{"version":3,"sources":["../../src/adapters/handlers.ts","../../src/errors.ts","../../src/session/jwt.ts","../../src/client.ts","../../src/constants.ts","../../src/config.ts","../../src/flows/login.ts","../../src/session/cookies.ts","../../src/flows/entitlement.ts","../../src/flows/callback.ts","../../src/debug.ts","../../src/flows/refresh.ts","../../src/session/ensure-fejwt.ts","../../src/flows/me.ts","../../src/flows/jwt.ts","../../src/flows/logout.ts","../../src/flows/import-session.ts","../../src/session/refresh-coordinator.ts","../../src/index.ts","../../src/adapters/redirects.ts","../../src/adapters/shared.ts","../../src/adapters/same-site.ts"],"sourcesContent":["import type { FetchFn } from '../client.js';\nimport {\n  createAppDirectAuth,\n  AuthError,\n  type AppDirectAuthConfig,\n} from '../index.js';\nimport type { CookieMutation } from '../types.js';\nimport { appHomeUrl, errorRedirectUrl } from './redirects.js';\nimport {\n  applyCookieMutations,\n  clearCookieMutations,\n  clearCookiesOnResponse,\n  formatSetCookieHeader,\n  type CookieHeaderWriter,\n  readAuthCookies,\n} from './shared.js';\nimport {\n  assertSameSiteRequest,\n  parseRequestBody,\n  readBodySessionTokens,\n  type SameSiteRequestHeaders,\n} from './same-site.js';\n\nexport {\n  applyCookieMutations,\n  formatSetCookieHeader,\n  readAuthCookies,\n  type CookieHeaderWriter,\n};\nexport { buildSessionCookies } from '../session/cookies.js';\nexport {\n  assertSameSiteRequest,\n  getRequestOrigin,\n  parseRequestBody,\n  readBodySessionTokens,\n  type SameSiteRequestHeaders,\n} from './same-site.js';\n\nexport interface HandlerRequest {\n  method?: string;\n  body?: unknown;\n  headers: SameSiteRequestHeaders & { cookie?: string };\n  query: Record<string, string | string[] | undefined>;\n}\n\nexport interface HandlerResponse {\n  status(code: number): HandlerResponse;\n  json(body: unknown): void;\n  redirect(status: number, url: string): void;\n  setHeader(name: string, value: string | string[]): void;\n  appendHeader?(name: string, value: string): void;\n  end(): void;\n}\n\nfunction queryParam(value: string | string[] | undefined): string | undefined {\n  return Array.isArray(value) ? value[0] : value;\n}\n\nexport function createHandlerCookieWriter(res: HandlerResponse): CookieHeaderWriter {\n  return {\n    setHeader: (name, value) => res.setHeader(name, value),\n    appendHeader: res.appendHeader\n      ? (name, value) => res.appendHeader!(name, value)\n      : undefined,\n  };\n}\n\nfunction applyCookies(res: HandlerResponse, mutations: CookieMutation[]): void {\n  applyCookieMutations(createHandlerCookieWriter(res), mutations);\n}\n\nexport function createAuthRouteHandlers(\n  config: AppDirectAuthConfig,\n  options?: { fetch?: FetchFn },\n) {\n  const auth = createAppDirectAuth(config, options);\n\n  return {\n    login(req: HandlerRequest, res: HandlerResponse) {\n      if (req.method !== 'GET') {\n        res.status(405).json({ error: 'Method not allowed' });\n        return;\n      }\n\n      try {\n        const result = auth.buildLoginRedirect();\n        applyCookies(res, result.cookiesToSet);\n        res.redirect(302, result.authorizeUrl);\n      } catch (err) {\n        const code = err instanceof AuthError ? err.code : 'server_config';\n        res.status(500).json({ error: code });\n      }\n    },\n\n    async callback(req: HandlerRequest, res: HandlerResponse) {\n      if (req.method !== 'GET') {\n        res.status(405).end();\n        return;\n      }\n\n      const { store } = readAuthCookies(req.headers.cookie);\n      const code = queryParam(req.query.code);\n      const error = queryParam(req.query.error);\n      const state = queryParam(req.query.state);\n\n      if (error || !code) {\n        res.redirect(302, errorRedirectUrl(auth.config, error ?? 'no_code'));\n        return;\n      }\n\n      try {\n        const result = await auth.handleCallback({ code, state, cookies: store });\n        applyCookies(res, [\n          ...result.cookiesToSet,\n          ...clearCookieMutations(auth.config, result.cookiesToClear),\n        ]);\n        res.redirect(302, appHomeUrl(auth.config));\n      } catch (err) {\n        const code = err instanceof AuthError ? err.code : 'server_config';\n        res.redirect(302, errorRedirectUrl(auth.config, code));\n      }\n    },\n\n    async me(req: HandlerRequest, res: HandlerResponse) {\n      if (req.method !== 'GET') {\n        res.status(405).json({ error: 'Method not allowed' });\n        return;\n      }\n\n      const { session, refreshToken } = readAuthCookies(req.headers.cookie);\n      const result = await auth.getMe({ sessionToken: session, refreshToken });\n      if (result.cookiesToSet?.length) {\n        applyCookies(res, result.cookiesToSet);\n      }\n      res.status(200).json({\n        user: result.user,\n        hasSession: result.hasSession,\n      });\n    },\n\n    async jwt(req: HandlerRequest, res: HandlerResponse) {\n      if (req.method !== 'GET') {\n        res.status(405).json({ error: 'Method not allowed' });\n        return;\n      }\n\n      const { session, refreshToken } = readAuthCookies(req.headers.cookie);\n\n      try {\n        const result = await auth.getFeJwt({ sessionToken: session, refreshToken });\n        if (result.cookiesToSet?.length) {\n          applyCookies(res, result.cookiesToSet);\n        }\n        res.status(200).json({ token: result.token });\n      } catch (err) {\n        if (err instanceof AuthError) {\n          res.status(err.statusCode).json({\n            error: err.code,\n            token: null,\n            refresh_url: auth.config.routes.refresh,\n          });\n          return;\n        }\n        res.status(500).json({ error: 'server_config', token: null });\n      }\n    },\n\n    async refresh(req: HandlerRequest, res: HandlerResponse) {\n      if (req.method !== 'GET' && req.method !== 'POST') {\n        res.status(405).json({ error: 'Method not allowed' });\n        return;\n      }\n\n      const { refreshToken } = readAuthCookies(req.headers.cookie);\n      if (!refreshToken) {\n        res.status(401).json({ error: 'not_authenticated', ok: false });\n        return;\n      }\n\n      try {\n        const result = await auth.refreshSession({ refreshToken });\n        applyCookies(res, result.cookiesToSet);\n        res.status(200).json({ ok: true, token: result.fejwt });\n      } catch {\n        res.status(502).json({ error: 'refresh_failed', ok: false });\n      }\n    },\n\n    logout(req: HandlerRequest, res: HandlerResponse) {\n      if (req.method !== 'GET' && req.method !== 'POST') {\n        res.status(405).json({ error: 'Method not allowed' });\n        return;\n      }\n\n      clearCookiesOnResponse(auth.config, createHandlerCookieWriter(res));\n      res.redirect(302, appHomeUrl(auth.config));\n    },\n\n    async importSession(req: HandlerRequest, res: HandlerResponse) {\n      if (req.method !== 'POST') {\n        res.status(405).json({ error: 'Method not allowed' });\n        return;\n      }\n      if (!assertSameSiteRequest(req.headers, auth.config.appBaseUrl)) {\n        res.status(403).json({ error: 'Cross-site request blocked' });\n        return;\n      }\n\n      const tokens = readBodySessionTokens(parseRequestBody(req.body));\n      if (!tokens) {\n        res.status(400).json({ error: 'invalid_body' });\n        return;\n      }\n\n      try {\n        const result = await auth.importSession(tokens);\n        applyCookies(res, result.cookiesToSet);\n        res.status(200).json({ ok: true });\n      } catch (err) {\n        if (err instanceof AuthError) {\n          res.status(err.statusCode).json({ error: err.code });\n          return;\n        }\n        res.status(500).json({ error: 'server_config' });\n      }\n    },\n\n    auth,\n  };\n}\n\nexport type { AppDirectAuthConfig };\n","export type AuthErrorCode =\n  | 'server_config'\n  | 'no_code'\n  | 'invalid_state'\n  | 'token_exchange'\n  | 'fejwt'\n  | 'userinfo'\n  | 'unauthorized'\n  | 'session_expired'\n  | 'not_authenticated'\n  | 'refresh_failed'\n  | 'method_not_allowed';\n\nexport class AuthError extends Error {\n  readonly code: AuthErrorCode;\n  readonly statusCode: number;\n  readonly details?: unknown;\n\n  constructor(code: AuthErrorCode, message?: string, options?: { statusCode?: number; details?: unknown }) {\n    super(message ?? code);\n    this.name = 'AuthError';\n    this.code = code;\n    this.statusCode = options?.statusCode ?? AuthError.defaultStatus(code);\n    this.details = options?.details;\n  }\n\n  private static defaultStatus(code: AuthErrorCode): number {\n    switch (code) {\n      case 'not_authenticated':\n      case 'session_expired':\n      case 'unauthorized':\n        return 401;\n      case 'method_not_allowed':\n        return 405;\n      case 'server_config':\n        return 500;\n      case 'refresh_failed':\n      case 'token_exchange':\n      case 'fejwt':\n      case 'userinfo':\n        return 502;\n      default:\n        return 400;\n    }\n  }\n}\n","import type { AuthUser } from '../types.js';\n\nexport interface JwtPayload {\n  sub?: string;\n  email?: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  current_active_company?: string;\n  companyUuid?: string;\n  company_id?: string;\n  exp?: number;\n  [key: string]: unknown;\n}\n\nfunction claimString(\n  payload: Record<string, unknown> | JwtPayload | null | undefined,\n  key: string,\n): string | null {\n  if (!payload) return null;\n  const value = payload[key];\n  return typeof value === 'string' && value ? value : null;\n}\n\nexport function resolveCompanyIdFromClaims(\n  payload: Record<string, unknown> | JwtPayload | null | undefined,\n): string | null {\n  return (\n    claimString(payload, 'current_active_company') ??