nestjs-slightly-better-auth 1.0.0

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["keys.ACCESS_METADATA","keys.REQUIREMENTS_METADATA","keys.AUTH_INSTANCE_METADATA","keys.ACCEPT_PRINCIPALS_METADATA","keys.SKIP_DEFAULT_REQUIREMENTS_METADATA","keys.FRESHNESS_METADATA","keys.PRINCIPAL_PARAMS_METADATA","keys.FORWARD_COOKIES_METADATA","keys.SKIP_ORIGIN_CHECK_METADATA","keys.INVOCATION_PARAMS_METADATA","distance"],"sources":["../src/route-planner.ts","../src/authorization-evaluator.ts","../src/trusted-origins.ts","../src/bridge-client.ts","../src/bridge-protocol.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/boot-validator.ts","../src/hook-binder.ts","../src/auth-exchange.ts","../src/mount-coordinator.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/auth-core-module.ts","../src/session-principal.ts","../src/auth-service.ts","../src/http-transport.ts","../src/auth-module-definition.ts","../src/auth-module.ts"],"sourcesContent":["import type { ExecutionContext, Type } from \"@nestjs/common\";\nimport type { RequirementExpr, RoutePlan } from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport * as keys from \"./auth-tokens.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PolicyResolver } from \"./policy-resolver.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\nfunction classes(target: Type): object[] {\n  const result: object[] = [];\n  for (\n    let current: object | null = target;\n    current && current !== Function.prototype;\n    current = Object.getPrototypeOf(current)\n  ) {\n    result.push(current);\n  }\n  return result;\n}\nfunction own<T>(key: symbol, target: object): T | undefined {\n  return Reflect.getOwnMetadata(key, target);\n}\nfunction closest<T>(key: symbol, targets: readonly object[]): T | undefined {\n  for (const target of targets) {\n    const value = own<T>(key, target);\n    if (value !== undefined) {\n      return value;\n    }\n  }\n  return undefined;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function methodName(target: Type, handler: Function): string {\n  for (\n    let prototype = target.prototype;\n    prototype && prototype !== Object.prototype;\n    prototype = Object.getPrototypeOf(prototype)\n  ) {\n    for (const name of Object.getOwnPropertyNames(prototype)) {\n      if (\n        name !== \"constructor\" &&\n        Object.getOwnPropertyDescriptor(prototype, name)?.value === handler\n      ) {\n        return name;\n      }\n    }\n  }\n  throw new BetterAuthConfigurationError(\n    \"UNKNOWN_HANDLER\",\n    `Cannot locate handler on ${target.name}`,\n  );\n}\nexport class RoutePlanner {\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  private readonly cache = new WeakMap<Type, WeakMap<Function, RoutePlan>>();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly policies: PolicyResolver,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  private prepare(target: Type, method: string) {\n    // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n    const handler = Reflect.get(target.prototype, method) as Function;\n    if (typeof handler !== \"function\") {\n      throw new BetterAuthConfigurationError(\n        \"UNKNOWN_HANDLER\",\n        `${target.name}.${method} is not a handler`,\n      );\n    }\n    const chain = classes(target);\n    const nested =\n      this.transports.defaultAccessFor(target, method) === \"inherit\";\n    const levels = nested ? [handler] : [handler, ...chain];\n    const site = `${target.name}.${method}`;\n    for (const level of levels) {\n      const access = own<string>(keys.ACCESS_METADATA, level);\n      if (\n        (access === \"public\" || access === \"optional\") &&\n        (own<readonly RequirementExpr[]>(keys.REQUIREMENTS_METADATA, level)\n          ?.length ?? 0) > 0\n      ) {\n        throw new BetterAuthConfigurationError(\n          \"CONTRADICTORY_ACCESS\",\n          `${site} combines anonymous access and requirements at the same level`,\n        );\n      }\n    }\n    const instance =\n      closest<string>(keys.AUTH_INSTANCE_METADATA, [handler, ...chain]) ??\n      \"default\";\n    const entry = this.instances.get(instance);\n    let access: RoutePlan[\"access\"] = nested\n      ? \"inherit\"\n      : entry.options.defaultAccess === \"public\"\n        ? \"public\"\n        : \"required\";\n    for (const level of levels) {\n      const declared = own<RoutePlan[\"access\"]>(keys.ACCESS_METADATA, level);\n      if (declared) {\n        access = declared;\n        break;\n      }\n      if (\n        (own<readonly RequirementExpr[]>(keys.REQUIREMENTS_METADATA, level)\n          ?.length ?? 0) > 0 ||\n        (nested && own(keys.ACCEPT_PRINCIPALS_METADATA, level) !== undefined)\n      ) {\n        access = \"required\";\n        break;\n      }\n    }\n    const skips =\n      closest<boolean>(keys.SKIP_DEFAULT_REQUIREMENTS_METADATA, levels) ===\n      true;\n    const declaredRequirements =\n      access === \"required\"\n        ? [\n            ...(skips ? [] : (entry.options.defaultRequirements ?? [])).map(\n              (expression) => ({ expression, origin: \"defaultRequirements\" }),\n            ),\n            ...(nested\n              ? []\n              : [...chain].reverse().flatMap((level) =>\n                  (\n                    own<readonly RequirementExpr[]>(\n                      keys.REQUIREMENTS_METADATA,\n                      level,\n                    ) ?? []\n                  ).map((expression) => ({\n                    expression,\n                    origin: `${(level as Type).name} (class)`,\n                  })),\n                )),\n            ...(\n              own<readonly RequirementExpr[]>(\n                keys.REQUIREMENTS_METADATA,\n                handler,\n              ) ?? []\n            ).map((expression) => ({ expression, origin: `${site} (method)` })),\n          ]\n        : [];\n    const requirements = declaredRequirements.map((item) => item.expression);\n    return {\n      handler,\n      chain,\n      levels,\n      nested,\n      site,\n      instance,\n      entry,\n      access,\n      skips,\n      requirements,\n      declaredRequirements,\n    };\n  }\n\n  requirementsOf(target: Type, method: string): readonly RequirementExpr[] {\n    return Object.freeze(this.prepare(target, method).requirements);\n  }\n\n  forContext(context: ExecutionContext): RoutePlan {\n    try {\n      return this.plan(\n        context.getClass(),\n        methodName(context.getClass(), context.getHandler()),\n      );\n    } catch (error) {\n      if (isConfigurationError(error) && error.phase !== \"request\") {\n        throw BetterAuthConfigurationError.atRequest(error.code, error.detail, {\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n          hint: error.hint,\n        });\n      }\n      throw error;\n    }\n  }\n\n  plan(target: Type, method: string): RoutePlan {\n    // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n    const handler = Reflect.get(target.prototype, method) as Function;\n    let cache = this.cache.get(target);\n    const previous = cache?.get(handler);\n    if (previous) {\n      return previous;\n    }\n    const p = this.prepare(target, method);\n    const { entry, levels, chain } = p;\n    const allKinds = new Set<string>(\n      entry.sources.flatMap((source) => [...source.kinds]),\n    );\n    const accepts = new Set(\n      closest<readonly string[]>(keys.ACCEPT_PRINCIPALS_METADATA, levels) ??\n        entry.sources\n          .filter((source) => source.acceptance === \"default\")\n          .flatMap((source) => [...source.kinds]),\n    );\n    let fresh =\n      closest<boolean>(keys.FRESHNESS_METADATA, levels) === true ||\n      (entry.options.session !== false &&\n        entry.options.session?.freshness === \"authoritative\");\n    const admitted = (expression: RequirementExpr): Set<string> => {\n      if (\"anyOf\" in expression) {\n        return new Set(\n          expression.anyOf.flatMap((child) => [...admitted(child)]),\n        );\n      }\n      if (\"allOf\" in expression) {\n        return intersection(expression.allOf.map(admitted), allKinds);\n      }\n      const policy = this.policies.resolve(expression.policy);\n      const kinds = expression.principals ?? policy.requires?.principals;\n      if (expression.freshIdentity ?? policy.requires?.freshIdentity) {\n        fresh = true;\n      }\n      if (kinds) {\n        for (const kind of kinds) {\n          accepts.add(kind);\n        }\n      }\n      return new Set(\n        kinds ??\n          entry.sources\n            .filter((source) => !source.delegates)\n            .flatMap((source) => [...source.kinds]),\n      );\n    };\n    const permitted = p.requirements.map(admitted);\n    for (const kind of accepts) {\n      if (!allKinds.has(kind)) {\n        throw new BetterAuthConfigurationError(\n          \"UNKNOWN_PRINCIPAL_KIND\",\n          `${p.site} accepts unavailable principal kind ${kind}`,\n        );\n      }\n    }\n    const parameters =\n      own<readonly { index: number; kind?: string; reason?: string }[]>(\n        keys.PRINCIPAL_PARAMS_METADATA,\n        handler,\n      ) ?? [];\n    if (p.access === \"public\" && parameters.length) {\n      throw new BetterAuthConfigurationError(\n        \"PUBLIC_READS_PRINCIPAL\",\n        `${p.site} reads a principal on a public handler`,\n        \"Use OptionalAuth\",\n      );\n    }\n    const principalParams = parameters.flatMap((param) =>\n      param.kind ? [{ kind: param.kind, reason: param.reason! }] : [],\n    );\n    if (p.access !== \"inherit\") {\n      for (const param of principalParams) {\n        if ([...accepts].some((kind) => kind !== param.kind)) {\n          throw new BetterAuthConfigurationError(\n            \"PRINCIPAL_PARAM_CONFLICT\",\n            `${p.site} admits a kind rejected by its principal parameter`,\n            \"Use CurrentPrincipal and narrow kind\",\n          );\n        }\n      }\n    }\n    if (\n      p.access === \"required\" &&\n      !intersection([accepts, ...permitted], allKinds).size\n    ) {\n      const describe = (expression: RequirementExpr): string => {\n        if (\"anyOf\" in expression) {\n          return `anyOf(${expression.anyOf.map(describe).join(\", \")})`;\n        }\n        if (\"allOf\" in expression) {\n          return `allOf(${expression.allOf.map(describe).join(\", \")})`;\n        }\n        return expression.label ?? this.policies.resolve(expression.policy).id;\n      };\n      const declarations = p.declaredRequirements.map(\n        ({ expression, origin }) => `${origin}: ${describe(expression)}`,\n      );\n      throw new BetterAuthConfigurationError(\n        \"UNSATISFIABLE_PRINCIPAL_KINDS\",\n        `${p.site} has no eligible principal kind satisfying its requirements. Accepted kinds: ${[...accepts].join(\", \") || \"none\"}.${declarations.length ? ` Requirements: ${declarations.join(\"; \")}.` : \"\"}`,\n        p.declaredRequirements.some(\n          (item) => item.origin === \"defaultRequirements\",\n        )\n          ? \"Review the conflicting requirements; use @SkipDefaultRequirements() to explicitly opt this handler out of instance defaults.\"\n          : \"Review accepted kinds and requirement restrictions; configure a default source or explicitly accept a registered principal kind.\",\n      );\n    }\n    const forwardDirectCalls =\n      closest<boolean>(keys.FORWARD_COOKIES_METADATA, [handler, ...chain]) ??\n      entry.options.cookies?.forwardDirectCalls ??\n      false;\n    const originCheck =\n      closest<boolean>(keys.SKIP_ORIGIN_CHECK_METADATA, [handler, ...chain]) ||\n      entry.options.originCheck?.mode === \"off\"\n        ? \"off\"\n        : forwardDirectCalls\n          ? \"form\"\n          : \"cookie\";\n    const declares =\n      forwardDirectCalls ||\n      levels.some((level) => {\n        const access = own<string>(keys.ACCESS_METADATA, level);\n        return (\n          access === \"required\" ||\n          access === \"optional\" ||\n          [\n            keys.ACCEPT_PRINCIPALS_METADATA,\n            keys.REQUIREMENTS_METADATA,\n            keys.PRINCIPAL_PARAMS_METADATA,\n            keys.INVOCATION_PARAMS_METADATA,\n          ].some((key) => own(key, level) !== undefined)\n        );\n      });\n    const plan: RoutePlan = Object.freeze({\n      instance: p.instance,\n      access: p.access,\n      nested: p.nested,\n      site: p.site,\n      requirements: Object.freeze(p.requirements),\n      skipsDefaultRequirements: p.access === \"required\" && p.skips,\n      freshness: fresh ? \"authoritative\" : \"default\",\n      accepts,\n      principalParams: Object.freeze(principalParams),\n      originCheck,\n      sourceSet: JSON.stringify(\n        entry.sources.flatMap((source, index) =>\n          source.kinds.some((kind) => accepts.has(kind)) ? [index] : [],\n        ),\n      ),\n      forwardDirectCalls,\n      declares,\n    });\n    if (!cache) {\n      cache = new WeakMap();\n      this.cache.set(target, cache);\n    }\n    cache.set(handler, plan);\n    return plan;\n  }\n}\nfunction intersection(\n  sets: readonly ReadonlySet<string>[],\n  universe: ReadonlySet<string>,\n): Set<string> {\n  return new Set(\n    [...universe].filter((kind) => sets.every((set) => set.has(kind))),\n  );\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport type {\n  AuthorizationContext,\n  AuthorizationDecision,\n  AuthorizationPolicy,\n  PolicyInvoker,\n  PrincipalResolver,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport type {\n  AuthPrincipal,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { createInfrastructureError, isAuthFailure } from \"./auth-errors.js\";\nimport { INVOCATION_VALUES } from \"./auth-tokens.js\";\nimport type { InstanceEntry } from \"./instance-registry.js\";\nimport type { PolicyResolver } from \"./policy-resolver.js\";\nimport {\n  MemoKeys,\n  normalizeForRequest,\n  requestHeaders,\n} from \"./principal-resolver.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport { methodName } from \"./route-planner.js\";\n\nexport const allow = (): AuthorizationDecision => ({ effect: \"allow\" });\nexport const deny = (input: {\n  reason: string;\n  status?: 401 | 403;\n  message?: string;\n  challenge?: string;\n}): AuthorizationDecision => ({ effect: \"deny\", ...input });\nexport function definePolicy<P, K extends PrincipalKind = PrincipalKind>(\n  policy: AuthorizationPolicy<P, PrincipalOfKind<K>>,\n): (params: P, options?: RequirementOptions) => Requirement<P> {\n  return (params, options) => ({ policy, params, ...options });\n}\nexport class DefaultPolicyInvoker implements PolicyInvoker {\n  async invoke<P>(\n    policy: AuthorizationPolicy<P, any>,\n    params: P,\n    context: AuthorizationContext,\n  ): Promise<AuthorizationDecision> {\n    return policy.evaluate(params, context);\n  }\n}\nexport class AuthorizationEvaluator {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly policies: PolicyResolver,\n    private readonly invoker: PolicyInvoker,\n    private readonly resolver: PrincipalResolver,\n    private readonly scope: RequestScope,\n  ) {}\n\n  async evaluate(\n    plan: RoutePlan,\n    principal: AuthPrincipal,\n    call: TransportCall,\n    entry: InstanceEntry,\n    execution: ExecutionContext,\n    transport: string,\n  ): Promise<AuthorizationDecision> {\n    if (!plan.requirements.length) {\n      return allow();\n    }\n    const headers = requestHeaders(call, entry);\n    const context: AuthorizationContext = {\n      principal,\n      instance: entry.name,\n      transport,\n      headers,\n      cookies: call.cookies,\n      request: call.request,\n      param: (name) => call.param(name),\n      handler: {\n        class: execution.getClass(),\n        method: methodName(execution.getClass(), execution.getHandler()),\n      },\n      auth: entry.handle,\n      execution,\n      memo: <T>(\n        key: string | object | symbol,\n        fn: () => Promise<T>,\n      ): Promise<T> =>\n        this.scope.memoPolicyIo(\n          call.key,\n          entry.name,\n          this.keys.key(call.key, \"policy-io\", key),\n          fn,\n          entry.options.limits?.maxAuthorizationCallsPerRequest,\n        ),\n      provide: (slot, value) => {\n        this.scope\n          .stateFor(call.invocation)\n          .values.set(this.scope.valueKey(entry.name, slot), value);\n        let instances = Reflect.get(call.invocation, INVOCATION_VALUES) as\n          | Map<string, Map<symbol, unknown>>\n          | undefined;\n        if (!instances) {\n          instances = new Map();\n          Object.defineProperty(call.invocation, INVOCATION_VALUES, {\n            value: instances,\n          });\n        }\n        let values = instances.get(entry.name);\n        if (!values) {\n          values = new Map();\n          instances.set(entry.name, values);\n        }\n        values.set(slot, value);\n      },\n    };\n    const evaluate = (\n      expression: RequirementExpr,\n    ): Promise<AuthorizationDecision> =>\n      this.scope.memoDecision(\n        call.invocation,\n        entry.name,\n        this.keys.key(call.invocation, \"decision\", expression),\n        async () => {\n          if (\"anyOf\" in expression || \"allOf\" in expression) {\n            const disjunction = \"anyOf\" in expression;\n            const children =\n              \"anyOf\" in expression ? expression.anyOf : expression.allOf;\n            const denials: Extract<\n              AuthorizationDecision,\n              { effect: \"deny\" }\n            >[] = [];\n            for (const child of children) {\n              const decision = await evaluate(child);\n              if (decision.effect === \"allow\" && disjunction) {\n                return decision;\n              }\n              if (decision.effect === \"deny\") {\n                if (!disjunction) {\n                  return decision;\n                }\n                denials.push(decision);\n              }\n            }\n            if (!disjunction) {\n              return allow();\n            }\n            return deny({\n              reason: denials[0]?.reason ?? \"NO_REQUIREMENT_SATISFIED\",\n              status: denials.some((d) => d.status === 401) ? 401 : 403,\n              message: children\n                .map((child) =>\n                  \"policy\" in child\n                    ? (child.label ?? this.policies.resolve(child.policy).id)\n                    : \"requirement group\",\n                )\n                .join(\" or \"),\n            });\n          }\n          const policy = this.policies.resolve(expression.policy);\n          const kinds = expression.principals ?? policy.requires?.principals;\n          if (\n            (kinds && !kinds.includes(principal.kind)) ||\n            (!kinds && principal.delegation)\n          ) {\n            return deny({ reason: \"PRINCIPAL_NOT_SUPPORTED\" });\n          }\n          try {\n            return await entry.handle.run(\n              {\n                cookies: call.cookies,\n                forward: \"same-credential\",\n                inbound: () => headers,\n                internal: true,\n              },\n              () => this.invoker.invoke(policy, expression.params, context),\n            );\n          } catch (error) {\n            const normalized = normalizeForRequest(\n              error,\n              \"policy\",\n              plan.site,\n              entry,\n              headers,\n            );\n            if (isAuthFailure(normalized)) {\n              if (normalized.status === 429) {\n                throw normalized;\n              }\n              return deny({\n                status: normalized.status,\n                reason: normalized.reason ?? normalized.code,\n                message: normalized.message,\n                challenge: normalized.challenge,\n              });\n            }\n            const source = entry.sources.find(\n              (item) => item.id === principal.source && item.sessionBacked,\n            );\n            if (source) {\n              await this.scope.memoPolicyIo(\n                call.key,\n                entry.name,\n                JSON.stringify([\"reclassify\", source.id]),\n                async () => {\n                  const result = await this.resolver.resolve(call, {\n                    auth: entry.handle,\n                    freshness: \"authoritative\",\n                    accepts: plan.accepts,\n                    sourceSet: plan.sourceSet,\n                    reclassify: { sourceId: source.id },\n                  });\n                  if (result.outcome === \"authenticated\") {\n                    throw createInfrastructureError(normalized.sessionLoss, {\n                      headers,\n                      credentialHeaders: entry.credentialHeaders,\n                      exposeRawCause: entry.options.errors?.exposeRawCause,\n                    });\n                  }\n                  return result;\n                },\n                entry.options.limits?.maxAuthorizationCallsPerRequest,\n              );\n            }\n            return deny({\n              status: 401,\n              reason: normalized.reason ?? \"UNAUTHENTICATED\",\n            });\n          }\n        },\n      );\n    for (const expression of plan.requirements) {\n      const decision = await evaluate(expression);\n      if (decision.effect === \"deny\") {\n        return decision;\n      }\n    }\n    return allow();\n  }\n}\n","import type { AuthContextView } from \"./auth-contracts.js\";\n\n/** Auth route path exceptions never exempt application operations. */\nexport function originChecksDisabled(context: AuthContextView): boolean {\n  return (\n    context.skipCSRFCheck ||\n    (context.skipOriginCheck === true &&\n      context.options.advanced?.disableCSRFCheck === undefined)\n  );\n}\n\nexport class TrustedOrigins {\n  constructor(private readonly context: () => Promise<AuthContextView>) {}\n\n  async list(request?: Request): Promise<readonly string[]> {\n    const context = await this.context();\n    const configured = context.options.trustedOrigins;\n    const contributed =\n      typeof configured === \"function\" ? await configured(request) : configured;\n    const origins = new Set(context.trustedOrigins);\n    if (Array.isArray(contributed)) {\n      for (const origin of contributed) {\n        if (typeof origin === \"string\" && origin) {\n          origins.add(origin);\n        }\n      }\n    }\n    if (request && !context.options.baseURL && !context.baseURL) {\n      origins.add(new URL(request.url).origin);\n    }\n    return [...origins];\n  }\n\n  async isTrusted(origin: string, request?: Request): Promise<boolean> {\n    const [context, trustedOrigins] = await Promise.all([\n      this.context(),\n      this.list(request),\n    ]);\n    return context.isTrustedOrigin.call({ trustedOrigins }, origin, {\n      allowRelativePaths: false,\n    });\n  }\n}\n","import type {\n  AuthContextView,\n  AuthHandle,\n  ScopeInit,\n} from \"./auth-contracts.js\";\nimport type { AuthLike } from \"./auth-types.js\";\nimport type { BridgeBinding, ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceEntry } from \"./instance-registry.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport { TrustedOrigins } from \"./trusted-origins.js\";\n\n/** Preserve capabilities lazily; spreading a ScopeView can extract credentials. */\nexport function derivedScope(scope: RequestScope, init: ScopeInit): ScopeState {\n  const outer = scope.current();\n  const view: ScopeView = {\n    get cookies() {\n      return init.cookies;\n    },\n    get forward() {\n      return init.forward ?? \"same-credential\";\n    },\n    get inbound() {\n      return init.inbound;\n    },\n    get internal() {\n      return init.internal ?? false;\n    },\n    get browserHeaders() {\n      return outer?.view.browserHeaders;\n    },\n    get checkCallerSession() {\n      return outer?.view.checkCallerSession;\n    },\n  };\n  return {\n    view,\n    get call() {\n      return outer?.call;\n    },\n    get plan() {\n      return outer?.plan;\n    },\n    get reading() {\n      return outer?.reading;\n    },\n  };\n}\n\nexport function createAuthHandle(\n  name: string,\n  instance: AuthLike,\n  scope: RequestScope,\n  ready: () => InstanceEntry,\n): AuthHandle {\n  const context = (): Promise<AuthContextView> =>\n    instance.$context as Promise<AuthContextView>;\n  const trusted = new TrustedOrigins(context);\n  return {\n    name,\n    instance,\n    get api() {\n      return instance.api;\n    },\n    context,\n    async hasPlugin(id) {\n      return (await context()).hasPlugin(id);\n    },\n    run<T>(init: ScopeInit, fn: () => Promise<T>): Promise<T> {\n      return scope.run(derivedScope(scope, init), fn);\n    },\n    checkOrigin(browser, mode) {\n      return ready().origin.check(browser, mode);\n    },\n    producedByEndpoint(value) {\n      return ready().bridge.producedByEndpoint(value);\n    },\n    isTrustedOrigin(origin, request) {\n      return trusted.isTrusted(origin, request);\n    },\n  };\n}\n\nexport class BridgeClient {\n  readonly #registrations: { binding: BridgeBinding; close: () => void }[] = [];\n\n  bind(\n    entry: InstanceEntry,\n    binding: BridgeBinding,\n  ): { tookOverFrom?: string } {\n    const result = entry.bridge.bind(binding);\n    this.#registrations.push({ binding, close: result.close });\n    return result;\n  }\n\n  bootstrap(): void {\n    for (const { binding } of this.#registrations) {\n      binding.state = \"bootstrapped\";\n    }\n  }\n\n  close(): void {\n    for (const registration of this.#registrations) {\n      registration.close();\n    }\n    this.#registrations.length = 0;\n  }\n}\n","import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"nestjs-slightly-better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"nestjs-slightly-better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"nestjs-slightly-better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /** 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'. */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n","import type {\n  AuthContextView,\n  BrowserExposure,\n  OriginCheckOptions,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  BetterAuthConfigurationError,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { memoKey, RequestScope } from \"./request-scope.js\";\nimport { originChecksDisabled, TrustedOrigins } from \"./trusted-origins.js\";\n\nconst ORIGIN_PROOF = Symbol.for(\"nestjs-slightly-better-auth:origin-proof\");\nconst ORIGIN_CALCULATION_FAILURES = Symbol.for(\n  \"nestjs-slightly-better-auth:origin-calculation-failures\",\n);\n\nfunction diagnosticOrigin(headers: Headers): string {\n  const origin = headers.get(\"origin\");\n  const referer = headers.get(\"referer\");\n  let value = origin || referer || \"(missing)\";\n  if (!origin && referer) {\n    try {\n      value = new URL(referer).origin;\n    } catch {\n      value = \"(invalid referer)\";\n    }\n  }\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: Remove attacker-controlled log control characters.\n  return value.replace(/[\\u0000-\\u001f\\u007f]/g, \"\").slice(0, 100);\n}\n\n/** Bounded, per-application diagnostics; the next denial rolls the window without timers. */\nexport class OriginDiagnostics {\n  #openedAt: number | undefined;\n  readonly #pairs = new Set<string>();\n  readonly #further = new Map<string, number>();\n  readonly #origins = new Map<string, number>();\n\n  constructor(\n    private readonly logger: {\n      warn(message: string): void;\n      debug(message: string): void;\n    },\n  ) {}\n\n  record(\n    instance: string,\n    failure: AuthFailure,\n    headers: Headers,\n    trustedCount: number,\n  ): void {\n    const now = Date.now();\n    if (this.#openedAt !== undefined && now - this.#openedAt >= 3_600_000) {\n      this.logger.warn(\n        `Origin check window closed: further denials ${JSON.stringify([...this.#further])}; frequent origins ${JSON.stringify([...this.#origins].sort((a, b) => b[1] - a[1]).slice(0, 5))}`,\n      );\n      this.#pairs.clear();\n      this.#further.clear();\n      this.#origins.clear();\n      this.#openedAt = undefined;\n    }\n    this.#openedAt ??= now;\n    const origin = diagnosticOrigin(headers);\n    const reason = failure.reason ?? failure.code;\n    const pair = JSON.stringify([reason, origin]);\n    const message = `Origin check ${instance}: ${reason}, origin ${origin}, trusted origins ${trustedCount}. Add the origin to trustedOrigins or send Origin from non-browser clients.`;\n    if (!this.#pairs.has(pair) && this.#pairs.size < 100) {\n      this.#pairs.add(pair);\n      this.logger.warn(message);\n    } else {\n      this.#further.set(reason, (this.