{"version":3,"sources":["../../../src/adapters/next/app-router.ts","../../../src/errors.ts","../../../src/session/jwt.ts","../../../src/client.ts","../../../src/constants.ts","../../../src/config.ts","../../../src/flows/login.ts","../../../src/session/cookies.ts","../../../src/flows/entitlement.ts","../../../src/flows/callback.ts","../../../src/debug.ts","../../../src/flows/refresh.ts","../../../src/session/ensure-fejwt.ts","../../../src/flows/me.ts","../../../src/flows/jwt.ts","../../../src/flows/logout.ts","../../../src/flows/import-session.ts","../../../src/session/refresh-coordinator.ts","../../../src/index.ts","../../../src/adapters/shared.ts","../../../src/adapters/redirects.ts","../../../src/adapters/same-site.ts"],"sourcesContent":["import {\n  createAppDirectAuth,\n  AuthError,\n  type AppDirectAuthConfig,\n  type CookieMutation,\n} from '../../index.js';\nimport { applyCookieMutations, clearCookieMutations, readAuthCookies } from '../shared.js';\nimport { appHomeUrl, errorRedirectUrl } from '../redirects.js';\nimport { assertSameSiteFetchRequest, readBodySessionTokens } from '../same-site.js';\n\ntype NextResponseType = {\n  redirect(url: string | URL, status?: number): NextResponseType;\n  json(body: unknown, init?: { status?: number }): NextResponseType;\n  headers: {\n    set(name: string, value: string): void;\n    append(name: string, value: string): void;\n  };\n  cookies: {\n    set(\n      name: string,\n      value: string,\n      options?: {\n        httpOnly?: boolean;\n        sameSite?: 'lax' | 'strict' | 'none';\n        secure?: boolean;\n        path?: string;\n        maxAge?: number;\n      },\n    ): void;\n  };\n};\n\ntype NextResponseConstructor = {\n  redirect(url: string | URL, status?: number): NextResponseType;\n  json(body: unknown, init?: { status?: number }): NextResponseType;\n};\n\nfunction getNextResponse(): NextResponseConstructor {\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const nextServer = require('next/server') as { NextResponse: NextResponseConstructor };\n    return nextServer.NextResponse;\n  } catch {\n    throw new Error(\n      'Next.js is required for @appdirect/auth-bff/next. Install next as a peer dependency.',\n    );\n  }\n}\n\nfunction applyCookiesToNextResponse(\n  response: NextResponseType,\n  mutations: CookieMutation[],\n): void {\n  applyCookieMutations(\n    {\n      setHeader: (name, value) =>\n        response.headers.set(name, Array.isArray(value) ? value.join(', ') : value),\n      appendHeader: (name, value) => response.headers.append(name, value),\n    },\n    mutations,\n  );\n}\n\nexport function createNextAuthHandlers(config: AppDirectAuthConfig) {\n  const auth = createAppDirectAuth(config);\n  const NextResponse = getNextResponse();\n\n  return {\n    login(req: Request): NextResponseType {\n      if (req.method !== 'GET') {\n        return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n      }\n\n      try {\n        const result = auth.buildLoginRedirect();\n        const response = NextResponse.redirect(result.authorizeUrl, 302);\n        applyCookiesToNextResponse(response, result.cookiesToSet);\n        return response;\n      } catch (err: unknown) {\n        const code = err instanceof AuthError ? err.code : 'server_config';\n        return NextResponse.json({ error: code }, { status: 500 });\n      }\n    },\n\n    async callback(req: Request): Promise<NextResponseType> {\n      if (req.method !== 'GET') {\n        return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n      }\n\n      const url = new URL(req.url);\n      const code = url.searchParams.get('code') ?? undefined;\n      const error = url.searchParams.get('error') ?? undefined;\n      const state = url.searchParams.get('state') ?? undefined;\n      const { store } = readAuthCookies(req.headers.get('cookie'));\n\n      if (error || !code) {\n        return NextResponse.redirect(errorRedirectUrl(auth.config, error ?? 'no_code'), 302);\n      }\n\n      try {\n        const result = await auth.handleCallback({ code, state, cookies: store });\n        const response = NextResponse.redirect(appHomeUrl(auth.config), 302);\n        applyCookiesToNextResponse(response, result.cookiesToSet);\n        applyCookiesToNextResponse(\n          response,\n          clearCookieMutations(auth.config, result.cookiesToClear),\n        );\n        return response;\n      } catch (err: unknown) {\n        const code = err instanceof AuthError ? err.code : 'server_config';\n        return NextResponse.redirect(errorRedirectUrl(auth.config, code), 302);\n      }\n    },\n\n    async me(req: Request): Promise<NextResponseType> {\n      if (req.method !== 'GET') {\n        return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n      }\n\n      const { session, refreshToken } = readAuthCookies(req.headers.get('cookie'));\n      const result = await auth.getMe({ sessionToken: session, refreshToken });\n      const response = NextResponse.json({\n        user: result.user,\n        hasSession: result.hasSession,\n      });\n      if (result.cookiesToSet?.length) {\n        applyCookiesToNextResponse(response, result.cookiesToSet);\n      }\n      return response;\n    },\n\n    async jwt(req: Request): Promise<NextResponseType> {\n      if (req.method !== 'GET') {\n        return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n      }\n\n      const { session, refreshToken } = readAuthCookies(req.headers.get('cookie'));\n\n      try {\n        const result = await auth.getFeJwt({ sessionToken: session, refreshToken });\n        const response = NextResponse.json({ token: result.token });\n        if (result.cookiesToSet?.length) {\n          applyCookiesToNextResponse(response, result.cookiesToSet);\n        }\n        return response;\n      } catch (err: unknown) {\n        if (err instanceof AuthError) {\n          return NextResponse.json(\n            {\n              error: err.code,\n              token: null,\n              refresh_url: auth.config.routes.refresh,\n            },\n            { status: err.statusCode },\n          );\n        }\n        return NextResponse.json({ error: 'server_config', token: null }, { status: 500 });\n      }\n    },\n\n    async refresh(req: Request): Promise<NextResponseType> {\n      if (req.method !== 'GET' && req.method !== 'POST') {\n        return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n      }\n\n      const { refreshToken } = readAuthCookies(req.headers.get('cookie'));\n      if (!refreshToken) {\n        return NextResponse.json({ error: 'not_authenticated', ok: false }, { status: 401 });\n      }\n\n      try {\n        const result = await auth.refreshSession({ refreshToken });\n        const response = NextResponse.json({ ok: true, token: result.fejwt });\n        applyCookiesToNextResponse(response, result.cookiesToSet);\n        return response;\n      } catch {\n        return NextResponse.json({ error: 'refresh_failed', ok: false }, { status: 502 });\n      }\n    },\n\n    logout(req: Request): NextResponseType {\n      if (req.method !== 'GET' && req.method !== 'POST') {\n        return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n      }\n\n      const response = NextResponse.redirect(appHomeUrl(auth.config), 302);\n      applyCookiesToNextResponse(\n        response,\n        clearCookieMutations(auth.config, auth.buildLogout().cookiesToClear),\n      );\n      return response;\n    },\n\n    async importSession(req: Request): Promise<NextResponseType> {\n      if (req.method !== 'POST') {\n        return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n      }\n      if (!assertSameSiteFetchRequest(req, auth.config.appBaseUrl)) {\n        return NextResponse.json({ error: 'Cross-site request blocked' }, { status: 403 });\n      }\n\n      let body: unknown;\n      try {\n        body = await req.json();\n      } catch {\n        return NextResponse.json({ error: 'invalid_body' }, { status: 400 });\n      }\n\n      const tokens = readBodySessionTokens(body);\n      if (!tokens) {\n        return NextResponse.json({ error: 'invalid_body' }, { status: 400 });\n      }\n\n      try {\n        const result = await auth.importSession(tokens);\n        const response = NextResponse.json({ ok: true });\n        applyCookiesToNextResponse(response, result.cookiesToSet);\n        return response;\n      } catch (err: unknown) {\n        if (err instanceof AuthError) {\n          return NextResponse.json({ error: err.code }, { status: err.statusCode });\n        }\n        return NextResponse.json({ error: 'server_config' }, { status: 500 });\n      }\n    },\n\n    auth,\n  };\n}\n\nexport type { AppDirectAuthConfig };\n","export type AuthErrorCode =\n  | 'server_config'\n  | 'no_code'\n  | 'invalid_state'\n  | 'token_exchange'\n  | 'fejwt'\n  | 'userinfo'\n  | 'unauthorized'\n  | 'session_expired'\n  | 'not_authenticated'\n  | 'refresh_failed'\n  | 'method_not_allowed';\n\nexport class AuthError extends Error {\n  readonly code: AuthErrorCode;\n  readonly statusCode: number;\n  readonly details?: unknown;\n\n  constructor(code: AuthErrorCode, message?: string, options?: { statusCode?: number; details?: unknown }) {\n    super(message ?? code);\n    this.name = 'AuthError';\n    this.code = code;\n    this.statusCode = options?.statusCode ?? AuthError.defaultStatus(code);\n    this.details = options?.details;\n  }\n\n  private static defaultStatus(code: AuthErrorCode): number {\n    switch (code) {\n      case 'not_authenticated':\n      case 'session_expired':\n      case 'unauthorized':\n        return 401;\n      case 'method_not_allowed':\n        return 405;\n      case 'server_config':\n        return 500;\n      case 'refresh_failed':\n      case 'token_exchange':\n      case 'fejwt':\n      case 'userinfo':\n        return 502;\n      default:\n        return 400;\n    }\n  }\n}\n","import type { AuthUser } from '../types.js';\n\nexport interface JwtPayload {\n  sub?: string;\n  email?: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  current_active_company?: string;\n  companyUuid?: string;\n  company_id?: string;\n  exp?: number;\n  [key: string]: unknown;\n}\n\nfunction claimString(\n  payload: Record<string, unknown> | JwtPayload | null | undefined,\n  key: string,\n): string | null {\n  if (!payload) return null;\n  const value = payload[key];\n  return typeof value === 'string' && value ? value : null;\n}\n\nexport function resolveCompanyIdFromClaims(\n  payload: Record<string, unknown> | JwtPayload | null | undefined,\n): string | null {\n  return (\n    claimString(payload, 'current_active_company') ??