@zitadel/components 0.1.0-alpha.9 → 1.0.0-alpha.20

package/dist/orchestrator-ixQm2RIC.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator-ixQm2RIC.mjs","names":["getSession","revokeSession","TEMPLATE_NAMES","defaultTemplate","layoutChromeCss","apiStartFlow","apiSubmitStep","getSession","revokeSession","getSession","revokeSession"],"sources":["../../api/dist/runtime/auth.mjs","../../api/dist/runtime/fetch.mjs","../src/internal/attribution-markup.ts","../src/internal/escape-html.ts","../src/orchestrator/api-client.ts","../src/orchestrator/asset-fallback.ts","../../api/dist/generated/model/index.mjs","../src/orchestrator/branding-validator.ts","../src/orchestrator/exportparts.ts","../src/orchestrator/mandatory-gates.ts","../src/orchestrator/liquid.ts","../src/orchestrator/locales/en.ts","../src/orchestrator/locales/de.ts","../src/orchestrator/locales/it.ts","../src/orchestrator/locales/business.ts","../src/orchestrator/locales/index.ts","../../api/dist/runtime/base-url.mjs","../../api/dist/chunk-CfYAbeIz.mjs","../../api/dist/generated/endpoints/zitadelNextGen.mjs","../../api/dist/runtime/api-factory.mjs","../../api/dist/runtime/config.mjs","../src/orchestrator/resolve-api.ts","../src/orchestrator/sanitiser.ts","../src/orchestrator/branding-to-tokens.ts","../src/orchestrator/font-loader.ts","../src/orchestrator/theme-controller.ts","../src/orchestrator/surface.ts","../src/orchestrator/template-names.ts","../src/orchestrator/templates/layout-chrome.css?inline","../src/orchestrator/zitadel-login.ts","../src/orchestrator/zitadel-logout.ts","../src/orchestrator/zitadel-session.ts"],"sourcesContent":["//#region src/runtime/auth.ts\n/**\n* Module-global bearer token used by the orval-generated client's\n* custom fetch. Set once at command boot (the same lifecycle pattern\n* as `base-url.ts`); every generated request reads from here.\n*\n* Keeping the token here means the CLI doesn't have to thread an\n* `Authorization` header through every generated call site; orval's\n* `mutator` wires `runtime/fetch.ts` in, and that file pulls the token\n* from this module.\n*/\nlet apiAuthToken;\nfunction getApiAuthToken() {\n\treturn apiAuthToken;\n}\nfunction setApiAuthToken(token) {\n\tapiAuthToken = token;\n}\n//#endregion\nexport { getApiAuthToken, setApiAuthToken };\n\n//# sourceMappingURL=auth.mjs.map","import { getApiAuthToken } from \"./auth.mjs\";\n//#region src/runtime/fetch.ts\n/**\n* Framework-neutral failure type the orval-generated client throws on\n* any non-2xx response. Carries the HTTP status, the parsed error body\n* (the spec's `{code, message, details?}` envelope when the server\n* returned one), and the request URL — enough for callers to map to\n* their own error taxonomy without re-implementing the fetch layer.\n*\n* Callers that don't care about the distinction can catch `ApiError`\n* generically; callers that do (the CLI's `toZitadelError`) read\n* `status` and decide.\n*/\nvar ApiError = class extends Error {\n\tstatus;\n\turl;\n\tbody;\n\tconstructor(status, url, body, message) {\n\t\tsuper(message);\n\t\tthis.name = \"ApiError\";\n\t\tthis.status = status;\n\t\tthis.url = url;\n\t\tthis.body = body;\n\t}\n};\n/**\n* The orval `mutator` for the fetch client. Every generated operation\n* routes its request through this function instead of the global\n* `fetch`. We pin three concerns here so generated call sites stay\n* focused on the shape of one HTTP call:\n*\n* - bearer auth — read from `runtime/auth.ts` and attached automatically;\n* - non-2xx → throw — orval's stock client parses the body regardless\n*   of status, so callers would have to inspect every response. Throw\n*   `ApiError` on `!res.ok` so failures interrupt control flow;\n* - body parsing — return the parsed JSON typed as `T` (the operation's\n*   return type, threaded through by orval), or `undefined` for the\n*   spec's `204`/`205`/`304` no-body responses.\n*/\nasync function customFetch(url, options) {\n\tconst token = getApiAuthToken();\n\tconst headers = new Headers(options.headers);\n\tif (token && !headers.has(\"authorization\")) headers.set(\"authorization\", `Bearer ${token}`);\n\tconst res = await fetch(url, {\n\t\t...options,\n\t\theaders\n\t});\n\tconst rawBody = [\n\t\t204,\n\t\t205,\n\t\t304\n\t].includes(res.status) ? \"\" : await res.text();\n\tconst parsed = rawBody ? safeJsonParse(rawBody) : void 0;\n\tif (!res.ok) {\n\t\tconst message = `${options.method ?? \"GET\"} ${url} returned ${res.status}`;\n\t\tthrow new ApiError(res.status, url, parsed, message);\n\t}\n\treturn parsed;\n}\n/**\n* `JSON.parse` wrapped so a non-JSON body (e.g. an HTML 502 from a\n* proxy) becomes `{ raw: \"<text>\" }` instead of throwing inside\n* `customFetch`. The thrown `ApiError` then carries something useful\n* for the user to see.\n*/\nfunction safeJsonParse(text) {\n\ttry {\n\t\treturn JSON.parse(text);\n\t} catch {\n\t\treturn { raw: text };\n\t}\n}\n/**\n* Extracts the server's `{code, message, details}` envelope from an\n* {@link ApiError} into a display string. Falls back to the fetch layer's\n* `\"METHOD url returned N\"` when the body isn't shaped like an envelope, so\n* transport-level failures (HTML from a proxy, empty 5xx) still say\n* something.\n*/\nfunction apiErrorMessage(error) {\n\tconst body = error.body;\n\tif (!isRecord(body)) return error.message;\n\tconst serverMessage = typeof body.message === \"string\" ? body.message : void 0;\n\tconst detail = pickDetailString(body.details);\n\tif (!serverMessage) return error.message;\n\treturn detail ? `${serverMessage}: ${detail}` : serverMessage;\n}\n/**\n* Reads the innermost human-readable string out of the spec's error\n* `details` field. Handles both `details: \"...\"` and the nested\n* `details: { details: \"...\" }` shape the platform emits for validation\n* failures.\n*/\nfunction pickDetailString(details) {\n\tif (typeof details === \"string\") return details;\n\tif (isRecord(details)) {\n\t\tif (typeof details.details === \"string\") return details.details;\n\t\tif (typeof details.message === \"string\") return details.message;\n\t}\n}\nfunction isRecord(value) {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n//#endregion\nexport { ApiError, apiErrorMessage, customFetch };\n\n//# sourceMappingURL=fetch.mjs.map","/**\n * The trustmark: \"Secured with\" + the 65×16 logotype. Shared by the\n * orchestrator's injected footer and the Storybook page-shell story.\n */\nexport const ZITADEL_ATTRIBUTION_LOGOTYPE_SVG =\n  '<svg class=\"zl-trustmark__logotype-svg\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 67.3501 15.1111\" width=\"65\" height=\"16\" fill=\"currentColor\" aria-hidden=\"true\" focusable=\"false\"><path d=\"M2.04839 4.265C2.06224 4.1284 2.1748 3.98591 2.32756 3.91161L8.98593 0.0494262C9.227 -0.0678242 9.45274 0.0334116 9.43089 0.248972V4.52681C9.41705 4.66341 9.30448 4.80589 9.15172 4.88019L2.49335 8.66426C2.25228 8.78151 2.02654 8.68027 2.04839 8.46471V4.265Z\"/><path d=\"M14.0086 5.25359C14.12 5.33388 14.1871 5.50261 14.1751 5.67205V13.2643C14.1561 13.5317 13.9555 13.6766 13.7798 13.5499L10.1005 11.4468C9.98908 11.3666 9.92196 11.1978 9.934 11.0284V3.32695C9.95299 3.05956 10.1535 2.91467 10.3293 3.04138L14.0086 5.25359Z\"/><path d=\"M7.37428 15.0817C7.24906 15.138 7.06938 15.1118 6.92865 15.0167L0.183465 11.1405C-0.038611 10.9903 -0.0638098 10.7442 0.133796 10.6554L3.76278 8.53833C3.888 8.48203 4.06767 8.50827 4.2084 8.60341L10.9046 12.5341C11.1267 12.6843 11.1557 12.9125 10.9543 13.0193L7.37428 15.0817Z\"/><path d=\"M65.6687 13.1043V2.00077H67.3501V13.1043H65.6687Z\"/><path d=\"M60.4255 13.2947C59.6535 13.2947 58.9715 13.1202 58.3793 12.7712C57.7871 12.4222 57.3218 11.9358 56.9834 11.3119C56.6556 10.688 56.4917 9.97418 56.4917 9.1705C56.4917 8.33509 56.6556 7.61073 56.9834 6.99739C57.3112 6.38405 57.7712 5.90819 58.3634 5.56979C58.9662 5.22083 59.6588 5.04634 60.4414 5.04634C61.2027 5.04634 61.869 5.21554 62.44 5.55393C63.011 5.88175 63.4552 6.33118 63.7724 6.90222C64.1002 7.47326 64.2642 8.12359 64.2642 8.85325C64.2642 9.0013 64.2589 9.1282 64.2483 9.23395C64.2483 9.33969 64.2377 9.46659 64.2166 9.61464H58.1731C58.2048 10.0588 58.3158 10.4553 58.5062 10.8043C58.6965 11.1427 58.9556 11.4124 59.2834 11.6133C59.6112 11.8036 59.9866 11.8988 60.4096 11.8988C60.8644 11.8988 61.2503 11.7983 61.5676 11.5974C61.8954 11.3859 62.1386 11.0898 62.2972 10.7091H64.0421C63.9046 11.185 63.672 11.6186 63.3441 12.0098C63.0269 12.4011 62.6251 12.7131 62.1386 12.9457C61.6522 13.1784 61.0811 13.2947 60.4255 13.2947ZM58.1889 8.42497H62.551C62.5299 7.81163 62.3131 7.3305 61.9007 6.98153C61.4883 6.62199 60.986 6.44222 60.3938 6.44222C59.865 6.44222 59.3839 6.60613 58.9503 6.93394C58.5168 7.26176 58.263 7.75876 58.1889 8.42497Z\"/><path d=\"M50.5389 13.2947C49.7563 13.2947 49.0796 13.1096 48.5085 12.7395C47.9481 12.3588 47.5145 11.8565 47.2078 11.2326C46.9117 10.6087 46.7637 9.91073 46.7637 9.13877C46.7637 8.37739 46.9117 7.69004 47.2078 7.0767C47.5145 6.45279 47.9481 5.96106 48.5085 5.60152C49.0796 5.2314 49.7563 5.04634 50.5389 5.04634C51.1205 5.04634 51.6492 5.16795 52.1251 5.41117C52.601 5.64382 52.9869 5.97692 53.283 6.41049V2.00077H54.9803V13.1043H53.3465L53.283 11.8829C53.0292 12.2954 52.6644 12.6337 52.1886 12.8981C51.7127 13.1625 51.1628 13.2947 50.5389 13.2947ZM50.872 11.8195C51.369 11.8195 51.7973 11.7032 52.1568 11.4705C52.5164 11.2379 52.7913 10.9206 52.9817 10.5188C53.172 10.1169 53.2672 9.66751 53.2672 9.1705C53.2672 8.59946 53.1561 8.1183 52.9341 7.72704C52.7226 7.33577 52.4318 7.0344 52.0617 6.82291C51.7021 6.61141 51.3003 6.50567 50.8561 6.50567C50.4014 6.50567 49.9943 6.6167 49.6347 6.83877C49.2752 7.06084 48.9897 7.36749 48.7782 7.75876C48.5773 8.15003 48.4768 8.61532 48.4768 9.15463C48.4768 9.68337 48.5825 10.1487 48.794 10.5505C49.0055 10.9524 49.2911 11.2643 49.6506 11.4864C50.0101 11.7085 50.4173 11.8195 50.872 11.8195Z\"/><path d=\"M40.7882 13.2947C40.2806 13.2947 39.8153 13.2048 39.3923 13.025C38.9693 12.8347 38.6309 12.5597 38.3771 12.2002C38.1233 11.8406 37.9965 11.4071 37.9965 10.8995C37.9965 10.2967 38.1445 9.81556 38.4406 9.45602C38.7473 9.0859 39.1544 8.81624 39.662 8.64704C40.1801 8.46727 40.7459 8.37739 41.3592 8.37739H43.3579C43.3579 7.92267 43.2839 7.55786 43.1358 7.28291C42.9878 6.99739 42.7868 6.79118 42.533 6.66429C42.2792 6.52681 41.9832 6.45808 41.6448 6.45808C41.2006 6.45808 40.8094 6.56383 40.471 6.77532C40.1431 6.97624 39.9369 7.29876 39.8523 7.7429H38.1551C38.2079 7.17186 38.3983 6.68544 38.7261 6.28359C39.0645 5.88175 39.4928 5.57508 40.011 5.36358C40.5291 5.15209 41.079 5.04634 41.6606 5.04634C42.422 5.04634 43.0512 5.1891 43.5482 5.47462C44.0558 5.74957 44.4312 6.13555 44.6744 6.63256C44.9282 7.12958 45.0551 7.69531 45.0551 8.3298V10.7409C45.0657 11.0475 45.1292 11.2749 45.2455 11.4229C45.3724 11.5604 45.5945 11.6397 45.9117 11.6609V13.1043C45.4887 13.1043 45.1186 13.0567 44.8013 12.9616C44.4947 12.8664 44.2409 12.7236 44.04 12.5333C43.839 12.3324 43.6804 12.0786 43.5641 11.7719C43.3103 12.1949 42.9402 12.5544 42.4537 12.8505C41.9673 13.1466 41.4121 13.2947 40.7882 13.2947ZM41.1848 11.9147C41.6183 11.9147 41.999 11.8089 42.3268 11.5974C42.6547 11.3753 42.9084 11.0898 43.0882 10.7409C43.268 10.3813 43.3579 9.99533 43.3579 9.58291V9.55119H41.4861C41.1795 9.55119 40.8887 9.5882 40.6137 9.66223C40.3493 9.73625 40.1326 9.86315 39.9634 10.0429C39.8047 10.2121 39.7254 10.45 39.7254 10.7567C39.7254 11.1586 39.8682 11.4547 40.1537 11.645C40.4392 11.8248 40.7829 11.9147 41.1848 11.9147Z\"/><path d=\"M35.5197 13.1043C34.7372 13.1043 34.1344 12.914 33.7114 12.5333C33.2884 12.1526 33.0769 11.5287 33.0769 10.6615V6.64842H31.8873V5.23669H33.0769V3.3332H34.7583V5.23669H36.757V6.64842H34.7583V10.6615C34.7583 11.0634 34.8482 11.333 35.028 11.4705C35.2078 11.608 35.488 11.6767 35.8687 11.6767H36.757V13.1043H35.5197Z\"/><path d=\"M29.6602 3.85668C29.3536 3.85668 29.0892 3.7509 28.8671 3.53941C28.6556 3.31734 28.5499 3.04768 28.5499 2.73043C28.5499 2.42376 28.6556 2.16468 28.8671 1.95319C29.0892 1.74169 29.3536 1.63594 29.6602 1.63594C29.9775 1.63594 30.2419 1.74169 30.4533 1.95319C30.6754 2.16468 30.7865 2.42376 30.7865 2.73043C30.7865 3.04768 30.6754 3.31734 30.4533 3.53941C30.2419 3.7509 29.9775 3.85668 29.6602 3.85668ZM28.8195 13.1043V5.23669H30.5009V13.1043H28.8195Z\"/><path d=\"M19.8276 13.1043V11.8036L25.1098 3.42837H19.8911V2.00077H27.0608V3.30147L21.7628 11.6609H27.1084V13.1043H19.8276Z\"/></svg>';\n\n/**\n * Inner markup for the default Zitadel trustmark (label + logotype). Plain text\n * beside a logotype — the design stopped wrapping this in a chip, so the chip\n * geometry stays with `<zl-pill>` and nothing here reaches for it.\n */\nexport function zitadelTrustmarkInnerHtml(): string {\n  return `Secured with <span class=\"zl-trustmark__logotype\">${ZITADEL_ATTRIBUTION_LOGOTYPE_SVG}</span>`;\n}\n","/**\n * Escapes the five HTML-significant characters so a string is safe to\n * interpolate into either element text or a double-quoted attribute value.\n *\n * Used for the orchestrator-owned attribution markup, which is appended after\n * the Liquid output has already been sanitised — so it can't rely on the\n * DOMPurify pass and must escape its own (tenant-supplied) values.\n */\nexport function escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n","/**\n * Thin wrappers around the orval-generated `@zitadel/api` fetch\n * functions for the API operations the orchestrator drives:\n *\n * - `POST   /flow`              — `createFlow`\n * - `POST   /flow/{id}/submit`  — `submitFlowStep`\n * - `GET    /flow/{id}`         — `getFlowStep`\n * - `POST   /sessions/exchange` — `exchangeHandoff`\n * - `GET    /sessions/me`       — `getMySession`\n * - `DELETE /sessions/me`       — `revokeMySession`\n *\n * The wrappers exist for one reason: every API call must run with\n * `credentials: \"include\"` so the stateless `_zflow` / `__nextgen_session`\n * HttpOnly cookies round-trip. Centralising that here keeps every call site\n * honest.\n *\n * Types come straight from `@zitadel/api/generated/model`. Orval\n * emits per-operation aliases (`CreateFlow201`, `GetFlowStep200`,\n * `SubmitFlowStep200`) for what is structurally the same response; the\n * orchestrator stores them as `CreateFlow201` because that is the alias\n * orval gives the start-of-flow response.\n */\nimport type { ZitadelApi } from \"@zitadel/api/config\";\nimport type {\n  CreateFlow201,\n  CreateFlowBody,\n  ExchangeHandoff200,\n  ExchangeHandoffBody,\n  ExchangeHandoffParams,\n  GetMySession200,\n  SubmitFlowStepBody,\n} from \"@zitadel/api/generated/model\";\nimport { ApiError } from \"@zitadel/api/runtime/fetch\";\n\nconst apiRequestInit: RequestInit = { credentials: \"include\" };\n\n/**\n * The signed-in session as the orchestrator renders it. `GET /sessions/me`\n * hydrates the user's conventional identity attributes, so the generated\n * schema carries optional `name` and `email` alongside `user_id`; both stay\n * absent for anonymous sessions and schemas without those properties.\n */\nexport type SessionIdentity = GetMySession200;\n\nexport async function startFlow(api: ZitadelApi, input: CreateFlowBody): Promise<CreateFlow201> {\n  return api.createFlow(input, apiRequestInit);\n}\n\n// Field validation errors come back as 400 with the step echoed and\n// `step.error` set. Unwrap that shape so it flows through like a 200;\n// everything else bubbles.\nexport async function submitStep(\n  api: ZitadelApi,\n  id: string,\n  body: SubmitFlowStepBody,\n): Promise<CreateFlow201> {\n  try {\n    return await api.submitFlowStep(id, body, apiRequestInit);\n  } catch (error) {\n    if (error instanceof ApiError && error.status === 400 && isFlowResponse(error.body)) {\n      return error.body;\n    }\n    throw error;\n  }\n}\n\nfunction isFlowResponse(body: unknown): body is CreateFlow201 {\n  return typeof body === \"object\" && body !== null && \"step\" in body;\n}\n\nexport async function getCurrentStep(api: ZitadelApi, id: string): Promise<CreateFlow201> {\n  return api.getFlowStep(id, apiRequestInit);\n}\n\n/**\n * Exchange a terminal-flow `handoff_token` for an authenticated session.\n * The server sets the `__nextgen_session` HttpOnly cookie on success.\n *\n * Uses the generated `exchangeHandoff` client which handles the\n * `project_id` query parameter via {@link ExchangeHandoffParams}.\n */\nexport async function exchangeSession(\n  api: ZitadelApi,\n  body: ExchangeHandoffBody,\n  params: ExchangeHandoffParams,\n): Promise<ExchangeHandoff200> {\n  return api.exchangeHandoff(body, params, apiRequestInit);\n}\n\n/**\n * Reads the current session (`GET /sessions/me`) with credentials so the\n * `__nextgen_session` cookie authenticates the request. Used by the\n * orchestrator's signed-in surfaces to render the user's identity.\n */\nexport async function getSession(api: ZitadelApi): Promise<SessionIdentity> {\n  return api.getMySession(apiRequestInit);\n}\n\n/**\n * Revokes the current session (`DELETE /sessions/me`) with credentials. The\n * server deletes the session and clears the cookie via `Set-Cookie: Max-Age=0`.\n */\nexport async function revokeSession(api: ZitadelApi): Promise<void> {\n  await api.revokeMySession(apiRequestInit);\n}\n","/**\n * Broken-branding-asset degradation.\n *\n * A `logo_url` / `hero_url` that is well-formed but unreachable clears every\n * gate on the way in — the CLI's zod shape check, the server's save gate —\n * and then renders as a 0×0 `<img>`: a silent hole where the brand should\n * be, with nothing in the console and nothing in `plan` output. The split\n * designs are the worst case, because their `.zl-split__placeholder` is\n * keyed on *no asset being configured*, so a configured-but-dead asset\n * leaves the whole brand pane blank.\n *\n * The templates cannot fix this themselves. They go through DOMPurify\n * (`sanitiser.ts`), which strips `onerror` along with every other inline\n * handler, so the recovery has to be orchestrator-side: arm a real `error`\n * listener on each rendered image after every commit, hide what fails, and\n * put the placeholder back when that empties a brand pane.\n */\n\n/** Marks an image whose `error` listener is already attached. */\nconst ARMED_ATTR = \"data-zl-asset-armed\";\n\n/** Marks an image that failed to load; `layout-chrome.css` hides it. */\nconst BROKEN_ATTR = \"data-zl-asset-broken\";\n\nconst BRAND_PANE_SELECTOR = \".zl-split__brand\";\nconst PLACEHOLDER_CLASS = \"zl-split__placeholder\";\nconst AUTHORED_FALLBACK_ATTR = \"data-zl-asset-fallback\";\nconst AUTHORED_FALLBACK_CONTENT_ATTR = \"data-zl-asset-fallback-content\";\n\n/**\n * Arm every not-yet-armed `<img>` under `root`, and repair anything already\n * broken. Idempotent: safe to call on every Lit commit, since `unsafeHTML`\n * only re-parses when the rendered string actually changes and re-parsed\n * nodes arrive without the marker attribute.\n */\nexport function armAssetFallbacks(root: ParentNode): void {\n  let repairNeeded = false;\n\n  for (const img of root.querySelectorAll(\"img\")) {\n    if (img.hasAttribute(ARMED_ATTR)) {\n      continue;\n    }\n    img.setAttribute(ARMED_ATTR, \"\");\n\n    // An image that finished loading before we got here reports its verdict\n    // through `complete` + `naturalWidth`, not through an event we can still\n    // catch — the error already fired.\n    if (img.getAttribute(\"src\") && img.complete && img.naturalWidth === 0) {\n      markBroken(img);\n      repairNeeded = true;\n      continue;\n    }\n    img.addEventListener(\n      \"error\",\n      () => {\n        markBroken(img);\n        repairBrandPanes(root);\n      },\n      { once: true },\n    );\n  }\n\n  if (repairNeeded) {\n    repairBrandPanes(root);\n  }\n}\n\nfunction markBroken(img: HTMLImageElement): void {\n  img.setAttribute(BROKEN_ATTR, \"\");\n  revealAuthoredFallback(img);\n  // The failure is invisible by construction — say so once, out loud.\n  console.warn(\n    `[zitadel-login] branding asset failed to load, hiding it: ${img.getAttribute(\"src\") ?? \"\"}`,\n  );\n}\n\n/**\n * Some shipped templates have a richer no-asset branch than the generic split\n * placeholder (the hero design's brand mark and compact text). They render that\n * branch hidden beside the image and opt in with data attributes, so the\n * orchestrator can reveal the exact authored fallback without knowing template\n * copy or structure.\n */\nfunction revealAuthoredFallback(img: HTMLImageElement): void {\n  if (!img.hasAttribute(AUTHORED_FALLBACK_ATTR)) {\n    return;\n  }\n  const fallback = img.nextElementSibling;\n  if (fallback?.hasAttribute(AUTHORED_FALLBACK_CONTENT_ATTR)) {\n    fallback.removeAttribute(\"hidden\");\n  }\n}\n\n/**\n * Restore `.zl-split__placeholder` in any split brand pane whose only content\n * was assets that all failed. Deliberately narrow: a pane is only repaired\n * when it actually holds a broken image, so a pane an author left empty on\n * purpose — or a hero design whose landing copy still renders — is never\n * given decoration it did not ask for.\n */\nfunction repairBrandPanes(root: ParentNode): void {\n  for (const pane of root.querySelectorAll(BRAND_PANE_SELECTOR)) {\n    if (pane.querySelector(`.${PLACEHOLDER_CLASS}`)) {\n      continue;\n    }\n    const children = Array.from(pane.children);\n    if (!children.some(isBrokenImage)) {\n      continue;\n    }\n    if (children.some((child) => !isBrokenImage(child))) {\n      continue;\n    }\n    const placeholder = pane.ownerDocument.createElement(\"div\");\n    placeholder.className = PLACEHOLDER_CLASS;\n    placeholder.setAttribute(\"aria-hidden\", \"true\");\n    pane.append(placeholder);\n  }\n}\n\nfunction isBrokenImage(node: Element): boolean {\n  return node.tagName === \"IMG\" && node.hasAttribute(BROKEN_ATTR);\n}\n","//#region src/generated/model/createAuthAttempt201ChallengesItemMethod.ts\nconst CreateAuthAttempt201ChallengesItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201ChallengesItemState.ts\nconst CreateAuthAttempt201ChallengesItemState = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201CompletedFactorsItemMethod.ts\nconst CreateAuthAttempt201CompletedFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201RequiredFactorsItem.ts\nconst CreateAuthAttempt201RequiredFactorsItem = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createAuthAttempt201State.ts\nconst CreateAuthAttempt201State = {\n\tin_progress: \"in_progress\",\n\tcompleted: \"completed\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/createBranding201BrandingLayout.ts\nconst CreateBranding201BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/createBrandingBodyLayout.ts\nconst CreateBrandingBodyLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/createFlow201BrandingLayout.ts\nconst CreateFlow201BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepActionsItemKind.ts\nconst CreateFlow201StepActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepChallengeMethod.ts\nconst CreateFlow201StepChallengeMethod = {\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepComplete.ts\nconst CreateFlow201StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepFieldsItemType.ts\nconst CreateFlow201StepFieldsItemType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\",\n\tcheckbox: \"checkbox\",\n\tselect: \"select\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepFieldsItemValidationFormat.ts\nconst CreateFlow201StepFieldsItemValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/createFlow201StepGatesKind.ts\nconst CreateFlow201StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/createFlowBodyPurpose.ts\nconst CreateFlowBodyPurpose = {\n\tlogin: \"login\",\n\tregister: \"register\",\n\trecovery: \"recovery\",\n\tprofiling: \"profiling\",\n\treauth: \"reauth\",\n\tlink_account: \"link_account\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinition201FlowDefinitionStatus.ts\nconst CreateFlowDefinition201FlowDefinitionStatus = {\n\tactive: \"active\",\n\tdraft: \"draft\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActionsItemKind.ts\nconst CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemComplete.ts\nconst CreateFlowDefinition201FlowDefinitionStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGatesKind.ts\nconst CreateFlowDefinition201FlowDefinitionStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemOnSuccess.ts\nconst CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStatus.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStatus = {\n\tactive: \"active\",\n\tdraft: \"draft\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.ts\nconst CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/createGrant201ObjectType.ts\nconst CreateGrant201ObjectType = { project: \"project\" };\n//#endregion\n//#region src/generated/model/createGrant201PrincipalType.ts\nconst CreateGrant201PrincipalType = {\n\tuser: \"user\",\n\tteam: \"team\"\n};\n//#endregion\n//#region src/generated/model/createGrant201Relation.ts\nconst CreateGrant201Relation = {\n\tviewer: \"viewer\",\n\teditor: \"editor\",\n\tadmin: \"admin\"\n};\n//#endregion\n//#region src/generated/model/createGrantBodyPrincipalType.ts\nconst CreateGrantBodyPrincipalType = {\n\tuser: \"user\",\n\tteam: \"team\"\n};\n//#endregion\n//#region src/generated/model/createGrantBodyRelation.ts\nconst CreateGrantBodyRelation = {\n\tviewer: \"viewer\",\n\teditor: \"editor\",\n\tadmin: \"admin\"\n};\n//#endregion\n//#region src/generated/model/createRelease200PointersItemKind.ts\nconst CreateRelease200PointersItemKind = {\n\tschema: \"schema\",\n\tflow_definition: \"flow_definition\",\n\tbranding: \"branding\"\n};\n//#endregion\n//#region src/generated/model/createRelease201PointersItemKind.ts\nconst CreateRelease201PointersItemKind = {\n\tschema: \"schema\",\n\tflow_definition: \"flow_definition\",\n\tbranding: \"branding\"\n};\n//#endregion\n//#region src/generated/model/createReleaseBodyPointersItemKind.ts\nconst CreateReleaseBodyPointersItemKind = {\n\tschema: \"schema\",\n\tflow_definition: \"flow_definition\",\n\tbranding: \"branding\"\n};\n//#endregion\n//#region src/generated/model/createSession201SessionFactorsItemMethod.ts\nconst CreateSession201SessionFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/createSession201SessionState.ts\nconst CreateSession201SessionState = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/createTeam201Status.ts\nconst CreateTeam201Status = {\n\tactive: \"active\",\n\tdeactivated: \"deactivated\"\n};\n//#endregion\n//#region src/generated/model/createUser201MetadataStatus.ts\nconst CreateUser201MetadataStatus = {\n\tactive: \"active\",\n\tsuspended: \"suspended\",\n\tdeactivated: \"deactivated\",\n\tpending_purge: \"pending_purge\"\n};\n//#endregion\n//#region src/generated/model/createUser201TeamsItemMembershipStatus.ts\nconst CreateUser201TeamsItemMembershipStatus = {\n\tpending: \"pending\",\n\tactive: \"active\",\n\tinactive: \"inactive\"\n};\n//#endregion\n//#region src/generated/model/exchangeHandoff200SessionFactorsItemMethod.ts\nconst ExchangeHandoff200SessionFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/exchangeHandoff200SessionState.ts\nconst ExchangeHandoff200SessionState = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200ChallengesItemMethod.ts\nconst GetAuthAttempt200ChallengesItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200ChallengesItemState.ts\nconst GetAuthAttempt200ChallengesItemState = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200CompletedFactorsItemMethod.ts\nconst GetAuthAttempt200CompletedFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200RequiredFactorsItem.ts\nconst GetAuthAttempt200RequiredFactorsItem = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getAuthAttempt200State.ts\nconst GetAuthAttempt200State = {\n\tin_progress: \"in_progress\",\n\tcompleted: \"completed\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/getBrandingById200BrandingLayout.ts\nconst GetBrandingById200BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/getFlowDefinition200FlowDefinitionStatus.ts\nconst GetFlowDefinition200FlowDefinitionStatus = {\n\tactive: \"active\",\n\tdraft: \"draft\"\n};\n//#endregion\n//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActionsItemKind.ts\nconst GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemComplete.ts\nconst GetFlowDefinition200FlowDefinitionStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGatesKind.ts\nconst GetFlowDefinition200FlowDefinitionStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemOnSuccess.ts\nconst GetFlowDefinition200FlowDefinitionStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/getFlowStep200BrandingLayout.ts\nconst GetFlowStep200BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepActionsItemKind.ts\nconst GetFlowStep200StepActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepChallengeMethod.ts\nconst GetFlowStep200StepChallengeMethod = {\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepComplete.ts\nconst GetFlowStep200StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepFieldsItemType.ts\nconst GetFlowStep200StepFieldsItemType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\",\n\tcheckbox: \"checkbox\",\n\tselect: \"select\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepFieldsItemValidationFormat.ts\nconst GetFlowStep200StepFieldsItemValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/getFlowStep200StepGatesKind.ts\nconst GetFlowStep200StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/getGrant200ObjectType.ts\nconst GetGrant200ObjectType = { project: \"project\" };\n//#endregion\n//#region src/generated/model/getGrant200PrincipalType.ts\nconst GetGrant200PrincipalType = {\n\tuser: \"user\",\n\tteam: \"team\"\n};\n//#endregion\n//#region src/generated/model/getGrant200Relation.ts\nconst GetGrant200Relation = {\n\tviewer: \"viewer\",\n\teditor: \"editor\",\n\tadmin: \"admin\"\n};\n//#endregion\n//#region src/generated/model/getMySession200FactorsItemMethod.ts\nconst GetMySession200FactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getMySession200State.ts\nconst GetMySession200State = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/getMyUser200MetadataStatus.ts\nconst GetMyUser200MetadataStatus = {\n\tactive: \"active\",\n\tsuspended: \"suspended\",\n\tdeactivated: \"deactivated\",\n\tpending_purge: \"pending_purge\"\n};\n//#endregion\n//#region src/generated/model/getMyUser200TeamsItemMembershipStatus.ts\nconst GetMyUser200TeamsItemMembershipStatus = {\n\tpending: \"pending\",\n\tactive: \"active\",\n\tinactive: \"inactive\"\n};\n//#endregion\n//#region src/generated/model/getReleaseById200PointersItemKind.ts\nconst GetReleaseById200PointersItemKind = {\n\tschema: \"schema\",\n\tflow_definition: \"flow_definition\",\n\tbranding: \"branding\"\n};\n//#endregion\n//#region src/generated/model/getSession200FactorsItemMethod.ts\nconst GetSession200FactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/getSession200State.ts\nconst GetSession200State = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/getTeam200Status.ts\nconst GetTeam200Status = {\n\tactive: \"active\",\n\tdeactivated: \"deactivated\"\n};\n//#endregion\n//#region src/generated/model/getUserByID200MetadataStatus.ts\nconst GetUserByID200MetadataStatus = {\n\tactive: \"active\",\n\tsuspended: \"suspended\",\n\tdeactivated: \"deactivated\",\n\tpending_purge: \"pending_purge\"\n};\n//#endregion\n//#region src/generated/model/getUserByID200TeamsItemMembershipStatus.ts\nconst GetUserByID200TeamsItemMembershipStatus = {\n\tpending: \"pending\",\n\tactive: \"active\",\n\tinactive: \"inactive\"\n};\n//#endregion\n//#region src/generated/model/issueChallenge201Method.ts\nconst IssueChallenge201Method = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/issueChallenge201State.ts\nconst IssueChallenge201State = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/issueChallengeBodyMethod.ts\nconst IssueChallengeBodyMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/issueChallengeBodyPasskeyOptionsUserVerification.ts\nconst IssueChallengeBodyPasskeyOptionsUserVerification = {\n\trequired: \"required\",\n\tpreferred: \"preferred\",\n\tdiscouraged: \"discouraged\"\n};\n//#endregion\n//#region src/generated/model/listEventsCategoryItem.ts\nconst ListEventsCategoryItem = {\n\trequest: \"request\",\n\tauth: \"auth\",\n\tsession: \"session\",\n\tadmin: \"admin\",\n\tentity: \"entity\",\n\tsignal: \"signal\"\n};\n//#endregion\n//#region src/generated/model/listEventsOrder.ts\nconst ListEventsOrder = {\n\tasc: \"asc\",\n\tdesc: \"desc\"\n};\n//#endregion\n//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemFlowDefinitionStatus.ts\nconst ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStatus = {\n\tactive: \"active\",\n\tdraft: \"draft\"\n};\n//#endregion\n//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemActionsItemKind.ts\nconst ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemComplete.ts\nconst ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemGatesKind.ts\nconst ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemOnSuccess.ts\nconst ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/listFlowDefinitionsExpandItem.ts\nconst ListFlowDefinitionsExpandItem = { user_schema: \"user_schema\" };\n//#endregion\n//#region src/generated/model/listFlowDefinitionsPurpose.ts\nconst ListFlowDefinitionsPurpose = {\n\tlogin: \"login\",\n\tregister: \"register\",\n\trecovery: \"recovery\",\n\tprofiling: \"profiling\",\n\treauth: \"reauth\",\n\tlink_account: \"link_account\"\n};\n//#endregion\n//#region src/generated/model/listSchemasKind.ts\nconst ListSchemasKind = { \"user-schema\": \"user-schema\" };\n//#endregion\n//#region src/generated/model/listSchemasRevisions.ts\nconst ListSchemasRevisions = {\n\tall: \"all\",\n\tlatest: \"latest\"\n};\n//#endregion\n//#region src/generated/model/listUserTeams200TeamsItemMembershipStatus.ts\nconst ListUserTeams200TeamsItemMembershipStatus = {\n\tpending: \"pending\",\n\tactive: \"active\",\n\tinactive: \"inactive\"\n};\n//#endregion\n//#region src/generated/model/queryProjectsBodyFilterItemField.ts\nconst QueryProjectsBodyFilterItemField = { created_at: \"created_at\" };\n//#endregion\n//#region src/generated/model/queryProjectsBodyFilterItemOperation.ts\nconst QueryProjectsBodyFilterItemOperation = {\n\tequals: \"equals\",\n\tnot_equals: \"not_equals\",\n\tcontains: \"contains\",\n\tnot_contains: \"not_contains\",\n\tless_than: \"less_than\",\n\tless_than_or_equal: \"less_than_or_equal\",\n\tgreater_than: \"greater_than\",\n\tgreater_than_or_equal: \"greater_than_or_equal\"\n};\n//#endregion\n//#region src/generated/model/queryProjectsBodySortingDirection.ts\nconst QueryProjectsBodySortingDirection = {\n\tasc: \"asc\",\n\tdesc: \"desc\"\n};\n//#endregion\n//#region src/generated/model/queryProjectsBodySortingField.ts\nconst QueryProjectsBodySortingField = { created_at: \"created_at\" };\n//#endregion\n//#region src/generated/model/querySessions200SessionsItemFactorsItemMethod.ts\nconst QuerySessions200SessionsItemFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/querySessions200SessionsItemState.ts\nconst QuerySessions200SessionsItemState = {\n\tbuilding: \"building\",\n\tactive: \"active\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/querySessionsBodyFilterItemField.ts\nconst QuerySessionsBodyFilterItemField = {\n\tcreated_at: \"created_at\",\n\tuser_id: \"user_id\",\n\tstate: \"state\",\n\tlifecycle_owner_team_id: \"lifecycle_owner_team_id\"\n};\n//#endregion\n//#region src/generated/model/querySessionsBodyFilterItemOperation.ts\nconst QuerySessionsBodyFilterItemOperation = {\n\tequals: \"equals\",\n\tnot_equals: \"not_equals\",\n\tcontains: \"contains\",\n\tnot_contains: \"not_contains\",\n\tless_than: \"less_than\",\n\tless_than_or_equal: \"less_than_or_equal\",\n\tgreater_than: \"greater_than\",\n\tgreater_than_or_equal: \"greater_than_or_equal\"\n};\n//#endregion\n//#region src/generated/model/querySessionsBodySortingDirection.ts\nconst QuerySessionsBodySortingDirection = {\n\tasc: \"asc\",\n\tdesc: \"desc\"\n};\n//#endregion\n//#region src/generated/model/querySessionsBodySortingField.ts\nconst QuerySessionsBodySortingField = {\n\tcreated_at: \"created_at\",\n\tuser_id: \"user_id\"\n};\n//#endregion\n//#region src/generated/model/queryTeams200TeamsItemStatus.ts\nconst QueryTeams200TeamsItemStatus = {\n\tactive: \"active\",\n\tdeactivated: \"deactivated\"\n};\n//#endregion\n//#region src/generated/model/queryTeamsBodyFilterItemField.ts\nconst QueryTeamsBodyFilterItemField = {\n\tcreated_at: \"created_at\",\n\tname: \"name\",\n\tstatus: \"status\"\n};\n//#endregion\n//#region src/generated/model/queryTeamsBodyFilterItemOperation.ts\nconst QueryTeamsBodyFilterItemOperation = {\n\tequals: \"equals\",\n\tnot_equals: \"not_equals\",\n\tcontains: \"contains\",\n\tnot_contains: \"not_contains\",\n\tless_than: \"less_than\",\n\tless_than_or_equal: \"less_than_or_equal\",\n\tgreater_than: \"greater_than\",\n\tgreater_than_or_equal: \"greater_than_or_equal\"\n};\n//#endregion\n//#region src/generated/model/queryTeamsBodySortingDirection.ts\nconst QueryTeamsBodySortingDirection = {\n\tasc: \"asc\",\n\tdesc: \"desc\"\n};\n//#endregion\n//#region src/generated/model/queryTeamsBodySortingField.ts\nconst QueryTeamsBodySortingField = {\n\tcreated_at: \"created_at\",\n\tname: \"name\",\n\tstatus: \"status\"\n};\n//#endregion\n//#region src/generated/model/queryUsers200UsersItemMetadataStatus.ts\nconst QueryUsers200UsersItemMetadataStatus = {\n\tactive: \"active\",\n\tsuspended: \"suspended\",\n\tdeactivated: \"deactivated\",\n\tpending_purge: \"pending_purge\"\n};\n//#endregion\n//#region src/generated/model/queryUsers200UsersItemTeamsItemMembershipStatus.ts\nconst QueryUsers200UsersItemTeamsItemMembershipStatus = {\n\tpending: \"pending\",\n\tactive: \"active\",\n\tinactive: \"inactive\"\n};\n//#endregion\n//#region src/generated/model/queryUsersBodyExpandItem.ts\nconst QueryUsersBodyExpandItem = {\n\tteams: \"teams\",\n\tlifecycle_owner_team: \"lifecycle_owner_team\"\n};\n//#endregion\n//#region src/generated/model/queryUsersBodyFilterItemField.ts\nconst QueryUsersBodyFilterItemField = {\n\tcreated_at: \"created_at\",\n\tid: \"id\",\n\tschema: \"schema\",\n\tstatus: \"status\",\n\tteam_id: \"team_id\",\n\tlifecycle_owner_team_id: \"lifecycle_owner_team_id\"\n};\n//#endregion\n//#region src/generated/model/queryUsersBodyFilterItemOperation.ts\nconst QueryUsersBodyFilterItemOperation = {\n\tequals: \"equals\",\n\tnot_equals: \"not_equals\",\n\tcontains: \"contains\",\n\tnot_contains: \"not_contains\",\n\tless_than: \"less_than\",\n\tless_than_or_equal: \"less_than_or_equal\",\n\tgreater_than: \"greater_than\",\n\tgreater_than_or_equal: \"greater_than_or_equal\"\n};\n//#endregion\n//#region src/generated/model/queryUsersBodySortingDirection.ts\nconst QueryUsersBodySortingDirection = {\n\tasc: \"asc\",\n\tdesc: \"desc\"\n};\n//#endregion\n//#region src/generated/model/queryUsersBodySortingField.ts\nconst QueryUsersBodySortingField = {\n\tcreated_at: \"created_at\",\n\tid: \"id\",\n\tschema: \"schema\",\n\tstatus: \"status\",\n\tlifecycle_owner_team_id: \"lifecycle_owner_team_id\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200BrandingLayout.ts\nconst SubmitFlowStep200BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepActionsItemKind.ts\nconst SubmitFlowStep200StepActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepChallengeMethod.ts\nconst SubmitFlowStep200StepChallengeMethod = {\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepComplete.ts\nconst SubmitFlowStep200StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepFieldsItemType.ts\nconst SubmitFlowStep200StepFieldsItemType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\",\n\tcheckbox: \"checkbox\",\n\tselect: \"select\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepFieldsItemValidationFormat.ts\nconst SubmitFlowStep200StepFieldsItemValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep200StepGatesKind.ts\nconst SubmitFlowStep200StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/submitFlowStep400BrandingLayout.ts\nconst SubmitFlowStep400BrandingLayout = {\n\tcentered: \"centered\",\n\tsplit: \"split\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepActionsItemKind.ts\nconst SubmitFlowStep400StepActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepChallengeMethod.ts\nconst SubmitFlowStep400StepChallengeMethod = {\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepComplete.ts\nconst SubmitFlowStep400StepComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepFieldsItemType.ts\nconst SubmitFlowStep400StepFieldsItemType = {\n\ttext: \"text\",\n\temail: \"email\",\n\tpassword: \"password\",\n\ttel: \"tel\",\n\tnumber: \"number\",\n\turl: \"url\",\n\tdate: \"date\",\n\thidden: \"hidden\",\n\tcheckbox: \"checkbox\",\n\tselect: \"select\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepFieldsItemValidationFormat.ts\nconst SubmitFlowStep400StepFieldsItemValidationFormat = {\n\temail: \"email\",\n\t\"date-time\": \"date-time\",\n\tuuid: \"uuid\",\n\turi: \"uri\"\n};\n//#endregion\n//#region src/generated/model/submitFlowStep400StepGatesKind.ts\nconst SubmitFlowStep400StepGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/updateFlowDefinition200FlowDefinitionStatus.ts\nconst UpdateFlowDefinition200FlowDefinitionStatus = {\n\tactive: \"active\",\n\tdraft: \"draft\"\n};\n//#endregion\n//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActionsItemKind.ts\nconst UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemComplete.ts\nconst UpdateFlowDefinition200FlowDefinitionStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGatesKind.ts\nconst UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemOnSuccess.ts\nconst UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStatus.ts\nconst UpdateFlowDefinitionBodyFlowDefinitionStatus = {\n\tactive: \"active\",\n\tdraft: \"draft\"\n};\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind.ts\nconst UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind = {\n\tsubmit: \"submit\",\n\tpasskey: \"passkey\",\n\tpasskey_register: \"passkey_register\",\n\tnavigate: \"navigate\",\n\tback: \"back\"\n};\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemComplete.ts\nconst UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete = {\n\tredirect: \"redirect\",\n\tshow: \"show\"\n};\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.ts\nconst UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = { captcha: \"captcha\" };\n//#endregion\n//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.ts\nconst UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = { create_user: \"create_user\" };\n//#endregion\n//#region src/generated/model/updateTeam200Status.ts\nconst UpdateTeam200Status = {\n\tactive: \"active\",\n\tdeactivated: \"deactivated\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.ts\nconst VerifyChallengeProof200ChallengesItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200ChallengesItemState.ts\nconst VerifyChallengeProof200ChallengesItemState = {\n\tpending: \"pending\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200CompletedFactorsItemMethod.ts\nconst VerifyChallengeProof200CompletedFactorsItemMethod = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200RequiredFactorsItem.ts\nconst VerifyChallengeProof200RequiredFactorsItem = {\n\tidentifier: \"identifier\",\n\tpassword: \"password\",\n\tpasskey: \"passkey\"\n};\n//#endregion\n//#region src/generated/model/verifyChallengeProof200State.ts\nconst VerifyChallengeProof200State = {\n\tin_progress: \"in_progress\",\n\tcompleted: \"completed\",\n\tfailed: \"failed\",\n\texpired: \"expired\"\n};\n//#endregion\nexport { CreateAuthAttempt201ChallengesItemMethod, CreateAuthAttempt201ChallengesItemState, CreateAuthAttempt201CompletedFactorsItemMethod, CreateAuthAttempt201RequiredFactorsItem, CreateAuthAttempt201State, CreateBranding201BrandingLayout, CreateBrandingBodyLayout, CreateFlow201BrandingLayout, CreateFlow201StepActionsItemKind, CreateFlow201StepChallengeMethod, CreateFlow201StepComplete, CreateFlow201StepFieldsItemType, CreateFlow201StepFieldsItemValidationFormat, CreateFlow201StepGatesKind, CreateFlowBodyPurpose, CreateFlowDefinition201FlowDefinitionStatus, CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind, CreateFlowDefinition201FlowDefinitionStepsItemComplete, CreateFlowDefinition201FlowDefinitionStepsItemGatesKind, CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess, CreateFlowDefinitionBodyFlowDefinitionStatus, CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess, CreateGrant201ObjectType, CreateGrant201PrincipalType, CreateGrant201Relation, CreateGrantBodyPrincipalType, CreateGrantBodyRelation, CreateRelease200PointersItemKind, CreateRelease201PointersItemKind, CreateReleaseBodyPointersItemKind, CreateSession201SessionFactorsItemMethod, CreateSession201SessionState, CreateTeam201Status, CreateUser201MetadataStatus, CreateUser201TeamsItemMembershipStatus, ExchangeHandoff200SessionFactorsItemMethod, ExchangeHandoff200SessionState, GetAuthAttempt200ChallengesItemMethod, GetAuthAttempt200ChallengesItemState, GetAuthAttempt200CompletedFactorsItemMethod, GetAuthAttempt200RequiredFactorsItem, GetAuthAttempt200State, GetBrandingById200BrandingLayout, GetFlowDefinition200FlowDefinitionStatus, GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind, GetFlowDefinition200FlowDefinitionStepsItemComplete, GetFlowDefinition200FlowDefinitionStepsItemGatesKind, GetFlowDefinition200FlowDefinitionStepsItemOnSuccess, GetFlowStep200BrandingLayout, GetFlowStep200StepActionsItemKind, GetFlowStep200StepChallengeMethod, GetFlowStep200StepComplete, GetFlowStep200StepFieldsItemType, GetFlowStep200StepFieldsItemValidationFormat, GetFlowStep200StepGatesKind, GetGrant200ObjectType, GetGrant200PrincipalType, GetGrant200Relation, GetMySession200FactorsItemMethod, GetMySession200State, GetMyUser200MetadataStatus, GetMyUser200TeamsItemMembershipStatus, GetReleaseById200PointersItemKind, GetSession200FactorsItemMethod, GetSession200State, GetTeam200Status, GetUserByID200MetadataStatus, GetUserByID200TeamsItemMembershipStatus, IssueChallenge201Method, IssueChallenge201State, IssueChallengeBodyMethod, IssueChallengeBodyPasskeyOptionsUserVerification, ListEventsCategoryItem, ListEventsOrder, ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStatus, ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemActionsItemKind, ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemComplete, ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemGatesKind, ListFlowDefinitions200FlowDefinitionsItemFlowDefinitionStepsItemOnSuccess, ListFlowDefinitionsExpandItem, ListFlowDefinitionsPurpose, ListSchemasKind, ListSchemasRevisions, ListUserTeams200TeamsItemMembershipStatus, QueryProjectsBodyFilterItemField, QueryProjectsBodyFilterItemOperation, QueryProjectsBodySortingDirection, QueryProjectsBodySortingField, QuerySessions200SessionsItemFactorsItemMethod, QuerySessions200SessionsItemState, QuerySessionsBodyFilterItemField, QuerySessionsBodyFilterItemOperation, QuerySessionsBodySortingDirection, QuerySessionsBodySortingField, QueryTeams200TeamsItemStatus, QueryTeamsBodyFilterItemField, QueryTeamsBodyFilterItemOperation, QueryTeamsBodySortingDirection, QueryTeamsBodySortingField, QueryUsers200UsersItemMetadataStatus, QueryUsers200UsersItemTeamsItemMembershipStatus, QueryUsersBodyExpandItem, QueryUsersBodyFilterItemField, QueryUsersBodyFilterItemOperation, QueryUsersBodySortingDirection, QueryUsersBodySortingField, SubmitFlowStep200BrandingLayout, SubmitFlowStep200StepActionsItemKind, SubmitFlowStep200StepChallengeMethod, SubmitFlowStep200StepComplete, SubmitFlowStep200StepFieldsItemType, SubmitFlowStep200StepFieldsItemValidationFormat, SubmitFlowStep200StepGatesKind, SubmitFlowStep400BrandingLayout, SubmitFlowStep400StepActionsItemKind, SubmitFlowStep400StepChallengeMethod, SubmitFlowStep400StepComplete, SubmitFlowStep400StepFieldsItemType, SubmitFlowStep400StepFieldsItemValidationFormat, SubmitFlowStep400StepGatesKind, UpdateFlowDefinition200FlowDefinitionStatus, UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind, UpdateFlowDefinition200FlowDefinitionStepsItemComplete, UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind, UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess, UpdateFlowDefinitionBodyFlowDefinitionStatus, UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind, UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete, UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind, UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess, UpdateTeam200Status, VerifyChallengeProof200ChallengesItemMethod, VerifyChallengeProof200ChallengesItemState, VerifyChallengeProof200CompletedFactorsItemMethod, VerifyChallengeProof200RequiredFactorsItem, VerifyChallengeProof200State };\n\n//# sourceMappingURL=index.mjs.map","/**\n * Lightweight paint-time validator for `Branding` payloads.