#further.get(reason) ?? 0) + 1);\n    }\n    if (this.#origins.has(origin) || this.#origins.size < 100) {\n      this.#origins.set(origin, (this.#origins.get(origin) ?? 0) + 1);\n    }\n    this.logger.debug(message);\n  }\n\n  advisoryFailure(\n    instance: string,\n    headers: Headers,\n    trustedCount: number,\n  ): void {\n    this.record(\n      instance,\n      AuthFailures.forbidden(\"ORIGIN_CHECK_UNAVAILABLE\"),\n      headers,\n      trustedCount,\n    );\n  }\n}\n\nexport interface OriginCheckInit {\n  readonly instance: string;\n  readonly context: AuthContextView;\n  readonly options?: OriginCheckOptions;\n  readonly diagnostics?: OriginDiagnostics;\n  readonly credentialHeaders?: readonly string[];\n  readonly exposeRawCause?: boolean;\n}\n\nexport class OriginCheck {\n  readonly #trusted: TrustedOrigins;\n  readonly #trustedCounts = new WeakMap<object, number>();\n\n  constructor(\n    private readonly scope: RequestScope,\n    private readonly init: OriginCheckInit,\n  ) {\n    this.#trusted = new TrustedOrigins(async () => init.context);\n  }\n\n  check(\n    browser: BrowserExposure,\n    mode: \"cookie\" | \"form\",\n  ): Promise<AuthFailure | null> {\n    const origins = this.scope.stateFor(browser.key).origins;\n    const key = memoKey(this.init.instance, mode);\n    const existing = origins.get(key);\n    if (existing) {\n      return existing;\n    }\n    let headers: Headers | undefined;\n    let calculationFailed = false;\n    const promise = Promise.resolve()\n      .then(async () => {\n        if (\n          this.init.options?.mode === \"off\" ||\n          originChecksDisabled(this.init.context)\n        ) {\n          return null;\n        }\n        headers = browser.headers();\n        const failure = await this.verdict(browser, headers, mode, () => {\n          calculationFailed = true;\n        });\n        if (failure) {\n          this.init.diagnostics?.record(\n            this.init.instance,\n            failure,\n            headers,\n            this.#trustedCounts.get(browser.key) ??\n              this.init.context.trustedOrigins.length,\n          );\n        } else {\n          // Cookie-free cookie mode does not establish evidence about an origin.\n          if (mode === \"form\" || headers.has(\"cookie\")) {\n            this.scope\n              .stateFor(browser.key)\n              .values.set(\n                this.scope.valueKey(this.init.instance, ORIGIN_PROOF),\n                true,\n              );\n          }\n        }\n        return failure;\n      })\n      .catch((error: unknown) => {\n        if (origins.get(key) === promise) {\n          origins.delete(key);\n        }\n        if (isConfigurationError(error)) {\n          throw error;\n        }\n        const failure = isInfrastructureError(error)\n          ? error\n          : createInfrastructureError(error, {\n              headers,\n              credentialHeaders: this.init.credentialHeaders,\n              exposeRawCause: this.init.exposeRawCause,\n            });\n        if (calculationFailed && headers) {\n          this.calculationFailures(browser).set(promise, headers);\n        }\n        throw failure;\n      });\n    origins.set(key, promise);\n    return promise;\n  }\n\n  async advisory(browser: BrowserExposure): Promise<void> {\n    const verdict = this.check(browser, \"cookie\");\n    try {\n      await verdict;\n    } catch (error) {\n      const headers = this.calculationFailures(browser).get(verdict);\n      if (!isInfrastructureError(error) || !headers) {\n        throw error;\n      }\n      // Only failed origin calculations are advisory. Logging reuses the successful extraction.\n      this.init.diagnostics?.advisoryFailure(\n        this.init.instance,\n        headers,\n        this.init.context.trustedOrigins.length,\n      );\n    }\n  }\n\n  assertCallerSession(\n    browser: BrowserExposure,\n    path: string,\n    instance: string,\n  ): void {\n    if (\n      instance === this.init.instance &&\n      (this.init.options?.mode === \"off\" ||\n        originChecksDisabled(this.init.context) ||\n        this.scope\n          .stateFor(browser.key)\n          .values.get(this.scope.valueKey(this.init.instance, ORIGIN_PROOF)) ===\n          true)\n    ) {\n      return;\n    }\n    throw BetterAuthConfigurationError.atRequest(\n      \"PUBLIC_HANDLER_USED_CALLER_SESSION\",\n      \"A direct caller-session call requires a passing origin verdict for this browser leg and instance\",\n      {\n        site: path,\n        hint: \"Guard the handler and pass its origin check before making this call.\",\n      },\n    );\n  }\n\n  private calculationFailures(\n    browser: BrowserExposure,\n  ): WeakMap<Promise<AuthFailure | null>, Headers> {\n    const values = this.scope.stateFor(browser.key).values;\n    const key = this.scope.valueKey(\n      this.init.instance,\n      ORIGIN_CALCULATION_FAILURES,\n    );\n    let failures = values.get(key) as\n      | WeakMap<Promise<AuthFailure | null>, Headers>\n      | undefined;\n    if (!failures) {\n      failures = new WeakMap();\n      values.set(key, failures);\n    }\n    return failures;\n  }\n\n  private async verdict(\n    browser: BrowserExposure,\n    headers: Headers,\n    mode: \"cookie\" | \"form\",\n    onCalculationFailure: () => void,\n  ): Promise<AuthFailure | null> {\n    if (!headers.has(\"cookie\")) {\n      if (mode === \"cookie\") {\n        return null;\n      }\n      const site = headers.get(\"sec-fetch-site\");\n      const navigation = headers.get(\"sec-fetch-mode\");\n      const metadata = [site, navigation, headers.get(\"sec-fetch-dest\")].some(\n        (value) => Boolean(value?.trim()),\n      );\n      if (metadata && site === \"cross-site\" && navigation === \"navigate\") {\n        return AuthFailures.forbidden(\"CROSS_SITE_NAVIGATION_LOGIN_BLOCKED\");\n      }\n      if (!metadata && !headers.get(\"origin\") && !headers.get(\"referer\")) {\n        return null;\n      }\n    }\n    const origin = headers.get(\"origin\");\n    const referer = headers.get(\"referer\");\n    const site = headers.get(\"sec-fetch-site\");\n    const value =\n      origin === \"null\" && site === \"same-origin\"\n        ? new URL(browser.url).origin\n        : origin || referer;\n    if (!value || value === \"null\") {\n      if (\n        this.init.options?.missingOrigin === \"allow-non-browser\" &&\n        !headers.has(\"origin\") &&\n        !headers.has(\"referer\") &&\n        !headers.has(\"sec-fetch-site\")\n      ) {\n        return null;\n      }\n      return AuthFailures.forbidden(\"MISSING_OR_NULL_ORIGIN\");\n    }\n    const request = new Request(browser.url, { headers });\n    const trustedOrigins = await this.#trusted\n      .list(request)\n      .catch((error: unknown) => {\n        onCalculationFailure();\n        throw error;\n      });\n    this.#trustedCounts.set(browser.key, trustedOrigins.length);\n    return this.init.context.isTrustedOrigin.call({ trustedOrigins }, value, {\n      allowRelativePaths: false,\n    })\n      ? null\n      : AuthFailures.forbidden(\"INVALID_ORIGIN\");\n  }\n}\n","import { Inject, Logger } from \"@nestjs/common\";\nimport type { AbstractHttpAdapter } from \"@nestjs/core\";\nimport type { InstanceWrapper } from \"@nestjs/core/injector/instance-wrapper.js\";\nimport type {\n  AuthContextView,\n  AuthHandle,\n  BetterAuthAppOptions,\n  BetterAuthRuntimeOptions,\n  BetterAuthStaticOptions,\n  PrincipalSource,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport { REQUEST_SCOPE } from \"./auth-tokens.js\";\nimport type { AuthLike } from \"./auth-types.js\";\nimport { createAuthHandle } from \"./bridge-client.js\";\nimport { BRIDGE_HANDLE, type BridgeHandle } from \"./bridge-protocol.js\";\nimport { OriginCheck, OriginDiagnostics } from \"./origin-check.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\n/** Nest considers transient providers static; auth collaborators require singleton trees. */\nexport function isSingletonDependencyTree(root: InstanceWrapper): boolean {\n  const pending = [root];\n  const seen = new Set<InstanceWrapper>();\n  while (pending.length) {\n    const wrapper = pending.pop()!;\n    if (seen.has(wrapper)) {\n      continue;\n    }\n    seen.add(wrapper);\n    if (wrapper.isTransient || !wrapper.isDependencyTreeStatic()) {\n      return false;\n    }\n    // useExisting aliases are constructor-injection edges to their real target.\n    for (const dependency of wrapper.getCtorMetadata() ?? []) {\n      if (dependency) {\n        pending.push(dependency);\n      }\n    }\n    for (const property of wrapper.getPropertiesMetadata() ?? []) {\n      pending.push(property.wrapper);\n    }\n    for (const enhancer of wrapper.getEnhancersMetadata() ?? []) {\n      pending.push(enhancer);\n    }\n  }\n  return true;\n}\n\nexport interface InstanceEntry {\n  readonly name: string;\n  readonly instance: AuthLike;\n  readonly options: BetterAuthRuntimeOptions<AuthLike>;\n  readonly staticOptions: BetterAuthStaticOptions;\n  readonly sources: readonly PrincipalSource[];\n  readonly handle: AuthHandle;\n  readonly context: AuthContextView;\n  readonly origin: OriginCheck;\n  readonly bridge: BridgeHandle;\n  readonly credentialHeaders: readonly string[];\n}\nexport interface InstanceLookup {\n  get(name: string): InstanceEntry;\n  list(): readonly InstanceEntry[];\n}\nexport interface InstanceRegistration {\n  readonly name: string;\n  readonly instance: AuthLike;\n  readonly options: BetterAuthRuntimeOptions<AuthLike>;\n  readonly staticOptions: BetterAuthStaticOptions;\n  readonly appOptions: BetterAuthAppOptions;\n  readonly sources: readonly PrincipalSource[];\n  readonly handle: AuthHandle;\n}\n\nexport function configurationIssue(\n  error: unknown,\n  code: string,\n  detail: string,\n): BetterAuthConfigurationError {\n  if (isConfigurationError(error)) {\n    return error;\n  }\n  const issue = new BetterAuthConfigurationError(code, detail);\n  Object.defineProperty(issue, \"cause\", { value: error });\n  return issue;\n}\n\nexport class InstanceRegistry implements InstanceLookup {\n  readonly #registrations: InstanceRegistration[] = [];\n  readonly #entries = new Map<string, InstanceEntry>();\n  readonly logger = new Logger(\"BetterAuth\");\n  readonly diagnostics = new OriginDiagnostics(this.logger);\n  state: \"new\" | \"initialized\" | \"bootstrapped\" = \"new\";\n  adapter: AbstractHttpAdapter | null = null;\n  owner = { description: \"Nest application\" };\n\n  constructor(@Inject(REQUEST_SCOPE) private readonly scope: RequestScope) {}\n\n  register(\n    options: BetterAuthRuntimeOptions<AuthLike>,\n    staticOptions: BetterAuthStaticOptions,\n    sources: readonly PrincipalSource[],\n    appOptions: BetterAuthAppOptions,\n  ): InstanceRegistration {\n    const name = staticOptions.name || \"default\";\n    const registration: InstanceRegistration = {\n      name,\n      options,\n      staticOptions,\n      sources,\n      appOptions,\n      instance: options.auth,\n      handle: createAuthHandle(name, options.auth, this.scope, () =>\n        this.get(name),\n      ),\n    };\n    this.#registrations.push(registration);\n    return registration;\n  }\n\n  registrations(): readonly InstanceRegistration[] {\n    return [...this.#registrations];\n  }\n\n  get(name: string): InstanceEntry {\n    const entry = this.#entries.get(name);\n    if (!entry) {\n      throw new BetterAuthConfigurationError(\n        \"UNKNOWN_INSTANCE\",\n        `Auth instance '${name}' is unknown or not initialized.`,\n        \"Register the instance once with BetterAuthModule.forRoot().\",\n      );\n    }\n    return entry;\n  }\n\n  list(): readonly InstanceEntry[] {\n    return [...this.#entries.values()];\n  }\n\n  begin(adapter: AbstractHttpAdapter | null): boolean {\n    if (this.state !== \"new\") {\n      if (this.adapter !== adapter) {\n        throw new BetterAuthConfigurationError(\n          \"LATE_HTTP_ADAPTER\",\n          \"Another application changed the active HTTP adapter.\",\n          \"Close the first application before creating another.\",\n        );\n      }\n      return false;\n    }\n    this.adapter = adapter;\n    this.state = \"initialized\";\n    this.owner = {\n      description: `Nest application ${globalThis.crypto.randomUUID()}`,\n    };\n    return true;\n  }\n\n  async initialize(issues: BetterAuthConfigurationError[]): Promise<void> {\n    this.#entries.clear();\n    const seen = new Set<string>();\n    const bridgeOwners = new Map<BridgeHandle, string>();\n    const shared = new Set<string>();\n    let globals = 0;\n    for (const registration of this.#registrations) {\n      const {\n        name,\n        instance,\n        options,\n        staticOptions,\n        appOptions,\n        sources,\n        handle,\n      } = registration;\n      if (seen.has(name)) {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"DUPLICATE_INSTANCE\",\n            `Instance '${name}' was registered more than once.`,\n            \"Import BetterAuthModule.forRoot() once per instance.\",\n          ),\n        );\n      }\n      seen.add(name);\n      if (staticOptions.globalGuard ?? name === \"default\") {\n        globals++;\n      }\n      if (\n        name !== \"default\" &&\n        (appOptions.platforms !== undefined ||\n          appOptions.transports !== undefined)\n      ) {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"APP_EXTENSIONS_ON_NAMED_INSTANCE\",\n            `Instance '${name}' declares app-wide extensions.`,\n            \"Declare platforms and transports on the default instance.\",\n          ),\n        );\n      }\n      if (\n        !instance ||\n        typeof instance.handler !== \"function\" ||\n        typeof instance.api?.getSession !== \"function\" ||\n        typeof instance.$context?.then !== \"function\"\n      ) {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"NOT_AN_AUTH_INSTANCE\",\n            `Instance '${name}' must be the object returned by betterAuth().`,\n          ),\n        );\n        continue;\n      }\n      let context: AuthContextView;\n      try {\n        context = (await instance.$context) as AuthContextView;\n      } catch (error) {\n        issues.push(\n          configurationIssue(\n            error,\n            \"AUTH_CONTEXT_FAILED\",\n            `Instance '${name}' failed to initialize its auth context.`,\n          ),\n        );\n        continue;\n      }\n      const plugin = context.getPlugin(\"nestjs-slightly-better-auth\");\n      const bridge =\n        plugin && typeof plugin === \"object\"\n          ? (Reflect.get(plugin, BRIDGE_HANDLE) as BridgeHandle | undefined)\n          : undefined;\n      if (!bridge) {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"PLUGIN_MISSING\",\n            `Instance '${name}' has no nestjs() bridge.`,\n            \"Add nestjs() as the LAST betterAuth plugins entry.\",\n          ),\n        );\n        continue;\n      }\n      if (bridge.protocol !== 4 || typeof bridge.bind !== \"function\") {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"PLUGIN_PROTOCOL_MISMATCH\",\n            `Instance '${name}' has bridge protocol ${bridge.protocol}; expected 4.`,\n            \"Align the module and plugin package versions.\",\n          ),\n        );\n        continue;\n      }\n      const previous = bridgeOwners.get(bridge);\n      if (previous !== undefined) {\n        shared.add(name);\n        shared.add(previous);\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"PLUGIN_SHARED_BETWEEN_INSTANCES\",\n            `'${previous}' and '${name}' share one plugin object.`,\n            \"Call nestjs() separately inside every betterAuth() construction.\",\n          ),\n        );\n      }\n      bridgeOwners.set(bridge, name);\n      const plugins = context.options.plugins ?? [];\n      const index = plugins.findIndex(\n        (value) => value.id === \"nestjs-slightly-better-auth\",\n      );\n      if (\n        index >= 0 &&\n        plugins.slice(index + 1).some((value) => value.hooks?.after?.length)\n      ) {\n        this.logger.warn(\n          `W_PLUGIN_NOT_LAST: '${name}': put nestjs() after plugins with after hooks.`,\n        );\n      }\n      const credentialHeaders = [\n        ...new Set(\n          sources\n            .flatMap((source) => source.credentialHeaders ?? [])\n            .map((value) => value.toLowerCase()),\n        ),\n      ];\n      this.#entries.set(name, {\n        name,\n        instance,\n        options,\n        staticOptions,\n        sources,\n        handle,\n        context,\n        bridge,\n        credentialHeaders,\n        origin: new OriginCheck(this.scope, {\n          instance: name,\n          context,\n          options: options.originCheck,\n          diagnostics: this.diagnostics,\n          credentialHeaders,\n          exposeRawCause: options.errors?.exposeRawCause,\n        }),\n      });\n    }\n    for (const name of shared) {\n      this.#entries.delete(name);\n    }\n    if (globals > 1) {\n      issues.push(\n        new BetterAuthConfigurationError(\n          \"DUPLICATE_GLOBAL_GUARD\",\n          \"More than one registration enables the global guard.\",\n          \"Enable globalGuard on only one instance.\",\n        ),\n      );\n    }\n    if (!seen.has(\"default\")) {\n      issues.push(\n        new BetterAuthConfigurationError(\n          \"NO_DEFAULT_INSTANCE\",\n          \"Named registrations require one default instance.\",\n          \"Add BetterAuthModule.forRoot({ auth }).\",\n        ),\n      );\n    }\n  }\n\n  reset(): void {\n    this.state = \"new\";\n    this.#entries.clear();\n  }\n}\n","import {\n  Controller,\n  Get,\n  Inject,\n  Logger,\n  RequestMethod,\n  UseGuards,\n  UseInterceptors,\n  VERSION_NEUTRAL,\n  VersioningType,\n  type Type,\n} from \"@nestjs/common\";\nimport {\n  ApplicationConfig,\n  DiscoveryService,\n  MetadataScanner,\n  ModuleRef,\n  ModulesContainer,\n  Reflector,\n} from \"@nestjs/core\";\nimport { RoutePathFactory } from \"@nestjs/core/router/route-path-factory.js\";\nimport type {\n  AdvisedHandler,\n  ApplicationRouteDescriptor,\n  AuthorizationPolicy,\n  AuthTransport,\n  BootAdviceContext,\n  ClaimOptions,\n  GuardReach,\n  Requirement,\n  RequirementExpr,\n  RoutePlan,\n} from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport {\n  ACCEPT_PRINCIPALS_METADATA,\n  ACCESS_METADATA,\n  AUTH_ENHANCER,\n  AUTH_INSTANCE_METADATA,\n  FORWARD_COOKIES_METADATA,\n  FRESHNESS_METADATA,\n  INSTANCE_REGISTRY,\n  INVOCATION_PARAMS_METADATA,\n  MOUNT_COORDINATOR,\n  POLICY_RESOLVER,\n  PRINCIPAL_PARAMS_METADATA,\n  REQUIREMENTS_METADATA,\n  ROUTE_PLANNER,\n  SKIP_ORIGIN_CHECK_METADATA,\n  SKIP_DEFAULT_REQUIREMENTS_METADATA,\n  TRANSPORT_REGISTRY,\n  USE_BETTER_AUTH_METADATA,\n} from \"./auth-tokens.js\";\nimport {\n  configurationIssue,\n  isSingletonDependencyTree,\n  type InstanceEntry,\n  type InstanceRegistry,\n} from \"./instance-registry.js\";\nimport type { MountCoordinator } from \"./mount-coordinator.js\";\nimport type { PolicyResolver } from \"./policy-resolver.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\ntype NestRoutePathMetadata = Parameters<RoutePathFactory[\"create\"]>[0];\n\ntype MetadataTarget = Parameters<\n  NonNullable<AuthTransport[\"defaultAccessFor\"]>\n>[0];\n\ninterface Site {\n  target: Type;\n  method: string;\n  handler: (...args: never[]) => unknown;\n}\ninterface PlannedSite extends Site {\n  plan: RoutePlan;\n}\ninterface HandlerClaim {\n  transport: AuthTransport;\n  target: MetadataTarget;\n  method: string | undefined;\n  reach: GuardReach;\n  options: ClaimOptions;\n}\nexport function requirementLeaves(\n  expressions: readonly RequirementExpr[],\n): Requirement[] {\n  return expressions.flatMap((expression) =>\n    \"anyOf\" in expression\n      ? requirementLeaves(expression.anyOf)\n      : \"allOf\" in expression\n        ? requirementLeaves(expression.allOf)\n        : [expression],\n  );\n}\nexport function productionMode(): boolean {\n  return ![\"development\", \"dev\", \"test\"].includes(process.env.NODE_ENV ?? \"\");\n}\nfunction ancestors(target: MetadataTarget): MetadataTarget[] {\n  const result: MetadataTarget[] = [];\n  for (\n    let current: unknown = target;\n    typeof current === \"function\" && current !== Function.prototype;\n    current = Object.getPrototypeOf(current)\n  ) {\n    result.push(current);\n  }\n  return result;\n}\nfunction domainsOverlap(a: string | undefined, b: string | undefined): boolean {\n  if (!a || !b) {\n    return true;\n  }\n  const left = a.replace(/^\\./, \"\").toLowerCase();\n  const right = b.replace(/^\\./, \"\").toLowerCase();\n  return (\n    left === right || left.endsWith(`.${right}`) || right.endsWith(`.${left}`)\n  );\n}\nfunction pathsOverlap(a = \"/\", b = \"/\"): boolean {\n  return (\n    a === b ||\n    a.startsWith(b.endsWith(\"/\") ? b : `${b}/`) ||\n    b.startsWith(a.endsWith(\"/\") ? a : `${a}/`)\n  );\n}\n\nfunction routeMayWarnAboutMount(path: string, basePath: string): boolean {\n  const route = path.toLowerCase().replace(/(?<!\\/)\\/+$/, \"\") || \"/\";\n  const base = basePath.toLowerCase().replace(/(?<!\\/)\\/+$/, \"\") || \"/\";\n  if (base === \"/\") {\n    return route.startsWith(\"/\");\n  }\n  if (route === base || route.startsWith(`${base}/`)) {\n    return true;\n  }\n  const marker = route.search(/[:*{]/);\n  if (marker === -1) {\n    return false;\n  }\n  const literal = route.slice(0, marker);\n  return base.startsWith(literal) || literal.startsWith(`${base}/`);\n}\n\nexport class BootValidator {\n  readonly logger = new Logger(\"BetterAuth\");\n  readonly #plans: PlannedSite[] = [];\n  readonly #claims: HandlerClaim[] = [];\n  #globalGuard = false;\n  #globalScope = false;\n\n  constructor(\n    @Inject(DiscoveryService) private readonly discovery: DiscoveryService,\n    @Inject(MetadataScanner) private readonly scanner: MetadataScanner,\n    @Inject(Reflector) private readonly reflector: Reflector,\n    @Inject(ModuleRef) private readonly moduleRef: ModuleRef,\n    @Inject(ApplicationConfig) private readonly appConfig: ApplicationConfig,\n    @Inject(INSTANCE_REGISTRY) private readonly instances: InstanceRegistry,\n    @Inject(ROUTE_PLANNER) private readonly planner: RoutePlanner,\n    @Inject(POLICY_RESOLVER) private readonly policies: PolicyResolver,\n    @Inject(TRANSPORT_REGISTRY) private readonly transports: TransportRegistry,\n    @Inject(MOUNT_COORDINATOR) private readonly mounts: MountCoordinator,\n  ) {}\n\n  private warn(code: string, message: string): void {\n    this.logger.warn(`${code}: ${message}`);\n  }\n\n  private sites(): Site[] {\n    const sites: Site[] = [];\n    const seen = new Map<Type, Set<string>>();\n    for (const wrapper of [\n      ...this.discovery.getControllers(),\n      ...this.discovery.getProviders(),\n    ]) {\n      if (\n        wrapper.isAlias ||\n        !wrapper.instance ||\n        (typeof wrapper.instance !== \"object\" &&\n          typeof wrapper.instance !== \"function\")\n      ) {\n        continue;\n      }\n      const prototype = Object.getPrototypeOf(wrapper.instance) as\n        | object\n        | null;\n      const target = prototype?.constructor as Type | undefined;\n      if (!prototype || !target || target === Object || target === Function) {\n        continue;\n      }\n      const methods = seen.get(target) ?? new Set<string>();\n      seen.set(target, methods);\n      for (const method of this.scanner.getAllMethodNames(prototype)) {\n        if (methods.has(method)) {\n          continue;\n        }\n        methods.add(method);\n        const handler = Reflect.get(prototype, method);\n        if (typeof handler === \"function\") {\n          sites.push({ target, method, handler });\n        }\n      }\n    }\n    return sites;\n  }\n\n  private singletonChecks(\n    issues: BetterAuthConfigurationError[],\n    references: readonly Requirement[],\n  ): void {\n    const refs = new Set(references.map((value) => value.policy));\n    for (const wrapper of this.discovery.getProviders()) {\n      const key =\n        typeof wrapper.token === \"symbol\"\n          ? Symbol.keyFor(wrapper.token)\n          : undefined;\n      if (\n        (key?.startsWith(\"nestjs-slightly-better-auth:ext:\") ||\n          refs.has(wrapper.token) ||\n          refs.has(wrapper.metatype as Type)) &&\n        !isSingletonDependencyTree(wrapper)\n      ) {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"NON_SINGLETON_EXTENSION\",\n            `Extension/policy '${String(wrapper.name)}' has a non-static dependency tree.`,\n            \"Use singleton extensions and singleton dependencies.\",\n          ),\n        );\n      }\n    }\n  }\n\n  private canaries(): void {\n    @Controller(\"coverage-probe\")\n    class Probe {\n      @Get(\"handler\") run() {}\n    }\n    if (\n      Reflect.getOwnMetadata(\"path\", Probe) !== \"coverage-probe\" ||\n      Reflect.getOwnMetadata(\"path\", Probe.prototype.run) !== \"handler\" ||\n      Reflect.getOwnMetadata(\"method\", Probe.prototype.run) !== 0\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"NEST_METADATA_KEY_CHANGED\",\n        \"Boot route checks cannot read Nest path/method metadata.\",\n      );\n    }\n    UseGuards(BetterAuthGuard)(Probe);\n    UseInterceptors(BetterAuthScopeInterceptor)(Probe);\n    if (\n      !(\n        Reflect.getOwnMetadata(\"__guards__\", Probe) as unknown[] | undefined\n      )?.includes(BetterAuthGuard) ||\n      !(\n        Reflect.getOwnMetadata(\"__interceptors__\", Probe) as\n          | unknown[]\n          | undefined\n      )?.includes(BetterAuthScopeInterceptor)\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"NEST_METADATA_KEY_CHANGED\",\n        \"Boot coverage cannot read Nest '__guards__' / '__interceptors__' metadata.\",\n        \"Use a compatible Nest version and report the metadata change.\",\n      );\n    }\n  }\n\n  private enhancer(value: unknown, kind: \"guard\" | \"scope\"): boolean {\n    const token =\n      kind === \"guard\" ? BetterAuthGuard : BetterAuthScopeInterceptor;\n    let actual: unknown;\n    try {\n      actual = this.moduleRef.get(token, { strict: false });\n    } catch {\n      actual = undefined;\n    }\n    if (value === token || (actual !== undefined && value === actual)) {\n      return true;\n    }\n    if (value && (typeof value === \"object\" || typeof value === \"function\")) {\n      const brand =\n        Reflect.get(value, AUTH_ENHANCER) ??\n        (typeof value === \"function\"\n          ? Reflect.get(value.prototype ?? {}, AUTH_ENHANCER)\n          : Reflect.get(Object.getPrototypeOf(value) ?? {}, AUTH_ENHANCER));\n      return (\n        brand === kind ||\n        (kind === \"scope\" && brand === \"interceptor\") ||\n        (typeof brand === \"object\" &&\n          brand !== null &&\n          Reflect.get(brand, kind) === true)\n      );\n    }\n    return false;\n  }\n\n  private local(\n    site: { target: MetadataTarget; method?: string },\n    kind: \"guard\" | \"scope\",\n  ): boolean {\n    const handler = site.method\n      ? (Reflect.get(site.target.prototype ?? {}, site.method) as\n          | object\n          | undefined)\n      : undefined;\n    const targets: object[] = [\n      ...ancestors(site.target),\n      ...(handler ? [handler] : []),\n    ];\n    if (\n      targets.some(\n        (target) =>\n          Reflect.getOwnMetadata(USE_BETTER_AUTH_METADATA, target) === true,\n      )\n    ) {\n      return true;\n    }\n    const key = kind === \"guard\" ? \"__guards__\" : \"__interceptors__\";\n    return targets.some((target) =>\n      ((Reflect.getOwnMetadata(key, target) ?? []) as unknown[]).some((value) =>\n        this.enhancer(value, kind),\n      ),\n    );\n  }\n\n  private trigger(target: object): boolean {\n    const access = Reflect.getOwnMetadata(ACCESS_METADATA, target) as unknown;\n    if (\n      access === \"required\" ||\n      access === \"optional\" ||\n      access === \"authenticated\"\n    ) {\n      return true;\n    }\n    return [\n      ACCEPT_PRINCIPALS_METADATA,\n      REQUIREMENTS_METADATA,\n      PRINCIPAL_PARAMS_METADATA,\n      INVOCATION_PARAMS_METADATA,\n      FORWARD_COOKIES_METADATA,\n      FRESHNESS_METADATA,\n      AUTH_INSTANCE_METADATA,\n      USE_BETTER_AUTH_METADATA,\n    ].some((key) => Reflect.hasOwnMetadata(key, target));\n  }\n\n  private coverage(\n    sites: readonly Site[],\n    issues: BetterAuthConfigurationError[],\n  ): void {\n    this.#globalGuard = [\n      ...this.appConfig.getGlobalGuards(),\n      ...this.appConfig\n        .getGlobalRequestGuards()\n        .map((wrapper) => wrapper.instance),\n    ].some((value) => this.enhancer(value, \"guard\"));\n    this.