\n    claimString(payload, 'companyUuid') ??\n    claimString(payload, 'company_id')\n  );\n}\n\nexport function decodeJwtPayloadUnsafe(token: string | null | undefined): JwtPayload | null {\n  if (!token || typeof token !== 'string') return null;\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return null;\n    const decoded = Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString(\n      'utf8',\n    );\n    return JSON.parse(decoded) as JwtPayload;\n  } catch {\n    return null;\n  }\n}\n\nexport function isJwtExpired(token: string, bufferSec: number): boolean {\n  const payload = decodeJwtPayloadUnsafe(token);\n  if (!payload || typeof payload.exp !== 'number') return false;\n  const now = Math.floor(Date.now() / 1000);\n  return payload.exp < now + bufferSec;\n}\n\nexport function mapClaimsToUser(payload: JwtPayload | null): AuthUser | null {\n  if (!payload?.sub) return null;\n\n  const name =\n    payload.name ??\n    ([payload.given_name, payload.family_name].filter(Boolean).join(' ') || null);\n\n  return {\n    id: payload.sub,\n    email: payload.email ?? null,\n    name,\n    picture: payload.picture ?? null,\n    companyId: resolveCompanyIdFromClaims(payload),\n  };\n}\n\nexport function getUserFromFeJwt(token: string | null | undefined): AuthUser | null {\n  return mapClaimsToUser(decodeJwtPayloadUnsafe(token));\n}\n","import type {\n  AuthTokenResult,\n  AuthUser,\n  FeJwtResponse,\n  ResolvedConfig,\n  TokenResponse,\n  UserInfoResponse,\n} from './types.js';\nimport { AuthError } from './errors.js';\nimport { resolveCompanyIdFromClaims } from './session/jwt.js';\n\nexport type FetchFn = typeof fetch;\n\nfunction basicAuthHeader(clientId: string, clientSecret: string): string {\n  return `Basic ${Buffer.from(`${clientId}:${clientSecret}`, 'utf8').toString('base64')}`;\n}\n\nexport function parseFeJwt(body: FeJwtResponse): string {\n  const fejwt = body.fejwt ?? body.fewjwt ?? body.token ?? body.jwt ?? body.access_token;\n  if (!fejwt || typeof fejwt !== 'string') {\n    throw new AuthError('fejwt', 'FEJWT missing in response');\n  }\n  return fejwt;\n}\n\nfunction parseAuthTokenResponse(body: FeJwtResponse & TokenResponse): AuthTokenResult {\n  const accessToken = parseFeJwt(body);\n  const refreshToken =\n    typeof body.refresh_token === 'string' ? body.refresh_token : undefined;\n  return { accessToken, refreshToken };\n}\n\nasync function postAuthEndpoint(\n  fetchFn: FetchFn,\n  url: string,\n  bearerToken: string,\n): Promise<AuthTokenResult> {\n  const res = await fetchFn(url, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/json',\n      Accept: 'application/json',\n      Authorization: `Bearer ${bearerToken}`,\n    },\n    body: JSON.stringify({}),\n  });\n\n  if (!res.ok) {\n    const body = await res.text();\n    throw new AuthError('fejwt', 'Auth token request failed', {\n      details: { status: res.status, body },\n    });\n  }\n\n  const body = (await res.json()) as FeJwtResponse & TokenResponse;\n  return parseAuthTokenResponse(body);\n}\n\nexport function mapUserInfo(userinfo: UserInfoResponse): AuthUser {\n  const name =\n    [userinfo.given_name, userinfo.family_name].filter(Boolean).join(' ') ||\n    userinfo.name ||\n    null;\n\n  return {\n    id: userinfo.sub,\n    email: userinfo.email ?? null,\n    name,\n    picture: userinfo.picture ?? null,\n    companyId: userinfo.current_active_company ?? null,\n  };\n}\n\nexport function mapIdTokenClaims(payload: Record<string, unknown>): AuthUser | null {\n  const sub = payload.sub;\n  if (typeof sub !== 'string' || !sub) return null;\n\n  const givenName = typeof payload.given_name === 'string' ? payload.given_name : undefined;\n  const familyName = typeof payload.family_name === 'string' ? payload.family_name : undefined;\n  const nameField = typeof payload.name === 'string' ? payload.name : undefined;\n  const name = nameField ?? ([givenName, familyName].filter(Boolean).join(' ') || null);\n\n  return {\n    id: sub,\n    email: typeof payload.email === 'string' ? payload.email : null,\n    name,\n    picture: typeof payload.picture === 'string' ? payload.picture : null,\n    companyId: resolveCompanyIdFromClaims(payload),\n  };\n}\n\nexport function decodeIdToken(idToken: string): Record<string, unknown> | null {\n  try {\n    const payload = idToken.split('.')[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nexport class AppDirectClient {\n  constructor(\n    private readonly config: ResolvedConfig,\n    private readonly fetchFn: FetchFn = fetch,\n  ) {}\n\n  buildAuthorizeUrl(state: string): string {\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: this.config.scopes.join(' '),\n      state,\n    });\n    return `${this.config.endpoints.authorizeUrl}?${params}`;\n  }\n\n  async exchangeAuthorizationCode(code: string): Promise<TokenResponse> {\n    const res = await this.fetchFn(this.config.endpoints.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Authorization: basicAuthHeader(this.config.clientId, this.config.clientSecret),\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: this.config.redirectUri,\n      }),\n    });\n\n    if (!res.ok) {\n      const body = await res.text();\n      throw new AuthError('token_exchange', 'Authorization code exchange failed', {\n        details: { status: res.status, body },\n      });\n    }\n\n    return (await res.json()) as TokenResponse;\n  }\n\n  async refreshAccessToken(refreshToken: string): Promise<TokenResponse> {\n    const res = await this.fetchFn(this.config.endpoints.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Authorization: basicAuthHeader(this.config.clientId, this.config.clientSecret),\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      }),\n    });\n\n    if (!res.ok) {\n      const body = await res.text();\n      throw new AuthError('refresh_failed', 'Refresh token exchange failed', {\n        details: { status: res.status, body },\n      });\n    }\n\n    return (await res.json()) as TokenResponse;\n  }\n\n  async exchangeAuthToken(oauthAccessToken: string): Promise<AuthTokenResult> {\n    return postAuthEndpoint(\n      this.fetchFn,\n      this.config.endpoints.authTokenUrl,\n      oauthAccessToken,\n    );\n  }\n\n  async refreshAuthToken(authRefreshToken: string): Promise<AuthTokenResult> {\n    return postAuthEndpoint(\n      this.fetchFn,\n      this.config.endpoints.authRefreshUrl,\n      authRefreshToken,\n    );\n  }\n\n  async fetchUserInfo(accessToken: string): Promise<AuthUser | null> {\n    const res = await this.fetchFn(this.config.endpoints.userinfoUrl, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!res.ok) return null;\n    const userinfo = (await res.json()) as UserInfoResponse;\n    return mapUserInfo(userinfo);\n  }\n\n  async resolveUser(accessToken: string, idToken?: string): Promise<AuthUser> {\n    const fromUserInfo = await this.fetchUserInfo(accessToken);\n\n    let fromIdToken: AuthUser | null = null;\n    if (idToken) {\n      const claims = decodeIdToken(idToken);\n      if (claims) {\n        fromIdToken = mapIdTokenClaims(claims);\n      }\n    }\n\n    if (fromUserInfo?.id) {\n      if (\n        !fromUserInfo.companyId &&\n        fromIdToken?.companyId &&\n        fromIdToken.id === fromUserInfo.id\n      ) {\n        return { ...fromUserInfo, companyId: fromIdToken.companyId };\n      }\n      return fromUserInfo;\n    }\n\n    if (fromIdToken?.id) return fromIdToken;\n\n    throw new AuthError('userinfo', 'Unable to resolve user identity');\n  }\n\n  async assertUserAssignedToApplication(input: {\n    fejwt: string;\n    companyUuid: string;\n    userUuid: string;\n    applicationId: number;\n  }): Promise<void> {\n    const url = new URL(\n      `${this.config.issuerBaseUrl}/api/account/v2/companies/${encodeURIComponent(input.companyUuid)}/memberships/${encodeURIComponent(input.userUuid)}/myapps`,\n    );\n    url.searchParams.set('applicationId', String(input.applicationId));\n\n    const res = await this.fetchFn(url.toString(), {\n      headers: {\n        Authorization: `Bearer ${input.fejwt}`,\n        Accept: 'application/json',\n      },\n    });\n\n    if (!res.ok) {\n      await res.text().catch(() => undefined);\n      throw new AuthError('unauthorized', 'User is not assigned to this application', {\n        details: { status: res.status },\n      });\n    }\n\n    const body = (await res.json()) as { content?: unknown[] };\n    if (!Array.isArray(body.content) || body.content.length === 0) {\n      throw new AuthError('unauthorized', 'User is not assigned to this application');\n    }\n  }\n}\n","export const COOKIE_SESSION = 'session';\nexport const COOKIE_REFRESH_TOKEN = 'refresh_token';\nexport const COOKIE_OAUTH_STATE = 'oauth_state';\n\nexport const DEFAULT_CALLBACK_PATH = '/api/auth/callback';\nexport const DEFAULT_SCOPES = [\n  'company',\n  