@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/api/auth.api-client.impl.js

@@ -0,0 +1,595 @@
+/**
+ * Auth api-client — consumer variant.
+ *
+ * Cross-origin HTTP client against `${authOrigin}/api/auth/*`. Loaded in
+ * cli/browser/sveltekit/cloud scopes by the auth plugin's api-client loader.
+ *
+ * Auth on this surface is COOKIE-based (better-auth session cookies set by
+ * auth-web's `/api/auth/*` endpoints). Every request includes
+ * `credentials: 'include'` so the cookie carries across origins. We do NOT
+ * carry a bearer token — auth-web is the issuer; mounting `Authorization`
+ * headers here would mean re-encoding the cookie as a bearer, which is
+ * neither what better-auth expects nor safe to log.
+ *
+ * Hard rules (Constitution §`runtime/client` + AGENT-CONSTITUTION):
+ *   - NEVER log the password field, the request body of sign-in/sign-up, or
+ *     the resolved session payload's `session.id` / cookies.
+ *   - NEVER persist credentials here. Authority verdicts, bearer partitions and
+ *     the HMAC key live only in this runtime-owned client and clear on disposal.
+ *   - The `logger.warn` paths intentionally log only request paths, HTTP
+ *     status codes, and error class/message strings. Email is structurally
+ *     PII but is already exposed in the URL/body of `/api/auth/sign-in/email`
+ *     so logging it at warn level for diagnostics is acceptable; passwords
+ *     are NEVER touched.
+ *
+ * The descriptor may pin an endpoint. Otherwise the handed runtime resolves
+ * the declared infra/service auth origin in onLoad; absence is a typed error.
+ */
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { HttpTransportUnavailableError, readValidatedJson, requestValidated, resolveRequestTransport } from '@vibesdotdev/client/validated-request';
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { attempt, attemptSync, failureLabel } from "../features/utils/attempt.js";
+import { getLogger } from '@vibesdotdev/logging';
+import { readErrorBodyText, readJsonOrNull } from "../client/read-json-or-null.js";
+// The auth facade delegates to the canonical infra/service owner.
+import { resolveAuthOrigin } from "../config/env.js";
+import { AuthClientError } from "./auth.api-client.types.js";
+import { authProviderSignInPath, authProviderSignUpPath } from "./auth.api-client.urls.js";
+import { authSessionSchema, authUserSearchResponseSchema, authVoidResponseSchema, getSessionResponseSchema, authRevokeSessionResultSchema, authUserSessionSchema, authConnectedAccountListSchema, authEnabledSocialProvidersSchema, authLinkSocialInputSchema, authLinkSocialResultSchema, authUnlinkAccountResultSchema } from "./auth.api-client.schemas.js";
+import { selectCredential, resolveCredentialEnvironmentId } from "../features/services/credential-store.js";
+import { resolveAppJwtOwned, resolveFreshAppJwtOwned } from "../client/app-authority.js";
+import { credentialEnvironmentSchema, resolveAppJwtOptionsSchema, resolveFreshAppJwtOptionsSchema } from "../schemas/app-jwt.js";
+import { authAuthorityStateSchema } from "../schemas/authority-state.js";
+import { RegisteredOriginResolveResponseSchema, canonicalRegisteredOrigin } from "../schemas/registered-app.js";
+import { authInternalEndpoints } from "../system/internal-api/endpoints.js";
+import { AUTH_APP_CREDENTIALS_MANIFEST_ID, AuthAppCredentialsConfigSchema } from "../schemas/app-credentials.js";
+import { sessionVerificationStateSchema } from "../schemas/session-verification.js";
+import { DeviceSignInOptionsSchema } from "../schemas/consumer-auth.js";
+const DEFAULT_API_BASE = '/api/auth';
+/** Mint a fresh app token this long before the cached one expires. */
+const APP_TOKEN_EXPIRY_MARGIN_MS = 60_000;
+/** Better Auth's `client_credentials` token answer (RFC 6749 §5.1). */
+const appTokenResponseSchema = z.object({
+    access_token: z.string().min(1),
+    token_type: z.string(),
+    expires_in: z.number().int().positive()
+});
+/**
+ * Build an `AuthClientError` for a non-2xx response, preferring the server's
+ * `{ error }` message and falling back to a method-specific default. Used as the
+ * `mapHttpError` hook for the shared `requestValidated` path so the diagnostic
+ * message matches what callers historically saw.
+ */
+const errorBodySchema = z.object({ error: z.string().min(1).max(500) });
+function authHttpError(body, fallbackMessage, status) {
+    let message = fallbackMessage;
+    if (body) {
+        // An error body that is not JSON is expected (an HTML page); the fallback message stands.
+        // Only JSON's own SyntaxError is that; any other failure of the parse is not.
