@zitadel/components 0.0.0

package/dist/orchestrator-CNKo2WQG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator-CNKo2WQG.mjs","names":["err","props","apiStartFlow","apiSubmitStep"],"sources":["../../api/dist/runtime/base-url.mjs","../../api/dist/runtime/auth.mjs","../../api/dist/chunk-CfYAbeIz.mjs","../../api/dist/runtime/fetch.mjs","../../api/dist/generated/endpoints/zitadelNextGen.mjs","../../api/dist/runtime/api-factory.mjs","../../api/dist/runtime/config.mjs","../src/orchestrator/api-client.ts","../src/orchestrator/branding-to-tokens.ts","../../api/dist/generated/model/index.mjs","../src/orchestrator/branding-validator.ts","../src/orchestrator/font-loader.ts","../src/orchestrator/mandatory-gates.ts","../src/orchestrator/templates/auth-form.liquid.ts","../src/orchestrator/templates/default.liquid.ts","../src/orchestrator/templates/passkey-upsell.liquid.ts","../src/orchestrator/templates/signed-in.liquid.ts","../src/orchestrator/template-names.ts","../src/orchestrator/liquid.ts","../src/orchestrator/locales/en.ts","../src/orchestrator/locales/de.ts","../src/orchestrator/locales/index.ts","../../shared-component-styles/dist/attribution-markup.mjs","../src/orchestrator/sanitiser.ts","../src/orchestrator/theme-controller.ts","../src/orchestrator/zitadel-login.ts","../src/orchestrator/zitadel-logout.ts"],"sourcesContent":["//#region src/runtime/base-url.ts\nlet proxyPath = \"\";\nfunction getProxyPath() {\n\treturn proxyPath;\n}\nfunction setProxyPath(path) {\n\tproxyPath = path;\n}\n//#endregion\nexport { getProxyPath, setProxyPath };\n\n//# sourceMappingURL=base-url.mjs.map","//#region src/runtime/auth.ts\n/**\n* Module-global bearer token used by the orval-generated client's\n* custom fetch. Set once at command boot (the same lifecycle pattern\n* as `base-url.ts`); every generated request reads from here.\n*\n* Keeping the token here means the CLI doesn't have to thread an\n* `Authorization` header through every generated call site; orval's\n* `mutator` wires `runtime/fetch.ts` in, and that file pulls the token\n* from this module.\n*/\nlet apiAuthToken;\nfunction getApiAuthToken() {\n\treturn apiAuthToken;\n}\nfunction setApiAuthToken(token) {\n\tapiAuthToken = token;\n}\n//#endregion\nexport { getApiAuthToken, setApiAuthToken };\n\n//# sourceMappingURL=auth.mjs.map","//#region \\0rolldown/runtime.js\nvar __defProp = Object.defineProperty;\nvar __exportAll = (all, no_symbols) => {\n\tlet target = {};\n\tfor (var name in all) __defProp(target, name, {\n\t\tget: all[name],\n\t\tenumerable: true\n\t});\n\tif (!no_symbols) __defProp(target, Symbol.toStringTag, { value: \"Module\" });\n\treturn target;\n};\n//#endregion\nexport { __exportAll as t };\n","import { getApiAuthToken } from \"./auth.mjs\";\n//#region src/runtime/fetch.ts\n/**\n* Framework-neutral failure type the orval-generated client throws on\n* any non-2xx response. Carries the HTTP status, the parsed error body\n* (the spec's `{code, message, details?}` envelope when the server\n* returned one), and the request URL — enough for callers to map to\n* their own error taxonomy without re-implementing the fetch layer.\n*\n* Callers that don't care about the distinction can catch `ApiError`\n* generically; callers that do (the CLI's `toZitadelError`) read\n* `status` and decide.\n*/\nvar ApiError = class extends Error {\n\tstatus;\n\turl;\n\tbody;\n\tconstructor(status, url, body, message) {\n\t\tsuper(message);\n\t\tthis.name = \"ApiError\";\n\t\tthis.status = status;\n\t\tthis.url = url;\n\t\tthis.body = body;\n\t}\n};\n/**\n* The orval `mutator` for the fetch client. Every generated operation\n* routes its request through this function instead of the global\n* `fetch`. We pin three concerns here so generated call sites stay\n* focused on the shape of one HTTP call:\n*\n* - bearer auth — read from `runtime/auth.ts` and attached automatically;\n* - non-2xx → throw — orval's stock client parses the body regardless\n*   of status, so callers would have to inspect every response. Throw\n*   `ApiError` on `!res.ok` so failures interrupt control flow;\n* - body parsing — return the parsed JSON typed as `T` (the operation's\n*   return type, threaded through by orval), or `undefined` for the\n*   spec's `204`/`205`/`304` no-body responses.\n*/\nasync function customFetch(url, options) {\n\tconst token = getApiAuthToken();\n\tconst headers = new Headers(options.headers);\n\tif (token && !headers.has(\"authorization\")) headers.set(\"authorization\", `Bearer ${token}`);\n\tconst res = await fetch(url, {\n\t\t...options,\n\t\theaders\n\t});\n\tconst rawBody = [\n\t\t204,\n\t\t205,\n\t\t304\n\t].includes(res.status) ? \"\" : await res.text();\n\tconst parsed = rawBody ? safeJsonParse(rawBody) : void 0;\n\tif (!res.ok) {\n\t\tconst message = `${options.method ?? \"GET\"} ${url} returned ${res.status}`;\n\t\tthrow new ApiError(res.status, url, parsed, message);\n\t}\n\treturn parsed;\n}\n/**\n* `JSON.parse` wrapped so a non-JSON body (e.g. an HTML 502 from a\n* proxy) becomes `{ raw: \"<text>\" }` instead of throwing inside\n* `customFetch`. The thrown `ApiError` then carries something useful\n* for the user to see.\n*/\nfunction safeJsonParse(text) {\n\ttry {\n\t\treturn JSON.parse(text);\n\t} catch {\n\t\treturn { raw: text };\n\t}\n}\n//#endregion\nexport { ApiError, customFetch };\n\n//# sourceMappingURL=fetch.mjs.map","import { t as __exportAll } from \"../../chunk-CfYAbeIz.mjs\";\nimport { getProxyPath } from \"../../runtime/base-url.mjs\";\nimport { customFetch } from \"../../runtime/fetch.mjs\";\n//#region src/generated/endpoints/zitadelNextGen.ts\n/**\n* Generated by orval v8.10.0 🍺\n* Do not edit manually.\n* Zitadel NextGen\n* This is the next generation of the Zitadel identity platform.\n* OpenAPI spec version: 0.0.1\n*/\nvar zitadelNextGen_exports = /* @__PURE__ */ __exportAll({\n\tauthorizeDevice: () => authorizeDevice,\n\tauthorizeGet: () => authorizeGet,\n\tcreateAuthAttempt: () => createAuthAttempt,\n\tcreateFlow: () => createFlow,\n\tcreateFlowDefinition: () => createFlowDefinition,\n\tcreateHandoff: () => createHandoff,\n\tcreateProject: () => createProject,\n\tcreateSchema: () => createSchema,\n\tcreateSession: () => createSession,\n\tcreateTeam: () => createTeam,\n\tcreateUser: () => createUser,\n\tdeleteFlowDefinition: () => deleteFlowDefinition,\n\tendSession: () => endSession,\n\texchangeHandoff: () => exchangeHandoff,\n\tgetAuthAttempt: () => getAuthAttempt,\n\tgetAuthorizeDeviceUrl: () => getAuthorizeDeviceUrl,\n\tgetAuthorizeGetUrl: () => getAuthorizeGetUrl,\n\tgetCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,\n\tgetCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,\n\tgetCreateFlowUrl: () => getCreateFlowUrl,\n\tgetCreateHandoffUrl: () => getCreateHandoffUrl,\n\tgetCreateProjectUrl: () => getCreateProjectUrl,\n\tgetCreateSchemaUrl: () => getCreateSchemaUrl,\n\tgetCreateSessionUrl: () => getCreateSessionUrl,\n\tgetCreateTeamUrl: () => getCreateTeamUrl,\n\tgetCreateUserUrl: () => getCreateUserUrl,\n\tgetDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,\n\tgetEndSessionUrl: () => getEndSessionUrl,\n\tgetExchangeHandoffUrl: () => getExchangeHandoffUrl,\n\tgetFlowDefinition: () => getFlowDefinition,\n\tgetFlowStep: () => getFlowStep,\n\tgetGetAuthAttemptUrl: () => getGetAuthAttemptUrl,\n\tgetGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,\n\tgetGetFlowStepUrl: () => getGetFlowStepUrl,\n\tgetGetHealthUrl: () => getGetHealthUrl,\n\tgetGetKeysUrl: () => getGetKeysUrl,\n\tgetGetLiveUrl: () => getGetLiveUrl,\n\tgetGetMySessionUrl: () => getGetMySessionUrl,\n\tgetGetOpenIDConfigurationUrl: () => getGetOpenIDConfigurationUrl,\n\tgetGetProjectUrl: () => getGetProjectUrl,\n\tgetGetReadyUrl: () => getGetReadyUrl,\n\tgetGetSchemaByIdUrl: () => getGetSchemaByIdUrl,\n\tgetGetSessionUrl: () => getGetSessionUrl,\n\tgetGetTeamUrl: () => getGetTeamUrl,\n\tgetGetTokenUrl: () => getGetTokenUrl,\n\tgetGetUserByIDUrl: () => getGetUserByIDUrl,\n\tgetGetUserInfoUrl: () => getGetUserInfoUrl,\n\tgetHealth: () => getHealth,\n\tgetIntrospectUrl: () => getIntrospectUrl,\n\tgetIssueChallengeUrl: () => getIssueChallengeUrl,\n\tgetKeys: () => getKeys,\n\tgetListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,\n\tgetListSessionsUrl: () => getListSessionsUrl,\n\tgetListUsersUrl: () => getListUsersUrl,\n\tgetLive: () => getLive,\n\tgetMySession: () => getMySession,\n\tgetOpenIDConfiguration: () => getOpenIDConfiguration,\n\tgetProject: () => getProject,\n\tgetReady: () => getReady,\n\tgetRevokeMySessionUrl: () => getRevokeMySessionUrl,\n\tgetRevokeSessionUrl: () => getRevokeSessionUrl,\n\tgetRevokeTokenUrl: () => getRevokeTokenUrl,\n\tgetSchemaById: () => getSchemaById,\n\tgetSession: () => getSession,\n\tgetSubmitFlowEventUrl: () => getSubmitFlowEventUrl,\n\tgetSubmitFlowStepUrl: () => getSubmitFlowStepUrl,\n\tgetTeam: () => getTeam,\n\tgetToken: () => getToken,\n\tgetUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,\n\tgetUserByID: () => getUserByID,\n\tgetUserInfo: () => getUserInfo,\n\tgetVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,\n\tintrospect: () => introspect,\n\tissueChallenge: () => issueChallenge,\n\tlistFlowDefinitions: () => listFlowDefinitions,\n\tlistSessions: () => listSessions,\n\tlistUsers: () => listUsers,\n\trevokeMySession: () => revokeMySession,\n\trevokeSession: () => revokeSession,\n\trevokeToken: () => revokeToken,\n\tsubmitFlowEvent: () => submitFlowEvent,\n\tsubmitFlowStep: () => submitFlowStep,\n\tupdateFlowDefinition: () => updateFlowDefinition,\n\tverifyChallengeProof: () => verifyChallengeProof\n});\nconst getGetOpenIDConfigurationUrl = () => {\n\treturn `${getProxyPath()}/.well-known/openid-configuration`;\n};\n/**\n* Retrieve the OpenID Connect configuration\n* @summary Get OpenID Connect configuration\n*/\nconst getOpenIDConfiguration = async (options) => {\n\treturn customFetch(getGetOpenIDConfigurationUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getAuthorizeGetUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/auth/authorize?${stringifiedParams}` : `${getProxyPath()}/auth/authorize`;\n};\n/**\n* @summary Authorize a user\n*/\nconst authorizeGet = async (params, options) => {\n\treturn customFetch(getAuthorizeGetUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getAuthorizeDeviceUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}` : `${getProxyPath()}/auth/device-authorization`;\n};\n/**\n* @summary Authorize a device\n*/\nconst authorizeDevice = async (params, options) => {\n\treturn customFetch(getAuthorizeDeviceUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getEndSessionUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/auth/end-session?${stringifiedParams}` : `${getProxyPath()}/auth/end-session`;\n};\n/**\n* @summary End a session\n*/\nconst endSession = async (params, options) => {\n\treturn customFetch(getEndSessionUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getIntrospectUrl = () => {\n\treturn `${getProxyPath()}/auth/introspect`;\n};\n/**\n* @summary Introspect a token\n*/\nconst introspect = async (introspectBody, options) => {\n\tconst formUrlEncoded = new URLSearchParams();\n\tformUrlEncoded.append(`token`, introspectBody.token);\n\tif (introspectBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);\n\treturn customFetch(getIntrospectUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: formUrlEncoded\n\t});\n};\nconst getGetKeysUrl = () => {\n\treturn `${getProxyPath()}/auth/keys`;\n};\n/**\n* @summary Get public keys\n*/\nconst getKeys = async (options) => {\n\treturn customFetch(getGetKeysUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getRevokeTokenUrl = () => {\n\treturn `${getProxyPath()}/auth/revoke`;\n};\n/**\n* @summary Revoke an access token or refresh token\n*/\nconst revokeToken = async (revokeTokenBody, options) => {\n\tconst formUrlEncoded = new URLSearchParams();\n\tif (revokeTokenBody.token !== void 0) formUrlEncoded.append(`token`, revokeTokenBody.token);\n\tif (revokeTokenBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);\n\treturn customFetch(getRevokeTokenUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: formUrlEncoded\n\t});\n};\nconst getGetTokenUrl = () => {\n\treturn `${getProxyPath()}/auth/token`;\n};\n/**\n* @summary Get accesstoken\n*/\nconst getToken = async (getTokenBody, options) => {\n\tconst formUrlEncoded = new URLSearchParams();\n\tif (getTokenBody.code !== void 0) formUrlEncoded.append(`code`, getTokenBody.code);\n\tif (getTokenBody.client_assertion !== void 0) formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);\n\tif (getTokenBody.client_assertion_type !== void 0) formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);\n\tif (getTokenBody.client_id !== void 0) formUrlEncoded.append(`client_id`, getTokenBody.client_id);\n\tif (getTokenBody.client_secret !== void 0) formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);\n\tif (getTokenBody.code_verifier !== void 0) formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);\n\tif (getTokenBody.grant_type !== void 0) formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);\n\tif (getTokenBody.redirect_uri !== void 0) formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);\n\treturn customFetch(getGetTokenUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: formUrlEncoded\n\t});\n};\nconst getGetUserInfoUrl = () => {\n\treturn `${getProxyPath()}/auth/userinfo`;\n};\n/**\n* @summary Get user info\n*/\nconst getUserInfo = async (options) => {\n\treturn customFetch(getGetUserInfoUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetHealthUrl = () => {\n\treturn `${getProxyPath()}/healthz`;\n};\n/**\n* Check whether the server is healthy\n* @summary Check server health\n*/\nconst getHealth = async (options) => {\n\treturn customFetch(getGetHealthUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetLiveUrl = () => {\n\treturn `${getProxyPath()}/livez`;\n};\n/**\n* Check whether the server is started\n* @summary Check server liveness\n*/\nconst getLive = async (options) => {\n\treturn customFetch(getGetLiveUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetReadyUrl = () => {\n\treturn `${getProxyPath()}/readyz`;\n};\n/**\n* Check whether the server is ready to accept requests\n* @summary Check server readiness\n*/\nconst getReady = async (options) => {\n\treturn customFetch(getGetReadyUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateUserUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/user?${stringifiedParams}` : `${getProxyPath()}/user`;\n};\n/**\n* @summary Create user\n*/\nconst createUser = async (createUserBody, params, options) => {\n\treturn customFetch(getCreateUserUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createUserBody)\n\t});\n};\nconst getListUsersUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/user?${stringifiedParams}` : `${getProxyPath()}/user`;\n};\n/**\n* @summary List users\n*/\nconst listUsers = async (params, options) => {\n\treturn customFetch(getListUsersUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetUserByIDUrl = (userId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/user/${userId}?${stringifiedParams}` : `${getProxyPath()}/user/${userId}`;\n};\n/**\n* @summary Get user by ID\n*/\nconst getUserByID = async (userId, params, options) => {\n\treturn customFetch(getGetUserByIDUrl(userId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateFlowUrl = () => {\n\treturn `${getProxyPath()}/flow`;\n};\n/**\n* Resolves a flow definition based on purpose + audience context and returns\nthe first capability step. Creates a new session implicitly unless\n`session_id` is provided (for step-up / reauth on an existing session).\n\nThe response contains an `id` field — the flow handle. Use it as the path\nparameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.\n\nThe response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing\nthe flow's orchestration state (current step, collected data, history).\nThe server is stateless between requests — all flow state lives in this\ncookie. The browser sends it automatically on subsequent requests.\n\n* @summary Start a new flow\n*/\nconst createFlow = async (createFlowBody, options) => {\n\treturn customFetch(getCreateFlowUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createFlowBody)\n\t});\n};\nconst getGetFlowStepUrl = (id) => {\n\treturn `${getProxyPath()}/flow/${id}`;\n};\n/**\n* Returns the current capability step without advancing the state machine.\nUseful for page reloads or re-rendering after a network error.\n\n* @summary Get current step (re-render)\n*/\nconst getFlowStep = async (id, options) => {\n\treturn customFetch(getGetFlowStepUrl(id), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getSubmitFlowStepUrl = (id) => {\n\treturn `${getProxyPath()}/flow/${id}/submit`;\n};\n/**\n* Submits user input for the current step. The server validates,\nprocesses (e.g., verifies a credential), advances the state machine\nthrough any invisible steps, and returns the next visible step.\n\nThe response sets an updated encrypted `HttpOnly` cookie (`_zflow`)\nwith the new flow state. The server is stateless — all orchestration\nstate is carried in this cookie between requests.\n\n**Important:** The `id` in the response may differ from the `id` used in\nthe request. This happens when a flow pivots (pushes a new flow onto the\nstack) or when a stacked flow completes (auto-pops to the parent flow).\nAlways use the `id` from the latest response for the next request.\n\n## Flow completion\n\nWhen `step.type` is `complete`, the flow is terminal. The `step.behavior`\nfield tells the frontend what to do:\n\n| `behavior`   | Action                                                     |\n|------------- |------------------------------------------------------------|\n| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |\n| `show`       | Render the step as a success screen (e.g., registration).  |\n\nA `complete` step is only returned when the **entire flow stack** is done.\nIf a stacked flow (e.g., recovery pivoted from login) finishes, the server\nauto-pops to the parent flow and returns the parent's next step — the\nfrontend never sees a `complete` for intermediate flows.\n\n* @summary Submit step data and advance\n*/\nconst submitFlowStep = async (id, submitFlowStepBody, options) => {\n\treturn customFetch(getSubmitFlowStepUrl(id), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(submitFlowStepBody)\n\t});\n};\nconst getSubmitFlowEventUrl = (id) => {\n\treturn `${getProxyPath()}/flow/${id}/event`;\n};\n/**\n* Submits telemetry or fingerprint data from the frontend.\nDoes not advance the state machine. Used for risk evaluation.\n\n* @summary Submit client-side event\n*/\nconst submitFlowEvent = async (id, submitFlowEventBody, options) => {\n\treturn customFetch(getSubmitFlowEventUrl(id), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(submitFlowEventBody)\n\t});\n};\nconst getCreateAuthAttemptUrl = () => {\n\treturn `${getProxyPath()}/auth_attempts`;\n};\n/**\n* Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.\n\nAn attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.\nIt accepts factor challenges, verifies proofs, and completes into a session or handoff token.\n\nAccepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,\nalso include session_id to add factors to an existing session.\n\n* @summary Create a new authentication attempt\n*/\nconst createAuthAttempt = async (createAuthAttemptBody, options) => {\n\treturn customFetch(getCreateAuthAttemptUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createAuthAttemptBody)\n\t});\n};\nconst getGetAuthAttemptUrl = (attemptId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}`;\n};\n/**\n* Polls the current state of an authentication attempt.\n\nReturns the attempt's state, available factors for the next challenge,\nchallenges issued so far, and any errors preventing progress.\n\nUse this for polling during long-running factor verifications (e.g., waiting for\na federated IdP callback or a device flow).\n\n* @summary Get authentication attempt state\n*/\nconst getAuthAttempt = async (attemptId, options) => {\n\treturn customFetch(getGetAuthAttemptUrl(attemptId), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getIssueChallengeUrl = (attemptId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}/challenges`;\n};\n/**\n* Issues a single-factor verification challenge within an auth attempt.\n\nThis advances the authentication state machine by requesting a specific factor method\n(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details\nincluding method, metadata, and any UI hints. The client then verifies the proof\nby calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.\n\n* @summary Issue a factor challenge\n*/\nconst issueChallenge = async (attemptId, issueChallengeBody, options) => {\n\treturn customFetch(getIssueChallengeUrl(attemptId), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(issueChallengeBody)\n\t});\n};\nconst getVerifyChallengeProofUrl = (attemptId, challengeId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}/challenges/${challengeId}/verify`;\n};\n/**\n* Submits a proof (credential, code, assertion) to verify a factor challenge.\n\nThe proof format depends on the challenge method. For example:\n- `password` method: { password: \"…\" }\n- `totp` method: { totp: { code: \"123456\" } }\n- `passkey` method: { passkey: { assertion: \"…\" } }\n- `recovery_code` method: { recovery_code: \"…\" }\n\nOn successful verification, the factor is written to the auth attempt.\nThe attempt moves to the next pending challenge or completes if all required factors are verified.\n\n* @summary Verify a factor proof\n*/\nconst verifyChallengeProof = async (attemptId, challengeId, verifyChallengeProofBody, options) => {\n\treturn customFetch(getVerifyChallengeProofUrl(attemptId, challengeId), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(verifyChallengeProofBody)\n\t});\n};\nconst getCreateHandoffUrl = (attemptId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}/handoff`;\n};\n/**\n* Completes the authentication attempt and mints a `handoff_token`.\n\nCall this after all required factors have been verified and the attempt is in `completed` state.\nThe handoff token is short-lived (≤60 seconds) and must be exchanged at\nPOST /sessions/exchange to receive the final session and session_token.\n\nThe handoff token is:\n- Single-use (atomic exchange, no retry)\n- Audience-bound (requires matching project key for exchange)\n- Idempotency-safe within a 5-minute window (see conventions)\n\n* @summary Complete authentication and create handoff token\n*/\nconst createHandoff = async (attemptId, options) => {\n\treturn customFetch(getCreateHandoffUrl(attemptId), {\n\t\t...options,\n\t\tmethod: \"POST\"\n\t});\n};\nconst getCreateProjectUrl = () => {\n\treturn `${getProxyPath()}/projects`;\n};\n/**\n* @summary Create project\n*/\nconst createProject = async (createProjectBody, options) => {\n\treturn customFetch(getCreateProjectUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createProjectBody)\n\t});\n};\nconst getGetProjectUrl = (projectId) => {\n\treturn `${getProxyPath()}/projects/${projectId}`;\n};\n/**\n* Returns the current state of a project.\n\n* @summary Get project\n*/\nconst getProject = async (projectId, options) => {\n\treturn customFetch(getGetProjectUrl(projectId), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateSessionUrl = () => {\n\treturn `${getProxyPath()}/sessions`;\n};\n/**\n* Creates an anonymous session shell with no user and no factors (`state: building`).\n\nThis is optional — an `auth_attempt` will create a session implicitly if none is provided.\nUse this explicitly when you want to:\n- Pre-allocate a `session_id` before the user is known, so device/telemetry signals\ncan be correlated with the eventual authenticated session from the start.\n- Track anonymous state (bot detection, device fingerprint) that survives until authentication.\n\nThe returned `session_token` authorises GET and DELETE on this session.\nIt is superseded when a handoff exchange completes — clients must replace it at that point.\n\nAnonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured\nfull session TTL when the first authentication factor is written via a completing `auth_attempt`.\n\n* @summary Create an anonymous session shell\n*/\nconst createSession = async (createSessionBody, options) => {\n\treturn customFetch(getCreateSessionUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createSessionBody)\n\t});\n};\nconst getListSessionsUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/sessions?${stringifiedParams}` : `${getProxyPath()}/sessions`;\n};\n/**\n* Returns a paginated list of sessions for a project.\nRequires a project service key (OAuth2 client credentials).