\n *\n * Per `docs/design/branding/schema.md` §Shape invariants:\n *\n * 1. Every referenced URL is https, except logo/hero assets may use canonical\n *    loopback HTTP while the component itself renders on a loopback HTTP\n *    origin.\n * 2. `layout` is in the documented enum.\n * 3. `liquid_template` shape checks happen elsewhere (security pipeline runs\n *    server-side; structural validator is deferred until the full atom set\n *    lands).\n *\n * Failures are non-fatal: we collect issues, log a dev-build warning, and\n * return a sanitised payload with the offending fields stripped (set to\n * `undefined`) so the orchestrator falls back to the bundled defaults.\n */\nimport { CreateFlow201BrandingLayout } from \"@zitadel/api/generated/model\";\nimport { isCanonicalLoopbackHttpUrl } from \"@zitadel/config/branding-url\";\n\nimport type { Branding } from \"./branding.js\";\n\nconst VALID_LAYOUTS = new Set<string>(Object.values(CreateFlow201BrandingLayout));\n\nexport type BrandingValidationResult = {\n  branding: Branding | undefined;\n  issues: readonly string[];\n};\n\nexport type BrandingValidationContext = {\n  /** Origin of the document that will paint the branding payload. */\n  renderingOrigin?: string;\n};\n\nexport function validateBranding(\n  input: Branding | undefined,\n  context: BrandingValidationContext = {},\n): BrandingValidationResult {\n  if (!input) {\n    return { branding: undefined, issues: [] };\n  }\n\n  const issues: string[] = [];\n  const out: Branding = { ...input };\n  const allowLoopbackHttp =\n    context.renderingOrigin !== undefined && isCanonicalLoopbackHttpUrl(context.renderingOrigin);\n\n  if (out.layout && !VALID_LAYOUTS.has(out.layout)) {\n    issues.push(`Unknown layout \"${out.layout}\" — falling back to \"centered\".`);\n    out.layout = CreateFlow201BrandingLayout.centered;\n  }\n\n  out.logo_url = sanitiseUrl(out.logo_url, \"logo_url\", issues, { allowed: allowLoopbackHttp });\n  out.font_url = sanitiseUrl(out.font_url, \"font_url\", issues);\n  out.hero_url = sanitiseUrl(out.hero_url, \"hero_url\", issues, { allowed: allowLoopbackHttp });\n  if (out.assets) {\n    out.assets = {\n      logo_dark: sanitiseUrl(out.assets.logo_dark, \"assets.logo_dark\", issues),\n      favicon: sanitiseUrl(out.assets.favicon, \"assets.favicon\", issues),\n      background_image: sanitiseUrl(out.assets.background_image, \"assets.background_image\", issues),\n    };\n  }\n\n  return { branding: out, issues };\n}\n\nfunction sanitiseUrl(\n  value: string | undefined,\n  field: string,\n  issues: string[],\n  loopbackHttp?: { allowed: boolean },\n): string | undefined {\n  if (value == null || value === \"\") {\n    return undefined;\n  }\n  try {\n    const parsed = new URL(value);\n    // Only logo/hero URLs opt into this policy, and only while the containing\n    // page is itself on loopback. That keeps a persisted development URL from\n    // making a public login page request resources from each visitor's device.\n    if (parsed.protocol === \"http:\" && loopbackHttp?.allowed && isCanonicalLoopbackHttpUrl(value)) {\n      return parsed.toString();\n    }\n    if (parsed.protocol !== \"https:\") {\n      const loopbackHint = loopbackHttp\n        ? \"; canonical loopback http is allowed only on loopback development pages\"\n        : \"\";\n      issues.push(`${field} must use https (got \"${parsed.protocol}\"${loopbackHint}) — dropped.`);\n      return undefined;\n    }\n    return parsed.toString();\n  } catch {\n    issues.push(`${field} is not a valid URL — dropped.`);\n    return undefined;\n  }\n}\n","/**\n * Forwards atom-internal CSS Shadow Parts through the orchestrator boundary.\n *\n * Atoms stamp `part=\"...\"` on their internals and declare the public set in\n * their manifest (`parts`). Those parts are visible one shadow boundary up —\n * inside the orchestrator's shadow root — but not to the embedding page,\n * because `::part()` pierces a single boundary unless each host in the chain\n * re-exports (`exportparts`). Templates never author the forwarding (the\n * sanitiser strips `exportparts`); the orchestrator stamps it after every\n * render commit so the mapping stays canonical for template-rendered and\n * gate-patched atoms alike.\n *\n * Exported names are mechanical, collision-free, and public contract\n * (override-ladder Tier 2, same stability rules as token names):\n * `<atom>-<part>` with the `zl-` prefix dropped — `zl-field`'s `input` part\n * becomes `zitadel-login::part(field-input)` on the host page. Manifests are\n * the canonical part catalogue; this module derives, never curates.\n */\nimport { manifestRegistry } from \"../manifests.js\";\n\nconst exportpartsByTag: ReadonlyMap<string, string> = new Map(\n  manifestRegistry\n    .filter((manifest) => manifest.parts.length > 0)\n    .map((manifest) => {\n      const short = manifest.tag.replace(/^zl-/, \"\");\n      const value = manifest.parts.map((part) => `${part}: ${short}-${part}`).join(\", \");\n      return [manifest.tag, value] as const;\n    }),\n);\n\n/** The `exportparts` value an atom tag gets, or `undefined` for part-less atoms. */\nexport function exportpartsFor(tag: string): string | undefined {\n  return exportpartsByTag.get(tag);\n}\n\n/**\n * Stamps `exportparts` onto every known atom in `scope`. Idempotent — call\n * after each render commit: `unsafeHTML` re-parses replace previously\n * stamped nodes, and the mandatory-gates patcher appends atoms after\n * sanitisation.\n */\nexport function stampExportparts(scope: ParentNode): void {\n  for (const [tag, value] of exportpartsByTag) {\n    for (const el of scope.querySelectorAll(tag)) {\n      if (el.getAttribute(\"exportparts\") !== value) {\n        el.setAttribute(\"exportparts\", value);\n      }\n    }\n  }\n}\n","/**\n * `{% mandatory_gates %}` runtime patcher.\n *\n * Per `docs/design/branding/validator.md` §Runtime safety net:\n *\n *   \"After the template finishes rendering, the tag inspects the produced DOM\n *    and appends:\n *      - Any required `fields[*]` without a matching `<zl-field>`.\n *      - Any required `gates[*]` without a matching consumer.\n *      - A primary `<zl-button type=\"submit\">` if none was reached.\"\n *\n * Implementation: the LiquidJS `{% mandatory_gates %}` tag emits a unique\n * marker comment. After Liquid renders, this patcher parses the produced\n * HTML into a `<template>`, builds any missing atoms as real DOM elements,\n * replaces the marker with them, and serialises back to a string.\n *\n * Building elements via the DOM (`document.createElement` + `setAttribute`)\n * delegates HTML attribute escaping to the browser's serialiser — no manual\n * string-escaping in this module.\n */\nimport type { CreateFlow201Step } from \"@zitadel/api/generated/model\";\n\nimport type { Locale } from \"./locales/en.js\";\n\nexport const MANDATORY_GATES_MARKER = \"ZL_MANDATORY_GATES\";\n\n/** Every atom tag that participates as a named form field. */\nconst FIELD_ATOM_TAGS = \"zl-field, zl-select, zl-checkbox\";\n\nexport const mandatoryGatesMarkerComment = `<!--${MANDATORY_GATES_MARKER}-->`;\n\nexport function patchMandatoryGates(\n  html: string,\n  step: CreateFlow201Step,\n  locale: Locale,\n): string {\n  const template = document.createElement(\"template\");\n  template.innerHTML = html;\n  const fragment = template.content;\n\n  const additions = collectMissingAtoms(fragment, step, locale);\n  const marker = findMarkerComment(fragment);\n\n  if (marker?.parentNode) {\n    for (const node of additions) {\n      marker.parentNode.insertBefore(node, marker);\n    }\n    marker.remove();\n  } else {\n    for (const node of additions) {\n      fragment.appendChild(node);\n    }\n  }\n\n  return template.innerHTML;\n}\n\nfunction collectMissingAtoms(\n  fragment: DocumentFragment,\n  step: CreateFlow201Step,\n  locale: Locale,\n): Element[] {\n  const additions: Element[] = [];\n\n  if (step.fields) {\n    for (const field of step.fields) {\n      if (!field.required) continue;\n      if (hasFieldFor(fragment, field.name)) continue;\n      additions.push(buildField(field.name, field.text_key, field.type, locale, field.required));\n    }\n  }\n\n  if (step.actions && !hasPrimaryButton(fragment)) {\n    const primary = step.actions.find((action) => action.primary);\n    if (primary) {\n      additions.push(buildSubmit(primary.name, primary.text_key, locale));\n    }\n  }\n\n  return additions;\n}\n\nfunction hasPrimaryButton(fragment: DocumentFragment): boolean {\n  // CSS attribute selectors with quotes are fine for static values like\n  // \"primary\"; no escaping risk here.\n  return Boolean(fragment.querySelector('zl-button[hierarchy=\"primary\"]'));\n}\n\nfunction hasFieldFor(fragment: DocumentFragment, name: string): boolean {\n  // A field renders as one of several form-participating atoms depending on\n  // its type: <zl-field> (text/email/password), <zl-select> (enum), or\n  // <zl-checkbox> (boolean). Match on the shared `name` attribute across all\n  // of them — checking only <zl-field> made required <zl-select>/<zl-checkbox>\n  // fields look \"missing\", so the safety net appended a duplicate generic text\n  // field at the bottom of the form.\n  //\n  // We avoid a CSS attribute selector for `name` so we don't have to worry\n  // about escaping arbitrary characters in it (it comes from the step JSON);\n  // walking the small set of field-atom nodes is fine.\n  for (const field of fragment.querySelectorAll(FIELD_ATOM_TAGS)) {\n    if (field.getAttribute(\"name\") === name) return true;\n  }\n  return false;\n}\n\nfunction findMarkerComment(fragment: DocumentFragment): Comment | null {\n  const walker = (fragment.ownerDocument ?? document).createTreeWalker(\n    fragment,\n    NodeFilter.SHOW_COMMENT,\n  );\n  let node: Node | null = walker.nextNode();\n  while (node) {\n    if (node.nodeValue?.trim() === MANDATORY_GATES_MARKER) {\n      return node as Comment;\n    }\n    node = walker.nextNode();\n  }\n  return null;\n}\n\nfunction buildField(\n  name: string,\n  textKey: string | undefined,\n  type: string,\n  locale: Locale,\n  required: boolean,\n): Element {\n  const el = document.createElement(\"zl-field\");\n  el.setAttribute(\"name\", name);\n  el.setAttribute(\"label\", lookup(locale, textKey ?? name));\n  el.setAttribute(\"type\", type);\n  if (required) {\n    el.setAttribute(\"required\", \"\");\n  }\n  return el;\n}\n\nfunction buildSubmit(name: string, textKey: string | undefined, locale: Locale): Element {\n  const el = document.createElement(\"zl-button\");\n  el.setAttribute(\"hierarchy\", \"primary\");\n  el.setAttribute(\"size\", \"medium\");\n  el.setAttribute(\"type\", \"submit\");\n  el.setAttribute(\"block\", \"\");\n  el.setAttribute(\"action\", name);\n  el.setAttribute(\"label\", lookup(locale, textKey ?? \"submit.continue\"));\n  return el;\n}\n\nfunction lookup(locale: Locale, key: string): string {\n  return locale[key] ?? key;\n}\n","/**\n * LiquidJS engine factory for the `<zitadel-login>` orchestrator.\n *\n * Configures the engine per the security pipeline in\n * `docs/design/flowengine/template-security.md` and registers the\n * `| t` filter and `{% mandatory_gates %}` tag from\n * `docs/design/branding/templates.md`.\n *\n * Hard rules:\n *\n * - `{{ }}` output is HTML-escaped (LiquidJS default since v10).\n * - The `| raw` filter is overridden to a no-op string passthrough that still\n *   escapes (Layer 1 of the security pipeline).\n * - Partials are loaded from an in-memory map; no filesystem access.\n */\nimport { MANDATORY_GATES_TAG } from \"@zitadel/config/template\";\nimport { Liquid } from \"liquidjs\";\n\nimport type { FlowError } from \"./template-context.js\";\nimport type { Locale } from \"./locales/en.js\";\nimport { hookName } from \"../internal/hook-name.js\";\nimport { mandatoryGatesMarkerComment } from \"./mandatory-gates.js\";\nimport defaultTemplate from \"./templates/default.liquid\";\n\nexport const TEMPLATE_NAMES = {\n  default: \"default\",\n} as const;\n\nexport type CreateLiquidOptions = {\n  locale: Locale;\n  /**\n   * Additional in-memory templates merged on top of the bundled defaults.\n   * Useful for tests and for tenant-supplied `branding.liquid_template`\n   * (registered under {@link TEMPLATE_NAMES.default}).\n   */\n  templates?: Record<string, string>;\n};\n\n/**\n * Maps catalog `error.*` keys with no `_<rule>` suffix (so\n * {@link localiseFlowErrorKeys} can't derive the field from the key itself)\n * to their field name — the credential errors with bespoke catalog copy\n * (`error.email_exists`, `error.invalid_credentials`, …). Rule-suffixed keys\n * (`error.<field>_<rule>`) derive their field from the key. Consumed only by\n * {@link localiseFlowErrorKeys}, which stamps the resolved `field` onto the\n * error; the template filters (`fieldError` / `formLevelError`) then route by\n * that `field`, and an error whose field the step omits is downgraded to a\n * fieldless banner message.\n */\nconst fieldErrorKeys: Record<string, string> = {\n  \"error.email_required\": \"email\",\n  \"error.email_invalid\": \"email\",\n  \"error.email_exists\": \"email\",\n  \"error.password_required\": \"password\",\n  \"error.password_incorrect\": \"password\",\n  \"error.invalid_credentials\": \"password\",\n};\n\nexport function createLiquidEngine(options: CreateLiquidOptions): Liquid {\n  const templates: Record<string, string> = {\n    [TEMPLATE_NAMES.default]: defaultTemplate,\n    ...(options.templates ?? {}),\n  };\n\n  const engine = new Liquid({\n    templates,\n    cache: true,\n    jsTruthy: true,\n    relativeReference: false,\n    strictFilters: false,\n    strictVariables: false,\n    outputEscape: \"escape\",\n  });\n\n  // Layer 1.5 — drop the `| raw` filter. We return a plain string instead of\n  // the engine's \"safe\" marker, so the configured `outputEscape: \"escape\"`\n  // still applies. Templates that historically used `| raw` therefore no\n  // longer bypass auto-escaping.\n  engine.registerFilter(\"raw\", (value: unknown) => stringify(value));\n\n  // The i18n filter. Looks up `text_key` in the active locale dictionary.\n  // Extra args become positional `{n}` substitutions:\n  //\n  //   {{ \"password.title\" | t: identity.display_name }}\n  //   -> \"Welcome back, Alice\"\n  //\n  // A key that misses the dictionary AND both fallbacks renders as the raw\n  // key (graceful degradation) — with a warn-once console signal so template\n  // authors see the miss instead of shipping `action.recover` to users.\n  const warnedMissingKeys = new Set<string>();\n  engine.registerFilter(\n    \"t\",\n    function tFilter(this: { context: unknown }, key: unknown, ...args: unknown[]) {\n      const lookupKey = stringify(key);\n      let template =\n        options.locale[lookupKey] ??\n        injectedKeyFallback(options.locale, lookupKey) ??\n        fieldLabelFallback(lookupKey);\n      if (template === undefined) {\n        template = lookupKey;\n        if (lookupKey !== \"\" && !warnedMissingKeys.has(lookupKey)) {\n          warnedMissingKeys.add(lookupKey);\n          console.warn(\n            `[zitadel-login] missing text key \"${lookupKey}\" — rendering the raw key`,\n          );\n        }\n      }\n      return interpolate(template, args.map(stringify));\n    },\n  );\n\n  /** Resolves `{text_key}.placeholder` — empty when undefined (not the raw key). */\n  engine.registerFilter(\"fieldPlaceholder\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.placeholder`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /** Resolves `{text_key}.help` — empty when undefined. */\n  engine.registerFilter(\"fieldHelp\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.help`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /**\n   * Builds `<zl-select>` options from a field's closed `validation.enum`. The\n   * wire only carries the allowed values (strings), so the label defaults to the\n   * value — author the enum with display-ready text. Piped through `| json` into\n   * the element's `options` attribute.\n   */\n  engine.registerFilter(\"selectOptions\", (values: unknown) => {\n    if (!Array.isArray(values)) return [];\n    return values.map((value) => {\n      const v = stringify(value);\n      return { value: v, label: v };\n    });\n  });\n\n  /** Resolves `{text_key}.title` for form-level `<zl-alert heading>`. */\n  engine.registerFilter(\"alertHeading\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.title`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /** Resolves `{text_key}.body` for form-level `<zl-alert>` message slot. */\n  engine.registerFilter(\"alertBody\", (textKey: unknown) => {\n    const lookupKey = `${stringify(textKey)}.body`;\n    return options.locale[lookupKey] ?? \"\";\n  });\n\n  /** Localized inline error for `fieldName`, or empty when none applies. */\n  engine.registerFilter(\"fieldError\", (fieldName: unknown, errors: unknown) => {\n    const name = stringify(fieldName);\n    if (!Array.isArray(errors)) return \"\";\n    for (const item of errors) {\n      const err = item as FlowError;\n      if (err.field !== name) continue;\n      // A catalog key localises through the active dictionary; a pre-localised\n      // generic field error (no catalog entry) carries its `message` verbatim.\n      return err.text_key ? (options.locale[err.text_key] ?? err.text_key) : (err.message ?? \"\");\n    }\n    return \"\";\n  });\n\n  /**\n   * Automation-hook token for a field name: strips the\n   * `x-auth-methods#` credential prefix so testids stay method-named\n   * (`zitadel-field-password`), while the `name` attribute keeps the\n   * raw wire key. See hookName for the contract.\n   */\n  engine.registerFilter(\"testid\", (fieldName: unknown) => hookName(stringify(fieldName)));\n\n  /**\n   * True when the error should render as `<zl-alert>`, not on a field. A\n   * field-scoped error (`field` set by {@link localiseFlowErrorKeys} when the\n   * step renders that field) routes inline instead; everything else — engine\n   * errors, and orphaned field errors already downgraded to a fieldless\n   * message — falls to the banner.\n   */\n  engine.registerFilter(\"formLevelError\", (err: unknown) => {\n    return !(err as FlowError)?.field;\n  });\n\n  // `{% mandatory_gates %}` — emits a unique marker comment that the\n  // orchestrator post-processes via `patchMandatoryGates`. The tag name is\n  // owned by @zitadel/config so the authoring validator registers the same\n  // dialect this engine renders.\n  engine.registerTag(MANDATORY_GATES_TAG, {\n    parse() {\n      // No body, no args — nothing to consume.\n    },\n    render() {\n      return mandatoryGatesMarkerComment;\n    },\n  });\n\n  return engine;\n}\n\n/**\n * Fallbacks for text keys the flow engine derives from tenant-chosen step\n * names (`<step>.action.back` for the injected back action — see\n * `internal/domain/flow_state_machine.go` `buildStep`). Step names are open,\n * so no dictionary can enumerate them; a missing step-specific key falls back\n * to its generic entry instead of leaking the raw key into the UI.\n */\nconst INJECTED_KEY_FALLBACKS: ReadonlyArray<{ suffix: string; fallback: string }> = [\n  { suffix: \".action.back\", fallback: \"action.back\" },\n];\n\nfunction injectedKeyFallback(locale: Locale, key: string): string | undefined {\n  for (const { suffix, fallback } of INJECTED_KEY_FALLBACKS) {\n    if (key.endsWith(suffix)) return locale[fallback];\n  }\n  return undefined;\n}\n\n/**\n * Fallback for field-label keys (`<step>.field.<name>` — see\n * `FlowField.TextKey` in `internal/domain/flow_field_resolver.go`). Both\n * halves are tenant-chosen (step names and schema property names), so no\n * catalog can enumerate the keys; a miss renders a humanised property name\n * (\"dateOfBirth\" → \"Date of birth\") instead of leaking the raw key into the\n * form. Sub-keys like `.placeholder`/`.help` are excluded — they resolve\n * through their own filters, which stay empty on a miss.\n */\nfunction fieldLabelFallback(key: string): string | undefined {\n  const marker = \".field.\";\n  // Last occurrence: step names are tenant-chosen and may themselves\n  // contain \".field.\"; the property name always follows the final marker.\n  const index = key.lastIndexOf(marker);\n  if (index === -1) return undefined;\n  const field = key.slice(index + marker.length);\n  if (field === \"\" || field.includes(\".\")) return undefined;\n  return capitaliseFirst(humaniseFieldName(field));\n}\n\nexport type FlowErrorKeyContext = {\n  locale: Locale;\n  /** Step name, for `<step>.field.<name>` label lookups. */\n  stepName: string;\n  /**\n   * Names of the fields the step renders. When provided, an inline-routed\n   * key (see `fieldErrorKeys`) whose field is absent is downgraded to a\n   * pre-localised banner message — its inline outlet doesn't exist, and\n   * `formLevelError` would otherwise suppress the banner too, silently\n   * hiding the error. Omit to skip the check (pure lookups).\n   */\n  fields?: readonly string[];\n};\n\n/**\n * Rule-suffix fallbacks for the server's field-validation keys\n * (`error.<field>_<rule>` — see `FlowFieldValidationError.TextKey` in\n * `internal/domain/flow_field_resolver.go`). Field names come from the\n * tenant's user schema, so no catalog can enumerate the specific keys;\n * a miss resolves to the rule's generic entry, interpolated with the\n * field's label (`{0}`). The server spells the format rule `_invalid`\n * (the catalog's existing convention, e.g. `error.email_invalid`), so\n * that suffix takes the format wording; `_unknown_field` (a submitted\n * name that is not a step field) takes the catch-all.\n */\nconst FLOW_ERROR_RULE_FALLBACKS: ReadonlyArray<{ suffix: string; generic: string }> = [\n  { suffix: \"_required\", generic: \"error.field_required\" },\n  { suffix: \"_min_length\", generic: \"error.field_min_length\" },\n  { suffix: \"_max_length\", generic: \"error.field_max_length\" },\n  { suffix: \"_format\", generic: \"error.field_format\" },\n  { suffix: \"_invalid\", generic: \"error.field_format\" },\n  { suffix: \"_unknown_field\", generic: \"error.field_invalid\" },\n];\n\nconst FLOW_ERROR_CATCH_ALL_KEY = \"error.field_invalid\";\n\n/**\n * Localises a `step.error` payload of `error.*` catalog keys —\n * field-validation violations and general engine failures (e.g.\n * `error.invalid_credentials`, `error.passkey_invalid`) alike.\n * Returns `null` unless EVERY `\"; \"`-joined segment is an `error.*` key\n * — the caller keeps other payloads (outcome tokens such as\n * `user_not_found`) verbatim.\n *\n * Keys the locale knows pass through as `text_key` entries: the template\n * localises them via `| t`, and `fieldErrorKeys` routes the known ones\n * inline to their field. Unknown keys with a recognised rule suffix are\n * pre-localised here from their generic {@link FLOW_ERROR_RULE_FALLBACKS}\n * entry; unknown keys without one pass through as `text_key` (matching\n * `| t`'s behaviour for non-validation keys such as\n * `error.sign_in_server`, which localises via `.title`/`.body`).\n */\nexport function localiseFlowErrorKeys(\n  raw: string,\n  ctx: FlowErrorKeyContext,\n): FlowError[] | null {\n  const segments = raw.split(\"; \");\n  if (!segments.every((segment) => segment.startsWith(\"error.\"))) return null;\n  return segments.map((key) => localiseFlowErrorKey(key, ctx));\n}\n\nfunction localiseFlowErrorKey(key: string, ctx: FlowErrorKeyContext): FlowError {\n  // An inline-routed key can only render on its field; when the step\n  // doesn't carry that field, fall through to the pre-localised message\n  // paths so the error surfaces as a banner instead of vanishing.\n  const inlineField = fieldErrorKeys[key];\n  const orphanedInline =\n    inlineField !== undefined && ctx.fields !== undefined && !ctx.fields.includes(inlineField);\n  if (!orphanedInline && ctx.locale[key] !== undefined) {\n    // Catalog-known key. A field-mapped one (email/password) routes inline to\n    // its field; an unmapped one (e.g. `error.sign_in_server`) stays\n    // form-level, localising through its `.title`/`.body` sub-keys in the\n    // alert filters.\n    return inlineField !== undefined ? { field: inlineField, text_key: key } : { text_key: key };\n  }\n  for (const { suffix, generic } of FLOW_ERROR_RULE_FALLBACKS) {\n    if (!key.endsWith(suffix)) continue;\n    const field = key.slice(\"error.\".length, key.length - suffix.length);\n    if (field === \"\") break;\n    const template =\n      ctx.locale[generic] ?? ctx.locale[FLOW_ERROR_CATCH_ALL_KEY] ?? \"Please check {0}.\";\n    const message = capitaliseFirst(interpolate(template, [fieldLabel(ctx, field)]));\n    // Route inline when the step renders this field (the inline outlet exists);\n    // otherwise keep it a banner message so it can never silently vanish. A\n    // fields-less pure lookup can't confirm the outlet, so it stays a banner.\n    const rendered = ctx.fields !== undefined && ctx.fields.includes(field);\n    return rendered ? { field, message } : { message };\n  }\n  // Orphaned inline key without a recognised rule suffix (e.g.\n  // `error.email_exists`): surface its catalog copy as a banner message.\n  if (orphanedInline && ctx.locale[key] !== undefined) {\n    return { message: ctx.locale[key] };\n  }\n  return { text_key: key };\n}\n\n/** `<step>.field.<name>` from the locale, else a humanised field name. */\nfunction fieldLabel(ctx: FlowErrorKeyContext, field: string): string {\n  const fromStep = ctx.locale[`${ctx.stepName}.field.${field}`];\n  return fromStep ?? humaniseFieldName(field);\n}\n\n/**\n * `x-auth-methods#password` → \"password\", `givenName` → \"given name\",\n * `date_of_birth` → \"date of birth\".\n */\nfunction humaniseFieldName(field: string): string {\n  const afterHash = field.includes(\"#\") ? (field.split(\"#\").pop() as string) : field;\n  return afterHash\n    .replace(/([a-z0-9])([A-Z])/g, \"$1 $2\")\n    .replace(/[_.-]+/g, \" \")\n    .trim()\n    .toLowerCase();\n}\n\n/** Messages may open with a lowercase field label; sentence-case them. */\nfunction capitaliseFirst(text: string): string {\n  return text.length > 0 ? text[0]?.toUpperCase() + text.slice(1) : text;\n}\n\nfunction stringify(value: unknown): string {\n  if (value == null) return \"\";\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\") return String(value);\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return String(value);\n  }\n}\n\n/**\n * Positional `{n}` substitution shared by the `| t` filter and the\n * pre-localising fallback in {@link localiseFlowErrorKeys}, so both\n * produce byte-identical output for the same template and args.\n */\nfunction interpolate(template: string, args: readonly string[]): string {\n  if (args.length === 0) return template;\n  return template.replace(/\\{(\\d+)\\}/g, (match, index) => {\n    const i = Number(index);\n    return args[i] ?? match;\n  });\n}\n","/**\n * Minimal English locale dictionary.\n *\n * The `| t` filter looks up `text_key` strings here. Missing keys fall through\n * to the raw key (matches the spec in\n * `docs/design/flowengine/flow-engine-guide.md`).\n *\n * Text keys are auto-generated by the server from the flow definition:\n *   - Step titles:       `<step>.title`\n *   - Step descriptions: `<step>.description`\n *   - Field labels:      `<step>.field.<field>`\n *   - Action labels:     `<step>.action.<action>`\n *\n * Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).\n * MVP only — multi-locale support is deferred.\n */\nexport const en: Record<string, string> = {\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: identifier (email entry — first screen)\n  // Figma 2xl `6593:141983`, card `6593:141985`, stack `6593:141989`\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"identifier.title\": \"Sign in\",\n  \"identifier.description\": \"Enter your email to continue\",\n  \"identifier.field.email\": \"Email\",\n  \"identifier.field.email.placeholder\": \"you@example.com\",\n  \"identifier.field.password\": \"Password\",\n  \"identifier.action.submit\": \"Sign in\",\n  \"identifier.action.continue\": \"Continue\",\n  \"identifier.action.passkey\": \"Sign in with a passkey\",\n  \"identifier.action.register.lead\": \"Don't have an account? \",\n  \"identifier.action.register.link\": \"Sign up\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: authenticate (password entry — sign-in flow)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"authenticate.title\": \"Sign in\",\n  \"authenticate.description\": \"Enter your password\",\n  \"authenticate.field.password\": \"Password\",\n  \"authenticate.action.submit\": \"Sign in\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: choose-register (registration path selection — no fields)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"choose-register.title\": \"Create your account\",\n  \"choose-register.description\": \"Choose how you'd like to sign up\",\n  \"choose-register.action.register-with-password\": \"Sign up with password\",\n  \"choose-register.action.register-with-passkey\": \"Sign up with passkey\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: collect-credentials (email + password — password registration)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"collect-credentials.title\": \"Create your account\",\n  \"collect-credentials.description\": \"Set up your email and password\",\n  \"collect-credentials.field.email\": \"Email\",\n  \"collect-credentials.field.email.placeholder\": \"you@example.com\",\n  \"collect-credentials.field.password\": \"Password\",\n  // No static password rule hint: the only enforced rule is the schema's\n  // minLength, and \"symbol + number\" was never enforced. The client will build\n  // this hint dynamically from the API's per-field validation rules (#251).\n  \"collect-credentials.action.submit\": \"Sign up\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: register-password (password entry — registration path)\n  // Default login flow: register → register-password → passkey-upsell → done\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"register-password.title\": \"Create your password\",\n  \"register-password.description\": \"Choose a secure password for your account\",\n  \"register-password.field.password\": \"Password\",\n  \"register-password.action.submit\": \"Sign up\",\n  \"register-password.action.back\": \"Back\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: passkey-upsell (passkey enrollment offer — after registration)\n  // Figma `6594:630`, heading `6594:89142`, body `6594:12796`\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"passkey-upsell.title\": \"Sign in faster next time\",\n  \"passkey-upsell.description\": \"No password needed ever again.\",\n  \"passkey-upsell.description.line1\": \"No password needed ever again.\",\n  \"passkey-upsell.description.line2\": \"Sign in with Face ID, Touch ID, or PIN.\",\n  \"passkey-upsell.action.passkey_register\": \"Set up passkey\",\n  \"passkey-upsell.action.skip\": \"Skip for now\",\n  // Figma `6594:630` setup-passkey annotations — kept for backward compat.\n  \"passkey-upsell.action.setup\": \"Set up passkey\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: collect-passkey-email (email only — passkey-only registration)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"collect-passkey-email.title\": \"Create your account\",\n  \"collect-passkey-email.description\": \"Enter your email to set up a passkey\",\n  \"collect-passkey-email.field.email\": \"Email\",\n  \"collect-passkey-email.field.email.placeholder\": \"you@example.com\",\n  \"collect-passkey-email.action.submit\": \"Continue\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: passkey-enroll (mandatory passkey ceremony — passkey-only path)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"passkey-enroll.title\": \"Set up your passkey\",\n  \"passkey-enroll.description\": \"Use Face ID, Touch ID, or your device PIN to create a passkey.\",\n  \"passkey-enroll.action.passkey_register\": \"Set up passkey\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: done (terminal — signed-in confirmation)\n  // Figma `6596:132846`\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"done.title\": \"You're signed in as\",\n  \"done.description\": \"\",\n\n  // --- Step-name aliases used by the default login flow ---\n  \"password.title\": \"Sign in\",\n  \"password.description\": \"Enter your password\",\n  \"password.field.password\": \"Password\",\n  \"password.action.signin\": \"Sign in\",\n  \"password.action.passkey\": \"Sign in with a passkey\",\n  \"password.action.back\": \"Back\",\n  \"password.action.register.lead\": \"Don't have an account? \",\n  \"password.action.register.link\": \"Sign up\",\n\n  \"register.title\": \"Create your account\",\n  // Empty by design — the sign-up card has no subheadline (Figma 6593:141743).\n  \"register.description\": \"\",\n  \"register.field.email\": \"Email\",\n  \"register.field.email.placeholder\": \"you@example.com\",\n  \"register.field.password\": \"Password\",\n  \"register.field.givenName\": \"Given name\",\n  \"register.field.familyName\": \"Family name\",\n  \"register.field.companyName\": \"Company name\",\n  // Native <input type=\"date\"> localizes its own display format to the user's\n  // locale and submits ISO YYYY-MM-DD — no placeholder/help format hint needed.\n  \"register.field.dateOfBirth\": \"Date of birth\",\n  \"register.field.country\": \"Country\",\n  \"register.field.country.placeholder\": \"Select your country\",\n  \"register.field.terms\": \"I agree to the terms of service\",\n  \"register.action.password\": \"Continue with password\",\n  \"register.action.passkey\": \"Continue with a passkey\",\n  \"register.action.submit\": \"Sign up\",\n  \"register.action.back\": \"Back\",\n  \"register.action.sign_in.lead\": \"Already have an account? \",\n  \"register.action.sign_in.link\": \"Sign in\",\n\n  \"complete.title\": \"You're signed in as\",\n  \"signed-in.continue\": \"Continue\",\n  \"signed-in.logout\": \"Sign out\",\n\n  // --- Passkey login ---\n  \"passkey-login.title\": \"Sign in with your passkey\",\n\n  // --- Step: passkey-first (entry step of the passkey-first preset) ---\n  \"passkey-first.title\": \"Sign in\",\n  \"passkey-first.description\": \"Use your passkey to continue\",\n  \"passkey-first.action.passkey\": \"Continue with passkey\",\n  \"passkey-first.action.email_fallback\": \"Use email instead\",\n\n  // --- Password recovery ---\n  \"recover.title\": \"Check your email\",\n  \"recover.description\": \"We sent a password reset link to your email address.\",\n  \"recover.action.back\": \"Back to sign in\",\n\n  // --- Shared actions ---\n  \"submit.continue\": \"Continue\",\n  \"submit.signin\": \"Sign in\",\n  \"action.forgot_password\": \"Forgot password?\",\n  \"action.cancel\": \"Cancel\",\n  // Generic fallback for the engine-injected `<step>.action.back` key on\n  // custom step names (see INJECTED_KEY_FALLBACKS in liquid.ts).\n  \"action.back\": \"Back\",\n\n  // --- SSO ---\n  \"sso.redirect.title\": \"Redirecting to your provider…\",\n\n  // --- Passkey ceremony ---\n  \"passkey.pending.status\": \"Waiting for your passkey…\",\n\n  // --- Passkey errors ---\n  // Covers both user dismissal and any close the browser reports as\n  // NotAllowedError — it fires for login and registration ceremonies alike.\n  \"error.passkey_cancelled\": \"The passkey prompt was closed before completing.\",\n  \"error.passkey_timeout\": \"The passkey request timed out. Please try again.\",\n  \"error.passkey_not_registered\":\n    \"This passkey is not registered. Please sign in with your email and password.\",\n  \"error.passkey_setup_failed\": \"Passkey registration did not complete. Please try again.\",\n  \"error.passkey_unsupported\": \"This device does not support passkeys\",\n  \"error.passkey_failed\": \"Something went wrong. Please try again.\",\n  \"error.passkey_invalid\": \"This passkey could not be verified. Please try again.\",\n  \"error.passkey_registration_invalid\":\n    \"The new passkey could not be verified. Please try registering it again.\",\n\n  // --- Field / form errors (Figma field annotations) ---\n  \"error.email_required\": \"Please enter an email address\",\n  \"error.email_invalid\": \"Please enter a valid email\",\n  \"error.password_required\": \"Please enter a password\",\n  \"error.password_incorrect\": \"Wrong email or password.\",\n  \"error.email_exists\": \"An account with this email already exists.\",\n  /** Figma sign-in error `6602:180268` — inline on password field. */\n  \"error.invalid_credentials\": \"Wrong email or password.\",\n  \"error.required\": \"This field is required.\",\n\n  // --- Generic field-rule fallbacks ({0} = field label) ---\n  // Used by `localiseFlowErrorKeys` (liquid.ts) when no field-specific\n  // entry exists for a server-emitted `error.<field>_<rule>` key.\n  \"error.field_required\": \"{0} is required.\",\n  \"error.field_format\": \"Please enter a valid {0}.\",\n  \"error.field_min_length\": \"{0} is too short.\",\n  \"error.field_max_length\": \"{0} is too long.\",\n  \"error.field_invalid\": \"Please check {0}.\",\n\n  // --- Sign-in form-level alert (Figma `6594:125237`, alert `6596:132779`) ---\n  \"error.sign_in_server.title\": \"We couldn't complete your sign in.\",\n  \"error.sign_in_server.body\": \"Please try again in a few minutes\",\n};\n\nexport type Locale = Record<string, string>;\n","/**\n * German locale dictionary.\n *\n * Structure mirrors {@link en} — same keys, translated values.\n *\n * Text keys are auto-generated by the server from the flow definition:\n *   - Step titles:       `<step>.title`\n *   - Step descriptions: `<step>.description`\n *   - Field labels:      `<step>.field.<field>`\n *   - Action labels:     `<step>.action.<action>`\n *\n * Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).\n */\nimport type { Locale } from \"./en.js\";\n\nexport const de: Locale = {\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: identifier (E-Mail-Eingabe — erster Bildschirm)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"identifier.title\": \"Anmelden\",\n  \"identifier.description\": \"Gib deine E-Mail-Adresse ein, um fortzufahren\",\n  \"identifier.field.email\": \"E-Mail\",\n  \"identifier.field.email.placeholder\": \"du@beispiel.de\",\n  \"identifier.field.password\": \"Passwort\",\n  \"identifier.action.submit\": \"Anmelden\",\n  \"identifier.action.continue\": \"Weiter\",\n  \"identifier.action.passkey\": \"Mit Passkey anmelden\",\n  \"identifier.action.register.lead\": \"Noch kein Konto? \",\n  \"identifier.action.register.link\": \"Registrieren\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: authenticate (Passwort-Eingabe — Anmeldefluss)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"authenticate.title\": \"Anmelden\",\n  \"authenticate.description\": \"Gib dein Passwort ein\",\n  \"authenticate.field.password\": \"Passwort\",\n  \"authenticate.action.submit\": \"Anmelden\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: choose-register (Registrierungspfad-Auswahl — keine Felder)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"choose-register.title\": \"Konto erstellen\",\n  \"choose-register.description\": \"Wähle, wie du dich registrieren möchtest\",\n  \"choose-register.action.register-with-password\": \"Mit Passwort registrieren\",\n  \"choose-register.action.register-with-passkey\": \"Mit Passkey registrieren\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: collect-credentials (E-Mail + Passwort — Passwort-Registrierung)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"collect-credentials.title\": \"Konto erstellen\",\n  \"collect-credentials.description\": \"Richte E-Mail und Passwort ein\",\n  \"collect-credentials.field.email\": \"E-Mail\",\n  \"collect-credentials.field.email.placeholder\": \"du@beispiel.de\",\n  \"collect-credentials.field.password\": \"Passwort\",\n  \"collect-credentials.action.submit\": \"Registrieren\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: register-password (Passwort-Eingabe — Registrierungspfad)\n  // Standard-Login-Flow: register → register-password → passkey-upsell → done\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"register-password.title\": \"Passwort erstellen\",\n  \"register-password.description\": \"Wähle ein sicheres Passwort für dein Konto\",\n  \"register-password.field.password\": \"Passwort\",\n  \"register-password.action.submit\": \"Registrieren\",\n  \"register-password.action.back\": \"Zurück\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: passkey-upsell (Passkey-Angebot — nach Registrierung)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"passkey-upsell.title\": \"Nächstes Mal schneller anmelden\",\n  \"passkey-upsell.description\": \"Kein Passwort mehr nötig.\",\n  \"passkey-upsell.description.line1\": \"Kein Passwort mehr nötig.\",\n  \"passkey-upsell.description.line2\": \"Melde dich mit Face ID, Touch ID oder PIN an.