\n    claimString(payload, 'companyUuid') ??\n    claimString(payload, 'company_id')\n  );\n}\n\nexport function decodeJwtPayloadUnsafe(token: string | null | undefined): JwtPayload | null {\n  if (!token || typeof token !== 'string') return null;\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return null;\n    const decoded = Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString(\n      'utf8',\n    );\n    return JSON.parse(decoded) as JwtPayload;\n  } catch {\n    return null;\n  }\n}\n\nexport function isJwtExpired(token: string, bufferSec: number): boolean {\n  const payload = decodeJwtPayloadUnsafe(token);\n  if (!payload || typeof payload.exp !== 'number') return false;\n  const now = Math.floor(Date.now() / 1000);\n  return payload.exp < now + bufferSec;\n}\n\nexport function mapClaimsToUser(payload: JwtPayload | null): AuthUser | null {\n  if (!payload?.sub) return null;\n\n  const name =\n    payload.name ??\n    ([payload.given_name, payload.family_name].filter(Boolean).join(' ') || null);\n\n  return {\n    id: payload.sub,\n    email: payload.email ?? null,\n    name,\n    picture: payload.picture ?? null,\n    companyId: resolveCompanyIdFromClaims(payload),\n  };\n}\n\nexport function getUserFromFeJwt(token: string | null | undefined): AuthUser | null {\n  return mapClaimsToUser(decodeJwtPayloadUnsafe(token));\n}\n","import type {\n  AuthTokenResult,\n  AuthUser,\n  FeJwtResponse,\n  ResolvedConfig,\n  TokenResponse,\n  UserInfoResponse,\n} from './types.js';\nimport { AuthError } from './errors.js';\nimport { resolveCompanyIdFromClaims } from './session/jwt.js';\n\nexport type FetchFn = typeof fetch;\n\nfunction basicAuthHeader(clientId: string, clientSecret: string): string {\n  return `Basic ${Buffer.from(`${clientId}:${clientSecret}`, 'utf8').toString('base64')}`;\n}\n\nexport function parseFeJwt(body: FeJwtResponse): string {\n  const fejwt = body.fejwt ?? body.fewjwt ?? body.token ?? body.jwt ?? body.access_token;\n  if (!fejwt || typeof fejwt !== 'string') {\n    throw new AuthError('fejwt', 'FEJWT missing in response');\n  }\n  return fejwt;\n}\n\nfunction parseAuthTokenResponse(body: FeJwtResponse & TokenResponse): AuthTokenResult {\n  const accessToken = parseFeJwt(body);\n  const refreshToken =\n    typeof body.refresh_token === 'string' ? body.refresh_token : undefined;\n  return { accessToken, refreshToken };\n}\n\nasync function postAuthEndpoint(\n  fetchFn: FetchFn,\n  url: string,\n  bearerToken: string,\n): Promise<AuthTokenResult> {\n  const res = await fetchFn(url, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/json',\n      Accept: 'application/json',\n      Authorization: `Bearer ${bearerToken}`,\n    },\n    body: JSON.stringify({}),\n  });\n\n  if (!res.ok) {\n    const body = await res.text();\n    throw new AuthError('fejwt', 'Auth token request failed', {\n      details: { status: res.status, body },\n    });\n  }\n\n  const body = (await res.json()) as FeJwtResponse & TokenResponse;\n  return parseAuthTokenResponse(body);\n}\n\nexport function mapUserInfo(userinfo: UserInfoResponse): AuthUser {\n  const name =\n    [userinfo.given_name, userinfo.family_name].filter(Boolean).join(' ') ||\n    userinfo.name ||\n    null;\n\n  return {\n    id: userinfo.sub,\n    email: userinfo.email ?? null,\n    name,\n    picture: userinfo.picture ?? null,\n    companyId: userinfo.current_active_company ?? null,\n  };\n}\n\nexport function mapIdTokenClaims(payload: Record<string, unknown>): AuthUser | null {\n  const sub = payload.sub;\n  if (typeof sub !== 'string' || !sub) return null;\n\n  const givenName = typeof payload.given_name === 'string' ? payload.given_name : undefined;\n  const familyName = typeof payload.family_name === 'string' ? payload.family_name : undefined;\n  const nameField = typeof payload.name === 'string' ? payload.name : undefined;\n  const name = nameField ?? ([givenName, familyName].filter(Boolean).join(' ') || null);\n\n  return {\n    id: sub,\n    email: typeof payload.email === 'string' ? payload.email : null,\n    name,\n    picture: typeof payload.picture === 'string' ? payload.picture : null,\n    companyId: resolveCompanyIdFromClaims(payload),\n  };\n}\n\nexport function decodeIdToken(idToken: string): Record<string, unknown> | null {\n  try {\n    const payload = idToken.split('.')[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nexport class AppDirectClient {\n  constructor(\n    private readonly config: ResolvedConfig,\n    private readonly fetchFn: FetchFn = fetch,\n  ) {}\n\n  buildAuthorizeUrl(state: string): string {\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: this.config.scopes.join(' '),\n      state,\n    });\n    return `${this.config.endpoints.authorizeUrl}?${params}`;\n  }\n\n  async exchangeAuthorizationCode(code: string): Promise<TokenResponse> {\n    const res = await this.fetchFn(this.config.endpoints.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Authorization: basicAuthHeader(this.config.clientId, this.config.clientSecret),\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: this.config.redirectUri,\n      }),\n    });\n\n    if (!res.ok) {\n      const body = await res.text();\n      throw new AuthError('token_exchange', 'Authorization code exchange failed', {\n        details: { status: res.status, body },\n      });\n    }\n\n    return (await res.json()) as TokenResponse;\n  }\n\n  async refreshAccessToken(refreshToken: string): Promise<TokenResponse> {\n    const res = await this.fetchFn(this.config.endpoints.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Authorization: basicAuthHeader(this.config.clientId, this.config.clientSecret),\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      }),\n    });\n\n    if (!res.ok) {\n      const body = await res.text();\n      throw new AuthError('refresh_failed', 'Refresh token exchange failed', {\n        details: { status: res.status, body },\n      });\n    }\n\n    return (await res.json()) as TokenResponse;\n  }\n\n  async exchangeAuthToken(oauthAccessToken: string): Promise<AuthTokenResult> {\n    return postAuthEndpoint(\n      this.fetchFn,\n      this.config.endpoints.authTokenUrl,\n      oauthAccessToken,\n    );\n  }\n\n  async refreshAuthToken(authRefreshToken: string): Promise<AuthTokenResult> {\n    return postAuthEndpoint(\n      this.fetchFn,\n      this.config.endpoints.authRefreshUrl,\n      authRefreshToken,\n    );\n  }\n\n  async fetchUserInfo(accessToken: string): Promise<AuthUser | null> {\n    const res = await this.fetchFn(this.config.endpoints.userinfoUrl, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!res.ok) return null;\n    const userinfo = (await res.json()) as UserInfoResponse;\n    return mapUserInfo(userinfo);\n  }\n\n  async resolveUser(accessToken: string, idToken?: string): Promise<AuthUser> {\n    const fromUserInfo = await this.fetchUserInfo(accessToken);\n\n    let fromIdToken: AuthUser | null = null;\n    if (idToken) {\n      const claims = decodeIdToken(idToken);\n      if (claims) {\n        fromIdToken = mapIdTokenClaims(claims);\n      }\n    }\n\n    if (fromUserInfo?.id) {\n      if (\n        !fromUserInfo.companyId &&\n        fromIdToken?.companyId &&\n        fromIdToken.id === fromUserInfo.id\n      ) {\n        return { ...fromUserInfo, companyId: fromIdToken.companyId };\n      }\n      return fromUserInfo;\n    }\n\n    if (fromIdToken?.id) return fromIdToken;\n\n    throw new AuthError('userinfo', 'Unable to resolve user identity');\n  }\n\n  async assertUserAssignedToApplication(input: {\n    fejwt: string;\n    companyUuid: string;\n    userUuid: string;\n    applicationId: number;\n  }): Promise<void> {\n    const url = new URL(\n      `${this.config.issuerBaseUrl}/api/account/v2/companies/${encodeURIComponent(input.companyUuid)}/memberships/${encodeURIComponent(input.userUuid)}/myapps`,\n    );\n    url.searchParams.set('applicationId', String(input.applicationId));\n\n    const res = await this.fetchFn(url.toString(), {\n      headers: {\n        Authorization: `Bearer ${input.fejwt}`,\n        Accept: 