{"version":3,"sources":["../src/pkce.ts","../src/paths.ts","../src/browser.ts","../src/views.tsx","../src/react.ts"],"names":["useState","useEffect","useCallback","h","createContext","useMemo","useRef","handleCallback","logout","createElement","useContext"],"mappings":";;;;;;;AAcA,IAAM,aAAA,GAAgB,EAAA;AAEtB,SAAS,gBAAgB,UAAA,EAA4B;AACnD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,UAAU,CAAA;AACvC,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,eAAA,CAAgB,MAAM,MAAM,CAAA;AACrC;AAEA,eAAe,OAAO,KAAA,EAAqC;AACzD,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,OAAO,OAAO,MAAA,CAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AAC9D;AAEA,SAAS,gBAAgB,MAAA,EAA6B;AACpD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAUA,eAAsB,qBAAA,GAGnB;AACD,EAAA,MAAM,YAAA,GAAe,gBAAgB,aAAa,CAAA;AAClD,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,YAAY,CAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,gBAAgB,IAAI,CAAA;AAC1C,EAAA,OAAO,EAAE,cAAc,aAAA,EAAc;AACvC;AAGO,SAAS,aAAA,GAAwB;AACtC,EAAA,OAAO,gBAAgB,aAAa,CAAA;AACtC;;;ACrCO,IAAM,UAAA,GAAa;AAAA;AAAA,EAExB,SAAA,EAAW,mCAAA;AAAA;AAAA,EAEX,SAAA,EAAW,yBAAA;AAAA;AAAA,EAEX,KAAA,EAAO,qBAAA;AAAA;AAAA,EAEP,QAAA,EAAU,wBAAA;AAAA;AAAA,EAEV,IAAA,EAAM,0BAAA;AAAA;AAAA,EAEN,MAAA,EAAQ;AACV,CAAA;AASO,IAAM,SAAA,GAAY;AAAA;AAAA,EAEvB,WAAA,EAAa,sBAAA;AAAA;AAAA,EAEb,UAAA,EAAY,oBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQZ,KAAA,EAAO,eAAA;AAAA;AAAA,EAEP,QAAA,EAAU,gCAAA;AAAA,EAEF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,SAAA,EAAW,oBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQX,UAAA,EAAY;AACd,CAAA;AAiCO,SAAS,cAAc,SAAA,EAA2B;AACvD,EAAA,OAAO,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACrC;AAQO,SAAS,MAAA,CAAO,WAAmB,GAAA,EAA0B;AAClE,EAAA,OAAO,GAAG,aAAA,CAAc,SAAS,CAAC,CAAA,EAAG,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA;AACtD;;;AChFA,IAAM,cAAA,GAAiB,YAAA;AACvB,IAAM,SAAA,GAAY,GAAG,cAAc,CAAA,KAAA,CAAA;AACnC,IAAM,iBAAA,GAAoB,GAAG,cAAc,CAAA,aAAA,CAAA;AAC3C,IAAM,gBAAA,GAAmB,GAAG,cAAc,CAAA,YAAA,CAAA;AAC1C,IAAM,iBAAA,GAAoB,GAAG,cAAc,CAAA,aAAA,CAAA;AAC3C,IAAM,YAAA,GAAe,GAAG,cAAc,CAAA,QAAA,CAAA;AACtC,IAAM,cAAA,GAAiB,GAAG,cAAc,CAAA,UAAA,CAAA;AAMxC,IAAM,mBAAA,GAAsB,GAAG,iBAAiB,CAAA,CAAA,CAAA;AAChD,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,OAAO,CAAA,EAAG,mBAAmB,CAAA,EAAG,KAAK,CAAA,CAAA;AACvC;AASA,IAAM,eAAA,GAAkB,KAAK,EAAA,GAAK,GAAA;AAGlC,SAAS,UAAA,CAAW,cAAsB,KAAA,EAAuB;AAC/D,EAAA,OAAO,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AACjC;AAOA,SAAS,WAAW,KAAA,EAA2D;AAC7E,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC/B,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACtB,MAAA,OAAO,EAAE,QAAA,EAAU,MAAA,CAAO,IAAI,CAAA,EAAG,cAAc,KAAA,CAAM,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA,EAAE;AAAA,IACtE;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,CAAA,EAAG,YAAA,EAAc,KAAA,EAAM;AAC5C;AAYO,IAAM,iBAAA,GAAoB,iBAAA;AACjC,IAAM,oBAAA,GAAuB,WAAA;AA4E7B,SAAS,iBAAiB,QAAA,EAA4B;AACpD,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,iBAAiB,WAAA,EAAa;AACvC,MAAA,MAAM,KAAA,GAAQ,iBAAA;AACd,MAAA,YAAA,CAAa,OAAA,CAAQ,OAAO,GAAG,CAAA;AAC/B,MAAA,YAAA,CAAa,WAAW,KAAK,CAAA;AAC7B,MAAA,OAAO,YAAA;AAAA,IACT;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,QAAA;AACT;AAEO,IAAM,MAAN,MAAU;AAAA,EACE,MAAA;AAAA,EACA,OAAA;AAAA;AAAA;AAAA,EAGA,SAAA;AAAA,EACT,cAAA,GAAuC,IAAA;AAAA,EAE/C,YAAY,MAAA,EAAmB;AAC7B,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAO,OAAA,IAAW,cAAA;AACjC,IAAA,IAAA,CAAK,SAAA,GAAY,gBAAA,CAAiB,IAAA,CAAK,OAAO,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,YAAA,GAAuC;AACnD,IAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,OAAO,IAAA,CAAK,cAAA;AAErC,IAAA,MAAM,OAAA,GAAU,aAAA,CAAc,IAAA,CAAK,MAAA,CAAO,SAAS,CAAA;AAOnD,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,EAAG,UAAA,CAAW,SAAS,CAAA,CAAA,EAAI;AAAA,QAC3D,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,OACvC,CAAA;AACD,MAAA,IAAI,IAAI,EAAA,EAAI;AACV,QAAA,IAAA,CAAK,cAAA,GAAkB,MAAM,GAAA,CAAI,IAAA,EAAK;AACtC,QAAA,OAAO,IAAA,CAAK,cAAA;AAAA,MACd;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAA,CAAK,cAAA,GAAiB;AAAA,MACpB,MAAA,EAAQ,OAAA;AAAA,MACR,sBAAA,EAAwB,MAAA,CAAO,OAAA,EAAS,WAAW,CAAA;AAAA,MACnD,cAAA,EAAgB,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA;AAAA,MACvC,iBAAA,EAAmB,MAAA,CAAO,OAAA,EAAS,UAAU,CAAA;AAAA,MAC7C,QAAA,EAAU,MAAA,CAAO,OAAA,EAAS,MAAM,CAAA;AAAA,MAChC,wBAAA,EAA0B,CAAC,MAAM,CAAA;AAAA,MACjC,qBAAA,EAAuB,CAAC,oBAAA,EAAsB,eAAe,CAAA;AAAA,MAC7D,gBAAA,EAAkB,CAAC,QAAA,EAAU,OAAA,EAAS,SAAS;AAAA,KACjD;AACA,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,aAAA,GAAiC;AAC7C,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,OAAO,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,OAAO,CAAA;AAAA,IACjD;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,YAAA,EAAa;AAC1C,IAAA,OAAO,SAAA,CAAU,cAAA;AAAA,EACnB;AAAA,EAEA,MAAc,gBAAA,GAAoC;AAChD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,OAAO,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,UAAU,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,YAAA,EAAa;AAC1C,IAAA,OAAO,SAAA,CAAU,iBAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,SAAA,CAAU,OAAe,YAAA,EAA4B;AAC3D,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAKrB,IAAA,IAAA,CAAK,oBAAoB,GAAG,CAAA;AAC5B,IAAA,IAAA,CAAK,SAAA,CAAU,QAAQ,WAAA,CAAY,KAAK,GAAG,UAAA,CAAW,YAAA,EAAc,GAAG,CAAC,CAAA;AACxE,IAAA,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,SAAA,EAAW,KAAK,CAAA;AACvC,IAAA,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,iBAAA,EAAmB,YAAY,CAAA;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,oBAAoB,GAAA,EAAoB;AAC9C,IAAA,KAAA,IAAS,IAAI,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AACnD,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA;AAC9B,MAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,CAAE,UAAA,CAAW,mBAAmB,CAAA,EAAG;AAC9C,MAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,QAAA,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC,CAAA;AAC3B,QAAA;AAAA,MACF;AACA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA;AACpC,MAAA,MAAM,QAAA,GAAW,GAAA,GAAM,UAAA,CAAW,GAAG,EAAE,QAAA,GAAW,CAAA;AAClD,MAAA,IAAI,MAAM,QAAA,GAAW,eAAA,EAAiB,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC,CAAA;AAAA,IACnE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,kBAAkB,KAAA,EAG+B;AAC7D,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,YAAA,EAAa;AAC1C,IAAA,MAAM,EAAE,YAAA,EAAc,aAAA,EAAc,GAAI,MAAM,qBAAA,EAAsB;AACpE,IAAA,MAAM,QAAQ,aAAA,EAAc;AAE5B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,YAAY,CAAA;AAElC,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,CAAU,sBAAsB,CAAA;AACpD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,OAAO,QAAQ,CAAA;AACtD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAC5C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,OAAO,WAAW,CAAA;AAC5D,IAAA,GAAA,CAAI,aAAa,GAAA,CAAI,OAAA,EAAS,IAAA,CAAK,MAAA,CAAO,SAAS,sBAAsB,CAAA;AACzE,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACnC,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,gBAAA,EAAkB,aAAa,CAAA;AACpD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,uBAAA,EAAyB,MAAM,CAAA;AAEpD,IAAA,IAAI,OAAO,MAAA,EAAQ,GAAA,CAAI,aAAa,GAAA,CAAI,QAAA,EAAU,MAAM,MAAM,CAAA;AAC9D,IAAA,IAAI,OAAO,gBAAA,EAAkB;AAC3B,MAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,gBAAgB,CAAA,EAAG;AAC3D,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,CAAC,CAAA;AAAA,MAC3B;AAAA,IACF;AACA,IAAA,OAAO,EAAE,GAAA,EAAK,YAAA,EAAc,KAAA,EAAM;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,eAAe,MAAA,EAAuE;AAC1F,IAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,kBAAkB,MAAM,CAAA;AACnD,IAAA,MAAA,CAAO,QAAA,CAAS,IAAA,GAAO,GAAA,CAAI,QAAA,EAAS;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,MAAA,EAAyE;AAC1F,IAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,kBAAkB,MAAM,CAAA;AACnD,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,eAAA,GAAqE;AACjF,IAAA,MAAM,EAAE,YAAA,EAAc,aAAA,EAAc,GAAI,MAAM,qBAAA,EAAsB;AACpE,IAAA,MAAM,QAAQ,aAAA,EAAc;AAC5B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,YAAY,CAAA;AAClC,IAAA,OAAO,EAAE,eAAe,KAAA,EAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,gBAAgB,MAAA,EAAkD;AAC9E,IAAA,MAAM,EAAE,aAAA,EAAe,KAAA,EAAM,GAAI,MAAM,KAAK,eAAA,EAAgB;AAC5D,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,KAAK,MAAA,CAAO,SAAA;AACrD,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,aAAA,CAAc,IAAI,CAAC,CAAA,EAAG,SAAA,CAAU,KAAK,CAAA,CAAE,CAAA;AAC9D,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,OAAO,QAAQ,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,MAAM,CAAA;AAC3C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,OAAO,WAAW,CAAA;AAC3D,IAAA,GAAA,CAAI,aAAa,GAAA,CAAI,OAAA,EAAS,IAAA,CAAK,MAAA,CAAO,SAAS,sBAAsB,CAAA;AACzE,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACnC,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AACnC,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,gBAAA,EAAkB,aAAa,CAAA;AACpD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,uBAAA,EAAyB,MAAM,CAAA;AAEpD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,MACtC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,WAAA,EAAa,SAAA;AAAA,MACb,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,IAAA,EAAM,MAAA;AAAA,QACN,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,WAAA,IAAe,KAAK,MAAA,CAAO,QAAA;AAAA,QACpD,YAAA,EAAc,KAAK,MAAA,CAAO,YAAA;AAAA,QAC1B,UAAA,EAAY,IAAA;AAAA,QACZ,GAAG;AAAA,OACJ;AAAA,KACF,CAAA;AACD,IAAA,MAAM,MAAA,GAAU,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACjD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,MAAA,CAAO,WAAW,OAAA,EAAS;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,GAAA,GAAM,CAAA,gBAAA,EAAmB,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IAChG;AACA,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,WAAW,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AACA,IAAA,MAAM,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAA;AAC1D,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA,EAAG,GAAG,CAAA,KAAA,EAAQ,kBAAA,CAAmB,IAAI,CAAC,CAAA,OAAA,EAAU,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,EAC5G;AAAA;AAAA,EAGA,iBAAA,CAAkB,UAAkB,QAAA,EAAmC;AACrE,IAAA,OAAO,KAAK,eAAA,CAAgB,EAAE,UAAU,QAAA,EAAU,YAAA,EAAc,YAAY,CAAA;AAAA,EAC9E;AAAA;AAAA,EAGA,aAAA,CAAc,aAAqB,IAAA,EAA+B;AAChE,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA;AACxC,IAAA,OAAO,KAAK,eAAA,CAAgB;AAAA,MAC1B,QAAA,EAAU,WAAA;AAAA,MACV,IAAA;AAAA,MACA,YAAA,EAAc,mBAAA;AAAA,MACd,GAAI,UAAU,EAAE,KAAA,EAAO,aAAY,GAAI,EAAE,OAAO,WAAA;AAAY,KAC7D,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,cAAc,WAAA,EAAoC;AACtD,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,KAAK,MAAA,CAAO,SAAA;AACrD,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,aAAA,CAAc,IAAI,CAAC,CAAA,EAAG,SAAA,CAAU,QAAQ,CAAA,CAAE,CAAA;AACjE,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,OAAO,QAAQ,CAAA;AACrD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc,GAAA,CAAI,aAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAC3F,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,MACtC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,eAAe,CAAA,MAAA,EAAS,IAAA,CAAK,OAAO,WAAA,IAAe,IAAA,CAAK,OAAO,QAAQ,CAAA,CAAA;AAAA,QACvE,YAAA,EAAc,KAAK,MAAA,CAAO,YAAA;AAAA,QAC1B,IAAA,EAAM,WAAA;AAAA,QACN,IAAA,EAAM,UAAU,OAAA,GAAU,OAAA;AAAA,QAC1B,MAAA,EAAQ,OAAA;AAAA,QACR,SAAA,EAAW;AAAA,OACZ;AAAA,KACF,CAAA;AACD,IAAA,MAAM,MAAA,GAAU,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACjD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,MAAA,CAAO,WAAW,OAAA,EAAS;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,GAAA,GAAM,CAAA,qBAAA,EAAwB,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IACrG;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAe,WAAA,EAAyC;AAC5D,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,WAAA,IAAe,MAAA,CAAO,SAAS,IAAI,CAAA;AACvD,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAE1C,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,mBAAmB,CAAA,IAAK,KAAA;AAC1D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,IAAI,CAAA,CAAE,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAU1C,IAAA,MAAM,KAAA,GAAQ,KAAA,GAAQ,WAAA,CAAY,KAAK,CAAA,GAAI,IAAA;AAC3C,IAAA,MAAM,KAAA,GAAQ,KAAA,GAAS,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA,IAAK,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA,GAAK,IAAA;AACvF,IAAA,IAAI,YAAA,GAA8B,KAAA,GAAQ,UAAA,CAAW,KAAK,EAAE,YAAA,GAAe,IAAA;AAE3E,IAAA,IAAI,gBAAgB,KAAA,EAAO;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,WAAW,KAAK,CAAA;AAC/B,MAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,KAAK,CAAA;AAG7B,MAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA,KAAM,KAAA,IAAS,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,SAAS,CAAA,KAAM,KAAA,EAAO;AAC5F,QAAA,IAAA,CAAK,SAAA,CAAU,WAAW,SAAS,CAAA;AACnC,QAAA,IAAA,CAAK,SAAA,CAAU,WAAW,iBAAiB,CAAA;AAC3C,QAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,SAAS,CAAA;AACjC,QAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,iBAAiB,CAAA;AAAA,MAC3C;AAAA,IACF,CAAA,MAAO;AAKL,MAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA,IAAK,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,SAAS,CAAA;AACtF,MAAA,IAAI,CAAC,UAAA,IAAc,KAAA,KAAU,UAAA,EAAY;AACvC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,YAAA,GAAe,IAAA,CAAK,UAAU,OAAA,CAAQ,iBAAiB,KAAK,IAAA,CAAK,OAAA,CAAQ,QAAQ,iBAAiB,CAAA;AAClG,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAA,CAAK,SAAA,CAAU,WAAW,SAAS,CAAA;AACnC,MAAA,IAAA,CAAK,SAAA,CAAU,WAAW,iBAAiB,CAAA;AAC3C,MAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,SAAS,CAAA;AACjC,MAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,iBAAiB,CAAA;AAAA,IAC3C;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,IAAA;AAAA,MACA,YAAA,EAAc,KAAK,MAAA,CAAO,WAAA;AAAA,MAC1B,aAAA,EAAe;AAAA,KAChB,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,EAAc;AAC1C,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,KAAK,QAAA;AAAS,KACrB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,IAAI,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,GAAA,CAAI,IAAA,EAAK;AAC/B,IAAA,IAAA,CAAK,YAAY,MAAM,CAAA;AACvB,IAAA,OAAO,WAAW,MAAM,CAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAA,GAAwC;AAC5C,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,iBAAiB,CAAA;AAC3D,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,eAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,EAAc;AAC1C,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,KAAK,QAAA;AAAS,KACrB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,IAAI,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,GAAA,CAAI,IAAA,EAAK;AAC/B,IAAA,IAAA,CAAK,YAAY,MAAM,CAAA;AACvB,IAAA,OAAO,WAAW,MAAM,CAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,YAAY,MAAA,EAMI;AACpB,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAM,GAAI,MAAM,KAAK,iBAAA,CAAkB;AAAA,MAClD,kBAAkB,MAAA,EAAQ;AAAA,KAC3B,CAAA;AAED,IAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,GAAA;AAC/B,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,GAAA;AACjC,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,OAAA,GAAA,CAAW,MAAA,CAAO,aAAa,KAAA,IAAS,CAAA;AAC5D,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,OAAA,GAAA,CAAW,MAAA,CAAO,cAAc,MAAA,IAAU,CAAA;AAK7D,IAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,IAAA,CAAK,OAAO,WAAA,EAAa,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,CAAE,MAAA;AAE9E,IAAA,OAAO,IAAI,OAAA,CAAkB,CAAC,OAAA,EAAS,MAAA,KAAW;AAChD,MAAA,MAAM,QAAQ,MAAA,CAAO,IAAA;AAAA,QACnB,IAAI,QAAA,EAAS;AAAA,QACb,iBAAA;AAAA,QACA,SAAS,KAAK,CAAA,QAAA,EAAW,MAAM,CAAA,MAAA,EAAS,IAAI,QAAQ,GAAG,CAAA,sBAAA;AAAA,OACzD;AAEA,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,uDAAkD,CAAC,CAAA;AACpE,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,IAAI,UAAA,GAAmD,IAAA;AACvD,MAAA,MAAM,UAAU,MAAM;AACpB,QAAA,IAAI,OAAA,EAAS;AACb,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,QAAA,aAAA,CAAc,WAAW,CAAA;AACzB,QAAA,YAAA,CAAa,YAAY,CAAA;AACzB,QAAA,IAAI,UAAA,eAAyB,UAAU,CAAA;AACvC,QAAA,IAAI;AACF,UAAA,IAAI,CAAC,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,KAAA,EAAM;AAAA,QACjC,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA;AAEA,MAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAAwB;AACzC,QAAA,IAAI,OAAA,EAAS;AAIb,QAAA,IAAI,KAAA,CAAM,WAAW,cAAA,EAAgB;AACrC,QAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAEnB,QAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,SAAS,QAAA,IAAY,IAAA,CAAK,WAAW,oBAAA,EAAsB;AAE/E,QAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,IAAA,CAAK,UAAU,KAAA,EAAO;AAC1D,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,mDAA8C,CAAC,CAAA;AAChE,UAAA;AAAA,QACF;AACA,QAAA,IAAI,KAAK,KAAA,EAAO;AACd,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,IAAA,CAAK,KAAK,EAAE,CAAC,CAAA;AAC9C,UAAA;AAAA,QACF;AACA,QAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,IAAA,CAAK,IAAA,CAAK,WAAW,CAAA,EAAG;AAC3D,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,4CAA4C,CAAC,CAAA;AAC9D,UAAA;AAAA,QACF;AAIA,QAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,QAAA,MAAM,gBAAgB,IAAA,CAAK,KAAA;AAC3B,QAAA,OAAA,EAAQ;AACR,QAAA,MAAM,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAA;AAC1D,QAAA,MAAM,WAAA,GAAc,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA,EAAG,GAAG,CAAA,KAAA,EAAQ,kBAAA,CAAmB,IAAI,CAAC,CAAA,OAAA,EAAU,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAA;AAC/H,QAAA,IAAA,CAAK,cAAA,CAAe,WAAW,CAAA,CAAE,IAAA,CAAK,SAAS,MAAM,CAAA;AAAA,MACvD,CAAA;AAEA,MAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAM5C,MAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AACpC,QAAA,IAAI,OAAA,IAAW,CAAC,KAAA,CAAM,MAAA,IAAU,UAAA,EAAY;AAC5C,QAAA,UAAA,GAAa,WAAW,MAAM;AAC5B,UAAA,IAAI,CAAC,OAAA,EAAS;AACZ,YAAA,OAAA,EAAQ;AACR,YAAA,MAAA,CAAO,IAAI,KAAA,CAAM,0CAA0C,CAAC,CAAA;AAAA,UAC9D;AAAA,QACF,GAAG,GAAI,CAAA;AAAA,MACT,GAAG,GAAG,CAAA;AACN,MAAA,MAAM,YAAA,GAAe,WAAW,MAAM;AACpC,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,uBAAuB,CAAC,CAAA;AAAA,QAC3C;AAAA,MACF,CAAA,EAAG,MAAA,EAAQ,SAAA,IAAa,GAAO,CAAA;AAAA,IACjC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,gBAAgB,IAAA,EAA0D;AAC9E,IAAA,MAAM,GAAA,GACJ,IAAA,EAAM,QAAA,IAAa,UAAA,CAA8C,QAAA;AACnE,IAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,CAAI,YAAY,UAAA,EAAY;AAC7C,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,WAAY,MAAM,GAAA,CAAI,QAAQ,EAAE,MAAA,EAAQ,uBAAuB,CAAA;AACrE,IAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,GAAK,QAAA,CAAS,CAAC,CAAA,GAA2B,MAAA;AAChF,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,KAAK,MAAA,CAAO,SAAA;AACrD,IAAA,MAAM,OAAA,GAAU,cAAc,IAAI,CAAA;AAIlC,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,CAAA,EAAG,OAAO,CAAA,EAAG,SAAA,CAAU,SAAS,CAAA,CAAE,CAAA;AAC3D,IAAA,QAAA,CAAS,YAAA,CAAa,GAAA,CAAI,SAAA,EAAW,OAAO,CAAA;AAC5C,IAAA,QAAA,CAAS,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,OAAO,QAAQ,CAAA;AAC1D,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc,QAAA,CAAS,aAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAChG,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,QAAA,CAAS,UAAS,EAAG;AAAA,MAChD,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,WAAA,EAAa;AAAA,KACd,CAAA;AACD,IAAA,MAAM,YAAA,GAAgB,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAC5D,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,IAAM,YAAA,CAAa,WAAW,OAAA,EAAS;AACnD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,OAAO,aAAa,GAAA,KAAQ,QAAA,GAAW,aAAa,GAAA,GAAM,CAAA,qBAAA,EAAwB,SAAS,MAAM,CAAA,CAAA;AAAA,OACnG;AAAA,IACF;AACA,IAAA,MAAM,SAAA,GAAa,aAAa,IAAA,IAAQ,YAAA;AACxC,IAAA,MAAM,UAAU,SAAA,CAAU,OAAA;AAC1B,IAAA,MAAM,QAAQ,SAAA,CAAU,KAAA;AACxB,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AAGA,IAAA,MAAM,SAAA,GAAa,MAAM,GAAA,CAAI,OAAA,CAAQ;AAAA,MACnC,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,CAAC,OAAA,EAAS,OAAO;AAAA,KAC1B,CAAA;AAGD,IAAA,MAAM,EAAE,aAAA,EAAe,KAAA,EAAM,GAAI,MAAM,KAAK,eAAA,EAAgB;AAC5D,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,CAAA,EAAG,OAAO,CAAA,EAAG,SAAA,CAAU,UAAU,CAAA,CAAE,CAAA;AAC7D,IAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,OAAO,QAAQ,