@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/app/server/assets/authorize-C95F-9E1-CbESJKGU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-C95F-9E1-CbESJKGU.js","names":["core._coercedString","schemas.ZodString","core._coercedBoolean","schemas.ZodBoolean","hmac","hmac","createView","encoder","encode","encoder","encode","cache","encode","b64u","transform","b64u","encode","encode","verifySignature","REGEX","encoder","b64u","encode","encoder","b64u","encode","b64u","decodeBase64URL","b64u","signJWT","base64url.encode","algorithm","getCryptoKey","makeSignature","getBody","isAPIError","tryDecode","parseCookies","tryDecode","ValidationError","parseCookies","isJSONSerializable","isAPIError","ValidationError","isAPIError","isAPIError","getBody","isAPIError","base64url.encode","JWKS_CACHE_TTL_MS","makeSignature","z.ipv4","z.ipv6","z.validate","ensureAsyncStorage","z.object","z.string","z.date","z.coerce.string","z.date","z.string","z.string","z.boolean","APIError","z.optional","z.object","z.coerce.boolean","z.looseObject","z.number","z.string","z.object","z.record","z.unknown","signJWT","APIError","z.object","z.string","APIError","z.url","z.NEVER","z.record","z.string","z.unknown","z.looseObject","z.boolean","z.array","z.object","z.union","z.NEVER","z.enum","z.number","z.literal","z.never","APIError","base64url.encode","APIError$1","APIError","APIError$1","z.core.toDotPath","z.string","z.array","z.object","z.boolean","z.enum","z.union","z.number","z.record","z.unknown","z.literal","makeSignature","__exportAll$1","NEVER","validate","_coercedString","record","union","unknown","optional","string$1","literal","_enum","number","ipv6","ipv4","ZodString","toDotPath","url","boolean$1","ZodObject","ZodOptional","array","ZodBoolean","looseObject","object","never","_coercedBoolean","toBufferSource","__getBetterAuthGlobal","BetterCallError","anumber$1","abytes$1","ValidationError$1","clean$1","aoutput$1","kAPIErrorHeaderSymbol","isProduction","isTest","env","APIError","rotr","base64","shouldPublishLog","aexists$1","createRandomStringGenerator","ahash","createView$1","createHasher","oidNist","APIError$1","createWithSpan","safeJSONParse","getAuthTables","isDevelopment","ATTR_HTTP_ROUTE","encodeDeterministicId","hex","BetterAuthError","__getCurrentEndpointContext","logger","base64Url","runtimeSchemaCheckFor","string","params","boolean","__defProp","__exportAll","target","name","all","no_symbols","signedQueryIssuedAtParam","postLoginClearedParam","signedQueryParameterNameParam","canonicalizeOAuthQueryParams","canonicalParams","entries","keyA","valueA","keyB","valueB","key","value","setSignedOAuthQueryParameterNames","signedParameterNames","parameterName","getSignedQueryIssuedAt","raw","oauthQuery","issuedAt","_HMAC","hash","blockLen","pad","i","buf","out","to","finished","destroyed","outputLen","canXOF","oHash","iHash","hmac$1","hmac_","message","HKDF_COUNTER","EMPTY_BUFFER","expand","length","prk","olen","blocks","info","_recycled","okm","T","worker","counter","iWork","res","hkdf","salt","HMAC","ikm","fromNumH","n","fromNumL","setU64FromNum","h","l","view","byteOffset","isLE","Chi","a","b","c","Maj","HashMD","padOffset","data","len","processed","pos","take","dataView","buffer","oview","outLen","state","SHA256_IV","SHA256_K","SHA256_W","SHA2_32B","IV","A","B","C","D","E","F","G","H","offset","W15","W2","s0","s1","sigma1","T1","T2","_SHA256","sha256","encoder$1","decoder","strictDecoder","MAX_INT32","concat","buffers","size","acc","writeUInt32BE","uint64be","high","low","uint32be","NON_ASCII","encode$1","bytes","code","encodeBase64","input","CHUNK_SIZE","arr","encoded","decodeBase64","binary","digest","subtleDigest","algorithm","JOSEError","options","JWTClaimValidationFailed","claim","reason","payload","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWEDecryptionFailed","JWEInvalid","JWSInvalid","JWTInvalid","JWKInvalid","JWKSInvalid","JWKSNoMatchingKey","JWKSMultipleMatchingKeys","JWKSTimeout","JWSSignatureVerificationFailed","invalid","decode","cause","encode","assertUint8Array","label","isObject","prototype","isJwkSet","isDisjoint","headers","parameters","header","parameter","assertNotSet","decodeBase64url","ErrorClass","encodeBase64url","parseJoseHeader","parsed","b64","JWS_RECOGNIZED","JWE_RECOGNIZED","validateAlgorithms","algorithms","s","option","validateCritDuplicates","protectedHeader","crit","Err","validateCrit","joseHeader","recognized","recognizedOption","recognizedDefault","validateB64","extensions","serializeJoseHeader","serialized","tag","jwkMatchesOp","entry","expected","usage","alg","expectedKeyOp","prepareKey","privateKey","secret","normalized","keyObject","normalizeJwk","invalidKeyType","key_ops","isKeyLike","expectedType","isCryptoKey","cacheKey","cached","cache$1","isPublic","crv","nist","jwkToKey","assertCryptoKey","isKeyObject","types","last","actual","msg","invalidKeyInput","unusable","prop","checkUsage","checkModulusLength","modulusLength","checkCryptoKey","snapshotJwk","jwk","keyOps","operation","validateExtractableOption","extractable","isPrivate","keyData","rawKey","generateCek","enc","checkCekLength","cek","generateIv","checkIvLength","iv","cbcKeySetup","keySize","cbcHmacTag","macKey","macData","cbcEncrypt","encKey","ciphertext","plaintext","aad","timingSafeEqual","aHmac","cbcDecrypt","expectedTag","encrypt","encrypted","decrypt","table","wrap","derive","none","rsaes","bits","ecdh","asymmetricKeyType","kty","aeskw","gcm","pbes2","JWE","contentOps","contentEncryption","cbc","ENC","unsupported","jweAlgorithm","isJWECEKTransport","jweEncryption","checkEcdhCryptoKey","aeskwWrap","cryptoKey","cryptoKeyCek","aeskwUnwrap","encryptedKey","checkRsaKey","deriveKey","p2s","p2c","keylen","subtleAlg","lengthAndInput","concatKdf","dkLen","L","reps","dk","hashResult","Z","OtherInfo","ecdhesDeriveKey","publicKey","otherInfo","apu","apv","keyLength","assertEcdhKey","curve","partyInfo","checkPartyInfo","assertEncryptedKey","assertNoEncryptedKey","validateMaxPBES2Count","decryptKeyManagement","mode","direct","epk","ephemeralPublicKey","partyUInfo","partyVInfo","sharedSecret","maxPBES2Count","p2cLimit","encryptKeyManagement","transport","providedCek","inputKey","providedApu","providedApv","providedParameters","ephemeralKey","subtle","exportableEpk","y","wrapped","validateZip","supported","transform$1","writer","stream","chunks","reader","done","maxLength","compress","decompress","shareJWE","encodedProtected","jwe","parsedProt","prepareDecrypt","decryptJWE","additionalData","token","unprotected","keyManagementAlgorithms","contentEncryptionAlgorithms","maxDecompressedLength","shared","encodedKey","selected","integrated","encEntry","error","resolvedKey","algEntry","k","encryption","err","decompressionLimit","decryptCompact","checkDisjoint","unprotectedHeader","sharedUnprotectedHeader","checkEncryptHeaders","keyManagementParameters","sharedHeadersNormalized","encryptJWE","checked","inputPlaintext","inputProtectedHeader","inputUnprotectedHeader","inputIv","unprotectedParameters","protectedHeaderS","aadMember","createJWE","compactJWE","sig","hmac","rsa","saltLength","ecdsa","eddsa","mldsa","JWS","jwsAlgorithm","prepareVerify","parseProtectedHeader","encodeCompactUnencodedPayload","verifySignature$1","inputPayload","jws","parsedProtected","signingPayload","encodeUnencodedPayload","signature","verified","result","verifyCompact","compactVerify","epoch","date","multipliers","REGEX$1","checkFailed","invalidDuration","secs","str","matched","numericDate2","validateInput","validateStringClaim","validateAudienceClaim","member","numericDate","normalizeTyp","checkAudiencePresence","audPayload","audOption","aud","validateNumericDate","required","unexpectedClaim","validateClaimsSet","encodedPayload","typ","presenceCheck","requiredClaims","maxTokenAge","audience","subject","issuer","tolerance","clockTolerance","now","currentDate","iat","nbf","exp","age","max","producerPayloads","producerPayload","producer","jwtData","jwtClaim","JWTClaimsBuilder","jwtVerify","jwt","jwtDecrypt","createSignature","protectedHeaderString","rejectUnencoded","payloadS","payloadB","createCompactSignature","SignJWT_base","SignJWT","#protectedHeader","EncryptJWT_base","EncryptJWT","#input","#replicateIssuerAsHeader","#replicateSubjectAsHeader","#replicateAudienceAsHeader","algArgument","unsupportedAlg","source","keyAlgorithm","bytesEqual","createASN1State","readByte","byte","parseLength","first","lengthOfLen","expectTag","errorMessage","getSubarray","parseAlgorithmOID","parseKeyHeader","keyFormat","parseECAlgorithmIdentifier","algOid","curveOid","genericImport","processPEMData","pem","pattern","fromSPKI","exportJWK","check","description","calculateJwkThumbprint","digestAlgorithm","components","isUsableJWK","jwkKid","jwkAlg","ext","index","kid","use","importWithAlgCache","cache","pending","createLocalJWKSet","snapshot","jwks","metadata","candidates","jwk2","importSPKI","spki","importJWK","decodeProtectedHeader","protectedB64u","parts","decodeJwt","decoded","getModulusLengthOption","generateKeyPair","signJWT$1","expiresIn","verifyJWT","deriveEncryptionSecret","getCurrentSecret","getAllSecrets","version","symmetricEncodeJWT","encryptionSecret","thumbprint","jwtDecryptOpts","symmetricDecodeJWT","hasKid","secrets","constantTimeEqual","aBuffer","bBuffer","generateRandomString","getWebcryptoSubtle","cr","createHash","hashBuffer","encoding","isBytes","atitle","title","abool","anumber","abytes","ofLen","got","aobject","aexists","instance","checkFinished","aoutput","min","u32","clean","arrays","createView","byteSwap","word","byteSwap32","swap32IfBE","u","hasHexBuiltin","hexes","bytesToHex","asciiToBase16","ch","hexToBytes","hl","al","ai","hi","n1","n2","char","utf8ToBytes","overlapBytes","complexOverlapBytes","output","concatBytes","sum","checkOpts","defaults","opts","equalBytes","diff","wrapMacConstructor","mac","macCons","getArgs","fromMsg","macC","tmp","keyLen","args","wrapCipher","wrappedCipher","nonce","tagl","aadStart","cipher","constructor","checkOutput","fnLength","called","getOutput","expectedLength","onlyAligned","isAligned32","u64Lengths","dataLength","aadLength","num","copyBytes","randomBytes","bytesLength","managedNonce","fn","randomBytes_","nonceLength","addNonce","ct","decrypted","encodeStr","sigma16_32","sigma32_32","rotl","BLOCK_LEN","BLOCK_LEN32","MAX_COUNTER","U32_EMPTY","runCipher","block","b32","isAligned","d32","o32","core","sigma","rounds","pos32","j","posj","createCipher","counterLength","counterRight","allowShortKeys","hasOutput","toClean","k32","extendNonceFn","n16","sigmaRaw","nonceNcLen","nc","n32","u8to16","Poly1305","t0","t1","t2","t3","t4","t5","t6","t7","hibit","isLast","r0","r","r1","r2","r3","r4","r5","r6","r7","r8","r9","h0","h1","h2","h3","h4","h5","h6","h7","h8","h9","d0","d1","d2","d3","d4","d5","d6","d7","d8","d9","g","mask","f","opos","poly1305","chachaCore","y00","y01","y02","y03","y04","y05","y06","y07","y08","y09","y10","y11","y12","cnt","y13","y14","y15","x00","x01","x02","x03","x04","x05","x06","x07","x08","x09","x10","x11","x12","x13","x14","x15","oi","hchacha","s2","k2","i2","t","xchacha20","ZEROS16","updatePadded","leftover","ZEROS32","computeTag","AAD","authKey","lengths","xchacha20poly1305","plength","oPlain","xorStream","passedTag","algorithm$1","ENVELOPE_PREFIX","parseEnvelope","secondSep","formatEnvelope","rawEncrypt","keyAsBytes","dataAsBytes","rawDecrypt","chacha","symmetricEncrypt","symmetricDecrypt","envelope","getCryptoKey$1","secretBuf","makeSignature$1","getCryptoKey","verifySignature","signatureBinStr","base64Signature","makeSignature","signCookieValue","jsonContentTypeRegex","getBody$1","contentType","request","normalizedContentType","allowedMediaTypes","normalizedContentTypeBase","normalizedAllowed","allowed","formData","isAPIError$1","tryDecode$1","tryCatch","promise","isRequest","obj","COOKIE_PREFIXES","getCookieKey","prefix","parseCookies$1","cookies","eqIdx","endIdx","val","resolveCookie","resolvedName","resolvedOptions","lowerName","serializeCookieValue","cookie","serializeCookie","opt","serializeSignedCookie","runValidation","context","fromError","validating","x","createInternalContext","responseStatus","requestHeaders","requestCookies","parsedCookies","internalContext","path","finalKey","signatureStartPos","signedValue","status","body","routerResponse","json","middleware","response","isJSONSerializable$1","safeStringify","parents","ids","id","isAncestor","curr","holder","isJSONResponse","REQUEST_ONLY_HEADERS","stripRequestOnlyHeaders","copyHeaders","toResponse","init","safeHeaders","statusText","createEndpoint","pathOrOptions","handlerOrOptions","handler","handlerOrNever","internalHandler","inputCtx","validationError","onAPIError","combineMiddleware","local","configured","createConfiguredEndpoint","createMiddleware","_handler","optionsOrHandler","paths","getTypeFromZodType","zodType","getParameters","getRequestBody","shape","properties","getResponse","responses","generator","endpoints","_","config","getHTML","apiReference","NullProtoObj","createRouter","scanFirstGroup","depth","mod","hasMod","expandGroupDelimiters","group","pre","suf","UNNAMED_GROUP_PREFIX","ESCAPED_GROUP_PREFIX","toUnnamedGroupKey","toGroupName","fromGroupName","hasSegmentWildcard","segment","replaceSegmentWildcards","nextIndex","unnamedStart","replaced","toGroupKey","encodeEscapes","segmentKey","expandModifiers","segments","m","wc","without","normalizePath","splitPath","splitRoute","getMatchParams","paramsMap","match","addRoute","method","groupExpanded","expandedPath","ctx","expanded","p","node","_unnamedParamIndex","paramsRegexp","regexp","getParamRegexp","child","staticNode","hasParams","methods","_i","_s","_d","regex","findRoute","staticMatch","_lookupTree","_selectMatcher","staticChild","optionalOnly","pMap","best","bestWeight","lastOptional","weight","dynamicTerminal","regexps","findAllRoutes","matches","_findAll","pushSorted","start","w","rx","pm","createRouter$1","openapi","\"openapi\"","schema","router","middlewareRouter","endpoint","basePath","processRequest","pathname","route","query","middlewareRoutes","errorResponse","onReq","req","onRes","defineErrorCodes","codes","BASE_ERROR_CODES","parseScopeField","scope","getOAuth2Tokens","getDate","seconds","mergeScopes","existing","stored","next","incoming","getPrimaryClientId","clientId","generateCodeChallenge","codeVerifier","BASIC_AUTHORIZATION_PATTERN","formUrlEncode","formUrlDecode","encodeBasicCredentials","clientSecret","decodeBasicCredentials","authorization","separatorIndex","rawClientId","rawClientSecret","PRIVATE_KEY_JWT_SIGNING_ALGORITHMS","CLIENT_ASSERTION_TYPE","resolveClientAssertionParams","getClientAssertion","BetterFetchError","initializePlugins","hooks","plugin","pluginRes","LinearRetryStrategy","attempt","ExponentialRetryStrategy","createRetryStrategy","parseMethodModifier","separator","isReservedPathSegment","encodeLiteralPathSegment","part","resolvePathSegment","pathParam","pathParams","getURL$1","baseURL","requestPath","urlQuery","queryParams","serializedValue","paramPaths","queryParamString","getAuthHeader","getValue","\"authorization\"","username","password","JSON_RE","detectResponseType","_contentType","textTypes","isJSONParsable","isJSONSerializable","jsonParse","text","isFunction","getFetch","mergeHeaders","sources","merged","getHeaders","detectContentType","getMediaType","getBody","getMethod","getTimeout","abortTimeout","controller","ValidationError","issues","parseStandardSchema","_typeof","o","toPrimitive","e","toPropertyKey","_defineProperty","ownKeys","_objectSpread2","betterFetch","_options$body","__url","fetch","signal","_url","onRequest","clearTimeout","responseContext","onResponse","_options$hookOptions","responseType","successContext","onSuccess","_options$hookOptions2","parser","responseText","errorObject","errorContext","onError","_options$hookOptions3","retryStrategy","_retryAttempt","onRetry","delay","resolve","httpRedirectStatuses","isRedirectResponse","redirectRefused","noFollowRedirect","fetchRefusingRedirects","redirected","DPOP_PROOF_TYPE","DPOP_SIGNING_ALGORITHMS","DEFAULT_DPOP_PROOF_MAX_AGE_SECONDS","MAX_DPOP_JTI_LENGTH","JWK_PRIVATE_FIELDS","createDpopReplayStore","reservations","createDpopProofError","isDpopProofError","parseAccessTokenAuthorization","scheme","stripAccessTokenAuthorizationScheme","normalizeDpopHtu","deriveDpopAth","accessToken","deriveDpopJkt","getConfirmationJkt","confirmation","jkt","getDpopJktFromPayload","getStringClaim","getNumberClaim","assertSupportedDpopAlgorithm","signingAlgorithms","assertPublicJwk","field","deriveDpopReplayKey","reserveDpopReplay","replayStore","reservation","verifyDpopProof","proofJwt","htm","htu","jti","normalizedHtu","proofHtu","nowSeconds","proofMaxAgeSeconds","ath","requireAth","expectedJkt","replayKey","expiresAt","createDpopBindingError","isDpopBindingError","enforceDpopBinding","dpopJkt","jwksCache","functionJwksCache","JWKS_CACHE_TTL_MS$1","getFreshJwksWithKid","fetchJwks","jwksFetch","getJwks","getJwksForVerification","jwtHeaders","cachedJwks","fetchedAt","DEFAULT_GRANT_TYPES","BUILT_IN_CONFIDENTIAL_AUTH_METHODS","RESERVED_TOKEN_ENDPOINT_AUTH_METHODS","RESERVED_TOKEN_ENDPOINT_AUTH_METHOD_SET","assertNonEmptyExtensionValue","assertAbsoluteUri","assertExtensionGrantType","grantType","assertExtensionTokenEndpointAuthMethod","assertExtensionClientAssertionType","assertionType","collectExtensionKeys","grantTypes","extension","authMethods","assertionTypes","strategy","methodAssertionTypes","clientDiscoveryIds","discovery","clientDiscoveryId","assertNoDuplicateAcrossExtensions","seen","values","validateOAuthProviderExtensions","keys","getOAuthProviderExtensions","getClientDiscoveries","extendOAuthProvider","provider","getExtensionGrantTypes","getSupportedGrantTypes","getExtensionGrantHandler","getExtensionTokenEndpointAuthMethods","getSupportedAuthMethods","settings","isExtensionTokenEndpointAuthMethod","getExtensionClientAuthenticationStrategy","strategies","applyOAuthProviderMetadataExtensions","document","contribution","collectClaims","claims","run","collectExtensionAccessTokenClaims","collectExtensionIdTokenClaims","collectExtensionUserInfoClaims","hasUserInfoClaimExtension","parseBearerToken","credentials","extraParts","createTTLCache","getOAuthProviderPlugin","getJwtPlugin","normalizeTimestampValue","trimmed","numeric","resolveSessionAuthTime","nested","toResourceList","toAudienceClaim","trustedClientCaches","getTrustedClientCache","existingCache","verifyOAuthQueryParams","oauth_query","sigs","verifySig","getClient","trustedClientCache","trustedClient","dbClient","discoveries","candidate","resolved","mergeDiscoveryMetadata","d","defaultHasher","decryptStoredClientSecret","storageMethod","storedClientSecret","verifyStoredClientSecret","hashedClientSecret","decryptedClientSecret","storeClientSecret","storeToken","type","getStoredToken","BASIC_SCHEME_PREFIX","AUTH_SCHEME_TOKEN","parseAuthorizationScheme","CLIENT_AUTHENTICATION_FIELDS","throwInvalidAuthenticationRequest","errorDescription","normalizeClientAuthenticationParameters","fields","setEffectiveField","hasAuthorizationHeader","clientIds","hasClientSecret","hasClientAssertion","basicToClientCredentials","clientAllowsGrant","allowedGrants","client","validateClientScopes","scopes","validScopes","throwInvalidClient","attemptedBasicAuthentication","authentication","challengeScheme","validateClientCredentials","authMethod","registeredAuthMethod","preVerified","parseClientMetadata","destructureCredentials","extractClientCredentials","assertion","extensionStrategy","verify","authorize_C95F_9E1_exports","expectedAudience","authorizationScheme","parsePrompt","prompts","prompt","set","getSectorIdentifier","uri","computePairwiseSub","userId","resolveSubjectIdentifier","searchParamsToQuery","isSessionFreshForSignedQuery","signedQueryIssuedAt","sessionCreatedAt","removePromptFromQuery","nextQuery","foundPrompt","v","removeMaxAgeFromQuery","isPKCERequired","requestScopes","isOpenIdRequest","hasNonce","hasOidcNonce","isAPIError","cachedAsyncLocalStorageConstructor","availabilityWarningLogged","getBuiltinAsyncLocalStorage","getAsyncLocalStorage","builtinConstructor","getExistingEndpointContextStorage","getOrCreateEndpointContextStorage","AsyncLocalStorage","globalContext","tryGetCurrentAuthEndpointContext","getCurrentAuthEndpointContext","authEndpointContext","runWithEndpointContext","NO_STORE_HEADERS","attachResponseHeadersToAPIError","responseHeaders","optionsMiddleware","createAuthMiddleware","createEndpointWithAuthContext","wrapEndpointHandler","noStore","createAuthEndpoint","withServerOnly","escapeRegExpChar","escapeRegExpString","transform","separatorSplitter","separatorMatcher","wildcard","requiredSeparator","optionalSeparator","nextSegment","currentSeparator","isMatch","sample","wildcardMatch","regexpPattern","SLASH_CHAR_CODE","isLoopbackForDevScheme","hostname","host","trimTrailingSlashes","end","checkHasPath","assertHasProtocol","parsedUrl","withPath","trimmedUrl","validateProxyHeader","getBaseURL","loadEnv","fromEnv","fromRequest","fromRequestProto","trustedProxyHeaders","getOrigin","getProtocol","getHost","isDynamicBaseURLConfig","isRequestLike","getHostFromSource","forwardedHost","getProtocolFromSource","configProtocol","forwardedProto","matchesHostPattern","normalizedHost","normalizedPattern","resolveDynamicBaseURL","resolveBaseURL","normalizePathname","requestUrl","normalizedBasePath","URL_REFERENCE_ORIGIN","appendQueryParams","relative","parsedURL","DANGEROUS_URL_SCHEMES","ipv4Schema","ipv6Schema","isValidIP","isIPv4","ip","isIPv6","extractIPv4FromMapped","lower","ipv4Part","groups","expandIPv6","sides","left","right","missingGroups","zeros","paddedLeft","paddedRight","normalizeIPv6","subnetPrefix","bitsRemaining","masked","normalizeIP","ipToBytes","octet","mapped","CIDR_PREFIX_PATTERN","parseCIDR","slash","maxBits","prefixPart","matchesCIDR","ipBytes","net","findInvalidTrustedProxies","getIPFromHeader","forwardedIps","trustedProxies","proxy","selectedIp","LOCALHOST_IP","DEFAULT_IP_HEADERS","getIP","ipHeaders","createRateLimitKey","ensureAsyncStorage$1","betterAuthGlobal","hasRequestState","getCurrentRequestState","store","runWithRequestState","defineRequestState","ref","initialValue","initFn","ensureAsyncStorage","getCurrentAdapter","als","fallback","runWithAdapter","pendingHooks","hasError","hook","runWithTransaction","pendingSchemaCheck","adapter","trx","runPendingHooks","hookError","unhandledErrors","queueAfterTransactionHook","executeHook","storage","getRawOAuthState","setOAuthState","getOAuthState","getOAuthServerContext","setOAuthServerContext","addOAuthServerContext","getShouldSkipSessionRefresh","setShouldSkipSessionRefresh","hasServerSessionStore","hasServerAccountStore","shouldBindAccountCookieToSessionUser","coreSchema","sessionSchema","userSchema","filterOutputFields","additionalFields","returnFiltered","returned","getFields","modelName","tableCache","parseUserOutput","user","buildSyntheticUserOutput","fieldAttr","parseSessionOutput","session","parseAccountOutput","_accessToken","_refreshToken","_idToken","_accessTokenExpiresAt","_refreshTokenExpiresAt","_password","rest","account","parseInputData","action","parsedData","parseUserInput","parseAdditionalUserInputFromProviderProfile","allowedProfileFields","profile","parseSessionInput","getSessionDefaultFields","mergeSchema","newSchema","newModelName","newField","unit","span","tryDecode","SECURE_COOKIE_PREFIX","splitSetCookieHeader","setCookie","parseSetCookieHeader","nameValue","attributes","cookieString","valueParts","unquoteCookieValue","attrObj","attrName","attrValueParts","attribute","attrValue","normalizedAttrName","cookieNameRegex","cookieValueRegex","trimOWS","parseCookies","cookieMap","chunk","eq","MAX_COOKIE_SIZE","MAX_COOKIE_CHUNKS","getMaxCookieValueSize","parseCookieChunkIndex","cookieName","suffix","readExistingChunks","chunkCookie","chunkSize","chunkCount","storeName","getCleanCookies","cleanedChunks","cookieOptions","storeFactory","expireExistingChunks","expired","chunked","createSessionStore","createAccountStore","getChunkedCookie","cookieHeader","setAccountCookie","accountDataCookie","accountData","accountStore","getAccountCookie","accountCookie","getSessionQuerySchema","isPromise","SEC","MIN","HOUR","DAY","WEEK","MONTH","YEAR","REGEX","parse","ms","sec","cookieCachePayloadSchema","compactCookieCacheSchema","parseCookieCachePayload","parseCompactCookieCache","decoders","encoder","createHMAC","keyUsage","hmacKey","createCookieGetter","baseURLString","dynamicProtocol","secureCookiePrefix","crossSubdomainEnabled","domain","createCookie","overrideAttributes","getCookies","sessionToken","sessionData","dontRememberToken","setCookieCache","filteredSession","filteredUser","versionConfig","dontRememberMe","expiresAtDate","cookieCacheSigner","sessionStore","hasPendingSetCookie","expireCookie","decodeCookieCache","setSessionCookie","dontRememberMeCookie","maxAge","overrides","removeSetCookieEntries","scoped","targets","exact","survivors","deleteSessionCookie","cleanCookies","skipDontRememberMe","getSession","deferSessionRefresh","isPostRequest","cookieCacheEnabled","sessionCookieToken","sessionDataCookie","shouldUseCookieCache","sessionDataPayload","shouldExpireCookieCache","expectedVersion","cachedSessionExpiresAt","cookieRefreshCache","parsedSession","parsedUser","timeUntilExpiry","updateAge","shouldSkipSessionRefresh","refreshedSession","sessionTokenOptions","sessionTokenMaxAge","parsedRefreshedSession","parsedRefreshedUser","shouldBeUpdated","disableRefresh","needsRefresh","updatedSession","parsedUpdatedSession","isStateful","getSessionFromCtx","lowerKey","getAuthoritativeSessionFromCtx","sessionMiddleware","sensitiveSessionMiddleware","freshSessionMiddleware","createdAt","freshAge","listSessions","activeSessions","revokeSession","revokeSessions","revokeOtherSessions","otherSessions","ATTR_OPERATION_ID","ATTR_HOOK_TYPE","ATTR_CONTEXT","isPlainObject","_defu","baseObject","namespace","merger","createDefu","arguments_","defu","CLOUD_METADATA_HOSTS","stripBrackets","stripPort","firstColon","stripZoneId","zone","stripTrailingDot","looksLikeIPv4","ipv4ToUint32","inIPv4Range","classifyIPv4","extractEmbeddedIPv4","startGroup","g1","g2","combined","classifyIPv6","firstByte","secondByte","embedded","classifyHost","lowered","canonical","isLoopbackIP","isLoopbackHost","kind","isPublicRoutableHost","defuReplaceArrays","hooksSourceWeakMap","getOperationId","mergeResponseHeaders","mergeAPIErrorHeaders","ctxHeaders","errHeaders","runBeforeHooks","withSpan","modifiedContext","hookSource","operationId","hookReturn","runAfterHooks","getHooks","plugins","authContext","beforeHooks","afterHooks","beforeHookHandler","afterHookHandler","pluginBeforeHooks","pluginAfterHooks","dispatchAuthEndpoint","endpointMethod","defaultMethod","methodName","shouldReturnResponse","before","after","REVERSE_DOMAIN_PRIVATE_USE_SCHEME","NON_PRIVATE_USE_SCHEMES","isReverseDomainPrivateUseRedirectUri","schemeSpecificPart","isHostBearingPrivateUseRedirectUri","isNativePrivateUseRedirectUri","SafeUrlSchema","getJwksAdapter","baseAdapter","isLive","configAlg","webKey","toExpJWT","expirationTime","generateExportedKeyPair","cfg","createJwk","explicitCrv","derivedCrv","publicWebKey","stringifiedPrivateWebKey","privateWebKey","privateKeyEncryptionEnabled","resolveSigningKey","primaryAlg","preconfig","isPrimary","advertisedExtra","signJWT","defaultExp","baseURLOrigin","iss","defaultIss","defaultAud","jwtPayload","getJwtToken","RESERVED_ID_TOKEN_CLAIMS","stripReservedIdTokenClaims","stripped","safeClaims","claimRequestMemberSchema","acrClaimRequestMemberSchema","idTokenClaimsRequestSchema","oidcClaimsRequestObjectSchema","parseClaimsRequestValue","parseOidcClaimsRequestObject","claimsRequestParameterValueSchema","claimsRequestInputSchema","claimsRequestParameterSchema","isValidOidcClaimsRequest","getRequestedUserInfoClaims","userInfoClaims","names","supportedClaims","canSatisfyEssentialAcrRequest","claimsRequest","acrRequest","valueMatches","currentAcr","valuesMatch","filterClaimsRequestUserInfoClaims","allowedClaimSet","allowedUserInfoClaims","filteredClaimsRequest","splitDisplayName","STANDARD_CLAIMS","STANDARD_CLAIM_NAMES","getSupportedClaims","RESERVED_ACCESS_TOKEN_CLAIMS","stripReservedClaims","safe","resolveAccessTokenClaims","extensionClaims","pluginClaims","perRequestClaims","resourcePolicyClaims","DANGEROUS_SCHEMES","ResourceUriSchema","authorizationPromptTokenSchema","authorizationPromptSchema","promptTokens","promptSet","clientJwksSchema","maxAgeSchema","dpopJktSchema","authorizationQuerySchema","storedAuthorizationQuerySchema","verificationValueSchema","clientRegistrationRequestSchema","JWS_ALGORITHMS","JWS_ALGORITHM_SET","MAX_AUD_VALUES","checkIdentifier","customValidator","identifier","assertIdentifierValid","userInfoResource","extractRepeatedResourceFromForm","normalizeResourceParam","resource","isAudienceClaimAllowed","audienceClaim","audienceValues","implicitAudienceSet","implicitAudiences","resourcesToLookup","audienceValue","getResource","resolveResourcePolicy","requestedResources","includesOpenid","userInfoResourceIdentifier","uniqueRequestedResources","row","enforcePerClient","resolveEnforcePerClientResources","assertClientLinkedToResources","effectiveScopes","intersection","accessTokenTtl","refreshTokenTtl","uniqueSigningAlgs","uniqueSigningKids","signingAlgorithm","signingKeyId","mergedClaims","dpopBoundAccessTokensRequired","audienceIdentifiers","audClaim","resources","links","linkedSet","unlinked","isClientLinkedToAnyResource","resourceIdentifiers","getResourceCustomClaims","rows","rowByIdentifier","resourceCache","invalidateResourceCache","seedResourcesOnce","dbResource","defaultName","collectResourceInputs","inputs","buildSeedRow","buildSeedUpdate","_identifier","_createdAt","update","MISSING_TABLE_PATTERN","logStartupSeedFailure","missingTable","current","seedStates","getSeedState","adapterKey","byOptions","created","seedResources","rawInput","where","logEnforcePerClientResourcesResolution","getDpopProofJwt","getEndpointUrl","USER_DELEGATED_SCOPES","isUserDelegatedScope","normalizeClientCredentialsScopes","validateClientCredentialsScopes","tokenEndpointAuthMethod","providerScopes","invalidScopes","userNormalClaims","requested","requestedClaims","definition","pickClaims","base","getUserInfoAccessToken","headerAccessTokenAuthorization","bodyToken","accessTokenAuthorization","userInfoEndpoint","requireActiveAccessTokenWithClaims","baseUserClaims","extensionUserClaims","additionalInfoUserClaims","ID_TOKEN_SCOPE_CLAIM_GUARDS","confirmationTokenType","JWT_ACCESS_TOKEN_TYPE","tokenEndpoint","handleAuthorizationCodeGrant","handleClientCredentialsGrant","handleRefreshTokenGrant","getOAuthProviderApi","createUserTokens","introspect_exports","validateAccessToken","requireActiveAccessToken","createJwtAccessToken","jwtPluginOptions","computeOidcHash","hashAlg","signingAlg","createIdToken","resolvedSub","authTimeSec","authTime","customClaims","atHash","emitSid","sessionId","additiveClaims","extraClaims","idToken","encodeRefreshToken","decodeRefreshToken","createOpaqueAccessToken","requestedUserInfoClaims","invalidateRefreshFamily","refreshTokens","revokeTokensIssuedForAuthorizationCode","deleteIssuedTokens","authorizationCodeId","createRefreshToken","newRow","originalRefresh","rotatedAt","rotationUpdate","reuseInterval","resolveResourceGrantIssuance","resourcePolicy","resourceExpiresAtSeconds","refreshTokenDefaultTtl","throwInvalidDpopProof","clientRequiresDpopBoundAccessTokens","resolveDpopTokenBinding","authCodeDpopJkt","refreshJkt","dpopProofJwt","dpopRequired","normalizeReplayValues","sameReplayValues","normalizedLeft","normalizedRight","confirmationReplayKey","sameConfirmation","isConfirmation","isTokenType","isOAuthTokenResponse","isRefreshTokenRotationReplay","replay","buildRefreshTokenRotationReplayRequest","sameRefreshTokenRotationReplayRequest","encryptRefreshTokenRotationReplay","decryptRefreshTokenRotationReplay","isWithinRefreshTokenReuseInterval","refreshToken","storeRefreshTokenRotationReplay","getRefreshTokenRotationReplay","resolveRefreshTokenRotationReplayRequest","grantIssuance","replayRefreshTokenRotationResponse","existingRefreshToken","scopeExp","sc","prev","refreshTokenExp","isRefreshToken","isJwtAccessToken","isIdToken","additionalIdTokenClaims","customFields","refreshResources","earlyRefreshToken","referenceId","accessTokenClaims","responseBody","checkVerificationValue","verification","rawValue","verificationValue","client_id","boundRedirectUri","redirect_uri","storedResources","effectiveResources","requestedSet","authorizedSet","client_secret","isAuthCodeWithSecret","isAuthCodeWithPkce","code_verifier","pkceUsedInAuth","pkceUsedInToken","authorizedResources","clientCredentialsScopes","requestedScopes","refresh_token","decodedRefresh","requestedScope","introspectEndpoint","INVALID_ACCESS_TOKEN_ERROR_DESCRIPTION","INVALID_ACCESS_TOKEN_WWW_AUTHENTICATE","inactiveAccessToken","audienceResourceIdentifiers","userInfoAud","isIntrospectionAuthorized","introspectingClientId","issuerClientId","audienceResources","validateJwtAccessToken","jwtPlugin","expectedIssuer","rawAud","validateOpaqueAccessToken","tokenValue","validateRefreshToken","createInvalidAccessTokenError","isInactiveTokenError","resolveAccessTokenValidation","resolveIntrospectionSub","issuingClient","introspectingClient","token_type_hint","PACKAGE_VERSION","isBrowserFetchRequest","metadataResponse","oauthAuthorizationServerMetadata","oidcServerMetadata","oauthProvider","validatePublicClientJwks","DEFAULT_OAUTH_SCOPES","client_assertion_exports","getOAuthProviderState","consumeClientAssertion","getIssuer","authServerMetadata","consentEndpoint","oauthRequest","oAuthState","_query","originalRequestedScopes","originalRequestedUserInfoClaims","acceptedClaims","acceptedUserInfoClaims","formatErrorURL","hasLoginPrompt","hasSatisfiedLoginPrompt","authorize","foundConsent","consent","authorizationQuery","continueEndpoint","postLogin","BACKCHANNEL_LOGOUT_EVENT_URI","LOGOUT_TOKEN_JWT_TYP","LOGOUT_TOKEN_LIFETIME_SECONDS","BACKCHANNEL_DISPATCH_TIMEOUT_MS","signLogoutToken","prepareBackchannelLogoutPlan","accessTokens","affectedClientIds","clients","accessToRevokeIds","refreshToRevokeIds","eligibleClients","applyBackchannelLogoutPlan","revokedAt","revocations","plan","deliverBackchannelLogoutTokens","LOGOUT_CONFIRMATION_TTL_SECONDS","LOGOUT_CONFIRMATION_COOKIE_SUFFIX","escapeHtml","character","isBrowserNavigation","accept","logoutPage","logoutConfirmationPath","logoutConfirmationCookiePath","logoutConfirmationPage","logoutSuccessPage","note","logoutErrorPage","logoutProtocolError","logoutConfirmationCookieName","logoutConfirmationCookieOptions","setLogoutConfirmationState","getLogoutConfirmationState","clearLogoutConfirmationState","getCurrentBrowserSession","findHintedSession","deleteLogoutSession","getLogoutClient","normalizeLogoutAudiences","getHintClientId","audiences","resolveHintClient","hint","verifyLogoutHint","verifiedPayload","getRegisteredLogoutRedirect","requestedURI","redirectURI","getLogoutConfirmationContext","getConfirmedLogoutRedirect","confirmationRequired","currentSession","completeConfirmedLogout","redirect","handleRedirect","rpInitiatedLogoutEndpoint","idTokenPayload","hintedSession","matchesCurrentSession","sessionToDelete","rpInitiatedLogoutConfirmationEndpoint","backchannelSupported","validateIssuerUrl","buildAuthServerMetadata","clientDiscoveries","publicClientSupported","authMetadata","primary","extras","METADATA_CACHE_CONTROL","extraHeaders","createOAuthEndpoint","userHook","redirectOnError","mapIssuesToOAuthError","errorCodesByField","defaultError","bodySchema","querySchema","forwarded","validateSlot","slot","issue","fieldKey","mapping","resolveErrorCode","describeIssue","isMissingValueIssue","publicSessionMiddleware","EC_PRIVATE_KEY_JWT_ALGORITHM_BY_CURVE","OKP_PRIVATE_KEY_JWT_SIGNING_CURVES","PRIVATE_JWK_MEMBER_NAMES","isRecord$1","hasStringMember","memberName","isSupportedEcSigningCurve","isSupportedOkpSigningCurve","signingCurve","isSupportedPublicJwk","hasSupportedPrivateKeyJwtAlgorithm","OAUTH_CLIENT_RECORD_FIELD_NAMES","OAUTH_CLIENT_WIRE_FIELD_NAMES","OPAQUE_METADATA_RESERVED_FIELDS","stripReservedOAuthClientMetadataExtensions","assertClientPrivileges","assertResourcePrivileges","isPrivateHostname","verifyClientAssertion","jwksCaches","JWKS_CACHE_TTL_MS","JWKS_CACHE_MAX_ENTRIES","JWKS_FETCH_TIMEOUT_MS","MAX_JWKS_RESPONSE_BYTES","JSON_CONTENT_TYPE","setJwksCache","oldest","getJwksCache","getJwksCacheKey","ALGORITHMS_LIST","validateJwksUri","jwksUri","clientIdUrlOrigin","urlClientIdOrigin","readBoundedResponseBody","contentLength","totalBytes","fetchJwksFromUri","timeout","fetchClientMetadataResource","parsedBody","createClientJwksFetchError","fetchClientJwks","staleLimitMs","refetchClientJwks","maxLifetime","jtiDigest","jtiId","createErr","alreadyUsed","clientAssertionType","clientAssertion","unverified","clientIdHint","endpointAudience","issuerAudience","acceptedAudiences","verifyOpts","verifyErr","refreshed","acceptedAudience","registrationBearerError","authorizeInitialAccessToken","initialAccessToken","DEFAULT_REGISTRATION_GRANT_TYPES","resolveClientRegistrationScopes","resolveRegistrationGrantTypes","resolveRegistrationResponseTypes","applyOAuthClientRegistrationDefaults","defaultApplicationType","isCustomSchemeWithHost","redirectUri","isNonHttpRedirectUri","protocol","resolveDynamicRegistrationDefaultApplicationType","invalidRedirectUri","getRawHttpHostname","authority","hostAndPort","bracketEnd","assertDynamicRegistrationResourcesAllowed","allowedResources","resolveClientRegistrationResources","defaultResources","validateClientRedirectUri","isHttp","isHttps","isRedirectLoopback","rawHttpHostname","applicationType","assertValidRegistrationJwks","registerEndpoint","tokenAuthorization","isTokenAuthorized","createOAuthClientRegistration","checkOAuthClient","isClientMetadataDocument","clientWithDefaults","responseTypes","supportedGrantTypes","validatesRegistrationMetadata","allowedScopes","CLIENT_REGISTRATION_COLLISION","persistOAuthClientRegistration","registrationMetadata","isPrivateKeyJwt","isExtensionAuthMethod","isPKCEOptionalForRegisteredClient","requirePKCE","_requestedResources","persistableBody","owner","oauthToSchema","clientModel","clientResourceModel","existingClient","persistenceResult","storedClient","updatedClient","isUniqueConstraintError","linkedResources","linkedResourceIds","link","resourceId","createOAuthClientRegistrationResponse","schemaToOAuth","createOAuthClientAdministrativeResponse","createOAuthClientAdministrativeRegistration","createOAuthClientEndpoint","rawClientCredentialsScopes","registrationInput","_expiresAt","_scope","icon","tos","policy","inputJwks","softwareId","softwareVersion","softwareStatement","redirectUris","postLogoutRedirectUris","backchannelLogoutUri","backchannelLogoutSessionRequired","skipConsent","enableEndSession","dpopBoundAccessTokens","subjectType","inputMetadata","metadataObj","_updatedAt","_scopes","contacts","disabled","getClientEndpoint","getClientPublicEndpoint","getClientsEndpoint","deleteClientEndpoint","updateClientEndpoint","updates","ownsClient","isCrossOwnerScopeConfiguration","finalGrantTypes","finalTokenEndpointAuthMethod","schemaUpdates","rotateClientSecretEndpoint","tokenEndpointAuthMethodSchema","grantTypesSchema","adminCreateOAuthClient","createOAuthClient","getOAuthClient","getOAuthClientPublic","getOAuthClientPublicPrelogin","getOAuthClients","adminUpdateOAuthClient","updateOAuthClient","rotateClientSecret","deleteOAuthClient","getConsent","getConsentEndpoint","getConsentsEndpoint","deleteConsentEndpoint","updateConsentEndpoint","getOAuthConsent","getOAuthConsents","updateOAuthConsent","deleteOAuthConsent","resourceModel","linkModel","decodePathParam","buildResourceRow","createResourceEndpoint","listResourcesEndpoint","getResourceByIdentifierEndpoint","updateResourceEndpoint","deleteResourceEndpoint","linkClientResourceEndpoint","unlinkClientResourceEndpoint","resourceBodySchema","adminCreateOAuthResource","adminListOAuthResources","adminGetOAuthResource","adminUpdateOAuthResource","adminDeleteOAuthResource","adminLinkClientResource","adminUnlinkClientResource","revokeJwtAccessToken","userInfoAudience","revokeOpaqueAccessToken","revokeRefreshToken","revokeAccessToken","revokeEndpoint","rpInitiatedLogoutRequestSchema","backchannelLogoutPlansByContext","signedQueryIssuedAtMsKey","getServerContextSignedQueryIssuedAt","issuedAtMs","clientRegistrationAllowedScopes","_allowedScopes","configuredResourceIdentifiers","optionName","identifiers","handleIssuerMetadataRequest","requestPathname","issuerPath","endpointCtx","authServerMetadataPaths","openIdConfigPath","isAuthServerMetadataRequest","isOpenIdConfigRequest","createMetadataResponse","oauth2AuthorizeEndpoint","authorizeRedirectOnError","authorizeEndpoint","runOAuth2Authorize","isDynamicBaseURLInit","hookCtx","logoutPlanBySessionId","logoutTask","postLoginClearedForSession","serverContext","secFetchMode","acceptHeader","repeated","isWithinMaxAge","maxAgeSeconds","removeMaxAgeFromAuthorizationQuery","_maxAge","queryWithoutMaxAge","searchParams","deriveResponseMode","responseMode","authorizationQueryErrorCodesByField","isRecord","getStringParameter","getAuthorizationRequestParameters","fromFetch","acceptJson","redirectWithPromptNoneError","getErrorURL","stripLoopbackRedirectPort","isLoopback","schemeSeparatorIndex","authorityStart","authorityEndOffset","authorityEnd","portStart","closingBracket","port","portStartInUri","findRegisteredRedirectUri","registered","requestedUrl","hasFragment","hasUserinfo","requestedWithoutPort","isSafeCustomRedirectUri","resolveTrustedRedirectUri","registeredUris","trusted","error_description","requestObject","requestUri","resolvedParams","urlClientId","parsedQuery","mappedError","serializeAuthorizationQuery","promptNone","isValidRedirectUri","defaultResult","openidRequested","pkceRequired","hasSatisfiedMaxAge","redirectWithPromptCode","signupRedirect","redirectWithAuthorizationCode","consentedResources","requestedResource","redirectUriWithCode","signParams","flags"],"sources":["../../../../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/coerce.js","../../../../../node_modules/.pnpm/@better-auth+oauth-provider@1.7.8_@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@bet_a9f2bc837da41095445a0377e1cf646a/node_modules/@better-auth/oauth-provider/dist/rolldown-runtime-wcPFST8Q.mjs","../../../../../node_modules/.pnpm/@better-auth+oauth-provider@1.7.8_@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@bet_a9f2bc837da41095445a0377e1cf646a/node_modules/@better-auth/oauth-provider/dist/signed-query-Df1MNiSH.mjs","../../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/hmac.js","../../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/hkdf.js","../../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js","../../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js","../../../../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/sha2.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/content_encryption.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_algorithms.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_management.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/deflate.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_decrypt.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_encrypt.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jws/compact/verify.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/decrypt.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_sign.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/sign.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/encrypt.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_algorithm.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/asn1.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/export.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwk/thumbprint.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/local.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/import.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_protected_header.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_jwt.js","../../../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/generate_key_pair.js","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/crypto/jwt.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/crypto/buffer.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/crypto/random.mjs","../../../../../node_modules/.pnpm/@better-auth+utils@0.5.0/node_modules/@better-auth/utils/dist/index.mjs","../../../../../node_modules/.pnpm/@better-auth+utils@0.5.0/node_modules/@better-auth/utils/dist/hash.mjs","../../../../../node_modules/.pnpm/@noble+ciphers@2.4.0/node_modules/@noble/ciphers/utils.js","../../../../../node_modules/.pnpm/@noble+ciphers@2.4.0/node_modules/@noble/ciphers/_arx.js","../../../../../node_modules/.pnpm/@noble+ciphers@2.4.0/node_modules/@noble/ciphers/_poly1305.js","../../../../../node_modules/.pnpm/@noble+ciphers@2.4.0/node_modules/@noble/ciphers/chacha.js","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/crypto/index.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/crypto.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/utils.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/cookies.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/validator.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/context.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/to-response.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/endpoint.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/middleware.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/openapi.mjs","../../../../../node_modules/.pnpm/rou3@0.9.2/node_modules/rou3/dist/index.mjs","../../../../../node_modules/.pnpm/better-call@1.4.2_zod@4.6.7/node_modules/better-call/dist/router.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/error-codes.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/error/codes.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/oauth2/utils.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/oauth2/basic-credentials.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/oauth2/client-assertion.mjs","../../../../../node_modules/.pnpm/@better-fetch+fetch@1.3.2/node_modules/@better-fetch/fetch/dist/index.js","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/oauth2/reject-redirects.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/oauth2/dpop.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/oauth2/verify.mjs","../../../../../node_modules/.pnpm/@better-auth+oauth-provider@1.7.8_@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@bet_a9f2bc837da41095445a0377e1cf646a/node_modules/@better-auth/oauth-provider/dist/utils-CGIZS-Da.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/is-api-error.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/async_hooks/index.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/context/endpoint-context.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/api/index.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/utils/wildcard.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/utils/url.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/url.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/ip.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/context/request-state.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/context/transaction.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/api/state/oauth.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/api/state/should-session-refresh.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/context/store-capabilities.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/db/schema/shared.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/db/schema/session.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/db/schema/user.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/db.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/db/schema.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/utils/date.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/cookies/cookie-utils.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/cookies/session-store.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/utils/is-promise.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/utils/time.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/cookies/cache.mjs","../../../../../node_modules/.pnpm/@better-auth+utils@0.5.0/node_modules/@better-auth/utils/dist/binary.mjs","../../../../../node_modules/.pnpm/@better-auth+utils@0.5.0/node_modules/@better-auth/utils/dist/hmac.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/cookies/index.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/api/routes/session.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/instrumentation/attributes.mjs","../../../../../node_modules/.pnpm/defu@6.1.7/node_modules/defu/dist/defu.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/host.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/api/dispatch.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/redirect-uri.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/plugins/jwt/adapter.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/plugins/jwt/utils.mjs","../../../../../node_modules/.pnpm/better-auth@1.7.8_@tanstack+react-start@1.168.60_@voidzero-dev+vite-plus-core@1.2.0_@ty_d7f44717d4a32b4e04105c42076a65b3/node_modules/better-auth/dist/plugins/jwt/sign.mjs","../../../../../node_modules/.pnpm/@better-auth+oauth-provider@1.7.8_@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@bet_a9f2bc837da41095445a0377e1cf646a/node_modules/@better-auth/oauth-provider/dist/introspect-H3uoUiuS.mjs","../../../../../node_modules/.pnpm/@better-auth+oauth-provider@1.7.8_@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@bet_a9f2bc837da41095445a0377e1cf646a/node_modules/@better-auth/oauth-provider/dist/version-BPS0os17.mjs","../../../../../node_modules/.pnpm/@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_better-call@_e244494d16af5cbfc2a915ab801404c3/node_modules/@better-auth/core/dist/utils/fetch-metadata.mjs","../../../../../node_modules/.pnpm/@better-auth+oauth-provider@1.7.8_@better-auth+core@1.7.8_@better-auth+utils@0.5.0_@bet_a9f2bc837da41095445a0377e1cf646a/node_modules/@better-auth/oauth-provider/dist/authorize-C95F-9E1.mjs"],"sourcesContent":["import * as core from \"../core/index.js\";\nimport * as schemas from \"./schemas.js\";\nexport function string(params) {\n    return core._coercedString(schemas.ZodString, params);\n}\nexport function number(params) {\n    return core._coercedNumber(schemas.ZodNumber, params);\n}\nexport function boolean(params) {\n    return core._coercedBoolean(schemas.ZodBoolean, params);\n}\nexport function bigint(params) {\n    return core._coercedBigint(schemas.ZodBigInt, params);\n}\nexport function date(params) {\n    return core._coercedDate(schemas.ZodDate, params);\n}\n","//#region \\0rolldown/runtime.js\nvar __defProp = Object.defineProperty;\nvar __exportAll = (all, no_symbols) => {\n\tlet target = {};\n\tfor (var name in all) __defProp(target, name, {\n\t\tget: all[name],\n\t\tenumerable: true\n\t});\n\tif (!no_symbols) __defProp(target, Symbol.toStringTag, { value: \"Module\" });\n\treturn target;\n};\n//#endregion\nexport { __exportAll as t };\n","//#region src/signed-query.ts\nconst signedQueryIssuedAtParam = \"ba_iat\";\nconst postLoginClearedParam = \"ba_pl\";\nconst signedQueryParameterNameParam = \"ba_param\";\nfunction canonicalizeOAuthQueryParams(params) {\n\tconst canonicalParams = new URLSearchParams();\n\tconst entries = [...params.entries()].sort(([keyA, valueA], [keyB, valueB]) => {\n\t\tif (keyA < keyB) return -1;\n\t\tif (keyA > keyB) return 1;\n\t\tif (valueA < valueB) return -1;\n\t\tif (valueA > valueB) return 1;\n\t\treturn 0;\n\t});\n\tfor (const [key, value] of entries) canonicalParams.append(key, value);\n\treturn canonicalParams;\n}\nfunction setSignedOAuthQueryParameterNames(params) {\n\tparams.delete(signedQueryParameterNameParam);\n\tconst signedParameterNames = [...new Set([...params.keys(), signedQueryParameterNameParam])].sort();\n\tfor (const parameterName of signedParameterNames) params.append(signedQueryParameterNameParam, parameterName);\n}\nfunction getSignedOAuthQueryParameterNames(params) {\n\tconst signedParameterNames = params.getAll(signedQueryParameterNameParam);\n\tif (!signedParameterNames.length) return;\n\treturn new Set(signedParameterNames);\n}\nfunction buildSignedOAuthQuery(search) {\n\tconst params = new URLSearchParams(search);\n\tif (!params.has(\"sig\")) return;\n\tconst signedParameterNames = getSignedOAuthQueryParameterNames(params);\n\tif (!signedParameterNames) return;\n\tconst signedParams = new URLSearchParams();\n\tfor (const [key, value] of params.entries()) if (key === \"sig\" || key === signedQueryParameterNameParam || signedParameterNames.has(key)) signedParams.append(key, value);\n\treturn signedParams.toString();\n}\nfunction getSignedQueryIssuedAt(oauthQuery) {\n\tconst raw = new URLSearchParams(oauthQuery).get(signedQueryIssuedAtParam);\n\tif (!raw) return null;\n\tconst issuedAt = Number(raw);\n\tif (!Number.isFinite(issuedAt) || issuedAt <= 0) return null;\n\treturn new Date(issuedAt);\n}\n//#endregion\nexport { setSignedOAuthQueryParameterNames as a, postLoginClearedParam as i, canonicalizeOAuthQueryParams as n, signedQueryIssuedAtParam as o, getSignedQueryIssuedAt as r, buildSignedOAuthQuery as t };\n","/**\n * HMAC: RFC2104 message authentication code.\n * @module\n */\nimport { abytes, aexists, ahash, aoutput, clean, } from \"./utils.js\";\n/**\n * Internal class for HMAC.\n * Accepts any byte key, although RFC 2104 §3 recommends keys at least\n * `HashLen` bytes long.\n */\nexport class _HMAC {\n    oHash;\n    iHash;\n    blockLen;\n    outputLen;\n    canXOF = false;\n    finished = false;\n    destroyed = false;\n    constructor(hash, key) {\n        ahash(hash);\n        abytes(key, undefined, 'key');\n        this.iHash = hash.create();\n        if (typeof this.iHash.update !== 'function')\n            throw new Error('expected Hash instance');\n        this.blockLen = this.iHash.blockLen;\n        this.outputLen = this.iHash.outputLen;\n        const blockLen = this.blockLen;\n        const pad = new Uint8Array(blockLen);\n        // blockLen can be bigger than outputLen\n        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36;\n        this.iHash.update(pad);\n        // By doing update (processing of the first block) of the outer hash here,\n        // we can re-use it between multiple calls via clone.\n        this.oHash = hash.create();\n        // Undo internal XOR && apply outer XOR\n        for (let i = 0; i < pad.length; i++)\n            pad[i] ^= 0x36 ^ 0x5c;\n        this.oHash.update(pad);\n        clean(pad);\n    }\n    update(buf) {\n        aexists(this);\n        this.iHash.update(buf);\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        aoutput(out, this);\n        this.finished = true;\n        const buf = out.subarray(0, this.outputLen);\n        // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before\n        // overwriting that same prefix with the final tag, leaving any oversized tail untouched.\n        this.iHash.digestInto(buf);\n        this.oHash.update(buf);\n        this.oHash.digestInto(buf);\n        this.destroy();\n    }\n    digest() {\n        const out = new Uint8Array(this.oHash.outputLen);\n        this.digestInto(out);\n        return out;\n    }\n    _cloneInto(to) {\n        // Create new instance without calling constructor since the key\n        // is already in state and we don't know it.\n        to ||= Object.create(Object.getPrototypeOf(this), {});\n        const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;\n        to = to;\n        to.finished = finished;\n        to.destroyed = destroyed;\n        to.blockLen = blockLen;\n        to.outputLen = outputLen;\n        to.canXOF = canXOF;\n        to.oHash = oHash._cloneInto(to.oHash);\n        to.iHash = iHash._cloneInto(to.iHash);\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n    destroy() {\n        this.destroyed = true;\n        this.oHash.destroy();\n        this.iHash.destroy();\n    }\n}\nexport const hmac = /* @__PURE__ */ (() => {\n    const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());\n    hmac_.create = (hash, key) => new _HMAC(hash, key);\n    return hmac_;\n})();\n","/**\n * HKDF (RFC 5869): extract + expand in one step.\n * See {@link https://soatok.blog/2021/11/17/understanding-hkdf/}.\n * @module\n */\nimport { hmac } from \"./hmac.js\";\nimport { abytes, ahash, anumber, clean } from \"./utils.js\";\n/**\n * HKDF-extract from spec. Less important part. `HKDF-Extract(IKM, salt) -> PRK`\n * Arguments position differs from spec (IKM is first one, since it is not optional)\n * Local validation only checks `hash`; `ikm` / `salt` byte validation is delegated to `hmac()`.\n * @param hash - hash function that would be used (e.g. sha256)\n * @param ikm - input keying material, the initial key\n * @param salt - optional salt value (a non-secret random value)\n * @returns Pseudorandom key derived from input keying material.\n * @example\n * Run the HKDF extract step.\n * ```ts\n * import { extract } from '@noble/hashes/hkdf.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * extract(sha256, new Uint8Array([1, 2, 3]), new Uint8Array([4, 5, 6]));\n * ```\n */\nexport function extract(hash, ikm, salt) {\n    ahash(hash);\n    // NOTE: some libraries treat zero-length array as 'not provided';\n    // we don't, since we have undefined as 'not provided'\n    // https://github.com/RustCrypto/KDFs/issues/15\n    if (salt === undefined)\n        salt = new Uint8Array(hash.outputLen);\n    return hmac(hash, salt, ikm);\n}\n// Shared mutable scratch byte for the RFC 5869 block counter `N`.\n// Safe to reuse because `expand()` is synchronous and resets it with `clean(...)` before returning.\nconst HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);\n// Shared RFC 5869 empty string for both `info === undefined` and the first-block `T(0)` input.\nconst EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();\n/**\n * HKDF-expand from the spec. The most important part. `HKDF-Expand(PRK, info, L) -> OKM`\n * @param hash - hash function that would be used (e.g. sha256)\n * @param prk - a pseudorandom key of at least HashLen octets\n *   (usually, the output from the extract step)\n * @param info - optional context and application specific information (can be a zero-length string)\n * @param length - length of output keying material in bytes.\n *   RFC 5869 §2.3 allows `0..255*HashLen`, so `0` returns an empty OKM.\n * @param _recycled - Internal destroyed extract hashes owned by the combined `hkdf()` call.\n * @returns Output keying material with the requested length.\n * @throws If the requested output length exceeds the HKDF limit\n *   for the selected hash. {@link Error}\n * @example\n * Run the HKDF expand step.\n * ```ts\n * import { expand } from '@noble/hashes/hkdf.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * expand(sha256, new Uint8Array(32), new Uint8Array([1, 2, 3]), 16);\n * ```\n */\nexport function expand(hash, prk, info, length = 32, _recycled) {\n    ahash(hash);\n    anumber(length, 'length');\n    abytes(prk, undefined, 'prk');\n    const olen = hash.outputLen;\n    // RFC 5869 §2.3: PRK is \"a pseudorandom key of at least HashLen octets\".\n    if (prk.length < olen)\n        throw new Error('\"prk\" must be at least HashLen octets');\n    // RFC 5869 §2.3 only bounds `L` by `<= 255*HashLen`; `L=0` is valid and yields empty OKM.\n    if (length > 255 * olen)\n        throw new Error('Length must be <= 255*HashLen');\n    const blocks = Math.ceil(length / olen);\n    if (info === undefined)\n        info = EMPTY_BUFFER;\n    else\n        abytes(info, undefined, 'info');\n    if (!blocks) {\n        if (_recycled)\n            clean(prk); // Full hkdf() owns this intermediate PRK.\n        return new Uint8Array();\n    }\n    // first L(ength) octets of T\n    // The private PRK can become both T and a one-block result after HMAC consumes the key.\n    const okm = _recycled && blocks === 1 ? prk : new Uint8Array(blocks * olen);\n    const { iHash, oHash } = hmac.create(hash, prk);\n    // Driving them directly also skips `_HMAC.digestInto`'s per-digest destroy.\n    const T = _recycled ? prk : new Uint8Array(olen);\n    // Full hkdf() donates one destroyed extract hash; standalone creates one alternating worker.\n    const worker = blocks > 1 ? _recycled?.iHash || hash.create() : undefined;\n    for (let counter = 0; counter < blocks - 1; counter++) {\n        HKDF_COUNTER[0] = counter + 1;\n        const iWork = iHash._cloneInto(worker);\n        // T(0) = empty string (zero length)\n        // T(N) = HMAC-Hash(PRK, T(N-1) | info | N)\n        if (counter)\n            iWork.update(T);\n        iWork.update(info).update(HKDF_COUNTER).digestInto(T);\n        oHash._cloneInto(worker).update(T).digestInto(T);\n        okm.set(T, olen * counter);\n    }\n    // Midstates are key-equivalent: they allow computing HMAC(prk, ...) for any message.\n    HKDF_COUNTER[0] = blocks; // Final block consumes them; retain worker for cleanup.\n    if (blocks > 1)\n        iHash.update(T);\n    iHash.update(info).update(HKDF_COUNTER).digestInto(T);\n    oHash.update(T).digestInto(T);\n    okm.set(T, olen * (blocks - 1));\n    iHash.destroy(); // Raw digests may leave key-derived base/worker state; wipe all explicitly.\n    oHash.destroy();\n    worker?.destroy();\n    if (T !== okm)\n        clean(T); // Wipe private T/PRK; standalone preserves caller-owned PRK.\n    clean(HKDF_COUNTER);\n    // Exact fit: return without the extra copy.\n    if (length === okm.length)\n        return okm;\n    // Copy the requested prefix, then wipe the full buffer: its tail holds\n    // up to HashLen-1 bytes of derived key material past `length`.\n    const res = okm.slice(0, length);\n    clean(okm);\n    return res;\n}\n/**\n * HKDF (RFC 5869): derive keys from an initial input.\n * Combines hkdf_extract + hkdf_expand in one step\n * @param hash - hash function that would be used (e.g. sha256)\n * @param ikm - input keying material, the initial key\n * @param salt - optional salt value (a non-secret random value)\n * @param info - optional context and application specific information bytes\n * @param length - length of output keying material in bytes.\n *   RFC 5869 §2.3 allows `0..255*HashLen`, so `0` returns an empty OKM.\n * @returns Output keying material derived from the input key.\n * @throws If the requested output length exceeds the HKDF limit\n *   for the selected hash. {@link Error}\n * @example\n * HKDF (RFC 5869): derive keys from an initial input.\n * ```ts\n * import { hkdf } from '@noble/hashes/hkdf.js';\n * import { sha256 } from '@noble/hashes/sha2.js';\n * import { randomBytes, utf8ToBytes } from '@noble/hashes/utils.js';\n * const inputKey = randomBytes(32);\n * const salt = randomBytes(32);\n * const info = utf8ToBytes('application-key');\n * const okm = hkdf(sha256, inputKey, salt, info, 32);\n * ```\n */\nexport const hkdf = (hash, ikm, salt, info, length) => {\n    ahash(hash);\n    if (salt === undefined)\n        salt = new Uint8Array(hash.outputLen);\n    const HMAC = hmac.create(hash, salt).update(ikm);\n    // The intermediate PRK is secret key material; wipe it instead of\n    // leaving it for GC.\n    return expand(hash, HMAC.digest(), info, length, HMAC); // expand() owns and consumes it.\n};\n","const U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();\nconst _32n = /* @__PURE__ */ BigInt(32);\n// Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high\n// }` to match little-endian word order rather than the property names.\nfunction fromBig(n, le = false) {\n    if (le)\n        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };\n    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };\n}\n// Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array\n// holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.\nfunction split(lst, le = false) {\n    const len = lst.length;\n    let Ah = new Uint32Array(len);\n    let Al = new Uint32Array(len);\n    for (let i = 0; i < len; i++) {\n        const { h, l } = fromBig(lst[i], le);\n        [Ah[i], Al[i]] = [h, l];\n    }\n    return [Ah, Al];\n}\n// Combine explicit `(high, low)` 32-bit halves into a bigint; `>>> 0` normalizes signed JS\n// bitwise results back to uint32 first, and little-endian callers must swap.\nconst toBig = (h, l) => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);\n// Split a JS number into u32 halves without a BigInt allocation. Exact only for integers\n// `0 <= n < 2**53`; callers use it on byte / bit counters, which JS length math caps far below\n// that (an ArrayBuffer cannot exceed 2**53 - 1 bytes).\nconst fromNumH = (n) => (n / 2 ** 32) | 0;\nconst fromNumL = (n) => n >>> 0;\n// Drop-in replacement for `view.setBigUint64(byteOffset, BigInt(n), isLE)` without the per-call\n// BigInt allocation. Same `n < 2**53` precondition as `fromNumH`/`fromNumL`.\nfunction setU64FromNum(view, byteOffset, n, isLE) {\n    const h = fromNumH(n);\n    const l = fromNumL(n);\n    view.setUint32(byteOffset, isLE ? l : h, isLE);\n    view.setUint32(byteOffset + 4, isLE ? h : l, isLE);\n}\n// High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.\nconst shrSH = (h, _l, s) => h >>> s;\n// Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.\nconst shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.\nconst rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));\n// Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.\nconst rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);\n// High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.\nconst rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));\n// Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.\nconst rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));\n// High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.\nconst rotr32H = (_h, l) => l;\n// Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.\nconst rotr32L = (h, _l) => h;\n// 64-bit left rotates (rotl*) are not defined here: sha3.ts, their only consumer, keeps\n// local copies so V8 inlines them into keccakP.\n// Add two split 64-bit words and return the split `{ h, l }` sum.\n// JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out\n// of the low sum and instead use division.\nfunction add(Ah, Al, Bh, Bl) {\n    const l = (Al >>> 0) + (Bl >>> 0);\n    return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };\n}\n// Addition with more than 2 elements\n// Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.\nconst add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);\n// High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.\nconst add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;\n// Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.\nconst add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);\n// High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.\nconst add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;\n// Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.\nconst add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);\n// High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.\nconst add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;\n// prettier-ignore\nexport { add, add3H, add3L, add4H, add4L, add5H, add5L, fromBig, fromNumH, fromNumL, rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL, setU64FromNum, shrSH, shrSL, split, toBig };\n","/**\n * Internal Merkle-Damgard hash utils.\n * @module\n */\nimport { setU64FromNum } from \"./_u64.js\";\nimport { abytes, aexists, aoutput, createView } from \"./utils.js\";\n/**\n * Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.\n * Returns bits from `b` when `a` is set, otherwise from `c`.\n * The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never\n * set the same bit.\n * @param a - selector word\n * @param b - word chosen when selector bit is set\n * @param c - word chosen when selector bit is clear\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit choice primitive.\n * ```ts\n * Chi(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Chi(a, b, c) {\n    return (a & b) ^ (~a & c);\n}\n/**\n * Shared 32-bit majority primitive reused by SHA-256 and SHA-1.\n * Returns bits shared by at least two inputs.\n * @param a - first input word\n * @param b - second input word\n * @param c - third input word\n * @returns Mixed 32-bit word.\n * @example\n * Combine three words with the shared 32-bit majority primitive.\n * ```ts\n * Maj(0xffffffff, 0x12345678, 0x87654321);\n * ```\n */\nexport function Maj(a, b, c) {\n    return (a & b) ^ (a & c) ^ (b & c);\n}\n/**\n * Merkle-Damgard hash construction base class.\n * Could be used to create MD5, RIPEMD, SHA1, SHA2.\n * Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit\n * strings with partial-byte tails.\n * @param blockLen - internal block size in bytes\n * @param outputLen - digest size in bytes\n * @param padOffset - trailing length field size in bytes\n * @param isLE - whether length and state words are encoded in little-endian\n * @example\n * Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.\n * ```ts\n * import { _SHA1 } from '@noble/hashes/legacy.js';\n * const hash = new _SHA1();\n * hash.update(new Uint8Array([97, 98, 99]));\n * hash.digest();\n * ```\n */\nexport class HashMD {\n    blockLen;\n    outputLen;\n    canXOF = false;\n    padOffset;\n    isLE;\n    // For partial updates less than block size\n    buffer;\n    view;\n    finished = false;\n    length = 0;\n    pos = 0;\n    destroyed = false;\n    constructor(blockLen, outputLen, padOffset, isLE) {\n        this.blockLen = blockLen;\n        this.outputLen = outputLen;\n        this.padOffset = padOffset;\n        this.isLE = isLE;\n        this.buffer = new Uint8Array(blockLen);\n        this.view = createView(this.buffer);\n    }\n    update(data) {\n        aexists(this);\n        abytes(data);\n        const { view, buffer, blockLen } = this;\n        const len = data.length;\n        let processed = false;\n        for (let pos = 0; pos < len;) {\n            const take = Math.min(blockLen - this.pos, len - pos);\n            // Fast path only when there is no buffered partial block: `take === blockLen` implies\n            // `this.pos === 0`, so we can process full blocks directly from the input view.\n            if (take === blockLen) {\n                const dataView = createView(data);\n                for (; blockLen <= len - pos; pos += blockLen)\n                    this.process(dataView, pos);\n                processed = true;\n                continue;\n            }\n            // When the whole input is buffered in one go (common for short messages), passing `data`\n            // directly avoids allocating a subarray view.\n            buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);\n            this.pos += take;\n            pos += take;\n            if (this.pos === blockLen) {\n                this.process(view, 0);\n                this.pos = 0;\n                processed = true;\n            }\n        }\n        this.length += data.length;\n        // Shared schedule buffers only pick up input-derived words inside process(); if everything\n        // was buffered without processing, there is nothing to zero.\n        if (processed)\n            this.roundClean();\n        return this;\n    }\n    digestInto(out) {\n        aexists(this);\n        aoutput(out, this);\n        this.finished = true;\n        // Padding\n        // We can avoid allocation of buffer for padding completely if it\n        // was previously not allocated here. But it won't change performance.\n        const { buffer, view, blockLen, isLE } = this;\n        let { pos } = this;\n        // append the bit '1' to the message, then zero-pad the rest of the block\n        buffer[pos++] = 0b10000000;\n        buffer.fill(0, pos);\n        // we have less than padOffset left in buffer, so we cannot put length in\n        // current block, need process it and pad again\n        if (this.padOffset > blockLen - pos) {\n            this.process(view, 0);\n            buffer.fill(0);\n        }\n        // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from\n        // the padding fill above, and JS will overflow before user input can make that half non-zero.\n        // So we only need to write the low 64 bits here (`length * 8` only scales the exponent of an\n        // integer below 2**53, so the split inside the helper stays exact).\n        setU64FromNum(view, blockLen - 8, this.length * 8, isLE);\n        this.process(view, 0);\n        // The final block above is processed outside update(), so the shared message-schedule\n        // buffers (e.g. SHA256_W) would otherwise retain input-derived words after digest().\n        this.roundClean();\n        // digest() passes our own `buffer` as `out`; reuse its cached view instead of allocating one.\n        const oview = out === buffer ? view : createView(out);\n        const len = this.outputLen;\n        // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT\n        const outLen = len / 4;\n        const state = this.get();\n        // Subclass-misconfiguration invariant: outputLen must be 32-bit aligned and fit the state.\n        if (len % 4 || outLen > state.length)\n            throw new Error('invalid outputLen');\n        for (let i = 0; i < outLen; i++)\n            oview.setUint32(4 * i, state[i], isLE);\n    }\n    digest() {\n        const { buffer, outputLen } = this;\n        this.digestInto(buffer);\n        // Copy before destroy(): subclasses wipe `buffer` during cleanup, but `digest()` must return\n        // fresh bytes to the caller.\n        const res = buffer.slice(0, outputLen);\n        this.destroy();\n        return res;\n    }\n    _cloneIntoMeta(to) {\n        const { buffer, length, finished, destroyed, pos } = this;\n        to.destroyed = destroyed;\n        to.finished = finished;\n        to.length = length;\n        to.pos = pos;\n        // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and\n        // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.\n        if (pos)\n            to.buffer.set(buffer); // Avoid a hot modulo guard.\n        return to;\n    }\n    clone() {\n        return this._cloneInto();\n    }\n}\n/**\n * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.\n * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.\n */\n/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the\n * square roots of the first eight prime numbers. Exported as a shared table; callers must treat\n * it as read-only because constructors copy words from it by index. */\nexport const SHA256_IV = /* @__PURE__ */ Uint32Array.from([\n    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,\n]);\n/** Initial SHA224 state `H(0)` from RFC 6234 §6.1. Exported as a shared table; callers must\n * treat it as read-only because constructors copy words from it by index. */\nexport const SHA224_IV = /* @__PURE__ */ Uint32Array.from([\n    0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,\n]);\n/** Initial SHA384 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the ninth\n * through sixteenth prime numbers. Exported as a shared table; callers must treat it as read-only\n * because constructors copy halves from it by index. */\nexport const SHA384_IV = /* @__PURE__ */ Uint32Array.from([\n    0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,\n    0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,\n]);\n/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen\n * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first\n * eight prime numbers. Exported as a shared table; callers must treat it as read-only because\n * constructors copy halves from it by index. */\nexport const SHA512_IV = /* @__PURE__ */ Uint32Array.from([\n    0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,\n    0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,\n]);\n","/**\n * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.\n * SHA256 is the fastest hash implementable in JS, even faster than Blake3.\n * Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and\n * {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.\n * @module\n */\nimport { Chi, HashMD, Maj, SHA224_IV, SHA256_IV, SHA384_IV, SHA512_IV } from \"./_md.js\";\nimport * as u64 from \"./_u64.js\";\nimport { clean, createHasher, oidNist, rotr } from \"./utils.js\";\n/**\n * SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits\n * of the cube roots of the first 64 primes (2..311).\n */\n// prettier-ignore\nconst SHA256_K = /* @__PURE__ */ Uint32Array.from([\n    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */\nconst SHA256_W = /* @__PURE__ */ new Uint32Array(64);\n/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */\nclass SHA2_32B extends HashMD {\n    // We cannot use array here since array allows indexing by variable\n    // which means optimizer/compiler cannot use registers.\n    // Numeric initializers matter: starting the fields as `undefined` changes\n    // V8's field representation and makes sha256 3x slower (measured).\n    A = 0;\n    B = 0;\n    C = 0;\n    D = 0;\n    E = 0;\n    F = 0;\n    G = 0;\n    H = 0;\n    constructor(outputLen, IV) {\n        super(64, outputLen, 8, false);\n        this.A = IV[0] | 0;\n        this.B = IV[1] | 0;\n        this.C = IV[2] | 0;\n        this.D = IV[3] | 0;\n        this.E = IV[4] | 0;\n        this.F = IV[5] | 0;\n        this.G = IV[6] | 0;\n        this.H = IV[7] | 0;\n    }\n    get() {\n        const { A, B, C, D, E, F, G, H } = this;\n        return [A, B, C, D, E, F, G, H];\n    }\n    // prettier-ignore\n    set(A, B, C, D, E, F, G, H) {\n        this.A = A | 0;\n        this.B = B | 0;\n        this.C = C | 0;\n        this.D = D | 0;\n        this.E = E | 0;\n        this.F = F | 0;\n        this.G = G | 0;\n        this.H = H | 0;\n    }\n    _cloneInto(to) {\n        (to ||= new this.constructor()).set(...this.get());\n        return this._cloneIntoMeta(to);\n    }\n    process(view, offset) {\n        // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array\n        for (let i = 0; i < 16; i++, offset += 4)\n            SHA256_W[i] = view.getUint32(offset, false);\n        for (let i = 16; i < 64; i++) {\n            const W15 = SHA256_W[i - 15];\n            const W2 = SHA256_W[i - 2];\n            const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);\n            const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);\n            SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;\n        }\n        // Compression function main loop, 64 rounds\n        let { A, B, C, D, E, F, G, H } = this;\n        for (let i = 0; i < 64; i++) {\n            const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);\n            const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n            const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);\n            const T2 = (sigma0 + Maj(A, B, C)) | 0;\n            H = G;\n            G = F;\n            F = E;\n            E = (D + T1) | 0;\n            D = C;\n            C = B;\n            B = A;\n            A = (T1 + T2) | 0;\n        }\n        // Add the compressed chunk to the current hash value\n        A = (A + this.A) | 0;\n        B = (B + this.B) | 0;\n        C = (C + this.C) | 0;\n        D = (D + this.D) | 0;\n        E = (E + this.E) | 0;\n        F = (F + this.F) | 0;\n        G = (G + this.G) | 0;\n        H = (H + this.H) | 0;\n        this.set(A, B, C, D, E, F, G, H);\n    }\n    roundClean() {\n        clean(SHA256_W);\n    }\n    destroy() {\n        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n        // update()/digest() callable on reused instances.\n        this.destroyed = true;\n        this.set(0, 0, 0, 0, 0, 0, 0, 0);\n        clean(this.buffer);\n    }\n}\n/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */\nexport class _SHA256 extends SHA2_32B {\n    constructor() {\n        super(32, SHA256_IV);\n    }\n}\n/** Internal SHA-224 hash class grounded in RFC 6234 §6.2 and §8.5. */\nexport class _SHA224 extends SHA2_32B {\n    constructor() {\n        super(28, SHA224_IV);\n    }\n}\n// SHA2-512 is slower than sha256 in js because u64 operations are slow.\n// SHA-384 / SHA-512 round constants from RFC 6234 §5.2:\n// 80 full 64-bit words split into high/low halves.\n// prettier-ignore\nconst K512 = /* @__PURE__ */ (() => u64.split([\n    '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',\n    '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',\n    '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',\n    '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',\n    '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',\n    '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',\n    '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',\n    '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',\n    '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',\n    '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',\n    '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',\n    '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',\n    '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',\n    '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',\n    '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',\n    '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',\n    '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',\n    '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',\n    '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',\n    '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'\n].map(n => BigInt(n))))();\nconst SHA512_Kh = /* @__PURE__ */ (() => K512[0])();\nconst SHA512_Kl = /* @__PURE__ */ (() => K512[1])();\n// Reusable high-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);\n// Reusable low-half schedule buffer for the RFC 6234 §6.4 64-bit `W_t` words.\nconst SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);\n/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */\nclass SHA2_64B extends HashMD {\n    // We cannot use array here since array allows indexing by variable\n    // which means optimizer/compiler cannot use registers.\n    // h -- high 32 bits, l -- low 32 bits\n    // Numeric initializers matter: starting the fields as `undefined` changes\n    // V8's field representation and slows hashing down (measured on sha256).\n    Ah = 0;\n    Al = 0;\n    Bh = 0;\n    Bl = 0;\n    Ch = 0;\n    Cl = 0;\n    Dh = 0;\n    Dl = 0;\n    Eh = 0;\n    El = 0;\n    Fh = 0;\n    Fl = 0;\n    Gh = 0;\n    Gl = 0;\n    Hh = 0;\n    Hl = 0;\n    constructor(outputLen, IV) {\n        super(128, outputLen, 16, false);\n        this.Ah = IV[0] | 0;\n        this.Al = IV[1] | 0;\n        this.Bh = IV[2] | 0;\n        this.Bl = IV[3] | 0;\n        this.Ch = IV[4] | 0;\n        this.Cl = IV[5] | 0;\n        this.Dh = IV[6] | 0;\n        this.Dl = IV[7] | 0;\n        this.Eh = IV[8] | 0;\n        this.El = IV[9] | 0;\n        this.Fh = IV[10] | 0;\n        this.Fl = IV[11] | 0;\n        this.Gh = IV[12] | 0;\n        this.Gl = IV[13] | 0;\n        this.Hh = IV[14] | 0;\n        this.Hl = IV[15] | 0;\n    }\n    // prettier-ignore\n    get() {\n        const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n        return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];\n    }\n    // prettier-ignore\n    set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {\n        this.Ah = Ah | 0;\n        this.Al = Al | 0;\n        this.Bh = Bh | 0;\n        this.Bl = Bl | 0;\n        this.Ch = Ch | 0;\n        this.Cl = Cl | 0;\n        this.Dh = Dh | 0;\n        this.Dl = Dl | 0;\n        this.Eh = Eh | 0;\n        this.El = El | 0;\n        this.Fh = Fh | 0;\n        this.Fl = Fl | 0;\n        this.Gh = Gh | 0;\n        this.Gl = Gl | 0;\n        this.Hh = Hh | 0;\n        this.Hl = Hl | 0;\n    }\n    _cloneInto(to) {\n        (to ||= new this.constructor()).set(...this.get());\n        return this._cloneIntoMeta(to);\n    }\n    process(view, offset) {\n        // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array\n        for (let i = 0; i < 16; i++, offset += 4) {\n            SHA512_W_H[i] = view.getUint32(offset);\n            SHA512_W_L[i] = view.getUint32((offset += 4));\n        }\n        for (let i = 16; i < 80; i++) {\n            // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)\n            const W15h = SHA512_W_H[i - 15] | 0;\n            const W15l = SHA512_W_L[i - 15] | 0;\n            const s0h = u64.rotrSH(W15h, W15l, 1) ^ u64.rotrSH(W15h, W15l, 8) ^ u64.shrSH(W15h, W15l, 7);\n            const s0l = u64.rotrSL(W15h, W15l, 1) ^ u64.rotrSL(W15h, W15l, 8) ^ u64.shrSL(W15h, W15l, 7);\n            // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)\n            const W2h = SHA512_W_H[i - 2] | 0;\n            const W2l = SHA512_W_L[i - 2] | 0;\n            const s1h = u64.rotrSH(W2h, W2l, 19) ^ u64.rotrBH(W2h, W2l, 61) ^ u64.shrSH(W2h, W2l, 6);\n            const s1l = u64.rotrSL(W2h, W2l, 19) ^ u64.rotrBL(W2h, W2l, 61) ^ u64.shrSL(W2h, W2l, 6);\n            // SHA512_W[i] = s0 + s1 + SHA512_W[i - 7] + SHA512_W[i - 16];\n            const SUMl = u64.add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);\n            const SUMh = u64.add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);\n            SHA512_W_H[i] = SUMh | 0;\n            SHA512_W_L[i] = SUMl | 0;\n        }\n        let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;\n        // Compression function main loop, 80 rounds\n        for (let i = 0; i < 80; i++) {\n            // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)\n            const sigma1h = u64.rotrSH(Eh, El, 14) ^ u64.rotrSH(Eh, El, 18) ^ u64.rotrBH(Eh, El, 41);\n            const sigma1l = u64.rotrSL(Eh, El, 14) ^ u64.rotrSL(Eh, El, 18) ^ u64.rotrBL(Eh, El, 41);\n            //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;\n            const CHIh = (Eh & Fh) ^ (~Eh & Gh);\n            const CHIl = (El & Fl) ^ (~El & Gl);\n            // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]\n            // prettier-ignore\n            const T1ll = u64.add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);\n            const T1h = u64.add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);\n            const T1l = T1ll | 0;\n            // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)\n            const sigma0h = u64.rotrSH(Ah, Al, 28) ^ u64.rotrBH(Ah, Al, 34) ^ u64.rotrBH(Ah, Al, 39);\n            const sigma0l = u64.rotrSL(Ah, Al, 28) ^ u64.rotrBL(Ah, Al, 34) ^ u64.rotrBL(Ah, Al, 39);\n            const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);\n            const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);\n            Hh = Gh | 0;\n            Hl = Gl | 0;\n            Gh = Fh | 0;\n            Gl = Fl | 0;\n            Fh = Eh | 0;\n            Fl = El | 0;\n            ({ h: Eh, l: El } = u64.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));\n            Dh = Ch | 0;\n            Dl = Cl | 0;\n            Ch = Bh | 0;\n            Cl = Bl | 0;\n            Bh = Ah | 0;\n            Bl = Al | 0;\n            const All = u64.add3L(T1l, sigma0l, MAJl);\n            Ah = u64.add3H(All, T1h, sigma0h, MAJh);\n            Al = All | 0;\n        }\n        // Add the compressed chunk to the current hash value\n        ({ h: Ah, l: Al } = u64.add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));\n        ({ h: Bh, l: Bl } = u64.add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));\n        ({ h: Ch, l: Cl } = u64.add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));\n        ({ h: Dh, l: Dl } = u64.add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));\n        ({ h: Eh, l: El } = u64.add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));\n        ({ h: Fh, l: Fl } = u64.add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));\n        ({ h: Gh, l: Gl } = u64.add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));\n        ({ h: Hh, l: Hl } = u64.add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));\n        this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);\n    }\n    roundClean() {\n        clean(SHA512_W_H, SHA512_W_L);\n    }\n    destroy() {\n        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves\n        // update()/digest() callable on reused instances.\n        this.destroyed = true;\n        clean(this.buffer);\n        this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);\n    }\n}\n/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA512 extends SHA2_64B {\n    constructor() {\n        super(64, SHA512_IV);\n    }\n}\n/** Internal SHA-384 hash class grounded in RFC 6234 §6.3 and §6.4. */\nexport class _SHA384 extends SHA2_64B {\n    constructor() {\n        super(48, SHA384_IV);\n    }\n}\n/**\n * Truncated SHA512/256 and SHA512/224.\n * SHA512_IV is XORed with 0xa5a5a5a5a5a5a5a5, then used as \"intermediary\" IV of SHA512/t.\n * Then t hashes string to produce result IV.\n * See the repo-side derivation recipe in `test/misc/sha2-gen-iv.js`.\n * These IV literals are checked against that script rather than a dedicated\n * local RFC section.\n */\n/** SHA-512/224 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T224_IV = /* @__PURE__ */ Uint32Array.from([\n    0x8c3d37c8, 0x19544da2, 0x73e19966, 0x89dcd4d6, 0x1dfab7ae, 0x32ff9c82, 0x679dd514, 0x582f9fcf,\n    0x0f6d2b69, 0x7bd44da8, 0x77e36f73, 0x04c48942, 0x3f9d85a8, 0x6a1d36c8, 0x1112e6ad, 0x91d692a1,\n]);\n/** SHA-512/256 IV derived by the SHA-512/t recipe in `test/misc/sha2-gen-iv.js` and\n * stored as sixteen big-endian 32-bit halves. */\nconst T256_IV = /* @__PURE__ */ Uint32Array.from([\n    0x22312194, 0xfc2bf72c, 0x9f555fa3, 0xc84c64c2, 0x2393b86b, 0x6f53b151, 0x96387719, 0x5940eabd,\n    0x96283ee2, 0xa88effe3, 0xbe5e1e25, 0x53863992, 0x2b0199fc, 0x2c85b8aa, 0x0eb72ddc, 0x81c52ca2,\n]);\n/** Internal SHA-512/224 hash class using the derived `T224_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_224 extends SHA2_64B {\n    constructor() {\n        super(28, T224_IV);\n    }\n}\n/** Internal SHA-512/256 hash class using the derived `T256_IV` and the shared\n * RFC 6234 §6.4 compression engine. */\nexport class _SHA512_256 extends SHA2_64B {\n    constructor() {\n        super(32, T256_IV);\n    }\n}\n/**\n * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:\n *\n * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.\n * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.\n * - Each sha256 hash is executing 2^18 bit operations.\n * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-256.\n * ```ts\n * sha256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), \n/* @__PURE__ */ oidNist(0x01));\n/**\n * SHA2-224 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-224.\n * ```ts\n * sha224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha224 = /* @__PURE__ */ createHasher(() => new _SHA224(), \n/* @__PURE__ */ oidNist(0x04));\n/**\n * SHA2-512 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512.\n * ```ts\n * sha512(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), \n/* @__PURE__ */ oidNist(0x03));\n/**\n * SHA2-384 hash function from RFC 4634.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-384.\n * ```ts\n * sha384(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha384 = /* @__PURE__ */ createHasher(() => new _SHA384(), \n/* @__PURE__ */ oidNist(0x02));\n/**\n * SHA2-512/256 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/256.\n * ```ts\n * sha512_256(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_256 = /* @__PURE__ */ createHasher(() => new _SHA512_256(), \n/* @__PURE__ */ oidNist(0x06));\n/**\n * SHA2-512/224 \"truncated\" hash function, with improved resistance to length extension attacks.\n * See the paper on {@link https://eprint.iacr.org/2010/548.pdf | truncated SHA512}.\n * @param msg - message bytes to hash\n * @param opts - Reserved hash options.\n * @returns Digest bytes.\n * @example\n * Hash a message with SHA2-512/224.\n * ```ts\n * sha512_224(new Uint8Array([97, 98, 99]));\n * ```\n */\nexport const sha512_224 = /* @__PURE__ */ createHasher(() => new _SHA512_224(), \n/* @__PURE__ */ oidNist(0x05));\n","const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder(\"utf-8\", { fatal: !0 }), MAX_INT32 = 2 ** 32;\nfunction concat(...buffers) {\n  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n  let i = 0;\n  for (const buffer of buffers)\n    buf.set(buffer, i), i += buffer.length;\n  return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n  if (value < 0 || value >= MAX_INT32)\n    throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n  buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);\n}\nfunction uint64be(value) {\n  const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);\n  return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;\n}\nfunction uint32be(value) {\n  const buf = new Uint8Array(4);\n  return writeUInt32BE(buf, value), buf;\n}\nconst NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n  if (typeof string == \"string\" && string.length >= 128) {\n    if (NON_ASCII.test(string))\n      throw new TypeError(\"non-ASCII string encountered in encode()\");\n    return encoder.encode(string);\n  }\n  const bytes = new Uint8Array(string.length);\n  for (let i = 0; i < string.length; i++) {\n    const code = string.charCodeAt(i);\n    if (code > 127)\n      throw new TypeError(\"non-ASCII string encountered in encode()\");\n    bytes[i] = code;\n  }\n  return bytes;\n}\nfunction encodeBase64(input, url = !1) {\n  if (Uint8Array.prototype.toBase64)\n    return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n  const CHUNK_SIZE = 32768, arr = [];\n  for (let i = 0; i < input.length; i += CHUNK_SIZE)\n    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n  const encoded = btoa(arr.join(\"\"));\n  return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = !1) {\n  if (Uint8Array.fromBase64)\n    return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n  if (url) {\n    if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n      throw new TypeError(\"Invalid base64url\");\n    encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  }\n  const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++)\n    bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\nasync function digest(algorithm, data) {\n  const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\nexport {\n  concat,\n  decodeBase64,\n  decoder,\n  digest,\n  encode,\n  encodeBase64,\n  encoder,\n  strictDecoder,\n  uint32be,\n  uint64be\n};\n","class JOSEError extends Error {\n  static code = \"ERR_JOSE_GENERIC\";\n  code = \"ERR_JOSE_GENERIC\";\n  constructor(message, options) {\n    super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n  }\n}\nclass JWTClaimValidationFailed extends JOSEError {\n  static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n  code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n  claim;\n  reason;\n  payload;\n  constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n  }\n}\nclass JWTExpired extends JOSEError {\n  static code = \"ERR_JWT_EXPIRED\";\n  code = \"ERR_JWT_EXPIRED\";\n  claim;\n  reason;\n  payload;\n  constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n  }\n}\nclass JOSEAlgNotAllowed extends JOSEError {\n  static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n  code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\nclass JOSENotSupported extends JOSEError {\n  static code = \"ERR_JOSE_NOT_SUPPORTED\";\n  code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWEDecryptionFailed extends JOSEError {\n  static code = \"ERR_JWE_DECRYPTION_FAILED\";\n  code = \"ERR_JWE_DECRYPTION_FAILED\";\n  constructor(message = \"decryption operation failed\", options) {\n    super(message, options);\n  }\n}\nclass JWEInvalid extends JOSEError {\n  static code = \"ERR_JWE_INVALID\";\n  code = \"ERR_JWE_INVALID\";\n}\nclass JWSInvalid extends JOSEError {\n  static code = \"ERR_JWS_INVALID\";\n  code = \"ERR_JWS_INVALID\";\n}\nclass JWTInvalid extends JOSEError {\n  static code = \"ERR_JWT_INVALID\";\n  code = \"ERR_JWT_INVALID\";\n}\nclass JWKInvalid extends JOSEError {\n  static code = \"ERR_JWK_INVALID\";\n  code = \"ERR_JWK_INVALID\";\n}\nclass JWKSInvalid extends JOSEError {\n  static code = \"ERR_JWKS_INVALID\";\n  code = \"ERR_JWKS_INVALID\";\n}\nclass JWKSNoMatchingKey extends JOSEError {\n  static code = \"ERR_JWKS_NO_MATCHING_KEY\";\n  code = \"ERR_JWKS_NO_MATCHING_KEY\";\n  constructor(message = \"no applicable key found in the JSON Web Key Set\", options) {\n    super(message, options);\n  }\n}\nclass JWKSMultipleMatchingKeys extends JOSEError {\n  [Symbol.asyncIterator] = async function* () {\n  };\n  static code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n  code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n  constructor(message = \"multiple matching keys found in the JSON Web Key Set\", options) {\n    super(message, options);\n  }\n}\nclass JWKSTimeout extends JOSEError {\n  static code = \"ERR_JWKS_TIMEOUT\";\n  code = \"ERR_JWKS_TIMEOUT\";\n  constructor(message = \"request timed out\", options) {\n    super(message, options);\n  }\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n  static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n  code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n  constructor(message = \"signature verification failed\", options) {\n    super(message, options);\n  }\n}\nexport {\n  JOSEAlgNotAllowed,\n  JOSEError,\n  JOSENotSupported,\n  JWEDecryptionFailed,\n  JWEInvalid,\n  JWKInvalid,\n  JWKSInvalid,\n  JWKSMultipleMatchingKeys,\n  JWKSNoMatchingKey,\n  JWKSTimeout,\n  JWSInvalid,\n  JWSSignatureVerificationFailed,\n  JWTClaimValidationFailed,\n  JWTExpired,\n  JWTInvalid\n};\n","import { encoder, decoder, encodeBase64, decodeBase64 } from \"../lib/buffer_utils.js\";\nconst invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n  try {\n    return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), !0);\n  } catch (cause) {\n    throw new TypeError(invalid, { cause });\n  }\n}\nfunction encode(input) {\n  return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, !0);\n}\nexport {\n  decode,\n  encode\n};\n","import { JOSENotSupported, JWSInvalid } from \"../util/errors.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { encode, strictDecoder } from \"./buffer_utils.js\";\nfunction assertUint8Array(input, label) {\n  if (!(input instanceof Uint8Array))\n    throw new TypeError(`${label} must be an instance of Uint8Array`);\n}\nfunction isObject(input) {\n  if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n    return !1;\n  const prototype = Object.getPrototypeOf(input);\n  return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isJwkSet(input) {\n  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);\n}\nfunction isDisjoint(...headers) {\n  const parameters = /* @__PURE__ */ new Set();\n  for (const header of headers)\n    if (header)\n      for (const parameter of Object.keys(header)) {\n        if (parameters.has(parameter))\n          return !1;\n        parameters.add(parameter);\n      }\n  return !0;\n}\nfunction assertNotSet(value, name) {\n  if (value !== void 0)\n    throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n  try {\n    return decode(value);\n  } catch {\n    throw new ErrorClass(`Failed to base64url decode the ${label}`);\n  }\n}\nfunction encodeBase64url(value, label, ErrorClass) {\n  try {\n    return encode(value);\n  } catch {\n    throw new ErrorClass(`The ${label} is not a valid base64url string`);\n  }\n}\nfunction parseJoseHeader(b64, ErrorClass, message) {\n  let parsed;\n  try {\n    parsed = JSON.parse(strictDecoder.decode(decode(b64)));\n  } catch {\n    throw new ErrorClass(message);\n  }\n  if (!isObject(parsed))\n    throw new ErrorClass(message);\n  return parsed;\n}\nconst JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };\nfunction validateAlgorithms(option, algorithms) {\n  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n    throw new TypeError(`\"${option}\" option must be an array of strings`);\n  return algorithms === void 0 ? void 0 : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n  const { crit } = protectedHeader ?? {};\n  if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n    throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)\n    throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n  if (!protectedHeader || protectedHeader.crit === void 0)\n    return [];\n  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n    throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n  for (const parameter of protectedHeader.crit) {\n    if (!(parameter in recognized))\n      throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)\n      throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))\n      throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n  }\n  return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n  if (extensions.includes(\"b64\")) {\n    const b64 = protectedHeader.b64;\n    if (typeof b64 != \"boolean\")\n      throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n    return b64;\n  }\n  return !0;\n}\nfunction serializeJoseHeader(Err, header) {\n  let serialized, parsed;\n  try {\n    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n  } catch (cause) {\n    throw new Err(\"JOSE Header is not valid JSON\", { cause });\n  }\n  if (!isObject(parsed))\n    throw new Err(\"JOSE Header is not a JSON object\");\n  return [parsed, serialized];\n}\nexport {\n  JWE_RECOGNIZED,\n  JWS_RECOGNIZED,\n  assertNotSet,\n  assertUint8Array,\n  decodeBase64url,\n  encodeBase64url,\n  isDisjoint,\n  isJwkSet,\n  isObject,\n  parseJoseHeader,\n  serializeJoseHeader,\n  validateAlgorithms,\n  validateB64,\n  validateCrit,\n  validateCritDuplicates\n};\n","import { isObject } from \"./validate.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nconst tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {\n  const { alg } = entry;\n  if (key.use !== void 0) {\n    const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n    if (key.use !== expected)\n      throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n  }\n  if (key.alg !== void 0 && key.alg !== alg)\n    throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n  if (Array.isArray(key.key_ops)) {\n    const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n      throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n  }\n};\nasync function prepareKey(entry, key, usage) {\n  const { alg, secret } = entry, privateKey = usage === \"decrypt\" || usage === \"sign\";\n  if (secret && key instanceof Uint8Array)\n    return key;\n  let normalized, keyObject;\n  if (isObject(key)) {\n    if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n      throw invalidKeyType(alg, key, secret);\n    if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (privateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === void 0 && normalized.priv === void 0)))\n      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? \"private\" : \"public\"} JWK`);\n    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n      return decode(normalized.k);\n    if (!Object.isFrozen(key)) {\n      const { key_ops } = key;\n      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n    }\n  } else {\n    if (!isKeyLike(key))\n      throw invalidKeyType(alg, key, secret);\n    const expectedType = secret ? \"secret\" : privateKey ? \"private\" : \"public\";\n    if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n      throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n    if (isCryptoKey(key))\n      return key;\n    if (keyObject = key, keyObject.type === \"secret\")\n      return keyObject.export();\n  }\n  cache ||= /* @__PURE__ */ new WeakMap();\n  const cacheKey = key;\n  let cached = cache.get(cacheKey);\n  if (cached?.[alg])\n    return cached[alg];\n  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n    const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n  }\n  return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nlet cache;\nconst nist = {\n  __proto__: null,\n  prime256v1: \"P-256\",\n  secp384r1: \"P-384\",\n  secp521r1: \"P-521\"\n};\nfunction assertCryptoKey(key) {\n  if (!isCryptoKey(key))\n    throw new Error(\"CryptoKey instance expected\");\n}\nconst isCryptoKey = (key) => {\n  if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n    return !0;\n  try {\n    return key instanceof CryptoKey;\n  } catch {\n    return !1;\n  }\n}, isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n  if (types.length > 2) {\n    const last = types.pop();\n    msg += `one of type ${types.join(\", \")}, or ${last}.`;\n  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n  return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nconst invalidKeyInput = (actual, ...types) => message(\"Key must be \", actual, ...types);\nfunction invalidKeyType(alg, actual, secret) {\n  const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n  return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nconst unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n  if (usage && !key.usages.includes(usage))\n    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n  const { modulusLength } = key.algorithm;\n  if (typeof modulusLength != \"number\" || modulusLength < 2048)\n    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n  const algorithm = key.algorithm;\n  if (algorithm.name !== expected.name)\n    throw unusable(expected.name);\n  if (expected.hash && algorithm.hash?.name !== expected.hash)\n    throw unusable(expected.hash, \"algorithm.hash\");\n  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n    throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n  if (expected.length !== void 0 && algorithm.length !== expected.length)\n    throw unusable(expected.length, \"algorithm.length\");\n  checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n  return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n  const normalized = snapshotJwk(jwk);\n  if (normalized.ext !== void 0 && typeof normalized.ext != \"boolean\")\n    throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n  if (normalized.key_ops !== void 0) {\n    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;\n    if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n      throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n    normalized.key_ops = keyOps;\n  }\n  return normalized;\n}\nfunction validateExtractableOption(extractable) {\n  if (extractable !== void 0 && typeof extractable != \"boolean\")\n    throw new TypeError('\"extractable\" option must be a boolean');\n  return extractable;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n  if (!entry.kty.includes(jwk.kty))\n    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n  return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = !1) {\n  return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\nexport {\n  assertCryptoKey,\n  checkCryptoKey,\n  checkModulusLength,\n  checkUsage,\n  invalidKeyInput,\n  isCryptoKey,\n  isKeyLike,\n  isKeyObject,\n  jwkToKey,\n  normalizeJwk,\n  prepareKey,\n  rawKey,\n  snapshotJwk,\n  validateExtractableOption\n};\n","import { concat, uint64be } from \"./buffer_utils.js\";\nimport { rawKey, invalidKeyInput, isCryptoKey } from \"./key.js\";\nimport { JWEDecryptionFailed, JWEInvalid } from \"../util/errors.js\";\nconst generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));\nfunction checkCekLength(cek, expected) {\n  const actual = cek.byteLength << 3;\n  if (actual !== expected)\n    throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);\n}\nconst generateIv = (enc) => crypto.getRandomValues(new Uint8Array(enc.ivBits >> 3));\nfunction checkIvLength(enc, iv) {\n  if (iv.length << 3 !== enc.ivBits)\n    throw new JWEInvalid(\"Invalid Initialization Vector length\");\n}\nasync function cbcKeySetup(enc, cek, usage) {\n  if (!(cek instanceof Uint8Array))\n    throw new TypeError(invalidKeyInput(cek, \"Uint8Array\"));\n  const keySize = enc.cekBits >> 1, encKey = await crypto.subtle.importKey(\"raw\", cek.subarray(keySize >> 3), \"AES-CBC\", !1, [usage]), macKey = await crypto.subtle.importKey(\"raw\", cek.subarray(0, keySize >> 3), {\n    hash: `SHA-${keySize << 1}`,\n    name: \"HMAC\"\n  }, !1, [\"sign\"]);\n  return [encKey, macKey, keySize];\n}\nasync function cbcHmacTag(macKey, macData, keySize) {\n  return new Uint8Array((await crypto.subtle.sign(\"HMAC\", macKey, macData)).slice(0, keySize >> 3));\n}\nasync function cbcEncrypt(enc, plaintext, cek, iv, aad) {\n  const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, \"encrypt\"), ciphertext = new Uint8Array(await crypto.subtle.encrypt({\n    iv,\n    name: \"AES-CBC\"\n  }, encKey, plaintext)), macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8)), tag = await cbcHmacTag(macKey, macData, keySize);\n  return { ciphertext, tag, iv };\n}\nasync function timingSafeEqual(a, b) {\n  const algorithm = { name: \"HMAC\", hash: \"SHA-256\" }, key = await crypto.subtle.generateKey(algorithm, !1, [\"sign\", \"verify\"]), aHmac = await crypto.subtle.sign(algorithm, key, a);\n  return crypto.subtle.verify(algorithm, key, aHmac, b);\n}\nasync function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {\n  const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, \"decrypt\"), macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8)), expectedTag = await cbcHmacTag(macKey, macData, keySize);\n  try {\n    if (await timingSafeEqual(tag, expectedTag))\n      return new Uint8Array(await crypto.subtle.decrypt({ iv, name: \"AES-CBC\" }, encKey, ciphertext));\n  } catch {\n  }\n  throw new JWEDecryptionFailed();\n}\nasync function encrypt(enc, plaintext, cek, iv, aad) {\n  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))\n    throw new TypeError(invalidKeyInput(cek, \"CryptoKey\", \"KeyObject\", \"Uint8Array\", \"JSON Web Key\"));\n  if (iv ? checkIvLength(enc, iv) : iv = generateIv(enc), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)\n    return cbcEncrypt(enc, plaintext, cek, iv, aad);\n  const encKey = await rawKey(cek, enc.subtle, \"encrypt\"), encrypted = new Uint8Array(await crypto.subtle.encrypt({\n    additionalData: aad,\n    iv,\n    name: \"AES-GCM\",\n    tagLength: 128\n  }, encKey, plaintext));\n  return { ciphertext: encrypted.subarray(0, -16), tag: encrypted.subarray(-16), iv };\n}\nasync function decrypt(enc, cek, ciphertext, iv, tag, aad) {\n  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))\n    throw new TypeError(invalidKeyInput(cek, \"CryptoKey\", \"KeyObject\", \"Uint8Array\", \"JSON Web Key\"));\n  if (!iv)\n    throw new JWEInvalid(\"JWE Initialization Vector missing\");\n  if (!tag)\n    throw new JWEInvalid(\"JWE Authentication Tag missing\");\n  if (!enc.cbc && tag.length !== 16)\n    throw new JWEInvalid(\"Invalid Authentication Tag length\");\n  if (checkIvLength(enc, iv), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)\n    return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);\n  const encKey = await rawKey(cek, enc.subtle, \"decrypt\");\n  try {\n    return new Uint8Array(await crypto.subtle.decrypt({\n      additionalData: aad,\n      iv,\n      name: \"AES-GCM\",\n      tagLength: 128\n    }, encKey, concat(ciphertext, tag)));\n  } catch {\n    throw new JWEDecryptionFailed();\n  }\n}\nexport {\n  checkCekLength,\n  checkIvLength,\n  decrypt,\n  encrypt,\n  generateCek,\n  generateIv\n};\n","function table(entries) {\n  const out = { __proto__: null };\n  for (const alg in entries)\n    out[alg] = { ...entries[alg], alg };\n  return out;\n}\nexport {\n  table\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst wrap = [\n  [\"encrypt\", \"wrapKey\"],\n  [\"decrypt\", \"unwrapKey\"]\n], derive = [[], [\"deriveBits\"]], none = [[], []];\nfunction rsaes(bits) {\n  return {\n    kty: [\"RSA\"],\n    mode: \"key-encryption\",\n    subtle: { name: \"RSA-OAEP\", hash: `SHA-${bits}` },\n    usages: wrap,\n    ops: [\"wrapKey\", \"unwrapKey\"]\n  };\n}\nfunction ecdh(mode) {\n  return {\n    kty: [\"EC\", \"OKP\"],\n    mode,\n    subtle: { name: \"ECDH\" },\n    resolve: ({ kty, crv, asymmetricKeyType }) => {\n      if (crv === \"X25519\" || asymmetricKeyType === \"x25519\")\n        return { name: \"X25519\" };\n      if (kty === \"OKP\")\n        throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n      return { name: \"ECDH\", namedCurve: crv };\n    },\n    usages: derive,\n    ops: [void 0, \"deriveBits\"]\n  };\n}\nfunction aeskw(bits, gcm = !1) {\n  return {\n    kty: [\"oct\"],\n    mode: \"key-wrapping\",\n    secret: !0,\n    subtle: { name: gcm ? \"AES-GCM\" : \"AES-KW\", length: bits },\n    usages: none,\n    ops: gcm ? [\"encrypt\", \"decrypt\"] : [\"wrapKey\", \"unwrapKey\"]\n  };\n}\nfunction pbes2() {\n  return {\n    kty: [\"oct\"],\n    mode: \"key-wrapping\",\n    secret: !0,\n    subtle: { name: \"PBKDF2\" },\n    usages: none,\n    ops: [\"deriveBits\", \"deriveBits\"]\n  };\n}\nconst JWE = table({\n  dir: {\n    kty: [\"oct\"],\n    mode: \"direct-encryption\",\n    secret: !0,\n    subtle: { name: \"AES-GCM\" },\n    usages: none,\n    ops: [\"encrypt\", \"decrypt\"]\n  },\n  \"RSA-OAEP\": rsaes(1),\n  \"RSA-OAEP-256\": rsaes(256),\n  \"RSA-OAEP-384\": rsaes(384),\n  \"RSA-OAEP-512\": rsaes(512),\n  \"ECDH-ES\": ecdh(\"direct-key-agreement\"),\n  \"ECDH-ES+A128KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n  \"ECDH-ES+A192KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n  \"ECDH-ES+A256KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n  A128KW: aeskw(128),\n  A192KW: aeskw(192),\n  A256KW: aeskw(256),\n  A128GCMKW: aeskw(128, !0),\n  A192GCMKW: aeskw(192, !0),\n  A256GCMKW: aeskw(256, !0),\n  \"PBES2-HS256+A128KW\": pbes2(),\n  \"PBES2-HS384+A192KW\": pbes2(),\n  \"PBES2-HS512+A256KW\": pbes2()\n}), contentOps = [\"encrypt\", \"decrypt\"];\nfunction contentEncryption(bits, cbc = !1) {\n  return {\n    kty: [\"oct\"],\n    secret: !0,\n    subtle: { name: cbc ? \"AES-CBC\" : \"AES-GCM\", length: bits },\n    usages: none,\n    ops: contentOps,\n    cekBits: bits,\n    ivBits: cbc ? 128 : 96,\n    cbc\n  };\n}\nconst ENC = table({\n  A128GCM: contentEncryption(128),\n  A192GCM: contentEncryption(192),\n  A256GCM: contentEncryption(256),\n  \"A128CBC-HS256\": contentEncryption(256, !0),\n  \"A192CBC-HS384\": contentEncryption(384, !0),\n  \"A256CBC-HS512\": contentEncryption(512, !0)\n});\nfunction unsupported(parameter, name) {\n  throw new JOSENotSupported(`Invalid or unsupported \"${parameter}\" (JWE ${name}) header value`);\n}\nfunction jweAlgorithm(alg) {\n  return (typeof alg == \"string\" ? JWE[alg] : void 0) ?? unsupported(\"alg\", \"Algorithm\");\n}\nfunction isJWECEKTransport(algorithm) {\n  return algorithm.mode === \"key-wrapping\" || algorithm.mode === \"key-encryption\" || algorithm.mode === \"key-agreement-with-key-wrapping\";\n}\nfunction jweEncryption(enc) {\n  return (typeof enc == \"string\" ? ENC[enc] : void 0) ?? unsupported(\"enc\", \"Encryption Algorithm\");\n}\nexport {\n  JWE,\n  isJWECEKTransport,\n  jweAlgorithm,\n  jweEncryption\n};\n","import { encode as b64u } from \"../util/base64url.js\";\nimport { prepareKey, rawKey, jwkToKey, checkCryptoKey, checkModulusLength, checkUsage, assertCryptoKey } from \"./key.js\";\nimport { jweAlgorithm, jweEncryption, isJWECEKTransport } from \"./jwe_algorithms.js\";\nimport { JOSENotSupported, JWEInvalid } from \"../util/errors.js\";\nimport { decodeBase64url, assertUint8Array, isObject } from \"./validate.js\";\nimport { digest, concat, encode, uint32be } from \"./buffer_utils.js\";\nimport { checkCekLength, generateCek, encrypt, decrypt } from \"./content_encryption.js\";\nfunction checkEcdhCryptoKey(key, usage) {\n  if (key.algorithm.name !== \"ECDH\" && key.algorithm.name !== \"X25519\")\n    throw new TypeError(\"CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519\");\n  checkUsage(key, usage);\n}\nasync function aeskwWrap(alg, key, cek) {\n  const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, \"wrapKey\", !0), cryptoKeyCek = await crypto.subtle.importKey(\"raw\", cek, { hash: \"SHA-256\", name: \"HMAC\" }, !0, [\"sign\"]);\n  return new Uint8Array(await crypto.subtle.wrapKey(\"raw\", cryptoKeyCek, cryptoKey, \"AES-KW\"));\n}\nasync function aeskwUnwrap(alg, key, encryptedKey) {\n  const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, \"unwrapKey\", !0), cryptoKeyCek = await crypto.subtle.unwrapKey(\"raw\", encryptedKey, cryptoKey, \"AES-KW\", { hash: \"SHA-256\", name: \"HMAC\" }, !0, [\"sign\"]);\n  return new Uint8Array(await crypto.subtle.exportKey(\"raw\", cryptoKeyCek));\n}\nfunction checkRsaKey(alg, key, usage) {\n  checkCryptoKey(key, jweAlgorithm(alg).subtle, usage), checkModulusLength(alg, key);\n}\nasync function deriveKey(p2s, alg, p2c, key) {\n  if (!(p2s instanceof Uint8Array) || p2s.length < 8)\n    throw new JWEInvalid(\"PBES2 Salt Input must be 8 or more octets\");\n  if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1)\n    throw new JWEInvalid(\"PBES2 Count Input must be a positive integer\");\n  const salt = concat(encode(alg), Uint8Array.of(0), p2s), keylen = parseInt(alg.slice(13, 16), 10), subtleAlg = {\n    hash: `SHA-${alg.slice(8, 11)}`,\n    iterations: p2c,\n    name: \"PBKDF2\",\n    salt\n  }, cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, \"deriveBits\");\n  return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));\n}\nfunction lengthAndInput(input) {\n  return concat(uint32be(input.length), input);\n}\nasync function concatKdf(Z, L, OtherInfo) {\n  const dkLen = L >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);\n  for (let i = 1; i <= reps; i++) {\n    const hashResult = await digest(\"sha256\", concat(uint32be(i), Z, OtherInfo));\n    dk.set(hashResult, (i - 1) * hashLen);\n  }\n  return dk.slice(0, dkLen);\n}\nasync function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {\n  checkEcdhCryptoKey(publicKey), checkEcdhCryptoKey(privateKey, \"deriveBits\");\n  const otherInfo = concat(lengthAndInput(encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength)), Z = new Uint8Array(await crypto.subtle.deriveBits({\n    name: publicKey.algorithm.name,\n    public: publicKey\n  }, privateKey, publicKey.algorithm.name === \"X25519\" ? 256 : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));\n  return concatKdf(Z, keyLength, otherInfo);\n}\nfunction assertEcdhKey(key) {\n  assertCryptoKey(key);\n  const curve = key.algorithm.namedCurve;\n  if (curve !== \"P-256\" && curve !== \"P-384\" && curve !== \"P-521\" && key.algorithm.name !== \"X25519\")\n    throw new JOSENotSupported(\"ECDH with the provided key is not allowed or not supported by your javascript runtime\");\n}\nfunction partyInfo(joseHeader, name) {\n  const value = joseHeader[name];\n  if (value !== void 0) {\n    if (typeof value != \"string\")\n      throw new JWEInvalid(`JOSE Header \"${name}\" (Agreement Party${name === \"apu\" ? \"U\" : \"V\"}Info) invalid`);\n    return decodeBase64url(value, name, JWEInvalid);\n  }\n}\nfunction checkPartyInfo(apu, apv) {\n  if (!(apu === void 0 || apv === void 0 || apu.byteLength !== apv.byteLength)) {\n    for (let i = 0; i < apu.byteLength; i++)\n      if (apu[i] !== apv[i])\n        return;\n    throw new JWEInvalid('JOSE Header \"apu\" and \"apv\" values must be distinct');\n  }\n}\nfunction assertEncryptedKey(encryptedKey) {\n  if (encryptedKey === void 0)\n    throw new JWEInvalid(\"JWE Encrypted Key missing\");\n}\nfunction assertNoEncryptedKey(encryptedKey) {\n  if (encryptedKey !== void 0)\n    throw new JWEInvalid(\"Encountered unexpected JWE Encrypted Key\");\n}\nfunction validateMaxPBES2Count(value) {\n  if (value !== void 0 && value !== 1 / 0 && (!Number.isSafeInteger(value) || value < 1))\n    throw new TypeError(\"maxPBES2Count must be a positive safe integer or Infinity\");\n}\nasync function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, maxPBES2Count) {\n  const { alg } = entry, mode = entry.mode;\n  if (mode === \"direct-encryption\")\n    return assertNoEncryptedKey(encryptedKey), key;\n  const direct = mode === \"direct-key-agreement\";\n  switch (direct ? assertNoEncryptedKey(encryptedKey) : assertEncryptedKey(encryptedKey), entry.subtle.name) {\n    case \"ECDH\": {\n      const { epk } = joseHeader;\n      if (!isObject(epk) || [\"d\", \"k\", \"p\", \"q\", \"dp\", \"dq\", \"qi\", \"oth\", \"priv\"].some((parameter) => Object.hasOwn(epk, parameter)))\n        throw new JWEInvalid('JOSE Header \"epk\" (Ephemeral Public Key) missing or invalid');\n      assertEcdhKey(key);\n      const ephemeralPublicKey = await jwkToKey(entry, epk), partyUInfo = partyInfo(joseHeader, \"apu\"), partyVInfo = partyInfo(joseHeader, \"apv\");\n      checkPartyInfo(partyUInfo, partyVInfo);\n      const sharedSecret = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);\n      if (direct)\n        return sharedSecret;\n      key = sharedSecret;\n      break;\n    }\n    case \"RSA-OAEP\":\n      return assertCryptoKey(key), checkRsaKey(alg, key, \"decrypt\"), new Uint8Array(await crypto.subtle.decrypt(\"RSA-OAEP\", key, encryptedKey));\n    case \"PBKDF2\": {\n      if (typeof joseHeader.p2c != \"number\")\n        throw new JWEInvalid('JOSE Header \"p2c\" (PBES2 Count) missing or invalid');\n      validateMaxPBES2Count(maxPBES2Count);\n      const p2cLimit = maxPBES2Count ?? 1e4;\n      if (joseHeader.p2c > p2cLimit)\n        throw new JWEInvalid('JOSE Header \"p2c\" (PBES2 Count) out is of acceptable bounds');\n      if (typeof joseHeader.p2s != \"string\")\n        throw new JWEInvalid('JOSE Header \"p2s\" (PBES2 Salt) missing or invalid');\n      const p2s = decodeBase64url(joseHeader.p2s, \"p2s\", JWEInvalid);\n      key = await deriveKey(p2s, alg, joseHeader.p2c, key);\n      break;\n    }\n    case \"AES-GCM\": {\n      if (typeof joseHeader.iv != \"string\")\n        throw new JWEInvalid('JOSE Header \"iv\" (Initialization Vector) missing or invalid');\n      if (typeof joseHeader.tag != \"string\")\n        throw new JWEInvalid('JOSE Header \"tag\" (Authentication Tag) missing or invalid');\n      const iv = decodeBase64url(joseHeader.iv, \"iv\", JWEInvalid), tag = decodeBase64url(joseHeader.tag, \"tag\", JWEInvalid);\n      if (iv.byteLength !== 12)\n        throw new JWEInvalid(\"Invalid Initialization Vector length\");\n      if (tag.byteLength !== 16)\n        throw new JWEInvalid(\"Invalid Authentication Tag length\");\n      return decrypt(jweEncryption(alg.slice(0, -2)), key, encryptedKey, iv, tag, new Uint8Array());\n    }\n  }\n  return aeskwUnwrap(alg.slice(-6), key, encryptedKey);\n}\nasync function encryptKeyManagement(entry, enc, inputKey, joseHeader, providedCek, providedParameters = {}) {\n  const { alg, mode } = entry, transport = isJWECEKTransport(entry);\n  if (providedCek !== void 0 && !transport)\n    throw new TypeError(`setContentEncryptionKey cannot be called with JWE \"alg\" (Algorithm) Header ${alg}`);\n  let key = await prepareKey(mode === \"direct-encryption\" ? enc : entry, inputKey, \"encrypt\");\n  if (mode === \"direct-encryption\")\n    return [key, void 0, void 0];\n  const cek = transport ? providedCek ?? generateCek(enc) : void 0;\n  cek && checkCekLength(cek, enc.cekBits);\n  let encryptedKey, parameters;\n  switch (entry.subtle.name) {\n    case \"ECDH\": {\n      assertEcdhKey(key);\n      const { apu: providedApu, apv: providedApv } = providedParameters;\n      providedApu !== void 0 && assertUint8Array(providedApu, '\"apu\"'), providedApv !== void 0 && assertUint8Array(providedApv, '\"apv\"');\n      const apu = providedApu ?? partyInfo(joseHeader, \"apu\"), apv = providedApv ?? partyInfo(joseHeader, \"apv\");\n      checkPartyInfo(apu, apv);\n      let ephemeralKey;\n      providedParameters.epk !== void 0 ? ephemeralKey = await prepareKey(entry, providedParameters.epk, \"decrypt\") : ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, !0, [\"deriveBits\"])).privateKey;\n      const subtle = crypto.subtle;\n      let exportableEpk = ephemeralKey;\n      if (!exportableEpk.extractable) {\n        if (typeof subtle.getPublicKey != \"function\")\n          throw new TypeError('CryptoKey for \"epk\" must be extractable');\n        exportableEpk = await subtle.getPublicKey(ephemeralKey, []);\n      }\n      const { x, y, crv, kty } = await subtle.exportKey(\"jwk\", exportableEpk), direct = mode === \"direct-key-agreement\", sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = { x, crv, kty };\n      if (kty === \"EC\" && (epk.y = y), parameters = { epk }, providedApu !== void 0 && (parameters.apu = b64u(providedApu)), providedApv !== void 0 && (parameters.apv = b64u(providedApv)), direct)\n        return [sharedSecret, void 0, parameters];\n      key = sharedSecret;\n      break;\n    }\n    case \"RSA-OAEP\": {\n      assertCryptoKey(key), checkRsaKey(alg, key, \"encrypt\"), encryptedKey = new Uint8Array(await crypto.subtle.encrypt(\"RSA-OAEP\", key, cek));\n      break;\n    }\n    case \"PBKDF2\": {\n      const { p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16)) } = providedParameters;\n      key = await deriveKey(p2s, alg, p2c, key), parameters = { p2c, p2s: b64u(p2s) };\n      break;\n    }\n    case \"AES-GCM\": {\n      const iv = providedParameters.iv === void 0 ? crypto.getRandomValues(new Uint8Array(12)) : providedParameters.iv;\n      if (!(iv instanceof Uint8Array))\n        throw new TypeError('\"iv\" must be an instance of Uint8Array');\n      const wrapped = await encrypt(jweEncryption(alg.slice(0, -2)), cek, key, iv, new Uint8Array());\n      encryptedKey = wrapped.ciphertext, parameters = { iv: b64u(wrapped.iv), tag: b64u(wrapped.tag) };\n    }\n  }\n  if (encryptedKey ??= await aeskwWrap(alg.slice(-6), key, cek), !(encryptedKey instanceof Uint8Array) || !encryptedKey.byteLength)\n    throw new TypeError(\"JWE key management algorithm did not produce an Encrypted Key\");\n  return [cek, encryptedKey, parameters];\n}\nexport {\n  decryptKeyManagement,\n  encryptKeyManagement,\n  validateMaxPBES2Count\n};\n","import { JOSENotSupported, JWEInvalid } from \"../util/errors.js\";\nimport { concat } from \"./buffer_utils.js\";\nfunction validateZip(joseHeader, protectedHeader) {\n  if (joseHeader.zip !== void 0 && joseHeader.zip !== \"DEF\")\n    throw new JOSENotSupported('Unsupported JWE \"zip\" (Compression Algorithm) Header Parameter value.');\n  if (joseHeader.zip !== void 0 && !protectedHeader?.zip)\n    throw new JWEInvalid('JWE \"zip\" (Compression Algorithm) Header Parameter MUST be in a protected header.');\n}\nfunction supported(name) {\n  if (typeof globalThis[name] > \"u\")\n    throw new JOSENotSupported(`JWE \"zip\" (Compression Algorithm) Header Parameter requires the ${name} API.`);\n}\nasync function transform(stream, input, maxLength = 1 / 0) {\n  const writer = stream.writable.getWriter();\n  writer.write(input).catch(() => {\n  }), writer.close().catch(() => {\n  });\n  const chunks = [];\n  let length = 0;\n  const reader = stream.readable.getReader();\n  for (; ; ) {\n    const { value, done } = await reader.read();\n    if (done)\n      break;\n    if (chunks.push(value), length += value.byteLength, maxLength !== 1 / 0 && length > maxLength)\n      throw new JWEInvalid(\"Decompressed plaintext exceeded the configured limit\");\n  }\n  return concat(...chunks);\n}\nasync function compress(input) {\n  return supported(\"CompressionStream\"), transform(new CompressionStream(\"deflate-raw\"), input);\n}\nasync function decompress(input, maxLength) {\n  return supported(\"DecompressionStream\"), transform(new DecompressionStream(\"deflate-raw\"), input, maxLength);\n}\nexport {\n  compress,\n  decompress,\n  validateZip\n};\n","import { decrypt, generateCek } from \"./content_encryption.js\";\nimport { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateCrit, validateAlgorithms, JWE_RECOGNIZED } from \"./validate.js\";\nimport { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from \"../util/errors.js\";\nimport { decryptKeyManagement } from \"./key_management.js\";\nimport { decoder } from \"./buffer_utils.js\";\nimport { prepareKey } from \"./key.js\";\nimport { JWE, isJWECEKTransport, jweAlgorithm, jweEncryption } from \"./jwe_algorithms.js\";\nimport { decompress, validateZip } from \"./deflate.js\";\nfunction snapshotSharedJWE(jwe) {\n  const { aad, ciphertext, iv, protected: encodedProtected, tag, unprotected } = jwe;\n  if (iv !== void 0 && (typeof iv != \"string\" || !iv))\n    throw new JWEInvalid(\"JWE Initialization Vector incorrect type\");\n  if (typeof ciphertext != \"string\")\n    throw new JWEInvalid(\"JWE Ciphertext missing or incorrect type\");\n  if (tag !== void 0 && (typeof tag != \"string\" || !tag))\n    throw new JWEInvalid(\"JWE Authentication Tag incorrect type\");\n  if (encodedProtected !== void 0 && typeof encodedProtected != \"string\")\n    throw new JWEInvalid(\"JWE Protected Header incorrect type\");\n  if (aad !== void 0 && (typeof aad != \"string\" || !aad))\n    throw new JWEInvalid(\"JWE AAD incorrect type\");\n  if (unprotected !== void 0 && !isObject(unprotected))\n    throw new JWEInvalid(\"JWE Shared Unprotected Header incorrect type\");\n  return {\n    aad,\n    ciphertext,\n    iv,\n    protected: encodedProtected,\n    tag,\n    unprotected: unprotected === void 0 ? void 0 : { ...unprotected }\n  };\n}\nfunction snapshotRecipientJWE(recipient) {\n  let header, headerAlg;\n  try {\n    const { header: inputHeader } = recipient;\n    if (isObject(inputHeader)) {\n      headerAlg = inputHeader.alg;\n      const parameters = Object.keys(inputHeader);\n      parameters.includes(\"alg\") || (headerAlg = void 0), header = Object.fromEntries(parameters.map((parameter) => [\n        parameter,\n        parameter === \"alg\" ? headerAlg : inputHeader[parameter]\n      ]));\n    } else\n      header = inputHeader;\n    const { encrypted_key: encryptedKey } = recipient;\n    return [{ encrypted_key: encryptedKey, header }, headerAlg];\n  } catch (error) {\n    return [void 0, headerAlg, error];\n  }\n}\nfunction checkRecipient(jwe) {\n  const { encrypted_key: encryptedKey, header } = jwe;\n  if (encryptedKey !== void 0 && typeof encryptedKey != \"string\")\n    throw new JWEInvalid(\"JWE Encrypted Key incorrect type\");\n  if (header !== void 0 && !isObject(header))\n    throw new JWEInvalid(\"JWE Per-Recipient Unprotected Header incorrect type\");\n  if (jwe.protected === void 0 && header === void 0 && jwe.unprotected === void 0)\n    throw new JWEInvalid(\"JOSE Header missing\");\n}\nfunction shareJWE(jwe) {\n  const { protected: encodedProtected, ciphertext, iv, tag, aad } = jwe;\n  let parsedProt;\n  return encodedProtected !== void 0 && (parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, \"JWE Protected Header is invalid\")), [\n    parsedProt,\n    decodeBase64url(ciphertext, \"ciphertext\", JWEInvalid),\n    iv !== void 0 ? decodeBase64url(iv, \"iv\", JWEInvalid) : void 0,\n    tag !== void 0 ? decodeBase64url(tag, \"tag\", JWEInvalid) : void 0,\n    encodeBase64url((encodedProtected ?? \"\") + (aad !== void 0 ? `.${aad}` : \"\"), \"aad\", JWEInvalid)\n  ];\n}\nfunction prepareDecrypt(options) {\n  return [\n    options && validateAlgorithms(\"keyManagementAlgorithms\", options.keyManagementAlgorithms),\n    options && validateAlgorithms(\"contentEncryptionAlgorithms\", options.contentEncryptionAlgorithms),\n    options?.crit,\n    options?.maxPBES2Count,\n    options?.maxDecompressedLength\n  ];\n}\nasync function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {\n  const [parsedProt, ciphertext, iv, tag, additionalData] = token, { header, unprotected, aad } = jwe;\n  let joseHeader;\n  if (header !== void 0 || unprotected !== void 0) {\n    if (!isDisjoint(parsedProt, header, unprotected))\n      throw new JWEInvalid(\"JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint\");\n    joseHeader = { ...parsedProt, ...header, ...unprotected };\n  } else\n    joseHeader = parsedProt ?? {};\n  const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared, { encrypted_key: encodedKey } = jwe;\n  validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader), validateZip(joseHeader, parsedProt);\n  const { alg, enc } = joseHeader;\n  if (typeof alg != \"string\" || !alg)\n    throw new JWEInvalid(\"missing JWE Algorithm (alg) in JWE Header\");\n  const selected = JWE[alg];\n  if (encodedKey === \"\" && (!selected || !isJWECEKTransport(selected)))\n    throw new JWEInvalid(\"JWE Encrypted Key incorrect type\");\n  const integrated = selected?.mode === \"integrated-encryption\";\n  if (!integrated && (typeof enc != \"string\" || !enc))\n    throw new JWEInvalid(\"missing JWE Encryption Algorithm (enc) in JWE Header\");\n  if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg) || !keyManagementAlgorithms && alg.startsWith(\"PBES2\"))\n    throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n  let encEntry;\n  if (integrated) {\n    if (enc !== void 0)\n      throw new JWEInvalid('JWE \"enc\" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');\n    if (iv?.byteLength)\n      throw new JWEInvalid(\"JWE Initialization Vector must be empty for integrated encryption\");\n    if (tag?.byteLength)\n      throw new JWEInvalid(\"JWE Authentication Tag must be empty for integrated encryption\");\n  } else {\n    if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc))\n      throw new JOSEAlgNotAllowed('\"enc\" (Encryption Algorithm) Header Parameter value not allowed');\n    encEntry = jweEncryption(enc);\n  }\n  let encryptedKey;\n  if (encodedKey !== void 0)\n    try {\n      encryptedKey = decodeBase64url(encodedKey, \"encrypted_key\", JWEInvalid);\n    } catch (error) {\n      if (!selected || !isJWECEKTransport(selected))\n        throw error;\n      encryptedKey = new Uint8Array();\n    }\n  let resolvedKey = !1;\n  typeof key == \"function\" && (key = await key(parsedProt, jwe), resolvedKey = !0);\n  const algEntry = selected ?? jweAlgorithm(alg);\n  isJWECEKTransport(algEntry) && encryptedKey === void 0 && (encryptedKey = new Uint8Array());\n  const k = await prepareKey(algEntry.mode === \"direct-encryption\" ? encEntry : algEntry, key, \"decrypt\");\n  let plaintext;\n  if (algEntry.mode === \"integrated-encryption\")\n    plaintext = await algEntry.decrypt(k, encryptedKey, ciphertext, additionalData, parsedProt, joseHeader);\n  else {\n    const encryption = encEntry;\n    let cek;\n    try {\n      cek = await decryptKeyManagement(algEntry, encryption, k, encryptedKey, joseHeader, maxPBES2Count), isJWECEKTransport(algEntry) && cek instanceof Uint8Array && cek.byteLength << 3 !== encryption.cekBits && (cek = generateCek(encryption));\n    } catch (err) {\n      if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported)\n        throw err;\n      cek = generateCek(encryption);\n    }\n    plaintext = await decrypt(encryption, cek, ciphertext, iv, tag, additionalData);\n  }\n  if (joseHeader.zip === \"DEF\") {\n    const decompressionLimit = maxDecompressedLength ?? 25e4;\n    if (decompressionLimit === 0)\n      throw new JOSENotSupported('JWE \"zip\" (Compression Algorithm) Header Parameter is not supported.');\n    if (decompressionLimit !== 1 / 0 && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1))\n      throw new TypeError(\"maxDecompressedLength must be 0, a positive safe integer, or Infinity\");\n    plaintext = await decompress(plaintext, decompressionLimit).catch((cause) => {\n      throw cause instanceof JWEInvalid ? cause : new JWEInvalid(\"Failed to decompress plaintext\", { cause });\n    });\n  }\n  return {\n    plaintext,\n    ...parsedProt && { protectedHeader: parsedProt },\n    ...aad !== void 0 && {\n      additionalAuthenticatedData: decodeBase64url(aad, \"aad\", JWEInvalid)\n    },\n    ...unprotected && { sharedUnprotectedHeader: unprotected },\n    ...header && { unprotectedHeader: header },\n    ...resolvedKey && { key: k }\n  };\n}\nasync function decryptCompact(jwe, shared, key) {\n  if (jwe instanceof Uint8Array && (jwe = decoder.decode(jwe)), typeof jwe != \"string\")\n    throw new JWEInvalid(\"Compact JWE must be a string or Uint8Array\");\n  const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag, length } = jwe.split(\".\");\n  if (length !== 5)\n    throw new JWEInvalid(\"Invalid Compact JWE\");\n  return decryptJWE({\n    ciphertext,\n    iv: iv || void 0,\n    protected: protectedHeader,\n    tag: tag || void 0,\n    encrypted_key: encryptedKey || void 0\n  }, shared, key);\n}\nexport {\n  checkRecipient,\n  decryptCompact,\n  decryptJWE,\n  prepareDecrypt,\n  shareJWE,\n  snapshotRecipientJWE,\n  snapshotSharedJWE\n};\n","import { encode as b64u } from \"../util/base64url.js\";\nimport { encrypt } from \"./content_encryption.js\";\nimport { encryptKeyManagement } from \"./key_management.js\";\nimport { JWEInvalid } from \"../util/errors.js\";\nimport { assertUint8Array, isDisjoint, isObject, serializeJoseHeader, validateCrit, validateCritDuplicates, JWE_RECOGNIZED } from \"./validate.js\";\nimport { encode } from \"./buffer_utils.js\";\nimport { prepareKey } from \"./key.js\";\nimport { JWE, jweAlgorithm, jweEncryption } from \"./jwe_algorithms.js\";\nimport { compress, validateZip } from \"./deflate.js\";\nfunction checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {\n  if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader))\n    throw new JWEInvalid(\"JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint\");\n}\nfunction checkEncryptHeaders(input, options, sharedHeadersNormalized = !1) {\n  if (!input[1] && !input[2] && !input[3])\n    throw new JWEInvalid(\"either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()\");\n  options !== void 0 && (input[8] = options?.crit);\n  let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit] = input;\n  if (aad !== void 0 && assertUint8Array(aad, \"JWE Additional Authenticated Data\"), cek !== void 0 && assertUint8Array(cek, \"JWE Content Encryption Key\"), iv !== void 0 && assertUint8Array(iv, \"JWE Initialization Vector\"), !sharedHeadersNormalized && protectedHeader !== void 0 && (protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0], input[1] = protectedHeader), unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0], input[2] = unprotectedHeader), !sharedHeadersNormalized && sharedUnprotectedHeader !== void 0 && (sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0], input[3] = sharedUnprotectedHeader), keyManagementParameters !== void 0 && !isObject(keyManagementParameters))\n    throw new TypeError(\"JWE Key Management Parameters must be an object\");\n  checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);\n  const joseHeader = {\n    ...protectedHeader,\n    ...unprotectedHeader,\n    ...sharedUnprotectedHeader\n  };\n  validateCritDuplicates(JWEInvalid, protectedHeader), validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader), validateZip(joseHeader, protectedHeader);\n  const { alg, enc } = joseHeader;\n  if (typeof alg != \"string\" || !alg)\n    throw new JWEInvalid('JWE \"alg\" (Algorithm) Header Parameter missing or invalid');\n  const algEntry = JWE[alg];\n  if (algEntry?.mode === \"integrated-encryption\") {\n    if (enc !== void 0)\n      throw new JWEInvalid('JWE \"enc\" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');\n    if (cek !== void 0)\n      throw new TypeError(`setContentEncryptionKey cannot be called with JWE \"alg\" (Algorithm) Header ${alg}`);\n    if (iv !== void 0)\n      throw new TypeError(`setInitializationVector cannot be called with JWE \"alg\" (Algorithm) Header ${alg}`);\n    return [joseHeader, void 0, algEntry];\n  }\n  if (typeof enc != \"string\" || !enc)\n    throw new JWEInvalid('JWE \"enc\" (Encryption Algorithm) Header Parameter missing or invalid');\n  return [joseHeader, jweEncryption(enc), algEntry];\n}\nasync function encryptJWE(input, checked, key) {\n  const [joseHeader, encEntry, selected] = checked, [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters] = input;\n  let protectedHeader = inputProtectedHeader, unprotectedHeader = inputUnprotectedHeader;\n  const algEntry = selected ?? jweAlgorithm(joseHeader.alg);\n  let encryptedKey, parameters, cek;\n  algEntry.mode === \"integrated-encryption\" ? cek = await prepareKey(algEntry, key, \"encrypt\") : [cek, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, providedCek, keyManagementParameters), parameters && (unprotectedParameters ? unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters : protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters, checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader));\n  const protectedHeaderS = protectedHeader ? b64u(JSON.stringify(protectedHeader)) : \"\", aadMember = aad?.byteLength ? b64u(aad) : void 0, additionalData = encode(aadMember ? `${protectedHeaderS}.${aadMember}` : protectedHeaderS);\n  let plaintext = inputPlaintext;\n  joseHeader.zip === \"DEF\" && (plaintext = await compress(plaintext).catch((cause) => {\n    throw new JWEInvalid(\"Failed to compress plaintext\", { cause });\n  }));\n  let ciphertext, tag, iv;\n  algEntry.mode === \"integrated-encryption\" ? [encryptedKey, ciphertext] = await algEntry.encrypt(cek, plaintext, additionalData, protectedHeader, joseHeader, keyManagementParameters) : { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);\n  const jwe = {\n    ciphertext: b64u(ciphertext)\n  };\n  return iv && (jwe.iv = b64u(iv)), tag && (jwe.tag = b64u(tag)), encryptedKey?.byteLength && (jwe.encrypted_key = b64u(encryptedKey)), aadMember && (jwe.aad = aadMember), protectedHeader && (jwe.protected = protectedHeaderS), sharedUnprotectedHeader && (jwe.unprotected = sharedUnprotectedHeader), unprotectedHeader && (jwe.header = unprotectedHeader), jwe;\n}\nasync function createJWE(input, key, options) {\n  return encryptJWE(input, checkEncryptHeaders(input, options), key);\n}\nfunction compactJWE(jwe) {\n  return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(\".\");\n}\nexport {\n  checkDisjoint,\n  checkEncryptHeaders,\n  compactJWE,\n  createJWE,\n  encryptJWE\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n  const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n  return { kty: [\"oct\"], secret: !0, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n  const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n  return {\n    kty: [\"RSA\"],\n    subtle,\n    signing: saltLength ? { ...subtle, saltLength } : subtle,\n    usages: sig,\n    minRsaBits: 2048\n  };\n}\nfunction ecdsa(crv, bits) {\n  return {\n    kty: [\"EC\"],\n    crv,\n    subtle: { name: \"ECDSA\", namedCurve: crv },\n    signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n    usages: sig\n  };\n}\nfunction eddsa() {\n  const subtle = { name: \"Ed25519\" };\n  return {\n    kty: [\"OKP\"],\n    crv: \"Ed25519\",\n    subtle,\n    signing: subtle,\n    usages: sig\n  };\n}\nfunction mldsa(bits) {\n  const subtle = { name: `ML-DSA-${bits}` };\n  return {\n    kty: [\"AKP\"],\n    subtle,\n    signing: subtle,\n    usages: sig\n  };\n}\nconst JWS = table({\n  HS256: hmac(256),\n  HS384: hmac(384),\n  HS512: hmac(512),\n  RS256: rsa(256),\n  RS384: rsa(384),\n  RS512: rsa(512),\n  PS256: rsa(256, 32),\n  PS384: rsa(384, 48),\n  PS512: rsa(512, 64),\n  ES256: ecdsa(\"P-256\", 256),\n  ES384: ecdsa(\"P-384\", 384),\n  ES512: ecdsa(\"P-521\", 512),\n  EdDSA: eddsa(),\n  Ed25519: eddsa(),\n  \"ML-DSA-44\": mldsa(44),\n  \"ML-DSA-65\": mldsa(65),\n  \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n  const entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n  if (!entry)\n    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n  return entry;\n}\nexport {\n  JWS,\n  jwsAlgorithm\n};\n","import { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from \"../util/errors.js\";\nimport { concat, decoder, encoder, encode } from \"./buffer_utils.js\";\nimport { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from \"./validate.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nfunction snapshotJws(jws, sharedPayload) {\n  const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;\n  let payload = sharedPayload ? sharedPayload[0] : jws.payload;\n  !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));\n  const signature = jws.signature, snapshot = { payload, signature };\n  if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)\n    throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n  if (encodedProtected !== void 0 && typeof encodedProtected != \"string\")\n    throw new JWSInvalid(\"JWS Protected Header incorrect type\");\n  if (payload === void 0)\n    throw new JWSInvalid(\"JWS Payload missing\");\n  if (typeof signature != \"string\")\n    throw new JWSInvalid(\"JWS Signature missing or incorrect type\");\n  if (header !== void 0 && !isObject(header))\n    throw new JWSInvalid(\"JWS Unprotected Header incorrect type\");\n  return snapshot;\n}\nfunction prepareVerify(options) {\n  return [options && validateAlgorithms(\"algorithms\", options.algorithms), options?.crit];\n}\nfunction parseProtectedHeader(encodedProtected) {\n  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, \"JWS Protected Header is invalid\");\n}\nfunction encodeJsonUnencodedPayload(payload) {\n  const invalid = /[\\p{Cs}\\p{Cn}]/u.exec(payload)?.[0];\n  if (invalid !== void 0)\n    throw new JWSInvalid(/\\p{Cs}/u.test(invalid) ? \"JWS Payload must be a well-formed Unicode string\" : \"JWS Payload must not contain unassigned Unicode code points\");\n  return encoder.encode(payload);\n}\nfunction encodeCompactUnencodedPayload(payload) {\n  try {\n    return encode(payload);\n  } catch {\n    throw new JWSInvalid(\"JWS Compact Serialization payload must use only ASCII characters\");\n  }\n}\nasync function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {\n  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);\n  if (!isDisjoint(parsedProt, header))\n    throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;\n  if (typeof alg != \"string\" || !alg)\n    throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n  if (shared[0] && !shared[0].has(alg))\n    throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n  if (b64) {\n    if (typeof inputPayload != \"string\")\n      throw new JWSInvalid(\"JWS Payload must be a string\");\n  } else if (typeof inputPayload != \"string\" && !(inputPayload instanceof Uint8Array))\n    throw new JWSInvalid(\"JWS Payload must be a string or an Uint8Array instance\");\n  const signingPayload = b64 || typeof inputPayload != \"string\" ? inputPayload : encodeUnencodedPayload(inputPayload);\n  let resolvedKey = !1;\n  typeof key == \"function\" && (key = await key(parsedProt, jws), resolvedKey = !0);\n  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode(\".\"), typeof signingPayload == \"string\" ? shared[2] ??= encodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, \"signature\", JWSInvalid), k = await prepareKey(entry, key, \"verify\"), cryptoKey = await rawKey(k, entry.subtle, \"verify\");\n  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);\n  let verified = !1;\n  try {\n    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);\n  } catch {\n  }\n  if (!verified)\n    throw new JWSSignatureVerificationFailed();\n  const result = { payload: typeof signingPayload == \"string\" ? decodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload };\n  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];\n}\nasync function verifyCompact(jws, shared, key) {\n  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != \"string\")\n    throw new JWSInvalid(\"Compact JWS must be a string or Uint8Array\");\n  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(\".\");\n  if (length !== 3)\n    throw new JWSInvalid(\"Invalid Compact JWS\");\n  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);\n}\nexport {\n  encodeJsonUnencodedPayload,\n  parseProtectedHeader,\n  prepareVerify,\n  snapshotJws,\n  verifyCompact,\n  verifySignature\n};\n","import { prepareVerify, verifyCompact } from \"../../lib/jws_verify.js\";\nasync function compactVerify(jws, key, options) {\n  const [result] = await verifyCompact(jws, prepareVerify(options), key);\n  return result;\n}\nexport {\n  compactVerify\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from \"../util/errors.js\";\nimport { encoder, strictDecoder } from \"./buffer_utils.js\";\nimport { isObject } from \"./validate.js\";\nconst epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {\n  s: 1,\n  m: 60,\n  h: 3600,\n  d: 86400,\n  w: 604800,\n  y: 31557600\n}, REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = \"check_failed\";\nfunction invalidDuration() {\n  throw new TypeError(\"Invalid time period format\");\n}\nfunction secs(str) {\n  typeof str != \"string\" && invalidDuration();\n  const matched = REGEX.exec(str);\n  (!matched || matched[4] && matched[1]) && invalidDuration();\n  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);\n  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === \"-\" || matched[4] === \"ago\" ? -numericDate2 : numericDate2;\n}\nfunction validateInput(label, input) {\n  if (!Number.isFinite(input))\n    throw new TypeError(`Invalid ${label} input`);\n  return input;\n}\nfunction validateStringClaim(claim, value) {\n  if (typeof value != \"string\")\n    throw new TypeError(`\"${claim}\" claim must be a string`);\n}\nfunction validateAudienceClaim(value) {\n  if (typeof value != \"string\" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != \"string\")))\n    throw new TypeError('\"aud\" claim must be a string or an array of strings');\n}\nfunction numericDate(value, label) {\n  return typeof value == \"number\" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);\n}\nconst normalizeTyp = (value) => {\n  const normalized = value.toLowerCase();\n  return value.includes(\"/\") ? normalized : `application/${normalized}`;\n}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == \"string\" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;\nfunction validateNumericDate(payload, claim, required = !1) {\n  const value = payload[claim];\n  if (!(value === void 0 && !required)) {\n    if (typeof value != \"number\")\n      throw new JWTClaimValidationFailed(`\"${claim}\" claim must be a number`, payload, claim, \"invalid\");\n    return value;\n  }\n}\nfunction unexpectedClaim(payload, claim) {\n  throw new JWTClaimValidationFailed(`unexpected \"${claim}\" claim value`, payload, claim, checkFailed);\n}\nfunction validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n  let payload;\n  try {\n    payload = JSON.parse(strictDecoder.decode(encodedPayload));\n  } catch {\n  }\n  if (!isObject(payload))\n    throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\");\n  const { typ } = options;\n  if (typ !== void 0 && (typeof protectedHeader.typ != \"string\" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))\n    throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, \"typ\", checkFailed);\n  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];\n  maxTokenAge !== void 0 && presenceCheck.push(\"iat\"), audience !== void 0 && presenceCheck.push(\"aud\"), subject !== void 0 && presenceCheck.push(\"sub\"), issuer !== void 0 && presenceCheck.push(\"iss\");\n  for (const claim of new Set(presenceCheck.reverse()))\n    if (!Object.hasOwn(payload, claim))\n      throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, \"missing\");\n  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, \"iss\"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, \"sub\"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == \"string\" ? [audience] : audience) && unexpectedClaim(payload, \"aud\");\n  const { clockTolerance } = options;\n  let tolerance = 0;\n  if (typeof clockTolerance == \"string\")\n    tolerance = secs(clockTolerance);\n  else if (clockTolerance !== void 0) {\n    if (typeof clockTolerance != \"number\")\n      throw new TypeError(\"Invalid clockTolerance option type\");\n    tolerance = clockTolerance;\n  }\n  validateInput(\"clockTolerance option\", tolerance);\n  const { currentDate } = options, now = validateInput(\"currentDate option\", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, \"iat\", maxTokenAge !== void 0), nbf = validateNumericDate(payload, \"nbf\");\n  if (nbf !== void 0 && nbf > now + tolerance)\n    throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, \"nbf\", checkFailed);\n  const exp = validateNumericDate(payload, \"exp\");\n  if (exp !== void 0 && exp <= now - tolerance)\n    throw new JWTExpired('\"exp\" claim timestamp check failed', payload, \"exp\", checkFailed);\n  if (maxTokenAge !== void 0) {\n    const age = now - iat, max = validateInput(\"maxTokenAge option\", typeof maxTokenAge == \"number\" ? maxTokenAge : secs(maxTokenAge));\n    if (age - tolerance > max)\n      throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, \"iat\", checkFailed);\n    if (age < -tolerance)\n      throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, \"iat\", checkFailed);\n  }\n  return payload;\n}\nlet producerPayloads;\nfunction producerPayload(producer) {\n  return producerPayloads.get(producer);\n}\nfunction jwtData(producer) {\n  const payload = producerPayload(producer);\n  for (const claim of [\"iat\", \"nbf\", \"exp\"]) {\n    const value = payload[claim];\n    if (typeof value == \"number\" && !Number.isFinite(value))\n      throw new TypeError(`\"${claim}\" claim must be a finite number`);\n  }\n  return encoder.encode(JSON.stringify(payload));\n}\nfunction jwtClaim(producer, claim) {\n  return producerPayload(producer)[claim];\n}\nclass JWTClaimsBuilder {\n  constructor(payload = {}) {\n    if (!isObject(payload))\n      throw new TypeError(\"JWT Claims Set MUST be an object\");\n    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));\n  }\n  setIssuer(value) {\n    return validateStringClaim(\"iss\", value), producerPayload(this).iss = value, this;\n  }\n  setSubject(value) {\n    return validateStringClaim(\"sub\", value), producerPayload(this).sub = value, this;\n  }\n  setAudience(value) {\n    return validateAudienceClaim(value), producerPayload(this).aud = value, this;\n  }\n  setJti(value) {\n    return validateStringClaim(\"jti\", value), producerPayload(this).jti = value, this;\n  }\n  setNotBefore(value) {\n    return producerPayload(this).nbf = numericDate(value, \"setNotBefore\"), this;\n  }\n  setExpirationTime(value) {\n    return producerPayload(this).exp = numericDate(value, \"setExpirationTime\"), this;\n  }\n  setIssuedAt(value) {\n    const payload = producerPayload(this);\n    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == \"string\" ? payload.iat = validateInput(\"setIssuedAt\", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, \"setIssuedAt\"), this;\n  }\n}\nexport {\n  JWTClaimsBuilder,\n  jwtClaim,\n  jwtData,\n  secs,\n  validateClaimsSet\n};\n","import { prepareVerify, verifyCompact } from \"../lib/jws_verify.js\";\nimport { validateClaimsSet } from \"../lib/jwt_claims_set.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nasync function jwtVerify(jwt, key, options) {\n  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);\n  if (!b64)\n    throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n  return { ...verified, payload };\n}\nexport {\n  jwtVerify\n};\n","import { prepareDecrypt, decryptCompact } from \"../lib/jwe_decrypt.js\";\nimport { validateClaimsSet } from \"../lib/jwt_claims_set.js\";\nimport { JWTClaimValidationFailed } from \"../util/errors.js\";\nasync function jwtDecrypt(jwt, key, options) {\n  const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key), { protectedHeader } = result, payload = validateClaimsSet(protectedHeader, plaintext, options);\n  for (const claim of [\"iss\", \"sub\", \"aud\"])\n    if (protectedHeader[claim] !== void 0 && (claim === \"aud\" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim]))\n      throw new JWTClaimValidationFailed(`replicated \"${claim}\" claim header parameter mismatch`, payload, claim, \"mismatch\");\n  return { payload, ...result };\n}\nexport {\n  jwtDecrypt\n};\n","import { encode as b64u } from \"../util/base64url.js\";\nimport { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { isDisjoint, serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from \"./validate.js\";\nimport { JWSInvalid } from \"../util/errors.js\";\nimport { concat, encode, encoder } from \"./buffer_utils.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nasync function createSignature(input, key, rejectUnencoded) {\n  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = \"\";\n  if (protectedHeader !== void 0) {\n    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);\n    protectedHeader = normalized[0], protectedHeaderString = b64u(normalized[1]);\n  }\n  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)\n    throw new JWSInvalid(\"either setProtectedHeader or setUnprotectedHeader must be called before #sign()\");\n  if (!isDisjoint(protectedHeader, unprotectedHeader))\n    throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n  const joseHeader = { ...protectedHeader, ...unprotectedHeader };\n  validateCritDuplicates(JWSInvalid, protectedHeader);\n  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));\n  b64 || rejectUnencoded?.();\n  const { alg } = joseHeader;\n  if (typeof alg != \"string\" || !alg)\n    throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n  const entry = jwsAlgorithm(alg);\n  let payloadS = \"\", payloadB = payload, data;\n  if (b64) {\n    const encoded = input[4];\n    encoded ? (payloadS = encoded[0] ??= b64u(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = b64u(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));\n  }\n  data ??= concat(encode(protectedHeaderString), encode(\".\"), payloadB);\n  const k = await rawKey(await prepareKey(entry, key, \"sign\"), entry.subtle, \"sign\");\n  entry.minRsaBits && checkModulusLength(entry.alg, k);\n  const jws = {\n    signature: b64u(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),\n    payload: payloadS\n  };\n  return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];\n}\nasync function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {\n  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);\n  return `${jws.protected}.${jws.payload}.${jws.signature}`;\n}\nexport {\n  createCompactSignature,\n  createSignature\n};\n","import { createCompactSignature } from \"../lib/jws_sign.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nimport { JWTClaimsBuilder, jwtData } from \"../lib/jwt_claims_set.js\";\nimport { assertNotSet } from \"../lib/validate.js\";\nconst SignJWT_base = JWTClaimsBuilder;\nclass SignJWT extends SignJWT_base {\n  #protectedHeader;\n  setProtectedHeader(protectedHeader) {\n    return assertNotSet(this.#protectedHeader, \"setProtectedHeader\"), this.#protectedHeader = protectedHeader, this;\n  }\n  async sign(key, options) {\n    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {\n      throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n    });\n  }\n}\nexport {\n  SignJWT\n};\n","import { compactJWE, createJWE } from \"../lib/jwe_encrypt.js\";\nimport { JWTClaimsBuilder, jwtClaim, jwtData } from \"../lib/jwt_claims_set.js\";\nimport { assertNotSet } from \"../lib/validate.js\";\nconst EncryptJWT_base = JWTClaimsBuilder;\nclass EncryptJWT extends EncryptJWT_base {\n  #input = [void 0];\n  #replicateIssuerAsHeader;\n  #replicateSubjectAsHeader;\n  #replicateAudienceAsHeader;\n  setProtectedHeader(protectedHeader) {\n    return assertNotSet(this.#input[1], \"setProtectedHeader\"), this.#input[1] = protectedHeader, this;\n  }\n  setKeyManagementParameters(parameters) {\n    return assertNotSet(this.#input[7], \"setKeyManagementParameters\"), this.#input[7] = parameters, this;\n  }\n  setContentEncryptionKey(cek) {\n    return assertNotSet(this.#input[5], \"setContentEncryptionKey\"), this.#input[5] = cek, this;\n  }\n  setInitializationVector(iv) {\n    return assertNotSet(this.#input[6], \"setInitializationVector\"), this.#input[6] = iv, this;\n  }\n  replicateIssuerAsHeader() {\n    return this.#replicateIssuerAsHeader = !0, this;\n  }\n  replicateSubjectAsHeader() {\n    return this.#replicateSubjectAsHeader = !0, this;\n  }\n  replicateAudienceAsHeader() {\n    return this.#replicateAudienceAsHeader = !0, this;\n  }\n  async encrypt(key, options) {\n    const plaintext = jwtData(this);\n    this.#input[1] && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#input[1] = {\n      ...this.#input[1],\n      iss: this.#replicateIssuerAsHeader ? jwtClaim(this, \"iss\") : void 0,\n      sub: this.#replicateSubjectAsHeader ? jwtClaim(this, \"sub\") : void 0,\n      aud: this.#replicateAudienceAsHeader ? jwtClaim(this, \"aud\") : void 0\n    });\n    const input = [...this.#input];\n    return input[0] = plaintext, compactJWE(await createJWE(input, key, options));\n  }\n}\nexport {\n  EncryptJWT\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { JWS } from \"./jws_algorithms.js\";\nimport { JWE } from \"./jwe_algorithms.js\";\nconst algArgument = '\"alg\" (Algorithm)';\nfunction unsupportedAlg(source = 'JWK \"alg\" (Algorithm) Parameter') {\n  throw new JOSENotSupported(`Invalid or unsupported ${source} value`);\n}\nfunction keyAlgorithm(alg, source) {\n  return (typeof alg == \"string\" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);\n}\nexport {\n  algArgument,\n  keyAlgorithm,\n  unsupportedAlg\n};\n","import { invalidKeyInput, isCryptoKey, isKeyObject, validateExtractableOption } from \"./key.js\";\nimport { encodeBase64, decodeBase64 } from \"./buffer_utils.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nimport { keyAlgorithm, unsupportedAlg, algArgument } from \"./key_algorithm.js\";\nconst formatPEM = (b64, descriptor) => {\n  const newlined = (b64.match(/.{1,64}/g) || []).join(`\n`);\n  return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;\n}, genericExport = async (keyType, keyFormat, key) => {\n  if (isKeyObject(key)) {\n    if (key.type !== keyType)\n      throw new TypeError(`key is not a ${keyType} key`);\n    return key.export({ format: \"pem\", type: keyFormat });\n  }\n  if (!isCryptoKey(key))\n    throw new TypeError(invalidKeyInput(key, \"CryptoKey\", \"KeyObject\"));\n  if (!key.extractable)\n    throw new TypeError(\"CryptoKey is not extractable\");\n  if (key.type !== keyType)\n    throw new TypeError(`key is not a ${keyType} key`);\n  return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);\n}, toSPKI = (key) => genericExport(\"public\", \"spki\", key), toPKCS8 = (key) => genericExport(\"private\", \"pkcs8\", key), bytesEqual = (a, b) => {\n  if (a.byteLength !== b.length)\n    return !1;\n  for (let i = 0; i < a.byteLength; i++)\n    if (a[i] !== b[i])\n      return !1;\n  return !0;\n}, createASN1State = (data) => ({ data, pos: 0 }), readByte = (state) => {\n  const byte = state.data[state.pos++];\n  if (byte === void 0)\n    throw new Error(\"Unexpected end of ASN.1 input\");\n  return byte;\n}, parseLength = (state) => {\n  const first = readByte(state);\n  if (first & 128) {\n    const lengthOfLen = first & 127;\n    let length = 0;\n    for (let i = 0; i < lengthOfLen; i++)\n      length = length << 8 | readByte(state);\n    return length;\n  }\n  return first;\n}, skipElement = (state, count = 1) => {\n  for (; count-- > 0; ) {\n    state.pos++;\n    const length = parseLength(state);\n    state.pos += length;\n  }\n}, expectTag = (state, expectedTag, errorMessage) => {\n  if (readByte(state) !== expectedTag)\n    throw new Error(errorMessage);\n}, getSubarray = (state, length) => {\n  if (length < 0 || state.pos + length > state.data.length)\n    throw new Error(\"Unexpected end of ASN.1 input\");\n  const result = state.data.subarray(state.pos, state.pos + length);\n  return state.pos += length, result;\n}, parseAlgorithmOID = (state) => {\n  expectTag(state, 6, \"Expected algorithm OID\");\n  const oidLen = parseLength(state);\n  return getSubarray(state, oidLen);\n};\nfunction parseKeyHeader(state, keyFormat) {\n  if (expectTag(state, 48, `Invalid ${keyFormat === \"spki\" ? \"SPKI\" : \"PKCS#8\"} structure`), parseLength(state), keyFormat === \"pkcs8\") {\n    expectTag(state, 2, \"Expected version field\");\n    const length = parseLength(state);\n    state.pos += length;\n  }\n  expectTag(state, 48, \"Expected algorithm identifier\"), parseLength(state);\n}\nconst parseECAlgorithmIdentifier = (state) => {\n  const algOid = parseAlgorithmOID(state);\n  if (bytesEqual(algOid, [43, 101, 110]))\n    return \"X25519\";\n  if (!bytesEqual(algOid, [42, 134, 72, 206, 61, 2, 1]))\n    throw new Error(\"Unsupported key algorithm\");\n  expectTag(state, 6, \"Expected curve OID\");\n  const curveOidLen = parseLength(state), curveOid = getSubarray(state, curveOidLen);\n  if (bytesEqual(curveOid, [42, 134, 72, 206, 61, 3, 1, 7]))\n    return \"P-256\";\n  if (bytesEqual(curveOid, [43, 129, 4, 0, 34]))\n    return \"P-384\";\n  if (bytesEqual(curveOid, [43, 129, 4, 0, 35]))\n    return \"P-521\";\n  throw new Error(\"Unsupported named curve\");\n}, genericImport = async (keyFormat, keyData, alg, options) => {\n  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);\n  entry.secret && unsupportedAlg(algArgument);\n  const isPublic = keyFormat === \"spki\";\n  let algorithm;\n  if (entry.resolve)\n    try {\n      const state = createASN1State(keyData);\n      parseKeyHeader(state, keyFormat), algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });\n    } catch {\n      throw new JOSENotSupported(\"Invalid or unsupported key format\");\n    }\n  else\n    algorithm = entry.subtle;\n  return crypto.subtle.importKey(keyFormat, keyData, algorithm, extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);\n}, processPEMData = (pem, pattern) => decodeBase64(pem.replace(pattern, \"\")), fromPKCS8 = (pem, alg, options) => {\n  const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\\s)/g);\n  return genericImport(\"pkcs8\", keyData, alg, options);\n}, fromSPKI = (pem, alg, options) => {\n  const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\\s)/g);\n  return genericImport(\"spki\", keyData, alg, options);\n};\nfunction spkiFromX509(buf) {\n  const state = createASN1State(buf);\n  expectTag(state, 48, \"Invalid certificate structure\");\n  const certificateLength = parseLength(state);\n  if (certificateLength < 0 || state.pos + certificateLength > state.data.length)\n    throw new Error(\"Unexpected end of ASN.1 input\");\n  expectTag(state, 48, \"Invalid tbsCertificate structure\"), parseLength(state), buf[state.pos] === 160 ? skipElement(state, 6) : skipElement(state, 5);\n  const spkiStart = state.pos;\n  expectTag(state, 48, \"Invalid SPKI structure\");\n  const spkiContentLen = parseLength(state);\n  return buf.subarray(spkiStart, spkiStart + spkiContentLen + (state.pos - spkiStart));\n}\nconst fromX509 = (pem, alg, options) => {\n  let spki;\n  try {\n    const certificate = processPEMData(pem, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\\s)/g);\n    spki = spkiFromX509(certificate);\n  } catch (cause) {\n    throw new TypeError(\"Failed to parse the X.509 certificate\", { cause });\n  }\n  return genericImport(\"spki\", spki, alg, options);\n};\nexport {\n  fromPKCS8,\n  fromSPKI,\n  fromX509,\n  toPKCS8,\n  toSPKI\n};\n","import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from \"../lib/asn1.js\";\nimport { invalidKeyInput, isCryptoKey, isKeyObject } from \"../lib/key.js\";\nimport { encode as b64u } from \"../util/base64url.js\";\nfunction exportSPKI(key) {\n  return exportPublic(key);\n}\nfunction exportPKCS8(key) {\n  return exportPrivate(key);\n}\nasync function exportJWK(key) {\n  if (isKeyObject(key))\n    if (key.type === \"secret\")\n      key = key.export();\n    else\n      return key.export({ format: \"jwk\" });\n  if (key instanceof Uint8Array)\n    return {\n      kty: \"oct\",\n      k: b64u(key)\n    };\n  if (!isCryptoKey(key))\n    throw new TypeError(invalidKeyInput(key, \"CryptoKey\", \"KeyObject\", \"Uint8Array\"));\n  if (!key.extractable)\n    throw new TypeError(\"non-extractable CryptoKey cannot be exported as a JWK\");\n  const jwk = await crypto.subtle.exportKey(\"jwk\", key);\n  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== \"AKP\" && delete jwk.alg;\n  for (const parameter of Object.keys(jwk))\n    jwk[parameter] === void 0 && delete jwk[parameter];\n  return jwk;\n}\nexport {\n  exportJWK,\n  exportPKCS8,\n  exportSPKI\n};\n","import { digest, encode } from \"../lib/buffer_utils.js\";\nimport { encode as b64u } from \"../util/base64url.js\";\nimport { JOSENotSupported, JWKInvalid } from \"../util/errors.js\";\nimport { isKeyLike, invalidKeyInput, snapshotJwk } from \"../lib/key.js\";\nimport { isObject } from \"../lib/validate.js\";\nimport { exportJWK } from \"../key/export.js\";\nconst check = (value, description) => {\n  if (typeof value != \"string\" || !value)\n    throw new JWKInvalid(`${description} missing or invalid`);\n};\nasync function calculateJwkThumbprint(key, digestAlgorithm) {\n  let jwk;\n  if (isObject(key)) {\n    if (jwk = snapshotJwk(key), typeof jwk.kty != \"string\")\n      throw new TypeError(invalidKeyInput(key, \"CryptoKey\", \"KeyObject\", \"JSON Web Key\"));\n  } else if (isKeyLike(key))\n    jwk = snapshotJwk(await exportJWK(key));\n  else\n    throw new TypeError(invalidKeyInput(key, \"CryptoKey\", \"KeyObject\", \"JSON Web Key\"));\n  if (digestAlgorithm ??