'application/json',\n      },\n    });\n\n    if (!res.ok) {\n      await res.text().catch(() => undefined);\n      throw new AuthError('unauthorized', 'User is not assigned to this application', {\n        details: { status: res.status },\n      });\n    }\n\n    const body = (await res.json()) as { content?: unknown[] };\n    if (!Array.isArray(body.content) || body.content.length === 0) {\n      throw new AuthError('unauthorized', 'User is not assigned to this application');\n    }\n  }\n}\n","export const COOKIE_SESSION = 'session';\nexport const COOKIE_REFRESH_TOKEN = 'refresh_token';\nexport const COOKIE_OAUTH_STATE = 'oauth_state';\n\nexport const DEFAULT_CALLBACK_PATH = '/api/auth/callback';\nexport const DEFAULT_SCOPES = [\n  'company',\n  'openid',\n  'profile',\n  'email',\n] as const;\n\nexport const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\nexport const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nexport const DEFAULT_STATE_MAX_AGE = 60 * 10; // 10 minutes\nexport const DEFAULT_EXPIRY_BUFFER_SEC = 60;\n\nexport const DEFAULT_ROUTES = {\n  login: '/api/auth/login',\n  callback: '/api/auth/callback',\n  me: '/api/auth/me',\n  jwt: '/api/auth/jwt',\n  refresh: '/api/auth/refresh',\n  logout: '/api/auth/logout',\n} as const;\n\nexport const DEFAULT_ERROR_REDIRECT = '/?error=';\n","import {\n  DEFAULT_CALLBACK_PATH,\n  DEFAULT_ERROR_REDIRECT,\n  DEFAULT_EXPIRY_BUFFER_SEC,\n  DEFAULT_REFRESH_MAX_AGE,\n  DEFAULT_ROUTES,\n  DEFAULT_SCOPES,\n  DEFAULT_SESSION_MAX_AGE,\n  DEFAULT_STATE_MAX_AGE,\n} from './constants.js';\nimport type { AppDirectAuthConfig, CookieOptions, ResolvedConfig } from './types.js';\n\nfunction normalizeBaseUrl(url: string): string {\n  return url.replace(/\\/$/, '');\n}\n\nfunction parseApplicationId(value?: string | number): number | null {\n  if (value == null) return null;\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    if (trimmed === '') return null;\n    const parsed = Number(trimmed);\n    if (!Number.isFinite(parsed)) return null;\n    return parsed;\n  }\n  if (!Number.isFinite(value)) return null;\n  return value;\n}\n\nexport function resolveConfig(input: AppDirectAuthConfig): ResolvedConfig {\n  const issuerBaseUrl = normalizeBaseUrl(input.issuerBaseUrl);\n  const appBaseUrl = normalizeBaseUrl(input.appBaseUrl);\n  const callbackPath = input.callbackPath ?? DEFAULT_CALLBACK_PATH;\n  const partitioned = input.cookieOptions?.partitioned ?? false;\n  let secure =\n    input.secureCookies ??\n    input.cookieOptions?.secure ??\n    process.env.NODE_ENV === 'production';\n  let sameSite = input.cookieOptions?.sameSite ?? 'lax';\n\n  if (partitioned) {\n    secure = true;\n    if (input.cookieOptions?.sameSite === undefined) {\n      sameSite = 'none';\n    }\n  }\n\n  const cookieOptions: Required<CookieOptions> = {\n    sessionMaxAge: input.cookieOptions?.sessionMaxAge ?? DEFAULT_SESSION_MAX_AGE,\n    refreshMaxAge: input.cookieOptions?.refreshMaxAge ?? DEFAULT_REFRESH_MAX_AGE,\n    stateMaxAge: input.cookieOptions?.stateMaxAge ?? DEFAULT_STATE_MAX_AGE,\n    secure,\n    sameSite,\n    path: input.cookieOptions?.path ?? '/',\n    partitioned,\n  };\n\n  return {\n    issuerBaseUrl,\n    clientId: input.clientId,\n    clientSecret: input.clientSecret,\n    appBaseUrl,\n    applicationId: parseApplicationId(input.applicationId),\n    callbackPath,\n    redirectUri: `${appBaseUrl}${callbackPath}`,\n    scopes: input.scopes ?? [...DEFAULT_SCOPES],\n    cookieOptions,\n    expiryBufferSec: input.expiryBufferSec ?? DEFAULT_EXPIRY_BUFFER_SEC,\n    routes: {\n      login: input.routes?.login ?? DEFAULT_ROUTES.login,\n      callback: input.routes?.callback ?? DEFAULT_ROUTES.callback,\n      me: input.routes?.me ?? DEFAULT_ROUTES.me,\n      jwt: input.routes?.jwt ?? DEFAULT_ROUTES.jwt,\n      refresh: input.routes?.refresh ?? DEFAULT_ROUTES.refresh,\n      logout: input.routes?.logout ?? DEFAULT_ROUTES.logout,\n    },\n    onErrorRedirect: input.onErrorRedirect ?? DEFAULT_ERROR_REDIRECT,\n    endpoints: {\n      authorizeUrl: `${issuerBaseUrl}/oauth2/authorize`,\n      tokenUrl: `${issuerBaseUrl}/oauth2/token`,\n      userinfoUrl: `${issuerBaseUrl}/oauth2/userinfo`,\n      authTokenUrl: `${issuerBaseUrl}/auth/token`,\n      authRefreshUrl: `${issuerBaseUrl}/auth/refresh`,\n    },\n  };\n}\n\nexport function validateConfig(config: ResolvedConfig): void {\n  if (!config.issuerBaseUrl || !config.clientId || !config.clientSecret || !config.appBaseUrl) {\n    throw new Error('issuerBaseUrl, clientId, clientSecret, and appBaseUrl are required');\n  }\n  if (config.cookieOptions.partitioned && config.cookieOptions.sameSite !== 'none') {\n    throw new Error('cookieOptions.partitioned requires cookieOptions.sameSite to be \"none\"');\n  }\n}\n","import { randomBytes } from 'node:crypto';\nimport type { AppDirectClient } from '../client.js';\nimport { buildStateCookie } from '../session/cookies.js';\nimport type { LoginRedirectResult, ResolvedConfig } from '../types.js';\n\nexport function buildLoginRedirect(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n): LoginRedirectResult {\n  const state = randomBytes(16).toString('hex');\n  const authorizeUrl = client.buildAuthorizeUrl(state);\n\n  return {\n    authorizeUrl,\n    state,\n    cookiesToSet: [buildStateCookie(config, state)],\n  };\n}\n","import {\n  COOKIE_OAUTH_STATE,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_SESSION,\n} from '../constants.js';\nimport type { CookieMutation, CookieMutationOptions, ResolvedConfig } from '../types.js';\n\nfunction withPartitioned(\n  config: ResolvedConfig,\n  options: CookieMutationOptions,\n): CookieMutationOptions {\n  if (!config.cookieOptions.partitioned) return options;\n  return { ...options, partitioned: true };\n}\n\nexport function buildCookieOptions(\n  config: ResolvedConfig,\n  maxAge: number,\n): CookieMutationOptions {\n  return withPartitioned(config, {\n    httpOnly: true,\n    sameSite: config.cookieOptions.sameSite,\n    secure: config.cookieOptions.secure,\n    path: config.cookieOptions.path,\n    maxAge,\n  });\n}\n\nexport function buildSessionCookies(\n  config: ResolvedConfig,\n  sessionToken: string,\n  refreshToken?: string | null,\n): CookieMutation[] {\n  const cookies: CookieMutation[] = [\n    {\n      name: COOKIE_SESSION,\n      value: sessionToken,\n      options: buildCookieOptions(config, config.cookieOptions.sessionMaxAge),\n    },\n  ];\n\n  if (refreshToken) {\n    cookies.push({\n      name: COOKIE_REFRESH_TOKEN,\n      value: refreshToken,\n      options: buildCookieOptions(config, config.cookieOptions.refreshMaxAge),\n    });\n  } else {\n    cookies.push(buildClearCookie(config, COOKIE_REFRESH_TOKEN));\n  }\n\n  return cookies;\n}\n\nexport function buildStateCookie(config: ResolvedConfig, state: string): CookieMutation {\n  return {\n    name: COOKIE_OAUTH_STATE,\n    value: state,\n    options: buildCookieOptions(config, config.cookieOptions.stateMaxAge),\n  };\n}\n\nexport function buildClearCookie(config: ResolvedConfig, name: string): CookieMutation {\n  return {\n    name,\n    value: '',\n    options: withPartitioned(config, {\n      httpOnly: true,\n      sameSite: config.cookieOptions.sameSite,\n      secure: config.cookieOptions.secure,\n      path: config.cookieOptions.path,\n      maxAge: 0,\n    }),\n  };\n}\n\nexport function buildLogoutCookies(config: ResolvedConfig): CookieMutation[] {\n  return [COOKIE_SESSION, COOKIE_REFRESH_TOKEN, COOKIE_OAUTH_STATE].map((name) =>\n    buildClearCookie(config, name),\n  );\n}\n\nexport { COOKIE_OAUTH_STATE, COOKIE_REFRESH_TOKEN, COOKIE_SESSION };\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport { getUserFromFeJwt } from '../session/jwt.js';\nimport type { AuthUser, ResolvedConfig } from '../types.js';\n\nexport async function assertConfiguredApplicationAssignment(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  fejwt: string,\n  user?: AuthUser | null,\n): Promise<void> {\n  if (config.applicationId == null) return;\n\n  const fromJwt = getUserFromFeJwt(fejwt);\n  let resolvedUser = user ?? fromJwt;\n  if (\n    resolvedUser?.id &&\n    !resolvedUser.companyId &&\n    fromJwt?.companyId &&\n    fromJwt.id === resolvedUser.id\n  ) {\n    resolvedUser = { ...resolvedUser, companyId: fromJwt.companyId };\n  }\n  if (!resolvedUser?.id) {\n    throw new AuthError('unauthorized', 'Unable to resolve user for application assignment');\n  }\n  if (!resolvedUser.companyId) {\n    throw new AuthError('unauthorized', 'Missing company from session');\n  }\n\n  await client.assertUserAssignedToApplication({\n    fejwt,\n    companyUuid: resolvedUser.companyId,\n    userUuid: resolvedUser.id,\n    applicationId: config.applicationId,\n  });\n}\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport {\n  buildSessionCookies,\n  COOKIE_OAUTH_STATE,\n} from '../session/cookies.js';\nimport type { CallbackResult, CookieStore, ResolvedConfig } from '../types.js';\nimport { assertConfiguredApplicationAssignment } from './entitlement.js';\n\nexport async function handleCallback(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  input: {\n    code?: string;\n    error?: string;\n    state?: string;\n    cookies: CookieStore;\n  },\n): Promise<CallbackResult> {\n  if (input.error || !input.code) {\n    throw new AuthError('no_code', input.error ?? 