CAAA;AAC3D,IAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,MAAM,CAAA;AACjD,IAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,OAAO,WAAW,CAAA;AACjE,IAAA,SAAA,CAAU,aAAa,GAAA,CAAI,OAAA,EAAS,IAAA,CAAK,MAAA,CAAO,SAAS,sBAAsB,CAAA;AAC/E,IAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACzC,IAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,gBAAA,EAAkB,aAAa,CAAA;AAC1D,IAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,uBAAA,EAAyB,MAAM,CAAA;AAC1D,IAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,SAAA,CAAU,UAAS,EAAG;AAAA,MAClD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,WAAA,EAAa,SAAA;AAAA,MACb,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,WAAA,IAAe,KAAK,MAAA,CAAO,QAAA;AAAA,QACpD,YAAA,EAAc,KAAK,MAAA,CAAO,YAAA;AAAA;AAAA;AAAA,QAG1B,OAAA;AAAA,QACA,OAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACD;AAAA,KACF,CAAA;AACD,IAAA,MAAM,aAAA,GAAiB,MAAM,SAAA,CAAU,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAC9D,IAAA,IAAI,CAAC,SAAA,CAAU,EAAA,IAAM,aAAA,CAAc,WAAW,OAAA,EAAS;AACrD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,OAAO,cAAc,GAAA,KAAQ,QAAA,GAAW,cAAc,GAAA,GAAM,CAAA,sBAAA,EAAyB,UAAU,MAAM,CAAA,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,MAAM,OAAO,aAAA,CAAc,IAAA;AAC3B,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,WAAW,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAA;AAC1D,IAAA,MAAM,WAAA,GAAc,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA,EAAG,GAAG,CAAA,KAAA,EAAQ,kBAAA,CAAmB,IAAI,CAAC,CAAA,OAAA,EAAU,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AACvH,IAAA,OAAO,IAAA,CAAK,eAAe,WAAW,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YAAA,CAAa,SAAA,GAAY,GAAA,EAAgC;AAC7D,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAM,GAAI,MAAM,KAAK,iBAAA,CAAkB,EAAE,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAEtE,IAAA,OAAO,IAAI,OAAA,CAAyB,CAAC,OAAA,KAAY;AAC/C,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,MAAA,MAAA,CAAO,MAAM,OAAA,GAAU,MAAA;AAEvB,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,OAAA,EAAQ;AACR,QAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,MACd,GAAG,SAAS,CAAA;AAEZ,MAAA,MAAM,UAAU,MAAM;AACpB,QAAA,YAAA,CAAa,OAAO,CAAA;AACpB,QAAA,MAAA,CAAO,MAAA,EAAO;AACd,QAAA,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,WAAA,CAAY,KAAK,CAAC,CAAA;AAC5C,QAAA,IAAA,CAAK,SAAA,CAAU,WAAW,SAAS,CAAA;AACnC,QAAA,IAAA,CAAK,SAAA,CAAU,WAAW,iBAAiB,CAAA;AAC3C,QAAA,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,WAAA,CAAY,KAAK,CAAC,CAAA;AAC1C,QAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,SAAS,CAAA;AACjC,QAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,iBAAiB,CAAA;AAAA,MAC3C,CAAA;AAEA,MAAA,MAAA,CAAO,gBAAA,CAAiB,QAAQ,MAAM;AACpC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,MAAA,CAAO,aAAA,EAAe,QAAA,CAAS,IAAA;AACjD,UAAA,IAAI,aAAa,SAAA,CAAU,UAAA,CAAW,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAG9D,YAAA,YAAA,CAAa,OAAO,CAAA;AACpB,YAAA,MAAA,CAAO,MAAA,EAAO;AACd,YAAA,IAAA,CAAK,cAAA,CAAe,SAAS,CAAA,CAAE,IAAA;AAAA,cAC7B,CAAC,MAAA,KAAW,OAAA,CAAQ,MAAM,CAAA;AAAA,cAC1B,MAAM;AACJ,gBAAA,OAAA,EAAQ;AACR,gBAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,cACd;AAAA,aACF;AAAA,UACF;AAAA,QACF,CAAA,CAAA,MAAQ;AAEN,UAAA,OAAA,EAAQ;AACR,UAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,QACd;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,GAAA,GAAM,IAAI,QAAA,EAAS;AAC1B,MAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,IAClC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMQ,YAAY,MAAA,EAA6B;AAC/C,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,gBAAA,EAAkB,MAAA,CAAO,YAAY,CAAA;AAC1D,IAAA,IAAI,OAAO,aAAA,EAAe;AACxB,MAAA,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,iBAAA,EAAmB,MAAA,CAAO,aAAa,CAAA;AAAA,IAC9D;AACA,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,YAAA,EAAc,MAAA,CAAO,QAAQ,CAAA;AAAA,IACpD;AACA,IAAA,IAAI,OAAO,UAAA,EAAY;AACrB,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AACnD,MAAA,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,cAAA,EAAgB,MAAA,CAAO,SAAS,CAAC,CAAA;AAAA,IACxD;AAAA,EACF;AAAA;AAAA,EAGA,cAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,eAAA,GAAiC;AAC/B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,iBAAiB,CAAA;AAAA,EAC/C;AAAA;AAAA,EAGA,UAAA,GAA4B;AAC1B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,YAAY,CAAA;AAAA,EAC1C;AAAA;AAAA,EAGA,cAAA,GAA0B;AACxB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,cAAc,CAAA;AACrD,IAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,IAAK,MAAA,CAAO,SAAS,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,mBAAA,GAA8C;AAClD,IAAA,MAAM,KAAA,GAAQ,KAAK,cAAA,EAAe;AAClC,IAAA,IAAI,KAAA,IAAS,CAAC,IAAA,CAAK,cAAA,EAAe,EAAG;AACnC,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,CAAK,iBAAgB,EAAG;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,kBAAA,EAAmB;AAC7C,QAAA,OAAO,MAAA,CAAO,WAAA;AAAA,MAChB,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGA,WAAA,GAAoB;AAClB,IAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,gBAAgB,CAAA;AACxC,IAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,iBAAiB,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,YAAY,CAAA;AACpC,IAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,cAAc,CAAA;AACtC,IAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,SAAS,CAAA;AACjC,IAAA,IAAA,CAAK,OAAA,CAAQ,WAAW,iBAAiB,CAAA;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,WAAW,SAAS,CAAA;AACnC,IAAA,IAAA,CAAK,SAAA,CAAU,WAAW,iBAAiB,CAAA;AAG3C,IAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,IAAA,KAAA,IAAS,IAAI,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AACjD,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA;AAC5B,MAAA,IAAI,CAAA,IAAK,EAAE,UAAA,CAAW,mBAAmB,GAAG,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAC,CAAA;AAAA,IACvE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,MAAA,GAAwB;AAC5B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAA;AACnD,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,QAAQ,CAAA,EAAG;AAAA,QACnD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,QAAQ,EAAE,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA,KAAO;AAAC,OAC1D,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,WAAA,EAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,GAAgD;AACpD,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC7C,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAAA,IAC5D;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,gBAAA,EAAiB;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAC3B,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA;AAAG,KAC7C,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IACzD;AACA,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAmC;AACvC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC7C,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,IAAA,MAAM,CAAA,GAAK,MAAM,IAAA,CAAK,WAAA,EAAY;AAClC,IAAA,OAAO;AAAA,MACL,GAAA,EAAM,EAAE,GAAA,IAAkB,EAAA;AAAA,MAC1B,OAAO,CAAA,CAAE,KAAA;AAAA,MACT,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,WAAW,CAAA,CAAE,UAAA;AAAA,MACb,YAAY,CAAA,CAAE,WAAA;AAAA,MACd,aAAa,CAAA,CAAE,YAAA;AAAA,MACf,eAAe,CAAA,CAAE,cAAA;AAAA,MACjB,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,OAAO,CAAA,CAAE;AAAA,KACX;AAAA,EACF;AACF,CAAA;AA+BO,SAAS,WAAW,CAAA,EAA4B;AACrD,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,CAAE,YAAA;AAAA,IACf,cAAc,CAAA,CAAE,aAAA;AAAA,IAChB,SAAS,CAAA,CAAE,QAAA;AAAA,IACX,WAAW,CAAA,CAAE,UAAA;AAAA,IACb,WAAW,CAAA,CAAE,UAAA;AAAA,IACb,OAAO,CAAA,CAAE;AAAA,GACX;AACF;AA8BO,SAAS,mBAAA,GAA+B;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAM1C,EAAA,IAAI,MAAA,CAAO,IAAA,KAAS,iBAAA,EAAmB,OAAO,KAAA;AAC9C,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,MAAA,IAAU,MAAA,KAAW,MAAA,EAAQ,OAAO,KAAA;AAEzC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,SAAS,IAAI,CAAA;AACxC,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAC1C,EAAA,MAAM,KAAA,GAAQ,IAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA,IAAK,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,mBAAmB,CAAA;AAEvF,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,KAAA;AAE5B,EAAA,MAAM,OAAA,GAAwB;AAAA,IAC5B,MAAA,EAAQ,oBAAA;AAAA,IACR,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS,EAAC;AAAA,IACvB,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,IACzB,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,GAC3B;AAIA,EAAA,MAAA,CAAO,WAAA,CAAY,OAAA,EAAS,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAClD,EAAA,MAAA,CAAO,KAAA,EAAM;AACb,EAAA,OAAO,IAAA;AACT;ACnhCA,SAAS,QAAQ,KAAA,EAAuB;AACtC,EAAA,OAAO,IAAI,GAAA,CAAI;AAAA,IACb,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,aAAa,KAAA,CAAM;AAAA,GACpB,CAAA;AACH;AAyBO,SAAS,eAAe,IAAA,EAAuC;AACpE,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,cAAA,CAAuB,EAAE,CAAA;AACvD,EAAA,MAAM,CAAC,UAAA,EAAY,aAAa,CAAA,GAAIA,eAAS,KAAK,CAAA;AAClD,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,eAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAErD,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,IAAW,KAAA;AAChC,IAAA,UAAA,CAAW,IAAI,CAAA;AACf,IAAA,QAAA,CAAS,IAAI,CAAA;AAEb,IAAA,OAAA,CAAQ,CAAA,EAAG,cAAc,IAAA,CAAK,SAAS,CAAC,CAAA,EAAG,SAAA,CAAU,WAAW,CAAA,CAAA,EAAI;AAAA,MAClE,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,KACvC,CAAA,CACE,IAAA,CAAK,OAAO,GAAA,KAAQ;AACnB,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACvE,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,CAAC,CAAA,CACA,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,UAAA,CAAW,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC7B,MAAA,aAAA,CAAc,OAAA,CAAQ,IAAA,CAAK,WAAW,CAAC,CAAA;AAAA,IACzC,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,GAAA,KAAQ;AACd,MAAA,IAAI,CAAC,SAAA,EAAW,QAAA,CAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,IAC9E,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,MAAA,IAAI,CAAC,SAAA,EAAW,UAAA,CAAW,KAAK,CAAA;AAAA,IAClC,CAAC,CAAA;AAEH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,OAAO,CAAC,CAAA;AAEjC,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,GAAA,EAAK,CAAC,IAAA,KAAS,OAAA,CAAQ,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AAAA,IAClD,WAAW,MACT,OAAA,CAAQ,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,QAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,QAAkB,CAAA;AAAA,IAC1F,GAAA,EAAK,OAAA;AAAA,IACL;AAAA,GACF;AACF;AAyEO,IAAM,YAAA,GAAiD,CAAC,KAAA,KAAU;AACvE,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAID,eAAS,KAAK,CAAA;AACtC,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAwB,IAAI,CAAA;AAEtD,EAAA,MAAM,OAAA,GAAUE,kBAAY,YAAY;AACtC,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,KAAK,EAAE,WAAA,CAAY;AAAA,QAC7C,gBAAA,EAAkB,EAAE,QAAA,EAAU,KAAA,CAAM,QAAA;AAAS,OAC9C,CAAA;AACD,MAAA,KAAA,CAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AAAA,IACrC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,EAAA,GAAK,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D,MAAA,QAAA,CAAS,GAAG,OAAO,CAAA;AACnB,MAAA,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,IACpB,CAAA,SAAE;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf;AAAA,EACF,CAAA,EAAG,CAAC,KAAA,CAAM,SAAA,EAAW,KAAA,CAAM,UAAU,KAAA,CAAM,WAAA,EAAa,KAAA,CAAM,QAAQ,CAAC,CAAA;AAEvE,EAAA,OAAOC,mBAAA;AAAA,IACL,QAAA;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,OAAA;AAAA,MACA,QAAA,EAAU,IAAA;AAAA,MACV,iBAAiB,KAAA,CAAM,QAAA;AAAA,MACvB,SAAA,EAAW,eAAA;AAAA,MACX,OAAO,KAAA,IAAS;AAAA,KAClB;AAAA,IACA,OAAO,kBAAA,GAAiB,KAAA,CAAM,KAAA,IAAS,CAAA,cAAA,EAAiB,MAAM,QAAQ,CAAA;AAAA,GACxE;AACF;AASO,IAAM,YAAA,GAAiD,CAAC,KAAA,KAAU;AACvE,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIH,eAAS,KAAK,CAAA;AACtC,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAwB,IAAI,CAAA;AAEtD,EAAA,MAAM,OAAA,GAAUE,kBAAY,YAAY;AACtC,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,KAAK,EAAE,eAAA,EAAgB;AACnD,MAAA,KAAA,CAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AAAA,IACrC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,EAAA,GAAK,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D,MAAA,QAAA,CAAS,GAAG,OAAO,CAAA;AACnB,MAAA,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,IACpB,CAAA,SAAE;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf;AAAA,EACF,CAAA,EAAG,CAAC,KAAA,CAAM,SAAA,EAAW,MAAM,QAAA,EAAU,KAAA,CAAM,WAAW,CAAC,CAAA;AAEvD,EAAA,OAAOC,mBAAA;AAAA,IACL,QAAA;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,OAAA;AAAA,MACA,QAAA,EAAU,IAAA;AAAA,MACV,eAAA,EAAiB,QAAA;AAAA,MACjB,SAAA,EAAW,eAAA;AAAA,MACX,OAAO,KAAA,IAAS;AAAA,KAClB;AAAA,IACA,IAAA,GAAO,kBAAA,GAAiB,KAAA,CAAM,KAAA,IAAS;AAAA,GACzC;AACF;AAOO,IAAM,iBAAA,GAA2D,CAAC,KAAA,KAAU;AACjF,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,IAAIH,cAAA,CAAS,KAAA,CAAM,gBAAgB,EAAE,CAAA;AAC3D,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIA,eAAS,EAAE,CAAA;AAC3C,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAAS,KAAK,CAAA;AACtC,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAwB,IAAI,CAAA;AAEtD,EAAA,MAAM,QAAA,GAAWE,iBAAA;AAAA,IACf,OAAO,CAAA,KAAiB;AACtB,MAAA,CAAA,CAAE,cAAA,EAAe;AACjB,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AAGF,QAAA,MAAA,CAAO,QAAA,CAAS,OAAO,MAAM,OAAA,CAAQ,KAAK,CAAA,CAAE,iBAAA,CAAkB,OAAO,QAAQ,CAAA;AAAA,MAC/E,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,EAAA,GAAK,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D,QAAA,QAAA,CAAS,GAAG,OAAO,CAAA;AACnB,QAAA,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,MACpB,CAAA,SAAE;AACA,QAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,MACf;AAAA,IACF,CAAA;AAAA,IACA,CAAC,KAAA,EAAO,QAAA,EAAU,KAAA,CAAM,WAAW,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,WAAA,EAAa,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,YAAA,EAAc,MAAM,WAAW;AAAA,GAC1H;AAEA,EAAA,OAAOC,mBAAA;AAAA,IACL,MAAA;AAAA,IACA,EAAE,QAAA,EAAU,SAAA,EAAW,gBAAA,EAAiB;AAAA,IACxCA,oBAAE,OAAA,EAAS;AAAA,MACT,IAAA,EAAM,OAAA;AAAA,MACN,IAAA,EAAM,OAAA;AAAA,MACN,YAAA,EAAc,OAAA;AAAA,MACd,WAAA,EAAa,OAAA;AAAA,MACb,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,KAAA;AAAA,MACP,UAAU,CAAC,CAAA,KAAqC,QAAA,CAAS,CAAA,CAAE,OAAO,KAAK;AAAA,KACxE,CAAA;AAAA,IACDA,oBAAE,OAAA,EAAS;AAAA,MACT,IAAA,EAAM,UAAA;AAAA,MACN,IAAA,EAAM,UAAA;AAAA,MACN,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa,UAAA;AAAA,MACb,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,QAAA;AAAA,MACP,UAAU,CAAC,CAAA,KAAqC,WAAA,CAAY,CAAA,CAAE,OAAO,KAAK;AAAA,KAC3E,CAAA;AAAA,IACD,KAAA,GAAQA,mBAAA,CAAE,GAAA,EAAK,EAAE,IAAA,EAAM,SAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAK,CAAA,GAAI,IAAA;AAAA,IACzEA,mBAAA,CAAE,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,IAAA,EAAM,SAAA,EAAW,eAAA,EAAgB,EAAG,IAAA,GAAO,kBAAA,GAAgB,SAAS;AAAA,GAC9G;AACF;AAOO,IAAM,OAAA,GAAuC,CAAC,KAAA,KAAU;AAC7D,EAAA,MAAM,CAAC,WAAA,EAAa,cAAc,IAAIH,cAAA,CAAS,KAAA,CAAM,eAAe,EAAE,CAAA;AACtE,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAAS,EAAE,CAAA;AACnC,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAAS,KAAK,CAAA;AACtC,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAAS,KAAK,CAAA;AACtC,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAwB,IAAI,CAAA;AAEtD,EAAA,MAAM,IAAA,GAAOE,kBAAY,YAAY;AACnC,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,CAAQ,KAAK,CAAA,CAAE,aAAA,CAAc,WAAW,CAAA;AAC9C,MAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,IACd,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,EAAA,GAAK,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D,MAAA,QAAA,CAAS,GAAG,OAAO,CAAA;AACnB,MAAA,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,IACpB,CAAA,SAAE;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf;AAAA,EACF,CAAA,EAAG,CAAC,WAAA,EAAa,KAAA,CAAM,OAAA,EAAS,KAAA,CAAM,SAAA,EAAW,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,YAAA,EAAc,KAAA,CAAM,WAAW,CAAC,CAAA;AAEvG,EAAA,MAAM,MAAA,GAASA,iBAAA;AAAA,IACb,OAAO,CAAA,KAAiB;AACtB,MAAA,CAAA,CAAE,cAAA,EAAe;AACjB,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,QAAA,CAAS,OAAO,MAAM,OAAA,CAAQ,KAAK,CAAA,CAAE,aAAA,CAAc,aAAa,IAAI,CAAA;AAAA,MAC7E,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,EAAA,GAAK,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D,QAAA,QAAA,CAAS,GAAG,OAAO,CAAA;AACnB,QAAA,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,MACpB,CAAA,SAAE;AACA,QAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,MACf;AAAA,IACF,CAAA;AAAA,IACA,CAAC,WAAA,EAAa,IAAA,EAAM,KAAA,CAAM,WAAW,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,WAAA,EAAa,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,YAAA,EAAc,MAAM,WAAW;AAAA,GAC5H;AAEA,EAAA,OAAOC,mBAAA;AAAA,IACL,MAAA;AAAA,IACA,EAAE,QAAA,EAAU,MAAA,EAAQ,SAAA,EAAW,gBAAA,EAAiB;AAAA,IAChDA,oBAAE,OAAA,EAAS;AAAA,MACT,IAAA,EAAM,KAAA,CAAM,OAAA,KAAY,OAAA,GAAU,OAAA,GAAU,KAAA;AAAA,MAC5C,WAAA,EAAa,KAAA,CAAM,OAAA,KAAY,OAAA,GAAU,OAAA,GAAU,OAAA;AAAA,MACnD,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,WAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAU,CAAC,CAAA,KAAqC,cAAA,CAAe,CAAA,CAAE,OAAO,KAAK;AAAA,KAC9E,CAAA;AAAA,IACD,IAAA,GACIA,oBAAE,OAAA,EAAS;AAAA,MACT,IAAA,EAAM,MAAA;AAAA,MACN,SAAA,EAAW,SAAA;AAAA,MACX,YAAA,EAAc,eAAA;AAAA,MACd,WAAA,EAAa,MAAA;AAAA,MACb,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,IAAA;AAAA,MACP,UAAU,CAAC,CAAA,KAAqC,OAAA,CAAQ,CAAA,CAAE,OAAO,KAAK;AAAA,KACvE,CAAA,GACD,IAAA;AAAA,IACJ,KAAA,GAAQA,mBAAA,CAAE,GAAA,EAAK,EAAE,IAAA,EAAM,SAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAK,CAAA,GAAI,IAAA;AAAA,IACzE,IAAA,GACIA,mBAAA,CAAE,QAAA,EAAU,EAAE,MAAM,QAAA,EAAU,QAAA,EAAU,IAAA,EAAM,SAAA,EAAW,eAAA,EAAgB,EAAG,IAAA,GAAO,iBAAA,GAAe,aAAa,CAAA,GAC/GA,mBAAA;AAAA,MACE,QAAA;AAAA,MACA,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,IAAA,IAAQ,CAAC,WAAA,EAAa,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW,eAAA,EAAgB;AAAA,MAC5F,IAAA,GAAO,eAAA,GAAc,KAAA,CAAM,KAAA,IAAS;AAAA;AACtC,GACN;AACF;AAQO,IAAM,KAAA,GAAmC,CAAC,KAAA,KAAU;AACzD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,aAAa,KAAA,CAAM;AAAA,GACrB;AAEA,EAAA,MAAM,WAAA,GAAkD;AAAA,IACtD,MAAA,EAAQ,MAAM,MAAA,EAAQ,YAAA;AAAA,IACtB,MAAA,EAAQ,MAAM,MAAA,EAAQ,YAAA;AAAA,IACtB,KAAA,EAAO,MAAM,MAAA,EAAQ;AAAA,GACvB;AAEA,EAAA,MAAM,WAAwB,EAAC;AAC/B,EAAA,IAAI,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,IAAA,CAAKA,oBAAE,KAAA,EAAO,EAAE,GAAA,EAAK,OAAA,EAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAA,CAAM,KAAK,CAAC,CAAA;AAKpG,EAAA,KAAA,MAAW,QAAA,IAAY,KAAA,CAAM,SAAA,IAAa,EAAC,EAAG;AAC5C,IAAA,IAAI,aAAa,QAAA,EAAU;AACzB,MAAA,QAAA,CAAS,KAAKA,mBAAA,CAAE,YAAA,EAAc,EAAE,GAAA,EAAK,UAAU,GAAG,IAAA,EAAM,KAAA,EAAO,KAAA,CAAM,QAAQ,MAAA,EAAQ,SAAA,EAAW,KAAA,CAAM,SAAA,EAAW,CAAC,CAAA;AAAA,IACpH,CAAA,MAAO;AACL,MAAA,QAAA,CAAS,KAAKA,mBAAA,CAAE,YAAA,EAAc,EAAE,GAAA,EAAK,CAAA,OAAA,EAAU,QAAQ,CAAA,CAAA,EAAI,GAAG,MAAM,QAAA,EAAU,KAAA,EAAO,YAAY,QAAQ,CAAA,EAAG,WAAW,KAAA,CAAM,SAAA,EAAW,CAAC,CAAA;AAAA,IAC3I;AAAA,EACF;AAGA,EAAA,QAAA,CAAS,IAAA,CAAKA,mBAAA,CAAE,iBAAA,EAAmB,EAAE,GAAA,EAAK,UAAA,EAAY,GAAG,IAAA,EAAM,SAAA,EAAW,KAAA,CAAM,SAAA,EAAW,CAAC,CAAA;AAG5F,EAAA,QAAA,CAAS,IAAA,CAAKA,mBAAA,CAAE,KAAA,EAAO,EAAE,GAAA,EAAK,SAAA,EAAW,SAAA,EAAW,mBAAA,EAAoB,EAAG,KAAA,CAAM,MAAA,EAAQ,OAAA,IAAW,IAAI,CAAC,CAAA;AACzG,EAAA,QAAA,CAAS,KAAKA,mBAAA,CAAE,OAAA,EAAS,EAAE,GAAA,EAAK,WAAA,EAAa,GAAG,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,MAAM,MAAA,EAAQ,QAAA,EAAU,WAAW,KAAA,CAAM,SAAA,EAAW,CAAC,CAAA;AAEpI,EAAA,OAAOA,mBAAA,CAAE,OAAO,EAAE,SAAA,EAAW,MAAM,SAAA,IAAa,gBAAA,EAAiB,EAAG,GAAG,QAAQ,CAAA;AACjF;AAQA,IAAM,YAA8B,CAAC,UAAA,EAAY,WAAA,EAAa,WAAA,EAAa,UAAU,QAAQ,CAAA;AAwB7F,eAAe,QAAA,CACb,SAAA,EACA,KAAA,EACA,IAAA,EACA,MACA,aAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,OAAO,QAAA,KAAa,WAAA,IAAe,IAAA,YAAgB,QAAA;AAClE,EAAA,MAAM,GAAA,GAAM,GAAG,aAAA,CAAc,SAAS,CAAC,CAAA,EAAG,SAAA,CAAU,UAAU,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AACtE,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,IAC3B,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA;AAAA,MAC9B,MAAA,EAAQ,kBAAA;AAAA,MACR,GAAI,MAAA,GAAS,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MACvD,GAAI,aAAA,GAAgB,EAAE,kBAAA,EAAoB,aAAA,KAAkB;AAAC,KAC/D;AAAA,IACA,IAAA,EAAM,MAAA,GAAU,IAAA,GAAoB,IAAA,CAAK,UAAU,IAAI;AAAA,GACxD,CAAA;AACD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