\n\n* @summary List sessions\n*/\nconst listSessions = async (params, options) => {\n\treturn customFetch(getListSessionsUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getExchangeHandoffUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/exchange?${stringifiedParams}` : `${getProxyPath()}/sessions/exchange`;\n};\n/**\n* Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`\nand returns the resulting session and a `session_token`.\n\nThe server resolves the originating `auth_attempt` from the token and then:\n\n| Originating auth_attempt | Outcome |\n|---|---|\n| No `session_id` | A new authenticated session is **created**. |\n| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |\n| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |\n\nThe response shape is identical in all three cases.\n\nThe `session_token` supersedes any previously issued `session_token` for the same session.\nClients must replace their stored token at this point.\n\nRequires a project service key (OAuth2 client credentials).\n\n* @summary Exchange handoff token for a session\n*/\nconst exchangeHandoff = async (exchangeHandoffBody, params, options) => {\n\treturn customFetch(getExchangeHandoffUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(exchangeHandoffBody)\n\t});\n};\nconst getGetSessionUrl = (sessionId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;\n};\n/**\n* Returns the current state of a session including its factors and all currently\nsatisfied assurance levels.\n\n`assurance_levels[]` may shrink over time as factor freshness windows expire,\nwithout the session itself expiring. Use step-up authentication (a new `auth_attempt`\nagainst the same `session_id`) to restore a dropped assurance level.\n\n* @summary Get session state\n*/\nconst getSession = async (sessionId, params, options) => {\n\treturn customFetch(getGetSessionUrl(sessionId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getRevokeSessionUrl = (sessionId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;\n};\n/**\n* Revokes the session immediately (`state: revoked`). This is the logout operation.\n\nThe session_token issued at creation (or superseded by a handoff exchange) is required.\nAfter revocation, any tokens derived from this session are invalidated.\n\n* @summary Revoke session\n*/\nconst revokeSession = async (sessionId, params, options) => {\n\treturn customFetch(getRevokeSessionUrl(sessionId, params), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getGetMySessionUrl = () => {\n\treturn `${getProxyPath()}/sessions/me`;\n};\n/**\n* Returns the current state of the current session including its factors and all currently\nsatisfied assurance levels.\n\n`assurance_levels[]` may shrink over time as factor freshness windows expire,\nwithout the session itself expiring. Use step-up authentication (a new `auth_attempt`\nagainst the same `session_id`) to restore a dropped assurance level.\n\n* @summary Get my session state\n*/\nconst getMySession = async (options) => {\n\treturn customFetch(getGetMySessionUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getRevokeMySessionUrl = () => {\n\treturn `${getProxyPath()}/sessions/me`;\n};\n/**\n* Revokes the session immediately (`state: revoked`). This is the logout operation.\n\nThe __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.\nAfter revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.\n\n* @summary Revoke my session\n*/\nconst revokeMySession = async (options) => {\n\treturn customFetch(getRevokeMySessionUrl(), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getCreateSchemaUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;\n};\n/**\n* Create a new schema. The schema definition must include a unique $id field,\nwhich will be used to identify the schema in future requests. The $id must\nbe a valid URI and should ideally point to the location where the schema\ncan be accessed.\n\nThe schema can either be a concrete schema, e.g. a user schema, or a\nschema-url which will be resolved by the server.\n\n* @summary Create new schema\n*/\nconst createSchema = async (createSchemaBody, params, options) => {\n\treturn customFetch(getCreateSchemaUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createSchemaBody)\n\t});\n};\nconst getGetSchemaByIdUrl = (id, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;\n};\n/**\n* Get a schema by its ID. This will return the default revision of the schema.\n* @summary Get schema by ID\n*/\nconst getSchemaById = async (id, params, options) => {\n\treturn customFetch(getGetSchemaByIdUrl(id, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateFlowDefinitionUrl = () => {\n\treturn `${getProxyPath()}/flow_definitions`;\n};\n/**\n* Creates a new flow definition.\nFlow definitions are templates that define the sequence of steps (capabilities)\nfor a particular user journey (e.g., registration, login, password reset).\n\nFlow definitions are created based on the flow meta schema, which includes the flow's purpose, audience, and the steps involved.\n\n* @summary Create a new flow definition\n*/\nconst createFlowDefinition = async (createFlowDefinitionBody, options) => {\n\treturn customFetch(getCreateFlowDefinitionUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createFlowDefinitionBody)\n\t});\n};\nconst getListFlowDefinitionsUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions?${stringifiedParams}` : `${getProxyPath()}/flow_definitions`;\n};\n/**\n* Retrieves a list of all flow definitions.\nThis endpoint can be used to view existing flow definitions and their configurations.\n\n* @summary List flow definitions\n*/\nconst listFlowDefinitions = async (params, options) => {\n\treturn customFetch(getListFlowDefinitionsUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetFlowDefinitionUrl = (id) => {\n\treturn `${getProxyPath()}/flow_definitions/${id}`;\n};\n/**\n* Get a flow definition by id\n* @summary Get a flow definition by id\n*/\nconst getFlowDefinition = async (id, options) => {\n\treturn customFetch(getGetFlowDefinitionUrl(id), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getUpdateFlowDefinitionUrl = (id) => {\n\treturn `${getProxyPath()}/flow_definitions/${id}`;\n};\n/**\n* Update a flow definition by id\n* @summary Update a flow definition by id\n*/\nconst updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {\n\treturn customFetch(getUpdateFlowDefinitionUrl(id), {\n\t\t...options,\n\t\tmethod: \"PATCH\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(updateFlowDefinitionBody)\n\t});\n};\nconst getDeleteFlowDefinitionUrl = (id) => {\n\treturn `${getProxyPath()}/flow_definitions/${id}`;\n};\n/**\n* Delete a flow definition by id\n* @summary Delete a flow definition by id\n*/\nconst deleteFlowDefinition = async (id, options) => {\n\treturn customFetch(getDeleteFlowDefinitionUrl(id), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getCreateTeamUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;\n};\n/**\n* @summary Create team\n*/\nconst createTeam = async (params, createTeamBody, options) => {\n\treturn customFetch(getCreateTeamUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createTeamBody)\n\t});\n};\nconst getGetTeamUrl = (teamId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;\n};\n/**\n* Returns the current state of a team.\n\n* @summary Get team\n*/\nconst getTeam = async (teamId, params, options) => {\n\treturn customFetch(getGetTeamUrl(teamId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\n//#endregion\nexport { authorizeDevice, authorizeGet, createAuthAttempt, createFlow, createFlowDefinition, createHandoff, createProject, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, endSession, exchangeHandoff, getAuthAttempt, getAuthorizeDeviceUrl, getAuthorizeGetUrl, getCreateAuthAttemptUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getEndSessionUrl, getExchangeHandoffUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetHealthUrl, getGetKeysUrl, getGetLiveUrl, getGetMySessionUrl, getGetOpenIDConfigurationUrl, getGetProjectUrl, getGetReadyUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetTokenUrl, getGetUserByIDUrl, getGetUserInfoUrl, getHealth, getIntrospectUrl, getIssueChallengeUrl, getKeys, getListFlowDefinitionsUrl, getListSessionsUrl, getListUsersUrl, getLive, getMySession, getOpenIDConfiguration, getProject, getReady, getRevokeMySessionUrl, getRevokeSessionUrl, getRevokeTokenUrl, getSchemaById, getSession, getSubmitFlowEventUrl, getSubmitFlowStepUrl, getTeam, getToken, getUpdateFlowDefinitionUrl, getUserByID, getUserInfo, getVerifyChallengeProofUrl, introspect, issueChallenge, listFlowDefinitions, listSessions, listUsers, revokeMySession, revokeSession, revokeToken, submitFlowEvent, submitFlowStep, zitadelNextGen_exports as t, updateFlowDefinition, verifyChallengeProof };\n\n//# sourceMappingURL=zitadelNextGen.mjs.map","import { setProxyPath } from \"./base-url.mjs\";\nimport { setApiAuthToken } from \"./auth.mjs\";\nimport { t as zitadelNextGen_exports } from \"../generated/endpoints/zitadelNextGen.mjs\";\n//#region src/runtime/api-factory.ts\n/**\n* Factory for the typed Zitadel client every consumer reaches for.\n*\n* Wraps the orval-generated endpoints in a {@link Proxy} so each\n* generated function sees the right base URL and (optionally) the\n* right bearer token at call time — without the caller having to\n* thread either through every operation, and without exposing the\n* module-globals (`setProxyPath` / `setApiAuthToken`) as part of the\n* public API.\n*\n* Per-instance isolation: multiple clients can coexist in one process\n* (different servers, different tokens). Their Proxy `get` traps set\n* the globals synchronously before invoking the underlying generated\n* function, which reads them at the top of `customFetch` before any\n* `await`. Two clients running interleaved within a single JS turn\n* are safe; two clients running in parallel across awaits could\n* clobber each other — not a pattern any current consumer uses.\n*/\n/**\n* Build a typed Zitadel client pre-bound to a base URL and (optionally)\n* a bearer token. Every method on the returned object mirrors a\n* generated orval function:\n*\n*     const client = createZitadelClient({ baseUrl, token });\n*     await client.createProject({ previewOrigins: [] });\n*     await client.createSchema(body, { project_id });\n*/\nfunction createZitadelClient(opts) {\n\tconst baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n\treturn new Proxy(zitadelNextGen_exports, { get(target, prop, receiver) {\n\t\tconst value = Reflect.get(target, prop, receiver);\n\t\tif (typeof value !== \"function\") return value;\n\t\treturn (...args) => {\n\t\t\tsetProxyPath(baseUrl);\n\t\t\tsetApiAuthToken(opts.token);\n\t\t\treturn value(...args);\n\t\t};\n\t} });\n}\n/**\n* Legacy entry point: builds a client with only the base URL set, no\n* token. Components and SDKs that don't carry an auth token (browser\n* flows authenticated by platform cookies) still consume this name.\n* Equivalent to `createZitadelClient({ baseUrl: apiBase })`.\n*/\nfunction createApi(apiBase) {\n\treturn createZitadelClient({ baseUrl: apiBase });\n}\n//#endregion\nexport { createApi, createZitadelClient };\n\n//# sourceMappingURL=api-factory.mjs.map","import { setProxyPath } from \"./base-url.mjs\";\nimport { createApi } from \"./api-factory.mjs\";\n//#region src/runtime/config.ts\nlet currentProject = null;\n/**\n* Per-project API client cache. Ensures `getApi(project)` returns the\n* same instance for the same project handle — no re-wrapping on every call.\n*/\nconst apiCache = /* @__PURE__ */ new WeakMap();\n/**\n* Initializes app-wide SDK configuration and returns the frozen\n* {@link ZitadelProject} handle.\n*\n* Write-once — subsequent calls with the same values return the original\n* handle; calls with different values log a warning and return the\n* original. This prevents accidental overwrites while remaining safe\n* for HMR and framework double-mounts.\n*/\nfunction configureZitadel(config) {\n\tconst resolvedProxyPath = config.proxyPath ?? \"/__nextgen\";\n\tif (currentProject !== null) {\n\t\tif (currentProject.proxyPath === resolvedProxyPath && currentProject.projectId === config.projectId && currentProject.url === config.url) return currentProject;\n\t\tconsole.warn(`[zitadel] configureZitadel() already called with different values. Ignoring: ${JSON.stringify(config)}`);\n\t\treturn currentProject;\n\t}\n\tcurrentProject = Object.freeze({\n\t\tproxyPath: resolvedProxyPath,\n\t\tprojectId: config.projectId,\n\t\turl: config.url\n\t});\n\tsetProxyPath(resolvedProxyPath);\n\treturn currentProject;\n}\n/**\n* Returns a typed API client for the given project, with the base URL\n* pre-bound. Cached per project handle — safe to call multiple times.\n*\n* ```ts\n* const project = configureZitadel({ ... });\n* export const api = getApi(project);\n* ```\n*/\nfunction getApi(project) {\n\tlet api = apiCache.get(project);\n\tif (!api) {\n\t\tapi = createApi(project.proxyPath);\n\t\tapiCache.set(project, api);\n\t}\n\treturn api;\n}\n/**\n* Returns the current project handle, or `null` if {@link configureZitadel}\n* has not been called yet.\n*/\nfunction getZitadelConfig() {\n\treturn currentProject;\n}\n/**\n* Reset internal state. **Test-only** — not exported from the package's\n* public API. Allows tests to call `configureZitadel()` multiple times\n* across isolated test cases without the write-once guard rejecting them.\n*/\nfunction _resetConfigForTesting() {\n\tcurrentProject = null;\n\tsetProxyPath(\"\");\n}\n//#endregion\nexport { _resetConfigForTesting, configureZitadel, getApi, getZitadelConfig };\n\n//# sourceMappingURL=config.mjs.map","/**\n * Thin wrappers around the orval-generated `@zitadel/api` fetch\n * functions for the API operations the orchestrator drives:\n *\n * - `POST /flow`              — `createFlow`\n * - `POST /flow/{id}/submit`  — `submitFlowStep`\n * - `GET  /flow/{id}`         — `getFlowStep`\n * - `POST /sessions/exchange` — `exchangeHandoff`\n *\n * The wrappers exist for one reason: every API call must run with\n * `credentials: \"include\"` so the stateless `_zflow` HttpOnly cookie\n * round-trips. Centralising that here keeps every call site honest.\n *\n * Types come straight from `@zitadel/api/generated/model`. Orval\n * emits per-operation aliases (`CreateFlow201`, `GetFlowStep200`,\n * `SubmitFlowStep200`) for what is structurally the same response; the\n * orchestrator stores them as `CreateFlow201` because that is the alias\n * orval gives the start-of-flow response.\n */\nimport type { ZitadelApi } from \"@zitadel/api/config\";\nimport type {\n  CreateFlow201,\n  CreateFlowBody,\n  ExchangeHandoff200,\n  ExchangeHandoffBody,\n  ExchangeHandoffParams,\n  SubmitFlowStepBody,\n} from \"@zitadel/api/generated/model\";\nimport { ApiError } from \"@zitadel/api/runtime/fetch\";\n\nconst apiRequestInit: RequestInit = { credentials: \"include\" };\n\nexport async function startFlow(api: ZitadelApi, input: CreateFlowBody): Promise<CreateFlow201> {\n  return api.createFlow(input, apiRequestInit);\n}\n\n// Field validation errors come back as 400 with the step echoed and\n// `step.error` set. Unwrap that shape so it flows through like a 200;\n// everything else bubbles.\nexport async function submitStep(\n  api: ZitadelApi,\n  id: string,\n  body: SubmitFlowStepBody,\n): Promise<CreateFlow201> {\n  try {\n    return await api.submitFlowStep(id, body, apiRequestInit);\n  } catch (error) {\n    if (error instanceof ApiError && error.status === 400 && isFlowResponse(error.body)) {\n      return error.body;\n    }\n    throw error;\n  }\n}\n\nfunction isFlowResponse(body: unknown): body is CreateFlow201 {\n  return typeof body === \"object\" && body !== null && \"step\" in body;\n}\n\nexport async function getCurrentStep(api: ZitadelApi, id: string): Promise<CreateFlow201> {\n  return api.getFlowStep(id, apiRequestInit);\n}\n\n/**\n * Exchange a terminal-flow `handoff_token` for an authenticated session.\n * The server sets the `__nextgen_session` HttpOnly cookie on success.\n *\n * Uses the generated `exchangeHandoff` client which handles the\n * `project_id` query parameter via {@link ExchangeHandoffParams}.\n */\nexport async function exchangeSession(\n  api: ZitadelApi,\n  body: ExchangeHandoffBody,\n  params: ExchangeHandoffParams,\n): Promise<ExchangeHandoff200> {\n  return api.exchangeHandoff(body, params, apiRequestInit);\n}\n","/**\n * Branding -> CSS token bridge.\n *\n * Per `docs/design/branding/README.md` the orchestrator owns theming. Templates\n * never emit `<style>` blocks; they only structure HTML. This module translates\n * the `Branding` JSON into a CSSStyleSheet of `:host { --zl-* }` declarations\n * and applies it via `shadowRoot.adoptedStyleSheets`.\n *\n * Dark-mode overrides are emitted as `:host([data-theme=\"dark\"]) { ... }`\n * (matching `docs/design/branding/tokens.md`). Resolution between\n * `light | dark | auto` happens in `<zitadel-login>`.\n *\n * Base layer: the design-tokens package ships the full `--zl-*` set as both a\n * `.css` file (for host pages) and a `tokensCss` string (for shadow roots and\n * SSR). We adopt the string into every orchestrator shadow root so atoms\n * paint correctly even when the host page didn't `@import` tokens.css — the\n * orchestrator is meant to drop into any page.\n */\nimport { tokensCss } from \"@zitadel/design-tokens\";\n\nimport type { ResolvedTheme } from \"./theme-controller.js\";\nimport type { Branding, BrandingPalette, BrandingShape, BrandingTypography } from \"./branding.js\";\n\n// Radius tokens (Figma corner-radius scale). Branding lets a tenant pick\n// one of five shapes; we override all three corner sizes in proportion.\nconst RADIUS_MAP: Record<NonNullable<BrandingShape[\"radius\"]>, string> = {\n  none: \"0\",\n  sm: \"0.25rem\",\n  md: \"0.5rem\",\n  lg: \"0.75rem\",\n  full: \"9999px\",\n};\n\n// Branding lets tenants tune perceived density. Padding bands are the\n// most visible knob; height tweaks come from the Figma button/field heights.\nconst DENSITY_MAP: Record<NonNullable<BrandingShape[\"density\"]>, Record<string, string>> = {\n  compact: {\n    \"--zl-spacing-03\": \"0.75rem\",\n    \"--zl-spacing-05\": \"1.5rem\",\n  },\n  regular: {},\n  comfortable: {\n    \"--zl-spacing-03\": \"1.25rem\",\n    \"--zl-spacing-05\": \"2.25rem\",\n  },\n};\n\n// Mapping from the Branding palette keys (stable, public API for tenants)\n// to the design-tokens variable names that atoms actually consume. The keys\n// are intentionally semantic — tenants do NOT see internal token names like\n// `--zl-color-surface-default-black`; they say \"background\", \"surface\",\n// \"primary\", \"text\", etc. The orchestrator translates here.\nconst PALETTE_MAP: Record<keyof BrandingPalette, string[]> = {\n  primary: [\"--zl-color-surface-default-white\"],\n  on_primary: [\"--zl-color-text-button-default\"],\n  background: [\"--zl-color-surface-default-black\"],\n  surface: [\"--zl-color-surface-default-primary-gray\"],\n  muted: [\"--zl-color-surface-default-secondary-gray\"],\n  border: [\"--zl-color-border-default-gray-200\", \"--zl-color-border-default-gray-100\"],\n  text: [\"--zl-color-text-primary-white\"],\n  text_muted: [\"--zl-color-text-secondary-gray\"],\n  link: [\"--zl-color-text-subtitle-pink\"],\n  success: [\"--zl-color-text-success\", \"--zl-color-border-success\", \"--zl-color-icon-success\"],\n  warning: [\"--zl-color-text-subtitle-orange\"],\n  error: [\"--zl-color-text-error\", \"--zl-color-border-error\", \"--zl-color-icon-error\"],\n};\n\nexport type BrandingToTokensOptions = {\n  resolvedTheme?: ResolvedTheme;\n};\n\n/**\n * Build a CSS string of `:host { --zl-* }` declarations from a Branding\n * payload. Light values land on `:host`; dark overrides land on\n * `:host([data-theme=\"dark\"])`.\n */\nexport function buildBrandingStylesheet(\n  branding: Branding | undefined,\n  options: BrandingToTokensOptions = {},\n): string {\n  const lightDecls = collectDeclarations(branding);\n  const darkPalette = branding?.theme?.dark?.palette;\n  const darkDecls = darkPalette ? mapPalette(darkPalette) : {};\n\n  const blocks: string[] = [];\n  if (Object.keys(lightDecls).length > 0) {\n    blocks.push(formatBlock(\":host\", lightDecls));\n  }\n  if (Object.keys(darkDecls).length > 0) {\n    blocks.push(formatBlock(':host([data-theme=\"dark\"])', darkDecls));\n  }\n\n  // When the orchestrator forces dark mode (mode: \"dark\" or auto + prefers-dark),\n  // treat the dark overrides as primary so :host alone reflects dark even\n  // before a `data-theme` attribute is set. Cheap and avoids a flash.\n  if (options.resolvedTheme === \"dark\" && darkPalette) {\n    const merged = { ...lightDecls, ...darkDecls };\n    blocks.length = 0;\n    blocks.push(formatBlock(\":host\", merged));\n  }\n\n  return blocks.join(\"\\n\");\n}\n\nfunction collectDeclarations(branding: Branding | undefined): Record<string, string> {\n  if (!branding) {\n    return {};\n  }\n  const decls: Record<string, string> = {};\n  Object.assign(decls, mapPalette(branding.palette));\n  Object.assign(decls, mapTypography(branding.typography));\n  Object.assign(decls, mapShape(branding.shape));\n  return decls;\n}\n\nfunction mapPalette(palette: BrandingPalette | undefined): Record<string, string> {\n  if (!palette) return {};\n  const out: Record<string, string> = {};\n  for (const [key, varNames] of Object.entries(PALETTE_MAP) as [keyof BrandingPalette, string[]][]) {\n    const value = palette[key];\n    if (typeof value === \"string\" && value.length > 0) {\n      for (const varName of varNames) {\n        out[varName] = value;\n      }\n    }\n  }\n  return out;\n}\n\nfunction mapTypography(typography: BrandingTypography | undefined): Record<string, string> {\n  if (!typography) return {};\n  const out: Record<string, string> = {};\n  // Tenants can override sans (primary body), heading, and mono families.\n  // We keep them as separate overrides so a tenant can ship a display face\n  // without losing the design-system fallback chain for body copy.\n  if (typography.font_family) {\n    out[\"--zl-font-family-sans\"] = typography.font_family;\n    out[\"--zl-font-family-heading\"] = typography.font_family;\n  }\n  if (typography.font_family_mono) {\n    out[\"--zl-font-family-mono\"] = typography.font_family_mono;\n  }\n  // Typography scale tunes the *base* font sizes embedded in atoms.\n  // The Figma scale isn't published as variables, so we map to the\n  // implicit sizes the atoms use directly.\n  const scale = clamp(typography.scale ?? 1, 0.75, 1.25);\n  if (scale !== 1) {\n    out[\"--zl-font-scale\"] = `${scale}`;\n  }\n  return out;\n}\n\nfunction mapShape(shape: BrandingShape | undefined): Record<string, string> {\n  if (!shape) return {};\n  const out: Record<string, string> = {};\n  if (shape.radius && RADIUS_MAP[shape.radius]) {\n    const radius = RADIUS_MAP[shape.radius];\n    // Map the chosen radius onto the corner-radius/s slot atoms use by\n    // default, plus the larger size for cards. xs stays as a small accent.\n    out[\"--zl-radius-s\"] = radius;\n    out[\"--zl-radius-m\"] = radius === \"0\" ? \"0\" : `calc(${radius} * 1.5)`;\n    out[\"--zl-radius-l\"] = radius === \"0\" ? \"0\" : `calc(${radius} * 2)`;\n  }\n  if (shape.density) {\n    Object.assign(out, DENSITY_MAP[shape.density]);\n  }\n  return out;\n}\n\nfunction formatBlock(selector: string, decls: Record<string, string>): string {\n  const lines = Object.entries(decls).map(([prop, value]) => `  ${prop}: ${value};`);\n  return `${selector} {\\n${lines.join(\"\\n\")}\\n}`;\n}\n\nfunction clamp(value: number, min: number, max: number): number {\n  if (Number.isNaN(value)) return min;\n  return Math.min(max, Math.max(min, value));\n}\n\n// Lazily-built base sheet, shared by every `<zitadel-login>` instance.\n// `tokensCss` ships the design-system defaults under `:root` and\n// `[data-theme=\"dark\"]`; rewriting them to `:host` / `:host([data-theme=\"dark\"])`\n// projects the same variables onto the orchestrator's shadow root so\n// `var(--zl-*)` lookups inside atoms resolve before branding overrides land.\nlet baseTokenSheet: CSSStyleSheet | undefined;\nfunction getBaseTokenSheet(): CSSStyleSheet | undefined {\n  if (typeof CSSStyleSheet === \"undefined\") return undefined;\n  if (!baseTokenSheet) {\n    baseTokenSheet = new CSSStyleSheet();\n    baseTokenSheet.replaceSync(\n      tokensCss\n        .replaceAll(\":root,\\n[data-theme=\\\"dark\\\"]\", \":host,\\n:host([data-theme=\\\"dark\\\"])\")\n        .replaceAll(\"[data-theme=\\\"light\\\"]\", \":host([data-theme=\\\"light\\\"])\"),\n    );\n  }\n  return baseTokenSheet;\n}\n\n/**\n * Adopt the design-system base token layer onto a `ShadowRoot`. Safe to call\n * many times — the underlying constructable sheet is shared across every\n * orchestrator instance and de-duplicated in the adopted list.\n */\nexport function applyBaseTokens(shadowRoot: ShadowRoot): void {\n  const sheet = getBaseTokenSheet();\n  if (!sheet) return;\n  // jsdom partially implements `adoptedStyleSheets` — treat a non-array as empty.