\",\n  \"passkey-upsell.action.passkey_register\": \"Passkey einrichten\",\n  \"passkey-upsell.action.skip\": \"Vorerst überspringen\",\n  \"passkey-upsell.action.setup\": \"Passkey einrichten\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: collect-passkey-email (nur E-Mail — Passkey-only-Registrierung)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"collect-passkey-email.title\": \"Konto erstellen\",\n  \"collect-passkey-email.description\":\n    \"Gib deine E-Mail-Adresse ein, um einen Passkey einzurichten\",\n  \"collect-passkey-email.field.email\": \"E-Mail\",\n  \"collect-passkey-email.field.email.placeholder\": \"du@beispiel.de\",\n  \"collect-passkey-email.action.submit\": \"Weiter\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: passkey-enroll (Passkey-Zeremonie — Passkey-only-Pfad)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"passkey-enroll.title\": \"Passkey einrichten\",\n  \"passkey-enroll.description\":\n    \"Verwende Face ID, Touch ID oder die Geräte-PIN, um einen Passkey zu erstellen.\",\n  \"passkey-enroll.action.passkey_register\": \"Passkey einrichten\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: done (Terminal — Anmeldebestätigung)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"done.title\": \"Du bist angemeldet als\",\n  \"done.description\": \"\",\n\n  // --- Step-Name-Aliase für den Standard-Login-Flow ---\n  \"password.title\": \"Anmelden\",\n  \"password.description\": \"Gib dein Passwort ein\",\n  \"password.field.password\": \"Passwort\",\n  \"password.action.signin\": \"Anmelden\",\n  \"password.action.passkey\": \"Mit Passkey anmelden\",\n  \"password.action.back\": \"Zurück\",\n  \"password.action.register.lead\": \"Noch kein Konto? \",\n  \"password.action.register.link\": \"Registrieren\",\n\n  \"register.title\": \"Konto erstellen\",\n  // Leer per Design — die Registrierungskarte hat keine Unterzeile (Figma 6593:141743).\n  \"register.description\": \"\",\n  \"register.field.email\": \"E-Mail\",\n  \"register.field.email.placeholder\": \"du@beispiel.de\",\n  \"register.field.password\": \"Passwort\",\n  \"register.field.givenName\": \"Vorname\",\n  \"register.field.familyName\": \"Nachname\",\n  \"register.field.companyName\": \"Firmenname\",\n  // Natives <input type=\"date\"> lokalisiert sein Anzeigeformat anhand der Sprache\n  // des Nutzers und übermittelt ISO YYYY-MM-DD – kein Platzhalter-/Format-Hinweis nötig.\n  \"register.field.dateOfBirth\": \"Geburtsdatum\",\n  \"register.field.country\": \"Land\",\n  \"register.field.country.placeholder\": \"Land auswählen\",\n  \"register.field.terms\": \"Ich stimme den Nutzungsbedingungen zu\",\n  \"register.action.password\": \"Mit Passwort fortfahren\",\n  \"register.action.passkey\": \"Weiter mit Passkey\",\n  \"register.action.submit\": \"Registrieren\",\n  \"register.action.back\": \"Zurück\",\n  \"register.action.sign_in.lead\": \"Bereits ein Konto? \",\n  \"register.action.sign_in.link\": \"Anmelden\",\n\n  \"complete.title\": \"Du bist angemeldet als\",\n  \"signed-in.continue\": \"Weiter\",\n  \"signed-in.logout\": \"Abmelden\",\n\n  // --- Passkey-Anmeldung ---\n  \"passkey-login.title\": \"Mit Passkey anmelden\",\n\n  // --- Step: passkey-first (Einstiegsschritt des Passkey-first-Presets) ---\n  \"passkey-first.title\": \"Anmelden\",\n  \"passkey-first.description\": \"Verwende deinen Passkey, um fortzufahren\",\n  \"passkey-first.action.passkey\": \"Weiter mit Passkey\",\n  \"passkey-first.action.email_fallback\": \"Stattdessen E-Mail verwenden\",\n\n  // --- Passwort-Wiederherstellung ---\n  \"recover.title\": \"E-Mail prüfen\",\n  \"recover.description\":\n    \"Wir haben einen Link zum Zurücksetzen des Passworts an deine E-Mail-Adresse gesendet.\",\n  \"recover.action.back\": \"Zurück zur Anmeldung\",\n\n  // --- Gemeinsame Aktionen ---\n  \"submit.continue\": \"Weiter\",\n  \"submit.signin\": \"Anmelden\",\n  \"action.forgot_password\": \"Passwort vergessen?\",\n  \"action.cancel\": \"Abbrechen\",\n  // Generische Rückfalloption für den von der Engine injizierten\n  // `<step>.action.back`-Schlüssel (siehe INJECTED_KEY_FALLBACKS in liquid.ts).\n  \"action.back\": \"Zurück\",\n\n  // --- SSO ---\n  \"sso.redirect.title\": \"Weiterleitung zum Anbieter…\",\n\n  // --- Passkey-Vorgang ---\n  \"passkey.pending.status\": \"Warten auf deinen Passkey…\",\n\n  // --- Passkey-Fehler ---\n  \"error.passkey_cancelled\": \"Die Passkey-Abfrage wurde vorzeitig geschlossen.\",\n  \"error.passkey_timeout\":\n    \"Die Passkey-Anfrage hat zu lange gedauert. Bitte versuche es erneut.\",\n  \"error.passkey_not_registered\":\n    \"Dieser Passkey ist nicht registriert. Bitte melde dich mit E-Mail und Passwort an.\",\n  \"error.passkey_setup_failed\":\n    \"Passkey-Registrierung wurde nicht abgeschlossen. Bitte versuche es erneut.\",\n  \"error.passkey_unsupported\": \"Dieses Gerät unterstützt keine Passkeys\",\n  \"error.passkey_failed\": \"Etwas ist schiefgelaufen. Bitte versuche es erneut.\",\n  \"error.passkey_invalid\":\n    \"Dieser Passkey konnte nicht bestätigt werden. Bitte versuche es erneut.\",\n  \"error.passkey_registration_invalid\":\n    \"Der neue Passkey konnte nicht bestätigt werden. Bitte registriere ihn erneut.\",\n\n  // --- Feld- / Formularfehler ---\n  \"error.email_required\": \"Bitte gib eine E-Mail-Adresse ein\",\n  \"error.email_invalid\": \"Bitte gib eine gültige E-Mail-Adresse ein\",\n  \"error.password_required\": \"Bitte gib ein Passwort ein\",\n  \"error.password_incorrect\": \"Falsche E-Mail oder falsches Passwort.\",\n  \"error.email_exists\": \"Ein Konto mit dieser E-Mail-Adresse existiert bereits.\",\n  \"error.invalid_credentials\": \"Falsche E-Mail oder falsches Passwort.\",\n  \"error.required\": \"Dieses Feld ist erforderlich.\",\n\n  // --- Generische Feldregel-Fallbacks ({0} = Feldbezeichnung) ---\n  \"error.field_required\": \"{0} ist erforderlich.\",\n  \"error.field_format\": \"Bitte gib einen gültigen Wert für {0} ein.\",\n  \"error.field_min_length\": \"{0} ist zu kurz.\",\n  \"error.field_max_length\": \"{0} ist zu lang.\",\n  \"error.field_invalid\": \"Bitte überprüfe {0}.\",\n\n  // --- Formular-Alerts ---\n  \"error.sign_in_server.title\": \"Anmeldung konnte nicht abgeschlossen werden.\",\n  \"error.sign_in_server.body\": \"Bitte versuche es in einigen Minuten erneut\",\n};\n","/**\n * Italian locale dictionary.\n *\n * Structure mirrors {@link en} — same keys, translated values.\n *\n * Text keys are auto-generated by the server from the flow definition:\n *   - Step titles:       `<step>.title`\n *   - Step descriptions: `<step>.description`\n *   - Field labels:      `<step>.field.<field>`\n *   - Action labels:     `<step>.action.<action>`\n */\nimport type { Locale } from \"./en.js\";\n\nexport const it: Locale = {\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: identifier (inserimento e-mail — prima schermata)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"identifier.title\": \"Accedi\",\n  \"identifier.description\": \"Inserisci la tua e-mail per continuare\",\n  \"identifier.field.email\": \"E-mail\",\n  \"identifier.field.email.placeholder\": \"tu@esempio.com\",\n  \"identifier.field.password\": \"Password\",\n  \"identifier.action.submit\": \"Accedi\",\n  \"identifier.action.continue\": \"Continua\",\n  \"identifier.action.passkey\": \"Accedi con passkey\",\n  \"identifier.action.register.lead\": \"Non hai un account? \",\n  \"identifier.action.register.link\": \"Registrati\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: authenticate (inserimento password — flusso di accesso)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"authenticate.title\": \"Accedi\",\n  \"authenticate.description\": \"Inserisci la tua password\",\n  \"authenticate.field.password\": \"Password\",\n  \"authenticate.action.submit\": \"Accedi\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: choose-register (scelta del percorso di registrazione — nessun campo)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"choose-register.title\": \"Crea il tuo account\",\n  \"choose-register.description\": \"Scegli come registrarti\",\n  \"choose-register.action.register-with-password\": \"Registrati con password\",\n  \"choose-register.action.register-with-passkey\": \"Registrati con passkey\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: collect-credentials (e-mail + password — registrazione con password)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"collect-credentials.title\": \"Crea il tuo account\",\n  \"collect-credentials.description\": \"Configura e-mail e password\",\n  \"collect-credentials.field.email\": \"E-mail\",\n  \"collect-credentials.field.email.placeholder\": \"tu@esempio.com\",\n  \"collect-credentials.field.password\": \"Password\",\n  \"collect-credentials.action.submit\": \"Registrati\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: register-password (inserimento password — percorso di registrazione)\n  // Flusso login predefinito: register → register-password → passkey-upsell → done\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"register-password.title\": \"Crea la tua password\",\n  \"register-password.description\": \"Scegli una password sicura per il tuo account\",\n  \"register-password.field.password\": \"Password\",\n  \"register-password.action.submit\": \"Registrati\",\n  \"register-password.action.back\": \"Indietro\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: passkey-upsell (proposta passkey — dopo la registrazione)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"passkey-upsell.title\": \"Accedi più velocemente la prossima volta\",\n  \"passkey-upsell.description\": \"Nessuna password necessaria.\",\n  \"passkey-upsell.description.line1\": \"Nessuna password necessaria.\",\n  \"passkey-upsell.description.line2\": \"Accedi con Face ID, Touch ID o PIN.\",\n  \"passkey-upsell.action.passkey_register\": \"Configura passkey\",\n  \"passkey-upsell.action.skip\": \"Salta per ora\",\n  \"passkey-upsell.action.setup\": \"Configura passkey\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: collect-passkey-email (solo e-mail — registrazione solo passkey)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"collect-passkey-email.title\": \"Crea il tuo account\",\n  \"collect-passkey-email.description\":\n    \"Inserisci la tua e-mail per configurare una passkey\",\n  \"collect-passkey-email.field.email\": \"E-mail\",\n  \"collect-passkey-email.field.email.placeholder\": \"tu@esempio.com\",\n  \"collect-passkey-email.action.submit\": \"Continua\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: passkey-enroll (cerimonia passkey — percorso solo passkey)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"passkey-enroll.title\": \"Configura la tua passkey\",\n  \"passkey-enroll.description\":\n    \"Usa Face ID, Touch ID o il PIN del dispositivo per creare una passkey.\",\n  \"passkey-enroll.action.passkey_register\": \"Configura passkey\",\n\n  // ═══════════════════════════════════════════════════════════════════════════\n  // Step: done (terminale — conferma accesso)\n  // ═══════════════════════════════════════════════════════════════════════════\n  \"done.title\": \"Sei connesso come\",\n  \"done.description\": \"\",\n\n  // --- Alias dei nomi step per il flusso login predefinito ---\n  \"password.title\": \"Accedi\",\n  \"password.description\": \"Inserisci la tua password\",\n  \"password.field.password\": \"Password\",\n  \"password.action.signin\": \"Accedi\",\n  \"password.action.passkey\": \"Accedi con passkey\",\n  \"password.action.back\": \"Indietro\",\n  \"password.action.register.lead\": \"Non hai un account? \",\n  \"password.action.register.link\": \"Registrati\",\n\n  \"register.title\": \"Crea il tuo account\",\n  // Vuoto per design — la scheda di registrazione non ha sottotitolo (Figma 6593:141743).\n  \"register.description\": \"\",\n  \"register.field.email\": \"E-mail\",\n  \"register.field.email.placeholder\": \"tu@esempio.com\",\n  \"register.field.password\": \"Password\",\n  \"register.field.givenName\": \"Nome\",\n  \"register.field.familyName\": \"Cognome\",\n  \"register.field.companyName\": \"Nome azienda\",\n  // L'<input type=\"date\"> nativo localizza il proprio formato di visualizzazione in base\n  // alla lingua dell'utente e invia ISO YYYY-MM-DD — nessun segnaposto/suggerimento di formato necessario.\n  \"register.field.dateOfBirth\": \"Data di nascita\",\n  \"register.field.country\": \"Paese\",\n  \"register.field.country.placeholder\": \"Seleziona il tuo paese\",\n  \"register.field.terms\": \"Accetto i termini di servizio\",\n  \"register.action.password\": \"Continua con password\",\n  \"register.action.passkey\": \"Continua con passkey\",\n  \"register.action.submit\": \"Registrati\",\n  \"register.action.back\": \"Indietro\",\n  \"register.action.sign_in.lead\": \"Hai già un account? \",\n  \"register.action.sign_in.link\": \"Accedi\",\n\n  \"complete.title\": \"Sei connesso come\",\n  \"signed-in.continue\": \"Continua\",\n  \"signed-in.logout\": \"Esci\",\n\n  // --- Accesso con passkey ---\n  \"passkey-login.title\": \"Accedi con la tua passkey\",\n\n  // --- Step: passkey-first (passo iniziale del preset passkey-first) ---\n  \"passkey-first.title\": \"Accedi\",\n  \"passkey-first.description\": \"Usa la tua passkey per continuare\",\n  \"passkey-first.action.passkey\": \"Continua con passkey\",\n  \"passkey-first.action.email_fallback\": \"Usa invece l'email\",\n\n  // --- Recupero password ---\n  \"recover.title\": \"Controlla la tua e-mail\",\n  \"recover.description\":\n    \"Abbiamo inviato un link per reimpostare la password al tuo indirizzo e-mail.\",\n  \"recover.action.back\": \"Torna all'accesso\",\n\n  // --- Azioni condivise ---\n  \"submit.continue\": \"Continua\",\n  \"submit.signin\": \"Accedi\",\n  \"action.forgot_password\": \"Password dimenticata?\",\n  \"action.cancel\": \"Annulla\",\n  // Fallback generico per la chiave `<step>.action.back` iniettata dal motore\n  // (vedi INJECTED_KEY_FALLBACKS in liquid.ts).\n  \"action.back\": \"Indietro\",\n\n  // --- SSO ---\n  \"sso.redirect.title\": \"Reindirizzamento al provider…\",\n\n  // --- Cerimonia passkey ---\n  \"passkey.pending.status\": \"In attesa della tua passkey…\",\n\n  // --- Errori passkey ---\n  \"error.passkey_cancelled\": \"La richiesta della passkey è stata chiusa prima del completamento.\",\n  \"error.passkey_timeout\": \"La richiesta della passkey è scaduta. Riprova.\",\n  \"error.passkey_not_registered\": \"Questa passkey non è registrata. Accedi con e-mail e password.\",\n  \"error.passkey_setup_failed\": \"La registrazione della passkey non è stata completata. Riprova.\",\n  \"error.passkey_unsupported\": \"Questo dispositivo non supporta le passkey\",\n  \"error.passkey_failed\": \"Qualcosa è andato storto. Riprova.\",\n  \"error.passkey_invalid\": \"Non è stato possibile verificare questa passkey. Riprova.\",\n  \"error.passkey_registration_invalid\":\n    \"Non è stato possibile verificare la nuova passkey. Riprova a registrarla.\",\n\n  // --- Errori campo / modulo ---\n  \"error.email_required\": \"Inserisci un indirizzo e-mail\",\n  \"error.email_invalid\": \"Inserisci un indirizzo e-mail valido\",\n  \"error.password_required\": \"Inserisci una password\",\n  \"error.password_incorrect\": \"E-mail o password errata.\",\n  \"error.email_exists\": \"Esiste già un account con questo indirizzo e-mail.\",\n  \"error.invalid_credentials\": \"E-mail o password errata.\",\n  \"error.required\": \"Questo campo è obbligatorio.\",\n\n  // --- Fallback generici per regole di campo ({0} = etichetta del campo) ---\n  \"error.field_required\": \"{0} è obbligatorio.\",\n  \"error.field_format\": \"Inserisci un valore valido per {0}.\",\n  \"error.field_min_length\": \"{0} è troppo corto.\",\n  \"error.field_max_length\": \"{0} è troppo lungo.\",\n  \"error.field_invalid\": \"Controlla {0}.\",\n\n  // --- Alert a livello di modulo ---\n  \"error.sign_in_server.title\": \"Non è stato possibile completare l'accesso.\",\n  \"error.sign_in_server.body\": \"Riprova tra qualche minuto\",\n};\n","/**\n * Business-flavored locale overlay.\n *\n * The built-in dictionaries ship neutral email copy (\"Email\" /\n * \"you@example.com\") so the default UI fits any audience. B2B products that\n * want the previous work-email framing spread this overlay on top of the\n * matching built-in dictionary via the `locales` property:\n *\n * ```ts\n * import { en, businessLocales } from \"@zitadel/components\";\n * loginElement.locales = { en: { ...en, ...businessLocales.en } };\n * ```\n *\n * Each entry is a partial dictionary carrying only the affected keys —\n * deliberately exempt from the en/de/it key-parity check that guards the\n * full built-in dictionaries.\n */\nimport type { Locale } from \"./en.js\";\n\nexport const businessLocales: Readonly<Record<string, Partial<Locale>>> = {\n  en: {\n    \"identifier.field.email\": \"Work email\",\n    \"identifier.field.email.placeholder\": \"you@company.com\",\n    \"collect-credentials.field.email\": \"Work email\",\n    \"collect-credentials.field.email.placeholder\": \"you@company.com\",\n    \"collect-passkey-email.field.email\": \"Work email\",\n    \"collect-passkey-email.field.email.placeholder\": \"you@company.com\",\n    \"register.field.email\": \"Work email\",\n    \"register.field.email.placeholder\": \"you@company.com\",\n  },\n  de: {\n    \"identifier.field.email\": \"Geschäftliche E-Mail\",\n    \"identifier.field.email.placeholder\": \"du@unternehmen.com\",\n    \"collect-credentials.field.email\": \"Geschäftliche E-Mail\",\n    \"collect-credentials.field.email.placeholder\": \"du@unternehmen.com\",\n    \"collect-passkey-email.field.email\": \"Geschäftliche E-Mail\",\n    \"collect-passkey-email.field.email.placeholder\": \"du@unternehmen.com\",\n    \"register.field.email\": \"Geschäftliche E-Mail\",\n    \"register.field.email.placeholder\": \"du@unternehmen.com\",\n  },\n  it: {\n    \"identifier.field.email\": \"E-mail aziendale\",\n    \"identifier.field.email.placeholder\": \"tu@azienda.com\",\n    \"collect-credentials.field.email\": \"E-mail aziendale\",\n    \"collect-credentials.field.email.placeholder\": \"tu@azienda.com\",\n    \"collect-passkey-email.field.email\": \"E-mail aziendale\",\n    \"collect-passkey-email.field.email.placeholder\": \"tu@azienda.com\",\n    \"register.field.email\": \"E-mail aziendale\",\n    \"register.field.email.placeholder\": \"tu@azienda.com\",\n  },\n};\n","/**\n * Built-in locale registry.\n *\n * Re-exports the individual dictionaries and provides a `builtinLocales`\n * map so the orchestrator can resolve a BCP 47 language tag to the\n * matching dictionary at runtime.\n */\nexport { en, type Locale } from \"./en.js\";\nexport { de } from \"./de.js\";\nexport { it } from \"./it.js\";\nexport { businessLocales } from \"./business.js\";\n\nimport { en, type Locale } from \"./en.js\";\nimport { de } from \"./de.js\";\nimport { it } from \"./it.js\";\n\nexport const builtinLocales: Readonly<Record<string, Locale>> = { en, de, it };\n","//#region src/runtime/base-url.ts\nlet proxyPath = \"\";\nfunction getProxyPath() {\n\treturn proxyPath;\n}\nfunction setProxyPath(path) {\n\tproxyPath = path;\n}\n//#endregion\nexport { getProxyPath, setProxyPath };\n\n//# sourceMappingURL=base-url.mjs.map","//#region \\0rolldown/runtime.js\nvar __defProp = Object.defineProperty;\nvar __exportAll = (all, no_symbols) => {\n\tlet target = {};\n\tfor (var name in all) __defProp(target, name, {\n\t\tget: all[name],\n\t\tenumerable: true\n\t});\n\tif (!no_symbols) __defProp(target, Symbol.toStringTag, { value: \"Module\" });\n\treturn target;\n};\n//#endregion\nexport { __exportAll as t };\n","import { t as __exportAll } from \"../../chunk-CfYAbeIz.mjs\";\nimport { getProxyPath } from \"../../runtime/base-url.mjs\";\nimport { customFetch } from \"../../runtime/fetch.mjs\";\n//#region src/generated/endpoints/zitadelNextGen.ts\n/**\n* Generated by orval v8.10.0 🍺\n* Do not edit manually.\n* Zitadel NextGen\n* This is the next generation of the Zitadel identity platform.\n* OpenAPI spec version: 0.0.1\n*/\nvar zitadelNextGen_exports = /* @__PURE__ */ __exportAll({\n\tbeginUserPasskeyRegistration: () => beginUserPasskeyRegistration,\n\tcompleteClaim: () => completeClaim,\n\tcreateAuthAttempt: () => createAuthAttempt,\n\tcreateBranding: () => createBranding,\n\tcreateFlow: () => createFlow,\n\tcreateFlowDefinition: () => createFlowDefinition,\n\tcreateGrant: () => createGrant,\n\tcreateHandoff: () => createHandoff,\n\tcreateProject: () => createProject,\n\tcreateRelease: () => createRelease,\n\tcreateSchema: () => createSchema,\n\tcreateSession: () => createSession,\n\tcreateTeam: () => createTeam,\n\tcreateUser: () => createUser,\n\tdeleteFlowDefinition: () => deleteFlowDefinition,\n\tdeleteGrant: () => deleteGrant,\n\tdeleteTeam: () => deleteTeam,\n\tdeleteUserByID: () => deleteUserByID,\n\texchangeHandoff: () => exchangeHandoff,\n\tfinishUserPasskeyRegistration: () => finishUserPasskeyRegistration,\n\tgetAuthAttempt: () => getAuthAttempt,\n\tgetBeginUserPasskeyRegistrationUrl: () => getBeginUserPasskeyRegistrationUrl,\n\tgetBrandingById: () => getBrandingById,\n\tgetClaimStatus: () => getClaimStatus,\n\tgetCompleteClaimUrl: () => getCompleteClaimUrl,\n\tgetCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,\n\tgetCreateBrandingUrl: () => getCreateBrandingUrl,\n\tgetCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,\n\tgetCreateFlowUrl: () => getCreateFlowUrl,\n\tgetCreateGrantUrl: () => getCreateGrantUrl,\n\tgetCreateHandoffUrl: () => getCreateHandoffUrl,\n\tgetCreateProjectUrl: () => getCreateProjectUrl,\n\tgetCreateReleaseUrl: () => getCreateReleaseUrl,\n\tgetCreateSchemaUrl: () => getCreateSchemaUrl,\n\tgetCreateSessionUrl: () => getCreateSessionUrl,\n\tgetCreateTeamUrl: () => getCreateTeamUrl,\n\tgetCreateUserUrl: () => getCreateUserUrl,\n\tgetDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,\n\tgetDeleteGrantUrl: () => getDeleteGrantUrl,\n\tgetDeleteTeamUrl: () => getDeleteTeamUrl,\n\tgetDeleteUserByIDUrl: () => getDeleteUserByIDUrl,\n\tgetEnvironmentByName: () => getEnvironmentByName,\n\tgetEvent: () => getEvent,\n\tgetExchangeHandoffUrl: () => getExchangeHandoffUrl,\n\tgetFinishUserPasskeyRegistrationUrl: () => getFinishUserPasskeyRegistrationUrl,\n\tgetFlowDefinition: () => getFlowDefinition,\n\tgetFlowStep: () => getFlowStep,\n\tgetGetAuthAttemptUrl: () => getGetAuthAttemptUrl,\n\tgetGetBrandingByIdUrl: () => getGetBrandingByIdUrl,\n\tgetGetClaimStatusUrl: () => getGetClaimStatusUrl,\n\tgetGetEnvironmentByNameUrl: () => getGetEnvironmentByNameUrl,\n\tgetGetEventUrl: () => getGetEventUrl,\n\tgetGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,\n\tgetGetFlowStepUrl: () => getGetFlowStepUrl,\n\tgetGetGrantUrl: () => getGetGrantUrl,\n\tgetGetHealthUrl: () => getGetHealthUrl,\n\tgetGetLiveUrl: () => getGetLiveUrl,\n\tgetGetMySessionUrl: () => getGetMySessionUrl,\n\tgetGetMyUserUrl: () => getGetMyUserUrl,\n\tgetGetProjectUrl: () => getGetProjectUrl,\n\tgetGetReadyUrl: () => getGetReadyUrl,\n\tgetGetReleaseByIdUrl: () => getGetReleaseByIdUrl,\n\tgetGetSchemaByIdUrl: () => getGetSchemaByIdUrl,\n\tgetGetSessionUrl: () => getGetSessionUrl,\n\tgetGetTeamUrl: () => getGetTeamUrl,\n\tgetGetUserByIDUrl: () => getGetUserByIDUrl,\n\tgetGrant: () => getGrant,\n\tgetHealth: () => getHealth,\n\tgetInitClaimUrl: () => getInitClaimUrl,\n\tgetIssueChallengeUrl: () => getIssueChallengeUrl,\n\tgetListBrandingUrl: () => getListBrandingUrl,\n\tgetListEnvironmentsUrl: () => getListEnvironmentsUrl,\n\tgetListEventsUrl: () => getListEventsUrl,\n\tgetListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,\n\tgetListReleasesUrl: () => getListReleasesUrl,\n\tgetListSchemasUrl: () => getListSchemasUrl,\n\tgetListUserPasskeysUrl: () => getListUserPasskeysUrl,\n\tgetListUserTeamsUrl: () => getListUserTeamsUrl,\n\tgetLive: () => getLive,\n\tgetMySession: () => getMySession,\n\tgetMyUser: () => getMyUser,\n\tgetPatchProjectUrl: () => getPatchProjectUrl,\n\tgetProject: () => getProject,\n\tgetQueryProjectsUrl: () => getQueryProjectsUrl,\n\tgetQuerySessionsUrl: () => getQuerySessionsUrl,\n\tgetQueryTeamsUrl: () => getQueryTeamsUrl,\n\tgetQueryUsersUrl: () => getQueryUsersUrl,\n\tgetReady: () => getReady,\n\tgetReleaseById: () => getReleaseById,\n\tgetRevokeMySessionUrl: () => getRevokeMySessionUrl,\n\tgetRevokeSessionUrl: () => getRevokeSessionUrl,\n\tgetSchemaById: () => getSchemaById,\n\tgetSession: () => getSession,\n\tgetSetUserPasswordUrl: () => getSetUserPasswordUrl,\n\tgetSubmitFlowStepUrl: () => getSubmitFlowStepUrl,\n\tgetTeam: () => getTeam,\n\tgetUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,\n\tgetUpdateTeamUrl: () => getUpdateTeamUrl,\n\tgetUserByID: () => getUserByID,\n\tgetVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,\n\tinitClaim: () => initClaim,\n\tissueChallenge: () => issueChallenge,\n\tlistBranding: () => listBranding,\n\tlistEnvironments: () => listEnvironments,\n\tlistEvents: () => listEvents,\n\tlistFlowDefinitions: () => listFlowDefinitions,\n\tlistReleases: () => listReleases,\n\tlistSchemas: () => listSchemas,\n\tlistUserPasskeys: () => listUserPasskeys,\n\tlistUserTeams: () => listUserTeams,\n\tpatchProject: () => patchProject,\n\tqueryProjects: () => queryProjects,\n\tquerySessions: () => querySessions,\n\tqueryTeams: () => queryTeams,\n\tqueryUsers: () => queryUsers,\n\trevokeMySession: () => revokeMySession,\n\trevokeSession: () => revokeSession,\n\tsetUserPassword: () => setUserPassword,\n\tsubmitFlowStep: () => submitFlowStep,\n\tupdateFlowDefinition: () => updateFlowDefinition,\n\tupdateTeam: () => updateTeam,\n\tverifyChallengeProof: () => verifyChallengeProof\n});\nconst getGetHealthUrl = () => {\n\treturn `${getProxyPath()}/healthz`;\n};\n/**\n* Check whether the server is healthy\n* @summary Check server health\n*/\nconst getHealth = async (options) => {\n\treturn customFetch(getGetHealthUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetLiveUrl = () => {\n\treturn `${getProxyPath()}/livez`;\n};\n/**\n* Check whether the server is started\n* @summary Check server liveness\n*/\nconst getLive = async (options) => {\n\treturn customFetch(getGetLiveUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetReadyUrl = () => {\n\treturn `${getProxyPath()}/readyz`;\n};\n/**\n* Check whether the server is ready to accept requests\n* @summary Check server readiness\n*/\nconst getReady = async (options) => {\n\treturn customFetch(getGetReadyUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateUserUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;\n};\n/**\n* @summary Create user\n*/\nconst createUser = async (createUserBody, params, options) => {\n\treturn customFetch(getCreateUserUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createUserBody)\n\t});\n};\nconst getQueryUsersUrl = () => {\n\treturn `${getProxyPath()}/users/query`;\n};\n/**\n* Returns the users of a project, paginated with a cursor.\n\nThe project comes from the credential, not from a parameter: the operation\nis bound to the token's own project by construction. This is why it takes\nno `project_id`, unlike the other query endpoints.\n\n* @summary Query users\n*/\nconst queryUsers = async (queryUsersBody, options) => {\n\treturn customFetch(getQueryUsersUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(queryUsersBody)\n\t});\n};\nconst getGetUserByIDUrl = (userId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;\n};\n/**\n* @summary Get user by ID\n*/\nconst getUserByID = async (userId, params, options) => {\n\treturn customFetch(getGetUserByIDUrl(userId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getDeleteUserByIDUrl = (userId) => {\n\treturn `${getProxyPath()}/users/${userId}`;\n};\n/**\n* @summary Delete user by ID\n*/\nconst deleteUserByID = async (userId, options) => {\n\treturn customFetch(getDeleteUserByIDUrl(userId), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getListUserPasskeysUrl = (userId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/passkeys`;\n};\n/**\n* @summary List user passkeys\n*/\nconst listUserPasskeys = async (userId, params, options) => {\n\treturn customFetch(getListUserPasskeysUrl(userId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getBeginUserPasskeyRegistrationUrl = (userId) => {\n\treturn `${getProxyPath()}/users/${userId}/passkeys/registrations`;\n};\n/**\n* Starts a WebAuthn registration ceremony for the user and returns the\ncreation options for `navigator.credentials.create()`. Complete the\nceremony with `POST /users/{user_id}/passkeys/registrations/{registration_id}` within\nfive minutes. Credentials already registered for the user are excluded\nautomatically.\n\n* @summary Begin passkey registration\n*/\nconst beginUserPasskeyRegistration = async (userId, beginUserPasskeyRegistrationBody, options) => {\n\treturn customFetch(getBeginUserPasskeyRegistrationUrl(userId), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(beginUserPasskeyRegistrationBody)\n\t});\n};\nconst getFinishUserPasskeyRegistrationUrl = (userId, registrationId) => {\n\treturn `${getProxyPath()}/users/${userId}/passkeys/registrations/${registrationId}`;\n};\n/**\n* Verifies the attestation against the ceremony started by\n`POST /users/{user_id}/passkeys/registrations` and persists the new credential. A\nrejected attestation counts against the ceremony's failure budget and the\nceremony stays open for a retry. An expired ceremony surfaces as\n`att.stale_challenge`; an unknown or already-consumed registration id\nsurfaces as `att.not_found`.\n\n* @summary Finish passkey registration\n*/\nconst finishUserPasskeyRegistration = async (userId, registrationId, finishUserPasskeyRegistrationBody, options) => {\n\treturn customFetch(getFinishUserPasskeyRegistrationUrl(userId, registrationId), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(finishUserPasskeyRegistrationBody)\n\t});\n};\nconst getSetUserPasswordUrl = (userId) => {\n\treturn `${getProxyPath()}/users/${userId}/password`;\n};\n/**\n* @summary Set user password\n*/\nconst setUserPassword = async (userId, setUserPasswordBody, options) => {\n\treturn customFetch(getSetUserPasswordUrl(userId), {\n\t\t...options,\n\t\tmethod: \"PUT\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(setUserPasswordBody)\n\t});\n};\nconst getListUserTeamsUrl = (userId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/teams`;\n};\n/**\n* The user's team roster, ordered by team name. Each entry carries the\nteam's name, so a client renders a page without resolving ids one by one.\n\nThis is the N:N roster and it is not lifecycle ownership: the single team\nthat owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`\non the user read endpoints. Memberships the user was removed from are not\nreturned.\n\n* @summary List the teams a user belongs to\n*/\nconst listUserTeams = async (userId, params, options) => {\n\treturn customFetch(getListUserTeamsUrl(userId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetMyUserUrl = () => {\n\treturn `${getProxyPath()}/users/me`;\n};\n/**\n* @summary Get my user information\n*/\nconst getMyUser = async (options) => {\n\treturn customFetch(getGetMyUserUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateFlowUrl = () => {\n\treturn `${getProxyPath()}/flow`;\n};\n/**\n* Resolves a flow definition based on purpose + audience context and returns\nthe first capability step. Creates a new session implicitly unless\n`session_id` is provided (for step-up / reauth on an existing session).\n\nThe response contains an `id` field — the flow handle. Use it as the path\nparameter for all subsequent `/flow/{id}/submit` calls.\n\nThe response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing\nthe flow's orchestration state (current step, collected data, history).\nThe server is stateless between requests — all flow state lives in this\ncookie. The browser sends it automatically on subsequent requests.\n\n* @summary Start a new flow\n*/\nconst createFlow = async (createFlowBody, options) => {\n\treturn customFetch(getCreateFlowUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createFlowBody)\n\t});\n};\nconst getGetFlowStepUrl = (id) => {\n\treturn `${getProxyPath()}/flow/${id}`;\n};\n/**\n* Returns the current capability step without advancing the state machine.\nUseful for page reloads or re-rendering after a network error.\n\n* @summary Get current step (re-render)\n*/\nconst getFlowStep = async (id, options) => {\n\treturn customFetch(getGetFlowStepUrl(id), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getSubmitFlowStepUrl = (id) => {\n\treturn `${getProxyPath()}/flow/${id}/submit`;\n};\n/**\n* Submits user input for the current step. The server validates,\nprocesses (e.g., verifies a credential), advances the state machine\nthrough any invisible steps, and returns the next visible step.\n\nThe response sets an updated encrypted `HttpOnly` cookie (`_zflow`)\nwith the new flow state. The server is stateless — all orchestration\nstate is carried in this cookie between requests.\n\n**Important:** The `id` in the response may differ from the `id` used in\nthe request. This happens when a flow pivots (pushes a new flow onto the\nstack) or when a stacked flow completes (auto-pops to the parent flow).\nAlways use the `id` from the latest response for the next request.\n\n## Flow completion\n\nWhen `step.type` is `complete`, the flow is terminal. The `step.behavior`\nfield tells the frontend what to do:\n\n| `behavior`   | Action                                                     |\n|------------- |------------------------------------------------------------|\n| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |\n| `show`       | Render the step as a success screen (e.g., registration).  |\n\nA `complete` step is only returned when the **entire flow stack** is done.\nIf a stacked flow (e.g., recovery pivoted from login) finishes, the server\nauto-pops to the parent flow and returns the parent's next step — the\nfrontend never sees a `complete` for intermediate flows.\n\n* @summary Submit step data and advance\n*/\nconst submitFlowStep = async (id, submitFlowStepBody, options) => {\n\treturn customFetch(getSubmitFlowStepUrl(id), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(submitFlowStepBody)\n\t});\n};\nconst getCreateAuthAttemptUrl = () => {\n\treturn `${getProxyPath()}/auth_attempts`;\n};\n/**\n* Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.\n\nAn attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.\nIt accepts factor challenges, verifies proofs, and completes into a session or handoff token.\n\nAccepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,\nalso include session_id to add factors to an existing session.\n\n* @summary Create a new authentication attempt\n*/\nconst createAuthAttempt = async (createAuthAttemptBody, options) => {\n\treturn customFetch(getCreateAuthAttemptUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createAuthAttemptBody)\n\t});\n};\nconst getGetAuthAttemptUrl = (attemptId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}`;\n};\n/**\n* Polls the current state of an authentication attempt.\n\nReturns the attempt's state, available factors for the next challenge,\nchallenges issued so far, and any errors preventing progress.\n\nUse this for polling during long-running factor verifications (e.g., waiting for\na federated IdP callback or a device flow).\n\n* @summary Get authentication attempt state\n*/\nconst getAuthAttempt = async (attemptId, options) => {\n\treturn customFetch(getGetAuthAttemptUrl(attemptId), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getIssueChallengeUrl = (attemptId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}/challenges`;\n};\n/**\n* Issues a single-factor verification challenge within an auth attempt.\n\nThis advances the authentication state machine by requesting a specific factor method\n(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details\nincluding method, metadata, and any UI hints. The client then verifies the proof\nby calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.\n\n* @summary Issue a factor challenge\n*/\nconst issueChallenge = async (attemptId, issueChallengeBody, options) => {\n\treturn customFetch(getIssueChallengeUrl(attemptId), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(issueChallengeBody)\n\t});\n};\nconst getVerifyChallengeProofUrl = (attemptId, challengeId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}/challenges/${challengeId}/verify`;\n};\n/**\n* Submits a proof (credential, code, assertion) to verify a factor challenge.\n\nThe proof format depends on the challenge method. For example:\n- `password` method: { password: \"…\" }\n- `totp` method: { totp: { code: \"123456\" } }\n- `passkey` method: { passkey: { assertion: \"…\" } }\n- `recovery_code` method: { recovery_code: \"…\" }\n\nOn successful verification, the factor is written to the auth attempt.\nThe attempt moves to the next pending challenge or completes if all required factors are verified.\n\n* @summary Verify a factor proof\n*/\nconst verifyChallengeProof = async (attemptId, challengeId, verifyChallengeProofBody, options) => {\n\treturn customFetch(getVerifyChallengeProofUrl(attemptId, challengeId), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(verifyChallengeProofBody)\n\t});\n};\nconst getCreateHandoffUrl = (attemptId) => {\n\treturn `${getProxyPath()}/auth_attempts/${attemptId}/handoff`;\n};\n/**\n* Completes the authentication attempt and mints a `handoff_token`.\n\nCall this after all required factors have been verified and the attempt is in `completed` state.\nThe handoff token is short-lived (≤60 seconds) and must be exchanged at\nPOST /sessions/exchange to receive the final session and session_token.\n\nThe handoff token is:\n- Single-use (atomic exchange, no retry)\n- Audience-bound (requires matching project key for exchange)\n- Idempotency-safe within a 5-minute window (see conventions)\n\n* @summary Complete authentication and create handoff token\n*/\nconst createHandoff = async (attemptId, options) => {\n\treturn customFetch(getCreateHandoffUrl(attemptId), {\n\t\t...options,\n\t\tmethod: \"POST\"\n\t});\n};\nconst getCreateProjectUrl = () => {\n\treturn `${getProxyPath()}/projects`;\n};\n/**\n* @summary Create project\n*/\nconst createProject = async (createProjectBody, options) => {\n\treturn customFetch(getCreateProjectUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createProjectBody)\n\t});\n};\nconst getQueryProjectsUrl = () => {\n\treturn `${getProxyPath()}/projects/query`;\n};\n/**\n* @summary Query projects\n*/\nconst queryProjects = async (queryProjectsBody, options) => {\n\treturn customFetch(getQueryProjectsUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(queryProjectsBody)\n\t});\n};\nconst getGetProjectUrl = (projectId) => {\n\treturn `${getProxyPath()}/projects/${projectId}`;\n};\n/**\n* Returns the current state of a project.\n\n* @summary Get project\n*/\nconst getProject = async (projectId, options) => {\n\treturn customFetch(getGetProjectUrl(projectId), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getPatchProjectUrl = (projectId) => {\n\treturn `${getProxyPath()}/projects/${projectId}`;\n};\n/**\n* Updates the state of a project.\n\n* @summary Update project\n*/\nconst patchProject = async (projectId, patchProjectBody, options) => {\n\treturn customFetch(getPatchProjectUrl(projectId), {\n\t\t...options,\n\t\tmethod: \"PATCH\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(patchProjectBody)\n\t});\n};\nconst getInitClaimUrl = (projectId) => {\n\treturn `${getProxyPath()}/projects/${projectId}/claim/init`;\n};\n/**\n* Starts a claim challenge for an unclaimed project. Authenticated by the\nproject secret, this mints a single-use, short-lived challenge and returns\nthe `claim_url` the developer opens in a browser to complete the claim,\ntogether with the `challenge_id` the CLI polls with. The exact expiry is\ncarried by `expires_at` on the response.\n\n* @summary Initialize a project claim\n*/\nconst initClaim = async (projectId, options) => {\n\treturn customFetch(getInitClaimUrl(projectId), {\n\t\t...options,\n\t\tmethod: \"POST\"\n\t});\n};\nconst getGetClaimStatusUrl = (projectId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/status`;\n};\n/**\n* Polled by the CLI while a browser completes the claim. Authorized by the\nproject secret that initiated the challenge. Returns `pending`, or\n`completed` with the owning team, the claim timestamp, and the dashboard\nURL once the browser leg has finished.\n\n* @summary Get claim status\n*/\nconst getClaimStatus = async (projectId, params, options) => {\n\treturn customFetch(getGetClaimStatusUrl(projectId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCompleteClaimUrl = (projectId) => {\n\treturn `${getProxyPath()}/projects/${projectId}/claim/complete`;\n};\n/**\n* Called by the browser after the developer authenticates on the claim page.\nAuthenticated by the `__nextgen_session` cookie, it attaches the project to\nthe developer's personal team using the `challenge_id` from the claim URL as\nits single-use, browser-safe authorization.\n\n* @summary Complete a project claim\n*/\nconst completeClaim = async (projectId, completeClaimBody, options) => {\n\treturn customFetch(getCompleteClaimUrl(projectId), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(completeClaimBody)\n\t});\n};\nconst getCreateSessionUrl = () => {\n\treturn `${getProxyPath()}/sessions`;\n};\n/**\n* Creates an anonymous session shell with no user and no factors (`state: building`).\n\nThis is optional — an `auth_attempt` will create a session implicitly if none is provided.\nUse this explicitly when you want to:\n- Pre-allocate a `session_id` before the user is known, so device/telemetry signals\ncan be correlated with the eventual authenticated session from the start.\n- Track anonymous state (bot detection, device fingerprint) that survives until authentication.\n\nCreating a session is an app-plane operation on the project credential\n(`session.write`). The returned `session_token` is a session credential for the\nend-user client, not a management scope: it is delivered as the\n`__nextgen_session` cookie and authorises the self-service operations\n`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The\nby-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`\nare operator endpoints and require `session.read` / `session.delete` instead.\n\nThe `session_token` is superseded when a handoff exchange completes — clients must\nreplace it at that point.\n\nAnonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured\nfull session TTL when the first authentication factor is written via a completing `auth_attempt`.\n\n* @summary Create an anonymous session shell\n*/\nconst createSession = async (createSessionBody, options) => {\n\treturn customFetch(getCreateSessionUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createSessionBody)\n\t});\n};\nconst getQuerySessionsUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/query?${stringifiedParams}` : `${getProxyPath()}/sessions/query`;\n};\n/**\n* Returns the sessions of a project, paginated with a cursor.\nSessions of every lifecycle state are returned; each carries its `state`.\nRequires `session.read` permission.\n\n* @summary Query sessions\n*/\nconst querySessions = async (querySessionsBody, params, options) => {\n\treturn customFetch(getQuerySessionsUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(querySessionsBody)\n\t});\n};\nconst getExchangeHandoffUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/exchange?${stringifiedParams}` : `${getProxyPath()}/sessions/exchange`;\n};\n/**\n* Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`\nand returns the resulting session and a `session_token`.\n\nThe server resolves the originating `auth_attempt` from the token and then:\n\n| Originating auth_attempt | Outcome |\n|---|---|\n| No `session_id` | A new authenticated session is **created**. |\n| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |\n| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |\n\nThe response shape is identical in all three cases.\n\nThe `session_token` supersedes any previously issued `session_token` for the same session.\nClients must replace their stored token at this point.\n\nRequires a project service key (OAuth2 client credentials).\n\n* @summary Exchange handoff token for a session\n*/\nconst exchangeHandoff = async (exchangeHandoffBody, params, options) => {\n\treturn customFetch(getExchangeHandoffUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(exchangeHandoffBody)\n\t});\n};\nconst getGetSessionUrl = (sessionId) => {\n\treturn `${getProxyPath()}/sessions/${sessionId}`;\n};\n/**\n* Returns the current state of a session including its factors and all currently\nsatisfied assurance levels.\n\n`assurance_levels[]` may shrink over time as factor freshness windows expire,\nwithout the session itself expiring. Use step-up authentication (a new `auth_attempt`\nagainst the same `session_id`) to restore a dropped assurance level.\n\n* @summary Get session state\n*/\nconst getSession = async (sessionId, options) => {\n\treturn customFetch(getGetSessionUrl(sessionId), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getRevokeSessionUrl = (sessionId) => {\n\treturn `${getProxyPath()}/sessions/${sessionId}`;\n};\n/**\n* Permanently deletes the session, terminating it immediately.