#globalScope = [\n      ...this.appConfig.getGlobalInterceptors(),\n      ...this.appConfig\n        .getGlobalRequestInterceptors()\n        .map((wrapper) => wrapper.instance),\n    ].some((value) => this.enhancer(value, \"scope\"));\n    for (const claim of this.#claims) {\n      let plan: RoutePlan | undefined;\n      try {\n        plan = claim.method\n          ? this.planner.plan(claim.target as Type, claim.method)\n          : undefined;\n      } catch {\n        continue;\n      }\n      const classEntry = this.instances\n        .list()\n        .find(\n          (entry) =>\n            entry.name ===\n            (Reflect.getMetadata(AUTH_INSTANCE_METADATA, claim.target) ??\n              \"default\"),\n        );\n      const classForwarding =\n        Reflect.getMetadata(FORWARD_COOKIES_METADATA, claim.target) ??\n        classEntry?.options.cookies?.forwardDirectCalls ??\n        false;\n      const classForm =\n        classForwarding &&\n        Reflect.getMetadata(SKIP_ORIGIN_CHECK_METADATA, claim.target) !==\n          true &&\n        classEntry?.options.originCheck?.mode !== \"off\";\n      const accessCovered = plan\n        ? (plan.access === \"public\" || plan.access === \"inherit\") &&\n          plan.originCheck !== \"form\"\n        : Reflect.getMetadata(ACCESS_METADATA, claim.target) === \"public\" &&\n          !classForm;\n      const localGuard = this.local(claim, \"guard\");\n      const localScope = this.local(claim, \"scope\");\n      const covered =\n        accessCovered ||\n        (claim.reach === \"global\" && (this.#globalGuard || localGuard)) ||\n        (claim.reach === \"explicit\" && localGuard && localScope);\n      const declares =\n        plan?.declares ??\n        ancestors(claim.target).some((target) => this.trigger(target));\n      if (\n        !covered &&\n        (claim.options.everyHandler || declares) &&\n        claim.options.coverage !== \"off\"\n      ) {\n        const message = `${claim.target.name}${claim.method ? `.${claim.method}` : \"\"} is not covered by the required auth enhancers.`;\n        if (claim.options.coverage === \"warn\") {\n          this.warn(claim.options.code, `${message} ${claim.options.hint}`);\n        } else {\n          issues.push(\n            new BetterAuthConfigurationError(\n              claim.options.code,\n              message,\n              claim.options.hint,\n            ),\n          );\n        }\n      }\n    }\n    for (const site of sites) {\n      const classClaims = this.#claims.filter(\n        (claim) => claim.target === site.target,\n      );\n      if (\n        classClaims.some(\n          (claim) => claim.method === undefined || claim.method === site.method,\n        )\n      ) {\n        continue;\n      }\n      if (\n        this.trigger(site.handler) ||\n        (!classClaims.length &&\n          ancestors(site.target).some((target) => this.trigger(target)))\n      ) {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"UNGUARDED_AUTH_METADATA\",\n            `${site.target.name}.${site.method} declares auth metadata but no transport claims it. Registered transports: ${this.transports\n              .list()\n              .map((value) => value.id)\n              .join(\", \")}.`,\n            \"Register a transport that claims this handler.\",\n          ),\n        );\n      }\n    }\n    if (!this.#globalScope) {\n      const affected = this.#claims.flatMap((claim) => {\n        if (this.local(claim, \"scope\")) {\n          return [];\n        }\n        const plan = this.#plans.find(\n          (site) =>\n            site.target === claim.target && site.method === claim.method,\n        )?.plan;\n        if (plan) {\n          return plan.declares\n            ? [{ claim, forwarding: plan.forwardDirectCalls }]\n            : [];\n        }\n        if (claim.method !== undefined) {\n          return [];\n        }\n        const entry = this.instances\n          .list()\n          .find(\n            (value) =>\n              value.name ===\n              (Reflect.getMetadata(AUTH_INSTANCE_METADATA, claim.target) ??\n                \"default\"),\n          );\n        const forwarding =\n          Reflect.getMetadata(FORWARD_COOKIES_METADATA, claim.target) ??\n          entry?.options.cookies?.forwardDirectCalls ??\n          false;\n        return forwarding ||\n          ancestors(claim.target).some((target) => this.trigger(target))\n          ? [{ claim, forwarding: Boolean(forwarding) }]\n          : [];\n      });\n      const seen = new Map<MetadataTarget, Set<string | undefined>>();\n      const uncovered = affected\n        .sort(\n          (left, right) => Number(right.forwarding) - Number(left.forwarding),\n        )\n        .filter(({ claim }) => {\n          const methods =\n            seen.get(claim.target) ?? new Set<string | undefined>();\n          seen.set(claim.target, methods);\n          if (methods.has(claim.method)) {\n            return false;\n          }\n          methods.add(claim.method);\n          return true;\n        })\n        .slice(0, 20)\n        .map(({ claim }) => `${claim.target.name}.${claim.method ?? \"*\"}`);\n      this.warn(\n        \"W_NO_GLOBAL_SCOPE\",\n        `BetterAuthScopeInterceptor is not global; unscoped direct auth.api calls have no origin proof, refresh suppression or cookie bridge. Enable globalScope or apply @UseBetterAuth(). ${uncovered.join(\", \")}`,\n      );\n    }\n  }\n\n  private entryChecks(\n    entry: InstanceEntry,\n    policies: readonly AuthorizationPolicy[],\n    issues: BetterAuthConfigurationError[],\n  ): void {\n    const { name, context, options, sources, bridge } = entry;\n    for (const unit of [...sources, ...policies]) {\n      for (const plugin of unit.requires?.plugins ?? []) {\n        if (!context.hasPlugin(plugin)) {\n          issues.push(\n            new BetterAuthConfigurationError(\n              \"PLUGIN_PREREQUISITE\",\n              `'${name}': '${unit.id}' requires the '${plugin}' plugin.`,\n              `Add the '${plugin}' Better Auth plugin.`,\n            ),\n          );\n        }\n      }\n    }\n    const base = context.options.baseURL;\n    const dynamic =\n      !!base && typeof base === \"object\" && \"allowedHosts\" in base;\n    if (dynamic && !(\"fallback\" in base && base.fallback)) {\n      const hostless = [\n        ...sources,\n        ...policies,\n        ...this.transports.list(),\n      ].filter((unit) => unit.requires?.hostlessCalls);\n      if (hostless.length) {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"DYNAMIC_BASE_URL_WITHOUT_FALLBACK\",\n            `'${name}': ${hostless.map((unit) => unit.id).join(\", \")} make hostless calls.`,\n            \"Add baseURL.fallback to the dynamic allowedHosts configuration.\",\n          ),\n        );\n      } else {\n        this.warn(\n          \"W_DYNAMIC_HOST\",\n          `'${name}': dynamic baseURL has no fallback; rejected hosts may make auth.handler throw.`,\n        );\n      }\n    }\n    const production = productionMode();\n    if (production && !context.baseURL && !dynamic) {\n      if (options.http?.allowRequestDerivedBaseURL) {\n        this.warn(\n          \"W_REQUEST_DERIVED_BASE_URL\",\n          `'${name}': requests choose the origin of token links and trusted origins.`,\n        );\n      } else {\n        issues.push(\n          new BetterAuthConfigurationError(\n            \"UNSAFE_BASE_URL\",\n            `'${name}' has no safe baseURL in production.`,\n            \"Set baseURL / BETTER_AUTH_URL, or dynamic baseURL.allowedHosts.\",\n          ),\n        );\n      }\n    }\n    if (\n      production &&\n      context.secret === \"better-auth-secret-12345678901234567890\"\n    ) {\n      issues.push(\n        new BetterAuthConfigurationError(\n          \"DEFAULT_SECRET\",\n          `'${name}' uses Better Auth's public default signing secret.`,\n          \"Set BETTER_AUTH_SECRET or betterAuth({ secret }).\",\n        ),\n      );\n    }\n    if (context.skipCSRFCheck || context.skipOriginCheck === true) {\n      const explicit = context.options.advanced;\n      const cause = `disableCSRFCheck=${String(explicit?.disableCSRFCheck)}, disableOriginCheck=${String(explicit?.disableOriginCheck)}; unset flags use Better Auth's import-time NODE_ENV/TEST defaults`;\n      const exception =\n        context.skipOriginCheck === true && explicit?.disableCSRFCheck === false\n          ? \"; disableCSRFCheck:false does not re-enable SDK origin checks; app-route checks remain on\"\n          : \"\";\n      this.warn(\n        \"W_ORIGIN_CHECK\",\n        `'${name}': resolved skipCSRFCheck=${context.skipCSRFCheck}, skipOriginCheck=${String(context.skipOriginCheck)} (${cause})${exception}.`,\n      );\n    }\n    if (\n      Array.isArray(context.skipOriginCheck) &&\n      context.skipOriginCheck.length\n    ) {\n      this.logger.log(\n        `I_AUTH_ORIGIN_PATH_SKIPS: '${name}': ${context.skipOriginCheck.join(\", \")}; app-route checks are unchanged.`,\n      );\n    }\n    if (production && options.originCheck?.mode === \"off\") {\n      this.warn(\n        \"W_ORIGIN_CHECK\",\n        `'${name}': application origin checks are disabled.`,\n      );\n    }\n    if (name === \"default\" && options.cookies?.forwardDirectCalls) {\n      this.warn(\n        \"W_FORWARD_DIRECT_CALLS\",\n        \"The default instance forwards same-credential direct-call cookies app-wide; every handler requires form-CSRF enforcement.\",\n      );\n    }\n    const proxy =\n      this.mounts.adapter &&\n      this.mounts.platform?.proxyTrust?.(this.mounts.adapter);\n    const ip = context.options.advanced?.ipAddress;\n    const role = context.rateLimit.enabled\n      ? \"rate-limit buckets and session IP\"\n      : \"session IP only (rate limiter disabled)\";\n    if (\n      production &&\n      bridge.clientIpHeader &&\n      ip?.ipAddressHeaders?.[0] !== bridge.clientIpHeader\n    ) {\n      this.warn(\n        \"W_CLIENT_IP\",\n        `'${name}': the bridge IP header is not first in effective ipAddressHeaders (${role}).`,\n      );\n    }\n    if (\n      production &&\n      !bridge.clientIpHeader &&\n      !ip?.ipAddressHeaders?.length &&\n      !ip?.trustedProxies?.length\n    ) {\n      this.warn(\n        \"W_CLIENT_IP\",\n        `'${name}': no bridge IP header or SDK IP configuration (${role}).`,\n      );\n    }\n    if (\n      production &&\n      bridge.clientIpHeader &&\n      ip?.trustedProxies?.length &&\n      proxy &&\n      proxy.mode === \"none\"\n    ) {\n      this.warn(\n        \"W_CLIENT_IP\",\n        `'${name}': SDK trustedProxies rechecks the socket IP without platform proxy trust (${role}); configure platform trust or set clientIpHeader:false.`,\n      );\n    }\n    if (production && proxy && proxy.mode === \"all\") {\n      this.warn(\n        \"W_PROXY_TRUST_ALL\",\n        `'${name}': the platform trusts every proxy; clients can choose ${role}.`,\n      );\n    }\n    if (\n      production &&\n      !context.rateLimit.enabled &&\n      context.options.rateLimit?.enabled === undefined\n    ) {\n      const contradiction =\n        process.env.NODE_ENV === \"production\"\n          ? \" while process.env.NODE_ENV is production; Better Auth imported before that value existed\"\n          : \"\";\n      this.warn(\n        \"W_RATE_LIMIT_DISABLED\",\n        `'${name}': better-auth resolved rateLimit.enabled=false${contradiction}. Set NODE_ENV=production before auth.ts is imported, rateLimit.enabled:true, or explicitly disable it when an edge proxy limits traffic.`,\n      );\n    }\n  }\n\n  private cookies(issues: BetterAuthConfigurationError[]): void {\n    const entries = this.instances.list();\n    for (let i = 0; i < entries.length; i++) {\n      for (const right of entries.slice(i + 1)) {\n        const left = entries[i]!;\n        for (const a of Object.values(left.context.authCookies)) {\n          for (const b of Object.values(right.context.authCookies)) {\n            if (\n              a.name === b.name &&\n              domainsOverlap(a.attributes.domain, b.attributes.domain) &&\n              pathsOverlap(a.attributes.path, b.attributes.path)\n            ) {\n              issues.push(\n                new BetterAuthConfigurationError(\n                  \"COOKIE_NAME_COLLISION\",\n                  `'${left.name}' and '${right.name}' both use cookie '${a.name}' on overlapping scopes.`,\n                  \"Set advanced.cookiePrefix on one instance.\",\n                ),\n              );\n            }\n          }\n        }\n      }\n    }\n  }\n\n  async validate(issues: BetterAuthConfigurationError[]): Promise<void> {\n    this.#plans.length = 0;\n    this.#claims.length = 0;\n    const sites = this.sites();\n    const candidates = new Map<MetadataTarget, Map<string, Site>>();\n    const prepared = new Set<Site>();\n    const compiled = new Map<Site, RoutePlan>();\n    const failures = new Map<Site, unknown>();\n    const reported = new Set<unknown>();\n    const references: Requirement[] = [];\n    const report = (error: unknown, detail: string): void => {\n      if (!reported.has(error)) {\n        reported.add(error);\n        issues.push(configurationIssue(error, \"UNRESOLVED_POLICY\", detail));\n      }\n    };\n    const candidate = (target: MetadataTarget, method: string): Site => {\n      let methods = candidates.get(target);\n      if (!methods) {\n        methods = new Map();\n        candidates.set(target, methods);\n      }\n      const existing = methods.get(method);\n      if (existing) {\n        return existing;\n      }\n      const handler = Reflect.get(target.prototype ?? {}, method);\n      if (typeof handler !== \"function\") {\n        throw new BetterAuthConfigurationError(\n          \"UNKNOWN_HANDLER\",\n          `${target.name}.${method} is not a handler.`,\n        );\n      }\n      const site = { target: target as Type, method, handler };\n      methods.set(method, site);\n      return site;\n    };\n    const prepare = (site: Site): void => {\n      if (failures.has(site)) {\n        throw failures.get(site);\n      }\n      if (prepared.has(site)) {\n        return;\n      }\n      try {\n        const leaves = requirementLeaves(\n          this.planner.requirementsOf(site.target, site.method),\n        );\n        references.push(...leaves);\n        for (const requirement of leaves) {\n          this.policies.resolve(requirement.policy);\n        }\n        prepared.add(site);\n      } catch (error) {\n        failures.set(site, error);\n        throw error;\n      }\n    };\n    const planOf = (target: MetadataTarget, method: string): RoutePlan => {\n      const site = candidate(target, method);\n      prepare(site);\n      const cached = compiled.get(site);\n      if (cached) {\n        return cached;\n      }\n      try {\n        const plan = this.planner.plan(site.target, site.method);\n        compiled.set(site, plan);\n        this.#plans.push({ ...site, plan });\n        return plan;\n      } catch (error) {\n        failures.set(site, error);\n        throw error;\n      }\n    };\n    // Discovery remains broad for unclaimed metadata. Only explicit method\n    // metadata and transport-identified handlers enter the planning population.\n    for (const site of sites) {\n      if (\n        this.trigger(site.handler) ||\n        [\n          ACCESS_METADATA,\n          FRESHNESS_METADATA,\n          SKIP_ORIGIN_CHECK_METADATA,\n          SKIP_DEFAULT_REQUIREMENTS_METADATA,\n        ].some((key) => Reflect.hasOwnMetadata(key, site.handler))\n      ) {\n        const selected = candidate(site.target, site.method);\n        try {\n          prepare(selected);\n        } catch (error) {\n          report(error, `Cannot prepare ${site.target.name}.${site.method}.`);\n        }\n      }\n    }\n    let canariesPassed = false;\n    try {\n      this.canaries();\n      canariesPassed = true;\n    } catch (error) {\n      issues.push(\n        configurationIssue(\n          error,\n          \"NEST_METADATA_KEY_CHANGED\",\n          \"Coverage metadata canaries failed.\",\n        ),\n      );\n    }\n    if (canariesPassed) {\n      for (const transport of this.transports.list()) {\n        try {\n          await transport.validate?.({\n            discovery: this.discovery,\n            reflector: this.reflector,\n            moduleRef: this.moduleRef,\n            hasHttpAdapter: this.mounts.adapter !== null,\n            // A transport may need the plan before claiming its handler. The\n            // same pre-resolution pass applies to that synchronous request.\n            planOf,\n            claim: (target, method, reach, options) => {\n              this.#claims.push({ transport, target, method, reach, options });\n              if (method !== undefined) {\n                candidate(target, method);\n              }\n            },\n            logger: this.logger,\n          });\n        } catch (error) {\n          if (!reported.has(error)) {\n            reported.add(error);\n            issues.push(\n              configurationIssue(\n                error,\n                \"TRANSPORT_VALIDATION_FAILED\",\n                `Transport '${transport.id}' failed validation.`,\n              ),\n            );\n          }\n        }\n      }\n    }\n    for (const methods of candidates.values()) {\n      for (const site of methods.values()) {\n        try {\n          prepare(site);\n        } catch (error) {\n          report(error, `Cannot prepare ${site.target.name}.${site.method}.`);\n        }\n      }\n    }\n    this.singletonChecks(issues, references);\n    for (const methods of candidates.values()) {\n      for (const site of methods.values()) {\n        try {\n          planOf(site.target, site.method);\n        } catch (error) {\n          report(error, `Cannot compile ${site.target.name}.${site.method}.`);\n        }\n      }\n    }\n    for (const site of this.#plans) {\n      try {\n        const entry = this.instances.get(site.plan.instance);\n        for (const requirement of requirementLeaves(site.plan.requirements)) {\n          await this.policies\n            .resolve(requirement.policy)\n            .validate?.(requirement.params, {\n              auth: entry.handle,\n              context: entry.context,\n              site: site.plan.site,\n            });\n        }\n      } catch (error) {\n        report(error, `Cannot validate ${site.target.name}.${site.method}.`);\n      }\n    }\n    if (canariesPassed) {\n      this.coverage(sites, issues);\n      const applicationRoutes: ApplicationRouteDescriptor[] = [];\n      const routePathFactory = new RoutePathFactory(this.appConfig);\n      const globalPrefix = this.appConfig.getGlobalPrefix();\n      const versioningOptions = this.appConfig.getVersioning();\n      const modules = this.moduleRef.get(ModulesContainer, { strict: false });\n      for (const wrapper of this.discovery.getControllers()) {\n        const target = wrapper.metatype;\n        if (!target?.prototype) {\n          continue;\n        }\n        const moduleType = wrapper.host?.metatype;\n        const modulePath = moduleType\n          ? (Reflect.getMetadata(\n              `__module_path__${modules.applicationId}`,\n              moduleType,\n            ) ?? Reflect.getMetadata(\"__module_path__\", moduleType))\n          : undefined;\n        const host = Reflect.getMetadata(\"host\", target) as unknown;\n        const controllerVersion = versioningOptions\n          ? (Reflect.getMetadata(\"__version__\", target) ??\n            versioningOptions.defaultVersion)\n          : undefined;\n        const rawPrefixes = Reflect.getMetadata(\"path\", target) as\n          | string\n          | string[]\n          | undefined;\n        const prefixes = Array.isArray(rawPrefixes)\n          ? rawPrefixes\n          : [rawPrefixes ?? \"\"];\n        for (const method of this.scanner.getAllMethodNames(target.prototype)) {\n          const handler = Reflect.get(target.prototype, method);\n          const rawPaths = Reflect.getMetadata(\"path\", handler) as\n            | string\n            | string[]\n            | undefined;\n          const requestMethod = Reflect.getMetadata(\"method\", handler) as\n            | RequestMethod\n            | undefined;\n          if (rawPaths === undefined || requestMethod === undefined) {\n            continue;\n          }\n          const methodVersion = Reflect.getMetadata(\n            \"__version__\",\n            handler,\n          ) as NestRoutePathMetadata[\"methodVersion\"];\n          const effectiveVersion = methodVersion ?? controllerVersion;\n          const conditions: (\"host\" | \"version\")[] = [];\n          if (host !== undefined) {\n            conditions.push(\"host\");\n          }\n          if (\n            versioningOptions &&\n            versioningOptions.type !== VersioningType.URI &&\n            effectiveVersion !== undefined &&\n            effectiveVersion !== VERSION_NEUTRAL\n          ) {\n            conditions.push(\"version\");\n          }\n          for (const prefix of prefixes) {\n            for (const path of Array.isArray(rawPaths)\n              ? rawPaths\n              : [rawPaths]) {\n              const resolvedPaths = routePathFactory\n                .create(\n                  {\n                    ctrlPath: prefix,\n                    methodPath: path,\n                    modulePath,\n                    globalPrefix,\n                    controllerVersion:\n                      controllerVersion as NestRoutePathMetadata[\"controllerVersion\"],\n                    methodVersion,\n                    versioningOptions,\n                  },\n                  requestMethod,\n                )\n                .map((route) => this.mounts.normalizeApplicationRoute(route));\n              const source = `${target.name}.${method}`;\n              applicationRoutes.push(\n                Object.freeze({\n                  method: RequestMethod[requestMethod] ?? String(requestMethod),\n                  paths: Object.freeze([...resolvedPaths]),\n                  conditions: Object.freeze([...conditions]),\n                  source,\n                }),\n              );\n              for (const route of resolvedPaths) {\n                const binding = this.mounts\n                  .bindings()\n                  .find((candidate) =>\n                    routeMayWarnAboutMount(route, candidate.basePath),\n                  );\n                if (!binding) {\n                  continue;\n                }\n                this.warn(\n                  \"W_ROUTE_SHADOWS_AUTH\",\n                  `${source} at '${route}' may shadow auth mount '${binding.basePath}'.`,\n                );\n              }\n            }\n          }\n        }\n      }\n      this.mounts.registerApplicationRoutes(\n        Object.freeze(applicationRoutes),\n        issues,\n      );\n    }\n    this.cookies(issues);\n    for (const entry of this.instances.list()) {\n      const plans = this.#plans.filter(\n        (site) => site.plan.instance === entry.name,\n      );\n      const policies = [\n        ...new Set(\n          plans.flatMap((site) =>\n            requirementLeaves(site.plan.requirements).map((requirement) =>\n              this.policies.resolve(requirement.policy),\n            ),\n          ),\n        ),\n      ];\n      this.entryChecks(entry, policies, issues);\n      const handlers: AdvisedHandler[] = plans.map((site) => {\n        const claims = this.#claims.filter(\n          (claim) =>\n            claim.target === site.target &&\n            (claim.method === undefined || claim.method === site.method),\n        );\n        return {\n          plan: site.plan,\n          transports: [...new Set(claims.map((claim) => claim.transport.id))],\n          inputs: [\n            ...new Set(claims.flatMap((claim) => claim.options.inputs ?? [])),\n          ],\n        };\n      });\n      const advice: BootAdviceContext = {\n        instance: entry.name,\n        auth: entry.handle,\n        context: entry.context,\n        production: productionMode(),\n        hasHttpAdapter: this.mounts.adapter !== null,\n        originCheck: {\n          mode: entry.options.originCheck?.mode ?? \"cookie\",\n          missingOrigin: entry.options.originCheck?.missingOrigin ?? \"reject\",\n        },\n        handlers,\n        transports: this.transports\n          .list()\n          .map((transport) => ({ id: transport.id })),\n        sources: entry.sources,\n        policies,\n      };\n      for (const unit of [\n        ...entry.sources,\n        ...policies,\n        ...this.transports.list(),\n        ...(this.mounts.platform ? [this.mounts.platform] : []),\n      ]) {\n        try {\n          for (const item of (await unit.advise?.(advice)) ?? []) {\n            const line = `${item.code}: '${entry.name}' ${unit.id}: ${item.message}${item.hint ? ` ${item.hint}` : \"\"}`;\n            if (item.level === \"warn\") {\n              this.logger.warn(line);\n            } else {\n              this.logger.log(line);\n            }\n          }\n        } catch (error) {\n          issues.push(\n            configurationIssue(\n              error,\n              \"EXTENSION_ADVICE_FAILED\",\n              `Advice from '${unit.id}' failed.`,\n            ),\n          );\n        }\n      }\n    }\n  }\n\n  summary(\n    hooks: ReadonlyMap<string, import(\"./hook-binder.js\").HookTables>,\n  ): void {\n    for (const entry of this.instances.list()) {\n      if (entry.options.logSummary === false) {\n        continue;\n      }\n      const mount = this.mounts.binding(entry.name);\n      const plans = this.#plans\n        .filter((site) => site.plan.instance === entry.name)\n        .map((site) => site.plan);\n      const rate = entry.context.rateLimit.enabled\n        ? \"on\"\n        : entry.context.options.rateLimit?.enabled === false\n          ? \"off (rateLimit.enabled:false)\"\n          : process.env.NODE_ENV === \"production\"\n            ? \"off (Better Auth saw no NODE_ENV=production at import time; see W_RATE_LIMIT_DISABLED)\"\n            : `off (NODE_ENV ${process.env.NODE_ENV ?? \"unset\"}; Better Auth enables it for NODE_ENV=production)`;\n      const table = hooks.get(entry.name);\n      const hookSummary = table\n        ? `${table.before.length} before, ${table.after.length} after, ${Object.values(table.database).reduce((count, value) => count + value.before.length + value.after.length, 0)} database`\n        : \"none\";\n      const proxy = this.mounts.adapter\n        ? this.mounts.platform?.proxyTrust?.(this.mounts.adapter)\n        : undefined;\n      const defaults = `access: ${entry.options.defaultAccess ?? \"authenticated\"}; origin: ${entry.options.originCheck?.mode ?? \"cookie\"}/${entry.options.originCheck?.missingOrigin ?? \"reject\"}; direct-call cookies: ${entry.options.cookies?.forwardDirectCalls ? \"same-credential\" : \"opt-in\"}`;\n      const guardOrder = this.appConfig\n        .getGlobalGuards()\n        .map((guard) => guard.constructor.name)\n        .join(\" → \");\n      this.logger.log(\n        `'${entry.name}': ${mount ? `mounted at ${mount.basePath} (${mount.bodyLimit} bytes)` : \"not mounted\"}; platform: ${this.mounts.platform?.id ?? \"none\"} (trust proxy: ${proxy?.mode ?? \"unknown\"}${proxy?.detail ? ` ${proxy.detail}` : \"\"}); outside global prefix '${this.appConfig.getGlobalPrefix()}'; hooks: ${hookSummary}; defaults: ${defaults}; transports: ${this.transports\n          .list()\n          .map((unit) => unit.id)\n          .join(\n            \", \",\n          )}; principals: ${entry.sources.map((unit) => `${unit.id} (${unit.acceptance ?? \"explicit\"})`).join(\" → \")}; handlers: ${plans.length} (${plans.filter((plan) => plan.access === \"public\").length} public, ${plans.filter((plan) => plan.access === \"optional\").length} optional, ${plans.filter((plan) => plan.access === \"inherit\").length} inherit, ${plans.filter((plan) => plan.skipsDefaultRequirements).length} skip defaults); environment: ${productionMode() ? \"production\" : \"development\"} (NODE_ENV ${process.env.NODE_ENV ?? \"unset\"}); rate limit: ${rate}; scope: ${this.#globalScope ? \"global\" : \"off — see W_NO_GLOBAL_SCOPE\"}; global guards: ${guardOrder}`,\n      );\n    }\n  }\n}\n","import { Inject, Logger } from \"@nestjs/common\";\nimport { DiscoveryService, MetadataScanner } from \"@nestjs/core\";\nimport { readHookMetadata } from \"./auth-decorators.js\";\nimport type { AuthHookContext, DatabaseHookMethod } from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type { DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { BridgeBinding, CompiledHook } from \"./bridge-protocol.js\";\nimport {\n  isSingletonDependencyTree,\n  type InstanceRegistry,\n} from \"./instance-registry.js\";\n\nexport type HookTables = Pick<BridgeBinding, \"before\" | \"after\" | \"database\">;\nexport const DATABASE_TARGETS: readonly DatabaseHookTarget[] = [\n  \"user\",\n  \"session\",\n  \"account\",\n  \"verification\",\n].flatMap((model) =>\n  [\"create\", \"update\", \"delete\"].map(\n    (operation) => `${model}.