{"version":3,"sources":["../src/handlers.ts","../src/idp/handlers/auth.ts","../src/idp/utils/problem.ts","../src/idp/utils/ed25519.ts","../src/idp/utils/auth-token.ts","../src/idp/handlers/enroll.ts","../src/idp/handlers/admin.ts","../src/idp/utils/bearer-auth.ts","../src/idp/handlers/authorize.ts","../src/idp/handlers/session.ts","../src/idp/handlers/token.ts","../src/idp/handlers/jwks.ts","../src/idp/handlers/discovery.ts","../src/idp/handlers/grants.ts","../src/idp/handlers/delegations.ts"],"sourcesContent":["export type { IdPConfig, IdPStores } from './idp/config.js'\nexport {\n createChallengeHandler,\n createAuthenticateHandler,\n createEnrollHandler,\n createAuthorizeHandler,\n createTokenHandler,\n createJWKSHandler,\n createDiscoveryHandler,\n createApproveGrantHandler,\n createBatchGrantHandler,\n createConsumeGrantHandler,\n createCreateGrantHandler,\n createDenyGrantHandler,\n createGetGrantHandler,\n createGrantTokenHandler,\n createListGrantsHandler,\n createRevokeGrantHandler,\n createVerifyGrantHandler,\n createAddSshKeyHandler,\n createCreateUserHandler,\n createDeleteSshKeyHandler,\n createDeleteUserHandler,\n createListSshKeysHandler,\n createListUsersHandler,\n createCreateDelegationHandler,\n createListDelegationsHandler,\n createRevokeDelegationHandler,\n createValidateDelegationHandler,\n createLoginPageHandler,\n createSessionLoginHandler,\n createSessionLogoutHandler,\n} from './idp/handlers/index.js'\n","import { defineEventHandler, readBody } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyEd25519Signature } from '../utils/ed25519.js'\nimport { issueAuthToken } from '../utils/auth-token.js'\n\nexport function createChallengeHandler(stores: IdPStores, _config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const body = await readBody<{ id: string }>(event)\n\n if (!body.id) {\n throw createProblemError({ status: 400, title: 'Missing required field: id' })\n }\n\n // A deactivated user must not receive challenges, even with SSH keys on file\n const user = await stores.userStore.findByEmail(body.id)\n if (user && !user.isActive) {\n throw createProblemError({ status: 403, title: 'User is inactive' })\n }\n if (user) {\n const challenge = await stores.challengeStore.createChallenge(user.email)\n return { challenge }\n }\n\n // Identities known only by SSH key (no userStore record)\n const sshKeys = await stores.sshKeyStore.findByUser(body.id)\n if (sshKeys.length > 0) {\n const challenge = await stores.challengeStore.createChallenge(body.id)\n return { challenge }\n }\n\n throw createProblemError({ status: 404, title: 'No user with SSH keys found for this identity' })\n })\n}\n\nexport function createAuthenticateHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const body = await readBody<{\n id: string\n challenge: string\n signature: string\n public_key?: string\n }>(event)\n\n if (!body.id || !body.challenge || !body.signature) {\n throw createProblemError({ status: 400, title: 'Missing required fields: id, challenge, signature' })\n }\n\n const user = await stores.userStore.findByEmail(body.id)\n if (!user) {\n throw createProblemError({ status: 404, title: 'User not found' })\n }\n\n if (!user.isActive) {\n throw createProblemError({ status: 403, title: 'User is inactive' })\n }\n\n // Determine which SSH key(s) to verify against\n let keys\n if (body.public_key) {\n const sshKey = await stores.sshKeyStore.findByPublicKey(body.public_key)\n if (!sshKey || sshKey.userEmail !== body.id) {\n throw createProblemError({ status: 404, title: 'SSH key not found for this user' })\n }\n keys = [sshKey]\n }\n else {\n keys = await stores.sshKeyStore.findByUser(body.id)\n if (keys.length === 0) {\n throw createProblemError({ status: 404, title: 'No SSH keys found for this user' })\n }\n }\n\n // Consume challenge\n const valid = await stores.challengeStore.consumeChallenge(body.challenge, body.id)\n if (!valid) {\n throw createProblemError({ status: 401, title: 'Invalid, expired, or already used challenge' })\n }\n\n // Try each registered key until one verifies\n const signatureBuffer = Buffer.from(body.signature, 'base64')\n let isValid = false\n for (const key of keys) {\n if (verifyEd25519Signature(key.publicKey, body.challenge, signatureBuffer)) {\n isValid = true\n break\n }\n }\n if (!isValid) {\n throw createProblemError({ status: 401, title: 'Invalid signature', type: 'https://ddisa.org/errors/invalid_token' })\n }\n\n // Determine act: explicit type > fallback (owner → agent, no owner → human)\n const act = user.type ?? (user.owner ? 'agent' as const : 'human' as const)\n\n const signingKey = await stores.keyStore.getSigningKey()\n const token = await issueAuthToken(\n { sub: user.email, act },\n config.issuer,\n signingKey.privateKey,\n signingKey.kid,\n )\n\n return {\n token,\n id: user.email,\n email: user.email,\n name: user.name,\n act,\n expires_in: 3600,\n }\n })\n}\n","import { createError } from 'h3'\nimport { createProblemDetails } from '@openape/core'\n\nexport function createProblemError(opts: {\n type?: string\n title: string\n status: number\n detail?: string\n}) {\n const problem = createProblemDetails(opts)\n return createError({\n statusCode: opts.status,\n statusMessage: opts.title,\n data: problem,\n })\n}\n","import type { KeyObject } from 'node:crypto'\nimport { createPublicKey, verify } from 'node:crypto'\n\nconst ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex')\n\nconst RE_WHITESPACE = /\\s+/\n\nfunction parseSSHEd25519PublicKey(sshKey: string): KeyObject {\n const parts = sshKey.trim().split(RE_WHITESPACE)\n if (parts[0] !== 'ssh-ed25519' || !parts[1]) {\n throw new Error('Not an ssh-ed25519 key')\n }\n\n const wireFormat = Buffer.from(parts[1], 'base64')\n\n let offset = 0\n const typeLen = wireFormat.readUInt32BE(offset)\n offset += 4\n const keyType = wireFormat.subarray(offset, offset + typeLen).toString()\n offset += typeLen\n\n if (keyType !== 'ssh-ed25519') {\n throw new Error(`Unexpected key type in wire format: ${keyType}`)\n }\n\n const keyLen = wireFormat.readUInt32BE(offset)\n offset += 4\n const rawKey = wireFormat.subarray(offset, offset + keyLen)\n\n if (rawKey.length !== 32) {\n throw new Error(`Expected 32-byte ed25519 key, got ${rawKey.length}`)\n }\n\n const spkiDer = Buffer.concat([ED25519_SPKI_PREFIX, rawKey])\n\n return createPublicKey({\n key: spkiDer,\n format: 'der',\n type: 'spki',\n })\n}\n\n/**\n * Parse an SSH Ed25519 public key into a Node.js KeyObject.\n * The returned KeyObject is compatible with jose's KeyLike type\n * and can be used for EdDSA JWT verification.\n */\nexport function sshEd25519ToKeyObject(sshKey: string): KeyObject {\n return parseSSHEd25519PublicKey(sshKey)\n}\n\nexport function verifyEd25519Signature(\n sshPublicKey: string,\n data: Buffer | string,\n signature: Buffer,\n): boolean {\n const pubKey = parseSSHEd25519PublicKey(sshPublicKey)\n const dataBuffer = typeof data === 'string' ? Buffer.from(data) : data\n return verify(null, dataBuffer, pubKey, signature)\n}\n","import type { ActorType } from '@openape/core'\nimport type { KeyLike } from 'jose'\nimport { jwtVerify, SignJWT } from 'jose'\n\n/**\n * Default audience for CLI-issued tokens. Every token issued by the IdP for\n * the apes ecosystem carries `aud='apes-cli'` so that downstream service\n * providers can enforce `expectedAud='apes-cli'` on their token-exchange\n * endpoints and reject tokens minted for any other purpose.\n */\nexport const DEFAULT_CLI_AUDIENCE = 'apes-cli'\n\nexport interface AuthTokenPayload {\n sub: string\n act: ActorType\n aud?: string\n}\n\nexport async function issueAuthToken(\n payload: { sub: string, act: ActorType, aud?: string },\n issuer: string,\n privateKey: KeyLike,\n kid?: string,\n): Promise {\n const jwt = new SignJWT({ sub: payload.sub, act: payload.act })\n .setProtectedHeader({ alg: 'EdDSA', ...(kid ? { kid } : {}) })\n .setIssuer(issuer)\n .setSubject(payload.sub)\n .setAudience(payload.aud ?? DEFAULT_CLI_AUDIENCE)\n .setIssuedAt()\n .setExpirationTime('1h')\n\n return await jwt.sign(privateKey)\n}\n\nexport async function verifyAuthToken(\n token: string,\n issuer: string,\n publicKey: KeyLike | Uint8Array,\n expectedAud?: string,\n): Promise {\n const { payload } = await jwtVerify(token, publicKey, {\n issuer,\n ...(expectedAud ? { audience: expectedAud } : {}),\n algorithms: ['EdDSA'],\n })\n\n const act = payload.act\n if (act !== 'agent' && act !== 'human') {\n throw new Error('Invalid act claim')\n }\n\n return {\n sub: payload.sub as string,\n act,\n ...(typeof payload.aud === 'string' ? { aud: payload.aud } : {}),\n }\n}\n","import { createHash } from 'node:crypto'\nimport { defineEventHandler, readBody } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { sshEd25519ToKeyObject } from '../utils/ed25519.js'\nimport { hasManagementToken } from './admin.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\n\nexport function createEnrollHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n // --- Determine auth method: management token or Bearer token ---\n const isMgmt = hasManagementToken(event, config)\n\n let callerEmail: string | undefined\n if (!isMgmt) {\n const payload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n if (!payload) {\n throw createProblemError({ status: 401, title: 'Authentication required (management token or Bearer token)' })\n }\n if (payload.act !== 'human') {\n throw createProblemError({ status: 403, title: 'Only human users may enroll sub-users' })\n }\n callerEmail = payload.sub\n }\n\n const body = await readBody<{\n email: string\n name: string\n publicKey: string\n owner?: string\n approver?: string\n type?: 'human' | 'agent'\n }>(event)\n\n // --- Validate required fields ---\n // For management token: owner is required in body\n // For Bearer token: owner is automatically set to caller\n if (isMgmt) {\n if (!body.email || !body.name || !body.publicKey || !body.owner) {\n throw createProblemError({ status: 400, title: 'Missing required fields: email, name, publicKey, owner' })\n }\n }\n else {\n if (!body.email || !body.name || !body.publicKey) {\n throw createProblemError({ status: 400, title: 'Missing required fields: email, name, publicKey' })\n }\n }\n\n // Input length validation\n if (body.email.length > 255) {\n throw createProblemError({ status: 400, title: 'Email must not exceed 255 characters' })\n }\n if (body.name.length > 255) {\n throw createProblemError({ status: 400, title: 'Name must not exceed 255 characters' })\n }\n if (body.publicKey.length > 1000) {\n throw createProblemError({ status: 400, title: 'Public key must not exceed 1000 characters' })\n }\n\n if (!body.publicKey.startsWith('ssh-ed25519 ')) {\n throw createProblemError({ status: 400, title: 'Public key must be in ssh-ed25519 format' })\n }\n\n // Validate key format\n try {\n sshEd25519ToKeyObject(body.publicKey)\n }\n catch {\n throw createProblemError({ status: 400, title: 'Invalid SSH key format' })\n }\n\n // Check for duplicate email\n const existing = await stores.userStore.findByEmail(body.email)\n if (existing) {\n throw createProblemError({ status: 409, title: 'A user with this email already exists' })\n }\n\n // Check for duplicate public key\n const existingKey = await stores.sshKeyStore.findByPublicKey(body.publicKey)\n if (existingKey) {\n throw createProblemError({ status: 409, title: 'A user with this public key already exists' })\n }\n\n // --- Determine owner, approver, type ---\n const owner = isMgmt ? body.owner! : callerEmail!\n const approver = isMgmt ? (body.approver ?? owner) : callerEmail!\n const type = body.type ?? 