+        const parsed = attemptSync(() => errorBodySchema.safeParse(JSON.parse(body)));
+        if (parsed.ok) {
+            if (parsed.value.success)
+                message = parsed.value.data.error;
+        }
+        else if (!(parsed.failure instanceof SyntaxError)) {
+            throw parsed.failure;
+        }
+    }
+    return new AuthClientError(message, status);
+}
+/** `mapInvalid` hook: a 2xx body that doesn't match the expected shape. */
+function authInvalidResponse(label, status) {
+    return new AuthClientError(`Invalid ${label} response`, status);
+}
+/**
+ * Session cookies understood by the Vibes Auth Better Auth deployment.
+ *
+ * SSR consumers often carry unrelated application cookies. Forwarding the
+ * inbound Cookie header wholesale would turn the auth client into a credential
+ * exfiltration path, so only these session aliases may cross to auth-web.
+ */
+const AUTH_SESSION_COOKIE_NAMES = new Set([
+    'vibes.session',
+    '__Secure-vibes.session',
+    '__Host-vibes.session',
+    'better-auth.session_token',
+    '__Secure-better-auth.session_token',
+    '__Host-better-auth.session_token'
+]);
+function authSessionCookieHeader(cookieHeader) {
+    const allowed = cookieHeader
+        .split(';')
+        .map((part) => part.trim())
+        .filter((part) => {
+        const separator = part.indexOf('=');
+        return separator > 0 && AUTH_SESSION_COOKIE_NAMES.has(part.slice(0, separator).trim());
+    });
+    return allowed.length > 0 ? allowed.join('; ') : null;
+}
+/**
+ * Construct headers for one request without retaining request-scoped state on
+ * the singleton client. Browser calls rely on `credentials: include`; SSR
+ * calls explicitly forward only recognized Auth session cookies and a
+ * URL-derived Origin.
+ */
+function hasHeaderIterator(base) {
+    return !Array.isArray(base) && 'forEach' in base && base.forEach instanceof Function;
+}
+function authRequestHeaders(base, options) {
+    const headers = new Headers();
+    if (Array.isArray(base)) {
+        for (const [key, value] of base)
+            headers.set(key, value);
+    }
+    else if (hasHeaderIterator(base)) {
+        base.forEach((value, key) => headers.set(key, value));
+    }
+    else {
+        for (const [key, value] of Object.entries(base))
+            headers.set(key, value);
+    }
+    if (!options)
+        return headers;
+    const cookieHeader = options.request.headers.get('cookie');
+    const cookie = cookieHeader ? authSessionCookieHeader(cookieHeader) : null;
+    if (cookie)
+        headers.set('Cookie', cookie);
+    headers.set('Origin', new URL(options.request.url).origin);
+    return headers;
+}
+export class AuthApiClientConsumer extends BaseRuntimeClient {
+    async getCredential(environmentId) {
+        const parsed = credentialEnvironmentSchema.safeParse(environmentId);
+        if (!parsed.success)
+            throw new CapabilityError('Invalid credential environment.', 'INVALID_INPUT', { reason: 'credential-input-invalid' });
+        return selectCredential(this.runtime, parsed.data);
+    }
+    async resolveAppJwt(input = {}) {
+        const parsed = resolveAppJwtOptionsSchema.safeParse(input);
+        if (!parsed.success)
+            throw new CapabilityError('Invalid app JWT options.', 'INVALID_INPUT', { reason: 'app-jwt-input-invalid' });
+        const options = parsed.data;
+        const environment = options.loadCredentials ? options.environment : await resolveCredentialEnvironmentId(this.runtime, options.environment);
+        return resolveAppJwtOwned({
+            ...options, runtime: this.runtime, environment,
+            loadCredentials: options.loadCredentials ?? (() => this.getCredential(environment))
+        });
+    }
+    async resolveFreshAppJwt(input = {}) {
+        const parsed = resolveFreshAppJwtOptionsSchema.safeParse(input);
+        if (!parsed.success)
+            throw new CapabilityError('Invalid app JWT options.', 'INVALID_INPUT', { reason: 'app-jwt-input-invalid' });
+        const options = parsed.data;
+        return resolveFreshAppJwtOwned({
+            ...options, runtime: this.runtime,
+            loadCredentials: options.loadCredentials ?? (() => this.getCredential(options.environment))
+        });
+    }
+    async getStoredIdentity() {
+        if (!this.runtime.hasContext('auth/consumer-operations')) {
+            throw new CapabilityError('Consumer Auth operations are not composed.', 'UNAVAILABLE', { reason: 'consumer-auth-unavailable' });
+        }
+        const operations = await this.runtime.context('auth/consumer-operations');
+        return operations.getStoredIdentity();
+    }
+    async signInDevice(input = {}) {
+        const options = DeviceSignInOptionsSchema.parse(input);
+        if (!this.runtime.hasContext('auth/consumer-operations')) {