,IAAA,MAAM,IAAI,MAAM,IAAA,IAAQ,CAAA,WAAA,EAAc,IAAI,CAAA,SAAA,EAAY,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,GAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,EAAA,OAAO,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,aAAA,IAAiB,aAAA,IAAiB,EAAA;AACrE;AAEA,SAAS,aAAA,CAAc,MAAsB,KAAA,EAAkB;AAC7D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIH,eAAS,KAAK,CAAA;AACtC,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAwB,IAAI,CAAA;AACtD,EAAA,MAAM,MAAA,GAASE,iBAAA;AAAA,IACb,OAAO,IAAA,KAA6C;AAClD,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,EAAA,GAAK,MAAM,QAAA,CAAS,KAAA,CAAM,SAAA,EAAW,MAAM,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,KAAA,CAAM,aAAa,CAAA;AACvF,QAAA,KAAA,CAAM,OAAO,EAAE,CAAA;AAAA,MACjB,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,EAAA,GAAK,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D,QAAA,QAAA,CAAS,GAAG,OAAO,CAAA;AACnB,QAAA,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,MACpB,CAAA,SAAE;AACA,QAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,MACf;AAAA,IACF,CAAA;AAAA,IACA,CAAC,IAAA,EAAM,KAAA,CAAM,WAAW,KAAA,CAAM,KAAA,EAAO,MAAM,aAAa;AAAA,GAC1D;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,EAAO;AAC/B;AAGO,IAAM,YAAA,GAAyC,CAAC,KAAA,KAAU;AAC/D,EAAA,MAAM,CAAC,GAAA,EAAK,MAAM,CAAA,GAAIF,eAAS,EAAE,CAAA;AACjC,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,eAAS,EAAE,CAAA;AACzC,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,aAAA,CAAc,YAAY,KAAK,CAAA;AAC/D,EAAA,OAAOG,mBAAA;AAAA,IACL,MAAA;AAAA,IACA;AAAA,MACE,SAAA,EAAW,gBAAA;AAAA,MACX,QAAA,EAAU,CAAC,CAAA,KAAiB;AAC1B,QAAA,CAAA,CAAE,cAAA,EAAe;AACjB,QAAA,KAAK,MAAA,CAAO,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA;AAAA,MAC9B;AAAA,KACF;AAAA,IACAA,oBAAE,OAAA,EAAS,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAU,IAAA,EAAM,KAAA,EAAO,GAAA,EAAK,QAAA,EAAU,CAAC,CAAA,KAAqC,MAAA,CAAO,EAAE,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IAC/HA,oBAAE,OAAA,EAAS,EAAE,MAAM,MAAA,EAAQ,WAAA,EAAa,WAAW,QAAA,EAAU,IAAA,EAAM,OAAO,OAAA,EAAS,QAAA,EAAU,CAAC,CAAA,KAAqC,UAAA,CAAW,EAAE,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IAC/J,KAAA,GAAQA,mBAAA,CAAE,GAAA,EAAK,EAAE,IAAA,EAAM,SAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAK,CAAA,GAAI,IAAA;AAAA,IACzEA,mBAAA,CAAE,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,IAAA,EAAM,SAAA,EAAW,eAAA,EAAgB,EAAG,IAAA,GAAO,cAAA,GAAY,UAAU;AAAA,GAC3G;AACF,CAAA;AAGO,IAAM,aAAA,GAA0C,CAAC,KAAA,KAAU;AAChE,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIH,eAAsB,IAAI,CAAA;AAClD,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,aAAA,CAAc,aAAa,KAAK,CAAA;AAChE,EAAA,OAAOG,mBAAA;AAAA,IACL,MAAA;AAAA,IACA;AAAA,MACE,SAAA,EAAW,gBAAA;AAAA,MACX,QAAA,EAAU,CAAC,CAAA,KAAiB;AAC1B,QAAA,CAAA,CAAE,cAAA,EAAe;AACjB,QAAA,IAAI,CAAC,IAAA,EAAM;AACX,QAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,QAAA,EAAA,CAAG,MAAA,CAAO,YAAY,IAAI,CAAA;AAC1B,QAAA,KAAK,OAAO,EAAE,CAAA;AAAA,MAChB;AAAA,KACF;AAAA,IACAA,oBAAE,OAAA,EAAS;AAAA,MACT,IAAA,EAAM,MAAA;AAAA,MACN,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,CAAC,CAAA,KAA8C,OAAA,CAAQ,EAAE,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA,IAAK,IAAI;AAAA,KAC7F,CAAA;AAAA,IACD,KAAA,GAAQA,mBAAA,CAAE,GAAA,EAAK,EAAE,IAAA,EAAM,SAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAK,CAAA,GAAI,IAAA;AAAA,IACzEA,mBAAA,CAAE,QAAA,EAAU,EAAE,IAAA,EAAM,UAAU,QAAA,EAAU,IAAA,IAAQ,CAAC,IAAA,EAAM,SAAA,EAAW,eAAA,EAAgB,EAAG,IAAA,GAAO,oBAAe,UAAU;AAAA,GACvH;AACF,CAAA;AAGO,IAAM,aAAA,GAA0C,CAAC,KAAA,KAAU;AAChE,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,aAAA,CAAc,aAAa,KAAK,CAAA;AAChE,EAAA,OAAOA,mBAAA;AAAA,IACL,KAAA;AAAA,IACA,EAAE,WAAW,gBAAA,EAAiB;AAAA,IAC9B,KAAA,GAAQA,mBAAA,CAAE,GAAA,EAAK,EAAE,IAAA,EAAM,SAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAK,CAAA,GAAI,IAAA;AAAA,IACzEA,mBAAA;AAAA,MACE,QAAA;AAAA,MACA,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,MAAM,SAAA,EAAW,eAAA,EAAiB,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA,EAAE;AAAA,MAC5G,OAAO,gBAAA,GAAc;AAAA;AACvB,GACF;AACF,CAAA;AAGO,IAAM,UAAA,GAAuC,CAAC,KAAA,KAAU;AAC7D,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,aAAA,CAAc,UAAU,KAAK,CAAA;AAC7D,EAAA,OAAOA,mBAAA;AAAA,IACL,KAAA;AAAA,IACA,EAAE,WAAW,gBAAA,EAAiB;AAAA,IAC9B,KAAA,GAAQA,mBAAA,CAAE,GAAA,EAAK,EAAE,IAAA,EAAM,SAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAK,CAAA,GAAI,IAAA;AAAA,IACzEA,mBAAA;AAAA,MACE,QAAA;AAAA,MACA,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,MAAM,SAAA,EAAW,eAAA,EAAiB,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,EAAE,YAAA,EAAc,IAAA,EAAM,CAAA,EAAE;AAAA,MACjH,OAAO,iBAAA,GAAe;AAAA;AACxB,GACF;AACF,CAAA;AAGO,IAAM,UAAA,GAAuC,CAAC,KAAA,KAAU;AAC7D,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,aAAA,CAAc,UAAU,KAAK,CAAA;AAC7D,EAAA,OAAOA,mBAAA;AAAA,IACL,KAAA;AAAA,IACA,EAAE,WAAW,gBAAA,EAAiB;AAAA,IAC9B,KAAA,GAAQA,mBAAA,CAAE,GAAA,EAAK,EAAE,IAAA,EAAM,SAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAK,CAAA,GAAI,IAAA;AAAA,IACzEA,mBAAA;AAAA,MACE,QAAA;AAAA,MACA,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,MAAM,SAAA,EAAW,eAAA,EAAiB,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,EAAE;AAAA,MAC7G,OAAO,kBAAA,GAAgB;AAAA;AACzB,GACF;AACF,CAAA;AAEA,IAAM,cAAA,GAAmE;AAAA,EACvE,QAAA,EAAU,YAAA;AAAA,EACV,SAAA,EAAW,aAAA;AAAA,EACX,SAAA,EAAW,aAAA;AAAA,EACX,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ;AACV,CAAA;AAOO,IAAM,cAAA,GAAqD,CAAC,KAAA,KAAU;AAC3E,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,SAAA;AAC7B,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIH,eAAS,CAAC,CAAA;AACpC,EAAA,MAAM,CAAC,aAAA,EAAe,gBAAgB,CAAA,GAAIA,eAA6B,MAAS,CAAA;AAEhF,EAAA,MAAM,MAAA,GAASE,iBAAA;AAAA,IACb,CAAC,EAAA,KAAe;AACd,MAAA,gBAAA,CAAiB,MAAM,MAAS,CAAA;AAChC,MAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAC7B,QAAA,KAAA,CAAM,aAAa,EAAE,CAAA;AAAA,MACvB,CAAA,MAAO;AACL,QAAA,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,MACpB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,KAAA,EAAO,KAAA,CAAM,MAAM;AAAA,GACtB;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAK,CAAA;AACxB,EAAA,MAAM,QAAA,GAAW,eAAe,IAAI,CAAA;AAEpC,EAAA,OAAOC,mBAAA;AAAA,IACL,KAAA;AAAA,IACA,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,IAAa,gBAAA,EAAiB;AAAA,IACjD,KAAA,CAAM,KAAA,GAAQA,mBAAA,CAAE,KAAA,EAAO,EAAE,GAAA,EAAK,OAAA,EAAS,SAAA,EAAW,iBAAA,EAAkB,EAAG,KAAA,CAAM,KAAK,CAAA,GAAI,IAAA;AAAA,IACtFA,mBAAA,CAAE,KAAA,EAAO,EAAE,GAAA,EAAK,YAAY,SAAA,EAAW,oBAAA,EAAqB,EAAG,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,IAC/FA,mBAAA,CAAE,QAAA,EAAU,EAAE,GAAA,EAAK,IAAA,EAAM,SAAA,EAAW,KAAA,CAAM,SAAA,EAAW,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,aAAA,EAAe,QAAQ;AAAA,GAClG;AACF;;;ACzkBA,IAAM,UAAA,GAAaC,oBAAsC,IAAI;AAC7D,UAAA,CAAW,WAAA,GAAc,YAAA;AAGzB,IAAM,eAAA,GAAkB,uBAAA;AACxB,IAAM,mBAAA,GAAsB,2BAAA;AAC5B,IAAM,mBAAA,GAAsB,sBAAA;AAYrB,SAAS,YAAY,KAAA,EAAyB;AACnD,EAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,GAAW,IAAA,EAAM,YAAA,EAAc,UAAS,GAAI,KAAA;AAE5D,EAAA,MAAM,GAAA,GAAMC,aAAA;AAAA,IACV,MAAM,IAAI,GAAA,CAAI,MAAM,CAAA;AAAA;AAAA,IAEpB,CAAC,MAAA,CAAO,SAAA,EAAW,MAAA,CAAO,QAAA,EAAU,OAAO,WAAW;AAAA,GACxD;AAEA,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIL,eAAsB,IAAI,CAAA;AAClD,EAAA,MAAM,CAAC,eAAA,EAAiB,kBAAkB,CAAA,GAAIA,eAAS,KAAK,CAAA;AAC5D,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAIA,eAAS,QAAQ,CAAA;AACnD,EAAA,MAAM,CAAC,WAAA,EAAa,cAAc,CAAA,GAAIA,cAAAA;AAAA,IACpC,IAAI,cAAA;AAAe,GACrB;AACA,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AACrD,EAAA,MAAM,eAAA,GAAkBM,aAA6C,IAAI,CAAA;AAGzE,EAAA,MAAM,eAAA,GAAkBJ,kBAAY,MAAM;AACxC,IAAA,IAAI,eAAA,CAAgB,OAAA,EAAS,YAAA,CAAa,eAAA,CAAgB,OAAO,CAAA;AACjE,IAAA,IAAI,GAAA,CAAI,gBAAe,EAAG;AAE1B,IAAA,MAAM,OAAA,GAAU,OAAO,OAAA,IAAW,cAAA;AAClC,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,mBAAmB,CAAA;AACxD,IAAA,IAAI,CAAC,YAAA,EAAc;AAEnB,IAAA,MAAM,iBAAiB,MAAA,CAAO,YAAY,CAAA,GAAI,IAAA,CAAK,KAAI,GAAI,GAAA;AAC3D,IAAA,IAAI,kBAAkB,CAAA,EAAG;AACvB,MAAA,GAAA,CACG,kBAAA,EAAmB,CACnB,IAAA,CAAK,CAAC,MAAA,KAAW;AAChB,QAAA,cAAA,CAAe,OAAO,WAAW,CAAA;AACjC,QAAA,eAAA,EAAgB;AAAA,MAClB,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AACX,QAAA,kBAAA,CAAmB,KAAK,CAAA;AACxB,QAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,QAAA,cAAA,CAAe,IAAI,CAAA;AAAA,MACrB,CAAC,CAAA;AACH,MAAA;AAAA,IACF;AAEA,IAAA,eAAA,CAAgB,OAAA,GAAU,WAAW,YAAY;AAC/C,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,kBAAA,EAAmB;AAC5C,QAAA,cAAA,CAAe,OAAO,WAAW,CAAA;AACjC,QAAA,eAAA,EAAgB;AAAA,MAClB,CAAA,CAAA,MAAQ;AACN,QAAA,kBAAA,CAAmB,KAAK,CAAA;AACxB,QAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,QAAA,cAAA,CAAe,IAAI,CAAA;AAAA,MACrB;AAAA,IACF,GAAG,cAAc,CAAA;AAAA,EACnB,CAAA,EAAG,CAAC,GAAA,EAAK,MAAA,CAAO,OAAO,CAAC,CAAA;AAGxB,EAAAD,gBAAU,MAAM;AACd,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,MAAM,OAAO,YAAY;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,mBAAA,EAAoB;AAC5C,QAAA,IAAI,SAAA,EAAW;AACf,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,cAAA,CAAe,KAAK,CAAA;AACpB,UAAA,kBAAA,CAAmB,IAAI,CAAA;AACvB,UAAA,IAAI;AACF,YAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,YAAA,IAAI,CAAC,SAAA,EAAW,OAAA,CAAQ,IAAuB,CAAA;AAAA,UACjD,CAAA,CAAA,MAAQ;AAAA,UAER;AACA,UAAA,eAAA,EAAgB;AAChB,UAAA,YAAA,GAAe,IAAI,CAAA;AAAA,QACrB,CAAA,MAAO;AACL,UAAA,YAAA,GAAe,KAAK,CAAA;AAAA,QACtB;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,QAAA,CAAS,GAAA,YAAe,QAAQ,GAAA,GAAM,IAAI,MAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAC5D,UAAA,YAAA,GAAe,KAAK,CAAA;AAAA,QACtB;AAAA,MACF,CAAA,SAAE;AACA,QAAA,IAAI,CAAC,SAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,MACpC;AAAA,IACF,CAAA;AAEA,IAAA,IAAA,EAAK;AACL,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EAEF,CAAA,EAAG,CAAC,GAAA,EAAK,QAAQ,CAAC,CAAA;AAGlB,EAAAA,gBAAU,MAAM;AACd,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,eAAA,CAAgB,OAAA,EAAS,YAAA,CAAa,eAAA,CAAgB,OAAO,CAAA;AAAA,IACnE,CAAA;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAGL,EAAA,MAAM,YAAA,GAAeC,iBAAAA;AAAA,IACnB,OAAO,MAAA,KAAqB;AAC1B,MAAA,cAAA,CAAe,OAAO,WAAW,CAAA;AACjC,MAAA,kBAAA,CAAmB,IAAI,CAAA;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,QAAA,OAAA,CAAQ,IAAuB,CAAA;AAAA,MACjC,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,eAAA,EAAgB;AAChB,MAAA,YAAA,GAAe,IAAI,CAAA;AAAA,IACrB,CAAA;AAAA,IACA,CAAC,GAAA,EAAK,eAAA,EAAiB,YAAY;AAAA,GACrC;AAEA,EAAA,MAAM,KAAA,GAAQA,iBAAAA;AAAA,IACZ,OAAO,MAAA,KAA2D;AAChE,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,MAAM,GAAA,CAAI,eAAe,MAAM,CAAA;AAAA,IACjC,CAAA;AAAA,IACA,CAAC,GAAG;AAAA,GACN;AAEA,EAAA,MAAM,UAAA,GAAaA,iBAAAA;AAAA,IACjB,OAAO,MAAA,KAAiD;AACtD,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,WAAA,CAAY,MAAM,CAAA;AAC3C,QAAA,MAAM,aAAa,MAAM,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,CAAA,GAAI,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC5D,QAAA,QAAA,CAAS,CAAC,CAAA;AACV,QAAA,MAAM,CAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IACA,CAAC,KAAK,YAAY;AAAA,GACpB;AAEA,EAAA,MAAMK,eAAAA,GAAiBL,iBAAAA;AAAA,IACrB,OAAO,WAAA,KAAyB;AAC9B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,cAAA,CAAe,WAAW,CAAA;AACnD,QAAA,MAAM,aAAa,MAAM,CAAA;AACzB,QAAA,OAAO,MAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,CAAA,GAAI,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC5D,QAAA,QAAA,CAAS,CAAC,CAAA;AACV,QAAA,MAAM,CAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IACA,CAAC,KAAK,YAAY;AAAA,GACpB;AAEA,EAAA,MAAMM,OAAAA,GAASN,kBAAY,MAAM;AAC/B,IAAA,GAAA,CAAI,WAAA,EAAY;AAChB,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,kBAAA,CAAmB,KAAK,CAAA;AACxB,IAAA,cAAA,CAAe,IAAI,CAAA;AACnB,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,IAAI,eAAA,CAAgB,OAAA,EAAS,YAAA,CAAa,eAAA,CAAgB,OAAO,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,YAAA,CAAa,WAAW,eAAe,CAAA;AACvC,MAAA,YAAA,CAAa,WAAW,mBAAmB,CAAA;AAAA,IAC7C,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,YAAA,GAAe,KAAK,CAAA;AAAA,EACtB,CAAA,EAAG,CAAC,GAAA,EAAK,YAAY,CAAC,CAAA;AAEtB,EAAA,MAAM,KAAA,GAAQG,aAAA;AAAA,IACZ,OAAO;AAAA,MACL,GAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA;AAAA,MACA,KAAA;AAAA,MACA,UAAA;AAAA,MACA,cAAA,EAAAE,eAAAA;AAAA,MACA,MAAA,EAAAC,OAAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA;AAAA,MACE,GAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA;AAAA,MACA,KAAA;AAAA,MACA,UAAA;AAAA,MACAD,eAAAA;AAAA,MACAC,OAAAA;AAAA,MACA;AAAA;AACF,GACF;AAEA,EAAA,OAAOC,oBAAc,UAAA,CAAW,QAAA,EAAU,EAAE,KAAA,IAAS,QAAQ,CAAA;AAC/D;AAUO,SAAS,MAAA,GAA0B;AACxC,EAAA,MAAM,GAAA,GAAMC,iBAAW,UAAU,CAAA;AACjC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,GAAA;AACT;AAaO,SAAS,gBAAA,GAA6B;AAC3C,EAAA,MAAM,EAAE,eAAA,EAAiB,WAAA,EAAY,GAAI,MAAA,EAAO;AAChD,EAAA,MAAM,CAAC,aAAA,EAAe,gBAAgB,CAAA,GAAIV,cAAAA,CAAyB,EAAE,CAAA;AAErE,EAAA,MAAM,CAAC,YAAA,EAAc,eAAe,CAAA,GAAIA,eAAwB,MAAM;AACpE,IAAA,IAAI;AACF,MAAA,OAAO,YAAA,CAAa,QAAQ,eAAe,CAAA;AAAA,IAC7C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,CAAC,gBAAA,EAAkB,mBAAmB,CAAA,GAAIA,cAAAA;AAAA,IAC9C,MAAM;AACJ,MAAA,IAAI;AACF,QAAA,OAAO,YAAA,CAAa,QAAQ,mBAAmB,CAAA;AAAA,MACjD,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAAA,GACF;AAMA,EAAAC,gBAAU,MAAM;AACd,IAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,WAAA,EAAa;AACpC,MAAA,gBAAA,CAAiB,EAAE,CAAA;AACnB,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,WAAA,CAAY,MAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA;AAC1D,MAAA,MAAM,GAAA,GAAO,QAAQ,GAAA,IAAkB,EAAA;AACvC,MAAA,MAAM,KAAA,GAAS,QAAQ,KAAA,IAAoB,EAAA;AAC3C,MAAA,MAAM,UAAA,GAAa,KAAA,KAAU,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,GAAI,EAAA,CAAA;AACrE,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,MAAM,YAAA,GAA6B;AAAA,UACjC,KAAA,EAAO,OAAA;AAAA,UACP,IAAA,EAAM,UAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AACA,QAAA,gBAAA,CAAiB,CAAC,YAAY,CAAC,CAAA;AAC/B,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA,eAAA,CAAgB,UAAU,CAAA;AAC1B,UAAA,IAAI;AACF,YAAA,YAAA,CAAa,OAAA,CAAQ,iBAAiB,UAAU,CAAA;AAAA,UAClD,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EAEF,CAAA,EAAG,CAAC,eAAA,EAAiB,WAAW,CAAC,CAAA;AAEjC,EAAA,MAAM,WAAsB,EAAC;AAC7B,EAAA,MAAM,cAAA,GAAiC,IAAA;AAEvC,EAAA,MAAM,UAAA,GAAaI,aAAA;AAAA,IACjB,MAAM,cAAc,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,YAAY,CAAA,IAAK,IAAA;AAAA,IAC5D,CAAC,eAAe,YAAY;AAAA,GAC9B;AAEA,EAAA,MAAM,SAAA,GAAYH,iBAAAA,CAAY,CAAC,KAAA,KAAkB;AAC/C,IAAA,eAAA,CAAgB,KAAK,CAAA;AACrB,IAAA,mBAAA,CAAoB,IAAI,CAAA;AACxB,IAAA,IAAI;AACF,MAAA,YAAA,CAAa,OAAA,CAAQ,iBAAiB,KAAK,CAAA;AAC3C,MAAA,YAAA,CAAa,WAAW,mBAAmB,CAAA;AAAA,IAC7C,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgBA,iBAAAA,CAAY,CAAC,SAAA,KAA6B;AAC9D,IAAA,mBAAA,CAAoB,SAAS,CAAA;AAC7B,IAAA,IAAI;AACF,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,YAAA,CAAa,OAAA,CAAQ,qBAAqB,SAAS,CAAA;AAAA,MACrD,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,WAAW,mBAAmB,CAAA;AAAA,MAC7C;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,OAAO;AAAA,IACL,aAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA;AAAA,IACA,cAAA;AAAA,IACA,gBAAA;AAAA,IACA,aAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACb;AACF;AAUO,SAAS,WAAA,GAId;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,WAAA,EAAa,eAAA,KAAoB,MAAA,EAAO;AAErD,EAAA,MAAM,OAAA,GAAUA,kBAAY,YAAY;AACtC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAI,mBAAA,EAAoB;AAAA,IACvC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAA,EAAG,CAAC,GAAG,CAAC,CAAA;AAER,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,WAAA;AAAA,IACP,SAAS,eAAA,IAAmB,CAAC,CAAC,WAAA,IAAe,CAAC,IAAI,cAAA,EAAe;AAAA,IACjE;AAAA,GACF;AACF;AAmCO,SAAS,kBAAA,CAAmB;AAAA,EACjC,aAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAW,EAAC;AAAA,EACZ,gBAAA,GAAmB,IAAA;AAAA,EACnB,aAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA,GAAY,EAAA;AAAA,EACZ,UAAA,GAAa;AACf,CAAA,EAA4B;AAC1B,EAAAD,gBAAU,MAAM;AACd,IAAA,cAAA,GAAiB,YAAA,EAAc,oBAAoB,IAAI,CAAA;AAAA,EACzD,CAAA,EAAG,CAAC,YAAA,EAAc,gBAAA,EAAkB,cAAc,CAAC,CAAA;AAEnD,EAAA,MAAM,eAAA,GAAkBC,iBAAAA;AAAA,IACtB,CAAC,CAAA,KAAqC,SAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AAAA,IAC9D,CAAC,SAAS;AAAA,GACZ;AAEA,EAAA,MAAM,mBAAA,GAAsBA,iBAAAA;AAAA,IAC1B,CAAC,CAAA,KAAqC,aAAA,GAAgB,CAAA,CAAE,MAAA,CAAO,SAAS,IAAI,CAAA;AAAA,IAC5E,CAAC,aAAa;AAAA,GAChB;AAEA,EAAA,IAAI,CAAC,UAAA,IAAc,aAAA,CAAc,UAAU,CAAA,IAAK,QAAA,CAAS,UAAU,CAAA,EAAG;AACpE,IAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,MAAA,MAAM,GAAA,GAAM,cAAc,CAAC,CAAA;AAC3B,MAAA,OAAOO,mBAAA;AAAA,QACL,KAAA;AAAA,QACA,EAAE,SAAA,EAAW,CAAA,gCAAA,EAAmC,SAAS,CAAA,CAAA,EAAG;AAAA,QAC5DA,mBAAA,CAAc,QAAQ,EAAE,SAAA,EAAW,eAAc,EAAG,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,IAAI,CAAA;AAAA,QAC/E,QAAA,CAAS,WAAW,CAAA,GAChB;AAAA,UACEA,mBAAA,CAAc,QAAQ,EAAE,SAAA,EAAW,yBAAyB,GAAA,EAAK,KAAA,IAAS,GAAG,CAAA;AAAA,UAC7EA,mBAAA,CAAc,MAAA,EAAQ,EAAE,GAAA,EAAK,MAAA,EAAO,EAAG,QAAA,CAAS,CAAC,CAAA,CAAE,WAAA,IAAe,QAAA,CAAS,CAAC,EAAE,IAAI;AAAA,SACpF,GACA,IAAA;AAAA,QACJ,WAAA,GACIA,mBAAA;AAAA,UACE,MAAA;AAAA,UACA,EAAE,WAAW,iEAAA,EAAkE;AAAA,UAC/E;AAAA,SACF,GACA;AAAA,OACN;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAOA,mBAAA;AAAA,IACL,KAAA;AAAA,IACA,EAAE,SAAA,EAAW,CAAA,wBAAA,EAA2B,SAAS,CAAA,CAAA,EAAG;AAAA,IACpDA,mBAAA;AAAA,MACE,QAAA;AAAA,MACA;AAAA,QACE,OAAO,YAAA,IAAgB,EAAA;AAAA,QACvB,QAAA,EAAU,eAAA;AAAA,QACV,SAAA,EACE,gIAAA;AAAA,QACF,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,GAAG,aAAA,CAAc,GAAA;AAAA,QAAI,CAAC,GAAA,KACpBA,mBAAA,CAAc,QAAA,EAAU,EAAE,GAAA,EAAK,GAAA,CAAI,IAAA,EAAM,KAAA,EAAO,IAAI,IAAA,EAAK,EAAG,GAAA,CAAI,WAAA,IAAe,IAAI,IAAI;AAAA;AACzF,KACF;AAAA,IACA,QAAA,CAAS,MAAA,GAAS,CAAA,IAAK,aAAA,GACnB;AAAA,MACEA,mBAAA,CAAc,QAAQ,EAAE,SAAA,EAAW,yBAAyB,GAAA,EAAK,KAAA,IAAS,GAAG,CAAA;AAAA,MAC7EA,mBAAA;AAAA,QACE,QAAA;AAAA,QACA;AAAA,UACE,GAAA,EAAK,aAAA;AAAA,UACL,OAAO,gBAAA,IAAoB,EAAA;AAAA,UAC3B,QAAA,EAAU,mBAAA;AAAA,UACV,SAAA,EACE,gIAAA;AAAA,UACF,YAAA,EAAc;AAAA,SAChB;AAAA,QACA,GAAG,QAAA,CAAS,GAAA;AAAA,UAAI,CAAC,IAAA,KACfA,mBAAA,CAAc,QAAA,EAAU,EAAE,GAAA,EAAK,IAAA,CAAK,IAAA,EAAM,KAAA,EAAO,KAAK,IAAA,EAAK,EAAG,IAAA,CAAK,WAAA,IAAe,KAAK,IAAI;AAAA;AAC7F;AACF,KACF,GACA,IAAA;AAAA,IACJ,WAAA,GACIA,mBAAA;AAAA,MACE,MAAA;AAAA,MACA,EAAE,WAAW,iEAAA,EAAkE;AAAA,MAC/E;AAAA,KACF,GACA;AAAA,GACN;AACF","file":"react.cjs","sourcesContent":["/**\n * PKCE (Proof Key for Code Exchange, RFC 7636) utilities for OAuth2/OIDC.\n *\n * Uses the native Web Crypto API (`crypto.getRandomValues`,\n * `crypto.subtle.digest`) — available in modern browsers and Node ≥ 18.\n *\n * The code verifier is the base64url encoding of 32 cryptographically\n * random bytes (256 bits of entropy), which yields a 43-character\n * `[A-Za-z0-9-_]` string — within RFC 7636's 43–128 character range and\n * well above the minimum recommended entropy. The challenge is the\n * base64url-encoded SHA-256 of the verifier (the `S256` method).\n */\n\n/** Number of random bytes for the verifier and state — 256 bits each. */\nconst ENTROPY_BYTES = 32;\n\nfunction randomBase64Url(byteLength: number): string {\n  const bytes = new Uint8Array(byteLength);\n  crypto.getRandomValues(bytes);\n  return base64UrlEncode(bytes.buffer);\n}\n\nasync function sha256(plain: string): Promise<ArrayBuffer> {\n  const encoder = new TextEncoder();\n  return crypto.subtle.digest(\"SHA-256\", encoder.encode(plain));\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Generate a PKCE code verifier + S256 challenge pair.\n *\n * `codeVerifier` carries 256 bits of entropy; `codeChallenge` is its\n * base64url-encoded SHA-256 digest. Send `code_challenge` +\n * `code_challenge_method=S256` on the authorize request, and\n * `code_verifier` on the token exchange.\n */\nexport async function generatePKCEChallenge(): Promise<{\n  codeVerifier: string;\n  codeChallenge: string;\n}> {\n  const codeVerifier = randomBase64Url(ENTROPY_BYTES);\n  const hash = await sha256(codeVerifier);\n  const codeChallenge = base64UrlEncode(hash);\n  return { codeVerifier, codeChallenge };\n}\n\n/** Generate a high-entropy (256-bit) `state` parameter for CSRF protection. */\nexport function generateState(): string {\n  return randomBase64Url(ENTROPY_BYTES);\n}\n","/**\n * The single source of truth for Hanzo IAM OIDC endpoint paths.