'openid',\n  'profile',\n  'email',\n] as const;\n\nexport const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\nexport const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nexport const DEFAULT_STATE_MAX_AGE = 60 * 10; // 10 minutes\nexport const DEFAULT_EXPIRY_BUFFER_SEC = 60;\n\nexport const DEFAULT_ROUTES = {\n  login: '/api/auth/login',\n  callback: '/api/auth/callback',\n  me: '/api/auth/me',\n  jwt: '/api/auth/jwt',\n  refresh: '/api/auth/refresh',\n  logout: '/api/auth/logout',\n} as const;\n\nexport const DEFAULT_ERROR_REDIRECT = '/?error=';\n","import {\n  DEFAULT_CALLBACK_PATH,\n  DEFAULT_ERROR_REDIRECT,\n  DEFAULT_EXPIRY_BUFFER_SEC,\n  DEFAULT_REFRESH_MAX_AGE,\n  DEFAULT_ROUTES,\n  DEFAULT_SCOPES,\n  DEFAULT_SESSION_MAX_AGE,\n  DEFAULT_STATE_MAX_AGE,\n} from './constants.js';\nimport type { AppDirectAuthConfig, CookieOptions, ResolvedConfig } from './types.js';\n\nfunction normalizeBaseUrl(url: string): string {\n  return url.replace(/\\/$/, '');\n}\n\nfunction parseApplicationId(value?: string | number): number | null {\n  if (value == null) return null;\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    if (trimmed === '') return null;\n    const parsed = Number(trimmed);\n    if (!Number.isFinite(parsed)) return null;\n    return parsed;\n  }\n  if (!Number.isFinite(value)) return null;\n  return value;\n}\n\nexport function resolveConfig(input: AppDirectAuthConfig): ResolvedConfig {\n  const issuerBaseUrl = normalizeBaseUrl(input.issuerBaseUrl);\n  const appBaseUrl = normalizeBaseUrl(input.appBaseUrl);\n  const callbackPath = input.callbackPath ?? DEFAULT_CALLBACK_PATH;\n  const partitioned = input.cookieOptions?.partitioned ?? false;\n  let secure =\n    input.secureCookies ??\n    input.cookieOptions?.secure ??\n    process.env.NODE_ENV === 'production';\n  let sameSite = input.cookieOptions?.sameSite ?? 'lax';\n\n  if (partitioned) {\n    secure = true;\n    if (input.cookieOptions?.sameSite === undefined) {\n      sameSite = 'none';\n    }\n  }\n\n  const cookieOptions: Required<CookieOptions> = {\n    sessionMaxAge: input.cookieOptions?.sessionMaxAge ?? DEFAULT_SESSION_MAX_AGE,\n    refreshMaxAge: input.cookieOptions?.refreshMaxAge ?? DEFAULT_REFRESH_MAX_AGE,\n    stateMaxAge: input.cookieOptions?.stateMaxAge ?? DEFAULT_STATE_MAX_AGE,\n    secure,\n    sameSite,\n    path: input.cookieOptions?.path ?? '/',\n    partitioned,\n  };\n\n  return {\n    issuerBaseUrl,\n    clientId: input.clientId,\n    clientSecret: input.clientSecret,\n    appBaseUrl,\n    applicationId: parseApplicationId(input.applicationId),\n    callbackPath,\n    redirectUri: `${appBaseUrl}${callbackPath}`,\n    scopes: input.scopes ?? [...DEFAULT_SCOPES],\n    cookieOptions,\n    expiryBufferSec: input.expiryBufferSec ?? DEFAULT_EXPIRY_BUFFER_SEC,\n    routes: {\n      login: input.routes?.login ?? DEFAULT_ROUTES.login,\n      callback: input.routes?.callback ?? DEFAULT_ROUTES.callback,\n      me: input.routes?.me ?? DEFAULT_ROUTES.me,\n      jwt: input.routes?.jwt ?? DEFAULT_ROUTES.jwt,\n      refresh: input.routes?.refresh ?? DEFAULT_ROUTES.refresh,\n      logout: input.routes?.logout ?? DEFAULT_ROUTES.logout,\n    },\n    onErrorRedirect: input.onErrorRedirect ?? DEFAULT_ERROR_REDIRECT,\n    endpoints: {\n      authorizeUrl: `${issuerBaseUrl}/oauth2/authorize`,\n      tokenUrl: `${issuerBaseUrl}/oauth2/token`,\n      userinfoUrl: `${issuerBaseUrl}/oauth2/userinfo`,\n      authTokenUrl: `${issuerBaseUrl}/auth/token`,\n      authRefreshUrl: `${issuerBaseUrl}/auth/refresh`,\n    },\n  };\n}\n\nexport function validateConfig(config: ResolvedConfig): void {\n  if (!config.issuerBaseUrl || !config.clientId || !config.clientSecret || !config.appBaseUrl) {\n    throw new Error('issuerBaseUrl, clientId, clientSecret, and appBaseUrl are required');\n  }\n  if (config.cookieOptions.partitioned && config.cookieOptions.sameSite !== 'none') {\n    throw new Error('cookieOptions.partitioned requires cookieOptions.sameSite to be \"none\"');\n  }\n}\n","import { randomBytes } from 'node:crypto';\nimport type { AppDirectClient } from '../client.js';\nimport { buildStateCookie } from '../session/cookies.js';\nimport type { LoginRedirectResult, ResolvedConfig } from '../types.js';\n\nexport function buildLoginRedirect(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n): LoginRedirectResult {\n  const state = randomBytes(16).toString('hex');\n  const authorizeUrl = client.buildAuthorizeUrl(state);\n\n  return {\n    authorizeUrl,\n    state,\n    cookiesToSet: [buildStateCookie(config, state)],\n  };\n}\n","import {\n  COOKIE_OAUTH_STATE,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_SESSION,\n} from '../constants.js';\nimport type { CookieMutation, CookieMutationOptions, ResolvedConfig } from '../types.js';\n\nfunction withPartitioned(\n  config: ResolvedConfig,\n  options: CookieMutationOptions,\n): CookieMutationOptions {\n  if (!config.cookieOptions.partitioned) return options;\n  return { ...options, partitioned: true };\n}\n\nexport function buildCookieOptions(\n  config: ResolvedConfig,\n  maxAge: number,\n): CookieMutationOptions {\n  return withPartitioned(config, {\n    httpOnly: true,\n    sameSite: config.cookieOptions.sameSite,\n    secure: config.cookieOptions.secure,\n    path: config.cookieOptions.path,\n    maxAge,\n  });\n}\n\nexport function buildSessionCookies(\n  config: ResolvedConfig,\n  sessionToken: string,\n  refreshToken?: string | null,\n): CookieMutation[] {\n  const cookies: CookieMutation[] = [\n    {\n      name: COOKIE_SESSION,\n      value: sessionToken,\n      options: buildCookieOptions(config, config.cookieOptions.sessionMaxAge),\n    },\n  ];\n\n  if (refreshToken) {\n    cookies.push({\n      name: COOKIE_REFRESH_TOKEN,\n      value: refreshToken,\n      options: buildCookieOptions(config, config.cookieOptions.refreshMaxAge),\n    });\n  } else {\n    cookies.push(buildClearCookie(config, COOKIE_REFRESH_TOKEN));\n  }\n\n  return cookies;\n}\n\nexport function buildStateCookie(config: ResolvedConfig, state: string): CookieMutation {\n  return {\n    name: COOKIE_OAUTH_STATE,\n    value: state,\n    options: buildCookieOptions(config, config.cookieOptions.stateMaxAge),\n  };\n}\n\nexport function buildClearCookie(config: ResolvedConfig, name: string): CookieMutation {\n  return {\n    name,\n    value: '',\n    options: withPartitioned(config, {\n      httpOnly: true,\n      sameSite: config.cookieOptions.sameSite,\n      secure: config.cookieOptions.secure,\n      path: config.cookieOptions.path,\n      maxAge: 0,\n    }),\n  };\n}\n\nexport function buildLogoutCookies(config: ResolvedConfig): CookieMutation[] {\n  return [COOKIE_SESSION, COOKIE_REFRESH_TOKEN, COOKIE_OAUTH_STATE].map((name) =>\n    buildClearCookie(config, name),\n  );\n}\n\nexport { COOKIE_OAUTH_STATE, COOKIE_REFRESH_TOKEN, COOKIE_SESSION };\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport { getUserFromFeJwt } from '../session/jwt.js';\nimport type { AuthUser, ResolvedConfig } from '../types.js';\n\nexport async function assertConfiguredApplicationAssignment(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  fejwt: string,\n  user?: AuthUser | null,\n): Promise<void> {\n  if (config.applicationId == null) return;\n\n  const fromJwt = getUserFromFeJwt(fejwt);\n  let resolvedUser = user ?? fromJwt;\n  if (\n    resolvedUser?.id &&\n    !resolvedUser.companyId &&\n    fromJwt?.companyId &&\n    fromJwt.id === resolvedUser.id\n  ) {\n    resolvedUser = { ...resolvedUser, companyId: fromJwt.companyId };\n  }\n  if (!resolvedUser?.id) {\n    throw new AuthError('unauthorized', 'Unable to resolve user for application assignment');\n  }\n  if (!resolvedUser.companyId) {\n    throw new AuthError('unauthorized', 'Missing company from session');\n  }\n\n  await client.assertUserAssignedToApplication({\n    fejwt,\n    companyUuid: resolvedUser.companyId,\n    userUuid: resolvedUser.id,\n    applicationId: config.applicationId,\n  });\n}\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport {\n  buildSessionCookies,\n  COOKIE_OAUTH_STATE,\n} from '../session/cookies.js';\nimport type { CallbackResult, CookieStore, ResolvedConfig } from '../types.js';\nimport { assertConfiguredApplicationAssignment } from './entitlement.js';\n\nexport async function handleCallback(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  input: {\n    code?: string;\n    error?: string;\n    state?: string;\n    cookies: CookieStore;\n  },\n): Promise<CallbackResult> {\n  if (input.error || !input.code) {\n    throw new AuthError('no_code', input.error ?? 'Authorization code missing');\n  }\n\n  const storedState = input.cookies.get(COOKIE_OAUTH_STATE);\n  if (!storedState || !input.state || storedState !