'agent'\n\n // Create user\n const user = await stores.userStore.create({\n email: body.email,\n name: body.name,\n owner,\n approver,\n type,\n isActive: true,\n createdAt: Date.now(),\n })\n\n // Register SSH key\n const trimmedKey = body.publicKey.trim()\n const parts = trimmedKey.split(/\\s+/)\n const keyData = parts[1]!\n const keyId = createHash('sha256').update(Buffer.from(keyData, 'base64')).digest('hex')\n\n await stores.sshKeyStore.save({\n keyId,\n userEmail: body.email,\n publicKey: trimmedKey,\n name: body.name,\n createdAt: Math.floor(Date.now() / 1000),\n })\n\n return {\n email: user.email,\n name: user.name,\n owner: user.owner,\n approver: user.approver,\n type,\n status: 'active',\n }\n })\n}\n","import { createHash, timingSafeEqual } from 'node:crypto'\nimport type { H3Event } from 'h3'\nimport { defineEventHandler, getQuery, getRequestHeader, getRouterParam, readBody } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { sshEd25519ToKeyObject } from '../utils/ed25519.js'\n\n/** Timing-safe string comparison to prevent timing attacks on token validation. */\nfunction safeCompare(a: string, b: string): boolean {\n if (a.length !== b.length) return false\n return timingSafeEqual(Buffer.from(a), Buffer.from(b))\n}\n\nfunction requireManagementToken(event: H3Event, config: IdPConfig): void {\n if (!config.managementToken) {\n throw createProblemError({ status: 501, title: 'Management token not configured' })\n }\n const authHeader = getRequestHeader(event, 'authorization')\n if (!authHeader) {\n throw createProblemError({ status: 401, title: 'Authorization header required' })\n }\n const token = authHeader.replace(/^Bearer\\s+/i, '')\n if (!safeCompare(token, config.managementToken)) {\n throw createProblemError({ status: 403, title: 'Invalid management token' })\n }\n}\n\n/** Check if the request carries a valid management token (non-throwing). */\nexport function hasManagementToken(event: H3Event, config: IdPConfig): boolean {\n if (!config.managementToken) return false\n const authHeader = getRequestHeader(event, 'authorization')\n if (!authHeader) return false\n const token = authHeader.replace(/^Bearer\\s+/i, '')\n return safeCompare(token, config.managementToken)\n}\n\n// --- List Users ---\nexport function createListUsersHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n requireManagementToken(event, config)\n const query = getQuery(event)\n const result = await stores.userStore.list({\n limit: query.limit ? Number(query.limit) : undefined,\n cursor: query.cursor ? String(query.cursor) : undefined,\n search: query.search ? String(query.search) : undefined,\n })\n return {\n data: result.data.map(u => ({ email: u.email, name: u.name, isActive: u.isActive, owner: u.owner, createdAt: u.createdAt })),\n pagination: result.pagination,\n }\n })\n}\n\n// --- Delete User ---\nexport function createDeleteUserHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n requireManagementToken(event, config)\n\n const email = decodeURIComponent(getRouterParam(event, 'email')!)\n const user = await stores.userStore.findByEmail(email)\n if (!user) {\n throw createProblemError({ status: 404, title: 'User not found' })\n }\n\n // Delete user's SSH keys first\n await stores.sshKeyStore.deleteAllForUser(email)\n await stores.userStore.delete(email)\n return { ok: true }\n })\n}\n\n// --- Create User ---\nexport function createCreateUserHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n requireManagementToken(event, config)\n\n const body = await readBody<{ email: string, name: string, password?: string }>(event)\n if (!body.email || !body.name) {\n throw createProblemError({ status: 400, title: 'Missing required fields: email, name' })\n }\n\n // Input length validation\n if (body.email.length > 255) {\n throw createProblemError({ status: 400, title: 'Email must not exceed 255 characters' })\n }\n if (body.name.length > 255) {\n throw createProblemError({ status: 400, title: 'Name must not exceed 255 characters' })\n }\n\n const existing = await stores.userStore.findByEmail(body.email)\n if (existing) {\n throw createProblemError({ status: 409, title: 'User already exists' })\n }\n\n const user = await stores.userStore.create({\n email: body.email,\n name: body.name,\n isActive: true,\n createdAt: Date.now(),\n })\n return { ok: true, email: user.email, name: user.name }\n })\n}\n\n// --- Add SSH Key ---\nexport function createAddSshKeyHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n requireManagementToken(event, config)\n\n const email = decodeURIComponent(getRouterParam(event, 'email')!)\n\n const body = await readBody<{ publicKey: string, name?: string }>(event)\n if (!body.publicKey || typeof body.publicKey !== 'string') {\n throw createProblemError({ status: 400, title: 'Missing required field: publicKey' })\n }\n\n // Input length validation\n if (body.publicKey.length > 1000) {\n throw createProblemError({ status: 400, title: 'Public key must not exceed 1000 characters' })\n }\n if (body.name && body.name.length > 255) {\n throw createProblemError({ status: 400, title: 'Name must not exceed 255 characters' })\n }\n\n const trimmedKey = body.publicKey.trim()\n\n // Validate ssh-ed25519 format\n try {\n sshEd25519ToKeyObject(trimmedKey)\n }\n catch {\n throw createProblemError({ status: 400, title: 'Invalid SSH key. Must be ssh-ed25519 format.' })\n }\n\n // Extract comment as fallback name\n const parts = trimmedKey.split(/\\s+/)\n const comment = parts.length >= 3 ? parts.slice(2).join(' ') : undefined\n const name = body.name || comment || 'SSH Key'\n\n // Compute SHA256 fingerprint as keyId\n const keyData = parts[1]!\n const keyId = createHash('sha256').update(Buffer.from(keyData, 'base64')).digest('hex')\n\n // Check for duplicate key\n const existing = await stores.sshKeyStore.findByPublicKey(trimmedKey)\n if (existing) {\n throw createProblemError({ status: 409, title: 'This SSH key is already registered' })\n }\n\n // Ensure user exists — create if not\n const user = await stores.userStore.findByEmail(email)\n if (!user) {\n await stores.userStore.create({\n email,\n name,\n isActive: true,\n createdAt: Date.now(),\n })\n }\n\n const sshKey = {\n keyId,\n userEmail: email,\n publicKey: trimmedKey,\n name,\n createdAt: Math.floor(Date.now() / 1000),\n }\n\n await stores.sshKeyStore.save(sshKey)\n return sshKey\n })\n}\n\n// --- List SSH Keys ---\nexport function createListSshKeysHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n requireManagementToken(event, config)\n\n const email = decodeURIComponent(getRouterParam(event, 'email')!)\n\n return await stores.sshKeyStore.findByUser(email)\n })\n}\n\n// --- Delete SSH Key ---\nexport function createDeleteSshKeyHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n requireManagementToken(event, config)\n\n const keyId = getRouterParam(event, 'keyId')!\n\n const existing = await stores.sshKeyStore.findById(keyId)\n if (!existing) {\n throw createProblemError({ status: 404, title: 'SSH key not found' })\n }\n\n await stores.sshKeyStore.delete(keyId)\n return { ok: true }\n })\n}\n","import type { H3Event } from 'h3'\nimport { getHeader } from 'h3'\nimport type { KeyStore } from '@openape/auth'\nimport type { AuthTokenPayload } from './auth-token.js'\nimport { verifyAuthToken } from './auth-token.js'\n\nfunction extractBearerToken(event: H3Event): string | null {\n const authHeader = getHeader(event, 'authorization')\n if (!authHeader?.startsWith('Bearer '))\n return null\n return authHeader.slice(7)\n}\n\nexport async function verifyBearerAuth(\n event: H3Event,\n keyStore: KeyStore,\n issuer: string,\n): Promise {\n const token = extractBearerToken(event)\n if (!token)\n return null\n\n const signingKey = await keyStore.getSigningKey()\n\n try {\n return await verifyAuthToken(token, issuer, signingKey.publicKey)\n }\n catch {\n return null\n }\n}\n","import type { ActorType, DelegationActClaim, OpenApeAuthorizationDetail } from '@openape/core'\nimport type { AuthorizeParams } from '@openape/auth'\nimport { defineEventHandler, getQuery, sendRedirect, useSession } from 'h3'\nimport { validateAuthorizeRequest } from '@openape/auth'\nimport { approveGrant, createGrant, useGrant, validateDelegation } from '@openape/grants'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\nimport { getSessionConfig } from './session.js'\n\nfunction parseAuthorizationDetails(raw: string | undefined): OpenApeAuthorizationDetail[] {\n if (!raw) return []\n try {\n const parsed = JSON.parse(raw)\n if (!Array.isArray(parsed)) return []\n return parsed.filter(\n (d: unknown): d is OpenApeAuthorizationDetail =>\n typeof d === 'object'\n && d !== null\n && ['openape_grant', 'openape_cli'].includes(String((d as Record).type ?? ''))\n && typeof (d as Record).action === 'string',\n )\n }\n catch {\n return []\n }\n}\n\nexport function createAuthorizeHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const query = getQuery(event)\n\n const params: AuthorizeParams = {\n client_id: String(query.client_id ?? ''),\n redirect_uri: String(query.redirect_uri ?? ''),\n state: String(query.state ?? ''),\n code_challenge: String(query.code_challenge ?? ''),\n code_challenge_method: String(query.code_challenge_method ?? ''),\n nonce: query.nonce ? String(query.nonce) : undefined,\n response_type: String(query.response_type ?? ''),\n scope: String(query.scope ?? ''),\n }\n\n const error = validateAuthorizeRequest(params)\n if (error) {\n if (params.redirect_uri) {\n try {\n const errorUrl = new URL(params.redirect_uri)\n errorUrl.searchParams.set('error', 'invalid_request')\n errorUrl.searchParams.set('error_description', error)\n if (params.state) {\n errorUrl.searchParams.set('state', params.state)\n }\n return sendRedirect(event, errorUrl.toString())\n }\n catch {\n // Invalid redirect_uri — fall through to createProblemError\n }\n }\n throw createProblemError({ status: 400, title: error })\n }\n\n // Try Bearer token first (CLI/agent flow)\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n\n let userId: string\n let actorType: ActorType | undefined\n let delegationAct: DelegationActClaim | undefined\n let delegationGrantId: string | undefined\n\n const delegationGrantParam = String(query.delegation_grant ?? '')\n\n if (bearerPayload) {\n // Deactivation must also stop still-valid bearer tokens (#1144\n // follow-up). Unknown identities pass — only an existing user\n // with isActive === false is refused.\n const bearerUser = await stores.userStore.findByEmail(bearerPayload.sub)\n if (bearerUser && !bearerUser.isActive) {\n throw createProblemError({ status: 403, title: 'User is inactive' })\n }\n if (delegationGrantParam) {\n const grant = await validateDelegation(\n delegationGrantParam,\n bearerPayload.sub,\n params.client_id,\n stores.grantStore,\n )\n userId = grant.request.delegator!\n delegationAct = { sub: bearerPayload.sub }\n delegationGrantId = grant.id\n await useGrant(grant.id, stores.grantStore)\n }\n else {\n userId = bearerPayload.sub\n actorType = bearerPayload.act === 'agent' ? 'agent' : undefined\n }\n }\n else {\n // Try session (browser flow)\n const session = await useSession(event, getSessionConfig(config))\n\n if (!session.data.userId) {\n // No auth at all — redirect to login page\n const returnTo = `/authorize?${new URLSearchParams(query as Record).toString()}`\n return sendRedirect(event, `/login?returnTo=${encodeURIComponent(returnTo)}`)\n }\n\n const sessionUserId = session.data.userId as string\n const user = await stores.userStore.findByEmail(sessionUserId)\n if (!user || !user.isActive) {\n throw createProblemError({ status: 401, title: 'User not found or inactive' })\n }\n\n if (delegationGrantParam) {\n const grant = await validateDelegation(\n delegationGrantParam,\n sessionUserId,\n params.client_id,\n stores.grantStore,\n )\n userId = grant.request.delegator!