'Authorization code missing');\n  }\n\n  const storedState = input.cookies.get(COOKIE_OAUTH_STATE);\n  if (!storedState || !input.state || storedState !== input.state) {\n    throw new AuthError('invalid_state', 'OAuth state mismatch');\n  }\n\n  const oauthTokens = await client.exchangeAuthorizationCode(input.code);\n  const authTokens = await client.exchangeAuthToken(oauthTokens.access_token);\n  const user = await client.resolveUser(oauthTokens.access_token, oauthTokens.id_token);\n\n  await assertConfiguredApplicationAssignment(config, client, authTokens.accessToken, user);\n\n  const refreshToken = authTokens.refreshToken ?? null;\n\n  return {\n    fejwt: authTokens.accessToken,\n    refreshToken,\n    user,\n    cookiesToSet: buildSessionCookies(config, authTokens.accessToken, refreshToken),\n    cookiesToClear: [COOKIE_OAUTH_STATE],\n  };\n}\n","import { decodeJwtPayloadUnsafe, isJwtExpired } from './session/jwt.js';\n\nexport type AuthBffDebugScope = 'refresh' | 'jwt';\n\nfunction isDebugEnabled(): boolean {\n  const value = process.env.AUTH_BFF_DEBUG;\n  if (!value) return false;\n  const normalized = value.trim().toLowerCase();\n  return normalized === 'true' || normalized === '1' || normalized === 'yes';\n}\n\nexport function authBffDebug(\n  scope: AuthBffDebugScope,\n  message: string,\n  data?: Record<string, unknown>,\n): void {\n  if (!isDebugEnabled()) return;\n\n  const prefix = `[auth-bff:${scope}]`;\n  if (data) {\n    console.log(prefix, message, data);\n  } else {\n    console.log(prefix, message);\n  }\n}\n\nexport function sessionTokenMeta(\n  token: string | null | undefined,\n  bufferSec: number,\n): {\n  present: boolean;\n  length: number;\n  sub?: string;\n  exp?: number;\n  expired?: boolean;\n} {\n  if (!token) {\n    return { present: false, length: 0 };\n  }\n\n  const payload = decodeJwtPayloadUnsafe(token);\n  const expired = isJwtExpired(token, bufferSec);\n\n  return {\n    present: true,\n    length: token.length,\n    ...(typeof payload?.sub === 'string' ? { sub: payload.sub } : {}),\n    ...(typeof payload?.exp === 'number' ? { exp: payload.exp } : {}),\n    expired,\n  };\n}\n\nexport function refreshTokenMeta(token: string | null | undefined): {\n  present: boolean;\n  length: number;\n} {\n  if (!token) {\n    return { present: false, length: 0 };\n  }\n\n  return { present: true, length: token.length };\n}\n","import type { AppDirectClient } from '../client.js';\nimport { authBffDebug, refreshTokenMeta } from '../debug.js';\nimport { AuthError } from '../errors.js';\nimport { buildSessionCookies } from '../session/cookies.js';\nimport type { RefreshCoordinator } from '../session/refresh-coordinator.js';\nimport type { RefreshResult, ResolvedConfig } from '../types.js';\nimport { assertConfiguredApplicationAssignment } from './entitlement.js';\n\nasync function performRefresh(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  refreshToken: string,\n): Promise<RefreshResult> {\n  authBffDebug('refresh', 'executing refresh');\n\n  try {\n    const authTokens = await client.refreshAuthToken(refreshToken);\n    const newRefreshToken = authTokens.refreshToken ?? refreshToken;\n\n    authBffDebug('refresh', 'auth refresh succeeded', {\n      returnedNewRefreshToken: authTokens.refreshToken != null,\n    });\n\n    if (config.applicationId == null) {\n      authBffDebug('refresh', 'entitlement check skipped', { applicationId: null });\n    } else {\n      authBffDebug('refresh', 'running entitlement check', {\n        applicationId: config.applicationId,\n      });\n      await assertConfiguredApplicationAssignment(config, client, authTokens.accessToken);\n      authBffDebug('refresh', 'entitlement check passed', {\n        applicationId: config.applicationId,\n      });\n    }\n\n    const cookiesToSet = buildSessionCookies(config, authTokens.accessToken, newRefreshToken);\n\n    authBffDebug('refresh', 'refresh succeeded', {\n      cookieCount: cookiesToSet.length,\n      cookieNames: cookiesToSet.map((cookie) => cookie.name),\n      fejwtLength: authTokens.accessToken.length,\n    });\n\n    return {\n      fejwt: authTokens.accessToken,\n      refreshToken: newRefreshToken,\n      cookiesToSet,\n    };\n  } catch (err) {\n    if (err instanceof AuthError) {\n      authBffDebug('refresh', 'refresh failed', {\n        code: err.code,\n        statusCode: err.statusCode,\n        details: err.details,\n      });\n    } else {\n      authBffDebug('refresh', 'refresh failed with unexpected error', {\n        name: err instanceof Error ? err.name : 'unknown',\n      });\n    }\n    throw err;\n  }\n}\n\nexport async function refreshSession(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: { refreshToken: string },\n): Promise<RefreshResult> {\n  authBffDebug('refresh', 'refresh requested', {\n    refreshToken: refreshTokenMeta(input.refreshToken),\n  });\n\n  return coordinator.refreshOnce(input.refreshToken, () =>\n    performRefresh(config, client, input.refreshToken),\n  );\n}\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport { refreshSession } from '../flows/refresh.js';\nimport { isJwtExpired } from './jwt.js';\nimport type { RefreshCoordinator } from './refresh-coordinator.js';\nimport type { JwtResult, ResolvedConfig } from '../types.js';\n\nasync function coordinatedRefresh(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  refreshToken: string,\n): Promise<JwtResult> {\n  try {\n    const refreshed = await refreshSession(config, client, coordinator, { refreshToken });\n\n    return {\n      token: refreshed.fejwt,\n      cookiesToSet: refreshed.cookiesToSet,\n    };\n  } catch (err) {\n    if (err instanceof AuthError && (err.code === 'fejwt' || err.code === 'refresh_failed')) {\n      throw new AuthError('session_expired', 'Session expired');\n    }\n    throw err;\n  }\n}\n\nexport async function ensureValidFeJwt(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: { sessionToken: string | null; refreshToken: string | null },\n): Promise<JwtResult> {\n  const sessionToken = input.sessionToken ?? null;\n  const refreshToken = input.refreshToken ?? null;\n\n  if (!sessionToken) {\n    if (!refreshToken) {\n      throw new AuthError('not_authenticated', 'Not authenticated');\n    }\n    return coordinatedRefresh(config, client, coordinator, refreshToken);\n  }\n\n  if (!isJwtExpired(sessionToken, config.expiryBufferSec)) {\n    return { token: sessionToken };\n  }\n\n  if (!refreshToken) {\n    throw new AuthError('session_expired', 'Session expired');\n  }\n\n  return coordinatedRefresh(config, client, coordinator, refreshToken);\n}\n","import type { AppDirectClient } from '../client.js';\nimport { AuthError } from '../errors.js';\nimport { ensureValidFeJwt } from '../session/ensure-fejwt.js';\nimport { getUserFromFeJwt } from '../session/jwt.js';\nimport type { RefreshCoordinator } from '../session/refresh-coordinator.js';\nimport type { MeResult, ResolvedConfig } from '../types.js';\n\nexport function getUserFromSession(input: {\n  sessionToken: string | null | undefined;\n}): MeResult {\n  const token = input.sessionToken ?? null;\n  const user = getUserFromFeJwt(token);\n\n  return {\n    user,\n    hasSession: !!token,\n  };\n}\n\nexport async function getMe(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: {\n    sessionToken: string | null | undefined;\n    refreshToken?: string | null;\n  },\n): Promise<MeResult> {\n  const sessionToken = input.sessionToken ?? null;\n  const refreshToken = input.refreshToken ?? null;\n\n  if (!sessionToken && !refreshToken) {\n    return { user: null, hasSession: false };\n  }\n\n  try {\n    const jwtResult = await ensureValidFeJwt(config, client, coordinator, {\n      sessionToken,\n      refreshToken,\n    });\n    const user = getUserFromFeJwt(jwtResult.token);\n\n    return {\n      user,\n      hasSession: true,\n      cookiesToSet: jwtResult.cookiesToSet,\n    };\n  } catch (err) {\n    if (err instanceof AuthError) {\n      return { user: null, hasSession: false };\n    }\n    throw err;\n  }\n}\n","import type { AppDirectClient } from '../client.js';\nimport { authBffDebug, refreshTokenMeta, sessionTokenMeta } from '../debug.js';\nimport { AuthError } from '../errors.js';\nimport { ensureValidFeJwt } from '../session/ensure-fejwt.js';\nimport { isJwtExpired } from '../session/jwt.js';\nimport type { RefreshCoordinator } from '../session/refresh-coordinator.js';\nimport type { JwtResult, ResolvedConfig } from '../types.js';\n\ntype JwtDecisionPath =\n  | 'use_existing_session'\n  | 'refresh_no_session'\n  | 'refresh_expired_session'\n  | 'will_fail_not_authenticated'\n  | 'will_fail_session_expired';\n\nfunction resolveJwtDecisionPath(input: {\n  sessionToken: string | null;\n  refreshToken: string | null;\n  expiryBufferSec: number;\n}): JwtDecisionPath {\n  const { sessionToken, refreshToken, expiryBufferSec } = input;\n\n  if (!sessionToken) {\n    if (!refreshToken) {\n      return 'will_fail_not_authenticated';\n    }\n    return 'refresh_no_session';\n  }\n\n  if (!isJwtExpired(sessionToken, expiryBufferSec)) {\n    return 'use_existing_session';\n  }\n\n  if (!refreshToken) {\n    return 'will_fail_session_expired';\n  }\n\n  return 'refresh_expired_session';\n}\n\nexport async function getFeJwt(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  coordinator: RefreshCoordinator,\n  input: {\n    sessionToken: string | null | undefined;\n    refreshToken?: string | null;\n  },\n): Promise<JwtResult> {\n  const sessionToken = input.sessionToken ?? null;\n  const refreshToken = input.refreshToken ?? null;\n\n  authBffDebug('jwt', 'jwt requested', {\n    hasSession: sessionToken != null,\n    hasRefresh: refreshToken != null,\n    session: sessionTokenMeta(sessionToken, config.expiryBufferSec),\n    refreshToken: refreshTokenMeta(refreshToken),\n    expiryBufferSec: config.expiryBufferSec,\n  });\n\n  const path = resolveJwtDecisionPath({\n    sessionToken,\n    refreshToken,\n    expiryBufferSec: config.expiryBufferSec,\n  });\n\n  authBffDebug('jwt', 'jwt decision', { path });\n\n  try {\n    const result = await ensureValidFeJwt(config, client, coordinator, {\n      sessionToken,\n      refreshToken,\n    });\n\n    authBffDebug('jwt', 'jwt succeeded', {\n      path,\n      tokenLength: result.token.length,\n      cookieCount: result.cookiesToSet?.length ?? 