\n *\n * Hanzo IAM is a Casdoor-derived OIDC provider served per-brand from a\n * configurable origin (`serverUrl`): hanzo → https://iam.hanzo.ai,\n * lux → https://lux.id, zoo → https://zoo.id, bootnode → https://id.bootno.de.\n *\n * These are the ONLY paths. There is no legacy `/oauth/*` and no\n * `/api/login/*`. Every module in this SDK references `OIDC_PATHS` —\n * no path string is written anywhere else.\n *\n * CRITICAL GOTCHA: IAM serves a 200 `text/html` SPA catch-all for ANY\n * unregistered path. A client that hits a wrong path therefore gets a\n * 200 HTML body, not a 404 — silent breakage. So clients MUST hit these\n * exact paths, and a discovery round-trip must never be allowed to\n * resolve to a different path. The hard-coded fallbacks here are these\n * same values, so a failed discovery degrades to correct paths.\n */\n\n/** OIDC endpoint paths, relative to the brand `serverUrl`. */\nexport const OIDC_PATHS = {\n  /** OIDC discovery document. */\n  discovery: \"/.well-known/openid-configuration\",\n  /** Authorization endpoint (RFC 6749 §3.1). */\n  authorize: \"/v1/iam/oauth/authorize\",\n  /** Token endpoint (RFC 6749 §3.2). */\n  token: \"/v1/iam/oauth/token\",\n  /** UserInfo endpoint (OIDC Core §5.3). */\n  userinfo: \"/v1/iam/oauth/userinfo\",\n  /** JWKS endpoint (RFC 7517). */\n  jwks: \"/v1/iam/.well-known/jwks\",\n  /** RP-initiated logout endpoint (OIDC RP-Initiated Logout). */\n  logout: \"/v1/iam/oauth/logout\",\n} as const;\n\nexport type OidcPathKey = keyof typeof OIDC_PATHS;\n\n/**\n * Hanzo-IAM application paths that are NOT part of the OIDC spec — the\n * auth-method discovery endpoint and the onboarding state machine the\n * embedded views drive. Mounted under the same `/v1/iam` prefix.\n */\nexport const IAM_PATHS = {\n  /** Live list of enabled auth methods for the embedded login views. */\n  authMethods: \"/v1/iam/auth/methods\",\n  /** Onboarding state-machine base (steps append `/identity`, etc.). */\n  onboarding: \"/v1/iam/onboarding\",\n  /**\n   * Casdoor credential-login endpoint the embedded `<Login>` views POST to.\n   * `type=code` (a client `redirectUri` is present) mints an authorization\n   * code returned in `data`; `type=login` establishes the session cookie.\n   * This is what the deployed IAM actually authenticates against — the OIDC\n   * token endpoint's password/OTP grants are NOT enabled per-client.\n   */\n  login: \"/v1/iam/login\",\n  /** Send an email/SMS verification code (passwordless login). */\n  sendCode: \"/v1/iam/send-verification-code\",\n  /** Account registration. */\n  signup: \"/v1/iam/signup\",\n  /**\n   * Sign-In-with-X (SIWx / EIP-4361) nonce endpoint. Issues a server-owned,\n   * single-use nonce (and the exact message to sign) so the wallet signature\n   * cannot be replayed. The client NEVER invents the challenge — the server\n   * is the authority over the message content and the nonce lifetime.\n   */\n  web3Nonce: \"/v1/iam/web3/nonce\",\n  /**\n   * SIWx verify endpoint. The client POSTs the exact signed message +\n   * signature (and a PKCE `code_challenge`); the server recovers the signer\n   * from the signature (never trusting a client-supplied address), validates\n   * the nonce, and returns a PKCE-bound authorization `code`. The SAME\n   * RFC 7636 exchange then completes it through `handleCallback`.\n   */\n  web3Verify: \"/v1/iam/web3/verify\",\n} as const;\n\nexport type IamPathKey = keyof typeof IAM_PATHS;\n\n/**\n * The canonical `serverUrl` origin for each Hanzo IAM brand. White-label\n * is host-based: one IAM deployment serves every brand and selects the\n * tenant by the origin it is reached on. This is the SINGLE place the\n * brand→origin mapping lives — adapters take a `brand` and resolve here\n * rather than each app hard-coding a hostname.\n */\nexport const BRAND_SERVER_URLS = {\n  hanzo: \"https://iam.hanzo.ai\",\n  lux: \"https://lux.id\",\n  zoo: \"https://zoo.id\",\n  bootnode: \"https://id.bootno.de\",\n  pars: \"https://pars.id\",\n} as const;\n\n/** A known Hanzo IAM brand key. */\nexport type IamBrand = keyof typeof BRAND_SERVER_URLS;\n\n/**\n * Resolve a brand to its canonical IAM `serverUrl`.\n *\n * @example\n * serverUrlForBrand(\"lux\") // → \"https://lux.id\"\n */\nexport function serverUrlForBrand(brand: IamBrand): string {\n  return BRAND_SERVER_URLS[brand];\n}\n\n/** Strip trailing slashes from a server origin so paths concat cleanly. */\nexport function trimServerUrl(serverUrl: string): string {\n  return serverUrl.replace(/\\/+$/, \"\");\n}\n\n/**\n * Build an absolute IAM endpoint URL from a server origin and a path key.\n *\n * @example\n * iamUrl(\"https://iam.hanzo.ai\", \"token\") // → \"https://iam.hanzo.ai/v1/iam/oauth/token\"\n */\nexport function iamUrl(serverUrl: string, key: OidcPathKey): string {\n  return `${trimServerUrl(serverUrl)}${OIDC_PATHS[key]}`;\n}\n","/**\n * Browser-side OAuth2/OIDC PKCE flow for Hanzo IAM.\n *\n * Standards core: RFC 6749 (OAuth2), RFC 7636 (PKCE), OIDC. The default\n * flow is a single redirect-to-authorize where the IAM server owns the\n * credential interaction. For first-party apps that render their OWN\n * branded login on their own domain, the embedded credential methods\n * (`loginWithPassword` / `loginWithCode`) collect the credential in-app and\n * mint a PKCE-bound authorization code via the IAM login endpoint — the\n * SAME RFC 7636 code+PKCE exchange completes it through `handleCallback`.\n * (Not ROPC: no password ever hits the token endpoint.)\n *\n *   IAM#signinRedirect()    — start PKCE redirect to the authorize endpoint\n *   IAM#handleCallback()    — exchange code at the token endpoint (PKCE)\n *   IAM#loginWithPassword() — first-party embedded login → PKCE-bound code\n *   IAM#loginWithCode()     — embedded passwordless code login → PKCE code\n *   IAM#loginWithWallet()   — inline SIWx (EIP-4361) → PKCE-bound code, no redirect\n *   IAM#sendLoginCode()     — send an email/SMS verification code\n *   IAM#refreshAccessToken()— refresh grant\n *   IAM#signinPopup()       — in-place social login via popup + postMessage\n *   completePopupSignin()   — the popup's callback-page half of signinPopup\n *   IAM#signinSilent()      — prompt=none iframe attempt\n *   IAM#getUserInfo()       — userinfo endpoint\n *   IAM#logout()            — RP-initiated logout\n *\n * Every endpoint resolves through `OIDC_PATHS` (see ./paths). Live OIDC\n * discovery is preferred when reachable; the hard-coded fallback uses\n * the exact same canonical paths so a CORS/network failure degrades to\n * correct URLs, never to the IAM HTML SPA catch-all.\n */\n\nimport type { Config, TokenResponse, OidcDiscovery } from \"./types.js\";\nimport { generatePKCEChallenge, generateState } from \"./pkce.js\";\nimport { OIDC_PATHS, IAM_PATHS, iamUrl, trimServerUrl } from \"./paths.js\";\n\n// ---------------------------------------------------------------------------\n// Storage keys\n// ---------------------------------------------------------------------------\n\nconst STORAGE_PREFIX = \"hanzo_iam_\";\nconst KEY_STATE = `${STORAGE_PREFIX}state`;\nconst KEY_CODE_VERIFIER = `${STORAGE_PREFIX}code_verifier`;\nconst KEY_ACCESS_TOKEN = `${STORAGE_PREFIX}access_token`;\nconst KEY_REFRESH_TOKEN = `${STORAGE_PREFIX}refresh_token`;\nconst KEY_ID_TOKEN = `${STORAGE_PREFIX}id_token`;\nconst KEY_EXPIRES_AT = `${STORAGE_PREFIX}expires_at`;\n\n// Per-attempt PKCE verifier slot, keyed by the attempt's `state`. Isolates\n// concurrent logins (double-click, a racing signinSilent, a re-run React\n// effect) so a second attempt can never stomp the first's verifier. Note the\n// trailing `:` keeps it disjoint from the legacy single slot KEY_CODE_VERIFIER.\nconst KEY_VERIFIER_PREFIX = `${KEY_CODE_VERIFIER}:`;\nfunction verifierKey(state: string): string {\n  return `${KEY_VERIFIER_PREFIX}${state}`;\n}\n\n// Because the transaction lives in localStorage (survives the redirect + ITP)\n// it also persists across tabs and abandoned redirects — orphan slots would\n// accumulate. Each slot is stamped with its issue time as `${ms}.${verifier}`\n// (the base64url verifier never contains `.`), and a fresh login sweeps only\n// slots older than this TTL. A concurrent sibling attempt is seconds old, so\n// it is NEVER swept; a slot no callback consumed within the window is GC'd.\n// 15 min is far longer than any real redirect round-trip, shorter than a leak.\nconst VERIFIER_TTL_MS = 15 * 60 * 1000;\n\n/** Stamp a verifier with its issue time for the per-attempt slot value. */\nfunction encodeSlot(codeVerifier: string, nowMs: number): string {\n  return `${nowMs}.${codeVerifier}`;\n}\n\n/**\n * Decode a per-attempt slot value into `{ issuedAt, codeVerifier }`. Tolerates\n * a raw (un-stamped) value by reporting `issuedAt: 0` — it is still a usable\n * verifier, just always considered old by the sweep.\n */\nfunction decodeSlot(value: string): { issuedAt: number; codeVerifier: string } {\n  const dot = value.indexOf(\".\");\n  if (dot > 0) {\n    const head = value.slice(0, dot);\n    if (/^\\d+$/.test(head)) {\n      return { issuedAt: Number(head), codeVerifier: value.slice(dot + 1) };\n    }\n  }\n  return { issuedAt: 0, codeVerifier: value };\n}\n\n// ---------------------------------------------------------------------------\n// Popup handshake contract\n// ---------------------------------------------------------------------------\n\n/**\n * The `window.name` the popup opens with, and the `source` tag every popup\n * message carries. Both are part of the opener↔popup contract: the opener\n * only accepts a message whose `source` is exactly this, from exactly the\n * callback origin, carrying exactly the `state` it generated.\n */\nexport const POPUP_WINDOW_NAME = \"hanzo_iam_login\";\nconst POPUP_MESSAGE_SOURCE = \"hanzo-iam\" as const;\n\n/**\n * The one-shot message the callback page posts back to the opener. Never\n * carries a token — only the freshly minted authorization `code` + `state`\n * (or an OAuth `error`). The opener completes the PKCE token exchange with\n * the verifier it holds; the code alone is useless without that verifier.\n */\ninterface PopupMessage {\n  source: typeof POPUP_MESSAGE_SOURCE;\n  code?: string;\n  state?: string;\n  error?: string;\n}\n\n// ---------------------------------------------------------------------------\n// EIP-1193 wallet provider (minimal structural type — no web3 dependency)\n// ---------------------------------------------------------------------------\n\n/**\n * The minimal EIP-1193 surface the inline SIWx wallet login needs. Kept\n * structural so the SDK never depends on ethers/viem/web3.js — any injected\n * provider (`window.ethereum`, WalletConnect, Coinbase, …) satisfies it.\n */\nexport interface Eip1193Provider {\n  request(args: { method: string; params?: readonly unknown[] | object }): Promise<unknown>;\n}\n\n// ---------------------------------------------------------------------------\n// Config\n// ---------------------------------------------------------------------------\n\nexport type IAMConfig = Config & {\n  /** OAuth2 redirect URI (e.g. \"https://app.hanzo.bot/auth/callback\"). */\n  redirectUri: string;\n  /** OAuth2 scopes (default: \"openid profile email\"). */\n  scope?: string;\n  /** Storage to use for tokens (default: sessionStorage). */\n  storage?: Storage;\n  /**\n   * Optional proxy base URL for the token + userinfo endpoints.\n   * When set, token exchange POSTs hit `${proxyBaseUrl}/v1/iam/oauth/token`\n   * and userinfo GETs hit `${proxyBaseUrl}/v1/iam/oauth/userinfo` instead\n   * of the IAM origin directly. Use this to keep cross-origin requests\n   * off the browser (gateway proxies same-origin to IAM).\n   */\n  proxyBaseUrl?: string;\n  /**\n   * IAM organization (e.g. \"hanzo\"). Required only for the first-party\n   * embedded credential login (`loginWithPassword` / `loginWithCode`).\n   */\n  organization?: string;\n  /** IAM application name. Defaults to `clientId` (they match for Hanzo apps). */\n  application?: string;\n};\n\n// ---------------------------------------------------------------------------\n// Browser IAM SDK\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the storage used for the short-lived PKCE transaction (state +\n * code_verifier). These two values are written before the full-page redirect\n * to IAM and read back at the callback — they MUST survive that round-trip.\n *\n * sessionStorage does NOT reliably survive it: Safari/WebKit ITP can drop it,\n * the instant SSO bounce (already signed in at IAM → immediate 302 back) and\n * in-app webviews can land the callback in a fresh context, and multi-tab\n * logins don't share it. The symptom is \"Missing PKCE code verifier\" at the\n * callback even though signinRedirect() ran. localStorage survives all of\n * these on the same origin; the values are one-shot and removed immediately\n * after the exchange, so there is no lingering-secret tradeoff.\n *\n * Falls back to the token storage when localStorage is unavailable (SSR,\n * privacy mode that throws on access).\n */\nfunction resolveTxStorage(fallback: Storage): Storage {\n  try {\n    if (typeof localStorage !== \"undefined\") {\n      const probe = \"hanzo_iam_probe\";\n      localStorage.setItem(probe, \"1\");\n      localStorage.removeItem(probe);\n      return localStorage;\n    }\n  } catch {\n    /* localStorage unavailable (privacy mode) — fall back */\n  }\n  return fallback;\n}\n\nexport class IAM {\n  private readonly config: IAMConfig;\n  private readonly storage: Storage;\n  /** Storage for the one-shot PKCE transaction (state + verifier). Defaults to\n   * localStorage so it survives the OAuth redirect; see resolveTxStorage. */\n  private readonly txStorage: Storage;\n  private discoveryCache: OidcDiscovery | null = null;\n\n  constructor(config: IAMConfig) {\n    this.config = config;\n    this.storage = config.storage ?? sessionStorage;\n    this.txStorage = resolveTxStorage(this.storage);\n  }\n\n  // -----------------------------------------------------------------------\n  // OIDC Discovery\n  // -----------------------------------------------------------------------\n\n  private async getDiscovery(): Promise<OidcDiscovery> {\n    if (this.discoveryCache) return this.discoveryCache;\n\n    const baseUrl = trimServerUrl(this.config.serverUrl);\n\n    // Prefer live OIDC discovery. If it fails (e.g. CORS when the IAM\n    // server doesn't send Access-Control-Allow-Origin), construct a\n    // fallback from the canonical OIDC_PATHS — the SAME paths discovery\n    // would return, so a failed round-trip degrades to correct URLs,\n    // never to the IAM HTML SPA catch-all.\n    try {\n      const res = await fetch(`${baseUrl}${OIDC_PATHS.discovery}`, {\n        headers: { Accept: \"application/json\" },\n      });\n      if (res.ok) {\n        this.discoveryCache = (await res.json()) as OidcDiscovery;\n        return this.discoveryCache;\n      }\n    } catch {\n      // CORS or network error — fall through to constructed discovery\n    }\n\n    this.discoveryCache = {\n      issuer: baseUrl,\n      authorization_endpoint: iamUrl(baseUrl, \"authorize\"),\n      token_endpoint: iamUrl(baseUrl, \"token\"),\n      userinfo_endpoint: iamUrl(baseUrl, \"userinfo\"),\n      jwks_uri: iamUrl(baseUrl, \"jwks\"),\n      response_types_supported: [\"code\"],\n      grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n      scopes_supported: [\"openid\", \"email\", \"profile\"],\n    };\n    return this.discoveryCache;\n  }\n\n  // -----------------------------------------------------------------------\n  // Token endpoint URL (proxy-aware)\n  // -----------------------------------------------------------------------\n\n  private async tokenEndpoint(): Promise<string> {\n    if (this.config.proxyBaseUrl) {\n      return iamUrl(this.config.proxyBaseUrl, \"token\");\n    }\n    const discovery = await this.getDiscovery();\n    return discovery.token_endpoint;\n  }\n\n  private async userinfoEndpoint(): Promise<string> {\n    if (this.config.proxyBaseUrl) {\n      return iamUrl(this.config.proxyBaseUrl, \"userinfo\");\n    }\n    const discovery = await this.getDiscovery();\n    return discovery.userinfo_endpoint;\n  }\n\n  // -----------------------------------------------------------------------\n  // PKCE transaction storage\n  // -----------------------------------------------------------------------\n\n  /**\n   * Persist a login attempt's PKCE verifier. Writes to `txStorage`\n   * (localStorage) so the transaction survives the full-page OAuth redirect\n   * and Safari/WebKit ITP (see {@link resolveTxStorage}). The authoritative\n   * slot is keyed by `state` (concurrent attempts stay isolated, no stomping);\n   * the legacy single slots are kept as the latest-attempt pointer + a\n   * compatibility fallback for flows that predate per-state storage.\n   */\n  private stashPkce(state: string, codeVerifier: string): void {\n    const now = Date.now();\n    // Opportunistic GC: localStorage persists across tabs and abandoned\n    // redirects, so a fresh attempt is the natural moment to sweep verifiers\n    // no callback consumed. Age-bounded so a CONCURRENT sibling attempt (a few\n    // seconds old) is never touched — only true orphans past the TTL are cut.\n    this.sweepStaleVerifiers(now);\n    this.txStorage.setItem(verifierKey(state), encodeSlot(codeVerifier, now));\n    this.txStorage.setItem(KEY_STATE, state);\n    this.txStorage.setItem(KEY_CODE_VERIFIER, codeVerifier);\n  }\n\n  /**\n   * Remove per-attempt PKCE verifier slots from `txStorage`. With `now` given,\n   * only slots older than {@link VERIFIER_TTL_MS} (or unparseable) are cut —\n   * live concurrent attempts survive. With `now` omitted, ALL slots are swept\n   * (used by `clearTokens` on logout).\n   */\n  private sweepStaleVerifiers(now?: number): void {\n    for (let i = this.txStorage.length - 1; i >= 0; i--) {\n      const k = this.txStorage.key(i);\n      if (!k || !k.startsWith(KEY_VERIFIER_PREFIX)) continue;\n      if (now === undefined) {\n        this.txStorage.removeItem(k);\n        continue;\n      }\n      const raw = this.txStorage.getItem(k);\n      const issuedAt = raw ? decodeSlot(raw).issuedAt : 0;\n      if (now - issuedAt > VERIFIER_TTL_MS) this.txStorage.removeItem(k);\n    }\n  }\n\n  // -----------------------------------------------------------------------\n  // Authorize URL builder\n  // -----------------------------------------------------------------------\n\n  private async buildAuthorizeUrl(extra?: {\n    additionalParams?: Record<string, string>;\n    prompt?: string;\n  }): Promise<{ url: URL; codeVerifier: string; state: string }> {\n    const discovery = await this.getDiscovery();\n    const { codeVerifier, codeChallenge } = await generatePKCEChallenge();\n    const state = generateState();\n\n    this.stashPkce(state, codeVerifier);\n\n    const url = new URL(discovery.authorization_endpoint);\n    url.searchParams.set(\"client_id\", this.config.clientId);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"redirect_uri\", this.config.redirectUri);\n    url.searchParams.set(\"scope\", this.config.scope ?? \"openid profile email\");\n    url.searchParams.set(\"state\", state);\n    url.searchParams.set(\"code_challenge\", codeChallenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    if (extra?.prompt) url.searchParams.set(\"prompt\", extra.prompt);\n    if (extra?.additionalParams) {\n      for (const [k, v] of Object.entries(extra.additionalParams)) {\n        url.searchParams.set(k, v);\n      }\n    }\n    return { url, codeVerifier, state };\n  }\n\n  // -----------------------------------------------------------------------\n  // Login redirect (PKCE)\n  // -----------------------------------------------------------------------\n\n  /**\n   * Start the OAuth2 PKCE login flow by redirecting to /oauth/authorize.