\n  const existing: readonly CSSStyleSheet[] = Array.isArray(shadowRoot.adoptedStyleSheets)\n    ? shadowRoot.adoptedStyleSheets\n    : [];\n  if (existing.includes(sheet)) return;\n  try {\n    shadowRoot.adoptedStyleSheets = [sheet, ...existing];\n  } catch {\n    // Environments without constructable stylesheet adoption.\n  }\n}\n\n/**\n * Apply a branding payload as a `--zl-*` overrides layer on top of the base\n * token sheet. Subsequent calls replace the previous override sheet so a new\n * branding payload paints cleanly without leaking older declarations.\n *\n * Callers should run `applyBaseTokens(shadowRoot)` first (once per shadow\n * root) so the base values exist before branding patches them.\n */\nexport function applyBrandingTokens(\n  shadowRoot: ShadowRoot,\n  branding: Branding | undefined,\n  resolvedTheme: ResolvedTheme,\n): void {\n  const css = buildBrandingStylesheet(branding, { resolvedTheme });\n  if (typeof CSSStyleSheet === \"undefined\") {\n    return;\n  }\n  const sheet = new CSSStyleSheet();\n  sheet.replaceSync(css);\n  // Replace only the branding override sheet we own; leave the base token\n  // sheet and any host-supplied sheets in place.\n  const previous = (shadowRoot as ShadowRoot & { __zlTokenSheet?: CSSStyleSheet }).__zlTokenSheet;\n  const others = shadowRoot.adoptedStyleSheets.filter((s) => s !== previous);\n  shadowRoot.adoptedStyleSheets = [...others, sheet];\n  (shadowRoot as ShadowRoot & { __zlTokenSheet?: CSSStyleSheet }).__zlTokenSheet = sheet;\n}\n\nexport function resolveTheme(branding: Branding | undefined): ResolvedTheme {\n  // Default is dark — the design system only publishes a dark variable mode\n  // today. `light` and `auto` are accepted as branding inputs so existing\n  // payloads round-trip, but until a light mode lands they fall back to the\n  // dark surface. Light support is gated by a future Figma sync that fills\n  // the `[data-theme=\"light\"]` block in tokens.css.\n  const mode = branding?.theme?.mode ?? \"dark\";\n  if (mode === \"light\") return \"light\";\n  if (mode === \"dark\") return \"dark\";\n  if (typeof matchMedia === \"function\") {\n    return matchMedia(\"(prefers-color-scheme: light)\").matches ? \"light\" : \"dark\";\n  }\n  return \"dark\";\n}\n","//#region src/generated/model/createAuthAttempt201ChallengesItemMethod.ts\nconst CreateAuthAttempt201ChallengesItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201ChallengesItemState.ts\nconst CreateAuthAttempt201ChallengesItemState = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201CompletedFactorsItemMethod.ts\nconst CreateAuthAttempt201CompletedFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201RequiredFactorsItem.ts\nconst CreateAuthAttempt201RequiredFactorsItem = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201State.ts\nconst CreateAuthAttempt201State = {\n\tin_progress: \"in_progress\",\n\tcompleted: \"completed\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/createFlow201BrandingLayout.ts\nconst CreateFlow201BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepChallengeMethod.ts\nconst CreateFlow201StepChallengeMethod = { passkey: \"passkey\" };\n//#endregion\n//#region src/generated/model/createFlow201StepComplete.ts\nconst CreateFlow201StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepFieldsType.ts\nconst CreateFlow201StepFieldsType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepFieldsValidationFormat.ts\nconst CreateFlow201StepFieldsValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepGatesKind.ts\nconst CreateFlow201StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/createFlowBodyPurpose.ts\nconst CreateFlowBodyPurpose = {\n\tlogin: \"login\",\n\tregister: \"register\",\n\trecovery: \"recovery\",\n\tprofiling: \"profiling\",\n\treauth: \"reauth\",\n\tlink_account: \"link_account\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/createSession201SessionFactorsItemMethod.ts\nconst CreateSession201SessionFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createSession201SessionState.ts\nconst CreateSession201SessionState = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\",\n\trevoked: \"revoked\"\n};\n//#endregion\n//#region src/generated/model/exchangeHandoff200SessionFactorsItemMethod.ts\nconst ExchangeHandoff200SessionFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/exchangeHandoff200SessionState.ts\nconst ExchangeHandoff200SessionState = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\",\n\trevoked: \"revoked\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200ChallengesItemMethod.ts\nconst GetAuthAttempt200ChallengesItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200ChallengesItemState.ts\nconst GetAuthAttempt200ChallengesItemState = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200CompletedFactorsItemMethod.ts\nconst GetAuthAttempt200CompletedFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200RequiredFactorsItem.ts\nconst GetAuthAttempt200RequiredFactorsItem = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200State.ts\nconst GetAuthAttempt200State = {\n\tin_progress: \"in_progress\",\n\tcompleted: \"completed\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200BrandingLayout.ts\nconst GetFlowStep200BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepChallengeMethod.ts\nconst GetFlowStep200StepChallengeMethod = { passkey: \"passkey\" };\n//#endregion\n//#region src/generated/model/getFlowStep200StepComplete.ts\nconst GetFlowStep200StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepFieldsType.ts\nconst GetFlowStep200StepFieldsType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepFieldsValidationFormat.ts\nconst GetFlowStep200StepFieldsValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepGatesKind.ts\nconst GetFlowStep200StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/getMySession200FactorsItemMethod.ts\nconst GetMySession200FactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getMySession200State.ts\nconst GetMySession200State = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\",\n\trevoked: \"revoked\"\n};\n//#endregion\n//#region src/generated/model/getOpenIDConfiguration200ClaimTypesSupportedItem.ts\nconst GetOpenIDConfiguration200ClaimTypesSupportedItem = {\n\tnormal: \"normal\",\n\taggregated: \"aggregated\",\n\tdistributed: \"distributed\"\n};\n//#endregion\n//#region src/generated/model/getOpenIDConfiguration200DisplayValuesSupportedItem.ts\nconst GetOpenIDConfiguration200DisplayValuesSupportedItem = {\n\tpage: \"page\",\n\tpopup: \"popup\",\n\ttouch: \"touch\",\n\twap: \"wap\"\n};\n//#endregion\n//#region src/generated/model/getOpenIDConfiguration200SubjectTypesSupportedItem.ts\nconst GetOpenIDConfiguration200SubjectTypesSupportedItem = {\n\tpublic: \"public\",\n\tpairwise: \"pairwise\"\n};\n//#endregion\n//#region src/generated/model/getOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem.ts\nconst GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem = {\n\tclient_secret_post: \"client_secret_post\",\n\tclient_secret_basic: \"client_secret_basic\",\n\tclient_secret_jwt: \"client_secret_jwt\",\n\tprivate_key_jwt: \"private_key_jwt\"\n};\n//#endregion\n//#region src/generated/model/getSession200FactorsItemMethod.ts\nconst GetSession200FactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getSession200State.ts\nconst GetSession200State = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\",\n\trevoked: \"revoked\"\n};\n//#endregion\n//#region src/generated/model/getTokenBodyGrantType.ts\nconst GetTokenBodyGrantType = {\n\tauthorization_code: \"authorization_code\",\n\tclient_credentials: \"client_credentials\",\n\tpassword: \"password\",\n\trefresh_token: \"refresh_token\"\n};\n//#endregion\n//#region src/generated/model/issueChallenge201Method.ts\nconst IssueChallenge201Method = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/issueChallenge201State.ts\nconst IssueChallenge201State = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/issueChallengeBodyMethod.ts\nconst IssueChallengeBodyMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/issueChallengeBodyPasskeyOptionsUserVerification.ts\nconst IssueChallengeBodyPasskeyOptionsUserVerification = {\n\trequired: \"required\",\n\tpreferred: \"preferred\",\n\tdiscouraged: \"discouraged\"\n};\n//#endregion\n//#region src/generated/model/listFlowDefinitionsPurpose.ts\nconst ListFlowDefinitionsPurpose = {\n\tlogin: \"login\",\n\tregister: \"register\",\n\trecovery: \"recovery\",\n\tprofiling: \"profiling\",\n\treauth: \"reauth\",\n\tlink_account: \"link_account\"\n};\n//#endregion\n//#region src/generated/model/listSessions200SessionsItemFactorsItemMethod.ts\nconst ListSessions200SessionsItemFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/listSessions200SessionsItemState.ts\nconst ListSessions200SessionsItemState = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\",\n\trevoked: \"revoked\"\n};\n//#endregion\n//#region src/generated/model/listSessionsState.ts\nconst ListSessionsState = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\",\n\trevoked: \"revoked\"\n};\n//#endregion\n//#region src/generated/model/submitFlowEventBodyType.ts\nconst SubmitFlowEventBodyType = {\n\tfingerprint: \"fingerprint\",\n\ttelemetry: \"telemetry\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200BrandingLayout.ts\nconst SubmitFlowStep200BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepChallengeMethod.ts\nconst SubmitFlowStep200StepChallengeMethod = { passkey: \"passkey\" };\n//#endregion\n//#region src/generated/model/submitFlowStep200StepComplete.ts\nconst SubmitFlowStep200StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepFieldsType.ts\nconst SubmitFlowStep200StepFieldsType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepFieldsValidationFormat.ts\nconst SubmitFlowStep200StepFieldsValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepGatesKind.ts\nconst SubmitFlowStep200StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/submitFlowStep400BrandingLayout.ts\nconst SubmitFlowStep400BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepChallengeMethod.ts\nconst SubmitFlowStep400StepChallengeMethod = { passkey: \"passkey\" };\n//#endregion\n//#region src/generated/model/submitFlowStep400StepComplete.ts\nconst SubmitFlowStep400StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepFieldsType.ts\nconst SubmitFlowStep400StepFieldsType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepFieldsValidationFormat.ts\nconst SubmitFlowStep400StepFieldsValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepGatesKind.ts\nconst SubmitFlowStep400StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyStepsItemComplete.ts\nconst UpdateFlowDefinitionBodyStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyStepsItemGatesKind.ts\nconst UpdateFlowDefinitionBodyStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyStepsItemOnSuccess.ts\nconst UpdateFlowDefinitionBodyStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.ts\nconst VerifyChallengeProof200ChallengesItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200ChallengesItemState.ts\nconst VerifyChallengeProof200ChallengesItemState = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200CompletedFactorsItemMethod.ts\nconst VerifyChallengeProof200CompletedFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200RequiredFactorsItem.ts\nconst VerifyChallengeProof200RequiredFactorsItem = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200State.ts\nconst VerifyChallengeProof200State = {\n\tin_progress: \"in_progress\",\n\tcompleted: \"completed\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\nexport { CreateAuthAttempt201ChallengesItemMethod, CreateAuthAttempt201ChallengesItemState, CreateAuthAttempt201CompletedFactorsItemMethod, CreateAuthAttempt201RequiredFactorsItem, CreateAuthAttempt201State, CreateFlow201BrandingLayout, CreateFlow201StepChallengeMethod, CreateFlow201StepComplete, CreateFlow201StepFieldsType, CreateFlow201StepFieldsValidationFormat, CreateFlow201StepGatesKind, CreateFlowBodyPurpose, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess, CreateSession201SessionFactorsItemMethod, CreateSession201SessionState, ExchangeHandoff200SessionFactorsItemMethod, ExchangeHandoff200SessionState, GetAuthAttempt200ChallengesItemMethod, GetAuthAttempt200ChallengesItemState, GetAuthAttempt200CompletedFactorsItemMethod, GetAuthAttempt200RequiredFactorsItem, GetAuthAttempt200State, GetFlowStep200BrandingLayout, GetFlowStep200StepChallengeMethod, GetFlowStep200StepComplete, GetFlowStep200StepFieldsType, GetFlowStep200StepFieldsValidationFormat, GetFlowStep200StepGatesKind, GetMySession200FactorsItemMethod, GetMySession200State, GetOpenIDConfiguration200ClaimTypesSupportedItem, GetOpenIDConfiguration200DisplayValuesSupportedItem, GetOpenIDConfiguration200SubjectTypesSupportedItem, GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem, GetSession200FactorsItemMethod, GetSession200State, GetTokenBodyGrantType, IssueChallenge201Method, IssueChallenge201State, IssueChallengeBodyMethod, IssueChallengeBodyPasskeyOptionsUserVerification, ListFlowDefinitionsPurpose, ListSessions200SessionsItemFactorsItemMethod, ListSessions200SessionsItemState, ListSessionsState, SubmitFlowEventBodyType, SubmitFlowStep200BrandingLayout, SubmitFlowStep200StepChallengeMethod, SubmitFlowStep200StepComplete, SubmitFlowStep200StepFieldsType, SubmitFlowStep200StepFieldsValidationFormat, SubmitFlowStep200StepGatesKind, SubmitFlowStep400BrandingLayout, SubmitFlowStep400StepChallengeMethod, SubmitFlowStep400StepComplete, SubmitFlowStep400StepFieldsType, SubmitFlowStep400StepFieldsValidationFormat, SubmitFlowStep400StepGatesKind, UpdateFlowDefinitionBodyStepsItemComplete, UpdateFlowDefinitionBodyStepsItemGatesKind, UpdateFlowDefinitionBodyStepsItemOnSuccess, VerifyChallengeProof200ChallengesItemMethod, VerifyChallengeProof200ChallengesItemState, VerifyChallengeProof200CompletedFactorsItemMethod, VerifyChallengeProof200RequiredFactorsItem, VerifyChallengeProof200State };\n\n//# sourceMappingURL=index.mjs.map","/**\n * Lightweight paint-time validator for `Branding` payloads.\n *\n * Per `docs/design/branding/schema.md` §Shape invariants:\n *\n * 1. Every referenced URL is https.\n * 2. `layout` is in the documented enum.\n * 3. `liquid_template` shape checks happen elsewhere (security pipeline runs\n *    server-side; structural validator is deferred until the full atom set\n *    lands).\n *\n * Failures are non-fatal: we collect issues, log a dev-build warning, and\n * return a sanitised payload with the offending fields stripped (set to\n * `undefined`) so the orchestrator falls back to the bundled defaults.\n */\nimport { CreateFlow201BrandingLayout } from \"@zitadel/api/generated/model\";\n\nimport type { Branding } from \"./branding.js\";\n\nconst VALID_LAYOUTS = new Set<string>(Object.values(CreateFlow201BrandingLayout));\n\nexport type BrandingValidationResult = {\n  branding: Branding | undefined;\n  issues: readonly string[];\n};\n\nexport function validateBranding(input: Branding | undefined): BrandingValidationResult {\n  if (!input) {\n    return { branding: undefined, issues: [] };\n  }\n\n  const issues: string[] = [];\n  const out: Branding = { ...input };\n\n  if (out.layout && !VALID_LAYOUTS.has(out.layout)) {\n    issues.push(`Unknown layout \"${out.layout}\" — falling back to \"centered\".`);\n    out.layout = CreateFlow201BrandingLayout.centered;\n  }\n\n  out.logo_url = sanitiseUrl(out.logo_url, \"logo_url\", issues);\n  out.font_url = sanitiseUrl(out.font_url, \"font_url\", issues);\n  out.hero_url = sanitiseUrl(out.hero_url, \"hero_url\", issues);\n  if (out.assets) {\n    out.assets = {\n      logo_dark: sanitiseUrl(out.assets.logo_dark, \"assets.logo_dark\", issues),\n      favicon: sanitiseUrl(out.assets.favicon, \"assets.favicon\", issues),\n      background_image: sanitiseUrl(\n        out.assets.background_image,\n        \"assets.background_image\",\n        issues,\n      ),\n    };\n  }\n\n  return { branding: out, issues };\n}\n\nfunction sanitiseUrl(\n  value: string | undefined,\n  field: string,\n  issues: string[],\n): string | undefined {\n  if (value == null || value === \"\") {\n    return undefined;\n  }\n  try {\n    const parsed = new URL(value);\n    if (parsed.protocol !== \"https:\") {\n      issues.push(`${field} must use https (got \"${parsed.protocol}\") — dropped.`);\n      return undefined;\n    }\n    return parsed.toString();\n  } catch {\n    issues.push(`${field} is not a valid URL — dropped.`);\n    return undefined;\n  }\n}\n","/**\n * Inject `branding.font_url` as `<link rel=\"stylesheet\">` inside the\n * `<zitadel-login>` Shadow DOM. Per `docs/design/branding/templates.md`:\n *\n *   \"The `font_url` stylesheet is injected by the orchestrator; the template\n *    does not emit the `<link>` tag itself.\"\n *\n * Idempotent: calling with the same URL is a no-op; calling with a new URL\n * replaces the previous link. Calling with `null`/`undefined` removes any\n * previously injected link.\n */\nconst LINK_ID = \"zl-font-link\";\n\nexport function applyFontUrl(shadowRoot: ShadowRoot, fontUrl: string | null | undefined): void {\n  const existing = shadowRoot.getElementById?.(LINK_ID) as HTMLLinkElement | null;\n  if (!fontUrl) {\n    existing?.remove();\n    return;\n  }\n  if (existing && existing.href === fontUrl) {\n    return;\n  }\n  existing?.remove();\n  const ownerDocument = shadowRoot.ownerDocument ?? document;\n  const link = ownerDocument.createElement(\"link\");\n  link.id = LINK_ID;\n  link.rel = \"stylesheet\";\n  link.href = fontUrl;\n  shadowRoot.prepend(link);\n}\n","/**\n * `{% mandatory_gates %}` runtime patcher.\n *\n * Per `docs/design/branding/validator.md` §Runtime safety net:\n *\n *   \"After the template finishes rendering, the tag inspects the produced DOM\n *    and appends:\n *      - Any required `fields[*]` without a matching `<zl-field>`.\n *      - Any required `gates[*]` without a matching consumer.\n *      - A primary `<zl-button type=\"submit\">` if none was reached.\"\n *\n * Implementation: the LiquidJS `{% mandatory_gates %}` tag emits a unique\n * marker comment. After Liquid renders, this patcher parses the produced\n * HTML into a `<template>`, builds any missing atoms as real DOM elements,\n * replaces the marker with them, and serialises back to a string.\n *\n * Building elements via the DOM (`document.createElement` + `setAttribute`)\n * delegates HTML attribute escaping to the browser's serialiser — no manual\n * string-escaping in this module.\n */\nimport type { CreateFlow201Step } from \"@zitadel/api/generated/model\";\n\nimport type { Locale } from \"./locales/en.js\";\n\nexport const MANDATORY_GATES_MARKER = \"ZL_MANDATORY_GATES\";\n\nexport const mandatoryGatesMarkerComment = `<!--${MANDATORY_GATES_MARKER}-->`;\n\nexport function patchMandatoryGates(\n  html: string,\n  step: CreateFlow201Step,\n  locale: Locale,\n): string {\n  const template = document.createElement(\"template\");\n  template.innerHTML = html;\n  const fragment = template.content;\n\n  const additions = collectMissingAtoms(fragment, step, locale);\n  const marker = findMarkerComment(fragment);\n\n  if (marker?.parentNode) {\n    for (const node of additions) {\n      marker.parentNode.insertBefore(node, marker);\n    }\n    marker.remove();\n  } else {\n    for (const node of additions) {\n      fragment.appendChild(node);\n    }\n  }\n\n  return template.innerHTML;\n}\n\nfunction collectMissingAtoms(\n  fragment: DocumentFragment,\n  step: CreateFlow201Step,\n  locale: Locale,\n): Element[] {\n  const additions: Element[] = [];\n\n  if (step.fields) {\n    for (const [name, field] of Object.entries(step.fields)) {\n      if (!field.required) continue;\n      if (hasFieldFor(fragment, name)) continue;\n      additions.push(buildField(name, field.text_key, field.type, locale, field.required));\n    }\n  }\n\n  if (step.actions && !hasPrimaryButton(fragment)) {\n    const primary = Object.entries(step.actions).find(([, action]) => action.primary);\n    if (primary) {\n      const [name, action] = primary;\n      additions.push(buildSubmit(name, action.text_key, locale));\n    }\n  }\n\n  return additions;\n}\n\nfunction hasPrimaryButton(fragment: DocumentFragment): boolean {\n  // CSS attribute selectors with quotes are fine for static values like\n  // \"primary\"; no escaping risk here.\n  return Boolean(fragment.querySelector('zl-button[hierarchy=\"primary\"]'));\n}\n\nfunction hasFieldFor(fragment: DocumentFragment, name: string): boolean {\n  // We avoid a CSS attribute selector here so we don't have to worry about\n  // escaping arbitrary characters in `name` (which comes from the step JSON).\n  // Walking the small set of <zl-field> nodes is fine.\n  for (const field of fragment.querySelectorAll(\"zl-field\")) {\n    if (field.getAttribute(\"name\") === name) return true;\n  }\n  return false;\n}\n\nfunction findMarkerComment(fragment: DocumentFragment): Comment | null {\n  const walker = (fragment.ownerDocument ?? document).createTreeWalker(\n    fragment,\n    NodeFilter.SHOW_COMMENT,\n  );\n  let node: Node | null = walker.nextNode();\n  while (node) {\n    if (node.nodeValue?.trim() === MANDATORY_GATES_MARKER) {\n      return node as Comment;\n    }\n    node = walker.nextNode();\n  }\n  return null;\n}\n\nfunction buildField(\n  name: string,\n  textKey: string | undefined,\n  type: string,\n  locale: Locale,\n  required: boolean,\n): Element {\n  const el = document.createElement(\"zl-field\");\n  el.setAttribute(\"name\", name);\n  el.setAttribute(\"label\", lookup(locale, textKey ?? name));\n  el.setAttribute(\"type\", type);\n  if (required) {\n    el.setAttribute(\"required\", \"\");\n  }\n  return el;\n}\n\nfunction buildSubmit(name: string, textKey: string | undefined, locale: Locale): Element {\n  const el = document.createElement(\"zl-button\");\n  el.setAttribute(\"hierarchy\", \"primary\");\n  el.setAttribute(\"size\", \"medium\");\n  el.setAttribute(\"type\", \"submit\");\n  el.setAttribute(\"block\", \"\");\n  el.setAttribute(\"action\", name);\n  el.setAttribute(\"label\", lookup(locale, textKey ?? \"submit.continue\"));\n  return el;\n}\n\nfunction lookup(locale: Locale, key: string): string {\n  return locale[key] ?? key;\n}\n","/**\n * `auth-form` partial — Sign in and Sign up screens (Figma screens file).\n *\n * Sign up 2xl frame: `6593:141741` (card `6593:141743`, attribution `6593:141767`).\n * Sign in 2xl frame: `6593:141983`, card `6593:141985`, stack `6593:141989`\n * (email + password + forgot link + CTAs on one step).\n * Sign-in errors: wrong credentials `6602:180268`, server alert `6594:125237`.\n *\n * Figma `Field+CTAs` stacks fields + CTAs in one column at 16px (`spacing-03`).\n * Primary/secondary are 48px buttons; register / sign_in are body copy with a\n * purple text link (24px row) — not `<zl-button hierarchy=\"text\">`.