+            throw new CapabilityError('Consumer Auth operations are not composed.', 'UNAVAILABLE', { reason: 'consumer-auth-unavailable' });
+        }
+        const operations = await this.runtime.context('auth/consumer-operations');
+        return operations.signInDevice(options);
+    }
+    logger;
+    resolvedAuthOrigin;
+    apiBase;
+    sessionVerificationState = sessionVerificationStateSchema.parse({});
+    authorityState = authAuthorityStateSchema.parse({});
+    credentialMacKey;
+    /** App `client_credentials` tokens by client id; cleared on disposal. */
+    appTokens = new Map();
+    appTokenEpoch = 0;
+    async credentialMac(token) {
+        this.credentialMacKey ??= crypto.subtle.importKey('raw', crypto.getRandomValues(new Uint8Array(32)), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+        const mac = await crypto.subtle.sign('HMAC', await this.credentialMacKey, new TextEncoder().encode(token));
+        return Array.from(new Uint8Array(mac), byte => byte.toString(16).padStart(2, '0')).join('');
+    }
+    onDispose() {
+        this.sessionVerificationState.active = false;
+        this.sessionVerificationState.jwksByOrigin.clear();
+        this.sessionVerificationState.jwksForceRefreshAtMs.clear();
+        this.sessionVerificationState.jwksRefillInFlight.clear();
+        this.sessionVerificationState.apiKeyCache.clear();
+        this.authorityState.epoch++;
+        this.authorityState.verdicts.clear();
+        this.authorityState.bearers.clear();
+        this.credentialMacKey = undefined;
+        this.appTokenEpoch++;
+        this.appTokens.clear();
+    }
+    constructor(descriptor, context) {
+        if (!context?.runtime)
+            throw new CapabilityError('Auth client requires its caller runtime.', 'INVALID_INPUT', { reason: 'runtime-required', retryable: false });
+        super(descriptor, context);
+        this.logger = getLogger('auth.api-client', context.runtime);
+        // Precedence: explicit descriptor.baseUrl (surface declares), otherwise
+        // declared service origin in onLoad(). Never a
+        // bare-domain production literal invented here.
+        this.resolvedAuthOrigin = descriptor.baseUrl ?? null;
+        this.apiBase = DEFAULT_API_BASE;
+    }
+    /**
+     * Resolved auth origin used by the URL builders. FAIL-LOUD: throws when the
+     * origin has not been resolved yet — call `ensureLoaded()` first (the
+     * documented client contract) rather than reading a silently invented
+     * fallback.
+     */
+    get authOrigin() {
+        if (!this.resolvedAuthOrigin) {
+            throw new Error("auth origin not resolved yet: call ensureLoaded() before using the auth client's URL builders.");
+        }
+        return this.resolvedAuthOrigin;
+    }
+    async onLoad() {
+        // Preserve the base lifecycle (config-manifest loading etc.) before the
+        // origin step.
+        await super.onLoad();
+        if (this.resolvedAuthOrigin)
+            return;
+        // Resolve against THIS client's scoped runtime, not the ambient
+        // singleton — a client instantiated on a scoped child runtime must read
+        // that runtime's environment.
+        // `NOT_FOUND` `service-undeclared` when this runtime has no auth service.
+        this.resolvedAuthOrigin = await resolveAuthOrigin(this.runtime);
+    }
+    async signInEmail(input) {
+        await this.ensureLoaded();
+        const body = {
+            email: input.email,
+            password: input.password
+        };
+        if (input.rememberMe !== undefined)
+            body.rememberMe = input.rememberMe;
+        if (input.callbackURL)
+            body.callbackURL = input.callbackURL;
+        return requestValidated(this.buildUrl(`${this.apiBase}/sign-in/email`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify(body)
+        }, authSessionSchema, {
+            runtime: this.runtime,
+            mapHttpError: (response, errorBody) => authHttpError(errorBody, 'Sign-in failed', response.status),
+            mapInvalid: (_error, status) => authInvalidResponse('sign-in', status)
+        });
+    }
+    async signUpEmail(input) {
+        await this.ensureLoaded();
+        return requestValidated(this.buildUrl(`${this.apiBase}/sign-up/email`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({
+                email: input.email,
+                password: input.password,
+                name: input.name
+            })
+        }, authSessionSchema, {
+            runtime: this.runtime,
+            mapHttpError: (response, errorBody) => authHttpError(errorBody, 'Sign-up failed', response.status),
+            mapInvalid: (_error, status) => authInvalidResponse('sign-up', status)
+        });
+    }
+    async signOut() {
+        await this.ensureLoaded();
+        // Body is intentionally ignored; `requestValidated` still gives us the
+        // shared status check + error mapping.