\n delegationAct = { sub: sessionUserId }\n delegationGrantId = grant.id\n await useGrant(grant.id, stores.grantStore)\n }\n else {\n userId = sessionUserId\n actorType = user.type ?? (user.owner ? 'agent' : undefined)\n }\n }\n\n // Delegation resolves userId to the delegator — a deactivated\n // delegator must not have codes minted in their name either.\n if (delegationGrantParam) {\n const delegator = await stores.userStore.findByEmail(userId)\n if (delegator && !delegator.isActive) {\n throw createProblemError({ status: 403, title: 'User is inactive' })\n }\n }\n\n // Parse and process authorization_details (RFC 9396)\n const authzDetails = parseAuthorizationDetails(String(query.authorization_details ?? ''))\n let approvedDetails: OpenApeAuthorizationDetail[] | undefined\n\n if (authzDetails.length > 0) {\n approvedDetails = []\n\n for (const detail of authzDetails) {\n const grant = await createGrant({\n requester: bearerPayload ? bearerPayload.sub : userId,\n target_host: params.client_id,\n audience: params.client_id,\n grant_type: detail.approval ?? 'once',\n permissions: [detail.type === 'openape_cli' ? detail.permission : detail.action],\n ...(detail.type === 'openape_cli' ? { authorization_details: [detail] } : {}),\n reason: detail.reason,\n }, stores.grantStore)\n\n const approved = await approveGrant(grant.id, userId, stores.grantStore)\n approvedDetails.push({\n ...detail,\n grant_id: approved.id,\n })\n }\n }\n\n const code = crypto.randomUUID()\n await stores.codeStore.save({\n code,\n clientId: params.client_id,\n redirectUri: params.redirect_uri,\n codeChallenge: params.code_challenge,\n userId,\n nonce: params.nonce,\n expiresAt: Date.now() + 60_000,\n act: actorType,\n scope: params.scope || undefined,\n authorizationDetails: approvedDetails,\n delegationAct,\n delegationGrant: delegationGrantId,\n })\n\n const redirectUrl = new URL(params.redirect_uri)\n redirectUrl.searchParams.set('code', code)\n redirectUrl.searchParams.set('state', params.state)\n\n return sendRedirect(event, redirectUrl.toString())\n })\n}\n","import type { EventHandler } from 'h3'\nimport { defineEventHandler, getQuery, readBody, useSession } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyEd25519Signature } from '../utils/ed25519.js'\n\nconst IDP_SESSION_NAME = 'openape-idp'\nconst DEFAULT_SESSION_SECRET = 'default-secret-change-me-in-production!'\n\nexport function getSessionConfig(config: IdPConfig) {\n return {\n name: IDP_SESSION_NAME,\n password: config.sessionSecret || DEFAULT_SESSION_SECRET,\n cookie: {\n httpOnly: true,\n secure: config.issuer.startsWith('https://'),\n sameSite: 'lax' as const,\n maxAge: 60 * 60 * 24 * 7, // 7 days\n },\n }\n}\n\n/**\n * POST /api/session/login\n *\n * Headless session login: accepts { id, challenge, signature },\n * verifies the ed25519 signature, and sets a session cookie with { userId }.\n */\nexport function createSessionLoginHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const body = await readBody<{\n id: string\n challenge: string\n signature: string\n public_key?: string\n }>(event)\n\n if (!body.id || !body.challenge || !body.signature) {\n throw createProblemError({ status: 400, title: 'Missing required fields: id, challenge, signature' })\n }\n\n const user = await stores.userStore.findByEmail(body.id)\n if (!user) {\n throw createProblemError({ status: 404, title: 'User not found' })\n }\n if (!user.isActive) {\n throw createProblemError({ status: 403, title: 'User is inactive' })\n }\n\n // Determine which SSH key(s) to verify against\n let keys\n if (body.public_key) {\n const sshKey = await stores.sshKeyStore.findByPublicKey(body.public_key)\n if (!sshKey || sshKey.userEmail !== body.id) {\n throw createProblemError({ status: 404, title: 'SSH key not found for this user' })\n }\n keys = [sshKey]\n }\n else {\n keys = await stores.sshKeyStore.findByUser(body.id)\n if (keys.length === 0) {\n throw createProblemError({ status: 404, title: 'No SSH keys found for this user' })\n }\n }\n\n // Consume challenge\n const valid = await stores.challengeStore.consumeChallenge(body.challenge, body.id)\n if (!valid) {\n throw createProblemError({ status: 401, title: 'Invalid, expired, or already used challenge' })\n }\n\n // Try each registered key until one verifies\n const signatureBuffer = Buffer.from(body.signature, 'base64')\n let isValid = false\n for (const key of keys) {\n if (verifyEd25519Signature(key.publicKey, body.challenge, signatureBuffer)) {\n isValid = true\n break\n }\n }\n if (!isValid) {\n throw createProblemError({ status: 401, title: 'Invalid signature', type: 'https://ddisa.org/errors/invalid_token' })\n }\n\n // Set session cookie\n const session = await useSession(event, getSessionConfig(config))\n await session.update({ userId: user.email })\n\n return { ok: true }\n })\n}\n\n/**\n * POST /api/session/logout\n *\n * Clears the IdP session cookie.\n */\nexport function createSessionLogoutHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const session = await useSession(event, getSessionConfig(config))\n await session.clear()\n return { ok: true }\n })\n}\n\n/**\n * GET /login\n *\n * Returns the returnTo parameter as JSON.\n * In a real app this would render a login form;\n * for headless/test usage it signals that login is required.\n */\nexport function createLoginPageHandler(): EventHandler {\n return defineEventHandler((event) => {\n const query = getQuery(event)\n return { loginRequired: true, returnTo: query.returnTo || '/' }\n })\n}\n","import type { H3Event } from 'h3'\nimport type { TokenExchangeParams } from '@openape/auth'\nimport { defineEventHandler, getRequestHeader, readRawBody, setResponseStatus } from 'h3'\nimport { handleRefreshGrant, handleTokenExchange, InactiveUserError, issueAssertion, validateClientAssertion } from '@openape/auth'\nimport { useGrant, validateDelegation } from '@openape/grants'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { sshEd25519ToKeyObject } from '../utils/ed25519.js'\nimport { issueAuthToken } from '../utils/auth-token.js'\n\nconst RE_WHITESPACE = /\\s+/\n\nfunction oauthError(event: H3Event, status: number, error: string, description: string) {\n setResponseStatus(event, status)\n return { error, error_description: description }\n}\n\nfunction parseScope(scope?: string): Set {\n if (!scope) return new Set()\n return new Set(scope.split(RE_WHITESPACE).filter(Boolean))\n}\n\nfunction resolveUserClaimsFactory(stores: IdPStores) {\n return async (userId: string, scope?: string) => {\n const scopes = parseScope(scope)\n const claims: { email?: string, name?: string } = {}\n\n const includeAll = scopes.size === 0\n const needsUser = includeAll || scopes.has('email') || scopes.has('profile')\n\n if (needsUser) {\n const user = await stores.userStore.findByEmail(userId)\n if (user) {\n if (includeAll || scopes.has('email')) {\n claims.email = user.email\n }\n if (includeAll || scopes.has('profile')) {\n claims.name = user.name\n }\n }\n }\n\n return claims\n }\n}\n\nexport function createTokenHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const contentType = getRequestHeader(event, 'content-type') || ''\n const rawBody = await readRawBody(event, 'utf-8') || ''\n\n let body: Record\n if (contentType.includes('application/x-www-form-urlencoded')) {\n body = Object.fromEntries(new URLSearchParams(rawBody))\n }\n else {\n try {\n body = JSON.parse(rawBody || '{}')\n }\n catch {\n return oauthError(event, 400, 'invalid_request', 'Malformed request body')\n }\n }\n\n const grantType = body.grant_type\n\n if (grantType === 'client_credentials') {\n return handleClientCredentialsGrant(event, body, stores, config)\n }\n\n if (grantType === 'refresh_token') {\n return handleRefreshTokenGrant(event, body, stores, config)\n }\n\n if (grantType === 'authorization_code') {\n return handleAuthorizationCodeGrant(event, body as unknown as TokenExchangeParams, stores, config)\n }\n\n return oauthError(event, 400, 'unsupported_grant_type', 'Grant type not supported')\n })\n}\n\nasync function handleClientCredentialsGrant(\n event: H3Event,\n body: Record,\n stores: IdPStores,\n config: IdPConfig,\n) {\n const assertionType = body.client_assertion_type\n const assertion = body.client_assertion\n const delegationGrantParam = body.delegation_grant\n const audience = body.audience\n\n if (assertionType !== 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer') {\n return oauthError(event, 400, 'invalid_request', 'Unsupported client_assertion_type')\n }\n\n if (!assertion) {\n return oauthError(event, 400, 'invalid_request', 'Missing client_assertion')\n }\n\n try {\n const { sub } = await validateClientAssertion(\n assertion,\n `${config.issuer}/token`,\n async (userEmail) => {\n const user = await stores.userStore.findByEmail(userEmail)\n if (!user || !user.isActive) return null\n // Look up SSH key for this user\n const keys = await stores.sshKeyStore.findByUser(userEmail)\n if (keys.length === 0) return null\n return sshEd25519ToKeyObject(keys[0]!.publicKey)\n },\n stores.jtiStore,\n )\n\n // Delegation flow\n if (delegationGrantParam) {\n if (!audience) {\n return oauthError(event, 400, 'invalid_request', 'Missing audience for delegation')\n }\n\n const grant = await validateDelegation(delegationGrantParam, sub, audience, stores.grantStore)\n await useGrant(grant.id, stores.grantStore)\n\n const token = await issueAssertion(\n {\n sub: grant.request.delegator!,\n aud: audience,\n nonce: crypto.randomUUID(),\n delegation_act: { sub },\n delegation_grant: grant.id,\n // Mirror the grant's scopes into the assertion (grants.md §6.1,\n // protocol#6). Fail-closed: legacy grants without scopes yield\n // `scope: []` — a delegated token must always state its own limits,\n // and [] means \"nothing allowed\", not \"everything allowed\".\n scope: grant.request.scopes ?? [],\n },\n stores.keyStore,\n config.issuer,\n )\n\n return {\n access_token: token,\n token_type: 'Bearer',\n expires_in: 300,\n }\n }\n\n // Standard agent token\n const signingKey = await stores.keyStore.getSigningKey()\n const token = await issueAuthToken(\n { sub, act: 'agent' },\n config.issuer,\n signingKey.privateKey,\n signingKey.kid,\n )\n\n return {\n access_token: token,\n token_type: 'Bearer',\n expires_in: 3600,\n }\n }\n catch (err: unknown) {\n const message = err instanceof Error ? err.message : 'Client credentials authentication failed'\n return oauthError(event, 401, 'invalid_client', message)\n }\n}\n\nasync function handleRefreshTokenGrant(\n event: H3Event,\n body: Record,\n stores: IdPStores,\n config: IdPConfig,\n) {\n const refreshToken = body.refresh_token\n const clientId = body.client_id\n\n if (!refreshToken) {\n return oauthError(event, 400, 'invalid_request', 'Missing refresh_token')\n }\n\n if (!clientId) {\n return oauthError(event, 400, 'invalid_request', 'Missing client_id')\n }\n\n try {\n const result = await handleRefreshGrant(\n refreshToken,\n clientId,\n stores.refreshTokenStore,\n stores.keyStore,\n config.issuer,\n resolveUserClaimsFactory(stores),\n // Deactivation invalidates existing refresh tokens (#1144 follow-up).\n // Unknown identities pass — only an existing user with\n // isActive === false is refused.