== input.state) {\n    throw new AuthError('invalid_state', 'OAuth state mismatch');\n  }\n\n  const oauthTokens = await client.exchangeAuthorizationCode(input.code);\n  const authTokens = await client.exchangeAuthToken(oauthTokens.access_token);\n  const user = await client.resolveUser(oauthTokens.access_token, oauthTokens.id_token);\n\n  await assertConfiguredApplicationAssignment(config, client, authTokens.accessToken, user);\n\n  const refreshToken = authTokens.refreshToken ?? null;\n\n  return {\n    fejwt: authTokens.accessToken,\n    refreshToken,\n    user,\n    cookiesToSet: buildSessionCookies(config, authTokens.accessToken, refreshToken),\n    cookiesToClear: [COOKIE_OAUTH_STATE],\n  };\n}\n","import { decodeJwtPayloadUnsafe, isJwtExpired } from './session/jwt.js';\n\nexport type AuthBffDebugScope = 'refresh' | 'jwt';\n\nfunction isDebugEnabled(): boolean {\n  const value = process.env.AUTH_BFF_DEBUG;\n  if (!value) return false;\n  const normalized = value.trim().toLowerCase();\n  return normalized === 'true' || normalized === '1' || normalized === 'yes';\n}\n\nexport function authBffDebug(\n  scope: AuthBffDebugScope,\n  message: string,\n  data?: Record<string, unknown>,\n): void {\n  if (!isDebugEnabled()) return;\n\n  const prefix = `[auth-bff:${scope}]`;\n  if (data) {\n    console.log(prefix, message, data);\n  } else {\n    console.log(prefix, message);\n  }\n}\n\nexport function sessionTokenMeta(\n  token: string | null | undefined,\n  bufferSec: number,\n): {\n  present: boolean;\n  length: number;\n  sub?: string;\n  exp?: number;\n  expired?: boolean;\n} {\n  if (!token) {\n    return { present: false, length: 0 };\n  }\n\n  const payload = decodeJwtPayloadUnsafe(token);\n  const expired = isJwtExpired(token, bufferSec);\n\n  return {\n    present: true,\n    length: token.length,\n    ...(typeof payload?.sub === 'string' ? { sub: payload.sub } : {}),\n    ...(typeof payload?.exp === 'number' ? { exp: payload.exp } : {}),\n    expired,\n  };\n}\n\nexport function refreshTokenMeta(token: string | null | undefined): {\n  present: boolean;\n  length: number;\n} {\n  if (!token) {\n    return { present: false, length: 0 };\n  }\n\n  return { present: true, length: token.length };\n}\n","import type { AppDirectClient } from '../client.js';\nimport { authBffDebug, refreshTokenMeta } from '../debug.js';\nimport { AuthError } from '../errors.js';\nimport { buildSessionCookies } from '../session/cookies.js';\nimport type { RefreshCoordinator } from '../session/refresh-coordinator.js';\nimport type { RefreshResult, ResolvedConfig } from '../types.js';\nimport { assertConfiguredApplicationAssignment } from './entitlement.js';\n\nasync function performRefresh(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  refreshToken: string,\n): Promise<RefreshResult> {\n  authBffDebug('refresh', 'executing refresh');\n\n  try {\n    const authTokens = await client.refreshAuthToken(refreshToken);\n    const newRefreshToken = authTokens.refreshToken ?? refreshToken;\n\n    authBffDebug('refresh', 'auth refresh succeeded', {\n      returnedNewRefreshToken: authTokens.refreshToken != null,\n    });\n\n    if (config.applicationId == null) {\n      authBffDebug('refresh', 'entitlement check skipped', { applicationId: null });\n    } else {\n      authBffDebug('refresh', 'running entitlement check', {\n        applicationId: config.applicationId,\n      });\n      await assertConfiguredApplicationAssignment(config, client, authTokens.accessToken);\n      authBffDebug('refresh', 'entitlement check passed', {\n        applicationId: config.applicationId,\n      });\n    }\n\n    const cookiesToSet = buildSessionCookies(config, authTokens.accessToken, newRefreshToken);\n\n    authBffDebug('refresh', 'refresh succeeded', {\n      cookieCount: cookiesToSet.length,\n      cookieNames: cookiesToSet.map((cookie) => cookie.name),\n      fejwtLength: authTokens.accessToken.length,\n    });\n\n    return {\n      fejwt: authTokens.accessToken,\n      refreshToken: newRefreshToken,\n      cookiesToSet,\n    };\n  } catch (err) {\n    if (err instanceof AuthError) {\n      authBffDebug('refresh', 'refresh failed', {\n        code: err.code,\n        statusCode: err.statusCode,\n        details: err.details,\n      });\n    } else {\n      authBffDebug('refresh', 'refresh failed with unexpected error', {\n        name: err instanceof Error ? err.name : 'unknown',\n      });\n    }\n    throw err;\n  }\n}\n\nexport async function refreshSession(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: { refreshToken: string },\n): Promise<RefreshResult> {\n  authBffDebug('refresh', 'refresh requested', {\n    refreshToken: refreshTokenMeta(input.refreshToken),\n  });\n\n  return coordinator.refreshOnce(input.refreshToken, () =>\n    performRefresh(config, client, input.refreshToken),\n  );\n}\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport { refreshSession } from '../flows/refresh.js';\nimport { isJwtExpired } from './jwt.js';\nimport type { RefreshCoordinator } from './refresh-coordinator.js';\nimport type { JwtResult, ResolvedConfig } from '../types.js';\n\nasync function coordinatedRefresh(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  refreshToken: string,\n): Promise<JwtResult> {\n  try {\n    const refreshed = await refreshSession(config, client, coordinator, { refreshToken });\n\n    return {\n      token: refreshed.fejwt,\n      cookiesToSet: refreshed.cookiesToSet,\n    };\n  } catch (err) {\n    if (err instanceof AuthError && (err.code === 'fejwt' || err.code === 'refresh_failed')) {\n      throw new AuthError('session_expired', 'Session expired');\n    }\n    throw err;\n  }\n}\n\nexport async function ensureValidFeJwt(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: { sessionToken: string | null; refreshToken: string | null },\n): Promise<JwtResult> {\n  const sessionToken = input.sessionToken ?? null;\n  const refreshToken = input.refreshToken ?? null;\n\n  if (!sessionToken) {\n    if (!refreshToken) {\n      throw new AuthError('not_authenticated', 'Not authenticated');\n    }\n    return coordinatedRefresh(config, client, coordinator, refreshToken);\n  }\n\n  if (!isJwtExpired(sessionToken, config.expiryBufferSec)) {\n    return { token: sessionToken };\n  }\n\n  if (!refreshToken) {\n    throw new AuthError('session_expired', 'Session expired');\n  }\n\n  return coordinatedRefresh(config, client, coordinator, refreshToken);\n}\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport { ensureValidFeJwt } from '../session/ensure-fejwt.js';\nimport { getUserFromFeJwt } from '../session/jwt.js';\nimport type { RefreshCoordinator } from '../session/refresh-coordinator.js';\nimport type { MeResult, ResolvedConfig } from '../types.js';\n\nexport function getUserFromSession(input: {\n  sessionToken: string | null | undefined;\n}): MeResult {\n  const token = input.sessionToken ?? null;\n  const user = getUserFromFeJwt(token);\n\n  return {\n    user,\n    hasSession: !!token,\n  };\n}\n\nexport async function getMe(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: {\n    sessionToken: string | null | undefined;\n    refreshToken?: string | null;\n  },\n): Promise<MeResult> {\n  const sessionToken = input.sessionToken ?? null;\n  const refreshToken = input.refreshToken ?? null;\n\n  if (!sessionToken && !refreshToken) {\n    return { user: null, hasSession: false };\n  }\n\n  try {\n    const jwtResult = await ensureValidFeJwt(config, client, coordinator, {\n      sessionToken,\n      refreshToken,\n    });\n    const user = getUserFromFeJwt(jwtResult.token);\n\n    return {\n      user,\n      hasSession: true,\n      cookiesToSet: jwtResult.cookiesToSet,\n    };\n  } catch (err) {\n    if (err instanceof AuthError) {\n      return { user: null, hasSession: false };\n    }\n    throw err;\n  }\n}\n","import type { AppDirectClient } from '../client.js';\nimport { authBffDebug, refreshTokenMeta, sessionTokenMeta } from '../debug.js';\nimport { AuthError } from '../errors.js';\nimport { ensureValidFeJwt } from '../session/ensure-fejwt.js';\nimport { isJwtExpired } from '../session/jwt.js';\nimport type { RefreshCoordinator } from '../session/refresh-coordinator.js';\nimport type { JwtResult, ResolvedConfig } from '../types.js';\n\ntype JwtDecisionPath =\n  | 'use_existing_session'\n  | 'refresh_no_session'\n  | 'refresh_expired_session'\n  | 'will_fail_not_authenticated'\n  | 'will_fail_session_expired';\n\nfunction resolveJwtDecisionPath(input: {\n  sessionToken: string | null;\n  refreshToken: string | null;\n  expiryBufferSec: number;\n}): JwtDecisionPath {\n  const { sessionToken, refreshToken, expiryBufferSec } = input;\n\n  if (!sessionToken) {\n    if (!refreshToken) {\n      return 'will_fail_not_authenticated';\n    }\n    return 'refresh_no_session';\n  }\n\n  if (!isJwtExpired(sessionToken, expiryBufferSec)) {\n    return 'use_existing_session';\n  }\n\n  if (!refreshToken) {\n    return 'will_fail_session_expired';\n  }\n\n  return 'refresh_expired_session';\n}\n\nexport async function getFeJwt(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: {\n    sessionToken: string | null | undefined;\n    refreshToken?: string | null;\n  },\n): Promise<JwtResult> {\n  const sessionToken = input.sessionToken ?? null;\n  const refreshToken = input.refreshToken ?? null;\n\n  authBffDebug('jwt', 'jwt requested', {\n    hasSession: sessionToken != null,\n    hasRefresh: refreshToken != null,\n    session: sessionTokenMeta(sessionToken, config.expiryBufferSec),\n    refreshToken: refreshTokenMeta(refreshToken),\n    expiryBufferSec: config.expiryBufferSec,\n  });\n\n  const path = resolveJwtDecisionPath({\n    sessionToken,\n    refreshToken,\n    expiryBufferSec: config.expiryBufferSec,\n  });\n\n  authBffDebug('jwt', 'jwt decision', { path });\n\n  try {\n    const result = await ensureValidFeJwt(config, client, coordinator, {\n      sessionToken,\n      refreshToken,\n    });\n\n    authBffDebug('jwt', 'jwt succeeded', {\n      path,\n      tokenLength: result.token.length,\n      cookieCount: result.cookiesToSet?.length ?? 