${operation}` as DatabaseHookTarget,\n  ),\n);\nexport function emptyHookTables(): HookTables {\n  return {\n    before: [],\n    after: [],\n    database: Object.fromEntries(\n      DATABASE_TARGETS.map((target) => [target, { before: [], after: [] }]),\n    ) as unknown as BridgeBinding[\"database\"],\n  };\n}\n\nfunction distance(a: string, b: string): number {\n  let row = Array.from({ length: b.length + 1 }, (_, i) => i);\n  for (let i = 1; i <= a.length; i++) {\n    const next = [i];\n    for (let j = 1; j <= b.length; j++) {\n      next[j] = Math.min(\n        next[j - 1]! + 1,\n        row[j]! + 1,\n        row[j - 1]! + (a[i - 1] === b[j - 1] ? 0 : 1),\n      );\n    }\n    row = next;\n  }\n  return row[b.length]!;\n}\n\nexport class HookBinder {\n  private readonly logger = new Logger(\"BetterAuth\");\n\n  constructor(\n    @Inject(DiscoveryService) private readonly discovery: DiscoveryService,\n    @Inject(MetadataScanner) private readonly scanner: MetadataScanner,\n  ) {}\n\n  discover(\n    registry: InstanceRegistry,\n    issues: BetterAuthConfigurationError[],\n  ): Map<string, HookTables> {\n    const endpoint = new Map<\n      string,\n      { phase: \"before\" | \"after\"; order: number; hook: CompiledHook }[]\n    >();\n    const database = new Map<\n      string,\n      {\n        phase: \"before\" | \"after\";\n        target: DatabaseHookTarget;\n        order: number;\n        hook: DatabaseHookMethod<DatabaseHookTarget, \"before\" | \"after\">;\n      }[]\n    >();\n    const registrations = new Set(\n      registry.registrations().map((item) => item.name),\n    );\n    const discovered = new Map<unknown, string>();\n    for (const wrapper of this.discovery.getProviders()) {\n      if (\n        wrapper.isAlias ||\n        !wrapper.instance ||\n        (typeof wrapper.instance !== \"object\" &&\n          typeof wrapper.instance !== \"function\")\n      ) {\n        continue;\n      }\n      const instance = wrapper.instance as object;\n      const prototype = Object.getPrototypeOf(instance) as object | null;\n      if (!prototype) {\n        continue;\n      }\n      const methods = new Set<string | symbol>(\n        this.scanner.getAllMethodNames(instance),\n      );\n      for (\n        let current: object | null = instance;\n        current && current !== Object.prototype;\n        current = Object.getPrototypeOf(current)\n      ) {\n        for (const key of Object.getOwnPropertySymbols(current)) {\n          if (\n            typeof Object.getOwnPropertyDescriptor(current, key)?.value ===\n            \"function\"\n          ) {\n            methods.add(key);\n          }\n        }\n      }\n      let found = false;\n      for (const method of methods) {\n        const handler = Reflect.get(instance, method);\n        if (typeof handler !== \"function\") {\n          continue;\n        }\n        const metadata = readHookMetadata(handler);\n        if (!metadata.hooks.length && !metadata.databaseHooks.length) {\n          continue;\n        }\n        found = true;\n        if (!isSingletonDependencyTree(wrapper)) {\n          issues.push(\n            new BetterAuthConfigurationError(\n              \"NON_SINGLETON_EXTENSION\",\n              `Hook provider '${wrapper.name}' is not a static singleton.`,\n              \"Remove request/transient dependencies from hook providers.\",\n            ),\n          );\n          continue;\n        }\n        for (const declaration of metadata.hooks) {\n          const name = declaration.options.instance ?? \"default\";\n          if (!registrations.has(name)) {\n            issues.push(\n              new BetterAuthConfigurationError(\n                \"UNKNOWN_INSTANCE\",\n                `Hook '${wrapper.name}.${String(method)}' names unknown instance '${name}'.`,\n              ),\n            );\n            continue;\n          }\n          const entry = registry.list().find((value) => value.name === name);\n          if (!entry) {\n            continue;\n          }\n          const paths = Object.values(entry.instance.api).flatMap((api) =>\n            typeof api === \"function\" &&\n            typeof Reflect.get(api, \"path\") === \"string\"\n              ? [Reflect.get(api, \"path\") as string]\n              : [],\n          );\n          const { match, options } = declaration;\n          const patterns =\n            typeof match === \"string\"\n              ? [match]\n              : Array.isArray(match)\n                ? match\n                : [];\n          for (const pattern of patterns) {\n            if (!paths.includes(pattern)) {\n              const closest = [...paths].sort(\n                (a, b) => distance(a, pattern) - distance(b, pattern),\n              )[0];\n              issues.push(\n                new BetterAuthConfigurationError(\n                  \"UNKNOWN_HOOK_PATH\",\n                  `Hook '${wrapper.name}.${String(method)}' has unknown path '${pattern}'.`,\n                  closest\n                    ? `Did you mean '${closest}'?`\n                    : \"Use an endpoint path exposed by this auth instance.\",\n                ),\n              );\n            }\n          }\n          const hook: CompiledHook = {\n            matches(ctx, scope) {\n              const router = Reflect.get(ctx, \"_flag\") === \"router\";\n              if (\n                (options.calls === \"http\" && !router) ||\n                (options.calls === \"server\" && router) ||\n                (options.skipInternal && scope?.internal)\n              ) {\n                return false;\n              }\n              if (match === undefined) {\n                return true;\n              }\n              if (typeof match === \"function\") {\n                return match(ctx as AuthHookContext);\n              }\n              return typeof match === \"string\"\n                ? ctx.path === match\n                : match.includes(ctx.path ?? \"\");\n            },\n            async run(ctx) {\n              return handler.call(instance, ctx);\n            },\n          };\n          const list = endpoint.get(name) ?? [];\n          list.push({\n            phase: declaration.phase,\n            order: options.order ?? 0,\n            hook,\n          });\n          endpoint.set(name, list);\n        }\n        for (const declaration of metadata.databaseHooks) {\n          const name = declaration.options.instance ?? \"default\";\n          if (!registrations.has(name)) {\n            issues.push(\n              new BetterAuthConfigurationError(\n                \"UNKNOWN_INSTANCE\",\n                `Database hook '${wrapper.name}.${String(method)}' names unknown instance '${name}'.`,\n              ),\n            );\n            continue;\n          }\n          const list = database.get(name) ?? [];\n          list.push({\n            phase: declaration.phase,\n            target: declaration.target,\n            order: declaration.options.order ?? 0,\n            hook: handler.bind(instance),\n          });\n          database.set(name, list);\n        }\n      }\n      if (found) {\n        const owner = wrapper.host?.name ?? \"unknown module\";\n        const previous = discovered.get(wrapper.metatype);\n        if (previous) {\n          this.logger.warn(\n            `W_DUPLICATE_HOOK_PROVIDER: '${wrapper.name}' is provided in '${previous}' and '${owner}'; both registrations run.`,\n          );\n        }\n        discovered.set(wrapper.metatype, owner);\n      }\n    }\n    const tables = new Map<string, HookTables>();\n    for (const name of registrations) {\n      const hooks = (endpoint.get(name) ?? []).sort(\n        (a, b) => a.order - b.order,\n      );\n      const db = (database.get(name) ?? []).sort((a, b) => a.order - b.order);\n      tables.set(name, {\n        before: hooks\n          .filter((value) => value.phase === \"before\")\n          .map((value) => value.hook),\n        after: hooks\n          .filter((value) => value.phase === \"after\")\n          .map((value) => value.hook),\n        database: Object.fromEntries(\n          DATABASE_TARGETS.map((target) => [\n            target,\n            {\n              before: db\n                .filter(\n                  (value) =>\n                    value.target === target && value.phase === \"before\",\n                )\n                .map((value) => value.hook),\n              after: db\n                .filter(\n                  (value) => value.target === target && value.phase === \"after\",\n                )\n                .map((value) => value.hook),\n            },\n          ]),\n        ) as unknown as BridgeBinding[\"database\"],\n      });\n    }\n    return tables;\n  }\n}\n","import type { LoggerService } from \"@nestjs/common\";\nimport { isAPIError, type APIError } from \"better-auth/api\";\nimport type {\n  AuthContextView,\n  AuthRouteBinding,\n  CorsOriginOptions,\n  InboundAuthRequest,\n  ProxyTrust,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  createInfrastructureError,\n  getAPIErrorHeaders,\n} from \"./auth-errors.js\";\nimport { ErrorRedactor } from \"./error-redactor.js\";\nimport type { InstanceEntry } from \"./instance-registry.js\";\nimport { readBoundedBody } from \"./platform.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { AuthLike } from \"./auth-types.js\";\nimport { TrustedOrigins } from \"./trusted-origins.js\";\n\nexport interface AuthExchangeInit {\n  readonly basePath: string;\n  readonly bodyLimit: number;\n  readonly staticOrigin: string | undefined;\n  readonly logger: LoggerService;\n  readonly proxyTrust?: ProxyTrust;\n}\n\nconst HOP_HEADERS = [\n  \"connection\",\n  \"keep-alive\",\n  \"proxy-connection\",\n  \"transfer-encoding\",\n  \"te\",\n  \"trailer\",\n  \"upgrade\",\n  \"proxy-authenticate\",\n  \"proxy-authorization\",\n];\n\nfunction sdkAPIError(error: unknown): error is APIError {\n  try {\n    return isAPIError(error);\n  } catch {\n    return false;\n  }\n}\n\nfunction production(): boolean {\n  return ![\"development\", \"dev\", \"test\"].includes(process.env.NODE_ENV ?? \"\");\n}\n\nfunction distance(left: string, right: string): number {\n  let previous = Array.from({ length: right.length + 1 }, (_, index) => index);\n  for (let row = 0; row < left.length; row++) {\n    const current = [row + 1];\n    for (let column = 0; column < right.length; column++) {\n      current.push(\n        Math.min(\n          current[column]! + 1,\n          previous[column + 1]! + 1,\n          previous[column]! + Number(left[row] !== right[column]),\n        ),\n      );\n    }\n    previous = current;\n  }\n  return previous[right.length]!;\n}\n\n/** App-owned exchange; all platform request and response operations stay outside core. */\nexport class AuthExchange {\n  #warnedProxy = false;\n\n  constructor(private readonly scope: RequestScope) {}\n\n  create(entry: InstanceEntry, init: AuthExchangeInit): AuthRouteBinding {\n    const paths = [\n      ...new Set(\n        Object.values(entry.instance.api).flatMap((endpoint) => {\n          const path = Reflect.get(endpoint, \"path\");\n          return typeof path === \"string\" ? [path] : [];\n        }),\n      ),\n    ];\n    const seen = new Set<string>();\n    const binding: AuthRouteBinding = Object.freeze({\n      instance: entry.name,\n      basePath: init.basePath,\n      bodyLimit: init.bodyLimit,\n      staticOrigin: init.staticOrigin,\n      matches: (pathname: string) =>\n        init.basePath === \"/\"\n          ? pathname.startsWith(\"/\")\n          : pathname === init.basePath ||\n            pathname.startsWith(`${init.basePath}/`),\n      payloadTooLarge: () =>\n        Response.json(\n          {\n            code: \"PAYLOAD_TOO_LARGE\",\n            message: \"Request body exceeds the configured limit\",\n          },\n          { status: 413 },\n        ),\n      handle: async (inbound: InboundAuthRequest) => {\n        const response = await this.handle(entry, init, binding, inbound);\n        if (\n          response.status === 404 &&\n          (entry.options.http?.diagnostics ?? !production())\n        ) {\n          const pathname = new URL(inbound.url).pathname;\n          const key = `${inbound.method.toUpperCase()} ${pathname}`;\n          if (binding.matches(pathname) && !seen.has(key) && seen.size < 100) {\n            seen.add(key);\n            const requested = pathname.slice(\n              init.basePath === \"/\" ? 0 : init.basePath.length,\n            );\n            const closest = paths.reduce<string | undefined>(\n              (best, path) =>\n                best === undefined ||\n                distance(requested, path) < distance(requested, best)\n                  ? path\n                  : best,\n              undefined,\n            );\n            const suggestion = closest\n              ? ` Did you mean ${init.basePath === \"/\" ? \"\" : init.basePath}${closest}?`\n              : \"\";\n            init.logger.warn(\n              `better-auth has no route for ${key} (mounted at ${init.basePath}).${suggestion}`,\n            );\n          }\n        }\n        return response;\n      },\n    });\n    return binding;\n  }\n\n  private async handle(\n    entry: InstanceEntry,\n    init: AuthExchangeInit,\n    binding: AuthRouteBinding,\n    inbound: InboundAuthRequest,\n  ): Promise<Response> {\n    const redactors = [\n      new ErrorRedactor({\n        secrets: [entry.context.secret],\n        headers: inbound.headers,\n        credentialHeaders: entry.credentialHeaders,\n      }),\n    ];\n    try {\n      const method = inbound.method.toUpperCase();\n      let body: Uint8Array | null = null;\n      if (method !== \"GET\" && method !== \"HEAD\") {\n        if (inbound.body instanceof Uint8Array) {\n          if (inbound.body.byteLength > init.bodyLimit) {\n            return binding.payloadTooLarge();\n          }\n          body = inbound.body;\n        } else if (inbound.body !== null) {\n          const bounded = await readBoundedBody(inbound.body, {\n            limit: init.bodyLimit,\n          });\n          if (!bounded.ok) {\n            if (bounded.reason === \"too-large\") {\n              return binding.payloadTooLarge();\n            }\n            throw new Error(\"Authentication request body was aborted\");\n          }\n          body = bounded.bytes;\n        }\n      }\n      let url: URL;\n      try {\n        url = new URL(inbound.url);\n        if (\n          ![\"http:\", \"https:\"].includes(url.protocol) ||\n          url.username ||\n          url.password\n        ) {\n          throw new TypeError(\"Invalid request URL\");\n        }\n        if (init.staticOrigin) {\n          url = new URL(`${init.staticOrigin}${url.pathname}${url.search}`);\n        }\n      } catch {\n        return Response.json(\n          { code: \"INVALID_REQUEST_URL\", message: \"Invalid request URL\" },\n          { status: 400 },\n        );\n      }\n      const headers = new Headers(inbound.headers);\n      const nominated = (headers.get(\"connection\") ?? \"\")\n        .split(\",\")\n        .map((name) => name.trim())\n        .filter(Boolean);\n      for (const name of [...HOP_HEADERS, ...nominated]) {\n        headers.delete(name);\n      }\n      const ipHeader = entry.bridge.clientIpHeader;\n      for (const name of [...headers.keys()]) {\n        if (name.startsWith(\"x-nsba-ip-\") || name === ipHeader?.toLowerCase()) {\n          headers.delete(name);\n        }\n      }\n      if (ipHeader && inbound.clientIp !== null) {\n        headers.set(ipHeader, inbound.clientIp);\n      }\n      this.warnProxy(entry, init, inbound);\n      const request = new Request(url, {\n        method,\n        headers,\n        body: body === null ? null : Uint8Array.from(body),\n        signal: inbound.signal,\n      });\n      const interceptors = entry.options.http?.around ?? [];\n      const dispatch = (index: number, current: Request): Promise<Response> => {\n        redactors.push(\n          new ErrorRedactor({\n            headers: current.headers,\n            credentialHeaders: entry.credentialHeaders,\n          }),\n        );\n        const interceptor = interceptors[index];\n        return interceptor\n          ? interceptor(\n              {\n                request: current,\n                platformRequest: inbound.platformRequest,\n                instance: entry.name,\n              },\n              (replacement = current) => dispatch(index + 1, replacement),\n            )\n          : this.scope.exit(() => entry.instance.handler(current));\n      };\n      return await dispatch(0, request);\n    } catch (error) {\n      if (sdkAPIError(error)) {\n        if (entry.context.options.onAPIError?.throw) {\n          throw error;\n        }\n        return Response.json(error.body ?? { message: error.message }, {\n          status: error.statusCode,\n          headers: getAPIErrorHeaders(error),\n        });\n      }\n      let cause: unknown = error;\n      for (const redactor of redactors) {\n        cause = redactor.redact(cause);\n      }\n      const wrapped = createInfrastructureError(cause);\n      if (entry.options.errors?.exposeRawCause) {\n        // The opt-in retains the original separately while the ordinary cause stays redacted.\n        const raw = createInfrastructureError(error, { exposeRawCause: true });\n        Object.defineProperty(raw, \"cause\", { value: wrapped.cause });\n        throw raw;\n      }\n      throw wrapped;\n    }\n  }\n\n  private warnProxy(\n    entry: InstanceEntry,\n    init: AuthExchangeInit,\n    inbound: InboundAuthRequest,\n  ): void {\n    if (\n      this.#warnedProxy ||\n      !production() ||\n      init.proxyTrust?.mode !== \"none\" ||\n      ![\"x-forwarded-for\", \"forwarded\", \"x-real-ip\"].some((name) =>\n        inbound.headers.has(name),\n      )\n    ) {\n      return;\n    }\n    this.#warnedProxy = true;\n    const ip = entry.context.options.advanced?.ipAddress;\n    const bridgeHeader = entry.bridge.clientIpHeader;\n    const bridgeHeaderFirst =\n      bridgeHeader !== null &&\n      ip?.ipAddressHeaders?.[0]?.toLowerCase() === bridgeHeader.toLowerCase();\n    let effect: string;\n    if (!entry.context.rateLimit.enabled) {\n      if (bridgeHeader === null) {\n        effect =\n          \"Rate limiting is disabled; the bridge does not insert this socket IP, so better-auth's configured IP resolution determines the session IP.\";\n      } else if (!bridgeHeaderFirst) {\n        effect =\n          \"Rate limiting is disabled; a configured better-auth IP header precedes the bridge header, so this socket IP is not necessarily recorded on sessions.\";\n      } else {\n        effect =\n          \"Rate limiting is disabled; this IP is recorded on sessions only.\";\n      }\n    } else if (bridgeHeader === null) {\n      effect =\n        \"The bridge does not insert this socket IP; better-auth's configured IP resolution determines the rate-limit key.\";\n    } else if (!bridgeHeaderFirst) {\n      effect =\n        \"A configured better-auth IP header precedes the bridge header, so this socket IP is not necessarily the rate-limit key.\";\n    } else if (ip?.trustedProxies?.length) {\n      effect =\n        \"If better-auth trustedProxies covers this address, no client IP remains and all clients share one rate-limit bucket. Otherwise this socket IP is the rate-limit key.\";\n    } else {\n      effect =\n        \"This socket IP is the rate-limit key, so clients behind the proxy share its bucket.\";\n    }\n    init.logger.warn(\n      `W_PROXY_UNTRUSTED: platform resolved socket IP ${inbound.clientIp ?? \"unknown\"}. ${effect} Configure platform proxy trust (${init.proxyTrust.detail}).`,\n    );\n  }\n}\n\n/** Credentialed CORS for the auth mount, using the initialized SDK trusted origins. */\nexport function betterAuthCorsOrigin(\n  auth: AuthLike,\n  options?: CorsOriginOptions,\n): (\n  origin: string | undefined,\n  cb: (err: Error | null, allow?: boolean) => void,\n) => void {\n  const context = async () => (await auth.$context) as AuthContextView;\n  const trusted = new TrustedOrigins(context);\n  return (origin, callback) => {\n    void (async () => {\n      const initialized = await context();\n      if (typeof initialized.options.trustedOrigins === \"function\") {\n        throw new BetterAuthConfigurationError(\n          \"DYNAMIC_CORS_ORIGIN\",\n          \"Function-valued trustedOrigins needs a request that a CORS origin callback cannot provide\",\n          \"Supply a request-aware CORS origin function instead of betterAuthCorsOrigin.\",\n        );\n      }\n      if (!origin) {\n        return false;\n      }\n      if (options?.allowPatterns) {\n        return trusted.isTrusted(origin);\n      }\n      return (await trusted.list()).some((candidate) => {\n        try {\n          const parsed = new URL(candidate);\n          return (\n            (parsed.protocol === \"http:\" || parsed.protocol === \"https:\") &&\n            !candidate.includes(\"*\") &&\n            candidate === parsed.origin &&\n            origin === candidate\n          );\n        } catch {\n          return false;\n        }\n      });\n    })().then(\n      (allow) => callback(null, allow),\n      (error: unknown) =>\n        callback(\n          error instanceof Error\n            ? error\n            : new Error(\"Failed to resolve trusted CORS origins\"),\n        ),\n    );\n  };\n}\n","import { Inject, Logger } from \"@nestjs/common\";\nimport { HttpAdapterHost, type AbstractHttpAdapter } from \"@nestjs/core\";\nimport type {\n  ApplicationRouteDescriptor,\n  AuthRouteBinding,\n  HttpPlatform,\n} from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport { AuthExchange } from \"./auth-exchange.js\";\nimport { INSTANCE_REGISTRY, REQUEST_SCOPE } from \"./auth-tokens.js\";\nimport {\n  configurationIssue,\n  type InstanceRegistry,\n} from \"./instance-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nconst MOUNTED = Symbol.for(\"nestjs-slightly-better-auth:mounted\");\nexport function parseBodyLimit(input: number | string | undefined): number {\n  if (input === undefined) {\n    return 1_048_576;\n  }\n  const match =\n    typeof input === \"string\"\n      ? /^(\\d+(?:\\.\\d+)?)(b|kb|mb)$/i.exec(input)\n      : null;\n  const value =\n    typeof input === \"number\"\n      ? input\n      : match\n        ? Number(match[1]) *\n          ({ b: 1, kb: 1024, mb: 1048576 }[match[2]!.toLowerCase()] ?? 0)\n        : Number.NaN;\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new BetterAuthConfigurationError(\n      \"INVALID_BODY_LIMIT\",\n      `Invalid auth body limit '${input}'.`,\n      \"Use a nonnegative byte count or a value such as '1mb'.\",\n    );\n  }\n  return value;\n}\n\nexport class MountCoordinator {\n  readonly logger = new Logger(\"BetterAuth\");\n  readonly #exchange: AuthExchange;\n  readonly #bindings = new Map<string, AuthRouteBinding>();\n  #platforms: readonly HttpPlatform[] | undefined;\n  #prepared: AbstractHttpAdapter | null = null;\n  #selected: HttpPlatform | undefined;\n  #preparationErrors: BetterAuthConfigurationError[] = [];\n\n  constructor(\n    @Inject(HttpAdapterHost) readonly host: HttpAdapterHost,\n    @Inject(INSTANCE_REGISTRY) private readonly registry: InstanceRegistry,\n    @Inject(REQUEST_SCOPE) scope: RequestScope,\n  ) {\n    this.#exchange = new AuthExchange(scope);\n    host.init$.subscribe(() => this.tryPrepare(false));\n  }\n\n  registerPlatforms(platforms: readonly HttpPlatform[]): void {\n    this.#platforms = platforms;\n    this.tryPrepare(false);\n  }\n\n  get platform(): HttpPlatform | undefined {\n    return this.#selected;\n  }\n\n  get adapter(): AbstractHttpAdapter | null {\n    return this.host.httpAdapter ?? null;\n  }\n\n  private tryPrepare(atInit: boolean): void {\n    const adapter = this.adapter;\n    if (!adapter || !this.#platforms || this.#prepared === adapter) {\n      return;\n    }\n    try {\n      if (this.registry.state !== \"new\" && this.registry.adapter !== adapter) {\n        throw new BetterAuthConfigurationError(\n          \"LATE_HTTP_ADAPTER\",\n          \"The HTTP adapter changed while the application is active.\",\n          \"Close the first application before starting another.\",\n        );\n      }\n      const supported = this.#platforms.filter((platform) =>\n        platform.supports(adapter),\n      );\n      if (supported.length !== 1) {\n        throw new BetterAuthConfigurationError(\n          supported.length ? \"AMBIGUOUS_PLATFORM\" : \"NO_PLATFORM\",\n          `Expected exactly one supporting HTTP platform; found ${supported.length}.`,\n          \"Register the platform for your HTTP adapter on the default instance.\",\n        );\n      }\n      const platform = supported[0]!;\n      if (\n        atInit &&\n        this.#prepared !== null &&\n        !platform.capabilities?.prepareAtInit\n      ) {\n        throw new BetterAuthConfigurationError(\n          \"APP_ADAPTER_CHANGED\",\n          \"The application uses a different HTTP adapter after preparation.\",\n          \"Compile a new TestingModule for each application (or use NestFactory).\",\n        );\n      }\n      platform.prepare?.({\n        adapter,\n        logger: this.logger,\n        route: (pathname) => this.route(pathname),\n      });\n      this.#selected = platform;\n      this.#prepared = adapter;\n    } catch (error) {\n      this.#preparationErrors.push(\n        configurationIssue(\n          error,\n          \"PLATFORM_PREPARATION_FAILED\",\n          \"HTTP platform preparation failed.\",\n        ),\n      );\n    }\n  }\n\n  prepareAtInit(issues: BetterAuthConfigurationError[]): void {\n    this.tryPrepare(true);\n    issues.push(...this.#preparationErrors);\n    this.#preparationErrors = [];\n    if (this.adapter && this.#selected) {\n      try {\n        this.#selected.validate?.(this.adapter);\n      } catch (error) {\n        issues.push(\n          configurationIssue(\n            error,\n            \"PLATFORM_VALIDATION_FAILED\",\n            \"HTTP platform validation failed.\",\n          ),\n        );\n      }\n    }\n  }\n\n  resolve(issues: BetterAuthConfigurationError[]): void {\n    this.#bindings.clear();\n    const adapter = this.adapter;\n    if (!adapter || !this.#selected) {\n      return;\n    }\n    const server = adapter.getInstance() as object;\n    const mounted = Reflect.get(server, MOUNTED) as Set<string> | undefined;\n    for (const entry of this.registry.list()) {\n      if (entry.options.http?.mount === false) {\n        continue;\n      }\n      try {\n        const raw = entry.context.baseURL\n          ? new URL(entry.context.baseURL).pathname\n          : entry.context.options.basePath || \"/api/auth\";\n        const basePath = raw.length > 1 ? raw.replace(/\\/+$/, \"\") : raw;\n        if (\n          !basePath.startsWith(\"/\") ||\n          (basePath === \"/\" && !entry.options.http?.allowRootMount)\n        ) {\n          throw new BetterAuthConfigurationError(\n            \"INVALID_MOUNT_PATH\",\n            `Invalid auth mount path '${basePath}'.`,\n            \"Use an absolute path; opt into root mounting with http.allowRootMount.\",\n          );\n        }\n        if (mounted?.has(basePath)) {\n          throw new BetterAuthConfigurationError(\n            \"DUPLICATE_MOUNT\",\n            `Auth path '${basePath}' is already mounted on this server.`,\n            \"Create a fresh application and adapter.\",\n          );\n        }\n        for (const existing of this.#bindings.values()) {\n          if (\n            basePath === \"/\" ||\n            existing.basePath === \"/\" ||\n            existing.matches(basePath) ||\n            basePath.startsWith(`${existing.basePath}/`) ||\n            existing.basePath.startsWith(`${basePath}/`)\n          ) {\n            throw new BetterAuthConfigurationError(\n              \"OVERLAPPING_MOUNTS\",\n              `Mounts '${existing.basePath}' and '${basePath}' overlap.`,\n              \"Use separate basePath values for named instances.\",\n            );\n          }\n        }\n        this.#bindings.set(\n          entry.name,\n          this.#exchange.create(entry, {\n            basePath,\n            bodyLimit: parseBodyLimit(entry.options.http?.bodyLimit),\n            staticOrigin: entry.context.baseURL\n              ? new URL(entry.context.baseURL).origin\n              : undefined,\n            logger: this.logger,\n            proxyTrust: this.