= \"sha256\", digestAlgorithm !== \"sha256\" && digestAlgorithm !== \"sha384\" && digestAlgorithm !== \"sha512\")\n    throw new TypeError('digestAlgorithm must one of \"sha256\", \"sha384\", or \"sha512\"');\n  let components;\n  switch (jwk.kty) {\n    case \"AKP\":\n      check(jwk.alg, '\"alg\" (Algorithm) Parameter'), check(jwk.pub, '\"pub\" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };\n      break;\n    case \"EC\":\n      check(jwk.crv, '\"crv\" (Curve) Parameter'), check(jwk.x, '\"x\" (X Coordinate) Parameter'), check(jwk.y, '\"y\" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };\n      break;\n    case \"OKP\":\n      check(jwk.crv, '\"crv\" (Subtype of Key Pair) Parameter'), check(jwk.x, '\"x\" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };\n      break;\n    case \"RSA\":\n      check(jwk.e, '\"e\" (Exponent) Parameter'), check(jwk.n, '\"n\" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };\n      break;\n    case \"oct\":\n      if (typeof jwk.k != \"string\")\n        throw new JWKInvalid('\"k\" (Key Value) Parameter missing or invalid');\n      components = { k: jwk.k, kty: jwk.kty };\n      break;\n    default:\n      throw new JOSENotSupported('\"kty\" (Key Type) Parameter missing or unsupported');\n  }\n  const data = encode(JSON.stringify(components));\n  return b64u(await digest(digestAlgorithm, data));\n}\nasync function calculateJwkThumbprintUri(key, digestAlgorithm) {\n  digestAlgorithm ??= \"sha256\";\n  const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);\n  return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;\n}\nexport {\n  calculateJwkThumbprint,\n  calculateJwkThumbprintUri\n};\n","import { jwkToKey, snapshotJwk } from \"../lib/key.js\";\nimport { JWS } from \"../lib/jws_algorithms.js\";\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from \"../util/errors.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isUsableJWK(jwk, entry, alg, kid) {\n  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;\n  return (ext === void 0 || typeof ext == \"boolean\") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == \"string\" && keyOps.indexOf(operation) === index) && keyOps.includes(\"verify\")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == \"string\" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== \"AKP\" : alg === jwkAlg) && (use === void 0 || use === \"sig\") && (!entry.crv || crv === entry.crv);\n}\nasync function importWithAlgCache(cache, jwk, entry) {\n  const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;\n  if (cached[alg] === void 0) {\n    const pending = jwkToKey(entry, jwk, !0).then((key) => {\n      if (key.type !== \"public\")\n        throw new JWKSInvalid(\"JSON Web Key Set members must be public keys\");\n      return cached[alg] = key, key;\n    }).catch((error) => {\n      throw cached[alg] === pending && delete cached[alg], error;\n    });\n    cached[alg] = pending;\n  }\n  return cached[alg];\n}\nfunction createLocalJWKSet(jwks) {\n  let snapshot;\n  try {\n    snapshot = structuredClone(jwks);\n  } catch {\n  }\n  if (!isJwkSet(snapshot))\n    throw new JWKSInvalid(\"JSON Web Key Set malformed\");\n  const metadata = snapshot.keys.map((jwk) => {\n    const normalized = snapshotJwk(jwk);\n    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;\n  }), cached = /* @__PURE__ */ new WeakMap();\n  return Object.defineProperty(async (protectedHeader, token) => {\n    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n    if (!entry || entry.secret)\n      throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;\n    if (!length)\n      throw new JWKSNoMatchingKey();\n    if (length !== 1) {\n      const error = new JWKSMultipleMatchingKeys();\n      throw error[Symbol.asyncIterator] = async function* () {\n        for (const jwk2 of candidates)\n          try {\n            yield await importWithAlgCache(cached, jwk2, entry);\n          } catch {\n          }\n      }, error;\n    }\n    return importWithAlgCache(cached, jwk, entry);\n  }, \"jwks\", {\n    value: () => structuredClone(snapshot)\n  });\n}\nexport {\n  createLocalJWKSet\n};\n","import { decode as decodeBase64URL } from \"../util/base64url.js\";\nimport { fromSPKI, fromPKCS8, fromX509 } from \"../lib/asn1.js\";\nimport { jwkToKey, validateExtractableOption, normalizeJwk } from \"../lib/key.js\";\nimport { keyAlgorithm } from \"../lib/key_algorithm.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nimport { isObject } from \"../lib/validate.js\";\nasync function importSPKI(spki, alg, options) {\n  if (typeof spki != \"string\" || spki.indexOf(\"-----BEGIN PUBLIC KEY-----\") !== 0)\n    throw new TypeError('\"spki\" must be SPKI formatted string');\n  return fromSPKI(spki, alg, options);\n}\nasync function importX509(x509, alg, options) {\n  if (typeof x509 != \"string\" || x509.indexOf(\"-----BEGIN CERTIFICATE-----\") !== 0)\n    throw new TypeError('\"x509\" must be X.509 formatted string');\n  return fromX509(x509, alg, options);\n}\nasync function importPKCS8(pkcs8, alg, options) {\n  if (typeof pkcs8 != \"string\" || pkcs8.indexOf(\"-----BEGIN PRIVATE KEY-----\") !== 0)\n    throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n  return fromPKCS8(pkcs8, alg, options);\n}\nasync function importJWK(jwk, alg, options) {\n  if (!isObject(jwk))\n    throw new TypeError(\"JWK must be an object\");\n  const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;\n  if (alg ??= jwkAlg, normalized.kty !== \"oct\" && !alg)\n    throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n  switch (normalized.kty) {\n    case \"oct\":\n      if (typeof normalized.k != \"string\")\n        throw new TypeError('missing \"k\" (Key Value) Parameter value');\n      return decodeBase64URL(normalized.k);\n    case \"AKP\": {\n      if (typeof jwkAlg != \"string\" || !jwkAlg)\n        throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n      if (alg !== jwkAlg)\n        throw new TypeError(\"JWK alg and alg option value mismatch\");\n      return jwkToKey(keyAlgorithm(alg), normalized, extractable);\n    }\n    case \"RSA\":\n    case \"EC\":\n    case \"OKP\":\n      return jwkToKey(keyAlgorithm(alg), normalized, extractable);\n    default:\n      throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n  }\n}\nexport {\n  importJWK,\n  importPKCS8,\n  importSPKI,\n  importX509\n};\n","import { parseJoseHeader } from \"../lib/validate.js\";\nfunction decodeProtectedHeader(token) {\n  let protectedB64u;\n  if (typeof token == \"string\") {\n    const parts = token.split(\".\");\n    (parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);\n  } else if (typeof token == \"object\" && token)\n    if (\"protected\" in token)\n      protectedB64u = token.protected;\n    else\n      throw new TypeError(\"Token does not contain a Protected Header\");\n  const invalid = \"Invalid Token or Protected Header formatting\";\n  if (typeof protectedB64u != \"string\" || !protectedB64u)\n    throw new TypeError(invalid);\n  return parseJoseHeader(protectedB64u, TypeError, invalid);\n}\nexport {\n  decodeProtectedHeader\n};\n","import { decode as b64u } from \"./base64url.js\";\nimport { strictDecoder } from \"../lib/buffer_utils.js\";\nimport { isObject } from \"../lib/validate.js\";\nimport { JWTInvalid } from \"./errors.js\";\nfunction decodeJwt(jwt) {\n  if (typeof jwt != \"string\")\n    throw new JWTInvalid(\"JWTs must use Compact JWS serialization, JWT must be a string\");\n  const { 1: payload, length } = jwt.split(\".\");\n  if (length === 5)\n    throw new JWTInvalid(\"Only JWTs using Compact JWS serialization can be decoded\");\n  if (length !== 3)\n    throw new JWTInvalid(\"Invalid JWT\");\n  if (!payload)\n    throw new JWTInvalid(\"JWTs must contain a payload\");\n  let decoded;\n  try {\n    decoded = b64u(payload);\n  } catch {\n    throw new JWTInvalid(\"Failed to base64url decode the payload\");\n  }\n  let result;\n  try {\n    result = JSON.parse(strictDecoder.decode(decoded));\n  } catch {\n    throw new JWTInvalid(\"Failed to parse the decoded payload as JSON\");\n  }\n  if (!isObject(result))\n    throw new JWTInvalid(\"Invalid JWT Claims Set\");\n  return result;\n}\nexport {\n  decodeJwt\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { validateExtractableOption } from \"../lib/key.js\";\nimport { keyAlgorithm, unsupportedAlg, algArgument } from \"../lib/key_algorithm.js\";\nfunction getModulusLengthOption(options) {\n  const modulusLength = options?.modulusLength ?? 2048;\n  if (typeof modulusLength != \"number\" || !Number.isInteger(modulusLength) || modulusLength < 2048)\n    throw new JOSENotSupported(\"Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used\");\n  return modulusLength;\n}\nasync function generateKeyPair(alg, options) {\n  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);\n  entry.secret && unsupportedAlg(algArgument);\n  let algorithm;\n  if (entry.resolve) {\n    const crv = options?.crv ?? \"P-256\";\n    if (![\"P-256\", \"P-384\", \"P-521\", \"X25519\"].includes(crv))\n      throw new JOSENotSupported(\"Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519\");\n    algorithm = entry.resolve({ crv });\n  } else {\n    if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)\n      throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);\n    algorithm = entry.kty[0] === \"RSA\" ? {\n      ...entry.subtle,\n      publicExponent: Uint8Array.of(1, 0, 1),\n      modulusLength: getModulusLengthOption(options)\n    } : entry.subtle;\n  }\n  return crypto.subtle.generateKey(algorithm, extractable ?? !1, [\n    ...entry.usages[1],\n    ...entry.usages[0]\n  ]);\n}\nexport {\n  generateKeyPair\n};\n","import { hkdf } from \"@noble/hashes/hkdf.js\";\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { EncryptJWT, SignJWT, base64url, calculateJwkThumbprint, decodeProtectedHeader, jwtDecrypt, jwtVerify } from \"jose\";\n//#region src/crypto/jwt.ts\nasync function signJWT(payload, secret, expiresIn = 3600) {\n\treturn await new SignJWT(payload).setProtectedHeader({ alg: \"HS256\" }).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + expiresIn).sign(new TextEncoder().encode(secret));\n}\nasync function verifyJWT(token, secret) {\n\ttry {\n\t\treturn (await jwtVerify(token, new TextEncoder().encode(secret))).payload;\n\t} catch {\n\t\treturn null;\n\t}\n}\nconst info = new Uint8Array([\n\t66,\n\t101,\n\t116,\n\t116,\n\t101,\n\t114,\n\t65,\n\t117,\n\t116,\n\t104,\n\t46,\n\t106,\n\t115,\n\t32,\n\t71,\n\t101,\n\t110,\n\t101,\n\t114,\n\t97,\n\t116,\n\t101,\n\t100,\n\t32,\n\t69,\n\t110,\n\t99,\n\t114,\n\t121,\n\t112,\n\t116,\n\t105,\n\t111,\n\t110,\n\t32,\n\t75,\n\t101,\n\t121\n]);\nconst now = () => Date.now() / 1e3 | 0;\nconst alg = \"dir\";\nconst enc = \"A256CBC-HS512\";\nfunction deriveEncryptionSecret(secret, salt) {\n\treturn hkdf(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(salt), info, 64);\n}\nfunction getCurrentSecret(secret) {\n\tif (typeof secret === \"string\") return secret;\n\tconst value = secret.keys.get(secret.currentVersion);\n\tif (!value) throw new Error(`Secret version ${secret.currentVersion} not found in keys`);\n\treturn value;\n}\nfunction getAllSecrets(secret) {\n\tif (typeof secret === \"string\") return [{\n\t\tversion: 0,\n\t\tvalue: secret\n\t}];\n\tconst result = [];\n\tfor (const [version, value] of secret.keys) result.push({\n\t\tversion,\n\t\tvalue\n\t});\n\tif (secret.legacySecret && !result.some((s) => s.value === secret.legacySecret)) result.push({\n\t\tversion: -1,\n\t\tvalue: secret.legacySecret\n\t});\n\treturn result;\n}\nasync function symmetricEncodeJWT(payload, secret, salt, expiresIn = 3600) {\n\tconst encryptionSecret = deriveEncryptionSecret(getCurrentSecret(secret), salt);\n\tconst thumbprint = await calculateJwkThumbprint({\n\t\tkty: \"oct\",\n\t\tk: base64url.encode(encryptionSecret)\n\t}, \"sha256\");\n\treturn await new EncryptJWT(payload).setProtectedHeader({\n\t\talg,\n\t\tenc,\n\t\tkid: thumbprint\n\t}).setIssuedAt().setExpirationTime(now() + expiresIn).setJti(crypto.randomUUID()).encrypt(encryptionSecret);\n}\nconst jwtDecryptOpts = {\n\tclockTolerance: 15,\n\tkeyManagementAlgorithms: [alg],\n\tcontentEncryptionAlgorithms: [enc, \"A256GCM\"]\n};\nasync function symmetricDecodeJWT(token, secret, salt) {\n\tif (!token) return null;\n\tlet hasKid = false;\n\ttry {\n\t\thasKid = decodeProtectedHeader(token).kid !== void 0;\n\t} catch {\n\t\treturn null;\n\t}\n\ttry {\n\t\tconst secrets = getAllSecrets(secret);\n\t\tconst { payload } = await jwtDecrypt(token, async (protectedHeader) => {\n\t\t\tconst kid = protectedHeader.kid;\n\t\t\tif (kid !== void 0) {\n\t\t\t\tfor (const s of secrets) {\n\t\t\t\t\tconst encryptionSecret = deriveEncryptionSecret(s.value, salt);\n\t\t\t\t\tif (kid === await calculateJwkThumbprint({\n\t\t\t\t\t\tkty: \"oct\",\n\t\t\t\t\t\tk: base64url.encode(encryptionSecret)\n\t\t\t\t\t}, \"sha256\")) return encryptionSecret;\n\t\t\t\t}\n\t\t\t\tthrow new Error(\"no matching decryption secret\");\n\t\t\t}\n\t\t\tif (secrets.length === 1) return deriveEncryptionSecret(secrets[0].value, salt);\n\t\t\treturn deriveEncryptionSecret(secrets[0].value, salt);\n\t\t}, jwtDecryptOpts);\n\t\treturn payload;\n\t} catch {\n\t\tif (hasKid) return null;\n\t\tconst secrets = getAllSecrets(secret);\n\t\tif (secrets.length <= 1) return null;\n\t\tfor (let i = 1; i < secrets.length; i++) try {\n\t\t\tconst s = secrets[i];\n\t\t\tconst { payload } = await jwtDecrypt(token, deriveEncryptionSecret(s.value, salt), jwtDecryptOpts);\n\t\t\treturn payload;\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\treturn null;\n\t}\n}\n//#endregion\nexport { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT };\n","//#region src/crypto/buffer.ts\n/**\n* Compare two buffers in constant time.\n*/\nfunction constantTimeEqual(a, b) {\n\tif (typeof a === \"string\") a = new TextEncoder().encode(a);\n\tif (typeof b === \"string\") b = new TextEncoder().encode(b);\n\tconst aBuffer = new Uint8Array(a);\n\tconst bBuffer = new Uint8Array(b);\n\tlet c = aBuffer.length ^ bBuffer.length;\n\tconst length = Math.max(aBuffer.length, bBuffer.length);\n\tfor (let i = 0; i < length; i++) c |= (i < aBuffer.length ? aBuffer[i] : 0) ^ (i < bBuffer.length ? bBuffer[i] : 0);\n\treturn c === 0;\n}\n//#endregion\nexport { constantTimeEqual };\n","import { createRandomStringGenerator } from \"@better-auth/utils/random\";\n//#region src/crypto/random.ts\nconst generateRandomString = createRandomStringGenerator(\"a-z\", \"0-9\", \"A-Z\", \"-_\");\n//#endregion\nexport { generateRandomString };\n","//#region src/index.ts\nfunction getWebcryptoSubtle() {\n\tconst cr = typeof globalThis !== \"undefined\" && globalThis.crypto;\n\tif (cr && typeof cr.subtle === \"object\" && cr.subtle != null) return cr.subtle;\n\tthrow new Error(\"crypto.subtle must be defined\");\n}\n//#endregion\nexport { getWebcryptoSubtle };\n","import { getWebcryptoSubtle } from \"./index.mjs\";\nimport { toBufferSource } from \"./bytes.mjs\";\nimport { base64, base64Url } from \"./base64.mjs\";\n//#region src/hash.ts\nfunction createHash(algorithm, encoding) {\n\treturn { digest: async (input) => {\n\t\tconst data = toBufferSource(input);\n\t\tconst hashBuffer = await getWebcryptoSubtle().digest(algorithm, data);\n\t\tif (encoding === \"hex\") return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\t\tif (encoding === \"base64\" || encoding === \"base64url\" || encoding === \"base64urlnopad\") {\n\t\t\tif (encoding.includes(\"url\")) return base64Url.encode(hashBuffer, { padding: encoding !== \"base64urlnopad\" });\n\t\t\treturn base64.encode(hashBuffer);\n\t\t}\n\t\treturn hashBuffer;\n\t} };\n}\n//#endregion\nexport { createHash };\n","/**\n * Utilities for hex, bytes, CSPRNG.\n * @module\n */\n/*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) */\nexport function aarray(item, title, inner = () => { }) {\n    if (!Array.isArray(item))\n        throw new TypeError(`\"${title}\" expected array, got type=${typeof item}`);\n    for (let i = 0; i < item.length; i++)\n        inner(item[i], `${title}[${i}]`);\n    return item;\n}\n/**\n * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.\n * @param a - Value to inspect.\n * @returns `true` when the value is a Uint8Array view, including Node's `Buffer`.\n * @example\n * Guards a value before treating it as raw key material.\n *\n * ```ts\n * isBytes(new Uint8Array());\n * ```\n */\nexport function isBytes(a) {\n    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy /\n    // cross-realm cases. The fallback still requires a real ArrayBuffer view\n    // so plain JSON-deserialized `{ constructor: ... }`\n    // spoofing is rejected, and `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.\n    return (a instanceof Uint8Array ||\n        (ArrayBuffer.isView(a) &&\n            a.constructor.name === 'Uint8Array' &&\n            'BYTES_PER_ELEMENT' in a &&\n            a.BYTES_PER_ELEMENT === 1));\n}\n// Shared error-message prefix builder. Only called on throw paths, so assert\n// success paths never pay for the string concatenation.\nconst atitle = (title) => (title ? `\"${title}\" ` : '');\n/**\n * Asserts something is boolean.\n * @param value - Value to validate.\n * @returns The validated boolean.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Validates a boolean option before branching on it.\n *\n * ```ts\n * abool(true);\n * ```\n */\nexport function abool(value, title = '') {\n    if (typeof value !== 'boolean')\n        throw new TypeError(atitle(title) + 'expected boolean, got type=' + typeof value);\n    return value;\n}\n/**\n * Asserts something is a non-negative safe integer.\n * @param n - Value to validate.\n * @returns The validated number.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Validates a non-negative length or counter.\n *\n * ```ts\n * anumber(1);\n * ```\n */\nexport function anumber(n, title = '') {\n    if (typeof n !== 'number')\n        throw new TypeError(atitle(title) + 'expected number, got ' + typeof n);\n    if (!Number.isSafeInteger(n) || n < 0)\n        throw new RangeError(atitle(title) + 'expected integer >= 0, got ' + n);\n    return n;\n}\n/**\n * Asserts something is Uint8Array.\n * @param value - Value to validate.\n * @param length - Expected byte length.\n * @param title - Optional label used in error messages.\n * @returns The validated byte array.\n * On Node, `Buffer` is accepted too because it is a Uint8Array view.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument lengths. {@link RangeError}\n * @example\n * Validates a fixed-length nonce or key buffer.\n *\n * ```ts\n * abytes(new Uint8Array([1, 2]), 2);\n * ```\n */\nexport function abytes(value, length, title = '') {\n    // Success path first: this runs at the start of every update() / digestInto(), and the\n    // common `abytes(data)` form must not pay for length handling it does not use.\n    if (isBytes(value) && (length === undefined || value.length === length))\n        return value;\n    // Error path: recompute freely to build the exact message.\n    if (length !== undefined)\n        anumber(length, 'length');\n    const bytes = isBytes(value);\n    const ofLen = length !== undefined ? ` of length ${length}` : '';\n    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;\n    const message = atitle(title) + 'expected Uint8Array' + ofLen + ', got ' + got;\n    if (!bytes)\n        throw new TypeError(message);\n    throw new RangeError(message);\n}\nconst aobject = (value, label) => {\n    if (value === null || typeof value !== 'object' || Array.isArray(value))\n        throw new TypeError(label === 'object'\n            ? 'expected valid options object'\n            : `\"${label}\" expected object, got type=${typeof value}`);\n};\n/**\n * Asserts a hash- or MAC-like instance has not been destroyed or finished.\n * @param instance - Stateful instance to validate.\n * @param checkFinished - Whether to reject finished instances.\n * When `false`, only `destroyed` is checked.\n * @throws If the hash instance has already been destroyed or finalized. {@link Error}\n * @example\n * Guards against calling `update()` or `digest()` on a finished hash.\n *\n * ```ts\n * aexists({ destroyed: false, finished: false });\n * ```\n */\nexport function aexists(instance, checkFinished = true) {\n    // Runs on every update()/digestInto(); the flags are library-owned booleans, so only their\n    // truthiness is checked - re-validating their type per call was pure hot-path overhead.\n    if (instance.destroyed)\n        throw new Error('hash was destroyed');\n    if (checkFinished && instance.finished)\n        throw new Error('digest() was already called');\n}\n/**\n * Asserts output is a sufficiently-sized byte array.\n * @param out - Output buffer to validate.\n * @param instance - Hash-like instance providing `outputLen`.\n * This is the relaxed `digestInto()`-style contract: output must be at least `outputLen`,\n * unlike one-shot cipher helpers elsewhere in the repo that often require exact lengths.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong output buffer lengths. {@link RangeError}\n * @example\n * Verifies that a caller-provided output buffer is large enough.\n *\n * ```ts\n * aoutput(new Uint8Array(16), { outputLen: 16 });\n * ```\n */\nexport function aoutput(out, instance) {\n    abytes(out, undefined, 'output');\n    // `outputLen` is a library-owned readonly number; the negated comparison keeps failing fast\n    // when it is missing/NaN (comparisons with undefined/NaN are false) without an anumber() call.\n    const min = instance.outputLen;\n    if (!(out.length >= min)) {\n        throw new RangeError('\"output\" expected length >= ' + min);\n    }\n}\n/**\n * Asserts output is a sufficiently-sized, 4-byte-aligned byte array.\n * {@link aoutput} plus an {@link isAligned32} check, for `digestInto()` paths\n * that write through zero-allocation `u32` word views.\n * @param out - Output buffer to validate.\n * @param instance - Hash-like instance providing `outputLen`.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong output buffer lengths. {@link RangeError}\n * @throws On wrong output buffer alignment. {@link Error}\n * @example\n * Verifies that a caller-provided output buffer is large enough and aligned.\n *\n * ```ts\n * aoutput32(new Uint8Array(16), { outputLen: 16 });\n * ```\n */\nexport function aoutput32(out, instance) {\n    aoutput(out, instance);\n    if (!isAligned32(out))\n        throw new Error('invalid output, must be aligned');\n}\n/**\n * Casts a typed-array view to Uint8Array.\n * @param arr - Typed-array view to reinterpret.\n * @returns Uint8Array view over the same bytes.\n * @example\n * Views 32-bit words as raw bytes without copying.\n *\n * ```ts\n * u8(new Uint32Array([1]));\n * ```\n */\nexport function u8(arr) {\n    return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Casts a typed-array view to Uint32Array.\n * @param arr - Typed-array view to reinterpret.\n * @returns Uint32Array view over the same bytes. Callers are expected to provide a\n * 4-byte-aligned offset; trailing `1..3` bytes are silently dropped.\n * @example\n * Views a byte buffer as 32-bit words for block processing.\n *\n * ```ts\n * u32(new Uint8Array(4));\n * ```\n */\nexport function u32(arr) {\n    return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));\n}\n/**\n * Zeroizes typed arrays in place.\n * Warning: JS provides no guarantees.\n * @param arrays - Arrays to wipe.\n * @example\n * Wipes a temporary key buffer after use.\n *\n * ```ts\n * const bytes = new Uint8Array([1]);\n * clean(bytes);\n * ```\n */\nexport function clean(...arrays) {\n    for (let i = 0; i < arrays.length; i++) {\n        arrays[i].fill(0);\n    }\n}\n/**\n * Creates a DataView for byte-level manipulation.\n * @param arr - Typed-array view to wrap.\n * @returns DataView over the same bytes.\n * @example\n * Creates an endian-aware view for length encoding.\n *\n * ```ts\n * createView(new Uint8Array(4));\n * ```\n */\nexport function createView(arr) {\n    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);\n}\n/**\n * Whether the current platform is little-endian.\n * Most are; some IBM systems are not.\n */\nexport const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();\n/**\n * Reverses byte order of one 32-bit word.\n * @param word - Unsigned 32-bit word to swap.\n * @returns The same word with bytes reversed.\n * @example\n * Swaps a big-endian word into little-endian byte order.\n *\n * ```ts\n * byteSwap(0x11223344);\n * ```\n */\nexport function byteSwap(word) {\n    return (((word << 24) & 0xff000000) |\n        ((word << 8) & 0xff0000) |\n        ((word >>> 8) & 0xff00) |\n        ((word >>> 24) & 0xff));\n}\n/**\n * Normalizes one 32-bit word to the little-endian representation expected by cipher cores.\n * @param n - Unsigned 32-bit word to normalize.\n * @returns Little-endian normalized word on big-endian hosts, else the input word unchanged.\n * @example\n * Normalizes a host-endian word before passing it into an ARX/AES core.\n *\n * ```ts\n * swap8IfBE(0x11223344);\n * ```\n */\nexport const swap8IfBE = isLE\n    ? (n) => n\n    : (n) => byteSwap(n) >>> 0;\n/**\n * Byte-swaps every word of a Uint32Array in place.\n * @param arr - Uint32Array whose words should be swapped.\n * @returns The same array after in-place byte swapping.\n * @example\n * Swaps every 32-bit word in a word-view buffer.\n *\n * ```ts\n * byteSwap32(new Uint32Array([0x11223344]));\n * ```\n */\nexport function byteSwap32(arr) {\n    for (let i = 0; i < arr.length; i++) {\n        arr[i] = byteSwap(arr[i]);\n    }\n    return arr;\n}\n/**\n * Normalizes a Uint32Array view to the little-endian representation expected by cipher cores.\n * @param u - Word view to normalize in place.\n * @returns Little-endian normalized word view.\n * @example\n * Normalizes a word-view buffer before block processing.\n *\n * ```ts\n * swap32IfBE(new Uint32Array([0x11223344]));\n * ```\n */\nexport const swap32IfBE = isLE\n    ? (u) => u\n    : byteSwap32;\n// Built-in hex conversion:\n// {@link https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex | caniuse entry}\nconst hasHexBuiltin = /* @__PURE__ */ (() => \n// @ts-ignore\ntypeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();\n// Array where index 0xf0 (240) is mapped to string 'f0'\nconst hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));\n/**\n * Convert byte array to hex string. Uses built-in function, when available.\n * @param bytes - Bytes to encode.\n * @returns Lowercase hexadecimal string.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Formats ciphertext bytes for logs or test vectors.\n *\n * ```ts\n * bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'\n * ```\n */\nexport function bytesToHex(bytes) {\n    abytes(bytes);\n    // @ts-ignore\n    if (hasHexBuiltin)\n        return bytes.toHex();\n    // pre-caching improves the speed 6x\n    let hex = '';\n    for (let i = 0; i < bytes.length; i++) {\n        hex += hexes[bytes[i]];\n    }\n    return hex;\n}\n// Strict ASCII nibble parser: non-ASCII hex lookalikes are rejected as undefined.\n// ASCII codes: '0'..'9' = 48..57, 'A'..'F' = 65..70, 'a'..'f' = 97..102.\n// prettier-ignore\nfunction asciiToBase16(ch) {\n    return ch >= 48 && ch <= 57 ? ch - 48 // '2' => 50-48\n        : ch >= 65 && ch <= 70 ? ch - (65 - 10) // 'B' => 66-(65-10)\n            : ch >= 97 && ch <= 102 ? ch - (97 - 10) // 'b' => 98-(97-10)\n                : undefined;\n}\n/**\n * Convert hex string to byte array. Uses built-in function, when available.\n * @param hex - hexadecimal string to decode\n * @returns Decoded bytes.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Decode lowercase hexadecimal into bytes.\n * ```ts\n * hexToBytes('cafe0123'); // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])\n * ```\n */\nexport function hexToBytes(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    if (hasHexBuiltin) {\n        try {\n            return Uint8Array.fromHex(hex);\n        }\n        catch (error) {\n            if (error instanceof SyntaxError)\n                throw new RangeError(error.message);\n            throw error;\n        }\n    }\n    const hl = hex.length;\n    const al = hl / 2;\n    if (hl % 2)\n        throw new RangeError('hex string expected, got unpadded hex of length ' + hl);\n    const array = new Uint8Array(al);\n    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {\n        const n1 = asciiToBase16(hex.charCodeAt(hi)); // parse first char, multiply it by 16\n        const n2 = asciiToBase16(hex.charCodeAt(hi + 1)); // parse second char\n        if (n1 === undefined || n2 === undefined) {\n            const char = hex[hi] + hex[hi + 1];\n            throw new RangeError('hex string expected, got non-hex character \"' + char + '\" at index ' + hi);\n        }\n        array[ai] = n1 * 16 + n2; // example: 'A9' => 10*16 + 9\n    }\n    return array;\n}\nconst _0n = /* @__PURE__ */ BigInt(0);\n// Used in ff1, via bytesToNumberBE\n/**\n * Converts a big-endian hex string into bigint.\n * @param hex - Hexadecimal string without `0x`.\n * @returns Parsed bigint value. The empty string is treated as `0n`.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Parses a big-endian field element or counter from hex.\n *\n * ```ts\n * hexToNumber('ff');\n * ```\n */\nexport function hexToNumber(hex) {\n    if (typeof hex !== 'string')\n        throw new TypeError('hex string expected, got ' + typeof hex);\n    // Numeric parser, not byte-hex decoder: odd-length forms like 'f' are valid,\n    // and malformed syntax follows BigInt's native error behavior.\n    return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian\n}\n// Used in ff1\n// BE: Big Endian, LE: Little Endian\n/**\n * Converts big-endian bytes into bigint.\n * @param bytes - Big-endian bytes.\n * @returns Parsed bigint value. Empty input is treated as `0n`.\n * @throws On invalid byte input passed to the internal hex conversion. {@link TypeError}\n * @example\n * Reads a big-endian integer from serialized bytes.\n *\n * ```ts\n * bytesToNumberBE(new Uint8Array([1, 0]));\n * ```\n */\nexport function bytesToNumberBE(bytes) {\n    return hexToNumber(bytesToHex(bytes));\n}\n/**\n * Validates that a value is a non-negative bigint or safe integer.\n * @param n - Value to validate.\n * @returns The same validated value.\n * @throws On wrong argument ranges or values. {@link RangeError}\n */\nfunction abignumber(n) {\n    if (typeof n === 'bigint') {\n        if (!(_0n <= n))\n            throw new RangeError('positive bigint expected, got ' + n);\n    }\n    else\n        anumber(n);\n    return n;\n}\n// Used in ff1\n/**\n * Converts a number into big-endian bytes of fixed length.\n * @param n - Number to encode.\n * @param len - Output length in bytes. Must be greater than zero.\n * @returns Big-endian bytes padded to `len`.\n * Negative values, `len = 0`, and values that do not fit are rejected before\n * downstream hex parsing.\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If a documented runtime validation or state check fails. {@link Error}\n * @example\n * Encodes a counter as fixed-width big-endian bytes.\n *\n * ```ts\n * numberToBytesBE(1, 2);\n * ```\n */\nexport function numberToBytesBE(n, len) {\n    anumber(len);\n    if (len === 0)\n        throw new Error('zero output length is invalid');\n    n = abignumber(n);\n    const expectedLen = len * 2;\n    const hex = n.toString(16);\n    // Detect overflow before hex parsing so oversized values don't leak the shared odd-hex error.\n    if (hex.length > expectedLen)\n        throw new RangeError('number is too large');\n    return hexToBytes(hex.padStart(expectedLen, '0'));\n}\n/**\n * Converts string to bytes using UTF8 encoding.\n * @param str - String to encode.\n * @returns UTF-8 bytes in a detached fresh Uint8Array copy.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Encodes application text before encryption or MACing.\n *\n * ```ts\n * utf8ToBytes('abc'); // new Uint8Array([97, 98, 99])\n * ```\n */\nexport function utf8ToBytes(str) {\n    if (typeof str !== 'string')\n        throw new TypeError('string expected');\n    return new Uint8Array(new TextEncoder().encode(str)); // {@link https://bugzil.la/1681809 | Firefox bug 1681809}\n}\n/**\n * Converts bytes to string using UTF8 encoding.\n * @param bytes - UTF-8 bytes.\n * @returns Decoded string. Input validation is delegated to `TextDecoder`, and malformed\n * UTF-8 is replacement-decoded instead of rejected.\n * @example\n * Decodes UTF-8 plaintext back into a string.\n *\n * ```ts\n * bytesToUtf8(new Uint8Array([97, 98, 99])); // 'abc'\n * ```\n */\nexport function bytesToUtf8(bytes) {\n    return new TextDecoder().decode(bytes);\n}\n/**\n * Checks if two U8A use same underlying buffer and overlaps.\n * This is invalid and can corrupt data.\n * @param a - First byte view.\n * @param b - Second byte view.\n * @returns `true` when the views overlap in memory.\n * @example\n * Detects whether two slices alias the same backing buffer.\n *\n * ```ts\n * overlapBytes(new Uint8Array(4), new Uint8Array(4));\n * ```\n */\nexport function overlapBytes(a, b) {\n    // Zero-length views cannot overwrite anything, even if their offset sits inside another range.\n    if (!a.byteLength || !b.byteLength)\n        return false;\n    return (a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy\n        a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end\n        b.byteOffset < a.byteOffset + a.byteLength // b starts before a end\n    );\n}\n/**\n * If input and output overlap and input starts before output, we will overwrite end of input before\n * we start processing it, so this is not supported by forward-processing ciphers.\n * @param input - Input bytes.\n * @param output - Output bytes.\n * @throws If the output view would overwrite unread input bytes. {@link Error}\n * @example\n * Rejects an in-place layout that would overwrite unread input bytes.\n *\n * ```ts\n * const buffer = new Uint8Array(8);\n * complexOverlapBytes(buffer.subarray(0, 4), buffer.subarray(2, 6));\n * ```\n */\nexport function complexOverlapBytes(input, output) {\n    // This is very cursed. It works somehow, but I'm completely unsure,\n    // reasoning about overlapping aligned windows is very hard.\n    if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)\n        throw new Error('complex overlap of input and output is not supported');\n}\n/**\n * Copies several Uint8Arrays into one.\n * @param arrays - Byte arrays to concatenate.\n * @returns Combined byte array.\n * @throws On wrong argument types inside the byte-array list. {@link TypeError}\n * @example\n * Builds a `nonce || ciphertext` style buffer.\n *\n * ```ts\n * concatBytes(new Uint8Array([1]), new Uint8Array([2]));\n * ```\n */\nexport function concatBytes(...arrays) {\n    let sum = 0;\n    for (let i = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        abytes(a);\n        sum += a.length;\n    }\n    const res = new Uint8Array(sum);\n    for (let i = 0, pad = 0; i < arrays.length; i++) {\n        const a = arrays[i];\n        res.set(a, pad);\n        pad += a.length;\n    }\n    return res;\n}\n/**\n * Merges user options into defaults.\n * @param defaults - Default option values.\n * @param opts - User-provided overrides.\n * @returns Combined options object.\n * `defaults` is a library-owned mutable object; user-provided `opts` only need to be\n * object-shaped, since \"plain object\" checks reject valid proxy/cross-realm containers.\n * The merge mutates `defaults` in place and returns the same object, so direct callers\n * should pass a fresh defaults object unless they intentionally want shared state updated.\n * @throws If options are missing or not an object. {@link Error}\n * @example\n * Applies user overrides to the default cipher options.\n *\n * ```ts\n * checkOpts({ rounds: 20 }, { rounds: 8 });\n * ```\n */\nexport function checkOpts(defaults, opts) {\n    aobject(defaults, 'defaults');\n    aobject(opts, 'opts');\n    // Mutates defaults by design. __proto__ follows Object.assign semantics here and can only\n    // affect this local option object; callers already control this low-level options surface.\n    const merged = Object.assign(defaults, opts);\n    return merged;\n}\n/**\n * Compares two byte arrays in kinda constant time once lengths already match.\n * @param a - First byte array.\n * @param b - Second byte array.\n * @returns `true` when the arrays contain the same bytes. Different lengths still return early.\n * @example\n * Compares an expected authentication tag with the received one.\n *\n * ```ts\n * equalBytes(new Uint8Array([1]), new Uint8Array([1]));\n * ```\n */\nexport function equalBytes(a, b) {\n    a = abytes(a);\n    b = abytes(b);\n    if (a.length !== b.length)\n        return false;\n    let diff = 0;\n    for (let i = 0; i < a.length; i++)\n        diff |= a[i] ^ b[i];\n    return diff === 0;\n}\n/**\n * Wraps a keyed MAC constructor into a one-shot helper with `.create()`.\n * @param keyLen - Valid probe-key length used to read static metadata once.\n * The probe key is only used for `outputLen` / `blockLen`, so callers with several valid key sizes\n * can pass any representative size as long as those values stay fixed.\n * @param macCons - Keyed MAC constructor or factory.\n * @param fromMsg - Optional adapter that derives extra constructor args from the one-shot message.\n * @returns Callable MAC helper with `.create()`.\n */\nexport function wrapMacConstructor(keyLen, macCons, fromMsg) {\n    const mac = macCons;\n    const getArgs = (fromMsg || (() => []));\n    const macC = (msg, key) => mac(key, ...getArgs(msg))\n        .update(msg)\n        .digest();\n    const tmp = mac(new Uint8Array(keyLen), ...getArgs(new Uint8Array(0)));\n    macC.outputLen = tmp.outputLen;\n    macC.blockLen = tmp.blockLen;\n    macC.create = (key, ...args) => mac(key, ...args);\n    return macC;\n}\n/**\n * Wraps a cipher: validates args, ensures encrypt() can only be called once.\n * Used internally by the exported cipher constructors.\n * Output-buffer support is inferred from the wrapped `encrypt` / `decrypt`\n * arity (`fn.length === 2`), so wrapped output-capable methods must use a normal\n * second parameter, not a default/rest parameter. AAD support is explicit in\n * `params.withAAD`; optional AAD starts after the nonce slot when one is present.\n * @__NO_SIDE_EFFECTS__\n * @param params - Static cipher metadata. See {@link CipherParams}.\n * @param constructor - Cipher constructor.\n * @returns Wrapped constructor with validation.\n */\nexport const wrapCipher = (params, constructor) => {\n    function wrappedCipher(key, ...args) {\n        // Validate key\n        abytes(key, undefined, 'key');\n        // Validate nonce if nonceLength is present\n        if (params.nonceLength !== undefined) {\n            const nonce = args[0];\n            abytes(nonce, params.varSizeNonce ? undefined : params.nonceLength, 'nonce');\n        }\n        // Keep tag length available for decrypt-size checks after constructor validation.\n        const tagl = params.tagLength;\n        const aadStart = params.nonceLength !== undefined ? 1 : 0;\n        // No-AAD constructors otherwise silently ignore byte args meant as AAD.\n        if (!params.withAAD) {\n            for (let i = aadStart; i < args.length; i++)\n                if (isBytes(args[i]))\n                    throw new Error('AAD not supported');\n        }\n        // Validate the first AAD slot early; rest-arg AAD constructors validate the tail themselves.\n        if (params.withAAD && args[aadStart] !== undefined)\n            abytes(args[aadStart], undefined, 'AAD');\n        const cipher = constructor(key, ...args);\n        const checkOutput = (fnLength, output) => {\n            if (output !== undefined) {\n                if (fnLength !== 2)\n                    throw new Error('cipher output not supported');\n                abytes(output, undefined, 'output');\n            }\n        };\n        // Create wrapped cipher with validation and single-use encryption\n        let called = false;\n        const wrCipher = {\n            encrypt(data, output) {\n                if (called)\n                    throw new Error('cannot encrypt() twice with same key + nonce');\n                // Any encrypt attempt consumes the instance, even if validation rejects below.\n                called = true;\n                abytes(data, undefined, 'data');\n                checkOutput(cipher.encrypt.length, output);\n                return cipher.encrypt(data, output);\n            },\n            decrypt(data, output) {\n                abytes(data, undefined, 'data');\n                if (tagl && data.length < tagl)\n                    throw new Error('\"ciphertext\" expected length >= tagLength=' + tagl);\n                checkOutput(cipher.decrypt.length, output);\n                return cipher.decrypt(data, output);\n            },\n        };\n        return wrCipher;\n    }\n    Object.assign(wrappedCipher, params);\n    return wrappedCipher;\n};\n/**\n * By default, returns u8a of length.\n * When out is available, it checks it for validity and uses it.\n * @param expectedLength - Required output length.\n * @param out - Optional destination buffer.\n * @param onlyAligned - Whether `out` must be 4-byte aligned.\n * @returns Output buffer ready for writing.\n * @throws On wrong argument types. {@link TypeError}\n * @throws If the provided output buffer has the wrong size. {@link RangeError}\n * @throws If the provided output buffer has the wrong alignment. {@link Error}\n * @example\n * Reuses a caller-provided output buffer when lengths match.\n *\n * ```ts\n * getOutput(16, new Uint8Array(16));\n * ```\n */\nexport function getOutput(expectedLength, out, onlyAligned = true) {\n    if (out === undefined)\n        return new Uint8Array(expectedLength);\n    // Keep Buffer/cross-realm Uint8Array support here instead of trusting a shape-compatible object.\n    abytes(out, expectedLength, 'output');\n    if (onlyAligned && !isAligned32(out))\n        throw new Error('invalid output, must be aligned');\n    return out;\n}\n/**\n * Encodes data and AAD lengths into a 16-byte buffer.\n * @param dataLength - Data length. Units are caller-defined: GCM passes bit\n * lengths, ChaCha20-Poly1305 passes byte lengths — the helper writes the raw values.\n * @param aadLength - AAD length, same unit convention as `dataLength`.\n * The serialized block is still `aadLength || dataLength`, matching GCM/Poly1305\n * conventions even though the helper parameter order is `(dataLength, aadLength)`.\n * @param isLE - Whether to encode lengths as little-endian.\n * @returns 16-byte length block.\n * @throws On wrong argument types passed to the endian validator. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @example\n * Builds the length block appended by GCM and Poly1305.\n *\n * ```ts\n * u64Lengths(16, 8, true);\n * ```\n */\nexport function u64Lengths(dataLength, aadLength, isLE) {\n    // Reject coercible non-number lengths like '10' and true before BigInt(...) accepts them.\n    anumber(dataLength);\n    anumber(aadLength);\n    abool(isLE);\n    const num = new Uint8Array(16);\n    const view = createView(num);\n    view.setBigUint64(0, BigInt(aadLength), isLE);\n    view.setBigUint64(8, BigInt(dataLength), isLE);\n    return num;\n}\n/**\n * Checks whether a byte array is aligned to a 4-byte offset.\n * @param bytes - Byte array to inspect.\n * @returns `true` when the view is 4-byte aligned.\n * @example\n * Checks whether a buffer can be safely viewed as Uint32Array.\n *\n * ```ts\n * isAligned32(new Uint8Array(4));\n * ```\n */\nexport function isAligned32(bytes) {\n    return bytes.byteOffset % 4 === 0;\n}\n/**\n * Copies bytes into a new Uint8Array.\n * @param bytes - Bytes to copy.\n * @returns Copied byte array.\n * @throws On wrong argument types. {@link TypeError}\n * @example\n * Copies input into an aligned Uint8Array before block processing.\n *\n * ```ts\n * copyBytes(new Uint8Array([1, 2]));\n * ```\n */\nexport function copyBytes(bytes) {\n    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict\n    // because callers use it at byte-validation boundaries before mutating the detached copy.\n    return Uint8Array.from(abytes(bytes));\n}\n/**\n * Cryptographically secure PRNG backed by `crypto.getRandomValues`.\n * @param bytesLength - number of random bytes to generate\n * @returns Random bytes.\n * The platform `getRandomValues()` implementation still defines any\n * single-call length cap, and this helper rejects oversize requests\n * with a stable library `RangeError` instead of host-specific errors.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On wrong argument ranges or values. {@link RangeError}\n * @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}\n * @example\n * Generate a fresh random key or nonce.\n * ```ts\n * const key = randomBytes(16);\n * ```\n */\nexport function randomBytes(bytesLength = 32) {\n    // Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.\n    anumber(bytesLength, 'bytesLength');\n    const cr = typeof globalThis === 'object' ? globalThis.crypto : null;\n    if (typeof cr?.getRandomValues !== 'function')\n        throw new Error('crypto.getRandomValues must be defined');\n    // Web Cryptography API Level 2 §10.1.1:\n    // if `byteLength > 65536`, throw `QuotaExceededError`.\n    // Keep the guard explicit so callers can see the quota in code\n    // instead of discovering it by reading the spec or host errors.\n    // This wrapper surfaces the same quota as a stable library RangeError.\n    if (bytesLength > 65536)\n        throw new RangeError(`\"bytesLength\" expected <= 65536, got ${bytesLength}`);\n    return cr.getRandomValues(new Uint8Array(bytesLength));\n}\n/**\n * Uses CSPRNG for nonce, nonce injected in ciphertext.\n * For `encrypt`, a `nonceBytes`-length buffer is fetched from CSPRNG and\n * prepended to encrypted ciphertext. For `decrypt`, first `nonceBytes` of ciphertext\n * are treated as nonce. The wrapper always allocates a fresh `nonce || ciphertext`\n * buffer on encrypt and intentionally does not support caller-provided destination buffers.\n * Too-short decrypt inputs are split into short/empty nonce views and then delegated\n * to the wrapped cipher instead of being rejected here first.\n *\n * NOTE: Under the same key, using random nonces (e.g. `managedNonce`) with AES-GCM and ChaCha\n * should be limited to `2**23` (8M) messages to get a collision chance of\n * `2**-50`. Stretching to `2**32` (4B) messages would raise that chance to\n * `2**-33`, still negligible but creeping up.\n * @param fn - Cipher constructor that expects a nonce.\n * @param randomBytes_ - Random-byte source used for nonce generation.\n * @returns Cipher constructor that prepends the nonce to ciphertext.\n * @throws On wrong argument types. {@link TypeError}\n * @throws On invalid nonce lengths observed at wrapper construction or use. {@link RangeError}\n * @example\n * Prepends a fresh random nonce to every ciphertext.\n *\n * ```ts\n * import { gcm } from '@noble/ciphers/aes.js';\n * import { managedNonce, randomBytes } from '@noble/ciphers/utils.js';\n * const wrapped = managedNonce(gcm);\n * const key = randomBytes(16);\n * const ciphertext = wrapped(key).encrypt(new Uint8Array([1, 2, 3]));\n * wrapped(key).decrypt(ciphertext);\n * ```\n */\nexport function managedNonce(fn, randomBytes_ = randomBytes) {\n    if (typeof fn !== 'function')\n        throw new TypeError('\"fn\" expected cipher constructor, got type=' + typeof fn);\n    if (typeof randomBytes_ !== 'function')\n        throw new TypeError('\"randomBytes_\" expected function, got type=' + typeof randomBytes_);\n    const { nonceLength } = fn;\n    anumber(nonceLength, 'fn.nonceLength');\n    const addNonce = (nonce, ciphertext, plaintext) => {\n        const out = concatBytes(nonce, ciphertext);\n        // Wrapped ciphers may alias caller plaintext on encrypt(); never zero\n        // caller-owned buffers here.\n        if (!overlapBytes(plaintext, ciphertext))\n            ciphertext.fill(0);\n        return out;\n    };\n    // NOTE: we cannot support DST here, it would be mistake:\n    // - we don't know how much dst length cipher requires\n    // - nonce may unalign dst and break everything\n    // - we create new u8a anyway (concatBytes)\n    // - previously we passed all args to cipher, but that was mistake!\n    const res = ((key, ...args) => ({\n        encrypt(plaintext) {\n            abytes(plaintext, undefined, 'data');\n            const nonce = randomBytes_(nonceLength);\n            const encrypted = fn(key, nonce, ...args).encrypt(plaintext);\n            // @ts-ignore\n            if (encrypted instanceof Promise)\n                return encrypted.then((ct) => addNonce(nonce, ct, plaintext));\n            return addNonce(nonce, encrypted, plaintext);\n        },\n        decrypt(ciphertext) {\n            abytes(ciphertext, undefined, 'data');\n            const nonce = ciphertext.subarray(0, nonceLength);\n            const decrypted = ciphertext.subarray(nonceLength);\n            return fn(key, nonce, ...args).decrypt(decrypted);\n        },\n    }));\n    // Auto-nonce wrappers still preserve the wrapped payload geometry.\n    if ('blockSize' in fn)\n        res.blockSize = fn.blockSize;\n    if ('tagLength' in fn)\n        res.tagLength = fn.tagLength;\n    if ('withAAD' in fn)\n        res.withAAD = fn.withAAD;\n    return res;\n}\n","/**\n * Basic utils for ARX (add-rotate-xor) salsa and chacha ciphers.\n\nRFC8439 requires multi-step cipher stream, where\nauthKey starts with counter: 0, actual msg with counter: 1.\n\nFor this, we need a way to re-use nonce / counter:\n\n    const counter = new Uint8Array(4);\n    chacha(..., counter, ...); // counter is now 1\n    chacha(..., counter, ...); // counter is now 2\n\nThis is complicated:\n\n- 32-bit counters are enough, no need for 64-bit: max ArrayBuffer size in JS is 4GB\n- Original papers don't allow mutating counters\n- Counter overflow is undefined [^1]\n- Idea A: allow providing (nonce | counter) instead of just nonce, re-use it\n- Caveat: Cannot be re-used through all cases:\n- * chacha has (counter | nonce)\n- * xchacha has (nonce16 | counter | nonce16)\n- Idea B: separate nonce / counter and provide separate API for counter re-use\n- Caveat: there are different counter sizes depending on an algorithm.\n- salsa & chacha also differ in structures of key & sigma:\n  salsa20:      s[0] | k(4) | s[1] | nonce(2) | cnt(2) | s[2] | k(4) | s[3]\n  chacha:       s(4) | k(8) | cnt(1) | nonce(3)\n  chacha20orig: s(4) | k(8) | cnt(2) | nonce(2)\n- Idea C: helper method such as `setSalsaState(key, nonce, sigma, data)`\n- Caveat: we can't re-use counter array\n\nxchacha uses the subkey and remaining 8 byte nonce with ChaCha20 as normal\n(prefixed by 4 NUL bytes, since RFC8439 specifies a 12-byte nonce).\nCounter overflow is undefined; see {@link https://mailarchive.ietf.org/arch/msg/cfrg/gsOnTJzcbgG6OqD8Sc0GO5aR_tU/ | the CFRG thread}.\nCurrent noble policy is strict non-wrap for the shared 32-bit counter path:\nexported ARX ciphers reject initial `0xffffffff` and stop before any implicit\nwrap back to zero.\nSee {@link https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha#appendix-A.2 | the XChaCha appendix} for the extended-nonce construction.\n\n * @module\n */\nimport { abool, abytes, anumber, checkOpts, clean, complexOverlapBytes, copyBytes, getOutput, isAligned32, isLE, randomBytes, swap32IfBE, u32, } from \"./utils.js\";\n// Replaces `TextEncoder` for ASCII literals, which is enough for sigma constants.\n// Non-ASCII input would not match UTF-8 `TextEncoder` output.\nconst encodeStr = (str) => Uint8Array.from(str.split(''), (c) => c.charCodeAt(0));\n// Raw `createCipher(...)` exports consume these native-endian `u32(...)` views directly.\n// Public `wrapCipher(...)` APIs reject non-little-endian platforms before reaching this path.\n// RFC 8439 §2.3 / RFC 7539 §2.3 only define the 256-bit-key constants; this 16-byte sigma is\n// kept for legacy allowShortKeys Salsa/ChaCha variants.\nconst sigma16_32 = /* @__PURE__ */ (() => swap32IfBE(u32(encodeStr('expand 16-byte k'))))();\n// RFC 8439 §2.3 / RFC 7539 §2.3 define words 0-3 as\n// `0x61707865 0x3320646e 0x79622d32 0x6b206574`, i.e. `expand 32-byte k`.\nconst sigma32_32 = /* @__PURE__ */ (() => swap32IfBE(u32(encodeStr('expand 32-byte k'))))();\n/**\n * Rotates a 32-bit word left.\n * @param a - Input word.\n * @param b - Rotation count in bits.\n * @returns Rotated 32-bit word.\n * @example\n * Moves the top byte of `0x12345678` into the low byte position.\n * ```ts\n * rotl(0x12345678, 8);\n * ```\n */\nexport function rotl(a, b) {\n    return (a << b) | (a >>> (32 - b));\n}\n// Salsa and Chacha block length is always 512-bit\nconst BLOCK_LEN = 64;\n// RFC 8439 §2.2 / RFC 7539 §2.2: the ChaCha state has 16 32-bit words.\nconst BLOCK_LEN32 = 16;\n// Counter policy for the shared public `counter` argument:\n// - RFC/IETF ChaCha20 uses a 32-bit counter.\n// - OpenSSL/Node `chacha20` instead treat the full 16-byte IV as a 128-bit\n//   counter state and carry into the next word.\n// - Raw `chacha20orig`, `salsa20`, `xsalsa20`, and `xchacha20` use 64-bit counters in libsodium\n//   and libtomcrypt, while some libs (for example libtomcrypt's RFC/IETF path) reject the max\n//   boundary instead of carrying.\n// - AEAD wrappers diverge too: libsodium `xchacha20poly1305` uses the IETF payload counter from\n//   block 1, while `secretstream_xchacha20poly1305` is a different protocol with rekey/reset.\n// Noble intentionally throws instead of silently picking one wrap model for users. In the default\n// path, even a 32-bit boundary would take 2^32 blocks * 64 bytes = 256 GiB, which is practically\n// unreachable for normal JS callers; advanced users who pass `counter` explicitly can implement\n// whatever wider carry / wrap policy they need on top.\nconst MAX_COUNTER = /* @__PURE__ */ (() => 2 ** 32 - 1)();\nconst U32_EMPTY = /* @__PURE__ */ Uint32Array.of();\nfunction runCipher(core, sigma, key, nonce, data, output, counter, rounds) {\n    const len = data.length;\n    const block = new Uint8Array(BLOCK_LEN);\n    const b32 = u32(block);\n    // Make sure that buffers aligned to 4 bytes\n    const isAligned = isLE && isAligned32(data) && isAligned32(output);\n    const d32 = isAligned ? u32(data) : U32_EMPTY;\n    const o32 = isAligned ? u32(output) : U32_EMPTY;\n    // RFC 8439 §2.4.1 / RFC 7539 §2.4.1 allow XORing one keystream block at a time and\n    // truncating the final partial block instead of materializing the whole keystream.\n    if (!isLE) {\n        for (let pos = 0; pos < len; counter++) {\n            core(sigma, key, nonce, b32, counter, rounds);\n            // RFC 8439 §2.4 / RFC 7539 §2.4 serialize keystream words in little-endian order.\n            swap32IfBE(b32);\n            if (counter >= MAX_COUNTER)\n                throw new Error('arx: counter overflow');\n            const take = Math.min(BLOCK_LEN, len - pos);\n            for (let j = 0, posj; j < take; j++) {\n                posj = pos + j;\n                output[posj] = data[posj] ^ block[j];\n            }\n            pos += take;\n        }\n        return;\n    }\n    for (let pos = 0; pos < len; counter++) {\n        core(sigma, key, nonce, b32, counter, rounds);\n        // See MAX_COUNTER policy note above: never silently wrap the shared public counter.\n        if (counter >= MAX_COUNTER)\n            throw new Error('arx: counter overflow');\n        const take = Math.min(BLOCK_LEN, len - pos);\n        // aligned to 4 bytes\n        if (isAligned && take === BLOCK_LEN) {\n            const pos32 = pos / 4;\n            if (pos % 4 !== 0)\n                throw new Error('arx: invalid block position');\n            for (let j = 0, posj; j < BLOCK_LEN32; j++) {\n                posj = pos32 + j;\n                o32[posj] = d32[posj] ^ b32[j];\n            }\n            pos += BLOCK_LEN;\n            continue;\n        }\n        for (let j = 0, posj; j < take; j++) {\n            posj = pos + j;\n            output[posj] = data[posj] ^ block[j];\n        }\n        pos += take;\n    }\n}\n/**\n * Creates an ARX stream cipher from a 32-bit core permutation.\n * Used internally to build the exported Salsa and ChaCha stream ciphers.\n * @param core - Core function that fills one keystream block.\n * @param opts - Cipher layout and nonce-extension options. See {@link CipherOpts}.\n * @returns Stream cipher function over byte arrays.\n * @throws If the core callback, key size, counter, or output sizing is invalid. {@link Error}\n */\nexport function createCipher(core, opts) {\n    const { allowShortKeys, extendNonceFn, counterLength, counterRight, rounds } = checkOpts({ allowShortKeys: false, counterLength: 8, counterRight: false, rounds: 20 }, opts);\n    if (typeof core !== 'function')\n        throw new Error('core must be a function');\n    anumber(counterLength);\n    anumber(rounds);\n    abool(counterRight);\n    abool(allowShortKeys);\n    return (key, nonce, data, output, counter = 0) => {\n        abytes(key, undefined, 'key');\n        abytes(nonce, undefined, 'nonce');\n        abytes(data, undefined, 'data');\n        const len = data.length;\n        // Raw XorStream APIs return ciphertext/plaintext bytes directly, so caller-provided outputs\n        // must match the logical result length exactly instead of returning an oversized workspace.\n        const hasOutput = output !== undefined;\n        output = getOutput(len, output, false);\n        if (hasOutput)\n            complexOverlapBytes(data, output);\n        anumber(counter);\n        // See MAX_COUNTER policy note above: reject advanced explicit-counter requests before any wrap.\n        if (counter < 0 || counter >= MAX_COUNTER)\n            throw new Error('arx: counter overflow');\n        const toClean = [];\n        // Key & sigma\n        // key=16 -> sigma16, k=key|key\n        // key=32 -> sigma32, k=key\n        let l = key.length;\n        let k;\n        let sigma;\n        if (l === 32) {\n            // Copy caller keys too: big-endian normalization, extended-nonce subkey derivation, and\n            // final clean(...) all mutate or wipe the temporary buffer in place.\n            toClean.push((k = copyBytes(key)));\n            sigma = sigma32_32;\n        }\n        else if (l === 16 && allowShortKeys) {\n            k = new Uint8Array(32);\n            k.set(key);\n            k.set(key, 16);\n            sigma = sigma16_32;\n            toClean.push(k);\n        }\n        else {\n            abytes(key, 32, 'arx key');\n            throw new Error('invalid key size');\n            // throw new Error(`\"arx key\" expected Uint8Array of length 32, got length=${l}`);\n        }\n        // Nonce\n        // salsa20:      8   (8-byte counter)\n        // chacha20orig: 8   (8-byte counter)\n        // chacha20:     12  (4-byte counter)\n        // xsalsa20:     24  (16 -> hsalsa,  8 -> old nonce)\n        // xchacha20:    24  (16 -> hchacha, 8 -> old nonce)\n        // Copy before taking u32(...) views on misaligned inputs, and on big-endian so later\n        // swap32IfBE(...) never mutates caller nonce bytes in place.\n        if (!isLE || !isAligned32(nonce))\n            toClean.push((nonce = copyBytes(nonce)));\n        let k32 = u32(k);\n        // hsalsa & hchacha: handle extended nonce\n        if (extendNonceFn) {\n            if (nonce.length !== 24)\n                throw new Error('arx: extended nonce must be 24 bytes');\n            const n16 = nonce.subarray(0, 16);\n            if (isLE)\n                extendNonceFn(sigma, k32, u32(n16), k32);\n            else {\n                const sigmaRaw = swap32IfBE(Uint32Array.from(sigma));\n                extendNonceFn(sigmaRaw, k32, u32(n16), k32);\n                clean(sigmaRaw);\n                swap32IfBE(k32);\n            }\n            nonce = nonce.subarray(16);\n        }\n        else if (!isLE)\n            swap32IfBE(k32);\n        // Handle nonce counter\n        const nonceNcLen = 16 - counterLength;\n        if (nonceNcLen !== nonce.length)\n            throw new Error(`arx: nonce must be ${nonceNcLen} or 16 bytes`);\n        // Normalize 64-bit-nonce layouts to the 12-byte core input: ChaCha/XChaCha prefix 4 zero\n        // counter bytes, while Salsa/XSalsa append them after the nonce words.\n        if (nonceNcLen !== 12) {\n            const nc = new Uint8Array(12);\n            nc.set(nonce, counterRight ? 0 : 12 - nonce.length);\n            nonce = nc;\n            toClean.push(nonce);\n        }\n        const n32 = swap32IfBE(u32(nonce));\n        // Ensure temporary key/nonce copies are wiped even if the remaining\n        // runtime guard in runCipher(...) throws on counter overflow.\n        try {\n            runCipher(core, sigma, k32, n32, data, output, counter, rounds);\n            return output;\n        }\n        finally {\n            clean(...toClean);\n        }\n    };\n}\n/** Internal class which wraps chacha20 or chacha8 to create CSPRNG. */\nexport class _XorStreamPRG {\n    blockLen;\n    keyLen;\n    nonceLen;\n    state;\n    buf;\n    key;\n    nonce;\n    pos;\n    ctr;\n    cipher;\n    destroyed = false;\n    constructor(cipher, blockLen, keyLen, nonceLen, seed) {\n        this.cipher = cipher;\n        this.blockLen = blockLen;\n        this.keyLen = keyLen;\n        this.nonceLen = nonceLen;\n        this.state = new Uint8Array(this.keyLen + this.nonceLen);\n        this.reseed(seed);\n        this.ctr = 0;\n        this.pos = this.blockLen;\n        this.buf = new Uint8Array(this.blockLen);\n        // Keep a single key||nonce backing buffer so reseed/addEntropy/clean update the live cipher\n        // inputs in place through these subarray views.\n        this.key = this.state.subarray(0, this.keyLen);\n        this.nonce = this.state.subarray(this.keyLen);\n    }\n    reseed(seed) {\n        abytes(seed, undefined, 'seed');\n        if (!seed || seed.length === 0)\n            throw new Error('entropy required');\n        // Mix variable-length entropy cyclically across the whole key||nonce state, then restart the\n        // keystream so buffered leftovers from the previous state are never reused.\n        for (let i = 0; i < seed.length; i++)\n            this.state[i % this.state.length] ^= seed[i];\n        this.ctr = 0;\n        this.pos = this.blockLen;\n    }\n    addEntropy(seed) {\n        if (this.destroyed)\n            throw new Error('cannot use destroyed PRG');\n        // Reject empty entropy before re-keying, otherwise a throwing call would still advance state.\n        abytes(seed, undefined, 'seed');\n        if (seed.length === 0)\n            throw new Error('entropy required');\n        // Re-key from the current stream first, then mix external entropy into the fresh key||nonce\n        // state through reseed() so stale buffered bytes are discarded.\n        this.state.set(this.randomBytes(this.state.length));\n        this.reseed(seed);\n    }\n    randomBytes(len) {\n        if (this.destroyed)\n            throw new Error('cannot use destroyed PRG');\n        anumber(len);\n        if (len === 0)\n            return new Uint8Array(0);\n        const avail = this.pos < this.blockLen ? this.blockLen - this.pos : 0;\n        const blocks = Math.ceil(Math.max(0, len - avail) / this.blockLen);\n        // Preflight overflow so failed reads don't partially consume keystream\n        // and leave the PRG repeating blocks.\n        if (blocks > 0 && this.ctr > MAX_COUNTER - blocks)\n            throw new Error('arx: counter overflow');\n        const out = new Uint8Array(len);\n        let outPos = 0;\n        // `out` starts zero-filled, and `buf.fill(0)` below does the same for leftovers: XOR-stream\n        // ciphers then emit raw keystream bytes directly into those buffers.\n        // Serve buffered leftovers first so split reads stay identical to one larger read.\n        if (this.pos < this.blockLen) {\n            const take = Math.min(len, this.blockLen - this.pos);\n            out.set(this.buf.subarray(this.pos, this.pos + take), 0);\n            this.pos += take;\n            outPos += take;\n            if (outPos === len)\n                return out; // fast path\n        }\n        // Full blocks directly to out\n        const full = Math.floor((len - outPos) / this.blockLen);\n        if (full > 0) {\n            const blockBytes = full * this.blockLen;\n            const b = out.subarray(outPos, outPos + blockBytes);\n            this.cipher(this.key, this.nonce, b, b, this.ctr);\n            this.ctr += full;\n            outPos += blockBytes;\n        }\n        // Save leftovers\n        const left = len - outPos;\n        if (left > 0) {\n            this.buf.fill(0);\n            // NOTE: cipher will handle overflow\n            this.cipher(this.key, this.nonce, this.buf, this.buf, this.ctr++);\n            out.set(this.buf.subarray(0, left), outPos);\n            this.pos = left;\n        }\n        return out;\n    }\n    // Clone seeds the new instance from this stream, so the source PRG advances too.\n    clone() {\n        if (this.destroyed)\n            throw new Error('cannot use destroyed PRG');\n        return new _XorStreamPRG(this.cipher, this.blockLen, this.keyLen, this.nonceLen, this.randomBytes(this.state.length));\n    }\n    // Zeroes the current state, leftover buffer, and marks the instance destroyed.\n    // The instance fails closed: any later randomBytes()/addEntropy()/clone() throws instead\n    // of silently continuing from zero key||nonce state (which would yield predictable output).\n    clean() {\n        this.pos = 0;\n        this.ctr = 0;\n        this.buf.fill(0);\n        this.state.fill(0);\n        this.destroyed = true;\n    }\n}\n/**\n * Creates a PRG constructor from a stream cipher.\n * @param cipher - Stream cipher used to fill output blocks.\n * @param blockLen - Keystream block length in bytes.\n * @param keyLen - Internal key length in bytes.\n * @param nonceLen - Internal nonce length in bytes.\n * @returns PRG factory for seeded concrete `_XorStreamPRG` instances.\n * @example\n * Builds a PRG from XChaCha20 and reads bytes from a randomly seeded instance.\n * ```ts\n * import { xchacha20 } from '@noble/ciphers/chacha.js';\n * import { createPRG } from '@noble/ciphers/_arx.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const seed = randomBytes(32);\n * const init = createPRG(xchacha20, 64, 32, 24);\n * const prg = init(seed);\n * prg.randomBytes(8);\n * ```\n */\nexport const createPRG = (cipher, blockLen, keyLen, nonceLen) => {\n    return ((seed = randomBytes(32)) => new _XorStreamPRG(cipher, blockLen, keyLen, nonceLen, seed));\n};\n","/**\n * Poly1305 ({@link https://cr.yp.to/mac/poly1305-20050329.pdf | PDF},\n * {@link https://en.wikipedia.org/wiki/Poly1305 | wiki})\n * is a fast and parallel secret-key message-authentication code suitable for\n * a wide variety of applications. It was standardized in\n * {@link https://www.rfc-editor.org/rfc/rfc8439 | RFC 8439} and is now used in TLS 1.3.\n *\n * Polynomial MACs are not perfect for every situation:\n * they lack Random Key Robustness: the MAC can be forged, and can't be used in PAKE schemes.\n * See {@link https://keymaterial.net/2020/09/07/invisible-salamanders-in-aes-gcm-siv/ | the invisible salamanders attack writeup}.\n * To combat invisible salamanders, `hash(key)` can be included in ciphertext,\n * however, this would violate ciphertext indistinguishability:\n * an attacker would know which key was used - so `HKDF(key, i)`\n * could be used instead.\n *\n * Check out the {@link https://cr.yp.to/mac.html | original website}.\n * Based on public-domain {@link https://github.com/floodyberry/poly1305-donna | poly1305-donna}.\n * @module\n */\n// prettier-ignore\nimport { abytes, aexists, aoutput, clean, copyBytes, wrapMacConstructor } from \"./utils.js\";\n// A simple-loop reference version (`poly1305_small`) lives in\n// `test/misc/micro-ciphers.ts`, provided for auditability.\n// Little-endian 2-byte load used by the Poly1305 limb decomposition.\nfunction u8to16(a, i) {\n    return (a[i++] & 0xff) | ((a[i++] & 0xff) << 8);\n}\n/**\n * Incremental Poly1305 MAC state.\n * Prefer `poly1305()` for one-shot use.\n * @param key - 32-byte Poly1305 one-time key.\n * @example\n * Feeds one chunk into an incremental Poly1305 state with a fresh one-time key.\n *\n * ```ts\n * import { Poly1305 } from '@noble/ciphers/_poly1305.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const mac = new Poly1305(key);\n * mac.update(new Uint8Array([1, 2, 3]));\n * mac.digest();\n * ```\n */\nexport class Poly1305 {\n    blockLen = 16;\n    outputLen = 16;\n    buffer = new Uint8Array(16);\n    r = new Uint16Array(10); // Allocating 1 array with .subarray() here is slower than 3\n    h = new Uint16Array(10);\n    pad = new Uint16Array(8);\n    pos = 0;\n    finished = false;\n    destroyed = false;\n    // Can be speed-up using BigUint64Array, at the cost of complexity\n    constructor(key) {\n        key = copyBytes(abytes(key, 32, 'key'));\n        const t0 = u8to16(key, 0);\n        const t1 = u8to16(key, 2);\n        const t2 = u8to16(key, 4);\n        const t3 = u8to16(key, 6);\n        const t4 = u8to16(key, 8);\n        const t5 = u8to16(key, 10);\n        const t6 = u8to16(key, 12);\n        const t7 = u8to16(key, 14);\n        // RFC 8439 §2.5.1 / RFC 7539 §2.5.1 clamp r before multiplication.\n        // These masks unpack that clamped value into 13-bit limbs, while pad\n        // keeps the raw s half for finalize().\n        // {@link https://github.com/floodyberry/poly1305-donna/blob/e6ad6e091d30d7f4ec2d4f978be1fcfcbce72781/poly1305-donna-16.h#L47 | poly1305-donna reference}\n        this.r[0] = t0 & 0x1fff;\n        this.r[1] = ((t0 >>> 13) | (t1 << 3)) & 0x1fff;\n        this.r[2] = ((t1 >>> 10) | (t2 << 6)) & 0x1f03;\n        this.r[3] = ((t2 >>> 7) | (t3 << 9)) & 0x1fff;\n        this.r[4] = ((t3 >>> 4) | (t4 << 12)) & 0x00ff;\n        this.r[5] = (t4 >>> 1) & 0x1ffe;\n        this.r[6] = ((t4 >>> 14) | (t5 << 2)) & 0x1fff;\n        this.r[7] = ((t5 >>> 11) | (t6 << 5)) & 0x1f81;\n        this.r[8] = ((t6 >>> 8) | (t7 << 8)) & 0x1fff;\n        this.r[9] = (t7 >>> 5) & 0x007f;\n        for (let i = 0; i < 8; i++)\n            this.pad[i] = u8to16(key, 16 + 2 * i);\n    }\n    process(data, offset, isLast = false) {\n        // RFC 8439 §2.5 / §2.5.1 and RFC 7539 §2.5 / §2.5.1 add an extra high\n        // bit to every full 16-byte block. The final partial block gets its\n        // explicit `1` byte during digestInto(), so `hibit` stays zero there.\n        const hibit = isLast ? 0 : 1 << 11;\n        const { h, r } = this;\n        const r0 = r[0];\n        const r1 = r[1];\n        const r2 = r[2];\n        const r3 = r[3];\n        const r4 = r[4];\n        const r5 = r[5];\n        const r6 = r[6];\n        const r7 = r[7];\n        const r8 = r[8];\n        const r9 = r[9];\n        const t0 = u8to16(data, offset + 0);\n        const t1 = u8to16(data, offset + 2);\n        const t2 = u8to16(data, offset + 4);\n        const t3 = u8to16(data, offset + 6);\n        const t4 = u8to16(data, offset + 8);\n        const t5 = u8to16(data, offset + 10);\n        const t6 = u8to16(data, offset + 12);\n        const t7 = u8to16(data, offset + 14);\n        let h0 = h[0] + (t0 & 0x1fff);\n        let h1 = h[1] + (((t0 >>> 13) | (t1 << 3)) & 0x1fff);\n        let h2 = h[2] + (((t1 >>> 10) | (t2 << 6)) & 0x1fff);\n        let h3 = h[3] + (((t2 >>> 7) | (t3 << 9)) & 0x1fff);\n        let h4 = h[4] + (((t3 >>> 4) | (t4 << 12)) & 0x1fff);\n        let h5 = h[5] + ((t4 >>> 1) & 0x1fff);\n        let h6 = h[6] + (((t4 >>> 14) | (t5 << 2)) & 0x1fff);\n        let h7 = h[7] + (((t5 >>> 11) | (t6 << 5)) & 0x1fff);\n        let h8 = h[8] + (((t6 >>> 8) | (t7 << 8)) & 0x1fff);\n        let h9 = h[9] + ((t7 >>> 5) | hibit);\n        let c = 0;\n        let d0 = c + h0 * r0 + h1 * (5 * r9) + h2 * (5 * r8) + h3 * (5 * r7) + h4 * (5 * r6);\n        c = d0 >>> 13;\n        d0 &= 0x1fff;\n        d0 += h5 * (5 * r5) + h6 * (5 * r4) + h7 * (5 * r3) + h8 * (5 * r2) + h9 * (5 * r1);\n        c += d0 >>> 13;\n        d0 &= 0x1fff;\n        let d1 = c + h0 * r1 + h1 * r0 + h2 * (5 * r9) + h3 * (5 * r8) + h4 * (5 * r7);\n        c = d1 >>> 13;\n        d1 &= 0x1fff;\n        d1 += h5 * (5 * r6) + h6 * (5 * r5) + h7 * (5 * r4) + h8 * (5 * r3) + h9 * (5 * r2);\n        c += d1 >>> 13;\n        d1 &= 0x1fff;\n        let d2 = c + h0 * r2 + h1 * r1 + h2 * r0 + h3 * (5 * r9) + h4 * (5 * r8);\n        c = d2 >>> 13;\n        d2 &= 0x1fff;\n        d2 += h5 * (5 * r7) + h6 * (5 * r6) + h7 * (5 * r5) + h8 * (5 * r4) + h9 * (5 * r3);\n        c += d2 >>> 13;\n        d2 &= 0x1fff;\n        let d3 = c + h0 * r3 + h1 * r2 + h2 * r1 + h3 * r0 + h4 * (5 * r9);\n        c = d3 >>> 13;\n        d3 &= 0x1fff;\n        d3 += h5 * (5 * r8) + h6 * (5 * r7) + h7 * (5 * r6) + h8 * (5 * r5) + h9 * (5 * r4);\n        c += d3 >>> 13;\n        d3 &= 0x1fff;\n        let d4 = c + h0 * r4 + h1 * r3 + h2 * r2 + h3 * r1 + h4 * r0;\n        c = d4 >>> 13;\n        d4 &= 0x1fff;\n        d4 += h5 * (5 * r9) + h6 * (5 * r8) + h7 * (5 * r7) + h8 * (5 * r6) + h9 * (5 * r5);\n        c += d4 >>> 13;\n        d4 &= 0x1fff;\n        let d5 = c + h0 * r5 + h1 * r4 + h2 * r3 + h3 * r2 + h4 * r1;\n        c = d5 >>> 13;\n        d5 &= 0x1fff;\n        d5 += h5 * r0 + h6 * (5 * r9) + h7 * (5 * r8) + h8 * (5 * r7) + h9 * (5 * r6);\n        c += d5 >>> 13;\n        d5 &= 0x1fff;\n        let d6 = c + h0 * r6 + h1 * r5 + h2 * r4 + h3 * r3 + h4 * r2;\n        c = d6 >>> 13;\n        d6 &= 0x1fff;\n        d6 += h5 * r1 + h6 * r0 + h7 * (5 * r9) + h8 * (5 * r8) + h9 * (5 * r7);\n        c += d6 >>> 13;\n        d6 &= 0x1fff;\n        let d7 = c + h0 * r7 + h1 * r6 + h2 * r5 + h3 * r4 + h4 * r3;\n        c = d7 >>> 13;\n        d7 &= 0x1fff;\n        d7 += h5 * r2 + h6 * r1 + h7 * r0 + h8 * (5 * r9) + h9 * (5 * r8);\n        c += d7 >>> 13;\n        d7 &= 0x1fff;\n        let d8 = c + h0 * r8 + h1 * r7 + h2 * r6 + h3 * r5 + h4 * r4;\n        c = d8 >>> 13;\n        d8 &= 0x1fff;\n        d8 += h5 * r3 + h6 * r2 + h7 * r1 + h8 * r0 + h9 * (5 * r9);\n        c += d8 >>> 13;\n        d8 &= 0x1fff;\n        let d9 = c + h0 * r9 + h1 * r8 + h2 * r7 + h3 * r6 + h4 * r5;\n        c = d9 >>> 13;\n        d9 &= 0x1fff;\n        d9 += h5 * r4 + h6 * r3 + h7 * r2 + h8 * r1 + h9 * r0;\n        c += d9 >>> 13;\n        d9 &= 0x1fff;\n        c = ((c << 2) + c) | 0;\n        c = (c + d0) | 0;\n        d0 = c & 0x1fff;\n        c = c >>> 13;\n        d1 += c;\n        h[0] = d0;\n        h[1] = d1;\n        h[2] = d2;\n        h[3] = d3;\n        h[4] = d4;\n        h[5] = d5;\n        h[6] = d6;\n        h[7] = d7;\n        h[8] = d8;\n        h[9] = d9;\n    }\n    finalize() {\n        const { h, pad } = this;\n        const g = new Uint16Array(10);\n        let c = h[1] >>> 13;\n        h[1] &= 0x1fff;\n        for (let i = 2; i < 10; i++) {\n            h[i] += c;\n            c = h[i] >>> 13;\n            h[i] &= 0x1fff;\n        }\n        h[0] += c * 5;\n        c = h[0] >>> 13;\n        h[0] &= 0x1fff;\n        h[1] += c;\n        c = h[1] >>> 13;\n        h[1] &= 0x1fff;\n        h[2] += c;\n        // RFC 8439 §2.5 / RFC 7539 §2.5 reduce modulo 2^130-5 before repacking\n        // to 16-bit words and adding the raw s half.\n        g[0] = h[0] + 5;\n        c = g[0] >>> 13;\n        g[0] &= 0x1fff;\n        for (let i = 1; i < 10; i++) {\n            g[i] = h[i] + c;\n            c = g[i] >>> 13;\n            g[i] &= 0x1fff;\n        }\n        g[9] -= 1 << 13;\n        let mask = (c ^ 1) - 1;\n        for (let i = 0; i < 10; i++)\n            g[i] &= mask;\n        mask = ~mask;\n        for (let i = 0; i < 10; i++)\n            h[i] = (h[i] & mask) | g[i];\n        h[0] = (h[0] | (h[1] << 13)) & 0xffff;\n        h[1] = ((h[1] >>> 3) | (h[2] << 10)) & 0xffff;\n        h[2] = ((h[2] >>> 6) | (h[3] << 7)) & 0xffff;\n        h[3] = ((h[3] >>> 9) | (h[4] << 4)) & 0xffff;\n        h[4] = ((h[4] >>> 12) | (h[5] << 1) | (h[6] << 14)) & 0xffff;\n        h[5] = ((h[6] >>> 2) | (h[7] << 11)) & 0xffff;\n        h[6] = ((h[7] >>> 5) | (h[8] << 8)) & 0xffff;\n        h[7] = ((h[8] >>> 8) | (h[9] << 5)) & 0xffff;\n        let f = h[0] + pad[0];\n        h[0] = f & 0xffff;\n        for (let i = 1; i < 8; i++) {\n            f = (((h[i] + pad[i]) | 0) + (f >>> 16)) | 0;\n            h[i] = f & 0xffff;\n        }\n        clean(g);\n    }\n    update(data) {\n        aexists(this);\n        abytes(data);\n        data = copyBytes(data);\n        const { buffer, blockLen } = this;\n        const len = data.length;\n        for (let pos = 0; pos < len;) {\n            const take = Math.min(blockLen - this.pos, len - pos);\n            // Fast path: we have at least one block in input\n            if (take === blockLen) {\n                for (; blockLen <= len - pos; pos += blockLen)\n                    this.process(data, pos);\n                continue;\n            }\n            buffer.set(data.subarray(pos, pos + take), this.pos);\n            this.pos += take;\n            pos += take;\n            if (this.pos === blockLen) {\n                this.process(buffer, 0, false);\n                this.pos = 0;\n            }\n        }\n        return this;\n    }\n    destroy() {\n        // `aexists(this)` guards update/digest paths, so destroy must mark the instance unusable too.\n        this.destroyed = true;\n        clean(this.h, this.r, this.buffer, this.pad);\n    }\n    digestInto(out) {\n        aexists(this);\n        aoutput(out, this);\n        this.finished = true;\n        const { buffer, h } = this;\n        let { pos } = this;\n        if (pos) {\n            // RFC 8439 §2.5 / RFC 7539 §2.5: the final short block appends a\n            // single `0x01` byte and zero-fills the remaining bytes before the\n            // last multiplication step.\n            buffer[pos++] = 1;\n            for (; pos < 16; pos++)\n                buffer[pos] = 0;\n            this.process(buffer, 0, true);\n        }\n        this.finalize();\n        let opos = 0;\n        for (let i = 0; i < 8; i++) {\n            out[opos++] = h[i] >>> 0;\n            out[opos++] = h[i] >>> 8;\n        }\n    }\n    digest() {\n        const { buffer, outputLen } = this;\n        this.digestInto(buffer);\n        // Copy out before destroy() zeroes the internal buffer.\n        const res = buffer.slice(0, outputLen);\n        this.destroy();\n        return res;\n    }\n}\n/**\n * Poly1305 MAC from RFC 8439.\n * @param msg - Message bytes to authenticate.\n * @param key - 32-byte Poly1305 one-time key.\n * @returns 16-byte authentication tag.\n * @example\n * Authenticates one message with a one-shot Poly1305 call and a fresh key.\n *\n * ```ts\n * import { poly1305 } from '@noble/ciphers/_poly1305.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * poly1305(new Uint8Array(), key);\n * ```\n */\nexport const poly1305 = /* @__PURE__ */ wrapMacConstructor(32, (key) => new Poly1305(key));\n","/**\n * ChaCha stream cipher, released\n * in 2008. Developed after Salsa20, ChaCha aims to increase diffusion per round.\n * It was standardized in\n * {@link https://www.rfc-editor.org/rfc/rfc8439 | RFC 8439} and\n * is now used in TLS 1.3.\n *\n * {@link https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha | XChaCha20}\n * extended-nonce variant is also provided. Similar to XSalsa, it's safe to use with\n * randomly-generated nonces.\n *\n * Check out\n * {@link http://cr.yp.to/chacha/chacha-20080128.pdf | PDF},\n * {@link https://en.wikipedia.org/wiki/Salsa20 | wiki}, and\n * {@link https://cr.yp.to/chacha.html | website}.\n *\n * @module\n */\nimport { createCipher, createPRG, rotl } from \"./_arx.js\";\nimport { poly1305 } from \"./_poly1305.js\";\nimport { abytes, clean, equalBytes, getOutput, isLE, swap32IfBE, u64Lengths, wrapCipher, } from \"./utils.js\";\n/**\n * ChaCha core function. Uses an unrolled loop (chachaCore, hchacha) - 4x\n * faster than a simple loop, but larger & harder to read. A simple-loop\n * reference version lives in `test/misc/micro-ciphers.ts`;\n * `test/arx.test.ts` keeps the two aligned.\n * The specific implementation is selected in `createCipher` below.\n */\n/** RFC 8439 §2.3 block core for `state = constants | key | counter | nonce`. */\n// prettier-ignore\nfunction chachaCore(s, k, n, out, cnt, rounds = 20) {\n    let y00 = s[0], y01 = s[1], y02 = s[2], y03 = s[3], // \"expa\"   \"nd 3\"  \"2-by\"  \"te k\"\n    y04 = k[0], y05 = k[1], y06 = k[2], y07 = k[3], // Key      Key     Key     Key\n    y08 = k[4], y09 = k[5], y10 = k[6], y11 = k[7], // Key      Key     Key     Key\n    y12 = cnt, y13 = n[0], y14 = n[1], y15 = n[2]; // Counter  Nonce   Nonce   Nonce\n    // Save state to temporary variables\n    let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;\n    for (let r = 0; r < rounds; r += 2) {\n        x00 = (x00 + x04) | 0;\n        x12 = rotl(x12 ^ x00, 16);\n        x08 = (x08 + x12) | 0;\n        x04 = rotl(x04 ^ x08, 12);\n        x00 = (x00 + x04) | 0;\n        x12 = rotl(x12 ^ x00, 8);\n        x08 = (x08 + x12) | 0;\n        x04 = rotl(x04 ^ x08, 7);\n        x01 = (x01 + x05) | 0;\n        x13 = rotl(x13 ^ x01, 16);\n        x09 = (x09 + x13) | 0;\n        x05 = rotl(x05 ^ x09, 12);\n        x01 = (x01 + x05) | 0;\n        x13 = rotl(x13 ^ x01, 8);\n        x09 = (x09 + x13) | 0;\n        x05 = rotl(x05 ^ x09, 7);\n        x02 = (x02 + x06) | 0;\n        x14 = rotl(x14 ^ x02, 16);\n        x10 = (x10 + x14) | 0;\n        x06 = rotl(x06 ^ x10, 12);\n        x02 = (x02 + x06) | 0;\n        x14 = rotl(x14 ^ x02, 8);\n        x10 = (x10 + x14) | 0;\n        x06 = rotl(x06 ^ x10, 7);\n        x03 = (x03 + x07) | 0;\n        x15 = rotl(x15 ^ x03, 16);\n        x11 = (x11 + x15) | 0;\n        x07 = rotl(x07 ^ x11, 12);\n        x03 = (x03 + x07) | 0;\n        x15 = rotl(x15 ^ x03, 8);\n        x11 = (x11 + x15) | 0;\n        x07 = rotl(x07 ^ x11, 7);\n        x00 = (x00 + x05) | 0;\n        x15 = rotl(x15 ^ x00, 16);\n        x10 = (x10 + x15) | 0;\n        x05 = rotl(x05 ^ x10, 12);\n        x00 = (x00 + x05) | 0;\n        x15 = rotl(x15 ^ x00, 8);\n        x10 = (x10 + x15) | 0;\n        x05 = rotl(x05 ^ x10, 7);\n        x01 = (x01 + x06) | 0;\n        x12 = rotl(x12 ^ x01, 16);\n        x11 = (x11 + x12) | 0;\n        x06 = rotl(x06 ^ x11, 12);\n        x01 = (x01 + x06) | 0;\n        x12 = rotl(x12 ^ x01, 8);\n        x11 = (x11 + x12) | 0;\n        x06 = rotl(x06 ^ x11, 7);\n        x02 = (x02 + x07) | 0;\n        x13 = rotl(x13 ^ x02, 16);\n        x08 = (x08 + x13) | 0;\n        x07 = rotl(x07 ^ x08, 12);\n        x02 = (x02 + x07) | 0;\n        x13 = rotl(x13 ^ x02, 8);\n        x08 = (x08 + x13) | 0;\n        x07 = rotl(x07 ^ x08, 7);\n        x03 = (x03 + x04) | 0;\n        x14 = rotl(x14 ^ x03, 16);\n        x09 = (x09 + x14) | 0;\n        x04 = rotl(x04 ^ x09, 12);\n        x03 = (x03 + x04) | 0;\n        x14 = rotl(x14 ^ x03, 8);\n        x09 = (x09 + x14) | 0;\n        x04 = rotl(x04 ^ x09, 7);\n    }\n    // RFC 8439 §2.3 / §2.3.1: add the original state words back in state order.\n    let oi = 0;\n    out[oi++] = (y00 + x00) | 0;\n    out[oi++] = (y01 + x01) | 0;\n    out[oi++] = (y02 + x02) | 0;\n    out[oi++] = (y03 + x03) | 0;\n    out[oi++] = (y04 + x04) | 0;\n    out[oi++] = (y05 + x05) | 0;\n    out[oi++] = (y06 + x06) | 0;\n    out[oi++] = (y07 + x07) | 0;\n    out[oi++] = (y08 + x08) | 0;\n    out[oi++] = (y09 + x09) | 0;\n    out[oi++] = (y10 + x10) | 0;\n    out[oi++] = (y11 + x11) | 0;\n    out[oi++] = (y12 + x12) | 0;\n    out[oi++] = (y13 + x13) | 0;\n    out[oi++] = (y14 + x14) | 0;\n    out[oi++] = (y15 + x15) | 0;\n}\n/**\n * hchacha hashes key and nonce into key' and nonce' for xchacha20.\n * Algorithmically identical to `hchacha_small` from `test/misc/micro-ciphers.ts`,\n * but this exported path normalizes word order on big-endian hosts.\n * Reuses `chachaCore` and subtracts its feed-forward, keeping the hot per-block\n * path untouched.\n * @param s - Sigma constants as 32-bit words.\n * @param k - Key words.\n * @param i - Nonce-prefix words.\n * @param out - Output buffer for the derived subkey.\n * @example\n * Derives the XChaCha subkey from sigma, key, and nonce-prefix words.\n *\n * ```ts\n * const sigma = new Uint32Array(4);\n * const key = new Uint32Array(8);\n * const nonce = new Uint32Array(4);\n * const out = new Uint32Array(8);\n * hchacha(sigma, key, nonce, out);\n * ```\n */\n// prettier-ignore\nexport function hchacha(s, k, i, out) {\n    // Runs the shared chachaCore permutation, then subtracts the RFC 8439 feed-forward\n    // it applies, recovering the raw permutation words hchacha needs.\n    // LE hosts read the caller arrays in place (no copies); BE hosts get\n    // byte-swapped scratch copies, wiped before returning.\n    const s2 = isLE ? s : swap32IfBE(s.slice(0, 4));\n    const k2 = isLE ? k : swap32IfBE(k.slice(0, 8));\n    const i2 = isLE ? i : swap32IfBE(i.slice(0, 4));\n    const t = new Uint32Array(16);\n    chachaCore(s2, k2, i2.subarray(1), t, i2[0]);\n    let oi = 0;\n    out[oi++] = (t[0] - s2[0]) | 0;\n    out[oi++] = (t[1] - s2[1]) | 0;\n    out[oi++] = (t[2] - s2[2]) | 0;\n    out[oi++] = (t[3] - s2[3]) | 0;\n    out[oi++] = (t[12] - i2[0]) | 0;\n    out[oi++] = (t[13] - i2[1]) | 0;\n    out[oi++] = (t[14] - i2[2]) | 0;\n    out[oi++] = (t[15] - i2[3]) | 0;\n    swap32IfBE(out);\n    if (!isLE)\n        clean(s2, k2, i2);\n    clean(t);\n}\n/**\n * Original, non-RFC chacha20 from DJB. 8-byte nonce, 8-byte counter.\n * The nonce/counter layout still reserves 8 counter bytes internally, but the shared public\n * `counter` argument follows noble's strict non-wrapping 32-bit policy. See `src/_arx.ts`\n * near `MAX_COUNTER` for the full counter-policy rationale.\n * @param key - 16-byte or 32-byte key.\n * @param nonce - 8-byte nonce.\n * @param data - Input bytes to xor with the keystream.\n * @param output - Optional destination buffer.\n * @param counter - Initial block counter.\n * @returns Encrypted or decrypted bytes.\n * @example\n * Encrypts bytes with the original 8-byte-nonce ChaCha variant and a fresh key/nonce.\n *\n * ```ts\n * import { chacha20orig } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const nonce = randomBytes(8);\n * chacha20orig(key, nonce, new Uint8Array(4));\n * ```\n */\nexport const chacha20orig = /* @__PURE__ */ createCipher(chachaCore, {\n    counterRight: false,\n    counterLength: 8,\n    allowShortKeys: true,\n});\n/**\n * ChaCha stream cipher. Conforms to RFC 8439 (IETF, TLS). 12-byte nonce, 4-byte counter.\n * With smaller nonce, it's not safe to make it random (CSPRNG), due to collision chance.\n * @param key - 32-byte key.\n * @param nonce - 12-byte nonce.\n * @param data - Input bytes to xor with the keystream.\n * @param output - Optional destination buffer.\n * @param counter - Initial block counter.\n * @returns Encrypted or decrypted bytes.\n * @example\n * Encrypts bytes with the RFC 8439 ChaCha20 stream cipher and a fresh key/nonce.\n *\n * ```ts\n * import { chacha20 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const nonce = randomBytes(12);\n * chacha20(key, nonce, new Uint8Array(4));\n * ```\n */\nexport const chacha20 = /* @__PURE__ */ createCipher(chachaCore, {\n    counterRight: false,\n    counterLength: 4,\n    allowShortKeys: false,\n});\n/**\n * XChaCha eXtended-nonce ChaCha. With 24-byte nonce, it's safe to make it random (CSPRNG).\n * See {@link https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha | the IRTF draft}.\n * The nonce/counter layout still reserves 8 counter bytes internally, but the shared public\n * `counter` argument follows noble's strict non-wrapping 32-bit policy. See `src/_arx.ts`\n * near `MAX_COUNTER` for the full counter-policy rationale.\n * @param key - 32-byte key.\n * @param nonce - 24-byte extended nonce.\n * @param data - Input bytes to xor with the keystream.\n * @param output - Optional destination buffer.\n * @param counter - Initial block counter.\n * @returns Encrypted or decrypted bytes.\n * @example\n * Encrypts bytes with XChaCha20 using a fresh key and random 24-byte nonce.\n *\n * ```ts\n * import { xchacha20 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const nonce = randomBytes(24);\n * xchacha20(key, nonce, new Uint8Array(4));\n * ```\n */\nexport const xchacha20 = /* @__PURE__ */ createCipher(chachaCore, {\n    counterRight: false,\n    counterLength: 8,\n    extendNonceFn: hchacha,\n    allowShortKeys: false,\n});\n/**\n * Reduced 8-round chacha, described in original paper.\n * @param key - 32-byte key.\n * @param nonce - 12-byte nonce.\n * @param data - Input bytes to xor with the keystream.\n * @param output - Optional destination buffer.\n * @param counter - Initial block counter.\n * @returns Encrypted or decrypted bytes.\n * @example\n * Uses the reduced 8-round variant for non-critical workloads with a fresh key/nonce.\n *\n * ```ts\n * import { chacha8 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const nonce = randomBytes(12);\n * chacha8(key, nonce, new Uint8Array(4));\n * ```\n */\nexport const chacha8 = /* @__PURE__ */ createCipher(chachaCore, {\n    counterRight: false,\n    counterLength: 4,\n    rounds: 8,\n});\n/**\n * Reduced 12-round chacha, described in original paper.\n * @param key - 32-byte key.\n * @param nonce - 12-byte nonce.\n * @param data - Input bytes to xor with the keystream.\n * @param output - Optional destination buffer.\n * @param counter - Initial block counter.\n * @returns Encrypted or decrypted bytes.\n * @example\n * Uses the reduced 12-round variant for non-critical workloads with a fresh key/nonce.\n *\n * ```ts\n * import { chacha12 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const nonce = randomBytes(12);\n * chacha12(key, nonce, new Uint8Array(4));\n * ```\n */\nexport const chacha12 = /* @__PURE__ */ createCipher(chachaCore, {\n    counterRight: false,\n    counterLength: 4,\n    rounds: 12,\n});\n// Test-only hook: exposes the unrolled production core so tests can compare it\n// with the simple/reference core from `test/misc/micro-ciphers.ts`.\nexport const __TESTS = /* @__PURE__ */ Object.freeze({ chachaCore });\n// RFC 8439 §2.8.1 pad16(x): shared zero block for AAD/ciphertext padding.\nconst ZEROS16 = /* @__PURE__ */ new Uint8Array(16);\n// RFC 8439 §2.8 / §2.8.1: aligned inputs add nothing, otherwise append 16-(len%16) zero bytes.\nconst updatePadded = (h, msg) => {\n    h.update(msg);\n    const leftover = msg.length % 16;\n    if (leftover)\n        h.update(ZEROS16.subarray(leftover));\n};\n// RFC 8439 §2.6.1 poly1305_key_gen returns `block[0..31]`, so AEAD key\n// generation only needs 32 zero bytes.\nconst ZEROS32 = /* @__PURE__ */ new Uint8Array(32);\nfunction computeTag(fn, key, nonce, ciphertext, AAD) {\n    if (AAD !== undefined)\n        abytes(AAD, undefined, 'AAD');\n    // RFC 8439 §2.6 / §2.8: derive the Poly1305 one-time key from counter 0,\n    // then MAC AAD || pad16(AAD) || ciphertext || pad16(ciphertext) || len(AAD) || len(ciphertext).\n    const authKey = fn(key, nonce, ZEROS32);\n    const lengths = u64Lengths(ciphertext.length, AAD ? AAD.length : 0, true);\n    // Methods below can be replaced with\n    // `return poly1305_computeTag_small(authKey, lengths, ciphertext, AAD)`\n    // from `test/misc/micro-ciphers.ts`.\n    const h = poly1305.create(authKey);\n    if (AAD)\n        updatePadded(h, AAD);\n    updatePadded(h, ciphertext);\n    h.update(lengths);\n    const res = h.digest();\n    clean(authKey, lengths);\n    return res;\n}\n/**\n * AEAD algorithm from RFC 8439.\n * Salsa20 and chacha (RFC 8439) use poly1305 differently.\n * We could have composed them, but it's hard because of authKey:\n * In salsa20, authKey changes position in salsa stream.\n * In chacha, authKey can't be computed inside computeTag, it modifies the counter.\n */\nexport const _poly1305_aead = (xorStream) => (key, nonce, AAD) => {\n    // This borrows caller key/nonce/AAD buffers by reference; mutating them after construction\n    // changes future encrypt/decrypt results.\n    const tagLength = 16;\n    return {\n        encrypt(plaintext, output) {\n            const plength = plaintext.length;\n            output = getOutput(plength + tagLength, output, false);\n            output.set(plaintext);\n            const oPlain = output.subarray(0, -tagLength);\n            // RFC 8439 §2.8: payload encryption starts at counter 1 because counter 0 produced the OTK.\n            xorStream(key, nonce, oPlain, oPlain, 1);\n            const tag = computeTag(xorStream, key, nonce, oPlain, AAD);\n            output.set(tag, plength); // append tag\n            clean(tag);\n            return output;\n        },\n        decrypt(ciphertext, output) {\n            output = getOutput(ciphertext.length - tagLength, output, false);\n            const data = ciphertext.subarray(0, -tagLength);\n            const passedTag = ciphertext.subarray(-tagLength);\n            const tag = computeTag(xorStream, key, nonce, data, AAD);\n            // RFC 8439 §2.8 / §4: authenticate ciphertext before decrypting it, and compare tags with\n            // the constant-time equalBytes() helper rather than decrypting speculative plaintext first.\n            if (!equalBytes(passedTag, tag)) {\n                clean(tag);\n                throw new Error('invalid tag');\n            }\n            output.set(ciphertext.subarray(0, -tagLength));\n            // Actual decryption\n            xorStream(key, nonce, output, output, 1); // start stream with i=1\n            clean(tag);\n            return output;\n        },\n    };\n};\n/**\n * ChaCha20-Poly1305 from RFC 8439.\n *\n * Unsafe to use random nonces under the same key, due to collision chance.\n * Prefer XChaCha instead.\n * @param key - 32-byte key.\n * @param nonce - 12-byte nonce.\n * @param AAD - Additional authenticated data.\n * @returns AEAD cipher instance.\n * @example\n * Encrypts and authenticates plaintext with a fresh key and nonce.\n *\n * ```ts\n * import { chacha20poly1305 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const nonce = randomBytes(12);\n * const aad = new TextEncoder().encode('session metadata');\n * const cipher = chacha20poly1305(key, nonce, aad);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const chacha20poly1305 = /* @__PURE__ */ wrapCipher({ blockSize: 64, nonceLength: 12, tagLength: 16, withAAD: true }, \n/* @__PURE__ */ _poly1305_aead(chacha20));\n/**\n * XChaCha20-Poly1305 extended-nonce chacha.\n *\n * Can be safely used with random nonces (CSPRNG).\n * See {@link https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha | the IRTF draft}.\n * @param key - 32-byte key.\n * @param nonce - 24-byte nonce.\n * @param AAD - Additional authenticated data.\n * @returns AEAD cipher instance.\n * @example\n * Encrypts and authenticates plaintext with a fresh key and random 24-byte nonce.\n *\n * ```ts\n * import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const key = randomBytes(32);\n * const nonce = randomBytes(24);\n * const aad = new TextEncoder().encode('session metadata');\n * const cipher = xchacha20poly1305(key, nonce, aad);\n * cipher.encrypt(new Uint8Array([1, 2, 3]));\n * ```\n */\nexport const xchacha20poly1305 = /* @__PURE__ */ wrapCipher({ blockSize: 64, nonceLength: 24, tagLength: 16, withAAD: true }, \n/* @__PURE__ */ _poly1305_aead(xchacha20));\n/**\n * Chacha20 CSPRNG (cryptographically secure pseudorandom number generator).\n * It's best to limit usage to non-production, non-critical cases: for example, test-only.\n * Compatible with libtomcrypt. It does not have a specification, so unclear how secure it is.\n * @param seed - Optional seed bytes mixed into the internal `key || nonce` state. When omitted,\n * only 32 random bytes are mixed into the 40-byte state.\n * @returns Seeded concrete `_XorStreamPRG` instance, including `clone()`.\n * @example\n * Seeds the test-only ChaCha20 DRBG from fresh entropy.\n *\n * ```ts\n * import { rngChacha20 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const seed = randomBytes(32);\n * const prg = rngChacha20(seed);\n * prg.randomBytes(8);\n * ```\n */\nexport const rngChacha20 = /* @__PURE__ */ createPRG(chacha20orig, 64, 32, 8);\n/**\n * Chacha20/8 CSPRNG (cryptographically secure pseudorandom number generator).\n * It's best to limit usage to non-production, non-critical cases: for example, test-only.\n * Faster than `rngChacha20`.\n * @param seed - Optional seed bytes mixed into the internal `key || nonce` state. When omitted,\n * only 32 random bytes are mixed into the 44-byte state.\n * @returns Seeded concrete `_XorStreamPRG` instance, including `clone()`.\n * @example\n * Seeds the faster test-only ChaCha8 DRBG from fresh entropy.\n *\n * ```ts\n * import { rngChacha8 } from '@noble/ciphers/chacha.js';\n * import { randomBytes } from '@noble/ciphers/utils.js';\n * const seed = randomBytes(32);\n * const prg = rngChacha8(seed);\n * prg.randomBytes(8);\n * ```\n */\nexport const rngChacha8 = /* @__PURE__ */ createPRG(chacha8, 64, 32, 12);\n","import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from \"./jwt.mjs\";\nimport { constantTimeEqual } from \"./buffer.mjs\";\nimport { hashPassword, verifyPassword } from \"./password.mjs\";\nimport { generateRandomString } from \"./random.mjs\";\nimport { getWebcryptoSubtle } from \"@better-auth/utils\";\nimport { createHash } from \"@better-auth/utils/hash\";\nimport { xchacha20poly1305 } from \"@noble/ciphers/chacha.js\";\nimport { bytesToHex, hexToBytes, managedNonce, utf8ToBytes } from \"@noble/ciphers/utils.js\";\n//#region src/crypto/index.ts\nconst algorithm = {\n\tname: \"HMAC\",\n\thash: \"SHA-256\"\n};\nconst ENVELOPE_PREFIX = \"$ba$\";\nfunction parseEnvelope(data) {\n\tif (!data.startsWith(ENVELOPE_PREFIX)) return null;\n\tconst firstSep = 4;\n\tconst secondSep = data.indexOf(\"$\", firstSep);\n\tif (secondSep === -1) return null;\n\tconst version = parseInt(data.slice(firstSep, secondSep), 10);\n\tif (!Number.isInteger(version) || version < 0) return null;\n\treturn {\n\t\tversion,\n\t\tciphertext: data.slice(secondSep + 1)\n\t};\n}\nfunction formatEnvelope(version, ciphertext) {\n\treturn `${ENVELOPE_PREFIX}${version}$${ciphertext}`;\n}\nasync function rawEncrypt(secret, data) {\n\tconst keyAsBytes = await createHash(\"SHA-256\").digest(secret);\n\tconst dataAsBytes = utf8ToBytes(data);\n\treturn bytesToHex(managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes)).encrypt(dataAsBytes));\n}\nasync function rawDecrypt(secret, hex) {\n\tconst keyAsBytes = await createHash(\"SHA-256\").digest(secret);\n\tconst dataAsBytes = hexToBytes(hex);\n\tconst chacha = managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes));\n\treturn new TextDecoder().decode(chacha.decrypt(dataAsBytes));\n}\nconst symmetricEncrypt = async ({ key, data }) => {\n\tif (typeof key === \"string\") return rawEncrypt(key, data);\n\tconst secret = key.keys.get(key.currentVersion);\n\tif (!secret) throw new Error(`Secret version ${key.currentVersion} not found in keys`);\n\tconst ciphertext = await rawEncrypt(secret, data);\n\treturn formatEnvelope(key.currentVersion, ciphertext);\n};\nconst symmetricDecrypt = async ({ key, data }) => {\n\tif (typeof key === \"string\") return rawDecrypt(key, data);\n\tconst envelope = parseEnvelope(data);\n\tif (envelope) {\n\t\tconst secret = key.keys.get(envelope.version);\n\t\tif (!secret) throw new Error(`Secret version ${envelope.version} not found in keys (key may have been retired)`);\n\t\treturn rawDecrypt(secret, envelope.ciphertext);\n\t}\n\tif (key.legacySecret) return rawDecrypt(key.legacySecret, data);\n\tthrow new Error(\"Cannot decrypt legacy bare-hex payload: no legacy secret available. Set BETTER_AUTH_SECRET for backwards compatibility.\");\n};\nconst getCryptoKey = async (secret) => {\n\tconst secretBuf = typeof secret === \"string\" ? new TextEncoder().encode(secret) : secret;\n\treturn await getWebcryptoSubtle().importKey(\"raw\", secretBuf, algorithm, false, [\"sign\", \"verify\"]);\n};\nconst makeSignature = async (value, secret) => {\n\tconst key = await getCryptoKey(secret);\n\tconst signature = await getWebcryptoSubtle().sign(algorithm.name, key, new TextEncoder().encode(value));\n\treturn btoa(String.fromCharCode(...new Uint8Array(signature)));\n};\n//#endregion\nexport { constantTimeEqual, formatEnvelope, generateRandomString, getCryptoKey, hashPassword, makeSignature, parseEnvelope, signJWT, symmetricDecodeJWT, symmetricDecrypt, symmetricEncodeJWT, symmetricEncrypt, verifyJWT, verifyPassword };\n","import { getWebcryptoSubtle } from \"@better-auth/utils\";\n//#region src/crypto.ts\nconst algorithm = {\n\tname: \"HMAC\",\n\thash: \"SHA-256\"\n};\nconst getCryptoKey = async (secret) => {\n\tconst secretBuf = typeof secret === \"string\" ? new TextEncoder().encode(secret) : secret;\n\treturn await getWebcryptoSubtle().importKey(\"raw\", secretBuf, algorithm, false, [\"sign\", \"verify\"]);\n};\nconst verifySignature = async (base64Signature, value, secret) => {\n\ttry {\n\t\tconst signatureBinStr = atob(base64Signature);\n\t\tconst signature = new Uint8Array(signatureBinStr.length);\n\t\tfor (let i = 0, len = signatureBinStr.length; i < len; i++) signature[i] = signatureBinStr.charCodeAt(i);\n\t\treturn await getWebcryptoSubtle().verify(algorithm, secret, signature, new TextEncoder().encode(value));\n\t} catch {\n\t\treturn false;\n\t}\n};\nconst makeSignature = async (value, secret) => {\n\tconst key = await getCryptoKey(secret);\n\tconst signature = await getWebcryptoSubtle().sign(algorithm.name, key, new TextEncoder().encode(value));\n\treturn btoa(String.fromCharCode(...new Uint8Array(signature)));\n};\nconst signCookieValue = async (value, secret) => {\n\tconst signature = await makeSignature(value, secret);\n\tvalue = `${value}.${signature}`;\n\tvalue = encodeURIComponent(value);\n\treturn value;\n};\n//#endregion\nexport { getCryptoKey, signCookieValue, verifySignature };\n\n//# sourceMappingURL=crypto.mjs.map","import { APIError } from \"./error.mjs\";\n//#region src/utils.ts\nconst jsonContentTypeRegex = /^application\\/([a-z0-9.+-]*\\+)?json/i;\nasync function getBody(request, allowedMediaTypes) {\n\tconst contentType = request.headers.get(\"content-type\") || \"\";\n\tconst normalizedContentType = contentType.toLowerCase();\n\tif (!request.body) return;\n\tif (allowedMediaTypes && allowedMediaTypes.length > 0) {\n\t\tif (!allowedMediaTypes.some((allowed) => {\n\t\t\tconst normalizedContentTypeBase = normalizedContentType.split(\";\")[0].trim();\n\t\t\tconst normalizedAllowed = allowed.toLowerCase().trim();\n\t\t\treturn normalizedContentTypeBase === normalizedAllowed || normalizedContentTypeBase.includes(normalizedAllowed);\n\t\t})) {\n\t\t\tif (!normalizedContentType) throw new APIError(415, {\n\t\t\t\tmessage: `Content-Type is required. Allowed types: ${allowedMediaTypes.join(\", \")}`,\n\t\t\t\tcode: \"UNSUPPORTED_MEDIA_TYPE\"\n\t\t\t});\n\t\t\tthrow new APIError(415, {\n\t\t\t\tmessage: `Content-Type \"${contentType}\" is not allowed. Allowed types: ${allowedMediaTypes.join(\", \")}`,\n\t\t\t\tcode: \"UNSUPPORTED_MEDIA_TYPE\"\n\t\t\t});\n\t\t}\n\t}\n\tif (jsonContentTypeRegex.test(normalizedContentType)) try {\n\t\treturn await request.json();\n\t} catch (e) {\n\t\tif (e instanceof SyntaxError) throw new APIError(400, {\n\t\t\tmessage: \"Invalid JSON in request body\",\n\t\t\tcode: \"BAD_REQUEST\"\n\t\t});\n\t\tthrow e;\n\t}\n\tif (normalizedContentType.includes(\"application/x-www-form-urlencoded\")) {\n\t\tconst formData = await request.formData();\n\t\tconst result = {};\n\t\tformData.forEach((value, key) => {\n\t\t\tresult[key] = value.toString();\n\t\t});\n\t\treturn result;\n\t}\n\tif (normalizedContentType.includes(\"multipart/form-data\")) {\n\t\tconst formData = await request.formData();\n\t\tconst result = {};\n\t\tformData.forEach((value, key) => {\n\t\t\tresult[key] = value;\n\t\t});\n\t\treturn result;\n\t}\n\tif (normalizedContentType.includes(\"text/plain\")) return await request.text();\n\tif (normalizedContentType.includes(\"application/octet-stream\")) return await request.arrayBuffer();\n\tif (normalizedContentType.includes(\"application/pdf\") || normalizedContentType.includes(\"image/\") || normalizedContentType.includes(\"video/\")) return await request.blob();\n\tif (normalizedContentType.includes(\"application/stream\") || request.body instanceof ReadableStream) return request.body;\n\treturn await request.text();\n}\nfunction isAPIError(error) {\n\treturn error instanceof APIError || error?.name === \"APIError\";\n}\nfunction tryDecode(str) {\n\ttry {\n\t\treturn str.includes(\"%\") ? decodeURIComponent(str) : str;\n\t} catch {\n\t\treturn str;\n\t}\n}\nasync function tryCatch(promise) {\n\ttry {\n\t\treturn {\n\t\t\tdata: await promise,\n\t\t\terror: null\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tdata: null,\n\t\t\terror\n\t\t};\n\t}\n}\n/**\n* Check if an object is a `Request`\n* - `instanceof`: works for native Request instances\n* - `toString`: handles where instanceof check fails but the object is still a valid Request\n*/\nfunction isRequest(obj) {\n\treturn obj instanceof Request || Object.prototype.toString.call(obj) === \"[object Request]\";\n}\n//#endregion\nexport { getBody, isAPIError, isRequest, tryCatch, tryDecode };\n\n//# sourceMappingURL=utils.mjs.map","import { signCookieValue } from \"./crypto.mjs\";\nimport { tryDecode } from \"./utils.mjs\";\n//#region src/cookies.ts\nconst COOKIE_PREFIXES = {\n\tsecure: \"__Secure-\",\n\thost: \"__Host-\"\n};\nconst getCookieKey = (key, prefix) => {\n\tif (!prefix) return key;\n\tif (prefix !== \"secure\" && prefix !== \"host\") return void 0;\n\treturn COOKIE_PREFIXES[prefix] + key;\n};\n/**\n* Parse an HTTP Cookie header string and returning an object of all cookie\n* name-value pairs.\n*\n* Inspired by https://github.com/unjs/cookie-es/blob/main/src/cookie/parse.ts\n*\n* @param str the string representing a `Cookie` header value\n*/\nfunction parseCookies(str) {\n\tif (typeof str !== \"string\") throw new TypeError(\"argument str must be a string\");\n\tconst cookies = /* @__PURE__ */ new Map();\n\tlet index = 0;\n\twhile (index < str.length) {\n\t\tconst eqIdx = str.indexOf(\"=\", index);\n\t\tif (eqIdx === -1) break;\n\t\tlet endIdx = str.indexOf(\";\", index);\n\t\tif (endIdx === -1) endIdx = str.length;\n\t\telse if (endIdx < eqIdx) {\n\t\t\tindex = str.lastIndexOf(\";\", eqIdx - 1) + 1;\n\t\t\tcontinue;\n\t\t}\n\t\tconst key = str.slice(index, eqIdx).trim();\n\t\tif (!cookies.has(key)) {\n\t\t\tlet val = str.slice(eqIdx + 1, endIdx).trim();\n\t\t\tif (val.codePointAt(0) === 34) val = val.slice(1, -1);\n\t\t\tcookies.set(key, tryDecode(val));\n\t\t}\n\t\tindex = endIdx + 1;\n\t}\n\treturn cookies;\n}\nfunction resolveCookie(name, value, options = {}) {\n\tconst resolvedName = getCookieKey(name, options.prefix) ?? name;\n\tconst resolvedOptions = { ...options };\n\tconst lowerName = resolvedName.toLowerCase();\n\tif (lowerName.startsWith(\"__host-\")) {\n\t\tresolvedOptions.secure = true;\n\t\tresolvedOptions.path = \"/\";\n\t\tresolvedOptions.domain = void 0;\n\t} else if (lowerName.startsWith(\"__secure-\")) resolvedOptions.secure = true;\n\tif (resolvedOptions.partitioned === true || resolvedOptions.sameSite?.toLowerCase() === \"none\") resolvedOptions.secure = true;\n\treturn {\n\t\tname: resolvedName,\n\t\tvalue,\n\t\toptions: resolvedOptions\n\t};\n}\nfunction serializeCookieValue({ name, value, options }) {\n\tlet cookie = `${name}=${value}`;\n\tif (typeof options.maxAge === \"number\" && options.maxAge >= 0) {\n\t\tif (options.maxAge > 3456e4) throw new Error(\"Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.\");\n\t\tcookie += `; Max-Age=${Math.floor(options.maxAge)}`;\n\t}\n\tif (options.domain) cookie += `; Domain=${options.domain}`;\n\tif (options.path) cookie += `; Path=${options.path}`;\n\tif (options.expires) {\n\t\tif (options.expires.getTime() - Date.now() > 3456e7) throw new Error(\"Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.\");\n\t\tcookie += `; Expires=${options.expires.toUTCString()}`;\n\t}\n\tif (options.httpOnly) cookie += \"; HttpOnly\";\n\tif (options.secure) cookie += \"; Secure\";\n\tif (options.sameSite) cookie += `; SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`;\n\tif (options.partitioned) cookie += \"; Partitioned\";\n\treturn cookie;\n}\nconst serializeCookie = (key, value, opt) => {\n\tvalue = encodeURIComponent(value);\n\treturn serializeCookieValue(resolveCookie(key, value, opt));\n};\nconst serializeSignedCookie = async (key, value, secret, opt) => {\n\tvalue = await signCookieValue(value, secret);\n\treturn serializeCookieValue(resolveCookie(key, value, opt));\n};\n//#endregion\nexport { getCookieKey, parseCookies, serializeCookie, serializeSignedCookie };\n\n//# sourceMappingURL=cookies.mjs.map","//#region src/validator.ts\n/**\n* Runs validation on body and query\n* @returns error and data object\n*/\nasync function runValidation(options, context = {}) {\n\tconst request = {\n\t\tbody: context.body,\n\t\tquery: context.query\n\t};\n\tif (options.body) {\n\t\tconst result = await options.body[\"~standard\"].validate(context.body);\n\t\tif (result.issues) return {\n\t\t\tdata: null,\n\t\t\terror: fromError(result.issues, \"body\")\n\t\t};\n\t\trequest.body = result.value;\n\t}\n\tif (options.query) {\n\t\tconst result = await options.query[\"~standard\"].validate(context.query);\n\t\tif (result.issues) return {\n\t\t\tdata: null,\n\t\t\terror: fromError(result.issues, \"query\")\n\t\t};\n\t\trequest.query = result.value;\n\t}\n\tif (options.requireHeaders && !context.headers) return {\n\t\tdata: null,\n\t\terror: {\n\t\t\tmessage: \"Headers is required\",\n\t\t\tissues: []\n\t\t}\n\t};\n\tif (options.requireRequest && !context.request) return {\n\t\tdata: null,\n\t\terror: {\n\t\t\tmessage: \"Request is required\",\n\t\t\tissues: []\n\t\t}\n\t};\n\treturn {\n\t\tdata: request,\n\t\terror: null\n\t};\n}\nfunction fromError(error, validating) {\n\treturn {\n\t\tmessage: error.map((e) => {\n\t\t\treturn `[${e.path?.length ? `${validating}.` + e.path.map((x) => typeof x === \"object\" ? x.key : x).join(\".\") : validating}] ${e.message}`;\n\t\t}).join(\"; \"),\n\t\tissues: error\n\t};\n}\n//#endregion\nexport { runValidation };\n\n//# sourceMappingURL=validator.mjs.map","import { getCryptoKey, verifySignature } from \"./crypto.mjs\";\nimport { APIError, ValidationError } from \"./error.mjs\";\nimport { isRequest } from \"./utils.mjs\";\nimport { getCookieKey, parseCookies, serializeCookie, serializeSignedCookie } from \"./cookies.mjs\";\nimport { runValidation } from \"./validator.mjs\";\n//#region src/context.ts\nconst createInternalContext = async (context, { options, path }) => {\n\tconst headers = new Headers();\n\tlet responseStatus = void 0;\n\tconst { data, error } = await runValidation(options, context);\n\tif (error) throw new ValidationError(error.message, error.issues);\n\tconst requestHeaders = context.headers !== void 0 ? context.headers instanceof Headers ? context.headers : new Headers(context.headers) : \"request\" in context && isRequest(context.request) ? context.request.headers : null;\n\tconst requestCookies = requestHeaders?.get(\"cookie\");\n\tconst parsedCookies = requestCookies ? parseCookies(requestCookies) : void 0;\n\tconst internalContext = {\n\t\t...context,\n\t\tbody: data.body,\n\t\tquery: data.query,\n\t\tpath: context.path || path || \"virtual:\",\n\t\tcontext: \"context\" in context && context.context ? context.context : {},\n\t\treturned: void 0,\n\t\theaders: context?.headers,\n\t\trequest: context?.request,\n\t\tparams: \"params\" in context ? context.params : void 0,\n\t\tmethod: context.method ?? (Array.isArray(options.method) ? options.method[0] : options.method === \"*\" ? \"GET\" : options.method),\n\t\tsetHeader: (key, value) => {\n\t\t\theaders.set(key, value);\n\t\t},\n\t\tgetHeader: (key) => {\n\t\t\tif (!requestHeaders) return null;\n\t\t\treturn requestHeaders.get(key);\n\t\t},\n\t\tgetCookie: (key, prefix) => {\n\t\t\tconst finalKey = getCookieKey(key, prefix);\n\t\t\tif (!finalKey) return null;\n\t\t\treturn parsedCookies?.get(finalKey) || null;\n\t\t},\n\t\tgetSignedCookie: async (key, secret, prefix) => {\n\t\t\tconst finalKey = getCookieKey(key, prefix);\n\t\t\tif (!finalKey) return null;\n\t\t\tconst value = parsedCookies?.get(finalKey);\n\t\t\tif (!value) return null;\n\t\t\tconst signatureStartPos = value.lastIndexOf(\".\");\n\t\t\tif (signatureStartPos < 1) return null;\n\t\t\tconst signedValue = value.substring(0, signatureStartPos);\n\t\t\tconst signature = value.substring(signatureStartPos + 1);\n\t\t\tif (signature.length !== 44 || !signature.endsWith(\"=\")) return null;\n\t\t\treturn await verifySignature(signature, signedValue, await getCryptoKey(secret)) ? signedValue : false;\n\t\t},\n\t\tsetCookie: (key, value, options) => {\n\t\t\tconst cookie = serializeCookie(key, value, options);\n\t\t\theaders.append(\"set-cookie\", cookie);\n\t\t\treturn cookie;\n\t\t},\n\t\tsetSignedCookie: async (key, value, secret, options) => {\n\t\t\tconst cookie = await serializeSignedCookie(key, value, secret, options);\n\t\t\theaders.append(\"set-cookie\", cookie);\n\t\t\treturn cookie;\n\t\t},\n\t\tredirect: (url) => {\n\t\t\theaders.set(\"location\", url);\n\t\t\treturn new APIError(\"FOUND\", void 0, headers);\n\t\t},\n\t\terror: (status, body, headers) => {\n\t\t\treturn new APIError(status, body, headers);\n\t\t},\n\t\tsetStatus: (status) => {\n\t\t\tresponseStatus = status;\n\t\t},\n\t\tjson: (json, routerResponse) => {\n\t\t\tif (!context.asResponse) return json;\n\t\t\treturn {\n\t\t\t\tbody: routerResponse?.body || json,\n\t\t\t\trouterResponse,\n\t\t\t\t_flag: \"json\"\n\t\t\t};\n\t\t},\n\t\tresponseHeaders: headers,\n\t\tget responseStatus() {\n\t\t\treturn responseStatus;\n\t\t}\n\t};\n\tfor (const middleware of options.use || []) {\n\t\tconst response = await middleware({\n\t\t\t...internalContext,\n\t\t\treturnHeaders: true,\n\t\t\tasResponse: false\n\t\t});\n\t\tif (response.response) Object.assign(internalContext.context, response.response);\n\t\t/**\n\t\t* Apply headers from the middleware to the endpoint headers\n\t\t*/\n\t\tif (response.headers) response.headers.forEach((value, key) => {\n\t\t\tinternalContext.responseHeaders.set(key, value);\n\t\t});\n\t}\n\treturn internalContext;\n};\n//#endregion\nexport { createInternalContext };\n\n//# sourceMappingURL=context.mjs.map","import { isAPIError } from \"./utils.mjs\";\n//#region src/to-response.ts\nfunction isJSONSerializable(value) {\n\tif (value === void 0) return false;\n\tconst t = typeof value;\n\tif (t === \"string\" || t === \"number\" || t === \"boolean\" || t === null) return true;\n\tif (t !== \"object\") return false;\n\tif (Array.isArray(value)) return true;\n\tif (value.buffer) return false;\n\treturn value.constructor && value.constructor.name === \"Object\" || typeof value.toJSON === \"function\";\n}\nfunction safeStringify(obj) {\n\tconst parents = /* @__PURE__ */ new WeakMap();\n\tconst ids = /* @__PURE__ */ new WeakMap();\n\tlet id = 0;\n\tconst isAncestor = (value, holder) => {\n\t\tlet curr = holder;\n\t\twhile (curr) {\n\t\t\tif (curr === value) return true;\n\t\t\tcurr = parents.get(curr);\n\t\t}\n\t\treturn false;\n\t};\n\treturn JSON.stringify(obj, function(_key, value) {\n\t\tif (typeof value === \"bigint\") return value.toString();\n\t\tif (typeof value === \"object\" && value !== null) {\n\t\t\tif (isAncestor(value, this)) return `[Circular ref-${ids.get(value)}]`;\n\t\t\tparents.set(value, this);\n\t\t\tif (!ids.has(value)) ids.set(value, id++);\n\t\t}\n\t\treturn value;\n\t});\n}\nfunction isJSONResponse(value) {\n\tif (!value || typeof value !== \"object\") return false;\n\treturn \"_flag\" in value && value._flag === \"json\";\n}\n/**\n* Headers that MUST be stripped when building an HTTP response from\n* arbitrary header input. These are request-only, hop-by-hop, or\n* transport-managed headers that cause protocol violations when present\n* on responses (e.g. Content-Length mismatch → net::ERR_CONTENT_LENGTH_MISMATCH).\n*\n* Sources:\n*   - RFC 9110 §10.1   (Request Context Fields)\n*   - RFC 9110 §7.6.1  (Connection / hop-by-hop)\n*   - RFC 9110 §11.6-7 (Authentication credentials)\n*   - RFC 9110 §12.5   (Content negotiation)\n*   - RFC 9110 §13.1   (Conditional request headers)\n*   - RFC 9110 §14.2   (Range requests)\n*   - RFC 6265 §5.4    (Cookie)\n*   - RFC 6454         (Origin)\n*/\nconst REQUEST_ONLY_HEADERS = /* @__PURE__ */ new Set([\n\t\"host\",\n\t\"user-agent\",\n\t\"referer\",\n\t\"from\",\n\t\"expect\",\n\t\"authorization\",\n\t\"proxy-authorization\",\n\t\"cookie\",\n\t\"origin\",\n\t\"accept-charset\",\n\t\"accept-encoding\",\n\t\"accept-language\",\n\t\"if-match\",\n\t\"if-none-match\",\n\t\"if-modified-since\",\n\t\"if-unmodified-since\",\n\t\"if-range\",\n\t\"range\",\n\t\"max-forwards\",\n\t\"connection\",\n\t\"keep-alive\",\n\t\"transfer-encoding\",\n\t\"te\",\n\t\"upgrade\",\n\t\"trailer\",\n\t\"proxy-connection\",\n\t\"content-length\"\n]);\nfunction stripRequestOnlyHeaders(headers) {\n\tfor (const name of REQUEST_ONLY_HEADERS) headers.delete(name);\n}\n/**\n* Copy headers from `source` into `target`. `Set-Cookie` is appended (one\n* header per cookie) because RFC 9110 §5.3 notes it cannot be combined\n* into a single comma-separated value; other headers are set (replace).\n*/\nfunction copyHeaders(target, source) {\n\tif (!source) return;\n\tfor (const [key, value] of new Headers(source).entries()) if (key.toLowerCase() === \"set-cookie\") target.append(key, value);\n\telse target.set(key, value);\n}\nfunction toResponse(data, init) {\n\tif (data instanceof Response) {\n\t\tif (init?.headers) {\n\t\t\tconst safeHeaders = new Headers(init.headers);\n\t\t\tstripRequestOnlyHeaders(safeHeaders);\n\t\t\tcopyHeaders(data.headers, safeHeaders);\n\t\t}\n\t\treturn data;\n\t}\n\tif (isJSONResponse(data)) {\n\t\tconst body = data.body;\n\t\tconst routerResponse = data.routerResponse;\n\t\tif (routerResponse instanceof Response) return routerResponse;\n\t\tconst headers = new Headers();\n\t\tcopyHeaders(headers, routerResponse?.headers);\n\t\tcopyHeaders(headers, data.headers);\n\t\tif (init?.headers) {\n\t\t\tconst safeHeaders = new Headers(init.headers);\n\t\t\tstripRequestOnlyHeaders(safeHeaders);\n\t\t\tcopyHeaders(headers, safeHeaders);\n\t\t}\n\t\theaders.set(\"Content-Type\", \"application/json\");\n\t\tconst status = data.status ?? init?.status ?? routerResponse?.status;\n\t\tconst statusText = init?.statusText ?? routerResponse?.statusText;\n\t\treturn new Response(JSON.stringify(body), {\n\t\t\t...routerResponse,\n\t\t\theaders,\n\t\t\t...status === void 0 ? {} : { status },\n\t\t\t...statusText === void 0 ? {} : { statusText }\n\t\t});\n\t}\n\tif (isAPIError(data)) return toResponse(data.body, {\n\t\tstatus: init?.status ?? data.statusCode,\n\t\tstatusText: data.status.toString(),\n\t\theaders: init?.headers || data.headers\n\t});\n\tlet body = data;\n\tconst headers = new Headers(init?.headers);\n\tstripRequestOnlyHeaders(headers);\n\tif (!data) {\n\t\tif (data === null) body = JSON.stringify(null);\n\t\theaders.set(\"content-type\", \"application/json\");\n\t} else if (typeof data === \"string\") {\n\t\tbody = data;\n\t\theaders.set(\"Content-Type\", \"text/plain\");\n\t} else if (data instanceof ArrayBuffer || ArrayBuffer.isView(data)) {\n\t\tbody = data;\n\t\theaders.set(\"Content-Type\", \"application/octet-stream\");\n\t} else if (data instanceof Blob) {\n\t\tbody = data;\n\t\theaders.set(\"Content-Type\", data.type || \"application/octet-stream\");\n\t} else if (data instanceof FormData) body = data;\n\telse if (data instanceof URLSearchParams) {\n\t\tbody = data;\n\t\theaders.set(\"Content-Type\", \"application/x-www-form-urlencoded\");\n\t} else if (data instanceof ReadableStream) {\n\t\tbody = data;\n\t\theaders.set(\"Content-Type\", \"application/octet-stream\");\n\t} else if (isJSONSerializable(data)) {\n\t\tbody = safeStringify(data);\n\t\theaders.set(\"Content-Type\", \"application/json\");\n\t}\n\treturn new Response(body, {\n\t\t...init,\n\t\theaders\n\t});\n}\n//#endregion\nexport { toResponse };\n\n//# sourceMappingURL=to-response.mjs.map","import { APIError, BetterCallError, ValidationError } from \"./error.mjs\";\nimport { isAPIError, tryCatch } from \"./utils.mjs\";\nimport { createInternalContext } from \"./context.mjs\";\nimport { toResponse } from \"./to-response.mjs\";\n//#region src/endpoint.ts\nfunction createEndpoint(pathOrOptions, handlerOrOptions, handlerOrNever) {\n\tconst path = typeof pathOrOptions === \"string\" ? pathOrOptions : void 0;\n\tconst options = typeof handlerOrOptions === \"object\" ? handlerOrOptions : pathOrOptions;\n\tconst handler = typeof handlerOrOptions === \"function\" ? handlerOrOptions : handlerOrNever;\n\tif ((options.method === \"GET\" || options.method === \"HEAD\") && options.body) throw new BetterCallError(\"Body is not allowed with GET or HEAD methods\");\n\tif (path && /\\/{2,}/.test(path)) throw new BetterCallError(\"Path cannot contain consecutive slashes\");\n\tconst internalHandler = async (...inputCtx) => {\n\t\tconst context = inputCtx[0] || {};\n\t\tconst { data: internalContext, error: validationError } = await tryCatch(createInternalContext(context, {\n\t\t\toptions,\n\t\t\tpath\n\t\t}));\n\t\tif (validationError) {\n\t\t\tif (!(validationError instanceof ValidationError)) throw validationError;\n\t\t\tif (options.onValidationError) await options.onValidationError({\n\t\t\t\tmessage: validationError.message,\n\t\t\t\tissues: validationError.issues\n\t\t\t});\n\t\t\tthrow new APIError(400, {\n\t\t\t\tmessage: validationError.message,\n\t\t\t\tcode: \"VALIDATION_ERROR\"\n\t\t\t});\n\t\t}\n\t\tconst response = await handler(internalContext).catch(async (e) => {\n\t\t\tif (isAPIError(e)) {\n\t\t\t\tconst onAPIError = options.onAPIError;\n\t\t\t\tif (onAPIError) await onAPIError(e);\n\t\t\t\tif (context.asResponse) return e;\n\t\t\t}\n\t\t\tthrow e;\n\t\t});\n\t\tconst headers = internalContext.responseHeaders;\n\t\tconst status = internalContext.responseStatus;\n\t\treturn context.asResponse ? toResponse(response, status === void 0 ? { headers } : {\n\t\t\theaders,\n\t\t\tstatus\n\t\t}) : context.returnHeaders ? context.returnStatus ? {\n\t\t\theaders,\n\t\t\tresponse,\n\t\t\tstatus\n\t\t} : {\n\t\t\theaders,\n\t\t\tresponse\n\t\t} : context.returnStatus ? {\n\t\t\tresponse,\n\t\t\tstatus\n\t\t} : response;\n\t};\n\tinternalHandler.options = options;\n\tinternalHandler.path = path;\n\treturn internalHandler;\n}\nfunction combineMiddleware(local, configured) {\n\treturn [...local ?? [], ...configured ?? []];\n}\ncreateEndpoint.create = (opts) => {\n\tfunction createConfiguredEndpoint(...args) {\n\t\tif (args.length === 3) {\n\t\t\tconst [path, options, handler] = args;\n\t\t\treturn createEndpoint(path, {\n\t\t\t\t...options,\n\t\t\t\tuse: combineMiddleware(options.use, opts?.use)\n\t\t\t}, handler);\n\t\t}\n\t\tconst [options, handler] = args;\n\t\treturn createEndpoint({\n\t\t\t...options,\n\t\t\tuse: combineMiddleware(options.use, opts?.use)\n\t\t}, handler);\n\t}\n\treturn createConfiguredEndpoint;\n};\n//#endregion\nexport { createEndpoint };\n\n//# sourceMappingURL=endpoint.mjs.map","import { kAPIErrorHeaderSymbol } from \"./error.mjs\";\nimport { isAPIError } from \"./utils.mjs\";\nimport { createInternalContext } from \"./context.mjs\";\n//#region src/middleware.ts\nfunction createMiddleware(optionsOrHandler, handler) {\n\tconst internalHandler = async (inputCtx) => {\n\t\tconst context = inputCtx;\n\t\tconst _handler = typeof optionsOrHandler === \"function\" ? optionsOrHandler : handler;\n\t\tconst internalContext = await createInternalContext(context, {\n\t\t\toptions: typeof optionsOrHandler === \"function\" ? {} : optionsOrHandler,\n\t\t\tpath: \"/\"\n\t\t});\n\t\tif (!_handler) throw new Error(\"handler must be defined\");\n\t\ttry {\n\t\t\tconst response = await _handler(internalContext);\n\t\t\tconst headers = internalContext.responseHeaders;\n\t\t\treturn context.returnHeaders ? {\n\t\t\t\theaders,\n\t\t\t\tresponse\n\t\t\t} : response;\n\t\t} catch (e) {\n\t\t\tif (isAPIError(e)) Object.defineProperty(e, kAPIErrorHeaderSymbol, {\n\t\t\t\tenumerable: false,\n\t\t\t\tconfigurable: true,\n\t\t\t\tget() {\n\t\t\t\t\treturn internalContext.responseHeaders;\n\t\t\t\t}\n\t\t\t});\n\t\t\tthrow e;\n\t\t}\n\t};\n\tinternalHandler.options = typeof optionsOrHandler === \"function\" ? {} : optionsOrHandler;\n\treturn internalHandler;\n}\ncreateMiddleware.create = (opts) => {\n\tfunction fn(optionsOrHandler, handler) {\n\t\tif (typeof optionsOrHandler === \"function\") return createMiddleware({ use: opts?.use }, optionsOrHandler);\n\t\tif (!handler) throw new Error(\"Middleware handler is required\");\n\t\treturn createMiddleware({\n\t\t\t...optionsOrHandler,\n\t\t\tmethod: \"*\",\n\t\t\tuse: [...opts?.use || [], ...optionsOrHandler.use || []]\n\t\t}, handler);\n\t}\n\treturn fn;\n};\n//#endregion\nexport { createMiddleware };\n\n//# sourceMappingURL=middleware.mjs.map","import { ZodObject, ZodOptional } from \"zod\";\n//#region src/openapi.ts\nconst paths = {};\nfunction getTypeFromZodType(zodType) {\n\tswitch (zodType.constructor.name) {\n\t\tcase \"ZodString\": return \"string\";\n\t\tcase \"ZodNumber\": return \"number\";\n\t\tcase \"ZodBoolean\": return \"boolean\";\n\t\tcase \"ZodObject\": return \"object\";\n\t\tcase \"ZodArray\": return \"array\";\n\t\tdefault: return \"string\";\n\t}\n}\nfunction getParameters(options) {\n\tconst parameters = [];\n\tif (options.metadata?.openapi?.parameters) {\n\t\tparameters.push(...options.metadata.openapi.parameters);\n\t\treturn parameters;\n\t}\n\tif (options.query instanceof ZodObject) Object.entries(options.query.shape).forEach(([key, value]) => {\n\t\tif (value instanceof ZodObject) parameters.push({\n\t\t\tname: key,\n\t\t\tin: \"query\",\n\t\t\tschema: {\n\t\t\t\ttype: getTypeFromZodType(value),\n\t\t\t\t...\"minLength\" in value && value.minLength ? { minLength: value.minLength } : {},\n\t\t\t\tdescription: value.description\n\t\t\t}\n\t\t});\n\t});\n\treturn parameters;\n}\nfunction getRequestBody(options) {\n\tif (options.metadata?.openapi?.requestBody) return options.metadata.openapi.requestBody;\n\tif (!options.body) return void 0;\n\tif (options.body instanceof ZodObject || options.body instanceof ZodOptional) {\n\t\tconst shape = options.body.shape;\n\t\tif (!shape) return void 0;\n\t\tconst properties = {};\n\t\tconst required = [];\n\t\tObject.entries(shape).forEach(([key, value]) => {\n\t\t\tif (value instanceof ZodObject) {\n\t\t\t\tproperties[key] = {\n\t\t\t\t\ttype: getTypeFromZodType(value),\n\t\t\t\t\tdescription: value.description\n\t\t\t\t};\n\t\t\t\tif (!(value instanceof ZodOptional)) required.push(key);\n\t\t\t}\n\t\t});\n\t\treturn {\n\t\t\trequired: options.body instanceof ZodOptional ? false : options.body ? true : false,\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties,\n\t\t\t\trequired\n\t\t\t} } }\n\t\t};\n\t}\n}\nfunction getResponse(responses) {\n\treturn {\n\t\t\"400\": {\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { message: { type: \"string\" } },\n\t\t\t\trequired: [\"message\"]\n\t\t\t} } },\n\t\t\tdescription: \"Bad Request. Usually due to missing parameters, or invalid parameters.\"\n\t\t},\n\t\t\"401\": {\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { message: { type: \"string\" } },\n\t\t\t\trequired: [\"message\"]\n\t\t\t} } },\n\t\t\tdescription: \"Unauthorized. Due to missing or invalid authentication.\"\n\t\t},\n\t\t\"403\": {\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { message: { type: \"string\" } }\n\t\t\t} } },\n\t\t\tdescription: \"Forbidden. You do not have permission to access this resource or to perform this action.\"\n\t\t},\n\t\t\"404\": {\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { message: { type: \"string\" } }\n\t\t\t} } },\n\t\t\tdescription: \"Not Found. The requested resource was not found.\"\n\t\t},\n\t\t\"429\": {\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { message: { type: \"string\" } }\n\t\t\t} } },\n\t\t\tdescription: \"Too Many Requests. You have exceeded the rate limit. Try again later.\"\n\t\t},\n\t\t\"500\": {\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { message: { type: \"string\" } }\n\t\t\t} } },\n\t\t\tdescription: \"Internal Server Error. This is a problem with the server that you cannot fix.\"\n\t\t},\n\t\t...responses\n\t};\n}\nasync function generator(endpoints, config) {\n\tconst components = { schemas: {} };\n\tObject.entries(endpoints).forEach(([_, value]) => {\n\t\tconst options = value.options;\n\t\tif (!value.path || options.metadata?.SERVER_ONLY) return;\n\t\tif (options.method === \"GET\") paths[value.path] = { get: {\n\t\t\ttags: [\"Default\", ...options.metadata?.openapi?.tags || []],\n\t\t\tdescription: options.metadata?.openapi?.description,\n\t\t\toperationId: options.metadata?.openapi?.operationId,\n\t\t\tsecurity: [{ bearerAuth: [] }],\n\t\t\tparameters: getParameters(options),\n\t\t\tresponses: getResponse(options.metadata?.openapi?.responses)\n\t\t} };\n\t\tif (options.method === \"POST\") {\n\t\t\tconst body = getRequestBody(options);\n\t\t\tpaths[value.path] = { post: {\n\t\t\t\ttags: [\"Default\", ...options.metadata?.openapi?.tags || []],\n\t\t\t\tdescription: options.metadata?.openapi?.description,\n\t\t\t\toperationId: options.metadata?.openapi?.operationId,\n\t\t\t\tsecurity: [{ bearerAuth: [] }],\n\t\t\t\tparameters: getParameters(options),\n\t\t\t\t...body ? { requestBody: body } : { requestBody: { content: { \"application/json\": { schema: {\n\t\t\t\t\ttype: \"object\",\n\t\t\t\t\tproperties: {}\n\t\t\t\t} } } } },\n\t\t\t\tresponses: getResponse(options.metadata?.openapi?.responses)\n\t\t\t} };\n\t\t}\n\t});\n\treturn {\n\t\topenapi: \"3.1.1\",\n\t\tinfo: {\n\t\t\ttitle: \"Better Auth\",\n\t\t\tdescription: \"API Reference for your Better Auth Instance\",\n\t\t\tversion: \"1.1.0\"\n\t\t},\n\t\tcomponents,\n\t\tsecurity: [{ apiKeyCookie: [] }],\n\t\tservers: [{ url: config?.url }],\n\t\ttags: [{\n\t\t\tname: \"Default\",\n\t\t\tdescription: \"Default endpoints that are included with Better Auth by default. These endpoints are not part of any plugin.\"\n\t\t}],\n\t\tpaths\n\t};\n}\nconst getHTML = (apiReference, config) => `<!doctype html>\n<html>\n  <head>\n    <title>Scalar API Reference</title>\n    <meta charset=\"utf-8\" />\n    <meta\n      name=\"viewport\"\n      content=\"width=device-width, initial-scale=1\" />\n  </head>\n  <body>\n    <script\n      id=\"api-reference\"\n      type=\"application/json\">\n    ${JSON.stringify(apiReference)}\n    <\\/script>\n\t <script>\n      var configuration = {\n\t  \tfavicon: ${config?.logo ? `data:image/svg+xml;utf8,${encodeURIComponent(config.logo)}` : void 0} ,\n\t   \ttheme: ${config?.theme || \"saturn\"},\n        metaData: {\n\t\t\ttitle: ${config?.title || \"Open API Reference\"},\n\t\t\tdescription: ${config?.description || \"Better Call Open API\"},\n\t\t}\n      }\n      document.getElementById('api-reference').dataset.configuration =\n        JSON.stringify(configuration)\n    <\\/script>\n\t  <script src=\"https://cdn.jsdelivr.net/npm/@scalar/api-reference\"><\\/script>\n  </body>\n</html>`;\n//#endregion\nexport { generator, getHTML };\n\n//# sourceMappingURL=openapi.mjs.map","const NullProtoObj = /* @__PURE__ */ (() => {\n\tconst e = function() {};\n\treturn e.prototype = Object.create(null), Object.freeze(e.prototype), e;\n})();\nfunction createRouter() {\n\treturn {\n\t\troot: { key: \"\" },\n\t\tstatic: new NullProtoObj()\n\t};\n}\nfunction scanFirstGroup(path) {\n\tlet i = 0;\n\tlet depth = 0;\n\tfor (; i < path.length; i++) {\n\t\tconst c = path.charCodeAt(i);\n\t\tif (c === 92) i++;\n\t\telse if (c === 40) depth++;\n\t\telse if (c === 41 && depth > 0) depth--;\n\t\telse if (c === 123 && depth === 0) break;\n\t}\n\tif (i >= path.length) return;\n\tlet j = i + 1;\n\tdepth = 0;\n\tfor (; j < path.length; j++) {\n\t\tconst c = path.charCodeAt(j);\n\t\tif (c === 92) j++;\n\t\telse if (c === 40) depth++;\n\t\telse if (c === 41 && depth > 0) depth--;\n\t\telse if (c === 125 && depth === 0) break;\n\t}\n\tif (j >= path.length) return;\n\tconst mod = path[j + 1];\n\tconst hasMod = mod === \"?\" || mod === \"+\" || mod === \"*\";\n\treturn [\n\t\tpath.slice(0, i),\n\t\tpath.slice(i + 1, j),\n\t\tpath.slice(j + (hasMod ? 2 : 1)),\n\t\thasMod ? mod : void 0\n\t];\n}\nfunction expandGroupDelimiters(path) {\n\tif (!path.includes(\"{\")) return;\n\tconst group = scanFirstGroup(path);\n\tif (!group) return;\n\tconst [pre, body, suf, mod] = group;\n\tif (!mod) return [pre + body + suf];\n\tif (mod === \"?\") return [pre + body + suf, pre + suf];\n\tif (body.includes(\"/\")) throw new Error(\"unsupported group repetition across segments\");\n\treturn [`${pre}(?:${body})${mod}${suf}`];\n}\nconst UNNAMED_GROUP_PREFIX = \"__rou3_unnamed_\";\nconst ESCAPED_GROUP_PREFIX = \"__rou3_esc_\";\nfunction toUnnamedGroupKey(index) {\n\treturn `${UNNAMED_GROUP_PREFIX}${index}`;\n}\nfunction toGroupName(name) {\n\treturn /^(?!__rou3_|_\\d)[A-Za-z_]\\w*$/.test(name) ? name : ESCAPED_GROUP_PREFIX + name.replace(/[_-]/g, (c) => c === \"_\" ? \"__\" : \"_h\");\n}\nfunction fromGroupName(key) {\n\tif (key.charCodeAt(0) !== 95) return key;\n\tif (key.startsWith(\"__rou3_esc_\")) return key.slice(11).replace(/__|_h/g, (c) => c === \"__\" ? \"_\" : \"-\");\n\treturn key.startsWith(\"__rou3_unnamed_\") ? key.slice(15) : key;\n}\nfunction hasSegmentWildcard(segment) {\n\tlet depth = 0;\n\tfor (let i = 0; i < segment.length; i++) {\n\t\tconst ch = segment.charCodeAt(i);\n\t\tif (ch === 92) {\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === 40) {\n\t\t\tdepth++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === 41 && depth > 0) {\n\t\t\tdepth--;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === 42 && depth === 0) return true;\n\t}\n\treturn false;\n}\nfunction replaceSegmentWildcards(segment, unnamedStart, toGroupKey = toUnnamedGroupKey) {\n\tlet depth = 0;\n\tlet nextIndex = unnamedStart;\n\tlet replaced = \"\";\n\tfor (let i = 0; i < segment.length; i++) {\n\t\tconst ch = segment.charCodeAt(i);\n\t\tif (ch === 92) {\n\t\t\treplaced += segment[i];\n\t\t\tif (i + 1 < segment.length) replaced += segment[++i];\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === 40) {\n\t\t\tdepth++;\n\t\t\treplaced += segment[i];\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === 41 && depth > 0) {\n\t\t\tdepth--;\n\t\t\treplaced += segment[i];\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === 42 && depth === 0) {\n\t\t\treplaced += `(?<${toGroupKey(nextIndex++)}>[^/]*)`;\n\t\t\tcontinue;\n\t\t}\n\t\treplaced += segment[i];\n\t}\n\treturn [replaced, nextIndex];\n}\nfunction encodeEscapes(path) {\n\tif (!path.includes(\"\\\\\")) return path;\n\treturn path.replace(/\\\\([:(){}])/g, (_, c) => \"�\" + \"ABCDE\"[\":(){}\".indexOf(c)]);\n}\nfunction segmentKey(segment) {\n\tif (segment.startsWith(\"**\")) return 2;\n\tif (segment === \"*\" || segment.includes(\":\") || segment.includes(\"(\") || hasSegmentWildcard(segment)) return 1;\n\tif (segment === \"\\\\*\") return \"*\";\n\tif (segment === \"\\\\*\\\\*\") return \"**\";\n\tif (!segment.includes(\"�\")) return segment;\n\treturn segment.replace(/\\uFFFD([A-E])/g, (_, c) => c === \"A\" ? \":\" : c === \"B\" ? \"(\" : c === \"C\" ? \")\" : c === \"D\" ? \"{\" : \"}\");\n}\nfunction expandModifiers(segments) {\n\tfor (let i = 0; i < segments.length; i++) {\n\t\tconst last = segments[i].charCodeAt(segments[i].length - 1);\n\t\tif (last !== 63 && last !== 43 && last !== 42) continue;\n\t\tconst m = segments[i].match(/^(.*:[\\w-]+(?:\\([^)]*\\))?)([?+*])$/);\n\t\tif (!m) continue;\n\t\tconst pre = segments.slice(0, i);\n\t\tconst suf = segments.slice(i + 1);\n\t\tif (m[2] === \"?\") return [\"/\" + pre.concat(m[1]).concat(suf).join(\"/\"), \"/\" + pre.concat(suf).join(\"/\")];\n\t\tconst name = m[1].match(/:([\\w-]+)/)?.[1] || \"_\";\n\t\tconst wc = \"/\" + [\n\t\t\t...pre,\n\t\t\t`**:${name}`,\n\t\t\t...suf\n\t\t].join(\"/\");\n\t\tconst without = \"/\" + [...pre, ...suf].join(\"/\");\n\t\treturn m[2] === \"+\" ? [wc] : [wc, without];\n\t}\n}\nfunction normalizePath(path) {\n\tif (!path.includes(\"/.\")) return path;\n\tconst r = [];\n\tfor (const s of path.split(\"/\")) if (s === \".\") continue;\n\telse if (s === \"..\" && r.length > 1) r.pop();\n\telse r.push(s);\n\treturn r.join(\"/\") || \"/\";\n}\nfunction splitPath(path) {\n\tconst s = path.split(\"/\");\n\ts.shift();\n\tif (s[s.length - 1] === \"\") s.pop();\n\treturn s;\n}\nfunction splitRoute(path) {\n\tconst s = splitPath(path);\n\twhile (s[s.length - 1] === \"\") s.pop();\n\treturn s;\n}\nfunction getMatchParams(segments, paramsMap) {\n\tconst params = new NullProtoObj();\n\tfor (const [index, name] of paramsMap) {\n\t\tconst segment = index < 0 ? segments.slice(-(index + 1)).join(\"/\") : segments[index];\n\t\tif (typeof name === \"string\") params[name] = segment;\n\t\telse {\n\t\t\tconst match = segment.match(name);\n\t\t\tif (match) for (const key in match.groups) params[fromGroupName(key)] = match.groups[key];\n\t\t}\n\t}\n\treturn params;\n}\nfunction addRoute(ctx, method = \"\", path, data) {\n\tmethod = method.toUpperCase();\n\tif (path.charCodeAt(0) !== 47) path = `/${path}`;\n\tconst groupExpanded = expandGroupDelimiters(path);\n\tif (groupExpanded) {\n\t\tfor (const expandedPath of groupExpanded) addRoute(ctx, method, expandedPath, data);\n\t\treturn;\n\t}\n\tpath = encodeEscapes(path);\n\tconst segments = splitRoute(path);\n\tconst expanded = expandModifiers(segments);\n\tif (expanded) {\n\t\tfor (const p of expanded) addRoute(ctx, method, p, data);\n\t\treturn;\n\t}\n\tlet node = ctx.root;\n\tlet _unnamedParamIndex = 0;\n\tconst paramsMap = [];\n\tconst paramsRegexp = [];\n\tfor (let i = 0; i < segments.length; i++) {\n\t\tlet segment = segments[i];\n\t\tconst key = segmentKey(segment);\n\t\tif (key === 2) {\n\t\t\tif (!node.wildcard) node.wildcard = { key: \"**\" };\n\t\t\tnode = node.wildcard;\n\t\t\tparamsMap.push([\n\t\t\t\t-(i + 1),\n\t\t\t\tsegment.split(\":\")[1] || \"_\",\n\t\t\t\tsegment.length === 2\n\t\t\t]);\n\t\t\tbreak;\n\t\t}\n\t\tif (key === 1) {\n\t\t\tif (!node.param) node.param = { key: \"*\" };\n\t\t\tnode = node.param;\n\t\t\tif (segment === \"*\") paramsMap.push([\n\t\t\t\ti,\n\t\t\t\tString(_unnamedParamIndex++),\n\t\t\t\ttrue\n\t\t\t]);\n\t\t\telse if (segment.includes(\"(\") || segment.includes(\":\", 1) || !/^:[\\w-]+$/.test(segment)) {\n\t\t\t\tconst [regexp, nextIndex] = getParamRegexp(segment, _unnamedParamIndex);\n\t\t\t\t_unnamedParamIndex = nextIndex;\n\t\t\t\tparamsRegexp[i] = regexp;\n\t\t\t\tnode.hasRegexParam = true;\n\t\t\t\tparamsMap.push([\n\t\t\t\t\ti,\n\t\t\t\t\tregexp,\n\t\t\t\t\tfalse\n\t\t\t\t]);\n\t\t\t} else paramsMap.push([\n\t\t\t\ti,\n\t\t\t\tsegment.slice(1),\n\t\t\t\tfalse\n\t\t\t]);\n\t\t\tcontinue;\n\t\t}\n\t\tsegment = segments[i] = key;\n\t\tconst child = node.static?.[segment];\n\t\tif (child) node = child;\n\t\telse {\n\t\t\tconst staticNode = { key: segment };\n\t\t\tif (!node.static) node.static = new NullProtoObj();\n\t\t\tnode.static[segment] = staticNode;\n\t\t\tnode = staticNode;\n\t\t}\n\t}\n\tconst hasParams = paramsMap.length > 0;\n\tconst methods = node.methods ??= new NullProtoObj();\n\t(methods[method] ??= []).push({\n\t\tdata: data || null,\n\t\tparamsRegexp,\n\t\tparamsMap: hasParams ? paramsMap : void 0\n\t});\n\tif (!hasParams) ctx.static[\"/\" + segments.join(\"/\")] = node;\n}\nfunction getParamRegexp(segment, unnamedStart = 0) {\n\tlet _i = unnamedStart;\n\tlet _s = \"\", _d = 0;\n\tfor (let j = 0; j < segment.length; j++) {\n\t\tconst c = segment.charCodeAt(j);\n\t\tif (c === 40) _d++;\n\t\telse if (c === 41 && _d > 0) _d--;\n\t\telse if (c === 92 && _d === 0 && j + 1 < segment.length) {\n\t\t\tconst n = segment[j + 1];\n\t\t\tif (n !== \":\" && n !== \"(\" && n !== \"*\" && n !== \"\\\\\") {\n\t\t\t\t_s += \"￾\" + n;\n\t\t\t\tj++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t} else if (c === 46 && _d === 0) {\n\t\t\t_s += \"\\\\.\";\n\t\t\tcontinue;\n\t\t}\n\t\t_s += segment[j];\n\t}\n\t[_s, _i] = replaceSegmentWildcards(_s, _i);\n\tconst regex = _s.replace(/:([\\w-]+)(?:\\(([^)]*)\\))?/g, (_, id, p) => `(?<${toGroupName(id)}>${p || \"[^/]+\"})`).replace(/\\((?![?<])/g, () => `(?<${toUnnamedGroupKey(_i++)}>`).replace(/\\uFFFE(.)/g, (_, c) => /[.*+?^${}()|[\\]\\\\]/.test(c) ? `\\\\${c}` : c);\n\treturn [new RegExp(`^${regex}$`), _i];\n}\nfunction findRoute(ctx, method = \"\", path, opts) {\n\tif (opts?.normalize) path = normalizePath(path);\n\tif (path.charCodeAt(path.length - 1) === 47) path = path.slice(0, -1);\n\tconst staticNode = ctx.static[path];\n\tif (staticNode && staticNode.methods) {\n\t\tconst staticMatch = staticNode.methods[method] || staticNode.methods[\"\"];\n\t\tif (staticMatch !== void 0) return staticMatch[0];\n\t}\n\tconst segments = splitPath(path);\n\tconst match = _lookupTree(ctx.root, method, segments, 0);\n\tif (match === void 0) return;\n\tif (opts?.params === false) return match;\n\treturn {\n\t\tdata: match.data,\n\t\tparams: match.paramsMap ? getMatchParams(segments, match.paramsMap) : void 0\n\t};\n}\nfunction _lookupTree(node, method, segments, index) {\n\tif (index === segments.length) {\n\t\tif (node.methods) {\n\t\t\tconst match = _selectMatcher(node.methods, method, segments, node.key === \"*\", false);\n\t\t\tif (match) return match;\n\t\t}\n\t\treturn node.param?.methods && _selectMatcher(node.param.methods, method, segments, true, true) || node.wildcard?.methods && _selectMatcher(node.wildcard.methods, method, segments, true, true) || void 0;\n\t}\n\tconst segment = segments[index];\n\tif (node.static) {\n\t\tconst staticChild = node.static[segment];\n\t\tif (staticChild) {\n\t\t\tconst match = _lookupTree(staticChild, method, segments, index + 1);\n\t\t\tif (match) return match;\n\t\t}\n\t}\n\tif (node.param) {\n\t\tconst match = _lookupTree(node.param, method, segments, index + 1);\n\t\tif (match) return match;\n\t}\n\tif (node.wildcard && node.wildcard.methods) return _selectMatcher(node.wildcard.methods, method, segments, true, false);\n}\nfunction _selectMatcher(methods, method, segments, dynamicTerminal, optionalOnly) {\n\tconst match = methods[method] || methods[\"\"];\n\tif (!match) return;\n\tconst first = match[0];\n\tif (match.length === 1 && first.paramsRegexp.length === 0) {\n\t\tif (!optionalOnly) return first;\n\t\tconst pMap = first.paramsMap;\n\t\treturn pMap?.[pMap.length - 1]?.[2] ? first : void 0;\n\t}\n\tlet best;\n\tlet bestWeight = -1;\n\tfor (const m of match) {\n\t\tconst pMap = m.paramsMap;\n\t\tconst lastOptional = pMap?.[pMap.length - 1]?.[2];\n\t\tif (optionalOnly && !lastOptional) continue;\n\t\tlet weight = dynamicTerminal && pMap && !lastOptional ? 1 : 0;\n\t\tconst regexps = m.paramsRegexp;\n\t\tfor (let i = 0; i < regexps.length; i++) if (regexps[i]) {\n\t\t\tif (!regexps[i].test(segments[i])) {\n\t\t\t\tweight = -1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tweight++;\n\t\t}\n\t\tif (weight > bestWeight) {\n\t\t\tbest = m;\n\t\t\tbestWeight = weight;\n\t\t}\n\t}\n\treturn best;\n}\nfunction removeRoute(ctx, method = \"\", path) {\n\tmethod = method.toUpperCase();\n\tif (path.charCodeAt(0) !== 47) path = `/${path}`;\n\tconst groupExpanded = expandGroupDelimiters(path);\n\tif (groupExpanded) {\n\t\tfor (const expandedPath of groupExpanded) removeRoute(ctx, method, expandedPath);\n\t\treturn;\n\t}\n\tpath = encodeEscapes(path);\n\tconst segments = splitRoute(path);\n\tconst modExpanded = expandModifiers(segments);\n\tif (modExpanded) {\n\t\tfor (const expandedPath of modExpanded) removeRoute(ctx, method, expandedPath);\n\t\treturn;\n\t}\n\t_remove(ctx.root, method, segments, 0);\n}\nfunction _remove(node, method, segments, index) {\n\tif (index === segments.length) {\n\t\tif (node.methods && method in node.methods) {\n\t\t\tdelete node.methods[method];\n\t\t\tif (Object.keys(node.methods).length === 0) node.methods = void 0;\n\t\t}\n\t\treturn;\n\t}\n\tconst segment = segments[index];\n\tconst key = segmentKey(segment);\n\tif (key === 2) {\n\t\tif (node.wildcard) {\n\t\t\t_remove(node.wildcard, method, segments, segments.length);\n\t\t\tif (_isEmptyNode(node.wildcard)) node.wildcard = void 0;\n\t\t}\n\t\treturn;\n\t}\n\tif (key === 1) {\n\t\tif (node.param) {\n\t\t\t_remove(node.param, method, segments, index + 1);\n\t\t\tif (_isEmptyNode(node.param)) node.param = void 0;\n\t\t}\n\t\treturn;\n\t}\n\tconst childNode = node.static?.[key];\n\tif (childNode) {\n\t\t_remove(childNode, method, segments, index + 1);\n\t\tif (_isEmptyNode(childNode)) {\n\t\t\tdelete node.static[key];\n\t\t\tif (Object.keys(node.static).length === 0) node.static = void 0;\n\t\t}\n\t}\n}\nfunction _isEmptyNode(node) {\n\treturn node.methods === void 0 && node.static === void 0 && node.param === void 0 && node.wildcard === void 0;\n}\nfunction findAllRoutes(ctx, method = \"\", path, opts) {\n\tif (opts?.normalize) path = normalizePath(path);\n\tif (path.charCodeAt(path.length - 1) === 47) path = path.slice(0, -1);\n\tconst segments = splitPath(path);\n\tconst matches = _findAll(ctx.root, method, segments, 0);\n\tif (opts?.params === false) return matches;\n\treturn matches.map((m) => {\n\t\treturn {\n\t\t\tdata: m.data,\n\t\t\tparams: m.paramsMap ? getMatchParams(segments, m.paramsMap) : void 0\n\t\t};\n\t});\n}\nfunction _findAll(node, method, segments, index, matches = []) {\n\tconst segment = segments[index];\n\tif (node.wildcard && node.wildcard.methods) {\n\t\tconst match = node.wildcard.methods[method] || node.wildcard.methods[\"\"];\n\t\tif (match) if (index < segments.length) pushSorted(matches, match, true);\n\t\telse {\n\t\t\tconst optional = [];\n\t\t\tfor (const m of match) {\n\t\t\t\tconst pMap = m.paramsMap;\n\t\t\t\tif (pMap?.[pMap.length - 1]?.[2]) optional.push(m);\n\t\t\t}\n\t\t\tpushSorted(matches, optional, true);\n\t\t}\n\t}\n\tif (node.param) {\n\t\tif (index < segments.length) {\n\t\t\tconst start = matches.length;\n\t\t\t_findAll(node.param, method, segments, index + 1, matches);\n\t\t\tif (node.param.hasRegexParam) {\n\t\t\t\tfor (let r = matches.length - 1; r >= start; r--) if (matches[r].paramsRegexp[index]?.test(segment) === false) matches.splice(r, 1);\n\t\t\t}\n\t\t} else if (node.param.methods) {\n\t\t\tconst match = node.param.methods[method] || node.param.methods[\"\"];\n\t\t\tif (match) {\n\t\t\t\tconst optional = [];\n\t\t\t\tfor (const m of match) {\n\t\t\t\t\tconst pMap = m.paramsMap;\n\t\t\t\t\tif (pMap?.[pMap.length - 1]?.[2]) optional.push(m);\n\t\t\t\t}\n\t\t\t\tpushSorted(matches, optional, true);\n\t\t\t}\n\t\t}\n\t}\n\tif (index < segments.length) {\n\t\tconst staticChild = node.static?.[segment];\n\t\tif (staticChild) _findAll(staticChild, method, segments, index + 1, matches);\n\t}\n\tif (index === segments.length && node.methods) {\n\t\tconst match = node.methods[method] || node.methods[\"\"];\n\t\tif (match) pushSorted(matches, match, node.key === \"*\");\n\t}\n\treturn matches;\n}\nfunction pushSorted(matches, match, dynamicTerminal) {\n\tif (match.length > 1) match = match.map((m) => {\n\t\tlet w = 0;\n\t\tconst { paramsRegexp: rx, paramsMap: pm } = m;\n\t\tfor (let i = 0; i < rx.length; i++) if (rx[i]) w++;\n\t\tif (dynamicTerminal && pm && !pm[pm.length - 1][2]) w++;\n\t\treturn [m, w];\n\t}).sort((a, b) => a[1] - b[1]).map((e) => e[0]);\n\tfor (const m of match) matches.push(m);\n}\nfunction shapeSubsumes(a, b) {\n\tconst fa = a.fixed.length;\n\tconst fb = b.fixed.length;\n\tif (fa + a.tailMin > fb + b.tailMin || fa + a.tailMax < fb + b.tailMax) return false;\n\tconst common = fa < fb ? fa : fb;\n\tfor (let k = 0; k < common; k++) if (!_segmentSubsumes(a.fixed[k], b.fixed[k])) return false;\n\tfor (let k = fb; k < fa; k++) if (a.fixed[k] !== void 0) return false;\n\treturn true;\n}\nfunction mergeShapes(shapes) {\n\tfor (let i = 0; i < shapes.length; i++) for (let j = i + 1; j < shapes.length; j++) {\n\t\tconst a = shapes[i];\n\t\tconst b = shapes[j];\n\t\tif (_sameFixed(a.fixed, b.fixed) && a.tailMin <= b.tailMax + 1 && b.tailMin <= a.tailMax + 1) {\n\t\t\ta.tailMin = Math.min(a.tailMin, b.tailMin);\n\t\t\ta.tailMax = Math.max(a.tailMax, b.tailMax);\n\t\t\tshapes.splice(j, 1);\n\t\t\tj = i;\n\t\t}\n\t}\n\treturn shapes;\n}\nfunction _sameFixed(a, b) {\n\tif (a.length !== b.length) return false;\n\tfor (let k = 0; k < a.length; k++) if (!_segmentEqual(a[k], b[k])) return false;\n\treturn true;\n}\nfunction _segmentEqual(x, y) {\n\treturn x === y || x instanceof RegExp && y instanceof RegExp && x.flags === y.flags && _regExpKey(x) === _regExpKey(y);\n}\nfunction _segmentSubsumes(x, y) {\n\tif (x === void 0) return true;\n\tif (typeof x === \"string\") return x === y;\n\tif (typeof y === \"string\") return x.test(y);\n\treturn y instanceof RegExp && x.flags === y.flags && _regExpKey(x) === _regExpKey(y);\n}\nconst _regExpKeys = /* @__PURE__ */ new WeakMap();\nfunction _regExpKey(r) {\n\tlet key = _regExpKeys.get(r);\n\tif (key === void 0) {\n\t\tconst s = r.source;\n\t\tkey = \"\";\n\t\tfor (let i = 0; i < s.length; i++) {\n\t\t\tconst c = s[i];\n\t\t\tif (c === \"\\\\\") key += c + s[++i];\n\t\t\telse if (c === \"[\") {\n\t\t\t\tlet j = i + 1;\n\t\t\t\twhile (j < s.length && s[j] !== \"]\") j += s[j] === \"\\\\\" ? 2 : 1;\n\t\t\t\tkey += s.slice(i, j + 1);\n\t\t\t\ti = j;\n\t\t\t} else if (c === \"(\" && s[i + 1] === \"?\" && s[i + 2] === \"<\" && s[i + 3] !== \"=\" && s[i + 3] !== \"!\") {\n\t\t\t\tconst end = s.indexOf(\">\", i + 3);\n\t\t\t\tkey += \"(\";\n\t\t\t\ti = end === -1 ? i : end;\n\t\t\t} else key += c;\n\t\t}\n\t\t_regExpKeys.set(r, key);\n\t}\n\treturn key;\n}\nfunction routeToShapes(pattern) {\n\tlet shapes = _patternShapes.get(pattern);\n\tif (shapes === void 0) {\n\t\tconst ctx = createRouter();\n\t\taddRoute(ctx, \"\", pattern);\n\t\tshapes = [];\n\t\t_collectShapes(ctx.root, [], shapes);\n\t\tshapes = mergeShapes(shapes);\n\t\tif (_patternShapes.size >= 1024) _patternShapes.clear();\n\t\t_patternShapes.set(pattern, shapes);\n\t}\n\treturn shapes;\n}\nfunction shapeOf(edges, entry) {\n\tlet shape = _shapeCache.get(entry);\n\tif (!shape) _shapeCache.set(entry, shape = _computeShape(edges, entry));\n\treturn shape;\n}\nfunction shapesOverlap(a, b) {\n\tconst fa = a.fixed.length;\n\tconst fb = b.fixed.length;\n\tconst common = fa < fb ? fa : fb;\n\tfor (let k = 0; k < common; k++) if (!_segmentsCanOverlap(a.fixed[k], b.fixed[k])) return false;\n\treturn Math.max(fa + a.tailMin, fb + b.tailMin) <= Math.min(fa + a.tailMax, fb + b.tailMax);\n}\nfunction mayMatchAt(query, depth, key) {\n\tfor (const q of query) if (depth < q.fixed.length) {\n\t\tconst m = q.fixed[depth];\n\t\tif (m === void 0 || (typeof m === \"string\" ? m === key : m.test(key))) return true;\n\t} else if (depth - q.fixed.length < q.tailMax) return true;\n\treturn false;\n}\nconst _shapeCache = /* @__PURE__ */ new WeakMap();\nconst _patternShapes = /* @__PURE__ */ new Map();\nfunction _collectShapes(node, edges, shapes) {\n\tif (node.methods) for (const entry of node.methods[\"\"] || []) shapes.push(_computeShape(edges, entry));\n\tif (node.static) for (const key in node.static) {\n\t\tedges.push(key);\n\t\t_collectShapes(node.static[key], edges, shapes);\n\t\tedges.pop();\n\t}\n\tif (node.param) {\n\t\tedges.push(0);\n\t\t_collectShapes(node.param, edges, shapes);\n\t\tedges.pop();\n\t}\n\tif (node.wildcard) {\n\t\tedges.push(1);\n\t\t_collectShapes(node.wildcard, edges, shapes);\n\t\tedges.pop();\n\t}\n}\nfunction _computeShape(edges, entry) {\n\tconst fixed = [];\n\tlet tailMin = 0;\n\tlet tailMax = 0;\n\tconst pMap = entry.paramsMap;\n\tfor (let d = 0; d < edges.length; d++) {\n\t\tconst edge = edges[d];\n\t\tif (typeof edge === \"string\") fixed.push(edge);\n\t\telse if (edge === 1) {\n\t\t\ttailMin = pMap[pMap.length - 1][2] ? 0 : 1;\n\t\t\ttailMax = Number.POSITIVE_INFINITY;\n\t\t} else if (pMap) {\n\t\t\tconst p = pMap.find((e) => e[0] === d);\n\t\t\tif (p[1] instanceof RegExp) fixed.push(p[1]);\n\t\t\telse if (p[2] && d === edges.length - 1) tailMax = 1;\n\t\t\telse fixed.push(void 0);\n\t\t}\n\t}\n\tlet f = fixed.length;\n\twhile (f > 0 && fixed[f - 1] === void 0) f--;\n\tif (f < fixed.length) {\n\t\ttailMin += fixed.length - f;\n\t\ttailMax += fixed.length - f;\n\t\tfixed.length = f;\n\t}\n\treturn {\n\t\tfixed,\n\t\ttailMin,\n\t\ttailMax\n\t};\n}\nfunction _segmentsCanOverlap(x, y) {\n\tif (typeof x === \"string\") return typeof y === \"string\" ? x === y : y instanceof RegExp ? y.test(x) : true;\n\tif (x instanceof RegExp && typeof y === \"string\") return x.test(y);\n\treturn true;\n}\nfunction routesOverlap(patternA, patternB) {\n\treturn _anyOverlap(routeToShapes(patternA), routeToShapes(patternB));\n}\nfunction compareRoutes(patternA, patternB) {\n\tconst a = routeToShapes(patternA);\n\tconst b = routeToShapes(patternB);\n\tconst aCoversB = _covers(a, b);\n\tconst bCoversA = _covers(b, a);\n\tif (aCoversB && bCoversA) return \"equal\";\n\tif (aCoversB) return \"superset\";\n\tif (bCoversA) return \"subset\";\n\treturn _anyOverlap(a, b) ? \"partial\" : \"disjoint\";\n}\nfunction findOverlappingRoutes(ctx, method = \"\", pattern) {\n\tconst query = routeToShapes(pattern);\n\tconst matches = [];\n\t_collectOverlaps(ctx.root, method, query, [], /* @__PURE__ */ new Set(), matches);\n\treturn matches;\n}\nfunction _anyOverlap(a, b) {\n\tfor (const x of a) for (const y of b) if (shapesOverlap(x, y)) return true;\n\treturn false;\n}\nfunction _covers(sup, sub) {\n\treturn sub.every((s) => sup.some((x) => shapeSubsumes(x, s)));\n}\nfunction _collectOverlaps(node, method, query, edges, seen, matches) {\n\tif (node.wildcard) {\n\t\tedges.push(1);\n\t\t_collectOverlaps(node.wildcard, method, query, edges, seen, matches);\n\t\tedges.pop();\n\t}\n\tif (node.param) {\n\t\tedges.push(0);\n\t\t_collectOverlaps(node.param, method, query, edges, seen, matches);\n\t\tedges.pop();\n\t}\n\tif (node.static) {\n\t\tfor (const key in node.static) if (mayMatchAt(query, edges.length, key)) {\n\t\t\tedges.push(key);\n\t\t\t_collectOverlaps(node.static[key], method, query, edges, seen, matches);\n\t\t\tedges.pop();\n\t\t}\n\t}\n\tif (node.methods) {\n\t\tconst data = node.methods[method] || node.methods[\"\"];\n\t\tif (data) for (const entry of data) {\n\t\t\tconst d = entry.data;\n\t\t\tconst isRef = d !== null && (typeof d === \"object\" || typeof d === \"function\");\n\t\t\tif (isRef && seen.has(d)) continue;\n\t\t\tconst shape = shapeOf(edges, entry);\n\t\t\tif (query.some((q) => shapesOverlap(q, shape))) {\n\t\t\t\tif (isRef) seen.add(d);\n\t\t\t\tmatches.push({ data: d });\n\t\t\t}\n\t\t}\n\t}\n}\nfunction routeNodeKeys(pattern) {\n\tlet keys = _patternKeys.get(pattern);\n\tif (keys === void 0) {\n\t\tconst ctx = createRouter();\n\t\taddRoute(ctx, \"\", pattern);\n\t\tkeys = [];\n\t\t_collectKeys(ctx.root, \"\", keys);\n\t\tif (_patternKeys.size >= 1024) _patternKeys.clear();\n\t\t_patternKeys.set(pattern, keys);\n\t}\n\treturn keys.slice();\n}\nconst _patternKeys = /* @__PURE__ */ new Map();\nfunction _collectKeys(node, prefix, keys) {\n\tif (node.methods) keys.push(prefix || \"/\");\n\tif (node.static) for (const key in node.static) _collectKeys(node.static[key], prefix + \"/\" + _escapeKey(key), keys);\n\tif (node.param) _collectKeys(node.param, prefix + \"/*\", keys);\n\tif (node.wildcard) _collectKeys(node.wildcard, prefix + \"/**\", keys);\n}\nfunction _escapeKey(key) {\n\tif (key === \"*\") return \"\\\\*\";\n\tif (key === \"**\") return \"\\\\*\\\\*\";\n\treturn key.replace(/[:(){}]/g, \"\\\\$&\");\n}\nconst _P = \"￾\";\nfunction replaceEscapesOutsideGroups(segment) {\n\tlet r = \"\", d = 0;\n\tfor (let i = 0; i < segment.length; i++) {\n\t\tconst c = segment.charCodeAt(i);\n\t\tif (c === 40) d++;\n\t\telse if (c === 41 && d > 0) d--;\n\t\telse if (c === 92 && d === 0 && i + 1 < segment.length) {\n\t\t\tconst n = segment[i + 1];\n\t\t\tif (n !== \":\" && n !== \"(\" && n !== \"*\" && n !== \"\\\\\") {\n\t\t\t\tr += _P + n;\n\t\t\t\ti++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\t\tr += segment[i];\n\t}\n\treturn r;\n}\nfunction resolveEscapePlaceholders(str) {\n\treturn str.replace(/\\uFFFE(.)/g, (_, c) => /[.*+?^${}()|[\\]\\\\]/.test(c) ? `\\\\${c}` : c);\n}\nfunction escapeBareDots(str) {\n\tlet r = \"\", d = 0;\n\tfor (let i = 0; i < str.length; i++) {\n\t\tconst c = str.charCodeAt(i);\n\t\tif (c === 92 || c === 65534) {\n\t\t\tr += str[i] + (str[i + 1] || \"\");\n\t\t\ti++;\n\t\t} else if (c === 40) {\n\t\t\td++;\n\t\t\tr += str[i];\n\t\t} else if (c === 41) {\n\t\t\tif (d > 0) d--;\n\t\t\tr += str[i];\n\t\t} else if (c === 46 && d === 0) r += \"\\\\.\";\n\t\telse r += str[i];\n\t}\n\treturn r;\n}\nfunction routeToRegExp(route = \"/\") {\n\tif (route.charCodeAt(0) !== 47) route = `/${route}`;\n\tconst inlineOptional = inlineOptionalGroup(route);\n\tif (inlineOptional) return inlineOptional;\n\tconst groupExpanded = expandGroupDelimiters(route);\n\tif (groupExpanded) {\n\t\tconst sources = groupExpanded.map((expandedRoute) => routeToRegExp(expandedRoute).source.slice(1, -1));\n\t\treturn new RegExp(`^(?:${sources.join(\"|\")})$`);\n\t}\n\treturn _routeToRegExp(route);\n}\nfunction inlineOptionalGroup(route) {\n\tconst group = scanFirstGroup(route);\n\tif (!group) return;\n\tconst [pre, body, suf, mod] = group;\n\tif (mod !== \"?\" || suf !== \"\" || body === \"\" || scanFirstGroup(pre) || scanFirstGroup(body)) return;\n\tconst baseSegs = routeToRegExpSegments(pre);\n\tconst fullSegs = routeToRegExpSegments(pre + body);\n\tconst baseLen = baseSegs.length;\n\tif (baseLen === 0 || fullSegs.length < baseLen) return;\n\tconst midSegment = fullSegs.length === baseLen;\n\tconst sharedLen = midSegment ? baseLen - 1 : baseLen;\n\tfor (let i = 0; i < sharedLen; i++) if (fullSegs[i] !== baseSegs[i]) return;\n\tif (midSegment) {\n\t\tconst prefix = baseSegs[baseLen - 1];\n\t\tconst last = fullSegs[baseLen - 1];\n\t\tif (!last.startsWith(prefix)) return;\n\t\tif (/(?:\\[\\^\\/\\]|\\.)[*+]\\)?$/.test(prefix)) return;\n\t\tconst k = prefix.length;\n\t\tconst inlineSegs = fullSegs.slice(0, baseLen - 1);\n\t\tinlineSegs.push(`${last.slice(0, k)}(?:${last.slice(k)})?`);\n\t\treturn new RegExp(`^/${inlineSegs.join(\"/\")}/?$`);\n\t}\n\tconst head = fullSegs.slice(0, baseLen).join(\"/\");\n\tconst tail = fullSegs.slice(baseLen).join(\"/\");\n\treturn new RegExp(`^/${head}(?:/${tail})?/?$`);\n}\nfunction _routeToRegExp(route) {\n\treturn new RegExp(`^/${routeToRegExpSegments(route).join(\"/\")}/?$`);\n}\nfunction routeToRegExpSegments(route) {\n\tconst reSegments = [];\n\tlet idCtr = 0;\n\tfor (const segment of splitRoute(route)) {\n\t\tif (!segment) {\n\t\t\treSegments.push(\"\");\n\t\t\tcontinue;\n\t\t}\n\t\tif (segment === \"*\") reSegments.push(`(?<${toRegExpUnnamedKey(idCtr++)}>[^/]*)`);\n\t\telse if (segment.startsWith(\"**\")) reSegments.push(segment === \"**\" ? \"?(?<_>.*)\" : `?(?<${toGroupName(segment.slice(3))}>.+)`);\n\t\telse if (segment.includes(\":\") || /(^|[^\\\\])\\(/.test(segment) || hasSegmentWildcard(segment)) {\n\t\t\tconst modMatch = segment.match(/^(.*:[\\w-]+(?:\\([^)]*\\))?)([?+*])$/);\n\t\t\tif (modMatch) {\n\t\t\t\tconst [, base, mod] = modMatch;\n\t\t\t\tconst name = toGroupName(base.match(/:([\\w-]+)/)?.[1] || `_${idCtr++}`);\n\t\t\t\tif (mod === \"?\") {\n\t\t\t\t\tconst inner = escapeBareDots(base.replace(/:([\\w-]+)(?:\\(([^)]*)\\))?/g, (_, id, pattern) => `(?<${toGroupName(id)}>${pattern || \"[^/]+\"})`));\n\t\t\t\t\tif (reSegments.length > 0) {\n\t\t\t\t\t\tconst prevQ = reSegments.pop();\n\t\t\t\t\t\treSegments.push(`${prevQ}(?:/${inner})?`);\n\t\t\t\t\t} else reSegments.push(`?${inner}?`);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst pattern = base.match(/:([\\w-]+)(?:\\(([^)]*)\\))?/)?.[2];\n\t\t\t\tif (reSegments.length > 0) {\n\t\t\t\t\tconst prevMod = reSegments.pop();\n\t\t\t\t\tif (pattern) {\n\t\t\t\t\t\tconst repeated = `${pattern}(?:/${pattern})*`;\n\t\t\t\t\t\treSegments.push(mod === \"+\" ? `${prevMod}/(?<${name}>${repeated})` : `${prevMod}(?:/(?<${name}>${repeated}))?`);\n\t\t\t\t\t} else reSegments.push(mod === \"+\" ? `${prevMod}/(?<${name}>.+)` : `${prevMod}(?:/(?<${name}>.*))?`);\n\t\t\t\t} else if (pattern) {\n\t\t\t\t\tconst repeated = `${pattern}(?:/${pattern})*`;\n\t\t\t\t\treSegments.push(mod === \"+\" ? `?(?<${name}>${repeated})` : `?(?<${name}>${repeated})?`);\n\t\t\t\t} else reSegments.push(mod === \"+\" ? `?(?<${name}>.+)` : `?(?<${name}>.*)`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tlet dynamicSegment = replaceEscapesOutsideGroups(segment);\n\t\t\t[dynamicSegment, idCtr] = replaceSegmentWildcards(dynamicSegment, idCtr, toRegExpUnnamedKey);\n\t\t\treSegments.push(resolveEscapePlaceholders(escapeBareDots(dynamicSegment.replace(/:([\\w-]+)(?:\\(([^)]*)\\))?/g, (_, id, pattern) => `(?<${toGroupName(id)}>${pattern || \"[^/]+\"})`).replace(/(^|[^\\\\])\\((?![?<])/g, (_, p) => `${p}(?<${toRegExpUnnamedKey(idCtr++)}>`))));\n\t\t} else reSegments.push(segment.replace(/\\\\(.)/g, \"$1\").replace(/[.*+?^${}()|[\\]]/g, \"\\\\$&\"));\n\t}\n\treturn reSegments;\n}\nfunction toRegExpUnnamedKey(index) {\n\treturn `_${index}`;\n}\nconst ROUTE_SPECIAL = /* @__PURE__ */ new Set([\n\t\":\",\n\t\"(\",\n\t\")\",\n\t\"{\",\n\t\"}\",\n\t\"*\",\n\t\"\\\\\",\n\t\"?\",\n\t\"+\",\n\t\"|\",\n\t\"^\",\n\t\"$\",\n\t\"[\",\n\t\"]\"\n]);\nfunction regExpToRoute(regexp) {\n\tif (typeof regexp !== \"string\" && /[ims]/.test(regexp.flags)) throw new Error(`rou3: cannot represent regexp flag(s) \"${regexp.flags}\" as a route`);\n\tlet src = typeof regexp === \"string\" ? regexp : regexp.source;\n\tif (src.startsWith(\"^\")) src = src.slice(1);\n\tif (src.endsWith(\"$\")) src = src.slice(0, -1);\n\tif (src.endsWith(\"\\\\/?\")) src = src.slice(0, -3);\n\tif (src === \"\" || src === \"\\\\/\") return \"/\";\n\tconst segments = [];\n\tconst n = src.length;\n\tlet i = 0;\n\twhile (i < n) {\n\t\tif (src.startsWith(\"(?:\", i)) {\n\t\t\tconst end = readGroup(src, i);\n\t\t\tif (src[end] !== \"?\") throw new Error(`rou3: unsupported non-optional group in \"${src}\"`);\n\t\t\tapplyOptional(segments, src.slice(i + 3, end - 1));\n\t\t\ti = end + 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (src.startsWith(\"\\\\/?\", i)) {\n\t\t\tconst g = matchNamedGroup(src, i + 3);\n\t\t\tif (g && g.end === n && (g.body === \".*\" || g.body === \".+\")) {\n\t\t\t\tsegments.push(g.name === \"_\" ? \"**\" : `**:${g.name}`);\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tif (src.startsWith(\"\\\\/\", i)) {\n\t\t\tconst end = segmentEnd(src, i + 2);\n\t\t\tsegments.push(reverseSegment(src.slice(i + 2, end)));\n\t\t\ti = end;\n\t\t\tcontinue;\n\t\t}\n\t\tthrow new Error(`rou3: cannot parse \"${src}\" at index ${i}`);\n\t}\n\treturn \"/\" + segments.join(\"/\");\n}\nfunction reverseSegment(seg) {\n\tconst whole = matchNamedGroup(seg, 0);\n\tif (whole && whole.end === seg.length) {\n\t\tif (whole.body === \".+\") return `:${whole.name}+`;\n\t\tconst rep = matchRepeat(whole.body);\n\t\tif (rep) return `:${whole.name}${constraint(rep)}+`;\n\t}\n\tlet out = \"\";\n\tlet i = 0;\n\twhile (i < seg.length) {\n\t\tconst c = seg[i];\n\t\tif (c === \"(\") {\n\t\t\tconst g = matchNamedGroup(seg, i);\n\t\t\tif (g) {\n\t\t\t\tout += paramToken(g.name, g.body);\n\t\t\t\ti = g.end;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!seg.startsWith(\"(?\", i)) {\n\t\t\t\tconst end = readGroup(seg, i);\n\t\t\t\tout += paramToken(\"_0\", seg.slice(i + 1, end - 1));\n\t\t\t\ti = end;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`rou3: unsupported group construct in \"${seg}\"`);\n\t\t}\n\t\tif (c === \"\\\\\") {\n\t\t\tconst next = seg[i + 1];\n\t\t\tif (next === void 0) throw new Error(`rou3: dangling escape in \"${seg}\"`);\n\t\t\tif (/[a-z0-9]/i.test(next)) throw new Error(`rou3: unsupported escape \"\\\\${next}\" in \"${seg}\"`);\n\t\t\tout += escapeLiteral(next);\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (BARE_META.has(c)) throw new Error(`rou3: unsupported metacharacter \"${c}\" in \"${seg}\"`);\n\t\tout += escapeLiteral(c);\n\t\ti += 1;\n\t}\n\treturn out;\n}\nconst BARE_META = /* @__PURE__ */ new Set([\n\t\".\",\n\t\"^\",\n\t\"$\",\n\t\"*\",\n\t\"+\",\n\t\"?\",\n\t\"|\",\n\t\"[\",\n\t\"]\",\n\t\"{\",\n\t\"}\",\n\t\")\"\n]);\nfunction applyOptional(segments, inner) {\n\tif (inner.startsWith(\"\\\\/\")) {\n\t\tconst rest = inner.slice(2);\n\t\tconst g = matchNamedGroup(rest, 0);\n\t\tif (g && g.end === rest.length) {\n\t\t\tsegments.push(optionalParam(g.name, g.body));\n\t\t\treturn;\n\t\t}\n\t\tmergeGroup(segments, `/${reverseSegment(rest)}`);\n\t\treturn;\n\t}\n\tmergeGroup(segments, reverseSegment(inner));\n}\nfunction mergeGroup(segments, body) {\n\tif (segments.length === 0) throw new Error(`rou3: optional group \"{${body}}?\" has no preceding segment`);\n\tsegments[segments.length - 1] += `{${body}}?`;\n}\nfunction paramToken(name, body) {\n\tconst unnamed = /^_\\d+$/.test(name);\n\tif (unnamed && body === \"[^/]*\") return \"*\";\n\tif (!unnamed && body === \"[^/]+\") return `:${name}`;\n\treturn unnamed ? constraint(body) : `:${name}${constraint(body)}`;\n}\nfunction optionalParam(name, body) {\n\tif (body === \"[^/]+\") return `:${name}?`;\n\tif (body === \".*\") return `:${name}*`;\n\tconst rep = matchRepeat(body);\n\tif (rep) return `:${name}${constraint(rep)}*`;\n\treturn `:${name}${constraint(body)}?`;\n}\nfunction matchRepeat(body) {\n\tconst m = body.match(/^(.+)\\(\\?:\\\\\\/(.+)\\)\\*$/);\n\treturn m && m[1] === m[2] ? m[1] : void 0;\n}\nfunction constraint(body) {\n\tif (body.includes(\"/\")) throw new Error(`rou3: param constraint \"(${body})\" cannot contain \"/\"`);\n\treturn `(${body})`;\n}\nfunction escapeLiteral(ch) {\n\treturn ROUTE_SPECIAL.has(ch) ? `\\\\${ch}` : ch;\n}\nfunction matchNamedGroup(src, start) {\n\tif (!src.startsWith(\"(?<\", start)) return;\n\tconst after = src[start + 3];\n\tif (after === \"=\" || after === \"!\") return;\n\tconst gt = src.indexOf(\">\", start);\n\tif (gt === -1) return;\n\tconst end = readGroup(src, start);\n\treturn {\n\t\tname: fromGroupName(src.slice(start + 3, gt)),\n\t\tbody: src.slice(gt + 1, end - 1),\n\t\tend\n\t};\n}\nfunction readGroup(src, start) {\n\tlet depth = 0;\n\tlet inClass = false;\n\tfor (let i = start; i < src.length; i++) {\n\t\tconst c = src[i];\n\t\tif (inClass) {\n\t\t\tif (c === \"\\\\\") i++;\n\t\t\telse if (c === \"]\") inClass = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"\\\\\") i++;\n\t\telse if (c === \"[\") inClass = true;\n\t\telse if (c === \"(\") depth++;\n\t\telse if (c === \")\" && --depth === 0) return i + 1;\n\t}\n\tthrow new Error(`rou3: unbalanced group in \"${src}\"`);\n}\nfunction segmentEnd(src, start) {\n\tlet depth = 0;\n\tlet inClass = false;\n\tlet i = start;\n\twhile (i < src.length) {\n\t\tif (inClass) {\n\t\t\tif (src[i] === \"\\\\\") i++;\n\t\t\telse if (src[i] === \"]\") inClass = false;\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (depth === 0 && (src.startsWith(\"\\\\/\", i) || src.startsWith(\"(?:\", i))) break;\n\t\tconst c = src[i];\n\t\tif (c === \"\\\\\") i += 2;\n\t\telse if (c === \"[\") {\n\t\t\tinClass = true;\n\t\t\ti++;\n\t\t} else {\n\t\t\tif (c === \"(\") depth++;\n\t\t\telse if (c === \")\") depth--;\n\t\t\ti++;\n\t\t}\n\t}\n\treturn i;\n}\nexport { NullProtoObj, addRoute, compareRoutes, createRouter, findAllRoutes, findOverlappingRoutes, findRoute, regExpToRoute, removeRoute, routeNodeKeys, routeToRegExp, routesOverlap };\n","import { getBody, isAPIError, isRequest } from \"./utils.mjs\";\nimport { toResponse } from \"./to-response.mjs\";\nimport { createEndpoint } from \"./endpoint.mjs\";\nimport { generator, getHTML } from \"./openapi.mjs\";\nimport { addRoute, createRouter, findAllRoutes, findRoute } from \"rou3\";\n//#region src/router.ts\nconst createRouter$1 = (endpoints, config) => {\n\tif (!config?.openapi?.disabled) {\n\t\tconst openapi = {\n\t\t\tpath: \"/api/reference\",\n\t\t\t...config?.openapi\n\t\t};\n\t\tendpoints[\"openapi\"] = createEndpoint(openapi.path, { method: \"GET\" }, async (c) => {\n\t\t\tconst schema = await generator(endpoints);\n\t\t\treturn new Response(getHTML(schema, openapi.scalar), { headers: { \"Content-Type\": \"text/html\" } });\n\t\t});\n\t}\n\tconst router = createRouter();\n\tconst middlewareRouter = createRouter();\n\tfor (const endpoint of Object.values(endpoints)) {\n\t\tif (!endpoint.options || !endpoint.path) continue;\n\t\tif (endpoint.options?.metadata?.SERVER_ONLY) continue;\n\t\tconst methods = Array.isArray(endpoint.options?.method) ? endpoint.options.method : [endpoint.options?.method];\n\t\tfor (const method of methods) addRoute(router, method, endpoint.path, endpoint);\n\t}\n\tif (config?.routerMiddleware?.length) for (const { path, middleware } of config.routerMiddleware) addRoute(middlewareRouter, \"*\", path, middleware);\n\tconst basePath = config?.basePath && config.basePath !