0,\n    });\n\n    return result;\n  } catch (err) {\n    if (err instanceof AuthError) {\n      authBffDebug('jwt', 'jwt failed', {\n        path,\n        code: err.code,\n        statusCode: err.statusCode,\n        details: err.details,\n      });\n    } else {\n      authBffDebug('jwt', 'jwt failed with unexpected error', {\n        path,\n        name: err instanceof Error ? err.name : 'unknown',\n      });\n    }\n    throw err;\n  }\n}\n","import {\n  buildLogoutCookies,\n  COOKIE_OAUTH_STATE,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_SESSION,\n} from '../session/cookies.js';\nimport type { LogoutResult, ResolvedConfig } from '../types.js';\n\nexport function buildLogout(_config: ResolvedConfig): LogoutResult {\n  return {\n    cookiesToClear: [COOKIE_SESSION, COOKIE_REFRESH_TOKEN, COOKIE_OAUTH_STATE],\n  };\n}\n\nexport { buildLogoutCookies };\n","import type { AppDirectClient } from '../client.js';\nimport { authBffDebug } from '../debug.js';\nimport { buildSessionCookies } from '../session/cookies.js';\nimport type { ImportSessionResult, ResolvedConfig } from '../types.js';\nimport { assertConfiguredApplicationAssignment } from './entitlement.js';\n\nexport async function importSession(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  input: { sessionToken: string; refreshToken: string },\n): Promise<ImportSessionResult> {\n  if (config.applicationId == null) {\n    authBffDebug('import-session', 'entitlement check skipped', { applicationId: null });\n  } else {\n    authBffDebug('import-session', 'running entitlement check', {\n      applicationId: config.applicationId,\n    });\n    await assertConfiguredApplicationAssignment(config, client, input.sessionToken);\n    authBffDebug('import-session', 'entitlement check passed', {\n      applicationId: config.applicationId,\n    });\n  }\n\n  return {\n    cookiesToSet: buildSessionCookies(config, input.sessionToken, input.refreshToken),\n  };\n}\n","import type { RefreshResult } from '../types.js';\n\nexport class RefreshCoordinator {\n  private readonly inflight = new Map<string, Promise<RefreshResult>>();\n\n  async refreshOnce(\n    key: string,\n    refresh: () => Promise<RefreshResult>,\n  ): Promise<RefreshResult> {\n    const existing = this.inflight.get(key);\n    if (existing) return existing;\n\n    const promise = refresh().finally(() => {\n      this.inflight.delete(key);\n    });\n\n    this.inflight.set(key, promise);\n    return promise;\n  }\n}\n\nexport function createRefreshCoordinator(): RefreshCoordinator {\n  return new RefreshCoordinator();\n}\n","import { AppDirectClient, type FetchFn } from './client.js';\nimport { resolveConfig, validateConfig } from './config.js';\nimport { buildLoginRedirect } from './flows/login.js';\nimport { handleCallback } from './flows/callback.js';\nimport { refreshSession } from './flows/refresh.js';\nimport { getMe, getUserFromSession } from './flows/me.js';\nimport { getFeJwt } from './flows/jwt.js';\nimport { buildLogout } from './flows/logout.js';\nimport { importSession } from './flows/import-session.js';\nimport { ensureValidFeJwt } from './session/ensure-fejwt.js';\nimport { createRefreshCoordinator } from './session/refresh-coordinator.js';\nimport type { AppDirectAuth, AppDirectAuthConfig } from './types.js';\n\nexport function createAppDirectAuth(\n  configInput: AppDirectAuthConfig,\n  options?: { fetch?: FetchFn },\n): AppDirectAuth {\n  const config = resolveConfig(configInput);\n  validateConfig(config);\n  const client = new AppDirectClient(config, options?.fetch ?? fetch);\n  const coordinator = createRefreshCoordinator();\n\n  const sessionInput = (input: {\n    sessionToken: string | null | undefined;\n    refreshToken?: string | null;\n  }) => ({\n    sessionToken: input.sessionToken ?? null,\n    refreshToken: input.refreshToken ?? null,\n  });\n\n  return {\n    config,\n    buildLoginRedirect: () => buildLoginRedirect(config, client),\n    handleCallback: (input) => handleCallback(config, client, input),\n    refreshSession: (input) => refreshSession(config, client, coordinator, input),\n    getMe: (input) => getMe(config, client, coordinator, input),\n    getUserFromSession: (input) => getUserFromSession(input),\n    ensureValidFeJwt: (input) =>\n      ensureValidFeJwt(config, client, coordinator, sessionInput(input)),\n    getFeJwt: (input) => getFeJwt(config, client, coordinator, input),\n    importSession: (input) => importSession(config, client, input),\n    buildLogout: () => buildLogout(config),\n  };\n}\n\nexport { AppDirectClient } from './client.js';\nexport { resolveConfig, validateConfig } from './config.js';\nexport { AuthError } from './errors.js';\nexport { ensureValidFeJwt } from './session/ensure-fejwt.js';\nexport { RefreshCoordinator, createRefreshCoordinator } from './session/refresh-coordinator.js';\nexport type {\n  AppDirectAuth,\n  AppDirectAuthConfig,\n  AuthUser,\n  CallbackResult,\n  CookieMutation,\n  CookieStore,\n  JwtResult,\n  LoginRedirectResult,\n  LogoutResult,\n  MeResult,\n  RefreshResult,\n  ResolvedConfig,\n  RoutePaths,\n} from './types.js';\nexport {\n  COOKIE_OAUTH_STATE,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_SESSION,\n} from './constants.js';\n","import type { ResolvedConfig } from '../types.js';\n\nexport function resolveAppUrl(config: ResolvedConfig, path: string): string {\n  if (path.startsWith('http://') || path.startsWith('https://')) {\n    return path;\n  }\n  const normalized = path.startsWith('/') ? path : `/${path}`;\n  return `${config.appBaseUrl}${normalized}`;\n}\n\nexport function appHomeUrl(config: ResolvedConfig): string {\n  return `${config.appBaseUrl}/`;\n}\n\nexport function errorRedirectUrl(config: ResolvedConfig, code: string): string {\n  return resolveAppUrl(config, `${config.onErrorRedirect}${code}`);\n}\n","import { buildClearCookie, buildLogoutCookies } from '../session/cookies.js';\nimport type { CookieMutation, CookieStore, ResolvedConfig } from '../types.js';\nimport { COOKIE_OAUTH_STATE, COOKIE_REFRESH_TOKEN, COOKIE_SESSION } from '../constants.js';\n\nexport interface CookieHeaderWriter {\n  setHeader(name: string, value: string | string[]): void;\n  appendHeader?(name: string, value: string): void;\n}\n\nexport function cookieStoreFromHeader(cookieHeader: string | null | undefined): CookieStore {\n  const parsed = parseCookieHeader(cookieHeader);\n  return {\n    get(name: string) {\n      return parsed[name];\n    },\n  };\n}\n\nexport function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string> {\n  if (!cookieHeader) return {};\n  const result: Record<string, string> = {};\n  for (const part of cookieHeader.split(';')) {\n    const [rawName, ...rest] = part.trim().split('=');\n    if (!rawName) continue;\n    result[rawName] = decodeURIComponent(rest.join('='));\n  }\n  return result;\n}\n\nexport function formatSetCookieHeader(mutation: CookieMutation): string {\n  const { name, value, options } = mutation;\n  const parts = [\n    `${name}=${value}`,\n    `Path=${options.path}`,\n    'HttpOnly',\n    `SameSite=${capitalizeSameSite(options.sameSite)}`,\n    `Max-Age=${options.maxAge}`,\n  ];\n  if (options.secure || options.partitioned) parts.push('Secure');\n  if (options.partitioned) parts.push('Partitioned');\n  return parts.join('; ');\n}\n\nfunction capitalizeSameSite(value: 'lax' | 'strict' | 'none'): string {\n  if (value === 'lax') return 'Lax';\n  if (value === 'strict') return 'Strict';\n  return 'None';\n}\n\nexport function clearCookieMutations(config: ResolvedConfig, names: string[]): CookieMutation[] {\n  return names.map((name) => buildClearCookie(config, name));\n}\n\nexport function applyCookieMutations(\n  writer: CookieHeaderWriter,\n  mutations: CookieMutation[],\n): void {\n  if (mutations.length === 0) return;\n\n  const formatted = mutations.map((mutation) => formatSetCookieHeader(mutation));\n  if (writer.appendHeader) {\n    for (const value of formatted) {\n      writer.appendHeader('Set-Cookie', value);\n    }\n    return;\n  }\n\n  writer.setHeader('Set-Cookie', formatted);\n}\n\nexport function clearCookiesOnResponse(\n  config: ResolvedConfig,\n  writer: CookieHeaderWriter,\n  names?: string[],\n): void {\n  const mutations = names\n    ? clearCookieMutations(config, names)\n    : buildLogoutCookies(config);\n  applyCookieMutations(writer, mutations);\n}\n\nexport function readAuthCookies(cookieHeader: string | null | undefined) {\n  const store = cookieStoreFromHeader(cookieHeader);\n  return {\n    session: store.get(COOKIE_SESSION) ?? null,\n    refreshToken: store.get(COOKIE_REFRESH_TOKEN) ?? null,\n    oauthState: store.get(COOKIE_OAUTH_STATE) ?? null,\n    store,\n  };\n}\n\nexport { COOKIE_OAUTH_STATE, COOKIE_REFRESH_TOKEN, COOKIE_SESSION };\n","export type SameSiteRequestHeaders = Record<string, string | string[] | undefined>;\n\nfunction readHeader(headers: SameSiteRequestHeaders, name: string): string | null {\n  const value = headers[name];\n  if (Array.isArray(value)) return value[0] ?? null;\n  return typeof value === 'string' ? value : null;\n}\n\nexport function getRequestOrigin(headers: SameSiteRequestHeaders): string | null {\n  const host = readHeader(headers, 'host');\n  if (!host) return null;\n  const proto = readHeader(headers, 'x-forwarded-proto') ?? 