#selected.proxyTrust?.(adapter),\n          }),\n        );\n      } catch (error) {\n        issues.push(\n          configurationIssue(\n            error,\n            \"INVALID_MOUNT_PATH\",\n            `Cannot resolve mount for '${entry.name}'.`,\n          ),\n        );\n      }\n    }\n  }\n\n  route(pathname: string): AuthRouteBinding | undefined {\n    return [...this.#bindings.values()].find((binding) =>\n      binding.matches(pathname),\n    );\n  }\n\n  binding(name: string): AuthRouteBinding | undefined {\n    return this.#bindings.get(name);\n  }\n\n  bindings(): readonly AuthRouteBinding[] {\n    return [...this.#bindings.values()];\n  }\n\n  normalizeApplicationRoute(path: string): string {\n    const adapter = this.adapter;\n    return adapter && typeof adapter.normalizePath === \"function\"\n      ? adapter.normalizePath(path)\n      : path;\n  }\n\n  registerApplicationRoutes(\n    routes: readonly ApplicationRouteDescriptor[],\n    issues: BetterAuthConfigurationError[],\n  ): void {\n    try {\n      this.#selected?.applicationRoutes?.(\n        routes,\n        Object.freeze([...this.#bindings.values()]),\n      );\n    } catch (error) {\n      issues.push(\n        configurationIssue(\n          error,\n          \"APPLICATION_ROUTE_REGISTRATION_FAILED\",\n          \"Cannot register application routes with the HTTP platform.\",\n        ),\n      );\n    }\n  }\n\n  async mount(): Promise<void> {\n    const adapter = this.adapter;\n    const platform = this.#selected;\n    if (!adapter || !platform) {\n      return;\n    }\n    const server = adapter.getInstance() as object;\n    let mounted = Reflect.get(server, MOUNTED) as Set<string> | undefined;\n    if (!mounted) {\n      mounted = new Set();\n      Object.defineProperty(server, MOUNTED, { value: mounted });\n    }\n    for (const binding of this.#bindings.values()) {\n      if (mounted.has(binding.basePath)) {\n        throw new BetterAuthConfigurationError(\n          \"DUPLICATE_MOUNT\",\n          `Auth path '${binding.basePath}' is already mounted.`,\n        );\n      }\n      await platform.mount({ adapter, logger: this.logger, binding });\n      mounted.add(binding.basePath);\n    }\n  }\n\n  reset(): void {\n    this.#bindings.clear();\n    this.#preparationErrors = [];\n  }\n}\n","import type { ModuleRef } from \"@nestjs/core\";\nimport type { AuthorizationPolicy, PolicyRef } from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\n\nexport class PolicyResolver {\n  private readonly cache = new Map<\n    PolicyRef<unknown>,\n    AuthorizationPolicy<any, any>\n  >();\n\n  constructor(private readonly moduleRef: ModuleRef) {}\n\n  resolve<P>(reference: PolicyRef<P>): AuthorizationPolicy<P, any> {\n    const cached = this.cache.get(reference);\n    if (cached) {\n      return cached;\n    }\n    let policy: AuthorizationPolicy<P, any>;\n    try {\n      policy =\n        typeof reference === \"object\" &&\n        reference !== null &&\n        \"evaluate\" in reference\n          ? reference\n          : this.moduleRef.get(reference as never, { strict: false });\n    } catch {\n      throw new BetterAuthConfigurationError(\n        \"UNRESOLVED_POLICY\",\n        \"A requirement references a policy that is not registered as a provider\",\n      );\n    }\n    if (\n      !policy ||\n      typeof policy.evaluate !== \"function\" ||\n      typeof policy.id !== \"string\"\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"UNRESOLVED_POLICY\",\n        \"A requirement must reference an authorization policy\",\n      );\n    }\n    this.cache.set(reference, policy);\n    return policy;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  TransportCall,\n  TransportKit,\n} from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\n\nexport class TransportRegistry {\n  private transports: readonly AuthTransport[] = [];\n  private readonly owners = new WeakMap<TransportCall, string>();\n  private kit: TransportKit = { http: null };\n\n  register(transports: readonly AuthTransport[]): void {\n    this.transports = [...transports];\n  }\n\n  setKit(kit: TransportKit): void {\n    this.kit = kit;\n  }\n\n  list(): readonly AuthTransport[] {\n    return [...this.transports];\n  }\n\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  defaultAccessFor(target: Function, method: string): \"inherit\" | undefined {\n    for (const transport of this.transports) {\n      const answer = transport.defaultAccessFor?.(target, method);\n      if (answer !== undefined) {\n        return answer;\n      }\n    }\n    return undefined;\n  }\n\n  find(context: ExecutionContext): AuthTransport | undefined {\n    return this.transports.find((unit) => unit.handles(context));\n  }\n\n  select(context: ExecutionContext): AuthTransport {\n    const transport = this.find(context);\n    if (!transport) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"NO_TRANSPORT\",\n        \"No registered transport handles this execution context\",\n      );\n    }\n    return transport;\n  }\n\n  idOf(call: TransportCall): string {\n    return this.owners.get(call) ?? \"unknown\";\n  }\n\n  describe(\n    context: ExecutionContext,\n    transport = this.select(context),\n  ): TransportCall {\n    const call = transport.describe(context, this.kit);\n    this.owners.set(call, transport.id);\n    return call;\n  }\n}\n","import {\n  Global,\n  Inject,\n  Module,\n  type OnApplicationBootstrap,\n  type OnApplicationShutdown,\n  type OnModuleInit,\n} from \"@nestjs/common\";\nimport {\n  DiscoveryModule,\n  DiscoveryService,\n  HttpAdapterHost,\n  MetadataScanner,\n  ModuleRef,\n  Reflector,\n  ApplicationConfig,\n} from \"@nestjs/core\";\nimport {\n  AuthorizationEvaluator,\n  DefaultPolicyInvoker,\n} from \"./authorization-evaluator.js\";\nimport { BetterAuthGuard, GuardCore } from \"./auth-guard.js\";\nimport {\n  BetterAuthScopeInterceptor,\n  ScopeCore,\n} from \"./auth-scope-interceptor.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type { PolicyInvoker, PrincipalResolver } from \"./auth-contracts.js\";\nimport {\n  GUARD_CORE,\n  INSTANCE_REGISTRY,\n  MOUNT_COORDINATOR,\n  POLICY_INVOKER,\n  POLICY_RESOLVER,\n  PRINCIPAL_READINGS,\n  PRINCIPAL_RESOLVER,\n  REQUEST_SCOPE,\n  ROUTE_PLANNER,\n  SCOPE_CORE,\n  TRANSPORT_REGISTRY,\n} from \"./auth-tokens.js\";\nimport { BootValidator } from \"./boot-validator.js\";\nimport { BridgeClient } from \"./bridge-client.js\";\nimport { emptyHookTables, HookBinder } from \"./hook-binder.js\";\nimport { configurationIssue, InstanceRegistry } from \"./instance-registry.js\";\nimport { MountCoordinator } from \"./mount-coordinator.js\";\nimport { PolicyResolver } from \"./policy-resolver.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { ChainPrincipalResolver } from \"./principal-resolver.js\";\nimport { RequestScope } from \"./request-scope.js\";\nimport { RoutePlanner } from \"./route-planner.js\";\nimport { TransportRegistry } from \"./transport-registry.js\";\n\nconst EVALUATOR = Symbol(\"authorization-evaluator\");\nconst exports = [\n  INSTANCE_REGISTRY,\n  REQUEST_SCOPE,\n  PRINCIPAL_READINGS,\n  MOUNT_COORDINATOR,\n  POLICY_RESOLVER,\n  ROUTE_PLANNER,\n  TRANSPORT_REGISTRY,\n  PRINCIPAL_RESOLVER,\n  POLICY_INVOKER,\n  GUARD_CORE,\n  SCOPE_CORE,\n  BetterAuthGuard,\n  BetterAuthScopeInterceptor,\n];\n\n@Global()\n@Module({\n  imports: [DiscoveryModule],\n  providers: [\n    MetadataScanner,\n    { provide: REQUEST_SCOPE, useFactory: () => new RequestScope() },\n    {\n      provide: INSTANCE_REGISTRY,\n      inject: [REQUEST_SCOPE],\n      useFactory: (scope: RequestScope) => new InstanceRegistry(scope),\n    },\n    {\n      provide: PRINCIPAL_READINGS,\n      inject: [REQUEST_SCOPE],\n      useFactory: (scope: RequestScope) => new PrincipalReadings(scope),\n    },\n    { provide: TRANSPORT_REGISTRY, useFactory: () => new TransportRegistry() },\n    {\n      provide: POLICY_RESOLVER,\n      inject: [ModuleRef],\n      useFactory: (ref: ModuleRef) => new PolicyResolver(ref),\n    },\n    {\n      provide: ROUTE_PLANNER,\n      inject: [INSTANCE_REGISTRY, POLICY_RESOLVER, TRANSPORT_REGISTRY],\n      useFactory: (\n        instances: InstanceRegistry,\n        policies: PolicyResolver,\n        transports: TransportRegistry,\n      ) => new RoutePlanner(instances, policies, transports),\n    },\n    {\n      provide: MOUNT_COORDINATOR,\n      inject: [HttpAdapterHost, INSTANCE_REGISTRY, REQUEST_SCOPE],\n      useFactory: (\n        host: HttpAdapterHost,\n        instances: InstanceRegistry,\n        scope: RequestScope,\n      ) => new MountCoordinator(host, instances, scope),\n    },\n    {\n      provide: PRINCIPAL_RESOLVER,\n      inject: [INSTANCE_REGISTRY, REQUEST_SCOPE, TRANSPORT_REGISTRY],\n      useFactory: (\n        instances: InstanceRegistry,\n        scope: RequestScope,\n        transports: TransportRegistry,\n      ) => new ChainPrincipalResolver(instances, scope, transports),\n    },\n    { provide: POLICY_INVOKER, useFactory: () => new DefaultPolicyInvoker() },\n    {\n      provide: EVALUATOR,\n      inject: [\n        POLICY_RESOLVER,\n        POLICY_INVOKER,\n        PRINCIPAL_RESOLVER,\n        REQUEST_SCOPE,\n      ],\n      useFactory: (\n        policies: PolicyResolver,\n        invoker: PolicyInvoker,\n        resolver: PrincipalResolver,\n        scope: RequestScope,\n      ) => new AuthorizationEvaluator(policies, invoker, resolver, scope),\n    },\n    {\n      provide: GUARD_CORE,\n      inject: [\n        INSTANCE_REGISTRY,\n        ROUTE_PLANNER,\n        TRANSPORT_REGISTRY,\n        PRINCIPAL_RESOLVER,\n        EVALUATOR,\n        REQUEST_SCOPE,\n        PRINCIPAL_READINGS,\n      ],\n      useFactory: (\n        instances: InstanceRegistry,\n        planner: RoutePlanner,\n        transports: TransportRegistry,\n        resolver: PrincipalResolver,\n        evaluator: AuthorizationEvaluator,\n        scope: RequestScope,\n        readings: PrincipalReadings,\n      ) =>\n        new GuardCore(\n          instances,\n          planner,\n          transports,\n          resolver,\n          evaluator,\n          scope,\n          readings,\n        ),\n    },\n    {\n      provide: SCOPE_CORE,\n      inject: [\n        INSTANCE_REGISTRY,\n        ROUTE_PLANNER,\n        TRANSPORT_REGISTRY,\n        REQUEST_SCOPE,\n        PRINCIPAL_READINGS,\n      ],\n      useFactory: (\n        instances: InstanceRegistry,\n        planner: RoutePlanner,\n        transports: TransportRegistry,\n        scope: RequestScope,\n        readings: PrincipalReadings,\n      ) => new ScopeCore(instances, planner, transports, scope, readings),\n    },\n    BetterAuthGuard,\n    BetterAuthScopeInterceptor,\n    HookBinder,\n    BridgeClient,\n    {\n      provide: BootValidator,\n      inject: [\n        DiscoveryService,\n        MetadataScanner,\n        Reflector,\n        ModuleRef,\n        ApplicationConfig,\n        INSTANCE_REGISTRY,\n        ROUTE_PLANNER,\n        POLICY_RESOLVER,\n        TRANSPORT_REGISTRY,\n        MOUNT_COORDINATOR,\n      ],\n      useFactory: (\n        discovery: DiscoveryService,\n        scanner: MetadataScanner,\n        reflector: Reflector,\n        moduleRef: ModuleRef,\n        appConfig: ApplicationConfig,\n        instances: InstanceRegistry,\n        planner: RoutePlanner,\n        policies: PolicyResolver,\n        transports: TransportRegistry,\n        mounts: MountCoordinator,\n      ) =>\n        new BootValidator(\n          discovery,\n          scanner,\n          reflector,\n          moduleRef,\n          appConfig,\n          instances,\n          planner,\n          policies,\n          transports,\n          mounts,\n        ),\n    },\n  ],\n  exports,\n})\nexport class BetterAuthCoreModule\n  implements OnModuleInit, OnApplicationBootstrap, OnApplicationShutdown\n{\n  #initialization: Promise<void> | undefined;\n  #ready = false;\n\n  constructor(\n    @Inject(INSTANCE_REGISTRY) private readonly instances: InstanceRegistry,\n    @Inject(REQUEST_SCOPE) private readonly scope: RequestScope,\n    @Inject(TRANSPORT_REGISTRY) private readonly transports: TransportRegistry,\n    @Inject(MOUNT_COORDINATOR) private readonly mounts: MountCoordinator,\n    @Inject(HookBinder) private readonly hooks: HookBinder,\n    @Inject(BridgeClient) private readonly bridges: BridgeClient,\n    @Inject(BootValidator) private readonly validator: BootValidator,\n  ) {}\n\n  onModuleInit(): Promise<void> {\n    if (!this.instances.begin(this.mounts.adapter)) {\n      return this.#initialization ?? Promise.resolve();\n    }\n    this.#initialization = this.initialize();\n    return this.#initialization;\n  }\n\n  private async initialize(): Promise<void> {\n    const issues: BetterAuthConfigurationError[] = [];\n    await this.instances.initialize(issues);\n    const hooks = this.hooks.discover(this.instances, issues);\n    for (const entry of this.instances.list()) {\n      const tables = hooks.get(entry.name) ?? emptyHookTables();\n      const unbound = entry.bridge.unboundDispatches;\n      const count =\n        tables.before.length +\n        tables.after.length +\n        Object.values(tables.database).reduce(\n          (sum, value) => sum + value.before.length + value.after.length,\n          0,\n        );\n      try {\n        const result = this.bridges.bind(entry, {\n          owner: this.instances.owner,\n          instance: entry.name,\n          state: \"initialized\",\n          current: () => this.scope.current()?.view,\n          credentialHeaders: entry.credentialHeaders,\n          ...tables,\n          onDropped: (path) =>\n            this.instances.logger.debug(\n              `Direct auth call '${path}' used foreign credentials; cookies dropped for '${entry.name}'.`,\n            ),\n        });\n        if (result.tookOverFrom) {\n          this.instances.logger.warn(\n            `W_INSTANCE_TAKEN_OVER: '${entry.name}' took over from never-bootstrapped '${result.tookOverFrom}'.`,\n          );\n        }\n        if (unbound > 0 && count > 0) {\n          this.instances.logger.warn(\n            `W_CALLS_BEFORE_BIND: '${entry.name}': ${unbound} auth dispatches or database writes ran before Nest hooks; move seeding to onApplicationBootstrap.`,\n          );\n        }\n      } catch (error) {\n        issues.push(\n          configurationIssue(\n            error,\n            \"INSTANCE_ALREADY_BOUND\",\n            `Cannot bind '${entry.name}' to this application.`,\n          ),\n        );\n      }\n    }\n    this.mounts.prepareAtInit(issues);\n    this.mounts.resolve(issues);\n    this.transports.setKit({ http: this.mounts.platform?.requests ?? null });\n    await this.validator.validate(issues);\n    if (issues.length) {\n      const failure = new BetterAuthConfigurationError(\n        \"AUTH_BOOT_FAILED\",\n        `Authentication bootstrap failed:\\n${issues.map((issue) => `[${issue.code}] ${issue.detail}${issue.hint ? ` Hint: ${issue.hint}` : \"\"}`).join(\"\\n\")}`,\n        \"Resolve every reported configuration problem before starting the application.\",\n      );\n      Object.defineProperty(failure, \"issues\", {\n        value: Object.freeze([...issues]),\n        enumerable: true,\n      });\n      throw failure;\n    }\n    this.validator.summary(hooks);\n    await this.mounts.mount();\n    this.#ready = true;\n  }\n\n  onApplicationBootstrap(): void {\n    if (this.#ready && this.instances.state !== \"bootstrapped\") {\n      this.bridges.bootstrap();\n      this.instances.state = \"bootstrapped\";\n    }\n  }\n\n  onApplicationShutdown(): void {\n    this.bridges.close();\n    this.instances.reset();\n    this.mounts.reset();\n    this.#initialization = undefined;\n    this.#ready = false;\n  }\n}\n","import type {\n  AuthorizationPolicy,\n  BootAdvice,\n  PrincipalSource,\n  Requirement,\n  SessionPrincipalOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  AuthSession,\n  GetSessionWithHeaders,\n  SessionPrincipal,\n} from \"./auth-types.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  getAPIErrorHeaders,\n} from \"./auth-errors.js\";\nimport { definePrincipalParam, Require } from \"./auth-decorators.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { absent, authenticated, rejected } from \"./principal-resolver.js\";\n\nexport const SESSION_PRINCIPAL_KIND = \"session\" as const;\nexport const CurrentSession = definePrincipalParam({\n  kind: SESSION_PRINCIPAL_KIND,\n  reason: \"SESSION_REQUIRED\",\n  project: (principal) => principal.session,\n});\nexport const CurrentUser = definePrincipalParam({\n  kind: SESSION_PRINCIPAL_KIND,\n  reason: \"SESSION_REQUIRED\",\n  project: (principal) =>\n    \"user\" in principal.session ? principal.session.user : undefined,\n});\nexport function readCurrentSession<S = AuthSession>(\n  readings: PrincipalReadings,\n): S | null {\n  return readings.project(readings.current(), {\n    kind: SESSION_PRINCIPAL_KIND,\n    reason: \"SESSION_REQUIRED\",\n    site: \"BetterAuthService.getSession\",\n    project: (principal) => (principal as SessionPrincipal<S>).session,\n  });\n}\nexport function sessionPrincipal<S = AuthSession>(\n  options: SessionPrincipalOptions<S> = {},\n): PrincipalSource<SessionPrincipal<S>> {\n  return {\n    id: \"better-auth:session\",\n    kinds: [SESSION_PRINCIPAL_KIND],\n    acceptance: \"default\",\n    credentialHeaders: [\"cookie\", \"authorization\"],\n    sessionBacked: true,\n    async resolve(request) {\n      const context = await request.auth.context();\n      const authoritative = request.freshness === \"authoritative\";\n      const query = {\n        ...(authoritative &&\n        (context.options.database || context.options.secondaryStorage)\n          ? { disableCookieCache: true }\n          : {}),\n        ...(request.cookies === null ? { disableRefresh: true } : {}),\n      };\n      let result: GetSessionWithHeaders;\n      try {\n        result = (await request.auth.run(\n          { cookies: request.cookies, forward: \"none\", internal: true },\n          () =>\n            request.auth.api.getSession({\n              headers: request.headers,\n              returnHeaders: true,\n              query,\n            }),\n        )) as GetSessionWithHeaders;\n      } catch (error) {\n        const failure = AuthFailures.fromAPIError(error);\n        if (!failure) {\n          throw error;\n        }\n        const cookies = getAPIErrorHeaders(error).getSetCookie();\n        if (cookies.length) {\n          request.cookies?.append(cookies);\n        }\n        return rejected(failure);\n      }\n      const cookies = result.headers?.getSetCookie() ?? [];\n      if (cookies.length) {\n        request.cookies?.append(cookies);\n      }\n      if (\n        result.response == null ||\n        (authoritative && !request.auth.producedByEndpoint(result.response))\n      ) {\n        return absent();\n      }\n      const userId = options.userId\n        ? options.userId(result.response as S)\n        : ((result.response as { user?: { id?: string } }).user?.id ?? null);\n      if (typeof userId !== \"string\" || !userId) {\n        throw BetterAuthConfigurationError.atRequest(\n          \"SESSION_USER_ID\",\n          \"session.userId must return a nonempty user id for a resolved session\",\n        );\n      }\n      return authenticated({\n        kind: SESSION_PRINCIPAL_KIND,\n        source: \"better-auth:session\",\n        userId,\n        session: result.response as S,\n      });\n    },\n    advise(context) {\n      const warnings: BootAdvice[] = [];\n      if (context.context.hasPlugin(\"jwt\")) {\n        warnings.push({\n          level: \"info\",\n          code: \"I_SESSION_JWT_COST\",\n          message:\n            \"Unless disableSettingJwtHeader is enabled, session reads may also sign a JWT.\",\n        });\n      }\n      if (context.context.hasPlugin(\"bearer\")) {\n        warnings.push({\n          level: \"info\",\n          code: \"I_SESSION_BEARER_COST\",\n          message:\n            \"Without requireSignature, foreign bearer tokens can trigger a session lookup.\",\n        });\n      }\n      const sites = context.handlers\n        .filter(\n          ({ plan }) =>\n            (plan.access === \"required\" || plan.access === \"optional\") &&\n            [...plan.accepts].some((kind) => kind !== SESSION_PRINCIPAL_KIND),\n        )\n        .map(({ plan }) => plan.site);\n      if (sites.length) {\n        warnings.push({\n          level: \"warn\",\n          code: \"W_MIXED_KIND_SESSION_READER\",\n          message: `If these handlers read getSession(), another authenticated kind throws SESSION_REQUIRED: ${sites.slice(0, 10).join(\", \")}`,\n          hint: \"Use getPrincipal() and narrow p.kind.\",\n        });\n      }\n      if (\n        context.context.hasPlugin(\"api-key\") &&\n        options.apiKeySessions !== false\n      ) {\n        warnings.push({\n          level: \"warn\",\n          code: \"W_API_KEY_FULL_SESSION\",\n          message: `${options.apiKeySessions ? \"API-key sessions grant\" : \"If enableSessionForAPIKeys is enabled, API-key sessions grant\"} full session access on ordinary authenticated routes.`,\n        });\n        if (\n          context.policies.some(\n            (policy) => policy.requires?.presentsCredentials,\n          )\n        ) {\n          warnings.push({\n            level: \"warn\",\n            code: \"W_API_KEY_SESSION_MULTIPLIER\",\n            message:\n              \"Policies presenting credentials can validate API-key sessions again and consume additional quota.\",\n          });\n        }\n      }\n      if (\n        context.context.hasPlugin(\"expo\") &&\n        context.originCheck.missingOrigin === \"reject\"\n      ) {\n        warnings.push({\n          level: \"warn\",\n          code: \"W_ORIGIN_CHECK_NATIVE_CLIENTS\",\n          message:\n            \"Native clients must send a trusted Origin for cookie-carrying operations.\",\n        });\n      }\n      return warnings;\n    },\n  };\n}\nconst freshPolicy: AuthorizationPolicy<{ maxAgeSeconds?: number }> = {\n  id: \"better-auth:session/fresh\",\n  requires: { principals: [SESSION_PRINCIPAL_KIND] },\n  validate(params) {\n    if (\n      params.maxAgeSeconds !== undefined &&\n      (!Number.isFinite(params.maxAgeSeconds) || params.maxAgeSeconds < 0)\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"INVALID_FRESH_AGE\",\n        \"maxAgeSeconds must be finite and nonnegative\",\n      );\n    }\n  },\n  advise(context) {\n    return context.context.hasPlugin(\"custom-session\")\n      ? [\n          {\n            level: \"warn\",\n            code: \"W_FRESH_SESSION_SHAPE\",\n            message:\n              \"freshSession requires custom session results to retain session.createdAt; unsupported shapes deny PRINCIPAL_NOT_SUPPORTED.\",\n          },\n        ]\n      : [];\n  },\n  async evaluate(params, context) {\n    const principal = context.principal as SessionPrincipal;\n    const createdAt = (\n      principal.session as { session?: { createdAt?: unknown } }\n    ).session?.createdAt;\n    const age =\n      params.maxAgeSeconds ??\n      (await context.auth.context()).sessionConfig.freshAge;\n    if (age === 0) {\n      return { effect: \"allow\" };\n    }\n    if (\n      !(createdAt instanceof Date) &&\n      typeof createdAt !== \"string\" &&\n      typeof createdAt !== \"number\"\n    ) {\n      return { effect: \"deny\", reason: \"PRINCIPAL_NOT_SUPPORTED\" };\n    }\n    const time = new Date(createdAt).getTime();\n    return Number.isFinite(time) && Date.now() - time < age * 1000\n      ? { effect: \"allow\" }\n      : { effect: \"deny\", status: 403, reason: \"SESSION_NOT_FRESH\" };\n  },\n};\nexport const freshSession = (\n  options: { maxAgeSeconds?: number } = {},\n): Requirement<{ maxAgeSeconds?: number }> => ({\n  policy: freshPolicy,\n  params: options,\n});\nexport const RequireFreshSession = (options?: {\n  maxAgeSeconds?: number;\n}): ClassDecorator & MethodDecorator => Require(freshSession(options));\n","import { Inject, type ExecutionContext } from \"@nestjs/common\";\nimport type {\n  BetterAuthRuntimeOptions,\n  PrincipalReading,\n} from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport {\n  getBetterAuthOptionsToken,\n  INSTANCE_REGISTRY,\n  MOUNT_COORDINATOR,\n  PRINCIPAL_READINGS,\n  REQUEST_SCOPE,\n  ROUTE_PLANNER,\n  TRANSPORT_REGISTRY,\n} from \"./auth-tokens.js\";\nimport type {\n  AuthLike,\n  AuthPrincipal,\n  RegisteredAuth,\n  SessionOf,\n} from \"./auth-types.js\";\nimport { derivedScope } from \"./bridge-client.js\";\nimport type { InstanceRegistry } from \"./instance-registry.js\";\nimport type { MountCoordinator } from \"./mount-coordinator.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport { readCurrentSession } from \"./session-principal.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\nexport class BetterAuthService<A extends AuthLike = RegisteredAuth> {\n  readonly name: string;\n  readonly instance: A;\n  readonly api: A[\"api\"];\n  readonly #context: Promise<Awaited<A[\"$context\"]>>;\n\n  constructor(\n    @Inject(getBetterAuthOptionsToken()) options: BetterAuthRuntimeOptions<A>,\n    @Inject(INSTANCE_REGISTRY) private readonly registry: InstanceRegistry,\n    @Inject(REQUEST_SCOPE) private readonly scope: RequestScope,\n    @Inject(PRINCIPAL_READINGS) private readonly readings: PrincipalReadings,\n    @Inject(ROUTE_PLANNER) private readonly planner: RoutePlanner,\n    @Inject(TRANSPORT_REGISTRY) private readonly transports: TransportRegistry,\n    @Inject(MOUNT_COORDINATOR) private readonly coordinator: MountCoordinator,\n  ) {\n    const registration = registry\n      .registrations()\n      .find((value) => value.options === options);\n    if (!registration) {\n      throw new BetterAuthConfigurationError(\n        \"UNKNOWN_INSTANCE\",\n        \"The service options have no registered instance.\",\n      );\n    }\n    this.name = registration.name;\n    this.instance = options.auth;\n    this.api = options.auth?.api;\n    this.#context = options.auth?.$context as Promise<Awaited<A[\"$context\"]>>;\n  }\n\n  context(): Promise<Awaited<A[\"$context\"]>> {\n    return this.#context;\n  }\n\n  mount():\n    | {\n        readonly basePath: string;\n        readonly bodyLimit: number;\n        readonly platform: string;\n      }\n    | undefined {\n    const binding = this.coordinator.binding(this.name);\n    const platform = this.coordinator.platform;\n    return binding && platform\n      ? {\n          basePath: binding.basePath,\n          bodyLimit: binding.bodyLimit,\n          platform: platform.id,\n        }\n      : undefined;\n  }\n\n  getPrincipal(): Promise<AuthPrincipal | null> {\n    const reading = this.readings.current();\n    return Promise.resolve(\n      this.readings.project(reading, {\n        site: \"BetterAuthService.getPrincipal\",\n        project: (principal) => principal,\n      }),\n    );\n  }\n\n  getSession(): Promise<SessionOf<A> | null> {\n    return Promise.resolve(readCurrentSession<SessionOf<A>>(this.readings));\n  }\n\n  principalFor(context: ExecutionContext): PrincipalReading {\n    const plan = this.planner.forContext(context);\n    const transport = this.transports.find(context);\n    const lineage = transport?.lineage?.(context);\n    const call =\n      plan.access !== \"public\" && plan.access !== \"inherit\" && transport\n        ? this.transports.describe(context, transport)\n        : undefined;\n    return this.readings.read({\n      args: context.getArgs(),\n      plan,\n      call,\n      lineage,\n      beforeGuard: true,\n    });\n  }\n\n  headersFrom(platformRequest: unknown): Headers {\n    const accessor = this.coordinator.platform?.requests;\n    if (!accessor?.isRequest(platformRequest)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"NO_HTTP_REQUEST\",\n        \"headersFrom needs a request from the selected HTTP platform.\",\n      );\n    }\n    const entry = this.registry.get(this.name);\n    const headers = new Headers(accessor.headers(platformRequest));\n    for (const name of [...headers.keys()]) {\n      if (\n        name.startsWith(\":\") ||\n        name.startsWith(\"x-nsba-ip-\") ||\n        name === entry.bridge.clientIpHeader?.toLowerCase()\n      ) {\n        headers.delete(name);\n      }\n    }\n    const clientIp = accessor.clientIp(platformRequest);\n    if (entry.bridge.clientIpHeader && clientIp !== null) {\n      headers.set(entry.bridge.clientIpHeader, clientIp);\n    }\n    return headers;\n  }\n\n  forwardForeignCookies<T>(fn: () => Promise<T>): Promise<T> {\n    const outer = this.scope.current();\n    if (!outer?.plan?.forwardDirectCalls) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"FORWARDING_NOT_DECLARED\",\n        \"Declare cookie forwarding on the active handler before forwarding foreign credentials.