\n async (userId) => {\n const user = await stores.userStore.findByEmail(userId)\n return !user || user.isActive\n },\n )\n return result\n }\n catch (err: unknown) {\n if (err instanceof InactiveUserError) {\n return oauthError(event, 403, 'invalid_grant', err.message)\n }\n const message = err instanceof Error ? err.message : 'Refresh token exchange failed'\n return oauthError(event, 400, 'invalid_grant', message)\n }\n}\n\nasync function handleAuthorizationCodeGrant(\n event: H3Event,\n body: TokenExchangeParams,\n stores: IdPStores,\n config: IdPConfig,\n) {\n if (!body.grant_type || !body.code || !body.code_verifier || !body.redirect_uri || !body.client_id) {\n return oauthError(event, 400, 'invalid_request', 'Missing required fields: grant_type, code, code_verifier, redirect_uri, client_id')\n }\n\n try {\n const result = await handleTokenExchange(\n body,\n stores.codeStore,\n stores.keyStore,\n config.issuer,\n resolveUserClaimsFactory(stores),\n stores.refreshTokenStore,\n )\n return result\n }\n catch (err: unknown) {\n const message = err instanceof Error ? err.message : 'Token exchange failed'\n return oauthError(event, 400, 'invalid_grant', message)\n }\n}\n","import { defineEventHandler, setResponseHeader } from 'h3'\nimport { exportJWK } from 'jose'\nimport type { IdPStores } from '../config.js'\n\nexport function createJWKSHandler(stores: IdPStores) {\n return defineEventHandler(async (event) => {\n // Override the default no-store with a cacheable policy for public keys\n setResponseHeader(event, 'Cache-Control', 'public, max-age=3600')\n\n const entries = await stores.keyStore.getAllPublicKeys()\n const keys = await Promise.all(\n entries.map(async (entry) => {\n const jwk = await exportJWK(entry.publicKey)\n return { ...jwk, kid: entry.kid, alg: 'EdDSA', use: 'sig' }\n }),\n )\n return { keys }\n })\n}\n","import { defineEventHandler, setResponseHeader } from 'h3'\nimport type { IdPConfig } from '../config.js'\n\nexport function createDiscoveryHandler(config: IdPConfig) {\n return defineEventHandler((event) => {\n // Override the default no-store with a cacheable policy for discovery metadata\n setResponseHeader(event, 'Cache-Control', 'public, max-age=3600')\n const issuer = config.issuer\n\n return {\n issuer,\n authorization_endpoint: `${issuer}/authorize`,\n token_endpoint: `${issuer}/token`,\n userinfo_endpoint: `${issuer}/userinfo`,\n jwks_uri: `${issuer}/.well-known/jwks.json`,\n response_types_supported: ['code'],\n revocation_endpoint: `${issuer}/revoke`,\n grant_types_supported: ['authorization_code', 'client_credentials', 'refresh_token'],\n subject_types_supported: ['public'],\n id_token_signing_alg_values_supported: ['EdDSA'],\n token_endpoint_auth_methods_supported: ['none', 'private_key_jwt'],\n token_endpoint_auth_signing_alg_values_supported: ['EdDSA'],\n code_challenge_methods_supported: ['S256'],\n scopes_supported: ['openid', 'email', 'profile', 'offline_access'],\n claims_supported: ['sub', 'iss', 'aud', 'exp', 'iat', 'nonce', 'act', 'email', 'name', 'authorization_details', 'delegation_grant'],\n authorization_details_types_supported: ['openape_grant', 'openape_cli'],\n\n // DDISA extensions\n ddisa_version: '1.0',\n ddisa_auth_methods_supported: ['ed25519', 'ssh-key'],\n ddisa_auth_challenge_endpoint: `${issuer}/api/auth/challenge`,\n ddisa_auth_authenticate_endpoint: `${issuer}/api/auth/authenticate`,\n\n // OpenApe extensions\n openape_grants_endpoint: `${issuer}/api/grants`,\n openape_delegations_endpoint: `${issuer}/api/delegations`,\n openape_grant_types_supported: ['once', 'timed', 'always'],\n openape_grant_categories_supported: ['command', 'delegation'],\n }\n })\n}\n","import type { GrantStatus, GrantType, OpenApeGrantRequest, ProblemDetails } from '@openape/core'\nimport type { ApproveGrantOverrides } from '@openape/grants'\nimport { approveGrant, createGrant, denyGrant, introspectGrant, issueAuthzJWT, revokeGrant, useGrant, verifyAuthzJWT } from '@openape/grants'\nimport { defineEventHandler, getHeader, getQuery, getRequestHeader, getRouterParam, readBody, setResponseHeader, setResponseStatus } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\nimport { hasManagementToken } from './admin.js'\n\nconst VALID_GRANT_TYPES: GrantType[] = ['once', 'timed', 'always']\n\nfunction requireBearerIdentity(payload: { sub: string } | null): string {\n if (!payload) {\n throw createProblemError({ status: 401, title: 'Bearer token required' })\n }\n return payload.sub\n}\n\nfunction requireManagementOrBearer(\n event: import('h3').H3Event,\n config: IdPConfig,\n bearerPayload: { sub: string } | null,\n): string {\n if (hasManagementToken(event, config)) {\n return '_management_'\n }\n return requireBearerIdentity(bearerPayload)\n}\n\n// --- List Grants ---\nexport function createListGrantsHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const query = getQuery(event)\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n\n const limit = Math.min(Math.max(Number(query.limit) || 20, 1), 100)\n const cursor = query.cursor ? String(query.cursor) : undefined\n const status = query.status ? String(query.status) as GrantStatus : undefined\n const requester = query.requester ? String(query.requester) : undefined\n\n if (requester) {\n return stores.grantStore.listGrants({ limit, cursor, status, requester })\n }\n\n const identity = requireBearerIdentity(bearerPayload)\n\n // Get self + owned agents → single IN query\n const ownedUsers = await stores.userStore.findByOwner(identity)\n const requesters = [identity, ...ownedUsers.map(u => u.email)]\n\n return stores.grantStore.listGrants({ limit, cursor, status, requester: requesters })\n })\n}\n\n// --- Create Grant ---\nexport function createCreateGrantHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const body = await readBody(event)\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n\n if (bearerPayload) {\n body.requester = bearerPayload.sub\n }\n\n if (!body.requester || !body.target_host || !body.audience) {\n throw createProblemError({ status: 400, title: 'Missing required fields: requester, target_host, audience' })\n }\n\n if (!body.grant_type) {\n body.grant_type = 'once'\n }\n\n if (!VALID_GRANT_TYPES.includes(body.grant_type)) {\n throw createProblemError({ status: 400, title: `Invalid grant_type. Must be one of: ${VALID_GRANT_TYPES.join(', ')}` })\n }\n\n if (body.grant_type === 'timed' && !body.duration) {\n throw createProblemError({ status: 400, title: 'Duration is required for timed grants' })\n }\n\n const grant = await createGrant(body, stores.grantStore)\n setResponseStatus(event, 201)\n return grant\n })\n}\n\n// --- Get Grant ---\nexport function createGetGrantHandler(stores: IdPStores) {\n return defineEventHandler(async (event) => {\n const id = getRouterParam(event, 'id')!\n\n const grant = await introspectGrant(id, stores.grantStore)\n if (!grant) {\n throw createProblemError({ status: 404, title: 'Grant not found' })\n }\n\n const etag = `W/\"${grant.status}:${grant.decided_at || grant.created_at}\"`\n setResponseHeader(event, 'ETag', etag)\n\n const ifNoneMatch = getRequestHeader(event, 'if-none-match')\n if (ifNoneMatch === etag) {\n setResponseStatus(event, 304)\n return ''\n }\n\n return grant\n })\n}\n\n// --- Approve Grant ---\nexport function createApproveGrantHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const id = getRouterParam(event, 'id')!\n\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const email = requireManagementOrBearer(event, config, bearerPayload)\n\n const body = await readBody(event).catch(() => ({})) as Record\n\n if (body.grant_type !== undefined) {\n if (!VALID_GRANT_TYPES.includes(body.grant_type as GrantType)) {\n throw createProblemError({ status: 400, title: `Invalid grant_type. Must be one of: ${VALID_GRANT_TYPES.join(', ')}` })\n }\n if (body.grant_type === 'timed' && (!body.duration || typeof body.duration !== 'number' || body.duration <= 0)) {\n throw createProblemError({ status: 400, title: 'Duration must be a positive number for timed grants' })\n }\n }\n\n const grant = await stores.grantStore.findById(id)\n if (!grant) {\n throw createProblemError({ status: 404, title: 'Grant not found' })\n }\n\n // Authorize: requester can self-approve, or owner/approver of the requester's agent\n if (email !== '_management_') {\n const isRequester = grant.request.requester === email\n if (!isRequester) {\n const requesterUser = await stores.userStore.findByEmail(grant.request.requester)\n if (!requesterUser) {\n throw createProblemError({ status: 403, title: 'Requester user not found for this grant' })\n }\n const isOwnerOrApprover = requesterUser.owner === email || requesterUser.approver === email\n if (!isOwnerOrApprover) {\n throw createProblemError({ status: 403, title: 'Only the requester, owner, or approver can approve this grant' })\n }\n }\n }\n\n try {\n const overrides: ApproveGrantOverrides | undefined = body.grant_type\n ? { grant_type: body.grant_type as GrantType, duration: body.duration as number | undefined }\n : undefined\n const approved = await approveGrant(id, email, stores.grantStore, overrides)\n\n const signingKey = await stores.keyStore.getSigningKey()\n const authzJwt = await issueAuthzJWT(approved, config.issuer, signingKey.privateKey, signingKey.kid)\n return { grant: approved, authz_jwt: authzJwt }\n }\n catch (err: unknown) {\n if (err && typeof err === 'object' && 'statusCode' in err) throw err\n const message = err instanceof Error ? err.message : 'Failed to approve grant'\n throw createProblemError({ status: 400, title: message })\n }\n })\n}\n\n// --- Deny Grant ---\nexport function createDenyGrantHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const id = getRouterParam(event, 'id')!\n\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const email = requireManagementOrBearer(event, config, bearerPayload)\n\n const grant = await stores.grantStore.findById(id)\n if (!grant) {\n throw createProblemError({ status: 404, title: 'Grant not found' })\n }\n\n if (email !== '_management_') {\n const isRequester = grant.request.requester === email\n if (!isRequester) {\n const requesterUser = await stores.userStore.findByEmail(grant.request.requester)\n if (!requesterUser) {\n throw createProblemError({ status: 403, title: 'Requester user not found for this grant' })\n }\n const isOwnerOrApprover = requesterUser.owner === email || requesterUser.approver === email\n if (!isOwnerOrApprover) {\n throw createProblemError({ status: 403, title: 'Only the requester, owner, or approver can deny this grant' })\n }\n }\n }\n\n try {\n const denied = await denyGrant(id, email, stores.grantStore)\n return denied\n }\n catch (err: unknown) {\n const message = err instanceof Error ? err.message : 'Failed to deny grant'\n throw createProblemError({ status: 400, title: message })\n }\n })\n}\n\n// --- Revoke Grant ---\nexport function createRevokeGrantHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const id = getRouterParam(event, 'id')!\n\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const identity = requireManagementOrBearer(event, config, bearerPayload)\n\n const grant = await stores.grantStore.findById(id)\n if (!grant) {\n throw createProblemError({ status: 404, title: 'Grant not found' })\n }\n\n if (identity !== '_management_') {\n const isRequester = grant.request.requester === identity\n if (!isRequester) {\n const requesterUser = await stores.userStore.findByEmail(grant.request.requester)\n const isApprover = requesterUser && requesterUser.approver === identity\n const isAdmin = config.adminEmails?.includes(identity)\n if (!isApprover && !isAdmin) {\n throw createProblemError({ status: 403, title: 'Only the requester, approver, or admin can revoke this grant' })\n }\n }\n }\n\n try {\n const revoked = await revokeGrant(id, stores.grantStore)\n return revoked\n }\n catch (err: unknown) {\n const message = err instanceof Error ? err.message : 'Failed to revoke grant'\n throw createProblemError({ status: 400, title: message })\n }\n })\n}\n\n// --- Grant Token ---\nexport function createGrantTokenHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const identity = requireBearerIdentity(bearerPayload)\n\n const id = getRouterParam(event, 'id')!