== \"/\" ? config.basePath.replace(/\\/+$/, \"\") : \"\";\n\tconst processRequest = async (request) => {\n\t\tconst url = new URL(request.url);\n\t\tconst pathname = url.pathname;\n\t\tlet path;\n\t\tif (basePath) {\n\t\t\tif (!pathname.startsWith(`${basePath}/`)) return new Response(null, {\n\t\t\t\tstatus: 404,\n\t\t\t\tstatusText: \"Not Found\"\n\t\t\t});\n\t\t\tpath = pathname.slice(basePath.length);\n\t\t} else path = pathname;\n\t\tif (path.length === 0 || /\\/{2,}/.test(path)) return new Response(null, {\n\t\t\tstatus: 404,\n\t\t\tstatusText: \"Not Found\"\n\t\t});\n\t\tconst route = findRoute(router, request.method, path);\n\t\tif (path.endsWith(\"/\") !== route?.data?.path?.endsWith(\"/\") && !config?.skipTrailingSlashes) return new Response(null, {\n\t\t\tstatus: 404,\n\t\t\tstatusText: \"Not Found\"\n\t\t});\n\t\tif (!route?.data) return new Response(null, {\n\t\t\tstatus: 404,\n\t\t\tstatusText: \"Not Found\"\n\t\t});\n\t\tconst query = {};\n\t\turl.searchParams.forEach((value, key) => {\n\t\t\tif (key in query) if (Array.isArray(query[key])) query[key].push(value);\n\t\t\telse query[key] = [query[key], value];\n\t\t\telse query[key] = value;\n\t\t});\n\t\tconst handler = route.data;\n\t\ttry {\n\t\t\tconst allowedMediaTypes = handler.options.metadata?.allowedMediaTypes || config?.allowedMediaTypes;\n\t\t\tconst context = {\n\t\t\t\tpath,\n\t\t\t\tmethod: request.method,\n\t\t\t\theaders: request.headers,\n\t\t\t\tparams: route.params ? { ...route.params } : {},\n\t\t\t\trequest,\n\t\t\t\tbody: handler.options.disableBody ? void 0 : await getBody(handler.options.cloneRequest ? request.clone() : request, allowedMediaTypes),\n\t\t\t\tquery,\n\t\t\t\t_flag: \"router\",\n\t\t\t\tasResponse: true,\n\t\t\t\tcontext: config?.routerContext\n\t\t\t};\n\t\t\tconst middlewareRoutes = findAllRoutes(middlewareRouter, \"*\", path);\n\t\t\tif (middlewareRoutes?.length) for (const { data: middleware, params } of middlewareRoutes) {\n\t\t\t\tconst res = await middleware({\n\t\t\t\t\t...context,\n\t\t\t\t\tparams: params ? { ...params } : {},\n\t\t\t\t\tasResponse: false\n\t\t\t\t});\n\t\t\t\tif (res instanceof Response) return res;\n\t\t\t}\n\t\t\treturn await handler(context);\n\t\t} catch (error) {\n\t\t\tif (config?.onError) try {\n\t\t\t\tconst errorResponse = await config.onError(error, request);\n\t\t\t\tif (errorResponse instanceof Response) return toResponse(errorResponse);\n\t\t\t} catch (error) {\n\t\t\t\tif (isAPIError(error)) return toResponse(error);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (config?.throwError) throw error;\n\t\t\tif (isAPIError(error)) return toResponse(error);\n\t\t\tconsole.error(`# SERVER_ERROR: `, error);\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 500,\n\t\t\t\tstatusText: \"Internal Server Error\"\n\t\t\t});\n\t\t}\n\t};\n\treturn {\n\t\thandler: async (request) => {\n\t\t\tconst onReq = await config?.onRequest?.(request);\n\t\t\tif (onReq instanceof Response) return onReq;\n\t\t\tconst req = isRequest(onReq) ? onReq : request;\n\t\t\tconst res = await processRequest(req);\n\t\t\tconst onRes = await config?.onResponse?.(res, req);\n\t\t\tif (onRes instanceof Response) return onRes;\n\t\t\treturn res;\n\t\t},\n\t\tendpoints\n\t};\n};\n//#endregion\nexport { createRouter$1 as createRouter };\n\n//# sourceMappingURL=router.mjs.map","//#region src/utils/error-codes.ts\nfunction defineErrorCodes(codes) {\n\treturn Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {\n\t\tcode: key,\n\t\tmessage: value,\n\t\ttoString: () => key\n\t}]));\n}\n//#endregion\nexport { defineErrorCodes };\n","import { defineErrorCodes } from \"../utils/error-codes.mjs\";\n//#region src/error/codes.ts\nconst BASE_ERROR_CODES = defineErrorCodes({\n\tUSER_NOT_FOUND: \"User not found\",\n\tFAILED_TO_CREATE_USER: \"Failed to create user\",\n\tFAILED_TO_CREATE_SESSION: \"Failed to create session\",\n\tFAILED_TO_UPDATE_USER: \"Failed to update user\",\n\tFAILED_TO_GET_SESSION: \"Failed to get session\",\n\tINVALID_PASSWORD: \"Invalid password\",\n\tINVALID_EMAIL: \"Invalid email\",\n\tINVALID_EMAIL_OR_PASSWORD: \"Invalid email or password\",\n\tINVALID_USER: \"Invalid user\",\n\tSOCIAL_ACCOUNT_ALREADY_LINKED: \"Social account already linked\",\n\tPROVIDER_NOT_FOUND: \"Provider not found\",\n\tINVALID_TOKEN: \"Invalid token\",\n\tTOKEN_EXPIRED: \"Token expired\",\n\tID_TOKEN_NOT_SUPPORTED: \"id_token not supported\",\n\tFAILED_TO_GET_USER_INFO: \"Failed to get user info\",\n\tUSER_EMAIL_NOT_FOUND: \"User email not found\",\n\tEMAIL_NOT_VERIFIED: \"Email not verified\",\n\tPASSWORD_TOO_SHORT: \"Password too short\",\n\tPASSWORD_TOO_LONG: \"Password too long\",\n\tUSER_ALREADY_EXISTS: \"User already exists.\",\n\tUSER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: \"User already exists. Use another email.\",\n\tEMAIL_CAN_NOT_BE_UPDATED: \"Email can not be updated\",\n\tCHANGE_EMAIL_DISABLED: \"Change email is disabled\",\n\tCREDENTIAL_ACCOUNT_NOT_FOUND: \"Credential account not found\",\n\tSESSION_EXPIRED: \"Session expired. Re-authenticate to perform this action.\",\n\tFAILED_TO_UNLINK_LAST_ACCOUNT: \"You can't unlink your last account\",\n\tACCOUNT_NOT_FOUND: \"Account not found\",\n\tUSER_ALREADY_HAS_PASSWORD: \"User already has a password. Provide that to delete the account.\",\n\tCROSS_SITE_NAVIGATION_LOGIN_BLOCKED: \"Cross-site navigation login blocked. This request appears to be a CSRF attack.\",\n\tVERIFICATION_EMAIL_NOT_ENABLED: \"Verification email isn't enabled\",\n\tEMAIL_ALREADY_VERIFIED: \"Email is already verified\",\n\tEMAIL_MISMATCH: \"Email mismatch\",\n\tSESSION_NOT_FRESH: \"Session is not fresh\",\n\tLINKED_ACCOUNT_ALREADY_EXISTS: \"Linked account already exists\",\n\tINVALID_ORIGIN: \"Invalid origin\",\n\tINVALID_CALLBACK_URL: \"Invalid callbackURL\",\n\tINVALID_REDIRECT_URL: \"Invalid redirectURL\",\n\tINVALID_ERROR_CALLBACK_URL: \"Invalid errorCallbackURL\",\n\tINVALID_NEW_USER_CALLBACK_URL: \"Invalid newUserCallbackURL\",\n\tMISSING_OR_NULL_ORIGIN: \"Missing or null Origin\",\n\tCALLBACK_URL_REQUIRED: \"callbackURL is required\",\n\tFAILED_TO_CREATE_VERIFICATION: \"Unable to create verification\",\n\tFIELD_NOT_ALLOWED: \"Field not allowed to be set\",\n\tASYNC_VALIDATION_NOT_SUPPORTED: \"Async validation is not supported\",\n\tVALIDATION_ERROR: \"Validation Error\",\n\tMISSING_FIELD: \"Field is required\",\n\tMETHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED: \"POST method requires deferSessionRefresh to be enabled in session config\",\n\tBODY_MUST_BE_AN_OBJECT: \"Body must be an object\",\n\tPASSWORD_ALREADY_SET: \"User already has a password set\"\n});\n//#endregion\nexport { BASE_ERROR_CODES };\n","import { base64Url } from \"@better-auth/utils/base64\";\n//#region src/oauth2/utils.ts\n/**\n* Parse a provider's `scope` token-response field into a string array.\n*\n* RFC 6749 Section 3.3 defines `scope` as a space-delimited string, but\n* providers vary: some return an already-split array. Accept both forms and\n* drop empty or non-string entries.\n*\n* @see https://github.com/better-auth/better-auth/issues/9076\n*/\nfunction parseScopeField(scope) {\n\tif (Array.isArray(scope)) return scope.map((s) => typeof s === \"string\" ? s.trim() : \"\").filter(Boolean);\n\tif (typeof scope === \"string\") return scope.trim().split(/\\s+/).filter(Boolean);\n\treturn [];\n}\nfunction getOAuth2Tokens(data) {\n\tconst getDate = (seconds) => {\n\t\treturn new Date((/* @__PURE__ */ new Date()).getTime() + seconds * 1e3);\n\t};\n\treturn {\n\t\ttokenType: data.token_type,\n\t\taccessToken: data.access_token,\n\t\trefreshToken: data.refresh_token,\n\t\taccessTokenExpiresAt: data.expires_in ? getDate(data.expires_in) : void 0,\n\t\trefreshTokenExpiresAt: data.refresh_token_expires_in ? getDate(data.refresh_token_expires_in) : void 0,\n\t\tscopes: parseScopeField(data.scope),\n\t\tidToken: data.id_token,\n\t\traw: data\n\t};\n}\n/**\n* Fill in `accessTokenExpiresAt` from the provider's configured\n* `accessTokenExpiresIn` when the token response omitted `expires_in`. Without a\n* known expiry, `getAccessToken` cannot tell the token is expired and never\n* refreshes it. No-op when the provider already supplied an expiry or no\n* fallback is configured.\n*/\nfunction applyDefaultAccessTokenExpiry(tokens, accessTokenExpiresIn) {\n\tif (!tokens.accessTokenExpiresAt && accessTokenExpiresIn) tokens.accessTokenExpiresAt = new Date(Date.now() + accessTokenExpiresIn * 1e3);\n\treturn tokens;\n}\n/**\n* Compute the union of stored and incoming OAuth scopes, preserving\n* stored insertion order and dropping duplicates.\n*/\nfunction mergeScopes(stored, incoming) {\n\tconst existing = stored ? stored.split(\",\").map((scope) => scope.trim()).filter(Boolean) : [];\n\tconst next = (incoming ?? []).map((scope) => scope.trim()).filter(Boolean);\n\treturn [...new Set([...existing, ...next])].join(\",\");\n}\n/**\n* Return the provider's primary Client ID: the single string, or the entry at\n* array index 0 for the cross-platform form used by ID token audience\n* verification. Index 0 is the designated primary and pairs with\n* `clientSecret` for the authorization code flow; later array entries are\n* only used as additional accepted audiences. Returns `undefined` when the\n* primary value is missing or an empty string.\n*/\nfunction getPrimaryClientId(clientId) {\n\tconst value = Array.isArray(clientId) ? clientId[0] : clientId;\n\treturn typeof value === \"string\" && value.length > 0 ? value : void 0;\n}\nasync function generateCodeChallenge(codeVerifier) {\n\tconst data = new TextEncoder().encode(codeVerifier);\n\tconst hash = await crypto.subtle.digest(\"SHA-256\", data);\n\treturn base64Url.encode(new Uint8Array(hash), { padding: false });\n}\n//#endregion\nexport { applyDefaultAccessTokenExpiry, generateCodeChallenge, getOAuth2Tokens, getPrimaryClientId, mergeScopes, parseScopeField };\n","import { base64 } from \"@better-auth/utils/base64\";\n//#region src/oauth2/basic-credentials.ts\nconst BASIC_AUTHORIZATION_PATTERN = /^Basic +(.*)$/i;\n/**\n* Encodes a value using `application/x-www-form-urlencoded` per the URL\n* Living Standard. Differs from `encodeURIComponent` in two ways: it escapes\n* `!`, `'`, `(`, and `)`, and it represents space as `+` rather than `%20`.\n* `*` is left unescaped, matching the URL Standard's percent-encode set.\n*/\nfunction formUrlEncode(value) {\n\treturn new URLSearchParams({ v: value }).toString().slice(2);\n}\n/**\n* Inverse of `formUrlEncode`: decodes a single `application/x-www-form-urlencoded`\n* value, handling both `+` and `%20` as space.\n*/\nfunction formUrlDecode(value) {\n\tconst decoded = new URLSearchParams(`v=${value}`).get(\"v\");\n\tif (decoded === null) throw new Error(\"form-url-encoded value could not be decoded\");\n\treturn decoded;\n}\n/**\n* Encodes an OAuth client id and secret as an HTTP Basic credential string.\n*\n* Follows RFC 6749 §2.3.1: both values are `application/x-www-form-urlencoded`\n* prior to base64 encoding. The returned string is the full value of the\n* `Authorization` header, including the `Basic ` prefix.\n*/\nfunction encodeBasicCredentials(clientId, clientSecret) {\n\tconst payload = `${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`;\n\treturn `Basic ${base64.encode(payload)}`;\n}\n/**\n* Decodes an `Authorization: Basic …` header value into its OAuth client id\n* and secret.\n*\n* Scheme matching is case-insensitive and tolerates one or more spaces\n* between the scheme and credentials per RFC 7235 §2.1. The base64 payload\n* is split on the first `:` only, so secrets containing colons round-trip\n* correctly. Each half is form-url-decoded per RFC 6749 §2.3.1, accepting\n* both `+` and `%20` as space. Per the URL Living Standard, invalid\n* percent-escapes pass through as-is; downstream client lookup will fail\n* with `invalid_client` for malformed credentials.\n*\n* Throws when the header is not a Basic credential, when the base64 payload\n* contains no `:`, or when either half is empty.\n*/\nfunction decodeBasicCredentials(authorization) {\n\tconst match = authorization.match(BASIC_AUTHORIZATION_PATTERN);\n\tif (!match) throw new Error(\"Authorization header is not a Basic credential\");\n\tconst encoded = match[1] ?? \"\";\n\tconst decoded = new TextDecoder().decode(base64.decode(encoded));\n\tconst separatorIndex = decoded.indexOf(\":\");\n\tif (separatorIndex === -1) throw new Error(\"Basic credential is missing the client id/secret separator\");\n\tconst rawClientId = decoded.slice(0, separatorIndex);\n\tconst rawClientSecret = decoded.slice(separatorIndex + 1);\n\tif (!rawClientId || !rawClientSecret) throw new Error(\"Basic credential client id and secret must both be non-empty\");\n\treturn {\n\t\tclientId: formUrlDecode(rawClientId),\n\t\tclientSecret: formUrlDecode(rawClientSecret)\n\t};\n}\n//#endregion\nexport { decodeBasicCredentials, encodeBasicCredentials };\n","import { SignJWT, importJWK, importPKCS8 } from \"jose\";\n//#region src/oauth2/client-assertion.ts\n/** Asymmetric signing algorithms compatible with private_key_jwt (RFC 7523). */\nconst PRIVATE_KEY_JWT_SIGNING_ALGORITHMS = [\n\t\"RS256\",\n\t\"RS384\",\n\t\"RS512\",\n\t\"PS256\",\n\t\"PS384\",\n\t\"PS512\",\n\t\"ES256\",\n\t\"ES384\",\n\t\"ES512\",\n\t\"EdDSA\"\n];\nfunction assertSupportedPrivateKeyJwtAlgorithm(candidate) {\n\tif (!PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.includes(candidate)) throw new Error(`Unsupported private_key_jwt signing algorithm: ${candidate}. Use one of ${PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.join(\", \")}.`);\n}\n/**\n* Validates `private_key_jwt` options eagerly and returns the algorithm to\n* use for signing.\n*\n* Asserts that key material is configured, that any explicit `algorithm` is\n* supported, that any JWK-embedded `alg` is supported, and that the two\n* agree when both are set.\n*/\nfunction resolveValidPrivateKeyJwtOptions(options) {\n\tif (!options.privateKeyJwk && !options.privateKeyPem) throw new Error(\"private_key_jwt requires either privateKeyJwk or privateKeyPem\");\n\tif (options.algorithm) assertSupportedPrivateKeyJwtAlgorithm(options.algorithm);\n\tconst jwkAlg = options.privateKeyJwk?.alg;\n\tif (typeof jwkAlg === \"string\") assertSupportedPrivateKeyJwtAlgorithm(jwkAlg);\n\tif (options.algorithm && typeof jwkAlg === \"string\" && options.algorithm !== jwkAlg) throw new Error(`JWK alg \"${jwkAlg}\" does not match configured algorithm \"${options.algorithm}\". Remove the JWK alg field, or pass an algorithm that matches the JWK.`);\n\treturn options.algorithm ?? (typeof jwkAlg === \"string\" ? jwkAlg : \"RS256\");\n}\nconst CLIENT_ASSERTION_TYPE = \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\";\n/**\n* Signs an RFC 7523 client assertion JWT for `private_key_jwt` authentication.\n*\n* The JWT contains these claims:\n*\n* - iss=clientId\n* - sub=clientId\n* - aud=tokenEndpoint\n* - exp=now + 120s\n* - jti=unique\n* - iat=now\n*/\nasync function signPrivateKeyJwtClientAssertion({ clientId, tokenEndpoint, privateKeyJwk, privateKeyPem, kid, algorithm, expiresIn = 120 }) {\n\tconst resolvedAlg = resolveValidPrivateKeyJwtOptions({\n\t\tprivateKeyJwk,\n\t\tprivateKeyPem,\n\t\talgorithm\n\t});\n\tconst resolvedKid = kid ?? privateKeyJwk?.kid;\n\tconst key = privateKeyJwk ? await importJWK(privateKeyJwk, resolvedAlg) : await importPKCS8(privateKeyPem, resolvedAlg);\n\tconst now = Math.floor(Date.now() / 1e3);\n\tconst jti = crypto.randomUUID();\n\tconst header = {\n\t\talg: resolvedAlg,\n\t\ttyp: \"JWT\"\n\t};\n\tif (resolvedKid) header.kid = resolvedKid;\n\treturn new SignJWT({}).setProtectedHeader(header).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setIssuedAt(now).setExpirationTime(now + expiresIn).setJti(jti).sign(key);\n}\n/**\n* Creates a client assertion getter for `private_key_jwt` authentication.\n*\n* Validates options eagerly (key material, supported algorithm, JWK alg\n* agreement) so misconfiguration surfaces at construction rather than on the\n* first token request. The returned function signs a fresh RFC 7523 JWT\n* assertion for every token endpoint request.\n*/\nfunction createPrivateKeyJwtClientAssertionGetter(options) {\n\tresolveValidPrivateKeyJwtOptions({\n\t\tprivateKeyJwk: options.privateKeyJwk,\n\t\tprivateKeyPem: options.privateKeyPem,\n\t\talgorithm: options.algorithm\n\t});\n\treturn ({ clientId, tokenEndpoint }) => signPrivateKeyJwtClientAssertion({\n\t\tclientId,\n\t\ttokenEndpoint,\n\t\tprivateKeyJwk: options.privateKeyJwk,\n\t\tprivateKeyPem: options.privateKeyPem,\n\t\tkid: options.kid,\n\t\talgorithm: options.algorithm,\n\t\texpiresIn: options.expiresIn\n\t});\n}\n/**\n* Resolves a client assertion getter into `client_assertion` + `client_assertion_type` params for injection into a token request body.\n*/\nasync function resolveClientAssertionParams({ getClientAssertion, context }) {\n\treturn {\n\t\tclient_assertion: await getClientAssertion(context),\n\t\tclient_assertion_type: CLIENT_ASSERTION_TYPE\n\t};\n}\n//#endregion\nexport { CLIENT_ASSERTION_TYPE, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, createPrivateKeyJwtClientAssertionGetter, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion };\n","//#region src/error.ts\nvar BetterFetchError = class extends Error {\n\tconstructor(status, statusText, error) {\n\t\tsuper(statusText || status.toString(), { cause: error });\n\t\tthis.status = status;\n\t\tthis.statusText = statusText;\n\t\tthis.error = error;\n\t\tError.captureStackTrace(this, this.constructor);\n\t}\n};\n//#endregion\n//#region src/plugins.ts\nconst initializePlugins = async (url, options) => {\n\tlet opts = options || {};\n\tconst hooks = {\n\t\tonRequest: [options === null || options === void 0 ? void 0 : options.onRequest],\n\t\tonResponse: [options === null || options === void 0 ? void 0 : options.onResponse],\n\t\tonSuccess: [options === null || options === void 0 ? void 0 : options.onSuccess],\n\t\tonError: [options === null || options === void 0 ? void 0 : options.onError],\n\t\tonRetry: [options === null || options === void 0 ? void 0 : options.onRetry]\n\t};\n\tif (!options || !(options === null || options === void 0 ? void 0 : options.plugins)) return {\n\t\turl,\n\t\toptions: opts,\n\t\thooks\n\t};\n\tfor (const plugin of (options === null || options === void 0 ? void 0 : options.plugins) || []) {\n\t\tvar _plugin$hooks, _plugin$hooks2, _plugin$hooks3, _plugin$hooks4, _plugin$hooks5;\n\t\tif (plugin.init) {\n\t\t\tvar _plugin$init;\n\t\t\tconst pluginRes = await ((_plugin$init = plugin.init) === null || _plugin$init === void 0 ? void 0 : _plugin$init.call(plugin, url.toString(), opts));\n\t\t\topts = pluginRes.options || opts;\n\t\t\turl = pluginRes.url;\n\t\t}\n\t\thooks.onRequest.push((_plugin$hooks = plugin.hooks) === null || _plugin$hooks === void 0 ? void 0 : _plugin$hooks.onRequest);\n\t\thooks.onResponse.push((_plugin$hooks2 = plugin.hooks) === null || _plugin$hooks2 === void 0 ? void 0 : _plugin$hooks2.onResponse);\n\t\thooks.onSuccess.push((_plugin$hooks3 = plugin.hooks) === null || _plugin$hooks3 === void 0 ? void 0 : _plugin$hooks3.onSuccess);\n\t\thooks.onError.push((_plugin$hooks4 = plugin.hooks) === null || _plugin$hooks4 === void 0 ? void 0 : _plugin$hooks4.onError);\n\t\thooks.onRetry.push((_plugin$hooks5 = plugin.hooks) === null || _plugin$hooks5 === void 0 ? void 0 : _plugin$hooks5.onRetry);\n\t}\n\treturn {\n\t\turl,\n\t\toptions: opts,\n\t\thooks\n\t};\n};\n//#endregion\n//#region src/retry.ts\nvar LinearRetryStrategy = class {\n\tconstructor(options) {\n\t\tthis.options = options;\n\t}\n\tshouldAttemptRetry(attempt, response) {\n\t\tif (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));\n\t\treturn Promise.resolve(attempt < this.options.attempts);\n\t}\n\tgetDelay() {\n\t\treturn this.options.delay;\n\t}\n};\nvar ExponentialRetryStrategy = class {\n\tconstructor(options) {\n\t\tthis.options = options;\n\t}\n\tshouldAttemptRetry(attempt, response) {\n\t\tif (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));\n\t\treturn Promise.resolve(attempt < this.options.attempts);\n\t}\n\tgetDelay(attempt) {\n\t\treturn Math.min(this.options.maxDelay, this.options.baseDelay * 2 ** attempt);\n\t}\n};\nfunction createRetryStrategy(options) {\n\tif (typeof options === \"number\") return new LinearRetryStrategy({\n\t\ttype: \"linear\",\n\t\tattempts: options,\n\t\tdelay: 1e3\n\t});\n\tswitch (options.type) {\n\t\tcase \"linear\": return new LinearRetryStrategy(options);\n\t\tcase \"exponential\": return new ExponentialRetryStrategy(options);\n\t\tdefault: throw new Error(\"Invalid retry strategy\");\n\t}\n}\n//#endregion\n//#region src/create-fetch/schema.ts\nconst methods = [\n\t\"get\",\n\t\"post\",\n\t\"put\",\n\t\"patch\",\n\t\"delete\"\n];\nconst createSchema = (schema, config) => {\n\treturn {\n\t\tschema,\n\t\tconfig\n\t};\n};\n//#endregion\n//#region src/method.ts\nfunction parseMethodModifier(path) {\n\tif (!path.startsWith(\"@\")) return {\n\t\tmethod: void 0,\n\t\tpath\n\t};\n\tconst separator = path.indexOf(\"/\");\n\tconst method = path.slice(1, separator === -1 ? void 0 : separator);\n\tif (!methods.includes(method)) return {\n\t\tmethod: void 0,\n\t\tpath\n\t};\n\treturn {\n\t\tmethod,\n\t\tpath: separator === -1 ? path : path.slice(separator + 1)\n\t};\n}\n//#endregion\n//#region src/url.ts\nconst isReservedPathSegment = (value) => value === \".\" || value === \"..\";\nconst encodeLiteralPathSegment = (segment) => segment.split(\":\").map((part) => encodeURIComponent(part)).join(\":\");\nfunction resolvePathSegment(segment, pathParams) {\n\tconst pathParam = pathParams.get(segment);\n\tif (pathParam === void 0) return encodeLiteralPathSegment(segment);\n\tif (isReservedPathSegment(pathParam)) throw new TypeError(\"Path parameters cannot be reserved path segments\");\n\treturn encodeURIComponent(pathParam);\n}\n/**\n* Normalize URL\n*/\nfunction getURL$1(url, option) {\n\tconst { baseURL, params, query } = option || {\n\t\tquery: {},\n\t\tparams: {},\n\t\tbaseURL: \"\"\n\t};\n\tlet basePath = url.startsWith(\"http\") ? url.split(\"/\").slice(0, 3).join(\"/\") : baseURL || \"\";\n\tconst { path: requestPath } = parseMethodModifier(url);\n\tif (requestPath !== url) url = `/${requestPath}`;\n\tif (!basePath.endsWith(\"/\")) basePath += \"/\";\n\tlet [path, urlQuery] = url.replace(basePath, \"\").split(\"?\");\n\tconst queryParams = new URLSearchParams(urlQuery);\n\tfor (const [key, value] of Object.entries(query || {})) {\n\t\tif (value == null) continue;\n\t\tlet serializedValue;\n\t\tif (typeof value === \"string\") serializedValue = value;\n\t\telse if (Array.isArray(value)) {\n\t\t\tfor (const val of value) queryParams.append(key, val);\n\t\t\tcontinue;\n\t\t} else serializedValue = JSON.stringify(value);\n\t\tqueryParams.set(key, serializedValue);\n\t}\n\tconst pathParams = /* @__PURE__ */ new Map();\n\tif (params) if (Array.isArray(params)) {\n\t\tconst paramPaths = path.split(\"/\").filter((p) => p.startsWith(\":\"));\n\t\tfor (const [index, key] of paramPaths.entries()) {\n\t\t\tconst value = params[index];\n\t\t\tpathParams.set(key, String(value));\n\t\t}\n\t} else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));\n\tpath = path.split(\"/\").map((segment) => resolvePathSegment(segment, pathParams)).join(\"/\");\n\tpath = path.replace(/^\\/+/, \"\");\n\tlet queryParamString = queryParams.toString();\n\tqueryParamString = queryParamString.length > 0 ? `?${queryParamString}`.replace(/\\+/g, \"%20\") : \"\";\n\tif (!basePath.startsWith(\"http\")) return `${basePath}${path}${queryParamString}`;\n\treturn new URL(`${path}${queryParamString}`, basePath);\n}\n//#endregion\n//#region src/auth.ts\nconst getAuthHeader = async (options) => {\n\tconst headers = {};\n\tconst getValue = async (value) => typeof value === \"function\" ? await value() : value;\n\tif (options === null || options === void 0 ? void 0 : options.auth) {\n\t\tif (options.auth.type === \"Bearer\") {\n\t\t\tconst token = await getValue(options.auth.token);\n\t\t\tif (!token) return headers;\n\t\t\theaders[\"authorization\"] = `Bearer ${token}`;\n\t\t} else if (options.auth.type === \"Basic\") {\n\t\t\tconst [username, password] = await Promise.all([getValue(options.auth.username), getValue(options.auth.password)]);\n\t\t\tif (!username || !password) return headers;\n\t\t\theaders[\"authorization\"] = `Basic ${btoa(`${username}:${password}`)}`;\n\t\t} else if (options.auth.type === \"Custom\") {\n\t\t\tconst [prefix, value] = await Promise.all([getValue(options.auth.prefix), getValue(options.auth.value)]);\n\t\t\tif (!value) return headers;\n\t\t\theaders[\"authorization\"] = `${prefix !== null && prefix !== void 0 ? prefix : \"\"} ${value}`;\n\t\t}\n\t}\n\treturn headers;\n};\n//#endregion\n//#region src/utils.ts\nconst JSON_RE = /^application\\/(?:[\\w!#$%&*.^`~-]*\\+)?json(;.+)?$/i;\nfunction detectResponseType(request) {\n\tconst _contentType = request.headers.get(\"content-type\");\n\tconst textTypes = /* @__PURE__ */ new Set([\n\t\t\"image/svg\",\n\t\t\"application/xml\",\n\t\t\"application/xhtml\",\n\t\t\"application/html\"\n\t]);\n\tif (!_contentType) return \"json\";\n\tconst contentType = _contentType.split(\";\").shift() || \"\";\n\tif (JSON_RE.test(contentType)) return \"json\";\n\tif (textTypes.has(contentType) || contentType.startsWith(\"text/\")) return \"text\";\n\treturn \"blob\";\n}\nfunction isJSONParsable(value) {\n\ttry {\n\t\tJSON.parse(value);\n\t\treturn true;\n\t} catch (error) {\n\t\treturn false;\n\t}\n}\nfunction isJSONSerializable(value) {\n\tif (value === void 0) return false;\n\tconst t = typeof value;\n\tif (t === \"string\" || t === \"number\" || t === \"boolean\" || t === null) return true;\n\tif (t !== \"object\") return false;\n\tif (Array.isArray(value)) return true;\n\tif (value.buffer) return false;\n\treturn value.constructor && value.constructor.name === \"Object\" || typeof value.toJSON === \"function\";\n}\nfunction jsonParse(text) {\n\ttry {\n\t\treturn JSON.parse(text);\n\t} catch (error) {\n\t\treturn text;\n\t}\n}\nfunction isFunction(value) {\n\treturn typeof value === \"function\";\n}\nfunction getFetch(options) {\n\tif (options === null || options === void 0 ? void 0 : options.customFetchImpl) return options.customFetchImpl;\n\tif (typeof globalThis !== \"undefined\" && isFunction(globalThis.fetch)) return globalThis.fetch;\n\tif (typeof window !== \"undefined\" && isFunction(window.fetch)) return window.fetch;\n\tthrow new Error(\"No fetch implementation found\");\n}\nfunction isPayloadMethod(method) {\n\tif (!method) return false;\n\treturn [\n\t\t\"POST\",\n\t\t\"PUT\",\n\t\t\"PATCH\",\n\t\t\"DELETE\"\n\t].includes(method.toUpperCase());\n}\nfunction isRouteMethod(method) {\n\tconst routeMethod = [\n\t\t\"GET\",\n\t\t\"POST\",\n\t\t\"PUT\",\n\t\t\"PATCH\",\n\t\t\"DELETE\"\n\t];\n\tif (!method) return false;\n\treturn routeMethod.includes(method.toUpperCase());\n}\nfunction mergeHeaders(...sources) {\n\tconst merged = {};\n\tfor (const source of sources) {\n\t\tif (!source) continue;\n\t\tif (source instanceof Headers) source.forEach((value, key) => {\n\t\t\tmerged[key] = value;\n\t\t});\n\t\telse {\n\t\t\tconst entries = Array.isArray(source) ? source : Object.entries(source);\n\t\t\tfor (const [key, value] of entries) if (value !== null && value !== void 0) merged[key] = value;\n\t\t}\n\t}\n\treturn merged;\n}\nasync function getHeaders(opts) {\n\tconst headers = new Headers(mergeHeaders(opts === null || opts === void 0 ? void 0 : opts.headers, await getAuthHeader(opts)));\n\tif (!headers.has(\"content-type\")) {\n\t\tconst contentType = detectContentType(opts === null || opts === void 0 ? void 0 : opts.body);\n\t\tif (contentType) headers.set(\"content-type\", contentType);\n\t}\n\treturn headers;\n}\nfunction getURL(url, options) {\n\tconst { path } = parseMethodModifier(url);\n\tif (path !== url) url = `/${path}`;\n\tlet _url;\n\ttry {\n\t\tif (url.startsWith(\"http\")) _url = url;\n\t\telse {\n\t\t\tlet baseURL = options === null || options === void 0 ? void 0 : options.baseURL;\n\t\t\tif (baseURL && !(baseURL === null || baseURL === void 0 ? void 0 : baseURL.endsWith(\"/\"))) baseURL = baseURL + \"/\";\n\t\t\tif (url.startsWith(\"/\")) _url = new URL(url.substring(1), baseURL);\n\t\t\telse _url = new URL(url, options === null || options === void 0 ? void 0 : options.baseURL);\n\t\t}\n\t} catch (e) {\n\t\tif (e instanceof TypeError) {\n\t\t\tif (!(options === null || options === void 0 ? void 0 : options.baseURL)) throw TypeError(`Invalid URL ${url}. Are you passing in a relative url but not setting the baseURL?`);\n\t\t\tthrow TypeError(`Invalid URL ${url}. Please validate that you are passing the correct input.`);\n\t\t}\n\t\tthrow e;\n\t}\n\t/**\n\t* Dynamic Parameters.\n\t*/\n\tif (options === null || options === void 0 ? void 0 : options.params) if (Array.isArray(options === null || options === void 0 ? void 0 : options.params)) {\n\t\tconst params = (options === null || options === void 0 ? void 0 : options.params) ? Array.isArray(options.params) ? `/${options.params.join(\"/\")}` : `/${Object.values(options.params).join(\"/\")}` : \"\";\n\t\t_url = _url.toString().split(\"/:\")[0];\n\t\t_url = `${_url.toString()}${params}`;\n\t} else for (const [key, value] of Object.entries(options === null || options === void 0 ? void 0 : options.params)) _url = _url.toString().replace(`:${key}`, String(value));\n\tconst __url = new URL(_url);\n\t/**\n\t* Query Parameters\n\t*/\n\tconst queryParams = options === null || options === void 0 ? void 0 : options.query;\n\tif (queryParams) for (const [key, value] of Object.entries(queryParams)) __url.searchParams.append(key, String(value));\n\treturn __url;\n}\nfunction detectContentType(body) {\n\tif (isJSONSerializable(body)) return \"application/json\";\n\treturn null;\n}\nfunction getMediaType(headers) {\n\tconst contentType = headers.get(\"content-type\");\n\treturn contentType ? contentType.split(\";\")[0].trim().toLowerCase() : null;\n}\nfunction getBody(options, headers) {\n\tconst { body } = options;\n\tif (!body) return null;\n\tif (!isJSONSerializable(body)) return body;\n\tif (typeof body === \"string\") return body;\n\tif (getMediaType(headers) === \"application/x-www-form-urlencoded\") return new URLSearchParams(body).toString();\n\treturn JSON.stringify(body);\n}\nfunction getMethod(url, options) {\n\tif (options === null || options === void 0 ? void 0 : options.method) return options.method.toUpperCase();\n\tconst { method } = parseMethodModifier(url);\n\tif (method) return method.toUpperCase();\n\treturn (options === null || options === void 0 ? void 0 : options.body) ? \"POST\" : \"GET\";\n}\nfunction getTimeout(options, controller) {\n\tlet abortTimeout;\n\tif (!(options === null || options === void 0 ? void 0 : options.signal) && (options === null || options === void 0 ? void 0 : options.timeout)) abortTimeout = setTimeout(() => controller === null || controller === void 0 ? void 0 : controller.abort(), options === null || options === void 0 ? void 0 : options.timeout);\n\treturn {\n\t\tabortTimeout,\n\t\tclearTimeout: () => {\n\t\t\tif (abortTimeout) clearTimeout(abortTimeout);\n\t\t}\n\t};\n}\nfunction bodyParser(data, responseType) {\n\tif (responseType === \"json\") return JSON.parse(data);\n\treturn data;\n}\nvar ValidationError = class ValidationError extends Error {\n\tconstructor(issues, message) {\n\t\tsuper(message || JSON.stringify(issues, null, 2));\n\t\tthis.issues = issues;\n\t\tObject.setPrototypeOf(this, ValidationError.prototype);\n\t}\n};\nasync function parseStandardSchema(schema, input) {\n\tconst result = await schema[\"~standard\"].validate(input);\n\tif (result.issues) throw new ValidationError(result.issues);\n\treturn result.value;\n}\n//#endregion\n//#region \\0@oxc-project+runtime@0.140.0/helpers/esm/typeof.js\nfunction _typeof(o) {\n\t\"@babel/helpers - typeof\";\n\treturn _typeof = \"function\" == typeof Symbol && \"symbol\" == typeof Symbol.iterator ? function(o) {\n\t\treturn typeof o;\n\t} : function(o) {\n\t\treturn o && \"function\" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? \"symbol\" : typeof o;\n\t}, _typeof(o);\n}\n//#endregion\n//#region \\0@oxc-project+runtime@0.140.0/helpers/esm/toPrimitive.js\nfunction toPrimitive(t, r) {\n\tif (\"object\" != _typeof(t) || !t) return t;\n\tvar e = t[Symbol.toPrimitive];\n\tif (void 0 !== e) {\n\t\tvar i = e.call(t, r || \"default\");\n\t\tif (\"object\" != _typeof(i)) return i;\n\t\tthrow new TypeError(\"@@toPrimitive must return a primitive value.\");\n\t}\n\treturn (\"string\" === r ? String : Number)(t);\n}\n//#endregion\n//#region \\0@oxc-project+runtime@0.140.0/helpers/esm/toPropertyKey.js\nfunction toPropertyKey(t) {\n\tvar i = toPrimitive(t, \"string\");\n\treturn \"symbol\" == _typeof(i) ? i : i + \"\";\n}\n//#endregion\n//#region \\0@oxc-project+runtime@0.140.0/helpers/esm/defineProperty.js\nfunction _defineProperty(e, r, t) {\n\treturn (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {\n\t\tvalue: t,\n\t\tenumerable: !0,\n\t\tconfigurable: !0,\n\t\twritable: !0\n\t}) : e[r] = t, e;\n}\n//#endregion\n//#region \\0@oxc-project+runtime@0.140.0/helpers/esm/objectSpread2.js\nfunction ownKeys(e, r) {\n\tvar t = Object.keys(e);\n\tif (Object.getOwnPropertySymbols) {\n\t\tvar o = Object.getOwnPropertySymbols(e);\n\t\tr && (o = o.filter(function(r) {\n\t\t\treturn Object.getOwnPropertyDescriptor(e, r).enumerable;\n\t\t})), t.push.apply(t, o);\n\t}\n\treturn t;\n}\nfunction _objectSpread2(e) {\n\tfor (var r = 1; r < arguments.length; r++) {\n\t\tvar t = null != arguments[r] ? arguments[r] : {};\n\t\tr % 2 ? ownKeys(Object(t), !0).forEach(function(r) {\n\t\t\t_defineProperty(e, r, t[r]);\n\t\t}) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function(r) {\n\t\t\tObject.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r));\n\t\t});\n\t}\n\treturn e;\n}\n//#endregion\n//#region src/fetch.ts\nconst betterFetch = async (url, options) => {\n\tvar _opts$signal, _options$body, _options$jsonParser;\n\tconst { hooks, url: __url, options: opts } = await initializePlugins(url, options);\n\tconst fetch = getFetch(opts);\n\tconst controller = new AbortController();\n\tconst signal = (_opts$signal = opts.signal) !== null && _opts$signal !== void 0 ? _opts$signal : controller.signal;\n\tconst _url = getURL$1(__url, opts);\n\tconst headers = await getHeaders(opts);\n\tconst body = getBody(opts, headers);\n\tconst method = getMethod(__url, opts);\n\tconst context = _objectSpread2(_objectSpread2({}, opts), {}, {\n\t\turl: _url,\n\t\theaders,\n\t\tbody,\n\t\tmethod,\n\t\tsignal\n\t});\n\t/**\n\t* Run all on request hooks\n\t*/\n\tfor (const onRequest of hooks.onRequest) if (onRequest) {\n\t\tconst res = await onRequest(context);\n\t\tif (typeof res === \"object\" && res !== null) Object.assign(context, res);\n\t}\n\tif (\"pipeTo\" in context && typeof context.pipeTo === \"function\" || typeof (options === null || options === void 0 || (_options$body = options.body) === null || _options$body === void 0 ? void 0 : _options$body.pipe) === \"function\") {\n\t\tif (!(\"duplex\" in context)) context.duplex = \"half\";\n\t}\n\tconst { clearTimeout } = getTimeout(opts, controller);\n\tlet response = await fetch(context.url, context);\n\tclearTimeout();\n\tconst responseContext = {\n\t\tresponse,\n\t\trequest: context\n\t};\n\tfor (const onResponse of hooks.onResponse) if (onResponse) {\n\t\tvar _options$hookOptions;\n\t\tconst r = await onResponse(_objectSpread2(_objectSpread2({}, responseContext), {}, { response: (options === null || options === void 0 || (_options$hookOptions = options.hookOptions) === null || _options$hookOptions === void 0 ? void 0 : _options$hookOptions.cloneResponse) ? response.clone() : response }));\n\t\tif (r instanceof Response) response = r;\n\t\telse if (typeof r === \"object\" && r !== null) response = r.response;\n\t}\n\t/**\n\t* OK Branch\n\t*/\n\tif (response.ok) {\n\t\tif (!(context.method !== \"HEAD\")) return {\n\t\t\tdata: \"\",\n\t\t\terror: null\n\t\t};\n\t\tconst responseType = detectResponseType(response);\n\t\tconst successContext = {\n\t\t\tdata: null,\n\t\t\tresponse,\n\t\t\trequest: context\n\t\t};\n\t\tif (responseType === \"json\" || responseType === \"text\") {\n\t\t\tvar _context$jsonParser;\n\t\t\tconst text = await response.text();\n\t\t\tsuccessContext.data = await ((_context$jsonParser = context.jsonParser) !== null && _context$jsonParser !== void 0 ? _context$jsonParser : jsonParse)(text);\n\t\t} else successContext.data = await response[responseType]();\n\t\t/**\n\t\t* Parse the data if the output schema is defined\n\t\t*/\n\t\tif (context === null || context === void 0 ? void 0 : context.output) {\n\t\t\tif (context.output && !context.disableValidation) successContext.data = await parseStandardSchema(context.output, successContext.data);\n\t\t}\n\t\tfor (const onSuccess of hooks.onSuccess) if (onSuccess) {\n\t\t\tvar _options$hookOptions2;\n\t\t\tawait onSuccess(_objectSpread2(_objectSpread2({}, successContext), {}, { response: (options === null || options === void 0 || (_options$hookOptions2 = options.hookOptions) === null || _options$hookOptions2 === void 0 ? void 0 : _options$hookOptions2.cloneResponse) ? response.clone() : response }));\n\t\t}\n\t\tif (options === null || options === void 0 ? void 0 : options.throw) return successContext.data;\n\t\treturn {\n\t\t\tdata: successContext.data,\n\t\t\terror: null\n\t\t};\n\t}\n\tconst parser = (_options$jsonParser = options === null || options === void 0 ? void 0 : options.jsonParser) !== null && _options$jsonParser !== void 0 ? _options$jsonParser : jsonParse;\n\tconst responseText = await response.text();\n\tconst isJSONResponse = isJSONParsable(responseText);\n\tconst errorObject = isJSONResponse ? await parser(responseText) : null;\n\t/**\n\t* Error Branch\n\t*/\n\tconst errorContext = {\n\t\tresponse,\n\t\tresponseText,\n\t\trequest: context,\n\t\terror: _objectSpread2(_objectSpread2({}, errorObject), {}, {\n\t\t\tstatus: response.status,\n\t\t\tstatusText: response.statusText\n\t\t})\n\t};\n\tfor (const onError of hooks.onError) if (onError) {\n\t\tvar _options$hookOptions3;\n\t\tawait onError(_objectSpread2(_objectSpread2({}, errorContext), {}, { response: (options === null || options === void 0 || (_options$hookOptions3 = options.hookOptions) === null || _options$hookOptions3 === void 0 ? void 0 : _options$hookOptions3.cloneResponse) ? response.clone() : response }));\n\t}\n\tif (options === null || options === void 0 ? void 0 : options.retry) {\n\t\tvar _options$retryAttempt;\n\t\tconst retryStrategy = createRetryStrategy(options.retry);\n\t\tconst _retryAttempt = (_options$retryAttempt = options.retryAttempt) !== null && _options$retryAttempt !== void 0 ? _options$retryAttempt : 0;\n\t\tif (await retryStrategy.shouldAttemptRetry(_retryAttempt, response)) {\n\t\t\tfor (const onRetry of hooks.onRetry) if (onRetry) await onRetry(responseContext);\n\t\t\tconst delay = retryStrategy.getDelay(_retryAttempt);\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, delay));\n\t\t\treturn await betterFetch(url, _objectSpread2(_objectSpread2({}, options), {}, { retryAttempt: _retryAttempt + 1 }));\n\t\t}\n\t}\n\tif (options === null || options === void 0 ? void 0 : options.throw) throw new BetterFetchError(response.status, response.statusText, isJSONResponse ? errorObject : responseText);\n\treturn {\n\t\tdata: null,\n\t\terror: _objectSpread2(_objectSpread2({}, errorObject), {}, {\n\t\t\tstatus: response.status,\n\t\t\tstatusText: response.statusText\n\t\t})\n\t};\n};\n//#endregion\n//#region src/create-fetch/index.ts\nconst applySchemaPlugin = (config) => ({\n\tid: \"apply-schema\",\n\tname: \"Apply Schema\",\n\tversion: \"1.0.0\",\n\tasync init(url, options) {\n\t\tvar _config$plugins;\n\t\tlet opts = _objectSpread2(_objectSpread2({}, options), config.query !== void 0 && { query: _objectSpread2(_objectSpread2({}, config.query), options === null || options === void 0 ? void 0 : options.query) });\n\t\tconst schema = ((_config$plugins = config.plugins) === null || _config$plugins === void 0 || (_config$plugins = _config$plugins.find((plugin) => {\n\t\t\tvar _plugin$schema;\n\t\t\treturn ((_plugin$schema = plugin.schema) === null || _plugin$schema === void 0 ? void 0 : _plugin$schema.config) ? url.startsWith(plugin.schema.config.baseURL || \"\") || url.startsWith(plugin.schema.config.prefix || \"\") : false;\n\t\t})) === null || _config$plugins === void 0 ? void 0 : _config$plugins.schema) || config.schema;\n\t\tif (schema) {\n\t\t\tvar _schema$config, _schema$config2;\n\t\t\tlet urlKey = url;\n\t\t\tif ((_schema$config = schema.config) === null || _schema$config === void 0 ? void 0 : _schema$config.prefix) {\n\t\t\t\tif (urlKey.startsWith(schema.config.prefix)) {\n\t\t\t\t\turlKey = urlKey.replace(schema.config.prefix, \"\");\n\t\t\t\t\tif (schema.config.baseURL) url = url.replace(schema.config.prefix, schema.config.baseURL);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif ((_schema$config2 = schema.config) === null || _schema$config2 === void 0 ? void 0 : _schema$config2.baseURL) {\n\t\t\t\tif (urlKey.startsWith(schema.config.baseURL)) urlKey = urlKey.replace(schema.config.baseURL, \"\");\n\t\t\t}\n\t\t\tif (urlKey.startsWith(\"/\") && urlKey.charAt(1) === \"@\") urlKey = urlKey.substring(1);\n\t\t\tconst keySchema = schema.schema[urlKey];\n\t\t\tif (keySchema) {\n\t\t\t\tvar _keySchema$method;\n\t\t\t\tconst { method: schemaMethod, path } = parseMethodModifier(urlKey);\n\t\t\t\tif (schemaMethod) url = url.slice(0, url.length - urlKey.length) + path;\n\t\t\t\tlet validatedHeaders = options === null || options === void 0 ? void 0 : options.headers;\n\t\t\t\tif (keySchema.headers && !(options === null || options === void 0 ? void 0 : options.disableValidation)) {\n\t\t\t\t\tconst normalizedHeaders = {};\n\t\t\t\t\tif (options === null || options === void 0 ? void 0 : options.headers) {\n\t\t\t\t\t\tif (options.headers instanceof Headers) options.headers.forEach((value, key) => {\n\t\t\t\t\t\t\tnormalizedHeaders[key.toLowerCase()] = value;\n\t\t\t\t\t\t});\n\t\t\t\t\t\telse if (typeof options.headers === \"object\") {\n\t\t\t\t\t\t\tfor (const [key, value] of Object.entries(options.headers)) if (value !== null && value !== void 0) normalizedHeaders[key.toLowerCase()] = value;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tconst validated = await parseStandardSchema(keySchema.headers, normalizedHeaders);\n\t\t\t\t\tconst finalHeaders = {};\n\t\t\t\t\tfor (const [key, value] of Object.entries(validated)) finalHeaders[key.toLowerCase()] = value;\n\t\t\t\t\tvalidatedHeaders = finalHeaders;\n\t\t\t\t}\n\t\t\t\tconst method = (_keySchema$method = keySchema.method) !== null && _keySchema$method !== void 0 ? _keySchema$method : schemaMethod;\n\t\t\t\topts = _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({}, opts), method !== void 0 && { method }), keySchema.output !== void 0 && { output: keySchema.output }), validatedHeaders !== void 0 && { headers: validatedHeaders });\n\t\t\t\tif (!(options === null || options === void 0 ? void 0 : options.disableValidation)) {\n\t\t\t\t\tif (keySchema.query) {\n\t\t\t\t\t\topts.query = await parseStandardSchema(keySchema.query, options === null || options === void 0 ? void 0 : options.query);\n\t\t\t\t\t\tif (opts.query !== null && typeof opts.query === \"object\") {\n\t\t\t\t\t\t\tconst defaults = _objectSpread2({}, config.query);\n\t\t\t\t\t\t\tfor (const key of Object.keys(defaults)) if ((options === null || options === void 0 ? void 0 : options.query) && Object.prototype.hasOwnProperty.call(options.query, key)) defaults[key] = options.query[key];\n\t\t\t\t\t\t\topts.query = _objectSpread2(_objectSpread2({}, defaults), opts.query);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\topts = _objectSpread2(_objectSpread2({}, opts), {}, {\n\t\t\t\t\t\tbody: keySchema.input ? await parseStandardSchema(keySchema.input, options === null || options === void 0 ? void 0 : options.body) : options === null || options === void 0 ? void 0 : options.body,\n\t\t\t\t\t\tparams: keySchema.params ? await parseStandardSchema(keySchema.params, options === null || options === void 0 ? void 0 : options.params) : options === null || options === void 0 ? void 0 : options.params\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\turl,\n\t\t\t\t\toptions: opts\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\treturn _objectSpread2({ url }, (options !== void 0 || config.query !== void 0) && { options: opts });\n\t}\n});\nconst createFetch = (config) => {\n\tasync function $fetch(url, options) {\n\t\tconst opts = _objectSpread2(_objectSpread2(_objectSpread2({}, config), options), {}, {\n\t\t\theaders: mergeHeaders(config === null || config === void 0 ? void 0 : config.headers, options === null || options === void 0 ? void 0 : options.headers),\n\t\t\tplugins: [\n\t\t\t\t...(config === null || config === void 0 ? void 0 : config.plugins) || [],\n\t\t\t\tapplySchemaPlugin(config || {}),\n\t\t\t\t...(options === null || options === void 0 ? void 0 : options.plugins) || []\n\t\t\t]\n\t\t});\n\t\tif (config === null || config === void 0 ? void 0 : config.catchAllError) try {\n\t\t\treturn await betterFetch(url, opts);\n\t\t} catch (error) {\n\t\t\treturn {\n\t\t\t\tdata: null,\n\t\t\t\terror: {\n\t\t\t\t\tstatus: 500,\n\t\t\t\t\tstatusText: \"Fetch Error\",\n\t\t\t\t\tmessage: \"Fetch related error. Captured by catchAllError option. See error property for more details.\",\n\t\t\t\t\terror\n\t\t\t\t}\n\t\t\t};\n\t\t}\n\t\treturn await betterFetch(url, opts);\n\t}\n\treturn $fetch;\n};\n//#endregion\nexport { BetterFetchError, ValidationError, applySchemaPlugin, betterFetch, bodyParser, createFetch, createRetryStrategy, createSchema, detectContentType, detectResponseType, getBody, getFetch, getHeaders, getMethod, getTimeout, getURL, initializePlugins, isFunction, isJSONParsable, isJSONSerializable, isPayloadMethod, isRouteMethod, jsonParse, mergeHeaders, methods, parseStandardSchema };\n\n//# sourceMappingURL=index.js.map","import { BetterAuthError } from \"../error/index.mjs\";\nimport { betterFetch } from \"@better-fetch/fetch\";\n//#region src/oauth2/reject-redirects.ts\nconst httpRedirectStatuses = new Set([\n\t301,\n\t302,\n\t303,\n\t307,\n\t308\n]);\n/**\n* Whether a response from a `redirect: \"manual\"` fetch is a redirect.\n*\n* Node/undici exposes the real 3xx status. Spec-compliant runtimes (Cloudflare\n* Workers, Deno, browsers) return an opaque-redirect filtered response with\n* status 0 and type `\"opaqueredirect\"`, so the status alone is not enough.\n*/\nfunction isRedirectResponse(response) {\n\treturn response.type === \"opaqueredirect\" || httpRedirectStatuses.has(response.status);\n}\nfunction redirectRefused(endpoint) {\n\treturn new BetterAuthError(`The OAuth endpoint \"${endpoint}\" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`);\n}\n/**\n* Fetch option that refuses HTTP redirects portably.\n*\n* Cloudflare Workers (workerd) rejects `redirect: \"error\"`, so manual mode is\n* used and the resolved response is checked with {@link assertResponseNotRedirect}\n* (or, for betterFetch, with {@link fetchRefusingRedirects}).\n*/\nconst noFollowRedirect = { redirect: \"manual\" };\n/**\n* Throw when a native-`fetch` response (e.g. jose's JWKS loader) resolved to a\n* redirect, so an attacker-influenced endpoint cannot bounce a server-side\n* request to an internal address.\n*/\nfunction assertResponseNotRedirect(endpoint, response) {\n\tif (isRedirectResponse(response)) throw redirectRefused(endpoint);\n}\n/**\n* betterFetch that refuses HTTP redirects on a server-side OAuth fetch.\n*\n* Returns the betterFetch result and throws if the endpoint redirected, on both\n* undici (real 3xx status) and spec-compliant runtimes (opaque redirect, where\n* the error status is 0). The redirect is never followed on any runtime.\n*/\nasync function fetchRefusingRedirects(url, options) {\n\tlet redirected = false;\n\tconst onError = options?.onError;\n\tconst result = await betterFetch(url, {\n\t\t...options,\n\t\t...noFollowRedirect,\n\t\tasync onError(context) {\n\t\t\tif (isRedirectResponse(context.response)) redirected = true;\n\t\t\tawait onError?.(context);\n\t\t}\n\t}).catch((error) => {\n\t\tif (redirected) throw redirectRefused(url);\n\t\tthrow error;\n\t});\n\tif (redirected) throw redirectRefused(url);\n\treturn result;\n}\n//#endregion\nexport { assertResponseNotRedirect, fetchRefusingRedirects, noFollowRedirect };\n","import { base64url, calculateJwkThumbprint, decodeProtectedHeader, importJWK, jwtVerify } from \"jose\";\n//#region src/oauth2/dpop.ts\nconst DPOP_AUTHORIZATION_SCHEME = \"DPoP\";\nconst BEARER_AUTHORIZATION_SCHEME = \"Bearer\";\nconst DPOP_PROOF_TYPE = \"dpop+jwt\";\nconst DPOP_SIGNING_ALGORITHMS = [\n\t\"EdDSA\",\n\t\"ES256\",\n\t\"ES512\",\n\t\"PS256\",\n\t\"RS256\"\n];\nconst DEFAULT_DPOP_PROOF_MAX_AGE_SECONDS = 300;\nconst MAX_DPOP_JTI_LENGTH = 512;\nconst JWK_PRIVATE_FIELDS = new Set([\n\t\"d\",\n\t\"p\",\n\t\"q\",\n\t\"dp\",\n\t\"dq\",\n\t\"qi\",\n\t\"oth\",\n\t\"k\"\n]);\nfunction createInMemoryDpopReplayStore() {\n\tconst reservations = /* @__PURE__ */ new Map();\n\treturn { reserve({ key, expiresAt, now }) {\n\t\tconst nowMs = now.getTime();\n\t\tfor (const [storedKey, expiresAtMs] of reservations) if (expiresAtMs <= nowMs) reservations.delete(storedKey);\n\t\tif (reservations.has(key)) return false;\n\t\treservations.set(key, expiresAt.getTime());\n\t\treturn true;\n\t} };\n}\n/**\n* Database-backed DPoP proof replay store built on the auth context's\n* verification reservation primitive (`internalAdapter.reserveVerificationValue`),\n* the same atomic single-use mechanism that guards SAML assertion ids and other\n* one-time tokens. A replayed proof collides on the deterministic reservation id\n* so `reserve` returns `false`, giving cross-instance anti-replay. Prefer this\n* over {@link createInMemoryDpopReplayStore} for any multi-instance or serverless\n* resource server. Requires database-backed verification storage; a\n* secondary-storage-only deployment rejects the proof (fails closed).\n*/\nfunction createDpopReplayStore(reservations) {\n\treturn { reserve: ({ key, expiresAt }) => reservations.reserveVerificationValue({\n\t\tidentifier: `dpop-proof:${key}`,\n\t\tvalue: key,\n\t\texpiresAt\n\t}) };\n}\nfunction createDpopProofError(code, message) {\n\treturn Object.assign(new Error(message), { code });\n}\nfunction isDpopProofError(error) {\n\treturn error instanceof Error && \"code\" in error && error.code === \"invalid_dpop_proof\";\n}\nfunction parseAccessTokenAuthorization(authorization) {\n\tif (!authorization) return void 0;\n\tconst value = authorization.trim();\n\tif (!value) return void 0;\n\tconst match = /^([A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*)\\s+(.+)$/.exec(value);\n\tif (!match) return {\n\t\tscheme: \"Unknown\",\n\t\ttoken: value\n\t};\n\tconst scheme = match[1] ?? \"\";\n\tconst token = match[2]?.trim() ?? \"\";\n\tif (scheme.toLowerCase() === \"bearer\") return {\n\t\tscheme: \"Bearer\",\n\t\ttoken\n\t};\n\tif (scheme.toLowerCase() === \"dpop\") return {\n\t\tscheme: \"DPoP\",\n\t\ttoken\n\t};\n\treturn {\n\t\tscheme: \"Unknown\",\n\t\ttoken: value\n\t};\n}\nfunction stripAccessTokenAuthorizationScheme(token) {\n\treturn parseAccessTokenAuthorization(token)?.token ?? token;\n}\nfunction normalizeDpopHtu(url) {\n\tconst parsed = new URL(url);\n\tif (parsed.hash) throw new Error(\"DPoP proof htu must not contain a fragment\");\n\treturn `${parsed.origin}${parsed.pathname}`;\n}\nasync function deriveDpopAth(accessToken) {\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(accessToken));\n\treturn base64url.encode(new Uint8Array(digest));\n}\nasync function deriveDpopJkt(jwk) {\n\treturn calculateJwkThumbprint(jwk, \"sha256\");\n}\n/**\n* Extracts the DPoP key thumbprint from an RFC 7800 `cnf` confirmation. The\n* input is untrusted (a JWT claim, a JSON column), so any shape other than an\n* object carrying a non-empty string `jkt` (a primitive, an array, a different\n* confirmation method such as mTLS `x5t#S256`) yields `undefined` instead of\n* throwing.\n*/\nfunction getConfirmationJkt(confirmation) {\n\tif (!confirmation || typeof confirmation !== \"object\" || Array.isArray(confirmation)) return;\n\tconst jkt = confirmation.jkt;\n\treturn typeof jkt === \"string\" && jkt.length > 0 ? jkt : void 0;\n}\nfunction getDpopJktFromPayload(payload) {\n\treturn getConfirmationJkt(payload.cnf);\n}\nfunction getStringClaim(payload, claim) {\n\tconst value = payload[claim];\n\treturn typeof value === \"string\" && value.length > 0 ? value : void 0;\n}\nfunction getNumberClaim(payload, claim) {\n\tconst value = payload[claim];\n\treturn typeof value === \"number\" && Number.isFinite(value) ? value : void 0;\n}\nfunction assertSupportedDpopAlgorithm(alg, signingAlgorithms) {\n\tif (!alg || alg === \"none\" || alg.startsWith(\"HS\")) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof must use an asymmetric JWS algorithm\");\n\tif (!signingAlgorithms.includes(alg)) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof uses an unsupported JWS algorithm\");\n}\nfunction assertPublicJwk(jwk) {\n\tif (!jwk || typeof jwk !== \"object\" || Array.isArray(jwk)) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof header must include a public jwk\");\n\tif (jwk.kty === \"oct\") throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof jwk must be asymmetric\");\n\tfor (const field of JWK_PRIVATE_FIELDS) if (field in jwk) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof jwk must not contain private key material\");\n}\nasync function deriveDpopReplayKey(params) {\n\tconst input = `${params.jkt}\\n${params.htm}\\n${params.htu}\\n${params.jti}`;\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(input));\n\treturn base64url.encode(new Uint8Array(digest));\n}\nasync function reserveDpopReplay(replayStore, reservation) {\n\tif (!replayStore) return;\n\tif (!await replayStore.reserve(reservation)) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof jti has already been used\");\n}\nasync function verifyDpopProof({ proofJwt, method, url, accessToken, expectedJkt, requireAth = false, nowSeconds = Math.floor(Date.now() / 1e3), proofMaxAgeSeconds = DEFAULT_DPOP_PROOF_MAX_AGE_SECONDS, signingAlgorithms = DPOP_SIGNING_ALGORITHMS, replayStore }) {\n\tif (!proofJwt || proofJwt.split(\".\").length !== 3) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof must be a compact JWT\");\n\tlet protectedHeader;\n\ttry {\n\t\tprotectedHeader = decodeProtectedHeader(proofJwt);\n\t} catch (error) {\n\t\tthrow createDpopProofError(\"invalid_dpop_proof\", error instanceof Error ? error.message : \"DPoP proof header is invalid\");\n\t}\n\tif (protectedHeader.typ !== \"dpop+jwt\") throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof typ must be \\\"dpop+jwt\\\"\");\n\tassertSupportedDpopAlgorithm(protectedHeader.alg, signingAlgorithms);\n\tassertPublicJwk(protectedHeader.jwk);\n\tlet payload;\n\ttry {\n\t\tpayload = (await jwtVerify(proofJwt, await importJWK(protectedHeader.jwk, protectedHeader.alg), { typ: DPOP_PROOF_TYPE })).payload;\n\t} catch (error) {\n\t\tthrow createDpopProofError(\"invalid_dpop_proof\", error instanceof Error ? error.message : \"DPoP proof signature is invalid\");\n\t}\n\tconst htm = getStringClaim(payload, \"htm\");\n\tconst htu = getStringClaim(payload, \"htu\");\n\tconst jti = getStringClaim(payload, \"jti\");\n\tconst iat = getNumberClaim(payload, \"iat\");\n\tif (!htm || !htu || !jti || iat === void 0) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof must include htm, htu, jti, and iat claims\");\n\tif (jti.length > MAX_DPOP_JTI_LENGTH) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof jti is too large\");\n\tif (htm.toUpperCase() !== method.toUpperCase()) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof htm does not match the request method\");\n\tlet normalizedHtu;\n\tlet proofHtu;\n\ttry {\n\t\tnormalizedHtu = normalizeDpopHtu(url);\n\t\tproofHtu = normalizeDpopHtu(htu);\n\t} catch (error) {\n\t\tthrow createDpopProofError(\"invalid_dpop_proof\", error instanceof Error ? error.message : \"DPoP proof htu is invalid\");\n\t}\n\tif (proofHtu !== normalizedHtu) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof htu does not match the request URL\");\n\tif (iat > nowSeconds + 5 || nowSeconds - iat > proofMaxAgeSeconds) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof iat is outside the accepted window\");\n\tconst ath = getStringClaim(payload, \"ath\");\n\tif (requireAth && !ath) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof must include an ath claim\");\n\tif (accessToken !== void 0) {\n\t\tif (ath !== await deriveDpopAth(accessToken)) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof ath does not match the access token\");\n\t}\n\tconst jkt = await deriveDpopJkt(protectedHeader.jwk);\n\tif (expectedJkt !== void 0 && jkt !== expectedJkt) throw createDpopProofError(\"invalid_dpop_proof\", \"DPoP proof key does not match the bound token\");\n\tconst replayKey = await deriveDpopReplayKey({\n\t\tjkt,\n\t\thtm: htm.toUpperCase(),\n\t\thtu: normalizedHtu,\n\t\tjti\n\t});\n\tconst expiresAt = /* @__PURE__ */ new Date((iat + proofMaxAgeSeconds) * 1e3);\n\tawait reserveDpopReplay(replayStore, {\n\t\tkey: replayKey,\n\t\texpiresAt,\n\t\tnow: /* @__PURE__ */ new Date(nowSeconds * 1e3)\n\t});\n\treturn {\n\t\tjwk: protectedHeader.jwk,\n\t\tjkt,\n\t\tjti,\n\t\thtm,\n\t\thtu: normalizedHtu,\n\t\tiat,\n\t\tath,\n\t\treplayKey,\n\t\texpiresAt\n\t};\n}\nfunction createDpopBindingError(code, message) {\n\treturn Object.assign(new Error(message), { code });\n}\nfunction isDpopBindingError(error) {\n\treturn error instanceof Error && \"code\" in error && (error.code === \"invalid_token\" || error.code === \"invalid_dpop_proof\");\n}\n/**\n* Enforces the RFC 9449 §7.1 sender-constraint check for a resource request,\n* given an access-token payload that has already been validated (by JWKS or\n* introspection). This is the single source of truth for the\n* \"is the token DPoP-bound? then require the DPoP scheme, a proof, and a\n* matching key\" decision, shared by every resource-server entry point.\n*\n* Throws a {@link DpopBindingError} on any mismatch so callers map the\n* `invalid_token` / `invalid_dpop_proof` code into their own transport. Returns\n* normally for a valid bearer token (no `cnf.jkt`, no DPoP scheme).\n*/\nasync function enforceDpopBinding({ payload, authorization, proofJwt, method, url, replayStore, proofMaxAgeSeconds, signingAlgorithms }) {\n\tconst dpopJkt = getDpopJktFromPayload(payload);\n\tif (!dpopJkt) {\n\t\tif (authorization.scheme === \"DPoP\") throw createDpopBindingError(\"invalid_token\", \"DPoP authorization requires a DPoP-bound access token\");\n\t\treturn;\n\t}\n\tif (authorization.scheme !== \"DPoP\") throw createDpopBindingError(\"invalid_token\", \"DPoP-bound access token requires the DPoP authorization scheme\");\n\tif (!proofJwt) throw createDpopBindingError(\"invalid_dpop_proof\", \"DPoP proof header is required\");\n\ttry {\n\t\tawait verifyDpopProof({\n\t\t\tproofJwt,\n\t\t\tmethod,\n\t\t\turl,\n\t\t\taccessToken: authorization.token,\n\t\t\texpectedJkt: dpopJkt,\n\t\t\trequireAth: true,\n\t\t\tproofMaxAgeSeconds,\n\t\t\tsigningAlgorithms,\n\t\t\treplayStore\n\t\t});\n\t} catch (error) {\n\t\tif (isDpopProofError(error)) throw createDpopBindingError(\"invalid_dpop_proof\", error.message);\n\t\tthrow error;\n\t}\n}\n//#endregion\nexport { BEARER_AUTHORIZATION_SCHEME, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, deriveDpopAth, deriveDpopJkt, enforceDpopBinding, getConfirmationJkt, getDpopJktFromPayload, isDpopBindingError, isDpopProofError, normalizeDpopHtu, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof };\n","import { logger } from \"../env/logger.mjs\";\nimport { fetchRefusingRedirects } from \"./reject-redirects.mjs\";\nimport { createInMemoryDpopReplayStore, enforceDpopBinding, getDpopJktFromPayload, isDpopBindingError, parseAccessTokenAuthorization } from \"./dpop.mjs\";\nimport { APIError } from \"better-call\";\nimport { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from \"jose\";\n//#region src/oauth2/verify.ts\nconst joseInfrastructureErrorCodes = new Set([\n\terrors.JWKSTimeout.code,\n\terrors.JWKSInvalid.code,\n\terrors.JWKSMultipleMatchingKeys.code\n]);\nfunction isJoseInfrastructureError(error) {\n\treturn joseInfrastructureErrorCodes.has(error.code);\n}\n/**\n* @internal\n*/\nconst jwksCache = /* @__PURE__ */ new Map();\n/**\n* Cache for function jwks sources, keyed by a caller-provided stable object.\n* Entries are released with their key, so per-request keys cannot accumulate.\n*/\nconst functionJwksCache = /* @__PURE__ */ new WeakMap();\n/**\n* How long a cached JWKS is trusted before it is refetched\n*\n* @internal\n*/\nconst JWKS_CACHE_TTL_MS = 300 * 1e3;\nconst JWKS_NO_KID_REFETCH_COOLDOWN_MS = 30 * 1e3;\n/**\n* Returns the cached key set when it is within the TTL. When the token carries\n* `kid`, the cached set must contain that key id; without `kid`, key selection\n* is deferred to JOSE because RFC 7515 makes the header parameter optional.\n*/\nfunction getFreshJwksWithKid(cached, kid) {\n\tif (!cached) return void 0;\n\tif (Date.now() - cached.fetchedAt >= JWKS_CACHE_TTL_MS) return void 0;\n\tif (kid && !cached.jwks.keys.some((jwk) => jwk.kid === kid)) return;\n\treturn cached.jwks;\n}\nfunction shouldRefetchCachedJwksWithoutKid(error, resolved) {\n\tif (!(resolved.fromCache && !resolved.kid && (error instanceof errors.JWKSNoMatchingKey || error instanceof errors.JWSSignatureVerificationFailed))) return false;\n\tif (!resolved.noKidRefetchedAt) return true;\n\treturn Date.now() - resolved.noKidRefetchedAt >= JWKS_NO_KID_REFETCH_COOLDOWN_MS;\n}\nasync function fetchJwks(jwksFetch) {\n\tconst jwks = typeof jwksFetch === \"string\" ? await fetchRefusingRedirects(jwksFetch, { headers: { Accept: \"application/json\" } }).then(async (res) => {\n\t\tif (res.error) throw new Error(`Jwks failed: ${res.error.message ?? res.error.statusText}`);\n\t\treturn res.data;\n\t}) : await jwksFetch();\n\tif (!jwks) throw new Error(\"No jwks found\");\n\treturn jwks;\n}\n/**\n* Builds a {@link ResourceRequestInput} from a standard `Request`, reading the\n* `Authorization` and `DPoP` headers and the request method and URL. Resource\n* servers share this so every entry point maps the wire request the same way.\n*/\nfunction requestToResourceInput(request) {\n\treturn {\n\t\tauthorizationHeader: request.headers.get(\"authorization\"),\n\t\tdpopProofJwt: request.headers.get(\"dpop\"),\n\t\tmethod: request.method,\n\t\turl: request.url\n\t};\n}\n/**\n* Process-local, single-instance replay store. See the warning on\n* {@link VerifyAccessTokenRequestOptions.dpop.replayStore}; multi-instance\n* resource servers must pass their own shared store.\n*/\nconst defaultDpopReplayStore = createInMemoryDpopReplayStore();\n/**\n* Performs local verification of an access token for your APIs.\n*\n* Can also be configured for remote verification.\n*/\nasync function verifyJwsAccessToken(token, opts) {\n\ttry {\n\t\tconst resolved = await getJwksForVerification(token, opts);\n\t\tlet jwt;\n\t\ttry {\n\t\t\tjwt = await jwtVerify(token, createLocalJWKSet(resolved.jwks), opts.verifyOptions);\n\t\t} catch (error) {\n\t\t\tif (shouldRefetchCachedJwksWithoutKid(error, resolved)) jwt = await jwtVerify(token, createLocalJWKSet((await getJwksForVerification(token, {\n\t\t\t\t...opts,\n\t\t\t\tforceRefresh: true\n\t\t\t})).jwks), opts.verifyOptions);\n\t\t\telse throw error;\n\t\t}\n\t\tif (jwt.payload.azp) jwt.payload.client_id = jwt.payload.azp;\n\t\treturn jwt.payload;\n\t} catch (error) {\n\t\tif (error instanceof Error) throw error;\n\t\tthrow new Error(error);\n\t}\n}\nasync function getJwks(token, opts) {\n\treturn (await getJwksForVerification(token, opts)).jwks;\n}\nasync function getJwksForVerification(token, opts) {\n\tlet jwtHeaders;\n\ttry {\n\t\tjwtHeaders = decodeProtectedHeader(token);\n\t} catch (error) {\n\t\tif (error instanceof Error) throw error;\n\t\tthrow new Error(error);\n\t}\n\tconst kid = jwtHeaders.kid;\n\tif (typeof opts.jwksFetch !== \"string\") {\n\t\tconst cacheKey = opts.jwksCacheKey;\n\t\tif (!cacheKey) {\n\t\t\tconst jwks = await opts.jwksFetch();\n\t\t\tif (!jwks) throw new Error(\"No jwks found\");\n\t\t\treturn {\n\t\t\t\tjwks,\n\t\t\t\tfromCache: false,\n\t\t\t\tkid\n\t\t\t};\n\t\t}\n\t\tconst cached = functionJwksCache.get(cacheKey);\n\t\tconst cachedJwks = opts.forceRefresh ? void 0 : getFreshJwksWithKid(cached, kid);\n\t\tif (cachedJwks) return {\n\t\t\tjwks: cachedJwks,\n\t\t\tfromCache: true,\n\t\t\tkid,\n\t\t\tnoKidRefetchedAt: cached?.noKidRefetchedAt\n\t\t};\n\t\tconst jwks = await opts.jwksFetch();\n\t\tif (!jwks) throw new Error(\"No jwks found\");\n\t\tconst fetchedAt = Date.now();\n\t\tfunctionJwksCache.set(cacheKey, {\n\t\t\tjwks,\n\t\t\tfetchedAt,\n\t\t\t...opts.forceRefresh && !kid ? { noKidRefetchedAt: fetchedAt } : {}\n\t\t});\n\t\treturn {\n\t\t\tjwks,\n\t\t\tfromCache: false,\n\t\t\tkid\n\t\t};\n\t}\n\tconst cacheKey = opts.jwksFetch;\n\tconst cached = jwksCache.get(cacheKey);\n\tconst cachedJwks = opts.forceRefresh ? void 0 : getFreshJwksWithKid(cached, kid);\n\tif (!cachedJwks) {\n\t\tconst jwks = await fetchJwks(opts.jwksFetch);\n\t\tconst fetchedAt = Date.now();\n\t\tjwksCache.set(cacheKey, {\n\t\t\tjwks,\n\t\t\tfetchedAt,\n\t\t\t...opts.forceRefresh && !kid ? { noKidRefetchedAt: fetchedAt } : {}\n\t\t});\n\t\treturn {\n\t\t\tjwks,\n\t\t\tfromCache: false,\n\t\t\tkid\n\t\t};\n\t}\n\treturn {\n\t\tjwks: cachedJwks,\n\t\tfromCache: true,\n\t\tkid,\n\t\tnoKidRefetchedAt: cached?.noKidRefetchedAt\n\t};\n}\nasync function verifyAccessTokenPayload(token, opts) {\n\tlet payload;\n\tif (opts.jwksUrl && !opts?.remoteVerify?.force) try {\n\t\tpayload = await verifyJwsAccessToken(token, {\n\t\t\tjwksFetch: opts.jwksUrl,\n\t\t\tverifyOptions: opts.verifyOptions\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof Error) if (error.name === \"TypeError\" || error.name === \"JWSInvalid\") {} else if (error instanceof errors.JWTExpired) throw new APIError(\"UNAUTHORIZED\", { message: \"token expired\" });\n\t\telse if (error instanceof errors.JOSEError) {\n\t\t\tif (isJoseInfrastructureError(error)) throw error;\n\t\t\tthrow new APIError(\"UNAUTHORIZED\", { message: \"invalid access token\" });\n\t\t} else throw error;\n\t\telse throw new Error(error);\n\t}\n\tif (opts?.remoteVerify) {\n\t\tconst { data: introspect, error: introspectError } = await fetchRefusingRedirects(opts.remoteVerify.introspectUrl, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\"\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: opts.remoteVerify.clientId,\n\t\t\t\tclient_secret: opts.remoteVerify.clientSecret,\n\t\t\t\ttoken,\n\t\t\t\ttoken_type_hint: \"access_token\"\n\t\t\t}).toString()\n\t\t});\n\t\tif (introspectError) logger.error(`Introspection failed: ${introspectError.message ?? introspectError.statusText}`);\n\t\tif (!introspect) throw new APIError(\"INTERNAL_SERVER_ERROR\", { message: \"introspection failed\" });\n\t\tif (!introspect.active) throw new APIError(\"UNAUTHORIZED\", { message: \"token inactive\" });\n\t\ttry {\n\t\t\tconst unsecuredJwt = new UnsecuredJWT(introspect).encode();\n\t\t\tconst { audience: _audience, ...verifyOptionsNoAudience } = opts.verifyOptions;\n\t\t\tconst skipAudience = !introspect.aud && opts.remoteVerify.allowMissingAudience === true;\n\t\t\tpayload = UnsecuredJWT.decode(unsecuredJwt, skipAudience ? verifyOptionsNoAudience : opts.verifyOptions).payload;\n\t\t} catch (error) {\n\t\t\tthrow new Error(error);\n\t\t}\n\t}\n\tif (!payload) throw new APIError(\"UNAUTHORIZED\", { message: `no token payload` });\n\tconst grantedScopes = parseGrantedScopes(payload.scope);\n\tif (opts.requiredScopes) {\n\t\tconst isScopeSatisfied = opts.isScopeSatisfied ?? ((requiredScope, scopes) => scopes.has(requiredScope));\n\t\tconst missingScopes = opts.requiredScopes.filter((scope) => !isScopeSatisfied(scope, grantedScopes));\n\t\tif (missingScopes.length > 0) throw createInsufficientScopeError(missingScopes);\n\t}\n\treturn payload;\n}\n/**\n* Build the RFC 6750 §3.1 insufficient-scope failure: the access token is valid\n* but lacks scopes the operation needs.\n*\n* Resource-server challenge builders turn this into a `403` carrying a\n* `WWW-Authenticate: Bearer error=\"insufficient_scope\"` challenge that names\n* `scopes`, so the client knows what to request when it re-authorizes. Throw it\n* from a route handler to challenge for scopes only that operation needs; a\n* plain `FORBIDDEN` stays a plain `403`, since a permission denial the client\n* cannot fix by re-authorizing must not send the user through consent again.\n*\n* @param requiredScopes - Every scope the operation requires but the token lacks.\n* @param description - RFC 6750 `error_description` text. It must use the\n* printable ASCII character set allowed by the specification.\n*/\nconst OAUTH_SCOPE_TOKEN_PATTERN = /^[\\x21\\x23-\\x5b\\x5d-\\x7e]+$/;\nconst OAUTH_ERROR_DESCRIPTION_PATTERN = /^[\\x20-\\x21\\x23-\\x5b\\x5d-\\x7e]+$/;\nconst insufficientScopeErrors = /* @__PURE__ */ new WeakSet();\nfunction isOAuthScopeToken(value) {\n\treturn OAUTH_SCOPE_TOKEN_PATTERN.test(value);\n}\nfunction validateScopeTokens(scopes, label) {\n\tfor (const scope of scopes) if (!isOAuthScopeToken(scope)) throw new TypeError(`invalid ${label}: ${JSON.stringify(scope)}`);\n}\nfunction validateRequiredScopes(opts) {\n\tif (opts.requiredScopes) validateScopeTokens(opts.requiredScopes, \"required scope\");\n}\nfunction parseGrantedScopes(scope) {\n\tif (scope === void 0) return /* @__PURE__ */ new Set();\n\tif (typeof scope !== \"string\" || scope.length === 0 || scope.split(\" \").some((token) => !isOAuthScopeToken(token))) throw new APIError(\"UNAUTHORIZED\", {\n\t\tmessage: \"access token scope claim is invalid\",\n\t\terror: \"invalid_token\",\n\t\terror_description: \"access token scope claim is invalid\"\n\t});\n\treturn new Set(scope.split(\" \"));\n}\nfunction createInsufficientScopeError(requiredScopes, description = `access token is missing required scope: ${requiredScopes.join(\" \")}`) {\n\tif (requiredScopes.length === 0) throw new TypeError(\"requiredScopes must contain at least one scope\");\n\tvalidateScopeTokens(requiredScopes, \"required scope\");\n\tif (typeof description !== \"string\" || !OAUTH_ERROR_DESCRIPTION_PATTERN.test(description)) throw new TypeError(\"invalid error_description\");\n\tconst error = new APIError(\"FORBIDDEN\", {\n\t\tmessage: description,\n\t\terror: \"insufficient_scope\",\n\t\terror_description: description,\n\t\tscope: [...new Set(requiredScopes)].join(\" \")\n\t});\n\tinsufficientScopeErrors.add(error);\n\treturn error;\n}\n/**\n* Returns whether an error is a typed RFC 6750 insufficient-scope failure.\n*/\nfunction isInsufficientScopeError(error) {\n\tif (!(error instanceof APIError) || !insufficientScopeErrors.has(error) || error.status !== \"FORBIDDEN\") return false;\n\tconst body = error.body;\n\tif (body?.error !== \"insufficient_scope\" || typeof body.scope !== \"string\") return false;\n\tconst scopes = body.scope.split(\" \");\n\treturn scopes.length > 0 && scopes.every(isOAuthScopeToken);\n}\nfunction throwDpopUnauthorized(message, error) {\n\tthrow new APIError(\"UNAUTHORIZED\", error ? {\n\t\tmessage,\n\t\terror,\n\t\terror_description: message\n\t} : { message });\n}\n/**\n* Performs local verification of a bearer access token for your API.\n*\n* Can also be configured for remote verification. DPoP-bound access tokens\n* require {@link verifyAccessTokenRequest}, because sender-constraining cannot\n* be verified without the HTTP method, URL, Authorization scheme, DPoP proof,\n* and access-token hash. This function rejects DPoP-bound tokens; reach for it\n* only when you hold a raw token string and intentionally accept bearer tokens\n* alone.\n*/\nasync function verifyBearerToken(token, opts) {\n\tvalidateRequiredScopes(opts);\n\tconst payload = await verifyAccessTokenPayload(token, opts);\n\tif (getDpopJktFromPayload(payload)) throwDpopUnauthorized(\"DPoP-bound access token requires verifyAccessTokenRequest\", \"invalid_token\");\n\treturn payload;\n}\n/**\n* Verifies an HTTP resource request carrying an OAuth access token. This is the\n* recommended resource-server entry point: it handles both bearer and\n* DPoP-bound tokens, the bearer case being the request with no DPoP proof.\n*\n* It performs the same token validation as {@link verifyBearerToken}, then adds\n* the RFC 9449 sender-constraint checks that need request context: authorization\n* scheme, method, URL, DPoP proof, `ath`, and `cnf.jkt` binding.\n*/\nasync function verifyAccessTokenRequest(request, opts) {\n\tvalidateRequiredScopes(opts);\n\tconst authorization = parseAccessTokenAuthorization(request.authorizationHeader);\n\tif (!authorization?.token) throwDpopUnauthorized(\"missing authorization header\");\n\tif (authorization.scheme === \"Unknown\") throwDpopUnauthorized(\"authorization scheme must be Bearer or DPoP\", \"invalid_token\");\n\tconst payload = await verifyAccessTokenPayload(authorization.token, opts);\n\ttry {\n\t\tawait enforceDpopBinding({\n\t\t\tpayload,\n\t\t\tauthorization,\n\t\t\tproofJwt: request.dpopProofJwt,\n\t\t\tmethod: request.method,\n\t\t\turl: request.url,\n\t\t\treplayStore: opts.dpop?.replayStore ?? defaultDpopReplayStore,\n\t\t\tproofMaxAgeSeconds: opts.dpop?.proofMaxAgeSeconds,\n\t\t\tsigningAlgorithms: opts.dpop?.signingAlgorithms\n\t\t});\n\t} catch (error) {\n\t\tif (isDpopBindingError(error)) throwDpopUnauthorized(error.message, error.code);\n\t\tthrow error;\n\t}\n\treturn payload;\n}\n//#endregion\nexport { createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };\n","import { n as canonicalizeOAuthQueryParams } from \"./signed-query-Df1MNiSH.mjs\";\nimport { constantTimeEqual, makeSignature, symmetricDecrypt, symmetricEncrypt } from \"better-auth/crypto\";\nimport { APIError } from \"better-call\";\nimport { logger } from \"@better-auth/core/env\";\nimport { BetterAuthError } from \"@better-auth/core/error\";\nimport { CLIENT_ASSERTION_TYPE, decodeBasicCredentials } from \"@better-auth/core/oauth2\";\nimport { base64Url } from \"@better-auth/utils/base64\";\nimport { createHash } from \"@better-auth/utils/hash\";\n//#region src/extensions.ts\nconst DEFAULT_GRANT_TYPES = [\n\t\"authorization_code\",\n\t\"client_credentials\",\n\t\"refresh_token\"\n];\nconst BUILT_IN_CONFIDENTIAL_AUTH_METHODS = [\n\t\"client_secret_basic\",\n\t\"client_secret_post\",\n\t\"private_key_jwt\"\n];\nconst RESERVED_TOKEN_ENDPOINT_AUTH_METHODS = [\"none\", ...BUILT_IN_CONFIDENTIAL_AUTH_METHODS];\nconst RESERVED_TOKEN_ENDPOINT_AUTH_METHOD_SET = new Set(RESERVED_TOKEN_ENDPOINT_AUTH_METHODS);\nfunction assertNonEmptyExtensionValue(name, value) {\n\tif (value.trim().length > 0) return;\n\tthrow new BetterAuthError(`OAuth Provider extension ${name} cannot be empty`);\n}\nfunction assertAbsoluteUri(name, value) {\n\tassertNonEmptyExtensionValue(name, value);\n\tlet url;\n\ttry {\n\t\turl = new URL(value);\n\t} catch {\n\t\turl = void 0;\n\t}\n\tif (url?.protocol) return;\n\tthrow new BetterAuthError(`OAuth Provider extension ${name} must be an absolute URI: ${value}`);\n}\nfunction assertExtensionGrantType(grantType) {\n\tassertAbsoluteUri(\"grant type\", grantType);\n}\nfunction assertExtensionTokenEndpointAuthMethod(method) {\n\tassertNonEmptyExtensionValue(\"token_endpoint_auth_method\", method);\n\tif (!RESERVED_TOKEN_ENDPOINT_AUTH_METHOD_SET.has(method)) return;\n\tthrow new BetterAuthError(`OAuth Provider extension token_endpoint_auth_method is reserved: ${method}`);\n}\nfunction assertExtensionClientAssertionType(assertionType) {\n\tassertAbsoluteUri(\"client_assertion_type\", assertionType);\n\tif (assertionType !== CLIENT_ASSERTION_TYPE) return;\n\tthrow new BetterAuthError(`OAuth Provider extension client_assertion_type is reserved: ${assertionType}`);\n}\n/**\n* Validates one extension's dispatched keys (grant types, auth methods,\n* assertion types) and returns them for the cross-extension disjointness check.\n* Throws on a non-absolute grant/assertion URI, a reserved auth-method name, or\n* an empty assertion-type list.\n*/\nfunction collectExtensionKeys(extension) {\n\tconst grantTypes = Object.keys(extension.grants ?? {});\n\tfor (const grantType of grantTypes) assertExtensionGrantType(grantType);\n\tconst authMethods = [];\n\tconst assertionTypes = [];\n\tfor (const [method, strategy] of Object.entries(extension.clientAuthentication ?? {})) {\n\t\tassertExtensionTokenEndpointAuthMethod(method);\n\t\tauthMethods.push(method);\n\t\tconst methodAssertionTypes = strategy.assertionTypes ?? [method];\n\t\tif (methodAssertionTypes.length === 0) throw new BetterAuthError(`OAuth Provider extension client_assertion_type list cannot be empty for ${method}`);\n\t\tfor (const assertionType of methodAssertionTypes) {\n\t\t\tassertExtensionClientAssertionType(assertionType);\n\t\t\tassertionTypes.push(assertionType);\n\t\t}\n\t}\n\tconst clientDiscoveryIds = (extension.clientDiscovery ? Array.isArray(extension.clientDiscovery) ? extension.clientDiscovery : [extension.clientDiscovery] : []).map((discovery) => discovery.id);\n\tfor (const clientDiscoveryId of clientDiscoveryIds) assertNonEmptyExtensionValue(\"client discovery id\", clientDiscoveryId);\n\treturn {\n\t\tgrantTypes,\n\t\tauthMethods,\n\t\tassertionTypes,\n\t\tclientDiscoveryIds\n\t};\n}\nfunction assertNoDuplicateAcrossExtensions(label, values) {\n\tconst seen = /* @__PURE__ */ new Set();\n\tfor (const value of values) {\n\t\tif (seen.has(value)) throw new BetterAuthError(`OAuth Provider extensions register ${label} \"${value}\" more than once. Extension contributions must be disjoint.`);\n\t\tseen.add(value);\n\t}\n}\n/**\n* Validates every extension and rejects two extensions registering the same\n* grant type, auth method, assertion type, or client discovery identifier:\n* otherwise the first would win and the second be silently unreachable. Runs at\n* setup over the whole list; extensions number in the single digits, so a full\n* re-scan per registration is cheaper than the bookkeeping to cache it.\n*/\nfunction validateOAuthProviderExtensions(extensions) {\n\tconst keys = (extensions ?? []).map(collectExtensionKeys);\n\tassertNoDuplicateAcrossExtensions(\"grant type\", keys.flatMap((k) => k.grantTypes));\n\tassertNoDuplicateAcrossExtensions(\"token_endpoint_auth_method\", keys.flatMap((k) => k.authMethods));\n\tassertNoDuplicateAcrossExtensions(\"client_assertion_type\", keys.flatMap((k) => k.assertionTypes));\n\tassertNoDuplicateAcrossExtensions(\"client discovery id\", keys.flatMap((k) => k.clientDiscoveryIds));\n}\nfunction getOAuthProviderExtensions(opts) {\n\treturn opts.extensions ?? [];\n}\n/**\n* Flattens the client-id discovery sources contributed by every registered\n* extension into a single ordered list. `getClient()` consults them in order;\n* the metadata endpoints merge their `discoveryMetadata`.\n*/\nfunction getClientDiscoveries(opts) {\n\treturn getOAuthProviderExtensions(opts).flatMap((extension) => {\n\t\tconst discovery = extension.clientDiscovery;\n\t\tif (!discovery) return [];\n\t\treturn Array.isArray(discovery) ? discovery : [discovery];\n\t});\n}\n/**\n* Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin\n* from a companion plugin's `init()` hook. An extension can add token grants,\n* assertion-based client authentication methods, additive discovery metadata,\n* access-token / ID-token / UserInfo claims, and client-id discovery, without\n* forking provider core.\n*\n* Call this once, at `init()` time. It is idempotent in the same `extension`\n* object, so re-running a plugin's `init()` (for example when one plugin factory\n* result is shared across two `betterAuth()` instances) does not register it\n* twice. It throws if the oauth-provider plugin is not installed, if a grant\n* type or assertion type is not an absolute URI, if a client authentication\n* method reuses a built-in name, or if the extension registers a grant type,\n* auth method, assertion type, or client discovery identifier that another\n* extension already registered (contributions must be disjoint).\n*\n* @example\n* ```ts\n* init(ctx) {\n*   extendOAuthProvider(ctx, {\n*     grants: { \"urn:example:grant\": async ({ provider }) => provider.issueTokens(...) },\n*   });\n* }\n* ```\n*/\nfunction extendOAuthProvider(ctx, extension) {\n\tconst provider = ctx.getPlugin(\"oauth-provider\");\n\tif (!provider) throw new BetterAuthError(\"extendOAuthProvider requires the oauth-provider plugin.\");\n\tconst existing = provider.options.extensions ?? [];\n\tif (existing.includes(extension)) return;\n\tconst extensions = [...existing, extension];\n\tvalidateOAuthProviderExtensions(extensions);\n\tprovider.options.extensions = extensions;\n}\nfunction getExtensionGrantTypes(opts) {\n\treturn getOAuthProviderExtensions(opts).flatMap((extension) => Object.keys(extension.grants ?? {}));\n}\nfunction getSupportedGrantTypes(opts) {\n\treturn Array.from(new Set([...opts.grantTypes ?? DEFAULT_GRANT_TYPES, ...getExtensionGrantTypes(opts)]));\n}\nfunction getExtensionGrantHandler(opts, grantType) {\n\tfor (const extension of getOAuthProviderExtensions(opts)) {\n\t\tconst handler = extension.grants?.[grantType];\n\t\tif (handler) return handler;\n\t}\n}\nfunction getExtensionTokenEndpointAuthMethods(opts) {\n\treturn getOAuthProviderExtensions(opts).flatMap((extension) => Object.keys(extension.clientAuthentication ?? {}));\n}\n/**\n* Confidential and extension client-authentication methods the provider\n* supports. Pass `includeNone` to prepend `\"none\"` for the token endpoint and\n* DCR, where public clients are allowed; the introspection and revocation\n* endpoints, which never accept public clients, omit it (the default).\n*/\nfunction getSupportedAuthMethods(opts, settings) {\n\treturn Array.from(new Set([\n\t\t...settings?.includeNone ? [\"none\"] : [],\n\t\t...BUILT_IN_CONFIDENTIAL_AUTH_METHODS,\n\t\t...getExtensionTokenEndpointAuthMethods(opts)\n\t]));\n}\nfunction isExtensionTokenEndpointAuthMethod(opts, method) {\n\treturn method ? getExtensionTokenEndpointAuthMethods(opts).includes(method) : false;\n}\nfunction getExtensionClientAuthenticationStrategy(opts, assertionType) {\n\tif (assertionType === CLIENT_ASSERTION_TYPE) return void 0;\n\tfor (const extension of getOAuthProviderExtensions(opts)) {\n\t\tconst strategies = extension.clientAuthentication ?? {};\n\t\tfor (const [method, strategy] of Object.entries(strategies)) if ((strategy.assertionTypes ?? [method]).includes(assertionType)) return {\n\t\t\tmethod,\n\t\t\tstrategy\n\t\t};\n\t}\n}\n/**\n* Merges each registered extension's `metadata()` contribution into `document`,\n* first-wins: the provider owns every key it already wrote, so an extension can\n* add fields but never override core. Each contributor sees the base `document`,\n* not the running accumulation, so contributions stay order-independent.\n*/\nfunction applyOAuthProviderMetadataExtensions(ctx, opts, type, document) {\n\tconst next = { ...document };\n\tfor (const extension of getOAuthProviderExtensions(opts)) {\n\t\tconst contribution = extension.metadata?.({\n\t\t\tctx,\n\t\t\topts,\n\t\t\ttype,\n\t\t\tdocument\n\t\t});\n\t\tfor (const [key, value] of Object.entries(contribution ?? {})) if (!(key in next)) next[key] = value;\n\t}\n\treturn next;\n}\nasync function collectClaims(opts, run) {\n\tconst claims = {};\n\tfor (const extension of getOAuthProviderExtensions(opts)) {\n\t\tconst contribution = await run(extension) ?? {};\n\t\tfor (const [key, value] of Object.entries(contribution)) {\n\t\t\tif (key in claims) {\n\t\t\t\tlogger.warn(`oauth-provider: two extensions contributed the claim \"${key}\"; keeping the first-registered value.`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tclaims[key] = value;\n\t\t}\n\t}\n\treturn claims;\n}\nfunction collectExtensionAccessTokenClaims(opts, input) {\n\treturn collectClaims(opts, (extension) => extension.claims?.accessToken?.(input));\n}\nfunction collectExtensionIdTokenClaims(opts, input) {\n\treturn collectClaims(opts, (extension) => extension.claims?.idToken?.(input));\n}\nfunction collectExtensionUserInfoClaims(opts, input) {\n\treturn collectClaims(opts, (extension) => extension.claims?.userInfo?.(input));\n}\n/**\n* Whether any registered extension contributes UserInfo claims. Lets the\n* UserInfo endpoint skip loading the client when nothing needs it.\n*/\nfunction hasUserInfoClaimExtension(opts) {\n\treturn getOAuthProviderExtensions(opts).some((extension) => extension.claims?.userInfo);\n}\n//#endregion\n//#region src/utils/index.ts\n/**\n* Extracts the credentials from an `Authorization: Bearer <token>` header.\n*\n* Returns `undefined` when the header is absent or carries a non-Bearer scheme,\n* leaving the caller to decide whether that is an error. Throws an\n* `invalid_request` `APIError` when the Bearer scheme is present but the\n* credentials are missing or the header carries extra parts. The scheme match\n* is case-insensitive and the credentials are the single token after it.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc6750#section-2.1\n* @see https://datatracker.ietf.org/doc/html/rfc7235#section-2.1\n*/\nfunction parseBearerToken(authorization) {\n\tif (!authorization) return void 0;\n\tconst [scheme, credentials, ...extraParts] = authorization.trim().split(/\\s+/);\n\tif (scheme?.toLowerCase() !== \"bearer\") return void 0;\n\tif (!credentials || extraParts.length > 0) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_request\",\n\t\terror_description: \"Malformed Bearer Authorization header\"\n\t});\n\treturn credentials;\n}\nfunction createTTLCache() {\n\tconst cache = /* @__PURE__ */ new Map();\n\treturn {\n\t\tget(key) {\n\t\t\tconst entry = cache.get(key);\n\t\t\tif (!entry) return void 0;\n\t\t\tif (entry.expiresAt && entry.expiresAt < /* @__PURE__ */ new Date()) {\n\t\t\t\tcache.delete(key);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treturn entry;\n\t\t},\n\t\tset(key, value) {\n\t\t\tcache.set(key, value);\n\t\t}\n\t};\n}\n/**\n* Gets the oAuth Provider Plugin\n* @internal\n*/\nconst getOAuthProviderPlugin = (ctx) => {\n\treturn ctx.getPlugin(\"oauth-provider\");\n};\n/**\n* Gets the JWT Plugin\n* @internal\n*/\nconst getJwtPlugin = (ctx) => {\n\tconst plugin = ctx.getPlugin(\"jwt\");\n\tif (!plugin) throw new BetterAuthError(\"jwt_config\");\n\treturn plugin;\n};\n/**\n* Normalizes timestamp-like values returned by adapters.\n*\n* Accepts Date instances, epoch milliseconds as numbers, and strings that are\n* either ISO dates or numeric millisecond values such as \"1774295570569.0\".\n*/\nfunction normalizeTimestampValue(value) {\n\tif (value == null) return;\n\tif (value instanceof Date) return Number.isFinite(value.getTime()) ? value : void 0;\n\tif (typeof value === \"number\") {\n\t\tif (!Number.isFinite(value)) return;\n\t\tconst parsed = new Date(value);\n\t\treturn Number.isFinite(parsed.getTime()) ? parsed : void 0;\n\t}\n\tif (typeof value === \"string\") {\n\t\tconst trimmed = value.trim();\n\t\tif (!trimmed.length) return;\n\t\tconst numeric = Number(trimmed);\n\t\tif (Number.isFinite(numeric)) {\n\t\t\tconst parsed = new Date(numeric);\n\t\t\treturn Number.isFinite(parsed.getTime()) ? parsed : void 0;\n\t\t}\n\t\tconst parsed = new Date(trimmed);\n\t\treturn Number.isFinite(parsed.getTime()) ? parsed : void 0;\n\t}\n}\n/**\n* Resolves a session auth time from common adapter return shapes.\n*/\nfunction resolveSessionAuthTime(value) {\n\tif (value instanceof Date) return normalizeTimestampValue(value);\n\tif (!value || typeof value !== \"object\") return normalizeTimestampValue(value);\n\tconst direct = normalizeTimestampValue(value.createdAt) ?? normalizeTimestampValue(value.created_at);\n\tif (direct) return direct;\n\tconst nested = value.session;\n\tif (!nested || typeof nested !== \"object\") return;\n\treturn normalizeTimestampValue(nested.createdAt) ?? normalizeTimestampValue(nested.created_at);\n}\n/**\n* Normalizes OAuth resource values into a non-empty string array.\n*/\nfunction toResourceList(value) {\n\tif (typeof value === \"string\") return [value];\n\tif (!value?.length) return void 0;\n\treturn value;\n}\n/**\n* Normalizes audience values for JWT claims.\n*/\nfunction toAudienceClaim(audience) {\n\tif (typeof audience === \"string\") return audience;\n\tif (!audience?.length) return void 0;\n\treturn audience.length === 1 ? audience.at(0) : audience;\n}\nconst trustedClientCaches = /* @__PURE__ */ new WeakMap();\nfunction getTrustedClientCache(options) {\n\tconst existingCache = trustedClientCaches.get(options);\n\tif (existingCache) return existingCache;\n\tconst cache = createTTLCache();\n\ttrustedClientCaches.set(options, cache);\n\treturn cache;\n}\n/**\n* Verify the signature and expiration of an OAuth query issued by this provider.\n* Use the provider's current auth secret on the server before displaying a\n* consent page. A valid signature does not replace client or session checks.\n*/\nasync function verifyOAuthQueryParams(oauth_query, secret) {\n\tconst queryParams = new URLSearchParams(oauth_query);\n\tconst sig = queryParams.get(\"sig\");\n\tconst sigs = queryParams.getAll(\"sig\");\n\tconst exp = Number(queryParams.get(\"exp\"));\n\tqueryParams.delete(\"sig\");\n\tconst verifySig = await makeSignature(canonicalizeOAuthQueryParams(queryParams).toString(), secret);\n\treturn sigs.length === 1 && !!sig && constantTimeEqual(sig, verifySig) && /* @__PURE__ */ new Date(exp * 1e3) >= /* @__PURE__ */ new Date();\n}\n/**\n* Get a client by ID, checking trusted clients first, then database\n*/\nasync function getClient(ctx, options, clientId) {\n\tconst trustedClientCache = getTrustedClientCache(options);\n\tconst trustedClient = trustedClientCache.get(clientId);\n\tif (trustedClient && !trustedClient.clientDiscoveryId) return Object.assign({}, trustedClient);\n\tlet dbClient = await ctx.context.adapter.findOne({\n\t\tmodel: options.schema?.oauthClient?.modelName ?? \"oauthClient\",\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}]\n\t});\n\tconst discoveries = getClientDiscoveries(options);\n\tif (dbClient?.clientDiscoveryId) {\n\t\tconst clientDiscoveryId = dbClient.clientDiscoveryId;\n\t\tconst discovery = discoveries.find((candidate) => candidate.id === clientDiscoveryId);\n\t\tif (!discovery?.matches(clientId)) return null;\n\t\tdbClient = await discovery.resolve(ctx, clientId, dbClient);\n\t\tif (!dbClient) return null;\n\t} else if (dbClient) {\n\t\tif (options.cachedTrustedClients?.has(clientId)) trustedClientCache.set(clientId, Object.assign({}, dbClient));\n\t\treturn dbClient;\n\t} else for (const discovery of discoveries) {\n\t\tif (!discovery.matches(clientId)) continue;\n\t\tconst resolved = await discovery.resolve(ctx, clientId, null);\n\t\tif (resolved) {\n\t\t\tdbClient = resolved;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn dbClient;\n}\n/**\n* Merge `discoveryMetadata` from every contributed {@link ClientDiscovery}\n* into a single object. Entries are spread in order; later entries override\n* earlier ones on key collisions.\n*\n* @internal\n*/\nfunction mergeDiscoveryMetadata(discoveries) {\n\treturn discoveries.reduce((acc, d) => ({\n\t\t...acc,\n\t\t...d.discoveryMetadata ?? {}\n\t}), {});\n}\n/**\n* Default client secret hasher using SHA-256\n*\n* @internal\n*/\nconst defaultHasher = async (value) => {\n\tconst hash = await createHash(\"SHA-256\").digest(new TextEncoder().encode(value));\n\treturn base64Url.encode(new Uint8Array(hash), { padding: false });\n};\n/**\n* Decrypts a storedClientSecret for signing\n*\n* @internal\n*/\nasync function decryptStoredClientSecret(ctx, storageMethod, storedClientSecret) {\n\tif (storageMethod === \"encrypted\") return await symmetricDecrypt({\n\t\tkey: ctx.context.secretConfig,\n\t\tdata: storedClientSecret\n\t});\n\telse if (typeof storageMethod === \"object\" && \"decrypt\" in storageMethod) return await storageMethod.decrypt(storedClientSecret);\n\tthrow new BetterAuthError(`Unsupported decryption storageMethod type '${storageMethod}'`);\n}\n/**\n* Verify stored client secret against provided client secret\n*\n* @internal\n*/\nasync function verifyStoredClientSecret(ctx, opts, storedClientSecret, clientSecret) {\n\tconst storageMethod = opts.storeClientSecret ?? (opts.disableJwtPlugin ? \"encrypted\" : \"hashed\");\n\tif (clientSecret && opts.prefix?.clientSecret) if (clientSecret.startsWith(opts.prefix?.clientSecret)) clientSecret = clientSecret.replace(opts.prefix.clientSecret, \"\");\n\telse throw new APIError(\"UNAUTHORIZED\", {\n\t\terror_description: \"invalid client_secret\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (storageMethod === \"hashed\") {\n\t\tconst hashedClientSecret = clientSecret ? await defaultHasher(clientSecret) : void 0;\n\t\treturn !!hashedClientSecret && constantTimeEqual(hashedClientSecret, storedClientSecret);\n\t} else if (typeof storageMethod === \"object\" && \"hash\" in storageMethod) if (storageMethod.verify) return !!clientSecret && await storageMethod.verify(clientSecret, storedClientSecret);\n\telse {\n\t\tconst hashedClientSecret = clientSecret ? await storageMethod.hash(clientSecret) : void 0;\n\t\treturn !!hashedClientSecret && constantTimeEqual(hashedClientSecret, storedClientSecret);\n\t}\n\telse if (storageMethod === \"encrypted\") try {\n\t\tconst decryptedClientSecret = await decryptStoredClientSecret(ctx, storageMethod, storedClientSecret);\n\t\treturn !!clientSecret && constantTimeEqual(decryptedClientSecret, clientSecret);\n\t} catch {\n\t\treturn false;\n\t}\n\telse if (typeof storageMethod === \"object\" && \"decrypt\" in storageMethod) {\n\t\tconst decryptedClientSecret = await decryptStoredClientSecret(ctx, storageMethod, storedClientSecret);\n\t\treturn !!clientSecret && constantTimeEqual(decryptedClientSecret, clientSecret);\n\t}\n\tthrow new BetterAuthError(`Unsupported verify storageMethod type '${storageMethod}'`);\n}\n/**\n* Store client secret according to the configured storage method\n*\n* @internal\n*/\nasync function storeClientSecret(ctx, opts, clientSecret) {\n\tconst storageMethod = opts.storeClientSecret ?? (opts.disableJwtPlugin ? \"encrypted\" : \"hashed\");\n\tif (storageMethod === \"encrypted\") return await symmetricEncrypt({\n\t\tkey: ctx.context.secretConfig,\n\t\tdata: clientSecret\n\t});\n\telse if (storageMethod === \"hashed\") return await defaultHasher(clientSecret);\n\telse if (typeof storageMethod === \"object\" && \"hash\" in storageMethod) return await storageMethod.hash(clientSecret);\n\telse if (typeof storageMethod === \"object\" && \"encrypt\" in storageMethod) return await storageMethod.encrypt(clientSecret);\n\tthrow new BetterAuthError(`Unsupported storeClientSecret type '${storageMethod}'`);\n}\n/**\n* Stores a token value (ie opaque tokens, refresh tokens, transaction tokens, verification codes)\n* on the database in a secure hashed format.\n*\n* @internal\n*/\nasync function storeToken(storageMethod = \"hashed\", token, type) {\n\tif (storageMethod === \"hashed\") return await defaultHasher(token);\n\telse if (typeof storageMethod === \"object\" && \"hash\" in storageMethod) return await storageMethod.hash(token, type);\n\tthrow new BetterAuthError(`storeToken: unsupported storageMethod type '${storageMethod}'`);\n}\n/**\n* Gets a hashed token value to find on the database.\n*\n* @internal\n*/\nasync function getStoredToken(storageMethod = \"hashed\", token, type) {\n\tif (storageMethod === \"hashed\") return await defaultHasher(token);\n\telse if (typeof storageMethod === \"object\" && \"hash\" in storageMethod) return await storageMethod.hash(token, type);\n\tthrow new BetterAuthError(`getStoredToken: unsupported storageMethod type '${storageMethod}'`);\n}\n/**\n* Converts a BASIC authorization header\n* into its client_id and client_secret representation\n*\n* @internal\n*/\nconst BASIC_SCHEME_PREFIX = /^Basic +/i;\nconst AUTH_SCHEME_TOKEN = /^([!#$%&'*+\\-.^_`|~0-9A-Za-z]+)(?=\\s|$)/;\nfunction parseAuthorizationScheme(authorization) {\n\treturn authorization.match(AUTH_SCHEME_TOKEN)?.[1];\n}\nconst CLIENT_AUTHENTICATION_FIELDS = [\n\t\"client_secret\",\n\t\"client_assertion\",\n\t\"client_assertion_type\"\n];\nfunction throwInvalidAuthenticationRequest(errorDescription) {\n\tthrow new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_request\",\n\t\terror_description: errorDescription\n\t});\n}\n/**\n* Normalizes client identification and authentication parameters while\n* enforcing RFC 6749 §2.3 and RFC 8628 §3.1 cardinality. Empty values are\n* omitted. Client identification remains separate from authentication-method\n* detection so a public `client_id` does not count as an authentication attempt.\n* Repeated `resource` parameters are intentionally outside this parser because\n* RFC 8707 §2 explicitly permits them.\n*\n* Credential and assertion verification remain the responsibility of\n* `extractClientCredentials`.\n*\n* @internal\n*/\nasync function normalizeClientAuthenticationParameters(request, body = {}) {\n\tlet clientId;\n\tif (body.client_id !== void 0 && body.client_id !== \"\") {\n\t\tif (typeof body.client_id !== \"string\") throwInvalidAuthenticationRequest(\"client_id must be a string\");\n\t\tclientId = body.client_id;\n\t}\n\tconst fields = {};\n\tconst setEffectiveField = (field, value) => {\n\t\tif (value === void 0 || value === \"\") return;\n\t\tif (typeof value !== \"string\") throwInvalidAuthenticationRequest(`${field} must be a string`);\n\t\tfields[field] = value;\n\t};\n\tfor (const field of CLIENT_AUTHENTICATION_FIELDS) if (Object.hasOwn(body, field)) setEffectiveField(field, body[field]);\n\tconst authorization = request?.headers.get(\"authorization\");\n\tconst hasAuthorizationHeader = Boolean(authorization);\n\tif (request) {\n\t\tif ((request.headers.get(\"content-type\")?.toLowerCase() ?? \"\").includes(\"application/x-www-form-urlencoded\")) {\n\t\t\tconst params = new URLSearchParams(await request.clone().text());\n\t\t\tconst clientIds = params.getAll(\"client_id\").filter((value) => value.length > 0);\n\t\t\tif (clientIds.length > 1) throwInvalidAuthenticationRequest(\"client_id must not be repeated\");\n\t\t\tclientId = clientIds[0];\n\t\t\tfor (const field of CLIENT_AUTHENTICATION_FIELDS) {\n\t\t\t\tconst values = params.getAll(field).filter((value) => value.length > 0);\n\t\t\t\tif (values.length > 1) throwInvalidAuthenticationRequest(`${field} must not be repeated`);\n\t\t\t\tif (values.length === 1) setEffectiveField(field, values[0]);\n\t\t\t}\n\t\t}\n\t}\n\tconst hasClientSecret = fields.client_secret !== void 0;\n\tconst hasClientAssertion = fields.client_assertion !== void 0 || fields.client_assertion_type !== void 0;\n\tif (hasAuthorizationHeader && (hasClientSecret || hasClientAssertion) || hasClientSecret && hasClientAssertion) throwInvalidAuthenticationRequest(\"A request must use only one client authentication method\");\n\tbody.client_id = clientId;\n\tfor (const field of CLIENT_AUTHENTICATION_FIELDS) body[field] = fields[field];\n\treturn { detected: hasAuthorizationHeader || Object.keys(fields).length > 0 };\n}\nfunction basicToClientCredentials(authorization) {\n\tif (!BASIC_SCHEME_PREFIX.test(authorization)) return;\n\ttry {\n\t\tconst { clientId, clientSecret } = decodeBasicCredentials(authorization);\n\t\treturn {\n\t\t\tclient_id: clientId,\n\t\t\tclient_secret: clientSecret\n\t\t};\n\t} catch {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\terror_description: \"invalid authorization header format\",\n\t\t\terror: \"invalid_client\"\n\t\t}, { \"WWW-Authenticate\": \"Basic\" });\n\t}\n}\n/**\n* Whether a client is allowed to use a given grant type.\n*\n* A client's registered `grantTypes` defaults to the documented default\n* `[\"authorization_code\"]` when unset (see client registration). Refresh tokens\n* are only ever issued through the authorization_code flow, so a client allowed\n* to use `authorization_code` is implicitly allowed to use `refresh_token`.\n*\n* @internal\n*/\nfunction clientAllowsGrant(client, grantType) {\n\tconst allowedGrants = client.grantTypes && client.grantTypes.length > 0 ? client.grantTypes : [\"authorization_code\"];\n\tif (grantType === \"refresh_token\" && allowedGrants.includes(\"authorization_code\")) return true;\n\treturn allowedGrants.includes(grantType);\n}\n/**\n* Validates requested scopes against a registered client's allowed scopes.\n*\n* @internal\n*/\nfunction validateClientScopes(client, scopes) {\n\tif (!scopes || !client.scopes) return;\n\tconst validScopes = new Set(client.scopes);\n\tfor (const scope of scopes) if (!validScopes.has(scope)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: `client does not allow scope ${scope}`,\n\t\terror: \"invalid_scope\"\n\t});\n}\nfunction throwInvalidClient(errorDescription, authentication) {\n\tconst attemptedBasicAuthentication = authentication?.method === \"client_secret_basic\";\n\tconst challengeScheme = authentication?.scheme ?? (attemptedBasicAuthentication ? \"Basic\" : void 0);\n\tthrow new APIError(challengeScheme ? \"UNAUTHORIZED\" : \"BAD_REQUEST\", {\n\t\terror_description: errorDescription,\n\t\terror: \"invalid_client\"\n\t}, challengeScheme ? { \"WWW-Authenticate\": challengeScheme } : void 0);\n}\n/**\n* Resolves the registered client by id and authorizes it: existence, disabled\n* state, registered auth method, requested scopes, and grant type. The record is\n* always resolved here via `getClient`, so a client-auth strategy proves the\n* caller controls `clientId` but never supplies the record. `preVerified` marks\n* that an assertion already proved control, so the client-secret check is skipped.\n*\n* @internal\n*/\nasync function validateClientCredentials(ctx, options, clientId, clientSecret, scopes, preVerified, grantType, authMethod) {\n\tconst client = await getClient(ctx, options, clientId);\n\tif (!client) throwInvalidClient(\"missing client\", { method: authMethod });\n\tif (client.disabled) throwInvalidClient(\"client is disabled\", { method: authMethod });\n\tconst registeredAuthMethod = client.tokenEndpointAuthMethod ?? \"client_secret_basic\";\n\tif (authMethod && registeredAuthMethod !== authMethod) throwInvalidClient(`client registered for ${registeredAuthMethod} cannot use ${authMethod}`, { method: authMethod });\n\tif ((client.tokenEndpointAuthMethod === \"private_key_jwt\" || isExtensionTokenEndpointAuthMethod(options, client.tokenEndpointAuthMethod)) && !preVerified) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: `client registered for ${client.tokenEndpointAuthMethod} must use client_assertion`,\n\t\terror: \"invalid_client\"\n\t});\n\tif (!preVerified) {\n\t\tif (client.tokenEndpointAuthMethod !== \"none\" && !clientSecret) throwInvalidClient(\"client secret must be provided\", { method: authMethod });\n\t\tif (clientSecret && !client.clientSecret) throwInvalidClient(\"public client, client secret should not be received\", { method: authMethod });\n\t\tif (clientSecret && !await verifyStoredClientSecret(ctx, options, client.clientSecret, clientSecret)) throwInvalidClient(\"invalid client_secret\", { method: authMethod });\n\t}\n\tvalidateClientScopes(client, scopes);\n\tif (grantType && !clientAllowsGrant(client, grantType)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: `client is not authorized to use grant type ${grantType}`,\n\t\terror: \"unauthorized_client\"\n\t});\n\treturn client;\n}\n/**\n* Parse client metadata that may be stored as JSON string or already parsed object.\n* Handles database adapters that auto-parse JSON columns.\n*\n* @internal\n*/\nfunction parseClientMetadata(metadata) {\n\tif (!metadata) return void 0;\n\treturn typeof metadata === \"string\" ? JSON.parse(metadata) : metadata;\n}\n/** Unwraps ExtractedCredentials into the fields each grant handler needs. */\nfunction destructureCredentials(credentials) {\n\treturn {\n\t\tclientId: credentials?.clientId,\n\t\tclientSecret: credentials?.kind === \"client_secret\" ? credentials.clientSecret : void 0,\n\t\tpreVerified: credentials?.kind === \"pre_verified\",\n\t\tauthMethod: credentials?.method,\n\t\tconfirmation: credentials?.kind === \"pre_verified\" ? credentials.confirmation : void 0\n\t};\n}\n/**\n* Extracts and resolves client credentials from the request.\n* Supports: client_secret_basic, client_secret_post, private_key_jwt, and none (public).\n*/\nasync function extractClientCredentials(ctx, opts, expectedAudience) {\n\tconst body = { ...ctx.body ?? {} };\n\tawait normalizeClientAuthenticationParameters(ctx.request, body);\n\tconst authorization = ctx.request?.headers.get(\"authorization\") ?? void 0;\n\tif (body.client_assertion_type || body.client_assertion) {\n\t\tif (!body.client_assertion || !body.client_assertion_type) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"client_assertion and client_assertion_type must both be provided\",\n\t\t\terror: \"invalid_client\"\n\t\t});\n\t\tconst assertion = body.client_assertion;\n\t\tconst assertionType = body.client_assertion_type;\n\t\tconst extensionStrategy = getExtensionClientAuthenticationStrategy(opts, assertionType);\n\t\tif (extensionStrategy) {\n\t\t\tconst result = await extensionStrategy.strategy.authenticate({\n\t\t\t\tctx,\n\t\t\t\topts,\n\t\t\t\tassertion,\n\t\t\t\tassertionType,\n\t\t\t\tclientId: body.client_id,\n\t\t\t\texpectedAudience\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tkind: \"pre_verified\",\n\t\t\t\tmethod: extensionStrategy.method,\n\t\t\t\tclientId: result.clientId,\n\t\t\t\tconfirmation: result.confirmation\n\t\t\t};\n\t\t}\n\t\tconst { verifyClientAssertion: verify } = await import(\"./authorize-C95F-9E1.mjs\").then((n) => n.o);\n\t\treturn {\n\t\t\tkind: \"pre_verified\",\n\t\t\tmethod: \"private_key_jwt\",\n\t\t\tclientId: (await verify(ctx, opts, assertion, assertionType, body.client_id, expectedAudience)).clientId\n\t\t};\n\t}\n\tif (authorization && !BASIC_SCHEME_PREFIX.test(authorization)) {\n\t\tconst authorizationScheme = parseAuthorizationScheme(authorization);\n\t\tif (!authorizationScheme) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_request\",\n\t\t\terror_description: \"Invalid authorization header format\"\n\t\t});\n\t\tthrowInvalidClient(\"unsupported authorization scheme\", { scheme: authorizationScheme });\n\t}\n\tif (authorization && BASIC_SCHEME_PREFIX.test(authorization)) {\n\t\tconst res = basicToClientCredentials(authorization);\n\t\tif (res) return {\n\t\t\tkind: \"client_secret\",\n\t\t\tmethod: \"client_secret_basic\",\n\t\t\tclientId: res.client_id,\n\t\t\tclientSecret: res.client_secret\n\t\t};\n\t}\n\tif (body.client_id && body.client_secret) return {\n\t\tkind: \"client_secret\",\n\t\tmethod: \"client_secret_post\",\n\t\tclientId: body.client_id,\n\t\tclientSecret: body.client_secret\n\t};\n\tif (body.client_id) return {\n\t\tkind: \"public\",\n\t\tmethod: \"none\",\n\t\tclientId: body.client_id\n\t};\n\treturn null;\n}\n/**\n* Parse space-separated prompt string into a set of prompts\n*\n* @param prompt\n*/\nfunction parsePrompt(prompt) {\n\tconst prompts = prompt.split(\" \").map((p) => p.trim());\n\tconst set = /* @__PURE__ */ new Set();\n\tfor (const p of prompts) if (p === \"login\" || p === \"consent\" || p === \"create\" || p === \"select_account\" || p === \"none\") set.add(p);\n\treturn new Set(set);\n}\n/**\n* Extracts the sector identifier (hostname) from a client's first redirect URI.\n*\n* @see https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg\n* @internal\n*/\nfunction getSectorIdentifier(client) {\n\tconst uri = client.redirectUris?.[0];\n\tif (!uri) throw new BetterAuthError(\"Client has no redirect URIs for sector identifier\");\n\treturn new URL(uri).host;\n}\n/**\n* Computes a pairwise subject identifier using HMAC-SHA256.\n*\n* @see https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg\n* @internal\n*/\nasync function computePairwiseSub(userId, client, secret) {\n\treturn makeSignature(`${getSectorIdentifier(client)}.${userId}`, secret);\n}\n/**\n* Returns the appropriate subject identifier for a user+client pair.\n* Uses pairwise when the client opts in and the server has a secret configured.\n*\n* @internal\n*/\nasync function resolveSubjectIdentifier(userId, client, opts) {\n\tif (client.subjectType === \"pairwise\" && opts.pairwiseSecret) return computePairwiseSub(userId, client, opts.pairwiseSecret);\n\treturn userId;\n}\n/**\n* Converts URLSearchParams to a plain object, preserving\n* multi-valued keys as arrays instead of discarding duplicates.\n*/\nfunction searchParamsToQuery(params) {\n\tconst result = Object.create(null);\n\tfor (const key of new Set(params.keys())) {\n\t\tconst values = params.getAll(key);\n\t\tresult[key] = values.length === 1 ? values[0] : values;\n\t}\n\treturn result;\n}\nfunction isSessionFreshForSignedQuery(sessionCreatedAt, signedQueryIssuedAt) {\n\tif (!signedQueryIssuedAt) return false;\n\tconst normalized = normalizeTimestampValue(sessionCreatedAt);\n\tif (!normalized) return false;\n\treturn normalized.getTime() >= signedQueryIssuedAt.getTime();\n}\nfunction removePromptFromQuery(query, prompt) {\n\tconst nextQuery = new URLSearchParams(query);\n\tconst prompts = nextQuery.get(\"prompt\")?.split(\" \");\n\tconst foundPrompt = prompts?.findIndex((v) => v === prompt) ?? -1;\n\tif (foundPrompt >= 0) {\n\t\tprompts?.splice(foundPrompt, 1);\n\t\tprompts?.length ? nextQuery.set(\"prompt\", prompts.join(\" \")) : nextQuery.delete(\"prompt\");\n\t}\n\treturn nextQuery;\n}\nfunction removeMaxAgeFromQuery(query) {\n\tconst nextQuery = new URLSearchParams(query);\n\tnextQuery.delete(\"max_age\");\n\treturn nextQuery;\n}\n/**\n* Determines if PKCE is required for a given client and authorization request.\n*\n* PKCE is always required for:\n* 1. Public clients (cannot securely store client_secret)\n* 2. Requests with offline_access scope unless a confidential OIDC request\n*    already uses nonce as its authorization-code injection countermeasure.\n*\n* For confidential clients:\n* - Uses client.requirePKCE if set (defaults to true)\n*\n* Returns false if PKCE is not required, or the reason it is required.\n*\n* @internal\n*/\nfunction isPKCERequired(client, request) {\n\tif (client.tokenEndpointAuthMethod === \"none\") return \"pkce is required for public clients\";\n\tconst requestScopes = request?.scopes ?? [];\n\tconst isOpenIdRequest = requestScopes.includes(\"openid\");\n\tconst hasNonce = typeof request?.nonce === \"string\" && request.nonce.length > 0;\n\tconst hasOidcNonce = isOpenIdRequest && hasNonce;\n\tif (requestScopes.includes(\"offline_access\") && !hasOidcNonce) return \"pkce or OIDC nonce is required when requesting offline_access scope\";\n\tif (client.requirePKCE ?? true) return \"pkce is required for this client\";\n\treturn false;\n}\n//#endregion\nexport { collectExtensionAccessTokenClaims as A, validateOAuthProviderExtensions as B, storeToken as C, validateClientScopes as D, validateClientCredentials as E, getExtensionGrantHandler as F, getSupportedAuthMethods as I, getSupportedGrantTypes as L, collectExtensionUserInfoClaims as M, extendOAuthProvider as N, verifyOAuthQueryParams as O, getClientDiscoveries as P, hasUserInfoClaimExtension as R, storeClientSecret as S, toResourceList as T, removeMaxAgeFromQuery as _, getClient as a, resolveSubjectIdentifier as b, getStoredToken as c, mergeDiscoveryMetadata as d, normalizeClientAuthenticationParameters as f, parsePrompt as g, parseClientMetadata as h, extractClientCredentials as i, collectExtensionIdTokenClaims as j, applyOAuthProviderMetadataExtensions as k, isPKCERequired as l, parseBearerToken as m, decryptStoredClientSecret as n, getJwtPlugin as o, normalizeTimestampValue as p, destructureCredentials as r, getOAuthProviderPlugin as s, clientAllowsGrant as t, isSessionFreshForSignedQuery as u, removePromptFromQuery as v, toAudienceClaim as w, searchParamsToQuery as x, resolveSessionAuthTime as y, isExtensionTokenEndpointAuthMethod as z };\n","import { APIError as APIError$1 } from \"../error/index.mjs\";\nimport { APIError } from \"better-call\";\n//#region src/utils/is-api-error.ts\nfunction isAPIError(error) {\n\treturn error instanceof APIError || error instanceof APIError$1 || error?.name === \"APIError\";\n}\n//#endregion\nexport { isAPIError };\n","//#region src/async_hooks/index.ts\nlet cachedAsyncLocalStorageConstructor;\nlet availabilityWarningLogged = false;\nfunction getBuiltinAsyncLocalStorage() {\n\ttry {\n\t\treturn globalThis.process?.getBuiltinModule?.(\"node:async_hooks\")?.AsyncLocalStorage;\n\t} catch {\n\t\treturn;\n\t}\n}\nasync function getAsyncLocalStorage() {\n\tif (cachedAsyncLocalStorageConstructor) return cachedAsyncLocalStorageConstructor;\n\tconst builtinConstructor = getBuiltinAsyncLocalStorage();\n\tif (builtinConstructor) {\n\t\tcachedAsyncLocalStorageConstructor ??= builtinConstructor;\n\t\treturn cachedAsyncLocalStorageConstructor;\n\t}\n\ttry {\n\t\tconst { AsyncLocalStorage: constructor } = await import(\n\t\t\t/* @vite-ignore */\n\t\t\t/* webpackIgnore: true */\n\t\t\t\"node:async_hooks\"\n);\n\t\tcachedAsyncLocalStorageConstructor ??= constructor;\n\t\treturn cachedAsyncLocalStorageConstructor;\n\t} catch (err) {\n\t\tconst constructor = globalThis.AsyncLocalStorage;\n\t\tif (typeof constructor === \"function\") {\n\t\t\tcachedAsyncLocalStorageConstructor ??= constructor;\n\t\t\treturn cachedAsyncLocalStorageConstructor;\n\t\t}\n\t\tif (typeof window !== \"undefined\") throw new Error(\"getAsyncLocalStorage is only available in server code\");\n\t\tif (!availabilityWarningLogged) {\n\t\t\tavailabilityWarningLogged = true;\n\t\t\tconsole.warn(\"[better-auth] Warning: AsyncLocalStorage is not available in this environment. Some features may not work as expected.\");\n\t\t\tconsole.warn(\"[better-auth] Please read more about this warning at https://better-auth.com/docs/installation#mount-handler\");\n\t\t\tconsole.warn(\"[better-auth] If you are using Cloudflare Workers, please see: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#nodejs-compatibility-flag\");\n\t\t}\n\t\tthrow err;\n\t}\n}\n//#endregion\nexport { getAsyncLocalStorage };\n","import { __getBetterAuthGlobal, __getCurrentEndpointContext } from \"./global.mjs\";\nimport { getAsyncLocalStorage } from \"@better-auth/core/async_hooks\";\n//#region src/context/endpoint-context.ts\nconst getExistingEndpointContextStorage = () => {\n\treturn __getBetterAuthGlobal().context.endpointContextAsyncStorage;\n};\nconst getOrCreateEndpointContextStorage = async () => {\n\tconst existing = getExistingEndpointContextStorage();\n\tif (existing) return existing;\n\tconst AsyncLocalStorage = await getAsyncLocalStorage();\n\tconst globalContext = __getBetterAuthGlobal().context;\n\treturn globalContext.endpointContextAsyncStorage ??= new AsyncLocalStorage();\n};\n/**\n* @deprecated Use `getCurrentAuthEndpointContext`,\n* `tryGetCurrentAuthEndpointContext`, or `runWithEndpointContext` instead.\n*/\nasync function getCurrentAuthContextAsyncLocalStorage() {\n\treturn getOrCreateEndpointContextStorage();\n}\n/**\n* Returns the current auth endpoint context, or `undefined` when called outside\n* of `runWithEndpointContext`.\n*/\nfunction tryGetCurrentAuthEndpointContext() {\n\treturn __getCurrentEndpointContext();\n}\n/**\n* Returns the current auth endpoint context.\n*\n* @throws When called outside of `runWithEndpointContext`.\n*/\nfunction getCurrentAuthEndpointContext() {\n\tconst authEndpointContext = tryGetCurrentAuthEndpointContext();\n\tif (!authEndpointContext) throw new Error(\"No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.\");\n\treturn authEndpointContext;\n}\n/**\n* @deprecated Use `getCurrentAuthEndpointContext` instead.\n*/\nasync function getCurrentAuthContext() {\n\treturn getCurrentAuthEndpointContext();\n}\nasync function runWithEndpointContext(authEndpointContext, fn) {\n\treturn (await getOrCreateEndpointContextStorage()).run(authEndpointContext, fn);\n}\n//#endregion\nexport { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext };\n","import { runWithEndpointContext } from \"../context/endpoint-context.mjs\";\nimport { isAPIError } from \"../utils/is-api-error.mjs\";\nimport { createEndpoint, createMiddleware, kAPIErrorHeaderSymbol } from \"better-call\";\n//#region src/api/index.ts\n/**\n* Response headers that forbid any intermediary (proxy, CDN, browser) from\n* caching a response body. Credential-bearing responses (access/refresh tokens,\n* ID tokens, client secrets, device codes) must carry them.\n*\n* Set `metadata: { noStore: true }` on an endpoint and {@link createAuthEndpoint}\n* applies these to the responses its handler produces: the success body and any\n* error the handler throws. A request rejected by schema or media-type\n* validation before the handler runs is not covered, and carries no credentials\n* to protect. Spread them into a hand-built `Response` or `APIError`'s headers\n* for the rare endpoint that constructs its own response.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\n*/\nconst NO_STORE_HEADERS = {\n\t\"Cache-Control\": \"no-store\",\n\tPragma: \"no-cache\"\n};\n/**\n* Better-call's createEndpoint re-throws APIError without exposing the headers\n* accumulated on ctx.responseHeaders (e.g. Set-Cookie from deleteSessionCookie\n* before throw). Attach them to the error via kAPIErrorHeaderSymbol — matching\n* better-call's createMiddleware contract so the outer pipeline can merge them\n* into the response.\n*/\nfunction attachResponseHeadersToAPIError(responseHeaders, e) {\n\tif (!isAPIError(e) || !responseHeaders) return;\n\tObject.defineProperty(e, kAPIErrorHeaderSymbol, {\n\t\tenumerable: false,\n\t\tconfigurable: true,\n\t\tvalue: responseHeaders,\n\t\twritable: false\n\t});\n}\nconst optionsMiddleware = createMiddleware(async () => {\n\t/**\n\t* This will be passed on the instance of\n\t* the context. Used to infer the type\n\t* here.\n\t*/\n\treturn {};\n});\nconst createAuthMiddleware = createMiddleware.create({ use: [optionsMiddleware, createMiddleware(async () => {\n\treturn {};\n})] });\nconst createEndpointWithAuthContext = createEndpoint.create({ use: [optionsMiddleware] });\nfunction wrapEndpointHandler(handler, options) {\n\tconst noStore = options.metadata?.noStore === true;\n\treturn async (context) => {\n\t\tif (noStore) for (const [name, value] of Object.entries(NO_STORE_HEADERS)) context.setHeader(name, value);\n\t\ttry {\n\t\t\treturn await runWithEndpointContext(context, () => handler(context));\n\t\t} catch (error) {\n\t\t\tattachResponseHeadersToAPIError(context.responseHeaders, error);\n\t\t\tthrow error;\n\t\t}\n\t};\n}\nfunction createAuthEndpoint(...args) {\n\tif (args.length === 3) {\n\t\tconst [path, options, handler] = args;\n\t\treturn createEndpointWithAuthContext(path, options, wrapEndpointHandler(handler, options));\n\t}\n\tconst [options, handler] = args;\n\treturn createEndpointWithAuthContext(options, wrapEndpointHandler(handler, options));\n}\n/**\n* Set `metadata.SERVER_ONLY` while preserving any existing metadata\n* (`$Infer`, `openapi`, ...).\n*/\nfunction withServerOnly(options) {\n\treturn {\n\t\t...options,\n\t\tmetadata: {\n\t\t\t...options.metadata,\n\t\t\tSERVER_ONLY: true\n\t\t}\n\t};\n}\n/**\n* Declare a **server-only** endpoint.\n*\n* The endpoint is callable through `auth.api.*` from trusted server code but is\n* never registered on the HTTP router and never emitted into the OpenAPI\n* schema. It takes no path because it has no URL to be reached at.\n*\n* Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.\n* Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and\n* keeps the endpoint off the HTTP surface even if a path is later added by\n* mistake: better-call's router skips an endpoint when its path is missing *or*\n* when `SERVER_ONLY` is set, so the two together are defense in depth. Relying\n* on path omission alone is invisible and one keystroke away from exposure.\n*\n* @example\n* ```ts\n* viewBackupCodes: createAuthEndpoint.serverOnly(\n* \t{ method: \"POST\", body: schema },\n* \tasync (ctx) => { ... },\n* )\n* ```\n*/\ncreateAuthEndpoint.serverOnly = (options, handler) => createAuthEndpoint(withServerOnly(options), handler);\n//#endregion\nexport { NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };\n","//#region src/utils/wildcard.ts\n/**\n* Escapes a character if it has a special meaning in regular expressions\n* and returns the character as is if it doesn't\n*/\nfunction escapeRegExpChar(char) {\n\tif (char === \"-\" || char === \"^\" || char === \"$\" || char === \"+\" || char === \".\" || char === \"(\" || char === \")\" || char === \"|\" || char === \"[\" || char === \"]\" || char === \"{\" || char === \"}\" || char === \"*\" || char === \"?\" || char === \"\\\\\") return `\\\\${char}`;\n\telse return char;\n}\n/**\n* Escapes all characters in a given string that have a special meaning in regular expressions\n*/\nfunction escapeRegExpString(str) {\n\tlet result = \"\";\n\tfor (let i = 0; i < str.length; i++) result += escapeRegExpChar(str[i]);\n\treturn result;\n}\n/**\n* Transforms one or more glob patterns into a RegExp pattern\n*/\nfunction transform(pattern, separator = true) {\n\tif (Array.isArray(pattern)) return `(?:${pattern.map((p) => `^${transform(p, separator)}$`).join(\"|\")})`;\n\tlet separatorSplitter = \"\";\n\tlet separatorMatcher = \"\";\n\tlet wildcard = \".\";\n\tif (separator === true) {\n\t\tseparatorSplitter = \"/\";\n\t\tseparatorMatcher = \"[/\\\\\\\\]\";\n\t\twildcard = \"[^/\\\\\\\\]\";\n\t} else if (separator) {\n\t\tseparatorSplitter = separator;\n\t\tseparatorMatcher = escapeRegExpString(separatorSplitter);\n\t\tif (separatorMatcher.length > 1) {\n\t\t\tseparatorMatcher = `(?:${separatorMatcher})`;\n\t\t\twildcard = `((?!${separatorMatcher}).)`;\n\t\t} else wildcard = `[^${separatorMatcher}]`;\n\t}\n\tconst requiredSeparator = separator ? `${separatorMatcher}+?` : \"\";\n\tconst optionalSeparator = separator ? `${separatorMatcher}*?` : \"\";\n\tconst segments = separator ? pattern.split(separatorSplitter) : [pattern];\n\tlet result = \"\";\n\tfor (let s = 0; s < segments.length; s++) {\n\t\tconst segment = segments[s];\n\t\tconst nextSegment = segments[s + 1];\n\t\tlet currentSeparator = \"\";\n\t\tif (!segment && s > 0) continue;\n\t\tif (separator) if (s === segments.length - 1) currentSeparator = optionalSeparator;\n\t\telse if (nextSegment !== \"**\") currentSeparator = requiredSeparator;\n\t\telse currentSeparator = \"\";\n\t\tif (separator && segment === \"**\") {\n\t\t\tif (currentSeparator) {\n\t\t\t\tresult += s === 0 ? \"\" : currentSeparator;\n\t\t\t\tresult += `(?:${wildcard}*?${currentSeparator})*?`;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tfor (let c = 0; c < segment.length; c++) {\n\t\t\tconst char = segment[c];\n\t\t\tif (char === \"\\\\\") {\n\t\t\t\tif (c < segment.length - 1) {\n\t\t\t\t\tresult += escapeRegExpChar(segment[c + 1]);\n\t\t\t\t\tc++;\n\t\t\t\t}\n\t\t\t} else if (char === \"?\") result += wildcard;\n\t\t\telse if (char === \"*\") result += `${wildcard}*?`;\n\t\t\telse result += escapeRegExpChar(char);\n\t\t}\n\t\tresult += currentSeparator;\n\t}\n\treturn result;\n}\nfunction isMatch(regexp, sample) {\n\tif (typeof sample !== \"string\") throw new TypeError(`Sample must be a string, but ${typeof sample} given`);\n\treturn regexp.test(sample);\n}\n/**\n* Compiles one or more glob patterns into a RegExp and returns an isMatch function.\n* The isMatch function takes a sample string as its only argument and returns `true`\n* if the string matches the pattern(s).\n*\n* ```js\n* wildcardMatch('src/*.js')('src/index.js') //=> true\n* ```\n*\n* ```js\n* const isMatch = wildcardMatch('*.example.com', '.')\n* isMatch('foo.example.com') //=> true\n* isMatch('foo.bar.com') //=> false\n* ```\n*/\nfunction wildcardMatch(pattern, options) {\n\tif (typeof pattern !== \"string\" && !Array.isArray(pattern)) throw new TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof pattern} given`);\n\tif (typeof options === \"string\" || typeof options === \"boolean\") options = { separator: options };\n\tif (arguments.length === 2 && !(typeof options === \"undefined\" || typeof options === \"object\" && options !== null && !Array.isArray(options))) throw new TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof options} given`);\n\toptions = options || {};\n\tif (options.separator === \"\\\\\") throw new Error(\"\\\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead\");\n\tconst regexpPattern = transform(pattern, options.separator);\n\tconst regexp = new RegExp(`^${regexpPattern}$`, options.flags);\n\tconst fn = isMatch.bind(null, regexp);\n\tfn.options = options;\n\tfn.pattern = pattern;\n\tfn.regexp = regexp;\n\treturn fn;\n}\n//#endregion\nexport { wildcardMatch };\n","import { wildcardMatch } from \"./wildcard.mjs\";\nimport { env } from \"@better-auth/core/env\";\nimport { BetterAuthError } from \"@better-auth/core/error\";\n//#region src/utils/url.ts\nconst SLASH_CHAR_CODE = \"/\".charCodeAt(0);\n/**\n* Minimal loopback check for dev scheme inference only. Reachable from\n* `client/config.ts` via `getBaseURL`, so we MUST NOT import the full\n* `@better-auth/core/utils/host` classifier here: its `utils/ip` dependency\n* on zod would leak into the client bundle (see `e2e/smoke/test/vite.spec.ts`).\n*\n* Server-side SSRF/loopback checks (oauth redirect matching, trusted-origin\n* resolution, electron fetch gate) continue to use the authoritative\n* `isLoopbackHost` from `@better-auth/core/utils/host`. This helper's only\n* job is picking `http` vs `https` for dev ergonomics.\n*/\nfunction isLoopbackForDevScheme(host) {\n\tconst hostname = host.replace(/:\\d+$/, \"\").replace(/^\\[|\\]$/g, \"\").toLowerCase();\n\treturn hostname === \"localhost\" || hostname.endsWith(\".localhost\") || hostname === \"::1\" || hostname.startsWith(\"127.\");\n}\nfunction trimTrailingSlashes(value) {\n\tlet end = value.length;\n\twhile (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) end--;\n\treturn end === value.length ? value : value.slice(0, end);\n}\nfunction checkHasPath(url) {\n\ttry {\n\t\treturn (trimTrailingSlashes(new URL(url).pathname) || \"/\") !== \"/\";\n\t} catch {\n\t\tthrow new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);\n\t}\n}\nfunction assertHasProtocol(url) {\n\ttry {\n\t\tconst parsedUrl = new URL(url);\n\t\tif (parsedUrl.protocol !== \"http:\" && parsedUrl.protocol !== \"https:\") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);\n\t} catch (error) {\n\t\tif (error instanceof BetterAuthError) throw error;\n\t\tthrow new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error });\n\t}\n}\nfunction withPath(url, path = \"/api/auth\") {\n\tassertHasProtocol(url);\n\tif (checkHasPath(url)) return url;\n\tconst trimmedUrl = trimTrailingSlashes(url);\n\tif (!path || path === \"/\") return trimmedUrl;\n\tpath = path.startsWith(\"/\") ? path : `/${path}`;\n\treturn `${trimmedUrl}${path}`;\n}\nfunction validateProxyHeader(header, type) {\n\tif (!header || header.trim() === \"\") return false;\n\tif (type === \"proto\") return header === \"http\" || header === \"https\";\n\tif (type === \"host\") {\n\t\tif ([\n\t\t\t/\\.\\./,\n\t\t\t/\\0/,\n\t\t\t/[\\s]/,\n\t\t\t/^[.]/,\n\t\t\t/[<>'\"]/,\n\t\t\t/javascript:/i,\n\t\t\t/file:/i,\n\t\t\t/data:/i\n\t\t].some((pattern) => pattern.test(header))) return false;\n\t\treturn /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\\d{1,3}\\.){3}\\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\\[[0-9a-fA-F:]+\\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);\n\t}\n\treturn false;\n}\nfunction getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {\n\tif (url) return withPath(url, path);\n\tif (loadEnv !== false) {\n\t\tconst fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== \"/\" ? env.BASE_URL : void 0);\n\t\tif (fromEnv) return withPath(fromEnv, path);\n\t}\n\tconst fromRequest = request?.headers.get(\"x-forwarded-host\");\n\tconst fromRequestProto = request?.headers.get(\"x-forwarded-proto\");\n\tif (fromRequest && fromRequestProto && trustedProxyHeaders) {\n\t\tif (validateProxyHeader(fromRequestProto, \"proto\") && validateProxyHeader(fromRequest, \"host\")) try {\n\t\t\treturn withPath(`${fromRequestProto}://${fromRequest}`, path);\n\t\t} catch (_error) {}\n\t}\n\tif (request) {\n\t\tconst url = getOrigin(request.url);\n\t\tif (!url) throw new BetterAuthError(\"Could not get origin from request. Please provide a valid base URL.\");\n\t\treturn withPath(url, path);\n\t}\n\tif (typeof window !== \"undefined\" && window.location) return withPath(window.location.origin, path);\n}\nfunction getOrigin(url) {\n\ttry {\n\t\tconst parsedUrl = new URL(url);\n\t\treturn parsedUrl.origin === \"null\" ? null : parsedUrl.origin;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction getProtocol(url) {\n\ttry {\n\t\treturn new URL(url).protocol;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction getHost(url) {\n\ttry {\n\t\treturn new URL(url).host;\n\t} catch {\n\t\treturn null;\n\t}\n}\n/**\n* Checks if the baseURL config is a dynamic config object\n*/\nfunction isDynamicBaseURLConfig(config) {\n\treturn typeof config === \"object\" && config !== null && \"allowedHosts\" in config && Array.isArray(config.allowedHosts);\n}\n/**\n* Check if a value is a `Request`\n* - `instanceof`: works for native Request instances\n* - `toString`: handles where instanceof check fails but the object is still a\n*   valid Request (e.g. cross-realm, polyfills). Paired with a shape check so\n*   an object that only spoofs `Symbol.toStringTag` without the real shape is\n*   rejected before downstream code tries to read `.headers` / `.url`.\n*\n* @param value The value to check\n* @returns `true` if the value is a Request instance\n*/\nfunction isRequestLike(value) {\n\tif (value instanceof Request) return true;\n\tif (typeof value !== \"object\" || value === null || Object.prototype.toString.call(value) !== \"[object Request]\") return false;\n\tconst v = value;\n\treturn typeof v.url === \"string\" && typeof v.headers === \"object\" && v.headers !== null && typeof v.headers.get === \"function\";\n}\n/**\n* Extracts the host from a `Request` or `Headers`.\n* Honors `x-forwarded-host` only when `trustedProxyHeaders` is enabled,\n* then falls back to the `host` header and finally the request URL.\n*/\nfunction getHostFromSource(source, trustedProxyHeaders) {\n\tconst headers = isRequestLike(source) ? source.headers : source;\n\tif (trustedProxyHeaders) {\n\t\tconst forwardedHost = headers.get(\"x-forwarded-host\");\n\t\tif (forwardedHost && validateProxyHeader(forwardedHost, \"host\")) return forwardedHost;\n\t}\n\tconst host = headers.get(\"host\");\n\tif (host && validateProxyHeader(host, \"host\")) return host;\n\tif (isRequestLike(source)) try {\n\t\treturn new URL(source.url).host;\n\t} catch {\n\t\treturn null;\n\t}\n\treturn null;\n}\n/**\n* Extracts the protocol from a `Request` or `Headers`.\n* Honors `x-forwarded-proto` only when `trustedProxyHeaders` is enabled,\n* then falls back to the request URL, then to \"https\".\n*/\nfunction getProtocolFromSource(source, configProtocol, trustedProxyHeaders) {\n\tif (configProtocol === \"http\" || configProtocol === \"https\") return configProtocol;\n\tconst headers = isRequestLike(source) ? source.headers : source;\n\tif (trustedProxyHeaders) {\n\t\tconst forwardedProto = headers.get(\"x-forwarded-proto\");\n\t\tif (forwardedProto && validateProxyHeader(forwardedProto, \"proto\")) return forwardedProto;\n\t}\n\tif (isRequestLike(source)) try {\n\t\tconst url = new URL(source.url);\n\t\tif (url.protocol === \"http:\" || url.protocol === \"https:\") return url.protocol.slice(0, -1);\n\t} catch {}\n\tconst host = getHostFromSource(source, trustedProxyHeaders);\n\tif (host && isLoopbackForDevScheme(host)) return \"http\";\n\treturn \"https\";\n}\n/**\n* Matches a hostname against a host pattern.\n* Supports wildcard patterns like `*.vercel.app` or `preview-*.myapp.com`.\n*\n* @param host The hostname to test (e.g., \"myapp.com\", \"preview-123.vercel.app\")\n* @param pattern The host pattern (e.g., \"myapp.com\", \"*.vercel.app\")\n* @returns {boolean} true if the host matches the pattern, false otherwise.\n*\n* @example\n* ```ts\n* matchesHostPattern(\"myapp.com\", \"myapp.com\") // true\n* matchesHostPattern(\"preview-123.vercel.app\", \"*.vercel.app\") // true\n* matchesHostPattern(\"preview-123.myapp.com\", \"preview-*.myapp.com\") // true\n* matchesHostPattern(\"evil.com\", \"myapp.com\") // false\n* ```\n*/\nconst matchesHostPattern = (host, pattern) => {\n\tif (!host || !pattern) return false;\n\tconst normalizedHost = host.replace(/^https?:\\/\\//, \"\").split(\"/\")[0].toLowerCase();\n\tconst normalizedPattern = pattern.replace(/^https?:\\/\\//, \"\").split(\"/\")[0].toLowerCase();\n\tif (normalizedPattern.includes(\"*\") || normalizedPattern.includes(\"?\")) return wildcardMatch(normalizedPattern)(normalizedHost);\n\treturn normalizedHost.toLowerCase() === normalizedPattern.toLowerCase();\n};\n/**\n* Resolves the base URL from a dynamic config based on the incoming request.\n* Validates the derived host against the allowedHosts allowlist.\n*\n* @param config The dynamic base URL config\n* @param request The incoming request\n* @param basePath The base path to append\n* @returns The resolved base URL with path\n* @throws BetterAuthError if host is not in allowedHosts and no fallback is set\n*/\nfunction resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders) {\n\tconst host = getHostFromSource(source, trustedProxyHeaders);\n\tif (!host) {\n\t\tif (config.fallback) return withPath(config.fallback, basePath);\n\t\tthrow new BetterAuthError(\"Could not determine host from request headers. Please provide a fallback URL in your baseURL config.\");\n\t}\n\tif (config.allowedHosts.some((pattern) => matchesHostPattern(host, pattern))) return withPath(`${getProtocolFromSource(source, config.protocol, trustedProxyHeaders)}://${host}`, basePath);\n\tif (config.fallback) return withPath(config.fallback, basePath);\n\tthrow new BetterAuthError(`Host \"${host}\" is not in the allowed hosts list. Allowed hosts: ${config.allowedHosts.join(\", \")}. Add this host to your allowedHosts config or provide a fallback URL.`);\n}\n/**\n* Resolves the base URL from any config type (static string or dynamic object).\n* This is the main entry point for base URL resolution.\n*\n* @param config The base URL config (string or object)\n* @param basePath The base path to append\n* @param request Optional request for dynamic resolution\n* @param loadEnv Whether to load from environment variables\n* @param trustedProxyHeaders Whether to trust proxy headers (for legacy behavior)\n* @returns The resolved base URL with path\n*/\nfunction resolveBaseURL(config, basePath, source, loadEnv, trustedProxyHeaders) {\n\tif (isDynamicBaseURLConfig(config)) {\n\t\tif (source) return resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders);\n\t\tif (config.fallback) return withPath(config.fallback, basePath);\n\t\treturn getBaseURL(void 0, basePath, void 0, loadEnv, trustedProxyHeaders);\n\t}\n\tconst request = isRequestLike(source) ? source : void 0;\n\tif (typeof config === \"string\") return getBaseURL(config, basePath, request, loadEnv, trustedProxyHeaders);\n\treturn getBaseURL(void 0, basePath, request, loadEnv, trustedProxyHeaders);\n}\n//#endregion\nexport { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };\n","//#region src/utils/url.ts\n/**\n* Normalizes a request pathname by removing the basePath prefix and trailing slashes.\n* This is useful for matching paths against configured path lists.\n*\n* @param requestUrl - The full request URL\n* @param basePath - The base path of the auth API (e.g., \"/api/auth\")\n* @returns The normalized path without basePath prefix or trailing slashes,\n*          or \"/\" if URL parsing fails\n*\n* @example\n* normalizePathname(\"http://localhost:3000/api/auth/sso/saml2/callback/provider1\", \"/api/auth\")\n* // Returns: \"/sso/saml2/callback/provider1\"\n*\n* normalizePathname(\"http://localhost:3000/sso/saml2/callback/provider1/\", \"/\")\n* // Returns: \"/sso/saml2/callback/provider1\"\n*/\nfunction normalizePathname(requestUrl, basePath) {\n\tlet pathname;\n\ttry {\n\t\tpathname = new URL(requestUrl).pathname.replace(/\\/+$/, \"\") || \"/\";\n\t} catch {\n\t\treturn \"/\";\n\t}\n\tconst normalizedBasePath = basePath.replace(/\\/+$/, \"\");\n\tif (normalizedBasePath === \"\") return pathname;\n\tif (pathname === normalizedBasePath) return \"/\";\n\tif (pathname.startsWith(normalizedBasePath + \"/\")) return pathname.slice(normalizedBasePath.length).replace(/\\/+$/, \"\") || \"/\";\n\treturn pathname;\n}\nconst URL_REFERENCE_ORIGIN = \"https://better-auth.invalid\";\n/**\n* Appends query parameters before the fragment of an absolute or root-relative URL.\n* Existing query text is retained without parsing it into name-value pairs.\n*\n* This function only composes URLs. Callers must validate untrusted input.\n*\n* @throws TypeError if parsing fails or a relative input changes authority.\n*/\nfunction appendQueryParams(input, params) {\n\tconst relative = input.startsWith(\"/\");\n\tif (input.startsWith(\"//\") || input.startsWith(\"/\\\\\")) throw new TypeError(\"Expected an absolute or root-relative URL\");\n\tconst parsedURL = relative ? new URL(input, URL_REFERENCE_ORIGIN) : new URL(input);\n\tif (relative && parsedURL.origin !== URL_REFERENCE_ORIGIN) throw new TypeError(\"Expected an absolute or root-relative URL\");\n\tconst query = params.toString();\n\tif (!query) return input;\n\tconst separator = parsedURL.search.endsWith(\"&\") ? \"\" : \"&\";\n\tparsedURL.search = parsedURL.search ? `${parsedURL.search}${separator}${query}` : query;\n\treturn relative ? parsedURL.href.slice(parsedURL.origin.length) : parsedURL.href;\n}\n/**\n* Schemes that execute or embed code when navigated to or accepted as a\n* redirect target. These are never safe as an OAuth `redirect_uri` or as a\n* client-side navigation target (`window.location.href`, `location.assign`, ...).\n*/\nconst DANGEROUS_URL_SCHEMES = [\n\t\"javascript:\",\n\t\"data:\",\n\t\"vbscript:\"\n];\n/**\n* Returns `false` only when `value` is an absolute URL using a dangerous scheme\n* (`javascript:`, `data:`, `vbscript:`). Relative URLs (e.g. `/dashboard`) and\n* safe absolute schemes (`http`, `https`, custom app schemes such as\n* `myapp://`) return `true`.\n*\n* Use this to guard browser navigation sinks and any redirect target that may\n* originate from untrusted input. It is intentionally narrow: it blocks code\n* execution schemes without rejecting relative paths or mobile deep links.\n*/\nfunction isSafeUrlScheme(value) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\treturn true;\n\t}\n\treturn !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);\n}\n//#endregion\nexport { DANGEROUS_URL_SCHEMES, appendQueryParams, isSafeUrlScheme, normalizePathname };\n","import { isDevelopment, isTest } from \"../env/env-impl.mjs\";\nimport * as z from \"zod\";\n//#region src/utils/ip.ts\nconst ipv4Schema = z.ipv4();\nconst ipv6Schema = z.ipv6();\n/**\n* Checks if an IP is valid IPv4 or IPv6\n*/\nfunction isValidIP(ip) {\n\treturn isIPv4(ip) || isIPv6(ip);\n}\nfunction isIPv4(ip) {\n\treturn z.validate(ipv4Schema, ip);\n}\nfunction isIPv6(ip) {\n\treturn z.validate(ipv6Schema, ip);\n}\n/**\n* Converts IPv4-mapped IPv6 address to IPv4\n* e.g., \"::ffff:192.0.2.1\" -> \"192.0.2.1\"\n*/\nfunction extractIPv4FromMapped(ipv6) {\n\tconst lower = ipv6.toLowerCase();\n\tif (lower.startsWith(\"::ffff:\")) {\n\t\tconst ipv4Part = lower.substring(7);\n\t\tif (isIPv4(ipv4Part)) return ipv4Part;\n\t}\n\tconst parts = ipv6.split(\":\");\n\tif (parts.length === 7 && parts[5]?.toLowerCase() === \"ffff\") {\n\t\tconst ipv4Part = parts[6];\n\t\tif (ipv4Part && isIPv4(ipv4Part)) return ipv4Part;\n\t}\n\tif (lower.includes(\"::ffff:\") || lower.includes(\":ffff:\")) {\n\t\tconst groups = expandIPv6(ipv6);\n\t\tif (groups.length === 8 && groups[0] === \"0000\" && groups[1] === \"0000\" && groups[2] === \"0000\" && groups[3] === \"0000\" && groups[4] === \"0000\" && groups[5] === \"ffff\" && groups[6] && groups[7]) return `${Number.parseInt(groups[6].substring(0, 2), 16)}.${Number.parseInt(groups[6].substring(2, 4), 16)}.${Number.parseInt(groups[7].substring(0, 2), 16)}.${Number.parseInt(groups[7].substring(2, 4), 16)}`;\n\t}\n\treturn null;\n}\n/**\n* Expands a compressed IPv6 address to full form\n* e.g., \"2001:db8::1\" -> [\"2001\", \"0db8\", \"0000\", \"0000\", \"0000\", \"0000\", \"0000\", \"0001\"]\n*/\nfunction expandIPv6(ipv6) {\n\tif (ipv6.includes(\"::\")) {\n\t\tconst sides = ipv6.split(\"::\");\n\t\tconst left = sides[0] ? sides[0].split(\":\") : [];\n\t\tconst right = sides[1] ? sides[1].split(\":\") : [];\n\t\tconst missingGroups = 8 - left.length - right.length;\n\t\tconst zeros = Array(missingGroups).fill(\"0000\");\n\t\tconst paddedLeft = left.map((g) => g.padStart(4, \"0\"));\n\t\tconst paddedRight = right.map((g) => g.padStart(4, \"0\"));\n\t\treturn [\n\t\t\t...paddedLeft,\n\t\t\t...zeros,\n\t\t\t...paddedRight\n\t\t];\n\t}\n\treturn ipv6.split(\":\").map((g) => g.padStart(4, \"0\"));\n}\n/**\n* Normalizes an IPv6 address to canonical form\n* e.g., \"2001:DB8::1\" -> \"2001:0db8:0000:0000:0000:0000:0000:0001\"\n*/\nfunction normalizeIPv6(ipv6, subnetPrefix) {\n\tconst groups = expandIPv6(ipv6);\n\tif (subnetPrefix !== void 0 && subnetPrefix < 128) {\n\t\tlet bitsRemaining = Math.max(0, Math.floor(subnetPrefix));\n\t\treturn groups.map((group) => {\n\t\t\tif (bitsRemaining <= 0) return \"0000\";\n\t\t\tif (bitsRemaining >= 16) {\n\t\t\t\tbitsRemaining -= 16;\n\t\t\t\treturn group;\n\t\t\t}\n\t\t\tconst masked = Number.parseInt(group, 16) & (65535 << 16 - bitsRemaining & 65535);\n\t\t\tbitsRemaining = 0;\n\t\t\treturn masked.toString(16).padStart(4, \"0\");\n\t\t}).join(\":\").toLowerCase();\n\t}\n\treturn groups.join(\":\").toLowerCase();\n}\n/**\n* Normalizes an IP address (IPv4 or IPv6) for consistent rate limiting.\n*\n* @param ip - The IP address to normalize\n* @param options - Normalization options\n* @returns Normalized IP address\n*\n* @example\n* normalizeIP(\"2001:DB8::1\")\n* // -> \"2001:0db8:0000:0000:0000:0000:0000:0000\"\n*\n* @example\n* normalizeIP(\"::ffff:192.0.2.1\")\n* // -> \"192.0.2.1\" (converted to IPv4)\n*\n* @example\n* normalizeIP(\"2001:db8::1\", { ipv6Subnet: 64 })\n* // -> \"2001:0db8:0000:0000:0000:0000:0000:0000\" (subnet /64)\n*/\nfunction normalizeIP(ip, options = {}) {\n\tif (isIPv4(ip)) return ip.toLowerCase();\n\tif (!isIPv6(ip)) return ip.toLowerCase();\n\tconst ipv4 = extractIPv4FromMapped(ip);\n\tif (ipv4) return ipv4.toLowerCase();\n\treturn normalizeIPv6(ip, options.ipv6Subnet ?? 64);\n}\n/**\n* Raw bytes of an IP for CIDR comparison. Returns `null` for an invalid IP.\n*/\nfunction ipToBytes(ip) {\n\tif (isIPv4(ip)) return Uint8Array.from(ip.split(\".\").map((octet) => Number(octet)));\n\tif (!isIPv6(ip)) return null;\n\tconst mapped = extractIPv4FromMapped(ip);\n\tif (mapped) return Uint8Array.from(mapped.split(\".\").map((octet) => Number(octet)));\n\tconst groups = expandIPv6(ip);\n\tconst bytes = new Uint8Array(16);\n\tfor (let i = 0; i < 8; i++) {\n\t\tconst group = Number.parseInt(groups[i] ?? \"0\", 16);\n\t\tbytes[i * 2] = group >> 8 & 255;\n\t\tbytes[i * 2 + 1] = group & 255;\n\t}\n\treturn bytes;\n}\nconst CIDR_PREFIX_PATTERN = /^\\d+$/;\n/**\n* Parses an IP or `IP/prefix` string into network bytes and a prefix length.\n* The prefix must be digits only and within the address family. `null` if the\n* value is not a valid IP or CIDR range, which keeps a malformed entry from\n* silently behaving like a non-match.\n*/\nfunction parseCIDR(value) {\n\tconst slash = value.lastIndexOf(\"/\");\n\tconst bytes = ipToBytes(slash === -1 ? value : value.slice(0, slash));\n\tif (!bytes) return null;\n\tconst maxBits = bytes.length * 8;\n\tif (slash === -1) return {\n\t\tbytes,\n\t\tprefix: maxBits\n\t};\n\tconst prefixPart = value.slice(slash + 1);\n\tif (!CIDR_PREFIX_PATTERN.test(prefixPart)) return null;\n\tconst prefix = Number(prefixPart);\n\treturn prefix <= maxBits ? {\n\t\tbytes,\n\t\tprefix\n\t} : null;\n}\n/**\n* Whether `ipBytes` falls inside an already-parsed CIDR network.\n*/\nfunction matchesCIDR(ipBytes, net) {\n\tif (ipBytes.length !== net.bytes.length) return false;\n\tlet bitsRemaining = net.prefix;\n\tfor (let i = 0; i < ipBytes.length && bitsRemaining > 0; i++) {\n\t\tconst take = bitsRemaining >= 8 ? 8 : bitsRemaining;\n\t\tconst mask = take === 8 ? 255 : 255 << 8 - take & 255;\n\t\tif (((ipBytes[i] ?? 0) & mask) !== ((net.bytes[i] ?? 0) & mask)) return false;\n\t\tbitsRemaining -= 8;\n\t}\n\treturn true;\n}\n/**\n* Trusted-proxy entries that are not a valid IP address or CIDR range.\n*/\nfunction findInvalidTrustedProxies(entries) {\n\treturn entries.filter((entry) => parseCIDR(entry) === null);\n}\n/**\n* Resolves the client IP from a forwarded header. The leftmost token is spoofable,\n* so with `trustedProxies` the chain is stripped from the right to the first\n* untrusted hop. Otherwise only a single-value header is trusted. Returns `null`\n* when no trustworthy client IP can be resolved.\n*/\nfunction getIPFromHeader(value, options = {}) {\n\tconst forwardedIps = value.split(\",\").map((ip) => ip.trim()).filter(Boolean);\n\tif (forwardedIps.length === 0) return null;\n\tconst trustedProxies = (options.trustedProxies ?? []).map(parseCIDR).filter((proxy) => {\n\t\treturn proxy !== null;\n\t});\n\tif (trustedProxies.length > 0) {\n\t\tfor (let i = forwardedIps.length - 1; i >= 0; i--) {\n\t\t\tconst ip = forwardedIps[i];\n\t\t\tconst ipBytes = ip ? ipToBytes(ip) : null;\n\t\t\tif (!ip || !ipBytes) return null;\n\t\t\tif (trustedProxies.some((proxy) => matchesCIDR(ipBytes, proxy))) continue;\n\t\t\treturn normalizeIP(ip, { ipv6Subnet: options.ipv6Subnet });\n\t\t}\n\t\treturn null;\n\t}\n\tif (forwardedIps.length !== 1) return null;\n\tconst selectedIp = forwardedIps[0];\n\tif (!selectedIp || !isValidIP(selectedIp)) return null;\n\treturn normalizeIP(selectedIp, { ipv6Subnet: options.ipv6Subnet });\n}\nconst LOCALHOST_IP = \"127.0.0.1\";\nconst DEFAULT_IP_HEADERS = [\"x-forwarded-for\"];\n/**\n* Resolves the client IP for a request from the configured IP headers.\n* Honors `disableIpTracking`, walks `ipAddressHeaders` in order (default\n* `x-forwarded-for`), and falls back to localhost in development and test.\n* Returns `null` when tracking is disabled or no trustworthy IP can be resolved.\n*/\nfunction getIP(req, options) {\n\tif (options.advanced?.ipAddress?.disableIpTracking) return null;\n\tconst headers = \"headers\" in req ? req.headers : req;\n\tconst ipHeaders = options.advanced?.ipAddress?.ipAddressHeaders || DEFAULT_IP_HEADERS;\n\tfor (const key of ipHeaders) {\n\t\tconst value = \"get\" in headers ? headers.get(key) : headers[key];\n\t\tif (typeof value === \"string\") {\n\t\t\tconst ip = getIPFromHeader(value, {\n\t\t\t\tipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,\n\t\t\t\ttrustedProxies: options.advanced?.ipAddress?.trustedProxies\n\t\t\t});\n\t\t\tif (ip) return ip;\n\t\t}\n\t}\n\tif (isTest() || isDevelopment()) return LOCALHOST_IP;\n\treturn null;\n}\n/**\n* Creates a rate limit key from IP and path\n* Uses a separator to prevent collision attacks\n*\n* @param ip - The IP address (should be normalized)\n* @param path - The request path\n* @returns Rate limit key\n*/\nfunction createRateLimitKey(ip, path) {\n\treturn `${ip}|${path}`;\n}\n//#endregion\nexport { createRateLimitKey, findInvalidTrustedProxies, getIP, getIPFromHeader, isValidIP, normalizeIP };\n","import { __getBetterAuthGlobal } from \"./global.mjs\";\nimport { getAsyncLocalStorage } from \"@better-auth/core/async_hooks\";\n//#region src/context/request-state.ts\nconst ensureAsyncStorage = async () => {\n\tconst betterAuthGlobal = __getBetterAuthGlobal();\n\tconst existing = betterAuthGlobal.context.requestStateAsyncStorage;\n\tif (existing) return existing;\n\tconst AsyncLocalStorage = await getAsyncLocalStorage();\n\tbetterAuthGlobal.context.requestStateAsyncStorage ??= new AsyncLocalStorage();\n\treturn betterAuthGlobal.context.requestStateAsyncStorage;\n};\nasync function getRequestStateAsyncLocalStorage() {\n\treturn ensureAsyncStorage();\n}\nasync function hasRequestState() {\n\treturn (await ensureAsyncStorage()).getStore() !== void 0;\n}\nasync function getCurrentRequestState() {\n\tconst store = (await ensureAsyncStorage()).getStore();\n\tif (!store) throw new Error(\"No request state found. Please make sure you are calling this function within a `runWithRequestState` callback.\");\n\treturn store;\n}\nasync function runWithRequestState(store, fn) {\n\treturn (await ensureAsyncStorage()).run(store, fn);\n}\nfunction defineRequestState(initFn) {\n\tconst ref = Object.freeze({});\n\treturn {\n\t\tget ref() {\n\t\t\treturn ref;\n\t\t},\n\t\tasync get() {\n\t\t\tconst store = await getCurrentRequestState();\n\t\t\tif (!store.has(ref)) {\n\t\t\t\tconst initialValue = await initFn();\n\t\t\t\tstore.set(ref, initialValue);\n\t\t\t\treturn initialValue;\n\t\t\t}\n\t\t\treturn store.get(ref);\n\t\t},\n\t\tasync set(value) {\n\t\t\t(await getCurrentRequestState()).set(ref, value);\n\t\t}\n\t};\n}\n//#endregion\nexport { defineRequestState, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, runWithRequestState };\n","import { __getBetterAuthGlobal } from \"./global.mjs\";\nimport { runtimeSchemaCheckFor } from \"../db/schema-check.mjs\";\nimport { logger } from \"../env/logger.mjs\";\nimport { getAsyncLocalStorage } from \"@better-auth/core/async_hooks\";\n//#region src/context/transaction.ts\nconst ensureAsyncStorage = async () => {\n\tconst betterAuthGlobal = __getBetterAuthGlobal();\n\tconst existing = betterAuthGlobal.context.adapterAsyncStorage;\n\tif (existing) return existing;\n\tconst AsyncLocalStorage = await getAsyncLocalStorage();\n\tbetterAuthGlobal.context.adapterAsyncStorage ??= new AsyncLocalStorage();\n\treturn betterAuthGlobal.context.adapterAsyncStorage;\n};\n/**\n* This is for internal use only. Most users should use `getCurrentAdapter` instead.\n*\n* It is exposed for advanced use cases where you need direct access to the AsyncLocalStorage instance.\n*/\nconst getCurrentDBAdapterAsyncLocalStorage = async () => {\n\treturn ensureAsyncStorage();\n};\nconst getCurrentAdapter = async (fallback) => {\n\treturn ensureAsyncStorage().then((als) => {\n\t\treturn als.getStore()?.adapter || fallback;\n\t}).catch(() => {\n\t\treturn fallback;\n\t});\n};\nconst runWithAdapter = async (adapter, fn) => {\n\tlet called = false;\n\treturn ensureAsyncStorage().then(async (als) => {\n\t\tcalled = true;\n\t\tconst pendingHooks = [];\n\t\tlet result;\n\t\tlet error;\n\t\tlet hasError = false;\n\t\ttry {\n\t\t\tresult = await als.run({\n\t\t\t\tadapter,\n\t\t\t\tpendingHooks,\n\t\t\t\tisTransactionActive: false\n\t\t\t}, fn);\n\t\t} catch (err) {\n\t\t\terror = err;\n\t\t\thasError = true;\n\t\t}\n\t\tfor (const hook of pendingHooks) await hook();\n\t\tif (hasError) throw error;\n\t\treturn result;\n\t}).catch((err) => {\n\t\tif (!called) return fn();\n\t\tthrow err;\n\t});\n};\n/**\n* Runs `fn` in a transaction on `adapter`, joining the current one when\n* already inside it, then runs the hooks queued with\n* `queueAfterTransactionHook` once the work commits.\n*\n* When the adapter has no real transaction (`transaction: false`), writes are\n* applied as they happen and cannot roll back, so queued hooks also run when\n* `fn` throws. The original error is still rethrown; a hook failure on that\n* path goes to `onAfterCommitHookError`, or is logged when none is given.\n*/\nconst runWithTransaction = async (adapter, fn, options) => {\n\tlet called = false;\n\treturn ensureAsyncStorage().then(async (als) => {\n\t\tcalled = true;\n\t\tif (als.getStore()?.isTransactionActive) return fn();\n\t\tconst pendingSchemaCheck = runtimeSchemaCheckFor(adapter)?.();\n\t\tif (pendingSchemaCheck) await pendingSchemaCheck;\n\t\tlet pendingHooks = [];\n\t\tlet result;\n\t\tlet error;\n\t\tlet hasError = false;\n\t\ttry {\n\t\t\tresult = await adapter.transaction(async (trx) => {\n\t\t\t\tpendingHooks = [];\n\t\t\t\treturn als.run({\n\t\t\t\t\tadapter: trx,\n\t\t\t\t\tpendingHooks,\n\t\t\t\t\tisTransactionActive: true\n\t\t\t\t}, fn);\n\t\t\t});\n\t\t} catch (e) {\n\t\t\thasError = true;\n\t\t\terror = e;\n\t\t}\n\t\tconst runPendingHooks = async (unhandledErrors) => {\n\t\t\tfor (const hook of pendingHooks) try {\n\t\t\t\tawait hook();\n\t\t\t} catch (hookError) {\n\t\t\t\tif (!options?.onAfterCommitHookError) {\n\t\t\t\t\tif (unhandledErrors === \"throw\") throw hookError;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tlogger.error(\"Failed to run an after-commit hook for work that could not roll back\", hookError);\n\t\t\t\t\t} catch {}\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tawait options.onAfterCommitHookError(hookError);\n\t\t\t\t} catch {}\n\t\t\t}\n\t\t};\n\t\tif (hasError) {\n\t\t\tif (adapter.options?.adapterConfig.transaction === false) await runPendingHooks(\"log\");\n\t\t\tthrow error;\n\t\t}\n\t\tawait runPendingHooks(\"throw\");\n\t\treturn result;\n\t}).catch((err) => {\n\t\tif (!called) return fn();\n\t\tthrow err;\n\t});\n};\n/**\n* Queue a hook to be executed after the current transaction commits.\n* If not in a transaction, the hook will execute immediately.\n*\n* When the adapter has no real transaction (`transaction: false`), the hook\n* also runs if the surrounding work fails, since its writes were kept.\n*/\nconst queueAfterTransactionHook = async (hook, options) => {\n\tconst executeHook = async () => {\n\t\ttry {\n\t\t\tawait hook();\n\t\t} catch (error) {\n\t\t\tif (!options?.onError) throw error;\n\t\t\tawait options.onError(error);\n\t\t}\n\t};\n\tlet storage;\n\ttry {\n\t\tstorage = await ensureAsyncStorage();\n\t} catch {\n\t\treturn executeHook();\n\t}\n\tconst store = storage.getStore();\n\tif (!store?.isTransactionActive) return executeHook();\n\tstore.pendingHooks.push(executeHook);\n};\n//#endregion\nexport { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, queueAfterTransactionHook, runWithAdapter, runWithTransaction };\n","import { defineRequestState } from \"@better-auth/core/context\";\n//#region src/api/state/oauth.ts\nconst { get: getRawOAuthState, set: setOAuthState } = defineRequestState(() => null);\n/**\n* Reads the OAuth state for the current request. During a callback it holds the\n* state parsed from the provider redirect; during sign-in it holds the state\n* just generated.\n*\n* Top-level keys beyond the documented fields are client-supplied\n* (`additionalData`) and must not be trusted. Server-trusted values live under\n* {@link OAuthState.serverContext}.\n*/\nconst getOAuthState = async () => {\n\treturn await getRawOAuthState();\n};\n/**\n* @internal Read accumulated server context to embed during state generation.\n*/\nconst { get: getOAuthServerContext, set: setOAuthServerContext } = defineRequestState(() => null);\n/**\n* Attaches server-trusted data to the current OAuth flow so it survives the\n* provider redirect. Call this from a `before` hook on an OAuth sign-in path\n* (for example `/sign-in/social` or `/sign-in/oauth2`). `generateState` embeds\n* the accumulated values into the state, and they become readable on the\n* callback via `getOAuthState().serverContext`.\n*\n* Unlike the request body's `additionalData`, values set here cannot be spoofed\n* by the client. Multiple callers merge: each call adds its own keys. Values are\n* stored as `unknown`, so narrow their shape when reading them back.\n*/\nconst addOAuthServerContext = async (values) => {\n\tawait setOAuthServerContext({\n\t\t...await getOAuthServerContext() ?? {},\n\t\t...values\n\t});\n};\n//#endregion\nexport { addOAuthServerContext, getOAuthServerContext, getOAuthState, setOAuthState };\n","import { defineRequestState } from \"@better-auth/core/context\";\n//#region src/api/state/should-session-refresh.ts\n/**\n* State for skipping session refresh\n*\n* In some cases, such as when using server-side rendering (SSR) or when dealing with\n* certain types of requests, it may be necessary to skip session refresh to prevent\n* potential inconsistencies between the session data in the database and the session\n* data stored in cookies.\n*/\nconst { get: getShouldSkipSessionRefresh, set: setShouldSkipSessionRefresh } = defineRequestState(() => false);\n//#endregion\nexport { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh };\n","//#region src/context/store-capabilities.ts\nfunction hasServerSessionStore(options) {\n\treturn !!options.database || !!options.secondaryStorage;\n}\nfunction hasServerAccountStore(options) {\n\treturn !!options.database;\n}\nfunction shouldBindAccountCookieToSessionUser(options) {\n\treturn hasServerAccountStore(options);\n}\n//#endregion\nexport { hasServerSessionStore, shouldBindAccountCookieToSessionUser };\n","import * as z from \"zod\";\n//#region src/db/schema/shared.ts\nconst coreSchema = z.object({\n\tid: z.string(),\n\tcreatedAt: z.date().default(() => /* @__PURE__ */ new Date()),\n\tupdatedAt: z.date().default(() => /* @__PURE__ */ new Date())\n});\n//#endregion\nexport { coreSchema };\n","import { coreSchema } from \"./shared.mjs\";\nimport * as z from \"zod\";\n//#region src/db/schema/session.ts\nconst sessionSchema = coreSchema.extend({\n\tuserId: z.coerce.string(),\n\texpiresAt: z.date(),\n\ttoken: z.string(),\n\tipAddress: z.string().nullish(),\n\tuserAgent: z.string().nullish()\n});\n//#endregion\nexport { sessionSchema };\n","import { coreSchema } from \"./shared.mjs\";\nimport * as z from \"zod\";\n//#region src/db/schema/user.ts\nconst userSchema = coreSchema.extend({\n\temail: z.string().transform((val) => val.toLowerCase()),\n\temailVerified: z.boolean().default(false),\n\tname: z.string(),\n\timage: z.string().nullish()\n});\n//#endregion\nexport { userSchema };\n","//#region src/utils/db.ts\n/**\n* Filters output data by removing fields with the `returned: false` attribute.\n* This ensures sensitive fields are not exposed in API responses.\n*/\nfunction filterOutputFields(data, additionalFields) {\n\tif (!data || !additionalFields) return data;\n\tconst returnFiltered = Object.entries(additionalFields).filter(([, { returned }]) => returned === false).map(([key]) => key);\n\treturn Object.entries(structuredClone(data)).filter(([key]) => !returnFiltered.includes(key)).reduce((acc, [key, value]) => ({\n\t\t...acc,\n\t\t[key]: value\n\t}), {});\n}\n//#endregion\nexport { filterOutputFields };\n","import { getAuthTables } from \"@better-auth/core/db\";\nimport { APIError, BASE_ERROR_CODES } from \"@better-auth/core/error\";\nimport { filterOutputFields } from \"@better-auth/core/utils/db\";\n//#region src/db/schema.ts\nconst cache = /* @__PURE__ */ new WeakMap();\nfunction getFields(options, modelName, mode) {\n\tconst cacheKey = `${modelName}:${mode}`;\n\tif (!cache.has(options)) cache.set(options, /* @__PURE__ */ new Map());\n\tconst tableCache = cache.get(options);\n\tif (tableCache.has(cacheKey)) return tableCache.get(cacheKey);\n\tconst coreSchema = mode === \"output\" ? getAuthTables(options)[modelName]?.fields ?? {} : {};\n\tconst additionalFields = modelName === \"user\" || modelName === \"session\" || modelName === \"account\" ? options[modelName]?.additionalFields : void 0;\n\tlet schema = {\n\t\t...coreSchema,\n\t\t...additionalFields ?? {}\n\t};\n\tfor (const plugin of options.plugins || []) if (plugin.schema && plugin.schema[modelName]) schema = {\n\t\t...schema,\n\t\t...plugin.schema[modelName].fields\n\t};\n\ttableCache.set(cacheKey, schema);\n\treturn schema;\n}\nfunction parseUserOutput(options, user) {\n\treturn filterOutputFields(user, getFields(options, \"user\", \"output\"));\n}\n/**\n* Builds a synthetic user object that matches the shape of a real user\n* returned from the database. This ensures enumeration protection works\n* correctly by making synthetic and real user responses indistinguishable.\n*\n* The function iterates over the user output schema and:\n* - Includes all fields that should be returned (returned !== false)\n* - Uses provided values when available\n* - Sets optional fields to null when no value is provided\n* - Applies default values where defined\n* - Always includes the 'id' field (not part of schema but always present)\n*/\nfunction buildSyntheticUserOutput(options, data) {\n\tconst schema = getFields(options, \"user\", \"output\");\n\tconst result = {};\n\tfor (const key in schema) {\n\t\tconst fieldAttr = schema[key];\n\t\tif (fieldAttr.returned === false) continue;\n\t\tif (key in data && data[key] !== void 0) result[key] = data[key];\n\t\telse if (fieldAttr.defaultValue !== void 0) result[key] = typeof fieldAttr.defaultValue === \"function\" ? fieldAttr.defaultValue() : fieldAttr.defaultValue;\n\t\telse if (!fieldAttr.required) result[key] = null;\n\t}\n\tif (\"id\" in data) result.id = data.id;\n\treturn result;\n}\nfunction parseSessionOutput(options, session) {\n\treturn filterOutputFields(session, getFields(options, \"session\", \"output\"));\n}\nfunction parseAccountOutput(options, account) {\n\tconst { accessToken: _accessToken, refreshToken: _refreshToken, idToken: _idToken, accessTokenExpiresAt: _accessTokenExpiresAt, refreshTokenExpiresAt: _refreshTokenExpiresAt, password: _password, ...rest } = filterOutputFields(account, getFields(options, \"account\", \"output\"));\n\treturn rest;\n}\nfunction parseInputData(data, schema) {\n\tconst action = schema.action || \"create\";\n\tconst fields = schema.fields;\n\tconst parsedData = Object.create(null);\n\tfor (const key in fields) {\n\t\tif (key in data) {\n\t\t\tif (fields[key].input === false) {\n\t\t\t\tif (fields[key].defaultValue !== void 0) {\n\t\t\t\t\tif (action !== \"update\") {\n\t\t\t\t\t\tparsedData[key] = fields[key].defaultValue;\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (data[key]) throw APIError.from(\"BAD_REQUEST\", {\n\t\t\t\t\t...BASE_ERROR_CODES.FIELD_NOT_ALLOWED,\n\t\t\t\t\tmessage: `${key} is not allowed to be set`\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (fields[key].validator?.input && data[key] !== void 0) {\n\t\t\t\tconst result = fields[key].validator.input[\"~standard\"].validate(data[key]);\n\t\t\t\tif (result instanceof Promise) throw APIError.from(\"INTERNAL_SERVER_ERROR\", BASE_ERROR_CODES.ASYNC_VALIDATION_NOT_SUPPORTED);\n\t\t\t\tif (\"issues\" in result && result.issues) throw APIError.from(\"BAD_REQUEST\", {\n\t\t\t\t\t...BASE_ERROR_CODES.VALIDATION_ERROR,\n\t\t\t\t\tmessage: result.issues[0]?.message || \"Validation Error\"\n\t\t\t\t});\n\t\t\t\tparsedData[key] = result.value;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (fields[key].transform?.input && data[key] !== void 0) {\n\t\t\t\tparsedData[key] = fields[key].transform?.input(data[key]);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tparsedData[key] = data[key];\n\t\t\tcontinue;\n\t\t}\n\t\tif (fields[key].defaultValue !== void 0 && action === \"create\") {\n\t\t\tif (typeof fields[key].defaultValue === \"function\") {\n\t\t\t\tparsedData[key] = fields[key].defaultValue();\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tparsedData[key] = fields[key].defaultValue;\n\t\t\tcontinue;\n\t\t}\n\t\tif (fields[key].required && action === \"create\") throw APIError.from(\"BAD_REQUEST\", {\n\t\t\t...BASE_ERROR_CODES.MISSING_FIELD,\n\t\t\tmessage: `${key} is required`\n\t\t});\n\t}\n\treturn parsedData;\n}\nfunction parseUserInput(options, user = {}, action) {\n\treturn parseInputData(user, {\n\t\tfields: getFields(options, \"user\", \"input\"),\n\t\taction\n\t});\n}\nfunction parseAdditionalUserInputFromProviderProfile(options, profile = {}, action) {\n\tconst schema = getFields(options, \"user\", \"input\");\n\tconst allowedProfileFields = Object.create(null);\n\tfor (const key of Object.keys(profile)) {\n\t\tif (schema[key]?.input === false) continue;\n\t\tallowedProfileFields[key] = profile[key];\n\t}\n\treturn parseInputData(allowedProfileFields, {\n\t\tfields: schema,\n\t\taction\n\t});\n}\nfunction parseAdditionalUserInput(options, user) {\n\tconst schema = getFields(options, \"user\", \"input\");\n\treturn parseInputData(user || {}, { fields: schema });\n}\nfunction parseAccountInput(options, account) {\n\treturn parseInputData(account, { fields: getFields(options, \"account\", \"input\") });\n}\nfunction parseSessionInput(options, session, action) {\n\treturn parseInputData(session, {\n\t\tfields: getFields(options, \"session\", \"input\"),\n\t\taction\n\t});\n}\nfunction getSessionDefaultFields(options) {\n\tconst fields = getFields(options, \"session\", \"input\");\n\tconst defaults = {};\n\tfor (const key in fields) if (fields[key].defaultValue !== void 0) defaults[key] = typeof fields[key].defaultValue === \"function\" ? fields[key].defaultValue() : fields[key].defaultValue;\n\treturn defaults;\n}\nfunction mergeSchema(schema, newSchema) {\n\tif (!newSchema) return schema;\n\tfor (const table in newSchema) {\n\t\tconst newModelName = newSchema[table]?.modelName;\n\t\tif (newModelName) schema[table].modelName = newModelName;\n\t\tfor (const field in schema[table].fields) {\n\t\t\tconst newField = newSchema[table]?.fields?.[field];\n\t\t\tif (!newField) continue;\n\t\t\tschema[table].fields[field].fieldName = newField;\n\t\t}\n\t}\n\treturn schema;\n}\n//#endregion\nexport { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };\n","//#region src/utils/date.ts\nconst getDate = (span, unit = \"ms\") => {\n\treturn new Date(Date.now() + (unit === \"sec\" ? span * 1e3 : span));\n};\n//#endregion\nexport { getDate };\n","//#region src/cookies/cookie-utils.ts\nfunction tryDecode(str) {\n\tif (str.indexOf(\"%\") === -1) return str;\n\ttry {\n\t\treturn decodeURIComponent(str);\n\t} catch {\n\t\treturn str;\n\t}\n}\nconst SECURE_COOKIE_PREFIX = \"__Secure-\";\nconst HOST_COOKIE_PREFIX = \"__Host-\";\n/**\n* Remove __Secure- or __Host- prefix from cookie name.\n*/\nfunction stripSecureCookiePrefix(cookieName) {\n\tif (cookieName.startsWith(\"__Secure-\")) return cookieName.slice(9);\n\tif (cookieName.startsWith(\"__Host-\")) return cookieName.slice(7);\n\treturn cookieName;\n}\n/**\n* Split a comma-joined `Set-Cookie` header string into individual cookies.\n*/\nfunction splitSetCookieHeader(setCookie) {\n\tif (!setCookie) return [];\n\tconst result = [];\n\tlet start = 0;\n\tlet i = 0;\n\twhile (i < setCookie.length) {\n\t\tif (setCookie[i] === \",\") {\n\t\t\tlet j = i + 1;\n\t\t\twhile (j < setCookie.length && setCookie[j] === \" \") j++;\n\t\t\twhile (j < setCookie.length && setCookie[j] !== \"=\" && setCookie[j] !== \";\" && setCookie[j] !