\n   * Generates PKCE challenge + state, stores them in session storage,\n   * then sets `window.location.href`.\n   */\n  async signinRedirect(params?: { additionalParams?: Record<string, string> }): Promise<void> {\n    const { url } = await this.buildAuthorizeUrl(params);\n    window.location.href = url.toString();\n  }\n\n  /**\n   * Build the authorize URL without redirecting — useful for `<a href>`\n   * (e.g. social login buttons with `provider` in additionalParams).\n   */\n  async getSigninUrl(params?: { additionalParams?: Record<string, string> }): Promise<string> {\n    const { url } = await this.buildAuthorizeUrl(params);\n    return url.toString();\n  }\n\n  // -----------------------------------------------------------------------\n  // First-party embedded credential login (PKCE-bound, no IAM-hosted UI)\n  // -----------------------------------------------------------------------\n\n  /**\n   * Generate + persist a PKCE verifier and state for an embedded credential\n   * login, returning the challenge to bind into the minted code. Uses the\n   * SAME storage keys as `signinRedirect`, so `handleCallback` completes the\n   * exact same RFC 7636 exchange regardless of how sign-in started.\n   */\n  private async beginCredential(): Promise<{ codeChallenge: string; state: string }> {\n    const { codeVerifier, codeChallenge } = await generatePKCEChallenge();\n    const state = generateState();\n    this.stashPkce(state, codeVerifier);\n    return { codeChallenge, state };\n  }\n\n  /**\n   * POST the IAM login endpoint with a PKCE `code_challenge` so the returned\n   * authorization code is challenge-bound. Returns the app-callback URL\n   * carrying `code` + `state`; the caller navigates there and\n   * `handleCallback()` performs the standard PKCE token exchange. Throws on\n   * an IAM error. No password ever reaches the token endpoint.\n   */\n  private async credentialLogin(fields: Record<string, unknown>): Promise<string> {\n    const { codeChallenge, state } = await this.beginCredential();\n    const base = this.config.proxyBaseUrl ?? this.config.serverUrl;\n    const url = new URL(`${trimServerUrl(base)}${IAM_PATHS.login}`);\n    url.searchParams.set(\"clientId\", this.config.clientId);\n    url.searchParams.set(\"responseType\", \"code\");\n    url.searchParams.set(\"redirectUri\", this.config.redirectUri);\n    url.searchParams.set(\"scope\", this.config.scope ?? \"openid profile email\");\n    url.searchParams.set(\"state\", state);\n    url.searchParams.set(\"type\", \"code\");\n    url.searchParams.set(\"code_challenge\", codeChallenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    const res = await fetch(url.toString(), {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n      credentials: \"include\",\n      body: JSON.stringify({\n        type: \"code\",\n        application: this.config.application ?? this.config.clientId,\n        organization: this.config.organization,\n        autoSignin: true,\n        ...fields,\n      }),\n    });\n    const parsed = (await res.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!res.ok || parsed.status === \"error\") {\n      throw new Error(typeof parsed.msg === \"string\" ? parsed.msg : `sign-in failed (${res.status})`);\n    }\n    const code = parsed.data;\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new Error(\"IAM did not return an authorization code\");\n    }\n    const sep = this.config.redirectUri.includes(\"?\") ? \"&\" : \"?\";\n    return `${this.config.redirectUri}${sep}code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`;\n  }\n\n  /** Embedded password login → returns the app-callback URL to navigate to. */\n  loginWithPassword(username: string, password: string): Promise<string> {\n    return this.credentialLogin({ username, password, signinMethod: \"Password\" });\n  }\n\n  /** Embedded passwordless code login → returns the app-callback URL. */\n  loginWithCode(destination: string, code: string): Promise<string> {\n    const isEmail = destination.includes(\"@\");\n    return this.credentialLogin({\n      username: destination,\n      code,\n      signinMethod: \"Verification code\",\n      ...(isEmail ? { email: destination } : { phone: destination }),\n    });\n  }\n\n  /** Send a passwordless email/SMS verification code for `loginWithCode`. */\n  async sendLoginCode(destination: string): Promise<void> {\n    const isEmail = destination.includes(\"@\");\n    const base = this.config.proxyBaseUrl ?? this.config.serverUrl;\n    const url = new URL(`${trimServerUrl(base)}${IAM_PATHS.sendCode}`);\n    url.searchParams.set(\"clientId\", this.config.clientId);\n    if (this.config.organization) url.searchParams.set(\"organization\", this.config.organization);\n    const res = await fetch(url.toString(), {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n      body: JSON.stringify({\n        applicationId: `admin/${this.config.application ?? this.config.clientId}`,\n        organization: this.config.organization,\n        dest: destination,\n        type: isEmail ? \"email\" : \"phone\",\n        method: \"login\",\n        checkUser: destination,\n      }),\n    });\n    const parsed = (await res.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!res.ok || parsed.status === \"error\") {\n      throw new Error(typeof parsed.msg === \"string\" ? parsed.msg : `could not send code (${res.status})`);\n    }\n  }\n\n  // -----------------------------------------------------------------------\n  // Callback handling\n  // -----------------------------------------------------------------------\n\n  /**\n   * Handle the OAuth2 callback after the IAM redirect. Validates state,\n   * exchanges the authorization code for tokens with PKCE, and stores\n   * the result.\n   *\n   * Call this on your callback route (e.g. /auth/callback).\n   */\n  async handleCallback(callbackUrl?: string): Promise<IAMToken> {\n    const url = new URL(callbackUrl ?? window.location.href);\n    const error = url.searchParams.get(\"error\");\n\n    if (error) {\n      const desc = url.searchParams.get(\"error_description\") ?? error;\n      throw new Error(`OAuth error: ${desc}`);\n    }\n\n    const code = url.searchParams.get(\"code\");\n    if (!code) {\n      throw new Error(\"Missing authorization code in callback URL\");\n    }\n\n    const state = url.searchParams.get(\"state\");\n\n    // Resolve the PKCE verifier for THIS attempt. It lives in txStorage\n    // (localStorage) so it survives the full-page OAuth redirect + Safari/WebKit\n    // ITP; the this.storage reads are a transition fallback for a login started\n    // by an older build (sessionStorage / non-namespaced). Prefer the\n    // per-attempt slot keyed by the returned `state`: its presence proves WE\n    // issued this state, so concurrent logins stay isolated (no stomping) AND\n    // state/CSRF is enforced structurally — an attacker cannot fabricate a state\n    // that maps to a stored slot. One-shot: consume the slot before the call.\n    const nsKey = state ? verifierKey(state) : null;\n    const nsRaw = nsKey ? (this.txStorage.getItem(nsKey) ?? this.storage.getItem(nsKey)) : null;\n    let codeVerifier: string | null = nsRaw ? decodeSlot(nsRaw).codeVerifier : null;\n\n    if (codeVerifier && nsKey) {\n      this.txStorage.removeItem(nsKey);\n      this.storage.removeItem(nsKey);\n      // Clear the latest-attempt pointer only if it names THIS attempt, so a\n      // racing second login's pointer is left intact.\n      if (this.txStorage.getItem(KEY_STATE) === state || this.storage.getItem(KEY_STATE) === state) {\n        this.txStorage.removeItem(KEY_STATE);\n        this.txStorage.removeItem(KEY_CODE_VERIFIER);\n        this.storage.removeItem(KEY_STATE);\n        this.storage.removeItem(KEY_CODE_VERIFIER);\n      }\n    } else {\n      // Legacy single-slot fallback (a flow that predates per-state storage).\n      // A MISSING saved state is itself a rejection — never soft-skip the CSRF\n      // check (fail-closed: a stomped/concurrent flow that lost its slot also\n      // lands here and is rejected with an accurate message, not a false CSRF).\n      const savedState = this.txStorage.getItem(KEY_STATE) ?? this.storage.getItem(KEY_STATE);\n      if (!savedState || state !== savedState) {\n        throw new Error(\n          \"OAuth state mismatch — stale, concurrent, or forged login. Restart sign-in.\",\n        );\n      }\n      codeVerifier = this.txStorage.getItem(KEY_CODE_VERIFIER) ?? this.storage.getItem(KEY_CODE_VERIFIER);\n      if (!codeVerifier) {\n        throw new Error(\n          \"Missing PKCE code verifier — start sign-in via signinRedirect() or the embedded credential login.\",\n        );\n      }\n      this.txStorage.removeItem(KEY_STATE);\n      this.txStorage.removeItem(KEY_CODE_VERIFIER);\n      this.storage.removeItem(KEY_STATE);\n      this.storage.removeItem(KEY_CODE_VERIFIER);\n    }\n\n    const body = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      client_id: this.config.clientId,\n      code,\n      redirect_uri: this.config.redirectUri,\n      code_verifier: codeVerifier,\n    });\n\n    const tokenUrl = await this.tokenEndpoint();\n    const res = await fetch(tokenUrl, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: body.toString(),\n    });\n\n    if (!res.ok) {\n      const text = await res.text().catch(() => \"\");\n      throw new Error(`Token exchange failed (${res.status}): ${text}`);\n    }\n\n    const tokens = (await res.json()) as TokenResponse;\n    this.storeTokens(tokens);\n    return toIAMToken(tokens);\n  }\n\n  // -----------------------------------------------------------------------\n  // Token refresh\n  // -----------------------------------------------------------------------\n\n  /** Refresh the access token using the stored refresh token. */\n  async refreshAccessToken(): Promise<IAMToken> {\n    const refreshToken = this.storage.getItem(KEY_REFRESH_TOKEN);\n    if (!refreshToken) {\n      throw new Error(\"No refresh token available\");\n    }\n\n    const body = new URLSearchParams({\n      grant_type: \"refresh_token\",\n      client_id: this.config.clientId,\n      refresh_token: refreshToken,\n    });\n\n    const tokenUrl = await this.tokenEndpoint();\n    const res = await fetch(tokenUrl, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: body.toString(),\n    });\n\n    if (!res.ok) {\n      const text = await res.text().catch(() => \"\");\n      throw new Error(`Token refresh failed (${res.status}): ${text}`);\n    }\n\n    const tokens = (await res.json()) as TokenResponse;\n    this.storeTokens(tokens);\n    return toIAMToken(tokens);\n  }\n\n  // -----------------------------------------------------------------------\n  // Popup signin\n  // -----------------------------------------------------------------------\n\n  /**\n   * Open IAM login in a popup and complete IN-PLACE via a `postMessage`\n   * handshake — the app window never navigates. This is the ONLY in-place\n   * path for social (Google/GitHub set `X-Frame-Options`, so they cannot be\n   * iframed; a popup is a full top-level context that can host them).\n   *\n   * Flow: this opener generates PKCE (S256) + `state` and opens the authorize\n   * URL in the popup. The popup runs the provider hop and lands on the app's\n   * `redirect_uri`, where {@link completePopupSignin} posts `{code,state}`\n   * back to this opener and closes itself. This opener then runs the SAME\n   * PKCE {@link handleCallback} exchange with the verifier it holds.\n   *\n   * Security (three gates, all mandatory, one-shot):\n   *   1. ORIGIN — the message is accepted ONLY from the exact origin of\n   *      `redirect_uri` (the callback origin). Any other `event.origin` is\n   *      ignored. IAM never messages the opener directly.\n   *   2. SOURCE — the payload must be tagged `source: \"hanzo-iam\"`.\n   *   3. STATE — `state` must equal the value THIS call generated (CSRF).\n   * The listener + popup are torn down after the first accepted message; the\n   * `code` is never logged. A closed popup or timeout rejects (fail secure).\n   */\n  async signinPopup(params?: {\n    width?: number;\n    height?: number;\n    additionalParams?: Record<string, string>;\n    /** Reject if no message arrives within this window. Default 300s. */\n    timeoutMs?: number;\n  }): Promise<IAMToken> {\n    const { url, state } = await this.buildAuthorizeUrl({\n      additionalParams: params?.additionalParams,\n    });\n\n    const width = params?.width ?? 600;\n    const height = params?.height ?? 700;\n    const left = window.screenX + (window.outerWidth - width) / 2;\n    const top = window.screenY + (window.outerHeight - height) / 2;\n\n    // The ONLY origin allowed to deliver the code: the origin that hosts our\n    // redirect_uri callback (same-origin as this app in the canonical\n    // deployment). Resolved once, up front — never derived from the message.\n    const expectedOrigin = new URL(this.config.redirectUri, window.location.href).origin;\n\n    return new Promise<IAMToken>((resolve, reject) => {\n      const popup = window.open(\n        url.toString(),\n        POPUP_WINDOW_NAME,\n        `width=${width},height=${height},left=${left},top=${top},menubar=no,toolbar=no`,\n      );\n\n      if (!popup) {\n        reject(new Error(\"Failed to open login popup — blocked by browser?\"));\n        return;\n      }\n\n      let settled = false;\n      let closeGrace: ReturnType<typeof setTimeout> | null = null;\n      const cleanup = () => {\n        if (settled) return;\n        settled = true;\n        window.removeEventListener(\"message\", onMessage);\n        clearInterval(closedTimer);\n        clearTimeout(timeoutTimer);\n        if (closeGrace) clearTimeout(closeGrace);\n        try {\n          if (!popup.closed) popup.close();\n        } catch {\n          /* ok */\n        }\n      };\n\n      const onMessage = (event: MessageEvent) => {\n        if (settled) return;\n        // Gate 1: ORIGIN allowlist. Reject anything not from our callback\n        // origin — a message from IAM, an ad iframe, or any other window is\n        // silently dropped (return, do NOT settle — the real one may follow).\n        if (event.origin !== expectedOrigin) return;\n        const data = event.data as Partial<PopupMessage> | null;\n        // Gate 2: SOURCE tag. Ignore unrelated same-origin postMessage chatter.\n        if (!data || typeof data !== \"object\" || data.source !== POPUP_MESSAGE_SOURCE) return;\n        // Gate 3: STATE / CSRF. Must equal the state THIS call generated.\n        if (typeof data.state !== \"string\" || data.state !== state) {\n          cleanup();\n          reject(new Error(\"OAuth state mismatch — possible CSRF (popup)\"));\n          return;\n        }\n        if (data.error) {\n          cleanup();\n          reject(new Error(`OAuth error: ${data.error}`));\n          return;\n        }\n        if (typeof data.code !== \"string\" || data.code.length === 0) {\n          cleanup();\n          reject(new Error(\"Login popup returned no authorization code\"));\n          return;\n        }\n        // One-shot: tear everything down BEFORE the exchange so no second\n        // message can race in. Then run the identical PKCE exchange the\n        // redirect/credential paths use — the verifier is in our storage.\n        const code = data.code;\n        const returnedState = data.state;\n        cleanup();\n        const sep = this.config.redirectUri.includes(\"?\") ? \"&\" : \"?\";\n        const callbackUrl = `${this.config.redirectUri}${sep}code=${encodeURIComponent(code)}&state=${encodeURIComponent(returnedState)}`;\n        this.handleCallback(callbackUrl).then(resolve, reject);\n      };\n\n      window.addEventListener(\"message\", onMessage);\n\n      // Fail secure: user closed the popup, or it never reported back. The\n      // popup posts the code THEN closes itself, so a detected close starts a\n      // short grace window — if the in-flight message lands, it settles first\n      // (cleanup clears the grace timer); otherwise we reject.\n      const closedTimer = setInterval(() => {\n        if (settled || !popup.closed || closeGrace) return;\n        closeGrace = setTimeout(() => {\n          if (!settled) {\n            cleanup();\n            reject(new Error(\"Login popup was closed before completing\"));\n          }\n        }, 1000);\n      }, 300);\n      const timeoutTimer = setTimeout(() => {\n        if (!settled) {\n          cleanup();\n          reject(new Error(\"Login popup timed out\"));\n        }\n      }, params?.timeoutMs ?? 300_000);\n    });\n  }\n\n  // -----------------------------------------------------------------------\n  // Inline Web3 wallet login (SIWx / EIP-4361, PKCE-bound)\n  // -----------------------------------------------------------------------\n\n  /**\n   * Sign in with a browser wallet WITHOUT any redirect — the loop-prone\n   * `signinRedirect({provider:\"wallet\"})` is gone. Flow:\n   *\n   *   1. `eth_requestAccounts` → the connected address.\n   *   2. GET {@link IAM_PATHS.web3Nonce} → a server-owned single-use nonce and\n   *      the exact EIP-4361 message to sign (server is the message authority).\n   *   3. `personal_sign` the server's message verbatim.\n   *   4. POST {@link IAM_PATHS.web3Verify} with `{message, signature, address}`\n   *      + a PKCE `code_challenge`. The server RECOVERS the signer from the\n   *      signature (a client-supplied `address` is a hint, never trusted),\n   *      validates the nonce, and returns a PKCE-bound authorization `code`.\n   *   5. {@link handleCallback} completes the SAME RFC 7636 exchange in-place.\n   *\n   * @param opts.provider Explicit EIP-1193 provider; defaults to the injected\n   *   `window.ethereum`.\n   */\n  async loginWithWallet(opts?: { provider?: Eip1193Provider }): Promise<IAMToken> {\n    const eth =\n      opts?.provider ?? (globalThis as { ethereum?: Eip1193Provider }).ethereum;\n    if (!eth || typeof eth.request !== \"function\") {\n      throw new Error(\"No EIP-1193 wallet provider found (window.ethereum).\");\n    }\n\n    const accounts = (await eth.request({ method: \"eth_requestAccounts\" })) as unknown;\n    const address = Array.isArray(accounts) ? (accounts[0] as string | undefined) : undefined;\n    if (!address) {\n      throw new Error(\"Wallet did not return an address\");\n    }\n\n    const base = this.config.proxyBaseUrl ?? this.config.serverUrl;\n    const trimmed = trimServerUrl(base);\n\n    // 2. Server-owned nonce + message. The message is signed VERBATIM; the\n    //    client never invents challenge content (domain/nonce/issued-at).\n    const nonceUrl = new URL(`${trimmed}${IAM_PATHS.web3Nonce}`);\n    nonceUrl.searchParams.set(\"address\", address);\n    nonceUrl.searchParams.set(\"clientId\", this.config.clientId);\n    if (this.config.organization) nonceUrl.searchParams.set(\"organization\", this.config.organization);\n    const nonceRes = await fetch(nonceUrl.toString(), {\n      headers: { Accept: \"application/json\" },\n      credentials: \"include\",\n    });\n    const noncePayload = (await nonceRes.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!nonceRes.ok || noncePayload.status === \"error\") {\n      throw new Error(\n        typeof noncePayload.msg === \"string\" ? noncePayload.msg : `wallet nonce failed (${nonceRes.status})`,\n      );\n    }\n    const nonceData = (noncePayload.data ?? noncePayload) as Record<string, unknown>;\n    const message = nonceData.message as string | undefined;\n    const nonce = nonceData.nonce as string | undefined;\n    if (!message) {\n      throw new Error(\"IAM did not return a SIWx message to sign\");\n    }\n\n    // 3. Wallet signs the server's message verbatim.