\n\n const grant = await introspectGrant(id, stores.grantStore)\n if (!grant) {\n throw createProblemError({ status: 404, title: 'Grant not found' })\n }\n\n if (grant.request.requester !== identity) {\n throw createProblemError({ status: 403, title: 'Grant does not belong to this identity' })\n }\n\n if (grant.status !== 'approved') {\n throw createProblemError({ status: 400, title: `Grant is not approved (status: ${grant.status})` })\n }\n\n const signingKey = await stores.keyStore.getSigningKey()\n const authzJwt = await issueAuthzJWT(grant, config.issuer, signingKey.privateKey, signingKey.kid)\n\n return { authz_jwt: authzJwt, grant }\n })\n}\n\n// --- Consume Grant ---\nexport function createConsumeGrantHandler(stores: IdPStores) {\n return defineEventHandler(async (event) => {\n const id = getRouterParam(event, 'id')!\n\n const authHeader = getHeader(event, 'authorization')\n if (!authHeader?.startsWith('Bearer ')) {\n throw createProblemError({ status: 401, title: 'Missing or invalid Authorization header' })\n }\n const token = authHeader.slice(7)\n\n const signingKey = await stores.keyStore.getSigningKey()\n const result = await verifyAuthzJWT(token, {\n publicKey: signingKey.publicKey,\n })\n\n if (!result.valid) {\n throw createProblemError({ status: 401, title: `Invalid grant token: ${result.error}` })\n }\n\n if (result.claims?.grant_id !== id) {\n throw createProblemError({ status: 400, title: 'Grant ID in token does not match URL' })\n }\n\n const grant = await introspectGrant(id, stores.grantStore)\n if (!grant) {\n throw createProblemError({ status: 404, title: 'Grant not found' })\n }\n\n switch (grant.status) {\n case 'used':\n return { error: 'already_consumed', status: grant.status }\n case 'revoked':\n return { error: 'revoked', status: grant.status }\n case 'denied':\n return { error: 'denied', status: grant.status }\n case 'expired':\n return { error: 'expired', status: grant.status }\n case 'pending':\n return { error: 'not_approved', status: grant.status }\n }\n\n if (grant.request.grant_type === 'once') {\n const used = await useGrant(id, stores.grantStore)\n return { status: 'consumed', grant: used }\n }\n\n return { status: 'valid', grant }\n })\n}\n\n// --- Batch ---\ninterface BatchOperation {\n id: string\n action: 'approve' | 'deny' | 'revoke'\n grant_type?: GrantType\n duration?: number\n}\n\ninterface BatchResult {\n id: string\n status: string\n success: boolean\n error?: ProblemDetails\n}\n\nexport function createBatchGrantHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const email = requireManagementOrBearer(event, config, bearerPayload)\n\n const body = await readBody<{ operations: BatchOperation[] }>(event)\n\n if (!body?.operations || !Array.isArray(body.operations) || body.operations.length === 0) {\n throw createProblemError({ status: 400, title: 'Missing or empty operations array' })\n }\n\n const results: BatchResult[] = []\n let hasError = false\n\n for (const item of body.operations) {\n try {\n let grant\n switch (item.action) {\n case 'approve': {\n const overrides: ApproveGrantOverrides | undefined = item.grant_type\n ? { grant_type: item.grant_type, duration: item.duration }\n : undefined\n grant = await approveGrant(item.id, email, stores.grantStore, overrides)\n break\n }\n case 'deny':\n grant = await denyGrant(item.id, email, stores.grantStore)\n break\n case 'revoke':\n grant = await revokeGrant(item.id, stores.grantStore)\n break\n default:\n throw new Error(`Invalid action: ${(item as { action: string }).action}`)\n }\n results.push({ id: item.id, status: grant.status, success: true })\n }\n catch (err) {\n hasError = true\n results.push({\n id: item.id,\n status: 'error',\n success: false,\n error: {\n type: 'https://openape.org/errors/grant_already_decided',\n title: err instanceof Error ? err.message : 'Operation failed',\n status: 400,\n },\n })\n }\n }\n\n if (hasError) {\n setResponseStatus(event, 207)\n }\n\n return { results }\n })\n}\n\n// --- Verify AuthZ-JWT ---\nexport function createVerifyGrantHandler(stores: IdPStores, _config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const body = await readBody<{ token: string }>(event)\n\n if (!body?.token) {\n return { valid: false, error: 'Missing token' }\n }\n\n const signingKey = await stores.keyStore.getSigningKey()\n const result = await verifyAuthzJWT(body.token, {\n publicKey: signingKey.publicKey,\n })\n\n if (!result.valid) {\n return { valid: false, error: result.error }\n }\n\n const grantId = result.claims?.grant_id\n if (!grantId) {\n return { valid: false, error: 'Missing grant_id in token' }\n }\n\n const grant = await introspectGrant(grantId, stores.grantStore)\n if (!grant) {\n return { valid: false, error: 'Grant not found' }\n }\n\n if (grant.status !== 'approved') {\n return { valid: false, error: `Grant is not approved (status: ${grant.status})` }\n }\n\n if (grant.request.grant_type === 'once') {\n const used = await useGrant(grantId, stores.grantStore)\n return { valid: true, claims: result.claims, grant: used }\n }\n\n return { valid: true, claims: result.claims, grant }\n })\n}\n","import type { GrantType } from '@openape/core'\nimport { createDelegation, revokeGrant, validateDelegation } from '@openape/grants'\nimport { defineEventHandler, getQuery, getRouterParam, readBody, setResponseStatus } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\n\nconst VALID_GRANT_TYPES: GrantType[] = ['once', 'timed', 'always']\n\nfunction requireHumanBearer(payload: { sub: string, act: string } | null): string {\n if (!payload) {\n throw createProblemError({ status: 401, title: 'Bearer token required' })\n }\n if (payload.act !== 'human') {\n throw createProblemError({ status: 403, title: 'Only human users may create delegations' })\n }\n return payload.sub\n}\n\nfunction requireBearer(payload: { sub: string } | null): string {\n if (!payload) {\n throw createProblemError({ status: 401, title: 'Bearer token required' })\n }\n return payload.sub\n}\n\n// --- Create Delegation ---\nexport function createCreateDelegationHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const delegator = requireHumanBearer(bearerPayload)\n\n const body = await readBody(event)\n\n if (!body?.delegate || typeof body.delegate !== 'string') {\n throw createProblemError({ status: 400, title: 'Missing delegate' })\n }\n if (!body?.audience || typeof body.audience !== 'string') {\n throw createProblemError({ status: 400, title: 'Missing audience' })\n }\n\n const grantType = body.grant_type || 'once'\n if (!VALID_GRANT_TYPES.includes(grantType)) {\n throw createProblemError({ status: 400, title: `Invalid grant_type. Must be one of: ${VALID_GRANT_TYPES.join(', ')}` })\n }\n\n if (grantType === 'timed' && (!body.duration || typeof body.duration !== 'number')) {\n throw createProblemError({ status: 400, title: 'Duration is required for timed grants' })\n }\n\n const grant = await createDelegation({\n delegator,\n delegate: body.delegate,\n audience: body.audience,\n scopes: Array.isArray(body.scopes) ? body.scopes : undefined,\n grant_type: grantType,\n duration: typeof body.duration === 'number' ? body.duration : undefined,\n }, stores.grantStore)\n\n setResponseStatus(event, 201)\n return grant\n })\n}\n\n// --- List Delegations ---\nexport function createListDelegationsHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const email = requireBearer(bearerPayload)\n\n const query = getQuery(event)\n const role = query.role as string | undefined\n const search = query.search as string | undefined\n const cursor = query.cursor as string | undefined\n const queryLimit = query.limit ? Number(query.limit) : undefined\n\n const grantStore = stores.grantStore\n\n let delegations: import('@openape/core').OpenApeGrant[]\n\n if (role === 'delegator') {\n if (!grantStore.findByDelegator) {\n throw createProblemError({ status: 501, title: 'Delegation queries not supported by this store' })\n }\n delegations = await grantStore.findByDelegator(email)\n }\n else if (role === 'delegate') {\n if (!grantStore.findByDelegate) {\n throw createProblemError({ status: 501, title: 'Delegation queries not supported by this store' })\n }\n delegations = await grantStore.findByDelegate(email)\n }\n else {\n // No role filter: return all delegations for this user (as delegator or delegate)\n const [asDelegator, asDelegate] = await Promise.all([\n grantStore.findByDelegator ? grantStore.findByDelegator(email) : [],\n grantStore.findByDelegate ? grantStore.findByDelegate(email) : [],\n ])\n\n const seen = new Set()\n delegations = []\n for (const grant of [...asDelegator, ...asDelegate]) {\n if (!seen.has(grant.id)) {\n seen.add(grant.id)\n delegations.push(grant)\n }\n }\n }\n\n // Sort by created_at DESC\n delegations.sort((a, b) => b.created_at - a.created_at)\n\n // Search filter\n if (search) {\n const q = search.toLowerCase()\n delegations = delegations.filter(g =>\n g.request.delegator?.toLowerCase().includes(q)\n || g.request.delegate?.toLowerCase().includes(q)\n || g.request.audience?.toLowerCase().includes(q),\n )\n }\n\n // Cursor pagination (cursor = grant ID)\n if (cursor) {\n const idx = delegations.findIndex(g => g.id === cursor)\n if (idx >= 0) delegations = delegations.slice(idx + 1)\n }\n\n const limit = Math.min(Math.max(queryLimit ?? 50, 1), 100)\n const hasMore = delegations.length > limit\n const data = delegations.slice(0, limit)\n\n return {\n data,\n pagination: {\n cursor: data.length > 0 ? data.at(-1)!.id : null,\n has_more: hasMore,\n },\n }\n })\n}\n\n// --- Revoke Delegation ---\nexport function createRevokeDelegationHandler(stores: IdPStores, config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n const email = requireBearer(bearerPayload)\n\n const id = getRouterParam(event, 'id')\n if (!id) {\n throw createProblemError({ status: 400, title: 'Missing delegation ID' })\n }\n\n const grant = await stores.grantStore.findById(id)\n if (!grant || grant.type !== 'delegation') {\n throw createProblemError({ status: 404, title: 'Delegation not found' })\n }\n\n // Only the delegator can revoke their own delegation\n if (grant.request.delegator !