== \",\") j++;\n\t\t\tif (j < setCookie.length && setCookie[j] === \"=\") {\n\t\t\t\tconst part = setCookie.slice(start, i).trim();\n\t\t\t\tif (part) result.push(part);\n\t\t\t\tstart = i + 1;\n\t\t\t\twhile (start < setCookie.length && setCookie[start] === \" \") start++;\n\t\t\t\ti = start;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\t\ti++;\n\t}\n\tconst last = setCookie.slice(start).trim();\n\tif (last) result.push(last);\n\treturn result;\n}\nfunction parseSetCookieHeader(setCookie) {\n\tconst cookies = /* @__PURE__ */ new Map();\n\tsplitSetCookieHeader(setCookie).forEach((cookieString) => {\n\t\tconst [nameValue, ...attributes] = cookieString.split(\";\").map((part) => part.trim());\n\t\tconst [name, ...valueParts] = (nameValue || \"\").split(\"=\");\n\t\tconst value = unquoteCookieValue(valueParts.join(\"=\"));\n\t\tif (!name) return;\n\t\tconst attrObj = { value: tryDecode(value) };\n\t\tattributes.forEach((attribute) => {\n\t\t\tconst [attrName, ...attrValueParts] = attribute.split(\"=\");\n\t\t\tconst attrValue = attrValueParts.join(\"=\");\n\t\t\tconst normalizedAttrName = attrName.trim().toLowerCase();\n\t\t\tswitch (normalizedAttrName) {\n\t\t\t\tcase \"max-age\":\n\t\t\t\t\tattrObj[\"max-age\"] = attrValue ? parseInt(attrValue.trim(), 10) : void 0;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"expires\":\n\t\t\t\t\tattrObj.expires = attrValue ? new Date(attrValue.trim()) : void 0;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"domain\":\n\t\t\t\t\tattrObj.domain = attrValue ? attrValue.trim() : void 0;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"path\":\n\t\t\t\t\tattrObj.path = attrValue ? attrValue.trim() : void 0;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"secure\":\n\t\t\t\t\tattrObj.secure = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"httponly\":\n\t\t\t\t\tattrObj.httponly = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"samesite\":\n\t\t\t\t\tattrObj.samesite = attrValue ? attrValue.trim().toLowerCase() : void 0;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"partitioned\":\n\t\t\t\t\tattrObj.partitioned = true;\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\tattrObj[normalizedAttrName] = attrValue ? attrValue.trim() : true;\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t});\n\t\tcookies.set(name, attrObj);\n\t});\n\treturn cookies;\n}\nfunction toCookieOptions(attributes) {\n\treturn {\n\t\tmaxAge: attributes[\"max-age\"],\n\t\texpires: attributes.expires,\n\t\tdomain: attributes.domain,\n\t\tpath: attributes.path,\n\t\tsecure: attributes.secure,\n\t\thttpOnly: attributes.httponly,\n\t\tsameSite: attributes.samesite,\n\t\tpartitioned: attributes.partitioned\n\t};\n}\n/**\n* Cookie-name token char set per RFC 7230 §3.2.6.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6\n*/\nconst cookieNameRegex = /^[\\x21\\x23-\\x27\\x2A\\x2B\\x2D\\x2E\\x30-\\x39\\x41-\\x5A\\x5E\\x5F\\x60\\x61-\\x7A\\x7C\\x7E]+$/;\n/**\n* Cookie-value char set per RFC 6265 §4.1.1, plus space and comma.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1\n* @see https://github.com/golang/go/issues/7243\n*/\nconst cookieValueRegex = /^[\\x20\\x21\\x23-\\x3A\\x3C-\\x5B\\x5D-\\x7E]*$/;\n/**\n* Strip surrounding double-quotes per RFC 6265 §4.1.1 quoted-string form.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1\n*/\nfunction unquoteCookieValue(value) {\n\tif (value.length < 2 || !value.startsWith(\"\\\"\") || !value.endsWith(\"\\\"\")) return value;\n\treturn value.slice(1, -1);\n}\n/**\n* Trim leading/trailing OWS (space / horizontal tab) per RFC 7230 §3.2.3.\n* Narrower than `String.prototype.trim()`, which strips CR/LF and other\n* whitespace and would let CTLs escape `cookieValueRegex`.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.3\n*/\nfunction trimOWS(s) {\n\tlet start = 0;\n\tlet end = s.length;\n\twhile (start < end) {\n\t\tconst c = s.charCodeAt(start);\n\t\tif (c !== 32 && c !== 9) break;\n\t\tstart++;\n\t}\n\twhile (end > start) {\n\t\tconst c = s.charCodeAt(end - 1);\n\t\tif (c !== 32 && c !== 9) break;\n\t\tend--;\n\t}\n\treturn start === 0 && end === s.length ? s : s.slice(start, end);\n}\n/**\n* Tolerates `;` separators without the SP that RFC 6265 §4.2.1 mandates,\n* since proxies and runtimes commonly strip it. Silently drops entries\n* whose name violates RFC 7230 token or whose value violates RFC 6265\n* cookie-octet (plus space and comma). Strips optional surrounding\n* double-quotes per RFC 6265 §4.1.1.\n*/\nfunction parseCookies(cookie) {\n\tconst cookieMap = /* @__PURE__ */ new Map();\n\tif (cookie.length < 2) return cookieMap;\n\tfor (const chunk of cookie.split(\";\")) {\n\t\tconst eq = chunk.indexOf(\"=\");\n\t\tif (eq === -1) continue;\n\t\tconst key = trimOWS(chunk.slice(0, eq));\n\t\tconst val = unquoteCookieValue(trimOWS(chunk.slice(eq + 1)));\n\t\tif (cookieNameRegex.test(key) && cookieValueRegex.test(val)) cookieMap.set(key, tryDecode(val));\n\t}\n\treturn cookieMap;\n}\n/**\n* Add or replace a cookie in the request `Cookie` header.\n*\n* Cookie pairs are joined with `; `, but `headers.append(\"cookie\", ...)`\n* joins with `, ` in some runtimes (e.g. Deno, Cloudflare Workers) and\n* breaks downstream cookie parsing. This builds the header value via\n* parse-mutate-serialize.\n*/\nfunction setRequestCookie(headers, name, value) {\n\tconst cookieMap = parseCookies(headers.get(\"cookie\") || \"\");\n\tif (cookieNameRegex.test(name)) cookieMap.set(name, value);\n\theaders.set(\"cookie\", Array.from(cookieMap, ([k, v]) => `${k}=${encodeURIComponent(v)}`).join(\"; \"));\n}\n/**\n* Merge `Set-Cookie` header values into the target's `Cookie` header.\n* Mutates `target`.\n*\n* Name/value-level merge only. RFC 6265 §5 user-agent semantics\n* (expiration, domain/path scoping, ordering) are out of scope. Suitable\n* for single-request proxy, middleware, and test contexts.\n*/\nfunction applySetCookies(target, setCookieValues) {\n\tconst cookieMap = parseCookies(target.get(\"cookie\") || \"\");\n\tfor (const setCookie of setCookieValues) for (const [name, attr] of parseSetCookieHeader(setCookie)) if (cookieNameRegex.test(name)) cookieMap.set(name, attr.value);\n\ttarget.set(\"cookie\", Array.from(cookieMap, ([k, v]) => `${k}=${encodeURIComponent(v)}`).join(\"; \"));\n}\nfunction setCookieToHeader(headers) {\n\treturn (context) => {\n\t\tconst setCookieHeader = context.response.headers.get(\"set-cookie\");\n\t\tif (!setCookieHeader) return;\n\t\tapplySetCookies(headers, [setCookieHeader]);\n\t};\n}\n//#endregion\nexport { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, parseCookies, parseSetCookieHeader, setCookieToHeader, setRequestCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions };\n","import { symmetricDecodeJWT, symmetricEncodeJWT } from \"../crypto/jwt.mjs\";\nimport { parseCookies } from \"./cookie-utils.mjs\";\nimport { safeJSONParse } from \"@better-auth/core/utils/json\";\nimport { serializeCookie } from \"better-call\";\nimport * as z from \"zod\";\n//#region src/cookies/session-store.ts\n/**\n* Per-cookie byte ceiling.\n* Safari's ~4093 floor is the lowest among browsers.\n* Kept a little under it for attributes added after sizing.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc6265#section-6.1\n* @see https://github.com/dotnet/aspnetcore/blob/aa5493528640932601bb82ef3295e4d8ca7e11c5/src/Shared/ChunkingCookieManager/ChunkingCookieManager.cs#L40\n*/\nconst MAX_COOKIE_SIZE = 4050;\n/**\n* Max chunks per cookie.\n* A larger value does not belong in a cookie.\n*/\nconst MAX_COOKIE_CHUNKS = 100;\n/**\n* Largest value that keeps the serialized cookie within {@link MAX_COOKIE_SIZE},\n* measured with the real `serializeCookie` writer so it stays in sync with the\n* wire. Non-positive when the name and attributes alone overflow.\n*/\nfunction getMaxCookieValueSize(name, options) {\n\treturn MAX_COOKIE_SIZE - serializeCookie(name, \"\", { ...options }).length;\n}\nfunction parseCookieChunkIndex(cookieName, name) {\n\tconst prefix = `${cookieName}.`;\n\tif (!name.startsWith(prefix)) return null;\n\tconst suffix = name.slice(prefix.length);\n\tconst index = Number(suffix);\n\tif (!Number.isSafeInteger(index) || index < 0 || String(index) !== suffix) return null;\n\treturn index;\n}\n/**\n* Read all existing chunks from cookies\n*/\nfunction readExistingChunks(cookieName, ctx) {\n\tconst chunks = {};\n\tconst cookies = parseCookies(ctx.headers?.get(\"cookie\") || \"\");\n\tfor (const [name, value] of cookies) {\n\t\tif (name !== cookieName && parseCookieChunkIndex(cookieName, name) === null) continue;\n\t\tchunks[name] = value;\n\t}\n\treturn chunks;\n}\n/**\n* Split a cookie value into chunks if needed\n*/\nfunction chunkCookie(storeName, cookie, chunks, logger) {\n\tconst chunkSize = getMaxCookieValueSize(`${cookie.name}.${MAX_COOKIE_CHUNKS - 1}`, cookie.attributes);\n\tconst chunkCount = chunkSize > 0 ? Math.ceil(cookie.value.length / chunkSize) : Infinity;\n\tif (chunkCount <= 1) {\n\t\tchunks[cookie.name] = cookie.value;\n\t\treturn [cookie];\n\t}\n\tif (chunkCount > MAX_COOKIE_CHUNKS) {\n\t\tlogger.warn(`${storeName} cookie is too large to store even after chunking, so the cookie cache was skipped. Reduce the cached data size or avoid storing this data in cookies.`);\n\t\treturn [];\n\t}\n\tconst cookies = [];\n\tfor (let i = 0; i < chunkCount; i++) {\n\t\tconst name = `${cookie.name}.${i}`;\n\t\tconst start = i * chunkSize;\n\t\tconst value = cookie.value.substring(start, start + chunkSize);\n\t\tcookies.push({\n\t\t\t...cookie,\n\t\t\tname,\n\t\t\tvalue\n\t\t});\n\t\tchunks[name] = value;\n\t}\n\tlogger.debug(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {\n\t\tmessage: `${storeName} cookie exceeds the ${MAX_COOKIE_SIZE} byte limit and was split into ${chunkCount} chunks.`,\n\t\tvalueSize: cookie.value.length,\n\t\tchunkCount,\n\t\tchunkSizes: cookies.map((c) => c.value.length)\n\t});\n\treturn cookies;\n}\n/**\n* Get all cookies that should be cleaned (removed)\n*/\nfunction getCleanCookies(chunks, cookieOptions) {\n\tconst cleanedChunks = {};\n\tfor (const name in chunks) cleanedChunks[name] = {\n\t\tname,\n\t\tvalue: \"\",\n\t\tattributes: {\n\t\t\t...cookieOptions,\n\t\t\tmaxAge: 0\n\t\t}\n\t};\n\treturn cleanedChunks;\n}\n/**\n* Store that splits a cookie into numbered chunks when its serialized form\n* would exceed the per-cookie byte limit, expiring stale chunks as needed.\n*\n* @see https://github.com/nextauthjs/next-auth/blob/27b2519b84b8eb9cf053775dea29d577d2aa0098/packages/next-auth/src/core/lib/cookie.ts\n*/\nconst storeFactory = (storeName) => (cookieName, cookieOptions, ctx) => {\n\tconst chunks = readExistingChunks(cookieName, ctx);\n\tconst logger = ctx.context.logger;\n\tconst expireExistingChunks = () => {\n\t\tconst expired = getCleanCookies(chunks, cookieOptions);\n\t\tfor (const name in chunks) delete chunks[name];\n\t\treturn expired;\n\t};\n\treturn {\n\t\tchunk(value, options) {\n\t\t\tconst cookies = expireExistingChunks();\n\t\t\tconst chunked = chunkCookie(storeName, {\n\t\t\t\tname: cookieName,\n\t\t\t\tvalue,\n\t\t\t\tattributes: {\n\t\t\t\t\t...cookieOptions,\n\t\t\t\t\t...options\n\t\t\t\t}\n\t\t\t}, chunks, logger);\n\t\t\tfor (const chunk of chunked) cookies[chunk.name] = chunk;\n\t\t\treturn Object.values(cookies);\n\t\t},\n\t\tclean() {\n\t\t\treturn Object.values(expireExistingChunks());\n\t\t},\n\t\tsetCookies(cookies) {\n\t\t\tfor (const cookie of cookies) ctx.setCookie(cookie.name, cookie.value, cookie.attributes);\n\t\t}\n\t};\n};\nconst createSessionStore = storeFactory(\"Session\");\nconst createAccountStore = storeFactory(\"Account\");\nfunction getChunkedCookie(ctx, cookieName) {\n\tconst value = ctx.getCookie(cookieName);\n\tif (value) return value;\n\tconst chunks = [];\n\tconst cookieHeader = ctx.headers?.get(\"cookie\");\n\tif (!cookieHeader) return null;\n\tfor (const [name, val] of parseCookies(cookieHeader)) {\n\t\tconst index = parseCookieChunkIndex(cookieName, name);\n\t\tif (index === null) continue;\n\t\tchunks.push({\n\t\t\tindex,\n\t\t\tvalue: val\n\t\t});\n\t}\n\tif (chunks.length > 0) {\n\t\tchunks.sort((a, b) => a.index - b.index);\n\t\treturn chunks.map((c) => c.value).join(\"\");\n\t}\n\treturn null;\n}\nasync function setAccountCookie(c, accountData) {\n\tconst accountDataCookie = c.context.authCookies.accountData;\n\tconst options = {\n\t\tmaxAge: 300,\n\t\t...accountDataCookie.attributes\n\t};\n\tconst data = await symmetricEncodeJWT(accountData, c.context.secretConfig, \"better-auth-account\", options.maxAge);\n\tconst accountStore = createAccountStore(accountDataCookie.name, options, c);\n\taccountStore.setCookies(accountStore.chunk(data, options));\n}\nasync function getAccountCookie(c) {\n\tconst accountCookie = getChunkedCookie(c, c.context.authCookies.accountData.name);\n\tif (accountCookie) {\n\t\tconst accountData = safeJSONParse(await symmetricDecodeJWT(accountCookie, c.context.secretConfig, \"better-auth-account\"));\n\t\tif (accountData) return accountData;\n\t}\n\treturn null;\n}\nconst getSessionQuerySchema = z.optional(z.object({\n\t/**\n\t* If cookie cache is enabled, it will disable the cache\n\t* and fetch the session from the database\n\t*/\n\tdisableCookieCache: z.coerce.boolean().meta({ description: \"Disable cookie cache and fetch session from database\" }).optional(),\n\tdisableRefresh: z.coerce.boolean().meta({ description: \"Disable session refresh. Useful for checking session status, without updating the session\" }).optional()\n}));\n//#endregion\nexport { createAccountStore, createSessionStore, getAccountCookie, getChunkedCookie, getSessionQuerySchema, setAccountCookie };\n","//#region src/utils/is-promise.ts\nfunction isPromise(obj) {\n\treturn !!obj && (typeof obj === \"object\" || typeof obj === \"function\") && typeof obj.then === \"function\";\n}\n//#endregion\nexport { isPromise };\n","//#region src/utils/time.ts\nconst SEC = 1e3;\nconst MIN = SEC * 60;\nconst HOUR = MIN * 60;\nconst DAY = HOUR * 24;\nconst WEEK = DAY * 7;\nconst MONTH = DAY * 30;\nconst YEAR = DAY * 365.25;\nconst REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|months?|mo|years?|yrs?|y)(?: (ago|from now))?$/i;\nfunction parse(value) {\n\tconst match = REGEX.exec(value);\n\tif (!match || match[4] && match[1]) throw new TypeError(`Invalid time string format: \"${value}\". Use formats like \"7d\", \"30m\", \"1 hour\", etc.`);\n\tconst n = parseFloat(match[2]);\n\tconst unit = match[3].toLowerCase();\n\tlet result;\n\tswitch (unit) {\n\t\tcase \"years\":\n\t\tcase \"year\":\n\t\tcase \"yrs\":\n\t\tcase \"yr\":\n\t\tcase \"y\":\n\t\t\tresult = n * YEAR;\n\t\t\tbreak;\n\t\tcase \"months\":\n\t\tcase \"month\":\n\t\tcase \"mo\":\n\t\t\tresult = n * MONTH;\n\t\t\tbreak;\n\t\tcase \"weeks\":\n\t\tcase \"week\":\n\t\tcase \"w\":\n\t\t\tresult = n * WEEK;\n\t\t\tbreak;\n\t\tcase \"days\":\n\t\tcase \"day\":\n\t\tcase \"d\":\n\t\t\tresult = n * DAY;\n\t\t\tbreak;\n\t\tcase \"hours\":\n\t\tcase \"hour\":\n\t\tcase \"hrs\":\n\t\tcase \"hr\":\n\t\tcase \"h\":\n\t\t\tresult = n * HOUR;\n\t\t\tbreak;\n\t\tcase \"minutes\":\n\t\tcase \"minute\":\n\t\tcase \"mins\":\n\t\tcase \"min\":\n\t\tcase \"m\":\n\t\t\tresult = n * MIN;\n\t\t\tbreak;\n\t\tcase \"seconds\":\n\t\tcase \"second\":\n\t\tcase \"secs\":\n\t\tcase \"sec\":\n\t\tcase \"s\":\n\t\t\tresult = n * SEC;\n\t\t\tbreak;\n\t\tdefault: throw new TypeError(`Unknown time unit: \"${unit}\"`);\n\t}\n\tif (match[1] === \"-\" || match[4] === \"ago\") return -result;\n\treturn result;\n}\n/**\n* Parse a time string and return the value in milliseconds.\n*\n* @param value - A time string like \"7d\", \"30m\", \"1 hour\", \"2 hours ago\"\n* @returns The parsed value in milliseconds\n* @throws TypeError if the string format is invalid\n*\n* @example\n* ms(\"1d\")          // 86400000\n* ms(\"2 hours\")     // 7200000\n* ms(\"30s\")         // 30000\n* ms(\"2 hours ago\") // -7200000\n*/\nfunction ms(value) {\n\treturn parse(value);\n}\n/**\n* Parse a time string and return the value in seconds.\n*\n* @param value - A time string like \"7d\", \"30m\", \"1 hour\", \"2 hours ago\"\n* @returns The parsed value in seconds (rounded)\n* @throws TypeError if the string format is invalid\n*\n* @example\n* sec(\"1d\")          // 86400\n* sec(\"2 hours\")     // 7200\n* sec(\"-30s\")        // -30\n* sec(\"2 hours ago\") // -7200\n*/\nfunction sec(value) {\n\treturn Math.round(parse(value) / 1e3);\n}\n//#endregion\nexport { ms, sec };\n","import { sessionSchema, userSchema } from \"@better-auth/core/db\";\nimport { logger } from \"@better-auth/core/env\";\nimport { safeJSONParse } from \"@better-auth/core/utils/json\";\nimport * as z from \"zod\";\n//#region src/cookies/cache.ts\nconst cookieCachePayloadSchema = z.looseObject({\n\tsession: sessionSchema.loose(),\n\tuser: userSchema.loose(),\n\tupdatedAt: z.number(),\n\tversion: z.string().optional()\n});\nconst compactCookieCacheSchema = z.object({\n\tsession: z.record(z.string(), z.unknown()),\n\texpiresAt: z.number(),\n\tsignature: z.string()\n});\nfunction parseCookieCachePayload(value) {\n\tconst parsed = safeJSONParse(value);\n\tif (parsed === null) return null;\n\tconst result = cookieCachePayloadSchema.safeParse(parsed);\n\tif (result.success) return result.data;\n\tlogger.warn(\"Cookie cache payload failed schema validation\", { issues: result.error.issues.map(({ code, path }) => ({\n\t\tcode,\n\t\tpath\n\t})) });\n\treturn null;\n}\nfunction parseCompactCookieCache(value) {\n\tconst result = compactCookieCacheSchema.safeParse(value);\n\treturn result.success ? result.data : null;\n}\n//#endregion\nexport { parseCompactCookieCache, parseCookieCachePayload };\n","//#region src/binary.ts\nconst decoders = /* @__PURE__ */ new Map();\nconst encoder = new TextEncoder();\nconst binary = {\n\tdecode: (data, encoding = \"utf-8\") => {\n\t\tif (!decoders.has(encoding)) decoders.set(encoding, new TextDecoder(encoding));\n\t\treturn decoders.get(encoding).decode(data);\n\t},\n\tencode: (input) => encoder.encode(input)\n};\n//#endregion\nexport { binary };\n","import { getWebcryptoSubtle } from \"./index.mjs\";\nimport { toBufferSource } from \"./bytes.mjs\";\nimport { base64, base64Url } from \"./base64.mjs\";\nimport { hex } from \"./hex.mjs\";\n//#region src/hmac.ts\nconst createHMAC = (algorithm = \"SHA-256\", encoding = \"none\") => {\n\tconst hmac = {\n\t\timportKey: async (key, keyUsage) => {\n\t\t\treturn getWebcryptoSubtle().importKey(\"raw\", toBufferSource(key), {\n\t\t\t\tname: \"HMAC\",\n\t\t\t\thash: { name: algorithm }\n\t\t\t}, false, [keyUsage]);\n\t\t},\n\t\tsign: async (hmacKey, data) => {\n\t\t\tif (typeof hmacKey === \"string\") hmacKey = await hmac.importKey(hmacKey, \"sign\");\n\t\t\tconst signature = await getWebcryptoSubtle().sign(\"HMAC\", hmacKey, toBufferSource(data));\n\t\t\tif (encoding === \"hex\") return hex.encode(signature);\n\t\t\tif (encoding === \"base64\") return base64.encode(signature);\n\t\t\tif (encoding === \"base64url\" || encoding === \"base64urlnopad\") return base64Url.encode(signature, { padding: encoding !== \"base64urlnopad\" });\n\t\t\treturn signature;\n\t\t},\n\t\tverify: async (hmacKey, data, signature) => {\n\t\t\tif (typeof hmacKey === \"string\") hmacKey = await hmac.importKey(hmacKey, \"verify\");\n\t\t\tif (encoding === \"hex\") signature = typeof signature === \"string\" ? hex.toBytes(signature) : signature;\n\t\t\tif (encoding === \"base64\" || encoding === \"base64url\" || encoding === \"base64urlnopad\") signature = await base64.decode(signature);\n\t\t\treturn getWebcryptoSubtle().verify(\"HMAC\", hmacKey, toBufferSource(signature), toBufferSource(data));\n\t\t}\n\t};\n\treturn hmac;\n};\n//#endregion\nexport { createHMAC };\n","import { isDynamicBaseURLConfig } from \"../utils/url.mjs\";\nimport { shouldBindAccountCookieToSessionUser } from \"../context/store-capabilities.mjs\";\nimport { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from \"../crypto/jwt.mjs\";\nimport { parseUserOutput } from \"../db/schema.mjs\";\nimport { getDate } from \"../utils/date.mjs\";\nimport { isPromise } from \"../utils/is-promise.mjs\";\nimport { sec } from \"../utils/time.mjs\";\nimport { parseCompactCookieCache, parseCookieCachePayload } from \"./cache.mjs\";\nimport { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, parseCookies, parseSetCookieHeader, setCookieToHeader, setRequestCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions } from \"./cookie-utils.mjs\";\nimport { verifySessionCookieJwtWithJwks } from \"./jwt.mjs\";\nimport { createAccountStore, createSessionStore, getAccountCookie, getChunkedCookie, setAccountCookie } from \"./session-store.mjs\";\nimport { env, isProduction } from \"@better-auth/core/env\";\nimport { BetterAuthError } from \"@better-auth/core/error\";\nimport { safeJSONParse } from \"@better-auth/core/utils/json\";\nimport { filterOutputFields } from \"@better-auth/core/utils/db\";\nimport { base64Url } from \"@better-auth/utils/base64\";\nimport { binary } from \"@better-auth/utils/binary\";\nimport { createHMAC } from \"@better-auth/utils/hmac\";\n//#region src/cookies/index.ts\nfunction createCookieGetter(options) {\n\tconst baseURLString = typeof options.baseURL === \"string\" ? options.baseURL : void 0;\n\tconst dynamicProtocol = typeof options.baseURL === \"object\" && options.baseURL !== null ? options.baseURL.protocol : void 0;\n\tconst secureCookiePrefix = (options.advanced?.useSecureCookies !== void 0 ? options.advanced?.useSecureCookies : dynamicProtocol === \"https\" ? true : dynamicProtocol === \"http\" ? false : baseURLString ? baseURLString.startsWith(\"https://\") : isProduction) ? SECURE_COOKIE_PREFIX : \"\";\n\tconst crossSubdomainEnabled = !!options.advanced?.crossSubDomainCookies?.enabled;\n\tconst domain = crossSubdomainEnabled ? options.advanced?.crossSubDomainCookies?.domain || (baseURLString ? new URL(baseURLString).hostname : void 0) : void 0;\n\tif (crossSubdomainEnabled && !domain && !isDynamicBaseURLConfig(options.baseURL)) throw new BetterAuthError(\"baseURL is required when crossSubdomainCookies are enabled.\");\n\tfunction createCookie(cookieName, overrideAttributes = {}) {\n\t\tconst prefix = options.advanced?.cookiePrefix || \"better-auth\";\n\t\tconst name = options.advanced?.cookies?.[cookieName]?.name || `${prefix}.${cookieName}`;\n\t\tconst attributes = options.advanced?.cookies?.[cookieName]?.attributes ?? {};\n\t\treturn {\n\t\t\tname: `${secureCookiePrefix}${name}`,\n\t\t\tattributes: {\n\t\t\t\tsecure: !!secureCookiePrefix,\n\t\t\t\tsameSite: \"lax\",\n\t\t\t\tpath: \"/\",\n\t\t\t\thttpOnly: true,\n\t\t\t\t...crossSubdomainEnabled ? { domain } : {},\n\t\t\t\t...options.advanced?.defaultCookieAttributes,\n\t\t\t\t...overrideAttributes,\n\t\t\t\t...attributes\n\t\t\t}\n\t\t};\n\t}\n\treturn createCookie;\n}\nfunction getCookies(options) {\n\tconst createCookie = createCookieGetter(options);\n\tconst sessionToken = createCookie(\"session_token\", { maxAge: options.session?.expiresIn || sec(\"7d\") });\n\tconst sessionData = createCookie(\"session_data\", { maxAge: options.session?.cookieCache?.maxAge || 300 });\n\tconst accountData = createCookie(\"account_data\", { maxAge: options.session?.cookieCache?.maxAge || 300 });\n\tconst dontRememberToken = createCookie(\"dont_remember\");\n\treturn {\n\t\tsessionToken: {\n\t\t\tname: sessionToken.name,\n\t\t\tattributes: sessionToken.attributes\n\t\t},\n\t\t/**\n\t\t* This cookie is used to store the session data in the cookie\n\t\t* This is useful for when you want to cache the session in the cookie\n\t\t*/\n\t\tsessionData: {\n\t\t\tname: sessionData.name,\n\t\t\tattributes: sessionData.attributes\n\t\t},\n\t\tdontRememberToken: {\n\t\t\tname: dontRememberToken.name,\n\t\t\tattributes: dontRememberToken.attributes\n\t\t},\n\t\taccountData: {\n\t\t\tname: accountData.name,\n\t\t\tattributes: accountData.attributes\n\t\t}\n\t};\n}\nasync function setCookieCache(ctx, session, dontRememberMe) {\n\tif (!ctx.context.options.session?.cookieCache?.enabled) return;\n\tconst filteredSession = filterOutputFields(session.session, ctx.context.options.session?.additionalFields);\n\tconst filteredUser = parseUserOutput(ctx.context.options, session.user);\n\tconst versionConfig = ctx.context.options.session?.cookieCache?.version;\n\tlet version = \"1\";\n\tif (versionConfig) {\n\t\tif (typeof versionConfig === \"string\") version = versionConfig;\n\t\telse if (typeof versionConfig === \"function\") {\n\t\t\tconst result = versionConfig(session.session, session.user);\n\t\t\tversion = isPromise(result) ? await result : result;\n\t\t}\n\t}\n\tconst sessionData = {\n\t\tsession: filteredSession,\n\t\tuser: filteredUser,\n\t\tupdatedAt: Date.now(),\n\t\tversion\n\t};\n\tconst options = {\n\t\t...ctx.context.authCookies.sessionData.attributes,\n\t\tmaxAge: dontRememberMe ? void 0 : ctx.context.authCookies.sessionData.attributes.maxAge\n\t};\n\tconst expiresAtDate = getDate(options.maxAge || 60, \"sec\").getTime();\n\tconst strategy = ctx.context.options.session?.cookieCache?.strategy || \"compact\";\n\tlet data;\n\tif (strategy === \"jwe\") data = await symmetricEncodeJWT(sessionData, ctx.context.secretConfig, \"better-auth-session\", options.maxAge || 300);\n\telse if (strategy === \"jwt\") {\n\t\tconst cookieCacheSigner = ctx.context.sessionConfig.cookieCacheSigner;\n\t\tdata = cookieCacheSigner ? await cookieCacheSigner.sign(ctx, sessionData, options.maxAge || 300) : await signJWT(sessionData, ctx.context.secret, options.maxAge || 300);\n\t} else data = base64Url.encode(JSON.stringify({\n\t\tsession: sessionData,\n\t\texpiresAt: expiresAtDate,\n\t\tsignature: await createHMAC(\"SHA-256\", \"base64urlnopad\").sign(ctx.context.secret, JSON.stringify({\n\t\t\t...sessionData,\n\t\t\texpiresAt: expiresAtDate\n\t\t}))\n\t}), { padding: false });\n\tconst sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);\n\tsessionStore.setCookies(sessionStore.chunk(data, options));\n\tif (ctx.context.options.account?.storeAccountCookie && !hasPendingSetCookie(ctx, ctx.context.authCookies.accountData.name)) {\n\t\tconst accountData = await getAccountCookie(ctx);\n\t\tif (accountData) if (!shouldBindAccountCookieToSessionUser(ctx.context.options) || accountData.userId === session.user.id) await setAccountCookie(ctx, accountData);\n\t\telse {\n\t\t\texpireCookie(ctx, ctx.context.authCookies.accountData);\n\t\t\tconst accountStore = createAccountStore(ctx.context.authCookies.accountData.name, ctx.context.authCookies.accountData.attributes, ctx);\n\t\t\taccountStore.setCookies(accountStore.clean());\n\t\t}\n\t}\n}\nasync function decodeCookieCache(ctx, value) {\n\tconst strategy = ctx.context.options.session?.cookieCache?.strategy || \"compact\";\n\tif (strategy === \"jwe\") {\n\t\tconst decoded = await symmetricDecodeJWT(value, ctx.context.secretConfig, \"better-auth-session\");\n\t\tconst payload = parseCookieCachePayload(decoded);\n\t\tif (!payload) return null;\n\t\treturn {\n\t\t\tsession: payload,\n\t\t\texpiresAt: decoded?.exp ? decoded.exp * 1e3 : Date.now()\n\t\t};\n\t}\n\tif (strategy === \"jwt\") {\n\t\tconst cookieCacheSigner = ctx.context.sessionConfig.cookieCacheSigner;\n\t\tif (cookieCacheSigner) {\n\t\t\tconst verified = await cookieCacheSigner.verify(ctx, value);\n\t\t\tif (!verified) return null;\n\t\t\treturn {\n\t\t\t\tsession: verified.payload,\n\t\t\t\texpiresAt: verified.expiresAt\n\t\t\t};\n\t\t}\n\t\tconst decoded = await verifyJWT(value, ctx.context.secret);\n\t\tconst payload = parseCookieCachePayload(decoded);\n\t\tif (!payload) return null;\n\t\treturn {\n\t\t\tsession: payload,\n\t\t\texpiresAt: decoded?.exp ? decoded.exp * 1e3 : Date.now()\n\t\t};\n\t}\n\tconst parsed = parseCompactCookieCache(safeJSONParse(binary.decode(base64Url.decode(value))));\n\tif (!parsed) return null;\n\tif (!await createHMAC(\"SHA-256\", \"base64urlnopad\").verify(ctx.context.secret, JSON.stringify({\n\t\t...parsed.session,\n\t\texpiresAt: parsed.expiresAt\n\t}), parsed.signature)) return null;\n\tconst payload = parseCookieCachePayload(parsed.session);\n\treturn payload ? {\n\t\tsession: payload,\n\t\texpiresAt: parsed.expiresAt\n\t} : null;\n}\nasync function setSessionCookie(ctx, session, dontRememberMe, overrides) {\n\tconst dontRememberMeCookie = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);\n\tdontRememberMe = dontRememberMe !== void 0 ? dontRememberMe : !!dontRememberMeCookie;\n\tconst options = ctx.context.authCookies.sessionToken.attributes;\n\tconst maxAge = dontRememberMe ? void 0 : ctx.context.sessionConfig.expiresIn;\n\tawait ctx.setSignedCookie(ctx.context.authCookies.sessionToken.name, session.session.token, ctx.context.secret, {\n\t\t...options,\n\t\tmaxAge,\n\t\t...overrides\n\t});\n\tif (dontRememberMe) await ctx.setSignedCookie(ctx.context.authCookies.dontRememberToken.name, \"true\", ctx.context.secret, ctx.context.authCookies.dontRememberToken.attributes);\n\tawait setCookieCache(ctx, session, dontRememberMe);\n\tctx.context.setNewSession(session);\n}\n/**\n* Remove any prior `Set-Cookie` entries on the current response whose cookie\n* name matches `cookieName` or any chunked variant (`${cookieName}.0`, etc.).\n*\n* Prevents a valid cookie value from leaking on the wire when the same cookie\n* is set and then expired within a single request (e.g. `/sign-in/email`\n* writes credential session cookies and the 2FA after-hook expires them).\n* Browsers honor the expiring entry, but anything reading the raw response\n* headers — proxy/LB logs, server-side SDK consumers, observability tools —\n* sees the earlier valid value and could replay it (bypassing the 2FA gate\n* when the cookie cache is enabled).\n*\n* Scrubs both the local middleware scope's `responseHeaders` and the outer\n* endpoint scope's `ctx.context.responseHeaders`, because plugin after-hooks\n* run in a fresh local scope while accumulated response headers live on the\n* outer one. `scoped.context` is required by {@link GenericEndpointContext}\n* but unit-test mocks pass a minimal object via `as any`, so we use optional\n* chaining defensively. The `Set` collapses the case where both scopes\n* reference the same `Headers`.\n*/\nfunction removeSetCookieEntries(ctx, cookieName) {\n\tconst scoped = ctx;\n\tconst targets = /* @__PURE__ */ new Set();\n\tif (scoped.responseHeaders) targets.add(scoped.responseHeaders);\n\tif (scoped.context?.responseHeaders) targets.add(scoped.context.responseHeaders);\n\tconst exact = `${cookieName}=`;\n\tconst chunk = `${cookieName}.`;\n\tfor (const headers of targets) {\n\t\tconst existing = typeof headers.getSetCookie === \"function\" ? headers.getSetCookie() : splitSetCookieHeader(headers.get(\"set-cookie\") || \"\");\n\t\tif (!existing.length) continue;\n\t\tconst survivors = existing.filter((entry) => !entry.startsWith(exact) && !entry.startsWith(chunk));\n\t\tif (survivors.length === existing.length) continue;\n\t\theaders.delete(\"set-cookie\");\n\t\tfor (const entry of survivors) headers.append(\"set-cookie\", entry);\n\t}\n}\n/**\n* Whether the response already has a pending `Set-Cookie` for `cookieName`\n* or a chunked variant.\n*/\nfunction hasPendingSetCookie(ctx, cookieName) {\n\tconst scoped = ctx;\n\tconst targets = /* @__PURE__ */ new Set();\n\tif (scoped.responseHeaders) targets.add(scoped.responseHeaders);\n\tif (scoped.context?.responseHeaders) targets.add(scoped.context.responseHeaders);\n\tconst exact = `${cookieName}=`;\n\tconst chunk = `${cookieName}.`;\n\tfor (const headers of targets) if ((typeof headers.getSetCookie === \"function\" ? headers.getSetCookie() : splitSetCookieHeader(headers.get(\"set-cookie\") || \"\")).some((entry) => entry.startsWith(exact) || entry.startsWith(chunk))) return true;\n\treturn false;\n}\n/**\n* Expires a cookie by setting `maxAge: 0` while preserving its attributes\n*/\nfunction expireCookie(ctx, cookie) {\n\tremoveSetCookieEntries(ctx, cookie.name);\n\tctx.setCookie(cookie.name, \"\", {\n\t\t...cookie.attributes,\n\t\tmaxAge: 0\n\t});\n}\nfunction deleteSessionCookie(ctx, skipDontRememberMe) {\n\texpireCookie(ctx, ctx.context.authCookies.sessionToken);\n\texpireCookie(ctx, ctx.context.authCookies.sessionData);\n\tif (ctx.context.options.account?.storeAccountCookie) {\n\t\texpireCookie(ctx, ctx.context.authCookies.accountData);\n\t\tconst accountStore = createAccountStore(ctx.context.authCookies.accountData.name, ctx.context.authCookies.accountData.attributes, ctx);\n\t\tconst cleanCookies = accountStore.clean();\n\t\taccountStore.setCookies(cleanCookies);\n\t}\n\tif (ctx.context.oauthConfig.storeStateStrategy === \"cookie\") expireCookie(ctx, ctx.context.createAuthCookie(\"oauth_state\"));\n\tconst sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, ctx.context.authCookies.sessionData.attributes, ctx);\n\tconst cleanCookies = sessionStore.clean();\n\tsessionStore.setCookies(cleanCookies);\n\tif (!skipDontRememberMe) expireCookie(ctx, ctx.context.authCookies.dontRememberToken);\n}\nfunction isEmbeddedSessionExpired(session) {\n\tif (!session?.expiresAt) return false;\n\tconst expiresAt = new Date(session.expiresAt).getTime();\n\treturn Number.isFinite(expiresAt) && expiresAt < Date.now();\n}\nconst getSessionCookie = (request, config) => {\n\tconst cookies = (request instanceof Headers || !(\"headers\" in request) ? request : request.headers).get(\"cookie\");\n\tif (!cookies) return null;\n\tconst { cookieName = \"session_token\", cookiePrefix = \"better-auth\" } = config || {};\n\tconst parsedCookie = parseCookies(cookies);\n\tconst getCookie = (name) => parsedCookie.get(`__Secure-${name}`) ?? parsedCookie.get(name);\n\tconst sessionToken = getCookie(`${cookiePrefix}.${cookieName}`) || getCookie(`${cookiePrefix}-${cookieName}`);\n\tif (sessionToken) return sessionToken;\n\treturn null;\n};\nasync function matchesVersion(payload, version) {\n\tconst expectedVersion = typeof version === \"string\" ? version : await version(payload.session, payload.user);\n\treturn (payload.version || \"1\") === expectedVersion;\n}\nconst getCookieCache = async (request, config) => {\n\tconst cookies = (request instanceof Headers || !(\"headers\" in request) ? request : request.headers).get(\"cookie\");\n\tif (!cookies) return null;\n\tconst { cookieName = \"session_data\", cookiePrefix = \"better-auth\" } = config || {};\n\tconst name = config?.isSecure !== void 0 ? config.isSecure ? `${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}` : isProduction ? `${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}`;\n\tconst parsedCookie = parseCookies(cookies);\n\tlet sessionData = parsedCookie.get(name);\n\tif (!sessionData) {\n\t\tconst chunks = [];\n\t\tfor (const [cookieName, value] of parsedCookie.entries()) if (cookieName.startsWith(name + \".\")) {\n\t\t\tconst parts = cookieName.split(\".\");\n\t\t\tconst indexStr = parts[parts.length - 1];\n\t\t\tconst index = parseInt(indexStr || \"0\", 10);\n\t\t\tif (!isNaN(index)) chunks.push({\n\t\t\t\tindex,\n\t\t\t\tvalue\n\t\t\t});\n\t\t}\n\t\tif (chunks.length > 0) {\n\t\t\tchunks.sort((a, b) => a.index - b.index);\n\t\t\tsessionData = chunks.map((c) => c.value).join(\"\");\n\t\t}\n\t}\n\tif (sessionData) {\n\t\tconst strategy = config?.strategy || \"compact\";\n\t\tif (strategy === \"jwe\") {\n\t\t\tconst secret = config?.secret || env.BETTER_AUTH_SECRET;\n\t\t\tif (!secret) throw new BetterAuthError(\"getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable\");\n\t\t\tconst payload = parseCookieCachePayload(await symmetricDecodeJWT(sessionData, secret, \"better-auth-session\"));\n\t\t\tif (!payload) return null;\n\t\t\tif (config?.version) {\n\t\t\t\tif (!await matchesVersion(payload, config.version)) return null;\n\t\t\t}\n\t\t\tif (isEmbeddedSessionExpired(payload.session)) return null;\n\t\t\treturn payload;\n\t\t} else if (strategy === \"jwt\") {\n\t\t\tconst jwks = config?.jwt?.jwks;\n\t\t\tlet payload;\n\t\t\tif (jwks) payload = await verifySessionCookieJwtWithJwks(sessionData, jwks, {\n\t\t\t\tissuer: config?.jwt?.issuer,\n\t\t\t\taudience: config?.jwt?.audience\n\t\t\t});\n\t\t\telse {\n\t\t\t\tconst secret = config?.secret || env.BETTER_AUTH_SECRET;\n\t\t\t\tif (!secret) throw new BetterAuthError(\"getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable\");\n\t\t\t\tpayload = parseCookieCachePayload(await verifyJWT(sessionData, secret));\n\t\t\t}\n\t\t\tif (!payload) return null;\n\t\t\tif (config?.version) {\n\t\t\t\tif (!await matchesVersion(payload, config.version)) return null;\n\t\t\t}\n\t\t\tif (isEmbeddedSessionExpired(payload.session)) return null;\n\t\t\treturn payload;\n\t\t} else {\n\t\t\tconst secret = config?.secret || env.BETTER_AUTH_SECRET;\n\t\t\tif (!secret) throw new BetterAuthError(\"getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable\");\n\t\t\tconst sessionDataPayload = parseCompactCookieCache(safeJSONParse(binary.decode(base64Url.decode(sessionData))));\n\t\t\tif (!sessionDataPayload) return null;\n\t\t\tif (!await createHMAC(\"SHA-256\", \"base64urlnopad\").verify(secret, JSON.stringify({\n\t\t\t\t...sessionDataPayload.session,\n\t\t\t\texpiresAt: sessionDataPayload.expiresAt\n\t\t\t}), sessionDataPayload.signature)) return null;\n\t\t\tconst payload = parseCookieCachePayload(sessionDataPayload.session);\n\t\t\tif (!payload) return null;\n\t\t\tif (config?.version) {\n\t\t\t\tif (!await matchesVersion(payload, config.version)) return null;\n\t\t\t}\n\t\t\tif (typeof sessionDataPayload.expiresAt === \"number\" && sessionDataPayload.expiresAt < Date.now()) return null;\n\t\t\tif (isEmbeddedSessionExpired(payload.session)) return null;\n\t\t\treturn payload;\n\t\t}\n\t}\n\treturn null;\n};\n//#endregion\nexport { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, createCookieGetter, createSessionStore, decodeCookieCache, deleteSessionCookie, expireCookie, getAccountCookie, getChunkedCookie, getCookieCache, getCookies, getSessionCookie, parseCookies, parseSetCookieHeader, setAccountCookie, setCookieCache, setCookieToHeader, setRequestCookie, setSessionCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions };\n","import { isAPIError } from \"../../utils/is-api-error.mjs\";\nimport { hasServerSessionStore } from \"../../context/store-capabilities.mjs\";\nimport { parseSessionOutput, parseUserOutput } from \"../../db/schema.mjs\";\nimport { getDate } from \"../../utils/date.mjs\";\nimport { createSessionStore, getChunkedCookie, getSessionQuerySchema } from \"../../cookies/session-store.mjs\";\nimport { decodeCookieCache, deleteSessionCookie, expireCookie, setCookieCache, setSessionCookie } from \"../../cookies/index.mjs\";\nimport { getShouldSkipSessionRefresh } from \"../state/should-session-refresh.mjs\";\nimport { APIError, BASE_ERROR_CODES } from \"@better-auth/core/error\";\nimport { createAuthEndpoint, createAuthMiddleware } from \"@better-auth/core/api\";\nimport * as z from \"zod\";\n//#region src/api/routes/session.ts\nconst getSession = () => createAuthEndpoint(\"/get-session\", {\n\tmethod: [\"GET\", \"POST\"],\n\toperationId: \"getSession\",\n\tquery: getSessionQuerySchema,\n\trequireHeaders: true,\n\tmetadata: { openapi: {\n\t\toperationId: \"getSession\",\n\t\tdescription: \"Get the current session\",\n\t\tresponses: { \"200\": {\n\t\t\tdescription: \"Success\",\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: [\"object\", \"null\"],\n\t\t\t\tproperties: {\n\t\t\t\t\tsession: { $ref: \"#/components/schemas/Session\" },\n\t\t\t\t\tuser: { $ref: \"#/components/schemas/User\" }\n\t\t\t\t},\n\t\t\t\trequired: [\"session\", \"user\"]\n\t\t\t} } }\n\t\t} }\n\t} }\n}, async (ctx) => {\n\tctx.setHeader(\"cache-control\", \"no-store\");\n\tctx.setHeader(\"pragma\", \"no-cache\");\n\tconst deferSessionRefresh = ctx.context.options.session?.deferSessionRefresh;\n\tconst isPostRequest = ctx.method === \"POST\";\n\tif (isPostRequest && !deferSessionRefresh) throw APIError.from(\"METHOD_NOT_ALLOWED\", BASE_ERROR_CODES.METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED);\n\ttry {\n\t\tconst cookieCacheEnabled = ctx.context.options.session?.cookieCache?.enabled === true;\n\t\tconst sessionCookieToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);\n\t\tif (!sessionCookieToken && cookieCacheEnabled) return null;\n\t\tconst sessionDataCookie = getChunkedCookie(ctx, ctx.context.authCookies.sessionData.name);\n\t\tif (sessionDataCookie && !cookieCacheEnabled) {\n\t\t\tconst sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, ctx.context.authCookies.sessionData.attributes, ctx);\n\t\t\tsessionStore.setCookies(sessionStore.clean());\n\t\t}\n\t\tif (!sessionCookieToken) return null;\n\t\tconst shouldUseCookieCache = cookieCacheEnabled && !ctx.query?.disableCookieCache;\n\t\tconst sessionDataPayload = shouldUseCookieCache && sessionDataCookie ? await decodeCookieCache(ctx, sessionDataCookie) : null;\n\t\tif (shouldUseCookieCache && sessionDataCookie && !sessionDataPayload) expireCookie(ctx, ctx.context.authCookies.sessionData);\n\t\tconst dontRememberMe = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);\n\t\t/**\n\t\t* If session data is present in the cookie, check if it should be used or refreshed\n\t\t*/\n\t\tif (sessionDataPayload?.session) {\n\t\t\tconst session = sessionDataPayload.session;\n\t\t\tlet shouldExpireCookieCache = session.session.token !== sessionCookieToken;\n\t\t\tif (!shouldExpireCookieCache) {\n\t\t\t\tconst versionConfig = ctx.context.options.session?.cookieCache?.version;\n\t\t\t\tlet expectedVersion = \"1\";\n\t\t\t\tif (versionConfig) {\n\t\t\t\t\tif (typeof versionConfig === \"string\") expectedVersion = versionConfig;\n\t\t\t\t\telse if (typeof versionConfig === \"function\") {\n\t\t\t\t\t\tconst result = versionConfig(session.session, session.user);\n\t\t\t\t\t\texpectedVersion = result instanceof Promise ? await result : result;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tshouldExpireCookieCache = (session.version || \"1\") !== expectedVersion;\n\t\t\t}\n\t\t\tif (!shouldExpireCookieCache) {\n\t\t\t\tconst now = Date.now();\n\t\t\t\tconst cachedSessionExpiresAt = new Date(session.session.expiresAt).getTime();\n\t\t\t\tshouldExpireCookieCache = sessionDataPayload.expiresAt < now || !Number.isFinite(cachedSessionExpiresAt) || cachedSessionExpiresAt < now;\n\t\t\t}\n\t\t\tif (shouldExpireCookieCache) expireCookie(ctx, ctx.context.authCookies.sessionData);\n\t\t\telse {\n\t\t\t\tconst cookieRefreshCache = ctx.context.sessionConfig.cookieRefreshCache;\n\t\t\t\tif (cookieRefreshCache === false) {\n\t\t\t\t\tctx.context.session = session;\n\t\t\t\t\tconst parsedSession = parseSessionOutput(ctx.context.options, {\n\t\t\t\t\t\t...session.session,\n\t\t\t\t\t\texpiresAt: new Date(session.session.expiresAt),\n\t\t\t\t\t\tcreatedAt: new Date(session.session.createdAt),\n\t\t\t\t\t\tupdatedAt: new Date(session.session.updatedAt)\n\t\t\t\t\t});\n\t\t\t\t\tconst parsedUser = parseUserOutput(ctx.context.options, {\n\t\t\t\t\t\t...session.user,\n\t\t\t\t\t\tcreatedAt: new Date(session.user.createdAt),\n\t\t\t\t\t\tupdatedAt: new Date(session.user.updatedAt)\n\t\t\t\t\t});\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tsession: parsedSession,\n\t\t\t\t\t\tuser: parsedUser\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tconst timeUntilExpiry = sessionDataPayload.expiresAt - Date.now();\n\t\t\t\tconst updateAge = cookieRefreshCache.updateAge * 1e3;\n\t\t\t\tconst shouldSkipSessionRefresh = await getShouldSkipSessionRefresh();\n\t\t\t\tif (timeUntilExpiry < updateAge && !shouldSkipSessionRefresh) {\n\t\t\t\t\tconst refreshedSession = {\n\t\t\t\t\t\tsession: { ...session.session },\n\t\t\t\t\t\tuser: session.user,\n\t\t\t\t\t\tupdatedAt: Date.now()\n\t\t\t\t\t};\n\t\t\t\t\tawait setCookieCache(ctx, refreshedSession, false);\n\t\t\t\t\tconst sessionTokenOptions = ctx.context.authCookies.sessionToken.attributes;\n\t\t\t\t\tconst sessionTokenMaxAge = dontRememberMe ? void 0 : ctx.context.sessionConfig.expiresIn;\n\t\t\t\t\tawait ctx.setSignedCookie(ctx.context.authCookies.sessionToken.name, session.session.token, ctx.context.secret, {\n\t\t\t\t\t\t...sessionTokenOptions,\n\t\t\t\t\t\tmaxAge: sessionTokenMaxAge\n\t\t\t\t\t});\n\t\t\t\t\tconst parsedRefreshedSession = parseSessionOutput(ctx.context.options, {\n\t\t\t\t\t\t...refreshedSession.session,\n\t\t\t\t\t\texpiresAt: new Date(refreshedSession.session.expiresAt),\n\t\t\t\t\t\tcreatedAt: new Date(refreshedSession.session.createdAt),\n\t\t\t\t\t\tupdatedAt: new Date(refreshedSession.session.updatedAt)\n\t\t\t\t\t});\n\t\t\t\t\tconst parsedRefreshedUser = parseUserOutput(ctx.context.options, {\n\t\t\t\t\t\t...refreshedSession.user,\n\t\t\t\t\t\tcreatedAt: new Date(refreshedSession.user.createdAt),\n\t\t\t\t\t\tupdatedAt: new Date(refreshedSession.user.updatedAt)\n\t\t\t\t\t});\n\t\t\t\t\tctx.context.session = {\n\t\t\t\t\t\tsession: parsedRefreshedSession,\n\t\t\t\t\t\tuser: parsedRefreshedUser\n\t\t\t\t\t};\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tsession: parsedRefreshedSession,\n\t\t\t\t\t\tuser: parsedRefreshedUser\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tconst parsedSession = parseSessionOutput(ctx.context.options, {\n\t\t\t\t\t...session.session,\n\t\t\t\t\texpiresAt: new Date(session.session.expiresAt),\n\t\t\t\t\tcreatedAt: new Date(session.session.createdAt),\n\t\t\t\t\tupdatedAt: new Date(session.session.updatedAt)\n\t\t\t\t});\n\t\t\t\tconst parsedUser = parseUserOutput(ctx.context.options, {\n\t\t\t\t\t...session.user,\n\t\t\t\t\tcreatedAt: new Date(session.user.createdAt),\n\t\t\t\t\tupdatedAt: new Date(session.user.updatedAt)\n\t\t\t\t});\n\t\t\t\tctx.context.session = {\n\t\t\t\t\tsession: parsedSession,\n\t\t\t\t\tuser: parsedUser\n\t\t\t\t};\n\t\t\t\treturn ctx.json({\n\t\t\t\t\tsession: parsedSession,\n\t\t\t\t\tuser: parsedUser\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tconst session = await ctx.context.internalAdapter.findSession(sessionCookieToken);\n\t\tctx.context.session = session;\n\t\tif (!session || session.session.expiresAt < /* @__PURE__ */ new Date()) {\n\t\t\tdeleteSessionCookie(ctx);\n\t\t\tif (session) {\n\t\t\t\t/**\n\t\t\t\t* if session expired clean up the session\n\t\t\t\t* Only delete on POST when deferSessionRefresh is enabled\n\t\t\t\t*/\n\t\t\t\tif (!deferSessionRefresh || isPostRequest) await ctx.context.internalAdapter.deleteSession(session.session.token);\n\t\t\t}\n\t\t\treturn ctx.json(null);\n\t\t}\n\t\t/**\n\t\t* We don't need to update the session if the user doesn't want to be remembered\n\t\t* or if the session refresh is disabled\n\t\t*/\n\t\tif (dontRememberMe || ctx.query?.disableRefresh) {\n\t\t\tconst parsedSession = parseSessionOutput(ctx.context.options, session.session);\n\t\t\tconst parsedUser = parseUserOutput(ctx.context.options, session.user);\n\t\t\treturn ctx.json({\n\t\t\t\tsession: parsedSession,\n\t\t\t\tuser: parsedUser\n\t\t\t});\n\t\t}\n\t\tconst expiresIn = ctx.context.sessionConfig.expiresIn;\n\t\tconst updateAge = ctx.context.sessionConfig.updateAge;\n\t\tconst shouldBeUpdated = session.session.expiresAt.valueOf() - expiresIn * 1e3 + updateAge * 1e3 <= Date.now();\n\t\tconst disableRefresh = ctx.query?.disableRefresh || ctx.context.options.session?.disableSessionRefresh;\n\t\tconst shouldSkipSessionRefresh = await getShouldSkipSessionRefresh();\n\t\tconst needsRefresh = shouldBeUpdated && !disableRefresh && !shouldSkipSessionRefresh;\n\t\t/**\n\t\t* When deferSessionRefresh is enabled and this is a GET request,\n\t\t* return the session without performing writes, but include needsRefresh flag\n\t\t*/\n\t\tif (deferSessionRefresh && !isPostRequest) {\n\t\t\tawait setCookieCache(ctx, session, !!dontRememberMe);\n\t\t\tconst parsedSession = parseSessionOutput(ctx.context.options, session.session);\n\t\t\tconst parsedUser = parseUserOutput(ctx.context.options, session.user);\n\t\t\treturn ctx.json({\n\t\t\t\tsession: parsedSession,\n\t\t\t\tuser: parsedUser,\n\t\t\t\tneedsRefresh\n\t\t\t});\n\t\t}\n\t\tif (needsRefresh) {\n\t\t\tconst updatedSession = await ctx.context.internalAdapter.updateSession(session.session.token, {\n\t\t\t\texpiresAt: getDate(ctx.context.sessionConfig.expiresIn, \"sec\"),\n\t\t\t\tupdatedAt: /* @__PURE__ */ new Date()\n\t\t\t});\n\t\t\tif (!updatedSession) {\n\t\t\t\t/**\n\t\t\t\t* Handle case where session update fails (e.g., concurrent deletion)\n\t\t\t\t*/\n\t\t\t\tdeleteSessionCookie(ctx);\n\t\t\t\tthrow APIError.from(\"UNAUTHORIZED\", BASE_ERROR_CODES.FAILED_TO_GET_SESSION);\n\t\t\t}\n\t\t\tconst maxAge = ctx.context.sessionConfig.expiresIn;\n\t\t\tawait setSessionCookie(ctx, {\n\t\t\t\tsession: updatedSession,\n\t\t\t\tuser: session.user\n\t\t\t}, false, { maxAge });\n\t\t\tconst parsedUpdatedSession = parseSessionOutput(ctx.context.options, updatedSession);\n\t\t\tconst parsedUser = parseUserOutput(ctx.context.options, session.user);\n\t\t\treturn ctx.json({\n\t\t\t\tsession: parsedUpdatedSession,\n\t\t\t\tuser: parsedUser\n\t\t\t});\n\t\t}\n\t\tawait setCookieCache(ctx, session, !!dontRememberMe);\n\t\tconst parsedSession = parseSessionOutput(ctx.context.options, session.session);\n\t\tconst parsedUser = parseUserOutput(ctx.context.options, session.user);\n\t\treturn ctx.json({\n\t\t\tsession: parsedSession,\n\t\t\tuser: parsedUser\n\t\t});\n\t} catch (error) {\n\t\tif (isAPIError(error)) throw error;\n\t\tctx.context.logger.error(\"INTERNAL_SERVER_ERROR\", error);\n\t\tthrow APIError.from(\"INTERNAL_SERVER_ERROR\", BASE_ERROR_CODES.FAILED_TO_GET_SESSION);\n\t}\n});\n/**\n* Whether the deployment keeps sessions in a durable server-side store\n* (a database or secondary storage) rather than only in the signed cookie.\n*\n* Sensitive operations use this to decide whether the cookie cache is merely an\n* optimization that must be bypassed for an authoritative read (`true`), or the\n* only place the session lives and therefore the authority itself (`false`, for\n* stateless / DB-less deployments). Pass the result as `disableCookieCache` so a\n* revoked-but-cached session cannot authorize a sensitive action.\n*/\nconst isStateful = (ctx) => hasServerSessionStore(ctx.context.options);\nconst getSessionFromCtx = async (ctx, config) => {\n\tif (ctx.context.session) return ctx.context.session;\n\tconst session = await getSession()({\n\t\t...ctx,\n\t\tmethod: \"GET\",\n\t\tasResponse: false,\n\t\theaders: ctx.headers,\n\t\treturnHeaders: true,\n\t\treturnStatus: false,\n\t\tquery: {\n\t\t\t...config,\n\t\t\t...ctx.query,\n\t\t\tdisableCookieCache: config?.disableCookieCache || ctx.query?.disableCookieCache,\n\t\t\tdisableRefresh: config?.disableRefresh || ctx.query?.disableRefresh\n\t\t}\n\t}).catch(() => {\n\t\treturn null;\n\t});\n\tif (!session) {\n\t\tctx.context.session = null;\n\t\treturn null;\n\t}\n\tif (session.headers) session.headers.forEach((value, key) => {\n\t\tconst lowerKey = key.toLowerCase();\n\t\tif (lowerKey === \"cache-control\" || lowerKey === \"pragma\") return;\n\t\tif (lowerKey === \"set-cookie\") ctx.responseHeaders.append(key, value);\n\t\telse ctx.responseHeaders.set(key, value);\n\t});\n\tctx.context.session = session.response;\n\treturn session.response;\n};\n/**\n* Reads the session from the source that can authorize sensitive work.\n*\n* Stateful deployments must re-read the server-side session store because an\n* earlier hook may have populated `ctx.context.session` from cookie cache.\n* Stateless deployments keep the signed cookie as the session record.\n*/\nconst getAuthoritativeSessionFromCtx = async (ctx) => {\n\tif (!isStateful(ctx)) return getSessionFromCtx(ctx);\n\tctx.context.session = null;\n\treturn getSessionFromCtx(ctx, { disableCookieCache: true });\n};\n/**\n* The middleware forces the endpoint to require a valid session.\n*/\nconst sessionMiddleware = createAuthMiddleware(async (ctx) => {\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session?.session) throw APIError.from(\"UNAUTHORIZED\", {\n\t\tmessage: \"Unauthorized\",\n\t\tcode: \"UNAUTHORIZED\"\n\t});\n\treturn { session };\n});\n/**\n* This middleware forces the endpoint to require a valid authoritative session.\n* This should be used for sensitive operations like password changes, account deletion, etc.\n*/\nconst sensitiveSessionMiddleware = createAuthMiddleware(async (ctx) => {\n\tconst session = await getAuthoritativeSessionFromCtx(ctx);\n\tif (!session?.session) throw APIError.from(\"UNAUTHORIZED\", {\n\t\tmessage: \"Unauthorized\",\n\t\tcode: \"UNAUTHORIZED\"\n\t});\n\treturn { session };\n});\n/**\n* This middleware allows you to call the endpoint on the client if session is valid.\n* However, if called on the server, no session is required.\n*/\nconst requestOnlySessionMiddleware = createAuthMiddleware(async (ctx) => {\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session?.session && (ctx.request || ctx.headers)) throw APIError.from(\"UNAUTHORIZED\", {\n\t\tmessage: \"Unauthorized\",\n\t\tcode: \"UNAUTHORIZED\"\n\t});\n\treturn { session };\n});\n/**\n* This middleware forces the endpoint to require a valid session,\n* as well as making sure the session is fresh before proceeding.\n*\n* Session freshness check will be skipped if the session config's freshAge\n* is set to 0\n*/\nconst freshSessionMiddleware = createAuthMiddleware(async (ctx) => {\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session?.session) throw APIError.from(\"UNAUTHORIZED\", {\n\t\tmessage: \"Unauthorized\",\n\t\tcode: \"UNAUTHORIZED\"\n\t});\n\tif (ctx.context.sessionConfig.freshAge !== 0) {\n\t\tconst createdAt = new Date(session.session.createdAt).getTime();\n\t\tconst freshAge = ctx.context.sessionConfig.freshAge * 1e3;\n\t\tif (Date.now() - createdAt >= freshAge) throw APIError.from(\"FORBIDDEN\", BASE_ERROR_CODES.SESSION_NOT_FRESH);\n\t}\n\treturn { session };\n});\n/**\n* user active sessions list\n*/\nconst listSessions = () => createAuthEndpoint(\"/list-sessions\", {\n\tmethod: \"GET\",\n\toperationId: \"listUserSessions\",\n\tuse: [freshSessionMiddleware],\n\trequireHeaders: true,\n\tmetadata: { openapi: {\n\t\toperationId: \"listUserSessions\",\n\t\tdescription: \"List all active sessions for the user\",\n\t\tresponses: { \"200\": {\n\t\t\tdescription: \"Success\",\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"array\",\n\t\t\t\titems: { $ref: \"#/components/schemas/Session\" }\n\t\t\t} } }\n\t\t} }\n\t} }\n}, async (ctx) => {\n\ttry {\n\t\tconst activeSessions = (await ctx.context.internalAdapter.listSessions(ctx.context.session.user.id, { onlyActiveSessions: true })).filter((session) => {\n\t\t\treturn session.expiresAt > /* @__PURE__ */ new Date();\n\t\t});\n\t\treturn ctx.json(activeSessions.map((session) => parseSessionOutput(ctx.context.options, session)));\n\t} catch (e) {\n\t\tctx.context.logger.error(e);\n\t\tthrow ctx.error(\"INTERNAL_SERVER_ERROR\");\n\t}\n});\n/**\n* revoke a single session\n*/\nconst revokeSession = createAuthEndpoint(\"/revoke-session\", {\n\tmethod: \"POST\",\n\tbody: z.object({ token: z.string().meta({ description: \"The token to revoke\" }) }),\n\tuse: [sensitiveSessionMiddleware],\n\trequireHeaders: true,\n\tmetadata: { openapi: {\n\t\tdescription: \"Revoke a single session\",\n\t\trequestBody: { content: { \"application/json\": { schema: {\n\t\t\ttype: \"object\",\n\t\t\tproperties: { token: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tdescription: \"The token to revoke\"\n\t\t\t} },\n\t\t\trequired: [\"token\"]\n\t\t} } } },\n\t\tresponses: { \"200\": {\n\t\t\tdescription: \"Success\",\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { status: {\n\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\tdescription: \"Indicates if the session was revoked successfully\"\n\t\t\t\t} },\n\t\t\t\trequired: [\"status\"]\n\t\t\t} } }\n\t\t} }\n\t} }\n}, async (ctx) => {\n\tconst token = ctx.body.token;\n\tif ((await ctx.context.internalAdapter.findSession(token))?.session.userId === ctx.context.session.user.id) try {\n\t\tawait ctx.context.internalAdapter.deleteSession(token);\n\t} catch (error) {\n\t\tctx.context.logger.error(error && typeof error === \"object\" && \"name\" in error ? error.name : \"\", error);\n\t\tthrow APIError.from(\"INTERNAL_SERVER_ERROR\", {\n\t\t\tmessage: \"Internal Server Error\",\n\t\t\tcode: \"INTERNAL_SERVER_ERROR\"\n\t\t});\n\t}\n\treturn ctx.json({ status: true });\n});\n/**\n* revoke all user sessions\n*/\nconst revokeSessions = createAuthEndpoint(\"/revoke-sessions\", {\n\tmethod: \"POST\",\n\tuse: [sensitiveSessionMiddleware],\n\trequireHeaders: true,\n\tmetadata: { openapi: {\n\t\tdescription: \"Revoke all sessions for the user\",\n\t\tresponses: { \"200\": {\n\t\t\tdescription: \"Success\",\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { status: {\n\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\tdescription: \"Indicates if all sessions were revoked successfully\"\n\t\t\t\t} },\n\t\t\t\trequired: [\"status\"]\n\t\t\t} } }\n\t\t} }\n\t} }\n}, async (ctx) => {\n\ttry {\n\t\tawait ctx.context.internalAdapter.deleteUserSessions(ctx.context.session.user.id);\n\t} catch (error) {\n\t\tctx.context.logger.error(error && typeof error === \"object\" && \"name\" in error ? error.name : \"\", error);\n\t\tthrow APIError.from(\"INTERNAL_SERVER_ERROR\", {\n\t\t\tmessage: \"Internal Server Error\",\n\t\t\tcode: \"INTERNAL_SERVER_ERROR\"\n\t\t});\n\t}\n\treturn ctx.json({ status: true });\n});\nconst revokeOtherSessions = createAuthEndpoint(\"/revoke-other-sessions\", {\n\tmethod: \"POST\",\n\trequireHeaders: true,\n\tuse: [sensitiveSessionMiddleware],\n\tmetadata: { openapi: {\n\t\tdescription: \"Revoke all other sessions for the user except the current one\",\n\t\tresponses: { \"200\": {\n\t\t\tdescription: \"Success\",\n\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: { status: {\n\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\tdescription: \"Indicates if all other sessions were revoked successfully\"\n\t\t\t\t} },\n\t\t\t\trequired: [\"status\"]\n\t\t\t} } }\n\t\t} }\n\t} }\n}, async (ctx) => {\n\tconst session = ctx.context.session;\n\tif (!session.user) throw APIError.from(\"UNAUTHORIZED\", {\n\t\tmessage: \"Unauthorized\",\n\t\tcode: \"UNAUTHORIZED\"\n\t});\n\tconst otherSessions = (await ctx.context.internalAdapter.listSessions(session.user.id)).filter((session) => {\n\t\treturn session.expiresAt > /* @__PURE__ */ new Date();\n\t}).filter((session) => session.token !== ctx.context.session.session.token);\n\tawait Promise.all(otherSessions.map((session) => ctx.context.internalAdapter.deleteSession(session.token)));\n\treturn ctx.json({ status: true });\n});\n//#endregion\nexport { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };\n","import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE } from \"@opentelemetry/semantic-conventions\";\n//#region src/instrumentation/attributes.ts\n/** Operation identifier (e.g. getSession, signUpWithEmailAndPassword). Uses endpoint operationId when set, otherwise the endpoint key. */\nconst ATTR_OPERATION_ID = \"better_auth.operation_id\";\n/** Hook type (e.g. before, after, create.before). */\nconst ATTR_HOOK_TYPE = \"better_auth.hook.type\";\n/** Execution context (e.g. user, plugin:id). */\nconst ATTR_CONTEXT = \"better_auth.context\";\n//#endregion\nexport { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID };\n","function isPlainObject(value) {\n  if (value === null || typeof value !== \"object\") {\n    return false;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== null && prototype !== Object.prototype && Object.getPrototypeOf(prototype) !== null) {\n    return false;\n  }\n  if (Symbol.iterator in value) {\n    return false;\n  }\n  if (Symbol.toStringTag in value) {\n    return Object.prototype.toString.call(value) === \"[object Module]\";\n  }\n  return true;\n}\n\nfunction _defu(baseObject, defaults, namespace = \".\", merger) {\n  if (!isPlainObject(defaults)) {\n    return _defu(baseObject, {}, namespace, merger);\n  }\n  const object = { ...defaults };\n  for (const key of Object.keys(baseObject)) {\n    if (key === \"__proto__\" || key === \"constructor\") {\n      continue;\n    }\n    const value = baseObject[key];\n    if (value === null || value === void 0) {\n      continue;\n    }\n    if (merger && merger(object, key, value, namespace)) {\n      continue;\n    }\n    if (Array.isArray(value) && Array.isArray(object[key])) {\n      object[key] = [...value, ...object[key]];\n    } else if (isPlainObject(value) && isPlainObject(object[key])) {\n      object[key] = _defu(\n        value,\n        object[key],\n        (namespace ? `${namespace}.` : \"\") + key.toString(),\n        merger\n      );\n    } else {\n      object[key] = value;\n    }\n  }\n  return object;\n}\nfunction createDefu(merger) {\n  return (...arguments_) => (\n    // eslint-disable-next-line unicorn/no-array-reduce\n    arguments_.reduce((p, c) => _defu(p, c, \"\", merger), {})\n  );\n}\nconst defu = createDefu();\nconst defuFn = createDefu((object, key, currentValue) => {\n  if (object[key] !== void 0 && typeof currentValue === \"function\") {\n    object[key] = currentValue(object[key]);\n    return true;\n  }\n});\nconst defuArrayFn = createDefu((object, key, currentValue) => {\n  if (Array.isArray(object[key]) && typeof currentValue === \"function\") {\n    object[key] = currentValue(object[key]);\n    return true;\n  }\n});\n\nexport { createDefu, defu as default, defu, defuArrayFn, defuFn };\n","import { isValidIP, normalizeIP } from \"./ip.mjs\";\n//#region src/utils/host.ts\n/**\n* Cloud provider instance metadata service FQDNs. These resolve to link-local\n* IPs (usually `169.254.169.254`) inside their respective clouds and are\n* prime SSRF targets.\n*\n* The IPs themselves are already caught by the `linkLocal` kind; this set\n* only exists for the FQDN form that a naive server-side fetch might resolve\n* via its own resolver.\n*/\nconst CLOUD_METADATA_HOSTS = new Set([\n\t\"metadata.google.internal\",\n\t\"metadata.goog\",\n\t\"metadata\",\n\t\"instance-data\",\n\t\"instance-data.ec2.internal\"\n]);\n/** Strip `[...]` if the entire input is bracketed (IPv6 literal form). */\nfunction stripBrackets(host) {\n\tif (host.length >= 2 && host.startsWith(\"[\") && host.endsWith(\"]\")) return host.slice(1, -1);\n\treturn host;\n}\n/**\n* Strip trailing `:port` from host-with-port strings.\n*\n* - Bracketed IPv6 with port: `[::1]:8080` → `[::1]`\n* - IPv4/FQDN with port: `127.0.0.1:3000` / `example.com:443` → base form\n* - Bare IPv6: `::1` / `fe80::1` → unchanged (multiple colons means no port)\n*/\nfunction stripPort(host) {\n\tif (host.startsWith(\"[\")) {\n\t\tconst end = host.indexOf(\"]\");\n\t\tif (end === -1) return host;\n\t\treturn host.slice(0, end + 1);\n\t}\n\tconst firstColon = host.indexOf(\":\");\n\tif (firstColon === -1) return host;\n\tif (host.indexOf(\":\", firstColon + 1) !== -1) return host;\n\treturn host.slice(0, firstColon);\n}\n/** Strip IPv6 zone identifier: `fe80::1%eth0` → `fe80::1`. */\nfunction stripZoneId(host) {\n\tconst zone = host.indexOf(\"%\");\n\tif (zone === -1) return host;\n\treturn host.slice(0, zone);\n}\n/**\n* Strip trailing dots (RFC 1034 absolute DNS form): `localhost.` → `localhost`.\n* Without this, `metadata.google.internal.` would fall through to `public` and\n* bypass the cloud-metadata / `.localhost` checks, since WHATWG URL parsing\n* preserves the trailing dot in `url.hostname`.\n*/\nfunction stripTrailingDot(host) {\n\treturn host.replace(/\\.+$/, \"\");\n}\n/** Fast dotted-decimal shape check. Does NOT validate octet bounds. */\nfunction looksLikeIPv4(host) {\n\treturn /^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/.test(host);\n}\n/** Pack a validated dotted-decimal IPv4 into a 32-bit unsigned integer. */\nfunction ipv4ToUint32(ip) {\n\tconst parts = ip.split(\".\");\n\treturn (Number(parts[0]) << 24 | Number(parts[1]) << 16 | Number(parts[2]) << 8 | Number(parts[3])) >>> 0;\n}\n/** Check whether a 32-bit value matches `prefix/length` (both unsigned). */\nfunction inIPv4Range(value, prefix, length) {\n\tif (length === 0) return true;\n\tconst mask = length === 32 ? 4294967295 : -1 << 32 - length >>> 0;\n\treturn (value & mask) === (prefix & mask);\n}\nfunction classifyIPv4(ip) {\n\tif (ip === \"0.0.0.0\") return \"unspecified\";\n\tif (ip === \"255.255.255.255\") return \"broadcast\";\n\tconst n = ipv4ToUint32(ip);\n\tif (inIPv4Range(n, ipv4ToUint32(\"127.0.0.0\"), 8)) return \"loopback\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"10.0.0.0\"), 8)) return \"private\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"172.16.0.0\"), 12)) return \"private\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"192.168.0.0\"), 16)) return \"private\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"169.254.0.0\"), 16)) return \"linkLocal\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"100.64.0.0\"), 10)) return \"sharedAddressSpace\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"192.0.2.0\"), 24)) return \"documentation\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"198.51.100.0\"), 24)) return \"documentation\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"203.0.113.0\"), 24)) return \"documentation\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"198.18.0.0\"), 15)) return \"benchmarking\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"224.0.0.0\"), 4)) return \"multicast\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"0.0.0.0\"), 8)) return \"reserved\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"192.0.0.0\"), 24)) return \"reserved\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"192.88.99.0\"), 24)) return \"reserved\";\n\tif (inIPv4Range(n, ipv4ToUint32(\"240.0.0.0\"), 4)) return \"reserved\";\n\treturn \"public\";\n}\n/**\n* Extract an IPv4 address embedded in an expanded IPv6 literal.\n*\n* Used to recurse into tunnel/translation forms (6to4, NAT64, Teredo) so a\n* private destination cannot be smuggled behind a syntactically-public IPv6\n* literal. `startGroup` is the index of the first of two 16-bit groups in the\n* expanded form (`0000:0000:...`). With `xor: true`, the 32-bit value is XORed\n* with `0xffffffff` before decoding (Teredo obfuscates the client IPv4 this\n* way).\n*/\nfunction extractEmbeddedIPv4(expanded, startGroup, options = {}) {\n\tconst offset = startGroup * 5;\n\tconst g1 = Number.parseInt(expanded.slice(offset, offset + 4), 16);\n\tconst g2 = Number.parseInt(expanded.slice(offset + 5, offset + 9), 16);\n\tif (!Number.isFinite(g1) || !Number.isFinite(g2)) return null;\n\tlet combined = (g1 << 16 | g2) >>> 0;\n\tif (options.xor) combined = (combined ^ 4294967295) >>> 0;\n\treturn `${combined >>> 24 & 255}.${combined >>> 16 & 255}.${combined >>> 8 & 255}.${combined & 255}`;\n}\n/**\n* Classify an expanded, full-form, lowercase IPv6 address (no IPv4-mapped\n* input — those are unmapped to IPv4 before reaching here).\n*\n* 6to4 (`2002::/16`), NAT64 (`64:ff9b::/96`) and Teredo (`2001:0000::/32`)\n* embed an IPv4 that can route to private/loopback space. If the embedded\n* IPv4 classifies as non-`public`, return `reserved` — blocks SSRF without\n* advertising the address as a loopback literal for RFC 8252 §7.3 matching.\n*/\nfunction classifyIPv6(expanded) {\n\tif (expanded === \"0000:0000:0000:0000:0000:0000:0000:0000\") return \"unspecified\";\n\tif (expanded === \"0000:0000:0000:0000:0000:0000:0000:0001\") return \"loopback\";\n\tconst firstByte = Number.parseInt(expanded.slice(0, 2), 16);\n\tconst secondByte = Number.parseInt(expanded.slice(2, 4), 16);\n\tif (firstByte === 255) return \"multicast\";\n\tif (firstByte === 254 && (secondByte & 192) === 128) return \"linkLocal\";\n\tif (firstByte === 254 && (secondByte & 192) === 192) return \"reserved\";\n\tif ((firstByte & 254) === 252) return \"private\";\n\tif (expanded.startsWith(\"2001:0db8:\")) return \"documentation\";\n\tif (expanded.startsWith(\"2001:0002:0000:\")) return \"benchmarking\";\n\tif (expanded.startsWith(\"2002:\")) {\n\t\tconst embedded = extractEmbeddedIPv4(expanded, 1);\n\t\tif (embedded && classifyIPv4(embedded) !== \"public\") return \"reserved\";\n\t\treturn \"public\";\n\t}\n\tif (expanded.startsWith(\"0064:ff9b:0000:0000:0000:0000:\")) {\n\t\tconst embedded = extractEmbeddedIPv4(expanded, 6);\n\t\tif (embedded && classifyIPv4(embedded) !== \"public\") return \"reserved\";\n\t\treturn \"reserved\";\n\t}\n\tif (expanded.startsWith(\"0064:ff9b:0001:\")) return \"reserved\";\n\tif (expanded.startsWith(\"2001:0000:\")) {\n\t\tconst embedded = extractEmbeddedIPv4(expanded, 6, { xor: true });\n\t\tif (embedded && classifyIPv4(embedded) !== \"public\") return \"reserved\";\n\t\treturn \"reserved\";\n\t}\n\tif (expanded.startsWith(\"0100:0000:0000:0000:\")) return \"reserved\";\n\tif (expanded.startsWith(\"3fff:0\")) return \"documentation\";\n\tif (expanded.startsWith(\"5f00:\")) return \"reserved\";\n\tif (expanded.startsWith(\"0000:0000:0000:0000:0000:0000:\")) return \"reserved\";\n\treturn \"public\";\n}\n/**\n* Classify a host string according to RFC 6890 / RFC 6761.\n*\n* Accepts inputs in any of these shapes and normalizes before classifying:\n*\n*   - Bare IPv4: `127.0.0.1`\n*   - Bare IPv6: `::1`, `fe80::1%eth0`\n*   - Bracketed IPv6: `[::1]`\n*   - Host with port: `localhost:3000`, `127.0.0.1:443`, `[::1]:8080`\n*   - FQDN: `example.com`, `tenant.localhost`\n*   - IPv4-mapped IPv6: `::ffff:192.0.2.1` (reported as `literal: \"ipv4\"`)\n*\n* Invalid or non-resolvable FQDNs are returned as `{ kind: \"public\", literal: \"fqdn\" }`\n* — this function never throws. Callers that need structural validation must\n* combine this with a URL/hostname validator upstream.\n*\n* @example\n* classifyHost(\"127.0.0.1\")\n* // { kind: \"loopback\", literal: \"ipv4\", canonical: \"127.0.0.1\" }\n*\n* @example\n* classifyHost(\"[::1]:8080\")\n* // { kind: \"loopback\", literal: \"ipv6\", canonical: \"0000:0000:...:0001\" }\n*\n* @example\n* classifyHost(\"::ffff:192.0.2.1\")\n* // { kind: \"documentation\", literal: \"ipv4\", canonical: \"192.0.2.1\" }\n*\n* @example\n* classifyHost(\"tenant-a.localhost\")\n* // { kind: \"localhost\", literal: \"fqdn\", canonical: \"tenant-a.localhost\" }\n*/\nfunction classifyHost(host) {\n\tconst lowered = stripTrailingDot(stripZoneId(stripBrackets(stripPort(host.trim())))).toLowerCase();\n\tif (lowered === \"\") return {\n\t\tkind: \"reserved\",\n\t\tliteral: \"fqdn\",\n\t\tcanonical: \"\"\n\t};\n\tif (!isValidIP(lowered)) {\n\t\tif (lowered === \"localhost\" || lowered.endsWith(\".localhost\")) return {\n\t\t\tkind: \"localhost\",\n\t\t\tliteral: \"fqdn\",\n\t\t\tcanonical: lowered\n\t\t};\n\t\tif (CLOUD_METADATA_HOSTS.has(lowered)) return {\n\t\t\tkind: \"cloudMetadata\",\n\t\t\tliteral: \"fqdn\",\n\t\t\tcanonical: lowered\n\t\t};\n\t\treturn {\n\t\t\tkind: \"public\",\n\t\t\tliteral: \"fqdn\",\n\t\t\tcanonical: lowered\n\t\t};\n\t}\n\tif (looksLikeIPv4(lowered)) return {\n\t\tkind: classifyIPv4(lowered),\n\t\tliteral: \"ipv4\",\n\t\tcanonical: lowered\n\t};\n\tconst canonical = normalizeIP(lowered, { ipv6Subnet: 128 });\n\tif (looksLikeIPv4(canonical)) return {\n\t\tkind: classifyIPv4(canonical),\n\t\tliteral: \"ipv4\",\n\t\tcanonical\n\t};\n\treturn {\n\t\tkind: classifyIPv6(canonical),\n\t\tliteral: \"ipv6\",\n\t\tcanonical\n\t};\n}\n/**\n* Strict loopback-IP-literal check per RFC 8252 §7.3.\n*\n* Returns true ONLY for IPv4 `127.0.0.0/8` or IPv6 `::1`. The DNS name\n* `localhost` returns false — RFC 8252 §8.3 explicitly recommends against\n* relying on name resolution for loopback redirect URIs.\n*\n* Use this for OAuth redirect URI matching.\n*\n* @example\n* isLoopbackIP(\"127.0.0.1\")     // true\n* isLoopbackIP(\"::1\")           // true\n* isLoopbackIP(\"[::1]:8080\")    // true\n* isLoopbackIP(\"localhost\")     // false  (use isLoopbackHost for DNS names)\n* isLoopbackIP(\"0.0.0.0\")       // false  (unspecified, not loopback)\n*/\nfunction isLoopbackIP(host) {\n\treturn classifyHost(host).kind === \"loopback\";\n}\n/**\n* Permissive loopback check for developer-ergonomics code paths.\n*\n* Returns true for IPv4 `127.0.0.0/8`, IPv6 `::1`, the literal name `localhost`,\n* and any RFC 6761 `.localhost` subdomain (`tenant.localhost`, `app.localhost`).\n*\n* Use this for things like: allowing HTTP for dev servers, skipping Secure\n* cookie requirements, browser-trust heuristics. Do NOT use this for OAuth\n* redirect URI matching — use {@link isLoopbackIP} there.\n*\n* @example\n* isLoopbackHost(\"localhost\")         // true\n* isLoopbackHost(\"tenant.localhost\")  // true  (RFC 6761)\n* isLoopbackHost(\"127.0.0.1\")         // true\n* isLoopbackHost(\"0.0.0.0\")           // false (unspecified, NOT loopback)\n*/\nfunction isLoopbackHost(host) {\n\tconst kind = classifyHost(host).kind;\n\treturn kind === \"loopback\" || kind === \"localhost\";\n}\n/**\n* First-line SSRF gate: returns true ONLY for hosts that classify as `public`.\n*\n* Every RFC 6890 special-purpose range (loopback, private, link-local,\n* unspecified, documentation, multicast, broadcast, reserved, shared address\n* space, benchmarking) and cloud-metadata FQDN returns false.\n*\n* Use this BEFORE issuing a server-side fetch to a user-supplied URL, e.g.\n* OAuth introspection endpoints, webhook targets, or metadata-document\n* fetches (CIMD).\n*\n* Limitations (this is a syntactic check, not a complete SSRF mitigation):\n* - No DNS resolution: a public-looking FQDN that resolves to a private IP\n*   passes this check. Re-verify the resolved address before connecting, or\n*   pin the socket to the resolved IP.\n* - No DNS-rebinding defense: attackers can return a public IP on the first\n*   lookup and a private IP on the second. Resolve once and reuse the IP.\n* - No redirect following: HTTP 3xx responses can redirect to private hosts.\n*   Re-run this check on every redirect target, or disable auto-follow.\n*\n* @example\n* isPublicRoutableHost(\"example.com\")            // true\n* isPublicRoutableHost(\"127.0.0.1\")              // false (loopback)\n* isPublicRoutableHost(\"169.254.169.254\")        // false (linkLocal / AWS IMDS)\n* isPublicRoutableHost(\"metadata.google.internal\") // false (cloudMetadata)\n* isPublicRoutableHost(\"10.0.0.1\")               // false (private)\n* isPublicRoutableHost(\"::ffff:127.0.0.1\")       // false (mapped loopback)\n*/\nfunction isPublicRoutableHost(host) {\n\treturn classifyHost(host).kind === \"public\";\n}\n//#endregion\nexport { classifyHost, isLoopbackHost, isLoopbackIP, isPublicRoutableHost };\n","import { isAPIError } from \"../utils/is-api-error.mjs\";\nimport { isRequestLike } from \"../utils/url.mjs\";\nimport { runWithEndpointContext } from \"@better-auth/core/context\";\nimport { shouldPublishLog } from \"@better-auth/core/env\";\nimport { APIError } from \"@better-auth/core/error\";\nimport { createDefu } from \"defu\";\nimport { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, createWithSpan } from \"@better-auth/core/instrumentation\";\nimport { kAPIErrorHeaderSymbol, toResponse } from \"better-call\";\n//#region src/api/dispatch.ts\nconst defuReplaceArrays = createDefu((obj, key, value) => {\n\tif (Array.isArray(obj[key]) && Array.isArray(value)) {\n\t\tobj[key] = value;\n\t\treturn true;\n\t}\n});\nconst hooksSourceWeakMap = /* @__PURE__ */ new WeakMap();\n/**\n* Resolves the operation id used for spans, preferring an explicit\n* `operationId`, then the OpenAPI one, then the caller's `fallback` (the\n* `auth.api.*` map key), and finally the route path.\n*/\nfunction getOperationId(endpoint, fallback) {\n\tconst opts = endpoint.options;\n\treturn opts?.operationId ?? opts?.metadata?.openapi?.operationId ?? fallback ?? endpoint.path ?? \"/:virtual\";\n}\n/**\n* Merge a set of response headers onto the dispatch's accumulator, appending\n* `set-cookie` (multiple cookies are legal) and replacing everything else.\n*/\nfunction mergeResponseHeaders(context, headers) {\n\tif (!headers) return;\n\theaders.forEach((value, key) => {\n\t\tif (!context.responseHeaders) context.responseHeaders = new Headers({ [key]: value });\n\t\telse if (key.toLowerCase() === \"set-cookie\") context.responseHeaders.append(key, value);\n\t\telse context.responseHeaders.set(key, value);\n\t});\n}\n/**\n* Combine the two header sources an `APIError` can carry into one set:\n* - `kAPIErrorHeaderSymbol`: `ctx.responseHeaders` accumulated via\n*   `c.setCookie` / `c.setHeader` before the throw.\n* - `e.headers`: explicit headers on the error (e.g. `location` from\n*   `c.redirect`).\n*\n* `c.redirect()` reuses `ctx.responseHeaders` as `e.headers`, so when both\n* point at the same object iterating each would duplicate every `set-cookie`;\n* the identity check skips that copy. Explicit error headers override\n* accumulated ones, while cookies from both accumulate.\n*/\nfunction mergeAPIErrorHeaders(error) {\n\tconst ctxHeaders = error[kAPIErrorHeaderSymbol];\n\tconst errHeaders = error.headers && error.headers !== ctxHeaders ? new Headers(error.headers) : null;\n\tif (!ctxHeaders && !errHeaders) return null;\n\tconst headers = new Headers();\n\tctxHeaders?.forEach((value, key) => {\n\t\theaders.append(key, value);\n\t});\n\terrHeaders?.forEach((value, key) => {\n\t\tif (key.toLowerCase() === \"set-cookie\") headers.append(key, value);\n\t\telse headers.set(key, value);\n\t});\n\treturn headers;\n}\nasync function runBeforeHooks(context, hooks, endpoint, operationId) {\n\tconst withSpan = createWithSpan(context.context.options);\n\tlet modifiedContext = {};\n\tfor (const hook of hooks) {\n\t\tlet matched = false;\n\t\ttry {\n\t\t\tmatched = hook.matcher(context);\n\t\t} catch (error) {\n\t\t\tconst hookSource = hooksSourceWeakMap.get(hook.handler) ?? \"unknown\";\n\t\t\tcontext.context.logger.error(`An error occurred during ${hookSource} hook matcher execution:`, error);\n\t\t\tthrow new APIError(\"INTERNAL_SERVER_ERROR\", { message: \"An error occurred during hook matcher execution. Check the logs for more details.\" });\n\t\t}\n\t\tif (!matched) continue;\n\t\tconst hookSource = hooksSourceWeakMap.get(hook.handler) ?? \"unknown\";\n\t\tconst route = endpoint.path ?? \"/:virtual\";\n\t\tconst result = await withSpan(`hook before ${route} ${hookSource}`, {\n\t\t\t[ATTR_HOOK_TYPE]: \"before\",\n\t\t\t[ATTR_HTTP_ROUTE]: route,\n\t\t\t[ATTR_CONTEXT]: hookSource,\n\t\t\t[ATTR_OPERATION_ID]: operationId\n\t\t}, () => hook.handler({\n\t\t\t...context,\n\t\t\treturnHeaders: true\n\t\t})).catch((e) => {\n\t\t\tif (isAPIError(e) && shouldPublishLog(context.context.logger.level, \"debug\")) e.stack = e.errorStack;\n\t\t\tthrow e;\n\t\t});\n\t\tmergeResponseHeaders(context.context, result?.headers);\n\t\tconst hookReturn = result?.response;\n\t\tif (hookReturn && typeof hookReturn === \"object\") {\n\t\t\tif (\"context\" in hookReturn && typeof hookReturn.context === \"object\") {\n\t\t\t\tconst { headers, ...rest } = hookReturn.context;\n\t\t\t\tif (headers instanceof Headers) if (modifiedContext.headers) headers.forEach((value, key) => {\n\t\t\t\t\tmodifiedContext.headers?.set(key, value);\n\t\t\t\t});\n\t\t\t\telse modifiedContext.headers = headers;\n\t\t\t\tmodifiedContext = defuReplaceArrays(rest, modifiedContext);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn hookReturn;\n\t\t}\n\t}\n\treturn { context: modifiedContext };\n}\nasync function runAfterHooks(context, hooks, endpoint, operationId) {\n\tconst withSpan = createWithSpan(context.context.options);\n\tfor (const hook of hooks) {\n\t\tif (!hook.matcher(context)) continue;\n\t\tconst hookSource = hooksSourceWeakMap.get(hook.handler) ?? \"unknown\";\n\t\tconst route = endpoint.path ?? \"/:virtual\";\n\t\tconst result = await withSpan(`hook after ${route} ${hookSource}`, {\n\t\t\t[ATTR_HOOK_TYPE]: \"after\",\n\t\t\t[ATTR_HTTP_ROUTE]: route,\n\t\t\t[ATTR_CONTEXT]: hookSource,\n\t\t\t[ATTR_OPERATION_ID]: operationId\n\t\t}, () => hook.handler(context)).catch((e) => {\n\t\t\tif (isAPIError(e)) {\n\t\t\t\tif (shouldPublishLog(context.context.logger.level, \"debug\")) e.stack = e.errorStack;\n\t\t\t\treturn {\n\t\t\t\t\tresponse: e,\n\t\t\t\t\theaders: mergeAPIErrorHeaders(e)\n\t\t\t\t};\n\t\t\t}\n\t\t\tthrow e;\n\t\t});\n\t\tmergeResponseHeaders(context.context, result.headers);\n\t\tif (result.response !== void 0) context.context.returned = result.response;\n\t}\n\treturn {\n\t\tresponse: context.context.returned,\n\t\theaders: context.context.responseHeaders\n\t};\n}\nfunction getHooks(authContext) {\n\tconst plugins = authContext.options.plugins || [];\n\tconst beforeHooks = [];\n\tconst afterHooks = [];\n\tconst beforeHookHandler = authContext.options.hooks?.before;\n\tif (beforeHookHandler) {\n\t\thooksSourceWeakMap.set(beforeHookHandler, \"user\");\n\t\tbeforeHooks.push({\n\t\t\tmatcher: () => true,\n\t\t\thandler: beforeHookHandler\n\t\t});\n\t}\n\tconst afterHookHandler = authContext.options.hooks?.after;\n\tif (afterHookHandler) {\n\t\thooksSourceWeakMap.set(afterHookHandler, \"user\");\n\t\tafterHooks.push({\n\t\t\tmatcher: () => true,\n\t\t\thandler: afterHookHandler\n\t\t});\n\t}\n\tconst pluginBeforeHooks = plugins.flatMap((plugin) => (plugin.hooks?.before ?? []).map((h) => {\n\t\thooksSourceWeakMap.set(h.handler, `plugin:${plugin.id}`);\n\t\treturn h;\n\t}));\n\tconst pluginAfterHooks = plugins.flatMap((plugin) => (plugin.hooks?.after ?? []).map((h) => {\n\t\thooksSourceWeakMap.set(h.handler, `plugin:${plugin.id}`);\n\t\treturn h;\n\t}));\n\tif (pluginBeforeHooks.length) beforeHooks.push(...pluginBeforeHooks);\n\tif (pluginAfterHooks.length) afterHooks.push(...pluginAfterHooks);\n\treturn {\n\t\tbeforeHooks,\n\t\tafterHooks\n\t};\n}\n/**\n* Run a single endpoint through the configured `hooks.before` / `hooks.after`\n* pipeline, normalizing the response, headers, and `APIError`s the same way a\n* router or `auth.api.*` dispatch does.\n*\n* This is the canonical hook runner. The HTTP router and `auth.api.*` reach it\n* through {@link toAuthEndpoints}. Plugins call it directly when they need to\n* re-enter the pipeline on purpose, such as resuming `/oauth2/authorize` after\n* a fresh sign-in. Calling an endpoint as a plain function deliberately skips\n* hooks; `dispatchAuthEndpoint` is the supported way to opt back in.\n*\n* @param endpoint The endpoint to dispatch.\n* @param input Input context whose `context` is an already-resolved `AuthContext`.\n*/\nasync function dispatchAuthEndpoint(endpoint, input) {\n\tconst withSpan = createWithSpan(input.context.options);\n\tconst operationId = input.operationId ?? getOperationId(endpoint);\n\tconst route = endpoint.path ?? \"/:virtual\";\n\tconst endpointMethod = endpoint.options?.method;\n\tconst defaultMethod = Array.isArray(endpointMethod) ? endpointMethod[0] : endpointMethod;\n\tconst methodName = input.method ?? input.request?.method ?? defaultMethod ?? \"?\";\n\tconst shouldReturnResponse = input.asResponse ?? isRequestLike(input.request);\n\tlet internalContext = {\n\t\t...input,\n\t\tcontext: {\n\t\t\t...input.context,\n\t\t\treturned: void 0,\n\t\t\tresponseHeaders: void 0,\n\t\t\tsession: input.context.session ?? null\n\t\t},\n\t\tpath: endpoint.path,\n\t\theaders: input.headers ? new Headers(input.headers) : void 0\n\t};\n\treturn withSpan(`${methodName} ${route}`, {\n\t\t[ATTR_HTTP_ROUTE]: route,\n\t\t[ATTR_OPERATION_ID]: operationId\n\t}, async () => runWithEndpointContext(internalContext, async () => {\n\t\tconst { beforeHooks, afterHooks } = getHooks(internalContext.context);\n\t\tconst before = await runBeforeHooks(internalContext, beforeHooks, endpoint, operationId);\n\t\tif (\"context\" in before && before.context && typeof before.context === \"object\") {\n\t\t\tconst { headers, ...rest } = before.context;\n\t\t\tif (headers) {\n\t\t\t\tif (!internalContext.headers) internalContext.headers = new Headers();\n\t\t\t\tconst requestHeaders = internalContext.headers;\n\t\t\t\theaders.forEach((value, key) => {\n\t\t\t\t\trequestHeaders.set(key, value);\n\t\t\t\t});\n\t\t\t}\n\t\t\tinternalContext = defuReplaceArrays(rest, internalContext);\n\t\t} else if (before) {\n\t\t\tconst responseHeaders = internalContext.context.responseHeaders;\n\t\t\treturn shouldReturnResponse ? toResponse(before, { headers: responseHeaders }) : input.returnHeaders ? {\n\t\t\t\theaders: responseHeaders,\n\t\t\t\tresponse: before\n\t\t\t} : before;\n\t\t}\n\t\tinternalContext.asResponse = false;\n\t\tinternalContext.returnHeaders = true;\n\t\tinternalContext.returnStatus = true;\n\t\tconst result = await runWithEndpointContext(internalContext, () => withSpan(`handler ${route}`, {\n\t\t\t[ATTR_HTTP_ROUTE]: route,\n\t\t\t[ATTR_OPERATION_ID]: operationId\n\t\t}, () => endpoint(internalContext))).catch((e) => {\n\t\t\tif (isAPIError(e)) return {\n\t\t\t\tresponse: e,\n\t\t\t\tstatus: e.statusCode,\n\t\t\t\theaders: mergeAPIErrorHeaders(e)\n\t\t\t};\n\t\t\tthrow e;\n\t\t});\n\t\tif (result instanceof Response) return result;\n\t\tinternalContext.context.returned = result.response;\n\t\tinternalContext.context.responseHeaders = result.headers ?? void 0;\n\t\tconst after = await runAfterHooks(internalContext, afterHooks, endpoint, operationId);\n\t\tif (after.response !== void 0) result.response = after.response;\n\t\tresult.headers = after.headers ?? result.headers;\n\t\tif (isAPIError(result.response) && shouldPublishLog(internalContext.context.logger.level, \"debug\")) result.response.stack = result.response.errorStack;\n\t\tif (isAPIError(result.response) && !shouldReturnResponse) {\n\t\t\tif (result.headers) Object.defineProperty(result.response, kAPIErrorHeaderSymbol, {\n\t\t\t\tenumerable: false,\n\t\t\t\tconfigurable: true,\n\t\t\t\twritable: false,\n\t\t\t\tvalue: result.headers\n\t\t\t});\n\t\t\tthrow result.response;\n\t\t}\n\t\treturn shouldReturnResponse ? toResponse(result.response, {\n\t\t\theaders: result.headers ?? void 0,\n\t\t\tstatus: result.status\n\t\t}) : input.returnHeaders ? input.returnStatus ? {\n\t\t\theaders: result.headers,\n\t\t\tresponse: result.response,\n\t\t\tstatus: result.status\n\t\t} : {\n\t\t\theaders: result.headers,\n\t\t\tresponse: result.response\n\t\t} : input.returnStatus ? {\n\t\t\tresponse: result.response,\n\t\t\tstatus: result.status\n\t\t} : result.response;\n\t}));\n}\n//#endregion\nexport { dispatchAuthEndpoint, getOperationId };\n","import { isLoopbackHost } from \"./host.mjs\";\nimport { DANGEROUS_URL_SCHEMES } from \"./url.mjs\";\nimport * as z from \"zod\";\n//#region src/utils/redirect-uri.ts\nconst REVERSE_DOMAIN_PRIVATE_USE_SCHEME = /^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i;\nconst NON_PRIVATE_USE_SCHEMES = new Set([\n\t\"http:\",\n\t\"https:\",\n\t\"ws:\",\n\t\"wss:\",\n\t\"file:\",\n\t\"ftp:\",\n\t\"mailto:\",\n\t\"javascript:\",\n\t\"data:\",\n\t\"vbscript:\",\n\t\"blob:\",\n\t\"about:\",\n\t\"view-source:\"\n]);\n/**\n* Returns whether a parsed redirect URI uses an authority-free, reverse-domain\n* private-use scheme as recommended by RFC 8252 §7.1.\n*/\nfunction isReverseDomainPrivateUseRedirectUri(uri) {\n\tconst scheme = uri.protocol.slice(0, -1);\n\tconst schemeSpecificPart = uri.href.slice(uri.protocol.length);\n\treturn uri.protocol !== \"http:\" && uri.protocol !== \"https:\" && uri.host.length === 0 && schemeSpecificPart.startsWith(\"/\") && !schemeSpecificPart.startsWith(\"//\") && REVERSE_DOMAIN_PRIVATE_USE_SCHEME.test(scheme);\n}\n/**\n* Returns whether a parsed redirect URI uses a non-reserved custom scheme with\n* an authority component and a path (for example\n* `cursor://anysphere.cursor-mcp/oauth/callback`).\n*\n* RFC 8252 §7.1 recommends the authority-free reverse-domain form, and §8.4\n* says authorization servers SHOULD reject schemes without a period. Better\n* Auth deliberately does not enforce either, because native MCP clients such\n* as Cursor register host-bearing, period-free URIs. Bare-authority forms\n* (`cursor://host`, `cursor://host?x=1`) are rejected because non-special\n* schemes parse an empty pathname. Web, script, and browser-internal schemes\n* in `NON_PRIVATE_USE_SCHEMES` are rejected; any other scheme is accepted.\n*\n* @see https://github.com/better-auth/better-auth/issues/10946\n*/\nfunction isHostBearingPrivateUseRedirectUri(uri) {\n\tif (NON_PRIVATE_USE_SCHEMES.has(uri.protocol)) return false;\n\tif (uri.host.length === 0) return false;\n\treturn uri.pathname.startsWith(\"/\");\n}\n/** RFC 8252 recommended form or a host-bearing non-reserved custom scheme. */\nfunction isNativePrivateUseRedirectUri(uri) {\n\treturn isReverseDomainPrivateUseRedirectUri(uri) || isHostBearingPrivateUseRedirectUri(uri);\n}\n/**\n* Zod schema for OAuth redirect URIs and other developer-supplied URLs that the\n* server stores and later hands back to a browser.\n*\n* - Rejects dangerous schemes (`javascript:`, `data:`, `vbscript:`).\n* - Rejects URIs with a fragment component (`#...`) per RFC 6749 §3.1.2.\n* - Requires HTTPS, except for loopback hosts (`127.0.0.0/8`, `[::1]`,\n*   `*.localhost` per RFC 6761), where HTTP is allowed for local development.\n* - Allows custom schemes for mobile apps (e.g. `myapp://callback`).\n*\n* This is the single source of truth for redirect-URI validation across the\n* OAuth provider plugins. Consume it from `@better-auth/core/utils/redirect-uri`\n* rather than re-implementing the scheme policy per plugin.\n*/\nconst SafeUrlSchema = z.url().superRefine((val, ctx) => {\n\tlet u;\n\ttry {\n\t\tu = new URL(val);\n\t} catch {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"URL must be parseable\",\n\t\t\tfatal: true\n\t\t});\n\t\treturn z.NEVER;\n\t}\n\tif (DANGEROUS_URL_SCHEMES.includes(u.protocol)) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"URL cannot use javascript:, data:, or vbscript: scheme\"\n\t\t});\n\t\treturn;\n\t}\n\tif (val.includes(\"#\")) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"Redirect URI must not contain a fragment component\"\n\t});\n\tif (u.protocol === \"http:\" && !isLoopbackHost(u.host)) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"Redirect URI must use HTTPS (HTTP allowed only for loopback hosts)\"\n\t});\n});\n//#endregion\nexport { SafeUrlSchema, isNativePrivateUseRedirectUri, isReverseDomainPrivateUseRedirectUri };\n","import { getCurrentAdapter } from \"@better-auth/core/context\";\n//#region src/plugins/jwt/adapter.ts\nconst getJwksAdapter = (baseAdapter, options) => {\n\treturn {\n\t\tgetAllKeys: async (ctx) => {\n\t\t\tif (options?.adapter?.getJwks) return await options.adapter.getJwks(ctx);\n\t\t\treturn await (await getCurrentAdapter(baseAdapter)).findMany({ model: \"jwks\" });\n\t\t},\n\t\tgetLatestKey: async (ctx) => {\n\t\t\tconst now = /* @__PURE__ */ new Date();\n\t\t\tconst isLive = (k) => !k.expiresAt || k.expiresAt > now;\n\t\t\tif (options?.adapter?.getJwks) return (await options.adapter.getJwks(ctx))?.filter(isLive).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];\n\t\t\treturn (await (await getCurrentAdapter(baseAdapter)).findMany({ model: \"jwks\" }))?.filter(isLive).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];\n\t\t},\n\t\t/**\n\t\t* Look up a key by its `id` (matches the JWS `kid` header). Returns\n\t\t* `undefined` when no key with that id exists.\n\t\t*\n\t\t* When `options.adapter.getJwks` is configured (custom keyring),\n\t\t* filters in-memory after fetching the full set — the custom adapter\n\t\t* isn't required to implement an id index.\n\t\t*/\n\t\tgetKeyById: async (ctx, id) => {\n\t\t\tif (options?.adapter?.getJwks) return (await options.adapter.getJwks(ctx))?.find((k) => k.id === id);\n\t\t\treturn await (await getCurrentAdapter(baseAdapter)).findOne({\n\t\t\t\tmodel: \"jwks\",\n\t\t\t\twhere: [{\n\t\t\t\t\tfield: \"id\",\n\t\t\t\t\tvalue: id\n\t\t\t\t}]\n\t\t\t}) ?? void 0;\n\t\t},\n\t\t/**\n\t\t* Find the most recent key matching a specific algorithm. Used when\n\t\t* a caller (e.g. an OAuth audience) specifies `signingAlgorithm` but\n\t\t* not a specific `kid`. Returns `undefined` if no key with the alg\n\t\t* exists — callers decide whether to mint one or reject.\n\t\t*\n\t\t* Legacy rows persisted before the `alg` column existed have\n\t\t* `alg: null`. Per `schema.ts`, those rows are treated as the\n\t\t* configured default alg (`options.jwks.keyPairConfig.alg ?? \"EdDSA\"`),\n\t\t* so deployments that have only legacy rows can still satisfy an\n\t\t* audience-pinned `signingAlgorithm` matching the default.\n\t\t*\n\t\t* Expired keys are filtered out here — see `getLatestKey` for\n\t\t* rationale.\n\t\t*/\n\t\tgetLatestKeyByAlg: async (ctx, alg) => {\n\t\t\tconst candidates = options?.adapter?.getJwks ? await options.adapter.getJwks(ctx) : await (await getCurrentAdapter(baseAdapter)).findMany({ model: \"jwks\" });\n\t\t\tif (!candidates) return void 0;\n\t\t\tconst configAlg = options?.jwks?.keyPairConfig?.alg ?? \"EdDSA\";\n\t\t\tconst now = /* @__PURE__ */ new Date();\n\t\t\treturn candidates.filter((k) => k.alg === alg || k.alg == null && configAlg === alg).filter((k) => !k.expiresAt || k.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];\n\t\t},\n\t\tcreateJwk: async (ctx, webKey) => {\n\t\t\tif (options?.adapter?.createJwk) return await options.adapter.createJwk(webKey, ctx);\n\t\t\treturn await (await getCurrentAdapter(baseAdapter)).create({\n\t\t\t\tmodel: \"jwks\",\n\t\t\t\tdata: {\n\t\t\t\t\t...webKey,\n\t\t\t\t\tcreatedAt: /* @__PURE__ */ new Date()\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\t};\n};\n//#endregion\nexport { getJwksAdapter };\n","import { sec } from \"../../utils/time.mjs\";\nimport { symmetricEncrypt } from \"../../crypto/index.mjs\";\nimport { getJwksAdapter } from \"./adapter.mjs\";\nimport { exportJWK, generateKeyPair } from \"jose\";\n//#region src/plugins/jwt/utils.ts\n/**\n* Converts an expirationTime to ISO seconds expiration time (the format of JWT exp)\n*\n* See https://github.com/panva/jose/blob/main/src/lib/jwt_claims_set.ts#L245\n*\n* @param expirationTime - see options.jwt.expirationTime\n* @param iat - the iat time to consolidate on\n* @returns\n*/\nfunction toExpJWT(expirationTime, iat) {\n\tif (typeof expirationTime === \"number\") return expirationTime;\n\telse if (expirationTime instanceof Date) return Math.floor(expirationTime.getTime() / 1e3);\n\telse return iat + sec(expirationTime);\n}\nasync function generateExportedKeyPair(options) {\n\tconst { alg, ...cfg } = options?.jwks?.keyPairConfig ?? {\n\t\talg: \"EdDSA\",\n\t\tcrv: \"Ed25519\"\n\t};\n\tconst { publicKey, privateKey } = await generateKeyPair(alg, {\n\t\t...cfg,\n\t\textractable: true\n\t});\n\treturn {\n\t\tpublicWebKey: await exportJWK(publicKey),\n\t\tprivateWebKey: await exportJWK(privateKey),\n\t\talg,\n\t\tcfg\n\t};\n}\n/**\n* Creates a Jwk on the database\n*\n* @param ctx\n* @param options\n* @returns\n*/\nasync function createJwk(ctx, options) {\n\tconst { publicWebKey, privateWebKey, alg, cfg } = await generateExportedKeyPair(options);\n\tconst explicitCrv = cfg && \"crv\" in cfg ? cfg.crv : void 0;\n\tconst derivedCrv = typeof publicWebKey.crv === \"string\" ? publicWebKey.crv : void 0;\n\tconst crv = explicitCrv ?? derivedCrv;\n\tconst stringifiedPrivateWebKey = JSON.stringify(privateWebKey);\n\tconst privateKeyEncryptionEnabled = !options?.jwks?.disablePrivateKeyEncryption;\n\tconst jwk = {\n\t\talg,\n\t\t...crv ? { crv } : {},\n\t\tpublicKey: JSON.stringify(publicWebKey),\n\t\tprivateKey: privateKeyEncryptionEnabled ? JSON.stringify(await symmetricEncrypt({\n\t\t\tkey: ctx.context.secretConfig,\n\t\t\tdata: stringifiedPrivateWebKey\n\t\t})) : stringifiedPrivateWebKey,\n\t\tcreatedAt: /* @__PURE__ */ new Date(),\n\t\t...options?.jwks?.rotationInterval ? { expiresAt: new Date(Date.now() + options.jwks.rotationInterval * 1e3) } : {}\n\t};\n\treturn await getJwksAdapter(ctx.context.adapter, options).createJwk(ctx, jwk);\n}\n//#endregion\nexport { createJwk, generateExportedKeyPair, toExpJWT };\n","import { symmetricDecrypt } from \"../../crypto/index.mjs\";\nimport { getJwksAdapter } from \"./adapter.mjs\";\nimport { createJwk, toExpJWT } from \"./utils.mjs\";\nimport { BetterAuthError } from \"@better-auth/core/error\";\nimport { SignJWT, importJWK } from \"jose\";\n//#region src/plugins/jwt/sign.ts\n/**\n* Resolves the JWKS signing key, decrypts it, and imports it\n* for use with jose's SignJWT. Returns null when signing is\n* delegated to a custom jwt.sign callback.\n*\n* Callers that need the signing algorithm before constructing\n* the JWT payload (e.g. for OIDC at_hash) should call this\n* first, read `.alg`, then pass the result to `signJWT` via\n* the `resolvedKey` option to avoid a redundant DB lookup.\n*\n* When `overrides.signingKeyId` or `overrides.signingAlgorithm` is set, key\n* selection follows the contract documented on {@link SigningKeyOverrides};\n* without overrides this returns the most recently created live key, falling\n* back to the primary `keyPairConfig.alg` when even that's absent so unpinned\n* tokens stay on the configured default algorithm even after extra algorithms\n* have been lazy-minted for audience pinning.\n*/\nasync function resolveSigningKey(ctx, options, overrides) {\n\tif (options?.jwt?.sign) return null;\n\tconst adapter = getJwksAdapter(ctx.context.adapter, options);\n\tlet key;\n\tif (overrides?.signingKeyId !== void 0) {\n\t\tkey = await adapter.getKeyById(ctx, overrides.signingKeyId);\n\t\tif (!key) throw new BetterAuthError(`signJWT: signingKeyId \"${overrides.signingKeyId}\" not found in JWKS. The key must be provisioned before it can be referenced.`);\n\t\tif (overrides.signingAlgorithm !== void 0) {\n\t\t\tconst configAlg = options?.jwks?.keyPairConfig?.alg ?? \"EdDSA\";\n\t\t\tif ((key.alg ?? configAlg) !== overrides.signingAlgorithm) throw new BetterAuthError(`signJWT: signingKeyId \"${overrides.signingKeyId}\" has alg \"${key.alg ?? `unset (inherits keyPairConfig.alg \"${configAlg}\")`}\" but signingAlgorithm was set to \"${overrides.signingAlgorithm}\".`);\n\t\t}\n\t} else if (overrides?.signingAlgorithm !== void 0) {\n\t\tkey = await adapter.getLatestKeyByAlg(ctx, overrides.signingAlgorithm);\n\t\tif (!key) {\n\t\t\tconst primaryAlg = options?.jwks?.keyPairConfig?.alg ?? \"EdDSA\";\n\t\t\tconst preconfig = options?.jwks?.keyPairConfigs?.find((c) => c.alg === overrides.signingAlgorithm);\n\t\t\tconst isPrimary = primaryAlg === overrides.signingAlgorithm;\n\t\t\tif (preconfig || isPrimary) key = await createJwk(ctx, {\n\t\t\t\t...options,\n\t\t\t\tjwks: {\n\t\t\t\t\t...options?.jwks,\n\t\t\t\t\tkeyPairConfig: preconfig ?? options?.jwks?.keyPairConfig\n\t\t\t\t}\n\t\t\t});\n\t\t\telse {\n\t\t\t\tconst advertisedExtra = options?.jwks?.keyPairConfigs?.map((c) => c.alg).join(\", \") || \"none\";\n\t\t\t\tthrow new BetterAuthError(`signJWT: no key with alg \"${overrides.signingAlgorithm}\" found in JWKS. The plugin auto-mints only one key matching keyPairConfig.alg=\"${primaryAlg}\"; additional algs configured via keyPairConfigs: ${advertisedExtra}. Add \"${overrides.signingAlgorithm}\" to jwks.keyPairConfigs so the plugin provisions it on first use, or mint the key explicitly via createJwk().`);\n\t\t\t}\n\t\t}\n\t} else {\n\t\tconst primaryAlg = options?.jwks?.keyPairConfig?.alg ?? \"EdDSA\";\n\t\tkey = await adapter.getLatestKeyByAlg(ctx, primaryAlg) ?? await adapter.getLatestKey(ctx);\n\t}\n\tif (!key || key.expiresAt && key.expiresAt < /* @__PURE__ */ new Date()) {\n\t\tif (overrides?.signingKeyId !== void 0 || overrides?.signingAlgorithm !== void 0) throw new BetterAuthError(\"signJWT: requested signing key is expired and an explicit kid/alg was provided; not auto-minting a replacement. Rotate the key explicitly.\");\n\t\tkey = await createJwk(ctx, options);\n\t}\n\tconst privateWebKey = !options?.jwks?.disablePrivateKeyEncryption ? await symmetricDecrypt({\n\t\tkey: ctx.context.secretConfig,\n\t\tdata: JSON.parse(key.privateKey)\n\t}).catch(() => {\n\t\tthrow new BetterAuthError(\"Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.\");\n\t}) : key.privateKey;\n\tconst alg = key.alg ?? options?.jwks?.keyPairConfig?.alg ?? \"EdDSA\";\n\tconst privateKey = await importJWK(JSON.parse(privateWebKey), alg);\n\treturn {\n\t\talg,\n\t\tkid: key.id,\n\t\tprivateKey\n\t};\n}\nasync function signJWT(ctx, config) {\n\tconst { options } = config;\n\tconst payload = config.payload;\n\tconst nowSeconds = Math.floor(Date.now() / 1e3);\n\tconst iat = payload.iat;\n\tlet exp = payload.exp;\n\tconst defaultExp = toExpJWT(options?.jwt?.expirationTime ?? \"15m\", iat ?? nowSeconds);\n\texp = exp ?? defaultExp;\n\tconst nbf = payload.nbf;\n\tconst baseURLOrigin = typeof ctx.context.options.baseURL === \"string\" ? ctx.context.options.baseURL : \"\";\n\tconst iss = payload.iss;\n\tconst defaultIss = options?.jwt?.issuer ?? baseURLOrigin;\n\tconst aud = payload.aud;\n\tconst defaultAud = options?.jwt?.audience ?? baseURLOrigin;\n\tif (options?.jwt?.sign) {\n\t\tconst jwtPayload = {\n\t\t\t...payload,\n\t\t\tiat,\n\t\t\texp,\n\t\t\tnbf,\n\t\t\tiss: iss ?? defaultIss,\n\t\t\taud: aud ?? defaultAud\n\t\t};\n\t\treturn options.jwt.sign(jwtPayload, config.header, {\n\t\t\tsigningKeyId: config.signingKeyId,\n\t\t\tsigningAlgorithm: config.signingAlgorithm\n\t\t});\n\t}\n\tconst { alg, kid, privateKey } = config.resolvedKey ?? await resolveSigningKey(ctx, options, {\n\t\tsigningKeyId: config.signingKeyId,\n\t\tsigningAlgorithm: config.signingAlgorithm\n\t});\n\tconst jwt = new SignJWT(payload).setProtectedHeader({\n\t\t...config.header,\n\t\talg,\n\t\tkid\n\t}).setExpirationTime(exp).setIssuer(iss ?? defaultIss).setAudience(aud ?? defaultAud);\n\tif (iat) jwt.setIssuedAt(iat);\n\tif (payload.sub) jwt.setSubject(payload.sub);\n\tif (payload.nbf) jwt.setNotBefore(payload.nbf);\n\tif (payload.jti) jwt.setJti(payload.jti);\n\treturn await jwt.sign(privateKey);\n}\nasync function getJwtToken(ctx, options) {\n\tconst payload = !options?.jwt?.definePayload ? ctx.context.session.user : await options.jwt.definePayload(ctx.context.session);\n\treturn await signJWT(ctx, {\n\t\toptions,\n\t\tpayload: {\n\t\t\tiat: Math.floor(Date.now() / 1e3),\n\t\t\t...payload,\n\t\t\tsub: await options?.jwt?.getSubject?.(ctx.context.session) ?? ctx.context.session.user.id\n\t\t}\n\t});\n}\n//#endregion\nexport { getJwtToken, resolveSigningKey, signJWT };\n","import { t as __exportAll } from \"./rolldown-runtime-wcPFST8Q.mjs\";\nimport { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from \"./utils-CGIZS-Da.mjs\";\nimport { APIError } from \"better-auth/api\";\nimport { generateRandomString, symmetricDecrypt, symmetricEncrypt } from \"better-auth/crypto\";\nimport { APIError as APIError$1 } from \"better-call\";\nimport { logger } from \"@better-auth/core/env\";\nimport * as z from \"zod\";\nimport { createDpopReplayStore, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, isDpopBindingError, isDpopProofError, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof } from \"better-auth/oauth2\";\nimport { SignJWT, base64url, createLocalJWKSet, decodeProtectedHeader, jwtVerify } from \"jose\";\nimport { SafeUrlSchema } from \"@better-auth/core/utils/redirect-uri\";\nimport { resolveSigningKey, signJWT, toExpJWT } from \"better-auth/plugins\";\n//#region src/authentication-context.ts\nconst RESERVED_ID_TOKEN_CLAIMS = new Set([\n\t\"iss\",\n\t\"sub\",\n\t\"aud\",\n\t\"exp\",\n\t\"nbf\",\n\t\"iat\",\n\t\"jti\",\n\t\"auth_time\",\n\t\"nonce\",\n\t\"acr\",\n\t\"amr\",\n\t\"azp\",\n\t\"sid\",\n\t\"at_hash\",\n\t\"c_hash\",\n\t\"s_hash\"\n]);\n/**\n* Removes provider-owned ID token claim names from custom claims.\n*\n* `customIdTokenClaims` is an extension point for additional claims. It must not\n* replace the issuer, subject, audience, lifetime, nonce, authorized party,\n* token-binding hashes, session binding, or authentication context that the\n* provider owns.\n*/\nfunction stripReservedIdTokenClaims(claims) {\n\tif (!claims) return {};\n\tconst stripped = [];\n\tconst safeClaims = Object.create(null);\n\tfor (const [key, value] of Object.entries(claims)) {\n\t\tif (RESERVED_ID_TOKEN_CLAIMS.has(key)) {\n\t\t\tstripped.push(key);\n\t\t\tcontinue;\n\t\t}\n\t\tsafeClaims[key] = value;\n\t}\n\tif (stripped.length > 0) logger.warn(`oauth-provider: stripped reserved id-token claim name(s): ${stripped.join(\", \")}. The AS owns these claim values.`);\n\treturn safeClaims;\n}\n//#endregion\n//#region src/claims-request.ts\nconst claimRequestMemberSchema = z.record(z.string(), z.unknown()).nullable();\nconst acrClaimRequestMemberSchema = z.looseObject({\n\tessential: z.boolean().optional(),\n\tvalue: z.string().optional(),\n\tvalues: z.array(z.string()).optional()\n}).nullable();\nconst idTokenClaimsRequestSchema = z.object({ acr: acrClaimRequestMemberSchema.optional() }).catchall(claimRequestMemberSchema);\nconst oidcClaimsRequestObjectSchema = z.looseObject({\n\tuserinfo: z.record(z.string(), claimRequestMemberSchema).optional(),\n\tid_token: idTokenClaimsRequestSchema.optional()\n});\nfunction parseClaimsRequestValue(value) {\n\tif (typeof value === \"string\") try {\n\t\treturn JSON.parse(value);\n\t} catch {\n\t\treturn;\n\t}\n\treturn value;\n}\nfunction parseOidcClaimsRequestObject(value) {\n\tconst parsed = parseClaimsRequestValue(value);\n\tconst result = oidcClaimsRequestObjectSchema.safeParse(parsed);\n\treturn result.success ? result.data : void 0;\n}\nconst claimsRequestParameterValueSchema = z.union([z.string(), z.record(z.string(), z.unknown())]);\nconst claimsRequestInputSchema = claimsRequestParameterValueSchema;\nconst claimsRequestParameterSchema = claimsRequestParameterValueSchema.refine((value) => parseOidcClaimsRequestObject(value) !== void 0, { error: \"claims must be a valid Claims request object\" });\nfunction isValidOidcClaimsRequest(value) {\n\treturn value === void 0 || parseOidcClaimsRequestObject(value) !== void 0;\n}\nfunction getRequestedUserInfoClaims(value, supportedClaims) {\n\tconst userInfoClaims = parseOidcClaimsRequestObject(value)?.userinfo;\n\tif (!userInfoClaims) return [];\n\tconst names = Object.keys(userInfoClaims);\n\tif (!supportedClaims) return names;\n\tconst allowed = new Set(supportedClaims);\n\treturn names.filter((name) => allowed.has(name));\n}\nfunction canSatisfyEssentialAcrRequest(value, currentAcr) {\n\tconst claimsRequest = parseOidcClaimsRequestObject(value);\n\tif (!claimsRequest) return value === void 0;\n\tconst acrRequest = claimsRequest.id_token?.acr;\n\tif (!acrRequest || acrRequest.essential !== true) return true;\n\tconst valueMatches = acrRequest.value === void 0 || acrRequest.value === currentAcr;\n\tconst valuesMatch = acrRequest.values === void 0 || acrRequest.values.includes(currentAcr);\n\treturn valueMatches && valuesMatch;\n}\nfunction filterClaimsRequestUserInfoClaims(value, allowedUserInfoClaims) {\n\tconst claimsRequest = parseOidcClaimsRequestObject(value);\n\tif (!claimsRequest) return void 0;\n\tconst allowedClaimSet = new Set(allowedUserInfoClaims);\n\tconst userInfoClaims = Object.fromEntries(Object.entries(claimsRequest.userinfo ?? {}).filter(([claim]) => allowedClaimSet.has(claim)));\n\tconst filteredClaimsRequest = Object.keys(userInfoClaims).length ? {\n\t\t...claimsRequest,\n\t\tuserinfo: userInfoClaims\n\t} : Object.fromEntries(Object.entries(claimsRequest).filter(([key]) => key !== \"userinfo\"));\n\treturn Object.keys(filteredClaimsRequest).length ? filteredClaimsRequest : void 0;\n}\n//#endregion\n//#region src/standard-claims.ts\nfunction splitDisplayName(name) {\n\tconst parts = name.split(\" \").filter((part) => part !== \"\");\n\tif (parts.length <= 1) return {};\n\treturn {\n\t\tgiven: parts.slice(0, -1).join(\" \"),\n\t\tfamily: parts.at(-1)\n\t};\n}\n/**\n* The OIDC Standard Claims (OIDC Core §5.1) that Better Auth resolves from its\n* own user model, each paired with the scope that requests it (§5.4).\n*\n* This is the single source for UserInfo scope-claim resolution, individual\n* `claims.userinfo` resolution, the discovery `claims_supported` advertisement,\n* and the bound on requested claim names. Adding a standard claim Better Auth\n* can resolve means adding one entry here, not editing UserInfo, the metadata,\n* and the plugin init separately.\n*\n* These claims are delivered only at the UserInfo endpoint, never the ID token:\n* the authorization code flow always issues an access token, so §5.4 routes\n* scope-requested claims to UserInfo. Deployments that support further standard\n* profile claims (such as `birthdate` or `zoneinfo`) supply them through\n* `customUserInfoClaims` and advertise them in `claims_supported`.\n*/\nconst STANDARD_CLAIMS = {\n\tname: {\n\t\tscope: \"profile\",\n\t\tresolve: (user) => user.name ?? void 0\n\t},\n\tpicture: {\n\t\tscope: \"profile\",\n\t\tresolve: (user) => user.image ?? void 0\n\t},\n\tgiven_name: {\n\t\tscope: \"profile\",\n\t\tresolve: (user) => splitDisplayName(user.name).given\n\t},\n\tfamily_name: {\n\t\tscope: \"profile\",\n\t\tresolve: (user) => splitDisplayName(user.name).family\n\t},\n\temail: {\n\t\tscope: \"email\",\n\t\tresolve: (user) => user.email ?? void 0\n\t},\n\temail_verified: {\n\t\tscope: \"email\",\n\t\tresolve: (user) => user.emailVerified ?? false\n\t}\n};\nconst STANDARD_CLAIM_NAMES = Object.keys(STANDARD_CLAIMS);\n/**\n* The claim names this provider advertises it can supply (discovery\n* `claims_supported`): the operator's `advertisedMetadata.claims_supported`\n* override when set, otherwise the scope-derived standard set computed at plugin\n* init. Used both to advertise and to bound requested `claims.userinfo` names so\n* a client cannot pin arbitrary attacker-controlled strings onto stored tokens.\n*/\nfunction getSupportedClaims(opts) {\n\treturn opts.advertisedMetadata?.claims_supported ?? opts.claims ?? [];\n}\n//#endregion\n//#region src/claims.ts\n/**\n* Claim names the authorization server owns on a JWT access token, which no\n* claim source (the `customAccessTokenClaims` plugin option, an extension\n* contributor, or a resource row's `customClaims`) may override. The AS is the\n* only source of truth for issuer identity, subject, audience, lifetime, scope,\n* authentication context, the token's stable ID, and its sender-constraint\n* (`cnf`).\n*\n* @see RFC 9068 §2.2 (registered access-token claims)\n* @see RFC 7800 / RFC 9449 §6 (`cnf` confirmation — the token's bound key)\n*/\nconst RESERVED_ACCESS_TOKEN_CLAIMS = new Set([\n\t\"iss\",\n\t\"sub\",\n\t\"aud\",\n\t\"exp\",\n\t\"iat\",\n\t\"jti\",\n\t\"client_id\",\n\t\"scope\",\n\t\"auth_time\",\n\t\"acr\",\n\t\"amr\",\n\t\"cnf\"\n]);\n/**\n* Returns a copy of `claims` with reserved AS-owned names removed. Emits a\n* `warn` naming the stripped keys when any were present (never silently\n* dropped: surfacing the override attempt matters more than minimizing log\n* noise). Stable iteration order (`Object.entries`) is preserved so token-debug\n* logs stay reproducible across runs.\n*/\nfunction stripReservedClaims(claims) {\n\tif (!claims) return {};\n\tconst stripped = [];\n\tconst safe = {};\n\tfor (const [key, value] of Object.entries(claims)) {\n\t\tif (RESERVED_ACCESS_TOKEN_CLAIMS.has(key)) {\n\t\t\tstripped.push(key);\n\t\t\tcontinue;\n\t\t}\n\t\tsafe[key] = value;\n\t}\n\tif (stripped.length > 0) logger.warn(`oauth-provider: stripped reserved access-token claim name(s): ${stripped.join(\", \")}. The AS owns these claim values.`);\n\treturn safe;\n}\n/**\n* The single authority for the enriched (non-AS-owned) claim set an access\n* token carries. Both the JWT mint and the opaque-token introspection\n* re-derive path call this function, so the two formats cannot drift, and\n* reserved RFC 9068 names are stripped unconditionally here so no caller can\n* forget to.\n*\n* Precedence, lowest to highest: extension contributors < per-issuance\n* `accessTokenClaims` < plugin `customAccessTokenClaims` < per-resource\n* `customClaims`. Reserved names are removed from the merged result.\n*\n* Returns only the enriched claims; the caller stamps the AS-owned claims\n* (`iss`/`sub`/`aud`/`exp`/`iat`/`jti`/`client_id`/`scope`/...) itself, so they\n* always win.\n*/\nasync function resolveAccessTokenClaims(input) {\n\tconst { ctx, opts, user, client, scopes, resources, referenceId, metadata, grantType, sessionId, perRequestClaims, resourcePolicyClaims } = input;\n\tconst extensionClaims = await collectExtensionAccessTokenClaims(opts, {\n\t\tctx,\n\t\topts,\n\t\tuser,\n\t\tclient,\n\t\tscopes,\n\t\tgrantType,\n\t\treferenceId,\n\t\tsessionId,\n\t\tresources,\n\t\tmetadata\n\t});\n\tconst pluginClaims = opts.customAccessTokenClaims ? await opts.customAccessTokenClaims({\n\t\tuser,\n\t\tscopes,\n\t\tresources,\n\t\treferenceId,\n\t\tmetadata\n\t}) : {};\n\treturn stripReservedClaims({\n\t\t...extensionClaims,\n\t\t...perRequestClaims ?? {},\n\t\t...pluginClaims,\n\t\t...resourcePolicyClaims\n\t});\n}\n//#endregion\n//#region src/types/zod.ts\nconst DANGEROUS_SCHEMES = [\n\t\"javascript:\",\n\t\"data:\",\n\t\"vbscript:\"\n];\n/**\n* Validates an RFC 8707 resource indicator. The value must be an absolute URI\n* with no fragment (RFC 8707 §2). Unlike a redirect URI it is not restricted to\n* HTTPS, because a resource server identifier may use any absolute URI scheme;\n* configured OAuth resources are the authoritative control over\n* which resources a token may target.\n*/\nconst ResourceUriSchema = z.string().superRefine((val, ctx) => {\n\tif (!URL.canParse(val)) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"resource must be an absolute URI\",\n\t\t\tfatal: true\n\t\t});\n\t\treturn z.NEVER;\n\t}\n\tif (val.includes(\"#\")) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"resource must not contain a fragment\"\n\t\t});\n\t\treturn;\n\t}\n\tif (DANGEROUS_SCHEMES.includes(new URL(val).protocol)) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"resource cannot use javascript:, data:, or vbscript: scheme\"\n\t});\n});\nconst authorizationPromptTokenSchema = z.enum([\n\t\"none\",\n\t\"consent\",\n\t\"login\",\n\t\"create\",\n\t\"select_account\"\n]);\nconst authorizationPromptSchema = z.string().superRefine((value, ctx) => {\n\tconst promptTokens = value.split(\" \").map((token) => token.trim()).filter(Boolean);\n\tconst promptSet = /* @__PURE__ */ new Set();\n\tif (!promptTokens.length) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"prompt must include at least one value\"\n\t\t});\n\t\treturn;\n\t}\n\tfor (const token of promptTokens) {\n\t\tconst result = authorizationPromptTokenSchema.safeParse(token);\n\t\tif (!result.success) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tmessage: `unsupported prompt value: ${token}`\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\t\tpromptSet.add(result.data);\n\t}\n\tif (promptSet.has(\"none\") && promptSet.size > 1) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"prompt=none cannot be combined with other prompt values\"\n\t});\n});\n/** Canonical RFC 7517 JWK Set metadata for an OAuth client. */\nconst clientJwksSchema = z.object({ keys: z.array(z.record(z.string(), z.unknown())).min(1) });\nconst maxAgeSchema = z.union([z.number(), z.string().trim().min(1)]).transform((value, ctx) => {\n\tconst maxAge = typeof value === \"number\" ? value : Number(value);\n\tif (!Number.isInteger(maxAge) || maxAge < 0) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"max_age must be a non-negative integer\"\n\t\t});\n\t\treturn z.NEVER;\n\t}\n\treturn maxAge;\n});\nconst dpopJktSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/, \"dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint\");\n/**\n* Runtime schema for OAuthAuthorizationQuery.\n* Uses passthrough to tolerate fields added by future extensions (PAR, FPA, etc.)\n*/\nconst authorizationQuerySchema = z.object({\n\tresponse_type: z.string().pipe(z.enum([\"code\"])).optional(),\n\trequest: z.string().optional(),\n\trequest_uri: z.string().optional(),\n\tredirect_uri: SafeUrlSchema.optional(),\n\tscope: z.string().optional(),\n\tstate: z.string().optional(),\n\tclient_id: z.string().min(1, \"client_id is required\"),\n\tprompt: authorizationPromptSchema.optional(),\n\tdisplay: z.string().optional(),\n\tui_locales: z.string().optional(),\n\tmax_age: maxAgeSchema.optional(),\n\tacr_values: z.string().optional(),\n\tlogin_hint: z.string().optional(),\n\tid_token_hint: z.string().optional(),\n\tcode_challenge: z.string().optional(),\n\tcode_challenge_method: z.string().pipe(z.enum([\"S256\"])).optional(),\n\tnonce: z.string().optional(),\n\tclaims: claimsRequestInputSchema.optional(),\n\tdpop_jkt: dpopJktSchema.optional(),\n\tresource: z.union([ResourceUriSchema, z.array(ResourceUriSchema).min(1)]).optional()\n}).passthrough();\nconst storedAuthorizationQuerySchema = authorizationQuerySchema.extend({\n\tredirect_uri: SafeUrlSchema.optional(),\n\tclaims: claimsRequestParameterSchema.optional()\n});\n/**\n* Runtime schema for the authorization code verification value.\n* Validates structure on deserialization from the JSON blob stored in the DB.\n* Uses passthrough so future fields (e.g. from authorization challenge) don't break parsing.\n*/\nconst verificationValueSchema = z.object({\n\ttype: z.literal(\"authorization_code\"),\n\tquery: storedAuthorizationQuerySchema,\n\tsessionId: z.string(),\n\tuserId: z.string(),\n\treferenceId: z.string().optional(),\n\tauthTime: z.number().optional(),\n\tresource: z.array(z.string()).optional()\n}).passthrough();\n/**\n* Request body accepted at `POST /oauth2/register` (RFC 7591 §2 client\n* metadata). This is the single source of truth for the registration contract:\n* the endpoint validates against it and {@link ClientRegistrationRequest} is\n* inferred from it, so the type a `validateInitialAccessToken` callback receives\n* always matches what is actually validated. `grant_types` and\n* `token_endpoint_auth_method` are open strings because extensions can register\n* custom values. Server-assigned fields (`client_id`, `client_secret`, the\n* issued/expiry timestamps) and internal state (`disabled`, `reference_id`) are\n* never part of a registration request.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc7591#section-2\n*/\nconst clientRegistrationRequestSchema = z.object({\n\tredirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\tscope: z.string().optional(),\n\tclient_name: z.string().refine((value) => value.trim().length > 0, \"client_name cannot be empty\").optional(),\n\tclient_uri: z.string().optional(),\n\tlogo_uri: z.string().optional(),\n\tcontacts: z.array(z.string().min(1)).min(1).optional(),\n\ttos_uri: z.string().optional(),\n\tpolicy_uri: z.string().optional(),\n\tsoftware_id: z.string().optional(),\n\tsoftware_version: z.string().optional(),\n\tsoftware_statement: z.string().optional(),\n\tpost_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\tbackchannel_logout_uri: SafeUrlSchema.optional(),\n\tbackchannel_logout_session_required: z.boolean().optional(),\n\ttoken_endpoint_auth_method: z.string().trim().min(1).optional(),\n\tjwks: clientJwksSchema.optional(),\n\tjwks_uri: z.string().optional(),\n\tgrant_types: z.array(z.string().trim().min(1)).min(1).optional(),\n\tresponse_types: z.array(z.enum([\"code\"])).optional(),\n\tapplication_type: z.enum([\"web\", \"native\"]).optional(),\n\tsubject_type: z.enum([\"public\", \"pairwise\"]).optional(),\n\tdpop_bound_access_tokens: z.boolean().optional(),\n\tresources: z.array(ResourceUriSchema).optional(),\n\tskip_consent: z.never({ error: \"skip_consent cannot be set during dynamic client registration\" }).optional()\n});\n/**\n* Complete OAuth client metadata document schema shared by registration and\n* verified client-discovery integrations.\n*\n* Unlike {@link clientRegistrationRequestSchema}, a metadata document carries\n* its own identifier and may contain the server-assigned secret fields that a\n* discovery profile must explicitly prohibit. Keeping those fields in the\n* parsed shape lets profile validation distinguish a forbidden value from an\n* unknown extension without unsafe casts or ad-hoc allowlists.\n*/\nconst oauthClientMetadataSchema = clientRegistrationRequestSchema.omit({ skip_consent: true }).extend({\n\tclient_id: z.string().refine((value) => value.trim().length > 0, \"client_id cannot be empty\"),\n\tclient_secret: z.string().optional(),\n\tclient_secret_expires_at: z.number().int().nonnegative().optional(),\n\tclient_id_issued_at: z.number().int().nonnegative().optional()\n}).loose();\n//#endregion\n//#region src/resources.ts\n/**\n* Source-of-truth list of asymmetric JWS algorithms supported by the JWT\n* plugin. Mirrors the {@link JWSAlgorithms} literal-union type from\n* `packages/better-auth/src/plugins/jwt/types.ts`. Kept as a runtime const\n* so the admin-CRUD zod schema AND the seed-config validator can reject\n* bad values up-front rather than surfacing opaque jose errors at issuance.\n*\n* MUST stay in sync with `JWSAlgorithms`. The type-level guard immediately\n* below fails the typecheck if the two drift.\n*/\nconst JWS_ALGORITHMS = [\n\t\"EdDSA\",\n\t\"ES256\",\n\t\"ES512\",\n\t\"PS256\",\n\t\"RS256\"\n];\nconst JWS_ALGORITHM_SET = new Set(JWS_ALGORITHMS);\n/**\n* Upper bound on how many entries are accepted in a JWT's `aud` claim during\n* introspection / revocation validation. Without a cap, a hostile or replayed\n* token can supply hundreds of fake resource identifiers and amplify load on\n* the resource table (one DB lookup per unique unrecognized entry). Real-world\n* deployments use single-digit resource lists; 64 is a generous ceiling that\n* stays well clear of any legitimate use and bounds the per-request DB fan-out.\n*\n* RFC 7519 §4.1.3 does not specify a maximum, so this is a defensive limit,\n* not a spec one. Tokens that exceed it are treated as invalid (introspect →\n* `active: false`, revoke → no-op) rather than triggering the lookup path.\n*\n* @internal\n*/\nconst MAX_AUD_VALUES = 64;\n/**\n* Validates a resource `identifier` per RFC 8707 §2 (absolute URI, no\n* fragment), honoring {@link OAuthOptions.identifierValidator} when provided.\n*\n* Returns a structured result so callers can decide whether to throw\n* (admin CRUD / DCR) or warn-and-skip (config seed path).\n*\n* @internal\n*/\nasync function checkIdentifier(opts, identifier) {\n\tconst customValidator = opts.identifierValidator;\n\tif (customValidator) {\n\t\tif (!await customValidator(identifier)) return {\n\t\t\tok: false,\n\t\t\treason: `resource identifier ${identifier} failed validation`\n\t\t};\n\t\treturn { ok: true };\n\t}\n\tconst parsed = ResourceUriSchema.safeParse(identifier);\n\tif (!parsed.success) return {\n\t\tok: false,\n\t\treason: `resource identifier ${identifier} is invalid: ${parsed.error.issues[0]?.message ?? \"not an absolute URI\"}`\n\t};\n\treturn { ok: true };\n}\n/**\n* Variant of {@link checkIdentifier} that throws `invalid_target` on failure.\n* Used by admin CRUD endpoints where validation failure is a client error.\n*\n* @internal\n*/\nasync function assertIdentifierValid(opts, identifier) {\n\tconst result = await checkIdentifier(opts, identifier);\n\tif (!result.ok) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_target\",\n\t\terror_description: result.reason\n\t});\n}\n/**\n* The OIDC userinfo endpoint's resource identifier. Always accepted as an\n* implicit `aud` value when `openid` is in scope — not looked up against\n* `oauthResource` rows.\n*/\nconst userInfoResource = (baseURL) => `${baseURL}/oauth2/userinfo`;\n/**\n* Re-parses a request's raw `application/x-www-form-urlencoded` body to\n* recover every value of the repeated `resource` parameter (RFC 8707 §2).\n*\n* Workaround for better-call's form-body parser (better-call ≤1.3.5), which\n* collapses repeated form keys with last-write-wins. A client sending\n* `resource=https://a&resource=https://b` would otherwise arrive in the\n* handler as `{ resource: \"https://b\" }`, silently narrowing the issued\n* token's `aud` to a single resource.\n*\n* Returns the full ordered list when the body is form-encoded and contains\n* any `resource` entries; `undefined` otherwise. Caller MUST enable\n* `cloneRequest: true` on the endpoint — the body stream is read here a\n* second time, and that only works when better-call cloned the request\n* before its own parse.\n*\n* Note: the URL-encoded body path is the only one affected. The query-string\n* path (e.g. `/oauth2/authorize?resource=…&resource=…`) is parsed by the\n* router itself, which DOES array-promote duplicate keys correctly.\n*\n* @internal\n*/\nasync function extractRepeatedResourceFromForm(request) {\n\tif (!(request.headers.get(\"content-type\")?.toLowerCase() ?? \"\").includes(\"application/x-www-form-urlencoded\")) return;\n\tlet text;\n\ttry {\n\t\ttext = await request.clone().text();\n\t} catch {\n\t\treturn;\n\t}\n\tif (!text) return void 0;\n\tconst values = new URLSearchParams(text).getAll(\"resource\").filter((value) => value.length > 0);\n\treturn values.length > 0 ? values : void 0;\n}\n/**\n* Normalizes a `resource` parameter into an array. Accepts the RFC 8707\n* forms: a single string, a string[], or undefined.\n*\n* @internal\n*/\nfunction normalizeResourceParam(resource) {\n\tif (resource === void 0 || resource === null) return void 0;\n\tif (typeof resource === \"string\") return [resource];\n\tif (Array.isArray(resource)) {\n\t\tconst result = resource.filter((r) => typeof r === \"string\" && r.length > 0);\n\t\treturn result.length > 0 ? result : void 0;\n\t}\n}\n/**\n* Validates a JWT `aud` claim against the OAuth resource model.\n*\n* Every non-implicit audience value must resolve to an `oauthResource` row.\n* Disabled rows still pass because disabling blocks new issuance; deleting the\n* row is the operation that invalidates already-issued tokens.\n*\n* @internal\n*/\nasync function isAudienceClaimAllowed(ctx, opts, audienceClaim, implicitAudiences = []) {\n\tif (audienceClaim === void 0) return true;\n\tconst audienceValues = Array.isArray(audienceClaim) ? audienceClaim : [audienceClaim];\n\tif (audienceValues.length > MAX_AUD_VALUES) return false;\n\tconst implicitAudienceSet = new Set(implicitAudiences);\n\tconst resourcesToLookup = /* @__PURE__ */ new Set();\n\tfor (const audienceValue of audienceValues) {\n\t\tif (implicitAudienceSet.has(audienceValue)) continue;\n\t\tresourcesToLookup.add(audienceValue);\n\t}\n\tif (resourcesToLookup.size === 0) return true;\n\treturn (await Promise.all(Array.from(resourcesToLookup, (resource) => getResource(ctx, opts, resource)))).every(Boolean);\n}\n/**\n* Resolves the resource policy for a request.\n*\n* Validation steps (RFC 8707 §3 + per-resource policy):\n*\n* 1. Resolve `resource` parameter to a list of identifiers.\n* 2. For each identifier, look up the {@link OAuthResource} row.\n*    - Missing → `invalid_target`.\n*    - `disabled` → `invalid_target` (no new issuance).\n* 3. If {@link OAuthOptions.enforcePerClientResources} resolves to true,\n*    confirm the client is linked to every requested resource via\n*    `oauthClientResource`. Unlinked → `invalid_target`.\n* 4. Intersect `requestedScopes` with each resource's `allowedScopes`.\n*    Empty intersection → `invalid_scope`.\n* 5. Pick the minimum `accessTokenTtl` across requested resources.\n* 6. Pick signing config — only honored for single-resource requests\n*    (a JWT can only have one signature).\n* 7. Merge per-resource `customClaims` (returned raw; reserved-claim\n*    stripping is owned by `resolveAccessTokenClaims`).\n*\n* When no `resource` param is present, returns an empty policy: no `aud`\n* claim and no resource-specific overrides.\n*\n* @internal\n*/\nasync function resolveResourcePolicy(ctx, opts, params) {\n\tconst requestedResources = normalizeResourceParam(params.resource);\n\tconst includesOpenid = params.requestedScopes.includes(\"openid\");\n\tconst userInfoResourceIdentifier = userInfoResource(ctx.context.baseURL ?? \"\");\n\tif (!requestedResources) return {\n\t\taudienceClaim: void 0,\n\t\taccessTokenTtl: null,\n\t\trefreshTokenTtl: null,\n\t\tsigningAlgorithm: null,\n\t\tsigningKeyId: null,\n\t\trawCustomClaims: {},\n\t\tdpopBoundAccessTokensRequired: false,\n\t\teffectiveScopes: [...params.requestedScopes]\n\t};\n\tconst uniqueRequestedResources = [...new Set(requestedResources)];\n\tconst resolved = [];\n\tfor (const identifier of uniqueRequestedResources) {\n\t\tif (identifier === userInfoResourceIdentifier) continue;\n\t\tconst row = await getResource(ctx, opts, identifier);\n\t\tif (row) {\n\t\t\tif (row.disabled) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_target\",\n\t\t\t\terror_description: `requested resource ${identifier} is disabled`\n\t\t\t});\n\t\t\tresolved.push(row);\n\t\t\tcontinue;\n\t\t}\n\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_target\",\n\t\t\terror_description: `requested resource ${identifier} is not configured`\n\t\t});\n\t}\n\tconst { value: enforcePerClient } = resolveEnforcePerClientResources(opts);\n\tif (enforcePerClient && resolved.length > 0) await assertClientLinkedToResources(ctx, opts, params.clientId, resolved);\n\tlet effectiveScopes = [...params.requestedScopes];\n\tfor (const row of resolved) {\n\t\tif (row.allowedScopes === null || row.allowedScopes === void 0) continue;\n\t\tconst allowed = new Set(row.allowedScopes);\n\t\tconst intersection = effectiveScopes.filter((s) => allowed.has(s));\n\t\tif (intersection.length === 0) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_scope\",\n\t\t\terror_description: `none of the requested scopes are allowed for resource ${row.identifier}`\n\t\t});\n\t\teffectiveScopes = intersection;\n\t}\n\tlet accessTokenTtl = null;\n\tlet refreshTokenTtl = null;\n\tfor (const row of resolved) {\n\t\tif (row.accessTokenTtl != null) accessTokenTtl = accessTokenTtl === null ? row.accessTokenTtl : Math.min(accessTokenTtl, row.accessTokenTtl);\n\t\tif (row.refreshTokenTtl != null) refreshTokenTtl = refreshTokenTtl === null ? row.refreshTokenTtl : Math.min(refreshTokenTtl, row.refreshTokenTtl);\n\t}\n\tconst uniqueSigningAlgs = /* @__PURE__ */ new Set();\n\tconst uniqueSigningKids = /* @__PURE__ */ new Set();\n\tfor (const row of resolved) {\n\t\tif (row.signingAlgorithm) uniqueSigningAlgs.add(row.signingAlgorithm);\n\t\tif (row.signingKeyId) uniqueSigningKids.add(row.signingKeyId);\n\t}\n\tif (uniqueSigningAlgs.size > 1) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_request\",\n\t\terror_description: \"multi-resource request has conflicting signingAlgorithm pins; a single JWS signature cannot satisfy multiple algorithms\"\n\t});\n\tif (uniqueSigningKids.size > 1) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_request\",\n\t\terror_description: \"multi-resource request has conflicting signingKeyId pins; a single JWS signature cannot satisfy multiple key ids\"\n\t});\n\tconst signingAlgorithm = uniqueSigningAlgs.values().next().value ?? null;\n\tconst signingKeyId = uniqueSigningKids.values().next().value ?? null;\n\tconst mergedClaims = {};\n\tfor (const row of resolved) if (row.customClaims && typeof row.customClaims === \"object\") Object.assign(mergedClaims, row.customClaims);\n\tconst dpopBoundAccessTokensRequired = resolved.some((row) => row.dpopBoundAccessTokensRequired === true);\n\tconst audienceIdentifiers = includesOpenid ? [...uniqueRequestedResources, userInfoResourceIdentifier] : uniqueRequestedResources;\n\tconst audClaim = [...new Set(audienceIdentifiers)];\n\treturn {\n\t\taudienceClaim: audClaim.length === 1 ? audClaim[0] : audClaim,\n\t\taccessTokenTtl,\n\t\trefreshTokenTtl,\n\t\tsigningAlgorithm,\n\t\tsigningKeyId,\n\t\trawCustomClaims: mergedClaims,\n\t\tdpopBoundAccessTokensRequired,\n\t\teffectiveScopes\n\t};\n}\n/**\n* Throws `invalid_target` if the client isn't linked to every resource via\n* the `oauthClientResource` join table. Issues one `findMany` per call.\n*\n* @internal\n*/\nasync function assertClientLinkedToResources(ctx, opts, clientId, resources) {\n\tif (resources.length === 0) return;\n\tconst modelName = opts.schema?.oauthClientResource?.modelName ?? \"oauthClientResource\";\n\tconst links = await ctx.context.adapter.findMany({\n\t\tmodel: modelName,\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}]\n\t});\n\tconst linkedSet = new Set(links?.map((l) => l.resourceId) ?? []);\n\tconst unlinked = resources.filter((resource) => !linkedSet.has(resource.identifier));\n\tif (unlinked.length > 0) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_target\",\n\t\terror_description: `client ${clientId} is not linked to resource(s) ${unlinked.map((resource) => resource.identifier).join(\", \")}`\n\t});\n}\n/**\n* Returns `true` when `clientId` is linked, via the `oauthClientResource` join\n* table, to at least one of `resourceIdentifiers`. Authorizes cross-client token\n* introspection (RFC 7662 §2.1/§4): a resource server may introspect a token\n* whose audience it serves, even when a different client issued the token.\n*\n* @internal\n*/\nasync function isClientLinkedToAnyResource(ctx, opts, clientId, resourceIdentifiers) {\n\tif (resourceIdentifiers.length === 0) return false;\n\tconst modelName = opts.schema?.oauthClientResource?.modelName ?? \"oauthClientResource\";\n\treturn ((await ctx.context.adapter.findMany({\n\t\tmodel: modelName,\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}, {\n\t\t\tfield: \"resourceId\",\n\t\t\toperator: \"in\",\n\t\t\tvalue: resourceIdentifiers\n\t\t}],\n\t\tlimit: 1\n\t}))?.length ?? 0) > 0;\n}\n/**\n* Merges `customClaims` from the existing rows of `resourceIdentifiers` in\n* order (later resources win on collision). Missing rows are skipped; disabled\n* rows are included, since an already-issued token keeps its claims until it\n* expires. Returned raw; `resolveAccessTokenClaims` strips reserved names.\n*\n* Unlike {@link resolveResourcePolicy}, this applies none of the new-issuance\n* gates (disabled, scope allowlist, client linkage), so it is the right way to\n* re-derive claims for an already-issued token at introspection.\n*\n* @internal\n*/\nasync function getResourceCustomClaims(ctx, opts, resourceIdentifiers) {\n\tif (resourceIdentifiers.length === 0) return {};\n\tconst rows = await ctx.context.adapter.findMany({\n\t\tmodel: opts.schema?.oauthResource?.modelName ?? \"oauthResource\",\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\toperator: \"in\",\n\t\t\tvalue: resourceIdentifiers\n\t\t}]\n\t});\n\tconst rowByIdentifier = new Map(rows.map((row) => [row.identifier, row]));\n\tconst merged = {};\n\tfor (const identifier of resourceIdentifiers) {\n\t\tconst row = rowByIdentifier.get(identifier);\n\t\tif (row?.customClaims && typeof row.customClaims === \"object\") Object.assign(merged, row.customClaims);\n\t}\n\treturn merged;\n}\n/**\n* Resolves the effective {@link OAuthOptions.enforcePerClientResources} value.\n*\n* - Explicit `true | false` always wins (`source: \"explicit\"`).\n* - Otherwise resolve to `true` (`source: \"default\"`). RFC 8707 §3 per-client\n*   validation is the secure default.\n*\n* Deterministic and pure — safe to call on every validation pass.\n*/\nfunction resolveEnforcePerClientResources(opts) {\n\tif (opts.enforcePerClientResources !== void 0) return {\n\t\tvalue: opts.enforcePerClientResources,\n\t\tsource: \"explicit\"\n\t};\n\treturn {\n\t\tvalue: true,\n\t\tsource: \"default\"\n\t};\n}\n/**\n* In-process cache of {@link OAuthResource} rows, keyed by `identifier`.\n*\n* Opt-in via {@link OAuthOptions.cachedResources} (same membership-Set pattern\n* as `cachedTrustedClients`). Resources outside the set are looked up from the\n* DB on every request — the safe default for deployments that edit rows\n* through external tooling.\n*\n* Module-scoped so admin CRUD handlers can invalidate from anywhere via\n* {@link invalidateResourceCache}.\n*/\nconst resourceCache = /* @__PURE__ */ new Map();\n/**\n* Removes an entry from the resource cache. Called by admin CRUD handlers\n* after every write. Pass no argument to clear the entire cache.\n*\n* @internal\n*/\nfunction invalidateResourceCache(identifier) {\n\tif (identifier === void 0) {\n\t\tresourceCache.clear();\n\t\treturn;\n\t}\n\tresourceCache.delete(identifier);\n}\n/**\n* Looks up an {@link OAuthResource} by `identifier`, consulting the in-process\n* cache when the identifier is in {@link OAuthOptions.cachedResources}.\n*\n* Triggers the lazy seed via {@link seedResourcesOnce} on first call — the\n* retry path when the startup seed failed (database unreachable, or\n* migrations run after plugin init). The seed is idempotent and coalesced,\n* so the cost is paid only once per process.\n*\n* Returns a defensive copy so callers can't mutate cached state.\n*\n* @internal\n*/\nasync function getResource(ctx, opts, identifier) {\n\tawait seedResourcesOnce(ctx.context, opts);\n\tif (opts.cachedResources?.has(identifier)) {\n\t\tconst cached = resourceCache.get(identifier);\n\t\tif (cached) return Object.assign({}, cached);\n\t}\n\tconst dbResource = await ctx.context.adapter.findOne({\n\t\tmodel: opts.schema?.oauthResource?.modelName ?? \"oauthResource\",\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: identifier\n\t\t}]\n\t});\n\tif (dbResource && opts.cachedResources?.has(identifier)) resourceCache.set(identifier, Object.assign({}, dbResource));\n\treturn dbResource;\n}\n/**\n* Default `name` value when an input doesn't provide one. Mirrors what most\n* admin UIs would show.\n*/\nfunction defaultName(input) {\n\treturn input.name ?? input.identifier;\n}\n/**\n* Coerces seed-config `resources` entries — string or object form — into a\n* normalized list of {@link OAuthResourceInput}.\n*\n* @internal\n*/\nfunction collectResourceInputs(opts) {\n\tconst inputs = [];\n\tif (opts.resources?.length) for (const entry of opts.resources) inputs.push(typeof entry === \"string\" ? { identifier: entry } : entry);\n\treturn inputs;\n}\n/**\n* Builds the row payload sent to the adapter for a seed insert. All policy\n* columns default to `null` (= inherit plugin default at issuance time)\n* when the input doesn't specify a value.\n*/\nfunction buildSeedRow(input, now) {\n\treturn {\n\t\tidentifier: input.identifier,\n\t\tname: defaultName(input),\n\t\taccessTokenTtl: input.accessTokenTtl ?? null,\n\t\trefreshTokenTtl: input.refreshTokenTtl ?? null,\n\t\tsigningAlgorithm: input.signingAlgorithm ?? null,\n\t\tsigningKeyId: input.signingKeyId ?? null,\n\t\tallowedScopes: input.allowedScopes ?? null,\n\t\tcustomClaims: input.customClaims ?? null,\n\t\tdpopBoundAccessTokensRequired: input.dpopBoundAccessTokensRequired ?? false,\n\t\tdisabled: input.disabled ?? false,\n\t\tpolicyVersion: 1,\n\t\tmetadata: input.metadata ?? null,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now\n\t};\n}\n/**\n* Builds the partial update payload when re-seeding an existing row.\n*\n* - `overwrite` mode replaces every policy column with the input value\n*   (omitted fields fall back to `null` to clear stale state).\n* - `merge` mode updates only fields present in the input — admin edits to\n*   other fields are preserved.\n*/\nfunction buildSeedUpdate(input, mode, now) {\n\tif (mode === \"overwrite\") {\n\t\tconst { identifier: _identifier, createdAt: _createdAt, ...rest } = buildSeedRow(input, now);\n\t\treturn rest;\n\t}\n\tconst update = { updatedAt: now };\n\tif (input.name !== void 0) update.name = input.name;\n\tif (input.accessTokenTtl !== void 0) update.accessTokenTtl = input.accessTokenTtl;\n\tif (input.refreshTokenTtl !== void 0) update.refreshTokenTtl = input.refreshTokenTtl;\n\tif (input.signingAlgorithm !== void 0) update.signingAlgorithm = input.signingAlgorithm;\n\tif (input.signingKeyId !== void 0) update.signingKeyId = input.signingKeyId;\n\tif (input.allowedScopes !== void 0) update.allowedScopes = input.allowedScopes;\n\tif (input.customClaims !== void 0) update.customClaims = input.customClaims;\n\tif (input.dpopBoundAccessTokensRequired !== void 0) update.dpopBoundAccessTokensRequired = input.dpopBoundAccessTokensRequired;\n\tif (input.disabled !== void 0) update.disabled = input.disabled;\n\tif (input.metadata !== void 0) update.metadata = input.metadata;\n\treturn update;\n}\n/**\n* Pattern matched against adapter errors to detect the \"table not yet\n* created\" case — i.e. migrations or `auth generate` haven't run. Only\n* used to keep the expected startup seed failure quiet.\n*\n* Covers SQLite (\"no such table\"), Postgres (\"relation X does not exist\"),\n* MySQL (\"Table X does not exist\" / contracted form), and the Drizzle and\n* Prisma adapters' missing-model errors.\n*/\nconst MISSING_TABLE_PATTERN = /no such table|relation.*does not exist|table.*does(?: not|n'?t) exist|model.*(?:does not exist|was not found in the schema)/i;\n/**\n* Logs a failed startup seed. Missing tables are expected before migrations\n* and stay quiet; anything else is an error worth seeing.\n*\n* @internal\n*/\nfunction logStartupSeedFailure(ctx, error) {\n\tlet missingTable = false;\n\tlet current = error;\n\tfor (let depth = 0; current && !missingTable && depth < 5; depth++) {\n\t\tmissingTable = MISSING_TABLE_PATTERN.test(current instanceof Error ? current.message : String(current));\n\t\tcurrent = current instanceof Error ? current.cause : void 0;\n\t}\n\tif (missingTable) {\n\t\tctx.logger.debug(\"oauth-provider: oauthResource table not yet created; deferring resource seed to first access.\");\n\t\treturn;\n\t}\n\tctx.logger.error(\"oauth-provider: could not seed `resources` at startup; retrying on first resource access.\", error);\n}\n/**\n* Lazy-seed state per adapter and plugin options. A module-level boolean would\n* let one Better Auth instance suppress seeding for every later instance in the\n* same process. Endpoint `AuthContext` objects are not guaranteed to be stable\n* across requests, so the adapter identifies the backing store, and the options\n* object separates instances that share an adapter but configure different\n* `resources`.\n*/\nlet seedStates = /* @__PURE__ */ new WeakMap();\nfunction getSeedState(ctx, opts) {\n\tconst adapterKey = ctx.adapter;\n\tlet byOptions = seedStates.get(adapterKey);\n\tif (!byOptions) {\n\t\tbyOptions = /* @__PURE__ */ new WeakMap();\n\t\tseedStates.set(adapterKey, byOptions);\n\t}\n\tconst existing = byOptions.get(opts);\n\tif (existing) return existing;\n\tconst created = {\n\t\tcompleted: false,\n\t\tpromise: null\n\t};\n\tbyOptions.set(opts, created);\n\treturn created;\n}\n/**\n* Seeds `oauthResource` rows from plugin config.\n*\n* Behavior is controlled by {@link OAuthOptions.resourceSeedMode}:\n*\n* - `\"insertOnly\"` (default, safe): inserts rows whose `identifier` is not\n*   already present. Existing rows are untouched — admin edits via CRUD\n*   are never reverted on restart.\n* - `\"merge\"`: inserts missing rows; updates only specified fields for\n*   existing rows. Useful when config holds the \"preferred defaults\" but\n*   admins customize per-row.\n* - `\"overwrite\"`: inserts missing rows; replaces every policy column on\n*   existing rows with the config value (omitted fields → null). Use only\n*   when config is the single source of truth.\n*\n* Race-safety: the `identifier` column carries a UNIQUE constraint, so two\n* processes booting simultaneously can each attempt the insert — one wins,\n* the other re-reads the row and treats the failed insert as a no-op.\n*\n* Throws on storage errors, including a missing table. Callers go through\n* {@link seedResourcesOnce}, which resets so the next resource access\n* retries (e.g. after migrations run).\n*\n* Idempotent: safe to call multiple times.\n*\n* @internal\n*/\nasync function seedResources(ctx, opts) {\n\tconst inputs = collectResourceInputs(opts);\n\tif (inputs.length === 0) return;\n\tconst mode = opts.resourceSeedMode ?? \"insertOnly\";\n\tconst modelName = opts.schema?.oauthResource?.modelName ?? \"oauthResource\";\n\tfor (const rawInput of inputs) {\n\t\tconst check = await checkIdentifier(opts, rawInput.identifier);\n\t\tif (!check.ok) {\n\t\t\tlogger.warn(`oauth-provider: skipping resource seed for ${rawInput.identifier} — ${check.reason}`);\n\t\t\tcontinue;\n\t\t}\n\t\tlet input = rawInput;\n\t\tif (input.signingAlgorithm != null && !JWS_ALGORITHM_SET.has(input.signingAlgorithm)) {\n\t\t\tlogger.warn(`oauth-provider: dropping unsupported signingAlgorithm \"${input.signingAlgorithm}\" for resource ${input.identifier} — must be one of ${JWS_ALGORITHMS.join(\", \")}. Continuing without an algorithm override.`);\n\t\t\tconst { signingAlgorithm: _, ...rest } = input;\n\t\t\tinput = rest;\n\t\t}\n\t\tconst where = [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: input.identifier\n\t\t}];\n\t\tconst existing = await ctx.adapter.findOne({\n\t\t\tmodel: modelName,\n\t\t\twhere\n\t\t});\n\t\tconst now = /* @__PURE__ */ new Date();\n\t\tif (!existing) try {\n\t\t\tawait ctx.adapter.create({\n\t\t\t\tmodel: modelName,\n\t\t\t\tdata: buildSeedRow(input, now)\n\t\t\t});\n\t\t\tcontinue;\n\t\t} catch (err) {\n\t\t\tif (!await ctx.adapter.findOne({\n\t\t\t\tmodel: modelName,\n\t\t\t\twhere\n\t\t\t}).catch(() => null)) throw err;\n\t\t}\n\t\tif (mode === \"insertOnly\") continue;\n\t\tawait ctx.adapter.update({\n\t\t\tmodel: modelName,\n\t\t\twhere,\n\t\t\tupdate: buildSeedUpdate(input, mode, now)\n\t\t});\n\t}\n}\n/**\n* Idempotent, coalesced wrapper around {@link seedResources}, called from\n* plugin `init` and from every resource lookup. The first call runs the\n* seed, concurrent calls await the same promise, and calls after a success\n* are no-ops. A failure resets the state so the next call retries.\n*\n* @internal\n*/\nasync function seedResourcesOnce(ctx, opts) {\n\tconst state = getSeedState(ctx, opts);\n\tif (state.completed === true) return;\n\tif (state.promise !== null) return state.promise;\n\tstate.promise = seedResources(ctx, opts).then(() => {\n\t\tstate.completed = true;\n\t}).catch((err) => {\n\t\tstate.promise = null;\n\t\tthrow err;\n\t});\n\treturn state.promise;\n}\n/**\n* Logs the resolved value of {@link OAuthOptions.enforcePerClientResources}\n* so deployment admins see which default applied at init. Separated from\n* {@link resolveEnforcePerClientResources} so the latter stays pure and\n* cheap to call from validation flow.\n*\n* @internal\n*/\nfunction logEnforcePerClientResourcesResolution(opts) {\n\tconst resolved = resolveEnforcePerClientResources(opts);\n\tlogger.info(`oauth-provider: enforcePerClientResources resolved to ${resolved.value} (${resolved.source})`);\n}\n//#endregion\n//#region src/dpop.ts\nfunction getDpopProofJwt(ctx) {\n\treturn ctx.headers?.get(\"dpop\") ?? void 0;\n}\nfunction getEndpointUrl(ctx, path) {\n\treturn ctx.request?.url ?? `${ctx.context.baseURL}${path}`;\n}\n//#endregion\n//#region src/oauthClient/client-credentials.ts\nconst USER_DELEGATED_SCOPES = new Set([\n\t\"openid\",\n\t\"profile\",\n\t\"email\",\n\t\"offline_access\"\n]);\nfunction isUserDelegatedScope(scope) {\n\treturn USER_DELEGATED_SCOPES.has(scope);\n}\nfunction normalizeClientCredentialsScopes(scopes) {\n\treturn [...new Set(scopes.map((scope) => scope.trim()).filter(Boolean))];\n}\nfunction validateClientCredentialsScopes(scopes, grantTypes, tokenEndpointAuthMethod, opts) {\n\tif (scopes.length === 0) return;\n\tif (!grantTypes.includes(\"client_credentials\")) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"client_credentials_scopes requires the client_credentials grant\"\n\t});\n\tif (tokenEndpointAuthMethod === \"none\") throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"public clients cannot be assigned client_credentials scopes\"\n\t});\n\tconst providerScopes = new Set(opts.scopes ?? []);\n\tconst invalidScopes = scopes.filter((scope) => !providerScopes.has(scope) || isUserDelegatedScope(scope));\n\tif (invalidScopes.length > 0) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_scope\",\n\t\terror_description: `The following client_credentials scopes are invalid: ${invalidScopes.join(\", \")}`\n\t});\n}\n//#endregion\n//#region src/userinfo.ts\n/**\n* Builds the standard OIDC claims (OIDC Core §5.1) for the UserInfo response.\n*\n* A claim is included when its backing scope was granted, or when it was named\n* individually through the `claims.userinfo` request parameter (§5.4, §5.5).\n* `sub` is always present. Values come from the one claim registry, so the\n* advertisement, the scope mapping, and the resolution cannot drift apart.\n*\n* @see https://openid.net/specs/openid-connect-core-1_0.html#NormalClaims\n*/\nfunction userNormalClaims(user, scopes, requestedClaims = []) {\n\tconst requested = new Set(requestedClaims);\n\tconst claims = { sub: user.id ?? void 0 };\n\tfor (const [name, definition] of Object.entries(STANDARD_CLAIMS)) if (scopes.includes(definition.scope) || requested.has(name)) claims[name] = definition.resolve(user);\n\treturn claims;\n}\n/**\n* Returns the defined-valued entries of `claims`, dropping any key already\n* present in `base` when given.\n*\n* This is the two-tier claim authority shared by the /userinfo response and the\n* ID token:\n* - Called WITH `base` (the provider's own claims): the additive rule for\n*   third-party extension claims. A contributor may add new keys but never\n*   replace a claim the provider already owns.\n* - Called WITHOUT `base`: the deliberate first-party override path for the\n*   operator's own `customUserInfoClaims` / `customIdTokenClaims`, which is\n*   trusted to override identity claims (for example a formatted `name`). The\n*   caller re-pins `sub` afterwards, so subject integrity holds either way\n*   (OIDC Core §5.3.2: UserInfo `sub` MUST match the ID Token `sub`).\n*/\nfunction pickClaims(claims, base) {\n\tconst next = {};\n\tfor (const [key, value] of Object.entries(claims ?? {})) {\n\t\tif (value === void 0) continue;\n\t\tif (base && key in base) continue;\n\t\tnext[key] = value;\n\t}\n\treturn next;\n}\nfunction getUserInfoAccessToken(ctx) {\n\tconst authorization = ctx.headers?.get(\"authorization\");\n\tconst headerAccessTokenAuthorization = parseAccessTokenAuthorization(authorization);\n\tconst bodyToken = ctx.request?.method === \"POST\" ? ctx.body?.access_token ?? void 0 : void 0;\n\tif (headerAccessTokenAuthorization && bodyToken) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Multiple access token transport methods are not allowed\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst accessTokenAuthorization = headerAccessTokenAuthorization ?? (bodyToken ? {\n\t\tscheme: \"Bearer\",\n\t\ttoken: bodyToken\n\t} : void 0);\n\treturn {\n\t\tauthorization: accessTokenAuthorization,\n\t\ttoken: accessTokenAuthorization?.token\n\t};\n}\n/**\n* Handles the /oauth2/userinfo endpoint\n*/\nasync function userInfoEndpoint(ctx, opts) {\n\tconst { authorization: accessTokenAuthorization } = getUserInfoAccessToken(ctx);\n\tif (!accessTokenAuthorization?.token) throw new APIError(\"UNAUTHORIZED\", {\n\t\terror_description: \"access token not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst { payload: jwt, requestedUserInfoClaims: requestedClaims } = await requireActiveAccessTokenWithClaims(ctx, opts, accessTokenAuthorization.token);\n\tif (getDpopJktFromPayload(jwt) && !ctx.request) throw new APIError(\"UNAUTHORIZED\", {\n\t\terror_description: \"DPoP-bound access token requires an HTTP request context\",\n\t\terror: \"invalid_token\"\n\t});\n\ttry {\n\t\tawait enforceDpopBinding({\n\t\t\tpayload: jwt,\n\t\t\tauthorization: accessTokenAuthorization,\n\t\t\tproofJwt: getDpopProofJwt(ctx),\n\t\t\tmethod: ctx.request?.method ?? \"GET\",\n\t\t\turl: getEndpointUrl(ctx, \"/oauth2/userinfo\"),\n\t\t\tproofMaxAgeSeconds: opts.dpop?.proofMaxAgeSeconds,\n\t\t\tsigningAlgorithms: opts.dpop?.signingAlgorithms,\n\t\t\treplayStore: createDpopReplayStore(ctx.context.internalAdapter)\n\t\t});\n\t} catch (error) {\n\t\tif (isDpopBindingError(error)) throw new APIError(\"UNAUTHORIZED\", {\n\t\t\terror_description: error.message,\n\t\t\terror: error.code\n\t\t});\n\t\tthrow error;\n\t}\n\tconst scopes = jwt.scope?.split(\" \");\n\tif (!scopes?.includes(\"openid\")) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Missing required scope\",\n\t\terror: \"invalid_scope\"\n\t});\n\tif (!jwt.sub) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"user not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst user = await ctx.context.internalAdapter.findUserById(jwt.sub);\n\tif (!user) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"user not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst baseUserClaims = userNormalClaims(user, scopes ?? [], requestedClaims);\n\tconst clientId = jwt.client_id ?? jwt.azp;\n\tconst client = clientId && (opts.pairwiseSecret || hasUserInfoClaimExtension(opts)) ? await getClient(ctx, opts, clientId) : void 0;\n\tif (opts.pairwiseSecret && client) baseUserClaims.sub = await resolveSubjectIdentifier(user.id, client, opts);\n\tconst extensionUserClaims = scopes?.length ? await collectExtensionUserInfoClaims(opts, {\n\t\tctx,\n\t\topts,\n\t\tuser,\n\t\tscopes,\n\t\tjwt,\n\t\tclient: client ?? void 0,\n\t\trequestedClaims\n\t}) : {};\n\tconst additionalInfoUserClaims = opts.customUserInfoClaims && scopes?.length ? await opts.customUserInfoClaims({\n\t\tuser,\n\t\tscopes,\n\t\tjwt,\n\t\trequestedClaims\n\t}) : {};\n\treturn {\n\t\t...baseUserClaims,\n\t\t...pickClaims(extensionUserClaims, baseUserClaims),\n\t\t...pickClaims(additionalInfoUserClaims),\n\t\tsub: baseUserClaims.sub\n\t};\n}\n//#endregion\n//#region src/token.ts\nconst ID_TOKEN_SCOPE_CLAIM_GUARDS = Object.fromEntries(STANDARD_CLAIM_NAMES.map((name) => [name, void 0]));\n/**\n* Token presentation scheme implied by a confirmation: a DPoP key thumbprint\n* (`jkt`) yields `\"DPoP\"`; any other confirmation (including mTLS `x5t#S256`)\n* keeps `\"Bearer\"`, since that constraint lives at the TLS layer.\n*/\nfunction confirmationTokenType(confirmation) {\n\treturn getConfirmationJkt(confirmation) ? \"DPoP\" : \"Bearer\";\n}\nconst JWT_ACCESS_TOKEN_TYPE = \"at+jwt\";\n/**\n* Handles the /oauth2/token endpoint by delegating\n* the grant types\n*/\nasync function tokenEndpoint(ctx, opts) {\n\tconst grantType = ctx.body.grant_type;\n\tif (!getSupportedGrantTypes(opts).includes(grantType)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: `unsupported grant_type ${grantType}`,\n\t\terror: \"unsupported_grant_type\"\n\t});\n\tswitch (grantType) {\n\t\tcase \"authorization_code\": return handleAuthorizationCodeGrant(ctx, opts);\n\t\tcase \"client_credentials\": return handleClientCredentialsGrant(ctx, opts);\n\t\tcase \"refresh_token\": return handleRefreshTokenGrant(ctx, opts);\n\t\tdefault: {\n\t\t\tconst handler = getExtensionGrantHandler(opts, grantType);\n\t\t\tif (handler) return handler({\n\t\t\t\tctx,\n\t\t\t\topts,\n\t\t\t\tgrantType,\n\t\t\t\tprovider: getOAuthProviderApi(ctx, opts, grantType)\n\t\t\t});\n\t\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror_description: `unsupported grant_type ${grantType}`,\n\t\t\t\terror: \"unsupported_grant_type\"\n\t\t\t});\n\t\t}\n\t}\n}\n/**\n* Returns the OAuth Provider's server-side capability surface bound to `ctx`.\n* The token endpoint passes one (pre-bound to the dispatched grant) to each\n* extension grant handler; a companion plugin's own endpoint calls this directly\n* with its grant type. `grantType` is bound here, not per issuance, so a handler\n* cannot mislabel the grant; omit it for capabilities that do not issue tokens\n* (`getClient`, `validateAccessToken`, `requireActiveAccessToken`), and\n* `issueTokens` then throws.\n*/\nfunction getOAuthProviderApi(ctx, opts, grantType) {\n\treturn {\n\t\tgetClient: (clientId) => getClient(ctx, opts, clientId),\n\t\tauthenticateClient: async (request) => {\n\t\t\tconst { clientId, clientSecret, preVerified, authMethod, confirmation } = destructureCredentials(await extractClientCredentials(ctx, opts, `${ctx.context.baseURL}${ctx.path ?? \"/oauth2/token\"}`));\n\t\t\tif (!clientId) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror_description: \"Missing required client_id\",\n\t\t\t\terror: \"invalid_request\"\n\t\t\t});\n\t\t\tif (request?.requireCredentials !== false && !clientSecret && !preVerified) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror_description: \"Missing required client credentials\",\n\t\t\t\terror: \"invalid_client\"\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tclientId,\n\t\t\t\tclient: await validateClientCredentials(ctx, opts, clientId, clientSecret, request?.scopes, preVerified, grantType, authMethod),\n\t\t\t\tmethod: authMethod,\n\t\t\t\tconfirmation\n\t\t\t};\n\t\t},\n\t\tissueTokens: (params) => {\n\t\t\tif (!grantType) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\t\t\terror_description: \"issueTokens requires a grant type; pass it to getOAuthProviderApi(ctx, opts, grantType).\",\n\t\t\t\terror: \"server_error\"\n\t\t\t});\n\t\t\treturn createUserTokens(ctx, opts, {\n\t\t\t\t...params,\n\t\t\t\tgrantType\n\t\t\t});\n\t\t},\n\t\thashToken: (token, type) => storeToken(opts.storeTokens, token, type),\n\t\tvalidateAccessToken: async (token, clientId) => {\n\t\t\tconst { validateAccessToken } = await Promise.resolve().then(() => introspect_exports);\n\t\t\treturn validateAccessToken(ctx, opts, token, clientId);\n\t\t},\n\t\trequireActiveAccessToken: async (token, clientId) => {\n\t\t\tconst { requireActiveAccessToken } = await Promise.resolve().then(() => introspect_exports);\n\t\t\treturn requireActiveAccessToken(ctx, opts, token, clientId);\n\t\t}\n\t};\n}\nasync function createJwtAccessToken(ctx, opts, user, client, audienceClaim, scopes, overrides) {\n\tconst iat = overrides?.iat ?? Math.floor(Date.now() / 1e3);\n\tconst exp = overrides?.exp ?? iat + (opts.accessTokenExpiresIn ?? 3600);\n\tconst jwtPluginOptions = getJwtPlugin(ctx.context).options;\n\tconst subject = user?.id ?? client.clientId;\n\treturn signJWT(ctx, {\n\t\toptions: jwtPluginOptions,\n\t\theader: { typ: JWT_ACCESS_TOKEN_TYPE },\n\t\tsigningKeyId: overrides?.signingKeyId ?? void 0,\n\t\tsigningAlgorithm: overrides?.signingAlgorithm ?? void 0,\n\t\tpayload: {\n\t\t\t...overrides?.accessTokenClaims ?? {},\n\t\t\tsub: subject,\n\t\t\taud: toAudienceClaim(audienceClaim),\n\t\t\tclient_id: client.clientId,\n\t\t\tazp: client.clientId,\n\t\t\tscope: scopes.join(\" \"),\n\t\t\tsid: overrides?.sid,\n\t\t\tiss: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL,\n\t\t\tiat,\n\t\t\texp,\n\t\t\tjti: generateRandomString(32),\n\t\t\t...overrides?.confirmation ? { cnf: overrides.confirmation } : {}\n\t\t}\n\t});\n}\n/**\n* Computes an OIDC hash (at_hash, c_hash) per OIDC Core §3.1.3.6.\n* Hashes the token, takes the left half, and base64url-encodes it.\n*/\nasync function computeOidcHash(token, signingAlg) {\n\tlet hashAlg;\n\tif (signingAlg === \"EdDSA\") hashAlg = \"SHA-512\";\n\telse if (signingAlg.endsWith(\"384\")) hashAlg = \"SHA-384\";\n\telse if (signingAlg.endsWith(\"512\")) hashAlg = \"SHA-512\";\n\telse hashAlg = \"SHA-256\";\n\tconst digest = new Uint8Array(await crypto.subtle.digest(hashAlg, new TextEncoder().encode(token)));\n\treturn base64url.encode(digest.slice(0, digest.length / 2));\n}\n/**\n* Creates a user id token in code_authorization with scope of 'openid'\n* and hybrid/implicit (not yet implemented) flows\n*/\nasync function createIdToken(ctx, opts, user, client, scopes, nonce, sessionId, authTime, accessToken, extraClaims) {\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tconst exp = iat + (opts.idTokenExpiresIn ?? 36e3);\n\tconst resolvedSub = await resolveSubjectIdentifier(user.id, client, opts);\n\tconst authTimeSec = authTime != null ? Math.floor(authTime.getTime() / 1e3) : void 0;\n\tconst customClaims = stripReservedIdTokenClaims(opts.customIdTokenClaims ? await opts.customIdTokenClaims({\n\t\tuser,\n\t\tscopes,\n\t\tmetadata: parseClientMetadata(client.metadata)\n\t}) : void 0);\n\tconst jwtPluginOptions = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context).options;\n\tconst resolvedKey = !opts.disableJwtPlugin && !jwtPluginOptions?.jwt?.sign ? await resolveSigningKey(ctx, jwtPluginOptions) : void 0;\n\tconst signingAlg = opts.disableJwtPlugin ? \"HS256\" : resolvedKey?.alg ?? jwtPluginOptions?.jwks?.keyPairConfig?.alg;\n\tconst atHash = accessToken ? await computeOidcHash(accessToken, signingAlg) : void 0;\n\tconst emitSid = Boolean(client.enableEndSession || client.backchannelLogoutUri);\n\tconst payload = {\n\t\t...ID_TOKEN_SCOPE_CLAIM_GUARDS,\n\t\tauth_time: authTimeSec,\n\t\tacr: \"0\",\n\t\t...customClaims,\n\t\tat_hash: atHash,\n\t\tiss: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL,\n\t\tsub: resolvedSub,\n\t\taud: client.clientId,\n\t\tnonce,\n\t\tiat,\n\t\texp,\n\t\tsid: emitSid ? sessionId : void 0\n\t};\n\tconst additiveClaims = stripReservedIdTokenClaims(extraClaims);\n\tObject.assign(payload, pickClaims(additiveClaims, payload));\n\tif (opts.disableJwtPlugin && !client.clientSecret) return;\n\tconst idToken = opts.disableJwtPlugin ? await new SignJWT(payload).setProtectedHeader({ alg: \"HS256\" }).sign(new TextEncoder().encode(await decryptStoredClientSecret(ctx, opts.storeClientSecret, client.clientSecret))) : await signJWT(ctx, {\n\t\toptions: jwtPluginOptions,\n\t\tpayload,\n\t\tresolvedKey: resolvedKey ?? void 0\n\t});\n\tif (idToken && atHash && jwtPluginOptions?.jwt?.sign) {\n\t\tconst header = decodeProtectedHeader(idToken);\n\t\tif (header.alg !== signingAlg) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\t\terror_description: `ID token signed with \"${header.alg}\" but at_hash was computed for \"${signingAlg}\". Ensure jwt.sign uses the algorithm declared in keyPairConfig.alg.`,\n\t\t\terror: \"server_error\"\n\t\t});\n\t}\n\treturn idToken;\n}\n/**\n* Encodes a refresh token for a client\n*/\nasync function encodeRefreshToken(opts, token, sessionId) {\n\treturn (opts.prefix?.refreshToken ?? \"\") + (opts.formatRefreshToken?.encrypt ? opts.formatRefreshToken.encrypt(token, sessionId) : token);\n}\n/**\n* Decodes a refresh token for a client\n*\n* @internal\n*/\nasync function decodeRefreshToken(opts, token) {\n\tif (opts.prefix?.refreshToken) if (token.startsWith(opts.prefix.refreshToken)) token = token.replace(opts.prefix.refreshToken, \"\");\n\telse throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"refresh token not found\",\n\t\terror: \"invalid_token\"\n\t});\n\treturn opts.formatRefreshToken?.decrypt ? opts.formatRefreshToken?.decrypt(token) : { token };\n}\nasync function createOpaqueAccessToken(ctx, opts, user, client, scopes, payload, resources, referenceId, authorizationCodeId, refreshId, confirmation, requestedUserInfoClaims) {\n\tconst iat = payload.iat ?? Math.floor(Date.now() / 1e3);\n\tconst exp = payload?.exp ?? iat + (opts.accessTokenExpiresIn ?? 3600);\n\tconst token = opts.generateOpaqueAccessToken ? await opts.generateOpaqueAccessToken() : generateRandomString(32, \"A-Z\", \"a-z\");\n\tawait ctx.context.adapter.create({\n\t\tmodel: \"oauthAccessToken\",\n\t\tdata: {\n\t\t\ttoken: await storeToken(opts.storeTokens, token, \"access_token\"),\n\t\t\tclientId: client.clientId,\n\t\t\tsessionId: payload?.sid,\n\t\t\tuserId: user?.id,\n\t\t\treferenceId,\n\t\t\tauthorizationCodeId,\n\t\t\tresources,\n\t\t\trefreshId,\n\t\t\tconfirmation,\n\t\t\trequestedUserInfoClaims: requestedUserInfoClaims?.length ? requestedUserInfoClaims : void 0,\n\t\t\tscopes,\n\t\t\tcreatedAt: /* @__PURE__ */ new Date(iat * 1e3),\n\t\t\texpiresAt: /* @__PURE__ */ new Date(exp * 1e3)\n\t\t}\n\t});\n\treturn (opts.prefix?.opaqueAccessToken ?? \"\") + token;\n}\n/**\n* Tear down the entire refresh-token family for a (client, user) pair, plus\n* any access tokens that reference those refresh rows, per RFC 9700 §4.14.\n* Access tokens are deleted first so the parent rows' foreign-key children\n* do not block the refresh-row delete.\n*\n* TODO(invalidate-family-race): the two `deleteMany` calls are not atomic\n* with respect to each other. Between them, a concurrent rotation in a\n* different worker can `create` a fresh refresh row (and, immediately after,\n* an access-token row referencing it) for the same (client, user) pair,\n* leaving the family partially rebuilt and the new refresh row orphaned of\n* any deletion. Closing this window requires the same transactional adapter\n* contract tracked under FIXME(strict-family-invalidation) in\n* `createRefreshToken`.\n*\n* @internal\n*/\nasync function invalidateRefreshFamily(ctx, clientId, userId) {\n\tconst refreshTokens = await ctx.context.adapter.findMany({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}, {\n\t\t\tfield: \"userId\",\n\t\t\tvalue: userId\n\t\t}]\n\t});\n\tif (refreshTokens.length) await ctx.context.adapter.deleteMany({\n\t\tmodel: \"oauthAccessToken\",\n\t\twhere: [{\n\t\t\tfield: \"refreshId\",\n\t\t\toperator: \"in\",\n\t\t\tvalue: refreshTokens.map((r) => r.id)\n\t\t}]\n\t});\n\tawait ctx.context.adapter.deleteMany({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}, {\n\t\t\tfield: \"userId\",\n\t\t\tvalue: userId\n\t\t}]\n\t});\n}\nasync function revokeTokensIssuedForAuthorizationCode(ctx, authorizationCodeId) {\n\tconst deleteIssuedTokens = async (model) => {\n\t\ttry {\n\t\t\tawait ctx.context.adapter.deleteMany({\n\t\t\t\tmodel,\n\t\t\t\twhere: [{\n\t\t\t\t\tfield: \"authorizationCodeId\",\n\t\t\t\t\tvalue: authorizationCodeId\n\t\t\t\t}]\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tctx.context.logger.error(\"authorization code replay cleanup failed\", error);\n\t\t}\n\t};\n\tawait deleteIssuedTokens(\"oauthAccessToken\");\n\tawait deleteIssuedTokens(\"oauthRefreshToken\");\n}\nasync function createRefreshToken(ctx, opts, user, referenceId, authorizationCodeId, client, scopes, payload, originalRefresh, authTime, resources, confirmation, requestedUserInfoClaims) {\n\tconst iat = payload.iat ?? Math.floor(Date.now() / 1e3);\n\tconst exp = payload?.exp ?? iat + (opts.refreshTokenExpiresIn ?? 2592e3);\n\tconst token = opts.generateRefreshToken ? await opts.generateRefreshToken() : generateRandomString(32, \"A-Z\", \"a-z\");\n\tconst sessionId = payload?.sid;\n\tconst newRow = {\n\t\ttoken: await storeToken(opts.storeTokens, token, \"refresh_token\"),\n\t\tclientId: client.clientId,\n\t\tsessionId,\n\t\tuserId: user.id,\n\t\treferenceId,\n\t\tauthorizationCodeId,\n\t\tauthTime,\n\t\tconfirmation,\n\t\trequestedUserInfoClaims: requestedUserInfoClaims?.length ? requestedUserInfoClaims : void 0,\n\t\tscopes,\n\t\tresources,\n\t\tcreatedAt: /* @__PURE__ */ new Date(iat * 1e3),\n\t\texpiresAt: /* @__PURE__ */ new Date(exp * 1e3)\n\t};\n\tif (!originalRefresh?.id) return {\n\t\tid: (await ctx.context.adapter.create({\n\t\t\tmodel: \"oauthRefreshToken\",\n\t\t\tdata: newRow\n\t\t})).id,\n\t\ttoken: await encodeRefreshToken(opts, token, sessionId)\n\t};\n\tconst rotatedAt = /* @__PURE__ */ new Date(iat * 1e3);\n\tconst rotationUpdate = {\n\t\trevoked: rotatedAt,\n\t\trotatedAt\n\t};\n\tconst reuseInterval = opts.refreshTokenReuseInterval ?? 0;\n\tif (reuseInterval > 0) rotationUpdate.rotationReplayExpiresAt = /* @__PURE__ */ new Date((iat + reuseInterval) * 1e3);\n\tif (!await ctx.context.adapter.incrementOne({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: originalRefresh.id\n\t\t}, {\n\t\t\tfield: \"revoked\",\n\t\t\toperator: \"eq\",\n\t\t\tvalue: null\n\t\t}],\n\t\tincrement: {},\n\t\tset: rotationUpdate\n\t})) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"invalid refresh token\",\n\t\terror: \"invalid_grant\"\n\t});\n\treturn {\n\t\tid: (await ctx.context.adapter.create({\n\t\t\tmodel: \"oauthRefreshToken\",\n\t\t\tdata: newRow\n\t\t})).id,\n\t\ttoken: await encodeRefreshToken(opts, token, sessionId)\n\t};\n}\nasync function resolveResourceGrantIssuance(ctx, opts, params) {\n\tconst resourcePolicy = await resolveResourcePolicy(ctx, opts, {\n\t\tresource: params.resources,\n\t\tclientId: params.clientId,\n\t\trequestedScopes: params.requestedScopes\n\t});\n\tconst resourceExpiresAtSeconds = resourcePolicy.accessTokenTtl !== null ? params.iat + resourcePolicy.accessTokenTtl : params.scopeExpiresAtSeconds;\n\tconst refreshTokenDefaultTtl = opts.refreshTokenExpiresIn ?? 2592e3;\n\tconst refreshTokenTtl = resourcePolicy.refreshTokenTtl !== null ? Math.min(resourcePolicy.refreshTokenTtl, refreshTokenDefaultTtl) : refreshTokenDefaultTtl;\n\treturn {\n\t\taudienceClaim: resourcePolicy.audienceClaim,\n\t\teffectiveScopes: resourcePolicy.effectiveScopes,\n\t\taccessTokenExpiresAtSeconds: Math.min(params.scopeExpiresAtSeconds, resourceExpiresAtSeconds),\n\t\trefreshTokenExpiresAtSeconds: params.iat + refreshTokenTtl,\n\t\trefreshResources: params.refreshToken?.resources ?? params.originalResources ?? params.resources,\n\t\tsigningAlgorithm: resourcePolicy.signingAlgorithm,\n\t\tsigningKeyId: resourcePolicy.signingKeyId,\n\t\tresourceCustomClaims: resourcePolicy.rawCustomClaims,\n\t\tdpopBoundAccessTokensRequired: resourcePolicy.dpopBoundAccessTokensRequired\n\t};\n}\nfunction throwInvalidDpopProof(errorDescription) {\n\tthrow new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_dpop_proof\",\n\t\terror_description: errorDescription\n\t});\n}\nfunction clientRequiresDpopBoundAccessTokens(client) {\n\tconst metadata = parseClientMetadata(client.metadata) ?? {};\n\treturn client.dpopBoundAccessTokens === true || metadata.dpop_bound_access_tokens === true;\n}\nasync function resolveDpopTokenBinding(ctx, opts, params) {\n\tconst authCodeDpopJkt = params.verificationValue?.query.dpop_jkt;\n\tconst refreshJkt = getConfirmationJkt(params.refreshToken?.confirmation);\n\tconst expectedJkt = refreshJkt ?? authCodeDpopJkt;\n\tconst dpopProofJwt = getDpopProofJwt(ctx);\n\tconst dpopRequired = clientRequiresDpopBoundAccessTokens(params.client) || params.grantIssuance.dpopBoundAccessTokensRequired || !!authCodeDpopJkt || !!refreshJkt;\n\tif (!dpopProofJwt) {\n\t\tif (dpopRequired) throwInvalidDpopProof(\"DPoP proof header is required\");\n\t\treturn;\n\t}\n\ttry {\n\t\treturn { jkt: (await verifyDpopProof({\n\t\t\tproofJwt: dpopProofJwt,\n\t\t\tmethod: \"POST\",\n\t\t\turl: getEndpointUrl(ctx, \"/oauth2/token\"),\n\t\t\texpectedJkt,\n\t\t\tproofMaxAgeSeconds: opts.dpop?.proofMaxAgeSeconds,\n\t\t\tsigningAlgorithms: opts.dpop?.signingAlgorithms,\n\t\t\treplayStore: createDpopReplayStore(ctx.context.internalAdapter)\n\t\t})).jkt };\n\t} catch (error) {\n\t\tif (isDpopProofError(error)) throwInvalidDpopProof(error.message);\n\t\tthrow error;\n\t}\n}\nfunction normalizeReplayValues(values) {\n\treturn values ? [...new Set(values)].sort() : void 0;\n}\nfunction sameReplayValues(left, right) {\n\tconst normalizedLeft = normalizeReplayValues(left);\n\tconst normalizedRight = normalizeReplayValues(right);\n\tif (normalizedLeft === void 0 || normalizedRight === void 0) return normalizedLeft === normalizedRight;\n\tif (normalizedLeft.length !