\n\nThis is the operator revoke path and requires the `session.delete` scope on a\nproject-bound credential. End-user logout with the `__nextgen_session` cookie is\n`DELETE /sessions/me` (`nextgenSession` scheme).\n\nIdempotent: deleting a session that does not exist (or was already deleted)\nstill returns 204. After deletion, any tokens derived from the session are\ninvalidated.\n\n* @summary Revoke session\n*/\nconst revokeSession = async (sessionId, options) => {\n\treturn customFetch(getRevokeSessionUrl(sessionId), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getGetMySessionUrl = () => {\n\treturn `${getProxyPath()}/sessions/me`;\n};\n/**\n* Returns the current state of the current session including its factors and all currently\nsatisfied assurance levels.\n\n`assurance_levels[]` may shrink over time as factor freshness windows expire,\nwithout the session itself expiring. Use step-up authentication (a new `auth_attempt`\nagainst the same `session_id`) to restore a dropped assurance level.\n\n* @summary Get my session state\n*/\nconst getMySession = async (options) => {\n\treturn customFetch(getGetMySessionUrl(), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getRevokeMySessionUrl = () => {\n\treturn `${getProxyPath()}/sessions/me`;\n};\n/**\n* Logs out by permanently deleting the session.\n\nThe `__nextgen_session` cookie issued at creation (or superseded by a handoff\nexchange) is required. Idempotent: if the session is already gone this still\nreturns 204. Any tokens derived from the session are invalidated, and the\ncookie itself is cleared in the response.\n\n* @summary Revoke my session\n*/\nconst revokeMySession = async (options) => {\n\treturn customFetch(getRevokeMySessionUrl(), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getCreateSchemaUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;\n};\n/**\n* Create a new schema. The optional `$id` field is the JSON Schema document\nURI used to identify the schema in future requests (GitOps-stable identity,\nnot a free-form resource primary key). When `$id` is omitted, the server\ngenerates a `sch_*` URL. When provided, `$id` must be unique within the\nproject and should ideally be a valid URI pointing at where the schema can\nbe accessed.\n\nThe schema can either be a concrete schema, e.g. a user schema, or a\nschema-url which will be resolved by the server.\n\n* @summary Create new schema\n*/\nconst createSchema = async (createSchemaBody, params, options) => {\n\treturn customFetch(getCreateSchemaUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createSchemaBody)\n\t});\n};\nconst getListSchemasUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;\n};\n/**\n* Retrieve a list of all schemas available in the system. This endpoint\nsupports pagination and filtering based on schema attributes.\n\n* @summary List all schemas\n*/\nconst listSchemas = async (params, options) => {\n\treturn customFetch(getListSchemasUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetSchemaByIdUrl = (id, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;\n};\n/**\n* Get a schema by its ID. A schema ID identifies one immutable revision, so\nthis returns exactly that revision. To find the current revision of an\nobject type, list with `revisions=latest`.\n\n* @summary Get schema by ID\n*/\nconst getSchemaById = async (id, params, options) => {\n\treturn customFetch(getGetSchemaByIdUrl(id, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateFlowDefinitionUrl = () => {\n\treturn `${getProxyPath()}/flow_definitions`;\n};\n/**\n* Creates a new flow definition.\nFlow definitions are templates that define the sequence of steps (capabilities)\nfor a particular user journey (e.g., registration, login, password reset).\n\nFlow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.\n\n* @summary Create a new flow definition\n*/\nconst createFlowDefinition = async (createFlowDefinitionBody, options) => {\n\treturn customFetch(getCreateFlowDefinitionUrl(), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createFlowDefinitionBody)\n\t});\n};\nconst getListFlowDefinitionsUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions?${stringifiedParams}` : `${getProxyPath()}/flow_definitions`;\n};\n/**\n* Retrieves a list of all flow definitions.\nThis endpoint can be used to view existing flow definitions and their configurations.\n\n* @summary List flow definitions\n*/\nconst listFlowDefinitions = async (params, options) => {\n\treturn customFetch(getListFlowDefinitionsUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetFlowDefinitionUrl = (id) => {\n\treturn `${getProxyPath()}/flow_definitions/${id}`;\n};\n/**\n* Get a flow definition by id\n* @summary Get a flow definition by id\n*/\nconst getFlowDefinition = async (id, options) => {\n\treturn customFetch(getGetFlowDefinitionUrl(id), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getUpdateFlowDefinitionUrl = (id) => {\n\treturn `${getProxyPath()}/flow_definitions/${id}`;\n};\n/**\n* Update a flow definition by id. This endpoint replaces the existing flow definition.\nIf `flow_definition.status` is omitted, the current status is preserved\n\n* @summary Update a flow definition by id\n*/\nconst updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {\n\treturn customFetch(getUpdateFlowDefinitionUrl(id), {\n\t\t...options,\n\t\tmethod: \"PUT\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(updateFlowDefinitionBody)\n\t});\n};\nconst getDeleteFlowDefinitionUrl = (id) => {\n\treturn `${getProxyPath()}/flow_definitions/${id}`;\n};\n/**\n* Delete a flow definition by id.\nIf the flow definition is currently being used by a flow, the deletion will fail.\nIf the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.\n\n* @summary Delete a flow definition by id\n*/\nconst deleteFlowDefinition = async (id, options) => {\n\treturn customFetch(getDeleteFlowDefinitionUrl(id), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getCreateTeamUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;\n};\n/**\n* @summary Create team\n*/\nconst createTeam = async (createTeamBody, params, options) => {\n\treturn customFetch(getCreateTeamUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createTeamBody)\n\t});\n};\nconst getQueryTeamsUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/teams/query?${stringifiedParams}` : `${getProxyPath()}/teams/query`;\n};\n/**\n* Returns the teams of a project, paginated with a cursor.\n\n* @summary Query teams\n*/\nconst queryTeams = async (queryTeamsBody, params, options) => {\n\treturn customFetch(getQueryTeamsUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(queryTeamsBody)\n\t});\n};\nconst getGetTeamUrl = (teamId) => {\n\treturn `${getProxyPath()}/teams/${teamId}`;\n};\n/**\n* Returns a Team by its id.\n\n* @summary Get team\n*/\nconst getTeam = async (teamId, options) => {\n\treturn customFetch(getGetTeamUrl(teamId), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getDeleteTeamUrl = (teamId) => {\n\treturn `${getProxyPath()}/teams/${teamId}`;\n};\n/**\n* Deactivates the team.\n\nThe team is tombstoned rather than erased: it stays readable through\ngetTeam with status `deactivated`. Its memberships are removed and the\nusers whose lifecycle it owns are deactivated with it.\n\nThe request is idempotent. Deleting a team that is already deactivated\nor doesn't exist succeeds without changing anything.\n\n* @summary Delete team\n*/\nconst deleteTeam = async (teamId, options) => {\n\treturn customFetch(getDeleteTeamUrl(teamId), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getUpdateTeamUrl = (teamId) => {\n\treturn `${getProxyPath()}/teams/${teamId}`;\n};\n/**\n* Update team. Only active teams can be updated.\n\n* @summary Update team\n*/\nconst updateTeam = async (teamId, updateTeamBody, options) => {\n\treturn customFetch(getUpdateTeamUrl(teamId), {\n\t\t...options,\n\t\tmethod: \"PATCH\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(updateTeamBody)\n\t});\n};\nconst getListEnvironmentsUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/environments?${stringifiedParams}` : `${getProxyPath()}/environments`;\n};\n/**\n* Lists the project's environments ordered by name.\n\n* @summary List environments\n*/\nconst listEnvironments = async (params, options) => {\n\treturn customFetch(getListEnvironmentsUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetEnvironmentByNameUrl = (name, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/environments/${name}?${stringifiedParams}` : `${getProxyPath()}/environments/${name}`;\n};\n/**\n* Reads one environment of the project by its name.\n\nThe lookup is scoped to the project in `project_id`: a name that exists in\nanother project answers `env.not_found` exactly as an unused name does.\n\n* @summary Get an environment by name\n*/\nconst getEnvironmentByName = async (name, params, options) => {\n\treturn customFetch(getGetEnvironmentByNameUrl(name, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateBrandingUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;\n};\n/**\n* Publishes a new immutable branding revision for the project. Branding\nrevisions cannot be updated or deleted; every edit publishes a new\nrevision, and flow responses resolve the latest revision per project\n(see ADR 040).\n\nThe `liquid_template` is validated lexically on save (size, encoding,\nbanned patterns such as `<script>` tags, inline event handlers, and the\n`| raw` filter). Authoritative LiquidJS validation runs at authoring\ntime via `zitadel plan` / `zitadel apply`.\n\n* @summary Publish a new branding revision\n*/\nconst createBranding = async (createBrandingBody, params, options) => {\n\treturn customFetch(getCreateBrandingUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createBrandingBody)\n\t});\n};\nconst getListBrandingUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;\n};\n/**\n* Lists branding revisions for the project, newest first, capped at the\n100 most recent. The first entry is the revision flow responses\ncurrently resolve. Deliberately unpaginated in v1 — list endpoints\ngain a real query mechanism together (ADR 031); advertising pagination\nparameters the server ignores would be worse than none.\n\n* @summary List branding revisions\n*/\nconst listBranding = async (params, options) => {\n\treturn customFetch(getListBrandingUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetBrandingByIdUrl = (id) => {\n\treturn `${getProxyPath()}/branding/${id}`;\n};\n/**\n* Retrieves a single branding revision, including its stored configuration.\n* @summary Get a branding revision by ID\n*/\nconst getBrandingById = async (id, options) => {\n\treturn customFetch(getGetBrandingByIdUrl(id), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateReleaseUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;\n};\n/**\n* Bundles a release from revisions that already exist, supplied as\n`(kind, revision_id)` pairs. No new revisions are allocated — use the\nper-kind create endpoints for that, then pin the ids here.\n\nEvery referenced `revision_id` must exist in the project. Each one's handle\nis read from the revision itself and recorded on the release, so a resource\nis always pinned under the identity it declares.\n\nCreating a release does not deploy it. A release is environment-agnostic\nand the same release can later be deployed to any number of environments\nunchanged.\n\nIdempotent on the pinned set: metadata is excluded from the comparison, so\nre-submitting the same revisions with a different `message` returns the\nrelease that already pins them rather than creating a second one.\n\n* @summary Create a release\n*/\nconst createRelease = async (createReleaseBody, params, options) => {\n\treturn customFetch(getCreateReleaseUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createReleaseBody)\n\t});\n};\nconst getListReleasesUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;\n};\n/**\n* Lists the project's releases, newest first.\n\nEntries carry metadata only — the pinned set is omitted. Read one release\nwith `GET /releases/{release_id}` to get its pointers.\n\n* @summary List releases\n*/\nconst listReleases = async (params, options) => {\n\treturn customFetch(getListReleasesUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetReleaseByIdUrl = (releaseId, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/releases/${releaseId}?${stringifiedParams}` : `${getProxyPath()}/releases/${releaseId}`;\n};\n/**\n* Reads one release: its metadata and the `(kind, handle, revision_id)`\ntuples it pins.\n\nDoes not embed resource content. Resolve each `revision_id` through the\nper-kind read endpoints when the bytes are needed.\n\nThe lookup is scoped to the project in `project_id`: a release id belonging\nto another project answers not found exactly as an unknown id does, so the\nendpoint cannot be used to probe for releases in projects the caller cannot\nread.\n\n* @summary Get a release by id\n*/\nconst getReleaseById = async (releaseId, params, options) => {\n\treturn customFetch(getGetReleaseByIdUrl(releaseId, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getCreateGrantUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/grants?${stringifiedParams}` : `${getProxyPath()}/grants`;\n};\n/**\n* Bind a user or team to `project.viewer`, `project.editor`, or\n`project.admin` on the project identified by the `project-id` header.\nIDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not\ncreated here — claim owns that path. An unrevoked grant with the same\nprincipal and relation occupies the unique key even after `expires_at`;\nDELETE it before re-creating.\n\n* @summary Create grant\n*/\nconst createGrant = async (createGrantBody, params, options) => {\n\treturn customFetch(getCreateGrantUrl(params), {\n\t\t...options,\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...options?.headers\n\t\t},\n\t\tbody: JSON.stringify(createGrantBody)\n\t});\n};\nconst getGetGrantUrl = (id, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;\n};\n/**\n* Loads a grant by `(project_id, id)` that this API manages (user or team\nbound to viewer, editor, or admin) and that has not been revoked.\n\"Active\" here means not revoked: expired grants stay visible so the\nclient can DELETE before re-granting the same binding. Authorization\nstill ignores expired grants. Grants are not registered in\n`resource_scope_index`; project scope is required on the query (same as\nevents). Misses, revoked rows, project-secret setup (`sk_proj`),\nowning-team (`relation=team`) rows, and cross-project ids return 404.\n\n* @summary Get grant\n*/\nconst getGrant = async (id, params, options) => {\n\treturn customFetch(getGetGrantUrl(id, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getDeleteGrantUrl = (id, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;\n};\n/**\n* Soft-revokes a grant this API manages and emits `authz.revoked`.\nAlready-revoked, missing, project-secret setup, and owning-team grants\nreturn 404. The row is not un-revoked. Expired grants can still be\nrevoked so the unique binding can be reused.\n\n* @summary Revoke grant\n*/\nconst deleteGrant = async (id, params, options) => {\n\treturn customFetch(getDeleteGrantUrl(id, params), {\n\t\t...options,\n\t\tmethod: \"DELETE\"\n\t});\n};\nconst getListEventsUrl = (params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (Array.isArray(value) && [\"category\", \"event_type\"].includes(key)) {\n\t\t\tvalue.forEach((v) => {\n\t\t\t\tnormalizedParams.append(key, v === null ? \"null\" : v.toString());\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/events?${stringifiedParams}` : `${getProxyPath()}/events`;\n};\n/**\n* Returns project-scoped audit events, newest-first by keyset on\n`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.\nRequires `events.read`.\n\nPre-claim projects return an empty list (events are stored but not\nvisible until claim succeeds). Team-scoped credentials see only events\nwhose emit-time `team_id` matches the credential team (enforced when\nteam-scoped tokens exist).\n\nClients discriminate each item via `event_type` (OpenAPI Event oneOf) —\nsee docs/design/api/events-catalog.md.\n\n* @summary List events\n*/\nconst listEvents = async (params, options) => {\n\treturn customFetch(getListEventsUrl(params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\nconst getGetEventUrl = (id, params) => {\n\tconst normalizedParams = new URLSearchParams();\n\tObject.entries(params || {}).forEach(([key, value]) => {\n\t\tif (value !== void 0) normalizedParams.append(key, value === null ? \"null\" : value.toString());\n\t});\n\tconst stringifiedParams = normalizedParams.toString();\n\treturn stringifiedParams.length > 0 ? `${getProxyPath()}/events/${id}?${stringifiedParams}` : `${getProxyPath()}/events/${id}`;\n};\n/**\n* Loads a single event by `(project_id, id)`. Requires `events.read`.\nEvents are not registered in `resource_scope_index`; project scope is\nrequired on the query (ADR 049). Misses and cross-project ids return 404.\n\nPre-claim projects return 404 (stored events stay invisible until claim).\n\n* @summary Get event by ID\n*/\nconst getEvent = async (id, params, options) => {\n\treturn customFetch(getGetEventUrl(id, params), {\n\t\t...options,\n\t\tmethod: \"GET\"\n\t});\n};\n//#endregion\nexport { beginUserPasskeyRegistration, completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createGrant, createHandoff, createProject, createRelease, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, deleteGrant, deleteTeam, deleteUserByID, exchangeHandoff, finishUserPasskeyRegistration, getAuthAttempt, getBeginUserPasskeyRegistrationUrl, getBrandingById, getClaimStatus, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateGrantUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateReleaseUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getDeleteGrantUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getEnvironmentByName, getEvent, getExchangeHandoffUrl, getFinishUserPasskeyRegistrationUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetEnvironmentByNameUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetGrantUrl, getGetHealthUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetReleaseByIdUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getGrant, getHealth, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEnvironmentsUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListReleasesUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getLive, getMySession, getMyUser, getPatchProjectUrl, getProject, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getQueryUsersUrl, getReady, getReleaseById, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateFlowDefinitionUrl, getUpdateTeamUrl, getUserByID, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEnvironments, listEvents, listFlowDefinitions, listReleases, listSchemas, listUserPasskeys, listUserTeams, patchProject, queryProjects, querySessions, queryTeams, queryUsers, revokeMySession, revokeSession, setUserPassword, submitFlowStep, zitadelNextGen_exports as t, updateFlowDefinition, updateTeam, verifyChallengeProof };\n\n//# sourceMappingURL=zitadelNextGen.mjs.map","import { setProxyPath } from \"./base-url.mjs\";\nimport { setApiAuthToken } from \"./auth.mjs\";\nimport { t as zitadelNextGen_exports } from \"../generated/endpoints/zitadelNextGen.mjs\";\n//#region src/runtime/api-factory.ts\n/**\n* Factory for the typed Zitadel client every consumer reaches for.\n*\n* Wraps the orval-generated endpoints in a {@link Proxy} so each\n* generated function sees the right base URL and (optionally) the\n* right bearer token at call time — without the caller having to\n* thread either through every operation, and without exposing the\n* module-globals (`setProxyPath` / `setApiAuthToken`) as part of the\n* public API.\n*\n* Per-instance isolation: multiple clients can coexist in one process\n* (different servers, different tokens). Their Proxy `get` traps set\n* the globals synchronously before invoking the underlying generated\n* function, which reads them at the top of `customFetch` before any\n* `await`. Two clients running interleaved within a single JS turn\n* are safe; two clients running in parallel across awaits could\n* clobber each other — not a pattern any current consumer uses.\n*/\n/**\n* Build a typed Zitadel client pre-bound to a base URL and (optionally)\n* a bearer token. Every method on the returned object mirrors a\n* generated orval function:\n*\n*     const client = createZitadelClient({ baseUrl, token });\n*     await client.createProject({ preview_origins: [] });\n*     await client.createSchema(body, { project_id });\n*/\nfunction createZitadelClient(opts) {\n\tlet baseUrl = opts.baseUrl;\n\twhile (baseUrl.endsWith(\"/\")) baseUrl = baseUrl.slice(0, -1);\n\treturn new Proxy(zitadelNextGen_exports, { get(target, prop, receiver) {\n\t\tconst value = Reflect.get(target, prop, receiver);\n\t\tif (typeof value !== \"function\") return value;\n\t\treturn (...args) => {\n\t\t\tsetProxyPath(baseUrl);\n\t\t\tsetApiAuthToken(opts.token);\n\t\t\treturn value(...args);\n\t\t};\n\t} });\n}\n/**\n* Legacy entry point: builds a client with only the base URL set, no\n* token. Components and SDKs that don't carry an auth token (browser\n* flows authenticated by platform cookies) still consume this name.\n* Equivalent to `createZitadelClient({ baseUrl: apiBase })`.\n*/\nfunction createApi(apiBase) {\n\treturn createZitadelClient({ baseUrl: apiBase });\n}\n//#endregion\nexport { createApi, createZitadelClient };\n\n//# sourceMappingURL=api-factory.mjs.map","import { setProxyPath } from \"./base-url.mjs\";\nimport { createZitadelClient } from \"./api-factory.mjs\";\n//#region src/runtime/config.ts\n/**\n* Slot for the configured project, stored on `globalThis` under a\n* {@link Symbol.for} key. Every copy of this module evaluated in the\n* same JS realm resolves the symbol through the global symbol registry\n* to the same identity, so they all read and write a single slot —\n* needed because the standalone components bundle inlines its own copy\n* of this file, and dual-package hazards / monorepo duplicates can load\n* a second copy alongside the app's. With a module-local `let` each\n* instance kept its own singleton and `configureZitadel()` calls in one\n* were invisible to `getZitadelConfig()` calls in another. Sharing is\n* realm-scoped — separate realms (iframes, Node `vm` contexts, worker\n* threads) have their own registries and are not unified by this.\n*/\nconst PROJECT_SLOT = Symbol.for(\"@zitadel/api/config:currentProject\");\nfunction readSlot() {\n\treturn globalThis[PROJECT_SLOT] ?? null;\n}\nfunction writeSlot(value) {\n\tglobalThis[PROJECT_SLOT] = value;\n}\n/**\n* Per-project API client cache. Ensures `getApi(project)` returns the\n* same instance for the same project handle — no re-wrapping on every call.\n* Module-local on purpose: keyed by the shared frozen `ZitadelProject`\n* object identity, so cross-instance reads still resolve through the\n* same key and at worst memoize once per module instance.\n*/\nconst apiCache = /* @__PURE__ */ new WeakMap();\n/**\n* Initializes app-wide SDK configuration and returns the frozen\n* {@link ZitadelProject} handle.\n*\n* Write-once — subsequent calls with the same values return the original\n* handle; calls with different values log a warning and return the\n* original. This prevents accidental overwrites while remaining safe\n* for HMR and framework double-mounts.\n*/\nfunction configureZitadel(config) {\n\tconst resolvedProxyPath = config.proxyPath ?? \"/__nextgen\";\n\tconst existing = readSlot();\n\tif (existing !== null) {\n\t\tif (existing.proxyPath === resolvedProxyPath && existing.projectId === config.projectId && existing.url === config.url && existing.publishableKey === config.publishableKey) {\n\t\t\tsetProxyPath(resolvedProxyPath);\n\t\t\treturn existing;\n\t\t}\n\t\tconsole.warn(`[zitadel] configureZitadel() already called with different values. Ignoring: ${JSON.stringify(config)}`);\n\t\tsetProxyPath(existing.proxyPath);\n\t\treturn existing;\n\t}\n\tconst project = Object.freeze({\n\t\tproxyPath: resolvedProxyPath,\n\t\tprojectId: config.projectId,\n\t\turl: config.url,\n\t\tpublishableKey: config.publishableKey\n\t});\n\twriteSlot(project);\n\tsetProxyPath(resolvedProxyPath);\n\treturn project;\n}\n/**\n* Returns a typed API client for the given project, with the base URL\n* pre-bound. Cached per project handle — safe to call multiple times.\n*\n* ```ts\n* const project = configureZitadel({ ... });\n* export const api = getApi(project);\n* ```\n*/\nfunction getApi(project) {\n\tlet api = apiCache.get(project);\n\tif (!api) {\n\t\tapi = createZitadelClient({\n\t\t\tbaseUrl: project.proxyPath,\n\t\t\ttoken: project.publishableKey\n\t\t});\n\t\tapiCache.set(project, api);\n\t}\n\treturn api;\n}\n/**\n* Returns the current project handle, or `null` if {@link configureZitadel}\n* has not been called yet.\n*/\nfunction getZitadelConfig() {\n\treturn readSlot();\n}\n/**\n* Reset internal state. **Test-only**, and not part of the supported\n* public API even though the `./config` subpath ships every binding in\n* this module: the leading `_` marks it as private and the behaviour\n* is free to change without notice. Lets tests call `configureZitadel()`\n* multiple times across isolated cases without the write-once guard\n* rejecting them.\n*/\nfunction _resetConfigForTesting() {\n\twriteSlot(null);\n\tsetProxyPath(\"\");\n}\n//#endregion\nexport { _resetConfigForTesting, configureZitadel, getApi, getZitadelConfig };\n\n//# sourceMappingURL=config.mjs.map","import {\n  getApi,\n  getZitadelConfig,\n  type ZitadelApi,\n  type ZitadelProject,\n} from \"@zitadel/api/config\";\n\n/** Matches the `configureZitadel()` default so attribute and JS config agree. */\nconst DEFAULT_PROXY_PATH = \"/__nextgen\";\n\n/**\n * Declarative configuration read from an element's HTML attributes\n * (`project-id` / `proxy-path` / `url`). Empty strings mean \"unset\".\n */\nexport interface ProjectAttrs {\n  readonly projectId: string;\n  readonly proxyPath: string;\n  readonly url: string;\n}\n\n/**\n * Cache of project handles synthesized from attributes, keyed by their value\n * tuple. `getApi()` caches its client in a `WeakMap` keyed by the project's\n * identity, so the same attribute values must yield the *same* frozen object\n * across the several `resolveApi()` calls a single flow makes — otherwise\n * every call misses the cache and re-wraps a fresh client. A real page uses a\n * handful of distinct configs at most; the FIFO bound below is just a guard so\n * a pathological page that churns through unique configs can't leak memory.\n */\nconst MAX_SYNTHETIC_PROJECTS = 32;\nconst syntheticProjects = new Map<string, ZitadelProject>();\n\n/**\n * Builds a `ZitadelProject` from declarative attributes, or `undefined` when\n * no `project-id` was given (nothing to configure). Mirrors\n * `configureZitadel()`'s proxy-path defaulting so the two config paths are\n * interchangeable.\n */\nfunction projectFromAttrs({ projectId, proxyPath, url }: ProjectAttrs): ZitadelProject | undefined {\n  if (!projectId) return undefined;\n  const resolvedProxyPath = proxyPath || DEFAULT_PROXY_PATH;\n  const resolvedUrl = url || undefined;\n  const key = JSON.stringify([projectId, resolvedProxyPath, resolvedUrl ?? \"\"]);\n  let project = syntheticProjects.get(key);\n  if (!project) {\n    project = Object.freeze({ projectId, proxyPath: resolvedProxyPath, url: resolvedUrl });\n    if (syntheticProjects.size >= MAX_SYNTHETIC_PROJECTS) {\n      const oldest = syntheticProjects.keys().next().value;\n      if (oldest !== undefined) {\n        syntheticProjects.delete(oldest);\n      }\n    }\n    syntheticProjects.set(key, project);\n  }\n  return project;\n}\n\n/**\n * Resolves the effective SDK project handle and its typed API client for an\n * orchestrator element. Precedence, highest first:\n *\n * 1. the element's `project` property (an SDK handle set from JS / a framework),\n * 2. the global handle from `configureZitadel()`,\n * 3. the `project-id` / `proxy-path` / `url` attributes set declaratively in HTML.\n *\n * Both JS paths (property and global) win over the declarative attributes, so a\n * deliberate `configureZitadel()` is never silently overridden by fallback or\n * stale HTML attributes; the attributes are the no-JS fallback.\n *\n * Both `<zitadel-login>` and `<zitadel-logout>` need the same resolution and\n * the same \"no config\" failure, so it lives here rather than being copied\n * into each element. Callers run this inside their try/catch so a missing\n * configuration surfaces through the element's normal error path rather than\n * as an unhandled rejection.\n *\n * @param project Optional per-element override handle.\n * @param attrs Declarative config read from the element's attributes.\n * @param element Tag name used in the thrown error (e.g. `<zitadel-login>`).\n */\nexport function resolveApi(\n  project: ZitadelProject | undefined,\n  attrs: ProjectAttrs,\n  element: string,\n): { project: ZitadelProject; api: ZitadelApi } {\n  const cfg = project ?? getZitadelConfig() ?? projectFromAttrs(attrs);\n  if (!cfg) {\n    throw new Error(\n      `${element} requires a configured project: set the \\`project-id\\` attribute, ` +\n        `set the \\`project\\` property, or call configureZitadel().`,\n    );\n  }\n  return { project: cfg, api: getApi(cfg) };\n}\n","/**\n * Layer 2 of the template security pipeline (`docs/design/flowengine/template-security.md`).\n *\n * Wraps DOMPurify with the configuration the auth-UI templates need:\n *\n * - Allow every `<zl-*>` custom element registered in the manifest registry,\n *   plus the union of attributes declared on each manifest.\n * - Allow common HTML structural / typographic tags used by `default.liquid`.\n * - Strip `on*` event handlers and any `<script>` / `<style>` tags (theming is\n *   orchestrator-owned via `adoptedStyleSheets`).\n *\n * Runs after Liquid finishes rendering and before the HTML is handed to Lit's\n * `unsafeHTML` directive.\n */\nimport DOMPurify, { type Config } from \"dompurify\";\n\nimport { manifestRegistry } from \"../manifests.js\";\n\n/**\n * Standard HTML tags that templates may use as structural chrome around\n * `<zl-*>` atoms. Anything outside this list and the manifest registry is\n * stripped at sanitise-time.\n */\nconst STRUCTURAL_TAGS: readonly string[] = [\n  \"div\",\n  \"span\",\n  \"p\",\n  \"small\",\n  \"strong\",\n  \"em\",\n  \"br\",\n  \"hr\",\n  \"h1\",\n  \"h2\",\n  \"h3\",\n  \"h4\",\n  \"h5\",\n  \"h6\",\n  \"ul\",\n  \"ol\",\n  \"li\",\n  \"a\",\n  \"img\",\n  \"section\",\n  \"header\",\n  \"footer\",\n  \"main\",\n  \"nav\",\n  \"aside\",\n  \"article\",\n  \"figure\",\n  \"figcaption\",\n  \"label\",\n  \"fieldset\",\n  \"legend\",\n];\n\n/**\n * Attributes templates may carry on structural tags. Per-atom attributes are\n * derived from the manifest registry below — manifests are the single source\n * of truth for \"what attributes does `<zl-field>` accept?\".\n */\nconst COMMON_ATTRS: readonly string[] = [\n  \"id\",\n  \"class\",\n  \"role\",\n  \"slot\",\n  \"tabindex\",\n  \"lang\",\n  \"dir\",\n  \"alt\",\n  \"title\",\n  \"src\",\n  \"srcset\",\n  \"sizes\",\n  \"href\",\n  \"target\",\n  \"rel\",\n  \"style\",\n  \"name\",\n  \"for\",\n  \"data-testid\",\n  \"data-theme\",\n  \"hidden\",\n];\n\nconst CUSTOM_TAG_PATTERN = /^zl-[a-z0-9-]+$/;\n\nfunction buildAllowedTagList(): string[] {\n  const set = new Set<string>(STRUCTURAL_TAGS);\n  for (const manifest of manifestRegistry) {\n    set.add(manifest.tag);\n  }\n  return [...set];\n}\n\nfunction buildAllowedAttrList(): string[] {\n  const set = new Set<string>(COMMON_ATTRS);\n  for (const manifest of manifestRegistry) {\n    for (const attr of manifest.attrs) {\n      set.add(attr);\n    }\n  }\n  return [...set];\n}\n\n/**\n * Returns a sanitiser bound to the current manifest registry. Callers should\n * cache the result; rebuilding is cheap but allocates a fresh DOMPurify config.\n */\nexport function createSanitiser(): (html: string) => string {\n  const config: Config = {\n    USE_PROFILES: { html: true },\n    ADD_TAGS: buildAllowedTagList(),\n    ADD_ATTR: buildAllowedAttrList(),\n    FORBID_TAGS: [\"script\", \"style\", \"iframe\", \"object\", \"embed\", \"form\", \"input\", \"button\"],\n    FORBID_ATTR: [\"onerror\", \"onclick\", \"onload\", \"onfocus\", \"onblur\"],\n    CUSTOM_ELEMENT_HANDLING: {\n      tagNameCheck: CUSTOM_TAG_PATTERN,\n      attributeNameCheck: /^(?:[a-z][a-z0-9-]*)$/,\n      allowCustomizedBuiltInElements: false,\n    },\n    KEEP_CONTENT: true,\n    ALLOW_DATA_ATTR: true,\n    ALLOW_ARIA_ATTR: true,\n    RETURN_TRUSTED_TYPE: false,\n  };\n\n  return function sanitise(html: string): string {\n    const result = DOMPurify.sanitize(html, config);\n    return typeof result === \"string\" ? result : String(result);\n  };\n}\n","/**\n * Branding -> CSS token bridge.\n *\n * Per `docs/design/branding/README.md` the orchestrator owns theming. Templates\n * never emit `<style>` blocks; they only structure HTML. This module translates\n * the `Branding` JSON into a CSSStyleSheet of `:host { --zl-* }` declarations\n * and applies it via `shadowRoot.adoptedStyleSheets`.\n *\n * Dark-mode overrides are emitted as `:host([data-theme=\"dark\"]) { ... }`\n * (matching `docs/design/branding/tokens.md`). Resolution between\n * `light | dark | auto` happens in `<zitadel-login>`.\n *\n * Base layer: the design-tokens package ships the full `--zl-*` set as both a\n * `.css` file (for host pages) and a `tokensCss` string (for shadow roots and\n * SSR). We adopt the string into every orchestrator shadow root so atoms\n * paint correctly even when the host page didn't `@import` tokens.css — the\n * orchestrator is meant to drop into any page.\n */\nimport { THEME_SELECTORS, tokensCss } from \"@zitadel/design-tokens\";\n\nimport type { ResolvedTheme } from \"./theme-controller.js\";\nimport type { Branding, BrandingPalette, BrandingShape, BrandingTypography } from \"./branding.js\";\n\n// Radius tokens (Figma corner-radius scale). Branding lets a tenant pick\n// one of five shapes; we override all three corner sizes in proportion.\nconst RADIUS_MAP: Record<NonNullable<BrandingShape[\"radius\"]>, string> = {\n  none: \"0\",\n  sm: \"0.25rem\",\n  md: \"0.5rem\",\n  lg: \"0.75rem\",\n  full: \"9999px\",\n};\n\n// Branding lets tenants tune perceived density. Padding bands are the\n// most visible knob; height tweaks come from the Figma button/field heights.\nconst DENSITY_MAP: Record<NonNullable<BrandingShape[\"density\"]>, Record<string, string>> = {\n  compact: {\n    \"--zl-spacing-4\": \"0.75rem\",\n    \"--zl-spacing-8\": \"1.5rem\",\n  },\n  regular: {},\n  comfortable: {\n    \"--zl-spacing-4\": \"1.25rem\",\n    \"--zl-spacing-8\": \"2.25rem\",\n  },\n};\n\n// Mapping from the Branding palette keys (stable, public API for tenants) to\n// the design-tokens variable names that atoms actually consume. The keys are\n// intentionally semantic — tenants do NOT see internal token names; they say\n// \"background\", \"surface\", \"primary\", \"text\". The orchestrator translates here,\n// which is what lets the internal vocabulary move (as it just did, off the\n// legacy `--zl-color-*` names onto the shadcn roles) without touching a single\n// tenant's `branding.json`.\n//\n// A key maps to more than one variable where the design system splits a role\n// the tenant-facing API deliberately does not: a brand picks one \"border\"\n// colour, and both the card edge and the control edge take it.\nconst PALETTE_MAP: Record<keyof BrandingPalette, string[]> = {\n  primary: [\"--zl-primary\"],\n  on_primary: [\"--zl-primary-foreground\"],\n  background: [\"--zl-background\"],\n  surface: [\"--zl-card\", \"--zl-popover\"],\n  muted: [\"--zl-muted\", \"--zl-secondary\", \"--zl-accent\"],\n  border: [\"--zl-border\", \"--zl-input\"],\n  // Every neutral surface's text, not just the page's. A brand that sets a\n  // light `muted` on a dark-resolving widget would otherwise keep the default\n  // near-white label on it — the secondary button rendered at 1.05:1.\n  text: [\n    \"--zl-foreground\",\n    \"--zl-card-foreground\",\n    \"--zl-popover-foreground\",\n    \"--zl-secondary-foreground\",\n    \"--zl-accent-foreground\",\n  ],\n  text_muted: [\"--zl-muted-foreground\"],\n  // The frames draw links in the surrounding text colour and distinguish them\n  // by an underline, so `--zl-link` defaults to `currentColor`. Setting it here\n  // (or from a host page) tints exactly the links — the card-nav switcher and\n  // the forgot-password affordance — and nothing else.\n  link: [\"--zl-link\"],\n  success: [\"--zl-success\"],\n  warning: [\"--zl-warning\"],\n  error: [\"--zl-destructive\"],\n};\n\n/**\n * Selector for the tenant's declarations.\n *\n * It names the theme attributes rather than relying on `:host` alone, so it\n * reaches the same specificity as the base token layer. `applyBaseTokens`\n * rewrites the design-system defaults onto `:host, :host([data-theme=\"dark\"])`,\n * so on a host carrying `data-theme` — which `applySurfaceTheme` always stamps\n * — the *default* matches at `(0,2,0)`. A plain `:host` block is `(0,1,0)` and\n * loses on specificity however much later it is adopted, which left every\n * tenant's palette, fonts and shape painting nothing.\n *\n * Matching the attribute makes both `(0,2,0)`, so adoption order decides and\n * branding — adopted after the base — wins. `:host` stays in the list to cover\n * the moment before a theme resolves.\n */\nconst BRANDING_SELECTOR = ':host, :host([data-theme=\"light\"]), :host([data-theme=\"dark\"])';\n\n/** Dark-only overrides. Emitted after {@link BRANDING_SELECTOR}, so it wins on order. */\nconst DARK_SELECTOR = ':host([data-theme=\"dark\"])';\n\nexport type BrandingToTokensOptions = {\n  resolvedTheme?: ResolvedTheme;\n};\n\n/**\n * Build a CSS string of `:host { --zl-* }` declarations from a Branding\n * payload. Light values land on `:host`; dark overrides land on\n * `:host([data-theme=\"dark\"])`.\n */\nexport function buildBrandingStylesheet(\n  branding: Branding | undefined,\n  options: BrandingToTokensOptions = {},\n): string {\n  const lightDecls = collectDeclarations(branding);\n  const darkPalette = branding?.theme?.dark?.palette;\n  const darkDecls = darkPalette ? mapPalette(darkPalette) : {};\n\n  const blocks: string[] = [];\n  if (Object.keys(lightDecls).length > 0) {\n    blocks.push(formatBlock(BRANDING_SELECTOR, lightDecls));\n  }\n  if (Object.keys(darkDecls).length > 0) {\n    blocks.push(formatBlock(DARK_SELECTOR, darkDecls));\n  }\n\n  // When the orchestrator forces dark mode (mode: \"dark\" or auto + prefers-dark),\n  // treat the dark overrides as primary so the element reflects dark even\n  // before a `data-theme` attribute is set. Cheap and avoids a flash.\n  if (options.resolvedTheme === \"dark\" && darkPalette) {\n    const merged = { ...lightDecls, ...darkDecls };\n    blocks.length = 0;\n    blocks.push(formatBlock(BRANDING_SELECTOR, merged));\n  }\n\n  return blocks.join(\"\\n\");\n}\n\nfunction collectDeclarations(branding: Branding | undefined): Record<string, string> {\n  if (!branding) {\n    return {};\n  }\n  const decls: Record<string, string> = {};\n  Object.assign(decls, mapPalette(branding.palette));\n  Object.assign(decls, mapTypography(branding.typography));\n  Object.assign(decls, mapShape(branding.shape));\n  return decls;\n}\n\nfunction mapPalette(palette: BrandingPalette | undefined): Record<string, string> {\n  if (!palette) return {};\n  const out: Record<string, string> = {};\n  for (const [key, varNames] of Object.entries(PALETTE_MAP) as [keyof BrandingPalette, string[]][]) {\n    const value = palette[key];\n    if (typeof value === \"string\" && value.length > 0) {\n      for (const varName of varNames) {\n        out[varName] = value;\n      }\n    }\n  }\n  return out;\n}\n\nfunction mapTypography(typography: BrandingTypography | undefined): Record<string, string> {\n  if (!typography) return {};\n  const out: Record<string, string> = {};\n  // `font_family` sets both faces, which is the single-font look most brands\n  // want. `font_family_heading` peels the display face back off — name it and\n  // the body font stops dictating what titles render in.\n  if (typography.font_family) {\n    out[\"--zl-font-family-sans\"] = typography.font_family;\n    out[\"--zl-font-family-heading\"] = typography.font_family;\n  }\n  if (typography.font_family_heading) {\n    out[\"--zl-font-family-heading\"] = typography.font_family_heading;\n  }\n  if (typography.font_family_mono) {\n    out[\"--zl-font-family-mono\"] = typography.font_family_mono;\n  }\n  // Typography scale tunes the *base* font sizes embedded in atoms.\n  // The Figma scale isn't published as variables, so we map to the\n  // implicit sizes the atoms use directly.\n  const scale = clamp(typography.scale ?? 1, 0.75, 1.25);\n  if (scale !== 1) {\n    out[\"--zl-font-scale\"] = `${scale}`;\n  }\n  return out;\n}\n\nfunction mapShape(shape: BrandingShape | undefined): Record<string, string> {\n  if (!shape) return {};\n  const out: Record<string, string> = {};\n  if (shape.radius && RADIUS_MAP[shape.radius]) {\n    const radius = RADIUS_MAP[shape.radius];\n    // The three steps the atoms actually draw with: `md` for controls (inputs,\n    // buttons), `lg` for the alert, `xl` for the card. Scaling them off one\n    // tenant value keeps their relative proportions when a brand asks for\n    // sharper or rounder corners. Smaller and larger steps stay untouched.\n    out[\"--zl-radius-md\"] = radius;\n    out[\"--zl-radius-lg\"] = radius === \"0\" ? \"0\" : `calc(${radius} * 1.25)`;\n    out[\"--zl-radius-xl\"] = radius === \"0\" ? \"0\" : `calc(${radius} * 1.75)`;\n  }\n  if (shape.density) {\n    Object.assign(out, DENSITY_MAP[shape.density]);\n  }\n  return out;\n}\n\nfunction formatBlock(selector: string, decls: Record<string, string>): string {\n  const lines = Object.entries(decls).map(([prop, value]) => `  ${prop}: ${value};`);\n  return `${selector} {\\n${lines.join(\"\\n\")}\\n}`;\n}\n\nfunction clamp(value: number, min: number, max: number): number {\n  if (Number.isNaN(value)) return min;\n  return Math.min(max, Math.max(min, value));\n}\n\n// Lazily-built base sheet, shared by every `<zitadel-login>` instance.\n// `tokensCss` ships the design-system defaults against document selectors;\n// rewriting them to `:host` projects the same variables onto the orchestrator's\n// shadow root so `var(--zl-*)` lookups inside atoms resolve before branding\n// overrides land. The selectors come from the package rather than being spelled\n// out here: a mismatch would not fail, it would silently stop rewriting and\n// leave the widget with no base tokens at all.\nlet baseTokenSheet: CSSStyleSheet | undefined;\nfunction getBaseTokenSheet(): CSSStyleSheet | undefined {\n  if (typeof CSSStyleSheet === \"undefined\") return undefined;\n  if (!baseTokenSheet) {\n    const rewritten = tokensCss\n      .replaceAll(THEME_SELECTORS.dark, ':host,\\n:host([data-theme=\"dark\"])')\n      .replaceAll(THEME_SELECTORS.light, ':host([data-theme=\"light\"])');\n    baseTokenSheet = new CSSStyleSheet();\n    baseTokenSheet.replaceSync(rewritten);\n  }\n  return baseTokenSheet;\n}\n\n/**\n * Adopt the design-system base token layer onto a `ShadowRoot`. Safe to call\n * many times — the underlying constructable sheet is shared across every\n * orchestrator instance and de-duplicated in the adopted list.\n */\nexport function applyBaseTokens(shadowRoot: ShadowRoot): void {\n  const sheet = getBaseTokenSheet();\n  if (!sheet) return;\n  // jsdom partially implements `adoptedStyleSheets` — treat a non-array as empty.\n  const existing: readonly CSSStyleSheet[] = Array.isArray(shadowRoot.adoptedStyleSheets)\n    ? shadowRoot.adoptedStyleSheets\n    : [];\n  if (existing.includes(sheet)) return;\n  try {\n    shadowRoot.adoptedStyleSheets = [sheet, ...existing];\n  } catch {\n    // Environments without constructable stylesheet adoption.\n  }\n}\n\n/**\n * Apply a branding payload as a `--zl-*` overrides layer on top of the base\n * token sheet. Subsequent calls replace the previous override sheet so a new\n * branding payload paints cleanly without leaking older declarations.\n *\n * Callers should run `applyBaseTokens(shadowRoot)` first (once per shadow\n * root) so the base values exist before branding patches them.\n */\nexport function applyBrandingTokens(\n  shadowRoot: ShadowRoot,\n  branding: Branding | undefined,\n  resolvedTheme: ResolvedTheme,\n): void {\n  const css = buildBrandingStylesheet(branding, { resolvedTheme });\n  if (typeof CSSStyleSheet === \"undefined\") {\n    return;\n  }\n  const sheet = new CSSStyleSheet();\n  sheet.replaceSync(css);\n  // Replace only the branding override sheet we own; leave the base token\n  // sheet and any host-supplied sheets in place.\n  const previous = (shadowRoot as ShadowRoot & { __zlTokenSheet?: CSSStyleSheet }).