\",\n        { hint: \"Use @ForwardAuthCookies() on a guarded handler.\" },\n      );\n    }\n    return this.scope.run(\n      derivedScope(this.scope, {\n        get cookies() {\n          return outer.view.cookies;\n        },\n        get inbound() {\n          return outer.view.inbound;\n        },\n        get internal() {\n          return outer.view.internal;\n        },\n        forward: \"any\",\n      }),\n      fn,\n    );\n  }\n\n  withoutCookies<T>(fn: () => Promise<T>): Promise<T> {\n    const outer = this.scope.current();\n    return this.scope.run(\n      derivedScope(this.scope, {\n        cookies: null,\n        forward: \"none\",\n        get inbound() {\n          return outer?.view.inbound;\n        },\n        get internal() {\n          return outer?.view.internal ?? false;\n        },\n      }),\n      fn,\n    );\n  }\n\n  runOutsideScope<T>(fn: () => Promise<T>): Promise<T> {\n    return this.scope.exit(fn);\n  }\n}\n","import {\n  ForbiddenException,\n  Get,\n  HttpException,\n  Inject,\n  RequestMethod,\n  UnauthorizedException,\n} from \"@nestjs/common\";\nimport type { ExecutionContext } from \"@nestjs/common\";\nimport { HttpAdapterHost, MetadataScanner } from \"@nestjs/core\";\nimport type { AuthErrorBody, AuthFailure } from \"./auth-errors.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type {\n  AuthTransport,\n  ExtensionRef,\n  TransportCall,\n  TransportKit,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\n\n/** HTTP controller transport constructed by Nest so denial headers use its adapter. */\nexport class HttpTransport implements AuthTransport {\n  readonly id = \"http\";\n\n  constructor(\n    @Inject(HttpAdapterHost) private readonly adapterHost: HttpAdapterHost,\n  ) {}\n\n  handles(context: ExecutionContext): boolean {\n    return context.getType() === \"http\";\n  }\n\n  describe(context: ExecutionContext, kit: TransportKit): TransportCall {\n    const http = context.switchToHttp();\n    const request = http.getRequest<unknown>();\n    const response = http.getResponse<unknown>();\n    const key = kit.http\n      ? kit.http.key(request)\n      : typeof request === \"object\" && request !== null\n        ? request\n        : context.getArgs();\n    const accessor = () => {\n      if (!kit.http) {\n        throw BetterAuthConfigurationError.atRequest(\n          \"HTTP_PLATFORM_MISSING\",\n          \"No HTTP platform is available for this request\",\n          {\n            hint: \"Register the HTTP platform that supports the application's adapter.\",\n          },\n        );\n      }\n      return kit.http;\n    };\n    return {\n      key,\n      invocation: key,\n      headers: () => accessor().headers(request),\n      get clientIp() {\n        return accessor().clientIp(request);\n      },\n      get cookies() {\n        return accessor().cookieSink(request, response);\n      },\n      get request() {\n        return accessor().request(request);\n      },\n      param: (name) => accessor().param(request, name),\n      get browser() {\n        const info = accessor().request(request);\n        return {\n          enforce: ![\"GET\", \"HEAD\", \"OPTIONS\"].includes(\n            info.method.toUpperCase(),\n          ),\n          headers: () => accessor().headers(request),\n          url: info.url,\n          key,\n        };\n      },\n    };\n  }\n\n  toException(failure: AuthFailure, context: ExecutionContext): unknown {\n    const adapter = this.adapterHost.httpAdapter;\n    const response = context.switchToHttp().getResponse();\n    if (adapter && response) {\n      if (failure.challenge) {\n        adapter.setHeader(response, \"WWW-Authenticate\", failure.challenge);\n      }\n      const retryAfter = failure.headers?.get(\"retry-after\");\n      if (\n        failure.status === 429 &&\n        retryAfter !== null &&\n        retryAfter !== undefined\n      ) {\n        adapter.setHeader(response, \"Retry-After\", retryAfter);\n      }\n    }\n    const body: AuthErrorBody = {\n      statusCode: failure.status,\n      error:\n        failure.status === 401\n          ? \"Unauthorized\"\n          : failure.status === 403\n            ? \"Forbidden\"\n            : \"Too Many Requests\",\n      code: failure.code,\n      ...(failure.reason ? { reason: failure.reason } : {}),\n      message: failure.message,\n    };\n    if (failure.status === 401) {\n      return new UnauthorizedException(body);\n    }\n    if (failure.status === 403) {\n      return new ForbiddenException(body);\n    }\n    return new HttpException(body, 429);\n  }\n\n  validate(context: TransportValidationContext): void {\n    class Probe {\n      route(): void {}\n    }\n    Get(\"/nsba-canary/:id\")(\n      Probe.prototype,\n      \"route\",\n      Object.getOwnPropertyDescriptor(Probe.prototype, \"route\")!,\n    );\n    if (\n      Reflect.getMetadata(\"path\", Probe.prototype.route) !==\n        \"/nsba-canary/:id\" ||\n      Reflect.getMetadata(\"method\", Probe.prototype.route) !== RequestMethod.GET\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"NEST_METADATA_KEY_CHANGED\",\n        \"Nest HTTP route metadata failed its path/method canary\",\n      );\n    }\n    const scanner = new MetadataScanner();\n    for (const wrapper of context.discovery.getControllers()) {\n      const target = wrapper.metatype;\n      if (!target?.prototype || wrapper.isAlias) {\n        continue;\n      }\n      const controllerPaths: unknown = Reflect.getMetadata(\"path\", target);\n      for (const method of scanner.getAllMethodNames(target.prototype)) {\n        const handler: unknown = target.prototype[method];\n        if (\n          typeof handler !== \"function\" ||\n          Reflect.getMetadata(\"method\", handler) === undefined\n        ) {\n          continue;\n        }\n        const handlerPaths: unknown = Reflect.getMetadata(\"path\", handler);\n        const paths = [controllerPaths, handlerPaths].flatMap(\n          (value): string[] =>\n            typeof value === \"string\"\n              ? [value]\n              : Array.isArray(value)\n                ? value.filter(\n                    (item): item is string => typeof item === \"string\",\n                  )\n                : [],\n        );\n        const inputs = [\n          ...new Set(\n            paths.flatMap((path) =>\n              [...path.matchAll(/:([A-Za-z0-9_]+)/g)].map((match) => match[1]!),\n            ),\n          ),\n        ];\n        context.claim(target, method, \"global\", {\n          code: \"ROUTE_UNGUARDED\",\n          inputs,\n          hint: \"Register the global guard (globalGuard: true) or add @UseBetterAuth() to the controller.\",\n        });\n      }\n    }\n  }\n}\n\nexport function httpTransport(): ExtensionRef<AuthTransport> {\n  return HttpTransport;\n}\n","import type {\n  DynamicModule,\n  InjectionToken,\n  Provider,\n  Type,\n} from \"@nestjs/common\";\nimport { APP_GUARD, APP_INTERCEPTOR } from \"@nestjs/core\";\nimport type {\n  AuthTransport,\n  BetterAuthAppOptions,\n  BetterAuthModuleAsyncOptions,\n  BetterAuthModuleOptions,\n  BetterAuthRuntimeOptions,\n  BetterAuthStaticOptions,\n  ExtensionDefinition,\n  ExtensionRef,\n  HttpPlatform,\n  PrincipalSource,\n} from \"./auth-contracts.js\";\nimport { BetterAuthCoreModule } from \"./auth-core-module.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { BetterAuthService } from \"./auth-service.js\";\nimport {\n  getBetterAuthHandleToken,\n  getBetterAuthInstanceToken,\n  getBetterAuthOptionsToken,\n  getBetterAuthServiceToken,\n  getExtensionToken,\n  getPrincipalSourcesToken,\n  INSTANCE_REGISTRY,\n  MOUNT_COORDINATOR,\n  PLATFORMS,\n  PRINCIPAL_READINGS,\n  REQUEST_SCOPE,\n  ROUTE_PLANNER,\n  TRANSPORT_REGISTRY,\n  TRANSPORTS,\n} from \"./auth-tokens.js\";\nimport type { AuthLike } from \"./auth-types.js\";\nimport { EXTENSION_DEFINITION } from \"./bridge-protocol.js\";\nimport { httpTransport } from \"./http-transport.js\";\nimport type {\n  InstanceRegistration,\n  InstanceRegistry,\n} from \"./instance-registry.js\";\nimport type { MountCoordinator } from \"./mount-coordinator.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport { sessionPrincipal } from \"./session-principal.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\nexport function defineExtension<T>(\n  definition: Omit<ExtensionDefinition<T>, typeof EXTENSION_DEFINITION>,\n): ExtensionDefinition<T> {\n  return { ...definition, [EXTENSION_DEFINITION]: true };\n}\nexport function defineHttpPlatform<P extends HttpPlatform>(platform: P): P {\n  return platform;\n}\nexport function defineTransport<T extends AuthTransport>(transport: T): T {\n  return transport;\n}\n\nconst STATIC_KEYS = [\n  \"name\",\n  \"isGlobal\",\n  \"globalGuard\",\n  \"globalScope\",\n  \"principals\",\n  \"platforms\",\n  \"transports\",\n] as const;\nexport function moduleDefinition(\n  module: Type,\n  definition: (\n    | BetterAuthModuleOptions<AuthLike>\n    | BetterAuthModuleAsyncOptions<AuthLike>\n  ) &\n    BetterAuthAppOptions,\n  async: boolean,\n): DynamicModule {\n  const name = definition.name || \"default\";\n  const providers: Provider[] = [];\n  const imports: NonNullable<DynamicModule[\"imports\"]> = [BetterAuthCoreModule];\n  const exports: NonNullable<DynamicModule[\"exports\"]> = [];\n  const registrationToken = Symbol(`registration:${name}`);\n  const staticOptions: BetterAuthStaticOptions = {\n    name,\n    isGlobal: definition.isGlobal,\n    globalGuard: definition.globalGuard,\n    globalScope: definition.globalScope,\n    principals: definition.principals,\n  };\n  const appOptions: BetterAuthAppOptions = {\n    platforms: definition.platforms,\n    transports: definition.transports,\n  };\n  const optionsToken = getBetterAuthOptionsToken(name);\n  if (async) {\n    const factory = definition as BetterAuthModuleAsyncOptions<AuthLike>;\n    imports.push(...(factory.imports ?? []));\n    providers.push({\n      provide: optionsToken,\n      inject: [...(factory.inject ?? [])],\n      useFactory: async (...deps: unknown[]) => {\n        const options = await factory.useFactory(...deps);\n        for (const key of STATIC_KEYS) {\n          if (Object.hasOwn(options, key)) {\n            throw new BetterAuthConfigurationError(\n              \"STATIC_OPTION_IN_FACTORY\",\n              `'${key}' was returned from useFactory.`,\n              `Pass '${key}' next to useFactory in forRootAsync().`,\n            );\n          }\n        }\n        return options;\n      },\n    });\n  } else {\n    const runtime = { ...definition } as Record<string, unknown>;\n    for (const key of STATIC_KEYS) {\n      delete runtime[key];\n    }\n    providers.push({ provide: optionsToken, useValue: runtime });\n  }\n\n  function extensions<T>(\n    point: \"platforms\" | \"transports\" | \"principals\",\n    refs: readonly ExtensionRef<T>[],\n  ): InjectionToken[] {\n    return refs.map((ref, index) => {\n      const token = getExtensionToken(point, name, index);\n      if (typeof ref === \"function\") {\n        providers.push({ provide: token, useClass: ref as Type<T> });\n      } else if (\n        ref &&\n        typeof ref === \"object\" &&\n        Reflect.get(ref, EXTENSION_DEFINITION) === true\n      ) {\n        const definition = ref as ExtensionDefinition<T>;\n        imports.push(...(definition.imports ?? []));\n        providers.push(...(definition.providers ?? []));\n        if (\"useClass\" in definition.use) {\n          providers.push({ provide: token, useClass: definition.use.useClass });\n        } else if (\"useExisting\" in definition.use) {\n          providers.push({\n            provide: token,\n            useExisting: definition.use.useExisting,\n          });\n        } else {\n          providers.push({\n            provide: token,\n            useFactory: definition.use.useFactory,\n            inject: [...(definition.use.inject ?? [])],\n          });\n        }\n        exports.push(...(definition.exports ?? []));\n      } else {\n        providers.push({ provide: token, useValue: ref });\n      }\n      return token;\n    });\n  }\n\n  const sourceTokens = extensions(\"principals\", definition.principals ?? []);\n  providers.push({\n    provide: getPrincipalSourcesToken(name),\n    inject: [optionsToken, ...sourceTokens],\n    useFactory: (\n      options: BetterAuthRuntimeOptions<AuthLike>,\n      ...sources: PrincipalSource[]\n    ) => {\n      const builtIn = sessionPrincipal(\n        options.session === false ? undefined : options.session,\n      );\n      return options.session === false ? sources : [...sources, builtIn];\n    },\n  });\n  providers.push({\n    provide: registrationToken,\n    inject: [INSTANCE_REGISTRY, optionsToken, getPrincipalSourcesToken(name)],\n    useFactory: (\n      registry: InstanceRegistry,\n      options: BetterAuthRuntimeOptions<AuthLike>,\n      sources: PrincipalSource[],\n    ) => registry.register(options, staticOptions, sources, appOptions),\n  });\n  providers.push({\n    provide: getBetterAuthInstanceToken(name),\n    inject: [registrationToken],\n    useFactory: (registration: InstanceRegistration) => registration.instance,\n  });\n  providers.push({\n    provide: getBetterAuthHandleToken(name),\n    inject: [registrationToken],\n    useFactory: (registration: InstanceRegistration) => registration.handle,\n  });\n  const serviceProvider: Provider = {\n    provide: getBetterAuthServiceToken(name),\n    inject: [\n      registrationToken,\n      INSTANCE_REGISTRY,\n      REQUEST_SCOPE,\n      PRINCIPAL_READINGS,\n      ROUTE_PLANNER,\n      TRANSPORT_REGISTRY,\n      MOUNT_COORDINATOR,\n    ],\n    useFactory: (\n      registration: InstanceRegistration,\n      registry: InstanceRegistry,\n      scope: RequestScope,\n      readings: PrincipalReadings,\n      planner: RoutePlanner,\n      transports: TransportRegistry,\n      mounts: MountCoordinator,\n    ) =>\n      new BetterAuthService(\n        registration.options,\n        registry,\n        scope,\n        readings,\n        planner,\n        transports,\n        mounts,\n      ),\n  };\n  if (name === \"default\") {\n    providers.push(\n      { ...serviceProvider, provide: BetterAuthService },\n      {\n        provide: getBetterAuthServiceToken(name),\n        useExisting: BetterAuthService,\n      },\n    );\n    exports.push(BetterAuthService);\n    const platformTokens = extensions(\"platforms\", definition.platforms ?? []);\n    const transportTokens = extensions(\"transports\", [\n      ...(definition.transports ?? []),\n      httpTransport(),\n    ]);\n    providers.push({\n      provide: PLATFORMS,\n      inject: [MOUNT_COORDINATOR, ...platformTokens],\n      useFactory: (mounts: MountCoordinator, ...platforms: HttpPlatform[]) => {\n        mounts.registerPlatforms(platforms);\n        return platforms;\n      },\n    });\n    providers.push({\n      provide: TRANSPORTS,\n      inject: [TRANSPORT_REGISTRY, ...transportTokens],\n      useFactory: (\n        registry: TransportRegistry,\n        ...transports: AuthTransport[]\n      ) => {\n        registry.register(transports);\n        return transports;\n      },\n    });\n  } else {\n    providers.push(serviceProvider);\n  }\n  if (definition.globalGuard ?? name === \"default\") {\n    providers.push({ provide: APP_GUARD, useExisting: BetterAuthGuard });\n  }\n  if (name === \"default\" && (definition.globalScope ?? true)) {\n    providers.push({\n      provide: APP_INTERCEPTOR,\n      useExisting: BetterAuthScopeInterceptor,\n    });\n  }\n  exports.push(\n    optionsToken,\n    getBetterAuthInstanceToken(name),\n    getBetterAuthHandleToken(name),\n    getBetterAuthServiceToken(name),\n  );\n  return {\n    module,\n    global: definition.isGlobal ?? true,\n    imports,\n    providers,\n    exports,\n  };\n}\n","import { Module, type DynamicModule } from \"@nestjs/common\";\nimport type {\n  BetterAuthAppOptions,\n  BetterAuthModuleAsyncOptions,\n  BetterAuthModuleOptions,\n  DefaultInstanceCheck,\n  NoAppOptions,\n} from \"./auth-contracts.js\";\nimport { moduleDefinition } from \"./auth-module-definition.js\";\nimport type { AuthLike, RegisteredAuth } from \"./auth-types.js\";\n\n@Module({})\nexport class BetterAuthModule {\n  static forRoot<A extends AuthLike = RegisteredAuth>(\n    options: BetterAuthModuleOptions<A> &\n      BetterAuthAppOptions & { name?: \"default\" } & DefaultInstanceCheck<A>,\n  ): DynamicModule;\n  static forRoot<A extends AuthLike>(\n    options: BetterAuthModuleOptions<A> & { name: string } & NoAppOptions,\n  ): DynamicModule;\n  static forRoot<A extends AuthLike>(\n    options: BetterAuthModuleOptions<A> & BetterAuthAppOptions,\n  ): DynamicModule {\n    return moduleDefinition(\n      BetterAuthModule,\n      options as BetterAuthModuleOptions<AuthLike> & BetterAuthAppOptions,\n      false,\n    );\n  }\n\n  static forRootAsync<A extends AuthLike = RegisteredAuth>(\n    options: BetterAuthModuleAsyncOptions<A> &\n      BetterAuthAppOptions & { name?: \"default\" },\n  ): DynamicModule;\n  static forRootAsync<A extends AuthLike>(\n    options: BetterAuthModuleAsyncOptions<A> & { name: string } & NoAppOptions,\n  ): DynamicModule;\n  static forRootAsync<A extends AuthLike>(\n    options: BetterAuthModuleAsyncOptions<A> & BetterAuthAppOptions,\n  ): DynamicModule {\n    return moduleDefinition(\n      BetterAuthModule,\n      options as BetterAuthModuleAsyncOptions<AuthLike> & BetterAuthAppOptions,\n      true,\n    );\n  }\n}\n"],"mappings":";;;;;;;;AAWA,SAAS,QAAQ,QAAwB;CACvC,MAAM,SAAmB,CAAC;CAC1B,KACE,IAAI,UAAyB,QAC7B,WAAW,YAAY,SAAS,WAChC,UAAU,OAAO,eAAe,OAAO,GAEvC,OAAO,KAAK,OAAO;CAErB,OAAO;AACT;AACA,SAAS,IAAO,KAAa,QAA+B;CAC1D,OAAO,QAAQ,eAAe,KAAK,MAAM;AAC3C;AACA,SAAS,QAAW,KAAa,SAA2C;CAC1E,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,QAAQ,IAAO,KAAK,MAAM;EAChC,IAAI,UAAU,KAAA,GACZ,OAAO;CAEX;AAEF;AAEA,SAAgB,WAAW,QAAc,SAA2B;CAClE,KACE,IAAI,YAAY,OAAO,WACvB,aAAa,cAAc,OAAO,WAClC,YAAY,OAAO,eAAe,SAAS,GAE3C,KAAK,MAAM,QAAQ,OAAO,oBAAoB,SAAS,GACrD,IACE,SAAS,iBACT,OAAO,yBAAyB,WAAW,IAAI,CAAC,EAAE,UAAU,SAE5D,OAAO;CAIb,MAAM,IAAI,6BACR,mBACA,4BAA4B,OAAO,MACrC;AACF;AACA,IAAa,eAAb,MAA0B;CAKL;CACA;CACA;CALnB,wBAAyB,IAAI,QAA4C;CAEzE,YACE,WACA,UACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,WAAA;EACA,KAAA,aAAA;CAChB;CAEH,QAAgB,QAAc,QAAgB;EAE5C,MAAM,UAAU,QAAQ,IAAI,OAAO,WAAW,MAAM;EACpD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,6BACR,mBACA,GAAG,OAAO,KAAK,GAAG,OAAO,kBAC3B;EAEF,MAAM,QAAQ,QAAQ,MAAM;EAC5B,MAAM,SACJ,KAAK,WAAW,iBAAiB,QAAQ,MAAM,MAAM;EACvD,MAAM,SAAS,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,GAAG,KAAK;EACtD,MAAM,OAAO,GAAG,OAAO,KAAK,GAAG;EAC/B,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,SAAS,IAAYA,iBAAsB,KAAK;GACtD,KACG,WAAW,YAAY,WAAW,gBAClC,IAAgCC,uBAA4B,KAAK,CAAC,EAC/D,UAAU,KAAK,GAEnB,MAAM,IAAI,6BACR,wBACA,GAAG,KAAK,8DACV;EAEJ;EACA,MAAM,WACJ,QAAgBC,wBAA6B,CAAC,SAAS,GAAG,KAAK,CAAC,KAChE;EACF,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ;EACzC,IAAI,SAA8B,SAC9B,YACA,MAAM,QAAQ,kBAAkB,WAC9B,WACA;EACN,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,WAAW,IAAyBF,iBAAsB,KAAK;GACrE,IAAI,UAAU;IACZ,SAAS;IACT;GACF;GACA,KACG,IAAgCC,uBAA4B,KAAK,CAAC,EAC/D,UAAU,KAAK,KAClB,UAAU,IAAIE,4BAAiC,KAAK,MAAM,KAAA,GAC3D;IACA,SAAS;IACT;GACF;EACF;EACA,MAAM,QACJ,QAAiBC,oCAAyC,MAAM,MAChE;EACF,MAAM,uBACJ,WAAW,aACP;GACE,IAAI,QAAQ,CAAC,IAAK,MAAM,QAAQ,uBAAuB,CAAC,EAAA,CAAI,KACzD,gBAAgB;IAAE;IAAY,QAAQ;GAAsB,EAC/D;GACA,GAAI,SACA,CAAC,IACD,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,WAE1B,IACEH,uBACA,KACF,KAAK,CAAC,EAAA,CACN,KAAK,gBAAgB;IACrB;IACA,QAAQ,GAAI,MAAe,KAAK;GAClC,EAAE,CACJ;GACJ,IACE,IACEA,uBACA,OACF,KAAK,CAAC,EAAA,CACN,KAAK,gBAAgB;IAAE;IAAY,QAAQ,GAAG,KAAK;GAAW,EAAE;EACpE,IACA,CAAC;EACP,MAAM,eAAe,qBAAqB,KAAK,SAAS,KAAK,UAAU;EACvE,OAAO;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CAEA,eAAe,QAAc,QAA4C;EACvE,OAAO,OAAO,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC,CAAC,YAAY;CAChE;CAEA,WAAW,SAAsC;EAC/C,IAAI;GACF,OAAO,KAAK,KACV,QAAQ,SAAS,GACjB,WAAW,QAAQ,SAAS,GAAG,QAAQ,WAAW,CAAC,CACrD;EACF,SAAS,OAAO;GACd,IAAI,qBAAqB,KAAK,KAAK,MAAM,UAAU,WACjD,MAAM,6BAA6B,UAAU,MAAM,MAAM,MAAM,QAAQ;IACrE,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;IACzD,MAAM,MAAM;GACd,CAAC;GAEH,MAAM;EACR;CACF;CAEA,KAAK,QAAc,QAA2B;EAE5C,MAAM,UAAU,QAAQ,IAAI,OAAO,WAAW,MAAM;EACpD,IAAI,QAAQ,KAAK,MAAM,IAAI,MAAM;EACjC,MAAM,WAAW,OAAO,IAAI,OAAO;EACnC,IAAI,UACF,OAAO;EAET,MAAM,IAAI,KAAK,QAAQ,QAAQ,MAAM;EACrC,MAAM,EAAE,OAAO,QAAQ,UAAU;EACjC,MAAM,WAAW,IAAI,IACnB,MAAM,QAAQ,SAAS,WAAW,CAAC,GAAG,OAAO,KAAK,CAAC,CACrD;EACA,MAAM,UAAU,IAAI,IAClB,QAA2BE,4BAAiC,MAAM,KAChE,MAAM,QACH,QAAQ,WAAW,OAAO,eAAe,SAAS,CAAC,CACnD,SAAS,WAAW,CAAC,GAAG,OAAO,KAAK,CAAC,CAC5C;EACA,IAAI,QACF,QAAiBE,oBAAyB,MAAM,MAAM,QACrD,MAAM,QAAQ,YAAY,SACzB,MAAM,QAAQ,SAAS,cAAc;EACzC,MAAM,YAAY,eAA6C;GAC7D,IAAI,WAAW,YACb,OAAO,IAAI,IACT,WAAW,MAAM,SAAS,UAAU,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC1D;GAEF,IAAI,WAAW,YACb,OAAO,aAAa,WAAW,MAAM,IAAI,QAAQ,GAAG,QAAQ;GAE9D,MAAM,SAAS,KAAK,SAAS,QAAQ,WAAW,MAAM;GACtD,MAAM,QAAQ,WAAW,cAAc,OAAO,UAAU;GACxD,IAAI,WAAW,iBAAiB,OAAO,UAAU,eAC/C,QAAQ;GAEV,IAAI,OACF,KAAK,MAAM,QAAQ,OACjB,QAAQ,IAAI,IAAI;GAGpB,OAAO,IAAI,IACT,SACE,MAAM,QACH,QAAQ,WAAW,CAAC,OAAO,SAAS,CAAC,CACrC,SAAS,WAAW,CAAC,GAAG,OAAO,KAAK,CAAC,CAC5C;EACF;EACA,MAAM,YAAY,EAAE,aAAa,IAAI,QAAQ;EAC7C,KAAK,MAAM,QAAQ,SACjB,IAAI,CAAC,SAAS,IAAI,IAAI,GACpB,MAAM,IAAI,6BACR,0BACA,GAAG,EAAE,KAAK,sCAAsC,MAClD;EAGJ,MAAM,aACJ,IACEC,2BACA,OACF,KAAK,CAAC;EACR,IAAI,EAAE,WAAW,YAAY,WAAW,QACtC,MAAM,IAAI,6BACR,0BACA,GAAG,EAAE,KAAK,yCACV,kBACF;EAEF,MAAM,kBAAkB,WAAW,SAAS,UAC1C,MAAM,OAAO,CAAC;GAAE,MAAM,MAAM;GAAM,QAAQ,MAAM;EAAQ,CAAC,IAAI,CAAC,CAChE;EACA,IAAI,EAAE,WAAW,WACV;QAAA,MAAM,SAAS,iBAClB,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,MAAM,IAAI,GACjD,MAAM,IAAI,6BACR,4BACA,GAAG,EAAE,KAAK,qDACV,sCACF;EAAA;EAIN,IACE,EAAE,WAAW,cACb,CAAC,aAAa,CAAC,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,MACjD;GACA,MAAM,YAAY,eAAwC;IACxD,IAAI,WAAW,YACb,OAAO,SAAS,WAAW,MAAM,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE;IAE5D,IAAI,WAAW,YACb,OAAO,SAAS,WAAW,MAAM,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE;IAE5D,OAAO,WAAW,SAAS,KAAK,SAAS,QAAQ,WAAW,MAAM,CAAC,CAAC;GACtE;GACA,MAAM,eAAe,EAAE,qBAAqB,KACzC,EAAE,YAAY,aAAa,GAAG,OAAO,IAAI,SAAS,UAAU,GAC/D;GACA,MAAM,IAAI,6BACR,iCACA,GAAG,EAAE,KAAK,+EAA+E,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,OAAO,GAAG,aAAa,SAAS,kBAAkB,aAAa,KAAK,IAAI,EAAE,KAAK,MACnM,EAAE,qBAAqB,MACpB,SAAS,KAAK,WAAW,qBAC5B,IACI,iIACA,kIACN;EACF;EACA,MAAM,qBACJ,QAAiBC,0BAA+B,CAAC,SAAS,GAAG,KAAK,CAAC,KACnE,MAAM,QAAQ,SAAS,sBACvB;EACF,MAAM,cACJ,QAAiBC,4BAAiC,CAAC,SAAS,GAAG,KAAK,CAAC,KACrE,MAAM,QAAQ,aAAa,SAAS,QAChC,QACA,qBACE,SACA;EACR,MAAM,WACJ,sBACA,OAAO,MAAM,UAAU;GACrB,MAAM,SAAS,IAAYR,iBAAsB,KAAK;GACtD,OACE,WAAW,cACX,WAAW,cACX;IACEG;IACAF;IACAK;IACAG;GACF,CAAC,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,MAAM,KAAA,CAAS;EAEjD,CAAC;EACH,MAAM,OAAkB,OAAO,OAAO;GACpC,UAAU,EAAE;GACZ,QAAQ,EAAE;GACV,QAAQ,EAAE;GACV,MAAM,EAAE;GACR,cAAc,OAAO,OAAO,EAAE,YAAY;GAC1C,0BAA0B,EAAE,WAAW,cAAc,EAAE;GACvD,WAAW,QAAQ,kBAAkB;GACrC;GACA,iBAAiB,OAAO,OAAO,eAAe;GAC9C;GACA,WAAW,KAAK,UACd,MAAM,QAAQ,SAAS,QAAQ,UAC7B,OAAO,MAAM,MAAM,SAAS,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAC9D,CACF;GACA;GACA;EACF,CAAC;EACD,IAAI,CAAC,OAAO;GACV,wBAAQ,IAAI,QAAQ;GACpB,KAAK,MAAM,IAAI,QAAQ,KAAK;EAC9B;EACA,MAAM,IAAI,SAAS,IAAI;EACvB,OAAO;CACT;AACF;AACA,SAAS,aACP,MACA,UACa;CACb,OAAO,IAAI,IACT,CAAC,GAAG,QAAQ,CAAC,CAAC,QAAQ,SAAS,KAAK,OAAO,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,CACnE;AACF;;;ACnUA,MAAa,eAAsC,EAAE,QAAQ,QAAQ;AACrE,MAAa,QAAQ,WAKS;CAAE,QAAQ;CAAQ,GAAG;AAAM;AACzD,SAAgB,aACd,QAC6D;CAC7D,QAAQ,QAAQ,aAAa;EAAE;EAAQ;EAAQ,GAAG;CAAQ;AAC5D;AACA,IAAa,uBAAb,MAA2D;CACzD,MAAM,OACJ,QACA,QACA,SACgC;EAChC,OAAO,OAAO,SAAS,QAAQ,OAAO;CACxC;AACF;AACA,IAAa,yBAAb,MAAoC;CAIf;CACA;CACA;CACA;CANnB,OAAwB,IAAI,SAAS;CAErC,YACE,UACA,SACA,UACA,OACA;EAJiB,KAAA,WAAA;EACA,KAAA,UAAA;EACA,KAAA,WAAA;EACA,KAAA,QAAA;CAChB;CAEH,MAAM,SACJ,MACA,WACA,MACA,OACA,WACA,WACgC;EAChC,IAAI,CAAC,KAAK,aAAa,QACrB,OAAO,MAAM;EAEf,MAAM,UAAU,eAAe,MAAM,KAAK;EAC1C,MAAM,UAAgC;GACpC;GACA,UAAU,MAAM;GAChB;GACA;GACA,SAAS,KAAK;GACd,SAAS,KAAK;GACd,QAAQ,SAAS,KAAK,MAAM,IAAI;GAChC,SAAS;IACP,OAAO,UAAU,SAAS;IAC1B,QAAQ,WAAW,UAAU,SAAS,GAAG,UAAU,WAAW,CAAC;GACjE;GACA,MAAM,MAAM;GACZ;GACA,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,aAAa,GAAG,GACxC,IACA,MAAM,QAAQ,QAAQ,+BACxB;GACF,UAAU,MAAM,UAAU;IACxB,KAAK,MACF,SAAS,KAAK,UAAU,CAAC,CACzB,OAAO,IAAI,KAAK,MAAM,SAAS,MAAM,MAAM,IAAI,GAAG,KAAK;IAC1D,IAAI,YAAY,QAAQ,IAAI,KAAK,YAAY,iBAAiB;IAG9D,IAAI,CAAC,WAAW;KACd,4BAAY,IAAI,IAAI;KACpB,OAAO,eAAe,KAAK,YAAY,mBAAmB,EACxD,OAAO,UACT,CAAC;IACH;IACA,IAAI,SAAS,UAAU,IAAI,MAAM,IAAI;IACrC,IAAI,CAAC,QAAQ;KACX,yBAAS,IAAI,IAAI;KACjB,UAAU,IAAI,MAAM,MAAM,MAAM;IAClC;IACA,OAAO,IAAI,MAAM,KAAK;GACxB;EACF;EACA,MAAM,YACJ,eAEA,KAAK,MAAM,aACT,KAAK,YACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,YAAY,YAAY,UAAU,GACrD,YAAY;GACV,IAAI,WAAW,cAAc,WAAW,YAAY;IAClD,MAAM,cAAc,WAAW;IAC/B,MAAM,WACJ,WAAW,aAAa,WAAW,QAAQ,WAAW;IACxD,MAAM,UAGA,CAAC;IACP,KAAK,MAAM,SAAS,UAAU;KAC5B,MAAM,WAAW,MAAM,SAAS,KAAK;KACrC,IAAI,SAAS,WAAW,WAAW,aACjC,OAAO;KAET,IAAI,SAAS,WAAW,QAAQ;MAC9B,IAAI,CAAC,aACH,OAAO;MAET,QAAQ,KAAK,QAAQ;KACvB;IACF;IACA,IAAI,CAAC,aACH,OAAO,MAAM;IAEf,OAAO,KAAK;KACV,QAAQ,QAAQ,EAAE,EAAE,UAAU;KAC9B,QAAQ,QAAQ,MAAM,MAAM,EAAE,WAAW,GAAG,IAAI,MAAM;KACtD,SAAS,SACN,KAAK,UACJ,YAAY,QACP,MAAM,SAAS,KAAK,SAAS,QAAQ,MAAM,MAAM,CAAC,CAAC,KACpD,mBACN,CAAC,CACA,KAAK,MAAM;IAChB,CAAC;GACH;GACA,MAAM,SAAS,KAAK,SAAS,QAAQ,WAAW,MAAM;GACtD,MAAM,QAAQ,WAAW,cAAc,OAAO,UAAU;GACxD,IACG,SAAS,CAAC,MAAM,SAAS,UAAU,IAAI,KACvC,CAAC,SAAS,UAAU,YAErB,OAAO,KAAK,EAAE,QAAQ,0BAA0B,CAAC;GAEnD,IAAI;IACF,OAAO,MAAM,MAAM,OAAO,IACxB;KACE,SAAS,KAAK;KACd,SAAS;KACT,eAAe;KACf,UAAU;IACZ,SACM,KAAK,QAAQ,OAAO,QAAQ,WAAW,QAAQ,OAAO,CAC9D;GACF,SAAS,OAAO;IACd,MAAM,aAAa,oBACjB,OACA,UACA,KAAK,MACL,OACA,OACF;IACA,IAAI,cAAc,UAAU,GAAG;KAC7B,IAAI,WAAW,WAAW,KACxB,MAAM;KAER,OAAO,KAAK;MACV,QAAQ,WAAW;MACnB,QAAQ,WAAW,UAAU,WAAW;MACxC,SAAS,WAAW;MACpB,WAAW,WAAW;KACxB,CAAC;IACH;IACA,MAAM,SAAS,MAAM,QAAQ,MAC1B,SAAS,KAAK,OAAO,UAAU,UAAU,KAAK,aACjD;IACA,IAAI,QACF,MAAM,KAAK,MAAM,aACf,KAAK,KACL,MAAM,MACN,KAAK,UAAU,CAAC,cAAc,OAAO,EAAE,CAAC,GACxC,YAAY;KACV,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;MAC/C,MAAM,MAAM;MACZ,WAAW;MACX,SAAS,KAAK;MACd,WAAW,KAAK;MAChB,YAAY,EAAE,UAAU,OAAO,GAAG;KACpC,CAAC;KACD,IAAI,OAAO,YAAY,iBACrB,MAAM,0BAA0B,WAAW,aAAa;MACtD;MACA,mBAAmB,MAAM;MACzB,gBAAgB,MAAM,QAAQ,QAAQ;KACxC,CAAC;KAEH,OAAO;IACT,GACA,MAAM,QAAQ,QAAQ,+BACxB;IAEF,OAAO,KAAK;KACV,QAAQ;KACR,QAAQ,WAAW,UAAU;IAC/B,CAAC;GACH;EACF,CACF;EACF,KAAK,MAAM,cAAc,KAAK,cAAc;GAC1C,MAAM,WAAW,MAAM,SAAS,UAAU;GAC1C,IAAI,SAAS,WAAW,QACtB,OAAO;EAEX;EACA,OAAO,MAAM;CACf;AACF;;;;AC/OA,SAAgB,qBAAqB,SAAmC;CACtE,OACE,QAAQ,iBACP,QAAQ,oBAAoB,QAC3B,QAAQ,QAAQ,UAAU,qBAAqB,KAAA;AAErD;AAEA,IAAa,iBAAb,MAA4B;CACG;CAA7B,YAAY,SAA0D;EAAzC,KAAA,UAAA;CAA0C;CAEvE,MAAM,KAAK,SAA+C;EACxD,MAAM,UAAU,MAAM,KAAK,QAAQ;EACnC,MAAM,aAAa,QAAQ,QAAQ;EACnC,MAAM,cACJ,OAAO,eAAe,aAAa,MAAM,WAAW,OAAO,IAAI;EACjE,MAAM,UAAU,IAAI,IAAI,QAAQ,cAAc;EAC9C,IAAI,MAAM,QAAQ,WAAW,GACtB;QAAA,MAAM,UAAU,aACnB,IAAI,OAAO,WAAW,YAAY,QAChC,QAAQ,IAAI,MAAM;EAAA;EAIxB,IAAI,WAAW,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,SAClD,QAAQ,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM;EAEzC,OAAO,CAAC,GAAG,OAAO;CACpB;CAEA,MAAM,UAAU,QAAgB,SAAqC;EACnE,MAAM,CAAC,SAAS,kBAAkB,MAAM,QAAQ,IAAI,CAClD,KAAK,QAAQ,GACb,KAAK,KAAK,OAAO,CACnB,CAAC;EACD,OAAO,QAAQ,gBAAgB,KAAK,EAAE,eAAe,GAAG,QAAQ,EAC9D,oBAAoB,MACtB,CAAC;CACH;AACF;;;;AC9BA,SAAgB,aAAa,OAAqB,MAA6B;CAC7E,MAAM,QAAQ,MAAM,QAAQ;CAqB5B,OAAO;EACL,MAAA;GApBA,IAAI,UAAU;IACZ,OAAO,KAAK;GACd;GACA,IAAI,UAAU;IACZ,OAAO,KAAK,WAAW;GACzB;GACA,IAAI,UAAU;IACZ,OAAO,KAAK;GACd;GACA,IAAI,WAAW;IACb,OAAO,KAAK,YAAY;GAC1B;GACA,IAAI,iBAAiB;IACnB,OAAO,OAAO,KAAK;GACrB;GACA,IAAI,qBAAqB;IACvB,OAAO,OAAO,KAAK;GACrB;EAGG;EACH,IAAI,OAAO;GACT,OAAO,OAAO;EAChB;EACA,IAAI,OAAO;GACT,OAAO,OAAO;EAChB;EACA,IAAI,UAAU;GACZ,OAAO,OAAO;EAChB;CACF;AACF;AAEA,SAAgB,iBACd,MACA,UACA,OACA,OACY;CACZ,MAAM,gBACJ,SAAS;CACX,MAAM,UAAU,IAAI,eAAe,OAAO;CAC1C,OAAO;EACL;EACA;EACA,IAAI,MAAM;GACR,OAAO,SAAS;EAClB;EACA;EACA,MAAM,UAAU,IAAI;GAClB,QAAQ,MAAM,QAAQ,EAAA,CAAG,UAAU,EAAE;EACvC;EACA,IAAO,MAAiB,IAAkC;GACxD,OAAO,MAAM,IAAI,aAAa,OAAO,IAAI,GAAG,EAAE;EAChD;EACA,YAAY,SAAS,MAAM;GACzB,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM,SAAS,IAAI;EAC3C;EACA,mBAAmB,OAAO;GACxB,OAAO,MAAM,CAAC,CAAC,OAAO,mBAAmB,KAAK;EAChD;EACA,gBAAgB,QAAQ,SAAS;GAC/B,OAAO,QAAQ,UAAU,QAAQ,OAAO;EAC1C;CACF;AACF;AAEA,IAAa,eAAb,MAA0B;CACxB,iBAA2E,CAAC;CAE5E,KACE,OACA,SAC2B;EAC3B,MAAM,SAAS,MAAM,OAAO,KAAK,OAAO;EACxC,KAAK,eAAe,KAAK;GAAE;GAAS,OAAO,OAAO;EAAM,CAAC;EACzD,OAAO;CACT;CAEA,YAAkB;EAChB,KAAK,MAAM,EAAE,aAAa,KAAK,gBAC7B,QAAQ,QAAQ;CAEpB;CAEA,QAAc;EACZ,KAAK,MAAM,gBAAgB,KAAK,gBAC9B,aAAa,MAAM;EAErB,KAAK,eAAe,SAAS;CAC/B;AACF;;;ACtGA,MAAa,gBAAgB,OAAO,IAAI,oCAAoC;AAC5E,MAAa,uBAAuB