== normalizedRight.length) return false;\n\treturn normalizedLeft.every((value, index) => value === normalizedRight[index]);\n}\nfunction confirmationReplayKey(confirmation) {\n\tif (!confirmation) return;\n\tif (\"jkt\" in confirmation) return `jkt:${confirmation.jkt}`;\n\treturn `x5t#S256:${confirmation[\"x5t#S256\"]}`;\n}\nfunction sameConfirmation(left, right) {\n\treturn confirmationReplayKey(left) === confirmationReplayKey(right);\n}\nfunction isConfirmation(value) {\n\tif (!value || typeof value !== \"object\") return false;\n\tconst confirmation = value;\n\treturn typeof confirmation.jkt === \"string\" && confirmation[\"x5t#S256\"] === void 0 || typeof confirmation[\"x5t#S256\"] === \"string\" && confirmation.jkt === void 0;\n}\nfunction isTokenType(value) {\n\treturn value === \"Bearer\" || value === \"DPoP\";\n}\nfunction isOAuthTokenResponse(value) {\n\tif (!value || typeof value !== \"object\") return false;\n\tconst response = value;\n\treturn typeof response.access_token === \"string\" && typeof response.expires_in === \"number\" && typeof response.expires_at === \"number\" && isTokenType(response.token_type) && typeof response.scope === \"string\" && (response.refresh_token === void 0 || typeof response.refresh_token === \"string\") && (response.id_token === void 0 || typeof response.id_token === \"string\");\n}\nfunction isRefreshTokenRotationReplay(value) {\n\tif (!value || typeof value !== \"object\") return false;\n\tconst replay = value;\n\tconst request = replay.request;\n\treturn !!request && Array.isArray(request.effectiveScopes) && request.effectiveScopes.every((scope) => typeof scope === \"string\") && (request.requestedResources === void 0 || Array.isArray(request.requestedResources) && request.requestedResources.every((resource) => typeof resource === \"string\")) && (request.confirmation === void 0 || isConfirmation(request.confirmation)) && isOAuthTokenResponse(replay.response);\n}\nfunction buildRefreshTokenRotationReplayRequest(params) {\n\tconst requestedResources = normalizeReplayValues(params.requestedResources);\n\treturn {\n\t\teffectiveScopes: normalizeReplayValues(params.effectiveScopes) ?? [],\n\t\t...requestedResources ? { requestedResources } : {},\n\t\t...params.confirmation ? { confirmation: params.confirmation } : {}\n\t};\n}\nfunction sameRefreshTokenRotationReplayRequest(left, right) {\n\treturn sameReplayValues(left.effectiveScopes, right.effectiveScopes) && sameReplayValues(left.requestedResources, right.requestedResources) && sameConfirmation(left.confirmation, right.confirmation);\n}\nasync function encryptRefreshTokenRotationReplay(ctx, replay) {\n\treturn symmetricEncrypt({\n\t\tkey: ctx.context.secretConfig,\n\t\tdata: JSON.stringify(replay)\n\t});\n}\nasync function decryptRefreshTokenRotationReplay(ctx, value) {\n\tconst decrypted = await symmetricDecrypt({\n\t\tkey: ctx.context.secretConfig,\n\t\tdata: value\n\t});\n\tconst parsed = JSON.parse(decrypted);\n\tif (!isRefreshTokenRotationReplay(parsed)) return;\n\treturn parsed;\n}\nfunction isWithinRefreshTokenReuseInterval(refreshToken) {\n\treturn !!refreshToken.rotatedAt && !!refreshToken.rotationReplayExpiresAt && refreshToken.rotationReplayExpiresAt >= /* @__PURE__ */ new Date();\n}\nasync function storeRefreshTokenRotationReplay(ctx, opts, refreshToken, request, response) {\n\tif ((opts.refreshTokenReuseInterval ?? 0) <= 0) return;\n\tawait ctx.context.adapter.update({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: refreshToken.id\n\t\t}],\n\t\tupdate: { rotationReplayResponse: await encryptRefreshTokenRotationReplay(ctx, {\n\t\t\trequest,\n\t\t\tresponse\n\t\t}) }\n\t});\n}\nasync function getRefreshTokenRotationReplay(ctx, refreshToken, request) {\n\tif (!isWithinRefreshTokenReuseInterval(refreshToken)) return;\n\tif (!refreshToken.rotationReplayResponse) return;\n\ttry {\n\t\tconst replay = await decryptRefreshTokenRotationReplay(ctx, refreshToken.rotationReplayResponse);\n\t\tif (!replay || !sameRefreshTokenRotationReplayRequest(replay.request, request)) return;\n\t\treturn replay.response;\n\t} catch (error) {\n\t\tctx.context.logger.error(\"refresh token rotation replay failed\", error);\n\t\treturn;\n\t}\n}\nasync function resolveRefreshTokenRotationReplayRequest(ctx, opts, params) {\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tconst grantIssuance = await resolveResourceGrantIssuance(ctx, opts, {\n\t\tclientId: params.client.clientId,\n\t\trequestedScopes: params.scopes,\n\t\tresources: params.resources,\n\t\trefreshToken: params.refreshToken,\n\t\tiat,\n\t\tscopeExpiresAtSeconds: iat + (opts.accessTokenExpiresIn ?? 3600)\n\t});\n\tconst confirmation = await resolveDpopTokenBinding(ctx, opts, {\n\t\tclient: params.client,\n\t\tgrantIssuance,\n\t\trefreshToken: params.refreshToken\n\t});\n\treturn buildRefreshTokenRotationReplayRequest({\n\t\teffectiveScopes: grantIssuance.effectiveScopes,\n\t\trequestedResources: params.resources,\n\t\tconfirmation\n\t});\n}\nfunction replayRefreshTokenRotationResponse(ctx, response) {\n\tconst now = Math.floor(Date.now() / 1e3);\n\treturn ctx.json({\n\t\t...response,\n\t\texpires_in: Math.max(0, response.expires_at - now)\n\t});\n}\nasync function createUserTokens(ctx, opts, params) {\n\tconst { client, scopes, user, grantType, referenceId, sessionId, nonce, refreshToken: existingRefreshToken, authTime, verificationValue } = params;\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tconst defaultExp = iat + (user ? opts.accessTokenExpiresIn ?? 3600 : opts.m2mAccessTokenExpiresIn ?? 3600);\n\tconst scopeExp = opts.scopeExpirations ? scopes.map((sc) => opts.scopeExpirations?.[sc] ? toExpJWT(opts.scopeExpirations[sc], iat) : defaultExp).reduce((prev, curr) => {\n\t\treturn prev < curr ? prev : curr;\n\t}, defaultExp) : defaultExp;\n\tconst grantIssuance = await resolveResourceGrantIssuance(ctx, opts, {\n\t\tclientId: client.clientId,\n\t\trequestedScopes: scopes,\n\t\tresources: params.resources,\n\t\toriginalResources: params.originalResources,\n\t\trefreshToken: params.refreshToken,\n\t\tiat,\n\t\tscopeExpiresAtSeconds: scopeExp\n\t});\n\tconst audienceClaim = grantIssuance.audienceClaim;\n\tconst effectiveScopes = grantIssuance.effectiveScopes;\n\tconst exp = grantIssuance.accessTokenExpiresAtSeconds;\n\tconst refreshTokenExp = grantIssuance.refreshTokenExpiresAtSeconds;\n\tconst isRefreshToken = user && clientAllowsGrant(client, \"refresh_token\") && (existingRefreshToken?.scopes?.includes(\"offline_access\") || scopes.includes(\"offline_access\"));\n\tconst isJwtAccessToken = audienceClaim && !opts.disableJwtPlugin;\n\tconst isIdToken = user && effectiveScopes.includes(\"openid\");\n\tconst metadata = parseClientMetadata(client.metadata);\n\tconst additionalIdTokenClaims = isIdToken && user ? {\n\t\t...await collectExtensionIdTokenClaims(opts, {\n\t\t\tctx,\n\t\t\topts,\n\t\t\tuser,\n\t\t\tclient,\n\t\t\tscopes: effectiveScopes,\n\t\t\tgrantType,\n\t\t\treferenceId,\n\t\t\tsessionId,\n\t\t\tresources: params.resources,\n\t\t\tmetadata\n\t\t}),\n\t\t...params.idTokenClaims ?? {}\n\t} : void 0;\n\tconst customFields = opts.customTokenResponseFields ? await opts.customTokenResponseFields({\n\t\tgrantType,\n\t\tuser,\n\t\tscopes: effectiveScopes,\n\t\tmetadata,\n\t\tverificationValue\n\t}) : void 0;\n\tconst refreshResources = grantIssuance.refreshResources;\n\tconst confirmation = params.confirmation ?? await resolveDpopTokenBinding(ctx, opts, {\n\t\tclient,\n\t\tgrantIssuance,\n\t\tverificationValue,\n\t\trefreshToken: existingRefreshToken\n\t});\n\tconst requestedUserInfoClaims = params.requestedUserInfoClaims ?? existingRefreshToken?.requestedUserInfoClaims ?? [];\n\tconst earlyRefreshToken = isRefreshToken && user && !isJwtAccessToken ? await createRefreshToken(ctx, opts, user, referenceId, params.authorizationCodeId, client, effectiveScopes, {\n\t\tiat,\n\t\texp: refreshTokenExp,\n\t\tsid: sessionId\n\t}, existingRefreshToken, authTime, refreshResources, confirmation, requestedUserInfoClaims) : void 0;\n\tconst accessTokenClaims = isJwtAccessToken ? await resolveAccessTokenClaims({\n\t\tctx,\n\t\topts,\n\t\tuser,\n\t\tclient,\n\t\tscopes: effectiveScopes,\n\t\tgrantType,\n\t\tsessionId,\n\t\tresources: params.resources,\n\t\treferenceId,\n\t\tmetadata,\n\t\tperRequestClaims: params.accessTokenClaims,\n\t\tresourcePolicyClaims: grantIssuance.resourceCustomClaims\n\t}) : void 0;\n\tconst [accessToken, refreshToken] = await Promise.all([isJwtAccessToken ? createJwtAccessToken(ctx, opts, user, client, audienceClaim, effectiveScopes, {\n\t\tiat,\n\t\texp,\n\t\tsid: sessionId,\n\t\tsigningAlgorithm: grantIssuance.signingAlgorithm,\n\t\tsigningKeyId: grantIssuance.signingKeyId,\n\t\taccessTokenClaims,\n\t\tconfirmation\n\t}) : createOpaqueAccessToken(ctx, opts, user, client, effectiveScopes, {\n\t\tiat,\n\t\texp,\n\t\tsid: sessionId\n\t}, params?.resources, referenceId, params.authorizationCodeId, earlyRefreshToken?.id, confirmation, requestedUserInfoClaims), earlyRefreshToken ? earlyRefreshToken : isRefreshToken && user ? createRefreshToken(ctx, opts, user, referenceId, params.authorizationCodeId, client, effectiveScopes, {\n\t\tiat,\n\t\texp: refreshTokenExp,\n\t\tsid: sessionId\n\t}, existingRefreshToken, authTime, refreshResources, confirmation, requestedUserInfoClaims) : void 0]);\n\tconst idToken = isIdToken ? await createIdToken(ctx, opts, user, client, effectiveScopes, nonce, sessionId, authTime, accessToken, additionalIdTokenClaims) : void 0;\n\tconst responseBody = {\n\t\t...customFields,\n\t\t...params.tokenResponse ?? {},\n\t\taccess_token: accessToken,\n\t\texpires_in: exp - iat,\n\t\texpires_at: exp,\n\t\ttoken_type: confirmationTokenType(confirmation),\n\t\trefresh_token: refreshToken?.token,\n\t\tscope: effectiveScopes.join(\" \"),\n\t\tid_token: idToken\n\t};\n\tif (existingRefreshToken?.id && refreshToken?.id) try {\n\t\tawait storeRefreshTokenRotationReplay(ctx, opts, existingRefreshToken, buildRefreshTokenRotationReplayRequest({\n\t\t\teffectiveScopes,\n\t\t\trequestedResources: params.resources,\n\t\t\tconfirmation\n\t\t}), responseBody);\n\t} catch (error) {\n\t\tctx.context.logger.error(\"failed to store refresh token rotation replay\", error);\n\t}\n\treturn ctx.json(responseBody);\n}\n/** Checks verification value */\nasync function checkVerificationValue(ctx, opts, code, client_id, redirect_uri, resource) {\n\tconst authorizationCodeId = await storeToken(opts.storeTokens, code, \"authorization_code\");\n\tconst verification = await ctx.context.internalAdapter.consumeVerificationValue(authorizationCodeId);\n\tif (!verification) {\n\t\tawait revokeTokensIssuedForAuthorizationCode(ctx, authorizationCodeId);\n\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"invalid code\",\n\t\t\terror: \"invalid_grant\"\n\t\t});\n\t}\n\tlet rawValue;\n\ttry {\n\t\trawValue = JSON.parse(verification.value);\n\t} catch {\n\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"malformed verification value\",\n\t\t\terror: \"invalid_grant\"\n\t\t});\n\t}\n\tconst parsed = verificationValueSchema.safeParse(rawValue);\n\tif (!parsed.success) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"malformed verification value\",\n\t\terror: \"invalid_grant\"\n\t});\n\tconst verificationValue = parsed.data;\n\tif (verificationValue.query.client_id !== client_id) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"invalid client_id\",\n\t\terror: \"invalid_grant\"\n\t});\n\tconst boundRedirectUri = verificationValue.query.redirect_uri;\n\tif (boundRedirectUri) {\n\t\tif (!redirect_uri) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"redirect_uri is required\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t\tif (boundRedirectUri !== redirect_uri) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"redirect_uri mismatch\",\n\t\t\terror: \"invalid_grant\"\n\t\t});\n\t} else if (redirect_uri) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"redirect_uri mismatch\",\n\t\terror: \"invalid_grant\"\n\t});\n\tconst storedResources = toResourceList(verificationValue.resource) ?? toResourceList(verificationValue.query.resource);\n\tconst effectiveResources = resource ?? storedResources;\n\tif (resource && storedResources) {\n\t\tconst requestedSet = new Set(resource);\n\t\tconst authorizedSet = new Set(storedResources);\n\t\tfor (const r of requestedSet) if (!authorizedSet.has(r)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"requested resource not authorized\",\n\t\t\terror: \"invalid_target\"\n\t\t});\n\t}\n\treturn {\n\t\tverificationValue,\n\t\teffectiveResources,\n\t\tauthorizedResources: storedResources,\n\t\tauthorizationCodeId\n\t};\n}\n/**\n* Obtains new Session Jwt and Refresh Tokens using a code\n*/\nasync function handleAuthorizationCodeGrant(ctx, opts) {\n\tconst { clientId: client_id, clientSecret: client_secret, preVerified, authMethod } = destructureCredentials(await extractClientCredentials(ctx, opts, `${ctx.context.baseURL}/oauth2/token`));\n\tconst { code, code_verifier, redirect_uri, resource } = ctx.body;\n\tconst resources = toResourceList(resource);\n\tif (!client_id) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"client_id is required\",\n\t\terror: \"invalid_request\"\n\t});\n\tif (!code) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"code is required\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst isAuthCodeWithSecret = client_id && client_secret;\n\tconst isAuthCodeWithPkce = client_id && code && code_verifier;\n\tif (!isAuthCodeWithSecret && !isAuthCodeWithPkce && !preVerified) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Either code_verifier or client_secret is required\",\n\t\terror: \"invalid_request\"\n\t});\n\t/** Get and check Verification Value */\n\tconst { verificationValue, effectiveResources, authorizedResources, authorizationCodeId } = await checkVerificationValue(ctx, opts, code, client_id, redirect_uri, resources);\n\tconst scopes = verificationValue.query.scope?.split(\" \");\n\tif (!scopes) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\terror_description: \"verification scope unset\",\n\t\terror: \"invalid_scope\"\n\t});\n\t/** Verify Client */\n\tconst client = await validateClientCredentials(ctx, opts, client_id, client_secret, scopes, preVerified, \"authorization_code\", authMethod);\n\tif (isPKCERequired(client, {\n\t\tscopes: (verificationValue.query?.scope)?.split(\" \") || [],\n\t\tnonce: verificationValue.query?.nonce\n\t})) {\n\t\tif (!isAuthCodeWithPkce) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"PKCE is required for this client\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t} else if (!(isAuthCodeWithPkce || isAuthCodeWithSecret || preVerified)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Either PKCE (code_verifier) or client authentication (client_secret or client_assertion) is required\",\n\t\terror: \"invalid_request\"\n\t});\n\t/** Check PKCE challenge if verifier is provided */\n\tconst pkceUsedInAuth = !!verificationValue.query?.code_challenge;\n\tconst pkceUsedInToken = !!code_verifier;\n\tif (pkceUsedInAuth || pkceUsedInToken) {\n\t\tif (pkceUsedInAuth && !pkceUsedInToken) throw new APIError(\"UNAUTHORIZED\", {\n\t\t\terror_description: \"code_verifier required because PKCE was used in authorization\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t\tif (!pkceUsedInAuth && pkceUsedInToken) throw new APIError(\"UNAUTHORIZED\", {\n\t\t\terror_description: \"code_verifier provided but PKCE was not used in authorization\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t\tif ((verificationValue.query?.code_challenge_method === \"S256\" ? await generateCodeChallenge(code_verifier) : void 0) !== verificationValue.query?.code_challenge) throw new APIError(\"UNAUTHORIZED\", {\n\t\t\terror_description: \"code verification failed\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t}\n\t/** Get user */\n\tif (!verificationValue.userId) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"missing user, user may have been deleted\",\n\t\terror: \"invalid_user\"\n\t});\n\tconst user = await ctx.context.internalAdapter.findUserById(verificationValue.userId);\n\tif (!user) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"missing user, user may have been deleted\",\n\t\terror: \"invalid_user\"\n\t});\n\tconst session = await ctx.context.adapter.findOne({\n\t\tmodel: \"session\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: verificationValue.sessionId\n\t\t}]\n\t});\n\tif (!session || session.expiresAt < /* @__PURE__ */ new Date()) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"session no longer exists\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst authTime = verificationValue.authTime != null ? normalizeTimestampValue(verificationValue.authTime) : resolveSessionAuthTime(session);\n\tconst requestedUserInfoClaims = getRequestedUserInfoClaims(verificationValue.query.claims, getSupportedClaims(opts));\n\treturn createUserTokens(ctx, opts, {\n\t\tclient,\n\t\tscopes: verificationValue.query.scope?.split(\" \") ?? [],\n\t\tuser,\n\t\tgrantType: \"authorization_code\",\n\t\treferenceId: verificationValue.referenceId,\n\t\tsessionId: session.id,\n\t\tnonce: verificationValue.query?.nonce,\n\t\tauthTime,\n\t\tverificationValue,\n\t\tauthorizationCodeId,\n\t\trequestedUserInfoClaims,\n\t\tresources: effectiveResources,\n\t\toriginalResources: authorizedResources\n\t});\n}\n/**\n* Grant that allows direct access to an API using the application's credentials\n* This grant is for M2M so the concept of a user id does not exist on the token.\n*\n* MUST follow https://datatracker.ietf.org/doc/html/rfc6749#section-4.4\n*/\nasync function handleClientCredentialsGrant(ctx, opts) {\n\tconst { clientId: client_id, clientSecret: client_secret, preVerified, authMethod } = destructureCredentials(await extractClientCredentials(ctx, opts, `${ctx.context.baseURL}/oauth2/token`));\n\tconst { scope, resource } = ctx.body;\n\tconst resources = toResourceList(resource);\n\tif (!client_id) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Missing required client_id\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst client = await validateClientCredentials(ctx, opts, client_id, client_secret, void 0, preVerified, \"client_credentials\", authMethod);\n\tif (client.tokenEndpointAuthMethod === \"none\") throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"public clients cannot use the client_credentials grant\",\n\t\terror: \"unauthorized_client\"\n\t});\n\tconst clientCredentialsScopes = client.clientCredentialsScopes;\n\tif (!clientCredentialsScopes?.length) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"client has no authorized client_credentials scopes\",\n\t\terror: \"unauthorized_client\"\n\t});\n\tlet requestedScopes = scope?.split(\" \");\n\tif (requestedScopes) {\n\t\tconst validScopes = new Set(clientCredentialsScopes);\n\t\tconst invalidScopes = requestedScopes.filter((scope) => {\n\t\t\treturn !validScopes.has(scope) || isUserDelegatedScope(scope);\n\t\t});\n\t\tif (invalidScopes.length) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: `The following scopes are invalid: ${invalidScopes.join(\", \")}`,\n\t\t\terror: \"invalid_scope\"\n\t\t});\n\t}\n\tif (!requestedScopes) requestedScopes = [...clientCredentialsScopes];\n\treturn createUserTokens(ctx, opts, {\n\t\tclient,\n\t\tscopes: requestedScopes,\n\t\tgrantType: \"client_credentials\",\n\t\tresources\n\t});\n}\n/**\n* Obtains new Session Jwt and Refresh Tokens using a refresh token\n*\n* Refresh tokens will only allow the same or lesser scopes as the initial authorize request.\n* To add scopes, you must restart the authorize process again.\n*/\nasync function handleRefreshTokenGrant(ctx, opts) {\n\tconst { clientId: client_id, clientSecret: client_secret, preVerified, authMethod } = destructureCredentials(await extractClientCredentials(ctx, opts, `${ctx.context.baseURL}/oauth2/token`));\n\tconst { refresh_token, scope, resource } = ctx.body;\n\tconst resources = toResourceList(resource);\n\tif (!client_id) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Missing required client_id\",\n\t\terror: \"invalid_request\"\n\t});\n\tif (!refresh_token) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Missing a required refresh_token for refresh_token grant\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst decodedRefresh = await decodeRefreshToken(opts, refresh_token);\n\tconst refreshToken = await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"token\",\n\t\t\tvalue: await getStoredToken(opts.storeTokens, decodedRefresh.token, \"refresh_token\")\n\t\t}]\n\t});\n\tif (!refreshToken) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"session not found\",\n\t\terror: \"invalid_grant\"\n\t});\n\tif (refreshToken.clientId !== client_id) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"invalid refresh token\",\n\t\terror: \"invalid_grant\"\n\t});\n\tif (refreshToken.expiresAt < /* @__PURE__ */ new Date()) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"invalid refresh token\",\n\t\terror: \"invalid_grant\"\n\t});\n\tif (resources && refreshToken.resources && !resources.every((v) => refreshToken.resources?.includes(v))) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"requested resource invalid\",\n\t\terror: \"invalid_target\"\n\t});\n\tconst scopes = refreshToken?.scopes;\n\tconst requestedScopes = scope?.split(\" \");\n\tif (requestedScopes) {\n\t\tconst validScopes = new Set(scopes);\n\t\tfor (const requestedScope of requestedScopes) if (!validScopes.has(requestedScope)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: `unable to issue scope ${requestedScope}`,\n\t\t\terror: \"invalid_scope\"\n\t\t});\n\t}\n\tconst client = await validateClientCredentials(ctx, opts, client_id, client_secret, requestedScopes ?? scopes, preVerified, \"refresh_token\", authMethod);\n\tif (refreshToken.revoked) {\n\t\tif (isWithinRefreshTokenReuseInterval(refreshToken)) {\n\t\t\tconst replay = await getRefreshTokenRotationReplay(ctx, refreshToken, await resolveRefreshTokenRotationReplayRequest(ctx, opts, {\n\t\t\t\tclient,\n\t\t\t\trefreshToken,\n\t\t\t\tscopes: requestedScopes ?? scopes,\n\t\t\t\tresources: resources ?? refreshToken.resources\n\t\t\t}));\n\t\t\tif (replay) return replayRefreshTokenRotationResponse(ctx, replay);\n\t\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror_description: \"invalid refresh token\",\n\t\t\t\terror: \"invalid_grant\"\n\t\t\t});\n\t\t}\n\t\tawait invalidateRefreshFamily(ctx, client_id, refreshToken.userId);\n\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"invalid refresh token\",\n\t\t\terror: \"invalid_grant\"\n\t\t});\n\t}\n\tconst user = await ctx.context.internalAdapter.findUserById(refreshToken.userId);\n\tif (!user) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"user not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst authTime = refreshToken.authTime != null ? normalizeTimestampValue(refreshToken.authTime) : void 0;\n\treturn createUserTokens(ctx, opts, {\n\t\tclient,\n\t\tscopes: requestedScopes ?? scopes,\n\t\tuser,\n\t\tgrantType: \"refresh_token\",\n\t\treferenceId: refreshToken.referenceId,\n\t\tauthorizationCodeId: refreshToken.authorizationCodeId,\n\t\tsessionId: refreshToken.sessionId,\n\t\trefreshToken,\n\t\tresources: resources ?? refreshToken.resources,\n\t\tauthTime,\n\t\trequestedUserInfoClaims: refreshToken.requestedUserInfoClaims\n\t});\n}\n//#endregion\n//#region src/introspect.ts\nvar introspect_exports = /* @__PURE__ */ __exportAll({\n\tintrospectEndpoint: () => introspectEndpoint,\n\trequireActiveAccessToken: () => requireActiveAccessToken,\n\trequireActiveAccessTokenWithClaims: () => requireActiveAccessTokenWithClaims,\n\tvalidateAccessToken: () => validateAccessToken\n});\nconst INVALID_ACCESS_TOKEN_ERROR_DESCRIPTION = \"Invalid access token\";\nconst INVALID_ACCESS_TOKEN_WWW_AUTHENTICATE = `Bearer error=\"invalid_token\", error_description=\"${INVALID_ACCESS_TOKEN_ERROR_DESCRIPTION}\"`;\nfunction inactiveAccessToken() {\n\treturn {\n\t\tpayload: { active: false },\n\t\trequestedUserInfoClaims: []\n\t};\n}\n/**\n* IMPORTANT NOTES:\n* Introspection follows RFC7662\n* https://datatracker.ietf.org/doc/html/rfc7662\n* - APIError: Continue catches (returnable to client)\n* - Error: Should immediately stop catches (internal error)\n*/\n/**\n* Resource identifiers in a token's audience, excluding the implicit\n* `/oauth2/userinfo` audience (which is not a configured resource server).\n*/\nfunction audienceResourceIdentifiers(aud, userInfoAud) {\n\tif (aud == null) return [];\n\treturn (Array.isArray(aud) ? aud : [aud]).filter((value) => typeof value === \"string\" && value !== userInfoAud);\n}\n/**\n* Authorizes an introspection request (RFC 7662 §2.1/§4). The caller is already\n* authenticated as a registered client; it may introspect the token when it\n* issued the token, or when it is a resource server linked to one of the token's\n* audience resources. Tokens with no resource audience stay issuer-only. An\n* unauthorized caller receives `{active:false}` (indistinguishable from an\n* expired or unknown token), preserving the §4 anti-scanning property.\n*/\nasync function isIntrospectionAuthorized(ctx, opts, params) {\n\tconst { introspectingClientId, issuerClientId, audienceResources } = params;\n\tif (!introspectingClientId) return true;\n\tif (introspectingClientId === issuerClientId) return true;\n\tif (audienceResources.length === 0) return false;\n\treturn isClientLinkedToAnyResource(ctx, opts, introspectingClientId, audienceResources);\n}\n/**\n* Validates a JWT access token against the configured JWKs.\n*\n* @returns RFC7662 introspection format\n*/\nasync function validateJwtAccessToken(ctx, opts, token, clientId) {\n\tconst jwtPlugin = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context);\n\tconst jwtPluginOptions = jwtPlugin?.options;\n\tconst userInfoAud = `${ctx.context.baseURL ?? \"\"}/oauth2/userinfo`;\n\tconst expectedIssuer = jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL;\n\tlet jwtPayload;\n\ttry {\n\t\tjwtPayload = (await jwtVerify(token, createLocalJWKSet(await getJwks(token, {\n\t\t\tjwksFetch: jwtPluginOptions?.jwks?.remoteUrl ? jwtPluginOptions.jwks.remoteUrl : async () => {\n\t\t\t\treturn (await jwtPlugin?.endpoints.getJwks(ctx))?.response;\n\t\t\t},\n\t\t\tjwksCacheKey: jwtPlugin\n\t\t})), { issuer: expectedIssuer })).payload;\n\t} catch (error) {\n\t\tif (error instanceof Error) {\n\t\t\tif (error.name === \"TypeError\" || error.name === \"JWSInvalid\") throw new APIError$1(\"BAD_REQUEST\", {\n\t\t\t\terror_description: \"invalid JWT signature\",\n\t\t\t\terror: \"invalid_request\"\n\t\t\t});\n\t\t\telse if (error.name === \"JWTExpired\") return { active: false };\n\t\t\telse if (error.name === \"JWTInvalid\") return { active: false };\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new Error(error);\n\t}\n\tconst rawAud = jwtPayload.aud;\n\tif (!await isAudienceClaimAllowed(ctx, opts, rawAud, [userInfoAud])) return { active: false };\n\tif (!jwtPayload.azp) return { active: false };\n\tconst client = await getClient(ctx, opts, jwtPayload.azp);\n\tif (!client || client?.disabled) return { active: false };\n\tif (!await isIntrospectionAuthorized(ctx, opts, {\n\t\tintrospectingClientId: clientId,\n\t\tissuerClientId: jwtPayload.azp,\n\t\taudienceResources: audienceResourceIdentifiers(rawAud, userInfoAud)\n\t})) return { active: false };\n\tconst sessionId = jwtPayload.sid;\n\tif (sessionId) {\n\t\tconst session = await ctx.context.adapter.findOne({\n\t\t\tmodel: \"session\",\n\t\t\twhere: [{\n\t\t\t\tfield: \"id\",\n\t\t\t\tvalue: sessionId\n\t\t\t}]\n\t\t});\n\t\tif (!session || session.expiresAt < /* @__PURE__ */ new Date()) return { active: false };\n\t}\n\tjwtPayload.client_id = jwtPayload.azp;\n\tjwtPayload.active = true;\n\tjwtPayload.token_type = confirmationTokenType(jwtPayload.cnf);\n\treturn jwtPayload;\n}\n/**\n* Searches for an opaque access token in the database and validates it\n*\n* @returns RFC7662 introspection format\n*/\nasync function validateOpaqueAccessToken(ctx, opts, token, clientId) {\n\tlet tokenValue = token;\n\tif (opts.prefix?.opaqueAccessToken) if (tokenValue.startsWith(opts.prefix.opaqueAccessToken)) tokenValue = tokenValue.replace(opts.prefix.opaqueAccessToken, \"\");\n\telse throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"opaque access token not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst accessToken = await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthAccessToken\",\n\t\twhere: [{\n\t\t\tfield: \"token\",\n\t\t\tvalue: await getStoredToken(opts.storeTokens, tokenValue, \"access_token\")\n\t\t}]\n\t});\n\tif (!accessToken) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"opaque access token not found\",\n\t\terror: \"invalid_token\"\n\t});\n\tif (!accessToken.expiresAt || accessToken.expiresAt < /* @__PURE__ */ new Date()) return inactiveAccessToken();\n\tif (accessToken.revoked) return inactiveAccessToken();\n\tconst resources = Array.isArray(accessToken.resources) ? accessToken.resources : void 0;\n\tlet client;\n\tif (accessToken.clientId) {\n\t\tclient = await getClient(ctx, opts, accessToken.clientId);\n\t\tif (!client || client?.disabled) return inactiveAccessToken();\n\t\tif (!await isIntrospectionAuthorized(ctx, opts, {\n\t\t\tintrospectingClientId: clientId,\n\t\t\tissuerClientId: accessToken.clientId,\n\t\t\taudienceResources: resources ?? []\n\t\t})) return inactiveAccessToken();\n\t}\n\tconst sessionId = accessToken.sessionId ?? void 0;\n\tif (sessionId) {\n\t\tconst session = await ctx.context.adapter.findOne({\n\t\t\tmodel: \"session\",\n\t\t\twhere: [{\n\t\t\t\tfield: \"id\",\n\t\t\t\tvalue: sessionId\n\t\t\t}]\n\t\t});\n\t\tif (!session || session.expiresAt < /* @__PURE__ */ new Date()) return inactiveAccessToken();\n\t}\n\tlet user;\n\tif (accessToken.userId) user = await ctx.context.internalAdapter.findUserById(accessToken?.userId);\n\tconst userInfoEndpoint = `${ctx.context.baseURL}/oauth2/userinfo`;\n\tif (resources?.length && !await isAudienceClaimAllowed(ctx, opts, resources, [userInfoEndpoint])) return inactiveAccessToken();\n\tconst audienceClaim = resources ? [...resources] : void 0;\n\tif (audienceClaim?.length && accessToken.scopes?.includes(\"openid\")) {\n\t\tif (!audienceClaim.includes(userInfoEndpoint)) audienceClaim.push(userInfoEndpoint);\n\t}\n\tconst resourcePolicyClaims = resources?.length ? await getResourceCustomClaims(ctx, opts, resources) : {};\n\tconst accessTokenClaims = client ? await resolveAccessTokenClaims({\n\t\tctx,\n\t\topts,\n\t\tuser,\n\t\tclient,\n\t\tscopes: accessToken.scopes ?? [],\n\t\tgrantType: void 0,\n\t\tsessionId: void 0,\n\t\tresources,\n\t\treferenceId: accessToken.referenceId,\n\t\tmetadata: parseClientMetadata(client.metadata),\n\t\tperRequestClaims: void 0,\n\t\tresourcePolicyClaims\n\t}) : {};\n\tconst jwtPluginOptions = (opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context))?.options;\n\treturn {\n\t\tpayload: {\n\t\t\t...accessTokenClaims,\n\t\t\tactive: true,\n\t\t\tiss: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL,\n\t\t\taud: toAudienceClaim(audienceClaim),\n\t\t\tclient_id: accessToken.clientId,\n\t\t\tazp: accessToken.clientId,\n\t\t\tsub: user?.id,\n\t\t\tsid: sessionId,\n\t\t\texp: Math.floor(new Date(accessToken.expiresAt).getTime() / 1e3),\n\t\t\tiat: Math.floor(new Date(accessToken.createdAt).getTime() / 1e3),\n\t\t\tscope: accessToken.scopes?.join(\" \"),\n\t\t\ttoken_type: confirmationTokenType(accessToken.confirmation),\n\t\t\t...accessToken.confirmation ? { cnf: accessToken.confirmation } : {}\n\t\t},\n\t\trequestedUserInfoClaims: accessToken.requestedUserInfoClaims ?? []\n\t};\n}\n/**\n* Validates a refresh token in the session store.\n*\n* @returns payload in RFC7662 introspection format\n*/\nasync function validateRefreshToken(ctx, opts, token, clientId) {\n\tconst refreshToken = await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"token\",\n\t\t\tvalue: await getStoredToken(opts.storeTokens, token, \"refresh_token\")\n\t\t}]\n\t});\n\tif (!refreshToken) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"token not found\",\n\t\terror: \"invalid_token\"\n\t});\n\tif (!refreshToken.clientId || refreshToken.clientId !== clientId) return { active: false };\n\tif (!refreshToken.expiresAt || refreshToken.expiresAt < /* @__PURE__ */ new Date()) return { active: false };\n\tif (refreshToken.revoked) return { active: false };\n\tlet sessionId = refreshToken.sessionId ?? void 0;\n\tif (sessionId) {\n\t\tconst session = await ctx.context.adapter.findOne({\n\t\t\tmodel: \"session\",\n\t\t\twhere: [{\n\t\t\t\tfield: \"id\",\n\t\t\t\tvalue: sessionId\n\t\t\t}]\n\t\t});\n\t\tif (!session || session.expiresAt < /* @__PURE__ */ new Date()) sessionId = void 0;\n\t}\n\tlet user = void 0;\n\tif (refreshToken.userId) user = await ctx.context.internalAdapter.findUserById(refreshToken?.userId) ?? void 0;\n\treturn {\n\t\tactive: true,\n\t\tclient_id: clientId,\n\t\tiss: ((opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context))?.options)?.jwt?.issuer ?? ctx.context.baseURL,\n\t\tsub: user?.id,\n\t\tsid: sessionId,\n\t\texp: Math.floor(new Date(refreshToken.expiresAt).getTime() / 1e3),\n\t\tiat: Math.floor(new Date(refreshToken.createdAt).getTime() / 1e3),\n\t\tscope: refreshToken.scopes?.join(\" \"),\n\t\ttoken_type: confirmationTokenType(refreshToken.confirmation),\n\t\t...refreshToken.confirmation ? { cnf: refreshToken.confirmation } : {}\n\t};\n}\nfunction createInvalidAccessTokenError() {\n\treturn new APIError$1(\"UNAUTHORIZED\", {\n\t\terror_description: INVALID_ACCESS_TOKEN_ERROR_DESCRIPTION,\n\t\terror: \"invalid_token\"\n\t}, { \"WWW-Authenticate\": INVALID_ACCESS_TOKEN_WWW_AUTHENTICATE });\n}\nfunction isInactiveTokenError(error) {\n\treturn error.status === \"BAD_REQUEST\" || error.body?.error === \"invalid_token\";\n}\n/**\n* We don't know the access token format so we try to validate it as a JWT\n* first, then as an opaque token. Returns the RFC 7662 introspection payload\n* alongside the per-issuance UserInfo claims the opaque row persisted (empty for\n* a JWT access token, which resolves UserInfo claims by scope).\n*/\nasync function resolveAccessTokenValidation(ctx, opts, token, clientId) {\n\ttry {\n\t\treturn {\n\t\t\tpayload: await validateJwtAccessToken(ctx, opts, token, clientId),\n\t\t\trequestedUserInfoClaims: []\n\t\t};\n\t} catch (err) {\n\t\tif (err instanceof APIError$1) {} else if (err instanceof Error) throw err;\n\t\telse throw new Error(err);\n\t}\n\ttry {\n\t\treturn await validateOpaqueAccessToken(ctx, opts, token, clientId);\n\t} catch (err) {\n\t\tif (err instanceof APIError$1) {} else if (err instanceof Error) throw err;\n\t\telse throw new Error(\"Unknown error validating access token\");\n\t}\n\tthrow createInvalidAccessTokenError();\n}\n/**\n* Validates an access token (JWT or opaque) and returns its RFC 7662\n* introspection-format payload.\n*\n* @internal\n*/\nasync function validateAccessToken(ctx, opts, token, clientId) {\n\treturn (await resolveAccessTokenValidation(ctx, opts, token, clientId)).payload;\n}\nasync function requireActiveAccessToken(ctx, opts, token, clientId) {\n\tconst payload = await validateAccessToken(ctx, opts, token, clientId);\n\tif (payload.active) return payload;\n\tthrow createInvalidAccessTokenError();\n}\n/**\n* UserInfo entry point: validates the access token, requires it active, and\n* returns the introspection payload together with the OIDC `claims.userinfo`\n* names persisted for the token. Opaque tokens carry the names on their row;\n* JWT access tokens return an empty list and resolve UserInfo claims by scope.\n*/\nasync function requireActiveAccessTokenWithClaims(ctx, opts, token, clientId) {\n\tconst { payload, requestedUserInfoClaims } = await resolveAccessTokenValidation(ctx, opts, token, clientId);\n\tif (payload.active) return {\n\t\tpayload,\n\t\trequestedUserInfoClaims\n\t};\n\tthrow createInvalidAccessTokenError();\n}\n/**\n* Resolves pairwise sub on an introspection payload.\n* Applied at the presentation layer so internal validation functions\n* keep real user.id (needed for user lookup in /userinfo).\n*/\nasync function resolveIntrospectionSub(ctx, opts, payload, introspectingClient) {\n\tif (!payload.active || !payload.sub) return payload;\n\tconst issuerClientId = payload.client_id ?? payload.azp;\n\tif (!issuerClientId) return payload;\n\tconst issuingClient = issuerClientId === introspectingClient.clientId ? introspectingClient : await getClient(ctx, opts, issuerClientId);\n\tif (!issuingClient) return payload;\n\tconst resolvedSub = await resolveSubjectIdentifier(payload.sub, issuingClient, opts);\n\treturn {\n\t\t...payload,\n\t\tsub: resolvedSub\n\t};\n}\nasync function introspectEndpoint(ctx, opts) {\n\tlet { token, token_type_hint } = ctx.body;\n\tif (token_type_hint !== \"access_token\" && token_type_hint !== \"refresh_token\") token_type_hint = void 0;\n\tconst { clientId: client_id, clientSecret: client_secret, preVerified, authMethod } = destructureCredentials(await extractClientCredentials(ctx, opts, `${ctx.context.baseURL}/oauth2/introspect`));\n\tif (!client_id || !client_secret && !preVerified) throw new APIError$1(\"UNAUTHORIZED\", {\n\t\terror_description: \"missing required credentials\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (token && typeof token === \"string\") token = stripAccessTokenAuthorizationScheme(token);\n\tif (!token?.length) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"missing a required token for introspection\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst client = await validateClientCredentials(ctx, opts, client_id, client_secret, void 0, preVerified, void 0, authMethod);\n\ttry {\n\t\tif (token_type_hint === void 0 || token_type_hint === \"access_token\") try {\n\t\t\treturn resolveIntrospectionSub(ctx, opts, await validateAccessToken(ctx, opts, token, client.clientId), client);\n\t\t} catch (error) {\n\t\t\tif (error instanceof APIError$1) {\n\t\t\t\tif (token_type_hint === \"access_token\") throw error;\n\t\t\t} else if (error instanceof Error) throw error;\n\t\t\telse throw new Error(error);\n\t\t}\n\t\tif (token_type_hint === void 0 || token_type_hint === \"refresh_token\") try {\n\t\t\treturn resolveIntrospectionSub(ctx, opts, await validateRefreshToken(ctx, opts, (await decodeRefreshToken(opts, token)).token, client.clientId), client);\n\t\t} catch (error) {\n\t\t\tif (error instanceof APIError$1) {\n\t\t\t\tif (token_type_hint === \"refresh_token\") throw error;\n\t\t\t} else if (error instanceof Error) throw error;\n\t\t\telse throw new Error(error);\n\t\t}\n\t\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\t\terror_description: \"token not found\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof APIError$1) {\n\t\t\tif (isInactiveTokenError(error)) return { active: false };\n\t\t\tthrow error;\n\t\t} else if (error instanceof Error) {\n\t\t\tlogger.error(\"Introspection error:\", error.message, error.stack);\n\t\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\");\n\t\t} else {\n\t\t\tlogger.error(\"Introspection error:\", error);\n\t\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\");\n\t\t}\n\t}\n}\n//#endregion\nexport { claimsRequestParameterSchema as A, clientJwksSchema as C, STANDARD_CLAIM_NAMES as D, STANDARD_CLAIMS as E, getRequestedUserInfoClaims as M, isValidOidcClaimsRequest as N, getSupportedClaims as O, authorizationQuerySchema as S, oauthClientMetadataSchema as T, logStartupSeedFailure as _, invalidateRefreshFamily as a, ResourceUriSchema as b, normalizeClientCredentialsScopes as c, assertIdentifierValid as d, extractRepeatedResourceFromForm as f, logEnforcePerClientResourcesResolution as g, isAudienceClaimAllowed as h, getOAuthProviderApi as i, filterClaimsRequestUserInfoClaims as j, canSatisfyEssentialAcrRequest as k, validateClientCredentialsScopes as l, invalidateResourceCache as m, introspect_exports as n, tokenEndpoint as o, getResource as p, decodeRefreshToken as r, userInfoEndpoint as s, introspectEndpoint as t, JWS_ALGORITHMS as u, resolveResourcePolicy as v, clientRegistrationRequestSchema as w, SafeUrlSchema as x, seedResourcesOnce as y };\n","//#endregion\n//#region src/version.ts\nconst PACKAGE_VERSION = \"1.7.8\";\n//#endregion\nexport { PACKAGE_VERSION as t };\n","//#region src/utils/fetch-metadata.ts\nfunction isBrowserFetchRequest(headers) {\n\treturn headers?.get(\"sec-fetch-mode\") === \"cors\";\n}\n//#endregion\nexport { isBrowserFetchRequest };\n","import { t as __exportAll } from \"./rolldown-runtime-wcPFST8Q.mjs\";\nimport { A as claimsRequestParameterSchema, C as clientJwksSchema, D as STANDARD_CLAIM_NAMES, E as STANDARD_CLAIMS, M as getRequestedUserInfoClaims, N as isValidOidcClaimsRequest, O as getSupportedClaims, S as authorizationQuerySchema, _ as logStartupSeedFailure, a as invalidateRefreshFamily, b as ResourceUriSchema, c as normalizeClientCredentialsScopes, d as assertIdentifierValid, f as extractRepeatedResourceFromForm, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, j as filterClaimsRequestUserInfoClaims, k as canSatisfyEssentialAcrRequest, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as tokenEndpoint, p as getResource, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as JWS_ALGORITHMS, v as resolveResourcePolicy, w as clientRegistrationRequestSchema, x as SafeUrlSchema, y as seedResourcesOnce } from \"./introspect-H3uoUiuS.mjs\";\nimport { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from \"./utils-CGIZS-Da.mjs\";\nimport { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from \"./signed-query-Df1MNiSH.mjs\";\nimport { t as PACKAGE_VERSION } from \"./version-BPS0os17.mjs\";\nimport { isBrowserFetchRequest } from \"@better-auth/core/utils/fetch-metadata\";\nimport { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from \"@better-auth/core/utils/host\";\nimport { appendQueryParams } from \"@better-auth/core/utils/url\";\nimport { APIError, NO_STORE_HEADERS, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, dispatchAuthEndpoint, getOAuthState, getSessionFromCtx, sessionMiddleware } from \"better-auth/api\";\nimport { generateRandomString, makeSignature } from \"better-auth/crypto\";\nimport { APIError as APIError$1 } from \"better-call\";\nimport { logger } from \"@better-auth/core/env\";\nimport * as z from \"zod\";\nimport { defineRequestState, getCurrentAdapter, runWithTransaction } from \"@better-auth/core/context\";\nimport { BetterAuthError } from \"@better-auth/core/error\";\nimport { deleteSessionCookie, parseSetCookieHeader } from \"better-auth/cookies\";\nimport { mergeSchema } from \"better-auth/db\";\nimport { CLIENT_ASSERTION_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from \"@better-auth/core/oauth2\";\nimport { createHash } from \"@better-auth/utils/hash\";\nimport { getJwks, stripAccessTokenAuthorizationScheme } from \"better-auth/oauth2\";\nimport { compactVerify, createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from \"jose\";\nimport { isNativePrivateUseRedirectUri } from \"@better-auth/core/utils/redirect-uri\";\nimport { resolveSigningKey, signJWT, toExpJWT } from \"better-auth/plugins\";\nimport { encodeDeterministicId } from \"@better-auth/core/db/internal\";\n//#region src/consent.ts\nasync function consentEndpoint(ctx, opts, authorize) {\n\tconst oauthRequest = await oAuthState.get();\n\tconst _query = oauthRequest?.query;\n\tif (!_query) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"missing oauth query\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst query = new URLSearchParams(_query);\n\tconst originalRequestedScopes = query.get(\"scope\")?.split(\" \") ?? [];\n\tconst supportedClaims = getSupportedClaims(opts);\n\tconst originalRequestedUserInfoClaims = getRequestedUserInfoClaims(query.get(\"claims\"), supportedClaims);\n\tconst clientId = query.get(\"client_id\");\n\tif (!clientId) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"client_id is required\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst requestedScopes = ctx.body.scope?.split(\" \");\n\tif (requestedScopes) {\n\t\tif (!requestedScopes.every((sc) => originalRequestedScopes?.includes(sc))) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror_description: \"Scope not originally requested\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t}\n\tconst acceptedClaims = ctx.body.claims;\n\tconst acceptedUserInfoClaims = acceptedClaims !== void 0 ? getRequestedUserInfoClaims(acceptedClaims, supportedClaims) : originalRequestedUserInfoClaims;\n\tif (acceptedClaims !== void 0 && !acceptedUserInfoClaims.every((claim) => originalRequestedUserInfoClaims.includes(claim))) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Claim not originally requested\",\n\t\terror: \"invalid_request\"\n\t});\n\tif (!(ctx.body.accept === true)) return {\n\t\tredirect: true,\n\t\turl: formatErrorURL(query.get(\"redirect_uri\") ?? \"\", \"access_denied\", \"User denied access\", query.get(\"state\") ?? void 0, getIssuer(ctx, opts))\n\t};\n\tconst session = await getSessionFromCtx(ctx);\n\tconst hasLoginPrompt = parsePrompt(query.get(\"prompt\") ?? \"\").has(\"login\");\n\tconst hasSatisfiedLoginPrompt = hasLoginPrompt && isSessionFreshForSignedQuery(session?.session.createdAt, oauthRequest?.signedQueryIssuedAt);\n\tif (hasLoginPrompt && !hasSatisfiedLoginPrompt) {\n\t\tctx?.headers?.set(\"accept\", \"application/json\");\n\t\tctx.query = searchParamsToQuery(query);\n\t\treturn await authorize(ctx);\n\t}\n\tconst referenceId = await opts.postLogin?.consentReferenceId?.({\n\t\tuser: session?.user,\n\t\tsession: session?.session,\n\t\tscopes: requestedScopes ?? originalRequestedScopes\n\t});\n\tconst foundConsent = await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthConsent\",\n\t\twhere: [\n\t\t\t{\n\t\t\t\tfield: \"clientId\",\n\t\t\t\tvalue: clientId\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"userId\",\n\t\t\t\tvalue: session?.user.id\n\t\t\t},\n\t\t\t...referenceId ? [{\n\t\t\t\tfield: \"referenceId\",\n\t\t\t\tvalue: referenceId\n\t\t\t}] : []\n\t\t]\n\t});\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tconst resource = query.getAll(\"resource\");\n\tconst consent = {\n\t\tclientId,\n\t\tuserId: session?.user.id,\n\t\tscopes: requestedScopes ?? originalRequestedScopes,\n\t\trequestedUserInfoClaims: acceptedUserInfoClaims,\n\t\tcreatedAt: /* @__PURE__ */ new Date(iat * 1e3),\n\t\tupdatedAt: /* @__PURE__ */ new Date(iat * 1e3),\n\t\tresources: resource.length ? resource : void 0,\n\t\treferenceId\n\t};\n\tfoundConsent?.id ? await ctx.context.adapter.update({\n\t\tmodel: \"oauthConsent\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: foundConsent.id\n\t\t}],\n\t\tupdate: {\n\t\t\tresources: consent.resources,\n\t\t\tscopes: consent.scopes,\n\t\t\trequestedUserInfoClaims: consent.requestedUserInfoClaims,\n\t\t\tupdatedAt: /* @__PURE__ */ new Date(iat * 1e3)\n\t\t}\n\t}) : await ctx.context.adapter.create({\n\t\tmodel: \"oauthConsent\",\n\t\tdata: {\n\t\t\t...consent,\n\t\t\tscopes: consent.scopes\n\t\t}\n\t});\n\tif (requestedScopes) query.set(\"scope\", consent.scopes.join(\" \"));\n\tif (acceptedClaims !== void 0) {\n\t\tconst claimsRequest = filterClaimsRequestUserInfoClaims(query.get(\"claims\"), acceptedUserInfoClaims);\n\t\tif (claimsRequest) query.set(\"claims\", JSON.stringify(claimsRequest));\n\t\telse query.delete(\"claims\");\n\t}\n\tctx?.headers?.set(\"accept\", \"application/json\");\n\tlet authorizationQuery = removePromptFromQuery(query, \"consent\");\n\tif (hasSatisfiedLoginPrompt) {\n\t\tauthorizationQuery = removePromptFromQuery(authorizationQuery, \"login\");\n\t\tauthorizationQuery = removeMaxAgeFromQuery(authorizationQuery);\n\t}\n\tctx.query = searchParamsToQuery(authorizationQuery);\n\treturn await authorize(ctx, { postLogin: oauthRequest?.postLoginClearedForSession !== void 0 && oauthRequest.postLoginClearedForSession === session?.session.id });\n}\n//#endregion\n//#region src/continue.ts\nasync function continueEndpoint(ctx, authorize) {\n\tif (ctx.body.selected === true) return await selected(ctx, authorize);\n\telse if (ctx.body.created === true) return await created(ctx, authorize);\n\telse if (ctx.body.postLogin === true) return await postLogin(ctx, authorize);\n\telse throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"Missing parameters\",\n\t\terror: \"invalid_request\"\n\t});\n}\nasync function selected(ctx, authorize) {\n\tconst _query = (await oAuthState.get())?.query;\n\tif (!_query) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"missing oauth query\",\n\t\terror: \"invalid_request\"\n\t});\n\tctx.headers?.set(\"accept\", \"application/json\");\n\tctx.query = searchParamsToQuery(removePromptFromQuery(new URLSearchParams(_query), \"select_account\"));\n\treturn await authorize(ctx);\n}\nasync function created(ctx, authorize) {\n\tconst _query = (await oAuthState.get())?.query;\n\tif (!_query) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"missing oauth query\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst query = new URLSearchParams(_query);\n\tctx.headers?.set(\"accept\", \"application/json\");\n\tctx.query = searchParamsToQuery(removePromptFromQuery(query, \"create\"));\n\treturn await authorize(ctx);\n}\nasync function postLogin(ctx, authorize) {\n\tconst state = await oAuthState.get();\n\tconst _query = state?.query;\n\tif (!_query) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"missing oauth query\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst query = new URLSearchParams(_query);\n\tctx.headers?.set(\"accept\", \"application/json\");\n\tctx.query = searchParamsToQuery(query);\n\tconst session = await getSessionFromCtx(ctx);\n\treturn await authorize(ctx, { postLogin: state?.postLoginClearedForSession !== void 0 && state.postLoginClearedForSession === session?.session.id });\n}\n//#endregion\n//#region src/logout.ts\nconst BACKCHANNEL_LOGOUT_EVENT_URI = \"http://schemas.openid.net/event/backchannel-logout\";\nconst LOGOUT_TOKEN_JWT_TYP = \"logout+jwt\";\nconst LOGOUT_TOKEN_LIFETIME_SECONDS = 120;\nconst BACKCHANNEL_DISPATCH_TIMEOUT_MS = 5e3;\n/**\n* Signs a Back-Channel Logout Token per OIDC Back-Channel Logout 1.0 §2.4.\n*\n* The token reuses the ID Token signing key so any RP that validates ID Tokens\n* from this OP can validate Logout Tokens without extra configuration. The\n* caller resolves that key once and passes it in so a fan-out to many RPs does\n* not re-read it per target.\n*\n* §2.4 mandates `iss`, `aud`, `iat`, `exp`, `jti`, `events`, and at least one\n* of `sub` / `sid` (we send both). A `nonce` claim MUST NOT be present, and\n* `alg: none` is forbidden (§2.6).\n*/\nasync function signLogoutToken(ctx, options, resolvedKey, claims) {\n\treturn signJWT(ctx, {\n\t\toptions,\n\t\tpayload: {\n\t\t\t...claims,\n\t\t\tevents: { [BACKCHANNEL_LOGOUT_EVENT_URI]: {} }\n\t\t},\n\t\theader: { typ: LOGOUT_TOKEN_JWT_TYP },\n\t\tresolvedKey: resolvedKey ?? void 0\n\t});\n}\n/**\n* Build the immutable work plan before a session is deleted. This phase only\n* reads database state because a later delete hook may still veto the mutation.\n* Token identifiers must be captured here because their `sessionId` foreign key\n* is cleared when the session row disappears.\n*\n* Revocation is the stored backstop, not the primary enforcement: introspection\n* and `/userinfo` already treat a token whose session has ended as inactive\n* (see `validateOpaqueAccessToken` / `validateJwtAccessToken`), so a missed\n* `revoked` write cannot keep a session-bound token alive on its own. Access\n* tokens bound to the session are revoked as OP hardening. Refresh tokens\n* follow OIDC Back-Channel Logout 1.0 §2.7: those without `offline_access` are\n* revoked; `offline_access` refresh tokens survive so long-lived API access can\n* outlive the browser session.\n*\n* Token revocation runs regardless of the JWT plugin (refresh-token revocation\n* has no dependency on signing). Only Logout Token delivery needs the JWT\n* plugin, so a plan may contain token identifiers with no delivery targets.\n*\n* Returns `null` when there is nothing to do, so the caller can skip the\n* background handoff entirely.\n*/\nasync function prepareBackchannelLogoutPlan(ctx, opts, input) {\n\tconst { sessionId, userId } = input;\n\tif (!userId) return null;\n\tconst logger = ctx.context.logger;\n\ttry {\n\t\tconst adapter = await getCurrentAdapter(ctx.context.adapter);\n\t\tconst where = [{\n\t\t\tfield: \"sessionId\",\n\t\t\tvalue: sessionId\n\t\t}];\n\t\tconst [accessTokens, refreshTokens] = await Promise.all([adapter.findMany({\n\t\t\tmodel: \"oauthAccessToken\",\n\t\t\twhere\n\t\t}), adapter.findMany({\n\t\t\tmodel: \"oauthRefreshToken\",\n\t\t\twhere\n\t\t})]);\n\t\tconst affectedClientIds = /* @__PURE__ */ new Set();\n\t\tfor (const t of accessTokens) affectedClientIds.add(t.clientId);\n\t\tfor (const t of refreshTokens) affectedClientIds.add(t.clientId);\n\t\tif (affectedClientIds.size === 0) return null;\n\t\tconst clients = await adapter.findMany({\n\t\t\tmodel: \"oauthClient\",\n\t\t\twhere: [{\n\t\t\t\tfield: \"clientId\",\n\t\t\t\toperator: \"in\",\n\t\t\t\tvalue: Array.from(affectedClientIds)\n\t\t\t}]\n\t\t});\n\t\tconst accessToRevokeIds = accessTokens.filter((t) => !t.revoked).map((t) => t.id);\n\t\tconst refreshToRevokeIds = refreshTokens.filter((t) => !t.revoked && !t.scopes?.includes(\"offline_access\")).map((t) => t.id);\n\t\tconst eligibleClients = opts.disableJwtPlugin ? [] : clients.filter((c) => Boolean(c.backchannelLogoutUri) && !c.disabled);\n\t\treturn {\n\t\t\taccessTokenIds: accessToRevokeIds,\n\t\t\trefreshTokenIds: refreshToRevokeIds,\n\t\t\tsessionId,\n\t\t\ttargets: (await Promise.all(eligibleClients.map(async (client) => {\n\t\t\t\ttry {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tclient,\n\t\t\t\t\t\tsub: await resolveSubjectIdentifier(userId, client, opts)\n\t\t\t\t\t};\n\t\t\t\t} catch (error) {\n\t\t\t\t\tlogger.warn(`back-channel logout: unable to resolve subject for client ${client.clientId}`, error);\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t}))).filter((target) => target !== null)\n\t\t};\n\t} catch (error) {\n\t\tlogger.error(\"back-channel logout planning failed\", error);\n\t\treturn null;\n\t}\n}\n/**\n* Apply a prepared logout plan after the session deletion succeeds. Core runs\n* `session.delete.after` after the row is consumed and, for transactional\n* callers, only after the transaction commits.\n*/\nasync function applyBackchannelLogoutPlan(ctx, plan) {\n\tconst revokedAt = /* @__PURE__ */ new Date();\n\tconst adapter = await getCurrentAdapter(ctx.context.adapter);\n\tconst revocations = await Promise.allSettled([plan.accessTokenIds.length > 0 ? adapter.updateMany({\n\t\tmodel: \"oauthAccessToken\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\toperator: \"in\",\n\t\t\tvalue: plan.accessTokenIds\n\t\t}],\n\t\tupdate: { revoked: revokedAt }\n\t}) : Promise.resolve(), plan.refreshTokenIds.length > 0 ? adapter.updateMany({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\toperator: \"in\",\n\t\t\tvalue: plan.refreshTokenIds\n\t\t}],\n\t\tupdate: { revoked: revokedAt }\n\t}) : Promise.resolve()]);\n\tfor (const result of revocations) if (result.status === \"rejected\") ctx.context.logger.error(\"back-channel logout: token revocation update failed\", result.reason);\n\tif (plan.targets.length > 0) await deliverBackchannelLogoutTokens(ctx, plan);\n}\n/**\n* Asynchronous phase: sign one Logout Token per target client and POST it to\n* the registered `backchannel_logout_uri`. The caller hands this to\n* `runInBackgroundOrAwait`, so when a background handler is configured (Vercel\n* `waitUntil`, Cloudflare `ctx.waitUntil`) it runs after the response; without\n* one it completes inline so delivery is not lost on request teardown.\n*\n* Spec §2.5: \"the OP SHOULD NOT retransmit\", so each RP gets a single attempt\n* within `BACKCHANNEL_DISPATCH_TIMEOUT_MS`. Every per-client failure (fetch\n* error, non-2xx response, signing error, subject resolution error) is\n* logged; none of them can reject the outer promise.\n*/\nasync function deliverBackchannelLogoutTokens(ctx, plan) {\n\tconst logger = ctx.context.logger;\n\tconst jwtPluginOptions = getJwtPlugin(ctx.context)?.options;\n\tconst iss = jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL;\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tconst exp = iat + LOGOUT_TOKEN_LIFETIME_SECONDS;\n\tconst resolvedKey = jwtPluginOptions?.jwt?.sign ? null : await resolveSigningKey(ctx, jwtPluginOptions);\n\tawait Promise.allSettled(plan.targets.map(async ({ client, sub }) => {\n\t\ttry {\n\t\t\tconst jti = generateRandomString(32, \"a-z\", \"A-Z\", \"0-9\");\n\t\t\tconst token = await signLogoutToken(ctx, jwtPluginOptions, resolvedKey, {\n\t\t\t\tiss,\n\t\t\t\taud: client.clientId,\n\t\t\t\tsub,\n\t\t\t\tsid: plan.sessionId,\n\t\t\t\tiat,\n\t\t\t\texp,\n\t\t\t\tjti\n\t\t\t});\n\t\t\tconst response = await fetch(client.backchannelLogoutUri, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\"\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({ logout_token: token }),\n\t\t\t\tsignal: AbortSignal.timeout(BACKCHANNEL_DISPATCH_TIMEOUT_MS),\n\t\t\t\tredirect: \"error\"\n\t\t\t});\n\t\t\tif (response.status !== 200 && response.status !== 204) logger.warn(`back-channel logout to client ${client.clientId} returned ${response.status}`);\n\t\t} catch (error) {\n\t\t\tlogger.warn(`back-channel logout to client ${client.clientId} failed`, error);\n\t\t}\n\t}));\n}\nconst LOGOUT_CONFIRMATION_TTL_SECONDS = 300;\nconst LOGOUT_CONFIRMATION_COOKIE_SUFFIX = \".oauth_logout_confirmation\";\nfunction escapeHtml(value) {\n\treturn value.replace(/[&<>\"']/g, (character) => {\n\t\tswitch (character) {\n\t\t\tcase \"&\": return \"&amp;\";\n\t\t\tcase \"<\": return \"&lt;\";\n\t\t\tcase \">\": return \"&gt;\";\n\t\t\tcase \"\\\"\": return \"&quot;\";\n\t\t\tcase \"'\": return \"&#39;\";\n\t\t\tdefault: return character;\n\t\t}\n\t});\n}\nfunction isBrowserNavigation(ctx) {\n\tconst headers = ctx.request?.headers ?? ctx.headers;\n\tif (!headers || isBrowserFetchRequest(headers)) return false;\n\tconst accept = headers.get(\"accept\") ?? \"\";\n\treturn headers.get(\"sec-fetch-mode\") === \"navigate\" || accept.includes(\"text/html\") || accept.includes(\"application/xhtml+xml\");\n}\nfunction logoutPage(title, body, status = 200) {\n\treturn new Response(`<!doctype html><html><head><meta charset=\"utf-8\"><title>${escapeHtml(title)}</title></head><body>${body}</body></html>`, {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"cache-control\": \"no-store\",\n\t\t\t\"content-security-policy\": \"default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'\",\n\t\t\t\"content-type\": \"text/html; charset=utf-8\",\n\t\t\tpragma: \"no-cache\",\n\t\t\t\"x-content-type-options\": \"nosniff\"\n\t\t}\n\t});\n}\nfunction logoutConfirmationPath(ctx) {\n\treturn `${ctx.context.baseURL.replace(/\\/$/, \"\")}/oauth2/end-session/confirm`;\n}\nfunction logoutConfirmationCookiePath(ctx) {\n\ttry {\n\t\treturn new URL(logoutConfirmationPath(ctx)).pathname;\n\t} catch {\n\t\treturn \"/oauth2/end-session/confirm\";\n\t}\n}\nfunction logoutConfirmationPage(ctx) {\n\treturn logoutPage(\"Confirm logout\", `<main><h1>Confirm logout</h1><p>Do you want to log out of this account?</p><form method=\"post\" data-oidc-logout-confirmation action=\"${escapeHtml(logoutConfirmationPath(ctx))}\"><button type=\"submit\" name=\"action\" value=\"confirm\">Confirm logout</button></form></main>`);\n}\nfunction logoutSuccessPage(note) {\n\treturn logoutPage(\"Logged out\", `<main><p data-oidc-logout-state=\"logged-out\">${note ? `Logged out. ${escapeHtml(note)}` : \"Logged out.\"}</p></main>`);\n}\nfunction logoutErrorPage(description, status) {\n\treturn logoutPage(\"Logout error\", `<main><h1>Logout error</h1><p data-oidc-logout-state=\"error\">${escapeHtml(description)}</p></main>`, status);\n}\nfunction logoutProtocolError(ctx, status, error, description) {\n\tif (isBrowserNavigation(ctx)) return logoutErrorPage(description, status === \"BAD_REQUEST\" ? 400 : status === \"UNAUTHORIZED\" ? 401 : 500);\n\tthrow new APIError$1(status, {\n\t\terror,\n\t\terror_description: description\n\t});\n}\nfunction logoutConfirmationCookieName(ctx) {\n\treturn `${ctx.context.authCookies.sessionToken.name}${LOGOUT_CONFIRMATION_COOKIE_SUFFIX}`;\n}\nfunction logoutConfirmationCookieOptions(ctx, maxAge) {\n\treturn {\n\t\t...ctx.context.authCookies.sessionToken.attributes,\n\t\thttpOnly: true,\n\t\tmaxAge,\n\t\tpath: logoutConfirmationCookiePath(ctx),\n\t\tsameSite: \"lax\"\n\t};\n}\nasync function setLogoutConfirmationState(ctx, sessionId, confirmation = {}) {\n\tconst state = {\n\t\t...sessionId ? { sessionId } : {},\n\t\t...confirmation,\n\t\texpiresAt: Date.now() + LOGOUT_CONFIRMATION_TTL_SECONDS * 1e3\n\t};\n\tawait ctx.setSignedCookie(logoutConfirmationCookieName(ctx), JSON.stringify(state), ctx.context.secret, logoutConfirmationCookieOptions(ctx, LOGOUT_CONFIRMATION_TTL_SECONDS));\n}\nasync function getLogoutConfirmationState(ctx) {\n\tconst value = await ctx.getSignedCookie(logoutConfirmationCookieName(ctx), ctx.context.secret);\n\tif (typeof value !== \"string\") return null;\n\ttry {\n\t\tconst parsed = JSON.parse(value);\n\t\tif (typeof parsed !== \"object\" || parsed === null) return null;\n\t\tconst record = parsed;\n\t\tif (record.sessionId !== void 0 && (typeof record.sessionId !== \"string\" || record.sessionId.length === 0) || record.clientId !== void 0 && (typeof record.clientId !== \"string\" || record.clientId.length === 0) || record.postLogoutRedirectUri !== void 0 && (typeof record.postLogoutRedirectUri !== \"string\" || record.postLogoutRedirectUri.length === 0) || record.state !== void 0 && typeof record.state !== \"string\" || record.redirectInvalid !== void 0 && typeof record.redirectInvalid !== \"boolean\" || record.postLogoutRedirectUri !== void 0 && record.clientId === void 0 || typeof record.expiresAt !== \"number\" || !Number.isFinite(record.expiresAt)) return null;\n\t\treturn {\n\t\t\t...typeof record.sessionId === \"string\" ? { sessionId: record.sessionId } : {},\n\t\t\t...typeof record.clientId === \"string\" ? { clientId: record.clientId } : {},\n\t\t\t...typeof record.postLogoutRedirectUri === \"string\" ? { postLogoutRedirectUri: record.postLogoutRedirectUri } : {},\n\t\t\t...typeof record.state === \"string\" ? { state: record.state } : {},\n\t\t\t...typeof record.redirectInvalid === \"boolean\" ? { redirectInvalid: record.redirectInvalid } : {},\n\t\t\texpiresAt: record.expiresAt\n\t\t};\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction clearLogoutConfirmationState(ctx) {\n\tctx.setCookie(logoutConfirmationCookieName(ctx), \"\", logoutConfirmationCookieOptions(ctx, 0));\n}\nasync function getCurrentBrowserSession(ctx) {\n\tconst token = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);\n\tif (typeof token !== \"string\" || token.length === 0) return null;\n\ttry {\n\t\tconst result = await ctx.context.internalAdapter.findSession(token);\n\t\treturn result ? { session: result.session } : null;\n\t} catch (error) {\n\t\tctx.context.logger.error(\"Failed to read the current logout session\", error);\n\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\", {\n\t\t\terror: \"server_error\",\n\t\t\terror_description: \"Unable to read the current session\"\n\t\t});\n\t}\n}\nasync function findHintedSession(ctx, sessionId) {\n\ttry {\n\t\treturn await ctx.context.adapter.findOne({\n\t\t\tmodel: \"session\",\n\t\t\twhere: [{\n\t\t\t\tfield: \"id\",\n\t\t\t\tvalue: sessionId\n\t\t\t}]\n\t\t});\n\t} catch (error) {\n\t\tctx.context.logger.error(\"Failed to read the hinted logout session\", error);\n\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\", {\n\t\t\terror: \"server_error\",\n\t\t\terror_description: \"Unable to read the hinted session\"\n\t\t});\n\t}\n}\nasync function deleteLogoutSession(ctx, session) {\n\tif (typeof session.token !== \"string\" || session.token.length === 0) throw new APIError$1(\"INTERNAL_SERVER_ERROR\", {\n\t\terror: \"server_error\",\n\t\terror_description: \"Unable to complete logout\"\n\t});\n\ttry {\n\t\tawait ctx.context.internalAdapter.deleteSession(session.token);\n\t} catch (error) {\n\t\tctx.context.logger.error(\"Failed to delete the logout session\", error);\n\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\", {\n\t\t\terror: \"server_error\",\n\t\t\terror_description: \"Unable to complete logout\"\n\t\t});\n\t}\n}\nasync function getLogoutClient(ctx, opts, clientId) {\n\ttry {\n\t\treturn await getClient(ctx, opts, clientId);\n\t} catch (error) {\n\t\tctx.context.logger.error(\"Failed to resolve the logout client\", error);\n\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\", {\n\t\t\terror: \"server_error\",\n\t\t\terror_description: \"Unable to resolve the logout client\"\n\t\t});\n\t}\n}\nfunction normalizeLogoutAudiences(value) {\n\treturn (Array.isArray(value) ? value : [value]).filter((candidate) => typeof candidate === \"string\");\n}\nfunction getHintClientId(payload) {\n\tif (typeof payload.aud === \"string\" && payload.aud.length > 0) return payload.aud;\n\tif (typeof payload.azp === \"string\" && payload.azp.length > 0) return payload.azp;\n\tconst audiences = normalizeLogoutAudiences(payload.aud);\n\treturn audiences.length === 1 ? audiences[0] : null;\n}\nasync function resolveHintClient(ctx, opts, hint, clientId) {\n\tif (clientId) return getLogoutClient(ctx, opts, clientId);\n\tlet decoded;\n\ttry {\n\t\tdecoded = decodeJwt(hint);\n\t} catch {\n\t\treturn null;\n\t}\n\tconst candidate = getHintClientId(decoded);\n\treturn candidate ? getLogoutClient(ctx, opts, candidate) : null;\n}\nasync function verifyLogoutHint(ctx, opts, hint, client) {\n\ttry {\n\t\tlet payload;\n\t\tif (opts.disableJwtPlugin) {\n\t\t\tif (!client.clientSecret) return null;\n\t\t\tconst secret = await decryptStoredClientSecret(ctx, opts.storeClientSecret, client.clientSecret);\n\t\t\tconst { payload: verifiedPayload } = await compactVerify(hint, new TextEncoder().encode(secret));\n\t\t\tpayload = JSON.parse(new TextDecoder().decode(verifiedPayload));\n\t\t} else {\n\t\t\tconst jwtPluginOptions = getJwtPlugin(ctx.context).options;\n\t\t\tconst { payload: verifiedPayload } = await compactVerify(hint, createLocalJWKSet(await getJwks(hint, { jwksFetch: jwtPluginOptions?.jwks?.remoteUrl ?? `${ctx.context.baseURL}${jwtPluginOptions?.jwks?.jwksPath ?? \"/jwks\"}` })));\n\t\t\tpayload = JSON.parse(new TextDecoder().decode(verifiedPayload));\n\t\t}\n\t\tif (payload.iss !== getIssuer(ctx, opts)) return null;\n\t\tif (!normalizeLogoutAudiences(payload.aud).includes(client.clientId)) return null;\n\t\tif (typeof payload.sid !== \"string\" || payload.sid.length === 0 || typeof payload.sub !== \"string\" || payload.sub.length === 0) return null;\n\t\treturn payload;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction getRegisteredLogoutRedirect(client, requestedURI, state) {\n\tif (!requestedURI) return { invalid: false };\n\tif (!client.postLogoutRedirectUris?.includes(requestedURI)) return { invalid: true };\n\tif (!state) return {\n\t\turi: requestedURI,\n\t\tinvalid: false\n\t};\n\ttry {\n\t\tconst redirectURI = new URL(requestedURI);\n\t\tredirectURI.searchParams.set(\"state\", state);\n\t\treturn {\n\t\t\turi: redirectURI.toString(),\n\t\t\tinvalid: false\n\t\t};\n\t} catch {\n\t\treturn { invalid: true };\n\t}\n}\nfunction getLogoutConfirmationContext(client, request) {\n\tif (!request.post_logout_redirect_uri) return {};\n\tif (getRegisteredLogoutRedirect(client, request.post_logout_redirect_uri, request.state).invalid) return { redirectInvalid: true };\n\treturn {\n\t\tclientId: client.clientId,\n\t\tpostLogoutRedirectUri: request.post_logout_redirect_uri,\n\t\t...request.state !== void 0 ? { state: request.state } : {}\n\t};\n}\nasync function getConfirmedLogoutRedirect(ctx, opts, state) {\n\tif (state.redirectInvalid) return { invalid: true };\n\tif (!state.clientId || !state.postLogoutRedirectUri) return { invalid: false };\n\tconst client = await getLogoutClient(ctx, opts, state.clientId);\n\tif (!client || client.disabled || !client.enableEndSession) return { invalid: true };\n\treturn getRegisteredLogoutRedirect(client, state.postLogoutRedirectUri, state.state);\n}\nasync function confirmationRequired(ctx, currentSession, confirmation = {}) {\n\tif (!currentSession) {\n\t\tif (isBrowserNavigation(ctx)) {\n\t\t\tawait setLogoutConfirmationState(ctx, void 0, confirmation);\n\t\t\treturn logoutConfirmationPage(ctx);\n\t\t}\n\t\treturn logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_request\", \"No active session is available for logout\");\n\t}\n\tif (!isBrowserNavigation(ctx)) return logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_request\", \"User confirmation is required to complete logout\");\n\tawait setLogoutConfirmationState(ctx, currentSession.session.id, confirmation);\n\treturn logoutConfirmationPage(ctx);\n}\nasync function completeConfirmedLogout(ctx, opts) {\n\tconst state = await getLogoutConfirmationState(ctx);\n\tconst currentSession = await getCurrentBrowserSession(ctx);\n\tif (!state || state.expiresAt <= Date.now()) return logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_request\", \"The logout confirmation is invalid or expired\");\n\tconst redirect = await getConfirmedLogoutRedirect(ctx, opts, state);\n\tif (!currentSession) {\n\t\tclearLogoutConfirmationState(ctx);\n\t\tif (redirect.uri) return handleRedirect(ctx, redirect.uri);\n\t\treturn isBrowserNavigation(ctx) ? logoutSuccessPage(redirect.invalid ? \"The requested post-logout redirect was not registered.\" : void 0) : logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_request\", \"No active session is available for logout\");\n\t}\n\tif (state.sessionId && state.sessionId !== currentSession.session.id) return logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_request\", \"The logout confirmation is invalid or expired\");\n\tawait deleteLogoutSession(ctx, currentSession.session);\n\tdeleteSessionCookie(ctx);\n\tclearLogoutConfirmationState(ctx);\n\tif (redirect.uri) return handleRedirect(ctx, redirect.uri);\n\treturn isBrowserNavigation(ctx) ? logoutSuccessPage(redirect.invalid ? \"The requested post-logout redirect was not registered.\" : void 0) : null;\n}\n/**\n* RP-Initiated Logout (OIDC RP-Initiated Logout 1.0). The RP presents a signed\n* `id_token_hint`; after verification, the OP terminates the matching session\n* and optionally redirects to `post_logout_redirect_uri`. Requests without a\n* usable hint, and hints that do not identify the current browser session, use\n* a signed, short-lived OP confirmation state before terminating that session.\n*\n* Session termination goes through `internalAdapter.deleteSession`, which fires\n* `session.delete.after` so the hook drives revocation and back-channel\n* notifications to every RP with tokens on the session.\n*\n* @see https://openid.net/specs/openid-connect-rpinitiated-1_0.html\n*/\nasync function rpInitiatedLogoutEndpoint(ctx, opts) {\n\tconst query = ctx.query ?? {};\n\tconst body = ctx.body ?? {};\n\tconst request = {\n\t\t...query,\n\t\t...body\n\t};\n\tconst currentSession = await getCurrentBrowserSession(ctx);\n\tif (!(request.id_token_hint !== void 0)) {\n\t\tlet confirmation = {};\n\t\tif (request.client_id) {\n\t\t\tconst client = await getLogoutClient(ctx, opts, request.client_id);\n\t\t\tif (!client) return logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_client\", \"The logout client does not exist\");\n\t\t\tif (client.disabled) return logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_client\", \"The logout client is disabled\");\n\t\t\tif (!client.enableEndSession) return logoutProtocolError(ctx, \"UNAUTHORIZED\", \"invalid_client\", \"The client is not allowed to initiate logout\");\n\t\t\tconfirmation = getLogoutConfirmationContext(client, request);\n\t\t}\n\t\treturn confirmationRequired(ctx, currentSession, confirmation);\n\t}\n\tconst client = await resolveHintClient(ctx, opts, request.id_token_hint, request.client_id);\n\tif (!client) {\n\t\tif (currentSession && isBrowserNavigation(ctx)) return confirmationRequired(ctx, currentSession);\n\t\treturn logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_client\", \"The logout client does not exist\");\n\t}\n\tif (client.disabled) return logoutProtocolError(ctx, \"BAD_REQUEST\", \"invalid_client\", \"The logout client is disabled\");\n\tif (!client.enableEndSession) return logoutProtocolError(ctx, \"UNAUTHORIZED\", \"invalid_client\", \"The client is not allowed to initiate logout\");\n\tconst idTokenPayload = await verifyLogoutHint(ctx, opts, request.id_token_hint, client);\n\tif (!idTokenPayload) {\n\t\tif (currentSession && isBrowserNavigation(ctx)) return confirmationRequired(ctx, currentSession, request.client_id ? getLogoutConfirmationContext(client, request) : {});\n\t\treturn logoutProtocolError(ctx, \"UNAUTHORIZED\", \"invalid_token\", \"The id_token_hint is invalid\");\n\t}\n\tconst sessionId = idTokenPayload.sid;\n\tconst hintedSession = await findHintedSession(ctx, sessionId);\n\tconst matchesCurrentSession = currentSession?.session.id === sessionId;\n\tif (currentSession && !matchesCurrentSession) return confirmationRequired(ctx, currentSession, getLogoutConfirmationContext(client, request));\n\tconst redirect = getRegisteredLogoutRedirect(client, request.post_logout_redirect_uri, request.state);\n\tconst sessionToDelete = hintedSession ?? (matchesCurrentSession ? currentSession?.session : null);\n\tif (sessionToDelete) await deleteLogoutSession(ctx, sessionToDelete);\n\tif (matchesCurrentSession) deleteSessionCookie(ctx);\n\tclearLogoutConfirmationState(ctx);\n\tif (redirect.uri) return handleRedirect(ctx, redirect.uri);\n\treturn isBrowserNavigation(ctx) ? logoutSuccessPage(redirect.invalid ? \"The requested post-logout redirect was not registered.\" : void 0) : null;\n}\n/**\n* Completes the browser confirmation flow for RP-Initiated Logout. This route\n* is intentionally scoped to HTTP delivery so it does not become a generated\n* client action; the signed cookie is the only confirmation context it accepts.\n*/\nasync function rpInitiatedLogoutConfirmationEndpoint(ctx, opts) {\n\treturn completeConfirmedLogout(ctx, opts);\n}\n//#endregion\n//#region src/metadata.ts\nfunction authServerMetadata(ctx, opts, overrides) {\n\tconst baseURL = ctx.context.baseURL;\n\tconst backchannelSupported = !overrides?.jwt_disabled;\n\treturn {\n\t\tscopes_supported: overrides?.scopes_supported,\n\t\tissuer: validateIssuerUrl(opts?.jwt?.issuer ?? baseURL),\n\t\tauthorization_endpoint: `${baseURL}/oauth2/authorize`,\n\t\ttoken_endpoint: `${baseURL}/oauth2/token`,\n\t\tjwks_uri: overrides?.jwt_disabled ? void 0 : opts?.jwks?.remoteUrl ?? `${baseURL}${opts?.jwks?.jwksPath ?? \"/jwks\"}`,\n\t\tregistration_endpoint: overrides?.dynamic_client_registration_supported ? `${baseURL}/oauth2/register` : void 0,\n\t\tintrospection_endpoint: `${baseURL}/oauth2/introspect`,\n\t\trevocation_endpoint: `${baseURL}/oauth2/revoke`,\n\t\tresponse_types_supported: overrides?.grant_types_supported && !overrides.grant_types_supported.includes(\"authorization_code\") ? [] : [\"code\"],\n\t\tresponse_modes_supported: [\"query\"],\n\t\tgrant_types_supported: overrides?.grant_types_supported ?? [\n\t\t\t\"authorization_code\",\n\t\t\t\"client_credentials\",\n\t\t\t\"refresh_token\"\n\t\t],\n\t\ttoken_endpoint_auth_methods_supported: overrides?.token_endpoint_auth_methods_supported ?? [\n\t\t\t...overrides?.public_client_supported ? [\"none\"] : [],\n\t\t\t\"client_secret_basic\",\n\t\t\t\"client_secret_post\",\n\t\t\t\"private_key_jwt\"\n\t\t],\n\t\ttoken_endpoint_auth_signing_alg_values_supported: [...PRIVATE_KEY_JWT_SIGNING_ALGORITHMS],\n\t\tintrospection_endpoint_auth_methods_supported: overrides?.endpoint_auth_methods_supported ?? [\n\t\t\t\"client_secret_basic\",\n\t\t\t\"client_secret_post\",\n\t\t\t\"private_key_jwt\"\n\t\t],\n\t\tintrospection_endpoint_auth_signing_alg_values_supported: [...PRIVATE_KEY_JWT_SIGNING_ALGORITHMS],\n\t\trevocation_endpoint_auth_methods_supported: overrides?.endpoint_auth_methods_supported ?? [\n\t\t\t\"client_secret_basic\",\n\t\t\t\"client_secret_post\",\n\t\t\t\"private_key_jwt\"\n\t\t],\n\t\trevocation_endpoint_auth_signing_alg_values_supported: [...PRIVATE_KEY_JWT_SIGNING_ALGORITHMS],\n\t\tcode_challenge_methods_supported: [\"S256\"],\n\t\tauthorization_response_iss_parameter_supported: true,\n\t\tdpop_signing_alg_values_supported: overrides?.dpop_signing_alg_values_supported ?? [...DPOP_SIGNING_ALGORITHMS],\n\t\tbackchannel_logout_supported: backchannelSupported,\n\t\tbackchannel_logout_session_supported: backchannelSupported\n\t};\n}\n/**\n* Builds the authorization-server metadata shared by the\n* `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration`\n* responses, plus the inputs both need to finish their own document.\n*/\nfunction buildAuthServerMetadata(ctx, opts) {\n\tconst jwtPluginOptions = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context).options;\n\tconst clientDiscoveries = getClientDiscoveries(opts);\n\tconst publicClientSupported = opts.allowUnauthenticatedClientRegistration || clientDiscoveries.length > 0;\n\treturn {\n\t\tjwtPluginOptions,\n\t\tclientDiscoveries,\n\t\tauthMetadata: authServerMetadata(ctx, jwtPluginOptions, {\n\t\t\tscopes_supported: opts.advertisedMetadata?.scopes_supported ?? opts.scopes,\n\t\t\tdynamic_client_registration_supported: opts.allowDynamicClientRegistration,\n\t\t\tpublic_client_supported: publicClientSupported,\n\t\t\tgrant_types_supported: getSupportedGrantTypes(opts),\n\t\t\ttoken_endpoint_auth_methods_supported: getSupportedAuthMethods(opts, { includeNone: publicClientSupported }),\n\t\t\tendpoint_auth_methods_supported: getSupportedAuthMethods(opts),\n\t\t\tjwt_disabled: opts.disableJwtPlugin,\n\t\t\tdpop_signing_alg_values_supported: opts.dpop?.signingAlgorithms\n\t\t})\n\t};\n}\nfunction oauthAuthorizationServerMetadata(ctx, opts) {\n\tconst { clientDiscoveries, authMetadata } = buildAuthServerMetadata(ctx, opts);\n\treturn applyOAuthProviderMetadataExtensions(ctx, opts, \"oauth-authorization-server\", {\n\t\t...mergeDiscoveryMetadata(clientDiscoveries),\n\t\t...authMetadata\n\t});\n}\nfunction oidcServerMetadata(ctx, opts) {\n\tconst baseURL = ctx.context.baseURL;\n\tconst { jwtPluginOptions, clientDiscoveries, authMetadata } = buildAuthServerMetadata(ctx, opts);\n\tconst metadata = {\n\t\t...authMetadata,\n\t\tclaims_supported: getSupportedClaims(opts),\n\t\tclaims_parameter_supported: true,\n\t\tuserinfo_endpoint: `${baseURL}/oauth2/userinfo`,\n\t\tsubject_types_supported: opts.pairwiseSecret ? [\"public\", \"pairwise\"] : [\"public\"],\n\t\tacr_values_supported: [\"0\"],\n\t\tid_token_signing_alg_values_supported: (() => {\n\t\t\tif (opts.disableJwtPlugin) return [\"HS256\"];\n\t\t\tconst primary = jwtPluginOptions?.jwks?.keyPairConfig?.alg ?? \"EdDSA\";\n\t\t\tconst extras = jwtPluginOptions?.jwks?.keyPairConfigs?.map((c) => c.alg) ?? [];\n\t\t\treturn Array.from(new Set([primary, ...extras]));\n\t\t})(),\n\t\tend_session_endpoint: `${baseURL}/oauth2/end-session`,\n\t\trequest_parameter_supported: false,\n\t\trequest_uri_parameter_supported: false,\n\t\tprompt_values_supported: [\n\t\t\t\"login\",\n\t\t\t\"consent\",\n\t\t\t\"create\",\n\t\t\t\"select_account\",\n\t\t\t\"none\"\n\t\t]\n\t};\n\treturn applyOAuthProviderMetadataExtensions(ctx, opts, \"openid-configuration\", {\n\t\t...mergeDiscoveryMetadata(clientDiscoveries),\n\t\t...metadata\n\t});\n}\nconst METADATA_CACHE_CONTROL = \"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400\";\nfunction metadataResponse(body, extraHeaders) {\n\tconst headers = new Headers(extraHeaders);\n\tif (!headers.has(\"Cache-Control\")) headers.set(\"Cache-Control\", METADATA_CACHE_CONTROL);\n\theaders.set(\"Content-Type\", \"application/json\");\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus: 200,\n\t\theaders\n\t});\n}\n/**\n* Provides an exportable `/.well-known/oauth-authorization-server`.\n*\n* Useful when basePath prevents the endpoint from being located at the root\n* and must be provided manually.\n*\n* @external\n*/\nconst oauthProviderAuthServerMetadata = (auth, opts) => {\n\treturn async (request) => {\n\t\treturn metadataResponse(await auth.api.getOAuthServerConfig({\n\t\t\trequest,\n\t\t\tasResponse: false\n\t\t}), opts?.headers);\n\t};\n};\n/**\n* Provides an exportable `/.well-known/openid-configuration`.\n*\n* Useful when basePath prevents the endpoint from being located at the root\n* and must be provided manually.\n*\n* @external\n*/\nconst oauthProviderOpenIdConfigMetadata = (auth, opts) => {\n\treturn async (request) => {\n\t\treturn metadataResponse(await auth.api.getOpenIdConfig({\n\t\t\trequest,\n\t\t\tasResponse: false\n\t\t}), opts?.headers);\n\t};\n};\n//#endregion\n//#region src/oauth-endpoint.ts\n/**\n* Wraps `createAuthEndpoint` so zod schemas stay the single source of truth\n* for body/query shape while validation failures serialize as the RFC 6749\n* §5.2 error envelope `{ error, error_description }`.\n*\n* A failing issue is routed by its first path segment via `errorCodesByField`:\n* - missing required (`invalid_type` + \"received undefined\") → `.missing`\n* - unsupported value (`invalid_value`) → `.invalid`\n* - anything else (wrong type, duplicated params, bad format) → `defaultError`\n*\n* For enum fields that need to distinguish missing from unsupported, compose\n* as `z.string().pipe(z.enum([...]))` so duplicated params fail the outer\n* `z.string()` as `invalid_type` instead of masquerading as an unsupported\n* enum value.\n*/\nfunction createOAuthEndpoint(path, options, handler) {\n\tconst { redirectOnError, onValidationError: userHook, errorCodesByField, defaultError = \"invalid_request\", ...rest } = options;\n\tif (!redirectOnError) return createAuthEndpoint(path, {\n\t\t...rest,\n\t\tonValidationError: async (args) => {\n\t\t\tif (userHook) await userHook(args);\n\t\t\tthrow new APIError$1(\"BAD_REQUEST\", { ...mapIssuesToOAuthError(args.issues, errorCodesByField, defaultError) });\n\t\t}\n\t}, handler);\n\tconst redirect = redirectOnError;\n\tconst { body: bodySchema, query: querySchema, ...forwarded } = rest;\n\tasync function validateSlot(ctx, slot, schema) {\n\t\tif (!schema) return { ok: true };\n\t\tconst result = await schema.safeParseAsync(ctx[slot] ?? {});\n\t\tif (result.success) {\n\t\t\tctx[slot] = result.data;\n\t\t\treturn { ok: true };\n\t\t}\n\t\tif (userHook) await userHook({\n\t\t\tmessage: result.error.message,\n\t\t\tissues: result.error.issues\n\t\t});\n\t\treturn {\n\t\t\tok: false,\n\t\t\tresponse: redirect({\n\t\t\t\t...mapIssuesToOAuthError(result.error.issues, errorCodesByField, defaultError),\n\t\t\t\tctx\n\t\t\t})\n\t\t};\n\t}\n\treturn createAuthEndpoint(path, forwarded, async (ctx) => {\n\t\tconst body = await validateSlot(ctx, \"body\", bodySchema);\n\t\tif (!body.ok) return body.response;\n\t\tconst query = await validateSlot(ctx, \"query\", querySchema);\n\t\tif (!query.ok) return query.response;\n\t\treturn handler(ctx);\n\t});\n}\nfunction mapIssuesToOAuthError(issues, errorCodesByField, defaultError = \"invalid_request\") {\n\tconst issue = issues[0];\n\tif (!issue) return {\n\t\terror: defaultError,\n\t\terror_description: \"Invalid request.\"\n\t};\n\tconst first = issue.path?.[0];\n\tconst fieldKey = typeof first === \"string\" ? first : void 0;\n\tconst mapping = fieldKey ? errorCodesByField?.[fieldKey] : void 0;\n\tconst field = issue.path?.length ? z.core.toDotPath(issue.path) : \"\";\n\treturn {\n\t\terror: resolveErrorCode(issue, mapping, defaultError),\n\t\terror_description: describeIssue(issue, field)\n\t};\n}\nfunction resolveErrorCode(issue, mapping, defaultError) {\n\tif (typeof mapping === \"string\") return mapping;\n\tif (isMissingValueIssue(issue)) return mapping?.missing ?? defaultError;\n\tif (issue.code === \"invalid_value\") return mapping?.invalid ?? defaultError;\n\treturn defaultError;\n}\n/**\n* Returns `true` for issues that represent an absent required value. Zod v4\n* strips `input` from published issues, so the signal is the `invalid_type`\n* code combined with a message suffix of \"received undefined\". The suffix is\n* pinned by a regression test so a zod rephrase fails the test instead of\n* silently reclassifying missing fields.\n*\n* Assumes the default zod error map. Consumers that install a localized map\n* via `z.setErrorMap()` will break this check, collapsing missing-field\n* failures to `defaultError`.\n*/\nfunction isMissingValueIssue(issue) {\n\treturn issue.code === \"invalid_type\" && issue.message.endsWith(\"received undefined\");\n}\nfunction describeIssue(issue, field) {\n\tif (!field) return issue.message;\n\tif (issue.code === \"invalid_type\") {\n\t\tif (issue.message.endsWith(\"received undefined\")) return `${field} is required`;\n\t\tif (issue.message.endsWith(\"received array\")) return `${field} must not appear more than once`;\n\t\treturn `${field} must be a ${issue.expected ?? \"valid value\"}`;\n\t}\n\tif (issue.code === \"invalid_value\") {\n\t\tconst values = issue.values;\n\t\tif (Array.isArray(values) && values.length > 0) return `${field} must be one of: ${values.join(\", \")}`;\n\t}\n\treturn `${field}: ${issue.message}`;\n}\n//#endregion\n//#region src/middleware/index.ts\nconst publicSessionMiddleware = (opts) => createAuthMiddleware(async (ctx) => {\n\tif (!opts.allowPublicClientPrelogin) throw new APIError(\"BAD_REQUEST\");\n\tconst query = ctx.body.oauth_query;\n\tif (!await verifyOAuthQueryParams(query, ctx.context.secret)) throw new APIError(\"UNAUTHORIZED\", { error: \"invalid_signature\" });\n});\n//#endregion\n//#region src/client-jwks.ts\nconst EC_PRIVATE_KEY_JWT_ALGORITHM_BY_CURVE = {\n\t\"P-256\": \"ES256\",\n\t\"P-384\": \"ES384\",\n\t\"P-521\": \"ES512\"\n};\nconst OKP_PRIVATE_KEY_JWT_SIGNING_CURVES = [\"Ed25519\"];\nconst PRIVATE_JWK_MEMBER_NAMES = [\n\t\"d\",\n\t\"p\",\n\t\"q\",\n\t\"dp\",\n\t\"dq\",\n\t\"qi\",\n\t\"oth\"\n];\nfunction isRecord$1(value) {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\nfunction hasStringMember(key, memberName) {\n\treturn typeof key[memberName] === \"string\" && key[memberName].length > 0;\n}\nfunction isSupportedEcSigningCurve(curve) {\n\treturn typeof curve === \"string\" && Object.prototype.hasOwnProperty.call(EC_PRIVATE_KEY_JWT_ALGORITHM_BY_CURVE, curve);\n}\nfunction isSupportedOkpSigningCurve(curve) {\n\treturn OKP_PRIVATE_KEY_JWT_SIGNING_CURVES.some((signingCurve) => signingCurve === curve);\n}\nfunction isSupportedPublicJwk(key) {\n\tswitch (key.kty) {\n\t\tcase \"RSA\": return hasStringMember(key, \"n\") && hasStringMember(key, \"e\");\n\t\tcase \"EC\": return isSupportedEcSigningCurve(key.crv) && hasStringMember(key, \"x\") && hasStringMember(key, \"y\");\n\t\tcase \"OKP\": return isSupportedOkpSigningCurve(key.crv) && hasStringMember(key, \"x\");\n\t\tdefault: return false;\n\t}\n}\nfunction hasSupportedPrivateKeyJwtAlgorithm(key) {\n\tif (key.alg === void 0) return true;\n\tif (typeof key.alg !== \"string\" || !PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.some((algorithm) => algorithm === key.alg)) return false;\n\tswitch (key.kty) {\n\t\tcase \"RSA\": return key.alg.startsWith(\"RS\") || key.alg.startsWith(\"PS\");\n\t\tcase \"EC\": return isSupportedEcSigningCurve(key.crv) && EC_PRIVATE_KEY_JWT_ALGORITHM_BY_CURVE[key.crv] === key.alg;\n\t\tcase \"OKP\": return isSupportedOkpSigningCurve(key.crv) && key.alg === \"EdDSA\";\n\t\tdefault: return false;\n\t}\n}\n/**\n* Validates an OAuth client's public asymmetric JWK set.\n*\n* This boundary accepts only the RFC 7517 `{ keys: [...] }` representation.\n* It performs no I/O and returns the validated set for downstream JOSE\n* verification.\n*\n* @internal\n*/\nfunction validatePublicClientJwks(input) {\n\tconst keys = isRecord$1(input) && Array.isArray(input.keys) ? input.keys : void 0;\n\tif (!keys?.length) return {\n\t\tvalid: false,\n\t\terror: \"jwks must be an RFC 7517 JWK Set object with a non-empty keys array\"\n\t};\n\tfor (const key of keys) {\n\t\tif (!isRecord$1(key)) return {\n\t\t\tvalid: false,\n\t\t\terror: \"jwks keys must be supported public JWKs with required key parameters\"\n\t\t};\n\t\tif (key.kty === \"oct\" || \"k\" in key || PRIVATE_JWK_MEMBER_NAMES.some((name) => name in key)) return {\n\t\t\tvalid: false,\n\t\t\terror: \"jwks must contain only public asymmetric keys\"\n\t\t};\n\t\tif (!isSupportedPublicJwk(key)) return {\n\t\t\tvalid: false,\n\t\t\terror: \"jwks keys must be supported public JWKs with required key parameters\"\n\t\t};\n\t\tif (!hasSupportedPrivateKeyJwtAlgorithm(key)) return {\n\t\t\tvalid: false,\n\t\t\terror: \"jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve\"\n\t\t};\n\t}\n\treturn {\n\t\tvalid: true,\n\t\tjwks: { keys }\n\t};\n}\n//#endregion\n//#region src/client-metadata.ts\nconst OAUTH_CLIENT_RECORD_FIELD_NAMES = Object.freeze(Object.keys({\n\tclientId: true,\n\tclientSecret: true,\n\tclientDiscoveryId: true,\n\tdisabled: true,\n\tscopes: true,\n\tclientCredentialsScopes: true,\n\tuserId: true,\n\tcreatedAt: true,\n\tupdatedAt: true,\n\texpiresAt: true,\n\tname: true,\n\turi: true,\n\ticon: true,\n\tcontacts: true,\n\ttos: true,\n\tpolicy: true,\n\tsoftwareId: true,\n\tsoftwareVersion: true,\n\tsoftwareStatement: true,\n\tredirectUris: true,\n\tpostLogoutRedirectUris: true,\n\tbackchannelLogoutUri: true,\n\tbackchannelLogoutSessionRequired: true,\n\ttokenEndpointAuthMethod: true,\n\tgrantTypes: true,\n\tresponseTypes: true,\n\tapplicationType: true,\n\tjwks: true,\n\tjwksUri: true,\n\trequirePKCE: true,\n\tdpopBoundAccessTokens: true,\n\tskipConsent: true,\n\tenableEndSession: true,\n\tsubjectType: true,\n\treferenceId: true,\n\tmetadata: true\n}));\n/**\n* Canonical wire fields emitted by schemaToOAuth. They are mapped explicitly\n* and therefore must never also survive inside the opaque metadata envelope.\n*/\nconst OAUTH_CLIENT_WIRE_FIELD_NAMES = [\n\t\"client_id\",\n\t\"client_secret\",\n\t\"client_secret_expires_at\",\n\t\"scope\",\n\t\"user_id\",\n\t\"client_id_issued_at\",\n\t\"client_name\",\n\t\"client_uri\",\n\t\"logo_uri\",\n\t\"contacts\",\n\t\"tos_uri\",\n\t\"policy_uri\",\n\t\"jwks\",\n\t\"jwks_uri\",\n\t\"software_id\",\n\t\"software_version\",\n\t\"software_statement\",\n\t\"redirect_uris\",\n\t\"post_logout_redirect_uris\",\n\t\"backchannel_logout_uri\",\n\t\"backchannel_logout_session_required\",\n\t\"token_endpoint_auth_method\",\n\t\"grant_types\",\n\t\"response_types\",\n\t\"application_type\",\n\t\"disabled\",\n\t\"skip_consent\",\n\t\"enable_end_session\",\n\t\"require_pkce\",\n\t\"dpop_bound_access_tokens\",\n\t\"subject_type\",\n\t\"reference_id\"\n];\nconst OPAQUE_METADATA_RESERVED_FIELDS = new Set([\n\t...OAUTH_CLIENT_RECORD_FIELD_NAMES,\n\t...OAUTH_CLIENT_WIRE_FIELD_NAMES,\n\t\"public\",\n\t\"type\",\n\t\"resources\",\n\t\"client_credentials_scopes\"\n]);\nconst CIMD_FORBIDDEN_SERVER_FIELD_NAMES = new Set([\n\t\"disabled\",\n\t\"client_secret\",\n\t\"client_secret_expires_at\",\n\t\"client_id_issued_at\",\n\t\"skip_consent\",\n\t\"enable_end_session\",\n\t\"require_pkce\",\n\t\"reference_id\",\n\t\"user_id\",\n\t\"resources\",\n\t\"clientSecret\",\n\t\"clientDiscoveryId\",\n\t\"skipConsent\",\n\t\"enableEndSession\",\n\t\"requirePKCE\",\n\t\"referenceId\",\n\t\"userId\",\n\t\"clientId\",\n\t\"applicationType\",\n\t\"tokenEndpointAuthMethod\",\n\t\"redirectUris\",\n\t\"postLogoutRedirectUris\",\n\t\"grantTypes\",\n\t\"responseTypes\",\n\t\"scopes\",\n\t\"expiresAt\",\n\t\"createdAt\",\n\t\"updatedAt\",\n\t\"softwareId\",\n\t\"softwareVersion\",\n\t\"softwareStatement\",\n\t\"backchannelLogoutUri\",\n\t\"backchannelLogoutSessionRequired\",\n\t\"jwksUri\",\n\t\"dpopBoundAccessTokens\",\n\t\"subjectType\"\n]);\nfunction isForbiddenCimdClientMetadataField(field) {\n\treturn CIMD_FORBIDDEN_SERVER_FIELD_NAMES.has(field);\n}\nfunction stripReservedOAuthClientMetadataExtensions(metadata) {\n\tif (!metadata) return void 0;\n\treturn Object.fromEntries(Object.entries(metadata).filter(([field]) => !OPAQUE_METADATA_RESERVED_FIELDS.has(field)));\n}\n//#endregion\n//#region src/oauthClient/privileges.ts\n/**\n* Authorizes a client action against the configured `clientPrivileges` hook.\n*\n* This is the single authorization helper for every OAuth client mutation. The\n* create path enforces it at the shared creation chokepoint so that no\n* registration route can reach client persistence without it.\n*\n* @throws APIError UNAUTHORIZED when there is no session or the hook denies the action.\n* @throws APIError BAD_REQUEST when the request carries no headers.\n*/\nasync function assertClientPrivileges(ctx, session, opts, action, clientId) {\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tif (!ctx.headers) throw new APIError(\"BAD_REQUEST\");\n\tif (action === \"configure-client-credentials-scopes\" && !opts.clientPrivileges) throw new APIError(\"UNAUTHORIZED\");\n\tif (opts.clientPrivileges && !await opts.clientPrivileges({\n\t\theaders: ctx.headers,\n\t\taction,\n\t\tsession: session.session,\n\t\tuser: session.user,\n\t\tclientId\n\t})) throw new APIError(\"UNAUTHORIZED\");\n}\n//#endregion\n//#region src/oauthResource/privileges.ts\n/**\n* Authorizes a resource action against the configured `resourcePrivileges`\n* hook. Gates every admin resource endpoint and the resource links selected\n* during managed client registration. Mirrors `assertClientPrivileges`:\n* a missing session → 401; a defined `resourcePrivileges` callback that\n* returns falsy → 401 with the original action context preserved.\n*\n* When `resourcePrivileges` is undefined, the gate degrades to \"any\n* authenticated session can manage resources\" — same forgiving default\n* as `clientPrivileges`. Operators who care about RBAC must define the\n* callback.\n*\n* @internal\n*/\nasync function assertResourcePrivileges(ctx, session, opts, action, resourceId) {\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tif (!ctx.headers) throw new APIError(\"BAD_REQUEST\");\n\tif (!opts.resourcePrivileges) return;\n\tif (!await opts.resourcePrivileges({\n\t\theaders: ctx.headers,\n\t\taction,\n\t\tsession: session.session,\n\t\tuser: session.user,\n\t\tresourceId\n\t})) throw new APIError(\"UNAUTHORIZED\");\n}\n//#endregion\n//#region src/utils/client-assertion.ts\nvar client_assertion_exports = /* @__PURE__ */ __exportAll({\n\tconsumeClientAssertion: () => consumeClientAssertion,\n\tisPrivateHostname: () => isPrivateHostname,\n\tverifyClientAssertion: () => verifyClientAssertion\n});\nconst jwksCaches = /* @__PURE__ */ new WeakMap();\nconst JWKS_CACHE_TTL_MS = 300 * 1e3;\nconst JWKS_CACHE_MAX_ENTRIES = 500;\nconst JWKS_FETCH_TIMEOUT_MS = 5e3;\nconst MAX_JWKS_RESPONSE_BYTES = 64 * 1024;\nconst JSON_CONTENT_TYPE = /^application\\/(?:[-\\w.]+\\+)?json\\s*(?:;|$)/i;\nfunction setJwksCache(jwksCache, cacheKey, jwks, fetchedAt) {\n\tjwksCache.set(cacheKey, {\n\t\tjwks,\n\t\tfetchedAt\n\t});\n\tif (jwksCache.size > JWKS_CACHE_MAX_ENTRIES) {\n\t\tconst oldest = jwksCache.keys().next().value;\n\t\tif (oldest !== void 0) jwksCache.delete(oldest);\n\t}\n}\nfunction getJwksCache(opts) {\n\tconst existingCache = jwksCaches.get(opts);\n\tif (existingCache) return existingCache;\n\tconst cache = /* @__PURE__ */ new Map();\n\tjwksCaches.set(opts, cache);\n\treturn cache;\n}\nfunction getJwksCacheKey(client) {\n\treturn `${client.clientDiscoveryId ?? \"managed\"}:${client.jwksUri ?? \"\"}`;\n}\nconst ALGORITHMS_LIST = [...PRIVATE_KEY_JWT_SIGNING_ALGORITHMS];\n/**\n* SSRF gate for user-supplied server-side fetch targets (`jwks_uri`,\n* `backchannel_logout_uri`): returns true when the host is NOT publicly\n* routable. That covers loopback, RFC 1918 private, link-local (including AWS\n* IMDS `169.254.169.254`), shared-address-space (carrier-grade NAT),\n* IPv4-mapped IPv6, 6to4/NAT64/Teredo tunnels, every other RFC 6890\n* special-purpose range, and cloud-metadata FQDNs.\n*\n* Delegates to the audited single source of truth so this check cannot drift\n* into the kind of encoding bypass that bespoke regexes invite. This is a\n* syntactic check only: it does not resolve DNS, so a public name that\n* resolves to a private address at fetch time is not caught here.\n*/\nfunction isPrivateHostname(hostname) {\n\treturn !isPublicRoutableHost(hostname);\n}\nfunction validateJwksUri(ctx, jwksUri, clientIdUrlOrigin) {\n\tconst parsed = new URL(jwksUri);\n\tif (parsed.protocol !== \"https:\") throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"jwks_uri must use HTTPS\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (parsed.username || parsed.password) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"jwks_uri must not contain credentials\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (jwksUri.includes(\"#\")) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"jwks_uri must not include a fragment component\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (isPrivateHostname(parsed.hostname)) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"jwks_uri must not point to a private or reserved address\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (clientIdUrlOrigin && parsed.origin === clientIdUrlOrigin) return;\n\tif (!ctx.context.isTrustedOrigin(parsed.href)) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client jwks_uri is not trusted\",\n\t\terror: \"invalid_client\"\n\t});\n}\nfunction urlClientIdOrigin(clientId) {\n\ttry {\n\t\tconst parsed = new URL(clientId);\n\t\tif (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return;\n\t\treturn parsed.origin;\n\t} catch {\n\t\treturn;\n\t}\n}\nasync function readBoundedResponseBody(response) {\n\tconst contentLength = response.headers.get(\"content-length\");\n\tif (contentLength !== null && Number.isFinite(Number(contentLength)) && Number(contentLength) > MAX_JWKS_RESPONSE_BYTES) {\n\t\tawait response.body?.cancel();\n\t\tthrow new Error(\"JWKS response exceeds 64 KiB\");\n\t}\n\tif (!response.body) return \"\";\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet totalBytes = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\ttotalBytes += value.byteLength;\n\t\tif (totalBytes > MAX_JWKS_RESPONSE_BYTES) {\n\t\t\tawait reader.cancel();\n\t\t\tthrow new Error(\"JWKS response exceeds 64 KiB\");\n\t\t}\n\t\tchunks.push(value);\n\t}\n\tconst bytes = new Uint8Array(totalBytes);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn new TextDecoder().decode(bytes);\n}\nasync function fetchJwksFromUri(jwksUri, fetchClientMetadataResource = globalThis.fetch) {\n\tconst controller = new AbortController();\n\tconst timeout = setTimeout(() => controller.abort(), JWKS_FETCH_TIMEOUT_MS);\n\ttry {\n\t\tconst response = await fetchClientMetadataResource(jwksUri, {\n\t\t\tsignal: controller.signal,\n\t\t\theaders: { accept: \"application/json\" },\n\t\t\tredirect: \"error\"\n\t\t});\n\t\tif (response.redirected) throw new Error(\"JWKS fetch redirected\");\n\t\tif (response.status !== 200) throw new Error(`JWKS fetch returned ${response.status}`);\n\t\tconst contentType = response.headers.get(\"content-type\");\n\t\tif (!contentType || !JSON_CONTENT_TYPE.test(contentType)) throw new Error(\"JWKS response must use a JSON media type\");\n\t\tconst responseBody = await readBoundedResponseBody(response);\n\t\tlet parsedBody;\n\t\ttry {\n\t\t\tparsedBody = JSON.parse(responseBody);\n\t\t} catch {\n\t\t\treturn { valid: false };\n\t\t}\n\t\tconst result = validatePublicClientJwks(parsedBody);\n\t\tif (!result.valid) return { valid: false };\n\t\treturn {\n\t\t\tvalid: true,\n\t\t\tjwks: result.jwks\n\t\t};\n\t} finally {\n\t\tclearTimeout(timeout);\n\t}\n}\nfunction createClientJwksFetchError() {\n\treturn new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"failed to fetch client JWKS\",\n\t\terror: \"invalid_client\"\n\t});\n}\nasync function fetchClientJwks(ctx, opts, client) {\n\tif (client.jwks) return JSON.parse(client.jwks);\n\tif (!client.jwksUri) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client has no JWKS configured\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst discovery = client.clientDiscoveryId ? getClientDiscoveries(opts).find((candidate) => candidate.id === client.clientDiscoveryId) : void 0;\n\tif (client.clientDiscoveryId && !discovery?.fetchClientMetadataResource) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client discovery does not provide a metadata resource transport\",\n\t\terror: \"invalid_client\"\n\t});\n\tvalidateJwksUri(ctx, client.jwksUri, client.clientDiscoveryId ? urlClientIdOrigin(client.clientId) : void 0);\n\tconst now = Date.now();\n\tconst cacheKey = getJwksCacheKey(client);\n\tconst jwksCache = getJwksCache(opts);\n\tconst cached = jwksCache.get(cacheKey);\n\tif (cached && now - cached.fetchedAt < JWKS_CACHE_TTL_MS) return cached.jwks;\n\tlet result;\n\ttry {\n\t\tresult = await fetchJwksFromUri(client.jwksUri, discovery?.fetchClientMetadataResource);\n\t} catch {\n\t\tconst staleLimitMs = JWKS_CACHE_TTL_MS * 2;\n\t\tif (cached && now - cached.fetchedAt < staleLimitMs) return cached.jwks;\n\t\tthrow createClientJwksFetchError();\n\t}\n\tif (!result.valid) throw createClientJwksFetchError();\n\tsetJwksCache(jwksCache, cacheKey, result.jwks, now);\n\treturn result.jwks;\n}\n/**\n* Refetch JWKS from jwks_uri when signature verification fails with cached keys.\n* Handles key rotation: the client may have published a new key that isn't in our cache yet.\n*/\nasync function refetchClientJwks(opts, client) {\n\tif (!client.jwksUri) return null;\n\tconst discovery = client.clientDiscoveryId ? getClientDiscoveries(opts).find((candidate) => candidate.id === client.clientDiscoveryId) : void 0;\n\tif (client.clientDiscoveryId && !discovery?.fetchClientMetadataResource) return null;\n\ttry {\n\t\tconst result = await fetchJwksFromUri(client.jwksUri, discovery?.fetchClientMetadataResource);\n\t\tif (!result.valid) return null;\n\t\tsetJwksCache(getJwksCache(opts), getJwksCacheKey(client), result.jwks, Date.now());\n\t\treturn result.jwks;\n\t} catch {\n\t\treturn null;\n\t}\n}\n/**\n* Enforces the assertion-hygiene claims every client-assertion authentication\n* method must check, independent of how the signature is verified or where the\n* verification keys come from:\n* - `aud` MUST include `expectedAudience` (RFC 7523 §3 rule 3),\n* - `exp` MUST be present, unexpired, and at most `assertionMaxLifetime`\n*   seconds away (RFC 7523 §3 rule 4),\n* - `iat`, when present, MUST be within `assertionMaxLifetime`,\n* - `jti` MUST be present and single-use; this consumes a replay tombstone keyed\n*   by `` `${namespace}:${jti}` ``, inserted under the adapter's primary key so a\n*   replay across workers fails atomically.\n*\n* A custom {@link OAuthClientAuthenticationStrategy} should call this after\n* verifying the assertion signature, so an extension method inherits the same\n* replay, lifetime, and audience guarantees as the built-in `private_key_jwt`\n* path, which calls it too.\n*\n* @param params.namespace Scopes the replay tombstone to the method and client,\n*   e.g. `` `${method}:${clientId}` ``, so the same `jti` can recur across\n*   distinct methods or clients but never within one.\n*/\nasync function consumeClientAssertion(ctx, opts, params) {\n\tconst { namespace, payload, expectedAudience } = params;\n\tif (!(Array.isArray(payload.aud) ? payload.aud : payload.aud != null ? [payload.aud] : []).includes(expectedAudience)) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client assertion aud does not match the endpoint\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst maxLifetime = opts.assertionMaxLifetime ?? 300;\n\tconst now = Math.floor(Date.now() / 1e3);\n\tif (typeof payload.exp !== \"number\") throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client assertion must include exp claim\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (payload.exp <= now) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client assertion has expired\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (payload.exp - now > maxLifetime) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: `client assertion exp is too far in the future (max ${maxLifetime}s)`,\n\t\terror: \"invalid_client\"\n\t});\n\tif (typeof payload.iat === \"number\" && now - payload.iat > maxLifetime) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: `client assertion iat is too far in the past (max ${maxLifetime}s)`,\n\t\terror: \"invalid_client\"\n\t});\n\tif (typeof payload.jti !== \"string\" || payload.jti.length === 0) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client assertion must include jti claim\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst jtiDigest = await createHash(\"SHA-256\").digest(new TextEncoder().encode(`${namespace}:${payload.jti}`));\n\tconst jtiId = encodeDeterministicId(new Uint8Array(jtiDigest).slice(0, 24), ctx.context.options);\n\ttry {\n\t\tawait ctx.context.adapter.create({\n\t\t\tmodel: \"oauthClientAssertion\",\n\t\t\tdata: {\n\t\t\t\tid: jtiId,\n\t\t\t\texpiresAt: /* @__PURE__ */ new Date(payload.exp * 1e3)\n\t\t\t},\n\t\t\tforceAllowId: true\n\t\t});\n\t} catch (createErr) {\n\t\tlet alreadyUsed = false;\n\t\ttry {\n\t\t\talreadyUsed = Boolean(await ctx.context.adapter.findOne({\n\t\t\t\tmodel: \"oauthClientAssertion\",\n\t\t\t\twhere: [{\n\t\t\t\t\tfield: \"id\",\n\t\t\t\t\tvalue: jtiId\n\t\t\t\t}]\n\t\t\t}));\n\t\t} catch {}\n\t\tif (alreadyUsed) throw new APIError$1(\"BAD_REQUEST\", {\n\t\t\terror_description: \"client assertion jti has already been used\",\n\t\t\terror: \"invalid_client\"\n\t\t});\n\t\tthrow createErr;\n\t}\n}\n/**\n* Verifies a client assertion JWT for `private_key_jwt` authentication.\n*\n* Validates: signature, iss=client_id, sub=client_id, aud=the endpoint serving\n* the assertion or the normalized OP issuer, exp, assertion max lifetime,\n* jti uniqueness (replay prevention).\n*/\nasync function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertionType, clientIdHint, expectedAudience) {\n\tif (clientAssertionType !== CLIENT_ASSERTION_TYPE) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"unsupported client_assertion_type\",\n\t\terror: \"invalid_client\"\n\t});\n\tlet header;\n\ttry {\n\t\theader = decodeProtectedHeader(clientAssertion);\n\t} catch {\n\t\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\t\terror_description: \"malformed client assertion: invalid JWT header\",\n\t\t\terror: \"invalid_client\"\n\t\t});\n\t}\n\tif (!header.alg || !ALGORITHMS_LIST.includes(header.alg)) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: `unsupported assertion signing algorithm: ${header.alg}`,\n\t\terror: \"invalid_client\"\n\t});\n\tlet unverified;\n\ttry {\n\t\tunverified = decodeJwt(clientAssertion);\n\t} catch {\n\t\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\t\terror_description: \"malformed client assertion: invalid JWT payload\",\n\t\t\terror: \"invalid_client\"\n\t\t});\n\t}\n\tconst clientId = unverified.sub ?? unverified.iss;\n\tif (!clientId) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client assertion must contain sub or iss claim identifying the client\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (clientIdHint && clientIdHint !== clientId) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client_id in body does not match assertion sub/iss\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst client = await getClient(ctx, opts, clientId);\n\tif (!client) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"unknown client\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (client.disabled) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client is disabled\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (client.tokenEndpointAuthMethod !== \"private_key_jwt\") throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"client is not registered for private_key_jwt authentication\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst jwks = await fetchClientJwks(ctx, opts, client);\n\tconst endpointAudience = expectedAudience ?? `${ctx.context.baseURL}/oauth2/token`;\n\tconst issuerAudience = getIssuer(ctx, opts);\n\tconst acceptedAudiences = [...new Set([endpointAudience, issuerAudience])];\n\tconst verifyOpts = {\n\t\tissuer: clientId,\n\t\tsubject: clientId,\n\t\taudience: acceptedAudiences,\n\t\talgorithms: ALGORITHMS_LIST\n\t};\n\tlet payload;\n\ttry {\n\t\t({payload} = await jwtVerify(clientAssertion, createLocalJWKSet(jwks), verifyOpts));\n\t} catch (verifyErr) {\n\t\tif (verifyErr instanceof Error && /no matching key|no applicable key/i.test(verifyErr.message)) {\n\t\t\tconst refreshed = await refetchClientJwks(opts, client);\n\t\t\tif (refreshed) try {\n\t\t\t\t({payload} = await jwtVerify(clientAssertion, createLocalJWKSet(refreshed), verifyOpts));\n\t\t\t} catch {\n\t\t\t\tthrow new APIError$1(\"UNAUTHORIZED\", {\n\t\t\t\t\terror_description: \"client assertion signature verification failed\",\n\t\t\t\t\terror: \"invalid_client\"\n\t\t\t\t});\n\t\t\t}\n\t\t\telse throw new APIError$1(\"UNAUTHORIZED\", {\n\t\t\t\terror_description: \"client assertion signature verification failed\",\n\t\t\t\terror: \"invalid_client\"\n\t\t\t});\n\t\t} else throw new APIError$1(\"UNAUTHORIZED\", {\n\t\t\terror_description: \"client assertion signature verification failed\",\n\t\t\terror: \"invalid_client\"\n\t\t});\n\t}\n\tconst acceptedAudience = (Array.isArray(payload.aud) ? payload.aud : [payload.aud]).find((value) => typeof value === \"string\" && acceptedAudiences.includes(value));\n\tawait consumeClientAssertion(ctx, opts, {\n\t\tnamespace: `private_key_jwt:${clientId}`,\n\t\tpayload,\n\t\texpectedAudience: acceptedAudience\n\t});\n\treturn { clientId };\n}\n//#endregion\n//#region src/utils/initial-access-token.ts\n/**\n* Builds an RFC 6750 §3 Bearer challenge for the registration endpoint. The\n* `error` code maps to the status per RFC 6750 §3.1 (`invalid_request` → 400,\n* `invalid_token` → 401) and is echoed in both the `WWW-Authenticate` challenge\n* and the JSON body.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc6750#section-3\n*/\nfunction registrationBearerError(status, error, errorDescription) {\n\treturn new APIError$1(status, {\n\t\terror,\n\t\terror_description: errorDescription\n\t}, {\n\t\t\"WWW-Authenticate\": `Bearer error=\"${error}\"`,\n\t\t...NO_STORE_HEADERS\n\t});\n}\n/**\n* Resolves an RFC 7591 initial access token from the request and authorizes it\n* against the deployment-supplied validator.\n*\n* Returns the authorization (optionally carrying a `referenceId`) when a valid\n* token is present, or `undefined` when no Bearer credentials were sent so the\n* caller can fall back to session or open registration. Throws an RFC 6750\n* Bearer challenge when the header is malformed, no validator is configured, or\n* the token is rejected.\n*\n* @see https://datatracker.ietf.org/doc/html/rfc7591#section-3\n*/\nasync function authorizeInitialAccessToken(ctx, opts, clientMetadata) {\n\tconst headers = ctx.headers;\n\tlet initialAccessToken;\n\ttry {\n\t\tinitialAccessToken = parseBearerToken(headers?.get(\"authorization\"));\n\t} catch {\n\t\tthrow registrationBearerError(\"BAD_REQUEST\", \"invalid_request\", \"Malformed initial access token Authorization header\");\n\t}\n\tif (!initialAccessToken || !headers) return;\n\tif (!opts.validateInitialAccessToken) throw registrationBearerError(\"UNAUTHORIZED\", \"invalid_token\", \"Invalid initial access token\");\n\tlet authorization;\n\ttry {\n\t\tauthorization = await opts.validateInitialAccessToken({\n\t\t\tinitialAccessToken,\n\t\t\theaders,\n\t\t\tclientMetadata\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof APIError$1) throw error;\n\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\", {\n\t\t\terror: \"server_error\",\n\t\t\terror_description: \"Initial access token validation failed\"\n\t\t});\n\t}\n\tif (!authorization) throw registrationBearerError(\"UNAUTHORIZED\", \"invalid_token\", \"Invalid initial access token\");\n\treturn authorization;\n}\n//#endregion\n//#region src/register.ts\nconst DEFAULT_REGISTRATION_GRANT_TYPES = [\"authorization_code\"];\nfunction resolveClientRegistrationScopes(opts) {\n\treturn [...new Set([...opts.clientRegistrationDefaultScopes ?? opts.scopes ?? [], ...opts.clientRegistrationAllowedScopes ?? []])];\n}\nfunction resolveRegistrationGrantTypes(client) {\n\tconst grantTypes = client.grant_types ?? [...DEFAULT_REGISTRATION_GRANT_TYPES];\n\tif (grantTypes.length > 0) return grantTypes;\n\tthrow new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"grant_types must contain at least one grant type\"\n\t});\n}\nfunction resolveRegistrationResponseTypes(client, grantTypes) {\n\tif (client.response_types) return client.response_types;\n\treturn grantTypes.includes(\"authorization_code\") ? [\"code\"] : void 0;\n}\nfunction applyOAuthClientRegistrationDefaults(client, defaultApplicationType = \"web\") {\n\tconst grantTypes = resolveRegistrationGrantTypes(client);\n\treturn {\n\t\t...client,\n\t\ttoken_endpoint_auth_method: client.token_endpoint_auth_method ?? \"client_secret_basic\",\n\t\tapplication_type: client.application_type ?? (defaultApplicationType === null ? void 0 : defaultApplicationType),\n\t\tgrant_types: grantTypes,\n\t\tresponse_types: resolveRegistrationResponseTypes(client, grantTypes)\n\t};\n}\nfunction isCustomSchemeWithHost(redirectUri) {\n\tconst url = new URL(redirectUri);\n\treturn url.protocol !== \"http:\" && url.protocol !== \"https:\" && url.host !== \"\";\n}\nfunction isNonHttpRedirectUri(redirectUri) {\n\ttry {\n\t\tconst protocol = new URL(redirectUri).protocol;\n\t\treturn protocol !== \"http:\" && protocol !== \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Server-owned default for dynamic registrations that omit `application_type`.\n* `\"infer\"` classifies as native when any redirect URI uses a non-http(s)\n* scheme, because a web client can never register one. Every URI is then\n* validated against the native rules. A sent `application_type` is never\n* overridden because `applyOAuthClientRegistrationDefaults` only fills the\n* absent field.\n*/\nfunction resolveDynamicRegistrationDefaultApplicationType(opts, client) {\n\tconst configured = opts.clientRegistrationDefaultApplicationType ?? \"web\";\n\tif (configured !== \"infer\") return configured;\n\treturn (client.redirect_uris ?? []).some(isNonHttpRedirectUri) ? \"native\" : \"web\";\n}\nfunction invalidRedirectUri(description) {\n\tthrow new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_redirect_uri\",\n\t\terror_description: description\n\t});\n}\nfunction getRawHttpHostname(redirectUri) {\n\tconst authority = /^http:\\/\\/([^/?#]*)/i.exec(redirectUri)?.[1];\n\tif (!authority) return null;\n\tconst hostAndPort = authority.slice(authority.lastIndexOf(\"@\") + 1);\n\tif (hostAndPort.startsWith(\"[\")) {\n\t\tconst bracketEnd = hostAndPort.indexOf(\"]\");\n\t\treturn bracketEnd < 0 ? null : hostAndPort.slice(0, bracketEnd + 1).toLowerCase();\n\t}\n\treturn (hostAndPort.split(\":\")[0] ?? \"\").toLowerCase();\n}\nfunction assertDynamicRegistrationResourcesAllowed(opts, requestedResources) {\n\tconst allowedResources = new Set([...opts.clientRegistrationDefaultResources ?? [], ...opts.clientRegistrationAllowedResources ?? []]);\n\tfor (const identifier of requestedResources) if (!allowedResources.has(identifier)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_target\",\n\t\terror_description: `requested resource ${identifier} is not allowed for client registration`\n\t});\n}\nasync function resolveClientRegistrationResources(ctx, opts, requestedResources) {\n\tconst defaultResources = opts.clientRegistrationDefaultResources ?? [];\n\tconst resources = [...new Set([...defaultResources, ...requestedResources])];\n\tfor (const identifier of resources) {\n\t\tconst row = await getResource(ctx, opts, identifier);\n\t\tif (!row) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_target\",\n\t\t\terror_description: `requested resource ${identifier} does not exist`\n\t\t});\n\t\tif (row.disabled) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_target\",\n\t\t\terror_description: `requested resource ${identifier} is disabled`\n\t\t});\n\t}\n\treturn resources;\n}\nfunction validateClientRedirectUri(redirectUri, applicationType) {\n\tlet url;\n\ttry {\n\t\turl = new URL(redirectUri);\n\t} catch {\n\t\tinvalidRedirectUri(`redirect URI must be an absolute URI: ${redirectUri}`);\n\t}\n\tif (redirectUri.includes(\"#\") || url.username.length > 0 || url.password.length > 0) invalidRedirectUri(`redirect URI must not include credentials or a fragment: ${redirectUri}`);\n\tconst isHttp = url.protocol === \"http:\";\n\tconst isHttps = url.protocol === \"https:\";\n\tif (/^localhost\\.+$/i.test(url.hostname)) invalidRedirectUri(`redirect URI localhost must not include trailing dots: ${redirectUri}`);\n\tconst isRedirectLoopback = isLoopbackIP(url.hostname) || url.hostname === \"localhost\";\n\tconst rawHttpHostname = getRawHttpHostname(redirectUri);\n\tconst isAllowedNativeHttpLoopback = rawHttpHostname === \"localhost\" || rawHttpHostname === \"127.0.0.1\" || rawHttpHostname === \"[::1]\";\n\tif (applicationType === \"web\") {\n\t\tif (!isHttps || isRedirectLoopback) invalidRedirectUri(`web clients require https redirect URIs on non-loopback hosts: ${redirectUri}`);\n\t\treturn;\n\t}\n\tif (isHttps) {\n\t\tif (isRedirectLoopback) invalidRedirectUri(`native clients must not use https loopback redirect URIs: ${redirectUri}`);\n\t\treturn;\n\t}\n\tif (isHttp) {\n\t\tif (!isAllowedNativeHttpLoopback) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);\n\t\treturn;\n\t}\n\tif (!isNativePrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${redirectUri}`);\n}\nfunction assertValidRegistrationJwks(jwks) {\n\tconst result = validatePublicClientJwks(jwks);\n\tif (!result.valid) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: result.error\n\t});\n}\nasync function registerEndpoint(ctx, opts) {\n\tconst body = ctx.body;\n\tif (!opts.allowDynamicClientRegistration) throw new APIError(\"FORBIDDEN\", {\n\t\terror: \"access_denied\",\n\t\terror_description: \"Client registration is disabled\"\n\t});\n\tconst session = await getSessionFromCtx(ctx);\n\tconst tokenAuthorization = session ? void 0 : await authorizeInitialAccessToken(ctx, opts, body);\n\tconst isTokenAuthorized = Boolean(tokenAuthorization);\n\tif (!(session || isTokenAuthorized || opts.allowUnauthenticatedClientRegistration)) throw new APIError(\"UNAUTHORIZED\", { error_description: \"Authentication required for client registration\" }, {\n\t\t\"WWW-Authenticate\": \"Bearer\",\n\t\t...NO_STORE_HEADERS\n\t});\n\tif (!session && !isTokenAuthorized) {\n\t\tif (body.grant_types?.includes(\"client_credentials\")) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"client_credentials grant requires authenticated registration\"\n\t\t});\n\t}\n\tconst requestedResources = Array.isArray(body.resources) ? body.resources.filter((resource) => typeof resource === \"string\" && resource.length > 0) : [];\n\tif (session) await assertClientPrivileges(ctx, session, opts, \"create\");\n\tconst referenceId = tokenAuthorization?.referenceId ?? (session && opts.clientReference ? await opts.clientReference({\n\t\tuser: session.user,\n\t\tsession: session.session\n\t}) : void 0);\n\tconst response = await createOAuthClientRegistration(ctx, opts, {\n\t\tmetadata: body,\n\t\tregistrationSource: \"dynamic\",\n\t\tuserId: referenceId ? void 0 : session?.session.userId,\n\t\treferenceId,\n\t\trequestedResources\n\t});\n\tctx.setStatus(201);\n\treturn ctx.json(response);\n}\nasync function checkOAuthClient(client, opts, settings) {\n\tconst isClientMetadataDocument = settings?.registrationSource === \"clientMetadataDocument\";\n\tconst clientWithDefaults = applyOAuthClientRegistrationDefaults(client, isClientMetadataDocument ? null : settings?.registrationSource === \"dynamic\" ? resolveDynamicRegistrationDefaultApplicationType(opts, client) : \"web\");\n\tconst tokenEndpointAuthMethod = clientWithDefaults.token_endpoint_auth_method ?? \"client_secret_basic\";\n\tif (!new Set(getSupportedAuthMethods(opts, { includeNone: true })).has(tokenEndpointAuthMethod)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: `unsupported token_endpoint_auth_method ${tokenEndpointAuthMethod}`\n\t});\n\tif (clientWithDefaults.dpop_bound_access_tokens !== void 0 && typeof clientWithDefaults.dpop_bound_access_tokens !== \"boolean\") throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"dpop_bound_access_tokens must be a boolean\"\n\t});\n\tconst grantTypes = clientWithDefaults.grant_types ?? [];\n\tconst responseTypes = clientWithDefaults.response_types;\n\tconst applicationType = clientWithDefaults.application_type;\n\tif (applicationType !== void 0 && applicationType !== \"web\" && applicationType !== \"native\") throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"application_type must be web or native\"\n\t});\n\tif (grantTypes.includes(\"authorization_code\") && (!clientWithDefaults.redirect_uris || clientWithDefaults.redirect_uris.length === 0)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_redirect_uri\",\n\t\terror_description: \"Redirect URIs are required for authorization_code and implicit grant types\"\n\t});\n\tfor (const uri of clientWithDefaults.redirect_uris ?? []) validateClientRedirectUri(uri, applicationType ?? (isClientMetadataDocument ? \"native\" : \"web\"));\n\tconst supportedGrantTypes = new Set(getSupportedGrantTypes(opts));\n\tif (isClientMetadataDocument) {\n\t\tif (!grantTypes.some((grantType) => supportedGrantTypes.has(grantType))) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: `no mutually supported grant_type among ${grantTypes.join(\", \")}`\n\t\t});\n\t} else for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: `unsupported grant_type ${grantType}`\n\t});\n\tif (grantTypes.includes(\"authorization_code\") && !responseTypes?.includes(\"code\")) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"When 'authorization_code' grant type is used, 'code' response type must be included\"\n\t});\n\tif (!grantTypes.includes(\"authorization_code\") && responseTypes?.includes(\"code\")) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"When 'code' response type is used, 'authorization_code' grant type must be included\"\n\t});\n\tif (clientWithDefaults.subject_type !== void 0) {\n\t\tif (clientWithDefaults.subject_type !== \"public\" && clientWithDefaults.subject_type !== \"pairwise\") throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: `subject_type must be \"public\" or \"pairwise\"`\n\t\t});\n\t\tif (clientWithDefaults.subject_type === \"pairwise\" && !opts.pairwiseSecret) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"pairwise subject_type requires server pairwiseSecret configuration\"\n\t\t});\n\t\tif (clientWithDefaults.subject_type === \"pairwise\" && clientWithDefaults.redirect_uris?.some(isCustomSchemeWithHost)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"pairwise clients cannot use custom-scheme redirect URIs that include a host\"\n\t\t});\n\t\tif (clientWithDefaults.subject_type === \"pairwise\" && clientWithDefaults.redirect_uris && clientWithDefaults.redirect_uris.length > 1) {\n\t\t\tif (new Set(clientWithDefaults.redirect_uris.map((uri) => new URL(uri).host)).size > 1) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\terror_description: \"pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host.\"\n\t\t\t});\n\t\t}\n\t}\n\tconst requestedScopes = (clientWithDefaults?.scope)?.split(\" \").filter((v) => v.length);\n\tconst validatesRegistrationMetadata = settings?.registrationSource === \"dynamic\" || settings?.registrationSource === \"clientMetadataDocument\";\n\tconst allowedScopes = validatesRegistrationMetadata ? resolveClientRegistrationScopes(opts) : opts.scopes;\n\tif (allowedScopes) {\n\t\tconst validScopes = new Set(allowedScopes);\n\t\tfor (const requestedScope of requestedScopes ?? []) if (!validScopes?.has(requestedScope)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_scope\",\n\t\t\terror_description: `cannot request scope ${requestedScope}`\n\t\t});\n\t}\n\tif (validatesRegistrationMetadata && clientWithDefaults.require_pkce === false) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: `pkce is required for registered clients.`\n\t});\n\tif (clientWithDefaults.jwks || clientWithDefaults.jwks_uri) {\n\t\tif (clientWithDefaults.jwks && clientWithDefaults.jwks_uri) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"jwks and jwks_uri are mutually exclusive\"\n\t\t});\n\t\tif (clientWithDefaults.jwks_uri) try {\n\t\t\tconst uri = new URL(clientWithDefaults.jwks_uri);\n\t\t\tif (uri.protocol !== \"https:\") throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\terror_description: \"jwks_uri must use HTTPS\"\n\t\t\t});\n\t\t\tif (uri.username || uri.password) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\terror_description: \"jwks_uri must not contain credentials\"\n\t\t\t});\n\t\t\tif (clientWithDefaults.jwks_uri.includes(\"#\")) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\terror_description: \"jwks_uri must not include a fragment component\"\n\t\t\t});\n\t\t\tif (isPrivateHostname(uri.hostname)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\terror_description: \"jwks_uri must not point to a private or reserved address\"\n\t\t\t});\n\t\t\tif (settings?.ctx && !settings.ctx.context.isTrustedOrigin(uri.href)) {\n\t\t\t\tconst clientId = typeof clientWithDefaults.client_id === \"string\" ? clientWithDefaults.client_id : void 0;\n\t\t\t\tif (!(isClientMetadataDocument && clientId !== void 0 && URL.canParse(clientId) && new URL(clientId).origin === uri.origin)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\t\terror_description: \"jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin\"\n\t\t\t\t});\n\t\t\t}\n\t\t} catch (e) {\n\t\t\tif (e instanceof APIError) throw e;\n\t\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\terror_description: \"jwks_uri must be a valid URL\"\n\t\t\t});\n\t\t}\n\t\tif (clientWithDefaults.jwks) assertValidRegistrationJwks(clientWithDefaults.jwks);\n\t}\n\tif (tokenEndpointAuthMethod === \"private_key_jwt\" && !clientWithDefaults.jwks && !clientWithDefaults.jwks_uri) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"private_key_jwt requires either jwks or jwks_uri\"\n\t});\n\tif (clientWithDefaults.backchannel_logout_uri !== void 0) {\n\t\tif (opts.disableJwtPlugin) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)\"\n\t\t});\n\t\tlet url;\n\t\ttry {\n\t\t\turl = new URL(clientWithDefaults.backchannel_logout_uri);\n\t\t} catch {\n\t\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client_metadata\",\n\t\t\t\terror_description: \"backchannel_logout_uri must be an absolute URL\"\n\t\t\t});\n\t\t}\n\t\tif (clientWithDefaults.backchannel_logout_uri.includes(\"#\")) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"backchannel_logout_uri must not include a fragment component\"\n\t\t});\n\t\tif (url.protocol !== \"https:\") throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"backchannel_logout_uri must use https\"\n\t\t});\n\t\tif (url.username || url.password) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"backchannel_logout_uri must not contain credentials\"\n\t\t});\n\t\tif (isPrivateHostname(url.hostname)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_client_metadata\",\n\t\t\terror_description: \"backchannel_logout_uri must not point to a private or reserved address\"\n\t\t});\n\t}\n}\nconst CLIENT_REGISTRATION_COLLISION = Symbol(\"client-registration-collision\");\nfunction isClientRegistrationCollision(error) {\n\tif (!error || typeof error !== \"object\") return false;\n\tconst candidate = error;\n\treturn candidate[CLIENT_REGISTRATION_COLLISION] === true && (candidate.kind === \"oauth-client-row-unique\" || candidate.kind === \"oauth-client-resource-link-unique\") && \"cause\" in candidate;\n}\n/**\n* Creates and persists one canonical OAuth client registration.\n*\n* Authorization and ownership resolution belong to endpoint adapters. This\n* operation owns metadata normalization, validation, credentials, persistence,\n* and resource links so canonical creation paths share one transactional\n* boundary.\n*/\nasync function persistOAuthClientRegistration(ctx, opts, input) {\n\tconst registrationMetadata = input.registrationSource === \"dynamic\" && !input.metadata.scope ? {\n\t\t...input.metadata,\n\t\tscope: (opts.clientRegistrationDefaultScopes ?? opts.scopes)?.join(\" \")\n\t} : input.metadata;\n\tconst body = applyOAuthClientRegistrationDefaults(registrationMetadata, input.registrationSource === \"clientMetadataDocument\" ? null : input.registrationSource === \"dynamic\" ? resolveDynamicRegistrationDefaultApplicationType(opts, registrationMetadata) : \"web\");\n\tconst isPublic = body.token_endpoint_auth_method === \"none\";\n\tconst isPrivateKeyJwt = body.token_endpoint_auth_method === \"private_key_jwt\";\n\tconst isExtensionAuthMethod = isExtensionTokenEndpointAuthMethod(opts, body.token_endpoint_auth_method);\n\tawait checkOAuthClient(body, opts, {\n\t\tregistrationSource: input.registrationSource,\n\t\tctx\n\t});\n\tconst clientId = input.clientId ?? opts.generateClientId?.() ?? generateRandomString(32, \"a-z\", \"A-Z\");\n\tconst clientSecret = isPublic || isPrivateKeyJwt || isExtensionAuthMethod ? void 0 : opts.generateClientSecret?.() || generateRandomString(32, \"a-z\", \"A-Z\");\n\tconst storedClientSecret = clientSecret ? await storeClientSecret(ctx, opts, clientSecret) : void 0;\n\tconst isPKCEOptionalForRegisteredClient = input.registrationSource === \"dynamic\" && !isPublic && opts.clientRegistrationRequirePKCE === false;\n\tconst requirePKCE = body.require_pkce ?? (isPKCEOptionalForRegisteredClient ? false : void 0);\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tconst { resources: _requestedResources, ...persistableBody } = input.registrationSource === \"dynamic\" || input.registrationSource === \"clientMetadataDocument\" ? {\n\t\t...body,\n\t\tscope: resolveClientRegistrationScopes(opts).join(\" \")\n\t} : body;\n\tconst owner = input.registrationSource === \"clientMetadataDocument\" ? void 0 : {\n\t\tuserId: input.userId,\n\t\treferenceId: input.referenceId\n\t};\n\tconst schema = oauthToSchema({\n\t\t...persistableBody,\n\t\tredirect_uris: body.redirect_uris ?? [],\n\t\tdisabled: void 0,\n\t\tclient_secret_expires_at: storedClientSecret ? input.registrationSource === \"dynamic\" && opts.clientRegistrationClientSecretExpiration ? toExpJWT(opts.clientRegistrationClientSecretExpiration, iat) : 0 : void 0,\n\t\tclient_id: clientId,\n\t\tclient_secret: storedClientSecret,\n\t\tclient_id_issued_at: iat,\n\t\trequire_pkce: requirePKCE,\n\t\tuser_id: owner?.referenceId ? void 0 : owner?.userId,\n\t\treference_id: owner?.referenceId\n\t});\n\tschema.clientCredentialsScopes = input.registrationSource === \"clientMetadataDocument\" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === \"managed\" ? input.clientCredentialsScopes ?? [] : [];\n\tschema.clientDiscoveryId = input.registrationSource === \"clientMetadataDocument\" ? input.clientDiscoveryId : null;\n\tif (input.registrationSource === \"clientMetadataDocument\" && body.application_type === void 0) schema.applicationType = null;\n\tconst requestedResources = input.registrationSource === \"clientMetadataDocument\" ? [] : input.requestedResources ?? [];\n\tif (input.registrationSource === \"dynamic\") assertDynamicRegistrationResourcesAllowed(opts, requestedResources);\n\tconst resources = await resolveClientRegistrationResources(ctx, opts, requestedResources);\n\tconst clientModel = opts.schema?.oauthClient?.modelName ?? \"oauthClient\";\n\tconst clientResourceModel = opts.schema?.oauthClientResource?.modelName ?? \"oauthClientResource\";\n\tconst existingClient = input.registrationSource === \"clientMetadataDocument\" ? input.existingClient : void 0;\n\tconst clientDiscoveryId = input.registrationSource === \"clientMetadataDocument\" ? input.clientDiscoveryId : null;\n\tconst persistenceResult = await runWithTransaction(ctx.context.adapter, async () => {\n\t\tconst adapter = await getCurrentAdapter(ctx.context.adapter);\n\t\tlet storedClient;\n\t\tlet created = false;\n\t\tif (existingClient) {\n\t\t\tconst updatedClient = await adapter.update({\n\t\t\t\tmodel: clientModel,\n\t\t\t\twhere: [{\n\t\t\t\t\tfield: \"clientId\",\n\t\t\t\t\tvalue: clientId\n\t\t\t\t}, {\n\t\t\t\t\tfield: \"clientDiscoveryId\",\n\t\t\t\t\tvalue: clientDiscoveryId\n\t\t\t\t}],\n\t\t\t\tupdate: {\n\t\t\t\t\t...schema,\n\t\t\t\t\tdisabled: existingClient.disabled,\n\t\t\t\t\tskipConsent: existingClient.skipConsent,\n\t\t\t\t\tenableEndSession: existingClient.enableEndSession,\n\t\t\t\t\tcreatedAt: existingClient.createdAt,\n\t\t\t\t\tupdatedAt: /* @__PURE__ */ new Date(iat * 1e3)\n\t\t\t\t}\n\t\t\t});\n\t\t\tif (!updatedClient) throw new APIError(\"BAD_REQUEST\", {\n\t\t\t\terror: \"invalid_client\",\n\t\t\t\terror_description: \"client no longer exists\"\n\t\t\t});\n\t\t\tstoredClient = updatedClient;\n\t\t} else {\n\t\t\ttry {\n\t\t\t\tstoredClient = await adapter.create({\n\t\t\t\t\tmodel: clientModel,\n\t\t\t\t\tdata: {\n\t\t\t\t\t\t...schema,\n\t\t\t\t\t\tcreatedAt: /* @__PURE__ */ new Date(iat * 1e3),\n\t\t\t\t\t\tupdatedAt: /* @__PURE__ */ new Date(iat * 1e3)\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tif (input.registrationSource === \"clientMetadataDocument\" && isUniqueConstraintError(error)) throw {\n\t\t\t\t\t[CLIENT_REGISTRATION_COLLISION]: true,\n\t\t\t\t\tkind: \"oauth-client-row-unique\",\n\t\t\t\t\tclientId,\n\t\t\t\t\tcause: error\n\t\t\t\t};\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tcreated = true;\n\t\t}\n\t\tconst linkedResources = resources.length === 0 ? [] : await adapter.findMany({\n\t\t\tmodel: clientResourceModel,\n\t\t\twhere: [{\n\t\t\t\tfield: \"clientId\",\n\t\t\t\tvalue: clientId\n\t\t\t}]\n\t\t});\n\t\tconst linkedResourceIds = new Set(linkedResources.map((link) => link.resourceId));\n\t\tconst now = /* @__PURE__ */ new Date();\n\t\tfor (const resourceId of resources) {\n\t\t\tif (linkedResourceIds.has(resourceId)) continue;\n\t\t\ttry {\n\t\t\t\tawait adapter.create({\n\t\t\t\t\tmodel: clientResourceModel,\n\t\t\t\t\tdata: {\n\t\t\t\t\t\tclientId,\n\t\t\t\t\t\tresourceId,\n\t\t\t\t\t\tcreatedAt: now\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tif (input.registrationSource === \"clientMetadataDocument\" && isUniqueConstraintError(error)) throw {\n\t\t\t\t\t[CLIENT_REGISTRATION_COLLISION]: true,\n\t\t\t\t\tkind: \"oauth-client-resource-link-unique\",\n\t\t\t\t\tclientId,\n\t\t\t\t\tresourceId,\n\t\t\t\t\tcause: error\n\t\t\t\t};\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\t\treturn {\n\t\t\tclient: storedClient,\n\t\t\tcreated\n\t\t};\n\t});\n\treturn {\n\t\tclient: persistenceResult.client,\n\t\tclientSecret,\n\t\tresources,\n\t\tcreated: persistenceResult.created\n\t};\n}\nfunction createOAuthClientRegistrationResponse(result, opts) {\n\tconst responseBody = schemaToOAuth({\n\t\t...result.client,\n\t\tclientSecret: result.clientSecret ? (opts.prefix?.clientSecret ?? \"\") + result.clientSecret : void 0\n\t});\n\tif (result.resources.length > 0) responseBody.resources = result.resources;\n\treturn responseBody;\n}\nfunction createOAuthClientAdministrativeResponse(result, opts) {\n\treturn {\n\t\t...createOAuthClientRegistrationResponse(result, opts),\n\t\tclient_credentials_scopes: [...result.client.clientCredentialsScopes ?? []]\n\t};\n}\n/**\n* Creates and persists one canonical OAuth client registration.\n*/\nasync function createOAuthClientRegistration(ctx, opts, input) {\n\treturn createOAuthClientRegistrationResponse(await persistOAuthClientRegistration(ctx, opts, input), opts);\n}\nasync function createOAuthClientAdministrativeRegistration(ctx, opts, input) {\n\treturn createOAuthClientAdministrativeResponse(await persistOAuthClientRegistration(ctx, opts, input), opts);\n}\nfunction assertClientDiscoveryOwnership(client, clientDiscoveryId) {\n\tif (!client || client.clientDiscoveryId === clientDiscoveryId) return;\n\tthrow new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client\",\n\t\terror_description: \"client_id is already owned by a different registration source\"\n\t});\n}\n/**\n* First-party persistence seam for a validated Client ID Metadata Document.\n*\n* This operation owns both initial creation and atomic replacement. It never\n* generates a client secret, preserves operator-controlled flags on\n* replacement, and ensures server-default resource links in the same\n* transaction.\n*\n* @internal\n*/\nasync function registerClientMetadataDocument(ctx, opts, input) {\n\tassertClientDiscoveryOwnership(input.existingClient, input.clientDiscoveryId);\n\tif (input.metadata.backchannel_logout_uri !== void 0 || input.metadata.backchannel_logout_session_required !== void 0) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"Client ID Metadata Documents cannot register a back-channel logout target\"\n\t});\n\tif ((input.metadata.token_endpoint_auth_method ?? \"none\") !== \"none\" && input.metadata.token_endpoint_auth_method !== \"private_key_jwt\") throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_client_metadata\",\n\t\terror_description: \"Client ID Metadata Document clients cannot use a shared secret\"\n\t});\n\tconst registrationInput = {\n\t\t...input,\n\t\tmetadata: {\n\t\t\t...input.metadata,\n\t\t\ttoken_endpoint_auth_method: input.metadata.token_endpoint_auth_method ?? \"none\",\n\t\t\tclient_secret: void 0,\n\t\t\tclient_secret_expires_at: void 0\n\t\t},\n\t\tregistrationSource: \"clientMetadataDocument\"\n\t};\n\ttry {\n\t\treturn await persistOAuthClientRegistration(ctx, opts, registrationInput);\n\t} catch (error) {\n\t\tif (!isClientRegistrationCollision(error)) throw error;\n\t\tconst clientModel = opts.schema?.oauthClient?.modelName ?? \"oauthClient\";\n\t\tconst clientResourceModel = opts.schema?.oauthClientResource?.modelName ?? \"oauthClientResource\";\n\t\tconst currentClient = await ctx.context.adapter.findOne({\n\t\t\tmodel: clientModel,\n\t\t\twhere: [{\n\t\t\t\tfield: \"clientId\",\n\t\t\t\tvalue: input.clientId\n\t\t\t}]\n\t\t});\n\t\tif (error.clientId !== input.clientId || !currentClient || currentClient.clientDiscoveryId !== input.clientDiscoveryId) throw error.cause;\n\t\tif (error.kind === \"oauth-client-resource-link-unique\") {\n\t\t\tif (!await ctx.context.adapter.findOne({\n\t\t\t\tmodel: clientResourceModel,\n\t\t\t\twhere: [{\n\t\t\t\t\tfield: \"clientId\",\n\t\t\t\t\tvalue: error.clientId\n\t\t\t\t}, {\n\t\t\t\t\tfield: \"resourceId\",\n\t\t\t\t\tvalue: error.resourceId\n\t\t\t\t}]\n\t\t\t})) throw error.cause;\n\t\t}\n\t\ttry {\n\t\t\treturn await persistOAuthClientRegistration(ctx, opts, {\n\t\t\t\t...registrationInput,\n\t\t\t\texistingClient: currentClient\n\t\t\t});\n\t\t} catch (retryError) {\n\t\t\tif (isClientRegistrationCollision(retryError)) throw retryError.cause;\n\t\t\tthrow retryError;\n\t\t}\n\t}\n}\nfunction isUniqueConstraintError(error) {\n\tif (!error || typeof error !== \"object\") return false;\n\tconst candidate = error;\n\tconst code = String(candidate.code ?? candidate.errno ?? \"\");\n\tif ([\n\t\t\"1062\",\n\t\t\"11000\",\n\t\t\"23505\",\n\t\t\"ER_DUP_ENTRY\",\n\t\t\"P2002\",\n\t\t\"SQLITE_CONSTRAINT_UNIQUE\"\n\t].includes(code)) return true;\n\tif (candidate.name === \"MongoServerError\" && candidate.code === 11e3) return true;\n\treturn typeof candidate.message === \"string\" && /(?:duplicate|unique constraint|unique key)/i.test(candidate.message);\n}\nasync function createOAuthClientEndpoint(ctx, opts, settings) {\n\tconst session = await getSessionFromCtx(ctx);\n\tawait assertClientPrivileges(ctx, session, opts, \"create\");\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst referenceId = opts.clientReference ? await opts.clientReference({\n\t\tuser: session.user,\n\t\tsession: session.session\n\t}) : void 0;\n\tconst { client_credentials_scopes: rawClientCredentialsScopes, ...metadata } = ctx.body;\n\tconst clientCredentialsScopes = settings?.admin ? normalizeClientCredentialsScopes(rawClientCredentialsScopes ?? []) : [];\n\tvalidateClientCredentialsScopes(clientCredentialsScopes, resolveRegistrationGrantTypes(metadata), metadata.token_endpoint_auth_method, opts);\n\tif (clientCredentialsScopes.length > 0) await assertClientPrivileges(ctx, session, opts, \"configure-client-credentials-scopes\");\n\tconst requestedResources = settings?.admin ? metadata.resources : void 0;\n\tfor (const identifier of new Set(requestedResources ?? [])) await assertResourcePrivileges(ctx, session, opts, \"link\", identifier);\n\tconst registrationInput = {\n\t\tmetadata,\n\t\tregistrationSource: \"managed\",\n\t\tuserId: referenceId ? void 0 : session.session.userId,\n\t\treferenceId,\n\t\tclientCredentialsScopes,\n\t\t...requestedResources ? { requestedResources } : {}\n\t};\n\tconst responseBody = settings?.admin ? await createOAuthClientAdministrativeRegistration(ctx, opts, registrationInput) : await createOAuthClientRegistration(ctx, opts, registrationInput);\n\tctx.setStatus(201);\n\treturn ctx.json(responseBody);\n}\nfunction oauthToSchema(input) {\n\tconst { client_id: clientId, client_secret: clientSecret, client_secret_expires_at: _expiresAt, scope: _scope, user_id: userId, client_id_issued_at: _createdAt, client_name: name, client_uri: uri, logo_uri: icon, contacts, tos_uri: tos, policy_uri: policy, jwks: inputJwks, jwks_uri: jwksUri, software_id: softwareId, software_version: softwareVersion, software_statement: softwareStatement, redirect_uris: redirectUris, post_logout_redirect_uris: postLogoutRedirectUris, backchannel_logout_uri: backchannelLogoutUri, backchannel_logout_session_required: backchannelLogoutSessionRequired, token_endpoint_auth_method: tokenEndpointAuthMethod, grant_types: grantTypes, response_types: responseTypes, application_type: applicationType, disabled, skip_consent: skipConsent, enable_end_session: enableEndSession, require_pkce: requirePKCE, dpop_bound_access_tokens: dpopBoundAccessTokens, subject_type: subjectType, reference_id: referenceId, metadata: inputMetadata } = input;\n\tconst expiresAt = _expiresAt ? /* @__PURE__ */ new Date(Number(_expiresAt) * 1e3) : void 0;\n\tconst createdAt = _createdAt ? /* @__PURE__ */ new Date(_createdAt * 1e3) : void 0;\n\tconst scopes = _scope?.split(\" \");\n\tconst metadataObj = stripReservedOAuthClientMetadataExtensions(inputMetadata ?? {});\n\tconst metadata = metadataObj && Object.keys(metadataObj).length ? JSON.stringify(metadataObj) : void 0;\n\treturn {\n\t\tclientId,\n\t\tclientSecret,\n\t\tdisabled,\n\t\tscopes,\n\t\tuserId,\n\t\tcreatedAt,\n\t\texpiresAt,\n\t\tname,\n\t\turi,\n\t\ticon,\n\t\tcontacts,\n\t\ttos,\n\t\tpolicy,\n\t\tsoftwareId,\n\t\tsoftwareVersion,\n\t\tsoftwareStatement,\n\t\tredirectUris,\n\t\tpostLogoutRedirectUris,\n\t\tbackchannelLogoutUri,\n\t\tbackchannelLogoutSessionRequired,\n\t\ttokenEndpointAuthMethod,\n\t\tgrantTypes,\n\t\tresponseTypes,\n\t\tjwks: inputJwks ? JSON.stringify(inputJwks) : void 0,\n\t\tjwksUri,\n\t\tapplicationType,\n\t\tskipConsent,\n\t\tenableEndSession,\n\t\trequirePKCE,\n\t\tdpopBoundAccessTokens,\n\t\tsubjectType,\n\t\treferenceId,\n\t\tmetadata\n\t};\n}\n/**\n* Converts a Database Schema to an OAuth 2.0 Dynamic Client Schema\n* @param input\n* @param cleaned - default true, determines if the output has only Oauth 2.0 compatible data\n* @returns\n*/\nfunction schemaToOAuth(input) {\n\tconst { clientId, clientSecret, disabled, scopes, userId, createdAt, updatedAt: _updatedAt, expiresAt, name, uri, icon, contacts, tos, policy, softwareId, softwareVersion, softwareStatement, redirectUris, postLogoutRedirectUris, backchannelLogoutUri, backchannelLogoutSessionRequired, tokenEndpointAuthMethod, grantTypes, responseTypes, applicationType, jwks, jwksUri, skipConsent, enableEndSession, requirePKCE, dpopBoundAccessTokens, subjectType, referenceId, metadata } = input;\n\tconst _expiresAt = expiresAt ? Math.round(new Date(expiresAt).getTime() / 1e3) : void 0;\n\tconst _createdAt = createdAt ? Math.round(new Date(createdAt).getTime() / 1e3) : void 0;\n\tconst _scopes = scopes?.join(\" \");\n\treturn {\n\t\t...stripReservedOAuthClientMetadataExtensions(parseClientMetadata(metadata)),\n\t\tclient_id: clientId,\n\t\tclient_secret: clientSecret ?? void 0,\n\t\tclient_secret_expires_at: clientSecret ? _expiresAt ?? 0 : void 0,\n\t\tscope: _scopes ?? void 0,\n\t\tuser_id: userId ?? void 0,\n\t\tclient_id_issued_at: _createdAt ?? void 0,\n\t\tclient_name: name ?? void 0,\n\t\tclient_uri: uri ?? void 0,\n\t\tlogo_uri: icon ?? void 0,\n\t\tcontacts: contacts ?? void 0,\n\t\ttos_uri: tos ?? void 0,\n\t\tpolicy_uri: policy ?? void 0,\n\t\tjwks: jwks ? JSON.parse(jwks) : void 0,\n\t\tjwks_uri: jwksUri ?? void 0,\n\t\tsoftware_id: softwareId ?? void 0,\n\t\tsoftware_version: softwareVersion ?? void 0,\n\t\tsoftware_statement: softwareStatement ?? void 0,\n\t\tredirect_uris: redirectUris ?? [],\n\t\tpost_logout_redirect_uris: postLogoutRedirectUris ?? void 0,\n\t\tbackchannel_logout_uri: backchannelLogoutUri ?? void 0,\n\t\tbackchannel_logout_session_required: backchannelLogoutSessionRequired ?? void 0,\n\t\ttoken_endpoint_auth_method: tokenEndpointAuthMethod ?? void 0,\n\t\tgrant_types: grantTypes ?? void 0,\n\t\tresponse_types: responseTypes ?? void 0,\n\t\tapplication_type: applicationType ?? void 0,\n\t\tdisabled: disabled ?? void 0,\n\t\tskip_consent: skipConsent ?? void 0,\n\t\tenable_end_session: enableEndSession ?? void 0,\n\t\trequire_pkce: requirePKCE ?? void 0,\n\t\tdpop_bound_access_tokens: dpopBoundAccessTokens ?? void 0,\n\t\tsubject_type: subjectType ?? void 0,\n\t\treference_id: referenceId ?? void 0\n\t};\n}\n//#endregion\n//#region src/oauthClient/endpoints.ts\nasync function getClientEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tawait assertClientPrivileges(ctx, session, opts, \"read\", ctx.query.client_id);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst client = await getClient(ctx, opts, ctx.query.client_id);\n\tif (!client) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"client not found\",\n\t\terror: \"not_found\"\n\t});\n\tif (client.userId) {\n\t\tif (client.userId !== session.user.id) throw new APIError(\"UNAUTHORIZED\");\n\t} else if (client.referenceId && opts.clientReference) {\n\t\tif (client.referenceId !== await opts.clientReference(session)) throw new APIError(\"UNAUTHORIZED\");\n\t} else throw new APIError(\"UNAUTHORIZED\");\n\tconst res = schemaToOAuth(client);\n\tres.client_secret = void 0;\n\treturn res;\n}\n/**\n* Provides public client fields for any logged-in user.\n* This is commonly used to display information on login flow pages.\n*/\nasync function getClientPublicEndpoint(ctx, opts, clientId) {\n\tconst client = await getClient(ctx, opts, clientId);\n\tif (!client) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"client not found\",\n\t\terror: \"not_found\"\n\t});\n\tif (client.disabled) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"client not found\",\n\t\terror: \"not_found\"\n\t});\n\treturn schemaToOAuth({\n\t\tclientId: client.clientId,\n\t\tname: client.name,\n\t\turi: client.uri,\n\t\tcontacts: client.contacts,\n\t\ticon: client.icon,\n\t\ttos: client.tos,\n\t\tpolicy: client.policy\n\t});\n}\nasync function getClientsEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tawait assertClientPrivileges(ctx, session, opts, \"list\");\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst referenceId = await opts.clientReference?.(session);\n\tif (referenceId) return await ctx.context.adapter.findMany({\n\t\tmodel: \"oauthClient\",\n\t\twhere: [{\n\t\t\tfield: \"referenceId\",\n\t\t\tvalue: referenceId\n\t\t}]\n\t}).then((res) => {\n\t\tif (!res) return null;\n\t\treturn res.map((v) => {\n\t\t\tconst res = schemaToOAuth(v);\n\t\t\tres.client_secret = void 0;\n\t\t\treturn res;\n\t\t});\n\t});\n\telse if (session.user.id) return await ctx.context.adapter.findMany({\n\t\tmodel: \"oauthClient\",\n\t\twhere: [{\n\t\t\tfield: \"userId\",\n\t\t\tvalue: session.user.id\n\t\t}]\n\t}).then((res) => {\n\t\tif (!res) return null;\n\t\treturn res.map((v) => {\n\t\t\tconst res = schemaToOAuth(v);\n\t\t\tres.client_secret = void 0;\n\t\t\treturn res;\n\t\t});\n\t});\n\telse throw new APIError(\"BAD_REQUEST\", { message: \"either user_id or reference_id must be provided\" });\n}\nasync function deleteClientEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tawait assertClientPrivileges(ctx, session, opts, \"delete\", ctx.body.client_id);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst clientId = ctx.body.client_id;\n\tif (opts.cachedTrustedClients?.has(clientId)) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\terror_description: \"trusted clients must be updated manually\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst client = await getClient(ctx, opts, clientId);\n\tif (!client) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"client not found\",\n\t\terror: \"not_found\"\n\t});\n\tif (client.userId) {\n\t\tif (client.userId !== session.user.id) throw new APIError(\"UNAUTHORIZED\");\n\t} else if (client.referenceId && opts.clientReference) {\n\t\tif (client.referenceId !== await opts.clientReference(session)) throw new APIError(\"UNAUTHORIZED\");\n\t} else throw new APIError(\"UNAUTHORIZED\");\n\tawait ctx.context.adapter.delete({\n\t\tmodel: \"oauthClient\",\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}]\n\t});\n}\nasync function updateClientEndpoint(ctx, opts, settings) {\n\tconst session = await getSessionFromCtx(ctx);\n\tawait assertClientPrivileges(ctx, session, opts, \"update\", ctx.body.client_id);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst clientId = ctx.body.client_id;\n\tif (opts.cachedTrustedClients?.has(clientId)) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\terror_description: \"trusted clients must be updated manually\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst client = await getClient(ctx, opts, clientId);\n\tif (!client) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"client not found\",\n\t\terror: \"not_found\"\n\t});\n\tconst { client_credentials_scopes: rawClientCredentialsScopes, ...updates } = ctx.body.update;\n\tconst ownsClient = client.userId ? client.userId === session.user.id : client.referenceId && opts.clientReference ? client.referenceId === await opts.clientReference(session) : false;\n\tconst isCrossOwnerScopeConfiguration = !ownsClient && settings?.admin && rawClientCredentialsScopes !== void 0 && Object.keys(updates).length === 0;\n\tif (!ownsClient && !isCrossOwnerScopeConfiguration) throw new APIError(\"UNAUTHORIZED\");\n\tif (isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, \"configure-client-credentials-scopes\", clientId);\n\tif (Object.keys(updates).length === 0 && rawClientCredentialsScopes === void 0) {\n\t\tconst res = schemaToOAuth(client);\n\t\tres.client_secret = void 0;\n\t\tif (settings?.admin) return {\n\t\t\t...res,\n\t\t\tclient_credentials_scopes: [...client.clientCredentialsScopes ?? []]\n\t\t};\n\t\treturn res;\n\t}\n\tconst finalGrantTypes = updates.grant_types ?? client.grantTypes ?? [];\n\tconst finalTokenEndpointAuthMethod = updates.token_endpoint_auth_method ?? client.tokenEndpointAuthMethod;\n\tconst clientCredentialsScopes = rawClientCredentialsScopes === void 0 ? void 0 : normalizeClientCredentialsScopes(rawClientCredentialsScopes);\n\tif (clientCredentialsScopes !== void 0) {\n\t\tvalidateClientCredentialsScopes(clientCredentialsScopes, finalGrantTypes, finalTokenEndpointAuthMethod, opts);\n\t\tif (clientCredentialsScopes.length > 0 && !isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, \"configure-client-credentials-scopes\", clientId);\n\t}\n\tawait checkOAuthClient({\n\t\t...schemaToOAuth(client),\n\t\t...updates\n\t}, opts, { ctx });\n\tconst schemaUpdates = { ...oauthToSchema(updates) };\n\tif (!finalGrantTypes.includes(\"client_credentials\") || finalTokenEndpointAuthMethod === \"none\") schemaUpdates.clientCredentialsScopes = [];\n\telse if (clientCredentialsScopes !== void 0) schemaUpdates.clientCredentialsScopes = clientCredentialsScopes;\n\tif (updates.token_endpoint_auth_method) if (updates.token_endpoint_auth_method === \"private_key_jwt\") schemaUpdates.clientSecret = null;\n\telse {\n\t\tschemaUpdates.jwks = null;\n\t\tschemaUpdates.jwksUri = null;\n\t\tif (!schemaUpdates.clientSecret) schemaUpdates.clientSecret = await storeClientSecret(ctx, opts, opts.generateClientSecret?.() || generateRandomString(32, \"a-z\", \"A-Z\"));\n\t}\n\tconst updatedClient = await ctx.context.adapter.update({\n\t\tmodel: \"oauthClient\",\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}],\n\t\tupdate: {\n\t\t\t...schemaUpdates,\n\t\t\tupdatedAt: /* @__PURE__ */ new Date(Math.floor(Date.now() / 1e3) * 1e3)\n\t\t}\n\t});\n\tif (!updatedClient) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\terror_description: \"unable to update client\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst res = schemaToOAuth(updatedClient);\n\tres.client_secret = void 0;\n\tif (settings?.admin) return {\n\t\t...res,\n\t\tclient_credentials_scopes: [...updatedClient.clientCredentialsScopes ?? []]\n\t};\n\treturn res;\n}\nasync function rotateClientSecretEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tawait assertClientPrivileges(ctx, session, opts, \"rotate\", ctx.body.client_id);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst clientId = ctx.body.client_id;\n\tif (opts.cachedTrustedClients?.has(clientId)) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\terror_description: \"trusted clients must be updated manually\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst client = await getClient(ctx, opts, clientId);\n\tif (!client) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"client not found\",\n\t\terror: \"not_found\"\n\t});\n\tif (client.userId) {\n\t\tif (client.userId !== session.user.id) throw new APIError(\"UNAUTHORIZED\");\n\t} else if (client.referenceId && opts.clientReference) {\n\t\tif (client.referenceId !== await opts.clientReference(session)) throw new APIError(\"UNAUTHORIZED\");\n\t} else throw new APIError(\"UNAUTHORIZED\");\n\tif (client.tokenEndpointAuthMethod === \"none\" || !client.clientSecret) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: \"secret rotation is only available for clients using client_secret authentication\",\n\t\terror: \"invalid_client\"\n\t});\n\tconst clientSecret = opts.generateClientSecret?.() || generateRandomString(32, \"a-z\", \"A-Z\");\n\tconst storedClientSecret = clientSecret ? await storeClientSecret(ctx, opts, clientSecret) : void 0;\n\tconst updatedClient = await ctx.context.adapter.update({\n\t\tmodel: \"oauthClient\",\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}],\n\t\tupdate: {\n\t\t\tclientSecret: storedClientSecret,\n\t\t\tupdatedAt: /* @__PURE__ */ new Date(Math.floor(Date.now() / 1e3) * 1e3)\n\t\t}\n\t});\n\tif (!updatedClient) throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\terror_description: \"unable to update client\",\n\t\terror: \"invalid_client\"\n\t});\n\treturn schemaToOAuth({\n\t\t...updatedClient,\n\t\tclientSecret: (opts.prefix?.clientSecret ?? \"\") + clientSecret\n\t});\n}\n//#endregion\n//#region src/oauthClient/index.ts\nconst tokenEndpointAuthMethodSchema = z.string().trim().min(1);\nconst grantTypesSchema = z.array(z.string().trim().min(1)).min(1);\nconst adminCreateOAuthClient = (opts) => createAuthEndpoint(\"/admin/oauth2/create-client\", {\n\tmethod: \"POST\",\n\tbody: z.object({\n\t\tredirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\tscope: z.string().optional(),\n\t\tclient_name: z.string().optional(),\n\t\tclient_uri: z.string().optional(),\n\t\tlogo_uri: z.string().optional(),\n\t\tcontacts: z.array(z.string().min(1)).min(1).optional(),\n\t\ttos_uri: z.string().optional(),\n\t\tpolicy_uri: z.string().optional(),\n\t\tsoftware_id: z.string().optional(),\n\t\tsoftware_version: z.string().optional(),\n\t\tsoftware_statement: z.string().optional(),\n\t\tpost_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\tbackchannel_logout_uri: SafeUrlSchema.optional(),\n\t\tbackchannel_logout_session_required: z.boolean().optional(),\n\t\ttoken_endpoint_auth_method: tokenEndpointAuthMethodSchema.optional(),\n\t\tapplication_type: z.enum([\"web\", \"native\"]).optional(),\n\t\tjwks: clientJwksSchema.optional(),\n\t\tjwks_uri: z.string().optional(),\n\t\tgrant_types: grantTypesSchema.optional(),\n\t\tclient_credentials_scopes: z.array(z.string().trim().min(1)).optional(),\n\t\tresources: z.array(ResourceUriSchema).optional(),\n\t\tresponse_types: z.array(z.enum([\"code\"])).optional(),\n\t\tclient_secret_expires_at: z.union([z.string(), z.number()]).optional().default(0),\n\t\tskip_consent: z.boolean().optional(),\n\t\tenable_end_session: z.boolean().optional(),\n\t\trequire_pkce: z.boolean().optional(),\n\t\tdpop_bound_access_tokens: z.boolean().optional(),\n\t\tsubject_type: z.enum([\"public\", \"pairwise\"]).optional(),\n\t\tmetadata: z.record(z.string(), z.unknown()).optional()\n\t}),\n\tmetadata: {\n\t\tnoStore: true,\n\t\tSERVER_ONLY: true,\n\t\topenapi: {\n\t\t\tdescription: \"Register an OAuth2 application\",\n\t\t\tresponses: { \"201\": {\n\t\t\t\tdescription: \"OAuth2 application registered successfully\",\n\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t/** @returns {OauthClient} */\n\t\t\t\t\ttype: \"object\",\n\t\t\t\t\tproperties: {\n\t\t\t\t\t\tclient_id: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Unique identifier for the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_secret: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Secret key for the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_secret_expires_at: {\n\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\tdescription: \"Time the client secret will expire. If 0, the client secret will never expire.\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tscope: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Space-separated scopes allowed by the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_credentials_scopes: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"Server-authorized scope ceiling for client_credentials tokens\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tuser_id: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"ID of the user who registered the client, null if registered anonymously\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_id_issued_at: {\n\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\tdescription: \"Creation timestamp of this client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_name: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Name of the OAuth2 application\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"URI of the OAuth2 application\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tlogo_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Icon URI for the application\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcontacts: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"List representing ways to contact people responsible for this client, typically email addresses\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttos_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Client's terms of service uri\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tpolicy_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Client's policy uri\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsoftware_id: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Unique identifier assigned by the developer to help in the dynamic registration process\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsoftware_version: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Version identifier for the software_id\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsoftware_statement: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"JWT containing metadata values about the client software as claims\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tredirect_uris: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tdescription: \"List of allowed redirect uris\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttoken_endpoint_auth_method: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Requested authentication method for the token endpoint\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tgrant_types: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"Grant types the client may use at the token endpoint\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tresponse_types: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tenum: [\"code\"]\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tdescription: \"Response types the client may use at the authorization endpoint\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tapplication_type: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"OIDC application type used to classify redirect URI policy\",\n\t\t\t\t\t\t\tenum: [\"web\", \"native\"]\n\t\t\t\t\t\t},\n\t\t\t\t\t\tresources: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tdescription: \"Final server-owned resources linked to the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tdisabled: {\n\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\tdescription: \"Whether the client is disabled\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\trequire_pkce: {\n\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\tdescription: \"Whether the client requires PKCE\",\n\t\t\t\t\t\t\tdefault: true\n\t\t\t\t\t\t},\n\t\t\t\t\t\tmetadata: {\n\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\tadditionalProperties: true,\n\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\tdescription: \"Additional metadata for the application\"\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\trequired: [\"client_id\"]\n\t\t\t\t} } }\n\t\t\t} }\n\t\t}\n\t}\n}, async (ctx) => {\n\treturn createOAuthClientEndpoint(ctx, opts, { admin: true });\n});\nconst createOAuthClient = (opts) => createAuthEndpoint(\"/oauth2/create-client\", {\n\tmethod: \"POST\",\n\tuse: [sessionMiddleware],\n\tbody: z.object({\n\t\tredirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\tscope: z.string().optional(),\n\t\tclient_name: z.string().optional(),\n\t\tclient_uri: z.string().optional(),\n\t\tlogo_uri: z.string().optional(),\n\t\tcontacts: z.array(z.string().min(1)).min(1).optional(),\n\t\ttos_uri: z.string().optional(),\n\t\tpolicy_uri: z.string().optional(),\n\t\tsoftware_id: z.string().optional(),\n\t\tsoftware_version: z.string().optional(),\n\t\tsoftware_statement: z.string().optional(),\n\t\tpost_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\tbackchannel_logout_uri: SafeUrlSchema.optional(),\n\t\tbackchannel_logout_session_required: z.boolean().optional(),\n\t\ttoken_endpoint_auth_method: tokenEndpointAuthMethodSchema.optional(),\n\t\tapplication_type: z.enum([\"web\", \"native\"]).optional(),\n\t\tjwks: clientJwksSchema.optional(),\n\t\tjwks_uri: z.string().optional(),\n\t\tgrant_types: grantTypesSchema.optional(),\n\t\tresponse_types: z.array(z.enum([\"code\"])).optional(),\n\t\tdpop_bound_access_tokens: z.boolean().optional()\n\t}),\n\tmetadata: {\n\t\tnoStore: true,\n\t\topenapi: {\n\t\t\tdescription: \"Register an OAuth2 application\",\n\t\t\tresponses: { \"201\": {\n\t\t\t\tdescription: \"OAuth2 application registered successfully\",\n\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t/** @returns {OauthClient} */\n\t\t\t\t\ttype: \"object\",\n\t\t\t\t\tproperties: {\n\t\t\t\t\t\tclient_id: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Unique identifier for the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_secret: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Secret key for the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_secret_expires_at: {\n\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\tdescription: \"Time the client secret will expire. If 0, the client secret will never expire.\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tscope: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Space-separated scopes allowed by the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tuser_id: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"ID of the user who registered the client, null if registered anonymously\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_id_issued_at: {\n\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\tdescription: \"Creation timestamp of this client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_name: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Name of the OAuth2 application\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tclient_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"URI of the OAuth2 application\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tlogo_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Icon URI for the application\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcontacts: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"List representing ways to contact people responsible for this client, typically email addresses\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttos_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Client's terms of service uri\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tpolicy_uri: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Client's policy uri\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsoftware_id: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Unique identifier assigned by the developer to help in the dynamic registration process\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsoftware_version: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Version identifier for the software_id\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsoftware_statement: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"JWT containing metadata values about the client software as claims\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tredirect_uris: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tdescription: \"List of allowed redirect uris\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttoken_endpoint_auth_method: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"Requested authentication method for the token endpoint\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tgrant_types: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"Grant types the client may use at the token endpoint\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tresponse_types: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tenum: [\"code\"]\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tdescription: \"Response types the client may use at the authorization endpoint\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tapplication_type: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tdescription: \"OIDC application type used to classify redirect URI policy\",\n\t\t\t\t\t\t\tenum: [\"web\", \"native\"]\n\t\t\t\t\t\t},\n\t\t\t\t\t\tresources: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tdescription: \"Final server-owned resources linked to the client\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tdisabled: {\n\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\tdescription: \"Whether the client is disabled\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tmetadata: {\n\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\tadditionalProperties: true,\n\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\tdescription: \"Additional metadata for the application\"\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\trequired: [\"client_id\"]\n\t\t\t\t} } }\n\t\t\t} }\n\t\t}\n\t}\n}, async (ctx) => {\n\treturn createOAuthClientEndpoint(ctx, opts);\n});\nconst getOAuthClient = (opts) => createAuthEndpoint(\"/oauth2/get-client\", {\n\tmethod: \"GET\",\n\tuse: [sessionMiddleware],\n\tquery: z.object({ client_id: z.string() }),\n\tmetadata: { openapi: { description: \"Get OAuth2 formatted client details\" } }\n}, async (ctx) => {\n\treturn getClientEndpoint(ctx, opts);\n});\nconst getOAuthClientPublic = (opts) => createAuthEndpoint(\"/oauth2/public-client\", {\n\tmethod: \"GET\",\n\tuse: [sessionMiddleware],\n\tquery: z.object({ client_id: z.string() }),\n\tmetadata: { openapi: { description: \"Gets publicly available client fields\" } }\n}, async (ctx) => {\n\tconst clientId = ctx.query.client_id;\n\treturn getClientPublicEndpoint(ctx, opts, clientId);\n});\nconst getOAuthClientPublicPrelogin = (opts) => createAuthEndpoint(\"/oauth2/public-client-prelogin\", {\n\tmethod: \"POST\",\n\tuse: [publicSessionMiddleware(opts)],\n\tbody: z.object({\n\t\tclient_id: z.string(),\n\t\toauth_query: z.string().optional()\n\t}),\n\tmetadata: { openapi: { description: \"Gets publicly available client fields (prior to login)\" } }\n}, async (ctx) => {\n\tconst clientId = ctx.body.client_id;\n\treturn getClientPublicEndpoint(ctx, opts, clientId);\n});\nconst getOAuthClients = (opts) => createAuthEndpoint(\"/oauth2/get-clients\", {\n\tmethod: \"GET\",\n\tuse: [sessionMiddleware],\n\tmetadata: { openapi: { description: \"Get OAuth2 formatted client details for a user or organization\" } }\n}, async (ctx) => {\n\treturn getClientsEndpoint(ctx, opts);\n});\nconst adminUpdateOAuthClient = (opts) => createAuthEndpoint(\"/admin/oauth2/update-client\", {\n\tmethod: \"PATCH\",\n\tbody: z.object({\n\t\tclient_id: z.string(),\n\t\tupdate: z.object({\n\t\t\tredirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\t\tscope: z.string().optional(),\n\t\t\tclient_name: z.string().optional(),\n\t\t\tclient_uri: z.string().optional(),\n\t\t\tlogo_uri: z.string().optional(),\n\t\t\tcontacts: z.array(z.string().min(1)).min(1).optional(),\n\t\t\ttos_uri: z.string().optional(),\n\t\t\tpolicy_uri: z.string().optional(),\n\t\t\tsoftware_id: z.string().optional(),\n\t\t\tsoftware_version: z.string().optional(),\n\t\t\tsoftware_statement: z.string().optional(),\n\t\t\tpost_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\t\tbackchannel_logout_uri: SafeUrlSchema.optional(),\n\t\t\tbackchannel_logout_session_required: z.boolean().optional(),\n\t\t\tapplication_type: z.enum([\"web\", \"native\"]).optional(),\n\t\t\tgrant_types: grantTypesSchema.optional(),\n\t\t\tclient_credentials_scopes: z.array(z.string().trim().min(1)).optional(),\n\t\t\tresponse_types: z.array(z.enum([\"code\"])).optional(),\n\t\t\tclient_secret_expires_at: z.union([z.string(), z.number()]).optional(),\n\t\t\tskip_consent: z.boolean().optional(),\n\t\t\tenable_end_session: z.boolean().optional(),\n\t\t\tdisabled: z.boolean().optional(),\n\t\t\tdpop_bound_access_tokens: z.boolean().optional(),\n\t\t\tmetadata: z.record(z.string(), z.unknown()).optional()\n\t\t})\n\t}),\n\tmetadata: {\n\t\tSERVER_ONLY: true,\n\t\topenapi: { description: \"Updates OAuth2 formatted client details.