+        await requestValidated(this.buildUrl(`${this.apiBase}/sign-out`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: { Accept: 'application/json' }
+        }, authVoidResponseSchema, {
+            runtime: this.runtime,
+            mapHttpError: (response, errorBody) => authHttpError(errorBody, 'Sign-out failed', response.status)
+        });
+    }
+    async getSession() {
+        await this.ensureLoaded();
+        // `/session` has two non-error "no session" paths: a 401, or a 200 with a
+        // null/empty body. Both must resolve to the signed-out shape, so the
+        // request flow stays bespoke and only the success body routes through the
+        // shared validator (`getSessionResponseSchema` normalizes null → empty).
+        const response = await fetch(this.buildUrl(`${this.apiBase}/session`), {
+            method: 'GET',
+            credentials: 'include',
+            headers: { Accept: 'application/json' }
+        });
+        if (response.status === 401) {
+            return { user: null, session: null };
+        }
+        if (!response.ok) {
+            throw authHttpError(await readErrorBodyText(response, this.runtime), 'Failed to load session', response.status);
+        }
+        return readValidatedJson(response, getSessionResponseSchema, {
+            mapInvalid: (_error, status) => authInvalidResponse('session', status)
+        });
+    }
+    async listSessions() {
+        await this.ensureLoaded();
+        const response = await fetch(this.buildUrl(`${this.apiBase}/list-sessions`), {
+            method: 'GET',
+            credentials: 'include',
+            headers: { Accept: 'application/json' }
+        });
+        if (!response.ok) {
+            throw authHttpError(await readErrorBodyText(response, this.runtime), 'Failed to list sessions', response.status);
+        }
+        // Best-effort, resilient parse (the historical behavior): a non-array body
+        // yields `[]` rather than throwing, and a single sparse/drifted row is
+        // skipped rather than nuking the whole list. A row without an `id`/`token`
+        // can't be acted on (revoke needs the token), so dropping it is correct.
+        const payload = await readJsonOrNull(response);
+        if (!Array.isArray(payload))
+            return [];
+        const sessions = [];
+        for (const row of payload) {
+            const parsed = authUserSessionSchema.safeParse(row);
+            if (parsed.success)
+                sessions.push(parsed.data);
+        }
+        return sessions;
+    }
+    async revokeSession(token) {
+        await this.ensureLoaded();
+        const response = await fetch(this.buildUrl(`${this.apiBase}/revoke-session`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({ token })
+        });
+        if (!response.ok) {
+            throw authHttpError(await readErrorBodyText(response, this.runtime), 'Failed to revoke session', response.status);
+        }
+        return readValidatedJson(response, authRevokeSessionResultSchema, {
+            mapInvalid: (_error, status) => authInvalidResponse('revoke-session', status)
+        });
+    }
+    async revokeOtherSessions() {
+        await this.ensureLoaded();
+        const response = await fetch(this.buildUrl(`${this.apiBase}/revoke-other-sessions`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: { Accept: 'application/json' }
+        });
+        if (!response.ok) {
+            throw authHttpError(await readErrorBodyText(response, this.runtime), 'Failed to revoke other sessions', response.status);
+        }
+        return readValidatedJson(response, authRevokeSessionResultSchema, {
+            mapInvalid: (_error, status) => authInvalidResponse('revoke-session', status)
+        });
+    }
+    async revokeAllSessions() {
+        await this.ensureLoaded();
+        const response = await fetch(this.buildUrl(`${this.apiBase}/revoke-sessions`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: { Accept: 'application/json' }
+        });
+        if (!response.ok) {
+            throw authHttpError(await readErrorBodyText(response, this.runtime), 'Failed to revoke sessions', response.status);
+        }
+        return readValidatedJson(response, authRevokeSessionResultSchema, {
+            mapInvalid: (_error, status) => authInvalidResponse('revoke-session', status)
+        });
+    }
+    async listAccounts(options) {
+        await this.ensureLoaded();
+        return requestValidated(this.buildUrl(`${this.apiBase}/list-accounts`), {
+            method: 'GET',
+            credentials: 'include',
+            headers: authRequestHeaders({ Accept: 'application/json' }, options)
+        }, authConnectedAccountListSchema, {
+            runtime: this.runtime,
+            mapHttpError: (response, errorBody) => authHttpError(errorBody, 'Failed to list connected accounts', response.status),
+            mapInvalid: (_error, status) => authInvalidResponse('connected accounts', status)
+        });
+    }
+    async listEnabledSocialProviders() {
+        await this.ensureLoaded();
+        return requestValidated(this.buildUrl('/api/health'), {
+            method: 'GET',
+            credentials: 'omit',
+            cache: 'no-store',
+            headers: { Accept: 'application/json' }
+        }, authEnabledSocialProvidersSchema, {
+            runtime: this.runtime,
+            mapHttpError: (response, errorBody) => authHttpError(errorBody, 'Failed to list available sign-in providers', response.status),
+            mapInvalid: (_error, status) => authInvalidResponse('sign-in providers', status)
+        });
+    }
+    async linkSocial(input, options) {
+        await this.ensureLoaded();
+        const validated = authLinkSocialInputSchema.parse(input);
+        return requestValidated(this.buildUrl(`${this.apiBase}/link-social`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: authRequestHeaders({ 'Content-Type': 'application/json', Accept: 'application/json' }, options),