__zlTokenSheet;\n  const others = shadowRoot.adoptedStyleSheets.filter((s) => s !== previous);\n  shadowRoot.adoptedStyleSheets = [...others, sheet];\n  (shadowRoot as ShadowRoot & { __zlTokenSheet?: CSSStyleSheet }).__zlTokenSheet = sheet;\n}\n\n/**\n * Standalone branding→theme resolution for callers outside the orchestrator\n * (SSR, tests, embedders composing atoms by hand). `<zitadel-login>` itself\n * uses {@link ThemeController}, which layers the element's `theme` property\n * and a variant-derived fallback on top of the same branding input.\n *\n * Defaults to dark: the design system's primary surface, and the mode a\n * hosted login page renders when a tenant states no preference.\n */\nexport function resolveTheme(branding: Branding | undefined): ResolvedTheme {\n  const mode = branding?.theme?.mode ?? \"dark\";\n  if (mode === \"light\") return \"light\";\n  if (mode === \"dark\") return \"dark\";\n  if (typeof matchMedia === \"function\") {\n    return matchMedia(\"(prefers-color-scheme: light)\").matches ? \"light\" : \"dark\";\n  }\n  return \"dark\";\n}\n","/**\n * Document-level font stylesheet injection for the orchestrator surfaces.\n *\n * Two faces can be linked into the host document's `<head>`:\n *\n * - The **design-system default** (`applyDefaultFont`) — the brand body face\n *   (Arimo, named first in `--zl-font-family-sans`). The component ships this\n *   so the auth screens render in the brand font out of the box, even when the\n *   server returns no branding. This is the \"default users can override\" layer.\n * - The **tenant override** (`applyFontUrl`) — `branding.font_url`, resolved\n *   server-side from the app → team → project branding hierarchy.\n *\n * Both must live at document level, not inside the shadow root: browsers ignore\n * `@font-face` rules declared in shadow-tree stylesheets, so a shadow-scoped\n * link would never register the font faces and every branded font silently\n * falls back to the system stack. `font-family` references inside the shadow\n * tree resolve against document-level faces.\n *\n * Each `<link>` is shared per document but **owned collectively**: every\n * calling surface (identified by its shadow root) registers the href it wants,\n * and passing `null`/`undefined` withdraws only that surface's registration —\n * never the link another surface still needs. Multiple surfaces now call these\n * helpers on every update (`<zitadel-login>` and `<zitadel-session>` via the\n * shared surface base), so a widget-mode session mounting next to a page-mode\n * login must not strip the login's fonts. The rendered href is the most\n * recently registered one (matching the old single-owner behavior when only\n * one surface is present); the link is removed once no surface wants it.\n * Registrations from since-disconnected surfaces are pruned lazily on the\n * next call, so a removed element neither pins a link forever nor leaks its\n * shadow root — while the link itself stays in place until another surface\n * actually updates, exactly like the pre-ownership behavior.\n */\nconst TENANT_LINK_ID = \"zl-font-link\";\nconst DEFAULT_LINK_ID = \"zl-default-font-link\";\n\n/**\n * Design-system default brand font. Arimo is the Figma body face and leads the\n * `--zl-font-family-sans` stack; loading it here makes the unbranded auth UI\n * paint in the brand font instead of the system fallback. Tenants override it\n * with `branding.font_url`. Exported so a privacy- or offline-sensitive\n * deployment can self-host the same face and swap this single URL.\n */\nexport const DEFAULT_BRAND_FONT_HREF =\n  \"https://fonts.googleapis.com/css2?family=Arimo:ital,wght@0,400;0,500;0,600;0,700;1,400&display=swap\";\n\n/**\n * Only the body face is loaded here.\n *\n * The design draws card titles, field labels and alert titles in APK Futural,\n * a licensed display face. First-party surfaces declare it themselves and point\n * `--zl-font-family-heading` at it — see `apps/login-ui/src/styles.css` and\n * `apps/console/src/styles.css`. An embedded widget runs on a customer's own\n * origin, so serving them the binary from here is a licensing question rather\n * than an engineering one, and it is not answered yet. Until it is, embedded\n * headings fall through the token's stack to Arimo, which is what the stack is\n * for. A host page that has licensed the face can opt in today by declaring an\n * `@font-face` and setting `--zl-font-family-heading` on the element.\n */\n\n/** Per-document, per-link-id map of each owner's desired href. */\nconst registries = new WeakMap<Document, Map<string, Map<ShadowRoot, string>>>();\n\n/**\n * Inject the tenant's `branding.font_url` stylesheet. Pass `null`/`undefined`\n * to withdraw this surface's registration (e.g. when a flow resolves with no\n * tenant font); the link disappears once no surface registers a URL.\n */\nexport function applyFontUrl(shadowRoot: ShadowRoot, fontUrl: string | null | undefined): void {\n  applyLinkedStylesheet(shadowRoot, TENANT_LINK_ID, fontUrl);\n}\n\n/**\n * Inject the design-system default font stylesheet. Defaults to\n * {@link DEFAULT_BRAND_FONT_HREF}; pass `null` to withdraw this surface's\n * registration (the orchestrator does this when a tenant `font_url` takes\n * over, to avoid a redundant request).\n */\nexport function applyDefaultFont(\n  shadowRoot: ShadowRoot,\n  href: string | null | undefined = DEFAULT_BRAND_FONT_HREF,\n): void {\n  applyLinkedStylesheet(shadowRoot, DEFAULT_LINK_ID, href);\n}\n\nfunction applyLinkedStylesheet(\n  shadowRoot: ShadowRoot,\n  linkId: string,\n  href: string | null | undefined,\n): void {\n  const ownerDocument = shadowRoot.ownerDocument ?? document;\n\n  let registry = registries.get(ownerDocument);\n  if (!registry) {\n    registry = new Map();\n    registries.set(ownerDocument, registry);\n  }\n  let desires = registry.get(linkId);\n  if (!desires) {\n    desires = new Map();\n    registry.set(linkId, desires);\n  }\n  // Disconnected surfaces no longer vote; prune them so a removed element's\n  // registration can neither pin the link nor resurrect it later.\n  for (const owner of desires.keys()) {\n    if (!owner.host.isConnected) desires.delete(owner);\n  }\n  if (href) {\n    // Delete-then-set moves this owner to the end of the insertion order, so\n    // the effective href below is always the most recent registration.\n    desires.delete(shadowRoot);\n    desires.set(shadowRoot, href);\n  } else {\n    desires.delete(shadowRoot);\n  }\n\n  const effective = [...desires.values()].at(-1) ?? null;\n\n  // Scope the lookup to our own `<link>` so we only ever touch the element this\n  // id owns, then reuse it across re-renders instead of removing and\n  // re-fetching the font.\n  const existing = ownerDocument.head.querySelector<HTMLLinkElement>(`link#${linkId}`);\n  if (!effective) {\n    existing?.remove();\n    return;\n  }\n  if (!href) {\n    // A withdrawal keeps the shared link current for the remaining owners but\n    // never materialises one: if the link is gone (e.g. the host page pruned\n    // it), only a surface positively registering a font may bring it back.\n    if (existing && existing.href !== effective) {\n      existing.href = effective;\n    }\n    return;\n  }\n  const link = existing ?? ownerDocument.createElement(\"link\");\n  link.id = linkId;\n  link.rel = \"stylesheet\";\n  if (link.href !== effective) {\n    link.href = effective;\n  }\n  if (!existing) {\n    ownerDocument.head.appendChild(link);\n  }\n}\n","/**\n * `ThemeController` — Lit ReactiveController that resolves the active\n * `light | dark` theme from the current `Branding` payload and keeps it in\n * sync with the OS-level `prefers-color-scheme` when the tenant opts into\n * `theme.mode = \"auto\"`.\n *\n * Per `docs/design/branding/tokens.md` the orchestrator owns theming entirely.\n * Subscribing here is what makes \"auto\" actually reactive instead of a\n * one-shot read at first paint.\n */\nimport type { ReactiveController, ReactiveControllerHost } from \"lit\";\n\nimport type { Branding } from \"./branding.js\";\n\nexport type ResolvedTheme = \"light\" | \"dark\";\n\n/** Theme inputs a caller may express, before resolution. */\nexport type ThemeMode = \"light\" | \"dark\" | \"auto\";\n\nconst DARK_QUERY = \"(prefers-color-scheme: dark)\";\n\nexport class ThemeController implements ReactiveController {\n  private readonly host: ReactiveControllerHost;\n\n  private branding: Branding | undefined;\n\n  /** Element-level `theme` property — the embedding developer's explicit call. */\n  private explicitMode: ThemeMode | undefined;\n\n  /** Used when neither the element nor the branding payload names a mode. */\n  private fallbackMode: ThemeMode = \"dark\";\n\n  private mediaQuery: MediaQueryList | null = null;\n\n  // Initial value before the first resolve; dark is the design system's\n  // primary surface. Both modes ship real token values.\n  private _theme: ResolvedTheme = \"dark\";\n\n  constructor(host: ReactiveControllerHost) {\n    this.host = host;\n    host.addController(this);\n  }\n\n  get theme(): ResolvedTheme {\n    return this._theme;\n  }\n\n  setBranding(branding: Branding | undefined): void {\n    this.branding = branding;\n    this.refresh();\n  }\n\n  /**\n   * Sets the element-level preference and the fallback used when neither the\n   * element nor the branding payload names a mode. Precedence, strongest\n   * first: element `theme` property → `branding.theme.mode` → fallback. The\n   * element wins because the page embedding the widget knows its own surface\n   * better than the tenant's stored branding does.\n   */\n  setModePreference(explicit: ThemeMode | undefined, fallback: ThemeMode): void {\n    if (this.explicitMode === explicit && this.fallbackMode === fallback) return;\n    this.explicitMode = explicit;\n    this.fallbackMode = fallback;\n    this.refresh();\n  }\n\n  hostConnected(): void {\n    this.refresh();\n  }\n\n  hostDisconnected(): void {\n    this.detach();\n  }\n\n  private refresh(): void {\n    const mode = this.explicitMode ?? this.branding?.theme?.mode ?? this.fallbackMode;\n    if (mode === \"auto\") {\n      this.attach();\n      // Follow `prefers-color-scheme`. Where `matchMedia` is unavailable the\n      // preference is unknowable, so fall back to the design system's\n      // primary surface rather than guessing light.\n      this.update(this.mediaQuery?.matches === false ? \"light\" : \"dark\");\n      return;\n    }\n    this.detach();\n    this.update(mode === \"light\" ? \"light\" : \"dark\");\n  }\n\n  private attach(): void {\n    if (this.mediaQuery || typeof matchMedia !== \"function\") return;\n    this.mediaQuery = matchMedia(DARK_QUERY);\n    this.mediaQuery.addEventListener(\"change\", this.onMediaChange);\n  }\n\n  private detach(): void {\n    if (!this.mediaQuery) return;\n    this.mediaQuery.removeEventListener(\"change\", this.onMediaChange);\n    this.mediaQuery = null;\n  }\n\n  private onMediaChange = (event: MediaQueryListEvent): void => {\n    // Auto-mode follows prefers-color-scheme. We watch the dark query, so\n    // `matches=true` ⇒ user wants dark.\n    this.update(event.matches ? \"dark\" : \"light\");\n  };\n\n  private update(next: ResolvedTheme): void {\n    if (this._theme === next) return;\n    this._theme = next;\n    this.host.requestUpdate();\n  }\n}\n","import { LitElement } from \"lit\";\nimport { property } from \"lit/decorators.js\";\n\nimport type { Branding } from \"./branding.js\";\nimport { applyBaseTokens, applyBrandingTokens } from \"./branding-to-tokens.js\";\nimport { applyDefaultFont, applyFontUrl } from \"./font-loader.js\";\nimport { ThemeController, type ThemeMode } from \"./theme-controller.js\";\n\n/**\n * Shared base for the orchestrator host elements (`<zitadel-login>`,\n * `<zitadel-session>`) that render a themable page/widget surface.\n *\n * Owns the `variant` / `theme` public properties, the {@link ThemeController},\n * and the per-update surface application (base tokens, branding overrides,\n * font links, and the `data-theme` host stamp). Subclasses call\n * {@link applySurfaceTheme} from their `willUpdate` so the resolved theme is\n * committed in the same update cycle that reads it.\n *\n * Not a registered custom element — purely an implementation-sharing base.\n */\nexport class ZitadelSurface extends LitElement {\n  /**\n   * Sizing/chrome mode. Components size to content; pages compose them —\n   * so the default is `widget`: content-sized, transparent host, no\n   * document-level default-font injection. Dedicated routes — the hosted\n   * shell and the scaffolded pages — opt into `page`, which claims the\n   * viewport, paints the surface background, and ships the brand font.\n   * Fine-grained height override in both modes: `--zl-page-min-height`.\n   */\n  @property({ type: String, reflect: true }) accessor variant: \"widget\" | \"page\" = \"widget\";\n\n  /**\n   * Colour mode: `light`, `dark`, or `auto` (follow `prefers-color-scheme`).\n   * Empty means \"not stated\", and resolution falls through to the tenant's\n   * `branding.theme.mode`, then to a variant-derived default — `dark` for\n   * `page` (the hosted design system surface) and `auto` for `widget`, so an\n   * embedded widget matches the visitor's preference instead of forcing a\n   * dark card onto a light page. Set it explicitly when your app's surface\n   * is fixed: `<zitadel-login theme=\"light\">`.\n   */\n  @property({ type: String }) accessor theme: \"\" | ThemeMode = \"\";\n\n  /**\n   * Visually hide the surface's own heading block (the step title and\n   * subtitle on `<zitadel-login>`, the heading line on\n   * `<zitadel-session>`) while keeping it in the accessibility tree. For\n   * embedders whose page already carries the heading — a brand-voice\n   * \"Welcome back\" above the card — so the widget doesn't repeat it.\n   * Reflected so host-page CSS and DOM assertions can key off the\n   * attribute, like `variant`.\n   */\n  @property({ type: Boolean, reflect: true, attribute: \"suppress-header\" })\n  accessor suppressHeader = false;\n\n  protected readonly themeController = new ThemeController(this);\n\n  /**\n   * Resolve the active theme and commit it to this element's surface: adopt\n   * the base token sheet, layer the branding overrides, manage the\n   * document-level font links, and stamp `data-theme` / `data-theme-dark` on\n   * the host so token lookups (and host-page selectors) flip with the mode.\n   * `branding` is `undefined` for surfaces without a tenant payload — the\n   * theme then resolves through the element preference and variant fallback.\n   */\n  protected applySurfaceTheme(branding: Branding | undefined): void {\n    // Resolve before reading `themeController.theme` below: a page owns its\n    // surface (dark), a widget defers to the visitor's preference (auto).\n    this.themeController.setModePreference(\n      this.theme === \"\" ? undefined : this.theme,\n      this.variant === \"page\" ? \"dark\" : \"auto\",\n    );\n    const root = this.shadowRoot;\n    if (root) {\n      applyBaseTokens(root);\n      applyBrandingTokens(root, branding, this.themeController.theme);\n      // Ship the design-system brand face by default on dedicated pages;\n      // drop it when a tenant font takes over so we don't fire a redundant\n      // request. Widget mode never injects the default into the host\n      // document — the embedding app owns its typography (and its visitors'\n      // font-CDN connections). Tenant `font_url` is explicit server-side\n      // branding state, so it applies in both modes.\n      const tenantFontUrl = branding?.font_url ?? null;\n      applyDefaultFont(root, this.variant === \"page\" && !tenantFontUrl ? undefined : null);\n      applyFontUrl(root, tenantFontUrl);\n    }\n    this.dataset.theme = this.themeController.theme;\n    this.toggleAttribute(\"data-theme-dark\", this.themeController.theme === \"dark\");\n  }\n}\n","/**\n * Names of the bundled Liquid templates the `<zitadel-login>` orchestrator\n * registers.\n *\n * This lives in its own module — separate from `liquid.ts` — so the public\n * barrel can re-export `TEMPLATE_NAMES` without dragging LiquidJS' `Liquid`\n * type (and its Node ambient-type requirements) into the published\n * declaration surface. See `liquid.ts` / the orchestrator barrel.\n */\nexport const TEMPLATE_NAMES = {\n  default: \"default\",\n  authForm: \"auth-form\",\n  passkeyUpsell: \"passkey-upsell\",\n  signedIn: \"signed-in\",\n} as const;\n","/**\n * Layout chrome injected as an `adoptedStyleSheet` on the orchestrator's\n * shadow root. Provides the page background and the attribution-footer\n * positioning that lives *outside* any template — the rest of the visual\n * surface is owned by the `<zl-page-shell>` / `<zl-card>` atoms the\n * templates render. Token references resolve against the\n * `@zitadel/design-tokens` CSS variables that are present on\n * `:host` via the branding stylesheet.\n */\n\n/* Widget-first: the default host is content-sized and paints nothing —\n   the embedding app owns the page. `variant=\"page\"` (hosted shell,\n   scaffolded login routes) opts into the full-page chrome. The\n   `--zl-page-min-height` custom property overrides the height in both\n   modes (a host-set value always wins over the variant default). */\n:host {\n  display: block;\n  background: transparent;\n  color: var(--zl-foreground);\n  font-family: var(--zl-font-family-sans);\n}\n:host([variant=\"page\"]) {\n  min-height: 100%;\n  background: var(--zl-background);\n}\n/* A branding asset whose URL is well-formed but dead otherwise renders as a\n   0×0 <img> — a silent hole in the design. `asset-fallback.ts` stamps this\n   attribute from a real `error` listener (templates are DOMPurify-sanitised,\n   so inline `onerror` is not available to them) and the element leaves the\n   layout, degrading to the same result as \"no asset configured\". Qualified\n   on `img` so it outranks the `.zl-split__compact` display rules below\n   regardless of source order. */\nimg[data-zl-asset-broken] {\n  display: none;\n}\n.zl-mount {\n  display: flex;\n  flex-direction: column;\n  /* Width-based chrome below (`@container`) responds to the widget's own\n     width, not the viewport — a sidebar embed on a desktop viewport must\n     collapse like a phone would. */\n  container-type: inline-size;\n  min-height: var(--zl-page-min-height, auto);\n  background: inherit;\n  color: inherit;\n}\n:host([variant=\"page\"]) .zl-mount {\n  min-height: var(--zl-page-min-height, 100vh);\n}\n.zl-mount > zl-page-shell,\n.zl-mount > [data-zl-template-root] {\n  flex: 1 1 auto;\n}\n.zl-attribution {\n  display: flex;\n  justify-content: center;\n  align-items: center;\n  background: transparent;\n}\n.zl-attribution[hidden] {\n  display: none;\n}\n\n/* The trustmark: \"Secured with\" beside the logotype, at body size. It is not a\n   chip — the design reserves the chip beside it for the session badge. */\n.zl-trustmark {\n  flex-wrap: wrap;\n  gap: var(--zl-spacing-2-5);\n}\n.zl-trustmark__mark {\n  display: inline-flex;\n  align-items: center;\n  gap: var(--zl-spacing-2);\n  font-family: var(--zl-font-family-sans);\n  font-size: var(--zl-text-sm-size);\n  line-height: var(--zl-text-sm-leading);\n  color: var(--zl-foreground);\n  text-decoration: none;\n}\n.zl-trustmark__mark:hover {\n  text-decoration: underline;\n  text-underline-offset: 4px;\n}\n.zl-trustmark__mark:focus-visible {\n  outline: var(--zl-focus-width) solid var(--zl-ring);\n  outline-offset: var(--zl-focus-offset);\n  border-radius: var(--zl-radius-sm);\n}\n.zl-trustmark__logotype {\n  display: block;\n  flex-shrink: 0;\n  width: 65px;\n  height: 16px;\n  line-height: 0;\n}\n.zl-trustmark__logotype-svg {\n  display: block;\n  width: 100%;\n  height: 100%;\n}\n/* Card header typography. Templates slot raw <h1>/<p> elements into\n   <zl-card>, which keeps them in the light DOM where this stylesheet can\n   reach them — the atom intentionally doesn't dictate typography.\n\n   `line-height: 1` on the title is the design's, not an oversight: the header\n   is a single line whose 6px gap to the description does the separating, so\n   leading above the cap height only pads the top of the card. */\n/* Brand mark above the card, from `branding.logo_url`. Bounded the way the\n   split pane's mark is (`img.zl-split__compact`): a tenant asset carries no\n   intrinsic size the layout can trust, and an SVG with only a viewBox stretches\n   to fill whatever box it lands in — which here is the full page width. */\n.zl-card-logo {\n  width: auto;\n  max-width: min(12rem, 60%);\n  max-height: var(--zl-card-logo-max-height, 2.5rem);\n  object-fit: contain;\n}\n.zl-card-title {\n  margin: 0;\n  font-family: var(--zl-font-family-heading);\n  font-size: var(--zl-text-xl-size);\n  font-weight: var(--zl-font-weight-medium);\n  line-height: 1;\n  color: var(--zl-card-foreground);\n  text-align: left;\n}\n.zl-card-subtitle {\n  margin: 0;\n  font-family: var(--zl-font-family-sans);\n  font-size: var(--zl-text-sm-size);\n  line-height: var(--zl-text-sm-leading);\n  font-weight: var(--zl-font-weight-normal);\n  color: var(--zl-muted-foreground);\n}\n\n/* The two groups the card body holds. The card spaces them 28px apart; each\n   packs its own members tighter. Explicit wrappers rather than sibling\n   selectors, so an ejected template composes them on purpose. */\n.zl-field-group {\n  display: flex;\n  flex-direction: column;\n  gap: var(--zl-spacing-7);\n}\n/* A step can declare no fields at all — the passkey upsell is title, copy and\n   two buttons. The wrapper still renders, and an empty flex item would keep\n   claiming the card's 28px gap. `:has(*)` rather than `:empty` because Liquid\n   leaves whitespace text nodes behind, which `:empty` counts. */\n.zl-field-group:not(:has(*)) {\n  display: none;\n}\n.zl-card-actions {\n  display: flex;\n  flex-direction: column;\n  gap: var(--zl-spacing-3);\n}\n/* suppress-header: the host asked for the heading block to be visually\n   hidden (its page already carries one). Stamped by the orchestrator on the\n   shell so it covers user-ejected templates too. Screen-reader-only rather\n   than display:none — the step keeps its accessible name. */\n[data-suppress-header] .zl-card-title,\n[data-suppress-header] .zl-card-subtitle {\n  position: absolute;\n  width: 1px;\n  height: 1px;\n  margin: -1px;\n  padding: 0;\n  border: 0;\n  overflow: hidden;\n  clip-path: inset(50%);\n  white-space: nowrap;\n}\n/* The sign-in <-> sign-up switcher, centred beneath the actions. The design\n   gives the link no colour of its own — the underline is what marks it. */\n.zl-card-nav {\n  margin: 0;\n  font-family: var(--zl-font-family-sans);\n  font-size: var(--zl-text-sm-size);\n  line-height: var(--zl-text-sm-leading);\n  font-weight: var(--zl-font-weight-normal);\n  color: var(--zl-muted-foreground);\n  text-align: center;\n}\n.zl-card-nav__link {\n  display: inline;\n  margin: 0;\n  padding: 0;\n  border: none;\n  background: transparent;\n  font: inherit;\n  line-height: inherit;\n  color: var(--zl-link);\n  text-decoration: underline;\n  text-underline-offset: 4px;\n  cursor: pointer;\n}\n/* The switcher's underline is how the design marks it, so hover lifts the link\n   out of the muted line it sits in rather than taking the underline away. */\n.zl-card-nav__link:hover {\n  color: var(--zl-foreground);\n}\n.zl-card-nav__link:focus-visible {\n  outline: var(--zl-focus-width) solid var(--zl-ring);\n  outline-offset: var(--zl-focus-offset);\n}\n/* Forgot-password is no longer a row of its own: the design sits it on the\n   password field's label row, so `<zl-field>` renders it (see its\n   `forgot-password-*` attributes). These rules remain for templates ejected\n   before that move, which still emit the standalone paragraph. */\n.zl-card-forgot {\n  margin: 0;\n  text-align: right;\n}\n.zl-card-forgot__link {\n  display: inline;\n  margin: 0;\n  padding: 0;\n  border: none;\n  background: transparent;\n  font-family: var(--zl-font-family-sans);\n  font-size: var(--zl-text-sm-size);\n  line-height: var(--zl-text-sm-leading);\n  font-weight: var(--zl-font-weight-normal);\n  color: var(--zl-link);\n  text-decoration: none;\n  text-underline-offset: 4px;\n  cursor: pointer;\n}\n/* Matches the field-level affordance in `zl-field.css`: the design draws\n   forgot-password as plain text, and the underline is the hover. */\n.zl-card-forgot__link:hover {\n  text-decoration: underline;\n}\n.zl-card-forgot__link:focus-visible {\n  outline: var(--zl-focus-width) solid var(--zl-ring);\n  outline-offset: var(--zl-focus-offset);\n}\n/* Split-design chrome (ADR 040 design catalog: `split` / `split-right`).\n   Consumed by the ejectable templates in @zitadel/config under\n   defaults/branding/ — a brand pane beside the form pane, collapsing to\n   form-only on narrow viewports. */\n.zl-split {\n  display: grid;\n  /* Tunable from the template root's style attribute (the sanitiser allows\n     style=\"\"): custom properties cascade into this shadow chrome. */\n  grid-template-columns: var(--zl-split-columns, minmax(0, 1fr) minmax(0, 1fr));\n  align-items: var(--zl-split-align, center);\n  min-height: 100%;\n  /* Explicit, not content-derived: the column ratio applies to the full\n     available width, and the attribution row below mirrors the same tracks\n     to line the badge up under the form pane. */\n  width: 100%;\n  gap: var(--zl-spacing-8);\n}\n/* The block padding is what decides whether the pane reads as a peer of the\n   form card or as the thing the page is built around. The card is 384 wide and\n   roughly 342 tall on the sign-in step, so 3.25rem a side on top of the\n   placeholder's own footprint put the pane 200px past it — the grid centres the\n   card in that row and the attribution then sits a long way under it. 2rem\n   keeps the panes visually separated at the width they meet without the brand\n   side dictating the page height. Spacing tokens, not pixels: the branding\n   density knob writes `--zl-spacing-4` / `--zl-spacing-8`, so a compact tenant\n   tightens this pane along with everything else. */\n.zl-split__brand {\n  display: flex;\n  flex-direction: column;\n  align-items: center;\n  justify-content: center;\n  gap: var(--zl-spacing-6);\n  padding: var(--zl-spacing-8) var(--zl-spacing-4);\n}\n/* A width cap alone leaves the height open: a portrait lockup clamped to 16rem\n   wide still resolves whatever height its ratio asks for (a 500×2000 mark\n   renders 256×1024), and the content-sized brand pane hands that straight to\n   the page. `max-height` only, deliberately unlike `.zl-split__hero` below: a\n   logo is a mark, not a pane-filling image, so it shrinks proportionally and\n   keeps its whole shape rather than being cropped to a slot — and it is never\n   stretched to the pane, which is what `width: 100%` there would do. 16rem\n   squares off the existing width cap, so the logo fits a 16rem box either way.\n   That is the cap for a logo that has the pane to itself — when a hero shares\n   it, the rule below takes over. Raise `--zl-split-logo-max-height` from the\n   template root for a taller lockup. */\n.zl-split__logo {\n  max-width: min(16rem, 60%);\n  max-height: var(--zl-split-logo-max-height, 16rem);\n}\n/* A tenant who sets both assets stacks them in this one pane, so the two solo\n   caps stop being independent — and the pane's own gap and padding are only\n   half the chrome they compete with. The shell around it adds 3.25rem of block\n   padding, a region gap, and the 2.5rem attribution pill. The logo first yields\n   to a header-mark cap; the hero then takes only the viewport height left after\n   that whole fixed budget, so the pair also fits short, wide laptop viewports.\n   Hero-only panes keep the larger cap below.\n\n   The floor is 6rem — the compact banner's cap — not 0. Below roughly a 420px\n   viewport the subtraction goes negative, and floored at 0 the hero silently\n   disappeared while the pane kept the logo. That bought nothing: at those\n   heights the form card is already taller than the brand pane, so it, not the\n   hero, sets the page height. A visible-but-small hero is the honest\n   degradation. */\n.zl-split__logo:has(+ .zl-split__hero) {\n  max-height: var(--zl-split-logo-max-height, 8rem);\n}\n.zl-split__logo:has(+ .zl-split__hero) + .zl-split__hero {\n  max-height: min(\n    var(--zl-split-hero-max-height, 22.5rem),\n    max(\n      6rem,\n      calc(\n        100vh - 104px - var(--zl-spacing-8) - var(--zl-spacing-8) -\n          2.5rem - var(--zl-spacing-6) - var(--zl-spacing-6) -\n          var(--zl-split-logo-max-height, 8rem)\n      )\n    )\n  );\n}\n/* Pinned width and a capped height, not a bare `max-width`. The brand pane is\n   content-sized — the grid centres it, nothing above the image constrains it —\n   so an unbounded hero *is* the page height. That bites hardest on an asset\n   with no intrinsic size (an SVG carrying only a viewBox, which every\n   framework scaffold ships): `width: auto` resolves to the pane's width and\n   the ratio squares it, so the pane grows past the viewport and pushes the\n   attribution below the fold. Pinning the width hands the excess to\n   `object-fit` instead of the layout: a wide banner is untouched (its height\n   never reaches the cap) and a tall or square one is cropped. The cap is the\n   `.zl-split__placeholder` footprint (18rem at 4 / 5), so a hero never claims\n   more vertical space than the panel it replaces, with a viewport term for\n   short screens. Tenants whose design wants a taller pane raise\n   `--zl-split-hero-max-height` from the template root. */\n.zl-split__hero {\n  width: 100%;\n  max-height: var(--zl-split-hero-max-height, min(22.5rem, 60vh));\n  border-radius: var(--zl-radius-lg);\n  object-fit: cover;\n}\n/* No-asset default for the brand pane: a token-gradient panel (same visual\n   language as .zl-hero__brand-mark) so a split design still reads as split\n   before branding.json names a logo_url/hero_url — an empty aside renders\n   the whole design as a lonely off-centre card. The templates swap it for\n   the real assets the moment one is set. */\n.zl-split__placeholder {\n  width: min(18rem, 85%);\n  aspect-ratio: 4 / 5;\n  border-radius: var(--zl-radius-lg);\n  background:\n    radial-gradient(\n      120% 120% at 18% 12%,\n      var(--zl-gradient-lavender-start) 0%,\n      transparent 60%\n    ),\n    radial-gradient(\n      130% 130% at 85% 92%,\n      var(--zl-gradient-rose-start) 0%,\n      transparent 60%\n    ),\n    var(--zl-card);\n}\n/* A column at every width, not just the collapsed one: the trustmark is a\n   member of this pane (see the anchor in the split templates), and stacking it\n   under the card is what puts it the same 24px away that the centred design\n   gives it. On wide viewports the compact mark is hidden, so the column holds\n   the card and the trustmark alone. */\n.zl-split__form {\n  display: flex;\n  flex-direction: column;\n  align-items: center;\n  justify-content: center;\n  gap: var(--zl-spacing-6);\n  padding: 16px;\n}\n/* Condensed brand header inside the form pane. Hidden on wide viewports\n   (the full brand pane carries the branding there); shown on narrow ones\n   so collapsing the brand pane doesn't erase the tenant's identity. */\n.zl-split__compact {\n  display: none;\n  max-width: min(12rem, 60%);\n}\n/* The height cap is an image concern — it keeps a tall logo from crowding\n   out the card. The hero design's fallback is a <p> whose copy tenants are\n   meant to edit, and a shared cap would clip it the moment it wraps; the\n   `img` qualifier keeps the two cases from inheriting each other's limits.\n   Both rules are `img`-qualified so source order (not specificity) decides\n   between the logo cap and the hero banner cap. */\nimg.zl-split__compact {\n  max-height: 2.5rem;\n}\n/* hero_url-only tenants: the compact fallback renders the hero image as a\n   modest banner instead of vanishing with the brand pane. Same pinned-width +\n   capped-height shape as `.zl-split__hero`, and load-bearing for the same\n   reason — drop the `width` and an intrinsic-size-less asset sizes itself off\n   the form pane instead, squaring a banner slot into a wall above the card. */\nimg.zl-split__compact--hero {\n  max-height: 6rem;\n  max-width: 100%;\n  width: 100%;\n  border-radius: var(--zl-radius-lg);\n  object-fit: cover;\n}\n.zl-split--right .zl-split__brand {\n  order: 2;\n}\n.zl-split--right .zl-split__form {\n  order: 1;\n}\n/* Only for a template with no attribution anchor — an ejected split from\n   before the mark moved into the form column, which still slots it into the\n   shell footer. That footer spans both panes, so a centred mark lands under the\n   pane seam: mirror the split's tracks (same custom property, same gap, same\n   width) on the footer row and park the mark in the form column. `:has` keys it\n   to the template actually rendering a split, so centred/minimal keep the plain\n   centring. */\nzl-page-shell:has(.zl-split) [slot=\"footer\"].zl-attribution {\n  width: 100%;\n  display: grid;\n  grid-template-columns: var(--zl-split-columns, minmax(0, 1fr) minmax(0, 1fr));\n  gap: var(--zl-spacing-8);\n}\nzl-page-shell:has(.zl-split) [slot=\"footer\"].zl-attribution > * {\n  grid-column: 2;\n  justify-self: center;\n}\nzl-page-shell:has(.zl-split--right) [slot=\"footer\"].zl-attribution > * {\n  grid-column: 1;\n}\n/* Container query, not media query: keyed to the mount's inline size so a\n   narrow embed on a wide viewport collapses exactly like a phone. */\n@container (max-width: 48rem) {\n  .zl-split {\n    grid-template-columns: minmax(0, 1fr);\n  }\n  /* Templates opt into keeping the full pane (stacked above the form) by\n     setting --zl-split-brand-mobile: flex on their root element. */\n  .zl-split__brand {\n    display: var(--zl-split-brand-mobile, none);\n  }\n  .zl-split__compact {\n    display: block;\n  }\n  /* Collapsed split is a single column — the badge recentres with it. */\n  zl-page-shell:has(.zl-split) [slot=\"footer\"].zl-attribution {\n    grid-template-columns: minmax(0, 1fr);\n  }\n  zl-page-shell:has(.zl-split) .zl-attribution > *,\n  zl-page-shell:has(.zl-split--right) [slot=\"footer\"].zl-attribution > * {\n    grid-column: 1;\n  }\n}\n/* Hero-design landing primitives (`hero`): a token-styled mock landing\n   page inside .zl-split__brand. Consumed by the ejectable hero template in\n   @zitadel/config under defaults/branding/hero/ — tenants edit the copy,\n   the classes keep it on design tokens so palettes and theme mode apply. */\n.zl-hero {\n  display: flex;\n  flex-direction: column;\n  width: 100%;\n  max-width: 34rem;\n  text-align: left;\n  color: var(--zl-foreground);\n  font-family: var(--zl-font-family-sans);\n}\n.zl-hero__nav {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  margin-bottom: var(--zl-spacing-8);\n}\n.zl-hero__brand {\n  display: inline-flex;\n  align-items: center;\n  gap: var(--zl-spacing-2);\n  font-size: 1.125rem;\n  font-weight: 700;\n  letter-spacing: -0.01em;\n}\n.zl-hero__brand-logo {\n  max-height: 1.75rem;\n}\n.zl-hero__brand-mark {\n  display: inline-flex;\n  width: 1.75rem;\n  height: 1.75rem;\n  border-radius: var(--zl-radius-md);\n  background: linear-gradient(\n    135deg,\n    var(--zl-gradient-lavender-start),\n    var(--zl-gradient-rose-start)\n  );\n}\n/* Text fallback for the mobile compact header when no logo_url is set\n   (display is owned by .zl-split__compact; this only styles the text).\n   Overrides the logo-sized width the shared class assumes, resets the\n   paragraph margin, and lets a long unbroken brand name wrap instead of\n   pushing the form pane sideways. */\n.zl-hero__compact-brand {\n  margin: 0;\n  max-width: 100%;\n  overflow-wrap: anywhere;\n  font-size: 1.125rem;\n  font-weight: 700;\n  letter-spacing: -0.01em;\n  color: var(--zl-foreground);\n}\n.zl-hero__nav-links {\n  display: flex;\n  gap: var(--zl-spacing-6);\n  font-size: 0.9375rem;\n  color: var(--zl-muted-foreground);\n}\n.zl-hero__nav-links a {\n  color: inherit;\n  text-decoration: none;\n}\n.zl-hero__nav-links a:hover {\n  text-decoration: underline;\n}\n.zl-hero__eyebrow {\n  margin: 0 0 var(--zl-spacing-4);\n  font-size: 0.8125rem;\n  font-weight: 600;\n  letter-spacing: 0.08em;\n  text-transform: uppercase;\n  color: var(--zl-muted-foreground);\n}\n.zl-hero__headline {\n  margin: 0 0 var(--zl-spacing-4);\n  font-family: var(--zl-font-family-heading);\n  font-size: 2.75rem;\n  line-height: 1.1;\n  font-weight: 700;\n  letter-spacing: -0.02em;\n}\n.zl-hero__sub {\n  margin: 0 0 var(--zl-spacing-8);\n  max-width: 30rem;\n  font-size: 1.0625rem;\n  line-height: 1.6;\n  color: var(--zl-muted-foreground);\n}\n.zl-hero__bullets {\n  display: flex;\n  flex-direction: column;\n  gap: var(--zl-spacing-2);\n  margin: 0 0 var(--zl-spacing-8);\n  padding: 0;\n  list-style: none;\n}\n.zl-hero__bullets li {\n  display: flex;\n  align-items: center;\n  gap: var(--zl-spacing-2);\n  font-size: 1rem;\n}\n.zl-hero__bullets li::before {\n  content: \"✓\";\n  color: var(--zl-success);\n  font-weight: 700;\n}\n.zl-hero__footnote {\n  margin: 0;\n  padding-top: var(--zl-spacing-6);\n  border-top: 1px solid var(--zl-border);\n  font-size: 0.8125rem;\n  color: var(--zl-muted-foreground);\n}\n.zl-hero__footnote strong {\n  color: var(--zl-muted-foreground);\n  font-weight: 600;\n}\n/* Minimal-design chrome (`minimal`): fields straight on the page, no card.\n   With no card to carry spacing, the pane's padding IS the page chrome, so\n   it follows the same widget-first rule as the shell's own padding: page\n   mode opts in, a widget embed is content-sized and the embedding app owns\n   spacing. The split panes above are different on purpose — their padding\n   separates the two panes' content and is part of that design's\n   composition, so it survives in both modes. */\n.zl-minimal {\n  display: flex;\n  flex-direction: column;\n  gap: var(--zl-spacing-6);\n  width: min(24rem, 100%);\n  margin-inline: auto;\n}\n:host([variant=\"page\"]) .zl-minimal {\n  padding: 52px 16px;\n}\n","import { type ZitadelProject } from \"@zitadel/api/config\";\nimport type {\n  CreateFlow201,\n  CreateFlow201Step,\n  CreateFlow201StepFieldsItem,\n  CreateFlowBodyPurpose,\n  SubmitFlowStepBody,\n  SubmitFlowStepBodyChallengeResponse,\n  SubmitFlowStepBodyFields,\n} from \"@zitadel/api/generated/model\";\nimport { ApiError, apiErrorMessage } from \"@zitadel/api/runtime/fetch\";\nimport { zitadelTrustmarkInnerHtml } from \"../internal/attribution-markup.js\";\nimport type { Liquid, Template } from \"liquidjs\";\nimport { css, html, LitElement, type PropertyValues } from \"lit\";\nimport { customElement, property, state } from \"lit/decorators.js\";\n\nimport \"../atoms/index.js\";\nimport { unsafeHTML } from \"lit/directives/unsafe-html.js\";\n\nimport { emit } from \"../internal/emit.js\";\nimport { escapeHtml } from \"../internal/escape-html.js\";\nimport {\n  exchangeSession,\n  getCurrentStep,\n  startFlow as apiStartFlow,\n  submitStep as apiSubmitStep,\n} from \"./api-client.js\";\nimport { armAssetFallbacks } from \"./asset-fallback.js\";\nimport { validateBranding } from \"./branding-validator.js\";\nimport type { Branding } from \"./branding.js\";\nimport { stampExportparts } from \"./exportparts.js\";\nimport { createLiquidEngine, localiseFlowErrorKeys } from \"./liquid.js\";\nimport { en, builtinLocales, type Locale } from \"./locales/index.js\";\nimport { patchMandatoryGates } from \"./mandatory-gates.js\";\nimport { resolveApi, type ProjectAttrs } from \"./resolve-api.js\";\nimport { createSanitiser } from \"./sanitiser.js\";\nimport { ZitadelSurface } from \"./surface.js\";\nimport type { FlowError, FlowIdentity, LiquidContext } from \"./template-context.js\";\nimport { TEMPLATE_NAMES } from \"./template-names.js\";\n\nimport layoutChromeCss from \"./templates/layout-chrome.css?inline\";\n\n/**\n * The uniform value contract every input atom exposes (`<zl-field>`,\n * `<zl-select>`, `<zl-checkbox>`, and any future field atom). The orchestrator\n * reads and restores field values exclusively through `formValue`, so it never\n * has to know an atom's tag or internal shape — a new field type works with no\n * change here.\n */\ntype FieldAtom = HTMLElement & { formValue: string };\n\n/** Narrow a rendered named element to the `formValue` field-atom contract. */\nfunction isFieldAtom(el: Element): el is FieldAtom {\n  return typeof (el as Partial<FieldAtom>).formValue === \"string\";\n}\n\n/**\n * `<zitadel-login>` — the auth-UI orchestrator.\n *\n * Drives the typed `@zitadel/api` Flow API directly: `POST /flow`\n * starts a flow, `POST /flow/{id}/submit` advances it. Renders each step\n * through LiquidJS, sanitises the output via DOMPurify, and mounts the\n * result inside a real `<form>` element in its Shadow DOM via Lit's\n * `unsafeHTML` directive. Atom CustomEvents (`zl-input` / `zl-submit`)\n * and the form's native `submit` event feed back into the\n * submit cycle.\n *\n * Form participation: the orchestrator owns the `<form>` so Enter submits,\n * browsers offer \"save password\" prompts, and password managers / autofill\n * see a real form. Each `<zl-field>` is form-associated (see\n * `docs/design/branding/form-participation.md`) so its value participates in\n * the form even though it lives inside its own shadow root. The shadow root\n * also delegates focus, and after each step swap focus moves to the first\n * field so screen-reader and keyboard users land in a sensible spot.\n *\n * Session/state: the server is stateless between requests — a `_zflow`\n * HttpOnly cookie carries orchestration state. We always run with\n * `credentials: \"include\"` (set in `api-client.ts`). The flow handle (`id`)\n * may rotate on pivots/pops; we re-read it from every response.\n *\n * Spec sources:\n * - `docs/design/flowengine/flow-engine-guide.md`\n * - `docs/design/branding/templates.md`\n * - `docs/design/branding/tokens.md`\n * - `docs/design/branding/schema.md`\n * - `docs/design/branding/form-participation.md`\n * - `docs/design/flowengine/template-security.md`\n */\n@customElement(\"zitadel-login\")\nexport class ZitadelLogin extends ZitadelSurface {\n  static override shadowRootOptions: ShadowRootInit = {\n    ...LitElement.shadowRootOptions,\n    delegatesFocus: true,\n  };\n\n  // Host layout defaults. A bare custom element is inline-level, which makes\n  // it collapse to content width when dropped into a `display: flex` parent\n  // and never reach the orchestrator's intended full-bleed shell. We claim\n  // the page by default; host pages that want to constrain the orchestrator\n  // can still set `width`/`min-height` on the element directly.\n  static override styles = css`\n    :host {\n      display: block;\n      width: 100%;\n    }\n  `;\n\n  // `variant` and `theme` come from `ZitadelSurface`. Login adds one\n  // variant-specific behavior on top of the shared surface polarity: `page`\n  // focuses the first field on load, `widget` never steals focus.\n\n  @property({ type: String }) accessor purpose: CreateFlowBodyPurpose = \"login\";\n\n  /**\n   * Name of the flow definition to run, matching the `name` in its flow\n   * file. When set, the server resolves that definition directly instead\n   * of picking one by audience. Omit to run the project's default flow.\n   */\n  @property({ type: String, attribute: \"flow-name\" }) accessor flowName = \"\";\n\n  /**\n   * SDK project handle returned by `configureZitadel()`. Set from JS (or a\n   * framework binding). When set, takes precedence over both the\n   * `project-id`/`proxy-path`/`url` attributes and the global singleton from\n   * `getZitadelConfig()`.\n   */\n  @property({ attribute: false }) accessor project: ZitadelProject | undefined;\n\n  /**\n   * Project ID, set declaratively in HTML. Lets the component be configured on\n   * a plain page without JS or `configureZitadel()`. Ignored when the `project`\n   * property or a `configureZitadel()` global is set. See {@link projectAttrs}.\n   */\n  @property({ type: String, attribute: \"project-id\" }) accessor projectId = \"\";\n\n  /**\n   * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.\n   * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.\n   */\n  @property({ type: String, attribute: \"proxy-path\" }) accessor proxyPath = \"\";\n\n  /**\n   * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —\n   * not needed in client-only setups.\n   */\n  @property({ type: String }) accessor url = \"\";\n\n  /**\n   * URL to navigate to after a successful embedded sign-in. When set, the\n   * orchestrator exchanges the terminal `handoff_token` via the generated\n   * API client (setting the session cookie) and then performs a full\n   * navigation to this URL so host middleware can observe the cookie.\n   * For `complete: \"redirect\"` the orchestrator follows `redirect_uri`\n   * instead and does not run the exchange.