\n    const signature = (await eth.request({\n      method: \"personal_sign\",\n      params: [message, address],\n    })) as string;\n\n    // 4. Verify → PKCE-bound authorization code. Bind PKCE + state up front.\n    const { codeChallenge, state } = await this.beginCredential();\n    const verifyUrl = new URL(`${trimmed}${IAM_PATHS.web3Verify}`);\n    verifyUrl.searchParams.set(\"clientId\", this.config.clientId);\n    verifyUrl.searchParams.set(\"responseType\", \"code\");\n    verifyUrl.searchParams.set(\"redirectUri\", this.config.redirectUri);\n    verifyUrl.searchParams.set(\"scope\", this.config.scope ?? \"openid profile email\");\n    verifyUrl.searchParams.set(\"state\", state);\n    verifyUrl.searchParams.set(\"code_challenge\", codeChallenge);\n    verifyUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n    const verifyRes = await fetch(verifyUrl.toString(), {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n      credentials: \"include\",\n      body: JSON.stringify({\n        application: this.config.application ?? this.config.clientId,\n        organization: this.config.organization,\n        // Server recovers the signer from (message, signature); `address` is a\n        // hint the server MUST re-derive and match — never a trusted identity.\n        address,\n        message,\n        signature,\n        nonce,\n      }),\n    });\n    const verifyPayload = (await verifyRes.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!verifyRes.ok || verifyPayload.status === \"error\") {\n      throw new Error(\n        typeof verifyPayload.msg === \"string\" ? verifyPayload.msg : `wallet verify failed (${verifyRes.status})`,\n      );\n    }\n    const code = verifyPayload.data;\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new Error(\"IAM did not return an authorization code\");\n    }\n\n    // 5. Same RFC 7636 exchange, in-place — no navigation, no redirect.\n    const sep = this.config.redirectUri.includes(\"?\") ? \"&\" : \"?\";\n    const callbackUrl = `${this.config.redirectUri}${sep}code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`;\n    return this.handleCallback(callbackUrl);\n  }\n\n  // -----------------------------------------------------------------------\n  // Silent signin (iframe)\n  // -----------------------------------------------------------------------\n\n  /**\n   * Attempt silent authentication via a hidden iframe (`prompt=none`).\n   * Returns null if silent auth fails (user needs to log in interactively).\n   */\n  async signinSilent(timeoutMs = 5000): Promise<IAMToken | null> {\n    const { url, state } = await this.buildAuthorizeUrl({ prompt: \"none\" });\n\n    return new Promise<IAMToken | null>((resolve) => {\n      const iframe = document.createElement(\"iframe\");\n      iframe.style.display = \"none\";\n\n      const timeout = setTimeout(() => {\n        cleanup();\n        resolve(null);\n      }, timeoutMs);\n\n      const cleanup = () => {\n        clearTimeout(timeout);\n        iframe.remove();\n        this.txStorage.removeItem(verifierKey(state));\n        this.txStorage.removeItem(KEY_STATE);\n        this.txStorage.removeItem(KEY_CODE_VERIFIER);\n        this.storage.removeItem(verifierKey(state));\n        this.storage.removeItem(KEY_STATE);\n        this.storage.removeItem(KEY_CODE_VERIFIER);\n      };\n\n      iframe.addEventListener(\"load\", () => {\n        try {\n          const iframeUrl = iframe.contentWindow?.location.href;\n          if (iframeUrl && iframeUrl.startsWith(this.config.redirectUri)) {\n            // handleCallback consumes the per-attempt verifier slot itself —\n            // do NOT pre-clear it here; only sweep leftovers if it fails.\n            clearTimeout(timeout);\n            iframe.remove();\n            this.handleCallback(iframeUrl).then(\n              (tokens) => resolve(tokens),\n              () => {\n                cleanup();\n                resolve(null);\n              },\n            );\n          }\n        } catch {\n          // Cross-origin or error — silent auth failed\n          cleanup();\n          resolve(null);\n        }\n      });\n\n      iframe.src = url.toString();\n      document.body.appendChild(iframe);\n    });\n  }\n\n  // -----------------------------------------------------------------------\n  // Token management\n  // -----------------------------------------------------------------------\n\n  private storeTokens(tokens: TokenResponse): void {\n    this.storage.setItem(KEY_ACCESS_TOKEN, tokens.access_token);\n    if (tokens.refresh_token) {\n      this.storage.setItem(KEY_REFRESH_TOKEN, tokens.refresh_token);\n    }\n    if (tokens.id_token) {\n      this.storage.setItem(KEY_ID_TOKEN, tokens.id_token);\n    }\n    if (tokens.expires_in) {\n      const expiresAt = Date.now() + tokens.expires_in * 1000;\n      this.storage.setItem(KEY_EXPIRES_AT, String(expiresAt));\n    }\n  }\n\n  /** Get the stored access token (may be expired). */\n  getAccessToken(): string | null {\n    return this.storage.getItem(KEY_ACCESS_TOKEN);\n  }\n\n  /** Get the stored refresh token. */\n  getRefreshToken(): string | null {\n    return this.storage.getItem(KEY_REFRESH_TOKEN);\n  }\n\n  /** Get the stored ID token. */\n  getIdToken(): string | null {\n    return this.storage.getItem(KEY_ID_TOKEN);\n  }\n\n  /** Check if the stored access token is expired. */\n  isTokenExpired(): boolean {\n    const expiresAt = this.storage.getItem(KEY_EXPIRES_AT);\n    if (!expiresAt) return true;\n    return Date.now() >= Number(expiresAt);\n  }\n\n  /**\n   * Get a valid access token — refreshes automatically if expired.\n   * Returns null if no token and no refresh token available.\n   */\n  async getValidAccessToken(): Promise<string | null> {\n    const token = this.getAccessToken();\n    if (token && !this.isTokenExpired()) {\n      return token;\n    }\n    if (this.getRefreshToken()) {\n      try {\n        const tokens = await this.refreshAccessToken();\n        return tokens.accessToken;\n      } catch {\n        return null;\n      }\n    }\n    return null;\n  }\n\n  /** Clear all stored tokens (local logout). */\n  clearTokens(): void {\n    this.storage.removeItem(KEY_ACCESS_TOKEN);\n    this.storage.removeItem(KEY_REFRESH_TOKEN);\n    this.storage.removeItem(KEY_ID_TOKEN);\n    this.storage.removeItem(KEY_EXPIRES_AT);\n    this.storage.removeItem(KEY_STATE);\n    this.storage.removeItem(KEY_CODE_VERIFIER);\n    this.txStorage.removeItem(KEY_STATE);\n    this.txStorage.removeItem(KEY_CODE_VERIFIER);\n    // Fully sweep every per-attempt PKCE verifier slot (both stores) — no age\n    // bound on logout.\n    this.sweepStaleVerifiers();\n    for (let i = this.storage.length - 1; i >= 0; i--) {\n      const k = this.storage.key(i);\n      if (k && k.startsWith(KEY_VERIFIER_PREFIX)) this.storage.removeItem(k);\n    }\n  }\n\n  // -----------------------------------------------------------------------\n  // RP-initiated logout\n  // -----------------------------------------------------------------------\n\n  /**\n   * RP-initiated logout (OIDC). Best-effort POST to the logout endpoint\n   * to terminate the server-side session, then clears local tokens.\n   */\n  async logout(): Promise<void> {\n    const token = this.storage.getItem(KEY_ACCESS_TOKEN);\n    try {\n      await fetch(iamUrl(this.config.serverUrl, \"logout\"), {\n        method: \"POST\",\n        headers: token ? { Authorization: `Bearer ${token}` } : {},\n      });\n    } catch {\n      // best-effort — local cleanup is what matters\n    }\n    this.clearTokens();\n  }\n\n  // -----------------------------------------------------------------------\n  // User info\n  // -----------------------------------------------------------------------\n\n  /** Fetch user info from /oauth/userinfo using the stored access token. */\n  async getUserInfo(): Promise<Record<string, unknown>> {\n    const token = await this.getValidAccessToken();\n    if (!token) {\n      throw new Error(\"No valid access token — user must log in\");\n    }\n    const url = await this.userinfoEndpoint();\n    const res = await fetch(url, {\n      headers: { Authorization: `Bearer ${token}` },\n    });\n    if (!res.ok) {\n      throw new Error(`Userinfo fetch failed (${res.status})`);\n    }\n    return (await res.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * Fetch the current user, shaped into the canonical `IAMUser` form\n   * (camelCase, no `_` keys). Returns null when no token is present.\n   */\n  async getUser(): Promise<IAMUser | null> {\n    const token = await this.getValidAccessToken();\n    if (!token) return null;\n    const u = (await this.getUserInfo()) as Record<string, unknown>;\n    return {\n      sub: (u.sub as string) ?? \"\",\n      email: u.email as string | undefined,\n      name: u.name as string | undefined,\n      givenName: u.given_name as string | undefined,\n      familyName: u.family_name as string | undefined,\n      phoneNumber: u.phone_number as string | undefined,\n      emailVerified: u.email_verified as boolean | undefined,\n      picture: u.picture as string | undefined,\n      owner: u.owner as string | undefined,\n    };\n  }\n}\n\n/**\n * Canonical user shape returned by `IAM#getUser()`. Maps the OIDC userinfo\n * response (snake_case) to camelCase.\n */\nexport type IAMUser = {\n  sub: string;\n  email?: string;\n  name?: string;\n  givenName?: string;\n  familyName?: string;\n  phoneNumber?: string;\n  emailVerified?: boolean;\n  picture?: string;\n  owner?: string;\n};\n\n/**\n * Canonical token shape (camelCase, no `_` keys) for app code.\n */\nexport type IAMToken = {\n  accessToken: string;\n  refreshToken?: string;\n  idToken?: string;\n  expiresIn?: number;\n  tokenType?: string;\n  scope?: string;\n};\n\n/** Convert the raw OAuth2 token response into the canonical `IAMToken`. */\nexport function toIAMToken(t: TokenResponse): IAMToken {\n  return {\n    accessToken: t.access_token,\n    refreshToken: t.refresh_token,\n    idToken: t.id_token,\n    expiresIn: t.expires_in,\n    tokenType: t.token_type,\n    scope: t.scope,\n  };\n}\n\n/**\n * Popup-callback bridge — the OTHER half of {@link IAM#signinPopup}. Mount\n * this on your `redirect_uri` route (one line):\n *\n * ```ts\n * import { completePopupSignin } from \"@hanzo/iam/browser\";\n * if (!completePopupSignin()) {\n *   // normal top-level navigation → run the usual handleCallback()\n * }\n * ```\n *\n * When the page is our auth popup (it carries the reserved `window.name` set\n * by `signinPopup` AND has a `window.opener`), it hands the freshly minted\n * `code` + `state` back to the opener via a SINGLE `postMessage` and closes\n * itself — returning `true`. For a normal top-level navigation (wrong/no\n * window.name, or no opener) it does nothing and returns `false`, so the app\n * falls through to its standard `handleCallback()`.\n *\n * SECURITY: the message is posted with `targetOrigin` pinned to this page's\n * OWN origin — NEVER `\"*\"`. The `code` is therefore delivered only to an\n * opener on the same origin as this callback (the canonical deployment), and\n * can never leak cross-origin. The opener independently re-verifies\n * `event.origin` and `state`. A bare `code` is useless without the opener's\n * PKCE verifier, which never leaves the opener. The code is never logged.\n *\n * @returns `true` if this was a popup callback (handled + window closed),\n *   `false` for a normal navigation the app should complete itself.\n */\nexport function completePopupSignin(): boolean {\n  if (typeof window === \"undefined\") return false;\n  // Gate on the popup's window.name — signinPopup opens it with exactly this\n  // name, which persists across the cross-origin provider hop. This makes the\n  // bridge inert on any ordinary same-origin page that merely happens to carry\n  // ?code + a window.opener (e.g. a tab opened with target=_blank), so it can\n  // never post a message or close a window it was not meant to.\n  if (window.name !== POPUP_WINDOW_NAME) return false;\n  const opener = window.opener as Window | null;\n  if (!opener || opener === window) return false;\n\n  const url = new URL(window.location.href);\n  const code = url.searchParams.get(\"code\");\n  const state = url.searchParams.get(\"state\");\n  const error = url.searchParams.get(\"error\") ?? url.searchParams.get(\"error_description\");\n  // Not an OAuth callback at all — leave it for the app.\n  if (!code && !error) return false;\n\n  const message: PopupMessage = {\n    source: POPUP_MESSAGE_SOURCE,\n    ...(code ? { code } : {}),\n    ...(state ? { state } : {}),\n    ...(error ? { error } : {}),\n  };\n  // Pin targetOrigin to our own origin: the opener MUST be same-origin as\n  // this callback page. Never \"*\" — that would broadcast the code to any\n  // cross-origin opener.\n  opener.postMessage(message, window.location.origin);\n  window.close();\n  return true;\n}\n\n// ---------------------------------------------------------------------------\n// Promoted functional surface — the ONE thing apps import.\n//\n// `configureIam` + `startLogin({provider?})` + `handleCallback` + session\n// verbs over the configured singleton. See ./session.ts. Re-exported here so\n// `import { startLogin } from \"@hanzo/iam/browser\"` just works.\n// ---------------------------------------------------------------------------\n\nexport {\n  configureIam,\n  startLogin,\n  getLoginUrl,\n  handleCallback,\n  getSession,\n  getUser,\n  logout,\n  getIam,\n  getIamConfig,\n  type IamSessionConfig,\n  type StartLoginOptions,\n  type IamSession,\n} from \"./session.js\";\n","/**\n * Composable IAM views.\n *\n * Drop-in React components that mirror the server-rendered embedded\n * login + onboarding flows. Each component is independently usable —\n * render the whole `<Login>`, or just the `<WalletButton>`, or just the\n * `<EmailPasswordForm>`, or assemble a custom flow from the primitives.\n *\n * Discovery\n * =========\n *\n * `<Login>` reads {@link IAM_PATHS.authMethods} from the configured IAM\n * and renders only the buttons whose backends are actually wired. One\n * source of truth — the server emits the method list, the client renders\n * exactly that. No env mismatch, no client-side guessing.\n *\n * Every method stays IN-PLACE — the app window never navigates to the\n * hosted login page. Social opens the provider hop in a popup and completes\n * over a `postMessage` handshake (`signinPopup`); wallet runs inline SIWx\n * (`loginWithWallet`); email/password and OTP mint a PKCE-bound code via the\n * IAM login endpoint. All four converge on the SAME PKCE `handleCallback`\n * token exchange in `@hanzo/iam/browser`, which resolves every endpoint\n * through `OIDC_PATHS`. `signinRedirect` remains only as an explicit\n * standalone fallback — it is never the default here.\n *\n * @example\n * ```tsx\n * import { Login, OnboardingFlow } from '@hanzo/iam/views'\n *\n * function MyApp() {\n *   return location.pathname === '/onboarding'\n *     ? <OnboardingFlow serverUrl=\"https://iam.hanzo.ai\" token={token} onComplete={(id) => …} />\n *     : <Login serverUrl=\"https://iam.hanzo.ai\" clientId=\"my-app\"\n *              redirectUri={`${origin}/_/callback`} state={state} />\n * }\n * ```\n *\n * @packageDocumentation\n */\n\nimport {\n  createElement as h,\n  useCallback,\n  useEffect,\n  useState,\n  type ComponentType,\n  type FormEvent,\n  type ReactNode,\n} from \"react\";\n\nimport { IAM } from \"./browser.js\";\nimport { IAM_PATHS, trimServerUrl } from \"./paths.js\";\n\n// ============================================================\n// types\n// ============================================================\n\nexport type AuthMethodKind = \"password\" | \"social\" | \"wallet\" | \"email_otp\" | \"sms_otp\";\n\nexport interface AuthMethod {\n  kind: AuthMethodKind;\n  /** Set when kind = 'social'; one of 'google' | 'github' | 'apple' | … */\n  provider?: string;\n  label: string;\n  is_primary: boolean;\n  is_secondary: boolean;\n}\n\nexport interface MethodsResponse {\n  methods: AuthMethod[];\n  require_2fa: boolean;\n}\n\n/** Common props every view accepts. The redirectUri and state pair up\n * with the OIDC PKCE flow — see `@hanzo/iam/browser`. */\nexport interface FlowProps {\n  /** Base URL of the IAM server, e.g. 'https://iam.hanzo.ai'. */\n  serverUrl: string;\n  clientId: string;\n  redirectUri: string;\n  /** The OIDC `state` param. Generate one per signinRedirect() call. */\n  state: string;\n  /**\n   * IAM organization the app belongs to (e.g. 'hanzo'). Required for the\n   * credential (password / verification-code) login flow.\n   */\n  organization?: string;\n  /** IAM application name. Defaults to `clientId` (they match for Hanzo apps). */\n  application?: string;\n}\n\nfunction makeIam(props: FlowProps): IAM {\n  return new IAM({\n    serverUrl: props.serverUrl,\n    clientId: props.clientId,\n    redirectUri: props.redirectUri,\n    organization: props.organization,\n    application: props.application,\n  });\n}\n\n// ============================================================\n// hooks\n// ============================================================\n\nexport interface MethodsView {\n  loading: boolean;\n  error: Error | null;\n  has: (kind: AuthMethodKind) => boolean;\n  providers: () => string[];\n  raw: AuthMethod[];\n  require2FA: boolean;\n}\n\nexport interface UseAuthMethodsOpts {\n  serverUrl: string;\n  fetcher?: typeof fetch;\n}\n\n/**\n * Fetch the live list of enabled auth methods from\n * {@link IAM_PATHS.authMethods}. SSR-safe: no fetch runs until the\n * component is mounted in the browser.\n */\nexport function useAuthMethods(opts: UseAuthMethodsOpts): MethodsView {\n  const [methods, setMethods] = useState<AuthMethod[]>([]);\n  const [require2FA, setRequire2FA] = useState(false);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<Error | null>(null);\n\n  useEffect(() => {\n    let cancelled = false;\n    const doFetch = opts.fetcher ?? fetch;\n    setLoading(true);\n    setError(null);\n\n    doFetch(`${trimServerUrl(opts.serverUrl)}${IAM_PATHS.authMethods}`, {\n      headers: { Accept: \"application/json\" },\n    })\n      .then(async (res) => {\n        if (!res.ok) throw new Error(`auth methods fetch failed: ${res.status}`);\n        return (await res.json()) as MethodsResponse;\n      })\n      .then((body) => {\n        if (cancelled) return;\n        setMethods(body.methods ?? []);\n        setRequire2FA(Boolean(body.require_2fa));\n      })\n      .catch((err) => {\n        if (!cancelled) setError(err instanceof Error ? err : new Error(String(err)));\n      })\n      .finally(() => {\n        if (!cancelled) setLoading(false);\n      });\n\n    return () => {\n      cancelled = true;\n    };\n  }, [opts.serverUrl, opts.fetcher]);\n\n  return {\n    loading,\n    error,\n    has: (kind) => methods.some((m) => m.kind === kind),\n    providers: () =>\n      methods.filter((m) => m.kind === \"social\" && m.provider).map((m) => m.provider as string),\n    raw: methods,\n    require2FA,\n  };\n}\n\n// ============================================================\n// view components\n// ============================================================\n\nexport interface LoginProps extends FlowProps {\n  /** Override individual button labels for white-label deployments. */\n  labels?: Partial<{\n    wallet: string;\n    googleSocial: string;\n    githubSocial: string;\n    appleSocial: string;\n    emailOtp: string;\n    smsOtp: string;\n    password: string;\n    divider: string;\n  }>;\n  /** Render-prop slot for the brand mark above the form. */\n  brand?: ReactNode;\n  /** Optional class hook for the outer card. */\n  className?: string;\n  /** Called after a successful credential sign-in (pre-redirect). */\n  onSuccess?: (token: string) => void;\n  /**\n   * Social/wallet providers to render as buttons (e.g. ['google','github','wallet']).