'http';\n  return `${proto}://${host}`;\n}\n\nexport function assertSameSiteRequest(\n  headers: SameSiteRequestHeaders,\n  appBaseUrl?: string,\n): boolean {\n  const fetchSite = readHeader(headers, 'sec-fetch-site');\n  if (fetchSite !== null) {\n    return fetchSite === 'same-origin' || fetchSite === 'none';\n  }\n  const origin = readHeader(headers, 'origin');\n  if (origin === null) return false;\n\n  const expected = getRequestOrigin(headers);\n  if (expected !== null && origin === expected) return true;\n\n  if (appBaseUrl) {\n    try {\n      const configured = new URL(appBaseUrl);\n      const host = readHeader(headers, 'host');\n      if (host === configured.host && origin === configured.origin) {\n        return true;\n      }\n    } catch {\n      return false;\n    }\n  }\n\n  return false;\n}\n\nexport function parseRequestBody(body: unknown): unknown {\n  if (body == null) return body;\n  if (typeof body === 'string') {\n    if (!body.trim()) return null;\n    try {\n      return JSON.parse(body);\n    } catch {\n      return null;\n    }\n  }\n  if (typeof Buffer !== 'undefined' && Buffer.isBuffer(body)) {\n    try {\n      return JSON.parse(body.toString('utf8'));\n    } catch {\n      return null;\n    }\n  }\n  return body;\n}\n\nexport function assertSameSiteFetchRequest(req: Request, appBaseUrl?: string): boolean {\n  const fetchSite = req.headers.get('sec-fetch-site');\n  if (fetchSite !== null) {\n    return fetchSite === 'same-origin' || fetchSite === 'none';\n  }\n  const origin = req.headers.get('origin');\n  if (origin === null) return false;\n  const host = req.headers.get('host');\n  if (!host) return false;\n  const proto = req.headers.get('x-forwarded-proto') ?? new URL(req.url).protocol.replace(':', '');\n  if (origin === `${proto}://${host}`) return true;\n\n  if (appBaseUrl) {\n    try {\n      const configured = new URL(appBaseUrl);\n      if (host === configured.host && origin === configured.origin) {\n        return true;\n      }\n    } catch {\n      return false;\n    }\n  }\n\n  return false;\n}\n\nfunction isValidJwtShape(token: string): boolean {\n  const parts = token.split('.');\n  if (parts.length < 2) return false;\n  try {\n    const payload = JSON.parse(\n      Buffer.from(parts[1].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'),\n    ) as { exp?: unknown };\n    return typeof payload.exp === 'number' && payload.exp > 0;\n  } catch {\n    return false;\n  }\n}\n\nexport function readBodySessionTokens(\n  body: unknown,\n): { sessionToken: string; refreshToken: string } | null {\n  if (!body || typeof body !== 'object') return null;\n  const sessionToken = (body as { sessionToken?: unknown }).sessionToken;\n  const refreshToken = (body as { refreshToken?: unknown }).refreshToken;\n  if (typeof sessionToken !== 'string' || !sessionToken.trim()) return null;\n  if (typeof refreshToken !== 'string' || !refreshToken.trim()) return null;\n  if (!isValidJwtShape(sessionToken)) return null;\n  return { sessionToken: sessionToken.trim(), refreshToken: refreshToken.trim() };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACaO,IAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqB,SAAkB,SAAsD;AACvG,UAAM,WAAW,IAAI;AACrB,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS,cAAc,WAAU,cAAc,IAAI;AACrE,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA,EAEA,OAAe,cAAc,MAA6B;AACxD,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACF;;;AC7BA,SAAS,YACP,SACA,KACe;AACf,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,QAAQ,GAAG;AACzB,SAAO,OAAO,UAAU,YAAY,QAAQ,QAAQ;AACtD;AAEO,SAAS,2BACd,SACe;AACf,SACE,YAAY,SAAS,wBAAwB,KAC7C,YAAY,SAAS,aAAa,KAClC,YAAY,SAAS,YAAY;AAErC;AAEO,SAAS,uBAAuB,OAAqD;AAC1F,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,UAAU,OAAO,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GAAG,QAAQ,EAAE;AAAA,MACnF;AAAA,IACF;AACA,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAe,WAA4B;AACtE,QAAM,UAAU,uBAAuB,KAAK;AAC5C,MAAI,CAAC,WAAW,OAAO,QAAQ,QAAQ,SAAU,QAAO;AACxD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,QAAQ,MAAM,MAAM;AAC7B;AAEO,SAAS,gBAAgB,SAA6C;AAC3E,MAAI,CAAC,SAAS,IAAK,QAAO;AAE1B,QAAM,OACJ,QAAQ,SACP,CAAC,QAAQ,YAAY,QAAQ,WAAW,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,KAAK;AAE1E,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ,SAAS;AAAA,IACxB;AAAA,IACA,SAAS,QAAQ,WAAW;AAAA,IAC5B,WAAW,2BAA2B,OAAO;AAAA,EAC/C;AACF;AAEO,SAAS,iBAAiB,OAAmD;AAClF,SAAO,gBAAgB,uBAAuB,KAAK,CAAC;AACtD;;;AC7DA,SAAS,gBAAgB,UAAkB,cAA8B;AACvE,SAAO,SAAS,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,IAAI,MAAM,EAAE,SAAS,QAAQ,CAAC;AACvF;AAEO,SAAS,WAAW,MAA6B;AACtD,QAAM,QAAQ,KAAK,SAAS,KAAK,UAAU,KAAK,SAAS,KAAK,OAAO,KAAK;AAC1E,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,UAAU,SAAS,2BAA2B;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,MAAsD;AACpF,QAAM,cAAc,WAAW,IAAI;AACnC,QAAM,eACJ,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAChE,SAAO,EAAE,aAAa,aAAa;AACrC;AAEA,eAAe,iBACb,SACA,KACA,aAC0B;AAC1B,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,IACA,MAAM,KAAK,UAAU,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAMA,QAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,UAAU,SAAS,6BAA6B;AAAA,MACxD,SAAS,EAAE,QAAQ,IAAI,QAAQ,MAAAA,MAAK;AAAA,IACtC,CAAC;AAAA,EACH;AAEA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,uBAAuB,IAAI;AACpC;AAEO,SAAS,YAAY,UAAsC;AAChE,QAAM,OACJ,CAAC,SAAS,YAAY,SAAS,WAAW,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,KACpE,SAAS,QACT;AAEF,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS,SAAS;AAAA,IACzB;AAAA,IACA,SAAS,SAAS,WAAW;AAAA,IAC7B,WAAW,SAAS,0BAA0B;AAAA,EAChD;AACF;AAEO,SAAS,iBAAiB,SAAmD;AAClF,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAK,QAAO;AAE5C,QAAM,YAAY,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAChF,QAAM,aAAa,OAAO,QAAQ,gBAAgB,WAAW,QAAQ,cAAc;AACnF,QAAM,YAAY,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AACpE,QAAM,OAAO,cAAc,CAAC,WAAW,UAAU,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,KAAK;AAEhF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAC3D;AAAA,IACA,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,IACjE,WAAW,2BAA2B,OAAO;AAAA,EAC/C;AACF;AAEO,SAAS,cAAc,SAAiD;AAC7E,MAAI;AACF,UAAM,UAAU,QAAQ,MAAM,GAAG,EAAE,CAAC;AACpC,QAAI,CAAC,QAAS,QAAO;AACrB,WAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YACmB,QACA,UAAmB,OACpC;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,kBAAkB,OAAuB;AACvC,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,OAAO,KAAK,OAAO,OAAO,KAAK,GAAG;AAAA,MAClC;AAAA,IACF,CAAC;AACD,WAAO,GAAG,KAAK,OAAO,UAAU,YAAY,IAAI,MAAM;AAAA,EACxD;AAAA,EAEA,MAAM,0BAA0B,MAAsC;AACpE,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO,UAAU,UAAU;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,gBAAgB,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY;AAAA,MAC/E;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,IAAI,UAAU,kBAAkB,sCAAsC;AAAA,QAC1E,SAAS,EAAE,QAAQ,IAAI,QAAQ,KAAK;AAAA,MACtC,CAAC;AAAA,IACH;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,mBAAmB,cAA8C;AACrE,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO,UAAU,UAAU;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,gBAAgB,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY;AAAA,MAC/E;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,IAAI,UAAU,kBAAkB,iCAAiC;AAAA,QACrE,SAAS,EAAE,QAAQ,IAAI,QAAQ,KAAK;AAAA,MACtC,CAAC;AAAA,IACH;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,kBAAkB,kBAAoD;AAC1E,WAAO;AAAA,MACL,KAAK;AAAA,MACL,KAAK,OAAO,UAAU;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,kBAAoD;AACzE,WAAO;AAAA,MACL,KAAK;AAAA,MACL,KAAK,OAAO,UAAU;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,aAA+C;AACjE,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO,UAAU,aAAa;AAAA,MAChE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EAEA,MAAM,YAAY,aAAqB,SAAqC;AAC1E,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW;AAEzD,QAAI,cAA+B;AACnC,QAAI,SAAS;AACX,YAAM,SAAS,cAAc,OAAO;AACpC,UAAI,QAAQ;AACV,sBAAc,iBAAiB,MAAM;AAAA,MACvC;AAAA,IACF;AAEA,QAAI,cAAc,IAAI;AACpB,UACE,CAAC,aAAa,aACd,aAAa,aACb,YAAY,OAAO,aAAa,IAChC;AACA,eAAO,EAAE,GAAG,cAAc,WAAW,YAAY,UAAU;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAEA,QAAI,aAAa,GAAI,QAAO;AAE5B,UAAM,IAAI,UAAU,YAAY,iCAAiC;AAAA,EACnE;AAAA,EAEA,MAAM,gCAAgC,OAKpB;AAChB,UAAM,MAAM,IAAI;AAAA,MACd,GAAG,KAAK,OAAO,aAAa,6BAA6B,mBAAmB,MAAM,WAAW,CAAC,gBAAgB,mBAAmB,MAAM,QAAQ,CAAC;AAAA,IAClJ;AACA,QAAI,aAAa,IAAI,iBAAiB,OAAO,MAAM,aAAa,CAAC;AAEjE,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,SAAS,GAAG;AAAA,MAC7C,SAAS;AAAA,QACP,eAAe,UAAU,MAAM,KAAK;AAAA,QACpC,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,KAAK,EAAE,MAAM,MAAM,MAAS;AACtC,YAAM,IAAI,UAAU,gBAAgB,4CAA4C;AAAA,QAC9E,SAAS,EAAE,QAAQ,IAAI,OAAO;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC7D,YAAM,IAAI,UAAU,gBAAgB,0CAA0C;AAAA,IAChF;AAAA,EACF;AACF;;;ACxPO,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAE3B,IAAM,wBAAwB;AAC9B,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,0BAA0B,KAAK,KAAK,KAAK;AAC/C,IAAM,0BAA0B,KAAK,KAAK,KAAK;AAC/C,IAAM,wBAAwB,KAAK;AACnC,IAAM,4BAA4B;AAElC,IAAM,iBAAiB;AAAA,EAC5B,OAAO;AAAA,EACP,UAAU;AAAA,EACV,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV;AAEO,IAAM,yBAAyB;;;ACdtC,SAAS,iBAAiB,KAAqB;AAC7C,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,YAAY,GAAI,QAAO;AAC3B,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AACrC,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO;AACT;AAEO,SAAS,cAAc,OAA4C;AACxE,QAAM,gBAAgB,iBAAiB,MAAM,aAAa;AAC1D,QAAM,aAAa,iBAAiB,MAAM,UAAU;AACpD,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,cAAc,MAAM,eAAe,eAAe;AACxD,MAAI,SACF,MAAM,iBACN,MAAM,eAAe,UACrB,QAAQ,IAAI,aAAa;AAC3B,MAAI,WAAW,MAAM,eAAe,YAAY;AAEhD,MAAI,aAAa;AACf,aAAS;AACT,QAAI,MAAM,eAAe,aAAa,QAAW;AAC/C,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,QAAM,gBAAyC;AAAA,IAC7C,eAAe,MAAM,eAAe,iBAAiB;AAAA,IACrD,eAAe,MAAM,eAAe,iBAAiB;AAAA,IACrD,aAAa,MAAM,eAAe,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,IACA,MAAM,MAAM,eAAe,QAAQ;AAAA,IACnC;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,cAAc,MAAM;AAAA,IACpB;AAAA,IACA,eAAe,mBAAmB,MAAM,aAAa;AAAA,IACrD;AAAA,IACA,aAAa,GAAG,UAAU,GAAG,YAAY;AAAA,IACzC,QAAQ,MAAM,UAAU,CAAC,GAAG,cAAc;AAAA,IAC1C;AAAA,IACA,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,QAAQ;AAAA,MACN,OAAO,MAAM,QAAQ,SAAS,eAAe;AAAA,MAC7C,UAAU,MAAM,QAAQ,YAAY,eAAe;AAAA,MACnD,IAAI,MAAM,QAAQ,MAAM,eAAe;AAAA,MACvC,KAAK,MAAM,QAAQ,OAAO,eAAe;AAAA,MACzC,SAAS,MAAM,QAAQ,WAAW,eAAe;AAAA,MACjD,QAAQ,MAAM,QAAQ,UAAU,eAAe;AAAA,IACjD;AAAA,IACA,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW;AAAA,MACT,cAAc,GAAG,aAAa;AAAA,MAC9B,UAAU,GAAG,aAAa;AAAA,MAC1B,aAAa,GAAG,aAAa;AAAA,MAC7B,cAAc,GAAG,aAAa;AAAA,MAC9B,gBAAgB,GAAG,aAAa;AAAA,IAClC;AAAA,EACF;AACF;AAEO,SAAS,eAAe,QAA8B;AAC3D,MAAI,CAAC,OAAO,iBAAiB,CAAC,OAAO,YAAY,CAAC,OAAO,gBAAgB,CAAC,OAAO,YAAY;AAC3F,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,OAAO,cAAc,eAAe,OAAO,cAAc,aAAa,QAAQ;AAChF,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACF;;;AC9FA,yBAA4B;;;ACO5B,SAAS,gBACP,QACA,SACuB;AACvB,MAAI,CAAC,OAAO,cAAc,YAAa,QAAO;AAC9C,SAAO,EAAE,GAAG,SAAS,aAAa,KAAK;AACzC;AAEO,SAAS,mBACd,QACA,QACuB;AACvB,SAAO,gBAAgB,QAAQ;AAAA,IAC7B,UAAU;AAAA,IACV,UAAU,OAAO,cAAc;AAAA,IAC/B,QAAQ,OAAO,cAAc;AAAA,IAC7B,MAAM,OAAO,cAAc;AAAA,IAC3B;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBACd,QACA,cACA,cACkB;AAClB,QAAM,UAA4B;AAAA,IAChC;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,mBAAmB,QAAQ,OAAO,cAAc,aAAa;AAAA,IACxE;AAAA,EACF;AAEA,MAAI,cAAc;AAChB,YAAQ,KAAK;AAAA,MACX,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,mBAAmB,QAAQ,OAAO,cAAc,aAAa;AAAA,IACxE,CAAC;AAAA,EACH,OAAO;AACL,YAAQ,KAAK,iBAAiB,QAAQ,oBAAoB,CAAC;AAAA,EAC7D;AAEA,SAAO;AACT;AAEO,SAAS,iBAAiB,QAAwB,OAA+B;AACtF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS,mBAAmB,QAAQ,OAAO,cAAc,WAAW;AAAA,EACtE;AACF;AAEO,SAAS,iBAAiB,QAAwB,MAA8B;AACrF,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP,SAAS,gBAAgB,QAAQ;AAAA,MAC/B,UAAU;AAAA,MACV,UAAU,OAAO,cAAc;AAAA,MAC/B,QAAQ,OAAO,cAAc;AAAA,MAC7B,MAAM,OAAO,cAAc;AAAA,MAC3B,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;AAEO,SAAS,mBAAmB,QAA0C;AAC3E,SAAO,CAAC,gBAAgB,sBAAsB,kBAAkB,EAAE;AAAA,IAAI,CAAC,SACrE,iBAAiB,QAAQ,IAAI;AAAA,EAC/B;AACF;;;AD3EO,SAAS,mBACd,QACA,QACqB;AACrB,QAAM,YAAQ,gCAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,QAAM,eAAe,OAAO,kBAAkB,KAAK;AAEnD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,CAAC,iBAAiB,QAAQ,KAAK,CAAC;AAAA,EAChD;AACF;;;AEZA,eAAsB,sCACpB,QACA,QACA,OACA,MACe;AACf,MAAI,OAAO,iBAAiB,KAAM;AAElC,QAAM,UAAU,iBAAiB,KAAK;AACtC,MAAI,eAAe,QAAQ;AAC3B,MACE,cAAc,MACd,CAAC,aAAa,aACd,SAAS,aACT,QAAQ,OAAO,aAAa,IAC5B;AACA,mBAAe,EAAE,GAAG,cAAc,WAAW,QAAQ,UAAU;AAAA,EACjE;AACA,MAAI,CAAC,cAAc,IAAI;AACrB,UAAM,IAAI,UAAU,gBAAgB,mDAAmD;AAAA,EACzF;AACA,MAAI,CAAC,aAAa,WAAW;AAC3B,UAAM,IAAI,UAAU,gBAAgB,8BAA8B;AAAA,EACpE;AAEA,QAAM,OAAO,gCAAgC;AAAA,IAC3C;AAAA,IACA,aAAa,aAAa;AAAA,IAC1B,UAAU,aAAa;AAAA,IACvB,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;;;AC3BA,eAAsB,eACpB,QACA,QACA,OAMyB;AACzB,MAAI,MAAM,SAAS,CAAC,MAAM,MAAM;AAC9B,UAAM,IAAI,UAAU,WAAW,MAAM,SAAS,4BAA4B;AAAA,EAC5E;AAEA,QAAM,cAAc,MAAM,QAAQ,IAAI,kBAAkB;AACxD,MAAI,CAAC,eAAe,CAAC,MAAM,SAAS,gBAAgB,MAAM,OAAO;AAC/D,UAAM,IAAI,UAAU,iBAAiB,sBAAsB;AAAA,EAC7D;AAEA,QAAM,cAAc,MAAM,OAAO,0BAA0B,MAAM,IAAI;AACrE,QAAM,aAAa,MAAM,OAAO,kBAAkB,YAAY,YAAY;AAC1E,QAAM,OAAO,MAAM,OAAO,YAAY,YAAY,cAAc,YAAY,QAAQ;AAEpF,QAAM,sCAAsC,QAAQ,QAAQ,WAAW,aAAa,IAAI;AAExF,QAAM,eAAe,WAAW,gBAAgB;AAEhD,SAAO;AAAA,IACL,OAAO,WAAW;AAAA,IAClB;AAAA,IACA;AAAA,IACA,cAAc,oBAAoB,QAAQ,WAAW,aAAa,YAAY;AAAA,IAC9E,gBAAgB,CAAC,kBAAkB;AAAA,EACrC;AACF;;;ACvCA,SAAS,iBAA0B;AACjC,QAAM,QAAQ,QAAQ,IAAI;AAC1B,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,SAAO,eAAe,UAAU,eAAe,OAAO,eAAe;AACvE;AAEO,SAAS,aACd,OACA,SACA,MACM;AACN,MAAI,CAAC,eAAe,EAAG;AAEvB,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,MAAM;AACR,YAAQ,IAAI,QAAQ,SAAS,IAAI;AAAA,EACnC,OAAO;AACL,YAAQ,IAAI,QAAQ,OAAO;AAAA,EAC7B;AACF;AAEO,SAAS,iBACd,OACA,WAOA;AACA,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,OAAO,QAAQ,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,uBAAuB,KAAK;AAC5C,QAAM,UAAU,aAAa,OAAO,SAAS;AAE7C,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,MAAM;AAAA,IACd,GAAI,OAAO,SAAS,QAAQ,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC/D,GAAI,OAAO,SAAS,QAAQ,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC/D;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,OAG/B;AACA,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,OAAO,QAAQ,EAAE;AAAA,EACrC;AAEA,SAAO,EAAE,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC/C;;;ACrDA,eAAe,eACb,QACA,QACA,cACwB;AACxB,eAAa,WAAW,mBAAmB;AAE3C,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,iBAAiB,YAAY;AAC7D,UAAM,kBAAkB,WAAW,gBAAgB;AAEnD,iBAAa,WAAW,0BAA0B;AAAA,MAChD,yBAAyB,WAAW,gBAAgB;AAAA,IACtD,CAAC;AAED,QAAI,OAAO,iBAAiB,MAAM;AAChC,mBAAa,WAAW,6BAA6B,EAAE,eAAe,KAAK,CAAC;AAAA,IAC9E,OAAO;AACL,mBAAa,WAAW,6BAA6B;AAAA,QACnD,eAAe,OAAO;AAAA,MACxB,CAAC;AACD,YAAM,sCAAsC,QAAQ,QAAQ,WAAW,WAAW;AAClF,mBAAa,WAAW,4BAA4B;AAAA,QAClD,eAAe,OAAO;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,oBAAoB,QAAQ,WAAW,aAAa,eAAe;AAExF,iBAAa,WAAW,qBAAqB;AAAA,MAC3C,aAAa,aAAa;AAAA,MAC1B,aAAa,aAAa,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,MACrD,aAAa,WAAW,YAAY;AAAA,IACtC,CAAC;AAED,WAAO;AAAA,MACL,OAAO,WAAW;AAAA,MAClB,cAAc;AAAA,MACd;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,WAAW;AAC5B,mBAAa,WAAW,kBAAkB;AAAA,QACxC,MAAM,IAAI;AAAA,QACV,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI;AAAA,MACf,CAAC;AAAA,IACH,OAAO;AACL,mBAAa,WAAW,wCAAwC;AAAA,QAC9D,MAAM,eAAe,QAAQ,IAAI,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,eACpB,QACA,QACA,aACA,OACwB;AACxB,eAAa,WAAW,qBAAqB;AAAA,IAC3C,cAAc,iBAAiB,MAAM,YAAY;AAAA,EACnD,CAAC;AAED,SAAO,YAAY;AAAA,IAAY,MAAM;AAAA,IAAc,MACjD,eAAe,QAAQ,QAAQ,MAAM,YAAY;AAAA,EACnD;AACF;;;ACtEA,eAAe,mBACb,QACA,QACA,aACA,cACoB;AACpB,MAAI;AACF,UAAM,YAAY,MAAM,eAAe,QAAQ,QAAQ,aAAa,EAAE,aAAa,CAAC;AAEpF,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,cAAc,UAAU;AAAA,IAC1B;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,cAAc,IAAI,SAAS,WAAW,IAAI,SAAS,mBAAmB;AACvF,YAAM,IAAI,UAAU,mBAAmB,iBAAiB;AAAA,IAC1D;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,iBACpB,QACA,QACA,aACA,OACoB;AACpB,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,eAAe,MAAM,gBAAgB;AAE3C,MAAI,CAAC,cAAc;AACjB,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,UAAU,qBAAqB,mBAAmB;AAAA,IAC9D;AACA,WAAO,mBAAmB,QAAQ,QAAQ,aAAa,YAAY;AAAA,EACrE;AAEA,MAAI,CAAC,aAAa,cAAc,OAAO,eAAe,GAAG;AACvD,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B;AAEA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,UAAU,mBAAmB,iBAAiB;AAAA,EAC1D;AAEA,SAAO,mBAAmB,QAAQ,QAAQ,aAAa,YAAY;AACrE;;;AC9CO,SAAS,mBAAmB,OAEtB;AACX,QAAM,QAAQ,MAAM,gBAAgB;AACpC,QAAM,OAAO,iBAAiB,KAAK;AAEnC,SAAO;AAAA,IACL;AAAA,IACA,YAAY,CAAC,CAAC;AAAA,EAChB;AACF;AAEA,eAAsB,MACpB,QACA,QACA,aACA,OAImB;AACnB,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,eAAe,MAAM,gBAAgB;AAE3C,MAAI,CAAC,gBAAgB,CAAC,cAAc;AAClC,WAAO,EAAE,MAAM,MAAM,YAAY,MAAM;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,QAAQ,QAAQ,aAAa;AAAA,MACpE;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,iBAAiB,UAAU,KAAK;AAE7C,WAAO;AAAA,MACL;AAAA,MACA,YAAY;AAAA,MACZ,cAAc,UAAU;AAAA,IAC1B;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,WAAW;AAC5B,aAAO,EAAE,MAAM,MAAM,YAAY,MAAM;AAAA,IACzC;AACA,UAAM;AAAA,EACR;AACF;;;ACtCA,SAAS,uBAAuB,OAIZ;AAClB,QAAM,EAAE,cAAc,cAAc,gBAAgB,IAAI;AAExD,MAAI,CAAC,cAAc;AACjB,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,aAAa,cAAc,eAAe,GAAG;AAChD,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,eAAsB,SACpB,QACA,QACA,aACA,OAIoB;AACpB,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,eAAe,MAAM,gBAAgB;AAE3C,eAAa,OAAO,iBAAiB;AAAA,IACnC,YAAY,gBAAgB;AAAA,IAC5B,YAAY,gBAAgB;AAAA,IAC5B,SAAS,iBAAiB,cAAc,OAAO,eAAe;AAAA,IAC9D,cAAc,iBAAiB,YAAY;AAAA,IAC3C,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AAED,QAAM,OAAO,uBAAuB;AAAA,IAClC;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AAED,eAAa,OAAO,gBAAgB,EAAE,KAAK,CAAC;AAE5C,MAAI;AACF,UAAM,SAAS,MAAM,iBAAiB,QAAQ,QAAQ,aAAa;AAAA,MACjE;AAAA,MACA;AAAA,IACF,CAAC;AAED,iBAAa,OAAO,iBAAiB;AAAA,MACnC;AAAA,MACA,aAAa,OAAO,MAAM;AAAA,MAC1B,aAAa,OAAO,cAAc,UAAU;AAAA,IAC9C,CAAC;AAED,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,eAAe,WAAW;AAC5B,mBAAa,OAAO,cAAc;AAAA,QAChC;AAAA,QACA,MAAM,IAAI;AAAA,QACV,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI;AAAA,MACf,CAAC;AAAA,IACH,OAAO;AACL,mBAAa,OAAO,oCAAoC;AAAA,QACtD;AAAA,QACA,MAAM,eAAe,QAAQ,IAAI,