\" }\n\t}\n}, async (ctx) => {\n\treturn updateClientEndpoint(ctx, opts, { admin: true });\n});\nconst updateOAuthClient = (opts) => createAuthEndpoint(\"/oauth2/update-client\", {\n\tmethod: \"POST\",\n\tuse: [sessionMiddleware],\n\tbody: z.object({\n\t\tclient_id: z.string(),\n\t\tupdate: z.object({\n\t\t\tredirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\t\tscope: z.string().optional(),\n\t\t\tclient_name: z.string().optional(),\n\t\t\tclient_uri: z.string().optional(),\n\t\t\tlogo_uri: z.string().optional(),\n\t\t\tcontacts: z.array(z.string().min(1)).min(1).optional(),\n\t\t\ttos_uri: z.string().optional(),\n\t\t\tpolicy_uri: z.string().optional(),\n\t\t\tsoftware_id: z.string().optional(),\n\t\t\tsoftware_version: z.string().optional(),\n\t\t\tsoftware_statement: z.string().optional(),\n\t\t\tpost_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),\n\t\t\tbackchannel_logout_uri: SafeUrlSchema.optional(),\n\t\t\tbackchannel_logout_session_required: z.boolean().optional(),\n\t\t\tapplication_type: z.enum([\"web\", \"native\"]).optional(),\n\t\t\tgrant_types: grantTypesSchema.optional(),\n\t\t\tresponse_types: z.array(z.enum([\"code\"])).optional()\n\t\t})\n\t}),\n\tmetadata: { openapi: { description: \"Updates OAuth2 formatted client details.\" } }\n}, async (ctx) => {\n\treturn updateClientEndpoint(ctx, opts);\n});\nconst rotateClientSecret = (opts) => createAuthEndpoint(\"/oauth2/client/rotate-secret\", {\n\tmethod: \"POST\",\n\tuse: [sessionMiddleware],\n\tbody: z.object({ client_id: z.string() }),\n\tmetadata: {\n\t\tnoStore: true,\n\t\topenapi: { description: \"Rotates a confidential client's secret\" }\n\t}\n}, async (ctx) => {\n\treturn rotateClientSecretEndpoint(ctx, opts);\n});\nconst deleteOAuthClient = (opts) => createAuthEndpoint(\"/oauth2/delete-client\", {\n\tmethod: \"POST\",\n\tuse: [sessionMiddleware],\n\tbody: z.object({ client_id: z.string() }),\n\tmetadata: { openapi: { description: \"Deletes an oauth client\" } }\n}, async (ctx) => {\n\treturn deleteClientEndpoint(ctx, opts);\n});\n//#endregion\n//#region src/oauthConsent/endpoints.ts\nasync function getConsent(ctx, opts, id) {\n\treturn await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthConsent\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: id\n\t\t}]\n\t});\n}\nasync function getConsentEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst { id } = ctx.query;\n\tif (!id) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"missing id parameter\",\n\t\terror: \"not_found\"\n\t});\n\tconst consent = await getConsent(ctx, opts, id);\n\tif (!consent) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"no consent\",\n\t\terror: \"not_found\"\n\t});\n\tif (consent.userId !== session.user.id) throw new APIError(\"UNAUTHORIZED\");\n\treturn consent;\n}\nasync function getConsentsEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\treturn await ctx.context.adapter.findMany({\n\t\tmodel: \"oauthConsent\",\n\t\twhere: [{\n\t\t\tfield: \"userId\",\n\t\t\tvalue: session.user.id\n\t\t}]\n\t});\n}\nasync function deleteConsentEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst { id } = ctx.body;\n\tif (!id) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"missing id parameter\",\n\t\terror: \"not_found\"\n\t});\n\tconst consent = await getConsent(ctx, opts, id);\n\tif (!consent) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"no consent\",\n\t\terror: \"not_found\"\n\t});\n\tif (consent.userId !== session.user.id) throw new APIError(\"UNAUTHORIZED\");\n\tawait ctx.context.adapter.delete({\n\t\tmodel: \"oauthConsent\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: id\n\t\t}]\n\t});\n}\nasync function updateConsentEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session) throw new APIError(\"UNAUTHORIZED\");\n\tconst { id } = ctx.body;\n\tif (!id) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"missing id parameter\",\n\t\terror: \"not_found\"\n\t});\n\tconst consent = await getConsent(ctx, opts, id);\n\tif (!consent) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"no consent\",\n\t\terror: \"not_found\"\n\t});\n\tif (consent.userId !== session.user.id) throw new APIError(\"UNAUTHORIZED\");\n\tconst client = await getClient(ctx, opts, consent.clientId);\n\tif (!client) throw new APIError(\"NOT_FOUND\", {\n\t\terror_description: \"client not found\",\n\t\terror: \"not_found\"\n\t});\n\tconst allowedScopes = client?.scopes ?? opts.scopes ?? [];\n\tconst updates = ctx.body.update;\n\tconst scopes = updates.scopes;\n\tif (scopes && !scopes.every((val) => allowedScopes?.includes(val))) throw new APIError(\"BAD_REQUEST\", {\n\t\terror_description: `unable to provide scopes to ${client?.referenceId ?? client?.userId}`,\n\t\terror: \"invalid_request\"\n\t});\n\tconst iat = Math.floor(Date.now() / 1e3);\n\treturn await ctx.context.adapter.update({\n\t\tmodel: \"oauthConsent\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: id\n\t\t}],\n\t\tupdate: {\n\t\t\t...updates,\n\t\t\tupdatedAt: /* @__PURE__ */ new Date(iat * 1e3)\n\t\t}\n\t});\n}\n//#endregion\n//#region src/oauthConsent/index.ts\nconst getOAuthConsent = (opts) => createAuthEndpoint(\"/oauth2/get-consent\", {\n\tmethod: \"GET\",\n\tquery: z.object({ id: z.string() }),\n\tuse: [sessionMiddleware],\n\tmetadata: { openapi: { description: \"Gets details of a specific OAuth2 consent for a user\" } }\n}, async (ctx) => {\n\treturn getConsentEndpoint(ctx, opts);\n});\nconst getOAuthConsents = (opts) => createAuthEndpoint(\"/oauth2/get-consents\", {\n\tmethod: \"GET\",\n\tuse: [sessionMiddleware],\n\tmetadata: { openapi: { description: \"Gets all available OAuth2 consents for a user\" } }\n}, async (ctx) => {\n\treturn getConsentsEndpoint(ctx, opts);\n});\nconst updateOAuthConsent = (opts) => createAuthEndpoint(\"/oauth2/update-consent\", {\n\tmethod: \"POST\",\n\tuse: [sessionMiddleware],\n\tbody: z.object({\n\t\tid: z.string(),\n\t\tupdate: z.object({ scopes: z.array(z.string()) })\n\t}),\n\tmetadata: { openapi: { description: \"Updates consent granted to a client.\" } }\n}, async (ctx) => {\n\treturn updateConsentEndpoint(ctx, opts);\n});\nconst deleteOAuthConsent = (opts) => createAuthEndpoint(\"/oauth2/delete-consent\", {\n\tmethod: \"POST\",\n\tuse: [sessionMiddleware],\n\tbody: z.object({ id: z.string() }),\n\tmetadata: { openapi: { description: \"Deletes consent granted to a client\" } }\n}, async (ctx) => {\n\treturn deleteConsentEndpoint(ctx, opts);\n});\n//#endregion\n//#region src/oauthResource/endpoints.ts\nconst resourceModel = (opts) => opts.schema?.oauthResource?.modelName ?? \"oauthResource\";\nconst linkModel = (opts) => opts.schema?.oauthClientResource?.modelName ?? \"oauthClientResource\";\nconst clientModel = (opts) => opts.schema?.oauthClient?.modelName ?? \"oauthClient\";\n/**\n* Decode a URL path-segment parameter.\n*\n* better-call's router (better-call@1.3.5) does NOT decode path params —\n* `tryDecode` is wired into cookie parsing only. So a raw HTTP caller hitting\n* `/admin/oauth2/resources/https%3A%2F%2Fapi.example.com` lands here with\n* `ctx.params.identifier === \"https%3A%2F%2Fapi.example.com\"`, which never\n* matches the stored `https://api.example.com` row. Decode every path\n* segment that holds a URI-valued identifier so the admin handlers behave\n* identically to in-process `auth.api.*` calls (which pass already-decoded\n* JS strings).\n*\n* Falls back to the raw string when decode fails so a malformed identifier\n* surfaces as a clean NOT_FOUND from the row lookup rather than a 500.\n*\n* @internal\n*/\nfunction decodePathParam(value) {\n\ttry {\n\t\treturn decodeURIComponent(value);\n\t} catch {\n\t\treturn value;\n\t}\n}\n/**\n* Builds the create-payload from a normalized input. Fills in defaults\n* for the fields seedResources uses so the admin-CRUD and seed paths\n* write identical rows.\n*\n* @internal\n*/\nfunction buildResourceRow(input, now) {\n\treturn {\n\t\tidentifier: input.identifier,\n\t\tname: input.name ?? input.identifier,\n\t\taccessTokenTtl: input.accessTokenTtl ?? null,\n\t\trefreshTokenTtl: input.refreshTokenTtl ?? null,\n\t\tsigningAlgorithm: input.signingAlgorithm ?? null,\n\t\tsigningKeyId: input.signingKeyId ?? null,\n\t\tallowedScopes: input.allowedScopes ?? null,\n\t\tcustomClaims: input.customClaims ?? null,\n\t\tdpopBoundAccessTokensRequired: input.dpopBoundAccessTokensRequired ?? false,\n\t\tdisabled: input.disabled ?? false,\n\t\tpolicyVersion: 1,\n\t\tmetadata: input.metadata ?? null,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now\n\t};\n}\nasync function createResourceEndpoint(ctx, opts) {\n\tawait assertResourcePrivileges(ctx, await getSessionFromCtx(ctx), opts, \"create\");\n\tconst input = ctx.body;\n\tif (!input?.identifier) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_request\",\n\t\terror_description: \"identifier is required\"\n\t});\n\tawait assertIdentifierValid(opts, input.identifier);\n\tconst now = /* @__PURE__ */ new Date();\n\tlet created;\n\ttry {\n\t\tcreated = await ctx.context.adapter.create({\n\t\t\tmodel: resourceModel(opts),\n\t\t\tdata: buildResourceRow(input, now)\n\t\t});\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\tif (/unique|duplicate|UNIQUE/i.test(message)) throw new APIError(\"BAD_REQUEST\", {\n\t\t\terror: \"invalid_request\",\n\t\t\terror_description: `resource ${input.identifier} already exists`\n\t\t});\n\t\tthrow err;\n\t}\n\tif (!created) throw new APIError(\"BAD_REQUEST\", {\n\t\terror: \"invalid_request\",\n\t\terror_description: `resource ${input.identifier} could not be created`\n\t});\n\tinvalidateResourceCache(created.identifier);\n\treturn ctx.json(created, { status: 201 });\n}\nasync function listResourcesEndpoint(ctx, opts) {\n\tawait assertResourcePrivileges(ctx, await getSessionFromCtx(ctx), opts, \"list\");\n\tconst rows = await ctx.context.adapter.findMany({ model: resourceModel(opts) });\n\treturn ctx.json(rows ?? []);\n}\nasync function getResourceByIdentifierEndpoint(ctx, opts) {\n\tconst identifier = decodePathParam(ctx.params.identifier);\n\tawait assertResourcePrivileges(ctx, await getSessionFromCtx(ctx), opts, \"read\", identifier);\n\tconst row = await ctx.context.adapter.findOne({\n\t\tmodel: resourceModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: identifier\n\t\t}]\n\t});\n\tif (!row) throw new APIError(\"NOT_FOUND\", {\n\t\terror: \"not_found\",\n\t\terror_description: `resource ${identifier} not found`\n\t});\n\treturn ctx.json(row);\n}\nasync function updateResourceEndpoint(ctx, opts) {\n\tconst identifier = decodePathParam(ctx.params.identifier);\n\tawait assertResourcePrivileges(ctx, await getSessionFromCtx(ctx), opts, \"update\", identifier);\n\tif (!await ctx.context.adapter.findOne({\n\t\tmodel: resourceModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: identifier\n\t\t}]\n\t})) throw new APIError(\"NOT_FOUND\", {\n\t\terror: \"not_found\",\n\t\terror_description: `resource ${identifier} not found`\n\t});\n\tconst update = { updatedAt: /* @__PURE__ */ new Date() };\n\tfor (const key of [\n\t\t\"name\",\n\t\t\"accessTokenTtl\",\n\t\t\"refreshTokenTtl\",\n\t\t\"signingAlgorithm\",\n\t\t\"signingKeyId\",\n\t\t\"allowedScopes\",\n\t\t\"customClaims\",\n\t\t\"dpopBoundAccessTokensRequired\",\n\t\t\"disabled\",\n\t\t\"metadata\"\n\t]) if (Object.prototype.hasOwnProperty.call(ctx.body, key)) update[key] = ctx.body[key];\n\tawait ctx.context.adapter.update({\n\t\tmodel: resourceModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: identifier\n\t\t}],\n\t\tupdate\n\t});\n\tinvalidateResourceCache(identifier);\n\tconst refreshed = await ctx.context.adapter.findOne({\n\t\tmodel: resourceModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: identifier\n\t\t}]\n\t});\n\tif (!refreshed) throw new APIError(\"NOT_FOUND\", {\n\t\terror: \"not_found\",\n\t\terror_description: `resource ${identifier} not found`\n\t});\n\treturn ctx.json(refreshed);\n}\nasync function deleteResourceEndpoint(ctx, opts) {\n\tconst identifier = decodePathParam(ctx.params.identifier);\n\tawait assertResourcePrivileges(ctx, await getSessionFromCtx(ctx), opts, \"delete\", identifier);\n\tif (!await ctx.context.adapter.findOne({\n\t\tmodel: resourceModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: identifier\n\t\t}]\n\t})) throw new APIError(\"NOT_FOUND\", {\n\t\terror: \"not_found\",\n\t\terror_description: `resource ${identifier} not found`\n\t});\n\tawait ctx.context.adapter.delete({\n\t\tmodel: resourceModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: identifier\n\t\t}]\n\t});\n\tinvalidateResourceCache(identifier);\n\treturn ctx.json({ deleted: true });\n}\n/**\n* Link a client to a resource.\n*\n* Route: `POST /admin/oauth2/resources/:identifier/clients/:client_id`.\n* Path params carry the identifiers (RESTful linkage) — no body required.\n* Used by admins when {@link OAuthOptions.enforcePerClientResources} is on.\n*/\nasync function linkClientResourceEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tconst resourceId = decodePathParam(ctx.params.identifier);\n\tconst clientId = decodePathParam(ctx.params.client_id);\n\tawait assertResourcePrivileges(ctx, session, opts, \"link\", resourceId);\n\tif (!await ctx.context.adapter.findOne({\n\t\tmodel: resourceModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"identifier\",\n\t\t\tvalue: resourceId\n\t\t}]\n\t})) throw new APIError(\"NOT_FOUND\", {\n\t\terror: \"not_found\",\n\t\terror_description: `resource ${resourceId} not found`\n\t});\n\tif (!await ctx.context.adapter.findOne({\n\t\tmodel: clientModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}]\n\t})) throw new APIError(\"NOT_FOUND\", {\n\t\terror: \"not_found\",\n\t\terror_description: `client ${clientId} not found`\n\t});\n\ttry {\n\t\tawait ctx.context.adapter.create({\n\t\t\tmodel: linkModel(opts),\n\t\t\tdata: {\n\t\t\t\tclientId,\n\t\t\t\tresourceId,\n\t\t\t\tcreatedAt: /* @__PURE__ */ new Date()\n\t\t\t}\n\t\t});\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\tif (/unique|duplicate|UNIQUE/i.test(message)) return ctx.json({\n\t\t\tlinked: true,\n\t\t\talreadyLinked: true\n\t\t});\n\t\tthrow err;\n\t}\n\treturn ctx.json({ linked: true });\n}\n/**\n* Unlink a client from a resource.\n*\n* Route: `DELETE /admin/oauth2/resources/:identifier/clients/:client_id`.\n* Path params carry the identifiers (RESTful linkage) — no body required.\n*/\nasync function unlinkClientResourceEndpoint(ctx, opts) {\n\tconst session = await getSessionFromCtx(ctx);\n\tconst resourceId = decodePathParam(ctx.params.identifier);\n\tconst clientId = decodePathParam(ctx.params.client_id);\n\tawait assertResourcePrivileges(ctx, session, opts, \"unlink\", resourceId);\n\tawait ctx.context.adapter.deleteMany({\n\t\tmodel: linkModel(opts),\n\t\twhere: [{\n\t\t\tfield: \"clientId\",\n\t\t\tvalue: clientId\n\t\t}, {\n\t\t\tfield: \"resourceId\",\n\t\t\tvalue: resourceId\n\t\t}]\n\t});\n\treturn ctx.json({ unlinked: true });\n}\n//#endregion\n//#region src/oauthResource/index.ts\n/**\n* Shared body schema for create/update — every field is optional except\n* `identifier` on create (validated in the handler). Update accepts a\n* subset; the handler only writes fields that are explicitly present.\n*/\nconst resourceBodySchema = z.object({\n\tidentifier: z.string().min(1).optional(),\n\tname: z.string().optional(),\n\taccessTokenTtl: z.number().int().positive().nullable().optional(),\n\trefreshTokenTtl: z.number().int().positive().nullable().optional(),\n\tsigningAlgorithm: z.enum(JWS_ALGORITHMS).nullable().optional(),\n\tsigningKeyId: z.string().nullable().optional(),\n\tallowedScopes: z.array(z.string()).nullable().optional(),\n\tcustomClaims: z.record(z.string(), z.unknown()).nullable().optional(),\n\tdpopBoundAccessTokensRequired: z.boolean().optional(),\n\tdisabled: z.boolean().optional(),\n\tmetadata: z.record(z.string(), z.unknown()).nullable().optional()\n});\nconst adminCreateOAuthResource = (opts) => createAuthEndpoint(\"/admin/oauth2/resources\", {\n\tmethod: \"POST\",\n\tbody: resourceBodySchema.required({ identifier: true }),\n\tmetadata: { SERVER_ONLY: true }\n}, async (ctx) => createResourceEndpoint(ctx, opts));\nconst adminListOAuthResources = (opts) => createAuthEndpoint(\"/admin/oauth2/resources\", {\n\tmethod: \"GET\",\n\tmetadata: { SERVER_ONLY: true }\n}, async (ctx) => listResourcesEndpoint(ctx, opts));\nconst adminGetOAuthResource = (opts) => createAuthEndpoint(\"/admin/oauth2/resources/:identifier\", {\n\tmethod: \"GET\",\n\tmetadata: { SERVER_ONLY: true }\n}, async (ctx) => getResourceByIdentifierEndpoint(ctx, opts));\nconst adminUpdateOAuthResource = (opts) => createAuthEndpoint(\"/admin/oauth2/resources/:identifier\", {\n\tmethod: \"PATCH\",\n\tbody: resourceBodySchema,\n\tmetadata: { SERVER_ONLY: true }\n}, async (ctx) => updateResourceEndpoint(ctx, opts));\nconst adminDeleteOAuthResource = (opts) => createAuthEndpoint(\"/admin/oauth2/resources/:identifier\", {\n\tmethod: \"DELETE\",\n\tmetadata: { SERVER_ONLY: true }\n}, async (ctx) => deleteResourceEndpoint(ctx, opts));\nconst adminLinkClientResource = (opts) => createAuthEndpoint(\"/admin/oauth2/resources/:identifier/clients/:client_id\", {\n\tmethod: \"POST\",\n\tmetadata: { SERVER_ONLY: true }\n}, async (ctx) => linkClientResourceEndpoint(ctx, opts));\nconst adminUnlinkClientResource = (opts) => createAuthEndpoint(\"/admin/oauth2/resources/:identifier/clients/:client_id\", {\n\tmethod: \"DELETE\",\n\tmetadata: { SERVER_ONLY: true }\n}, async (ctx) => unlinkClientResourceEndpoint(ctx, opts));\n//#endregion\n//#region src/revoke.ts\n/**\n* IMPORTANT NOTES:\n* Revocation follows RFC7009\n* https://datatracker.ietf.org/doc/html/rfc7009\n* - APIError: Continue catches (returnable to client)\n* - Error: Should immediately stop catches (internal error)\n*/\n/**\n* Revokes a JWT access token against the configured JWKs.\n*\n* A JWT access token is self-contained and never stored, so there is nothing to\n* delete. Once the token is confirmed to be a valid JWT for this server, the\n* endpoint reports `unsupported_token_type` (RFC 7009 §2.2.1) instead of a\n* silent success, so callers can tell that no server-side revocation happened.\n* An expired JWT or a JWT with an audience rejected by the OAuth resource model\n* is already inactive and still resolves as a successful no-op. Session-bound\n* tokens (carrying `sid`) are cut off early by the session-liveness check in\n* introspection and userinfo.\n*/\nasync function revokeJwtAccessToken(ctx, opts, token) {\n\tconst jwtPlugin = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context);\n\tconst jwtPluginOptions = jwtPlugin?.options;\n\ttry {\n\t\tconst verified = await jwtVerify(token, createLocalJWKSet(await getJwks(token, {\n\t\t\tjwksFetch: jwtPluginOptions?.jwks?.remoteUrl ? jwtPluginOptions.jwks.remoteUrl : async () => {\n\t\t\t\treturn (await jwtPlugin?.endpoints.getJwks(ctx))?.response;\n\t\t\t},\n\t\t\tjwksCacheKey: jwtPlugin\n\t\t})), { issuer: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL });\n\t\tconst userInfoAudience = `${ctx.context.baseURL}/oauth2/userinfo`;\n\t\tif (!verified.payload.azp || !await isAudienceClaimAllowed(ctx, opts, verified.payload.aud, [userInfoAudience])) return null;\n\t} catch (error) {\n\t\tif (error instanceof Error) {\n\t\t\tif (error.name === \"TypeError\" || error.name === \"JWSInvalid\") throw new APIError$1(\"BAD_REQUEST\", {\n\t\t\t\terror_description: \"invalid JWT signature\",\n\t\t\t\terror: \"invalid_request\"\n\t\t\t});\n\t\t\telse if (error.name === \"JWTExpired\") return null;\n\t\t\telse if (error.name === \"JWTInvalid\") return null;\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new Error(error);\n\t}\n\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"JWT access tokens are self-contained and cannot be revoked server-side\",\n\t\terror: \"unsupported_token_type\"\n\t});\n}\n/**\n* Searches for an opaque access token in the database and validates it\n*/\nasync function revokeOpaqueAccessToken(ctx, opts, token, clientId) {\n\tlet tokenValue = token;\n\tif (opts.prefix?.opaqueAccessToken) if (tokenValue.startsWith(opts.prefix.opaqueAccessToken)) tokenValue = tokenValue.replace(opts.prefix.opaqueAccessToken, \"\");\n\telse throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"opaque access token not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst accessToken = await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthAccessToken\",\n\t\twhere: [{\n\t\t\tfield: \"token\",\n\t\t\tvalue: await getStoredToken(opts.storeTokens, tokenValue, \"access_token\")\n\t\t}]\n\t});\n\tif (!accessToken) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"opaque access token not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tif (!accessToken.clientId || accessToken.clientId !== clientId) return null;\n\taccessToken.id ? await ctx.context.adapter.delete({\n\t\tmodel: \"oauthAccessToken\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: accessToken.id\n\t\t}]\n\t}) : await ctx.context.adapter.delete({\n\t\tmodel: \"oauthAccessToken\",\n\t\twhere: [{\n\t\t\tfield: \"token\",\n\t\t\tvalue: accessToken.token\n\t\t}]\n\t});\n}\n/**\n* Validates a refresh token in the session store.\n*/\nasync function revokeRefreshToken(ctx, opts, token, clientId) {\n\tconst refreshToken = await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"token\",\n\t\t\tvalue: await getStoredToken(opts.storeTokens, token, \"refresh_token\")\n\t\t}]\n\t});\n\tif (!refreshToken) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"token not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tif (refreshToken.revoked) {\n\t\tawait invalidateRefreshFamily(ctx, clientId, refreshToken.userId);\n\t\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\t\terror_description: \"refresh token revoked\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t}\n\tif (!refreshToken.clientId || refreshToken.clientId !== clientId) return null;\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tif (!await ctx.context.adapter.incrementOne({\n\t\tmodel: \"oauthRefreshToken\",\n\t\twhere: [{\n\t\t\tfield: \"id\",\n\t\t\tvalue: refreshToken.id\n\t\t}, {\n\t\t\tfield: \"revoked\",\n\t\t\toperator: \"eq\",\n\t\t\tvalue: null\n\t\t}],\n\t\tincrement: {},\n\t\tset: { revoked: /* @__PURE__ */ new Date(iat * 1e3) }\n\t})) {\n\t\tawait invalidateRefreshFamily(ctx, clientId, refreshToken.userId);\n\t\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\t\terror_description: \"refresh token revoked\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t}\n\tawait ctx.context.adapter.deleteMany({\n\t\tmodel: \"oauthAccessToken\",\n\t\twhere: [{\n\t\t\tfield: \"refreshId\",\n\t\t\tvalue: refreshToken.id\n\t\t}]\n\t});\n}\n/**\n* We don't know the access token format so we try to validate it\n* as a JWT first, then as an opaque token.\n*/\nasync function revokeAccessToken(ctx, opts, clientId, token) {\n\ttry {\n\t\treturn await revokeJwtAccessToken(ctx, opts, token);\n\t} catch (err) {\n\t\tif (err instanceof APIError$1) {\n\t\t\tif (err.body?.error === \"unsupported_token_type\") throw err;\n\t\t} else if (err instanceof Error) throw err;\n\t\telse throw new Error(err);\n\t}\n\ttry {\n\t\treturn await revokeOpaqueAccessToken(ctx, opts, token, clientId);\n\t} catch (err) {\n\t\tif (err instanceof APIError$1) {} else if (err instanceof Error) throw err;\n\t\telse throw new Error(\"Unknown error validating access token\");\n\t}\n\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"Invalid access token\",\n\t\terror: \"invalid_request\"\n\t});\n}\nasync function revokeEndpoint(ctx, opts) {\n\tlet { token, token_type_hint } = ctx.body;\n\tif (token_type_hint !== \"access_token\" && token_type_hint !== \"refresh_token\") token_type_hint = void 0;\n\tconst { clientId: client_id, clientSecret: client_secret, preVerified, authMethod } = destructureCredentials(await extractClientCredentials(ctx, opts, `${ctx.context.baseURL}/oauth2/revoke`));\n\tif (!client_id) throw new APIError$1(\"UNAUTHORIZED\", {\n\t\terror_description: \"missing required credentials\",\n\t\terror: \"invalid_client\"\n\t});\n\tif (typeof token === \"string\") token = stripAccessTokenAuthorizationScheme(token);\n\tif (!token?.length) throw new APIError$1(\"BAD_REQUEST\", {\n\t\terror_description: \"missing a required token for introspection\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst client = await validateClientCredentials(ctx, opts, client_id, client_secret, void 0, preVerified, void 0, authMethod);\n\ttry {\n\t\tif (token_type_hint === void 0 || token_type_hint === \"access_token\") try {\n\t\t\treturn await revokeAccessToken(ctx, opts, client.clientId, token);\n\t\t} catch (error) {\n\t\t\tif (error instanceof APIError$1) {\n\t\t\t\tif (token_type_hint === \"access_token\" || error.body?.error === \"unsupported_token_type\") throw error;\n\t\t\t} else if (error instanceof Error) throw error;\n\t\t\telse throw new Error(error);\n\t\t}\n\t\tif (token_type_hint === void 0 || token_type_hint === \"refresh_token\") try {\n\t\t\treturn await revokeRefreshToken(ctx, opts, (await decodeRefreshToken(opts, token)).token, client.clientId);\n\t\t} catch (error) {\n\t\t\tif (error instanceof APIError$1) {\n\t\t\t\tif (token_type_hint === \"refresh_token\") throw error;\n\t\t\t} else if (error instanceof Error) throw error;\n\t\t\telse throw new Error(error);\n\t\t}\n\t\tthrow new APIError$1(\"BAD_REQUEST\", {\n\t\t\terror_description: \"token not found\",\n\t\t\terror: \"invalid_request\"\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof APIError$1) {\n\t\t\tif (error.body?.error === \"unsupported_token_type\") throw error;\n\t\t\tif (error.name === \"BAD_REQUEST\") return null;\n\t\t\tthrow error;\n\t\t} else if (error instanceof Error) {\n\t\t\tlogger.error(\"Introspection error:\", error.message, error.stack);\n\t\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\");\n\t\t} else {\n\t\t\tlogger.error(\"Introspection error:\", error);\n\t\t\tthrow new APIError$1(\"INTERNAL_SERVER_ERROR\");\n\t\t}\n\t}\n}\n//#endregion\n//#region src/schema.ts\nconst schema = {\n\toauthClient: {\n\t\tmodelName: \"oauthClient\",\n\t\tfields: {\n\t\t\tclientId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tunique: true,\n\t\t\t\trequired: true\n\t\t\t},\n\t\t\tclientSecret: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tclientDiscoveryId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tdisabled: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdefaultValue: false,\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tskipConsent: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tenableEndSession: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tsubjectType: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tscopes: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tclientCredentialsScopes: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false,\n\t\t\t\tdefaultValue: []\n\t\t\t},\n\t\t\tuserId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"user\",\n\t\t\t\t\tfield: \"id\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\tcreatedAt: {\n\t\t\t\ttype: \"date\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tupdatedAt: {\n\t\t\t\ttype: \"date\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tname: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\turi: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\ticon: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tcontacts: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\ttos: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tpolicy: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tsoftwareId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tsoftwareVersion: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tsoftwareStatement: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tredirectUris: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: true\n\t\t\t},\n\t\t\tpostLogoutRedirectUris: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tbackchannelLogoutUri: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tbackchannelLogoutSessionRequired: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\ttokenEndpointAuthMethod: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tapplicationType: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tjwks: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tjwksUri: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tgrantTypes: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tresponseTypes: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\trequirePKCE: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tdpopBoundAccessTokens: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false,\n\t\t\t\tdefaultValue: false\n\t\t\t},\n\t\t\treferenceId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tmetadata: {\n\t\t\t\ttype: \"json\",\n\t\t\t\trequired: false\n\t\t\t}\n\t\t}\n\t},\n\t/**\n\t* A protected resource the AS issues access tokens for.\n\t*\n\t* Promotes protected resources into a first-class persisted entity with\n\t* per-resource token policy. A null value\n\t* on any policy column means \"inherit the plugin-level default at token\n\t* issuance time\" — admins can later override without re-seeding.\n\t*\n\t* @see RFC 8707 (Resource Indicators) — `identifier` is the `resource` parameter value\n\t* @see RFC 9068 §2.2 — `customClaims` cannot override reserved JWT claims (enforced server-side)\n\t*/\n\toauthResource: {\n\t\tmodelName: \"oauthResource\",\n\t\tfields: {\n\t\t\tidentifier: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\tunique: true\n\t\t\t},\n\t\t\tname: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true\n\t\t\t},\n\t\t\taccessTokenTtl: {\n\t\t\t\ttype: \"number\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\trefreshTokenTtl: {\n\t\t\t\ttype: \"number\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tsigningAlgorithm: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tsigningKeyId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tallowedScopes: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tcustomClaims: {\n\t\t\t\ttype: \"json\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tdpopBoundAccessTokensRequired: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false,\n\t\t\t\tdefaultValue: false\n\t\t\t},\n\t\t\tdisabled: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false,\n\t\t\t\tdefaultValue: false\n\t\t\t},\n\t\t\tcreatedAt: {\n\t\t\t\ttype: \"date\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tupdatedAt: {\n\t\t\t\ttype: \"date\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tpolicyVersion: {\n\t\t\t\ttype: \"number\",\n\t\t\t\trequired: false,\n\t\t\t\tdefaultValue: 1\n\t\t\t},\n\t\t\tmetadata: {\n\t\t\t\ttype: \"json\",\n\t\t\t\trequired: false\n\t\t\t}\n\t\t}\n\t},\n\t/**\n\t* Join table — which clients are allowed to request which resources.\n\t*\n\t* Authoritative only when `enforcePerClientResources: true` on plugin options.\n\t* When the flag is off, clients implicitly have access to all enabled resources\n\t* (preserves pre-entity behavior).\n\t*\n\t* Composite uniqueness on `(clientId, resourceId)` is load-bearing — the\n\t* `enforcePerClientResources` linkage check assumes one row per pair.\n\t*\n\t* Concurrent inserts of the same pair surface as a UNIQUE-constraint\n\t* error which the endpoint catches and converts to a 200 \"alreadyLinked\"\n\t* response (idempotency).\n\t*/\n\toauthClientResource: {\n\t\tmodelName: \"oauthClientResource\",\n\t\tfields: {\n\t\t\tclientId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"oauthClient\",\n\t\t\t\t\tfield: \"clientId\",\n\t\t\t\t\tonDelete: \"cascade\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\tresourceId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"oauthResource\",\n\t\t\t\t\tfield: \"identifier\",\n\t\t\t\t\tonDelete: \"cascade\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\tmetadata: {\n\t\t\t\ttype: \"json\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tcreatedAt: {\n\t\t\t\ttype: \"date\",\n\t\t\t\trequired: false\n\t\t\t}\n\t\t},\n\t\tindexes: [{\n\t\t\tfields: [\"clientId\", \"resourceId\"],\n\t\t\tunique: true\n\t\t}]\n\t},\n\t/**\n\t* An opaque refresh token created with \"offline_access\"\n\t*\n\t* Refresh tokens are linked to a session.\n\t*/\n\toauthRefreshToken: { fields: {\n\t\ttoken: {\n\t\t\ttype: \"string\",\n\t\t\trequired: true,\n\t\t\tunique: true\n\t\t},\n\t\tclientId: {\n\t\t\ttype: \"string\",\n\t\t\trequired: true,\n\t\t\treferences: {\n\t\t\t\tmodel: \"oauthClient\",\n\t\t\t\tfield: \"clientId\"\n\t\t\t},\n\t\t\tindex: true\n\t\t},\n\t\tsessionId: {\n\t\t\ttype: \"string\",\n\t\t\trequired: false,\n\t\t\treferences: {\n\t\t\t\tmodel: \"session\",\n\t\t\t\tfield: \"id\",\n\t\t\t\tonDelete: \"set null\"\n\t\t\t},\n\t\t\tindex: true\n\t\t},\n\t\tuserId: {\n\t\t\ttype: \"string\",\n\t\t\trequired: true,\n\t\t\treferences: {\n\t\t\t\tmodel: \"user\",\n\t\t\t\tfield: \"id\"\n\t\t\t},\n\t\t\tindex: true\n\t\t},\n\t\treferenceId: {\n\t\t\ttype: \"string\",\n\t\t\trequired: false\n\t\t},\n\t\tauthorizationCodeId: {\n\t\t\ttype: \"string\",\n\t\t\trequired: false,\n\t\t\tindex: true\n\t\t},\n\t\tresources: {\n\t\t\ttype: \"string[]\",\n\t\t\trequired: false\n\t\t},\n\t\trequestedUserInfoClaims: {\n\t\t\ttype: \"string[]\",\n\t\t\trequired: false\n\t\t},\n\t\texpiresAt: { type: \"date\" },\n\t\tcreatedAt: { type: \"date\" },\n\t\trevoked: {\n\t\t\ttype: \"date\",\n\t\t\trequired: false\n\t\t},\n\t\trotatedAt: {\n\t\t\ttype: \"date\",\n\t\t\trequired: false\n\t\t},\n\t\trotationReplayResponse: {\n\t\t\ttype: \"string\",\n\t\t\trequired: false\n\t\t},\n\t\trotationReplayExpiresAt: {\n\t\t\ttype: \"date\",\n\t\t\trequired: false\n\t\t},\n\t\tauthTime: {\n\t\t\ttype: \"date\",\n\t\t\trequired: false\n\t\t},\n\t\tconfirmation: {\n\t\t\ttype: \"json\",\n\t\t\trequired: false\n\t\t},\n\t\tscopes: {\n\t\t\ttype: \"string[]\",\n\t\t\trequired: true\n\t\t}\n\t} },\n\t/**\n\t* An opaque access token sent when there is no resource audience claim\n\t* to assigned to the JWT.\n\t*\n\t* Access tokens are linked to a session, better-auth\n\t* authors SHALL always check for valid session!\n\t*\n\t* AccessTokens SHALL only be created at refresh,\n\t* destroyed at revoke, and read at introspection.\n\t* NEVER update an access token! Typically a refresh and\n\t* revoke (if not expired) may want to occur at the same time.\n\t*/\n\toauthAccessToken: {\n\t\tmodelName: \"oauthAccessToken\",\n\t\tfields: {\n\t\t\ttoken: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tunique: true\n\t\t\t},\n\t\t\tclientId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"oauthClient\",\n\t\t\t\t\tfield: \"clientId\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\tsessionId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"session\",\n\t\t\t\t\tfield: \"id\",\n\t\t\t\t\tonDelete: \"set null\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\tuserId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"user\",\n\t\t\t\t\tfield: \"id\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\treferenceId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tauthorizationCodeId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false,\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\tresources: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\trequestedUserInfoClaims: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\trefreshId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"oauthRefreshToken\",\n\t\t\t\t\tfield: \"id\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\texpiresAt: { type: \"date\" },\n\t\t\tcreatedAt: { type: \"date\" },\n\t\t\trevoked: {\n\t\t\t\ttype: \"date\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tconfirmation: {\n\t\t\t\ttype: \"json\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tscopes: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: true\n\t\t\t}\n\t\t}\n\t},\n\toauthConsent: {\n\t\tmodelName: \"oauthConsent\",\n\t\tfields: {\n\t\t\tclientId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"oauthClient\",\n\t\t\t\t\tfield: \"clientId\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\tuserId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"user\",\n\t\t\t\t\tfield: \"id\"\n\t\t\t\t},\n\t\t\t\tindex: true\n\t\t\t},\n\t\t\treferenceId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tresources: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\trequestedUserInfoClaims: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: false\n\t\t\t},\n\t\t\tscopes: {\n\t\t\t\ttype: \"string[]\",\n\t\t\t\trequired: true\n\t\t\t},\n\t\t\tcreatedAt: { type: \"date\" },\n\t\t\tupdatedAt: { type: \"date\" }\n\t\t}\n\t},\n\t/**\n\t* Single-use record for `private_key_jwt` client assertion `jti` values. The\n\t* row id is a digest of the per-client assertion identifier, so a replayed or\n\t* concurrent assertion collides on the primary key and the insert fails\n\t* atomically on every adapter (SQL primary key, MongoDB `_id`), including\n\t* across multiple server processes.\n\t*\n\t* A row keeps blocking its id until deleted; `expiresAt` marks when removal\n\t* is safe, since the assertion it guards has expired and is rejected earlier.\n\t* TODO: no scheduled job prunes expired rows yet; like the verification\n\t* table, they accumulate until a deployment-level sweep removes them.\n\t*/\n\toauthClientAssertion: {\n\t\tmodelName: \"oauthClientAssertion\",\n\t\tfields: { expiresAt: {\n\t\t\ttype: \"date\",\n\t\t\trequired: true\n\t\t} }\n\t}\n};\n//#endregion\n//#region src/oauth.ts\n/**\n* Default scopes advertised and accepted when a configuration sets none. Shared\n* with the MCP preset so the resource metadata it serves matches what the\n* authorization-server metadata advertises.\n*/\nconst DEFAULT_OAUTH_SCOPES = [\n\t\"openid\",\n\t\"profile\",\n\t\"email\",\n\t\"offline_access\"\n];\nconst rpInitiatedLogoutRequestSchema = z.object({\n\tid_token_hint: z.string().optional(),\n\tclient_id: z.string().optional(),\n\tpost_logout_redirect_uri: SafeUrlSchema.optional(),\n\tstate: z.string().optional()\n});\nconst oAuthState = defineRequestState(() => null);\nconst getOAuthProviderState = oAuthState.get;\nconst backchannelLogoutPlansByContext = /* @__PURE__ */ new WeakMap();\nconst signedQueryIssuedAtMsKey = \"signedQueryIssuedAtMs\";\nfunction getServerContextSignedQueryIssuedAt(value) {\n\tconst issuedAtMs = typeof value === \"number\" ? value : typeof value === \"string\" ? Number(value) : void 0;\n\tif (!issuedAtMs || !Number.isFinite(issuedAtMs) || issuedAtMs <= 0) return;\n\treturn new Date(issuedAtMs);\n}\n/**\n* oAuth 2.1 provider plugin for Better Auth.\n*\n* @see https://better-auth.com/docs/plugins/oauth-provider\n* @param options - The options for the oAuth Provider plugin.\n* @returns A Better Auth plugin.\n*/\nconst oauthProvider = (options) => {\n\tlet clientRegistrationAllowedScopes = options.clientRegistrationAllowedScopes;\n\tif (options.clientRegistrationDefaultScopes) {\n\t\tconst _allowedScopes = clientRegistrationAllowedScopes ? new Set([...clientRegistrationAllowedScopes, ...options.clientRegistrationDefaultScopes]) : new Set([...options.clientRegistrationDefaultScopes]);\n\t\tclientRegistrationAllowedScopes = Array.from(_allowedScopes);\n\t}\n\tconst scopes = new Set((options.scopes ?? DEFAULT_OAUTH_SCOPES).filter((val) => val.length));\n\tif (clientRegistrationAllowedScopes) {\n\t\tfor (const sc of clientRegistrationAllowedScopes) if (!scopes.has(sc)) throw new BetterAuthError(`clientRegistrationAllowedScope ${sc} not found in scopes`);\n\t}\n\tfor (const sc of options.advertisedMetadata?.scopes_supported ?? []) if (!scopes?.has(sc)) throw new BetterAuthError(`advertisedMetadata.scopes_supported ${sc} not found in scopes`);\n\tconst configuredResourceIdentifiers = new Set((options.resources ?? []).map((resource) => typeof resource === \"string\" ? resource : resource.identifier));\n\tfor (const [optionName, identifiers] of [[\"clientRegistrationDefaultResources\", options.clientRegistrationDefaultResources], [\"clientRegistrationAllowedResources\", options.clientRegistrationAllowedResources]]) for (const identifier of identifiers ?? []) if (!configuredResourceIdentifiers.has(identifier)) throw new BetterAuthError(`${optionName} resource ${identifier} not found in resources`);\n\tconst claims = new Set([\n\t\t\"sub\",\n\t\t\"iss\",\n\t\t\"aud\",\n\t\t\"exp\",\n\t\t\"iat\",\n\t\t\"sid\",\n\t\t\"scope\",\n\t\t\"azp\",\n\t\t...STANDARD_CLAIM_NAMES.filter((name) => scopes.has(STANDARD_CLAIMS[name].scope))\n\t]);\n\tconst opts = {\n\t\tcodeExpiresIn: 600,\n\t\taccessTokenExpiresIn: 3600,\n\t\tm2mAccessTokenExpiresIn: 3600,\n\t\trefreshTokenExpiresIn: 2592e3,\n\t\trefreshTokenReuseInterval: 0,\n\t\tallowUnauthenticatedClientRegistration: false,\n\t\tallowDynamicClientRegistration: false,\n\t\tdisableJwtPlugin: false,\n\t\tstoreClientSecret: options.disableJwtPlugin ? \"encrypted\" : \"hashed\",\n\t\tstoreTokens: \"hashed\",\n\t\tgrantTypes: [\n\t\t\t\"authorization_code\",\n\t\t\t\"client_credentials\",\n\t\t\t\"refresh_token\"\n\t\t],\n\t\t...options,\n\t\tscopes: Array.from(scopes),\n\t\tclaims: Array.from(claims),\n\t\tclientRegistrationAllowedScopes\n\t};\n\tvalidateOAuthProviderExtensions(opts.extensions);\n\tif (opts.pairwiseSecret && opts.pairwiseSecret.length < 32) throw new BetterAuthError(\"pairwiseSecret must be at least 32 characters long for adequate HMAC-SHA256 security\");\n\tif (opts.grantTypes && opts.grantTypes.includes(\"refresh_token\") && !opts.grantTypes.includes(\"authorization_code\")) throw new BetterAuthError(\"refresh_token grant requires authorization_code grant\");\n\tif (opts.disableJwtPlugin && (opts.storeClientSecret === \"hashed\" || typeof opts.storeClientSecret === \"object\" && \"hash\" in opts.storeClientSecret)) throw new BetterAuthError(\"unable to store hashed secrets because id tokens will be signed with secret\");\n\tif (!opts.disableJwtPlugin && (opts.storeClientSecret === \"encrypted\" || typeof opts.storeClientSecret === \"object\" && (\"encrypt\" in opts.storeClientSecret || \"decrypt\" in opts.storeClientSecret))) throw new BetterAuthError(\"encryption method not recommended, please use 'hashed' or the 'hash' function\");\n\tconst handleIssuerMetadataRequest = async (request, ctx) => {\n\t\tconst requestPathname = new URL(request.url).pathname;\n\t\tconst requestPath = ctx.options.advanced?.skipTrailingSlashes ? requestPathname.replace(/\\/+$/, \"\") || \"/\" : requestPathname;\n\t\tconst issuer = opts.disableJwtPlugin ? ctx.baseURL : getJwtPlugin(ctx)?.options?.jwt?.issuer ?? ctx.baseURL;\n\t\tlet issuerPath = \"/\";\n\t\ttry {\n\t\t\tissuerPath = new URL(issuer).pathname.replace(/\\/$/, \"\") || \"\";\n\t\t} catch {\n\t\t\tissuerPath = new URL(ctx.baseURL).pathname.replace(/\\/$/, \"\") || \"\";\n\t\t}\n\t\tconst endpointCtx = { context: ctx };\n\t\tconst authServerMetadataPaths = new Set([`/.well-known/oauth-authorization-server${issuerPath}`, `${issuerPath}/.well-known/oauth-authorization-server`]);\n\t\tconst openIdConfigPath = `${issuerPath}/.well-known/openid-configuration`;\n\t\tconst isAuthServerMetadataRequest = authServerMetadataPaths.has(requestPath);\n\t\tconst isOpenIdConfigRequest = opts.scopes?.includes(\"openid\") && requestPath === openIdConfigPath;\n\t\tconst createMetadataResponse = (metadata) => {\n\t\t\tconst response = metadataResponse(metadata);\n\t\t\tif (request.method === \"HEAD\") return new Response(null, {\n\t\t\t\tstatus: response.status,\n\t\t\t\theaders: response.headers\n\t\t\t});\n\t\t\treturn response;\n\t\t};\n\t\tif (isAuthServerMetadataRequest || isOpenIdConfigRequest) {\n\t\t\tif (request.method !== \"GET\" && request.method !== \"HEAD\") return { response: new Response(null, {\n\t\t\t\tstatus: 405,\n\t\t\t\theaders: { Allow: \"GET, HEAD\" }\n\t\t\t}) };\n\t\t}\n\t\tif (isAuthServerMetadataRequest) {\n\t\t\tif (opts.scopes?.includes(\"openid\")) return { response: createMetadataResponse(oidcServerMetadata(endpointCtx, opts)) };\n\t\t\treturn { response: createMetadataResponse(oauthAuthorizationServerMetadata(endpointCtx, opts)) };\n\t\t}\n\t\tif (isOpenIdConfigRequest) return { response: createMetadataResponse(oidcServerMetadata(endpointCtx, opts)) };\n\t};\n\tconst oauth2AuthorizeEndpoint = createOAuthEndpoint(\"/oauth2/authorize\", {\n\t\tmethod: [\"GET\", \"POST\"],\n\t\tbody: z.object({}).passthrough(),\n\t\tredirectOnError: authorizeRedirectOnError(opts),\n\t\tmetadata: {\n\t\t\tallowedMediaTypes: [\"application/x-www-form-urlencoded\"],\n\t\t\topenapi: {\n\t\t\t\tdescription: \"Authorize an OAuth 2.1 request from query parameters or an application/x-www-form-urlencoded POST body\",\n\t\t\t\tparameters: [\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"response_type\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"OAuth 2.1 response type (e.g., 'code')\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"client_id\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"OAuth 2.1 client ID\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"redirect_uri\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tdescription: \"OAuth 2.1 redirect URI\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"scope\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"OAuth 2.1 scopes (space-separated)\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"state\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"OAuth 2.1 state parameter\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"request_uri\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"Pushed Authorization Request URI referencing stored parameters\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"code_challenge\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"PKCE code challenge\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"code_challenge_method\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"PKCE code challenge method\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"nonce\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"OpenID Connect nonce\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"max_age\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\ttype: \"integer\",\n\t\t\t\t\t\t\tminimum: 0\n\t\t\t\t\t\t},\n\t\t\t\t\t\tdescription: \"Maximum authentication age in seconds; forces re-authentication when exceeded\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"resource\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\titems: { type: \"string\" }\n\t\t\t\t\t\t},\n\t\t\t\t\t\tdescription: \"Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tname: \"prompt\",\n\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\tdescription: \"OAuth2 prompt parameter\"\n\t\t\t\t\t}\n\t\t\t\t],\n\t\t\t\tresponses: {\n\t\t\t\t\t\"302\": {\n\t\t\t\t\t\tdescription: \"Redirect to client with code or error\",\n\t\t\t\t\t\theaders: { Location: {\n\t\t\t\t\t\t\tdescription: \"Redirect URI with code or error\",\n\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} }\n\t\t\t\t\t},\n\t\t\t\t\t\"400\": {\n\t\t\t\t\t\tdescription: \"Invalid request\",\n\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\terror: { type: \"string\" },\n\t\t\t\t\t\t\t\terror_description: { type: \"string\" },\n\t\t\t\t\t\t\t\tstate: { type: \"string\" }\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\trequired: [\"error\"]\n\t\t\t\t\t\t} } }\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}, async (ctx) => {\n\t\treturn authorizeEndpoint(ctx, opts, ctx.authorizeSettings ?? { isAuthorize: true });\n\t});\n\tconst runOAuth2Authorize = (ctx, settings) => dispatchAuthEndpoint(oauth2AuthorizeEndpoint, {\n\t\t...ctx,\n\t\tasResponse: false,\n\t\treturnHeaders: false,\n\t\treturnStatus: false,\n\t\tauthorizeSettings: settings ?? {}\n\t});\n\treturn {\n\t\tid: \"oauth-provider\",\n\t\tversion: PACKAGE_VERSION,\n\t\toptions: opts,\n\t\tonRequest: handleIssuerMetadataRequest,\n\t\tinit: async (ctx) => {\n\t\t\tif (ctx.options.secondaryStorage && ctx.options.session?.storeSessionInDatabase !== true) throw new BetterAuthError(\"OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage\");\n\t\t\tawait seedResourcesOnce(ctx, opts).catch((error) => logStartupSeedFailure(ctx, error));\n\t\t\tlogEnforcePerClientResourcesResolution(opts);\n\t\t\tif (!opts.disableJwtPlugin) {\n\t\t\t\tconst jwtPluginOptions = getJwtPlugin(ctx)?.options;\n\t\t\t\tconst issuer = jwtPluginOptions?.jwt?.issuer ?? ctx.baseURL;\n\t\t\t\tconst isDynamicBaseURLInit = jwtPluginOptions?.jwt?.issuer == null && typeof ctx.options.baseURL === \"object\" && ctx.options.baseURL !== null && \"allowedHosts\" in ctx.options.baseURL;\n\t\t\t\ttry {\n\t\t\t\t\tnew URL(issuer);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (!isDynamicBaseURLInit || issuer !== \"\") throw error;\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { options: { databaseHooks: { session: { delete: {\n\t\t\t\tasync before(session, hookCtx) {\n\t\t\t\t\tif (!hookCtx) return;\n\t\t\t\t\tconst plan = await prepareBackchannelLogoutPlan(hookCtx, opts, {\n\t\t\t\t\t\tsessionId: session.id,\n\t\t\t\t\t\tuserId: session.userId\n\t\t\t\t\t});\n\t\t\t\t\tif (!plan) return;\n\t\t\t\t\tconst logoutPlanBySessionId = backchannelLogoutPlansByContext.get(hookCtx) ?? /* @__PURE__ */ new Map();\n\t\t\t\t\tlogoutPlanBySessionId.set(session.id, plan);\n\t\t\t\t\tbackchannelLogoutPlansByContext.set(hookCtx, logoutPlanBySessionId);\n\t\t\t\t},\n\t\t\t\tasync after(session, hookCtx) {\n\t\t\t\t\tif (!hookCtx) return;\n\t\t\t\t\tconst logoutPlanBySessionId = backchannelLogoutPlansByContext.get(hookCtx);\n\t\t\t\t\tif (!logoutPlanBySessionId) return;\n\t\t\t\t\tconst plan = logoutPlanBySessionId.get(session.id);\n\t\t\t\t\tlogoutPlanBySessionId.delete(session.id);\n\t\t\t\t\tif (logoutPlanBySessionId.size === 0) backchannelLogoutPlansByContext.delete(hookCtx);\n\t\t\t\t\tif (!plan) return;\n\t\t\t\t\tconst logoutTask = applyBackchannelLogoutPlan(hookCtx, plan).catch((error) => {\n\t\t\t\t\t\thookCtx.context.logger.error(\"Back-channel logout failed after session deletion\", error);\n\t\t\t\t\t});\n\t\t\t\t\tawait hookCtx.context.runInBackgroundOrAwait(logoutTask);\n\t\t\t\t}\n\t\t\t} } } } };\n\t\t},\n\t\thooks: {\n\t\t\tbefore: [{\n\t\t\t\tmatcher(ctx) {\n\t\t\t\t\treturn ctx.body?.oauth_query;\n\t\t\t\t},\n\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\tconst query = ctx.body.oauth_query;\n\t\t\t\t\tif (!await verifyOAuthQueryParams(query, ctx.context.secret)) throw new APIError(\"BAD_REQUEST\", { error: \"invalid_signature\" });\n\t\t\t\t\tconst signedQueryIssuedAt = getSignedQueryIssuedAt(query);\n\t\t\t\t\tconst queryParams = new URLSearchParams(query);\n\t\t\t\t\tconst postLoginClearedForSession = queryParams.get(\"ba_pl\") ?? void 0;\n\t\t\t\t\tqueryParams.delete(\"sig\");\n\t\t\t\t\tqueryParams.delete(\"exp\");\n\t\t\t\t\tqueryParams.delete(signedQueryIssuedAtParam);\n\t\t\t\t\tqueryParams.delete(postLoginClearedParam);\n\t\t\t\t\tawait oAuthState.set({\n\t\t\t\t\t\tquery: queryParams.toString(),\n\t\t\t\t\t\tsignedQueryIssuedAt: signedQueryIssuedAt ?? void 0,\n\t\t\t\t\t\tpostLoginClearedForSession\n\t\t\t\t\t});\n\t\t\t\t\tif (ctx.path === \"/sign-in/social\") await addOAuthServerContext({\n\t\t\t\t\t\tquery: queryParams.toString(),\n\t\t\t\t\t\t...signedQueryIssuedAt ? { [signedQueryIssuedAtMsKey]: signedQueryIssuedAt.getTime() } : {}\n\t\t\t\t\t});\n\t\t\t\t})\n\t\t\t}],\n\t\t\tafter: [{\n\t\t\t\tmatcher(ctx) {\n\t\t\t\t\treturn parseSetCookieHeader(ctx.context.responseHeaders?.get(\"set-cookie\") || \"\").has(ctx.context.authCookies.sessionToken.name);\n\t\t\t\t},\n\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\tconst sessionToken = parseSetCookieHeader(ctx.context.responseHeaders?.get(\"set-cookie\") || \"\").get(ctx.context.authCookies.sessionToken.name)?.value.split(\".\")[0];\n\t\t\t\t\tif (!sessionToken) return;\n\t\t\t\t\tconst oauthRequest = await oAuthState.get();\n\t\t\t\t\tconst serverContext = (await getOAuthState())?.serverContext;\n\t\t\t\t\tconst _query = oauthRequest?.query ?? serverContext?.query;\n\t\t\t\t\tif (!_query) return;\n\t\t\t\t\tconst query = new URLSearchParams(_query);\n\t\t\t\t\tconst session = await ctx.context.internalAdapter.findSession(sessionToken);\n\t\t\t\t\tif (!session) return;\n\t\t\t\t\tctx.context.session = session;\n\t\t\t\t\tconst secFetchMode = ctx.request?.headers?.get(\"sec-fetch-mode\")?.toLowerCase();\n\t\t\t\t\tconst acceptHeader = ctx.request?.headers?.get(\"accept\")?.toLowerCase() ?? \"\";\n\t\t\t\t\tif (!(secFetchMode === \"navigate\" || !secFetchMode && (acceptHeader.includes(\"text/html\") || acceptHeader.includes(\"application/xhtml+xml\")))) ctx.headers?.set(\"accept\", \"application/json\");\n\t\t\t\t\tconst signedQueryIssuedAt = oauthRequest?.signedQueryIssuedAt ?? getServerContextSignedQueryIssuedAt(serverContext?.[signedQueryIssuedAtMsKey]);\n\t\t\t\t\tlet authorizationQuery = removePromptFromQuery(query, \"login\");\n\t\t\t\t\tif (isSessionFreshForSignedQuery(session.session.createdAt, signedQueryIssuedAt)) authorizationQuery = removeMaxAgeFromQuery(authorizationQuery);\n\t\t\t\t\tctx.query = searchParamsToQuery(authorizationQuery);\n\t\t\t\t\treturn await runOAuth2Authorize(ctx);\n\t\t\t\t})\n\t\t\t}]\n\t\t},\n\t\tendpoints: {\n\t\t\t/**\n\t\t\t* A server-only endpoint that helps provide the\n\t\t\t* oAuth Server configuration at the well-known endpoint.\n\t\t\t*\n\t\t\t* Provided at /.well-known/oauth-authorization-server/[issuer-path]\n\t\t\t* (root if no issuer-path).\n\t\t\t*/\n\t\t\tgetOAuthServerConfig: createAuthEndpoint(\"/.well-known/oauth-authorization-server\", {\n\t\t\t\tmethod: \"GET\",\n\t\t\t\tmetadata: { SERVER_ONLY: true }\n\t\t\t}, async (ctx) => {\n\t\t\t\tif (opts.scopes && opts.scopes.includes(\"openid\")) return oidcServerMetadata(ctx, opts);\n\t\t\t\telse return oauthAuthorizationServerMetadata(ctx, opts);\n\t\t\t}),\n\t\t\t/**\n\t\t\t* A server-only endpoint that helps provide the\n\t\t\t* OpenId configuration at the well-known endpoint.\n\t\t\t*\n\t\t\t* Provided at [issuer-path]/.well-known/openid-configuration\n\t\t\t* (root if no issuer-path).\n\t\t\t*/\n\t\t\tgetOpenIdConfig: createAuthEndpoint(\"/.well-known/openid-configuration\", {\n\t\t\t\tmethod: \"GET\",\n\t\t\t\tmetadata: { SERVER_ONLY: true }\n\t\t\t}, async (ctx) => {\n\t\t\t\tif (opts.scopes && !opts.scopes.includes(\"openid\")) throw new APIError(\"NOT_FOUND\");\n\t\t\t\treturn oidcServerMetadata(ctx, opts);\n\t\t\t}),\n\t\t\toauth2Authorize: oauth2AuthorizeEndpoint,\n\t\t\toauth2Consent: createAuthEndpoint(\"/oauth2/consent\", {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tbody: z.object({\n\t\t\t\t\taccept: z.boolean().meta({ description: \"Accept or deny user consent for a set of scopes\" }),\n\t\t\t\t\tscope: z.string().optional().meta({ description: \"List of accept of accepted space-separated scopes. If none is provided, then all originally requested scopes are accepted.\" }),\n\t\t\t\t\tclaims: claimsRequestParameterSchema.optional().meta({ description: \"Accepted OIDC claims request object. If none is provided, then all originally requested claims are accepted.\" }),\n\t\t\t\t\toauth_query: z.string().optional().meta({ description: \"The redirected page's query parameters\" })\n\t\t\t\t}),\n\t\t\t\tuse: [sessionMiddleware],\n\t\t\t\tmetadata: { openapi: {\n\t\t\t\t\tdescription: \"Handle OAuth2 consent\",\n\t\t\t\t\tresponses: { \"200\": {\n\t\t\t\t\t\tdescription: \"Consent processed successfully\",\n\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\tproperties: { redirect_uri: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\tdescription: \"The URI to redirect to, either with an authorization code or an error\"\n\t\t\t\t\t\t\t} },\n\t\t\t\t\t\t\trequired: [\"redirect_uri\"]\n\t\t\t\t\t\t} } }\n\t\t\t\t\t} }\n\t\t\t\t} }\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn consentEndpoint(ctx, opts, runOAuth2Authorize);\n\t\t\t}),\n\t\t\toauth2Continue: createAuthEndpoint(\"/oauth2/continue\", {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tbody: z.object({\n\t\t\t\t\tselected: z.boolean().optional().meta({ description: \"Confirms an account has been selected and authorization can proceed.\" }),\n\t\t\t\t\tcreated: z.boolean().optional().meta({ description: \"Confirms an account was registered\" }),\n\t\t\t\t\tpostLogin: z.boolean().optional().meta({ description: \"Confirms organization and/or team selection.\" }),\n\t\t\t\t\toauth_query: z.string().optional().meta({ description: \"The redirected page's query parameters\" })\n\t\t\t\t}),\n\t\t\t\tuse: [sessionMiddleware],\n\t\t\t\tmetadata: { openapi: {\n\t\t\t\t\tdescription: \"Continues OAuth2 authorization flow\",\n\t\t\t\t\tresponses: { \"200\": {\n\t\t\t\t\t\tdescription: \"Consent processed successfully\",\n\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\tproperties: { redirect_uri: {\n\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\tdescription: \"The URI to redirect to, either with an authorization code or an error\"\n\t\t\t\t\t\t\t} },\n\t\t\t\t\t\t\trequired: [\"redirect_uri\"]\n\t\t\t\t\t\t} } }\n\t\t\t\t\t} }\n\t\t\t\t} }\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn continueEndpoint(ctx, runOAuth2Authorize);\n\t\t\t}),\n\t\t\toauth2Token: createOAuthEndpoint(\"/oauth2/token\", {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tcloneRequest: true,\n\t\t\t\tbody: z.object({\n\t\t\t\t\tgrant_type: z.string().trim().min(1),\n\t\t\t\t\tclient_id: z.string().optional(),\n\t\t\t\t\tclient_secret: z.string().optional(),\n\t\t\t\t\tclient_assertion: z.string().optional(),\n\t\t\t\t\tclient_assertion_type: z.string().optional(),\n\t\t\t\t\tcode: z.string().optional(),\n\t\t\t\t\tcode_verifier: z.string().optional(),\n\t\t\t\t\tredirect_uri: SafeUrlSchema.optional(),\n\t\t\t\t\trefresh_token: z.string().optional(),\n\t\t\t\t\tresource: z.union([ResourceUriSchema, z.array(ResourceUriSchema).min(1)]).optional(),\n\t\t\t\t\tscope: z.string().optional()\n\t\t\t\t}).passthrough(),\n\t\t\t\terrorCodesByField: {\n\t\t\t\t\tgrant_type: {\n\t\t\t\t\t\tmissing: \"invalid_request\",\n\t\t\t\t\t\tinvalid: \"unsupported_grant_type\"\n\t\t\t\t\t},\n\t\t\t\t\tresource: { invalid: \"invalid_target\" }\n\t\t\t\t},\n\t\t\t\tmetadata: {\n\t\t\t\t\tnoStore: true,\n\t\t\t\t\tallowedMediaTypes: [\"application/x-www-form-urlencoded\"],\n\t\t\t\t\topenapi: {\n\t\t\t\t\t\tdescription: \"Obtain an OAuth2.1 access token\",\n\t\t\t\t\t\tparameters: [{\n\t\t\t\t\t\t\tname: \"DPoP\",\n\t\t\t\t\t\t\tin: \"header\",\n\t\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens\"\n\t\t\t\t\t\t}],\n\t\t\t\t\t\trequestBody: {\n\t\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\tgrant_type: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OAuth2 grant type\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_id: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OAuth2 client ID\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_secret: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OAuth2 client secret\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tcode: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Authorization code (for authorization_code grant)\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tcode_verifier: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"PKCE code verifier (for authorization_code grant)\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tredirect_uri: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Redirect URI (for authorization_code grant)\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trefresh_token: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Refresh token (for refresh_token grant)\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tresource: {\n\t\t\t\t\t\t\t\t\t\toneOf: [{\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Single resource (URL)\"\n\t\t\t\t\t\t\t\t\t\t}, {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Multiple resources (URLs)\"\n\t\t\t\t\t\t\t\t\t\t}],\n\t\t\t\t\t\t\t\t\t\tdescription: \"Requested protected resource(s) for the access token\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tscope: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Requested scopes (for client_credentials grant)\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\trequired: [\"grant_type\"]\n\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t},\n\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\tdescription: \"Access token response\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\taccess_token: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"The access token issued by the authorization server\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\ttoken_type: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"The type of the token issued\",\n\t\t\t\t\t\t\t\t\t\t\tenum: [\"Bearer\", \"DPoP\"]\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\texpires_in: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Lifetime in seconds of the access token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\trefresh_token: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Refresh token, if issued\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tscope: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Scopes granted by the access token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tid_token: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"ID Token (if OpenID Connect)\"\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\n\t\t\t\t\t\t\t\t\t\t\"access_token\",\n\t\t\t\t\t\t\t\t\t\t\"token_type\",\n\t\t\t\t\t\t\t\t\t\t\"expires_in\"\n\t\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"400\": {\n\t\t\t\t\t\t\t\tdescription: \"Invalid request or error response\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\terror: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_description: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_uri: { type: \"string\" }\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\"error\"]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}, async (ctx) => {\n\t\t\t\tif (ctx.request) {\n\t\t\t\t\tconst repeated = await extractRepeatedResourceFromForm(ctx.request);\n\t\t\t\t\tif (repeated && repeated.length > 1) ctx.body.resource = repeated;\n\t\t\t\t}\n\t\t\t\treturn tokenEndpoint(ctx, opts);\n\t\t\t}),\n\t\t\toauth2Introspect: createOAuthEndpoint(\"/oauth2/introspect\", {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tcloneRequest: true,\n\t\t\t\tbody: z.object({\n\t\t\t\t\tclient_id: z.string().optional(),\n\t\t\t\t\tclient_secret: z.string().optional(),\n\t\t\t\t\tclient_assertion: z.string().optional(),\n\t\t\t\t\tclient_assertion_type: z.string().optional(),\n\t\t\t\t\ttoken: z.string(),\n\t\t\t\t\ttoken_type_hint: z.string().optional()\n\t\t\t\t}),\n\t\t\t\tmetadata: {\n\t\t\t\t\tnoStore: true,\n\t\t\t\t\tallowedMediaTypes: [\"application/x-www-form-urlencoded\"],\n\t\t\t\t\topenapi: {\n\t\t\t\t\t\tdescription: \"Introspect an OAuth2 access or refresh token\",\n\t\t\t\t\t\trequestBody: {\n\t\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\tclient_id: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OAuth2 client ID\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_secret: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OAuth2 client secret\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\ttoken: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"The token to introspect (access or refresh token)\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\ttoken_type_hint: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Hint about the token type. Recognized values: `access_token`, `refresh_token`.\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\trequired: [\"token\"]\n\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t},\n\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\tdescription: \"Token introspection response\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\tactive: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Whether the token is active\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tscope: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Scopes associated with the token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tclient_id: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Client ID associated with the token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tusername: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Username associated with the token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\ttoken_type: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Type of the token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\texp: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Expiration time of the token (seconds since epoch)\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tiat: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Issued at time (seconds since epoch)\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tnbf: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Not before time (seconds since epoch)\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tsub: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Subject of the token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\taud: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Audience of the token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tiss: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Issuer of the token\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tjti: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"JWT ID\"\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\"active\"]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"400\": {\n\t\t\t\t\t\t\t\tdescription: \"Invalid request or error response\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\terror: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_description: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_uri: { type: \"string\" }\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\"error\"]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn introspectEndpoint(ctx, opts);\n\t\t\t}),\n\t\t\toauth2Revoke: createOAuthEndpoint(\"/oauth2/revoke\", {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tcloneRequest: true,\n\t\t\t\tbody: z.object({\n\t\t\t\t\tclient_id: z.string().optional(),\n\t\t\t\t\tclient_secret: z.string().optional(),\n\t\t\t\t\tclient_assertion: z.string().optional(),\n\t\t\t\t\tclient_assertion_type: z.string().optional(),\n\t\t\t\t\ttoken: z.string(),\n\t\t\t\t\ttoken_type_hint: z.string().optional()\n\t\t\t\t}),\n\t\t\t\tmetadata: {\n\t\t\t\t\tallowedMediaTypes: [\"application/x-www-form-urlencoded\"],\n\t\t\t\t\topenapi: {\n\t\t\t\t\t\tdescription: \"Revoke an OAuth2 access or refresh token\",\n\t\t\t\t\t\trequestBody: {\n\t\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\tclient_id: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OAuth2 client ID\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_secret: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OAuth2 client secret\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\ttoken: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"The token to revoke (access or refresh token)\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\ttoken_type_hint: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Hint about the token type. Recognized values: `access_token`, `refresh_token`.\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\trequired: [\"token\"]\n\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t},\n\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\tdescription: \"Token revoked successfully. The response body is empty.\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tdescription: \"Empty object on success\"\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"400\": {\n\t\t\t\t\t\t\t\tdescription: \"Invalid request or error response\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\terror: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_description: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_uri: { type: \"string\" }\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\"error\"]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn revokeEndpoint(ctx, opts);\n\t\t\t}),\n\t\t\toauth2UserInfo: createAuthEndpoint(\"/oauth2/userinfo\", {\n\t\t\t\tmethod: [\"GET\", \"POST\"],\n\t\t\t\tbody: z.object({ access_token: z.string().optional() }).passthrough().optional(),\n\t\t\t\tmetadata: {\n\t\t\t\t\tnoStore: true,\n\t\t\t\t\tallowedMediaTypes: [\"application/x-www-form-urlencoded\"],\n\t\t\t\t\topenapi: {\n\t\t\t\t\t\tdescription: \"Get OpenID Connect user information (UserInfo endpoint)\",\n\t\t\t\t\t\tsecurity: [{ bearerAuth: [] }, { OAuth2: [\n\t\t\t\t\t\t\t\"openid\",\n\t\t\t\t\t\t\t\"profile\",\n\t\t\t\t\t\t\t\"email\"\n\t\t\t\t\t\t] }],\n\t\t\t\t\t\tparameters: [{\n\t\t\t\t\t\t\tname: \"Authorization\",\n\t\t\t\t\t\t\tin: \"header\",\n\t\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"Bearer or DPoP access token\"\n\t\t\t\t\t\t}, {\n\t\t\t\t\t\t\tname: \"DPoP\",\n\t\t\t\t\t\t\tin: \"header\",\n\t\t\t\t\t\t\trequired: false,\n\t\t\t\t\t\t\tschema: { type: \"string\" },\n\t\t\t\t\t\t\tdescription: \"RFC 9449 DPoP proof JWT when using a DPoP-bound access token\"\n\t\t\t\t\t\t}],\n\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\tdescription: \"User information retrieved successfully\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\tsub: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Subject identifier (user ID)\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\temail: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tformat: \"email\",\n\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's email address, included if 'email' scope is granted\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tname: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's full name, included if 'profile' scope is granted\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tpicture: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's profile picture URL, included if 'profile' scope is granted\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tgiven_name: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's given name, included if 'profile' scope is granted\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tfamily_name: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's family name, included if 'profile' scope is granted\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\temail_verified: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Whether the email is verified, included if 'email' scope is granted\"\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\"sub\"]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"401\": {\n\t\t\t\t\t\t\t\tdescription: \"Unauthorized - invalid or missing access token\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\terror: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_description: { type: \"string\" }\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\"error\"]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"403\": {\n\t\t\t\t\t\t\t\tdescription: \"Forbidden - insufficient scope\",\n\t\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\terror: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\terror_description: { type: \"string\" }\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\trequired: [\"error\"]\n\t\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn userInfoEndpoint(ctx, opts);\n\t\t\t}),\n\t\t\toauth2EndSession: createOAuthEndpoint(\"/oauth2/end-session\", {\n\t\t\t\tmethod: [\"GET\", \"POST\"],\n\t\t\t\tbody: rpInitiatedLogoutRequestSchema.optional(),\n\t\t\t\tquery: rpInitiatedLogoutRequestSchema.optional(),\n\t\t\t\tmetadata: {\n\t\t\t\t\tnoStore: true,\n\t\t\t\t\tallowedMediaTypes: [\"application/x-www-form-urlencoded\", \"application/json\"],\n\t\t\t\t\t$Infer: {\n\t\t\t\t\t\tbody: {},\n\t\t\t\t\t\tquery: {}\n\t\t\t\t\t},\n\t\t\t\t\topenapi: {\n\t\t\t\t\t\tdescription: \"RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.\",\n\t\t\t\t\t\tresponses: { \"200\": {\n\t\t\t\t\t\t\tdescription: \"Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.\",\n\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\"application/json\": { schema: {\n\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\tredirect_uri: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"URI to redirect to after logout (if post_logout_redirect_uri was provided)\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tmessage: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"Success message\"\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t} },\n\t\t\t\t\t\t\t\t\"text/html\": { schema: { type: \"string\" } }\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} }\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn rpInitiatedLogoutEndpoint(ctx, opts);\n\t\t\t}),\n\t\t\toauth2EndSessionConfirmation: createOAuthEndpoint(\"/oauth2/end-session/confirm\", {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tbody: z.object({ action: z.literal(\"confirm\") }),\n\t\t\t\tmetadata: {\n\t\t\t\t\tnoStore: true,\n\t\t\t\t\tallowedMediaTypes: [\"application/x-www-form-urlencoded\"],\n\t\t\t\t\tscope: \"http\"\n\t\t\t\t}\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn rpInitiatedLogoutConfirmationEndpoint(ctx, opts);\n\t\t\t}),\n\t\t\tregisterOAuthClient: createOAuthEndpoint(\"/oauth2/register\", {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tbody: clientRegistrationRequestSchema,\n\t\t\t\terrorCodesByField: {\n\t\t\t\t\tredirect_uris: \"invalid_redirect_uri\",\n\t\t\t\t\tpost_logout_redirect_uris: \"invalid_redirect_uri\",\n\t\t\t\t\tsoftware_statement: \"invalid_software_statement\",\n\t\t\t\t\tresources: \"invalid_target\"\n\t\t\t\t},\n\t\t\t\tdefaultError: \"invalid_client_metadata\",\n\t\t\t\tmetadata: {\n\t\t\t\t\tnoStore: true,\n\t\t\t\t\topenapi: {\n\t\t\t\t\t\tdescription: \"Register an OAuth2 application\",\n\t\t\t\t\t\tresponses: { \"201\": {\n\t\t\t\t\t\t\tdescription: \"OAuth2 application registered successfully\",\n\t\t\t\t\t\t\tcontent: { \"application/json\": { schema: {\n\t\t\t\t\t\t\t\t/** @returns {OauthClient} */\n\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\tclient_id: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Unique identifier for the client\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_secret: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Secret key for the client\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_secret_expires_at: {\n\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Time the client secret will expire. If 0, the client secret will never expire.\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tscope: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Space-separated scopes allowed by the client\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tuser_id: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"ID of the user who registered the client, null if registered anonymously\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_id_issued_at: {\n\t\t\t\t\t\t\t\t\t\ttype: \"number\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Creation timestamp of this client\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_name: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Name of the OAuth2 application\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tclient_uri: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Name of the OAuth2 application\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tlogo_uri: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Icon URL for the application\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tcontacts: {\n\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\tdescription: \"List representing ways to contact people responsible for this client, typically email addresses\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\ttos_uri: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Client's terms of service uri\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tpolicy_uri: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Client's policy uri\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tsoftware_id: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Unique identifier assigned by the developer to help in the dynamic registration process\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tsoftware_version: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Version identifier for the software_id\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tsoftware_statement: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"JWT containing metadata values about the client software as claims\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tredirect_uris: {\n\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tdescription: \"List of allowed redirect uris\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tpost_logout_redirect_uris: {\n\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tdescription: \"List of allowed logout redirect uris\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tbackchannel_logout_uri: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"RP URL to receive signed Logout Tokens when the end-user's OP session terminates\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tbackchannel_logout_session_required: {\n\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Whether the RP requires a `sid` claim in every Logout Token\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\ttoken_endpoint_auth_method: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Requested authentication method for the token endpoint\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tgrant_types: {\n\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\tdescription: \"Grant types the client may use at the token endpoint\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tresponse_types: {\n\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tenum: [\"code\"]\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tdescription: \"Response types the client may use at the authorization endpoint\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tapplication_type: {\n\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"OIDC application type used to classify redirect URI policy\",\n\t\t\t\t\t\t\t\t\t\tenum: [\"web\", \"native\"]\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tresources: {\n\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\tformat: \"uri\"\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\tdescription: \"Final resource identifiers linked to the registered client\"\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tdisabled: {\n\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\tdescription: \"Whether the client is disabled\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\trequired: [\"client_id\"]\n\t\t\t\t\t\t\t} } }\n\t\t\t\t\t\t} }\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}, async (ctx) => {\n\t\t\t\treturn registerEndpoint(ctx, opts);\n\t\t\t}),\n\t\t\tadminCreateOAuthClient: adminCreateOAuthClient(opts),\n\t\t\tcreateOAuthClient: createOAuthClient(opts),\n\t\t\tgetOAuthClient: getOAuthClient(opts),\n\t\t\tgetOAuthClientPublic: getOAuthClientPublic(opts),\n\t\t\tgetOAuthClientPublicPrelogin: getOAuthClientPublicPrelogin(opts),\n\t\t\tgetOAuthClients: getOAuthClients(opts),\n\t\t\tadminUpdateOAuthClient: adminUpdateOAuthClient(opts),\n\t\t\tupdateOAuthClient: updateOAuthClient(opts),\n\t\t\trotateClientSecret: rotateClientSecret(opts),\n\t\t\tdeleteOAuthClient: deleteOAuthClient(opts),\n\t\t\tgetOAuthConsent: getOAuthConsent(opts),\n\t\t\tgetOAuthConsents: getOAuthConsents(opts),\n\t\t\tupdateOAuthConsent: updateOAuthConsent(opts),\n\t\t\tdeleteOAuthConsent: deleteOAuthConsent(opts),\n\t\t\tadminCreateOAuthResource: adminCreateOAuthResource(opts),\n\t\t\tadminListOAuthResources: adminListOAuthResources(opts),\n\t\t\tadminGetOAuthResource: adminGetOAuthResource(opts),\n\t\t\tadminUpdateOAuthResource: adminUpdateOAuthResource(opts),\n\t\t\tadminDeleteOAuthResource: adminDeleteOAuthResource(opts),\n\t\t\tadminLinkClientResource: adminLinkClientResource(opts),\n\t\t\tadminUnlinkClientResource: adminUnlinkClientResource(opts)\n\t\t},\n\t\tschema: mergeSchema(structuredClone(schema), opts?.schema),\n\t\trateLimit: [\n\t\t\t...opts.rateLimit?.token !== false ? [{\n\t\t\t\tpathMatcher: (path) => path === \"/oauth2/token\",\n\t\t\t\twindow: opts.rateLimit?.token?.window ?? 60,\n\t\t\t\tmax: opts.rateLimit?.token?.max ?? 20\n\t\t\t}] : [],\n\t\t\t...opts.rateLimit?.authorize !== false ? [{\n\t\t\t\tpathMatcher: (path) => path === \"/oauth2/authorize\",\n\t\t\t\twindow: opts.rateLimit?.authorize?.window ?? 60,\n\t\t\t\tmax: opts.rateLimit?.authorize?.max ?? 30\n\t\t\t}] : [],\n\t\t\t...opts.rateLimit?.introspect !== false ? [{\n\t\t\t\tpathMatcher: (path) => path === \"/oauth2/introspect\",\n\t\t\t\twindow: opts.rateLimit?.introspect?.window ?? 60,\n\t\t\t\tmax: opts.rateLimit?.introspect?.max ?? 100\n\t\t\t}] : [],\n\t\t\t...opts.rateLimit?.revoke !== false ? [{\n\t\t\t\tpathMatcher: (path) => path === \"/oauth2/revoke\",\n\t\t\t\twindow: opts.rateLimit?.revoke?.window ?? 60,\n\t\t\t\tmax: opts.rateLimit?.revoke?.max ?? 30\n\t\t\t}] : [],\n\t\t\t...opts.rateLimit?.register !== false ? [{\n\t\t\t\tpathMatcher: (path) => path === \"/oauth2/register\",\n\t\t\t\twindow: opts.rateLimit?.register?.window ?? 60,\n\t\t\t\tmax: opts.rateLimit?.register?.max ?? 5\n\t\t\t}] : [],\n\t\t\t...opts.rateLimit?.userinfo !== false ? [{\n\t\t\t\tpathMatcher: (path) => path === \"/oauth2/userinfo\",\n\t\t\t\twindow: opts.rateLimit?.userinfo?.window ?? 60,\n\t\t\t\tmax: opts.rateLimit?.userinfo?.max ?? 60\n\t\t\t}] : []\n\t\t]\n\t};\n};\n//#endregion\n//#region src/authorize.ts\n/**\n* Whether a past authentication is still fresh enough for an OIDC `max_age`\n* request: true when no more than `maxAge` seconds have elapsed since the user\n* last authenticated. The caller supplies `now`, keeping this pure.\n*/\nfunction isWithinMaxAge(sessionCreatedAt, maxAgeSeconds, now) {\n\tif (maxAgeSeconds === 0) return false;\n\treturn now.getTime() - sessionCreatedAt.getTime() <= maxAgeSeconds * 1e3;\n}\nfunction removeMaxAgeFromAuthorizationQuery(query) {\n\tconst { max_age: _maxAge, ...queryWithoutMaxAge } = query;\n\treturn queryWithoutMaxAge;\n}\n/**\n* Formats an error url. Per OIDC Core 1.0 §5 / RFC 6749 §4.2.2.1, errors on\n* implicit and hybrid flows are delivered in the URL fragment, not the query.\n* Callers on the code flow (default) omit `mode` and get query delivery.\n*/\nfunction formatErrorURL(url, error, description, state, iss, mode = \"query\") {\n\tconst searchParams = new URLSearchParams({\n\t\terror,\n\t\terror_description: description\n\t});\n\tstate && searchParams.append(\"state\", state);\n\tiss && searchParams.append(\"iss\", iss);\n\tif (mode === \"fragment\") return `${url}#${searchParams.toString()}`;\n\treturn appendQueryParams(url, searchParams);\n}\n/**\n* Selects the response mode for an error redirect to the RP. OIDC Core 1.0 §5\n* defines defaults based on response_type: `code` → query, types containing\n* `token` / `id_token` → fragment. An explicit `response_mode` overrides.\n*\n* When `response_type` is duplicated (array) or absent, we can't trust the\n* caller's intent, so we default to query — the safer channel for\n* unrecognized shapes.\n*/\nfunction deriveResponseMode(raw) {\n\tconst responseMode = typeof raw.response_mode === \"string\" ? raw.response_mode : void 0;\n\tif (responseMode === \"fragment\") return \"fragment\";\n\tif (responseMode === \"query\") return \"query\";\n\tconst responseType = typeof raw.response_type === \"string\" ? raw.response_type : void 0;\n\tif (responseType && /\\b(token|id_token)\\b/.test(responseType)) return \"fragment\";\n\treturn \"query\";\n}\nconst authorizationQueryErrorCodesByField = {\n\tresponse_type: { invalid: \"unsupported_response_type\" },\n\tresource: { invalid: \"invalid_target\" }\n};\nfunction isRecord(value) {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\nfunction getStringParameter(value) {\n\treturn typeof value === \"string\" ? value : void 0;\n}\nfunction getAuthorizationRequestParameters(ctx, settings) {\n\tconst source = ctx.method === \"POST\" && settings?.isAuthorize === true ? ctx.body : ctx.query;\n\treturn { ...isRecord(source) ? source : {} };\n}\nconst handleRedirect = (ctx, uri) => {\n\tconst fromFetch = isBrowserFetchRequest(ctx.request?.headers);\n\tconst acceptJson = ctx.headers?.get(\"accept\")?.includes(\"application/json\");\n\tif (fromFetch || acceptJson) return {\n\t\tredirect: true,\n\t\turl: uri.toString()\n\t};\n\telse throw ctx.redirect(uri);\n};\nfunction redirectWithPromptNoneError(ctx, opts, query, error, description) {\n\treturn handleRedirect(ctx, formatErrorURL(query.redirect_uri, error, description, query.state, getIssuer(ctx, opts)));\n}\n/**\n* Validates that the issuer URL\n* - MUST use HTTPS scheme (HTTP allowed for localhost in dev)\n* - MUST NOT contain query components\n* - MUST NOT contain fragment components\n*\n* @returns The validated issuer URL, or a sanitized version if invalid\n*/\nfunction validateIssuerUrl(issuer) {\n\ttry {\n\t\tconst url = new URL(issuer);\n\t\tif (url.protocol !== \"https:\" && !isLoopbackHost(url.host)) url.protocol = \"https:\";\n\t\turl.search = \"\";\n\t\turl.hash = \"\";\n\t\treturn url.toString().replace(/\\/$/, \"\");\n\t} catch {\n\t\treturn issuer;\n\t}\n}\n/**\n* Gets the issuer identifier\n*/\nfunction getIssuer(ctx, opts) {\n\tlet issuer;\n\tif (opts.disableJwtPlugin) issuer = ctx.context.baseURL;\n\telse try {\n\t\tissuer = getJwtPlugin(ctx.context).options?.jwt?.issuer ?? ctx.context.baseURL;\n\t} catch {\n\t\tissuer = ctx.context.baseURL;\n\t}\n\treturn validateIssuerUrl(issuer);\n}\n/**\n* Error page url if redirect_uri has not been verified yet\n* Generates Url for custom error page\n*/\nfunction getErrorURL(ctx, error, description) {\n\treturn formatErrorURL(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, error, description);\n}\n/**\n* Based on the loopback port matching approach in node-oidc-provider.\n*\n* @see https://github.com/panva/node-oidc-provider/blob/ea1456f987de7750b6af8a89a1881e70c70827fe/lib/models/client.js#L36-L76\n*/\nfunction stripLoopbackRedirectPort(uri) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(uri);\n\t} catch {\n\t\treturn;\n\t}\n\tconst isLoopback = isLoopbackIP(parsed.hostname) || parsed.hostname === \"localhost\";\n\tif (parsed.protocol !== \"http:\" || !isLoopback) return;\n\tconst schemeSeparatorIndex = uri.indexOf(\"://\");\n\tif (schemeSeparatorIndex < 0) return void 0;\n\tconst authorityStart = schemeSeparatorIndex + 3;\n\tconst authorityEndOffset = uri.slice(authorityStart).search(/[/?#]/u);\n\tlet authorityEnd = uri.length;\n\tif (authorityEndOffset >= 0) authorityEnd = authorityStart + authorityEndOffset;\n\tconst authority = uri.slice(authorityStart, authorityEnd);\n\tlet portStart;\n\tif (authority.startsWith(\"[\")) {\n\t\tconst closingBracket = authority.indexOf(\"]\");\n\t\tif (closingBracket < 0) return void 0;\n\t\tif (authority[closingBracket + 1] !== \":\") return uri;\n\t\tportStart = closingBracket + 1;\n\t} else {\n\t\tportStart = authority.lastIndexOf(\":\");\n\t\tif (portStart < 0) return uri;\n\t}\n\tconst port = authority.slice(portStart + 1);\n\tif (!/^\\d*$/u.test(port)) return;\n\tconst portStartInUri = authorityStart + portStart;\n\treturn `${uri.slice(0, portStartInUri)}${uri.slice(authorityEnd)}`;\n}\n/**\n* Finds the matching entry in a client's registered redirect URIs.\n*\n* Registration limits loopback redirects to native-compatible HTTP forms.\n* Within that boundary, only the port may vary; every other character must\n* match the registered URI.\n*\n* @see https://www.rfc-editor.org/rfc/rfc9700.html#section-4.1.3\n* @see https://www.rfc-editor.org/rfc/rfc8252.html#section-8.3\n*/\nfunction findRegisteredRedirectUri(registered, requested) {\n\tif (!registered || !requested) return void 0;\n\tlet requestedUrl;\n\ttry {\n\t\trequestedUrl = new URL(requested);\n\t} catch {\n\t\treturn;\n\t}\n\t/**\n\t* A trailing `#` yields an empty `URL.hash` but still defines a fragment.\n\t*/\n\tconst hasFragment = requested.includes(\"#\");\n\tconst hasUserinfo = requestedUrl.username.length > 0 || requestedUrl.password.length > 0;\n\tif (hasFragment || hasUserinfo) return;\n\tconst requestedWithoutPort = stripLoopbackRedirectPort(requested);\n\treturn registered.find((url) => {\n\t\tif (url === requested) return true;\n\t\tif (!requestedWithoutPort) return false;\n\t\treturn stripLoopbackRedirectPort(url) === requestedWithoutPort;\n\t});\n}\n/** Keep URI syntax and credential checks outside the custom trust decision. */\nfunction isSafeCustomRedirectUri(uri) {\n\tif (!SafeUrlSchema.safeParse(uri).success) return false;\n\tconst parsed = new URL(uri);\n\treturn parsed.username.length === 0 && parsed.password.length === 0;\n}\n/**\n* Loads the client, verifies it's enabled, and returns the requested\n* redirect_uri when it matches a registered entry (or is accepted by the\n* custom `validateRedirectUri` option, mirroring the authorize endpoint's\n* validation). Returns null whenever the RP cannot be safely reached, so\n* callers can fall back to the server error page (avoiding open-redirect\n* risk on validation failures).\n*/\nasync function resolveTrustedRedirectUri(ctx, opts, clientId, redirectUri) {\n\tif (!clientId || !redirectUri) return null;\n\tlet client;\n\ttry {\n\t\tclient = await getClient(ctx, opts, clientId);\n\t} catch {\n\t\treturn null;\n\t}\n\tif (!client || client.disabled) return null;\n\tconst registeredUris = client.redirectUris ?? [];\n\tconst matched = findRegisteredRedirectUri(registeredUris, redirectUri);\n\tif (opts.validateRedirectUri) {\n\t\tif (!isSafeCustomRedirectUri(redirectUri)) return null;\n\t\ttry {\n\t\t\treturn await opts.validateRedirectUri(redirectUri, registeredUris, Boolean(matched)) ? redirectUri : null;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\treturn matched ? redirectUri : null;\n}\n/**\n* `redirectOnError` callback for `/oauth2/authorize`. Per RFC 6749 §4.1.2.1,\n* authorize errors MUST be delivered to the client's `redirect_uri` with\n* `error`, `error_description`, `state`, and (RFC 9207) `iss`. The clause\n* carves out one case: a missing/invalid `redirect_uri` or `client_id` MUST\n* NOT redirect to the requested URI. We implement the carve-out via\n* `resolveTrustedRedirectUri`, falling back to the server error page.\n*\n* Channel (query vs fragment) follows OIDC Core §5 via `deriveResponseMode`.\n*/\nfunction authorizeRedirectOnError(opts) {\n\treturn async ({ error, error_description, ctx }) => {\n\t\tconst raw = ctx.query ?? {};\n\t\tconst trusted = await resolveTrustedRedirectUri(ctx, opts, typeof raw.client_id === \"string\" ? raw.client_id : void 0, typeof raw.redirect_uri === \"string\" ? raw.redirect_uri : void 0);\n\t\tif (trusted) return handleRedirect(ctx, formatErrorURL(trusted, error, error_description, typeof raw.state === \"string\" ? raw.state : void 0, getIssuer(ctx, opts), deriveResponseMode(raw)));\n\t\treturn handleRedirect(ctx, getErrorURL(ctx, error, error_description));\n\t};\n}\nasync function authorizeEndpoint(ctx, opts, settings) {\n\tif (opts.grantTypes && !opts.grantTypes.includes(\"authorization_code\")) throw new APIError$1(\"NOT_FOUND\");\n\tif (!ctx.request) throw new APIError$1(\"UNAUTHORIZED\", {\n\t\terror_description: \"request not found\",\n\t\terror: \"invalid_request\"\n\t});\n\tconst request = ctx.request;\n\tlet query = getAuthorizationRequestParameters(ctx, settings);\n\tctx.query = query;\n\tconst requestObject = getStringParameter(query.request);\n\tconst requestUri = getStringParameter(query.request_uri);\n\tif (requestObject !== void 0 && requestUri !== void 0) return authorizeRedirectOnError(opts)({\n\t\terror: \"invalid_request\",\n\t\terror_description: \"request and request_uri cannot be used together\",\n\t\tctx\n\t});\n\tif (requestObject !== void 0) return authorizeRedirectOnError(opts)({\n\t\terror: \"request_not_supported\",\n\t\terror_description: \"request object not supported\",\n\t\tctx\n\t});\n\tif (requestUri !== void 0) {\n\t\tconst clientId = getStringParameter(query.client_id);\n\t\tif (!clientId) return authorizeRedirectOnError(opts)({\n\t\t\terror: \"invalid_request\",\n\t\t\terror_description: \"client_id is required\",\n\t\t\tctx\n\t\t});\n\t\tif (!opts.requestUriResolver) return authorizeRedirectOnError(opts)({\n\t\t\terror: \"request_uri_not_supported\",\n\t\t\terror_description: \"request_uri not supported\",\n\t\t\tctx\n\t\t});\n\t\tconst resolvedParams = await opts.requestUriResolver({\n\t\t\trequestUri,\n\t\t\tclientId,\n\t\t\tctx\n\t\t});\n\t\tif (!resolvedParams) return authorizeRedirectOnError(opts)({\n\t\t\terror: \"invalid_request_uri\",\n\t\t\terror_description: \"request_uri is invalid or expired\",\n\t\t\tctx\n\t\t});\n\t\tconst urlClientId = query.client_id;\n\t\tquery = resolvedParams;\n\t\tif (urlClientId) query.client_id = urlClientId;\n\t}\n\tctx.query = query;\n\tconst parsedQuery = authorizationQuerySchema.safeParse(query);\n\tif (!parsedQuery.success) {\n\t\tconst mappedError = mapIssuesToOAuthError(parsedQuery.error.issues, authorizationQueryErrorCodesByField);\n\t\treturn authorizeRedirectOnError(opts)({\n\t\t\t...mappedError,\n\t\t\tctx\n\t\t});\n\t}\n\tquery = parsedQuery.data;\n\tctx.query = query;\n\tawait oAuthState.set({ query: serializeAuthorizationQuery(query).toString() });\n\tif (!query.response_type) return authorizeRedirectOnError(opts)({\n\t\terror: \"invalid_request\",\n\t\terror_description: \"response_type is required\",\n\t\tctx\n\t});\n\tconst promptSet = ctx.query?.prompt ? parsePrompt(ctx.query?.prompt) : void 0;\n\tconst promptNone = promptSet?.has(\"none\") ?? false;\n\tif (promptSet?.has(\"select_account\") && !opts.selectAccount?.page) return handleRedirect(ctx, getErrorURL(ctx, `unsupported_prompt_select_account`, \"unsupported prompt type\"));\n\tif (!(query.response_type === \"code\")) return handleRedirect(ctx, getErrorURL(ctx, \"unsupported_response_type\", \"unsupported response type\"));\n\tconst client = await getClient(ctx, opts, query.client_id);\n\tif (!client) return handleRedirect(ctx, getErrorURL(ctx, \"invalid_client\", \"client_id is required\"));\n\tif (client.disabled) return handleRedirect(ctx, getErrorURL(ctx, \"client_disabled\", \"client is disabled\"));\n\tif (!clientAllowsGrant(client, \"authorization_code\")) return handleRedirect(ctx, getErrorURL(ctx, \"unauthorized_client\", \"client is not authorized to use the authorization_code grant\"));\n\tconst registeredUris = client.redirectUris ?? [];\n\tlet isValidRedirectUri = false;\n\tif (query.redirect_uri) {\n\t\tconst defaultResult = Boolean(findRegisteredRedirectUri(registeredUris, query.redirect_uri));\n\t\tif (opts.validateRedirectUri && isSafeCustomRedirectUri(query.redirect_uri)) try {\n\t\t\tisValidRedirectUri = await opts.validateRedirectUri(query.redirect_uri, registeredUris, defaultResult);\n\t\t} catch {\n\t\t\tisValidRedirectUri = false;\n\t\t}\n\t\telse if (!opts.validateRedirectUri) isValidRedirectUri = defaultResult;\n\t}\n\tif (!isValidRedirectUri) return handleRedirect(ctx, getErrorURL(ctx, \"invalid_redirect\", \"invalid redirect uri\"));\n\tlet requestedScopes = query.scope?.split(\" \").filter((s) => s);\n\tif (requestedScopes) {\n\t\tconst validScopes = new Set(client.scopes ?? opts.scopes);\n\t\tconst invalidScopes = requestedScopes.filter((scope) => {\n\t\t\treturn !validScopes?.has(scope);\n\t\t});\n\t\tif (invalidScopes.length) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, \"invalid_scope\", `The following scopes are invalid: ${invalidScopes.join(\", \")}`, query.state, getIssuer(ctx, opts)));\n\t}\n\tif (!requestedScopes) {\n\t\trequestedScopes = client.scopes ?? opts.scopes ?? [];\n\t\tquery.scope = requestedScopes.join(\" \");\n\t}\n\tconst openidRequested = requestedScopes.includes(\"openid\");\n\tif (query.claims !== void 0 && !openidRequested) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, \"invalid_request\", \"openid scope must be requested when using the claims parameter\", query.state, getIssuer(ctx, opts)));\n\tif (openidRequested && !isValidOidcClaimsRequest(query.claims)) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, \"invalid_request\", \"claims must be a valid Claims request object\", query.state, getIssuer(ctx, opts)));\n\tif (openidRequested && !canSatisfyEssentialAcrRequest(query.claims, \"0\")) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, \"access_denied\", \"essential acr requirement cannot be met\", query.state, getIssuer(ctx, opts)));\n\tconst requestedUserInfoClaims = getRequestedUserInfoClaims(query.claims, getSupportedClaims(opts));\n\tif (query.resource !== void 0) try {\n\t\tawait resolveResourcePolicy(ctx, opts, {\n\t\t\tresource: query.resource,\n\t\t\tclientId: client.clientId,\n\t\t\trequestedScopes\n\t\t});\n\t} catch (err) {\n\t\tif (err instanceof APIError$1) {\n\t\t\tconst error = err.body?.error ?? \"invalid_target\";\n\t\t\tconst description = err.body?.error_description ?? \"requested resource invalid\";\n\t\t\treturn handleRedirect(ctx, formatErrorURL(query.redirect_uri, error, description, query.state, getIssuer(ctx, opts)));\n\t\t}\n\t\tthrow err;\n\t}\n\tconst pkceRequired = isPKCERequired(client, {\n\t\tscopes: requestedScopes,\n\t\tnonce: query.nonce\n\t});\n\tif (pkceRequired) {\n\t\tif (!query.code_challenge || !query.code_challenge_method) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, \"invalid_request\", pkceRequired.valueOf(), query.state, getIssuer(ctx, opts)));\n\t}\n\tif (query.code_challenge || query.code_challenge_method) {\n\t\tif (!query.code_challenge || !query.code_challenge_method) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, \"invalid_request\", \"code_challenge and code_challenge_method must both be provided\", query.state, getIssuer(ctx, opts)));\n\t\tif (![\"S256\"].includes(query.code_challenge_method)) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, \"invalid_request\", \"invalid code_challenge method, only S256 is supported\", query.state, getIssuer(ctx, opts)));\n\t}\n\tconst requestedResources = toResourceList(query.resource) ?? [];\n\tconst session = await getSessionFromCtx(ctx);\n\tconst maxAgeSeconds = query.max_age;\n\tconst hasSatisfiedMaxAge = session != null && maxAgeSeconds !== void 0 && isWithinMaxAge(new Date(session.session.createdAt), maxAgeSeconds, /* @__PURE__ */ new Date());\n\tif (!session || session != null && maxAgeSeconds !== void 0 && !hasSatisfiedMaxAge || promptSet?.has(\"login\") || promptSet?.has(\"create\")) {\n\t\tif (promptNone) return redirectWithPromptNoneError(ctx, opts, query, \"login_required\", \"authentication required\");\n\t\treturn redirectWithPromptCode(ctx, opts, promptSet?.has(\"create\") ? \"create\" : \"login\");\n\t}\n\tif (hasSatisfiedMaxAge) {\n\t\tquery = removeMaxAgeFromAuthorizationQuery(query);\n\t\tctx.query = query;\n\t}\n\tif (settings?.isAuthorize && promptSet?.has(\"select_account\")) return redirectWithPromptCode(ctx, opts, \"select_account\");\n\tif (settings?.isAuthorize && opts.selectAccount) {\n\t\tif (await opts.selectAccount.shouldRedirect({\n\t\t\theaders: request.headers,\n\t\t\tuser: session.user,\n\t\t\tsession: session.session,\n\t\t\tscopes: requestedScopes\n\t\t})) {\n\t\t\tif (promptNone) return redirectWithPromptNoneError(ctx, opts, query, \"account_selection_required\", \"End-User account selection is required\");\n\t\t\treturn redirectWithPromptCode(ctx, opts, \"select_account\");\n\t\t}\n\t}\n\tif (opts.signup?.shouldRedirect) {\n\t\tconst signupRedirect = await opts.signup.shouldRedirect({\n\t\t\theaders: request.headers,\n\t\t\tuser: session.user,\n\t\t\tsession: session.session,\n\t\t\tscopes: requestedScopes\n\t\t});\n\t\tif (signupRedirect) {\n\t\t\tif (promptNone) return redirectWithPromptNoneError(ctx, opts, query, \"interaction_required\", \"End-User interaction is required\");\n\t\t\treturn redirectWithPromptCode(ctx, opts, \"create\", { page: typeof signupRedirect === \"string\" ? signupRedirect : void 0 });\n\t\t}\n\t}\n\tif (!settings?.postLogin && opts.postLogin) {\n\t\tif (await opts.postLogin.shouldRedirect({\n\t\t\theaders: request.headers,\n\t\t\tuser: session.user,\n\t\t\tsession: session.session,\n\t\t\tscopes: requestedScopes\n\t\t})) {\n\t\t\tif (promptNone) return redirectWithPromptNoneError(ctx, opts, query, \"interaction_required\", \"End-User interaction is required\");\n\t\t\treturn redirectWithPromptCode(ctx, opts, \"post_login\");\n\t\t}\n\t}\n\tif (promptSet?.has(\"consent\")) return redirectWithPromptCode(ctx, opts, \"consent\", { sessionId: session.session.id });\n\tconst referenceId = await opts.postLogin?.consentReferenceId?.({\n\t\tuser: session.user,\n\t\tsession: session.session,\n\t\tscopes: requestedScopes\n\t});\n\tif (client.skipConsent) return redirectWithAuthorizationCode(ctx, opts, {\n\t\tquery,\n\t\tclientId: client.clientId,\n\t\tuserId: session.user.id,\n\t\tsessionId: session.session.id,\n\t\tauthTime: new Date(session.session.createdAt).getTime(),\n\t\treferenceId,\n\t\tresource: requestedResources\n\t});\n\tconst consent = await ctx.context.adapter.findOne({\n\t\tmodel: \"oauthConsent\",\n\t\twhere: [\n\t\t\t{\n\t\t\t\tfield: \"clientId\",\n\t\t\t\tvalue: client.clientId\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"userId\",\n\t\t\t\tvalue: session.user.id\n\t\t\t},\n\t\t\t...referenceId ? [{\n\t\t\t\tfield: \"referenceId\",\n\t\t\t\tvalue: referenceId\n\t\t\t}] : []\n\t\t]\n\t});\n\tif (!consent || !requestedScopes.every((val) => consent.scopes.includes(val)) || !requestedUserInfoClaims.every((claim) => (consent.requestedUserInfoClaims ?? []).includes(claim))) {\n\t\tif (promptNone) return redirectWithPromptNoneError(ctx, opts, query, \"consent_required\", \"End-User consent is required\");\n\t\treturn redirectWithPromptCode(ctx, opts, \"consent\", { sessionId: session.session.id });\n\t}\n\tconst consentedResources = consent?.resources ?? [];\n\tif (requestedResources.some((requestedResource) => !consentedResources.includes(requestedResource))) {\n\t\tif (promptNone) return redirectWithPromptNoneError(ctx, opts, query, \"consent_required\", \"End-User consent is required\");\n\t\treturn redirectWithPromptCode(ctx, opts, \"consent\", { sessionId: session.session.id });\n\t}\n\treturn redirectWithAuthorizationCode(ctx, opts, {\n\t\tquery,\n\t\tclientId: client.clientId,\n\t\tuserId: session.user.id,\n\t\tsessionId: session.session.id,\n\t\tauthTime: new Date(session.session.createdAt).getTime(),\n\t\treferenceId,\n\t\tresource: requestedResources\n\t});\n}\nfunction serializeAuthorizationQuery(query) {\n\tconst params = new URLSearchParams();\n\tfor (const [key, value] of Object.entries(query)) {\n\t\tif (value == null) continue;\n\t\tif (Array.isArray(value)) for (const v of value) params.append(key, String(v));\n\t\telse if (key === \"claims\" && typeof value === \"object\") params.set(key, JSON.stringify(value));\n\t\telse params.set(key, String(value));\n\t}\n\treturn params;\n}\nasync function redirectWithAuthorizationCode(ctx, opts, verificationValue) {\n\tconst code = generateRandomString(32, \"a-z\", \"A-Z\", \"0-9\");\n\tconst iat = Math.floor(Date.now() / 1e3);\n\tconst exp = iat + (opts.codeExpiresIn ?? 600);\n\tconst data = {\n\t\tidentifier: await storeToken(opts.storeTokens, code, \"authorization_code\"),\n\t\tupdatedAt: /* @__PURE__ */ new Date(iat * 1e3),\n\t\texpiresAt: /* @__PURE__ */ new Date(exp * 1e3),\n\t\tvalue: JSON.stringify({\n\t\t\ttype: \"authorization_code\",\n\t\t\tquery: verificationValue.query,\n\t\t\tuserId: verificationValue.userId,\n\t\t\tsessionId: verificationValue?.sessionId,\n\t\t\treferenceId: verificationValue.referenceId,\n\t\t\tauthTime: verificationValue.authTime,\n\t\t\tresource: verificationValue.resource\n\t\t})\n\t};\n\tawait ctx.context.internalAdapter.createVerificationValue({\n\t\t...data,\n\t\tcreatedAt: /* @__PURE__ */ new Date(iat * 1e3)\n\t});\n\tconst redirectUriWithCode = new URL(verificationValue.query.redirect_uri);\n\tredirectUriWithCode.searchParams.set(\"code\", code);\n\tif (verificationValue.query.state) redirectUriWithCode.searchParams.set(\"state\", verificationValue.query.state);\n\tredirectUriWithCode.searchParams.set(\"iss\", getIssuer(ctx, opts));\n\treturn handleRedirect(ctx, redirectUriWithCode.toString());\n}\nasync function redirectWithPromptCode(ctx, opts, type, options) {\n\tconst queryParams = await signParams(ctx, opts, { postLoginClearedForSession: type === \"consent\" && opts.postLogin ? options?.sessionId : void 0 });\n\tlet path = opts.loginPage;\n\tif (type === \"select_account\") path = opts.selectAccount?.page ?? opts.loginPage;\n\telse if (type === \"post_login\") {\n\t\tif (!opts.postLogin?.page) throw new APIError$1(\"INTERNAL_SERVER_ERROR\", { error_description: \"postLogin should have been defined\" });\n\t\tpath = opts.postLogin?.page;\n\t} else if (type === \"consent\") path = opts.consentPage;\n\telse if (type === \"create\") path = opts.signup?.page ?? opts.loginPage;\n\treturn handleRedirect(ctx, `${options?.page ?? path}?${queryParams}`);\n}\nasync function signParams(ctx, opts, flags) {\n\tconst issuedAt = Date.now();\n\tconst exp = Math.floor(issuedAt / 1e3) + (opts.codeExpiresIn ?? 600);\n\tconst params = serializeAuthorizationQuery(ctx.query);\n\tparams.set(\"exp\", String(exp));\n\tparams.set(signedQueryIssuedAtParam, String(issuedAt));\n\tparams.delete(\"sig\");\n\tparams.delete(postLoginClearedParam);\n\tif (flags?.postLoginClearedForSession) params.set(postLoginClearedParam, flags.postLoginClearedForSession);\n\tsetSignedOAuthQueryParameterNames(params);\n\tconst signature = await makeSignature(canonicalizeOAuthQueryParams(params).toString(), ctx.context.secret);\n\tparams.set(\"sig\", signature);\n\treturn params.toString();\n}\n//#endregion\nexport { registerClientMetadataDocument as a, isForbiddenCimdClientMetadataField as c, metadataResponse as d, oauthAuthorizationServerMetadata as f, oidcServerMetadata as h, oauthProvider as i, validatePublicClientJwks as l, oauthProviderOpenIdConfigMetadata as m, DEFAULT_OAUTH_SCOPES as n, client_assertion_exports as o, oauthProviderAuthServerMetadata as p, getOAuthProviderState as r, consumeClientAssertion as s, getIssuer as t, authServerMetadata as u };\n"],"ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108],"mappings":"moBAEA,SAAgB2K,GAAO,EAAQ,CAC3B,OAAO3K,EAAoBC,EAAmB2K,CAAM,CACxD,CAIA,SAAgBC,GAAQ,EAAQ,CAC5B,OAAO3K,EAAqBC,EAAoByK,CAAM,CAC1D,CCTA,IAAIE,GAAY,OAAO,eACnBC,IAAe,EAAK,IAAe,CACtC,IAAIC,EAAS,CAAC,EACd,IAAK,IAAIC,KAAQC,EAAKJ,GAAUE,EAAQC,EAAM,CAC7C,IAAKC,EAAID,GACT,WAAY,EACb,CAAC,EAED,OADKE,GAAYL,GAAUE,EAAQ,OAAO,YAAa,CAAE,MAAO,QAAS,CAAC,EACnEA,CACR,ECTMI,GAA2B,SAC3BC,GAAwB,QACxBC,GAAgC,WACtC,SAASC,GAA6B,EAAQ,CAC7C,IAAMC,EAAkB,IAAI,gBACtBC,EAAU,CAAC,GAAGb,EAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAACc,EAAMC,GAAS,CAACC,EAAMC,KAC9DH,EAAOE,EAAa,GACpBF,EAAOE,EAAa,EACpBD,EAASE,EAAe,GAC5B,EAAIF,EAASE,EAEb,EACD,IAAK,GAAM,CAACC,EAAKC,KAAUN,EAASD,EAAgB,OAAOM,EAAKC,CAAK,EACrE,OAAOP,CACR,CACA,SAASQ,GAAkC,EAAQ,CAClDpB,EAAO,OAAOU,EAA6B,EAC3C,IAAMW,EAAuB,CAAC,GAAG,IAAI,IAAI,CAAC,GAAGrB,EAAO,KAAK,EAAGU,EAA6B,CAAC,CAAC,CAAC,CAAC,KAAK,EAClG,IAAK,IAAMY,KAAiBD,EAAsBrB,EAAO,OAAOU,GAA+BY,CAAa,CAC7G,CAeA,SAASC,GAAuB,EAAY,CAC3C,IAAMC,EAAM,IAAI,gBAAgBC,CAAU,CAAC,CAAC,IAAIjB,EAAwB,EACxE,GAAI,CAACgB,EAAK,OAAO,KACjB,IAAME,EAAW,OAAOF,CAAG,EAE3B,MADI,CAAC,OAAO,SAASE,CAAQ,GAAKA,GAAY,EAAU,KACjD,IAAI,KAAKA,CAAQ,CACzB,CC/BA,IAAaC,GAAb,KAAmB,CACf,MACA,MACA,SACA,UACA,OAAS,GACT,SAAW,GACX,UAAY,GACZ,YAAY,EAAM,EAAK,CAInB,GAHA7C,GAAM8C,CAAI,EACV5D,EAAOkD,EAAK,IAAA,GAAW,KAAK,EAC5B,KAAK,MAAQU,EAAK,OAAO,EACrB,OAAO,KAAK,MAAM,QAAW,WAC7B,MAAU,MAAM,wBAAwB,EAC5C,KAAK,SAAW,KAAK,MAAM,SAC3B,KAAK,UAAY,KAAK,MAAM,UAC5B,IAAMC,EAAW,KAAK,SAChBC,EAAM,IAAI,WAAWD,CAAQ,EAEnCC,EAAI,IAAIZ,EAAI,OAASW,EAAWD,EAAK,OAAO,CAAC,CAAC,OAAOV,CAAG,CAAC,CAAC,OAAO,EAAIA,CAAG,EACxE,IAAK,IAAIa,EAAI,EAAGA,EAAID,EAAI,OAAQ,IAC5B,EAAIC,IAAM,GACd,KAAK,MAAM,OAAOD,CAAG,EAGrB,KAAK,MAAQF,EAAK,OAAO,EAEzB,IAAK,IAAIG,EAAI,EAAGA,EAAID,EAAI,OAAQ,IAC5B,EAAIC,IAAM,IACd,KAAK,MAAM,OAAOD,CAAG,EACrB5D,EAAM4D,CAAG,CACb,CACA,OAAO,EAAK,CAGR,OAFAlD,GAAQ,IAAI,EACZ,KAAK,MAAM,OAAOoD,CAAG,EACd,IACX,CACA,WAAW,EAAK,CACZpD,GAAQ,IAAI,EACZT,EAAQ8D,EAAK,IAAI,EACjB,KAAK,SAAW,GAChB,IAAMD,EAAMC,EAAI,SAAS,EAAG,KAAK,SAAS,EAG1C,KAAK,MAAM,WAAWD,CAAG,EACzB,KAAK,MAAM,OAAOA,CAAG,EACrB,KAAK,MAAM,WAAWA,CAAG,EACzB,KAAK,QAAQ,CACjB,CACA,QAAS,CACL,IAAMC,EAAM,IAAI,WAAW,KAAK,MAAM,SAAS,EAE/C,OADA,KAAK,WAAWA,CAAG,EACZA,CACX,CACA,WAAW,EAAI,CAGX,IAAO,OAAO,OAAO,OAAO,eAAe,IAAI,EAAG,CAAC,CAAC,EACpD,GAAM,CAAE,QAAO,QAAO,WAAU,YAAW,WAAU,YAAW,UAAW,KAS3E,MARA,GAAKC,EACL,EAAG,SAAWC,EACd,EAAG,UAAYC,EACf,EAAG,SAAWP,EACd,EAAG,UAAYQ,EACf,EAAG,OAASC,EACZ,EAAG,MAAQC,EAAM,WAAWL,EAAG,KAAK,EACpC,EAAG,MAAQM,EAAM,WAAWN,EAAG,KAAK,EAC7BA,CACX,CACA,OAAQ,CACJ,OAAO,KAAK,WAAW,CAC3B,CACA,SAAU,CACN,KAAK,UAAY,GACjB,KAAK,MAAM,QAAQ,EACnB,KAAK,MAAM,QAAQ,CACvB,CACJ,EACa1M,QAA8B,CACvC,IAAMkN,IAAU,EAAM,EAAK,IAAY,IAAIf,GAAMC,EAAMV,CAAG,CAAC,CAAC,OAAOyB,CAAO,CAAC,CAAC,OAAO,GAEnF,MADA,GAAM,QAAU,EAAM,IAAQ,IAAIhB,GAAMC,EAAMV,CAAG,EAC1CwB,CACX,EAAA,CAAG,EC1DGE,GAA+B,WAAW,GAAG,CAAC,EAE9CC,GAA+B,WAAW,GAAG,EAqBnD,SAAgBC,GAAO,EAAM,EAAK,EAAM,EAAS,GAAI,EAAW,CAC5DhE,GAAM8C,CAAI,EACV7D,EAAQgF,EAAQ,QAAQ,EACxB/E,EAAOgF,EAAK,IAAA,GAAW,KAAK,EAC5B,IAAMC,EAAOrB,EAAK,UAElB,GAAIoB,EAAI,OAASC,EACb,MAAU,MAAM,uCAAuC,EAE3D,GAAIF,EAAS,IAAME,EACf,MAAU,MAAM,+BAA+B,EACnD,IAAMC,EAAS,KAAK,KAAKH,EAASE,CAAI,EAKtC,GAJIE,IAAS,IAAA,GACT,EAAON,GAEP7E,EAAOmF,EAAM,IAAA,GAAW,MAAM,EAC9B,CAACD,EAGD,OAFIE,GACAlF,EAAM8E,CAAG,EACN,IAAI,WAIf,IAAMK,EAAMD,GAAaF,IAAW,EAAIF,EAAM,IAAI,WAAWE,EAASD,CAAI,EACpE,CAAE,QAAO,SAAUxN,GAAK,OAAOmM,EAAMoB,CAAG,EAExCM,EAAIF,EAAYJ,EAAM,IAAI,WAAWC,CAAI,EAEzCM,EAASL,EAAS,EAAIE,GAAW,OAASxB,EAAK,OAAO,EAAI,IAAA,GAChE,IAAK,IAAI4B,EAAU,EAAGA,EAAUN,EAAS,EAAG,IAAW,CACnD,GAAa,GAAKM,EAAU,EAC5B,IAAMC,EAAQjB,EAAM,WAAWe,CAAM,EAGjCC,GACAC,EAAM,OAAOH,CAAC,EAClBG,EAAM,OAAON,CAAI,CAAC,CAAC,OAAOP,EAAY,CAAC,CAAC,WAAWU,CAAC,EACpDf,EAAM,WAAWgB,CAAM,CAAC,CAAC,OAAOD,CAAC,CAAC,CAAC,WAAWA,CAAC,EAC/CD,EAAI,IAAIC,EAAGL,EAAOO,CAAO,CAC7B,CAeA,GAbA,GAAa,GAAKN,EACdA,EAAS,GACTV,EAAM,OAAOc,CAAC,EAClBd,EAAM,OAAOW,CAAI,CAAC,CAAC,OAAOP,EAAY,CAAC,CAAC,WAAWU,CAAC,EACpDf,EAAM,OAAOe,CAAC,CAAC,CAAC,WAAWA,CAAC,EAC5BD,EAAI,IAAIC,EAAGL,GAAQC,EAAS,EAAE,EAC9BV,EAAM,QAAQ,EACdD,EAAM,QAAQ,EACdgB,GAAQ,QAAQ,EACZD,IAAMD,GACNnF,EAAMoF,CAAC,EACXpF,EAAM0E,EAAY,EAEdG,IAAWM,EAAI,OACf,OAAOA,EAGX,IAAMK,EAAML,EAAI,MAAM,EAAGN,CAAM,EAE/B,OADA7E,EAAMmF,CAAG,EACFK,CACX,CAyBA,IAAaC,IAAQ,EAAM,EAAK,EAAM,EAAM,IAAW,CACnD7E,GAAM8C,CAAI,EACNgC,IAAS,IAAA,KACT,EAAO,IAAI,WAAWhC,EAAK,SAAS,GACxC,IAAMiC,EAAOpO,GAAK,OAAOmM,EAAMgC,CAAI,CAAC,CAAC,OAAOE,CAAG,EAG/C,OAAOhB,GAAOlB,EAAMiC,EAAK,OAAO,EAAGV,EAAMJ,EAAQc,CAAI,CACzD,EC5HME,GAAY,GAAOC,EAAI,GAAK,GAAM,EAClCC,GAAY,GAAMD,IAAM,EAG9B,SAASE,GAAc,EAAM,EAAY,EAAG,EAAM,CAC9C,IAAMC,EAAIJ,GAAS,CAAC,EACdK,EAAIH,GAAS,CAAC,EACpBI,EAAK,UAAUC,EAAYC,EAAOH,EAAID,EAAGI,CAAI,EAC7CF,EAAK,UAAUC,EAAa,EAAGC,EAAOJ,EAAIC,EAAGG,CAAI,CACrD,CCfA,SAAgBC,GAAI,EAAG,EAAG,EAAG,CACzB,OAAQC,EAAIC,EAAM,CAACD,EAAIE,CAC3B,CAcA,SAAgBC,GAAI,EAAG,EAAG,EAAG,CACzB,OAAQH,EAAIC,EAAMD,EAAIE,EAAMD,EAAIC,CACpC,CAmBA,IAAaE,GAAb,KAAoB,CAChB,SACA,UACA,OAAS,GACT,UACA,KAEA,OACA,KACA,SAAW,GACX,OAAS,EACT,IAAM,EACN,UAAY,GACZ,YAAY,EAAU,EAAW,EAAW,EAAM,CAC9C,KAAK,SAAWhD,EAChB,KAAK,UAAYQ,EACjB,KAAK,UAAYyC,EACjB,KAAK,KAAOP,EACZ,KAAK,OAAS,IAAI,WAAW1C,CAAQ,EACrC,KAAK,KAAOnM,GAAW,KAAK,MAAM,CACtC,CACA,OAAO,EAAM,CACTkJ,GAAQ,IAAI,EACZZ,EAAO+G,CAAI,EACX,GAAM,CAAE,OAAM,SAAQ,YAAa,KAC7BC,EAAMD,EAAK,OACbE,EAAY,GAChB,IAAK,IAAIC,EAAM,EAAGA,EAAMF,GAAM,CAC1B,IAAMG,EAAO,KAAK,IAAItD,EAAW,KAAK,IAAKmD,EAAME,CAAG,EAGpD,GAAIC,IAAStD,EAAU,CACnB,IAAMuD,EAAW1P,GAAWqP,CAAI,EAChC,KAAOlD,GAAYmD,EAAME,EAAK,GAAOrD,EACjC,KAAK,QAAQuD,EAAUF,CAAG,EAC9B,EAAY,EAEhB,MAGAG,EAAO,IAAIH,IAAQ,GAAKC,IAASH,EAAMD,EAAOA,EAAK,SAASG,EAAKA,EAAMC,CAAI,EAAG,KAAK,GAAG,EACtF,KAAK,KAAOA,EACZ,GAAOA,EACH,KAAK,MAAQtD,IACb,KAAK,QAAQwC,EAAM,CAAC,EACpB,KAAK,IAAM,EACX,EAAY,GAEpB,CAMA,MALA,MAAK,QAAUU,EAAK,OAGhBE,GACA,KAAK,WAAW,EACb,IACX,CACA,WAAW,EAAK,CACZrG,GAAQ,IAAI,EACZT,EAAQ8D,EAAK,IAAI,EACjB,KAAK,SAAW,GAIhB,GAAM,CAAE,SAAQ,OAAM,WAAU,QAAS,KACrC,CAAE,OAAQ,KAEd,EAAO,KAAS,IAChBoD,EAAO,KAAK,EAAGH,CAAG,EAGd,KAAK,UAAYrD,EAAWqD,IAC5B,KAAK,QAAQb,EAAM,CAAC,EACpBgB,EAAO,KAAK,CAAC,GAMjBnB,GAAcG,EAAMxC,EAAW,EAAG,KAAK,OAAS,EAAG0C,CAAI,EACvD,KAAK,QAAQF,EAAM,CAAC,EAGpB,KAAK,WAAW,EAEhB,IAAMiB,EAAQrD,IAAQoD,EAAShB,EAAO3O,GAAWuM,CAAG,EAC9C+C,EAAM,KAAK,UAEXO,EAASP,EAAM,EACfQ,EAAQ,KAAK,IAAI,EAEvB,GAAIR,EAAM,GAAKO,EAASC,EAAM,OAC1B,MAAU,MAAM,mBAAmB,EACvC,IAAK,IAAIzD,EAAI,EAAGA,EAAIwD,EAAQ,IACxBD,EAAM,UAAU,EAAIvD,EAAGyD,EAAMzD,GAAIwC,CAAI,CAC7C,CACA,QAAS,CACL,GAAM,CAAE,SAAQ,aAAc,KAC9B,KAAK,WAAWc,CAAM,EAGtB,IAAM3B,EAAM2B,EAAO,MAAM,EAAGhD,CAAS,EAErC,OADA,KAAK,QAAQ,EACNqB,CACX,CACA,eAAe,EAAI,CACf,GAAM,CAAE,SAAQ,SAAQ,WAAU,YAAW,OAAQ,KASrD,MARA,GAAG,UAAYtB,EACf,EAAG,SAAWD,EACd,EAAG,OAASY,EACZ,EAAG,IAAMmC,EAGLA,GACAhD,EAAG,OAAO,IAAImD,CAAM,EACjBnD,CACX,CACA,OAAQ,CACJ,OAAO,KAAK,WAAW,CAC3B,CACJ,EAQauD,GAA4B,YAAY,KAAK,CACtD,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,UAAY,UACxF,CAAC,EC5KKC,GAA2B,YAAY,KAAK,CAC9C,WAAY,WAAY,WAAY,WAAY,UAAY,WAAY,WAAY,WACpF,WAAY,UAAY,UAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,UAAY,UAAY,UAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,UAAY,UACpF,UAAY,UAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,UACpF,UAAY,UAAY,UAAY,UAAY,UAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,UACxF,CAAC,EAEKC,GAA2B,IAAI,YAAY,EAAE,EAE7CC,GAAN,cAAuBf,EAAO,CAK1B,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,YAAY,EAAW,EAAI,CACvB,MAAM,GAAIxC,EAAW,EAAG,EAAK,EAC7B,KAAK,EAAIwD,EAAG,GAAK,EACjB,KAAK,EAAIA,EAAG,GAAK,EACjB,KAAK,EAAIA,EAAG,GAAK,EACjB,KAAK,EAAIA,EAAG,GAAK,EACjB,KAAK,EAAIA,EAAG,GAAK,EACjB,KAAK,EAAIA,EAAG,GAAK,EACjB,KAAK,EAAIA,EAAG,GAAK,EACjB,KAAK,EAAIA,EAAG,GAAK,CACrB,CACA,KAAM,CACF,GAAM,CAAE,IAAG,IAAG,IAAG,IAAG,IAAG,IAAG,IAAG,KAAM,KACnC,MAAO,CAACC,EAAGC,EAAGC,EAAGC,EAAGC,EAAGC,EAAGC,EAAGC,CAAC,CAClC,CAEA,IAAI,EAAG,EAAG,EAAG,EAAG,EAAG,EAAG,EAAG,EAAG,CACxB,KAAK,EAAIP,EAAI,EACb,KAAK,EAAIC,EAAI,EACb,KAAK,EAAIC,EAAI,EACb,KAAK,EAAIC,EAAI,EACb,KAAK,EAAIC,EAAI,EACb,KAAK,EAAIC,EAAI,EACb,KAAK,EAAIC,EAAI,EACb,KAAK,EAAIC,EAAI,CACjB,CACA,WAAW,EAAI,CAEX,OADC,IAAO,IAAI,KAAK,YAAY,CAAG,IAAI,GAAG,KAAK,IAAI,CAAC,EAC1C,KAAK,eAAenE,CAAE,CACjC,CACA,QAAQ,EAAM,EAAQ,CAElB,IAAK,IAAIH,EAAI,EAAGA,EAAI,GAAI,IAAK,GAAU,EACnC,GAASA,GAAKsC,EAAK,UAAUiC,EAAQ,EAAK,EAC9C,IAAK,IAAIvE,EAAI,GAAIA,EAAI,GAAI,IAAK,CAC1B,IAAMwE,EAAMZ,GAAS5D,EAAI,IACnByE,EAAKb,GAAS5D,EAAI,GAClB0E,EAAKhI,GAAK8H,EAAK,CAAC,EAAI9H,GAAK8H,EAAK,EAAE,EAAKA,IAAQ,EAC7CG,EAAKjI,GAAK+H,EAAI,EAAE,EAAI/H,GAAK+H,EAAI,EAAE,EAAKA,IAAO,GACjD,GAASzE,GAAM2E,EAAKf,GAAS5D,EAAI,GAAK0E,EAAKd,GAAS5D,EAAI,IAAO,CACnE,CAEA,GAAI,CAAE,IAAG,IAAG,IAAG,IAAG,IAAG,IAAG,IAAG,KAAM,KACjC,IAAK,IAAIA,EAAI,EAAGA,EAAI,GAAI,IAAK,CACzB,IAAM4E,EAASlI,GAAKyH,EAAG,CAAC,EAAIzH,GAAKyH,EAAG,EAAE,EAAIzH,GAAKyH,EAAG,EAAE,EAC9CU,EAAMP,EAAIM,EAASnC,GAAI0B,EAAGC,EAAGC,CAAC,EAAIV,GAAS3D,GAAK4D,GAAS5D,GAAM,EAE/D8E,GADSpI,GAAKqH,EAAG,CAAC,EAAIrH,GAAKqH,EAAG,EAAE,EAAIrH,GAAKqH,EAAG,EAAE,GAC/BlB,GAAIkB,EAAGC,EAAGC,CAAC,EAAK,EACrC,EAAII,EACJ,EAAID,EACJ,EAAID,EACJ,EAAKD,EAAIW,EAAM,EACf,EAAIZ,EACJ,EAAID,EACJ,EAAID,EACJ,EAAKc,EAAKC,EAAM,CACpB,CAEA,EAAKf,EAAI,KAAK,EAAK,EACnB,EAAKC,EAAI,KAAK,EAAK,EACnB,EAAKC,EAAI,KAAK,EAAK,EACnB,EAAKC,EAAI,KAAK,EAAK,EACnB,EAAKC,EAAI,KAAK,EAAK,EACnB,EAAKC,EAAI,KAAK,EAAK,EACnB,EAAKC,EAAI,KAAK,EAAK,EACnB,EAAKC,EAAI,KAAK,EAAK,EACnB,KAAK,IAAIP,EAAGC,EAAGC,EAAGC,EAAGC,EAAGC,EAAGC,EAAGC,CAAC,CACnC,CACA,YAAa,CACTnI,EAAMyH,EAAQ,CAClB,CACA,SAAU,CAGN,KAAK,UAAY,GACjB,KAAK,IAAI,EAAG,EAAG,EAAG,EAAG,EAAG,EAAG,EAAG,CAAC,EAC/BzH,EAAM,KAAK,MAAM,CACrB,CACJ,EAEa4I,GAAb,cAA6BlB,EAAS,CAClC,aAAc,CACV,MAAM,GAAIH,EAAS,CACvB,CACJ,EA4PasB,GAAyB/H,OAAmB,IAAI8H,GAC7C7H,GAAQ,CAAI,CAAC,EC1XvBtJ,GAAU,IAAI,YAAesR,GAAU,IAAI,YAAeC,GAAgB,IAAI,YAAY,QAAS,CAAE,MAAO,CAAC,CAAE,CAAC,EAAGC,GAAY,GAAK,GAC1I,SAASC,GAAO,GAAGC,EAAS,CAC1B,IAAMC,EAAOD,EAAQ,QAAQ,EAAK,CAAE,YAAaE,EAAMxE,EAAQ,CAAC,EAAGf,EAAM,IAAI,WAAWsF,CAAI,EACxFvF,EAAI,EACR,IAAK,IAAMsD,KAAUgC,EACnBrF,EAAI,IAAIqD,EAAQtD,CAAC,EAAG,GAAKsD,EAAO,OAClC,OAAOrD,CACT,CACA,SAASwF,GAAc,EAAK,EAAO,EAAQ,CACzC,GAAIrG,EAAQ,GAAKA,GAASgG,GACxB,MAAU,WAAW,6BAA6BA,GAAY,EAAE,aAAahG,GAAO,EACtFa,EAAI,IAAI,CAACb,IAAU,GAAIA,IAAU,GAAIA,IAAU,EAAGA,EAAQ,GAAG,EAAGmF,CAAM,CACxE,CACA,SAASmB,GAAS,EAAO,CACvB,IAAMC,EAAO,KAAK,MAAMvG,EAAQgG,EAAS,EAAGQ,EAAMxG,EAAQgG,GAAWnF,EAAM,IAAI,WAAW,CAAC,EAC3F,OAAOwF,GAAcxF,EAAK0F,EAAM,CAAC,EAAGF,GAAcxF,EAAK2F,EAAK,CAAC,EAAG3F,CAClE,CACA,SAAS4F,GAAS,EAAO,CACvB,IAAM5F,EAAM,IAAI,WAAW,CAAC,EAC5B,OAAOwF,GAAcxF,EAAKb,CAAK,EAAGa,CACpC,CACA,IAAM6F,GAAY,eAClB,SAASjS,GAAO,EAAQ,CACtB,GAAI,OAAOmK,GAAU,UAAYA,EAAO,QAAU,IAAK,CACrD,GAAI8H,GAAU,KAAK9H,CAAM,EACvB,MAAU,UAAU,0CAA0C,EAChE,OAAOpK,GAAQ,OAAOoK,CAAM,CAC9B,CACA,IAAMgI,EAAQ,IAAI,WAAWhI,EAAO,MAAM,EAC1C,IAAK,IAAIgC,EAAI,EAAGA,EAAIhC,EAAO,OAAQ,IAAK,CACtC,IAAMiI,EAAOjI,EAAO,WAAWgC,CAAC,EAChC,GAAIiG,EAAO,IACT,MAAU,UAAU,0CAA0C,EAChE,EAAMjG,GAAKiG,CACb,CACA,OAAOD,CACT,CACA,SAASE,GAAa,EAAO,EAAM,CAAC,EAAG,CACrC,GAAI,WAAW,UAAU,SACvB,OAAOC,EAAM,SAAS,CAAE,SAAUhL,EAAM,YAAc,SAAU,YAAaA,CAAI,CAAC,EACpF,IAAMiL,EAAa,MAAOC,EAAM,CAAC,EACjC,IAAK,IAAIrG,EAAI,EAAGA,EAAImG,EAAM,OAAQ,GAAKC,EACrCC,EAAI,KAAK,OAAO,aAAa,MAAM,KAAMF,EAAM,SAASnG,EAAGA,EAAIoG,CAAU,CAAC,CAAC,EAC7E,IAAME,EAAU,KAAKD,EAAI,KAAK,EAAE,CAAC,EACjC,OAAOlL,EAAMmL,EAAQ,QAAQ,KAAM,EAAE,CAAC,CAAC,QAAQ,MAAO,GAAG,CAAC,CAAC,QAAQ,MAAO,GAAG,EAAIA,CACnF,CACA,SAASC,GAAa,EAAS,EAAM,CAAC,EAAG,CACvC,GAAI,WAAW,WACb,OAAO,WAAW,WAAWD,EAAS,CAAE,SAAUnL,EAAM,YAAc,QAAS,CAAC,EAClF,GAAIA,EAAK,CACP,GAAImL,EAAQ,SAAS,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAC/C,MAAU,UAAU,mBAAmB,EACzC,EAAUA,EAAQ,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,CACxD,CACA,IAAME,EAAS,KAAKF,CAAO,EAAGN,EAAQ,IAAI,WAAWQ,EAAO,MAAM,EAClE,IAAK,IAAIxG,EAAI,EAAGA,EAAIwG,EAAO,OAAQ,IACjC,EAAMxG,GAAKwG,EAAO,WAAWxG,CAAC,EAChC,OAAOgG,CACT,CACA,eAAeS,GAAO,EAAW,EAAM,CACrC,IAAMC,EAAe,OAAOC,EAAU,MAAM,EAAE,IAC9C,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAOD,EAAc1D,CAAI,CAAC,CACtE,CC9DA,IAAM4D,GAAN,cAAwB,KAAM,CAC5B,OAAO,KAAO,mBACd,KAAO,mBACP,YAAY,EAAS,EAAS,CAC5B,MAAMhG,EAASiG,CAAO,EAAG,KAAK,KAAO,KAAK,YAAY,KAAM,MAAM,oBAAoB,KAAM,KAAK,WAAW,CAC9G,CACF,EACMC,GAAN,cAAuCF,EAAU,CAC/C,OAAO,KAAO,kCACd,KAAO,kCACP,MACA,OACA,QACA,YAAY,EAAS,EAAS,EAAQ,cAAe,EAAS,cAAe,CAC3E,MAAMhG,EAAS,CAAE,MAAO,CAAE,QAAO,SAAQ,SAAQ,CAAE,CAAC,EAAG,KAAK,MAAQmG,EAAO,KAAK,OAASC,EAAQ,KAAK,QAAUC,CAClH,CACF,EACMC,GAAN,cAAyBN,EAAU,CACjC,OAAO,KAAO,kBACd,KAAO,kBACP,MACA,OACA,QACA,YAAY,EAAS,EAAS,EAAQ,cAAe,EAAS,cAAe,CAC3E,MAAMhG,EAAS,CAAE,MAAO,CAAE,QAAO,SAAQ,SAAQ,CAAE,CAAC,EAAG,KAAK,MAAQmG,EAAO,KAAK,OAASC,EAAQ,KAAK,QAAUC,CAClH,CACF,EACME,GAAN,cAAgCP,EAAU,CACxC,OAAO,KAAO,2BACd,KAAO,0BACT,EACMQ,EAAN,cAA+BR,EAAU,CACvC,OAAO,KAAO,yBACd,KAAO,wBACT,EACMS,GAAN,cAAkCT,EAAU,CAC1C,OAAO,KAAO,4BACd,KAAO,4BACP,YAAY,EAAU,8BAA+B,EAAS,CAC5D,MAAMhG,EAASiG,CAAO,CACxB,CACF,EACMS,EAAN,cAAyBV,EAAU,CACjC,OAAO,KAAO,kBACd,KAAO,iBACT,EACMW,EAAN,cAAyBX,EAAU,CACjC,OAAO,KAAO,kBACd,KAAO,iBACT,EACMY,GAAN,cAAyBZ,EAAU,CACjC,OAAO,KAAO,kBACd,KAAO,iBACT,EACMa,GAAN,cAAyBb,EAAU,CACjC,OAAO,KAAO,kBACd,KAAO,iBACT,EACMc,GAAN,cAA0Bd,EAAU,CAClC,OAAO,KAAO,mBACd,KAAO,kBACT,EACMe,GAAN,cAAgCf,EAAU,CACxC,OAAO,KAAO,2BACd,KAAO,2BACP,YAAY,EAAU,kDAAmD,EAAS,CAChF,MAAMhG,EAASiG,CAAO,CACxB,CACF,EACMe,GAAN,cAAuChB,EAAU,CAC/C,CAAC,OAAO,eAAiB,iBAAmB,CAC5C,EACA,OAAO,KAAO,kCACd,KAAO,kCACP,YAAY,EAAU,uDAAwD,EAAS,CACrF,MAAMhG,EAASiG,CAAO,CACxB,CACF,EACMgB,GAAN,cAA0BjB,EAAU,CAClC,OAAO,KAAO,mBACd,KAAO,mBACP,YAAY,EAAU,oBAAqB,EAAS,CAClD,MAAMhG,EAASiG,CAAO,CACxB,CACF,EACMiB,GAAN,cAA6ClB,EAAU,CACrD,OAAO,KAAO,wCACd,KAAO,wCACP,YAAY,EAAU,gCAAiC,EAAS,CAC9D,MAAMhG,EAASiG,CAAO,CACxB,CACF,EC1FMkB,GAAU,oDAChB,SAASC,GAAO,EAAO,CACrB,GAAI,CACF,OAAOzB,GAAa,OAAOJ,GAAS,SAAWA,EAAQjB,GAAQ,OAAOiB,CAAK,EAAG,CAAC,CAAC,CAClF,OAAS8B,EAAO,CACd,MAAU,UAAUF,GAAS,CAAE,OAAM,CAAC,CACxC,CACF,CACA,SAASG,EAAO,EAAO,CACrB,OAAOhC,GAAa,OAAOC,GAAS,SAAWrS,GAAQ,OAAOqS,CAAK,EAAIA,EAAO,CAAC,CAAC,CAClF,CCRA,SAASgC,GAAiB,EAAO,EAAO,CACtC,GAAI,EAAEhC,aAAiB,YACrB,MAAU,UAAU,GAAGiC,EAAM,mCAAmC,CACpE,CACA,SAASC,GAAS,EAAO,CACvB,GAAI,OAAOlC,GAAS,WAAYA,GAAkB,OAAO,UAAU,SAAS,KAAKA,CAAK,IAAM,kBAC1F,MAAO,CAAC,EACV,IAAMmC,EAAY,OAAO,eAAenC,CAAK,EAC7C,OAAOmC,IAAc,MAAQ,OAAO,eAAeA,CAAS,IAAM,IACpE,CACA,SAASC,GAAS,EAAO,CACvB,OAAOF,GAASlC,CAAK,GAAK,MAAM,QAAQA,EAAM,IAAI,GAAK,MAAM,KAAKA,EAAM,IAAI,CAAC,CAAC,MAAMkC,EAAQ,CAC9F,CACA,SAASG,GAAW,GAAGC,EAAS,CAC9B,IAAMC,EAA6B,IAAI,IACvC,IAAK,IAAMC,KAAUF,EACnB,GAAIE,EACF,IAAK,IAAMC,KAAa,OAAO,KAAKD,CAAM,EAAG,CAC3C,GAAID,EAAW,IAAIE,CAAS,EAC1B,MAAO,CAAC,EACVF,EAAW,IAAIE,CAAS,CAC1B,CACJ,MAAO,CAAC,CACV,CACA,SAASC,GAAa,EAAO,EAAM,CACjC,GAAIzJ,IAAU,IAAK,GACjB,MAAU,UAAU,GAAGd,EAAK,yBAAyB,CACzD,CACA,SAASwK,GAAgB,EAAO,EAAO,EAAY,CACjD,GAAI,CACF,OAAOd,GAAO5I,CAAK,CACrB,MAAQ,CACN,MAAM,IAAI2J,EAAW,kCAAkCX,GAAO,CAChE,CACF,CACA,SAASY,GAAgB,EAAO,EAAO,EAAY,CACjD,GAAI,CACF,OAAOjV,GAAOqL,CAAK,CACrB,MAAQ,CACN,MAAM,IAAI2J,EAAW,OAAOX,EAAM,iCAAiC,CACrE,CACF,CACA,SAASa,GAAgB,EAAK,EAAY,EAAS,CACjD,IAAIC,EACJ,GAAI,CACF,EAAS,KAAK,MAAM/D,GAAc,OAAO6C,GAAOmB,CAAG,CAAC,CAAC,CACvD,MAAQ,CACN,MAAM,IAAIJ,EAAWnI,CAAO,CAC9B,CACA,GAAI,CAACyH,GAASa,CAAM,EAClB,MAAM,IAAIH,EAAWnI,CAAO,EAC9B,OAAOsI,CACT,CACA,IAAME,GAAiB,CAAE,UAAW,KAAM,IAAK,CAAC,CAAE,EAAGC,GAAiB,CAAE,UAAW,IAAK,EACxF,SAASC,GAAmB,EAAQ,EAAY,CAC9C,GAAIC,IAAe,IAAK,KAAM,CAAC,MAAM,QAAQA,CAAU,GAAKA,EAAW,KAAM,GAAM,OAAOC,GAAK,QAAQ,GACrG,MAAU,UAAU,IAAIC,EAAO,qCAAqC,EACtE,OAAOF,IAAe,IAAK,GAAI,IAAK,GAAI,IAAI,IAAIA,CAAU,CAC5D,CACA,SAASG,GAAuB,EAAK,EAAiB,CACpD,GAAM,CAAE,QAASC,GAAmB,CAAC,EACrC,GAAI,MAAM,QAAQC,CAAI,GAAK,IAAI,IAAIA,CAAI,CAAC,CAAC,OAASA,EAAK,OACrD,MAAM,IAAIC,EAAI,sEAAsE,CACxF,CACA,SAASC,GAAa,EAAK,EAAmB,EAAkB,EAAiB,EAAY,CAC3F,GAAIC,EAAW,OAAS,IAAK,IAAKJ,GAAiB,OAAS,IAAK,GAC/D,MAAM,IAAIE,EAAI,gEAAgE,EAChF,GAAI,CAACF,GAAmBA,EAAgB,OAAS,IAAK,GACpD,MAAO,CAAC,EACV,GAAI,CAAC,MAAM,QAAQA,EAAgB,IAAI,GAAKA,EAAgB,KAAK,SAAW,GAAKA,EAAgB,KAAK,KAAM,GAAU,OAAOxD,GAAS,UAAYA,EAAM,SAAW,CAAC,EAClK,MAAM,IAAI0D,EAAI,uFAAuF,EACvG,IAAMG,EAAaC,IAAqB,IAAK,GAAIC,EAAoB,CAAE,UAAW,KAAM,GAAGD,EAAkB,GAAGC,CAAkB,EAClI,IAAK,IAAMtB,KAAae,EAAgB,KAAM,CAC5C,GAAI,EAAEf,KAAaoB,GACjB,MAAM,IAAI5C,EAAiB,+BAA+BwB,EAAU,oBAAoB,EAC1F,GAAI,CAAC,OAAO,OAAOmB,EAAYnB,CAAS,GAAKmB,EAAWnB,KAAe,IAAK,GAC1E,MAAM,IAAIiB,EAAI,+BAA+BjB,EAAU,aAAa,EACtE,GAAIoB,EAAWpB,KAAe,CAAC,OAAO,OAAOe,EAAiBf,CAAS,GAAKe,EAAgBf,KAAe,IAAK,IAC9G,MAAM,IAAIiB,EAAI,+BAA+BjB,EAAU,8BAA8B,CACzF,CACA,OAAOe,EAAgB,IACzB,CACA,SAASQ,GAAY,EAAiB,EAAY,CAChD,GAAIC,EAAW,SAAS,KAAK,EAAG,CAC9B,IAAMjB,EAAMQ,EAAgB,IAC5B,GAAI,OAAOR,GAAO,UAChB,MAAM,IAAI5B,EAAW,yEAAyE,EAChG,OAAO4B,CACT,CACA,MAAO,CAAC,CACV,CACA,SAASkB,GAAoB,EAAK,EAAQ,CACxC,IAAIC,EAAYpB,EAChB,GAAI,CACF,EAAa,KAAK,UAAUP,CAAM,EAAG,EAAS,KAAK,MAAM2B,CAAU,CACrE,OAASrC,EAAO,CACd,MAAM,IAAI4B,EAAI,gCAAiC,CAAE,OAAM,CAAC,CAC1D,CACA,GAAI,CAACxB,GAASa,CAAM,EAClB,MAAM,IAAIW,EAAI,kCAAkC,EAClD,MAAO,CAACX,EAAQoB,CAAU,CAC5B,CCrGA,IAAMC,GAAO,GAAQpL,EAAI,OAAO,aAAcqL,IAAgB,EAAO,EAAK,IAAU,CAClF,GAAM,CAAE,OAAQC,EAChB,GAAItL,EAAI,MAAQ,IAAK,GAAG,CACtB,IAAMuL,EAAWC,IAAU,QAAUA,IAAU,SAAW,MAAQ,MAClE,GAAIxL,EAAI,MAAQuL,EACd,MAAU,UAAU,sDAAsDA,EAAS,eAAe,CACtG,CACA,GAAIvL,EAAI,MAAQ,IAAK,IAAKA,EAAI,MAAQyL,EACpC,MAAU,UAAU,sDAAsDA,EAAI,eAAe,EAC/F,GAAI,MAAM,QAAQzL,EAAI,OAAO,EAAG,CAC9B,IAAM0L,EAAgBF,IAAU,WAAaA,IAAU,UAAYF,EAAM,MAAME,IAAU,UAAY,EAAI,GAAKA,EAC9G,GAAIE,GAAiB,CAAC1L,EAAI,QAAQ,SAAS0L,CAAa,EACtD,MAAU,UAAU,+DAA+DA,EAAc,eAAe,CACpH,CACF,EACA,eAAeC,GAAW,EAAO,EAAK,EAAO,CAC3C,GAAM,CAAE,MAAK,UAAWL,EAAOM,EAAaJ,IAAU,WAAaA,IAAU,OAC7E,GAAIK,GAAU7L,aAAe,WAC3B,OAAOA,EACT,IAAI8L,EAAYC,EAChB,GAAI7C,GAASlJ,CAAG,EAAG,CACjB,GAAI,EAAagM,GAAahM,CAAG,EAAG,OAAO8L,EAAW,KAAO,SAC3D,MAAMG,GAAeR,EAAKzL,EAAK6L,CAAM,EACvC,GAAI,EAAEA,EAASC,EAAW,MAAQ,OAAS,OAAOA,EAAW,GAAK,SAAWA,EAAW,MAAQ,QAAUF,EAAaE,EAAW,MAAQ,OAAS,OAAOA,EAAW,MAAQ,UAAY,OAAOA,EAAW,GAAK,SAAWA,EAAW,IAAM,IAAK,IAAKA,EAAW,OAAS,IAAK,KAC7Q,MAAU,UAAUD,EAAS,0HAA4H,6CAA6CD,EAAa,UAAY,SAAS,KAAK,EAC/O,GAAIP,GAAaC,EAAOQ,EAAYN,CAAK,EAAGM,EAAW,MAAQ,MAC7D,OAAOjD,GAAOiD,EAAW,CAAC,EAC5B,GAAI,CAAC,OAAO,SAAS9L,CAAG,EAAG,CACzB,GAAM,CAAE,WAAYA,EACpB,MAAM,QAAQkM,CAAO,GAAK,OAAO,OAAOA,CAAO,EAAG,OAAO,OAAOlM,CAAG,CACrE,CACF,KAAO,CACL,GAAI,CAACmM,GAAUnM,CAAG,EAChB,MAAMiM,GAAeR,EAAKzL,EAAK6L,CAAM,EACvC,IAAMO,EAAeP,EAAS,SAAWD,EAAa,UAAY,SAClE,GAAI5L,EAAI,OAASoM,IAAiBP,GAAU,CAAC,SAAU,SAAU,SAAS,CAAC,CAAC,SAAS7L,EAAI,IAAI,GAC3F,MAAU,UAAU,GAAGoL,GAAIpL,CAAG,EAAE,8BAA8BoM,EAAa,YAAYX,EAAI,WAAW,EACxG,GAAIY,GAAYrM,CAAG,EACjB,OAAOA,EACT,GAAI,EAAYA,EAAK+L,EAAU,OAAS,SACtC,OAAOA,EAAU,OAAO,CAC5B,CACA,KAA0B,IAAI,QAC9B,IAAMO,EAAWtM,EACbuM,EAAS1X,GAAM,IAAIyX,CAAQ,EAC/B,GAAIC,IAASd,GACX,OAAOc,EAAOd,GAChB,GAAIc,GAAU1X,GAAM,IAAIyX,EAAU,EAAS,CAAC,CAAC,EAAGP,GAAa,OAAOA,EAAU,aAAe,WAAY,CACvG,IAAMU,EAAWV,EAAU,OAAS,SAAUW,EAAMC,GAAKZ,EAAU,sBAAsB,YAAajN,EAASwM,EAAM,UAAU,CAAE,MAAK,kBAAmBS,EAAU,iBAAkB,CAAC,GAAKT,EAAM,OACjM,MAAO,GAAOG,GAAOM,EAAU,YAAYjN,EAAQ2N,EAAUnB,EAAM,OAAO,IAAiB,CAC7F,CACA,MAAO,KAAeS,EAAU,OAAO,CAAE,OAAQ,KAAM,CAAC,EAAG,EAAW,IAAMN,EAAK,EAAOA,GAAO,MAAMmB,GAAStB,EAAOQ,CAAU,CACjI,CACA,IAAIjX,GACE8X,GAAO,CACX,UAAW,KACX,WAAY,QACZ,UAAW,QACX,UAAW,OACb,EACA,SAASE,GAAgB,EAAK,CAC5B,GAAI,CAACR,GAAYrM,CAAG,EAClB,MAAU,MAAM,6BAA6B,CACjD,CACA,IAAMqM,GAAe,GAAQ,CAC3B,GAAIrM,IAAM,OAAO,eAAiB,YAChC,MAAO,CAAC,EACV,GAAI,CACF,OAAOA,aAAe,SACxB,MAAQ,CACN,MAAO,CAAC,CACV,CACF,EAAG8M,GAAe,GAAQ9M,IAAM,OAAO,eAAiB,YAAamM,GAAa,GAAQE,GAAYrM,CAAG,GAAK8M,GAAY9M,CAAG,EAC7H,SAASyB,GAAQ,EAAK,EAAQ,GAAGsL,EAAO,CACtC,GAAIA,EAAM,OAAS,EAAG,CACpB,IAAMC,EAAOD,EAAM,IAAI,EACvB,GAAO,eAAeA,EAAM,KAAK,IAAI,EAAE,OAAOC,EAAK,EACrD,MAAOD,EAAM,SAAW,EAAI,GAAO,eAAeA,EAAM,GAAG,MAAMA,EAAM,GAAG,GAAK,GAAO,WAAWA,EAAM,GAAG,GAC1G,OAAOE,GAAU,KAAO,GAAO,aAAaA,IAAW,OAAOA,GAAU,YAAcA,EAAO,KAAO,GAAO,sBAAsBA,EAAO,OAAS,OAAOA,GAAU,UAAYA,GAAkBA,EAAO,aAAa,OAAS,GAAO,4BAA4BA,EAAO,YAAY,QAASC,CAC9R,CACA,IAAMC,IAAmB,EAAQ,GAAGJ,IAAUtL,GAAQ,eAAgBwL,EAAQ,GAAGF,CAAK,EACtF,SAASd,GAAe,EAAK,EAAQ,EAAQ,CAC3C,IAAMc,EAAQ,CAAC,YAAa,YAAa,cAAc,EACvD,OAAOlB,GAAUkB,EAAM,KAAK,YAAY,EAAO,UAAUtL,GAAQ,eAAegK,EAAI,qBAAsBwB,EAAQ,GAAGF,CAAK,CAAC,CAC7H,CACA,IAAMK,IAAY,EAAM,EAAO,mBAAyB,UAAU,kDAAkDC,EAAK,WAAWlO,GAAM,EAC1I,SAASmO,GAAW,EAAK,EAAO,CAC9B,GAAI9B,GAAS,CAACxL,EAAI,OAAO,SAASwL,CAAK,EACrC,MAAU,UAAU,sEAAsEA,EAAM,EAAE,CACtG,CACA,SAAS+B,GAAmB,EAAK,EAAK,CACpC,GAAM,CAAE,iBAAkBvN,EAAI,UAC9B,GAAI,OAAOwN,GAAiB,UAAYA,EAAgB,KACtD,MAAU,UAAU,GAAG/B,EAAI,sDAAsD,CACrF,CACA,SAASgC,GAAe,EAAK,EAAU,EAAO,CAC5C,IAAMjG,EAAYxH,EAAI,UACtB,GAAIwH,EAAU,OAAS+D,EAAS,KAC9B,MAAM6B,GAAS7B,EAAS,IAAI,EAC9B,GAAIA,EAAS,MAAQ/D,EAAU,MAAM,OAAS+D,EAAS,KACrD,MAAM6B,GAAS7B,EAAS,KAAM,gBAAgB,EAChD,GAAIA,EAAS,YAAc/D,EAAU,aAAe+D,EAAS,WAC3D,MAAM6B,GAAS7B,EAAS,WAAY,sBAAsB,EAC5D,GAAIA,EAAS,SAAW,IAAK,IAAK/D,EAAU,SAAW+D,EAAS,OAC9D,MAAM6B,GAAS7B,EAAS,OAAQ,kBAAkB,EACpD+B,GAAWtN,EAAKwL,CAAK,CACvB,CACA,SAASkC,GAAY,EAAK,CACxB,MAAO,CAAE,UAAW,KAAM,GAAGC,CAAI,CACnC,CACA,SAAS3B,GAAa,EAAK,CACzB,IAAMF,EAAa4B,GAAYC,CAAG,EAClC,GAAI7B,EAAW,MAAQ,IAAK,IAAK,OAAOA,EAAW,KAAO,UACxD,MAAU,UAAU,iDAAiD,EACvE,GAAIA,EAAW,UAAY,IAAK,GAAG,CACjC,IAAM7L,EAAQ6L,EAAW,QAAS8B,EAAS,MAAM,QAAQ3N,CAAK,EAAI,CAAC,GAAGA,CAAK,EAAI,IAAK,GACpF,GAAI,CAAC2N,GAAUA,EAAO,KAAM,GAAc,OAAOC,GAAa,QAAQ,GAAK,IAAI,IAAID,CAAM,CAAC,CAAC,OAASA,EAAO,OACzG,MAAU,UAAU,yEAAyE,EAC/F,EAAW,QAAUA,CACvB,CACA,OAAO9B,CACT,CACA,SAASgC,GAA0B,EAAa,CAC9C,GAAIC,IAAgB,IAAK,IAAK,OAAOA,GAAe,UAClD,MAAU,UAAU,wCAAwC,EAC9D,OAAOA,CACT,CACA,eAAenB,GAAS,EAAO,EAAK,EAAa,CAC/C,GAAI,CAACtB,EAAM,IAAI,SAASqC,EAAI,GAAG,EAC7B,MAAM,IAAI1F,EAAiB,8DAA8D,EAC3F,IAAMT,EAAY8D,EAAM,UAAU,CAAE,IAAKqC,EAAI,IAAK,IAAKA,EAAI,GAAI,CAAC,GAAKrC,EAAM,OAAQ0C,EAAY,CAAC,EAAEL,EAAI,GAAKA,EAAI,MAAOM,EAAU,CAAE,GAAGN,EAAK,IAAKI,GAAeJ,EAAI,GAAI,EACtK,OAAOM,EAAQ,MAAQ,OAAS,OAAOA,EAAQ,IAAK,OAAOA,EAAQ,IAAK,OAAO,OAAO,UAAU,MAAOA,EAASzG,EAAWyG,EAAQ,KAAO,CAACD,EAAWL,EAAI,SAAWrC,EAAM,OAAO,KAAkB,CACtM,CACA,eAAe4C,GAAO,EAAK,EAAU,EAAO,EAAc,CAAC,EAAG,CAC5D,OAAOlO,aAAe,aAAe,EAAM,MAAM,OAAO,OAAO,UAAU,MAAOA,EAAKuL,EAAUwC,EAAa,CAACvC,CAAK,CAAC,GAAIiC,GAAezN,EAAKuL,EAAUC,CAAK,EAAGxL,CAC/J,CCvIA,IAAMmO,GAAe,GAAQ,OAAO,gBAAgB,IAAI,WAAWC,EAAI,SAAW,CAAC,CAAC,EACpF,SAASC,GAAe,EAAK,EAAU,CACrC,IAAMpB,EAASqB,EAAI,YAAc,EACjC,GAAIrB,IAAW1B,EACb,MAAM,IAAIpD,EAAW,mDAAmDoD,EAAS,aAAa0B,EAAO,MAAM,CAC/G,CACA,IAAMsB,GAAc,GAAQ,OAAO,gBAAgB,IAAI,WAAWH,EAAI,QAAU,CAAC,CAAC,EAClF,SAASI,GAAc,EAAK,EAAI,CAC9B,GAAIC,EAAG,QAAU,IAAML,EAAI,OACzB,MAAM,IAAIjG,EAAW,sCAAsC,CAC/D,CACA,eAAeuG,GAAY,EAAK,EAAK,EAAO,CAC1C,GAAI,EAAEJ,aAAe,YACnB,MAAU,UAAUnB,GAAgBmB,EAAK,YAAY,CAAC,EACxD,IAAMK,EAAUP,EAAI,SAAW,EAI/B,MAAO,CAAC,MAJyC,OAAO,OAAO,UAAU,MAAOE,EAAI,SAASK,GAAW,CAAC,EAAG,UAAW,CAAC,EAAG,CAACnD,CAAK,CAAC,EAIlH,MAJoI,OAAO,OAAO,UAAU,MAAO8C,EAAI,SAAS,EAAGK,GAAW,CAAC,EAAG,CAChN,KAAM,OAAOA,GAAW,IACxB,KAAM,MACR,EAAG,CAAC,EAAG,CAAC,MAAM,CAAC,EACSA,CAAO,CACjC,CACA,eAAeC,GAAW,EAAQ,EAAS,EAAS,CAClD,OAAO,IAAI,YAAY,MAAM,OAAO,OAAO,KAAK,OAAQC,EAAQC,CAAO,EAAA,CAAG,MAAM,EAAGH,GAAW,CAAC,CAAC,CAClG,CACA,eAAeI,GAAW,EAAK,EAAW,EAAK,EAAI,EAAK,CACtD,GAAM,CAACC,EAAQH,EAAQF,GAAW,MAAMD,GAAYN,EAAKE,EAAK,SAAS,EAAGW,EAAa,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,CAChI,KACA,KAAM,SACR,EAAGD,EAAQE,CAAS,CAAC,EACrB,MAAO,CAAE,aAAY,IAAA,MADgFN,GAAWC,EAA9E3I,GAAOiJ,EAAKV,EAAIQ,EAAY1I,GAAS4I,EAAI,OAAS,CAAC,CAAyC,EAAGR,CAAO,EAC9G,IAAG,CAC/B,CACA,eAAeS,GAAgB,EAAG,EAAG,CACnC,IAAM5H,EAAY,CAAE,KAAM,OAAQ,KAAM,SAAU,EAAGxH,EAAM,MAAM,OAAO,OAAO,YAAYwH,EAAW,CAAC,EAAG,CAAC,OAAQ,QAAQ,CAAC,EAAG6H,EAAQ,MAAM,OAAO,OAAO,KAAK7H,EAAWxH,EAAKuD,CAAC,EACjL,OAAO,OAAO,OAAO,OAAOiE,EAAWxH,EAAKqP,EAAO7L,CAAC,CACtD,CACA,eAAe8L,GAAW,EAAK,EAAK,EAAY,EAAI,EAAK,EAAK,CAC5D,GAAM,CAACN,EAAQH,EAAQF,GAAW,MAAMD,GAAYN,EAAKE,EAAK,SAAS,EAAoEiB,EAAc,MAAMX,GAAWC,EAAtF3I,GAAOiJ,EAAKV,EAAIQ,EAAY1I,GAAS4I,EAAI,OAAS,CAAC,CAAiD,EAAGR,CAAO,EAClM,GAAI,CACF,GAAI,MAAMS,GAAgBhE,EAAKmE,CAAW,EACxC,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,CAAE,KAAI,KAAM,SAAU,EAAGP,EAAQC,CAAU,CAAC,CAClG,MAAQ,CACR,CACA,MAAM,IAAI/G,EACZ,CACA,eAAesH,GAAQ,EAAK,EAAW,EAAK,EAAI,EAAK,CACnD,GAAI,CAACnD,GAAYiC,CAAG,GAAK,EAAEA,aAAe,YACxC,MAAU,UAAUnB,GAAgBmB,EAAK,YAAa,YAAa,aAAc,cAAc,CAAC,EAClG,GAAIG,EAAKD,GAAcJ,EAAKK,CAAE,EAAI,EAAKF,GAAWH,CAAG,EAAGE,aAAe,YAAcD,GAAeC,EAAKF,EAAI,OAAO,EAAGA,EAAI,IACzH,OAAOW,GAAWX,EAAKc,EAAWZ,EAAKG,EAAIU,CAAG,EAChD,IAAMH,EAAS,MAAMd,GAAOI,EAAKF,EAAI,OAAQ,SAAS,EAAGqB,EAAY,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,CAC9G,eAAgBN,EAChB,KACA,KAAM,UACN,UAAW,GACb,EAAGH,EAAQE,CAAS,CAAC,EACrB,MAAO,CAAE,WAAYO,EAAU,SAAS,EAAG,GAAG,EAAG,IAAKA,EAAU,SAAS,GAAG,EAAG,IAAG,CACpF,CACA,eAAeC,GAAQ,EAAK,EAAK,EAAY,EAAI,EAAK,EAAK,CACzD,GAAI,CAACrD,GAAYiC,CAAG,GAAK,EAAEA,aAAe,YACxC,MAAU,UAAUnB,GAAgBmB,EAAK,YAAa,YAAa,aAAc,cAAc,CAAC,EAClG,GAAI,CAACG,EACH,MAAM,IAAItG,EAAW,mCAAmC,EAC1D,GAAI,CAACiD,EACH,MAAM,IAAIjD,EAAW,gCAAgC,EACvD,GAAI,CAACiG,EAAI,KAAOhD,EAAI,SAAW,GAC7B,MAAM,IAAIjD,EAAW,mCAAmC,EAC1D,GAAIqG,GAAcJ,EAAKK,CAAE,EAAGH,aAAe,YAAcD,GAAeC,EAAKF,EAAI,OAAO,EAAGA,EAAI,IAC7F,OAAOkB,GAAWlB,EAAKE,EAAKW,EAAYR,EAAIrD,EAAK+D,CAAG,EACtD,IAAMH,EAAS,MAAMd,GAAOI,EAAKF,EAAI,OAAQ,SAAS,EACtD,GAAI,CACF,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,CAChD,eAAgBe,EAChB,KACA,KAAM,UACN,UAAW,GACb,EAAGH,EAAQ9I,GAAO+I,EAAY7D,CAAG,CAAC,CAAC,CACrC,MAAQ,CACN,MAAM,IAAIlD,EACZ,CACF,CCjFA,SAASyH,GAAM,EAAS,CACtB,IAAM5O,EAAM,CAAE,UAAW,IAAK,EAC9B,IAAK,IAAM0K,KAAO9L,EAChB,EAAI8L,GAAO,CAAE,GAAG9L,EAAQ8L,GAAM,KAAI,EACpC,OAAO1K,CACT,CCHA,IAAM6O,GAAO,CACX,CAAC,UAAW,SAAS,EACrB,CAAC,UAAW,WAAW,CACzB,EAAGC,GAAS,CAAC,CAAC,EAAG,CAAC,YAAY,CAAC,EAAGC,GAAO,CAAC,CAAC,EAAG,CAAC,CAAC,EAChD,SAASC,GAAM,EAAM,CACnB,MAAO,CACL,IAAK,CAAC,KAAK,EACX,KAAM,iBACN,OAAQ,CAAE,KAAM,WAAY,KAAM,OAAOC,GAAO,EAChD,OAAQJ,GACR,IAAK,CAAC,UAAW,WAAW,CAC9B,CACF,CACA,SAASK,GAAK,EAAM,CAClB,MAAO,CACL,IAAK,CAAC,KAAM,KAAK,EACjB,OACA,OAAQ,CAAE,KAAM,MAAO,EACvB,SAAU,CAAE,MAAK,MAAK,uBAAwB,CAC5C,GAAIvD,IAAQ,UAAYwD,IAAsB,SAC5C,MAAO,CAAE,KAAM,QAAS,EAC1B,GAAIC,IAAQ,MACV,MAAM,IAAIlI,EAAiB,8DAA8D,EAC3F,MAAO,CAAE,KAAM,OAAQ,WAAYyE,CAAI,CACzC,EACA,OAAQmD,GACR,IAAK,CAAC,IAAK,GAAG,YAAY,CAC5B,CACF,CACA,SAASO,GAAM,EAAM,EAAM,CAAC,EAAG,CAC7B,MAAO,CACL,IAAK,CAAC,KAAK,EACX,KAAM,eACN,OAAQ,CAAC,EACT,OAAQ,CAAE,KAAMC,EAAM,UAAY,SAAU,OAAQL,CAAK,EACzD,OAAQF,GACR,IAAKO,EAAM,CAAC,UAAW,SAAS,EAAI,CAAC,UAAW,WAAW,CAC7D,CACF,CACA,SAASC,IAAQ,CACf,MAAO,CACL,IAAK,CAAC,KAAK,EACX,KAAM,eACN,OAAQ,CAAC,EACT,OAAQ,CAAE,KAAM,QAAS,EACzB,OAAQR,GACR,IAAK,CAAC,aAAc,YAAY,CAClC,CACF,CACA,IAAMS,GAAMZ,GAAM,CAChB,IAAK,CACH,IAAK,CAAC,KAAK,EACX,KAAM,oBACN,OAAQ,CAAC,EACT,OAAQ,CAAE,KAAM,SAAU,EAC1B,OAAQG,GACR,IAAK,CAAC,UAAW,SAAS,CAC5B,EACA,WAAYC,GAAM,CAAC,EACnB,eAAgBA,GAAM,GAAG,EACzB,eAAgBA,GAAM,GAAG,EACzB,eAAgBA,GAAM,GAAG,EACzB,UAAWE,GAAK,sBAAsB,EACtC,iBAAkBA,GAAK,iCAAiC,EACxD,iBAAkBA,GAAK,iCAAiC,EACxD,iBAAkBA,GAAK,iCAAiC,EACxD,OAAQG,GAAM,GAAG,EACjB,OAAQA,GAAM,GAAG,EACjB,OAAQA,GAAM,GAAG,EACjB,UAAWA,GAAM,IAAK,CAAC,CAAC,EACxB,UAAWA,GAAM,IAAK,CAAC,CAAC,EACxB,UAAWA,GAAM,IAAK,CAAC,CAAC,EACxB,qBAAsBE,GAAM,EAC5B,qBAAsBA,GAAM,EAC5B,qBAAsBA,GAAM,CAC9B,CAAC,EAAGE,GAAa,CAAC,UAAW,SAAS,EACtC,SAASC,GAAkB,EAAM,EAAM,CAAC,EAAG,CACzC,MAAO,CACL,IAAK,CAAC,KAAK,EACX,OAAQ,CAAC,EACT,OAAQ,CAAE,KAAMC,EAAM,UAAY,UAAW,OAAQV,CAAK,EAC1D,OAAQF,GACR,IAAKU,GACL,QAASR,EACT,OAAQU,EAAM,IAAM,GACpB,KACF,CACF,CACA,IAAMC,GAAMhB,GAAM,CAChB,QAASc,GAAkB,GAAG,EAC9B,QAASA,GAAkB,GAAG,EAC9B,QAASA,GAAkB,GAAG,EAC9B,gBAAiBA,GAAkB,IAAK,CAAC,CAAC,EAC1C,gBAAiBA,GAAkB,IAAK,CAAC,CAAC,EAC1C,gBAAiBA,GAAkB,IAAK,CAAC,CAAC,CAC5C,CAAC,EACD,SAASG,GAAY,EAAW,EAAM,CACpC,MAAM,IAAI3I,EAAiB,2BAA2BwB,EAAU,SAAStK,EAAK,eAAe,CAC/F,CACA,SAAS0R,GAAa,EAAK,CACzB,OAAQ,OAAOpF,GAAO,SAAW8E,GAAI9E,GAAO,IAAK,KAAMmF,GAAY,MAAO,WAAW,CACvF,CACA,SAASE,GAAkB,EAAW,CACpC,OAAOtJ,EAAU,OAAS,gBAAkBA,EAAU,OAAS,kBAAoBA,EAAU,OAAS,iCACxG,CACA,SAASuJ,GAAc,EAAK,CAC1B,OAAQ,OAAO3C,GAAO,SAAWuC,GAAIvC,GAAO,IAAK,KAAMwC,GAAY,MAAO,sBAAsB,CAClG,CCtGA,SAASI,GAAmB,EAAK,EAAO,CACtC,GAAIhR,EAAI,UAAU,OAAS,QAAUA,EAAI,UAAU,OAAS,SAC1D,MAAU,UAAU,sFAAsF,EAC5GsN,GAAWtN,EAAKwL,CAAK,CACvB,CACA,eAAeyF,GAAU,EAAK,EAAK,EAAK,CACtC,IAAMC,EAAY,MAAMhD,GAAOlO,EAAK6Q,GAAapF,CAAG,CAAC,CAAC,OAAQ,UAAW,CAAC,CAAC,EAAG0F,EAAe,MAAM,OAAO,OAAO,UAAU,MAAO7C,EAAK,CAAE,KAAM,UAAW,KAAM,MAAO,EAAG,CAAC,EAAG,CAAC,MAAM,CAAC,EACtL,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,MAAO6C,EAAcD,EAAW,QAAQ,CAAC,CAC7F,CACA,eAAeE,GAAY,EAAK,EAAK,EAAc,CACjD,IAAMF,EAAY,MAAMhD,GAAOlO,EAAK6Q,GAAapF,CAAG,CAAC,CAAC,OAAQ,YAAa,CAAC,CAAC,EAAG0F,EAAe,MAAM,OAAO,OAAO,UAAU,MAAOE,EAAcH,EAAW,SAAU,CAAE,KAAM,UAAW,KAAM,MAAO,EAAG,CAAC,EAAG,CAAC,MAAM,CAAC,EACtN,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,UAAU,MAAOC,CAAY,CAAC,CAC1E,CACA,SAASG,GAAY,EAAK,EAAK,EAAO,CACpC7D,GAAezN,EAAK6Q,GAAapF,CAAG,CAAC,CAAC,OAAQD,CAAK,EAAG+B,GAAmB9B,EAAKzL,CAAG,CACnF,CACA,eAAeuR,GAAU,EAAK,EAAK,EAAK,EAAK,CAC3C,GAAI,EAAEC,aAAe,aAAeA,EAAI,OAAS,EAC/C,MAAM,IAAIrJ,EAAW,2CAA2C,EAClE,GAAI,CAAC,OAAO,cAAcsJ,CAAG,GAAK,KAAK,KAAKA,CAAG,IAAM,EACnD,MAAM,IAAItJ,EAAW,8CAA8C,EACrE,IAAMzF,EAAOwD,GAAOpR,GAAO2W,CAAG,EAAG,WAAW,GAAG,CAAC,EAAG+F,CAAG,EAAGE,EAAS,SAASjG,EAAI,MAAM,GAAI,EAAE,EAAG,EAAE,EAAGkG,EAAY,CAC7G,KAAM,OAAOlG,EAAI,MAAM,EAAG,EAAE,IAC5B,WAAYgG,EACZ,KAAM,SACN,MACF,EAAGP,EAAY,MAAMhD,GAAOlO,EAAK6Q,GAAapF,CAAG,CAAC,CAAC,OAAQ,YAAY,EACvE,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,WAAWkG,EAAWT,EAAWQ,CAAM,CAAC,CACpF,CACA,SAASE,GAAe,EAAO,CAC7B,OAAO1L,GAAOQ,GAASM,EAAM,MAAM,EAAGA,CAAK,CAC7C,CACA,eAAe6K,GAAU,EAAG,EAAG,EAAW,CACxC,IAAMC,EAAQC,GAAK,EAAiBC,EAAO,KAAK,KAAKF,EAAQ,EAAO,EAAGG,EAAK,IAAI,WAAWD,EAAO,EAAO,EACzG,IAAK,IAAInR,EAAI,EAAGA,GAAKmR,EAAM,IAAK,CAC9B,IAAME,EAAa,MAAM5K,GAAO,SAAUpB,GAAOQ,GAAS7F,CAAC,EAAGsR,EAAGC,CAAS,CAAC,EAC3EH,EAAG,IAAIC,GAAarR,EAAI,GAAK,EAAO,CACtC,CACA,OAAOoR,EAAG,MAAM,EAAGH,CAAK,CAC1B,CACA,eAAeO,GAAgB,EAAW,EAAY,EAAW,EAAW,EAAM,IAAI,WAAc,EAAM,IAAI,WAAc,CAC1HrB,GAAmBsB,CAAS,EAAGtB,GAAmBpF,EAAY,YAAY,EAC1E,IAAM2G,EAAYrM,GAAO0L,GAAe9c,GAAO0S,CAAS,CAAC,EAAGoK,GAAeY,CAAG,EAAGZ,GAAea,CAAG,EAAG/L,GAASgM,CAAS,CAAC,EAIzH,OAAOb,GAAU,IAJmH,WAAW,MAAM,OAAO,OAAO,WAAW,CAC5K,KAAMS,EAAU,UAAU,KAC1B,OAAQA,CACV,EAAG1G,EAAY0G,EAAU,UAAU,OAAS,SAAW,IAAM,KAAK,KAAK,SAASA,EAAU,UAAU,WAAW,MAAM,EAAE,EAAG,EAAE,EAAI,CAAC,GAAK,CAAC,CACtH,EAAGI,EAAWH,CAAS,CAC1C,CACA,SAASI,GAAc,EAAK,CAC1B9F,GAAgB7M,CAAG,EACnB,IAAM4S,EAAQ5S,EAAI,UAAU,WAC5B,GAAI4S,IAAU,SAAWA,IAAU,SAAWA,IAAU,SAAW5S,EAAI,UAAU,OAAS,SACxF,MAAM,IAAIiI,EAAiB,uFAAuF,CACtH,CACA,SAAS4K,GAAU,EAAY,EAAM,CACnC,IAAM5S,EAAQ2K,EAAWzL,GACzB,GAAIc,IAAU,IAAK,GAAG,CACpB,GAAI,OAAOA,GAAS,SAClB,MAAM,IAAIkI,EAAW,gBAAgBhJ,EAAK,oBAAoBA,IAAS,MAAQ,IAAM,IAAI,cAAc,EACzG,OAAOwK,GAAgB1J,EAAOd,EAAMgJ,CAAU,CAChD,CACF,CACA,SAAS2K,GAAe,EAAK,EAAK,CAChC,GAAMN,IAAQ,IAAK,IAAKC,IAAQ,IAAK,IAAKD,EAAI,aAAeC,EAAI,WAAa,CAC5E,IAAK,IAAI5R,EAAI,EAAGA,EAAI2R,EAAI,WAAY,IAClC,GAAIA,EAAI3R,KAAO4R,EAAI5R,GACjB,OACJ,MAAM,IAAIsH,EAAW,qDAAqD,CAC5E,CACF,CACA,SAAS4K,GAAmB,EAAc,CACxC,GAAI1B,IAAiB,IAAK,GACxB,MAAM,IAAIlJ,EAAW,2BAA2B,CACpD,CACA,SAAS6K,GAAqB,EAAc,CAC1C,GAAI3B,IAAiB,IAAK,GACxB,MAAM,IAAIlJ,EAAW,0CAA0C,CACnE,CACA,SAAS8K,GAAsB,EAAO,CACpC,GAAIhT,IAAU,IAAK,IAAKA,IAAU,EAAI,IAAM,CAAC,OAAO,cAAcA,CAAK,GAAKA,EAAQ,GAClF,MAAU,UAAU,2DAA2D,CACnF,CACA,eAAeiT,GAAqB,EAAO,EAAK,EAAK,EAAc,EAAY,EAAe,CAC5F,GAAM,CAAE,OAAQ5H,EAAO6H,EAAO7H,EAAM,KACpC,GAAI6H,IAAS,oBACX,OAAOH,GAAqB3B,CAAY,EAAGrR,EAC7C,IAAMoT,EAASD,IAAS,uBACxB,OAAQC,EAASJ,GAAqB3B,CAAY,EAAI0B,GAAmB1B,CAAY,EAAG/F,EAAM,OAAO,KAArG,CACE,IAAK,OAAQ,CACX,GAAM,CAAE,OAAQV,EAChB,GAAI,CAAC1B,GAASmK,CAAG,GAAK,CAAC,IAAK,IAAK,IAAK,IAAK,KAAM,KAAM,KAAM,MAAO,MAAM,CAAC,CAAC,KAAM,GAAc,OAAO,OAAOA,EAAK5J,CAAS,CAAC,EAC3H,MAAM,IAAItB,EAAW,6DAA6D,EACpFwK,GAAc3S,CAAG,EACjB,IAAMsT,EAAqB,MAAM1G,GAAStB,EAAO+H,CAAG,EAAGE,EAAaV,GAAUjI,EAAY,KAAK,EAAG4I,EAAaX,GAAUjI,EAAY,KAAK,EAC1IkI,GAAeS,EAAYC,CAAU,EACrC,IAAMC,EAAe,MAAMpB,GAAgBiB,EAAoBtT,EAAKoT,EAAShF,EAAI,IAAM3C,EAAK2H,EAAShF,EAAI,QAAU,SAAS3C,EAAI,MAAM,GAAI,EAAE,EAAG,EAAE,EAAG8H,EAAYC,CAAU,EAC1K,GAAIJ,EACF,OAAOK,EACT,EAAMA,EACN,KACF,CACA,IAAK,WACH,OAAO5G,GAAgB7M,CAAG,EAAGsR,GAAY7F,EAAKzL,EAAK,SAAS,EAAG,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,WAAYA,EAAKqR,CAAY,CAAC,EAC1I,IAAK,SAAU,CACb,GAAI,OAAOzG,EAAW,KAAO,SAC3B,MAAM,IAAIzC,EAAW,oDAAoD,EAC3E8K,GAAsBS,CAAa,EACnC,IAAMC,EAAWD,GAAiB,IAClC,GAAI9I,EAAW,IAAM+I,EACnB,MAAM,IAAIxL,EAAW,6DAA6D,EACpF,GAAI,OAAOyC,EAAW,KAAO,SAC3B,MAAM,IAAIzC,EAAW,mDAAmD,EAE1E,EAAM,MAAMoJ,GADA5H,GAAgBiB,EAAW,IAAK,MAAOzC,CAC3B,EAAGsD,EAAKb,EAAW,IAAK5K,CAAG,EACnD,KACF,CACA,IAAK,UAAW,CACd,GAAI,OAAO4K,EAAW,IAAM,SAC1B,MAAM,IAAIzC,EAAW,6DAA6D,EACpF,GAAI,OAAOyC,EAAW,KAAO,SAC3B,MAAM,IAAIzC,EAAW,2DAA2D,EAClF,IAAMsG,EAAK9E,GAAgBiB,EAAW,GAAI,KAAMzC,CAAU,EAAGiD,EAAMzB,GAAgBiB,EAAW,IAAK,MAAOzC,CAAU,EACpH,GAAIsG,EAAG,aAAe,GACpB,MAAM,IAAItG,EAAW,sCAAsC,EAC7D,GAAIiD,EAAI,aAAe,GACrB,MAAM,IAAIjD,EAAW,mCAAmC,EAC1D,OAAOuH,GAAQqB,GAActF,EAAI,MAAM,EAAG,EAAE,CAAC,EAAGzL,EAAKqR,EAAc5C,EAAIrD,EAAK,IAAI,UAAY,CAC9F,CACF,CACA,OAAOgG,GAAY3F,EAAI,MAAM,EAAE,EAAGzL,EAAKqR,CAAY,CACrD,CACA,eAAeuC,GAAqB,EAAO,EAAK,EAAU,EAAY,EAAa,EAAqB,CAAC,EAAG,CAC1G,GAAM,CAAE,MAAK,QAAStI,EAAOuI,EAAY/C,GAAkBxF,CAAK,EAChE,GAAIwI,IAAgB,IAAK,IAAK,CAACD,EAC7B,MAAU,UAAU,8EAA8EpI,GAAK,EACzG,IAAIzL,EAAM,MAAM2L,GAAWwH,IAAS,oBAAsB/E,EAAM9C,EAAOyI,EAAU,SAAS,EAC1F,GAAIZ,IAAS,oBACX,MAAO,CAACnT,EAAK,IAAK,GAAG,IAAK,EAAC,EAC7B,IAAMsO,EAAMuF,EAAYC,GAAe3F,GAAYC,CAAG,EAAI,IAAK,GAC/DE,GAAOD,GAAeC,EAAKF,EAAI,OAAO,EACtC,IAAIiD,EAAc9H,EAClB,OAAQ+B,EAAM,OAAO,KAArB,CACE,IAAK,OAAQ,CACXqH,GAAc3S,CAAG,EACjB,GAAM,CAAE,IAAKgU,EAAa,IAAKC,GAAgBC,EAC/CF,IAAgB,IAAK,IAAKhL,GAAiBgL,EAAa,OAAO,EAAGC,IAAgB,IAAK,IAAKjL,GAAiBiL,EAAa,OAAO,EACjI,IAAMzB,EAAMwB,GAAenB,GAAUjI,EAAY,KAAK,EAAG6H,EAAMwB,GAAepB,GAAUjI,EAAY,KAAK,EACzGkI,GAAeN,EAAKC,CAAG,EACvB,IAAI0B,EACJ,AAAoCA,EAApCD,EAAmB,MAAQ,IAAK,IAAgG,MAAM,OAAO,OAAO,YAAYlU,EAAI,UAAW,CAAC,EAAG,CAAC,YAAY,CAAC,EAAA,CAAG,WAAjJ,MAAM2L,GAAWL,EAAO4I,EAAmB,IAAK,SAAS,EAC5G,IAAME,EAAS,OAAO,OAClBC,EAAgBF,EACpB,GAAI,CAACE,EAAc,YAAa,CAC9B,GAAI,OAAOD,EAAO,cAAgB,WAChC,MAAU,UAAU,yCAAyC,EAC/D,EAAgB,MAAMA,EAAO,aAAaD,EAAc,CAAC,CAAC,CAC5D,CACA,GAAM,CAAE,IAAG,IAAG,MAAK,OAAQ,MAAMC,EAAO,UAAU,MAAOC,CAAa,EAAGjB,EAASD,IAAS,uBAAwBM,EAAe,MAAMpB,GAAgBrS,EAAKmU,EAAcf,EAAShF,EAAI,IAAM3C,EAAK2H,EAAShF,EAAI,QAAU,SAAS3C,EAAI,MAAM,GAAI,EAAE,EAAG,EAAE,EAAG+G,EAAKC,CAAG,EAAGY,EAAM,CAAE,IAAG,MAAK,KAAI,EAC1R,GAAIlD,IAAQ,OAAS,EAAI,EAAImE,GAAI,EAAa,CAAE,KAAI,EAAGN,IAAgB,IAAK,KAAM,EAAW,IAAMjf,EAAKif,CAAW,GAAIC,IAAgB,IAAK,KAAM,EAAW,IAAMlf,EAAKkf,CAAW,GAAIb,EACrL,MAAO,CAACK,EAAc,IAAK,GAAGlK,CAAU,EAC1C,EAAMkK,EACN,KACF,CACA,IAAK,WACH5G,GAAgB7M,CAAG,EAAGsR,GAAY7F,EAAKzL,EAAK,SAAS,EAAG,EAAe,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,WAAYA,EAAKsO,CAAG,CAAC,EACvI,MAEF,IAAK,SAAU,CACb,GAAM,CAAE,MAAM,KAAM,MAAM,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,GAAM4F,EACzE,EAAM,MAAM3C,GAAUC,EAAK/F,EAAKgG,EAAKzR,CAAG,EAAG,EAAa,CAAE,MAAK,IAAKjL,EAAKyc,CAAG,CAAE,EAC9E,KACF,CACA,IAAK,UAAW,CACd,IAAM/C,EAAKyF,EAAmB,KAAO,IAAK,GAAI,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAAIA,EAAmB,GAC9G,GAAI,EAAEzF,aAAc,YAClB,MAAU,UAAU,wCAAwC,EAC9D,IAAM8F,EAAU,MAAM/E,GAAQuB,GAActF,EAAI,MAAM,EAAG,EAAE,CAAC,EAAG6C,EAAKtO,EAAKyO,EAAI,IAAI,UAAY,EAC7F,EAAe8F,EAAQ,WAAY,EAAa,CAAE,GAAIxf,EAAKwf,EAAQ,EAAE,EAAG,IAAKxf,EAAKwf,EAAQ,GAAG,CAAE,CACjG,CACF,CACA,GAAI,IAAiB,MAAMtD,GAAUxF,EAAI,MAAM,EAAE,EAAGzL,EAAKsO,CAAG,EAAG,EAAE+C,aAAwB,aAAe,CAACA,EAAa,WACpH,MAAU,UAAU,+DAA+D,EACrF,MAAO,CAAC/C,EAAK+C,EAAc9H,CAAU,CACvC,CC5LA,SAASiL,GAAY,EAAY,EAAiB,CAChD,GAAI5J,EAAW,MAAQ,IAAK,IAAKA,EAAW,MAAQ,MAClD,MAAM,IAAI3C,EAAiB,uEAAuE,EACpG,GAAI2C,EAAW,MAAQ,IAAK,IAAK,CAACJ,GAAiB,IACjD,MAAM,IAAIrC,EAAW,mFAAmF,CAC5G,CACA,SAASsM,GAAU,EAAM,CACvB,GAAI,OAAO,WAAWtV,GAAQ,IAC5B,MAAM,IAAI8I,EAAiB,mEAAmE9I,EAAK,MAAM,CAC7G,CACA,eAAenK,GAAU,EAAQ,EAAO,EAAY,EAAI,EAAG,CACzD,IAAM2f,EAASC,EAAO,SAAS,UAAU,EACzCD,EAAO,MAAM3N,CAAK,CAAC,CAAC,UAAY,CAChC,CAAC,EAAG2N,EAAO,MAAM,CAAC,CAAC,UAAY,CAC/B,CAAC,EACD,IAAME,EAAS,CAAC,EACZhT,EAAS,EACPiT,EAASF,EAAO,SAAS,UAAU,EACzC,OAAW,CACT,GAAM,CAAE,QAAO,QAAS,MAAME,EAAO,KAAK,EAC1C,GAAIC,EACF,MACF,GAAIF,EAAO,KAAK5U,CAAK,EAAG,GAAUA,EAAM,WAAY+U,IAAc,EAAI,GAAKnT,EAASmT,EAClF,MAAM,IAAI7M,EAAW,sDAAsD,CAC/E,CACA,OAAOjC,GAAO,GAAG2O,CAAM,CACzB,CACA,eAAeI,GAAS,EAAO,CAC7B,OAAOR,GAAU,mBAAmB,EAAGzf,GAAU,IAAI,kBAAkB,aAAa,EAAGgS,CAAK,CAC9F,CACA,eAAekO,GAAW,EAAO,EAAW,CAC1C,OAAOT,GAAU,qBAAqB,EAAGzf,GAAU,IAAI,oBAAoB,aAAa,EAAGgS,EAAOgO,CAAS,CAC7G,CCyBA,SAASG,GAAS,EAAK,CACrB,GAAM,CAAE,UAAWC,EAAkB,aAAY,KAAI,MAAK,OAAQC,EAC9DC,EACJ,OAAOF,IAAqB,IAAK,KAAM,EAAatL,GAAgBsL,EAAkBjN,EAAY,iCAAiC,GAAI,CACrImN,EACA3L,GAAgBsF,EAAY,aAAc9G,CAAU,EACpDsG,IAAO,IAAK,GAA4C,IAAK,GAA7C9E,GAAgB8E,EAAI,KAAMtG,CAAU,EACpDiD,IAAQ,IAAK,GAA8C,IAAK,GAA/CzB,GAAgByB,EAAK,MAAOjD,CAAU,EACvD0B,IAAiBuL,GAAoB,KAAOjG,IAAQ,IAAK,GAAgB,GAAZ,IAAIA,KAAa,MAAOhH,CAAU,CACjG,CACF,CACA,SAASoN,GAAe,EAAS,CAC/B,MAAO,CACL7N,GAAWyC,GAAmB,0BAA2BzC,EAAQ,uBAAuB,EACxFA,GAAWyC,GAAmB,8BAA+BzC,EAAQ,2BAA2B,EAChGA,GAAS,KACTA,GAAS,cACTA,GAAS,qBACX,CACF,CACA,eAAe8N,GAAW,EAAK,EAAQ,EAAK,EAAQL,GAASE,CAAG,EAAG,CACjE,GAAM,CAACC,EAAYrG,EAAYR,EAAIrD,EAAKqK,GAAkBC,EAAO,CAAE,SAAQ,cAAa,OAAQL,EAC5FzK,EACJ,GAAIpB,IAAW,IAAK,IAAKmM,IAAgB,IAAK,GAAG,CAC/C,GAAI,CAACtM,GAAWiM,EAAY9L,EAAQmM,CAAW,EAC7C,MAAM,IAAIxN,EAAW,kHAAkH,EACzI,EAAa,CAAE,GAAGmN,EAAY,GAAG9L,EAAQ,GAAGmM,CAAY,CAC1D,KACE,GAAaL,GAAc,CAAC,EAC9B,GAAM,CAACM,EAAyBC,EAA6BpL,EAAMiJ,EAAeoC,GAAyBC,EAAQ,CAAE,cAAeC,GAAeX,EACnJ1K,GAAaxC,EAAY+B,GAAgBO,EAAM6K,EAAY1K,CAAU,EAAG4J,GAAY5J,EAAY0K,CAAU,EAC1G,GAAM,CAAE,MAAK,OAAQ1K,EACrB,GAAI,OAAOa,GAAO,UAAY,CAACA,EAC7B,MAAM,IAAItD,EAAW,2CAA2C,EAClE,IAAM8N,EAAW1F,GAAI9E,GACrB,GAAIuK,IAAe,KAAO,CAACC,GAAY,CAACnF,GAAkBmF,CAAQ,GAChE,MAAM,IAAI9N,EAAW,kCAAkC,EACzD,IAAM+N,EAAaD,GAAU,OAAS,wBACtC,GAAI,CAACC,IAAe,OAAO9H,GAAO,UAAY,CAACA,GAC7C,MAAM,IAAIjG,EAAW,sDAAsD,EAC7E,GAAIyN,GAA2B,CAACA,EAAwB,IAAInK,CAAG,GAAK,CAACmK,GAA2BnK,EAAI,WAAW,OAAO,EACpH,MAAM,IAAIzD,GAAkB,sDAAsD,EACpF,IAAImO,EACJ,GAAID,EAAY,CACd,GAAI9H,IAAQ,IAAK,GACf,MAAM,IAAIjG,EAAW,iGAAiG,EACxH,GAAIsG,GAAI,WACN,MAAM,IAAItG,EAAW,mEAAmE,EAC1F,GAAIiD,GAAK,WACP,MAAM,IAAIjD,EAAW,gEAAgE,CACzF,KAAO,CACL,GAAI0N,GAA+B,CAACA,EAA4B,IAAIzH,CAAG,EACrE,MAAM,IAAIpG,GAAkB,iEAAiE,EAC/F,EAAW+I,GAAc3C,CAAG,CAC9B,CACA,IAAIiD,EACJ,GAAI2E,IAAe,IAAK,GACtB,GAAI,CACF,EAAerM,GAAgBqM,EAAY,gBAAiB7N,CAAU,CACxE,OAASiO,EAAO,CACd,GAAI,CAACH,GAAY,CAACnF,GAAkBmF,CAAQ,EAC1C,MAAMG,EACR,EAAe,IAAI,UACrB,CACF,IAAIC,EAAc,CAAC,EACnB,OAAOrW,GAAO,aAAe,EAAM,MAAMA,EAAIsV,EAAYD,CAAG,EAAG,EAAc,CAAC,GAC9E,IAAMiB,EAAWL,GAAYpF,GAAapF,CAAG,EAC7CqF,GAAkBwF,CAAQ,GAAKjF,IAAiB,IAAK,KAAM,EAAe,IAAI,YAC9E,IAAMkF,EAAI,MAAM5K,GAAW2K,EAAS,OAAS,oBAAsBH,EAAWG,EAAUtW,EAAK,SAAS,EAClGkP,EACJ,GAAIoH,EAAS,OAAS,wBACpB,EAAY,MAAMA,EAAS,QAAQC,EAAGlF,EAAcpC,EAAYwG,EAAgBH,EAAY1K,CAAU,MACnG,CACH,IAAM4L,EAAaL,EACf7H,EACJ,GAAI,CACF,EAAM,MAAM4E,GAAqBoD,EAAUE,EAAYD,EAAGlF,EAAczG,EAAY8I,CAAa,EAAG5C,GAAkBwF,CAAQ,GAAKhI,aAAe,YAAcA,EAAI,YAAc,IAAMkI,EAAW,UAAY,EAAMrI,GAAYqI,CAAU,EAC7O,OAASC,EAAK,CACZ,GAAIA,aAAe,WAAaA,aAAetO,GAAcsO,aAAexO,EAC1E,MAAMwO,EACR,EAAMtI,GAAYqI,CAAU,CAC9B,CACA,EAAY,MAAM9G,GAAQ8G,EAAYlI,EAAKW,EAAYR,EAAIrD,EAAKqK,CAAc,CAChF,CACA,GAAI7K,EAAW,MAAQ,MAAO,CAC5B,IAAM8L,EAAqBZ,GAAyB,KACpD,GAAIY,IAAuB,EACzB,MAAM,IAAIzO,EAAiB,sEAAsE,EACnG,GAAIyO,IAAuB,EAAI,IAAM,CAAC,OAAO,cAAcA,CAAkB,GAAKA,EAAqB,GACrG,MAAU,UAAU,uEAAuE,EAC7F,EAAY,MAAMxB,GAAWhG,EAAWwH,CAAkB,CAAC,CAAC,MAAO,GAAU,CAC3E,MAAM5N,aAAiBX,EAAaW,EAAQ,IAAIX,EAAW,iCAAkC,CAAE,OAAM,CAAC,CACxG,CAAC,CACH,CACA,MAAO,CACL,YACA,GAAGmN,GAAc,CAAE,gBAAiBA,CAAW,EAC/C,GAAGnG,IAAQ,IAAK,IAAK,CACnB,4BAA6BxF,GAAgBwF,EAAK,MAAOhH,CAAU,CACrE,EACA,GAAGwN,GAAe,CAAE,wBAAyBA,CAAY,EACzD,GAAGnM,GAAU,CAAE,kBAAmBA,CAAO,EACzC,GAAG6M,GAAe,CAAE,IAAKE,CAAE,CAC7B,CACF,CACA,eAAeI,GAAe,EAAK,EAAQ,EAAK,CAC9C,GAAItB,aAAe,aAAe,EAAMtP,GAAQ,OAAOsP,CAAG,GAAI,OAAOA,GAAO,SAC1E,MAAM,IAAIlN,EAAW,4CAA4C,EACnE,GAAM,CAAE,EAAGqC,EAAiB,EAAG6G,EAAc,EAAG5C,EAAI,EAAGQ,EAAY,EAAG7D,EAAK,UAAWiK,EAAI,MAAM,GAAG,EACnG,GAAIxT,IAAW,EACb,MAAM,IAAIsG,EAAW,qBAAqB,EAC5C,OAAOqN,GAAW,CAChB,aACA,GAAI/G,GAAM,IAAK,GACf,UAAWjE,EACX,IAAKY,GAAO,IAAK,GACjB,cAAeiG,GAAgB,IAAK,EACtC,EAAG0E,EAAQ/V,CAAG,CAChB,CCxKA,SAAS4W,GAAc,EAAiB,EAAmB,EAAyB,CAClF,GAAI,CAACvN,GAAWmB,EAAiBqM,EAAmBC,CAAuB,EACzE,MAAM,IAAI3O,EAAW,qGAAqG,CAC9H,CACA,SAAS4O,GAAoB,EAAO,EAAS,EAA0B,CAAC,EAAG,CACzE,GAAI,CAAC/P,EAAM,IAAM,CAACA,EAAM,IAAM,CAACA,EAAM,GACnC,MAAM,IAAImB,EAAW,8GAA8G,EACrIT,IAAY,IAAK,KAAM,EAAM,GAAKA,GAAS,MAC3C,GAAI,EAAG8C,EAAiBqM,EAAmBC,EAAyB3H,EAAKb,EAAKG,EAAIuI,EAAyBvM,GAAQzD,EACnH,GAAImI,IAAQ,IAAK,IAAKnG,GAAiBmG,EAAK,mCAAmC,EAAGb,IAAQ,IAAK,IAAKtF,GAAiBsF,EAAK,4BAA4B,EAAGG,IAAO,IAAK,IAAKzF,GAAiByF,EAAI,2BAA2B,EAAG,CAACwI,GAA2BzM,IAAoB,IAAK,KAAM,EAAkBU,GAAoB/C,EAAYqC,CAAe,CAAC,CAAC,GAAI,EAAM,GAAKA,GAAkBqM,IAAsB,IAAK,KAAM,EAAoB3L,GAAoB/C,EAAY0O,CAAiB,CAAC,CAAC,GAAI,EAAM,GAAKA,GAAoB,CAACI,GAA2BH,IAA4B,IAAK,KAAM,EAA0B5L,GAAoB/C,EAAY2O,CAAuB,CAAC,CAAC,GAAI,EAAM,GAAKA,GAA0BE,IAA4B,IAAK,IAAK,CAAC9N,GAAS8N,CAAuB,EAC3wB,MAAU,UAAU,iDAAiD,EACvEJ,GAAcpM,EAAiBqM,EAAmBC,CAAuB,EACzE,IAAMlM,EAAa,CACjB,GAAGJ,EACH,GAAGqM,EACH,GAAGC,CACL,EACAvM,GAAuBpC,EAAYqC,CAAe,EAAGG,GAAaxC,EAAY+B,GAAgBO,EAAMD,EAAiBI,CAAU,EAAG4J,GAAY5J,EAAYJ,CAAe,EACzK,GAAM,CAAE,MAAK,OAAQI,EACrB,GAAI,OAAOa,GAAO,UAAY,CAACA,EAC7B,MAAM,IAAItD,EAAW,2DAA2D,EAClF,IAAMmO,EAAW/F,GAAI9E,GACrB,GAAI6K,GAAU,OAAS,wBAAyB,CAC9C,GAAIlI,IAAQ,IAAK,GACf,MAAM,IAAIjG,EAAW,iGAAiG,EACxH,GAAImG,IAAQ,IAAK,GACf,MAAU,UAAU,8EAA8E7C,GAAK,EACzG,GAAIgD,IAAO,IAAK,GACd,MAAU,UAAU,8EAA8EhD,GAAK,EACzG,MAAO,CAACb,EAAY,IAAK,GAAG0L,CAAQ,CACtC,CACA,GAAI,OAAOlI,GAAO,UAAY,CAACA,EAC7B,MAAM,IAAIjG,EAAW,sEAAsE,EAC7F,MAAO,CAACyC,EAAYmG,GAAc3C,CAAG,EAAGkI,CAAQ,CAClD,CACA,eAAeY,GAAW,EAAO,EAAS,EAAK,CAC7C,GAAM,CAACtM,EAAYuL,EAAUF,GAAYkB,EAAS,CAACC,EAAgBC,EAAsBC,EAAwBR,EAAyB3H,EAAK2E,EAAayD,EAASP,GAA2BQ,GAAyBxQ,EACrNwD,EAAkB6M,EAAsBR,EAAoBS,EAC1DhB,EAAWL,GAAYpF,GAAajG,EAAW,GAAG,EACpDyG,EAAc9H,EAAY+E,EAC9BgI,EAAS,OAAS,wBAA0B,EAAM,MAAM3K,GAAW2K,EAAUtW,EAAK,SAAS,EAAI,CAACsO,EAAK+C,EAAc9H,GAAc,MAAMqK,GAAqB0C,EAAUH,EAAUnW,EAAK4K,EAAYkJ,EAAakD,CAAuB,EAAGzN,IAAeiO,EAAwB,EAAoBX,EAAoB,CAAE,GAAGA,EAAmB,GAAGtN,CAAW,EAAIA,EAAa,EAAkBiB,EAAkB,CAAE,GAAGA,EAAiB,GAAGjB,CAAW,EAAIA,EAAYqN,GAAcpM,EAAiBqM,EAAmBC,CAAuB,GAC/gB,IAAMW,EAAmBjN,EAAkBvV,EAAK,KAAK,UAAUuV,CAAe,CAAC,EAAI,GAAIkN,EAAYvI,GAAK,WAAala,EAAKka,CAAG,EAAI,IAAK,GAAGsG,EAAiBvgB,GAAOwiB,EAAY,GAAGD,EAAiB,GAAGC,IAAcD,CAAgB,EAC9NvI,EAAYkI,EAChBxM,EAAW,MAAQ,QAAU,EAAY,MAAMqK,GAAS/F,CAAS,CAAC,CAAC,MAAO,GAAU,CAClF,MAAM,IAAI/G,EAAW,+BAAgC,CAAE,OAAM,CAAC,CAChE,CAAC,GACD,IAAI8G,EAAY7D,EAAKqD,EACrB6H,EAAS,OAAS,wBAA0B,CAACjF,EAAcpC,GAAc,MAAMqH,EAAS,QAAQhI,EAAKY,EAAWuG,EAAgBjL,EAAiBI,EAAYoM,CAAuB,EAAI,0BAA0B,MAAMxH,GAAQ2G,EAAUjH,EAAWZ,EAAKiJ,EAAS9B,CAAc,EACjR,IAAMJ,EAAM,CACV,WAAYpgB,EAAKga,CAAU,CAC7B,EACA,OAAOR,IAAO,EAAI,GAAKxZ,EAAKwZ,CAAE,GAAIrD,IAAQ,EAAI,IAAMnW,EAAKmW,CAAG,GAAIiG,GAAc,aAAe,EAAI,cAAgBpc,EAAKoc,CAAY,GAAIqG,IAAc,EAAI,IAAMA,GAAYlN,IAAoB,EAAI,UAAYiN,GAAmBX,IAA4B,EAAI,YAAcA,GAA0BD,IAAsB,EAAI,OAASA,GAAoBxB,CAClW,CACA,eAAesC,GAAU,EAAO,EAAK,EAAS,CAC5C,OAAOT,GAAWlQ,EAAO+P,GAAoB/P,EAAOU,CAAO,EAAG1H,CAAG,CACnE,CACA,SAAS4X,GAAW,EAAK,CACvB,MAAO,CAACvC,EAAI,UAAWA,EAAI,cAAeA,EAAI,GAAIA,EAAI,WAAYA,EAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CACrF,CCjEA,IAAMwC,GAAM,CAAC,CAAC,QAAQ,EAAG,CAAC,MAAM,CAAC,EACjC,SAASC,GAAK,EAAM,CAClB,IAAM1D,EAAS,CAAE,KAAM,OAAQ,KAAM,OAAOpE,GAAO,EACnD,MAAO,CAAE,IAAK,CAAC,KAAK,EAAG,OAAQ,CAAC,EAAG,SAAQ,QAASoE,EAAQ,OAAQyD,EAAI,CAC1E,CACA,SAASE,GAAI,EAAM,EAAY,CAC7B,IAAM3D,EAAS,CAAE,KAAM4D,EAAa,UAAY,oBAAqB,KAAM,OAAOhI,GAAO,EACzF,MAAO,CACL,IAAK,CAAC,KAAK,EACX,SACA,QAASgI,EAAa,CAAE,GAAG5D,EAAQ,YAAW,EAAIA,EAClD,OAAQyD,GACR,WAAY,IACd,CACF,CACA,SAASI,GAAM,EAAK,EAAM,CACxB,MAAO,CACL,IAAK,CAAC,IAAI,EACV,MACA,OAAQ,CAAE,KAAM,QAAS,WAAYvL,CAAI,EACzC,QAAS,CAAE,KAAM,QAAS,KAAM,OAAOsD,GAAO,EAC9C,OAAQ6H,EACV,CACF,CACA,SAASK,IAAQ,CACf,IAAM9D,EAAS,CAAE,KAAM,SAAU,EACjC,MAAO,CACL,IAAK,CAAC,KAAK,EACX,IAAK,UACL,SACA,QAASA,EACT,OAAQyD,EACV,CACF,CACA,SAASM,GAAM,EAAM,CACnB,IAAM/D,EAAS,CAAE,KAAM,UAAUpE,GAAO,EACxC,MAAO,CACL,IAAK,CAAC,KAAK,EACX,SACA,QAASoE,EACT,OAAQyD,EACV,CACF,CACA,IAAMO,GAAMzI,GAAM,CAChB,MAAOmI,GAAK,GAAG,EACf,MAAOA,GAAK,GAAG,EACf,MAAOA,GAAK,GAAG,EACf,MAAOC,GAAI,GAAG,EACd,MAAOA,GAAI,GAAG,EACd,MAAOA,GAAI,GAAG,EACd,MAAOA,GAAI,IAAK,EAAE,EAClB,MAAOA,GAAI,IAAK,EAAE,EAClB,MAAOA,GAAI,IAAK,EAAE,EAClB,MAAOE,GAAM,QAAS,GAAG,EACzB,MAAOA,GAAM,QAAS,GAAG,EACzB,MAAOA,GAAM,QAAS,GAAG,EACzB,MAAOC,GAAM,EACb,QAASA,GAAM,EACf,YAAaC,GAAM,EAAE,EACrB,YAAaA,GAAM,EAAE,EACrB,YAAaA,GAAM,EAAE,CACvB,CAAC,EACD,SAASE,GAAa,EAAK,CACzB,IAAM/M,EAAQ,OAAOG,GAAO,SAAW2M,GAAI3M,GAAO,IAAK,GACvD,GAAI,CAACH,EACH,MAAM,IAAIrD,EAAiB,OAAOwD,EAAI,4DAA4D,EACpG,OAAOH,CACT,CC/CA,SAASgN,GAAc,EAAS,CAC9B,MAAO,CAAC5Q,GAAWyC,GAAmB,aAAczC,EAAQ,UAAU,EAAGA,GAAS,IAAI,CACxF,CACA,SAAS6Q,GAAqB,EAAkB,CAC9C,OAAOnD,IAAqB,IAAK,GAAI,CAAC,EAAItL,GAAgBsL,EAAkBhN,EAAY,iCAAiC,CAC3H,CAOA,SAASoQ,GAA8B,EAAS,CAC9C,GAAI,CACF,OAAOrjB,GAAO2S,CAAO,CACvB,MAAQ,CACN,MAAM,IAAIM,EAAW,kEAAkE,CACzF,CACF,CACA,eAAehT,GAAgB,EAAK,EAAQ,EAAK,EAAwB,EAAiB,CACxF,GAAM,CAAE,UAAWggB,EAAkB,SAAQ,QAASsD,GAAiBC,EAAKrD,EAAasD,GAAmBL,GAAqBnD,CAAgB,EACjJ,GAAI,CAAC/L,GAAWiM,EAAY9L,CAAM,EAChC,MAAM,IAAIpB,EAAW,2EAA2E,EAClG,IAAMwC,EAAa,CAAE,GAAG0K,EAAY,GAAG9L,CAAO,EAAGQ,EAAMgB,GAAYsK,EAAY3K,GAAavC,EAAY6B,GAAgB8L,EAAO,GAAIT,EAAY1K,CAAU,CAAC,EAAG,CAAE,OAAQA,EACvK,GAAI,OAAOa,GAAO,UAAY,CAACA,EAC7B,MAAM,IAAIrD,EAAW,2DAA2D,EAClF,GAAI2N,EAAO,IAAM,CAACA,EAAO,EAAE,CAAC,IAAItK,CAAG,EACjC,MAAM,IAAIzD,GAAkB,sDAAsD,EACpF,GAAIgC,EACE,IAAA,OAAO0O,GAAgB,SACzB,MAAM,IAAItQ,EAAW,8BAA8B,CAAA,MAChD,GAAI,OAAOsQ,GAAgB,UAAY,EAAEA,aAAwB,YACtE,MAAM,IAAItQ,EAAW,wDAAwD,EAC/E,IAAMyQ,EAAiB7O,GAAO,OAAO0O,GAAgB,SAAWA,EAAeI,EAAuBJ,CAAY,EAC9GrC,EAAc,CAAC,EACnB,OAAOrW,GAAO,aAAe,EAAM,MAAMA,EAAIsV,EAAYqD,CAAG,EAAG,EAAc,CAAC,GAC9E,IAAMrN,EAAQ+M,GAAa5M,CAAG,EAAG5H,EAAOqC,GAAOkP,IAAqB,IAAK,GAA+B,IAAI,WAA/BjgB,GAAOigB,CAAgB,EAAsBjgB,GAAO,GAAG,EAAG,OAAO0jB,GAAkB,SAAW,EAAO,KAAOhP,GAAgBgP,EAAgB,UAAWzQ,CAAU,EAAIyQ,CAAc,EAAGE,EAAYpP,GAAgBgP,EAAI,UAAW,YAAavQ,CAAU,EAAGmO,EAAI,MAAM5K,GAAWL,EAAOtL,EAAK,QAAQ,EAAGkR,EAAY,MAAMhD,GAAOqI,EAAGjL,EAAM,OAAQ,QAAQ,EACtaA,EAAM,YAAciC,GAAmBjC,EAAM,IAAK4F,CAAS,EAC3D,IAAI8H,EAAW,CAAC,EAChB,GAAI,CACF,EAAW,MAAM,OAAO,OAAO,OAAO1N,EAAM,QAAS4F,EAAW6H,EAAWlV,CAAI,CACjF,MAAQ,CACR,CACA,GAAI,CAACmV,EACH,MAAM,IAAIrQ,GACZ,IAAMsQ,EAAS,CAAE,QAAS,OAAOJ,GAAkB,SAAWlP,GAAgBkP,EAAgB,UAAWzQ,CAAU,EAAIyQ,CAAe,EACtI,OAAOzD,IAAqB,IAAK,KAAM,EAAO,gBAAkBE,GAAa9L,IAAW,IAAK,KAAM,EAAO,kBAAoBA,GAAS6M,EAAc,CAAC,CAAE,GAAG4C,EAAQ,IAAK1C,CAAE,EAAGvM,CAAG,EAAI,CAACiP,EAAQjP,CAAG,CAClM,CACA,eAAekP,GAAc,EAAK,EAAQ,EAAK,CAC7C,GAAIP,aAAe,aAAe,EAAM5S,GAAQ,OAAO4S,CAAG,GAAI,OAAOA,GAAO,SAC1E,MAAM,IAAIvQ,EAAW,4CAA4C,EACnE,GAAM,CAAE,EAAGoC,EAAiB,EAAG1C,EAAS,EAAGiR,EAAW,UAAWJ,EAAI,MAAM,GAAG,EAC9E,GAAI9W,IAAW,EACb,MAAM,IAAIuG,EAAW,qBAAqB,EAC5C,OAAOhT,GAAgB,CAAE,UAAS,UAAWoV,EAAiB,WAAU,EAAGuL,EAAQ/V,EAAKwY,EAA6B,CACvH,CC5EA,eAAeW,GAAc,EAAK,EAAK,EAAS,CAC9C,GAAM,CAACF,GAAU,MAAMC,GAAcP,EAAKL,GAAc5Q,CAAO,EAAG1H,CAAG,EACrE,OAAOiZ,CACT,CCDA,IAAMG,GAAS,GAAS,KAAK,MAAMC,EAAK,QAAQ,EAAI,GAAG,EAAGC,GAAc,CACtE,EAAG,EACH,EAAG,GACH,EAAG,KACH,EAAG,MACH,EAAG,OACH,EAAG,QACL,EAAGjkB,GAAQ,oIAAqImkB,GAAc,eAC9J,SAASC,IAAkB,CACzB,MAAU,UAAU,4BAA4B,CAClD,CACA,SAASC,GAAK,EAAK,CACjB,OAAOC,GAAO,UAAYF,GAAgB,EAC1C,IAAMG,EAAUvkB,GAAM,KAAKskB,CAAG,GAC7B,CAACC,GAAWA,EAAQ,IAAMA,EAAQ,KAAOH,GAAgB,EAC1D,IAAMxZ,EAAQ,WAAW2Z,EAAQ,EAAE,EAAGC,EAAe,KAAK,MAAM5Z,EAAQqZ,GAAYM,EAAQ,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAChH,OAAO,OAAO,SAASC,CAAY,GAAKJ,GAAgB,EAAGG,EAAQ,KAAO,KAAOA,EAAQ,KAAO,MAAQ,CAACC,EAAeA,CAC1H,CACA,SAASC,GAAc,EAAO,EAAO,CACnC,GAAI,CAAC,OAAO,SAAS9S,CAAK,EACxB,MAAU,UAAU,WAAWiC,EAAM,OAAO,EAC9C,OAAOjC,CACT,CACA,SAAS+S,GAAoB,EAAO,EAAO,CACzC,GAAI,OAAO9Z,GAAS,SAClB,MAAU,UAAU,IAAI2H,EAAM,yBAAyB,CAC3D,CACA,SAASoS,GAAsB,EAAO,CACpC,GAAI,OAAO/Z,GAAS,WAAa,CAAC,MAAM,QAAQA,CAAK,GAAK,MAAM,KAAKA,CAAK,CAAC,CAAC,KAAM,GAAW,OAAOga,GAAU,QAAQ,GACpH,MAAU,UAAU,qDAAqD,CAC7E,CACA,SAASC,GAAY,EAAO,EAAO,CACjC,OAAO,OAAOja,GAAS,SAAW6Z,GAAc7Q,EAAOhJ,CAAK,EAAIA,aAAiB,KAAO6Z,GAAc7Q,EAAOmQ,GAAMnZ,CAAK,CAAC,EAAImZ,GAAsB,IAAI,IAAM,EAAIM,GAAKzZ,CAAK,CAC7K,CACA,IAAMka,GAAgB,GAAU,CAC9B,IAAMrO,EAAa7L,EAAM,YAAY,EACrC,OAAOA,EAAM,SAAS,GAAG,EAAI6L,EAAa,eAAeA,GAC3D,EAAGsO,IAAyB,EAAY,IAAc,OAAOC,GAAc,SAAWC,EAAU,SAASD,CAAU,EAAI,MAAM,QAAQA,CAAU,EAAIC,EAAU,KAAM,GAAQD,EAAW,SAASE,CAAG,CAAC,EAAI,CAAC,EACxM,SAASC,GAAoB,EAAS,EAAO,EAAW,CAAC,EAAG,CAC1D,IAAMva,EAAQ6H,EAAQF,GACtB,GAAM3H,IAAU,IAAK,IAAMwa,EAAW,CACpC,GAAI,OAAOxa,GAAS,SAClB,MAAM,IAAI0H,GAAyB,IAAIC,EAAM,0BAA2BE,EAASF,EAAO,SAAS,EACnG,OAAO3H,CACT,CACF,CACA,SAASya,GAAgB,EAAS,EAAO,CACvC,MAAM,IAAI/S,GAAyB,eAAeC,EAAM,eAAgBE,EAASF,EAAO4R,EAAW,CACrG,CACA,SAASmB,GAAkB,EAAiB,EAAgB,EAAU,CAAC,EAAG,CACxE,IAAI7S,EACJ,GAAI,CACF,EAAU,KAAK,MAAM9B,GAAc,OAAO4U,CAAc,CAAC,CAC3D,MAAQ,CACR,CACA,GAAI,CAAC1R,GAASpB,CAAO,EACnB,MAAM,IAAIO,GAAW,gDAAgD,EACvE,GAAM,CAAE,OAAQX,EAChB,GAAImT,IAAQ,IAAK,KAAM,OAAOrQ,EAAgB,KAAO,UAAY2P,GAAa3P,EAAgB,GAAG,IAAM2P,GAAaU,CAAG,GACrH,MAAM,IAAIlT,GAAyB,oCAAqCG,EAAS,MAAO0R,EAAW,EACrG,GAAM,CAAE,iBAAiB,CAAC,EAAG,SAAQ,UAAS,WAAU,eAAgB9R,EAASoT,EAAgB,CAAC,GAAGC,CAAc,EACnHC,IAAgB,IAAK,IAAKF,EAAc,KAAK,KAAK,EAAGG,IAAa,IAAK,IAAKH,EAAc,KAAK,KAAK,EAAGI,IAAY,IAAK,IAAKJ,EAAc,KAAK,KAAK,EAAGK,IAAW,IAAK,IAAKL,EAAc,KAAK,KAAK,EACrM,IAAK,IAAMlT,KAAS,IAAI,IAAIkT,EAAc,QAAQ,CAAC,EACjD,GAAI,CAAC,OAAO,OAAOhT,EAASF,CAAK,EAC/B,MAAM,IAAID,GAAyB,qBAAqBC,EAAM,SAAUE,EAASF,EAAO,SAAS,EACrGuT,IAAW,IAAK,IAAK,EAAE,MAAM,QAAQA,CAAM,EAAIA,EAAS,CAACA,CAAM,EAAA,CAAG,SAASrT,EAAQ,GAAG,GAAK4S,GAAgB5S,EAAS,KAAK,EAAGoT,IAAY,IAAK,IAAKpT,EAAQ,MAAQoT,GAAWR,GAAgB5S,EAAS,KAAK,EAAGmT,IAAa,IAAK,IAAK,CAACb,GAAsBtS,EAAQ,IAAK,OAAOmT,GAAY,SAAW,CAACA,CAAQ,EAAIA,CAAQ,GAAKP,GAAgB5S,EAAS,KAAK,EAC/V,GAAM,CAAE,kBAAmBJ,EACvB0T,EAAY,EAChB,GAAI,OAAOC,GAAkB,SAC3B,EAAY3B,GAAK2B,CAAc,OAC5B,GAAIA,IAAmB,IAAK,GAAG,CAClC,GAAI,OAAOA,GAAkB,SAC3B,MAAU,UAAU,oCAAoC,EAC1D,EAAYA,CACd,CACAvB,GAAc,wBAAyBsB,CAAS,EAChD,GAAM,CAAE,eAAgB1T,EAAS4T,EAAMxB,GAAc,qBAAsBV,GAAMmC,IAAgB,IAAK,GAAoB,IAAI,KAASA,CAAW,CAAC,EAAGC,EAAMhB,GAAoB1S,EAAS,MAAOkT,IAAgB,IAAK,EAAC,EAAGS,EAAMjB,GAAoB1S,EAAS,KAAK,EACjQ,GAAI2T,IAAQ,IAAK,IAAKA,EAAMH,EAAMF,EAChC,MAAM,IAAIzT,GAAyB,qCAAsCG,EAAS,MAAO0R,EAAW,EACtG,IAAMkC,EAAMlB,GAAoB1S,EAAS,KAAK,EAC9C,GAAI4T,IAAQ,IAAK,IAAKA,GAAOJ,EAAMF,EACjC,MAAM,IAAIrT,GAAW,qCAAsCD,EAAS,MAAO0R,EAAW,EACxF,GAAIwB,IAAgB,IAAK,GAAG,CAC1B,IAAMW,EAAML,EAAME,EAAKI,EAAM9B,GAAc,qBAAsB,OAAOkB,GAAe,SAAWA,EAActB,GAAKsB,CAAW,CAAC,EACjI,GAAIW,EAAMP,EAAYQ,EACpB,MAAM,IAAI7T,GAAW,2DAA4DD,EAAS,MAAO0R,EAAW,EAC9G,GAAImC,EAAM,CAACP,EACT,MAAM,IAAIzT,GAAyB,gEAAiEG,EAAS,MAAO0R,EAAW,CACnI,CACA,OAAO1R,CACT,CACA,IAAI+T,GACJ,SAASC,GAAgB,EAAU,CACjC,OAAOD,GAAiB,IAAIE,CAAQ,CACtC,CACA,SAASC,GAAQ,EAAU,CACzB,IAAMlU,EAAUgU,GAAgBC,CAAQ,EACxC,IAAK,IAAMnU,IAAS,CAAC,MAAO,MAAO,KAAK,EAAG,CACzC,IAAM3H,EAAQ6H,EAAQF,GACtB,GAAI,OAAO3H,GAAS,UAAY,CAAC,OAAO,SAASA,CAAK,EACpD,MAAU,UAAU,IAAI2H,EAAM,gCAAgC,CAClE,CACA,OAAOtS,GAAQ,OAAO,KAAK,UAAUwS,CAAO,CAAC,CAC/C,CACA,SAASmU,GAAS,EAAU,EAAO,CACjC,OAAOH,GAAgBC,CAAQ,CAAC,CAACnU,EACnC,CACA,IAAMsU,GAAN,KAAuB,CACrB,YAAY,EAAU,CAAC,EAAG,CACxB,GAAI,CAAChT,GAASpB,CAAO,EACnB,MAAU,UAAU,kCAAkC,GACvD,KAAqC,IAAI,QAAQ,CAAG,IAAI,KAAM,gBAAgBA,CAAO,CAAC,CACzF,CACA,UAAU,EAAO,CACf,OAAOiS,GAAoB,MAAO9Z,CAAK,EAAG,GAAgB,IAAI,CAAC,CAAC,IAAMA,EAAO,IAC/E,CACA,WAAW,EAAO,CAChB,OAAO8Z,GAAoB,MAAO9Z,CAAK,EAAG,GAAgB,IAAI,CAAC,CAAC,IAAMA,EAAO,IAC/E,CACA,YAAY,EAAO,CACjB,OAAO+Z,GAAsB/Z,CAAK,EAAG,GAAgB,IAAI,CAAC,CAAC,IAAMA,EAAO,IAC1E,CACA,OAAO,EAAO,CACZ,OAAO8Z,GAAoB,MAAO9Z,CAAK,EAAG,GAAgB,IAAI,CAAC,CAAC,IAAMA,EAAO,IAC/E,CACA,aAAa,EAAO,CAClB,MAAO,IAAgB,IAAI,CAAC,CAAC,IAAMia,GAAYja,EAAO,cAAc,EAAG,IACzE,CACA,kBAAkB,EAAO,CACvB,MAAO,IAAgB,IAAI,CAAC,CAAC,IAAMia,GAAYja,EAAO,mBAAmB,EAAG,IAC9E,CACA,YAAY,EAAO,CACjB,IAAM6H,EAAUgU,GAAgB,IAAI,EACpC,MAAO,CAA8LhU,EAAQ,IAAtM7H,IAAU,IAAK,GAAkBmZ,GAAsB,IAAI,IAAM,EAAI,OAAOnZ,GAAS,SAAyB6Z,GAAc,cAAeV,GAAsB,IAAI,IAAM,EAAIM,GAAKzZ,CAAK,CAAC,EAAkBia,GAAYja,EAAO,aAAa,EAAG,IACxP,CACF,ECvIA,eAAekc,GAAU,EAAK,EAAK,EAAS,CAC1C,GAAM,CAACnD,EAAUhP,GAAO,MAAMkP,GAAckD,EAAK9D,GAAc5Q,CAAO,EAAG1H,CAAG,EAC5E,GAAI,CAACgK,EACH,MAAM,IAAI3B,GAAW,qCAAqC,EAC5D,IAAMP,EAAU6S,GAAkB3B,EAAS,gBAAiBA,EAAS,QAAStR,CAAO,EACrF,MAAO,CAAE,GAAGsR,EAAU,SAAQ,CAChC,CCNA,eAAeqD,GAAW,EAAK,EAAK,EAAS,CAC3C,GAAM,CAAE,YAAW,GAAGpD,GAAW,MAAMtC,GAAeyF,EAAK7G,GAAe7N,CAAO,EAAG1H,CAAG,EAAG,CAAE,mBAAoBiZ,EAAQnR,EAAU6S,GAAkBnQ,EAAiB0E,EAAWxH,CAAO,EACvL,IAAK,IAAME,IAAS,CAAC,MAAO,MAAO,KAAK,EACtC,GAAI4C,EAAgB5C,KAAW,IAAK,KAAMA,IAAU,MAAQ,KAAK,UAAU4C,EAAgB,GAAG,IAAM,KAAK,UAAU1C,EAAQ,GAAG,EAAI0C,EAAgB5C,KAAWE,EAAQF,IACnK,MAAM,IAAID,GAAyB,eAAeC,EAAM,mCAAoCE,EAASF,EAAO,UAAU,EAC1H,MAAO,CAAE,UAAS,GAAGqR,CAAO,CAC9B,CCHA,eAAeqD,GAAgB,EAAO,EAAK,EAAiB,CAC1D,GAAI,CAACxU,EAAS0C,EAAiBqM,EAAmBpM,GAAQzD,EAAOuV,EAAwB,GACzF,GAAI/R,IAAoB,IAAK,GAAG,CAC9B,IAAMsB,EAAaZ,GAAoB9C,EAAYoC,CAAe,EAClE,EAAkBsB,EAAW,GAAI,EAAwBvW,EAAKuW,EAAW,EAAE,CAC7E,CACA,GAAI+K,IAAsB,IAAK,KAAM,EAAoB3L,GAAoB9C,EAAYyO,CAAiB,CAAC,CAAC,IAAK,CAACrM,GAAmB,CAACqM,EACpI,MAAM,IAAIzO,EAAW,iFAAiF,EACxG,GAAI,CAACiB,GAAWmB,EAAiBqM,CAAiB,EAChD,MAAM,IAAIzO,EAAW,2EAA2E,EAClG,IAAMwC,EAAa,CAAE,GAAGJ,EAAiB,GAAGqM,CAAkB,EAC9DtM,GAAuBnC,EAAYoC,CAAe,EAClD,IAAMR,EAAMgB,GAAYR,EAAiBG,GAAavC,EAAY6B,GAAgBQ,EAAMD,EAAiBI,CAAU,CAAC,EACpHZ,GAAOwS,IAAkB,EACzB,GAAM,CAAE,OAAQ5R,EAChB,GAAI,OAAOa,GAAO,UAAY,CAACA,EAC7B,MAAM,IAAIrD,EAAW,2DAA2D,EAClF,IAAMkD,EAAQ+M,GAAa5M,CAAG,EAC1BgR,EAAW,GAAIC,EAAW5U,EAASjE,EACvC,GAAImG,EAAK,CACP,IAAM7C,EAAUH,EAAM,GACtBG,GAAW,EAAW,EAAQ,KAAO5R,EAAKuS,CAAO,EAAG,EAAW,EAAQ,KAAOtS,GAAOinB,CAAQ,IAAM,EAAWlnB,EAAKuS,CAAO,EAAG,EAAOrS,GAAQ,OAAO,GAAG8mB,EAAsB,GAAGE,GAAU,EAC3L,CACA,IAASvW,GAAO1Q,GAAO+mB,CAAqB,EAAG/mB,GAAO,GAAG,EAAGknB,CAAQ,EACpE,IAAMnG,EAAI,MAAMrI,GAAO,MAAMvC,GAAWL,EAAOtL,EAAK,MAAM,EAAGsL,EAAM,OAAQ,MAAM,EACjFA,EAAM,YAAciC,GAAmBjC,EAAM,IAAKiL,CAAC,EACnD,IAAMoC,EAAM,CACV,UAAWpjB,EAAK,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK+V,EAAM,QAASiL,EAAG1S,CAAI,CAAC,CAAC,EAChF,QAAS4Y,CACX,EACA,OAAOjS,IAAoB,EAAI,UAAY+R,GAAwB1F,IAAsB,EAAI,OAASA,GAAoB,CAAC8B,EAAK3O,CAAG,CACrI,CACA,eAAe2S,GAAuB,EAAS,EAAiB,EAAM,EAAK,EAAiB,CAC1F,GAAM,CAAChE,GAAO,MAAM2D,GAAgB,CAACxU,EAAS0C,EAAiB,IAAK,GAAGC,CAAI,EAAGzK,EAAKwc,CAAe,EAClG,MAAO,GAAG7D,EAAI,UAAU,GAAGA,EAAI,QAAQ,GAAGA,EAAI,WAChD,CCrCA,IAAMiE,GAAeV,GACfW,GAAN,cAAsBD,EAAa,CACjC,GACA,mBAAmB,EAAiB,CAClC,OAAOlT,GAAa,KAAKoT,GAAkB,oBAAoB,EAAG,KAAKA,GAAmBtS,EAAiB,IAC7G,CACA,MAAM,KAAK,EAAK,EAAS,CACvB,OAAOmS,GAAuBX,GAAQ,IAAI,EAAG,KAAKc,GAAkBpV,GAAS,KAAM1H,MAAW,CAC5F,MAAM,IAAIqI,GAAW,qCAAqC,CAC5D,CAAC,CACH,CACF,ECZM0U,GAAkBb,GAClBc,GAAN,cAAyBD,EAAgB,CACvC,GAAS,CAAC,IAAK,EAAC,EAChB,GACA,GACA,GACA,mBAAmB,EAAiB,CAClC,OAAOrT,GAAa,KAAKuT,GAAO,GAAI,oBAAoB,EAAG,KAAKA,GAAO,GAAKzS,EAAiB,IAC/F,CACA,2BAA2B,EAAY,CACrC,OAAOd,GAAa,KAAKuT,GAAO,GAAI,4BAA4B,EAAG,KAAKA,GAAO,GAAK1T,EAAY,IAClG,CACA,wBAAwB,EAAK,CAC3B,OAAOG,GAAa,KAAKuT,GAAO,GAAI,yBAAyB,EAAG,KAAKA,GAAO,GAAK3O,EAAK,IACxF,CACA,wBAAwB,EAAI,CAC1B,OAAO5E,GAAa,KAAKuT,GAAO,GAAI,yBAAyB,EAAG,KAAKA,GAAO,GAAKxO,EAAI,IACvF,CACA,yBAA0B,CACxB,MAAO,MAAKyO,GAA2B,CAAC,EAAG,IAC7C,CACA,0BAA2B,CACzB,MAAO,MAAKC,GAA4B,CAAC,EAAG,IAC9C,CACA,2BAA4B,CAC1B,MAAO,MAAKC,GAA6B,CAAC,EAAG,IAC/C,CACA,MAAM,QAAQ,EAAK,EAAS,CAC1B,IAAMlO,EAAY8M,GAAQ,IAAI,EAC9B,KAAKiB,GAAO,KAAO,KAAKC,IAA4B,KAAKC,IAA6B,KAAKC,MAAgC,KAAKH,GAAO,GAAK,CAC1I,GAAG,KAAKA,GAAO,GACf,IAAK,KAAKC,GAA2BjB,GAAS,KAAM,KAAK,EAAI,IAAK,GAClE,IAAK,KAAKkB,GAA4BlB,GAAS,KAAM,KAAK,EAAI,IAAK,GACnE,IAAK,KAAKmB,GAA6BnB,GAAS,KAAM,KAAK,EAAI,IAAK,EACtE,GACA,IAAMjV,EAAQ,CAAC,GAAG,KAAKiW,EAAM,EAC7B,MAAO,GAAM,GAAK/N,EAAW0I,GAAW,MAAMD,GAAU3Q,EAAOhH,EAAK0H,CAAO,CAAC,CAC9E,CACF,ECtCM2V,GAAc,oBACpB,SAASC,GAAe,EAAS,kCAAmC,CAClE,MAAM,IAAIrV,EAAiB,0BAA0BsV,EAAO,OAAO,CACrE,CACA,SAASC,GAAa,EAAK,EAAQ,CACjC,OAAQ,OAAO/R,GAAO,SAAW2M,GAAI3M,IAAQ8E,GAAI9E,GAAO,IAAK,KAAM6R,GAAeC,CAAM,CAC1F,CCcsH,IAAAE,IAAc,EAAG,IAAM,CAC3I,GAAIla,EAAE,aAAeC,EAAE,OACrB,MAAO,CAAC,EACV,IAAK,IAAI3C,EAAI,EAAGA,EAAI0C,EAAE,WAAY,IAChC,GAAIA,EAAE1C,KAAO2C,EAAE3C,GACb,MAAO,CAAC,EACZ,MAAO,CAAC,CACV,EAAG6c,GAAmB,IAAU,CAAE,OAAM,IAAK,CAAE,GAAIC,GAAY,GAAU,CACvE,IAAMC,EAAOtZ,EAAM,KAAK,EAAM,OAC9B,GAAIsZ,IAAS,IAAK,GAChB,MAAU,MAAM,+BAA+B,EACjD,OAAOA,CACT,EAAGC,GAAe,GAAU,CAC1B,IAAMC,EAAQH,GAASrZ,CAAK,EAC5B,GAAIwZ,EAAQ,IAAK,CACf,IAAMC,EAAcD,EAAQ,IACxBjc,EAAS,EACb,IAAK,IAAIhB,EAAI,EAAGA,EAAIkd,EAAa,IAC/B,EAASlc,GAAU,EAAI8b,GAASrZ,CAAK,EACvC,OAAOzC,CACT,CACA,OAAOic,CACT,EAMGE,IAAa,EAAO,EAAa,IAAiB,CACnD,GAAIL,GAASrZ,CAAK,IAAMiL,EACtB,MAAU,MAAM0O,CAAY,CAChC,EAAGC,IAAe,EAAO,IAAW,CAClC,GAAIrc,EAAS,GAAKyC,EAAM,IAAMzC,EAASyC,EAAM,KAAK,OAChD,MAAU,MAAM,+BAA+B,EACjD,IAAM2U,EAAS3U,EAAM,KAAK,SAASA,EAAM,IAAKA,EAAM,IAAMzC,CAAM,EAChE,MAAO,GAAM,KAAOA,EAAQoX,CAC9B,EAAGkF,GAAqB,IACtBH,GAAU1Z,EAAO,EAAG,wBAAwB,EAErC4Z,GAAY5Z,EADJuZ,GAAYvZ,CACD,CAAM,GAElC,SAAS8Z,GAAe,EAAO,EAAW,CACxC,GAAIJ,GAAU1Z,EAAO,GAAI,WAAW+Z,IAAc,OAAS,OAAS,SAAS,WAAW,EAAGR,GAAYvZ,CAAK,EAAG+Z,IAAc,QAAS,CACpIL,GAAU1Z,EAAO,EAAG,wBAAwB,EAC5C,IAAMzC,EAASgc,GAAYvZ,CAAK,EAChC,EAAM,KAAOzC,CACf,CACAmc,GAAU1Z,EAAO,GAAI,+BAA+B,EAAGuZ,GAAYvZ,CAAK,CAC1E,CACA,IAAMga,GAA8B,GAAU,CAC5C,IAAMC,EAASJ,GAAkB7Z,CAAK,EACtC,GAAImZ,GAAWc,EAAQ,CAAC,GAAI,IAAK,GAAG,CAAC,EACnC,MAAO,SACT,GAAI,CAACd,GAAWc,EAAQ,CAAC,GAAI,IAAK,GAAI,IAAK,GAAI,EAAG,CAAC,CAAC,EAClD,MAAU,MAAM,2BAA2B,EAC7CP,GAAU1Z,EAAO,EAAG,oBAAoB,EACxC,IAAwCka,EAAWN,GAAY5Z,EAA3CuZ,GAAYvZ,CAAsC,CAAW,EACjF,GAAImZ,GAAWe,EAAU,CAAC,GAAI,IAAK,GAAI,IAAK,GAAI,EAAG,EAAG,CAAC,CAAC,EACtD,MAAO,QACT,GAAIf,GAAWe,EAAU,CAAC,GAAI,IAAK,EAAG,EAAG,EAAE,CAAC,EAC1C,MAAO,QACT,GAAIf,GAAWe,EAAU,CAAC,GAAI,IAAK,EAAG,EAAG,EAAE,CAAC,EAC1C,MAAO,QACT,MAAU,MAAM,yBAAyB,CAC3C,EAAGC,GAAgB,MAAO,EAAW,EAAS,EAAK,IAAY,CAC7D,IAAM1Q,EAAcD,GAA0BpG,GAAS,WAAW,EAAG4D,EAAQkS,GAAa/R,EAAK4R,EAAW,EAC1G/R,EAAM,QAAUgS,GAAA,mBAA0B,EAC1C,IAAM7Q,EAAW4R,IAAc,OAC3B7W,EACJ,GAAI8D,EAAM,QACR,GAAI,CACF,IAAMhH,EAAQoZ,GAAgBzP,CAAO,EACrCmQ,GAAe9Z,EAAO+Z,CAAS,EAAG,EAAY/S,EAAM,QAAQ,CAAE,IAAKgT,GAA2Bha,CAAK,CAAE,CAAC,CACxG,MAAQ,CACN,MAAM,IAAI2D,EAAiB,mCAAmC,CAChE,KAEA,GAAYqD,EAAM,OACpB,OAAO,OAAO,OAAO,UAAU+S,EAAWpQ,EAASzG,EAAWuG,GAAetB,EAAUnB,EAAM,OAAO,IAAiB,CACvH,EAAGoT,IAAkB,EAAK,IAAYtX,GAAauX,EAAI,QAAQC,EAAS,EAAE,CAAC,EAGxEC,IAAY,EAAK,EAAK,IAEhBJ,GAAc,OADLC,GAAeC,EAAK,4CACP,EAASlT,EAAK/D,CAAO,EClGpD,eAAeoX,GAAU,EAAK,CAC5B,GAAIhS,GAAY9M,CAAG,EACjB,IAAIA,EAAI,OAAS,SACf,EAAMA,EAAI,OAAO,OAEjB,OAAOA,EAAI,OAAO,CAAE,OAAQ,KAAM,CAAC,CAAA,CACvC,GAAIA,aAAe,WACjB,MAAO,CACL,IAAK,MACL,EAAGtK,EAAKsK,CAAG,CACb,EACF,GAAI,CAACqM,GAAYrM,CAAG,EAClB,MAAU,UAAUmN,GAAgBnN,EAAK,YAAa,YAAa,YAAY,CAAC,EAClF,GAAI,CAACA,EAAI,YACP,MAAU,UAAU,uDAAuD,EAC7E,IAAM2N,EAAM,MAAM,OAAO,OAAO,UAAU,MAAO3N,CAAG,EACpD,OAAO2N,EAAI,IAAK,OAAOA,EAAI,QAAS,OAAOA,EAAI,IAAKA,EAAI,MAAQ,OAAS,OAAOA,EAAI,IACpF,IAAK,IAAMlE,KAAa,OAAO,KAAKkE,CAAG,EACrCA,EAAIlE,KAAe,IAAK,IAAK,OAAOkE,EAAIlE,GAC1C,OAAOkE,CACT,CCvBA,IAAMoR,IAAS,EAAO,IAAgB,CACpC,GAAI,OAAO9e,GAAS,UAAY,CAACA,EAC/B,MAAM,IAAIqI,GAAW,GAAG0W,EAAY,oBAAoB,CAC5D,EACA,eAAeC,GAAuB,EAAK,EAAiB,CAC1D,IAAItR,EACJ,GAAIzE,GAASlJ,CAAG,EACV,IAAA,EAAM0N,GAAY1N,CAAG,EAAG,OAAO2N,EAAI,KAAO,SAC5C,MAAU,UAAUR,GAAgBnN,EAAK,YAAa,YAAa,cAAc,CAAC,CAAA,MAC/E,GAAImM,GAAUnM,CAAG,EACtB,EAAM0N,GAAY,MAAMoR,GAAU9e,CAAG,CAAC,OAEtC,MAAU,UAAUmN,GAAgBnN,EAAK,YAAa,YAAa,cAAc,CAAC,EACpF,GAAI,IAAoB,SAAUkf,IAAoB,UAAYA,IAAoB,UAAYA,IAAoB,SACpH,MAAU,UAAU,6DAA6D,EACnF,IAAIC,EACJ,OAAQxR,EAAI,IAAZ,CACE,IAAK,MACHoR,GAAMpR,EAAI,IAAK,6BAA6B,EAAGoR,GAAMpR,EAAI,IAAK,8BAA8B,EAAG,EAAa,CAAE,IAAKA,EAAI,IAAK,IAAKA,EAAI,IAAK,IAAKA,EAAI,GAAI,EACvJ,MACF,IAAK,KACHoR,GAAMpR,EAAI,IAAK,yBAAyB,EAAGoR,GAAMpR,EAAI,EAAG,8BAA8B,EAAGoR,GAAMpR,EAAI,EAAG,8BAA8B,EAAG,EAAa,CAAE,IAAKA,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,EAAG,EAAGA,EAAI,CAAE,EACrM,MACF,IAAK,MACHoR,GAAMpR,EAAI,IAAK,uCAAuC,EAAGoR,GAAMpR,EAAI,EAAG,4BAA4B,EAAG,EAAa,CAAE,IAAKA,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAE,EACzJ,MACF,IAAK,MACHoR,GAAMpR,EAAI,EAAG,0BAA0B,EAAGoR,GAAMpR,EAAI,EAAG,yBAAyB,EAAG,EAAa,CAAE,EAAGA,EAAI,EAAG,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAE,EACnI,MACF,IAAK,MACH,GAAI,OAAOA,EAAI,GAAK,SAClB,MAAM,IAAIrF,GAAW,8CAA8C,EACrE,EAAa,CAAE,EAAGqF,EAAI,EAAG,IAAKA,EAAI,GAAI,EACtC,MACF,QACE,MAAM,IAAI1F,EAAiB,mDAAmD,CAClF,CACA,IAAMpE,EAAOlO,GAAO,KAAK,UAAUwpB,CAAU,CAAC,EAC9C,OAAOvpB,EAAK,MAAM0R,GAAO4X,EAAiBrb,CAAI,CAAC,CACjD,CCzCA,SAASub,GAAY,EAAK,EAAO,EAAK,EAAK,CACzC,GAAM,CAAE,MAAK,QAASxR,EAAQ,MAAK,IAAKyR,EAAQ,IAAKC,EAAQ,MAAK,OAAQ3R,EAC1E,OAAQ4R,IAAQ,IAAK,IAAK,OAAOA,GAAO,aAAe3R,IAAW,IAAK,IAAK,MAAM,QAAQA,CAAM,GAAKA,EAAO,OAAO,EAAW,IAAU,OAAOC,GAAa,UAAYD,EAAO,QAAQC,CAAS,IAAM2R,CAAK,GAAK5R,EAAO,SAAS,QAAQ,IAAMtC,EAAM,IAAI,SAAS6E,CAAG,IAAMsP,IAAQ,IAAK,IAAK,OAAOA,GAAO,UAAYA,IAAQJ,KAAYC,IAAW,IAAK,GAAInP,IAAQ,MAAQ1E,IAAQ6T,KAAYI,IAAQ,IAAK,IAAKA,IAAQ,SAAW,CAACpU,EAAM,KAAOoB,IAAQpB,EAAM,IACrc,CACA,eAAeqU,GAAmB,EAAO,EAAK,EAAO,CACnD,IAAMpT,EAASqT,EAAM,IAAIjS,CAAG,GAAKiS,EAAM,IAAIjS,EAAK,CAAC,CAAC,CAAC,CAAC,IAAIA,CAAG,EAAG,CAAE,OAAQrC,EACxE,GAAIiB,EAAOd,KAAS,IAAK,GAAG,CAC1B,IAAMoU,EAAUjT,GAAStB,EAAOqC,EAAK,CAAC,CAAC,CAAC,CAAC,KAAM,GAAQ,CACrD,GAAI3N,EAAI,OAAS,SACf,MAAM,IAAIuI,GAAY,8CAA8C,EACtE,MAAO,GAAOkD,GAAOzL,EAAKA,CAC5B,CAAC,CAAC,CAAC,MAAO,GAAU,CAClB,MAAMuM,EAAOd,KAASoU,GAAW,OAAOtT,EAAOd,GAAM2K,CACvD,CAAC,EACD,EAAO3K,GAAOoU,CAChB,CACA,OAAOtT,EAAOd,EAChB,CACA,SAASqU,GAAkB,EAAM,CAC/B,IAAIC,EACJ,GAAI,CACF,EAAW,gBAAgBC,CAAI,CACjC,MAAQ,CACR,CACA,GAAI,CAAC5W,GAAS2W,CAAQ,EACpB,MAAM,IAAIxX,GAAY,4BAA4B,EACpD,IAAM0X,EAAWF,EAAS,KAAK,IAAK,GAAQ,CAC1C,IAAMjU,EAAa4B,GAAYC,CAAG,EAClC,OAAO,MAAM,QAAQ7B,EAAW,OAAO,IAAM,EAAW,QAAU,CAAC,GAAGA,EAAW,OAAO,GAAIA,CAC9F,CAAC,EAAGS,EAAyB,IAAI,QACjC,OAAO,OAAO,eAAe,MAAO,EAAiB,IAAU,CAC7D,GAAM,CAAE,MAAK,OAAQ,CAAE,GAAG/B,EAAiB,GAAGkL,GAAO,MAAO,EAAGpK,EAAQ,OAAOG,GAAO,SAAW2M,GAAI3M,GAAO,IAAK,GAChH,GAAI,CAACH,GAASA,EAAM,OAClB,MAAM,IAAIrD,EAAiB,gDAAgD,EAC7E,IAAMiY,EAAaH,EAAS,KAAK,QAAQ,EAAG,IAAUX,GAAYa,EAAST,GAAQlU,EAAOG,EAAKgU,CAAG,CAAC,EAAG,CAAE,EAAG9R,EAAK,UAAWuS,EAC3H,GAAI,CAACre,EACH,MAAM,IAAI2G,GACZ,GAAI3G,IAAW,EAAG,CAChB,IAAMuU,EAAQ,IAAI3N,GAClB,KAAM,GAAM,OAAO,eAAiB,iBAAmB,CACrD,IAAK,IAAM0X,KAAQD,EACjB,GAAI,CACF,MAAM,MAAMP,GAAmBpT,EAAQ4T,EAAM7U,CAAK,CACpD,MAAQ,CACR,CACJ,EAAG8K,CACL,CACA,OAAOuJ,GAAmBpT,EAAQoB,EAAKrC,CAAK,CAC9C,EAAG,OAAQ,CACT,UAAa,gBAAgByU,CAAQ,CACvC,CAAC,CACH,CCjDA,eAAeK,GAAW,EAAM,EAAK,EAAS,CAC5C,GAAI,OAAOC,GAAQ,UAAYA,EAAK,QAAQ,4BAA4B,IAAM,EAC5E,MAAU,UAAU,sCAAsC,EAC5D,OAAOxB,GAASwB,EAAM5U,EAAK/D,CAAO,CACpC,CAWA,eAAe4Y,GAAU,EAAK,EAAK,EAAS,CAC1C,GAAI,CAACpX,GAASyE,CAAG,EACf,MAAU,UAAU,uBAAuB,EAC7C,IAAM7B,EAAaE,GAAa2B,CAAG,EAAGI,EAAcD,GAA0BpG,GAAS,WAAW,EAAG,CAAE,IAAK4X,GAAWxT,EACvH,GAAI,IAAQwT,EAAQxT,EAAW,MAAQ,OAAS,CAACL,EAC/C,MAAU,UAAU,0DAA0D,EAChF,OAAQK,EAAW,IAAnB,CACE,IAAK,MACH,GAAI,OAAOA,EAAW,GAAK,SACzB,MAAU,UAAU,yCAAyC,EAC/D,OAAOjW,GAAgBiW,EAAW,CAAC,EACrC,IAAK,MACH,GAAI,OAAOwT,GAAU,UAAY,CAACA,EAChC,MAAU,UAAU,2CAA2C,EACjE,GAAI7T,IAAQ6T,EACV,MAAU,UAAU,uCAAuC,EAC7D,OAAO1S,GAAS4Q,GAAa/R,CAAG,EAAGK,EAAYiC,CAAW,EAE5D,IAAK,MACL,IAAK,KACL,IAAK,MACH,OAAOnB,GAAS4Q,GAAa/R,CAAG,EAAGK,EAAYiC,CAAW,EAC5D,QACE,MAAM,IAAI9F,EAAiB,8CAA8C,CAC7E,CACF,CC7CA,SAASsY,GAAsB,EAAO,CACpC,IAAIC,EACJ,GAAI,OAAO9K,GAAS,SAAU,CAC5B,IAAM+K,EAAQ/K,EAAM,MAAM,GAAG,GAC5B+K,EAAM,SAAW,GAAKA,EAAM,SAAW,KAAO,CAACD,GAAiBC,EACnE,MAAO,GAAI,OAAO/K,GAAS,UAAYA,EACrC,IAAI,cAAeA,EACjB,EAAgBA,EAAM,eAEtB,MAAU,UAAU,2CAA2C,CAAA,CACnE,IAAM9M,EAAU,+CAChB,GAAI,OAAO4X,GAAiB,UAAY,CAACA,EACvC,MAAU,UAAU5X,CAAO,EAC7B,OAAOkB,GAAgB0W,EAAe,UAAW5X,CAAO,CAC1D,CCXA,SAAS8X,GAAU,EAAK,CACtB,GAAI,OAAOtE,GAAO,SAChB,MAAM,IAAI/T,GAAW,+DAA+D,EACtF,GAAM,CAAE,EAAGP,EAAS,UAAWsU,EAAI,MAAM,GAAG,EAC5C,GAAIva,IAAW,EACb,MAAM,IAAIwG,GAAW,0DAA0D,EACjF,GAAIxG,IAAW,EACb,MAAM,IAAIwG,GAAW,aAAa,EACpC,GAAI,CAACP,EACH,MAAM,IAAIO,GAAW,6BAA6B,EACpD,IAAIsY,EACJ,GAAI,CACF,EAAU7qB,GAAKgS,CAAO,CACxB,MAAQ,CACN,MAAM,IAAIO,GAAW,wCAAwC,CAC/D,CACA,IAAI4Q,EACJ,GAAI,CACF,EAAS,KAAK,MAAMjT,GAAc,OAAO2a,CAAO,CAAC,CACnD,MAAQ,CACN,MAAM,IAAItY,GAAW,6CAA6C,CACpE,CACA,GAAI,CAACa,GAAS+P,CAAM,EAClB,MAAM,IAAI5Q,GAAW,wBAAwB,EAC/C,OAAO4Q,CACT,CC1BA,SAAS2H,GAAuB,EAAS,CACvC,IAAMpT,EAAgB9F,GAAS,eAAiB,KAChD,GAAI,OAAO8F,GAAiB,UAAY,CAAC,OAAO,UAAUA,CAAa,GAAKA,EAAgB,KAC1F,MAAM,IAAIvF,EAAiB,6FAA6F,EAC1H,OAAOuF,CACT,CACA,eAAeqT,GAAgB,EAAK,EAAS,CAC3C,IAAM9S,EAAcD,GAA0BpG,GAAS,WAAW,EAAG4D,EAAQkS,GAAa/R,EAAK4R,EAAW,EAC1G/R,EAAM,QAAUgS,GAAA,mBAA0B,EAC1C,IAAI9V,EACJ,GAAI8D,EAAM,QAAS,CACjB,IAAMoB,EAAMhF,GAAS,KAAO,QAC5B,GAAI,CAAC,CAAC,QAAS,QAAS,QAAS,QAAQ,CAAC,CAAC,SAASgF,CAAG,EACrD,MAAM,IAAIzE,EAAiB,kGAAkG,EAC/H,EAAYqD,EAAM,QAAQ,CAAE,KAAI,CAAC,CACnC,KAAO,CACL,GAAIA,EAAM,MAAQ,IAAK,IAAK5D,GAAS,MAAQ,IAAK,IAAKA,EAAQ,MAAQ4D,EAAM,IAC3E,MAAM,IAAIrD,EAAiB,4EAA4EwD,EAAI,MAAMH,EAAM,KAAK,EAC9H,EAAYA,EAAM,IAAI,KAAO,MAAQ,CACnC,GAAGA,EAAM,OACT,eAAgB,WAAW,GAAG,EAAG,EAAG,CAAC,EACrC,cAAesV,GAAuBlZ,CAAO,CAC/C,EAAI4D,EAAM,MACZ,CACA,OAAO,OAAO,OAAO,YAAY9D,EAAWuG,GAAe,CAAC,EAAG,CAC7D,GAAGzC,EAAM,OAAO,GAChB,GAAGA,EAAM,OAAO,EAClB,CAAC,CACH,CC3BA,eAAevV,GAAQ,EAAS,EAAQ,EAAY,KAAM,CACzD,OAAO,MAAM,IAAI8mB,GAAQ/U,CAAO,CAAC,CAAC,mBAAmB,CAAE,IAAK,OAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,kBAAkB,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EAAIiZ,CAAS,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC,OAAOlV,CAAM,CAAC,CACvL,CACA,eAAemV,GAAU,EAAO,EAAQ,CACvC,GAAI,CACH,OAAQ,MAAM7E,GAAUzG,EAAO,IAAI,YAAY,CAAC,CAAC,OAAO7J,CAAM,CAAC,EAAA,CAAG,OACnE,MAAQ,CACP,OAAO,IACR,CACD,CACA,IAAM5J,GAAO,IAAI,WAAW,CAC3B,GACA,IACA,IACA,IACA,IACA,IACA,GACA,IACA,IACA,IACA,GACA,IACA,IACA,GACA,GACA,IACA,IACA,IACA,IACA,GACA,IACA,IACA,IACA,GACA,GACA,IACA,GACA,IACA,IACA,IACA,IACA,IACA,IACA,IACA,GACA,GACA,IACA,GACD,CAAC,EACKqZ,OAAY,KAAK,IAAI,EAAI,IAAM,EAC/B7P,GAAM,MACN2C,GAAM,gBACZ,SAAS6S,GAAuB,EAAQ,EAAM,CAC7C,OAAOxe,GAAKoD,GAAQ,IAAI,YAAY,CAAC,CAAC,OAAOgG,CAAM,EAAG,IAAI,YAAY,CAAC,CAAC,OAAOnJ,CAAI,EAAGT,GAAM,EAAE,CAC/F,CACA,SAASif,GAAiB,EAAQ,CACjC,GAAI,OAAOrV,GAAW,SAAU,OAAOA,EACvC,IAAM5L,EAAQ4L,EAAO,KAAK,IAAIA,EAAO,cAAc,EACnD,GAAI,CAAC5L,EAAO,MAAU,MAAM,kBAAkB4L,EAAO,eAAe,mBAAmB,EACvF,OAAO5L,CACR,CACA,SAASkhB,GAAc,EAAQ,CAC9B,GAAI,OAAOtV,GAAW,SAAU,MAAO,CAAC,CACvC,QAAS,EACT,MAAOA,CACR,CAAC,EACD,IAAMoN,EAAS,CAAC,EAChB,IAAK,GAAM,CAACmI,EAASnhB,KAAU4L,EAAO,KAAMoN,EAAO,KAAK,CACvD,UACA,OACD,CAAC,EAKD,OAJIpN,EAAO,cAAgB,CAACoN,EAAO,KAAM,GAAM5O,EAAE,QAAUwB,EAAO,YAAY,GAAGoN,EAAO,KAAK,CAC5F,QAAS,GACT,MAAOpN,EAAO,YACf,CAAC,EACMoN,CACR,CACA,eAAeoI,GAAmB,EAAS,EAAQ,EAAM,EAAY,KAAM,CAC1E,IAAMC,EAAmBL,GAAuBC,GAAiBrV,CAAM,EAAGnJ,CAAI,EACxE6e,EAAa,MAAMtC,GAAuB,CAC/C,IAAK,MACL,EAAGjpB,EAAiBsrB,CAAgB,CACrC,EAAG,QAAQ,EACX,OAAO,MAAM,IAAItE,GAAWlV,CAAO,CAAC,CAAC,mBAAmB,CACvD,OACA,OACA,IAAKyZ,CACN,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,kBAAkBjG,GAAI,EAAIyF,CAAS,CAAC,CAAC,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,QAAQO,CAAgB,CAC3G,CACA,IAAME,GAAiB,CACtB,eAAgB,GAChB,wBAAyB,CAAC/V,EAAG,EAC7B,4BAA6B,CAAC2C,GAAK,SAAS,CAC7C,EACA,eAAeqT,GAAmB,EAAO,EAAQ,EAAM,CACtD,GAAI,CAAC/L,EAAO,OAAO,KACnB,IAAIgM,EAAS,GACb,GAAI,CACH,EAASnB,GAAsB7K,CAAK,CAAC,CAAC,MAAQ,IAAK,EACpD,MAAQ,CACP,OAAO,IACR,CACA,GAAI,CACH,IAAMiM,EAAUR,GAActV,CAAM,EAC9B,CAAE,WAAY,MAAMwQ,GAAW3G,EAAO,KAAO,IAAoB,CACtE,IAAM+J,EAAMjV,EAAgB,IAC5B,GAAIiV,IAAQ,IAAK,GAAG,CACnB,IAAK,IAAMpV,KAAKsX,EAAS,CACxB,IAAML,EAAmBL,GAAuB5W,EAAE,MAAO3H,CAAI,EAC7D,GAAI+c,IAAQ,MAAMR,GAAuB,CACxC,IAAK,MACL,EAAGjpB,EAAiBsrB,CAAgB,CACrC,EAAG,QAAQ,EAAG,OAAOA,CACtB,CACA,MAAU,MAAM,+BAA+B,CAChD,CAEA,OADIK,EAAQ,OAAqBV,GAAuBU,EAAQ,EAAE,CAAC,MAAOjf,CAAI,CAE/E,EAAG8e,EAAc,EACjB,OAAO1Z,CACR,MAAQ,CACP,GAAI4Z,EAAQ,OAAO,KACnB,IAAMC,EAAUR,GAActV,CAAM,EACpC,GAAI8V,EAAQ,QAAU,EAAG,OAAO,KAChC,IAAK,IAAI9gB,EAAI,EAAGA,EAAI8gB,EAAQ,OAAQ,IAAK,GAAI,CAC5C,IAAMtX,EAAIsX,EAAQ9gB,GACZ,CAAE,WAAY,MAAMwb,GAAW3G,EAAOuL,GAAuB5W,EAAE,MAAO3H,CAAI,EAAG8e,EAAc,EACjG,OAAO1Z,CACR,MAAQ,CACP,QACD,CACA,OAAO,IACR,CACD,CCtIA,SAAS8Z,GAAkB,EAAG,EAAG,CAC5B,OAAOre,GAAM,WAAU,EAAI,IAAI,YAAY,CAAC,CAAC,OAAOA,CAAC,GACrD,OAAOC,GAAM,WAAU,EAAI,IAAI,YAAY,CAAC,CAAC,OAAOA,CAAC,GACzD,IAAMqe,EAAU,IAAI,WAAWte,CAAC,EAC1Bue,EAAU,IAAI,WAAWte,CAAC,EAC5BC,EAAIoe,EAAQ,OAASC,EAAQ,OAC3BjgB,EAAS,KAAK,IAAIggB,EAAQ,OAAQC,EAAQ,MAAM,EACtD,IAAK,IAAIjhB,EAAI,EAAGA,EAAIgB,EAAQ,IAAK,IAAMhB,EAAIghB,EAAQ,OAASA,EAAQhhB,GAAK,IAAMA,EAAIihB,EAAQ,OAASA,EAAQjhB,GAAK,GACjH,OAAO4C,IAAM,CACd,CCXA,IAAMse,GAAuBpkB,GAA4B,MAAO,MAAO,MAAO,IAAI,ECDlF,SAASqkB,IAAqB,CAC7B,IAAMC,EAAK,OAAO,WAAe,KAAe,WAAW,OAC3D,GAAIA,GAAM,OAAOA,EAAG,QAAW,UAAYA,EAAG,QAAU,KAAM,OAAOA,EAAG,OACxE,MAAU,MAAM,+BAA+B,CAChD,CCDA,SAASC,GAAW,EAAW,EAAU,CACxC,MAAO,CAAE,OAAQ,KAAO,IAAU,CACjC,IAAMre,EAAOnH,EAAesK,CAAK,EAC3Bmb,EAAa,MAAMH,GAAmB,CAAC,CAAC,OAAOxa,EAAW3D,CAAI,EAMpE,OALIue,IAAa,MAAc,MAAM,KAAK,IAAI,WAAWD,CAAU,CAAC,CAAC,CAAC,IAAK,GAAM3e,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EACrH4e,IAAa,UAAYA,IAAa,aAAeA,IAAa,iBACjEA,EAAS,SAAS,KAAK,EAAUzjB,GAAU,OAAOwjB,EAAY,CAAE,QAASC,IAAa,gBAAiB,CAAC,EACrG5kB,GAAO,OAAO2kB,CAAU,EAEzBA,CACR,CAAE,CACH,CCQA,SAAgBE,GAAQ,EAAG,CAKvB,OAAQ9e,aAAa,YAChB,YAAY,OAAOA,CAAC,GACjBA,EAAE,YAAY,OAAS,cACvB,sBAAuBA,GACvBA,EAAE,oBAAsB,CACpC,CAGA,IAAM+e,GAAU,GAAWC,EAAQ,IAAIA,EAAM,IAAM,GAanD,SAAgBC,GAAM,EAAO,EAAQ,GAAI,CACrC,GAAI,OAAOviB,GAAU,UACjB,MAAU,UAAUqiB,GAAOC,CAAK,EAAI,8BAAgC,OAAOtiB,CAAK,EACpF,OAAOA,CACX,CAcA,SAAgBwiB,GAAQ,EAAG,EAAQ,GAAI,CACnC,GAAI,OAAO3f,GAAM,SACb,MAAU,UAAUwf,GAAOC,CAAK,EAAI,wBAA0B,OAAOzf,CAAC,EAC1E,GAAI,CAAC,OAAO,cAAcA,CAAC,GAAKA,EAAI,EAChC,MAAU,WAAWwf,GAAOC,CAAK,EAAI,8BAAgCzf,CAAC,EAC1E,OAAOA,CACX,CAiBA,SAAgB4f,EAAO,EAAO,EAAQ,EAAQ,GAAI,CAG9C,GAAIL,GAAQpiB,CAAK,IAAM4B,IAAW,IAAA,IAAa5B,EAAM,SAAW4B,GAC5D,OAAO5B,EAEP4B,IAAW,IAAA,IACX4gB,GAAQ5gB,EAAQ,QAAQ,EAC5B,IAAMgF,EAAQwb,GAAQpiB,CAAK,EACrB0iB,EAAQ9gB,IAAW,IAAA,GAAqC,GAAzB,cAAcA,IAC7C+gB,EAAM/b,EAAQ,UAAU5G,EAAM,SAAW,QAAQ,OAAOA,IACxDwB,EAAU6gB,GAAOC,CAAK,EAAI,sBAAwBI,EAAQ,SAAWC,EAG3E,MAFK/b,EAEK,WAAWpF,CAAO,EADd,UAAUA,CAAO,CAEnC,CACA,IAAMohB,IAAW,EAAO,IAAU,CAC9B,GAAsB,OAAO5iB,GAAU,WAAnCA,GAA+C,MAAM,QAAQA,CAAK,EAClE,MAAU,UAAUgJ,IAAU,SACxB,gCACA,IAAIA,EAAM,8BAA8B,OAAOhJ,GAAO,CACpE,EAcA,SAAgB6iB,GAAQ,EAAU,EAAgB,GAAM,CAGpD,GAAIC,EAAS,UACT,MAAU,MAAM,oBAAoB,EACxC,GAAIC,GAAiBD,EAAS,SAC1B,MAAU,MAAM,6BAA6B,CACrD,CAgBA,SAAgBE,GAAQ,EAAK,EAAU,CACnCP,EAAO3hB,EAAK,IAAA,GAAW,QAAQ,EAG/B,IAAMmiB,EAAMH,EAAS,UACrB,GAAI,EAAEhiB,EAAI,QAAUmiB,GAChB,MAAU,WAAW,+BAAiCA,CAAG,CAEjE,CAgDA,SAAgBC,GAAI,EAAK,CACrB,OAAO,IAAI,YAAYjc,EAAI,OAAQA,EAAI,WAAY,KAAK,MAAMA,EAAI,WAAa,CAAC,CAAC,CACrF,CAaA,SAAgBkc,GAAM,GAAGC,EAAQ,CAC7B,IAAK,IAAIxiB,EAAI,EAAGA,EAAIwiB,EAAO,OAAQ,IAC/BA,EAAOxiB,EAAE,CAAC,KAAK,CAAC,CAExB,CAYA,SAAgByiB,GAAW,EAAK,CAC5B,OAAO,IAAI,SAASpc,EAAI,OAAQA,EAAI,WAAYA,EAAI,UAAU,CAClE,CAKA,IAAa7D,GAA8B,IAAI,WAAW,IAAI,YAAY,CAAC,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAO,GAYvG,SAAgBkgB,GAAS,EAAM,CAC3B,OAAUC,GAAQ,GAAM,WAClBA,GAAQ,EAAK,SACbA,IAAS,EAAK,MACdA,IAAS,GAAM,GACzB,CA0BA,SAAgBC,GAAW,EAAK,CAC5B,IAAK,IAAI5iB,EAAI,EAAGA,EAAIqG,EAAI,OAAQ,IAC5B,EAAIrG,GAAK0iB,GAASrc,EAAIrG,EAAE,EAE5B,OAAOqG,CACX,CAYA,IAAawc,GAAargB,GACnB,GAAMsgB,EACPF,GAGAG,GAEN,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,OAAU,YAAc,OAAO,WAAW,SAAY,WAE3EC,GAAwB,MAAM,KAAK,CAAE,OAAQ,GAAI,GAAI,EAAG,IAAMhjB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,EAanG,SAAgBijB,GAAW,EAAO,CAG9B,GAFApB,EAAO7b,CAAK,EAER+c,GACA,OAAO/c,EAAM,MAAM,EAEvB,IAAItI,EAAM,GACV,IAAK,IAAIsC,EAAI,EAAGA,EAAIgG,EAAM,OAAQ,IAC9B,GAAOgd,GAAMhd,EAAMhG,IAEvB,OAAOtC,CACX,CAIA,SAASwlB,GAAc,EAAI,CACvB,OAAOC,GAAM,IAAMA,GAAM,GAAKA,EAAK,GAC7BA,GAAM,IAAMA,GAAM,GAAKA,EAAM,GACzBA,GAAM,IAAMA,GAAM,IAAMA,EAAM,GAC1B,IAAA,EAClB,CAaA,SAAgBC,GAAW,EAAK,CAC5B,GAAI,OAAO1lB,GAAQ,SACf,MAAU,UAAU,4BAA8B,OAAOA,CAAG,EAChE,GAAIqlB,GACA,GAAI,CACA,OAAO,WAAW,QAAQrlB,CAAG,CACjC,OACO6X,EAAO,CAGV,MAFIA,aAAiB,YACP,WAAWA,EAAM,OAAO,EAChCA,CACV,CAEJ,IAAM8N,EAAK3lB,EAAI,OACT4lB,EAAKD,EAAK,EAChB,GAAIA,EAAK,EACL,MAAU,WAAW,mDAAqDA,CAAE,EAChF,IAAM9nB,EAAQ,IAAI,WAAW+nB,CAAE,EAC/B,IAAK,IAAIC,EAAK,EAAGC,EAAK,EAAGD,EAAKD,EAAI,IAAM,GAAM,EAAG,CAC7C,IAAMG,EAAKP,GAAcxlB,EAAI,WAAW8lB,CAAE,CAAC,EACrCE,EAAKR,GAAcxlB,EAAI,WAAW8lB,EAAK,CAAC,CAAC,EAC/C,GAAIC,IAAO,IAAA,IAAaC,IAAO,IAAA,GAAW,CACtC,IAAMC,EAAOjmB,EAAI8lB,GAAM9lB,EAAI8lB,EAAK,GAChC,MAAU,WAAW,+CAAiDG,EAAO,cAAgBH,CAAE,CACnG,CACA,EAAMD,GAAME,EAAK,GAAKC,CAC1B,CACA,OAAOnoB,CACX,CA+FA,SAAgBqoB,GAAY,EAAK,CAC7B,GAAI,OAAO9K,GAAQ,SACf,MAAU,UAAU,iBAAiB,EACzC,OAAO,IAAI,WAAW,IAAI,YAAY,CAAC,CAAC,OAAOA,CAAG,CAAC,CACvD,CA6BA,SAAgB+K,GAAa,EAAG,EAAG,CAI/B,MAFI,CAACnhB,EAAE,YAAc,CAACC,EAAE,WACb,GACHD,EAAE,SAAWC,EAAE,QACnBD,EAAE,WAAaC,EAAE,WAAaA,EAAE,YAChCA,EAAE,WAAaD,EAAE,WAAaA,EAAE,UAExC,CAeA,SAAgBohB,GAAoB,EAAO,EAAQ,CAG/C,GAAID,GAAa1d,EAAO4d,CAAM,GAAK5d,EAAM,WAAa4d,EAAO,WACzD,MAAU,MAAM,sDAAsD,CAC9E,CAaA,SAAgBC,GAAY,GAAGxB,EAAQ,CACnC,IAAIyB,EAAM,EACV,IAAK,IAAIjkB,EAAI,EAAGA,EAAIwiB,EAAO,OAAQ,IAAK,CACpC,IAAM9f,EAAI8f,EAAOxiB,GACjB6hB,EAAOnf,CAAC,EACR,GAAOA,EAAE,MACb,CACA,IAAMf,EAAM,IAAI,WAAWsiB,CAAG,EAC9B,IAAK,IAAIjkB,EAAI,EAAGD,EAAM,EAAGC,EAAIwiB,EAAO,OAAQ,IAAK,CAC7C,IAAM9f,EAAI8f,EAAOxiB,GACjB2B,EAAI,IAAIe,EAAG3C,CAAG,EACd,GAAO2C,EAAE,MACb,CACA,OAAOf,CACX,CAkBA,SAAgBuiB,GAAU,EAAU,EAAM,CAMtC,OALAlC,GAAQmC,EAAU,UAAU,EAC5BnC,GAAQoC,EAAM,MAAM,EAGL,OAAO,OAAOD,EAAUC,CAC3B,CAChB,CAaA,SAAgBC,GAAW,EAAG,EAAG,CAG7B,GAFA,EAAIxC,EAAOnf,CAAC,EACZ,EAAImf,EAAOlf,CAAC,EACRD,EAAE,SAAWC,EAAE,OACf,MAAO,GACX,IAAI2hB,EAAO,EACX,IAAK,IAAItkB,EAAI,EAAGA,EAAI0C,EAAE,OAAQ,IAC1B,GAAQA,EAAE1C,GAAK2C,EAAE3C,GACrB,OAAOskB,IAAS,CACpB,CAUA,SAAgBC,GAAmB,EAAQ,EAAS,EAAS,CACzD,IAAMC,EAAMC,EACNC,EAAWC,QAAkB,CAAC,GAC9BC,GAAQ,EAAK,IAAQJ,EAAIrlB,EAAK,GAAGulB,EAAQrY,CAAG,CAAC,CAAC,CAC/C,OAAOA,CAAG,CAAC,CACX,OAAO,EACNwY,EAAML,EAAI,IAAI,WAAWM,CAAM,EAAG,GAAGJ,EAAQ,IAAI,UAAa,CAAC,EAIrE,MAHA,GAAK,UAAYG,EAAI,UACrB,EAAK,SAAWA,EAAI,SACpB,EAAK,QAAU,EAAK,GAAGE,IAASP,EAAIrlB,EAAK,GAAG4lB,CAAI,EACzCH,CACX,CAaA,IAAaI,IAAc,EAAQ,IAAgB,CAC/C,SAASC,EAAc,EAAK,GAAGF,EAAM,CAIjC,GAFAlD,EAAO1iB,EAAK,IAAA,GAAW,KAAK,EAExBlB,EAAO,cAAgB,IAAA,GAAW,CAClC,IAAMinB,EAAQH,EAAK,GACnBlD,EAAOqD,EAAOjnB,EAAO,aAAe,IAAA,GAAYA,EAAO,YAAa,OAAO,CAC/E,CAEA,IAAMknB,EAAOlnB,EAAO,UACdmnB,EAAWnnB,EAAO,cAAgB,IAAA,GAAgB,EAAJ,EAEpD,GAAI,CAACA,EAAO,QACH,KAAA,IAAI+B,EAAIolB,EAAUplB,EAAI+kB,EAAK,OAAQ,IACpC,GAAIvD,GAAQuD,EAAK/kB,EAAE,EACf,MAAU,MAAM,mBAAmB,CAAA,CAG3C/B,EAAO,SAAW8mB,EAAKK,KAAc,IAAA,IACrCvD,EAAOkD,EAAKK,GAAW,IAAA,GAAW,KAAK,EAC3C,IAAMC,EAASC,EAAYnmB,EAAK,GAAG4lB,CAAI,EACjCQ,GAAe,EAAU,IAAW,CACtC,GAAIxB,IAAW,IAAA,GAAW,CACtB,GAAIyB,IAAa,EACb,MAAU,MAAM,6BAA6B,EACjD3D,EAAOkC,EAAQ,IAAA,GAAW,QAAQ,CACtC,CACJ,EAEI0B,EAAS,GAmBb,MAAO,CAjBH,QAAQ,EAAM,EAAQ,CAClB,GAAIA,EACA,MAAU,MAAM,8CAA8C,EAKlE,MAHA,GAAS,GACT5D,EAAO7e,EAAM,IAAA,GAAW,MAAM,EAC9BuiB,EAAYF,EAAO,QAAQ,OAAQtB,CAAM,EAClCsB,EAAO,QAAQriB,EAAM+gB,CAAM,CACtC,EACA,QAAQ,EAAM,EAAQ,CAElB,GADAlC,EAAO7e,EAAM,IAAA,GAAW,MAAM,EAC1BmiB,GAAQniB,EAAK,OAASmiB,EACtB,MAAU,MAAM,6CAA+CA,CAAI,EAEvE,OADAI,EAAYF,EAAO,QAAQ,OAAQtB,CAAM,EAClCsB,EAAO,QAAQriB,EAAM+gB,CAAM,CACtC,CAEU,CAClB,CAEA,OADA,OAAO,OAAOkB,EAAehnB,CAAM,EAC5BgnB,CACX,EAkBA,SAAgBS,GAAU,EAAgB,EAAK,EAAc,GAAM,CAC/D,GAAIxlB,IAAQ,IAAA,GACR,OAAO,IAAI,WAAWylB,CAAc,EAGxC,GADA9D,EAAO3hB,EAAKylB,EAAgB,QAAQ,EAChCC,GAAe,CAACC,GAAY3lB,CAAG,EAC/B,MAAU,MAAM,iCAAiC,EACrD,OAAOA,CACX,CAmBA,SAAgB4lB,GAAW,EAAY,EAAW,EAAM,CAEpDlE,GAAQmE,CAAU,EAClBnE,GAAQoE,CAAS,EACjBrE,GAAMnf,CAAI,EACV,IAAMyjB,EAAM,IAAI,WAAW,EAAE,EACvB3jB,EAAOmgB,GAAWwD,CAAG,EAG3B,OAFA3jB,EAAK,aAAa,EAAG,OAAO0jB,CAAS,EAAGxjB,CAAI,EAC5CF,EAAK,aAAa,EAAG,OAAOyjB,CAAU,EAAGvjB,CAAI,EACtCyjB,CACX,CAYA,SAAgBJ,GAAY,EAAO,CAC/B,OAAO7f,EAAM,WAAa,GAAM,CACpC,CAaA,SAAgBkgB,GAAU,EAAO,CAG7B,OAAO,WAAW,KAAKrE,EAAO7b,CAAK,CAAC,CACxC,CAiBA,SAAgBmgB,GAAY,EAAc,GAAI,CAE1CvE,GAAQwE,EAAa,aAAa,EAClC,IAAMhF,EAAK,OAAO,YAAe,SAAW,WAAW,OAAS,KAChE,GAAI,OAAOA,GAAI,iBAAoB,WAC/B,MAAU,MAAM,wCAAwC,EAM5D,GAAIgF,EAAc,MACd,MAAU,WAAW,wCAAwCA,GAAa,EAC9E,OAAOhF,EAAG,gBAAgB,IAAI,WAAWgF,CAAW,CAAC,CACzD,CA+BA,SAAgBC,GAAa,EAAI,EAAeF,GAAa,CACzD,GAAI,OAAOG,GAAO,WACd,MAAU,UAAU,8CAAgD,OAAOA,CAAE,EACjF,GAAI,OAAOC,GAAiB,WACxB,MAAU,UAAU,8CAAgD,OAAOA,CAAY,EAC3F,GAAM,CAAE,eAAgBD,EACxB1E,GAAQ4E,EAAa,gBAAgB,EACrC,IAAMC,GAAY,EAAO,EAAY,IAAc,CAC/C,IAAMvmB,EAAM8jB,GAAYkB,EAAO9W,CAAU,EAKzC,OAFKyV,GAAaxV,EAAWD,CAAU,GACnCA,EAAW,KAAK,CAAC,EACdlO,CACX,EAMMyB,IAAQ,EAAK,GAAGojB,KAAU,CAC5B,QAAQ,EAAW,CACflD,EAAOxT,EAAW,IAAA,GAAW,MAAM,EACnC,IAAM6W,EAAQqB,EAAaC,CAAW,EAChC5X,EAAY0X,EAAGnnB,EAAK+lB,EAAO,GAAGH,CAAI,CAAC,CAAC,QAAQ1W,CAAS,EAI3D,OAFIO,aAAqB,QACdA,EAAU,KAAM,GAAO6X,EAASvB,EAAOwB,EAAIrY,CAAS,CAAC,EACzDoY,EAASvB,EAAOtW,EAAWP,CAAS,CAC/C,EACA,QAAQ,EAAY,CAChBwT,EAAOzT,EAAY,IAAA,GAAW,MAAM,EACpC,IAAM8W,EAAQ9W,EAAW,SAAS,EAAGoY,CAAW,EAC1CG,EAAYvY,EAAW,SAASoY,CAAW,EACjD,OAAOF,EAAGnnB,EAAK+lB,EAAO,GAAGH,CAAI,CAAC,CAAC,QAAQ4B,CAAS,CACpD,CACJ,IAQA,MANI,cAAeL,IACf,EAAI,UAAYA,EAAG,WACnB,cAAeA,IACf,EAAI,UAAYA,EAAG,WACnB,YAAaA,IACb,EAAI,QAAUA,EAAG,SACd3kB,CACX,CCp1BA,IAAMilB,GAAa,GAAQ,WAAW,KAAK9N,EAAI,MAAM,EAAE,EAAI,GAAMlW,EAAE,WAAW,CAAC,CAAC,EAK1EikB,GAAoChE,GAAWP,GAAIsE,GAAU,kBAAkB,CAAC,CAAC,EAGjFE,GAAoCjE,GAAWP,GAAIsE,GAAU,kBAAkB,CAAC,CAAC,EAYvF,SAAgBG,EAAK,EAAG,EAAG,CACvB,OAAQrkB,GAAKC,EAAMD,IAAO,GAAKC,CACnC,CAEA,IAAMqkB,GAAY,GAEZC,GAAc,GAcdC,GAAqC,GAAK,GAAK,EAC/CC,GAA4B,YAAY,GAAG,EACjD,SAASC,GAAU,EAAM,EAAO,EAAK,EAAO,EAAM,EAAQ,EAAS,EAAQ,CACvE,IAAMnkB,EAAMD,EAAK,OACXqkB,EAAQ,IAAI,WAAWL,EAAS,EAChCM,EAAMhF,GAAI+E,CAAK,EAEfE,EAAY/kB,IAAQqjB,GAAY7iB,CAAI,GAAK6iB,GAAY9B,CAAM,EAC3DyD,EAAMD,EAAYjF,GAAItf,CAAI,EAAImkB,GAC9BM,EAAMF,EAAYjF,GAAIyB,CAAM,EAAIoD,GAGtC,GAAK3kB,GAgBL,IAAK,IAAIW,EAAM,EAAGA,EAAMF,EAAK,IAAW,CAGpC,GAFAykB,EAAKC,EAAOxoB,EAAK+lB,EAAOoC,EAAK7lB,EAASmmB,CAAM,EAExCnmB,GAAWylB,GACX,MAAU,MAAM,uBAAuB,EAC3C,IAAM9jB,EAAO,KAAK,IAAI4jB,GAAW/jB,EAAME,CAAG,EAE1C,GAAIokB,GAAankB,IAAS4jB,GAAW,CACjC,IAAMa,EAAQ1kB,EAAM,EACpB,GAAIA,EAAM,GAAM,EACZ,MAAU,MAAM,6BAA6B,EACjD,IAAK,IAAI2kB,EAAI,EAAGC,EAAMD,EAAIb,GAAa,IACnC,EAAOY,EAAQC,EACf,EAAIC,GAAQP,EAAIO,GAAQT,EAAIQ,GAEhC,GAAOd,EAEX,KACA,KAAK,IAAIc,EAAI,EAAGC,EAAMD,EAAI1kB,EAAM,IAC5B,EAAOD,EAAM2kB,EACb,EAAOC,GAAQ/kB,EAAK+kB,GAAQV,EAAMS,GAEtC,GAAO1kB,CADP,CAEJ,MAtCI,IAAK,IAAID,EAAM,EAAGA,EAAMF,EAAK,IAAW,CAIpC,GAHAykB,EAAKC,EAAOxoB,EAAK+lB,EAAOoC,EAAK7lB,EAASmmB,CAAM,EAE5C/E,GAAWyE,CAAG,EACV7lB,GAAWylB,GACX,MAAU,MAAM,uBAAuB,EAC3C,IAAM9jB,EAAO,KAAK,IAAI4jB,GAAW/jB,EAAME,CAAG,EAC1C,IAAK,IAAI2kB,EAAI,EAAGC,EAAMD,EAAI1kB,EAAM,IAC5B,EAAOD,EAAM2kB,EACb,EAAOC,GAAQ/kB,EAAK+kB,GAAQV,EAAMS,GAEtC,GAAO1kB,CACX,CA2BR,CASA,SAAgB4kB,GAAa,EAAM,EAAM,CACrC,GAAM,CAAE,iBAAgB,gBAAe,gBAAe,eAAc,UAAW9D,GAAU,CAAE,eAAgB,GAAO,cAAe,EAAG,aAAc,GAAO,OAAQ,EAAG,EAAGE,CAAI,EAC3K,GAAI,OAAOsD,GAAS,WAChB,MAAU,MAAM,yBAAyB,EAK7C,OAJA9F,GAAQqG,CAAa,EACrBrG,GAAQgG,CAAM,EACdjG,GAAMuG,CAAY,EAClBvG,GAAMwG,CAAc,GACZ,EAAK,EAAO,EAAM,EAAQ,EAAU,IAAM,CAC9CtG,EAAO1iB,EAAK,IAAA,GAAW,KAAK,EAC5B0iB,EAAOqD,EAAO,IAAA,GAAW,OAAO,EAChCrD,EAAO7e,EAAM,IAAA,GAAW,MAAM,EAC9B,IAAMC,EAAMD,EAAK,OAGXolB,EAAYrE,IAAW,IAAA,GAM7B,GALA,EAAS2B,GAAUziB,EAAK8gB,EAAQ,EAAK,EACjCqE,GACAtE,GAAoB9gB,EAAM+gB,CAAM,EACpCnC,GAAQngB,CAAO,EAEXA,EAAU,GAAKA,GAAWylB,GAC1B,MAAU,MAAM,uBAAuB,EAC3C,IAAMmB,EAAU,CAAC,EAIbhmB,EAAIlD,EAAI,OACRuW,EACAiS,EACJ,GAAItlB,IAAM,GAGNgmB,EAAQ,KAAM,EAAInC,GAAU/mB,CAAG,CAAE,EACjC,EAAQ2nB,QAEP,GAAIzkB,IAAM,IAAM8lB,EACjB,EAAI,IAAI,WAAW,EAAE,EACrBzS,EAAE,IAAIvW,CAAG,EACTuW,EAAE,IAAIvW,EAAK,EAAE,EACb,EAAQ0nB,GACRwB,EAAQ,KAAK3S,CAAC,OAId,MADAmM,EAAO1iB,EAAK,GAAI,SAAS,EACf,MAAM,kBAAkB,GAWlC,CAACqD,IAAQ,CAACqjB,GAAYX,CAAK,IAC3BmD,EAAQ,KAAM,EAAQnC,GAAUhB,CAAK,CAAE,EAC3C,IAAIoD,EAAMhG,GAAI5M,CAAC,EAEf,GAAI6S,EAAe,CACf,GAAIrD,EAAM,SAAW,GACjB,MAAU,MAAM,sCAAsC,EAC1D,IAAMsD,EAAMtD,EAAM,SAAS,EAAG,EAAE,EAChC,GAAI1iB,GACA+lB,EAAcZ,EAAOW,EAAKhG,GAAIkG,CAAG,EAAGF,CAAG,MACtC,CACD,IAAMG,EAAW5F,GAAW,YAAY,KAAK8E,CAAK,CAAC,EACnDY,EAAcE,EAAUH,EAAKhG,GAAIkG,CAAG,EAAGF,CAAG,EAC1C/F,GAAMkG,CAAQ,EACd5F,GAAWyF,CAAG,CAClB,CACA,EAAQpD,EAAM,SAAS,EAAE,CAC7B,MACU1iB,IACNqgB,GAAWyF,CAAG,EAElB,IAAMI,EAAa,GAAKT,EACxB,GAAIS,IAAexD,EAAM,OACrB,MAAU,MAAM,sBAAsBwD,EAAW,aAAa,EAGlE,GAAIA,IAAe,GAAI,CACnB,IAAMC,EAAK,IAAI,WAAW,EAAE,EAC5BA,EAAG,IAAIzD,EAAOgD,EAAe,EAAI,GAAKhD,EAAM,MAAM,EAClD,EAAQyD,EACRN,EAAQ,KAAKnD,CAAK,CACtB,CACA,IAAM0D,EAAM/F,GAAWP,GAAI4C,CAAK,CAAC,EAGjC,GAAI,CAEA,OADAkC,GAAUM,EAAMC,EAAOW,EAAKM,EAAK5lB,EAAM+gB,EAAQtiB,EAASmmB,CAAM,EACvD7D,CACX,QACQ,CACJxB,GAAM,GAAG8F,CAAO,CACpB,CACJ,CACJ,CC3NA,SAASQ,EAAO,EAAG,EAAG,CAClB,OAAQnmB,EAAE,KAAO,KAAUA,EAAE,KAAO,MAAS,CACjD,CAiBA,IAAaomB,GAAb,KAAsB,CAClB,SAAW,GACX,UAAY,GACZ,OAAS,IAAI,WAAW,EAAE,EAC1B,EAAI,IAAI,YAAY,EAAE,EACtB,EAAI,IAAI,YAAY,EAAE,EACtB,IAAM,IAAI,YAAY,CAAC,EACvB,IAAM,EACN,SAAW,GACX,UAAY,GAEZ,YAAY,EAAK,CACb,EAAM5C,GAAUrE,EAAO1iB,EAAK,GAAI,KAAK,CAAC,EACtC,IAAM4pB,EAAKF,EAAO1pB,EAAK,CAAC,EAClB6pB,EAAKH,EAAO1pB,EAAK,CAAC,EAClB8pB,EAAKJ,EAAO1pB,EAAK,CAAC,EAClB+pB,EAAKL,EAAO1pB,EAAK,CAAC,EAClBgqB,EAAKN,EAAO1pB,EAAK,CAAC,EAClBiqB,EAAKP,EAAO1pB,EAAK,EAAE,EACnBkqB,EAAKR,EAAO1pB,EAAK,EAAE,EACnBmqB,EAAKT,EAAO1pB,EAAK,EAAE,EAKzB,KAAK,EAAE,GAAK4pB,EAAK,KACjB,KAAK,EAAE,IAAOA,IAAO,GAAOC,GAAM,GAAM,KACxC,KAAK,EAAE,IAAOA,IAAO,GAAOC,GAAM,GAAM,KACxC,KAAK,EAAE,IAAOA,IAAO,EAAMC,GAAM,GAAM,KACvC,KAAK,EAAE,IAAOA,IAAO,EAAMC,GAAM,IAAO,IACxC,KAAK,EAAE,GAAMA,IAAO,EAAK,KACzB,KAAK,EAAE,IAAOA,IAAO,GAAOC,GAAM,GAAM,KACxC,KAAK,EAAE,IAAOA,IAAO,GAAOC,GAAM,GAAM,KACxC,KAAK,EAAE,IAAOA,IAAO,EAAMC,GAAM,GAAM,KACvC,KAAK,EAAE,GAAMA,IAAO,EAAK,IACzB,IAAK,IAAItpB,EAAI,EAAGA,EAAI,EAAG,IACnB,KAAK,IAAIA,GAAK6oB,EAAO1pB,EAAK,GAAK,EAAIa,CAAC,CAC5C,CACA,QAAQ,EAAM,EAAQ,EAAS,GAAO,CAIlC,IAAMupB,EAAQC,EAAS,EAAI,KACrB,CAAE,IAAG,KAAM,KACXC,EAAKC,EAAE,GACPC,EAAKD,EAAE,GACPE,EAAKF,EAAE,GACPG,EAAKH,EAAE,GACPI,EAAKJ,EAAE,GACPK,EAAKL,EAAE,GACPM,EAAKN,EAAE,GACPO,EAAKP,EAAE,GACPQ,EAAKR,EAAE,GACPS,EAAKT,EAAE,GACPX,EAAKF,EAAO7lB,EAAMuB,EAAS,CAAC,EAC5BykB,EAAKH,EAAO7lB,EAAMuB,EAAS,CAAC,EAC5B0kB,EAAKJ,EAAO7lB,EAAMuB,EAAS,CAAC,EAC5B2kB,EAAKL,EAAO7lB,EAAMuB,EAAS,CAAC,EAC5B4kB,EAAKN,EAAO7lB,EAAMuB,EAAS,CAAC,EAC5B6kB,EAAKP,EAAO7lB,EAAMuB,EAAS,EAAE,EAC7B8kB,EAAKR,EAAO7lB,EAAMuB,EAAS,EAAE,EAC7B+kB,EAAKT,EAAO7lB,EAAMuB,EAAS,EAAE,EAC/B6lB,EAAKhoB,EAAE,IAAM2mB,EAAK,MAClBsB,EAAKjoB,EAAE,KAAQ2mB,IAAO,GAAOC,GAAM,GAAM,MACzCsB,EAAKloB,EAAE,KAAQ4mB,IAAO,GAAOC,GAAM,GAAM,MACzCsB,EAAKnoB,EAAE,KAAQ6mB,IAAO,EAAMC,GAAM,GAAM,MACxCsB,EAAKpoB,EAAE,KAAQ8mB,IAAO,EAAMC,GAAM,IAAO,MACzCsB,EAAKroB,EAAE,IAAO+mB,IAAO,EAAK,MAC1BuB,EAAKtoB,EAAE,KAAQ+mB,IAAO,GAAOC,GAAM,GAAM,MACzCuB,EAAKvoB,EAAE,KAAQgnB,IAAO,GAAOC,GAAM,GAAM,MACzCuB,EAAKxoB,EAAE,KAAQinB,IAAO,EAAMC,GAAM,GAAM,MACxCuB,EAAKzoB,EAAE,IAAOknB,IAAO,EAAKC,GAC1B3mB,EAAI,EACJkoB,EAAKloB,EAAIwnB,EAAKX,EAAW,EAAIU,EAAVE,EAAsB,EAAIH,EAAVI,EAAsB,EAAIL,EAAVM,EAAsB,EAAIP,EAAVQ,EACvE,EAAIM,IAAO,GACX,GAAM,KACN,GAAY,EAAIf,EAAVU,EAAsB,EAAIX,EAAVY,EAAsB,EAAIb,EAAVc,EAAsB,EAAIf,EAAVgB,EAAsB,EAAIjB,EAAVkB,EACtE,GAAKC,IAAO,GACZ,GAAM,KACN,IAAIC,EAAKnoB,EAAIwnB,EAAKT,EAAKU,EAAKZ,EAAW,EAAIU,EAAVG,EAAsB,EAAIJ,EAAVK,EAAsB,EAAIN,EAAVO,EACjE,EAAIO,IAAO,GACX,GAAM,KACN,GAAY,EAAIf,EAAVS,EAAsB,EAAIV,EAAVW,EAAsB,EAAIZ,EAAVa,EAAsB,EAAId,EAAVe,EAAsB,EAAIhB,EAAViB,EACtE,GAAKE,IAAO,GACZ,GAAM,KACN,IAAIC,EAAKpoB,EAAIwnB,EAAKR,EAAKS,EAAKV,EAAKW,EAAKb,EAAW,EAAIU,EAAVI,EAAsB,EAAIL,EAAVM,EAC3D,EAAIQ,IAAO,GACX,GAAM,KACN,GAAY,EAAIf,EAAVQ,EAAsB,EAAIT,EAAVU,EAAsB,EAAIX,EAAVY,EAAsB,EAAIb,EAAVc,EAAsB,EAAIf,EAAVgB,EACtE,GAAKG,IAAO,GACZ,GAAM,KACN,IAAIC,EAAKroB,EAAIwnB,EAAKP,EAAKQ,EAAKT,EAAKU,EAAKX,EAAKY,EAAKd,EAAW,EAAIU,EAAVK,EACrD,EAAIS,IAAO,GACX,GAAM,KACN,GAAY,EAAIf,EAAVO,EAAsB,EAAIR,EAAVS,EAAsB,EAAIV,EAAVW,EAAsB,EAAIZ,EAAVa,EAAsB,EAAId,EAAVe,EACtE,GAAKI,IAAO,GACZ,GAAM,KACN,IAAIC,EAAKtoB,EAAIwnB,EAAKN,EAAKO,EAAKR,EAAKS,EAAKV,EAAKW,EAAKZ,EAAKa,EAAKf,EAC1D,EAAIyB,IAAO,GACX,GAAM,KACN,GAAY,EAAIf,EAAVM,EAAsB,EAAIP,EAAVQ,EAAsB,EAAIT,EAAVU,EAAsB,EAAIX,EAAVY,EAAsB,EAAIb,EAAVc,EACtE,GAAKK,IAAO,GACZ,GAAM,KACN,IAAIC,GAAKvoB,EAAIwnB,EAAKL,EAAKM,EAAKP,EAAKQ,EAAKT,EAAKU,EAAKX,EAAKY,EAAKb,EAC1D,EAAIwB,KAAO,GACX,IAAM,KACN,IAAMV,EAAKhB,EAAW,EAAIU,EAAVO,EAAsB,EAAIR,EAAVS,EAAsB,EAAIV,EAAVW,EAAsB,EAAIZ,EAAVa,EAChE,GAAKM,KAAO,GACZ,IAAM,KACN,IAAIC,GAAKxoB,EAAIwnB,EAAKJ,EAAKK,EAAKN,EAAKO,EAAKR,EAAKS,EAAKV,EAAKW,EAAKZ,EAC1D,EAAIwB,KAAO,GACX,IAAM,KACN,IAAMX,EAAKd,EAAKe,EAAKjB,EAAW,EAAIU,EAAVQ,EAAsB,EAAIT,EAAVU,EAAsB,EAAIX,EAAVY,EAC1D,GAAKO,KAAO,GACZ,IAAM,KACN,IAAIC,GAAKzoB,EAAIwnB,EAAKH,EAAKI,EAAKL,EAAKM,EAAKP,EAAKQ,EAAKT,EAAKU,EAAKX,EAC1D,EAAIwB,KAAO,GACX,IAAM,KACN,IAAMZ,EAAKb,EAAKc,EAAKf,EAAKgB,EAAKlB,EAAW,EAAIU,EAAVS,EAAsB,EAAIV,EAAVW,EACpD,GAAKQ,KAAO,GACZ,IAAM,KACN,IAAIC,GAAK1oB,EAAIwnB,EAAKF,EAAKG,EAAKJ,EAAKK,EAAKN,EAAKO,EAAKR,EAAKS,EAAKV,EAC1D,EAAIwB,KAAO,GACX,IAAM,KACN,IAAMb,EAAKZ,EAAKa,EAAKd,EAAKe,EAAKhB,EAAKiB,EAAKnB,EAAW,EAAIU,EAAVU,EAC9C,GAAKS,KAAO,GACZ,IAAM,KACN,IAAIC,GAAK3oB,EAAIwnB,EAAKD,EAAKE,EAAKH,EAAKI,EAAKL,EAAKM,EAAKP,EAAKQ,EAAKT,EAC1D,EAAIwB,KAAO,GACX,IAAM,KACN,IAAMd,EAAKX,EAAKY,EAAKb,EAAKc,EAAKf,EAAKgB,EAAKjB,EAAKkB,EAAKpB,EACnD,GAAK8B,KAAO,GACZ,IAAM,KACN,GAAM3oB,GAAK,GAAKA,EAAK,EACrB,EAAKA,EAAIkoB,EAAM,EACf,EAAKloB,EAAI,KACT,KAAU,GACV,GAAMA,EACN,EAAE,GAAKkoB,EACP,EAAE,GAAKC,EACP,EAAE,GAAKC,EACP,EAAE,GAAKC,EACP,EAAE,GAAKC,EACP,EAAE,GAAKC,GACP,EAAE,GAAKC,GACP,EAAE,GAAKC,GACP,EAAE,GAAKC,GACP,EAAE,GAAKC,EACX,CACA,UAAW,CACP,GAAM,CAAE,IAAG,OAAQ,KACbC,EAAI,IAAI,YAAY,EAAE,EACxB5oB,EAAIR,EAAE,KAAO,GACjB,EAAE,IAAM,KACR,IAAK,IAAIpC,EAAI,EAAGA,EAAI,GAAI,IACpB,EAAEA,IAAM4C,EACR,EAAIR,EAAEpC,KAAO,GACb,EAAEA,IAAM,KAEZ,EAAE,IAAM4C,EAAI,EACZ,EAAIR,EAAE,KAAO,GACb,EAAE,IAAM,KACR,EAAE,IAAMQ,EACR,EAAIR,EAAE,KAAO,GACb,EAAE,IAAM,KACR,EAAE,IAAMQ,EAGR,EAAE,GAAKR,EAAE,GAAK,EACd,EAAIopB,EAAE,KAAO,GACb,EAAE,IAAM,KACR,IAAK,IAAIxrB,EAAI,EAAGA,EAAI,GAAI,IACpB,EAAEA,GAAKoC,EAAEpC,GAAK4C,EACd,EAAI4oB,EAAExrB,KAAO,GACb,EAAEA,IAAM,KAEZ,EAAE,IAAM,KACR,IAAIyrB,GAAQ7oB,EAAI,GAAK,EACrB,IAAK,IAAI5C,EAAI,EAAGA,EAAI,GAAI,IACpB,EAAEA,IAAMyrB,EACZ,EAAO,CAACA,EACR,IAAK,IAAIzrB,EAAI,EAAGA,EAAI,GAAI,IACpB,EAAEA,GAAMoC,EAAEpC,GAAKyrB,EAAQD,EAAExrB,GAC7B,EAAE,IAAMoC,EAAE,GAAMA,EAAE,IAAM,IAAO,MAC/B,EAAE,IAAOA,EAAE,KAAO,EAAMA,EAAE,IAAM,IAAO,MACvC,EAAE,IAAOA,EAAE,KAAO,EAAMA,EAAE,IAAM,GAAM,MACtC,EAAE,IAAOA,EAAE,KAAO,EAAMA,EAAE,IAAM,GAAM,MACtC,EAAE,IAAOA,EAAE,KAAO,GAAOA,EAAE,IAAM,EAAMA,EAAE,IAAM,IAAO,MACtD,EAAE,IAAOA,EAAE,KAAO,EAAMA,EAAE,IAAM,IAAO,MACvC,EAAE,IAAOA,EAAE,KAAO,EAAMA,EAAE,IAAM,GAAM,MACtC,EAAE,IAAOA,EAAE,KAAO,EAAMA,EAAE,IAAM,GAAM,MACtC,IAAIspB,EAAItpB,EAAE,GAAKrC,EAAI,GACnB,EAAE,GAAK2rB,EAAI,MACX,IAAK,IAAI1rB,EAAI,EAAGA,EAAI,EAAG,IACnB,GAAOoC,EAAEpC,GAAKD,EAAIC,GAAM,IAAM0rB,IAAM,IAAO,EAC3C,EAAE1rB,GAAK0rB,EAAI,MAEfnJ,GAAMiJ,CAAC,CACX,CACA,OAAO,EAAM,CACTvJ,GAAQ,IAAI,EACZJ,EAAO7e,CAAI,EACX,EAAOkjB,GAAUljB,CAAI,EACrB,GAAM,CAAE,SAAQ,YAAa,KACvBC,EAAMD,EAAK,OACjB,IAAK,IAAIG,EAAM,EAAGA,EAAMF,GAAM,CAC1B,IAAMG,EAAO,KAAK,IAAItD,EAAW,KAAK,IAAKmD,EAAME,CAAG,EAEpD,GAAIC,IAAStD,EACT,KAAOA,GAAYmD,EAAME,EAAK,GAAOrD,EACjC,KAAK,QAAQkD,EAAMG,CAAG,OAG9BG,EAAO,IAAIN,EAAK,SAASG,EAAKA,EAAMC,CAAI,EAAG,KAAK,GAAG,EACnD,KAAK,KAAOA,EACZ,GAAOA,EACH,KAAK,MAAQtD,IACb,KAAK,QAAQwD,EAAQ,EAAG,EAAK,EAC7B,KAAK,IAAM,EAEnB,CACA,OAAO,IACX,CACA,SAAU,CAEN,KAAK,UAAY,GACjBif,GAAM,KAAK,EAAG,KAAK,EAAG,KAAK,OAAQ,KAAK,GAAG,CAC/C,CACA,WAAW,EAAK,CACZN,GAAQ,IAAI,EACZG,GAAQliB,EAAK,IAAI,EACjB,KAAK,SAAW,GAChB,GAAM,CAAE,SAAQ,KAAM,KAClB,CAAE,OAAQ,KACd,GAAIiD,EAAK,CAKL,IADA,EAAO,KAAS,EACTA,EAAM,GAAI,IACb,EAAOA,GAAO,EAClB,KAAK,QAAQG,EAAQ,EAAG,EAAI,CAChC,CACA,KAAK,SAAS,EACd,IAAIqoB,EAAO,EACX,IAAK,IAAI3rB,EAAI,EAAGA,EAAI,EAAG,IACnB,EAAI,KAAUoC,EAAEpC,KAAO,EACvB,EAAI,KAAUoC,EAAEpC,KAAO,CAE/B,CACA,QAAS,CACL,GAAM,CAAE,SAAQ,aAAc,KAC9B,KAAK,WAAWsD,CAAM,EAEtB,IAAM3B,EAAM2B,EAAO,MAAM,EAAGhD,CAAS,EAErC,OADA,KAAK,QAAQ,EACNqB,CACX,CACJ,EAgBaiqB,GAA2BrH,GAAmB,GAAK,GAAQ,IAAIuE,GAAS3pB,CAAG,CAAC,EC/RzF,SAAS0sB,GAAW,EAAG,EAAG,EAAG,EAAK,EAAK,EAAS,GAAI,CAChD,IAAIC,EAAMtiB,EAAE,GAAIuiB,EAAMviB,EAAE,GAAIwiB,EAAMxiB,EAAE,GAAIyiB,EAAMziB,EAAE,GAChD0iB,EAAMxW,EAAE,GAAIyW,EAAMzW,EAAE,GAAI0W,EAAM1W,EAAE,GAAI2W,EAAM3W,EAAE,GAC5C4W,EAAM5W,EAAE,GAAI6W,EAAM7W,EAAE,GAAI8W,EAAM9W,EAAE,GAAI+W,EAAM/W,EAAE,GAC5CgX,EAAMC,EAAKC,EAAM,EAAE,GAAIC,EAAM,EAAE,GAAIC,EAAM,EAAE,GAEvCC,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMjB,EAAKkB,EAAMhB,EAAKiB,EAAMhB,EAAKiB,EAAMhB,EAC/K,IAAK,IAAIpD,EAAI,EAAGA,EAAI9B,EAAQ,GAAK,EAC7B,EAAOmF,EAAMI,EAAO,EACpB,EAAMpG,EAAK4G,EAAMZ,EAAK,EAAE,EACxB,EAAOQ,EAAMI,EAAO,EACpB,EAAM5G,EAAKoG,EAAMI,EAAK,EAAE,EACxB,EAAOR,EAAMI,EAAO,EACpB,EAAMpG,EAAK4G,EAAMZ,EAAK,CAAC,EACvB,EAAOQ,EAAMI,EAAO,EACpB,EAAM5G,EAAKoG,EAAMI,EAAK,CAAC,EACvB,EAAOP,EAAMI,EAAO,EACpB,EAAMrG,EAAK6G,EAAMZ,EAAK,EAAE,EACxB,EAAOQ,EAAMI,EAAO,EACpB,EAAM7G,EAAKqG,EAAMI,EAAK,EAAE,EACxB,EAAOR,EAAMI,EAAO,EACpB,EAAMrG,EAAK6G,EAAMZ,EAAK,CAAC,EACvB,EAAOQ,EAAMI,EAAO,EACpB,EAAM7G,EAAKqG,EAAMI,EAAK,CAAC,EACvB,EAAOP,EAAMI,EAAO,EACpB,EAAMtG,EAAK8G,EAAMZ,EAAK,EAAE,EACxB,EAAOQ,EAAMI,EAAO,EACpB,EAAM9G,EAAKsG,EAAMI,EAAK,EAAE,EACxB,EAAOR,EAAMI,EAAO,EACpB,EAAMtG,EAAK8G,EAAMZ,EAAK,CAAC,EACvB,EAAOQ,EAAMI,EAAO,EACpB,EAAM9G,EAAKsG,EAAMI,EAAK,CAAC,EACvB,EAAOP,EAAMI,EAAO,EACpB,EAAMvG,EAAK+G,EAAMZ,EAAK,EAAE,EACxB,EAAOQ,EAAMI,EAAO,EACpB,EAAM/G,EAAKuG,EAAMI,EAAK,EAAE,EACxB,EAAOR,EAAMI,EAAO,EACpB,EAAMvG,EAAK+G,EAAMZ,EAAK,CAAC,EACvB,EAAOQ,EAAMI,EAAO,EACpB,EAAM/G,EAAKuG,EAAMI,EAAK,CAAC,EACvB,EAAOX,EAAMK,EAAO,EACpB,EAAMrG,EAAK+G,EAAMf,EAAK,EAAE,EACxB,EAAOU,EAAMK,EAAO,EACpB,EAAM/G,EAAKqG,EAAMK,EAAK,EAAE,EACxB,EAAOV,EAAMK,EAAO,EACpB,EAAMrG,EAAK+G,EAAMf,EAAK,CAAC,EACvB,EAAOU,EAAMK,EAAO,EACpB,EAAM/G,EAAKqG,EAAMK,EAAK,CAAC,EACvB,EAAOT,EAAMK,EAAO,EACpB,EAAMtG,EAAK4G,EAAMX,EAAK,EAAE,EACxB,EAAOU,EAAMC,EAAO,EACpB,EAAM5G,EAAKsG,EAAMK,EAAK,EAAE,EACxB,EAAOV,EAAMK,EAAO,EACpB,EAAMtG,EAAK4G,EAAMX,EAAK,CAAC,EACvB,EAAOU,EAAMC,EAAO,EACpB,EAAM5G,EAAKsG,EAAMK,EAAK,CAAC,EACvB,EAAOT,EAAMK,EAAO,EACpB,EAAMvG,EAAK6G,EAAMX,EAAK,EAAE,EACxB,EAAOM,EAAMK,EAAO,EACpB,EAAM7G,EAAKuG,EAAMC,EAAK,EAAE,EACxB,EAAON,EAAMK,EAAO,EACpB,EAAMvG,EAAK6G,EAAMX,EAAK,CAAC,EACvB,EAAOM,EAAMK,EAAO,EACpB,EAAM7G,EAAKuG,EAAMC,EAAK,CAAC,EACvB,EAAOL,EAAMC,EAAO,EACpB,EAAMpG,EAAK8G,EAAMX,EAAK,EAAE,EACxB,EAAOM,EAAMK,EAAO,EACpB,EAAM9G,EAAKoG,EAAMK,EAAK,EAAE,EACxB,EAAON,EAAMC,EAAO,EACpB,EAAMpG,EAAK8G,EAAMX,EAAK,CAAC,EACvB,EAAOM,EAAMK,EAAO,EACpB,EAAM9G,EAAKoG,EAAMK,EAAK,CAAC,EAG3B,IAAIO,EAAK,EACT,EAAI,KAASjC,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAAShB,EAAMiB,EAAO,EAC1B,EAAI,KAASf,EAAMgB,EAAO,EAC1B,EAAI,KAASf,EAAMgB,EAAO,EAC1B,EAAI,KAASf,EAAMgB,EAAO,CAC9B,CAuBA,SAAgBE,GAAQ,EAAG,EAAG,EAAG,EAAK,CAKlC,IAAMC,EAAKzrB,GAAOgH,EAAIqZ,GAAWrZ,EAAE,MAAM,EAAG,CAAC,CAAC,EACxC0kB,EAAK1rB,GAAOkT,EAAImN,GAAWnN,EAAE,MAAM,EAAG,CAAC,CAAC,EACxCyY,EAAK3rB,GAAOxC,EAAI6iB,GAAW7iB,EAAE,MAAM,EAAG,CAAC,CAAC,EACxCouB,EAAI,IAAI,YAAY,EAAE,EAC5BvC,GAAWoC,EAAIC,EAAIC,EAAG,SAAS,CAAC,EAAGC,EAAGD,EAAG,EAAE,EAC3C,IAAIJ,EAAK,EACT,EAAI,KAASK,EAAE,GAAKH,EAAG,GAAM,EAC7B,EAAI,KAASG,EAAE,GAAKH,EAAG,GAAM,EAC7B,EAAI,KAASG,EAAE,GAAKH,EAAG,GAAM,EAC7B,EAAI,KAASG,EAAE,GAAKH,EAAG,GAAM,EAC7B,EAAI,KAASG,EAAE,IAAMD,EAAG,GAAM,EAC9B,EAAI,KAASC,EAAE,IAAMD,EAAG,GAAM,EAC9B,EAAI,KAASC,EAAE,IAAMD,EAAG,GAAM,EAC9B,EAAI,KAASC,EAAE,IAAMD,EAAG,GAAM,EAC9BtL,GAAW3iB,CAAG,EACTsC,IACD+f,GAAM0L,EAAIC,EAAIC,CAAE,EACpB5L,GAAM6L,CAAC,CACX,CA4EA,IAAaC,GAA4BrG,GAAa6D,GAAY,CAC9D,aAAc,GACd,cAAe,EACf,cAAemC,GACf,eAAgB,EACpB,CAAC,EAqDKM,GAA0B,IAAI,WAAW,EAAE,EAE3CC,IAAgB,EAAG,IAAQ,CAC7BnsB,EAAE,OAAOiK,CAAG,EACZ,IAAMmiB,EAAWniB,EAAI,OAAS,GAC1BmiB,GACApsB,EAAE,OAAOksB,GAAQ,SAASE,CAAQ,CAAC,CAC3C,EAGMC,GAA0B,IAAI,WAAW,EAAE,EACjD,SAASC,GAAW,EAAI,EAAK,EAAO,EAAY,EAAK,CAC7CC,IAAQ,IAAA,IACR9M,EAAO8M,EAAK,IAAA,GAAW,KAAK,EAGhC,IAAMC,EAAUtI,EAAGnnB,EAAK+lB,EAAOuJ,EAAO,EAChCI,EAAU/I,GAAW1X,EAAW,OAAQugB,EAAMA,EAAI,OAAS,EAAG,EAAI,EAIlEvsB,EAAIwpB,GAAS,OAAOgD,CAAO,EAC7BD,GACAJ,GAAansB,EAAGusB,CAAG,EACvBJ,GAAansB,EAAGgM,CAAU,EAC1BhM,EAAE,OAAOysB,CAAO,EAChB,IAAMltB,EAAMS,EAAE,OAAO,EAErB,OADAmgB,GAAMqM,EAASC,CAAO,EACfltB,CACX,CA0FA,IAAamtB,GAAoC9J,GAAW,CAAE,UAAW,GAAI,YAAa,GAAI,UAAW,GAAI,QAAS,EAAK,GAlF5F,IAAe,EAAK,EAAO,KAI/C,CACH,QAAQ,EAAW,EAAQ,CACvB,IAAM+J,EAAU1gB,EAAU,OAC1B,EAASqX,GAAUqJ,EAAU,GAAWhL,EAAQ,EAAK,EACrDA,EAAO,IAAI1V,CAAS,EACpB,IAAM2gB,EAASjL,EAAO,SAAS,EAAG,GAAU,EAE5CkL,EAAU9vB,EAAK+lB,EAAO8J,EAAQA,EAAQ,CAAC,EACvC,IAAMzkB,EAAMmkB,GAAWO,EAAW9vB,EAAK+lB,EAAO8J,EAAQL,CAAG,EAGzD,OAFA5K,EAAO,IAAIxZ,EAAKwkB,CAAO,EACvBxM,GAAMhY,CAAG,EACFwZ,CACX,EACA,QAAQ,EAAY,EAAQ,CACxB,EAAS2B,GAAUtX,EAAW,OAAS,GAAW2V,EAAQ,EAAK,EAC/D,IAAM/gB,EAAOoL,EAAW,SAAS,EAAG,GAAU,EACxC8gB,EAAY9gB,EAAW,SAAS,GAAU,EAC1C7D,EAAMmkB,GAAWO,EAAW9vB,EAAK+lB,EAAOliB,EAAM2rB,CAAG,EAGvD,GAAI,CAACtK,GAAW6K,EAAW3kB,CAAG,EAE1B,MADAgY,GAAMhY,CAAG,EACC,MAAM,aAAa,EAMjC,OAJAwZ,EAAO,IAAI3V,EAAW,SAAS,EAAG,GAAU,CAAC,EAE7C6gB,EAAU9vB,EAAK+lB,EAAOnB,EAAQA,EAAQ,CAAC,EACvCxB,GAAMhY,CAAG,EACFwZ,CACX,CACJ,GAiDY,CAAesK,EAAS,CAAC,EC5ZnCj5B,GAAY,CACjB,KAAM,OACN,KAAM,SACP,EACMg6B,GAAkB,OACxB,SAASC,GAAc,EAAM,CAC5B,GAAI,CAACrsB,EAAK,WAAWosB,EAAe,EAAG,OAAO,KAC9C,IACME,EAAYtsB,EAAK,QAAQ,IAAK,CAAQ,EAC5C,GAAIssB,IAAc,GAAI,OAAO,KAC7B,IAAM/O,EAAU,SAASvd,EAAK,MAAM,EAAUssB,CAAS,EAAG,EAAE,EAE5D,MADI,CAAC,OAAO,UAAU/O,CAAO,GAAKA,EAAU,EAAU,KAC/C,CACN,UACA,WAAYvd,EAAK,MAAMssB,EAAY,CAAC,CACrC,CACD,CACA,SAASC,GAAe,EAAS,EAAY,CAC5C,MAAO,GAAGH,KAAkB7O,EAAQ,GAAGnS,GACxC,CACA,eAAeohB,GAAW,EAAQ,EAAM,CACvC,IAAMC,EAAa,MAAMpO,GAAW,SAAS,CAAC,CAAC,OAAOrW,CAAM,EACtD0kB,EAAc9L,GAAY5gB,CAAI,EACpC,OAAOigB,GAAWoD,GAAayI,EAAiB,CAAC,CAAC,IAAI,WAAWW,CAAU,CAAC,CAAC,CAAC,QAAQC,CAAW,CAAC,CACnG,CACA,eAAeC,GAAW,EAAQ,EAAK,CACtC,IAAMF,EAAa,MAAMpO,GAAW,SAAS,CAAC,CAAC,OAAOrW,CAAM,EACtD0kB,EAActM,GAAW1lB,CAAG,EAC5BkyB,EAASvJ,GAAayI,EAAiB,CAAC,CAAC,IAAI,WAAWW,CAAU,CAAC,EACzE,OAAO,IAAI,YAAY,CAAC,CAAC,OAAOG,EAAO,QAAQF,CAAW,CAAC,CAC5D,CACA,IAAMG,GAAmB,MAAO,CAAE,MAAK,UAAW,CACjD,GAAI,OAAO1wB,GAAQ,SAAU,OAAOqwB,GAAWrwB,EAAK6D,CAAI,EACxD,IAAMgI,EAAS7L,EAAI,KAAK,IAAIA,EAAI,cAAc,EAC9C,GAAI,CAAC6L,EAAQ,MAAU,MAAM,kBAAkB7L,EAAI,eAAe,mBAAmB,EACrF,IAAMiP,EAAa,MAAMohB,GAAWxkB,EAAQhI,CAAI,EAChD,OAAOusB,GAAepwB,EAAI,eAAgBiP,CAAU,CACrD,EACM0hB,GAAmB,MAAO,CAAE,MAAK,UAAW,CACjD,GAAI,OAAO3wB,GAAQ,SAAU,OAAOwwB,GAAWxwB,EAAK6D,CAAI,EACxD,IAAM+sB,EAAWV,GAAcrsB,CAAI,EACnC,GAAI+sB,EAAU,CACb,IAAM/kB,EAAS7L,EAAI,KAAK,IAAI4wB,EAAS,OAAO,EAC5C,GAAI,CAAC/kB,EAAQ,MAAU,MAAM,kBAAkB+kB,EAAS,QAAQ,+CAA+C,EAC/G,OAAOJ,GAAW3kB,EAAQ+kB,EAAS,UAAU,CAC9C,CACA,GAAI5wB,EAAI,aAAc,OAAOwwB,GAAWxwB,EAAI,aAAc6D,CAAI,EAC9D,MAAU,MAAM,yHAAyH,CAC1I,EACM3N,GAAe,KAAO,IAAW,CACtC,IAAM46B,EAAY,OAAOjlB,GAAW,SAAW,IAAI,YAAY,CAAC,CAAC,OAAOA,CAAM,EAAIA,EAClF,OAAO,MAAMmW,GAAmB,CAAC,CAAC,UAAU,MAAO8O,EAAW76B,GAAW,GAAO,CAAC,OAAQ,QAAQ,CAAC,CACnG,EACME,GAAgB,MAAO,EAAO,IAAW,CAC9C,IAAM6J,EAAM,MAAM9J,GAAa2V,CAAM,EAC/BkN,EAAY,MAAMiJ,GAAmB,CAAC,CAAC,KAAK/rB,GAAU,KAAM+J,EAAK,IAAI,YAAY,CAAC,CAAC,OAAOC,CAAK,CAAC,EACtG,OAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW8Y,CAAS,CAAC,CAAC,CAC9D,EChEMvR,GAAY,CACjB,KAAM,OACN,KAAM,SACP,EACMwpB,GAAe,KAAO,IAAW,CACtC,IAAMF,EAAY,OAAOjlB,GAAW,SAAW,IAAI,YAAY,CAAC,CAAC,OAAOA,CAAM,EAAIA,EAClF,OAAO,MAAMmW,GAAmB,CAAC,CAAC,UAAU,MAAO8O,EAAWtpB,GAAW,GAAO,CAAC,OAAQ,QAAQ,CAAC,CACnG,EACMypB,GAAkB,MAAO,EAAiB,EAAO,IAAW,CACjE,GAAI,CACH,IAAMC,EAAkB,KAAKC,CAAe,EACtCpY,EAAY,IAAI,WAAWmY,EAAgB,MAAM,EACvD,IAAK,IAAIrwB,EAAI,EAAGiD,EAAMotB,EAAgB,OAAQrwB,EAAIiD,EAAK,IAAK,EAAUjD,GAAKqwB,EAAgB,WAAWrwB,CAAC,EACvG,OAAO,MAAMmhB,GAAmB,CAAC,CAAC,OAAOxa,GAAWqE,EAAQkN,EAAW,IAAI,YAAY,CAAC,CAAC,OAAO9Y,CAAK,CAAC,CACvG,MAAQ,CACP,MAAO,EACR,CACD,EACMmxB,GAAgB,MAAO,EAAO,IAAW,CAC9C,IAAMpxB,EAAM,MAAMgxB,GAAanlB,CAAM,EAC/BkN,EAAY,MAAMiJ,GAAmB,CAAC,CAAC,KAAKxa,GAAU,KAAMxH,EAAK,IAAI,YAAY,CAAC,CAAC,OAAOC,CAAK,CAAC,EACtG,OAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW8Y,CAAS,CAAC,CAAC,CAC9D,EACMsY,GAAkB,MAAO,EAAO,IAAW,CAChD,IAAMtY,EAAY,MAAMqY,GAAcnxB,EAAO4L,CAAM,EAGnD,MAFA,GAAQ,GAAG5L,EAAM,GAAG8Y,IACpB,EAAQ,mBAAmB9Y,CAAK,EACzBA,CACR,EC5BMqxB,GAAuB,uCAC7B,eAAel7B,GAAQ,EAAS,EAAmB,CAClD,IAAMo7B,EAAcC,EAAQ,QAAQ,IAAI,cAAc,GAAK,GACrDC,EAAwBF,EAAY,YAAY,EACtD,GAAKC,EAAQ,KACb,IAAIE,GAAqBA,EAAkB,OAAS,GAC/C,CAACA,EAAkB,KAAM,GAAY,CACxC,IAAMC,EAA4BF,EAAsB,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EACrEG,EAAoBC,EAAQ,YAAY,CAAC,CAAC,KAAK,EACrD,OAAOF,IAA8BC,GAAqBD,EAA0B,SAASC,CAAiB,CAC/G,CAAC,EAKA,MAJKH,EAIC,IAAIp0B,EAAS,IAAK,CACvB,QAAS,iBAAiBk0B,EAAY,mCAAmCG,EAAkB,KAAK,IAAI,IACpG,KAAM,wBACP,CAAC,EAPiC,IAAIr0B,EAAS,IAAK,CACnD,QAAS,4CAA4Cq0B,EAAkB,KAAK,IAAI,IAChF,KAAM,wBACP,CAAC,EAOH,GAAIL,GAAqB,KAAKI,CAAqB,EAAG,GAAI,CACzD,OAAO,MAAMD,EAAQ,KAAK,CAC3B,OAAS,EAAG,CAKX,MAJI,aAAa,YAAmB,IAAIn0B,EAAS,IAAK,CACrD,QAAS,+BACT,KAAM,aACP,CAAC,EACK,CACP,CACA,GAAIo0B,EAAsB,SAAS,mCAAmC,EAAG,CACxE,IAAMK,EAAW,MAAMN,EAAQ,SAAS,EAClCxY,EAAS,CAAC,EAIhB,OAHA8Y,EAAS,SAAS,EAAO,IAAQ,CAChC,EAAO/xB,GAAOC,EAAM,SAAS,CAC9B,CAAC,EACMgZ,CACR,CACA,GAAIyY,EAAsB,SAAS,qBAAqB,EAAG,CAC1D,IAAMK,EAAW,MAAMN,EAAQ,SAAS,EAClCxY,EAAS,CAAC,EAIhB,OAHA8Y,EAAS,SAAS,EAAO,IAAQ,CAChC,EAAO/xB,GAAOC,CACf,CAAC,EACMgZ,CACR,CAKA,OAJIyY,EAAsB,SAAS,YAAY,EAAU,MAAMD,EAAQ,KAAK,EACxEC,EAAsB,SAAS,0BAA0B,EAAU,MAAMD,EAAQ,YAAY,EAC7FC,EAAsB,SAAS,iBAAiB,GAAKA,EAAsB,SAAS,QAAQ,GAAKA,EAAsB,SAAS,QAAQ,EAAU,MAAMD,EAAQ,KAAK,EACrKC,EAAsB,SAAS,oBAAoB,GAAKD,EAAQ,gBAAgB,eAAuBA,EAAQ,KAC5G,MAAMA,EAAQ,KAAK,EAC3B,CACA,SAASp7B,GAAW,EAAO,CAC1B,OAAO+f,aAAiB9Y,GAAY8Y,GAAO,OAAS,UACrD,CACA,SAAS9f,GAAU,EAAK,CACvB,GAAI,CACH,OAAOqjB,EAAI,SAAS,GAAG,EAAI,mBAAmBA,CAAG,EAAIA,CACtD,MAAQ,CACP,OAAOA,CACR,CACD,CACA,eAAeuY,GAAS,EAAS,CAChC,GAAI,CACH,MAAO,CACN,KAAM,MAAMC,EACZ,MAAO,IACR,CACD,OAAS/b,EAAO,CACf,MAAO,CACN,KAAM,KACN,OACD,CACD,CACD,CAMA,SAASgc,GAAU,EAAK,CACvB,OAAOC,aAAe,SAAW,OAAO,UAAU,SAAS,KAAKA,CAAG,IAAM,kBAC1E,CCjFA,IAAMC,GAAkB,CACvB,OAAQ,YACR,KAAM,SACP,EACMC,IAAgB,EAAK,IAAW,CACrC,GAAI,CAACC,EAAQ,OAAOxyB,EACpB,GAAIwyB,IAAW,UAAYA,IAAW,OACtC,OAAOF,GAAgBE,GAAUxyB,CAClC,EASA,SAASzJ,GAAa,EAAK,CAC1B,GAAI,OAAOojB,GAAQ,SAAU,MAAU,UAAU,+BAA+B,EAChF,IAAM+Y,EAA0B,IAAI,IAChClT,EAAQ,EACZ,KAAOA,EAAQ7F,EAAI,QAAQ,CAC1B,IAAMgZ,EAAQhZ,EAAI,QAAQ,IAAK6F,CAAK,EACpC,GAAImT,IAAU,GAAI,MAClB,IAAIC,EAASjZ,EAAI,QAAQ,IAAK6F,CAAK,EACnC,GAAIoT,IAAW,GAAI,EAASjZ,EAAI,YAC3B,GAAIiZ,EAASD,EAAO,CACxB,EAAQhZ,EAAI,YAAY,IAAKgZ,EAAQ,CAAC,EAAI,EAC1C,QACD,CACA,IAAM3yB,EAAM2Z,EAAI,MAAM6F,EAAOmT,CAAK,CAAC,CAAC,KAAK,EACzC,GAAI,CAACD,EAAQ,IAAI1yB,CAAG,EAAG,CACtB,IAAI6yB,EAAMlZ,EAAI,MAAMgZ,EAAQ,EAAGC,CAAM,CAAC,CAAC,KAAK,EACxCC,EAAI,YAAY,CAAC,IAAM,KAAI,EAAMA,EAAI,MAAM,EAAG,EAAE,GACpDH,EAAQ,IAAI1yB,EAAKxJ,GAAUq8B,CAAG,CAAC,CAChC,CACA,EAAQD,EAAS,CAClB,CACA,OAAOF,CACR,CACA,SAASI,GAAc,EAAM,EAAO,EAAU,CAAC,EAAG,CACjD,IAAMC,EAAeR,GAAapzB,EAAMuI,EAAQ,MAAM,GAAKvI,EACrD6zB,EAAkB,CAAE,GAAGtrB,CAAQ,EAC/BurB,EAAYF,EAAa,YAAY,EAO3C,OANIE,EAAU,WAAW,SAAS,GACjC,EAAgB,OAAS,GACzB,EAAgB,KAAO,IACvB,EAAgB,OAAS,IAAK,IACpBA,EAAU,WAAW,WAAW,IAAG,EAAgB,OAAS,KACnED,EAAgB,cAAgB,IAAQA,EAAgB,UAAU,YAAY,IAAM,UAAQ,EAAgB,OAAS,IAClH,CACN,KAAMD,EACN,QACA,QAASC,CACV,CACD,CACA,SAASE,GAAqB,CAAE,OAAM,QAAO,WAAW,CACvD,IAAIC,EAAS,GAAGh0B,EAAK,GAAGc,IACxB,GAAI,OAAOyH,EAAQ,QAAW,UAAYA,EAAQ,QAAU,EAAG,CAC9D,GAAIA,EAAQ,OAAS,OAAQ,MAAU,MAAM,qFAAqF,EAClI,GAAU,aAAa,KAAK,MAAMA,EAAQ,MAAM,GACjD,CAGA,GAFIA,EAAQ,SAAQ,GAAU,YAAYA,EAAQ,UAC9CA,EAAQ,OAAM,GAAU,UAAUA,EAAQ,QAC1CA,EAAQ,QAAS,CACpB,GAAIA,EAAQ,QAAQ,QAAQ,EAAI,KAAK,IAAI,EAAI,OAAQ,MAAU,MAAM,uFAAuF,EAC5J,GAAU,aAAaA,EAAQ,QAAQ,YAAY,GACpD,CAKA,OAJIA,EAAQ,WAAU,GAAU,cAC5BA,EAAQ,SAAQ,GAAU,YAC1BA,EAAQ,WAAU,GAAU,cAAcA,EAAQ,SAAS,OAAO,CAAC,CAAC,CAAC,YAAY,EAAIA,EAAQ,SAAS,MAAM,CAAC,KAC7GA,EAAQ,cAAa,GAAU,iBAC5ByrB,CACR,CACA,IAAMC,IAAmB,EAAK,EAAO,KACpC,EAAQ,mBAAmBnzB,CAAK,EACzBizB,GAAqBJ,GAAc9yB,EAAKC,EAAOozB,CAAG,CAAC,GAErDC,GAAwB,MAAO,EAAK,EAAO,EAAQ,KACxD,EAAQ,MAAMjC,GAAgBpxB,EAAO4L,CAAM,EACpCqnB,GAAqBJ,GAAc9yB,EAAKC,EAAOozB,CAAG,CAAC,GC9E3D,eAAeE,GAAc,EAAS,EAAU,CAAC,EAAG,CACnD,IAAM9B,EAAU,CACf,KAAM+B,EAAQ,KACd,MAAOA,EAAQ,KAChB,EACA,GAAI9rB,EAAQ,KAAM,CACjB,IAAMuR,EAAS,MAAMvR,EAAQ,KAAK,YAAY,CAAC,SAAS8rB,EAAQ,IAAI,EACpE,GAAIva,EAAO,OAAQ,MAAO,CACzB,KAAM,KACN,MAAOwa,GAAUxa,EAAO,OAAQ,MAAM,CACvC,EACA,EAAQ,KAAOA,EAAO,KACvB,CACA,GAAIvR,EAAQ,MAAO,CAClB,IAAMuR,EAAS,MAAMvR,EAAQ,MAAM,YAAY,CAAC,SAAS8rB,EAAQ,KAAK,EACtE,GAAIva,EAAO,OAAQ,MAAO,CACzB,KAAM,KACN,MAAOwa,GAAUxa,EAAO,OAAQ,OAAO,CACxC,EACA,EAAQ,MAAQA,EAAO,KACxB,CAeA,OAdIvR,EAAQ,gBAAkB,CAAC8rB,EAAQ,QAAgB,CACtD,KAAM,KACN,MAAO,CACN,QAAS,sBACT,OAAQ,CAAC,CACV,CACD,EACI9rB,EAAQ,gBAAkB,CAAC8rB,EAAQ,QAAgB,CACtD,KAAM,KACN,MAAO,CACN,QAAS,sBACT,OAAQ,CAAC,CACV,CACD,EACO,CACN,KAAM/B,EACN,MAAO,IACR,CACD,CACA,SAASgC,GAAU,EAAO,EAAY,CACrC,MAAO,CACN,QAASrd,EAAM,IAAK,GACZ,IAAI,EAAE,MAAM,OAAS,GAAGsd,EAAW,GAAK,EAAE,KAAK,IAAK,GAAM,OAAOC,GAAM,SAAWA,EAAE,IAAMA,CAAC,CAAC,CAAC,KAAK,GAAG,EAAID,EAAW,IAAI,EAAE,SACjI,CAAC,CAAC,KAAK,IAAI,EACZ,OAAQtd,CACT,CACD,CC9CA,IAAMwd,GAAwB,MAAO,EAAS,CAAE,UAAS,UAAW,CACnE,IAAMtqB,EAAU,IAAI,QAChBuqB,EACE,CAAE,OAAM,SAAU,MAAMN,GAAc7rB,EAAS8rB,CAAO,EAC5D,GAAIpd,EAAO,MAAM,IAAI3f,EAAgB2f,EAAM,QAASA,EAAM,MAAM,EAChE,IAAM0d,EAAiBN,EAAQ,UAAY,IAAK,GAA0F,YAAaA,GAAWpB,GAAUoB,EAAQ,OAAO,EAAIA,EAAQ,QAAQ,QAAU,KAArKA,EAAQ,mBAAmB,QAAUA,EAAQ,QAAU,IAAI,QAAQA,EAAQ,OAAO,EAChIO,EAAiBD,GAAgB,IAAI,QAAQ,EAC7CE,EAAgBD,EAAiBr9B,GAAaq9B,CAAc,EAAI,IAAK,GACrEE,EAAkB,CACvB,GAAGT,EACH,KAAM3vB,EAAK,KACX,MAAOA,EAAK,MACZ,KAAM2vB,EAAQ,MAAQU,GAAQ,WAC9B,QAAS,YAAaV,GAAWA,EAAQ,QAAUA,EAAQ,QAAU,CAAC,EACtE,SAAU,IAAK,GACf,QAASA,GAAS,QAClB,QAASA,GAAS,QAClB,OAAQ,WAAYA,EAAUA,EAAQ,OAAS,IAAK,GACpD,OAAQA,EAAQ,SAAW,MAAM,QAAQ9rB,EAAQ,MAAM,EAAIA,EAAQ,OAAO,GAAKA,EAAQ,SAAW,IAAM,MAAQA,EAAQ,QACxH,WAAY,EAAK,IAAU,CAC1B4B,EAAQ,IAAItJ,EAAKC,CAAK,CACvB,EACA,UAAY,GACN6zB,EACEA,EAAe,IAAI9zB,CAAG,EADD,KAG7B,WAAY,EAAK,IAAW,CAC3B,IAAMm0B,EAAW5B,GAAavyB,EAAKwyB,CAAM,EAEzC,OADK2B,GACEH,GAAe,IAAIG,CAAQ,GAAK,IACxC,EACA,gBAAiB,MAAO,EAAK,EAAQ,IAAW,CAC/C,IAAMA,EAAW5B,GAAavyB,EAAKwyB,CAAM,EACzC,GAAI,CAAC2B,EAAU,OAAO,KACtB,IAAMl0B,EAAQ+zB,GAAe,IAAIG,CAAQ,EACzC,GAAI,CAACl0B,EAAO,OAAO,KACnB,IAAMm0B,EAAoBn0B,EAAM,YAAY,GAAG,EAC/C,GAAIm0B,EAAoB,EAAG,OAAO,KAClC,IAAMC,EAAcp0B,EAAM,UAAU,EAAGm0B,CAAiB,EAClDrb,EAAY9Y,EAAM,UAAUm0B,EAAoB,CAAC,EAEvD,OADIrb,EAAU,SAAW,IAAM,CAACA,EAAU,SAAS,GAAG,EAAU,KACzD,MAAMkY,GAAgBlY,EAAWsb,EAAa,MAAMrD,GAAanlB,CAAM,CAAC,EAAIwoB,EAAc,EAClG,EACA,WAAY,EAAK,EAAO,IAAY,CACnC,IAAMlB,EAASC,GAAgBpzB,EAAKC,EAAOyH,CAAO,EAElD,OADA4B,EAAQ,OAAO,aAAc6pB,CAAM,EAC5BA,CACR,EACA,gBAAiB,MAAO,EAAK,EAAO,EAAQ,IAAY,CACvD,IAAMA,EAAS,MAAMG,GAAsBtzB,EAAKC,EAAO4L,EAAQnE,CAAO,EAEtE,OADA4B,EAAQ,OAAO,aAAc6pB,CAAM,EAC5BA,CACR,EACA,SAAW,IACV7pB,EAAQ,IAAI,WAAYtN,CAAG,EACpB,IAAIsB,EAAS,QAAS,IAAK,GAAGgM,CAAO,GAE7C,OAAQ,EAAQ,EAAM,IACd,IAAIhM,EAASg3B,EAAQC,EAAMjrB,CAAO,EAE1C,UAAY,GAAW,CACtB,EAAiBgrB,CAClB,EACA,MAAO,EAAM,IACPd,EAAQ,WACN,CACN,KAAMgB,GAAgB,MAAQC,EAC9B,iBACA,MAAO,MACR,EALgCA,EAOjC,gBAAiBnrB,EACjB,IAAI,gBAAiB,CACpB,OAAOuqB,CACR,CACD,EACA,IAAK,IAAMa,KAAchtB,EAAQ,KAAO,CAAC,EAAG,CAC3C,IAAMitB,EAAW,MAAMD,EAAW,CACjC,GAAGT,EACH,cAAe,GACf,WAAY,EACb,CAAC,EACGU,EAAS,UAAU,OAAO,OAAOV,EAAgB,QAASU,EAAS,QAAQ,EAI3EA,EAAS,SAASA,EAAS,QAAQ,SAAS,EAAO,IAAQ,CAC9DV,EAAgB,gBAAgB,IAAIj0B,EAAKC,CAAK,CAC/C,CAAC,CACF,CACA,OAAOg0B,CACR,EC/FA,SAASt9B,GAAmB,EAAO,CAClC,GAAIsJ,IAAU,IAAK,GAAG,MAAO,GAC7B,IAAM,EAAI,OAAOA,EAKjB,OAJI,IAAM,UAAY,IAAM,UAAY,IAAM,WAAa,IAAM,KAAa,GAC1E,IAAM,SACN,MAAM,QAAQA,CAAK,EAAU,GAC7BA,EAAM,OAAe,GAClBA,EAAM,aAAeA,EAAM,YAAY,OAAS,UAAY,OAAOA,EAAM,QAAW,WAHhE,EAI5B,CACA,SAAS40B,GAAc,EAAK,CAC3B,IAAMC,EAA0B,IAAI,QAC9BC,EAAsB,IAAI,QAC5BC,EAAK,EACHC,GAAc,EAAO,IAAW,CACrC,IAAIC,EAAOC,EACX,KAAOD,GAAM,CACZ,GAAIA,IAASj1B,EAAO,MAAO,GAC3B,EAAO60B,EAAQ,IAAII,CAAI,CACxB,CACA,MAAO,EACR,EACA,OAAO,KAAK,UAAU7C,EAAK,SAAS,EAAM,EAAO,CAChD,GAAI,OAAOpyB,GAAU,SAAU,OAAOA,EAAM,SAAS,EACrD,GAAI,OAAOA,GAAU,UAAYA,EAAgB,CAChD,GAAIg1B,EAAWh1B,EAAO,IAAI,EAAG,MAAO,iBAAiB80B,EAAI,IAAI90B,CAAK,EAAE,GACpE60B,EAAQ,IAAI70B,EAAO,IAAI,EAClB80B,EAAI,IAAI90B,CAAK,GAAG80B,EAAI,IAAI90B,EAAO,GAAI,CACzC,CACA,OAAOA,CACR,CAAC,CACF,CACA,SAASm1B,GAAe,EAAO,CAE9B,MADI,CAACn1B,GAAS,OAAOA,GAAU,SAAiB,GACzC,UAAWA,GAASA,EAAM,QAAU,MAC5C,CAiBA,IAAMo1B,GAAuC,IAAI,IAAI,kUA4BrD,CAAC,EACD,SAASC,GAAwB,EAAS,CACzC,IAAK,IAAMn2B,KAAQk2B,GAAsB/rB,EAAQ,OAAOnK,CAAI,CAC7D,CAMA,SAASo2B,GAAY,EAAQ,EAAQ,CACpC,GAAKhY,EACL,IAAK,GAAM,CAACvd,EAAKC,KAAU,IAAI,QAAQsd,CAAM,CAAC,CAAC,QAAQ,EAAOvd,EAAI,YAAY,IAAM,aAAcd,EAAO,OAAOc,EAAKC,CAAK,EACrHf,EAAO,IAAIc,EAAKC,CAAK,CAC3B,CACA,SAASu1B,GAAW,EAAM,EAAM,CAC/B,GAAI3xB,aAAgB,SAAU,CAC7B,GAAI4xB,GAAM,QAAS,CAClB,IAAMC,EAAc,IAAI,QAAQD,EAAK,OAAO,EAC5CH,GAAwBI,CAAW,EACnCH,GAAY1xB,EAAK,QAAS6xB,CAAW,CACtC,CACA,OAAO7xB,CACR,CACA,GAAIuxB,GAAevxB,CAAI,EAAG,CACzB,IAAM0wB,EAAO1wB,EAAK,KACZ2wB,EAAiB3wB,EAAK,eAC5B,GAAI2wB,aAA0B,SAAU,OAAOA,EAC/C,IAAMlrB,EAAU,IAAI,QAGpB,GAFAisB,GAAYjsB,EAASkrB,GAAgB,OAAO,EAC5Ce,GAAYjsB,EAASzF,EAAK,OAAO,EAC7B4xB,GAAM,QAAS,CAClB,IAAMC,EAAc,IAAI,QAAQD,EAAK,OAAO,EAC5CH,GAAwBI,CAAW,EACnCH,GAAYjsB,EAASosB,CAAW,CACjC,CACApsB,EAAQ,IAAI,eAAgB,kBAAkB,EAC9C,IAAMgrB,EAASzwB,EAAK,QAAU4xB,GAAM,QAAUjB,GAAgB,OACxDmB,EAAaF,GAAM,YAAcjB,GAAgB,WACvD,OAAO,IAAI,SAAS,KAAK,UAAUD,CAAI,EAAG,CACzC,GAAGC,EACH,UACA,GAAGF,IAAW,IAAK,GAAI,CAAC,EAAI,CAAE,QAAO,EACrC,GAAGqB,IAAe,IAAK,GAAI,CAAC,EAAI,CAAE,YAAW,CAC9C,CAAC,CACF,CACA,GAAI/+B,GAAWiN,CAAI,EAAG,OAAO2xB,GAAW3xB,EAAK,KAAM,CAClD,OAAQ4xB,GAAM,QAAU5xB,EAAK,WAC7B,WAAYA,EAAK,OAAO,SAAS,EACjC,QAAS4xB,GAAM,SAAW5xB,EAAK,OAChC,CAAC,EACD,IAAI0wB,EAAO1wB,EACLyF,EAAU,IAAI,QAAQmsB,GAAM,OAAO,EAyBzC,OAxBAH,GAAwBhsB,CAAO,EAC1BzF,EAGM,OAAOA,GAAS,UAC1B,EAAOA,EACPyF,EAAQ,IAAI,eAAgB,YAAY,GAC9BzF,aAAgB,aAAe,YAAY,OAAOA,CAAI,GAChE,EAAOA,EACPyF,EAAQ,IAAI,eAAgB,0BAA0B,GAC5CzF,aAAgB,MAC1B,EAAOA,EACPyF,EAAQ,IAAI,eAAgBzF,EAAK,MAAQ,0BAA0B,GACzDA,aAAgB,SAAU,EAAOA,EACnCA,aAAgB,iBACxB,EAAOA,EACPyF,EAAQ,IAAI,eAAgB,mCAAmC,GACrDzF,aAAgB,gBAC1B,EAAOA,EACPyF,EAAQ,IAAI,eAAgB,0BAA0B,GAC5C3S,GAAmBkN,CAAI,IACjC,EAAOgxB,GAAchxB,CAAI,EACzByF,EAAQ,IAAI,eAAgB,kBAAkB,IApB1CzF,IAAS,OAAM,EAAO,KAAK,UAAU,IAAI,GAC7CyF,EAAQ,IAAI,eAAgB,kBAAkB,GAqBxC,IAAI,SAASirB,EAAM,CACzB,GAAGkB,EACH,SACD,CAAC,CACF,CC5JA,SAASG,GAAe,EAAe,EAAkB,EAAgB,CACxE,IAAM1B,EAAO,OAAO2B,GAAkB,SAAWA,EAAgB,IAAK,GAChEnuB,EAAU,OAAOouB,GAAqB,SAAWA,EAAmBD,EACpEE,EAAU,OAAOD,GAAqB,WAAaA,EAAmBE,EAC5E,IAAKtuB,EAAQ,SAAW,OAASA,EAAQ,SAAW,SAAWA,EAAQ,KAAM,MAAM,IAAI9K,EAAgB,8CAA8C,EACrJ,GAAIs3B,GAAQ,SAAS,KAAKA,CAAI,EAAG,MAAM,IAAIt3B,EAAgB,yCAAyC,EACpG,IAAMq5B,EAAkB,MAAO,GAAGC,IAAa,CAC9C,IAAM1C,EAAU0C,EAAS,IAAM,CAAC,EAC1B,CAAE,KAAMjC,EAAiB,MAAOkC,GAAoB,MAAMjE,GAAS0B,GAAsBJ,EAAS,CACvG,UACA,MACD,CAAC,CAAC,EACF,GAAI2C,EAMH,MALMA,aAA2Bt/B,GAC7B6Q,EAAQ,mBAAmB,MAAMA,EAAQ,kBAAkB,CAC9D,QAASyuB,EAAgB,QACzB,OAAQA,EAAgB,MACzB,CAAC,EACK,IAAI74B,EAAS,IAAK,CACvB,QAAS64B,EAAgB,QACzB,KAAM,kBACP,CAAC,GARwDA,EAU1D,IAAMxB,EAAW,MAAMoB,EAAQ9B,CAAe,CAAC,CAAC,MAAM,KAAO,IAAM,CAClE,GAAIn9B,GAAW,CAAC,EAAG,CAClB,IAAMs/B,EAAa1uB,EAAQ,WAE3B,GADI0uB,GAAY,MAAMA,EAAW,CAAC,EAC9B5C,EAAQ,WAAY,OAAO,CAChC,CACA,MAAM,CACP,CAAC,EACKlqB,EAAU2qB,EAAgB,gBAC1BK,EAASL,EAAgB,eAC/B,OAAOT,EAAQ,WAAagC,GAAWb,EAAUL,IAAW,IAAK,GAAI,CAAE,SAAQ,EAAI,CAClF,UACA,QACD,CAAC,EAAId,EAAQ,cAAgBA,EAAQ,aAAe,CACnD,UACA,WACA,QACD,EAAI,CACH,UACA,UACD,EAAIA,EAAQ,aAAe,CAC1B,WACA,QACD,EAAImB,CACL,EAGA,MAFA,GAAgB,QAAUjtB,EAC1B,EAAgB,KAAOwsB,EAChB+B,CACR,CACA,SAASI,GAAkB,EAAO,EAAY,CAC7C,MAAO,CAAC,GAAGC,GAAS,CAAC,EAAG,GAAGC,GAAc,CAAC,CAAC,CAC5C,CACA,GAAe,OAAU,GAAS,CACjC,SAASC,EAAyB,GAAG5Q,EAAM,CAC1C,GAAIA,EAAK,SAAW,EAAG,CACtB,GAAM,CAACsO,EAAMxsB,EAASquB,GAAWnQ,EACjC,OAAOgQ,GAAe1B,EAAM,CAC3B,GAAGxsB,EACH,IAAK2uB,GAAkB3uB,EAAQ,IAAKud,GAAM,GAAG,CAC9C,EAAG8Q,CAAO,CACX,CACA,GAAM,CAACruB,EAASquB,GAAWnQ,EAC3B,OAAOgQ,GAAe,CACrB,GAAGluB,EACH,IAAK2uB,GAAkB3uB,EAAQ,IAAKud,GAAM,GAAG,CAC9C,EAAG8Q,CAAO,CACX,CACA,OAAOS,CACR,ECxEA,SAASC,GAAiB,EAAkB,EAAS,CACpD,IAAMR,EAAkB,KAAO,IAAa,CAC3C,IAAMzC,EAAU0C,EACVQ,EAAW,OAAOC,GAAqB,WAAaA,EAAmBZ,EACvE9B,EAAkB,MAAML,GAAsBJ,EAAS,CAC5D,QAAS,OAAOmD,GAAqB,WAAa,CAAC,EAAIA,EACvD,KAAM,GACP,CAAC,EACD,GAAI,CAACD,EAAU,MAAU,MAAM,yBAAyB,EACxD,GAAI,CACH,IAAM/B,EAAW,MAAM+B,EAASzC,CAAe,EACzC3qB,EAAU2qB,EAAgB,gBAChC,OAAOT,EAAQ,cAAgB,CAC9B,UACA,UACD,EAAImB,CACL,OAAS,EAAG,CAQX,MAPI59B,GAAW,CAAC,GAAG,OAAO,eAAe,EAAGmG,EAAuB,CAClE,WAAY,GACZ,aAAc,GACd,KAAM,CACL,OAAO+2B,EAAgB,eACxB,CACD,CAAC,EACK,CACP,CACD,EAEA,MADA,GAAgB,QAAU,OAAO0C,GAAqB,WAAa,CAAC,EAAIA,EACjEV,CACR,CACA,GAAiB,OAAU,GAAS,CACnC,SAAS9O,EAAG,EAAkB,EAAS,CACtC,GAAI,OAAOwP,GAAqB,WAAY,OAAOF,GAAiB,CAAE,IAAKxR,GAAM,GAAI,EAAG0R,CAAgB,EACxG,GAAI,CAACZ,EAAS,MAAU,MAAM,gCAAgC,EAC9D,OAAOU,GAAiB,CACvB,GAAGE,EACH,OAAQ,IACR,IAAK,CAAC,GAAG1R,GAAM,KAAO,CAAC,EAAG,GAAG0R,EAAiB,KAAO,CAAC,CAAC,CACxD,EAAGZ,CAAO,CACX,CACA,OAAO5O,CACR,EC3CA,IAAMyP,GAAQ,CAAC,EACf,SAASC,GAAmB,EAAS,CACpC,OAAQC,EAAQ,YAAY,KAA5B,CACC,IAAK,YAAa,MAAO,SACzB,IAAK,YAAa,MAAO,SACzB,IAAK,aAAc,MAAO,UAC1B,IAAK,YAAa,MAAO,SACzB,IAAK,WAAY,MAAO,QACxB,QAAS,MAAO,QACjB,CACD,CACA,SAASC,GAAc,EAAS,CAC/B,IAAMxtB,EAAa,CAAC,EAgBpB,OAfI7B,EAAQ,UAAU,SAAS,YAC9B6B,EAAW,KAAK,GAAG7B,EAAQ,SAAS,QAAQ,UAAU,EAC/C6B,IAEJ7B,EAAQ,iBAAiBxL,GAAW,OAAO,QAAQwL,EAAQ,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC1H,EAAKC,KAAW,CACjGA,aAAiB/D,GAAWqN,EAAW,KAAK,CAC/C,KAAMvJ,EACN,GAAI,QACJ,OAAQ,CACP,KAAM62B,GAAmB52B,CAAK,EAC9B,GAAG,cAAeA,GAASA,EAAM,UAAY,CAAE,UAAWA,EAAM,SAAU,EAAI,CAAC,EAC/E,YAAaA,EAAM,WACpB,CACD,CAAC,CACF,CAAC,EACMsJ,EACR,CACA,SAASytB,GAAe,EAAS,CAChC,GAAItvB,EAAQ,UAAU,SAAS,YAAa,OAAOA,EAAQ,SAAS,QAAQ,YAC5E,GAAKA,EAAQ,OACTA,EAAQ,gBAAgBxL,GAAawL,EAAQ,gBAAgBvL,GAAa,CAC7E,IAAM86B,EAAQvvB,EAAQ,KAAK,MAC3B,GAAI,CAACuvB,EAAO,OACZ,IAAMC,EAAa,CAAC,EACdzc,EAAW,CAAC,EAUlB,OATA,OAAO,QAAQwc,CAAK,CAAC,CAAC,SAAS,CAACj3B,EAAKC,KAAW,CAC3CA,aAAiB/D,IACpB,EAAW8D,GAAO,CACjB,KAAM62B,GAAmB52B,CAAK,EAC9B,YAAaA,EAAM,WACpB,EACMA,aAAiB9D,GAAcse,EAAS,KAAKza,CAAG,EAExD,CAAC,EACM,CACN,SAAU0H,EAAQ,gBAAgBvL,EAAc,GAAQ,IAAQ,KAChE,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,aACA,UACD,CAAE,CAAE,CACL,CACD,CACD,CACA,SAASg7B,GAAY,EAAW,CAC/B,MAAO,CACN,IAAO,CACN,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,QAAS,CAAE,KAAM,QAAS,CAAE,EAC1C,SAAU,CAAC,SAAS,CACrB,CAAE,CAAE,EACJ,YAAa,wEACd,EACA,IAAO,CACN,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,QAAS,CAAE,KAAM,QAAS,CAAE,EAC1C,SAAU,CAAC,SAAS,CACrB,CAAE,CAAE,EACJ,YAAa,yDACd,EACA,IAAO,CACN,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,QAAS,CAAE,KAAM,QAAS,CAAE,CAC3C,CAAE,CAAE,EACJ,YAAa,0FACd,EACA,IAAO,CACN,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,QAAS,CAAE,KAAM,QAAS,CAAE,CAC3C,CAAE,CAAE,EACJ,YAAa,kDACd,EACA,IAAO,CACN,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,QAAS,CAAE,KAAM,QAAS,CAAE,CAC3C,CAAE,CAAE,EACJ,YAAa,uEACd,EACA,IAAO,CACN,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,QAAS,CAAE,KAAM,QAAS,CAAE,CAC3C,CAAE,CAAE,EACJ,YAAa,+EACd,EACA,GAAGC,CACJ,CACD,CACA,eAAeC,GAAU,EAAW,EAAQ,CA6B3C,OA3BA,OAAO,QAAQC,CAAS,CAAC,CAAC,SAAS,CAACC,EAAGt3B,KAAW,CACjD,IAAMyH,EAAUzH,EAAM,QACtB,GAAKA,EAAM,MAAQ,GAAQ,UAAU,cACjCyH,EAAQ,SAAW,QAAO,GAAMzH,EAAM,MAAQ,CAAE,IAAK,CACxD,KAAM,CAAC,UAAW,GAAGyH,EAAQ,UAAU,SAAS,MAAQ,CAAC,CAAC,EAC1D,YAAaA,EAAQ,UAAU,SAAS,YACxC,YAAaA,EAAQ,UAAU,SAAS,YACxC,SAAU,CAAC,CAAE,WAAY,CAAC,CAAE,CAAC,EAC7B,WAAYqvB,GAAcrvB,CAAO,EACjC,UAAWyvB,GAAYzvB,EAAQ,UAAU,SAAS,SAAS,CAC5D,CAAE,GACEA,EAAQ,SAAW,QAAQ,CAC9B,IAAM6sB,EAAOyC,GAAetvB,CAAO,EACnC,GAAMzH,EAAM,MAAQ,CAAE,KAAM,CAC3B,KAAM,CAAC,UAAW,GAAGyH,EAAQ,UAAU,SAAS,MAAQ,CAAC,CAAC,EAC1D,YAAaA,EAAQ,UAAU,SAAS,YACxC,YAAaA,EAAQ,UAAU,SAAS,YACxC,SAAU,CAAC,CAAE,WAAY,CAAC,CAAE,CAAC,EAC7B,WAAYqvB,GAAcrvB,CAAO,EACjC,GAAG6sB,EAAO,CAAE,YAAaA,CAAK,EAAI,CAAE,YAAa,CAAE,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CAC3F,KAAM,SACN,WAAY,CAAC,CACd,CAAE,CAAE,CAAE,CAAE,EACR,UAAW4C,GAAYzvB,EAAQ,UAAU,SAAS,SAAS,CAC5D,CAAE,CACH,CACD,CAAC,EACM,CACN,QAAS,QACT,KAAM,CACL,MAAO,cACP,YAAa,8CACb,QAAS,OACV,EACA,YAnCoB,QAAS,CAAC,CAmC9B,EACA,SAAU,CAAC,CAAE,aAAc,CAAC,CAAE,CAAC,EAC/B,QAAS,CAAC,CAAE,IAAK8vB,GAAQ,GAAI,CAAC,EAC9B,KAAM,CAAC,CACN,KAAM,UACN,YAAa,8GACd,CAAC,EACD,QACD,CACD,CACA,IAAMC,IAAW,EAAc,IAAW;;;;;;;;;;;;;MAapC,KAAK,UAAUC,CAAY,EAAE;;;;eAIpBF,GAAQ,KAAO,2BAA2B,mBAAmBA,EAAO,IAAI,IAAM,IAAK,GAAE;cACtFA,GAAQ,OAAS,SAAS;;YAE5BA,GAAQ,OAAS,qBAAqB;kBAChCA,GAAQ,aAAe,uBAAuB;;;;;;;;SC/K1DG,QAAsC,CAC3C,IAAM,EAAI,UAAW,CAAC,EACtB,MAAO,GAAE,UAAY,OAAO,OAAO,IAAI,EAAG,OAAO,OAAO,EAAE,SAAS,EAAG,CACvE,EAAA,CAAG,EACH,SAASC,IAAe,CACvB,MAAO,CACN,KAAM,CAAE,IAAK,EAAG,EAChB,OAAQ,IAAID,EACb,CACD,CACA,SAASE,GAAe,EAAM,CAC7B,IAAIh3B,EAAI,EACJi3B,EAAQ,EACZ,KAAOj3B,EAAIqzB,EAAK,OAAQ,IAAK,CAC5B,IAAMzwB,EAAIywB,EAAK,WAAWrzB,CAAC,EAC3B,GAAI4C,IAAM,GAAI,SACT,GAAIA,IAAM,GAAI,SACd,GAAIA,IAAM,IAAMq0B,EAAQ,EAAG,SAC3B,GAAIr0B,IAAM,KAAOq0B,IAAU,EAAG,KACpC,CACA,GAAIj3B,GAAKqzB,EAAK,OAAQ,OACtB,IAAIvL,EAAI9nB,EAAI,EAEZ,IADA,EAAQ,EACD8nB,EAAIuL,EAAK,OAAQ,IAAK,CAC5B,IAAMzwB,EAAIywB,EAAK,WAAWvL,CAAC,EAC3B,GAAIllB,IAAM,GAAI,SACT,GAAIA,IAAM,GAAI,SACd,GAAIA,IAAM,IAAMq0B,EAAQ,EAAG,SAC3B,GAAIr0B,IAAM,KAAOq0B,IAAU,EAAG,KACpC,CACA,GAAInP,GAAKuL,EAAK,OAAQ,OACtB,IAAM6D,EAAM7D,EAAKvL,EAAI,GACfqP,EAASD,IAAQ,KAAOA,IAAQ,KAAOA,IAAQ,IACrD,MAAO,CACN7D,EAAK,MAAM,EAAGrzB,CAAC,EACfqzB,EAAK,MAAMrzB,EAAI,EAAG8nB,CAAC,EACnBuL,EAAK,MAAMvL,GAAKqP,EAAS,EAAI,EAAE,EAC/BA,EAASD,EAAM,IAAK,EACrB,CACD,CACA,SAASE,GAAsB,EAAM,CACpC,GAAI,CAAC/D,EAAK,SAAS,GAAG,EAAG,OACzB,IAAMgE,EAAQL,GAAe3D,CAAI,EACjC,GAAI,CAACgE,EAAO,OACZ,GAAM,CAACC,EAAK5D,EAAM6D,EAAKL,GAAOG,EAC9B,GAAI,CAACH,EAAK,MAAO,CAACI,EAAM5D,EAAO6D,CAAG,EAClC,GAAIL,IAAQ,IAAK,MAAO,CAACI,EAAM5D,EAAO6D,EAAKD,EAAMC,CAAG,EACpD,GAAI7D,EAAK,SAAS,GAAG,EAAG,MAAU,MAAM,8CAA8C,EACtF,MAAO,CAAC,GAAG4D,EAAI,KAAK5D,EAAK,GAAGwD,IAAMK,GAAK,CACxC,CACA,IAAMC,GAAuB,kBACvBC,GAAuB,cAC7B,SAASC,GAAkB,EAAO,CACjC,MAAO,GAAGF,KAAuB7Y,GAClC,CACA,SAASgZ,GAAY,EAAM,CAC1B,MAAO,gCAAgC,KAAKr5B,CAAI,EAAIA,EAAOm5B,GAAuBn5B,EAAK,QAAQ,QAAU,GAAMsE,IAAM,IAAM,KAAO,IAAI,CACvI,CACA,SAASg1B,GAAc,EAAK,CAG3B,OAFIz4B,EAAI,WAAW,CAAC,IAAM,GACtBA,EAAI,WAAW,aAAa,EAAUA,EAAI,MAAM,EAAE,CAAC,CAAC,QAAQ,SAAW,GAAMyD,IAAM,KAAO,IAAM,GAAG,EAChGzD,EAAI,WAAW,iBAAiB,EAAIA,EAAI,MAAM,EAAE,EAAIA,EAFtBA,CAGtC,CACA,SAAS04B,GAAmB,EAAS,CACpC,IAAIZ,EAAQ,EACZ,IAAK,IAAIj3B,EAAI,EAAGA,EAAI83B,EAAQ,OAAQ,IAAK,CACxC,IAAM3U,EAAK2U,EAAQ,WAAW93B,CAAC,EAC/B,GAAImjB,IAAO,GACV,SAGD,GAAIA,IAAO,GACV,SAGD,GAAIA,IAAO,IAAM8T,EAAQ,EACxB,SAGD,GAAI9T,IAAO,IAAM8T,IAAU,EAAG,MAAO,EACtC,CACA,MAAO,EACR,CACA,SAASc,GAAwB,EAAS,EAAc,EAAaL,GAAmB,CACvF,IAAIT,EAAQ,EACRe,EAAYC,EACZC,EAAW,GACf,IAAK,IAAIl4B,EAAI,EAAGA,EAAI83B,EAAQ,OAAQ,IAAK,CACxC,IAAM3U,EAAK2U,EAAQ,WAAW93B,CAAC,EAC3BmjB,IAAO,IACV,GAAY2U,EAAQ93B,GAChBA,EAAI,EAAI83B,EAAQ,SAAQ,GAAYA,EAAQ,EAAE93B,KAG/CmjB,IAAO,IACV,IACA,GAAY2U,EAAQ93B,IAGjBmjB,IAAO,IAAM8T,EAAQ,GACxB,IACA,GAAYa,EAAQ93B,IAGrB,AAIAk4B,GAJI/U,IAAO,IAAM8T,IAAU,EACd,MAAMkB,EAAW,GAAW,EAAE,SAG/BL,EAAQ93B,EACrB,CACA,MAAO,CAACk4B,EAAUF,CAAS,CAC5B,CACA,SAASI,GAAc,EAAM,CAE5B,OADK/E,EAAK,SAAS,IAAI,EAChBA,EAAK,QAAQ,gBAAiB,EAAG,IAAM,IAAM,QAAQ,QAAQ,QAAQzwB,CAAC,EAAE,EAD9CywB,CAElC,CACA,SAASgF,GAAW,EAAS,CAM5B,OALIP,EAAQ,WAAW,IAAI,EAAU,EACjCA,IAAY,KAAOA,EAAQ,SAAS,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAAKD,GAAmBC,CAAO,EAAU,EACzGA,IAAY,MAAc,IAC1BA,IAAY,SAAiB,KAC5BA,EAAQ,SAAS,GAAG,EAClBA,EAAQ,QAAQ,kBAAmB,EAAG,IAAMl1B,IAAM,IAAM,IAAMA,IAAM,IAAM,IAAMA,IAAM,IAAM,IAAMA,IAAM,IAAM,IAAM,GAAG,EAD3Fk1B,CAEpC,CACA,SAASQ,GAAgB,EAAU,CAClC,IAAK,IAAIt4B,EAAI,EAAGA,EAAIu4B,EAAS,OAAQ,IAAK,CACzC,IAAMpsB,EAAOosB,EAASv4B,EAAE,CAAC,WAAWu4B,EAASv4B,EAAE,CAAC,OAAS,CAAC,EAC1D,GAAImM,IAAS,IAAMA,IAAS,IAAMA,IAAS,GAAI,SAC/C,IAAMqsB,EAAID,EAASv4B,EAAE,CAAC,MAAM,oCAAoC,EAChE,GAAI,CAACw4B,EAAG,SACR,IAAMlB,EAAMiB,EAAS,MAAM,EAAGv4B,CAAC,EACzBu3B,EAAMgB,EAAS,MAAMv4B,EAAI,CAAC,EAChC,GAAIw4B,EAAE,KAAO,IAAK,MAAO,CAAC,IAAMlB,EAAI,OAAOkB,EAAE,EAAE,CAAC,CAAC,OAAOjB,CAAG,CAAC,CAAC,KAAK,GAAG,EAAG,IAAMD,EAAI,OAAOC,CAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EACvG,IAAMj5B,EAAOk6B,EAAE,EAAE,CAAC,MAAM,WAAW,CAAC,GAAG,IAAM,IACvCC,EAAK,IAAM,CAChB,GAAGnB,EACH,MAAMh5B,IACN,GAAGi5B,CACJ,CAAC,CAAC,KAAK,GAAG,EACJmB,EAAU,IAAM,CAAC,GAAGpB,EAAK,GAAGC,CAAG,CAAC,CAAC,KAAK,GAAG,EAC/C,OAAOiB,EAAE,KAAO,IAAM,CAACC,CAAE,EAAI,CAACA,EAAIC,CAAO,CAC1C,CACD,CACA,SAASC,GAAc,EAAM,CAC5B,GAAI,CAACtF,EAAK,SAAS,IAAI,EAAG,OAAOA,EACjC,IAAM3J,EAAI,CAAC,EACX,IAAK,IAAMlgB,KAAK6pB,EAAK,MAAM,GAAG,EAAG,GAAI7pB,IAAM,IAAK,cACvCA,IAAM,MAAQkgB,EAAE,OAAS,EAAGA,EAAE,IAAI,EACtCA,EAAE,KAAKlgB,CAAC,EACb,OAAOkgB,EAAE,KAAK,GAAG,GAAK,GACvB,CACA,SAASkP,GAAU,EAAM,CACxB,IAAMpvB,EAAI6pB,EAAK,MAAM,GAAG,EAGxB,OAFA7pB,EAAE,MAAM,EACJA,EAAEA,EAAE,OAAS,KAAO,IAAIA,EAAE,IAAI,EAC3BA,CACR,CACA,SAASqvB,GAAW,EAAM,CACzB,IAAMrvB,EAAIovB,GAAUvF,CAAI,EACxB,KAAO7pB,EAAEA,EAAE,OAAS,KAAO,IAAIA,EAAE,IAAI,EACrC,OAAOA,CACR,CACA,SAASsvB,GAAe,EAAU,EAAW,CAC5C,IAAM76B,EAAS,IAAI64B,GACnB,IAAK,GAAM,CAACnY,EAAOrgB,KAASy6B,EAAW,CACtC,IAAMjB,EAAUnZ,EAAQ,EAAI4Z,EAAS,MAAM,EAAE5Z,EAAQ,EAAE,CAAC,CAAC,KAAK,GAAG,EAAI4Z,EAAS5Z,GAC9E,GAAI,OAAOrgB,GAAS,SAAU,EAAOA,GAAQw5B,MACxC,CACJ,IAAMkB,EAAQlB,EAAQ,MAAMx5B,CAAI,EAChC,GAAI06B,EAAO,IAAK,IAAM75B,KAAO65B,EAAM,OAAQ,EAAOpB,GAAcz4B,CAAG,GAAK65B,EAAM,OAAO75B,EACtF,CACD,CACA,OAAOlB,CACR,CACA,SAASg7B,GAAS,EAAK,EAAS,GAAI,EAAM,EAAM,CAC/C,EAASC,EAAO,YAAY,EACxB7F,EAAK,WAAW,CAAC,IAAM,KAAI,EAAO,IAAIA,KAC1C,IAAM8F,EAAgB/B,GAAsB/D,CAAI,EAChD,GAAI8F,EAAe,CAClB,IAAK,IAAMC,KAAgBD,EAAeF,GAASI,EAAKH,EAAQE,EAAcp2B,CAAI,EAClF,MACD,CACA,EAAOo1B,GAAc/E,CAAI,EACzB,IAAMkF,EAAWM,GAAWxF,CAAI,EAC1BiG,EAAWhB,GAAgBC,CAAQ,EACzC,GAAIe,EAAU,CACb,IAAK,IAAMC,KAAKD,EAAUL,GAASI,EAAKH,EAAQK,EAAGv2B,CAAI,EACvD,MACD,CACA,IAAIw2B,EAAOH,EAAI,KACXI,EAAqB,EACnBV,EAAY,CAAC,EACbW,EAAe,CAAC,EACtB,IAAK,IAAI15B,EAAI,EAAGA,EAAIu4B,EAAS,OAAQ,IAAK,CACzC,IAAIT,EAAUS,EAASv4B,GACjBb,EAAMk5B,GAAWP,CAAO,EAC9B,GAAI34B,IAAQ,EAAG,CACTq6B,EAAK,WAAU,EAAK,SAAW,CAAE,IAAK,IAAK,GAChD,EAAOA,EAAK,SACZT,EAAU,KAAK,CACd,EAAE/4B,EAAI,GACN83B,EAAQ,MAAM,GAAG,CAAC,CAAC,IAAM,IACzBA,EAAQ,SAAW,CACpB,CAAC,EACD,KACD,CACA,GAAI34B,IAAQ,EAAG,CAGd,GAFKq6B,EAAK,QAAO,EAAK,MAAQ,CAAE,IAAK,GAAI,GACzC,EAAOA,EAAK,MACR1B,IAAY,IAAKiB,EAAU,KAAK,CACnC/4B,EACA,OAAO,GAAoB,EAC3B,EACD,CAAC,OACI,GAAI83B,EAAQ,SAAS,GAAG,GAAKA,EAAQ,SAAS,IAAK,CAAC,GAAK,CAAC,YAAY,KAAKA,CAAO,EAAG,CACzF,GAAM,CAAC6B,EAAQ3B,GAAa4B,GAAe9B,EAAS2B,CAAkB,EACtE,EAAqBzB,EACrB,EAAah4B,GAAK25B,EAClB,EAAK,cAAgB,GACrBZ,EAAU,KAAK,CACd/4B,EACA25B,EACA,EACD,CAAC,CACF,MAAOZ,EAAU,KAAK,CACrB/4B,EACA83B,EAAQ,MAAM,CAAC,EACf,EACD,CAAC,EACD,QACD,CACA,EAAU,EAAS93B,GAAKb,EACxB,IAAM06B,EAAQL,EAAK,SAAS1B,GAC5B,GAAI+B,EAAO,EAAOA,MACb,CACJ,IAAMC,EAAa,CAAE,IAAKhC,CAAQ,EAC7B0B,EAAK,SAAQ,EAAK,OAAS,IAAI1C,IACpC,EAAK,OAAOgB,GAAWgC,EACvB,EAAOA,CACR,CACD,CACA,IAAMC,EAAYhB,EAAU,OAAS,EAC/BiB,EAAU,EAAK,UAAY,IAAIlD,IACpC,EAAQoC,KAAY,CAAC,EAAA,CAAG,KAAK,CAC7B,KAAMl2B,GAAQ,KACd,eACA,UAAW+2B,EAAYhB,EAAY,IAAK,EACzC,CAAC,EACIgB,IAAW,EAAI,OAAO,IAAMxB,EAAS,KAAK,GAAG,GAAKiB,EACxD,CACA,SAASI,GAAe,EAAS,EAAe,EAAG,CAClD,IAAIK,EAAKhC,EACLiC,EAAK,GAAIC,EAAK,EAClB,IAAK,IAAIrS,EAAI,EAAGA,EAAIgQ,EAAQ,OAAQ,IAAK,CACxC,IAAMl1B,EAAIk1B,EAAQ,WAAWhQ,CAAC,EAC9B,GAAIllB,IAAM,GAAI,SACT,GAAIA,IAAM,IAAMu3B,EAAK,EAAG,SACxB,GAAIv3B,IAAM,IAAMu3B,IAAO,GAAKrS,EAAI,EAAIgQ,EAAQ,OAAQ,CACxD,IAAM,EAAIA,EAAQhQ,EAAI,GACtB,GAAI,IAAM,KAAO,IAAM,KAAO,IAAM,KAAO,IAAM,KAAM,CACtD,GAAM,IAAM,EACZ,IACA,QACD,CACD,MAAO,GAAIllB,IAAM,IAAMu3B,IAAO,EAAG,CAChC,GAAM,MACN,QACD,CACA,GAAMrC,EAAQhQ,EACf,CACA,CAACoS,EAAID,GAAMlC,GAAwBmC,EAAID,CAAE,EACzC,IAAMG,EAAQF,EAAG,QAAQ,8BAA+B,EAAG,EAAI,IAAM,MAAMvC,GAAYxD,CAAE,EAAE,GAAGoF,GAAK,QAAQ,EAAE,CAAC,CAAC,QAAQ,kBAAqB,MAAM7B,GAAkB,GAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,cAAe,EAAG,IAAM,qBAAqB,KAAK90B,CAAC,EAAI,KAAKA,IAAMA,CAAC,EACzP,MAAO,CAAK,OAAO,IAAIw3B,EAAM,EAAE,EAAGH,CAAE,CACrC,CACA,SAASI,GAAU,EAAK,EAAS,GAAI,EAAM,EAAM,CAC5CjW,GAAM,YAAW,EAAOuU,GAActF,CAAI,GAC1CA,EAAK,WAAWA,EAAK,OAAS,CAAC,IAAM,KAAI,EAAOA,EAAK,MAAM,EAAG,EAAE,GACpE,IAAMyG,EAAaT,EAAI,OAAOhG,GAC9B,GAAIyG,GAAcA,EAAW,QAAS,CACrC,IAAMQ,EAAcR,EAAW,QAAQZ,IAAWY,EAAW,QAAQ,IACrE,GAAIQ,IAAgB,IAAK,GAAG,OAAOA,EAAY,EAChD,CACA,IAAM/B,EAAWK,GAAUvF,CAAI,EACzB2F,EAAQuB,GAAYlB,EAAI,KAAMH,EAAQX,EAAU,CAAC,EACvD,GAAIS,IAAU,IAAK,GAEnB,OADI5U,GAAM,SAAW,GAAc4U,EAC5B,CACN,KAAMA,EAAM,KACZ,OAAQA,EAAM,UAAYF,GAAeP,EAAUS,EAAM,SAAS,EAAI,IAAK,EAC5E,CACD,CACA,SAASuB,GAAY,EAAM,EAAQ,EAAU,EAAO,CACnD,GAAI5b,IAAU4Z,EAAS,OAAQ,CAC9B,GAAIiB,EAAK,QAAS,CACjB,IAAMR,EAAQwB,GAAehB,EAAK,QAASN,EAAQX,EAAUiB,EAAK,MAAQ,IAAK,EAAK,EACpF,GAAIR,EAAO,OAAOA,CACnB,CACA,OAAOQ,EAAK,OAAO,SAAWgB,GAAehB,EAAK,MAAM,QAASN,EAAQX,EAAU,GAAM,EAAI,GAAKiB,EAAK,UAAU,SAAWgB,GAAehB,EAAK,SAAS,QAASN,EAAQX,EAAU,GAAM,EAAI,GAAK,IAAK,EACzM,CACA,IAAMT,EAAUS,EAAS5Z,GACzB,GAAI6a,EAAK,OAAQ,CAChB,IAAMiB,EAAcjB,EAAK,OAAO1B,GAChC,GAAI2C,EAAa,CAChB,IAAMzB,EAAQuB,GAAYE,EAAavB,EAAQX,EAAU5Z,EAAQ,CAAC,EAClE,GAAIqa,EAAO,OAAOA,CACnB,CACD,CACA,GAAIQ,EAAK,MAAO,CACf,IAAMR,EAAQuB,GAAYf,EAAK,MAAON,EAAQX,EAAU5Z,EAAQ,CAAC,EACjE,GAAIqa,EAAO,OAAOA,CACnB,CACA,GAAIQ,EAAK,UAAYA,EAAK,SAAS,QAAS,OAAOgB,GAAehB,EAAK,SAAS,QAASN,EAAQX,EAAU,GAAM,EAAK,CACvH,CACA,SAASiC,GAAe,EAAS,EAAQ,EAAU,EAAiB,EAAc,CACjF,IAAMxB,EAAQgB,EAAQd,IAAWc,EAAQ,IACzC,GAAI,CAAChB,EAAO,OACZ,IAAM/b,EAAQ+b,EAAM,GACpB,GAAIA,EAAM,SAAW,GAAK/b,EAAM,aAAa,SAAW,EAAG,CAC1D,GAAI,CAACyd,EAAc,OAAOzd,EAC1B,IAAM0d,EAAO1d,EAAM,UACnB,OAAO0d,IAAOA,EAAK,OAAS,EAAE,GAAG,GAAK1d,EAAQ,IAAK,EACpD,CACA,IAAI2d,EACAC,EAAa,GACjB,IAAK,IAAMrC,KAAKQ,EAAO,CACtB,IAAM2B,EAAOnC,EAAE,UACTsC,EAAeH,IAAOA,EAAK,OAAS,EAAE,GAAG,GAC/C,GAAID,GAAgB,CAACI,EAAc,SACnC,IAAIC,EAASC,GAAmBL,GAAQ,CAACG,EAAe,EAAI,EACtDG,EAAUzC,EAAE,aAClB,IAAK,IAAIx4B,EAAI,EAAGA,EAAIi7B,EAAQ,OAAQ,IAAK,GAAIA,EAAQj7B,GAAI,CACxD,GAAI,CAACi7B,EAAQj7B,EAAE,CAAC,KAAKu4B,EAASv4B,EAAE,EAAG,CAClC,EAAS,GACT,KACD,CACA,GACD,CACI+6B,EAASF,IACZ,EAAOrC,EACP,EAAauC,EAEf,CACA,OAAOH,CACR,CAsDA,SAASM,GAAc,EAAK,EAAS,GAAI,EAAM,EAAM,CAChD9W,GAAM,YAAW,EAAOuU,GAActF,CAAI,GAC1CA,EAAK,WAAWA,EAAK,OAAS,CAAC,IAAM,KAAI,EAAOA,EAAK,MAAM,EAAG,EAAE,GACpE,IAAMkF,EAAWK,GAAUvF,CAAI,EACzB8H,EAAUC,GAAS/B,EAAI,KAAMH,EAAQX,EAAU,CAAC,EAEtD,OADInU,GAAM,SAAW,GAAc+W,EAC5BA,EAAQ,IAAK,IACZ,CACN,KAAM3C,EAAE,KACR,OAAQA,EAAE,UAAYM,GAAeP,EAAUC,EAAE,SAAS,EAAI,IAAK,EACpE,EACA,CACF,CACA,SAAS4C,GAAS,EAAM,EAAQ,EAAU,EAAO,EAAU,CAAC,EAAG,CAC9D,IAAMtD,EAAUS,EAAS5Z,GACzB,GAAI6a,EAAK,UAAYA,EAAK,SAAS,QAAS,CAC3C,IAAMR,EAAQQ,EAAK,SAAS,QAAQN,IAAWM,EAAK,SAAS,QAAQ,IACrE,GAAIR,EAAO,IAAIra,EAAQ4Z,EAAS,OAAQ8C,GAAWF,EAASnC,EAAO,EAAI,MAClE,CACJ,IAAMt+B,EAAW,CAAC,EAClB,IAAK,IAAM89B,KAAKQ,EAAO,CACtB,IAAM2B,EAAOnC,EAAE,UACXmC,IAAOA,EAAK,OAAS,EAAE,GAAG,IAAIjgC,EAAS,KAAK89B,CAAC,CAClD,CACA6C,GAAWF,EAASzgC,EAAU,EAAI,CACnC,EACD,CACA,GAAI8+B,EAAK,MAAO,CACf,GAAI7a,EAAQ4Z,EAAS,OAAQ,CAC5B,IAAM+C,EAAQH,EAAQ,OAEtB,GADAC,GAAS5B,EAAK,MAAON,EAAQX,EAAU5Z,EAAQ,EAAGwc,CAAO,EACrD3B,EAAK,MAAM,cACT,IAAA,IAAI9P,EAAIyR,EAAQ,OAAS,EAAGzR,GAAK4R,EAAO,IAASH,EAAQzR,EAAE,CAAC,aAAa/K,EAAM,EAAE,KAAKmZ,CAAO,IAAM,IAAOqD,EAAQ,OAAOzR,EAAG,CAAC,CAEpI,MAAO,GAAI8P,EAAK,MAAM,QAAS,CAC9B,IAAMR,EAAQQ,EAAK,MAAM,QAAQN,IAAWM,EAAK,MAAM,QAAQ,IAC/D,GAAIR,EAAO,CACV,IAAMt+B,EAAW,CAAC,EAClB,IAAK,IAAM89B,KAAKQ,EAAO,CACtB,IAAM2B,EAAOnC,EAAE,UACXmC,IAAOA,EAAK,OAAS,EAAE,GAAG,IAAIjgC,EAAS,KAAK89B,CAAC,CAClD,CACA6C,GAAWF,EAASzgC,EAAU,EAAI,CACnC,CACD,CACD,CACA,GAAIikB,EAAQ4Z,EAAS,OAAQ,CAC5B,IAAMkC,EAAcjB,EAAK,SAAS1B,GAC9B2C,GAAaW,GAASX,EAAavB,EAAQX,EAAU5Z,EAAQ,EAAGwc,CAAO,CAC5E,CACA,GAAIxc,IAAU4Z,EAAS,QAAUiB,EAAK,QAAS,CAC9C,IAAMR,EAAQQ,EAAK,QAAQN,IAAWM,EAAK,QAAQ,IAC/CR,GAAOqC,GAAWF,EAASnC,EAAOQ,EAAK,MAAQ,GAAG,CACvD,CACA,OAAO2B,CACR,CACA,SAASE,GAAW,EAAS,EAAO,EAAiB,CAChDrC,EAAM,OAAS,IAAG,EAAQA,EAAM,IAAK,GAAM,CAC9C,IAAIuC,EAAI,EACF,CAAE,aAAcC,EAAI,UAAWC,GAAOjD,EAC5C,IAAK,IAAIx4B,EAAI,EAAGA,EAAIw7B,EAAG,OAAQ,IAASA,EAAGx7B,IAAI,IAE/C,OADIg7B,GAAmBS,GAAM,CAACA,EAAGA,EAAG,OAAS,EAAE,CAAC,IAAI,IAC7C,CAACjD,EAAG+C,CAAC,CACb,CAAC,CAAC,CAAC,MAAM,EAAG,IAAM74B,EAAE,GAAKC,EAAE,EAAE,CAAC,CAAC,IAAK,GAAM,EAAE,EAAE,GAC9C,IAAK,IAAM61B,KAAKQ,EAAOmC,EAAQ,KAAK3C,CAAC,CACtC,CCxcA,IAAMkD,IAAkB,EAAW,IAAW,CAC7C,GAAI,CAAC/E,GAAQ,SAAS,SAAU,CAC/B,IAAMgF,EAAU,CACf,KAAM,iBACN,GAAGhF,GAAQ,OACZ,EACA,EAAUiF,QAAa7G,GAAe4G,EAAQ,KAAM,CAAE,OAAQ,KAAM,EAAG,KAAO,IAAM,CACnF,IAAME,EAAS,MAAMrF,GAAUC,CAAS,EACxC,OAAO,IAAI,SAASG,GAAQiF,EAAQF,EAAQ,MAAM,EAAG,CAAE,QAAS,CAAE,eAAgB,WAAY,CAAE,CAAC,CAClG,CAAC,CACF,CACA,IAAMG,EAAS/E,GAAa,EACtBgF,EAAmBhF,GAAa,EACtC,IAAK,IAAMiF,KAAY,OAAO,OAAOvF,CAAS,EAAG,CAEhD,GADI,CAACuF,EAAS,SAAW,CAACA,EAAS,MAC/BA,EAAS,SAAS,UAAU,YAAa,SAC7C,IAAMhC,EAAU,MAAM,QAAQgC,EAAS,SAAS,MAAM,EAAIA,EAAS,QAAQ,OAAS,CAACA,EAAS,SAAS,MAAM,EAC7G,IAAK,IAAM9C,KAAUc,EAASf,GAAS6C,EAAQ5C,EAAQ8C,EAAS,KAAMA,CAAQ,CAC/E,CACA,GAAIrF,GAAQ,kBAAkB,OAAQ,IAAK,GAAM,CAAE,OAAM,gBAAgBA,EAAO,iBAAkBsC,GAAS8C,EAAkB,IAAK1I,EAAMQ,CAAU,EAClJ,IAAMoI,EAAWtF,GAAQ,UAAYA,EAAO,WAAa,IAAMA,EAAO,SAAS,QAAQ,OAAQ,EAAE,EAAI,GAC/FuF,EAAiB,KAAO,IAAY,CACzC,IAAM/gC,EAAM,IAAI,IAAIy1B,EAAQ,GAAG,EACzBuL,EAAWhhC,EAAI,SACjBk4B,EACJ,GAAI4I,EAAU,CACb,GAAI,CAACE,EAAS,WAAW,GAAGF,EAAS,EAAE,EAAG,OAAO,IAAI,SAAS,KAAM,CACnE,OAAQ,IACR,WAAY,WACb,CAAC,EACD,EAAOE,EAAS,MAAMF,EAAS,MAAM,CACtC,KAAO,GAAOE,EACd,GAAI9I,EAAK,SAAW,GAAK,SAAS,KAAKA,CAAI,EAAG,OAAO,IAAI,SAAS,KAAM,CACvE,OAAQ,IACR,WAAY,WACb,CAAC,EACD,IAAM+I,EAAQ/B,GAAUyB,EAAQlL,EAAQ,OAAQyC,CAAI,EAKpD,GAJIA,EAAK,SAAS,GAAG,IAAM+I,GAAO,MAAM,MAAM,SAAS,GAAG,GAAK,CAACzF,GAAQ,qBAIpE,CAACyF,GAAO,KAAM,OAAO,IAAI,SAAS,KAAM,CAC3C,OAAQ,IACR,WAAY,WACb,CAAC,EACD,IAAMC,EAAQ,CAAC,EACflhC,EAAI,aAAa,SAAS,EAAO,IAAQ,CACpCgE,KAAOk9B,EAAW,MAAM,QAAQA,EAAMl9B,EAAI,EAAGk9B,EAAMl9B,EAAI,CAAC,KAAKC,CAAK,EACjE,EAAMD,GAAO,CAACk9B,EAAMl9B,GAAMC,CAAK,EAC/B,EAAMD,GAAOC,CACnB,CAAC,EACD,IAAM81B,EAAUkH,EAAM,KACtB,GAAI,CACH,IAAMtL,EAAoBoE,EAAQ,QAAQ,UAAU,mBAAqByB,GAAQ,kBAC3EhE,EAAU,CACf,OACA,OAAQ/B,EAAQ,OAChB,QAASA,EAAQ,QACjB,OAAQwL,EAAM,OAAS,CAAE,GAAGA,EAAM,MAAO,EAAI,CAAC,EAC9C,UACA,KAAMlH,EAAQ,QAAQ,YAAc,IAAK,GAAI,MAAM/+B,GAAQ++B,EAAQ,QAAQ,aAAetE,EAAQ,MAAM,EAAIA,EAASE,CAAiB,EACtI,QACA,MAAO,SACP,WAAY,GACZ,QAAS6F,GAAQ,aAClB,EACM2F,EAAmBpB,GAAca,EAAkB,IAAK1I,CAAI,EAClE,GAAIiJ,GAAkB,OAAQ,IAAK,GAAM,CAAE,KAAMzI,EAAY,YAAYyI,EAAkB,CAC1F,IAAM36B,EAAM,MAAMkyB,EAAW,CAC5B,GAAGlB,EACH,OAAQ10B,EAAS,CAAE,GAAGA,CAAO,EAAI,CAAC,EAClC,WAAY,EACb,CAAC,EACD,GAAI0D,aAAe,SAAU,OAAOA,CACrC,CACA,OAAO,MAAMuzB,EAAQvC,CAAO,CAC7B,OAASpd,EAAO,CACf,GAAIohB,GAAQ,QAAS,GAAI,CACxB,IAAM4F,EAAgB,MAAM5F,EAAO,QAAQphB,EAAOqb,CAAO,EACzD,GAAI2L,aAAyB,SAAU,OAAO5H,GAAW4H,CAAa,CACvE,OAAShnB,EAAO,CACf,GAAInf,GAAWmf,CAAK,EAAG,OAAOof,GAAWpf,CAAK,EAC9C,MAAMA,CACP,CACA,GAAIohB,GAAQ,WAAY,MAAMphB,EAG9B,OAFInf,GAAWmf,CAAK,EAAUof,GAAWpf,CAAK,GAC9C,QAAQ,MAAM,mBAAoBA,CAAK,EAChC,IAAI,SAAS,KAAM,CACzB,OAAQ,IACR,WAAY,uBACb,CAAC,EACF,CACD,EACA,MAAO,CACN,QAAS,KAAO,IAAY,CAC3B,IAAMinB,EAAQ,MAAM7F,GAAQ,YAAY/F,CAAO,EAC/C,GAAI4L,aAAiB,SAAU,OAAOA,EACtC,IAAMC,EAAMlL,GAAUiL,CAAK,EAAIA,EAAQ5L,EACjCjvB,EAAM,MAAMu6B,EAAeO,CAAG,EAC9BC,EAAQ,MAAM/F,GAAQ,aAAah1B,EAAK86B,CAAG,EAEjD,OADIC,aAAiB,SAAiBA,EAC/B/6B,CACR,EACA,WACD,CACD,EC9GA,SAASg7B,GAAiB,EAAO,CAChC,OAAO,OAAO,YAAY,OAAO,QAAQC,CAAK,CAAC,CAAC,KAAK,CAACz9B,EAAKC,KAAW,CAACD,EAAK,CAC3E,KAAMA,EACN,QAASC,EACT,aAAgBD,CACjB,CAAC,CAAC,CAAC,CACJ,CCLA,IAAM09B,GAAmBF,GAAiB,CACzC,eAAgB,iBAChB,sBAAuB,wBACvB,yBAA0B,2BAC1B,sBAAuB,wBACvB,sBAAuB,wBACvB,iBAAkB,mBAClB,cAAe,gBACf,0BAA2B,4BAC3B,aAAc,eACd,8BAA+B,gCAC/B,mBAAoB,qBACpB,cAAe,gBACf,cAAe,gBACf,uBAAwB,yBACxB,wBAAyB,0BACzB,qBAAsB,uBACtB,mBAAoB,qBACpB,mBAAoB,qBACpB,kBAAmB,oBACnB,oBAAqB,uBACrB,sCAAuC,0CACvC,yBAA0B,2BAC1B,sBAAuB,2BACvB,6BAA8B,+BAC9B,gBAAiB,2DACjB,8BAA+B,qCAC/B,kBAAmB,oBACnB,0BAA2B,mEAC3B,oCAAqC,iFACrC,+BAAgC,mCAChC,uBAAwB,4BACxB,eAAgB,iBAChB,kBAAmB,uBACnB,8BAA+B,gCAC/B,eAAgB,iBAChB,qBAAsB,sBACtB,qBAAsB,sBACtB,2BAA4B,2BAC5B,8BAA+B,6BAC/B,uBAAwB,yBACxB,sBAAuB,0BACvB,8BAA+B,gCAC/B,kBAAmB,8BACnB,+BAAgC,oCAChC,iBAAkB,mBAClB,cAAe,oBACf,0CAA2C,2EAC3C,uBAAwB,yBACxB,qBAAsB,iCACvB,CAAC,ECzCD,SAASG,GAAgB,EAAO,CAG/B,OAFI,MAAM,QAAQC,CAAK,EAAUA,EAAM,IAAK,GAAM,OAAOvzB,GAAM,SAAWA,EAAE,KAAK,EAAI,EAAE,CAAC,CAAC,OAAO,OAAO,EACnG,OAAOuzB,GAAU,SAAiBA,EAAM,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EACvE,CAAC,CACT,CACA,SAASC,GAAgB,EAAM,CAC9B,IAAMC,EAAW,GACT,IAAI,KAAsB,IAAI,KAAK,CAAA,CAAG,QAAQ,EAAIC,EAAU,GAAG,EAEvE,MAAO,CACN,UAAWl6B,EAAK,WAChB,YAAaA,EAAK,aAClB,aAAcA,EAAK,cACnB,qBAAsBA,EAAK,WAAai6B,EAAQj6B,EAAK,UAAU,EAAI,IAAK,GACxE,sBAAuBA,EAAK,yBAA2Bi6B,EAAQj6B,EAAK,wBAAwB,EAAI,IAAK,GACrG,OAAQ85B,GAAgB95B,EAAK,KAAK,EAClC,QAASA,EAAK,SACd,IAAKA,CACN,CACD,CAgBA,SAASm6B,GAAY,EAAQ,EAAU,CACtC,IAAMC,EAAWC,EAASA,EAAO,MAAM,GAAG,CAAC,CAAC,IAAK,GAAUN,EAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,EAAI,CAAC,EACtFO,GAAQC,GAAY,CAAC,EAAA,CAAG,IAAK,GAAUR,EAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,EACzE,MAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAGK,EAAU,GAAGE,CAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CACrD,CASA,SAASE,GAAmB,EAAU,CACrC,IAAMp+B,EAAQ,MAAM,QAAQq+B,CAAQ,EAAIA,EAAS,GAAKA,EACtD,OAAO,OAAOr+B,GAAU,UAAYA,EAAM,OAAS,EAAIA,EAAQ,IAAK,EACrE,CACA,eAAes+B,GAAsB,EAAc,CAClD,IAAM16B,EAAO,IAAI,YAAY,CAAC,CAAC,OAAO26B,CAAY,EAC5C99B,EAAO,MAAM,OAAO,OAAO,OAAO,UAAWmD,CAAI,EACvD,OAAOlF,GAAU,OAAO,IAAI,WAAW+B,CAAI,EAAG,CAAE,QAAS,EAAM,CAAC,CACjE,CCjEA,IAAM+9B,GAA8B,iBAOpC,SAASC,GAAc,EAAO,CAC7B,OAAO,IAAI,gBAAgB,CAAE,EAAGz+B,CAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAC5D,CAKA,SAAS0+B,GAAc,EAAO,CAC7B,IAAMhe,EAAU,IAAI,gBAAgB,KAAK1gB,GAAO,CAAC,CAAC,IAAI,GAAG,EACzD,GAAI0gB,IAAY,KAAM,MAAU,MAAM,6CAA6C,EACnF,OAAOA,CACR,CAQA,SAASie,GAAuB,EAAU,EAAc,CACvD,IAAM92B,EAAU,GAAG42B,GAAcJ,CAAQ,EAAE,GAAGI,GAAcG,CAAY,IACxE,MAAO,SAASrhC,GAAO,OAAOsK,CAAO,GACtC,CAgBA,SAASg3B,GAAuB,EAAe,CAC9C,IAAMjF,EAAQkF,EAAc,MAAMN,EAA2B,EAC7D,GAAI,CAAC5E,EAAO,MAAU,MAAM,gDAAgD,EAC5E,IAAM1yB,EAAU0yB,EAAM,IAAM,GACtBlZ,EAAU,IAAI,YAAY,CAAC,CAAC,OAAOnjB,GAAO,OAAO2J,CAAO,CAAC,EACzD63B,EAAiBre,EAAQ,QAAQ,GAAG,EAC1C,GAAIqe,IAAmB,GAAI,MAAU,MAAM,4DAA4D,EACvG,IAAMC,EAActe,EAAQ,MAAM,EAAGqe,CAAc,EAC7CE,EAAkBve,EAAQ,MAAMqe,EAAiB,CAAC,EACxD,GAAI,CAACC,GAAe,CAACC,EAAiB,MAAU,MAAM,8DAA8D,EACpH,MAAO,CACN,SAAUP,GAAcM,CAAW,EACnC,aAAcN,GAAcO,CAAe,CAC5C,CACD,CC1DA,IAAMC,GAAqC,CAC1C,QACA,QACA,QACA,QACA,QACA,QACA,QACA,QACA,QACA,OACD,EAoBMC,GAAwB,yDAyD9B,eAAeC,GAA6B,CAAE,qBAAoB,WAAW,CAC5E,MAAO,CACN,iBAAkB,MAAMC,EAAmB9L,CAAO,EAClD,sBAAuB4L,EACxB,CACD,CC/FA,IAAIG,GAAmB,cAAc,KAAM,CAC1C,YAAY,EAAQ,EAAY,EAAO,CACtC,MAAM5J,GAAcrB,EAAO,SAAS,EAAG,CAAE,MAAOle,CAAM,CAAC,EACvD,KAAK,OAASke,EACd,KAAK,WAAaqB,EAClB,KAAK,MAAQvf,EACb,MAAM,kBAAkB,KAAM,KAAK,WAAW,CAC/C,CACD,EAGMopB,GAAoB,MAAO,EAAK,IAAY,CACjD,IAAIva,EAAOvd,GAAW,CAAC,EACjB+3B,EAAQ,CACb,UAAW,CAAC/3B,GAA0D,SAAS,EAC/E,WAAY,CAACA,GAA0D,UAAU,EACjF,UAAW,CAACA,GAA0D,SAAS,EAC/E,QAAS,CAACA,GAA0D,OAAO,EAC3E,QAAS,CAACA,GAA0D,OAAO,CAC5E,EACA,GAAI,CAACA,GAAW,CAAEA,GAA0D,QAAU,MAAO,CAC5F,MACA,QAASud,EACT,OACD,EACA,IAAK,IAAMya,KAAWh4B,GAA0D,SAAY,CAAC,EAAG,CAE/F,GAAIg4B,EAAO,KAAM,CAEhB,IAAMC,EAAY,MAAuBD,EAAO,MAAkE,KAAKA,EAAQ1jC,EAAI,SAAS,EAAGipB,CAAI,EACnJ,EAAO0a,EAAU,SAAW1a,EAC5B,EAAM0a,EAAU,GACjB,CACAF,EAAM,UAAU,KAAsBC,EAAO,OAAqE,SAAS,EAC3HD,EAAM,WAAW,KAAuBC,EAAO,OAAuE,UAAU,EAChID,EAAM,UAAU,KAAuBC,EAAO,OAAuE,SAAS,EAC9HD,EAAM,QAAQ,KAAuBC,EAAO,OAAuE,OAAO,EAC1HD,EAAM,QAAQ,KAAuBC,EAAO,OAAuE,OAAO,CAC3H,CACA,MAAO,CACN,MACA,QAASza,EACT,OACD,CACD,EAGI2a,GAAsB,KAAM,CAC/B,YAAY,EAAS,CACpB,KAAK,QAAUl4B,CAChB,CACA,mBAAmB,EAAS,EAAU,CAErC,OADI,KAAK,QAAQ,YAAoB,QAAQ,QAAQm4B,EAAU,KAAK,QAAQ,UAAY,KAAK,QAAQ,YAAYlL,CAAQ,CAAC,EACnH,QAAQ,QAAQkL,EAAU,KAAK,QAAQ,QAAQ,CACvD,CACA,UAAW,CACV,OAAO,KAAK,QAAQ,KACrB,CACD,EACIC,GAA2B,KAAM,CACpC,YAAY,EAAS,CACpB,KAAK,QAAUp4B,CAChB,CACA,mBAAmB,EAAS,EAAU,CAErC,OADI,KAAK,QAAQ,YAAoB,QAAQ,QAAQm4B,EAAU,KAAK,QAAQ,UAAY,KAAK,QAAQ,YAAYlL,CAAQ,CAAC,EACnH,QAAQ,QAAQkL,EAAU,KAAK,QAAQ,QAAQ,CACvD,CACA,SAAS,EAAS,CACjB,OAAO,KAAK,IAAI,KAAK,QAAQ,SAAU,KAAK,QAAQ,UAAY,GAAKA,CAAO,CAC7E,CACD,EACA,SAASE,GAAoB,EAAS,CACrC,GAAI,OAAOr4B,GAAY,SAAU,OAAO,IAAIk4B,GAAoB,CAC/D,KAAM,SACN,SAAUl4B,EACV,MAAO,GACR,CAAC,EACD,OAAQA,EAAQ,KAAhB,CACC,IAAK,SAAU,OAAO,IAAIk4B,GAAoBl4B,CAAO,EACrD,IAAK,cAAe,OAAO,IAAIo4B,GAAyBp4B,CAAO,EAC/D,QAAS,MAAU,MAAM,wBAAwB,CAClD,CACD,CAGA,IAAMmzB,GAAU,CACf,MACA,OACA,MACA,QACA,QACD,EASA,SAASmF,GAAoB,EAAM,CAClC,GAAI,CAAC9L,EAAK,WAAW,GAAG,EAAG,MAAO,CACjC,OAAQ,IAAK,GACb,MACD,EACA,IAAM+L,EAAY/L,EAAK,QAAQ,GAAG,EAC5B6F,EAAS7F,EAAK,MAAM,EAAG+L,IAAc,GAAK,IAAK,GAAIA,CAAS,EAKlE,OAJKpF,GAAQ,SAASd,CAAM,EAIrB,CACN,SACA,KAAMkG,IAAc,GAAK/L,EAAOA,EAAK,MAAM+L,EAAY,CAAC,CACzD,EAPsC,CACrC,OAAQ,IAAK,GACb,MACD,CAKD,CAGA,IAAMC,GAAyB,GAAUjgC,IAAU,KAAOA,IAAU,KAC9DkgC,GAA4B,GAAYxH,EAAQ,MAAM,GAAG,CAAC,CAAC,IAAK,GAAS,mBAAmByH,CAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EACjH,SAASC,GAAmB,EAAS,EAAY,CAChD,IAAMC,EAAYC,EAAW,IAAI5H,CAAO,EACxC,GAAI2H,IAAc,IAAK,GAAG,OAAOH,GAAyBxH,CAAO,EACjE,GAAIuH,GAAsBI,CAAS,EAAG,MAAU,UAAU,kDAAkD,EAC5G,OAAO,mBAAmBA,CAAS,CACpC,CAIA,SAASE,GAAS,EAAK,EAAQ,CAC9B,GAAM,CAAE,UAAS,SAAQ,SAAUl2B,GAAU,CAC5C,MAAO,CAAC,EACR,OAAQ,CAAC,EACT,QAAS,EACV,EACIwyB,EAAW9gC,EAAI,WAAW,MAAM,EAAIA,EAAI,MAAM,GAAG,CAAC,CAAC,MAAM,EAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAIykC,GAAW,GACpF,CAAE,KAAMC,GAAgBV,GAAoBhkC,CAAG,EACjD0kC,IAAgB1kC,IAAK,EAAM,IAAI0kC,KAC9B5D,EAAS,SAAS,GAAG,IAAG,GAAY,KACzC,GAAI,CAAC5I,EAAMyM,GAAY3kC,EAAI,QAAQ8gC,EAAU,EAAE,CAAC,CAAC,MAAM,GAAG,EACpD8D,EAAc,IAAI,gBAAgBD,CAAQ,EAChD,IAAK,GAAM,CAAC3gC,EAAKC,KAAU,OAAO,QAAQi9B,GAAS,CAAC,CAAC,EAAG,CACvD,GAAIj9B,GAAS,KAAM,SACnB,IAAI4gC,EACJ,GAAI,OAAO5gC,GAAU,SAAU,EAAkBA,OAC5C,GAAI,MAAM,QAAQA,CAAK,EAAG,CAC9B,IAAK,IAAM4yB,KAAO5yB,EAAO2gC,EAAY,OAAO5gC,EAAK6yB,CAAG,EACpD,QACD,KAAO,GAAkB,KAAK,UAAU5yB,CAAK,EAC7C2gC,EAAY,IAAI5gC,EAAK6gC,CAAe,CACrC,CACA,IAAMN,EAA6B,IAAI,IACvC,GAAIzhC,EAAQ,IAAI,MAAM,QAAQA,CAAM,EAAG,CACtC,IAAMgiC,EAAa5M,EAAK,MAAM,GAAG,CAAC,CAAC,OAAQ,GAAMkG,EAAE,WAAW,GAAG,CAAC,EAClE,IAAK,GAAM,CAAC5a,EAAOxf,KAAQ8gC,EAAW,QAAQ,EAAG,CAChD,IAAM7gC,EAAQnB,EAAO0gB,GACrB+gB,EAAW,IAAIvgC,EAAK,OAAOC,CAAK,CAAC,CAClC,CACD,MAAO,IAAK,GAAM,CAACD,EAAKC,KAAU,OAAO,QAAQnB,CAAM,EAAGyhC,EAAW,IAAI,IAAIvgC,IAAO,OAAOC,CAAK,CAAC,CAAA,CACjG,EAAOi0B,EAAK,MAAM,GAAG,CAAC,CAAC,IAAK,GAAYmM,GAAmB1H,EAAS4H,CAAU,CAAC,CAAC,CAAC,KAAK,GAAG,EACzF,EAAOrM,EAAK,QAAQ,OAAQ,EAAE,EAC9B,IAAI6M,EAAmBH,EAAY,SAAS,EAG5C,MAFA,GAAmBG,EAAiB,OAAS,EAAI,IAAIA,IAAmB,QAAQ,MAAO,KAAK,EAAI,GAC3FjE,EAAS,WAAW,MAAM,EACxB,IAAI,IAAI,GAAG5I,IAAO6M,IAAoBjE,CAAQ,EADZ,GAAGA,IAAW5I,IAAO6M,GAE/D,CAGA,IAAMC,GAAgB,KAAO,IAAY,CACxC,IAAM13B,EAAU,CAAC,EACX23B,EAAW,KAAO,IAAU,OAAOhhC,GAAU,WAAa,MAAMA,EAAM,EAAIA,EAChF,GAAIyH,GAA0D,KAAM,CACnE,GAAIA,EAAQ,KAAK,OAAS,SAAU,CACnC,IAAMgO,EAAQ,MAAMurB,EAASv5B,EAAQ,KAAK,KAAK,EAC/C,GAAI,CAACgO,EAAO,OAAOpM,EACnB,EAAQ43B,cAAmB,UAAUxrB,GACtC,MAAO,GAAIhO,EAAQ,KAAK,OAAS,QAAS,CACzC,GAAM,CAACy5B,EAAUC,GAAY,MAAM,QAAQ,IAAI,CAACH,EAASv5B,EAAQ,KAAK,QAAQ,EAAGu5B,EAASv5B,EAAQ,KAAK,QAAQ,CAAC,CAAC,EACjH,GAAI,CAACy5B,GAAY,CAACC,EAAU,OAAO93B,EACnC,EAAQ43B,cAAmB,SAAS,KAAK,GAAGC,EAAS,GAAGC,GAAU,GACnE,MAAO,GAAI15B,EAAQ,KAAK,OAAS,SAAU,CAC1C,GAAM,CAAC8qB,EAAQvyB,GAAS,MAAM,QAAQ,IAAI,CAACghC,EAASv5B,EAAQ,KAAK,MAAM,EAAGu5B,EAASv5B,EAAQ,KAAK,KAAK,CAAC,CAAC,EACvG,GAAI,CAACzH,EAAO,OAAOqJ,EACnB,EAAQ43B,cAAmB,GAAG1O,GAAgD,GAAG,GAAGvyB,GACrF,CACD,CACA,OAAOqJ,CACR,EAGM+3B,GAAU,oDAChB,SAASC,GAAmB,EAAS,CACpC,IAAMC,EAAe9P,EAAQ,QAAQ,IAAI,cAAc,EACjD+P,EAA4B,IAAI,IAAI,CACzC,YACA,kBACA,oBACA,kBACD,CAAC,EACD,GAAI,CAACD,EAAc,MAAO,OAC1B,IAAM/P,EAAc+P,EAAa,MAAM,GAAG,CAAC,CAAC,MAAM,GAAK,GAGvD,OAFIF,GAAQ,KAAK7P,CAAW,EAAU,OAClCgQ,EAAU,IAAIhQ,CAAW,GAAKA,EAAY,WAAW,OAAO,EAAU,OACnE,MACR,CACA,SAASiQ,GAAe,EAAO,CAC9B,GAAI,CAEH,OADA,KAAK,MAAMxhC,CAAK,EACT,EACR,MAAgB,CACf,MAAO,EACR,CACD,CACA,SAASyhC,GAAmB,EAAO,CAClC,GAAIzhC,IAAU,IAAK,GAAG,MAAO,GAC7B,IAAM,EAAI,OAAOA,EAKjB,OAJI,IAAM,UAAY,IAAM,UAAY,IAAM,WAAa,IAAM,KAAa,GAC1E,IAAM,SACN,MAAM,QAAQA,CAAK,EAAU,GAC7BA,EAAM,OAAe,GAClBA,EAAM,aAAeA,EAAM,YAAY,OAAS,UAAY,OAAOA,EAAM,QAAW,WAHhE,EAI5B,CACA,SAAS0hC,GAAU,EAAM,CACxB,GAAI,CACH,OAAO,KAAK,MAAMC,CAAI,CACvB,MAAgB,CACf,OAAOA,CACR,CACD,CACA,SAASC,GAAW,EAAO,CAC1B,OAAO,OAAO5hC,GAAU,UACzB,CACA,SAAS6hC,GAAS,EAAS,CAC1B,GAAIp6B,GAA0D,gBAAiB,OAAOA,EAAQ,gBAC9F,GAAI,OAAO,WAAe,KAAem6B,GAAW,WAAW,KAAK,EAAG,OAAO,WAAW,MACzF,GAAI,OAAO,OAAW,KAAeA,GAAW,OAAO,KAAK,EAAG,OAAO,OAAO,MAC7E,MAAU,MAAM,+BAA+B,CAChD,CAqBA,SAASE,GAAa,GAAGC,EAAS,CACjC,IAAMC,EAAS,CAAC,EAChB,IAAK,IAAM1kB,KAAUykB,EACpB,GAAKzkB,EACL,IAAIA,aAAkB,QAASA,EAAO,SAAS,EAAO,IAAQ,CAC7D,EAAOvd,GAAOC,CACf,CAAC,MACI,CACJ,IAAMN,EAAU,MAAM,QAAQ4d,CAAM,EAAIA,EAAS,OAAO,QAAQA,CAAM,EACtE,IAAK,GAAM,CAACvd,EAAKC,KAAUN,EAAaM,GAAU,OAA0B,EAAOD,GAAOC,EAC3F,EAED,OAAOgiC,CACR,CACA,eAAeC,GAAW,EAAM,CAC/B,IAAM54B,EAAU,IAAI,QAAQy4B,GAAa9c,GAAiD,QAAS,MAAM+b,GAAc/b,CAAI,CAAC,CAAC,EAC7H,GAAI,CAAC3b,EAAQ,IAAI,cAAc,EAAG,CACjC,IAAMkoB,EAAc2Q,GAAkBld,GAAiD,IAAI,EACvFuM,GAAaloB,EAAQ,IAAI,eAAgBkoB,CAAW,CACzD,CACA,OAAOloB,CACR,CAoCA,SAAS64B,GAAkB,EAAM,CAEhC,OADIT,GAAmBnN,CAAI,EAAU,mBAC9B,IACR,CACA,SAAS6N,GAAa,EAAS,CAC9B,IAAM5Q,EAAcloB,EAAQ,IAAI,cAAc,EAC9C,OAAOkoB,EAAcA,EAAY,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,EAAI,IACvE,CACA,SAAS6Q,GAAQ,EAAS,EAAS,CAClC,GAAM,CAAE,QAAS36B,EAKjB,OAJK6sB,EACD,CAACmN,GAAmBnN,CAAI,GACxB,OAAOA,GAAS,SAAiBA,EACjC6N,GAAa94B,CAAO,IAAM,oCAA4C,IAAI,gBAAgBirB,CAAI,CAAC,CAAC,SAAS,EACtG,KAAK,UAAUA,CAAI,EAJR,IAKnB,CACA,SAAS+N,GAAU,EAAK,EAAS,CAChC,GAAI56B,GAA0D,OAAQ,OAAOA,EAAQ,OAAO,YAAY,EACxG,GAAM,CAAE,UAAWs4B,GAAoBhkC,CAAG,EAE1C,OADI+9B,EAAeA,EAAO,YAAY,EAC9BryB,GAA0D,KAAQ,OAAS,KACpF,CACA,SAAS66B,GAAW,EAAS,EAAY,CACxC,IAAIC,EAEJ,MADI,CAAE96B,GAA0D,QAAYA,GAA0D,UAAU,EAAe,eAAiB+6B,GAAmE,MAAM,EAAG/6B,GAA0D,OAAO,GACtT,CACN,eACA,iBAAoB,CACf86B,GAAc,aAAaA,CAAY,CAC5C,CACD,CACD,CAKA,IAAIE,GAAkB,MAAMA,UAAwB,KAAM,CACzD,YAAY,EAAQ,EAAS,CAC5B,MAAMjhC,GAAW,KAAK,UAAUkhC,EAAQ,KAAM,CAAC,CAAC,EAChD,KAAK,OAASA,EACd,OAAO,eAAe,KAAMD,EAAgB,SAAS,CACtD,CACD,EACA,eAAeE,GAAoB,EAAQ,EAAO,CACjD,IAAM3pB,EAAS,MAAMyjB,EAAO,YAAY,CAAC,SAAS11B,CAAK,EACvD,GAAIiS,EAAO,OAAQ,MAAM,IAAIypB,GAAgBzpB,EAAO,MAAM,EAC1D,OAAOA,EAAO,KACf,CAGA,SAAS4pB,GAAQ,EAAG,CACnB,0BACA,MAAO,IAAwB,OAAO,QAArB,YAA2C,OAAO,OAAO,UAA1B,SAAqC,SAAS,EAAG,CAChG,OAAO,OAAOC,CACf,EAAI,SAAS,EAAG,CACf,OAAOA,GAAmB,OAAO,QAArB,YAA+BA,EAAE,cAAgB,QAAUA,IAAM,OAAO,UAAY,SAAW,OAAOA,CACnH,EAAGD,GAAQC,CAAC,CACb,CAGA,SAASC,GAAY,EAAG,EAAG,CAC1B,GAAgBF,GAAQ5T,CAAC,GAArB,UAA0B,CAACA,EAAG,OAAOA,EACzC,IAAI+T,EAAI/T,EAAE,OAAO,aACjB,GAAe+T,IAAX,IAAK,GAAS,CACjB,IAAIniC,EAAImiC,EAAE,KAAK/T,EAAG1E,GAAK,SAAS,EAChC,GAAgBsY,GAAQhiC,CAAC,GAArB,SAAwB,OAAOA,EACnC,MAAU,UAAU,8CAA8C,CACnE,CACA,OAAqB0pB,IAAb,SAAiB,OAAS,OAAA,CAAQ0E,CAAC,CAC5C,CAGA,SAASgU,GAAc,EAAG,CACzB,IAAIpiC,EAAIkiC,GAAY9T,EAAG,QAAQ,EAC/B,OAAmB4T,GAAQhiC,CAAC,GAArB,SAAyBA,EAAIA,EAAI,EACzC,CAGA,SAASqiC,GAAgB,EAAG,EAAG,EAAG,CACjC,OAAQ,EAAID,GAAc1Y,CAAC,KAAM,EAAI,OAAO,eAAe,EAAGA,EAAG,CAChE,MAAO0E,EACP,WAAY,CAAC,EACb,aAAc,CAAC,EACf,SAAU,CAAC,CACZ,CAAC,EAAI,EAAE1E,GAAK0E,EAAG,CAChB,CAGA,SAASkU,GAAQ,EAAG,EAAG,CACtB,IAAIlU,EAAI,OAAO,KAAK,CAAC,EACrB,GAAI,OAAO,sBAAuB,CACjC,IAAI6T,EAAI,OAAO,sBAAsB,CAAC,EACtCvY,IAAM,EAAIuY,EAAE,OAAO,SAAS,EAAG,CAC9B,OAAO,OAAO,yBAAyB,EAAGvY,CAAC,CAAC,CAAC,UAC9C,CAAC,GAAI0E,EAAE,KAAK,MAAMA,EAAG6T,CAAC,CACvB,CACA,OAAO7T,CACR,CACA,SAASmU,GAAe,EAAG,CAC1B,IAAK,IAAI7Y,EAAI,EAAGA,EAAI,UAAU,OAAQ,IAAK,CAC1C,IAAI0E,EAAY,UAAU1E,IAAlB,KAAsC,CAAC,EAAhB,UAAUA,GACzCA,EAAI,EAAI4Y,GAAQ,OAAOlU,CAAC,EAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,SAAS,EAAG,CAClDiU,GAAgB,EAAG3Y,EAAG0E,EAAE1E,EAAE,CAC3B,CAAC,EAAI,OAAO,0BAA4B,OAAO,iBAAiB,EAAG,OAAO,0BAA0B0E,CAAC,CAAC,EAAIkU,GAAQ,OAAOlU,CAAC,CAAC,CAAC,CAAC,QAAQ,SAAS,EAAG,CAChJ,OAAO,eAAe,EAAG1E,EAAG,OAAO,yBAAyB0E,EAAG1E,CAAC,CAAC,CAClE,CAAC,CACF,CACA,OAAO,CACR,CAGA,IAAM8Y,GAAc,MAAO,EAAK,IAAY,CAC3C,IAAkBC,EAClB,GAAM,CAAE,QAAO,IAAKC,EAAO,QAASte,GAAS,MAAMua,GAAkBxjC,EAAK0L,CAAO,EAC3E87B,EAAQ1B,GAAS7c,CAAI,EACrBwd,EAAa,IAAI,gBACjBgB,EAAyBxe,EAAK,QAA6Dwd,EAAW,OACtGiB,EAAOlD,GAAS+C,EAAOte,CAAI,EAC3B3b,EAAU,MAAM44B,GAAWjd,CAAI,EAC/BsP,EAAO8N,GAAQpd,EAAM3b,CAAO,EAC5BywB,EAASuI,GAAUiB,EAAOte,CAAI,EAC9BuO,EAAU4P,GAAeA,GAAe,CAAC,EAAGne,CAAI,EAAG,CAAC,EAAG,CAC5D,IAAKye,EACL,UACA,OACA,SACA,QACD,CAAC,EAID,IAAK,IAAMC,KAAalE,EAAM,UAAW,GAAIkE,EAAW,CACvD,IAAMnhC,EAAM,MAAMmhC,EAAUnQ,CAAO,EAC/B,OAAOhxB,GAAQ,UAAYA,GAAc,OAAO,OAAOgxB,EAAShxB,CAAG,CACxE,EACI,WAAYgxB,GAAW,OAAOA,EAAQ,QAAW,YAAc,OAAQ9rB,GAAY,OAA+B,EAAgBA,EAAQ,OAAU,KAAmC,IAAK,GAAI47B,EAAc,OAAU,cACrN,WAAY9P,IAAU,EAAQ,OAAS,SAE9C,GAAM,CAAE,gBAAiB+O,GAAWtd,EAAMwd,CAAU,EAChD9N,EAAW,MAAM6O,EAAMhQ,EAAQ,IAAKA,CAAO,EAC/CoQ,EAAa,EACb,IAAMC,EAAkB,CACvB,WACA,QAASrQ,CACV,EACA,IAAK,IAAMsQ,KAAcrE,EAAM,WAAY,GAAIqE,EAAY,CAC1D,IAAIC,EACJ,IAAMxZ,EAAI,MAAMuZ,EAAWV,GAAeA,GAAe,CAAC,EAAGS,CAAe,EAAG,CAAC,EAAG,CAAE,SAAWn8B,GAAY,OAA+B,EAAuBA,EAAQ,cAAiB,MAAmDq8B,EAAqB,cAAiBpP,EAAS,MAAM,EAAIA,CAAS,CAAC,CAAC,EAC9SpK,aAAa,SAAU,EAAWA,EAC7B,OAAOA,GAAM,UAAYA,IAAY,EAAWA,EAAE,SAC5D,CAIA,GAAIoK,EAAS,GAAI,CAChB,GAAMnB,EAAQ,SAAW,OAAS,MAAO,CACxC,KAAM,GACN,MAAO,IACR,EACA,IAAMwQ,EAAe1C,GAAmB3M,CAAQ,EAC1CsP,EAAiB,CACtB,KAAM,KACN,WACA,QAASzQ,CACV,EACA,GAAIwQ,IAAiB,QAAUA,IAAiB,OAAQ,CAEvD,IAAMpC,EAAO,MAAMjN,EAAS,KAAK,EACjC,EAAe,KAAO,MAA8BnB,EAAQ,YAA+EmO,GAAA,CAAWC,CAAI,CAC3J,KAAO,GAAe,KAAO,MAAMjN,EAASqP,EAAa,CAAC,EAItDxQ,GAA0D,QACzDA,EAAQ,QAAU,CAACA,EAAQ,oBAAmB,EAAe,KAAO,MAAMoP,GAAoBpP,EAAQ,OAAQyQ,EAAe,IAAI,GAEtI,IAAK,IAAMC,KAAazE,EAAM,UAAW,GAAIyE,EAAW,CACvD,IAAIC,EACJ,MAAMD,EAAUd,GAAeA,GAAe,CAAC,EAAGa,CAAc,EAAG,CAAC,EAAG,CAAE,SAAWv8B,GAAY,OAA+B,EAAwBA,EAAQ,cAAiB,MAAoDy8B,EAAsB,cAAiBxP,EAAS,MAAM,EAAIA,CAAS,CAAC,CAAC,CAC1S,CAEA,OADIjtB,GAA0D,MAAcu8B,EAAe,KACpF,CACN,KAAMA,EAAe,KACrB,MAAO,IACR,CACD,CACA,IAAMG,EAAgC18B,GAA0D,YAA+Ei6B,GACzK0C,EAAe,MAAM1P,EAAS,KAAK,EACnCS,EAAiBqM,GAAe4C,CAAY,EAC5CC,EAAclP,EAAiB,MAAMgP,EAAOC,CAAY,EAAI,KAI5DE,EAAe,CACpB,WACA,eACA,QAAS/Q,EACT,MAAO4P,GAAeA,GAAe,CAAC,EAAGkB,CAAW,EAAG,CAAC,EAAG,CAC1D,OAAQ3P,EAAS,OACjB,WAAYA,EAAS,UACtB,CAAC,CACF,EACA,IAAK,IAAM6P,KAAW/E,EAAM,QAAS,GAAI+E,EAAS,CACjD,IAAIC,EACJ,MAAMD,EAAQpB,GAAeA,GAAe,CAAC,EAAGmB,CAAY,EAAG,CAAC,EAAG,CAAE,SAAW78B,GAAY,OAA+B,EAAwBA,EAAQ,cAAiB,MAAoD+8B,EAAsB,cAAiB9P,EAAS,MAAM,EAAIA,CAAS,CAAC,CAAC,CACtS,CACA,GAAIjtB,GAA0D,MAAO,CAEpE,IAAMg9B,EAAgB3E,GAAoBr4B,EAAQ,KAAK,EACjDi9B,EAAyCj9B,EAAQ,cAAqF,EAC5I,GAAI,MAAMg9B,EAAc,mBAAmBC,EAAehQ,CAAQ,EAAG,CACpE,IAAK,IAAMiQ,KAAWnF,EAAM,QAAamF,GAAS,MAAMA,EAAQf,CAAe,EAC/E,IAAMgB,EAAQH,EAAc,SAASC,CAAa,EAElD,OADA,MAAM,IAAI,QAAS,GAAY,WAAWG,EAASD,CAAK,CAAC,EAClD,MAAMxB,GAAYrnC,EAAKonC,GAAeA,GAAe,CAAC,EAAG17B,CAAO,EAAG,CAAC,EAAG,CAAE,aAAci9B,EAAgB,CAAE,CAAC,CAAC,CACnH,CACD,CACA,GAAIj9B,GAA0D,MAAO,MAAM,IAAI63B,GAAiB5K,EAAS,OAAQA,EAAS,WAAYS,EAAiBkP,EAAcD,CAAY,EACjL,MAAO,CACN,KAAM,KACN,MAAOjB,GAAeA,GAAe,CAAC,EAAGkB,CAAW,EAAG,CAAC,EAAG,CAC1D,OAAQ3P,EAAS,OACjB,WAAYA,EAAS,UACtB,CAAC,CACF,CACD,EC1hBMoQ,GAAuB,IAAI,IAAI,CACpC,IACA,IACA,IACA,IACA,GACD,CAAC,EAQD,SAASC,GAAmB,EAAU,CACrC,OAAOrQ,EAAS,OAAS,kBAAoBoQ,GAAqB,IAAIpQ,EAAS,MAAM,CACtF,CACA,SAASsQ,GAAgB,EAAU,CAClC,OAAO,IAAIzmC,EAAgB,uBAAuBq+B,EAAS,2HAA2H,CACvL,CAQA,IAAMqI,GAAmB,CAAE,SAAU,QAAS,EAgB9C,eAAeC,GAAuB,EAAK,EAAS,CACnD,IAAIC,EAAa,GACXZ,EAAU98B,GAAS,QACnBuR,EAAS,MAAMoqB,GAAYrnC,EAAK,CACrC,GAAG0L,EACH,GAAGw9B,GACH,MAAM,QAAQ,EAAS,CAClBF,GAAmBxR,EAAQ,QAAQ,IAAG,EAAa,IACvD,MAAMgR,IAAUhR,CAAO,CACxB,CACD,CAAC,CAAC,CAAC,MAAO,GAAU,CAEnB,MADI4R,EAAkBH,GAAgBjpC,CAAG,EACnCoa,CACP,CAAC,EACD,GAAIgvB,EAAY,MAAMH,GAAgBjpC,CAAG,EACzC,OAAOid,CACR,CC1DA,IAAMosB,GAAkB,WAClBC,GAA0B,CAC/B,QACA,QACA,QACA,QACA,OACD,EACMC,GAAqC,IACrCC,GAAsB,IACtBC,GAAqB,IAAI,IAAI,CAClC,IACA,IACA,IACA,KACA,KACA,KACA,MACA,GACD,CAAC,EAqBD,SAASC,GAAsB,EAAc,CAC5C,MAAO,CAAE,SAAU,CAAE,MAAK,eAAgBC,EAAa,yBAAyB,CAC/E,WAAY,cAAc3lC,IAC1B,MAAOA,EACP,WACD,CAAC,CAAE,CACJ,CACA,SAAS4lC,EAAqB,EAAM,EAAS,CAC5C,OAAO,OAAO,OAAW,MAAMnkC,CAAO,EAAG,CAAE,MAAK,CAAC,CAClD,CACA,SAASokC,GAAiB,EAAO,CAChC,OAAOzvB,aAAiB,OAAS,SAAUA,GAASA,EAAM,OAAS,oBACpE,CACA,SAAS0vB,GAA8B,EAAe,CACrD,GAAI,CAAC/G,EAAe,OACpB,IAAM9+B,EAAQ8+B,EAAc,KAAK,EACjC,GAAI,CAAC9+B,EAAO,OACZ,IAAM45B,EAAQ,iDAAiD,KAAK55B,CAAK,EACzE,GAAI,CAAC45B,EAAO,MAAO,CAClB,OAAQ,UACR,MAAO55B,CACR,EACA,IAAM8lC,EAASlM,EAAM,IAAM,GACrBnkB,EAAQmkB,EAAM,EAAE,EAAE,KAAK,GAAK,GASlC,OARIkM,EAAO,YAAY,IAAM,SAAiB,CAC7C,OAAQ,SACR,OACD,EACIA,EAAO,YAAY,IAAM,OAAe,CAC3C,OAAQ,OACR,OACD,EACO,CACN,OAAQ,UACR,MAAO9lC,CACR,CACD,CACA,SAAS+lC,GAAoC,EAAO,CACnD,OAAOF,GAA8BpwB,CAAK,CAAC,EAAE,OAASA,CACvD,CACA,SAASuwB,GAAiB,EAAK,CAC9B,IAAMl8B,EAAS,IAAI,IAAI/N,CAAG,EAC1B,GAAI+N,EAAO,KAAM,MAAU,MAAM,4CAA4C,EAC7E,MAAO,GAAGA,EAAO,SAASA,EAAO,UAClC,CACA,eAAem8B,GAAc,EAAa,CACzC,IAAM5+B,EAAS,MAAM,OAAO,OAAO,OAAO,UAAW,IAAI,YAAY,CAAC,CAAC,OAAO6+B,CAAW,CAAC,EAC1F,OAAOjvC,EAAiB,IAAI,WAAWoQ,CAAM,CAAC,CAC/C,CACA,eAAe8+B,GAAc,EAAK,CACjC,OAAOnnB,GAAuBtR,EAAK,QAAQ,CAC5C,CAQA,SAAS04B,GAAmB,EAAc,CACzC,GAAI,CAACC,GAAgB,OAAOA,GAAiB,UAAY,MAAM,QAAQA,CAAY,EAAG,OACtF,IAAMC,EAAMD,EAAa,IACzB,OAAO,OAAOC,GAAQ,UAAYA,EAAI,OAAS,EAAIA,EAAM,IAAK,EAC/D,CACA,SAASC,GAAsB,EAAS,CACvC,OAAOH,GAAmBv+B,EAAQ,GAAG,CACtC,CACA,SAAS2+B,GAAe,EAAS,EAAO,CACvC,IAAMxmC,EAAQ6H,EAAQF,GACtB,OAAO,OAAO3H,GAAU,UAAYA,EAAM,OAAS,EAAIA,EAAQ,IAAK,EACrE,CACA,SAASymC,GAAe,EAAS,EAAO,CACvC,IAAMzmC,EAAQ6H,EAAQF,GACtB,OAAO,OAAO3H,GAAU,UAAY,OAAO,SAASA,CAAK,EAAIA,EAAQ,IAAK,EAC3E,CACA,SAAS0mC,GAA6B,EAAK,EAAmB,CAC7D,GAAI,CAACl7B,GAAOA,IAAQ,QAAUA,EAAI,WAAW,IAAI,EAAG,MAAMm6B,EAAqB,qBAAsB,iDAAiD,EACtJ,GAAI,CAACgB,EAAkB,SAASn7B,CAAG,EAAG,MAAMm6B,EAAqB,qBAAsB,8CAA8C,CACtI,CACA,SAASiB,GAAgB,EAAK,CAC7B,GAAI,CAACl5B,GAAO,OAAOA,GAAQ,UAAY,MAAM,QAAQA,CAAG,EAAG,MAAMi4B,EAAqB,qBAAsB,6CAA6C,EACzJ,GAAIj4B,EAAI,MAAQ,MAAO,MAAMi4B,EAAqB,qBAAsB,mCAAmC,EAC3G,IAAK,IAAMkB,KAASrB,GAAoB,GAAIqB,KAASn5B,EAAK,MAAMi4B,EAAqB,qBAAsB,sDAAsD,CAClK,CACA,eAAemB,GAAoB,EAAQ,CAC1C,IAAM//B,EAAQ,GAAGlI,EAAO,IAAI,IAAIA,EAAO,IAAI,IAAIA,EAAO,IAAI,IAAIA,EAAO,MAC/DwI,EAAS,MAAM,OAAO,OAAO,OAAO,UAAW,IAAI,YAAY,CAAC,CAAC,OAAON,CAAK,CAAC,EACpF,OAAO9P,EAAiB,IAAI,WAAWoQ,CAAM,CAAC,CAC/C,CACA,eAAe0/B,GAAkB,EAAa,EAAa,CAC1D,GAAKC,GACD,CAAC,MAAMA,EAAY,QAAQC,CAAW,EAAG,MAAMtB,EAAqB,qBAAsB,sCAAsC,CACrI,CACA,eAAeuB,GAAgB,CAAE,WAAU,SAAQ,MAAK,cAAa,cAAa,aAAa,GAAO,aAAa,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EAAG,qBAAqB5B,GAAoC,oBAAoBD,GAAyB,eAAe,CACrQ,GAAI,CAAC8B,GAAYA,EAAS,MAAM,GAAG,CAAC,CAAC,SAAW,EAAG,MAAMxB,EAAqB,qBAAsB,kCAAkC,EACtI,IAAIp7B,EACJ,GAAI,CACH,EAAkB+V,GAAsB6mB,CAAQ,CACjD,OAAShxB,EAAO,CACf,MAAMwvB,EAAqB,qBAAsBxvB,aAAiB,MAAQA,EAAM,QAAU,8BAA8B,CACzH,CACA,GAAI5L,EAAgB,MAAQ,WAAY,MAAMo7B,EAAqB,qBAAsB,mCAAqC,EAC9He,GAA6Bn8B,EAAgB,IAAKo8B,CAAiB,EACnEC,GAAgBr8B,EAAgB,GAAG,EACnC,IAAI1C,EACJ,GAAI,CACH,GAAW,MAAMqU,GAAUirB,EAAU,MAAM9mB,GAAU9V,EAAgB,IAAKA,EAAgB,GAAG,EAAG,CAAE,IAAK66B,EAAgB,CAAC,EAAA,CAAG,OAC5H,OAASjvB,EAAO,CACf,MAAMwvB,EAAqB,qBAAsBxvB,aAAiB,MAAQA,EAAM,QAAU,iCAAiC,CAC5H,CACA,IAAMixB,EAAMZ,GAAe3+B,EAAS,KAAK,EACnCw/B,EAAMb,GAAe3+B,EAAS,KAAK,EACnCy/B,EAAMd,GAAe3+B,EAAS,KAAK,EACnC0T,EAAMkrB,GAAe5+B,EAAS,KAAK,EACzC,GAAI,CAACu/B,GAAO,CAACC,GAAO,CAACC,GAAO/rB,IAAQ,IAAK,GAAG,MAAMoqB,EAAqB,qBAAsB,uDAAuD,EACpJ,GAAI2B,EAAI,OAAS/B,GAAqB,MAAMI,EAAqB,qBAAsB,6BAA6B,EACpH,GAAIyB,EAAI,YAAY,IAAMtN,EAAO,YAAY,EAAG,MAAM6L,EAAqB,qBAAsB,kDAAkD,EACnJ,IAAI4B,EACAC,EACJ,GAAI,CACH,EAAgBxB,GAAiBjqC,CAAG,EACpC,EAAWiqC,GAAiBqB,CAAG,CAChC,OAASlxB,EAAO,CACf,MAAMwvB,EAAqB,qBAAsBxvB,aAAiB,MAAQA,EAAM,QAAU,2BAA2B,CACtH,CACA,GAAIqxB,IAAaD,EAAe,MAAM5B,EAAqB,qBAAsB,+CAA+C,EAChI,GAAIpqB,EAAMksB,EAAa,GAAKA,EAAalsB,EAAMmsB,EAAoB,MAAM/B,EAAqB,qBAAsB,+CAA+C,EACnK,IAAMgC,EAAMnB,GAAe3+B,EAAS,KAAK,EACzC,GAAI+/B,GAAc,CAACD,EAAK,MAAMhC,EAAqB,qBAAsB,sCAAsC,EAC/G,GAAIO,IAAgB,IAAK,IACpByB,IAAQ,MAAM1B,GAAcC,CAAW,EAAG,MAAMP,EAAqB,qBAAsB,gDAAgD,EAEhJ,IAAMW,EAAM,MAAMH,GAAc57B,EAAgB,GAAG,EACnD,GAAIs9B,IAAgB,IAAK,IAAKvB,IAAQuB,EAAa,MAAMlC,EAAqB,qBAAsB,+CAA+C,EACnJ,IAAMmC,EAAY,MAAMhB,GAAoB,CAC3C,MACA,IAAKM,EAAI,YAAY,EACrB,IAAKG,EACL,KACD,CAAC,EACKQ,EAA4B,IAAI,MAAMxsB,EAAMmsB,GAAsB,GAAG,EAM3E,OALA,MAAMX,GAAkBC,EAAa,CACpC,IAAKc,EACL,YACA,IAAqB,IAAI,KAAKL,EAAa,GAAG,CAC/C,CAAC,EACM,CACN,IAAKl9B,EAAgB,IACrB,MACA,MACA,MACA,IAAKg9B,EACL,MACA,MACA,YACA,WACD,CACD,CACA,SAASS,GAAuB,EAAM,EAAS,CAC9C,OAAO,OAAO,OAAW,MAAMxmC,CAAO,EAAG,CAAE,MAAK,CAAC,CAClD,CACA,SAASymC,GAAmB,EAAO,CAClC,OAAO9xB,aAAiB,OAAS,SAAUA,IAAUA,EAAM,OAAS,iBAAmBA,EAAM,OAAS,qBACvG,CAYA,eAAe+xB,GAAmB,CAAE,UAAS,gBAAe,WAAU,SAAQ,MAAK,cAAa,qBAAoB,qBAAqB,CACxI,IAAMC,EAAU5B,GAAsB1+B,CAAO,EAC7C,GAAKsgC,EAIL,IAAIrJ,EAAc,SAAW,OAAQ,MAAMkJ,GAAuB,gBAAiB,gEAAgE,EACnJ,GAAI,CAACb,EAAU,MAAMa,GAAuB,qBAAsB,+BAA+B,EACjG,GAAI,CACH,MAAMd,GAAgB,CACrB,WACA,SACA,MACA,YAAapI,EAAc,MAC3B,YAAaqJ,EACb,WAAY,GACZ,qBACA,oBACA,aACD,CAAC,CACF,OAAShyB,EAAO,CAEf,MADIyvB,GAAiBzvB,CAAK,EAAS6xB,GAAuB,qBAAsB7xB,EAAM,OAAO,EACvFA,CACP,CAjBmJ,MAHlJ,GAAI2oB,EAAc,SAAW,OAAQ,MAAMkJ,GAAuB,gBAAiB,uDAAuD,CAqB5I,CC5OoBv/B,GAAA,KACAH,GAAA,KACaE,GAAA,KAQjC,IAAM4/B,GAA4B,IAAI,IAKhCC,GAAoC,IAAI,QAMxCnxC,GAAoB,IAO1B,SAASqxC,GAAoB,EAAQ,EAAK,CACzC,GAAKj8B,GACD,OAAK,IAAI,EAAIA,EAAO,WAAapV,MACjC,IAAQoV,EAAO,KAAK,KAAK,KAAM,GAAQoB,EAAI,MAAQ8R,CAAG,GAC1D,OAAOlT,EAAO,IACf,CAMA,eAAek8B,GAAU,EAAW,CACnC,IAAMzoB,EAAO,OAAO0oB,GAAc,SAAW,MAAMvD,GAAuBuD,EAAW,CAAE,QAAS,CAAE,OAAQ,kBAAmB,CAAE,CAAC,CAAC,CAAC,KAAK,KAAO,IAAQ,CACrJ,GAAIlmC,EAAI,MAAO,MAAU,MAAM,gBAAgBA,EAAI,MAAM,SAAWA,EAAI,MAAM,YAAY,EAC1F,OAAOA,EAAI,IACZ,CAAC,EAAI,MAAMkmC,EAAU,EACrB,GAAI,CAAC1oB,EAAM,MAAU,MAAM,eAAe,EAC1C,OAAOA,CACR,CA6CA,eAAe2oB,GAAQ,EAAO,EAAM,CACnC,OAAQ,MAAMC,GAAuBlzB,EAAOuP,CAAI,EAAA,CAAG,IACpD,CACA,eAAe2jB,GAAuB,EAAO,EAAM,CAClD,IAAIC,EACJ,GAAI,CACH,EAAatoB,GAAsB7K,CAAK,CACzC,OAASU,EAAO,CAEf,MADIA,aAAiB,MAAaA,EACxB,MAAMA,CAAK,CACtB,CACA,IAAMqJ,EAAMopB,EAAW,IACvB,GAAI,OAAO5jB,EAAK,WAAc,SAAU,CACvC,IAAM3Y,EAAW2Y,EAAK,aACtB,GAAI,CAAC3Y,EAAU,CACd,IAAM0T,EAAO,MAAMiF,EAAK,UAAU,EAClC,GAAI,CAACjF,EAAM,MAAU,MAAM,eAAe,EAC1C,MAAO,CACN,OACA,UAAW,GACX,KACD,CACD,CACA,IAAMzT,EAAS+7B,GAAkB,IAAIh8B,CAAQ,EACvCw8B,EAAa7jB,EAAK,aAAe,IAAK,GAAIujB,GAAoBj8B,EAAQkT,CAAG,EAC/E,GAAIqpB,EAAY,MAAO,CACtB,KAAMA,EACN,UAAW,GACX,MACA,iBAAkBv8B,GAAQ,gBAC3B,EACA,IAAMyT,EAAO,MAAMiF,EAAK,UAAU,EAClC,GAAI,CAACjF,EAAM,MAAU,MAAM,eAAe,EAC1C,IAAM+oB,EAAY,KAAK,IAAI,EAM3B,OALAT,GAAkB,IAAIh8B,EAAU,CAC/B,OACA,YACA,GAAG2Y,EAAK,cAAgB,CAACxF,EAAM,CAAE,iBAAkBspB,CAAU,EAAI,CAAC,CACnE,CAAC,EACM,CACN,OACA,UAAW,GACX,KACD,CACD,CACA,IAAMz8B,EAAW2Y,EAAK,UAChB1Y,EAAS87B,GAAU,IAAI/7B,CAAQ,EAC/Bw8B,EAAa7jB,EAAK,aAAe,IAAK,GAAIujB,GAAoBj8B,EAAQkT,CAAG,EAC/E,GAAI,CAACqpB,EAAY,CAChB,IAAM9oB,EAAO,MAAMyoB,GAAUxjB,EAAK,SAAS,EACrC8jB,EAAY,KAAK,IAAI,EAM3B,OALAV,GAAU,IAAI/7B,EAAU,CACvB,OACA,YACA,GAAG2Y,EAAK,cAAgB,CAACxF,EAAM,CAAE,iBAAkBspB,CAAU,EAAI,CAAC,CACnE,CAAC,EACM,CACN,OACA,UAAW,GACX,KACD,CACD,CACA,MAAO,CACN,KAAMD,EACN,UAAW,GACX,MACA,iBAAkBv8B,GAAQ,gBAC3B,CACD,CC7JA,IAAMy8B,GAAsB,CAC3B,qBACA,qBACA,eACD,EACMC,GAAqC,CAC1C,sBACA,qBACA,iBACD,EACMC,GAAuC,CAAC,OAAQ,GAAGD,EAAkC,EACrFE,GAA0C,IAAI,IAAID,EAAoC,EAC5F,SAASE,GAA6B,EAAM,EAAO,CAClD,GAAI,IAAM,KAAK,CAAC,CAAC,OAAS,GAC1B,MAAM,IAAI5qC,EAAgB,4BAA4BW,EAAK,iBAAiB,CAC7E,CACA,SAASkqC,GAAkB,EAAM,EAAO,CACvCD,GAA6BjqC,EAAMc,CAAK,EACxC,IAAIjE,EACJ,GAAI,CACH,EAAM,IAAI,IAAIiE,CAAK,CACpB,MAAQ,CACP,EAAM,IAAK,EACZ,CACA,GAAI,IAAK,SACT,MAAM,IAAIzB,EAAgB,4BAA4BW,EAAK,4BAA4Bc,GAAO,CAC/F,CACA,SAASqpC,GAAyB,EAAW,CAC5CD,GAAkB,aAAcE,CAAS,CAC1C,CACA,SAASC,GAAuC,EAAQ,CAEvD,GADAJ,GAA6B,6BAA8BrP,CAAM,EAC5DoP,GAAwC,IAAIpP,CAAM,EACvD,MAAM,IAAIv7B,EAAgB,oEAAoEu7B,GAAQ,CACvG,CACA,SAAS0P,GAAmC,EAAe,CAE1D,GADAJ,GAAkB,wBAAyBK,CAAa,EACpDA,IAAA,yDACJ,MAAM,IAAIlrC,EAAgB,+DAA+DkrC,GAAe,CACzG,CAOA,SAASC,GAAqB,EAAW,CACxC,IAAMC,EAAa,OAAO,KAAKC,EAAU,QAAU,CAAC,CAAC,EACrD,IAAK,IAAMN,KAAaK,EAAYN,GAAyBC,CAAS,EACtE,IAAMO,EAAc,CAAC,EACfC,EAAiB,CAAC,EACxB,IAAK,GAAM,CAAChQ,EAAQiQ,KAAa,OAAO,QAAQH,EAAU,sBAAwB,CAAC,CAAC,EAAG,CACtFL,GAAuCzP,CAAM,EAC7C+P,EAAY,KAAK/P,CAAM,EACvB,IAAMkQ,EAAuBD,EAAS,gBAAkB,CAACjQ,CAAM,EAC/D,GAAIkQ,EAAqB,SAAW,EAAG,MAAM,IAAIzrC,EAAgB,2EAA2Eu7B,GAAQ,EACpJ,IAAK,IAAM2P,KAAiBO,EAC3BR,GAAmCC,CAAa,EAChDK,EAAe,KAAKL,CAAa,CAEnC,CACA,IAAMQ,GAAsBL,EAAU,gBAAkB,MAAM,QAAQA,EAAU,eAAe,EAAIA,EAAU,gBAAkB,CAACA,EAAU,eAAe,EAAI,CAAC,EAAA,CAAG,IAAK,GAAcM,EAAU,EAAE,EAChM,IAAK,IAAMC,KAAqBF,EAAoBd,GAA6B,sBAAuBgB,CAAiB,EACzH,MAAO,CACN,aACA,cACA,iBACA,oBACD,CACD,CACA,SAASC,GAAkC,EAAO,EAAQ,CACzD,IAAMC,EAAuB,IAAI,IACjC,IAAK,IAAMrqC,KAASsqC,EAAQ,CAC3B,GAAID,EAAK,IAAIrqC,CAAK,EAAG,MAAM,IAAIzB,EAAgB,sCAAsCyK,EAAM,IAAIhJ,EAAM,4DAA4D,EACjKqqC,EAAK,IAAIrqC,CAAK,CACf,CACD,CAQA,SAASuqC,GAAgC,EAAY,CACpD,IAAMC,GAAQx/B,GAAc,CAAC,EAAA,CAAG,IAAI0+B,EAAoB,EACxDU,GAAkC,aAAcI,EAAK,QAAS,GAAMl0B,EAAE,UAAU,CAAC,EACjF8zB,GAAkC,6BAA8BI,EAAK,QAAS,GAAMl0B,EAAE,WAAW,CAAC,EAClG8zB,GAAkC,wBAAyBI,EAAK,QAAS,GAAMl0B,EAAE,cAAc,CAAC,EAChG8zB,GAAkC,sBAAuBI,EAAK,QAAS,GAAMl0B,EAAE,kBAAkB,CAAC,CACnG,CACA,SAASm0B,GAA2B,EAAM,CACzC,OAAOzlB,EAAK,YAAc,CAAC,CAC5B,CAMA,SAAS0lB,GAAqB,EAAM,CACnC,OAAOD,GAA2BzlB,CAAI,CAAC,CAAC,QAAS,GAAc,CAC9D,IAAMklB,EAAYN,EAAU,gBAE5B,OADKM,EACE,MAAM,QAAQA,CAAS,EAAIA,EAAY,CAACA,CAAS,EADjC,CAAC,CAEzB,CAAC,CACF,CA0BA,SAASS,GAAoB,EAAK,EAAW,CAC5C,IAAMC,EAAW3Q,EAAI,UAAU,gBAAgB,EAC/C,GAAI,CAAC2Q,EAAU,MAAM,IAAIrsC,EAAgB,yDAAyD,EAClG,IAAMy/B,EAAW4M,EAAS,QAAQ,YAAc,CAAC,EACjD,GAAI5M,EAAS,SAAS4L,CAAS,EAAG,OAClC,IAAM5+B,EAAa,CAAC,GAAGgzB,EAAU4L,CAAS,EAC1CW,GAAgCv/B,CAAU,EAC1C,EAAS,QAAQ,WAAaA,CAC/B,CACA,SAAS6/B,GAAuB,EAAM,CACrC,OAAOJ,GAA2BzlB,CAAI,CAAC,CAAC,QAAS,GAAc,OAAO,KAAK4kB,EAAU,QAAU,CAAC,CAAC,CAAC,CACnG,CACA,SAASkB,GAAuB,EAAM,CACrC,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG9lB,EAAK,YAAc+jB,GAAqB,GAAG8B,GAAuB7lB,CAAI,CAAC,CAAC,CAAC,CACxG,CACA,SAAS+lB,GAAyB,EAAM,EAAW,CAClD,IAAK,IAAMnB,KAAaa,GAA2BzlB,CAAI,EAAG,CACzD,IAAM8Q,EAAU8T,EAAU,SAASN,GACnC,GAAIxT,EAAS,OAAOA,CACrB,CACD,CACA,SAASkV,GAAqC,EAAM,CACnD,OAAOP,GAA2BzlB,CAAI,CAAC,CAAC,QAAS,GAAc,OAAO,KAAK4kB,EAAU,sBAAwB,CAAC,CAAC,CAAC,CACjH,CAOA,SAASqB,GAAwB,EAAM,EAAU,CAChD,OAAO,MAAM,KAAK,IAAI,IAAI,CACzB,GAAGC,GAAU,YAAc,CAAC,MAAM,EAAI,CAAC,EACvC,GAAGlC,GACH,GAAGgC,GAAqChmB,CAAI,CAC7C,CAAC,CAAC,CACH,CACA,SAASmmB,GAAmC,EAAM,EAAQ,CACzD,OAAOrR,EAASkR,GAAqChmB,CAAI,CAAC,CAAC,SAAS8U,CAAM,EAAI,EAC/E,CACA,SAASsR,GAAyC,EAAM,EAAe,CACtE,GAAI3B,IAAA,yDACJ,IAAK,IAAMG,KAAaa,GAA2BzlB,CAAI,EAAG,CACzD,IAAMqmB,EAAazB,EAAU,sBAAwB,CAAC,EACtD,IAAK,GAAM,CAAC9P,EAAQiQ,KAAa,OAAO,QAAQsB,CAAU,EAAG,IAAKtB,EAAS,gBAAkB,CAACjQ,CAAM,EAAA,CAAG,SAAS2P,CAAa,EAAG,MAAO,CACtI,SACA,UACD,CACD,CACD,CAOA,SAAS6B,GAAqC,EAAK,EAAM,EAAM,EAAU,CACxE,IAAMpN,EAAO,CAAE,GAAGqN,CAAS,EAC3B,IAAK,IAAM3B,KAAaa,GAA2BzlB,CAAI,EAAG,CACzD,IAAMwmB,EAAe5B,EAAU,WAAW,CACzC,MACA,OACA,OACA,UACD,CAAC,EACD,IAAK,GAAM,CAAC7pC,EAAKC,KAAU,OAAO,QAAQwrC,GAAgB,CAAC,CAAC,EAASzrC,KAAOm+B,IAAO,EAAKn+B,GAAOC,EAChG,CACA,OAAOk+B,CACR,CACA,eAAeuN,GAAc,EAAM,EAAK,CACvC,IAAMC,EAAS,CAAC,EAChB,IAAK,IAAM9B,KAAaa,GAA2BzlB,CAAI,EAAG,CACzD,IAAMwmB,EAAe,MAAMG,EAAI/B,CAAS,GAAK,CAAC,EAC9C,IAAK,GAAM,CAAC7pC,EAAKC,KAAU,OAAO,QAAQwrC,CAAY,EACjDzrC,KAAO2rC,EACVjtC,GAAO,KAAK,yDAAyDsB,EAAI,uCAAuC,EAGjH,EAAOA,GAAOC,CAEhB,CACA,OAAO0rC,CACR,CACA,SAASE,GAAkC,EAAM,EAAO,CACvD,OAAOH,GAAczmB,EAAO,GAAc4kB,EAAU,QAAQ,cAAc7iC,CAAK,CAAC,CACjF,CACA,SAAS8kC,GAA8B,EAAM,EAAO,CACnD,OAAOJ,GAAczmB,EAAO,GAAc4kB,EAAU,QAAQ,UAAU7iC,CAAK,CAAC,CAC7E,CACA,SAAS+kC,GAA+B,EAAM,EAAO,CACpD,OAAOL,GAAczmB,EAAO,GAAc4kB,EAAU,QAAQ,WAAW7iC,CAAK,CAAC,CAC9E,CAKA,SAASglC,GAA0B,EAAM,CACxC,OAAOtB,GAA2BzlB,CAAI,CAAC,CAAC,KAAM,GAAc4kB,EAAU,QAAQ,QAAQ,CACvF,CAeA,SAASoC,GAAiB,EAAe,CACxC,GAAI,CAAClN,EAAe,OACpB,GAAM,CAACgH,EAAQmG,EAAa,GAAGC,GAAcpN,EAAc,KAAK,CAAC,CAAC,MAAM,KAAK,EAC7E,GAAIgH,GAAQ,YAAY,IAAM,SAC9B,IAAI,CAACmG,GAAeC,EAAW,OAAS,EAAG,MAAM,IAAI7uC,EAAS,cAAe,CAC5E,MAAO,kBACP,kBAAmB,uCACpB,CAAC,EACD,OAAO4uC,CADN,CAEF,CACA,SAASE,IAAiB,CACzB,IAAMxsB,EAAwB,IAAI,IAClC,MAAO,CACN,IAAI,EAAK,CACR,IAAMtU,EAAQsU,EAAM,IAAI5f,CAAG,EAC3B,GAAKsL,EACL,IAAIA,EAAM,WAAaA,EAAM,UAA4B,IAAI,KAC5DsU,EAAM,OAAO5f,CAAG,OAGjB,OAAOsL,CADP,CAED,EACA,IAAI,EAAK,EAAO,CACfsU,EAAM,IAAI5f,EAAKC,CAAK,CACrB,CACD,CACD,CAKA,IAAMosC,GAA0B,GACxBnS,EAAI,UAAU,gBAAgB,EAMhCoS,GAAgB,GAAQ,CAC7B,IAAM5M,EAASxF,EAAI,UAAU,KAAK,EAClC,GAAI,CAACwF,EAAQ,MAAM,IAAIlhC,EAAgB,YAAY,EACnD,OAAOkhC,CACR,EAOA,SAAS6M,GAAwB,EAAO,CACvC,GAAItsC,GAAS,KACb,IAAIA,aAAiB,KAAM,OAAO,OAAO,SAASA,EAAM,QAAQ,CAAC,EAAIA,EAAQ,IAAK,GAClF,GAAI,OAAOA,GAAU,SAAU,CAC9B,GAAI,CAAC,OAAO,SAASA,CAAK,EAAG,OAC7B,IAAM8J,EAAS,IAAI,KAAK9J,CAAK,EAC7B,OAAO,OAAO,SAAS8J,EAAO,QAAQ,CAAC,EAAIA,EAAS,IAAK,EAC1D,CACA,GAAI,OAAO9J,GAAU,SAAU,CAC9B,IAAMusC,EAAUvsC,EAAM,KAAK,EAC3B,GAAI,CAACusC,EAAQ,OAAQ,OACrB,IAAMC,EAAU,OAAOD,CAAO,EAC9B,GAAI,OAAO,SAASC,CAAO,EAAG,CAC7B,IAAM1iC,EAAS,IAAI,KAAK0iC,CAAO,EAC/B,OAAO,OAAO,SAAS1iC,EAAO,QAAQ,CAAC,EAAIA,EAAS,IAAK,EAC1D,CACA,IAAMA,EAAS,IAAI,KAAKyiC,CAAO,EAC/B,OAAO,OAAO,SAASziC,EAAO,QAAQ,CAAC,EAAIA,EAAS,IAAK,EAC1D,CAhBkF,CAiBnF,CAIA,SAAS2iC,GAAuB,EAAO,CAEtC,GADIzsC,aAAiB,MACjB,CAACA,GAAS,OAAOA,GAAU,SAAU,OAAOssC,GAAwBtsC,CAAK,EAC7E,IAAMmT,EAASm5B,GAAwBtsC,EAAM,SAAS,GAAKssC,GAAwBtsC,EAAM,UAAU,EACnG,GAAImT,EAAQ,OAAOA,EACnB,IAAMu5B,EAAS1sC,EAAM,QACrB,GAAK0sC,GAAU,OAAOA,GAAW,SACjC,OAAOJ,GAAwBI,EAAO,SAAS,GAAKJ,GAAwBI,EAAO,UAAU,CAC9F,CAIA,SAASC,GAAe,EAAO,CAC9B,GAAI,OAAO3sC,GAAU,SAAU,MAAO,CAACA,CAAK,EAC5C,GAAKA,GAAO,OACZ,OAAOA,CACR,CAIA,SAAS4sC,GAAgB,EAAU,CAClC,GAAI,OAAO5xB,GAAa,SAAU,OAAOA,EACzC,GAAKA,GAAU,OACf,OAAOA,EAAS,SAAW,EAAIA,EAAS,GAAG,CAAC,EAAIA,CACjD,CACA,IAAM6xB,GAAsC,IAAI,QAChD,SAASC,GAAsB,EAAS,CACvC,IAAMC,EAAgBF,GAAoB,IAAIplC,CAAO,EACrD,GAAIslC,EAAe,OAAOA,EAC1B,IAAMptB,EAAQwsB,GAAe,EAE7B,OADAU,GAAoB,IAAIplC,EAASkY,CAAK,EAC/BA,CACR,CAMA,eAAeqtB,GAAuB,EAAa,EAAQ,CAC1D,IAAMrM,EAAc,IAAI,gBAAgBsM,CAAW,EAC7Cr1B,EAAM+oB,EAAY,IAAI,KAAK,EAC3BuM,EAAOvM,EAAY,OAAO,KAAK,EAC/BllB,EAAM,OAAOklB,EAAY,IAAI,KAAK,CAAC,EACzCA,EAAY,OAAO,KAAK,EACxB,IAAMwM,EAAY,MAAMh2C,GAAcqI,GAA6BmhC,CAAW,CAAC,CAAC,SAAS,EAAG/0B,CAAM,EAClG,OAAOshC,EAAK,SAAW,GAAK,CAAC,CAACt1B,GAAO+J,GAAkB/J,EAAKu1B,CAAS,GAAqB,IAAI,KAAK1xB,EAAM,GAAG,GAAqB,IAAI,IACtI,CAIA,eAAe2xB,GAAU,EAAK,EAAS,EAAU,CAChD,IAAMC,EAAqBP,GAAsBrlC,CAAO,EAClD6lC,EAAgBD,EAAmB,IAAIhP,CAAQ,EACrD,GAAIiP,GAAiB,CAACA,EAAc,kBAAmB,OAAO,OAAO,OAAO,CAAC,EAAGA,CAAa,EAC7F,IAAIC,EAAW,MAAMtT,EAAI,QAAQ,QAAQ,QAAQ,CAChD,MAAOxyB,EAAQ,QAAQ,aAAa,WAAa,cACjD,MAAO,CAAC,CACP,MAAO,WACP,MAAO42B,CACR,CAAC,CACF,CAAC,EACKmP,EAAc9C,GAAqBjjC,CAAO,EAChD,GAAI8lC,GAAU,kBAAmB,CAChC,IAAMpD,EAAoBoD,EAAS,kBAC7BrD,EAAYsD,EAAY,KAAM,GAAcC,EAAU,KAAOtD,CAAiB,EAGpF,GAFI,CAACD,GAAW,QAAQ7L,CAAQ,IAChC,EAAW,MAAM6L,EAAU,QAAQjQ,EAAKoE,EAAUkP,CAAQ,EACtD,CAACA,GAAU,OAAO,IACvB,MAAO,GAAIA,EAEV,OADI9lC,EAAQ,sBAAsB,IAAI42B,CAAQ,GAAGgP,EAAmB,IAAIhP,EAAU,OAAO,OAAO,CAAC,EAAGkP,CAAQ,CAAC,EACtGA,OACD,IAAK,IAAMrD,KAAasD,EAAa,CAC3C,GAAI,CAACtD,EAAU,QAAQ7L,CAAQ,EAAG,SAClC,IAAMqP,EAAW,MAAMxD,EAAU,QAAQjQ,EAAKoE,EAAU,IAAI,EAC5D,GAAIqP,EAAU,CACb,EAAWA,EACX,KACD,CACD,CACA,OAAOH,CACR,CAQA,SAASI,GAAuB,EAAa,CAC5C,OAAOH,EAAY,QAAQ,EAAK,KAAO,CACtC,GAAGpnC,EACH,GAAGwnC,EAAE,mBAAqB,CAAC,CAC5B,GAAI,CAAC,CAAC,CACP,CAMA,IAAMC,GAAgB,KAAO,IAAU,CACtC,IAAMptC,EAAO,MAAMwhB,GAAW,SAAS,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,OAAOjiB,CAAK,CAAC,EAC/E,OAAOtB,GAAU,OAAO,IAAI,WAAW+B,CAAI,EAAG,CAAE,QAAS,EAAM,CAAC,CACjE,EAMA,eAAeqtC,GAA0B,EAAK,EAAe,EAAoB,CAChF,GAAIC,IAAkB,YAAa,OAAO,MAAMrd,GAAiB,CAChE,IAAKuJ,EAAI,QAAQ,aACjB,KAAM+T,CACP,CAAC,EACI,GAAI,OAAOD,GAAkB,UAAY,YAAaA,EAAe,OAAO,MAAMA,EAAc,QAAQC,CAAkB,EAC/H,MAAM,IAAIzvC,EAAgB,8CAA8CwvC,EAAc,EAAE,CACzF,CAMA,eAAeE,GAAyB,EAAK,EAAM,EAAoB,EAAc,CACpF,IAAMF,EAAgB/oB,EAAK,oBAAsBA,EAAK,iBAAmB,YAAc,UACvF,GAAI4Z,GAAgB5Z,EAAK,QAAQ,aAAc,IAAI4Z,EAAa,WAAW5Z,EAAK,QAAQ,YAAY,EAAG,EAAe4Z,EAAa,QAAQ5Z,EAAK,OAAO,aAAc,EAAE,OAClK,MAAM,IAAI3nB,EAAS,eAAgB,CACvC,kBAAmB,wBACnB,MAAO,gBACR,CAAC,CAAA,CACD,GAAI0wC,IAAkB,SAAU,CAC/B,IAAMG,EAAqBtP,EAAe,MAAMiP,GAAcjP,CAAY,EAAI,IAAK,GACnF,MAAO,CAAC,CAACsP,GAAsBvsB,GAAkBusB,EAAoBF,CAAkB,CACxF,CAAO,GAAI,OAAOD,GAAkB,UAAY,SAAUA,EAAe,IAAIA,EAAc,OAAQ,MAAO,CAAC,CAACnP,GAAgB,MAAMmP,EAAc,OAAOnP,EAAcoP,CAAkB,EAClL,CACJ,IAAME,EAAqBtP,EAAe,MAAMmP,EAAc,KAAKnP,CAAY,EAAI,IAAK,GACxF,MAAO,CAAC,CAACsP,GAAsBvsB,GAAkBusB,EAAoBF,CAAkB,CACxF,EACK,GAAID,IAAkB,YAAa,GAAI,CAC3C,IAAMI,EAAwB,MAAML,GAA0B7T,EAAK8T,EAAeC,CAAkB,EACpG,MAAO,CAAC,CAACpP,GAAgBjd,GAAkBwsB,EAAuBvP,CAAY,CAC/E,MAAQ,CACP,MAAO,EACR,CACK,GAAI,OAAOmP,GAAkB,UAAY,YAAaA,EAAe,CACzE,IAAMI,EAAwB,MAAML,GAA0B7T,EAAK8T,EAAeC,CAAkB,EACpG,MAAO,CAAC,CAACpP,GAAgBjd,GAAkBwsB,EAAuBvP,CAAY,CAC/E,CACA,MAAM,IAAIrgC,EAAgB,0CAA0CwvC,EAAc,EAAE,CACrF,CAMA,eAAeK,GAAkB,EAAK,EAAM,EAAc,CACzD,IAAML,EAAgB/oB,EAAK,oBAAsBA,EAAK,iBAAmB,YAAc,UACvF,GAAI+oB,IAAkB,YAAa,OAAO,MAAMtd,GAAiB,CAChE,IAAKwJ,EAAI,QAAQ,aACjB,KAAM2E,CACP,CAAC,EACI,GAAImP,IAAkB,SAAU,OAAO,MAAMF,GAAcjP,CAAY,EACvE,GAAI,OAAOmP,GAAkB,UAAY,SAAUA,EAAe,OAAO,MAAMA,EAAc,KAAKnP,CAAY,EAC9G,GAAI,OAAOmP,GAAkB,UAAY,YAAaA,EAAe,OAAO,MAAMA,EAAc,QAAQnP,CAAY,EACzH,MAAM,IAAIrgC,EAAgB,uCAAuCwvC,EAAc,EAAE,CAClF,CAOA,eAAeM,GAAW,EAAgB,SAAU,EAAO,EAAM,CAChE,GAAIN,IAAkB,SAAU,OAAO,MAAMF,GAAcp4B,CAAK,EAC3D,GAAI,OAAOs4B,GAAkB,UAAY,SAAUA,EAAe,OAAO,MAAMA,EAAc,KAAKt4B,EAAO64B,CAAI,EAClH,MAAM,IAAI/vC,EAAgB,+CAA+CwvC,EAAc,EAAE,CAC1F,CAMA,eAAeQ,GAAe,EAAgB,SAAU,EAAO,EAAM,CACpE,GAAIR,IAAkB,SAAU,OAAO,MAAMF,GAAcp4B,CAAK,EAC3D,GAAI,OAAOs4B,GAAkB,UAAY,SAAUA,EAAe,OAAO,MAAMA,EAAc,KAAKt4B,EAAO64B,CAAI,EAClH,MAAM,IAAI/vC,EAAgB,mDAAmDwvC,EAAc,EAAE,CAC9F,CAOA,IAAMS,GAAsB,YACtBC,GAAoB,0CAC1B,SAASC,GAAyB,EAAe,CAChD,OAAO5P,EAAc,MAAM2P,EAAiB,CAAC,GAAG,EACjD,CACA,IAAME,GAA+B,CACpC,gBACA,mBACA,uBACD,EACA,SAASC,GAAkC,EAAkB,CAC5D,MAAM,IAAIvxC,EAAS,cAAe,CACjC,MAAO,kBACP,kBAAmBwxC,CACpB,CAAC,CACF,CAcA,eAAeC,GAAwC,EAAS,EAAO,CAAC,EAAG,CAC1E,IAAIzQ,EACA/J,EAAK,YAAc,IAAK,IAAKA,EAAK,YAAc,KAC/C,OAAOA,EAAK,WAAc,UAAUsa,GAAkC,4BAA4B,EACtG,EAAWta,EAAK,WAEjB,IAAMya,EAAS,CAAC,EACVC,GAAqB,EAAO,IAAU,CACvChvC,IAAU,IAAK,IAAKA,IAAU,KAC9B,OAAOA,GAAU,UAAU4uC,GAAkC,GAAG/H,EAAM,kBAAkB,EAC5F,EAAOA,GAAS7mC,EACjB,EACA,IAAK,IAAM6mC,KAAS8H,GAAkC,OAAO,OAAOra,EAAMuS,CAAK,GAAGmI,EAAkBnI,EAAOvS,EAAKuS,EAAM,EAEtH,IAAMoI,EAAyB,EADTzd,GAAS,QAAQ,IAAI,eAAe,EAE1D,GAAIA,IACEA,EAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,GAAK,GAAA,CAAI,SAAS,mCAAmC,EAAG,CAC7G,IAAM3yB,EAAS,IAAI,gBAAgB,MAAM2yB,EAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,EACzD0d,EAAYrwC,EAAO,OAAO,WAAW,CAAC,CAAC,OAAQ,GAAUmB,EAAM,OAAS,CAAC,EAC3EkvC,EAAU,OAAS,GAAGN,GAAkC,gCAAgC,EAC5F,EAAWM,EAAU,GACrB,IAAK,IAAMrI,KAAS8H,GAA8B,CACjD,IAAMrE,EAASzrC,EAAO,OAAOgoC,CAAK,CAAC,CAAC,OAAQ,GAAU7mC,EAAM,OAAS,CAAC,EAClEsqC,EAAO,OAAS,GAAGsE,GAAkC,GAAG/H,EAAM,sBAAsB,EACpFyD,EAAO,SAAW,GAAG0E,EAAkBnI,EAAOyD,EAAO,EAAE,CAC5D,CACD,CAED,IAAM6E,EAAkBJ,EAAO,gBAAkB,IAAK,GAChDK,EAAqBL,EAAO,mBAAqB,IAAK,IAAKA,EAAO,wBAA0B,IAAK,IACnGE,IAA2BE,GAAmBC,IAAuBD,GAAmBC,IAAoBR,GAAkC,0DAA0D,EAC5M,EAAK,UAAYvQ,EACjB,IAAK,IAAMwI,KAAS8H,GAA8B,EAAK9H,GAASkI,EAAOlI,GACvE,MAAO,CAAE,SAAUoI,GAA0B,OAAO,KAAKF,CAAM,CAAC,CAAC,OAAS,CAAE,CAC7E,CACA,SAASM,GAAyB,EAAe,CAChD,GAAKb,GAAoB,KAAK1P,CAAa,EAC3C,GAAI,CACH,GAAM,CAAE,WAAU,gBAAiBD,GAAuBC,CAAa,EACvE,MAAO,CACN,UAAWT,EACX,cAAeO,CAChB,CACD,MAAQ,CACP,MAAM,IAAIvhC,EAAS,eAAgB,CAClC,kBAAmB,sCACnB,MAAO,gBACR,EAAG,CAAE,mBAAoB,OAAQ,CAAC,CACnC,CACD,CAWA,SAASiyC,GAAkB,EAAQ,EAAW,CAC7C,IAAMC,EAAgBC,EAAO,YAAcA,EAAO,WAAW,OAAS,EAAIA,EAAO,WAAa,CAAC,oBAAoB,EAEnH,OADIlG,IAAc,iBAAmBiG,EAAc,SAAS,oBAAoB,EAAU,GACnFA,EAAc,SAASjG,CAAS,CACxC,CAMA,SAASmG,GAAqB,EAAQ,EAAQ,CAC7C,GAAI,CAACC,GAAU,CAACF,EAAO,OAAQ,OAC/B,IAAMG,EAAc,IAAI,IAAIH,EAAO,MAAM,EACzC,IAAK,IAAM7R,KAAS+R,EAAQ,GAAI,CAACC,EAAY,IAAIhS,CAAK,EAAG,MAAM,IAAItgC,EAAS,cAAe,CAC1F,kBAAmB,+BAA+BsgC,IAClD,MAAO,eACR,CAAC,CACF,CACA,SAASiS,GAAmB,EAAkB,EAAgB,CAC7D,IAAMC,EAA+BC,GAAgB,SAAW,sBAC1DC,EAAkBD,GAAgB,SAAWD,EAA+B,QAAU,IAAK,IACjG,MAAM,IAAIxyC,EAAS0yC,EAAkB,eAAiB,cAAe,CACpE,kBAAmBlB,EACnB,MAAO,gBACR,EAAGkB,EAAkB,CAAE,mBAAoBA,CAAgB,EAAI,IAAK,EAAC,CACtE,CAUA,eAAeC,GAA0B,EAAK,EAAS,EAAU,EAAc,EAAQ,EAAa,EAAW,EAAY,CAC1H,IAAMR,EAAS,MAAMpC,GAAUnT,EAAKxyB,EAAS42B,CAAQ,EAChDmR,GAAQI,GAAmB,iBAAkB,CAAE,OAAQK,CAAW,CAAC,EACpET,EAAO,UAAUI,GAAmB,qBAAsB,CAAE,OAAQK,CAAW,CAAC,EACpF,IAAMC,EAAuBV,EAAO,yBAA2B,sBAE/D,GADIS,GAAcC,IAAyBD,GAAYL,GAAmB,yBAAyBM,EAAqB,cAAcD,IAAc,CAAE,OAAQA,CAAW,CAAC,GACrKT,EAAO,0BAA4B,mBAAqBrE,GAAmC1jC,EAAS+nC,EAAO,uBAAuB,IAAM,CAACW,EAAa,MAAM,IAAI9yC,EAAS,cAAe,CAC5L,kBAAmB,yBAAyBmyC,EAAO,wBAAwB,4BAC3E,MAAO,gBACR,CAAC,EAOD,GANKW,IACAX,EAAO,0BAA4B,QAAU,CAAC5Q,GAAcgR,GAAmB,iCAAkC,CAAE,OAAQK,CAAW,CAAC,EACvIrR,GAAgB,CAAC4Q,EAAO,cAAcI,GAAmB,sDAAuD,CAAE,OAAQK,CAAW,CAAC,EACtIrR,GAAgB,CAAC,MAAMqP,GAAyBhU,EAAKxyB,EAAS+nC,EAAO,aAAc5Q,CAAY,GAAGgR,GAAmB,wBAAyB,CAAE,OAAQK,CAAW,CAAC,GAEzKR,GAAqBD,EAAQE,CAAM,EAC/BpG,GAAa,CAACgG,GAAkBE,EAAQlG,CAAS,EAAG,MAAM,IAAIjsC,EAAS,cAAe,CACzF,kBAAmB,8CAA8CisC,IACjE,MAAO,qBACR,CAAC,EACD,OAAOkG,CACR,CAOA,SAASY,GAAoB,EAAU,CACtC,GAAKpwB,EACL,OAAO,OAAOA,GAAa,SAAW,KAAK,MAAMA,CAAQ,EAAIA,CAC9D,CAEA,SAASqwB,GAAuB,EAAa,CAC5C,MAAO,CACN,SAAUpE,GAAa,SACvB,aAAcA,GAAa,OAAS,gBAAkBA,EAAY,aAAe,IAAK,GACtF,YAAaA,GAAa,OAAS,eACnC,WAAYA,GAAa,OACzB,aAAcA,GAAa,OAAS,eAAiBA,EAAY,aAAe,IAAK,EACtF,CACD,CAKA,eAAeqE,GAAyB,EAAK,EAAM,EAAkB,CACpE,IAAMhc,EAAO,CAAE,GAAG2F,EAAI,MAAQ,CAAC,CAAE,EACjC,MAAM6U,GAAwC7U,EAAI,QAAS3F,CAAI,EAC/D,IAAMwK,EAAgB7E,EAAI,SAAS,QAAQ,IAAI,eAAe,GAAK,IAAK,GACxE,GAAI3F,EAAK,uBAAyBA,EAAK,iBAAkB,CACxD,GAAI,CAACA,EAAK,kBAAoB,CAACA,EAAK,sBAAuB,MAAM,IAAIj3B,EAAS,cAAe,CAC5F,kBAAmB,mEACnB,MAAO,gBACR,CAAC,EACD,IAAMkzC,EAAYjc,EAAK,iBACjBmV,EAAgBnV,EAAK,sBACrBkc,EAAoBpF,GAAyCpmB,EAAMykB,CAAa,EACtF,GAAI+G,EAAmB,CACtB,IAAMx3B,EAAS,MAAMw3B,EAAkB,SAAS,aAAa,CAC5D,MACA,OACA,YACA,gBACA,SAAUlc,EAAK,UACf,kBACD,CAAC,EACD,MAAO,CACN,KAAM,eACN,OAAQkc,EAAkB,OAC1B,SAAUx3B,EAAO,SACjB,aAAcA,EAAO,YACtB,CACD,CACA,GAAM,CAAE,sBAAuBy3B,GAAW,MAAA,QAAA,QAAA,CAAA,CAAA,SAAAC,EAAA,CAAA,CAAyC,KAAM,GAAM7tC,EAAE,CAAC,EAClG,MAAO,CACN,KAAM,eACN,OAAQ,kBACR,UAAW,MAAM4tC,EAAOxW,EAAKjV,EAAMurB,EAAW9G,EAAenV,EAAK,UAAWqc,CAAgB,EAAA,CAAG,QACjG,CACD,CACA,GAAI7R,GAAiB,CAAC0P,GAAoB,KAAK1P,CAAa,EAAG,CAC9D,IAAM8R,EAAsBlC,GAAyB5P,CAAa,EAClE,GAAI,CAAC8R,EAAqB,MAAM,IAAIvzC,EAAS,cAAe,CAC3D,MAAO,kBACP,kBAAmB,qCACpB,CAAC,EACDuyC,GAAmB,mCAAoC,CAAE,OAAQgB,CAAoB,CAAC,CACvF,CACA,GAAI9R,GAAiB0P,GAAoB,KAAK1P,CAAa,EAAG,CAC7D,IAAMv8B,EAAM8sC,GAAyBvQ,CAAa,EAClD,GAAIv8B,EAAK,MAAO,CACf,KAAM,gBACN,OAAQ,sBACR,SAAUA,EAAI,UACd,aAAcA,EAAI,aACnB,CACD,CAYA,OAXI+xB,EAAK,WAAaA,EAAK,cAAsB,CAChD,KAAM,gBACN,OAAQ,qBACR,SAAUA,EAAK,UACf,aAAcA,EAAK,aACpB,EACIA,EAAK,UAAkB,CAC1B,KAAM,SACN,OAAQ,OACR,SAAUA,EAAK,SAChB,EACO,IACR,CAMA,SAASuc,GAAY,EAAQ,CAC5B,IAAMC,EAAUC,EAAO,MAAM,GAAG,CAAC,CAAC,IAAK,GAAM5W,EAAE,KAAK,CAAC,EAC/C6W,EAAsB,IAAI,IAChC,IAAK,IAAM7W,KAAK2W,GAAa3W,IAAM,SAAWA,IAAM,WAAaA,IAAM,UAAYA,IAAM,kBAAoBA,IAAM,SAAQ6W,EAAI,IAAI7W,CAAC,EACpI,OAAO,IAAI,IAAI6W,CAAG,CACnB,CAOA,SAASC,GAAoB,EAAQ,CACpC,IAAMC,EAAM1B,EAAO,eAAe,GAClC,GAAI,CAAC0B,EAAK,MAAM,IAAI3yC,EAAgB,mDAAmD,EACvF,OAAO,IAAI,IAAI2yC,CAAG,CAAC,CAAC,IACrB,CAOA,eAAeC,GAAmB,EAAQ,EAAQ,EAAQ,CACzD,OAAOh6C,GAAc,GAAG85C,GAAoBzB,CAAM,EAAE,GAAG4B,IAAUxlC,CAAM,CACxE,CAOA,eAAeylC,GAAyB,EAAQ,EAAQ,EAAM,CAE7D,OADI7B,EAAO,cAAgB,YAAcxqB,EAAK,eAAuBmsB,GAAmBC,EAAQ5B,EAAQxqB,EAAK,cAAc,EACpHosB,CACR,CAKA,SAASE,GAAoB,EAAQ,CACpC,IAAMt4B,EAAS,OAAO,OAAO,IAAI,EACjC,IAAK,IAAMjZ,KAAO,IAAI,IAAIlB,EAAO,KAAK,CAAC,EAAG,CACzC,IAAMyrC,EAASzrC,EAAO,OAAOkB,CAAG,EAChC,EAAOA,GAAOuqC,EAAO,SAAW,EAAIA,EAAO,GAAKA,CACjD,CACA,OAAOtxB,CACR,CACA,SAASu4B,GAA6B,EAAkB,EAAqB,CAC5E,GAAI,CAACC,EAAqB,MAAO,GACjC,IAAM3lC,EAAaygC,GAAwBmF,CAAgB,EAE3D,OADK5lC,EACEA,EAAW,QAAQ,GAAK2lC,EAAoB,QAAQ,EADnC,EAEzB,CACA,SAASE,GAAsB,EAAO,EAAQ,CAC7C,IAAMC,EAAY,IAAI,gBAAgB1U,CAAK,EACrC6T,EAAUa,EAAU,IAAI,QAAQ,CAAC,EAAE,MAAM,GAAG,EAC5CC,EAAcd,GAAS,UAAW,GAAMe,IAAMd,CAAM,GAAK,GAK/D,OAJIa,GAAe,IAClBd,GAAS,OAAOc,EAAa,CAAC,EAC9Bd,GAAS,OAASa,EAAU,IAAI,SAAUb,EAAQ,KAAK,GAAG,CAAC,EAAIa,EAAU,OAAO,QAAQ,GAElFA,CACR,CACA,SAASG,GAAsB,EAAO,CACrC,IAAMH,EAAY,IAAI,gBAAgB1U,CAAK,EAE3C,OADA0U,EAAU,OAAO,SAAS,EACnBA,CACR,CAgBA,SAASI,GAAe,EAAQ,EAAS,CACxC,GAAIvC,EAAO,0BAA4B,OAAQ,MAAO,sCACtD,IAAMwC,EAAgBxgB,GAAS,QAAU,CAAC,EACpCygB,EAAkBD,EAAc,SAAS,QAAQ,EACjDE,EAAW,OAAO1gB,GAAS,OAAU,UAAYA,EAAQ,MAAM,OAAS,EACxE2gB,EAAeF,GAAmBC,EAGxC,OAFIF,EAAc,SAAS,gBAAgB,GAAK,CAACG,EAAqB,sEAClE3C,EAAO,aAAe,GAAa,mCAChC,EACR,CC90BA,SAAS4C,GAAW,EAAO,CAC1B,OAAOj8B,aAAiB9Y,GAAY8Y,aAAiBpY,GAAcoY,GAAO,OAAS,UACpF,CCJA,IAAIk8B,GACAC,GAA4B,GAChC,SAASC,IAA8B,CACtC,GAAI,CACH,OAAO,WAAW,SAAS,mBAAmB,kBAAkB,CAAC,EAAE,iBACpE,MAAQ,CACP,MACD,CACD,CACA,eAAeC,IAAuB,CACrC,GAAIH,GAAoC,OAAOA,GAC/C,IAAMI,EAAqBF,GAA4B,EACvD,GAAIE,EAEH,MADA,MAAuCA,EAChCJ,GAER,GAAI,CACH,GAAM,CAAE,kBAAmBnsB,GAAgB,MAAM,OAGhD,oBAGD,MADA,MAAuCA,EAChCmsB,EACR,OAAS77B,EAAK,CACb,IAAM0P,EAAc,WAAW,kBAC/B,GAAI,OAAOA,GAAgB,WAE1B,MADA,MAAuCA,EAChCmsB,GASR,MAPI,OAAO,OAAW,IAAuB,MAAM,uDAAuD,GACrGC,KACJ,GAA4B,GAC5B,QAAQ,KAAK,wHAAwH,EACrI,QAAQ,KAAK,8GAA8G,EAC3H,QAAQ,KAAK,uKAAuK,GAE/K97B,EACP,CACD,CCrCA,IAAMk8B,OACEh2C,EAAsB,CAAC,CAAC,QAAQ,4BAElCi2C,GAAoC,SAAY,CACrD,IAAM3U,EAAW0U,GAAkC,EACnD,GAAI1U,EAAU,OAAOA,EACrB,IAAM4U,EAAoB,MAAMJ,GAAqB,EAC/CK,EAAgBn2C,EAAsB,CAAC,CAAC,QAC9C,MAAO,GAAc,8BAAgC,IAAIk2C,CAC1D,EAYA,SAASE,IAAmC,CAC3C,OAAOt0C,GAA4B,CACpC,CAMA,SAASu0C,IAAgC,CACxC,IAAMC,EAAsBF,GAAiC,EAC7D,GAAI,CAACE,EAAqB,MAAU,MAAM,mHAAmH,EAC7J,OAAOA,CACR,CAOA,eAAeC,GAAuB,EAAqB,EAAI,CAC9D,OAAQ,MAAMN,GAAkC,EAAA,CAAG,IAAIK,EAAqB9rB,CAAE,CAC/E,CC3BA,IAAMgsB,GAAmB,CACxB,gBAAiB,WACjB,OAAQ,UACT,EAQA,SAASC,GAAgC,EAAiB,EAAG,CACvDf,GAAWrP,CAAC,GAAMqQ,GACvB,OAAO,eAAerQ,EAAG9lC,EAAuB,CAC/C,WAAY,GACZ,aAAc,GACd,MAAOm2C,EACP,SAAU,EACX,CAAC,CACF,CACA,IAAMC,GAAoB7c,GAAiB,UAMnC,CAAC,EACR,EACK8c,GAAuB9c,GAAiB,OAAO,CAAE,IAAK,CAAC6c,GAAmB7c,GAAiB,UACzF,CAAC,EACR,CAAC,CAAE,CAAC,EACC+c,GAAgC5d,GAAe,OAAO,CAAE,IAAK,CAAC0d,EAAiB,CAAE,CAAC,EACxF,SAASG,GAAoB,EAAS,EAAS,CAC9C,IAAMC,EAAUhsC,EAAQ,UAAU,UAAY,GAC9C,OAAO,KAAO,IAAY,CACzB,GAAIgsC,EAAS,IAAK,GAAM,CAACv0C,EAAMc,KAAU,OAAO,QAAQkzC,EAAgB,EAAG3f,EAAQ,UAAUr0B,EAAMc,CAAK,EACxG,GAAI,CACH,OAAO,MAAMizC,GAAuB1f,MAAeuC,EAAQvC,CAAO,CAAC,CACpE,OAASpd,EAAO,CAEf,MADAg9B,GAAgC5f,EAAQ,gBAAiBpd,CAAK,EACxDA,CACP,CACD,CACD,CACA,SAASu9B,EAAmB,GAAG/tB,EAAM,CACpC,GAAIA,EAAK,SAAW,EAAG,CACtB,GAAM,CAACsO,EAAMxsB,EAASquB,GAAWnQ,EACjC,OAAO4tB,GAA8Btf,EAAMxsB,EAAS+rC,GAAoB1d,EAASruB,CAAO,CAAC,CAC1F,CACA,GAAM,CAACA,EAASquB,GAAWnQ,EAC3B,OAAO4tB,GAA8B9rC,EAAS+rC,GAAoB1d,EAASruB,CAAO,CAAC,CACpF,CAKA,SAASksC,GAAe,EAAS,CAChC,MAAO,CACN,GAAGlsC,EACH,SAAU,CACT,GAAGA,EAAQ,SACX,YAAa,EACd,CACD,CACD,CAuBA,EAAmB,YAAc,EAAS,IAAYisC,EAAmBC,GAAelsC,CAAO,EAAGquB,CAAO,ECpGzG,SAAS8d,GAAiB,EAAM,CAE1B,OADDrvB,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAOA,IAAS,KAAa,KAAKA,IACnPA,CACb,CAIA,SAASsvB,GAAmB,EAAK,CAChC,IAAI76B,EAAS,GACb,IAAK,IAAIpY,EAAI,EAAGA,EAAI8Y,EAAI,OAAQ,IAAK,GAAUk6B,GAAiBl6B,EAAI9Y,EAAE,EACtE,OAAOoY,CACR,CAIA,SAAS86B,GAAU,EAAS,EAAY,GAAM,CAC7C,GAAI,MAAM,QAAQn1B,CAAO,EAAG,MAAO,MAAMA,EAAQ,IAAK,GAAM,IAAIm1B,GAAU3Z,EAAG6F,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,GACtG,IAAI+T,EAAoB,GACpBC,EAAmB,GACnBC,EAAW,IACXjU,IAAc,IACjB,EAAoB,IACpB,EAAmB,UACnB,EAAW,YACDA,IACV,EAAoBA,EACpB,EAAmB6T,GAAmBE,CAAiB,EACnDC,EAAiB,OAAS,GAC7B,EAAmB,MAAMA,EAAiB,GAC1C,EAAW,OAAOA,EAAiB,MAC7B,EAAW,KAAKA,EAAiB,IAEzC,IAAME,EAAoBlU,EAAY,GAAGgU,EAAiB,IAAM,GAC1DG,EAAoBnU,EAAY,GAAGgU,EAAiB,IAAM,GAC1D7a,EAAW6G,EAAYrhB,EAAQ,MAAMo1B,CAAiB,EAAI,CAACp1B,CAAO,EACpE3F,EAAS,GACb,IAAK,IAAI5O,EAAI,EAAGA,EAAI+uB,EAAS,OAAQ,IAAK,CACzC,IAAMT,EAAUS,EAAS/uB,GACnBgqC,EAAcjb,EAAS/uB,EAAI,GAC7BiqC,EAAmB,GACvB,GAAI,GAAC3b,GAAWtuB,EAAI,GAIpB,IAHI41B,IAAW,AACgBqU,EADZjqC,IAAM+uB,EAAS,OAAS,EAAsBgb,EACxDC,IAAgB,KACD,GAD0BF,GAE9ClU,GAAatH,IAAY,KACxB2b,IACH,GAAUjqC,IAAM,EAAI,GAAKiqC,EACzB,GAAU,MAAMJ,EAAS,IAAII,EAAiB,UAIhD,KAAK,IAAI7wC,EAAI,EAAGA,EAAIk1B,EAAQ,OAAQ,IAAK,CACxC,IAAMnU,EAAOmU,EAAQl1B,GACjB+gB,IAAS,KACR/gB,EAAIk1B,EAAQ,OAAS,IACxB,GAAUkb,GAAiBlb,EAAQl1B,EAAI,EAAE,EACzC,KAEK,AAEFwV,GAFMuL,IAAS,IAAe0vB,EAC1B1vB,IAAS,IAAe,GAAG0vB,EAAS,IAC9BL,GAAiBrvB,CAAI,CACrC,CACA,GAAU8vB,CADV,CAXA,CAaD,CACA,OAAOr7B,CACR,CACA,SAASs7B,GAAQ,EAAQ,EAAQ,CAChC,GAAI,OAAOC,GAAW,SAAU,MAAU,UAAU,gCAAgC,OAAOA,EAAO,OAAO,EACzG,OAAOha,EAAO,KAAKga,CAAM,CAC1B,CAgBA,SAASC,GAAc,EAAS,EAAS,CACxC,GAAI,OAAO71B,GAAY,UAAY,CAAC,MAAM,QAAQA,CAAO,EAAG,MAAU,UAAU,mFAAmF,OAAOA,EAAQ,OAAO,EAEzL,IADI,OAAOlX,GAAY,UAAY,OAAOA,GAAY,aAAW,EAAU,CAAE,UAAWA,CAAQ,GAC5F,UAAU,SAAW,GAAK,EAASA,IAAY,QAAe,OAAOA,GAAY,UAAYA,GAAoB,CAAC,MAAM,QAAQA,CAAO,GAAI,MAAU,UAAU,oFAAoF,OAAOA,EAAQ,OAAO,EAE7Q,GADA,IAAqB,CAAC,EAClBA,EAAQ,YAAc,KAAM,MAAU,MAAM,0GAA0G,EAC1J,IAAMgtC,EAAgBX,GAAUn1B,EAASlX,EAAQ,SAAS,EACpD8yB,EAAa,OAAO,IAAIka,EAAc,GAAIhtC,EAAQ,KAAK,EACvDyf,EAAKotB,GAAQ,KAAK,KAAM/Z,CAAM,EAIpC,MAHA,GAAG,QAAU9yB,EACb,EAAG,QAAUkX,EACb,EAAG,OAAS4b,EACLrT,CACR,CCnGA,IAAMwtB,GAAkB,GAYxB,SAASC,GAAuB,EAAM,CACrC,IAAMC,EAAWC,EAAK,QAAQ,QAAS,EAAE,CAAC,CAAC,QAAQ,WAAY,EAAE,CAAC,CAAC,YAAY,EAC/E,OAAOD,IAAa,aAAeA,EAAS,SAAS,YAAY,GAAKA,IAAa,OAASA,EAAS,WAAW,MAAM,CACvH,CACA,SAASE,GAAoB,EAAO,CACnC,IAAIC,EAAM/0C,EAAM,OAChB,KAAO+0C,EAAM,GAAK/0C,EAAM,WAAW+0C,EAAM,CAAC,IAAML,IAAiB,IACjE,OAAOK,IAAQ/0C,EAAM,OAASA,EAAQA,EAAM,MAAM,EAAG+0C,CAAG,CACzD,CACA,SAASC,GAAa,EAAK,CAC1B,GAAI,CACH,OAAQF,GAAoB,IAAI,IAAI/4C,CAAG,CAAC,CAAC,QAAQ,GAAK,OAAS,GAChE,MAAQ,CACP,MAAM,IAAIwC,EAAgB,qBAAqBxC,EAAI,mCAAmC,CACvF,CACD,CACA,SAASk5C,GAAkB,EAAK,CAC/B,GAAI,CACH,IAAMC,EAAY,IAAI,IAAIn5C,CAAG,EAC7B,GAAIm5C,EAAU,WAAa,SAAWA,EAAU,WAAa,SAAU,MAAM,IAAI32C,EAAgB,qBAAqBxC,EAAI,2CAA2C,CACtK,OAASoa,EAAO,CAEf,MADIA,aAAiB5X,EAAuB4X,EACtC,IAAI5X,EAAgB,qBAAqBxC,EAAI,oCAAqC,CAAE,MAAOoa,CAAM,CAAC,CACzG,CACD,CACA,SAASg/B,GAAS,EAAK,EAAO,YAAa,CAE1C,GADAF,GAAkBl5C,CAAG,EACjBi5C,GAAaj5C,CAAG,EAAG,OAAOA,EAC9B,IAAMq5C,EAAaN,GAAoB/4C,CAAG,EAG1C,MAFI,CAACk4B,GAAQA,IAAS,IAAYmhB,GAClC,EAAOnhB,EAAK,WAAW,GAAG,EAAIA,EAAO,IAAIA,IAClC,GAAGmhB,IAAanhB,IACxB,CACA,SAASohB,GAAoB,EAAQ,EAAM,CAgB1C,MAfI,CAAC9rC,GAAUA,EAAO,KAAK,IAAM,GAAW,GACxC+kC,IAAS,QAAgB/kC,IAAW,QAAUA,IAAW,QACzD+kC,IAAS,OACR,CACH,OACA,KACA,OACA,OACA,SACA,eACA,SACA,QACD,CAAC,CAAC,KAAM,GAAY3vB,EAAQ,KAAKpV,CAAM,CAAC,EAAU,GAC3C,8GAA8G,KAAKA,CAAM,GAAK,wCAAwC,KAAKA,CAAM,GAAK,oCAAoC,KAAKA,CAAM,GAAK,6BAA6B,KAAKA,CAAM,EAEnR,EACR,CACA,SAAS+rC,GAAW,EAAK,EAAM,EAAS,EAAS,EAAqB,CACrE,GAAIv5C,EAAK,OAAOo5C,GAASp5C,EAAKk4B,CAAI,EAClC,GAAIshB,IAAY,GAAO,CACtB,IAAMC,EAAUp4C,EAAI,iBAAmBA,EAAI,6BAA+BA,EAAI,wBAA0BA,EAAI,6BAA+BA,EAAI,uBAAyBA,EAAI,WAAa,IAAqB,IAAK,GAApBA,EAAI,UACnM,GAAIo4C,EAAS,OAAOL,GAASK,EAASvhB,CAAI,CAC3C,CACA,IAAMwhB,EAAcjkB,GAAS,QAAQ,IAAI,kBAAkB,EACrDkkB,EAAmBlkB,GAAS,QAAQ,IAAI,mBAAmB,EACjE,GAAIikB,GAAeC,GAAoBC,GAClCN,GAAoBK,EAAkB,OAAO,GAAKL,GAAoBI,EAAa,MAAM,EAAG,GAAI,CACnG,OAAON,GAAS,GAAGO,EAAiB,KAAKD,IAAexhB,CAAI,CAC7D,MAAiB,CAAC,CAEnB,GAAIzC,EAAS,CACZ,IAAMz1B,EAAM65C,GAAUpkB,EAAQ,GAAG,EACjC,GAAI,CAACz1B,EAAK,MAAM,IAAIwC,EAAgB,qEAAqE,EACzG,OAAO42C,GAASp5C,EAAKk4B,CAAI,CAC1B,CACA,GAAI,OAAO,OAAW,KAAe,OAAO,SAAU,OAAOkhB,GAAS,OAAO,SAAS,OAAQlhB,CAAI,CACnG,CACA,SAAS2hB,GAAU,EAAK,CACvB,GAAI,CACH,IAAMV,EAAY,IAAI,IAAIn5C,CAAG,EAC7B,OAAOm5C,EAAU,SAAW,OAAS,KAAOA,EAAU,MACvD,MAAQ,CACP,OAAO,IACR,CACD,CACA,SAASW,GAAY,EAAK,CACzB,GAAI,CACH,OAAO,IAAI,IAAI95C,CAAG,CAAC,CAAC,QACrB,MAAQ,CACP,OAAO,IACR,CACD,CACA,SAAS+5C,GAAQ,EAAK,CACrB,GAAI,CACH,OAAO,IAAI,IAAI/5C,CAAG,CAAC,CAAC,IACrB,MAAQ,CACP,OAAO,IACR,CACD,CAIA,SAASg6C,GAAuB,EAAQ,CACvC,OAAO,OAAOxe,GAAW,YAAYA,GAAmB,iBAAkBA,GAAU,MAAM,QAAQA,EAAO,YAAY,CACtH,CAYA,SAASye,GAAc,EAAO,CAC7B,GAAIh2C,aAAiB,QAAS,MAAO,GACrC,GAAI,OAAOA,GAAU,WAAYA,GAAkB,OAAO,UAAU,SAAS,KAAKA,CAAK,IAAM,mBAAoB,MAAO,GACxH,IAAM6xC,EAAI7xC,EACV,OAAO,OAAO6xC,EAAE,KAAQ,UAAY,OAAOA,EAAE,SAAY,UAAYA,EAAE,UAAY,MAAQ,OAAOA,EAAE,QAAQ,KAAQ,UACrH,CAMA,SAASoE,GAAkB,EAAQ,EAAqB,CACvD,IAAM5sC,EAAU2sC,GAAc14B,CAAM,EAAIA,EAAO,QAAUA,EACzD,GAAIq4B,EAAqB,CACxB,IAAMO,EAAgB7sC,EAAQ,IAAI,kBAAkB,EACpD,GAAI6sC,GAAiBb,GAAoBa,EAAe,MAAM,EAAG,OAAOA,CACzE,CACA,IAAMrB,EAAOxrC,EAAQ,IAAI,MAAM,EAC/B,GAAIwrC,GAAQQ,GAAoBR,EAAM,MAAM,EAAG,OAAOA,EACtD,GAAImB,GAAc14B,CAAM,EAAG,GAAI,CAC9B,OAAO,IAAI,IAAIA,EAAO,GAAG,CAAC,CAAC,IAC5B,MAAQ,CACP,OAAO,IACR,CACA,OAAO,IACR,CAMA,SAAS64B,GAAsB,EAAQ,EAAgB,EAAqB,CAC3E,GAAIC,IAAmB,QAAUA,IAAmB,QAAS,OAAOA,EACpE,IAAM/sC,EAAU2sC,GAAc14B,CAAM,EAAIA,EAAO,QAAUA,EACzD,GAAIq4B,EAAqB,CACxB,IAAMU,EAAiBhtC,EAAQ,IAAI,mBAAmB,EACtD,GAAIgtC,GAAkBhB,GAAoBgB,EAAgB,OAAO,EAAG,OAAOA,CAC5E,CACA,GAAIL,GAAc14B,CAAM,EAAG,GAAI,CAC9B,IAAMvhB,EAAM,IAAI,IAAIuhB,EAAO,GAAG,EAC9B,GAAIvhB,EAAI,WAAa,SAAWA,EAAI,WAAa,SAAU,OAAOA,EAAI,SAAS,MAAM,EAAG,EAAE,CAC3F,MAAQ,CAAC,CACT,IAAM84C,EAAOoB,GAAkB34B,EAAQq4B,CAAmB,EAE1D,OADId,GAAQF,GAAuBE,CAAI,EAAU,OAC1C,OACR,CAiBA,IAAMyB,IAAsB,EAAM,IAAY,CAC7C,GAAI,CAACzB,GAAQ,CAACl2B,EAAS,MAAO,GAC9B,IAAM43B,EAAiB1B,EAAK,QAAQ,eAAgB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,EAC5E2B,EAAoB73B,EAAQ,QAAQ,eAAgB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,EAExF,OADI63B,EAAkB,SAAS,GAAG,GAAKA,EAAkB,SAAS,GAAG,EAAUhC,GAAcgC,CAAiB,CAAC,CAACD,CAAc,EACvHA,EAAe,YAAY,IAAMC,EAAkB,YAAY,CACvE,EAWA,SAASC,GAAsB,EAAQ,EAAQ,EAAU,EAAqB,CAC7E,IAAM5B,EAAOoB,GAAkB34B,EAAQq4B,CAAmB,EAC1D,GAAI,CAACd,EAAM,CACV,GAAItd,EAAO,SAAU,OAAO4d,GAAS5d,EAAO,SAAUsF,CAAQ,EAC9D,MAAM,IAAIt+B,EAAgB,sGAAsG,CACjI,CACA,GAAIg5B,EAAO,aAAa,KAAM,GAAY+e,GAAmBzB,EAAMl2B,CAAO,CAAC,EAAG,OAAOw2B,GAAS,GAAGgB,GAAsB74B,EAAQia,EAAO,SAAUoe,CAAmB,EAAE,KAAKd,IAAQhY,CAAQ,EAC1L,GAAItF,EAAO,SAAU,OAAO4d,GAAS5d,EAAO,SAAUsF,CAAQ,EAC9D,MAAM,IAAIt+B,EAAgB,SAASs2C,EAAK,qDAAqDtd,EAAO,aAAa,KAAK,IAAI,EAAE,uEAAuE,CACpM,CAYA,SAASmf,GAAe,EAAQ,EAAU,EAAQ,EAAS,EAAqB,CAC/E,GAAIX,GAAuBxe,CAAM,EAGhC,OAFIja,EAAem5B,GAAsBlf,EAAQja,EAAQuf,EAAU8Y,CAAmB,EAClFpe,EAAO,SAAiB4d,GAAS5d,EAAO,SAAUsF,CAAQ,EACvDyY,GAAW,IAAK,GAAGzY,EAAU,IAAK,GAAG0Y,EAASI,CAAmB,EAEzE,IAAMnkB,EAAUwkB,GAAc14B,CAAM,EAAIA,EAAS,IAAK,GAEtD,OADuCg4B,GAAnC,OAAO/d,GAAW,SAA4BA,EAChC,IAAK,GADmCsF,EAAUrL,EAAS+jB,EAASI,CAAmB,CAE1G,CC1NA,SAASgB,GAAkB,EAAY,EAAU,CAChD,IAAI5Z,EACJ,GAAI,CACH,EAAW,IAAI,IAAI6Z,CAAU,CAAC,CAAC,SAAS,QAAQ,OAAQ,EAAE,GAAK,GAChE,MAAQ,CACP,MAAO,GACR,CACA,IAAMC,EAAqBha,EAAS,QAAQ,OAAQ,EAAE,EAItD,OAHIga,IAAuB,GAAW9Z,EAClCA,IAAa8Z,EAA2B,IACxC9Z,EAAS,WAAW8Z,EAAqB,GAAG,EAAU9Z,EAAS,MAAM8Z,EAAmB,MAAM,CAAC,CAAC,QAAQ,OAAQ,EAAE,GAAK,IACpH9Z,CACR,CACA,IAAM+Z,GAAuB,8BAS7B,SAASC,GAAkB,EAAO,EAAQ,CACzC,IAAMC,EAAWjwC,EAAM,WAAW,GAAG,EACrC,GAAIA,EAAM,WAAW,IAAI,GAAKA,EAAM,WAAW,KAAK,EAAG,MAAU,UAAU,2CAA2C,EACtH,IAAMkwC,EAAYD,EAAW,IAAI,IAAIjwC,EAAO+vC,EAAoB,EAAI,IAAI,IAAI/vC,CAAK,EACjF,GAAIiwC,GAAYC,EAAU,SAAWH,GAAsB,MAAU,UAAU,2CAA2C,EAC1H,IAAM7Z,EAAQp+B,EAAO,SAAS,EAC9B,GAAI,CAACo+B,EAAO,OAAOl2B,EACnB,IAAMi5B,EAAYiX,EAAU,OAAO,SAAS,GAAG,EAAI,GAAK,IAExD,MADA,GAAU,OAASA,EAAU,OAAS,GAAGA,EAAU,SAASjX,IAAY/C,IAAUA,EAC3E+Z,EAAWC,EAAU,KAAK,MAAMA,EAAU,OAAO,MAAM,EAAIA,EAAU,IAC7E,CAMA,IAAMC,GAAwB,CAC7B,cACA,QACA,WACD,ECxDMC,GAAa//C,EAAO,EACpBggD,GAAa//C,EAAO,EAI1B,SAASggD,GAAU,EAAI,CACtB,OAAOC,GAAOC,CAAE,GAAKC,GAAOD,CAAE,CAC/B,CACA,SAASD,GAAO,EAAI,CACnB,OAAOhgD,EAAW6/C,GAAYI,CAAE,CACjC,CACA,SAASC,GAAO,EAAI,CACnB,OAAOlgD,EAAW8/C,GAAYG,CAAE,CACjC,CAKA,SAASE,GAAsB,EAAM,CACpC,IAAMC,EAAQ/7C,EAAK,YAAY,EAC/B,GAAI+7C,EAAM,WAAW,SAAS,EAAG,CAChC,IAAMC,EAAWD,EAAM,UAAU,CAAC,EAClC,GAAIJ,GAAOK,CAAQ,EAAG,OAAOA,CAC9B,CACA,IAAMn3B,EAAQ7kB,EAAK,MAAM,GAAG,EAC5B,GAAI6kB,EAAM,SAAW,GAAKA,EAAM,EAAE,EAAE,YAAY,IAAM,OAAQ,CAC7D,IAAMm3B,EAAWn3B,EAAM,GACvB,GAAIm3B,GAAYL,GAAOK,CAAQ,EAAG,OAAOA,CAC1C,CACA,GAAID,EAAM,SAAS,SAAS,GAAKA,EAAM,SAAS,QAAQ,EAAG,CAC1D,IAAME,EAASC,GAAWl8C,CAAI,EAC9B,GAAIi8C,EAAO,SAAW,GAAKA,EAAO,KAAO,QAAUA,EAAO,KAAO,QAAUA,EAAO,KAAO,QAAUA,EAAO,KAAO,QAAUA,EAAO,KAAO,QAAUA,EAAO,KAAO,QAAUA,EAAO,IAAMA,EAAO,GAAI,MAAO,GAAG,OAAO,SAASA,EAAO,EAAE,CAAC,UAAU,EAAG,CAAC,EAAG,EAAE,EAAE,GAAG,OAAO,SAASA,EAAO,EAAE,CAAC,UAAU,EAAG,CAAC,EAAG,EAAE,EAAE,GAAG,OAAO,SAASA,EAAO,EAAE,CAAC,UAAU,EAAG,CAAC,EAAG,EAAE,EAAE,GAAG,OAAO,SAASA,EAAO,EAAE,CAAC,UAAU,EAAG,CAAC,EAAG,EAAE,GACjZ,CACA,OAAO,IACR,CAKA,SAASC,GAAW,EAAM,CACzB,GAAIl8C,EAAK,SAAS,IAAI,EAAG,CACxB,IAAMm8C,EAAQn8C,EAAK,MAAM,IAAI,EACvBo8C,EAAOD,EAAM,GAAKA,EAAM,EAAE,CAAC,MAAM,GAAG,EAAI,CAAC,EACzCE,EAAQF,EAAM,GAAKA,EAAM,EAAE,CAAC,MAAM,GAAG,EAAI,CAAC,EAC1CG,EAAgB,EAAIF,EAAK,OAASC,EAAM,OACxCE,EAAQ,MAAMD,CAAa,CAAC,CAAC,KAAK,MAAM,EACxCE,EAAaJ,EAAK,IAAK,GAAM3rB,EAAE,SAAS,EAAG,GAAG,CAAC,EAC/CgsB,EAAcJ,EAAM,IAAK,GAAM5rB,EAAE,SAAS,EAAG,GAAG,CAAC,EACvD,MAAO,CACN,GAAG+rB,EACH,GAAGD,EACH,GAAGE,CACJ,CACD,CACA,OAAOz8C,EAAK,MAAM,GAAG,CAAC,CAAC,IAAK,GAAMywB,EAAE,SAAS,EAAG,GAAG,CAAC,CACrD,CAKA,SAASisB,GAAc,EAAM,EAAc,CAC1C,IAAMT,EAASC,GAAWl8C,CAAI,EAC9B,GAAI28C,IAAiB,IAAK,IAAKA,EAAe,IAAK,CAClD,IAAIC,EAAgB,KAAK,IAAI,EAAG,KAAK,MAAMD,CAAY,CAAC,EACxD,OAAOV,EAAO,IAAK,GAAU,CAC5B,GAAIW,GAAiB,EAAG,MAAO,OAC/B,GAAIA,GAAiB,GAEpB,MADA,IAAiB,GACVtgB,EAER,IAAMugB,EAAS,OAAO,SAASvgB,EAAO,EAAE,EAAK,OAAS,GAAKsgB,EAAgB,MAE3E,MADA,GAAgB,EACTC,EAAO,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAC3C,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,YAAY,CAC1B,CACA,OAAOZ,EAAO,KAAK,GAAG,CAAC,CAAC,YAAY,CACrC,CAoBA,SAASa,GAAY,EAAI,EAAU,CAAC,EAAG,CAEtC,GADInB,GAAOC,CAAE,GACT,CAACC,GAAOD,CAAE,EAAG,OAAOA,EAAG,YAAY,EACvC,IAAM37C,EAAO67C,GAAsBF,CAAE,EAErC,OADI37C,EAAaA,EAAK,YAAY,EAC3By8C,GAAcd,EAAI9vC,EAAQ,YAAc,EAAE,CAClD,CAIA,SAASixC,GAAU,EAAI,CACtB,GAAIpB,GAAOC,CAAE,EAAG,OAAO,WAAW,KAAKA,EAAG,MAAM,GAAG,CAAC,CAAC,IAAK,GAAU,OAAOoB,CAAK,CAAC,CAAC,EAClF,GAAI,CAACnB,GAAOD,CAAE,EAAG,OAAO,KACxB,IAAMqB,EAASnB,GAAsBF,CAAE,EACvC,GAAIqB,EAAQ,OAAO,WAAW,KAAKA,EAAO,MAAM,GAAG,CAAC,CAAC,IAAK,GAAU,OAAOD,CAAK,CAAC,CAAC,EAClF,IAAMf,EAASC,GAAWN,CAAE,EACtB3wC,EAAQ,IAAI,WAAW,EAAE,EAC/B,IAAK,IAAIhG,EAAI,EAAGA,EAAI,EAAG,IAAK,CAC3B,IAAMq3B,EAAQ,OAAO,SAAS2f,EAAOh3C,IAAM,IAAK,EAAE,EAClD,EAAMA,EAAI,GAAKq3B,GAAS,EAAI,IAC5B,EAAMr3B,EAAI,EAAI,GAAKq3B,EAAQ,GAC5B,CACA,OAAOrxB,CACR,CACA,IAAMiyC,GAAsB,QAO5B,SAASC,GAAU,EAAO,CACzB,IAAMC,EAAQ/4C,EAAM,YAAY,GAAG,EAC7B4G,EAAQ8xC,GAAUK,IAAU,GAAK/4C,EAAQA,EAAM,MAAM,EAAG+4C,CAAK,CAAC,EACpE,GAAI,CAACnyC,EAAO,OAAO,KACnB,IAAMoyC,EAAUpyC,EAAM,OAAS,EAC/B,GAAImyC,IAAU,GAAI,MAAO,CACxB,QACA,OAAQC,CACT,EACA,IAAMC,EAAaj5C,EAAM,MAAM+4C,EAAQ,CAAC,EACxC,GAAI,CAACF,GAAoB,KAAKI,CAAU,EAAG,OAAO,KAClD,IAAM1mB,EAAS,OAAO0mB,CAAU,EAChC,OAAO1mB,GAAUymB,EAAU,CAC1B,QACA,QACD,EAAI,IACL,CAIA,SAASE,GAAY,EAAS,EAAK,CAClC,GAAIC,EAAQ,SAAWC,EAAI,MAAM,OAAQ,MAAO,GAChD,IAAIb,EAAgBa,EAAI,OACxB,IAAK,IAAIx4C,EAAI,EAAGA,EAAIu4C,EAAQ,QAAUZ,EAAgB,EAAG,IAAK,CAC7D,IAAMv0C,EAAOu0C,GAAiB,EAAI,EAAIA,EAChClsB,EAAOroB,IAAS,EAAI,IAAM,KAAO,EAAIA,EAAO,IAClD,KAAMm1C,EAAQv4C,IAAM,GAAKyrB,OAAY+sB,EAAI,MAAMx4C,IAAM,GAAKyrB,GAAO,MAAO,GACxE,GAAiB,CAClB,CACA,MAAO,EACR,CAIA,SAASgtB,GAA0B,EAAS,CAC3C,OAAO35C,EAAQ,OAAQ,GAAUo5C,GAAUztC,CAAK,IAAM,IAAI,CAC3D,CAOA,SAASiuC,GAAgB,EAAO,EAAU,CAAC,EAAG,CAC7C,IAAMC,EAAev5C,EAAM,MAAM,GAAG,CAAC,CAAC,IAAK,GAAOu3C,EAAG,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,EAC3E,GAAIgC,EAAa,SAAW,EAAG,OAAO,KACtC,IAAMC,GAAkB/xC,EAAQ,gBAAkB,CAAC,EAAA,CAAG,IAAIqxC,EAAS,CAAC,CAAC,OAAQ,GACrEW,IAAU,IACjB,EACD,GAAID,EAAe,OAAS,EAAG,CAC9B,IAAK,IAAI54C,EAAI24C,EAAa,OAAS,EAAG34C,GAAK,EAAG,IAAK,CAClD,IAAM22C,EAAKgC,EAAa34C,GAClBu4C,EAAU5B,EAAKmB,GAAUnB,CAAE,EAAI,KACrC,GAAI,CAACA,GAAM,CAAC4B,EAAS,OAAO,KAC5B,GAAI,GAAe,KAAM,GAAUD,GAAYC,EAASM,CAAK,CAAC,EAC9D,OAAOhB,GAAYlB,EAAI,CAAE,WAAY9vC,EAAQ,UAAW,CAAC,CAC1D,CACA,OAAO,IACR,CACA,GAAI8xC,EAAa,SAAW,EAAG,OAAO,KACtC,IAAMG,EAAaH,EAAa,GAEhC,MADI,CAACG,GAAc,CAACrC,GAAUqC,CAAU,EAAU,KAC3CjB,GAAYiB,EAAY,CAAE,WAAYjyC,EAAQ,UAAW,CAAC,CAClE,CACA,IAAMkyC,GAAe,YACfC,GAAqB,CAAC,iBAAiB,EAO7C,SAASC,GAAM,EAAK,EAAS,CAC5B,GAAIpyC,EAAQ,UAAU,WAAW,kBAAmB,OAAO,KAC3D,IAAM4B,EAAU,YAAag0B,EAAMA,EAAI,QAAUA,EAC3Cyc,EAAYryC,EAAQ,UAAU,WAAW,kBAAoBmyC,GACnE,IAAK,IAAM75C,KAAO+5C,EAAW,CAC5B,IAAM95C,EAAQ,QAASqJ,EAAUA,EAAQ,IAAItJ,CAAG,EAAIsJ,EAAQtJ,GAC5D,GAAI,OAAOC,GAAU,SAAU,CAC9B,IAAMu3C,EAAK+B,GAAgBt5C,EAAO,CACjC,WAAYyH,EAAQ,UAAU,WAAW,WACzC,eAAgBA,EAAQ,UAAU,WAAW,cAC9C,CAAC,EACD,GAAI8vC,EAAI,OAAOA,CAChB,CACD,CAEA,OADIp6C,EAAO,GAAKgB,GAAc,EAAUw7C,GACjC,IACR,CASA,SAASI,GAAmB,EAAI,EAAM,CACrC,MAAO,GAAGxC,EAAG,GAAGtjB,GACjB,CClOA,IAAM18B,GAAqB,SAAY,CACtC,IAAM0iD,EAAmBv9C,EAAsB,EACzCshC,EAAWic,EAAiB,QAAQ,yBAC1C,GAAIjc,EAAU,OAAOA,EACrB,IAAM4U,EAAoB,MAAMJ,GAAqB,EAErD,MADA,GAAiB,QAAQ,2BAA6B,IAAII,EACnDqH,EAAiB,QAAQ,wBACjC,EAIA,eAAeC,IAAkB,CAChC,OAAQ,MAAM3iD,GAAmB,EAAA,CAAG,SAAS,IAAM,IAAK,EACzD,CACA,eAAe4iD,IAAyB,CACvC,IAAMC,GAAS,MAAM7iD,GAAmB,EAAA,CAAG,SAAS,EACpD,GAAI,CAAC6iD,EAAO,MAAU,MAAM,iHAAiH,EAC7I,OAAOA,CACR,CACA,eAAeC,GAAoB,EAAO,EAAI,CAC7C,OAAQ,MAAM9iD,GAAmB,EAAA,CAAG,IAAI6iD,EAAOlzB,CAAE,CAClD,CACA,SAASozB,GAAmB,EAAQ,CACnC,IAAMC,EAAM,OAAO,OAAO,CAAC,CAAC,EAC5B,MAAO,CACN,IAAI,KAAM,CACT,OAAOA,CACR,EACA,MAAM,KAAM,CACX,IAAMH,EAAQ,MAAMD,GAAuB,EAC3C,GAAI,CAACC,EAAM,IAAIG,CAAG,EAAG,CACpB,IAAMC,EAAe,MAAMC,EAAO,EAElC,OADAL,EAAM,IAAIG,EAAKC,CAAY,EACpBA,CACR,CACA,OAAOJ,EAAM,IAAIG,CAAG,CACrB,EACA,MAAM,IAAI,EAAO,EACf,MAAMJ,GAAuB,EAAA,CAAG,IAAII,EAAKv6C,CAAK,CAChD,CACD,CACD,CCvCA,IAAM06C,GAAqB,SAAY,CACtC,IAAMT,EAAmBv9C,EAAsB,EACzCshC,EAAWic,EAAiB,QAAQ,oBAC1C,GAAIjc,EAAU,OAAOA,EACrB,IAAM4U,EAAoB,MAAMJ,GAAqB,EAErD,MADA,GAAiB,QAAQ,sBAAwB,IAAII,EAC9CqH,EAAiB,QAAQ,mBACjC,EASMU,GAAoB,KAAO,IACzBD,GAAmB,CAAC,CAAC,KAAM,GAC1BE,EAAI,SAAS,CAAC,EAAE,SAAWC,CAClC,CAAC,CAAC,UACKA,CACP,EAEIC,GAAiB,MAAO,EAAS,IAAO,CAC7C,IAAIz0B,EAAS,GACb,OAAOq0B,GAAmB,CAAC,CAAC,KAAK,KAAO,IAAQ,CAC/C,EAAS,GACT,IAAMK,EAAe,CAAC,EAClB/hC,EACA7C,EACA6kC,EAAW,GACf,GAAI,CACH,EAAS,MAAMJ,EAAI,IAAI,CACtB,UACA,eACA,oBAAqB,EACtB,EAAG1zB,CAAE,CACN,OAAS1Q,EAAK,CACb,EAAQA,EACR,EAAW,EACZ,CACA,IAAK,IAAMykC,KAAQF,EAAc,MAAME,EAAK,EAC5C,GAAID,EAAU,MAAM7kC,EACpB,OAAO6C,CACR,CAAC,CAAC,CAAC,MAAO,GAAQ,CACjB,GAAI,CAACqN,EAAQ,OAAOa,EAAG,EACvB,MAAM1Q,CACP,CAAC,CACF,EAWM0kC,GAAqB,MAAO,EAAS,EAAI,IAAY,CAC1D,IAAI70B,EAAS,GACb,OAAOq0B,GAAmB,CAAC,CAAC,KAAK,KAAO,IAAQ,CAE/C,GADA,EAAS,GACLE,EAAI,SAAS,CAAC,EAAE,oBAAqB,OAAO1zB,EAAG,EACnD,IAAMi0B,EAAqBx8C,GAAsBy8C,CAAO,CAAC,GAAG,EACxDD,GAAoB,MAAMA,EAC9B,IAAIJ,EAAe,CAAC,EAChB/hC,EACA7C,EACA6kC,EAAW,GACf,GAAI,CACH,EAAS,MAAMI,EAAQ,YAAY,KAAO,KACzC,EAAe,CAAC,EACTR,EAAI,IAAI,CACd,QAASS,EACT,eACA,oBAAqB,EACtB,EAAGn0B,CAAE,EACL,CACF,OAAS,EAAG,CACX,EAAW,GACX,EAAQ,CACT,CACA,IAAMo0B,EAAkB,KAAO,IAAoB,CAClD,IAAK,IAAML,KAAQF,EAAc,GAAI,CACpC,MAAME,EAAK,CACZ,OAASM,EAAW,CACnB,GAAI,CAAC9zC,GAAS,uBAAwB,CACrC,GAAI+zC,IAAoB,QAAS,MAAMD,EACvC,GAAI,CACH98C,GAAO,MAAM,uEAAwE88C,CAAS,CAC/F,MAAQ,CAAC,CACT,QACD,CACA,GAAI,CACH,MAAM9zC,EAAQ,uBAAuB8zC,CAAS,CAC/C,MAAQ,CAAC,CACV,CACD,EACA,GAAIP,EAEH,MADII,EAAQ,SAAS,cAAc,cAAgB,IAAO,MAAME,EAAgB,KAAK,EAC/EnlC,EAGP,OADA,MAAMmlC,EAAgB,OAAO,EACtBtiC,CACR,CAAC,CAAC,CAAC,MAAO,GAAQ,CACjB,GAAI,CAACqN,EAAQ,OAAOa,EAAG,EACvB,MAAM1Q,CACP,CAAC,CACF,EAQMilC,GAA4B,MAAO,EAAM,IAAY,CAC1D,IAAMC,EAAc,SAAY,CAC/B,GAAI,CACH,MAAMT,EAAK,CACZ,OAAS9kC,EAAO,CACf,GAAI,CAAC1O,GAAS,QAAS,MAAM0O,EAC7B,MAAM1O,EAAQ,QAAQ0O,CAAK,CAC5B,CACD,EACIwlC,EACJ,GAAI,CACH,EAAU,MAAMjB,GAAmB,CACpC,MAAQ,CACP,OAAOgB,EAAY,CACpB,CACA,IAAMtB,EAAQuB,EAAQ,SAAS,EAC/B,GAAI,CAACvB,GAAO,oBAAqB,OAAOsB,EAAY,EACpDtB,EAAM,aAAa,KAAKsB,CAAW,CACpC,EC1IM,CAAE,IAAKE,GAAkB,IAAKC,IAAkBvB,OAAyB,IAAI,EAU7EwB,GAAgB,SACd,MAAMF,GAAiB,EAKzB,CAAE,IAAKG,GAAuB,IAAKC,IAA0B1B,OAAyB,IAAI,EAY1F2B,GAAwB,KAAO,IAAW,CAC/C,MAAMD,GAAsB,CAC3B,GAAG,MAAMD,GAAsB,GAAK,CAAC,EACrC,GAAGzR,CACJ,CAAC,CACF,ECzBM,CAAE,IAAK4R,GAA6B,IAAKC,IAAgC7B,OAAyB,EAAK,ECT7G,SAAS8B,GAAsB,EAAS,CACvC,MAAO,CAAC,CAAC30C,EAAQ,UAAY,CAAC,CAACA,EAAQ,gBACxC,CACA,SAAS40C,GAAsB,EAAS,CACvC,MAAO,CAAC,CAAC50C,EAAQ,QAClB,CACA,SAAS60C,GAAqC,EAAS,CACtD,OAAOD,GAAsB50C,CAAO,CACrC,CCPA,IAAM80C,GAAa/kD,EAAS,CAC3B,GAAIC,EAAS,EACb,UAAWC,EAAO,CAAC,CAAC,YAA8B,IAAI,IAAM,EAC5D,UAAWA,EAAO,CAAC,CAAC,YAA8B,IAAI,IAAM,CAC7D,CAAC,ECHK8kD,GAAgBD,GAAW,OAAO,CACvC,OAAQ5kD,GAAgB,EACxB,UAAWC,EAAO,EAClB,MAAOC,EAAS,EAChB,UAAWA,EAAS,CAAC,CAAC,QAAQ,EAC9B,UAAWA,EAAS,CAAC,CAAC,QAAQ,CAC/B,CAAC,ECNK4kD,GAAaF,GAAW,OAAO,CACpC,MAAOzkD,EAAS,CAAC,CAAC,UAAW,GAAQ86B,EAAI,YAAY,CAAC,EACtD,cAAe76B,EAAU,CAAC,CAAC,QAAQ,EAAK,EACxC,KAAMD,EAAS,EACf,MAAOA,EAAS,CAAC,CAAC,QAAQ,CAC3B,CAAC,ECHD,SAAS4kD,GAAmB,EAAM,EAAkB,CACnD,GAAI,CAAC94C,GAAQ,CAAC+4C,EAAkB,OAAO/4C,EACvC,IAAMg5C,EAAiB,OAAO,QAAQD,CAAgB,CAAC,CAAC,QAAQ,EAAG,CAAE,eAAgBE,IAAa,EAAK,CAAC,CAAC,KAAK,CAAC98C,KAASA,CAAG,EAC3H,OAAO,OAAO,QAAQ,gBAAgB6D,CAAI,CAAC,CAAC,CAAC,QAAQ,CAAC7D,KAAS,CAAC68C,EAAe,SAAS78C,CAAG,CAAC,CAAC,CAAC,QAAQ,EAAK,CAACA,EAAKC,MAAY,CAC5H,GAAGoG,GACFrG,GAAMC,CACR,GAAI,CAAC,CAAC,CACP,CCRA,IAAM2f,GAAwB,IAAI,QAClC,SAASm9B,GAAU,EAAS,EAAW,EAAM,CAC5C,IAAMzwC,EAAW,GAAG0wC,EAAU,GAAG7pC,IAC5ByM,GAAM,IAAIlY,CAAO,GAAGkY,GAAM,IAAIlY,EAAyB,IAAI,GAAK,EACrE,IAAMu1C,EAAar9B,GAAM,IAAIlY,CAAO,EACpC,GAAIu1C,EAAW,IAAI3wC,CAAQ,EAAG,OAAO2wC,EAAW,IAAI3wC,CAAQ,EAC5D,IAAMkwC,EAAarpC,IAAS,SAAWhV,GAAcuJ,CAAO,CAAC,CAACs1C,EAAU,EAAE,QAAU,CAAC,EAAI,CAAC,EACpFJ,EAAmBI,IAAc,QAAUA,IAAc,WAAaA,IAAc,UAAYt1C,EAAQs1C,EAAU,EAAE,iBAAmB,IAAK,GAC9ItgB,EAAS,CACZ,GAAG8f,EACH,GAAGI,GAAoB,CAAC,CACzB,EACA,IAAK,IAAMld,KAAUh4B,EAAQ,SAAW,CAAC,EAAOg4B,EAAO,QAAUA,EAAO,OAAOsd,KAAY,EAAS,CACnG,GAAGtgB,EACH,GAAGgD,EAAO,OAAOsd,EAAU,CAAC,MAC7B,GAEA,OADAC,EAAW,IAAI3wC,EAAUowB,CAAM,EACxBA,CACR,CACA,SAASwgB,GAAgB,EAAS,EAAM,CACvC,OAAOP,GAAmBQ,EAAMJ,GAAUr1C,EAAS,OAAQ,QAAQ,CAAC,CACrE,CAaA,SAAS01C,GAAyB,EAAS,EAAM,CAChD,IAAM1gB,EAASqgB,GAAUr1C,EAAS,OAAQ,QAAQ,EAC5CuR,EAAS,CAAC,EAChB,IAAK,IAAMjZ,KAAO08B,EAAQ,CACzB,IAAM2gB,EAAY3gB,EAAO18B,GACrBq9C,EAAU,WAAa,KACvBr9C,KAAO6D,GAAQA,EAAK7D,KAAS,IAAK,GAAG,EAAOA,GAAO6D,EAAK7D,GACnDq9C,EAAU,eAAiB,IAAK,GAC/BA,EAAU,WAAU,EAAOr9C,GAAO,MADA,EAAOA,GAAO,OAAOq9C,EAAU,cAAiB,WAAaA,EAAU,aAAa,EAAIA,EAAU,aAE/I,CAEA,MADI,OAAQx5C,IAAM,EAAO,GAAKA,EAAK,IAC5BoV,CACR,CACA,SAASqkC,GAAmB,EAAS,EAAS,CAC7C,OAAOX,GAAmBY,EAASR,GAAUr1C,EAAS,UAAW,QAAQ,CAAC,CAC3E,CACA,SAAS81C,GAAmB,EAAS,EAAS,CAC7C,GAAM,CAAE,YAAaC,EAAc,aAAcC,EAAe,QAASC,EAAU,qBAAsBC,EAAuB,sBAAuBC,EAAwB,SAAUC,EAAW,GAAGC,GAASpB,GAAmBqB,EAASjB,GAAUr1C,EAAS,UAAW,QAAQ,CAAC,EACnR,OAAOq2C,CACR,CACA,SAASE,GAAe,EAAM,EAAQ,CACrC,IAAMC,EAASxhB,EAAO,QAAU,SAC1BsS,EAAStS,EAAO,OAChByhB,EAAa,OAAO,OAAO,IAAI,EACrC,IAAK,IAAMn+C,KAAOgvC,EACjB,GAAIhvC,KAAO6D,EAAM,CAChB,GAAImrC,EAAOhvC,EAAI,CAAC,QAAU,GAAO,CAChC,GAAIgvC,EAAOhvC,EAAI,CAAC,eAAiB,IAAK,IACjCk+C,IAAW,SAAU,CACxB,EAAWl+C,GAAOgvC,EAAOhvC,EAAI,CAAC,aAC9B,QACD,CAED,GAAI6D,EAAK7D,GAAM,MAAM/H,EAAS,KAAK,cAAe,CACjD,GAAGylC,GAAiB,kBACpB,QAAS,GAAG19B,EAAI,0BACjB,CAAC,EACD,QACD,CACA,GAAIgvC,EAAOhvC,EAAI,CAAC,WAAW,OAAS6D,EAAK7D,KAAS,IAAK,GAAG,CACzD,IAAMiZ,EAAS+1B,EAAOhvC,EAAI,CAAC,UAAU,MAAM,YAAY,CAAC,SAAS6D,EAAK7D,EAAI,EAC1E,GAAIiZ,aAAkB,QAAS,MAAMhhB,EAAS,KAAK,wBAAyBylC,GAAiB,8BAA8B,EAC3H,GAAI,WAAYzkB,GAAUA,EAAO,OAAQ,MAAMhhB,EAAS,KAAK,cAAe,CAC3E,GAAGylC,GAAiB,iBACpB,QAASzkB,EAAO,OAAO,EAAE,EAAE,SAAW,kBACvC,CAAC,EACD,EAAWjZ,GAAOiZ,EAAO,MACzB,QACD,CACA,GAAI+1B,EAAOhvC,EAAI,CAAC,WAAW,OAAS6D,EAAK7D,KAAS,IAAK,GAAG,CACzD,EAAWA,GAAOgvC,EAAOhvC,EAAI,CAAC,WAAW,MAAM6D,EAAK7D,EAAI,EACxD,QACD,CACA,EAAWA,GAAO6D,EAAK7D,EAExB,MACA,GAAIgvC,EAAOhvC,EAAI,CAAC,eAAiB,IAAK,IAAKk+C,IAAW,SAAU,CAC/D,GAAI,OAAOlP,EAAOhvC,EAAI,CAAC,cAAiB,WAAY,CACnD,EAAWA,GAAOgvC,EAAOhvC,EAAI,CAAC,aAAa,EAC3C,QACD,CACA,EAAWA,GAAOgvC,EAAOhvC,EAAI,CAAC,YAE/B,MACA,GAAIgvC,EAAOhvC,EAAI,CAAC,UAAYk+C,IAAW,SAAU,MAAMjmD,EAAS,KAAK,cAAe,CACnF,GAAGylC,GAAiB,cACpB,QAAS,GAAG19B,EAAI,aACjB,CAAC,EAEF,OAAOm+C,CACR,CACA,SAASC,GAAe,EAAS,EAAO,CAAC,EAAG,EAAQ,CACnD,OAAOH,GAAed,EAAM,CAC3B,OAAQJ,GAAUr1C,EAAS,OAAQ,OAAO,EAC1C,QACD,CAAC,CACF,CACA,SAAS22C,GAA4C,EAAS,EAAU,CAAC,EAAG,EAAQ,CACnF,IAAM3hB,EAASqgB,GAAUr1C,EAAS,OAAQ,OAAO,EAC3C42C,EAAuB,OAAO,OAAO,IAAI,EAC/C,IAAK,IAAMt+C,KAAO,OAAO,KAAKu+C,CAAO,EAChC7hB,EAAO18B,EAAI,EAAE,QAAU,KAC3B,EAAqBA,GAAOu+C,EAAQv+C,IAErC,OAAOi+C,GAAeK,EAAsB,CAC3C,OAAQ5hB,EACR,QACD,CAAC,CACF,CAQA,SAAS8hB,GAAkB,EAAS,EAAS,EAAQ,CACpD,OAAOP,GAAeV,EAAS,CAC9B,OAAQR,GAAUr1C,EAAS,UAAW,OAAO,EAC7C,QACD,CAAC,CACF,CACA,SAAS+2C,GAAwB,EAAS,CACzC,IAAMzP,EAAS+N,GAAUr1C,EAAS,UAAW,OAAO,EAC9Csd,EAAW,CAAC,EAClB,IAAK,IAAMhlB,KAAOgvC,EAAYA,EAAOhvC,EAAI,CAAC,eAAiB,IAAK,KAAG,EAASA,GAAO,OAAOgvC,EAAOhvC,EAAI,CAAC,cAAiB,WAAagvC,EAAOhvC,EAAI,CAAC,aAAa,EAAIgvC,EAAOhvC,EAAI,CAAC,cAC7K,OAAOglB,CACR,CACA,SAAS05B,GAAY,EAAQ,EAAW,CACvC,GAAI,CAACC,EAAW,OAAOjiB,EACvB,IAAK,IAAM/sB,KAASgvC,EAAW,CAC9B,IAAMC,EAAeD,EAAUhvC,EAAM,EAAE,UACnCivC,IAAc,EAAOjvC,EAAM,CAAC,UAAYivC,GAC5C,IAAK,IAAM9X,KAASpK,EAAO/sB,EAAM,CAAC,OAAQ,CACzC,IAAMkvC,EAAWF,EAAUhvC,EAAM,EAAE,SAASm3B,GACvC+X,IACL,EAAOlvC,EAAM,CAAC,OAAOm3B,EAAM,CAAC,UAAY+X,EACzC,CACD,CACA,OAAOniB,CACR,CC7JA,IAAMoB,IAAW,EAAM,EAAO,OACtB,IAAI,KAAK,KAAK,IAAI,GAAKghB,IAAS,MAAQC,EAAO,IAAMA,EAAK,ECDlE,SAASC,GAAU,EAAK,CACvB,GAAIrlC,EAAI,QAAQ,GAAG,IAAM,GAAI,OAAOA,EACpC,GAAI,CACH,OAAO,mBAAmBA,CAAG,CAC9B,MAAQ,CACP,OAAOA,CACR,CACD,CACA,IAAMslC,GAAuB,YAa7B,SAASC,GAAqB,EAAW,CACxC,GAAI,CAACC,EAAW,MAAO,CAAC,EACxB,IAAMlmC,EAAS,CAAC,EACZkjB,EAAQ,EACRt7B,EAAI,EACR,KAAOA,EAAIs+C,EAAU,QAAQ,CAC5B,GAAIA,EAAUt+C,KAAO,IAAK,CACzB,IAAI8nB,EAAI9nB,EAAI,EACZ,KAAO8nB,EAAIw2B,EAAU,QAAUA,EAAUx2B,KAAO,KAAK,IACrD,KAAOA,EAAIw2B,EAAU,QAAUA,EAAUx2B,KAAO,KAAOw2B,EAAUx2B,KAAO,KAAOw2B,EAAUx2B,KAAO,KAAK,IACrG,GAAIA,EAAIw2B,EAAU,QAAUA,EAAUx2B,KAAO,IAAK,CACjD,IAAMyX,EAAO+e,EAAU,MAAMhjB,EAAOt7B,CAAC,CAAC,CAAC,KAAK,EAG5C,IAFIu/B,GAAMnnB,EAAO,KAAKmnB,CAAI,EAC1B,EAAQv/B,EAAI,EACLs7B,EAAQgjB,EAAU,QAAUA,EAAUhjB,KAAW,KAAK,IAC7D,EAAIA,EACJ,QACD,CACD,CACA,GACD,CACA,IAAMnvB,EAAOmyC,EAAU,MAAMhjB,CAAK,CAAC,CAAC,KAAK,EAEzC,OADInvB,GAAMiM,EAAO,KAAKjM,CAAI,EACnBiM,CACR,CACA,SAASmmC,GAAqB,EAAW,CACxC,IAAM1sB,EAA0B,IAAI,IA2CpC,OA1CAwsB,GAAqBC,CAAS,CAAC,CAAC,QAAS,GAAiB,CACzD,GAAM,CAACE,EAAW,GAAGC,GAAcC,EAAa,MAAM,GAAG,CAAC,CAAC,IAAK,GAASnf,EAAK,KAAK,CAAC,EAC9E,CAACjhC,EAAM,GAAGqgD,IAAeH,GAAa,GAAA,CAAI,MAAM,GAAG,EACnDp/C,EAAQw/C,GAAmBD,EAAW,KAAK,GAAG,CAAC,EACrD,GAAI,CAACrgD,EAAM,OACX,IAAMugD,EAAU,CAAE,MAAOV,GAAU/+C,CAAK,CAAE,EAC1Cq/C,EAAW,QAAS,GAAc,CACjC,GAAM,CAACK,EAAU,GAAGC,GAAkBC,EAAU,MAAM,GAAG,EACnDC,EAAYF,EAAe,KAAK,GAAG,EACnCG,EAAqBJ,EAAS,KAAK,CAAC,CAAC,YAAY,EACvD,OAAQI,EAAR,CACC,IAAK,UACJ,EAAQ,WAAaD,EAAY,SAASA,EAAU,KAAK,EAAG,EAAE,EAAI,IAAK,GACvE,MACD,IAAK,UACJ,EAAQ,QAAUA,EAAY,IAAI,KAAKA,EAAU,KAAK,CAAC,EAAI,IAAK,GAChE,MACD,IAAK,SACJ,EAAQ,OAASA,EAAYA,EAAU,KAAK,EAAI,IAAK,GACrD,MACD,IAAK,OACJ,EAAQ,KAAOA,EAAYA,EAAU,KAAK,EAAI,IAAK,GACnD,MACD,IAAK,SACJ,EAAQ,OAAS,GACjB,MACD,IAAK,WACJ,EAAQ,SAAW,GACnB,MACD,IAAK,WACJ,EAAQ,SAAWA,EAAYA,EAAU,KAAK,CAAC,CAAC,YAAY,EAAI,IAAK,GACrE,MACD,IAAK,cACJ,EAAQ,YAAc,GACtB,MACD,QACC,EAAQC,GAAsB,IAAYD,EAAU,KAAK,CAE3D,CACD,CAAC,EACDptB,EAAQ,IAAIvzB,EAAMugD,CAAO,CAC1B,CAAC,EACMhtB,CACR,CAkBA,IAAMstB,GAAkB,oFAOlBC,GAAmB,2CAMzB,SAASR,GAAmB,EAAO,CAElC,OADIx/C,EAAM,OAAS,GAAK,CAACA,EAAM,WAAW,GAAI,GAAK,CAACA,EAAM,SAAS,GAAI,EAAUA,EAC1EA,EAAM,MAAM,EAAG,EAAE,CACzB,CAQA,SAASigD,GAAQ,EAAG,CACnB,IAAI/jB,EAAQ,EACR6Y,EAAM3qC,EAAE,OACZ,KAAO8xB,EAAQ6Y,GAAK,CACnB,IAAMvxC,EAAI4G,EAAE,WAAW8xB,CAAK,EAC5B,GAAI14B,IAAM,IAAMA,IAAM,EAAG,MACzB,GACD,CACA,KAAOuxC,EAAM7Y,GAAO,CACnB,IAAM14B,EAAI4G,EAAE,WAAW2qC,EAAM,CAAC,EAC9B,GAAIvxC,IAAM,IAAMA,IAAM,EAAG,MACzB,GACD,CACA,OAAO04B,IAAU,GAAK6Y,IAAQ3qC,EAAE,OAASA,EAAIA,EAAE,MAAM8xB,EAAO6Y,CAAG,CAChE,CAQA,SAASmL,GAAa,EAAQ,CAC7B,IAAMC,EAA4B,IAAI,IACtC,GAAIjtB,EAAO,OAAS,EAAG,OAAOitB,EAC9B,IAAK,IAAMC,KAASltB,EAAO,MAAM,GAAG,EAAG,CACtC,IAAMmtB,EAAKD,EAAM,QAAQ,GAAG,EAC5B,GAAIC,IAAO,GAAI,SACf,IAAMtgD,EAAMkgD,GAAQG,EAAM,MAAM,EAAGC,CAAE,CAAC,EAChCztB,EAAM4sB,GAAmBS,GAAQG,EAAM,MAAMC,EAAK,CAAC,CAAC,CAAC,EACvDN,GAAgB,KAAKhgD,CAAG,GAAKigD,GAAiB,KAAKptB,CAAG,GAAGutB,EAAU,IAAIpgD,EAAKg/C,GAAUnsB,CAAG,CAAC,CAC/F,CACA,OAAOutB,CACR,CCzJA,IAAMG,GAAkB,KAKlBC,GAAoB,IAM1B,SAASC,GAAsB,EAAM,EAAS,CAC7C,OAAOF,GAAkBntB,GAAgBj0B,EAAM,GAAI,CAAE,GAAGuI,CAAQ,CAAC,CAAC,CAAC,MACpE,CACA,SAASg5C,GAAsB,EAAY,EAAM,CAChD,IAAMluB,EAAS,GAAGmuB,EAAW,GAC7B,GAAI,CAACxhD,EAAK,WAAWqzB,CAAM,EAAG,OAAO,KACrC,IAAMouB,EAASzhD,EAAK,MAAMqzB,EAAO,MAAM,EACjChT,EAAQ,OAAOohC,CAAM,EAE3B,MADI,CAAC,OAAO,cAAcphC,CAAK,GAAKA,EAAQ,GAAK,OAAOA,CAAK,IAAMohC,EAAe,KAC3EphC,CACR,CAIA,SAASqhC,GAAmB,EAAY,EAAK,CAC5C,IAAMhsC,EAAS,CAAC,EACV6d,EAAUytB,GAAajmB,EAAI,SAAS,IAAI,QAAQ,GAAK,EAAE,EAC7D,IAAK,GAAM,CAAC/6B,EAAMc,KAAUyyB,GACvBvzB,IAASwhD,GAAcD,GAAsBC,EAAYxhD,CAAI,IAAM,QACvE,EAAOA,GAAQc,GAEhB,OAAO4U,CACR,CAIA,SAASisC,GAAY,EAAW,EAAQ,EAAQ,EAAQ,CACvD,IAAMC,EAAYN,GAAsB,GAAGttB,EAAO,KAAK,KAA4BA,EAAO,UAAU,EAC9F6tB,EAAaD,EAAY,EAAI,KAAK,KAAK5tB,EAAO,MAAM,OAAS4tB,CAAS,EAAI,IAChF,GAAIC,GAAc,EAEjB,MADA,GAAO7tB,EAAO,MAAQA,EAAO,MACtB,CAACA,CAAM,EAEf,GAAI6tB,EAAaR,GAEhB,OADA9hD,EAAO,KAAK,GAAGuiD,EAAU,uJAAuJ,EACzK,CAAC,EAET,IAAMvuB,EAAU,CAAC,EACjB,IAAK,IAAI7xB,EAAI,EAAGA,EAAImgD,EAAY,IAAK,CACpC,IAAM7hD,EAAO,GAAGg0B,EAAO,KAAK,GAAGtyB,IACzBs7B,EAAQt7B,EAAIkgD,EACZ9gD,EAAQkzB,EAAO,MAAM,UAAUgJ,EAAOA,EAAQ4kB,CAAS,EAC7DruB,EAAQ,KAAK,CACZ,GAAGS,EACH,OACA,OACD,CAAC,EACD,EAAOh0B,GAAQc,CAChB,CAOA,OANAvB,EAAO,MAAM,YAAYuiD,EAAU,YAAY,EAAE,SAAU,CAC1D,QAAS,GAAGA,EAAU,sBAAsBV,GAAgB,iCAAiCS,EAAW,UACxG,UAAW7tB,EAAO,MAAM,OACxB,aACA,WAAYT,EAAQ,IAAK,GAAMjvB,EAAE,MAAM,MAAM,CAC9C,CAAC,EACMivB,CACR,CAIA,SAASwuB,GAAgB,EAAQ,EAAe,CAC/C,IAAMC,EAAgB,CAAC,EACvB,IAAK,IAAMhiD,KAAQ0V,EAAQ,EAAc1V,GAAQ,CAChD,OACA,MAAO,GACP,WAAY,CACX,GAAGiiD,EACH,OAAQ,CACT,CACD,EACA,OAAOD,CACR,CAOA,IAAME,GAAgB,IAAe,EAAY,EAAe,IAAQ,CACvE,IAAMxsC,EAASgsC,GAAmBF,EAAYzmB,CAAG,EAC3Cx7B,EAASw7B,EAAI,QAAQ,OACrBonB,MAA6B,CAClC,IAAMC,EAAUL,GAAgBrsC,EAAQusC,CAAa,EACrD,IAAK,IAAMjiD,KAAQ0V,EAAQ,OAAOA,EAAO1V,GACzC,OAAOoiD,CACR,EACA,MAAO,CACN,MAAM,EAAO,EAAS,CACrB,IAAM7uB,EAAU4uB,EAAqB,EAC/BE,EAAUV,GAAYG,EAAW,CACtC,KAAMN,EACN,QACA,WAAY,CACX,GAAGS,EACH,GAAG15C,CACJ,CACD,EAAGmN,EAAQnW,CAAM,EACjB,IAAK,IAAM2hD,KAASmB,EAAS,EAAQnB,EAAM,MAAQA,EACnD,OAAO,OAAO,OAAO3tB,CAAO,CAC7B,EACA,OAAQ,CACP,OAAO,OAAO,OAAO4uB,EAAqB,CAAC,CAC5C,EACA,WAAW,EAAS,CACnB,IAAK,IAAMnuB,KAAUT,EAASwH,EAAI,UAAU/G,EAAO,KAAMA,EAAO,MAAOA,EAAO,UAAU,CACzF,CACD,CACD,EACMsuB,GAAqBJ,GAAa,SAAS,EAC3CK,GAAqBL,GAAa,SAAS,EACjD,SAASM,GAAiB,EAAK,EAAY,CAC1C,IAAM1hD,EAAQi6B,EAAI,UAAUymB,CAAU,EACtC,GAAI1gD,EAAO,OAAOA,EAClB,IAAM4U,EAAS,CAAC,EACV+sC,EAAe1nB,EAAI,SAAS,IAAI,QAAQ,EAC9C,GAAI,CAAC0nB,EAAc,OAAO,KAC1B,IAAK,GAAM,CAACziD,EAAM0zB,KAAQstB,GAAayB,CAAY,EAAG,CACrD,IAAMpiC,EAAQkhC,GAAsBC,EAAYxhD,CAAI,EAChDqgB,IAAU,MACd3K,EAAO,KAAK,CACX,QACA,MAAOge,CACR,CAAC,CACF,CAKA,OAJIhe,EAAO,OAAS,GACnBA,EAAO,MAAM,EAAG,IAAMtR,EAAE,MAAQC,EAAE,KAAK,EAChCqR,EAAO,IAAK,GAAMpR,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,GAEnC,IACR,CACA,eAAeo+C,GAAiB,EAAG,EAAa,CAC/C,IAAMC,EAAoBr+C,EAAE,QAAQ,YAAY,YAC1CiE,EAAU,CACf,OAAQ,IACR,GAAGo6C,EAAkB,UACtB,EACMj+C,EAAO,MAAMwd,GAAmB0gC,EAAat+C,EAAE,QAAQ,aAAc,sBAAuBiE,EAAQ,MAAM,EAC1Gs6C,EAAeN,GAAmBI,EAAkB,KAAMp6C,EAASjE,CAAC,EAC1Eu+C,EAAa,WAAWA,EAAa,MAAMn+C,EAAM6D,CAAO,CAAC,CAC1D,CACA,eAAeu6C,GAAiB,EAAG,CAClC,IAAMC,EAAgBP,GAAiBl+C,EAAGA,EAAE,QAAQ,YAAY,YAAY,IAAI,EAChF,GAAIy+C,EAAe,CAClB,IAAMH,EAAc7jD,GAAc,MAAMujB,GAAmBygC,EAAez+C,EAAE,QAAQ,aAAc,qBAAqB,CAAC,EACxH,GAAIs+C,EAAa,OAAOA,CACzB,CACA,OAAO,IACR,CACA,IAAMI,GAAwBjqD,EAAWC,EAAS,CAKjD,mBAAoBC,GAAiB,CAAC,CAAC,KAAK,CAAE,YAAa,sDAAuD,CAAC,CAAC,CAAC,SAAS,EAC9H,eAAgBA,GAAiB,CAAC,CAAC,KAAK,CAAE,YAAa,2FAA4F,CAAC,CAAC,CAAC,SAAS,CAChK,CAAC,CAAC,ECnLF,SAASgqD,GAAU,EAAK,CACvB,MAAO,CAAC,CAAC/vB,IAAQ,OAAOA,GAAQ,UAAY,OAAOA,GAAQ,aAAe,OAAOA,EAAI,MAAS,UAC/F,CCFA,IAAMgwB,GAAM,IACNC,GAAMD,GAAM,GACZE,GAAOD,GAAM,GACbE,GAAMD,GAAO,GACbE,GAAOD,GAAM,EACbE,GAAQF,GAAM,GACdG,GAAOH,GAAM,OACbI,GAAQ,+IACd,SAASC,GAAM,EAAO,CACrB,IAAMhpB,EAAQ+oB,GAAM,KAAK3iD,CAAK,EAC9B,GAAI,CAAC45B,GAASA,EAAM,IAAMA,EAAM,GAAI,MAAU,UAAU,gCAAgC55B,EAAM,gDAAgD,EAC9I,IAAM,EAAI,WAAW45B,EAAM,EAAE,EACvBilB,EAAOjlB,EAAM,EAAE,CAAC,YAAY,EAC9B5gB,EACJ,OAAQ6lC,EAAR,CACC,IAAK,QACL,IAAK,OACL,IAAK,MACL,IAAK,KACL,IAAK,IACJ,EAAS,EAAI6D,GACb,MACD,IAAK,SACL,IAAK,QACL,IAAK,KACJ,EAAS,EAAID,GACb,MACD,IAAK,QACL,IAAK,OACL,IAAK,IACJ,EAAS,EAAID,GACb,MACD,IAAK,OACL,IAAK,MACL,IAAK,IACJ,EAAS,EAAID,GACb,MACD,IAAK,QACL,IAAK,OACL,IAAK,MACL,IAAK,KACL,IAAK,IACJ,EAAS,EAAID,GACb,MACD,IAAK,UACL,IAAK,SACL,IAAK,OACL,IAAK,MACL,IAAK,IACJ,EAAS,EAAID,GACb,MACD,IAAK,UACL,IAAK,SACL,IAAK,OACL,IAAK,MACL,IAAK,IACJ,EAAS,EAAID,GACb,MACD,QAAS,MAAU,UAAU,uBAAuBvD,EAAK,EAAE,CAC5D,CAEA,OADIjlB,EAAM,KAAO,KAAOA,EAAM,KAAO,MAAc,CAAC5gB,EAC7CA,CACR,CAcA,SAAS6pC,GAAG,EAAO,CAClB,OAAOD,GAAM5iD,CAAK,CACnB,CAcA,SAAS8iD,GAAI,EAAO,CACnB,OAAO,KAAK,MAAMF,GAAM5iD,CAAK,EAAI,GAAG,CACrC,CC1FA,IAAM+iD,GAA2B3qD,EAAc,CAC9C,QAASokD,GAAc,MAAM,EAC7B,KAAMC,GAAW,MAAM,EACvB,UAAWpkD,EAAS,EACpB,QAASC,EAAS,CAAC,CAAC,SAAS,CAC9B,CAAC,EACK0qD,GAA2BzqD,EAAS,CACzC,QAASC,EAASF,EAAS,EAAGG,EAAU,CAAC,EACzC,UAAWJ,EAAS,EACpB,UAAWC,EAAS,CACrB,CAAC,EACD,SAAS2qD,GAAwB,EAAO,CACvC,IAAMn5C,EAAS7L,GAAc+B,CAAK,EAClC,GAAI8J,IAAW,KAAM,OAAO,KAC5B,IAAMkP,EAAS+pC,GAAyB,UAAUj5C,CAAM,EAMxD,OALIkP,EAAO,QAAgBA,EAAO,MAClCva,GAAO,KAAK,gDAAiD,CAAE,OAAQua,EAAO,MAAM,OAAO,KAAK,CAAE,OAAM,WAAY,CACnH,OACA,MACD,EAAE,CAAE,CAAC,EACE,KACR,CACA,SAASkqC,GAAwB,EAAO,CACvC,IAAMlqC,EAASgqC,GAAyB,UAAUhjD,CAAK,EACvD,OAAOgZ,EAAO,QAAUA,EAAO,KAAO,IACvC,CC7BA,IAAMmqC,GAA2B,IAAI,IAC/BC,GAAU,IAAI,YACdh8C,GAAS,CACd,QAAS,EAAM,EAAW,WACpB+7C,GAAS,IAAIhhC,CAAQ,GAAGghC,GAAS,IAAIhhC,EAAU,IAAI,YAAYA,CAAQ,CAAC,EACtEghC,GAAS,IAAIhhC,CAAQ,CAAC,CAAC,OAAOve,CAAI,GAE1C,OAAS,GAAUw/C,GAAQ,OAAOr8C,CAAK,CACxC,ECJMs8C,IAAc,EAAY,UAAW,EAAW,SAAW,CAChE,IAAMxrC,EAAO,CACZ,UAAW,MAAO,EAAK,IACfkK,GAAmB,CAAC,CAAC,UAAU,MAAOtlB,EAAesD,CAAG,EAAG,CACjE,KAAM,OACN,KAAM,CAAE,KAAMwH,CAAU,CACzB,EAAG,GAAO,CAAC+7C,CAAQ,CAAC,EAErB,KAAM,MAAO,EAAS,IAAS,CAC1B,OAAOC,GAAY,WAAU,EAAU,MAAM1rC,EAAK,UAAU0rC,EAAS,MAAM,GAC/E,IAAMzqC,EAAY,MAAMiJ,GAAmB,CAAC,CAAC,KAAK,OAAQwhC,EAAS9mD,EAAemH,CAAI,CAAC,EAIvF,OAHIue,IAAa,MAAc7jB,GAAI,OAAOwa,CAAS,EAC/CqJ,IAAa,SAAiB5kB,GAAO,OAAOub,CAAS,EACrDqJ,IAAa,aAAeA,IAAa,iBAAyBzjB,GAAU,OAAOoa,EAAW,CAAE,QAASqJ,IAAa,gBAAiB,CAAC,EACrIrJ,CACR,EACA,OAAQ,MAAO,EAAS,EAAM,KACzB,OAAOyqC,GAAY,WAAU,EAAU,MAAM1rC,EAAK,UAAU0rC,EAAS,QAAQ,GAC7EphC,IAAa,QAAO,EAAY,OAAOrJ,GAAc,SAAWxa,GAAI,QAAQwa,CAAS,EAAIA,IACzFqJ,IAAa,UAAYA,IAAa,aAAeA,IAAa,oBAAkB,EAAY,MAAM5kB,GAAO,OAAOub,CAAS,GAC1HiJ,GAAmB,CAAC,CAAC,OAAO,OAAQwhC,EAAS9mD,EAAeqc,CAAS,EAAGrc,EAAemH,CAAI,CAAC,EAErG,EACA,OAAOiU,CACR,ECVA,SAAS2rC,GAAmB,EAAS,CACpC,IAAMC,EAAgB,OAAOh8C,EAAQ,SAAY,SAAWA,EAAQ,QAAU,IAAK,GAC7Ei8C,EAAkB,OAAOj8C,EAAQ,SAAY,UAAYA,EAAQ,UAAY,KAAOA,EAAQ,QAAQ,SAAW,IAAK,GACpHk8C,GAAsBl8C,EAAQ,UAAU,mBAAqB,IAAK,GAAyCi8C,IAAoB,SAAiBA,IAAoB,SAAiBD,EAAgBA,EAAc,WAAW,UAAU,EAAIvmD,GAAtKuK,EAAQ,UAAU,kBAAoKu3C,GAAuB,GACnR4E,EAAwB,CAAC,CAACn8C,EAAQ,UAAU,uBAAuB,QACnEo8C,EAASD,EAAwBn8C,EAAQ,UAAU,uBAAuB,SAAWg8C,EAAgB,IAAI,IAAIA,CAAa,CAAC,CAAC,SAAW,IAAK,IAAK,IAAK,GAC5J,GAAIG,GAAyB,CAACC,GAAU,CAAC9N,GAAuBtuC,EAAQ,OAAO,EAAG,MAAM,IAAIlJ,EAAgB,6DAA6D,EACzK,SAASulD,EAAa,EAAY,EAAqB,CAAC,EAAG,CAC1D,IAAMvxB,EAAS9qB,EAAQ,UAAU,cAAgB,cAC3CvI,EAAOuI,EAAQ,UAAU,UAAUi5C,EAAW,EAAE,MAAQ,GAAGnuB,EAAO,GAAGmuB,IACrErB,EAAa53C,EAAQ,UAAU,UAAUi5C,EAAW,EAAE,YAAc,CAAC,EAC3E,MAAO,CACN,KAAM,GAAGiD,IAAqBzkD,IAC9B,WAAY,CACX,OAAQ,CAAC,CAACykD,EACV,SAAU,MACV,KAAM,IACN,SAAU,GACV,GAAGC,EAAwB,CAAE,QAAO,EAAI,CAAC,EACzC,GAAGn8C,EAAQ,UAAU,wBACrB,GAAGs8C,EACH,GAAG1E,CACJ,CACD,CACD,CACA,OAAOyE,CACR,CACA,SAASE,GAAW,EAAS,CAC5B,IAAMF,EAAeN,GAAmB/7C,CAAO,EACzCw8C,EAAeH,EAAa,gBAAiB,CAAE,OAAQr8C,EAAQ,SAAS,WAAaq7C,GAAI,IAAI,CAAE,CAAC,EAChGoB,EAAcJ,EAAa,eAAgB,CAAE,OAAQr8C,EAAQ,SAAS,aAAa,QAAU,GAAI,CAAC,EAClGq6C,EAAcgC,EAAa,eAAgB,CAAE,OAAQr8C,EAAQ,SAAS,aAAa,QAAU,GAAI,CAAC,EAClG08C,EAAoBL,EAAa,eAAe,EACtD,MAAO,CACN,aAAc,CACb,KAAMG,EAAa,KACnB,WAAYA,EAAa,UAC1B,EAKA,YAAa,CACZ,KAAMC,EAAY,KAClB,WAAYA,EAAY,UACzB,EACA,kBAAmB,CAClB,KAAMC,EAAkB,KACxB,WAAYA,EAAkB,UAC/B,EACA,YAAa,CACZ,KAAMrC,EAAY,KAClB,WAAYA,EAAY,UACzB,CACD,CACD,CACA,eAAesC,GAAe,EAAK,EAAS,EAAgB,CAC3D,GAAI,CAACnqB,EAAI,QAAQ,QAAQ,SAAS,aAAa,QAAS,OACxD,IAAMoqB,EAAkB3H,GAAmBY,EAAQ,QAASrjB,EAAI,QAAQ,QAAQ,SAAS,gBAAgB,EACnGqqB,EAAerH,GAAgBhjB,EAAI,QAAQ,QAASqjB,EAAQ,IAAI,EAChEiH,EAAgBtqB,EAAI,QAAQ,QAAQ,SAAS,aAAa,QAC5D9Y,EAAU,IACd,GAAIojC,EAAe,CAClB,GAAI,OAAOA,GAAkB,SAAU,EAAUA,OAC5C,GAAI,OAAOA,GAAkB,WAAY,CAC7C,IAAMvrC,EAASurC,EAAcjH,EAAQ,QAASA,EAAQ,IAAI,EAC1D,EAAU6E,GAAUnpC,CAAM,EAAI,MAAMA,EAASA,CAC9C,CACD,CACA,IAAMkrC,EAAc,CACnB,QAASG,EACT,KAAMC,EACN,UAAW,KAAK,IAAI,EACpB,SACD,EACM78C,EAAU,CACf,GAAGwyB,EAAI,QAAQ,YAAY,YAAY,WACvC,OAAQuqB,EAAiB,IAAK,GAAIvqB,EAAI,QAAQ,YAAY,YAAY,WAAW,MAClF,EACMwqB,EAAgB5mB,GAAQp2B,EAAQ,QAAU,GAAI,KAAK,CAAC,CAAC,QAAQ,EAC7DsiC,EAAW9P,EAAI,QAAQ,QAAQ,SAAS,aAAa,UAAY,UACnEr2B,EACJ,GAAImmC,IAAa,MAAO,EAAO,MAAM3oB,GAAmB8iC,EAAajqB,EAAI,QAAQ,aAAc,sBAAuBxyB,EAAQ,QAAU,GAAG,OACtI,GAAIsiC,IAAa,MAAO,CAC5B,IAAM2a,EAAoBzqB,EAAI,QAAQ,cAAc,kBACpD,EAAOyqB,EAAoB,MAAMA,EAAkB,KAAKzqB,EAAKiqB,EAAaz8C,EAAQ,QAAU,GAAG,EAAI,MAAM/O,GAAQwrD,EAAajqB,EAAI,QAAQ,OAAQxyB,EAAQ,QAAU,GAAG,CACxK,KAAO,GAAO/I,GAAU,OAAO,KAAK,UAAU,CAC7C,QAASwlD,EACT,UAAWO,EACX,UAAW,MAAMpB,GAAW,UAAW,gBAAgB,CAAC,CAAC,KAAKppB,EAAI,QAAQ,OAAQ,KAAK,UAAU,CAChG,GAAGiqB,EACH,UAAWO,CACZ,CAAC,CAAC,CACH,CAAC,EAAG,CAAE,QAAS,EAAM,CAAC,EACtB,IAAME,EAAenD,GAAmBvnB,EAAI,QAAQ,YAAY,YAAY,KAAMxyB,EAASwyB,CAAG,EAE9F,GADA0qB,EAAa,WAAWA,EAAa,MAAM/gD,EAAM6D,CAAO,CAAC,EACrDwyB,EAAI,QAAQ,QAAQ,SAAS,oBAAsB,CAAC2qB,GAAoB3qB,EAAKA,EAAI,QAAQ,YAAY,YAAY,IAAI,EAAG,CAC3H,IAAM6nB,EAAc,MAAME,GAAiB/nB,CAAG,EAC9C,GAAI6nB,EAAa,IAAI,CAACxF,GAAqCriB,EAAI,QAAQ,OAAO,GAAK6nB,EAAY,SAAWxE,EAAQ,KAAK,GAAI,MAAMsE,GAAiB3nB,EAAK6nB,CAAW,MAC7J,CACJ+C,GAAa5qB,EAAKA,EAAI,QAAQ,YAAY,WAAW,EACrD,IAAM8nB,EAAeN,GAAmBxnB,EAAI,QAAQ,YAAY,YAAY,KAAMA,EAAI,QAAQ,YAAY,YAAY,WAAYA,CAAG,EACrI8nB,EAAa,WAAWA,EAAa,MAAM,CAAC,CAC7C,EACD,CACD,CACA,eAAe+C,GAAkB,EAAK,EAAO,CAC5C,IAAM/a,EAAW9P,EAAI,QAAQ,QAAQ,SAAS,aAAa,UAAY,UACvE,GAAI8P,IAAa,MAAO,CACvB,IAAMrpB,EAAU,MAAMc,GAAmBxhB,EAAOi6B,EAAI,QAAQ,aAAc,qBAAqB,EACzFpyB,EAAUo7C,GAAwBviC,CAAO,EAE/C,OADK7Y,EACE,CACN,QAASA,EACT,UAAW6Y,GAAS,IAAMA,EAAQ,IAAM,IAAM,KAAK,IAAI,CACxD,EAJqB,IAKtB,CACA,GAAIqpB,IAAa,MAAO,CACvB,IAAM2a,EAAoBzqB,EAAI,QAAQ,cAAc,kBACpD,GAAIyqB,EAAmB,CACtB,IAAM3rC,EAAW,MAAM2rC,EAAkB,OAAOzqB,EAAKj6B,CAAK,EAE1D,OADK+Y,EACE,CACN,QAASA,EAAS,QAClB,UAAWA,EAAS,SACrB,EAJsB,IAKvB,CACA,IAAM2H,EAAU,MAAMK,GAAU/gB,EAAOi6B,EAAI,QAAQ,MAAM,EACnDpyB,EAAUo7C,GAAwBviC,CAAO,EAE/C,OADK7Y,EACE,CACN,QAASA,EACT,UAAW6Y,GAAS,IAAMA,EAAQ,IAAM,IAAM,KAAK,IAAI,CACxD,EAJqB,IAKtB,CACA,IAAM5W,EAASo5C,GAAwBjlD,GAAcmJ,GAAO,OAAO1I,GAAU,OAAOsB,CAAK,CAAC,CAAC,CAAC,EAE5F,GADI,CAAC8J,GACD,CAAC,MAAMu5C,GAAW,UAAW,gBAAgB,CAAC,CAAC,OAAOppB,EAAI,QAAQ,OAAQ,KAAK,UAAU,CAC5F,GAAGnwB,EAAO,QACV,UAAWA,EAAO,SACnB,CAAC,EAAGA,EAAO,SAAS,EAAG,OAAO,KAC9B,IAAMjC,EAAUo7C,GAAwBn5C,EAAO,OAAO,EACtD,OAAOjC,EAAU,CAChB,QAASA,EACT,UAAWiC,EAAO,SACnB,EAAI,IACL,CACA,eAAei7C,GAAiB,EAAK,EAAS,EAAgB,EAAW,CACxE,IAAMC,EAAuB,MAAM/qB,EAAI,gBAAgBA,EAAI,QAAQ,YAAY,kBAAkB,KAAMA,EAAI,QAAQ,MAAM,EACzH,EAAiBuqB,IAAmB,IAAK,GAAqB,CAAC,CAACQ,EAAnBR,EAC7C,IAAM/8C,EAAUwyB,EAAI,QAAQ,YAAY,aAAa,WAC/CgrB,EAAST,EAAiB,IAAK,GAAIvqB,EAAI,QAAQ,cAAc,UACnE,MAAMA,EAAI,gBAAgBA,EAAI,QAAQ,YAAY,aAAa,KAAMqjB,EAAQ,QAAQ,MAAOrjB,EAAI,QAAQ,OAAQ,CAC/G,GAAGxyB,EACH,SACA,GAAGy9C,CACJ,CAAC,EACGV,GAAgB,MAAMvqB,EAAI,gBAAgBA,EAAI,QAAQ,YAAY,kBAAkB,KAAM,OAAQA,EAAI,QAAQ,OAAQA,EAAI,QAAQ,YAAY,kBAAkB,UAAU,EAC9K,MAAMmqB,GAAenqB,EAAKqjB,EAASkH,CAAc,EACjDvqB,EAAI,QAAQ,cAAcqjB,CAAO,CAClC,CAqBA,SAAS6H,GAAuB,EAAK,EAAY,CAChD,IAAMC,EAASnrB,EACTorB,EAA0B,IAAI,IAChCD,EAAO,iBAAiBC,EAAQ,IAAID,EAAO,eAAe,EAC1DA,EAAO,SAAS,iBAAiBC,EAAQ,IAAID,EAAO,QAAQ,eAAe,EAC/E,IAAME,EAAQ,GAAG5E,EAAW,GACtBN,EAAQ,GAAGM,EAAW,GAC5B,IAAK,IAAMr3C,KAAWg8C,EAAS,CAC9B,IAAMrnB,EAAW,OAAO30B,EAAQ,cAAiB,WAAaA,EAAQ,aAAa,EAAI41C,GAAqB51C,EAAQ,IAAI,YAAY,GAAK,EAAE,EAC3I,GAAI,CAAC20B,EAAS,OAAQ,SACtB,IAAMunB,EAAYvnB,EAAS,OAAQ,GAAU,CAAC3yB,EAAM,WAAWi6C,CAAK,GAAK,CAACj6C,EAAM,WAAW+0C,CAAK,CAAC,EACjG,GAAImF,EAAU,SAAWvnB,EAAS,OAClC,GAAQ,OAAO,YAAY,EAC3B,IAAK,IAAM3yB,KAASk6C,EAAWl8C,EAAQ,OAAO,aAAcgC,CAAK,CADtC,CAE5B,CACD,CAKA,SAASu5C,GAAoB,EAAK,EAAY,CAC7C,IAAMQ,EAASnrB,EACTorB,EAA0B,IAAI,IAChCD,EAAO,iBAAiBC,EAAQ,IAAID,EAAO,eAAe,EAC1DA,EAAO,SAAS,iBAAiBC,EAAQ,IAAID,EAAO,QAAQ,eAAe,EAC/E,IAAME,EAAQ,GAAG5E,EAAW,GACtBN,EAAQ,GAAGM,EAAW,GAC5B,IAAK,IAAMr3C,KAAWg8C,EAAS,IAAK,OAAOh8C,EAAQ,cAAiB,WAAaA,EAAQ,aAAa,EAAI41C,GAAqB51C,EAAQ,IAAI,YAAY,GAAK,EAAE,EAAA,CAAG,KAAM,GAAUgC,EAAM,WAAWi6C,CAAK,GAAKj6C,EAAM,WAAW+0C,CAAK,CAAC,EAAG,MAAO,GAC7O,MAAO,EACR,CAIA,SAASyE,GAAa,EAAK,EAAQ,CAClCM,GAAuBlrB,EAAK/G,EAAO,IAAI,EACvC+G,EAAI,UAAU/G,EAAO,KAAM,GAAI,CAC9B,GAAGA,EAAO,WACV,OAAQ,CACT,CAAC,CACF,CACA,SAASsyB,GAAoB,EAAK,EAAoB,CAGrD,GAFAX,GAAa5qB,EAAKA,EAAI,QAAQ,YAAY,YAAY,EACtD4qB,GAAa5qB,EAAKA,EAAI,QAAQ,YAAY,WAAW,EACjDA,EAAI,QAAQ,QAAQ,SAAS,mBAAoB,CACpD4qB,GAAa5qB,EAAKA,EAAI,QAAQ,YAAY,WAAW,EACrD,IAAM8nB,EAAeN,GAAmBxnB,EAAI,QAAQ,YAAY,YAAY,KAAMA,EAAI,QAAQ,YAAY,YAAY,WAAYA,CAAG,EAC/HwrB,EAAe1D,EAAa,MAAM,EACxCA,EAAa,WAAW0D,CAAY,CACrC,CACIxrB,EAAI,QAAQ,YAAY,qBAAuB,UAAU4qB,GAAa5qB,EAAKA,EAAI,QAAQ,iBAAiB,aAAa,CAAC,EAC1H,IAAM0qB,EAAenD,GAAmBvnB,EAAI,QAAQ,YAAY,YAAY,KAAMA,EAAI,QAAQ,YAAY,YAAY,WAAYA,CAAG,EAC/HwrB,EAAed,EAAa,MAAM,EACxCA,EAAa,WAAWc,CAAY,EAC/BC,GAAoBb,GAAa5qB,EAAKA,EAAI,QAAQ,YAAY,iBAAiB,CACrF,CCnPA,IAAM0rB,OAAmBjS,EAAmB,eAAgB,CAC3D,OAAQ,CAAC,MAAO,MAAM,EACtB,YAAa,aACb,MAAOwO,GACP,eAAgB,GAChB,SAAU,CAAE,QAAS,CACpB,YAAa,aACb,YAAa,0BACb,UAAW,CAAE,IAAO,CACnB,YAAa,UACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,CAAC,SAAU,MAAM,EACvB,WAAY,CACX,QAAS,CAAE,KAAM,8BAA+B,EAChD,KAAM,CAAE,KAAM,2BAA4B,CAC3C,EACA,SAAU,CAAC,UAAW,MAAM,CAC7B,CAAE,CAAE,CACL,CAAE,CACH,CAAE,CACH,EAAG,KAAO,IAAQ,CACjBjoB,EAAI,UAAU,gBAAiB,UAAU,EACzCA,EAAI,UAAU,SAAU,UAAU,EAClC,IAAM2rB,EAAsB3rB,EAAI,QAAQ,QAAQ,SAAS,oBACnD4rB,EAAgB5rB,EAAI,SAAW,OACrC,GAAI4rB,GAAiB,CAACD,EAAqB,MAAMjtD,EAAS,KAAK,qBAAsB8kC,GAAiB,yCAAyC,EAC/I,GAAI,CACH,IAAMqoB,EAAqB7rB,EAAI,QAAQ,QAAQ,SAAS,aAAa,UAAY,GAC3E8rB,EAAqB,MAAM9rB,EAAI,gBAAgBA,EAAI,QAAQ,YAAY,aAAa,KAAMA,EAAI,QAAQ,MAAM,EAClH,GAAI,CAAC8rB,GAAsBD,EAAoB,OAAO,KACtD,IAAME,EAAoBtE,GAAiBznB,EAAKA,EAAI,QAAQ,YAAY,YAAY,IAAI,EACxF,GAAI+rB,GAAqB,CAACF,EAAoB,CAC7C,IAAMnB,EAAenD,GAAmBvnB,EAAI,QAAQ,YAAY,YAAY,KAAMA,EAAI,QAAQ,YAAY,YAAY,WAAYA,CAAG,EACrI0qB,EAAa,WAAWA,EAAa,MAAM,CAAC,CAC7C,CACA,GAAI,CAACoB,EAAoB,OAAO,KAChC,IAAME,EAAuBH,GAAsB,CAAC7rB,EAAI,OAAO,mBACzDisB,EAAqBD,GAAwBD,EAAoB,MAAMlB,GAAkB7qB,EAAK+rB,CAAiB,EAAI,KACrHC,GAAwBD,GAAqB,CAACE,GAAoBrB,GAAa5qB,EAAKA,EAAI,QAAQ,YAAY,WAAW,EAC3H,IAAMuqB,EAAiB,MAAMvqB,EAAI,gBAAgBA,EAAI,QAAQ,YAAY,kBAAkB,KAAMA,EAAI,QAAQ,MAAM,EAInH,GAAIisB,GAAoB,QAAS,CAChC,IAAM5I,EAAU4I,EAAmB,QAC/BC,EAA0B7I,EAAQ,QAAQ,QAAUyI,EACxD,GAAI,CAACI,EAAyB,CAC7B,IAAM5B,EAAgBtqB,EAAI,QAAQ,QAAQ,SAAS,aAAa,QAC5DmsB,EAAkB,IACtB,GAAI7B,EAAe,CAClB,GAAI,OAAOA,GAAkB,SAAU,EAAkBA,OACpD,GAAI,OAAOA,GAAkB,WAAY,CAC7C,IAAMvrC,EAASurC,EAAcjH,EAAQ,QAASA,EAAQ,IAAI,EAC1D,EAAkBtkC,aAAkB,QAAU,MAAMA,EAASA,CAC9D,CACD,CACA,GAA2BskC,EAAQ,SAAW,OAAS8I,CACxD,CACA,GAAI,CAACD,EAAyB,CAC7B,IAAM9qC,EAAM,KAAK,IAAI,EACfgrC,EAAyB,IAAI,KAAK/I,EAAQ,QAAQ,SAAS,CAAC,CAAC,QAAQ,EAC3E,EAA0B4I,EAAmB,UAAY7qC,GAAO,CAAC,OAAO,SAASgrC,CAAsB,GAAKA,EAAyBhrC,CACtI,CACA,GAAI8qC,EAAyBtB,GAAa5qB,EAAKA,EAAI,QAAQ,YAAY,WAAW,MAC7E,CACJ,IAAMqsB,EAAqBrsB,EAAI,QAAQ,cAAc,mBACrD,GAAIqsB,IAAuB,GAAO,CACjC,EAAI,QAAQ,QAAUhJ,EACtB,IAAMiJ,EAAgBlJ,GAAmBpjB,EAAI,QAAQ,QAAS,CAC7D,GAAGqjB,EAAQ,QACX,UAAW,IAAI,KAAKA,EAAQ,QAAQ,SAAS,EAC7C,UAAW,IAAI,KAAKA,EAAQ,QAAQ,SAAS,EAC7C,UAAW,IAAI,KAAKA,EAAQ,QAAQ,SAAS,CAC9C,CAAC,EACKkJ,EAAavJ,GAAgBhjB,EAAI,QAAQ,QAAS,CACvD,GAAGqjB,EAAQ,KACX,UAAW,IAAI,KAAKA,EAAQ,KAAK,SAAS,EAC1C,UAAW,IAAI,KAAKA,EAAQ,KAAK,SAAS,CAC3C,CAAC,EACD,OAAOrjB,EAAI,KAAK,CACf,QAASssB,EACT,KAAMC,CACP,CAAC,CACF,CACA,IAAMC,EAAkBP,EAAmB,UAAY,KAAK,IAAI,EAC1DQ,EAAYJ,EAAmB,UAAY,IAC3CK,EAA2B,MAAMzK,GAA4B,EACnE,GAAIuK,EAAkBC,GAAa,CAACC,EAA0B,CAC7D,IAAMC,EAAmB,CACxB,QAAS,CAAE,GAAGtJ,EAAQ,OAAQ,EAC9B,KAAMA,EAAQ,KACd,UAAW,KAAK,IAAI,CACrB,EACA,MAAM8G,GAAenqB,EAAK2sB,EAAkB,EAAK,EACjD,IAAMC,EAAsB5sB,EAAI,QAAQ,YAAY,aAAa,WAC3D6sB,EAAqBtC,EAAiB,IAAK,GAAIvqB,EAAI,QAAQ,cAAc,UAC/E,MAAMA,EAAI,gBAAgBA,EAAI,QAAQ,YAAY,aAAa,KAAMqjB,EAAQ,QAAQ,MAAOrjB,EAAI,QAAQ,OAAQ,CAC/G,GAAG4sB,EACH,OAAQC,CACT,CAAC,EACD,IAAMC,EAAyB1J,GAAmBpjB,EAAI,QAAQ,QAAS,CACtE,GAAG2sB,EAAiB,QACpB,UAAW,IAAI,KAAKA,EAAiB,QAAQ,SAAS,EACtD,UAAW,IAAI,KAAKA,EAAiB,QAAQ,SAAS,EACtD,UAAW,IAAI,KAAKA,EAAiB,QAAQ,SAAS,CACvD,CAAC,EACKI,EAAsB/J,GAAgBhjB,EAAI,QAAQ,QAAS,CAChE,GAAG2sB,EAAiB,KACpB,UAAW,IAAI,KAAKA,EAAiB,KAAK,SAAS,EACnD,UAAW,IAAI,KAAKA,EAAiB,KAAK,SAAS,CACpD,CAAC,EAKD,MAJA,GAAI,QAAQ,QAAU,CACrB,QAASG,EACT,KAAMC,CACP,EACO/sB,EAAI,KAAK,CACf,QAAS8sB,EACT,KAAMC,CACP,CAAC,CACF,CACA,IAAMT,EAAgBlJ,GAAmBpjB,EAAI,QAAQ,QAAS,CAC7D,GAAGqjB,EAAQ,QACX,UAAW,IAAI,KAAKA,EAAQ,QAAQ,SAAS,EAC7C,UAAW,IAAI,KAAKA,EAAQ,QAAQ,SAAS,EAC7C,UAAW,IAAI,KAAKA,EAAQ,QAAQ,SAAS,CAC9C,CAAC,EACKkJ,EAAavJ,GAAgBhjB,EAAI,QAAQ,QAAS,CACvD,GAAGqjB,EAAQ,KACX,UAAW,IAAI,KAAKA,EAAQ,KAAK,SAAS,EAC1C,UAAW,IAAI,KAAKA,EAAQ,KAAK,SAAS,CAC3C,CAAC,EAKD,MAJA,GAAI,QAAQ,QAAU,CACrB,QAASiJ,EACT,KAAMC,CACP,EACOvsB,EAAI,KAAK,CACf,QAASssB,EACT,KAAMC,CACP,CAAC,CACF,CACD,CACA,IAAMlJ,EAAU,MAAMrjB,EAAI,QAAQ,gBAAgB,YAAY8rB,CAAkB,EAEhF,GADA,EAAI,QAAQ,QAAUzI,EAClB,CAACA,GAAWA,EAAQ,QAAQ,UAA4B,IAAI,KAS/D,OARAkI,GAAoBvrB,CAAG,EACnBqjB,IAKC,CAACsI,GAAuBC,IAAe,MAAM5rB,EAAI,QAAQ,gBAAgB,cAAcqjB,EAAQ,QAAQ,KAAK,EAE1GrjB,EAAI,KAAK,IAAI,EAMrB,GAAIuqB,GAAkBvqB,EAAI,OAAO,eAAgB,CAChD,IAAMssB,EAAgBlJ,GAAmBpjB,EAAI,QAAQ,QAASqjB,EAAQ,OAAO,EACvEkJ,EAAavJ,GAAgBhjB,EAAI,QAAQ,QAASqjB,EAAQ,IAAI,EACpE,OAAOrjB,EAAI,KAAK,CACf,QAASssB,EACT,KAAMC,CACP,CAAC,CACF,CACA,IAAM1lC,EAAYmZ,EAAI,QAAQ,cAAc,UACtCysB,EAAYzsB,EAAI,QAAQ,cAAc,UACtCgtB,EAAkB3J,EAAQ,QAAQ,UAAU,QAAQ,EAAIx8B,EAAY,IAAM4lC,EAAY,KAAO,KAAK,IAAI,EACtGQ,EAAiBjtB,EAAI,OAAO,gBAAkBA,EAAI,QAAQ,QAAQ,SAAS,sBAC3E0sB,EAA2B,MAAMzK,GAA4B,EAC7DiL,EAAeF,GAAmB,CAACC,GAAkB,CAACP,EAK5D,GAAIf,GAAuB,CAACC,EAAe,CAC1C,MAAMzB,GAAenqB,EAAKqjB,EAAS,CAAC,CAACkH,CAAc,EACnD,IAAM+B,EAAgBlJ,GAAmBpjB,EAAI,QAAQ,QAASqjB,EAAQ,OAAO,EACvEkJ,EAAavJ,GAAgBhjB,EAAI,QAAQ,QAASqjB,EAAQ,IAAI,EACpE,OAAOrjB,EAAI,KAAK,CACf,QAASssB,EACT,KAAMC,EACN,cACD,CAAC,CACF,CACA,GAAIW,EAAc,CACjB,IAAMC,EAAiB,MAAMntB,EAAI,QAAQ,gBAAgB,cAAcqjB,EAAQ,QAAQ,MAAO,CAC7F,UAAWzf,GAAQ5D,EAAI,QAAQ,cAAc,UAAW,KAAK,EAC7D,UAA2B,IAAI,IAChC,CAAC,EACD,GAAI,CAACmtB,EAKJ,MADA5B,GAAoBvrB,CAAG,EACjBthC,EAAS,KAAK,eAAgB8kC,GAAiB,qBAAqB,EAE3E,IAAMwnB,EAAShrB,EAAI,QAAQ,cAAc,UACzC,MAAM8qB,GAAiB9qB,EAAK,CAC3B,QAASmtB,EACT,KAAM9J,EAAQ,IACf,EAAG,GAAO,CAAE,QAAO,CAAC,EACpB,IAAM+J,EAAuBhK,GAAmBpjB,EAAI,QAAQ,QAASmtB,CAAc,EAC7EZ,EAAavJ,GAAgBhjB,EAAI,QAAQ,QAASqjB,EAAQ,IAAI,EACpE,OAAOrjB,EAAI,KAAK,CACf,QAASotB,EACT,KAAMb,CACP,CAAC,CACF,CACA,MAAMpC,GAAenqB,EAAKqjB,EAAS,CAAC,CAACkH,CAAc,EACnD,IAAM+B,EAAgBlJ,GAAmBpjB,EAAI,QAAQ,QAASqjB,EAAQ,OAAO,EACvEkJ,EAAavJ,GAAgBhjB,EAAI,QAAQ,QAASqjB,EAAQ,IAAI,EACpE,OAAOrjB,EAAI,KAAK,CACf,QAASssB,EACT,KAAMC,CACP,CAAC,CACF,OAASrwC,EAAO,CAGf,MAFIi8B,GAAWj8B,CAAK,EAASA,GAC7B8jB,EAAI,QAAQ,OAAO,MAAM,wBAAyB9jB,CAAK,EACjDxd,EAAS,KAAK,wBAAyB8kC,GAAiB,qBAAqB,EACpF,CACD,CAAC,EAWK6pB,GAAc,GAAQlL,GAAsBniB,EAAI,QAAQ,OAAO,EAC/DstB,EAAoB,MAAO,EAAK,IAAW,CAChD,GAAIttB,EAAI,QAAQ,QAAS,OAAOA,EAAI,QAAQ,QAC5C,IAAMqjB,EAAU,MAAMqI,GAAW,CAAC,CAAC,CAClC,GAAG1rB,EACH,OAAQ,MACR,WAAY,GACZ,QAASA,EAAI,QACb,cAAe,GACf,aAAc,GACd,MAAO,CACN,GAAG1C,EACH,GAAG0C,EAAI,MACP,mBAAoB1C,GAAQ,oBAAsB0C,EAAI,OAAO,mBAC7D,eAAgB1C,GAAQ,gBAAkB0C,EAAI,OAAO,cACtD,CACD,CAAC,CAAC,CAAC,UACK,IACP,EAYD,OAXKqjB,GAIDA,EAAQ,SAASA,EAAQ,QAAQ,SAAS,EAAO,IAAQ,CAC5D,IAAMkK,EAAWznD,EAAI,YAAY,EAC7BynD,IAAa,iBAAmBA,IAAa,WAC7CA,IAAa,aAAcvtB,EAAI,gBAAgB,OAAOl6B,EAAKC,CAAK,EAC/Di6B,EAAI,gBAAgB,IAAIl6B,EAAKC,CAAK,EACxC,CAAC,EACD,EAAI,QAAQ,QAAUs9C,EAAQ,SACvBA,EAAQ,WAVd,EAAI,QAAQ,QAAU,KACf,KAUT,EAQMmK,GAAiC,KAAO,IACxCH,GAAWrtB,CAAG,GACnB,EAAI,QAAQ,QAAU,KACfstB,EAAkBttB,EAAK,CAAE,mBAAoB,EAAK,CAAC,GAF7BstB,EAAkBttB,CAAG,EAO7CytB,GAAoBpU,GAAqB,KAAO,IAAQ,CAC7D,IAAMgK,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,GAAI,CAACqjB,GAAS,QAAS,MAAM3kD,EAAS,KAAK,eAAgB,CAC1D,QAAS,eACT,KAAM,cACP,CAAC,EACD,MAAO,CAAE,SAAQ,CAClB,CAAC,EAKKgvD,GAA6BrU,GAAqB,KAAO,IAAQ,CACtE,IAAMgK,EAAU,MAAMmK,GAA+BxtB,CAAG,EACxD,GAAI,CAACqjB,GAAS,QAAS,MAAM3kD,EAAS,KAAK,eAAgB,CAC1D,QAAS,eACT,KAAM,cACP,CAAC,EACD,MAAO,CAAE,SAAQ,CAClB,CAAC,EAKoC26C,GAAqB,KAAO,IAAQ,CACxE,IAAMgK,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,GAAI,CAACqjB,GAAS,UAAYrjB,EAAI,SAAWA,EAAI,SAAU,MAAMthC,EAAS,KAAK,eAAgB,CAC1F,QAAS,eACT,KAAM,cACP,CAAC,EACD,MAAO,CAAE,SAAQ,CAClB,CAAC,EAQD,IAAMivD,GAAyBtU,GAAqB,KAAO,IAAQ,CAClE,IAAMgK,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,GAAI,CAACqjB,GAAS,QAAS,MAAM3kD,EAAS,KAAK,eAAgB,CAC1D,QAAS,eACT,KAAM,cACP,CAAC,EACD,GAAIshC,EAAI,QAAQ,cAAc,WAAa,EAAG,CAC7C,IAAM4tB,EAAY,IAAI,KAAKvK,EAAQ,QAAQ,SAAS,CAAC,CAAC,QAAQ,EACxDwK,EAAW7tB,EAAI,QAAQ,cAAc,SAAW,IACtD,GAAI,KAAK,IAAI,EAAI4tB,GAAaC,EAAU,MAAMnvD,EAAS,KAAK,YAAa8kC,GAAiB,iBAAiB,CAC5G,CACA,MAAO,CAAE,SAAQ,CAClB,CAAC,EAIKsqB,OAAqBrU,EAAmB,iBAAkB,CAC/D,OAAQ,MACR,YAAa,mBACb,IAAK,CAACkU,EAAsB,EAC5B,eAAgB,GAChB,SAAU,CAAE,QAAS,CACpB,YAAa,mBACb,YAAa,wCACb,UAAW,CAAE,IAAO,CACnB,YAAa,UACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,QACN,MAAO,CAAE,KAAM,8BAA+B,CAC/C,CAAE,CAAE,CACL,CAAE,CACH,CAAE,CACH,EAAG,KAAO,IAAQ,CACjB,GAAI,CACH,IAAMI,GAAkB,MAAM/tB,EAAI,QAAQ,gBAAgB,aAAaA,EAAI,QAAQ,QAAQ,KAAK,GAAI,CAAE,mBAAoB,EAAK,CAAC,EAAA,CAAG,OAAQ,GACnIqjB,EAAQ,UAA4B,IAAI,IAC/C,EACD,OAAOrjB,EAAI,KAAK+tB,EAAe,IAAK,GAAY3K,GAAmBpjB,EAAI,QAAQ,QAASqjB,CAAO,CAAC,CAAC,CAClG,OAASva,EAAG,CAEX,MADA9I,EAAI,QAAQ,OAAO,MAAM8I,CAAC,EACpB9I,EAAI,MAAM,uBAAuB,CACxC,CACD,CAAC,EAIKguB,GAAgBvU,EAAmB,kBAAmB,CAC3D,OAAQ,OACR,KAAM96C,EAAS,CAAE,MAAOC,EAAS,CAAC,CAAC,KAAK,CAAE,YAAa,qBAAsB,CAAC,CAAE,CAAC,EACjF,IAAK,CAAC8uD,EAA0B,EAChC,eAAgB,GAChB,SAAU,CAAE,QAAS,CACpB,YAAa,0BACb,YAAa,CAAE,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACvD,KAAM,SACN,WAAY,CAAE,MAAO,CACpB,KAAM,SACN,YAAa,qBACd,CAAE,EACF,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CAAE,EACN,UAAW,CAAE,IAAO,CACnB,YAAa,UACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,OAAQ,CACrB,KAAM,UACN,YAAa,mDACd,CAAE,EACF,SAAU,CAAC,QAAQ,CACpB,CAAE,CAAE,CACL,CAAE,CACH,CAAE,CACH,EAAG,KAAO,IAAQ,CACjB,IAAMlyC,EAAQwkB,EAAI,KAAK,MACvB,IAAK,MAAMA,EAAI,QAAQ,gBAAgB,YAAYxkB,CAAK,EAAA,EAAI,QAAQ,SAAWwkB,EAAI,QAAQ,QAAQ,KAAK,GAAI,GAAI,CAC/G,MAAMA,EAAI,QAAQ,gBAAgB,cAAcxkB,CAAK,CACtD,OAASU,EAAO,CAEf,MADA8jB,EAAI,QAAQ,OAAO,MAAM9jB,GAAS,OAAOA,GAAU,UAAY,SAAUA,EAAQA,EAAM,KAAO,GAAIA,CAAK,EACjGxd,EAAS,KAAK,wBAAyB,CAC5C,QAAS,wBACT,KAAM,uBACP,CAAC,CACF,CACA,OAAOshC,EAAI,KAAK,CAAE,OAAQ,EAAK,CAAC,CACjC,CAAC,EAIKiuB,GAAiBxU,EAAmB,mBAAoB,CAC7D,OAAQ,OACR,IAAK,CAACiU,EAA0B,EAChC,eAAgB,GAChB,SAAU,CAAE,QAAS,CACpB,YAAa,mCACb,UAAW,CAAE,IAAO,CACnB,YAAa,UACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,OAAQ,CACrB,KAAM,UACN,YAAa,qDACd,CAAE,EACF,SAAU,CAAC,QAAQ,CACpB,CAAE,CAAE,CACL,CAAE,CACH,CAAE,CACH,EAAG,KAAO,IAAQ,CACjB,GAAI,CACH,MAAM1tB,EAAI,QAAQ,gBAAgB,mBAAmBA,EAAI,QAAQ,QAAQ,KAAK,EAAE,CACjF,OAAS9jB,EAAO,CAEf,MADA8jB,EAAI,QAAQ,OAAO,MAAM9jB,GAAS,OAAOA,GAAU,UAAY,SAAUA,EAAQA,EAAM,KAAO,GAAIA,CAAK,EACjGxd,EAAS,KAAK,wBAAyB,CAC5C,QAAS,wBACT,KAAM,uBACP,CAAC,CACF,CACA,OAAOshC,EAAI,KAAK,CAAE,OAAQ,EAAK,CAAC,CACjC,CAAC,EACKkuB,GAAsBzU,EAAmB,yBAA0B,CACxE,OAAQ,OACR,eAAgB,GAChB,IAAK,CAACiU,EAA0B,EAChC,SAAU,CAAE,QAAS,CACpB,YAAa,gEACb,UAAW,CAAE,IAAO,CACnB,YAAa,UACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,OAAQ,CACrB,KAAM,UACN,YAAa,2DACd,CAAE,EACF,SAAU,CAAC,QAAQ,CACpB,CAAE,CAAE,CACL,CAAE,CACH,CAAE,CACH,EAAG,KAAO,IAAQ,CACjB,IAAMrK,EAAUrjB,EAAI,QAAQ,QAC5B,GAAI,CAACqjB,EAAQ,KAAM,MAAM3kD,EAAS,KAAK,eAAgB,CACtD,QAAS,eACT,KAAM,cACP,CAAC,EACD,IAAMyvD,GAAiB,MAAMnuB,EAAI,QAAQ,gBAAgB,aAAaqjB,EAAQ,KAAK,EAAE,EAAA,CAAG,OAAQ,GACxFA,EAAQ,UAA4B,IAAI,IAC/C,CAAC,CAAC,OAAQ,GAAYA,EAAQ,QAAUrjB,EAAI,QAAQ,QAAQ,QAAQ,KAAK,EAE1E,OADA,MAAM,QAAQ,IAAImuB,EAAc,IAAK,GAAYnuB,EAAI,QAAQ,gBAAgB,cAAcqjB,EAAQ,KAAK,CAAC,CAAC,EACnGrjB,EAAI,KAAK,CAAE,OAAQ,EAAK,CAAC,CACjC,CAAC,EC3dKouB,GAAoB,2BAEpBC,GAAiB,wBAEjBC,GAAe,sBCPrB,SAASC,GAAc,EAAO,CAC5B,GAAsB,OAAOxoD,GAAU,WAAnCA,EACF,MAAO,GAET,IAAMkJ,EAAY,OAAO,eAAelJ,CAAK,EAU7C,OATIkJ,IAAc,MAAQA,IAAc,OAAO,WAAa,OAAO,eAAeA,CAAS,IAAM,MAG7F,OAAO,YAAYlJ,EACd,GAEL,OAAO,eAAeA,EACjB,OAAO,UAAU,SAAS,KAAKA,CAAK,IAAM,kBAE5C,EACT,CAEA,SAASyoD,GAAM,EAAY,EAAU,EAAY,IAAK,EAAQ,CAC5D,GAAI,CAACD,GAAczjC,CAAQ,EACzB,OAAO0jC,GAAMC,EAAY,CAAC,EAAGC,EAAWC,CAAM,EAEhD,IAAMtsD,EAAS,CAAE,GAAGyoB,CAAS,EAC7B,IAAK,IAAMhlB,KAAO,OAAO,KAAK2oD,CAAU,EAAG,CACzC,GAAI3oD,IAAQ,aAAeA,IAAQ,cACjC,SAEF,IAAMC,EAAQ0oD,EAAW3oD,GACrBC,GAAU,OAGV4oD,GAAUA,EAAOtsD,EAAQyD,EAAKC,EAAO2oD,CAAS,IAGlD,AAUErsD,EAAOyD,GAVL,MAAM,QAAQC,CAAK,GAAK,MAAM,QAAQ1D,EAAOyD,EAAI,EACrC,CAAC,GAAGC,EAAO,GAAG1D,EAAOyD,EAAI,EAC9ByoD,GAAcxoD,CAAK,GAAKwoD,GAAclsD,EAAOyD,EAAI,EAC5C0oD,GACZzoD,EACA1D,EAAOyD,IACN4oD,EAAY,GAAGA,EAAU,GAAK,IAAM5oD,EAAI,SAAS,EAClD6oD,CACF,EAEc5oD,GAElB,CACA,OAAO1D,CACT,CACA,SAASusD,GAAW,EAAQ,CAC1B,OAAQ,GAAGC,IAETA,EAAW,QAAQ,EAAG,IAAML,GAAMtuB,EAAG32B,EAAG,GAAIolD,CAAM,EAAG,CAAC,CAAC,CAE3D,CACA,IAAMG,GAAOF,GAAW,EC3ClBG,GAAuB,IAAI,IAAI,CACpC,2BACA,gBACA,WACA,gBACA,4BACD,CAAC,EAED,SAASC,GAAc,EAAM,CAE5B,OADIpU,EAAK,QAAU,GAAKA,EAAK,WAAW,GAAG,GAAKA,EAAK,SAAS,GAAG,EAAUA,EAAK,MAAM,EAAG,EAAE,EACpFA,CACR,CAQA,SAASqU,GAAU,EAAM,CACxB,GAAIrU,EAAK,WAAW,GAAG,EAAG,CACzB,IAAME,EAAMF,EAAK,QAAQ,GAAG,EAE5B,OADIE,IAAQ,GAAWF,EAChBA,EAAK,MAAM,EAAGE,EAAM,CAAC,CAC7B,CACA,IAAMoU,EAAatU,EAAK,QAAQ,GAAG,EAGnC,OAFIsU,IAAe,IACftU,EAAK,QAAQ,IAAKsU,EAAa,CAAC,IAAM,GAAWtU,EAC9CA,EAAK,MAAM,EAAGsU,CAAU,CAChC,CAEA,SAASC,GAAY,EAAM,CAC1B,IAAMC,EAAOxU,EAAK,QAAQ,GAAG,EAE7B,OADIwU,IAAS,GAAWxU,EACjBA,EAAK,MAAM,EAAGwU,CAAI,CAC1B,CAOA,SAASC,GAAiB,EAAM,CAC/B,OAAOzU,EAAK,QAAQ,OAAQ,EAAE,CAC/B,CAEA,SAAS0U,GAAc,EAAM,CAC5B,MAAO,uCAAuC,KAAK1U,CAAI,CACxD,CAEA,SAAS2U,GAAa,EAAI,CACzB,IAAMhpC,EAAQ+2B,EAAG,MAAM,GAAG,EAC1B,OAAQ,OAAO/2B,EAAM,EAAE,GAAK,GAAK,OAAOA,EAAM,EAAE,GAAK,GAAK,OAAOA,EAAM,EAAE,GAAK,EAAI,OAAOA,EAAM,EAAE,KAAO,CACzG,CAEA,SAASipC,GAAY,EAAO,EAAQ,EAAQ,CAC3C,GAAI7nD,IAAW,EAAG,MAAO,GACzB,IAAMyqB,EAAOzqB,IAAW,GAAK,WAAa,IAAM,GAAKA,IAAW,EAChE,OAAQ5B,EAAQqsB,MAAWkG,EAASlG,EACrC,CACA,SAASq9B,GAAa,EAAI,CACzB,GAAInS,IAAO,UAAW,MAAO,cAC7B,GAAIA,IAAO,kBAAmB,MAAO,YACrC,IAAM10C,EAAI2mD,GAAajS,CAAE,EAgBzB,OAfIkS,GAAY5mD,EAAG2mD,GAAa,WAAW,EAAG,CAAC,EAAU,WACrDC,GAAY5mD,EAAG2mD,GAAa,UAAU,EAAG,CAAC,GAC1CC,GAAY5mD,EAAG2mD,GAAa,YAAY,EAAG,EAAE,GAC7CC,GAAY5mD,EAAG2mD,GAAa,aAAa,EAAG,EAAE,EAAU,UACxDC,GAAY5mD,EAAG2mD,GAAa,aAAa,EAAG,EAAE,EAAU,YACxDC,GAAY5mD,EAAG2mD,GAAa,YAAY,EAAG,EAAE,EAAU,qBACvDC,GAAY5mD,EAAG2mD,GAAa,WAAW,EAAG,EAAE,GAC5CC,GAAY5mD,EAAG2mD,GAAa,cAAc,EAAG,EAAE,GAC/CC,GAAY5mD,EAAG2mD,GAAa,aAAa,EAAG,EAAE,EAAU,gBACxDC,GAAY5mD,EAAG2mD,GAAa,YAAY,EAAG,EAAE,EAAU,eACvDC,GAAY5mD,EAAG2mD,GAAa,WAAW,EAAG,CAAC,EAAU,YACrDC,GAAY5mD,EAAG2mD,GAAa,SAAS,EAAG,CAAC,GACzCC,GAAY5mD,EAAG2mD,GAAa,WAAW,EAAG,EAAE,GAC5CC,GAAY5mD,EAAG2mD,GAAa,aAAa,EAAG,EAAE,GAC9CC,GAAY5mD,EAAG2mD,GAAa,WAAW,EAAG,CAAC,EAAU,WAClD,QACR,CAWA,SAASG,GAAoB,EAAU,EAAY,EAAU,CAAC,EAAG,CAChE,IAAMxkD,EAASykD,EAAa,EACtBC,EAAK,OAAO,SAAS3vB,EAAS,MAAM/0B,EAAQA,EAAS,CAAC,EAAG,EAAE,EAC3D2kD,EAAK,OAAO,SAAS5vB,EAAS,MAAM/0B,EAAS,EAAGA,EAAS,CAAC,EAAG,EAAE,EACrE,GAAI,CAAC,OAAO,SAAS0kD,CAAE,GAAK,CAAC,OAAO,SAASC,CAAE,EAAG,OAAO,KACzD,IAAIC,GAAYF,GAAM,GAAKC,KAAQ,EAEnC,OADIriD,EAAQ,MAAK,GAAYsiD,EAAW,cAAgB,GACjD,GAAGA,IAAa,GAAK,IAAI,GAAGA,IAAa,GAAK,IAAI,GAAGA,IAAa,EAAI,IAAI,GAAGA,EAAW,KAChG,CAUA,SAASC,GAAa,EAAU,CAC/B,GAAI9vB,IAAa,0CAA2C,MAAO,cACnE,GAAIA,IAAa,0CAA2C,MAAO,WACnE,IAAM+vB,EAAY,OAAO,SAAS/vB,EAAS,MAAM,EAAG,CAAC,EAAG,EAAE,EACpDgwB,EAAa,OAAO,SAAShwB,EAAS,MAAM,EAAG,CAAC,EAAG,EAAE,EAC3D,GAAI+vB,IAAc,IAAK,MAAO,YAC9B,GAAIA,IAAc,MAAQC,EAAa,MAAS,IAAK,MAAO,YAC5D,GAAID,IAAc,MAAQC,EAAa,MAAS,IAAK,MAAO,WAC5D,IAAKD,EAAY,MAAS,IAAK,MAAO,UACtC,GAAI/vB,EAAS,WAAW,YAAY,EAAG,MAAO,gBAC9C,GAAIA,EAAS,WAAW,iBAAiB,EAAG,MAAO,eACnD,GAAIA,EAAS,WAAW,OAAO,EAAG,CACjC,IAAMiwB,EAAWR,GAAoBzvB,EAAU,CAAC,EAEhD,OADIiwB,GAAYT,GAAaS,CAAQ,IAAM,SAAiB,WACrD,QACR,CACA,GAAIjwB,EAAS,WAAW,gCAAgC,EAAG,CAC1D,IAAMiwB,EAAWR,GAAoBzvB,EAAU,CAAC,EAEhD,OADIiwB,GAAYT,GAAaS,CAAQ,EAAuB,UAE7D,CACA,GAAIjwB,EAAS,WAAW,iBAAiB,EAAG,MAAO,WACnD,GAAIA,EAAS,WAAW,YAAY,EAAG,CACtC,IAAMiwB,EAAWR,GAAoBzvB,EAAU,EAAG,CAAE,IAAK,EAAK,CAAC,EAE/D,OADIiwB,GAAYT,GAAaS,CAAQ,EAAuB,UAE7D,CAKA,OAJIjwB,EAAS,WAAW,sBAAsB,EAAU,WACpDA,EAAS,WAAW,QAAQ,EAAU,gBACtCA,EAAS,WAAW,OAAO,GAC3BA,EAAS,WAAW,gCAAgC,EAAU,WAC3D,QACR,CAiCA,SAASkwB,GAAa,EAAM,CAC3B,IAAMC,EAAUf,GAAiBF,GAAYH,GAAcC,GAAUrU,EAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,EACjG,GAAIwV,IAAY,GAAI,MAAO,CAC1B,KAAM,WACN,QAAS,OACT,UAAW,EACZ,EACA,GAAI,CAAChT,GAAUgT,CAAO,EAWrB,OAVIA,IAAY,aAAeA,EAAQ,SAAS,YAAY,EAAU,CACrE,KAAM,YACN,QAAS,OACT,UAAWA,CACZ,EACIrB,GAAqB,IAAIqB,CAAO,EAAU,CAC7C,KAAM,gBACN,QAAS,OACT,UAAWA,CACZ,EACO,CACN,KAAM,SACN,QAAS,OACT,UAAWA,CACZ,EAED,GAAId,GAAcc,CAAO,EAAG,MAAO,CAClC,KAAMX,GAAaW,CAAO,EAC1B,QAAS,OACT,UAAWA,CACZ,EACA,IAAMC,EAAY7R,GAAY4R,EAAS,CAAE,WAAY,GAAI,CAAC,EAM1D,OALId,GAAce,CAAS,EAAU,CACpC,KAAMZ,GAAaY,CAAS,EAC5B,QAAS,OACT,WACD,EACO,CACN,KAAMN,GAAaM,CAAS,EAC5B,QAAS,OACT,WACD,CACD,CAiBA,SAASC,GAAa,EAAM,CAC3B,OAAOH,GAAavV,CAAI,CAAC,CAAC,OAAS,UACpC,CAiBA,SAAS2V,GAAe,EAAM,CAC7B,IAAMC,EAAOL,GAAavV,CAAI,CAAC,CAAC,KAChC,OAAO4V,IAAS,YAAcA,IAAS,WACxC,CA6BA,SAASC,GAAqB,EAAM,CACnC,OAAON,GAAavV,CAAI,CAAC,CAAC,OAAS,QACpC,CC9RA,IAAM8V,GAAoB9B,IAAY,EAAK,EAAK,IAAU,CACzD,GAAI,MAAM,QAAQz2B,EAAIryB,EAAI,GAAK,MAAM,QAAQC,CAAK,EAEjD,MADA,GAAID,GAAOC,EACJ,EAET,CAAC,EACK4qD,GAAqC,IAAI,QAM/C,SAASC,GAAe,EAAU,EAAU,CAC3C,IAAM7lC,EAAO4X,EAAS,QACtB,OAAO5X,GAAM,aAAeA,GAAM,UAAU,SAAS,aAAe61B,GAAYje,EAAS,MAAQ,WAClG,CAKA,SAASkuB,GAAqB,EAAS,EAAS,CAC1CzhD,GACLA,EAAQ,SAAS,EAAO,IAAQ,CAC1BkqB,EAAQ,gBACJxzB,EAAI,YAAY,IAAM,aAAcwzB,EAAQ,gBAAgB,OAAOxzB,EAAKC,CAAK,EACjFuzB,EAAQ,gBAAgB,IAAIxzB,EAAKC,CAAK,EAFb,EAAQ,gBAAkB,IAAI,QAAQ,EAAGD,GAAMC,CAAM,CAAC,CAGrF,CAAC,CACF,CAaA,SAAS+qD,GAAqB,EAAO,CACpC,IAAMC,EAAa70C,EAAMlZ,GACnBguD,EAAa90C,EAAM,SAAWA,EAAM,UAAY60C,EAAa,IAAI,QAAQ70C,EAAM,OAAO,EAAI,KAChG,GAAI,CAAC60C,GAAc,CAACC,EAAY,OAAO,KACvC,IAAM5hD,EAAU,IAAI,QAQpB,OAPA2hD,GAAY,SAAS,EAAO,IAAQ,CACnC3hD,EAAQ,OAAOtJ,EAAKC,CAAK,CAC1B,CAAC,EACDirD,GAAY,SAAS,EAAO,IAAQ,CAC/BlrD,EAAI,YAAY,IAAM,aAAcsJ,EAAQ,OAAOtJ,EAAKC,CAAK,EAC5DqJ,EAAQ,IAAItJ,EAAKC,CAAK,CAC5B,CAAC,EACMqJ,CACR,CACA,eAAe6hD,GAAe,EAAS,EAAO,EAAU,EAAa,CACpE,IAAMC,EAAWntD,GAAeu1B,EAAQ,QAAQ,OAAO,EACnD63B,EAAkB,CAAC,EACvB,IAAK,IAAMnQ,KAAQzb,EAAO,CACzB,IAAI7lB,EAAU,GACd,GAAI,CACH,EAAUshC,EAAK,QAAQ1nB,CAAO,CAC/B,OAASpd,EAAO,CACf,IAAMk1C,EAAaT,GAAmB,IAAI3P,EAAK,OAAO,GAAK,UAE3D,MADA1nB,EAAQ,QAAQ,OAAO,MAAM,4BAA4B83B,EAAW,0BAA2Bl1C,CAAK,EAC9F,IAAIrd,EAAS,wBAAyB,CAAE,QAAS,mFAAoF,CAAC,CAC7I,CACA,GAAI,CAAC6gB,EAAS,SACd,IAAM0xC,EAAaT,GAAmB,IAAI3P,EAAK,OAAO,GAAK,UACrDje,EAAQJ,EAAS,MAAQ,YACzB5jB,EAAS,MAAMmyC,EAAS,eAAenuB,EAAM,GAAGquB,IAAc,EAClE/C,IAAiB,UACjBlqD,IAAkB4+B,GAClBurB,IAAe8C,GACfhD,IAAoBiD,CACtB,MAASrQ,EAAK,QAAQ,CACrB,GAAG1nB,EACH,cAAe,EAChB,CAAC,CAAC,CAAC,CAAC,MAAO,GAAM,CAEhB,MADI6e,GAAWrP,CAAC,GAAKvlC,GAAiB+1B,EAAQ,QAAQ,OAAO,MAAO,OAAO,IAAG,EAAE,MAAQwP,EAAE,YACpFA,CACP,CAAC,EACD+nB,GAAqBv3B,EAAQ,QAASva,GAAQ,OAAO,EACrD,IAAMuyC,EAAavyC,GAAQ,SAC3B,GAAIuyC,GAAc,OAAOA,GAAe,SAAU,CACjD,GAAI,YAAaA,GAAc,OAAOA,EAAW,SAAY,SAAU,CACtE,GAAM,CAAE,UAAS,GAAGzN,GAASyN,EAAW,QACpCliD,aAAmB,UAAa+hD,EAAgB,QAAS/hD,EAAQ,SAAS,EAAO,IAAQ,CAC5F+hD,EAAgB,SAAS,IAAIrrD,EAAKC,CAAK,CACxC,CAAC,EACI,EAAgB,QAAUqJ,GAC/B,EAAkBshD,GAAkB7M,EAAMsN,CAAe,EACzD,QACD,CACA,OAAOG,CACR,CACD,CACA,MAAO,CAAE,QAASH,CAAgB,CACnC,CACA,eAAeI,GAAc,EAAS,EAAO,EAAU,EAAa,CACnE,IAAML,EAAWntD,GAAeu1B,EAAQ,QAAQ,OAAO,EACvD,IAAK,IAAM0nB,KAAQzb,EAAO,CACzB,GAAI,CAACyb,EAAK,QAAQ1nB,CAAO,EAAG,SAC5B,IAAM83B,EAAaT,GAAmB,IAAI3P,EAAK,OAAO,GAAK,UACrDje,EAAQJ,EAAS,MAAQ,YACzB5jB,EAAS,MAAMmyC,EAAS,cAAcnuB,EAAM,GAAGquB,IAAc,EACjE/C,IAAiB,SACjBlqD,IAAkB4+B,GAClBurB,IAAe8C,GACfhD,IAAoBiD,CACtB,MAASrQ,EAAK,QAAQ1nB,CAAO,CAAC,CAAC,CAAC,MAAO,GAAM,CAC5C,GAAI6e,GAAWrP,CAAC,EAEf,OADIvlC,GAAiB+1B,EAAQ,QAAQ,OAAO,MAAO,OAAO,IAAG,EAAE,MAAQwP,EAAE,YAClE,CACN,SAAUA,EACV,QAASgoB,GAAqBhoB,CAAC,CAChC,EAED,MAAMA,CACP,CAAC,EACD+nB,GAAqBv3B,EAAQ,QAASva,EAAO,OAAO,EAChDA,EAAO,WAAa,IAAK,KAAG,EAAQ,QAAQ,SAAWA,EAAO,SACnE,CACA,MAAO,CACN,SAAUua,EAAQ,QAAQ,SAC1B,QAASA,EAAQ,QAAQ,eAC1B,CACD,CACA,SAASk4B,GAAS,EAAa,CAC9B,IAAMC,EAAUC,EAAY,QAAQ,SAAW,CAAC,EAC1CC,EAAc,CAAC,EACfC,EAAa,CAAC,EACdC,EAAoBH,EAAY,QAAQ,OAAO,OACjDG,IACHlB,GAAmB,IAAIkB,EAAmB,MAAM,EAChDF,EAAY,KAAK,CAChB,YAAe,GACf,QAASE,CACV,CAAC,GAEF,IAAMC,EAAmBJ,EAAY,QAAQ,OAAO,MAChDI,IACHnB,GAAmB,IAAImB,EAAkB,MAAM,EAC/CF,EAAW,KAAK,CACf,YAAe,GACf,QAASE,CACV,CAAC,GAEF,IAAMC,EAAoBN,EAAQ,QAAS,IAAYjsB,EAAO,OAAO,QAAU,CAAC,EAAA,CAAG,IAAK,IACvFmrB,GAAmB,IAAI5nD,EAAE,QAAS,UAAUy8B,EAAO,IAAI,EAChDz8B,EACP,CAAC,EACIipD,EAAmBP,EAAQ,QAAS,IAAYjsB,EAAO,OAAO,OAAS,CAAC,EAAA,CAAG,IAAK,IACrFmrB,GAAmB,IAAI5nD,EAAE,QAAS,UAAUy8B,EAAO,IAAI,EAChDz8B,EACP,CAAC,EAGF,OAFIgpD,EAAkB,QAAQJ,EAAY,KAAK,GAAGI,CAAiB,EAC/DC,EAAiB,QAAQJ,EAAW,KAAK,GAAGI,CAAgB,EACzD,CACN,cACA,YACD,CACD,CAeA,eAAeC,GAAqB,EAAU,EAAO,CACpD,IAAMf,EAAWntD,GAAe+I,EAAM,QAAQ,OAAO,EAC/CukD,EAAcvkD,EAAM,aAAe8jD,GAAejuB,CAAQ,EAC1DI,EAAQJ,EAAS,MAAQ,YACzBuvB,EAAiBvvB,EAAS,SAAS,OACnCwvB,EAAgB,MAAM,QAAQD,CAAc,EAAIA,EAAe,GAAKA,EACpEE,EAAatlD,EAAM,QAAUA,EAAM,SAAS,QAAUqlD,GAAiB,IACvEE,EAAuBvlD,EAAM,YAAcivC,GAAcjvC,EAAM,OAAO,EACxEitB,EAAkB,CACrB,GAAGjtB,EACH,QAAS,CACR,GAAGA,EAAM,QACT,SAAU,IAAK,GACf,gBAAiB,IAAK,GACtB,QAASA,EAAM,QAAQ,SAAW,IACnC,EACA,KAAM61B,EAAS,KACf,QAAS71B,EAAM,QAAU,IAAI,QAAQA,EAAM,OAAO,EAAI,IAAK,EAC5D,EACA,OAAOokD,EAAS,GAAGkB,EAAW,GAAGrvB,IAAS,EACxC5+B,IAAkB4+B,GAClBqrB,IAAoBiD,CACtB,EAAG,SAAYrY,GAAuBjf,EAAiB,SAAY,CAClE,GAAM,CAAE,cAAa,cAAey3B,GAASz3B,EAAgB,OAAO,EAC9Du4B,EAAS,MAAMrB,GAAel3B,EAAiB43B,EAAahvB,EAAU0uB,CAAW,EACvF,GAAI,YAAaiB,GAAUA,EAAO,SAAW,OAAOA,EAAO,SAAY,SAAU,CAChF,GAAM,CAAE,UAAS,GAAGzO,GAASyO,EAAO,QACpC,GAAIljD,EAAS,CACP2qB,EAAgB,UAAS,EAAgB,QAAU,IAAI,SAC5D,IAAMH,EAAiBG,EAAgB,QACvC3qB,EAAQ,SAAS,EAAO,IAAQ,CAC/BwqB,EAAe,IAAI9zB,EAAKC,CAAK,CAC9B,CAAC,CACF,CACA,EAAkB2qD,GAAkB7M,EAAM9pB,CAAe,CAC1D,MAAO,GAAIu4B,EAAQ,CAClB,IAAMnZ,EAAkBpf,EAAgB,QAAQ,gBAChD,OAAOs4B,EAAuB/2B,GAAWg3B,EAAQ,CAAE,QAASnZ,CAAgB,CAAC,EAAIrsC,EAAM,cAAgB,CACtG,QAASqsC,EACT,SAAUmZ,CACX,EAAIA,CACL,CACA,EAAgB,WAAa,GAC7B,EAAgB,cAAgB,GAChC,EAAgB,aAAe,GAC/B,IAAMvzC,EAAS,MAAMi6B,GAAuBjf,MAAuBm3B,EAAS,WAAWnuB,IAAS,EAC9F5+B,IAAkB4+B,GAClBqrB,IAAoBiD,CACtB,MAAS1uB,EAAS5I,CAAe,CAAC,CAAC,CAAC,CAAC,MAAO,GAAM,CACjD,GAAIoe,GAAW,CAAC,EAAG,MAAO,CACzB,SAAU,EACV,OAAQ,EAAE,WACV,QAAS2Y,GAAqB,CAAC,CAChC,EACA,MAAM,CACP,CAAC,EACD,GAAI/xC,aAAkB,SAAU,OAAOA,EACvC,EAAgB,QAAQ,SAAWA,EAAO,SAC1C,EAAgB,QAAQ,gBAAkBA,EAAO,SAAW,IAAK,GACjE,IAAMwzC,EAAQ,MAAMhB,GAAcx3B,EAAiB63B,EAAYjvB,EAAU0uB,CAAW,EAIpF,GAHIkB,EAAM,WAAa,IAAK,KAAG,EAAO,SAAWA,EAAM,UACvD,EAAO,QAAUA,EAAM,SAAWxzC,EAAO,QACrCo5B,GAAWp5B,EAAO,QAAQ,GAAKxb,GAAiBw2B,EAAgB,QAAQ,OAAO,MAAO,OAAO,IAAG,EAAO,SAAS,MAAQhb,EAAO,SAAS,YACxIo5B,GAAWp5B,EAAO,QAAQ,GAAK,CAACszC,EAOnC,MANItzC,EAAO,SAAS,OAAO,eAAeA,EAAO,SAAU/b,EAAuB,CACjF,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO+b,EAAO,OACf,CAAC,EACKA,EAAO,SAEd,OAAOszC,EAAuB/2B,GAAWvc,EAAO,SAAU,CACzD,QAASA,EAAO,SAAW,IAAK,GAChC,OAAQA,EAAO,MAChB,CAAC,EAAIjS,EAAM,cAAgBA,EAAM,aAAe,CAC/C,QAASiS,EAAO,QAChB,SAAUA,EAAO,SACjB,OAAQA,EAAO,MAChB,EAAI,CACH,QAASA,EAAO,QAChB,SAAUA,EAAO,QAClB,EAAIjS,EAAM,aAAe,CACxB,SAAUiS,EAAO,SACjB,OAAQA,EAAO,MAChB,EAAIA,EAAO,QACZ,CAAC,CAAC,CACH,CC5QA,IAAMyzC,GAAoC,wEACpCC,GAA0B,IAAI,IAAI,CACvC,QACA,SACA,MACA,OACA,QACA,OACA,UACA,cACA,QACA,YACA,QACA,SACA,cACD,CAAC,EAKD,SAASC,GAAqC,EAAK,CAClD,IAAM7mB,EAASoL,EAAI,SAAS,MAAM,EAAG,EAAE,EACjC0b,EAAqB1b,EAAI,KAAK,MAAMA,EAAI,SAAS,MAAM,EAC7D,OAAOA,EAAI,WAAa,SAAWA,EAAI,WAAa,UAAYA,EAAI,KAAK,SAAW,GAAK0b,EAAmB,WAAW,GAAG,GAAK,CAACA,EAAmB,WAAW,IAAI,GAAKH,GAAkC,KAAK3mB,CAAM,CACrN,CAgBA,SAAS+mB,GAAmC,EAAK,CAGhD,OAFIH,GAAwB,IAAIxb,EAAI,QAAQ,GACxCA,EAAI,KAAK,SAAW,EAAU,GAC3BA,EAAI,SAAS,WAAW,GAAG,CACnC,CAEA,SAAS4b,GAA8B,EAAK,CAC3C,OAAOH,GAAqCzb,CAAG,GAAK2b,GAAmC3b,CAAG,CAC3F,CAeA,IAAM6b,EAAgBh0D,EAAM,CAAC,CAAC,aAAa,EAAK,IAAQ,CACvD,IAAI2qB,EACJ,GAAI,CACH,EAAI,IAAI,IAAIkP,CAAG,CAChB,MAAQ,CAMP,OALAqH,EAAI,SAAS,CACZ,KAAM,SACN,QAAS,wBACT,MAAO,EACR,CAAC,EACMjhC,CACR,CACIk+C,GAAsB,SAASxzB,EAAE,QAAQ,EAC5CuW,EAAI,SAAS,CACZ,KAAM,SACN,QAAS,wDACV,CAAC,GAGErH,EAAI,SAAS,GAAG,GAAGqH,EAAI,SAAS,CACnC,KAAM,SACN,QAAS,oDACV,CAAC,EACGvW,EAAE,WAAa,SAAW,CAAC8mC,GAAe9mC,EAAE,IAAI,GAAGuW,EAAI,SAAS,CACnE,KAAM,SACN,QAAS,oEACV,CAAC,EACF,CAAC,EC5FK+yB,IAAkB,EAAa,KAC7B,CACN,WAAY,KAAO,IACdvlD,GAAS,SAAS,QAAgB,MAAMA,EAAQ,QAAQ,QAAQwyB,CAAG,EAChE,MAAO,MAAM0gB,GAAkBsS,CAAW,EAAA,CAAG,SAAS,CAAE,MAAO,MAAO,CAAC,EAE/E,aAAc,KAAO,IAAQ,CAC5B,IAAM5xC,EAAsB,IAAI,KAC1B6xC,EAAU,GAAM,CAAC52C,EAAE,WAAaA,EAAE,UAAY+E,EAEpD,OADI5T,GAAS,SAAS,SAAiB,MAAMA,EAAQ,QAAQ,QAAQwyB,CAAG,EAAA,EAAI,OAAOizB,CAAM,CAAC,CAAC,MAAM,EAAG,IAAM3pD,EAAE,UAAU,QAAQ,EAAID,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,IACjJ,MAAO,MAAMq3C,GAAkBsS,CAAW,EAAA,CAAG,SAAS,CAAE,MAAO,MAAO,CAAC,EAAA,EAAI,OAAOC,CAAM,CAAC,CAAC,MAAM,EAAG,IAAM3pD,EAAE,UAAU,QAAQ,EAAID,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,EACjK,EASA,WAAY,MAAO,EAAK,IACnBmE,GAAS,SAAS,SAAiB,MAAMA,EAAQ,QAAQ,QAAQwyB,CAAG,EAAA,EAAI,KAAM,GAAM3jB,EAAE,KAAOye,CAAE,EAC5F,MAAO,MAAM4lB,GAAkBsS,CAAW,EAAA,CAAG,QAAQ,CAC3D,MAAO,OACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOl4B,CACR,CAAC,CACF,CAAC,GAAK,IAAK,GAiBZ,kBAAmB,MAAO,EAAK,IAAQ,CACtC,IAAM9U,EAAaxY,GAAS,SAAS,QAAU,MAAMA,EAAQ,QAAQ,QAAQwyB,CAAG,EAAI,MAAO,MAAM0gB,GAAkBsS,CAAW,EAAA,CAAG,SAAS,CAAE,MAAO,MAAO,CAAC,EAC3J,GAAI,CAAChtC,EAAY,OACjB,IAAMktC,EAAY1lD,GAAS,MAAM,eAAe,KAAO,QACjD4T,EAAsB,IAAI,KAChC,OAAO4E,EAAW,OAAQ,GAAM3J,EAAE,MAAQ9K,GAAO8K,EAAE,KAAO,MAAQ62C,IAAc3hD,CAAG,CAAC,CAAC,OAAQ,GAAM,CAAC8K,EAAE,WAAaA,EAAE,UAAY+E,CAAG,CAAC,CAAC,MAAM,EAAG,IAAM9X,EAAE,UAAU,QAAQ,EAAID,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,EACrM,EACA,UAAW,MAAO,EAAK,IAClBmE,GAAS,SAAS,UAAkB,MAAMA,EAAQ,QAAQ,UAAU2lD,EAAQnzB,CAAG,EAC5E,MAAO,MAAM0gB,GAAkBsS,CAAW,EAAA,CAAG,OAAO,CAC1D,MAAO,OACP,KAAM,CACL,GAAGG,EACH,UAA2B,IAAI,IAChC,CACD,CAAC,CAEH,GClDD,SAASC,GAAS,EAAgB,EAAK,CAGjC,OAFD,OAAOC,GAAmB,SAAiBA,EACtCA,aAA0B,KAAa,KAAK,MAAMA,EAAe,QAAQ,EAAI,GAAG,EAC7E/xC,EAAMunC,GAAIwK,CAAc,CACrC,CACA,eAAeC,GAAwB,EAAS,CAC/C,GAAM,CAAE,MAAK,GAAGC,GAAQ/lD,GAAS,MAAM,eAAiB,CACvD,IAAK,QACL,IAAK,SACN,EACM,CAAE,YAAW,cAAe,MAAMmZ,GAAgBpV,EAAK,CAC5D,GAAGgiD,EACH,YAAa,EACd,CAAC,EACD,MAAO,CACN,aAAc,MAAM3uC,GAAUxM,CAAS,EACvC,cAAe,MAAMwM,GAAUlT,CAAU,EACzC,MACA,KACD,CACD,CAQA,eAAe8hD,GAAU,EAAK,EAAS,CACtC,GAAM,CAAE,eAAc,gBAAe,MAAK,OAAQ,MAAMF,GAAwB9lD,CAAO,EACjFimD,EAAcF,GAAO,QAASA,EAAMA,EAAI,IAAM,IAAK,GACnDG,EAAa,OAAOC,EAAa,KAAQ,SAAWA,EAAa,IAAM,IAAK,GAC5EnhD,EAAMihD,GAAeC,EACrBE,EAA2B,KAAK,UAAUC,CAAa,EACvDC,EAA8B,CAACtmD,GAAS,MAAM,4BAC9CiG,EAAM,CACX,MACA,GAAGjB,EAAM,CAAE,KAAI,EAAI,CAAC,EACpB,UAAW,KAAK,UAAUmhD,CAAY,EACtC,WAAYG,EAA8B,KAAK,UAAU,MAAMt9B,GAAiB,CAC/E,IAAKwJ,EAAI,QAAQ,aACjB,KAAM4zB,CACP,CAAC,CAAC,EAAIA,EACN,UAA2B,IAAI,KAC/B,GAAGpmD,GAAS,MAAM,iBAAmB,CAAE,UAAW,IAAI,KAAK,KAAK,IAAI,EAAIA,EAAQ,KAAK,iBAAmB,GAAG,CAAE,EAAI,CAAC,CACnH,EACA,OAAO,MAAMulD,GAAe/yB,EAAI,QAAQ,QAASxyB,CAAO,CAAC,CAAC,UAAUwyB,EAAKvsB,CAAG,CAC7E,CCtCA,eAAesgD,GAAkB,EAAK,EAAS,EAAW,CACzD,GAAIvmD,GAAS,KAAK,KAAM,OAAO,KAC/B,IAAM2zC,EAAU4R,GAAe/yB,EAAI,QAAQ,QAASxyB,CAAO,EACvD1H,EACJ,GAAImlD,GAAW,eAAiB,IAAK,GAAG,CAEvC,GADA,EAAM,MAAM9J,EAAQ,WAAWnhB,EAAKirB,EAAU,YAAY,EACtD,CAACnlD,EAAK,MAAM,IAAIxB,EAAgB,0BAA0B2mD,EAAU,aAAa,8EAA8E,EACnK,GAAIA,EAAU,mBAAqB,IAAK,GAAG,CAC1C,IAAMiI,EAAY1lD,GAAS,MAAM,eAAe,KAAO,QACvD,IAAK1H,EAAI,KAAOotD,KAAejI,EAAU,iBAAkB,MAAM,IAAI3mD,EAAgB,0BAA0B2mD,EAAU,aAAa,aAAanlD,EAAI,KAAO,sCAAsCotD,EAAU,IAAI,qCAAqCjI,EAAU,iBAAiB,GAAG,CACtR,CACD,MAAO,GAAIA,GAAW,mBAAqB,IAAK,GAE/C,IADA,EAAM,MAAM9J,EAAQ,kBAAkBnhB,EAAKirB,EAAU,gBAAgB,EACjE,CAACnlD,EAAK,CACT,IAAMkuD,EAAaxmD,GAAS,MAAM,eAAe,KAAO,QAClDymD,EAAYzmD,GAAS,MAAM,gBAAgB,KAAM,GAAMjE,EAAE,MAAQ0hD,EAAU,gBAAgB,EAC3FiJ,EAAYF,IAAe/I,EAAU,iBAC3C,GAAIgJ,GAAaC,EAAW,EAAM,MAAMV,GAAUxzB,EAAK,CACtD,GAAGxyB,EACH,KAAM,CACL,GAAGA,GAAS,KACZ,cAAeymD,GAAazmD,GAAS,MAAM,aAC5C,CACD,CAAC,MACI,CACJ,IAAM2mD,EAAkB3mD,GAAS,MAAM,gBAAgB,IAAK,GAAMjE,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,GAAK,OACvF,MAAM,IAAIjF,EAAgB,6BAA6B2mD,EAAU,iBAAiB,kFAAkF+I,EAAW,oDAAoDG,EAAgB,SAASlJ,EAAU,iBAAiB,+GAA+G,CACvY,CACD,MACM,CACN,IAAM+I,EAAaxmD,GAAS,MAAM,eAAe,KAAO,QACxD,EAAM,MAAM2zC,EAAQ,kBAAkBnhB,EAAKg0B,CAAU,GAAK,MAAM7S,EAAQ,aAAanhB,CAAG,CACzF,CACA,GAAI,CAACl6B,GAAOA,EAAI,WAAaA,EAAI,UAA4B,IAAI,KAAQ,CACxE,GAAImlD,GAAW,eAAiB,IAAK,IAAKA,GAAW,mBAAqB,IAAK,GAAG,MAAM,IAAI3mD,EAAgB,4IAA4I,EACxP,EAAM,MAAMkvD,GAAUxzB,EAAKxyB,CAAO,CACnC,CACA,IAAMqmD,EAAiBrmD,GAAS,MAAM,4BAKjC1H,EAAI,WAL2D,MAAM2wB,GAAiB,CAC1F,IAAKuJ,EAAI,QAAQ,aACjB,KAAM,KAAK,MAAMl6B,EAAI,UAAU,CAChC,CAAC,CAAC,CAAC,UAAY,CACd,MAAM,IAAIxB,EAAgB,gOAAgO,CAC3P,CAAC,EACKiN,EAAMzL,EAAI,KAAO0H,GAAS,MAAM,eAAe,KAAO,QACtDkE,EAAa,MAAM0U,GAAU,KAAK,MAAMytC,CAAa,EAAGtiD,CAAG,EACjE,MAAO,CACN,MACA,IAAKzL,EAAI,GACT,YACD,CACD,CACA,eAAesuD,GAAQ,EAAK,EAAQ,CACnC,GAAM,CAAE,WAAY92B,EACd1vB,EAAU0vB,EAAO,QACjBkQ,EAAa,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACxClsB,EAAM1T,EAAQ,IAChB4T,EAAM5T,EAAQ,IACZymD,EAAajB,GAAS5lD,GAAS,KAAK,gBAAkB,MAAO8T,GAAOksB,CAAU,EACpF,IAAa6mB,EACb,IAAM9yC,EAAM3T,EAAQ,IACd0mD,EAAgB,OAAOt0B,EAAI,QAAQ,QAAQ,SAAY,SAAWA,EAAI,QAAQ,QAAQ,QAAU,GAChGu0B,EAAM3mD,EAAQ,IACd4mD,EAAahnD,GAAS,KAAK,QAAU8mD,EACrCj0C,EAAMzS,EAAQ,IACd6mD,EAAajnD,GAAS,KAAK,UAAY8mD,EAC7C,GAAI9mD,GAAS,KAAK,KAAM,CACvB,IAAMknD,EAAa,CAClB,GAAG9mD,EACH,MACA,MACA,MACA,IAAK2mD,GAAOC,EACZ,IAAKn0C,GAAOo0C,CACb,EACA,OAAOjnD,EAAQ,IAAI,KAAKknD,EAAYp3B,EAAO,OAAQ,CAClD,aAAcA,EAAO,aACrB,iBAAkBA,EAAO,gBAC1B,CAAC,CACF,CACA,GAAM,CAAE,MAAK,MAAK,cAAeA,EAAO,aAAe,MAAMy2B,GAAkB/zB,EAAKxyB,EAAS,CAC5F,aAAc8vB,EAAO,aACrB,iBAAkBA,EAAO,gBAC1B,CAAC,EACKpb,EAAM,IAAIS,GAAQ/U,CAAO,CAAC,CAAC,mBAAmB,CACnD,GAAG0vB,EAAO,OACV,MACA,KACD,CAAC,CAAC,CAAC,kBAAkB9b,CAAG,CAAC,CAAC,UAAU+yC,GAAOC,CAAU,CAAC,CAAC,YAAYn0C,GAAOo0C,CAAU,EAKpF,OAJInzC,GAAKY,EAAI,YAAYZ,CAAG,EACxB1T,EAAQ,KAAKsU,EAAI,WAAWtU,EAAQ,GAAG,EACvCA,EAAQ,KAAKsU,EAAI,aAAatU,EAAQ,GAAG,EACzCA,EAAQ,KAAKsU,EAAI,OAAOtU,EAAQ,GAAG,EAChC,MAAMsU,EAAI,KAAKxQ,CAAU,CACjC,CACA,eAAeijD,GAAY,EAAK,EAAS,CACxC,IAAM/mD,EAAWJ,GAAS,KAAK,cAA2C,MAAMA,EAAQ,IAAI,cAAcwyB,EAAI,QAAQ,OAAO,EAA9EA,EAAI,QAAQ,QAAQ,KACnE,OAAO,MAAMo0B,GAAQp0B,EAAK,CACzB,UACA,QAAS,CACR,IAAK,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EAChC,GAAGpyB,EACH,IAAK,MAAMJ,GAAS,KAAK,aAAawyB,EAAI,QAAQ,OAAO,GAAKA,EAAI,QAAQ,QAAQ,KAAK,EACxF,CACD,CAAC,CACF,CCnHA,IAAM40B,GAA2B,IAAI,IAAI,CACxC,MACA,MACA,MACA,MACA,MACA,MACA,MACA,YACA,QACA,MACA,MACA,MACA,MACA,UACA,SACA,QACD,CAAC,EASD,SAASC,GAA2B,EAAQ,CAC3C,GAAI,CAACpjB,EAAQ,MAAO,CAAC,EACrB,IAAMqjB,EAAW,CAAC,EACZC,EAAa,OAAO,OAAO,IAAI,EACrC,IAAK,GAAM,CAACjvD,EAAKC,KAAU,OAAO,QAAQ0rC,CAAM,EAC3CmjB,GAAyB,IAAI9uD,CAAG,EACnCgvD,EAAS,KAAKhvD,CAAG,EAGlB,EAAWA,GAAOC,EAGnB,OADI+uD,EAAS,OAAS,GAAGtwD,GAAO,KAAK,6DAA6DswD,EAAS,KAAK,IAAI,EAAE,kCAAkC,EACjJC,CACR,CAGA,IAAMC,GAA2Bh2D,EAASC,EAAS,EAAGC,EAAU,CAAC,CAAC,CAAC,SAAS,EACtE+1D,GAA8B91D,EAAc,CACjD,UAAWC,EAAU,CAAC,CAAC,SAAS,EAChC,MAAOH,EAAS,CAAC,CAAC,SAAS,EAC3B,OAAQI,EAAQJ,EAAS,CAAC,CAAC,CAAC,SAAS,CACtC,CAAC,CAAC,CAAC,SAAS,EACNi2D,GAA6B51D,EAAS,CAAE,IAAK21D,GAA4B,SAAS,CAAE,CAAC,CAAC,CAAC,SAASD,EAAwB,EACxHG,GAAgCh2D,EAAc,CACnD,SAAUH,EAASC,EAAS,EAAG+1D,EAAwB,CAAC,CAAC,SAAS,EAClE,SAAUE,GAA2B,SAAS,CAC/C,CAAC,EACD,SAASE,GAAwB,EAAO,CACvC,GAAI,OAAOrvD,GAAU,SAAU,GAAI,CAClC,OAAO,KAAK,MAAMA,CAAK,CACxB,MAAQ,CACP,MACD,CACA,OAAOA,CACR,CACA,SAASsvD,GAA6B,EAAO,CAC5C,IAAMxlD,EAASulD,GAAwBrvD,CAAK,EACtCgZ,EAASo2C,GAA8B,UAAUtlD,CAAM,EAC7D,OAAOkP,EAAO,QAAUA,EAAO,KAAO,IAAK,EAC5C,CACA,IAAMu2C,GAAoC/1D,EAAQ,CAACN,EAAS,EAAGD,EAASC,EAAS,EAAGC,EAAU,CAAC,CAAC,CAAC,EAC3Fq2D,GAA2BD,GAC3BE,GAA+BF,GAAkC,OAAQ,GAAUD,GAA6BtvD,CAAK,IAAM,IAAK,GAAG,CAAE,MAAO,8CAA+C,CAAC,EAClM,SAAS0vD,GAAyB,EAAO,CACxC,OAAO1vD,IAAU,IAAK,IAAKsvD,GAA6BtvD,CAAK,IAAM,IAAK,EACzE,CACA,SAAS2vD,GAA2B,EAAO,EAAiB,CAC3D,IAAMC,EAAiBN,GAA6BtvD,CAAK,CAAC,EAAE,SAC5D,GAAI,CAAC4vD,EAAgB,MAAO,CAAC,EAC7B,IAAMC,EAAQ,OAAO,KAAKD,CAAc,EACxC,GAAI,CAACE,EAAiB,OAAOD,EAC7B,IAAMh+B,EAAU,IAAI,IAAIi+B,CAAe,EACvC,OAAOD,EAAM,OAAQ,GAASh+B,EAAQ,IAAI3yB,CAAI,CAAC,CAChD,CACA,SAAS6wD,GAA8B,EAAO,EAAY,CACzD,IAAMC,EAAgBV,GAA6BtvD,CAAK,EACxD,GAAI,CAACgwD,EAAe,OAAOhwD,IAAU,IAAK,GAC1C,IAAMiwD,EAAaD,EAAc,UAAU,IAC3C,GAAI,CAACC,GAAcA,EAAW,YAAc,GAAM,MAAO,GACzD,IAAMC,EAAeD,EAAW,QAAU,IAAK,IAAKA,EAAW,QAAUE,EACnEC,EAAcH,EAAW,SAAW,IAAK,IAAKA,EAAW,OAAO,SAASE,CAAU,EACzF,OAAOD,GAAgBE,CACxB,CACA,SAASC,GAAkC,EAAO,EAAuB,CACxE,IAAML,EAAgBV,GAA6BtvD,CAAK,EACxD,GAAI,CAACgwD,EAAe,OACpB,IAAMM,EAAkB,IAAI,IAAIC,CAAqB,EAC/CX,EAAiB,OAAO,YAAY,OAAO,QAAQI,EAAc,UAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAACroD,KAAW2oD,EAAgB,IAAI3oD,CAAK,CAAC,CAAC,EAChI6oD,EAAwB,OAAO,KAAKZ,CAAc,CAAC,CAAC,OAAS,CAClE,GAAGI,EACH,SAAUJ,CACX,EAAI,OAAO,YAAY,OAAO,QAAQI,CAAa,CAAC,CAAC,QAAQ,CAACjwD,KAASA,IAAQ,UAAU,CAAC,EAC1F,OAAO,OAAO,KAAKywD,CAAqB,CAAC,CAAC,OAASA,EAAwB,IAAK,EACjF,CAGA,SAASC,GAAiB,EAAM,CAC/B,IAAMjwC,EAAQthB,EAAK,MAAM,GAAG,CAAC,CAAC,OAAQ,GAASihC,IAAS,EAAE,EAE1D,OADI3f,EAAM,QAAU,EAAU,CAAC,EACxB,CACN,MAAOA,EAAM,MAAM,EAAG,EAAE,CAAC,CAAC,KAAK,GAAG,EAClC,OAAQA,EAAM,GAAG,EAAE,CACpB,CACD,CAiBA,IAAMkwC,GAAkB,CACvB,KAAM,CACL,MAAO,UACP,QAAU,GAASxT,EAAK,MAAQ,IAAK,EACtC,EACA,QAAS,CACR,MAAO,UACP,QAAU,GAASA,EAAK,OAAS,IAAK,EACvC,EACA,WAAY,CACX,MAAO,UACP,QAAU,GAASuT,GAAiBvT,EAAK,IAAI,CAAC,CAAC,KAChD,EACA,YAAa,CACZ,MAAO,UACP,QAAU,GAASuT,GAAiBvT,EAAK,IAAI,CAAC,CAAC,MAChD,EACA,MAAO,CACN,MAAO,QACP,QAAU,GAASA,EAAK,OAAS,IAAK,EACvC,EACA,eAAgB,CACf,MAAO,QACP,QAAU,GAASA,EAAK,eAAiB,EAC1C,CACD,EACMyT,GAAuB,OAAO,KAAKD,EAAe,EAQxD,SAASE,GAAmB,EAAM,CACjC,OAAO5rC,EAAK,oBAAoB,kBAAoBA,EAAK,QAAU,CAAC,CACrE,CAcA,IAAM6rC,GAA+B,IAAI,IAAI,CAC5C,MACA,MACA,MACA,MACA,MACA,MACA,YACA,QACA,YACA,MACA,MACA,KACD,CAAC,EAQD,SAASC,GAAoB,EAAQ,CACpC,GAAI,CAACplB,EAAQ,MAAO,CAAC,EACrB,IAAMqjB,EAAW,CAAC,EACZgC,EAAO,CAAC,EACd,IAAK,GAAM,CAAChxD,EAAKC,KAAU,OAAO,QAAQ0rC,CAAM,EAC3CmlB,GAA6B,IAAI9wD,CAAG,EACvCgvD,EAAS,KAAKhvD,CAAG,EAGlB,EAAKA,GAAOC,EAGb,OADI+uD,EAAS,OAAS,GAAGtwD,GAAO,KAAK,iEAAiEswD,EAAS,KAAK,IAAI,EAAE,kCAAkC,EACrJgC,CACR,CAgBA,eAAeC,GAAyB,EAAO,CAC9C,GAAM,CAAE,MAAK,OAAM,OAAM,SAAQ,SAAQ,YAAW,cAAa,WAAU,YAAW,YAAW,mBAAkB,wBAAyBjqD,EACtIkqD,EAAkB,MAAMrlB,GAAkC5mB,EAAM,CACrE,MACA,OACA,OACA,SACA,SACA,YACA,cACA,YACA,YACA,UACD,CAAC,EACKksC,EAAelsC,EAAK,wBAA0B,MAAMA,EAAK,wBAAwB,CACtF,OACA,SACA,YACA,cACA,UACD,CAAC,EAAI,CAAC,EACN,OAAO8rC,GAAoB,CAC1B,GAAGG,EACH,GAAGE,GAAoB,CAAC,EACxB,GAAGD,EACH,GAAGE,CACJ,CAAC,CACF,CAGA,IAAMC,GAAoB,CACzB,cACA,QACA,WACD,EAQMC,GAAoBp4D,EAAS,CAAC,CAAC,aAAa,EAAK,IAAQ,CAC9D,GAAI,CAAC,IAAI,SAAS05B,CAAG,EAMpB,OALAqH,EAAI,SAAS,CACZ,KAAM,SACN,QAAS,mCACT,MAAO,EACR,CAAC,EACMxgC,EAEJm5B,EAAI,SAAS,GAAG,EACnBqH,EAAI,SAAS,CACZ,KAAM,SACN,QAAS,sCACV,CAAC,EAGEo3B,GAAkB,SAAS,IAAI,IAAIz+B,CAAG,CAAC,CAAC,QAAQ,GAAGqH,EAAI,SAAS,CACnE,KAAM,SACN,QAAS,6DACV,CAAC,CACF,CAAC,EACKs3B,GAAiC73D,EAAO,CAC7C,OACA,UACA,QACA,SACA,gBACD,CAAC,EACK83D,GAA4Bt4D,EAAS,CAAC,CAAC,aAAa,EAAO,IAAQ,CACxE,IAAMu4D,EAAezxD,EAAM,MAAM,GAAG,CAAC,CAAC,IAAK,GAAUyV,EAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,EAC3Ei8C,EAA4B,IAAI,IACtC,GAAI,CAACD,EAAa,OACjBx3B,EAAI,SAAS,CACZ,KAAM,SACN,QAAS,wCACV,CAAC,MAGF,KAAK,IAAMxkB,KAASg8C,EAAc,CACjC,IAAMz4C,EAASu4C,GAA+B,UAAU97C,CAAK,EACxDuD,EAAO,QAOZ04C,EAAU,IAAI14C,EAAO,IAAI,EANxBihB,EAAI,SAAS,CACZ,KAAM,SACN,QAAS,6BAA6BxkB,GACvC,CAAC,CAIH,CACIi8C,EAAU,IAAI,MAAM,GAAKA,EAAU,KAAO,GAAGz3B,EAAI,SAAS,CAC7D,KAAM,SACN,QAAS,yDACV,CAAC,CAJD,CAKD,CAAC,EAEK03B,GAAmBp4D,EAAS,CAAE,KAAMD,EAAQL,EAASC,EAAS,EAAGC,EAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAE,CAAC,EACvFy4D,GAAep4D,EAAQ,CAACG,EAAS,EAAGT,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAO,IAAQ,CAC9F,IAAM+rD,EAAS,OAAOjlD,GAAU,SAAWA,EAAQ,OAAOA,CAAK,EAQ/D,MAPI,CAAC,OAAO,UAAUilD,CAAM,GAAKA,EAAS,GACzChrB,EAAI,SAAS,CACZ,KAAM,SACN,QAAS,wCACV,CAAC,EACMxgC,GAEDwrD,CACR,CAAC,EACK4M,GAAgB34D,EAAS,CAAC,CAAC,MAAM,sBAAuB,6DAA6D,EAKrH44D,GAA2Bv4D,EAAS,CACzC,cAAeL,EAAS,CAAC,CAAC,KAAKQ,EAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAC1D,QAASR,EAAS,CAAC,CAAC,SAAS,EAC7B,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,aAAc6zD,EAAc,SAAS,EACrC,MAAO7zD,EAAS,CAAC,CAAC,SAAS,EAC3B,MAAOA,EAAS,CAAC,CAAC,SAAS,EAC3B,UAAWA,EAAS,CAAC,CAAC,IAAI,EAAG,uBAAuB,EACpD,OAAQs4D,GAA0B,SAAS,EAC3C,QAASt4D,EAAS,CAAC,CAAC,SAAS,EAC7B,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,QAAS04D,GAAa,SAAS,EAC/B,WAAY14D,EAAS,CAAC,CAAC,SAAS,EAChC,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,cAAeA,EAAS,CAAC,CAAC,SAAS,EACnC,eAAgBA,EAAS,CAAC,CAAC,SAAS,EACpC,sBAAuBA,EAAS,CAAC,CAAC,KAAKQ,EAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAClE,MAAOR,EAAS,CAAC,CAAC,SAAS,EAC3B,OAAQs2D,GAAyB,SAAS,EAC1C,SAAUqC,GAAc,SAAS,EACjC,SAAUr4D,EAAQ,CAAC83D,GAAmBh4D,EAAQg4D,EAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACpF,CAAC,CAAC,CAAC,YAAY,EACTS,GAAiCD,GAAyB,OAAO,CACtE,aAAc/E,EAAc,SAAS,EACrC,OAAQ0C,GAA6B,SAAS,CAC/C,CAAC,EAMKuC,GAA0Bz4D,EAAS,CACxC,KAAMK,EAAU,oBAAoB,EACpC,MAAOm4D,GACP,UAAW74D,EAAS,EACpB,OAAQA,EAAS,EACjB,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,SAAUS,EAAS,CAAC,CAAC,SAAS,EAC9B,SAAUL,EAAQJ,EAAS,CAAC,CAAC,CAAC,SAAS,CACxC,CAAC,CAAC,CAAC,YAAY,EAcT+4D,GAAkC14D,EAAS,CAChD,cAAeD,EAAQyzD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACtD,MAAO7zD,EAAS,CAAC,CAAC,SAAS,EAC3B,YAAaA,EAAS,CAAC,CAAC,OAAQ,GAAU8G,EAAM,KAAK,CAAC,CAAC,OAAS,EAAG,6BAA6B,CAAC,CAAC,SAAS,EAC3G,WAAY9G,EAAS,CAAC,CAAC,SAAS,EAChC,SAAUA,EAAS,CAAC,CAAC,SAAS,EAC9B,SAAUI,EAAQJ,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACrD,QAASA,EAAS,CAAC,CAAC,SAAS,EAC7B,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,mBAAoBA,EAAS,CAAC,CAAC,SAAS,EACxC,0BAA2BI,EAAQyzD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAClE,uBAAwBA,EAAc,SAAS,EAC/C,oCAAqC1zD,EAAU,CAAC,CAAC,SAAS,EAC1D,2BAA4BH,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC9D,KAAMy4D,GAAiB,SAAS,EAChC,SAAUz4D,EAAS,CAAC,CAAC,SAAS,EAC9B,YAAaI,EAAQJ,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC/D,eAAgBI,EAAQI,EAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EACnD,iBAAkBA,EAAO,CAAC,MAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,EACrD,aAAcA,EAAO,CAAC,SAAU,UAAU,CAAC,CAAC,CAAC,SAAS,EACtD,yBAA0BL,EAAU,CAAC,CAAC,SAAS,EAC/C,UAAWC,EAAQg4D,EAAiB,CAAC,CAAC,SAAS,EAC/C,aAAcz3D,EAAQ,CAAE,MAAO,+DAAgE,CAAC,CAAC,CAAC,SAAS,CAC5G,CAAC,EAWiCo4D,GAAgC,KAAK,CAAE,aAAc,EAAK,CAAC,CAAC,CAAC,OAAO,CACrG,UAAW/4D,EAAS,CAAC,CAAC,OAAQ,GAAU8G,EAAM,KAAK,CAAC,CAAC,OAAS,EAAG,2BAA2B,EAC5F,cAAe9G,EAAS,CAAC,CAAC,SAAS,EACnC,yBAA0BS,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,EAClE,oBAAqBA,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,CAC9D,CAAC,CAAC,CAAC,MAAM,EAaT,IAAMu4D,GAAiB,CACtB,QACA,QACA,QACA,QACA,OACD,EACMC,GAAoB,IAAI,IAAID,EAAc,EAe1CE,GAAiB,GAUvB,eAAeC,GAAgB,EAAM,EAAY,CAChD,IAAMC,EAAkBttC,EAAK,oBAC7B,GAAIstC,EAKH,OAJK,MAAMA,EAAgBC,CAAU,EAI9B,CAAE,GAAI,EAAK,EAJ6B,CAC9C,GAAI,GACJ,OAAQ,uBAAuBA,EAAW,mBAC3C,EAGD,IAAMzoD,EAASwnD,GAAkB,UAAUiB,CAAU,EAKrD,OAJKzoD,EAAO,QAIL,CAAE,GAAI,EAAK,EAJU,CAC3B,GAAI,GACJ,OAAQ,uBAAuByoD,EAAW,eAAezoD,EAAO,MAAM,OAAO,EAAE,EAAE,SAAW,uBAC7F,CAED,CAOA,eAAe0oD,GAAsB,EAAM,EAAY,CACtD,IAAMx5C,EAAS,MAAMq5C,GAAgBrtC,EAAMutC,CAAU,EACrD,GAAI,CAACv5C,EAAO,GAAI,MAAM,IAAIlf,EAAS,cAAe,CACjD,MAAO,iBACP,kBAAmBkf,EAAO,MAC3B,CAAC,CACF,CAMA,IAAMy5C,GAAoB,GAAY,GAAGjyB,EAAQ,kBAuBjD,eAAekyB,GAAgC,EAAS,CACvD,GAAI,EAAElhC,EAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,GAAK,GAAA,CAAI,SAAS,mCAAmC,EAAG,OAC/G,IAAImQ,EACJ,GAAI,CACH,EAAO,MAAMnQ,EAAQ,MAAM,CAAC,CAAC,KAAK,CACnC,MAAQ,CACP,MACD,CACA,GAAI,CAACmQ,EAAM,OACX,IAAM2I,EAAS,IAAI,gBAAgB3I,CAAI,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAQ,GAAU3hC,EAAM,OAAS,CAAC,EAC9F,OAAOsqC,EAAO,OAAS,EAAIA,EAAS,IAAK,EAC1C,CAOA,SAASqoB,GAAuB,EAAU,CACzC,GAAIC,GAAoC,KACxC,IAAI,OAAOA,GAAa,SAAU,MAAO,CAACA,CAAQ,EAClD,GAAI,MAAM,QAAQA,CAAQ,EAAG,CAC5B,IAAM55C,EAAS45C,EAAS,OAAQ,GAAM,OAAOtoC,GAAM,UAAYA,EAAE,OAAS,CAAC,EAC3E,OAAOtR,EAAO,OAAS,EAAIA,EAAS,IAAK,EAC1C,CAJkD,CAKnD,CAUA,eAAe65C,GAAuB,EAAK,EAAM,EAAe,EAAoB,CAAC,EAAG,CACvF,GAAIC,IAAkB,IAAK,GAAG,MAAO,GACrC,IAAMC,EAAiB,MAAM,QAAQD,CAAa,EAAIA,EAAgB,CAACA,CAAa,EACpF,GAAIC,EAAe,OAASX,GAAgB,MAAO,GACnD,IAAMY,EAAsB,IAAI,IAAIC,CAAiB,EAC/CC,EAAoC,IAAI,IAC9C,IAAK,IAAMC,KAAiBJ,EACvBC,EAAoB,IAAIG,CAAa,GACzCD,EAAkB,IAAIC,CAAa,EAGpC,OADID,EAAkB,OAAS,IACvB,MAAM,QAAQ,IAAI,MAAM,KAAKA,EAAoB,GAAaE,GAAYn5B,EAAKjV,EAAM4tC,CAAQ,CAAC,CAAC,EAAA,CAAG,MAAM,OAAO,CACxH,CA0BA,eAAeS,GAAsB,EAAK,EAAM,EAAQ,CACvD,IAAMC,EAAqBX,GAAuB9zD,EAAO,QAAQ,EAC3D00D,EAAiB10D,EAAO,gBAAgB,SAAS,QAAQ,EACzD20D,EAA6Bf,GAAiBx4B,EAAI,QAAQ,SAAW,EAAE,EAC7E,GAAI,CAACq5B,EAAoB,MAAO,CAC/B,cAAe,IAAK,GACpB,eAAgB,KAChB,gBAAiB,KACjB,iBAAkB,KAClB,aAAc,KACd,gBAAiB,CAAC,EAClB,8BAA+B,GAC/B,gBAAiB,CAAC,GAAGz0D,EAAO,eAAe,CAC5C,EACA,IAAM40D,EAA2B,CAAC,GAAG,IAAI,IAAIH,CAAkB,CAAC,EAC1D5lB,EAAW,CAAC,EAClB,IAAK,IAAM6kB,KAAckB,EAA0B,CAClD,GAAIlB,IAAeiB,EAA4B,SAC/C,IAAME,EAAM,MAAMN,GAAYn5B,EAAKjV,EAAMutC,CAAU,EACnD,GAAImB,EAAK,CACR,GAAIA,EAAI,SAAU,MAAM,IAAI55D,EAAS,cAAe,CACnD,MAAO,iBACP,kBAAmB,sBAAsBy4D,EAAW,aACrD,CAAC,EACD7kB,EAAS,KAAKgmB,CAAG,CAElB,MACA,MAAM,IAAI55D,EAAS,cAAe,CACjC,MAAO,iBACP,kBAAmB,sBAAsBy4D,EAAW,mBACrD,CAAC,CACF,CACA,GAAM,CAAE,MAAOoB,GAAqBC,GAAiC5uC,CAAI,EACrE2uC,GAAoBjmB,EAAS,OAAS,GAAG,MAAMmmB,GAA8B55B,EAAKjV,EAAMnmB,EAAO,SAAU6uC,CAAQ,EACrH,IAAIomB,EAAkB,CAAC,GAAGj1D,EAAO,eAAe,EAChD,IAAK,IAAM60D,KAAOhmB,EAAU,CAC3B,GAAIgmB,EAAI,gBAAkB,MAAQA,EAAI,gBAAkB,IAAK,GAAG,SAChE,IAAM7hC,EAAU,IAAI,IAAI6hC,EAAI,aAAa,EACnCK,EAAeD,EAAgB,OAAQ,GAAMjiC,EAAQ,IAAIznB,CAAC,CAAC,EACjE,GAAI2pD,EAAa,SAAW,EAAG,MAAM,IAAIj6D,EAAS,cAAe,CAChE,MAAO,gBACP,kBAAmB,yDAAyD45D,EAAI,YACjF,CAAC,EACD,EAAkBK,CACnB,CACA,IAAIC,EAAiB,KACjBC,EAAkB,KACtB,IAAK,IAAMP,KAAOhmB,EACbgmB,EAAI,gBAAkB,OAAM,EAAiBM,IAAmB,KAAON,EAAI,eAAiB,KAAK,IAAIM,EAAgBN,EAAI,cAAc,GACvIA,EAAI,iBAAmB,OAAM,EAAkBO,IAAoB,KAAOP,EAAI,gBAAkB,KAAK,IAAIO,EAAiBP,EAAI,eAAe,GAElJ,IAAMQ,EAAoC,IAAI,IACxCC,EAAoC,IAAI,IAC9C,IAAK,IAAMT,KAAOhmB,EACbgmB,EAAI,kBAAkBQ,EAAkB,IAAIR,EAAI,gBAAgB,EAChEA,EAAI,cAAcS,EAAkB,IAAIT,EAAI,YAAY,EAE7D,GAAIQ,EAAkB,KAAO,EAAG,MAAM,IAAIp6D,EAAS,cAAe,CACjE,MAAO,kBACP,kBAAmB,yHACpB,CAAC,EACD,GAAIq6D,EAAkB,KAAO,EAAG,MAAM,IAAIr6D,EAAS,cAAe,CACjE,MAAO,kBACP,kBAAmB,kHACpB,CAAC,EACD,IAAMs6D,EAAmBF,EAAkB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAS,KAC9DG,EAAeF,EAAkB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAS,KAC1DG,EAAe,CAAC,EACtB,IAAK,IAAMZ,KAAOhmB,EAAcgmB,EAAI,cAAgB,OAAOA,EAAI,cAAiB,UAAU,OAAO,OAAOY,EAAcZ,EAAI,YAAY,EACtI,IAAMa,EAAgC7mB,EAAS,KAAM,GAAQgmB,EAAI,gCAAkC,EAAI,EACjGc,EAAsBjB,EAAiB,CAAC,GAAGE,EAA0BD,CAA0B,EAAIC,EACnGgB,EAAW,CAAC,GAAG,IAAI,IAAID,CAAmB,CAAC,EACjD,MAAO,CACN,cAAeC,EAAS,SAAW,EAAIA,EAAS,GAAKA,EACrD,iBACA,kBACA,mBACA,eACA,gBAAiBH,EACjB,gCACA,iBACD,CACD,CAOA,eAAeT,GAA8B,EAAK,EAAM,EAAU,EAAW,CAC5E,GAAIa,EAAU,SAAW,EAAG,OAC5B,IAAM3X,EAAY/3B,EAAK,QAAQ,qBAAqB,WAAa,sBAC3D2vC,EAAQ,MAAM16B,EAAI,QAAQ,QAAQ,SAAS,CAChD,MAAO8iB,EACP,MAAO,CAAC,CACP,MAAO,WACP,MAAO1e,CACR,CAAC,CACF,CAAC,EACKu2B,EAAY,IAAI,IAAID,GAAO,IAAK,GAAM1xD,EAAE,UAAU,GAAK,CAAC,CAAC,EACzD4xD,EAAWH,EAAU,OAAQ,GAAa,CAACE,EAAU,IAAIhC,EAAS,UAAU,CAAC,EACnF,GAAIiC,EAAS,OAAS,EAAG,MAAM,IAAI/6D,EAAS,cAAe,CAC1D,MAAO,iBACP,kBAAmB,UAAUukC,EAAS,gCAAgCw2B,EAAS,IAAK,GAAajC,EAAS,UAAU,CAAC,CAAC,KAAK,IAAI,GAChI,CAAC,CACF,CASA,eAAekC,GAA4B,EAAK,EAAM,EAAU,EAAqB,CACpF,GAAIC,EAAoB,SAAW,EAAG,MAAO,GAC7C,IAAMhY,EAAY/3B,EAAK,QAAQ,qBAAqB,WAAa,sBACjE,QAAS,MAAMiV,EAAI,QAAQ,QAAQ,SAAS,CAC3C,MAAO8iB,EACP,MAAO,CAAC,CACP,MAAO,WACP,MAAO1e,CACR,EAAG,CACF,MAAO,aACP,SAAU,KACV,MAAO02B,CACR,CAAC,EACD,MAAO,CACR,CAAC,EAAA,EAAI,QAAU,GAAK,CACrB,CAaA,eAAeC,GAAwB,EAAK,EAAM,EAAqB,CACtE,GAAID,EAAoB,SAAW,EAAG,MAAO,CAAC,EAC9C,IAAME,EAAO,MAAMh7B,EAAI,QAAQ,QAAQ,SAAS,CAC/C,MAAOjV,EAAK,QAAQ,eAAe,WAAa,gBAChD,MAAO,CAAC,CACP,MAAO,aACP,SAAU,KACV,MAAO+vC,CACR,CAAC,CACF,CAAC,EACKG,EAAkB,IAAI,IAAID,EAAK,IAAK,GAAQ,CAACvB,EAAI,WAAYA,CAAG,CAAC,CAAC,EAClE1xB,EAAS,CAAC,EAChB,IAAK,IAAMuwB,KAAcwC,EAAqB,CAC7C,IAAMrB,EAAMwB,EAAgB,IAAI3C,CAAU,EACtCmB,GAAK,cAAgB,OAAOA,EAAI,cAAiB,UAAU,OAAO,OAAO1xB,EAAQ0xB,EAAI,YAAY,CACtG,CACA,OAAO1xB,CACR,CAUA,SAAS4xB,GAAiC,EAAM,CAK/C,OAJI5uC,EAAK,4BAA8B,IAAK,GAIrC,CACN,MAAO,GACP,OAAQ,SACT,EAPsD,CACrD,MAAOA,EAAK,0BACZ,OAAQ,UACT,CAKD,CAYA,IAAMmwC,GAAgC,IAAI,IAO1C,SAASC,GAAwB,EAAY,CACxC7C,IAAe,IAAK,GACvB4C,GAAc,MAAM,EAGrBA,GAAc,OAAO5C,CAAU,CAChC,CAcA,eAAea,GAAY,EAAK,EAAM,EAAY,CAEjD,GADA,MAAMiC,GAAkBp7B,EAAI,QAASjV,CAAI,EACrCA,EAAK,iBAAiB,IAAIutC,CAAU,EAAG,CAC1C,IAAMjmD,EAAS6oD,GAAc,IAAI5C,CAAU,EAC3C,GAAIjmD,EAAQ,OAAO,OAAO,OAAO,CAAC,EAAGA,CAAM,CAC5C,CACA,IAAMgpD,EAAa,MAAMr7B,EAAI,QAAQ,QAAQ,QAAQ,CACpD,MAAOjV,EAAK,QAAQ,eAAe,WAAa,gBAChD,MAAO,CAAC,CACP,MAAO,aACP,MAAOutC,CACR,CAAC,CACF,CAAC,EAED,OADI+C,GAActwC,EAAK,iBAAiB,IAAIutC,CAAU,GAAG4C,GAAc,IAAI5C,EAAY,OAAO,OAAO,CAAC,EAAG+C,CAAU,CAAC,EAC7GA,CACR,CAKA,SAASC,GAAY,EAAO,CAC3B,OAAOxuD,EAAM,MAAQA,EAAM,UAC5B,CAOA,SAASyuD,GAAsB,EAAM,CACpC,IAAMC,EAAS,CAAC,EAChB,GAAIzwC,EAAK,WAAW,OAAQ,IAAK,IAAM3Z,KAAS2Z,EAAK,UAAWywC,EAAO,KAAK,OAAOpqD,GAAU,SAAW,CAAE,WAAYA,CAAM,EAAIA,CAAK,EACrI,OAAOoqD,CACR,CAMA,SAASC,GAAa,EAAO,EAAK,CACjC,MAAO,CACN,WAAY3uD,EAAM,WAClB,KAAMwuD,GAAYxuD,CAAK,EACvB,eAAgBA,EAAM,gBAAkB,KACxC,gBAAiBA,EAAM,iBAAmB,KAC1C,iBAAkBA,EAAM,kBAAoB,KAC5C,aAAcA,EAAM,cAAgB,KACpC,cAAeA,EAAM,eAAiB,KACtC,aAAcA,EAAM,cAAgB,KACpC,8BAA+BA,EAAM,+BAAiC,GACtE,SAAUA,EAAM,UAAY,GAC5B,cAAe,EACf,SAAUA,EAAM,UAAY,KAC5B,UAAWsU,EACX,UAAWA,CACZ,CACD,CASA,SAASs6C,GAAgB,EAAO,EAAM,EAAK,CAC1C,GAAIziD,IAAS,YAAa,CACzB,GAAM,CAAE,WAAY0iD,EAAa,UAAWC,EAAY,GAAG/X,GAAS4X,GAAa3uD,EAAOsU,CAAG,EAC3F,OAAOyiC,CACR,CACA,IAAMgY,EAAS,CAAE,UAAWz6C,CAAI,EAWhC,OAVItU,EAAM,OAAS,IAAK,KAAG,EAAO,KAAOA,EAAM,MAC3CA,EAAM,iBAAmB,IAAK,KAAG,EAAO,eAAiBA,EAAM,gBAC/DA,EAAM,kBAAoB,IAAK,KAAG,EAAO,gBAAkBA,EAAM,iBACjEA,EAAM,mBAAqB,IAAK,KAAG,EAAO,iBAAmBA,EAAM,kBACnEA,EAAM,eAAiB,IAAK,KAAG,EAAO,aAAeA,EAAM,cAC3DA,EAAM,gBAAkB,IAAK,KAAG,EAAO,cAAgBA,EAAM,eAC7DA,EAAM,eAAiB,IAAK,KAAG,EAAO,aAAeA,EAAM,cAC3DA,EAAM,gCAAkC,IAAK,KAAG,EAAO,8BAAgCA,EAAM,+BAC7FA,EAAM,WAAa,IAAK,KAAG,EAAO,SAAWA,EAAM,UACnDA,EAAM,WAAa,IAAK,KAAG,EAAO,SAAWA,EAAM,UAChD+uD,CACR,CAUA,IAAMC,GAAwB,+HAO9B,SAASC,GAAsB,EAAK,EAAO,CAC1C,IAAIC,EAAe,GACfC,EAAU//C,EACd,IAAK,IAAI0hB,EAAQ,EAAGq+B,GAAW,CAACD,GAAgBp+B,EAAQ,EAAG,IAC1D,EAAek+B,GAAsB,KAAKG,aAAmB,MAAQA,EAAQ,QAAU,OAAOA,CAAO,CAAC,EACtG,EAAUA,aAAmB,MAAQA,EAAQ,MAAQ,IAAK,GAEvDD,EACHh8B,EAAI,OAAO,MAAM,+FAA+F,EAGjHA,EAAI,OAAO,MAAM,4FAA6F9jB,CAAK,CACpH,CASA,IAAIggD,GAA6B,IAAI,QACrC,SAASC,GAAa,EAAK,EAAM,CAChC,IAAMC,EAAap8B,EAAI,QACnBq8B,EAAYH,GAAW,IAAIE,CAAU,EACpCC,IACJ,EAA4B,IAAI,QAChCH,GAAW,IAAIE,EAAYC,CAAS,GAErC,IAAMt4B,EAAWs4B,EAAU,IAAItxC,CAAI,EACnC,GAAIgZ,EAAU,OAAOA,EACrB,IAAMu4B,EAAU,CACf,UAAW,GACX,QAAS,IACV,EAEA,OADAD,EAAU,IAAItxC,EAAMuxC,CAAO,EACpBA,CACR,CA4BA,eAAeC,GAAc,EAAK,EAAM,CACvC,IAAMf,EAASD,GAAsBxwC,CAAI,EACzC,GAAIywC,EAAO,SAAW,EAAG,OACzB,IAAMviD,EAAO8R,EAAK,kBAAoB,aAChC+3B,EAAY/3B,EAAK,QAAQ,eAAe,WAAa,gBAC3D,IAAK,IAAMyxC,KAAYhB,EAAQ,CAC9B,IAAM32C,EAAQ,MAAMuzC,GAAgBrtC,EAAMyxC,EAAS,UAAU,EAC7D,GAAI,CAAC33C,EAAM,GAAI,CACdrgB,GAAO,KAAK,8CAA8Cg4D,EAAS,WAAW,KAAK33C,EAAM,QAAQ,EACjG,QACD,CACA,IAAI/X,EAAQ0vD,EACZ,GAAI1vD,EAAM,kBAAoB,MAAQ,CAACorD,GAAkB,IAAIprD,EAAM,gBAAgB,EAAG,CACrFtI,GAAO,KAAK,0DAA0DsI,EAAM,iBAAiB,iBAAiBA,EAAM,WAAW,oBAAoBmrD,GAAe,KAAK,IAAI,EAAE,4CAA4C,EACzN,GAAM,CAAE,iBAAkB56B,EAAG,GAAGwmB,GAAS/2C,EACzC,EAAQ+2C,CACT,CACA,IAAM4Y,EAAQ,CAAC,CACd,MAAO,aACP,MAAO3vD,EAAM,UACd,CAAC,EACKi3B,EAAW,MAAM/D,EAAI,QAAQ,QAAQ,CAC1C,MAAO8iB,EACP,OACD,CAAC,EACK1hC,EAAsB,IAAI,KAChC,GAAI,CAAC2iB,EAAU,GAAI,CAClB,MAAM/D,EAAI,QAAQ,OAAO,CACxB,MAAO8iB,EACP,KAAM2Y,GAAa3uD,EAAOsU,CAAG,CAC9B,CAAC,EACD,QACD,OAAS7E,EAAK,CACb,GAAI,CAAC,MAAMyjB,EAAI,QAAQ,QAAQ,CAC9B,MAAO8iB,EACP,OACD,CAAC,CAAC,CAAC,UAAY,IAAI,EAAG,MAAMvmC,CAC7B,CACItD,IAAS,cACb,MAAM+mB,EAAI,QAAQ,OAAO,CACxB,MAAO8iB,EACP,QACA,OAAQ4Y,GAAgB5uD,EAAOmM,EAAMmI,CAAG,CACzC,CAAC,CACF,CACD,CASA,eAAeg6C,GAAkB,EAAK,EAAM,CAC3C,IAAMhxD,EAAQ+xD,GAAan8B,EAAKjV,CAAI,EACpC,GAAI3gB,EAAM,YAAc,GAQxB,OAPIA,EAAM,UAAY,OACtB,EAAM,QAAUmyD,GAAcv8B,EAAKjV,CAAI,CAAC,CAAC,SAAW,CACnD,EAAM,UAAY,EACnB,CAAC,CAAC,CAAC,MAAO,GAAQ,CAEjB,KADA,GAAM,QAAU,KACVxO,CACP,CAAC,GACMnS,EAAM,OACd,CASA,SAASsyD,GAAuC,EAAM,CACrD,IAAMjpB,EAAWkmB,GAAiC5uC,CAAI,EACtDvmB,GAAO,KAAK,yDAAyDivC,EAAS,MAAM,IAAIA,EAAS,OAAO,EAAE,CAC3G,CAGA,SAASkpB,GAAgB,EAAK,CAC7B,OAAO38B,EAAI,SAAS,IAAI,MAAM,GAAK,IAAK,EACzC,CACA,SAAS48B,GAAe,EAAK,EAAM,CAClC,OAAO58B,EAAI,SAAS,KAAO,GAAGA,EAAI,QAAQ,UAAUhG,GACrD,CAGA,IAAM6iC,GAAwB,IAAI,IAAI,CACrC,SACA,UACA,QACA,gBACD,CAAC,EACD,SAASC,GAAqB,EAAO,CACpC,OAAOD,GAAsB,IAAIn5B,CAAK,CACvC,CACA,SAASq5B,GAAiC,EAAQ,CACjD,MAAO,CAAC,GAAG,IAAI,IAAItnB,EAAO,IAAK,GAAU/R,EAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CACxE,CACA,SAASs5B,GAAgC,EAAQ,EAAY,EAAyB,EAAM,CAC3F,GAAIvnB,EAAO,SAAW,EAAG,OACzB,GAAI,CAAC/F,EAAW,SAAS,oBAAoB,EAAG,MAAM,IAAI7vC,EAAS,cAAe,CACjF,MAAO,0BACP,kBAAmB,iEACpB,CAAC,EACD,GAAIo9D,IAA4B,OAAQ,MAAM,IAAIp9D,EAAS,cAAe,CACzE,MAAO,0BACP,kBAAmB,6DACpB,CAAC,EACD,IAAMq9D,EAAiB,IAAI,IAAInyC,EAAK,QAAU,CAAC,CAAC,EAC1CoyC,EAAgB1nB,EAAO,OAAQ,GAAU,CAACynB,EAAe,IAAIx5B,CAAK,GAAKo5B,GAAqBp5B,CAAK,CAAC,EACxG,GAAIy5B,EAAc,OAAS,EAAG,MAAM,IAAIt9D,EAAS,cAAe,CAC/D,MAAO,gBACP,kBAAmB,wDAAwDs9D,EAAc,KAAK,IAAI,GACnG,CAAC,CACF,CAaA,SAASC,GAAiB,EAAM,EAAQ,EAAkB,CAAC,EAAG,CAC7D,IAAMC,EAAY,IAAI,IAAIC,CAAe,EACnC7rB,EAAS,CAAE,IAAKwR,EAAK,IAAM,IAAK,EAAE,EACxC,IAAK,GAAM,CAACh+C,EAAMs4D,KAAe,OAAO,QAAQ9G,EAAe,GAAOhhB,EAAO,SAAS8nB,EAAW,KAAK,GAAKF,EAAU,IAAIp4D,CAAI,KAAG,EAAOA,GAAQs4D,EAAW,QAAQta,CAAI,GACtK,OAAOxR,CACR,CAgBA,SAAS+rB,GAAW,EAAQ,EAAM,CACjC,IAAMv5B,EAAO,CAAC,EACd,IAAK,GAAM,CAACn+B,EAAKC,KAAU,OAAO,QAAQ0rC,GAAU,CAAC,CAAC,EACjD1rC,IAAU,IAAK,KACf03D,GAAQ33D,KAAO23D,IACnB,EAAK33D,GAAOC,IAEb,OAAOk+B,CACR,CACA,SAASy5B,GAAuB,EAAK,CACpC,IAAM74B,EAAgB7E,EAAI,SAAS,IAAI,eAAe,EAChD29B,EAAiC/xB,GAA8B/G,CAAa,EAC5E+4B,EAAY59B,EAAI,SAAS,SAAW,OAASA,EAAI,MAAM,cAAgB,IAAK,GAAI,IAAK,GAC3F,GAAI29B,GAAkCC,EAAW,MAAM,IAAI/9D,EAAS,cAAe,CAClF,kBAAmB,0DACnB,MAAO,iBACR,CAAC,EACD,IAAMg+D,EAA2BF,IAAmCC,EAAY,CAC/E,OAAQ,SACR,MAAOA,CACR,EAAI,IAAK,IACT,MAAO,CACN,cAAeC,EACf,MAAOA,GAA0B,KAClC,CACD,CAIA,eAAeC,GAAiB,EAAK,EAAM,CAC1C,GAAM,CAAE,cAAeD,GAA6BH,GAAuB19B,CAAG,EAC9E,GAAI,CAAC69B,GAA0B,MAAO,MAAM,IAAIh+D,EAAS,eAAgB,CACxE,kBAAmB,yBACnB,MAAO,iBACR,CAAC,EACD,GAAM,CAAE,QAASqiB,EAAK,wBAAyBo7C,GAAoB,MAAMS,GAAmC/9B,EAAKjV,EAAM8yC,EAAyB,KAAK,EACrJ,GAAIvxB,GAAsBpqB,CAAG,GAAK,CAAC8d,EAAI,QAAS,MAAM,IAAIngC,EAAS,eAAgB,CAClF,kBAAmB,2DACnB,MAAO,eACR,CAAC,EACD,GAAI,CACH,MAAMouC,GAAmB,CACxB,QAAS/rB,EACT,cAAe27C,EACf,SAAUlB,GAAgB38B,CAAG,EAC7B,OAAQA,EAAI,SAAS,QAAU,MAC/B,IAAK48B,GAAe58B,EAAK,kBAAkB,EAC3C,mBAAoBjV,EAAK,MAAM,mBAC/B,kBAAmBA,EAAK,MAAM,kBAC9B,YAAaygB,GAAsBxL,EAAI,QAAQ,eAAe,CAC/D,CAAC,CACF,OAAS9jB,EAAO,CAKf,MAJI8xB,GAAmB9xB,CAAK,EAAS,IAAIrc,EAAS,eAAgB,CACjE,kBAAmBqc,EAAM,QACzB,MAAOA,EAAM,IACd,CAAC,EACKA,CACP,CACA,IAAMu5B,EAASvzB,EAAI,OAAO,MAAM,GAAG,EACnC,GAAI,CAACuzB,GAAQ,SAAS,QAAQ,EAAG,MAAM,IAAI51C,EAAS,cAAe,CAClE,kBAAmB,yBACnB,MAAO,eACR,CAAC,EACD,GAAI,CAACqiB,EAAI,IAAK,MAAM,IAAIriB,EAAS,cAAe,CAC/C,kBAAmB,iBACnB,MAAO,iBACR,CAAC,EACD,IAAMojD,EAAO,MAAMjjB,EAAI,QAAQ,gBAAgB,aAAa9d,EAAI,GAAG,EACnE,GAAI,CAAC+gC,EAAM,MAAM,IAAIpjD,EAAS,cAAe,CAC5C,kBAAmB,iBACnB,MAAO,iBACR,CAAC,EACD,IAAMm+D,EAAiBZ,GAAiBna,EAAMxN,GAAU,CAAC,EAAG6nB,CAAe,EACrEl5B,EAAWliB,EAAI,WAAaA,EAAI,IAChCqzB,EAASnR,IAAarZ,EAAK,gBAAkB+mB,GAA0B/mB,CAAI,GAAK,MAAMooB,GAAUnT,EAAKjV,EAAMqZ,CAAQ,EAAI,IAAK,GAC9HrZ,EAAK,gBAAkBwqB,IAAQ,EAAe,IAAM,MAAM6B,GAAyB6L,EAAK,GAAI1N,EAAQxqB,CAAI,GAC5G,IAAMkzC,EAAsBxoB,GAAQ,OAAS,MAAM5D,GAA+B9mB,EAAM,CACvF,MACA,OACA,OACA,SACA,MACA,OAAQwqB,GAAU,IAAK,GACvB,iBACD,CAAC,EAAI,CAAC,EACA2oB,EAA2BnzC,EAAK,sBAAwB0qB,GAAQ,OAAS,MAAM1qB,EAAK,qBAAqB,CAC9G,OACA,SACA,MACA,iBACD,CAAC,EAAI,CAAC,EACN,MAAO,CACN,GAAGizC,EACH,GAAGR,GAAWS,EAAqBD,CAAc,EACjD,GAAGR,GAAWU,CAAwB,EACtC,IAAKF,EAAe,GACrB,CACD,CAGA,IAAMG,GAA8B,OAAO,YAAYzH,GAAqB,IAAK,GAAS,CAACzxD,EAAM,IAAK,EAAC,CAAC,CAAC,EAMzG,SAASm5D,GAAsB,EAAc,CAC5C,OAAOjyB,GAAmBC,CAAY,EAAI,OAAS,QACpD,CACA,IAAMiyB,GAAwB,SAK9B,eAAeC,GAAc,EAAK,EAAM,CACvC,IAAMjvB,EAAYrP,EAAI,KAAK,WAC3B,GAAI,CAAC6Q,GAAuB9lB,CAAI,CAAC,CAAC,SAASskB,CAAS,EAAG,MAAM,IAAIxvC,EAAS,cAAe,CACxF,kBAAmB,0BAA0BwvC,IAC7C,MAAO,wBACR,CAAC,EACD,OAAQA,EAAR,CACC,IAAK,qBAAsB,OAAOkvB,GAA6Bv+B,EAAKjV,CAAI,EACxE,IAAK,qBAAsB,OAAOyzC,GAA6Bx+B,EAAKjV,CAAI,EACxE,IAAK,gBAAiB,OAAO0zC,GAAwBz+B,EAAKjV,CAAI,EAC9D,QAAS,CACR,IAAM8Q,EAAUiV,GAAyB/lB,EAAMskB,CAAS,EACxD,GAAIxT,EAAS,OAAOA,EAAQ,CAC3B,MACA,OACA,YACA,SAAU6iC,GAAoB1+B,EAAKjV,EAAMskB,CAAS,CACnD,CAAC,EACD,MAAM,IAAIxvC,EAAS,cAAe,CACjC,kBAAmB,0BAA0BwvC,IAC7C,MAAO,wBACR,CAAC,CACF,CACD,CACD,CAUA,SAASqvB,GAAoB,EAAK,EAAM,EAAW,CAClD,MAAO,CACN,UAAY,GAAavrB,GAAUnT,EAAKjV,EAAMqZ,CAAQ,EACtD,mBAAoB,KAAO,IAAY,CACtC,GAAM,CAAE,WAAU,eAAc,cAAa,aAAY,gBAAiBgS,GAAuB,MAAMC,GAAyBrW,EAAKjV,EAAM,GAAGiV,EAAI,QAAQ,UAAUA,EAAI,MAAQ,iBAAiB,CAAC,EAClM,GAAI,CAACoE,EAAU,MAAM,IAAIvkC,EAAS,cAAe,CAChD,kBAAmB,6BACnB,MAAO,iBACR,CAAC,EACD,GAAI03B,GAAS,qBAAuB,IAAS,CAACoN,GAAgB,CAACuR,EAAa,MAAM,IAAIr2C,EAAS,cAAe,CAC7G,kBAAmB,sCACnB,MAAO,gBACR,CAAC,EACD,MAAO,CACN,WACA,OAAQ,MAAMk2C,GAA0B/V,EAAKjV,EAAMqZ,EAAUO,EAAcpN,GAAS,OAAQ2e,EAAa7G,EAAW2G,CAAU,EAC9H,OAAQA,EACR,cACD,CACD,EACA,YAAc,GAAW,CACxB,GAAI,CAAC3G,EAAW,MAAM,IAAIxvC,EAAS,wBAAyB,CAC3D,kBAAmB,2FACnB,MAAO,cACR,CAAC,EACD,OAAO8+D,GAAiB3+B,EAAKjV,EAAM,CAClC,GAAGnmB,EACH,WACD,CAAC,CACF,EACA,WAAY,EAAO,IAASwvC,GAAWrpB,EAAK,YAAavP,EAAO64B,CAAI,EACpE,oBAAqB,MAAO,EAAO,IAAa,CAC/C,GAAM,CAAE,uBAAwB,MAAM,QAAQ,QAAQ,CAAC,CAAC,SAAWuqB,EAAkB,EACrF,OAAOC,EAAoB7+B,EAAKjV,EAAMvP,EAAO4oB,CAAQ,CACtD,EACA,yBAA0B,MAAO,EAAO,IAAa,CACpD,GAAM,CAAE,4BAA6B,MAAM,QAAQ,QAAQ,CAAC,CAAC,SAAWw6B,EAAkB,EAC1F,OAAOE,EAAyB9+B,EAAKjV,EAAMvP,EAAO4oB,CAAQ,CAC3D,CACD,CACD,CACA,eAAe26B,GAAqB,EAAK,EAAM,EAAM,EAAQ,EAAe,EAAQ,EAAW,CAC9F,IAAMz9C,EAAM2pC,GAAW,KAAO,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACnDzpC,EAAMypC,GAAW,KAAO3pC,GAAOyJ,EAAK,sBAAwB,MAC5Di0C,EAAmB5sB,GAAapS,EAAI,OAAO,CAAC,CAAC,QAC7Chf,EAAUiiC,GAAM,IAAM1N,EAAO,SACnC,OAAO6e,GAAQp0B,EAAK,CACnB,QAASg/B,EACT,OAAQ,CAAE,IAAKX,EAAsB,EACrC,aAAcpT,GAAW,cAAgB,IAAK,GAC9C,iBAAkBA,GAAW,kBAAoB,IAAK,GACtD,QAAS,CACR,GAAGA,GAAW,mBAAqB,CAAC,EACpC,IAAKjqC,EACL,IAAK2xB,GAAgBkmB,CAAa,EAClC,UAAWtjB,EAAO,SAClB,IAAKA,EAAO,SACZ,MAAOE,EAAO,KAAK,GAAG,EACtB,IAAKwV,GAAW,IAChB,IAAK+T,GAAkB,KAAK,QAAUh/B,EAAI,QAAQ,QAClD,MACA,MACA,IAAKnY,GAAqB,EAAE,EAC5B,GAAGojC,GAAW,aAAe,CAAE,IAAKA,EAAU,YAAa,EAAI,CAAC,CACjE,CACD,CAAC,CACF,CAKA,eAAegU,GAAgB,EAAO,EAAY,CACjD,IAAIC,EACJ,AAGKA,EAHDC,IAAe,QAAmB,UAC7BA,EAAW,SAAS,KAAK,EAAa,UACtCA,EAAW,SAAS,KAAK,EAAa,UAChC,UACf,IAAM/xD,EAAS,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO8xD,EAAS,IAAI,YAAY,CAAC,CAAC,OAAO1jD,CAAK,CAAC,CAAC,EAClG,OAAO1b,EAAiBsN,EAAO,MAAM,EAAGA,EAAO,OAAS,CAAC,CAAC,CAC3D,CAKA,eAAegyD,GAAc,EAAK,EAAM,EAAM,EAAQ,EAAQ,EAAO,EAAW,EAAU,EAAa,EAAa,CACnH,IAAM99C,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACjCE,EAAMF,GAAOyJ,EAAK,kBAAoB,MACtCs0C,EAAc,MAAMjoB,GAAyB6L,EAAK,GAAI1N,EAAQxqB,CAAI,EAClEu0C,EAAcC,GAAY,KAA8C,IAAK,GAA5C,KAAK,MAAMA,EAAS,QAAQ,EAAI,GAAG,EACpEC,EAAe3K,GAA2B9pC,EAAK,oBAAsB,MAAMA,EAAK,oBAAoB,CACzG,OACA,SACA,SAAUorB,GAAoBZ,EAAO,QAAQ,CAC9C,CAAC,EAAI,IAAK,EAAC,EACLypB,EAAmBj0C,EAAK,iBAAmB,IAAK,GAAIqnB,GAAapS,EAAI,OAAO,CAAC,CAAC,QAC9E7jB,EAAc,CAAC4O,EAAK,kBAAoB,CAACi0C,GAAkB,KAAK,KAAO,MAAMjL,GAAkB/zB,EAAKg/B,CAAgB,EAAI,IAAK,GAC7HG,EAAap0C,EAAK,iBAAmB,QAAU5O,GAAa,KAAO6iD,GAAkB,MAAM,eAAe,IAC1GS,EAASxzB,EAAc,MAAMgzB,GAAgBhzB,EAAakzB,CAAU,EAAI,IAAK,GAC7EO,EAAU,GAAQnqB,EAAO,kBAAoBA,EAAO,sBACpD3nC,EAAU,CACf,GAAGuwD,GACH,UAAWmB,EACX,IAAK,IACL,GAAGE,EACH,QAASC,EACT,IAAKT,GAAkB,KAAK,QAAUh/B,EAAI,QAAQ,QAClD,IAAKq/B,EACL,IAAK9pB,EAAO,SACZ,QACA,MACA,MACA,IAAKmqB,EAAUC,EAAY,IAAK,EACjC,EACMC,EAAiB/K,GAA2BgL,CAAW,EAE7D,GADA,OAAO,OAAOjyD,EAAS4vD,GAAWoC,EAAgBhyD,CAAO,CAAC,EACtDmd,EAAK,kBAAoB,CAACwqB,EAAO,aAAc,OACnD,IAAMuqB,EAAU/0C,EAAK,iBAAmB,MAAM,IAAIpI,GAAQ/U,CAAO,CAAC,CAAC,mBAAmB,CAAE,IAAK,OAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,MAAMimC,GAA0B7T,EAAKjV,EAAK,kBAAmBwqB,EAAO,YAAY,CAAC,CAAC,EAAI,MAAM6e,GAAQp0B,EAAK,CAC9O,QAASg/B,EACT,UACA,YAAa7iD,GAAe,IAAK,EAClC,CAAC,EACD,GAAI2jD,GAAWL,GAAUT,GAAkB,KAAK,KAAM,CACrD,IAAM1vD,EAAS+W,GAAsBy5C,CAAO,EAC5C,GAAIxwD,EAAO,MAAQ6vD,EAAY,MAAM,IAAIt/D,EAAS,wBAAyB,CAC1E,kBAAmB,yBAAyByP,EAAO,IAAI,kCAAkC6vD,EAAW,sEACpG,MAAO,cACR,CAAC,CACF,CACA,OAAOW,CACR,CAIA,eAAeC,GAAmB,EAAM,EAAO,EAAW,CACzD,OAAQh1C,EAAK,QAAQ,cAAgB,KAAOA,EAAK,oBAAoB,QAAUA,EAAK,mBAAmB,QAAQvP,EAAOmkD,CAAS,EAAInkD,EACpI,CAMA,eAAewkD,GAAmB,EAAM,EAAO,CAC9C,GAAIj1C,EAAK,QAAQ,aAAc,IAAIvP,EAAM,WAAWuP,EAAK,OAAO,YAAY,EAAG,EAAQvP,EAAM,QAAQuP,EAAK,OAAO,aAAc,EAAE,OAC5H,MAAM,IAAIlrB,EAAS,cAAe,CACtC,kBAAmB,0BACnB,MAAO,eACR,CAAC,CAAA,CACD,OAAOkrB,EAAK,oBAAoB,QAAUA,EAAK,oBAAoB,QAAQvP,CAAK,EAAI,CAAE,OAAM,CAC7F,CACA,eAAeykD,GAAwB,EAAK,EAAM,EAAM,EAAQ,EAAQ,EAAS,EAAW,EAAa,EAAqB,EAAW,EAAc,EAAyB,CAC/K,IAAM3+C,EAAM1T,EAAQ,KAAO,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EAChD4T,EAAM5T,GAAS,KAAO0T,GAAOyJ,EAAK,sBAAwB,MAC1DvP,EAAQuP,EAAK,0BAA4B,MAAMA,EAAK,0BAA0B,EAAIlD,GAAqB,GAAI,MAAO,KAAK,EAmB7H,OAlBA,MAAMmY,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAO,mBACP,KAAM,CACL,MAAO,MAAMoU,GAAWrpB,EAAK,YAAavP,EAAO,cAAc,EAC/D,SAAU+5B,EAAO,SACjB,UAAW3nC,GAAS,IACpB,OAAQq1C,GAAM,GACd,cACA,sBACA,YACA,YACA,eACA,wBAAyBid,GAAyB,OAASA,EAA0B,IAAK,GAC1F,SACA,UAA2B,IAAI,KAAK5+C,EAAM,GAAG,EAC7C,UAA2B,IAAI,KAAKE,EAAM,GAAG,CAC9C,CACD,CAAC,GACOuJ,EAAK,QAAQ,mBAAqB,IAAMvP,CACjD,CAkBA,eAAe2kD,GAAwB,EAAK,EAAU,EAAQ,CAC7D,IAAMC,EAAgB,MAAMpgC,EAAI,QAAQ,QAAQ,SAAS,CACxD,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,WACP,MAAOoE,CACR,EAAG,CACF,MAAO,SACP,MAAO+S,CACR,CAAC,CACF,CAAC,EACGipB,EAAc,QAAQ,MAAMpgC,EAAI,QAAQ,QAAQ,WAAW,CAC9D,MAAO,mBACP,MAAO,CAAC,CACP,MAAO,YACP,SAAU,KACV,MAAOogC,EAAc,IAAK,GAAM/vC,EAAE,EAAE,CACrC,CAAC,CACF,CAAC,EACD,MAAM2P,EAAI,QAAQ,QAAQ,WAAW,CACpC,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,WACP,MAAOoE,CACR,EAAG,CACF,MAAO,SACP,MAAO+S,CACR,CAAC,CACF,CAAC,CACF,CACA,eAAekpB,GAAuC,EAAK,EAAqB,CAC/E,IAAMC,EAAqB,KAAO,IAAU,CAC3C,GAAI,CACH,MAAMtgC,EAAI,QAAQ,QAAQ,WAAW,CACpC,QACA,MAAO,CAAC,CACP,MAAO,sBACP,MAAOugC,CACR,CAAC,CACF,CAAC,CACF,OAASrkD,EAAO,CACf8jB,EAAI,QAAQ,OAAO,MAAM,2CAA4C9jB,CAAK,CAC3E,CACD,EACA,MAAMokD,EAAmB,kBAAkB,EAC3C,MAAMA,EAAmB,mBAAmB,CAC7C,CACA,eAAeE,GAAmB,EAAK,EAAM,EAAM,EAAa,EAAqB,EAAQ,EAAQ,EAAS,EAAiB,EAAU,EAAW,EAAc,EAAyB,CAC1L,IAAMl/C,EAAM1T,EAAQ,KAAO,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EAChD4T,EAAM5T,GAAS,KAAO0T,GAAOyJ,EAAK,uBAAyB,QAC3DvP,EAAQuP,EAAK,qBAAuB,MAAMA,EAAK,qBAAqB,EAAIlD,GAAqB,GAAI,MAAO,KAAK,EAC7G83C,EAAY/xD,GAAS,IACrB6yD,EAAS,CACd,MAAO,MAAMrsB,GAAWrpB,EAAK,YAAavP,EAAO,eAAe,EAChE,SAAU+5B,EAAO,SACjB,YACA,OAAQ0N,EAAK,GACb,cACA,sBACA,WACA,eACA,wBAAyBid,GAAyB,OAASA,EAA0B,IAAK,GAC1F,SACA,YACA,UAA2B,IAAI,KAAK5+C,EAAM,GAAG,EAC7C,UAA2B,IAAI,KAAKE,EAAM,GAAG,CAC9C,EACA,GAAI,CAACk/C,GAAiB,GAAI,MAAO,CAChC,IAAK,MAAM1gC,EAAI,QAAQ,QAAQ,OAAO,CACrC,MAAO,oBACP,KAAMygC,CACP,CAAC,EAAA,CAAG,GACJ,MAAO,MAAMV,GAAmBh1C,EAAMvP,EAAOmkD,CAAS,CACvD,EACA,IAAMgB,EAA4B,IAAI,KAAKr/C,EAAM,GAAG,EAC9Cs/C,EAAiB,CACtB,QAASD,EACT,WACD,EACME,EAAgB91C,EAAK,2BAA6B,EAExD,GADI81C,EAAgB,IAAG,EAAe,wBAA0C,IAAI,MAAMv/C,EAAMu/C,GAAiB,GAAG,GAChH,CAAC,MAAM7gC,EAAI,QAAQ,QAAQ,aAAa,CAC3C,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,KACP,MAAO0gC,EAAgB,EACxB,EAAG,CACF,MAAO,UACP,SAAU,KACV,MAAO,IACR,CAAC,EACD,UAAW,CAAC,EACZ,IAAKE,CACN,CAAC,EAAG,MAAM,IAAI/gE,EAAS,cAAe,CACrC,kBAAmB,wBACnB,MAAO,eACR,CAAC,EACD,MAAO,CACN,IAAK,MAAMmgC,EAAI,QAAQ,QAAQ,OAAO,CACrC,MAAO,oBACP,KAAMygC,CACP,CAAC,EAAA,CAAG,GACJ,MAAO,MAAMV,GAAmBh1C,EAAMvP,EAAOmkD,CAAS,CACvD,CACD,CACA,eAAemB,GAA6B,EAAK,EAAM,EAAQ,CAC9D,IAAMC,EAAiB,MAAM3H,GAAsBp5B,EAAKjV,EAAM,CAC7D,SAAUnmB,EAAO,UACjB,SAAUA,EAAO,SACjB,gBAAiBA,EAAO,eACzB,CAAC,EACKo8D,EAA2BD,EAAe,iBAAmB,KAAoDn8D,EAAO,sBAApDA,EAAO,IAAMm8D,EAAe,eAChGE,EAAyBl2C,EAAK,uBAAyB,OACvDivC,EAAkB+G,EAAe,kBAAoB,KAA0EE,EAAnE,KAAK,IAAIF,EAAe,gBAAiBE,CAAsB,EACjI,MAAO,CACN,cAAeF,EAAe,cAC9B,gBAAiBA,EAAe,gBAChC,4BAA6B,KAAK,IAAIn8D,EAAO,sBAAuBo8D,CAAwB,EAC5F,6BAA8Bp8D,EAAO,IAAMo1D,EAC3C,iBAAkBp1D,EAAO,cAAc,WAAaA,EAAO,mBAAqBA,EAAO,UACvF,iBAAkBm8D,EAAe,iBACjC,aAAcA,EAAe,aAC7B,qBAAsBA,EAAe,gBACrC,8BAA+BA,EAAe,6BAC/C,CACD,CACA,SAASG,GAAsB,EAAkB,CAChD,MAAM,IAAIrhE,EAAS,cAAe,CACjC,MAAO,qBACP,kBAAmB+0C,CACpB,CAAC,CACF,CACA,SAASusB,GAAoC,EAAQ,CACpD,IAAMp7C,EAAWowB,GAAoBZ,EAAO,QAAQ,GAAK,CAAC,EAC1D,OAAOA,EAAO,wBAA0B,IAAQxvB,EAAS,2BAA6B,EACvF,CACA,eAAeq7C,GAAwB,EAAK,EAAM,EAAQ,CACzD,IAAMC,EAAkBz8D,EAAO,mBAAmB,MAAM,SAClD08D,EAAan1B,GAAmBvnC,EAAO,cAAc,YAAY,EACjEgpC,EAAc0zB,GAAcD,EAC5BE,EAAe5E,GAAgB38B,CAAG,EAClCwhC,EAAeL,GAAoCv8D,EAAO,MAAM,GAAKA,EAAO,cAAc,+BAAiC,CAAC,CAACy8D,GAAmB,CAAC,CAACC,EACxJ,GAAI,CAACC,EACAC,GAAcN,GAAsB,+BAA+B,OAGxE,GAAI,CACH,MAAO,CAAE,KAAM,MAAMj0B,GAAgB,CACpC,SAAUs0B,EACV,OAAQ,OACR,IAAK3E,GAAe58B,EAAK,eAAe,EACxC,cACA,mBAAoBjV,EAAK,MAAM,mBAC/B,kBAAmBA,EAAK,MAAM,kBAC9B,YAAaygB,GAAsBxL,EAAI,QAAQ,eAAe,CAC/D,CAAC,EAAA,CAAG,GAAI,CACT,OAAS9jB,EAAO,CAEf,MADIyvB,GAAiBzvB,CAAK,GAAGglD,GAAsBhlD,EAAM,OAAO,EAC1DA,CACP,CACD,CACA,SAASulD,GAAsB,EAAQ,CACtC,OAAOpxB,EAAS,CAAC,GAAG,IAAI,IAAIA,CAAM,CAAC,CAAC,CAAC,KAAK,EAAI,IAAK,EACpD,CACA,SAASqxB,GAAiB,EAAM,EAAO,CACtC,IAAMC,EAAiBF,GAAsB3jB,CAAI,EAC3C8jB,EAAkBH,GAAsB1jB,CAAK,EAGnD,OAFI4jB,IAAmB,IAAK,IAAKC,IAAoB,IAAK,GAAUD,IAAmBC,EACnFD,EAAe,SAAWC,EAAgB,QACvCD,EAAe,OAAO,EAAO,IAAU57D,IAAU67D,EAAgBt8C,EAAM,CAC/E,CACA,SAASu8C,GAAsB,EAAc,CAC5C,GAAKz1B,EAEL,MADI,QAASA,EAAqB,OAAOA,EAAa,MAC/C,YAAYA,EAAa,aACjC,CACA,SAAS01B,GAAiB,EAAM,EAAO,CACtC,OAAOD,GAAsB/jB,CAAI,IAAM+jB,GAAsB9jB,CAAK,CACnE,CACA,SAASgkB,GAAe,EAAO,CAC9B,GAAI,CAACh8D,GAAS,OAAOA,GAAU,SAAU,MAAO,GAChD,IAAMqmC,EAAermC,EACrB,OAAO,OAAOqmC,EAAa,KAAQ,UAAYA,EAAa,cAAgB,IAAK,IAAK,OAAOA,EAAa,aAAgB,UAAYA,EAAa,MAAQ,IAAK,EACjK,CACA,SAAS41B,GAAY,EAAO,CAC3B,OAAOj8D,IAAU,UAAYA,IAAU,MACxC,CACA,SAASk8D,GAAqB,EAAO,CACpC,GAAI,CAACl8D,GAAS,OAAOA,GAAU,SAAU,MAAO,GAChD,IAAM00B,EAAW10B,EACjB,OAAO,OAAO00B,EAAS,cAAiB,UAAY,OAAOA,EAAS,YAAe,UAAY,OAAOA,EAAS,YAAe,UAAYunC,GAAYvnC,EAAS,UAAU,GAAK,OAAOA,EAAS,OAAU,WAAaA,EAAS,gBAAkB,IAAK,IAAK,OAAOA,EAAS,eAAkB,YAAcA,EAAS,WAAa,IAAK,IAAK,OAAOA,EAAS,UAAa,SACxW,CACA,SAASynC,GAA6B,EAAO,CAC5C,GAAI,CAACn8D,GAAS,OAAOA,GAAU,SAAU,MAAO,GAChD,IAAMo8D,EAASp8D,EACTwxB,EAAU4qC,EAAO,QACvB,MAAO,CAAC,CAAC5qC,GAAW,MAAM,QAAQA,EAAQ,eAAe,GAAKA,EAAQ,gBAAgB,MAAO,GAAU,OAAOmM,GAAU,QAAQ,IAAMnM,EAAQ,qBAAuB,IAAK,IAAK,MAAM,QAAQA,EAAQ,kBAAkB,GAAKA,EAAQ,mBAAmB,MAAO,GAAa,OAAOohC,GAAa,QAAQ,KAAOphC,EAAQ,eAAiB,IAAK,IAAKwqC,GAAexqC,EAAQ,YAAY,IAAM0qC,GAAqBE,EAAO,QAAQ,CAC/Z,CACA,SAASC,GAAuC,EAAQ,CACvD,IAAM/I,EAAqBoI,GAAsB78D,EAAO,kBAAkB,EAC1E,MAAO,CACN,gBAAiB68D,GAAsB78D,EAAO,eAAe,GAAK,CAAC,EACnE,GAAGy0D,EAAqB,CAAE,oBAAmB,EAAI,CAAC,EAClD,GAAGz0D,EAAO,aAAe,CAAE,aAAcA,EAAO,YAAa,EAAI,CAAC,CACnE,CACD,CACA,SAASy9D,GAAsC,EAAM,EAAO,CAC3D,OAAOX,GAAiB5jB,EAAK,gBAAiBC,EAAM,eAAe,GAAK2jB,GAAiB5jB,EAAK,mBAAoBC,EAAM,kBAAkB,GAAK+jB,GAAiBhkB,EAAK,aAAcC,EAAM,YAAY,CACtM,CACA,eAAeukB,GAAkC,EAAK,EAAQ,CAC7D,OAAO9rC,GAAiB,CACvB,IAAKwJ,EAAI,QAAQ,aACjB,KAAM,KAAK,UAAUmiC,CAAM,CAC5B,CAAC,CACF,CACA,eAAeI,GAAkC,EAAK,EAAO,CAC5D,IAAMj1C,EAAY,MAAMmJ,GAAiB,CACxC,IAAKuJ,EAAI,QAAQ,aACjB,KAAMj6B,CACP,CAAC,EACK8J,EAAS,KAAK,MAAMyd,CAAS,EACnC,GAAK40C,GAA6BryD,CAAM,EACxC,OAAOA,CACR,CACA,SAAS2yD,GAAkC,EAAc,CACxD,MAAO,CAAC,CAACC,EAAa,WAAa,CAAC,CAACA,EAAa,yBAA2BA,EAAa,yBAA2C,IAAI,IAC1I,CACA,eAAeC,GAAgC,EAAK,EAAM,EAAc,EAAS,EAAU,EACrF33C,EAAK,2BAA6B,IAAM,GAC7C,MAAMiV,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOyiC,EAAa,EACrB,CAAC,EACD,OAAQ,CAAE,uBAAwB,MAAMH,GAAkCtiC,EAAK,CAC9E,UACA,UACD,CAAC,CAAE,CACJ,CAAC,CACF,CACA,eAAe2iC,GAA8B,EAAK,EAAc,EAAS,CACxE,GAAKH,GAAkCC,CAAY,GAC9CA,EAAa,uBAClB,GAAI,CACH,IAAMN,EAAS,MAAMI,GAAkCviC,EAAKyiC,EAAa,sBAAsB,EAE/F,MADI,CAACN,GAAU,CAACE,GAAsCF,EAAO,QAAS5qC,CAAO,EAAG,OACzE4qC,EAAO,QACf,OAASjmD,EAAO,CACf8jB,EAAI,QAAQ,OAAO,MAAM,uCAAwC9jB,CAAK,EACtE,MACD,CACD,CACA,eAAe0mD,GAAyC,EAAK,EAAM,EAAQ,CAC1E,IAAMthD,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACjCuhD,EAAgB,MAAM/B,GAA6B9gC,EAAKjV,EAAM,CACnE,SAAUnmB,EAAO,OAAO,SACxB,gBAAiBA,EAAO,OACxB,UAAWA,EAAO,UAClB,aAAcA,EAAO,aACrB,MACA,sBAAuB0c,GAAOyJ,EAAK,sBAAwB,KAC5D,CAAC,EACKqhB,EAAe,MAAMg1B,GAAwBphC,EAAKjV,EAAM,CAC7D,OAAQnmB,EAAO,OACf,gBACA,aAAcA,EAAO,YACtB,CAAC,EACD,OAAOw9D,GAAuC,CAC7C,gBAAiBS,EAAc,gBAC/B,mBAAoBj+D,EAAO,UAC3B,cACD,CAAC,CACF,CACA,SAASk+D,GAAmC,EAAK,EAAU,CAC1D,IAAM1hD,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACvC,OAAO4e,EAAI,KAAK,CACf,GAAGvF,EACH,WAAY,KAAK,IAAI,EAAGA,EAAS,WAAarZ,CAAG,CAClD,CAAC,CACF,CACA,eAAeu9C,GAAiB,EAAK,EAAM,EAAQ,CAClD,GAAM,CAAE,SAAQ,SAAQ,OAAM,YAAW,cAAa,YAAW,QAAO,aAAcoE,EAAsB,WAAU,qBAAsBn+D,EACtI0c,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACjC+yC,EAAa/yC,GAAO2hC,EAAOl4B,EAAK,sBAAwB,KAAOA,EAAK,yBAA2B,MAC/Fi4C,EAAWj4C,EAAK,iBAAmB0qB,EAAO,IAAK,GAAO1qB,EAAK,mBAAmBk4C,GAAM7P,GAASroC,EAAK,iBAAiBk4C,GAAK3hD,CAAG,EAAI+yC,CAAU,CAAC,CAAC,QAAQ,EAAM,IACvJ6O,EAAOloC,EAAOkoC,EAAOloC,EAC1Bq5B,CAAU,EAAIA,EACXwO,EAAgB,MAAM/B,GAA6B9gC,EAAKjV,EAAM,CACnE,SAAUwqB,EAAO,SACjB,gBAAiBE,EACjB,UAAW7wC,EAAO,UAClB,kBAAmBA,EAAO,kBAC1B,aAAcA,EAAO,aACrB,MACA,sBAAuBo+D,CACxB,CAAC,EACKnK,EAAgBgK,EAAc,cAC9BhJ,EAAkBgJ,EAAc,gBAChCrhD,EAAMqhD,EAAc,4BACpBM,EAAkBN,EAAc,6BAChCO,EAAiBngB,GAAQ5N,GAAkBE,EAAQ,eAAe,IAAMwtB,GAAsB,QAAQ,SAAS,gBAAgB,GAAKttB,EAAO,SAAS,gBAAgB,GACpK4tB,EAAmBxK,GAAiB,CAAC9tC,EAAK,iBAC1Cu4C,EAAYrgB,GAAQ4W,EAAgB,SAAS,QAAQ,EACrD9zC,EAAWowB,GAAoBZ,EAAO,QAAQ,EAC9CguB,EAA0BD,GAAargB,EAAO,CACnD,GAAG,MAAMrR,GAA8B7mB,EAAM,CAC5C,MACA,OACA,OACA,SACA,OAAQ8uC,EACR,YACA,cACA,YACA,UAAWj1D,EAAO,UAClB,UACD,CAAC,EACD,GAAGA,EAAO,eAAiB,CAAC,CAC7B,EAAI,IAAK,GACH4+D,EAAez4C,EAAK,0BAA4B,MAAMA,EAAK,0BAA0B,CAC1F,YACA,OACA,OAAQ8uC,EACR,WACA,mBACD,CAAC,EAAI,IAAK,GACJ4J,EAAmBZ,EAAc,iBACjCz2B,EAAexnC,EAAO,cAAgB,MAAMw8D,GAAwBphC,EAAKjV,EAAM,CACpF,SACA,gBACA,oBACA,aAAcg4C,CACf,CAAC,EACK7C,EAA0Bt7D,EAAO,yBAA2Bm+D,GAAsB,yBAA2B,CAAC,EAC9GW,EAAoBN,GAAkBngB,GAAQ,CAACogB,EAAmB,MAAM7C,GAAmBxgC,EAAKjV,EAAMk4B,EAAM0gB,EAAa/+D,EAAO,oBAAqB2wC,EAAQskB,EAAiB,CACnL,MACA,IAAKsJ,EACL,IAAKxD,CACN,EAAGoD,EAAsBxD,EAAUkE,EAAkBr3B,EAAc8zB,CAAuB,EAAI,IAAK,GAC7F0D,EAAoBP,EAAmB,MAAMtM,GAAyB,CAC3E,MACA,OACA,OACA,SACA,OAAQ8C,EACR,YACA,YACA,UAAWj1D,EAAO,UAClB,cACA,WACA,iBAAkBA,EAAO,kBACzB,qBAAsBi+D,EAAc,oBACrC,CAAC,EAAI,IAAK,GACJ,CAAC52B,EAAaw2B,GAAgB,MAAM,QAAQ,IAAI,CAACY,EAAmBtE,GAAqB/+B,EAAKjV,EAAMk4B,EAAM1N,EAAQsjB,EAAegB,EAAiB,CACvJ,MACA,MACA,IAAK8F,EACL,iBAAkBkD,EAAc,iBAChC,aAAcA,EAAc,aAC5B,oBACA,cACD,CAAC,EAAI5C,GAAwBjgC,EAAKjV,EAAMk4B,EAAM1N,EAAQskB,EAAiB,CACtE,MACA,MACA,IAAK8F,CACN,EAAG/6D,GAAQ,UAAW++D,EAAa/+D,EAAO,oBAAqB8+D,GAAmB,GAAIt3B,EAAc8zB,CAAuB,EAAGwD,IAAwCN,GAAkBngB,EAAOud,GAAmBxgC,EAAKjV,EAAMk4B,EAAM0gB,EAAa/+D,EAAO,oBAAqB2wC,EAAQskB,EAAiB,CACpS,MACA,IAAKsJ,EACL,IAAKxD,CACN,EAAGoD,EAAsBxD,EAAUkE,EAAkBr3B,EAAc8zB,CAAuB,EAAI,IAAK,GAAC,CAAC,EAC/FJ,EAAUwD,EAAY,MAAMlE,GAAcp/B,EAAKjV,EAAMk4B,EAAM1N,EAAQskB,EAAiBhuC,EAAO8zC,EAAWJ,EAAUtzB,EAAas3B,CAAuB,EAAI,IAAK,GAC7JM,EAAe,CACpB,GAAGL,EACH,GAAG5+D,EAAO,eAAiB,CAAC,EAC5B,aAAcqnC,EACd,WAAYzqB,EAAMF,EAClB,WAAYE,EACZ,WAAY48C,GAAsBhyB,CAAY,EAC9C,cAAeq2B,GAAc,MAC7B,MAAO5I,EAAgB,KAAK,GAAG,EAC/B,SAAUiG,CACX,EACA,GAAIiD,GAAsB,IAAMN,GAAc,GAAI,GAAI,CACrD,MAAMC,GAAgC1iC,EAAKjV,EAAMg4C,EAAsBX,GAAuC,CAC7G,kBACA,mBAAoBx9D,EAAO,UAC3B,cACD,CAAC,EAAGi/D,CAAY,CACjB,OAAS3nD,EAAO,CACf8jB,EAAI,QAAQ,OAAO,MAAM,gDAAiD9jB,CAAK,CAChF,CACA,OAAO8jB,EAAI,KAAK6jC,CAAY,CAC7B,CAEA,eAAeC,GAAuB,EAAK,EAAM,EAAM,EAAW,EAAc,EAAU,CACzF,IAAMvD,EAAsB,MAAMnsB,GAAWrpB,EAAK,YAAane,EAAM,oBAAoB,EACnFm3D,EAAe,MAAM/jC,EAAI,QAAQ,gBAAgB,yBAAyBugC,CAAmB,EACnG,GAAI,CAACwD,EAEJ,MADA,MAAM1D,GAAuCrgC,EAAKugC,CAAmB,EAC/D,IAAI1gE,EAAS,cAAe,CACjC,kBAAmB,eACnB,MAAO,eACR,CAAC,EAEF,IAAImkE,EACJ,GAAI,CACH,EAAW,KAAK,MAAMD,EAAa,KAAK,CACzC,MAAQ,CACP,MAAM,IAAIlkE,EAAS,cAAe,CACjC,kBAAmB,+BACnB,MAAO,eACR,CAAC,CACF,CACA,IAAMgQ,EAASkoD,GAAwB,UAAUiM,CAAQ,EACzD,GAAI,CAACn0D,EAAO,QAAS,MAAM,IAAIhQ,EAAS,cAAe,CACtD,kBAAmB,+BACnB,MAAO,eACR,CAAC,EACD,IAAMokE,EAAoBp0D,EAAO,KACjC,GAAIo0D,EAAkB,MAAM,YAAcC,EAAW,MAAM,IAAIrkE,EAAS,cAAe,CACtF,kBAAmB,oBACnB,MAAO,eACR,CAAC,EACD,IAAMskE,EAAmBF,EAAkB,MAAM,aACjD,GAAIE,EAAkB,CACrB,GAAI,CAACC,EAAc,MAAM,IAAIvkE,EAAS,cAAe,CACpD,kBAAmB,2BACnB,MAAO,iBACR,CAAC,EACD,GAAIskE,IAAqBC,EAAc,MAAM,IAAIvkE,EAAS,cAAe,CACxE,kBAAmB,wBACnB,MAAO,eACR,CAAC,CACF,MAAO,GAAIukE,EAAc,MAAM,IAAIvkE,EAAS,cAAe,CAC1D,kBAAmB,wBACnB,MAAO,eACR,CAAC,EACD,IAAMwkE,EAAkB3xB,GAAeuxB,EAAkB,QAAQ,GAAKvxB,GAAeuxB,EAAkB,MAAM,QAAQ,EAC/GK,EAAqB3L,GAAY0L,EACvC,GAAI1L,GAAY0L,EAAiB,CAChC,IAAME,EAAe,IAAI,IAAI5L,CAAQ,EAC/B6L,EAAgB,IAAI,IAAIH,CAAe,EAC7C,IAAK,IAAMh0C,KAAKk0C,EAAc,GAAI,CAACC,EAAc,IAAIn0C,CAAC,EAAG,MAAM,IAAIxwB,EAAS,cAAe,CAC1F,kBAAmB,oCACnB,MAAO,gBACR,CAAC,CACF,CACA,MAAO,CACN,oBACA,qBACA,oBAAqBwkE,EACrB,qBACD,CACD,CAIA,eAAe9F,GAA6B,EAAK,EAAM,CACtD,GAAM,CAAE,SAAU2F,EAAW,aAAcO,EAAe,cAAa,cAAeruB,GAAuB,MAAMC,GAAyBrW,EAAKjV,EAAM,GAAGiV,EAAI,QAAQ,QAAQ,cAAc,CAAC,EACvL,CAAE,OAAM,gBAAe,eAAc,YAAaA,EAAI,KACtDy6B,EAAY/nB,GAAeimB,CAAQ,EACzC,GAAI,CAACuL,EAAW,MAAM,IAAIrkE,EAAS,cAAe,CACjD,kBAAmB,wBACnB,MAAO,iBACR,CAAC,EACD,GAAI,CAAC+M,EAAM,MAAM,IAAI/M,EAAS,cAAe,CAC5C,kBAAmB,mBACnB,MAAO,iBACR,CAAC,EACD,IAAM6kE,EAAuBR,GAAaO,EACpCE,EAAqBT,GAAat3D,GAAQg4D,EAChD,GAAI,CAACF,GAAwB,CAACC,GAAsB,CAACzuB,EAAa,MAAM,IAAIr2C,EAAS,cAAe,CACnG,kBAAmB,oDACnB,MAAO,iBACR,CAAC,EAED,GAAM,CAAE,oBAAmB,qBAAoB,sBAAqB,uBAAwB,MAAMikE,GAAuB9jC,EAAKjV,EAAMne,EAAMs3D,EAAWE,EAAc3J,CAAS,EACtKhlB,EAASwuB,EAAkB,MAAM,OAAO,MAAM,GAAG,EACvD,GAAI,CAACxuB,EAAQ,MAAM,IAAI51C,EAAS,wBAAyB,CACxD,kBAAmB,2BACnB,MAAO,eACR,CAAC,EAED,IAAM01C,EAAS,MAAMQ,GAA0B/V,EAAKjV,EAAMm5C,EAAWO,EAAehvB,EAAQS,EAAa,qBAAsBF,CAAU,EACzI,GAAI8B,GAAevC,EAAQ,CAC1B,QAAS0uB,EAAkB,OAAO,MAAA,EAAQ,MAAM,GAAG,GAAK,CAAC,EACzD,MAAOA,EAAkB,OAAO,KACjC,CAAC,EACI,IAAA,CAACU,EAAoB,MAAM,IAAI9kE,EAAS,cAAe,CAC1D,kBAAmB,mCACnB,MAAO,iBACR,CAAC,CAAA,MACK,GAAI,EAAE8kE,GAAsBD,GAAwBxuB,GAAc,MAAM,IAAIr2C,EAAS,cAAe,CAC1G,kBAAmB,uGACnB,MAAO,iBACR,CAAC,EAED,IAAMglE,EAAiB,CAAC,CAACZ,EAAkB,OAAO,eAC5Ca,EAAkB,CAAC,CAACF,EAC1B,GAAIC,GAAkBC,EAAiB,CACtC,GAAID,GAAkB,CAACC,EAAiB,MAAM,IAAIjlE,EAAS,eAAgB,CAC1E,kBAAmB,gEACnB,MAAO,iBACR,CAAC,EACD,GAAI,CAACglE,GAAkBC,EAAiB,MAAM,IAAIjlE,EAAS,eAAgB,CAC1E,kBAAmB,gEACnB,MAAO,iBACR,CAAC,EACD,IAAKokE,EAAkB,OAAO,wBAA0B,OAAS,MAAM5/B,GAAsBugC,CAAa,EAAI,IAAK,MAAOX,EAAkB,OAAO,eAAgB,MAAM,IAAIpkE,EAAS,eAAgB,CACrM,kBAAmB,2BACnB,MAAO,iBACR,CAAC,CACF,CAEA,GAAI,CAACokE,EAAkB,OAAQ,MAAM,IAAIpkE,EAAS,cAAe,CAChE,kBAAmB,2CACnB,MAAO,cACR,CAAC,EACD,IAAMojD,EAAO,MAAMjjB,EAAI,QAAQ,gBAAgB,aAAaikC,EAAkB,MAAM,EACpF,GAAI,CAAChhB,EAAM,MAAM,IAAIpjD,EAAS,cAAe,CAC5C,kBAAmB,2CACnB,MAAO,cACR,CAAC,EACD,IAAMwjD,EAAU,MAAMrjB,EAAI,QAAQ,QAAQ,QAAQ,CACjD,MAAO,UACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOikC,EAAkB,SAC1B,CAAC,CACF,CAAC,EACD,GAAI,CAAC5gB,GAAWA,EAAQ,UAA4B,IAAI,KAAQ,MAAM,IAAIxjD,EAAS,cAAe,CACjG,kBAAmB,2BACnB,MAAO,iBACR,CAAC,EACD,IAAM0/D,EAAW0E,EAAkB,UAAY,KAA6DzxB,GAAuB6Q,CAAO,EAApFhR,GAAwB4xB,EAAkB,QAAQ,EAClG/D,EAA0BxK,GAA2BuO,EAAkB,MAAM,OAAQtN,GAAmB5rC,CAAI,CAAC,EACnH,OAAO4zC,GAAiB3+B,EAAKjV,EAAM,CAClC,SACA,OAAQk5C,EAAkB,MAAM,OAAO,MAAM,GAAG,GAAK,CAAC,EACtD,OACA,UAAW,qBACX,YAAaA,EAAkB,YAC/B,UAAW5gB,EAAQ,GACnB,MAAO4gB,EAAkB,OAAO,MAChC,WACA,oBACA,sBACA,0BACA,UAAWK,EACX,kBAAmBS,CACpB,CAAC,CACF,CAOA,eAAevG,GAA6B,EAAK,EAAM,CACtD,GAAM,CAAE,SAAU0F,EAAW,aAAcO,EAAe,cAAa,cAAeruB,GAAuB,MAAMC,GAAyBrW,EAAKjV,EAAM,GAAGiV,EAAI,QAAQ,QAAQ,cAAc,CAAC,EACvL,CAAE,QAAO,YAAaA,EAAI,KAC1By6B,EAAY/nB,GAAeimB,CAAQ,EACzC,GAAI,CAACuL,EAAW,MAAM,IAAIrkE,EAAS,cAAe,CACjD,kBAAmB,6BACnB,MAAO,iBACR,CAAC,EACD,IAAM01C,EAAS,MAAMQ,GAA0B/V,EAAKjV,EAAMm5C,EAAWO,EAAe,IAAK,GAAGvuB,EAAa,qBAAsBF,CAAU,EACzI,GAAIT,EAAO,0BAA4B,OAAQ,MAAM,IAAI11C,EAAS,cAAe,CAChF,kBAAmB,yDACnB,MAAO,qBACR,CAAC,EACD,IAAMmlE,EAA0BzvB,EAAO,wBACvC,GAAI,CAACyvB,GAAyB,OAAQ,MAAM,IAAInlE,EAAS,cAAe,CACvE,kBAAmB,qDACnB,MAAO,qBACR,CAAC,EACD,IAAIolE,EAAkBvhC,GAAO,MAAM,GAAG,EACtC,GAAIuhC,EAAiB,CACpB,IAAMvvB,EAAc,IAAI,IAAIsvB,CAAuB,EAC7C7H,EAAgB8H,EAAgB,OAAQ,GACtC,CAACvvB,EAAY,IAAIhS,CAAK,GAAKo5B,GAAqBp5B,CAAK,CAC5D,EACD,GAAIy5B,EAAc,OAAQ,MAAM,IAAIt9D,EAAS,cAAe,CAC3D,kBAAmB,qCAAqCs9D,EAAc,KAAK,IAAI,IAC/E,MAAO,eACR,CAAC,CACF,CAEA,MADA,CAAsB8H,IAAkB,CAAC,GAAGD,CAAuB,EAC5DrG,GAAiB3+B,EAAKjV,EAAM,CAClC,SACA,OAAQk6C,EACR,UAAW,qBACX,WACD,CAAC,CACF,CAOA,eAAexG,GAAwB,EAAK,EAAM,CACjD,GAAM,CAAE,SAAUyF,EAAW,aAAcO,EAAe,cAAa,cAAeruB,GAAuB,MAAMC,GAAyBrW,EAAKjV,EAAM,GAAGiV,EAAI,QAAQ,QAAQ,cAAc,CAAC,EACvL,CAAE,gBAAe,QAAO,YAAaA,EAAI,KACzCy6B,EAAY/nB,GAAeimB,CAAQ,EACzC,GAAI,CAACuL,EAAW,MAAM,IAAIrkE,EAAS,cAAe,CACjD,kBAAmB,6BACnB,MAAO,iBACR,CAAC,EACD,GAAI,CAACqlE,EAAe,MAAM,IAAIrlE,EAAS,cAAe,CACrD,kBAAmB,2DACnB,MAAO,iBACR,CAAC,EACD,IAAMslE,EAAiB,MAAMnF,GAAmBj1C,EAAMm6C,CAAa,EAC7DzC,EAAe,MAAMziC,EAAI,QAAQ,QAAQ,QAAQ,CACtD,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,QACP,MAAO,MAAMsU,GAAevpB,EAAK,YAAao6C,EAAe,MAAO,eAAe,CACpF,CAAC,CACF,CAAC,EACD,GAAI,CAAC1C,EAAc,MAAM,IAAI5iE,EAAS,cAAe,CACpD,kBAAmB,oBACnB,MAAO,eACR,CAAC,EAKD,GAJI4iE,EAAa,WAAayB,GAI1BzB,EAAa,UAA4B,IAAI,KAAQ,MAAM,IAAI5iE,EAAS,cAAe,CAC1F,kBAAmB,wBACnB,MAAO,eACR,CAAC,EACD,GAAI46D,GAAagI,EAAa,WAAa,CAAChI,EAAU,MAAO,GAAMgI,EAAa,WAAW,SAAS7qB,CAAC,CAAC,EAAG,MAAM,IAAI/3C,EAAS,cAAe,CAC1I,kBAAmB,6BACnB,MAAO,gBACR,CAAC,EACD,IAAM41C,EAASgtB,GAAc,OACvBwC,EAAkBvhC,GAAO,MAAM,GAAG,EACxC,GAAIuhC,EAAiB,CACpB,IAAMvvB,EAAc,IAAI,IAAID,CAAM,EAClC,IAAK,IAAM2vB,KAAkBH,EAAiB,GAAI,CAACvvB,EAAY,IAAI0vB,CAAc,EAAG,MAAM,IAAIvlE,EAAS,cAAe,CACrH,kBAAmB,yBAAyBulE,IAC5C,MAAO,eACR,CAAC,CACF,CACA,IAAM7vB,EAAS,MAAMQ,GAA0B/V,EAAKjV,EAAMm5C,EAAWO,EAAeQ,GAAmBxvB,EAAQS,EAAa,gBAAiBF,CAAU,EACvJ,GAAIysB,EAAa,QAAS,CACzB,GAAID,GAAkCC,CAAY,EAAG,CACpD,IAAMN,EAAS,MAAMQ,GAA8B3iC,EAAKyiC,EAAc,MAAMG,GAAyC5iC,EAAKjV,EAAM,CAC/H,SACA,eACA,OAAQk6C,GAAmBxvB,EAC3B,UAAWglB,GAAagI,EAAa,SACtC,CAAC,CAAC,EACF,GAAIN,EAAQ,OAAOW,GAAmC9iC,EAAKmiC,CAAM,EACjE,MAAM,IAAItiE,EAAS,cAAe,CACjC,kBAAmB,wBACnB,MAAO,eACR,CAAC,CACF,CAEA,MADA,MAAMsgE,GAAwBngC,EAAKkkC,EAAWzB,EAAa,MAAM,EAC3D,IAAI5iE,EAAS,cAAe,CACjC,kBAAmB,wBACnB,MAAO,eACR,CAAC,CACF,CACA,IAAMojD,EAAO,MAAMjjB,EAAI,QAAQ,gBAAgB,aAAayiC,EAAa,MAAM,EAC/E,GAAI,CAACxf,EAAM,MAAM,IAAIpjD,EAAS,cAAe,CAC5C,kBAAmB,iBACnB,MAAO,iBACR,CAAC,EACD,IAAM0/D,EAAWkD,EAAa,UAAY,KAAwD,IAAK,GAAtDpwB,GAAwBowB,EAAa,QAAQ,EAC9F,OAAO9D,GAAiB3+B,EAAKjV,EAAM,CAClC,SACA,OAAQk6C,GAAmBxvB,EAC3B,OACA,UAAW,gBACX,YAAagtB,EAAa,YAC1B,oBAAqBA,EAAa,oBAClC,UAAWA,EAAa,UACxB,eACA,UAAWhI,GAAagI,EAAa,UACrC,WACA,wBAAyBA,EAAa,uBACvC,CAAC,CACF,CAGA,IAAI7D,GAAqC75D,GAAY,CACpD,uBAA0BsgE,GAC1B,6BAAgCvG,GAChC,uCAA0Cf,GAC1C,wBAA2Bc,EAC5B,CAAC,EACKyG,GAAyC,uBACzCC,GAAwC,oDAAoDD,GAAuC,GACzI,SAASE,IAAsB,CAC9B,MAAO,CACN,QAAS,CAAE,OAAQ,EAAM,EACzB,wBAAyB,CAAC,CAC3B,CACD,CAYA,SAASC,GAA4B,EAAK,EAAa,CAEtD,OADIplD,GAAO,KAAa,CAAC,GACjB,MAAM,QAAQA,CAAG,EAAIA,EAAM,CAACA,CAAG,EAAA,CAAG,OAAQ,GAAU,OAAOta,GAAU,UAAYA,IAAU2/D,CAAW,CAC/G,CASA,eAAeC,GAA0B,EAAK,EAAM,EAAQ,CAC3D,GAAM,CAAE,wBAAuB,iBAAgB,qBAAsB/gE,EAIrE,MAHI,CAACghE,GACDA,IAA0BC,GAC1BC,EAAkB,SAAW,GAC1BjL,GAA4B76B,EAAKjV,EAAM66C,EAAuBE,CAAiB,CACvF,CAMA,eAAeC,GAAuB,EAAK,EAAM,EAAO,EAAU,CACjE,IAAMC,EAAYj7C,EAAK,iBAAmB,IAAK,GAAIqnB,GAAapS,EAAI,OAAO,EACrEg/B,EAAmBgH,GAAW,QAC9BN,EAAc,GAAG1lC,EAAI,QAAQ,SAAW,GAAG,kBAC3CimC,EAAiBjH,GAAkB,KAAK,QAAUh/B,EAAI,QAAQ,QAChE00B,EACJ,GAAI,CACH,GAAc,MAAMzyC,GAAUzG,EAAOoK,GAAkB,MAAM6oB,GAAQjzB,EAAO,CAC3E,UAAWwjD,GAAkB,MAAM,UAAYA,EAAiB,KAAK,UAAY,UACxE,MAAMgH,GAAW,UAAU,QAAQhmC,CAAG,EAAA,EAAI,SAEnD,aAAcgmC,CACf,CAAC,CAAC,EAAG,CAAE,OAAQC,CAAe,CAAC,EAAA,CAAG,OACnC,OAAS/pD,EAAO,CACf,GAAIA,aAAiB,MAAO,CAC3B,GAAIA,EAAM,OAAS,aAAeA,EAAM,OAAS,aAAc,MAAM,IAAInc,EAAW,cAAe,CAClG,kBAAmB,wBACnB,MAAO,iBACR,CAAC,EAEI,GADImc,EAAM,OAAS,cACfA,EAAM,OAAS,aAAc,MAAO,CAAE,OAAQ,EAAM,EAC7D,MAAMA,CACP,CACA,MAAU,MAAMA,CAAK,CACtB,CACA,IAAMgqD,EAASxR,EAAW,IAE1B,GADI,CAAC,MAAMkE,GAAuB54B,EAAKjV,EAAMm7C,EAAQ,CAACR,CAAW,CAAC,GAC9D,CAAChR,EAAW,IAAK,MAAO,CAAE,OAAQ,EAAM,EAC5C,IAAMnf,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAM2pC,EAAW,GAAG,EAExD,GADI,CAACnf,GAAUA,GAAQ,UACnB,CAAC,MAAMowB,GAA0B3lC,EAAKjV,EAAM,CAC/C,sBAAuBqZ,EACvB,eAAgBswB,EAAW,IAC3B,kBAAmB+Q,GAA4BS,EAAQR,CAAW,CACnE,CAAC,EAAG,MAAO,CAAE,OAAQ,EAAM,EAC3B,IAAM/F,EAAYjL,EAAW,IAC7B,GAAIiL,EAAW,CACd,IAAMtc,EAAU,MAAMrjB,EAAI,QAAQ,QAAQ,QAAQ,CACjD,MAAO,UACP,MAAO,CAAC,CACP,MAAO,KACP,MAAO2/B,CACR,CAAC,CACF,CAAC,EACD,GAAI,CAACtc,GAAWA,EAAQ,UAA4B,IAAI,KAAQ,MAAO,CAAE,OAAQ,EAAM,CACxF,CAIA,MAHA,GAAW,UAAYqR,EAAW,IAClC,EAAW,OAAS,GACpB,EAAW,WAAa0J,GAAsB1J,EAAW,GAAG,EACrDA,CACR,CAMA,eAAeyR,GAA0B,EAAK,EAAM,EAAO,EAAU,CACpE,IAAIC,EAAa5qD,EACjB,GAAIuP,EAAK,QAAQ,kBAAmB,IAAIq7C,EAAW,WAAWr7C,EAAK,OAAO,iBAAiB,EAAG,EAAaq7C,EAAW,QAAQr7C,EAAK,OAAO,kBAAmB,EAAE,OAC1J,MAAM,IAAIhrB,EAAW,cAAe,CACxC,kBAAmB,gCACnB,MAAO,iBACR,CAAC,CAAA,CACD,IAAMksC,EAAc,MAAMjM,EAAI,QAAQ,QAAQ,QAAQ,CACrD,MAAO,mBACP,MAAO,CAAC,CACP,MAAO,QACP,MAAO,MAAMsU,GAAevpB,EAAK,YAAaq7C,EAAY,cAAc,CACzE,CAAC,CACF,CAAC,EACD,GAAI,CAACn6B,EAAa,MAAM,IAAIlsC,EAAW,cAAe,CACrD,kBAAmB,gCACnB,MAAO,eACR,CAAC,EAED,GADI,CAACksC,EAAY,WAAaA,EAAY,UAA4B,IAAI,MACtEA,EAAY,QAAS,OAAOu5B,GAAoB,EACpD,IAAM/K,EAAY,MAAM,QAAQxuB,EAAY,SAAS,EAAIA,EAAY,UAAY,IAAK,GAClFsJ,EACJ,GAAItJ,EAAY,WACf,EAAS,MAAMkH,GAAUnT,EAAKjV,EAAMkhB,EAAY,QAAQ,EACpD,CAACsJ,GAAUA,GAAQ,UACnB,CAAC,MAAMowB,GAA0B3lC,EAAKjV,EAAM,CAC/C,sBAAuBqZ,EACvB,eAAgB6H,EAAY,SAC5B,kBAAmBwuB,GAAa,CAAC,CAClC,CAAC,GAAG,OAAO+K,GAAoB,EAEhC,IAAM7F,EAAY1zB,EAAY,WAAa,IAAK,GAChD,GAAI0zB,EAAW,CACd,IAAMtc,EAAU,MAAMrjB,EAAI,QAAQ,QAAQ,QAAQ,CACjD,MAAO,UACP,MAAO,CAAC,CACP,MAAO,KACP,MAAO2/B,CACR,CAAC,CACF,CAAC,EACD,GAAI,CAACtc,GAAWA,EAAQ,UAA4B,IAAI,KAAQ,OAAOmiB,GAAoB,CAC5F,CACA,IAAIviB,EACAhX,EAAY,SAAQ,EAAO,MAAMjM,EAAI,QAAQ,gBAAgB,aAAaiM,GAAa,MAAM,GACjG,IAAM6xB,EAAmB,GAAG99B,EAAI,QAAQ,QAAQ,kBAChD,GAAIy6B,GAAW,QAAU,CAAC,MAAM7B,GAAuB54B,EAAKjV,EAAM0vC,EAAW,CAACqD,CAAgB,CAAC,EAAG,OAAO0H,GAAoB,EAC7H,IAAM3M,EAAgB4B,EAAY,CAAC,GAAGA,CAAS,EAAI,IAAK,GACpD5B,GAAe,QAAU5sB,EAAY,QAAQ,SAAS,QAAQ,IAC5D4sB,EAAc,SAASiF,CAAgB,GAAGjF,EAAc,KAAKiF,CAAgB,GAEnF,IAAM3G,EAAuBsD,GAAW,OAAS,MAAMM,GAAwB/6B,EAAKjV,EAAM0vC,CAAS,EAAI,CAAC,EAClGmJ,EAAoBruB,EAAS,MAAMwhB,GAAyB,CACjE,MACA,OACA,OACA,SACA,OAAQ9qB,EAAY,QAAU,CAAC,EAC/B,UAAW,IAAK,GAChB,UAAW,IAAK,GAChB,YACA,YAAaA,EAAY,YACzB,SAAUkK,GAAoBZ,EAAO,QAAQ,EAC7C,iBAAkB,IAAK,GACvB,sBACD,CAAC,EAAI,CAAC,EACAypB,GAAoBj0C,EAAK,iBAAmB,IAAK,GAAIqnB,GAAapS,EAAI,OAAO,EAAA,EAAI,QACvF,MAAO,CACN,QAAS,CACR,GAAG4jC,EACH,OAAQ,GACR,IAAK5E,GAAkB,KAAK,QAAUh/B,EAAI,QAAQ,QAClD,IAAK2S,GAAgBkmB,CAAa,EAClC,UAAW5sB,EAAY,SACvB,IAAKA,EAAY,SACjB,IAAKgX,GAAM,GACX,IAAK0c,EACL,IAAK,KAAK,MAAM,IAAI,KAAK1zB,EAAY,SAAS,CAAC,CAAC,QAAQ,EAAI,GAAG,EAC/D,IAAK,KAAK,MAAM,IAAI,KAAKA,EAAY,SAAS,CAAC,CAAC,QAAQ,EAAI,GAAG,EAC/D,MAAOA,EAAY,QAAQ,KAAK,GAAG,EACnC,WAAYmyB,GAAsBnyB,EAAY,YAAY,EAC1D,GAAGA,EAAY,aAAe,CAAE,IAAKA,EAAY,YAAa,EAAI,CAAC,CACpE,EACA,wBAAyBA,EAAY,yBAA2B,CAAC,CAClE,CACD,CAMA,eAAeo6B,GAAqB,EAAK,EAAM,EAAO,EAAU,CAC/D,IAAM5D,EAAe,MAAMziC,EAAI,QAAQ,QAAQ,QAAQ,CACtD,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,QACP,MAAO,MAAMsU,GAAevpB,EAAK,YAAavP,EAAO,eAAe,CACrE,CAAC,CACF,CAAC,EACD,GAAI,CAACinD,EAAc,MAAM,IAAI1iE,EAAW,cAAe,CACtD,kBAAmB,kBACnB,MAAO,eACR,CAAC,EAGD,GAFI,CAAC0iE,EAAa,UAAYA,EAAa,WAAar+B,GACpD,CAACq+B,EAAa,WAAaA,EAAa,UAA4B,IAAI,MACxEA,EAAa,QAAS,MAAO,CAAE,OAAQ,EAAM,EACjD,IAAI9C,EAAY8C,EAAa,WAAa,IAAK,GAC/C,GAAI9C,EAAW,CACd,IAAMtc,EAAU,MAAMrjB,EAAI,QAAQ,QAAQ,QAAQ,CACjD,MAAO,UACP,MAAO,CAAC,CACP,MAAO,KACP,MAAO2/B,CACR,CAAC,CACF,CAAC,GACG,CAACtc,GAAWA,EAAQ,UAA4B,IAAI,QAAQ,EAAY,IAAK,GAClF,CACA,IAAIJ,EAEJ,OADIwf,EAAa,SAAQ,EAAO,MAAMziC,EAAI,QAAQ,gBAAgB,aAAayiC,GAAc,MAAM,GAAK,IAAK,IACtG,CACN,OAAQ,GACR,UAAWr+B,EACX,MAAOrZ,EAAK,iBAAmB,IAAK,GAAIqnB,GAAapS,EAAI,OAAO,EAAA,EAAI,QAAA,EAAU,KAAK,QAAUA,EAAI,QAAQ,QACzG,IAAKijB,GAAM,GACX,IAAK0c,EACL,IAAK,KAAK,MAAM,IAAI,KAAK8C,EAAa,SAAS,CAAC,CAAC,QAAQ,EAAI,GAAG,EAChE,IAAK,KAAK,MAAM,IAAI,KAAKA,EAAa,SAAS,CAAC,CAAC,QAAQ,EAAI,GAAG,EAChE,MAAOA,EAAa,QAAQ,KAAK,GAAG,EACpC,WAAYrE,GAAsBqE,EAAa,YAAY,EAC3D,GAAGA,EAAa,aAAe,CAAE,IAAKA,EAAa,YAAa,EAAI,CAAC,CACtE,CACD,CACA,SAAS6D,IAAgC,CACxC,OAAO,IAAIvmE,EAAW,eAAgB,CACrC,kBAAmBulE,GACnB,MAAO,eACR,EAAG,CAAE,mBAAoBC,EAAsC,CAAC,CACjE,CACA,SAASgB,GAAqB,EAAO,CACpC,OAAOrqD,EAAM,SAAW,eAAiBA,EAAM,MAAM,QAAU,eAChE,CAOA,eAAesqD,GAA6B,EAAK,EAAM,EAAO,EAAU,CACvE,GAAI,CACH,MAAO,CACN,QAAS,MAAMT,GAAuB/lC,EAAKjV,EAAMvP,EAAO4oB,CAAQ,EAChE,wBAAyB,CAAC,CAC3B,CACD,OAAS7nB,EAAK,CACb,GAAI,eAAexc,GACd,MADsCwc,aAAe,MAAaA,EACxD,MAAMA,CAAG,CACzB,CACA,GAAI,CACH,OAAO,MAAM4pD,GAA0BnmC,EAAKjV,EAAMvP,EAAO4oB,CAAQ,CAClE,OAAS7nB,EAAK,CACb,GAAI,eAAexc,GACd,MADsCwc,aAAe,MAAaA,EACxD,MAAM,uCAAuC,CAC7D,CACA,MAAM+pD,GAA8B,CACrC,CAOA,eAAezH,GAAoB,EAAK,EAAM,EAAO,EAAU,CAC9D,OAAQ,MAAM2H,GAA6BxmC,EAAKjV,EAAMvP,EAAO4oB,CAAQ,EAAA,CAAG,OACzE,CACA,eAAe06B,GAAyB,EAAK,EAAM,EAAO,EAAU,CACnE,IAAMlxD,EAAU,MAAMixD,GAAoB7+B,EAAKjV,EAAMvP,EAAO4oB,CAAQ,EACpE,GAAIx2B,EAAQ,OAAQ,OAAOA,EAC3B,MAAM04D,GAA8B,CACrC,CAOA,eAAevI,GAAmC,EAAK,EAAM,EAAO,EAAU,CAC7E,GAAM,CAAE,UAAS,2BAA4B,MAAMyI,GAA6BxmC,EAAKjV,EAAMvP,EAAO4oB,CAAQ,EAC1G,GAAIx2B,EAAQ,OAAQ,MAAO,CAC1B,UACA,yBACD,EACA,MAAM04D,GAA8B,CACrC,CAMA,eAAeG,GAAwB,EAAK,EAAM,EAAS,EAAqB,CAC/E,GAAI,CAAC74D,EAAQ,QAAU,CAACA,EAAQ,IAAK,OAAOA,EAC5C,IAAMi4D,EAAiBj4D,EAAQ,WAAaA,EAAQ,IACpD,GAAI,CAACi4D,EAAgB,OAAOj4D,EAC5B,IAAM84D,EAAgBb,IAAmBc,EAAoB,SAAWA,EAAsB,MAAMxzB,GAAUnT,EAAKjV,EAAM86C,CAAc,EACvI,GAAI,CAACa,EAAe,OAAO94D,EAC3B,IAAMyxD,EAAc,MAAMjoB,GAAyBxpC,EAAQ,IAAK84D,EAAe37C,CAAI,EACnF,MAAO,CACN,GAAGnd,EACH,IAAKyxD,CACN,CACD,CACA,eAAegG,GAAmB,EAAK,EAAM,CAC5C,GAAI,CAAE,QAAO,mBAAoBrlC,EAAI,KACjC4mC,IAAoB,gBAAkBA,IAAoB,kBAAiB,EAAkB,IAAK,IACtG,GAAM,CAAE,SAAU1C,EAAW,aAAcO,EAAe,cAAa,cAAeruB,GAAuB,MAAMC,GAAyBrW,EAAKjV,EAAM,GAAGiV,EAAI,QAAQ,QAAQ,mBAAmB,CAAC,EAClM,GAAI,CAACkkC,GAAa,CAACO,GAAiB,CAACvuB,EAAa,MAAM,IAAIn2C,EAAW,eAAgB,CACtF,kBAAmB,+BACnB,MAAO,gBACR,CAAC,EAED,GADIyb,GAAS,OAAOA,GAAU,WAAU,EAAQswB,GAAoCtwB,CAAK,GACrF,CAACA,GAAO,OAAQ,MAAM,IAAIzb,EAAW,cAAe,CACvD,kBAAmB,6CACnB,MAAO,iBACR,CAAC,EACD,IAAMw1C,EAAS,MAAMQ,GAA0B/V,EAAKjV,EAAMm5C,EAAWO,EAAe,IAAK,GAAGvuB,EAAa,IAAK,GAAGF,CAAU,EAC3H,GAAI,CACH,GAAI4wB,IAAoB,IAAK,IAAKA,IAAoB,eAAgB,GAAI,CACzE,OAAOH,GAAwBzmC,EAAKjV,EAAM,MAAM8zC,GAAoB7+B,EAAKjV,EAAMvP,EAAO+5B,EAAO,QAAQ,EAAGA,CAAM,CAC/G,OAASr5B,EAAO,CACf,GAAIA,aAAiBnc,EAChB,IAAA6mE,IAAoB,eAAgB,MAAM1qD,CAAA,MACxC,GAAIA,aAAiB,MAAO,MAAMA,OACpC,MAAU,MAAMA,CAAK,CAC3B,CACA,GAAI0qD,IAAoB,IAAK,IAAKA,IAAoB,gBAAiB,GAAI,CAC1E,OAAOH,GAAwBzmC,EAAKjV,EAAM,MAAMs7C,GAAqBrmC,EAAKjV,GAAO,MAAMi1C,GAAmBj1C,EAAMvP,CAAK,EAAA,CAAG,MAAO+5B,EAAO,QAAQ,EAAGA,CAAM,CACxJ,OAASr5B,EAAO,CACf,GAAIA,aAAiBnc,EAChB,IAAA6mE,IAAoB,gBAAiB,MAAM1qD,CAAA,MACzC,GAAIA,aAAiB,MAAO,MAAMA,OACpC,MAAU,MAAMA,CAAK,CAC3B,CACA,MAAM,IAAInc,EAAW,cAAe,CACnC,kBAAmB,kBACnB,MAAO,iBACR,CAAC,CACF,OAASmc,EAAO,CACf,GAAIA,aAAiBnc,EAAY,CAChC,GAAIwmE,GAAqBrqD,CAAK,EAAG,MAAO,CAAE,OAAQ,EAAM,EACxD,MAAMA,CACP,CAKC,MALUA,aAAiB,OAC3B1X,GAAO,MAAM,uBAAwB0X,EAAM,QAASA,EAAM,KAAK,EACzD,IAAInc,EAAW,uBAAuB,IAE5CyE,GAAO,MAAM,uBAAwB0X,CAAK,EACpC,IAAInc,EAAW,uBAAuB,EAE9C,CACD,CC3+EA,IAAM8mE,GAAkB,QCDxB,SAASC,GAAsB,EAAS,CACvC,OAAO13D,GAAS,IAAI,gBAAgB,IAAM,MAC3C,gHCsBA,eAAes4D,GAAgB,EAAK,EAAM,EAAW,CACpD,IAAMC,EAAe,MAAMC,GAAW,IAAI,EACpCC,EAASF,GAAc,MAC7B,GAAI,CAACE,EAAQ,MAAM,IAAI7nE,EAAS,cAAe,CAC9C,kBAAmB,sBACnB,MAAO,iBACR,CAAC,EACD,IAAMgjC,EAAQ,IAAI,gBAAgB6kC,CAAM,EAClCC,EAA0B9kC,EAAM,IAAI,OAAO,CAAC,EAAE,MAAM,GAAG,GAAK,CAAC,EAC7D6yB,EAAkBc,GAAmB5rC,CAAI,EACzCg9C,EAAkCrS,GAA2B1yB,EAAM,IAAI,QAAQ,EAAG6yB,CAAe,EACjGzxB,EAAWpB,EAAM,IAAI,WAAW,EACtC,GAAI,CAACoB,EAAU,MAAM,IAAIpkC,EAAS,cAAe,CAChD,kBAAmB,wBACnB,MAAO,gBACR,CAAC,EACD,IAAMilE,EAAkBjlC,EAAI,KAAK,OAAO,MAAM,GAAG,EACjD,GAAIilC,GACC,CAACA,EAAgB,MAAO,GAAO6C,GAAyB,SAAS7E,CAAE,CAAC,EAAG,MAAM,IAAIjjE,EAAS,cAAe,CAC5G,kBAAmB,iCACnB,MAAO,iBACR,CAAC,EAEF,IAAMgoE,EAAiBhoC,EAAI,KAAK,OAC1BioC,EAAyBD,IAAmB,IAAK,GAAkED,EAA9DrS,GAA2BsS,EAAgBnS,CAAe,EACrH,GAAImS,IAAmB,IAAK,IAAK,CAACC,EAAuB,MAAO,GAAUF,EAAgC,SAASr6D,CAAK,CAAC,EAAG,MAAM,IAAI1N,EAAS,cAAe,CAC7J,kBAAmB,iCACnB,MAAO,iBACR,CAAC,EACD,GAAMggC,EAAI,KAAK,SAAW,GAAO,MAAO,CACvC,SAAU,GACV,IAAKkoC,GAAellC,EAAM,IAAI,cAAc,GAAK,GAAI,gBAAiB,qBAAsBA,EAAM,IAAI,OAAO,GAAK,IAAK,GAAGwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAC/I,EACA,IAAMs4B,EAAU,MAAMiK,EAAkBttB,CAAG,EACrCmoC,EAAiBvxB,GAAY5T,EAAM,IAAI,QAAQ,GAAK,EAAE,CAAC,CAAC,IAAI,OAAO,EACnEolC,EAA0BD,GAAkB7wB,GAA6B+L,GAAS,QAAQ,UAAWskB,GAAc,mBAAmB,EAC5I,GAAIQ,GAAkB,CAACC,EAGtB,OAFApoC,GAAK,SAAS,IAAI,SAAU,kBAAkB,EAC9C,EAAI,MAAQqX,GAAoBrU,CAAK,EAC9B,MAAMqlC,EAAUroC,CAAG,EAE3B,IAAM2jC,EAAc,MAAM54C,EAAK,WAAW,qBAAqB,CAC9D,KAAMs4B,GAAS,KACf,QAASA,GAAS,QAClB,OAAQ4hB,GAAmB6C,CAC5B,CAAC,EACKQ,EAAe,MAAMtoC,EAAI,QAAQ,QAAQ,QAAQ,CACtD,MAAO,eACP,MAAO,CACN,CACC,MAAO,WACP,MAAOoE,CACR,EACA,CACC,MAAO,SACP,MAAOif,GAAS,KAAK,EACtB,EACA,GAAGsgB,EAAc,CAAC,CACjB,MAAO,cACP,MAAOA,CACR,CAAC,EAAI,CAAC,CACP,CACD,CAAC,EACKriD,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACjCq3C,EAAW31B,EAAM,OAAO,UAAU,EAClCulC,EAAU,CACf,WACA,OAAQllB,GAAS,KAAK,GACtB,OAAQ4hB,GAAmB6C,EAC3B,wBAAyBG,EACzB,UAA2B,IAAI,KAAK3mD,EAAM,GAAG,EAC7C,UAA2B,IAAI,KAAKA,EAAM,GAAG,EAC7C,UAAWq3C,EAAS,OAASA,EAAW,IAAK,GAC7C,aACD,EAqBA,GApBA2P,GAAc,GAAK,MAAMtoC,EAAI,QAAQ,QAAQ,OAAO,CACnD,MAAO,eACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOsoC,EAAa,EACrB,CAAC,EACD,OAAQ,CACP,UAAWC,EAAQ,UACnB,OAAQA,EAAQ,OAChB,wBAAyBA,EAAQ,wBACjC,UAA2B,IAAI,KAAKjnD,EAAM,GAAG,CAC9C,CACD,CAAC,EAAI,MAAM0e,EAAI,QAAQ,QAAQ,OAAO,CACrC,MAAO,eACP,KAAM,CACL,GAAGuoC,EACH,OAAQA,EAAQ,MACjB,CACD,CAAC,EACGtD,GAAiBjiC,EAAM,IAAI,QAASulC,EAAQ,OAAO,KAAK,GAAG,CAAC,EAC5DP,IAAmB,IAAK,GAAG,CAC9B,IAAMjS,EAAgBK,GAAkCpzB,EAAM,IAAI,QAAQ,EAAGilC,CAAsB,EAC/FlS,EAAe/yB,EAAM,IAAI,SAAU,KAAK,UAAU+yB,CAAa,CAAC,EAC/D/yB,EAAM,OAAO,QAAQ,CAC3B,CACAhD,GAAK,SAAS,IAAI,SAAU,kBAAkB,EAC9C,IAAIwoC,EAAqB/wB,GAAsBzU,EAAO,SAAS,EAM/D,OALIolC,IACH,EAAqB3wB,GAAsB+wB,EAAoB,OAAO,EACtE,EAAqB3wB,GAAsB2wB,CAAkB,GAE9D,EAAI,MAAQnxB,GAAoBmxB,CAAkB,EAC3C,MAAMH,EAAUroC,EAAK,CAAE,UAAW2nC,GAAc,6BAA+B,IAAK,IAAKA,EAAa,6BAA+BtkB,GAAS,QAAQ,EAAG,CAAC,CAClK,CAGA,eAAeolB,GAAiB,EAAK,EAAW,CAC/C,GAAIzoC,EAAI,KAAK,WAAa,GAAM,OAAO,MAAMjkB,GAASikB,EAAKqoC,CAAS,EAC/D,GAAIroC,EAAI,KAAK,UAAY,GAAM,OAAO,MAAMs8B,GAAQt8B,EAAKqoC,CAAS,EAClE,GAAIroC,EAAI,KAAK,YAAc,GAAM,OAAO,MAAM0oC,GAAU1oC,EAAKqoC,CAAS,EACtE,MAAM,IAAIroE,EAAS,cAAe,CACtC,kBAAmB,qBACnB,MAAO,iBACR,CAAC,CACF,CACA,eAAe+b,GAAS,EAAK,EAAW,CACvC,IAAM8rD,GAAU,MAAMD,GAAW,IAAI,EAAA,EAAI,MACzC,GAAI,CAACC,EAAQ,MAAM,IAAI7nE,EAAS,cAAe,CAC9C,kBAAmB,sBACnB,MAAO,iBACR,CAAC,EAGD,OAFAggC,EAAI,SAAS,IAAI,SAAU,kBAAkB,EAC7C,EAAI,MAAQqX,GAAoBI,GAAsB,IAAI,gBAAgBowB,CAAM,EAAG,gBAAgB,CAAC,EAC7F,MAAMQ,EAAUroC,CAAG,CAC3B,CACA,eAAes8B,GAAQ,EAAK,EAAW,CACtC,IAAMuL,GAAU,MAAMD,GAAW,IAAI,EAAA,EAAI,MACzC,GAAI,CAACC,EAAQ,MAAM,IAAI7nE,EAAS,cAAe,CAC9C,kBAAmB,sBACnB,MAAO,iBACR,CAAC,EACD,IAAMgjC,EAAQ,IAAI,gBAAgB6kC,CAAM,EAGxC,OAFA7nC,EAAI,SAAS,IAAI,SAAU,kBAAkB,EAC7C,EAAI,MAAQqX,GAAoBI,GAAsBzU,EAAO,QAAQ,CAAC,EAC/D,MAAMqlC,EAAUroC,CAAG,CAC3B,CACA,eAAe0oC,GAAU,EAAK,EAAW,CACxC,IAAMt+D,EAAQ,MAAMw9D,GAAW,IAAI,EAC7BC,EAASz9D,GAAO,MACtB,GAAI,CAACy9D,EAAQ,MAAM,IAAI7nE,EAAS,cAAe,CAC9C,kBAAmB,sBACnB,MAAO,iBACR,CAAC,EACD,IAAMgjC,EAAQ,IAAI,gBAAgB6kC,CAAM,EACxC7nC,EAAI,SAAS,IAAI,SAAU,kBAAkB,EAC7C,EAAI,MAAQqX,GAAoBrU,CAAK,EACrC,IAAMqgB,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,OAAO,MAAMqoC,EAAUroC,EAAK,CAAE,UAAW51B,GAAO,6BAA+B,IAAK,IAAKA,EAAM,6BAA+Bi5C,GAAS,QAAQ,EAAG,CAAC,CACpJ,CAGA,IAAMslB,GAA+B,qDAC/BC,GAAuB,aACvBC,GAAgC,IAChCC,GAAkC,IAaxC,eAAeC,GAAgB,EAAK,EAAS,EAAa,EAAQ,CACjE,OAAO3U,GAAQp0B,EAAK,CACnB,UACA,QAAS,CACR,GAAGyR,EACH,OAAQ,EAAGk3B,IAA+B,CAAC,CAAE,CAC9C,EACA,OAAQ,CAAE,IAAKC,EAAqB,EACpC,YAAazsD,GAAe,IAAK,EAClC,CAAC,CACF,CAuBA,eAAe6sD,GAA6B,EAAK,EAAM,EAAO,CAC7D,GAAM,CAAE,YAAW,UAAWl8D,EAC9B,GAAI,CAACqqC,EAAQ,OAAO,KACpB,IAAM3yC,EAASw7B,EAAI,QAAQ,OAC3B,GAAI,CACH,IAAMmhB,EAAU,MAAMT,GAAkB1gB,EAAI,QAAQ,OAAO,EACrDy8B,EAAQ,CAAC,CACd,MAAO,YACP,MAAOkD,CACR,CAAC,EACK,CAACsJ,EAAc7I,GAAiB,MAAM,QAAQ,IAAI,CAACjf,EAAQ,SAAS,CACzE,MAAO,mBACP,OACD,CAAC,EAAGA,EAAQ,SAAS,CACpB,MAAO,oBACP,OACD,CAAC,CAAC,CAAC,EACG+nB,EAAoC,IAAI,IAC9C,IAAK,IAAMn0C,KAAKk0C,EAAcC,EAAkB,IAAIn0C,EAAE,QAAQ,EAC9D,IAAK,IAAMA,KAAKqrC,EAAe8I,EAAkB,IAAIn0C,EAAE,QAAQ,EAC/D,GAAIm0C,EAAkB,OAAS,EAAG,OAAO,KACzC,IAAMC,EAAU,MAAMhoB,EAAQ,SAAS,CACtC,MAAO,cACP,MAAO,CAAC,CACP,MAAO,WACP,SAAU,KACV,MAAO,MAAM,KAAK+nB,CAAiB,CACpC,CAAC,CACF,CAAC,EACKE,EAAoBH,EAAa,OAAQ,GAAM,CAACl0C,EAAE,OAAO,CAAC,CAAC,IAAK,GAAMA,EAAE,EAAE,EAC1Es0C,EAAqBjJ,EAAc,OAAQ,GAAM,CAACrrC,EAAE,SAAW,CAACA,EAAE,QAAQ,SAAS,gBAAgB,CAAC,CAAC,CAAC,IAAK,GAAMA,EAAE,EAAE,EACrHu0C,EAAkBv+C,EAAK,iBAAmB,CAAC,EAAIo+C,EAAQ,OAAQ,GAAM,EAAQ5/D,EAAE,sBAAyB,CAACA,EAAE,QAAQ,EACzH,MAAO,CACN,eAAgB6/D,EAChB,gBAAiBC,EACjB,YACA,SAAU,MAAM,QAAQ,IAAIC,EAAgB,IAAI,KAAO,IAAW,CACjE,GAAI,CACH,MAAO,CACN,SACA,IAAK,MAAMlyB,GAAyBD,EAAQ5B,EAAQxqB,CAAI,CACzD,CACD,OAAS7O,EAAO,CAEf,OADA1X,EAAO,KAAK,6DAA6D+wC,EAAO,WAAYr5B,CAAK,EAC1F,IACR,CACD,CAAC,CAAC,EAAA,CAAG,OAAQ,GAAWlX,IAAW,IAAI,CACxC,CACD,OAASkX,EAAO,CAEf,OADA1X,EAAO,MAAM,sCAAuC0X,CAAK,EAClD,IACR,CACD,CAMA,eAAeqtD,GAA2B,EAAK,EAAM,CACpD,IAAMC,EAA4B,IAAI,KAChCroB,EAAU,MAAMT,GAAkB1gB,EAAI,QAAQ,OAAO,EACrDypC,EAAc,MAAM,QAAQ,WAAW,CAACC,EAAK,eAAe,OAAS,EAAIvoB,EAAQ,WAAW,CACjG,MAAO,mBACP,MAAO,CAAC,CACP,MAAO,KACP,SAAU,KACV,MAAOuoB,EAAK,cACb,CAAC,EACD,OAAQ,CAAE,QAASF,CAAU,CAC9B,CAAC,EAAI,QAAQ,QAAQ,EAAGE,EAAK,gBAAgB,OAAS,EAAIvoB,EAAQ,WAAW,CAC5E,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,KACP,SAAU,KACV,MAAOuoB,EAAK,eACb,CAAC,EACD,OAAQ,CAAE,QAASF,CAAU,CAC9B,CAAC,EAAI,QAAQ,QAAQ,CAAC,CAAC,EACvB,IAAK,IAAMzqD,KAAU0qD,EAAiB1qD,EAAO,SAAW,YAAYihB,EAAI,QAAQ,OAAO,MAAM,sDAAuDjhB,EAAO,MAAM,EAC7J2qD,EAAK,QAAQ,OAAS,GAAG,MAAMC,GAA+B3pC,EAAK0pC,CAAI,CAC5E,CAaA,eAAeC,GAA+B,EAAK,EAAM,CACxD,IAAMnlE,EAASw7B,EAAI,QAAQ,OACrBg/B,EAAmB5sB,GAAapS,EAAI,OAAO,CAAC,EAAE,QAC9Cu0B,EAAMyK,GAAkB,KAAK,QAAUh/B,EAAI,QAAQ,QACnD1e,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACjCE,EAAMF,EAAMunD,GACZ1sD,EAAc6iD,GAAkB,KAAK,KAAO,KAAO,MAAMjL,GAAkB/zB,EAAKg/B,CAAgB,EACtG,MAAM,QAAQ,WAAW0K,EAAK,QAAQ,IAAI,MAAO,CAAE,SAAQ,SAAU,CACpE,GAAI,CACH,IAAMr8B,EAAMxlB,GAAqB,GAAI,MAAO,MAAO,KAAK,EAClDrM,EAAQ,MAAMutD,GAAgB/oC,EAAKg/B,EAAkB7iD,EAAa,CACvE,MACA,IAAKo5B,EAAO,SACZ,MACA,IAAKm0B,EAAK,UACV,MACA,MACA,KACD,CAAC,EACKjvC,EAAW,MAAM,MAAM8a,EAAO,qBAAsB,CACzD,OAAQ,OACR,QAAS,CACR,eAAgB,oCAChB,OAAQ,kBACT,EACA,KAAM,IAAI,gBAAgB,CAAE,aAAc/5B,CAAM,CAAC,EACjD,OAAQ,YAAY,QAAQstD,EAA+B,EAC3D,SAAU,OACX,CAAC,EACGruC,EAAS,SAAW,KAAOA,EAAS,SAAW,KAAKj2B,EAAO,KAAK,iCAAiC+wC,EAAO,SAAS,YAAY9a,EAAS,QAAQ,CACnJ,OAASve,EAAO,CACf1X,EAAO,KAAK,iCAAiC+wC,EAAO,SAAS,SAAUr5B,CAAK,CAC7E,CACD,CAAC,CAAC,CACH,CACA,IAAM0tD,GAAkC,IAClCC,GAAoC,6BAC1C,SAASC,GAAW,EAAO,CAC1B,OAAO/jE,EAAM,QAAQ,WAAa,GAAc,CAC/C,OAAQgkE,EAAR,CACC,IAAK,IAAK,MAAO,QACjB,IAAK,IAAK,MAAO,OACjB,IAAK,IAAK,MAAO,OACjB,IAAK,IAAM,MAAO,SAClB,IAAK,IAAK,MAAO,QACjB,QAAS,OAAOA,CACjB,CACD,CAAC,CACF,CACA,SAASC,GAAoB,EAAK,CACjC,IAAM56D,EAAU4wB,EAAI,SAAS,SAAWA,EAAI,QAC5C,GAAI,CAAC5wB,GAAW03D,GAAsB13D,CAAO,EAAG,MAAO,GACvD,IAAM66D,EAAS76D,EAAQ,IAAI,QAAQ,GAAK,GACxC,OAAOA,EAAQ,IAAI,gBAAgB,IAAM,YAAc66D,EAAO,SAAS,WAAW,GAAKA,EAAO,SAAS,uBAAuB,CAC/H,CACA,SAASC,GAAW,EAAO,EAAM,EAAS,IAAK,CAC9C,OAAO,IAAI,SAAS,2DAA2DJ,GAAWzhD,CAAK,EAAE,uBAAuBgS,EAAK,gBAAiB,CAC7I,SACA,QAAS,CACR,gBAAiB,WACjB,0BAA2B,kFAC3B,eAAgB,2BAChB,OAAQ,WACR,yBAA0B,SAC3B,CACD,CAAC,CACF,CACA,SAAS8vC,GAAuB,EAAK,CACpC,MAAO,GAAGnqC,EAAI,QAAQ,QAAQ,QAAQ,MAAO,EAAE,EAAE,4BAClD,CACA,SAASoqC,GAA6B,EAAK,CAC1C,GAAI,CACH,OAAO,IAAI,IAAID,GAAuBnqC,CAAG,CAAC,CAAC,CAAC,QAC7C,MAAQ,CACP,MAAO,6BACR,CACD,CACA,SAASqqC,GAAuB,EAAK,CACpC,OAAOH,GAAW,iBAAkB,wIAAwIJ,GAAWK,GAAuBnqC,CAAG,CAAC,EAAE,4FAA4F,CACjT,CACA,SAASsqC,GAAkB,EAAM,CAChC,OAAOJ,GAAW,aAAc,gDAAgDK,EAAO,eAAeT,GAAWS,CAAI,IAAM,cAAc,YAAY,CACtJ,CACA,SAASC,GAAgB,EAAa,EAAQ,CAC7C,OAAON,GAAW,eAAgB,gEAAgEJ,GAAWhlD,CAAW,EAAE,aAAcsV,CAAM,CAC/I,CACA,SAASqwC,GAAoB,EAAK,EAAQ,EAAO,EAAa,CAC7D,GAAIT,GAAoBhqC,CAAG,EAAG,OAAOwqC,GAAgB1lD,EAAasV,IAAW,cAAgB,IAAMA,IAAW,eAAiB,IAAM,GAAG,EACxI,MAAM,IAAIn6B,EAAWm6B,EAAQ,CAC5B,QACA,kBAAmBtV,CACpB,CAAC,CACF,CACA,SAAS4lD,GAA6B,EAAK,CAC1C,MAAO,GAAG1qC,EAAI,QAAQ,YAAY,aAAa,OAAO6pC,IACvD,CACA,SAASc,GAAgC,EAAK,EAAQ,CACrD,MAAO,CACN,GAAG3qC,EAAI,QAAQ,YAAY,aAAa,WACxC,SAAU,GACV,SACA,KAAMoqC,GAA6BpqC,CAAG,EACtC,SAAU,KACX,CACD,CACA,eAAe4qC,GAA2B,EAAK,EAAW,EAAe,CAAC,EAAG,CAC5E,IAAMxgE,EAAQ,CACb,GAAGu1D,EAAY,CAAE,WAAU,EAAI,CAAC,EAChC,GAAGvzB,EACH,UAAW,KAAK,IAAI,EAAIw9B,GAAkC,GAC3D,EACA,MAAM5pC,EAAI,gBAAgB0qC,GAA6B1qC,CAAG,EAAG,KAAK,UAAU51B,CAAK,EAAG41B,EAAI,QAAQ,OAAQ2qC,GAAgC3qC,EAAK4pC,EAA+B,CAAC,CAC9K,CACA,eAAeiB,GAA2B,EAAK,CAC9C,IAAM9kE,EAAQ,MAAMi6B,EAAI,gBAAgB0qC,GAA6B1qC,CAAG,EAAGA,EAAI,QAAQ,MAAM,EAC7F,GAAI,OAAOj6B,GAAU,SAAU,OAAO,KACtC,GAAI,CACH,IAAM8J,EAAS,KAAK,MAAM9J,CAAK,EAC/B,GAAI,OAAO8J,GAAW,WAAYA,EAAiB,OAAO,KAC1D,IAAM3O,EAAS2O,EAEf,OADI3O,EAAO,YAAc,IAAK,KAAM,OAAOA,EAAO,WAAc,UAAYA,EAAO,UAAU,SAAW,IAAMA,EAAO,WAAa,IAAK,KAAM,OAAOA,EAAO,UAAa,UAAYA,EAAO,SAAS,SAAW,IAAMA,EAAO,wBAA0B,IAAK,KAAM,OAAOA,EAAO,uBAA0B,UAAYA,EAAO,sBAAsB,SAAW,IAAMA,EAAO,QAAU,IAAK,IAAK,OAAOA,EAAO,OAAU,UAAYA,EAAO,kBAAoB,IAAK,IAAK,OAAOA,EAAO,iBAAoB,WAAaA,EAAO,wBAA0B,IAAK,IAAKA,EAAO,WAAa,IAAK,IAAK,OAAOA,EAAO,WAAc,UAAY,CAAC,OAAO,SAASA,EAAO,SAAS,EAAU,KAC3oB,CACN,GAAG,OAAOA,EAAO,WAAc,SAAW,CAAE,UAAWA,EAAO,SAAU,EAAI,CAAC,EAC7E,GAAG,OAAOA,EAAO,UAAa,SAAW,CAAE,SAAUA,EAAO,QAAS,EAAI,CAAC,EAC1E,GAAG,OAAOA,EAAO,uBAA0B,SAAW,CAAE,sBAAuBA,EAAO,qBAAsB,EAAI,CAAC,EACjH,GAAG,OAAOA,EAAO,OAAU,SAAW,CAAE,MAAOA,EAAO,KAAM,EAAI,CAAC,EACjE,GAAG,OAAOA,EAAO,iBAAoB,UAAY,CAAE,gBAAiBA,EAAO,eAAgB,EAAI,CAAC,EAChG,UAAWA,EAAO,SACnB,CACD,MAAQ,CACP,OAAO,IACR,CACD,CACA,SAAS4pE,GAA6B,EAAK,CAC1C9qC,EAAI,UAAU0qC,GAA6B1qC,CAAG,EAAG,GAAI2qC,GAAgC3qC,EAAK,CAAC,CAAC,CAC7F,CACA,eAAe+qC,GAAyB,EAAK,CAC5C,IAAMvvD,EAAQ,MAAMwkB,EAAI,gBAAgBA,EAAI,QAAQ,YAAY,aAAa,KAAMA,EAAI,QAAQ,MAAM,EACrG,GAAI,OAAOxkB,GAAU,UAAYA,EAAM,SAAW,EAAG,OAAO,KAC5D,GAAI,CACH,IAAMuD,EAAS,MAAMihB,EAAI,QAAQ,gBAAgB,YAAYxkB,CAAK,EAClE,OAAOuD,EAAS,CAAE,QAASA,EAAO,OAAQ,EAAI,IAC/C,OAAS7C,EAAO,CAEf,MADA8jB,EAAI,QAAQ,OAAO,MAAM,4CAA6C9jB,CAAK,EACrE,IAAIjc,EAAW,wBAAyB,CAC7C,MAAO,eACP,kBAAmB,oCACpB,CAAC,CACF,CACD,CACA,eAAe+qE,GAAkB,EAAK,EAAW,CAChD,GAAI,CACH,OAAO,MAAMhrC,EAAI,QAAQ,QAAQ,QAAQ,CACxC,MAAO,UACP,MAAO,CAAC,CACP,MAAO,KACP,MAAO2/B,CACR,CAAC,CACF,CAAC,CACF,OAASzjD,EAAO,CAEf,MADA8jB,EAAI,QAAQ,OAAO,MAAM,2CAA4C9jB,CAAK,EACpE,IAAIjc,EAAW,wBAAyB,CAC7C,MAAO,eACP,kBAAmB,mCACpB,CAAC,CACF,CACD,CACA,eAAegrE,GAAoB,EAAK,EAAS,CAChD,GAAI,OAAO5nB,EAAQ,OAAU,UAAYA,EAAQ,MAAM,SAAW,EAAG,MAAM,IAAIpjD,EAAW,wBAAyB,CAClH,MAAO,eACP,kBAAmB,2BACpB,CAAC,EACD,GAAI,CACH,MAAM+/B,EAAI,QAAQ,gBAAgB,cAAcqjB,EAAQ,KAAK,CAC9D,OAASnnC,EAAO,CAEf,MADA8jB,EAAI,QAAQ,OAAO,MAAM,sCAAuC9jB,CAAK,EAC/D,IAAIjc,EAAW,wBAAyB,CAC7C,MAAO,eACP,kBAAmB,2BACpB,CAAC,CACF,CACD,CACA,eAAeirE,GAAgB,EAAK,EAAM,EAAU,CACnD,GAAI,CACH,OAAO,MAAM/3B,GAAUnT,EAAKjV,EAAMqZ,CAAQ,CAC3C,OAASloB,EAAO,CAEf,MADA8jB,EAAI,QAAQ,OAAO,MAAM,sCAAuC9jB,CAAK,EAC/D,IAAIjc,EAAW,wBAAyB,CAC7C,MAAO,eACP,kBAAmB,qCACpB,CAAC,CACF,CACD,CACA,SAASkrE,GAAyB,EAAO,CACxC,OAAQ,MAAM,QAAQplE,CAAK,EAAIA,EAAQ,CAACA,CAAK,EAAA,CAAG,OAAQ,GAAc,OAAOytC,GAAc,QAAQ,CACpG,CACA,SAAS43B,GAAgB,EAAS,CACjC,GAAI,OAAOx9D,EAAQ,KAAQ,UAAYA,EAAQ,IAAI,OAAS,EAAG,OAAOA,EAAQ,IAC9E,GAAI,OAAOA,EAAQ,KAAQ,UAAYA,EAAQ,IAAI,OAAS,EAAG,OAAOA,EAAQ,IAC9E,IAAMy9D,EAAYF,GAAyBv9D,EAAQ,GAAG,EACtD,OAAOy9D,EAAU,SAAW,EAAIA,EAAU,GAAK,IAChD,CACA,eAAeC,GAAkB,EAAK,EAAM,EAAM,EAAU,CAC3D,GAAIlnC,EAAU,OAAO8mC,GAAgBlrC,EAAKjV,EAAMqZ,CAAQ,EACxD,IAAI3d,EACJ,GAAI,CACH,EAAUD,GAAU+kD,CAAI,CACzB,MAAQ,CACP,OAAO,IACR,CACA,IAAM/3B,EAAY43B,GAAgB3kD,CAAO,EACzC,OAAO+sB,EAAY03B,GAAgBlrC,EAAKjV,EAAMyoB,CAAS,EAAI,IAC5D,CACA,eAAeg4B,GAAiB,EAAK,EAAM,EAAM,EAAQ,CACxD,GAAI,CACH,IAAI59D,EACJ,GAAImd,EAAK,iBAAkB,CAC1B,GAAI,CAACwqB,EAAO,aAAc,OAAO,KACjC,IAAM5jC,EAAS,MAAMkiC,GAA0B7T,EAAKjV,EAAK,kBAAmBwqB,EAAO,YAAY,EACzF,CAAE,QAASk2B,GAAoB,MAAMxsD,GAAcssD,EAAM,IAAI,YAAY,CAAC,CAAC,OAAO55D,CAAM,CAAC,EAC/F,EAAU,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO85D,CAAe,CAAC,CAC/D,KAAO,CACN,IAAMzM,EAAmB5sB,GAAapS,EAAI,OAAO,CAAC,CAAC,QAC7C,CAAE,QAASyrC,GAAoB,MAAMxsD,GAAcssD,EAAM3lD,GAAkB,MAAM6oB,GAAQ88B,EAAM,CAAE,UAAWvM,GAAkB,MAAM,WAAa,GAAGh/B,EAAI,QAAQ,UAAUg/B,GAAkB,MAAM,UAAY,SAAU,CAAC,CAAC,CAAC,EACjO,EAAU,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAOyM,CAAe,CAAC,CAC/D,CAIA,OAHI79D,EAAQ,MAAQ45D,GAAUxnC,EAAKjV,CAAI,GACnC,CAACogD,GAAyBv9D,EAAQ,GAAG,CAAC,CAAC,SAAS2nC,EAAO,QAAQ,GAC/D,OAAO3nC,EAAQ,KAAQ,UAAYA,EAAQ,IAAI,SAAW,GAAK,OAAOA,EAAQ,KAAQ,UAAYA,EAAQ,IAAI,SAAW,EAAU,KAChIA,CACR,MAAQ,CACP,OAAO,IACR,CACD,CACA,SAAS89D,GAA4B,EAAQ,EAAc,EAAO,CACjE,GAAI,CAACC,EAAc,MAAO,CAAE,QAAS,EAAM,EAC3C,GAAI,CAACp2B,EAAO,wBAAwB,SAASo2B,CAAY,EAAG,MAAO,CAAE,QAAS,EAAK,EACnF,GAAI,CAACvhE,EAAO,MAAO,CAClB,IAAKuhE,EACL,QAAS,EACV,EACA,GAAI,CACH,IAAMC,EAAc,IAAI,IAAID,CAAY,EAExC,OADAC,EAAY,aAAa,IAAI,QAASxhE,CAAK,EACpC,CACN,IAAKwhE,EAAY,SAAS,EAC1B,QAAS,EACV,CACD,MAAQ,CACP,MAAO,CAAE,QAAS,EAAK,CACxB,CACD,CACA,SAASC,GAA6B,EAAQ,EAAS,CAGtD,OAFKt0C,EAAQ,yBACTm0C,GAA4Bn2B,EAAQhe,EAAQ,yBAA0BA,EAAQ,KAAK,CAAC,CAAC,QAAgB,CAAE,gBAAiB,EAAK,EAC1H,CACN,SAAUge,EAAO,SACjB,sBAAuBhe,EAAQ,yBAC/B,GAAGA,EAAQ,QAAU,IAAK,GAA+B,CAAC,EAA5B,CAAE,MAAOA,EAAQ,KAAM,CACtD,EAN8C,CAAC,CAOhD,CACA,eAAeu0C,GAA2B,EAAK,EAAM,EAAO,CAC3D,GAAI1hE,EAAM,gBAAiB,MAAO,CAAE,QAAS,EAAK,EAClD,GAAI,CAACA,EAAM,UAAY,CAACA,EAAM,sBAAuB,MAAO,CAAE,QAAS,EAAM,EAC7E,IAAMmrC,EAAS,MAAM21B,GAAgBlrC,EAAKjV,EAAM3gB,EAAM,QAAQ,EAE9D,MADI,CAACmrC,GAAUA,EAAO,UAAY,CAACA,EAAO,iBAAyB,CAAE,QAAS,EAAK,EAC5Em2B,GAA4Bn2B,EAAQnrC,EAAM,sBAAuBA,EAAM,KAAK,CACpF,CACA,eAAe2hE,GAAqB,EAAK,EAAgB,EAAe,CAAC,EAAG,CAU3E,OATKC,EAOAhC,GAAoBhqC,CAAG,GAC5B,MAAM4qC,GAA2B5qC,EAAKgsC,EAAe,QAAQ,GAAI5/B,CAAY,EACtEi+B,GAAuBrqC,CAAG,GAFKyqC,GAAoBzqC,EAAK,cAAe,kBAAmB,kDAAkD,EAN9IgqC,GAAoBhqC,CAAG,GAC1B,MAAM4qC,GAA2B5qC,EAAK,IAAK,GAAGoM,CAAY,EACnDi+B,GAAuBrqC,CAAG,GAE3ByqC,GAAoBzqC,EAAK,cAAe,kBAAmB,2CAA2C,CAK/G,CACA,eAAeisC,GAAwB,EAAK,EAAM,CACjD,IAAM7hE,EAAQ,MAAMygE,GAA2B7qC,CAAG,EAC5CgsC,EAAiB,MAAMjB,GAAyB/qC,CAAG,EACzD,GAAI,CAAC51B,GAASA,EAAM,WAAa,KAAK,IAAI,EAAG,OAAOqgE,GAAoBzqC,EAAK,cAAe,kBAAmB,+CAA+C,EAC9J,IAAMksC,EAAW,MAAMJ,GAA2B9rC,EAAKjV,EAAM3gB,CAAK,EAWlE,OAVK4hE,EAKD5hE,EAAM,WAAaA,EAAM,YAAc4hE,EAAe,QAAQ,GAAWvB,GAAoBzqC,EAAK,cAAe,kBAAmB,+CAA+C,GACvL,MAAMirC,GAAoBjrC,EAAKgsC,EAAe,OAAO,EACrDzgB,GAAoBvrB,CAAG,EACvB8qC,GAA6B9qC,CAAG,EAC5BksC,EAAS,IAAYC,EAAensC,EAAKksC,EAAS,GAAG,EAClDlC,GAAoBhqC,CAAG,EAAIsqC,GAAkB4B,EAAS,QAAU,yDAA2D,IAAK,EAAC,EAAI,OAT3IpB,GAA6B9qC,CAAG,EAC5BksC,EAAS,IAAYC,EAAensC,EAAKksC,EAAS,GAAG,EAClDlC,GAAoBhqC,CAAG,EAAIsqC,GAAkB4B,EAAS,QAAU,yDAA2D,IAAK,EAAC,EAAIzB,GAAoBzqC,EAAK,cAAe,kBAAmB,2CAA2C,EAQpP,CAcA,eAAeosC,GAA0B,EAAK,EAAM,CACnD,IAAMppC,EAAQhD,EAAI,OAAS,CAAC,EACtB3F,EAAO2F,EAAI,MAAQ,CAAC,EACpBzI,EAAU,CACf,GAAGyL,EACH,GAAG3I,CACJ,EACM2xC,EAAiB,MAAMjB,GAAyB/qC,CAAG,EACzD,GAAMzI,EAAQ,gBAAkB,IAAK,GAAI,CACxC,IAAI6U,EAAe,CAAC,EACpB,GAAI7U,EAAQ,UAAW,CACtB,IAAMge,EAAS,MAAM21B,GAAgBlrC,EAAKjV,EAAMwM,EAAQ,SAAS,EACjE,GAAI,CAACge,EAAQ,OAAOk1B,GAAoBzqC,EAAK,cAAe,iBAAkB,kCAAkC,EAChH,GAAIuV,EAAO,SAAU,OAAOk1B,GAAoBzqC,EAAK,cAAe,iBAAkB,+BAA+B,EACrH,GAAI,CAACuV,EAAO,iBAAkB,OAAOk1B,GAAoBzqC,EAAK,eAAgB,iBAAkB,8CAA8C,EAC9I,EAAe6rC,GAA6Bt2B,EAAQhe,CAAO,CAC5D,CACA,OAAOw0C,GAAqB/rC,EAAKgsC,EAAgB5/B,CAAY,CAC9D,CACA,IAAMmJ,EAAS,MAAM+1B,GAAkBtrC,EAAKjV,EAAMwM,EAAQ,cAAeA,EAAQ,SAAS,EAC1F,GAAI,CAACge,EAEJ,OADIy2B,GAAkBhC,GAAoBhqC,CAAG,EAAU+rC,GAAqB/rC,EAAKgsC,CAAc,EACxFvB,GAAoBzqC,EAAK,cAAe,iBAAkB,kCAAkC,EAEpG,GAAIuV,EAAO,SAAU,OAAOk1B,GAAoBzqC,EAAK,cAAe,iBAAkB,+BAA+B,EACrH,GAAI,CAACuV,EAAO,iBAAkB,OAAOk1B,GAAoBzqC,EAAK,eAAgB,iBAAkB,8CAA8C,EAC9I,IAAMqsC,EAAiB,MAAMb,GAAiBxrC,EAAKjV,EAAMwM,EAAQ,cAAege,CAAM,EACtF,GAAI,CAAC82B,EAEJ,OADIL,GAAkBhC,GAAoBhqC,CAAG,EAAU+rC,GAAqB/rC,EAAKgsC,EAAgBz0C,EAAQ,UAAYs0C,GAA6Bt2B,EAAQhe,CAAO,EAAI,CAAC,CAAC,EAChKkzC,GAAoBzqC,EAAK,eAAgB,gBAAiB,8BAA8B,EAEhG,IAAM2/B,EAAY0M,EAAe,IAC3BC,EAAgB,MAAMtB,GAAkBhrC,EAAK2/B,CAAS,EACtD4M,EAAwBP,GAAgB,QAAQ,KAAOrM,EAC7D,GAAIqM,GAAkB,CAACO,EAAuB,OAAOR,GAAqB/rC,EAAKgsC,EAAgBH,GAA6Bt2B,EAAQhe,CAAO,CAAC,EAC5I,IAAM20C,EAAWR,GAA4Bn2B,EAAQhe,EAAQ,yBAA0BA,EAAQ,KAAK,EAC9Fi1C,EAAkBF,IAAkBC,EAAwBP,GAAgB,QAAU,MAK5F,OAJIQ,GAAiB,MAAMvB,GAAoBjrC,EAAKwsC,CAAe,EAC/DD,GAAuBhhB,GAAoBvrB,CAAG,EAClD8qC,GAA6B9qC,CAAG,EAC5BksC,EAAS,IAAYC,EAAensC,EAAKksC,EAAS,GAAG,EAClDlC,GAAoBhqC,CAAG,EAAIsqC,GAAkB4B,EAAS,QAAU,yDAA2D,IAAK,EAAC,EAAI,IAC7I,CAMA,eAAeO,GAAsC,EAAK,EAAM,CAC/D,OAAOR,GAAwBjsC,EAAKjV,CAAI,CACzC,CAGA,SAAS08C,GAAmB,EAAK,EAAM,EAAW,CACjD,IAAMlhC,EAAUvG,EAAI,QAAQ,QACtB0sC,EAAuB,CAACzhB,GAAW,aACzC,MAAO,CACN,iBAAkBA,GAAW,iBAC7B,OAAQ0hB,GAAkB5hD,GAAM,KAAK,QAAUwb,CAAO,EACtD,uBAAwB,GAAGA,EAAQ,mBACnC,eAAgB,GAAGA,EAAQ,eAC3B,SAAU0kB,GAAW,aAAe,IAAK,GAAIlgC,GAAM,MAAM,WAAa,GAAGwb,IAAUxb,GAAM,MAAM,UAAY,UAC3G,sBAAuBkgC,GAAW,sCAAwC,GAAG1kB,EAAQ,kBAAoB,IAAK,GAC9G,uBAAwB,GAAGA,EAAQ,oBACnC,oBAAqB,GAAGA,EAAQ,gBAChC,yBAA0B0kB,GAAW,uBAAyB,CAACA,EAAU,sBAAsB,SAAS,oBAAoB,EAAI,CAAC,EAAI,CAAC,MAAM,EAC5I,yBAA0B,CAAC,OAAO,EAClC,sBAAuBA,GAAW,uBAAyB,CAC1D,qBACA,qBACA,eACD,EACA,sCAAuCA,GAAW,uCAAyC,CAC1F,GAAGA,GAAW,wBAA0B,CAAC,MAAM,EAAI,CAAC,EACpD,sBACA,qBACA,iBACD,EACA,iDAAkD,CAAC,GAAGhmB,EAAkC,EACxF,8CAA+CgmB,GAAW,iCAAmC,CAC5F,sBACA,qBACA,iBACD,EACA,yDAA0D,CAAC,GAAGhmB,EAAkC,EAChG,2CAA4CgmB,GAAW,iCAAmC,CACzF,sBACA,qBACA,iBACD,EACA,sDAAuD,CAAC,GAAGhmB,EAAkC,EAC7F,iCAAkC,CAAC,MAAM,EACzC,+CAAgD,GAChD,kCAAmCgmB,GAAW,mCAAqC,CAAC,GAAG7f,EAAuB,EAC9G,6BAA8BshC,EAC9B,qCAAsCA,CACvC,CACD,CAMA,SAASE,GAAwB,EAAK,EAAM,CAC3C,IAAM5N,EAAmBj0C,EAAK,iBAAmB,IAAK,GAAIqnB,GAAapS,EAAI,OAAO,CAAC,CAAC,QAC9E6sC,EAAoBp8B,GAAqB1lB,CAAI,EAC7C+hD,EAAwB/hD,EAAK,wCAA0C8hD,EAAkB,OAAS,EACxG,MAAO,CACN,mBACA,oBACA,aAAcpF,GAAmBznC,EAAKg/B,EAAkB,CACvD,iBAAkBj0C,EAAK,oBAAoB,kBAAoBA,EAAK,OACpE,sCAAuCA,EAAK,+BAC5C,wBAAyB+hD,EACzB,sBAAuBj8B,GAAuB9lB,CAAI,EAClD,sCAAuCimB,GAAwBjmB,EAAM,CAAE,YAAa+hD,CAAsB,CAAC,EAC3G,gCAAiC97B,GAAwBjmB,CAAI,EAC7D,aAAcA,EAAK,iBACnB,kCAAmCA,EAAK,MAAM,iBAC/C,CAAC,CACF,CACD,CACA,SAASi8C,GAAiC,EAAK,EAAM,CACpD,GAAM,CAAE,oBAAmB,gBAAiB4F,GAAwB5sC,EAAKjV,CAAI,EAC7E,OAAOsmB,GAAqCrR,EAAKjV,EAAM,6BAA8B,CACpF,GAAG2oB,GAAuBm5B,CAAiB,EAC3C,GAAGE,CACJ,CAAC,CACF,CACA,SAAS9F,GAAmB,EAAK,EAAM,CACtC,IAAM1gC,EAAUvG,EAAI,QAAQ,QACtB,CAAE,mBAAkB,oBAAmB,gBAAiB4sC,GAAwB5sC,EAAKjV,CAAI,EACzFhF,EAAW,CAChB,GAAGgnD,EACH,iBAAkBpW,GAAmB5rC,CAAI,EACzC,2BAA4B,GAC5B,kBAAmB,GAAGwb,EAAQ,kBAC9B,wBAAyBxb,EAAK,eAAiB,CAAC,SAAU,UAAU,EAAI,CAAC,QAAQ,EACjF,qBAAsB,CAAC,GAAG,EAC1B,2CAA8C,CAC7C,GAAIA,EAAK,iBAAkB,MAAO,CAAC,OAAO,EAC1C,IAAMiiD,EAAUhO,GAAkB,MAAM,eAAe,KAAO,QACxDiO,EAASjO,GAAkB,MAAM,gBAAgB,IAAK,GAAMz1D,EAAE,GAAG,GAAK,CAAC,EAC7E,OAAO,MAAM,KAAK,IAAI,IAAI,CAACyjE,EAAS,GAAGC,CAAM,CAAC,CAAC,CAChD,EAAA,CAAG,EACH,qBAAsB,GAAG1mC,EAAQ,qBACjC,4BAA6B,GAC7B,gCAAiC,GACjC,wBAAyB,CACxB,QACA,UACA,SACA,iBACA,MACD,CACD,EACA,OAAO8K,GAAqCrR,EAAKjV,EAAM,uBAAwB,CAC9E,GAAG2oB,GAAuBm5B,CAAiB,EAC3C,GAAG9mD,CACJ,CAAC,CACF,CACA,IAAMmnD,GAAyB,sEAC/B,SAASnG,GAAiB,EAAM,EAAc,CAC7C,IAAM33D,EAAU,IAAI,QAAQ+9D,CAAY,EAGxC,OAFK/9D,EAAQ,IAAI,eAAe,GAAGA,EAAQ,IAAI,gBAAiB89D,EAAsB,EACtF99D,EAAQ,IAAI,eAAgB,kBAAkB,EACvC,IAAI,SAAS,KAAK,UAAUirB,CAAI,EAAG,CACzC,OAAQ,IACR,SACD,CAAC,CACF,CAkDA,SAAS+yC,GAAoB,EAAM,EAAS,EAAS,CACpD,GAAM,CAAE,kBAAiB,kBAAmBC,EAAU,oBAAmB,eAAe,kBAAmB,GAAGxpB,GAASr2C,EACvH,GAAI,CAAC8/D,EAAiB,OAAO7zB,EAAmBzf,EAAM,CACrD,GAAG6pB,EACH,kBAAmB,KAAO,IAAS,CAElC,MADIwpB,GAAU,MAAMA,EAAS3hD,CAAI,EAC3B,IAAIzrB,EAAW,cAAe,CAAE,GAAGstE,GAAsB7hD,EAAK,OAAQ8hD,EAAmBC,CAAY,CAAE,CAAC,CAC/G,CACD,EAAG5xC,CAAO,EACV,IAAMqwC,EAAWoB,EACX,CAAE,KAAMI,EAAY,MAAOC,EAAa,GAAGC,GAAc/pB,EAC/D,eAAegqB,EAAa,EAAK,EAAM,EAAQ,CAC9C,GAAI,CAACrrC,EAAQ,MAAO,CAAE,GAAI,EAAK,EAC/B,IAAMzjB,EAAS,MAAMyjB,EAAO,eAAexC,EAAI8tC,IAAS,CAAC,CAAC,EAS1D,OARI/uD,EAAO,SACV,EAAI+uD,GAAQ/uD,EAAO,KACZ,CAAE,GAAI,EAAK,IAEfsuD,GAAU,MAAMA,EAAS,CAC5B,QAAStuD,EAAO,MAAM,QACtB,OAAQA,EAAO,MAAM,MACtB,CAAC,EACM,CACN,GAAI,GACJ,SAAUmtD,EAAS,CAClB,GAAGqB,GAAsBxuD,EAAO,MAAM,OAAQyuD,EAAmBC,CAAY,EAC7E,KACD,CAAC,CACF,EACD,CACA,OAAOh0B,EAAmBzf,EAAM4zC,EAAW,KAAO,IAAQ,CACzD,IAAMvzC,EAAO,MAAMwzC,EAAa7tC,EAAK,OAAQ0tC,CAAU,EACvD,GAAI,CAACrzC,EAAK,GAAI,OAAOA,EAAK,SAC1B,IAAM2I,EAAQ,MAAM6qC,EAAa7tC,EAAK,QAAS2tC,CAAW,EAE1D,OADK3qC,EAAM,GACJnH,EAAQmE,CAAG,EADIgD,EAAM,QAE7B,CAAC,CACF,CACA,SAASuqC,GAAsB,EAAQ,EAAmB,EAAe,kBAAmB,CAC3F,IAAMQ,EAAQtlC,EAAO,GACrB,GAAI,CAACslC,EAAO,MAAO,CAClB,MAAON,EACP,kBAAmB,kBACpB,EACA,IAAM7pD,EAAQmqD,EAAM,OAAO,GACrBC,EAAW,OAAOpqD,GAAU,SAAWA,EAAQ,IAAK,GACpDqqD,EAAUD,EAAWR,IAAoBQ,GAAY,IAAK,GAC1DphC,EAAQmhC,EAAM,MAAM,OAAS7tE,EAAiB6tE,EAAM,IAAI,EAAI,GAClE,MAAO,CACN,MAAOG,GAAiBH,EAAOE,EAASR,CAAY,EACpD,kBAAmBU,GAAcJ,EAAOnhC,CAAK,CAC9C,CACD,CACA,SAASshC,GAAiB,EAAO,EAAS,EAAc,CAIvD,OAHI,OAAOD,GAAY,SAAiBA,EACpCG,GAAoBL,CAAK,EAAUE,GAAS,SAAWR,EACvDM,EAAM,OAAS,gBAAwBE,GAAS,SAAWR,EACxDA,CACR,CAYA,SAASW,GAAoB,EAAO,CACnC,OAAOL,EAAM,OAAS,gBAAkBA,EAAM,QAAQ,SAAS,oBAAoB,CACpF,CACA,SAASI,GAAc,EAAO,EAAO,CACpC,GAAI,CAACvhC,EAAO,OAAOmhC,EAAM,QACzB,GAAIA,EAAM,OAAS,eAGlB,OAFIA,EAAM,QAAQ,SAAS,oBAAoB,EAAU,GAAGnhC,EAAM,cAC9DmhC,EAAM,QAAQ,SAAS,gBAAgB,EAAU,GAAGnhC,EAAM,iCACvD,GAAGA,EAAM,aAAamhC,EAAM,UAAY,gBAEhD,GAAIA,EAAM,OAAS,gBAAiB,CACnC,IAAM19B,EAAS09B,EAAM,OACrB,GAAI,MAAM,QAAQ19B,CAAM,GAAKA,EAAO,OAAS,EAAG,MAAO,GAAGzD,EAAM,mBAAmByD,EAAO,KAAK,IAAI,GACpG,CACA,MAAO,GAAGzD,EAAM,IAAImhC,EAAM,SAC3B,CAGA,IAAMM,GAA2B,GAASh1B,GAAqB,KAAO,IAAQ,CAC7E,GAAI,CAACtuB,EAAK,0BAA2B,MAAM,IAAI/qB,EAAS,aAAa,EACrE,IAAMgjC,EAAQhD,EAAI,KAAK,YACvB,GAAI,CAAC,MAAM+S,GAAuB/P,EAAOhD,EAAI,QAAQ,MAAM,EAAG,MAAM,IAAIhgC,EAAS,eAAgB,CAAE,MAAO,mBAAoB,CAAC,CAChI,CAAC,EAGKsuE,GAAwC,CAC7C,QAAS,QACT,QAAS,QACT,QAAS,OACV,EACMC,GAAqC,CAAC,SAAS,EAC/CC,GAA2B,CAChC,IACA,IACA,IACA,KACA,KACA,KACA,KACD,EACA,SAASC,GAAW,EAAO,CAC1B,OAAO,OAAO1oE,GAAU,YAAYA,GAAkB,CAAC,MAAM,QAAQA,CAAK,CAC3E,CACA,SAAS2oE,GAAgB,EAAK,EAAY,CACzC,OAAO,OAAO5oE,EAAI6oE,IAAgB,UAAY7oE,EAAI6oE,EAAW,CAAC,OAAS,CACxE,CACA,SAASC,GAA0B,EAAO,CACzC,OAAO,OAAOl2D,GAAU,UAAY,OAAO,UAAU,eAAe,KAAK41D,GAAuC51D,CAAK,CACtH,CACA,SAASm2D,GAA2B,EAAO,CAC1C,OAAON,GAAmC,KAAM,GAAiBO,IAAiBp2D,CAAK,CACxF,CACA,SAASq2D,GAAqB,EAAK,CAClC,OAAQjpE,EAAI,IAAZ,CACC,IAAK,MAAO,OAAO4oE,GAAgB5oE,EAAK,GAAG,GAAK4oE,GAAgB5oE,EAAK,GAAG,EACxE,IAAK,KAAM,OAAO8oE,GAA0B9oE,EAAI,GAAG,GAAK4oE,GAAgB5oE,EAAK,GAAG,GAAK4oE,GAAgB5oE,EAAK,GAAG,EAC7G,IAAK,MAAO,OAAO+oE,GAA2B/oE,EAAI,GAAG,GAAK4oE,GAAgB5oE,EAAK,GAAG,EAClF,QAAS,MAAO,EACjB,CACD,CACA,SAASkpE,GAAmC,EAAK,CAChD,GAAIlpE,EAAI,MAAQ,IAAK,GAAG,MAAO,GAC/B,GAAI,OAAOA,EAAI,KAAQ,UAAY,CAACm/B,GAAmC,KAAM,GAAc33B,IAAcxH,EAAI,GAAG,EAAG,MAAO,GAC1H,OAAQA,EAAI,IAAZ,CACC,IAAK,MAAO,OAAOA,EAAI,IAAI,WAAW,IAAI,GAAKA,EAAI,IAAI,WAAW,IAAI,EACtE,IAAK,KAAM,OAAO8oE,GAA0B9oE,EAAI,GAAG,GAAKwoE,GAAsCxoE,EAAI,OAASA,EAAI,IAC/G,IAAK,MAAO,OAAO+oE,GAA2B/oE,EAAI,GAAG,GAAKA,EAAI,MAAQ,QACtE,QAAS,MAAO,EACjB,CACD,CAUA,SAASqhE,GAAyB,EAAO,CACxC,IAAM52B,EAAOk+B,GAAW3hE,CAAK,GAAK,MAAM,QAAQA,EAAM,IAAI,EAAIA,EAAM,KAAO,IAAK,GAChF,GAAI,CAACyjC,GAAM,OAAQ,MAAO,CACzB,MAAO,GACP,MAAO,qEACR,EACA,IAAK,IAAMzqC,KAAOyqC,EAAM,CACvB,GAAI,CAACk+B,GAAW3oE,CAAG,EAAG,MAAO,CAC5B,MAAO,GACP,MAAO,sEACR,EACA,GAAIA,EAAI,MAAQ,OAAS,MAAOA,GAAO0oE,GAAyB,KAAM,GAASvpE,KAAQa,CAAG,EAAG,MAAO,CACnG,MAAO,GACP,MAAO,+CACR,EACA,GAAI,CAACipE,GAAqBjpE,CAAG,EAAG,MAAO,CACtC,MAAO,GACP,MAAO,sEACR,EACA,GAAI,CAACkpE,GAAmClpE,CAAG,EAAG,MAAO,CACpD,MAAO,GACP,MAAO,uGACR,CACD,CACA,MAAO,CACN,MAAO,GACP,KAAM,CAAE,MAAK,CACd,CACD,CAGA,IAAMmpE,GAAkC,OAAO,OAAO,OAAO,KAAK,CACjE,SAAU,GACV,aAAc,GACd,kBAAmB,GACnB,SAAU,GACV,OAAQ,GACR,wBAAyB,GACzB,OAAQ,GACR,UAAW,GACX,UAAW,GACX,UAAW,GACX,KAAM,GACN,IAAK,GACL,KAAM,GACN,SAAU,GACV,IAAK,GACL,OAAQ,GACR,WAAY,GACZ,gBAAiB,GACjB,kBAAmB,GACnB,aAAc,GACd,uBAAwB,GACxB,qBAAsB,GACtB,iCAAkC,GAClC,wBAAyB,GACzB,WAAY,GACZ,cAAe,GACf,gBAAiB,GACjB,KAAM,GACN,QAAS,GACT,YAAa,GACb,sBAAuB,GACvB,YAAa,GACb,iBAAkB,GAClB,YAAa,GACb,YAAa,GACb,SAAU,EACX,CAAC,CAAC,EAKIC,GAAgC,2eAiCtC,EACMC,GAAkC,IAAI,IAAI,CAC/C,GAAGF,GACH,GAAGC,GACH,SACA,OACA,YACA,2BACD,CAAC,EA0CD,SAASE,GAA2C,EAAU,CAC7D,GAAKrpD,EACL,OAAO,OAAO,YAAY,OAAO,QAAQA,CAAQ,CAAC,CAAC,QAAQ,CAAC6mB,KAAW,CAACuiC,GAAgC,IAAIviC,CAAK,CAAC,CAAC,CACpH,CAaA,eAAeyiC,GAAuB,EAAK,EAAS,EAAM,EAAQ,EAAU,CAC3E,GAAI,CAAChsB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,GAAI,CAACggC,EAAI,QAAS,MAAM,IAAIhgC,EAAS,aAAa,EAElD,GADIgkD,IAAW,uCAAyC,CAACj5B,EAAK,kBAC1DA,EAAK,kBAAoB,CAAC,MAAMA,EAAK,iBAAiB,CACzD,QAASiV,EAAI,QACb,SACA,QAASqjB,EAAQ,QACjB,KAAMA,EAAQ,KACd,UACD,CAAC,EAAG,MAAM,IAAIrjD,EAAS,cAAc,CACtC,CAiBA,eAAesvE,GAAyB,EAAK,EAAS,EAAM,EAAQ,EAAY,CAC/E,GAAI,CAACjsB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,GAAI,CAACggC,EAAI,QAAS,MAAM,IAAIhgC,EAAS,aAAa,EAClD,GAAK+qB,EAAK,oBACN,CAAC,MAAMA,EAAK,mBAAmB,CAClC,QAASiV,EAAI,QACb,SACA,QAASqjB,EAAQ,QACjB,KAAMA,EAAQ,KACd,YACD,CAAC,EAAG,MAAM,IAAIrjD,EAAS,cAAc,CACtC,CAGA,IAAIqnE,GAA2CtiE,GAAY,CAC1D,2BAA8BwiE,GAC9B,sBAAyBgI,GACzB,0BAA6BC,EAC9B,CAAC,EACKC,GAA6B,IAAI,QACjCC,GAAoB,IACpBC,GAAyB,IACzBC,GAAwB,IACxBC,GAA0B,MAC1BC,GAAoB,8CAC1B,SAASC,GAAa,EAAW,EAAU,EAAM,EAAW,CAK3D,GAJA5hC,EAAU,IAAI/7B,EAAU,CACvB,OACA,WACD,CAAC,EACG+7B,EAAU,KAAOwhC,GAAwB,CAC5C,IAAMK,EAAS7hC,EAAU,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,MACnC6hC,IAAW,IAAK,IAAG7hC,EAAU,OAAO6hC,CAAM,CAC/C,CACD,CACA,SAASC,GAAa,EAAM,CAC3B,IAAMn9B,EAAgB28B,GAAW,IAAI1kD,CAAI,EACzC,GAAI+nB,EAAe,OAAOA,EAC1B,IAAMptB,EAAwB,IAAI,IAElC,OADA+pD,GAAW,IAAI1kD,EAAMrF,CAAK,EACnBA,CACR,CACA,SAASwqD,GAAgB,EAAQ,CAChC,MAAO,GAAG36B,EAAO,mBAAqB,UAAU,GAAGA,EAAO,SAAW,IACtE,CACA,IAAM46B,GAAkB,CAAC,GAAGlrC,EAAkC,EAc9D,SAASsqC,GAAkB,EAAU,CACpC,MAAO,CAAC9e,GAAqB9V,CAAQ,CACtC,CACA,SAASy1B,GAAgB,EAAK,EAAS,EAAmB,CACzD,IAAMvgE,EAAS,IAAI,IAAIwgE,CAAO,EAC9B,GAAIxgE,EAAO,WAAa,SAAU,MAAM,IAAI5P,EAAW,cAAe,CACrE,kBAAmB,0BACnB,MAAO,gBACR,CAAC,EACD,GAAI4P,EAAO,UAAYA,EAAO,SAAU,MAAM,IAAI5P,EAAW,cAAe,CAC3E,kBAAmB,wCACnB,MAAO,gBACR,CAAC,EACD,GAAIowE,EAAQ,SAAS,GAAG,EAAG,MAAM,IAAIpwE,EAAW,cAAe,CAC9D,kBAAmB,iDACnB,MAAO,gBACR,CAAC,EACD,GAAIsvE,GAAkB1/D,EAAO,QAAQ,EAAG,MAAM,IAAI5P,EAAW,cAAe,CAC3E,kBAAmB,2DACnB,MAAO,gBACR,CAAC,EACD,GAAI,KAAqB4P,EAAO,SAAWygE,IACvC,CAACtwC,EAAI,QAAQ,gBAAgBnwB,EAAO,IAAI,EAAG,MAAM,IAAI5P,EAAW,cAAe,CAClF,kBAAmB,iCACnB,MAAO,gBACR,CAAC,CACF,CACA,SAASswE,GAAkB,EAAU,CACpC,GAAI,CACH,IAAM1gE,EAAS,IAAI,IAAIu0B,CAAQ,EAE/B,OADIv0B,EAAO,WAAa,UAAYA,EAAO,WAAa,QAAS,OAC1DA,EAAO,MACf,MAAQ,CACP,MACD,CACD,CACA,eAAe2gE,GAAwB,EAAU,CAChD,IAAMC,EAAgBh2C,EAAS,QAAQ,IAAI,gBAAgB,EAC3D,GAAIg2C,IAAkB,MAAQ,OAAO,SAAS,OAAOA,CAAa,CAAC,GAAK,OAAOA,CAAa,EAAIZ,GAE/F,MADA,MAAMp1C,EAAS,MAAM,OAAO,EAClB,MAAM,8BAA8B,EAE/C,GAAI,CAACA,EAAS,KAAM,MAAO,GAC3B,IAAM7f,EAAS6f,EAAS,KAAK,UAAU,EACjC9f,EAAS,CAAC,EACZ+1D,EAAa,EACjB,OAAa,CACZ,GAAM,CAAE,OAAM,SAAU,MAAM91D,EAAO,KAAK,EAC1C,GAAIC,EAAM,MAEV,GADA,GAAc9U,EAAM,WAChB2qE,EAAab,GAEhB,MADA,MAAMj1D,EAAO,OAAO,EACV,MAAM,8BAA8B,EAE/CD,EAAO,KAAK5U,CAAK,CAClB,CACA,IAAM4G,EAAQ,IAAI,WAAW+jE,CAAU,EACnCxlE,EAAS,EACb,IAAK,IAAMi7C,KAASxrC,EACnBhO,EAAM,IAAIw5C,EAAOj7C,CAAM,EACvB,GAAUi7C,EAAM,WAEjB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAOx5C,CAAK,CACtC,CACA,eAAegkE,GAAiB,EAAS,EAA8B,WAAW,MAAO,CACxF,IAAMpoC,EAAa,IAAI,gBACjBqoC,EAAU,eAAiBroC,EAAW,MAAM,EAAGqnC,EAAqB,EAC1E,GAAI,CACH,IAAMn1C,EAAW,MAAMo2C,EAA4BR,EAAS,CAC3D,OAAQ9nC,EAAW,OACnB,QAAS,CAAE,OAAQ,kBAAmB,EACtC,SAAU,OACX,CAAC,EACD,GAAI9N,EAAS,WAAY,MAAU,MAAM,uBAAuB,EAChE,GAAIA,EAAS,SAAW,IAAK,MAAU,MAAM,uBAAuBA,EAAS,QAAQ,EACrF,IAAMnD,EAAcmD,EAAS,QAAQ,IAAI,cAAc,EACvD,GAAI,CAACnD,GAAe,CAACw4C,GAAkB,KAAKx4C,CAAW,EAAG,MAAU,MAAM,0CAA0C,EACpH,IAAMusC,EAAe,MAAM2M,GAAwB/1C,CAAQ,EACvDq2C,EACJ,GAAI,CACH,EAAa,KAAK,MAAMjN,CAAY,CACrC,MAAQ,CACP,MAAO,CAAE,MAAO,EAAM,CACvB,CACA,IAAM9kD,EAASooD,GAAyB2J,CAAU,EAElD,OADK/xD,EAAO,MACL,CACN,MAAO,GACP,KAAMA,EAAO,IACd,EAJ0B,CAAE,MAAO,EAAM,CAK1C,QAAU,CACT,aAAa6xD,CAAO,CACrB,CACD,CACA,SAASG,IAA6B,CACrC,OAAO,IAAI9wE,EAAW,cAAe,CACpC,kBAAmB,8BACnB,MAAO,gBACR,CAAC,CACF,CACA,eAAe+wE,GAAgB,EAAK,EAAM,EAAQ,CACjD,GAAIz7B,EAAO,KAAM,OAAO,KAAK,MAAMA,EAAO,IAAI,EAC9C,GAAI,CAACA,EAAO,QAAS,MAAM,IAAIt1C,EAAW,cAAe,CACxD,kBAAmB,gCACnB,MAAO,gBACR,CAAC,EACD,IAAMgwC,EAAYsF,EAAO,kBAAoB9E,GAAqB1lB,CAAI,CAAC,CAAC,KAAM,GAAcyoB,EAAU,KAAO+B,EAAO,iBAAiB,EAAI,IAAK,GAC9I,GAAIA,EAAO,mBAAqB,CAACtF,GAAW,4BAA6B,MAAM,IAAIhwC,EAAW,cAAe,CAC5G,kBAAmB,kEACnB,MAAO,gBACR,CAAC,EACDmwE,GAAgBpwC,EAAKuV,EAAO,QAASA,EAAO,kBAAoBg7B,GAAkBh7B,EAAO,QAAQ,EAAI,IAAK,EAAC,EAC3G,IAAMn0B,EAAM,KAAK,IAAI,EACfhP,EAAW89D,GAAgB36B,CAAM,EACjCpH,EAAY8hC,GAAallD,CAAI,EAC7B1Y,EAAS87B,EAAU,IAAI/7B,CAAQ,EACrC,GAAIC,GAAU+O,EAAM/O,EAAO,UAAYq9D,GAAmB,OAAOr9D,EAAO,KACxE,IAAI0M,EACJ,GAAI,CACH,EAAS,MAAM4xD,GAAiBp7B,EAAO,QAAStF,GAAW,2BAA2B,CACvF,MAAQ,CACP,IAAMghC,EAAevB,GAAoB,EACzC,GAAIr9D,GAAU+O,EAAM/O,EAAO,UAAY4+D,EAAc,OAAO5+D,EAAO,KACnE,MAAM0+D,GAA2B,CAClC,CACA,GAAI,CAAChyD,EAAO,MAAO,MAAMgyD,GAA2B,EAEpD,OADAhB,GAAa5hC,EAAW/7B,EAAU2M,EAAO,KAAMqC,CAAG,EAC3CrC,EAAO,IACf,CAKA,eAAemyD,GAAkB,EAAM,EAAQ,CAC9C,GAAI,CAAC37B,EAAO,QAAS,OAAO,KAC5B,IAAMtF,EAAYsF,EAAO,kBAAoB9E,GAAqB1lB,CAAI,CAAC,CAAC,KAAM,GAAcyoB,EAAU,KAAO+B,EAAO,iBAAiB,EAAI,IAAK,GAC9I,GAAIA,EAAO,mBAAqB,CAACtF,GAAW,4BAA6B,OAAO,KAChF,GAAI,CACH,IAAMlxB,EAAS,MAAM4xD,GAAiBp7B,EAAO,QAAStF,GAAW,2BAA2B,EAG5F,OAFKlxB,EAAO,OACZgxD,GAAaE,GAAallD,CAAI,EAAGmlD,GAAgB36B,CAAM,EAAGx2B,EAAO,KAAM,KAAK,IAAI,CAAC,EAC1EA,EAAO,MAFY,IAG3B,MAAQ,CACP,OAAO,IACR,CACD,CAsBA,eAAewoD,GAAuB,EAAK,EAAM,EAAQ,CACxD,GAAM,CAAE,YAAW,UAAS,oBAAqB3iE,EACjD,GAAI,EAAE,MAAM,QAAQgJ,EAAQ,GAAG,EAAIA,EAAQ,IAAMA,EAAQ,KAAO,KAAuB,CAAC,EAAjB,CAACA,EAAQ,GAAG,EAAK,CAAG,SAAS8oC,CAAgB,EAAG,MAAM,IAAIz2C,EAAW,cAAe,CAC1J,kBAAmB,mDACnB,MAAO,gBACR,CAAC,EACD,IAAMkxE,EAAcpmD,EAAK,sBAAwB,IAC3C3J,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACvC,GAAI,OAAOxT,EAAQ,KAAQ,SAAU,MAAM,IAAI3N,EAAW,cAAe,CACxE,kBAAmB,0CACnB,MAAO,gBACR,CAAC,EACD,GAAI2N,EAAQ,KAAOwT,EAAK,MAAM,IAAInhB,EAAW,cAAe,CAC3D,kBAAmB,+BACnB,MAAO,gBACR,CAAC,EACD,GAAI2N,EAAQ,IAAMwT,EAAM+vD,EAAa,MAAM,IAAIlxE,EAAW,cAAe,CACxE,kBAAmB,sDAAsDkxE,EAAY,IACrF,MAAO,gBACR,CAAC,EACD,GAAI,OAAOvjE,EAAQ,KAAQ,UAAYwT,EAAMxT,EAAQ,IAAMujE,EAAa,MAAM,IAAIlxE,EAAW,cAAe,CAC3G,kBAAmB,oDAAoDkxE,EAAY,IACnF,MAAO,gBACR,CAAC,EACD,GAAI,OAAOvjE,EAAQ,KAAQ,UAAYA,EAAQ,IAAI,SAAW,EAAG,MAAM,IAAI3N,EAAW,cAAe,CACpG,kBAAmB,0CACnB,MAAO,gBACR,CAAC,EACD,IAAMmxE,EAAY,MAAMppD,GAAW,SAAS,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG0mC,EAAU,GAAG9gD,EAAQ,KAAK,CAAC,EACtGyjE,EAAQjtE,GAAsB,IAAI,WAAWgtE,CAAS,CAAC,CAAC,MAAM,EAAG,EAAE,EAAGpxC,EAAI,QAAQ,OAAO,EAC/F,GAAI,CACH,MAAMA,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAO,uBACP,KAAM,CACL,GAAIqxC,EACJ,UAA2B,IAAI,KAAKzjE,EAAQ,IAAM,GAAG,CACtD,EACA,aAAc,EACf,CAAC,CACF,OAAS0jE,EAAW,CACnB,IAAIC,EAAc,GAClB,GAAI,CACH,EAAc,EAAQ,MAAMvxC,EAAI,QAAQ,QAAQ,QAAQ,CACvD,MAAO,uBACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOqxC,CACR,CAAC,CACF,CAAC,CACF,MAAQ,CAAC,CAKT,MAJIE,EAAmB,IAAItxE,EAAW,cAAe,CACpD,kBAAmB,6CACnB,MAAO,gBACR,CAAC,EACKqxE,CACP,CACD,CAQA,eAAe9B,GAAsB,EAAK,EAAM,EAAiB,EAAqB,EAAc,EAAkB,CACrH,GAAIgC,IAAA,yDAA+C,MAAM,IAAIvxE,EAAW,cAAe,CACtF,kBAAmB,oCACnB,MAAO,gBACR,CAAC,EACD,IAAIqP,EACJ,GAAI,CACH,EAAS+W,GAAsBorD,CAAe,CAC/C,MAAQ,CACP,MAAM,IAAIxxE,EAAW,cAAe,CACnC,kBAAmB,iDACnB,MAAO,gBACR,CAAC,CACF,CACA,GAAI,CAACqP,EAAO,KAAO,CAAC6gE,GAAgB,SAAS7gE,EAAO,GAAG,EAAG,MAAM,IAAIrP,EAAW,cAAe,CAC7F,kBAAmB,4CAA4CqP,EAAO,MACtE,MAAO,gBACR,CAAC,EACD,IAAIoiE,EACJ,GAAI,CACH,EAAalrD,GAAUirD,CAAe,CACvC,MAAQ,CACP,MAAM,IAAIxxE,EAAW,cAAe,CACnC,kBAAmB,kDACnB,MAAO,gBACR,CAAC,CACF,CACA,IAAMmkC,EAAWstC,EAAW,KAAOA,EAAW,IAC9C,GAAI,CAACttC,EAAU,MAAM,IAAInkC,EAAW,cAAe,CAClD,kBAAmB,wEACnB,MAAO,gBACR,CAAC,EACD,GAAI0xE,GAAgBA,IAAiBvtC,EAAU,MAAM,IAAInkC,EAAW,cAAe,CAClF,kBAAmB,qDACnB,MAAO,gBACR,CAAC,EACD,IAAMs1C,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMqZ,CAAQ,EAClD,GAAI,CAACmR,EAAQ,MAAM,IAAIt1C,EAAW,cAAe,CAChD,kBAAmB,iBACnB,MAAO,gBACR,CAAC,EACD,GAAIs1C,EAAO,SAAU,MAAM,IAAIt1C,EAAW,cAAe,CACxD,kBAAmB,qBACnB,MAAO,gBACR,CAAC,EACD,GAAIs1C,EAAO,0BAA4B,kBAAmB,MAAM,IAAIt1C,EAAW,cAAe,CAC7F,kBAAmB,8DACnB,MAAO,gBACR,CAAC,EACD,IAAM6lB,EAAO,MAAMkrD,GAAgBhxC,EAAKjV,EAAMwqB,CAAM,EAC9Cq8B,EAAmBl7B,GAAoB,GAAG1W,EAAI,QAAQ,QAAQ,eAC9D6xC,EAAiBrK,GAAUxnC,EAAKjV,CAAI,EACpC+mD,EAAoB,CAAC,GAAG,IAAI,IAAI,CAACF,EAAkBC,CAAc,CAAC,CAAC,EACnEE,EAAa,CAClB,OAAQ3tC,EACR,QAASA,EACT,SAAU0tC,EACV,WAAY3B,EACb,EACIviE,EACJ,GAAI,EACF,YAAY,MAAMqU,GAAUwvD,EAAiB7rD,GAAkBE,CAAI,EAAGisD,CAAU,EAClF,OAASC,EAAW,CACnB,GAAIA,aAAqB,OAAS,qCAAqC,KAAKA,EAAU,OAAO,EAAG,CAC/F,IAAMC,EAAY,MAAMf,GAAkBnmD,EAAMwqB,CAAM,EACtD,GAAI08B,EAAW,GAAI,EACjB,YAAY,MAAMhwD,GAAUwvD,EAAiB7rD,GAAkBqsD,CAAS,EAAGF,CAAU,EACvF,MAAQ,CACP,MAAM,IAAI9xE,EAAW,eAAgB,CACpC,kBAAmB,iDACnB,MAAO,gBACR,CAAC,CACF,MACK,MAAM,IAAIA,EAAW,eAAgB,CACzC,kBAAmB,iDACnB,MAAO,gBACR,CAAC,CACF,MAAO,MAAM,IAAIA,EAAW,eAAgB,CAC3C,kBAAmB,iDACnB,MAAO,gBACR,CAAC,CACF,CACA,IAAMiyE,GAAoB,MAAM,QAAQtkE,EAAQ,GAAG,EAAIA,EAAQ,IAAM,CAACA,EAAQ,GAAG,EAAA,CAAG,KAAM,GAAU,OAAO7H,GAAU,UAAY+rE,EAAkB,SAAS/rE,CAAK,CAAC,EAMlK,OALA,MAAMwhE,GAAuBvnC,EAAKjV,EAAM,CACvC,UAAW,mBAAmBqZ,IAC9B,UACA,iBAAkB8tC,CACnB,CAAC,EACM,CAAE,UAAS,CACnB,CAWA,SAASC,GAAwB,EAAQ,EAAO,EAAkB,CACjE,OAAO,IAAIlyE,EAAWm6B,EAAQ,CAC7B,QACA,kBAAmBwa,CACpB,EAAG,CACF,mBAAoB,iBAAiB14B,EAAM,GAC3C,GAAG+8B,EACJ,CAAC,CACF,CAaA,eAAem5B,GAA4B,EAAK,EAAM,EAAgB,CACrE,IAAMhjE,EAAU4wB,EAAI,QAChBqyC,EACJ,GAAI,CACH,EAAqBtgC,GAAiB3iC,GAAS,IAAI,eAAe,CAAC,CACpE,MAAQ,CACP,MAAM+iE,GAAwB,cAAe,kBAAmB,qDAAqD,CACtH,CACA,GAAI,CAACE,GAAsB,CAACjjE,EAAS,OACrC,GAAI,CAAC2b,EAAK,2BAA4B,MAAMonD,GAAwB,eAAgB,gBAAiB,8BAA8B,EACnI,IAAIttC,EACJ,GAAI,CACH,EAAgB,MAAM9Z,EAAK,2BAA2B,CACrD,qBACA,UACA,gBACD,CAAC,CACF,OAAS7O,EAAO,CAEf,MADIA,aAAiBjc,EAAkBic,EACjC,IAAIjc,EAAW,wBAAyB,CAC7C,MAAO,eACP,kBAAmB,wCACpB,CAAC,CACF,CACA,GAAI,CAAC4kC,EAAe,MAAMstC,GAAwB,eAAgB,gBAAiB,8BAA8B,EACjH,OAAOttC,CACR,CAGA,IAAMytC,GAAmC,CAAC,oBAAoB,EAC9D,SAASC,GAAgC,EAAM,CAC9C,MAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAGxnD,EAAK,iCAAmCA,EAAK,QAAU,CAAC,EAAG,GAAGA,EAAK,iCAAmC,CAAC,CAAC,CAAC,CAAC,CAClI,CACA,SAASynD,GAA8B,EAAQ,CAC9C,IAAM9iC,EAAa6F,EAAO,aAAe,CAAC,GAAG+8B,EAAgC,EAC7E,GAAI5iC,EAAW,OAAS,EAAG,OAAOA,EAClC,MAAM,IAAI1vC,EAAS,cAAe,CACjC,MAAO,0BACP,kBAAmB,kDACpB,CAAC,CACF,CACA,SAASyyE,GAAiC,EAAQ,EAAY,CAE7D,OADIl9B,EAAO,eAAuBA,EAAO,eAClC7F,EAAW,SAAS,oBAAoB,EAAI,CAAC,MAAM,EAAI,IAAK,EACpE,CACA,SAASgjC,GAAqC,EAAQ,EAAyB,MAAO,CACrF,IAAMhjC,EAAa8iC,GAA8Bj9B,CAAM,EACvD,MAAO,CACN,GAAGA,EACH,2BAA4BA,EAAO,4BAA8B,sBACjE,iBAAkBA,EAAO,mBAAqBo9B,IAA2B,KAAO,IAAK,GAAIA,GACzF,YAAajjC,EACb,eAAgB+iC,GAAiCl9B,EAAQ7F,CAAU,CACpE,CACD,CACA,SAASkjC,GAAuB,EAAa,CAC5C,IAAM9wE,EAAM,IAAI,IAAI+wE,CAAW,EAC/B,OAAO/wE,EAAI,WAAa,SAAWA,EAAI,WAAa,UAAYA,EAAI,OAAS,EAC9E,CACA,SAASgxE,GAAqB,EAAa,CAC1C,GAAI,CACH,IAAMC,EAAW,IAAI,IAAIF,CAAW,CAAC,CAAC,SACtC,OAAOE,IAAa,SAAWA,IAAa,QAC7C,MAAQ,CACP,MAAO,EACR,CACD,CASA,SAASC,GAAiD,EAAM,EAAQ,CACvE,IAAM32C,EAAatR,EAAK,0CAA4C,MAEpE,OADIsR,IAAe,SACXkZ,EAAO,eAAiB,CAAC,EAAA,CAAG,KAAKu9B,EAAoB,EAAI,SAAW,MADzCz2C,CAEpC,CACA,SAAS42C,GAAmB,EAAa,CACxC,MAAM,IAAIjzE,EAAS,cAAe,CACjC,MAAO,uBACP,kBAAmB8kB,CACpB,CAAC,CACF,CACA,SAASouD,GAAmB,EAAa,CACxC,IAAMC,EAAY,uBAAuB,KAAKN,CAAW,CAAC,GAAG,GAC7D,GAAI,CAACM,EAAW,OAAO,KACvB,IAAMC,EAAcD,EAAU,MAAMA,EAAU,YAAY,GAAG,EAAI,CAAC,EAClE,GAAIC,EAAY,WAAW,GAAG,EAAG,CAChC,IAAMC,EAAaD,EAAY,QAAQ,GAAG,EAC1C,OAAOC,EAAa,EAAI,KAAOD,EAAY,MAAM,EAAGC,EAAa,CAAC,CAAC,CAAC,YAAY,CACjF,CACA,OAAQD,EAAY,MAAM,GAAG,CAAC,CAAC,IAAM,GAAA,CAAI,YAAY,CACtD,CACA,SAASE,GAA0C,EAAM,EAAoB,CAC5E,IAAMC,EAAmB,IAAI,IAAI,CAAC,GAAGxoD,EAAK,oCAAsC,CAAC,EAAG,GAAGA,EAAK,oCAAsC,CAAC,CAAC,CAAC,EACrI,IAAK,IAAMutC,KAAce,EAAoB,GAAI,CAACka,EAAiB,IAAIjb,CAAU,EAAG,MAAM,IAAIt4D,EAAS,cAAe,CACrH,MAAO,iBACP,kBAAmB,sBAAsBs4D,EAAW,wCACrD,CAAC,CACF,CACA,eAAekb,GAAmC,EAAK,EAAM,EAAoB,CAChF,IAAMC,EAAmB1oD,EAAK,oCAAsC,CAAC,EAC/D0vC,EAAY,CAAC,GAAG,IAAI,IAAI,CAAC,GAAGgZ,EAAkB,GAAGpa,CAAkB,CAAC,CAAC,EAC3E,IAAK,IAAMf,KAAcmC,EAAW,CACnC,IAAMhB,EAAM,MAAMN,GAAYn5B,EAAKjV,EAAMutC,CAAU,EACnD,GAAI,CAACmB,EAAK,MAAM,IAAIz5D,EAAS,cAAe,CAC3C,MAAO,iBACP,kBAAmB,sBAAsBs4D,EAAW,gBACrD,CAAC,EACD,GAAImB,EAAI,SAAU,MAAM,IAAIz5D,EAAS,cAAe,CACnD,MAAO,iBACP,kBAAmB,sBAAsBs4D,EAAW,aACrD,CAAC,CACF,CACA,OAAOmC,CACR,CACA,SAASiZ,GAA0B,EAAa,EAAiB,CAChE,IAAI5xE,EACJ,GAAI,CACH,EAAM,IAAI,IAAI+wE,CAAW,CAC1B,MAAQ,CACPI,GAAmB,yCAAyCJ,GAAa,CAC1E,EACIA,EAAY,SAAS,GAAG,GAAK/wE,EAAI,SAAS,OAAS,GAAKA,EAAI,SAAS,OAAS,IAAGmxE,GAAmB,4DAA4DJ,GAAa,EACjL,IAAMc,EAAS7xE,EAAI,WAAa,QAC1B8xE,EAAU9xE,EAAI,WAAa,SAC7B,kBAAkB,KAAKA,EAAI,QAAQ,GAAGmxE,GAAmB,0DAA0DJ,GAAa,EACpI,IAAMgB,EAAqBvjB,GAAaxuD,EAAI,QAAQ,GAAKA,EAAI,WAAa,YACpEgyE,EAAkBZ,GAAmBL,CAAW,EAElDkB,IAAoB,OACnB,CAACH,GAAWC,IAAoBZ,GAAmB,kEAAkEJ,GAAa,EAGnIe,EACCC,GAAoBZ,GAAmB,6DAA6DJ,GAAa,EAGlHc,EATgCG,IAAoB,aAAeA,IAAoB,aAAeA,IAAoB,SAU3Fb,GAAmB,gGAAgGJ,GAAa,EAG9JhgB,GAA8B/wD,CAAG,GAAGmxE,GAAmB,4KAA4KJ,GAAa,CACtP,CACA,SAASmB,GAA4B,EAAM,CAC1C,IAAMj1D,EAASooD,GAAyBrhD,CAAI,EAC5C,GAAI,CAAC/G,EAAO,MAAO,MAAM,IAAI/e,EAAS,cAAe,CACpD,MAAO,0BACP,kBAAmB+e,EAAO,KAC3B,CAAC,CACF,CACA,eAAek1D,GAAiB,EAAK,EAAM,CAC1C,IAAM55C,EAAO2F,EAAI,KACjB,GAAI,CAACjV,EAAK,+BAAgC,MAAM,IAAI/qB,EAAS,YAAa,CACzE,MAAO,gBACP,kBAAmB,iCACpB,CAAC,EACD,IAAMqjD,EAAU,MAAMiK,EAAkBttB,CAAG,EACrCk0C,EAAqB7wB,EAAU,IAAK,GAAI,MAAM+uB,GAA4BpyC,EAAKjV,EAAMsP,CAAI,EACzF85C,EAAoB,EAAQD,EAClC,GAAI,EAAE7wB,GAAW8wB,GAAqBppD,EAAK,wCAAyC,MAAM,IAAI/qB,EAAS,eAAgB,CAAE,kBAAmB,iDAAkD,EAAG,CAChM,mBAAoB,SACpB,GAAGi5C,EACJ,CAAC,EACD,GAAI,CAACoK,GAAW,CAAC8wB,GACZ95C,EAAK,aAAa,SAAS,oBAAoB,EAAG,MAAM,IAAIr6B,EAAS,cAAe,CACvF,MAAO,0BACP,kBAAmB,8DACpB,CAAC,EAEF,IAAMq5D,EAAqB,MAAM,QAAQh/B,EAAK,SAAS,EAAIA,EAAK,UAAU,OAAQ,GAAa,OAAOs+B,GAAa,UAAYA,EAAS,OAAS,CAAC,EAAI,CAAC,EACnJtV,GAAS,MAAMgsB,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,QAAQ,EACtE,IAAM44C,EAAcuQ,GAAoB,cAAgB7wB,GAAWt4B,EAAK,gBAAkB,MAAMA,EAAK,gBAAgB,CACpH,KAAMs4B,EAAQ,KACd,QAASA,EAAQ,OAClB,CAAC,EAAI,IAAK,IACJ5oB,EAAW,MAAM25C,GAA8Bp0C,EAAKjV,EAAM,CAC/D,SAAUsP,EACV,mBAAoB,UACpB,OAAQspC,EAAc,IAAK,GAAItgB,GAAS,QAAQ,OAChD,cACA,oBACD,CAAC,EAED,OADArjB,EAAI,UAAU,GAAG,EACVA,EAAI,KAAKvF,CAAQ,CACzB,CACA,eAAe45C,GAAiB,EAAQ,EAAM,EAAU,CACvD,IAAMC,EAA2BrjC,GAAU,qBAAuB,yBAC5DsjC,EAAqB7B,GAAqCn9B,EAAQ++B,EAA2B,KAAOrjC,GAAU,qBAAuB,UAAY+hC,GAAiDjoD,EAAMwqB,CAAM,EAAI,KAAK,EACvN0nB,EAA0BsX,EAAmB,4BAA8B,sBACjF,GAAI,CAAC,IAAI,IAAIvjC,GAAwBjmB,EAAM,CAAE,YAAa,EAAK,CAAC,CAAC,CAAC,CAAC,IAAIkyC,CAAuB,EAAG,MAAM,IAAIj9D,EAAS,cAAe,CAClI,MAAO,0BACP,kBAAmB,0CAA0Ci9D,GAC9D,CAAC,EACD,GAAIsX,EAAmB,2BAA6B,IAAK,IAAK,OAAOA,EAAmB,0BAA6B,UAAW,MAAM,IAAIv0E,EAAS,cAAe,CACjK,MAAO,0BACP,kBAAmB,4CACpB,CAAC,EACD,IAAM0vC,EAAa6kC,EAAmB,aAAe,CAAC,EAChDC,EAAgBD,EAAmB,eACnCR,EAAkBQ,EAAmB,iBAC3C,GAAIR,IAAoB,IAAK,IAAKA,IAAoB,OAASA,IAAoB,SAAU,MAAM,IAAI/zE,EAAS,cAAe,CAC9H,MAAO,0BACP,kBAAmB,wCACpB,CAAC,EACD,GAAI0vC,EAAW,SAAS,oBAAoB,IAAM,CAAC6kC,EAAmB,eAAiBA,EAAmB,cAAc,SAAW,GAAI,MAAM,IAAIv0E,EAAS,cAAe,CACxK,MAAO,uBACP,kBAAmB,4EACpB,CAAC,EACD,IAAK,IAAMi3C,KAAOs9B,EAAmB,eAAiB,CAAC,EAAGb,GAA0Bz8B,EAAK88B,IAAoBO,EAA2B,SAAW,MAAM,EACzJ,IAAMG,EAAsB,IAAI,IAAI5jC,GAAuB9lB,CAAI,CAAC,EAChE,GAAIupD,EACC,IAAA,CAAC5kC,EAAW,KAAM,GAAc+kC,EAAoB,IAAIplC,CAAS,CAAC,EAAG,MAAM,IAAIrvC,EAAS,cAAe,CAC1G,MAAO,0BACP,kBAAmB,0CAA0C0vC,EAAW,KAAK,IAAI,GAClF,CAAC,CAAA,MACK,IAAK,IAAML,KAAaK,EAAY,GAAI,CAAC+kC,EAAoB,IAAIplC,CAAS,EAAG,MAAM,IAAIrvC,EAAS,cAAe,CACrH,MAAO,0BACP,kBAAmB,0BAA0BqvC,GAC9C,CAAC,EACD,GAAIK,EAAW,SAAS,oBAAoB,GAAK,CAAC8kC,GAAe,SAAS,MAAM,EAAG,MAAM,IAAIx0E,EAAS,cAAe,CACpH,MAAO,0BACP,kBAAmB,qFACpB,CAAC,EACD,GAAI,CAAC0vC,EAAW,SAAS,oBAAoB,GAAK8kC,GAAe,SAAS,MAAM,EAAG,MAAM,IAAIx0E,EAAS,cAAe,CACpH,MAAO,0BACP,kBAAmB,qFACpB,CAAC,EACD,GAAIu0E,EAAmB,eAAiB,IAAK,GAAG,CAC/C,GAAIA,EAAmB,eAAiB,UAAYA,EAAmB,eAAiB,WAAY,MAAM,IAAIv0E,EAAS,cAAe,CACrI,MAAO,0BACP,kBAAmB,6CACpB,CAAC,EACD,GAAIu0E,EAAmB,eAAiB,YAAc,CAACxpD,EAAK,eAAgB,MAAM,IAAI/qB,EAAS,cAAe,CAC7G,MAAO,0BACP,kBAAmB,oEACpB,CAAC,EACD,GAAIu0E,EAAmB,eAAiB,YAAcA,EAAmB,eAAe,KAAK3B,EAAsB,EAAG,MAAM,IAAI5yE,EAAS,cAAe,CACvJ,MAAO,0BACP,kBAAmB,6EACpB,CAAC,EACD,GAAIu0E,EAAmB,eAAiB,YAAcA,EAAmB,eAAiBA,EAAmB,cAAc,OAAS,GAC/H,IAAI,IAAIA,EAAmB,cAAc,IAAK,GAAQ,IAAI,IAAIt9B,CAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAO,EAAG,MAAM,IAAIj3C,EAAS,cAAe,CACzH,MAAO,0BACP,kBAAmB,iKACpB,CAAC,CAEH,CACA,IAAMilE,GAAmBsP,GAAoB,MAAA,EAAQ,MAAM,GAAG,CAAC,CAAC,OAAQ,GAAM38B,EAAE,MAAM,EAChF88B,EAAgCzjC,GAAU,qBAAuB,WAAaA,GAAU,qBAAuB,yBAC/G0jC,EAAgBD,EAAgCnC,GAAgCxnD,CAAI,EAAIA,EAAK,OACnG,GAAI4pD,EAAe,CAClB,IAAMj/B,EAAc,IAAI,IAAIi/B,CAAa,EACzC,IAAK,IAAMvP,KAAkBH,GAAmB,CAAC,EAAG,GAAI,CAACvvB,GAAa,IAAI0vB,CAAc,EAAG,MAAM,IAAIplE,EAAS,cAAe,CAC5H,MAAO,gBACP,kBAAmB,wBAAwBolE,GAC5C,CAAC,CACF,CACA,GAAIsP,GAAiCH,EAAmB,eAAiB,GAAO,MAAM,IAAIv0E,EAAS,cAAe,CACjH,MAAO,0BACP,kBAAmB,0CACpB,CAAC,EACD,GAAIu0E,EAAmB,MAAQA,EAAmB,SAAU,CAC3D,GAAIA,EAAmB,MAAQA,EAAmB,SAAU,MAAM,IAAIv0E,EAAS,cAAe,CAC7F,MAAO,0BACP,kBAAmB,0CACpB,CAAC,EACD,GAAIu0E,EAAmB,SAAU,GAAI,CACpC,IAAMt9B,EAAM,IAAI,IAAIs9B,EAAmB,QAAQ,EAC/C,GAAIt9B,EAAI,WAAa,SAAU,MAAM,IAAIj3C,EAAS,cAAe,CAChE,MAAO,0BACP,kBAAmB,yBACpB,CAAC,EACD,GAAIi3C,EAAI,UAAYA,EAAI,SAAU,MAAM,IAAIj3C,EAAS,cAAe,CACnE,MAAO,0BACP,kBAAmB,uCACpB,CAAC,EACD,GAAIu0E,EAAmB,SAAS,SAAS,GAAG,EAAG,MAAM,IAAIv0E,EAAS,cAAe,CAChF,MAAO,0BACP,kBAAmB,gDACpB,CAAC,EACD,GAAIuvE,GAAkBt4B,EAAI,QAAQ,EAAG,MAAM,IAAIj3C,EAAS,cAAe,CACtE,MAAO,0BACP,kBAAmB,0DACpB,CAAC,EACD,GAAIixC,GAAU,KAAO,CAACA,EAAS,IAAI,QAAQ,gBAAgBgG,EAAI,IAAI,EAAG,CACrE,IAAM7S,EAAW,OAAOmwC,EAAmB,WAAc,SAAWA,EAAmB,UAAY,IAAK,GACxG,GAAI,EAAED,GAA4BlwC,IAAa,IAAK,IAAK,IAAI,SAASA,CAAQ,GAAK,IAAI,IAAIA,CAAQ,CAAC,CAAC,SAAW6S,EAAI,QAAS,MAAM,IAAIj3C,EAAS,cAAe,CAC9J,MAAO,0BACP,kBAAmB,oFACpB,CAAC,CACF,CACD,OAAS,EAAG,CAEX,MADI,aAAaA,EAAgB,EAC3B,IAAIA,EAAS,cAAe,CACjC,MAAO,0BACP,kBAAmB,8BACpB,CAAC,CACF,CACIu0E,EAAmB,MAAMP,GAA4BO,EAAmB,IAAI,CACjF,CACA,GAAItX,IAA4B,mBAAqB,CAACsX,EAAmB,MAAQ,CAACA,EAAmB,SAAU,MAAM,IAAIv0E,EAAS,cAAe,CAChJ,MAAO,0BACP,kBAAmB,kDACpB,CAAC,EACD,GAAIu0E,EAAmB,yBAA2B,IAAK,GAAG,CACzD,GAAIxpD,EAAK,iBAAkB,MAAM,IAAI/qB,EAAS,cAAe,CAC5D,MAAO,0BACP,kBAAmB,iFACpB,CAAC,EACD,IAAI8B,EACJ,GAAI,CACH,EAAM,IAAI,IAAIyyE,EAAmB,sBAAsB,CACxD,MAAQ,CACP,MAAM,IAAIv0E,EAAS,cAAe,CACjC,MAAO,0BACP,kBAAmB,gDACpB,CAAC,CACF,CACA,GAAIu0E,EAAmB,uBAAuB,SAAS,GAAG,EAAG,MAAM,IAAIv0E,EAAS,cAAe,CAC9F,MAAO,0BACP,kBAAmB,8DACpB,CAAC,EACD,GAAI8B,EAAI,WAAa,SAAU,MAAM,IAAI9B,EAAS,cAAe,CAChE,MAAO,0BACP,kBAAmB,uCACpB,CAAC,EACD,GAAI8B,EAAI,UAAYA,EAAI,SAAU,MAAM,IAAI9B,EAAS,cAAe,CACnE,MAAO,0BACP,kBAAmB,qDACpB,CAAC,EACD,GAAIuvE,GAAkBztE,EAAI,QAAQ,EAAG,MAAM,IAAI9B,EAAS,cAAe,CACtE,MAAO,0BACP,kBAAmB,wEACpB,CAAC,CACF,CACD,CACA,IAAM40E,GAAgC,OAAO,+BAA+B,EAc5E,eAAeC,GAA+B,EAAK,EAAM,EAAO,CAC/D,IAAMC,EAAuBhoE,EAAM,qBAAuB,WAAa,CAACA,EAAM,SAAS,MAAQ,CAC9F,GAAGA,EAAM,SACT,OAAQie,EAAK,iCAAmCA,EAAK,OAAA,EAAS,KAAK,GAAG,CACvE,EAAIje,EAAM,SACJutB,EAAOq4C,GAAqCoC,EAAsBhoE,EAAM,qBAAuB,yBAA2B,KAAOA,EAAM,qBAAuB,UAAYkmE,GAAiDjoD,EAAM+pD,CAAoB,EAAI,KAAK,EAC9PviE,EAAW8nB,EAAK,6BAA+B,OAC/C06C,EAAkB16C,EAAK,6BAA+B,kBACtD26C,EAAwB9jC,GAAmCnmB,EAAMsP,EAAK,0BAA0B,EACtG,MAAMg6C,GAAiBh6C,EAAMtP,EAAM,CAClC,mBAAoBje,EAAM,mBAC1B,KACD,CAAC,EACD,IAAMs3B,EAAWt3B,EAAM,UAAYie,EAAK,mBAAmB,GAAKlD,GAAqB,GAAI,MAAO,KAAK,EAC/F8c,EAAepyB,GAAYwiE,GAAmBC,EAAwB,IAAK,GAAIjqD,EAAK,uBAAuB,GAAKlD,GAAqB,GAAI,MAAO,KAAK,EACrJksB,EAAqBpP,EAAe,MAAMwP,GAAkBnU,EAAKjV,EAAM4Z,CAAY,EAAI,IAAK,GAC5FswC,EAAoCnoE,EAAM,qBAAuB,WAAa,CAACyF,GAAYwY,EAAK,gCAAkC,GAClImqD,EAAc76C,EAAK,eAAiB,IAA4C,IAAK,IACrF/Y,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACjC,CAAE,UAAW6zD,EAAqB,GAAGC,GAAoBtoE,EAAM,qBAAuB,WAAaA,EAAM,qBAAuB,yBAA2B,CAChK,GAAGutB,EACH,MAAOk4C,GAAgCxnD,CAAI,CAAC,CAAC,KAAK,GAAG,CACtD,EAAIsP,EACEg7C,EAAQvoE,EAAM,qBAAuB,yBAA2B,IAAK,GAAI,CAC9E,OAAQA,EAAM,OACd,YAAaA,EAAM,WACpB,EACM01B,EAAS8yC,GAAc,CAC5B,GAAGF,EACH,cAAe/6C,EAAK,eAAiB,CAAC,EACtC,SAAU,IAAK,GACf,yBAA0B0Z,EAAqBjnC,EAAM,qBAAuB,WAAaie,EAAK,yCAA2CqoC,GAASroC,EAAK,yCAA0CzJ,CAAG,EAAI,EAAI,IAAK,GACjN,UAAW8iB,EACX,cAAe2P,EACf,oBAAqBzyB,EACrB,aAAc4zD,EACd,QAASG,GAAO,YAAc,IAAK,GAAIA,GAAO,OAC9C,aAAcA,GAAO,WACtB,CAAC,EACD,EAAO,wBAA0BvoE,EAAM,qBAAuB,yBAA2BA,EAAM,gBAAgB,yBAA2B,CAAC,EAAIA,EAAM,qBAAuB,UAAYA,EAAM,yBAA2B,CAAC,EAAI,CAAC,EAC/N,EAAO,kBAAoBA,EAAM,qBAAuB,yBAA2BA,EAAM,kBAAoB,KACzGA,EAAM,qBAAuB,0BAA4ButB,EAAK,mBAAqB,IAAK,KAAG,EAAO,gBAAkB,MACxH,IAAMg/B,EAAqBvsD,EAAM,qBAAuB,yBAA2B,CAAC,EAAIA,EAAM,oBAAsB,CAAC,EACjHA,EAAM,qBAAuB,WAAWwmE,GAA0CvoD,EAAMsuC,CAAkB,EAC9G,IAAMoB,EAAY,MAAM+Y,GAAmCxzC,EAAKjV,EAAMsuC,CAAkB,EAClFkc,EAAcxqD,EAAK,QAAQ,aAAa,WAAa,cACrDyqD,EAAsBzqD,EAAK,QAAQ,qBAAqB,WAAa,sBACrE0qD,EAAiB3oE,EAAM,qBAAuB,yBAA2BA,EAAM,eAAiB,IAAK,GACrGojC,EAAoBpjC,EAAM,qBAAuB,yBAA2BA,EAAM,kBAAoB,KACtG4oE,EAAoB,MAAMz0B,GAAmBjhB,EAAI,QAAQ,QAAS,SAAY,CACnF,IAAMmhB,EAAU,MAAMT,GAAkB1gB,EAAI,QAAQ,OAAO,EACvD21C,EACArZ,EAAU,GACd,GAAImZ,EAAgB,CACnB,IAAMG,EAAgB,MAAMz0B,EAAQ,OAAO,CAC1C,MAAOo0B,EACP,MAAO,CAAC,CACP,MAAO,WACP,MAAOnxC,CACR,EAAG,CACF,MAAO,oBACP,MAAO8L,CACR,CAAC,EACD,OAAQ,CACP,GAAG1N,EACH,SAAUizC,EAAe,SACzB,YAAaA,EAAe,YAC5B,iBAAkBA,EAAe,iBACjC,UAAWA,EAAe,UAC1B,UAA2B,IAAI,KAAKn0D,EAAM,GAAG,CAC9C,CACD,CAAC,EACD,GAAI,CAACs0D,EAAe,MAAM,IAAI51E,EAAS,cAAe,CACrD,MAAO,iBACP,kBAAmB,yBACpB,CAAC,EACD,EAAe41E,CAChB,KAAO,CACN,GAAI,CACH,EAAe,MAAMz0B,EAAQ,OAAO,CACnC,MAAOo0B,EACP,KAAM,CACL,GAAG/yC,EACH,UAA2B,IAAI,KAAKlhB,EAAM,GAAG,EAC7C,UAA2B,IAAI,KAAKA,EAAM,GAAG,CAC9C,CACD,CAAC,CACF,OAASpF,EAAO,CAOf,MANIpP,EAAM,qBAAuB,0BAA4B+oE,GAAwB35D,CAAK,EAAS,EACjG04D,IAAgC,GACjC,KAAM,0BACN,WACA,MAAO14D,CACR,EACMA,CACP,CACA,EAAU,EACX,CACA,IAAM45D,EAAkBrb,EAAU,SAAW,EAAI,CAAC,EAAI,MAAMtZ,EAAQ,SAAS,CAC5E,MAAOq0B,EACP,MAAO,CAAC,CACP,MAAO,WACP,MAAOpxC,CACR,CAAC,CACF,CAAC,EACK2xC,EAAoB,IAAI,IAAID,EAAgB,IAAK,GAASE,EAAK,UAAU,CAAC,EAC1E50D,EAAsB,IAAI,KAChC,IAAK,IAAM60D,KAAcxb,EACxB,GAAI,GAAkB,IAAIwb,CAAU,EACpC,GAAI,CACH,MAAM90B,EAAQ,OAAO,CACpB,MAAOq0B,EACP,KAAM,CACL,WACA,aACA,UAAWp0D,CACZ,CACD,CAAC,CACF,OAASlF,EAAO,CAQf,MAPIpP,EAAM,qBAAuB,0BAA4B+oE,GAAwB35D,CAAK,EAAS,EACjG04D,IAAgC,GACjC,KAAM,oCACN,WACA,aACA,MAAO14D,CACR,EACMA,CACP,CAED,MAAO,CACN,OAAQy5D,EACR,SACD,CACD,CAAC,EACD,MAAO,CACN,OAAQD,EAAkB,OAC1B,eACA,YACA,QAASA,EAAkB,OAC5B,CACD,CACA,SAASQ,GAAsC,EAAQ,EAAM,CAC5D,IAAMrS,EAAesS,GAAc,CAClC,GAAGp3D,EAAO,OACV,aAAcA,EAAO,cAAgBgM,EAAK,QAAQ,cAAgB,IAAMhM,EAAO,aAAe,IAAK,EACpG,CAAC,EAED,OADIA,EAAO,UAAU,OAAS,IAAG,EAAa,UAAYA,EAAO,WAC1D8kD,CACR,CACA,SAASuS,GAAwC,EAAQ,EAAM,CAC9D,MAAO,CACN,GAAGF,GAAsCn3D,EAAQgM,CAAI,EACrD,0BAA2B,CAAC,GAAGhM,EAAO,OAAO,yBAA2B,CAAC,CAAC,CAC3E,CACD,CAIA,eAAeq1D,GAA8B,EAAK,EAAM,EAAO,CAC9D,OAAO8B,GAAsC,MAAMrB,GAA+B70C,EAAKjV,EAAMje,CAAK,EAAGie,CAAI,CAC1G,CACA,eAAesrD,GAA4C,EAAK,EAAM,EAAO,CAC5E,OAAOD,GAAwC,MAAMvB,GAA+B70C,EAAKjV,EAAMje,CAAK,EAAGie,CAAI,CAC5G,CA2EA,SAAS8qD,GAAwB,EAAO,CACvC,GAAI,CAAC35D,GAAS,OAAOA,GAAU,SAAU,MAAO,GAChD,IAAMs3B,EAAYt3B,EACZtP,EAAO,OAAO4mC,EAAU,MAAQA,EAAU,OAAS,EAAE,EAU3D,MATI,CACH,OACA,QACA,QACA,eACA,QACA,0BACD,CAAC,CAAC,SAAS5mC,CAAI,GACX4mC,EAAU,OAAS,oBAAsBA,EAAU,OAAS,KAAa,GACtE,OAAOA,EAAU,SAAY,UAAY,8CAA8C,KAAKA,EAAU,OAAO,CACrH,CACA,eAAe8iC,GAA0B,EAAK,EAAM,EAAU,CAC7D,IAAMjzB,EAAU,MAAMiK,EAAkBttB,CAAG,EAE3C,GADA,MAAMqvC,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,QAAQ,EACrD,CAACs4B,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,IAAM2jE,EAAc54C,EAAK,gBAAkB,MAAMA,EAAK,gBAAgB,CACrE,KAAMs4B,EAAQ,KACd,QAASA,EAAQ,OAClB,CAAC,EAAI,IAAK,GACJ,CAAE,0BAA2BkzB,EAA4B,GAAGxwD,GAAaia,EAAI,KAC7EglC,EAA0B/zB,GAAU,MAAQ8rB,GAAiCwZ,GAA8B,CAAC,CAAC,EAAI,CAAC,EACxHvZ,GAAgCgI,EAAyBwN,GAA8BzsD,CAAQ,EAAGA,EAAS,2BAA4BgF,CAAI,EACvIi6C,EAAwB,OAAS,GAAG,MAAMqK,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,qCAAqC,EAC9H,IAAMsuC,EAAqBpoB,GAAU,MAAQlrB,EAAS,UAAY,IAAK,GACvE,IAAK,IAAMuyC,KAAc,IAAI,IAAIe,GAAsB,CAAC,CAAC,EAAG,MAAMiW,GAAyBtvC,EAAKqjB,EAASt4B,EAAM,OAAQutC,CAAU,EACjI,IAAMke,EAAoB,CACzB,WACA,mBAAoB,UACpB,OAAQ7S,EAAc,IAAK,GAAItgB,EAAQ,QAAQ,OAC/C,cACA,0BACA,GAAGgW,EAAqB,CAAE,oBAAmB,EAAI,CAAC,CACnD,EACMwK,EAAe5yB,GAAU,MAAQ,MAAMolC,GAA4Cr2C,EAAKjV,EAAMyrD,CAAiB,EAAI,MAAMpC,GAA8Bp0C,EAAKjV,EAAMyrD,CAAiB,EAEzL,OADAx2C,EAAI,UAAU,GAAG,EACVA,EAAI,KAAK6jC,CAAY,CAC7B,CACA,SAASyR,GAAc,EAAO,CAC7B,GAAM,CAAE,UAAWlxC,EAAU,cAAeO,EAAc,yBAA0B8xC,EAAY,MAAOC,EAAQ,QAASv/B,EAAQ,oBAAqBykB,EAAY,YAAa32D,EAAM,WAAYgyC,EAAK,SAAU0/B,EAAM,WAAU,QAASC,EAAK,WAAYC,EAAQ,KAAMC,EAAW,SAAUzG,EAAS,YAAa0G,EAAY,iBAAkBC,EAAiB,mBAAoBC,EAAmB,cAAeC,EAAc,0BAA2BC,EAAwB,uBAAwBC,EAAsB,oCAAqCC,EAAkC,2BAA4Bpa,EAAyB,YAAavtB,EAAY,eAAgB8kC,EAAe,iBAAkBT,EAAiB,WAAU,aAAcuD,EAAa,mBAAoBC,EAAkB,aAAcrC,EAAa,yBAA0BsC,EAAuB,aAAcC,EAAa,aAAc9T,EAAa,SAAU+T,GAAkB5qE,EACh8BghC,EAAY2oC,EAA6B,IAAI,KAAK,OAAOA,CAAU,EAAI,GAAG,EAAI,IAAK,GACnF7oB,EAAYgO,EAA6B,IAAI,KAAKA,EAAa,GAAG,EAAI,IAAK,GAC3EnmB,EAASihC,GAAQ,MAAM,GAAG,EAC1BiB,EAAcvI,GAA2CsI,GAAiB,CAAC,CAAC,EAC5E3xD,EAAW4xD,GAAe,OAAO,KAAKA,CAAW,CAAC,CAAC,OAAS,KAAK,UAAUA,CAAW,EAAI,IAAK,GACrG,MAAO,CACN,WACA,eACA,WACA,SACA,SACA,YACA,YACA,OACA,MACA,OACA,WACA,MACA,SACA,aACA,kBACA,oBACA,eACA,yBACA,uBACA,mCACA,0BACA,aACA,gBACA,KAAMb,EAAY,KAAK,UAAUA,CAAS,EAAI,IAAK,GACnD,UACA,kBACA,cACA,mBACA,cACA,wBACA,cACA,cACA,UACD,CACD,CAOA,SAASX,GAAc,EAAO,CAC7B,GAAM,CAAE,WAAU,eAAc,WAAU,SAAQ,SAAQ,YAAW,UAAWyB,EAAY,YAAW,OAAM,MAAK,OAAM,WAAU,MAAK,SAAQ,aAAY,kBAAiB,oBAAmB,eAAc,yBAAwB,uBAAsB,mCAAkC,0BAAyB,aAAY,gBAAe,kBAAiB,OAAM,UAAS,cAAa,mBAAkB,cAAa,wBAAuB,cAAa,cAAa,YAAa9qE,EACrd2pE,EAAa3oC,EAAY,KAAK,MAAM,IAAI,KAAKA,CAAS,CAAC,CAAC,QAAQ,EAAI,GAAG,EAAI,IAAK,GAChF8tB,EAAahO,EAAY,KAAK,MAAM,IAAI,KAAKA,CAAS,CAAC,CAAC,QAAQ,EAAI,GAAG,EAAI,IAAK,GAChFiqB,EAAUpiC,GAAQ,KAAK,GAAG,EAChC,MAAO,CACN,GAAG25B,GAA2Cj5B,GAAoBpwB,CAAQ,CAAC,EAC3E,UAAWqe,EACX,cAAeO,GAAgB,IAAK,GACpC,yBAA0BA,EAAe8xC,GAAc,EAAI,IAAK,GAChE,MAAOoB,GAAW,IAAK,GACvB,QAAS1gC,GAAU,IAAK,GACxB,oBAAqBykB,GAAc,IAAK,GACxC,YAAa32D,GAAQ,IAAK,GAC1B,WAAYgyC,GAAO,IAAK,GACxB,SAAU0/B,GAAQ,IAAK,GACvB,SAAUmB,GAAY,IAAK,GAC3B,QAASlB,GAAO,IAAK,GACrB,WAAYC,GAAU,IAAK,GAC3B,KAAM/wD,EAAO,KAAK,MAAMA,CAAI,EAAI,IAAK,GACrC,SAAUuqD,GAAW,IAAK,GAC1B,YAAa0G,GAAc,IAAK,GAChC,iBAAkBC,GAAmB,IAAK,GAC1C,mBAAoBC,GAAqB,IAAK,GAC9C,cAAeC,GAAgB,CAAC,EAChC,0BAA2BC,GAA0B,IAAK,GAC1D,uBAAwBC,GAAwB,IAAK,GACrD,oCAAqCC,GAAoC,IAAK,GAC9E,2BAA4Bpa,GAA2B,IAAK,GAC5D,YAAavtB,GAAc,IAAK,GAChC,eAAgB8kC,GAAiB,IAAK,GACtC,iBAAkBT,GAAmB,IAAK,GAC1C,SAAUgE,GAAY,IAAK,GAC3B,aAAcT,GAAe,IAAK,GAClC,mBAAoBC,GAAoB,IAAK,GAC7C,aAAcrC,GAAe,IAAK,GAClC,yBAA0BsC,GAAyB,IAAK,GACxD,aAAcC,GAAe,IAAK,GAClC,aAAc9T,GAAe,IAAK,EACnC,CACD,CAGA,eAAeqU,GAAkB,EAAK,EAAM,CAC3C,IAAM30B,EAAU,MAAMiK,EAAkBttB,CAAG,EAE3C,GADA,MAAMqvC,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,OAAQiV,EAAI,MAAM,SAAS,EACxE,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,IAAMu1C,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMiV,EAAI,MAAM,SAAS,EAC7D,GAAI,CAACuV,EAAQ,MAAM,IAAIv1C,EAAS,YAAa,CAC5C,kBAAmB,mBACnB,MAAO,WACR,CAAC,EACD,GAAIu1C,EAAO,OACN,IAAAA,EAAO,SAAW8N,EAAQ,KAAK,GAAI,MAAM,IAAIrjD,EAAS,cAAc,CAAA,MAClE,GAAIu1C,EAAO,aAAexqB,EAAK,gBACjC,IAAAwqB,EAAO,cAAgB,MAAMxqB,EAAK,gBAAgBs4B,CAAO,EAAG,MAAM,IAAIrjD,EAAS,cAAc,CAAA,MAC3F,MAAM,IAAIA,EAAS,cAAc,EACxC,IAAMsI,EAAM6tE,GAAc5gC,CAAM,EAEhC,MADA,GAAI,cAAgB,IAAK,GAClBjtC,CACR,CAKA,eAAe2vE,GAAwB,EAAK,EAAM,EAAU,CAC3D,IAAM1iC,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMqZ,CAAQ,EAKlD,GAJI,CAACmR,GAIDA,EAAO,SAAU,MAAM,IAAIv1C,EAAS,YAAa,CACpD,kBAAmB,mBACnB,MAAO,WACR,CAAC,EACD,OAAOm2E,GAAc,CACpB,SAAU5gC,EAAO,SACjB,KAAMA,EAAO,KACb,IAAKA,EAAO,IACZ,SAAUA,EAAO,SACjB,KAAMA,EAAO,KACb,IAAKA,EAAO,IACZ,OAAQA,EAAO,MAChB,CAAC,CACF,CACA,eAAe2iC,GAAmB,EAAK,EAAM,CAC5C,IAAM70B,EAAU,MAAMiK,EAAkBttB,CAAG,EAE3C,GADA,MAAMqvC,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,MAAM,EACnD,CAACs4B,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,IAAM2jE,EAAc,MAAM54C,EAAK,kBAAkBs4B,CAAO,EACxD,GAAIsgB,EAAa,OAAO,MAAM3jC,EAAI,QAAQ,QAAQ,SAAS,CAC1D,MAAO,cACP,MAAO,CAAC,CACP,MAAO,cACP,MAAO2jC,CACR,CAAC,CACF,CAAC,CAAC,CAAC,KAAM,GACHr7D,EACEA,EAAI,IAAK,GAAM,CACrB,IAAMA,EAAM6tE,GAAcv+B,CAAC,EAE3B,MADA,GAAI,cAAgB,IAAK,GAClBtvC,CACR,CAAC,EALgB,IAMjB,EACI,GAAI+6C,EAAQ,KAAK,GAAI,OAAO,MAAMrjB,EAAI,QAAQ,QAAQ,SAAS,CACnE,MAAO,cACP,MAAO,CAAC,CACP,MAAO,SACP,MAAOqjB,EAAQ,KAAK,EACrB,CAAC,CACF,CAAC,CAAC,CAAC,KAAM,GACH/6C,EACEA,EAAI,IAAK,GAAM,CACrB,IAAMA,EAAM6tE,GAAcv+B,CAAC,EAE3B,MADA,GAAI,cAAgB,IAAK,GAClBtvC,CACR,CAAC,EALgB,IAMjB,EACI,MAAM,IAAItI,EAAS,cAAe,CAAE,QAAS,iDAAkD,CAAC,CACtG,CACA,eAAem4E,GAAqB,EAAK,EAAM,CAC9C,IAAM90B,EAAU,MAAMiK,EAAkBttB,CAAG,EAE3C,GADA,MAAMqvC,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,SAAUiV,EAAI,KAAK,SAAS,EACzE,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,IAAMokC,EAAWpE,EAAI,KAAK,UAC1B,GAAIjV,EAAK,sBAAsB,IAAIqZ,CAAQ,EAAG,MAAM,IAAIpkC,EAAS,wBAAyB,CACzF,kBAAmB,2CACnB,MAAO,gBACR,CAAC,EACD,IAAMu1C,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMqZ,CAAQ,EAClD,GAAI,CAACmR,EAAQ,MAAM,IAAIv1C,EAAS,YAAa,CAC5C,kBAAmB,mBACnB,MAAO,WACR,CAAC,EACD,GAAIu1C,EAAO,OACN,IAAAA,EAAO,SAAW8N,EAAQ,KAAK,GAAI,MAAM,IAAIrjD,EAAS,cAAc,CAAA,MAClE,GAAIu1C,EAAO,aAAexqB,EAAK,gBACjC,IAAAwqB,EAAO,cAAgB,MAAMxqB,EAAK,gBAAgBs4B,CAAO,EAAG,MAAM,IAAIrjD,EAAS,cAAc,CAAA,MAC3F,MAAM,IAAIA,EAAS,cAAc,EACxC,MAAMggC,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAO,cACP,MAAO,CAAC,CACP,MAAO,WACP,MAAOoE,CACR,CAAC,CACF,CAAC,CACF,CACA,eAAeg0C,GAAqB,EAAK,EAAM,EAAU,CACxD,IAAM/0B,EAAU,MAAMiK,EAAkBttB,CAAG,EAE3C,GADA,MAAMqvC,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,SAAUiV,EAAI,KAAK,SAAS,EACzE,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,IAAMokC,EAAWpE,EAAI,KAAK,UAC1B,GAAIjV,EAAK,sBAAsB,IAAIqZ,CAAQ,EAAG,MAAM,IAAIpkC,EAAS,wBAAyB,CACzF,kBAAmB,2CACnB,MAAO,gBACR,CAAC,EACD,IAAMu1C,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMqZ,CAAQ,EAClD,GAAI,CAACmR,EAAQ,MAAM,IAAIv1C,EAAS,YAAa,CAC5C,kBAAmB,mBACnB,MAAO,WACR,CAAC,EACD,GAAM,CAAE,0BAA2Bu2E,EAA4B,GAAG8B,GAAYr4C,EAAI,KAAK,OACjFs4C,EAAa/iC,EAAO,OAASA,EAAO,SAAW8N,EAAQ,KAAK,GAAK9N,EAAO,aAAexqB,EAAK,gBAAkBwqB,EAAO,cAAgB,MAAMxqB,EAAK,gBAAgBs4B,CAAO,EAAI,GAC3Kk1B,EAAiC,CAACD,GAAcrnC,GAAU,OAASslC,IAA+B,IAAK,IAAK,OAAO,KAAK8B,CAAO,CAAC,CAAC,SAAW,EAClJ,GAAI,CAACC,GAAc,CAACC,EAAgC,MAAM,IAAIv4E,EAAS,cAAc,EAErF,GADIu4E,GAAgC,MAAMlJ,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,sCAAuCqZ,CAAQ,EAChI,OAAO,KAAKi0C,CAAO,CAAC,CAAC,SAAW,GAAK9B,IAA+B,IAAK,GAAG,CAC/E,IAAMjuE,EAAM6tE,GAAc5gC,CAAM,EAMhC,MALA,GAAI,cAAgB,IAAK,GACrBtE,GAAU,MAAc,CAC3B,GAAG3oC,EACH,0BAA2B,CAAC,GAAGitC,EAAO,yBAA2B,CAAC,CAAC,CACpE,EACOjtC,CACR,CACA,IAAMkwE,EAAkBH,EAAQ,aAAe9iC,EAAO,YAAc,CAAC,EAC/DkjC,EAA+BJ,EAAQ,4BAA8B9iC,EAAO,wBAC5EyvB,EAA0BuR,IAA+B,IAAK,GAAI,IAAK,GAAIxZ,GAAiCwZ,CAA0B,EACxIvR,IAA4B,IAAK,KACpChI,GAAgCgI,EAAyBwT,EAAiBC,EAA8B1tD,CAAI,EACxGi6C,EAAwB,OAAS,GAAK,CAACuT,GAAgC,MAAMlJ,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,sCAAuCqZ,CAAQ,GAE5K,MAAMiwC,GAAiB,CACtB,GAAG8B,GAAc5gC,CAAM,EACvB,GAAG8iC,CACJ,EAAGttD,EAAM,CAAE,KAAI,CAAC,EAChB,IAAM2tD,EAAgB,CAAE,GAAGpD,GAAc+C,CAAO,CAAE,EAC9C,CAACG,EAAgB,SAAS,oBAAoB,GAAKC,IAAiC,OAAQ,EAAc,wBAA0B,CAAC,EAChIzT,IAA4B,IAAK,KAAG,EAAc,wBAA0BA,GACjFqT,EAAQ,6BAAgCA,EAAQ,6BAA+B,kBAAmB,EAAc,aAAe,MAElI,EAAc,KAAO,KACrB,EAAc,QAAU,KACxB,AAAiCK,EAAc,eAAe,MAAMvkC,GAAkBnU,EAAKjV,EAAMA,EAAK,uBAAuB,GAAKlD,GAAqB,GAAI,MAAO,KAAK,CAAC,IAEzK,IAAM+tD,EAAgB,MAAM51C,EAAI,QAAQ,QAAQ,OAAO,CACtD,MAAO,cACP,MAAO,CAAC,CACP,MAAO,WACP,MAAOoE,CACR,CAAC,EACD,OAAQ,CACP,GAAGs0C,EACH,UAA2B,IAAI,KAAK,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EAAI,GAAG,CACvE,CACD,CAAC,EACD,GAAI,CAAC9C,EAAe,MAAM,IAAI51E,EAAS,wBAAyB,CAC/D,kBAAmB,0BACnB,MAAO,gBACR,CAAC,EACD,IAAMsI,EAAM6tE,GAAcP,CAAa,EAMvC,MALA,GAAI,cAAgB,IAAK,GACrB3kC,GAAU,MAAc,CAC3B,GAAG3oC,EACH,0BAA2B,CAAC,GAAGstE,EAAc,yBAA2B,CAAC,CAAC,CAC3E,EACOttE,CACR,CACA,eAAeqwE,GAA2B,EAAK,EAAM,CACpD,IAAMt1B,EAAU,MAAMiK,EAAkBttB,CAAG,EAE3C,GADA,MAAMqvC,GAAuBrvC,EAAKqjB,EAASt4B,EAAM,SAAUiV,EAAI,KAAK,SAAS,EACzE,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,IAAMokC,EAAWpE,EAAI,KAAK,UAC1B,GAAIjV,EAAK,sBAAsB,IAAIqZ,CAAQ,EAAG,MAAM,IAAIpkC,EAAS,wBAAyB,CACzF,kBAAmB,2CACnB,MAAO,gBACR,CAAC,EACD,IAAMu1C,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMqZ,CAAQ,EAClD,GAAI,CAACmR,EAAQ,MAAM,IAAIv1C,EAAS,YAAa,CAC5C,kBAAmB,mBACnB,MAAO,WACR,CAAC,EACD,GAAIu1C,EAAO,OACN,IAAAA,EAAO,SAAW8N,EAAQ,KAAK,GAAI,MAAM,IAAIrjD,EAAS,cAAc,CAAA,MAClE,GAAIu1C,EAAO,aAAexqB,EAAK,gBACjC,IAAAwqB,EAAO,cAAgB,MAAMxqB,EAAK,gBAAgBs4B,CAAO,EAAG,MAAM,IAAIrjD,EAAS,cAAc,CAAA,MAC3F,MAAM,IAAIA,EAAS,cAAc,EACxC,GAAIu1C,EAAO,0BAA4B,QAAU,CAACA,EAAO,aAAc,MAAM,IAAIv1C,EAAS,cAAe,CACxG,kBAAmB,mFACnB,MAAO,gBACR,CAAC,EACD,IAAM2kC,EAAe5Z,EAAK,uBAAuB,GAAKlD,GAAqB,GAAI,MAAO,KAAK,EACrFksB,EAAqBpP,EAAe,MAAMwP,GAAkBnU,EAAKjV,EAAM4Z,CAAY,EAAI,IAAK,GAC5FixC,EAAgB,MAAM51C,EAAI,QAAQ,QAAQ,OAAO,CACtD,MAAO,cACP,MAAO,CAAC,CACP,MAAO,WACP,MAAOoE,CACR,CAAC,EACD,OAAQ,CACP,aAAc2P,EACd,UAA2B,IAAI,KAAK,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EAAI,GAAG,CACvE,CACD,CAAC,EACD,GAAI,CAAC6hC,EAAe,MAAM,IAAI51E,EAAS,wBAAyB,CAC/D,kBAAmB,0BACnB,MAAO,gBACR,CAAC,EACD,OAAOm2E,GAAc,CACpB,GAAGP,EACH,cAAe7qD,EAAK,QAAQ,cAAgB,IAAM4Z,CACnD,CAAC,CACF,CAGA,IAAMi0C,GAAgCz4E,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EACvD04E,GAAmBz4E,EAAQD,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAC1D24E,GAA0B,GAASr/B,EAAmB,8BAA+B,CAC1F,OAAQ,OACR,KAAMp5C,EAAS,CACd,cAAeD,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACtD,MAAO3yD,EAAS,CAAC,CAAC,SAAS,EAC3B,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,SAAUA,EAAS,CAAC,CAAC,SAAS,EAC9B,SAAUC,EAAQD,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACrD,QAASA,EAAS,CAAC,CAAC,SAAS,EAC7B,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,mBAAoBA,EAAS,CAAC,CAAC,SAAS,EACxC,0BAA2BC,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAClE,uBAAwBA,EAAc,SAAS,EAC/C,oCAAqCxyD,EAAU,CAAC,CAAC,SAAS,EAC1D,2BAA4Bs4E,GAA8B,SAAS,EACnE,iBAAkBr4E,EAAO,CAAC,MAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,EACrD,KAAMm3D,GAAiB,SAAS,EAChC,SAAUv3D,EAAS,CAAC,CAAC,SAAS,EAC9B,YAAa04E,GAAiB,SAAS,EACvC,0BAA2Bz4E,EAAQD,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EACtE,UAAWC,EAAQi3D,EAAiB,CAAC,CAAC,SAAS,EAC/C,eAAgBj3D,EAAQG,EAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EACnD,yBAA0BC,EAAQ,CAACL,EAAS,EAAGM,EAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAChF,aAAcH,EAAU,CAAC,CAAC,SAAS,EACnC,mBAAoBA,EAAU,CAAC,CAAC,SAAS,EACzC,aAAcA,EAAU,CAAC,CAAC,SAAS,EACnC,yBAA0BA,EAAU,CAAC,CAAC,SAAS,EAC/C,aAAcC,EAAO,CAAC,SAAU,UAAU,CAAC,CAAC,CAAC,SAAS,EACtD,SAAUG,EAASP,EAAS,EAAGQ,EAAU,CAAC,CAAC,CAAC,SAAS,CACtD,CAAC,EACD,SAAU,CACT,QAAS,GACT,YAAa,GACb,QAAS,CACR,YAAa,iCACb,UAAW,CAAE,IAAO,CACnB,YAAa,6CACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CAExC,KAAM,SACN,WAAY,CACX,UAAW,CACV,KAAM,SACN,YAAa,kCACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,2BACd,EACA,yBAA0B,CACzB,KAAM,SACN,YAAa,gFACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,8CACd,EACA,0BAA2B,CAC1B,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,+DACd,EACA,QAAS,CACR,KAAM,SACN,YAAa,0EACd,EACA,oBAAqB,CACpB,KAAM,SACN,YAAa,mCACd,EACA,YAAa,CACZ,KAAM,SACN,YAAa,gCACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,+BACd,EACA,SAAU,CACT,KAAM,SACN,YAAa,8BACd,EACA,SAAU,CACT,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,iGACd,EACA,QAAS,CACR,KAAM,SACN,YAAa,+BACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,qBACd,EACA,YAAa,CACZ,KAAM,SACN,YAAa,yFACd,EACA,iBAAkB,CACjB,KAAM,SACN,YAAa,wCACd,EACA,mBAAoB,CACnB,KAAM,SACN,YAAa,oEACd,EACA,cAAe,CACd,KAAM,QACN,MAAO,CACN,KAAM,SACN,OAAQ,KACT,EACA,YAAa,+BACd,EACA,2BAA4B,CAC3B,KAAM,SACN,YAAa,wDACd,EACA,YAAa,CACZ,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,sDACd,EACA,eAAgB,CACf,KAAM,QACN,MAAO,CACN,KAAM,SACN,KAAM,CAAC,MAAM,CACd,EACA,YAAa,iEACd,EACA,iBAAkB,CACjB,KAAM,SACN,YAAa,6DACb,KAAM,CAAC,MAAO,QAAQ,CACvB,EACA,UAAW,CACV,KAAM,QACN,MAAO,CACN,KAAM,SACN,OAAQ,KACT,EACA,YAAa,mDACd,EACA,SAAU,CACT,KAAM,UACN,YAAa,gCACd,EACA,aAAc,CACb,KAAM,UACN,YAAa,mCACb,QAAS,EACV,EACA,SAAU,CACT,KAAM,SACN,qBAAsB,GACtB,SAAU,GACV,YAAa,yCACd,CACD,EACA,SAAU,CAAC,WAAW,CACvB,CAAE,CAAE,CACL,CAAE,CACH,CACD,CACD,EAAG,KAAO,IACF21E,GAA0Bt2C,EAAKjV,EAAM,CAAE,MAAO,EAAK,CAAC,CAC3D,EACKguD,GAAqB,GAASt/B,EAAmB,wBAAyB,CAC/E,OAAQ,OACR,IAAK,CAACgU,EAAiB,EACvB,KAAMptD,EAAS,CACd,cAAeD,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACtD,MAAO3yD,EAAS,CAAC,CAAC,SAAS,EAC3B,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,SAAUA,EAAS,CAAC,CAAC,SAAS,EAC9B,SAAUC,EAAQD,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACrD,QAASA,EAAS,CAAC,CAAC,SAAS,EAC7B,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,mBAAoBA,EAAS,CAAC,CAAC,SAAS,EACxC,0BAA2BC,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAClE,uBAAwBA,EAAc,SAAS,EAC/C,oCAAqCxyD,EAAU,CAAC,CAAC,SAAS,EAC1D,2BAA4Bs4E,GAA8B,SAAS,EACnE,iBAAkBr4E,EAAO,CAAC,MAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,EACrD,KAAMm3D,GAAiB,SAAS,EAChC,SAAUv3D,EAAS,CAAC,CAAC,SAAS,EAC9B,YAAa04E,GAAiB,SAAS,EACvC,eAAgBz4E,EAAQG,EAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EACnD,yBAA0BD,EAAU,CAAC,CAAC,SAAS,CAChD,CAAC,EACD,SAAU,CACT,QAAS,GACT,QAAS,CACR,YAAa,iCACb,UAAW,CAAE,IAAO,CACnB,YAAa,6CACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CAExC,KAAM,SACN,WAAY,CACX,UAAW,CACV,KAAM,SACN,YAAa,kCACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,2BACd,EACA,yBAA0B,CACzB,KAAM,SACN,YAAa,gFACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,8CACd,EACA,QAAS,CACR,KAAM,SACN,YAAa,0EACd,EACA,oBAAqB,CACpB,KAAM,SACN,YAAa,mCACd,EACA,YAAa,CACZ,KAAM,SACN,YAAa,gCACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,+BACd,EACA,SAAU,CACT,KAAM,SACN,YAAa,8BACd,EACA,SAAU,CACT,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,iGACd,EACA,QAAS,CACR,KAAM,SACN,YAAa,+BACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,qBACd,EACA,YAAa,CACZ,KAAM,SACN,YAAa,yFACd,EACA,iBAAkB,CACjB,KAAM,SACN,YAAa,wCACd,EACA,mBAAoB,CACnB,KAAM,SACN,YAAa,oEACd,EACA,cAAe,CACd,KAAM,QACN,MAAO,CACN,KAAM,SACN,OAAQ,KACT,EACA,YAAa,+BACd,EACA,2BAA4B,CAC3B,KAAM,SACN,YAAa,wDACd,EACA,YAAa,CACZ,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,sDACd,EACA,eAAgB,CACf,KAAM,QACN,MAAO,CACN,KAAM,SACN,KAAM,CAAC,MAAM,CACd,EACA,YAAa,iEACd,EACA,iBAAkB,CACjB,KAAM,SACN,YAAa,6DACb,KAAM,CAAC,MAAO,QAAQ,CACvB,EACA,UAAW,CACV,KAAM,QACN,MAAO,CACN,KAAM,SACN,OAAQ,KACT,EACA,YAAa,mDACd,EACA,SAAU,CACT,KAAM,UACN,YAAa,gCACd,EACA,SAAU,CACT,KAAM,SACN,qBAAsB,GACtB,SAAU,GACV,YAAa,yCACd,CACD,EACA,SAAU,CAAC,WAAW,CACvB,CAAE,CAAE,CACL,CAAE,CACH,CACD,CACD,EAAG,KAAO,IACFg2E,GAA0Bt2C,EAAKjV,CAAI,CAC1C,EACKiuD,GAAkB,GAASv/B,EAAmB,qBAAsB,CACzE,OAAQ,MACR,IAAK,CAACgU,EAAiB,EACvB,MAAOptD,EAAS,CAAE,UAAWF,EAAS,CAAE,CAAC,EACzC,SAAU,CAAE,QAAS,CAAE,YAAa,qCAAsC,CAAE,CAC7E,EAAG,KAAO,IACF63E,GAAkBh4C,EAAKjV,CAAI,CAClC,EACKkuD,GAAwB,GAASx/B,EAAmB,wBAAyB,CAClF,OAAQ,MACR,IAAK,CAACgU,EAAiB,EACvB,MAAOptD,EAAS,CAAE,UAAWF,EAAS,CAAE,CAAC,EACzC,SAAU,CAAE,QAAS,CAAE,YAAa,uCAAwC,CAAE,CAC/E,EAAG,KAAO,IAAQ,CACjB,IAAMikC,EAAWpE,EAAI,MAAM,UAC3B,OAAOi4C,GAAwBj4C,EAAKjV,EAAMqZ,CAAQ,CACnD,CAAC,EACK80C,GAAgC,GAASz/B,EAAmB,iCAAkC,CACnG,OAAQ,OACR,IAAK,CAAC40B,GAAwBtjD,CAAI,CAAC,EACnC,KAAM1qB,EAAS,CACd,UAAWF,EAAS,EACpB,YAAaA,EAAS,CAAC,CAAC,SAAS,CAClC,CAAC,EACD,SAAU,CAAE,QAAS,CAAE,YAAa,wDAAyD,CAAE,CAChG,EAAG,KAAO,IAAQ,CACjB,IAAMikC,EAAWpE,EAAI,KAAK,UAC1B,OAAOi4C,GAAwBj4C,EAAKjV,EAAMqZ,CAAQ,CACnD,CAAC,EACK+0C,GAAmB,GAAS1/B,EAAmB,sBAAuB,CAC3E,OAAQ,MACR,IAAK,CAACgU,EAAiB,EACvB,SAAU,CAAE,QAAS,CAAE,YAAa,gEAAiE,CAAE,CACxG,EAAG,KAAO,IACFyqB,GAAmBl4C,EAAKjV,CAAI,CACnC,EACKquD,GAA0B,GAAS3/B,EAAmB,8BAA+B,CAC1F,OAAQ,QACR,KAAMp5C,EAAS,CACd,UAAWF,EAAS,EACpB,OAAQE,EAAS,CAChB,cAAeD,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACtD,MAAO3yD,EAAS,CAAC,CAAC,SAAS,EAC3B,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,SAAUA,EAAS,CAAC,CAAC,SAAS,EAC9B,SAAUC,EAAQD,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACrD,QAASA,EAAS,CAAC,CAAC,SAAS,EAC7B,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,mBAAoBA,EAAS,CAAC,CAAC,SAAS,EACxC,0BAA2BC,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAClE,uBAAwBA,EAAc,SAAS,EAC/C,oCAAqCxyD,EAAU,CAAC,CAAC,SAAS,EAC1D,iBAAkBC,EAAO,CAAC,MAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,EACrD,YAAas4E,GAAiB,SAAS,EACvC,0BAA2Bz4E,EAAQD,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EACtE,eAAgBC,EAAQG,EAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EACnD,yBAA0BC,EAAQ,CAACL,EAAS,EAAGM,EAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EACrE,aAAcH,EAAU,CAAC,CAAC,SAAS,EACnC,mBAAoBA,EAAU,CAAC,CAAC,SAAS,EACzC,SAAUA,EAAU,CAAC,CAAC,SAAS,EAC/B,yBAA0BA,EAAU,CAAC,CAAC,SAAS,EAC/C,SAAUI,EAASP,EAAS,EAAGQ,EAAU,CAAC,CAAC,CAAC,SAAS,CACtD,CAAC,CACF,CAAC,EACD,SAAU,CACT,YAAa,GACb,QAAS,CAAE,YAAa,0CAA2C,CACpE,CACD,EAAG,KAAO,IACFy3E,GAAqBp4C,EAAKjV,EAAM,CAAE,MAAO,EAAK,CAAC,CACtD,EACKsuD,GAAqB,GAAS5/B,EAAmB,wBAAyB,CAC/E,OAAQ,OACR,IAAK,CAACgU,EAAiB,EACvB,KAAMptD,EAAS,CACd,UAAWF,EAAS,EACpB,OAAQE,EAAS,CAChB,cAAeD,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACtD,MAAO3yD,EAAS,CAAC,CAAC,SAAS,EAC3B,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,SAAUA,EAAS,CAAC,CAAC,SAAS,EAC9B,SAAUC,EAAQD,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACrD,QAASA,EAAS,CAAC,CAAC,SAAS,EAC7B,WAAYA,EAAS,CAAC,CAAC,SAAS,EAChC,YAAaA,EAAS,CAAC,CAAC,SAAS,EACjC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,mBAAoBA,EAAS,CAAC,CAAC,SAAS,EACxC,0BAA2BC,EAAQ0yD,CAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAClE,uBAAwBA,EAAc,SAAS,EAC/C,oCAAqCxyD,EAAU,CAAC,CAAC,SAAS,EAC1D,iBAAkBC,EAAO,CAAC,MAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,EACrD,YAAas4E,GAAiB,SAAS,EACvC,eAAgBz4E,EAAQG,EAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACpD,CAAC,CACF,CAAC,EACD,SAAU,CAAE,QAAS,CAAE,YAAa,0CAA2C,CAAE,CAClF,EAAG,KAAO,IACF63E,GAAqBp4C,EAAKjV,CAAI,CACrC,EACKuuD,GAAsB,GAAS7/B,EAAmB,+BAAgC,CACvF,OAAQ,OACR,IAAK,CAACgU,EAAiB,EACvB,KAAMptD,EAAS,CAAE,UAAWF,EAAS,CAAE,CAAC,EACxC,SAAU,CACT,QAAS,GACT,QAAS,CAAE,YAAa,wCAAyC,CAClE,CACD,EAAG,KAAO,IACFw4E,GAA2B34C,EAAKjV,CAAI,CAC3C,EACKwuD,GAAqB,GAAS9/B,EAAmB,wBAAyB,CAC/E,OAAQ,OACR,IAAK,CAACgU,EAAiB,EACvB,KAAMptD,EAAS,CAAE,UAAWF,EAAS,CAAE,CAAC,EACxC,SAAU,CAAE,QAAS,CAAE,YAAa,yBAA0B,CAAE,CACjE,EAAG,KAAO,IACFg4E,GAAqBn4C,EAAKjV,CAAI,CACrC,EAGD,eAAeyuD,GAAW,EAAK,EAAM,EAAI,CACxC,OAAO,MAAMx5C,EAAI,QAAQ,QAAQ,QAAQ,CACxC,MAAO,eACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOlF,CACR,CAAC,CACF,CAAC,CACF,CACA,eAAe2+C,GAAmB,EAAK,EAAM,CAC5C,IAAMp2B,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,GAAI,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,GAAM,CAAE,MAAOggC,EAAI,MACnB,GAAI,CAAClF,EAAI,MAAM,IAAI96B,EAAS,YAAa,CACxC,kBAAmB,uBACnB,MAAO,WACR,CAAC,EACD,IAAMuoE,EAAU,MAAMiR,GAAWx5C,EAAKjV,EAAM+P,CAAE,EAC9C,GAAI,CAACytC,EAAS,MAAM,IAAIvoE,EAAS,YAAa,CAC7C,kBAAmB,aACnB,MAAO,WACR,CAAC,EACD,GAAIuoE,EAAQ,SAAWllB,EAAQ,KAAK,GAAI,MAAM,IAAIrjD,EAAS,cAAc,EACzE,OAAOuoE,CACR,CACA,eAAemR,GAAoB,EAAK,EAAM,CAC7C,IAAMr2B,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,GAAI,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,OAAO,MAAMggC,EAAI,QAAQ,QAAQ,SAAS,CACzC,MAAO,eACP,MAAO,CAAC,CACP,MAAO,SACP,MAAOqjB,EAAQ,KAAK,EACrB,CAAC,CACF,CAAC,CACF,CACA,eAAes2B,GAAsB,EAAK,EAAM,CAC/C,IAAMt2B,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,GAAI,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,GAAM,CAAE,MAAOggC,EAAI,KACnB,GAAI,CAAClF,EAAI,MAAM,IAAI96B,EAAS,YAAa,CACxC,kBAAmB,uBACnB,MAAO,WACR,CAAC,EACD,IAAMuoE,EAAU,MAAMiR,GAAWx5C,EAAKjV,EAAM+P,CAAE,EAC9C,GAAI,CAACytC,EAAS,MAAM,IAAIvoE,EAAS,YAAa,CAC7C,kBAAmB,aACnB,MAAO,WACR,CAAC,EACD,GAAIuoE,EAAQ,SAAWllB,EAAQ,KAAK,GAAI,MAAM,IAAIrjD,EAAS,cAAc,EACzE,MAAMggC,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAO,eACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOlF,CACR,CAAC,CACF,CAAC,CACF,CACA,eAAe8+C,GAAsB,EAAK,EAAM,CAC/C,IAAMv2B,EAAU,MAAMiK,EAAkBttB,CAAG,EAC3C,GAAI,CAACqjB,EAAS,MAAM,IAAIrjD,EAAS,cAAc,EAC/C,GAAM,CAAE,MAAOggC,EAAI,KACnB,GAAI,CAAClF,EAAI,MAAM,IAAI96B,EAAS,YAAa,CACxC,kBAAmB,uBACnB,MAAO,WACR,CAAC,EACD,IAAMuoE,EAAU,MAAMiR,GAAWx5C,EAAKjV,EAAM+P,CAAE,EAC9C,GAAI,CAACytC,EAAS,MAAM,IAAIvoE,EAAS,YAAa,CAC7C,kBAAmB,aACnB,MAAO,WACR,CAAC,EACD,GAAIuoE,EAAQ,SAAWllB,EAAQ,KAAK,GAAI,MAAM,IAAIrjD,EAAS,cAAc,EACzE,IAAMu1C,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMw9C,EAAQ,QAAQ,EAC1D,GAAI,CAAChzB,EAAQ,MAAM,IAAIv1C,EAAS,YAAa,CAC5C,kBAAmB,mBACnB,MAAO,WACR,CAAC,EACD,IAAM20E,EAAgBp/B,GAAQ,QAAUxqB,EAAK,QAAU,CAAC,EAClDstD,EAAUr4C,EAAI,KAAK,OACnByV,EAAS4iC,EAAQ,OACvB,GAAI5iC,GAAU,CAACA,EAAO,MAAO,GAAQk/B,GAAe,SAASh8C,CAAG,CAAC,EAAG,MAAM,IAAI34B,EAAS,cAAe,CACrG,kBAAmB,+BAA+Bu1C,GAAQ,aAAeA,GAAQ,SACjF,MAAO,iBACR,CAAC,EACD,IAAMj0B,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACvC,OAAO,MAAM0e,EAAI,QAAQ,QAAQ,OAAO,CACvC,MAAO,eACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOlF,CACR,CAAC,EACD,OAAQ,CACP,GAAGu9C,EACH,UAA2B,IAAI,KAAK/2D,EAAM,GAAG,CAC9C,CACD,CAAC,CACF,CAGA,IAAMu4D,GAAmB,GAASpgC,EAAmB,sBAAuB,CAC3E,OAAQ,MACR,MAAOp5C,EAAS,CAAE,GAAIF,EAAS,CAAE,CAAC,EAClC,IAAK,CAACstD,EAAiB,EACvB,SAAU,CAAE,QAAS,CAAE,YAAa,sDAAuD,CAAE,CAC9F,EAAG,KAAO,IACFgsB,GAAmBz5C,EAAKjV,CAAI,CACnC,EACK+uD,GAAoB,GAASrgC,EAAmB,uBAAwB,CAC7E,OAAQ,MACR,IAAK,CAACgU,EAAiB,EACvB,SAAU,CAAE,QAAS,CAAE,YAAa,+CAAgD,CAAE,CACvF,EAAG,KAAO,IACFisB,GAAoB15C,EAAKjV,CAAI,CACpC,EACKgvD,GAAsB,GAAStgC,EAAmB,yBAA0B,CACjF,OAAQ,OACR,IAAK,CAACgU,EAAiB,EACvB,KAAMptD,EAAS,CACd,GAAIF,EAAS,EACb,OAAQE,EAAS,CAAE,OAAQD,EAAQD,EAAS,CAAC,CAAE,CAAC,CACjD,CAAC,EACD,SAAU,CAAE,QAAS,CAAE,YAAa,sCAAuC,CAAE,CAC9E,EAAG,KAAO,IACFy5E,GAAsB55C,EAAKjV,CAAI,CACtC,EACKivD,GAAsB,GAASvgC,EAAmB,yBAA0B,CACjF,OAAQ,OACR,IAAK,CAACgU,EAAiB,EACvB,KAAMptD,EAAS,CAAE,GAAIF,EAAS,CAAE,CAAC,EACjC,SAAU,CAAE,QAAS,CAAE,YAAa,qCAAsC,CAAE,CAC7E,EAAG,KAAO,IACFw5E,GAAsB35C,EAAKjV,CAAI,CACtC,EAGKkvD,GAAiB,GAASlvD,EAAK,QAAQ,eAAe,WAAa,gBACnEmvD,GAAa,GAASnvD,EAAK,QAAQ,qBAAqB,WAAa,sBACrEwqD,GAAe,GAASxqD,EAAK,QAAQ,aAAa,WAAa,cAkBrE,SAASovD,GAAgB,EAAO,CAC/B,GAAI,CACH,OAAO,mBAAmBp0E,CAAK,CAChC,MAAQ,CACP,OAAOA,CACR,CACD,CAQA,SAASq0E,GAAiB,EAAO,EAAK,CACrC,MAAO,CACN,WAAYttE,EAAM,WAClB,KAAMA,EAAM,MAAQA,EAAM,WAC1B,eAAgBA,EAAM,gBAAkB,KACxC,gBAAiBA,EAAM,iBAAmB,KAC1C,iBAAkBA,EAAM,kBAAoB,KAC5C,aAAcA,EAAM,cAAgB,KACpC,cAAeA,EAAM,eAAiB,KACtC,aAAcA,EAAM,cAAgB,KACpC,8BAA+BA,EAAM,+BAAiC,GACtE,SAAUA,EAAM,UAAY,GAC5B,cAAe,EACf,SAAUA,EAAM,UAAY,KAC5B,UAAWsU,EACX,UAAWA,CACZ,CACD,CACA,eAAei5D,GAAuB,EAAK,EAAM,CAChD,MAAM/K,GAAyBtvC,EAAK,MAAMstB,EAAkBttB,CAAG,EAAGjV,EAAM,QAAQ,EAChF,IAAMje,EAAQkzB,EAAI,KAClB,GAAI,CAAClzB,GAAO,WAAY,MAAM,IAAI9M,EAAS,cAAe,CACzD,MAAO,kBACP,kBAAmB,wBACpB,CAAC,EACD,MAAMu4D,GAAsBxtC,EAAMje,EAAM,UAAU,EAClD,IAAMsU,EAAsB,IAAI,KAC5Bk7C,EACJ,GAAI,CACH,EAAU,MAAMt8B,EAAI,QAAQ,QAAQ,OAAO,CAC1C,MAAOi6C,GAAclvD,CAAI,EACzB,KAAMqvD,GAAiBttE,EAAOsU,CAAG,CAClC,CAAC,CACF,OAAS7E,EAAK,CACb,IAAMhV,EAAUgV,aAAe,MAAQA,EAAI,QAAU,OAAOA,CAAG,EAK/D,KAJI,2BAA2B,KAAKhV,CAAO,EAAS,IAAIvH,EAAS,cAAe,CAC/E,MAAO,kBACP,kBAAmB,YAAY8M,EAAM,WAAW,gBACjD,CAAC,EACKyP,CACP,CACA,GAAI,CAAC+/C,EAAS,MAAM,IAAIt8D,EAAS,cAAe,CAC/C,MAAO,kBACP,kBAAmB,YAAY8M,EAAM,WAAW,sBACjD,CAAC,EAED,OADAquD,GAAwBmB,EAAQ,UAAU,EACnCt8B,EAAI,KAAKs8B,EAAS,CAAE,OAAQ,GAAI,CAAC,CACzC,CACA,eAAege,GAAsB,EAAK,EAAM,CAC/C,MAAMhL,GAAyBtvC,EAAK,MAAMstB,EAAkBttB,CAAG,EAAGjV,EAAM,MAAM,EAC9E,IAAMiwC,EAAO,MAAMh7B,EAAI,QAAQ,QAAQ,SAAS,CAAE,MAAOi6C,GAAclvD,CAAI,CAAE,CAAC,EAC9E,OAAOiV,EAAI,KAAKg7B,GAAQ,CAAC,CAAC,CAC3B,CACA,eAAeuf,GAAgC,EAAK,EAAM,CACzD,IAAMjiB,EAAa6hB,GAAgBn6C,EAAI,OAAO,UAAU,EACxD,MAAMsvC,GAAyBtvC,EAAK,MAAMstB,EAAkBttB,CAAG,EAAGjV,EAAM,OAAQutC,CAAU,EAC1F,IAAMmB,EAAM,MAAMz5B,EAAI,QAAQ,QAAQ,QAAQ,CAC7C,MAAOi6C,GAAclvD,CAAI,EACzB,MAAO,CAAC,CACP,MAAO,aACP,MAAOutC,CACR,CAAC,CACF,CAAC,EACD,GAAI,CAACmB,EAAK,MAAM,IAAIz5D,EAAS,YAAa,CACzC,MAAO,YACP,kBAAmB,YAAYs4D,EAAW,WAC3C,CAAC,EACD,OAAOt4B,EAAI,KAAKy5B,CAAG,CACpB,CACA,eAAe+gB,GAAuB,EAAK,EAAM,CAChD,IAAMliB,EAAa6hB,GAAgBn6C,EAAI,OAAO,UAAU,EAExD,GADA,MAAMsvC,GAAyBtvC,EAAK,MAAMstB,EAAkBttB,CAAG,EAAGjV,EAAM,SAAUutC,CAAU,EACxF,CAAC,MAAMt4B,EAAI,QAAQ,QAAQ,QAAQ,CACtC,MAAOi6C,GAAclvD,CAAI,EACzB,MAAO,CAAC,CACP,MAAO,aACP,MAAOutC,CACR,CAAC,CACF,CAAC,EAAG,MAAM,IAAIt4D,EAAS,YAAa,CACnC,MAAO,YACP,kBAAmB,YAAYs4D,EAAW,WAC3C,CAAC,EACD,IAAMuD,EAAS,CAAE,UAA2B,IAAI,IAAO,EACvD,IAAK,IAAM/1D,IAAO,CACjB,OACA,iBACA,kBACA,mBACA,eACA,gBACA,eACA,gCACA,WACA,UACD,EAAO,OAAO,UAAU,eAAe,KAAKk6B,EAAI,KAAMl6B,CAAG,IAAG,EAAOA,GAAOk6B,EAAI,KAAKl6B,IACnF,MAAMk6B,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAOi6C,GAAclvD,CAAI,EACzB,MAAO,CAAC,CACP,MAAO,aACP,MAAOutC,CACR,CAAC,EACD,QACD,CAAC,EACD6C,GAAwB7C,CAAU,EAClC,IAAM2Z,EAAY,MAAMjyC,EAAI,QAAQ,QAAQ,QAAQ,CACnD,MAAOi6C,GAAclvD,CAAI,EACzB,MAAO,CAAC,CACP,MAAO,aACP,MAAOutC,CACR,CAAC,CACF,CAAC,EACD,GAAI,CAAC2Z,EAAW,MAAM,IAAIjyE,EAAS,YAAa,CAC/C,MAAO,YACP,kBAAmB,YAAYs4D,EAAW,WAC3C,CAAC,EACD,OAAOt4B,EAAI,KAAKiyC,CAAS,CAC1B,CACA,eAAewI,GAAuB,EAAK,EAAM,CAChD,IAAMniB,EAAa6hB,GAAgBn6C,EAAI,OAAO,UAAU,EAExD,GADA,MAAMsvC,GAAyBtvC,EAAK,MAAMstB,EAAkBttB,CAAG,EAAGjV,EAAM,SAAUutC,CAAU,EACxF,CAAC,MAAMt4B,EAAI,QAAQ,QAAQ,QAAQ,CACtC,MAAOi6C,GAAclvD,CAAI,EACzB,MAAO,CAAC,CACP,MAAO,aACP,MAAOutC,CACR,CAAC,CACF,CAAC,EAAG,MAAM,IAAIt4D,EAAS,YAAa,CACnC,MAAO,YACP,kBAAmB,YAAYs4D,EAAW,WAC3C,CAAC,EASD,OARA,MAAMt4B,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAOi6C,GAAclvD,CAAI,EACzB,MAAO,CAAC,CACP,MAAO,aACP,MAAOutC,CACR,CAAC,CACF,CAAC,EACD6C,GAAwB7C,CAAU,EAC3Bt4B,EAAI,KAAK,CAAE,QAAS,EAAK,CAAC,CAClC,CAQA,eAAe06C,GAA2B,EAAK,EAAM,CACpD,IAAMr3B,EAAU,MAAMiK,EAAkBttB,CAAG,EACrCi2C,EAAakE,GAAgBn6C,EAAI,OAAO,UAAU,EAClDoE,EAAW+1C,GAAgBn6C,EAAI,OAAO,SAAS,EAErD,GADA,MAAMsvC,GAAyBtvC,EAAKqjB,EAASt4B,EAAM,OAAQkrD,CAAU,EACjE,CAAC,MAAMj2C,EAAI,QAAQ,QAAQ,QAAQ,CACtC,MAAOi6C,GAAclvD,CAAI,EACzB,MAAO,CAAC,CACP,MAAO,aACP,MAAOkrD,CACR,CAAC,CACF,CAAC,EAAG,MAAM,IAAIj2E,EAAS,YAAa,CACnC,MAAO,YACP,kBAAmB,YAAYi2E,EAAW,WAC3C,CAAC,EACD,GAAI,CAAC,MAAMj2C,EAAI,QAAQ,QAAQ,QAAQ,CACtC,MAAOu1C,GAAYxqD,CAAI,EACvB,MAAO,CAAC,CACP,MAAO,WACP,MAAOqZ,CACR,CAAC,CACF,CAAC,EAAG,MAAM,IAAIpkC,EAAS,YAAa,CACnC,MAAO,YACP,kBAAmB,UAAUokC,EAAS,WACvC,CAAC,EACD,GAAI,CACH,MAAMpE,EAAI,QAAQ,QAAQ,OAAO,CAChC,MAAOk6C,GAAUnvD,CAAI,EACrB,KAAM,CACL,WACA,aACA,UAA2B,IAAI,IAChC,CACD,CAAC,CACF,OAASxO,EAAK,CACb,IAAMhV,EAAUgV,aAAe,MAAQA,EAAI,QAAU,OAAOA,CAAG,EAC/D,GAAI,2BAA2B,KAAKhV,CAAO,EAAG,OAAOy4B,EAAI,KAAK,CAC7D,OAAQ,GACR,cAAe,EAChB,CAAC,EACD,MAAMzjB,CACP,CACA,OAAOyjB,EAAI,KAAK,CAAE,OAAQ,EAAK,CAAC,CACjC,CAOA,eAAe26C,GAA6B,EAAK,EAAM,CACtD,IAAMt3B,EAAU,MAAMiK,EAAkBttB,CAAG,EACrCi2C,EAAakE,GAAgBn6C,EAAI,OAAO,UAAU,EAClDoE,EAAW+1C,GAAgBn6C,EAAI,OAAO,SAAS,EAYrD,OAXA,MAAMsvC,GAAyBtvC,EAAKqjB,EAASt4B,EAAM,SAAUkrD,CAAU,EACvE,MAAMj2C,EAAI,QAAQ,QAAQ,WAAW,CACpC,MAAOk6C,GAAUnvD,CAAI,EACrB,MAAO,CAAC,CACP,MAAO,WACP,MAAOqZ,CACR,EAAG,CACF,MAAO,aACP,MAAO6xC,CACR,CAAC,CACF,CAAC,EACMj2C,EAAI,KAAK,CAAE,SAAU,EAAK,CAAC,CACnC,CAQA,IAAM46C,GAAqBv6E,EAAS,CACnC,WAAYF,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACvC,KAAMA,EAAS,CAAC,CAAC,SAAS,EAC1B,eAAgBM,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EAChE,gBAAiBA,EAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACjE,iBAAkBF,EAAO03D,EAAc,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EAC7D,aAAc93D,EAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EAC7C,cAAeC,EAAQD,EAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACvD,aAAcO,EAASP,EAAS,EAAGQ,EAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACpE,8BAA+BL,EAAU,CAAC,CAAC,SAAS,EACpD,SAAUA,EAAU,CAAC,CAAC,SAAS,EAC/B,SAAUI,EAASP,EAAS,EAAGQ,EAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CACjE,CAAC,EACKk6E,GAA4B,GAASphC,EAAmB,0BAA2B,CACxF,OAAQ,OACR,KAAMmhC,GAAmB,SAAS,CAAE,WAAY,EAAK,CAAC,EACtD,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQP,GAAuBr6C,EAAKjV,CAAI,CAAC,EAC7C+vD,GAA2B,GAASrhC,EAAmB,0BAA2B,CACvF,OAAQ,MACR,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQ6gC,GAAsBt6C,EAAKjV,CAAI,CAAC,EAC5CgwD,GAAyB,GAASthC,EAAmB,sCAAuC,CACjG,OAAQ,MACR,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQ8gC,GAAgCv6C,EAAKjV,CAAI,CAAC,EACtDiwD,GAA4B,GAASvhC,EAAmB,sCAAuC,CACpG,OAAQ,QACR,KAAMmhC,GACN,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQJ,GAAuBx6C,EAAKjV,CAAI,CAAC,EAC7CkwD,GAA4B,GAASxhC,EAAmB,sCAAuC,CACpG,OAAQ,SACR,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQghC,GAAuBz6C,EAAKjV,CAAI,CAAC,EAC7CmwD,GAA2B,GAASzhC,EAAmB,yDAA0D,CACtH,OAAQ,OACR,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQihC,GAA2B16C,EAAKjV,CAAI,CAAC,EACjDowD,GAA6B,GAAS1hC,EAAmB,yDAA0D,CACxH,OAAQ,SACR,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQkhC,GAA6B36C,EAAKjV,CAAI,CAAC,EAsBzD,eAAeqwD,GAAqB,EAAK,EAAM,EAAO,CACrD,IAAMpV,EAAYj7C,EAAK,iBAAmB,IAAK,GAAIqnB,GAAapS,EAAI,OAAO,EACrEg/B,EAAmBgH,GAAW,QACpC,GAAI,CACH,IAAMlnD,EAAW,MAAMmD,GAAUzG,EAAOoK,GAAkB,MAAM6oB,GAAQjzB,EAAO,CAC9E,UAAWwjD,GAAkB,MAAM,UAAYA,EAAiB,KAAK,UAAY,UACxE,MAAMgH,GAAW,UAAU,QAAQhmC,CAAG,EAAA,EAAI,SAEnD,aAAcgmC,CACf,CAAC,CAAC,EAAG,CAAE,OAAQhH,GAAkB,KAAK,QAAUh/B,EAAI,QAAQ,OAAQ,CAAC,EAC/Dq7C,EAAmB,GAAGr7C,EAAI,QAAQ,QAAQ,kBAChD,GAAI,CAAClhB,EAAS,QAAQ,KAAO,CAAC,MAAM85C,GAAuB54B,EAAKjV,EAAMjM,EAAS,QAAQ,IAAK,CAACu8D,CAAgB,CAAC,EAAG,OAAO,IACzH,OAASn/D,EAAO,CACf,GAAIA,aAAiB,MAAO,CAC3B,GAAIA,EAAM,OAAS,aAAeA,EAAM,OAAS,aAAc,MAAM,IAAIjc,EAAW,cAAe,CAClG,kBAAmB,wBACnB,MAAO,iBACR,CAAC,EAEI,GADIic,EAAM,OAAS,cACfA,EAAM,OAAS,aAAc,OAAO,KAC7C,MAAMA,CACP,CACA,MAAU,MAAMA,CAAK,CACtB,CACA,MAAM,IAAIjc,EAAW,cAAe,CACnC,kBAAmB,yEACnB,MAAO,wBACR,CAAC,CACF,CAIA,eAAeq7E,GAAwB,EAAK,EAAM,EAAO,EAAU,CAClE,IAAIlV,EAAa5qD,EACjB,GAAIuP,EAAK,QAAQ,kBAAmB,IAAIq7C,EAAW,WAAWr7C,EAAK,OAAO,iBAAiB,EAAG,EAAaq7C,EAAW,QAAQr7C,EAAK,OAAO,kBAAmB,EAAE,OAC1J,MAAM,IAAI9qB,EAAW,cAAe,CACxC,kBAAmB,gCACnB,MAAO,iBACR,CAAC,CAAA,CACD,IAAMgsC,EAAc,MAAMjM,EAAI,QAAQ,QAAQ,QAAQ,CACrD,MAAO,mBACP,MAAO,CAAC,CACP,MAAO,QACP,MAAO,MAAMsU,GAAevpB,EAAK,YAAaq7C,EAAY,cAAc,CACzE,CAAC,CACF,CAAC,EACD,GAAI,CAACn6B,EAAa,MAAM,IAAIhsC,EAAW,cAAe,CACrD,kBAAmB,gCACnB,MAAO,iBACR,CAAC,EACD,GAAI,CAACgsC,EAAY,UAAYA,EAAY,WAAa7H,EAAU,OAAO,KACvE6H,EAAY,GAAK,MAAMjM,EAAI,QAAQ,QAAQ,OAAO,CACjD,MAAO,mBACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOiM,EAAY,EACpB,CAAC,CACF,CAAC,EAAI,MAAMjM,EAAI,QAAQ,QAAQ,OAAO,CACrC,MAAO,mBACP,MAAO,CAAC,CACP,MAAO,QACP,MAAOiM,EAAY,KACpB,CAAC,CACF,CAAC,CACF,CAIA,eAAesvC,GAAmB,EAAK,EAAM,EAAO,EAAU,CAC7D,IAAM9Y,EAAe,MAAMziC,EAAI,QAAQ,QAAQ,QAAQ,CACtD,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,QACP,MAAO,MAAMsU,GAAevpB,EAAK,YAAavP,EAAO,eAAe,CACrE,CAAC,CACF,CAAC,EACD,GAAI,CAACinD,EAAc,MAAM,IAAIxiE,EAAW,cAAe,CACtD,kBAAmB,kBACnB,MAAO,iBACR,CAAC,EACD,GAAIwiE,EAAa,QAEhB,MADA,MAAMtC,GAAwBngC,EAAKoE,EAAUq+B,EAAa,MAAM,EAC1D,IAAIxiE,EAAW,cAAe,CACnC,kBAAmB,wBACnB,MAAO,iBACR,CAAC,EAEF,GAAI,CAACwiE,EAAa,UAAYA,EAAa,WAAar+B,EAAU,OAAO,KACzE,IAAM9iB,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACvC,GAAI,CAAC,MAAM0e,EAAI,QAAQ,QAAQ,aAAa,CAC3C,MAAO,oBACP,MAAO,CAAC,CACP,MAAO,KACP,MAAOyiC,EAAa,EACrB,EAAG,CACF,MAAO,UACP,SAAU,KACV,MAAO,IACR,CAAC,EACD,UAAW,CAAC,EACZ,IAAK,CAAE,QAAyB,IAAI,KAAKnhD,EAAM,GAAG,CAAE,CACrD,CAAC,EAEA,MADA,MAAM6+C,GAAwBngC,EAAKoE,EAAUq+B,EAAa,MAAM,EAC1D,IAAIxiE,EAAW,cAAe,CACnC,kBAAmB,wBACnB,MAAO,iBACR,CAAC,EAEF,MAAM+/B,EAAI,QAAQ,QAAQ,WAAW,CACpC,MAAO,mBACP,MAAO,CAAC,CACP,MAAO,YACP,MAAOyiC,EAAa,EACrB,CAAC,CACF,CAAC,CACF,CAKA,eAAe+Y,GAAkB,EAAK,EAAM,EAAU,EAAO,CAC5D,GAAI,CACH,OAAO,MAAMJ,GAAqBp7C,EAAKjV,EAAMvP,CAAK,CACnD,OAASe,EAAK,CACb,GAAIA,aAAetc,EACd,IAAAsc,EAAI,MAAM,QAAU,yBAA0B,MAAMA,CAAA,MAClD,GAAIA,aAAe,MAAO,MAAMA,OAClC,MAAU,MAAMA,CAAG,CACzB,CACA,GAAI,CACH,OAAO,MAAM++D,GAAwBt7C,EAAKjV,EAAMvP,EAAO4oB,CAAQ,CAChE,OAAS7nB,EAAK,CACb,GAAI,eAAetc,GACd,MADsCsc,aAAe,MAAaA,EACxD,MAAM,uCAAuC,CAC7D,CACA,MAAM,IAAItc,EAAW,cAAe,CACnC,kBAAmB,uBACnB,MAAO,iBACR,CAAC,CACF,CACA,eAAew7E,GAAe,EAAK,EAAM,CACxC,GAAI,CAAE,QAAO,mBAAoBz7C,EAAI,KACjC4mC,IAAoB,gBAAkBA,IAAoB,kBAAiB,EAAkB,IAAK,IACtG,GAAM,CAAE,SAAU1C,EAAW,aAAcO,EAAe,cAAa,cAAeruB,GAAuB,MAAMC,GAAyBrW,EAAKjV,EAAM,GAAGiV,EAAI,QAAQ,QAAQ,eAAe,CAAC,EAC9L,GAAI,CAACkkC,EAAW,MAAM,IAAIjkE,EAAW,eAAgB,CACpD,kBAAmB,+BACnB,MAAO,gBACR,CAAC,EAED,GADI,OAAOub,GAAU,WAAU,EAAQswB,GAAoCtwB,CAAK,GAC5E,CAACA,GAAO,OAAQ,MAAM,IAAIvb,EAAW,cAAe,CACvD,kBAAmB,6CACnB,MAAO,iBACR,CAAC,EACD,IAAMs1C,EAAS,MAAMQ,GAA0B/V,EAAKjV,EAAMm5C,EAAWO,EAAe,IAAK,GAAGvuB,EAAa,IAAK,GAAGF,CAAU,EAC3H,GAAI,CACH,GAAI4wB,IAAoB,IAAK,IAAKA,IAAoB,eAAgB,GAAI,CACzE,OAAO,MAAM4U,GAAkBx7C,EAAKjV,EAAMwqB,EAAO,SAAU/5B,CAAK,CACjE,OAASU,EAAO,CACf,GAAIA,aAAiBjc,EAChB,IAAA2mE,IAAoB,gBAAkB1qD,EAAM,MAAM,QAAU,yBAA0B,MAAMA,CAAA,MAC1F,GAAIA,aAAiB,MAAO,MAAMA,OACpC,MAAU,MAAMA,CAAK,CAC3B,CACA,GAAI0qD,IAAoB,IAAK,IAAKA,IAAoB,gBAAiB,GAAI,CAC1E,OAAO,MAAM2U,GAAmBv7C,EAAKjV,GAAO,MAAMi1C,GAAmBj1C,EAAMvP,CAAK,EAAA,CAAG,MAAO+5B,EAAO,QAAQ,CAC1G,OAASr5B,EAAO,CACf,GAAIA,aAAiBjc,EAChB,IAAA2mE,IAAoB,gBAAiB,MAAM1qD,CAAA,MACzC,GAAIA,aAAiB,MAAO,MAAMA,OACpC,MAAU,MAAMA,CAAK,CAC3B,CACA,MAAM,IAAIjc,EAAW,cAAe,CACnC,kBAAmB,kBACnB,MAAO,iBACR,CAAC,CACF,OAASic,EAAO,CACf,GAAIA,aAAiBjc,EAAY,CAChC,GAAIic,EAAM,MAAM,QAAU,yBAA0B,MAAMA,EAC1D,GAAIA,EAAM,OAAS,cAAe,OAAO,KACzC,MAAMA,CACP,CAKC,MALUA,aAAiB,OAC3B1X,GAAO,MAAM,uBAAwB0X,EAAM,QAASA,EAAM,KAAK,EACzD,IAAIjc,EAAW,uBAAuB,IAE5CuE,GAAO,MAAM,uBAAwB0X,CAAK,EACpC,IAAIjc,EAAW,uBAAuB,EAE9C,CACD,CAGA,IAAMuiC,GAAS,CACd,YAAa,CACZ,UAAW,cACX,OAAQ,CACP,SAAU,CACT,KAAM,SACN,OAAQ,GACR,SAAU,EACX,EACA,aAAc,CACb,KAAM,SACN,SAAU,EACX,EACA,kBAAmB,CAClB,KAAM,SACN,SAAU,EACX,EACA,SAAU,CACT,KAAM,UACN,aAAc,GACd,SAAU,EACX,EACA,YAAa,CACZ,KAAM,UACN,SAAU,EACX,EACA,iBAAkB,CACjB,KAAM,UACN,SAAU,EACX,EACA,YAAa,CACZ,KAAM,SACN,SAAU,EACX,EACA,OAAQ,CACP,KAAM,WACN,SAAU,EACX,EACA,wBAAyB,CACxB,KAAM,WACN,SAAU,GACV,aAAc,CAAC,CAChB,EACA,OAAQ,CACP,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,OACP,MAAO,IACR,EACA,MAAO,EACR,EACA,UAAW,CACV,KAAM,OACN,SAAU,EACX,EACA,UAAW,CACV,KAAM,OACN,SAAU,EACX,EACA,KAAM,CACL,KAAM,SACN,SAAU,EACX,EACA,IAAK,CACJ,KAAM,SACN,SAAU,EACX,EACA,KAAM,CACL,KAAM,SACN,SAAU,EACX,EACA,SAAU,CACT,KAAM,WACN,SAAU,EACX,EACA,IAAK,CACJ,KAAM,SACN,SAAU,EACX,EACA,OAAQ,CACP,KAAM,SACN,SAAU,EACX,EACA,WAAY,CACX,KAAM,SACN,SAAU,EACX,EACA,gBAAiB,CAChB,KAAM,SACN,SAAU,EACX,EACA,kBAAmB,CAClB,KAAM,SACN,SAAU,EACX,EACA,aAAc,CACb,KAAM,WACN,SAAU,EACX,EACA,uBAAwB,CACvB,KAAM,WACN,SAAU,EACX,EACA,qBAAsB,CACrB,KAAM,SACN,SAAU,EACX,EACA,iCAAkC,CACjC,KAAM,UACN,SAAU,EACX,EACA,wBAAyB,CACxB,KAAM,SACN,SAAU,EACX,EACA,gBAAiB,CAChB,KAAM,SACN,SAAU,EACX,EACA,KAAM,CACL,KAAM,SACN,SAAU,EACX,EACA,QAAS,CACR,KAAM,SACN,SAAU,EACX,EACA,WAAY,CACX,KAAM,WACN,SAAU,EACX,EACA,cAAe,CACd,KAAM,WACN,SAAU,EACX,EACA,YAAa,CACZ,KAAM,UACN,SAAU,EACX,EACA,sBAAuB,CACtB,KAAM,UACN,SAAU,GACV,aAAc,EACf,EACA,YAAa,CACZ,KAAM,SACN,SAAU,EACX,EACA,SAAU,CACT,KAAM,OACN,SAAU,EACX,CACD,CACD,EAYA,cAAe,CACd,UAAW,gBACX,OAAQ,CACP,WAAY,CACX,KAAM,SACN,SAAU,GACV,OAAQ,EACT,EACA,KAAM,CACL,KAAM,SACN,SAAU,EACX,EACA,eAAgB,CACf,KAAM,SACN,SAAU,EACX,EACA,gBAAiB,CAChB,KAAM,SACN,SAAU,EACX,EACA,iBAAkB,CACjB,KAAM,SACN,SAAU,EACX,EACA,aAAc,CACb,KAAM,SACN,SAAU,EACX,EACA,cAAe,CACd,KAAM,WACN,SAAU,EACX,EACA,aAAc,CACb,KAAM,OACN,SAAU,EACX,EACA,8BAA+B,CAC9B,KAAM,UACN,SAAU,GACV,aAAc,EACf,EACA,SAAU,CACT,KAAM,UACN,SAAU,GACV,aAAc,EACf,EACA,UAAW,CACV,KAAM,OACN,SAAU,EACX,EACA,UAAW,CACV,KAAM,OACN,SAAU,EACX,EACA,cAAe,CACd,KAAM,SACN,SAAU,GACV,aAAc,CACf,EACA,SAAU,CACT,KAAM,OACN,SAAU,EACX,CACD,CACD,EAeA,oBAAqB,CACpB,UAAW,sBACX,OAAQ,CACP,SAAU,CACT,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,cACP,MAAO,WACP,SAAU,SACX,EACA,MAAO,EACR,EACA,WAAY,CACX,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,gBACP,MAAO,aACP,SAAU,SACX,EACA,MAAO,EACR,EACA,SAAU,CACT,KAAM,OACN,SAAU,EACX,EACA,UAAW,CACV,KAAM,OACN,SAAU,EACX,CACD,EACA,QAAS,CAAC,CACT,OAAQ,CAAC,WAAY,YAAY,EACjC,OAAQ,EACT,CAAC,CACF,EAMA,kBAAmB,CAAE,OAAQ,CAC5B,MAAO,CACN,KAAM,SACN,SAAU,GACV,OAAQ,EACT,EACA,SAAU,CACT,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,cACP,MAAO,UACR,EACA,MAAO,EACR,EACA,UAAW,CACV,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,UACP,MAAO,KACP,SAAU,UACX,EACA,MAAO,EACR,EACA,OAAQ,CACP,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,OACP,MAAO,IACR,EACA,MAAO,EACR,EACA,YAAa,CACZ,KAAM,SACN,SAAU,EACX,EACA,oBAAqB,CACpB,KAAM,SACN,SAAU,GACV,MAAO,EACR,EACA,UAAW,CACV,KAAM,WACN,SAAU,EACX,EACA,wBAAyB,CACxB,KAAM,WACN,SAAU,EACX,EACA,UAAW,CAAE,KAAM,MAAO,EAC1B,UAAW,CAAE,KAAM,MAAO,EAC1B,QAAS,CACR,KAAM,OACN,SAAU,EACX,EACA,UAAW,CACV,KAAM,OACN,SAAU,EACX,EACA,uBAAwB,CACvB,KAAM,SACN,SAAU,EACX,EACA,wBAAyB,CACxB,KAAM,OACN,SAAU,EACX,EACA,SAAU,CACT,KAAM,OACN,SAAU,EACX,EACA,aAAc,CACb,KAAM,OACN,SAAU,EACX,EACA,OAAQ,CACP,KAAM,WACN,SAAU,EACX,CACD,CAAE,EAaF,iBAAkB,CACjB,UAAW,mBACX,OAAQ,CACP,MAAO,CACN,KAAM,SACN,OAAQ,EACT,EACA,SAAU,CACT,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,cACP,MAAO,UACR,EACA,MAAO,EACR,EACA,UAAW,CACV,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,UACP,MAAO,KACP,SAAU,UACX,EACA,MAAO,EACR,EACA,OAAQ,CACP,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,OACP,MAAO,IACR,EACA,MAAO,EACR,EACA,YAAa,CACZ,KAAM,SACN,SAAU,EACX,EACA,oBAAqB,CACpB,KAAM,SACN,SAAU,GACV,MAAO,EACR,EACA,UAAW,CACV,KAAM,WACN,SAAU,EACX,EACA,wBAAyB,CACxB,KAAM,WACN,SAAU,EACX,EACA,UAAW,CACV,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,oBACP,MAAO,IACR,EACA,MAAO,EACR,EACA,UAAW,CAAE,KAAM,MAAO,EAC1B,UAAW,CAAE,KAAM,MAAO,EAC1B,QAAS,CACR,KAAM,OACN,SAAU,EACX,EACA,aAAc,CACb,KAAM,OACN,SAAU,EACX,EACA,OAAQ,CACP,KAAM,WACN,SAAU,EACX,CACD,CACD,EACA,aAAc,CACb,UAAW,eACX,OAAQ,CACP,SAAU,CACT,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,cACP,MAAO,UACR,EACA,MAAO,EACR,EACA,OAAQ,CACP,KAAM,SACN,SAAU,GACV,WAAY,CACX,MAAO,OACP,MAAO,IACR,EACA,MAAO,EACR,EACA,YAAa,CACZ,KAAM,SACN,SAAU,EACX,EACA,UAAW,CACV,KAAM,WACN,SAAU,EACX,EACA,wBAAyB,CACxB,KAAM,WACN,SAAU,EACX,EACA,OAAQ,CACP,KAAM,WACN,SAAU,EACX,EACA,UAAW,CAAE,KAAM,MAAO,EAC1B,UAAW,CAAE,KAAM,MAAO,CAC3B,CACD,EAaA,qBAAsB,CACrB,UAAW,uBACX,OAAQ,CAAE,UAAW,CACpB,KAAM,OACN,SAAU,EACX,CAAE,CACH,CACD,EAQM4kC,GAAuB,CAC5B,SACA,UACA,QACA,gBACD,EACMsU,GAAiCr7E,EAAS,CAC/C,cAAeF,EAAS,CAAC,CAAC,SAAS,EACnC,UAAWA,EAAS,CAAC,CAAC,SAAS,EAC/B,yBAA0B2yD,EAAc,SAAS,EACjD,MAAO3yD,EAAS,CAAC,CAAC,SAAS,CAC5B,CAAC,EACKynE,GAAavnB,OAAyB,IAAI,EAC1CinB,GAAwBM,GAAW,IACnC+T,GAAkD,IAAI,QACtDC,GAA2B,wBACjC,SAASC,GAAoC,EAAO,CACnD,IAAMC,EAAa,OAAO/1E,GAAU,SAAWA,EAAQ,OAAOA,GAAU,SAAW,OAAOA,CAAK,EAAI,IAAK,GACxG,GAAI,GAAC+1E,GAAc,CAAC,OAAO,SAASA,CAAU,GAAKA,GAAc,GACjE,OAAO,IAAI,KAAKA,CAAU,CAC3B,CAQA,IAAM5U,GAAiB,GAAY,CAClC,IAAI6U,EAAkCvuE,EAAQ,gCAC9C,GAAIA,EAAQ,gCAAiC,CAC5C,IAAMwuE,EAAiBD,EAAkC,IAAI,IAAI,CAAC,GAAGA,EAAiC,GAAGvuE,EAAQ,+BAA+B,CAAC,EAAI,IAAI,IAAI,CAAC,GAAGA,EAAQ,+BAA+B,CAAC,EACzM,EAAkC,MAAM,KAAKwuE,CAAc,CAC5D,CACA,IAAMvmC,EAAS,IAAI,KAAKjoC,EAAQ,QAAU45D,GAAA,CAAsB,OAAQ,GAAQzuC,EAAI,MAAM,CAAC,EAC3F,GAAIojD,EACE,KAAA,IAAM9Y,KAAM8Y,EAAiC,GAAI,CAACtmC,EAAO,IAAIwtB,CAAE,EAAG,MAAM,IAAI3+D,EAAgB,kCAAkC2+D,EAAG,qBAAqB,CAAA,CAE5J,IAAK,IAAMA,KAAMz1D,EAAQ,oBAAoB,kBAAoB,CAAC,EAAG,GAAI,CAACioC,GAAQ,IAAIwtB,CAAE,EAAG,MAAM,IAAI3+D,EAAgB,uCAAuC2+D,EAAG,qBAAqB,EACpL,IAAMgZ,EAAgC,IAAI,KAAKzuE,EAAQ,WAAa,CAAC,EAAA,CAAG,IAAK,GAAa,OAAOmrD,GAAa,SAAWA,EAAWA,EAAS,UAAU,CAAC,EACxJ,IAAK,GAAM,CAACujB,EAAYC,IAAgB,CAAC,CAAC,qCAAsC3uE,EAAQ,kCAAkC,EAAG,CAAC,qCAAsCA,EAAQ,kCAAkC,CAAC,EAAG,IAAK,IAAM8qD,KAAc6jB,GAAe,CAAC,EAAG,GAAI,CAACF,EAA8B,IAAI3jB,CAAU,EAAG,MAAM,IAAIh0D,EAAgB,GAAG43E,EAAW,YAAY5jB,EAAW,wBAAwB,EACzY,IAAM7mB,EAAS,IAAI,IAAI,CACtB,MACA,MACA,MACA,MACA,MACA,MACA,QACA,MACA,GAAGilB,GAAqB,OAAQ,GAASjhB,EAAO,IAAIghB,GAAgBxxD,EAAK,CAAC,KAAK,CAAC,CACjF,CAAC,EACK8lB,EAAO,CACZ,cAAe,IACf,qBAAsB,KACtB,wBAAyB,KACzB,sBAAuB,OACvB,0BAA2B,EAC3B,uCAAwC,GACxC,+BAAgC,GAChC,iBAAkB,GAClB,kBAAmBvd,EAAQ,iBAAmB,YAAc,SAC5D,YAAa,SACb,WAAY,CACX,qBACA,qBACA,eACD,EACA,GAAGA,EACH,OAAQ,MAAM,KAAKioC,CAAM,EACzB,OAAQ,MAAM,KAAKhE,CAAM,EACzB,iCACD,EAEA,GADAnB,GAAgCvlB,EAAK,UAAU,EAC3CA,EAAK,gBAAkBA,EAAK,eAAe,OAAS,GAAI,MAAM,IAAIzmB,EAAgB,sFAAsF,EAC5K,GAAIymB,EAAK,YAAcA,EAAK,WAAW,SAAS,eAAe,GAAK,CAACA,EAAK,WAAW,SAAS,oBAAoB,EAAG,MAAM,IAAIzmB,EAAgB,uDAAuD,EACtM,GAAIymB,EAAK,mBAAqBA,EAAK,oBAAsB,UAAY,OAAOA,EAAK,mBAAsB,UAAY,SAAUA,EAAK,mBAAoB,MAAM,IAAIzmB,EAAgB,6EAA6E,EAC7P,GAAI,CAACymB,EAAK,mBAAqBA,EAAK,oBAAsB,aAAe,OAAOA,EAAK,mBAAsB,WAAa,YAAaA,EAAK,mBAAqB,YAAaA,EAAK,oBAAqB,MAAM,IAAIzmB,EAAgB,+EAA+E,EAC/S,IAAM83E,EAA8B,MAAO,EAAS,IAAQ,CAC3D,IAAMC,EAAkB,IAAI,IAAI9kD,EAAQ,GAAG,CAAC,CAAC,SACvCiP,EAAcxG,EAAI,QAAQ,UAAU,oBAAsBq8C,EAAgB,QAAQ,OAAQ,EAAE,GAAK,IAAMA,EACvGp7D,EAAS8J,EAAK,iBAAmBiV,EAAI,QAAUoS,GAAapS,CAAG,CAAC,EAAE,SAAS,KAAK,QAAUA,EAAI,QAChGs8C,EAAa,IACjB,GAAI,CACH,EAAa,IAAI,IAAIr7D,CAAM,CAAC,CAAC,SAAS,QAAQ,MAAO,EAAE,GAAK,EAC7D,MAAQ,CACP,EAAa,IAAI,IAAI+e,EAAI,OAAO,CAAC,CAAC,SAAS,QAAQ,MAAO,EAAE,GAAK,EAClE,CACA,IAAMu8C,EAAc,CAAE,QAASv8C,CAAI,EAC7Bw8C,EAA0B,IAAI,IAAI,CAAC,0CAA0CF,IAAc,GAAGA,EAAW,wCAAwC,CAAC,EAClJG,EAAmB,GAAGH,EAAW,mCACjCI,EAA8BF,EAAwB,IAAIh2C,CAAW,EACrEm2C,EAAwB5xD,EAAK,QAAQ,SAAS,QAAQ,GAAKyb,IAAgBi2C,EAC3EG,EAA0B,GAAa,CAC5C,IAAMniD,EAAWssC,GAAiBhhD,CAAQ,EAK1C,OAJIwR,EAAQ,SAAW,OAAe,IAAI,SAAS,KAAM,CACxD,OAAQkD,EAAS,OACjB,QAASA,EAAS,OACnB,CAAC,EACMA,CACR,EACA,IAAIiiD,GAA+BC,IAC9BplD,EAAQ,SAAW,OAASA,EAAQ,SAAW,OAAQ,MAAO,CAAE,SAAU,IAAI,SAAS,KAAM,CAChG,OAAQ,IACR,QAAS,CAAE,MAAO,WAAY,CAC/B,CAAC,CAAE,EAEJ,GAAImlD,EAEH,OADI3xD,EAAK,QAAQ,SAAS,QAAQ,EAAU,CAAE,SAAU6xD,EAAuB3V,GAAmBsV,EAAaxxD,CAAI,CAAC,CAAE,EAC/G,CAAE,SAAU6xD,EAAuB5V,GAAiCuV,EAAaxxD,CAAI,CAAC,CAAE,EAEhG,GAAI4xD,EAAuB,MAAO,CAAE,SAAUC,EAAuB3V,GAAmBsV,EAAaxxD,CAAI,CAAC,CAAE,CAC7G,EACM8xD,EAA0BzP,GAAoB,oBAAqB,CACxE,OAAQ,CAAC,MAAO,MAAM,EACtB,KAAM/sE,EAAS,CAAC,CAAC,CAAC,CAAC,YAAY,EAC/B,gBAAiBy8E,GAAyB/xD,CAAI,EAC9C,SAAU,CACT,kBAAmB,CAAC,mCAAmC,EACvD,QAAS,CACR,YAAa,yGACb,WAAY,CACX,CACC,KAAM,gBACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,wCACd,EACA,CACC,KAAM,YACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,qBACd,EACA,CACC,KAAM,eACN,GAAI,QACJ,SAAU,GACV,OAAQ,CACP,KAAM,SACN,OAAQ,KACT,EACA,YAAa,wBACd,EACA,CACC,KAAM,QACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,oCACd,EACA,CACC,KAAM,QACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,2BACd,EACA,CACC,KAAM,cACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,gEACd,EACA,CACC,KAAM,iBACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,qBACd,EACA,CACC,KAAM,wBACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,4BACd,EACA,CACC,KAAM,QACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,sBACd,EACA,CACC,KAAM,UACN,GAAI,QACJ,SAAU,GACV,OAAQ,CACP,KAAM,UACN,QAAS,CACV,EACA,YAAa,+EACd,EACA,CACC,KAAM,WACN,GAAI,QACJ,SAAU,GACV,OAAQ,CACP,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,CACzB,EACA,YAAa,oKACd,EACA,CACC,KAAM,SACN,GAAI,QACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,yBACd,CACD,EACA,UAAW,CACV,IAAO,CACN,YAAa,wCACb,QAAS,CAAE,SAAU,CACpB,YAAa,kCACb,OAAQ,CACP,KAAM,SACN,OAAQ,KACT,CACD,CAAE,CACH,EACA,IAAO,CACN,YAAa,kBACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,MAAO,CAAE,KAAM,QAAS,EACxB,kBAAmB,CAAE,KAAM,QAAS,EACpC,MAAO,CAAE,KAAM,QAAS,CACzB,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,CACD,CACD,CACD,CACD,EAAG,KAAO,IACFgyD,GAAkB/8C,EAAKjV,EAAMiV,EAAI,mBAAqB,CAAE,YAAa,EAAK,CAAC,CAClF,EACKg9C,GAAsB,EAAK,IAAa/qB,GAAqB4qB,EAAyB,CAC3F,GAAG78C,EACH,WAAY,GACZ,cAAe,GACf,aAAc,GACd,kBAAmBiR,GAAY,CAAC,CACjC,CAAC,EACD,MAAO,CACN,GAAI,iBACJ,QAAS41B,GACT,QAAS97C,EACT,UAAWqxD,EACX,KAAM,KAAO,IAAQ,CACpB,GAAIp8C,EAAI,QAAQ,kBAAoBA,EAAI,QAAQ,SAAS,yBAA2B,GAAM,MAAM,IAAI17B,EAAgB,4FAA4F,EAGhN,GAFA,MAAM82D,GAAkBp7B,EAAKjV,CAAI,CAAC,CAAC,MAAO,GAAUgxC,GAAsB/7B,EAAK9jB,CAAK,CAAC,EACrFwgD,GAAuC3xC,CAAI,EACvC,CAACA,EAAK,iBAAkB,CAC3B,IAAMi0C,EAAmB5sB,GAAapS,CAAG,CAAC,EAAE,QACtC/e,EAAS+9C,GAAkB,KAAK,QAAUh/B,EAAI,QAC9Ci9C,EAAuBje,GAAkB,KAAK,QAAU,MAAQ,OAAOh/B,EAAI,QAAQ,SAAY,UAAYA,EAAI,QAAQ,UAAY,MAAQ,iBAAkBA,EAAI,QAAQ,QAC/K,GAAI,CACH,IAAI,IAAI/e,CAAM,CACf,OAAS/E,EAAO,CACf,GAAI,CAAC+gE,GAAwBh8D,IAAW,GAAI,MAAM/E,CACnD,CACD,CACA,MAAO,CAAE,QAAS,CAAE,cAAe,CAAE,QAAS,CAAE,OAAQ,CACvD,MAAM,OAAO,EAAS,EAAS,CAC9B,GAAI,CAACghE,EAAS,OACd,IAAMxT,EAAO,MAAMV,GAA6BkU,EAASnyD,EAAM,CAC9D,UAAWs4B,EAAQ,GACnB,OAAQA,EAAQ,MACjB,CAAC,EACD,GAAI,CAACqmB,EAAM,OACX,IAAMyT,EAAwBxB,GAAgC,IAAIuB,CAAO,GAAqB,IAAI,IAClGC,EAAsB,IAAI95B,EAAQ,GAAIqmB,CAAI,EAC1CiS,GAAgC,IAAIuB,EAASC,CAAqB,CACnE,EACA,MAAM,MAAM,EAAS,EAAS,CAC7B,GAAI,CAACD,EAAS,OACd,IAAMC,EAAwBxB,GAAgC,IAAIuB,CAAO,EACzE,GAAI,CAACC,EAAuB,OAC5B,IAAMzT,EAAOyT,EAAsB,IAAI95B,EAAQ,EAAE,EAGjD,GAFA85B,EAAsB,OAAO95B,EAAQ,EAAE,EACnC85B,EAAsB,OAAS,GAAGxB,GAAgC,OAAOuB,CAAO,EAChF,CAACxT,EAAM,OACX,IAAM0T,EAAa7T,GAA2B2T,EAASxT,CAAI,CAAC,CAAC,MAAO,GAAU,CAC7EwT,EAAQ,QAAQ,OAAO,MAAM,oDAAqDhhE,CAAK,CACxF,CAAC,EACD,MAAMghE,EAAQ,QAAQ,uBAAuBE,CAAU,CACxD,CACD,CAAE,CAAE,CAAE,CAAE,CACT,EACA,MAAO,CACN,OAAQ,CAAC,CACR,QAAQ,EAAK,CACZ,OAAOp9C,EAAI,MAAM,WAClB,EACA,QAASqZ,GAAqB,KAAO,IAAQ,CAC5C,IAAMrW,EAAQhD,EAAI,KAAK,YACvB,GAAI,CAAC,MAAM+S,GAAuB/P,EAAOhD,EAAI,QAAQ,MAAM,EAAG,MAAM,IAAIhgC,EAAS,cAAe,CAAE,MAAO,mBAAoB,CAAC,EAC9H,IAAMu3C,EAAsBpxC,GAAuB68B,CAAK,EAClD0D,EAAc,IAAI,gBAAgB1D,CAAK,EACvCq6C,EAA6B32C,EAAY,IAAI,OAAO,GAAK,IAAK,GACpEA,EAAY,OAAO,KAAK,EACxBA,EAAY,OAAO,KAAK,EACxBA,EAAY,OAAOthC,EAAwB,EAC3CshC,EAAY,OAAOrhC,EAAqB,EACxC,MAAMuiE,GAAW,IAAI,CACpB,MAAOlhC,EAAY,SAAS,EAC5B,oBAAqB6Q,GAAuB,IAAK,GACjD,4BACD,CAAC,EACGvX,EAAI,OAAS,mBAAmB,MAAMgiB,GAAsB,CAC/D,MAAOtb,EAAY,SAAS,EAC5B,GAAG6Q,EAAsB,EAAGqkC,IAA2BrkC,EAAoB,QAAQ,CAAE,EAAI,CAAC,CAC3F,CAAC,CACF,CAAC,CACF,CAAC,EACD,MAAO,CAAC,CACP,QAAQ,EAAK,CACZ,OAAO2N,GAAqBllB,EAAI,QAAQ,iBAAiB,IAAI,YAAY,GAAK,EAAE,CAAC,CAAC,IAAIA,EAAI,QAAQ,YAAY,aAAa,IAAI,CAChI,EACA,QAASqZ,GAAqB,KAAO,IAAQ,CAC5C,IAAM2Q,EAAe9E,GAAqBllB,EAAI,QAAQ,iBAAiB,IAAI,YAAY,GAAK,EAAE,CAAC,CAAC,IAAIA,EAAI,QAAQ,YAAY,aAAa,IAAI,CAAC,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC,GACjK,GAAI,CAACgqB,EAAc,OACnB,IAAM2d,EAAe,MAAMC,GAAW,IAAI,EACpC0V,GAAiB,MAAMz7B,GAAc,EAAA,EAAI,cACzCgmB,EAASF,GAAc,OAAS2V,GAAe,MACrD,GAAI,CAACzV,EAAQ,OACb,IAAM7kC,EAAQ,IAAI,gBAAgB6kC,CAAM,EAClCxkB,EAAU,MAAMrjB,EAAI,QAAQ,gBAAgB,YAAYgqB,CAAY,EAC1E,GAAI,CAAC3G,EAAS,OACd,EAAI,QAAQ,QAAUA,EACtB,IAAMk6B,EAAev9C,EAAI,SAAS,SAAS,IAAI,gBAAgB,CAAC,EAAE,YAAY,EACxEw9C,EAAex9C,EAAI,SAAS,SAAS,IAAI,QAAQ,CAAC,EAAE,YAAY,GAAK,GACrEu9C,IAAiB,YAAc,CAACA,IAAiBC,EAAa,SAAS,WAAW,GAAKA,EAAa,SAAS,uBAAuB,IAAKx9C,EAAI,SAAS,IAAI,SAAU,kBAAkB,EAC5L,IAAMuX,EAAsBowB,GAAc,qBAAuBkU,GAAoCyB,IAAgB1B,GAAyB,EAC1IpT,EAAqB/wB,GAAsBzU,EAAO,OAAO,EAG7D,OAFIsU,GAA6B+L,EAAQ,QAAQ,UAAW9L,CAAmB,IAAG,EAAqBM,GAAsB2wB,CAAkB,GAC/I,EAAI,MAAQnxB,GAAoBmxB,CAAkB,EAC3C,MAAMwU,EAAmBh9C,CAAG,CACpC,CAAC,CACF,CAAC,CACF,EACA,UAAW,CAQV,qBAAsByZ,EAAmB,0CAA2C,CACnF,OAAQ,MACR,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IACL1uB,EAAK,QAAUA,EAAK,OAAO,SAAS,QAAQ,EAAUk8C,GAAmBjnC,EAAKjV,CAAI,EAC1Ei8C,GAAiChnC,EAAKjV,CAAI,CACtD,EAQD,gBAAiB0uB,EAAmB,oCAAqC,CACxE,OAAQ,MACR,SAAU,CAAE,YAAa,EAAK,CAC/B,EAAG,KAAO,IAAQ,CACjB,GAAI1uB,EAAK,QAAU,CAACA,EAAK,OAAO,SAAS,QAAQ,EAAG,MAAM,IAAI/qB,EAAS,WAAW,EAClF,OAAOinE,GAAmBjnC,EAAKjV,CAAI,CACpC,CAAC,EACD,gBAAiB8xD,EACjB,cAAepjC,EAAmB,kBAAmB,CACpD,OAAQ,OACR,KAAMp5C,EAAS,CACd,OAAQC,EAAU,CAAC,CAAC,KAAK,CAAE,YAAa,iDAAkD,CAAC,EAC3F,MAAOH,EAAS,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAE,YAAa,4HAA6H,CAAC,EAC/K,OAAQq1D,GAA6B,SAAS,CAAC,CAAC,KAAK,CAAE,YAAa,8GAA+G,CAAC,EACpL,YAAar1D,EAAS,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAE,YAAa,wCAAyC,CAAC,CAClG,CAAC,EACD,IAAK,CAACstD,EAAiB,EACvB,SAAU,CAAE,QAAS,CACpB,YAAa,wBACb,UAAW,CAAE,IAAO,CACnB,YAAa,iCACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,aAAc,CAC3B,KAAM,SACN,OAAQ,MACR,YAAa,uEACd,CAAE,EACF,SAAU,CAAC,cAAc,CAC1B,CAAE,CAAE,CACL,CAAE,CACH,CAAE,CACH,EAAG,KAAO,IACFia,GAAgB1nC,EAAKjV,EAAMiyD,CAAkB,CACpD,EACD,eAAgBvjC,EAAmB,mBAAoB,CACtD,OAAQ,OACR,KAAMp5C,EAAS,CACd,SAAUC,EAAU,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAE,YAAa,sEAAuE,CAAC,EAC7H,QAASA,EAAU,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAE,YAAa,oCAAqC,CAAC,EAC1F,UAAWA,EAAU,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAE,YAAa,8CAA+C,CAAC,EACtG,YAAaH,EAAS,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAE,YAAa,wCAAyC,CAAC,CAClG,CAAC,EACD,IAAK,CAACstD,EAAiB,EACvB,SAAU,CAAE,QAAS,CACpB,YAAa,sCACb,UAAW,CAAE,IAAO,CACnB,YAAa,iCACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CAAE,aAAc,CAC3B,KAAM,SACN,OAAQ,MACR,YAAa,uEACd,CAAE,EACF,SAAU,CAAC,cAAc,CAC1B,CAAE,CAAE,CACL,CAAE,CACH,CAAE,CACH,EAAG,KAAO,IACFgb,GAAiBzoC,EAAKg9C,CAAkB,CAC/C,EACD,YAAa5P,GAAoB,gBAAiB,CACjD,OAAQ,OACR,aAAc,GACd,KAAM/sE,EAAS,CACd,WAAYF,EAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EACnC,UAAWA,EAAS,CAAC,CAAC,SAAS,EAC/B,cAAeA,EAAS,CAAC,CAAC,SAAS,EACnC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,sBAAuBA,EAAS,CAAC,CAAC,SAAS,EAC3C,KAAMA,EAAS,CAAC,CAAC,SAAS,EAC1B,cAAeA,EAAS,CAAC,CAAC,SAAS,EACnC,aAAc2yD,EAAc,SAAS,EACrC,cAAe3yD,EAAS,CAAC,CAAC,SAAS,EACnC,SAAUK,EAAQ,CAAC62D,GAAmBj3D,EAAQi3D,EAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EACnF,MAAOl3D,EAAS,CAAC,CAAC,SAAS,CAC5B,CAAC,CAAC,CAAC,YAAY,EACf,kBAAmB,CAClB,WAAY,CACX,QAAS,kBACT,QAAS,wBACV,EACA,SAAU,CAAE,QAAS,gBAAiB,CACvC,EACA,SAAU,CACT,QAAS,GACT,kBAAmB,CAAC,mCAAmC,EACvD,QAAS,CACR,YAAa,kCACb,WAAY,CAAC,CACZ,KAAM,OACN,GAAI,SACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,uDACd,CAAC,EACD,YAAa,CACZ,SAAU,GACV,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,WAAY,CACX,KAAM,SACN,YAAa,mBACd,EACA,UAAW,CACV,KAAM,SACN,YAAa,kBACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,sBACd,EACA,KAAM,CACL,KAAM,SACN,YAAa,mDACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,mDACd,EACA,aAAc,CACb,KAAM,SACN,OAAQ,MACR,YAAa,6CACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,yCACd,EACA,SAAU,CACT,MAAO,CAAC,CACP,KAAM,SACN,YAAa,uBACd,EAAG,CACF,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,2BACd,CAAC,EACD,YAAa,sDACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,iDACd,CACD,EACA,SAAU,CAAC,YAAY,CACxB,CAAE,CAAE,CACL,EACA,UAAW,CACV,IAAO,CACN,YAAa,wBACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,aAAc,CACb,KAAM,SACN,YAAa,qDACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,+BACb,KAAM,CAAC,SAAU,MAAM,CACxB,EACA,WAAY,CACX,KAAM,SACN,YAAa,yCACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,0BACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,oCACd,EACA,SAAU,CACT,KAAM,SACN,YAAa,8BACd,CACD,EACA,SAAU,CACT,eACA,aACA,YACD,CACD,CAAE,CAAE,CACL,EACA,IAAO,CACN,YAAa,oCACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,MAAO,CAAE,KAAM,QAAS,EACxB,kBAAmB,CAAE,KAAM,QAAS,EACpC,UAAW,CAAE,KAAM,QAAS,CAC7B,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,CACD,CACD,CACD,CACD,EAAG,KAAO,IAAQ,CACjB,GAAI6/B,EAAI,QAAS,CAChB,IAAMy9C,EAAW,MAAMhlB,GAAgCz4B,EAAI,OAAO,EAC9Dy9C,GAAYA,EAAS,OAAS,IAAG,EAAI,KAAK,SAAWA,EAC1D,CACA,OAAOnf,GAAct+B,EAAKjV,CAAI,CAC/B,CAAC,EACD,iBAAkBqiD,GAAoB,qBAAsB,CAC3D,OAAQ,OACR,aAAc,GACd,KAAM/sE,EAAS,CACd,UAAWF,EAAS,CAAC,CAAC,SAAS,EAC/B,cAAeA,EAAS,CAAC,CAAC,SAAS,EACnC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,sBAAuBA,EAAS,CAAC,CAAC,SAAS,EAC3C,MAAOA,EAAS,EAChB,gBAAiBA,EAAS,CAAC,CAAC,SAAS,CACtC,CAAC,EACD,SAAU,CACT,QAAS,GACT,kBAAmB,CAAC,mCAAmC,EACvD,QAAS,CACR,YAAa,+CACb,YAAa,CACZ,SAAU,GACV,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,UAAW,CACV,KAAM,SACN,YAAa,kBACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,sBACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,mDACd,EACA,gBAAiB,CAChB,KAAM,SACN,YAAa,gFACd,CACD,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,EACA,UAAW,CACV,IAAO,CACN,YAAa,+BACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,OAAQ,CACP,KAAM,UACN,YAAa,6BACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,kCACd,EACA,UAAW,CACV,KAAM,SACN,YAAa,qCACd,EACA,SAAU,CACT,KAAM,SACN,YAAa,oCACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,mBACd,EACA,IAAK,CACJ,KAAM,SACN,YAAa,oDACd,EACA,IAAK,CACJ,KAAM,SACN,YAAa,sCACd,EACA,IAAK,CACJ,KAAM,SACN,YAAa,uCACd,EACA,IAAK,CACJ,KAAM,SACN,YAAa,sBACd,EACA,IAAK,CACJ,KAAM,SACN,YAAa,uBACd,EACA,IAAK,CACJ,KAAM,SACN,YAAa,qBACd,EACA,IAAK,CACJ,KAAM,SACN,YAAa,QACd,CACD,EACA,SAAU,CAAC,QAAQ,CACpB,CAAE,CAAE,CACL,EACA,IAAO,CACN,YAAa,oCACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,MAAO,CAAE,KAAM,QAAS,EACxB,kBAAmB,CAAE,KAAM,QAAS,EACpC,UAAW,CAAE,KAAM,QAAS,CAC7B,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,CACD,CACD,CACD,CACD,EAAG,KAAO,IACFklE,GAAmBrlC,EAAKjV,CAAI,CACnC,EACD,aAAcqiD,GAAoB,iBAAkB,CACnD,OAAQ,OACR,aAAc,GACd,KAAM/sE,EAAS,CACd,UAAWF,EAAS,CAAC,CAAC,SAAS,EAC/B,cAAeA,EAAS,CAAC,CAAC,SAAS,EACnC,iBAAkBA,EAAS,CAAC,CAAC,SAAS,EACtC,sBAAuBA,EAAS,CAAC,CAAC,SAAS,EAC3C,MAAOA,EAAS,EAChB,gBAAiBA,EAAS,CAAC,CAAC,SAAS,CACtC,CAAC,EACD,SAAU,CACT,kBAAmB,CAAC,mCAAmC,EACvD,QAAS,CACR,YAAa,2CACb,YAAa,CACZ,SAAU,GACV,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,UAAW,CACV,KAAM,SACN,YAAa,kBACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,sBACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,+CACd,EACA,gBAAiB,CAChB,KAAM,SACN,YAAa,gFACd,CACD,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,EACA,UAAW,CACV,IAAO,CACN,YAAa,0DACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,YAAa,yBACd,CAAE,CAAE,CACL,EACA,IAAO,CACN,YAAa,oCACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,MAAO,CAAE,KAAM,QAAS,EACxB,kBAAmB,CAAE,KAAM,QAAS,EACpC,UAAW,CAAE,KAAM,QAAS,CAC7B,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,CACD,CACD,CACD,CACD,EAAG,KAAO,IACFs7E,GAAez7C,EAAKjV,CAAI,CAC/B,EACD,eAAgB0uB,EAAmB,mBAAoB,CACtD,OAAQ,CAAC,MAAO,MAAM,EACtB,KAAMp5C,EAAS,CAAE,aAAcF,EAAS,CAAC,CAAC,SAAS,CAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,EAC/E,SAAU,CACT,QAAS,GACT,kBAAmB,CAAC,mCAAmC,EACvD,QAAS,CACR,YAAa,0DACb,SAAU,CAAC,CAAE,WAAY,CAAC,CAAE,EAAG,CAAE,OAAQ,CACxC,SACA,UACA,OACD,CAAE,CAAC,EACH,WAAY,CAAC,CACZ,KAAM,gBACN,GAAI,SACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,6BACd,EAAG,CACF,KAAM,OACN,GAAI,SACJ,SAAU,GACV,OAAQ,CAAE,KAAM,QAAS,EACzB,YAAa,8DACd,CAAC,EACD,UAAW,CACV,IAAO,CACN,YAAa,0CACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,IAAK,CACJ,KAAM,SACN,YAAa,8BACd,EACA,MAAO,CACN,KAAM,SACN,OAAQ,QACR,SAAU,GACV,YAAa,4DACd,EACA,KAAM,CACL,KAAM,SACN,SAAU,GACV,YAAa,0DACd,EACA,QAAS,CACR,KAAM,SACN,OAAQ,MACR,SAAU,GACV,YAAa,oEACd,EACA,WAAY,CACX,KAAM,SACN,SAAU,GACV,YAAa,2DACd,EACA,YAAa,CACZ,KAAM,SACN,SAAU,GACV,YAAa,4DACd,EACA,eAAgB,CACf,KAAM,UACN,SAAU,GACV,YAAa,qEACd,CACD,EACA,SAAU,CAAC,KAAK,CACjB,CAAE,CAAE,CACL,EACA,IAAO,CACN,YAAa,iDACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,MAAO,CAAE,KAAM,QAAS,EACxB,kBAAmB,CAAE,KAAM,QAAS,CACrC,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,EACA,IAAO,CACN,YAAa,iCACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CACxC,KAAM,SACN,WAAY,CACX,MAAO,CAAE,KAAM,QAAS,EACxB,kBAAmB,CAAE,KAAM,QAAS,CACrC,EACA,SAAU,CAAC,OAAO,CACnB,CAAE,CAAE,CACL,CACD,CACD,CACD,CACD,EAAG,KAAO,IACF29D,GAAiB99B,EAAKjV,CAAI,CACjC,EACD,iBAAkBqiD,GAAoB,sBAAuB,CAC5D,OAAQ,CAAC,MAAO,MAAM,EACtB,KAAMsO,GAA+B,SAAS,EAC9C,MAAOA,GAA+B,SAAS,EAC/C,SAAU,CACT,QAAS,GACT,kBAAmB,CAAC,oCAAqC,kBAAkB,EAC3E,OAAQ,CACP,KAAM,CAAC,EACP,MAAO,CAAC,CACT,EACA,QAAS,CACR,YAAa,kQACb,UAAW,CAAE,IAAO,CACnB,YAAa,gKACb,QAAS,CACR,mBAAoB,CAAE,OAAQ,CAC7B,KAAM,SACN,WAAY,CACX,aAAc,CACb,KAAM,SACN,OAAQ,MACR,YAAa,4EACd,EACA,QAAS,CACR,KAAM,SACN,YAAa,iBACd,CACD,CACD,CAAE,EACF,YAAa,CAAE,OAAQ,CAAE,KAAM,QAAS,CAAE,CAC3C,CACD,CAAE,CACH,CACD,CACD,EAAG,KAAO,IACFtP,GAA0BpsC,EAAKjV,CAAI,CAC1C,EACD,6BAA8BqiD,GAAoB,8BAA+B,CAChF,OAAQ,OACR,KAAM/sE,EAAS,CAAE,OAAQO,EAAU,SAAS,CAAE,CAAC,EAC/C,SAAU,CACT,QAAS,GACT,kBAAmB,CAAC,mCAAmC,EACvD,MAAO,MACR,CACD,EAAG,KAAO,IACF6rE,GAAsCzsC,EAAKjV,CAAI,CACtD,EACD,oBAAqBqiD,GAAoB,mBAAoB,CAC5D,OAAQ,OACR,KAAMpV,GACN,kBAAmB,CAClB,cAAe,uBACf,0BAA2B,uBAC3B,mBAAoB,6BACpB,UAAW,gBACZ,EACA,aAAc,0BACd,SAAU,CACT,QAAS,GACT,QAAS,CACR,YAAa,iCACb,UAAW,CAAE,IAAO,CACnB,YAAa,6CACb,QAAS,CAAE,mBAAoB,CAAE,OAAQ,CAExC,KAAM,SACN,WAAY,CACX,UAAW,CACV,KAAM,SACN,YAAa,kCACd,EACA,cAAe,CACd,KAAM,SACN,YAAa,2BACd,EACA,yBAA0B,CACzB,KAAM,SACN,YAAa,gFACd,EACA,MAAO,CACN,KAAM,SACN,YAAa,8CACd,EACA,QAAS,CACR,KAAM,SACN,YAAa,0EACd,EACA,oBAAqB,CACpB,KAAM,SACN,YAAa,mCACd,EACA,YAAa,CACZ,KAAM,SACN,YAAa,gCACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,gCACd,EACA,SAAU,CACT,KAAM,SACN,YAAa,8BACd,EACA,SAAU,CACT,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,iGACd,EACA,QAAS,CACR,KAAM,SACN,YAAa,+BACd,EACA,WAAY,CACX,KAAM,SACN,YAAa,qBACd,EACA,YAAa,CACZ,KAAM,SACN,YAAa,yFACd,EACA,iBAAkB,CACjB,KAAM,SACN,YAAa,wCACd,EACA,mBAAoB,CACnB,KAAM,SACN,YAAa,oEACd,EACA,cAAe,CACd,KAAM,QACN,MAAO,CACN,KAAM,SACN,OAAQ,KACT,EACA,YAAa,+BACd,EACA,0BAA2B,CAC1B,KAAM,QACN,MAAO,CACN,KAAM,SACN,OAAQ,KACT,EACA,YAAa,sCACd,EACA,uBAAwB,CACvB,KAAM,SACN,OAAQ,MACR,YAAa,kFACd,EACA,oCAAqC,CACpC,KAAM,UACN,YAAa,6DACd,EACA,2BAA4B,CAC3B,KAAM,SACN,YAAa,wDACd,EACA,YAAa,CACZ,KAAM,QACN,MAAO,CAAE,KAAM,QAAS,EACxB,YAAa,sDACd,EACA,eAAgB,CACf,KAAM,QACN,MAAO,CACN,KAAM,SACN,KAAM,CAAC,MAAM,CACd,EACA,YAAa,iEACd,EACA,iBAAkB,CACjB,KAAM,SACN,YAAa,6DACb,KAAM,CAAC,MAAO,QAAQ,CACvB,EACA,UAAW,CACV,KAAM,QACN,MAAO,CACN,KAAM,SACN,OAAQ,KACT,EACA,YAAa,4DACd,EACA,SAAU,CACT,KAAM,UACN,YAAa,gCACd,CACD,EACA,SAAU,CAAC,WAAW,CACvB,CAAE,CAAE,CACL,CAAE,CACH,CACD,CACD,EAAG,KAAO,IACFic,GAAiBj0C,EAAKjV,CAAI,CACjC,EACD,uBAAwB+tD,GAAuB/tD,CAAI,EACnD,kBAAmBguD,GAAkBhuD,CAAI,EACzC,eAAgBiuD,GAAejuD,CAAI,EACnC,qBAAsBkuD,GAAqBluD,CAAI,EAC/C,6BAA8BmuD,GAA6BnuD,CAAI,EAC/D,gBAAiBouD,GAAgBpuD,CAAI,EACrC,uBAAwBquD,GAAuBruD,CAAI,EACnD,kBAAmBsuD,GAAkBtuD,CAAI,EACzC,mBAAoBuuD,GAAmBvuD,CAAI,EAC3C,kBAAmBwuD,GAAkBxuD,CAAI,EACzC,gBAAiB8uD,GAAgB9uD,CAAI,EACrC,iBAAkB+uD,GAAiB/uD,CAAI,EACvC,mBAAoBgvD,GAAmBhvD,CAAI,EAC3C,mBAAoBivD,GAAmBjvD,CAAI,EAC3C,yBAA0B8vD,GAAyB9vD,CAAI,EACvD,wBAAyB+vD,GAAwB/vD,CAAI,EACrD,sBAAuBgwD,GAAsBhwD,CAAI,EACjD,yBAA0BiwD,GAAyBjwD,CAAI,EACvD,yBAA0BkwD,GAAyBlwD,CAAI,EACvD,wBAAyBmwD,GAAwBnwD,CAAI,EACrD,0BAA2BowD,GAA0BpwD,CAAI,CAC1D,EACA,OAAQy5B,GAAY,gBAAgBhiB,EAAM,EAAGzX,GAAM,MAAM,EACzD,UAAW,CACV,GAAGA,EAAK,WAAW,QAAU,GAIxB,CAAC,EAJ+B,CAAC,CACrC,YAAc,GAASiP,IAAS,gBAChC,OAAQjP,EAAK,WAAW,OAAO,QAAU,GACzC,IAAKA,EAAK,WAAW,OAAO,KAAO,EACpC,CAAC,EACD,GAAGA,EAAK,WAAW,YAAc,GAI5B,CAAC,EAJmC,CAAC,CACzC,YAAc,GAASiP,IAAS,oBAChC,OAAQjP,EAAK,WAAW,WAAW,QAAU,GAC7C,IAAKA,EAAK,WAAW,WAAW,KAAO,EACxC,CAAC,EACD,GAAGA,EAAK,WAAW,aAAe,GAI7B,CAAC,EAJoC,CAAC,CAC1C,YAAc,GAASiP,IAAS,qBAChC,OAAQjP,EAAK,WAAW,YAAY,QAAU,GAC9C,IAAKA,EAAK,WAAW,YAAY,KAAO,GACzC,CAAC,EACD,GAAGA,EAAK,WAAW,SAAW,GAIzB,CAAC,EAJgC,CAAC,CACtC,YAAc,GAASiP,IAAS,iBAChC,OAAQjP,EAAK,WAAW,QAAQ,QAAU,GAC1C,IAAKA,EAAK,WAAW,QAAQ,KAAO,EACrC,CAAC,EACD,GAAGA,EAAK,WAAW,WAAa,GAI3B,CAAC,EAJkC,CAAC,CACxC,YAAc,GAASiP,IAAS,mBAChC,OAAQjP,EAAK,WAAW,UAAU,QAAU,GAC5C,IAAKA,EAAK,WAAW,UAAU,KAAO,CACvC,CAAC,EACD,GAAGA,EAAK,WAAW,WAAa,GAI3B,CAAC,EAJkC,CAAC,CACxC,YAAc,GAASiP,IAAS,mBAChC,OAAQjP,EAAK,WAAW,UAAU,QAAU,GAC5C,IAAKA,EAAK,WAAW,UAAU,KAAO,EACvC,CAAC,CACF,CACD,CACD,EAQA,SAAS2yD,GAAe,EAAkB,EAAe,EAAK,CAE7D,OADIC,IAAkB,GACfv8D,EAAI,QAAQ,EAAIo2B,EAAiB,QAAQ,GAAKmmC,EAAgB,GACtE,CACA,SAASC,GAAmC,EAAO,CAClD,GAAM,CAAE,QAASC,EAAS,GAAGC,GAAuB96C,EACpD,OAAO86C,CACR,CAMA,SAAS5V,GAAe,EAAK,EAAO,EAAa,EAAO,EAAK,EAAO,QAAS,CAC5E,IAAM6V,EAAe,IAAI,gBAAgB,CACxC,QACA,kBAAmBj5D,CACpB,CAAC,EAID,OAHA1a,GAAS2zE,EAAa,OAAO,QAAS3zE,CAAK,EAC3CmqD,GAAOwpB,EAAa,OAAO,MAAOxpB,CAAG,EACjCt7C,IAAS,WAAmB,GAAGnX,EAAI,GAAGi8E,EAAa,SAAS,IACzDjhC,GAAkBh7C,EAAKi8E,CAAY,CAC3C,CAUA,SAASC,GAAmB,EAAK,CAChC,IAAMC,EAAe,OAAO73E,EAAI,eAAkB,SAAWA,EAAI,cAAgB,IAAK,GACtF,GAAI63E,IAAiB,WAAY,MAAO,WACxC,GAAIA,IAAiB,QAAS,MAAO,QACrC,IAAMn0C,EAAe,OAAO1jC,EAAI,eAAkB,SAAWA,EAAI,cAAgB,IAAK,GAEtF,OADI0jC,GAAgB,uBAAuB,KAAKA,CAAY,EAAU,WAC/D,OACR,CACA,IAAMo0C,GAAsC,CAC3C,cAAe,CAAE,QAAS,2BAA4B,EACtD,SAAU,CAAE,QAAS,gBAAiB,CACvC,EACA,SAASC,GAAS,EAAO,CACxB,OAAO,OAAOp4E,GAAU,YAAYA,GAAkB,CAAC,MAAM,QAAQA,CAAK,CAC3E,CACA,SAASq4E,GAAmB,EAAO,CAClC,OAAO,OAAOr4E,GAAU,SAAWA,EAAQ,IAAK,EACjD,CACA,SAASs4E,GAAkC,EAAK,EAAU,CACzD,IAAMh7D,EAAS2c,EAAI,SAAW,QAAUiR,GAAU,cAAgB,GAAOjR,EAAI,KAAOA,EAAI,MACxF,MAAO,CAAE,GAAGm+C,GAAS96D,CAAM,EAAIA,EAAS,CAAC,CAAE,CAC5C,CACA,IAAM8oD,GAAkB,EAAK,IAAQ,CACpC,IAAMmS,EAAYxX,GAAsB9mC,EAAI,SAAS,OAAO,EACtDu+C,EAAav+C,EAAI,SAAS,IAAI,QAAQ,CAAC,EAAE,SAAS,kBAAkB,EAC1E,GAAIs+C,GAAaC,EAAY,MAAO,CACnC,SAAU,GACV,IAAKtnC,EAAI,SAAS,CACnB,EACK,MAAMjX,EAAI,SAASiX,CAAG,CAC5B,EACA,SAASunC,GAA4B,EAAK,EAAM,EAAO,EAAO,EAAa,CAC1E,OAAOrS,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc9mB,EAAO4I,EAAake,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,CACrH,CASA,SAAS4hD,GAAkB,EAAQ,CAClC,GAAI,CACH,IAAM7qE,EAAM,IAAI,IAAImf,CAAM,EAI1B,OAHInf,EAAI,WAAa,UAAY,CAACyuD,GAAezuD,EAAI,IAAI,IAAG,EAAI,SAAW,UAC3E,EAAI,OAAS,GACb,EAAI,KAAO,GACJA,EAAI,SAAS,CAAC,CAAC,QAAQ,MAAO,EAAE,CACxC,MAAQ,CACP,OAAOmf,CACR,CACD,CAIA,SAASumD,GAAU,EAAK,EAAM,CAC7B,IAAIvmD,EACJ,GAAI8J,EAAK,iBAAkB,EAASiV,EAAI,QAAQ,aAC3C,GAAI,CACR,EAASoS,GAAapS,EAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAUA,EAAI,QAAQ,OACxE,MAAQ,CACP,EAASA,EAAI,QAAQ,OACtB,CACA,OAAO2sC,GAAkB1rD,CAAM,CAChC,CAKA,SAASw9D,GAAY,EAAK,EAAO,EAAa,CAC7C,OAAOvW,GAAeloC,EAAI,QAAQ,QAAQ,YAAY,UAAY,GAAGA,EAAI,QAAQ,QAAQ,QAAS9jB,EAAO4I,CAAW,CACrH,CAMA,SAAS45D,GAA0B,EAAK,CACvC,IAAI7uE,EACJ,GAAI,CACH,EAAS,IAAI,IAAIonC,CAAG,CACrB,MAAQ,CACP,MACD,CACA,IAAM0nC,EAAaruB,GAAazgD,EAAO,QAAQ,GAAKA,EAAO,WAAa,YACxE,GAAIA,EAAO,WAAa,SAAW,CAAC8uE,EAAY,OAChD,IAAMC,EAAuB3nC,EAAI,QAAQ,KAAK,EAC9C,GAAI2nC,EAAuB,EAAG,OAC9B,IAAMC,EAAiBD,EAAuB,EACxCE,EAAqB7nC,EAAI,MAAM4nC,CAAc,CAAC,CAAC,OAAO,QAAQ,EAChEE,EAAe9nC,EAAI,OACnB6nC,GAAsB,IAAG,EAAeD,EAAiBC,GAC7D,IAAM3L,EAAYl8B,EAAI,MAAM4nC,EAAgBE,CAAY,EACpDC,EACJ,GAAI7L,EAAU,WAAW,GAAG,EAAG,CAC9B,IAAM8L,EAAiB9L,EAAU,QAAQ,GAAG,EAC5C,GAAI8L,EAAiB,EAAG,OACxB,GAAI9L,EAAU8L,EAAiB,KAAO,IAAK,OAAOhoC,EAClD,EAAYgoC,EAAiB,CAC9B,MAEC,GADA,EAAY9L,EAAU,YAAY,GAAG,EACjC6L,EAAY,EAAG,OAAO/nC,EAE3B,IAAMioC,EAAO/L,EAAU,MAAM6L,EAAY,CAAC,EAC1C,GAAI,CAAC,SAAS,KAAKE,CAAI,EAAG,OAC1B,IAAMC,EAAiBN,EAAiBG,EACxC,MAAO,GAAG/nC,EAAI,MAAM,EAAGkoC,CAAc,IAAIloC,EAAI,MAAM8nC,CAAY,GAChE,CAWA,SAASK,GAA0B,EAAY,EAAW,CACzD,GAAI,CAACC,GAAc,CAAChiB,EAAW,OAC/B,IAAIiiB,EACJ,GAAI,CACH,EAAe,IAAI,IAAIjiB,CAAS,CACjC,MAAQ,CACP,MACD,CAIA,IAAMkiB,EAAcliB,EAAU,SAAS,GAAG,EACpCmiB,EAAcF,EAAa,SAAS,OAAS,GAAKA,EAAa,SAAS,OAAS,EACvF,GAAIC,GAAeC,EAAa,OAChC,IAAMC,EAAuBf,GAA0BrhB,CAAS,EAChE,OAAOgiB,EAAW,KAAM,GACnBv9E,IAAQu7D,EAAkB,GACzBoiB,EACEf,GAA0B58E,CAAG,IAAM29E,EADR,EAElC,CACF,CAEA,SAASC,GAAwB,EAAK,CACrC,GAAI,CAAC5sB,EAAc,UAAU7b,CAAG,CAAC,CAAC,QAAS,MAAO,GAClD,IAAMpnC,EAAS,IAAI,IAAIonC,CAAG,EAC1B,OAAOpnC,EAAO,SAAS,SAAW,GAAKA,EAAO,SAAS,SAAW,CACnE,CASA,eAAe8vE,GAA0B,EAAK,EAAM,EAAU,EAAa,CAC1E,GAAI,CAACv7C,GAAY,CAACyuC,EAAa,OAAO,KACtC,IAAIt9B,EACJ,GAAI,CACH,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMqZ,CAAQ,CAC7C,MAAQ,CACP,OAAO,IACR,CACA,GAAI,CAACmR,GAAUA,EAAO,SAAU,OAAO,KACvC,IAAMqqC,EAAiBrqC,EAAO,cAAgB,CAAC,EACzC71B,EAAU0/D,GAA0BQ,EAAgB/M,CAAW,EACrE,GAAI9nD,EAAK,oBAAqB,CAC7B,GAAI,CAAC20D,GAAwB7M,CAAW,EAAG,OAAO,KAClD,GAAI,CACH,OAAO,MAAM9nD,EAAK,oBAAoB8nD,EAAa+M,EAAgB,EAAQlgE,CAAQ,EAAImzD,EAAc,IACtG,MAAQ,CACP,OAAO,IACR,CACD,CACA,OAAOnzD,EAAUmzD,EAAc,IAChC,CAWA,SAASiK,GAAyB,EAAM,CACvC,OAAO,MAAO,CAAE,QAAO,oBAAmB,SAAU,CACnD,IAAM12E,EAAM45B,EAAI,OAAS,CAAC,EACpB6/C,EAAU,MAAMF,GAA0B3/C,EAAKjV,EAAM,OAAO3kB,EAAI,WAAc,SAAWA,EAAI,UAAY,IAAK,GAAG,OAAOA,EAAI,cAAiB,SAAWA,EAAI,aAAe,IAAK,EAAC,EAEvL,OADIy5E,EAAgB1T,EAAensC,EAAKkoC,GAAe2X,EAAS3jE,EAAO4jE,EAAmB,OAAO15E,EAAI,OAAU,SAAWA,EAAI,MAAQ,IAAK,GAAGohE,GAAUxnC,EAAKjV,CAAI,EAAGizD,GAAmB53E,CAAG,CAAC,CAAC,EACrL+lE,EAAensC,EAAKy+C,GAAYz+C,EAAK9jB,EAAO4jE,CAAiB,CAAC,CACtE,CACD,CACA,eAAe/C,GAAkB,EAAK,EAAM,EAAU,CACrD,GAAIhyD,EAAK,YAAc,CAACA,EAAK,WAAW,SAAS,oBAAoB,EAAG,MAAM,IAAI9qB,EAAW,WAAW,EACxG,GAAI,CAAC+/B,EAAI,QAAS,MAAM,IAAI//B,EAAW,eAAgB,CACtD,kBAAmB,oBACnB,MAAO,iBACR,CAAC,EACD,IAAMs3B,EAAUyI,EAAI,QAChBgD,EAAQq7C,GAAkCr+C,EAAKiR,CAAQ,EAC3D,EAAI,MAAQjO,EACZ,IAAM+8C,EAAgB3B,GAAmBp7C,EAAM,OAAO,EAChDg9C,EAAa5B,GAAmBp7C,EAAM,WAAW,EACvD,GAAI+8C,IAAkB,IAAK,IAAKC,IAAe,IAAK,GAAG,OAAOlD,GAAyB/xD,CAAI,CAAC,CAAC,CAC5F,MAAO,kBACP,kBAAmB,kDACnB,KACD,CAAC,EACD,GAAIg1D,IAAkB,IAAK,GAAG,OAAOjD,GAAyB/xD,CAAI,CAAC,CAAC,CACnE,MAAO,wBACP,kBAAmB,+BACnB,KACD,CAAC,EACD,GAAIi1D,IAAe,IAAK,GAAG,CAC1B,IAAM57C,EAAWg6C,GAAmBp7C,EAAM,SAAS,EACnD,GAAI,CAACoB,EAAU,OAAO04C,GAAyB/xD,CAAI,CAAC,CAAC,CACpD,MAAO,kBACP,kBAAmB,wBACnB,KACD,CAAC,EACD,GAAI,CAACA,EAAK,mBAAoB,OAAO+xD,GAAyB/xD,CAAI,CAAC,CAAC,CACnE,MAAO,4BACP,kBAAmB,4BACnB,KACD,CAAC,EACD,IAAMk1D,EAAiB,MAAMl1D,EAAK,mBAAmB,CACpD,aACA,WACA,KACD,CAAC,EACD,GAAI,CAACk1D,EAAgB,OAAOnD,GAAyB/xD,CAAI,CAAC,CAAC,CAC1D,MAAO,sBACP,kBAAmB,oCACnB,KACD,CAAC,EACD,IAAMm1D,EAAcl9C,EAAM,UAC1B,EAAQi9C,EACJC,IAAa,EAAM,UAAYA,EACpC,CACA,EAAI,MAAQl9C,EACZ,IAAMm9C,EAActoB,GAAyB,UAAU70B,CAAK,EAC5D,GAAI,CAACm9C,EAAY,QAAS,CACzB,IAAMC,EAAc7S,GAAsB4S,EAAY,MAAM,OAAQjC,EAAmC,EACvG,OAAOpB,GAAyB/xD,CAAI,CAAC,CAAC,CACrC,GAAGq1D,EACH,KACD,CAAC,CACF,CAIA,GAHA,EAAQD,EAAY,KACpB,EAAI,MAAQn9C,EACZ,MAAM4kC,GAAW,IAAI,CAAE,MAAOyY,GAA4Br9C,CAAK,CAAC,CAAC,SAAS,CAAE,CAAC,EACzE,CAACA,EAAM,cAAe,OAAO85C,GAAyB/xD,CAAI,CAAC,CAAC,CAC/D,MAAO,kBACP,kBAAmB,4BACnB,KACD,CAAC,EACD,IAAM0sC,EAAYz3B,EAAI,OAAO,OAAS4W,GAAY5W,EAAI,OAAO,MAAM,EAAI,IAAK,GACtEsgD,EAAa7oB,GAAW,IAAI,MAAM,GAAK,GAC7C,GAAIA,GAAW,IAAI,gBAAgB,GAAK,CAAC1sC,EAAK,eAAe,KAAM,OAAOohD,EAAensC,EAAKy+C,GAAYz+C,EAAK,oCAAqC,yBAAyB,CAAC,EAC9K,GAAMgD,EAAM,gBAAkB,OAAS,OAAOmpC,EAAensC,EAAKy+C,GAAYz+C,EAAK,4BAA6B,2BAA2B,CAAC,EAC5I,IAAMuV,EAAS,MAAMpC,GAAUnT,EAAKjV,EAAMiY,EAAM,SAAS,EACzD,GAAI,CAACuS,EAAQ,OAAO42B,EAAensC,EAAKy+C,GAAYz+C,EAAK,iBAAkB,uBAAuB,CAAC,EACnG,GAAIuV,EAAO,SAAU,OAAO42B,EAAensC,EAAKy+C,GAAYz+C,EAAK,kBAAmB,oBAAoB,CAAC,EACzG,GAAI,CAACqV,GAAkBE,EAAQ,oBAAoB,EAAG,OAAO42B,EAAensC,EAAKy+C,GAAYz+C,EAAK,sBAAuB,8DAA8D,CAAC,EACxL,IAAM4/C,EAAiBrqC,EAAO,cAAgB,CAAC,EAC3CgrC,EAAqB,GACzB,GAAIv9C,EAAM,aAAc,CACvB,IAAMw9C,EAAgB,EAAQpB,GAA0BQ,EAAgB58C,EAAM,YAAY,EAC1F,GAAIjY,EAAK,qBAAuB20D,GAAwB18C,EAAM,YAAY,EAAG,GAAI,CAChF,EAAqB,MAAMjY,EAAK,oBAAoBiY,EAAM,aAAc48C,EAAgBY,CAAa,CACtG,MAAQ,CACP,EAAqB,EACtB,MACUz1D,EAAK,sBAAqB,EAAqBy1D,EAC1D,CACA,GAAI,CAACD,EAAoB,OAAOpU,EAAensC,EAAKy+C,GAAYz+C,EAAK,mBAAoB,sBAAsB,CAAC,EAChH,IAAIilC,EAAkBjiC,EAAM,OAAO,MAAM,GAAG,CAAC,CAAC,OAAQ,GAAM7yB,CAAC,EAC7D,GAAI80D,EAAiB,CACpB,IAAMvvB,EAAc,IAAI,IAAIH,EAAO,QAAUxqB,EAAK,MAAM,EAClDoyC,EAAgB8H,EAAgB,OAAQ,GACtC,CAACvvB,GAAa,IAAIhS,CAAK,CAC9B,EACD,GAAIy5B,EAAc,OAAQ,OAAOgP,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc,gBAAiB,qCAAqCm6B,EAAc,KAAK,IAAI,IAAKn6B,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,CAC7M,CACKk6C,IACJ,EAAkB1vB,EAAO,QAAUxqB,EAAK,QAAU,CAAC,EACnD,EAAM,MAAQk6C,EAAgB,KAAK,GAAG,GAEvC,IAAMwb,EAAkBxb,EAAgB,SAAS,QAAQ,EACzD,GAAIjiC,EAAM,SAAW,IAAK,IAAK,CAACy9C,EAAiB,OAAOtU,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc,kBAAmB,iEAAkEA,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,EACtO,GAAI01D,GAAmB,CAAChrB,GAAyBzyB,EAAM,MAAM,EAAG,OAAOmpC,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc,kBAAmB,+CAAgDA,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,EACnO,GAAI01D,GAAmB,CAAC3qB,GAA8B9yB,EAAM,OAAQ,GAAG,EAAG,OAAOmpC,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc,gBAAiB,0CAA2CA,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,EACtO,IAAMm1C,EAA0BxK,GAA2B1yB,EAAM,OAAQ2zB,GAAmB5rC,CAAI,CAAC,EACjG,GAAIiY,EAAM,WAAa,IAAK,GAAG,GAAI,CAClC,MAAMo2B,GAAsBp5B,EAAKjV,EAAM,CACtC,SAAUiY,EAAM,SAChB,SAAUuS,EAAO,SACjB,iBACD,CAAC,CACF,OAASh5B,EAAK,CACb,GAAIA,aAAetc,EAAY,CAC9B,IAAMic,EAAQK,EAAI,MAAM,OAAS,iBAC3BuI,EAAcvI,EAAI,MAAM,mBAAqB,6BACnD,OAAO4vD,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc9mB,EAAO4I,EAAake,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,CACrH,CACA,MAAMxO,CACP,CACA,IAAMmkE,EAAe5oC,GAAevC,EAAQ,CAC3C,OAAQ0vB,EACR,MAAOjiC,EAAM,KACd,CAAC,EACD,GAAI09C,IACC,CAAC19C,EAAM,gBAAkB,CAACA,EAAM,uBAAuB,OAAOmpC,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc,kBAAmB09C,EAAa,QAAQ,EAAG19C,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,EAEvM,GAAIiY,EAAM,gBAAkBA,EAAM,sBAAuB,CACxD,GAAI,CAACA,EAAM,gBAAkB,CAACA,EAAM,sBAAuB,OAAOmpC,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc,kBAAmB,iEAAkEA,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,EAChP,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,SAASiY,EAAM,qBAAqB,EAAG,OAAOmpC,EAAensC,EAAKkoC,GAAellC,EAAM,aAAc,kBAAmB,wDAAyDA,EAAM,MAAOwkC,GAAUxnC,EAAKjV,CAAI,CAAC,CAAC,CAClO,CACA,IAAMsuC,EAAqB3mB,GAAe1P,EAAM,QAAQ,GAAK,CAAC,EACxDqgB,EAAU,MAAMiK,EAAkBttB,CAAG,EACrC29C,EAAgB36C,EAAM,QACtB29C,EAAqBt9B,GAAW,MAAQs6B,IAAkB,IAAK,IAAKD,GAAe,IAAI,KAAKr6B,EAAQ,QAAQ,SAAS,EAAGs6B,EAA+B,IAAI,IAAM,EACvK,GAAI,CAACt6B,GAAWA,GAAW,MAAQs6B,IAAkB,IAAK,IAAK,CAACgD,GAAsBlpB,GAAW,IAAI,OAAO,GAAKA,GAAW,IAAI,QAAQ,EAEvI,OADI6oB,EAAmB9B,GAA4Bx+C,EAAKjV,EAAMiY,EAAO,iBAAkB,yBAAyB,EACzG49C,GAAuB5gD,EAAKjV,EAAM0sC,GAAW,IAAI,QAAQ,EAAI,SAAW,OAAO,EAMvF,GAJIkpB,IACH,EAAQ/C,GAAmC56C,CAAK,EAChD,EAAI,MAAQA,GAETiO,GAAU,aAAewmB,GAAW,IAAI,gBAAgB,EAAG,OAAOmpB,GAAuB5gD,EAAKjV,EAAM,gBAAgB,EACxH,GAAIkmB,GAAU,aAAelmB,EAAK,eAC7B,MAAMA,EAAK,cAAc,eAAe,CAC3C,QAASwM,EAAQ,QACjB,KAAM8rB,EAAQ,KACd,QAASA,EAAQ,QACjB,OAAQ4hB,CACT,CAAC,EAEA,OADIqb,EAAmB9B,GAA4Bx+C,EAAKjV,EAAMiY,EAAO,6BAA8B,wCAAwC,EACpI49C,GAAuB5gD,EAAKjV,EAAM,gBAAgB,EAG3D,GAAIA,EAAK,QAAQ,eAAgB,CAChC,IAAM81D,EAAiB,MAAM91D,EAAK,OAAO,eAAe,CACvD,QAASwM,EAAQ,QACjB,KAAM8rB,EAAQ,KACd,QAASA,EAAQ,QACjB,OAAQ4hB,CACT,CAAC,EACD,GAAI4b,EAEH,OADIP,EAAmB9B,GAA4Bx+C,EAAKjV,EAAMiY,EAAO,uBAAwB,kCAAkC,EACxH49C,GAAuB5gD,EAAKjV,EAAM,SAAU,CAAE,KAAM,OAAO81D,GAAmB,SAAWA,EAAiB,IAAK,EAAE,CAAC,CAE3H,CACA,GAAI,CAAC5vC,GAAU,WAAalmB,EAAK,WAC5B,MAAMA,EAAK,UAAU,eAAe,CACvC,QAASwM,EAAQ,QACjB,KAAM8rB,EAAQ,KACd,QAASA,EAAQ,QACjB,OAAQ4hB,CACT,CAAC,EAEA,OADIqb,EAAmB9B,GAA4Bx+C,EAAKjV,EAAMiY,EAAO,uBAAwB,kCAAkC,EACxH49C,GAAuB5gD,EAAKjV,EAAM,YAAY,EAGvD,GAAI0sC,GAAW,IAAI,SAAS,EAAG,OAAOmpB,GAAuB5gD,EAAKjV,EAAM,UAAW,CAAE,UAAWs4B,EAAQ,QAAQ,EAAG,CAAC,EACpH,IAAMsgB,EAAc,MAAM54C,EAAK,WAAW,qBAAqB,CAC9D,KAAMs4B,EAAQ,KACd,QAASA,EAAQ,QACjB,OAAQ4hB,CACT,CAAC,EACD,GAAI1vB,EAAO,YAAa,OAAOurC,GAA8B9gD,EAAKjV,EAAM,CACvE,QACA,SAAUwqB,EAAO,SACjB,OAAQ8N,EAAQ,KAAK,GACrB,UAAWA,EAAQ,QAAQ,GAC3B,SAAU,IAAI,KAAKA,EAAQ,QAAQ,SAAS,CAAC,CAAC,QAAQ,EACtD,cACA,SAAUgW,CACX,CAAC,EACD,IAAMkP,EAAU,MAAMvoC,EAAI,QAAQ,QAAQ,QAAQ,CACjD,MAAO,eACP,MAAO,CACN,CACC,MAAO,WACP,MAAOuV,EAAO,QACf,EACA,CACC,MAAO,SACP,MAAO8N,EAAQ,KAAK,EACrB,EACA,GAAGsgB,EAAc,CAAC,CACjB,MAAO,cACP,MAAOA,CACR,CAAC,EAAI,CAAC,CACP,CACD,CAAC,EACD,GAAI,CAAC4E,GAAW,CAACtD,EAAgB,MAAO,GAAQsD,EAAQ,OAAO,SAAS5vC,CAAG,CAAC,GAAK,CAACunC,EAAwB,MAAO,IAAWqI,EAAQ,yBAA2B,CAAC,EAAA,CAAG,SAAS76D,CAAK,CAAC,EAEjL,OADI4yE,EAAmB9B,GAA4Bx+C,EAAKjV,EAAMiY,EAAO,mBAAoB,8BAA8B,EAChH49C,GAAuB5gD,EAAKjV,EAAM,UAAW,CAAE,UAAWs4B,EAAQ,QAAQ,EAAG,CAAC,EAEtF,IAAM09B,EAAqBxY,GAAS,WAAa,CAAC,EAKlD,OAJIlP,EAAmB,KAAM,GAAsB,CAAC0nB,EAAmB,SAASC,CAAiB,CAAC,EAC7FV,EAAmB9B,GAA4Bx+C,EAAKjV,EAAMiY,EAAO,mBAAoB,8BAA8B,EAChH49C,GAAuB5gD,EAAKjV,EAAM,UAAW,CAAE,UAAWs4B,EAAQ,QAAQ,EAAG,CAAC,EAE/Ey9B,GAA8B9gD,EAAKjV,EAAM,CAC/C,QACA,SAAUwqB,EAAO,SACjB,OAAQ8N,EAAQ,KAAK,GACrB,UAAWA,EAAQ,QAAQ,GAC3B,SAAU,IAAI,KAAKA,EAAQ,QAAQ,SAAS,CAAC,CAAC,QAAQ,EACtD,cACA,SAAUgW,CACX,CAAC,CACF,CACA,SAASgnB,GAA4B,EAAO,CAC3C,IAAMz7E,EAAS,IAAI,gBACnB,IAAK,GAAM,CAACkB,EAAKC,KAAU,OAAO,QAAQi9B,CAAK,EAC9C,GAAIj9B,GAAS,KACb,IAAI,MAAM,QAAQA,CAAK,EAAG,IAAK,IAAM6xC,KAAK7xC,EAAOnB,EAAO,OAAOkB,EAAK,OAAO8xC,CAAC,CAAC,OACpE9xC,IAAQ,UAAY,OAAOC,GAAU,SAAUnB,EAAO,IAAIkB,EAAK,KAAK,UAAUC,CAAK,CAAC,EACxFnB,EAAO,IAAIkB,EAAK,OAAOC,CAAK,CAAC,CAAA,CAEnC,OAAOnB,CACR,CACA,eAAek8E,GAA8B,EAAK,EAAM,EAAmB,CAC1E,IAAMl0E,EAAOib,GAAqB,GAAI,MAAO,MAAO,KAAK,EACnDvG,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAG,EACjCE,EAAMF,GAAOyJ,EAAK,eAAiB,KACnCphB,EAAO,CACZ,WAAY,MAAMyqC,GAAWrpB,EAAK,YAAane,EAAM,oBAAoB,EACzE,UAA2B,IAAI,KAAK0U,EAAM,GAAG,EAC7C,UAA2B,IAAI,KAAKE,EAAM,GAAG,EAC7C,MAAO,KAAK,UAAU,CACrB,KAAM,qBACN,MAAOyiD,EAAkB,MACzB,OAAQA,EAAkB,OAC1B,UAAWA,GAAmB,UAC9B,YAAaA,EAAkB,YAC/B,SAAUA,EAAkB,SAC5B,SAAUA,EAAkB,QAC7B,CAAC,CACF,EACA,MAAMjkC,EAAI,QAAQ,gBAAgB,wBAAwB,CACzD,GAAGr2B,EACH,UAA2B,IAAI,KAAK2X,EAAM,GAAG,CAC9C,CAAC,EACD,IAAM2/D,EAAsB,IAAI,IAAIhd,EAAkB,MAAM,YAAY,EAIxE,OAHAgd,EAAoB,aAAa,IAAI,OAAQr0E,CAAI,EAC7Cq3D,EAAkB,MAAM,OAAOgd,EAAoB,aAAa,IAAI,QAAShd,EAAkB,MAAM,KAAK,EAC9Ggd,EAAoB,aAAa,IAAI,MAAOzZ,GAAUxnC,EAAKjV,CAAI,CAAC,EACzDohD,EAAensC,EAAKihD,EAAoB,SAAS,CAAC,CAC1D,CACA,eAAeL,GAAuB,EAAK,EAAM,EAAM,EAAS,CAC/D,IAAMl6C,EAAc,MAAMw6C,GAAWlhD,EAAKjV,EAAM,CAAE,2BAA4BspB,IAAS,WAAatpB,EAAK,UAAYvd,GAAS,UAAY,IAAK,EAAE,CAAC,EAC9IwsB,EAAOjP,EAAK,UAChB,GAAIspB,IAAS,iBAAkB,EAAOtpB,EAAK,eAAe,MAAQA,EAAK,eAClE,GAAIspB,IAAS,aAAc,CAC/B,GAAI,CAACtpB,EAAK,WAAW,KAAM,MAAM,IAAI9qB,EAAW,wBAAyB,CAAE,kBAAmB,oCAAqC,CAAC,EACpI,EAAO8qB,EAAK,WAAW,IACxB,MAAWspB,IAAS,UAAW,EAAOtpB,EAAK,YAClCspB,IAAS,WAAU,EAAOtpB,EAAK,QAAQ,MAAQA,EAAK,WAC7D,OAAOohD,EAAensC,EAAK,GAAGxyB,GAAS,MAAQwsB,EAAK,GAAG0M,GAAa,CACrE,CACA,eAAew6C,GAAW,EAAK,EAAM,EAAO,CAC3C,IAAM56E,EAAW,KAAK,IAAI,EACpBkb,EAAM,KAAK,MAAMlb,EAAW,GAAG,GAAKykB,EAAK,eAAiB,KAC1DnmB,EAASy7E,GAA4BrgD,EAAI,KAAK,EACpDp7B,EAAO,IAAI,MAAO,OAAO4c,CAAG,CAAC,EAC7B5c,EAAO,IAAIQ,GAA0B,OAAOkB,CAAQ,CAAC,EACrD1B,EAAO,OAAO,KAAK,EACnBA,EAAO,OAAOS,EAAqB,EAC/B87E,GAAO,4BAA4Bv8E,EAAO,IAAIS,GAAuB87E,EAAM,0BAA0B,EACzGn7E,GAAkCpB,CAAM,EACxC,IAAMia,EAAY,MAAMhe,GAAc0E,GAA6BX,CAAM,CAAC,CAAC,SAAS,EAAGo7B,EAAI,QAAQ,MAAM,EAEzG,OADAp7B,EAAO,IAAI,MAAOia,CAAS,EACpBja,EAAO,SAAS,CACxB"}