\n   * Each completes IN-PLACE (social via popup, wallet via inline SIWx) — never\n   * a redirect. Defaults to none — the `/v1/iam/auth/methods` discovery\n   * endpoint is not relied upon (it is not deployed), so providers are passed\n   * explicitly per app.\n   */\n  providers?: string[];\n}\n\nexport interface SocialButtonProps extends FlowProps {\n  /** 'google' | 'github' | 'apple' (or a custom provider key). */\n  provider: string;\n  label?: string;\n  /** Called with the access token after the in-place popup sign-in completes. */\n  onSuccess?: (token: string) => void;\n  onError?: (error: Error) => void;\n}\n\nexport interface WalletButtonProps extends FlowProps {\n  label?: string;\n  /** Called with the access token after the inline SIWx sign-in completes. */\n  onSuccess?: (token: string) => void;\n  onError?: (error: Error) => void;\n}\n\nexport interface EmailPasswordFormProps extends FlowProps {\n  initialEmail?: string;\n  onError?: (error: Error) => void;\n  /** Called with the access token after a successful password grant. */\n  onSuccess?: (token: string) => void;\n}\n\nexport interface OTPStepProps extends FlowProps {\n  channel: \"email\" | \"sms\";\n  /** Destination contact — when omitted the component prompts. */\n  destination?: string;\n  label?: string;\n  onError?: (error: Error) => void;\n  onSuccess?: (token: string) => void;\n}\n\n/**\n * Social sign-in button. Stays IN-PLACE: opens the provider hop in a popup\n * and completes via the `postMessage` handshake in `@hanzo/iam/browser`\n * (`signinPopup`) — the app window never navigates to the hosted login page.\n * Google/GitHub cannot be iframed, so a popup is the only embedded path.\n * On success it runs the SAME PKCE `handleCallback` the credential form uses.\n */\nexport const SocialButton: ComponentType<SocialButtonProps> = (props) => {\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const onClick = useCallback(async () => {\n    setBusy(true);\n    setError(null);\n    try {\n      const token = await makeIam(props).signinPopup({\n        additionalParams: { provider: props.provider },\n      });\n      props.onSuccess?.(token.accessToken);\n    } catch (err) {\n      const e2 = err instanceof Error ? err : new Error(String(err));\n      setError(e2.message);\n      props.onError?.(e2);\n    } finally {\n      setBusy(false);\n    }\n  }, [props.serverUrl, props.clientId, props.redirectUri, props.provider]);\n\n  return h(\n    \"button\",\n    {\n      type: \"button\",\n      onClick,\n      disabled: busy,\n      \"data-provider\": props.provider,\n      className: \"hanzo-iam-btn\",\n      title: error ?? undefined,\n    },\n    busy ? \"Connecting…\" : (props.label ?? `Continue with ${props.provider}`),\n  );\n};\n\n/**\n * Wallet sign-in button. Stays IN-PLACE: runs the inline SIWx (EIP-4361)\n * flow in `@hanzo/iam/browser` (`loginWithWallet`) — nonce → wallet signs →\n * verify → server returns a PKCE-bound code → `handleCallback`. No redirect,\n * no loop. The server verifies the signature; the client never asserts an\n * identity.\n */\nexport const WalletButton: ComponentType<WalletButtonProps> = (props) => {\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const onClick = useCallback(async () => {\n    setBusy(true);\n    setError(null);\n    try {\n      const token = await makeIam(props).loginWithWallet();\n      props.onSuccess?.(token.accessToken);\n    } catch (err) {\n      const e2 = err instanceof Error ? err : new Error(String(err));\n      setError(e2.message);\n      props.onError?.(e2);\n    } finally {\n      setBusy(false);\n    }\n  }, [props.serverUrl, props.clientId, props.redirectUri]);\n\n  return h(\n    \"button\",\n    {\n      type: \"button\",\n      onClick,\n      disabled: busy,\n      \"data-provider\": \"wallet\",\n      className: \"hanzo-iam-btn\",\n      title: error ?? undefined,\n    },\n    busy ? \"Connecting…\" : (props.label ?? \"Connect wallet\"),\n  );\n};\n\n/**\n * Email + password form. Drives IAM's password grant directly (RFC 6749\n * §4.3) and reports the access token via `onSuccess`. No credential ever\n * touches a path other than the canonical token endpoint.\n */\nexport const EmailPasswordForm: ComponentType<EmailPasswordFormProps> = (props) => {\n  const [email, setEmail] = useState(props.initialEmail ?? \"\");\n  const [password, setPassword] = useState(\"\");\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const onSubmit = useCallback(\n    async (e: FormEvent) => {\n      e.preventDefault();\n      setBusy(true);\n      setError(null);\n      try {\n        // Mints a PKCE-bound code, then navigates to the app callback which\n        // completes the standard RFC 7636 exchange via handleCallback().\n        window.location.href = await makeIam(props).loginWithPassword(email, password);\n      } catch (err) {\n        const e2 = err instanceof Error ? err : new Error(String(err));\n        setError(e2.message);\n        props.onError?.(e2);\n      } finally {\n        setBusy(false);\n      }\n    },\n    [email, password, props.serverUrl, props.clientId, props.redirectUri, props.state, props.organization, props.application],\n  );\n\n  return h(\n    \"form\",\n    { onSubmit, className: \"hanzo-iam-form\" },\n    h(\"input\", {\n      type: \"email\",\n      name: \"email\",\n      autoComplete: \"email\",\n      placeholder: \"Email\",\n      required: true,\n      value: email,\n      onChange: (e: { target: { value: string } }) => setEmail(e.target.value),\n    }),\n    h(\"input\", {\n      type: \"password\",\n      name: \"password\",\n      autoComplete: \"current-password\",\n      placeholder: \"Password\",\n      required: true,\n      value: password,\n      onChange: (e: { target: { value: string } }) => setPassword(e.target.value),\n    }),\n    error ? h(\"p\", { role: \"alert\", className: \"hanzo-iam-error\" }, error) : null,\n    h(\"button\", { type: \"submit\", disabled: busy, className: \"hanzo-iam-btn\" }, busy ? \"Signing in…\" : \"Sign in\"),\n  );\n};\n\n/**\n * One-time-code step. Sends a code to the destination via IAM, then\n * verifies it against the password grant using the OTP as the password\n * (IAM's `email_otp` / `sms_otp` grant). Reports the access token.\n */\nexport const OTPStep: ComponentType<OTPStepProps> = (props) => {\n  const [destination, setDestination] = useState(props.destination ?? \"\");\n  const [code, setCode] = useState(\"\");\n  const [sent, setSent] = useState(false);\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const send = useCallback(async () => {\n    setBusy(true);\n    setError(null);\n    try {\n      await makeIam(props).sendLoginCode(destination);\n      setSent(true);\n    } catch (err) {\n      const e2 = err instanceof Error ? err : new Error(String(err));\n      setError(e2.message);\n      props.onError?.(e2);\n    } finally {\n      setBusy(false);\n    }\n  }, [destination, props.channel, props.serverUrl, props.clientId, props.organization, props.application]);\n\n  const verify = useCallback(\n    async (e: FormEvent) => {\n      e.preventDefault();\n      setBusy(true);\n      setError(null);\n      try {\n        window.location.href = await makeIam(props).loginWithCode(destination, code);\n      } catch (err) {\n        const e2 = err instanceof Error ? err : new Error(String(err));\n        setError(e2.message);\n        props.onError?.(e2);\n      } finally {\n        setBusy(false);\n      }\n    },\n    [destination, code, props.serverUrl, props.clientId, props.redirectUri, props.state, props.organization, props.application],\n  );\n\n  return h(\n    \"form\",\n    { onSubmit: verify, className: \"hanzo-iam-form\" },\n    h(\"input\", {\n      type: props.channel === \"email\" ? \"email\" : \"tel\",\n      placeholder: props.channel === \"email\" ? \"Email\" : \"Phone\",\n      required: true,\n      value: destination,\n      disabled: sent,\n      onChange: (e: { target: { value: string } }) => setDestination(e.target.value),\n    }),\n    sent\n      ? h(\"input\", {\n          type: \"text\",\n          inputMode: \"numeric\",\n          autoComplete: \"one-time-code\",\n          placeholder: \"Code\",\n          required: true,\n          value: code,\n          onChange: (e: { target: { value: string } }) => setCode(e.target.value),\n        })\n      : null,\n    error ? h(\"p\", { role: \"alert\", className: \"hanzo-iam-error\" }, error) : null,\n    sent\n      ? h(\"button\", { type: \"submit\", disabled: busy, className: \"hanzo-iam-btn\" }, busy ? \"Verifying…\" : \"Verify code\")\n      : h(\n          \"button\",\n          { type: \"button\", disabled: busy || !destination, onClick: send, className: \"hanzo-iam-btn\" },\n          busy ? \"Sending…\" : (props.label ?? \"Send code\"),\n        ),\n  );\n};\n\n/**\n * Full embedded login. Reads the live method list and renders exactly\n * the enabled primitives — wallet, social providers, OTP, password — in\n * canonical order. White-label labels via `labels`; brand mark via\n * `brand`.\n */\nexport const Login: ComponentType<LoginProps> = (props) => {\n  const flow: FlowProps = {\n    serverUrl: props.serverUrl,\n    clientId: props.clientId,\n    redirectUri: props.redirectUri,\n    state: props.state,\n    organization: props.organization,\n    application: props.application,\n  };\n\n  const socialLabel: Record<string, string | undefined> = {\n    google: props.labels?.googleSocial,\n    github: props.labels?.githubSocial,\n    apple: props.labels?.appleSocial,\n  };\n\n  const children: ReactNode[] = [];\n  if (props.brand) children.push(h(\"div\", { key: \"brand\", className: \"hanzo-iam-brand\" }, props.brand));\n\n  // Social/wallet providers (explicit per app). Both stay IN-PLACE: social\n  // via popup + postMessage, wallet via inline SIWx. Never a full-page\n  // redirect to the hosted login page.\n  for (const provider of props.providers ?? []) {\n    if (provider === \"wallet\") {\n      children.push(h(WalletButton, { key: \"wallet\", ...flow, label: props.labels?.wallet, onSuccess: props.onSuccess }));\n    } else {\n      children.push(h(SocialButton, { key: `social-${provider}`, ...flow, provider, label: socialLabel[provider], onSuccess: props.onSuccess }));\n    }\n  }\n\n  // Password (always) — IAM credential login.\n  children.push(h(EmailPasswordForm, { key: \"password\", ...flow, onSuccess: props.onSuccess }));\n\n  // Passwordless email code.\n  children.push(h(\"div\", { key: \"divider\", className: \"hanzo-iam-divider\" }, props.labels?.divider ?? \"or\"));\n  children.push(h(OTPStep, { key: \"email-otp\", ...flow, channel: \"email\", label: props.labels?.emailOtp, onSuccess: props.onSuccess }));\n\n  return h(\"div\", { className: props.className ?? \"hanzo-iam-card\" }, ...children);\n};\n\n// ============================================================\n// onboarding views\n// ============================================================\n\nexport type OnboardingStep = \"identity\" | \"documents\" | \"biometric\" | \"screen\" | \"submit\";\n\nconst ALL_STEPS: OnboardingStep[] = [\"identity\", \"documents\", \"biometric\", \"screen\", \"submit\"];\n\nexport interface OnboardingFlowProps {\n  serverUrl: string;\n  /** Auth bearer token from the prior sign-in. */\n  token: string;\n  /** Subset of steps to render. Defaults to all five in canonical order. */\n  steps?: OnboardingStep[];\n  /** Fired when the user finishes the final step. */\n  onComplete?: (applicationId: string) => void;\n  /** Brand-mark slot, same shape as Login. */\n  brand?: ReactNode;\n  className?: string;\n}\n\nexport interface StepProps {\n  serverUrl: string;\n  token: string;\n  applicationId?: string;\n  onNext: (applicationId: string) => void;\n  onError?: (error: Error) => void;\n}\n\n/** POST a step's payload to the IAM onboarding state machine. */\nasync function postStep(\n  serverUrl: string,\n  token: string,\n  step: OnboardingStep,\n  body: BodyInit | Record<string, unknown>,\n  applicationId?: string,\n): Promise<string> {\n  const isForm = typeof FormData !== \"undefined\" && body instanceof FormData;\n  const url = `${trimServerUrl(serverUrl)}${IAM_PATHS.onboarding}/${step}`;\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${token}`,\n      Accept: \"application/json\",\n      ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(applicationId ? { \"X-Application-Id\": applicationId } : {}),\n    },\n    body: isForm ? (body as FormData) : JSON.stringify(body),\n  });\n  if (!res.ok) {\n    const text = await res.text().catch(() => \"\");\n    throw new Error(text || `onboarding ${step} failed (${res.status})`);\n  }\n  const out = (await res.json()) as { application_id?: string; applicationId?: string };\n  return out.application_id ?? out.applicationId ?? applicationId ?? \"\";\n}\n\nfunction useStepSubmit(step: OnboardingStep, props: StepProps) {\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const submit = useCallback(\n    async (body: BodyInit | Record<string, unknown>) => {\n      setBusy(true);\n      setError(null);\n      try {\n        const id = await postStep(props.serverUrl, props.token, step, body, props.applicationId);\n        props.onNext(id);\n      } catch (err) {\n        const e2 = err instanceof Error ? err : new Error(String(err));\n        setError(e2.message);\n        props.onError?.(e2);\n      } finally {\n        setBusy(false);\n      }\n    },\n    [step, props.serverUrl, props.token, props.applicationId],\n  );\n  return { busy, error, submit };\n}\n\n/** PII step — date of birth + address. */\nexport const IdentityStep: ComponentType<StepProps> = (props) => {\n  const [dob, setDob] = useState(\"\");\n  const [address, setAddress] = useState(\"\");\n  const { busy, error, submit } = useStepSubmit(\"identity\", props);\n  return h(\n    \"form\",\n    {\n      className: \"hanzo-iam-form\",\n      onSubmit: (e: FormEvent) => {\n        e.preventDefault();\n        void submit({ dob, address });\n      },\n    },\n    h(\"input\", { type: \"date\", required: true, value: dob, onChange: (e: { target: { value: string } }) => setDob(e.target.value) }),\n    h(\"input\", { type: \"text\", placeholder: \"Address\", required: true, value: address, onChange: (e: { target: { value: string } }) => setAddress(e.target.value) }),\n    error ? h(\"p\", { role: \"alert\", className: \"hanzo-iam-error\" }, error) : null,\n    h(\"button\", { type: \"submit\", disabled: busy, className: \"hanzo-iam-btn\" }, busy ? \"Saving…\" : \"Continue\"),\n  );\n};\n\n/** Document upload step — multipart. */\nexport const DocumentsStep: ComponentType<StepProps> = (props) => {\n  const [file, setFile] = useState<File | null>(null);\n  const { busy, error, submit } = useStepSubmit(\"documents\", props);\n  return h(\n    \"form\",\n    {\n      className: \"hanzo-iam-form\",\n      onSubmit: (e: FormEvent) => {\n        e.preventDefault();\n        if (!file) return;\n        const fd = new FormData();\n        fd.append(\"document\", file);\n        void submit(fd);\n      },\n    },\n    h(\"input\", {\n      type: \"file\",\n      required: true,\n      onChange: (e: { target: { files: FileList | null } }) => setFile(e.target.files?.[0] ?? null),\n    }),\n    error ? h(\"p\", { role: \"alert\", className: \"hanzo-iam-error\" }, error) : null,\n    h(\"button\", { type: \"submit\", disabled: busy || !file, className: \"hanzo-iam-btn\" }, busy ? \"Uploading…\" : \"Continue\"),\n  );\n};\n\n/** Biometric / IDV handoff step. */\nexport const BiometricStep: ComponentType<StepProps> = (props) => {\n  const { busy, error, submit } = useStepSubmit(\"biometric\", props);\n  return h(\n    \"div\",\n    { className: \"hanzo-iam-form\" },\n    error ? h(\"p\", { role: \"alert\", className: \"hanzo-iam-error\" }, error) : null,\n    h(\n      \"button\",\n      { type: \"button\", disabled: busy, className: \"hanzo-iam-btn\", onClick: () => void submit({ started: true }) },\n      busy ? \"Starting…\" : \"Start verification\",\n    ),\n  );\n};\n\n/** AML / sanctions screening step. */\nexport const ScreenStep: ComponentType<StepProps> = (props) => {\n  const { busy, error, submit } = useStepSubmit(\"screen\", props);\n  return h(\n    \"div\",\n    { className: \"hanzo-iam-form\" },\n    error ? h(\"p\", { role: \"alert\", className: \"hanzo-iam-error\" }, error) : null,\n    h(\n      \"button\",\n      { type: \"button\", disabled: busy, className: \"hanzo-iam-btn\", onClick: () => void submit({ acknowledged: true }) },\n      busy ? \"Screening…\" : \"Continue\",\n    ),\n  );\n};\n\n/** Finalize + fan-out step. */\nexport const SubmitStep: ComponentType<StepProps> = (props) => {\n  const { busy, error, submit } = useStepSubmit(\"submit\", props);\n  return h(\n    \"div\",\n    { className: \"hanzo-iam-form\" },\n    error ? h(\"p\", { role: \"alert\", className: \"hanzo-iam-error\" }, error) : null,\n    h(\n      \"button\",\n      { type: \"button\", disabled: busy, className: \"hanzo-iam-btn\", onClick: () => void submit({ finalize: true }) },\n      busy ? \"Submitting…\" : \"Submit application\",\n    ),\n  );\n};\n\nconst STEP_COMPONENT: Record<OnboardingStep, ComponentType<StepProps>> = {\n  identity: IdentityStep,\n  documents: DocumentsStep,\n  biometric: BiometricStep,\n  screen: ScreenStep,\n  submit: SubmitStep,\n};\n\n/**\n * Full onboarding pipeline. Renders the selected steps in canonical\n * order, threading the IAM `application_id` returned by each step into\n * the next, and fires `onComplete` after the final step.\n */\nexport const OnboardingFlow: ComponentType<OnboardingFlowProps> = (props) => {\n  const steps = props.steps ?? ALL_STEPS;\n  const [index, setIndex] = useState(0);\n  const [applicationId, setApplicationId] = useState<string | undefined>(undefined);\n\n  const onNext = useCallback(\n    (id: string) => {\n      setApplicationId(id || undefined);\n      if (index >= steps.length - 1) {\n        props.onComplete?.(id);\n      } else {\n        setIndex(index + 1);\n      }\n    },\n    [index, steps.length],\n  );\n\n  const step = steps[index];\n  const StepView = STEP_COMPONENT[step];\n\n  return h(\n    \"div\",\n    { className: props.className ?? \"hanzo-iam-card\" },\n    props.brand ? h(\"div\", { key: \"brand\", className: \"hanzo-iam-brand\" }, props.brand) : null,\n    h(\"div\", { key: \"progress\", className: \"hanzo-iam-progress\" }, `${index + 1} / ${steps.length}`),\n    h(StepView, { key: step, serverUrl: props.serverUrl, token: props.token, applicationId, onNext }),\n  );\n};\n","/**\n * React bindings for @hanzo/iam.\n *\n * Provides a context provider, auth hooks, org/project switching, and the\n * embedded `<Login>` component — the DEFAULT login UI apps should mount.\n * `<Login>` (re-exported here from `@hanzo/iam/views`) keeps every method\n * in-place: social via popup + postMessage, wallet via inline SIWx,\n * email/password/OTP via PKCE-bound code. It never full-page redirects to\n * the hosted login page. `signinRedirect` (surfaced as `useIam().login`)\n * remains available only as an explicit standalone fallback.