\n   */\n  @property({ type: String, attribute: \"post-sign-in-url\" }) accessor postSignInUrl = \"\";\n\n  /**\n   * Existing flow handle to resume rather than start a new flow. When set,\n   * the orchestrator hits `GET /flow/{id}` instead of `POST /flow` on\n   * mount, so a page reload after a network blip can re-render the same\n   * step without losing collected state.\n   */\n  @property({ type: String, attribute: \"resume-flow-id\" }) accessor resumeFlowId = \"\";\n\n  /**\n   * BCP 47 language tag (e.g. `\"de\"`, `\"en-US\"`). The widget resolves this\n   * to a built-in locale dictionary. Falls back to auto-detection from\n   * `document.documentElement.lang` or `navigator.language` when empty.\n   */\n  @property({ type: String }) override accessor lang = \"\";\n\n  /**\n   * Custom locale dictionaries keyed by language code. Entries may be\n   * partial — each is merged over the built-in dictionary for its language,\n   * so a preset like {@link businessLocales} (or a hand-written subset) is\n   * directly assignable:\n   *\n   * ```ts\n   * import { businessLocales } from \"@zitadel/components\";\n   * loginElement.locales = businessLocales;\n   * // or override individual keys:\n   * loginElement.locales = { en: { \"identifier.title\": \"Welcome\" } };\n   * ```\n   */\n  @property({ attribute: false }) accessor locales:\n    | Readonly<Record<string, Partial<Locale>>>\n    | undefined;\n\n  @state() private accessor response: CreateFlow201 | null = null;\n\n  @state() private accessor branding: Branding | undefined = undefined;\n\n  @state() private accessor loading = false;\n\n  @state() private accessor startupError: string | null = null;\n\n  @state() private accessor formValues: Record<string, string> = {};\n\n  private engine: Liquid | null = null;\n\n  private readonly sanitise = createSanitiser();\n\n  /**\n   * Cached compiled tenant template, keyed by source string. Re-rendering on\n   * every `formValues` change otherwise re-parses the same template.\n   */\n  private tenantTemplateCache: { source: string; template: Template[] } | null = null;\n\n  /**\n   * Whether the widget currently owns a same-document history entry (the\n   * \"sentinel\"). The sentinel exists so the browser's back gesture fires\n   * `popstate` instead of leaving the page. Exactly one sentinel is on\n   * the stack at a time: it is pushed when a step with a `kind: \"back\"`\n   * action renders, re-armed by `onPopState` after the browser consumes\n   * it, and retired by `applyResponse` when a step without a back action\n   * renders. The entry reuses the current URL, so the host page's\n   * location (including any hash-router fragment) is never modified.\n   */\n  private armed = false;\n\n  /**\n   * Set immediately before a self-initiated `history.back()` so the\n   * resulting `popstate` is ignored instead of being interpreted as a\n   * user back gesture.\n   */\n  private ignoreNextPop = false;\n\n  /** Bound `popstate` handler stored for cleanup in `disconnectedCallback`. */\n  private readonly handlePopState = this.onPopState.bind(this);\n\n  override createRenderRoot(): HTMLElement | DocumentFragment {\n    const root = super.createRenderRoot();\n    if (root instanceof ShadowRoot) {\n      // jsdom 29 partially implements `adoptedStyleSheets` — the property\n      // exists but isn't iterable. Treat a missing iterable as the empty\n      // list so the orchestrator boots in unit tests without crashing.\n      const existing: readonly CSSStyleSheet[] = Array.isArray(root.adoptedStyleSheets)\n        ? root.adoptedStyleSheets\n        : [];\n      const sheet = new CSSStyleSheet();\n      sheet.replaceSync(layoutChromeCss);\n      root.adoptedStyleSheets = [...existing, sheet];\n      root.addEventListener(\"zl-input\", this.handleAtomInput as EventListener);\n      // Editing any control (or dismissing the alert) retires the current\n      // step error. `zl-change` covers <zl-checkbox>/<zl-select>, which\n      // don't emit `zl-input`; the clearing is imperative DOM surgery so\n      // the rendered step string stays byte-identical and the subtree\n      // (including any in-flight <zl-passkey>) is never rebuilt mid-edit.\n      root.addEventListener(\"zl-change\", this.handleAtomEdited as EventListener);\n      root.addEventListener(\"zl-dismiss\", this.handleAlertDismiss as EventListener);\n      // <zl-button> dispatches `zl-submit` for both primary submits and\n      // secondary actions; the orchestrator picks the right path based on\n      // the button's `type` and `action`.\n      root.addEventListener(\"zl-submit\", this.handleAtomSubmit as EventListener);\n      root.addEventListener(\"click\", this.handleDelegatedAction as EventListener);\n      // Native <form> submit fires on Enter inside any field and after the\n      // browser's autofill / save-password handshake. Intercept it so we can\n      // hand off to our flow-submit cycle without the page reloading.\n      root.addEventListener(\"submit\", this.handleFormSubmit as EventListener);\n      // <zl-passkey> emits `zl-passkey-result` after a successful WebAuthn\n      // ceremony. Auto-submit the proof so the user doesn't have to click\n      // \"Continue\" — the ceremony IS the submission (ADR 013).\n      root.addEventListener(\"zl-passkey-result\", this.handlePasskeyResult as EventListener);\n      // <zl-passkey> emits `zl-passkey-error` when the ceremony fails or is\n      // cancelled. Surface the error on the current step.\n      root.addEventListener(\"zl-passkey-error\", this.handlePasskeyError as EventListener);\n    }\n    return root;\n  }\n\n  override connectedCallback(): void {\n    super.connectedCallback();\n    if (typeof window !== \"undefined\") {\n      window.addEventListener(\"popstate\", this.handlePopState);\n    }\n  }\n\n  override disconnectedCallback(): void {\n    super.disconnectedCallback();\n    if (typeof window !== \"undefined\") {\n      window.removeEventListener(\"popstate\", this.handlePopState);\n    }\n  }\n\n  /**\n   * Start the flow after the first render rather than in `connectedCallback`.\n   * Frameworks that wrap web components (e.g. `@lit/react` in the console)\n   * attach the element first and then assign object properties (`branding`,\n   * `locale`) via setters. `connectedCallback` runs synchronously on attach\n   * — before any setters from a wrapper's effects/refs — so reading those\n   * properties there sees stale defaults. `firstUpdated` runs after Lit's\n   * first render, by which time setters from the wrapping framework have\n   * fired.\n   */\n  protected override firstUpdated(): void {\n    // Defer so `startFlow()` can set `loading` without scheduling a second\n    // update before Lit finishes this commit (change-in-update warning).\n    queueMicrotask(() => void this.startFlow());\n  }\n\n  /**\n   * Resolves the effective locale dictionary. The built-in dictionary for the\n   * resolved language is used as the base; entries from the `locales` map (if\n   * set) are spread on top so partial overrides work without importing and\n   * spreading the full base dictionary.\n   *\n   * Priority: explicit `lang` attr → `navigator.language` (user preference)\n   * → `document.documentElement.lang` (page default) → English fallback.\n   */\n  private resolveLocale(): Locale {\n    const code =\n      this.lang ||\n      (typeof navigator !== \"undefined\" ? navigator.language : \"\") ||\n      (typeof document !== \"undefined\" ? document.documentElement.lang : \"\");\n    const primary = (code.split(\"-\")[0] ?? \"\").toLowerCase();\n    const builtin = builtinLocales[primary] ?? en;\n    const custom = this.locales?.[primary];\n    if (!custom) return builtin;\n\n    // Entries are Partial — merge key-by-key and skip explicit `undefined`\n    // values, which a plain spread would let shadow the built-in copy.\n    const merged: Locale = { ...builtin };\n    for (const [key, value] of Object.entries(custom)) {\n      if (value !== undefined) merged[key] = value;\n    }\n    return merged;\n  }\n\n  override willUpdate(changed: PropertyValues<this>): void {\n    if (!this.engine || changed.has(\"locales\") || changed.has(\"lang\")) {\n      this.engine = createLiquidEngine({ locale: this.resolveLocale() });\n    }\n    this.applySurfaceTheme(this.branding);\n    this.setAttribute(\"aria-busy\", this.loading ? \"true\" : \"false\");\n  }\n\n  override updated(changed: PropertyValues<this>): void {\n    // Re-stamp part forwarding and widget-mode chrome on every commit:\n    // `unsafeHTML` re-parses whenever the rendered string changes (step\n    // swap, loading toggle, error dismiss), replacing previously stamped\n    // nodes. The template's `zl-page-shell` sits in a different shadow\n    // scope, so the variant reaches it as a stamped attribute, not a\n    // `:host([variant])` selector.\n    if (this.shadowRoot) {\n      stampExportparts(this.shadowRoot);\n      // A configured-but-dead logo_url/hero_url is invisible everywhere else\n      // in the pipeline; this is the only layer that can see the image fail.\n      armAssetFallbacks(this.shadowRoot);\n      const widget = this.variant !== \"page\";\n      for (const shell of this.shadowRoot.querySelectorAll(\"zl-page-shell\")) {\n        shell.toggleAttribute(\"data-widget\", widget);\n        // CSS-level so it also covers user-ejected templates: the rule in\n        // layout-chrome.css hides `.zl-card-title`/`.zl-card-subtitle`\n        // visually while keeping the step's accessible name.\n        shell.toggleAttribute(\"data-suppress-header\", this.suppressHeader);\n      }\n      // Stamped on the card too: its header REGION must leave the flex flow\n      // (card-host.css) or the card keeps a blank 32px header band — the\n      // slotted headings alone going sr-only doesn't collapse the region.\n      for (const card of this.shadowRoot.querySelectorAll(\"zl-card\")) {\n        card.toggleAttribute(\"data-suppress-header\", this.suppressHeader);\n      }\n    }\n    const props = changed as Map<string, unknown>;\n    if (!props.has(\"response\")) return;\n    // `changed` holds the OLD value: nullish (`null` initializer, or\n    // undefined when the property never changed before) means this commit\n    // applied the first response — the initial paint, not a user-driven\n    // step swap.\n    void this.hydrateStepAfterRender(props.get(\"response\") == null);\n  }\n\n  /**\n   * Apply captured values and move focus once the new step has fully\n   * rendered. This commit produces the step's field/action atoms, but those\n   * render their own shadow DOM on a later microtask — so await this element's\n   * update *and* the child atoms' first render before touching them, rather\n   * than guessing a frame with `requestAnimationFrame`.\n   *\n   * Focus on the *initial* response is page-mode-only: a dedicated login\n   * route should focus its first field, but a widget embedded further down\n   * an arbitrary page must not steal focus and scroll-jump on load. Step\n   * swaps are user-initiated, so focus moves in both modes.\n   */\n  private async hydrateStepAfterRender(initial = false): Promise<void> {\n    await this.updateComplete;\n    const atoms = this.shadowRoot?.querySelectorAll<LitElement>(\n      \"zl-field, zl-select, zl-checkbox, zl-button\",\n    );\n    if (atoms) {\n      await Promise.all(Array.from(atoms).map((atom) => atom.updateComplete));\n    }\n    this.applyValuesToFields();\n    if (!initial || this.variant === \"page\") {\n      this.moveFocusToFirstField(initial && this.variant === \"page\");\n    }\n  }\n\n  override render() {\n    if (this.startupError) {\n      // Same chrome a step renders into (page shell + card), because this is\n      // still the login surface — just one that could not start. Without the\n      // shell the alert lands bare in the top-left corner of an otherwise\n      // empty page, which reads as a broken app rather than as auth reporting\n      // a problem: the most common trigger is a misconfigured origin, where\n      // the first step paints normally and only the submit fails.\n      return html`<form class=\"zl-mount\" novalidate>\n        <zl-page-shell>\n          <zl-card>\n            <zl-alert severity=\"error\">${this.startupError}</zl-alert>\n          </zl-card>\n        </zl-page-shell>\n      </form>`;\n    }\n    if (!this.response || !this.engine) {\n      return html`<slot name=\"loader\"></slot>`;\n    }\n    const rendered = this.injectAttribution(this.renderStep(this.response.step, this.engine));\n    return html`<form\n      class=\"zl-mount\"\n      part=\"form\"\n      novalidate\n      aria-busy=${this.loading ? \"true\" : \"false\"}\n    >\n      ${unsafeHTML(rendered)}\n    </form>`;\n  }\n\n  /**\n   * Inject the attribution badge into the rendered template's\n   * `<zl-page-shell>` footer slot. The attribution must live INSIDE the\n   * page-shell so it sits within the 100vh viewport rhythm (matching the\n   * Figma sign-in frame where the pill sits 24px below the card, both\n   * centred on the page). It can't be a sibling of the page-shell because\n   * the page-shell already occupies the full viewport height.\n   *\n   * This markup is appended AFTER `renderStep` has sanitised the Liquid\n   * output, so it is not run through DOMPurify. It is orchestrator-owned and\n   * any tenant-supplied values (`custom_link`) are escaped via `escapeHtml`.\n   */\n  private injectAttribution(rendered: string): string {\n    // A template that names where the trustmark goes wins over the footer slot.\n    // The split designs use it to keep the mark with their form column: the\n    // shell's footer spans both panes, so it would otherwise sit 24px below the\n    // *row*, and the row is as tall as the brand pane rather than the card.\n    // `ALLOW_DATA_ATTR` keeps the anchor through the sanitiser, which may have\n    // normalised it to `data-zl-attribution-anchor=\"\"`.\n    const anchor = /<div\\s+data-zl-attribution-anchor(?:=\"\")?\\s*>\\s*<\\/div>/;\n    if (anchor.test(rendered)) {\n      // Suppressed attribution replaces the anchor with nothing, so the form\n      // column does not keep a 24px gap below an element that renders empty.\n      return rendered.replace(anchor, this.renderAttributionHtml(\"inline\"));\n    }\n    const html = this.renderAttributionHtml(\"footer\");\n    if (!html) return rendered;\n    if (rendered.includes(\"</zl-page-shell>\")) {\n      return rendered.replace(\"</zl-page-shell>\", `${html}</zl-page-shell>`);\n    }\n    return rendered + html;\n  }\n\n  /**\n   * \"Secured with Zitadel\" attribution chrome injected into every\n   * template's page-shell footer slot. Controlled by\n   * `branding.attribution.show_zitadel` — defaults to `true` for\n   * community / OSS deployments. Licensed tenants can suppress the badge\n   * entirely or swap it for a `custom_link` value.\n   */\n  private renderAttributionHtml(placement: \"footer\" | \"inline\" = \"footer\"): string {\n    const attribution = this.branding?.attribution;\n    const show = attribution?.show_zitadel !== false;\n    const custom = attribution?.custom_link;\n    if (!show && !custom) {\n      return \"\";\n    }\n    // The design sets the trustmark as plain text beside the logotype rather\n    // than inside a chip. It also draws a session-lifetime badge next to it —\n    // not rendered, because nothing on the flow response carries an expiry to\n    // put in it. A badge showing an invented duration would be worse than none.\n    const mark = custom\n      ? `<a class=\"zl-trustmark__mark\" part=\"attribution-mark\" href=\"${escapeHtml(\n          String(custom.href),\n        )}\">${escapeHtml(String(custom.label))}</a>`\n      : `<a class=\"zl-trustmark__mark\" part=\"attribution-mark\" href=\"https://zitadel.com\" aria-label=\"Secured with Zitadel\">${zitadelTrustmarkInnerHtml()}</a>`;\n    const slot = placement === \"footer\" ? ` slot=\"footer\"` : \"\";\n    return `<div${slot} part=\"attribution\" class=\"zl-attribution zl-trustmark\">${mark}</div>`;\n  }\n\n  /** Declarative config read from this element's attributes. */\n  private get projectAttrs(): ProjectAttrs {\n    return { projectId: this.projectId, proxyPath: this.proxyPath, url: this.url };\n  }\n\n  private async startFlow(): Promise<void> {\n    this.loading = true;\n    this.startupError = null;\n    try {\n      // Resolve inside the try so a missing configuration surfaces through\n      // `handleTransportError` (rendered as `startupError`) rather than as an\n      // unhandled promise rejection from `firstUpdated`'s microtask.\n      const { project: cfg, api } = resolveApi(this.project, this.projectAttrs, \"<zitadel-login>\");\n      let wire: CreateFlow201;\n      if (this.resumeFlowId) {\n        wire = await getCurrentStep(api, this.resumeFlowId);\n      } else {\n        if (!cfg.projectId) {\n          throw new Error(\n            \"<zitadel-login> requires a project id (the `project-id` attribute, \" +\n              \"`configureZitadel({ projectId })`, or a `project` handle) to start a flow.\",\n          );\n        }\n        wire = await apiStartFlow(api, {\n          project_id: cfg.projectId,\n          purpose: this.purpose,\n          ...(this.flowName ? { flow_definition_name: this.flowName } : {}),\n        });\n      }\n      this.applyResponse(wire);\n      // Symmetric with `submit()`: every applied step announces itself, the\n      // first one included. A host app driving its own chrome from the step\n      // (progress, headings, analytics) would otherwise see nothing until\n      // after the visitor's first submit.\n      emit(this, \"zitadel-flow-step\", { step: wire.step });\n    } catch (error) {\n      this.handleTransportError(this.describeFlowSelectionError(error));\n    } finally {\n      this.loading = false;\n    }\n  }\n\n  /**\n   * When a `flow-name` lookup fails, the server's envelope only says\n   * \"not found\" / \"purpose mismatch\" — it cannot know the name came from\n   * an attribute. Rewrap those two codes with the attribute and the fix;\n   * every other error passes through untouched.\n   */\n  private describeFlowSelectionError(error: unknown): unknown {\n    if (!this.flowName || !(error instanceof ApiError)) return error;\n    const code =\n      typeof error.body === \"object\" && error.body !== null && \"code\" in error.body\n        ? String((error.body as { code: unknown }).code)\n        : \"\";\n    if (code === \"flowdef.not_found\") {\n      return new Error(\n        `<zitadel-login> flow-name=\"${this.flowName}\" does not match any active flow ` +\n          `definition in this project. Check the \\`name\\` in your flow file and that ` +\n          `it has been applied (\\`zitadel apply\\`).`,\n      );\n    }\n    if (code === \"flowdef.purpose_mismatch\") {\n      return new Error(\n        `<zitadel-login> flow-name=\"${this.flowName}\" matched a flow definition that ` +\n          `does not serve purpose \"${this.purpose}\".`,\n      );\n    }\n    return error;\n  }\n\n  private applyResponse(wire: CreateFlow201): void {\n    // A fresh response carries fresh (or no) errors — un-dismiss.\n    this.stepErrorDismissed = false;\n    this.response = wire;\n    const { branding, issues } = validateBranding(wire.branding, {\n      renderingOrigin: this.ownerDocument.location.origin,\n    });\n    this.branding = branding;\n    this.themeController.setBranding(branding);\n    if (issues.length > 0) {\n      console.warn(\"[zitadel-login] branding payload has issues:\", issues);\n    }\n    // Defaults seed every declared field; existing entries (typed input,\n    // carry-over from prior steps) win on conflict.\n    this.formValues = { ...collectInitialValues(wire.step), ...this.formValues };\n\n    // History API (ADR 022): keep exactly one same-document entry — the\n    // sentinel — on the stack while the current step supports\n    // back-navigation, so the browser's back gesture fires `popstate`\n    // (handled in `onPopState`) instead of leaving the page. Arming only\n    // on the unarmed → armed transition means consecutive back-capable\n    // steps (and re-renders of the same step, e.g. after a failed submit)\n    // never grow the stack. Steps without a `kind: \"back\"` action retire\n    // the sentinel — the next back press then navigates the host page\n    // (leaves the flow), which is correct.\n    if (typeof window !== \"undefined\") {\n      const hasBack = Boolean(wire.step.actions?.some((a) => a.kind === \"back\"));\n      if (hasBack && !this.armed) {\n        // Spread the host's state: vue-router (Nuxt) keeps `position` /\n        // `back` / `forward` here and reads them on popstate. Replacing it\n        // wholesale leaves the sentinel opaque to the host router.\n        history.pushState({ ...history.state, zl: true }, \"\");\n        this.armed = true;\n      } else if (!hasBack && this.armed) {\n        this.armed = false;\n        // Only traverse while we still own the current entry. If the host\n        // pushed its own entry after we armed, `history.back()` would pop\n        // *that* one and trigger a host back-navigation the user never\n        // asked for. Leaving a stale sentinel behind is the lesser evil —\n        // same tradeoff as disconnect; the popstate handler skips stale\n        // sentinels in one extra hop from either direction.\n        if ((history.state as { zl?: boolean } | null)?.zl === true) {\n          this.ignoreNextPop = true;\n          history.back();\n        }\n      }\n    }\n\n    void this.maybeCompleteFlow(wire);\n  }\n\n  /**\n   * Acts on terminal flow steps. The wire surfaces two kinds of completion:\n   *\n   * - `step.complete === \"redirect\"` — navigate the browser to\n   *   `response.redirect_uri` (OIDC/SAML `auth_request_id` resolved). This\n   *   takes precedence over `post-sign-in-url`.\n   * - `step.complete === \"show\"` — when `post-sign-in-url` is set, exchange\n   *   the `handoff_token` for a session cookie and navigate there.\n   *\n   * `zitadel-flow-complete` is always emitted so hosts with custom post-sign-in\n   * flows can handle the handoff themselves when `post-sign-in-url` is omitted.\n   */\n  private async maybeCompleteFlow(response: CreateFlow201): Promise<void> {\n    const behavior = response.step.complete;\n    if (!behavior) return;\n\n    emit(this, \"zitadel-flow-complete\", {\n      behavior,\n      redirect_uri: response.redirect_uri,\n      handoff_token: response.handoff_token,\n      handoff_token_expires_at: response.handoff_token_expires_at,\n    });\n\n    if (typeof window === \"undefined\") return;\n    if (behavior === \"redirect\" && response.redirect_uri) {\n      window.location.assign(response.redirect_uri);\n      return;\n    }\n\n    const handoffToken = response.handoff_token;\n    if (behavior === \"show\" && handoffToken && this.postSignInUrl) {\n      this.loading = true;\n      try {\n        const { project: cfg, api } = resolveApi(\n          this.project,\n          this.projectAttrs,\n          \"<zitadel-login>\",\n        );\n        await exchangeSession(api, { handoff_token: handoffToken }, { project_id: cfg.projectId });\n        window.location.assign(this.postSignInUrl);\n      } catch (error) {\n        this.handleTransportError(error);\n      } finally {\n        this.loading = false;\n      }\n    }\n  }\n\n  private renderStep(step: CreateFlow201Step, engine: Liquid): string {\n    const tenantSource =\n      typeof this.branding?.liquid_template === \"string\" && this.branding.liquid_template.length > 0\n        ? this.branding.liquid_template\n        : null;\n\n    // `error.*` keys — the server's validation dialect\n    // (`error.<field>_<rule>`, one key per violation, \"; \"-joined) —\n    // localise via the catalog with generic per-rule fallbacks; anything\n    // else (outcome names, diagnostics) stays verbatim.\n    const rawErrors: FlowError[] = step.error\n      ? (localiseFlowErrorKeys(step.error, {\n          locale: this.resolveLocale(),\n          stepName: step.name ?? \"\",\n          // Inline-routed keys downgrade to a banner message when the\n          // step doesn't render their field — the inline outlet is the\n          // only place the template shows them.\n          fields: (step.fields ?? []).map((field) => field.name),\n        }) ?? [{ message: step.error }])\n      : [];\n    // A dismissed step error must not flicker back on the `loading`\n    // re-render (the only step re-render while the user stays on this\n    // step — it rebuilds the subtree anyway). While idle the array must\n    // stay as-is: keystroke re-renders have to produce a byte-identical\n    // string, and the imperatively removed alert stays removed.\n    const errors: FlowError[] = this.loading && this.stepErrorDismissed ? [] : rawErrors;\n\n    const fields = step.fields ?? [];\n    const actions = step.actions ?? [];\n    const context: LiquidContext = {\n      step: {\n        name: step.name,\n        complete: step.complete,\n        texts: step.texts ?? {},\n      },\n      fields,\n      actions,\n      gates: step.gates ?? {},\n      sso_providers: step.sso_providers ?? [],\n      // While submitting a passkey proof, `loading` re-renders the current\n      // step before the server returns. Re-rendering the same challenge would\n      // reconnect `<zl-passkey>` and start a second WebAuthn ceremony.\n      challenge: this.loading ? null : (step.challenge ?? null),\n      messages: [],\n      identity: this.deriveIdentity(),\n      errors,\n      branding: this.branding ?? {},\n      loading: this.loading,\n    };\n\n    let raw: string;\n    try {\n      if (tenantSource) {\n        const compiled =\n          this.tenantTemplateCache?.source === tenantSource\n            ? this.tenantTemplateCache.template\n            : engine.parse(tenantSource);\n        this.tenantTemplateCache = { source: tenantSource, template: compiled };\n        raw = engine.renderSync(compiled, context);\n      } else {\n        raw = engine.renderFileSync(TEMPLATE_NAMES.default, context);\n      }\n    } catch (error) {\n      console.error(\"[zitadel-login] Liquid render failed:\", error);\n      try {\n        raw = engine.renderFileSync(TEMPLATE_NAMES.default, context);\n      } catch {\n        return `<zl-alert severity=\"error\">We couldn't render this step.</zl-alert>`;\n      }\n    }\n\n    const patched = patchMandatoryGates(raw, step, this.resolveLocale());\n    return this.sanitise(patched);\n  }\n\n  /**\n   * Build a `FlowIdentity` from the orchestrator's captured form values so\n   * the signed-in template can greet the user by email without the API\n   * having to round-trip identity claims. Email comes from the\n   * identifier step; display name composes from `given_name` /\n   * `family_name` when the register step ran.\n   */\n  private deriveIdentity(): FlowIdentity | null {\n    const email = this.formValues.email?.trim();\n    const given = this.formValues.given_name?.trim();\n    const family = this.formValues.family_name?.trim();\n    const display = [given, family].filter(Boolean).join(\" \").trim();\n    if (!email && !display) return null;\n    return {\n      ...(email ? { email_address: email } : {}),\n      ...(display ? { display_name: display } : email ? { display_name: email } : {}),\n    };\n  }\n\n  /** All rendered input atoms exposing the `formValue` contract. */\n  private fieldAtoms(): FieldAtom[] {\n    const root = this.shadowRoot;\n    if (!root) return [];\n    return Array.from(root.querySelectorAll<HTMLElement>(\"[name]\")).filter(isFieldAtom);\n  }\n\n  private applyValuesToFields(): void {\n    for (const atom of this.fieldAtoms()) {\n      const name = atom.getAttribute(\"name\");\n      if (!name) continue;\n      const next = this.formValues[name];\n      if (next !== undefined && atom.formValue !== next) {\n        atom.formValue = next;\n      }\n    }\n  }\n\n  /**\n   * Names of the current step's `required` fields whose captured value is\n   * empty. Reads each atom's live `formValue` (the getter reflects the native\n   * control, so autofill that skipped `input` events is still seen), so this\n   * is browser-independent and does not rely on native constraint validation.\n   */\n  private missingRequiredFields(): string[] {\n    const values = new Map<string, string>();\n    for (const atom of this.fieldAtoms()) {\n      const name = atom.getAttribute(\"name\");\n      if (name) values.set(name, atom.formValue);\n    }\n    const missing: string[] = [];\n    for (const field of this.response?.step.fields ?? []) {\n      // A checkbox always submits a real boolean (`false` when unticked), so it\n      // is never \"missing\"; a must-accept boolean is enforced by the schema\n      // (`const: true`), not this gate.\n      if (field.type === \"checkbox\") continue;\n      if (field.required && (values.get(field.name) ?? \"\") === \"\") {\n        missing.push(field.name);\n      }\n    }\n    return missing;\n  }\n\n  /**\n   * Surface a client-side required-field error using the server's own\n   * validation dialect (`error.<field>_required`, \"; \"-joined), so it flows\n   * through the same localisation and inline/banner routing as a real\n   * backend rejection — no native browser bubble. Idempotent: re-running with\n   * the same keys (both submit entry points fire on one click) is a no-op.\n   */\n  private reportRequiredErrors(fields: readonly string[]): void {\n    if (!this.response) return;\n    const errorKey = fields.map((name) => `error.${name}_required`).join(\"; \");\n    if (this.response.step.error === errorKey) return;\n    this.stepErrorDismissed = false;\n    this.response = {\n      ...this.response,\n      step: { ...this.response.step, error: errorKey },\n    };\n  }\n\n  /**\n   * Snapshot the current step's field values straight from the rendered input\n   * atoms through their uniform `formValue` contract. Tag-agnostic: every\n   * form-participating atom is read the same way, so a new field type needs no\n   * change here. Declared fields default to \"\" so the backend still runs its\n   * required-checks and challenge dispatch instead of silently advancing on a\n   * field-less payload. Captured values are folded into `formValues` for\n   * cross-step identity (the signed-in greeting) and post-error restoration.\n   */\n  private collectSubmitFields(): SubmitFlowStepBodyFields {\n    const current = new Map<string, string>();\n    for (const atom of this.fieldAtoms()) {\n      const name = atom.getAttribute(\"name\");\n      if (name) current.set(name, atom.formValue);\n    }\n    if (current.size > 0) {\n      this.formValues = { ...this.formValues, ...Object.fromEntries(current) };\n    }\n    const fields: SubmitFlowStepBodyFields = {};\n    for (const f of this.response?.step.fields ?? []) {\n      const value = current.get(f.name) ?? \"\";\n      // A `checkbox` maps to a JSON `boolean` schema property. The atom carries\n      // its value token when checked and \"\" when unchecked (native-checkbox\n      // semantics), but the server validates the property as a real boolean and\n      // rejects a string, so submit `true`/`false` rather than the token.\n      if (f.type === \"checkbox\") {\n        fields[f.name] = value !== \"\";\n        continue;\n      }\n      // A `select` renders a closed `enum`. Its leading placeholder option\n      // submits \"\" when the user picks nothing, but \"\" is not a member of the\n      // enum, so sending it fails the server's enum validation (e.g.\n      // create_user rejects with \"no enum value matched\"). Omit the field\n      // unless the value is an actual enum member the schema allows — which\n      // includes \"\" only when the schema explicitly lists it, so an\n      // intentionally-allowed empty option is still sent. An omitted required\n      // select still fails the server's required-check, surfacing a clearer\n      // \"required\" error instead of an enum mismatch. Other fields keep the \"\"\n      // default so required-checks and challenge dispatch still run.\n      if (f.type === \"select\" && !isAllowedSelectValue(f, value)) continue;\n      fields[f.name] = value;\n    }\n    return fields;\n  }\n\n  /**\n   * True once the user retired the current step error by editing a field or\n   * dismissing the alert. Deliberately NON-reactive: consulting reactive\n   * state in `renderStep` would change its output string on the first\n   * post-dismiss keystroke, and `unsafeHTML` would rebuild the whole step\n   * subtree — wiping typed values (`hydrateStepAfterRender` only re-applies\n   * them on response changes) and reconnecting atoms. Reset on every new\n   * response; consulted only by the `loading` re-render, which rebuilds\n   * anyway.\n   */\n  private stepErrorDismissed = false;\n\n  private handleAtomInput = (event: CustomEvent<{ name: string; value: string }>): void => {\n    if (!event.detail) return;\n    const { name, value } = event.detail;\n    if (!name) return;\n    this.formValues = { ...this.formValues, [name]: value };\n    this.syncFieldElementValue(name, value);\n    this.clearStaleErrors(name);\n    emit(this, \"zitadel-flow-input\", { name, value });\n  };\n\n  /**\n   * `zl-change` from <zl-checkbox>/<zl-select>. Persist the atom's value into\n   * `formValues` — mirroring `handleAtomInput` for text fields — so a later\n   * step re-render (a validation error re-parses the template via `unsafeHTML`\n   * and rebuilds the atoms) restores the selection/checked state through\n   * `applyValuesToFields` instead of dropping back to the template default.\n   * Reads the live `formValue` off the atom rather than the event's `value`\n   * token, because an unchecked checkbox reports \"\" there but keeps its token\n   * in the detail. Also clears stale errors on the edited field.\n   */\n  private handleAtomEdited = (event: CustomEvent<{ name?: string }>): void => {\n    const name = event.detail?.name;\n    if (!name) return;\n    const atom = event.target;\n    if (atom instanceof HTMLElement && isFieldAtom(atom)) {\n      this.formValues = { ...this.formValues, [name]: atom.formValue };\n    }\n    this.clearStaleErrors(name);\n  };\n\n  /** Explicit dismiss of the step-error alert (it removes itself). */\n  private handleAlertDismiss = (event: Event): void => {\n    const target = event.target as Element | null;\n    if (target?.matches?.(\"zl-alert[data-zl-step-error]\")) {\n      this.stepErrorDismissed = true;\n    }\n  };\n\n  /**\n   * Retire the current step error after the user edits `fieldName`:\n   * remove the form-level alert(s) and clear the edited field's inline\n   * error — other fields' inline errors stay until they are edited.\n   * Imperative on purpose; see {@link stepErrorDismissed}.\n   */\n  private clearStaleErrors(fieldName: string): void {\n    if (!this.response?.step.error) return;\n    const root = this.shadowRoot;\n    if (!root) return;\n    if (!this.stepErrorDismissed) {\n      this.stepErrorDismissed = true;\n      for (const alert of root.querySelectorAll(\"zl-alert[data-zl-step-error]\")) {\n        alert.remove();\n      }\n    }\n    // Schema field names are free-form (dots, quotes, `x-…#…`), so match by\n    // attribute value instead of interpolating into a CSS selector.\n    for (const field of root.querySelectorAll<HTMLElement & { invalid?: boolean; error?: string }>(\n      \"zl-field\",\n    )) {\n      if (field.getAttribute(\"name\") !== fieldName || !field.invalid) continue;\n      field.invalid = false;\n      field.error = \"\";\n    }\n  }\n\n  /** Mirror a value onto the matching rendered atom (used after atom events). */\n  private syncFieldElementValue(name: string, value: string): void {\n    for (const atom of this.fieldAtoms()) {\n      if (atom.getAttribute(\"name\") === name && atom.formValue !== value) {\n        atom.formValue = value;\n      }\n    }\n  }\n\n  private handleAtomSubmit = (event: CustomEvent<{ action: string | null }>): void => {\n    if (this.loading) return;\n    void this.submit(event.detail?.action ?? null);\n  };\n\n  /** Secondary navigation rows (`data-action` on `.zl-card-nav__link`). */\n  private handleDelegatedAction = (event: Event): void => {\n    const target = (event.target as HTMLElement | null)?.closest<HTMLElement>(\"[data-action]\");\n    if (!target || target.closest(\"zl-button\") || this.loading) return;\n    const action = target.getAttribute(\"data-action\");\n    if (!action) return;\n    event.preventDefault();\n    void this.submit(action);\n  };\n\n  private handleFormSubmit = (event: SubmitEvent): void => {\n    // Always intercept: we own the submit cycle. Without this the page would\n    // navigate to whatever `action` URL the form has (none) and lose state.\n    event.preventDefault();\n    if (this.loading) return;\n    // This is the sole submit path for the primary action (submit-type\n    // <zl-button> and Enter both drive `form.requestSubmit()`; the button no\n    // longer emits a parallel `zl-submit`). Enforce the step's required fields\n    // here and surface a styled, localised error instead of submitting an\n    // empty required value for the server to reject. Secondary actions (back,\n    // skip, passkey…) arrive via `zl-submit` → `handleAtomSubmit`, so they are\n    // never gated.\n    const missing = this.missingRequiredFields();\n    if (missing.length > 0) {\n      this.reportRequiredErrors(missing);\n      return;\n    }\n    // `submitter` is the button that triggered the submit. When the user\n    // pressed Enter inside a `<zl-field>`, the field calls\n    // `form.requestSubmit()` with no submitter, so we fall back to the first\n    // primary `<zl-button>`'s action (the step's primary action).\n    const submitter = event.submitter as HTMLElement | null;\n    const explicit = submitter?.getAttribute?.(\"action\") ?? null;\n    const action = explicit ?? this.findPrimaryAction();\n    void this.submit(action);\n  };\n\n  /**\n   * Handle a successful WebAuthn ceremony. Auto-submit with the proof\n   * as `challenge_response` so the flow advances without extra user\n   * interaction — the ceremony IS the factor verification (ADR 013).\n   */\n  private handlePasskeyResult = (\n    event: CustomEvent<{ challenge_id: string; method: string; proof: Record<string, unknown> }>,\n  ): void => {\n    if (this.loading) return;\n    const { challenge_id, method, proof } = event.detail;\n    void this.submit(method, {\n      challenge_id,\n      method,\n      proof,\n    });\n  };\n\n  /**\n   * Handle a WebAuthn ceremony error. Re-render the current step with\n   * an error message so the user sees feedback and can retry or skip.\n   *\n   * Guard: if the step already carries the same error key, skip the update.\n   * Mutating `this.response` triggers `unsafeHTML` to replace the DOM tree,\n   * which reconnects a fresh `<zl-passkey>` that immediately re-starts the\n   * ceremony — creating an infinite loop. The guard breaks the cycle.\n   *\n   * We also strip the `challenge` from the step so the template does not\n   * render a new `<zl-passkey>` on re-render. Without this, the first\n   * cancel would trigger a second ceremony (the guard prevents a third).\n   */\n  private handlePasskeyError = (\n    event: CustomEvent<{\n      challenge_id: string;\n      error: string;\n      aborted: boolean;\n      timed_out?: boolean;\n    }>,\n  ): void => {\n    if (!this.response) return;\n    const { error: message, aborted, timed_out: timedOut } = event.detail;\n    const errorKey = timedOut\n      ? \"error.passkey_timeout\"\n      : aborted\n        ? \"error.passkey_cancelled\"\n        : \"error.passkey_failed\";\n    if (this.response.step.error === errorKey) return;\n    // This path replaces the response without going through applyResponse;\n    // the fresh error must not start life dismissed.\n    this.stepErrorDismissed = false;\n    const { challenge: _dropped, ...stepWithoutChallenge } = this.response.step;\n    this.response = {\n      ...this.response,\n      step: { ...stepWithoutChallenge, error: errorKey },\n    };\n    console.warn(\n      `[zitadel-login] passkey ceremony ${timedOut ? \"timed out\" : aborted ? \"cancelled\" : \"failed\"}: ${message}`,\n    );\n  };\n\n  private findPrimaryAction(): string | null {\n    const root = this.shadowRoot;\n    if (!root) return null;\n    const primary =\n      root.querySelector('zl-button[hierarchy=\"primary\"][type=\"submit\"]') ??\n      root.querySelector('zl-button[hierarchy=\"primary\"]');\n    return primary?.getAttribute(\"action\") || null;\n  }\n\n  /**\n   * On the initial paint, only a field earns focus: script-moved focus with\n   * no prior interaction matches `:focus-visible`, so autofocusing a button\n   * on a field-less step (passkey-first) paints a ring that reads as a\n   * pre-selected state. Step swaps keep button focus — there the browser\n   * derives the modality from the user's actual input.\n   */\n  private moveFocusToFirstField(fieldsOnly = false): void {\n    const root = this.shadowRoot;\n    if (!root) return;\n    const focusables = fieldsOnly\n      ? this.fieldAtoms()\n      : Array.from(\n          root.querySelectorAll<HTMLElement>(\"zl-field, zl-select, zl-checkbox, zl-button\"),\n        );\n    const target = focusables.find(\n      (el) =>\n        !el.hasAttribute(\"disabled\") &&\n        !el.hasAttribute(\"hidden\") &&\n        el.getAttribute(\"type\") !== \"hidden\",\n    );\n    target?.focus();\n  }\n\n  private async submit(\n    action: string | null,\n    challengeResponse?: SubmitFlowStepBodyChallengeResponse,\n  ): Promise<void> {\n    if (!this.response || this.loading) return;\n    const { id, session_token } = this.response;\n    this.loading = true;\n    try {\n      // Only send field values the current step defines. `formValues` carries\n      // state across steps (e.g. email for the signed-in greeting), but\n      // collectSubmitFields keys off the step's declared fields, so a step\n      // without fields yields an empty map and never leaks prior values.\n      const fields = this.collectSubmitFields();\n      const body: SubmitFlowStepBody = {\n        session_token,\n        action: action ?? \"submit\",\n        fields,\n        ...(challengeResponse ? { challenge_response: challengeResponse } : {}),\n      };\n      const { api } = resolveApi(this.project, this.projectAttrs, \"<zitadel-login>\");\n      const wire = await apiSubmitStep(api, id, body);\n      this.applyResponse(wire);\n      emit(this, \"zitadel-flow-step\", { step: wire.step });\n    } catch (error) {\n      this.handleTransportError(error);\n    } finally {\n      this.loading = false;\n    }\n  }\n\n  /**\n   * Handle the browser's back/forward gesture (ADR 022). When `popstate`\n   * fires:\n   *\n   * - **Self-initiated** (`ignoreNextPop`) → `applyResponse` is retiring\n   *   the sentinel; ignore.\n   * - **Back press while armed** → the browser consumed the sentinel.\n   *   Re-arm it immediately — so the stack shape is identical on every\n   *   step and repeated presses behave the same at any flow depth — then\n   *   submit the step's `kind: \"back\"` action.\n   * - **Landing on the sentinel while armed** → the host page pushed an\n   *   entry above the sentinel (e.g. an in-page `#anchor` click) and the\n   *   user backed out of it. They are back where the widget expects them\n   *   — not asking the flow to go back; do nothing.\n   * - **Forward press onto a retired sentinel** (it survives as a forward\n   *   entry after `history.back()`) → bounce back: flow state is\n   *   server-authoritative, the browser cannot skip ahead\n   *   (ADR 022 §Edge cases).\n   * - Anything else is host-page traversal — leave the browser alone.\n   */\n  private onPopState(event: PopStateEvent): void {\n    if (this.ignoreNextPop) {\n      this.ignoreNextPop = false;\n      return;\n    }\n\n    if (this.armed) {\n      if ((event.state as { zl?: boolean } | null)?.zl === true) {\n        // Traversal landed ON the sentinel from an entry above it that the\n        // host page created after we armed. Position is as expected; the\n        // gesture was aimed at the host entry, not the flow.\n        return;\n      }\n      // Back press: the browser popped the sentinel.\n      this.armed = false;\n      const backAction = this.response?.step?.actions?.find((a) => a.kind === \"back\");\n      if (backAction) {\n        history.pushState({ zl: true }, \"\");\n        this.armed = true;\n        void this.submit(backAction.name);\n      }\n      return;\n    }\n\n    if ((event.state as { zl?: boolean } | null)?.zl === true) {\n      this.ignoreNextPop = true;\n      history.back();\n    }\n  }\n\n  private handleTransportError(error: unknown): void {\n    // For API rejections, prefer the server's error-envelope message (e.g.\n    // which origins a project allows) over the generic \"POST … returned N\".\n    const message =\n      error instanceof ApiError\n        ? apiErrorMessage(error)\n        : error instanceof Error\n          ? error.message\n          : \"Unexpected error contacting the Flow API.