+            body: JSON.stringify({ ...validated, disableRedirect: true })
+        }, authLinkSocialResultSchema, {
+            runtime: this.runtime,
+            mapHttpError: (response, errorBody) => authHttpError(errorBody, 'Failed to start account linking', response.status),
+            mapInvalid: (_error, status) => authInvalidResponse('account-linking', status)
+        });
+    }
+    async unlinkAccount(accountId, options) {
+        await this.ensureLoaded();
+        if (!accountId.trim())
+            throw new AuthClientError('Account id is required', 400);
+        return requestValidated(this.buildUrl(`${this.apiBase}/unlink-account`), {
+            method: 'POST',
+            credentials: 'include',
+            headers: authRequestHeaders({ 'Content-Type': 'application/json', Accept: 'application/json' }, options),
+            body: JSON.stringify({ accountId })
+        }, authUnlinkAccountResultSchema, {
+            runtime: this.runtime,
+            mapHttpError: (response, errorBody) => authHttpError(errorBody, 'Failed to unlink account', response.status),
+            mapInvalid: (_error, status) => authInvalidResponse('unlink-account', status)
+        });
+    }
+    async searchUsers(options) {
+        await this.ensureLoaded();
+        const query = options.query.trim();
+        if (!query)
+            return [];
+        const response = await fetch(this.buildUrl('/api/users/search', {
+            q: query,
+            limit: options.limit !== undefined ? String(options.limit) : undefined,
+            offset: options.offset !== undefined ? String(options.offset) : undefined,
+            exclude: options.exclude && options.exclude.length > 0 ? options.exclude.join(',') : undefined
+        }), {
+            method: 'GET',
+            credentials: 'include',
+            headers: { Accept: 'application/json' }
+        });
+        // User search is best-effort: a non-2xx or unparseable body yields no
+        // results rather than surfacing an error to the search box.
+        if (!response.ok)
+            return [];
+        const read = await attempt(() => readValidatedJson(response, authUserSearchResponseSchema));
+        if (read.ok)
+            return read.value.items ?? read.value.users ?? [];
+        this.logger.warn('User search response was not a valid result list; returning no results', {
+            failure: failureLabel(read.failure)
+        });
+        return [];
+    }
+    async resolveRegisteredOrigin(origin) {
+        const canonical = canonicalRegisteredOrigin(origin);
+        if (!canonical)
+            return null;
+        await this.ensureLoaded();
+        const credential = await this.appCredential();
+        const url = this.buildUrl(authInternalEndpoints.registeredAppsResolve);
+        const transport = await resolveRequestTransport({ runtime: this.runtime });
+        if (!transport)
+            throw new HttpTransportUnavailableError(url);
+        const ask = async (token) => transport(url, {
+            method: 'POST',
+            credentials: 'omit',
+            cache: 'no-store',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+                Authorization: `Bearer ${token}`
+            },
+            body: JSON.stringify({ origin: canonical })
+        });
+        let response = await ask(await this.appToken(credential));
+        if (response.status === 401) {
+            // A cached token Auth no longer honours (revoked, rotated): mint once more.
+            this.dropAppToken(credential.clientId);
+            response = await ask(await this.appToken(credential));
+        }
+        if (!response.ok) {
+            throw authHttpError(await readErrorBodyText(response, this.runtime), 'Failed to resolve the registered app for an origin', response.status);
+        }
+        const answer = await readValidatedJson(response, RegisteredOriginResolveResponseSchema, {
+            mapInvalid: (_error, status) => authInvalidResponse('registered-app', status)
+        });
+        return answer.app;
+    }
+    /** This app's own Auth client credential, from the `auth.app-credentials` references. */
+    async appCredential() {
+        const manifest = await this.runtime
+            .query('config/manifest')
+            .withId(AUTH_APP_CREDENTIALS_MANIFEST_ID)
+            .resolve();
+        const config = AuthAppCredentialsConfigSchema.parse((await manifest.load()) ?? {});
+        if (!config.clientId || !config.clientSecret) {
+            throw new CapabilityError("Registered-app resolution needs this app's own Auth credential: set auth.app-credentials clientId and clientSecret.", 'UNAVAILABLE', { reason: 'registered-origin-app-credential-unconfigured', retryable: false });
+        }
+        const [clientId, clientSecret] = await Promise.all([
+            this.runtime.resolveCredential(config.clientId),
+            this.runtime.resolveCredential(config.clientSecret)
+        ]);
+        for (const result of [clientId, clientSecret]) {
+            if (!result.ok) {
+                throw new CapabilityError("This app's Auth credential named by auth.app-credentials could not be read.", 'UNAVAILABLE', { reason: 'registered-origin-app-credential-unavailable', retryable: false, cause: result.error });
+            }
+        }
+        if (!clientId.ok || !clientSecret.ok || !clientId.value.trim() || !clientSecret.value.trim()) {
+            throw new CapabilityError("This app's Auth credential named by auth.app-credentials is empty.", 'UNAVAILABLE', { reason: 'registered-origin-app-credential-unavailable', retryable: false });
+        }
+        return { clientId: clientId.value.trim(), clientSecret: clientSecret.value.trim() };
+    }
+    /**
+     * A `client_credentials` access token for this app, cached until shortly
+     * before it expires. Concurrent callers share one mint. No scope is sent, so
+     * Auth grants every app-registry scope the registrar gave this client.