\n */\nexport const authFormTemplate = String.raw`\n<zl-page-shell data-zl-template-root>\n  {% if branding.logo_url %}\n    <img slot=\"header\" class=\"zl-card-logo\" src=\"{{ branding.logo_url }}\" alt=\"\" />\n  {% endif %}\n  <zl-card>\n    <h1 slot=\"header\" class=\"zl-card-title\">{{ step.texts.title_key | t: identity.display_name }}</h1>\n    {% if step.texts.description_key %}\n      <p slot=\"header\" class=\"zl-card-subtitle\">{{ step.texts.description_key | t: identity.display_name }}</p>\n    {% endif %}\n\n    {% if errors and errors.size > 0 %}\n      {% for err in errors %}\n        {% if err | formLevelError %}\n          {% assign alert_heading = err.text_key | alertHeading %}\n          {% assign alert_body = err.text_key | alertBody %}\n          <zl-alert severity=\"error\"{% if alert_heading != \"\" %} heading=\"{{ alert_heading | t }}\"{% endif %}>\n            {% if alert_body != \"\" %}{{ alert_body | t }}{% elsif err.text_key %}{{ err.text_key | t }}{% else %}{{ err.message }}{% endif %}\n          </zl-alert>\n        {% endif %}\n      {% endfor %}\n    {% endif %}\n\n    {% for entry in fields %}\n      {% assign field_placeholder = entry[1].text_key | fieldPlaceholder %}\n      {% assign field_help = entry[1].text_key | fieldHelp %}\n      {% assign field_err = entry[0] | fieldError: errors %}\n      {% assign autocomplete_val = '' %}\n      {% if entry[0] == 'email' %}\n        {% assign autocomplete_val = 'email' %}\n      {% elsif entry[1].type == 'password' and step.name == 'register' %}\n        {% assign autocomplete_val = 'new-password' %}\n      {% elsif entry[1].type == 'password' %}\n        {% assign autocomplete_val = 'current-password' %}\n      {% endif %}\n      <zl-field\n        name=\"{{ entry[0] }}\"\n        label=\"{{ entry[1].text_key | t }}\"\n        type=\"{{ entry[1].type }}\"\n        value=\"{{ entry[1].value }}\"\n        {% if autocomplete_val != '' %}autocomplete=\"{{ autocomplete_val }}\"{% endif %}\n        {% if entry[1].required %}required{% endif %}\n        {% if field_placeholder != \"\" %}placeholder=\"{{ field_placeholder }}\"{% endif %}\n        {% if field_err != \"\" %}invalid error=\"{{ field_err }}\"{% endif %}\n      >\n        {% if field_help != \"\" %}\n          <span slot=\"help\">{{ field_help }}</span>\n        {% endif %}\n      </zl-field>\n    {% endfor %}\n\n    {% if fields.email and fields.password and step.name == 'identifier' %}\n      <p class=\"zl-card-forgot\">\n        <a href=\"#\" class=\"zl-card-forgot__link\" data-action=\"recover\">{{ 'action.forgot_password' | t }}</a>\n      </p>\n    {% endif %}\n\n    {% for entry in actions %}\n      {% if entry[1].primary %}\n        <zl-button\n          hierarchy=\"primary\"\n          size=\"medium\"\n          type=\"submit\"\n          block\n          action=\"{{ entry[0] }}\"\n          label=\"{{ entry[1].text_key | t }}\"\n          {% if loading %}loading{% endif %}\n        ></zl-button>\n      {% endif %}\n    {% endfor %}\n\n    {% if actions.passkey %}\n      <zl-button\n        hierarchy=\"secondary\"\n        size=\"medium\"\n        block\n        action=\"passkey\"\n        label=\"{{ actions.passkey.text_key | t }}\"\n      ></zl-button>\n    {% endif %}\n\n    {% if actions.register %}\n      <p class=\"zl-card-nav\">\n        {{ 'identifier.action.register.lead' | t }}<a href=\"#\" class=\"zl-card-nav__link\" data-action=\"register\">{{ 'identifier.action.register.link' | t }}</a>\n      </p>\n    {% endif %}\n\n    {% if actions.sign_in %}\n      <p class=\"zl-card-nav\">\n        {{ 'register.action.sign_in.lead' | t }}<a href=\"#\" class=\"zl-card-nav__link\" data-action=\"sign_in\">{{ 'register.action.sign_in.link' | t }}</a>\n      </p>\n    {% endif %}\n\n    {% if challenge and challenge.method == \"passkey\" %}\n      <zl-passkey\n        ceremony=\"{{ challenge.options.ceremony | default: 'authenticate' }}\"\n        challenge-id=\"{{ challenge.challenge_id }}\"\n        options='{{ challenge.options | json }}'\n      ></zl-passkey>\n    {% endif %}\n\n    {% mandatory_gates %}\n  </zl-card>\n</zl-page-shell>\n`;\n","/**\n * Bundled `default.liquid` master template.\n *\n * Renders the four target Figma auth screens (Sign in, Sign up, Passkey\n * upsell, Signed in) by including the appropriate partial based on\n * `step.name`. Tenant-specific layouts (`branding.layout`) replace the\n * outer chrome only — the per-step partials stay shared so atom output\n * tracks the design system without each tenant re-implementing it.\n *\n * Spec: docs/design/branding/templates.md.\n */\nexport const defaultTemplate = String.raw`\n{%- if step.name == 'signed-in' or step.complete == 'show' -%}\n  {%- include 'signed-in' -%}\n{%- elsif step.name == 'passkey' or step.name == 'passkey-upsell' or step.name == 'passkey-setup' or step.name == 'passkey-login' -%}\n  {%- include 'passkey-upsell' -%}\n{%- else -%}\n  {%- include 'auth-form' -%}\n{%- endif -%}\n`;\n\n/**\n * Layout chrome injected as an `adoptedStyleSheet` on the orchestrator's\n * shadow root. Provides the page background and the attribution-footer\n * positioning that lives *outside* any template — the rest of the visual\n * surface is owned by the `<zl-page-shell>` / `<zl-card>` atoms the\n * templates render. Token references resolve against the\n * `@zitadel/design-tokens` CSS variables that are present on\n * `:host` via the branding stylesheet.\n */\nexport const layoutChromeCss = `\n:host {\n  display: block;\n  min-height: 100%;\n  background: var(--zl-color-surface-default-black, #0f0f11);\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n}\n.zl-mount {\n  display: flex;\n  flex-direction: column;\n  min-height: 100vh;\n  background: inherit;\n  color: inherit;\n}\n.zl-mount > zl-page-shell,\n.zl-mount > [data-zl-template-root] {\n  flex: 1 1 auto;\n}\n.zl-attribution {\n  display: flex;\n  justify-content: center;\n  align-items: center;\n  background: transparent;\n}\n.zl-attribution[hidden] {\n  display: none;\n}\n/* Card header typography — Figma \"Desktop/Headings/Small\" + \"Body Small\n   Regular\" pattern shared by sign-in (6593:141740), passkey upsell\n   (6594:89142 / 6594:12796), and signed-in (6596:132845). Templates\n   slot raw <h1>/<p> elements into <zl-card>, which keeps them in the\n   light DOM where the orchestrator's stylesheet can reach them — the\n   atom intentionally doesn't dictate typography. */\n.zl-card-title {\n  margin: 0;\n  font-family: var(--zl-font-family-heading, var(--zl-font-family-sans, system-ui, sans-serif));\n  font-size: 2rem;\n  font-weight: 400;\n  line-height: 2.5rem;\n  letter-spacing: -0.02em;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  text-align: left;\n}\n.zl-card-subtitle {\n  margin: 0;\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  font-size: 0.875rem;\n  line-height: 1.25rem;\n  font-weight: 400;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n}\n/* Figma 6593:141989 / 6594:12882 — left-aligned in Field+CTAs (x=0, items-start). */\n.zl-card-nav {\n  margin: 0;\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  font-size: 1rem;\n  line-height: 1.5rem;\n  font-weight: 400;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  text-align: left;\n}\n.zl-card-nav__link {\n  display: inline;\n  margin: 0;\n  padding: 0;\n  border: none;\n  background: transparent;\n  font: inherit;\n  line-height: inherit;\n  color: var(--zl-color-icon-default-purple, #bba5e4);\n  text-decoration: none;\n  cursor: pointer;\n}\n.zl-card-nav__link:hover {\n  text-decoration: underline;\n}\n.zl-card-nav__link:focus-visible {\n  outline: var(--zl-focus-width, 2px) solid var(--zl-focus-color, #f4f4f6);\n  outline-offset: var(--zl-focus-offset, 2px);\n}\n/* Figma 6593:141989 — forgot password row (left-aligned, before CTAs). */\n.zl-card-forgot {\n  margin: 0;\n  text-align: left;\n}\n.zl-card-forgot__link {\n  display: inline;\n  margin: 0;\n  padding: 0;\n  border: none;\n  background: transparent;\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  font-size: 1rem;\n  line-height: 1.5rem;\n  font-weight: 400;\n  color: var(--zl-color-icon-default-purple, #bba5e4);\n  text-decoration: none;\n  cursor: pointer;\n}\n.zl-card-forgot__link:hover {\n  text-decoration: underline;\n}\n.zl-card-forgot__link:focus-visible {\n  outline: var(--zl-focus-width, 2px) solid var(--zl-focus-color, #f4f4f6);\n  outline-offset: var(--zl-focus-offset, 2px);\n}\n`;\n","/**\n * `passkey-upsell` partial — third Figma target screen (file\n * `xkvBjkOJ8ENuHdTGZHXezK`, node `6594:630`).\n *\n * Differs from `auth-form`:\n *   - heading + subtitle live in a compact card (gap 24px instead of 32px),\n *   - primary \"Set up passkey\" CTA carries a trailing 24px passkey icon\n *     (Figma slots the icon to the right of the label, not above it),\n *   - secondary \"Skip for now\" uses the dark secondary hierarchy, not the\n *     `text` hierarchy — the Figma button has a solid #252528 background.\n *\n * Server-side errors land in a `<zl-alert>` the same way as the auth form.\n */\nexport const passkeyUpsellTemplate = String.raw`\n<zl-page-shell data-zl-template-root>\n  {% if branding.logo_url %}\n    <img slot=\"header\" class=\"zl-card-logo\" src=\"{{ branding.logo_url }}\" alt=\"\" />\n  {% endif %}\n  <zl-card compact>\n    <h1 slot=\"header\" class=\"zl-card-title\">{{ step.texts.title_key | t: identity.display_name }}</h1>\n    <p slot=\"header\" class=\"zl-card-subtitle\">{{ 'passkey-upsell.description.line1' | t }}</p>\n    <p slot=\"header\" class=\"zl-card-subtitle\">{{ 'passkey-upsell.description.line2' | t }}</p>\n\n    {% if errors and errors.size > 0 %}\n      {% for err in errors %}\n        {% if err | formLevelError %}\n          <zl-alert severity=\"error\">\n            {% if err.text_key %}{{ err.text_key | t }}{% else %}{{ err.message }}{% endif %}\n          </zl-alert>\n        {% endif %}\n      {% endfor %}\n    {% endif %}\n\n    {% for entry in actions %}\n      {% if entry[1].primary %}\n        <zl-button\n          slot=\"footer\"\n          hierarchy=\"primary\"\n          size=\"medium\"\n          type=\"submit\"\n          block\n          action=\"{{ entry[0] }}\"\n          {% if loading %}loading disabled{% endif %}\n        >\n          {{ entry[1].text_key | t }}\n          <zl-icon slot=\"trailing\" name=\"passkey\" size=\"24\"></zl-icon>\n        </zl-button>\n      {% endif %}\n    {% endfor %}\n\n    {% for entry in actions %}\n      {% unless entry[1].primary %}\n        <zl-button\n          slot=\"footer\"\n          hierarchy=\"secondary\"\n          size=\"medium\"\n          type=\"button\"\n          block\n          action=\"{{ entry[0] }}\"\n          label=\"{{ entry[1].text_key | t }}\"\n        ></zl-button>\n      {% endunless %}\n    {% endfor %}\n\n    {% mandatory_gates %}\n\n    {% if challenge and challenge.method == \"passkey\" %}\n      <zl-passkey\n        ceremony=\"{{ challenge.options.ceremony | default: 'register' }}\"\n        challenge-id=\"{{ challenge.challenge_id }}\"\n        options='{{ challenge.options | json }}'\n      ></zl-passkey>\n    {% endif %}\n  </zl-card>\n</zl-page-shell>\n`;\n","/**\n * `signed-in` partial — fourth Figma target screen (file\n * `xkvBjkOJ8ENuHdTGZHXezK`, node `6596:132844`).\n *\n * Figma layout:\n *   - heading \"You're signed in as\" (left-aligned, full width)\n *   - body line with the authenticated email address (Arimo Regular 16/24)\n *   - \"Continue\" primary CTA\n *   - \"Logout\" secondary CTA\n *\n * No avatar / identity hero glyph: the Figma frame is intentionally a\n * pure modal layover and dropping the avatar keeps the orchestrator\n * default in lockstep with the spec.\n *\n * Rendered when the flow returns a terminal step (`complete: \"show\"`)\n * and no `post-sign-in-url` is configured, so the user can confirm the\n * identity before the host SPA takes over.\n */\nexport const signedInTemplate = String.raw`\n<zl-page-shell data-zl-template-root>\n  {% if branding.logo_url %}\n    <img slot=\"header\" class=\"zl-card-logo\" src=\"{{ branding.logo_url }}\" alt=\"\" />\n  {% endif %}\n  <zl-card compact>\n    <h1 slot=\"header\" class=\"zl-card-title\">\n      {{ step.texts.title_key | t: identity.display_name }}\n    </h1>\n    {% if identity.email_address or identity.display_name %}\n      <p slot=\"header\" class=\"zl-card-subtitle\">\n        {{ identity.email_address | default: identity.display_name }}\n      </p>\n    {% endif %}\n\n    {% if errors and errors.size > 0 %}\n      {% for err in errors %}\n        <zl-alert severity=\"error\">{{ err.text_key | t }}</zl-alert>\n      {% endfor %}\n    {% endif %}\n\n    {% if actions and actions.size > 0 %}\n      {% for entry in actions %}\n        {% if entry[1].primary %}\n          <zl-button\n            slot=\"footer\"\n            hierarchy=\"primary\"\n            size=\"medium\"\n            type=\"submit\"\n            block\n            action=\"{{ entry[0] }}\"\n            label=\"{{ entry[1].text_key | t }}\"\n            {% if loading %}loading{% endif %}\n          ></zl-button>\n        {% endif %}\n      {% endfor %}\n\n      {% for entry in actions %}\n        {% unless entry[1].primary %}\n          <zl-button\n            slot=\"footer\"\n            hierarchy=\"secondary\"\n            size=\"medium\"\n            block\n            action=\"{{ entry[0] }}\"\n            label=\"{{ entry[1].text_key | t }}\"\n          ></zl-button>\n        {% endunless %}\n      {% endfor %}\n    {% else %}\n      {% comment %}\n        Fallback when the API ships a terminal step with no actions —\n        matches Figma node 6596:132844 which always renders Continue\n        + Logout. The orchestrator wires these to its built-in\n        continue / logout handlers.\n      {% endcomment %}\n      <zl-button\n        slot=\"footer\"\n        hierarchy=\"primary\"\n        size=\"medium\"\n        type=\"submit\"\n        block\n        action=\"continue\"\n        label=\"{{ 'signed-in.continue' | t }}\"\n      ></zl-button>\n      <zl-button\n        slot=\"footer\"\n        hierarchy=\"secondary\"\n        size=\"medium\"\n        block\n        action=\"logout\"\n        label=\"{{ 'signed-in.logout' | t }}\"\n      ></zl-button>\n    {% endif %}\n\n    {% mandatory_gates %}\n  </zl-card>\n</zl-page-shell>\n`;\n","/**\n * Names of the bundled Liquid templates the `<zitadel-login>` orchestrator\n * registers.\n *\n * This lives in its own module — separate from `liquid.ts` — so the public\n * barrel can re-export `TEMPLATE_NAMES` without dragging LiquidJS' `Liquid`\n * type (and its Node ambient-type requirements) into the published\n * declaration surface. See `liquid.ts` / the orchestrator barrel.\n */\nexport const TEMPLATE_NAMES = {\n  default: \"default\",\n  authForm: \"auth-form\",\n  passkeyUpsell: \"passkey-upsell\",\n  signedIn: \"signed-in\",\n} as const;\n","/**\n * LiquidJS engine factory for the `<zitadel-login>` orchestrator.\n *\n * Configures the engine per the security pipeline in\n * `docs/design/flowengine/template-security.md` and registers the\n * `| t` filter and `{% mandatory_gates %}` tag from\n * `docs/design/branding/templates.md`.\n *\n * Hard rules:\n *\n * - `{{ }}` output is HTML-escaped (LiquidJS default since v10).\n * - The `| raw` filter is overridden to a no-op string passthrough that still\n *   escapes (Layer 1 of the security pipeline).\n * - Partials are loaded from an in-memory map; no filesystem access.\n */\nimport { Liquid } from \"liquidjs\";\n\nimport type { FlowError } from \"./template-context.js\";\nimport type { Locale } from \"./locales/en.js\";\nimport { mandatoryGatesMarkerComment } from \"./mandatory-gates.js\";\nimport { authFormTemplate } from \"./templates/auth-form.liquid.js\";\nimport { defaultTemplate } from \"./templates/default.liquid.js\";\nimport { passkeyUpsellTemplate } from \"./templates/passkey-upsell.liquid.js\";\nimport { signedInTemplate } from \"./templates/signed-in.liquid.js\";\nimport { TEMPLATE_NAMES } from \"./template-names.js\";\n\nexport type CreateLiquidOptions = {\n  locale: Locale;\n  /**\n   * Additional in-memory templates merged on top of the bundled defaults.\n   * Useful for tests and for tenant-supplied `branding.liquid_template`\n   * (registered under {@link TEMPLATE_NAMES.default}).\n   */\n  templates?: Record<string, string>;\n};\n\nexport function createLiquidEngine(options: CreateLiquidOptions): Liquid {\n  const templates: Record<string, string> = {\n    [TEMPLATE_NAMES.default]: defaultTemplate,\n    [TEMPLATE_NAMES.authForm]: authFormTemplate,\n    [TEMPLATE_NAMES.passkeyUpsell]: passkeyUpsellTemplate,\n    [TEMPLATE_NAMES.signedIn]: signedInTemplate,\n    ...(options.templates ?? {}),\n  };\n\n  const engine = new Liquid({\n    templates,\n    cache: true,\n    jsTruthy: true,\n    relativeReference: false,\n    strictFilters: false,\n    strictVariables: false,\n    outputEscape: \"escape\",\n  });\n\n  // Layer 1.5 — drop the `| raw` filter. We return a plain string instead of\n  // the engine's \"safe\" marker, so the configured `outputEscape: \"escape\"`\n  // still applies. Templates that historically used `| raw` therefore no\n  // longer bypass auto-escaping.\n  engine.registerFilter(\"raw\", (value: unknown) => stringify(value));\n\n  // The i18n filter. Looks up `text_key` in the active locale dictionary.\n  // Extra args become positional `{n}` substitutions:\n  //\n  //   {{ \"password.title\" | t: identity.display_name }}\n  //   -> \"Welcome back, Alice\"\n  engine.registerFilter(\n    \"t\",\n    function tFilter(this: { context: unknown }, key: unknown, ...args: unknown[]) {\n      const lookupKey = stringify(key);\n      const template = options.locale[lookupKey] ?? lookupKey;\n      return interpolate(template, args.map(stringify));\n    },\n  );\n\n  /** Resolves `{text_key}.placeholder` — empty when undefined (not the raw key). */\n  engine.registerFilter(\"fieldPlaceholder\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.placeholder`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /** Resolves `{text_key}.help` — empty when undefined. */\n  engine.registerFilter(\"fieldHelp\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.help`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /** Maps `error.*` text keys to a field name (Figma inline-error annotations). */\n  const fieldErrorKeys: Record<string, string> = {\n    \"error.email_required\": \"email\",\n    \"error.email_invalid\": \"email\",\n    \"error.email_exists\": \"email\",\n    \"error.password_required\": \"password\",\n    \"error.password_incorrect\": \"password\",\n    \"error.invalid_credentials\": \"password\",\n  };\n\n  /** Resolves `{text_key}.title` for form-level `<zl-alert heading>`. */\n  engine.registerFilter(\"alertHeading\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.title`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /** Resolves `{text_key}.body` for form-level `<zl-alert>` message slot. */\n  engine.registerFilter(\"alertBody\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.body`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /** Localized inline error for `fieldName`, or empty when none applies. */\n  engine.registerFilter(\"fieldError\", (fieldName: unknown, errors: unknown) => {\n    const name = stringify(fieldName);\n    if (!Array.isArray(errors)) return \"\";\n    for (const item of errors) {\n      const err = item as FlowError;\n      const key = err.text_key ?? \"\";\n      if (fieldErrorKeys[key] === name) {\n        return options.locale[key] ?? key;\n      }\n    }\n    return \"\";\n  });\n\n  /** True when the error should render as `<zl-alert>`, not on a field. */\n  engine.registerFilter(\"formLevelError\", (err: unknown) => {\n    const key = (err as FlowError)?.text_key ?? \"\";\n    return key === \"\" || !(key in fieldErrorKeys);\n  });\n\n  // `{% mandatory_gates %}` — emits a unique marker comment that the\n  // orchestrator post-processes via `patchMandatoryGates`.\n  engine.registerTag(\"mandatory_gates\", {\n    parse() {\n      // No body, no args — nothing to consume.\n    },\n    render() {\n      return mandatoryGatesMarkerComment;\n    },\n  });\n\n  return engine;\n}\n\nfunction stringify(value: unknown): string {\n  if (value == null) return \"\";\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\") return String(value);\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return String(value);\n  }\n}\n\nfunction interpolate(template: string, args: readonly string[]): string {\n  if (args.length === 0) return template;\n  return template.replace(/\\{(\\d+)\\}/g, (match, index) => {\n    const i = Number(index);\n    return args[i] ?? match;\n  });\n}\n","/**\n * Minimal English locale dictionary.\n *\n * The `| t` filter looks up `text_key` strings here. Missing keys fall through\n * to the raw key (matches the spec in\n * `docs/design/flowengine/flow-engine-guide.md`).\n *\n * Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).\n * MVP only — multi-locale support is deferred.\n */\nexport const en: Record<string, string> = {\n  // --- Sign in (Figma 2xl `6593:141983`, card `6593:141985`, stack `6593:141989`) ---\n  \"identifier.title\": \"Sign in\",\n  \"identifier.field.email\": \"Work email\",\n  \"identifier.field.email.placeholder\": \"you@company.com\",\n  \"identifier.field.password\": \"Password\",\n  \"identifier.action.passkey\": \"Sign in with a passkey\",\n  \"identifier.action.register.lead\": \"Don't have an account? \",\n  \"identifier.action.register.link\": \"Sign up\",\n\n  // --- Sign in / password step (same screen; split flow step 2) ---\n  \"password.title\": \"Sign in\",\n  \"password.field.password\": \"Password\",\n  \"password.action.passkey\": \"Sign in with a passkey\",\n  \"password.action.register.lead\": \"Don't have an account? \",\n  \"password.action.register.link\": \"Sign up\",\n\n  // --- Sign up (2xl frame `6593:141741`, card `6593:141743`; see Figma dev annotations) ---\n  \"register.title\": \"Create your account\",\n  \"register.field.email\": \"Work email\",\n  \"register.field.email.placeholder\": \"you@company.com\",\n  \"register.field.password\": \"Password\",\n  \"register.field.password.help\":\n    \"At least 8 characters, including a symbol and number.\",\n  \"register.action.submit\": \"Sign up\",\n  \"register.action.sign_in.lead\": \"Already have an account? \",\n  \"register.action.sign_in.link\": \"Sign in\",\n\n  // --- Passkey upsell (`6594:630`, heading `6594:89142`, body `6594:12796`) ---\n  \"passkey-upsell.title\": \"Sign in faster next time\",\n  \"passkey-upsell.description.line1\": \"No password needed ever again.\",\n  \"passkey-upsell.description.line2\": \"Sign in with Face ID, Touch ID, or PIN.\",\n  \"passkey-upsell.action.setup\": \"Set up passkey\",\n  \"passkey-upsell.action.skip\": \"Skip for now\",\n  /** Figma `6594:630` setup-passkey annotations — form-level `<zl-alert>`. */\n  \"error.passkey_cancelled\": \"Passkey setup was cancelled\",\n  \"error.passkey_not_registered\": \"This passkey is not registered. Please sign in with your email and password.\",\n  \"error.passkey_setup_failed\": \"Passkey registration did not complete. Please try again.\",\n  \"error.passkey_unsupported\": \"This device does not support passkeys\",\n  \"error.passkey_failed\": \"Something went wrong. Please try again.\",\n\n  // --- Signed in (`6596:132846`) ---\n  \"complete.title\": \"You're signed in as\",\n  \"signed-in.continue\": \"Continue\",\n  \"signed-in.logout\": \"Logout\",\n\n  // --- Password recovery ---\n  \"recover.title\": \"Check your email\",\n  \"recover.description\":\n    \"We sent a password reset link to your email address.\",\n  \"recover.action.back\": \"Back to sign in\",\n\n  // --- Passkey login ---\n  \"passkey-login.title\": \"Sign in with your passkey\",\n\n  // --- Shared actions ---\n  \"submit.continue\": \"Continue\",\n  \"submit.signin\": \"Sign in\",\n  \"action.forgot_password\": \"Forgot password?\",\n  \"action.cancel\": \"Cancel\",\n\n  // --- SSO ---\n  \"sso.redirect.title\": \"Redirecting to your provider…\",\n\n  // --- Field / form errors (Figma field annotations) ---\n  \"error.email_required\": \"Please enter an email address\",\n  \"error.email_invalid\": \"Please enter a valid email\",\n  \"error.password_required\": \"Please enter a password\",\n  \"error.password_incorrect\": \"Wrong email or password.\",\n  \"error.email_exists\": \"An account with this email already exists.\",\n  /** Figma sign-in error `6602:180268` — inline on password field. */\n  \"error.invalid_credentials\": \"Wrong email or password.\",\n  \"error.required\": \"This field is required.\",\n\n  // --- Sign-in form-level alert (Figma `6594:125237`, alert `6596:132779`) ---\n  \"error.sign_in_server.title\": \"We couldn't complete your sign in.\",\n  \"error.sign_in_server.body\": \"Please try again in a few minutes\",\n};\n\nexport type Locale = Record<string, string>;\n","/**\n * German locale dictionary.\n *\n * Structure mirrors {@link en} — same keys, translated values.\n * Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).\n */\nimport type { Locale } from \"./en.js\";\n\nexport const de: Locale = {\n  // --- Anmelden (Figma 2xl `6593:141983`, card `6593:141985`, stack `6593:141989`) ---\n  \"identifier.title\": \"Anmelden\",\n  \"identifier.field.email\": \"E-Mail\",\n  \"identifier.field.email.placeholder\": \"du@unternehmen.com\",\n  \"identifier.field.password\": \"Passwort\",\n  \"identifier.action.passkey\": \"Mit Passkey anmelden\",\n  \"identifier.action.register.lead\": \"Noch kein Konto? \",\n  \"identifier.action.register.link\": \"Registrieren\",\n\n  // --- Anmelden / Passwort-Schritt (gleicher Bildschirm; geteilter Flow Schritt 2) ---\n  \"password.title\": \"Anmelden\",\n  \"password.field.password\": \"Passwort\",\n  \"password.action.passkey\": \"Mit Passkey anmelden\",\n  \"password.action.register.lead\": \"Noch kein Konto? \",\n  \"password.action.register.link\": \"Registrieren\",\n\n  // --- Registrieren (2xl frame `6593:141741`, card `6593:141743`) ---\n  \"register.title\": \"Konto erstellen\",\n  \"register.field.email\": \"E-Mail\",\n  \"register.field.email.placeholder\": \"du@unternehmen.com\",\n  \"register.field.password\": \"Passwort\",\n  \"register.field.password.help\":\n    \"Mindestens 8 Zeichen, einschließlich eines Sonderzeichens und einer Zahl.\",\n  \"register.action.submit\": \"Registrieren\",\n  \"register.action.sign_in.lead\": \"Bereits ein Konto? \",\n  \"register.action.sign_in.link\": \"Anmelden\",\n\n  // --- Passkey Upsell (`6594:630`) ---\n  \"passkey-upsell.title\": \"Nächstes Mal schneller anmelden\",\n  \"passkey-upsell.description.line1\": \"Kein Passwort mehr nötig.