0,\n    });\n\n    return result;\n  } catch (err) {\n    if (err instanceof AuthError) {\n      authBffDebug('jwt', 'jwt failed', {\n        path,\n        code: err.code,\n        statusCode: err.statusCode,\n        details: err.details,\n      });\n    } else {\n      authBffDebug('jwt', 'jwt failed with unexpected error', {\n        path,\n        name: err instanceof Error ? err.name : 'unknown',\n      });\n    }\n    throw err;\n  }\n}\n","import {\n  buildLogoutCookies,\n  COOKIE_OAUTH_STATE,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_SESSION,\n} from '../session/cookies.js';\nimport type { LogoutResult, ResolvedConfig } from '../types.js';\n\nexport function buildLogout(_config: ResolvedConfig): LogoutResult {\n  return {\n    cookiesToClear: [COOKIE_SESSION, COOKIE_REFRESH_TOKEN, COOKIE_OAUTH_STATE],\n  };\n}\n\nexport { buildLogoutCookies };\n","import type { AppDirectClient } from '../client.js';\nimport { authBffDebug } from '../debug.js';\nimport { buildSessionCookies } from '../session/cookies.js';\nimport type { ImportSessionResult, ResolvedConfig } from '../types.js';\nimport { assertConfiguredApplicationAssignment } from './entitlement.js';\n\nexport async function importSession(\n  config: ResolvedConfig,\n  client: AppDirectClient,\n  input: { sessionToken: string; refreshToken: string },\n): Promise<ImportSessionResult> {\n  if (config.applicationId == null) {\n    authBffDebug('import-session', 'entitlement check skipped', { applicationId: null });\n  } else {\n    authBffDebug('import-session', 'running entitlement check', {\n      applicationId: config.applicationId,\n    });\n    await assertConfiguredApplicationAssignment(config, client, input.sessionToken);\n    authBffDebug('import-session', 'entitlement check passed', {\n      applicationId: config.applicationId,\n    });\n  }\n\n  return {\n    cookiesToSet: buildSessionCookies(config, input.sessionToken, input.refreshToken),\n  };\n}\n","import type { RefreshResult } from '../types.js';\n\nexport class RefreshCoordinator {\n  private readonly inflight = new Map<string, Promise<RefreshResult>>();\n\n  async refreshOnce(\n    key: string,\n    refresh: () => Promise<RefreshResult>,\n  ): Promise<RefreshResult> {\n    const existing = this.inflight.get(key);\n    if (existing) return existing;\n\n    const promise = refresh().finally(() => {\n      this.inflight.delete(key);\n    });\n\n    this.inflight.set(key, promise);\n    return promise;\n  }\n}\n\nexport function createRefreshCoordinator(): RefreshCoordinator {\n  return new RefreshCoordinator();\n}\n","import { AppDirectClient, type FetchFn } from './client.js';\nimport { resolveConfig, validateConfig } from './config.js';\nimport { buildLoginRedirect } from './flows/login.js';\nimport { handleCallback } from './flows/callback.js';\nimport { refreshSession } from './flows/refresh.js';\nimport { getMe, getUserFromSession } from './flows/me.js';\nimport { getFeJwt } from './flows/jwt.js';\nimport { buildLogout } from './flows/logout.js';\nimport { importSession } from './flows/import-session.js';\nimport { ensureValidFeJwt } from './session/ensure-fejwt.js';\nimport { createRefreshCoordinator } from './session/refresh-coordinator.js';\nimport type { AppDirectAuth, AppDirectAuthConfig } from './types.js';\n\nexport function createAppDirectAuth(\n  configInput: AppDirectAuthConfig,\n  options?: { fetch?: FetchFn },\n): AppDirectAuth {\n  const config = resolveConfig(configInput);\n  validateConfig(config);\n  const client = new AppDirectClient(config, options?.fetch ?? fetch);\n  const coordinator = createRefreshCoordinator();\n\n  const sessionInput = (input: {\n    sessionToken: string | null | undefined;\n    refreshToken?: string | null;\n  }) => ({\n    sessionToken: input.sessionToken ?? null,\n    refreshToken: input.refreshToken ?? null,\n  });\n\n  return {\n    config,\n    buildLoginRedirect: () => buildLoginRedirect(config, client),\n    handleCallback: (input) => handleCallback(config, client, input),\n    refreshSession: (input) => refreshSession(config, client, coordinator, input),\n    getMe: (input) => getMe(config, client, coordinator, input),\n    getUserFromSession: (input) => getUserFromSession(input),\n    ensureValidFeJwt: (input) =>\n      ensureValidFeJwt(config, client, coordinator, sessionInput(input)),\n    getFeJwt: (input) => getFeJwt(config, client, coordinator, input),\n    importSession: (input) => importSession(config, client, input),\n    buildLogout: () => buildLogout(config),\n  };\n}\n\nexport { AppDirectClient } from './client.js';\nexport { resolveConfig, validateConfig } from './config.js';\nexport { AuthError } from './errors.js';\nexport { ensureValidFeJwt } from './session/ensure-fejwt.js';\nexport { RefreshCoordinator, createRefreshCoordinator } from './session/refresh-coordinator.js';\nexport type {\n  AppDirectAuth,\n  AppDirectAuthConfig,\n  AuthUser,\n  CallbackResult,\n  CookieMutation,\n  CookieStore,\n  JwtResult,\n  LoginRedirectResult,\n  LogoutResult,\n  MeResult,\n  RefreshResult,\n  ResolvedConfig,\n  RoutePaths,\n} from './types.js';\nexport {\n  COOKIE_OAUTH_STATE,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_SESSION,\n} from './constants.js';\n","import { buildClearCookie, buildLogoutCookies } from '../session/cookies.js';\nimport type { CookieMutation, CookieStore, ResolvedConfig } from '../types.js';\nimport { COOKIE_OAUTH_STATE, COOKIE_REFRESH_TOKEN, COOKIE_SESSION } from '../constants.js';\n\nexport interface CookieHeaderWriter {\n  setHeader(name: string, value: string | string[]): void;\n  appendHeader?(name: string, value: string): void;\n}\n\nexport function cookieStoreFromHeader(cookieHeader: string | null | undefined): CookieStore {\n  const parsed = parseCookieHeader(cookieHeader);\n  return {\n    get(name: string) {\n      return parsed[name];\n    },\n  };\n}\n\nexport function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string> {\n  if (!cookieHeader) return {};\n  const result: Record<string, string> = {};\n  for (const part of cookieHeader.split(';')) {\n    const [rawName, ...rest] = part.trim().split('=');\n    if (!rawName) continue;\n    result[rawName] = decodeURIComponent(rest.join('='));\n  }\n  return result;\n}\n\nexport function formatSetCookieHeader(mutation: CookieMutation): string {\n  const { name, value, options } = mutation;\n  const parts = [\n    `${name}=${value}`,\n    `Path=${options.path}`,\n    'HttpOnly',\n    `SameSite=${capitalizeSameSite(options.sameSite)}`,\n    `Max-Age=${options.maxAge}`,\n  ];\n  if (options.secure || options.partitioned) parts.push('Secure');\n  if (options.partitioned) parts.push('Partitioned');\n  return parts.join('; ');\n}\n\nfunction capitalizeSameSite(value: 'lax' | 'strict' | 'none'): string {\n  if (value === 'lax') return 'Lax';\n  if (value === 'strict') return 'Strict';\n  return 'None';\n}\n\nexport function clearCookieMutations(config: ResolvedConfig, names: string[]): CookieMutation[] {\n  return names.map((name) => buildClearCookie(config, name));\n}\n\nexport function applyCookieMutations(\n  writer: CookieHeaderWriter,\n  mutations: CookieMutation[],\n): void {\n  if (mutations.length === 0) return;\n\n  const formatted = mutations.map((mutation) => formatSetCookieHeader(mutation));\n  if (writer.appendHeader) {\n    for (const value of formatted) {\n      writer.appendHeader('Set-Cookie', value);\n    }\n    return;\n  }\n\n  writer.setHeader('Set-Cookie', formatted);\n}\n\nexport function clearCookiesOnResponse(\n  config: ResolvedConfig,\n  writer: CookieHeaderWriter,\n  names?: string[],\n): void {\n  const mutations = names\n    ? clearCookieMutations(config, names)\n    : buildLogoutCookies(config);\n  applyCookieMutations(writer, mutations);\n}\n\nexport function readAuthCookies(cookieHeader: string | null | undefined) {\n  const store = cookieStoreFromHeader(cookieHeader);\n  return {\n    session: store.get(COOKIE_SESSION) ?? null,\n    refreshToken: store.get(COOKIE_REFRESH_TOKEN) ?? null,\n    oauthState: store.get(COOKIE_OAUTH_STATE) ?? null,\n    store,\n  };\n}\n\nexport { COOKIE_OAUTH_STATE, COOKIE_REFRESH_TOKEN, COOKIE_SESSION };\n","import type { ResolvedConfig } from '../types.js';\n\nexport function resolveAppUrl(config: ResolvedConfig, path: string): string {\n  if (path.startsWith('http://') || path.startsWith('https://')) {\n    return path;\n  }\n  const normalized = path.startsWith('/') ? path : `/${path}`;\n  return `${config.appBaseUrl}${normalized}`;\n}\n\nexport function appHomeUrl(config: ResolvedConfig): string {\n  return `${config.appBaseUrl}/`;\n}\n\nexport function errorRedirectUrl(config: ResolvedConfig, code: string): string {\n  return resolveAppUrl(config, `${config.onErrorRedirect}${code}`);\n}\n","export type SameSiteRequestHeaders = Record<string, string | string[] | undefined>;\n\nfunction readHeader(headers: SameSiteRequestHeaders, name: string): string | null {\n  const value = headers[name];\n  if (Array.isArray(value)) return value[0] ?? null;\n  return typeof value === 'string' ? value : null;\n}\n\nexport function getRequestOrigin(headers: SameSiteRequestHeaders): string | null {\n  const host = readHeader(headers, 'host');\n  if (!host) return null;\n  const proto = readHeader(headers, 'x-forwarded-proto') ?? 