+     */
+    appToken(credential) {
+        const cached = this.appTokens.get(credential.clientId);
+        if (cached && ('pending' in cached || cached.expiresAt - APP_TOKEN_EXPIRY_MARGIN_MS > Date.now())) {
+            return 'pending' in cached ? cached.pending : Promise.resolve(cached.token);
+        }
+        const epoch = this.appTokenEpoch;
+        const pending = (async () => {
+            const basic = btoa(`${encodeURIComponent(credential.clientId)}:${encodeURIComponent(credential.clientSecret)}`);
+            const minted = await requestValidated(this.buildUrl(`${this.apiBase}/oauth2/token`), {
+                method: 'POST',
+                credentials: 'omit',
+                cache: 'no-store',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    Accept: 'application/json',
+                    Authorization: `Basic ${basic}`
+                },
+                body: new URLSearchParams({ grant_type: 'client_credentials' }).toString()
+            }, appTokenResponseSchema, {
+                runtime: this.runtime,
+                mapHttpError: (response, errorBody) => authHttpError(errorBody, "Auth refused this app's client credential", response.status),
+                mapInvalid: (_error, status) => authInvalidResponse('app token', status)
+            });
+            const expiresAt = Date.now() + minted.expires_in * 1000;
+            if (epoch === this.appTokenEpoch)
+                this.appTokens.set(credential.clientId, { token: minted.access_token, expiresAt });
+            return minted.access_token;
+        })();
+        this.appTokens.set(credential.clientId, { pending });
+        pending.catch(() => {
+            const current = this.appTokens.get(credential.clientId);
+            if (current && 'pending' in current && current.pending === pending)
+                this.appTokens.delete(credential.clientId);
+        });
+        return pending;
+    }
+    dropAppToken(clientId) {
+        this.appTokens.delete(clientId);
+    }
+    providerSignInUrl(providerId, opts) {
+        return this.buildUrl(authProviderSignInPath(providerId, {
+            redirectTo: opts?.redirectTo,
+            signInPath: opts?.signInPath ?? `${this.apiBase}/sign-in/${encodeURIComponent(providerId)}`
+        }));
+    }
+    providerSignUpUrl(providerId, opts) {
+        return this.buildUrl(authProviderSignUpPath(providerId, {
+            redirectTo: opts?.redirectTo,
+            signUpPath: opts?.signUpPath ?? `${this.apiBase}/sign-up/${encodeURIComponent(providerId)}`
+        }));
+    }
+    // --- internals ----------------------------------------------------------
+    buildUrl(path, query) {
+        const u = new URL(`${this.authOrigin}${path}`);
+        if (query) {
+            for (const [k, v] of Object.entries(query)) {
+                if (v !== undefined)
+                    u.searchParams.set(k, v);
+            }
+        }
+        return u.toString();
+    }
+}
+export default AuthApiClientConsumer;
+//# sourceMappingURL=auth.api-client.impl.js.map

package/dist/api/auth.api-client.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.impl.js","sourceRoot":"","sources":["../../src/api/auth.api-client.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,iBAAiB,EAAgC,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EACN,6BAA6B,EAC7B,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACnF,kEAAkE;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACN,eAAe,EAcf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EACN,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,gCAAgC,EAChC,yBAAyB,EACzB,0BAA0B,EAC1B,6BAA6B,EAC7B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC5G,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EACN,2BAA2B,EAAE,0BAA0B,EAAE,+BAA+B,EAExF,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EACN,qCAAqC,EACrC,yBAAyB,EAEzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAEjH,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEpF,OAAO,EACN,yBAAyB,EACzB,MAAM,6BAA6B,CAAC;AAErC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC,sEAAsE;AACtE,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAExE,SAAS,aAAa,CAAC,IAAY,EAAE,eAAuB,EAAE,MAAc;IAC3E,IAAI,OAAO,GAAG,eAAe,CAAC;IAC9B,IAAI,IAAI,EAAE,CAAC;QACV,0FAA0F;QAC1F,8EAA8E;QAC9E,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7D,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,MAAM,CAAC,OAAO,CAAC;QACtB,CAAC;IACF,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,SAAS,mBAAmB,CAAC,KAAa,EAAE,MAAc;IACzD,OAAO,IAAI,eAAe,CAAC,WAAW,KAAK,WAAW,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,eAAe;IACf,wBAAwB;IACxB,sBAAsB;IACtB,2BAA2B;IAC3B,oCAAoC;IACpC,kCAAkC;CAClC,CAAC,CAAC;AAEH,SAAS,uBAAuB,CAAC,YAAoB;IACpD,MAAM,OAAO,GAAG,YAAY;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACJ,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACzB,IAA0B;IAE1B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,YAAY,QAAQ,CAAC;AACtF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA0B,EAAE,OAA+B;IACtF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,iBAAiB;IAC3D,KAAK,CAAC,aAAa,CAAC,aAAsB;QACzC,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC3I,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAA8B,EAAE;QACnD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACjI,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,8BAA8B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5I,OAAO,kBAAkB,CAAC;YACzB,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