\",\n  \"passkey-upsell.description.line2\":\n    \"Melde dich mit Face ID, Touch ID oder PIN an.\",\n  \"passkey-upsell.action.setup\": \"Passkey einrichten\",\n  \"passkey-upsell.action.skip\": \"Vorerst überspringen\",\n  \"error.passkey_cancelled\": \"Passkey-Einrichtung wurde abgebrochen\",\n  \"error.passkey_not_registered\":\n    \"Dieser Passkey ist nicht registriert. Bitte melde dich mit E-Mail und Passwort an.\",\n  \"error.passkey_setup_failed\":\n    \"Passkey-Registrierung wurde nicht abgeschlossen. Bitte versuche es erneut.\",\n  \"error.passkey_unsupported\":\n    \"Dieses Gerät unterstützt keine Passkeys\",\n  \"error.passkey_failed\": \"Etwas ist schiefgelaufen. Bitte versuche es erneut.\",\n\n  // --- Angemeldet (`6596:132846`) ---\n  \"complete.title\": \"Du bist angemeldet als\",\n  \"signed-in.continue\": \"Weiter\",\n  \"signed-in.logout\": \"Abmelden\",\n\n  // --- Passwort-Wiederherstellung ---\n  \"recover.title\": \"E-Mail prüfen\",\n  \"recover.description\":\n    \"Wir haben einen Link zum Zurücksetzen des Passworts an deine E-Mail-Adresse gesendet.\",\n  \"recover.action.back\": \"Zurück zur Anmeldung\",\n\n  // --- Passkey Login ---\n  \"passkey-login.title\": \"Mit Passkey anmelden\",\n\n  // --- Gemeinsame Aktionen ---\n  \"submit.continue\": \"Weiter\",\n  \"submit.signin\": \"Anmelden\",\n  \"action.forgot_password\": \"Passwort vergessen?\",\n  \"action.cancel\": \"Abbrechen\",\n\n  // --- SSO ---\n  \"sso.redirect.title\": \"Weiterleitung zum Anbieter…\",\n\n  // --- Feld- / Formularfehler ---\n  \"error.email_required\": \"Bitte gib eine E-Mail-Adresse ein\",\n  \"error.email_invalid\": \"Bitte gib eine gültige E-Mail-Adresse ein\",\n  \"error.password_required\": \"Bitte gib ein Passwort ein\",\n  \"error.password_incorrect\": \"Falsche E-Mail oder falsches Passwort.\",\n  \"error.email_exists\": \"Ein Konto mit dieser E-Mail-Adresse existiert bereits.\",\n  \"error.invalid_credentials\": \"Falsche E-Mail oder falsches Passwort.\",\n  \"error.required\": \"Dieses Feld ist erforderlich.\",\n\n  // --- Formular-Alerts ---\n  \"error.sign_in_server.title\": \"Anmeldung konnte nicht abgeschlossen werden.\",\n  \"error.sign_in_server.body\": \"Bitte versuche es in einigen Minuten erneut\",\n};\n","/**\n * Built-in locale registry.\n *\n * Re-exports the individual dictionaries and provides a `builtinLocales`\n * map so the orchestrator can resolve a BCP 47 language tag to the\n * matching dictionary at runtime.\n */\nexport { en, type Locale } from \"./en.js\";\nexport { de } from \"./de.js\";\n\nimport { en, type Locale } from \"./en.js\";\nimport { de } from \"./de.js\";\n\nexport const builtinLocales: Readonly<Record<string, Locale>> = { en, de };\n","//#region src/attribution-markup.ts\n/**\n* Figma sign-in attribution chip (`6593:141767`): \"Secured with\" + 65×16 logotype.\n* Shared by Lit orchestrator HTML, dev playground, and paired React playgrounds.\n*/\nconst ZITADEL_ATTRIBUTION_LOGOTYPE_SVG = \"<svg class=\\\"zr-pill__logotype-svg\\\" xmlns=\\\"http://www.w3.org/2000/svg\\\" viewBox=\\\"0 0 67.3501 15.1111\\\" width=\\\"65\\\" height=\\\"16\\\" fill=\\\"currentColor\\\" aria-hidden=\\\"true\\\" focusable=\\\"false\\\"><path d=\\\"M2.04839 4.265C2.06224 4.1284 2.1748 3.98591 2.32756 3.91161L8.98593 0.0494262C9.227 -0.0678242 9.45274 0.0334116 9.43089 0.248972V4.52681C9.41705 4.66341 9.30448 4.80589 9.15172 4.88019L2.49335 8.66426C2.25228 8.78151 2.02654 8.68027 2.04839 8.46471V4.265Z\\\"/><path d=\\\"M14.0086 5.25359C14.12 5.33388 14.1871 5.50261 14.1751 5.67205V13.2643C14.1561 13.5317 13.9555 13.6766 13.7798 13.5499L10.1005 11.4468C9.98908 11.3666 9.92196 11.1978 9.934 11.0284V3.32695C9.95299 3.05956 10.1535 2.91467 10.3293 3.04138L14.0086 5.25359Z\\\"/><path d=\\\"M7.37428 15.0817C7.24906 15.138 7.06938 15.1118 6.92865 15.0167L0.183465 11.1405C-0.038611 10.9903 -0.0638098 10.7442 0.133796 10.6554L3.76278 8.53833C3.888 8.48203 4.06767 8.50827 4.2084 8.60341L10.9046 12.5341C11.1267 12.6843 11.1557 12.9125 10.9543 13.0193L7.37428 15.0817Z\\\"/><path d=\\\"M65.6687 13.1043V2.00077H67.3501V13.1043H65.6687Z\\\"/><path d=\\\"M60.4255 13.2947C59.6535 13.2947 58.9715 13.1202 58.3793 12.7712C57.7871 12.4222 57.3218 11.9358 56.9834 11.3119C56.6556 10.688 56.4917 9.97418 56.4917 9.1705C56.4917 8.33509 56.6556 7.61073 56.9834 6.99739C57.3112 6.38405 57.7712 5.90819 58.3634 5.56979C58.9662 5.22083 59.6588 5.04634 60.4414 5.04634C61.2027 5.04634 61.869 5.21554 62.44 5.55393C63.011 5.88175 63.4552 6.33118 63.7724 6.90222C64.1002 7.47326 64.2642 8.12359 64.2642 8.85325C64.2642 9.0013 64.2589 9.1282 64.2483 9.23395C64.2483 9.33969 64.2377 9.46659 64.2166 9.61464H58.1731C58.2048 10.0588 58.3158 10.4553 58.5062 10.8043C58.6965 11.1427 58.9556 11.4124 59.2834 11.6133C59.6112 11.8036 59.9866 11.8988 60.4096 11.8988C60.8644 11.8988 61.2503 11.7983 61.5676 11.5974C61.8954 11.3859 62.1386 11.0898 62.2972 10.7091H64.0421C63.9046 11.185 63.672 11.6186 63.3441 12.0098C63.0269 12.4011 62.6251 12.7131 62.1386 12.9457C61.6522 13.1784 61.0811 13.2947 60.4255 13.2947ZM58.1889 8.42497H62.551C62.5299 7.81163 62.3131 7.3305 61.9007 6.98153C61.4883 6.62199 60.986 6.44222 60.3938 6.44222C59.865 6.44222 59.3839 6.60613 58.9503 6.93394C58.5168 7.26176 58.263 7.75876 58.1889 8.42497Z\\\"/><path d=\\\"M50.5389 13.2947C49.7563 13.2947 49.0796 13.1096 48.5085 12.7395C47.9481 12.3588 47.5145 11.8565 47.2078 11.2326C46.9117 10.6087 46.7637 9.91073 46.7637 9.13877C46.7637 8.37739 46.9117 7.69004 47.2078 7.0767C47.5145 6.45279 47.9481 5.96106 48.5085 5.60152C49.0796 5.2314 49.7563 5.04634 50.5389 5.04634C51.1205 5.04634 51.6492 5.16795 52.1251 5.41117C52.601 5.64382 52.9869 5.97692 53.283 6.41049V2.00077H54.9803V13.1043H53.3465L53.283 11.8829C53.0292 12.2954 52.6644 12.6337 52.1886 12.8981C51.7127 13.1625 51.1628 13.2947 50.5389 13.2947ZM50.872 11.8195C51.369 11.8195 51.7973 11.7032 52.1568 11.4705C52.5164 11.2379 52.7913 10.9206 52.9817 10.5188C53.172 10.1169 53.2672 9.66751 53.2672 9.1705C53.2672 8.59946 53.1561 8.1183 52.9341 7.72704C52.7226 7.33577 52.4318 7.0344 52.0617 6.82291C51.7021 6.61141 51.3003 6.50567 50.8561 6.50567C50.4014 6.50567 49.9943 6.6167 49.6347 6.83877C49.2752 7.06084 48.9897 7.36749 48.7782 7.75876C48.5773 8.15003 48.4768 8.61532 48.4768 9.15463C48.4768 9.68337 48.5825 10.1487 48.794 10.5505C49.0055 10.9524 49.2911 11.2643 49.6506 11.4864C50.0101 11.7085 50.4173 11.8195 50.872 11.8195Z\\\"/><path d=\\\"M40.7882 13.2947C40.2806 13.2947 39.8153 13.2048 39.3923 13.025C38.9693 12.8347 38.6309 12.5597 38.3771 12.2002C38.1233 11.8406 37.9965 11.4071 37.9965 10.8995C37.9965 10.2967 38.1445 9.81556 38.4406 9.45602C38.7473 9.0859 39.1544 8.81624 39.662 8.64704C40.1801 8.46727 40.7459 8.37739 41.3592 8.37739H43.3579C43.3579 7.92267 43.2839 7.55786 43.1358 7.28291C42.9878 6.99739 42.7868 6.79118 42.533 6.66429C42.2792 6.52681 41.9832 6.45808 41.6448 6.45808C41.2006 6.45808 40.8094 6.56383 40.471 6.77532C40.1431 6.97624 39.9369 7.29876 39.8523 7.7429H38.1551C38.2079 7.17186 38.3983 6.68544 38.7261 6.28359C39.0645 5.88175 39.4928 5.57508 40.011 5.36358C40.5291 5.15209 41.079 5.04634 41.6606 5.04634C42.422 5.04634 43.0512 5.1891 43.5482 5.47462C44.0558 5.74957 44.4312 6.13555 44.6744 6.63256C44.9282 7.12958 45.0551 7.69531 45.0551 8.3298V10.7409C45.0657 11.0475 45.1292 11.2749 45.2455 11.4229C45.3724 11.5604 45.5945 11.6397 45.9117 11.6609V13.1043C45.4887 13.1043 45.1186 13.0567 44.8013 12.9616C44.4947 12.8664 44.2409 12.7236 44.04 12.5333C43.839 12.3324 43.6804 12.0786 43.5641 11.7719C43.3103 12.1949 42.9402 12.5544 42.4537 12.8505C41.9673 13.1466 41.4121 13.2947 40.7882 13.2947ZM41.1848 11.9147C41.6183 11.9147 41.999 11.8089 42.3268 11.5974C42.6547 11.3753 42.9084 11.0898 43.0882 10.7409C43.268 10.3813 43.3579 9.99533 43.3579 9.58291V9.55119H41.4861C41.1795 9.55119 40.8887 9.5882 40.6137 9.66223C40.3493 9.73625 40.1326 9.86315 39.9634 10.0429C39.8047 10.2121 39.7254 10.45 39.7254 10.7567C39.7254 11.1586 39.8682 11.4547 40.1537 11.645C40.4392 11.8248 40.7829 11.9147 41.1848 11.9147Z\\\"/><path d=\\\"M35.5197 13.1043C34.7372 13.1043 34.1344 12.914 33.7114 12.5333C33.2884 12.1526 33.0769 11.5287 33.0769 10.6615V6.64842H31.8873V5.23669H33.0769V3.3332H34.7583V5.23669H36.757V6.64842H34.7583V10.6615C34.7583 11.0634 34.8482 11.333 35.028 11.4705C35.2078 11.608 35.488 11.6767 35.8687 11.6767H36.757V13.1043H35.5197Z\\\"/><path d=\\\"M29.6602 3.85668C29.3536 3.85668 29.0892 3.7509 28.8671 3.53941C28.6556 3.31734 28.5499 3.04768 28.5499 2.73043C28.5499 2.42376 28.6556 2.16468 28.8671 1.95319C29.0892 1.74169 29.3536 1.63594 29.6602 1.63594C29.9775 1.63594 30.2419 1.74169 30.4533 1.95319C30.6754 2.16468 30.7865 2.42376 30.7865 2.73043C30.7865 3.04768 30.6754 3.31734 30.4533 3.53941C30.2419 3.7509 29.9775 3.85668 29.6602 3.85668ZM28.8195 13.1043V5.23669H30.5009V13.1043H28.8195Z\\\"/><path d=\\\"M19.8276 13.1043V11.8036L25.1098 3.42837H19.8911V2.00077H27.0608V3.30147L21.7628 11.6609H27.1084V13.1043H19.8276Z\\\"/></svg>\";\n/** Inner markup for the default Zitadel attribution pill (label + logotype). */\nfunction zitadelAttributionPillInnerHtml() {\n\treturn `Secured with <span class=\"zr-pill__logotype\">${ZITADEL_ATTRIBUTION_LOGOTYPE_SVG}</span>`;\n}\n//#endregion\nexport { ZITADEL_ATTRIBUTION_LOGOTYPE_SVG, zitadelAttributionPillInnerHtml };\n\n//# sourceMappingURL=attribution-markup.mjs.map","/**\n * Layer 2 of the template security pipeline (`docs/design/flowengine/template-security.md`).\n *\n * Wraps DOMPurify with the configuration the auth-UI templates need:\n *\n * - Allow every `<zl-*>` custom element registered in the manifest registry,\n *   plus the union of attributes declared on each manifest.\n * - Allow common HTML structural / typographic tags used by `default.liquid`.\n * - Strip `on*` event handlers and any `<script>` / `<style>` tags (theming is\n *   orchestrator-owned via `adoptedStyleSheets`).\n *\n * Runs after Liquid finishes rendering and before the HTML is handed to Lit's\n * `unsafeHTML` directive.\n */\nimport DOMPurify, { type Config } from \"dompurify\";\n\nimport { manifestRegistry } from \"../manifests.js\";\n\n/**\n * Standard HTML tags that templates may use as structural chrome around\n * `<zl-*>` atoms. Anything outside this list and the manifest registry is\n * stripped at sanitise-time.\n */\nconst STRUCTURAL_TAGS: readonly string[] = [\n  \"div\",\n  \"span\",\n  \"p\",\n  \"small\",\n  \"strong\",\n  \"em\",\n  \"br\",\n  \"hr\",\n  \"h1\",\n  \"h2\",\n  \"h3\",\n  \"h4\",\n  \"h5\",\n  \"h6\",\n  \"ul\",\n  \"ol\",\n  \"li\",\n  \"a\",\n  \"img\",\n  \"section\",\n  \"header\",\n  \"footer\",\n  \"main\",\n  \"nav\",\n  \"aside\",\n  \"article\",\n  \"figure\",\n  \"figcaption\",\n  \"label\",\n  \"fieldset\",\n  \"legend\",\n];\n\n/**\n * Attributes templates may carry on structural tags. Per-atom attributes are\n * derived from the manifest registry below — manifests are the single source\n * of truth for \"what attributes does `<zl-field>` accept?\".\n */\nconst COMMON_ATTRS: readonly string[] = [\n  \"id\",\n  \"class\",\n  \"role\",\n  \"slot\",\n  \"tabindex\",\n  \"lang\",\n  \"dir\",\n  \"alt\",\n  \"title\",\n  \"src\",\n  \"srcset\",\n  \"sizes\",\n  \"href\",\n  \"target\",\n  \"rel\",\n  \"style\",\n  \"name\",\n  \"for\",\n  \"data-theme\",\n  \"hidden\",\n];\n\nconst CUSTOM_TAG_PATTERN = /^zl-[a-z0-9-]+$/;\n\nfunction buildAllowedTagList(): string[] {\n  const set = new Set<string>(STRUCTURAL_TAGS);\n  for (const manifest of manifestRegistry) {\n    set.add(manifest.tag);\n  }\n  return [...set];\n}\n\nfunction buildAllowedAttrList(): string[] {\n  const set = new Set<string>(COMMON_ATTRS);\n  for (const manifest of manifestRegistry) {\n    for (const attr of manifest.attrs) {\n      set.add(attr);\n    }\n  }\n  return [...set];\n}\n\n/**\n * Returns a sanitiser bound to the current manifest registry. Callers should\n * cache the result; rebuilding is cheap but allocates a fresh DOMPurify config.\n */\nexport function createSanitiser(): (html: string) => string {\n  const config: Config = {\n    USE_PROFILES: { html: true },\n    ADD_TAGS: buildAllowedTagList(),\n    ADD_ATTR: buildAllowedAttrList(),\n    FORBID_TAGS: [\"script\", \"style\", \"iframe\", \"object\", \"embed\", \"form\", \"input\", \"button\"],\n    FORBID_ATTR: [\"onerror\", \"onclick\", \"onload\", \"onfocus\", \"onblur\"],\n    CUSTOM_ELEMENT_HANDLING: {\n      tagNameCheck: CUSTOM_TAG_PATTERN,\n      attributeNameCheck: /^(?:[a-z][a-z0-9-]*)$/,\n      allowCustomizedBuiltInElements: false,\n    },\n    KEEP_CONTENT: true,\n    ALLOW_DATA_ATTR: true,\n    ALLOW_ARIA_ATTR: true,\n    RETURN_TRUSTED_TYPE: false,\n  };\n\n  return function sanitise(html: string): string {\n    const result = DOMPurify.sanitize(html, config);\n    return typeof result === \"string\" ? result : String(result);\n  };\n}\n","/**\n * `ThemeController` — Lit ReactiveController that resolves the active\n * `light | dark` theme from the current `Branding` payload and keeps it in\n * sync with the OS-level `prefers-color-scheme` when the tenant opts into\n * `theme.mode = \"auto\"`.\n *\n * Per `docs/design/branding/tokens.md` the orchestrator owns theming entirely.\n * Subscribing here is what makes \"auto\" actually reactive instead of a\n * one-shot read at first paint.\n */\nimport type { ReactiveController, ReactiveControllerHost } from \"lit\";\n\nimport type { Branding } from \"./branding.js\";\n\nexport type ResolvedTheme = \"light\" | \"dark\";\n\nconst DARK_QUERY = \"(prefers-color-scheme: dark)\";\n\nexport class ThemeController implements ReactiveController {\n  private readonly host: ReactiveControllerHost;\n\n  private branding: Branding | undefined;\n\n  private mediaQuery: MediaQueryList | null = null;\n\n  // Default surface is dark — the design system only publishes a dark\n  // variable mode today. See `branding-to-tokens.resolveTheme` for the\n  // matching logic on the orchestrator side.\n  private _theme: ResolvedTheme = \"dark\";\n\n  constructor(host: ReactiveControllerHost) {\n    this.host = host;\n    host.addController(this);\n  }\n\n  get theme(): ResolvedTheme {\n    return this._theme;\n  }\n\n  setBranding(branding: Branding | undefined): void {\n    this.branding = branding;\n    this.refresh();\n  }\n\n  hostConnected(): void {\n    this.refresh();\n  }\n\n  hostDisconnected(): void {\n    this.detach();\n  }\n\n  private refresh(): void {\n    const mode = this.branding?.theme?.mode ?? \"dark\";\n    if (mode === \"auto\") {\n      this.attach();\n      // When tenants opt into auto and the OS preference is unknown, we\n      // bias toward dark since that's the only mode the design system\n      // currently publishes.\n      this.update(this.mediaQuery?.matches === false ? \"light\" : \"dark\");\n      return;\n    }\n    this.detach();\n    this.update(mode === \"light\" ? \"light\" : \"dark\");\n  }\n\n  private attach(): void {\n    if (this.mediaQuery || typeof matchMedia !== \"function\") return;\n    this.mediaQuery = matchMedia(DARK_QUERY);\n    this.mediaQuery.addEventListener(\"change\", this.onMediaChange);\n  }\n\n  private detach(): void {\n    if (!this.mediaQuery) return;\n    this.mediaQuery.removeEventListener(\"change\", this.onMediaChange);\n    this.mediaQuery = null;\n  }\n\n  private onMediaChange = (event: MediaQueryListEvent): void => {\n    // Auto-mode follows prefers-color-scheme. We watch the dark query, so\n    // `matches=true` ⇒ user wants dark.\n    this.update(event.matches ? \"dark\" : \"light\");\n  };\n\n  private update(next: ResolvedTheme): void {\n    if (this._theme === next) return;\n    this._theme = next;\n    this.host.requestUpdate();\n  }\n}\n","import { getZitadelConfig, getApi, type ZitadelProject } from \"@zitadel/api/config\";\nimport type {\n  CreateFlow201,\n  CreateFlow201Step,\n  CreateFlowBodyPurpose,\n  SubmitFlowStepBody,\n  SubmitFlowStepBodyChallengeResponse,\n} from \"@zitadel/api/generated/model\";\nimport { css, html, LitElement, type PropertyValues } from \"lit\";\nimport { customElement, property, state } from \"lit/decorators.js\";\nimport { unsafeHTML } from \"lit/directives/unsafe-html.js\";\nimport type { Liquid, Template } from \"liquidjs\";\n\nimport \"../atoms/index.js\";\nimport {\n  exchangeSession,\n  getCurrentStep,\n  startFlow as apiStartFlow,\n  submitStep as apiSubmitStep,\n} from \"./api-client.js\";\nimport type { Branding } from \"./branding.js\";\nimport { applyBaseTokens, applyBrandingTokens } from \"./branding-to-tokens.js\";\nimport { validateBranding } from \"./branding-validator.js\";\nimport { applyFontUrl } from \"./font-loader.js\";\nimport { createLiquidEngine } from \"./liquid.js\";\nimport { TEMPLATE_NAMES } from \"./template-names.js\";\nimport { en, builtinLocales, type Locale } from \"./locales/index.js\";\nimport { patchMandatoryGates } from \"./mandatory-gates.js\";\nimport { zitadelAttributionPillInnerHtml } from \"@zitadel/shared-component-styles/attribution-markup\";\nimport { createSanitiser } from \"./sanitiser.js\";\nimport type { FlowError, LiquidContext } from \"./template-context.js\";\nimport { layoutChromeCss } from \"./templates/default.liquid.js\";\nimport { ThemeController } from \"./theme-controller.js\";\n\n/**\n * `<zitadel-login>` — the auth-UI orchestrator.\n *\n * Drives the typed `@zitadel/api` Flow API directly: `POST /flow`\n * starts a flow, `POST /flow/{id}/submit` advances it. Renders each step\n * through LiquidJS, sanitises the output via DOMPurify, and mounts the\n * result inside a real `<form>` element in its Shadow DOM via Lit's\n * `unsafeHTML` directive. Atom CustomEvents (`zl-input` / `zl-submit`)\n * and the form's native `submit` event feed back into the\n * submit cycle.\n *\n * Form participation: the orchestrator owns the `<form>` so Enter submits,\n * browsers offer \"save password\" prompts, and password managers / autofill\n * see a real form. Each `<zl-field>` is form-associated (see\n * `docs/design/branding/form-participation.md`) so its value participates in\n * the form even though it lives inside its own shadow root. The shadow root\n * also delegates focus, and after each step swap focus moves to the first\n * field so screen-reader and keyboard users land in a sensible spot.\n *\n * Session/state: the server is stateless between requests — a `_zflow`\n * HttpOnly cookie carries orchestration state. We always run with\n * `credentials: \"include\"` (set in `api-client.ts`). The flow handle (`id`)\n * may rotate on pivots/pops; we re-read it from every response.\n *\n * Spec sources:\n * - `docs/design/flowengine/flow-engine-guide.md`\n * - `docs/design/branding/templates.md`\n * - `docs/design/branding/tokens.md`\n * - `docs/design/branding/schema.md`\n * - `docs/design/branding/form-participation.md`\n * - `docs/design/flowengine/template-security.md`\n */\n@customElement(\"zitadel-login\")\nexport class ZitadelLogin extends LitElement {\n  static override shadowRootOptions: ShadowRootInit = {\n    ...LitElement.shadowRootOptions,\n    delegatesFocus: true,\n  };\n\n  // Host layout defaults. A bare custom element is inline-level, which makes\n  // it collapse to content width when dropped into a `display: flex` parent\n  // and never reach the orchestrator's intended full-bleed shell. We claim\n  // the page by default; host pages that want to constrain the orchestrator\n  // can still set `width`/`min-height` on the element directly.\n  static override styles = css`\n    :host {\n      display: block;\n      width: 100%;\n      min-height: 100vh;\n    }\n  `;\n\n  @property({ type: String }) accessor purpose: CreateFlowBodyPurpose = \"login\";\n\n  /**\n   * SDK project handle returned by `configureZitadel()`. When set, takes\n   * precedence over the global singleton from `getZitadelConfig()`.\n   */\n  @property({ attribute: false }) accessor project: ZitadelProject | undefined;\n\n  /**\n   * URL to navigate to after a successful embedded sign-in. When set, the\n   * orchestrator exchanges the terminal `handoff_token` via the generated\n   * API client (setting the session cookie) and then performs a full\n   * navigation to this URL so host middleware can observe the cookie.\n   * For `complete: \"redirect\"` the orchestrator follows `redirect_uri`\n   * instead and does not run the exchange.\n   */\n  @property({ type: String, attribute: \"post-sign-in-url\" }) accessor postSignInUrl = \"\";\n\n  /**\n   * Existing flow handle to resume rather than start a new flow. When set,\n   * the orchestrator hits `GET /flow/{id}` instead of `POST /flow` on\n   * mount, so a page reload after a network blip can re-render the same\n   * step without losing collected state.\n   */\n  @property({ type: String, attribute: \"resume-flow-id\" }) accessor resumeFlowId = \"\";\n\n  /**\n   * BCP 47 language tag (e.g. `\"de\"`, `\"en-US\"`). The widget resolves this\n   * to a built-in locale dictionary. Falls back to auto-detection from\n   * `document.documentElement.lang` or `navigator.language` when empty.\n   */\n  @property({ type: String }) override accessor lang = \"\";\n\n  /**\n   * Custom locale dictionaries keyed by language code. When set, these take\n   * precedence over the built-in dictionaries for matching language codes.\n   *\n   * ```ts\n   * import { en } from \"@zitadel/components\";\n   * const locales = {\n   *   en: { ...en, \"identifier.title\": \"Welcome\" },\n   *   de: myGermanDict,\n   * };\n   * ```\n   */\n  @property({ attribute: false }) accessor locales: Record<string, Locale> | undefined;\n\n  @state() private accessor response: CreateFlow201 | null = null;\n\n  @state() private accessor branding: Branding | undefined = undefined;\n\n  @state() private accessor loading = false;\n\n  @state() private accessor startupError: string | null = null;\n\n  @state() private accessor formValues: Record<string, string> = {};\n\n  private readonly themeController = new ThemeController(this);\n\n  private engine: Liquid | null = null;\n\n  private readonly sanitise = createSanitiser();\n\n  /**\n   * Cached compiled tenant template, keyed by source string. Re-rendering on\n   * every `formValues` change otherwise re-parses the same template.\n   */\n  private tenantTemplateCache: { source: string; template: Template[] } | null = null;\n\n  override createRenderRoot(): HTMLElement | DocumentFragment {\n    const root = super.createRenderRoot();\n    if (root instanceof ShadowRoot) {\n      // jsdom 29 partially implements `adoptedStyleSheets` — the property\n      // exists but isn't iterable. Treat a missing iterable as the empty\n      // list so the orchestrator boots in unit tests without crashing.\n      const existing: readonly CSSStyleSheet[] = Array.isArray(root.adoptedStyleSheets)\n        ? root.adoptedStyleSheets\n        : [];\n      const sheet = new CSSStyleSheet();\n      sheet.replaceSync(layoutChromeCss);\n      root.adoptedStyleSheets = [...existing, sheet];\n      root.addEventListener(\"zl-input\", this.handleAtomInput as EventListener);\n      // <zl-button> dispatches `zl-submit` for both primary submits and\n      // secondary actions; the orchestrator picks the right path based on\n      // the button's `type` and `action`.\n      root.addEventListener(\"zl-submit\", this.handleAtomSubmit as EventListener);\n      root.addEventListener(\"click\", this.handleDelegatedAction as EventListener);\n      // Native <form> submit fires on Enter inside any field and after the\n      // browser's autofill / save-password handshake. Intercept it so we can\n      // hand off to our flow-submit cycle without the page reloading.\n      root.addEventListener(\"submit\", this.handleFormSubmit as EventListener);\n      // <zl-passkey> emits `zl-passkey-result` after a successful WebAuthn\n      // ceremony. Auto-submit the proof so the user doesn't have to click\n      // \"Continue\" — the ceremony IS the submission (ADR 013).\n      root.addEventListener(\"zl-passkey-result\", this.handlePasskeyResult as EventListener);\n      // <zl-passkey> emits `zl-passkey-error` when the ceremony fails or is\n      // cancelled. Surface the error on the current step.\n      root.addEventListener(\"zl-passkey-error\", this.handlePasskeyError as EventListener);\n    }\n    return root;\n  }\n\n  /**\n   * Start the flow after the first render rather than in `connectedCallback`.\n   * Frameworks that wrap web components (e.g. `@lit/react` in the console)\n   * attach the element first and then assign object properties (`branding`,\n   * `locale`) via setters. `connectedCallback` runs synchronously on attach\n   * — before any setters from a wrapper's effects/refs — so reading those\n   * properties there sees stale defaults. `firstUpdated` runs after Lit's\n   * first render, by which time setters from the wrapping framework have\n   * fired.