\";\n    this.startupError = message;\n    console.error(\"[zitadel-login]\", error);\n    emit(this, \"zitadel-flow-error\", { message });\n  }\n}\n\n/**\n * Whether `value` is a member of a select field's closed `enum`. A select\n * with no explicit enum has no submittable value, so this returns `false`\n * and the caller omits the field. Because the enum never contains \"\" unless\n * the schema deliberately lists it, an untouched placeholder (\"\") is omitted\n * rather than sent and rejected by the server's enum validation.\n */\nfunction isAllowedSelectValue(field: CreateFlow201StepFieldsItem, value: string): boolean {\n  return field.validation?.enum?.includes(value) ?? false;\n}\n\nfunction collectInitialValues(step: CreateFlow201Step): Record<string, string> {\n  const values: Record<string, string> = {};\n  if (!step.fields) return values;\n  for (const field of step.fields) {\n    values[field.name] = typeof field.value === \"string\" ? field.value : \"\";\n  }\n  return values;\n}\n\ndeclare global {\n  interface HTMLElementTagNameMap {\n    \"zitadel-login\": ZitadelLogin;\n  }\n}\n","import { LitElement, css, html, nothing } from \"lit\";\nimport { customElement, property, state } from \"lit/decorators.js\";\nimport { type ZitadelProject } from \"@zitadel/api/config\";\n\nimport { getSession, revokeSession } from \"./api-client.js\";\nimport { applyBaseTokens, applyBrandingTokens } from \"./branding-to-tokens.js\";\nimport { resolveApi, type ProjectAttrs } from \"./resolve-api.js\";\nimport { ThemeController, type ThemeMode } from \"./theme-controller.js\";\nimport { emit } from \"../internal/emit.js\";\nimport { baseHostStyles, focusVisibleStyles, t } from \"../styles/index.js\";\n\n/**\n * `<zitadel-logout>` — orchestrator-tier element that lets the signed-in user\n * sign out without touching the flow API.\n *\n * Reads the user's identity from the typed `getMySession` operation\n * (`GET /sessions/me`, credentialed) — the same source as `<zitadel-session>`,\n * so both signed-in surfaces stay consistent and work against the real backend.\n * The avatar/preview show `name`, then `email`, then the always-present\n * `user_id`. NOTE: the current server response includes only the `user_id`, so\n * the avatar falls back to the id until the backend returns a human-readable\n * `name`/`email`.\n *\n * It renders an avatar trigger with a dropdown that exposes a \"Sign out\"\n * action, and calls the typed `revokeMySession` operation in `@zitadel/api`\n * (`DELETE /sessions/me`). The server clears the session cookie via\n * `Set-Cookie: Max-Age=0`; on success the element fires `zitadel-signout`\n * and optionally navigates to `post-sign-out-url`.\n *\n * ## Template-slot mode\n *\n * When the consumer projects a `<template>` child the element renders the\n * template's clone into its light DOM with `{{name}}`, `{{email}}`, and\n * `{{initial}}` substituted. Any element with `data-action=\"logout\"` inside\n * the cloned template triggers the sign-out flow. This mirrors the\n * placeholder `<nextgen-logout>`'s contract so existing markup keeps working.\n *\n * Default styles consume the `--zl-*` design tokens so tenant branding\n * applies automatically — there is no hardcoded brand colour, radius, or\n * shadow.\n */\n@customElement(\"zitadel-logout\")\nexport class ZitadelLogout extends LitElement {\n  static override styles = [\n    baseHostStyles,\n    css`\n      :host {\n        display: inline-block;\n        position: relative;\n      }\n\n      .trigger {\n        all: unset;\n        cursor: pointer;\n        width: 2.5rem;\n        height: 2.5rem;\n        border-radius: 9999px;\n        background: ${t.theme.primary};\n        color: ${t.theme.primaryForeground};\n        font-size: 0.875rem;\n        font-weight: 600;\n        display: inline-flex;\n        align-items: center;\n        justify-content: center;\n        letter-spacing: 0.02em;\n        user-select: none;\n        transition: box-shadow ${t.motion.duration.fast} ${t.motion.easing.standard};\n      }\n      .trigger:focus-visible {\n        ${focusVisibleStyles};\n      }\n      .trigger[aria-expanded=\"true\"] {\n        box-shadow: 0 0 0 2px ${t.theme.ring};\n      }\n\n      .dropdown {\n        position: absolute;\n        top: calc(100% + ${t.spacing[\"2\"]});\n        right: 0;\n        width: 14rem;\n        background: ${t.theme.popover};\n        border: 1px solid ${t.theme.border};\n        border-radius: ${t.radius.lg};\n        box-shadow: 0 12px 32px rgba(0, 0, 0, 0.32);\n        z-index: 9999;\n        overflow: hidden;\n      }\n\n      .preview {\n        display: flex;\n        align-items: center;\n        gap: ${t.spacing[\"4\"]};\n        padding: ${t.spacing[\"4\"]};\n        border-bottom: 1px solid ${t.theme.border};\n      }\n      .preview-avatar {\n        flex-shrink: 0;\n        width: 2.5rem;\n        height: 2.5rem;\n        border-radius: 9999px;\n        background: ${t.theme.primary};\n        color: ${t.theme.primaryForeground};\n        font-size: 0.875rem;\n        font-weight: 600;\n        display: inline-flex;\n        align-items: center;\n        justify-content: center;\n      }\n      .preview-info {\n        min-width: 0;\n        flex: 1;\n      }\n      .preview-name {\n        font-size: 0.875rem;\n        font-weight: 600;\n        color: ${t.theme.foreground};\n        white-space: nowrap;\n        overflow: hidden;\n        text-overflow: ellipsis;\n      }\n      .preview-email {\n        font-size: 0.75rem;\n        color: ${t.theme.mutedForeground};\n        white-space: nowrap;\n        overflow: hidden;\n        text-overflow: ellipsis;\n        margin-top: 2px;\n      }\n\n      .actions {\n        padding: ${t.spacing[\"2\"]};\n      }\n      .signout-btn {\n        all: unset;\n        cursor: pointer;\n        display: flex;\n        align-items: center;\n        gap: ${t.spacing[\"2\"]};\n        width: 100%;\n        padding: ${t.spacing[\"2\"]} ${t.spacing[\"4\"]};\n        border-radius: ${t.radius.md};\n        color: ${t.theme.destructive};\n        font-size: 0.875rem;\n        font-weight: 500;\n        box-sizing: border-box;\n      }\n      .signout-btn:hover:not([disabled]) {\n        background: color-mix(in srgb, ${t.theme.destructive} 12%, transparent);\n      }\n      .signout-btn:focus-visible {\n        ${focusVisibleStyles};\n      }\n      .signout-btn[disabled] {\n        cursor: not-allowed;\n        opacity: 0.6;\n      }\n      .signout-btn svg {\n        flex-shrink: 0;\n      }\n\n      .spinner {\n        width: 1em;\n        height: 1em;\n        border-radius: 9999px;\n        border: 2px solid currentColor;\n        border-top-color: transparent;\n        animation: zl-logout-spin 600ms linear infinite;\n      }\n      @keyframes zl-logout-spin {\n        to {\n          transform: rotate(360deg);\n        }\n      }\n\n      .error-bar {\n        padding: ${t.spacing[\"2\"]} ${t.spacing[\"4\"]};\n        font-size: 0.75rem;\n        color: ${t.theme.destructive};\n        background: color-mix(in srgb, ${t.theme.destructive} 12%, transparent);\n        border-top: 1px solid ${t.theme.border};\n      }\n    `,\n  ];\n\n  /**\n   * SDK project handle returned by `configureZitadel()`. Set from JS (or a\n   * framework binding). When set, takes precedence over both the\n   * `project-id`/`proxy-path`/`url` attributes and the global singleton from\n   * `getZitadelConfig()`.\n   */\n  @property({ attribute: false }) accessor project: ZitadelProject | undefined;\n\n  /**\n   * Project ID, set declaratively in HTML. Lets the component be configured on\n   * a plain page without JS or `configureZitadel()`. Ignored when the `project`\n   * property or a `configureZitadel()` global is set.\n   */\n  @property({ type: String, attribute: \"project-id\" }) accessor projectId = \"\";\n\n  /**\n   * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.\n   * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.\n   */\n  @property({ type: String, attribute: \"proxy-path\" }) accessor proxyPath = \"\";\n\n  /**\n   * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —\n   * not needed in client-only setups.\n   */\n  @property({ type: String }) accessor url = \"\";\n\n  /** URL to navigate to after a successful sign-out. */\n  @property({ type: String, attribute: \"post-sign-out-url\" }) accessor postSignOutUrl = \"\";\n\n  /**\n   * Colour mode: `light`, `dark`, or `auto` (follow `prefers-color-scheme`).\n   * Empty means \"not stated\" and defaults to `auto` — the control lives\n   * inside the app's own chrome, so it follows the visitor's preference\n   * rather than forcing the dark login surface. Set it explicitly when the\n   * surrounding app surface is fixed: `<zitadel-logout theme=\"dark\">`.\n   */\n  @property({ type: String }) accessor theme: \"\" | ThemeMode = \"\";\n\n  @state() private accessor displayName = \"\";\n\n  @state() private accessor displayEmail = \"\";\n\n  @state() private accessor displayUserId = \"\";\n\n  @state() private accessor open = false;\n\n  @state() private accessor loading = false;\n\n  @state() private accessor errorMessage = \"\";\n\n  // Set once in `connectedCallback` based on whether a `<template>` child is\n  // present. Not reactive — switching modes mid-life would require re-running\n  // light-DOM mutation, which we don't support.\n  private templateMode = false;\n\n  // The consumer-supplied `<template>` and its currently projected clone. The\n  // template is re-projected whenever identity changes so a late config /\n  // identity fetch updates the light-DOM markup rather than leaving it blank.\n  private pendingTemplate: HTMLTemplateElement | null = null;\n\n  private projectedContainer: HTMLElement | null = null;\n\n  // Guards the one-shot identity fetch so it runs once config is resolvable,\n  // whether that's at connect time (global config / declarative attributes) or\n  // after a framework assigns the `project` property post-mount.\n  private identityRequested = false;\n\n  private readonly themeController = new ThemeController(this);\n\n  override connectedCallback(): void {\n    super.connectedCallback();\n\n    const tmpl = this.querySelector(\"template\");\n    if (tmpl instanceof HTMLTemplateElement) {\n      this.templateMode = true;\n      this.pendingTemplate = tmpl;\n      // Project immediately so the logout control renders even before (or\n      // without) a resolvable config; it is re-projected once identity loads.\n      this.projectTemplate();\n    }\n\n    document.addEventListener(\"click\", this.handleDocumentClick);\n    document.addEventListener(\"keydown\", this.handleDocumentKeydown);\n\n    this.maybeLoadIdentity();\n  }\n\n  override disconnectedCallback(): void {\n    super.disconnectedCallback();\n    document.removeEventListener(\"click\", this.handleDocumentClick);\n    document.removeEventListener(\"keydown\", this.handleDocumentKeydown);\n  }\n\n  override willUpdate(): void {\n    // No branding payload reaches this element (yet); the empty overrides\n    // call keeps the token pipeline identical to the other orchestrator\n    // surfaces so a future branding input only has to change the argument.\n    this.themeController.setModePreference(this.theme === \"\" ? undefined : this.theme, \"auto\");\n    const root = this.shadowRoot;\n    if (root && !this.templateMode) {\n      applyBaseTokens(root);\n      applyBrandingTokens(root, undefined, this.themeController.theme);\n    }\n    this.dataset.theme = this.themeController.theme;\n    this.toggleAttribute(\"data-theme-dark\", this.themeController.theme === \"dark\");\n  }\n\n  override updated(): void {\n    // Retry once config becomes resolvable (e.g. a framework set `project`\n    // after mount). No-ops after the first successful request.\n    this.maybeLoadIdentity();\n  }\n\n  /** Declarative config read from this element's attributes. */\n  private get projectAttrs(): ProjectAttrs {\n    return { projectId: this.projectId, proxyPath: this.proxyPath, url: this.url };\n  }\n\n  /**\n   * Fetches the signed-in identity from `GET /sessions/me` once a project is\n   * resolvable. No-ops until then (and on repeat calls) so framework property\n   * timing doesn't matter and we never fire the request twice. A pending\n   * `<template>` is already projected in `connectedCallback`, so when no config\n   * is available yet the logout control still renders; it is re-projected with\n   * the real identity once a later request succeeds.\n   */\n  private maybeLoadIdentity(): void {\n    if (this.identityRequested) return;\n    let api;\n    try {\n      ({ api } = resolveApi(this.project, this.projectAttrs, \"<zitadel-logout>\"));\n    } catch {\n      return;\n    }\n    this.identityRequested = true;\n    void this.loadIdentity(api);\n  }\n\n  private async loadIdentity(api: ReturnType<typeof resolveApi>[\"api\"]): Promise<void> {\n    try {\n      const session = await getSession(api);\n      this.displayName = session.name ?? \"\";\n      this.displayEmail = session.email ?? \"\";\n      this.displayUserId = session.user_id ?? \"\";\n    } catch {\n      // No active session — render the control without identity.\n    } finally {\n      // Re-project so template-mode markup reflects the resolved identity.\n      this.projectTemplate();\n    }\n  }\n\n  private get initial(): string {\n    const source = this.displayName || this.displayEmail || this.displayUserId;\n    return source ? source.charAt(0).toUpperCase() : \"?\";\n  }\n\n  /**\n   * Clones the consumer-supplied `<template>` into the light DOM, fills the\n   * `{{name}}`, `{{email}}`, and `{{initial}}` tokens via a TreeWalker, and\n   * wires every element with `data-action=\"logout\"` to trigger sign-out.\n   * Light-DOM mounting is deliberate so the consumer's existing CSS applies.\n   *\n   * Re-runnable: each call replaces the previously projected clone, so a late\n   * identity fetch (or a `project` assigned post-mount) updates the rendered\n   * markup instead of leaving the placeholders stuck on their initial values.\n   */\n  private projectTemplate(): void {\n    if (!this.templateMode || !this.pendingTemplate) return;\n\n    const clone = this.pendingTemplate.content.cloneNode(true) as DocumentFragment;\n    fillTemplateTokens(clone, this.displayName, this.displayEmail, this.initial);\n\n    const container = document.createElement(\"span\");\n    container.appendChild(clone);\n    this.projectedContainer?.remove();\n    this.projectedContainer = container;\n    this.appendChild(container);\n\n    const targets = container.querySelectorAll<HTMLElement>('[data-action=\"logout\"]');\n    targets.forEach((el) => {\n      el.addEventListener(\"click\", (event) => {\n        event.preventDefault();\n        void this.doLogout();\n      });\n    });\n  }\n\n  private readonly handleDocumentClick = (event: MouseEvent): void => {\n    if (!this.open) return;\n    if (event.composedPath().includes(this)) return;\n    this.open = false;\n  };\n\n  private readonly handleDocumentKeydown = (event: KeyboardEvent): void => {\n    if (!this.open) return;\n    if (event.key !== \"Escape\") return;\n    this.open = false;\n    this.shadowRoot?.querySelector<HTMLButtonElement>(\".trigger\")?.focus();\n  };\n\n  private toggleOpen(): void {\n    this.open = !this.open;\n    this.errorMessage = \"\";\n  }\n\n  /**\n   * Calls `DELETE /sessions/me` (`revokeMySession`) with `credentials: \"include\"`.\n   * The server validates the `__nextgen_session` cookie, deletes the session, and\n   * clears the cookie via `Set-Cookie: Max-Age=0`. On success this element fires\n   * `zitadel-signout` and optionally navigates to `postSignOutUrl`.\n   */\n  private async doLogout(): Promise<void> {\n    this.loading = true;\n    this.errorMessage = \"\";\n\n    try {\n      const { api } = resolveApi(this.project, this.projectAttrs, \"<zitadel-logout>\");\n      await revokeSession(api);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : \"\";\n      this.errorMessage = message || \"Sign-out failed. Please try again.\";\n      this.loading = false;\n      return;\n    }\n\n    this.open = false;\n    this.loading = false;\n\n    emit(this, \"zitadel-signout\", { name: this.displayName, email: this.displayEmail });\n\n    if (this.postSignOutUrl && typeof window !== \"undefined\") {\n      window.location.href = this.postSignOutUrl;\n    }\n  }\n\n  private handleSignOutClick(event: Event): void {\n    event.preventDefault();\n    void this.doLogout();\n  }\n\n  override render() {\n    if (this.templateMode) {\n      // Rendering happens into the light DOM via `projectTemplate`. The\n      // shadow root stays empty so the projected markup is the only thing\n      // the user sees.\n      return nothing;\n    }\n\n    return html`\n      <button\n        class=\"trigger\"\n        type=\"button\"\n        aria-label=${this.open ? \"Close user menu\" : \"Open user menu\"}\n        aria-expanded=${this.open ? \"true\" : \"false\"}\n        aria-haspopup=\"dialog\"\n        @click=${this.toggleOpen}\n      >\n        ${this.initial}\n      </button>\n\n      ${this.open\n        ? html`\n            <div class=\"dropdown\" role=\"dialog\" aria-label=\"User menu\">\n              <div class=\"preview\">\n                <div class=\"preview-avatar\" aria-hidden=\"true\">${this.initial}</div>\n                <div class=\"preview-info\">\n                  <div class=\"preview-name\">\n                    ${this.displayName || this.displayEmail || this.displayUserId}\n                  </div>\n                  ${this.displayName && this.displayEmail\n                    ? html`<div class=\"preview-email\">${this.displayEmail}</div>`\n                    : nothing}\n                </div>\n              </div>\n\n              <div class=\"actions\">\n                <button\n                  class=\"signout-btn\"\n                  type=\"button\"\n                  ?disabled=${this.loading}\n                  @click=${this.handleSignOutClick}\n                >\n                  ${this.loading\n                    ? html`<span class=\"spinner\" aria-hidden=\"true\"></span>`\n                    : html`\n                        <svg\n                          width=\"14\"\n                          height=\"14\"\n                          viewBox=\"0 0 24 24\"\n                          fill=\"none\"\n                          stroke=\"currentColor\"\n                          stroke-width=\"2\"\n                          stroke-linecap=\"round\"\n                          stroke-linejoin=\"round\"\n                          aria-hidden=\"true\"\n                        >\n                          <path d=\"M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4\" />\n                          <polyline points=\"16 17 21 12 16 7\" />\n                          <line x1=\"21\" y1=\"12\" x2=\"9\" y2=\"12\" />\n                        </svg>\n                      `}\n                  <span>${this.loading ? \"Signing out…\" : \"Sign out\"}</span>\n                </button>\n              </div>\n\n              ${this.errorMessage\n                ? html`<div class=\"error-bar\" role=\"alert\">${this.errorMessage}</div>`\n                : nothing}\n            </div>\n          `\n        : nothing}\n    `;\n  }\n}\n\n/**\n * Substitutes `{{name}}`, `{{email}}`, and `{{initial}}` placeholders inside\n * a fragment's text nodes. Walking text nodes (rather than running a regex\n * over `outerHTML`) keeps attributes and structural markup untouched.\n */\nfunction fillTemplateTokens(\n  fragment: DocumentFragment,\n  name: string,\n  email: string,\n  initial: string,\n): void {\n  const walker = document.createTreeWalker(fragment, NodeFilter.SHOW_TEXT);\n  let node = walker.nextNode() as Text | null;\n  while (node) {\n    if (node.textContent) {\n      node.textContent = node.textContent\n        .replace(/\\{\\{name\\}\\}/g, name)\n        .replace(/\\{\\{email\\}\\}/g, email)\n        .replace(/\\{\\{initial\\}\\}/g, initial);\n    }\n    node = walker.nextNode() as Text | null;\n  }\n}\n\ndeclare global {\n  interface HTMLElementTagNameMap {\n    \"zitadel-logout\": ZitadelLogout;\n  }\n}\n","import { css, html, nothing } from \"lit\";\nimport { customElement, property, state } from \"lit/decorators.js\";\nimport { type ZitadelProject } from \"@zitadel/api/config\";\n\nimport { getSession, revokeSession } from \"./api-client.js\";\nimport { resolveApi, type ProjectAttrs } from \"./resolve-api.js\";\nimport { ZitadelSurface } from \"./surface.js\";\nimport { emit } from \"../internal/emit.js\";\nimport { baseHostStyles, t } from \"../styles/index.js\";\n\nimport \"../atoms/index.js\";\n\n/**\n * `<zitadel-session>` — the \"signed in\" card.\n *\n * Renders the post-sign-in confirmation surface (Figma `7355:8959`): a\n * centred auth card reading \"Signed in as {identity}\" with a **Sign out**\n * action. Composed from the same `<zl-page-shell>` / `<zl-card>` /\n * `<zl-button>` atoms as the `<zitadel-login>` orchestrator, so it inherits\n * tenant branding tokens with no hardcoded colour, radius, or shadow.\n *\n * Like `<zitadel-login>` it is widget-first: the default `variant=\"widget\"`\n * is content-sized and transparent so the card drops into an app's own\n * page; dedicated signed-in routes opt into `variant=\"page\"`, which claims\n * the viewport and paints the surface background (the page paint lives on\n * the internal `<zl-page-shell>`). `theme` resolves through the shared\n * surface base — explicit value, else `dark` for `page` / `auto` for\n * `widget`.\n *\n * This is the companion surface to `<zitadel-login>` for the \"go straight to\n * /login\" flow: the orchestrator signs the user in and redirects here (or to\n * the consumer's own page); this element proves the session and offers a way\n * back out. The in-app avatar menu lives in the separate `<zitadel-logout>`.\n *\n * - Identity is fetched from the typed `getMySession` operation\n *   (`GET /sessions/me`), sent with credentials so the session cookie\n *   authenticates it. The card shows `name`, then `email`, then the\n *   always-present `user_id`. NOTE: the current server response includes only\n *   the `user_id`, so the card displays the raw id until the backend returns a\n *   human-readable `name`/`email` on `/sessions/me`. A failed or\n *   unauthenticated request renders the card without an identity line rather\n *   than throwing.\n * - **Sign out** calls the typed `revokeMySession` operation\n *   (`DELETE /sessions/me`); the server clears the session cookie. On success\n *   the element fires `zitadel-signout` (detail `{ name, email }`, matching the\n *   shared SPA contract) and optionally navigates to `post-sign-out-url`.\n *\n * A \"Continue\" action is intentionally omitted for now: the post-sign-in\n * destination contract is still being decided. Consumers redirect after\n * sign-in via the `<zitadel-login>` `post-sign-in-url`.\n */\n@customElement(\"zitadel-session\")\nexport class ZitadelSession extends ZitadelSurface {\n  static override styles = [\n    baseHostStyles,\n    css`\n      :host {\n        display: block;\n        width: 100%;\n      }\n      .title {\n        margin: 0;\n        font-family: ${t.font.family.heading};\n        font-size: 2rem;\n        font-weight: 700;\n        line-height: 2.5rem;\n        letter-spacing: -0.02em;\n        color: ${t.theme.foreground};\n        text-align: left;\n      }\n      .identity {\n        margin: 0;\n        font-family: ${t.font.family.sans};\n        font-size: 0.875rem;\n        line-height: 1.25rem;\n        font-weight: 400;\n        color: ${t.theme.mutedForeground};\n        text-align: left;\n        overflow-wrap: anywhere;\n      }\n      .error {\n        margin: 0;\n        font-size: 0.875rem;\n        line-height: 1.25rem;\n        color: ${t.theme.destructive};\n      }\n      /* suppress-header: visually hidden, kept in the accessibility tree. */\n      .title.sr-only {\n        position: absolute;\n        width: 1px;\n        height: 1px;\n        margin: -1px;\n        padding: 0;\n        border: 0;\n        overflow: hidden;\n        clip-path: inset(50%);\n        white-space: nowrap;\n      }\n    `,\n  ];\n\n  /**\n   * SDK project handle returned by `configureZitadel()`. Set from JS (or a\n   * framework binding). Takes precedence over the\n   * `project-id`/`proxy-path`/`url` attributes and the global singleton.\n   */\n  @property({ attribute: false }) accessor project: ZitadelProject | undefined;\n\n  /** Project ID, set declaratively in HTML for no-JS configuration. */\n  @property({ type: String, attribute: \"project-id\" }) accessor projectId = \"\";\n\n  /** Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML. */\n  @property({ type: String, attribute: \"proxy-path\" }) accessor proxyPath = \"\";\n\n  /** Full URL of the Zitadel auth backend, set declaratively in HTML. */\n  @property({ type: String }) accessor url = \"\";\n\n  /** URL to navigate to after a successful sign-out. */\n  @property({ type: String, attribute: \"post-sign-out-url\" }) accessor postSignOutUrl = \"\";\n\n  /** Heading text. Defaults to the English label. */\n  @property({ type: String }) accessor heading = \"Signed in as\";\n\n  /** Sign-out action label. */\n  @property({ type: String, attribute: \"logout-label\" }) accessor logoutLabel = \"Sign out\";\n\n  @state() private accessor displayName = \"\";\n\n  @state() private accessor displayEmail = \"\";\n\n  @state() private accessor displayUserId = \"\";\n\n  @state() private accessor loading = false;\n\n  @state() private accessor errorMessage = \"\";\n\n  // Guards the one-shot identity fetch so it runs once config is resolvable,\n  // whether that's at connect time (global config / declarative attributes) or\n  // after a framework assigns the `project` property post-mount.\n  private identityRequested = false;\n\n  override connectedCallback(): void {\n    super.connectedCallback();\n    this.maybeLoadIdentity();\n  }\n\n  /** Single identity line: human-readable name, then email, then user_id. */\n  private get identityLabel(): string {\n    return this.displayName || this.displayEmail || this.displayUserId;\n  }\n\n  override willUpdate(): void {\n    // No tenant branding payload on this surface (yet) — the theme resolves\n    // from the element preference and the variant fallback.\n    this.applySurfaceTheme(undefined);\n  }\n\n  override updated(): void {\n    this.maybeLoadIdentity();\n  }\n\n  /** Declarative config read from this element's attributes. */\n  private get projectAttrs(): ProjectAttrs {\n    return { projectId: this.projectId, proxyPath: this.proxyPath, url: this.url };\n  }\n\n  /**\n   * Fetches the signed-in identity from `GET /sessions/me` once a project is\n   * resolvable. No-ops until then (and on repeat calls) so framework property\n   * timing doesn't matter and we never fire the request twice.\n   */\n  private maybeLoadIdentity(): void {\n    if (this.identityRequested) return;\n    let api;\n    try {\n      ({ api } = resolveApi(this.project, this.projectAttrs, \"<zitadel-session>\"));\n    } catch {\n      return;\n    }\n    this.identityRequested = true;\n    void this.fetchIdentity(api);\n  }\n\n  private async fetchIdentity(api: ReturnType<typeof resolveApi>[\"api\"]): Promise<void> {\n    try {\n      const session = await getSession(api);\n      this.displayName = session.name ?? \"\";\n      this.displayEmail = session.email ?? \"\";\n      this.displayUserId = session.user_id ?? \"\";\n    } catch {\n      // No active session, or not configured — render without an identity line.\n    }\n  }\n\n  /**\n   * Calls `DELETE /sessions/me` (`revokeMySession`) with credentials. On\n   * success fires `zitadel-signout` and optionally navigates to\n   * `postSignOutUrl`; on failure surfaces an inline error and stays put.\n   */\n  private async doLogout(): Promise<void> {\n    this.loading = true;\n    this.errorMessage = \"\";\n\n    try {\n      const { api } = resolveApi(this.project, this.projectAttrs, \"<zitadel-session>\");\n      await revokeSession(api);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : \"\";\n      this.errorMessage = message || \"Sign-out failed. Please try again.\";\n      this.loading = false;\n      return;\n    }\n\n    this.loading = false;\n    emit(this, \"zitadel-signout\", { name: this.displayName, email: this.displayEmail });\n\n    if (this.postSignOutUrl && typeof window !== \"undefined\") {\n      window.location.assign(this.postSignOutUrl);\n    }\n  }\n\n  private handleLogout(event: Event): void {\n    event.preventDefault();\n    void this.doLogout();\n  }\n\n  override render() {\n    // Static template, so widget polarity is a plain binding — unlike\n    // `<zitadel-login>`, whose `zl-page-shell` lives in unsafeHTML-parsed\n    // markup and needs the imperative re-stamp loop.\n    return html`\n      <zl-page-shell ?data-widget=${this.variant !== \"page\"}>\n        <zl-card ?data-suppress-header=${this.suppressHeader}>\n          <h1 slot=\"header\" class=\"title ${this.suppressHeader ? \"sr-only\" : \"\"}\">\n            ${this.heading}\n          </h1>\n          ${this.identityLabel\n            ? html`<p slot=${this.suppressHeader ? nothing : \"header\"} class=\"identity\">\n                ${this.identityLabel}\n              </p>`\n            : nothing}\n\n          <zl-button\n            hierarchy=\"primary\"\n            size=\"medium\"\n            block\n            ?loading=${this.loading}\n            data-testid=\"zitadel-session-logout\"\n            label=${this.logoutLabel}\n            @zl-submit=${this.handleLogout}\n          ></zl-button>\n\n          ${this.errorMessage\n            ? html`<p class=\"error\" role=\"alert\">${this.errorMessage}</p>`\n            : nothing}\n        </zl-card>\n      </zl-page-shell>\n    `;\n  }\n}\n\ndeclare global {\n  interface HTMLElementTagNameMap {\n    \"zitadel-session\": ZitadelSession;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAWA,IAAI;AACJ,SAAS,kBAAkB;AAC1B,QAAO;;AAER,SAAS,gBAAgB,OAAO;AAC/B,gBAAe;;;;;;;;;;;;;;;ACHhB,IAAI,WAAW,cAAc,MAAM;CAClC;CACA;CACA;CACA,YAAY,QAAQ,KAAK,MAAM,SAAS;AACvC,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,MAAM;AACX,OAAK,OAAO;;;;;;;;;;;;;;;;;AAiBd,eAAe,YAAY,KAAK,SAAS;CACxC,MAAM,QAAQ,iBAAiB;CAC/B,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,KAAI,SAAS,CAAC,QAAQ,IAAI,gBAAgB,CAAE,SAAQ,IAAI,iBAAiB,UAAU,QAAQ;CAC3F,MAAM,MAAM,MAAM,MAAM,KAAK;EAC5B,GAAG;EACH;EACA,CAAC;CACF,MAAM,UAAU;EACf;EACA;EACA;EACA,CAAC,SAAS,IAAI,OAAO,GAAG,KAAK,MAAM,IAAI,MAAM;CAC9C,MAAM,SAAS,UAAU,cAAc,QAAQ,GAAG,KAAK;AACvD,KAAI,CAAC,IAAI,IAAI;EACZ,MAAM,UAAU,GAAG,QAAQ,UAAU,MAAM,GAAG,IAAI,YAAY,IAAI;AAClE,QAAM,IAAI,SAAS,IAAI,QAAQ,KAAK,QAAQ,QAAQ;;AAErD,QAAO;;;;;;;;AAQR,SAAS,cAAc,MAAM;AAC5B,KAAI;AACH,SAAO,KAAK,MAAM,KAAK;SAChB;AACP,SAAO,EAAE,KAAK,MAAM;;;;;;;;;;AAUtB,SAAS,gBAAgB,OAAO;CAC/B,MAAM,OAAO,MAAM;AACnB,KAAI,CAAC,SAAS,KAAK,CAAE,QAAO,MAAM;CAClC,MAAM,gBAAgB,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK;CAC7E,MAAM,SAAS,iBAAiB,KAAK,QAAQ;AAC7C,KAAI,CAAC,cAAe,QAAO,MAAM;AACjC,QAAO,SAAS,GAAG,cAAc,IAAI,WAAW;;;;;;;;AAQjD,SAAS,iBAAiB,SAAS;AAClC,KAAI,OAAO,YAAY,SAAU,QAAO;AACxC,KAAI,SAAS,QAAQ,EAAE;AACtB,MAAI,OAAO,QAAQ,YAAY,SAAU,QAAO,QAAQ;AACxD,MAAI,OAAO,QAAQ,YAAY,SAAU,QAAO,QAAQ;;;AAG1D,SAAS,SAAS,OAAO;AACxB,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;;;ACjG5E,MAAa,mCACX;;;;;;AAOF,SAAgB,4BAAoC;AAClD,QAAO,qDAAqD,iCAAiC;;;;;;;;;;;;ACL/F,SAAgB,WAAW,OAAuB;AAChD,QAAO,MACJ,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,SAAS,CACvB,QAAQ,MAAM,QAAQ;;;;ACoB3B,MAAM,iBAA8B,EAAE,aAAa,WAAW;AAU9D,eAAsB,UAAU,KAAiB,OAA+C;AAC9F,QAAO,IAAI,WAAW,OAAO,eAAe;;AAM9C,eAAsB,WACpB,KACA,IACA,MACwB;AACxB,KAAI;AACF,SAAO,MAAM,IAAI,eAAe,IAAI,MAAM,eAAe;UAClD,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,WAAW,OAAO,eAAe,MAAM,KAAK,CACjF,QAAO,MAAM;AAEf,QAAM;;;AAIV,SAAS,eAAe,MAAsC;AAC5D,QAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,UAAU;;AAGhE,eAAsB,eAAe,KAAiB,IAAoC;AACxF,QAAO,IAAI,YAAY,IAAI,eAAe;;;;;;;;;AAU5C,eAAsB,gBACpB,KACA,MACA,QAC6B;AAC7B,QAAO,IAAI,gBAAgB,MAAM,QAAQ,eAAe;;;;;;;AAQ1D,eAAsBA,aAAW,KAA2C;AAC1E,QAAO,IAAI,aAAa,eAAe;;;;;;AAOzC,eAAsBC,gBAAc,KAAgC;AAClE,OAAM,IAAI,gBAAgB,eAAe;;;;;;;;;;;;;;;;;;;;;;ACpF3C,MAAM,aAAa;;AAGnB,MAAM,cAAc;AAEpB,MAAM,sBAAsB;AAC5B,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;AAC/B,MAAM,iCAAiC;;;;;;;AAQvC,SAAgB,kBAAkB,MAAwB;CACxD,IAAI,eAAe;AAEnB,MAAK,MAAM,OAAO,KAAK,iBAAiB,MAAM,EAAE;AAC9C,MAAI,IAAI,aAAa,WAAW,CAC9B;AAEF,MAAI,aAAa,YAAY,GAAG;AAKhC,MAAI,IAAI,aAAa,MAAM,IAAI,IAAI,YAAY,IAAI,iBAAiB,GAAG;AACrE,cAAW,IAAI;AACf,kBAAe;AACf;;AAEF,MAAI,iBACF,eACM;AACJ,cAAW,IAAI;AACf,oBAAiB,KAAK;KAExB,EAAE,MAAM,MAAM,CACf;;AAGH,KAAI,aACF,kBAAiB,KAAK;;AAI1B,SAAS,WAAW,KAA6B;AAC/C,KAAI,aAAa,aAAa,GAAG;AACjC,wBAAuB,IAAI;AAE3B,SAAQ,KACN,6DAA6D,IAAI,aAAa,MAAM,IAAI,KACzF;;;;;;;;;AAUH,SAAS,uBAAuB,KAA6B;AAC3D,KAAI,CAAC,IAAI,aAAa,uBAAuB,CAC3C;CAEF,MAAM,WAAW,IAAI;AACrB,KAAI,UAAU,aAAa,+BAA+B,CACxD,UAAS,gBAAgB,SAAS;;;;;;;;;AAWtC,SAAS,iBAAiB,MAAwB;AAChD,MAAK,MAAM,QAAQ,KAAK,iBAAiB,oBAAoB,EAAE;AAC7D,MAAI,KAAK,cAAc,IAAI,oBAAoB,CAC7C;EAEF,MAAM,WAAW,MAAM,KAAK,KAAK,SAAS;AAC1C,MAAI,CAAC,SAAS,KAAK,cAAc,CAC/B;AAEF,MAAI,SAAS,MAAM,UAAU,CAAC,cAAc,MAAM,CAAC,CACjD;EAEF,MAAM,cAAc,KAAK,cAAc,cAAc,MAAM;AAC3D,cAAY,YAAY;AACxB,cAAY,aAAa,eAAe,OAAO;AAC/C,OAAK,OAAO,YAAY;;;AAI5B,SAAS,cAAc,MAAwB;AAC7C,QAAO,KAAK,YAAY,SAAS,KAAK,aAAa,YAAY;;;;ACvEjE,MAAM,8BAA8B;CACnC,UAAU;CACV,OAAO;CACP;;;;;;;;;;;;;;;;;;;;AC9BD,MAAM,gBAAgB,IAAI,IAAY,OAAO,OAAO,4BAA4B,CAAC;AAYjF,SAAgB,iBACd,OACA,UAAqC,EAAE,EACb;AAC1B,KAAI,CAAC,MACH,QAAO;EAAE,UAAU,KAAA;EAAW,QAAQ,EAAE;EAAE;CAG5C,MAAM,SAAmB,EAAE;CAC3B,MAAM,MAAgB,EAAE,GAAG,OAAO;CAClC,MAAM,oBACJ,QAAQ,oBAAoB,KAAA,KAAa,2BAA2B,QAAQ,gBAAgB;AAE9F,KAAI,IAAI,UAAU,CAAC,cAAc,IAAI,IAAI,OAAO,EAAE;AAChD,SAAO,KAAK,mBAAmB,IAAI,OAAO,iCAAiC;AAC3E,MAAI,SAAS,4BAA4B;;AAG3C,KAAI,WAAW,YAAY,IAAI,UAAU,YAAY,QAAQ,EAAE,SAAS,mBAAmB,CAAC;AAC5F,KAAI,WAAW,YAAY,IAAI,UAAU,YAAY,OAAO;AAC5D,KAAI,WAAW,YAAY,IAAI,UAAU,YAAY,QAAQ,EAAE,SAAS,mBAAmB,CAAC;AAC5F,KAAI,IAAI,OACN,KAAI,SAAS;EACX,WAAW,YAAY,IAAI,OAAO,WAAW,oBAAoB,OAAO;EACxE,SAAS,YAAY,IAAI,OAAO,SAAS,kBAAkB,OAAO;EAClE,kBAAkB,YAAY,IAAI,OAAO,kBAAkB,2BAA2B,OAAO;EAC9F;AAGH,QAAO;EAAE,UAAU;EAAK;EAAQ;;AAGlC,SAAS,YACP,OACA,OACA,QACA,cACoB;AACpB,KAAI,SAAS,QAAQ,UAAU,GAC7B;AAEF,KAAI;EACF,MAAM,SAAS,IAAI,IAAI,MAAM;AAI7B,MAAI,OAAO,aAAa,WAAW,cAAc,WAAW,2BAA2B,MAAM,CAC3F,QAAO,OAAO,UAAU;AAE1B,MAAI,OAAO,aAAa,UAAU;GAChC,MAAM,eAAe,eACjB,4EACA;AACJ,UAAO,KAAK,GAAG,MAAM,wBAAwB,OAAO,SAAS,GAAG,aAAa,cAAc;AAC3F;;AAEF,SAAO,OAAO,UAAU;SAClB;AACN,SAAO,KAAK,GAAG,MAAM,gCAAgC;AACrD;;;;;;;;;;;;;;;;;;;;;;;ACzEJ,MAAM,mBAAgD,IAAI,IACxD,iBACG,QAAQ,aAAa,SAAS,MAAM,SAAS,EAAE,CAC/C,KAAK,aAAa;CACjB,MAAM,QAAQ,SAAS,IAAI,QAAQ,QAAQ,GAAG;CAC9C,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,GAAG,KAAK,IAAI,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK;AAClF,QAAO,CAAC,SAAS,KAAK,MAAM;EAC5B,CACL;;;;;;;AAaD,SAAgB,iBAAiB,OAAyB;AACxD,MAAK,MAAM,CAAC,KAAK,UAAU,iBACzB,MAAK,MAAM,MAAM,MAAM,iBAAiB,IAAI,CAC1C,KAAI,GAAG,aAAa,cAAc,KAAK,MACrC,IAAG,aAAa,eAAe,MAAM;;;;ACrB7C,MAAa,yBAAyB;;AAGtC,MAAM,kBAAkB;AAExB,MAAa,8BAA8B,OAAO,uBAAuB;AAEzE,SAAgB,oBACd,MACA,MACA,QACQ;CACR,MAAM,WAAW,SAAS,cAAc,WAAW;AACnD,UAAS,YAAY;CACrB,MAAM,WAAW,SAAS;CAE1B,MAAM,YAAY,oBAAoB,UAAU,MAAM,OAAO;CAC7D,MAAM,SAAS,kBAAkB,SAAS;AAE1C,KAAI,QAAQ,YAAY;AACtB,OAAK,MAAM,QAAQ,UACjB,QAAO,WAAW,aAAa,MAAM,OAAO;AAE9C,SAAO,QAAQ;OAEf,MAAK,MAAM,QAAQ,UACjB,UAAS,YAAY,KAAK;AAI9B,QAAO,SAAS;;AAGlB,SAAS,oBACP,UACA,MACA,QACW;CACX,MAAM,YAAuB,EAAE;AAE/B,KAAI,KAAK,OACP,MAAK,MAAM,SAAS,KAAK,QAAQ;AAC/B,MAAI,CAAC,MAAM,SAAU;AACrB,MAAI,YAAY,UAAU,MAAM,KAAK,CAAE;AACvC,YAAU,KAAK,WAAW,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM,QAAQ,MAAM,SAAS,CAAC;;AAI9F,KAAI,KAAK,WAAW,CAAC,iBAAiB,SAAS,EAAE;EAC/C,MAAM,UAAU,KAAK,QAAQ,MAAM,WAAW,OAAO,QAAQ;AAC7D,MAAI,QACF,WAAU,KAAK,YAAY,QAAQ,MAAM,QAAQ,UAAU,OAAO,CAAC;;AAIvE,QAAO;;AAGT,SAAS,iBAAiB,UAAqC;AAG7D,QAAO,QAAQ,SAAS,cAAc,mCAAiC,CAAC;;AAG1E,SAAS,YAAY,UAA4B,MAAuB;AAWtE,MAAK,MAAM,SAAS,SAAS,iBAAiB,gBAAgB,CAC5D,KAAI,MAAM,aAAa,OAAO,KAAK,KAAM,QAAO;AAElD,QAAO;;AAGT,SAAS,kBAAkB,UAA4C;CACrE,MAAM,UAAU,SAAS,iBAAiB,UAAU,iBAClD,UACA,WAAW,aACZ;CACD,IAAI,OAAoB,OAAO,UAAU;AACzC,QAAO,MAAM;AACX,MAAI,KAAK,WAAW,MAAM,KAAA,qBACxB,QAAO;AAET,SAAO,OAAO,UAAU;;AAE1B,QAAO;;AAGT,SAAS,WACP,MACA,SACA,MACA,QACA,UACS;CACT,MAAM,KAAK,SAAS,cAAc,WAAW;AAC7C,IAAG,aAAa,QAAQ,KAAK;AAC7B,IAAG,aAAa,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC;AACzD,IAAG,aAAa,QAAQ,KAAK;AAC7B,KAAI,SACF,IAAG,aAAa,YAAY,GAAG;AAEjC,QAAO;;AAGT,SAAS,YAAY,MAAc,SAA6B,QAAyB;CACvF,MAAM,KAAK,SAAS,cAAc,YAAY;AAC9C,IAAG,aAAa,aAAa,UAAU;AACvC,IAAG,aAAa,QAAQ,SAAS;AACjC,IAAG,aAAa,QAAQ,SAAS;AACjC,IAAG,aAAa,SAAS,GAAG;AAC5B,IAAG,aAAa,UAAU,KAAK;AAC/B,IAAG,aAAa,SAAS,OAAO,QAAQ,WAAW,kBAAkB,CAAC;AACtE,QAAO;;AAGT,SAAS,OAAO,QAAgB,KAAqB;AACnD,QAAO,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;AC7HxB,MAAaC,mBAAiB,EAC5B,SAAS,WACV;;;;;;;;;;;;AAuBD,MAAM,iBAAyC;CAC7C,wBAAwB;CACxB,uBAAuB;CACvB,sBAAsB;CACtB,2BAA2B;CAC3B,4BAA4B;CAC5B,6BAA6B;CAC9B;AAED,SAAgB,mBAAmB,SAAsC;CAMvE,MAAM,SAAS,IAAI,OAAO;EACxB,WAAA;IALCA,iBAAe,UAAUC;GAC1B,GAAI,QAAQ,aAAa,EAAE;GAIlB;EACT,OAAO;EACP,UAAU;EACV,mBAAmB;EACnB,eAAe;EACf,iBAAiB;EACjB,cAAc;EACf,CAAC;AAMF,QAAO,eAAe,QAAQ,UAAmB,UAAU,MAAM,CAAC;CAWlE,MAAM,oCAAoB,IAAI,KAAa;AAC3C,QAAO,eACL,KACA,SAAS,QAAoC,KAAc,GAAG,MAAiB;EAC7E,MAAM,YAAY,UAAU,IAAI;EAChC,IAAI,WACF,QAAQ,OAAO,cACf,oBAAoB,QAAQ,QAAQ,UAAU,IAC9C,mBAAmB,UAAU;AAC/B,MAAI,aAAa,KAAA,GAAW;AAC1B,cAAW;AACX,OAAI,cAAc,MAAM,CAAC,kBAAkB,IAAI,UAAU,EAAE;AACzD,sBAAkB,IAAI,UAAU;AAChC,YAAQ,KACN,qCAAqC,UAAU,2BAChD;;;AAGL,SAAO,YAAY,UAAU,KAAK,IAAI,UAAU,CAAC;GAEpD;;AAGD,QAAO,eAAe,qBAAqB,YAAqB;EAC9D,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;AAGF,QAAO,eAAe,cAAc,YAAqB;EACvD,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;;;;;;AAQF,QAAO,eAAe,kBAAkB,WAAoB;AAC1D,MAAI,CAAC,MAAM,QAAQ,OAAO,CAAE,QAAO,EAAE;AACrC,SAAO,OAAO,KAAK,UAAU;GAC3B,MAAM,IAAI,UAAU,MAAM;AAC1B,UAAO;IAAE,OAAO;IAAG,OAAO;IAAG;IAC7B;GACF;;AAGF,QAAO,eAAe,iBAAiB,YAAqB;EAC1D,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;AAGF,QAAO,eAAe,cAAc,YAAqB;EACvD,MAAM,YAAY,GAAG,UAAU,QAAQ,CAAC;AACxC,SAAO,QAAQ,OAAO,cAAc;GACpC;;AAGF,QAAO,eAAe,eAAe,WAAoB,WAAoB;EAC3E,MAAM,OAAO,UAAU,UAAU;AACjC,MAAI,CAAC,MAAM,QAAQ,OAAO,CAAE,QAAO;AACnC,OAAK,MAAM,QAAQ,QAAQ;GACzB,MAAM,MAAM;AACZ,OAAI,IAAI,UAAU,KAAM;AAGxB,UAAO,IAAI,WAAY,QAAQ,OAAO,IAAI,aAAa,IAAI,WAAa,IAAI,WAAW;;AAEzF,SAAO;GACP;;;;;;;AAQF,QAAO,eAAe,WAAW,cAAuB,SAAS,UAAU,UAAU,CAAC,CAAC;;;;;;;;AASvF,QAAO,eAAe,mBAAmB,QAAiB;AACxD,SAAO,CAAE,KAAmB;GAC5B;AAMF,QAAO,YAAY,qBAAqB;EACtC,QAAQ;EAGR,SAAS;AACP,UAAO;;EAEV,CAAC;AAEF,QAAO;;;;;;;;;AAUT,MAAM,yBAA8E,CAClF;CAAE,QAAQ;CAAgB,UAAU;CAAe,CACpD;AAED,SAAS,oBAAoB,QAAgB,KAAiC;AAC5E,MAAK,MAAM,EAAE,QAAQ,cAAc,uBACjC,KAAI,IAAI,SAAS,OAAO,CAAE,QAAO,OAAO;;;;;;;;;;;AAc5C,SAAS,mBAAmB,KAAiC;CAI3D,MAAM,QAAQ,IAAI,YAAY,UAAO;AACrC,KAAI,UAAU,GAAI,QAAO,KAAA;CACzB,MAAM,QAAQ,IAAI,MAAM,QAAQ,EAAc;AAC9C,KAAI,UAAU,MAAM,MAAM,SAAS,IAAI,CAAE,QAAO,KAAA;AAChD,QAAO,gBAAgB,kBAAkB,MAAM,CAAC;;;;;;;;;;;;;AA4BlD,MAAM,4BAAgF;CACpF;EAAE,QAAQ;EAAa,SAAS;EAAwB;CACxD;EAAE,QAAQ;EAAe,SAAS;EAA0B;CAC5D;EAAE,QAAQ;EAAe,SAAS;EAA0B;CAC5D;EAAE,QAAQ;EAAW,SAAS;EAAsB;CACpD;EAAE,QAAQ;EAAY,SAAS;EAAsB;CACrD;EAAE,QAAQ;EAAkB,SAAS;EAAuB;CAC7D;AAED,MAAM,2BAA2B;;;;;;;;;;;;;;;;;AAkBjC,SAAgB,sBACd,KACA,KACoB;CACpB,MAAM,WAAW,IAAI,MAAM,KAAK;AAChC,KAAI,CAAC,SAAS,OAAO,YAAY,QAAQ,WAAW,SAAS,CAAC,CAAE,QAAO;AACvE,QAAO,SAAS,KAAK,QAAQ,qBAAqB,KAAK,IAAI,CAAC;;AAG9D,SAAS,qBAAqB,KAAa,KAAqC;CAI9E,MAAM,cAAc,eAAe;CACnC,MAAM,iBACJ,gBAAgB,KAAA,KAAa,IAAI,WAAW,KAAA,KAAa,CAAC,IAAI,OAAO,SAAS,YAAY;AAC5F,KAAI,CAAC,kBAAkB,IAAI,OAAO,SAAS,KAAA,EAKzC,QAAO,gBAAgB,KAAA,IAAY;EAAE,OAAO;EAAa,UAAU;EAAK,GAAG,EAAE,UAAU,KAAK;AAE9F,MAAK,MAAM,EAAE,QAAQ,aAAa,2BAA2B;AAC3D,MAAI,CAAC,IAAI,SAAS,OAAO,CAAE;EAC3B,MAAM,QAAQ,IAAI,MAAM,GAAiB,IAAI,SAAS,OAAO,OAAO;AACpE,MAAI,UAAU,GAAI;EAGlB,MAAM,UAAU,gBAAgB,YAD9B,IAAI,OAAO,YAAY,IAAI,OAAO,6BAA6B,qBACX,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC;AAKhF,SADiB,IAAI,WAAW,KAAA,KAAa,IAAI,OAAO,SAAS,MAAM,GACrD;GAAE;GAAO;GAAS,GAAG,EAAE,SAAS;;AAIpD,KAAI,kBAAkB,IAAI,OAAO,SAAS,KAAA,EACxC,QAAO,EAAE,SAAS,IAAI,OAAO,MAAM;AAErC,QAAO,EAAE,UAAU,KAAK;;;AAI1B,SAAS,WAAW,KAA0B,OAAuB;AAEnE,QADiB,IAAI,OAAO,GAAG,IAAI,SAAS,SAAS,YAClC,kBAAkB,MAAM;;;;;;AAO7C,SAAS,kBAAkB,OAAuB;AAEhD,SADkB,MAAM,SAAS,IAAI,GAAI,MAAM,MAAM,IAAI,CAAC,KAAK,GAAc,OAE1E,QAAQ,sBAAsB,QAAQ,CACtC,QAAQ,WAAW,IAAI,CACvB,MAAM,CACN,aAAa;;;AAIlB,SAAS,gBAAgB,MAAsB;AAC7C,QAAO,KAAK,SAAS,IAAI,KAAK,IAAI,aAAa,GAAG,KAAK,MAAM,EAAE,GAAG;;AAGpE,SAAS,UAAU,OAAwB;AACzC,KAAI,SAAS,KAAM,QAAO;AAC1B,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,MAAM;AACjF,KAAI;AACF,SAAO,KAAK,UAAU,MAAM;SACtB;AACN,SAAO,OAAO,MAAM;;;;;;;;AASxB,SAAS,YAAY,UAAkB,MAAiC;AACtE,KAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,QAAO,SAAS,QAAQ,eAAe,OAAO,UAAU;AAEtD,SAAO,KADG,OAAO,MACJ,KAAK;GAClB;;;;;;;;;;;;;;;;;;;;ACzWJ,MAAa,KAA6B;CAKxC,oBAAoB;CACpB,0BAA0B;CAC1B,0BAA0B;CAC1B,sCAAsC;CACtC,6BAA6B;CAC7B,4BAA4B;CAC5B,8BAA8B;CAC9B,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CAKnC,sBAAsB;CACtB,4BAA4B;CAC5B,+BAA+B;CAC/B,8BAA8B;CAK9B,yBAAyB;CACzB,+BAA+B;CAC/B,iDAAiD;CACjD,gDAAgD;CAKhD,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CACnC,+CAA+C;CAC/C,sCAAsC;CAItC,qCAAqC;CAMrC,2BAA2B;CAC3B,iCAAiC;CACjC,oCAAoC;CACpC,mCAAmC;CACnC,iCAAiC;CAMjC,wBAAwB;CACxB,8BAA8B;CAC9B,oCAAoC;CACpC,oCAAoC;CACpC,0CAA0C;CAC1C,8BAA8B;CAE9B,+BAA+B;CAK/B,+BAA+B;CAC/B,qCAAqC;CACrC,qCAAqC;CACrC,iDAAiD;CACjD,uCAAuC;CAKvC,wBAAwB;CACxB,8BAA8B;CAC9B,0CAA0C;CAM1C,cAAc;CACd,oBAAoB;CAGpB,kBAAkB;CAClB,wBAAwB;CACxB,2BAA2B;CAC3B,0BAA0B;CAC1B,2BAA2B;CAC3B,wBAAwB;CACxB,iCAAiC;CACjC,iCAAiC;CAEjC,kBAAkB;CAElB,wBAAwB;CACxB,wBAAwB;CACxB,oCAAoC;CACpC,2BAA2B;CAC3B,4BAA4B;CAC5B,6BAA6B;CAC7B,8BAA8B;CAG9B,8BAA8B;CAC9B,0BAA0B;CAC1B,sCAAsC;CACtC,wBAAwB;CACxB,4BAA4B;CAC5B,2BAA2B;CAC3B,0BAA0B;CAC1B,wBAAwB;CACxB,gCAAgC;CAChC,gCAAgC;CAEhC,kBAAkB;CAClB,sBAAsB;CACtB,oBAAoB;CAGpB,uBAAuB;CAGvB,uBAAuB;CACvB,6BAA6B;CAC7B,gCAAgC;CAChC,uCAAuC;CAGvC,iBAAiB;CACjB,uBAAuB;CACvB,uBAAuB;CAGvB,mBAAmB;CACnB,iBAAiB;CACjB,0BAA0B;CAC1B,iBAAiB;CAGjB,eAAe;CAGf,sBAAsB;CAGtB,0BAA0B;CAK1B,2BAA2B;CAC3B,yBAAyB;CACzB,gCACE;CACF,8BAA8B;CAC9B,6BAA6B;CAC7B,wBAAwB;CACxB,yBAAyB;CACzB,sCACE;CAGF,wBAAwB;CACxB,uBAAuB;CACvB,2BAA2B;CAC3B,4BAA4B;CAC5B,sBAAsB;;CAEtB,6BAA6B;CAC7B,kBAAkB;CAKlB,wBAAwB;CACxB,sBAAsB;CACtB,0BAA0B;CAC1B,0BAA0B;CAC1B,uBAAuB;CAGvB,8BAA8B;CAC9B,6BAA6B;CAC9B;;;ACjMD,MAAa,KAAa;CAIxB,oBAAoB;CACpB,0BAA0B;CAC1B,0BAA0B;CAC1B,sCAAsC;CACtC,6BAA6B;CAC7B,4BAA4B;CAC5B,8BAA8B;CAC9B,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CAKnC,sBAAsB;CACtB,4BAA4B;CAC5B,+BAA+B;CAC/B,8BAA8B;CAK9B,yBAAyB;CACzB,+BAA+B;CAC/B,iDAAiD;CACjD,gDAAgD;CAKhD,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CACnC,+CAA+C;CAC/C,sCAAsC;CACtC,qCAAqC;CAMrC,2BAA2B;CAC3B,iCAAiC;CACjC,oCAAoC;CACpC,mCAAmC;CACnC,iCAAiC;CAKjC,wBAAwB;CACxB,8BAA8B;CAC9B,oCAAoC;CACpC,oCAAoC;CACpC,0CAA0C;CAC1C,8BAA8B;CAC9B,+BAA+B;CAK/B,+BAA+B;CAC/B,qCACE;CACF,qCAAqC;CACrC,iDAAiD;CACjD,uCAAuC;CAKvC,wBAAwB;CACxB,8BACE;CACF,0CAA0C;CAK1C,cAAc;CACd,oBAAoB;CAGpB,kBAAkB;CAClB,wBAAwB;CACxB,2BAA2B;CAC3B,0BAA0B;CAC1B,2BAA2B;CAC3B,wBAAwB;CACxB,iCAAiC;CACjC,iCAAiC;CAEjC,kBAAkB;CAElB,wBAAwB;CACxB,wBAAwB;CACxB,oCAAoC;CACpC,2BAA2B;CAC3B,4BAA4B;CAC5B,6BAA6B;CAC7B,8BAA8B;CAG9B,8BAA8B;CAC9B,0BAA0B;CAC1B,sCAAsC;CACtC,wBAAwB;CACxB,4BAA4B;CAC5B,2BAA2B;CAC3B,0BAA0B;CAC1B,wBAAwB;CACxB,gCAAgC;CAChC,gCAAgC;CAEhC,kBAAkB;CAClB,sBAAsB;CACtB,oBAAoB;CAGpB,uBAAuB;CAGvB,uBAAuB;CACvB,6BAA6B;CAC7B,gCAAgC;CAChC,uCAAuC;CAGvC,iBAAiB;CACjB,uBACE;CACF,uBAAuB;CAGvB,mBAAmB;CACnB,iBAAiB;CACjB,0BAA0B;CAC1B,iBAAiB;CAGjB,eAAe;CAGf,sBAAsB;CAGtB,0BAA0B;CAG1B,2BAA2B;CAC3B,yBACE;CACF,gCACE;CACF,8BACE;CACF,6BAA6B;CAC7B,wBAAwB;CACxB,yBACE;CACF,sCACE;CAGF,wBAAwB;CACxB,uBAAuB;CACvB,2BAA2B;CAC3B,4BAA4B;CAC5B,sBAAsB;CACtB,6BAA6B;CAC7B,kBAAkB;CAGlB,wBAAwB;CACxB,sBAAsB;CACtB,0BAA0B;CAC1B,0BAA0B;CAC1B,uBAAuB;CAGvB,8BAA8B;CAC9B,6BAA6B;CAC9B;;;AC5LD,MAAa,KAAa;CAIxB,oBAAoB;CACpB,0BAA0B;CAC1B,0BAA0B;CAC1B,sCAAsC;CACtC,6BAA6B;CAC7B,4BAA4B;CAC5B,8BAA8B;CAC9B,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CAKnC,sBAAsB;CACtB,4BAA4B;CAC5B,+BAA+B;CAC/B,8BAA8B;CAK9B,yBAAyB;CACzB,+BAA+B;CAC/B,iDAAiD;CACjD,gDAAgD;CAKhD,6BAA6B;CAC7B,mCAAmC;CACnC,mCAAmC;CACnC,+CAA+C;CAC/C,sCAAsC;CACtC,qCAAqC;CAMrC,2BAA2B;CAC3B,iCAAiC;CACjC,oCAAoC;CACpC,mCAAmC;CACnC,iCAAiC;CAKjC,wBAAwB;CACxB,8BAA8B;CAC9B,oCAAoC;CACpC,oCAAoC;CACpC,0CAA0C;CAC1C,8BAA8B;CAC9B,+BAA+B;CAK/B,+BAA+B;CAC/B,qCACE;CACF,qCAAqC;CACrC,iDAAiD;CACjD,uCAAuC;CAKvC,wBAAwB;CACxB,8BACE;CACF,0CAA0C;CAK1C,cAAc;CACd,oBAAoB;CAGpB,kBAAkB;CAClB,wBAAwB;CACxB,2BAA2B;CAC3B,0BAA0B;CAC1B,2BAA2B;CAC3B,wBAAwB;CACxB,iCAAiC;CACjC,iCAAiC;CAEjC,kBAAkB;CAElB,wBAAwB;CACxB,wBAAwB;CACxB,oCAAoC;CACpC,2BAA2B;CAC3B,4BAA4B;CAC5B,6BAA6B;CAC7B,8BAA8B;CAG9B,8BAA8B;CAC9B,0BAA0B;CAC1B,sCAAsC;CACtC,wBAAwB;CACxB,4BAA4B;CAC5B,2BAA2B;CAC3B,0BAA0B;CAC1B,wBAAwB;CACxB,gCAAgC;CAChC,gCAAgC;CAEhC,kBAAkB;CAClB,sBAAsB;CACtB,oBAAoB;CAGpB,uBAAuB;CAGvB,uBAAuB;CACvB,6BAA6B;CAC7B,gCAAgC;CAChC,uCAAuC;CAGvC,iBAAiB;CACjB,uBACE;CACF,uBAAuB;CAGvB,mBAAmB;CACnB,iBAAiB;CACjB,0BAA0B;CAC1B,iBAAiB;CAGjB,eAAe;CAGf,sBAAsB;CAGtB,0BAA0B;CAG1B,2BAA2B;CAC3B,yBAAyB;CACzB,gCAAgC;CAChC,8BAA8B;CAC9B,6BAA6B;CAC7B,wBAAwB;CACxB,yBAAyB;CACzB,sCACE;CAGF,wBAAwB;CACxB,uBAAuB;CACvB,2BAA2B;CAC3B,4