'http';\n  return `${proto}://${host}`;\n}\n\nexport function assertSameSiteRequest(\n  headers: SameSiteRequestHeaders,\n  appBaseUrl?: string,\n): boolean {\n  const fetchSite = readHeader(headers, 'sec-fetch-site');\n  if (fetchSite !== null) {\n    return fetchSite === 'same-origin' || fetchSite === 'none';\n  }\n  const origin = readHeader(headers, 'origin');\n  if (origin === null) return false;\n\n  const expected = getRequestOrigin(headers);\n  if (expected !== null && origin === expected) return true;\n\n  if (appBaseUrl) {\n    try {\n      const configured = new URL(appBaseUrl);\n      const host = readHeader(headers, 'host');\n      if (host === configured.host && origin === configured.origin) {\n        return true;\n      }\n    } catch {\n      return false;\n    }\n  }\n\n  return false;\n}\n\nexport function parseRequestBody(body: unknown): unknown {\n  if (body == null) return body;\n  if (typeof body === 'string') {\n    if (!body.trim()) return null;\n    try {\n      return JSON.parse(body);\n    } catch {\n      return null;\n    }\n  }\n  if (typeof Buffer !== 'undefined' && Buffer.isBuffer(body)) {\n    try {\n      return JSON.parse(body.toString('utf8'));\n    } catch {\n      return null;\n    }\n  }\n  return body;\n}\n\nexport function assertSameSiteFetchRequest(req: Request, appBaseUrl?: string): boolean {\n  const fetchSite = req.headers.get('sec-fetch-site');\n  if (fetchSite !== null) {\n    return fetchSite === 'same-origin' || fetchSite === 'none';\n  }\n  const origin = req.headers.get('origin');\n  if (origin === null) return false;\n  const host = req.headers.get('host');\n  if (!host) return false;\n  const proto = req.headers.get('x-forwarded-proto') ?? new URL(req.url).protocol.replace(':', '');\n  if (origin === `${proto}://${host}`) return true;\n\n  if (appBaseUrl) {\n    try {\n      const configured = new URL(appBaseUrl);\n      if (host === configured.host && origin === configured.origin) {\n        return true;\n      }\n    } catch {\n      return false;\n    }\n  }\n\n  return false;\n}\n\nfunction isValidJwtShape(token: string): boolean {\n  const parts = token.split('.');\n  if (parts.length < 2) return false;\n  try {\n    const payload = JSON.parse(\n      Buffer.from(parts[1].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'),\n    ) as { exp?: unknown };\n    return typeof payload.exp === 'number' && payload.exp > 0;\n  } catch {\n    return false;\n  }\n}\n\nexport function readBodySessionTokens(\n  body: unknown,\n): { sessionToken: string; refreshToken: string } | null {\n  if (!body || typeof body !== 'object') return null;\n  const sessionToken = (body as { sessionToken?: unknown }).sessionToken;\n  const refreshToken = (body as { refreshToken?: unknown }).refreshToken;\n  if (typeof sessionToken !== 'string' || !sessionToken.trim()) return null;\n  if (typeof refreshToken !== 'string' || !refreshToken.trim()) return null;\n  if (!isValidJwtShape(sessionToken)) return null;\n  return { sessionToken: sessionToken.trim(), refreshToken: refreshToken.trim() };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACaO,IAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqB,SAAkB,SAAsD;AACvG,UAAM,WAAW,IAAI;AACrB,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS,cAAc,WAAU,cAAc,IAAI;AACrE,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA,EAEA,OAAe,cAAc,MAA6B;AACxD,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACF;;;AC7BA,SAAS,YACP,SACA,KACe;AACf,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,QAAQ,GAAG;AACzB,SAAO,OAAO,UAAU,YAAY,QAAQ,QAAQ;AACtD;AAEO,SAAS,2BACd,SACe;AACf,SACE,YAAY,SAAS,wBAAwB,KAC7C,YAAY,SAAS,aAAa,KAClC,YAAY,SAAS,YAAY;AAErC;AAEO,SAAS,uBAAuB,OAAqD;AAC1F,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,UAAU,OAAO,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GAAG,QAAQ,EAAE;AAAA,MACnF;AAAA,IACF;AACA,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAe,WAA4B;AACtE,QAAM,UAAU,uBAAuB,KAAK;AAC5C,MAAI,CAAC,WAAW,OAAO,QAAQ,QAAQ,SAAU,QAAO;AACxD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,QAAQ,MAAM,MAAM;AAC7B;AAEO,SAAS,gBAAgB,SAA6C;AAC3E,MAAI,CAAC,SAAS,IAAK,QAAO;AAE1B,QAAM,OACJ,QAAQ,SACP,CAAC,QAAQ,YAAY,QAAQ,WAAW,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,KAAK;AAE1E,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ,SAAS;AAAA,IACxB;AAAA,IACA,SAAS,QAAQ,WAAW;AAAA,IAC5B,WAAW,2BAA2B,OAAO;AAAA,EAC/C;AACF;AAEO,SAAS,iBAAiB,OAAmD;AAClF,SAAO,gBAAgB,uBAAuB,KAAK,CAAC;AACtD;;;AC7DA,SAAS,gBAAgB,UAAkB,cAA8B;AACvE,SAAO,SAAS,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,IAAI,MAAM,EAAE,SAAS,QAAQ,CAAC;AACvF;AAEO,SAAS,WAAW,MAA6B;AACtD,QAAM,QAAQ,KAAK,SAAS,KAAK,UAAU,KAAK,SAAS,KAAK,OAAO,KAAK;AAC1E,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,UAAU,SAAS,2BAA2B;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,MAAsD;AACpF,QAAM,cAAc,WAAW,IAAI;AACnC,QAAM,eACJ,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAChE,SAAO,EAAE,aAAa,aAAa;AACrC;AAEA,eAAe,iBACb,SACA,KACA,aAC0B;AAC1B,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,IACA,MAAM,KAAK,UAAU,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAMA,QAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,UAAU,SAAS,6BAA6B;AAAA,MACxD,SAAS,EAAE,QAAQ,IAAI,QAAQ,MAAAA,MAAK;AAAA,IACtC,CAAC;AAAA,EACH;AAEA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,uBAAuB,IAAI;AACpC;AAEO,SAAS,YAAY,UAAsC;AAChE,QAAM,OACJ,CAAC,SAAS,YAAY,SAAS,WAAW,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,KACpE,SAAS,QACT;AAEF,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS,SAAS;AAAA,IACzB;AAAA,IACA,SAAS,SAAS,WAAW;AAAA,IAC7B,WAAW,SAAS,0BAA0B;AAAA,EAChD;AACF;AAEO,SAAS,iBAAiB,SAAmD;AAClF,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAK,QAAO;AAE5C,QAAM,YAAY,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAChF,QAAM,aAAa,OAAO,QAAQ,gBAAgB,WAAW,QAAQ,cAAc;AACnF,QAAM,YAAY,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AACpE,QAAM,OAAO,cAAc,CAAC,WAAW,UAAU,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,KAAK;AAEhF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAC3D;AAAA,IACA,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,IACjE,WAAW,2BAA2B,OAAO;AAAA,EAC/C;AACF;AAEO,SAAS,cAAc,SAAiD;AAC7E,MAAI;AACF,UAAM,UAAU,QAAQ,MAAM,GAAG,EAAE,CAAC;AACpC,QAAI,CAAC,QAAS,QAAO;AACrB,WAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YACmB,QACA,UAAmB,OACpC;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,kBAAkB,OAAuB;AACvC,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,OAAO,KAAK,OAAO,OAAO,KAAK,GAAG;AAAA,MAClC;AAAA,IACF,CAAC;AACD,WAAO,GAAG,KAAK,OAAO,UAAU,YAAY,IAAI,MAAM;AAAA,EACxD;AAAA,EAEA,MAAM,0BAA0B,MAAsC;AACpE,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO,UAAU,UAAU;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,gBAAgB,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY;AAAA,MAC/E;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,IAAI,UAAU,kBAAkB,sCAAsC;AAAA,QAC1E,SAAS,EAAE,QAAQ,IAAI,QAAQ,KAAK;AAAA,MACtC,CAAC;AAAA,IACH;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,mBAAmB,cAA8C;AACrE,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO,UAAU,UAAU;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,gBAAgB,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY;AAAA,MAC/E;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,IAAI,UAAU,kBAAkB,iCAAiC;AAAA,QACrE,SAAS,EAAE,QAAQ,IAAI,QAAQ,KAAK;AAAA,MACtC,CAAC;AAAA,IACH;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,kBAAkB,kBAAoD;AAC1E,WAAO;AAAA,MACL,KAAK;AAAA,MACL,KAAK,OAAO,UAAU;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,kBAAoD;AACzE,WAAO;AAAA,MACL,KAAK;AAAA,MACL,KAAK,OAAO,UAAU;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,aAA+C;AACjE,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO,UAAU,aAAa;AAAA,MAChE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EAEA,MAAM,YAAY,aAAqB,SAAqC;AAC1E,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW;AAEzD,QAAI,cAA+B;AACnC,QAAI,SAAS;AACX,YAAM,SAAS,cAAc,OAAO;AACpC,UAAI,QAAQ;AACV,sBAAc,iBAAiB,MAAM;AAAA,MACvC;AAAA,IACF;AAEA,QAAI,cAAc,IAAI;AACpB,UACE,CAAC,aAAa,aACd,aAAa,aACb,YAAY,OAAO,aAAa,IAChC;AACA,eAAO,EAAE,GAAG,cAAc,WAAW,YAAY,UAAU;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAEA,QAAI,aAAa,GAAI,QAAO;AAE5B,UAAM,IAAI,UAAU,YAAY,iCAAiC;AAAA,EACnE;AAAA,EAEA,MAAM,gCAAgC,OAKpB;AAChB,UAAM,MAAM,IAAI;AAAA,MACd,GAAG,KAAK,OAAO,aAAa,6BAA6B,mBAAmB,MAAM,WAAW,CAAC,gBAAgB,mBAAmB,MAAM,QAAQ,CAAC;AAAA,IAClJ;AACA,QAAI,aAAa,IAAI,iBAAiB,OAAO,MAAM,aAAa,CAAC;AAEjE,