\n   */\n  protected override firstUpdated(): void {\n    // Defer so `startFlow()` can set `loading` without scheduling a second\n    // update before Lit finishes this commit (change-in-update warning).\n    queueMicrotask(() => void this.startFlow());\n  }\n\n  /**\n   * Resolves the effective locale dictionary. The built-in dictionary for the\n   * resolved language is used as the base; entries from the `locales` map (if\n   * set) are spread on top so partial overrides work without importing and\n   * spreading the full base dictionary.\n   */\n  private resolveLocale(): Locale {\n    const code = this.lang\n      || (typeof document !== \"undefined\" ? document.documentElement.lang : \"\")\n      || (typeof navigator !== \"undefined\" ? navigator.language : \"\");\n    const primary = (code.split(\"-\")[0] ?? \"\").toLowerCase();\n    const builtin = builtinLocales[primary] ?? en;\n    const custom = this.locales?.[primary];\n    return custom ? { ...builtin, ...custom } : builtin;\n  }\n\n  override willUpdate(changed: PropertyValues<this>): void {\n    if (!this.engine || changed.has(\"locales\") || changed.has(\"lang\")) {\n      this.engine = createLiquidEngine({ locale: this.resolveLocale() });\n    }\n    const root = this.shadowRoot;\n    if (root) {\n      applyBaseTokens(root);\n      applyBrandingTokens(root, this.branding, this.themeController.theme);\n      applyFontUrl(root, this.branding?.font_url ?? null);\n    }\n    this.dataset.theme = this.themeController.theme;\n    this.toggleAttribute(\"data-theme-dark\", this.themeController.theme === \"dark\");\n    this.setAttribute(\"aria-busy\", this.loading ? \"true\" : \"false\");\n  }\n\n  override updated(changed: PropertyValues<this>): void {\n    const props = changed as Map<string, unknown>;\n    if (!props.has(\"response\")) return;\n    // Step markup exists only after this commit; defer field hydration/focus.\n    requestAnimationFrame(() => {\n      this.applyValuesToFields();\n      this.moveFocusToFirstField();\n    });\n  }\n\n  override render() {\n    if (this.startupError) {\n      return html`<form class=\"zl-mount\" novalidate>\n        <zl-alert severity=\"error\">${this.startupError}</zl-alert>\n      </form>`;\n    }\n    if (!this.response || !this.engine) {\n      return html`<slot name=\"loader\"></slot>`;\n    }\n    const rendered = this.injectAttribution(\n      this.renderStep(this.response.step, this.engine),\n    );\n    return html`<form\n      class=\"zl-mount\"\n      part=\"form\"\n      novalidate\n      aria-busy=${this.loading ? \"true\" : \"false\"}\n    >\n      ${unsafeHTML(rendered)}\n    </form>`;\n  }\n\n  /**\n   * Inject the attribution badge into the rendered template's\n   * `<zl-page-shell>` footer slot. The attribution must live INSIDE the\n   * page-shell so it sits within the 100vh viewport rhythm (matching the\n   * Figma sign-in frame where the pill sits 24px below the card, both\n   * centred on the page). It can't be a sibling of the page-shell because\n   * the page-shell already occupies the full viewport height.\n   */\n  private injectAttribution(rendered: string): string {\n    const html = this.renderAttributionHtml();\n    if (!html) return rendered;\n    if (rendered.includes(\"</zl-page-shell>\")) {\n      return rendered.replace(\"</zl-page-shell>\", `${html}</zl-page-shell>`);\n    }\n    return rendered + html;\n  }\n\n  /**\n   * \"Secured with Zitadel\" attribution chrome injected into every\n   * template's page-shell footer slot. Controlled by\n   * `branding.attribution.show_zitadel` — defaults to `true` for\n   * community / OSS deployments. Licensed tenants can suppress the badge\n   * entirely or swap it for a `custom_link` value.\n   */\n  private renderAttributionHtml(): string {\n    const attribution = this.branding?.attribution;\n    const show = attribution?.show_zitadel !== false;\n    const custom = attribution?.custom_link;\n    if (!show && !custom) {\n      return \"\";\n    }\n    if (custom) {\n      const safeHref = String(custom.href).replace(/\"/g, \"&quot;\");\n      const safeLabel = String(custom.label)\n        .replace(/&/g, \"&amp;\")\n        .replace(/</g, \"&lt;\")\n        .replace(/>/g, \"&gt;\");\n      return `<div slot=\"footer\" part=\"attribution\" class=\"zl-attribution\"><zl-pill tone=\"neutral\" href=\"${safeHref}\">${safeLabel}</zl-pill></div>`;\n    }\n    return `<div slot=\"footer\" part=\"attribution\" class=\"zl-attribution\"><zl-pill tone=\"neutral\" href=\"https://zitadel.com\" part=\"attribution-pill\" aria-label=\"Secured with Zitadel\">${zitadelAttributionPillInnerHtml()}</zl-pill></div>`;\n  }\n\n  private async startFlow(): Promise<void> {\n    const cfg = this.project ?? getZitadelConfig();\n\n    // Resolve project ID from handle.\n    const projectId = cfg?.projectId || \"\";\n\n    if (!cfg) {\n      throw new Error(\"<zitadel-login> requires a `config` prop (from configureZitadel()) or configureZitadel() must be called before use.\");\n    }\n    const api = getApi(cfg);\n\n    this.loading = true;\n    this.startupError = null;\n    try {\n      let wire: CreateFlow201;\n      if (this.resumeFlowId) {\n        wire = await getCurrentStep(api, this.resumeFlowId);\n      } else {\n        if (!projectId) {\n          throw new Error(\"<zitadel-login> requires a `project-id` attribute (or configureZitadel()) to start a flow.\");\n        }\n        wire = await apiStartFlow(api, { project_id: projectId, purpose: this.purpose });\n      }\n      this.applyResponse(wire);\n    } catch (error) {\n      this.handleTransportError(error);\n    } finally {\n      this.loading = false;\n    }\n  }\n\n  private applyResponse(wire: CreateFlow201): void {\n    this.response = wire;\n    const { branding, issues } = validateBranding(wire.branding);\n    this.branding = branding;\n    this.themeController.setBranding(branding);\n    if (issues.length > 0) {\n      console.warn(\"[zitadel-login] branding payload has issues:\", issues);\n    }\n    // Defaults seed every declared field; existing entries (typed input,\n    // carry-over from prior steps) win on conflict.\n    this.formValues = { ...collectInitialValues(wire.step), ...this.formValues };\n    void this.maybeCompleteFlow(wire);\n  }\n\n  /**\n   * Acts on terminal flow steps. The wire surfaces two kinds of completion:\n   *\n   * - `step.complete === \"redirect\"` — navigate the browser to\n   *   `response.redirect_uri` (OIDC/SAML `auth_request_id` resolved). This\n   *   takes precedence over `post-sign-in-url`.\n   * - `step.complete === \"show\"` — when `post-sign-in-url` is set, exchange\n   *   the `handoff_token` for a session cookie and navigate there.\n   *\n   * `zitadel-flow-complete` is always emitted so hosts with custom post-sign-in\n   * flows can handle the handoff themselves when `post-sign-in-url` is omitted.\n   */\n  private async maybeCompleteFlow(response: CreateFlow201): Promise<void> {\n    const behavior = response.step.complete;\n    if (!behavior) return;\n\n    this.dispatchEvent(\n      new CustomEvent(\"zitadel-flow-complete\", {\n        bubbles: true,\n        composed: true,\n        detail: {\n          behavior,\n          redirect_uri: response.redirect_uri,\n          handoff_token: response.handoff_token,\n          handoff_token_expires_at: response.handoff_token_expires_at,\n        },\n      }),\n    );\n\n    if (typeof window === \"undefined\") return;\n    if (behavior === \"redirect\" && response.redirect_uri) {\n      window.location.assign(response.redirect_uri);\n      return;\n    }\n\n    const handoffToken = response.handoff_token;\n    if (behavior === \"show\" && handoffToken && this.postSignInUrl) {\n      this.loading = true;\n      try {\n        const cfg = this.project ?? getZitadelConfig();\n        if (!cfg) throw new Error(\"<zitadel-login> config is required for exchange.\");\n        const api = getApi(cfg);\n        await exchangeSession(api, { handoff_token: handoffToken }, { project_id: cfg.projectId });\n        window.location.assign(this.postSignInUrl);\n      } catch (error) {\n        this.handleTransportError(error);\n      } finally {\n        this.loading = false;\n      }\n    }\n  }\n\n  private renderStep(step: CreateFlow201Step, engine: Liquid): string {\n    const tenantSource =\n      typeof this.branding?.liquid_template === \"string\" &&\n      this.branding.liquid_template.length > 0\n        ? this.branding.liquid_template\n        : null;\n\n    const errors: FlowError[] = step.error\n      ? step.error.startsWith(\"error.\")\n        ? [{ text_key: step.error }]\n        : [{ message: step.error }]\n      : [];\n\n    const context: LiquidContext = {\n      step: {\n        name: step.name,\n        complete: step.complete,\n        texts: step.texts ?? {},\n      },\n      fields: step.fields ?? {},\n      actions: step.actions ?? {},\n      gates: step.gates ?? {},\n      sso_providers: step.sso_providers ?? [],\n      challenge: step.challenge ?? null,\n      messages: [],\n      identity: this.deriveIdentity(),\n      errors,\n      branding: this.branding ?? {},\n      loading: this.loading,\n    };\n\n    let raw: string;\n    try {\n      if (tenantSource) {\n        const compiled =\n          this.tenantTemplateCache?.source === tenantSource\n            ? this.tenantTemplateCache.template\n            : engine.parse(tenantSource);\n        this.tenantTemplateCache = { source: tenantSource, template: compiled };\n        raw = engine.renderSync(compiled, context);\n      } else {\n        raw = engine.renderFileSync(TEMPLATE_NAMES.default, context);\n      }\n    } catch (error) {\n      console.error(\"[zitadel-login] Liquid render failed:\", error);\n      try {\n        raw = engine.renderFileSync(TEMPLATE_NAMES.default, context);\n      } catch {\n        return `<zl-alert severity=\"error\">We couldn't render this step.</zl-alert>`;\n      }\n    }\n\n    const patched = patchMandatoryGates(raw, step, this.resolveLocale());\n    return this.sanitise(patched);\n  }\n\n  /**\n   * Build a `FlowIdentity` from the orchestrator's captured form values so\n   * the signed-in template can greet the user by email without the API\n   * having to round-trip identity claims. Email comes from the\n   * identifier step; display name composes from `given_name` /\n   * `family_name` when the register step ran.\n   */\n  private deriveIdentity(): import(\"./template-context.js\").FlowIdentity | null {\n    const email = this.formValues.email?.trim();\n    const given = this.formValues.given_name?.trim();\n    const family = this.formValues.family_name?.trim();\n    const display = [given, family].filter(Boolean).join(\" \").trim();\n    if (!email && !display) return null;\n    return {\n      ...(email ? { email_address: email } : {}),\n      ...(display ? { display_name: display } : email ? { display_name: email } : {}),\n    };\n  }\n\n  private applyValuesToFields(): void {\n    const root = this.shadowRoot;\n    if (!root) return;\n    const fields = root.querySelectorAll<HTMLElement & { value?: string }>(\"zl-field\");\n    if (fields.length === 0) return;\n    for (const field of fields) {\n      const name = field.getAttribute(\"name\");\n      if (!name || !(name in this.formValues)) continue;\n      const next = this.formValues[name];\n      if (field.value !== next) {\n        field.value = next;\n      }\n    }\n  }\n\n  private handleAtomInput = (event: CustomEvent<{ name: string; value: string }>): void => {\n    if (!event.detail) return;\n    const { name, value } = event.detail;\n    if (!name) return;\n    this.formValues = { ...this.formValues, [name]: value };\n    this.dispatchEvent(\n      new CustomEvent(\"zitadel-flow-input\", {\n        bubbles: true,\n        composed: true,\n        detail: { name, value },\n      }),\n    );\n  };\n\n  private handleAtomSubmit = (event: CustomEvent<{ action: string | null }>): void => {\n    if (this.loading) return;\n    void this.submit(event.detail?.action ?? null);\n  };\n\n  /** Secondary navigation rows (`data-action` on `.zl-card-nav__link`). */\n  private handleDelegatedAction = (event: Event): void => {\n    const target = (event.target as HTMLElement | null)?.closest<HTMLElement>(\"[data-action]\");\n    if (!target || target.closest(\"zl-button\") || this.loading) return;\n    const action = target.getAttribute(\"data-action\");\n    if (!action) return;\n    event.preventDefault();\n    void this.submit(action);\n  };\n\n  private handleFormSubmit = (event: SubmitEvent): void => {\n    // Always intercept: we own the submit cycle. Without this the page would\n    // navigate to whatever `action` URL the form has (none) and lose state.\n    event.preventDefault();\n    if (this.loading) return;\n    // `submitter` is the button that triggered the submit. When the user\n    // pressed Enter inside a `<zl-field>`, the field calls\n    // `form.requestSubmit()` with no submitter, so we fall back to the first\n    // primary `<zl-button>`'s action (the step's primary action).\n    const submitter = event.submitter as HTMLElement | null;\n    const explicit = submitter?.getAttribute?.(\"action\") ?? null;\n    const action = explicit ?? this.findPrimaryAction();\n    void this.submit(action);\n  };\n\n  /**\n   * Handle a successful WebAuthn ceremony. Auto-submit with the proof\n   * as `challenge_response` so the flow advances without extra user\n   * interaction — the ceremony IS the factor verification (ADR 013).\n   */\n  private handlePasskeyResult = (\n    event: CustomEvent<{ challenge_id: string; method: string; proof: Record<string, unknown> }>,\n  ): void => {\n    if (this.loading) return;\n    const { challenge_id, method, proof } = event.detail;\n    void this.submit(\"submit\", {\n      challenge_id,\n      method,\n      proof,\n    });\n  };\n\n  /**\n   * Handle a WebAuthn ceremony error. Re-render the current step with\n   * an error message so the user sees feedback and can retry or skip.\n   *\n   * Guard: if the step already carries the same error key, skip the update.\n   * Mutating `this.response` triggers `unsafeHTML` to replace the DOM tree,\n   * which reconnects a fresh `<zl-passkey>` that immediately re-starts the\n   * ceremony — creating an infinite loop. The guard breaks the cycle.\n   *\n   * We also strip the `challenge` from the step so the template does not\n   * render a new `<zl-passkey>` on re-render. Without this, the first\n   * cancel would trigger a second ceremony (the guard prevents a third).\n   */\n  private handlePasskeyError = (\n    event: CustomEvent<{ challenge_id: string; error: string; aborted: boolean }>,\n  ): void => {\n    if (!this.response) return;\n    const { error: message, aborted } = event.detail;\n    const errorKey = aborted ? \"error.passkey_cancelled\" : \"error.passkey_failed\";\n    if (this.response.step.error === errorKey) return;\n    const { challenge: _dropped, ...stepWithoutChallenge } = this.response.step;\n    this.response = {\n      ...this.response,\n      step: { ...stepWithoutChallenge, error: errorKey },\n    };\n    console.warn(`[zitadel-login] passkey ceremony ${aborted ? \"cancelled\" : \"failed\"}: ${message}`);\n  };\n\n  private findPrimaryAction(): string | null {\n    const root = this.shadowRoot;\n    if (!root) return null;\n    const primary = root.querySelector('zl-button[hierarchy=\"primary\"][type=\"submit\"]') ??\n      root.querySelector('zl-button[hierarchy=\"primary\"]');\n    return primary?.getAttribute(\"action\") || null;\n  }\n\n  private moveFocusToFirstField(): void {\n    const root = this.shadowRoot;\n    if (!root) return;\n    requestAnimationFrame(() => {\n      const focusables = root.querySelectorAll<HTMLElement>(\"zl-field, zl-button\");\n      const target = Array.from(focusables).find((el) => !el.hasAttribute(\"disabled\"));\n      target?.focus();\n    });\n  }\n\n  private async submit(\n    action: string | null,\n    challengeResponse?: SubmitFlowStepBodyChallengeResponse,\n  ): Promise<void> {\n    if (!this.response || this.loading) return;\n    const { id, session_token } = this.response;\n    this.loading = true;\n    try {\n      // Only send field values that the current step defines. `formValues`\n      // carries state across steps (e.g. email for the signed-in greeting)\n      // but steps without fields should not leak prior values onto the wire.\n      const stepFieldKeys = Object.keys(this.response.step.fields ?? {});\n      const fields: Record<string, string> = {};\n      for (const key of stepFieldKeys) {\n        const value = this.formValues[key];\n        if (value !== undefined) {\n          fields[key] = value;\n        }\n      }\n      const body: SubmitFlowStepBody = {\n        session_token,\n        action: action ?? \"submit\",\n        fields,\n        ...(challengeResponse ? { challenge_response: challengeResponse } : {}),\n      };\n      const cfg = this.project ?? getZitadelConfig();\n      if (!cfg) throw new Error(\"<zitadel-login> config is required for submit.\");\n      const api = getApi(cfg);\n      const wire = await apiSubmitStep(api, id, body);\n      this.applyResponse(wire);\n      this.dispatchEvent(\n        new CustomEvent(\"zitadel-flow-step\", {\n          bubbles: true,\n          composed: true,\n          detail: { step: wire.step },\n        }),\n      );\n    } catch (error) {\n      this.handleTransportError(error);\n    } finally {\n      this.loading = false;\n    }\n  }\n\n  private handleTransportError(error: unknown): void {\n    const message =\n      error instanceof Error ? error.message : \"Unexpected error contacting the Flow API.\";\n    this.startupError = message;\n    console.error(\"[zitadel-login]\", error);\n    this.dispatchEvent(\n      new CustomEvent(\"zitadel-flow-error\", {\n        bubbles: true,\n        composed: true,\n        detail: { message },\n      }),\n    );\n  }\n}\n\nfunction collectInitialValues(step: CreateFlow201Step): Record<string, string> {\n  const values: Record<string, string> = {};\n  if (!step.fields) return values;\n  for (const [name, field] of Object.entries(step.fields)) {\n    values[name] = typeof field.value === \"string\" ? field.value : \"\";\n  }\n  return values;\n}\n\ndeclare global {\n  interface HTMLElementTagNameMap {\n    \"zitadel-login\": ZitadelLogin;\n  }\n}\n","import { LitElement, css, html, nothing } from \"lit\";\nimport { customElement, property, state } from \"lit/decorators.js\";\nimport { getZitadelConfig, getApi, type ZitadelProject } from \"@zitadel/api/config\";\n\nimport { applyBaseTokens } from \"./branding-to-tokens.js\";\nimport { baseHostStyles, focusVisibleStyles, t } from \"../styles/index.js\";\n\n/**\n * Shape of the decoded `__nextgen_display` cookie set by the auth backend on\n * sign-in. The cookie is a base64-encoded JSON object — non-`HttpOnly` so the\n * frontend can render the signed-in user's identity without an extra round\n * trip.\n */\ninterface DisplayData {\n  readonly name: string;\n  readonly email: string;\n}\n\nconst DISPLAY_COOKIE_NAME = \"__nextgen_display\";\n\n/**\n * `<zitadel-logout>` — orchestrator-tier element that lets the signed-in user\n * sign out without touching the flow API.\n *\n * Reads the user's display name + email from the `__nextgen_display` cookie\n * (set by the auth backend on sign-in), renders an avatar trigger with a\n * dropdown that exposes a \"Sign out\" action, and calls the typed\n * `endSession` operation in `@zitadel/api`\n * (`GET /auth/end-session`). The server clears the session cookie via\n * `Set-Cookie: Max-Age=0`; on success the element fires `zitadel-signout`\n * and optionally navigates to `post-sign-out-url`.\n *\n * ## Template-slot mode\n *\n * When the consumer projects a `<template>` child the element renders the\n * template's clone into its light DOM with `{{name}}`, `{{email}}`, and\n * `{{initial}}` substituted. Any element with `data-action=\"logout\"` inside\n * the cloned template triggers the sign-out flow. This mirrors the\n * placeholder `<nextgen-logout>`'s contract so existing markup keeps working.\n *\n * Default styles consume the `--zl-*` design tokens so tenant branding\n * applies automatically — there is no hardcoded brand colour, radius, or\n * shadow.\n */\n@customElement(\"zitadel-logout\")\nexport class ZitadelLogout extends LitElement {\n  static override styles = [\n    baseHostStyles,\n    css`\n      :host {\n        display: inline-block;\n        position: relative;\n      }\n\n      .trigger {\n        all: unset;\n        cursor: pointer;\n        width: 2.5rem;\n        height: 2.5rem;\n        border-radius: 9999px;\n        background: ${t.color.surface.defaultWhite};\n        color: ${t.color.text.buttonDefault};\n        font-size: 0.875rem;\n        font-weight: 600;\n        display: inline-flex;\n        align-items: center;\n        justify-content: center;\n        letter-spacing: 0.02em;\n        user-select: none;\n        transition: box-shadow ${t.motion.duration.fast} ${t.motion.easing.standard};\n      }\n      .trigger:focus-visible {\n        ${focusVisibleStyles};\n      }\n      .trigger[aria-expanded=\"true\"] {\n        box-shadow: 0 0 0 2px ${t.focus.color};\n      }\n\n      .dropdown {\n        position: absolute;\n        top: calc(100% + ${t.spacing[\"02\"]});\n        right: 0;\n        width: 14rem;\n        background: ${t.color.surface.defaultPrimaryGray};\n        border: 1px solid ${t.color.border.defaultGray100};\n        border-radius: ${t.radius.m};\n        box-shadow: 0 12px 32px rgba(0, 0, 0, 0.32);\n        z-index: 9999;\n        overflow: hidden;\n      }\n\n      .preview {\n        display: flex;\n        align-items: center;\n        gap: ${t.spacing[\"03\"]};\n        padding: ${t.spacing[\"03\"]};\n        border-bottom: 1px solid ${t.color.border.defaultGray100};\n      }\n      .preview-avatar {\n        flex-shrink: 0;\n        width: 2.5rem;\n        height: 2.5rem;\n        border-radius: 9999px;\n        background: ${t.color.surface.defaultWhite};\n        color: ${t.color.text.buttonDefault};\n        font-size: 0.875rem;\n        font-weight: 600;\n        display: inline-flex;\n        align-items: center;\n        justify-content: center;\n      }\n      .preview-info {\n        min-width: 0;\n        flex: 1;\n      }\n      .preview-name {\n        font-size: 0.875rem;\n        font-weight: 600;\n        color: ${t.color.text.primaryWhite};\n        white-space: nowrap;\n        overflow: hidden;\n        text-overflow: ellipsis;\n      }\n      .preview-email {\n        font-size: 0.75rem;\n        color: ${t.color.text.secondaryGray};\n        white-space: nowrap;\n        overflow: hidden;\n        text-overflow: ellipsis;\n        margin-top: 2px;\n      }\n\n      .actions {\n        padding: ${t.spacing[\"02\"]};\n      }\n      .signout-btn {\n        all: unset;\n        cursor: pointer;\n        display: flex;\n        align-items: center;\n        gap: ${t.spacing[\"02\"]};\n        width: 100%;\n        padding: ${t.spacing[\"02\"]} ${t.spacing[\"03\"]};\n        border-radius: ${t.radius.s};\n        color: ${t.color.text.error};\n        font-size: 0.875rem;\n        font-weight: 500;\n        box-sizing: border-box;\n      }\n      .signout-btn:hover:not([disabled]) {\n        background: color-mix(in srgb, ${t.color.text.error} 12%, transparent);\n      }\n      .signout-btn:focus-visible {\n        ${focusVisibleStyles};\n      }\n      .signout-btn[disabled] {\n        cursor: not-allowed;\n        opacity: 0.6;\n      }\n      .signout-btn svg {\n        flex-shrink: 0;\n      }\n\n      .spinner {\n        width: 1em;\n        height: 1em;\n        border-radius: 9999px;\n        border: 2px solid currentColor;\n        border-top-color: transparent;\n        animation: zl-logout-spin 600ms linear infinite;\n      }\n      @keyframes zl-logout-spin {\n        to {\n          transform: rotate(360deg);\n        }\n      }\n\n      .error-bar {\n        padding: ${t.spacing[\"02\"]} ${t.spacing[\"03\"]};\n        font-size: 0.75rem;\n        color: ${t.color.text.error};\n        background: color-mix(in srgb, ${t.color.text.error} 12%, transparent);\n        border-top: 1px solid ${t.color.border.defaultGray100};\n      }\n    `,\n  ];\n\n  /**\n   * SDK project handle returned by `configureZitadel()`. When set, takes\n   * precedence over the global singleton from `getZitadelConfig()`.\n   */\n  @property({ attribute: false }) accessor project: ZitadelProject | undefined;\n\n  /** URL to navigate to after a successful sign-out. */\n  @property({ type: String, attribute: \"post-sign-out-url\" }) accessor postSignOutUrl = \"\";\n\n  /**\n   * OIDC `client_id` to forward as a query parameter on the end-session\n   * request, mirroring the standard end-session contract. Optional —\n   * leaving this empty is fine when the backend can resolve the client\n   * from the session cookie alone.