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;;;ACzFO,SAAS,YAAY,SAAuC;AACjE,SAAO;AAAA,IACL,gBAAgB,CAAC,gBAAgB,sBAAsB,kBAAkB;AAAA,EAC3E;AACF;;;ACNA,eAAsB,cACpB,QACA,QACA,OAC8B;AAC9B,MAAI,OAAO,iBAAiB,MAAM;AAChC,iBAAa,kBAAkB,6BAA6B,EAAE,eAAe,KAAK,CAAC;AAAA,EACrF,OAAO;AACL,iBAAa,kBAAkB,6BAA6B;AAAA,MAC1D,eAAe,OAAO;AAAA,IACxB,CAAC;AACD,UAAM,sCAAsC,QAAQ,QAAQ,MAAM,YAAY;AAC9E,iBAAa,kBAAkB,4BAA4B;AAAA,MACzD,eAAe,OAAO;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,cAAc,oBAAoB,QAAQ,MAAM,cAAc,MAAM,YAAY;AAAA,EAClF;AACF;;;ACxBO,IAAM,qBAAN,MAAyB;AAAA,EACb,WAAW,oBAAI,IAAoC;AAAA,EAEpE,MAAM,YACJ,KACA,SACwB;AACxB,UAAM,WAAW,KAAK,SAAS,IAAI,GAAG;AACtC,QAAI,SAAU,QAAO;AAErB,UAAM,UAAU,QAAQ,EAAE,QAAQ,MAAM;AACtC,WAAK,SAAS,OAAO,GAAG;AAAA,IAC1B,CAAC;AAED,SAAK,SAAS,IAAI,KAAK,OAAO;AAC9B,WAAO;AAAA,EACT;AACF;AAEO,SAAS,2BAA+C;AAC7D,SAAO,IAAI,mBAAmB;AAChC;;;ACVO,SAAS,oBACd,aACA,SACe;AACf,QAAM,SAAS,cAAc,WAAW;AACxC,iBAAe,MAAM;AACrB,QAAM,SAAS,IAAI,gBAAgB,QAAQ,SAAS,SAAS,KAAK;AAClE,QAAM,cAAc,yBAAyB;AAE7C,QAAM,eAAe,CAAC,WAGf;AAAA,IACL,cAAc,MAAM,gBAAgB;AAAA,IACpC,cAAc,MAAM,gBAAgB;AAAA,EACtC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,mBAAmB,QAAQ,MAAM;AAAA,IAC3D,gBAAgB,CAAC,UAAU,eAAe,QAAQ,QAAQ,KAAK;AAAA,IAC/D,gBAAgB,CAAC,UAAU,eAAe,QAAQ,QAAQ,aAAa,KAAK;AAAA,IAC5E,OAAO,CAAC,UAAU,MAAM,QAAQ,QAAQ,aAAa,KAAK;AAAA,IAC1D,oBAAoB,CAAC,UAAU,mBAAmB,KAAK;AAAA,IACvD,kBAAkB,CAAC,UACjB,iBAAiB,QAAQ,QAAQ,aAAa,aAAa,KAAK,CAAC;AAAA,IACnE,UAAU,CAAC,UAAU,SAAS,QAAQ,QAAQ,aAAa,KAAK;AAAA,IAChE,eAAe,CAAC,UAAU,cAAc,QAAQ,QAAQ,KAAK;AAAA,IAC7D,aAAa,MAAM,YAAY,MAAM;AAAA,EACvC;AACF;;;ACzCO,SAAS,cAAc,QAAwB,MAAsB;AAC1E,MAAI,KAAK,WAAW,SAAS,KAAK,KAAK,WAAW,UAAU,GAAG;AAC7D,WAAO;AAAA,EACT;AACA,QAAM,aAAa,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACzD,SAAO,GAAG,OAAO,UAAU,GAAG,UAAU;AAC1C;AAEO,SAAS,WAAW,QAAgC;AACzD,SAAO,GAAG,OAAO,UAAU;AAC7B;AAEO,SAAS,iBAAiB,QAAwB,MAAsB;AAC7E,SAAO,cAAc,QAAQ,GAAG,OAAO,eAAe,GAAG,IAAI,EAAE;AACjE;;;ACPO,SAAS,sBAAsB,cAAsD;AAC1F,QAAM,SAAS,kBAAkB,YAAY;AAC7C,SAAO;AAAA,IACL,IAAI,MAAc;AAChB,aAAO,OAAO,IAAI;AAAA,IACpB;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,cAAiE;AACjG,MAAI,CAAC,aAAc,QAAO,CAAC;AAC3B,QAAM,SAAiC,CAAC;AACxC,aAAW,QAAQ,aAAa,MAAM,GAAG,GAAG;AAC1C,UAAM,CAAC,SAAS,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AAChD,QAAI,CAAC,QAAS;AACd,WAAO,OAAO,IAAI,mBAAmB,KAAK,KAAK,GAAG,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,UAAkC;AACtE,QAAM,EAAE,MAAM,OAAO,QAAQ,IAAI;AACjC,QAAM,QAAQ;AAAA,IACZ,GAAG,IAAI,IAAI,KAAK;AAAA,IAChB,QAAQ,QAAQ,IAAI;AAAA,IACpB;AAAA,IACA,YAAY,mBAAmB,QAAQ,QAAQ,CAAC;AAAA,IAChD,WAAW,QAAQ,MAAM;AAAA,EAC3B;AACA,MAAI,QAAQ,UAAU,QAAQ,YAAa,OAAM,KAAK,QAAQ;AAC9D,MAAI,QAAQ,YAAa,OAAM,KAAK,aAAa;AACjD,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,mBAAmB,OAA0C;AACpE,MAAI,UAAU,MAAO,QAAO;AAC5B,MAAI,UAAU,SAAU,QAAO;AAC/B,SAAO;AACT;AAEO,SAAS,qBAAqB,QAAwB,OAAmC;AAC9F,SAAO,MAAM,IAAI,CAAC,SAAS,iBAAiB,QAAQ,IAAI,CAAC;AAC3D;AAEO,SAAS,qBACd,QACA,WACM;AACN,MAAI,UAAU,WAAW,EAAG;AAE5B,QAAM,YAAY,UAAU,IAAI,CAAC,aAAa,sBAAsB,QAAQ,CAAC;AAC7E,MAAI,OAAO,cAAc;AACvB,eAAW,SAAS,WAAW;AAC7B,aAAO,aAAa,cAAc,KAAK;AAAA,IACzC;AACA;AAAA,EACF;AAEA,SAAO,UAAU,cAAc,SAAS;AAC1C;AAEO,SAAS,uBACd,QACA,QACA,OACM;AACN,QAAM,YAAY,QACd,qBAAqB,QAAQ,KAAK,IAClC,mBAAmB,MAAM;AAC7B,uBAAqB,QAAQ,SAAS;AACxC;AAEO,SAAS,gBAAgB,cAAyC;AACvE,QAAM,QAAQ,sBAAsB,YAAY;AAChD,SAAO;AAAA,IACL,SAAS,MAAM,IAAI,cAAc,KAAK;AAAA,IACtC,cAAc,MAAM,IAAI,oBAAoB,KAAK;AAAA,IACjD,YAAY,MAAM,IAAI,kBAAkB,KAAK;AAAA,IAC7C;AAAA,EACF;AACF;;;ACvFA,SAAS,WAAW,SAAiC,MAA6B;AAChF,QAAM,QAAQ,QAAQ,IAAI;AAC1B,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,CAAC,KAAK;AAC7C,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEO,SAAS,iBAAiB,SAAgD;AAC/E,QAAM,OAAO,WAAW,SAAS,MAAM;AACvC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,WAAW,SAAS,mBAAmB,KAAK;AAC1D,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEO,SAAS,sBACd,SACA,YACS;AACT,QAAM,YAAY,WAAW,SAAS,gBAAgB;AACtD,MAAI,cAAc,MAAM;AACtB,WAAO,cAAc,iBAAiB,cAAc;AAAA,EACtD;AACA,QAAM,SAAS,WAAW,SAAS,QAAQ;AAC3C,MAAI,WAAW,KAAM,QAAO;AAE5B,QAAM,WAAW,iBAAiB,OAAO;AACzC,MAAI,aAAa,QAAQ,WAAW,SAAU,QAAO;AAErD,MAAI,YAAY;AACd,QAAI;AACF,YAAM,aAAa,IAAI,IAAI,UAAU;AACrC,YAAM,OAAO,WAAW,SAAS,MAAM;AACvC,UAAI,SAAS,WAAW,QAAQ,WAAW,WAAW,QAAQ;AAC5D,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAwB;AACvD,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI,OAAO,SAAS,UAAU;AAC5B,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO;AACzB,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,WAAW,eAAe,OAAO,SAAS,IAAI,GAAG;AAC1D,QAAI;AACF,aAAO,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC;AAAA,IACzC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AA4BA,SAAS,gBAAgB,OAAwB;AAC/C,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI;AACF,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,IACvF;AACA,WAAO,OAAO,QAAQ,QAAQ,YAAY,QAAQ,MAAM;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,sBACd,MACuD;AACvD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,eAAgB,KAAoC;AAC1D,QAAM,eAAgB,KAAoC;AAC1D,MAAI,OAAO,iBAAiB,YAAY,CAAC,aAAa,KAAK,EAAG,QAAO;AACrE,MAAI,OAAO,iBAAiB,YAAY,CAAC,aAAa,KAAK,EAAG,QAAO;AACrE,MAAI,CAAC,gBAAgB,YAAY,EAAG,QAAO;AAC3C,SAAO,EAAE,cAAc,aAAa,KAAK,GAAG,cAAc,aAAa,KAAK,EAAE;AAChF;;;ArB3DA,SAAS,WAAW,OAA0D;AAC5E,SAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAC3C;AAEO,SAAS,0BAA0B,KAA0C;AAClF,SAAO;AAAA,IACL,WAAW,CAAC,MAAM,UAAU,IAAI,UAAU,MAAM,KAAK;AAAA,IACrD,cAAc,IAAI,eACd,CAAC,MAAM,UAAU,IAAI,aAAc,MAAM,KAAK,IAC9C;AAAA,EACN;AACF;AAEA,SAAS,aAAa,KAAsB,WAAmC;AAC7E,uBAAqB,0BAA0B,GAAG,GAAG,SAAS;AAChE;AAEO,SAAS,wBACd,QACA,SACA;AACA,QAAM,OAAO,oBAAoB,QAAQ,OAAO;AAEhD,SAAO;AAAA,IACL,MAAM,KAAqB,KAAsB;AAC/C,UAAI,IAAI,WAAW,OAAO;AACxB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AACpD;AAAA,MACF;AAEA,UAAI;AACF,cAAM,SAAS,KAAK,mBAAmB;AACvC,qBAAa,KAAK,OAAO,YAAY;AACrC,YAAI,SAAS,KAAK,OAAO,YAAY;AAAA,MACvC,SAAS,KAAK;AACZ,cAAM,OAAO,eAAe,YAAY,IAAI,OAAO;AACnD,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,MACtC;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,KAAqB,KAAsB;AACxD,UAAI,IAAI,WAAW,OAAO;AACxB,YAAI,OAAO,GAAG,EAAE,IAAI;AACpB;AAAA,MACF;AAEA,YAAM,EAAE,MAAM,IAAI,gBAAgB,IAAI,QAAQ,MAAM;AACpD,YAAM,OAAO,WAAW,IAAI,MAAM,IAAI;AACtC,YAAM,QAAQ,WAAW,IAAI,MAAM,KAAK;AACxC,YAAM,QAAQ,WAAW,IAAI,MAAM,KAAK;AAExC,UAAI,SAAS,CAAC,MAAM;AAClB,YAAI,SAAS,KAAK,iBAAiB,KAAK,QAAQ,SAAS,SAAS,CAAC;AACnE;AAAA,MACF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,eAAe,EAAE,MAAM,OAAO,SAAS,MAAM,CAAC;AACxE,qBAAa,KAAK;AAAA,UAChB,GAAG,OAAO;AAAA,UACV,GAAG,qBAAqB,KAAK,QAAQ,OAAO,cAAc;AAAA,QAC5D,CAAC;AACD,YAAI,SAAS,KAAK,WAAW,KAAK,MAAM,CAAC;AAAA,MAC3C,SAAS,KAAK;AACZ,cAAMC,QAAO,eAAe,YAAY,IAAI,OAAO;AACnD,YAAI,SAAS,KAAK,iBAAiB,KAAK,QAAQA,KAAI,CAAC;AAAA,MACvD;AAAA,IACF;AAAA,IAEA,MAAM,GAAG,KAAqB,KAAsB;AAClD,UAAI,IAAI,WAAW,OAAO;AACxB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AACpD;AAAA,MACF;AAEA,YAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,IAAI,QAAQ,MAAM;AACpE,YAAM,SAAS,MAAM,KAAK,MAAM,EAAE,cAAc,SAAS,aAAa,CAAC;AACvE,UAAI,OAAO,cAAc,QAAQ;AAC/B,qBAAa,KAAK,OAAO,YAAY;AAAA,MACvC;AACA,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,IAAI,KAAqB,KAAsB;AACnD,UAAI,IAAI,WAAW,OAAO;AACxB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AACpD;AAAA,MACF;AAEA,YAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,IAAI,QAAQ,MAAM;AAEpE,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,SAAS,EAAE,cAAc,SAAS,aAAa,CAAC;AAC1E,YAAI,OAAO,cAAc,QAAQ;AAC/B,uBAAa,KAAK,OAAO,YAAY;AAAA,QACvC;AACA,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,MAC9C,SAAS,KAAK;AACZ,YAAI,eAAe,WAAW;AAC5B,cAAI,OAAO,IAAI,UAAU,EAAE,KAAK;AAAA,YAC9B,OAAO,IAAI;AAAA,YACX,OAAO;AAAA,YACP,aAAa,KAAK,OAAO,OAAO;AAAA,UAClC,CAAC;AACD;AAAA,QACF;AACA,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,OAAO,KAAK,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,KAAqB,KAAsB;AACvD,UAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AACjD,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AACpD;AAAA,MACF;AAEA,YAAM,EAAE,aAAa,IAAI,gBAAgB,IAAI,QAAQ,MAAM;AAC3D,UAAI,CAAC,cAAc;AACjB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,IAAI,MAAM,CAAC;AAC9D;AAAA,MACF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,eAAe,EAAE,aAAa,CAAC;AACzD,qBAAa,KAAK,OAAO,YAAY;AACrC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,MACxD,QAAQ;AACN,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,IAAI,MAAM,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,OAAO,KAAqB,KAAsB;AAChD,UAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AACjD,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AACpD;AAAA,MACF;AAEA,6BAAuB,KAAK,QAAQ,0BAA0B,GAAG,CAAC;AAClE,UAAI,SAAS,KAAK,WAAW,KAAK,MAAM,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,cAAc,KAAqB,KAAsB;AAC7D,UAAI,IAAI,WAAW,QAAQ;AACzB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AACpD;AAAA,MACF;AACA,UAAI,CAAC,sBAAsB,IAAI,SAAS,KAAK,OAAO,UAAU,GAAG;AAC/D,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,6BAA6B,CAAC;AAC5D;AAAA,MACF;AAEA,YAAM,SAAS,sBAAsB,iBAAiB,IAAI,IAAI,CAAC;AAC/D,UAAI,CAAC,QAAQ;AACX,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAC9C;AAAA,MACF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,cAAc,MAAM;AAC9C,qBAAa,KAAK,OAAO,YAAY;AACrC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,WAAW;AAC5B,cAAI,OAAO,IAAI,UAAU,EAAE,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC;AACnD;AAAA,QACF;AACA,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,IAEA;AAAA,EACF;AACF;","names":["body","code"]}