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,SAAS,GAAG;AAAA,MAC7C,SAAS;AAAA,QACP,eAAe,UAAU,MAAM,KAAK;AAAA,QACpC,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,KAAK,EAAE,MAAM,MAAM,MAAS;AACtC,YAAM,IAAI,UAAU,gBAAgB,4CAA4C;AAAA,QAC9E,SAAS,EAAE,QAAQ,IAAI,OAAO;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC7D,YAAM,IAAI,UAAU,gBAAgB,0CAA0C;AAAA,IAChF;AAAA,EACF;AACF;;;ACxPO,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAE3B,IAAM,wBAAwB;AAC9B,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,0BAA0B,KAAK,KAAK,KAAK;AAC/C,IAAM,0BAA0B,KAAK,KAAK,KAAK;AAC/C,IAAM,wBAAwB,KAAK;AACnC,IAAM,4BAA4B;AAElC,IAAM,iBAAiB;AAAA,EAC5B,OAAO;AAAA,EACP,UAAU;AAAA,EACV,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV;AAEO,IAAM,yBAAyB;;;ACdtC,SAAS,iBAAiB,KAAqB;AAC7C,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,YAAY,GAAI,QAAO;AAC3B,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AACrC,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO;AACT;AAEO,SAAS,cAAc,OAA4C;AACxE,QAAM,gBAAgB,iBAAiB,MAAM,aAAa;AAC1D,QAAM,aAAa,iBAAiB,MAAM,UAAU;AACpD,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,cAAc,MAAM,eAAe,eAAe;AACxD,MAAI,SACF,MAAM,iBACN,MAAM,eAAe,UACrB,QAAQ,IAAI,aAAa;AAC3B,MAAI,WAAW,MAAM,eAAe,YAAY;AAEhD,MAAI,aAAa;AACf,aAAS;AACT,QAAI,MAAM,eAAe,aAAa,QAAW;AAC/C,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,QAAM,gBAAyC;AAAA,IAC7C,eAAe,MAAM,eAAe,iBAAiB;AAAA,IACrD,eAAe,MAAM,eAAe,iBAAiB;AAAA,IACrD,aAAa,MAAM,eAAe,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,IACA,MAAM,MAAM,eAAe,QAAQ;AAAA,IACnC;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,cAAc,MAAM;AAAA,IACpB;AAAA,IACA,eAAe,mBAAmB,MAAM,aAAa;AAAA,IACrD;AAAA,IACA,aAAa,GAAG,UAAU,GAAG,YAAY;AAAA,IACzC,QAAQ,MAAM,UAAU,CAAC,GAAG,cAAc;AAAA,IAC1C;AAAA,IACA,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,QAAQ;AAAA,MACN,OAAO,MAAM,QAAQ,SAAS,eAAe;AAAA,MAC7C,UAAU,MAAM,QAAQ,YAAY,eAAe;AAAA,MACnD,IAAI,MAAM,QAAQ,MAAM,eAAe;AAAA,MACvC,KAAK,MAAM,QAAQ,OAAO,eAAe;AAAA,MACzC,SAAS,MAAM,QAAQ,WAAW,eAAe;AAAA,MACjD,QAAQ,MAAM,QAAQ,UAAU,eAAe;AAAA,IACjD;AAAA,IACA,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW;AAAA,MACT,cAAc,GAAG,aAAa;AAAA,MAC9B,UAAU,GAAG,aAAa;AAAA,MAC1B,aAAa,GAAG,aAAa;AAAA,MAC7B,cAAc,GAAG,aAAa;AAAA,MAC9B,gBAAgB,GAAG,aAAa;AAAA,IAClC;AAAA,EACF;AACF;AAEO,SAAS,eAAe,QAA8B;AAC3D,MAAI,CAAC,OAAO,iBAAiB,CAAC,OAAO,YAAY,CAAC,OAAO,gBAAgB,CAAC,OAAO,YAAY;AAC3F,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,OAAO,cAAc,eAAe,OAAO,cAAc,aAAa,QAAQ;AAChF,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACF;;;AC9FA,yBAA4B;;;ACO5B,SAAS,gBACP,QACA,SACuB;AACvB,MAAI,CAAC,OAAO,cAAc,YAAa,QAAO;AAC9C,SAAO,EAAE,GAAG,SAAS,aAAa,KAAK;AACzC;AAEO,SAAS,mBACd,QACA,QACuB;AACvB,SAAO,gBAAgB,QAAQ;AAAA,IAC7B,UAAU;AAAA,IACV,UAAU,OAAO,cAAc;AAAA,IAC/B,QAAQ,OAAO,cAAc;AAAA,IAC7B,MAAM,OAAO,cAAc;AAAA,IAC3B;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBACd,QACA,cACA,cACkB;AAClB,QAAM,UAA4B;AAAA,IAChC;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,mBAAmB,QAAQ,OAAO,cAAc,aAAa;AAAA,IACxE;AAAA,EACF;AAEA,MAAI,cAAc;AAChB,YAAQ,KAAK;AAAA,MACX,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,mBAAmB,QAAQ,OAAO,cAAc,aAAa;AAAA,IACxE,CAAC;AAAA,EACH,OAAO;AACL,YAAQ,KAAK,iBAAiB,QAAQ,oBAAoB,CAAC;AAAA,EAC7D;AAEA,SAAO;AACT;AAEO,SAAS,iBAAiB,QAAwB,OAA+B;AACtF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS,mBAAmB,QAAQ,OAAO,cAAc,WAAW;AAAA,EACtE;AACF;AAEO,SAAS,iBAAiB,QAAwB,MAA8B;AACrF,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP,SAAS,gBAAgB,QAAQ;AAAA,MAC/B,UAAU;AAAA,MACV,UAAU,OAAO,cAAc;AAAA,MAC/B,QAAQ,OAAO,cAAc;AAAA,MAC7B,MAAM,OAAO,cAAc;AAAA,MAC3B,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;;;ADrEO,SAAS,mBACd,QACA,QACqB;AACrB,QAAM,YAAQ,gCAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,QAAM,eAAe,OAAO,kBAAkB,KAAK;AAEnD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,CAAC,iBAAiB,QAAQ,KAAK,CAAC;AAAA,EAChD;AACF;;;AEZA,eAAsB,sCACpB,QACA,QACA,OACA,MACe;AACf,MAAI,OAAO,iBAAiB,KAAM;AAElC,QAAM,UAAU,iBAAiB,KAAK;AACtC,MAAI,eAAe,QAAQ;AAC3B,MACE,cAAc,MACd,CAAC,aAAa,aACd,SAAS,aACT,QAAQ,OAAO,aAAa,IAC5B;AACA,mBAAe,EAAE,GAAG,cAAc,WAAW,QAAQ,UAAU;AAAA,EACjE;AACA,MAAI,CAAC,cAAc,IAAI;AACrB,UAAM,IAAI,UAAU,gBAAgB,mDAAmD;AAAA,EACzF;AACA,MAAI,CAAC,aAAa,WAAW;AAC3B,UAAM,IAAI,UAAU,gBAAgB,8BAA8B;AAAA,EACpE;AAEA,QAAM,OAAO,gCAAgC;AAAA,IAC3C;AAAA,IACA,aAAa,aAAa;AAAA,IAC1B,UAAU,aAAa;AAAA,IACvB,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;;;AC3BA,eAAsB,eACpB,QACA,QACA,OAMyB;AACzB,MAAI,MAAM,SAAS,CAAC,MAAM,MAAM;AAC9B,UAAM,IAAI,UAAU,WAAW,MAAM,SAAS,4BAA4B;AAAA,EAC5E;AAEA,QAAM,cAAc,MAAM,QAAQ,IAAI,kBAAkB;AACxD,MAAI,CAAC,eAAe,CAAC,MAAM,SAAS,gBAAgB,MAAM,OAAO;AAC/D,UAAM,IAAI,UAAU,iBAAiB,sBAAsB;AAAA,EAC7D;AAEA,QAAM,cAAc,MAAM,OAAO,0BAA0B,MAAM,IAAI;AACrE,QAAM,aAAa,MAAM,OAAO,kBAAkB,YAAY,YAAY;AAC1E,QAAM,OAAO,MAAM,OAAO,YAAY,YAAY,cAAc,YAAY,QAAQ;AAEpF,QAAM,sCAAsC,QAAQ,QAAQ,WAAW,aAAa,IAAI;AAExF,QAAM,eAAe,WAAW,gBAAgB;AAEhD,SAAO;AAAA,IACL,OAAO,WAAW;AAAA,IAClB;AAAA,IACA;AAAA,IACA,cAAc,oBAAoB,QAAQ,WAAW,aAAa,YAAY;AAAA,IAC9E,gBAAgB,CAAC,kBAAkB;AAAA,EACrC;AACF;;;ACvCA,SAAS,iBAA0B;AACjC,QAAM,QAAQ,QAAQ,IAAI;AAC1B,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,SAAO,eAAe,UAAU,eAAe,OAAO,eAAe;AACvE;AAEO,SAAS,aACd,OACA,SACA,MACM;AACN,MAAI,CAAC,eAAe,EAAG;AAEvB,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,MAAM;AACR,YAAQ,IAAI,QAAQ,SAAS,IAAI;AAAA,EACnC,OAAO;AACL,YAAQ,IAAI,QAAQ,OAAO;AAAA,EAC7B;AACF;AAEO,SAAS,iBACd,OACA,WAOA;AACA,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,OAAO,QAAQ,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,uBAAuB,KAAK;AAC5C,QAAM,UAAU,aAAa,OAAO,SAAS;AAE7C,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,MAAM;AAAA,IACd,GAAI,OAAO,SAAS,QAAQ,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC/D,GAAI,OAAO,SAAS,QAAQ,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC/D;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,OAG/B;AACA,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,OAAO,QAAQ,EAAE;AAAA,EACrC;AAEA,SAAO,EAAE,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC/C;;;ACrDA,eAAe,eACb,QACA,QACA,cACwB;AACxB,eAAa,WAAW,mBAAmB;AAE3C,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,iBAAiB,YAAY;AAC7D,UAAM,kBAAkB,WAAW,gBAAgB;AAEnD,iBAAa,WAAW,0BAA0B;AAAA,MAChD,yBAAyB,WAAW,gBAAgB;AAAA,IACtD,CAAC;AAED,QAAI,OAAO,iBAAiB,MAAM;AAChC,mBAAa,WAAW,6BAA6B,EAAE,eAAe,KAAK,CAAC;AAAA,IAC9E,OAAO;AACL,mBAAa,WAAW,6BAA6B;AAAA,QACnD,eAAe,OAAO;AAAA,MACxB,CAAC;AACD,YAAM,sCAAsC,QAAQ,QAAQ,WAAW,WAAW;AAClF,mBAAa,WAAW,4BAA4B;AAAA,QAClD,eAAe,OAAO;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,oBAAoB,QAAQ,WAAW,aAAa,eAAe;AAExF,iBAAa,WAAW,qBAAqB;AAAA,MAC3C,aAAa,aAAa;AAAA,MAC1B,aAAa,aAAa,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,MACrD,aAAa,WAAW,YAAY;AAAA,IACtC,CAAC;AAED,WAAO;AAAA,MACL,OAAO,WAAW;AAAA,MAClB,cAAc;AAAA,MACd;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,WAAW;AAC5B,mBAAa,WAAW,kBAAkB;AAAA,QACxC,MAAM,IAAI;AAAA,QACV,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI;AAAA,MACf,CAAC;AAAA,IACH,OAAO;AACL,mBAAa,WAAW,wCAAwC;AAAA,QAC9D,MAAM,eAAe,QAAQ,IAAI,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,eACpB,QACA,QACA,aACA,OACwB;AACxB,eAAa,WAAW,qBAAqB;AAAA,IAC3C,cAAc,iBAAiB,MAAM,YAAY;AAAA,EACnD,CAAC;AAED,SAAO,YAAY;AAAA,IAAY,MAAM;AAAA,IAAc,MACjD,eAAe,QAAQ,QAAQ,MAAM,YAAY;AAAA,EACnD;AACF;;;ACtEA,eAAe,mBACb,QACA,QACA,aACA,cACoB;AACpB,MAAI;AACF,UAAM,YAAY,MAAM,eAAe,QAAQ,QAAQ,aAAa,EAAE,aAAa,CAAC;AAEpF,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,cAAc,UAAU;AAAA,IAC1B;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,cAAc,IAAI,SAAS,WAAW,IAAI,SAAS,mBAAmB;AACvF,YAAM,IAAI,UAAU,mBAAmB,iBAAiB;AAAA,IAC1D;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,iBACpB,QACA,QACA,aACA,OACoB;AACpB,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,eAAe,MAAM,gBAAgB;AAE3C,MAAI,CAAC,cAAc;AACjB,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,UAAU,qBAAqB,mBAAmB;AAAA,IAC9D;AACA,WAAO,mBAAmB,QAAQ,QAAQ,aAAa,YAAY;AAAA,EACrE;AAEA,MAAI,CAAC,aAAa,cAAc,OAAO,eAAe,GAAG;AACvD,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B;AAEA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,UAAU,mBAAmB,iBAAiB;AAAA,EAC1D;AAEA,SAAO,mBAAmB,QAAQ,QAAQ,aAAa,YAAY;AACrE;;;AC9CO,SAAS,mBAAmB,OAEtB;AACX,QAAM,QAAQ,MAAM,gBAAgB;AACpC,QAAM,OAAO,iBAAiB,KAAK;AAEnC,SAAO;AAAA,IACL;AAAA,IACA,YAAY,CAAC,CAAC;AAAA,EAChB;AACF;AAEA,eAAsB,MACpB,QACA,QACA,aACA,OAImB;AACnB,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,eAAe,MAAM,gBAAgB;AAE3C,MAAI,CAAC,gBAAgB,CAAC,cAAc;AAClC,WAAO,EAAE,MAAM,MAAM,YAAY,MAAM;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,QAAQ,QAAQ,aAAa;AAAA,MACpE;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,iBAAiB,UAAU,KAAK;AAE7C,WAAO;AAAA,MACL;AAAA,MACA,YAAY;AAAA,MACZ,cAAc,UAAU;AAAA,IAC1B;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,WAAW;AAC5B,aAAO,EAAE,MAAM,MAAM,YAAY,MAAM;AAAA,IACzC;AACA,UAAM;AAAA,EACR;AACF;;;ACtCA,SAAS,uBAAuB,OAIZ;AAClB,QAAM,EAAE,cAAc,cAAc,gBAAgB,IAAI;AAExD,MAAI,CAAC,cAAc;AACjB,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,aAAa,cAAc,eAAe,GAAG;AAChD,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,eAAsB,SACpB,QACA,QACA,aACA,OAIoB;AACpB,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,eAAe,MAAM,gBAAgB;AAE3C,eAAa,OAAO,iBAAiB;AAAA,IACnC,YAAY,gBAAgB;AAAA,IAC5B,YAAY,gBAAgB;AAAA,IAC5B,SAAS,iBAAiB,cAAc,OAAO,eAAe;AAAA,IAC9D,cAAc,iBAAiB,YAAY;AAAA,IAC3C,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AAED,QAAM,OAAO,uBAAuB;AAAA,IAClC;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AAED,eAAa,OAAO,gBAAgB,EAAE,KAAK,CAAC;AAE5C,MAAI;AACF,UAAM,SAAS,MAAM,iBAAiB,QAAQ,QAAQ,aAAa;AAAA,MACjE;AAAA,MACA;AAAA,IACF,CAAC;AAED,iBAAa,OAAO,iBAAiB;AAAA,MACnC;AAAA,MACA,aAAa,OAAO,MAAM;AAAA,MAC1B,aAAa,OAAO,cAAc,UAAU;AAAA,IAC9C,CAAC;AAED,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,eAAe,WAAW;AAC5B,mBAAa,OAAO,cAAc;AAAA,QAChC;AAAA,QACA,MAAM,IAAI;AAAA,QACV,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI;AAAA,MACf,CAAC;AAAA,IACH,OAAO;AACL,mBAAa,OAAO,oCAAoC;AAAA,QACtD;AAAA,QACA,MAAM,eAAe,QAAQ,IAAI,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;;;ACzFO,SAAS,YAAY,SAAuC;AACjE,SAAO;AAAA,IACL,gBAAgB,CAAC,gBAAgB,sBAAsB,kBAAkB;AAAA,EAC3E;AACF;;;ACNA,eAAsB,cACpB,QACA,QACA,OAC8B;AAC9B,MAAI,OAAO,iBAAiB,MAAM;AAChC,iBAAa,kBAAkB,6BAA6B,EAAE,eAAe,KAAK,CAAC;AAAA,EACrF,OAAO;AACL,iBAAa,kBAAkB,6BAA6B;AAAA,MAC1D,eAAe,OAAO;AAAA,IACxB,CAAC;AACD,UAAM,sCAAsC,QAAQ,QAAQ,MAAM,YAAY;AAC9E,iBAAa,kBAAkB,4BAA4B;AAAA,MACzD,eAAe,OAAO;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,cAAc,oBAAoB,QAAQ,MAAM,cAAc,MAAM,YAAY;AAAA,EAClF;AACF;;;ACxBO,IAAM,qBAAN,MAAyB;AAAA,EACb,WAAW,oBAAI,IAAoC;AAAA,EAEpE,MAAM,YACJ,KACA,SACwB;AACxB,UAAM,WAAW,KAAK,SAAS,IAAI,GAAG;AACtC,QAAI,SAAU,QAAO;AAErB,UAAM,UAAU,QAAQ,EAAE,QAAQ,MAAM;AACtC,WAAK,SAAS,OAAO,GAAG;AAAA,IAC1B,CAAC;AAED,SAAK,SAAS,IAAI,KAAK,OAAO;AAC9B,WAAO;AAAA,EACT;AACF;AAEO,SAAS,2BAA+C;AAC7D,SAAO,IAAI,mBAAmB;AAChC;;;ACVO,SAAS,oBACd,aACA,SACe;AACf,QAAM,SAAS,cAAc,WAAW;AACxC,iBAAe,MAAM;AACrB,QAAM,SAAS,IAAI,gBAAgB,QAAQ,SAAS,SAAS,KAAK;AAClE,QAAM,cAAc,yBAAyB;AAE7C,QAAM,eAAe,CAAC,WAGf;AAAA,IACL,cAAc,MAAM,gBAAgB;AAAA,IACpC,cAAc,MAAM,gBAAgB;AAAA,EACtC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,mBAAmB,QAAQ,MAAM;AAAA,IAC3D,gBAAgB,CAAC,UAAU,eAAe,QAAQ,QAAQ,KAAK;AAAA,IAC/D,gBAAgB,CAAC,UAAU,eAAe,QAAQ,QAAQ,aAAa,KAAK;AAAA,IAC5E,OAAO,CAAC,UAAU,MAAM,QAAQ,QAAQ,aAAa,KAAK;AAAA,IAC1D,oBAAoB,CAAC,UAAU,mBAAmB,KAAK;AAAA,IACvD,kBAAkB,CAAC,UACjB,iBAAiB,QAAQ,QAAQ,aAAa,aAAa,KAAK,CAAC;AAAA,IACnE,UAAU,CAAC,UAAU,SAAS,QAAQ,QAAQ,aAAa,KAAK;AAAA,IAChE,eAAe,CAAC,UAAU,cAAc,QAAQ,QAAQ,KAAK;AAAA,IAC7D,aAAa,MAAM,YAAY,MAAM;AAAA,EACvC;AACF;;;AClCO,SAAS,sBAAsB,cAAsD;AAC1F,QAAM,SAAS,kBAAkB,YAAY;AAC7C,SAAO;AAAA,IACL,IAAI,MAAc;AAChB,aAAO,OAAO,IAAI;AAAA,IACpB;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,cAAiE;AACjG,MAAI,CAAC,aAAc,QAAO,CAAC;AAC3B,QAAM,SAAiC,CAAC;AACxC,aAAW,QAAQ,aAAa,MAAM,GAAG,GAAG;AAC1C,UAAM,CAAC,SAAS,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AAChD,QAAI,CAAC,QAAS;AACd,WAAO,OAAO,IAAI,mBAAmB,KAAK,KAAK,GAAG,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,UAAkC;AACtE,QAAM,EAAE,MAAM,OAAO,QAAQ,IAAI;AACjC,QAAM,QAAQ;AAAA,IACZ,GAAG,IAAI,IAAI,KAAK;AAAA,IAChB,QAAQ,QAAQ,IAAI;AAAA,IACpB;AAAA,IACA,YAAY,mBAAmB,QAAQ,QAAQ,CAAC;AAAA,IAChD,WAAW,QAAQ,MAAM;AAAA,EAC3B;AACA,MAAI,QAAQ,UAAU,QAAQ,YAAa,OAAM,KAAK,QAAQ;AAC9D,MAAI,QAAQ,YAAa,OAAM,KAAK,aAAa;AACjD,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,mBAAmB,OAA0C;AACpE,MAAI,UAAU,MAAO,QAAO;AAC5B,MAAI,UAAU,SAAU,QAAO;AAC/B,SAAO;AACT;AAEO,SAAS,qBAAqB,QAAwB,OAAmC;AAC9F,SAAO,MAAM,IAAI,CAAC,SAAS,iBAAiB,QAAQ,IAAI,CAAC;AAC3D;AAEO,SAAS,qBACd,QACA,WACM;AACN,MAAI,UAAU,WAAW,EAAG;AAE5B,QAAM,YAAY,UAAU,IAAI,CAAC,aAAa,sBAAsB,QAAQ,CAAC;AAC7E,MAAI,OAAO,cAAc;AACvB,eAAW,SAAS,WAAW;AAC7B,aAAO,aAAa,cAAc,KAAK;AAAA,IACzC;AACA;AAAA,EACF;AAEA,SAAO,UAAU,cAAc,SAAS;AAC1C;AAaO,SAAS,gBAAgB,cAAyC;AACvE,QAAM,QAAQ,sBAAsB,YAAY;AAChD,SAAO;AAAA,IACL,SAAS,MAAM,IAAI,cAAc,KAAK;AAAA,IACtC,cAAc,MAAM,IAAI,oBAAoB,KAAK;AAAA,IACjD,YAAY,MAAM,IAAI,kBAAkB,KAAK;AAAA,IAC7C;AAAA,EACF;AACF;;;ACvFO,SAAS,cAAc,QAAwB,MAAsB;AAC1E,MAAI,KAAK,WAAW,SAAS,KAAK,KAAK,WAAW,UAAU,GAAG;AAC7D,WAAO;AAAA,EACT;AACA,QAAM,aAAa,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACzD,SAAO,GAAG,OAAO,UAAU,GAAG,UAAU;AAC1C;AAEO,SAAS,WAAW,QAAgC;AACzD,SAAO,GAAG,OAAO,UAAU;AAC7B;AAEO,SAAS,iBAAiB,QAAwB,MAAsB;AAC7E,SAAO,cAAc,QAAQ,GAAG,OAAO,eAAe,GAAG,IAAI,EAAE;AACjE;;;ACgDO,SAAS,2BAA2B,KAAc,YAA8B;AACrF,QAAM,YAAY,IAAI,QAAQ,IAAI,gBAAgB;AAClD,MAAI,cAAc,MAAM;AACtB,WAAO,cAAc,iBAAiB,cAAc;AAAA,EACtD;AACA,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;AACvC,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,OAAO,IAAI,QAAQ,IAAI,MAAM;AACnC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,QAAQ,KAAK,EAAE;AAC/F,MAAI,WAAW,GAAG,KAAK,MAAM,IAAI,GAAI,QAAO;AAE5C,MAAI,YAAY;AACd,QAAI;AACF,YAAM,aAAa,IAAI,IAAI,UAAU;AACrC,UAAI,SAAS,WAAW,QAAQ,WAAW,WAAW,QAAQ;AAC5D,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI;AACF,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,IACvF;AACA,WAAO,OAAO,QAAQ,QAAQ,YAAY,QAAQ,MAAM;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,sBACd,MACuD;AACvD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,eAAgB,KAAoC;AAC1D,QAAM,eAAgB,KAAoC;AAC1D,MAAI,OAAO,iBAAiB,YAAY,CAAC,aAAa,KAAK,EAAG,QAAO;AACrE,MAAI,OAAO,iBAAiB,YAAY,CAAC,aAAa,KAAK,EAAG,QAAO;AACrE,MAAI,CAAC,gBAAgB,YAAY,EAAG,QAAO;AAC3C,SAAO,EAAE,cAAc,aAAa,KAAK,GAAG,cAAc,aAAa,KAAK,EAAE;AAChF;;;ArB5EA,SAAS,kBAA2C;AAClD,MAAI;AAEF,UAAM,aAAa,QAAQ,aAAa;AACxC,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BACP,UACA,WACM;AACN;AAAA,IACE;AAAA,MACE,WAAW,CAAC,MAAM,UAChB,SAAS,QAAQ,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;AAAA,MAC5E,cAAc,CAAC,MAAM,UAAU,SAAS,QAAQ,OAAO,MAAM,KAAK;AAAA,IACpE;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,uBAAuB,QAA6B;AAClE,QAAM,OAAO,oBAAoB,MAAM;AACvC,QAAM,eAAe,gBAAgB;AAErC,SAAO;AAAA,IACL,MAAM,KAAgC;AACpC,UAAI,IAAI,WAAW,OAAO;AACxB,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3E;AAEA,UAAI;AACF,cAAM,SAAS,KAAK,mBAAmB;AACvC,cAAM,WAAW,aAAa,SAAS,OAAO,cAAc,GAAG;AAC/D,mCAA2B,UAAU,OAAO,YAAY;AACxD,eAAO;AAAA,MACT,SAAS,KAAc;AACrB,cAAM,OAAO,eAAe,YAAY,IAAI,OAAO;AACnD,eAAO,aAAa,KAAK,EAAE,OAAO,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,KAAyC;AACtD,UAAI,IAAI,WAAW,OAAO;AACxB,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3E;AAEA,YAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM,KAAK;AAC7C,YAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;AAC/C,YAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;AAC/C,YAAM,EAAE,MAAM,IAAI,gBAAgB,IAAI,QAAQ,IAAI,QAAQ,CAAC;AAE3D,UAAI,SAAS,CAAC,MAAM;AAClB,eAAO,aAAa,SAAS,iBAAiB,KAAK,QAAQ,SAAS,SAAS,GAAG,GAAG;AAAA,MACrF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,eAAe,EAAE,MAAM,OAAO,SAAS,MAAM,CAAC;AACxE,cAAM,WAAW,aAAa,SAAS,WAAW,KAAK,MAAM,GAAG,GAAG;AACnE,mCAA2B,UAAU,OAAO,YAAY;AACxD;AAAA,UACE;AAAA,UACA,qBAAqB,KAAK,QAAQ,OAAO,cAAc;AAAA,QACzD;AACA,eAAO;AAAA,MACT,SAAS,KAAc;AACrB,cAAMC,QAAO,eAAe,YAAY,IAAI,OAAO;AACnD,eAAO,aAAa,SAAS,iBAAiB,KAAK,QAAQA,KAAI,GAAG,GAAG;AAAA,MACvE;AAAA,IACF;AAAA,IAEA,MAAM,GAAG,KAAyC;AAChD,UAAI,IAAI,WAAW,OAAO;AACxB,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3E;AAEA,YAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,IAAI,QAAQ,IAAI,QAAQ,CAAC;AAC3E,YAAM,SAAS,MAAM,KAAK,MAAM,EAAE,cAAc,SAAS,aAAa,CAAC;AACvE,YAAM,WAAW,aAAa,KAAK;AAAA,QACjC,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AACD,UAAI,OAAO,cAAc,QAAQ;AAC/B,mCAA2B,UAAU,OAAO,YAAY;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,KAAyC;AACjD,UAAI,IAAI,WAAW,OAAO;AACxB,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3E;AAEA,YAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,IAAI,QAAQ,IAAI,QAAQ,CAAC;AAE3E,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,SAAS,EAAE,cAAc,SAAS,aAAa,CAAC;AAC1E,cAAM,WAAW,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC;AAC1D,YAAI,OAAO,cAAc,QAAQ;AAC/B,qCAA2B,UAAU,OAAO,YAAY;AAAA,QAC1D;AACA,eAAO;AAAA,MACT,SAAS,KAAc;AACrB,YAAI,eAAe,WAAW;AAC5B,iBAAO,aAAa;AAAA,YAClB;AAAA,cACE,OAAO,IAAI;AAAA,cACX,OAAO;AAAA,cACP,aAAa,KAAK,OAAO,OAAO;AAAA,YAClC;AAAA,YACA,EAAE,QAAQ,IAAI,WAAW;AAAA,UAC3B;AAAA,QACF;AACA,eAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,OAAO,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACnF;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,KAAyC;AACrD,UAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AACjD,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3E;AAEA,YAAM,EAAE,aAAa,IAAI,gBAAgB,IAAI,QAAQ,IAAI,QAAQ,CAAC;AAClE,UAAI,CAAC,cAAc;AACjB,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,IAAI,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,eAAe,EAAE,aAAa,CAAC;AACzD,cAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,MAAM,CAAC;AACpE,mCAA2B,UAAU,OAAO,YAAY;AACxD,eAAO;AAAA,MACT,QAAQ;AACN,eAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,IAAI,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClF;AAAA,IACF;AAAA,IAEA,OAAO,KAAgC;AACrC,UAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AACjD,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3E;AAEA,YAAM,WAAW,aAAa,SAAS,WAAW,KAAK,MAAM,GAAG,GAAG;AACnE;AAAA,QACE;AAAA,QACA,qBAAqB,KAAK,QAAQ,KAAK,YAAY,EAAE,cAAc;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,KAAyC;AAC3D,UAAI,IAAI,WAAW,QAAQ;AACzB,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3E;AACA,UAAI,CAAC,2BAA2B,KAAK,KAAK,OAAO,UAAU,GAAG;AAC5D,eAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACnF;AAEA,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,IAAI,KAAK;AAAA,MACxB,QAAQ;AACN,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AAEA,YAAM,SAAS,sBAAsB,IAAI;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,cAAc,MAAM;AAC9C,cAAM,WAAW,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAC/C,mCAA2B,UAAU,OAAO,YAAY;AACxD,eAAO;AAAA,MACT,SAAS,KAAc;AACrB,YAAI,eAAe,WAAW;AAC5B,iBAAO,aAAa,KAAK,EAAE,OAAO,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,WAAW,CAAC;AAAA,QAC1E;AACA,eAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA;AAAA,EACF;AACF;","names":["body","code"]}