\n *\n * @example\n * ```tsx\n * import { IamProvider, Login, useIam } from '@hanzo/iam/react'\n *\n * function App() {\n *   return (\n *     <IamProvider config={{\n *       serverUrl: 'https://iam.hanzo.ai',\n *       clientId: 'my-app',\n *       redirectUri: `${window.location.origin}/auth/callback`,\n *     }}>\n *       <MyApp />\n *     </IamProvider>\n *   )\n * }\n *\n * function MyApp() {\n *   const { user, isAuthenticated } = useIam()\n *   // Embedded, in-place — the default. Not a redirect.\n *   if (!isAuthenticated)\n *     return <Login serverUrl=\"https://iam.hanzo.ai\" clientId=\"my-app\"\n *                   redirectUri={`${location.origin}/auth/callback`} state=\"\"\n *                   providers={['google','github','wallet']} />\n *   return <div>Welcome, {user?.displayName}</div>\n * }\n * ```\n *\n * @packageDocumentation\n */\n\nimport {\n  createContext,\n  createElement,\n  useCallback,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n} from \"react\";\nimport type { ReactNode } from \"react\";\nimport { IAM } from \"./browser.js\";\nimport type { IAMConfig } from \"./browser.js\";\nimport type { User, Organization, Project } from \"./types.js\";\nimport type { IAMToken } from \"./browser.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface IamProviderProps {\n  /** Browser IAM SDK configuration. */\n  config: IAMConfig;\n  /** Auto-initialize on mount (check stored tokens). Default: true. */\n  autoInit?: boolean;\n  /** Called when authentication state changes. */\n  onAuthChange?: (authenticated: boolean) => void;\n  children: ReactNode;\n}\n\nexport interface IamContextValue {\n  /** The underlying IAM instance for advanced use. */\n  sdk: IAM;\n  /** The IAM configuration. */\n  config: IAMConfig;\n  /** Authenticated user (null if not logged in). */\n  user: User | null;\n  /** Whether the user is currently authenticated. */\n  isAuthenticated: boolean;\n  /** Whether initial auth check is in progress. */\n  isLoading: boolean;\n  /** Current access token (null if not authenticated). */\n  accessToken: string | null;\n  /**\n   * Explicit standalone FALLBACK: full-page redirect to the hosted login\n   * page. Not the default — prefer the embedded `<Login>` component or\n   * `loginPopup` so login stays in-place.\n   */\n  login: (params?: { additionalParams?: Record<string, string> }) => Promise<void>;\n  /** In-place social login via popup + postMessage. Resolves once signed in. */\n  loginPopup: (params?: { width?: number; height?: number }) => Promise<void>;\n  /** Handle OAuth callback — call on your /auth/callback route. */\n  handleCallback: (callbackUrl?: string) => Promise<IAMToken>;\n  /** Log out and clear all tokens. */\n  logout: () => void;\n  /** Last auth error, if any. */\n  error: Error | null;\n}\n\nexport interface OrgState {\n  /** All organizations the user belongs to. */\n  organizations: Organization[];\n  /** Currently selected organization. */\n  currentOrg: Organization | null;\n  /** Currently selected org ID. */\n  currentOrgId: string | null;\n  /** Switch to a different organization. */\n  switchOrg: (orgId: string) => void;\n  /** All projects for the current organization. */\n  projects: Project[];\n  /** Currently selected project. */\n  currentProject: Project | null;\n  /** Currently selected project ID within the org. */\n  currentProjectId: string | null;\n  /** Switch to a different project (null to clear). */\n  switchProject: (projectId: string | null) => void;\n  /** Whether organizations are loading. */\n  isLoading: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Context\n// ---------------------------------------------------------------------------\n\nconst IamContext = createContext<IamContextValue | null>(null);\nIamContext.displayName = \"IamContext\";\n\n// Storage keys for tenant persistence\nconst STORAGE_ORG_KEY = \"hanzo_iam_current_org\";\nconst STORAGE_PROJECT_KEY = \"hanzo_iam_current_project\";\nconst STORAGE_EXPIRES_KEY = \"hanzo_iam_expires_at\";\n\n// ---------------------------------------------------------------------------\n// IamProvider\n// ---------------------------------------------------------------------------\n\n/**\n * Root provider for Hanzo IAM in React applications.\n *\n * Wrap your app (or a subtree) with this provider to enable IAM auth.\n * Manages the IAM instance, token lifecycle, and auth state.\n */\nexport function IamProvider(props: IamProviderProps) {\n  const { config, autoInit = true, onAuthChange, children } = props;\n\n  const sdk = useMemo(\n    () => new IAM(config),\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n    [config.serverUrl, config.clientId, config.redirectUri],\n  );\n\n  const [user, setUser] = useState<User | null>(null);\n  const [isAuthenticated, setIsAuthenticated] = useState(false);\n  const [isLoading, setIsLoading] = useState(autoInit);\n  const [accessToken, setAccessToken] = useState<string | null>(\n    sdk.getAccessToken(),\n  );\n  const [error, setError] = useState<Error | null>(null);\n  const refreshTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  // Schedule token refresh ~60s before expiry\n  const scheduleRefresh = useCallback(() => {\n    if (refreshTimerRef.current) clearTimeout(refreshTimerRef.current);\n    if (sdk.isTokenExpired()) return;\n\n    const storage = config.storage ?? sessionStorage;\n    const expiresAtStr = storage.getItem(STORAGE_EXPIRES_KEY);\n    if (!expiresAtStr) return;\n\n    const msUntilRefresh = Number(expiresAtStr) - Date.now() - 60_000;\n    if (msUntilRefresh <= 0) {\n      sdk\n        .refreshAccessToken()\n        .then((tokens) => {\n          setAccessToken(tokens.accessToken);\n          scheduleRefresh();\n        })\n        .catch(() => {\n          setIsAuthenticated(false);\n          setUser(null);\n          setAccessToken(null);\n        });\n      return;\n    }\n\n    refreshTimerRef.current = setTimeout(async () => {\n      try {\n        const tokens = await sdk.refreshAccessToken();\n        setAccessToken(tokens.accessToken);\n        scheduleRefresh();\n      } catch {\n        setIsAuthenticated(false);\n        setUser(null);\n        setAccessToken(null);\n      }\n    }, msUntilRefresh);\n  }, [sdk, config.storage]);\n\n  // Auto-init: check stored tokens on mount\n  useEffect(() => {\n    if (!autoInit) {\n      setIsLoading(false);\n      return;\n    }\n\n    let cancelled = false;\n\n    const init = async () => {\n      try {\n        const token = await sdk.getValidAccessToken();\n        if (cancelled) return;\n        if (token) {\n          setAccessToken(token);\n          setIsAuthenticated(true);\n          try {\n            const info = await sdk.getUserInfo();\n            if (!cancelled) setUser(info as unknown as User);\n          } catch {\n            // Token valid but userinfo failed — still authenticated\n          }\n          scheduleRefresh();\n          onAuthChange?.(true);\n        } else {\n          onAuthChange?.(false);\n        }\n      } catch (err) {\n        if (!cancelled) {\n          setError(err instanceof Error ? err : new Error(String(err)));\n          onAuthChange?.(false);\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false);\n      }\n    };\n\n    init();\n    return () => {\n      cancelled = true;\n    };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [sdk, autoInit]);\n\n  // Cleanup refresh timer on unmount\n  useEffect(() => {\n    return () => {\n      if (refreshTimerRef.current) clearTimeout(refreshTimerRef.current);\n    };\n  }, []);\n\n  // Complete authentication after login/callback\n  const completeAuth = useCallback(\n    async (tokens: IAMToken) => {\n      setAccessToken(tokens.accessToken);\n      setIsAuthenticated(true);\n      try {\n        const info = await sdk.getUserInfo();\n        setUser(info as unknown as User);\n      } catch {\n        // ok — token valid, userinfo is optional\n      }\n      scheduleRefresh();\n      onAuthChange?.(true);\n    },\n    [sdk, scheduleRefresh, onAuthChange],\n  );\n\n  const login = useCallback(\n    async (params?: { additionalParams?: Record<string, string> }) => {\n      setError(null);\n      await sdk.signinRedirect(params);\n    },\n    [sdk],\n  );\n\n  const loginPopup = useCallback(\n    async (params?: { width?: number; height?: number }) => {\n      setError(null);\n      try {\n        const tokens = await sdk.signinPopup(params);\n        await completeAuth(tokens);\n      } catch (err) {\n        const e = err instanceof Error ? err : new Error(String(err));\n        setError(e);\n        throw e;\n      }\n    },\n    [sdk, completeAuth],\n  );\n\n  const handleCallback = useCallback(\n    async (callbackUrl?: string) => {\n      setError(null);\n      try {\n        const tokens = await sdk.handleCallback(callbackUrl);\n        await completeAuth(tokens);\n        return tokens;\n      } catch (err) {\n        const e = err instanceof Error ? err : new Error(String(err));\n        setError(e);\n        throw e;\n      }\n    },\n    [sdk, completeAuth],\n  );\n\n  const logout = useCallback(() => {\n    sdk.clearTokens();\n    setUser(null);\n    setIsAuthenticated(false);\n    setAccessToken(null);\n    setError(null);\n    if (refreshTimerRef.current) clearTimeout(refreshTimerRef.current);\n    try {\n      localStorage.removeItem(STORAGE_ORG_KEY);\n      localStorage.removeItem(STORAGE_PROJECT_KEY);\n    } catch {\n      /* ok */\n    }\n    onAuthChange?.(false);\n  }, [sdk, onAuthChange]);\n\n  const value = useMemo<IamContextValue>(\n    () => ({\n      sdk,\n      config,\n      user,\n      isAuthenticated,\n      isLoading,\n      accessToken,\n      login,\n      loginPopup,\n      handleCallback,\n      logout,\n      error,\n    }),\n    [\n      sdk,\n      config,\n      user,\n      isAuthenticated,\n      isLoading,\n      accessToken,\n      login,\n      loginPopup,\n      handleCallback,\n      logout,\n      error,\n    ],\n  );\n\n  return createElement(IamContext.Provider, { value }, children);\n}\n\n// ---------------------------------------------------------------------------\n// useIam\n// ---------------------------------------------------------------------------\n\n/**\n * Access Hanzo IAM auth state and methods.\n * Must be used within an `<IamProvider>`.\n */\nexport function useIam(): IamContextValue {\n  const ctx = useContext(IamContext);\n  if (!ctx) {\n    throw new Error(\"useIam() must be used within an <IamProvider>\");\n  }\n  return ctx;\n}\n\n// ---------------------------------------------------------------------------\n// useOrganizations\n// ---------------------------------------------------------------------------\n\n/**\n * Manage organization switching, derived from the JWT `sub`/`owner`\n * claims. Project state is preserved as an empty list — apps that\n * need full org/project listings must query their own admin API.\n *\n * Selection is persisted to localStorage.\n */\nexport function useOrganizations(): OrgState {\n  const { isAuthenticated, accessToken } = useIam();\n  const [organizations, setOrganizations] = useState<Organization[]>([]);\n\n  const [currentOrgId, setCurrentOrgId] = useState<string | null>(() => {\n    try {\n      return localStorage.getItem(STORAGE_ORG_KEY);\n    } catch {\n      return null;\n    }\n  });\n\n  const [currentProjectId, setCurrentProjectId] = useState<string | null>(\n    () => {\n      try {\n        return localStorage.getItem(STORAGE_PROJECT_KEY);\n      } catch {\n        return null;\n      }\n    },\n  );\n\n  // Derive primary org from the JWT (sub=\"org/username\" or owner claim).\n  // No API call — IAM SDK does not query the Casdoor /api/get-organizations\n  // admin surface. Apps that need a multi-org list must fetch it from\n  // their own admin/control-plane API.\n  useEffect(() => {\n    if (!isAuthenticated || !accessToken) {\n      setOrganizations([]);\n      return;\n    }\n    try {\n      const payload = JSON.parse(atob(accessToken.split(\".\")[1]));\n      const sub = (payload.sub as string) || \"\";\n      const owner = (payload.owner as string) || \"\";\n      const primaryOrg = owner || (sub.includes(\"/\") ? sub.split(\"/\")[0] : \"\");\n      if (primaryOrg) {\n        const syntheticOrg: Organization = {\n          owner: \"admin\",\n          name: primaryOrg,\n          displayName: primaryOrg,\n        };\n        setOrganizations([syntheticOrg]);\n        if (!currentOrgId) {\n          setCurrentOrgId(primaryOrg);\n          try {\n            localStorage.setItem(STORAGE_ORG_KEY, primaryOrg);\n          } catch {\n            /* ok */\n          }\n        }\n      }\n    } catch {\n      // Invalid token format — leave organizations empty\n    }\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [isAuthenticated, accessToken]);\n\n  const projects: Project[] = [];\n  const currentProject: Project | null = null;\n\n  const currentOrg = useMemo(\n    () => organizations.find((o) => o.name === currentOrgId) ?? null,\n    [organizations, currentOrgId],\n  );\n\n  const switchOrg = useCallback((orgId: string) => {\n    setCurrentOrgId(orgId);\n    setCurrentProjectId(null);\n    try {\n      localStorage.setItem(STORAGE_ORG_KEY, orgId);\n      localStorage.removeItem(STORAGE_PROJECT_KEY);\n    } catch {\n      /* ok */\n    }\n  }, []);\n\n  const switchProject = useCallback((projectId: string | null) => {\n    setCurrentProjectId(projectId);\n    try {\n      if (projectId) {\n        localStorage.setItem(STORAGE_PROJECT_KEY, projectId);\n      } else {\n        localStorage.removeItem(STORAGE_PROJECT_KEY);\n      }\n    } catch {\n      /* ok */\n    }\n  }, []);\n\n  return {\n    organizations,\n    currentOrg,\n    currentOrgId,\n    switchOrg,\n    projects,\n    currentProject,\n    currentProjectId,\n    switchProject,\n    isLoading: false,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// useIamToken\n// ---------------------------------------------------------------------------\n\n/**\n * Hook that provides a valid access token with auto-refresh capability.\n * Returns null while loading or if not authenticated.\n */\nexport function useIamToken(): {\n  token: string | null;\n  isValid: boolean;\n  refresh: () => Promise<string | null>;\n} {\n  const { sdk, accessToken, isAuthenticated } = useIam();\n\n  const refresh = useCallback(async () => {\n    try {\n      return await sdk.getValidAccessToken();\n    } catch {\n      return null;\n    }\n  }, [sdk]);\n\n  return {\n    token: accessToken,\n    isValid: isAuthenticated && !!accessToken && !sdk.isTokenExpired(),\n    refresh,\n  };\n}\n\n// Re-export context for advanced use\nexport { IamContext };\n\n// ---------------------------------------------------------------------------\n// OrgProjectSwitcher component\n// ---------------------------------------------------------------------------\n\nexport interface OrgProjectSwitcherProps {\n  organizations: Array<{ name: string; displayName?: string; owner?: string }>;\n  currentOrgId: string | null;\n  switchOrg: (orgId: string) => void;\n  projects?: Array<{ name: string; displayName?: string; organization?: string; isDefault?: boolean }>;\n  currentProjectId?: string | null;\n  switchProject?: (projectId: string | null) => void;\n  onTenantChange?: (orgId: string | null, projectId: string | null) => void;\n  environment?: string | null;\n  className?: string;\n  alwaysShow?: boolean;\n}\n\n/**\n * Organization and project switcher component.\n *\n * @example\n * ```tsx\n * import { useOrganizations, OrgProjectSwitcher } from '@hanzo/iam/react'\n *\n * function Nav() {\n *   const orgState = useOrganizations()\n *   return <OrgProjectSwitcher {...orgState} />\n * }\n * ```\n */\nexport function OrgProjectSwitcher({\n  organizations,\n  currentOrgId,\n  switchOrg,\n  projects = [],\n  currentProjectId = null,\n  switchProject,\n  onTenantChange,\n  environment,\n  className = \"\",\n  alwaysShow = false,\n}: OrgProjectSwitcherProps) {\n  useEffect(() => {\n    onTenantChange?.(currentOrgId, currentProjectId ?? null);\n  }, [currentOrgId, currentProjectId, onTenantChange]);\n\n  const handleOrgChange = useCallback(\n    (e: { target: { value: string } }) => switchOrg(e.target.value),\n    [switchOrg],\n  );\n\n  const handleProjectChange = useCallback(\n    (e: { target: { value: string } }) => switchProject?.(e.target.value || null),\n    [switchProject],\n  );\n\n  if (!alwaysShow && organizations.length <= 1 && projects.length <= 1) {\n    if (organizations.length === 1) {\n      const org = organizations[0];\n      return createElement(\n        \"div\",\n        { className: `flex items-center gap-2 text-sm ${className}` },\n        createElement(\"span\", { className: \"font-medium\" }, org.displayName || org.name),\n        projects.length === 1\n          ? [\n              createElement(\"span\", { className: \"text-muted-foreground\", key: \"sep\" }, \"/\"),\n              createElement(\"span\", { key: \"proj\" }, projects[0].displayName || projects[0].name),\n            ]\n          : null,\n        environment\n          ? createElement(\n              \"span\",\n              { className: \"rounded-full bg-muted px-2 py-0.5 text-xs text-muted-foreground\" },\n              environment,\n            )\n          : null,\n      );\n    }\n    return null;\n  }\n\n  return createElement(\n    \"div\",\n    { className: `flex items-center gap-2 ${className}` },\n    createElement(\n      \"select\",\n      {\n        value: currentOrgId ?? \"\",\n        onChange: handleOrgChange,\n        className:\n          \"h-8 rounded-md border border-border bg-background px-2 text-sm text-foreground focus:outline-none focus:ring-1 focus:ring-ring\",\n        \"aria-label\": \"Switch organization\",\n      },\n      ...organizations.map((org) =>\n        createElement(\"option\", { key: org.name, value: org.name }, org.displayName || org.name),\n      ),\n    ),\n    projects.length > 0 && switchProject\n      ? [\n          createElement(\"span\", { className: \"text-muted-foreground\", key: \"sep\" }, \"/\"),\n          createElement(\n            \"select\",\n            {\n              key: \"proj-select\",\n              value: currentProjectId ?? \"\",\n              onChange: handleProjectChange,\n              className:\n                \"h-8 rounded-md border border-border bg-background px-2 text-sm text-foreground focus:outline-none focus:ring-1 focus:ring-ring\",\n              \"aria-label\": \"Switch project\",\n            },\n            ...projects.map((proj) =>\n              createElement(\"option\", { key: proj.name, value: proj.name }, proj.displayName || proj.name),\n            ),\n          ),\n        ]\n      : null,\n    environment\n      ? createElement(\n          \"span\",\n          { className: \"rounded-full bg-muted px-2 py-0.5 text-xs text-muted-foreground\" },\n          environment,\n        )\n      : null,\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Embedded login surface — the DEFAULT the /react entry hands apps.\n//\n// `<Login>` is the one login UI: in-place social (popup + postMessage),\n// in-place wallet (inline SIWx), and PKCE-bound email/password/OTP. Apps\n// import it straight from \"@hanzo/iam/react\" instead of reaching for\n// `signinRedirect`. `completePopupSignin` is the popup callback-page bridge,\n// re-exported so the same entry covers the whole flow.\n// ---------------------------------------------------------------------------\n\nexport {\n  Login,\n  SocialButton,\n  WalletButton,\n  EmailPasswordForm,\n  OTPStep,\n  useAuthMethods,\n  OnboardingFlow,\n  type LoginProps,\n  type SocialButtonProps,\n  type WalletButtonProps,\n  type EmailPasswordFormProps,\n  type OTPStepProps,\n  type AuthMethod,\n  type AuthMethodKind,\n  type MethodsResponse,\n  type MethodsView,\n  type FlowProps,\n} from \"./views.js\";\n\nexport { completePopupSignin } from \"./browser.js\";\n"]}