\n   */\n  @property({ type: String, attribute: \"client-id\" }) accessor clientId = \"\";\n\n  @state() private accessor displayName = \"\";\n\n  @state() private accessor displayEmail = \"\";\n\n  @state() private accessor open = false;\n\n  @state() private accessor loading = false;\n\n  @state() private accessor errorMessage = \"\";\n\n  // Set once in `connectedCallback` based on whether a `<template>` child is\n  // present. Not reactive — switching modes mid-life would require re-running\n  // light-DOM mutation, which we don't support.\n  private templateMode = false;\n\n  override connectedCallback(): void {\n    super.connectedCallback();\n    this.dataset.theme = \"dark\";\n    this.readDisplayCookie();\n\n    const tmpl = this.querySelector(\"template\");\n    if (tmpl instanceof HTMLTemplateElement) {\n      this.templateMode = true;\n      this.renderTemplate(tmpl);\n    }\n\n    document.addEventListener(\"click\", this.handleDocumentClick);\n    document.addEventListener(\"keydown\", this.handleDocumentKeydown);\n  }\n\n  override disconnectedCallback(): void {\n    super.disconnectedCallback();\n    document.removeEventListener(\"click\", this.handleDocumentClick);\n    document.removeEventListener(\"keydown\", this.handleDocumentKeydown);\n  }\n\n  override updated(): void {\n    const root = this.shadowRoot;\n    if (root && !this.templateMode) {\n      applyBaseTokens(root);\n    }\n  }\n\n  /**\n   * Decodes the `__nextgen_display` cookie (base64-encoded JSON, set by the\n   * auth backend on sign-in) and populates `displayName` / `displayEmail`.\n   * A missing or malformed cookie is intentionally non-fatal — the dropdown\n   * still renders, just with empty values.\n   */\n  private readDisplayCookie(): void {\n    if (typeof document === \"undefined\") return;\n    const match = document.cookie.match(\n      new RegExp(`(?:^|;\\\\s*)${DISPLAY_COOKIE_NAME}=([^;]+)`),\n    );\n    if (!match || !match[1]) return;\n    try {\n      const data = JSON.parse(atob(match[1])) as DisplayData;\n      this.displayName = typeof data.name === \"string\" ? data.name : \"\";\n      this.displayEmail = typeof data.email === \"string\" ? data.email : \"\";\n    } catch {\n      // Cookie present but malformed — render with empty values.\n    }\n  }\n\n  private get initial(): string {\n    const source = this.displayName || this.displayEmail;\n    return source ? source.charAt(0).toUpperCase() : \"?\";\n  }\n\n  /**\n   * Clones a consumer-supplied `<template>` into the light DOM, fills the\n   * `{{name}}`, `{{email}}`, and `{{initial}}` tokens via a TreeWalker, and\n   * wires every element with `data-action=\"logout\"` to trigger sign-out.\n   * Light-DOM mounting is deliberate so the consumer's existing CSS applies.\n   */\n  private renderTemplate(tmpl: HTMLTemplateElement): void {\n    const clone = tmpl.content.cloneNode(true) as DocumentFragment;\n    fillTemplateTokens(clone, this.displayName, this.displayEmail, this.initial);\n\n    const container = document.createElement(\"span\");\n    container.appendChild(clone);\n    this.appendChild(container);\n\n    const targets = container.querySelectorAll<HTMLElement>('[data-action=\"logout\"]');\n    targets.forEach((el) => {\n      el.addEventListener(\"click\", (event) => {\n        event.preventDefault();\n        void this.doLogout();\n      });\n    });\n  }\n\n  private readonly handleDocumentClick = (event: MouseEvent): void => {\n    if (!this.open) return;\n    if (event.composedPath().includes(this)) return;\n    this.open = false;\n  };\n\n  private readonly handleDocumentKeydown = (event: KeyboardEvent): void => {\n    if (!this.open) return;\n    if (event.key !== \"Escape\") return;\n    this.open = false;\n    this.shadowRoot?.querySelector<HTMLButtonElement>(\".trigger\")?.focus();\n  };\n\n  private toggleOpen(): void {\n    this.open = !this.open;\n    this.errorMessage = \"\";\n  }\n\n  /**\n   * Calls the typed `endSession` operation (`GET /auth/end-session`) with\n   * `credentials: \"include\"`. The server clears the session cookie via\n   * `Set-Cookie: Max-Age=0`; on success this element fires `zitadel-signout`\n   * and optionally navigates to `postSignOutUrl`.\n   */\n  private async doLogout(): Promise<void> {\n    this.loading = true;\n    this.errorMessage = \"\";\n\n    const params = {\n      ...(this.clientId ? { client_id: this.clientId } : {}),\n      ...(this.postSignOutUrl ? { post_logout_redirect_uri: this.postSignOutUrl } : {}),\n    };\n\n    try {\n      const cfg = this.project ?? getZitadelConfig();\n      if (!cfg) throw new Error(\"<zitadel-logout> requires a `config` prop (from configureZitadel()).\");\n      await getApi(cfg).endSession(params, { credentials: \"include\" });\n    } catch (error) {\n      const message = error instanceof Error ? error.message : \"\";\n      this.errorMessage = message || \"Sign-out failed. Please try again.\";\n      this.loading = false;\n      return;\n    }\n\n    this.open = false;\n    this.loading = false;\n\n    const detail = { name: this.displayName, email: this.displayEmail };\n    this.dispatchEvent(\n      new CustomEvent(\"zitadel-signout\", {\n        bubbles: true,\n        composed: true,\n        detail,\n      }),\n    );\n\n    if (this.postSignOutUrl && typeof window !== \"undefined\") {\n      window.location.href = this.postSignOutUrl;\n    }\n  }\n\n  /**\n   * Returns the absolute URL the end-session request will hit. Useful for\n   * test assertions and for consumers that prefer to navigate the browser\n   * directly (instead of fetching) so the OIDC session-end redirect is\n   * driven by the user agent.\n   */\n  getEndSessionUrl(): string {\n    const params = {\n      ...(this.clientId ? { client_id: this.clientId } : {}),\n      ...(this.postSignOutUrl ? { post_logout_redirect_uri: this.postSignOutUrl } : {}),\n    };\n    const cfg = this.project ?? getZitadelConfig();\n    if (!cfg) throw new Error(\"<zitadel-logout> requires a `config` prop (from configureZitadel()).\");\n    return getApi(cfg).getEndSessionUrl(params);\n  }\n\n  private handleSignOutClick(event: Event): void {\n    event.preventDefault();\n    void this.doLogout();\n  }\n\n  override render() {\n    if (this.templateMode) {\n      // Rendering happens once into the light DOM via `renderTemplate`. The\n      // shadow root stays empty so the projected markup is the only thing\n      // the user sees.\n      return nothing;\n    }\n\n    return html`\n      <button\n        class=\"trigger\"\n        type=\"button\"\n        aria-label=${this.open ? \"Close user menu\" : \"Open user menu\"}\n        aria-expanded=${this.open ? \"true\" : \"false\"}\n        aria-haspopup=\"dialog\"\n        @click=${this.toggleOpen}\n      >\n        ${this.initial}\n      </button>\n\n      ${this.open\n        ? html`\n            <div class=\"dropdown\" role=\"dialog\" aria-label=\"User menu\">\n              <div class=\"preview\">\n                <div class=\"preview-avatar\" aria-hidden=\"true\">${this.initial}</div>\n                <div class=\"preview-info\">\n                  <div class=\"preview-name\">${this.displayName || this.displayEmail}</div>\n                  ${this.displayName\n                    ? html`<div class=\"preview-email\">${this.displayEmail}</div>`\n                    : nothing}\n                </div>\n              </div>\n\n              <div class=\"actions\">\n                <button\n                  class=\"signout-btn\"\n                  type=\"button\"\n                  ?disabled=${this.loading}\n                  @click=${this.handleSignOutClick}\n                >\n                  ${this.loading\n                    ? html`<span class=\"spinner\" aria-hidden=\"true\"></span>`\n                    : html`\n                        <svg\n                          width=\"14\"\n                          height=\"14\"\n                          viewBox=\"0 0 24 24\"\n                          fill=\"none\"\n                          stroke=\"currentColor\"\n                          stroke-width=\"2\"\n                          stroke-linecap=\"round\"\n                          stroke-linejoin=\"round\"\n                          aria-hidden=\"true\"\n                        >\n                          <path d=\"M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4\" />\n                          <polyline points=\"16 17 21 12 16 7\" />\n                          <line x1=\"21\" y1=\"12\" x2=\"9\" y2=\"12\" />\n                        </svg>\n                      `}\n                  <span>${this.loading ? \"Signing out…\" : \"Sign out\"}</span>\n                </button>\n              </div>\n\n              ${this.errorMessage\n                ? html`<div class=\"error-bar\" role=\"alert\">${this.errorMessage}</div>`\n                : nothing}\n            </div>\n          `\n        : nothing}\n    `;\n  }\n}\n\n/**\n * Substitutes `{{name}}`, `{{email}}`, and `{{initial}}` placeholders inside\n * a fragment's text nodes. Walking text nodes (rather than running a regex\n * over `outerHTML`) keeps attributes and structural markup untouched.\n */\nfunction fillTemplateTokens(\n  fragment: DocumentFragment,\n  name: string,\n  email: string,\n  initial: string,\n): void {\n  const walker = document.createTreeWalker(fragment, NodeFilter.SHOW_TEXT);\n  let node = walker.nextNode() as Text | null;\n  while (node) {\n    if (node.textContent) {\n      node.textContent = node.textContent\n        .replace(/\\{\\{name\\}\\}/g, name)\n        .replace(/\\{\\{email\\}\\}/g, email)\n        .replace(/\\{\\{initial\\}\\}/g, initial);\n    }\n    node = walker.nextNode() as Text | null;\n  }\n}\n\ndeclare global {\n  interface HTMLElementTagNameMap {\n    \"zitadel-logout\": ZitadelLogout;\n  }\n}\n"],"mappings":";;;;;;;;;AACA,IAAI,YAAY;AAChB,SAAS,eAAe;AACvB,QAAO;;AAER,SAAS,aAAa,MAAM;AAC3B,aAAY;;;;;;;;;;;;;;ACKb,IAAI;AACJ,SAAS,kBAAkB;AAC1B,QAAO;;AAER,SAAS,gBAAgB,OAAO;AAC/B,gBAAe;;;;ACfhB,IAAI,YAAY,OAAO;AACvB,IAAI,eAAe,KAAK,eAAe;CACtC,IAAI,SAAS,EAAE;AACf,MAAK,IAAI,QAAQ,IAAK,WAAU,QAAQ,MAAM;EAC7C,KAAK,IAAI;EACT,YAAY;EACZ,CAAC;AACF,KAAI,CAAC,WAAY,WAAU,QAAQ,OAAO,aAAa,EAAE,OAAO,UAAU,CAAC;AAC3E,QAAO;;;;;;;;;;;;;;;ACIR,IAAI,WAAW,cAAc,MAAM;CAClC;CACA;CACA;CACA,YAAY,QAAQ,KAAK,MAAM,SAAS;AACvC,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,MAAM;AACX,OAAK,OAAO;;;;;;;;;;;;;;;;;AAiBd,eAAe,YAAY,KAAK,SAAS;CACxC,MAAM,QAAQ,iBAAiB;CAC/B,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,KAAI,SAAS,CAAC,QAAQ,IAAI,gBAAgB,CAAE,SAAQ,IAAI,iBAAiB,UAAU,QAAQ;CAC3F,MAAM,MAAM,MAAM,MAAM,KAAK;EAC5B,GAAG;EACH;EACA,CAAC;CACF,MAAM,UAAU;EACf;EACA;EACA;EACA,CAAC,SAAS,IAAI,OAAO,GAAG,KAAK,MAAM,IAAI,MAAM;CAC9C,MAAM,SAAS,UAAU,cAAc,QAAQ,GAAG,KAAK;AACvD,KAAI,CAAC,IAAI,IAAI;EACZ,MAAM,UAAU,GAAG,QAAQ,UAAU,MAAM,GAAG,IAAI,YAAY,IAAI;AAClE,QAAM,IAAI,SAAS,IAAI,QAAQ,KAAK,QAAQ,QAAQ;;AAErD,QAAO;;;;;;;;AAQR,SAAS,cAAc,MAAM;AAC5B,KAAI;AACH,SAAO,KAAK,MAAM,KAAK;SAChB;AACP,SAAO,EAAE,KAAK,MAAM;;;;;;;;;;;;AC1DtB,IAAI,yBAAyC,4BAAY;CACxD,uBAAuB;CACvB,oBAAoB;CACpB,yBAAyB;CACzB,kBAAkB;CAClB,4BAA4B;CAC5B,qBAAqB;CACrB,qBAAqB;CACrB,oBAAoB;CACpB,qBAAqB;CACrB,kBAAkB;CAClB,kBAAkB;CAClB,4BAA4B;CAC5B,kBAAkB;CAClB,uBAAuB;CACvB,sBAAsB;CACtB,6BAA6B;CAC7B,0BAA0B;CAC1B,+BAA+B;CAC/B,kCAAkC;CAClC,wBAAwB;CACxB,2BAA2B;CAC3B,2BAA2B;CAC3B,0BAA0B;CAC1B,2BAA2B;CAC3B,wBAAwB;CACxB,wBAAwB;CACxB,kCAAkC;CAClC,wBAAwB;CACxB,6BAA6B;CAC7B,yBAAyB;CACzB,mBAAmB;CACnB,4BAA4B;CAC5B,+BAA+B;CAC/B,yBAAyB;CACzB,uBAAuB;CACvB,qBAAqB;CACrB,qBAAqB;CACrB,0BAA0B;CAC1B,oCAAoC;CACpC,wBAAwB;CACxB,sBAAsB;CACtB,2BAA2B;CAC3B,wBAAwB;CACxB,qBAAqB;CACrB,sBAAsB;CACtB,yBAAyB;CACzB,yBAAyB;CACzB,iBAAiB;CACjB,wBAAwB;CACxB,4BAA4B;CAC5B,eAAe;CACf,iCAAiC;CACjC,0BAA0B;CAC1B,uBAAuB;CACvB,eAAe;CACf,oBAAoB;CACpB,8BAA8B;CAC9B,kBAAkB;CAClB,gBAAgB;CAChB,6BAA6B;CAC7B,2BAA2B;CAC3B,yBAAyB;CACzB,qBAAqB;CACrB,kBAAkB;CAClB,6BAA6B;CAC7B,4BAA4B;CAC5B,eAAe;CACf,gBAAgB;CAChB,kCAAkC;CAClC,mBAAmB;CACnB,mBAAmB;CACnB,kCAAkC;CAClC,kBAAkB;CAClB,sBAAsB;CACtB,2BAA2B;CAC3B,oBAAoB;CACpB,iBAAiB;CACjB,uBAAuB;CACvB,qBAAqB;CACrB,mBAAmB;CACnB,uBAAuB;CACvB,sBAAsB;CACtB,4BAA4B;CAC5B,4BAA4B;CAC5B,CAAC;AACF,MAAM,qCAAqC;AAC1C,QAAO,GAAG,cAAc,CAAC;;;;;;AAM1B,MAAM,yBAAyB,OAAO,YAAY;AACjD,QAAO,YAAY,8BAA8B,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,sBAAsB,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,kBAAkB,sBAAsB,GAAG,cAAc,CAAC;;;;;AAKnH,MAAM,eAAe,OAAO,QAAQ,YAAY;AAC/C,QAAO,YAAY,mBAAmB,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,yBAAyB,WAAW;CACzC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,6BAA6B,sBAAsB,GAAG,cAAc,CAAC;;;;;AAK9H,MAAM,kBAAkB,OAAO,QAAQ,YAAY;AAClD,QAAO,YAAY,sBAAsB,OAAO,EAAE;EACjD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;CACpC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,oBAAoB,sBAAsB,GAAG,cAAc,CAAC;;;;;AAKrH,MAAM,aAAa,OAAO,QAAQ,YAAY;AAC7C,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,yBAAyB;AAC9B,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,aAAa,OAAO,gBAAgB,YAAY;CACrD,MAAM,iBAAiB,IAAI,iBAAiB;AAC5C,gBAAe,OAAO,SAAS,eAAe,MAAM;AACpD,KAAI,eAAe,oBAAoB,KAAK,EAAG,gBAAe,OAAO,mBAAmB,eAAe,gBAAgB;AACvH,QAAO,YAAY,kBAAkB,EAAE;EACtC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM;EACN,CAAC;;AAEH,MAAM,sBAAsB;AAC3B,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,UAAU,OAAO,YAAY;AAClC,QAAO,YAAY,eAAe,EAAE;EACnC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,0BAA0B;AAC/B,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,cAAc,OAAO,iBAAiB,YAAY;CACvD,MAAM,iBAAiB,IAAI,iBAAiB;AAC5C,KAAI,gBAAgB,UAAU,KAAK,EAAG,gBAAe,OAAO,SAAS,gBAAgB,MAAM;AAC3F,KAAI,gBAAgB,oBAAoB,KAAK,EAAG,gBAAe,OAAO,mBAAmB,gBAAgB,gBAAgB;AACzH,QAAO,YAAY,mBAAmB,EAAE;EACvC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM;EACN,CAAC;;AAEH,MAAM,uBAAuB;AAC5B,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,WAAW,OAAO,cAAc,YAAY;CACjD,MAAM,iBAAiB,IAAI,iBAAiB;AAC5C,KAAI,aAAa,SAAS,KAAK,EAAG,gBAAe,OAAO,QAAQ,aAAa,KAAK;AAClF,KAAI,aAAa,qBAAqB,KAAK,EAAG,gBAAe,OAAO,oBAAoB,aAAa,iBAAiB;AACtH,KAAI,aAAa,0BAA0B,KAAK,EAAG,gBAAe,OAAO,yBAAyB,aAAa,sBAAsB;AACrI,KAAI,aAAa,cAAc,KAAK,EAAG,gBAAe,OAAO,aAAa,aAAa,UAAU;AACjG,KAAI,aAAa,kBAAkB,KAAK,EAAG,gBAAe,OAAO,iBAAiB,aAAa,cAAc;AAC7G,KAAI,aAAa,kBAAkB,KAAK,EAAG,gBAAe,OAAO,iBAAiB,aAAa,cAAc;AAC7G,KAAI,aAAa,eAAe,KAAK,EAAG,gBAAe,OAAO,cAAc,aAAa,WAAW;AACpG,KAAI,aAAa,iBAAiB,KAAK,EAAG,gBAAe,OAAO,gBAAgB,aAAa,aAAa;AAC1G,QAAO,YAAY,gBAAgB,EAAE;EACpC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM;EACN,CAAC;;AAEH,MAAM,0BAA0B;AAC/B,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,cAAc,OAAO,YAAY;AACtC,QAAO,YAAY,mBAAmB,EAAE;EACvC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB;AAC7B,QAAO,GAAG,cAAc,CAAC;;;;;;AAM1B,MAAM,YAAY,OAAO,YAAY;AACpC,QAAO,YAAY,iBAAiB,EAAE;EACrC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,sBAAsB;AAC3B,QAAO,GAAG,cAAc,CAAC;;;;;;AAM1B,MAAM,UAAU,OAAO,YAAY;AAClC,QAAO,YAAY,eAAe,EAAE;EACnC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,uBAAuB;AAC5B,QAAO,GAAG,cAAc,CAAC;;;;;;AAM1B,MAAM,WAAW,OAAO,YAAY;AACnC,QAAO,YAAY,gBAAgB,EAAE;EACpC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;CACpC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,QAAQ,sBAAsB,GAAG,cAAc,CAAC;;;;;AAKzG,MAAM,aAAa,OAAO,gBAAgB,QAAQ,YAAY;AAC7D,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,mBAAmB,WAAW;CACnC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,QAAQ,sBAAsB,GAAG,cAAc,CAAC;;;;;AAKzG,MAAM,YAAY,OAAO,QAAQ,YAAY;AAC5C,QAAO,YAAY,gBAAgB,OAAO,EAAE;EAC3C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,qBAAqB,QAAQ,WAAW;CAC7C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,QAAQ,OAAO,GAAG,sBAAsB,GAAG,cAAc,CAAC,QAAQ;;;;;AAK3H,MAAM,cAAc,OAAO,QAAQ,QAAQ,YAAY;AACtD,QAAO,YAAY,kBAAkB,QAAQ,OAAO,EAAE;EACrD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,yBAAyB;AAC9B,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;AAiB1B,MAAM,aAAa,OAAO,gBAAgB,YAAY;AACrD,QAAO,YAAY,kBAAkB,EAAE;EACtC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,qBAAqB,OAAO;AACjC,QAAO,GAAG,cAAc,CAAC,QAAQ;;;;;;;;AAQlC,MAAM,cAAc,OAAO,IAAI,YAAY;AAC1C,QAAO,YAAY,kBAAkB,GAAG,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,OAAO;AACpC,QAAO,GAAG,cAAc,CAAC,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCrC,MAAM,iBAAiB,OAAO,IAAI,oBAAoB,YAAY;AACjE,QAAO,YAAY,qBAAqB,GAAG,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,mBAAmB;EACxC,CAAC;;AAEH,MAAM,yBAAyB,OAAO;AACrC,QAAO,GAAG,cAAc,CAAC,QAAQ,GAAG;;;;;;;;AAQrC,MAAM,kBAAkB,OAAO,IAAI,qBAAqB,YAAY;AACnE,QAAO,YAAY,sBAAsB,GAAG,EAAE;EAC7C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,oBAAoB;EACzC,CAAC;;AAEH,MAAM,gCAAgC;AACrC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;;AAa1B,MAAM,oBAAoB,OAAO,uBAAuB,YAAY;AACnE,QAAO,YAAY,yBAAyB,EAAE;EAC7C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,sBAAsB;EAC3C,CAAC;;AAEH,MAAM,wBAAwB,cAAc;AAC3C,QAAO,GAAG,cAAc,CAAC,iBAAiB;;;;;;;;;;;;;AAa3C,MAAM,iBAAiB,OAAO,WAAW,YAAY;AACpD,QAAO,YAAY,qBAAqB,UAAU,EAAE;EACnD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,cAAc;AAC3C,QAAO,GAAG,cAAc,CAAC,iBAAiB,UAAU;;;;;;;;;;;;AAYrD,MAAM,iBAAiB,OAAO,WAAW,oBAAoB,YAAY;AACxE,QAAO,YAAY,qBAAqB,UAAU,EAAE;EACnD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,mBAAmB;EACxC,CAAC;;AAEH,MAAM,8BAA8B,WAAW,gBAAgB;AAC9D,QAAO,GAAG,cAAc,CAAC,iBAAiB,UAAU,cAAc,YAAY;;;;;;;;;;;;;;;;AAgB/E,MAAM,uBAAuB,OAAO,WAAW,aAAa,0BAA0B,YAAY;AACjG,QAAO,YAAY,2BAA2B,WAAW,YAAY,EAAE;EACtE,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,yBAAyB;EAC9C,CAAC;;AAEH,MAAM,uBAAuB,cAAc;AAC1C,QAAO,GAAG,cAAc,CAAC,iBAAiB,UAAU;;;;;;;;;;;;;;;;AAgBrD,MAAM,gBAAgB,OAAO,WAAW,YAAY;AACnD,QAAO,YAAY,oBAAoB,UAAU,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,4BAA4B;AACjC,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,gBAAgB,OAAO,mBAAmB,YAAY;AAC3D,QAAO,YAAY,qBAAqB,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,oBAAoB,cAAc;AACvC,QAAO,GAAG,cAAc,CAAC,YAAY;;;;;;;AAOtC,MAAM,aAAa,OAAO,WAAW,YAAY;AAChD,QAAO,YAAY,iBAAiB,UAAU,EAAE;EAC/C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,4BAA4B;AACjC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;;;AAmB1B,MAAM,gBAAgB,OAAO,mBAAmB,YAAY;AAC3D,QAAO,YAAY,qBAAqB,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,sBAAsB,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;AAQ7G,MAAM,eAAe,OAAO,QAAQ,YAAY;AAC/C,QAAO,YAAY,mBAAmB,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,yBAAyB,WAAW;CACzC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,qBAAqB,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAuBtH,MAAM,kBAAkB,OAAO,qBAAqB,QAAQ,YAAY;AACvE,QAAO,YAAY,sBAAsB,OAAO,EAAE;EACjD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,oBAAoB;EACzC,CAAC;;AAEH,MAAM,oBAAoB,WAAW,WAAW;CAC/C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,UAAU,GAAG,sBAAsB,GAAG,cAAc,CAAC,YAAY;;;;;;;;;;;;AAYtI,MAAM,aAAa,OAAO,WAAW,QAAQ,YAAY;AACxD,QAAO,YAAY,iBAAiB,WAAW,OAAO,EAAE;EACvD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,uBAAuB,WAAW,WAAW;CAClD,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,UAAU,GAAG,sBAAsB,GAAG,cAAc,CAAC,YAAY;;;;;;;;;;AAUtI,MAAM,gBAAgB,OAAO,WAAW,QAAQ,YAAY;AAC3D,QAAO,YAAY,oBAAoB,WAAW,OAAO,EAAE;EAC1D,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,2BAA2B;AAChC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;AAY1B,MAAM,eAAe,OAAO,YAAY;AACvC,QAAO,YAAY,oBAAoB,EAAE;EACxC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,8BAA8B;AACnC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;AAU1B,MAAM,kBAAkB,OAAO,YAAY;AAC1C,QAAO,YAAY,uBAAuB,EAAE;EAC3C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,sBAAsB,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,WAAW,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;;AAa5G,MAAM,eAAe,OAAO,kBAAkB,QAAQ,YAAY;AACjE,QAAO,YAAY,mBAAmB,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,iBAAiB;EACtC,CAAC;;AAEH,MAAM,uBAAuB,IAAI,WAAW;CAC3C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,WAAW,GAAG,GAAG,sBAAsB,GAAG,cAAc,CAAC,WAAW;;;;;;AAM7H,MAAM,gBAAgB,OAAO,IAAI,QAAQ,YAAY;AACpD,QAAO,YAAY,oBAAoB,IAAI,OAAO,EAAE;EACnD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,mCAAmC;AACxC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;AAW1B,MAAM,uBAAuB,OAAO,0BAA0B,YAAY;AACzE,QAAO,YAAY,4BAA4B,EAAE;EAChD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,yBAAyB;EAC9C,CAAC;;AAEH,MAAM,6BAA6B,WAAW;CAC7C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,oBAAoB,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;AAQrH,MAAM,sBAAsB,OAAO,QAAQ,YAAY;AACtD,QAAO,YAAY,0BAA0B,OAAO,EAAE;EACrD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,2BAA2B,OAAO;AACvC,QAAO,GAAG,cAAc,CAAC,oBAAoB;;;;;;AAM9C,MAAM,oBAAoB,OAAO,IAAI,YAAY;AAChD,QAAO,YAAY,wBAAwB,GAAG,EAAE;EAC/C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,8BAA8B,OAAO;AAC1C,QAAO,GAAG,cAAc,CAAC,oBAAoB;;;;;;AAM9C,MAAM,uBAAuB,OAAO,IAAI,0BAA0B,YAAY;AAC7E,QAAO,YAAY,2BAA2B,GAAG,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,yBAAyB;EAC9C,CAAC;;AAEH,MAAM,8BAA8B,OAAO;AAC1C,QAAO,GAAG,cAAc,CAAC,oBAAoB;;;;;;AAM9C,MAAM,uBAAuB,OAAO,IAAI,YAAY;AACnD,QAAO,YAAY,2BAA2B,GAAG,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;CACpC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,SAAS,sBAAsB,GAAG,cAAc,CAAC;;;;;AAK1G,MAAM,aAAa,OAAO,QAAQ,gBAAgB,YAAY;AAC7D,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,iBAAiB,QAAQ,WAAW;CACzC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,SAAS,OAAO,GAAG,sBAAsB,GAAG,cAAc,CAAC,SAAS;;;;;;;AAO7H,MAAM,UAAU,OAAO,QAAQ,QAAQ,YAAY;AAClD,QAAO,YAAY,cAAc,QAAQ,OAAO,EAAE;EACjD,GAAG;EACH,QAAQ;EACR,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC15BH,SAAS,oBAAoB,MAAM;CAClC,MAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,GAAG;AAChD,QAAO,IAAI,MAAM,wBAAwB,EAAE,IAAI,QAAQ,MAAM,UAAU;EACtE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM,SAAS;AACjD,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,UAAQ,GAAG,SAAS;AACnB,gBAAa,QAAQ;AACrB,mBAAgB,KAAK,MAAM;AAC3B,UAAO,MAAM,GAAG,KAAK;;IAEpB,CAAC;;;;;;;;AAQL,SAAS,UAAU,SAAS;AAC3B,QAAO,oBAAoB,EAAE,SAAS,SAAS,CAAC;;;;AC/CjD,IAAI,iBAAiB;;;;;AAKrB,MAAM,2BAA2B,IAAI,SAAS;;;;;;;;;;AAkC9C,SAAS,OAAO,SAAS;CACxB,IAAI,MAAM,SAAS,IAAI,QAAQ;AAC/B,KAAI,CAAC,KAAK;AACT,QAAM,UAAU,QAAQ,UAAU;AAClC,WAAS,IAAI,SAAS,IAAI;;AAE3B,QAAO;;;;;;AAMR,SAAS,mBAAmB;AAC3B,QAAO;;;;ACzBR,MAAM,iBAA8B,EAAE,aAAa,WAAW;AAE9D,eAAsB,UAAU,KAAiB,OAA+C;AAC9F,QAAO,IAAI,WAAW,OAAO,eAAe;;AAM9C,eAAsB,WACpB,KACA,IACA,MACwB;AACxB,KAAI;AACF,SAAO,MAAM,IAAI,eAAe,IAAI,MAAM,eAAe;UAClD,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,WAAW,OAAO,eAAe,MAAM,KAAK,CACjF,QAAO,MAAM;AAEf,QAAM;;;AAIV,SAAS,eAAe,MAAsC;AAC5D,QAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,UAAU;;AAGhE,eAAsB,eAAe,KAAiB,IAAoC;AACxF,QAAO,IAAI,YAAY,IAAI,eAAe;;;;;;;;;AAU5C,eAAsB,gBACpB,KACA,MACA,QAC6B;AAC7B,QAAO,IAAI,gBAAgB,MAAM,QAAQ,eAAe;;;;;;;;;;;;;;;;;;;;;;ACjD1D,MAAM,aAAmE;CACvE,MAAM;CACN,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM;CACP;AAID,MAAM,cAAqF;CACzF,SAAS;EACP,mBAAmB;EACnB,mBAAmB;EACpB;CACD,SAAS,EAAE;CACX,aAAa;EACX,mBAAmB;EACnB,mBAAmB;EACpB;CACF;AAOD,MAAM,cAAuD;CAC3D,SAAS,CAAC,mCAAmC;CAC7C,YAAY,CAAC,iCAAiC;CAC9C,YAAY,CAAC,mCAAmC;CAChD,SAAS,CAAC,0CAA0C;CACpD,OAAO,CAAC,4CAA4C;CACpD,QAAQ,CAAC,sCAAsC,qCAAqC;CACpF,MAAM,CAAC,gCAAgC;CACvC,YAAY,CAAC,iCAAiC;CAC9C,MAAM,CAAC,gCAAgC;CACvC,SAAS;EAAC;EAA2B;EAA6B;EAA0B;CAC5F,SAAS,CAAC,kCAAkC;CAC5C,OAAO;EAAC;EAAyB;EAA2B;EAAwB;CACrF;;;;;;AAWD,SAAgB,wBACd,UACA,UAAmC,EAAE,EAC7B;CACR,MAAM,aAAa,oBAAoB,SAAS;CAChD,MAAM,cAAc,UAAU,OAAO,MAAM;CAC3C,MAAM,YAAY,cAAc,WAAW,YAAY,GAAG,EAAE;CAE5D,MAAM,SAAmB,EAAE;AAC3B,KAAI,OAAO,KAAK,WAAW,CAAC,SAAS,EACnC,QAAO,KAAK,YAAY,SAAS,WAAW,CAAC;AAE/C,KAAI,OAAO,KAAK,UAAU,CAAC,SAAS,EAClC,QAAO,KAAK,YAAY,gCAA8B,UAAU,CAAC;AAMnE,KAAI,QAAQ,kBAAkB,UAAU,aAAa;EACnD,MAAM,SAAS;GAAE,GAAG;GAAY,GAAG;GAAW;AAC9C,SAAO,SAAS;AAChB,SAAO,KAAK,YAAY,SAAS,OAAO,CAAC;;AAG3C,QAAO,OAAO,KAAK,KAAK;;AAG1B,SAAS,oBAAoB,UAAwD;AACnF,KAAI,CAAC,SACH,QAAO,EAAE;CAEX,MAAM,QAAgC,EAAE;AACxC,QAAO,OAAO,OAAO,WAAW,SAAS,QAAQ,CAAC;AAClD,QAAO,OAAO,OAAO,cAAc,SAAS,WAAW,CAAC;AACxD,QAAO,OAAO,OAAO,SAAS,SAAS,MAAM,CAAC;AAC9C,QAAO;;AAGT,SAAS,WAAW,SAA8D;AAChF,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,YAAY,EAAyC;EAChG,MAAM,QAAQ,QAAQ;AACtB,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC9C,MAAK,MAAM,WAAW,SACpB,KAAI,WAAW;;AAIrB,QAAO;;AAGT,SAAS,cAAc,YAAoE;AACzF,KAAI,CAAC,WAAY,QAAO,EAAE;CAC1B,MAAM,MAA8B,EAAE;AAItC,KAAI,WAAW,aAAa;AAC1B,MAAI,2BAA2B,WAAW;AAC1C,MAAI,8BAA8B,WAAW;;AAE/C,KAAI,WAAW,iBACb,KAAI,2BAA2B,WAAW;CAK5C,MAAM,QAAQ,MAAM,WAAW,SAAS,GAAG,KAAM,KAAK;AACtD,KAAI,UAAU,EACZ,KAAI,qBAAqB,GAAG;AAE9B,QAAO;;AAGT,SAAS,SAAS,OAA0D;AAC1E,KAAI,CAAC,MAAO,QAAO,EAAE;CACrB,MAAM,MAA8B,EAAE;AACtC,KAAI,MAAM,UAAU,WAAW,MAAM,SAAS;EAC5C,MAAM,SAAS,WAAW,MAAM;AAGhC,MAAI,mBAAmB;AACvB,MAAI,mBAAmB,WAAW,MAAM,MAAM,QAAQ,OAAO;AAC7D,MAAI,mBAAmB,WAAW,MAAM,MAAM,QAAQ,OAAO;;AAE/D,KAAI,MAAM,QACR,QAAO,OAAO,KAAK,YAAY,MAAM,SAAS;AAEhD,QAAO;;AAGT,SAAS,YAAY,UAAkB,OAAuC;AAE5E,QAAO,GAAG,SAAS,MADL,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,MAAM,WAAW,KAAK,KAAK,IAAI,MAAM,GACjD,CAAC,KAAK,KAAK,CAAC;;AAG5C,SAAS,MAAM,OAAe,KAAa,KAAqB;AAC9D,KAAI,OAAO,MAAM,MAAM,CAAE,QAAO;AAChC,QAAO,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