== email) {\n throw createProblemError({ status: 403, title: 'Not authorized to revoke this delegation' })\n }\n\n try {\n const revoked = await revokeGrant(id, stores.grantStore)\n return revoked\n }\n catch (err: unknown) {\n const message = err instanceof Error ? err.message : 'Failed to revoke delegation'\n throw createProblemError({ status: 400, title: message })\n }\n })\n}\n\n// --- Validate Delegation ---\nexport function createValidateDelegationHandler(stores: IdPStores, _config: IdPConfig) {\n return defineEventHandler(async (event) => {\n const id = getRouterParam(event, 'id')\n if (!id) {\n throw createProblemError({ status: 400, title: 'Missing delegation ID' })\n }\n\n const body = await readBody<{ delegate: string, audience: string }>(event)\n if (!body?.delegate || !body?.audience) {\n throw createProblemError({ status: 400, title: 'Missing delegate or audience' })\n }\n\n try {\n const grant = await validateDelegation(id, body.delegate, body.audience, stores.grantStore)\n return {\n valid: true,\n delegation: grant,\n scopes: grant.request.scopes || [],\n }\n }\n catch (err) {\n return {\n valid: false,\n error: err instanceof Error ? err.message : 'Delegation validation failed',\n }\n }\n })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,aAA6C;;;ACA7C,gBAA4B;AAC5B,kBAAqC;AAE9B,SAAS,mBAAmB,MAKhC;AACD,QAAM,cAAU,kCAAqB,IAAI;AACzC,aAAO,uBAAY;AAAA,IACjB,YAAY,KAAK;AAAA,IACjB,eAAe,KAAK;AAAA,IACpB,MAAM;AAAA,EACR,CAAC;AACH;;;ACdA,yBAAwC;AAExC,IAAM,sBAAsB,OAAO,KAAK,4BAA4B,KAAK;AAEzE,IAAM,gBAAgB;AAEtB,SAAS,yBAAyB,QAA2B;AAC3D,QAAM,QAAQ,OAAO,KAAK,EAAE,MAAM,aAAa;AAC/C,MAAI,MAAM,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG;AAC3C,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AAEA,QAAM,aAAa,OAAO,KAAK,MAAM,CAAC,GAAG,QAAQ;AAEjD,MAAI,SAAS;AACb,QAAM,UAAU,WAAW,aAAa,MAAM;AAC9C,YAAU;AACV,QAAM,UAAU,WAAW,SAAS,QAAQ,SAAS,OAAO,EAAE,SAAS;AACvE,YAAU;AAEV,MAAI,YAAY,eAAe;AAC7B,UAAM,IAAI,MAAM,uCAAuC,OAAO,EAAE;AAAA,EAClE;AAEA,QAAM,SAAS,WAAW,aAAa,MAAM;AAC7C,YAAU;AACV,QAAM,SAAS,WAAW,SAAS,QAAQ,SAAS,MAAM;AAE1D,MAAI,OAAO,WAAW,IAAI;AACxB,UAAM,IAAI,MAAM,qCAAqC,OAAO,MAAM,EAAE;AAAA,EACtE;AAEA,QAAM,UAAU,OAAO,OAAO,CAAC,qBAAqB,MAAM,CAAC;AAE3D,aAAO,oCAAgB;AAAA,IACrB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;AAOO,SAAS,sBAAsB,QAA2B;AAC/D,SAAO,yBAAyB,MAAM;AACxC;AAEO,SAAS,uBACd,cACA,MACA,WACS;AACT,QAAM,SAAS,yBAAyB,YAAY;AACpD,QAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,IAAI,IAAI;AAClE,aAAO,2BAAO,MAAM,YAAY,QAAQ,SAAS;AACnD;;;ACzDA,kBAAmC;AAQ5B,IAAM,uBAAuB;AAQpC,eAAsB,eACpB,SACA,QACA,YACA,KACiB;AACjB,QAAM,MAAM,IAAI,oBAAQ,EAAE,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CAAC,EAC3D,mBAAmB,EAAE,KAAK,SAAS,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC,EAAG,CAAC,EAC5D,UAAU,MAAM,EAChB,WAAW,QAAQ,GAAG,EACtB,YAAY,QAAQ,OAAO,oBAAoB,EAC/C,YAAY,EACZ,kBAAkB,IAAI;AAEzB,SAAO,MAAM,IAAI,KAAK,UAAU;AAClC;AAEA,eAAsB,gBACpB,OACA,QACA,WACA,aAC2B;AAC3B,QAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,WAAW;AAAA,IACpD;AAAA,IACA,GAAI,cAAc,EAAE,UAAU,YAAY,IAAI,CAAC;AAAA,IAC/C,YAAY,CAAC,OAAO;AAAA,EACtB,CAAC;AAED,QAAM,MAAM,QAAQ;AACpB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb;AAAA,IACA,GAAI,OAAO,QAAQ,QAAQ,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EAChE;AACF;;;AHnDO,SAAS,uBAAuB,QAAmB,SAAoB;AAC5E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,qBAAyB,KAAK;AAEjD,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6BAA6B,CAAC;AAAA,IAC/E;AAGA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK,EAAE;AACvD,QAAI,QAAQ,CAAC,KAAK,UAAU;AAC1B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AACA,QAAI,MAAM;AACR,YAAM,YAAY,MAAM,OAAO,eAAe,gBAAgB,KAAK,KAAK;AACxE,aAAO,EAAE,UAAU;AAAA,IACrB;AAGA,UAAM,UAAU,MAAM,OAAO,YAAY,WAAW,KAAK,EAAE;AAC3D,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,YAAY,MAAM,OAAO,eAAe,gBAAgB,KAAK,EAAE;AACrE,aAAO,EAAE,UAAU;AAAA,IACrB;AAEA,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,gDAAgD,CAAC;AAAA,EAClG,CAAC;AACH;AAEO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,qBAKhB,KAAK;AAER,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,WAAW;AAClD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oDAAoD,CAAC;AAAA,IACtG;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK,EAAE;AACvD,QAAI,CAAC,MAAM;AACT,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iBAAiB,CAAC;AAAA,IACnE;AAEA,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AAGA,QAAI;AACJ,QAAI,KAAK,YAAY;AACnB,YAAM,SAAS,MAAM,OAAO,YAAY,gBAAgB,KAAK,UAAU;AACvE,UAAI,CAAC,UAAU,OAAO,cAAc,KAAK,IAAI;AAC3C,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AACA,aAAO,CAAC,MAAM;AAAA,IAChB,OACK;AACH,aAAO,MAAM,OAAO,YAAY,WAAW,KAAK,EAAE;AAClD,UAAI,KAAK,WAAW,GAAG;AACrB,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM,OAAO,eAAe,iBAAiB,KAAK,WAAW,KAAK,EAAE;AAClF,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,8CAA8C,CAAC;AAAA,IAChG;AAGA,UAAM,kBAAkB,OAAO,KAAK,KAAK,WAAW,QAAQ;AAC5D,QAAI,UAAU;AACd,eAAW,OAAO,MAAM;AACtB,UAAI,uBAAuB,IAAI,WAAW,KAAK,WAAW,eAAe,GAAG;AAC1E,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,qBAAqB,MAAM,yCAAyC,CAAC;AAAA,IACtH;AAGA,UAAM,MAAM,KAAK,SAAS,KAAK,QAAQ,UAAmB;AAE1D,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,KAAK,KAAK,OAAO,IAAI;AAAA,MACvB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAEA,WAAO;AAAA,MACL;AAAA,MACA,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX;AAAA,MACA,YAAY;AAAA,IACd;AAAA,EACF,CAAC;AACH;;;AIhHA,IAAAC,sBAA2B;AAC3B,IAAAC,aAA6C;;;ACD7C,IAAAC,sBAA4C;AAE5C,IAAAC,aAAyF;AAMzF,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,aAAO,qCAAgB,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC;AACvD;AAEA,SAAS,uBAAuB,OAAgB,QAAyB;AACvE,MAAI,CAAC,OAAO,iBAAiB;AAC3B,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,EACpF;AACA,QAAM,iBAAa,6BAAiB,OAAO,eAAe;AAC1D,MAAI,CAAC,YAAY;AACf,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,gCAAgC,CAAC;AAAA,EAClF;AACA,QAAM,QAAQ,WAAW,QAAQ,eAAe,EAAE;AAClD,MAAI,CAAC,YAAY,OAAO,OAAO,eAAe,GAAG;AAC/C,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,2BAA2B,CAAC;AAAA,EAC7E;AACF;AAGO,SAAS,mBAAmB,OAAgB,QAA4B;AAC7E,MAAI,CAAC,OAAO,gBAAiB,QAAO;AACpC,QAAM,iBAAa,6BAAiB,OAAO,eAAe;AAC1D,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,QAAQ,WAAW,QAAQ,eAAe,EAAE;AAClD,SAAO,YAAY,OAAO,OAAO,eAAe;AAClD;AAGO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AACpC,UAAM,YAAQ,qBAAS,KAAK;AAC5B,UAAM,SAAS,MAAM,OAAO,UAAU,KAAK;AAAA,MACzC,OAAO,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI;AAAA,MAC3C,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,MAC9C,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,IAChD,CAAC;AACD,WAAO;AAAA,MACL,MAAM,OAAO,KAAK,IAAI,QAAM,EAAE,OAAO,EAAE,OAAO,MAAM,EAAE,MAAM,UAAU,EAAE,UAAU,OAAO,EAAE,OAAO,WAAW,EAAE,UAAU,EAAE;AAAA,MAC3H,YAAY,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,QAAQ,uBAAmB,2BAAe,OAAO,OAAO,CAAE;AAChE,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK;AACrD,QAAI,CAAC,MAAM;AACT,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iBAAiB,CAAC;AAAA,IACnE;AAGA,UAAM,OAAO,YAAY,iBAAiB,KAAK;AAC/C,UAAM,OAAO,UAAU,OAAO,KAAK;AACnC,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,OAAO,UAAM,qBAA6D,KAAK;AACrF,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,MAAM;AAC7B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AAGA,QAAI,KAAK,MAAM,SAAS,KAAK;AAC3B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AACA,QAAI,KAAK,KAAK,SAAS,KAAK;AAC1B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sCAAsC,CAAC;AAAA,IACxF;AAEA,UAAM,WAAW,MAAM,OAAO,UAAU,YAAY,KAAK,KAAK;AAC9D,QAAI,UAAU;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sBAAsB,CAAC;AAAA,IACxE;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,OAAO;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,UAAU;AAAA,MACV,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AACD,WAAO,EAAE,IAAI,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK;AAAA,EACxD,CAAC;AACH;AAGO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,QAAQ,uBAAmB,2BAAe,OAAO,OAAO,CAAE;AAEhE,UAAM,OAAO,UAAM,qBAA+C,KAAK;AACvE,QAAI,CAAC,KAAK,aAAa,OAAO,KAAK,cAAc,UAAU;AACzD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oCAAoC,CAAC;AAAA,IACtF;AAGA,QAAI,KAAK,UAAU,SAAS,KAAM;AAChC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6CAA6C,CAAC;AAAA,IAC/F;AACA,QAAI,KAAK,QAAQ,KAAK,KAAK,SAAS,KAAK;AACvC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sCAAsC,CAAC;AAAA,IACxF;AAEA,UAAM,aAAa,KAAK,UAAU,KAAK;AAGvC,QAAI;AACF,4BAAsB,UAAU;AAAA,IAClC,QACM;AACJ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,+CAA+C,CAAC;AAAA,IACjG;AAGA,UAAM,QAAQ,WAAW,MAAM,KAAK;AACpC,UAAM,UAAU,MAAM,UAAU,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,IAAI;AAC/D,UAAM,OAAO,KAAK,QAAQ,WAAW;AAGrC,UAAM,UAAU,MAAM,CAAC;AACvB,UAAM,YAAQ,gCAAW,QAAQ,EAAE,OAAO,OAAO,KAAK,SAAS,QAAQ,CAAC,EAAE,OAAO,KAAK;AAGtF,UAAM,WAAW,MAAM,OAAO,YAAY,gBAAgB,UAAU;AACpE,QAAI,UAAU;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,qCAAqC,CAAC;AAAA,IACvF;AAGA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK;AACrD,QAAI,CAAC,MAAM;AACT,YAAM,OAAO,UAAU,OAAO;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,SAAS;AAAA,MACb;AAAA,MACA,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,MACA,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACzC;AAEA,UAAM,OAAO,YAAY,KAAK,MAAM;AACpC,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,QAAmB;AAC7E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,QAAQ,uBAAmB,2BAAe,OAAO,OAAO,CAAE;AAEhE,WAAO,MAAM,OAAO,YAAY,WAAW,KAAK;AAAA,EAClD,CAAC;AACH;AAGO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,YAAQ,2BAAe,OAAO,OAAO;AAE3C,UAAM,WAAW,MAAM,OAAO,YAAY,SAAS,KAAK;AACxD,QAAI,CAAC,UAAU;AACb,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oBAAoB,CAAC;AAAA,IACtE;AAEA,UAAM,OAAO,YAAY,OAAO,KAAK;AACrC,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;;;ACtMA,IAAAC,aAA0B;AAK1B,SAAS,mBAAmB,OAA+B;AACzD,QAAM,iBAAa,sBAAU,OAAO,eAAe;AACnD,MAAI,CAAC,YAAY,WAAW,SAAS;AACnC,WAAO;AACT,SAAO,WAAW,MAAM,CAAC;AAC3B;AAEA,eAAsB,iBACpB,OACA,UACA,QACkC;AAClC,QAAM,QAAQ,mBAAmB,KAAK;AACtC,MAAI,CAAC;AACH,WAAO;AAET,QAAM,aAAa,MAAM,SAAS,cAAc;AAEhD,MAAI;AACF,WAAO,MAAM,gBAAgB,OAAO,QAAQ,WAAW,SAAS;AAAA,EAClE,QACM;AACJ,WAAO;AAAA,EACT;AACF;;;AFtBO,SAAS,oBAAoB,QAAmB,QAAmB;AACxE,aAAO,+BAAmB,OAAO,UAAU;AAEzC,UAAM,SAAS,mBAAmB,OAAO,MAAM;AAE/C,QAAI;AACJ,QAAI,CAAC,QAAQ;AACX,YAAM,UAAU,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAC5E,UAAI,CAAC,SAAS;AACZ,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6DAA6D,CAAC;AAAA,MAC/G;AACA,UAAI,QAAQ,QAAQ,SAAS;AAC3B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,MAC1F;AACA,oBAAc,QAAQ;AAAA,IACxB;AAEA,UAAM,OAAO,UAAM,qBAOhB,KAAK;AAKR,QAAI,QAAQ;AACV,UAAI,CAAC,KAAK,SAAS,CAAC,KAAK,QAAQ,CAAC,KAAK,aAAa,CAAC,KAAK,OAAO;AAC/D,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,yDAAyD,CAAC;AAAA,MAC3G;AAAA,IACF,OACK;AACH,UAAI,CAAC,KAAK,SAAS,CAAC,KAAK,QAAQ,CAAC,KAAK,WAAW;AAChD,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kDAAkD,CAAC;AAAA,MACpG;AAAA,IACF;AAGA,QAAI,KAAK,MAAM,SAAS,KAAK;AAC3B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AACA,QAAI,KAAK,KAAK,SAAS,KAAK;AAC1B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sCAAsC,CAAC;AAAA,IACxF;AACA,QAAI,KAAK,UAAU,SAAS,KAAM;AAChC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6CAA6C,CAAC;AAAA,IAC/F;AAEA,QAAI,CAAC,KAAK,UAAU,WAAW,cAAc,GAAG;AAC9C,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,2CAA2C,CAAC;AAAA,IAC7F;AAGA,QAAI;AACF,4BAAsB,KAAK,SAAS;AAAA,IACtC,QACM;AACJ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,yBAAyB,CAAC;AAAA,IAC3E;AAGA,UAAM,WAAW,MAAM,OAAO,UAAU,YAAY,KAAK,KAAK;AAC9D,QAAI,UAAU;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,IAC1F;AAGA,UAAM,cAAc,MAAM,OAAO,YAAY,gBAAgB,KAAK,SAAS;AAC3E,QAAI,aAAa;AACf,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6CAA6C,CAAC;AAAA,IAC/F;AAGA,UAAM,QAAQ,SAAS,KAAK,QAAS;AACrC,UAAM,WAAW,SAAU,KAAK,YAAY,QAAS;AACrD,UAAM,OAAO,KAAK,QAAQ;AAG1B,UAAM,OAAO,MAAM,OAAO,UAAU,OAAO;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAGD,UAAM,aAAa,KAAK,UAAU,KAAK;AACvC,UAAM,QAAQ,WAAW,MAAM,KAAK;AACpC,UAAM,UAAU,MAAM,CAAC;AACvB,UAAM,YAAQ,gCAAW,QAAQ,EAAE,OAAO,OAAO,KAAK,SAAS,QAAQ,CAAC,EAAE,OAAO,KAAK;AAEtF,UAAM,OAAO,YAAY,KAAK;AAAA,MAC5B;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW;AAAA,MACX,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACzC,CAAC;AAED,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;AGxHA,IAAAC,aAAuE;AACvE,kBAAyC;AACzC,oBAAwE;;;ACHxE,IAAAC,aAAmE;AAKnE,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAExB,SAAS,iBAAiB,QAAmB;AAClD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,OAAO,iBAAiB;AAAA,IAClC,QAAQ;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,OAAO,OAAO,WAAW,UAAU;AAAA,MAC3C,UAAU;AAAA,MACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,IACzB;AAAA,EACF;AACF;AAQO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,qBAKhB,KAAK;AAER,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,WAAW;AAClD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oDAAoD,CAAC;AAAA,IACtG;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK,EAAE;AACvD,QAAI,CAAC,MAAM;AACT,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iBAAiB,CAAC;AAAA,IACnE;AACA,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AAGA,QAAI;AACJ,QAAI,KAAK,YAAY;AACnB,YAAM,SAAS,MAAM,OAAO,YAAY,gBAAgB,KAAK,UAAU;AACvE,UAAI,CAAC,UAAU,OAAO,cAAc,KAAK,IAAI;AAC3C,