,OAAO,IACzC,uCACF;;;ACSA,MAAM,eAAe,OAAO,IAAI,0CAA0C;AAC1E,MAAM,8BAA8B,OAAO,IACzC,yDACF;AAEA,SAAS,iBAAiB,SAA0B;CAClD,MAAM,SAAS,QAAQ,IAAI,QAAQ;CACnC,MAAM,UAAU,QAAQ,IAAI,SAAS;CACrC,IAAI,QAAQ,UAAU,WAAW;CACjC,IAAI,CAAC,UAAU,SACb,IAAI;EACF,QAAQ,IAAI,IAAI,OAAO,CAAC,CAAC;CAC3B,QAAQ;EACN,QAAQ;CACV;CAGF,OAAO,MAAM,QAAQ,0BAA0B,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG;AACjE;;AAGA,IAAa,oBAAb,MAA+B;CAOV;CANnB;CACA,yBAAkB,IAAI,IAAY;CAClC,2BAAoB,IAAI,IAAoB;CAC5C,2BAAoB,IAAI,IAAoB;CAE5C,YACE,QAIA;EAJiB,KAAA,SAAA;CAIhB;CAEH,OACE,UACA,SACA,SACA,cACM;EACN,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,KAAK,cAAc,KAAA,KAAa,MAAM,KAAK,aAAa,MAAW;GACrE,KAAK,OAAO,KACV,+CAA+C,KAAK,UAAU,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,qBAAqB,KAAK,UAAU,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAClL;GACA,KAAK,OAAO,MAAM;GAClB,KAAK,SAAS,MAAM;GACpB,KAAK,SAAS,MAAM;GACpB,KAAK,YAAY,KAAA;EACnB;EACA,KAAK,cAAc;EACnB,MAAM,SAAS,iBAAiB,OAAO;EACvC,MAAM,SAAS,QAAQ,UAAU,QAAQ;EACzC,MAAM,OAAO,KAAK,UAAU,CAAC,QAAQ,MAAM,CAAC;EAC5C,MAAM,UAAU,gBAAgB,SAAS,IAAI,OAAO,WAAW,OAAO,oBAAoB,aAAa;EACvG,IAAI,CAAC,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,OAAO,OAAO,KAAK;GACpD,KAAK,OAAO,IAAI,IAAI;GACpB,KAAK,OAAO,KAAK,OAAO;EAC1B,OACE,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;EAEhE,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,SAAS,OAAO,KACpD,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;EAEhE,KAAK,OAAO,MAAM,OAAO;CAC3B;CAEA,gBACE,UACA,SACA,cACM;EACN,KAAK,OACH,UACA,aAAa,UAAU,0BAA0B,GACjD,SACA,YACF;CACF;AACF;AAWA,IAAa,cAAb,MAAyB;CAKJ;CACA;CALnB;CACA,iCAA0B,IAAI,QAAwB;CAEtD,YACE,OACA,MACA;EAFiB,KAAA,QAAA;EACA,KAAA,OAAA;EAEjB,KAAK,WAAW,IAAI,eAAe,YAAY,KAAK,OAAO;CAC7D;CAEA,MACE,SACA,MAC6B;EAC7B,MAAM,UAAU,KAAK,MAAM,SAAS,QAAQ,GAAG,CAAC,CAAC;EACjD,MAAM,MAAM,QAAQ,KAAK,KAAK,UAAU,IAAI;EAC5C,MAAM,WAAW,QAAQ,IAAI,GAAG;EAChC,IAAI,UACF,OAAO;EAET,IAAI;EACJ,IAAI,oBAAoB;EACxB,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAC9B,KAAK,YAAY;GAChB,IACE,KAAK,KAAK,SAAS,SAAS,SAC5B,qBAAqB,KAAK,KAAK,OAAO,GAEtC,OAAO;GAET,UAAU,QAAQ,QAAQ;GAC1B,MAAM,UAAU,MAAM,KAAK,QAAQ,SAAS,SAAS,YAAY;IAC/D,oBAAoB;GACtB,CAAC;GACD,IAAI,SACF,KAAK,KAAK,aAAa,OACrB,KAAK,KAAK,UACV,SACA,SACA,KAAK,eAAe,IAAI,QAAQ,GAAG,KACjC,KAAK,KAAK,QAAQ,eAAe,MACrC;QAGA,IAAI,SAAS,UAAU,QAAQ,IAAI,QAAQ,GACzC,KAAK,MACF,SAAS,QAAQ,GAAG,CAAC,CACrB,OAAO,IACN,KAAK,MAAM,SAAS,KAAK,KAAK,UAAU,YAAY,GACpD,IACF;GAGN,OAAO;EACT,CAAC,CAAC,CACD,OAAO,UAAmB;GACzB,IAAI,QAAQ,IAAI,GAAG,MAAM,SACvB,QAAQ,OAAO,GAAG;GAEpB,IAAI,qBAAqB,KAAK,GAC5B,MAAM;GAER,MAAM,UAAU,sBAAsB,KAAK,IACvC,QACA,0BAA0B,OAAO;IAC/B;IACA,mBAAmB,KAAK,KAAK;IAC7B,gBAAgB,KAAK,KAAK;GAC5B,CAAC;GACL,IAAI,qBAAqB,SACvB,KAAK,oBAAoB,OAAO,CAAC,CAAC,IAAI,SAAS,OAAO;GAExD,MAAM;EACR,CAAC;EACH,QAAQ,IAAI,KAAK,OAAO;EACxB,OAAO;CACT;CAEA,MAAM,SAAS,SAAyC;EACtD,MAAM,UAAU,KAAK,MAAM,SAAS,QAAQ;EAC5C,IAAI;GACF,MAAM;EACR,SAAS,OAAO;GACd,MAAM,UAAU,KAAK,oBAAoB,OAAO,CAAC,CAAC,IAAI,OAAO;GAC7D,IAAI,CAAC,sBAAsB,KAAK,KAAK,CAAC,SACpC,MAAM;GAGR,KAAK,KAAK,aAAa,gBACrB,KAAK,KAAK,UACV,SACA,KAAK,KAAK,QAAQ,eAAe,MACnC;EACF;CACF;CAEA,oBACE,SACA,MACA,UACM;EACN,IACE,aAAa,KAAK,KAAK,aACtB,KAAK,KAAK,SAAS,SAAS,SAC3B,qBAAqB,KAAK,KAAK,OAAO,KACtC,KAAK,MACF,SAAS,QAAQ,GAAG,CAAC,CACrB,OAAO,IAAI,KAAK,MAAM,SAAS,KAAK,KAAK,UAAU,YAAY,CAAC,MACjE,OAEJ;EAEF,MAAM,6BAA6B,UACjC,sCACA,oGACA;GACE,MAAM;GACN,MAAM;EACR,CACF;CACF;CAEA,oBACE,SAC+C;EAC/C,MAAM,SAAS,KAAK,MAAM,SAAS,QAAQ,GAAG,CAAC,CAAC;EAChD,MAAM,MAAM,KAAK,MAAM,SACrB,KAAK,KAAK,UACV,2BACF;EACA,IAAI,WAAW,OAAO,IAAI,GAAG;EAG7B,IAAI,CAAC,UAAU;GACb,2BAAW,IAAI,QAAQ;GACvB,OAAO,IAAI,KAAK,QAAQ;EAC1B;EACA,OAAO;CACT;CAEA,MAAc,QACZ,SACA,SACA,MACA,sBAC6B;EAC7B,IAAI,CAAC,QAAQ,IAAI,QAAQ,GAAG;GAC1B,IAAI,SAAS,UACX,OAAO;GAET,MAAM,OAAO,QAAQ,IAAI,gBAAgB;GACzC,MAAM,aAAa,QAAQ,IAAI,gBAAgB;GAC/C,MAAM,WAAW;IAAC;IAAM;IAAY,QAAQ,IAAI,gBAAgB;GAAC,CAAC,CAAC,MAChE,UAAU,QAAQ,OAAO,KAAK,CAAC,CAClC;GACA,IAAI,YAAY,SAAS,gBAAgB,eAAe,YACtD,OAAO,aAAa,UAAU,qCAAqC;GAErE,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,KAAK,CAAC,QAAQ,IAAI,SAAS,GAC/D,OAAO;EAEX;EACA,MAAM,SAAS,QAAQ,IAAI,QAAQ;EACnC,MAAM,UAAU,QAAQ,IAAI,SAAS;EACrC,MAAM,OAAO,QAAQ,IAAI,gBAAgB;EACzC,MAAM,QACJ,WAAW,UAAU,SAAS,gBAC1B,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,SACrB,UAAU;EAChB,IAAI,CAAC,SAAS,UAAU,QAAQ;GAC9B,IACE,KAAK,KAAK,SAAS,kBAAkB,uBACrC,CAAC,QAAQ,IAAI,QAAQ,KACrB,CAAC,QAAQ,IAAI,SAAS,KACtB,CAAC,QAAQ,IAAI,gBAAgB,GAE7B,OAAO;GAET,OAAO,aAAa,UAAU,wBAAwB;EACxD;EACA,MAAM,UAAU,IAAI,QAAQ,QAAQ,KAAK,EAAE,QAAQ,CAAC;EACpD,MAAM,iBAAiB,MAAM,KAAK,SAC/B,KAAK,OAAO,CAAC,CACb,OAAO,UAAmB;GACzB,qBAAqB;GACrB,MAAM;EACR,CAAC;EACH,KAAK,eAAe,IAAI,QAAQ,KAAK,eAAe,MAAM;EAC1D,OAAO,KAAK,KAAK,QAAQ,gBAAgB,KAAK,EAAE,eAAe,GAAG,OAAO,EACvE,oBAAoB,MACtB,CAAC,IACG,OACA,aAAa,UAAU,gBAAgB;CAC7C;AACF;;;;ACtRA,SAAgB,0BAA0B,MAAgC;CACxE,MAAM,UAAU,CAAC,IAAI;CACrB,MAAM,uBAAO,IAAI,IAAqB;CACtC,OAAO,QAAQ,QAAQ;EACrB,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,KAAK,IAAI,OAAO,GAClB;EAEF,KAAK,IAAI,OAAO;EAChB,IAAI,QAAQ,eAAe,CAAC,QAAQ,uBAAuB,GACzD,OAAO;EAGT,KAAK,MAAM,cAAc,QAAQ,gBAAgB,KAAK,CAAC,GACrD,IAAI,YACF,QAAQ,KAAK,UAAU;EAG3B,KAAK,MAAM,YAAY,QAAQ,sBAAsB,KAAK,CAAC,GACzD,QAAQ,KAAK,SAAS,OAAO;EAE/B,KAAK,MAAM,YAAY,QAAQ,qBAAqB,KAAK,CAAC,GACxD,QAAQ,KAAK,QAAQ;CAEzB;CACA,OAAO;AACT;AA4BA,SAAgB,mBACd,OACA,MACA,QAC8B;CAC9B,IAAI,qBAAqB,KAAK,GAC5B,OAAO;CAET,MAAM,QAAQ,IAAI,6BAA6B,MAAM,MAAM;CAC3D,OAAO,eAAe,OAAO,SAAS,EAAE,OAAO,MAAM,CAAC;CACtD,OAAO;AACT;AAEO,IAAM,mBAAN,MAAM,iBAA2C;CASF;CARpD,iBAAkD,CAAC;CACnD,2BAAoB,IAAI,IAA2B;CACnD,SAAkB,IAAI,OAAO,YAAY;CACzC,cAAuB,IAAI,kBAAkB,KAAK,MAAM;CACxD,QAAgD;CAChD,UAAsC;CACtC,QAAQ,EAAE,aAAa,mBAAmB;CAE1C,YAAY,OAA6D;EAArB,KAAA,QAAA;CAAsB;CAE1E,SACE,SACA,eACA,SACA,YACsB;EACtB,MAAM,OAAO,cAAc,QAAQ;EACnC,MAAM,eAAqC;GACzC;GACA;GACA;GACA;GACA;GACA,UAAU,QAAQ;GAClB,QAAQ,iBAAiB,MAAM,QAAQ,MAAM,KAAK,aAChD,KAAK,IAAI,IAAI,CACf;EACF;EACA,KAAK,eAAe,KAAK,YAAY;EACrC,OAAO;CACT;CAEA,gBAAiD;EAC/C,OAAO,CAAC,GAAG,KAAK,cAAc;CAChC;CAEA,IAAI,MAA6B;EAC/B,MAAM,QAAQ,KAAK,SAAS,IAAI,IAAI;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,6BACR,oBACA,kBAAkB,KAAK,mCACvB,6DACF;EAEF,OAAO;CACT;CAEA,OAAiC;EAC/B,OAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC;CACnC;CAEA,MAAM,SAA8C;EAClD,IAAI,KAAK,UAAU,OAAO;GACxB,IAAI,KAAK,YAAY,SACnB,MAAM,IAAI,6BACR,qBACA,wDACA,sDACF;GAEF,OAAO;EACT;EACA,KAAK,UAAU;EACf,KAAK,QAAQ;EACb,KAAK,QAAQ,EACX,aAAa,oBAAoB,WAAW,OAAO,WAAW,IAChE;EACA,OAAO;CACT;CAEA,MAAM,WAAW,QAAuD;EACtE,KAAK,SAAS,MAAM;EACpB,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,+BAAe,IAAI,IAA0B;EACnD,MAAM,yBAAS,IAAI,IAAY;EAC/B,IAAI,UAAU;EACd,KAAK,MAAM,gBAAgB,KAAK,gBAAgB;GAC9C,MAAM,EACJ,MACA,UACA,SACA,eACA,YACA,SACA,WACE;GACJ,IAAI,KAAK,IAAI,IAAI,GACf,OAAO,KACL,IAAI,6BACF,sBACA,aAAa,KAAK,mCAClB,sDACF,CACF;GAEF,KAAK,IAAI,IAAI;GACb,IAAI,cAAc,eAAe,SAAS,WACxC;GAEF,IACE,SAAS,cACR,WAAW,cAAc,KAAA,KACxB,WAAW,eAAe,KAAA,IAE5B,OAAO,KACL,IAAI,6BACF,oCACA,aAAa,KAAK,kCAClB,2DACF,CACF;GAEF,IACE,CAAC,YACD,OAAO,SAAS,YAAY,cAC5B,OAAO,SAAS,KAAK,eAAe,cACpC,OAAO,SAAS,UAAU,SAAS,YACnC;IACA,OAAO,KACL,IAAI,6BACF,wBACA,aAAa,KAAK,+CACpB,CACF;IACA;GACF;GACA,IAAI;GACJ,IAAI;IACF,UAAW,MAAM,SAAS;GAC5B,SAAS,OAAO;IACd,OAAO,KACL,mBACE,OACA,uBACA,aAAa,KAAK,yCACpB,CACF;IACA;GACF;GACA,MAAM,SAAS,QAAQ,UAAU,6BAA6B;GAC9D,MAAM,SACJ,UAAU,OAAO,WAAW,WACvB,QAAQ,IAAI,QAAQ,aAAa,IAClC,KAAA;GACN,IAAI,CAAC,QAAQ;IACX,OAAO,KACL,IAAI,6BACF,kBACA,aAAa,KAAK,4BAClB,oDACF,CACF;IACA;GACF;GACA,IAAI,OAAO,aAAa,KAAK,OAAO,OAAO,SAAS,YAAY;IAC9D,OAAO,KACL,IAAI,6BACF,4BACA,aAAa,KAAK,wBAAwB,OAAO,SAAS,gBAC1D,+CACF,CACF;IACA;GACF;GACA,MAAM,WAAW,aAAa,IAAI,MAAM;GACxC,IAAI,aAAa,KAAA,GAAW;IAC1B,OAAO,IAAI,IAAI;IACf,OAAO,IAAI,QAAQ;IACnB,OAAO,KACL,IAAI,6BACF,mCACA,IAAI,SAAS,SAAS,KAAK,6BAC3B,kEACF,CACF;GACF;GACA,aAAa,IAAI,QAAQ,IAAI;GAC7B,MAAM,UAAU,QAAQ,QAAQ,WAAW,CAAC;GAC5C,MAAM,QAAQ,QAAQ,WACnB,UAAU,MAAM,OAAO,6BAC1B;GACA,IACE,SAAS,KACT,QAAQ,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,UAAU,MAAM,OAAO,OAAO,MAAM,GAEnE,KAAK,OAAO,KACV,uBAAuB,KAAK,gDAC9B;GAEF,MAAM,oBAAoB,CACxB,GAAG,IAAI,IACL,QACG,SAAS,WAAW,OAAO,qBAAqB,CAAC,CAAC,CAAC,CACnD,KAAK,UAAU,MAAM,YAAY,CAAC,CACvC,CACF;GACA,KAAK,SAAS,IAAI,MAAM;IACtB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,QAAQ,IAAI,YAAY,KAAK,OAAO;KAClC,UAAU;KACV;KACA,SAAS,QAAQ;KACjB,aAAa,KAAK;KAClB;KACA,gBAAgB,QAAQ,QAAQ;IAClC,CAAC;GACH,CAAC;EACH;EACA,KAAK,MAAM,QAAQ,QACjB,KAAK,SAAS,OAAO,IAAI;EAE3B,IAAI,UAAU,GACZ,OAAO,KACL,IAAI,6BACF,0BACA,wDACA,0CACF,CACF;EAEF,IAAI,CAAC,KAAK,IAAI,SAAS,GACrB,OAAO,KACL,IAAI,6BACF,uBACA,qDACA,yCACF,CACF;CAEJ;CAEA,QAAc;EACZ,KAAK,QAAQ;EACb,KAAK,SAAS,MAAM;CACtB;AACF;AA5Oe,mBAAA,WAAA,CAAA,gBAAA,GAAA,OAAO,aAAa,CAAA,GAAA,mBAAA,qBAAA,CAAA,MAAA,CAAA,CAAA,GAAA,gBAAA;;;ACZnC,SAAgB,kBACd,aACe;CACf,OAAO,YAAY,SAAS,eAC1B,WAAW,aACP,kBAAkB,WAAW,KAAK,IAClC,WAAW,aACT,kBAAkB,WAAW,KAAK,IAClC,CAAC,UAAU,CACnB;AACF;AACA,SAAgB,iBAA0B;CACxC,OAAO,CAAC;EAAC;EAAe;EAAO;CAAM,CAAC,CAAC,SAAS,QAAQ,IAAI,YAAY,EAAE;AAC5E;AACA,SAAS,UAAU,QAA0C;CAC3D,MAAM,SAA2B,CAAC;CAClC,KACE,IAAI,UAAmB,QACvB,OAAO,YAAY,cAAc,YAAY,SAAS,WACtD,UAAU,OAAO,eAAe,OAAO,GAEvC,OAAO,KAAK,OAAO;CAErB,OAAO;AACT;AACA,SAAS,eAAe,GAAuB,GAAgC;CAC7E,IAAI,CAAC,KAAK,CAAC,GACT,OAAO;CAET,MAAM,OAAO,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC,YAAY;CAC9C,MAAM,QAAQ,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC,YAAY;CAC/C,OACE,SAAS,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,SAAS,IAAI,MAAM;AAE7E;AACA,SAAS,aAAa,IAAI,KAAK,IAAI,KAAc;CAC/C,OACE,MAAM,KACN,EAAE,WAAW,EAAE,SAAS,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAC1C,EAAE,WAAW,EAAE,SAAS,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE;AAE9C;AAEA,SAAS,uBAAuB,MAAc,UAA2B;CACvE,MAAM,QAAQ,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,EAAE,KAAK;CAC/D,MAAM,OAAO,SAAS,YAAY,CAAC,CAAC,QAAQ,eAAe,EAAE,KAAK;CAClE,IAAI,SAAS,KACX,OAAO,MAAM,WAAW,GAAG;CAE7B,IAAI,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE,GAC/C,OAAO;CAET,MAAM,SAAS,MAAM,OAAO,OAAO;CACnC,IAAI,WAAW,IACb,OAAO;CAET,MAAM,UAAU,MAAM,MAAM,GAAG,MAAM;CACrC,OAAO,KAAK,WAAW,OAAO,KAAK,QAAQ,WAAW,GAAG,KAAK,EAAE;AAClE;AAEO,IAAM,gBAAN,MAAM,cAAc;CAQoB;CACD;CACN;CACA;CACQ;CACA;CACJ;CACE;CACG;CACD;CAhB9C,SAAkB,IAAI,OAAO,YAAY;CACzC,SAAiC,CAAC;CAClC,UAAmC,CAAC;CACpC,eAAe;CACf,eAAe;CAEf,YACE,WACA,SACA,WACA,WACA,WACA,WACA,SACA,UACA,YACA,QACA;EAV2C,KAAA,YAAA;EACD,KAAA,UAAA;EACN,KAAA,YAAA;EACA,KAAA,YAAA;EACQ,KAAA,YAAA;EACA,KAAA,YAAA;EACJ,KAAA,UAAA;EACE,KAAA,WAAA;EACG,KAAA,aAAA;EACD,KAAA,SAAA;CAC3C;CAEH,KAAa,MAAc,SAAuB;EAChD,KAAK,OAAO,KAAK,GAAG,KAAK,IAAI,SAAS;CACxC;CAEA,QAAwB;EACtB,MAAM,QAAgB,CAAC;EACvB,MAAM,uBAAO,IAAI,IAAuB;EACxC,KAAK,MAAM,WAAW,CACpB,GAAG,KAAK,UAAU,eAAe,GACjC,GAAG,KAAK,UAAU,aAAa,CACjC,GAAG;GACD,IACE,QAAQ,WACR,CAAC,QAAQ,YACR,OAAO,QAAQ,aAAa,YAC3B,OAAO,QAAQ,aAAa,YAE9B;GAEF,MAAM,YAAY,OAAO,eAAe,QAAQ,QAAQ;GAGxD,MAAM,SAAS,WAAW;GAC1B,IAAI,CAAC,aAAa,CAAC,UAAU,WAAW,UAAU,WAAW,UAC3D;GAEF,MAAM,UAAU,KAAK,IAAI,MAAM,qBAAK,IAAI,IAAY;GACpD,KAAK,IAAI,QAAQ,OAAO;GACxB,KAAK,MAAM,UAAU,KAAK,QAAQ,kBAAkB,SAAS,GAAG;IAC9D,IAAI,QAAQ,IAAI,MAAM,GACpB;IAEF,QAAQ,IAAI,MAAM;IAClB,MAAM,UAAU,QAAQ,IAAI,WAAW,MAAM;IAC7C,IAAI,OAAO,YAAY,YACrB,MAAM,KAAK;KAAE;KAAQ;KAAQ;IAAQ,CAAC;GAE1C;EACF;EACA,OAAO;CACT;CAEA,gBACE,QACA,YACM;EACN,MAAM,OAAO,IAAI,IAAI,WAAW,KAAK,UAAU,MAAM,MAAM,CAAC;EAC5D,KAAK,MAAM,WAAW,KAAK,UAAU,aAAa,GAKhD,MAHE,OAAO,QAAQ,UAAU,WACrB,OAAO,OAAO,QAAQ,KAAK,IAC3B,KAAA,EAAA,EAEE,WAAW,kCAAkC,KACjD,KAAK,IAAI,QAAQ,KAAK,KACtB,KAAK,IAAI,QAAQ,QAAgB,MACnC,CAAC,0BAA0B,OAAO,GAElC,OAAO,KACL,IAAI,6BACF,2BACA,qBAAqB,OAAO,QAAQ,IAAI,EAAE,sCAC1C,sDACF,CACF;CAGN;CAEA,WAAyB;EACvB,IACM,QADN,MACM,MAAM;GACV,MAAsB,CAAC;EACzB;;GADG,IAAI,SAAS;;;;;EAFf,QAAA,WAAA,CAAA,WAAW,gBAAgB,CAAA,GAAA,KAAA;EAI5B,IACE,QAAQ,eAAe,QAAQ,KAAK,MAAM,oBAC1C,QAAQ,eAAe,QAAQ,MAAM,UAAU,GAAG,MAAM,aACxD,QAAQ,eAAe,UAAU,MAAM,UAAU,GAAG,MAAM,GAE1D,MAAM,IAAI,6BACR,6BACA,0DACF;EAEF,UAAU,eAAe,CAAC,CAAC,KAAK;EAChC,gBAAgB,0BAA0B,CAAC,CAAC,KAAK;EACjD,IACE,CACE,QAAQ,eAAe,cAAc,KAAK,CAAC,EAC1C,SAAS,eAAe,KAC3B,CACE,QAAQ,eAAe,oBAAoB,KAAK,CAAC,EAGhD,SAAS,0BAA0B,GAEtC,MAAM,IAAI,6BACR,6BACA,8EACA,+DACF;CAEJ;CAEA,SAAiB,OAAgB,MAAkC;EACjE,MAAM,QACJ,SAAS,UAAU,kBAAkB;EACvC,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,UAAU,IAAI,OAAO,EAAE,QAAQ,MAAM,CAAC;EACtD,QAAQ;GACN,SAAS,KAAA;EACX;EACA,IAAI,UAAU,SAAU,WAAW,KAAA,KAAa,UAAU,QACxD,OAAO;EAET,IAAI,UAAU,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa;GACvE,MAAM,QACJ,QAAQ,IAAI,OAAO,aAAa,MAC/B,OAAO,UAAU,aACd,QAAQ,IAAI,MAAM,aAAa,CAAC,GAAG,aAAa,IAChD,QAAQ,IAAI,OAAO,eAAe,KAAK,KAAK,CAAC,GAAG,aAAa;GACnE,OACE,UAAU,QACT,SAAS,WAAW,UAAU,iBAC9B,OAAO,UAAU,YAChB,UAAU,QACV,QAAQ,IAAI,OAAO,IAAI,MAAM;EAEnC;EACA,OAAO;CACT;CAEA,MACE,MACA,MACS;EACT,MAAM,UAAU,KAAK,SAChB,QAAQ,IAAI,KAAK,OAAO,aAAa,CAAC,GAAG,KAAK,MAAM,IAGrD,KAAA;EACJ,MAAM,UAAoB,CACxB,GAAG,UAAU,KAAK,MAAM,GACxB,GAAI,UAAU,CAAC,OAAO,IAAI,CAAC,CAC7B;EACA,IACE,QAAQ,MACL,WACC,QAAQ,eAAe,0BAA0B,MAAM,MAAM,IACjE,GAEA,OAAO;EAET,MAAM,MAAM,SAAS,UAAU,eAAe;EAC9C,OAAO,QAAQ,MAAM,YACjB,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,EAAA,CAAiB,MAAM,UAC/D,KAAK,SAAS,OAAO,IAAI,CAC3B,CACF;CACF;CAEA,QAAgB,QAAyB;EACvC,MAAM,SAAS,QAAQ,eAAe,iBAAiB,MAAM;EAC7D,IACE,WAAW,cACX,WAAW,cACX,WAAW,iBAEX,OAAO;EAET,OAAO;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,QAAQ,QAAQ,eAAe,KAAK,MAAM,CAAC;CACrD;CAEA,SACE,OACA,QACM;EACN,KAAK,eAAe,CAClB,GAAG,KAAK,UAAU,gBAAgB,GAClC,GAAG,KAAK,UACL,uBAAuB,CAAC,CACxB,KAAK,YAAY,QAAQ,QAAQ,CACtC,CAAC,CAAC,MAAM,UAAU,KAAK,SAAS,OAAO,OAAO,CAAC;EAC/C,KAAK,eAAe,CAClB,GAAG,KAAK,UAAU,sBAAsB,GACxC,GAAG,KAAK,UACL,6BAA6B,CAAC,CAC9B,KAAK,YAAY,QAAQ,QAAQ,CACtC,CAAC,CAAC,MAAM,UAAU,KAAK,SAAS,OAAO,OAAO,CAAC;EAC/C,KAAK,MAAM,SAAS,KAAK,SAAS;GAChC,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,SACT,KAAK,QAAQ,KAAK,MAAM,QAAgB,MAAM,MAAM,IACpD,KAAA;GACN,QAAQ;IACN;GACF;GACA,MAAM,aAAa,KAAK,UACrB,KAAK,CAAC,CACN,MACE,UACC,MAAM,UACL,QAAQ,YAAY,wBAAwB,MAAM,MAAM,KACvD,UACN;GAKF,MAAM,aAHJ,QAAQ,YAAY,0BAA0B,MAAM,MAAM,KAC1D,YAAY,QAAQ,SAAS,sBAC7B,UAGA,QAAQ,YAAY,4BAA4B,MAAM,MAAM,MAC1D,QACF,YAAY,QAAQ,aAAa,SAAS;GAC5C,MAAM,gBAAgB,QACjB,KAAK,WAAW,YAAY,KAAK,WAAW,cAC7C,KAAK,gBAAgB,SACrB,QAAQ,YAAY,iBAAiB,MAAM,MAAM,MAAM,YACvD,CAAC;GACL,MAAM,aAAa,KAAK,MAAM,OAAO,OAAO;GAC5C,MAAM,aAAa,KAAK,MAAM,OAAO,OAAO;GAC5C,MAAM,UACJ,iBACC,MAAM,UAAU,aAAa,KAAK,gBAAgB,eAClD,MAAM,UAAU,cAAc,cAAc;GAC/C,MAAM,WACJ,MAAM,YACN,UAAU,MAAM,MAAM,CAAC,CAAC,MAAM,WAAW,KAAK,QAAQ,MAAM,CAAC;GAC/D,IACE,CAAC,YACA,MAAM,QAAQ,gBAAgB,aAC/B,MAAM,QAAQ,aAAa,OAC3B;IACA,MAAM,UAAU,GAAG,MAAM,OAAO,OAAO,MAAM,SAAS,IAAI,MAAM,WAAW,GAAG;IAC9E,IAAI,MAAM,QAAQ,aAAa,QAC7B,KAAK,KAAK,MAAM,QAAQ,MAAM,GAAG,QAAQ,GAAG,MAAM,QAAQ,MAAM;SAEhE,OAAO,KACL,IAAI,6BACF,MAAM,QAAQ,MACd,SACA,MAAM,QAAQ,IAChB,CACF;GAEJ;EACF;EACA,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,cAAc,KAAK,QAAQ,QAC9B,UAAU,MAAM,WAAW,KAAK,MACnC;GACA,IACE,YAAY,MACT,UAAU,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,KAAK,MACjE,GAEA;GAEF,IACE,KAAK,QAAQ,KAAK,OAAO,KACxB,CAAC,YAAY,UACZ,UAAU,KAAK,MAAM,CAAC,CAAC,MAAM,WAAW,KAAK,QAAQ,MAAM,CAAC,GAE9D,OAAO,KACL,IAAI,6BACF,2BACA,GAAG,KAAK,OAAO,KAAK,GAAG,KAAK,OAAO,6EAA6E,KAAK,WAClH,KAAK,CAAC,CACN,KAAK,UAAU,MAAM,EAAE,CAAC,CACxB,KAAK,IAAI,EAAE,IACd,gDACF,CACF;EAEJ;EACA,IAAI,CAAC,KAAK,cAAc;GACtB,MAAM,WAAW,KAAK,QAAQ,SAAS,UAAU;IAC/C,IAAI,KAAK,MAAM,OAAO,OAAO,GAC3B,OAAO,CAAC;IAEV,MAAM,OAAO,KAAK,OAAO,MACtB,SACC,KAAK,WAAW,MAAM,UAAU,KAAK,WAAW,MAAM,MAC1D,CAAC,EAAE;IACH,IAAI,MACF,OAAO,KAAK,WACR,CAAC;KAAE;KAAO,YAAY,KAAK;IAAmB,CAAC,IAC/C,CAAC;IAEP,IAAI,MAAM,WAAW,KAAA,GACnB,OAAO,CAAC;IAEV,MAAM,QAAQ,KAAK,UAChB,KAAK,CAAC,CACN,MACE,UACC,MAAM,UACL,QAAQ,YAAY,wBAAwB,MAAM,MAAM,KACvD,UACN;IACF,MAAM,aACJ,QAAQ,YAAY,0BAA0B,MAAM,MAAM,KAC1D,OAAO,QAAQ,SAAS,sBACxB;IACF,OAAO,cACL,UAAU,MAAM,MAAM,CAAC,CAAC,MAAM,WAAW,KAAK,QAAQ,MAAM,CAAC,IAC3D,CAAC;KAAE;KAAO,YAAY,QAAQ,UAAU;IAAE,CAAC,IAC3C,CAAC;GACP,CAAC;GACD,MAAM,uBAAO,IAAI,IAA6C;GAC9D,MAAM,YAAY,SACf,MACE,MAAM,UAAU,OAAO,MAAM,UAAU,IAAI,OAAO,KAAK,UAAU,CACpE,CAAC,CACA,QAAQ,EAAE,YAAY;IACrB,MAAM,UACJ,KAAK,IAAI,MAAM,MAAM,qBAAK,IAAI,IAAwB;IACxD,KAAK,IAAI,MAAM,QAAQ,OAAO;IAC9B,IAAI,QAAQ,IAAI,MAAM,MAAM,GAC1B,OAAO;IAET,QAAQ,IAAI,MAAM,MAAM;IACxB,OAAO;GACT,CAAC,CAAC,CACD,MAAM,GAAG,EAAE,CAAC,CACZ,KAAK,EAAE,YAAY,GAAG,MAAM,OAAO,KAAK,GAAG,MAAM,UAAU,KAAK;GACnE,KAAK,KACH,qBACA,sLAAsL,UAAU,KAAK,IAAI,GAC3M;EACF;CACF;CAEA,YACE,OACA,UACA,QACM;EACN,MAAM,EAAE,MAAM,SAAS,SAAS,SAAS,WAAW;EACpD,KAAK,MAAM,QAAQ,CAAC,GAAG,SAAS,GAAG,QAAQ,GACzC,KAAK,MAAM,UAAU,KAAK,UAAU,WAAW,CAAC,GAC9C,IAAI,CAAC,QAAQ,UAAU,MAAM,GAC3B,OAAO,KACL,IAAI,6BACF,uBACA,IAAI,KAAK,MAAM,KAAK,GAAG,kBAAkB,OAAO,YAChD,YAAY,OAAO,sBACrB,CACF;EAIN,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,UACJ,CAAC,CAAC,QAAQ,OAAO,SAAS,YAAY,kBAAkB;EAC1D,IAAI,WAAW,EAAE,cAAc,QAAQ,KAAK,WAAW;GACrD,MAAM,WAAW;IACf,GAAG;IACH,GAAG;IACH,GAAG,KAAK,WAAW,KAAK;GAC1B,CAAC,CAAC,QAAQ,SAAS,KAAK,UAAU,aAAa;GAC/C,IAAI,SAAS,QACX,OAAO,KACL,IAAI,6BACF,qCACA,IAAI,KAAK,KAAK,SAAS,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,wBACzD,iEACF,CACF;QAEA,KAAK,KACH,kBACA,IAAI,KAAK,gFACX;EAEJ;EACA,MAAM,aAAa,eAAe;EAClC,IAAI,cAAc,CAAC,QAAQ,WAAW,CAAC,SAAS;GAC9C,IAAI,QAAQ,MAAM,4BAChB,KAAK,KACH,8BACA,IAAI,KAAK,kEACX;QAEA,OAAO,KACL,IAAI,6BACF,mBACA,IAAI,KAAK,uCACT,iEACF,CACF;EAEJ;EACA,IACE,cACA,QAAQ,WAAW,2CAEnB,OAAO,KACL,IAAI,6BACF,kBACA,IAAI,KAAK,sDACT,mDACF,CACF;EAEF,IAAI,QAAQ,iBAAiB,QAAQ,oBAAoB,MAAM;GAC7D,MAAM,WAAW,QAAQ,QAAQ;GACjC,MAAM,QAAQ,oBAAoB,OAAO,UAAU,gBAAgB,EAAE,uBAAuB,OAAO,UAAU,kBAAkB,EAAE;GACjI,MAAM,YACJ,QAAQ,oBAAoB,QAAQ,UAAU,qBAAqB,QAC/D,8FACA;GACN,KAAK,KACH,kBACA,IAAI,KAAK,4BAA4B,QAAQ,cAAc,oBAAoB,OAAO,QAAQ,eAAe,EAAE,IAAI,MAAM,GAAG,UAAU,EACxI;EACF;EACA,IACE,MAAM,QAAQ,QAAQ,eAAe,KACrC,QAAQ,gBAAgB,QAExB,KAAK,OAAO,IACV,8BAA8B,KAAK,KAAK,QAAQ,gBAAgB,KAAK,IAAI,EAAE,kCAC7E;EAEF,IAAI,cAAc,QAAQ,aAAa,SAAS,OAC9C,KAAK,KACH,kBACA,IAAI,KAAK,2CACX;EAEF,IAAI,SAAS,aAAa,QAAQ,SAAS,oBACzC,KAAK,KACH,0BACA,2HACF;EAEF,MAAM,QACJ,KAAK,OAAO,WACZ,KAAK,OAAO,UAAU,aAAa,KAAK,OAAO,OAAO;EACxD,MAAM,KAAK,QAAQ,QAAQ,UAAU;EACrC,MAAM,OAAO,QAAQ,UAAU,UAC3B,sCACA;EACJ,IACE,cACA,OAAO,kBACP,IAAI,mBAAmB,OAAO,OAAO,gBAErC,KAAK,KACH,eACA,IAAI,KAAK,sEAAsE,KAAK,GACtF;EAEF,IACE,cACA,CAAC,OAAO,kBACR,CAAC,IAAI,kBAAkB,UACvB,CAAC,IAAI,gBAAgB,QAErB,KAAK,KACH,eACA,IAAI,KAAK,kDAAkD,KAAK,GAClE;EAEF,IACE,cACA,OAAO,kBACP,IAAI,gBAAgB,UACpB,SACA,MAAM,SAAS,QAEf,KAAK,KACH,eACA,IAAI,KAAK,6EAA6E,KAAK,yDAC7F;EAEF,IAAI,cAAc,SAAS,MAAM,SAAS,OACxC,KAAK,KACH,qBACA,IAAI,KAAK,yDAAyD,KAAK,EACzE;EAEF,IACE,cACA,CAAC,QAAQ,UAAU,WACnB,QAAQ,QAAQ,WAAW,YAAY,KAAA,GACvC;GACA,MAAM,gBACJ,QAAQ,IAAI,aAAa,eACrB,8FACA;GACN,KAAK,KACH,yBACA,IAAI,KAAK,iDAAiD,cAAc,0IAC1E;EACF;CACF;CAEA,QAAgB,QAA8C;EAC5D,MAAM,UAAU,KAAK,UAAU,KAAK;EACpC,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAClC,KAAK,MAAM,SAAS,QAAQ,MAAM,IAAI,CAAC,GAAG;GACxC,MAAM,OAAO,QAAQ;GACrB,KAAK,MAAM,KAAK,OAAO,OAAO,KAAK,QAAQ,WAAW,GACpD,KAAK,MAAM,KAAK,OAAO,OAAO,MAAM,QAAQ,WAAW,GACrD,IACE,EAAE,SAAS,EAAE,QACb,eAAe,EAAE,WAAW,QAAQ,EAAE,WAAW,MAAM,KACvD,aAAa,EAAE,WAAW,MAAM,EAAE,WAAW,IAAI,GAEjD,OAAO,KACL,IAAI,6BACF,yBACA,IAAI,KAAK,KAAK,SAAS,MAAM,KAAK,qBAAqB,EAAE,KAAK,2BAC9D,4CACF,CACF;EAIR;CAEJ;CAEA,MAAM,SAAS,QAAuD;EACpE,KAAK,OAAO,SAAS;EACrB,KAAK,QAAQ,SAAS;EACtB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,6BAAa,IAAI,IAAuC;EAC9D,MAAM,2BAAW,IAAI,IAAU;EAC/B,MAAM,2BAAW,IAAI,IAAqB;EAC1C,MAAM,2BAAW,IAAI,IAAmB;EACxC,MAAM,2BAAW,IAAI,IAAa;EAClC,MAAM,aAA4B,CAAC;EACnC,MAAM,UAAU,OAAgB,WAAyB;GACvD,IAAI,CAAC,SAAS,IAAI,KAAK,GAAG;IACxB,SAAS,IAAI,KAAK;IAClB,OAAO,KAAK,mBAAmB,OAAO,qBAAqB,MAAM,CAAC;GACpE;EACF;EACA,MAAM,aAAa,QAAwB,WAAyB;GAClE,IAAI,UAAU,WAAW,IAAI,MAAM;GACnC,IAAI,CAAC,SAAS;IACZ,0BAAU,IAAI,IAAI;IAClB,WAAW,IAAI,QAAQ,OAAO;GAChC;GACA,MAAM,WAAW,QAAQ,IAAI,MAAM;GACnC,IAAI,UACF,OAAO;GAET,MAAM,UAAU,QAAQ,IAAI,OAAO,aAAa,CAAC,GAAG,MAAM;GAC1D,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,6BACR,mBACA,GAAG,OAAO,KAAK,GAAG,OAAO,mBAC3B;GAEF,MAAM,OAAO;IAAU;IAAgB;IAAQ;GAAQ;GACvD,QAAQ,IAAI,QAAQ,IAAI;GACxB,OAAO;EACT;EACA,MAAM,WAAW,SAAqB;GACpC,IAAI,SAAS,IAAI,IAAI,GACnB,MAAM,SAAS,IAAI,IAAI;GAEzB,IAAI,SAAS,IAAI,IAAI,GACnB;GAEF,IAAI;IACF,MAAM,SAAS,kBACb,KAAK,QAAQ,eAAe,KAAK,QAAQ,KAAK,MAAM,CACtD;IACA,WAAW,KAAK,GAAG,MAAM;IACzB,KAAK,MAAM,eAAe,QACxB,KAAK,SAAS,QAAQ,YAAY,MAAM;IAE1C,SAAS,IAAI,IAAI;GACnB,SAAS,OAAO;IACd,SAAS,IAAI,MAAM,KAAK;IACxB,MAAM;GACR;EACF;EACA,MAAM,UAAU,QAAwB,WAA8B;GACpE,MAAM,OAAO,UAAU,QAAQ,MAAM;GACrC,QAAQ,IAAI;GACZ,MAAM,SAAS,SAAS,IAAI,IAAI;GAChC,IAAI,QACF,OAAO;GAET,IAAI;IACF,MAAM,OAAO,KAAK,QAAQ,KAAK,KAAK,QAAQ,KAAK,MAAM;IACvD,SAAS,IAAI,MAAM,IAAI;IACvB,KAAK,OAAO,KAAK;KAAE,GAAG;KAAM;IAAK,CAAC;IAClC,OAAO;GACT,SAAS,OAAO;IACd,SAAS,IAAI,MAAM,KAAK;IACxB,MAAM;GACR;EACF;EAGA,KAAK,MAAM,QAAQ,OACjB,IACE,KAAK,QAAQ,KAAK,OAAO,KACzB;GACE;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,QAAQ,QAAQ,eAAe,KAAK,KAAK,OAAO,CAAC,GACzD;GACA,MAAM,WAAW,UAAU,KAAK,QAAQ,KAAK,MAAM;GACnD,IAAI;IACF,QAAQ,QAAQ;GAClB,SAAS,OAAO;IACd,OAAO,OAAO,kBAAkB,KAAK,OAAO,KAAK,GAAG,KAAK,OAAO,EAAE;GACpE;EACF;EAEF,IAAI,iBAAiB;EACrB,IAAI;GACF,KAAK,SAAS;GACd,iBAAiB;EACnB,SAAS,OAAO;GACd,OAAO,KACL,mBACE,OACA,6BACA,oCACF,CACF;EACF;EACA,IAAI,gBACF,KAAK,MAAM,aAAa,KAAK,WAAW,KAAK,GAC3C,IAAI;GACF,MAAM,UAAU,WAAW;IACzB,WAAW,KAAK;IAChB,WAAW,KAAK;IAChB,WAAW,KAAK;IAChB,gBAAgB,KAAK,OAAO,YAAY;IAGxC;IACA,QAAQ,QAAQ,QAAQ,OAAO,YAAY;KACzC,KAAK,QAAQ,KAAK;MAAE;MAAW;MAAQ;MAAQ;MAAO;KAAQ,CAAC;KAC/D,IAAI,WAAW,KAAA,GACb,UAAU,QAAQ,MAAM;IAE5B;IACA,QAAQ,KAAK;GACf,CAAC;EACH,SAAS,OAAO;GACd,IAAI,CAAC,SAAS,IAAI,KAAK,GAAG;IACxB,SAAS,IAAI,KAAK;IAClB,OAAO,KACL,mBACE,OACA,+BACA,cAAc,UAAU,GAAG,qBAC7B,CACF;GACF;EACF;EAGJ,KAAK,MAAM,WAAW,WAAW,OAAO,GACtC,KAAK,MAAM,QAAQ,QAAQ,OAAO,GAChC,IAAI;GACF,QAAQ,IAAI;EACd,SAAS,OAAO;GACd,OAAO,OAAO,kBAAkB,KAAK,OAAO,KAAK,GAAG,KAAK,OAAO,EAAE;EACpE;EAGJ,KAAK,gBAAgB,QAAQ,UAAU;EACvC,KAAK,MAAM,WAAW,WAAW,OAAO,GACtC,KAAK,MAAM,QAAQ,QAAQ,OAAO,GAChC,IAAI;GACF,OAAO,KAAK,QAAQ,KAAK,MAAM;EACjC,SAAS,OAAO;GACd,OAAO,OAAO,kBAAkB,KAAK,OAAO,KAAK,GAAG,KAAK,OAAO,EAAE;EACpE;EAGJ,KAAK,MAAM,QAAQ,KAAK,QACtB,IAAI;GACF,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ;GACnD,KAAK,MAAM,eAAe,kBAAkB,KAAK,KAAK,YAAY,GAChE,MAAM,KAAK,SACR,QAAQ,YAAY,MAAM,CAAC,CAC3B,WAAW,YAAY,QAAQ;IAC9B,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,MAAM,KAAK,KAAK;GAClB,CAAC;EAEP,SAAS,OAAO;GACd,OAAO,OAAO,mBAAmB,KAAK,OAAO,KAAK,GAAG,KAAK,OAAO,EAAE;EACrE;EAEF,IAAI,gBAAgB;GAClB,KAAK,SAAS,OAAO,MAAM;GAC3B,MAAM,oBAAkD,CAAC;GACzD,MAAM,mBAAmB,IAAI,iBAAiB,KAAK,SAAS;GAC5D,MAAM,eAAe,KAAK,UAAU,gBAAgB;GACpD,MAAM,oBAAoB,KAAK,UAAU,cAAc;GACvD,MAAM,UAAU,KAAK,UAAU,IAAI,kBAAkB,EAAE,QAAQ,MAAM,CAAC;GACtE,KAAK,MAAM,WAAW,KAAK,UAAU,eAAe,GAAG;IACrD,MAAM,SAAS,QAAQ;IACvB,IAAI,CAAC,QAAQ,WACX;IAEF,MAAM,aAAa,QAAQ,MAAM;IACjC,MAAM,aAAa,aACd,QAAQ,YACP,kBAAkB,QAAQ,iBAC1B,UACF,KAAK,QAAQ,YAAY,mBAAmB,UAAU,IACtD,KAAA;IACJ,MAAM,OAAO,QAAQ,YAAY,QAAQ,MAAM;IAC/C,MAAM,oBAAoB,oBACrB,QAAQ,YAAY,eAAe,MAAM,KAC1C,kBAAkB,iBAClB,KAAA;IACJ,MAAM,cAAc,QAAQ,YAAY,QAAQ,MAAM;IAItD,MAAM,WAAW,MAAM,QAAQ,WAAW,IACtC,cACA,CAAC,eAAe,EAAE;IACtB,KAAK,MAAM,UAAU,KAAK,QAAQ,kBAAkB,OAAO,SAAS,GAAG;KACrE,MAAM,UAAU,QAAQ,IAAI,OAAO,WAAW,MAAM;KACpD,MAAM,WAAW,QAAQ,YAAY,QAAQ,OAAO;KAIpD,MAAM,gBAAgB,QAAQ,YAAY,UAAU,OAAO;KAG3D,IAAI,aAAa,KAAA,KAAa,kBAAkB,KAAA,GAC9C;KAEF,MAAM,gBAAgB,QAAQ,YAC5B,eACA,OACF;KACA,MAAM,mBAAmB,iBAAiB;KAC1C,MAAM,aAAqC,CAAC;KAC5C,IAAI,SAAS,KAAA,GACX,WAAW,KAAK,MAAM;KAExB,IACE,qBACA,kBAAkB,SAAS,eAAe,OAC1C,qBAAqB,KAAA,KACrB,qBAAqB,iBAErB,WAAW,KAAK,SAAS;KAE3B,KAAK,MAAM,UAAU,UACnB,KAAK,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IACrC,WACA,CAAC,QAAQ,GAAG;MACd,MAAM,gBAAgB,iBACnB,OACC;OACE,UAAU;OACV,YAAY;OACZ;OACA;OAEE;OACF;OACA;MACF,GACA,aACF,CAAC,CACA,KAAK,UAAU,KAAK,OAAO,0BAA0B,KAAK,CAAC;MAC9D,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG;MACjC,kBAAkB,KAChB,OAAO,OAAO;OACZ,QAAQ,cAAc,kBAAkB,OAAO,aAAa;OAC5D,OAAO,OAAO,OAAO,CAAC,GAAG,aAAa,CAAC;OACvC,YAAY,OAAO,OAAO,CAAC,GAAG,UAAU,CAAC;OACzC;MACF,CAAC,CACH;MACA,KAAK,MAAM,SAAS,eAAe;OACjC,MAAM,UAAU,KAAK,OAClB,SAAS,CAAC,CACV,MAAM,cACL,uBAAuB,OAAO,UAAU,QAAQ,CAClD;OACF,IAAI,CAAC,SACH;OAEF,KAAK,KACH,wBACA,GAAG,OAAO,OAAO,MAAM,2BAA2B,QAAQ,SAAS,GACrE;MACF;KACF;IAEJ;GACF;GACA,KAAK,OAAO,0BACV,OAAO,OAAO,iBAAiB,GAC/B,MACF;EACF;EACA,KAAK,QAAQ,MAAM;EACnB,KAAK,MAAM,SAAS,KAAK,UAAU,KAAK,GAAG;GACzC,MAAM,QAAQ,KAAK,OAAO,QACvB,SAAS,KAAK,KAAK,aAAa,MAAM,IACzC;GACA,MAAM,WAAW,CACf,GAAG,IAAI,IACL,MAAM,SAAS,SACb,kBAAkB,KAAK,KAAK,YAAY,CAAC,CAAC,KAAK,gBAC7C,KAAK,SAAS,QAAQ,YAAY,MAAM,CAC1C,CACF,CACF,CACF;GACA,KAAK,YAAY,OAAO,UAAU,MAAM;GACxC,MAAM,WAA6B,MAAM,KAAK,SAAS;IACrD,MAAM,SAAS,KAAK,QAAQ,QACzB,UACC,MAAM,WAAW,KAAK,WACrB,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,KAAK,OACzD;IACA,OAAO;KACL,MAAM,KAAK;KACX,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,UAAU,EAAE,CAAC,CAAC;KAClE,QAAQ,CACN,GAAG,IAAI,IAAI,OAAO,SAAS,UAAU,MAAM,QAAQ,UAAU,CAAC,CAAC,CAAC,CAClE;IACF;GACF,CAAC;GACD,MAAM,SAA4B;IAChC,UAAU,MAAM;IAChB,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,YAAY,eAAe;IAC3B,gBAAgB,KAAK,OAAO,YAAY;IACxC,aAAa;KACX,MAAM,MAAM,QAAQ,aAAa,QAAQ;KACzC,eAAe,MAAM,QAAQ,aAAa,iBAAiB;IAC7D;IACA;IACA,YAAY,KAAK,WACd,KAAK,CAAC,CACN,KAAK,eAAe,EAAE,IAAI,UAAU,GAAG,EAAE;IAC5C,SAAS,MAAM;IACf;GACF;GACA,KAAK,MAAM,QAAQ;IACjB,GAAG,MAAM;IACT,GAAG;IACH,GAAG,KAAK,WAAW,KAAK;IACxB,GAAI,KAAK,OAAO,WAAW,CAAC,KAAK,OAAO,QAAQ,IAAI,CAAC;GACvD,GACE,IAAI;IACF,KAAK,MAAM,QAAS,MAAM,KAAK,SAAS,MAAM,KAAM,CAAC,GAAG;KACtD,MAAM,OAAO,GAAG,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK,UAAU,KAAK,OAAO,IAAI,KAAK,SAAS;KACvG,IAAI,KAAK,UAAU,QACjB,KAAK,OAAO,KAAK,IAAI;UAErB,KAAK,OAAO,IAAI,IAAI;IAExB;GACF,SAAS,OAAO;IACd,OAAO,KACL,mBACE,OACA,2BACA,gBAAgB,KAAK,GAAG,UAC1B,CACF;GACF;EAEJ;CACF;CAEA,QACE,OACM;EACN,KAAK,MAAM,SAAS,KAAK,UAAU,KAAK,GAAG;GACzC,IAAI,MAAM,QAAQ,eAAe,OAC/B;GAEF,MAAM,QAAQ,KAAK,OAAO,QAAQ,MAAM,IAAI;GAC5C,MAAM,QAAQ,KAAK,OAChB,QAAQ,SAAS,KAAK,KAAK,aAAa,MAAM,IAAI,CAAC,CACnD,KAAK,SAAS,KAAK,IAAI;GAC1B,MAAM,OAAO,MAAM,QAAQ,UAAU,UACjC,OACA,MAAM,QAAQ,QAAQ,WAAW,YAAY,QAC3C,kCACA,QAAQ,IAAI,aAAa,eACvB,2FACA,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;GACzD,MAAM,QAAQ,MAAM,IAAI,MAAM,IAAI;GAClC,MAAM,cAAc,QAChB,GAAG,MAAM,OAAO,OAAO,WAAW,MAAM,MAAM,OAAO,UAAU,OAAO,OAAO,MAAM,QAAQ,CAAC,CAAC,QAAQ,OAAO,UAAU,QAAQ,MAAM,OAAO,SAAS,MAAM,MAAM,QAAQ,CAAC,EAAE,aAC3K;GACJ,MAAM,QAAQ,KAAK,OAAO,UACtB,KAAK,OAAO,UAAU,aAAa,KAAK,OAAO,OAAO,IACtD,KAAA;GACJ,MAAM,WAAW,WAAW,MAAM,QAAQ,iBAAiB,gBAAgB,YAAY,MAAM,QAAQ,aAAa,QAAQ,SAAS,GAAG,MAAM,QAAQ,aAAa,iBAAiB,SAAS,yBAAyB,MAAM,QAAQ,SAAS,qBAAqB,oBAAoB;GACpR,MAAM,aAAa,KAAK,UACrB,gBAAgB,CAAC,CACjB,KAAK,UAAU,MAAM,YAAY,IAAI,CAAC,CACtC,KAAK,KAAK;GACb,KAAK,OAAO,IACV,IAAI,MAAM,KAAK,KAAK,QAAQ,cAAc,MAAM,SAAS,IAAI,MAAM,UAAU,WAAW,cAAc,cAAc,KAAK,OAAO,UAAU,MAAM,OAAO,iBAAiB,OAAO,QAAQ,YAAY,OAAO,SAAS,IAAI,MAAM,WAAW,GAAG,4BAA4B,KAAK,UAAU,gBAAgB,EAAE,YAAY,YAAY,cAAc,SAAS,gBAAgB,KAAK,WACzW,KAAK,CAAC,CACN,KAAK,SAAS,KAAK,EAAE,CAAC,CACtB,KACC,IACF,EAAE,gBAAgB,MAAM,QAAQ,KAAK,SAAS,GAAG,KAAK,GAAG,IAAI,KAAK,cAAc,WAAW,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,cAAc,MAAM,OAAO,IAAI,MAAM,QAAQ,SAAS,KAAK,WAAW,QAAQ,CAAC,CAAC,OAAO,WAAW,MAAM,QAAQ,SAAS,KAAK,WAAW,UAAU,CAAC,CAAC,OAAO,aAAa,MAAM,QAAQ,SAAS,KAAK,WAAW,SAAS,CAAC,CAAC,OAAO,YAAY,MAAM,QAAQ,SAAS,KAAK,wBAAwB,CAAC,CAAC,OAAO,gCAAgC,eAAe,IAAI,eAAe,cAAc,aAAa,QAAQ,IAAI,YAAY,QAAQ,iBAAiB,KAAK,WAAW,KAAK,eAAe,WAAW,8BAA8B,mBAAmB,YACxoB;EACF;CACF;AACF;;CAr7BK,gBAAA,GAAA,OAAO,gBAAgB,CAAA;CACvB,gBAAA,GAAA,OAAO,eAAe,CAAA;CACtB,gBAAA,GAAA,OAAO,SAAS,CAAA;CAChB,gBAAA,GAAA,OAAO,SAAS,CAAA;CAChB,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,aAAa,CAAA;CACpB,gBAAA,GAAA,OAAO,eAAe,CAAA;CACtB,gBAAA,GAAA,OAAO,kBAAkB,CAAA;CACzB,gBAAA,GAAA,OAAO,iBAAiB,CAAA;;;;ACvJ7B,MAAa,mBAAkD;CAC7D;CACA;CACA;CACA;AACF,CAAC,CAAC,SAAS,UACT;CAAC;CAAU;CAAU;AAAQ,CAAC,CAAC,KAC5B,cAAc,GAAG,MAAM,GAAG,WAC7B,CACF;AACA,SAAgB,kBAA8B;CAC5C,OAAO;EACL,QAAQ,CAAC;EACT,OAAO,CAAC;EACR,UAAU,OAAO,YACf,iBAAiB,KAAK,WAAW,CAAC,QAAQ;GAAE,QAAQ,CAAC;GAAG,OAAO,CAAC;EAAE,CAAC,CAAC,CACtE;CACF;AACF;AAEA,SAASC,WAAS,GAAW,GAAmB;CAC9C,IAAI,MAAM,MAAM,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;CAC1D,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK;EAClC,MAAM,OAAO,CAAC,CAAC;EACf,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,QAAQ,KAC7B,KAAK,KAAK,KAAK,IACb,KAAK,IAAI,KAAM,GACf,IAAI,KAAM,GACV,IAAI,IAAI,MAAO,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI,EAC7C;EAEF,MAAM;CACR;CACA,OAAO,IAAI,EAAE;AACf;AAEO,IAAM,aAAN,MAAM,WAAW;CAIuB;CACD;CAJ5C,SAA0B,IAAI,OAAO,YAAY;CAEjD,YACE,WACA,SACA;EAF2C,KAAA,YAAA;EACD,KAAA,UAAA;CACzC;CAEH,SACE,UACA,QACyB;EACzB,MAAM,2BAAW,IAAI,IAGnB;EACF,MAAM,2BAAW,IAAI,IAQnB;EACF,MAAM,gBAAgB,IAAI,IACxB,SAAS,cAAc,CAAC,CAAC,KAAK,SAAS,KAAK,IAAI,CAClD;EACA,MAAM,6BAAa,IAAI,IAAqB;EAC5C,KAAK,MAAM,WAAW,KAAK,UAAU,aAAa,GAAG;GACnD,IACE,QAAQ,WACR,CAAC,QAAQ,YACR,OAAO,QAAQ,aAAa,YAC3B,OAAO,QAAQ,aAAa,YAE9B;GAEF,MAAM,WAAW,QAAQ;GAEzB,IAAI,CADc,OAAO,eAAe,QAC3B,GACX;GAEF,MAAM,UAAU,IAAI,IAClB,KAAK,QAAQ,kBAAkB,QAAQ,CACzC;GACA,KACE,IAAI,UAAyB,UAC7B,WAAW,YAAY,OAAO,WAC9B,UAAU,OAAO,eAAe,OAAO,GAEvC,KAAK,MAAM,OAAO,OAAO,sBAAsB,OAAO,GACpD,IACE,OAAO,OAAO,yBAAyB,SAAS,GAAG,CAAC,EAAE,UACtD,YAEA,QAAQ,IAAI,GAAG;GAIrB,IAAI,QAAQ;GACZ,KAAK,MAAM,UAAU,SAAS;IAC5B,MAAM,UAAU,QAAQ,IAAI,UAAU,MAAM;IAC5C,IAAI,OAAO,YAAY,YACrB;IAEF,MAAM,WAAW,iBAAiB,OAAO;IACzC,IAAI,CAAC,SAAS,MAAM,UAAU,CAAC,SAAS,cAAc,QACpD;IAEF,QAAQ;IACR,IAAI,CAAC,0BAA0B,OAAO,GAAG;KACvC,OAAO,KACL,IAAI,6BACF,2BACA,kBAAkB,QAAQ,KAAK,+BAC/B,4DACF,CACF;KACA;IACF;IACA,KAAK,MAAM,eAAe,SAAS,OAAO;KACxC,MAAM,OAAO,YAAY,QAAQ,YAAY;KAC7C,IAAI,CAAC,cAAc,IAAI,IAAI,GAAG;MAC5B,OAAO,KACL,IAAI,6BACF,oBACA,SAAS,QAAQ,KAAK,GAAG,OAAO,MAAM,EAAE,4BAA4B,KAAK,GAC3E,CACF;MACA;KACF;KACA,MAAM,QAAQ,SAAS,KAAK,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,IAAI;KACjE,IAAI,CAAC,OACH;KAEF,MAAM,QAAQ,OAAO,OAAO,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,QACvD,OAAO,QAAQ,cACf,OAAO,QAAQ,IAAI,KAAK,MAAM,MAAM,WAChC,CAAC,QAAQ,IAAI,KAAK,MAAM,CAAW,IACnC,CAAC,CACP;KACA,MAAM,EAAE,OAAO,YAAY;KAC3B,MAAM,WACJ,OAAO,UAAU,WACb,CAAC,KAAK,IACN,MAAM,QAAQ,KAAK,IACjB,QACA,CAAC;KACT,KAAK,MAAM,WAAW,UACpB,IAAI,CAAC,MAAM,SAAS,OAAO,GAAG;MAC5B,MAAM,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,MACxB,GAAG,MAAMA,WAAS,GAAG,OAAO,IAAIA,WAAS,GAAG,OAAO,CACtD,CAAC,CAAC;MACF,OAAO,KACL,IAAI,6BACF,qBACA,SAAS,QAAQ,KAAK,GAAG,OAAO,MAAM,EAAE,sBAAsB,QAAQ,KACtE,UACI,iBAAiB,QAAQ,MACzB,qDACN,CACF;KACF;KAEF,MAAM,OAAqB;MACzB,QAAQ,KAAK,OAAO;OAClB,MAAM,SAAS,QAAQ,IAAI,KAAK,OAAO,MAAM;OAC7C,IACG,QAAQ,UAAU,UAAU,CAAC,UAC7B,QAAQ,UAAU,YAAY,UAC9B,QAAQ,gBAAgB,OAAO,UAEhC,OAAO;OAET,IAAI,UAAU,KAAA,GACZ,OAAO;OAET,IAAI,OAAO,UAAU,YACnB,OAAO,MAAM,GAAsB;OAErC,OAAO,OAAO,UAAU,WACpB,IAAI,SAAS,QACb,MAAM,SAAS,IAAI,QAAQ,EAAE;MACnC;MACA,MAAM,IAAI,KAAK;OACb,OAAO,QAAQ,KAAK,UAAU,GAAG;MACnC;KACF;KACA,MAAM,OAAO,SAAS,IAAI,IAAI,KAAK,CAAC;KACpC,KAAK,KAAK;MACR,OAAO,YAAY;MACnB,OAAO,QAAQ,SAAS;MACxB;KACF,CAAC;KACD,SAAS,IAAI,MAAM,IAAI;IACzB;IACA,KAAK,MAAM,eAAe,SAAS,eAAe;KAChD,MAAM,OAAO,YAAY,QAAQ,YAAY;KAC7C,IAAI,CAAC,cAAc,IAAI,IAAI,GAAG;MAC5B,OAAO,KACL,IAAI,6BACF,oBACA,kBAAkB,QAAQ,KAAK,GAAG,OAAO,MAAM,EAAE,4BAA4B,KAAK,GACpF,CACF;MACA;KACF;KACA,MAAM,OAAO,SAAS,IAAI,IAAI,KAAK,CAAC;KACpC,KAAK,KAAK;MACR,OAAO,YAAY;MACnB,QAAQ,YAAY;MACpB,OAAO,YAAY,QAAQ,SAAS;MACpC,MAAM,QAAQ,KAAK,QAAQ;KAC7B,CAAC;KACD,SAAS,IAAI,MAAM,IAAI;IACzB;GACF;GACA,IAAI,OAAO;IACT,MAAM,QAAQ,QAAQ,MAAM,QAAQ;IACpC,MAAM,WAAW,WAAW,IAAI,QAAQ,QAAQ;IAChD,IAAI,UACF,KAAK,OAAO,KACV,+BAA+B,QAAQ,KAAK,oBAAoB,SAAS,SAAS,MAAM,2BAC1F;IAEF,WAAW,IAAI,QAAQ,UAAU,KAAK;GACxC;EACF;EACA,MAAM,yBAAS,IAAI,IAAwB;EAC3C,KAAK,MAAM,QAAQ,eAAe;GAChC,MAAM,SAAS,SAAS,IAAI,IAAI,KAAK,CAAC,EAAA,CAAG,MACtC,GAAG,MAAM,EAAE,QAAQ,EAAE,KACxB;GACA,MAAM,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,EAAA,CAAG,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;GACtE,OAAO,IAAI,MAAM;IACf,QAAQ,MACL,QAAQ,UAAU,MAAM,UAAU,QAAQ,CAAC,CAC3C,KAAK,UAAU,MAAM,IAAI;IAC5B,OAAO,MACJ,QAAQ,UAAU,MAAM,UAAU,OAAO,CAAC,CAC1C,KAAK,UAAU,MAAM,IAAI;IAC5B,UAAU,OAAO,YACf,iBAAiB,KAAK,WAAW,CAC/B,QACA;KACE,QAAQ,GACL,QACE,UACC,MAAM,WAAW,UAAU,MAAM,UAAU,QAC/C,CAAC,CACA,KAAK,UAAU,MAAM,IAAI;KAC5B,OAAO,GACJ,QACE,UAAU,MAAM,WAAW,UAAU,MAAM,UAAU,OACxD,CAAC,CACA,KAAK,UAAU,MAAM,IAAI;IAC9B,CACF,CAAC,CACH;GACF,CAAC;EACH;EACA,OAAO;CACT;AACF;;CA5NK,gBAAA,GAAA,OAAO,gBAAgB,CAAA;CACvB,gBAAA,GAAA,OAAO,eAAe,CAAA;;;;;ACzB3B,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAS,YAAY,OAAmC;CACtD,IAAI;EACF,OAAO,WAAW,KAAK;CACzB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,aAAsB;CAC7B,OAAO,CAAC;EAAC;EAAe;EAAO;CAAM,CAAC,CAAC,SAAS,QAAQ,IAAI,YAAY,EAAE;AAC5E;AAEA,SAAS,SAAS,MAAc,OAAuB;CACrD,IAAI,WAAW,MAAM,KAAK,EAAE,QAAQ,MAAM,SAAS,EAAE,IAAI,GAAG,UAAU,KAAK;CAC3E,KAAK,IAAI,MAAM,GAAG,MAAM,KAAK,QAAQ,OAAO;EAC1C,MAAM,UAAU,CAAC,MAAM,CAAC;EACxB,KAAK,IAAI,SAAS,GAAG,SAAS,MAAM,QAAQ,UAC1C,QAAQ,KACN,KAAK,IACH,QAAQ,UAAW,GACnB,SAAS,SAAS,KAAM,GACxB,SAAS,UAAW,OAAO,KAAK,SAAS,MAAM,OAAO,CACxD,CACF;EAEF,WAAW;CACb;CACA,OAAO,SAAS,MAAM;AACxB;;AAGA,IAAa,eAAb,MAA0B;CAGK;CAF7B,eAAe;CAEf,YAAY,OAAsC;EAArB,KAAA,QAAA;CAAsB;CAEnD,OAAO,OAAsB,MAA0C;EACrE,MAAM,QAAQ,CACZ,GAAG,IAAI,IACL,OAAO,OAAO,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,aAAa;GACtD,MAAM,OAAO,QAAQ,IAAI,UAAU,MAAM;GACzC,OAAO,OAAO,SAAS,WAAW,CAAC,IAAI,IAAI,CAAC;EAC9C,CAAC,CACH,CACF;EACA,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,UAA4B,OAAO,OAAO;GAC9C,UAAU,MAAM;GAChB,UAAU,KAAK;GACf,WAAW,KAAK;GAChB,cAAc,KAAK;GACnB,UAAU,aACR,KAAK,aAAa,MACd,SAAS,WAAW,GAAG,IACvB,aAAa,KAAK,YAClB,SAAS,WAAW,GAAG,KAAK,SAAS,EAAE;GAC7C,uBACE,SAAS,KACP;IACE,MAAM;IACN,SAAS;GACX,GACA,EAAE,QAAQ,IAAI,CAChB;GACF,QAAQ,OAAO,YAAgC;IAC7C,MAAM,WAAW,MAAM,KAAK,OAAO,OAAO,MAAM,SAAS,OAAO;IAChE,IACE,SAAS,WAAW,QACnB,MAAM,QAAQ,MAAM,eAAe,CAAC,WAAW,IAChD;KACA,MAAM,WAAW,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;KACtC,MAAM,MAAM,GAAG,QAAQ,OAAO,YAAY,EAAE,GAAG;KAC/C,IAAI,QAAQ,QAAQ,QAAQ,KAAK,CAAC,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,KAAK;MAClE,KAAK,IAAI,GAAG;MACZ,MAAM,YAAY,SAAS,MACzB,KAAK,aAAa,MAAM,IAAI,KAAK,SAAS,MAC5C;MACA,MAAM,UAAU,MAAM,QACnB,MAAM,SACL,SAAS,KAAA,KACT,SAAS,WAAW,IAAI,IAAI,SAAS,WAAW,IAAI,IAChD,OACA,MACN,KAAA,CACF;MACA,MAAM,aAAa,UACf,iBAAiB,KAAK,aAAa,MAAM,KAAK,KAAK,WAAW,QAAQ,KACtE;MACJ,KAAK,OAAO,KACV,gCAAgC,IAAI,eAAe,KAAK,SAAS,IAAI,YACvE;KACF;IACF;IACA,OAAO;GACT;EACF,CAAC;EACD,OAAO;CACT;CAEA,MAAc,OACZ,OACA,MACA,SACA,SACmB;EACnB,MAAM,YAAY,CAChB,IAAI,cAAc;GAChB,SAAS,CAAC,MAAM,QAAQ,MAAM;GAC9B,SAAS,QAAQ;GACjB,mBAAmB,MAAM;EAC3B,CAAC,CACH;EACA,IAAI;GACF,MAAM,SAAS,QAAQ,OAAO,YAAY;GAC1C,IAAI,OAA0B;GAC9B,IAAI,WAAW,SAAS,WAAW,QAAQ;IACzC,IAAI,QAAQ,gBAAgB,YAAY;KACtC,IAAI,QAAQ,KAAK,aAAa,KAAK,WACjC,OAAO,QAAQ,gBAAgB;KAEjC,OAAO,QAAQ;IACjB,OAAO,IAAI,QAAQ,SAAS,MAAM;KAChC,MAAM,UAAU,MAAM,gBAAgB,QAAQ,MAAM,EAClD,OAAO,KAAK,UACd,CAAC;KACD,IAAI,CAAC,QAAQ,IAAI;MACf,IAAI,QAAQ,WAAW,aACrB,OAAO,QAAQ,gBAAgB;MAEjC,MAAM,IAAI,MAAM,yCAAyC;KAC3D;KACA,OAAO,QAAQ;IACjB;GACF;GACA,IAAI;GACJ,IAAI;IACF,MAAM,IAAI,IAAI,QAAQ,GAAG;IACzB,IACE,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,UAEJ,MAAM,IAAI,UAAU,qBAAqB;IAE3C,IAAI,KAAK,cACP,MAAM,IAAI,IAAI,GAAG,KAAK,eAAe,IAAI,WAAW,IAAI,QAAQ;GAEpE,QAAQ;IACN,OAAO,SAAS,KACd;KAAE,MAAM;KAAuB,SAAS;IAAsB,GAC9D,EAAE,QAAQ,IAAI,CAChB;GACF;GACA,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,MAAM,aAAa,QAAQ,IAAI,YAAY,KAAK,GAAA,CAC7C,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,OAAO,OAAO;GACjB,KAAK,MAAM,QAAQ,CAAC,GAAG,aAAa,GAAG,SAAS,GAC9C,QAAQ,OAAO,IAAI;GAErB,MAAM,WAAW,MAAM,OAAO;GAC9B,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IAAI,KAAK,WAAW,YAAY,KAAK,SAAS,UAAU,YAAY,GAClE,QAAQ,OAAO,IAAI;GAGvB,IAAI,YAAY,QAAQ,aAAa,MACnC,QAAQ,IAAI,UAAU,QAAQ,QAAQ;GAExC,KAAK,UAAU,OAAO,MAAM,OAAO;GACnC,MAAM,UAAU,IAAI,QAAQ,KAAK;IAC/B;IACA;IACA,MAAM,SAAS,OAAO,OAAO,WAAW,KAAK,IAAI;IACjD,QAAQ,QAAQ;GAClB,CAAC;GACD,MAAM,eAAe,MAAM,QAAQ,MAAM,UAAU,CAAC;GACpD,MAAM,YAAY,OAAe,YAAwC;IACvE,UAAU,KACR,IAAI,cAAc;KAChB,SAAS,QAAQ;KACjB,mBAAmB,MAAM;IAC3B,CAAC,CACH;IACA,MAAM,cAAc,aAAa;IACjC,OAAO,cACH,YACE;KACE,SAAS;KACT,iBAAiB,QAAQ;KACzB,UAAU,MAAM;IAClB,IACC,cAAc,YAAY,SAAS,QAAQ,GAAG,WAAW,CAC5D,IACA,KAAK,MAAM,WAAW,MAAM,SAAS,QAAQ,OAAO,CAAC;GAC3D;GACA,OAAO,MAAM,SAAS,GAAG,OAAO;EAClC,SAAS,OAAO;GACd,IAAI,YAAY,KAAK,GAAG;IACtB,IAAI,MAAM,QAAQ,QAAQ,YAAY,OACpC,MAAM;IAER,OAAO,SAAS,KAAK,MAAM,QAAQ,EAAE,SAAS,MAAM,QAAQ,GAAG;KAC7D,QAAQ,MAAM;KACd,SAAS,mBAAmB,KAAK;IACnC,CAAC;GACH;GACA,IAAI,QAAiB;GACrB,KAAK,MAAM,YAAY,WACrB,QAAQ,SAAS,OAAO,KAAK;GAE/B,MAAM,UAAU,0BAA0B,KAAK;GAC/C,IAAI,MAAM,QAAQ,QAAQ,gBAAgB;IAExC,MAAM,MAAM,0BAA0B,OAAO,EAAE,gBAAgB,KAAK,CAAC;IACrE,OAAO,eAAe,KAAK,SAAS,EAAE,OAAO,QAAQ,MAAM,CAAC;IAC5D,MAAM;GACR;GACA,MAAM;EACR;CACF;CAEA,UACE,OACA,MACA,SACM;EACN,IACE,KAAK,gBACL,CAAC,WAAW,KACZ,KAAK,YAAY,SAAS,UAC1B,CAAC;GAAC;GAAmB;GAAa;EAAW,CAAC,CAAC,MAAM,SACnD,QAAQ,QAAQ,IAAI,IAAI,CAC1B,GAEA;EAEF,KAAK,eAAe;EACpB,MAAM,KAAK,MAAM,QAAQ,QAAQ,UAAU;EAC3C,MAAM,eAAe,MAAM,OAAO;EAClC,MAAM,oBACJ,iBAAiB,QACjB,IAAI,mBAAmB,EAAE,EAAE,YAAY,MAAM,aAAa,YAAY;EACxE,IAAI;EACJ,IAAI,CAAC,MAAM,QAAQ,UAAU,SAAS;GACpC,IAAI,iBAAiB,MACnB,SACE;QACG,IAAI,CAAC,mBACV,SACE;QAEF,SACE;EAEN,OAAO,IAAI,iBAAiB,MAC1B,SACE;OACG,IAAI,CAAC,mBACV,SACE;OACG,IAAI,IAAI,gBAAgB,QAC7B,SACE;OAEF,SACE;EAEJ,KAAK,OAAO,KACV,kDAAkD,QAAQ,YAAY,UAAU,IAAI,OAAO,mCAAmC,KAAK,WAAW,OAAO,GACvJ;CACF;AACF;;AAGA,SAAgB,qBACd,MACA,SAIQ;CACR,MAAM,UAAU,YAAa,MAAM,KAAK;CACxC,MAAM,UAAU,IAAI,eAAe,OAAO;CAC1C,QAAQ,QAAQ,aAAa;EAC3B,CAAM,YAAY;GAEhB,IAAI,QAAO,MADe,QAAQ,EAAA,CACX,QAAQ,mBAAmB,YAChD,MAAM,IAAI,6BACR,uBACA,6FACA,8EACF;GAEF,IAAI,CAAC,QACH,OAAO;GAET,IAAI,SAAS,eACX,OAAO,QAAQ,UAAU,MAAM;GAEjC,QAAQ,MAAM,QAAQ,KAAK,EAAA,CAAG,MAAM,cAAc;IAChD,IAAI;KACF,MAAM,SAAS,IAAI,IAAI,SAAS;KAChC,QACG,OAAO,aAAa,WAAW,OAAO,aAAa,aACpD,CAAC,UAAU,SAAS,GAAG,KACvB,cAAc,OAAO,UACrB,WAAW;IAEf,QAAQ;KACN,OAAO;IACT;GACF,CAAC;EACH,EAAA,CAAG,CAAC,CAAC,MACF,UAAU,SAAS,MAAM,KAAK,IAC9B,UACC,SACE,iBAAiB,QACb,wBACA,IAAI,MAAM,wCAAwC,CACxD,CACJ;CACF;AACF;;;AC7VA,MAAM,UAAU,OAAO,IAAI,qCAAqC;AAChE,SAAgB,eAAe,OAA4C;CACzE,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,MAAM,QACJ,OAAO,UAAU,WACb,8BAA8B,KAAK,KAAK,IACxC;CACN,MAAM,QACJ,OAAO,UAAU,WACb,QACA,QACE,OAAO,MAAM,EAAE,KACd;EAAE,GAAG;EAAG,IAAI;EAAM,IAAI;CAAQ,EAAE,MAAM,EAAE,CAAE,YAAY,MAAM,KAC7D;CACR,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,6BACR,sBACA,4BAA4B,MAAM,KAClC,wDACF;CAEF,OAAO;AACT;AAEO,IAAM,mBAAN,MAAM,iBAAiB;CAUQ;CACU;CAV9C,SAAkB,IAAI,OAAO,YAAY;CACzC;CACA,4BAAqB,IAAI,IAA8B;CACvD;CACA,YAAwC;CACxC;CACA,qBAAqD,CAAC;CAEtD,YACE,MACA,UACA,OACA;EAHkC,KAAA,OAAA;EACU,KAAA,WAAA;EAG5C,KAAK,YAAY,IAAI,aAAa,KAAK;EACvC,KAAK,MAAM,gBAAgB,KAAK,WAAW,KAAK,CAAC;CACnD;CAEA,kBAAkB,WAA0C;EAC1D,KAAK,aAAa;EAClB,KAAK,WAAW,KAAK;CACvB;CAEA,IAAI,WAAqC;EACvC,OAAO,KAAK;CACd;CAEA,IAAI,UAAsC;EACxC,OAAO,KAAK,KAAK,eAAe;CAClC;CAEA,WAAmB,QAAuB;EACxC,MAAM,UAAU,KAAK;EACrB,IAAI,CAAC,WAAW,CAAC,KAAK,cAAc,KAAK,cAAc,SACrD;EAEF,IAAI;GACF,IAAI,KAAK,SAAS,UAAU,SAAS,KAAK,SAAS,YAAY,SAC7D,MAAM,IAAI,6BACR,qBACA,6DACA,sDACF;GAEF,MAAM,YAAY,KAAK,WAAW,QAAQ,aACxC,SAAS,SAAS,OAAO,CAC3B;GACA,IAAI,UAAU,WAAW,GACvB,MAAM,IAAI,6BACR,UAAU,SAAS,uBAAuB,eAC1C,wDAAwD,UAAU,OAAO,IACzE,sEACF;GAEF,MAAM,WAAW,UAAU;GAC3B,IACE,UACA,KAAK,cAAc,QACnB,CAAC,SAAS,cAAc,eAExB,MAAM,IAAI,6BACR,uBACA,oEACA,wEACF;GAEF,SAAS,UAAU;IACjB;IACA,QAAQ,KAAK;IACb,QAAQ,aAAa,KAAK,MAAM,QAAQ;GAC1C,CAAC;GACD,KAAK,YAAY;GACjB,KAAK,YAAY;EACnB,SAAS,OAAO;GACd,KAAK,mBAAmB,KACtB,mBACE,OACA,+BACA,mCACF,CACF;EACF;CACF;CAEA,cAAc,QAA8C;EAC1D,KAAK,WAAW,IAAI;EACpB,OAAO,KAAK,GAAG,KAAK,kBAAkB;EACtC,KAAK,qBAAqB,CAAC;EAC3B,IAAI,KAAK,WAAW,KAAK,WACvB,IAAI;GACF,KAAK,UAAU,WAAW,KAAK,OAAO;EACxC,SAAS,OAAO;GACd,OAAO,KACL,mBACE,OACA,8BACA,kCACF,CACF;EACF;CAEJ;CAEA,QAAQ,QAA8C;EACpD,KAAK,UAAU,MAAM;EACrB,MAAM,UAAU,KAAK;EACrB,IAAI,CAAC,WAAW,CAAC,KAAK,WACpB;EAEF,MAAM,SAAS,QAAQ,YAAY;EACnC,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO;EAC3C,KAAK,MAAM,SAAS,KAAK,SAAS,KAAK,GAAG;GACxC,IAAI,MAAM,QAAQ,MAAM,UAAU,OAChC;GAEF,IAAI;IACF,MAAM,MAAM,MAAM,QAAQ,UACtB,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC,CAAC,WAC/B,MAAM,QAAQ,QAAQ,YAAY;IACtC,MAAM,WAAW,IAAI,SAAS,IAAI,IAAI,QAAQ,QAAQ,EAAE,IAAI;IAC5D,IACE,CAAC,SAAS,WAAW,GAAG,KACvB,aAAa,OAAO,CAAC,MAAM,QAAQ,MAAM,gBAE1C,MAAM,IAAI,6BACR,sBACA,4BAA4B,SAAS,KACrC,wEACF;IAEF,IAAI,SAAS,IAAI,QAAQ,GACvB,MAAM,IAAI,6BACR,mBACA,cAAc,SAAS,uCACvB,yCACF;IAEF,KAAK,MAAM,YAAY,KAAK,UAAU,OAAO,GAC3C,IACE,aAAa,OACb,SAAS,aAAa,OACtB,SAAS,QAAQ,QAAQ,KACzB,SAAS,WAAW,GAAG,SAAS,SAAS,EAAE,KAC3C,SAAS,SAAS,WAAW,GAAG,SAAS,EAAE,GAE3C,MAAM,IAAI,6BACR,sBACA,WAAW,SAAS,SAAS,SAAS,SAAS,aAC/C,mDACF;IAGJ,KAAK,UAAU,IACb,MAAM,MACN,KAAK,UAAU,OAAO,OAAO;KAC3B;KACA,WAAW,eAAe,MAAM,QAAQ,MAAM,SAAS;KACvD,cAAc,MAAM,QAAQ,UACxB,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC,CAAC,SAC/B,KAAA;KACJ,QAAQ,KAAK;KACb,YAAY,KAAK,UAAU,aAAa,OAAO;IACjD,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,KACL,mBACE,OACA,sBACA,6BAA6B,MAAM,KAAK,GAC1C,CACF;GACF;EACF;CACF;CAEA,MAAM,UAAgD;EACpD,OAAO,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,MAAM,YACxC,QAAQ,QAAQ,QAAQ,CAC1B;CACF;CAEA,QAAQ,MAA4C;EAClD,OAAO,KAAK,UAAU,IAAI,IAAI;CAChC;CAEA,WAAwC;EACtC,OAAO,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC;CACpC;CAEA,0BAA0B,MAAsB;EAC9C,MAAM,UAAU,KAAK;EACrB,OAAO,WAAW,OAAO,QAAQ,kBAAkB,aAC/C,QAAQ,cAAc,IAAI,IAC1B;CACN;CAEA,0BACE,QACA,QACM;EACN,IAAI;GACF,KAAK,WAAW,oBACd,QACA,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,CAAC,CAC5C;EACF,SAAS,OAAO;GACd,OAAO,KACL,mBACE,OACA,yCACA,4DACF,CACF;EACF;CACF;CAEA,MAAM,QAAuB;EAC3B,MAAM,UAAU,KAAK;EACrB,MAAM,WAAW,KAAK;EACtB,IAAI,CAAC,WAAW,CAAC,UACf;EAEF,MAAM,SAAS,QAAQ,YAAY;EACnC,IAAI,UAAU,QAAQ,IAAI,QAAQ,OAAO;EACzC,IAAI,CAAC,SAAS;GACZ,0BAAU,IAAI,IAAI;GAClB,OAAO,eAAe,QAAQ,SAAS,EAAE,OAAO,QAAQ,CAAC;EAC3D;EACA,KAAK,MAAM,WAAW,KAAK,UAAU,OAAO,GAAG;GAC7C,IAAI,QAAQ,IAAI,QAAQ,QAAQ,GAC9B,MAAM,IAAI,6BACR,mBACA,cAAc,QAAQ,SAAS,sBACjC;GAEF,MAAM,SAAS,MAAM;IAAE;IAAS,QAAQ,KAAK;IAAQ;GAAQ,CAAC;GAC9D,QAAQ,IAAI,QAAQ,QAAQ;EAC9B;CACF;CAEA,QAAc;EACZ,KAAK,UAAU,MAAM;EACrB,KAAK,qBAAqB,CAAC;CAC7B;AACF;;CA3OK,gBAAA,GAAA,OAAO,eAAe,CAAA;CACtB,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,aAAa,CAAA;;;;;;;;;AClDzB,IAAa,iBAAb,MAA4B;CAMG;CAL7B,wBAAyB,IAAI,IAG3B;CAEF,YAAY,WAAuC;EAAtB,KAAA,YAAA;CAAuB;CAEpD,QAAW,WAAsD;EAC/D,MAAM,SAAS,KAAK,MAAM,IAAI,SAAS;EACvC,IAAI,QACF,OAAO;EAET,IAAI;EACJ,IAAI;GACF,SACE,OAAO,cAAc,YACrB,cAAc,QACd,cAAc,YACV,YACA,KAAK,UAAU,IAAI,WAAoB,EAAE,QAAQ,MAAM,CAAC;EAChE,QAAQ;GACN,MAAM,IAAI,6BACR,qBACA,wEACF;EACF;EACA,IACE,CAAC,UACD,OAAO,OAAO,aAAa,cAC3B,OAAO,OAAO,OAAO,UAErB,MAAM,IAAI,6BACR,qBACA,sDACF;EAEF,KAAK,MAAM,IAAI,WAAW,MAAM;EAChC,OAAO;CACT;AACF;;;ACpCA,IAAa,oBAAb,MAA+B;CAC7B,aAA+C,CAAC;CAChD,yBAA0B,IAAI,QAA+B;CAC7D,MAA4B,EAAE,MAAM,KAAK;CAEzC,SAAS,YAA4C;EACnD,KAAK,aAAa,CAAC,GAAG,UAAU;CAClC;CAEA,OAAO,KAAyB;EAC9B,KAAK,MAAM;CACb;CAEA,OAAiC;EAC/B,OAAO,CAAC,GAAG,KAAK,UAAU;CAC5B;CAGA,iBAAiB,QAAkB,QAAuC;EACxE,KAAK,MAAM,aAAa,KAAK,YAAY;GACvC,MAAM,SAAS,UAAU,mBAAmB,QAAQ,MAAM;GAC1D,IAAI,WAAW,KAAA,GACb,OAAO;EAEX;CAEF;CAEA,KAAK,SAAsD;EACzD,OAAO,KAAK,WAAW,MAAM,SAAS,KAAK,QAAQ,OAAO,CAAC;CAC7D;CAEA,OAAO,SAA0C;EAC/C,MAAM,YAAY,KAAK,KAAK,OAAO;EACnC,IAAI,CAAC,WACH,MAAM,6BAA6B,UACjC,gBACA,wDACF;EAEF,OAAO;CACT;CAEA,KAAK,MAA6B;EAChC,OAAO,KAAK,OAAO,IAAI,IAAI,KAAK;CAClC;CAEA,SACE,SACA,YAAY,KAAK,OAAO,OAAO,GAChB;EACf,MAAM,OAAO,UAAU,SAAS,SAAS,KAAK,GAAG;EACjD,KAAK,OAAO,IAAI,MAAM,UAAU,EAAE;EAClC,OAAO;CACT;AACF;;;ACVA,MAAM,YAAY,OAAO,yBAAyB;AAClD,MAAM,UAAU;CACd;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAgKO,IAAM,uBAAN,MAAM,qBAEb;CAKgD;CACJ;CACK;CACD;CACP;CACE;CACC;CAV1C;CACA,SAAS;CAET,YACE,WACA,OACA,YACA,QACA,OACA,SACA,WACA;EAP4C,KAAA,YAAA;EACJ,KAAA,QAAA;EACK,KAAA,aAAA;EACD,KAAA,SAAA;EACP,KAAA,QAAA;EACE,KAAA,UAAA;EACC,KAAA,YAAA;CACvC;CAEH,eAA8B;EAC5B,IAAI,CAAC,KAAK,UAAU,MAAM,KAAK,OAAO,OAAO,GAC3C,OAAO,KAAK,mBAAmB,QAAQ,QAAQ;EAEjD,KAAK,kBAAkB,KAAK,WAAW;EACvC,OAAO,KAAK;CACd;CAEA,MAAc,aAA4B;EACxC,MAAM,SAAyC,CAAC;EAChD,MAAM,KAAK,UAAU,WAAW,MAAM;EACtC,MAAM,QAAQ,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM;EACxD,KAAK,MAAM,SAAS,KAAK,UAAU,KAAK,GAAG;GACzC,MAAM,SAAS,MAAM,IAAI,MAAM,IAAI,KAAK,gBAAgB;GACxD,MAAM,UAAU,MAAM,OAAO;GAC7B,MAAM,QACJ,OAAO,OAAO,SACd,OAAO,MAAM,SACb,OAAO,OAAO,OAAO,QAAQ,CAAC,CAAC,QAC5B,KAAK,UAAU,MAAM,MAAM,OAAO,SAAS,MAAM,MAAM,QACxD,CACF;GACF,IAAI;IACF,MAAM,SAAS,KAAK,QAAQ,KAAK,OAAO;KACtC,OAAO,KAAK,UAAU;KACtB,UAAU,MAAM;KAChB,OAAO;KACP,eAAe,KAAK,MAAM,QAAQ,CAAC,EAAE;KACrC,mBAAmB,MAAM;KACzB,GAAG;KACH,YAAY,SACV,KAAK,UAAU,OAAO,MACpB,qBAAqB,KAAK,mDAAmD,MAAM,KAAK,GAC1F;IACJ,CAAC;IACD,IAAI,OAAO,cACT,KAAK,UAAU,OAAO,KACpB,2BAA2B,MAAM,KAAK,uCAAuC,OAAO,aAAa,GACnG;IAEF,IAAI,UAAU,KAAK,QAAQ,GACzB,KAAK,UAAU,OAAO,KACpB,yBAAyB,MAAM,KAAK,KAAK,QAAQ,mGACnD;GAEJ,SAAS,OAAO;IACd,OAAO,KACL,mBACE,OACA,0BACA,gBAAgB,MAAM,KAAK,uBAC7B,CACF;GACF;EACF;EACA,KAAK,OAAO,cAAc,MAAM;EAChC,KAAK,OAAO,QAAQ,MAAM;EAC1B,KAAK,WAAW,OAAO,EAAE,MAAM,KAAK,OAAO,UAAU,YAAY,KAAK,CAAC;EACvE,MAAM,KAAK,UAAU,SAAS,MAAM;EACpC,IAAI,OAAO,QAAQ;GACjB,MAAM,UAAU,IAAI,6BAClB,oBACA,qCAAqC,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,MAAM,SAAS,MAAM,OAAO,UAAU,MAAM,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,KAClJ,+EACF;GACA,OAAO,eAAe,SAAS,UAAU;IACvC,OAAO,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;IAChC,YAAY;GACd,CAAC;GACD,MAAM;EACR;EACA,KAAK,UAAU,QAAQ,KAAK;EAC5B,MAAM,KAAK,OAAO,MAAM;EACxB,KAAK,SAAS;CAChB;CAEA,yBAA+B;EAC7B,IAAI,KAAK,UAAU,KAAK,UAAU,UAAU,gBAAgB;GAC1D,KAAK,QAAQ,UAAU;GACvB,KAAK,UAAU,QAAQ;EACzB;CACF;CAEA,wBAA8B;EAC5B,KAAK,QAAQ,MAAM;EACnB,KAAK,UAAU,MAAM;EACrB,KAAK,OAAO,MAAM;EAClB,KAAK,kBAAkB,KAAA;EACvB,KAAK,SAAS;CAChB;AACF;;CAxQC,OAAO;CACP,OAAO;EACN,SAAS,CAAC,eAAe;EACzB,WAAW;GACT;GACA;IAAE,SAAS;IAAe,kBAAkB,IAAI,aAAa;GAAE;GAC/D;IACE,SAAS;IACT,QAAQ,CAAC,aAAa;IACtB,aAAa,UAAwB,IAAI,iBAAiB,KAAK;GACjE;GACA;IACE,SAAS;IACT,QAAQ,CAAC,aAAa;IACtB,aAAa,UAAwB,IAAI,kBAAkB,KAAK;GAClE;GACA;IAAE,SAAS;IAAoB,kBAAkB,IAAI,kBAAkB;GAAE;GACzE;IACE,SAAS;IACT,QAAQ,CAAC,SAAS;IAClB,aAAa,QAAmB,IAAI,eAAe,GAAG;GACxD;GACA;IACE,SAAS;IACT,QAAQ;KAAC;KAAmB;KAAiB;IAAkB;IAC/D,aACE,WACA,UACA,eACG,IAAI,aAAa,WAAW,UAAU,UAAU;GACvD;GACA;IACE,SAAS;IACT,QAAQ;KAAC;KAAiB;KAAmB;IAAa;IAC1D,aACE,MACA,WACA,UACG,IAAI,iBAAiB,MAAM,WAAW,KAAK;GAClD;GACA;IACE,SAAS;IACT,QAAQ;KAAC;KAAmB;KAAe;IAAkB;IAC7D,aACE,WACA,OACA,eACG,IAAI,uBAAuB,WAAW,OAAO,UAAU;GAC9D;GACA;IAAE,SAAS;IAAgB,kBAAkB,IAAI,qBAAqB;GAAE;GACxE;IACE,SAAS;IACT,QAAQ;KACN;KACA;KACA;KACA;IACF;IACA,aACE,UACA,SACA,UACA,UACG,IAAI,uBAAuB,UAAU,SAAS,UAAU,KAAK;GACpE;GACA;IACE,SAAS;IACT,QAAQ;KACN;KACA;KACA;KACA;KACA;KACA;KACA;IACF;IACA,aACE,WACA,SACA,YACA,UACA,WACA,OACA,aAEA,IAAI,UACF,WACA,SACA,YACA,UACA,WACA,OACA,QACF;GACJ;GACA;IACE,SAAS;IACT,QAAQ;KACN;KACA;KACA;KACA;KACA;IACF;IACA,aACE,WACA,SACA,YACA,OACA,aACG,IAAI,UAAU,WAAW,SAAS,YAAY,OAAO,QAAQ;GACpE;GACA;GACA;GACA;GACA;GACA;IACE,SAAS;IACT,QAAQ;KACN;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACF;IACA,aACE,WACA,SACA,WACA,WACA,WACA,WACA,SACA,UACA,YACA,WAEA,IAAI,cACF,WACA,SACA,WACA,WACA,WACA,WACA,SACA,UACA,YACA,MACF;GACJ;EACF;EACA;CACF,CAAC;CAQI,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,aAAa,CAAA;CACpB,gBAAA,GAAA,OAAO,kBAAkB,CAAA;CACzB,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,UAAU,CAAA;CACjB,gBAAA,GAAA,OAAO,YAAY,CAAA;CACnB,gBAAA,GAAA,OAAO,aAAa,CAAA;;;;;;;;;;;;;AC5NzB,MAAa,yBAAyB;AACtC,MAAa,iBAAiB,qBAAqB;CACjD,MAAM;CACN,QAAQ;CACR,UAAU,cAAc,UAAU;AACpC,CAAC;AACD,MAAa,cAAc,qBAAqB;CAC9C,MAAM;CACN,QAAQ;CACR,UAAU,cACR,UAAU,UAAU,UAAU,UAAU,QAAQ,OAAO,KAAA;AAC3D,CAAC;AACD,SAAgB,mBACd,UACU;CACV,OAAO,SAAS,QAAQ,SAAS,QAAQ,GAAG;EAC1C,MAAM;EACN,QAAQ;EACR,MAAM;EACN,UAAU,cAAe,UAAkC;CAC7D,CAAC;AACH;AACA,SAAgB,iBACd,UAAsC,CAAC,GACD;CACtC,OAAO;EACL,IAAI;EACJ,OAAO,CAAC,sBAAsB;EAC9B,YAAY;EACZ,mBAAmB,CAAC,UAAU,eAAe;EAC7C,eAAe;EACf,MAAM,QAAQ,SAAS;GACrB,MAAM,UAAU,MAAM,QAAQ,KAAK,QAAQ;GAC3C,MAAM,gBAAgB,QAAQ,cAAc;GAC5C,MAAM,QAAQ;IACZ,GAAI,kBACH,QAAQ,QAAQ,YAAY,QAAQ,QAAQ,oBACzC,EAAE,oBAAoB,KAAK,IAC3B,CAAC;IACL,GAAI,QAAQ,YAAY,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;GAC7D;GACA,IAAI;GACJ,IAAI;IACF,SAAU,MAAM,QAAQ,KAAK,IAC3B;KAAE,SAAS,QAAQ;KAAS,SAAS;KAAQ,UAAU;IAAK,SAE1D,QAAQ,KAAK,IAAI,WAAW;KAC1B,SAAS,QAAQ;KACjB,eAAe;KACf;IACF,CAAC,CACL;GACF,SAAS,OAAO;IACd,MAAM,UAAU,aAAa,aAAa,KAAK;IAC/C,IAAI,CAAC,SACH,MAAM;IAER,MAAM,UAAU,mBAAmB,KAAK,CAAC,CAAC,aAAa;IACvD,IAAI,QAAQ,QACV,QAAQ,SAAS,OAAO,OAAO;IAEjC,OAAO,SAAS,OAAO;GACzB;GACA,MAAM,UAAU,OAAO,SAAS,aAAa,KAAK,CAAC;GACnD,IAAI,QAAQ,QACV,QAAQ,SAAS,OAAO,OAAO;GAEjC,IACE,OAAO,YAAY,QAClB,iBAAiB,CAAC,QAAQ,KAAK,mBAAmB,OAAO,QAAQ,GAElE,OAAO,OAAO;GAEhB,MAAM,SAAS,QAAQ,SACnB,QAAQ,OAAO,OAAO,QAAa,IACjC,OAAO,SAAwC,MAAM,MAAM;GACjE,IAAI,OAAO,WAAW,YAAY,CAAC,QACjC,MAAM,6BAA6B,UACjC,mBACA,sEACF;GAEF,OAAO,cAAc;IACnB,MAAM;IACN,QAAQ;IACR;IACA,SAAS,OAAO;GAClB,CAAC;EACH;EACA,OAAO,SAAS;GACd,MAAM,WAAyB,CAAC;GAChC,IAAI,QAAQ,QAAQ,UAAU,KAAK,GACjC,SAAS,KAAK;IACZ,OAAO;IACP,MAAM;IACN,SACE;GACJ,CAAC;GAEH,IAAI,QAAQ,QAAQ,UAAU,QAAQ,GACpC,SAAS,KAAK;IACZ,OAAO;IACP,MAAM;IACN,SACE;GACJ,CAAC;GAEH,MAAM,QAAQ,QAAQ,SACnB,QACE,EAAE,YACA,KAAK,WAAW,cAAc,KAAK,WAAW,eAC/C,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAA,SAA+B,CACpE,CAAC,CACA,KAAK,EAAE,WAAW,KAAK,IAAI;GAC9B,IAAI,MAAM,QACR,SAAS,KAAK;IACZ,OAAO;IACP,MAAM;IACN,SAAS,4FAA4F,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI;IACjI,MAAM;GACR,CAAC;GAEH,IACE,QAAQ,QAAQ,UAAU,SAAS,KACnC,QAAQ,mBAAmB,OAC3B;IACA,SAAS,KAAK;KACZ,OAAO;KACP,MAAM;KACN,SAAS,GAAG,QAAQ,iBAAiB,2BAA2B,gEAAgE;IAClI,CAAC;IACD,IACE,QAAQ,SAAS,MACd,WAAW,OAAO,UAAU,mBAC/B,GAEA,SAAS,KAAK;KACZ,OAAO;KACP,MAAM;KACN,SACE;IACJ,CAAC;GAEL;GACA,IACE,QAAQ,QAAQ,UAAU,MAAM,KAChC,QAAQ,YAAY,kBAAkB,UAEtC,SAAS,KAAK;IACZ,OAAO;IACP,MAAM;IACN,SACE;GACJ,CAAC;GAEH,OAAO;EACT;CACF;AACF;AACA,MAAM,cAA+D;CACnE,IAAI;CACJ,UAAU,EAAE,YAAY,CAAC,sBAAsB,EAAE;CACjD,SAAS,QAAQ;EACf,IACE,OAAO,kBAAkB,KAAA,MACxB,CAAC,OAAO,SAAS,OAAO,aAAa,KAAK,OAAO,gBAAgB,IAElE,MAAM,IAAI,6BACR,qBACA,8CACF;CAEJ;CACA,OAAO,SAAS;EACd,OAAO,QAAQ,QAAQ,UAAU,gBAAgB,IAC7C,CACE;GACE,OAAO;GACP,MAAM;GACN,SACE;EACJ,CACF,IACA,CAAC;CACP;CACA,MAAM,SAAS,QAAQ,SAAS;EAE9B,MAAM,YADY,QAAQ,UAEd,QACV,SAAS;EACX,MAAM,MACJ,OAAO,kBACN,MAAM,QAAQ,KAAK,QAAQ,EAAA,CAAG,cAAc;EAC/C,IAAI,QAAQ,GACV,OAAO,EAAE,QAAQ,QAAQ;EAE3B,IACE,EAAE,qBAAqB,SACvB,OAAO,cAAc,YACrB,OAAO,cAAc,UAErB,OAAO;GAAE,QAAQ;GAAQ,QAAQ;EAA0B;EAE7D,MAAM,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ;EACzC,OAAO,OAAO,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,MACtD,EAAE,QAAQ,QAAQ,IAClB;GAAE,QAAQ;GAAQ,QAAQ;GAAK,QAAQ;EAAoB;CACjE;AACF;AACA,MAAa,gBACX,UAAsC,CAAC,OACM;CAC7C,QAAQ;CACR,QAAQ;AACV;AACA,MAAa,uBAAuB,YAEI,QAAQ,aAAa,OAAO,CAAC;;;AChN9D,IAAM,oBAAN,MAAM,kBAAuD;CAQpB;CACJ;CACK;CACL;CACK;CACD;CAZ9C;CACA;CACA;CACA;CAEA,YACE,SACA,UACA,OACA,UACA,SACA,YACA,aACA;EAN4C,KAAA,WAAA;EACJ,KAAA,QAAA;EACK,KAAA,WAAA;EACL,KAAA,UAAA;EACK,KAAA,aAAA;EACD,KAAA,cAAA;EAE5C,MAAM,eAAe,SAClB,cAAc,CAAC,CACf,MAAM,UAAU,MAAM,YAAY,OAAO;EAC5C,IAAI,CAAC,cACH,MAAM,IAAI,6BACR,oBACA,kDACF;EAEF,KAAK,OAAO,aAAa;EACzB,KAAK,WAAW,QAAQ;EACxB,KAAK,MAAM,QAAQ,MAAM;EACzB,KAAK,WAAW,QAAQ,MAAM;CAChC;CAEA,UAA2C;EACzC,OAAO,KAAK;CACd;CAEA,QAMc;EACZ,MAAM,UAAU,KAAK,YAAY,QAAQ,KAAK,IAAI;EAClD,MAAM,WAAW,KAAK,YAAY;EAClC,OAAO,WAAW,WACd;GACE,UAAU,QAAQ;GAClB,WAAW,QAAQ;GACnB,UAAU,SAAS;EACrB,IACA,KAAA;CACN;CAEA,eAA8C;EAC5C,MAAM,UAAU,KAAK,SAAS,QAAQ;EACtC,OAAO,QAAQ,QACb,KAAK,SAAS,QAAQ,SAAS;GAC7B,MAAM;GACN,UAAU,cAAc;EAC1B,CAAC,CACH;CACF;CAEA,aAA2C;EACzC,OAAO,QAAQ,QAAQ,mBAAiC,KAAK,QAAQ,CAAC;CACxE;CAEA,aAAa,SAA6C;EACxD,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;EAC9C,MAAM,UAAU,WAAW,UAAU,OAAO;EAC5C,MAAM,OACJ,KAAK,WAAW,YAAY,KAAK,WAAW,aAAa,YACrD,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;EACN,OAAO,KAAK,SAAS,KAAK;GACxB,MAAM,QAAQ,QAAQ;GACtB;GACA;GACA;GACA,aAAa;EACf,CAAC;CACH;CAEA,YAAY,iBAAmC;EAC7C,MAAM,WAAW,KAAK,YAAY,UAAU;EAC5C,IAAI,CAAC,UAAU,UAAU,eAAe,GACtC,MAAM,6BAA6B,UACjC,mBACA,8DACF;EAEF,MAAM,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI;EACzC,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ,eAAe,CAAC;EAC7D,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,YAAY,KAC5B,SAAS,MAAM,OAAO,gBAAgB,YAAY,GAElD,QAAQ,OAAO,IAAI;EAGvB,MAAM,WAAW,SAAS,SAAS,eAAe;EAClD,IAAI,MAAM,OAAO,kBAAkB,aAAa,MAC9C,QAAQ,IAAI,MAAM,OAAO,gBAAgB,QAAQ;EAEnD,OAAO;CACT;CAEA,sBAAyB,IAAkC;EACzD,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,IAAI,CAAC,OAAO,MAAM,oBAChB,MAAM,6BAA6B,UACjC,2BACA,0FACA,EAAE,MAAM,kDAAkD,CAC5D;EAEF,OAAO,KAAK,MAAM,IAChB,aAAa,KAAK,OAAO;GACvB,IAAI,UAAU;IACZ,OAAO,MAAM,KAAK;GACpB;GACA,IAAI,UAAU;IACZ,OAAO,MAAM,KAAK;GACpB;GACA,IAAI,WAAW;IACb,OAAO,MAAM,KAAK;GACpB;GACA,SAAS;EACX,CAAC,GACD,EACF;CACF;CAEA,eAAkB,IAAkC;EAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,OAAO,KAAK,MAAM,IAChB,aAAa,KAAK,OAAO;GACvB,SAAS;GACT,SAAS;GACT,IAAI,UAAU;IACZ,OAAO,OAAO,KAAK;GACrB;GACA,IAAI,WAAW;IACb,OAAO,OAAO,KAAK,YAAY;GACjC;EACF,CAAC,GACD,EACF;CACF;CAEA,gBAAmB,IAAkC;EACnD,OAAO,KAAK,MAAM,KAAK,EAAE;CAC3B;AACF;;CApJK,gBAAA,GAAA,OAAO,0BAA0B,CAAC,CAAA;CAClC,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,aAAa,CAAA;CACpB,gBAAA,GAAA,OAAO,kBAAkB,CAAA;CACzB,gBAAA,GAAA,OAAO,aAAa,CAAA;CACpB,gBAAA,GAAA,OAAO,kBAAkB,CAAA;CACzB,gBAAA,GAAA,OAAO,iBAAiB,CAAA;;;;;;;;;;;;;ACtBtB,IAAM,gBAAN,MAAM,cAAuC;CAIN;CAH5C,KAAc;CAEd,YACE,aACA;EAD0C,KAAA,cAAA;CACzC;CAEH,QAAQ,SAAoC;EAC1C,OAAO,QAAQ,QAAQ,MAAM;CAC/B;CAEA,SAAS,SAA2B,KAAkC;EACpE,MAAM,OAAO,QAAQ,aAAa;EAClC,MAAM,UAAU,KAAK,WAAoB;EACzC,MAAM,WAAW,KAAK,YAAqB;EAC3C,MAAM,MAAM,IAAI,OACZ,IAAI,KAAK,IAAI,OAAO,IACpB,OAAO,YAAY,YAAY,YAAY,OACzC,UACA,QAAQ,QAAQ;EACtB,MAAM,iBAAiB;GACrB,IAAI,CAAC,IAAI,MACP,MAAM,6BAA6B,UACjC,yBACA,kDACA,EACE,MAAM,sEACR,CACF;GAEF,OAAO,IAAI;EACb;EACA,OAAO;GACL;GACA,YAAY;GACZ,eAAe,SAAS,CAAC,CAAC,QAAQ,OAAO;GACzC,IAAI,WAAW;IACb,OAAO,SAAS,CAAC,CAAC,SAAS,OAAO;GACpC;GACA,IAAI,UAAU;IACZ,OAAO,SAAS,CAAC,CAAC,WAAW,SAAS,QAAQ;GAChD;GACA,IAAI,UAAU;IACZ,OAAO,SAAS,CAAC,CAAC,QAAQ,OAAO;GACnC;GACA,QAAQ,SAAS,SAAS,CAAC,CAAC,MAAM,SAAS,IAAI;GAC/C,IAAI,UAAU;IACZ,MAAM,OAAO,SAAS,CAAC,CAAC,QAAQ,OAAO;IACvC,OAAO;KACL,SAAS,CAAC;MAAC;MAAO;MAAQ;KAAS,CAAC,CAAC,SACnC,KAAK,OAAO,YAAY,CAC1B;KACA,eAAe,SAAS,CAAC,CAAC,QAAQ,OAAO;KACzC,KAAK,KAAK;KACV;IACF;GACF;EACF;CACF;CAEA,YAAY,SAAsB,SAAoC;EACpE,MAAM,UAAU,KAAK,YAAY;EACjC,MAAM,WAAW,QAAQ,aAAa,CAAC,CAAC,YAAY;EACpD,IAAI,WAAW,UAAU;GACvB,IAAI,QAAQ,WACV,QAAQ,UAAU,UAAU,oBAAoB,QAAQ,SAAS;GAEnE,MAAM,aAAa,QAAQ,SAAS,IAAI,aAAa;GACrD,IACE,QAAQ,WAAW,OACnB,eAAe,QACf,eAAe,KAAA,GAEf,QAAQ,UAAU,UAAU,eAAe,UAAU;EAEzD;EACA,MAAM,OAAsB;GAC1B,YAAY,QAAQ;GACpB,OACE,QAAQ,WAAW,MACf,iBACA,QAAQ,WAAW,MACjB,cACA;GACR,MAAM,QAAQ;GACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACnD,SAAS,QAAQ;EACnB;EACA,IAAI,QAAQ,WAAW,KACrB,OAAO,IAAI,sBAAsB,IAAI;EAEvC,IAAI,QAAQ,WAAW,KACrB,OAAO,IAAI,mBAAmB,IAAI;EAEpC,OAAO,IAAI,cAAc,MAAM,GAAG;CACpC;CAEA,SAAS,SAA2C;EAClD,MAAM,MAAM;GACV,QAAc,CAAC;EACjB;EACA,IAAI,kBAAkB,CAAC,CACrB,MAAM,WACN,SACA,OAAO,yBAAyB,MAAM,WAAW,OAAO,CAC1D;EACA,IACE,QAAQ,YAAY,QAAQ,MAAM,UAAU,KAAK,MAC/C,sBACF,QAAQ,YAAY,UAAU,MAAM,UAAU,KAAK,MAAM,cAAc,KAEvE,MAAM,IAAI,6BACR,6BACA,wDACF;EAEF,MAAM,UAAU,IAAI,gBAAgB;EACpC,KAAK,MAAM,WAAW,QAAQ,UAAU,eAAe,GAAG;GACxD,MAAM,SAAS,QAAQ;GACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;GAEF,MAAM,kBAA2B,QAAQ,YAAY,QAAQ,MAAM;GACnE,KAAK,MAAM,UAAU,QAAQ,kBAAkB,OAAO,SAAS,GAAG;IAChE,MAAM,UAAmB,OAAO,UAAU;IAC1C,IACE,OAAO,YAAY,cACnB,QAAQ,YAAY,UAAU,OAAO,MAAM,KAAA,GAE3C;IAGF,MAAM,QAAQ,CAAC,iBADe,QAAQ,YAAY,QAAQ,OACf,CAAC,CAAC,CAAC,SAC3C,UACC,OAAO,UAAU,WACb,CAAC,KAAK,IACN,MAAM,QAAQ,KAAK,IACjB,MAAM,QACH,SAAyB,OAAO,SAAS,QAC5C,IACA,CAAC,CACX;IACA,MAAM,SAAS,CACb,GAAG,IAAI,IACL,MAAM,SAAS,SACb,CAAC,GAAG,KAAK,SAAS,mBAAmB,CAAC,CAAC,CAAC,KAAK,UAAU,MAAM,EAAG,CAClE,CACF,CACF;IACA,QAAQ,MAAM,QAAQ,QAAQ,UAAU;KACtC,MAAM;KACN;KACA,MAAM;IACR,CAAC;GACH;EACF;CACF;AACF;AAzJK,gBAAA,WAAA,CAAA,gBAAA,GAAA,OAAO,eAAe,CAAA,GAAA,mBAAA,qBAAA,CAAA,OAAA,oBAAA,cAAA,SAAA,eAAA,CAAA,CAAA,GAAA,aAAA;AA2J3B,SAAgB,gBAA6C;CAC3D,OAAO;AACT;;;AChIA,SAAgB,gBACd,YACwB;CACxB,OAAO;EAAE,GAAG;GAAa,uBAAuB;CAAK;AACvD;AACA,SAAgB,mBAA2C,UAAgB;CACzE,OAAO;AACT;AACA,SAAgB,gBAAyC,WAAiB;CACxE,OAAO;AACT;AAEA,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,SAAgB,iBACd,QACA,YAKA,OACe;CACf,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,YAAwB,CAAC;CAC/B,MAAM,UAAiD,CAAC,oBAAoB;CAC5E,MAAM,UAAiD,CAAC;CACxD,MAAM,oBAAoB,OAAO,gBAAgB,MAAM;CACvD,MAAM,gBAAyC;EAC7C;EACA,UAAU,WAAW;EACrB,aAAa,WAAW;EACxB,aAAa,WAAW;EACxB,YAAY,WAAW;CACzB;CACA,MAAM,aAAmC;EACvC,WAAW,WAAW;EACtB,YAAY,WAAW;CACzB;CACA,MAAM,eAAe,0BAA0B,IAAI;CACnD,IAAI,OAAO;EACT,MAAM,UAAU;EAChB,QAAQ,KAAK,GAAI,QAAQ,WAAW,CAAC,CAAE;EACvC,UAAU,KAAK;GACb,SAAS;GACT,QAAQ,CAAC,GAAI,QAAQ,UAAU,CAAC,CAAE;GAClC,YAAY,OAAO,GAAG,SAAoB;IACxC,MAAM,UAAU,MAAM,QAAQ,WAAW,GAAG,IAAI;IAChD,KAAK,MAAM,OAAO,aAChB,IAAI,OAAO,OAAO,SAAS,GAAG,GAC5B,MAAM,IAAI,6BACR,4BACA,IAAI,IAAI,kCACR,SAAS,IAAI,wCACf;IAGJ,OAAO;GACT;EACF,CAAC;CACH,OAAO;EACL,MAAM,UAAU,EAAE,GAAG,WAAW;EAChC,KAAK,MAAM,OAAO,aAChB,OAAO,QAAQ;EAEjB,UAAU,KAAK;GAAE,SAAS;GAAc,UAAU;EAAQ,CAAC;CAC7D;CAEA,SAAS,WACP,OACA,MACkB;EAClB,OAAO,KAAK,KAAK,KAAK,UAAU;GAC9B,MAAM,QAAQ,kBAAkB,OAAO,MAAM,KAAK;GAClD,IAAI,OAAO,QAAQ,YACjB,UAAU,KAAK;IAAE,SAAS;IAAO,UAAU;GAAe,CAAC;QACtD,IACL,OACA,OAAO,QAAQ,YACf,QAAQ,IAAI,KAAK,oBAAoB,MAAM,MAC3C;IACA,MAAM,aAAa;IACnB,QAAQ,KAAK,GAAI,WAAW,WAAW,CAAC,CAAE;IAC1C,UAAU,KAAK,GAAI,WAAW,aAAa,CAAC,CAAE;IAC9C,IAAI,cAAc,WAAW,KAC3B,UAAU,KAAK;KAAE,SAAS;KAAO,UAAU,WAAW,IAAI;IAAS,CAAC;SAC/D,IAAI,iBAAiB,WAAW,KACrC,UAAU,KAAK;KACb,SAAS;KACT,aAAa,WAAW,IAAI;IAC9B,CAAC;SAED,UAAU,KAAK;KACb,SAAS;KACT,YAAY,WAAW,IAAI;KAC3B,QAAQ,CAAC,GAAI,WAAW,IAAI,UAAU,CAAC,CAAE;IAC3C,CAAC;IAEH,QAAQ,KAAK,GAAI,WAAW,WAAW,CAAC,CAAE;GAC5C,OACE,UAAU,KAAK;IAAE,SAAS;IAAO,UAAU;GAAI,CAAC;GAElD,OAAO;EACT,CAAC;CACH;CAEA,MAAM,eAAe,WAAW,cAAc,WAAW,cAAc,CAAC,CAAC;CACzE,UAAU,KAAK;EACb,SAAS,yBAAyB,IAAI;EACtC,QAAQ,CAAC,cAAc,GAAG,YAAY;EACtC,aACE,SACA,GAAG,YACA;GACH,MAAM,UAAU,iBACd,QAAQ,YAAY,QAAQ,KAAA,IAAY,QAAQ,OAClD;GACA,OAAO,QAAQ,YAAY,QAAQ,UAAU,CAAC,GAAG,SAAS,OAAO;EACnE;CACF,CAAC;CACD,UAAU,KAAK;EACb,SAAS;EACT,QAAQ;GAAC;GAAmB;GAAc,yBAAyB,IAAI;EAAC;EACxE,aACE,UACA,SACA,YACG,SAAS,SAAS,SAAS,eAAe,SAAS,UAAU;CACpE,CAAC;CACD,UAAU,KAAK;EACb,SAAS,2BAA2B,IAAI;EACxC,QAAQ,CAAC,iBAAiB;EAC1B,aAAa,iBAAuC,aAAa;CACnE,CAAC;CACD,UAAU,KAAK;EACb,SAAS,yBAAyB,IAAI;EACtC,QAAQ,CAAC,iBAAiB;EAC1B,aAAa,iBAAuC,aAAa;CACnE,CAAC;CACD,MAAM,kBAA4B;EAChC,SAAS,0BAA0B,IAAI;EACvC,QAAQ;GACN;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,aACE,cACA,UACA,OACA,UACA,SACA,YACA,WAEA,IAAI,kBACF,aAAa,SACb,UACA,OACA,UACA,SACA,YACA,MACF;CACJ;CACA,IAAI,SAAS,WAAW;EACtB,UAAU,KACR;GAAE,GAAG;GAAiB,SAAS;EAAkB,GACjD;GACE,SAAS,0BAA0B,IAAI;GACvC,aAAa;EACf,CACF;EACA,QAAQ,KAAK,iBAAiB;EAC9B,MAAM,iBAAiB,WAAW,aAAa,WAAW,aAAa,CAAC,CAAC;EACzE,MAAM,kBAAkB,WAAW,cAAc,CAC/C,GAAI,WAAW,cAAc,CAAC,GAC9B,cAAc,CAChB,CAAC;EACD,UAAU,KAAK;GACb,SAAS;GACT,QAAQ,CAAC,mBAAmB,GAAG,cAAc;GAC7C,aAAa,QAA0B,GAAG,cAA8B;IACtE,OAAO,kBAAkB,SAAS;IAClC,OAAO;GACT;EACF,CAAC;EACD,UAAU,KAAK;GACb,SAAS;GACT,QAAQ,CAAC,oBAAoB,GAAG,eAAe;GAC/C,aACE,UACA,GAAG,eACA;IACH,SAAS,SAAS,UAAU;IAC5B,OAAO;GACT;EACF,CAAC;CACH,OACE,UAAU,KAAK,eAAe;CAEhC,IAAI,WAAW,eAAe,SAAS,WACrC,UAAU,KAAK;EAAE,SAAS;EAAW,aAAa;CAAgB,CAAC;CAErE,IAAI,SAAS,cAAc,WAAW,eAAe,OACnD,UAAU,KAAK;EACb,SAAS;EACT,aAAa;CACf,CAAC;CAEH,QAAQ,KACN,cACA,2BAA2B,IAAI,GAC/B,yBAAyB,IAAI,GAC7B,0BAA0B,IAAI,CAChC;CACA,OAAO;EACL;EACA,QAAQ,WAAW,YAAY;EAC/B;EACA;EACA;CACF;AACF;;;;ACpRO,IAAM,mBAAA,oBAAN,MAAM,iBAAiB;CAQ5B,OAAO,QACL,SACe;EACf,OAAO,iBAAA,mBAEL,SACA,KACF;CACF;CASA,OAAO,aACL,SACe;EACf,OAAO,iBAAA,mBAEL,SACA,IACF;CACF;AACF;AAnCC,mBAAA,oBAAA,WAAA,CAAA,OAAO,CAAC,CAAC,CAAA,GAAA,gBAAA"}