,CAAC;;AAQ5C,IAAI;AACJ,SAAS,oBAA+C;AACtD,KAAI,OAAO,kBAAkB,YAAa,QAAO,KAAA;AACjD,KAAI,CAAC,gBAAgB;AACnB,mBAAiB,IAAI,eAAe;AACpC,iBAAe,YACb,UACG,WAAW,iCAAiC,uCAAuC,CACnF,WAAW,0BAA0B,gCAAgC,CACzE;;AAEH,QAAO;;;;;;;AAQT,SAAgB,gBAAgB,YAA8B;CAC5D,MAAM,QAAQ,mBAAmB;AACjC,KAAI,CAAC,MAAO;CAEZ,MAAM,WAAqC,MAAM,QAAQ,WAAW,mBAAmB,GACnF,WAAW,qBACX,EAAE;AACN,KAAI,SAAS,SAAS,MAAM,CAAE;AAC9B,KAAI;AACF,aAAW,qBAAqB,CAAC,OAAO,GAAG,SAAS;SAC9C;;;;;;;;;;AAaV,SAAgB,oBACd,YACA,UACA,eACM;CACN,MAAM,MAAM,wBAAwB,UAAU,EAAE,eAAe,CAAC;AAChE,KAAI,OAAO,kBAAkB,YAC3B;CAEF,MAAM,QAAQ,IAAI,eAAe;AACjC,OAAM,YAAY,IAAI;CAGtB,MAAM,WAAY,WAA+D;AAEjF,YAAW,qBAAqB,CAAC,GADlB,WAAW,mBAAmB,QAAQ,MAAM,MAAM,SACvB,EAAE,MAAM;AACjD,YAA+D,iBAAiB;;AAGnF,SAAgB,aAAa,UAA+C;CAM1E,MAAM,OAAO,UAAU,OAAO,QAAQ;AACtC,KAAI,SAAS,QAAS,QAAO;AAC7B,KAAI,SAAS,OAAQ,QAAO;AAC5B,KAAI,OAAO,eAAe,WACxB,QAAO,WAAW,gCAAgC,CAAC,UAAU,UAAU;AAEzE,QAAO;;;;AC5NT,MAAM,8BAA8B;CACnC,UAAU;CACV,OAAO;CACP;;;;;;;;;;;;;;;;;;ACrBD,MAAM,gBAAgB,IAAI,IAAY,OAAO,OAAO,4BAA4B,CAAC;AAOjF,SAAgB,iBAAiB,OAAuD;AACtF,KAAI,CAAC,MACH,QAAO;EAAE,UAAU,KAAA;EAAW,QAAQ,EAAE;EAAE;CAG5C,MAAM,SAAmB,EAAE;CAC3B,MAAM,MAAgB,EAAE,GAAG,OAAO;AAElC,KAAI,IAAI,UAAU,CAAC,cAAc,IAAI,IAAI,OAAO,EAAE;AAChD,SAAO,KAAK,mBAAmB,IAAI,OAAO,iCAAiC;AAC3E,MAAI,SAAS,4BAA4B;;AAG3C,KAAI,WAAW,YAAY,IAAI,UAAU,YAAY,OAAO;AAC5D,KAAI,WAAW,YAAY,IAAI,UAAU,YAAY,OAAO;AAC5D,KAAI,WAAW,YAAY,IAAI,UAAU,YAAY,OAAO;AAC5D,KAAI,IAAI,OACN,KAAI,SAAS;EACX,WAAW,YAAY,IAAI,OAAO,WAAW,oBAAoB,OAAO;EACxE,SAAS,YAAY,IAAI,OAAO,SAAS,kBAAkB,OAAO;EAClE,kBAAkB,YAChB,IAAI,OAAO,kBACX,2BACA,OACD;EACF;AAGH,QAAO;EAAE,UAAU;EAAK;EAAQ;;AAGlC,SAAS,YACP,OACA,OACA,QACoB;AACpB,KAAI,SAAS,QAAQ,UAAU,GAC7B;AAEF,KAAI;EACF,MAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,MAAI,OAAO,aAAa,UAAU;AAChC,UAAO,KAAK,GAAG,MAAM,wBAAwB,OAAO,SAAS,eAAe;AAC5E;;AAEF,SAAO,OAAO,UAAU;SAClB;AACN,SAAO,KAAK,GAAG,MAAM,gCAAgC;AACrD;;;;;;;;;;;;;;;;AC/DJ,MAAM,UAAU;AAEhB,SAAgB,aAAa,YAAwB,SAA0C;CAC7F,MAAM,WAAW,WAAW,iBAAiB,QAAQ;AACrD,KAAI,CAAC,SAAS;AACZ,YAAU,QAAQ;AAClB;;AAEF,KAAI,YAAY,SAAS,SAAS,QAChC;AAEF,WAAU,QAAQ;CAElB,MAAM,QADgB,WAAW,iBAAiB,UACvB,cAAc,OAAO;AAChD,MAAK,KAAK;AACV,MAAK,MAAM;AACX,MAAK,OAAO;AACZ,YAAW,QAAQ,KAAK;;;;ACJ1B,MAAa,yBAAyB;AAEtC,MAAa,8BAA8B,OAAO,uBAAuB;AAEzE,SAAgB,oBACd,MACA,MACA,QACQ;CACR,MAAM,WAAW,SAAS,cAAc,WAAW;AACnD,UAAS,YAAY;CACrB,MAAM,WAAW,SAAS;CAE1B,MAAM,YAAY,oBAAoB,UAAU,MAAM,OAAO;CAC7D,MAAM,SAAS,kBAAkB,SAAS;AAE1C,KAAI,QAAQ,YAAY;AACtB,OAAK,MAAM,QAAQ,UACjB,QAAO,WAAW,aAAa,MAAM,OAAO;AAE9C,SAAO,QAAQ;OAEf,MAAK,MAAM,QAAQ,UACjB,UAAS,YAAY,KAAK;AAI9B,QAAO,SAAS;;AAGlB,SAAS,oBACP,UACA,MACA,QACW;CACX,MAAM,YAAuB,EAAE;AAE/B,KAAI,KAAK,OACP,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,EAAE;AACvD,MAAI,CAAC,MAAM,SAAU;AACrB,MAAI,YAAY,UAAU,KAAK,CAAE;AACjC,YAAU,KAAK,WAAW,MAAM,MAAM,UAAU,MAAM,MAAM,QAAQ,MAAM,SAAS,CAAC;;AAIxF,KAAI,KAAK,WAAW,CAAC,iBAAiB,SAAS,EAAE;EAC/C,MAAM,UAAU,OAAO,QAAQ,KAAK,QAAQ,CAAC,MAAM,GAAG,YAAY,OAAO,QAAQ;AACjF,MAAI,SAAS;GACX,MAAM,CAAC,MAAM,UAAU;AACvB,aAAU,KAAK,YAAY,MAAM,OAAO,UAAU,OAAO,CAAC;;;AAI9D,QAAO;;AAGT,SAAS,iBAAiB,UAAqC;AAG7D,QAAO,QAAQ,SAAS,cAAc,mCAAiC,CAAC;;AAG1E,SAAS,YAAY,UAA4B,MAAuB;AAItE,MAAK,MAAM,SAAS,SAAS,iBAAiB,WAAW,CACvD,KAAI,MAAM,aAAa,OAAO,KAAK,KAAM,QAAO;AAElD,QAAO;;AAGT,SAAS,kBAAkB,UAA4C;CACrE,MAAM,UAAU,SAAS,iBAAiB,UAAU,iBAClD,UACA,WAAW,aACZ;CACD,IAAI,OAAoB,OAAO,UAAU;AACzC,QAAO,MAAM;AACX,MAAI,KAAK,WAAW,MAAM,KAAA,qBACxB,QAAO;AAET,SAAO,OAAO,UAAU;;AAE1B,QAAO;;AAGT,SAAS,WACP,MACA,SACA,MACA,QACA,UACS;CACT,MAAM,KAAK,SAAS,cAAc,WAAW;AAC7C,IAAG,aAAa,QAAQ,KAAK;AAC7B,IAAG,aAAa,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC;AACzD,IAAG,aAAa,QAAQ,KAAK;AAC7B,KAAI,SACF,IAAG,aAAa,YAAY,GAAG;AAEjC,QAAO;;AAGT,SAAS,YAAY,MAAc,SAA6B,QAAyB;CACvF,MAAM,KAAK,SAAS,cAAc,YAAY;AAC9C,IAAG,aAAa,aAAa,UAAU;AACvC,IAAG,aAAa,QAAQ,SAAS;AACjC,IAAG,aAAa,QAAQ,SAAS;AACjC,IAAG,aAAa,SAAS,GAAG;AAC5B,IAAG,aAAa,UAAU,KAAK;AAC/B,IAAG,aAAa,SAAS,OAAO,QAAQ,WAAW,kBAAkB,CAAC;AACtE,QAAO;;AAGT,SAAS,OAAO,QAAgB,KAAqB;AACnD,QAAO,OAAO,QAAQ;;;;;;;;;;;;;;;;AChIxB,MAAa,mBAAmB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACD1C,MAAa,kBAAkB,OAAO,GAAG;;;;;;;;;;;;;;;;;;AAmBzC,MAAa,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjB/B,MAAa,wBAAwB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACK/C,MAAa,mBAAmB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACT1C,MAAa,iBAAiB;CAC5B,SAAS;CACT,UAAU;CACV,eAAe;CACf,UAAU;CACX;;;;;;;;;;;;;;;;;;ACsBD,SAAgB,mBAAmB,SAAsC;CASvE,MAAM,SAAS,IAAI,OAAO;EACxB,WAAA;IARC,eAAe,UAAU;IACzB,eAAe,WAAW;IAC1B,eAAe,gBAAgB;IAC/B,eAAe,WAAW;GAC3B,GAAI,QAAQ,aAAa,EAAE;GAIlB;EACT,OAAO;EACP,UAAU;EACV,mBAAmB;EACnB,eAAe;EACf,iBAAiB;EACjB,cAAc;EACf,CAAC;AAMF,QAAO,eAAe,QAAQ,UAAmB,UAAU,MAAM,CAAC;AAOlE,QAAO,eACL,KACA,SAAS,QAAoC,KAAc,GAAG,MAAiB;EAC7E,MAAM,YAAY,UAAU,IAAI;AAEhC,SAAO,YADU,QAAQ,OAAO,cAAc,WACjB,KAAK,IAAI,UAAU,CAAC;GAEpD;;AAGD,QAAO,eAAe,qBAAqB,YAAqB;EAC9D,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;AAGF,QAAO,eAAe,cAAc,YAAqB;EACvD,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;CAGF,MAAM,iBAAyC;EAC7C,wBAAwB;EACxB,uBAAuB;EACvB,sBAAsB;EACtB,2BAA2B;EAC3B,4BAA4B;EAC5B,6BAA6B;EAC9B;;AAGD,QAAO,eAAe,iBAAiB,YAAqB;EAC1D,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;AAGF,QAAO,eAAe,cAAc,YAAqB;EACvD,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;AAGF,QAAO,eAAe,eAAe,WAAoB,WAAoB;EAC3E,MAAM,OAAO,UAAU,UAAU;AACjC,MAAI,CAAC,MAAM,QAAQ,OAAO,CAAE,QAAO;AACnC,OAAK,MAAM,QAAQ,QAAQ;GAEzB,MAAM,MAAMA,KAAI,YAAY;AAC5B,OAAI,eAAe,SAAS,KAC1B,QAAO,QAAQ,OAAO,QAAQ;;AAGlC,SAAO;GACP;;AAGF,QAAO,eAAe,mBAAmB,QAAiB;EACxD,MAAM,MAAO,KAAmB,YAAY;AAC5C,SAAO,QAAQ,MAAM,EAAE,OAAO;GAC9B;AAIF,QAAO,YAAY,mBAAmB;EACpC,QAAQ;EAGR,SAAS;AACP,UAAO;;EAEV,CAAC;AAEF,QAAO;;AAGT,SAAS,UAAU,OAAwB;AACzC,KAAI,SAAS,KAAM,QAAO;AAC1B,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,MAAM;AACjF,KAAI;AACF,SAAO,KAAK,UAAU,MAAM;SACtB;AACN,SAAO,OAAO,MAAM;;;AAIxB,SAAS,YAAY,UAAkB,MAAiC;AACtE,KAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,QAAO,SAAS,QAAQ,eAAe,OAAO,UAAU;AAEtD,SAAO,KADG,OAAO,MACJ,KAAK;GAClB;;;;;;;;;;;;;;ACrJJ,MAAa,KAA6B;CAExC,oBAAoB;CACpB,0BAA0B;CAC1B,sCAAsC;CACtC,6BAA6B;CAC7B,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CAGnC,kBAAkB;CAClB,2BAA2B;CAC3B,2BAA2B;CAC3B,iCAAiC;CACjC,iCAAiC;CAGjC,kBAAkB;CAClB,wBAAwB;CACxB,oCAAoC;CACpC,2BAA2B;CAC3B,gCACE;CACF,0BAA0B;CAC1B,gCAAgC;CAChC,gCAAgC;CAGhC,wBAAwB;CACxB,oCAAoC;CACpC,oCAAoC;CACpC,+BAA+B;CAC/B,8BAA8B;;CAE9B,2BAA2B;CAC3B,gCAAgC;CAChC,8BAA8B;CAC9B,6BAA6B;CAC7B,wBAAwB;CAGxB,kBAAkB;CAClB,sBAAsB;CACtB,oBAAoB;CAGpB,iBAAiB;CACjB,uBACE;CACF,uBAAuB;CAGvB,uBAAuB;CAGvB,mBAAmB;CACnB,iBAAiB;CACjB,0BAA0B;CAC1B,iBAAiB;CAGjB,sBAAsB;CAGtB,wBAAwB;CACxB,uBAAuB;CACvB,2BAA2B;CAC3B,4BAA4B;CAC5B,sBAAsB;;CAEtB,6BAA6B;CAC7B,kBAAkB;CAGlB,8BAA8B;CAC9B,6BAA6B;CAC9B;;;AC/ED,MAAa,KAAa;CAExB,oBAAoB;CACpB,0BAA0B;CAC1B,sCAAsC;CACtC,6BAA6B;CAC7B,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CAGnC,kBAAkB;CAClB,2BAA2B;CAC3B,2BAA2B;CAC3B,iCAAiC;CACjC,iCAAiC;CAGjC,kBAAkB;CAClB,wBAAwB;CACxB,oCAAoC;CACpC,2BAA2B;CAC3B,gCACE;CACF,0BAA0B;CAC1B,gCAAgC;CAChC,gCAAgC;CAGhC,wBAAwB;CACxB,oCAAoC;CACpC,oCACE;CACF,+BAA+B;CAC/B,8BAA8B;CAC9B,2BAA2B;CAC3B,gCACE;CACF,8BACE;CACF,6BACE;CACF,wBAAwB;CAGxB,kBAAkB;CAClB,sBAAsB;CACtB,oBAAoB;CAGpB,iBAAiB;CACjB,uBACE;CACF,uBAAuB;CAGvB,uBAAuB;CAGvB,mBAAmB;CACnB,iBAAiB;CACjB,0BAA0B;CAC1B,iBAAiB;CAGjB,sBAAsB;CAGtB,wBAAwB;CACxB,uBAAuB;CACvB,2BAA2B;CAC3B,4BAA4B;CAC5B,sBAAsB;CACtB,6BAA6B;CAC7B,kBAAkB;CAGlB,8BAA8B;CAC9B,6BAA6B;CAC9B;;;AC1ED,MAAa,iBAAmD;CAAE;CAAI;CAAI;;;;;;;ACR1E,MAAM,mCAAmC;;AAEzC,SAAS,kCAAkC;AAC1C,QAAO,gDAAgD,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;ACezF,MAAM,kBAAqC;CACzC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;;;;;AAOD,MAAM,eAAkC;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,qBAAqB;AAE3B,SAAS,sBAAgC;CACvC,MAAM,MAAM,IAAI,IAAY,gBAAgB;AAC5C,MAAK,MAAM,YAAY,iBACrB,KAAI,IAAI,SAAS,IAAI;AAEvB,QAAO,CAAC,GAAG,IAAI;;AAGjB,SAAS,uBAAiC;CACxC,MAAM,MAAM,IAAI,IAAY,aAAa;AACzC,MAAK,MAAM,YAAY,iBACrB,MAAK,MAAM,QAAQ,SAAS,MAC1B,KAAI,IAAI,KAAK;AAGjB,QAAO,CAAC,GAAG,IAAI;;;;;;AAOjB,SAAgB,kBAA4C;CAC1D,MAAM,SAAiB;EACrB,cAAc,EAAE,MAAM,MAAM;EAC5B,UAAU,qBAAqB;EAC/B,UAAU,sBAAsB;EAChC,aAAa;GAAC;GAAU;GAAS;GAAU;GAAU;GAAS;GAAQ;GAAS;GAAS;EACxF,aAAa;GAAC;GAAW;GAAW;GAAU;GAAW;GAAS;EAClE,yBAAyB;GACvB,cAAc;GACd,oBAAoB;GACpB,gCAAgC;GACjC;EACD,cAAc;EACd,iBAAiB;EACjB,iBAAiB;EACjB,qBAAqB;EACtB;AAED,QAAO,SAAS,SAAS,MAAsB;EAC7C,MAAM,SAAS,UAAU,SAAS,MAAM,OAAO;AAC/C,SAAO,OAAO,WAAW,WAAW,SAAS,OAAO,OAAO;;;;;ACjH/D,MAAM,aAAa;AAEnB,IAAa,kBAAb,MAA2D;CACzD;CAEA;CAEA,aAA4C;CAK5C,SAAgC;CAEhC,YAAY,MAA8B;AACxC,OAAK,OAAO;AACZ,OAAK,cAAc,KAAK;;CAG1B,IAAI,QAAuB;AACzB,SAAO,KAAK;;CAGd,YAAY,UAAsC;AAChD,OAAK,WAAW;AAChB,OAAK,SAAS;;CAGhB,gBAAsB;AACpB,OAAK,SAAS;;CAGhB,mBAAyB;AACvB,OAAK,QAAQ;;CAGf,UAAwB;EACtB,MAAM,OAAO,KAAK,UAAU,OAAO,QAAQ;AAC3C,MAAI,SAAS,QAAQ;AACnB,QAAK,QAAQ;AAIb,QAAK,OAAO,KAAK,YAAY,YAAY,QAAQ,UAAU,OAAO;AAClE;;AAEF,OAAK,QAAQ;AACb,OAAK,OAAO,SAAS,UAAU,UAAU,OAAO;;CAGlD,SAAuB;AACrB,MAAI,KAAK,cAAc,OAAO,eAAe,WAAY;AACzD,OAAK,aAAa,WAAW,WAAW;AACxC,OAAK,WAAW,iBAAiB,UAAU,KAAK,cAAc;;CAGhE,SAAuB;AACrB,MAAI,CAAC,KAAK,WAAY;AACtB,OAAK,WAAW,oBAAoB,UAAU,KAAK,cAAc;AACjE,OAAK,aAAa;;CAGpB,iBAAyB,UAAqC;AAG5D,OAAK,OAAO,MAAM,UAAU,SAAS,QAAQ;;CAG/C,OAAe,MAA2B;AACxC,MAAI,KAAK,WAAW,KAAM;AAC1B,OAAK,SAAS;AACd,OAAK,KAAK,eAAe;;;;;ACpBtB,IAAA,eAAA,MAAM,qBAAqB,WAAW;CAC3C,OAAgB,oBAAoC;EAClD,GAAG,WAAW;EACd,gBAAgB;EACjB;CAOD,OAAgB,SAAS,GAAG;;;;;;;8BAQ0C;KAAjC,UAAA;;;;;;;KAMI,UAAA;;;;;;oCAU2C;KAAhB,gBAAA;;;;;;mCAQa;KAAf,eAAA;;;;;;2BAOb;KAAP,OAAA;;;;;;;KAcL,UAAA;;;;;;+BAEkB;KAAjC,WAAA;;;;;;+BAEiC,KAAA;KAAjC,WAAA;;;;;;8BAEU;KAAV,UAAA;;;;;;mCAE8B;KAA9B,eAAA;;;;;;iCAEqC,EAAE;KAAvC,aAAA;;;;;;CAE1B,kBAAmC,IAAI,gBAAgB,KAAK;CAE5D,SAAgC;CAEhC,WAA4B,iBAAiB;;;;;CAM7C,sBAA+E;CAE/E,mBAA4D;EAC1D,MAAM,OAAO,MAAM,kBAAkB;AACrC,MAAI,gBAAgB,YAAY;GAI9B,MAAM,WAAqC,MAAM,QAAQ,KAAK,mBAAmB,GAC7E,KAAK,qBACL,EAAE;GACN,MAAM,QAAQ,IAAI,eAAe;AACjC,SAAM,YAAY,gBAAgB;AAClC,QAAK,qBAAqB,CAAC,GAAG,UAAU,MAAM;AAC9C,QAAK,iBAAiB,YAAY,KAAK,gBAAiC;AAIxE,QAAK,iBAAiB,aAAa,KAAK,iBAAkC;AAC1E,QAAK,iBAAiB,SAAS,KAAK,sBAAuC;AAI3E,QAAK,iBAAiB,UAAU,KAAK,iBAAkC;AAIvE,QAAK,iBAAiB,qBAAqB,KAAK,oBAAqC;AAGrF,QAAK,iBAAiB,oBAAoB,KAAK,mBAAoC;;AAErF,SAAO;;;;;;;;;;;;CAaT,eAAwC;AAGtC,uBAAqB,KAAK,KAAK,WAAW,CAAC;;;;;;;;CAS7C,gBAAgC;EAI9B,MAAM,YAHO,KAAK,SACZ,OAAO,aAAa,cAAc,SAAS,gBAAgB,OAAO,QAClE,OAAO,cAAc,cAAc,UAAU,WAAW,KACxC,MAAM,IAAI,CAAC,MAAM,IAAI,aAAa;EACxD,MAAM,UAAU,eAAe,YAAY;EAC3C,MAAM,SAAS,KAAK,UAAU;AAC9B,SAAO,SAAS;GAAE,GAAG;GAAS,GAAG;GAAQ,GAAG;;CAG9C,WAAoB,SAAqC;AACvD,MAAI,CAAC,KAAK,UAAU,QAAQ,IAAI,UAAU,IAAI,QAAQ,IAAI,OAAO,CAC/D,MAAK,SAAS,mBAAmB,EAAE,QAAQ,KAAK,eAAe,EAAE,CAAC;EAEpE,MAAM,OAAO,KAAK;AAClB,MAAI,MAAM;AACR,mBAAgB,KAAK;AACrB,uBAAoB,MAAM,KAAK,UAAU,KAAK,gBAAgB,MAAM;AACpE,gBAAa,MAAM,KAAK,UAAU,YAAY,KAAK;;AAErD,OAAK,QAAQ,QAAQ,KAAK,gBAAgB;AAC1C,OAAK,gBAAgB,mBAAmB,KAAK,gBAAgB,UAAU,OAAO;AAC9E,OAAK,aAAa,aAAa,KAAK,UAAU,SAAS,QAAQ;;CAGjE,QAAiB,SAAqC;AAEpD,MAAI,CAACC,QAAM,IAAI,WAAW,CAAE;AAE5B,8BAA4B;AAC1B,QAAK,qBAAqB;AAC1B,QAAK,uBAAuB;IAC5B;;CAGJ,SAAkB;AAChB,MAAI,KAAK,aACP,QAAO,IAAI;qCACoB,KAAK,aAAa;;AAGnD,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAC1B,QAAO,IAAI;EAEb,MAAM,WAAW,KAAK,kBACpB,KAAK,WAAW,KAAK,SAAS,MAAM,KAAK,OAAO,CACjD;AACD,SAAO,IAAI;;;;kBAIG,KAAK,UAAU,SAAS,QAAQ;;QAE1C,WAAW,SAAS,CAAC;;;;;;;;;;;CAY3B,kBAA0B,UAA0B;EAClD,MAAM,OAAO,KAAK,uBAAuB;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,SAAS,SAAS,mBAAmB,CACvC,QAAO,SAAS,QAAQ,oBAAoB,GAAG,KAAK,kBAAkB;AAExE,SAAO,WAAW;;;;;;;;;CAUpB,wBAAwC;EACtC,MAAM,cAAc,KAAK,UAAU;EACnC,MAAM,OAAO,aAAa,iBAAiB;EAC3C,MAAM,SAAS,aAAa;AAC5B,MAAI,CAAC,QAAQ,CAAC,OACZ,QAAO;AAET,MAAI,OAMF,QAAO,8FALU,OAAO,OAAO,KAAK,CAAC,QAAQ,MAAM,SAK0D,CAAC,IAJ5F,OAAO,OAAO,MAAM,CACnC,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAC0G,CAAC;AAE9H,SAAO,6KAA6K,iCAAiC,CAAC;;CAGxN,MAAc,YAA2B;EACvC,MAAM,MAAM,KAAK,WAAW,kBAAkB;EAG9C,MAAM,YAAY,KAAK,aAAa;AAEpC,MAAI,CAAC,IACH,OAAM,IAAI,MAAM,sHAAsH;EAExI,MAAM,MAAM,OAAO,IAAI;AAEvB,OAAK,UAAU;AACf,OAAK,eAAe;AACpB,MAAI;GACF,IAAI;AACJ,OAAI,KAAK,aACP,QAAO,MAAM,eAAe,KAAK,KAAK,aAAa;QAC9C;AACL,QAAI,CAAC,UACH,OAAM,IAAI,MAAM,6FAA6F;AAE/G,WAAO,MAAMC,UAAa,KAAK;KAAE,YAAY;KAAW,SAAS,KAAK;KAAS,CAAC;;AAElF,QAAK,cAAc,KAAK;WACjB,OAAO;AACd,QAAK,qBAAqB,MAAM;YACxB;AACR,QAAK,UAAU;;;CAInB,cAAsB,MAA2B;AAC/C,OAAK,WAAW;EAChB,MAAM,EAAE,UAAU,WAAW,iBAAiB,KAAK,SAAS;AAC5D,OAAK,WAAW;AAChB,OAAK,gBAAgB,YAAY,SAAS;AAC1C,MAAI,OAAO,SAAS,EAClB,SAAQ,KAAK,gDAAgD,OAAO;AAItE,OAAK,aAAa;GAAE,GAAG,qBAAqB,KAAK,KAAK;GAAE,GAAG,KAAK;GAAY;AACvE,OAAK,kBAAkB,KAAK;;;;;;;;;;;;;;CAenC,MAAc,kBAAkB,UAAwC;EACtE,MAAM,WAAW,SAAS,KAAK;AAC/B,MAAI,CAAC,SAAU;AAEf,OAAK,cACH,IAAI,YAAY,yBAAyB;GACvC,SAAS;GACT,UAAU;GACV,QAAQ;IACN;IACA,cAAc,SAAS;IACvB,eAAe,SAAS;IACxB,0BAA0B,SAAS;IACpC;GACF,CAAC,CACH;AAED,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,aAAa,cAAc,SAAS,cAAc;AACpD,UAAO,SAAS,OAAO,SAAS,aAAa;AAC7C;;EAGF,MAAM,eAAe,SAAS;AAC9B,MAAI,aAAa,UAAU,gBAAgB,KAAK,eAAe;AAC7D,QAAK,UAAU;AACf,OAAI;IACF,MAAM,MAAM,KAAK,WAAW,kBAAkB;AAC9C,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,mDAAmD;AAE7E,UAAM,gBADM,OAAO,IACM,EAAE,EAAE,eAAe,cAAc,EAAE,EAAE,YAAY,IAAI,WAAW,CAAC;AAC1F,WAAO,SAAS,OAAO,KAAK,cAAc;YACnC,OAAO;AACd,SAAK,qBAAqB,MAAM;aACxB;AACR,SAAK,UAAU;;;;CAKrB,WAAmB,MAAyB,QAAwB;EAClE,MAAM,eACJ,OAAO,KAAK,UAAU,oBAAoB,YAC1C,KAAK,SAAS,gBAAgB,SAAS,IACnC,KAAK,SAAS,kBACd;EAEN,MAAM,SAAsB,KAAK,QAC7B,KAAK,MAAM,WAAW,SAAS,GAC7B,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,GAC1B,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,GAC3B,EAAE;EAEN,MAAM,UAAyB;GAC7B,MAAM;IACJ,MAAM,KAAK;IACX,UAAU,KAAK;IACf,OAAO,KAAK,SAAS,EAAE;IACxB;GACD,QAAQ,KAAK,UAAU,EAAE;GACzB,SAAS,KAAK,WAAW,EAAE;GAC3B,OAAO,KAAK,SAAS,EAAE;GACvB,eAAe,KAAK,iBAAiB,EAAE;GACvC,WAAW,KAAK,aAAa;GAC7B,UAAU,EAAE;GACZ,UAAU,KAAK,gBAAgB;GAC/B;GACA,UAAU,KAAK,YAAY,EAAE;GAC7B,SAAS,KAAK;GACf;EAED,IAAI;AACJ,MAAI;AACF,OAAI,cAAc;IAChB,MAAM,WACJ,KAAK,qBAAqB,WAAW,eACjC,KAAK,oBAAoB,WACzB,OAAO,MAAM,aAAa;AAChC,SAAK,sBAAsB;KAAE,QAAQ;KAAc,UAAU;KAAU;AACvE,UAAM,OAAO,WAAW,UAAU,QAAQ;SAE1C,OAAM,OAAO,eAAe,eAAe,SAAS,QAAQ;WAEvD,OAAO;AACd,WAAQ,MAAM,yCAAyC,MAAM;AAC7D,OAAI;AACF,UAAM,OAAO,eAAe,eAAe,SAAS,QAAQ;WACtD;AACN,WAAO;;;EAIX,MAAM,UAAU,oBAAoB,KAAK,MAAM,KAAK,eAAe,CAAC;AACpE,SAAO,KAAK,SAAS,QAAQ;;;;;;;;;CAU/B,iBAA8E;EAC5E,MAAM,QAAQ,KAAK,WAAW,OAAO,MAAM;EAG3C,MAAM,UAAU,CAFF,KAAK,WAAW,YAAY,MAAM,EACjC,KAAK,WAAW,aAAa,MAAM,CACnB,CAAC,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC,MAAM;AAChE,MAAI,CAAC,SAAS,CAAC,QAAS,QAAO;AAC/B,SAAO;GACL,GAAI,QAAQ,EAAE,eAAe,OAAO,GAAG,EAAE;GACzC,GAAI,UAAU,EAAE,cAAc,SAAS,GAAG,QAAQ,EAAE,cAAc,OAAO,GAAG,EAAE;GAC/E;;CAGH,sBAAoC;EAClC,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,KAAM;EACX,MAAM,SAAS,KAAK,iBAAmD,WAAW;AAClF,MAAI,OAAO,WAAW,EAAG;AACzB,OAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,OAAO,MAAM,aAAa,OAAO;AACvC,OAAI,CAAC,QAAQ,EAAE,QAAQ,KAAK,YAAa;GACzC,MAAM,OAAO,KAAK,WAAW;AAC7B,OAAI,MAAM,UAAU,KAClB,OAAM,QAAQ;;;CAKpB,mBAA2B,UAA8D;AACvF,MAAI,CAAC,MAAM,OAAQ;EACnB,MAAM,EAAE,MAAM,UAAU,MAAM;AAC9B,MAAI,CAAC,KAAM;AACX,OAAK,aAAa;GAAE,GAAG,KAAK;IAAa,OAAO;GAAO;AACvD,OAAK,cACH,IAAI,YAAY,sBAAsB;GACpC,SAAS;GACT,UAAU;GACV,QAAQ;IAAE;IAAM;IAAO;GACxB,CAAC,CACH;;CAGH,oBAA4B,UAAwD;AAClF,MAAI,KAAK,QAAS;AACb,OAAK,OAAO,MAAM,QAAQ,UAAU,KAAK;;;CAIhD,yBAAiC,UAAuB;EACtD,MAAM,SAAU,MAAM,QAA+B,QAAqB,gBAAgB;AAC1F,MAAI,CAAC,UAAU,OAAO,QAAQ,YAAY,IAAI,KAAK,QAAS;EAC5D,MAAM,SAAS,OAAO,aAAa,cAAc;AACjD,MAAI,CAAC,OAAQ;AACb,QAAM,gBAAgB;AACjB,OAAK,OAAO,OAAO;;CAG1B,oBAA4B,UAA6B;AAGvD,QAAM,gBAAgB;AACtB,MAAI,KAAK,QAAS;EAOlB,MAAM,SAFY,MAAM,WACI,eAAe,SAAS,IAAI,QAC7B,KAAK,mBAAmB;AAC9C,OAAK,OAAO,OAAO;;;;;;;CAQ1B,uBACE,UACS;AACT,MAAI,KAAK,QAAS;EAClB,MAAM,EAAE,cAAc,QAAQ,UAAU,MAAM;AACzC,OAAK,OAAO,UAAU;GACzB;GACA;GACA;GACD,CAAC;;;;;;;;;;;;;;;CAgBJ,sBACE,UACS;AACT,MAAI,CAAC,KAAK,SAAU;EACpB,MAAM,EAAE,OAAO,SAAS,YAAY,MAAM;EAC1C,MAAM,WAAW,UAAU,4BAA4B;AACvD,MAAI,KAAK,SAAS,KAAK,UAAU,SAAU;EAC3C,MAAM,EAAE,WAAW,UAAU,GAAG,yBAAyB,KAAK,SAAS;AACvE,OAAK,WAAW;GACd,GAAG,KAAK;GACR,MAAM;IAAE,GAAG;IAAsB,OAAO;IAAU;GACnD;AACD,UAAQ,KAAK,oCAAoC,UAAU,cAAc,SAAS,IAAI,UAAU;;CAGlG,oBAA2C;EACzC,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,KAAM,QAAO;AAGlB,UAFgB,KAAK,cAAc,oDAAgD,IACjF,KAAK,cAAc,mCAAiC,GACtC,aAAa,SAAS,IAAI;;CAG5C,wBAAsC;EACpC,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,KAAM;AACX,8BAA4B;GAC1B,MAAM,aAAa,KAAK,iBAA8B,sBAAsB;AAC7D,SAAM,KAAK,WAAW,CAAC,MAAM,OAAO,CAAC,GAAG,aAAa,WAAW,CACzE,EAAE,OAAO;IACf;;CAGJ,MAAc,OACZ,QACA,mBACe;AACf,MAAI,CAAC,KAAK,YAAY,KAAK,QAAS;EACpC,MAAM,EAAE,IAAI,kBAAkB,KAAK;AACnC,OAAK,UAAU;AACf,MAAI;GAIF,MAAM,gBAAgB,OAAO,KAAK,KAAK,SAAS,KAAK,UAAU,EAAE,CAAC;GAClE,MAAM,SAAiC,EAAE;AACzC,QAAK,MAAM,OAAO,eAAe;IAC/B,MAAM,QAAQ,KAAK,WAAW;AAC9B,QAAI,UAAU,KAAA,EACZ,QAAO,OAAO;;GAGlB,MAAM,OAA2B;IAC/B;IACA,QAAQ,UAAU;IAClB;IACA,GAAI,oBAAoB,EAAE,oBAAoB,mBAAmB,GAAG,EAAE;IACvE;GACD,MAAM,MAAM,KAAK,WAAW,kBAAkB;AAC9C,OAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iDAAiD;GAE3E,MAAM,OAAO,MAAMC,WADP,OAAO,IACiB,EAAE,IAAI,KAAK;AAC/C,QAAK,cAAc,KAAK;AACxB,QAAK,cACH,IAAI,YAAY,qBAAqB;IACnC,SAAS;IACT,UAAU;IACV,QAAQ,EAAE,MAAM,KAAK,MAAM;IAC5B,CAAC,CACH;WACM,OAAO;AACd,QAAK,qBAAqB,MAAM;YACxB;AACR,QAAK,UAAU;;;CAInB,qBAA6B,OAAsB;EACjD,MAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,OAAK,eAAe;AACpB,UAAQ,MAAM,mBAAmB,MAAM;AACvC,OAAK,cACH,IAAI,YAAY,sBAAsB;GACpC,SAAS;GACT,UAAU;GACV,QAAQ,EAAE,SAAS;GACpB,CAAC,CACH;;;YA5jBF,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAM1B,SAAS,EAAE,WAAW,OAAO,CAAC,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAU9B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAoB,CAAC,CAAA,EAAA,aAAA,WAAA,iBAAA,KAAA;YAQzD,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAkB,CAAC,CAAA,EAAA,aAAA,WAAA,gBAAA,KAAA;YAOvD,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,aAAA,WAAA,QAAA,KAAA;YAc1B,SAAS,EAAE,WAAW,OAAO,CAAC,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAE9B,OAAO,CAAA,EAAA,aAAA,WAAA,YAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,YAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,gBAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,cAAA,KAAA;2BA3ET,cAAc,gBAAgB,CAAA,EAAA,aAAA;AAolB/B,SAAS,qBAAqB,MAAiD;CAC7E,MAAM,SAAiC,EAAE;AACzC,KAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,CACrD,QAAO,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAEjE,QAAO;;;;AC1oBT,MAAM,sBAAsB;AA2BrB,IAAA,gBAAA,MAAM,sBAAsB,WAAW;CAC5C,OAAgB,SAAS,CACvB,gBACA,GAAG;;;;;;;;;;;;sBAYe,EAAE,MAAM,QAAQ,aAAa;iBAClC,EAAE,MAAM,KAAK,cAAc;;;;;;;;iCAQX,EAAE,OAAO,SAAS,KAAK,GAAG,EAAE,OAAO,OAAO,SAAS;;;UAG1E,mBAAmB;;;gCAGG,EAAE,MAAM,MAAM;;;;;2BAKnB,EAAE,QAAQ,MAAM;;;sBAGrB,EAAE,MAAM,QAAQ,mBAAmB;4BAC7B,EAAE,MAAM,OAAO,eAAe;yBACjC,EAAE,OAAO,EAAE;;;;;;;;;eASrB,EAAE,QAAQ,MAAM;mBACZ,EAAE,QAAQ,MAAM;mCACA,EAAE,MAAM,OAAO,eAAe;;;;;;;sBAO3C,EAAE,MAAM,QAAQ,aAAa;iBAClC,EAAE,MAAM,KAAK,cAAc;;;;;;;;;;;;;;iBAc3B,EAAE,MAAM,KAAK,aAAa;;;;;;;iBAO1B,EAAE,MAAM,KAAK,cAAc;;;;;;;;mBAQzB,EAAE,QAAQ,MAAM;;;;;;;eAOpB,EAAE,QAAQ,MAAM;;mBAEZ,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM;yBAC7B,EAAE,OAAO,EAAE;iBACnB,EAAE,MAAM,KAAK,MAAM;;;;;;yCAMK,EAAE,MAAM,KAAK,MAAM;;;UAGlD,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBV,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM;;iBAErC,EAAE,MAAM,KAAK,MAAM;yCACK,EAAE,MAAM,KAAK,MAAM;gCAC5B,EAAE,MAAM,OAAO,eAAe;;MAG3D;;KAMwC,UAAA;;;;;;qCAG6C;KAAjB,iBAAA;;;;;;+BAQG;KAAX,WAAA;;;;;;kCAErB;KAAd,cAAA;;;;;;mCAEe;KAAf,eAAA;;;;;;2BAEO;KAAP,OAAA;;;;;;8BAEU;KAAV,UAAA;;;;;;mCAEe;KAAf,eAAA;;;;;;CAK1B,eAAuB;CAEvB,oBAAmC;AACjC,QAAM,mBAAmB;AACzB,OAAK,QAAQ,QAAQ;AACrB,OAAK,mBAAmB;EAExB,MAAM,OAAO,KAAK,cAAc,WAAW;AAC3C,MAAI,gBAAgB,qBAAqB;AACvC,QAAK,eAAe;AACpB,QAAK,eAAe,KAAK;;AAG3B,WAAS,iBAAiB,SAAS,KAAK,oBAAoB;AAC5D,WAAS,iBAAiB,WAAW,KAAK,sBAAsB;;CAGlE,uBAAsC;AACpC,QAAM,sBAAsB;AAC5B,WAAS,oBAAoB,SAAS,KAAK,oBAAoB;AAC/D,WAAS,oBAAoB,WAAW,KAAK,sBAAsB;;CAGrE,UAAyB;EACvB,MAAM,OAAO,KAAK;AAClB,MAAI,QAAQ,CAAC,KAAK,aAChB,iBAAgB,KAAK;;;;;;;;CAUzB,oBAAkC;AAChC,MAAI,OAAO,aAAa,YAAa;EACrC,MAAM,QAAQ,SAAS,OAAO,MAC5B,IAAI,OAAO,cAAc,oBAAoB,UAAU,CACxD;AACD,MAAI,CAAC,SAAS,CAAC,MAAM,GAAI;AACzB,MAAI;GACF,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,GAAG,CAAC;AACvC,QAAK,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAC/D,QAAK,eAAe,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;UAC5D;;CAKV,IAAY,UAAkB;EAC5B,MAAM,SAAS,KAAK,eAAe,KAAK;AACxC,SAAO,SAAS,OAAO,OAAO,EAAE,CAAC,aAAa,GAAG;;;;;;;;CASnD,eAAuB,MAAiC;EACtD,MAAM,QAAQ,KAAK,QAAQ,UAAU,KAAK;AAC1C,qBAAmB,OAAO,KAAK,aAAa,KAAK,cAAc,KAAK,QAAQ;EAE5E,MAAM,YAAY,SAAS,cAAc,OAAO;AAChD,YAAU,YAAY,MAAM;AAC5B,OAAK,YAAY,UAAU;AAEX,YAAU,iBAA8B,2BACjD,CAAC,SAAS,OAAO;AACtB,MAAG,iBAAiB,UAAU,UAAU;AACtC,UAAM,gBAAgB;AACjB,SAAK,UAAU;KACpB;IACF;;CAGJ,uBAAwC,UAA4B;AAClE,MAAI,CAAC,KAAK,KAAM;AAChB,MAAI,MAAM,cAAc,CAAC,SAAS,KAAK,CAAE;AACzC,OAAK,OAAO;;CAGd,yBAA0C,UAA+B;AACvE,MAAI,CAAC,KAAK,KAAM;AAChB,MAAI,MAAM,QAAQ,SAAU;AAC5B,OAAK,OAAO;AACZ,OAAK,YAAY,cAAiC,WAAW,EAAE,OAAO;;CAGxE,aAA2B;AACzB,OAAK,OAAO,CAAC,KAAK;AAClB,OAAK,eAAe;;;;;;;;CAStB,MAAc,WAA0B;AACtC,OAAK,UAAU;AACf,OAAK,eAAe;EAEpB,MAAM,SAAS;GACb,GAAI,KAAK,WAAW,EAAE,WAAW,KAAK,UAAU,GAAG,EAAE;GACrD,GAAI,KAAK,iBAAiB,EAAE,0BAA0B,KAAK,gBAAgB,GAAG,EAAE;GACjF;AAED,MAAI;GACF,MAAM,MAAM,KAAK,WAAW,kBAAkB;AAC9C,OAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uEAAuE;AACjG,SAAM,OAAO,IAAI,CAAC,WAAW,QAAQ,EAAE,aAAa,WAAW,CAAC;WACzD,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAK,eAAe,WAAW;AAC/B,QAAK,UAAU;AACf;;AAGF,OAAK,OAAO;AACZ,OAAK,UAAU;EAEf,MAAM,SAAS;GAAE,MAAM,KAAK;GAAa,OAAO,KAAK;GAAc;AACnE,OAAK,cACH,IAAI,YAAY,mBAAmB;GACjC,SAAS;GACT,UAAU;GACV;GACD,CAAC,CACH;AAED,MAAI,KAAK,kBAAkB,OAAO,WAAW,YAC3C,QAAO,SAAS,OAAO,KAAK;;;;;;;;CAUhC,mBAA2B;EACzB,MAAM,SAAS;GACb,GAAI,KAAK,WAAW,EAAE,WAAW,KAAK,UAAU,GAAG,EAAE;GACrD,GAAI,KAAK,iBAAiB,EAAE,0BAA0B,KAAK,gBAAgB,GAAG,EAAE;GACjF;EACD,MAAM,MAAM,KAAK,WAAW,kBAAkB;AAC9C,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uEAAuE;AACjG,SAAO,OAAO,IAAI,CAAC,iBAAiB,OAAO;;CAG7C,mBAA2B,OAAoB;AAC7C,QAAM,gBAAgB;AACjB,OAAK,UAAU;;CAGtB,SAAkB;AAChB,MAAI,KAAK,aAIP,QAAO;AAGT,SAAO,IAAI;;;;qBAIM,KAAK,OAAO,oBAAoB,iBAAiB;wBAC9C,KAAK,OAAO,SAAS,QAAQ;;iBAEpC,KAAK,WAAW;;UAEvB,KAAK,QAAQ;;;QAGf,KAAK,OACH,IAAI;;;iEAGmD,KAAK,QAAQ;;8CAEhC,KAAK,eAAe,KAAK,aAAa;oBAChE,KAAK,cACH,IAAI,8BAA8B,KAAK,aAAa,UACpD,QAAQ;;;;;;;;8BAQA,KAAK,QAAQ;2BAChB,KAAK,mBAAmB;;oBAE/B,KAAK,UACH,IAAI,qDACJ,IAAI;;;;;;;;;;;;;;;;wBAgBF;0BACE,KAAK,UAAU,iBAAiB,WAAW;;;;gBAIrD,KAAK,eACH,IAAI,uCAAuC,KAAK,aAAa,UAC7D,QAAQ;;cAGhB,QAAQ;;;;YA/Pf,SAAS,EAAE,WAAW,OAAO,CAAC,CAAA,EAAA,cAAA,WAAA,WAAA,KAAA;YAG9B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAqB,CAAC,CAAA,EAAA,cAAA,WAAA,kBAAA,KAAA;YAQ1D,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAa,CAAC,CAAA,EAAA,cAAA,WAAA,YAAA,KAAA;YAElD,OAAO,CAAA,EAAA,cAAA,WAAA,eAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,gBAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,QAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,WAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,gBAAA,KAAA;4BAxKT,cAAc,iBAAiB,CAAA,EAAA,cAAA;;;;;;AA4ZhC,SAAS,mBACP,UACA,MACA,OACA,SACM;CACN,MAAM,SAAS,SAAS,iBAAiB,UAAU,WAAW,UAAU;CACxE,IAAI,OAAO,OAAO,UAAU;AAC5B,QAAO,MAAM;AACX,MAAI,KAAK,YACP,MAAK,cAAc,KAAK,YACrB,QAAQ,iBAAiB,KAAK,CAC9B,QAAQ,kBAAkB,MAAM,CAChC,QAAQ,oBAAoB,QAAQ;AAEzC,SAAO,OAAO,UAAU"}

package/dist/styles/base.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Shared shadow-root base styles. Each atom prepends this fragment to its own
+ * `static styles` so font/colour inheritance, box-sizing, and resets stay
+ * consistent without forcing a global stylesheet on the host page.
+ */
+export declare const baseHostStyles: import("lit").CSSResult;
+//# sourceMappingURL=base.d.ts.map

package/dist/styles/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/styles/base.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,cAAc,yBAa1B,CAAC"}

package/dist/styles/focus-ring.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Visible focus indicator shared across interactive atoms. Mirrors the
+ * Figma button "Focused" state — a 2px white outline offset by 2px from
+ * the element edge. Atoms apply via `&:focus-visible { ${focusVisibleStyles} }`.
+ */
+export declare const focusVisibleStyles: import("lit").CSSResult;
+//# sourceMappingURL=focus-ring.d.ts.map

package/dist/styles/focus-ring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"focus-ring.d.ts","sourceRoot":"","sources":["../../src/styles/focus-ring.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAG9B,CAAC"}

package/dist/styles/index.d.ts

@@ -0,0 +1,5 @@
+export { baseHostStyles } from "./base.js";
+export { focusVisibleStyles } from "./focus-ring.js";
+export { surfaceStyles } from "./surface.js";
+export { t } from "./tokens.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/styles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/styles/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC"}

package/dist/styles/surface.d.ts

@@ -0,0 +1,8 @@
+import { type CSSResult } from "lit";
+/**
+ * Wrap shared surface CSS (from `@zitadel/shared-component-styles`)
+ * for Lit `static styles`. Import `.css?inline` in atoms; `@tsdown/css` inlines
+ * the strings when `components` is built.
+ */
+export declare function surfaceStyles(...cssChunks: string[]): CSSResult[];
+//# sourceMappingURL=surface.d.ts.map

package/dist/styles/surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/styles/surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,KAAK,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAEjE"}