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AACA,aAAO,CAAC,MAAM;AAAA,IAChB,OACK;AACH,aAAO,MAAM,OAAO,YAAY,WAAW,KAAK,EAAE;AAClD,UAAI,KAAK,WAAW,GAAG;AACrB,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM,OAAO,eAAe,iBAAiB,KAAK,WAAW,KAAK,EAAE;AAClF,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,8CAA8C,CAAC;AAAA,IAChG;AAGA,UAAM,kBAAkB,OAAO,KAAK,KAAK,WAAW,QAAQ;AAC5D,QAAI,UAAU;AACd,eAAW,OAAO,MAAM;AACtB,UAAI,uBAAuB,IAAI,WAAW,KAAK,WAAW,eAAe,GAAG;AAC1E,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,qBAAqB,MAAM,yCAAyC,CAAC;AAAA,IACtH;AAGA,UAAM,UAAU,UAAM,uBAAW,OAAO,iBAAiB,MAAM,CAAC;AAChE,UAAM,QAAQ,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC;AAE3C,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;AAOO,SAAS,2BAA2B,QAAmB,QAAmB;AAC/E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,UAAU,UAAM,uBAAW,OAAO,iBAAiB,MAAM,CAAC;AAChE,UAAM,QAAQ,MAAM;AACpB,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;AASO,SAAS,yBAAuC;AACrD,aAAO,+BAAmB,CAAC,UAAU;AACnC,UAAM,YAAQ,qBAAS,KAAK;AAC5B,WAAO,EAAE,eAAe,MAAM,UAAU,MAAM,YAAY,IAAI;AAAA,EAChE,CAAC;AACH;;;AD3GA,SAAS,0BAA0B,KAAuD;AACxF,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,WAAO,OAAO;AAAA,MACZ,CAAC,MACC,OAAO,MAAM,YACV,MAAM,QACN,CAAC,iBAAiB,aAAa,EAAE,SAAS,OAAQ,EAA8B,QAAQ,EAAE,CAAC,KAC3F,OAAQ,EAA8B,WAAW;AAAA,IACxD;AAAA,EACF,QACM;AACJ,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,qBAAS,KAAK;AAE5B,UAAM,SAA0B;AAAA,MAC9B,WAAW,OAAO,MAAM,aAAa,EAAE;AAAA,MACvC,cAAc,OAAO,MAAM,gBAAgB,EAAE;AAAA,MAC7C,OAAO,OAAO,MAAM,SAAS,EAAE;AAAA,MAC/B,gBAAgB,OAAO,MAAM,kBAAkB,EAAE;AAAA,MACjD,uBAAuB,OAAO,MAAM,yBAAyB,EAAE;AAAA,MAC/D,OAAO,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI;AAAA,MAC3C,eAAe,OAAO,MAAM,iBAAiB,EAAE;AAAA,MAC/C,OAAO,OAAO,MAAM,SAAS,EAAE;AAAA,IACjC;AAEA,UAAM,YAAQ,sCAAyB,MAAM;AAC7C,QAAI,OAAO;AACT,UAAI,OAAO,cAAc;AACvB,YAAI;AACF,gBAAM,WAAW,IAAI,IAAI,OAAO,YAAY;AAC5C,mBAAS,aAAa,IAAI,SAAS,iBAAiB;AACpD,mBAAS,aAAa,IAAI,qBAAqB,KAAK;AACpD,cAAI,OAAO,OAAO;AAChB,qBAAS,aAAa,IAAI,SAAS,OAAO,KAAK;AAAA,UACjD;AACA,qBAAO,yBAAa,OAAO,SAAS,SAAS,CAAC;AAAA,QAChD,QACM;AAAA,QAEN;AAAA,MACF;AACA,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,MAAM,CAAC;AAAA,IACxD;AAGA,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAElF,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,UAAM,uBAAuB,OAAO,MAAM,oBAAoB,EAAE;AAEhE,QAAI,eAAe;AAIjB,YAAM,aAAa,MAAM,OAAO,UAAU,YAAY,cAAc,GAAG;AACvE,UAAI,cAAc,CAAC,WAAW,UAAU;AACtC,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,MACrE;AACA,UAAI,sBAAsB;AACxB,cAAM,QAAQ,UAAM;AAAA,UAClB;AAAA,UACA,cAAc;AAAA,UACd,OAAO;AAAA,UACP,OAAO;AAAA,QACT;AACA,iBAAS,MAAM,QAAQ;AACvB,wBAAgB,EAAE,KAAK,cAAc,IAAI;AACzC,4BAAoB,MAAM;AAC1B,kBAAM,wBAAS,MAAM,IAAI,OAAO,UAAU;AAAA,MAC5C,OACK;AACH,iBAAS,cAAc;AACvB,oBAAY,cAAc,QAAQ,UAAU,UAAU;AAAA,MACxD;AAAA,IACF,OACK;AAEH,YAAM,UAAU,UAAM,uBAAW,OAAO,iBAAiB,MAAM,CAAC;AAEhE,UAAI,CAAC,QAAQ,KAAK,QAAQ;AAExB,cAAM,WAAW,cAAc,IAAI,gBAAgB,KAA+B,EAAE,SAAS,CAAC;AAC9F,mBAAO,yBAAa,OAAO,mBAAmB,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MAC9E;AAEA,YAAM,gBAAgB,QAAQ,KAAK;AACnC,YAAM,OAAO,MAAM,OAAO,UAAU,YAAY,aAAa;AAC7D,UAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6BAA6B,CAAC;AAAA,MAC/E;AAEA,UAAI,sBAAsB;AACxB,cAAM,QAAQ,UAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA,OAAO;AAAA,UACP,OAAO;AAAA,QACT;AACA,iBAAS,MAAM,QAAQ;AACvB,wBAAgB,EAAE,KAAK,cAAc;AACrC,4BAAoB,MAAM;AAC1B,kBAAM,wBAAS,MAAM,IAAI,OAAO,UAAU;AAAA,MAC5C,OACK;AACH,iBAAS;AACT,oBAAY,KAAK,SAAS,KAAK,QAAQ,UAAU;AAAA,MACnD;AAAA,IACF;AAIA,QAAI,sBAAsB;AACxB,YAAM,YAAY,MAAM,OAAO,UAAU,YAAY,MAAM;AAC3D,UAAI,aAAa,CAAC,UAAU,UAAU;AACpC,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,MACrE;AAAA,IACF;AAGA,UAAM,eAAe,0BAA0B,OAAO,MAAM,yBAAyB,EAAE,CAAC;AACxF,QAAI;AAEJ,QAAI,aAAa,SAAS,GAAG;AAC3B,wBAAkB,CAAC;AAEnB,iBAAW,UAAU,cAAc;AACjC,cAAM,QAAQ,UAAM,2BAAY;AAAA,UAC9B,WAAW,gBAAgB,cAAc,MAAM;AAAA,UAC/C,aAAa,OAAO;AAAA,UACpB,UAAU,OAAO;AAAA,UACjB,YAAY,OAAO,YAAY;AAAA,UAC/B,aAAa,CAAC,OAAO,SAAS,gBAAgB,OAAO,aAAa,OAAO,MAAM;AAAA,UAC/E,GAAI,OAAO,SAAS,gBAAgB,EAAE,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC;AAAA,UAC3E,QAAQ,OAAO;AAAA,QACjB,GAAG,OAAO,UAAU;AAEpB,cAAM,WAAW,UAAM,4BAAa,MAAM,IAAI,QAAQ,OAAO,UAAU;AACvE,wBAAgB,KAAK;AAAA,UACnB,GAAG;AAAA,UACH,UAAU,SAAS;AAAA,QACrB,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,OAAO,OAAO,WAAW;AAC/B,UAAM,OAAO,UAAU,KAAK;AAAA,MAC1B;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,eAAe,OAAO;AAAA,MACtB;AAAA,MACA,OAAO,OAAO;AAAA,MACd,WAAW,KAAK,IAAI,IAAI;AAAA,MACxB,KAAK;AAAA,MACL,OAAO,OAAO,SAAS;AAAA,MACvB,sBAAsB;AAAA,MACtB;AAAA,MACA,iBAAiB;AAAA,IACnB,CAAC;AAED,UAAM,cAAc,IAAI,IAAI,OAAO,YAAY;AAC/C,gBAAY,aAAa,IAAI,QAAQ,IAAI;AACzC,gBAAY,aAAa,IAAI,SAAS,OAAO,KAAK;AAElD,eAAO,yBAAa,OAAO,YAAY,SAAS,CAAC;AAAA,EACnD,CAAC;AACH;;;AE1LA,IAAAC,aAAqF;AACrF,IAAAC,eAAoH;AACpH,IAAAC,iBAA6C;AAK7C,IAAMC,iBAAgB;AAEtB,SAAS,WAAW,OAAgB,QAAgB,OAAe,aAAqB;AACtF,oCAAkB,OAAO,MAAM;AAC/B,SAAO,EAAE,OAAO,mBAAmB,YAAY;AACjD;AAEA,SAAS,WAAW,OAA6B;AAC/C,MAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,SAAO,IAAI,IAAI,MAAM,MAAMA,cAAa,EAAE,OAAO,OAAO,CAAC;AAC3D;AAEA,SAAS,yBAAyB,QAAmB;AACnD,SAAO,OAAO,QAAgB,UAAmB;AAC/C,UAAM,SAAS,WAAW,KAAK;AAC/B,UAAM,SAA4C,CAAC;AAEnD,UAAM,aAAa,OAAO,SAAS;AACnC,UAAM,YAAY,cAAc,OAAO,IAAI,OAAO,KAAK,OAAO,IAAI,SAAS;AAE3E,QAAI,WAAW;AACb,YAAM,OAAO,MAAM,OAAO,UAAU,YAAY,MAAM;AACtD,UAAI,MAAM;AACR,YAAI,cAAc,OAAO,IAAI,OAAO,GAAG;AACrC,iBAAO,QAAQ,KAAK;AAAA,QACtB;AACA,YAAI,cAAc,OAAO,IAAI,SAAS,GAAG;AACvC,iBAAO,OAAO,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mBAAmB,QAAmB,QAAmB;AACvE,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,kBAAc,6BAAiB,OAAO,cAAc,KAAK;AAC/D,UAAM,UAAU,UAAM,wBAAY,OAAO,OAAO,KAAK;AAErD,QAAI;AACJ,QAAI,YAAY,SAAS,mCAAmC,GAAG;AAC7D,aAAO,OAAO,YAAY,IAAI,gBAAgB,OAAO,CAAC;AAAA,IACxD,OACK;AACH,UAAI;AACF,eAAO,KAAK,MAAM,WAAW,IAAI;AAAA,MACnC,QACM;AACJ,eAAO,WAAW,OAAO,KAAK,mBAAmB,wBAAwB;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,YAAY,KAAK;AAEvB,QAAI,cAAc,sBAAsB;AACtC,aAAO,6BAA6B,OAAO,MAAM,QAAQ,MAAM;AAAA,IACjE;AAEA,QAAI,cAAc,iBAAiB;AACjC,aAAO,wBAAwB,OAAO,MAAM,QAAQ,MAAM;AAAA,IAC5D;AAEA,QAAI,cAAc,sBAAsB;AACtC,aAAO,6BAA6B,OAAO,MAAwC,QAAQ,MAAM;AAAA,IACnG;AAEA,WAAO,WAAW,OAAO,KAAK,0BAA0B,0BAA0B;AAAA,EACpF,CAAC;AACH;AAEA,eAAe,6BACb,OACA,MACA,QACA,QACA;AACA,QAAM,gBAAgB,KAAK;AAC3B,QAAM,YAAY,KAAK;AACvB,QAAM,uBAAuB,KAAK;AAClC,QAAM,WAAW,KAAK;AAEtB,MAAI,kBAAkB,0DAA0D;AAC9E,WAAO,WAAW,OAAO,KAAK,mBAAmB,mCAAmC;AAAA,EACtF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO,WAAW,OAAO,KAAK,mBAAmB,0BAA0B;AAAA,EAC7E;AAEA,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,UAAM;AAAA,MACpB;AAAA,MACA,GAAG,OAAO,MAAM;AAAA,MAChB,OAAO,cAAc;AACnB,cAAM,OAAO,MAAM,OAAO,UAAU,YAAY,SAAS;AACzD,YAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO;AAEpC,cAAM,OAAO,MAAM,OAAO,YAAY,WAAW,SAAS;AAC1D,YAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,eAAO,sBAAsB,KAAK,CAAC,EAAG,SAAS;AAAA,MACjD;AAAA,MACA,OAAO;AAAA,IACT;AAGA,QAAI,sBAAsB;AACxB,UAAI,CAAC,UAAU;AACb,eAAO,WAAW,OAAO,KAAK,mBAAmB,iCAAiC;AAAA,MACpF;AAEA,YAAM,QAAQ,UAAM,mCAAmB,sBAAsB,KAAK,UAAU,OAAO,UAAU;AAC7F,gBAAM,yBAAS,MAAM,IAAI,OAAO,UAAU;AAE1C,YAAMC,SAAQ,UAAM;AAAA,QAClB;AAAA,UACE,KAAK,MAAM,QAAQ;AAAA,UACnB,KAAK;AAAA,UACL,OAAO,OAAO,WAAW;AAAA,UACzB,gBAAgB,EAAE,IAAI;AAAA,UACtB,kBAAkB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,UAKxB,OAAO,MAAM,QAAQ,UAAU,CAAC;AAAA,QAClC;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAEA,aAAO;AAAA,QACL,cAAcA;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,KAAK,KAAK,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAEA,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AAAA,EACF,SACO,KAAc;AACnB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,WAAW,OAAO,KAAK,kBAAkB,OAAO;AAAA,EACzD;AACF;AAEA,eAAe,wBACb,OACA,MACA,QACA,QACA;AACA,QAAM,eAAe,KAAK;AAC1B,QAAM,WAAW,KAAK;AAEtB,MAAI,CAAC,cAAc;AACjB,WAAO,WAAW,OAAO,KAAK,mBAAmB,uBAAuB;AAAA,EAC1E;AAEA,MAAI,CAAC,UAAU;AACb,WAAO,WAAW,OAAO,KAAK,mBAAmB,mBAAmB;AAAA,EACtE;AAEA,MAAI;AACF,UAAM,SAAS,UAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,yBAAyB,MAAM;AAAA;AAAA;AAAA;AAAA,MAI/B,OAAO,WAAW;AAChB,cAAM,OAAO,MAAM,OAAO,UAAU,YAAY,MAAM;AACtD,eAAO,CAAC,QAAQ,KAAK;AAAA,MACvB;AAAA,IACF;AACA,WAAO;AAAA,EACT,SACO,KAAc;AACnB,QAAI,eAAe,gCAAmB;AACpC,aAAO,WAAW,OAAO,KAAK,iBAAiB,IAAI,OAAO;AAAA,IAC5D;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,WAAW,OAAO,KAAK,iBAAiB,OAAO;AAAA,EACxD;AACF;AAEA,eAAe,6BACb,OACA,MACA,QACA,QACA;AACA,MAAI,CAAC,KAAK,cAAc,CAAC,KAAK,QAAQ,CAAC,KAAK,iBAAiB,CAAC,KAAK,gBAAgB,CAAC,KAAK,WAAW;AAClG,WAAO,WAAW,OAAO,KAAK,mBAAmB,mFAAmF;AAAA,EACtI;AAEA,MAAI;AACF,UAAM,SAAS,UAAM;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,yBAAyB,MAAM;AAAA,MAC/B,OAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,SACO,KAAc;AACnB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,WAAW,OAAO,KAAK,iBAAiB,OAAO;AAAA,EACxD;AACF;;;AC9OA,IAAAC,aAAsD;AACtD,IAAAC,eAA0B;AAGnB,SAAS,kBAAkB,QAAmB;AACnD,aAAO,+BAAmB,OAAO,UAAU;AAEzC,sCAAkB,OAAO,iBAAiB,sBAAsB;AAEhE,UAAM,UAAU,MAAM,OAAO,SAAS,iBAAiB;AACvD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,QAAQ,IAAI,OAAO,UAAU;AAC3B,cAAM,MAAM,UAAM,wBAAU,MAAM,SAAS;AAC3C,eAAO,EAAE,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,SAAS,KAAK,MAAM;AAAA,MAC5D,CAAC;AAAA,IACH;AACA,WAAO,EAAE,KAAK;AAAA,EAChB,CAAC;AACH;;;AClBA,IAAAC,cAAsD;AAG/C,SAAS,uBAAuB,QAAmB;AACxD,aAAO,gCAAmB,CAAC,UAAU;AAEnC,uCAAkB,OAAO,iBAAiB,sBAAsB;AAChE,UAAM,SAAS,OAAO;AAEtB,WAAO;AAAA,MACL;AAAA,MACA,wBAAwB,GAAG,MAAM;AAAA,MACjC,gBAAgB,GAAG,MAAM;AAAA,MACzB,mBAAmB,GAAG,MAAM;AAAA,MAC5B,UAAU,GAAG,MAAM;AAAA,MACnB,0BAA0B,CAAC,MAAM;AAAA,MACjC,qBAAqB,GAAG,MAAM;AAAA,MAC9B,uBAAuB,CAAC,sBAAsB,sBAAsB,eAAe;AAAA,MACnF,yBAAyB,CAAC,QAAQ;AAAA,MAClC,uCAAuC,CAAC,OAAO;AAAA,MAC/C,uCAAuC,CAAC,QAAQ,iBAAiB;AAAA,MACjE,kDAAkD,CAAC,OAAO;AAAA,MAC1D,kCAAkC,CAAC,MAAM;AAAA,MACzC,kBAAkB,CAAC,UAAU,SAAS,WAAW,gBAAgB;AAAA,MACjE,kBAAkB,CAAC,OAAO,OAAO,OAAO,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,yBAAyB,kBAAkB;AAAA,MAClI,uCAAuC,CAAC,iBAAiB,aAAa;AAAA;AAAA,MAGtE,eAAe;AAAA,MACf,8BAA8B,CAAC,WAAW,SAAS;AAAA,MACnD,+BAA+B,GAAG,MAAM;AAAA,MACxC,kCAAkC,GAAG,MAAM;AAAA;AAAA,MAG3C,yBAAyB,GAAG,MAAM;AAAA,MAClC,8BAA8B,GAAG,MAAM;AAAA,MACvC,+BAA+B,CAAC,QAAQ,SAAS,QAAQ;AAAA,MACzD,oCAAoC,CAAC,WAAW,YAAY;AAAA,IAC9D;AAAA,EACF,CAAC;AACH;;;ACtCA,IAAAC,iBAA4H;AAC5H,IAAAC,cAA0I;AAM1I,IAAM,oBAAiC,CAAC,QAAQ,SAAS,QAAQ;AAEjE,SAAS,sBAAsB,SAAyC;AACtE,MAAI,CAAC,SAAS;AACZ,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,EAC1E;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,0BACP,OACA,QACA,eACQ;AACR,MAAI,mBAAmB,OAAO,MAAM,GAAG;AACrC,WAAO;AAAA,EACT;AACA,SAAO,sBAAsB,aAAa;AAC5C;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAElF,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,GAAG;AAClE,UAAM,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AACrD,UAAM,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM,IAAmB;AACpE,UAAM,YAAY,MAAM,YAAY,OAAO,MAAM,SAAS,IAAI;AAE9D,QAAI,WAAW;AACb,aAAO,OAAO,WAAW,WAAW,EAAE,OAAO,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC1E;AAEA,UAAM,WAAW,sBAAsB,aAAa;AAGpD,UAAM,aAAa,MAAM,OAAO,UAAU,YAAY,QAAQ;AAC9D,UAAM,aAAa,CAAC,UAAU,GAAG,WAAW,IAAI,OAAK,EAAE,KAAK,CAAC;AAE7D,WAAO,OAAO,WAAW,WAAW,EAAE,OAAO,QAAQ,QAAQ,WAAW,WAAW,CAAC;AAAA,EACtF,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,QAAmB;AAC7E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,sBAA8B,KAAK;AACtD,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAElF,QAAI,eAAe;AACjB,WAAK,YAAY,cAAc;AAAA,IACjC;AAEA,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,eAAe,CAAC,KAAK,UAAU;AAC1D,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,4DAA4D,CAAC;AAAA,IAC9G;AAEA,QAAI,CAAC,KAAK,YAAY;AACpB,WAAK,aAAa;AAAA,IACpB;AAEA,QAAI,CAAC,kBAAkB,SAAS,KAAK,UAAU,GAAG;AAChD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,kBAAkB,KAAK,IAAI,CAAC,GAAG,CAAC;AAAA,IACxH;AAEA,QAAI,KAAK,eAAe,WAAW,CAAC,KAAK,UAAU;AACjD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,IAC1F;AAEA,UAAM,QAAQ,UAAM,4BAAY,MAAM,OAAO,UAAU;AACvD,uCAAkB,OAAO,GAAG;AAC5B,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,sBAAsB,QAAmB;AACvD,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,QAAQ,UAAM,gCAAgB,IAAI,OAAO,UAAU;AACzD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,UAAM,OAAO,MAAM,MAAM,MAAM,IAAI,MAAM,cAAc,MAAM,UAAU;AACvE,uCAAkB,OAAO,QAAQ,IAAI;AAErC,UAAM,kBAAc,8BAAiB,OAAO,eAAe;AAC3D,QAAI,gBAAgB,MAAM;AACxB,yCAAkB,OAAO,GAAG;AAC5B,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,0BAA0B,OAAO,QAAQ,aAAa;AAEpE,UAAM,OAAO,UAAM,sBAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAEnD,QAAI,KAAK,eAAe,QAAW;AACjC,UAAI,CAAC,kBAAkB,SAAS,KAAK,UAAuB,GAAG;AAC7D,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,kBAAkB,KAAK,IAAI,CAAC,GAAG,CAAC;AAAA,MACxH;AACA,UAAI,KAAK,eAAe,YAAY,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,KAAK,YAAY,IAAI;AAC9G,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sDAAsD,CAAC;AAAA,MACxG;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAGA,QAAI,UAAU,gBAAgB;AAC5B,YAAM,cAAc,MAAM,QAAQ,cAAc;AAChD,UAAI,CAAC,aAAa;AAChB,cAAM,gBAAgB,MAAM,OAAO,UAAU,YAAY,MAAM,QAAQ,SAAS;AAChF,YAAI,CAAC,eAAe;AAClB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,QAC5F;AACA,cAAM,oBAAoB,cAAc,UAAU,SAAS,cAAc,aAAa;AACtF,YAAI,CAAC,mBAAmB;AACtB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,gEAAgE,CAAC;AAAA,QAClH;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,YAA+C,KAAK,aACtD,EAAE,YAAY,KAAK,YAAyB,UAAU,KAAK,SAA+B,IAC1F;AACJ,YAAM,WAAW,UAAM,6BAAa,IAAI,OAAO,OAAO,YAAY,SAAS;AAE3E,YAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,YAAM,WAAW,UAAM,8BAAc,UAAU,OAAO,QAAQ,WAAW,YAAY,WAAW,GAAG;AACnG,aAAO,EAAE,OAAO,UAAU,WAAW,SAAS;AAAA,IAChD,SACO,KAAc;AACnB,UAAI,OAAO,OAAO,QAAQ,YAAY,gBAAgB,IAAK,OAAM;AACjE,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,0BAA0B,OAAO,QAAQ,aAAa;AAEpE,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,QAAI,UAAU,gBAAgB;AAC5B,YAAM,cAAc,MAAM,QAAQ,cAAc;AAChD,UAAI,CAAC,aAAa;AAChB,cAAM,gBAAgB,MAAM,OAAO,UAAU,YAAY,MAAM,QAAQ,SAAS;AAChF,YAAI,CAAC,eAAe;AAClB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,QAC5F;AACA,cAAM,oBAAoB,cAAc,UAAU,SAAS,cAAc,aAAa;AACtF,YAAI,CAAC,mBAAmB;AACtB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6DAA6D,CAAC;AAAA,QAC/G;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,UAAM,0BAAU,IAAI,OAAO,OAAO,UAAU;AAC3D,aAAO;AAAA,IACT,SACO,KAAc;AACnB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,QAAmB;AAC7E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,WAAW,0BAA0B,OAAO,QAAQ,aAAa;AAEvE,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,QAAI,aAAa,gBAAgB;AAC/B,YAAM,cAAc,MAAM,QAAQ,cAAc;AAChD,UAAI,CAAC,aAAa;AAChB,cAAM,gBAAgB,MAAM,OAAO,UAAU,YAAY,MAAM,QAAQ,SAAS;AAChF,cAAM,aAAa,iBAAiB,cAAc,aAAa;AAC/D,cAAM,UAAU,OAAO,aAAa,SAAS,QAAQ;AACrD,YAAI,CAAC,cAAc,CAAC,SAAS;AAC3B,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,+DAA+D,CAAC;AAAA,QACjH;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,UAAM,4BAAY,IAAI,OAAO,UAAU;AACvD,aAAO;AAAA,IACT,SACO,KAAc;AACnB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,WAAW,sBAAsB,aAAa;AAEpD,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,QAAQ,UAAM,gCAAgB,IAAI,OAAO,UAAU;AACzD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,QAAI,MAAM,QAAQ,cAAc,UAAU;AACxC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,yCAAyC,CAAC;AAAA,IAC3F;AAEA,QAAI,MAAM,WAAW,YAAY;AAC/B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,MAAM,MAAM,IAAI,CAAC;AAAA,IACpG;AAEA,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,WAAW,UAAM,8BAAc,OAAO,OAAO,QAAQ,WAAW,YAAY,WAAW,GAAG;AAEhG,WAAO,EAAE,WAAW,UAAU,MAAM;AAAA,EACtC,CAAC;AACH;AAGO,SAAS,0BAA0B,QAAmB;AAC3D,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,iBAAa,uBAAU,OAAO,eAAe;AACnD,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,IAC5F;AACA,UAAM,QAAQ,WAAW,MAAM,CAAC;AAEhC,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,SAAS,UAAM,+BAAe,OAAO;AAAA,MACzC,WAAW,WAAW;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,OAAO,OAAO;AACjB,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,OAAO,KAAK,GAAG,CAAC;AAAA,IACzF;AAEA,QAAI,OAAO,QAAQ,aAAa,IAAI;AAClC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AAEA,UAAM,QAAQ,UAAM,gCAAgB,IAAI,OAAO,UAAU;AACzD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,YAAQ,MAAM,QAAQ;AAAA,MACpB,KAAK;AACH,eAAO,EAAE,OAAO,oBAAoB,QAAQ,MAAM,OAAO;AAAA,MAC3D,KAAK;AACH,eAAO,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO;AAAA,MAClD,KAAK;AACH,eAAO,EAAE,OAAO,UAAU,QAAQ,MAAM,OAAO;AAAA,MACjD,KAAK;AACH,eAAO,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO;AAAA,MAClD,KAAK;AACH,eAAO,EAAE,OAAO,gBAAgB,QAAQ,MAAM,OAAO;AAAA,IACzD;AAEA,QAAI,MAAM,QAAQ,eAAe,QAAQ;AACvC,YAAM,OAAO,UAAM,yBAAS,IAAI,OAAO,UAAU;AACjD,aAAO,EAAE,QAAQ,YAAY,OAAO,KAAK;AAAA,IAC3C;AAEA,WAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,EAClC,CAAC;AACH;AAiBO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,0BAA0B,OAAO,QAAQ,aAAa;AAEpE,UAAM,OAAO,UAAM,sBAA2C,KAAK;AAEnE,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,QAAQ,KAAK,UAAU,KAAK,KAAK,WAAW,WAAW,GAAG;AACxF,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oCAAoC,CAAC;AAAA,IACtF;AAEA,UAAM,UAAyB,CAAC;AAChC,QAAI,WAAW;AAEf,eAAW,QAAQ,KAAK,YAAY;AAClC,UAAI;AACF,YAAI;AACJ,gBAAQ,KAAK,QAAQ;AAAA,UACnB,KAAK,WAAW;AACd,kBAAM,YAA+C,KAAK,aACtD,EAAE,YAAY,KAAK,YAAY,UAAU,KAAK,SAAS,IACvD;AACJ,oBAAQ,UAAM,6BAAa,KAAK,IAAI,OAAO,OAAO,YAAY,SAAS;AACvE;AAAA,UACF;AAAA,UACA,KAAK;AACH,oBAAQ,UAAM,0BAAU,KAAK,IAAI,OAAO,OAAO,UAAU;AACzD;AAAA,UACF,KAAK;AACH,oBAAQ,UAAM,4BAAY,KAAK,IAAI,OAAO,UAAU;AACpD;AAAA,UACF;AACE,kBAAM,IAAI,MAAM,mBAAoB,KAA4B,MAAM,EAAE;AAAA,QAC5E;AACA,gBAAQ,KAAK,EAAE,IAAI,KAAK,IAAI,QAAQ,MAAM,QAAQ,SAAS,KAAK,CAAC;AAAA,MACnE,SACO,KAAK;AACV,mBAAW;AACX,gBAAQ,KAAK;AAAA,UACX,IAAI,KAAK;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,OAAO;AAAA,YACL,MAAM;AAAA,YACN,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,YAC5C,QAAQ;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,yCAAkB,OAAO,GAAG;AAAA,IAC9B;AAEA,WAAO,EAAE,QAAQ;AAAA,EACnB,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,SAAoB;AAC9E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,sBAA4B,KAAK;AAEpD,QAAI,CAAC,MAAM,OAAO;AAChB,aAAO,EAAE,OAAO,OAAO,OAAO,gBAAgB;AAAA,IAChD;AAEA,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,SAAS,UAAM,+BAAe,KAAK,OAAO;AAAA,MAC9C,WAAW,WAAW;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO,EAAE,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,IAC7C;AAEA,UAAM,UAAU,OAAO,QAAQ;AAC/B,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,OAAO,OAAO,OAAO,4BAA4B;AAAA,IAC5D;AAEA,UAAM,QAAQ,UAAM,gCAAgB,SAAS,OAAO,UAAU;AAC9D,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,OAAO,OAAO,OAAO,kBAAkB;AAAA,IAClD;AAEA,QAAI,MAAM,WAAW,YAAY;AAC/B,aAAO,EAAE,OAAO,OAAO,OAAO,kCAAkC,MAAM,MAAM,IAAI;AAAA,IAClF;AAEA,QAAI,MAAM,QAAQ,eAAe,QAAQ;AACvC,YAAM,OAAO,UAAM,yBAAS,SAAS,OAAO,UAAU;AACtD,aAAO,EAAE,OAAO,MAAM,QAAQ,OAAO,QAAQ,OAAO,KAAK;AAAA,IAC3D;AAEA,WAAO,EAAE,OAAO,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrD,CAAC;AACH;;;AC/aA,IAAAC,iBAAkE;AAClE,IAAAC,cAA0F;AAK1F,IAAMC,qBAAiC,CAAC,QAAQ,SAAS,QAAQ;AAEjE,SAAS,mBAAmB,SAAsD;AAChF,MAAI,CAAC,SAAS;AACZ,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,EAC1E;AACA,MAAI,QAAQ,QAAQ,SAAS;AAC3B,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,EAC5F;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,SAAyC;AAC9D,MAAI,CAAC,SAAS;AACZ,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,EAC1E;AACA,SAAO,QAAQ;AACjB;AAGO,SAAS,8BAA8B,QAAmB,QAAmB;AAClF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,YAAY,mBAAmB,aAAa;AAElD,UAAM,OAAO,UAAM,sBAAS,KAAK;AAEjC,QAAI,CAAC,MAAM,YAAY,OAAO,KAAK,aAAa,UAAU;AACxD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AACA,QAAI,CAAC,MAAM,YAAY,OAAO,KAAK,aAAa,UAAU;AACxD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AAEA,UAAM,YAAY,KAAK,cAAc;AACrC,QAAI,CAACA,mBAAkB,SAAS,SAAS,GAAG;AAC1C,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuCA,mBAAkB,KAAK,IAAI,CAAC,GAAG,CAAC;AAAA,IACxH;AAEA,QAAI,cAAc,YAAY,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,WAAW;AAClF,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,IAC1F;AAEA,UAAM,QAAQ,UAAM,iCAAiB;AAAA,MACnC;AAAA,MACA,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,QAAQ,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,SAAS;AAAA,MACnD,YAAY;AAAA,MACZ,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAChE,GAAG,OAAO,UAAU;AAEpB,uCAAkB,OAAO,GAAG;AAC5B,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,6BAA6B,QAAmB,QAAmB;AACjF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,cAAc,aAAa;AAEzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,OAAO,MAAM;AACnB,UAAM,SAAS,MAAM;AACrB,UAAM,SAAS,MAAM;AACrB,UAAM,aAAa,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI;AAEvD,UAAM,aAAa,OAAO;AAE1B,QAAI;AAEJ,QAAI,SAAS,aAAa;AACxB,UAAI,CAAC,WAAW,iBAAiB;AAC/B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iDAAiD,CAAC;AAAA,MACnG;AACA,oBAAc,MAAM,WAAW,gBAAgB,KAAK;AAAA,IACtD,WACS,SAAS,YAAY;AAC5B,UAAI,CAAC,WAAW,gBAAgB;AAC9B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iDAAiD,CAAC;AAAA,MACnG;AACA,oBAAc,MAAM,WAAW,eAAe,KAAK;AAAA,IACrD,OACK;AAEH,YAAM,CAAC,aAAa,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,QAClD,WAAW,kBAAkB,WAAW,gBAAgB,KAAK,IAAI,CAAC;AAAA,QAClE,WAAW,iBAAiB,WAAW,eAAe,KAAK,IAAI,CAAC;AAAA,MAClE,CAAC;AAED,YAAM,OAAO,oBAAI,IAAY;AAC7B,oBAAc,CAAC;AACf,iBAAW,SAAS,CAAC,GAAG,aAAa,GAAG,UAAU,GAAG;AACnD,YAAI,CAAC,KAAK,IAAI,MAAM,EAAE,GAAG;AACvB,eAAK,IAAI,MAAM,EAAE;AACjB,sBAAY,KAAK,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAGA,gBAAY,KAAK,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;AAGtD,QAAI,QAAQ;AACV,YAAM,IAAI,OAAO,YAAY;AAC7B,oBAAc,YAAY;AAAA,QAAO,OAC/B,EAAE,QAAQ,WAAW,YAAY,EAAE,SAAS,CAAC,KAC1C,EAAE,QAAQ,UAAU,YAAY,EAAE,SAAS,CAAC,KAC5C,EAAE,QAAQ,UAAU,YAAY,EAAE,SAAS,CAAC;AAAA,MACjD;AAAA,IACF;AAGA,QAAI,QAAQ;AACV,YAAM,MAAM,YAAY,UAAU,OAAK,EAAE,OAAO,MAAM;AACtD,UAAI,OAAO,EAAG,eAAc,YAAY,MAAM,MAAM,CAAC;AAAA,IACvD;AAEA,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,cAAc,IAAI,CAAC,GAAG,GAAG;AACzD,UAAM,UAAU,YAAY,SAAS;AACrC,UAAM,OAAO,YAAY,MAAM,GAAG,KAAK;AAEvC,WAAO;AAAA,MACL;AAAA,MACA,YAAY;AAAA,QACV,QAAQ,KAAK,SAAS,IAAI,KAAK,GAAG,EAAE,EAAG,KAAK;AAAA,QAC5C,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAGO,SAAS,8BAA8B,QAAmB,QAAmB;AAClF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,cAAc,aAAa;AAEzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AACrC,QAAI,CAAC,IAAI;AACP,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,IAC1E;AAEA,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,SAAS,MAAM,SAAS,cAAc;AACzC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uBAAuB,CAAC;AAAA,IACzE;AAGA,QAAI,MAAM,QAAQ,cAAc,OAAO;AACrC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,2CAA2C,CAAC;AAAA,IAC7F;AAEA,QAAI;AACF,YAAM,UAAU,UAAM,4BAAY,IAAI,OAAO,UAAU;AACvD,aAAO;AAAA,IACT,SACO,KAAc;AACnB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,gCAAgC,QAAmB,SAAoB;AACrF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AACrC,QAAI,CAAC,IAAI;AACP,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,IAC1E;AAEA,UAAM,OAAO,UAAM,sBAAiD,KAAK;AACzE,QAAI,CAAC,MAAM,YAAY,CAAC,MAAM,UAAU;AACtC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,+BAA+B,CAAC;AAAA,IACjF;AAEA,QAAI;AACF,YAAM,QAAQ,UAAM,mCAAmB,IAAI,KAAK,UAAU,KAAK,UAAU,OAAO,UAAU;AAC1F,aAAO;AAAA,QACL,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,QAAQ,MAAM,QAAQ,UAAU,CAAC;AAAA,MACnC;AAAA,IACF,SACO,KAAK;AACV,aAAO;AAAA,QACL,OAAO;AAAA,QACP,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,MAC9C;AAAA,IACF;AAAA,EACF,CAAC;AACH;","names":["import_h3","import_node_crypto","import_h3","import_node_crypto","import_h3","import_h3","import_h3","import_h3","import_h3","import_auth","import_grants","RE_WHITESPACE","token","import_h3","import_jose","import_h3","import_grants","import_h3","import_grants","import_h3","VALID_GRANT_TYPES"]}