;SACnF,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAiC,EAAE;QAC3D,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACjI,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QAC5B,OAAO,uBAAuB,CAAC;YAC9B,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YACjC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SAC3F,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAyB,0BAA0B,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC,iBAAiB,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAA6B,EAAE;QACjD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAyB,0BAA0B,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEgB,MAAM,CAA+B;IAC9C,kBAAkB,CAAgB;IACzB,OAAO,CAAS;IACxB,wBAAwB,GAAG,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,cAAc,GAAG,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrD,gBAAgB,CAAsB;IAC9C,yEAAyE;IACxD,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IACtD,aAAa,GAAG,CAAC,CAAC;IAE1B,KAAK,CAAC,aAAa,CAAC,KAAa;QAChC,IAAI,CAAC,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAChD,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EACjD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAClD,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAEkB,SAAS;QAC3B,IAAI,CAAC,wBAAwB,CAAC,MAAM,GAAG,KAAK,CAAC;QAC7C,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnD,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzD,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAClD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAGD,YACC,UAAmC,EACnC,OAAkC;QAElC,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,0CAA0C,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAChK,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,wEAAwE;QACxE,+CAA+C;QAC/C,gDAAgD;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACb,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACd,gGAAgG,CAChG,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IAChC,CAAC;IAEkB,KAAK,CAAC,MAAM;QAC9B,wEAAwE;QACxE,eAAe;QACf,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO;QACpC,gEAAgE;QAChE,wEAAwE;QACxE,8BAA8B;QAC9B,0EAA0E;QAC1E,IAAI,CAAC,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA+B;QAChD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAS1B,MAAM,IAAI,GAAoB;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACxB,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACvE,IAAI,KAAK,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QAC5D,OAAO,gBAAgB,CACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,CAAC,EAC9C;YACC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,EACD,iBAAiB,EACjB;YACC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC;YAC5D,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC;SACrF,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC7C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,CAAC,EAC9C;YACC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;aAChB,CAAC;SACF,EACD,iBAAiB,EACjB;YACC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC;YAC5D,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC;SACrF,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,gBAAgB,CACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,WAAW,CAAC,EACzC;YACC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,EACD,sBAAsB,EACtB;YACC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC;SAC7D,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACf,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,UAAU,CAAC,EAAE;YACtE,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,aAAa,CAClB,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/C,wBAAwB,EACxB,QAAQ,CAAC,MAAM,CACf,CAAC;QACH,CAAC;QACD,OAAO,iBAAiB,CAAc,QAAQ,EAAE,wBAAwB,EAAE;YACzE,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC;SACrF,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY;QACjB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,CAAC,EAAE;YAC5E,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,aAAa,CAClB,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/C,yBAAyB,EACzB,QAAQ,CAAC,MAAM,CACf,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAChC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,aAAa,CAClB,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/C,0BAA0B,EAC1B,QAAQ,CAAC,MAAM,CACf,CAAC;QACH,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,6BAA6B,EAAE;YACjE,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC;SAC5F,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,wBAAwB,CAAC,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,aAAa,CAClB,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/C,iCAAiC,EACjC,QAAQ,CAAC,MAAM,CACf,CAAC;QACH,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,6BAA6B,EAAE;YACjE,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC;SAC5F,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB;QACtB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,kBAAkB,CAAC,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,aAAa,CAClB,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/C,2BAA2B,EAC3B,QAAQ,CAAC,MAAM,CACf,CAAC;QACH,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,6BAA6B,EAAE;YACjE,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC;SAC5F,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,CAAC,EAC9C;YACC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,OAAO,CAAC;SACpE,EACD,8BAA8B,EAC9B;YACC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,mCAAmC,EAAE,QAAQ,CAAC,MAAM,CAAC;YAC/E,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,MAAM