BAA4B;CAC5B,sBAAsB;CACtB,6BAA6B;CAC7B,kBAAkB;CAGlB,wBAAwB;CACxB,sBAAsB;CACtB,0BAA0B;CAC1B,0BAA0B;CAC1B,uBAAuB;CAGvB,8BAA8B;CAC9B,6BAA6B;CAC9B;;;AChLD,MAAa,kBAA6D;CACxE,IAAI;EACF,0BAA0B;EAC1B,sCAAsC;EACtC,mCAAmC;EACnC,+CAA+C;EAC/C,qCAAqC;EACrC,iDAAiD;EACjD,wBAAwB;EACxB,oCAAoC;EACrC;CACD,IAAI;EACF,0BAA0B;EAC1B,sCAAsC;EACtC,mCAAmC;EACnC,+CAA+C;EAC/C,qCAAqC;EACrC,iDAAiD;EACjD,wBAAwB;EACxB,oCAAoC;EACrC;CACD,IAAI;EACF,0BAA0B;EAC1B,sCAAsC;EACtC,mCAAmC;EACnC,+CAA+C;EAC/C,qCAAqC;EACrC,iDAAiD;EACjD,wBAAwB;EACxB,oCAAoC;EACrC;CACF;;;AClCD,MAAa,iBAAmD;CAAE;CAAI;CAAI;CAAI;;;ACf9E,IAAI,YAAY;AAChB,SAAS,eAAe;AACvB,QAAO;;AAER,SAAS,aAAa,MAAM;AAC3B,aAAY;;;;ACLb,IAAI,YAAY,OAAO;AACvB,IAAI,eAAe,KAAK,eAAe;CACtC,IAAI,SAAS,EAAE;AACf,MAAK,IAAI,QAAQ,IAAK,WAAU,QAAQ,MAAM;EAC7C,KAAK,IAAI;EACT,YAAY;EACZ,CAAC;AACF,KAAI,CAAC,WAAY,WAAU,QAAQ,OAAO,aAAa,EAAE,OAAO,UAAU,CAAC;AAC3E,QAAO;;;;;;;;;;;ACER,IAAI,yBAAyC,4BAAY;CACxD,oCAAoC;CACpC,qBAAqB;CACrB,yBAAyB;CACzB,sBAAsB;CACtB,kBAAkB;CAClB,4BAA4B;CAC5B,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;CACrB,oBAAoB;CACpB,qBAAqB;CACrB,kBAAkB;CAClB,kBAAkB;CAClB,4BAA4B;CAC5B,mBAAmB;CACnB,kBAAkB;CAClB,sBAAsB;CACtB,uBAAuB;CACvB,qCAAqC;CACrC,sBAAsB;CACtB,0CAA0C;CAC1C,uBAAuB;CACvB,sBAAsB;CACtB,2BAA2B;CAC3B,+BAA+B;CAC/B,4BAA4B;CAC5B,kCAAkC;CAClC,wBAAwB;CACxB,yBAAyB;CACzB,2BAA2B;CAC3B,2BAA2B;CAC3B,2BAA2B;CAC3B,0BAA0B;CAC1B,2BAA2B;CAC3B,wBAAwB;CACxB,wBAAwB;CACxB,kCAAkC;CAClC,yBAAyB;CACzB,wBAAwB;CACxB,4BAA4B;CAC5B,4BAA4B;CAC5B,gBAAgB;CAChB,6BAA6B;CAC7B,2CAA2C;CAC3C,yBAAyB;CACzB,mBAAmB;CACnB,4BAA4B;CAC5B,6BAA6B;CAC7B,4BAA4B;CAC5B,kCAAkC;CAClC,sBAAsB;CACtB,+BAA+B;CAC/B,yBAAyB;CACzB,sBAAsB;CACtB,uBAAuB;CACvB,qBAAqB;CACrB,0BAA0B;CAC1B,uBAAuB;CACvB,wBAAwB;CACxB,sBAAsB;CACtB,4BAA4B;CAC5B,2BAA2B;CAC3B,wBAAwB;CACxB,qBAAqB;CACrB,yBAAyB;CACzB,gBAAgB;CAChB,iBAAiB;CACjB,uBAAuB;CACvB,4BAA4B;CAC5B,0BAA0B;CAC1B,8BAA8B;CAC9B,wBAAwB;CACxB,iCAAiC;CACjC,0BAA0B;CAC1B,yBAAyB;CACzB,8BAA8B;CAC9B,2BAA2B;CAC3B,eAAe;CACf,oBAAoB;CACpB,iBAAiB;CACjB,0BAA0B;CAC1B,kBAAkB;CAClB,2BAA2B;CAC3B,2BAA2B;CAC3B,wBAAwB;CACxB,wBAAwB;CACxB,gBAAgB;CAChB,sBAAsB;CACtB,6BAA6B;CAC7B,2BAA2B;CAC3B,qBAAqB;CACrB,kBAAkB;CAClB,6BAA6B;CAC7B,4BAA4B;CAC5B,eAAe;CACf,kCAAkC;CAClC,wBAAwB;CACxB,mBAAmB;CACnB,kCAAkC;CAClC,iBAAiB;CACjB,sBAAsB;CACtB,oBAAoB;CACpB,wBAAwB;CACxB,kBAAkB;CAClB,2BAA2B;CAC3B,oBAAoB;CACpB,mBAAmB;CACnB,wBAAwB;CACxB,qBAAqB;CACrB,oBAAoB;CACpB,qBAAqB;CACrB,qBAAqB;CACrB,kBAAkB;CAClB,kBAAkB;CAClB,uBAAuB;CACvB,qBAAqB;CACrB,uBAAuB;CACvB,sBAAsB;CACtB,4BAA4B;CAC5B,kBAAkB;CAClB,4BAA4B;CAC5B,CAAC;AACF,MAAM,wBAAwB;AAC7B,QAAO,GAAG,cAAc,CAAC;;;;;;AAM1B,MAAM,YAAY,OAAO,YAAY;AACpC,QAAO,YAAY,iBAAiB,EAAE;EACrC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,sBAAsB;AAC3B,QAAO,GAAG,cAAc,CAAC;;;;;;AAM1B,MAAM,UAAU,OAAO,YAAY;AAClC,QAAO,YAAY,eAAe,EAAE;EACnC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,uBAAuB;AAC5B,QAAO,GAAG,cAAc,CAAC;;;;;;AAM1B,MAAM,WAAW,OAAO,YAAY;AACnC,QAAO,YAAY,gBAAgB,EAAE;EACpC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;CACpC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,SAAS,sBAAsB,GAAG,cAAc,CAAC;;;;;AAK1G,MAAM,aAAa,OAAO,gBAAgB,QAAQ,YAAY;AAC7D,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,yBAAyB;AAC9B,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;AAW1B,MAAM,aAAa,OAAO,gBAAgB,YAAY;AACrD,QAAO,YAAY,kBAAkB,EAAE;EACtC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,qBAAqB,QAAQ,WAAW;CAC7C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,SAAS,OAAO,GAAG,sBAAsB,GAAG,cAAc,CAAC,SAAS;;;;;AAK7H,MAAM,cAAc,OAAO,QAAQ,QAAQ,YAAY;AACtD,QAAO,YAAY,kBAAkB,QAAQ,OAAO,EAAE;EACrD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,WAAW;AACxC,QAAO,GAAG,cAAc,CAAC,SAAS;;;;;AAKnC,MAAM,iBAAiB,OAAO,QAAQ,YAAY;AACjD,QAAO,YAAY,qBAAqB,OAAO,EAAE;EAChD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,0BAA0B,QAAQ,WAAW;CAClD,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,SAAS,OAAO,YAAY,sBAAsB,GAAG,cAAc,CAAC,SAAS,OAAO;;;;;AAK7I,MAAM,mBAAmB,OAAO,QAAQ,QAAQ,YAAY;AAC3D,QAAO,YAAY,uBAAuB,QAAQ,OAAO,EAAE;EAC1D,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,sCAAsC,WAAW;AACtD,QAAO,GAAG,cAAc,CAAC,SAAS,OAAO;;;;;;;;;;;AAW1C,MAAM,+BAA+B,OAAO,QAAQ,kCAAkC,YAAY;AACjG,QAAO,YAAY,mCAAmC,OAAO,EAAE;EAC9D,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,iCAAiC;EACtD,CAAC;;AAEH,MAAM,uCAAuC,QAAQ,mBAAmB;AACvE,QAAO,GAAG,cAAc,CAAC,SAAS,OAAO,0BAA0B;;;;;;;;;;;;AAYpE,MAAM,gCAAgC,OAAO,QAAQ,gBAAgB,mCAAmC,YAAY;AACnH,QAAO,YAAY,oCAAoC,QAAQ,eAAe,EAAE;EAC/E,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kCAAkC;EACvD,CAAC;;AAEH,MAAM,yBAAyB,WAAW;AACzC,QAAO,GAAG,cAAc,CAAC,SAAS,OAAO;;;;;AAK1C,MAAM,kBAAkB,OAAO,QAAQ,qBAAqB,YAAY;AACvE,QAAO,YAAY,sBAAsB,OAAO,EAAE;EACjD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,oBAAoB;EACzC,CAAC;;AAEH,MAAM,uBAAuB,QAAQ,WAAW;CAC/C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,SAAS,OAAO,SAAS,sBAAsB,GAAG,cAAc,CAAC,SAAS,OAAO;;;;;;;;;;;;;AAa1I,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,YAAY;AACxD,QAAO,YAAY,oBAAoB,QAAQ,OAAO,EAAE;EACvD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB;AAC7B,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,YAAY,OAAO,YAAY;AACpC,QAAO,YAAY,iBAAiB,EAAE;EACrC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,yBAAyB;AAC9B,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;AAiB1B,MAAM,aAAa,OAAO,gBAAgB,YAAY;AACrD,QAAO,YAAY,kBAAkB,EAAE;EACtC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,qBAAqB,OAAO;AACjC,QAAO,GAAG,cAAc,CAAC,QAAQ;;;;;;;;AAQlC,MAAM,cAAc,OAAO,IAAI,YAAY;AAC1C,QAAO,YAAY,kBAAkB,GAAG,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,OAAO;AACpC,QAAO,GAAG,cAAc,CAAC,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCrC,MAAM,iBAAiB,OAAO,IAAI,oBAAoB,YAAY;AACjE,QAAO,YAAY,qBAAqB,GAAG,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,mBAAmB;EACxC,CAAC;;AAEH,MAAM,gCAAgC;AACrC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;;AAa1B,MAAM,oBAAoB,OAAO,uBAAuB,YAAY;AACnE,QAAO,YAAY,yBAAyB,EAAE;EAC7C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,sBAAsB;EAC3C,CAAC;;AAEH,MAAM,wBAAwB,cAAc;AAC3C,QAAO,GAAG,cAAc,CAAC,iBAAiB;;;;;;;;;;;;;AAa3C,MAAM,iBAAiB,OAAO,WAAW,YAAY;AACpD,QAAO,YAAY,qBAAqB,UAAU,EAAE;EACnD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,cAAc;AAC3C,QAAO,GAAG,cAAc,CAAC,iBAAiB,UAAU;;;;;;;;;;;;AAYrD,MAAM,iBAAiB,OAAO,WAAW,oBAAoB,YAAY;AACxE,QAAO,YAAY,qBAAqB,UAAU,EAAE;EACnD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,mBAAmB;EACxC,CAAC;;AAEH,MAAM,8BAA8B,WAAW,gBAAgB;AAC9D,QAAO,GAAG,cAAc,CAAC,iBAAiB,UAAU,cAAc,YAAY;;;;;;;;;;;;;;;;AAgB/E,MAAM,uBAAuB,OAAO,WAAW,aAAa,0BAA0B,YAAY;AACjG,QAAO,YAAY,2BAA2B,WAAW,YAAY,EAAE;EACtE,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,yBAAyB;EAC9C,CAAC;;AAEH,MAAM,uBAAuB,cAAc;AAC1C,QAAO,GAAG,cAAc,CAAC,iBAAiB,UAAU;;;;;;;;;;;;;;;;AAgBrD,MAAM,gBAAgB,OAAO,WAAW,YAAY;AACnD,QAAO,YAAY,oBAAoB,UAAU,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,4BAA4B;AACjC,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,gBAAgB,OAAO,mBAAmB,YAAY;AAC3D,QAAO,YAAY,qBAAqB,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,4BAA4B;AACjC,QAAO,GAAG,cAAc,CAAC;;;;;AAK1B,MAAM,gBAAgB,OAAO,mBAAmB,YAAY;AAC3D,QAAO,YAAY,qBAAqB,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,oBAAoB,cAAc;AACvC,QAAO,GAAG,cAAc,CAAC,YAAY;;;;;;;AAOtC,MAAM,aAAa,OAAO,WAAW,YAAY;AAChD,QAAO,YAAY,iBAAiB,UAAU,EAAE;EAC/C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,sBAAsB,cAAc;AACzC,QAAO,GAAG,cAAc,CAAC,YAAY;;;;;;;AAOtC,MAAM,eAAe,OAAO,WAAW,kBAAkB,YAAY;AACpE,QAAO,YAAY,mBAAmB,UAAU,EAAE;EACjD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,iBAAiB;EACtC,CAAC;;AAEH,MAAM,mBAAmB,cAAc;AACtC,QAAO,GAAG,cAAc,CAAC,YAAY,UAAU;;;;;;;;;;;AAWhD,MAAM,YAAY,OAAO,WAAW,YAAY;AAC/C,QAAO,YAAY,gBAAgB,UAAU,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,WAAW,WAAW;CACnD,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,UAAU,gBAAgB,sBAAsB,GAAG,cAAc,CAAC,YAAY,UAAU;;;;;;;;;;AAU7J,MAAM,iBAAiB,OAAO,WAAW,QAAQ,YAAY;AAC5D,QAAO,YAAY,qBAAqB,WAAW,OAAO,EAAE;EAC3D,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,uBAAuB,cAAc;AAC1C,QAAO,GAAG,cAAc,CAAC,YAAY,UAAU;;;;;;;;;;AAUhD,MAAM,gBAAgB,OAAO,WAAW,mBAAmB,YAAY;AACtE,QAAO,YAAY,oBAAoB,UAAU,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,4BAA4B;AACjC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2B1B,MAAM,gBAAgB,OAAO,mBAAmB,YAAY;AAC3D,QAAO,YAAY,qBAAqB,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,uBAAuB,WAAW;CACvC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,kBAAkB,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;AASnH,MAAM,gBAAgB,OAAO,mBAAmB,QAAQ,YAAY;AACnE,QAAO,YAAY,oBAAoB,OAAO,EAAE;EAC/C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,yBAAyB,WAAW;CACzC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,qBAAqB,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAuBtH,MAAM,kBAAkB,OAAO,qBAAqB,QAAQ,YAAY;AACvE,QAAO,YAAY,sBAAsB,OAAO,EAAE;EACjD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,oBAAoB;EACzC,CAAC;;AAEH,MAAM,oBAAoB,cAAc;AACvC,QAAO,GAAG,cAAc,CAAC,YAAY;;;;;;;;;;;;AAYtC,MAAM,aAAa,OAAO,WAAW,YAAY;AAChD,QAAO,YAAY,iBAAiB,UAAU,EAAE;EAC/C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,uBAAuB,cAAc;AAC1C,QAAO,GAAG,cAAc,CAAC,YAAY;;;;;;;;;;;;;;;AAetC,MAAM,gBAAgB,OAAO,WAAW,YAAY;AACnD,QAAO,YAAY,oBAAoB,UAAU,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,2BAA2B;AAChC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;AAY1B,MAAM,eAAe,OAAO,YAAY;AACvC,QAAO,YAAY,oBAAoB,EAAE;EACxC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,8BAA8B;AACnC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;;AAY1B,MAAM,kBAAkB,OAAO,YAAY;AAC1C,QAAO,YAAY,uBAAuB,EAAE;EAC3C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,sBAAsB,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,WAAW,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;AAe5G,MAAM,eAAe,OAAO,kBAAkB,QAAQ,YAAY;AACjE,QAAO,YAAY,mBAAmB,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,iBAAiB;EACtC,CAAC;;AAEH,MAAM,qBAAqB,WAAW;CACrC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,WAAW,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;AAQ5G,MAAM,cAAc,OAAO,QAAQ,YAAY;AAC9C,QAAO,YAAY,kBAAkB,OAAO,EAAE;EAC7C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,uBAAuB,IAAI,WAAW;CAC3C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,WAAW,GAAG,GAAG,sBAAsB,GAAG,cAAc,CAAC,WAAW;;;;;;;;;AAS7H,MAAM,gBAAgB,OAAO,IAAI,QAAQ,YAAY;AACpD,QAAO,YAAY,oBAAoB,IAAI,OAAO,EAAE;EACnD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,mCAAmC;AACxC,QAAO,GAAG,cAAc,CAAC;;;;;;;;;;;AAW1B,MAAM,uBAAuB,OAAO,0BAA0B,YAAY;AACzE,QAAO,YAAY,4BAA4B,EAAE;EAChD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,yBAAyB;EAC9C,CAAC;;AAEH,MAAM,6BAA6B,WAAW;CAC7C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,oBAAoB,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;AAQrH,MAAM,sBAAsB,OAAO,QAAQ,YAAY;AACtD,QAAO,YAAY,0BAA0B,OAAO,EAAE;EACrD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,2BAA2B,OAAO;AACvC,QAAO,GAAG,cAAc,CAAC,oBAAoB;;;;;;AAM9C,MAAM,oBAAoB,OAAO,IAAI,YAAY;AAChD,QAAO,YAAY,wBAAwB,GAAG,EAAE;EAC/C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,8BAA8B,OAAO;AAC1C,QAAO,GAAG,cAAc,CAAC,oBAAoB;;;;;;;;AAQ9C,MAAM,uBAAuB,OAAO,IAAI,0BAA0B,YAAY;AAC7E,QAAO,YAAY,2BAA2B,GAAG,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,yBAAyB;EAC9C,CAAC;;AAEH,MAAM,8BAA8B,OAAO;AAC1C,QAAO,GAAG,cAAc,CAAC,oBAAoB;;;;;;;;;AAS9C,MAAM,uBAAuB,OAAO,IAAI,YAAY;AACnD,QAAO,YAAY,2BAA2B,GAAG,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;CACpC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,SAAS,sBAAsB,GAAG,cAAc,CAAC;;;;;AAK1G,MAAM,aAAa,OAAO,gBAAgB,QAAQ,YAAY;AAC7D,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,oBAAoB,WAAW;CACpC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,eAAe,sBAAsB,GAAG,cAAc,CAAC;;;;;;;AAOhH,MAAM,aAAa,OAAO,gBAAgB,QAAQ,YAAY;AAC7D,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,iBAAiB,WAAW;AACjC,QAAO,GAAG,cAAc,CAAC,SAAS;;;;;;;AAOnC,MAAM,UAAU,OAAO,QAAQ,YAAY;AAC1C,QAAO,YAAY,cAAc,OAAO,EAAE;EACzC,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;AACpC,QAAO,GAAG,cAAc,CAAC,SAAS;;;;;;;;;;;;;;AAcnC,MAAM,aAAa,OAAO,QAAQ,YAAY;AAC7C,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;AACpC,QAAO,GAAG,cAAc,CAAC,SAAS;;;;;;;AAOnC,MAAM,aAAa,OAAO,QAAQ,gBAAgB,YAAY;AAC7D,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,eAAe;EACpC,CAAC;;AAEH,MAAM,0BAA0B,WAAW;CAC1C,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,gBAAgB,sBAAsB,GAAG,cAAc,CAAC;;;;;;;AAOjH,MAAM,mBAAmB,OAAO,QAAQ,YAAY;AACnD,QAAO,YAAY,uBAAuB,OAAO,EAAE;EAClD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,8BAA8B,MAAM,WAAW;CACpD,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,gBAAgB,KAAK,GAAG,sBAAsB,GAAG,cAAc,CAAC,gBAAgB;;;;;;;;;;AAUzI,MAAM,uBAAuB,OAAO,MAAM,QAAQ,YAAY;AAC7D,QAAO,YAAY,2BAA2B,MAAM,OAAO,EAAE;EAC5D,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,WAAW;CACxC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;AAe7G,MAAM,iBAAiB,OAAO,oBAAoB,QAAQ,YAAY;AACrE,QAAO,YAAY,qBAAqB,OAAO,EAAE;EAChD,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,mBAAmB;EACxC,CAAC;;AAEH,MAAM,sBAAsB,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;AAW7G,MAAM,eAAe,OAAO,QAAQ,YAAY;AAC/C,QAAO,YAAY,mBAAmB,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,yBAAyB,OAAO;AACrC,QAAO,GAAG,cAAc,CAAC,YAAY;;;;;;AAMtC,MAAM,kBAAkB,OAAO,IAAI,YAAY;AAC9C,QAAO,YAAY,sBAAsB,GAAG,EAAE;EAC7C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,uBAAuB,WAAW;CACvC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;AAqB7G,MAAM,gBAAgB,OAAO,mBAAmB,QAAQ,YAAY;AACnE,QAAO,YAAY,oBAAoB,OAAO,EAAE;EAC/C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,kBAAkB;EACvC,CAAC;;AAEH,MAAM,sBAAsB,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;AAU7G,MAAM,eAAe,OAAO,QAAQ,YAAY;AAC/C,QAAO,YAAY,mBAAmB,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,wBAAwB,WAAW,WAAW;CACnD,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,YAAY,UAAU,GAAG,sBAAsB,GAAG,cAAc,CAAC,YAAY;;;;;;;;;;;;;;;;AAgBtI,MAAM,iBAAiB,OAAO,WAAW,QAAQ,YAAY;AAC5D,QAAO,YAAY,qBAAqB,WAAW,OAAO,EAAE;EAC3D,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,qBAAqB,WAAW;CACrC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,UAAU,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;AAY3G,MAAM,cAAc,OAAO,iBAAiB,QAAQ,YAAY;AAC/D,QAAO,YAAY,kBAAkB,OAAO,EAAE;EAC7C,GAAG;EACH,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,GAAG,SAAS;GACZ;EACD,MAAM,KAAK,UAAU,gBAAgB;EACrC,CAAC;;AAEH,MAAM,kBAAkB,IAAI,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,UAAU,GAAG,GAAG,sBAAsB,GAAG,cAAc,CAAC,UAAU;;;;;;;;;;;;;;AAc3H,MAAM,WAAW,OAAO,IAAI,QAAQ,YAAY;AAC/C,QAAO,YAAY,eAAe,IAAI,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,qBAAqB,IAAI,WAAW;CACzC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,UAAU,GAAG,GAAG,sBAAsB,GAAG,cAAc,CAAC,UAAU;;;;;;;;;;AAU3H,MAAM,cAAc,OAAO,IAAI,QAAQ,YAAY;AAClD,QAAO,YAAY,kBAAkB,IAAI,OAAO,EAAE;EACjD,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,oBAAoB,WAAW;CACpC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,MAAM,QAAQ,MAAM,IAAI,CAAC,YAAY,aAAa,CAAC,SAAS,IAAI,EAAE;AACrE,SAAM,SAAS,MAAM;AACpB,qBAAiB,OAAO,KAAK,MAAM,OAAO,SAAS,EAAE,UAAU,CAAC;KAC/D;AACF;;AAED,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,UAAU,sBAAsB,GAAG,cAAc,CAAC;;;;;;;;;;;;;;;;;AAiB3G,MAAM,aAAa,OAAO,QAAQ,YAAY;AAC7C,QAAO,YAAY,iBAAiB,OAAO,EAAE;EAC5C,GAAG;EACH,QAAQ;EACR,CAAC;;AAEH,MAAM,kBAAkB,IAAI,WAAW;CACtC,MAAM,mBAAmB,IAAI,iBAAiB;AAC9C,QAAO,QAAQ,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;AACtD,MAAI,UAAU,KAAK,EAAG,kBAAiB,OAAO,KAAK,UAAU,OAAO,SAAS,MAAM,UAAU,CAAC;GAC7F;CACF,MAAM,oBAAoB,iBAAiB,UAAU;AACrD,QAAO,kBAAkB,SAAS,IAAI,GAAG,cAAc,CAAC,UAAU,GAAG,GAAG,sBAAsB,GAAG,cAAc,CAAC,UAAU;;;;;;;;;;;AAW3H,MAAM,WAAW,OAAO,IAAI,QAAQ,YAAY;AAC/C,QAAO,YAAY,eAAe,IAAI,OAAO,EAAE;EAC9C,GAAG;EACH,QAAQ;EACR,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC56CH,SAAS,oBAAoB,MAAM;CAClC,IAAI,UAAU,KAAK;AACnB,QAAO,QAAQ,SAAS,IAAI,CAAE,WAAU,QAAQ,MAAM,GAAG,GAAG;AAC5D,QAAO,IAAI,MAAM,wBAAwB,EAAE,IAAI,QAAQ,MAAM,UAAU;EACtE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM,SAAS;AACjD,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,UAAQ,GAAG,SAAS;AACnB,gBAAa,QAAQ;AACrB,mBAAgB,KAAK,MAAM;AAC3B,UAAO,MAAM,GAAG,KAAK;;IAEpB,CAAC;;;;;;;;;;;;;;;;;AC1BL,MAAM,eAAe,OAAO,IAAI,qCAAqC;AACrE,SAAS,WAAW;AACnB,QAAO,WAAW,iBAAiB;;;;;;;;;AAYpC,MAAM,2BAA2B,IAAI,SAAS;;;;;;;;;;AAyC9C,SAAS,OAAO,SAAS;CACxB,IAAI,MAAM,SAAS,IAAI,QAAQ;AAC/B,KAAI,CAAC,KAAK;AACT,QAAM,oBAAoB;GACzB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GACf,CAAC;AACF,WAAS,IAAI,SAAS,IAAI;;AAE3B,QAAO;;;;;;AAMR,SAAS,mBAAmB;AAC3B,QAAO,UAAU;;;;;AC/ElB,MAAM,qBAAqB;;;;;;;;;;AAqB3B,MAAM,yBAAyB;AAC/B,MAAM,oCAAoB,IAAI,KAA6B;;;;;;;AAQ3D,SAAS,iBAAiB,EAAE,WAAW,WAAW,OAAiD;AACjG,KAAI,CAAC,UAAW,QAAO,KAAA;CACvB,MAAM,oBAAoB,aAAa;CACvC,MAAM,cAAc,OAAO,KAAA;CAC3B,MAAM,MAAM,KAAK,UAAU;EAAC;EAAW;EAAmB,eAAe;EAAG,CAAC;CAC7E,IAAI,UAAU,kBAAkB,IAAI,IAAI;AACxC,KAAI,CAAC,SAAS;AACZ,YAAU,OAAO,OAAO;GAAE;GAAW,WAAW;GAAmB,KAAK;GAAa,CAAC;AACtF,MAAI,kBAAkB,QAAQ,wBAAwB;GACpD,MAAM,SAAS,kBAAkB,MAAM,CAAC,MAAM,CAAC;AAC/C,OAAI,WAAW,KAAA,EACb,mBAAkB,OAAO,OAAO;;AAGpC,oBAAkB,IAAI,KAAK,QAAQ;;AAErC,QAAO;;;;;;;;;;;;;;;;;;;;;;;;AAyBT,SAAgB,WACd,SACA,OACA,SAC8C;CAC9C,MAAM,MAAM,WAAW,kBAAkB,IAAI,iBAAiB,MAAM;AACpE,KAAI,CAAC,IACH,OAAM,IAAI,MACR,GAAG,QAAQ,6HAEZ;AAEH,QAAO;EAAE,SAAS;EAAK,KAAK,OAAO,IAAI;EAAE;;;;;;;;;;;;;;;;;;;;;;;ACpE3C,MAAM,kBAAqC;CACzC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;;;;;AAOD,MAAM,eAAkC;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,qBAAqB;AAE3B,SAAS,sBAAgC;CACvC,MAAM,MAAM,IAAI,IAAY,gBAAgB;AAC5C,MAAK,MAAM,YAAY,iBACrB,KAAI,IAAI,SAAS,IAAI;AAEvB,QAAO,CAAC,GAAG,IAAI;;AAGjB,SAAS,uBAAiC;CACxC,MAAM,MAAM,IAAI,IAAY,aAAa;AACzC,MAAK,MAAM,YAAY,iBACrB,MAAK,MAAM,QAAQ,SAAS,MAC1B,KAAI,IAAI,KAAK;AAGjB,QAAO,CAAC,GAAG,IAAI;;;;;;AAOjB,SAAgB,kBAA4C;CAC1D,MAAM,SAAiB;EACrB,cAAc,EAAE,MAAM,MAAM;EAC5B,UAAU,qBAAqB;EAC/B,UAAU,sBAAsB;EAChC,aAAa;GAAC;GAAU;GAAS;GAAU;GAAU;GAAS;GAAQ;GAAS;GAAS;EACxF,aAAa;GAAC;GAAW;GAAW;GAAU;GAAW;GAAS;EAClE,yBAAyB;GACvB,cAAc;GACd,oBAAoB;GACpB,gCAAgC;GACjC;EACD,cAAc;EACd,iBAAiB;EACjB,iBAAiB;EACjB,qBAAqB;EACtB;AAED,QAAO,SAAS,SAAS,MAAsB;EAC7C,MAAM,SAAS,UAAU,SAAS,MAAM,OAAO;AAC/C,SAAO,OAAO,WAAW,WAAW,SAAS,OAAO,OAAO;;;;;;;;;;;;;;;;;;;;;;;ACzG/D,MAAM,aAAmE;CACvE,MAAM;CACN,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM;CACP;AAID,MAAM,cAAqF;CACzF,SAAS;EACP,kBAAkB;EAClB,kBAAkB;EACnB;CACD,SAAS,EAAE;CACX,aAAa;EACX,kBAAkB;EAClB,kBAAkB;EACnB;CACF;AAaD,MAAM,cAAuD;CAC3D,SAAS,CAAC,eAAe;CACzB,YAAY,CAAC,0BAA0B;CACvC,YAAY,CAAC,kBAAkB;CAC/B,SAAS,CAAC,aAAa,eAAe;CACtC,OAAO;EAAC;EAAc;EAAkB;EAAc;CACtD,QAAQ,CAAC,eAAe,aAAa;CAIrC,MAAM;EACJ;EACA;EACA;EACA;EACA;EACD;CACD,YAAY,CAAC,wBAAwB;CAKrC,MAAM,CAAC,YAAY;CACnB,SAAS,CAAC,eAAe;CACzB,SAAS,CAAC,eAAe;CACzB,OAAO,CAAC,mBAAmB;CAC5B;;;;;;;;;;;;;;;;AAiBD,MAAM,oBAAoB;;AAG1B,MAAM,gBAAgB;;;;;;AAWtB,SAAgB,wBACd,UACA,UAAmC,EAAE,EAC7B;CACR,MAAM,aAAa,oBAAoB,SAAS;CAChD,MAAM,cAAc,UAAU,OAAO,MAAM;CAC3C,MAAM,YAAY,cAAc,WAAW,YAAY,GAAG,EAAE;CAE5D,MAAM,SAAmB,EAAE;AAC3B,KAAI,OAAO,KAAK,WAAW,CAAC,SAAS,EACnC,QAAO,KAAK,YAAY,mBAAmB,WAAW,CAAC;AAEzD,KAAI,OAAO,KAAK,UAAU,CAAC,SAAS,EAClC,QAAO,KAAK,YAAY,eAAe,UAAU,CAAC;AAMpD,KAAI,QAAQ,kBAAkB,UAAU,aAAa;EACnD,MAAM,SAAS;GAAE,GAAG;GAAY,GAAG;GAAW;AAC9C,SAAO,SAAS;AAChB,SAAO,KAAK,YAAY,mBAAmB,OAAO,CAAC;;AAGrD,QAAO,OAAO,KAAK,KAAK;;AAG1B,SAAS,oBAAoB,UAAwD;AACnF,KAAI,CAAC,SACH,QAAO,EAAE;CAEX,MAAM,QAAgC,EAAE;AACxC,QAAO,OAAO,OAAO,WAAW,SAAS,QAAQ,CAAC;AAClD,QAAO,OAAO,OAAO,cAAc,SAAS,WAAW,CAAC;AACxD,QAAO,OAAO,OAAO,SAAS,SAAS,MAAM,CAAC;AAC9C,QAAO;;AAGT,SAAS,WAAW,SAA8D;AAChF,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,YAAY,EAAyC;EAChG,MAAM,QAAQ,QAAQ;AACtB,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC9C,MAAK,MAAM,WAAW,SACpB,KAAI,WAAW;;AAIrB,QAAO;;AAGT,SAAS,cAAc,YAAoE;AACzF,KAAI,CAAC,WAAY,QAAO,EAAE;CAC1B,MAAM,MAA8B,EAAE;AAItC,KAAI,WAAW,aAAa;AAC1B,MAAI,2BAA2B,WAAW;AAC1C,MAAI,8BAA8B,WAAW;;AAE/C,KAAI,WAAW,oBACb,KAAI,8BAA8B,WAAW;AAE/C,KAAI,WAAW,iBACb,KAAI,2BAA2B,WAAW;CAK5C,MAAM,QAAQ,MAAM,WAAW,SAAS,GAAG,KAAM,KAAK;AACtD,KAAI,UAAU,EACZ,KAAI,qBAAqB,GAAG;AAE9B,QAAO;;AAGT,SAAS,SAAS,OAA0D;AAC1E,KAAI,CAAC,MAAO,QAAO,EAAE;CACrB,MAAM,MAA8B,EAAE;AACtC,KAAI,MAAM,UAAU,WAAW,MAAM,SAAS;EAC5C,MAAM,SAAS,WAAW,MAAM;AAKhC,MAAI,oBAAoB;AACxB,MAAI,oBAAoB,WAAW,MAAM,MAAM,QAAQ,OAAO;AAC9D,MAAI,oBAAoB,WAAW,MAAM,MAAM,QAAQ,OAAO;;AAEhE,KAAI,MAAM,QACR,QAAO,OAAO,KAAK,YAAY,MAAM,SAAS;AAEhD,QAAO;;AAGT,SAAS,YAAY,UAAkB,OAAuC;AAE5E,QAAO,GAAG,SAAS,MADL,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,MAAM,WAAW,KAAK,KAAK,IAAI,MAAM,GACjD,CAAC,KAAK,KAAK,CAAC;;AAG5C,SAAS,MAAM,OAAe,KAAa,KAAqB;AAC9D,KAAI,OAAO,MAAM,MAAM,CAAE,QAAO;AAChC,QAAO,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,CAAC;;AAU5C,IAAI;AACJ,SAAS,oBAA+C;AACtD,KAAI,OAAO,kBAAkB,YAAa,QAAO,KAAA;AACjD,KAAI,CAAC,gBAAgB;EACnB,MAAM,YAAY,UACf,WAAW,gBAAgB,MAAM,uCAAqC,CACtE,WAAW,gBAAgB,OAAO,gCAA8B;AACnE,mBAAiB,IAAI,eAAe;AACpC,iBAAe,YAAY,UAAU;;AAEvC,QAAO;;;;;;;AAQT,SAAgB,gBAAgB,YAA8B;CAC5D,MAAM,QAAQ,mBAAmB;AACjC,KAAI,CAAC,MAAO;CAEZ,MAAM,WAAqC,MAAM,QAAQ,WAAW,mBAAmB,GACnF,WAAW,qBACX,EAAE;AACN,KAAI,SAAS,SAAS,MAAM,CAAE;AAC9B,KAAI;AACF,aAAW,qBAAqB,CAAC,OAAO,GAAG,SAAS;SAC9C;;;;;;;;;;AAaV,SAAgB,oBACd,YACA,UACA,eACM;CACN,MAAM,MAAM,wBAAwB,UAAU,EAAE,eAAe,CAAC;AAChE,KAAI,OAAO,kBAAkB,YAC3B;CAEF,MAAM,QAAQ,IAAI,eAAe;AACjC,OAAM,YAAY,IAAI;CAGtB,MAAM,WAAY,WAA+D;AAEjF,YAAW,qBAAqB,CAAC,GADlB,WAAW,mBAAmB,QAAQ,MAAM,MAAM,SACvB,EAAE,MAAM;AACjD,YAA+D,iBAAiB;;;;;;;;;;;AAYnF,SAAgB,aAAa,UAA+C;CAC1E,MAAM,OAAO,UAAU,OAAO,QAAQ;AACtC,KAAI,SAAS,QAAS,QAAO;AAC7B,KAAI,SAAS,OAAQ,QAAO;AAC5B,KAAI,OAAO,eAAe,WACxB,QAAO,WAAW,gCAAgC,CAAC,UAAU,UAAU;AAEzE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AClRT,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;;;;;;;;AASxB,MAAa,0BACX;;;;;;;;;;;;;;;AAiBF,MAAM,6BAAa,IAAI,SAAyD;;;;;;AAOhF,SAAgB,aAAa,YAAwB,SAA0C;AAC7F,uBAAsB,YAAY,gBAAgB,QAAQ;;;;;;;;AAS5D,SAAgB,iBACd,YACA,OAAkC,yBAC5B;AACN,uBAAsB,YAAY,iBAAiB,KAAK;;AAG1D,SAAS,sBACP,YACA,QACA,MACM;CACN,MAAM,gBAAgB,WAAW,iBAAiB;CAElD,IAAI,WAAW,WAAW,IAAI,cAAc;AAC5C,KAAI,CAAC,UAAU;AACb,6BAAW,IAAI,KAAK;AACpB,aAAW,IAAI,eAAe,SAAS;;CAEzC,IAAI,UAAU,SAAS,IAAI,OAAO;AAClC,KAAI,CAAC,SAAS;AACZ,4BAAU,IAAI,KAAK;AACnB,WAAS,IAAI,QAAQ,QAAQ;;AAI/B,MAAK,MAAM,SAAS,QAAQ,MAAM,CAChC,KAAI,CAAC,MAAM,KAAK,YAAa,SAAQ,OAAO,MAAM;AAEpD,KAAI,MAAM;AAGR,UAAQ,OAAO,WAAW;AAC1B,UAAQ,IAAI,YAAY,KAAK;OAE7B,SAAQ,OAAO,WAAW;CAG5B,MAAM,YAAY,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,GAAG,GAAG,IAAI;CAKlD,MAAM,WAAW,cAAc,KAAK,cAA+B,QAAQ,SAAS;AACpF,KAAI,CAAC,WAAW;AACd,YAAU,QAAQ;AAClB;;AAEF,KAAI,CAAC,MAAM;AAIT,MAAI,YAAY,SAAS,SAAS,UAChC,UAAS,OAAO;AAElB;;CAEF,MAAM,OAAO,YAAY,cAAc,cAAc,OAAO;AAC5D,MAAK,KAAK;AACV,MAAK,MAAM;AACX,KAAI,KAAK,SAAS,UAChB,MAAK,OAAO;AAEd,KAAI,CAAC,SACH,eAAc,KAAK,YAAY,KAAK;;;;AC1HxC,MAAM,aAAa;AAEnB,IAAa,kBAAb,MAA2D;CACzD;CAEA;;CAGA;;CAGA,eAAkC;CAElC,aAA4C;CAI5C,SAAgC;CAEhC,YAAY,MAA8B;AACxC,OAAK,OAAO;AACZ,OAAK,cAAc,KAAK;;CAG1B,IAAI,QAAuB;AACzB,SAAO,KAAK;;CAGd,YAAY,UAAsC;AAChD,OAAK,WAAW;AAChB,OAAK,SAAS;;;;;;;;;CAUhB,kBAAkB,UAAiC,UAA2B;AAC5E,MAAI,KAAK,iBAAiB,YAAY,KAAK,iBAAiB,SAAU;AACtE,OAAK,eAAe;AACpB,OAAK,eAAe;AACpB,OAAK,SAAS;;CAGhB,gBAAsB;AACpB,OAAK,SAAS;;CAGhB,mBAAyB;AACvB,OAAK,QAAQ;;CAGf,UAAwB;EACtB,MAAM,OAAO,KAAK,gBAAgB,KAAK,UAAU,OAAO,QAAQ,KAAK;AACrE,MAAI,SAAS,QAAQ;AACnB,QAAK,QAAQ;AAIb,QAAK,OAAO,KAAK,YAAY,YAAY,QAAQ,UAAU,OAAO;AAClE;;AAEF,OAAK,QAAQ;AACb,OAAK,OAAO,SAAS,UAAU,UAAU,OAAO;;CAGlD,SAAuB;AACrB,MAAI,KAAK,cAAc,OAAO,eAAe,WAAY;AACzD,OAAK,aAAa,WAAW,WAAW;AACxC,OAAK,WAAW,iBAAiB,UAAU,KAAK,cAAc;;CAGhE,SAAuB;AACrB,MAAI,CAAC,KAAK,WAAY;AACtB,OAAK,WAAW,oBAAoB,UAAU,KAAK,cAAc;AACjE,OAAK,aAAa;;CAGpB,iBAAyB,UAAqC;AAG5D,OAAK,OAAO,MAAM,UAAU,SAAS,QAAQ;;CAG/C,OAAe,MAA2B;AACxC,MAAI,KAAK,WAAW,KAAM;AAC1B,OAAK,SAAS;AACd,OAAK,KAAK,eAAe;;;;;;;;;;;;;;;;;ACzF7B,IAAa,iBAAb,cAAoC,WAAW;8BASoC;KAA7B,UAAA;;;;;;4BAWS;KAAxB,QAAA;;;;;;qCAYX;KAAjB,iBAAA;;;;;;CAET,kBAAqC,IAAI,gBAAgB,KAAK;;;;;;;;;CAU9D,kBAA4B,UAAsC;AAGhE,OAAK,gBAAgB,kBACnB,KAAK,UAAU,KAAK,KAAA,IAAY,KAAK,OACrC,KAAK,YAAY,SAAS,SAAS,OACpC;EACD,MAAM,OAAO,KAAK;AAClB,MAAI,MAAM;AACR,mBAAgB,KAAK;AACrB,uBAAoB,MAAM,UAAU,KAAK,gBAAgB,MAAM;GAO/D,MAAM,gBAAgB,UAAU,YAAY;AAC5C,oBAAiB,MAAM,KAAK,YAAY,UAAU,CAAC,gBAAgB,KAAA,IAAY,KAAK;AACpF,gBAAa,MAAM,cAAc;;AAEnC,OAAK,QAAQ,QAAQ,KAAK,gBAAgB;AAC1C,OAAK,gBAAgB,mBAAmB,KAAK,gBAAgB,UAAU,OAAO;;;YAzD/E,SAAS;CAAE,MAAM;CAAQ,SAAS;CAAM,CAAC,CAAA,EAAA,eAAA,WAAA,WAAA,KAAA;YAWzC,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,eAAA,WAAA,SAAA,KAAA;YAW1B,SAAS;CAAE,MAAM;CAAS,SAAS;CAAM,WAAW;CAAmB,CAAC,CAAA,EAAA,eAAA,WAAA,kBAAA,KAAA;;;;;;;;;;;;AC1C3E,MAAa,iBAAiB;CAC5B,SAAS;CACT,UAAU;CACV,eAAe;CACf,UAAU;CACX;;;ACdD,IAAA,wBAAE;;;;ACoDF,SAAS,YAAY,IAA8B;AACjD,QAAO,OAAQ,GAA0B,cAAc;;AAoClD,IAAA,eAAA,MAAM,qBAAqB,eAAe;CAC/C,OAAgB,oBAAoC;EAClD,GAAG,WAAW;EACd,gBAAgB;EACjB;CAOD,OAAgB,SAAS,GAAG;;;;;;8BAW0C;KAAjC,UAAA;;;;;;+BAOmC;KAAX,WAAA;;;;;;;KAQpB,UAAA;;;;;;gCAOiC;KAAZ,YAAA;;;;;;gCAMY;KAAZ,YAAA;;;;;;0BAMnB;KAAN,MAAA;;;;;;oCAU+C;KAAhB,gBAAA;;;;;;mCAQa;KAAf,eAAA;;;;;;2BAOb;KAAP,OAAA;;;;;;;KAeL,UAAA;;;;;;+BAIkB;KAAjC,WAAA;;;;;;+BAEiC,KAAA;KAAjC,WAAA;;;;;;8BAEU;KAAV,UAAA;;;;;;mCAE8B;KAA9B,eAAA;;;;;;iCAEqC,EAAE;KAAvC,aAAA;;;;;;CAE1B,SAAgC;CAEhC,WAA4B,iBAAiB;;;;;CAM7C,sBAA+E;;;;;;;;;;;CAY/E,QAAgB;;;;;;CAOhB,gBAAwB;;CAGxB,iBAAkC,KAAK,WAAW,KAAK,KAAK;CAE5D,mBAA4D;EAC1D,MAAM,OAAO,MAAM,kBAAkB;AACrC,MAAI,gBAAgB,YAAY;GAI9B,MAAM,WAAqC,MAAM,QAAQ,KAAK,mBAAmB,GAC7E,KAAK,qBACL,EAAE;GACN,MAAM,QAAQ,IAAI,eAAe;AACjC,SAAM,YAAYC,sBAAgB;AAClC,QAAK,qBAAqB,CAAC,GAAG,UAAU,MAAM;AAC9C,QAAK,iBAAiB,YAAY,KAAK,gBAAiC;AAMxE,QAAK,iBAAiB,aAAa,KAAK,iBAAkC;AAC1E,QAAK,iBAAiB,cAAc,KAAK,mBAAoC;AAI7E,QAAK,iBAAiB,aAAa,KAAK,iBAAkC;AAC1E,QAAK,iBAAiB,SAAS,KAAK,sBAAuC;AAI3E,QAAK,iBAAiB,UAAU,KAAK,iBAAkC;AAIvE,QAAK,iBAAiB,qBAAqB,KAAK,oBAAqC;AAGrF,QAAK,iBAAiB,oBAAoB,KAAK,mBAAoC;;AAErF,SAAO;;CAGT,oBAAmC;AACjC,QAAM,mBAAmB;AACzB,MAAI,OAAO,WAAW,YACpB,QAAO,iBAAiB,YAAY,KAAK,eAAe;;CAI5D,uBAAsC;AACpC,QAAM,sBAAsB;AAC5B,MAAI,OAAO,WAAW,YACpB,QAAO,oBAAoB,YAAY,KAAK,eAAe;;;;;;;;;;;;CAc/D,eAAwC;AAGtC,uBAAqB,KAAK,KAAK,WAAW,CAAC;;;;;;;;;;;CAY7C,gBAAgC;EAK9B,MAAM,YAHJ,KAAK,SACJ,OAAO,cAAc,cAAc,UAAU,WAAW,QACxD,OAAO,aAAa,cAAc,SAAS,gBAAgB,OAAO,KAC/C,MAAM,IAAI,CAAC,MAAM,IAAI,aAAa;EACxD,MAAM,UAAU,eAAe,YAAY;EAC3C,MAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,OAAQ,QAAO;EAIpB,MAAM,SAAiB,EAAE,GAAG,SAAS;AACrC,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,CAC/C,KAAI,UAAU,KAAA,EAAW,QAAO,OAAO;AAEzC,SAAO;;CAGT,WAAoB,SAAqC;AACvD,MAAI,CAAC,KAAK,UAAU,QAAQ,IAAI,UAAU,IAAI,QAAQ,IAAI,OAAO,CAC/D,MAAK,SAAS,mBAAmB,EAAE,QAAQ,KAAK,eAAe,EAAE,CAAC;AAEpE,OAAK,kBAAkB,KAAK,SAAS;AACrC,OAAK,aAAa,aAAa,KAAK,UAAU,SAAS,QAAQ;;CAGjE,QAAiB,SAAqC;AAOpD,MAAI,KAAK,YAAY;AACnB,oBAAiB,KAAK,WAAW;AAGjC,qBAAkB,KAAK,WAAW;GAClC,MAAM,SAAS,KAAK,YAAY;AAChC,QAAK,MAAM,SAAS,KAAK,WAAW,iBAAiB,gBAAgB,EAAE;AACrE,UAAM,gBAAgB,eAAe,OAAO;AAI5C,UAAM,gBAAgB,wBAAwB,KAAK,eAAe;;AAKpE,QAAK,MAAM,QAAQ,KAAK,WAAW,iBAAiB,UAAU,CAC5D,MAAK,gBAAgB,wBAAwB,KAAK,eAAe;;EAGrE,MAAM,QAAQ;AACd,MAAI,CAAC,MAAM,IAAI,WAAW,CAAE;AAKvB,OAAK,uBAAuB,MAAM,IAAI,WAAW,IAAI,KAAK;;;;;;;;;;;;;;CAejE,MAAc,uBAAuB,UAAU,OAAsB;AACnE,QAAM,KAAK;EACX,MAAM,QAAQ,KAAK,YAAY,iBAC7B,8CACD;AACD,MAAI,MACF,OAAM,QAAQ,IAAI,MAAM,KAAK,MAAM,CAAC,KAAK,SAAS,KAAK,eAAe,CAAC;AAEzE,OAAK,qBAAqB;AAC1B,MAAI,CAAC,WAAW,KAAK,YAAY,OAC/B,MAAK,sBAAsB,WAAW,KAAK,YAAY,OAAO;;CAIlE,SAAkB;AAChB,MAAI,KAAK,aAOP,QAAO,IAAI;;;yCAGwB,KAAK,aAAa;;;;AAKvD,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAC1B,QAAO,IAAI;EAEb,MAAM,WAAW,KAAK,kBAAkB,KAAK,WAAW,KAAK,SAAS,MAAM,KAAK,OAAO,CAAC;AACzF,SAAO,IAAI;;;;kBAIG,KAAK,UAAU,SAAS,QAAQ;;QAE1C,WAAW,SAAS,CAAC;;;;;;;;;;;;;;;CAgB3B,kBAA0B,UAA0B;EAOlD,MAAM,SAAS;AACf,MAAI,OAAO,KAAK,SAAS,CAGvB,QAAO,SAAS,QAAQ,QAAQ,KAAK,sBAAsB,SAAS,CAAC;EAEvE,MAAM,OAAO,KAAK,sBAAsB,SAAS;AACjD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,SAAS,SAAS,mBAAmB,CACvC,QAAO,SAAS,QAAQ,oBAAoB,GAAG,KAAK,kBAAkB;AAExE,SAAO,WAAW;;;;;;;;;CAUpB,sBAA8B,YAAiC,UAAkB;EAC/E,MAAM,cAAc,KAAK,UAAU;EACnC,MAAM,OAAO,aAAa,iBAAiB;EAC3C,MAAM,SAAS,aAAa;AAC5B,MAAI,CAAC,QAAQ,CAAC,OACZ,QAAO;EAMT,MAAM,OAAO,SACT,+DAA+D,WAC7D,OAAO,OAAO,KAAK,CACpB,CAAC,IAAI,WAAW,OAAO,OAAO,MAAM,CAAC,CAAC,QACvC,sHAAsH,2BAA2B,CAAC;AAEtJ,SAAO,OADM,cAAc,WAAW,mBAAmB,GACtC,0DAA0D,KAAK;;;CAIpF,IAAY,eAA6B;AACvC,SAAO;GAAE,WAAW,KAAK;GAAW,WAAW,KAAK;GAAW,KAAK,KAAK;GAAK;;CAGhF,MAAc,YAA2B;AACvC,OAAK,UAAU;AACf,OAAK,eAAe;AACpB,MAAI;GAIF,MAAM,EAAE,SAAS,KAAK,QAAQ,WAAW,KAAK,SAAS,KAAK,cAAc,kBAAkB;GAC5F,IAAI;AACJ,OAAI,KAAK,aACP,QAAO,MAAM,eAAe,KAAK,KAAK,aAAa;QAC9C;AACL,QAAI,CAAC,IAAI,UACP,OAAM,IAAI,MACR,gJAED;AAEH,WAAO,MAAMC,UAAa,KAAK;KAC7B,YAAY,IAAI;KAChB,SAAS,KAAK;KACd,GAAI,KAAK,WAAW,EAAE,sBAAsB,KAAK,UAAU,GAAG,EAAE;KACjE,CAAC;;AAEJ,QAAK,cAAc,KAAK;AAKxB,QAAK,MAAM,qBAAqB,EAAE,MAAM,KAAK,MAAM,CAAC;WAC7C,OAAO;AACd,QAAK,qBAAqB,KAAK,2BAA2B,MAAM,CAAC;YACzD;AACR,QAAK,UAAU;;;;;;;;;CAUnB,2BAAmC,OAAyB;AAC1D,MAAI,CAAC,KAAK,YAAY,EAAE,iBAAiB,UAAW,QAAO;EAC3D,MAAM,OACJ,OAAO,MAAM,SAAS,YAAY,MAAM,SAAS,QAAQ,UAAU,MAAM,OACrE,OAAQ,MAAM,KAA2B,KAAK,GAC9C;AACN,MAAI,SAAS,oBACX,wBAAO,IAAI,MACT,8BAA8B,KAAK,SAAS,qJAG7C;AAEH,MAAI,SAAS,2BACX,wBAAO,IAAI,MACT,8BAA8B,KAAK,SAAS,2DACf,KAAK,QAAQ,IAC3C;AAEH,SAAO;;CAGT,cAAsB,MAA2B;AAE/C,OAAK,qBAAqB;AAC1B,OAAK,WAAW;EAChB,MAAM,EAAE,UAAU,WAAW,iBAAiB,KAAK,UAAU,EAC3D,iBAAiB,KAAK,cAAc,SAAS,QAC9C,CAAC;AACF,OAAK,WAAW;AAChB,OAAK,gBAAgB,YAAY,SAAS;AAC1C,MAAI,OAAO,SAAS,EAClB,SAAQ,KAAK,gDAAgD,OAAO;AAItE,OAAK,aAAa;GAAE,GAAG,qBAAqB,KAAK,KAAK;GAAE,GAAG,KAAK;GAAY;AAW5E,MAAI,OAAO,WAAW,aAAa;GACjC,MAAM,UAAU,QAAQ,KAAK,KAAK,SAAS,MAAM,MAAM,EAAE,SAAS,OAAO,CAAC;AAC1E,OAAI,WAAW,CAAC,KAAK,OAAO;AAI1B,YAAQ,UAAU;KAAE,GAAG,QAAQ;KAAO,IAAI;KAAM,EAAE,GAAG;AACrD,SAAK,QAAQ;cACJ,CAAC,WAAW,KAAK,OAAO;AACjC,SAAK,QAAQ;AAOb,QAAK,QAAQ,OAAmC,OAAO,MAAM;AAC3D,UAAK,gBAAgB;AACrB,aAAQ,MAAM;;;;AAKf,OAAK,kBAAkB,KAAK;;;;;;;;;;;;;;CAenC,MAAc,kBAAkB,UAAwC;EACtE,MAAM,WAAW,SAAS,KAAK;AAC/B,MAAI,CAAC,SAAU;AAEf,OAAK,MAAM,yBAAyB;GAClC;GACA,cAAc,SAAS;GACvB,eAAe,SAAS;GACxB,0BAA0B,SAAS;GACpC,CAAC;AAEF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,aAAa,cAAc,SAAS,cAAc;AACpD,UAAO,SAAS,OAAO,SAAS,aAAa;AAC7C;;EAGF,MAAM,eAAe,SAAS;AAC9B,MAAI,aAAa,UAAU,gBAAgB,KAAK,eAAe;AAC7D,QAAK,UAAU;AACf,OAAI;IACF,MAAM,EAAE,SAAS,KAAK,QAAQ,WAC5B,KAAK,SACL,KAAK,cACL,kBACD;AACD,UAAM,gBAAgB,KAAK,EAAE,eAAe,cAAc,EAAE,EAAE,YAAY,IAAI,WAAW,CAAC;AAC1F,WAAO,SAAS,OAAO,KAAK,cAAc;YACnC,OAAO;AACd,SAAK,qBAAqB,MAAM;aACxB;AACR,SAAK,UAAU;;;;CAKrB,WAAmB,MAAyB,QAAwB;EAClE,MAAM,eACJ,OAAO,KAAK,UAAU,oBAAoB,YAAY,KAAK,SAAS,gBAAgB,SAAS,IACzF,KAAK,SAAS,kBACd;EAMN,MAAM,YAAyB,KAAK,QAC/B,sBAAsB,KAAK,OAAO;GACjC,QAAQ,KAAK,eAAe;GAC5B,UAAU,KAAK,QAAQ;GAIvB,SAAS,KAAK,UAAU,EAAE,EAAE,KAAK,UAAU,MAAM,KAAK;GACvD,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,GAC/B,EAAE;EAMN,MAAM,SAAsB,KAAK,WAAW,KAAK,qBAAqB,EAAE,GAAG;EAE3E,MAAM,SAAS,KAAK,UAAU,EAAE;EAChC,MAAM,UAAU,KAAK,WAAW,EAAE;EAClC,MAAM,UAAyB;GAC7B,MAAM;IACJ,MAAM,KAAK;IACX,UAAU,KAAK;IACf,OAAO,KAAK,SAAS,EAAE;IACxB;GACD;GACA;GACA,OAAO,KAAK,SAAS,EAAE;GACvB,eAAe,KAAK,iBAAiB,EAAE;GAIvC,WAAW,KAAK,UAAU,OAAQ,KAAK,aAAa;GACpD,UAAU,EAAE;GACZ,UAAU,KAAK,gBAAgB;GAC/B;GACA,UAAU,KAAK,YAAY,EAAE;GAC7B,SAAS,KAAK;GACf;EAED,IAAI;AACJ,MAAI;AACF,OAAI,cAAc;IAChB,MAAM,WACJ,KAAK,qBAAqB,WAAW,eACjC,KAAK,oBAAoB,WACzB,OAAO,MAAM,aAAa;AAChC,SAAK,sBAAsB;KAAE,QAAQ;KAAc,UAAU;KAAU;AACvE,UAAM,OAAO,WAAW,UAAU,QAAQ;SAE1C,OAAM,OAAO,eAAe,eAAe,SAAS,QAAQ;WAEvD,OAAO;AACd,WAAQ,MAAM,yCAAyC,MAAM;AAC7D,OAAI;AACF,UAAM,OAAO,eAAe,eAAe,SAAS,QAAQ;WACtD;AACN,WAAO;;;EAIX,MAAM,UAAU,oBAAoB,KAAK,MAAM,KAAK,eAAe,CAAC;AACpE,SAAO,KAAK,SAAS,QAAQ;;;;;;;;;CAU/B,iBAA8C;EAC5C,MAAM,QAAQ,KAAK,WAAW,OAAO,MAAM;EAG3C,MAAM,UAAU,CAFF,KAAK,WAAW,YAAY,MAAM,EACjC,KAAK,WAAW,aAAa,MAAM,CACnB,CAAC,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC,MAAM;AAChE,MAAI,CAAC,SAAS,CAAC,QAAS,QAAO;AAC/B,SAAO;GACL,GAAI,QAAQ,EAAE,eAAe,OAAO,GAAG,EAAE;GACzC,GAAI,UAAU,EAAE,cAAc,SAAS,GAAG,QAAQ,EAAE,cAAc,OAAO,GAAG,EAAE;GAC/E;;;CAIH,aAAkC;EAChC,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,KAAM,QAAO,EAAE;AACpB,SAAO,MAAM,KAAK,KAAK,iBAA8B,SAAS,CAAC,CAAC,OAAO,YAAY;;CAGrF,sBAAoC;AAClC,OAAK,MAAM,QAAQ,KAAK,YAAY,EAAE;GACpC,MAAM,OAAO,KAAK,aAAa,OAAO;AACtC,OAAI,CAAC,KAAM;GACX,MAAM,OAAO,KAAK,WAAW;AAC7B,OAAI,SAAS,KAAA,KAAa,KAAK,cAAc,KAC3C,MAAK,YAAY;;;;;;;;;CAWvB,wBAA0C;EACxC,MAAM,yBAAS,IAAI,KAAqB;AACxC,OAAK,MAAM,QAAQ,KAAK,YAAY,EAAE;GACpC,MAAM,OAAO,KAAK,aAAa,OAAO;AACtC,OAAI,KAAM,QAAO,IAAI,MAAM,KAAK,UAAU;;EAE5C,MAAM,UAAoB,EAAE;AAC5B,OAAK,MAAM,SAAS,KAAK,UAAU,KAAK,UAAU,EAAE,EAAE;AAIpD,OAAI,MAAM,SAAS,WAAY;AAC/B,OAAI,MAAM,aAAa,OAAO,IAAI,MAAM,KAAK,IAAI,QAAQ,GACvD,SAAQ,KAAK,MAAM,KAAK;;AAG5B,SAAO;;;;;;;;;CAUT,qBAA6B,QAAiC;AAC5D,MAAI,CAAC,KAAK,SAAU;EACpB,MAAM,WAAW,OAAO,KAAK,SAAS,SAAS,KAAK,WAAW,CAAC,KAAK,KAAK;AAC1E,MAAI,KAAK,SAAS,KAAK,UAAU,SAAU;AAC3C,OAAK,qBAAqB;AAC1B,OAAK,WAAW;GACd,GAAG,KAAK;GACR,MAAM;IAAE,GAAG,KAAK,SAAS;IAAM,OAAO;IAAU;GACjD;;;;;;;;;;;CAYH,sBAAwD;EACtD,MAAM,0BAAU,IAAI,KAAqB;AACzC,OAAK,MAAM,QAAQ,KAAK,YAAY,EAAE;GACpC,MAAM,OAAO,KAAK,aAAa,OAAO;AACtC,OAAI,KAAM,SAAQ,IAAI,MAAM,KAAK,UAAU;;AAE7C,MAAI,QAAQ,OAAO,EACjB,MAAK,aAAa;GAAE,GAAG,KAAK;GAAY,GAAG,OAAO,YAAY,QAAQ;GAAE;EAE1E,MAAM,SAAmC,EAAE;AAC3C,OAAK,MAAM,KAAK,KAAK,UAAU,KAAK,UAAU,EAAE,EAAE;GAChD,MAAM,QAAQ,QAAQ,IAAI,EAAE,KAAK,IAAI;AAKrC,OAAI,EAAE,SAAS,YAAY;AACzB,WAAO,EAAE,QAAQ,UAAU;AAC3B;;AAYF,OAAI,EAAE,SAAS,YAAY,CAAC,qBAAqB,GAAG,MAAM,CAAE;AAC5D,UAAO,EAAE,QAAQ;;AAEnB,SAAO;;;;;;;;;;;;CAaT,qBAA6B;CAE7B,mBAA2B,UAA8D;AACvF,MAAI,CAAC,MAAM,OAAQ;EACnB,MAAM,EAAE,MAAM,UAAU,MAAM;AAC9B,MAAI,CAAC,KAAM;AACX,OAAK,aAAa;GAAE,GAAG,KAAK;IAAa,OAAO;GAAO;AACvD,OAAK,sBAAsB,MAAM,MAAM;AACvC,OAAK,iBAAiB,KAAK;AAC3B,OAAK,MAAM,sBAAsB;GAAE;GAAM;GAAO,CAAC;;;;;;;;;;;;CAanD,oBAA4B,UAAgD;EAC1E,MAAM,OAAO,MAAM,QAAQ;AAC3B,MAAI,CAAC,KAAM;EACX,MAAM,OAAO,MAAM;AACnB,MAAI,gBAAgB,eAAe,YAAY,KAAK,CAClD,MAAK,aAAa;GAAE,GAAG,KAAK;IAAa,OAAO,KAAK;GAAW;AAElE,OAAK,iBAAiB,KAAK;;;CAI7B,sBAA8B,UAAuB;AAEnD,MADe,MAAM,QACT,UAAU,+BAA+B,CACnD,MAAK,qBAAqB;;;;;;;;CAU9B,iBAAyB,WAAyB;AAChD,MAAI,CAAC,KAAK,UAAU,KAAK,MAAO;EAChC,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,KAAM;AACX,MAAI,CAAC,KAAK,oBAAoB;AAC5B,QAAK,qBAAqB;AAC1B,QAAK,MAAM,SAAS,KAAK,iBAAiB,+BAA+B,CACvE,OAAM,QAAQ;;AAKlB,OAAK,MAAM,SAAS,KAAK,iBACvB,WACD,EAAE;AACD,OAAI,MAAM,aAAa,OAAO,KAAK,aAAa,CAAC,MAAM,QAAS;AAChE,SAAM,UAAU;AAChB,SAAM,QAAQ;;;;CAKlB,sBAA8B,MAAc,OAAqB;AAC/D,OAAK,MAAM,QAAQ,KAAK,YAAY,CAClC,KAAI,KAAK,aAAa,OAAO,KAAK,QAAQ,KAAK,cAAc,MAC3D,MAAK,YAAY;;CAKvB,oBAA4B,UAAwD;AAClF,MAAI,KAAK,QAAS;AACb,OAAK,OAAO,MAAM,QAAQ,UAAU,KAAK;;;CAIhD,yBAAiC,UAAuB;EACtD,MAAM,SAAU,MAAM,QAA+B,QAAqB,gBAAgB;AAC1F,MAAI,CAAC,UAAU,OAAO,QAAQ,YAAY,IAAI,KAAK,QAAS;EAC5D,MAAM,SAAS,OAAO,aAAa,cAAc;AACjD,MAAI,CAAC,OAAQ;AACb,QAAM,gBAAgB;AACjB,OAAK,OAAO,OAAO;;CAG1B,oBAA4B,UAA6B;AAGvD,QAAM,gBAAgB;AACtB,MAAI,KAAK,QAAS;EAQlB,MAAM,UAAU,KAAK,uBAAuB;AAC5C,MAAI,QAAQ,SAAS,GAAG;AACtB,QAAK,qBAAqB,QAAQ;AAClC;;EAQF,MAAM,SAFY,MAAM,WACI,eAAe,SAAS,IAAI,QAC7B,KAAK,mBAAmB;AAC9C,OAAK,OAAO,OAAO;;;;;;;CAQ1B,uBACE,UACS;AACT,MAAI,KAAK,QAAS;EAClB,MAAM,EAAE,cAAc,QAAQ,UAAU,MAAM;AACzC,OAAK,OAAO,QAAQ;GACvB;GACA;GACA;GACD,CAAC;;;;;;;;;;;;;;;CAgBJ,sBACE,UAMS;AACT,MAAI,CAAC,KAAK,SAAU;EACpB,MAAM,EAAE,OAAO,SAAS,SAAS,WAAW,aAAa,MAAM;EAC/D,MAAM,WAAW,WACb,0BACA,UACE,4BACA;AACN,MAAI,KAAK,SAAS,KAAK,UAAU,SAAU;AAG3C,OAAK,qBAAqB;EAC1B,MAAM,EAAE,WAAW,UAAU,GAAG,yBAAyB,KAAK,SAAS;AACvE,OAAK,WAAW;GACd,GAAG,KAAK;GACR,MAAM;IAAE,GAAG;IAAsB,OAAO;IAAU;GACnD;AACD,UAAQ,KACN,oCAAoC,WAAW,cAAc,UAAU,cAAc,SAAS,IAAI,UACnG;;CAGH,oBAA2C;EACzC,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,KAAM,QAAO;AAIlB,UAFE,KAAK,cAAc,oDAAgD,IACnE,KAAK,cAAc,mCAAiC,GACtC,aAAa,SAAS,IAAI;;;;;;;;;CAU5C,sBAA8B,aAAa,OAAa;EACtD,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,KAAM;AAYX,GAXmB,aACf,KAAK,YAAY,GACjB,MAAM,KACJ,KAAK,iBAA8B,8CAA8C,CAClF,EACqB,MACvB,OACC,CAAC,GAAG,aAAa,WAAW,IAC5B,CAAC,GAAG,aAAa,SAAS,IAC1B,GAAG,aAAa,OAAO,KAAK,SAE1B,EAAE,OAAO;;CAGjB,MAAc,OACZ,QACA,mBACe;AACf,MAAI,CAAC,KAAK,YAAY,KAAK,QAAS;EACpC,MAAM,EAAE,IAAI,kBAAkB,KAAK;AACnC,OAAK,UAAU;AACf,MAAI;GAKF,MAAM,SAAS,KAAK,qBAAqB;GACzC,MAAM,OAA2B;IAC/B;IACA,QAAQ,UAAU;IAClB;IACA,GAAI,oBAAoB,EAAE,oBAAoB,mBAAmB,GAAG,EAAE;IACvE;GACD,MAAM,EAAE,QAAQ,WAAW,KAAK,SAAS,KAAK,cAAc,kBAAkB;GAC9E,MAAM,OAAO,MAAMC,WAAc,KAAK,IAAI,KAAK;AAC/C,QAAK,cAAc,KAAK;AACxB,QAAK,MAAM,qBAAqB,EAAE,MAAM,KAAK,MAAM,CAAC;WAC7C,OAAO;AACd,QAAK,qBAAqB,MAAM;YACxB;AACR,QAAK,UAAU;;;;;;;;;;;;;;;;;;;;;;;CAwBnB,WAAmB,OAA4B;AAC7C,MAAI,KAAK,eAAe;AACtB,QAAK,gBAAgB;AACrB;;AAGF,MAAI,KAAK,OAAO;AACd,OAAK,MAAM,OAAmC,OAAO,KAInD;AAGF,QAAK,QAAQ;GACb,MAAM,aAAa,KAAK,UAAU,MAAM,SAAS,MAAM,MAAM,EAAE,SAAS,OAAO;AAC/E,OAAI,YAAY;AACd,YAAQ,UAAU,EAAE,IAAI,MAAM,EAAE,GAAG;AACnC,SAAK,QAAQ;AACR,SAAK,OAAO,WAAW,KAAK;;AAEnC;;AAGF,MAAK,MAAM,OAAmC,OAAO,MAAM;AACzD,QAAK,gBAAgB;AACrB,WAAQ,MAAM;;;CAIlB,qBAA6B,OAAsB;EAGjD,MAAM,UACJ,iBAAiB,WACb,gBAAgB,MAAM,GACtB,iBAAiB,QACf,MAAM,UACN;AACR,OAAK,eAAe;AACpB,UAAQ,MAAM,mBAAmB,MAAM;AACvC,OAAK,MAAM,sBAAsB,EAAE,SAAS,CAAC;;;YAliC9C,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAO1B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAa,CAAC,CAAA,EAAA,aAAA,WAAA,YAAA,KAAA;YAQlD,SAAS,EAAE,WAAW,OAAO,CAAC,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAO9B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAc,CAAC,CAAA,EAAA,aAAA,WAAA,aAAA,KAAA;YAMnD,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAc,CAAC,CAAA,EAAA,aAAA,WAAA,aAAA,KAAA;YAMnD,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,aAAA,WAAA,OAAA,KAAA;YAU1B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAoB,CAAC,CAAA,EAAA,aAAA,WAAA,iBAAA,KAAA;YAQzD,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAkB,CAAC,CAAA,EAAA,aAAA,WAAA,gBAAA,KAAA;YAOvD,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,aAAA,WAAA,QAAA,KAAA;YAe1B,SAAS,EAAE,WAAW,OAAO,CAAC,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAI9B,OAAO,CAAA,EAAA,aAAA,WAAA,YAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,YAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,WAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,gBAAA,KAAA;YAEP,OAAO,CAAA,EAAA,aAAA,WAAA,cAAA,KAAA;2BA7GT,cAAc,gBAAgB,CAAA,EAAA,aAAA;;;;;;;;AAokC/B,SAAS,qBAAqB,OAAoC,OAAwB;AACxF,QAAO,MAAM,YAAY,MAAM,SAAS,MAAM,IAAI;;AAGpD,SAAS,qBAAqB,MAAiD;CAC7E,MAAM,SAAiC,EAAE;AACzC,KAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,MAAK,MAAM,SAAS,KAAK,OACvB,QAAO,MAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAEvE,QAAO;;;;AC5nCF,IAAA,gBAAA,MAAM,sBAAsB,WAAW;CAC5C,OAAgB,SAAS,CACvB,gBACA,GAAG;;;;;;;;;;;;sBAYe,EAAE,MAAM,QAAQ;iBACrB,EAAE,MAAM,kBAAkB;;;;;;;;iCAQV,EAAE,OAAO,SAAS,KAAK,GAAG,EAAE,OAAO,OAAO,SAAS;;;UAG1E,mBAAmB;;;gCAGG,EAAE,MAAM,KAAK;;;;;2BAKlB,EAAE,QAAQ,KAAK;;;sBAGpB,EAAE,MAAM,QAAQ;4BACV,EAAE,MAAM,OAAO;yBAClB,EAAE,OAAO,GAAG;;;;;;;;;eAStB,EAAE,QAAQ,KAAK;mBACX,EAAE,QAAQ,KAAK;mCACC,EAAE,MAAM,OAAO;;;;;;;sBAO5B,EAAE,MAAM,QAAQ;iBACrB,EAAE,MAAM,kBAAkB;;;;;;;;;;;;;;iBAc1B,EAAE,MAAM,WAAW;;;;;;;iBAOnB,EAAE,MAAM,gBAAgB;;;;;;;;mBAQtB,EAAE,QAAQ,KAAK;;;;;;;eAOnB,EAAE,QAAQ,KAAK;;mBAEX,EAAE,QAAQ,KAAK,GAAG,EAAE,QAAQ,KAAK;yBAC3B,EAAE,OAAO,GAAG;iBACpB,EAAE,MAAM,YAAY;;;;;;yCAMI,EAAE,MAAM,YAAY;;;UAGnD,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBV,EAAE,QAAQ,KAAK,GAAG,EAAE,QAAQ,KAAK;;iBAEnC,EAAE,MAAM,YAAY;yCACI,EAAE,MAAM,YAAY;gCAC7B,EAAE,MAAM,OAAO;;MAG5C;;KAQwC,UAAA;;;;;;gCAOiC;KAAZ,YAAA;;;;;;gCAMY;KAAZ,YAAA;;;;;;0BAMnB;KAAN,MAAA;;;;;;qCAGiD;KAAjB,iBAAA;;;;;;4BASR;KAAxB,QAAA;;;;;;kCAEG;KAAd,cAAA;;;;;;mCAEe;KAAf,eAAA;;;;;;oCAEgB;KAAhB,gBAAA;;;;;;2BAEO;KAAP,OAAA;;;;;;8BAEU;KAAV,UAAA;;;;;;mCAEe;KAAf,eAAA;;;;;;CAK1B,eAAuB;CAKvB,kBAAsD;CAEtD,qBAAiD;CAKjD,oBAA4B;CAE5B,kBAAmC,IAAI,gBAAgB,KAAK;CAE5D,oBAAmC;AACjC,QAAM,mBAAmB;EAEzB,MAAM,OAAO,KAAK,cAAc,WAAW;AAC3C,MAAI,gBAAgB,qBAAqB;AACvC,QAAK,eAAe;AACpB,QAAK,kBAAkB;AAGvB,QAAK,iBAAiB;;AAGxB,WAAS,iBAAiB,SAAS,KAAK,oBAAoB;AAC5D,WAAS,iBAAiB,WAAW,KAAK,sBAAsB;AAEhE,OAAK,mBAAmB;;CAG1B,uBAAsC;AACpC,QAAM,sBAAsB;AAC5B,WAAS,oBAAoB,SAAS,KAAK,oBAAoB;AAC/D,WAAS,oBAAoB,WAAW,KAAK,sBAAsB;;CAGrE,aAA4B;AAI1B,OAAK,gBAAgB,kBAAkB,KAAK,UAAU,KAAK,KAAA,IAAY,KAAK,OAAO,OAAO;EAC1F,MAAM,OAAO,KAAK;AAClB,MAAI,QAAQ,CAAC,KAAK,cAAc;AAC9B,mBAAgB,KAAK;AACrB,uBAAoB,MAAM,KAAA,GAAW,KAAK,gBAAgB,MAAM;;AAElE,OAAK,QAAQ,QAAQ,KAAK,gBAAgB;AAC1C,OAAK,gBAAgB,mBAAmB,KAAK,gBAAgB,UAAU,OAAO;;CAGhF,UAAyB;AAGvB,OAAK,mBAAmB;;;CAI1B,IAAY,eAA6B;AACvC,SAAO;GAAE,WAAW,KAAK;GAAW,WAAW,KAAK;GAAW,KAAK,KAAK;GAAK;;;;;;;;;;CAWhF,oBAAkC;AAChC,MAAI,KAAK,kBAAmB;EAC5B,IAAI;AACJ,MAAI;AACF,IAAC,CAAE,OAAQ,WAAW,KAAK,SAAS,KAAK,cAAc,mBAAmB;UACpE;AACN;;AAEF,OAAK,oBAAoB;AACpB,OAAK,aAAa,IAAI;;CAG7B,MAAc,aAAa,KAA0D;AACnF,MAAI;GACF,MAAM,UAAU,MAAMC,aAAW,IAAI;AACrC,QAAK,cAAc,QAAQ,QAAQ;AACnC,QAAK,eAAe,QAAQ,SAAS;AACrC,QAAK,gBAAgB,QAAQ,WAAW;UAClC,WAEE;AAER,QAAK,iBAAiB;;;CAI1B,IAAY,UAAkB;EAC5B,MAAM,SAAS,KAAK,eAAe,KAAK,gBAAgB,KAAK;AAC7D,SAAO,SAAS,OAAO,OAAO,EAAE,CAAC,aAAa,GAAG;;;;;;;;;;;;CAanD,kBAAgC;AAC9B,MAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,gBAAiB;EAEjD,MAAM,QAAQ,KAAK,gBAAgB,QAAQ,UAAU,KAAK;AAC1D,qBAAmB,OAAO,KAAK,aAAa,KAAK,cAAc,KAAK,QAAQ;EAE5E,MAAM,YAAY,SAAS,cAAc,OAAO;AAChD,YAAU,YAAY,MAAM;AAC5B,OAAK,oBAAoB,QAAQ;AACjC,OAAK,qBAAqB;AAC1B,OAAK,YAAY,UAAU;AAEX,YAAU,iBAA8B,2BACjD,CAAC,SAAS,OAAO;AACtB,MAAG,iBAAiB,UAAU,UAAU;AACtC,UAAM,gBAAgB;AACjB,SAAK,UAAU;KACpB;IACF;;CAGJ,uBAAwC,UAA4B;AAClE,MAAI,CAAC,KAAK,KAAM;AAChB,MAAI,MAAM,cAAc,CAAC,SAAS,KAAK,CAAE;AACzC,OAAK,OAAO;;CAGd,yBAA0C,UAA+B;AACvE,MAAI,CAAC,KAAK,KAAM;AAChB,MAAI,MAAM,QAAQ,SAAU;AAC5B,OAAK,OAAO;AACZ,OAAK,YAAY,cAAiC,WAAW,EAAE,OAAO;;CAGxE,aAA2B;AACzB,OAAK,OAAO,CAAC,KAAK;AAClB,OAAK,eAAe;;;;;;;;CAStB,MAAc,WAA0B;AACtC,OAAK,UAAU;AACf,OAAK,eAAe;AAEpB,MAAI;GACF,MAAM,EAAE,QAAQ,WAAW,KAAK,SAAS,KAAK,cAAc,mBAAmB;AAC/E,SAAMC,gBAAc,IAAI;WACjB,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAK,eAAe,WAAW;AAC/B,QAAK,UAAU;AACf;;AAGF,OAAK,OAAO;AACZ,OAAK,UAAU;AAEf,OAAK,MAAM,mBAAmB;GAAE,MAAM,KAAK;GAAa,OAAO,KAAK;GAAc,CAAC;AAEnF,MAAI,KAAK,kBAAkB,OAAO,WAAW,YAC3C,QAAO,SAAS,OAAO,KAAK;;CAIhC,mBAA2B,OAAoB;AAC7C,QAAM,gBAAgB;AACjB,OAAK,UAAU;;CAGtB,SAAkB;AAChB,MAAI,KAAK,aAIP,QAAO;AAGT,SAAO,IAAI;;;;qBAIM,KAAK,OAAO,oBAAoB,iBAAiB;wBAC9C,KAAK,OAAO,SAAS,QAAQ;;iBAEpC,KAAK,WAAW;;UAEvB,KAAK,QAAQ;;;QAGf,KAAK,OACH,IAAI;;;iEAGmD,KAAK,QAAQ;;;sBAGxD,KAAK,eAAe,KAAK,gBAAgB,KAAK,cAAc;;oBAE9D,KAAK,eAAe,KAAK,eACvB,IAAI,8BAA8B,KAAK,aAAa,UACpD,QAAQ;;;;;;;;8BAQA,KAAK,QAAQ;2BAChB,KAAK,mBAAmB;;oBAE/B,KAAK,UACH,IAAI,qDACJ,IAAI;;;;;;;;;;;;;;;;wBAgBF;0BACE,KAAK,UAAU,iBAAiB,WAAW;;;;gBAIrD,KAAK,eACH,IAAI,uCAAuC,KAAK,aAAa,UAC7D,QAAQ;;cAGhB,QAAQ;;;;YAlTf,SAAS,EAAE,WAAW,OAAO,CAAC,CAAA,EAAA,cAAA,WAAA,WAAA,KAAA;YAO9B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAc,CAAC,CAAA,EAAA,cAAA,WAAA,aAAA,KAAA;YAMnD,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAc,CAAC,CAAA,EAAA,cAAA,WAAA,aAAA,KAAA;YAMnD,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,cAAA,WAAA,OAAA,KAAA;YAG1B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAqB,CAAC,CAAA,EAAA,cAAA,WAAA,kBAAA,KAAA;YAS1D,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,cAAA,WAAA,SAAA,KAAA;YAE1B,OAAO,CAAA,EAAA,cAAA,WAAA,eAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,gBAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,iBAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,QAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,WAAA,KAAA;YAEP,OAAO,CAAA,EAAA,cAAA,WAAA,gBAAA,KAAA;4BAhMT,cAAc,iBAAiB,CAAA,EAAA,cAAA;;;;;;AAidhC,SAAS,mBACP,UACA,MACA,OACA,SACM;CACN,MAAM,SAAS,SAAS,iBAAiB,UAAU,WAAW,UAAU;CACxE,IAAI,OAAO,OAAO,UAAU;AAC5B,QAAO,MAAM;AACX,MAAI,KAAK,YACP,MAAK,cAAc,KAAK,YACrB,QAAQ,iBAAiB,KAAK,CAC9B,QAAQ,kBAAkB,MAAM,CAChC,QAAQ,oBAAoB,QAAQ;AAEzC,SAAO,OAAO,UAAU;;;;;ACrdrB,IAAA,iBAAA,MAAM,uBAAuB,eAAe;CACjD,OAAgB,SAAS,CACvB,gBACA,GAAG;;;;;;;uBAOgB,EAAE,KAAK,OAAO,QAAQ;;;;;iBAK5B,EAAE,MAAM,WAAW;;;;;uBAKb,EAAE,KAAK,OAAO,KAAK;;;;iBAIzB,EAAE,MAAM,gBAAgB;;;;;;;;iBAQxB,EAAE,MAAM,YAAY;;;;;;;;;;;;;;MAelC;;KAOwC,UAAA;;;;;;gCAGiC;KAAZ,YAAA;;;;;;gCAGY;KAAZ,YAAA;;;;;;0BAGnB;KAAN,MAAA;;;;;;qCAGiD;KAAjB,iBAAA;;;;;;8BAGtB;KAAV,UAAA;;;;;;kCAGyC;KAAd,cAAA;;;;;;kCAExB;KAAd,cAAA;;;;;;mCAEe;KAAf,eAAA;;;;;;oCAEgB;KAAhB,gBAAA;;;;;;8BAEU;KAAV,UAAA;;;;;;mCAEe;KAAf,eAAA;;;;;;CAK1B,oBAA4B;CAE5B,oBAAmC;AACjC,QAAM,mBAAmB;AACzB,OAAK,mBAAmB;;;CAI1B,IAAY,gBAAwB;AAClC,SAAO,KAAK,eAAe,KAAK,gBAAgB,KAAK;;CAGvD,aAA4B;AAG1B,OAAK,kBAAkB,KAAA,EAAU;;CAGnC,UAAyB;AACvB,OAAK,mBAAmB;;;CAI1B,IAAY,eAA6B;AACvC,SAAO;GAAE,WAAW,KAAK;GAAW,WAAW,KAAK;GAAW,KAAK,KAAK;GAAK;;;;;;;CAQhF,oBAAkC;AAChC,MAAI,KAAK,kBAAmB;EAC5B,IAAI;AACJ,MAAI;AACF,IAAC,CAAE,OAAQ,WAAW,KAAK,SAAS,KAAK,cAAc,oBAAoB;UACrE;AACN;;AAEF,OAAK,oBAAoB;AACpB,OAAK,cAAc,IAAI;;CAG9B,MAAc,cAAc,KAA0D;AACpF,MAAI;GACF,MAAM,UAAU,MAAMC,aAAW,IAAI;AACrC,QAAK,cAAc,QAAQ,QAAQ;AACnC,QAAK,eAAe,QAAQ,SAAS;AACrC,QAAK,gBAAgB,QAAQ,WAAW;UAClC;;;;;;;CAUV,MAAc,WAA0B;AACtC,OAAK,UAAU;AACf,OAAK,eAAe;AAEpB,MAAI;GACF,MAAM,EAAE,QAAQ,WAAW,KAAK,SAAS,KAAK,cAAc,oBAAoB;AAChF,SAAMC,gBAAc,IAAI;WACjB,OAAO;GACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAK,eAAe,WAAW;AAC/B,QAAK,UAAU;AACf;;AAGF,OAAK,UAAU;AACf,OAAK,MAAM,mBAAmB;GAAE,MAAM,KAAK;GAAa,OAAO,KAAK;GAAc,CAAC;AAEnF,MAAI,KAAK,kBAAkB,OAAO,WAAW,YAC3C,QAAO,SAAS,OAAO,KAAK,eAAe;;CAI/C,aAAqB,OAAoB;AACvC,QAAM,gBAAgB;AACjB,OAAK,UAAU;;CAGtB,SAAkB;AAIhB,SAAO,IAAI;oCACqB,KAAK,YAAY,OAAO;yCACnB,KAAK,eAAe;2CAClB,KAAK,iBAAiB,YAAY,GAAG;cAClE,KAAK,QAAQ;;YAEf,KAAK,gBACH,IAAI,WAAW,KAAK,iBAAiB,UAAU,SAAS;kBACpD,KAAK,cAAc;sBAEvB,QAAQ;;;;;;uBAMC,KAAK,QAAQ;;oBAEhB,KAAK,YAAY;yBACZ,KAAK,aAAa;;;YAG/B,KAAK,eACH,IAAI,iCAAiC,KAAK,aAAa,QACvD,QAAQ;;;;;;YApJnB,SAAS,EAAE,WAAW,OAAO,CAAC,CAAA,EAAA,eAAA,WAAA,WAAA,KAAA;YAG9B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAc,CAAC,CAAA,EAAA,eAAA,WAAA,aAAA,KAAA;YAGnD,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAc,CAAC,CAAA,EAAA,eAAA,WAAA,aAAA,KAAA;YAGnD,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,eAAA,WAAA,OAAA,KAAA;YAG1B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAqB,CAAC,CAAA,EAAA,eAAA,WAAA,kBAAA,KAAA;YAG1D,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAA,EAAA,eAAA,WAAA,WAAA,KAAA;YAG1B,SAAS;CAAE,MAAM;CAAQ,WAAW;CAAgB,CAAC,CAAA,EAAA,eAAA,WAAA,eAAA,KAAA;YAErD,OAAO,CAAA,EAAA,eAAA,WAAA,eAAA,KAAA;YAEP,OAAO,CAAA,EAAA,eAAA,WAAA,gBAAA,KAAA;YAEP,OAAO,CAAA,EAAA,eAAA,WAAA,iBAAA,KAAA;YAEP,OAAO,CAAA,EAAA,eAAA,WAAA,WAAA,KAAA;YAEP,OAAO,CAAA,EAAA,eAAA,WAAA,gBAAA,KAAA;6BAnFT,cAAc,kBAAkB,CAAA,EAAA,eAAA"}