,CAAC;SAChG,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,0BAA0B;QAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CACtB,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC5B;YACC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,EACD,gCAAgC,EAChC;YACC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,4CAA4C,EAAE,QAAQ,CAAC,MAAM,CAAC;YACxF,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC;SAC/F,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CACf,KAA0B,EAC1B,OAA+B;QAE/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,gBAAgB,CACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,CAAC,EAC5C;YACC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,kBAAkB,CAC1B,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAClE,OAAO,CACP;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;SAC7D,EACD,0BAA0B,EAC1B;YACC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,iCAAiC,EAAE,QAAQ,CAAC,MAAM,CAAC;YAC7E,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,CAAC;SAC7F,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,SAAiB,EACjB,OAA+B;QAE/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAChF,OAAO,gBAAgB,CACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC,EAC/C;YACC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,kBAAkB,CAC1B,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAClE,OAAO,CACP;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;SACnC,EACD,6BAA6B,EAC7B;YACC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC;YACtE,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC;SAC5F,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAA8B;QAC/C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE;YAClC,CAAC,EAAE,KAAK;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACtE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzE,OAAO,EACN,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;SACtF,CAAC,EACF;YACC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CACD,CAAC;QACF,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE;YAC1F,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAC3C,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE,CACnC,SAAS,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;aAChC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;SAC3C,CAAC,CAAC;QACJ,IAAI,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,4EAA4E;YAC5E,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvC,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,aAAa,CAClB,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/C,oDAAoD,EACpD,QAAQ,CAAC,MAAM,CACf,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,qCAAqC,EAAE;YACvF,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC;SAC5F,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC;IACnB,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,aAAa;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO;aACjC,KAAK,CAAsC,iBAAiB,CAAC;aAC7D,MAAM,CAAC,gCAAgC,CAAC;aACxC,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CACxB,qHAAqH,EACrH,aAAa,EACb,EAAE,MAAM,EAAE,+CAA+C,EAAE,SAAS,EAAE,KAAK,EAAE,CAC7E,CAAC;QACH,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,eAAe,CACxB,6EAA6E,EAC7E,aAAa,EACb,EAAE,MAAM,EAAE,8CAA8C,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACjG,CAAC;YACH,CAAC;QACF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9F,MAAM,IAAI,eAAe,CACxB,oEAAoE,EACpE,aAAa,EACb,EAAE,MAAM,EAAE,8CAA8C,EAAE,SAAS,EAAE,KAAK,EAAE,CAC5E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,UAAsD;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,MAAM,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,0BAA0B,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnG,OAAO,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAChH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,eAAe,CAAC,EAC7C;gBACC,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,MAAM;gBACnB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE;oBACR,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,SAAS,KAAK,EAAE;iBAC/B;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,QAAQ,EAAE;aAC1E,EACD,sBAAsB,EACtB;gBACC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,CAAC,QAAkB,EAAE,SAAiB,EAAE,EAAE,CACvD,aAAa,CAAC,SAAS,EAAE,2CAA2C,EAAE,QAAQ,CAAC,MAAM,CAAC;gBACvF,UAAU,EAAE,CAAC,MAAa,EAAE,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC;aACvF,CACD,CAAC;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;YACxD,IAAI,KAAK,KAAK,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;YACrH,OAAO,MAAM,CAAC,YAAY,CAAC;QAC5B,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,OAAO,IAAI,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,QAAgB;QACpC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,iBAAiB,CAChB,UAA0B,EAC1B,IAAmD;QAEnD,OAAO,IAAI,CAAC,QAAQ,CACnB,sBAAsB,CAAC,UAAU,EAAE;YAClC,UAAU,EAAE,IAAI,EAAE,UAAU;YAC5B,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,GAAG,IAAI,CAAC,OAAO,YAAY,kBAAkB,CAAC,UAAU,CAAC,EAAE;SAC3F,CAAC,CACF,CAAC;IACH,CAAC;IAED,iBAAiB,CAChB,UAA0B,EAC1B,IAAmD;QAEnD,OAAO,IAAI,CAAC,QAAQ,CACnB,sBAAsB,CAAC,UAAU,EAAE;YAClC,UAAU,EAAE,IAAI,EAAE,UAAU;YAC5B,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,GAAG,IAAI,CAAC,OAAO,YAAY,kBAAkB,CAAC,UAAU,CAAC,EAAE;SAC3F,CAAC,CACF,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,QAAQ,CAAC,IAAY,EAAE,KAA0C;QACxE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,SAAS;oBAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,CAAC;QACF,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;CACD;AAED,eAAe,qBAAqB,CAAC"}