{"version":3,"sources":["../src/index.ts","../src/idp/app.ts","../src/idp/handlers/auth.ts","../src/idp/utils/problem.ts","../src/idp/utils/ed25519.ts","../src/idp/utils/auth-token.ts","../src/idp/handlers/enroll.ts","../src/idp/handlers/admin.ts","../src/idp/utils/bearer-auth.ts","../src/idp/handlers/authorize.ts","../src/idp/handlers/session.ts","../src/idp/handlers/token.ts","../src/idp/handlers/jwks.ts","../src/idp/handlers/discovery.ts","../src/idp/handlers/grants.ts","../src/idp/handlers/delegations.ts","../src/idp/middleware/security-headers.ts","../src/idp/middleware/rate-limit.ts","../src/idp/middleware/body-limit.ts","../src/sp/app.ts","../src/sp/handlers/api-callback.ts","../src/sp/handlers/api-login.ts","../src/sp/handlers/api-grant-callback.ts","../src/sp/handlers/api-grant-status.ts","../src/sp/handlers/api-me.ts","../src/sp/handlers/api-protected-action.ts","../src/sp/handlers/api-request-permission.ts","../src/sp/handlers/callback.ts","../src/sp/handlers/login.ts","../src/sp/handlers/me.ts","../src/sp/handlers/metadata.ts"],"sourcesContent":["export { createIdPApp } from './idp/app.js'\nexport type { IdPConfig, IdPInstance, IdPStores } from './idp/config.js'\nexport { createSPApp } from './sp/app.js'\nexport type { SPConfig, SPInstance } from './sp/config.js'\n","import { createApp, createRouter, defineEventHandler, handleCors } from 'h3'\nimport {\n  InMemoryCodeStore,\n  InMemoryGrantChallengeStore,\n  InMemoryJtiStore,\n  InMemoryKeyStore,\n  InMemoryRefreshTokenStore,\n  InMemorySshKeyStore,\n  InMemoryUserStore,\n} from '@openape/auth'\nimport { InMemoryGrantStore } from '@openape/grants'\nimport type { IdPConfig, IdPInstance, IdPStores } from './config.js'\nimport {\n  createAddSshKeyHandler,\n  createApproveGrantHandler,\n  createAuthenticateHandler,\n  createAuthorizeHandler,\n  createBatchGrantHandler,\n  createChallengeHandler,\n  createConsumeGrantHandler,\n  createCreateDelegationHandler,\n  createCreateGrantHandler,\n  createCreateUserHandler,\n  createDeleteSshKeyHandler,\n  createDeleteUserHandler,\n  createDenyGrantHandler,\n  createDiscoveryHandler,\n  createEnrollHandler,\n  createGetGrantHandler,\n  createGrantTokenHandler,\n  createJWKSHandler,\n  createListDelegationsHandler,\n  createListGrantsHandler,\n  createListSshKeysHandler,\n  createListUsersHandler,\n  createLoginPageHandler,\n  createRevokeDelegationHandler,\n  createRevokeGrantHandler,\n  createSessionLoginHandler,\n  createSessionLogoutHandler,\n  createTokenHandler,\n  createValidateDelegationHandler,\n  createVerifyGrantHandler,\n} from './handlers/index.js'\nimport { createSecurityHeadersMiddleware } from './middleware/security-headers.js'\nimport { createRateLimitMiddleware } from './middleware/rate-limit.js'\nimport { createBodyLimitMiddleware } from './middleware/body-limit.js'\n\nfunction createDefaultStores(): IdPStores {\n  return {\n    userStore: new InMemoryUserStore(),\n    sshKeyStore: new InMemorySshKeyStore(),\n    keyStore: new InMemoryKeyStore(),\n    codeStore: new InMemoryCodeStore(),\n    challengeStore: new InMemoryGrantChallengeStore(),\n    grantStore: new InMemoryGrantStore(),\n    jtiStore: new InMemoryJtiStore(),\n    refreshTokenStore: new InMemoryRefreshTokenStore(),\n  }\n}\n\nconst CORS_PATH_PREFIXES = [\n  '/.well-known/',\n  '/token',\n  '/userinfo',\n  '/api/grants',\n  '/api/auth/',\n  '/api/agent/',\n  '/api/delegations',\n]\n\nfunction createCorsMiddleware() {\n  return defineEventHandler((event) => {\n    const path = event.path\n    const needsCors = CORS_PATH_PREFIXES.some(p => path.startsWith(p))\n\n    if (needsCors) {\n      const handled = handleCors(event, {\n        origin: '*',\n        methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],\n        allowHeaders: ['Content-Type', 'Authorization'],\n        exposeHeaders: ['Content-Type'],\n        preflight: { statusCode: 204 },\n      })\n      if (handled) {\n        return ''\n      }\n    }\n  })\n}\n\nexport function createIdPApp(config: IdPConfig, stores?: Partial<IdPStores>): IdPInstance {\n  const resolvedStores: IdPStores = { ...createDefaultStores(), ...stores }\n  const app = createApp()\n  const router = createRouter()\n\n  // Auth\n  router.post('/api/auth/challenge', createChallengeHandler(resolvedStores, config))\n  router.post('/api/auth/authenticate', createAuthenticateHandler(resolvedStores, config))\n  router.post('/api/auth/enroll', createEnrollHandler(resolvedStores, config))\n\n  // Session (browser flow)\n  router.get('/login', createLoginPageHandler())\n  router.post('/api/session/login', createSessionLoginHandler(resolvedStores, config))\n  router.post('/api/session/logout', createSessionLogoutHandler(resolvedStores, config))\n\n  // OIDC\n  router.get('/authorize', createAuthorizeHandler(resolvedStores, config))\n  router.post('/token', createTokenHandler(resolvedStores, config))\n  router.get('/.well-known/jwks.json', createJWKSHandler(resolvedStores))\n  router.get('/.well-known/openid-configuration', createDiscoveryHandler(config))\n\n  // Grants\n  router.get('/api/grants', createListGrantsHandler(resolvedStores, config))\n  router.post('/api/grants', createCreateGrantHandler(resolvedStores, config))\n  router.post('/api/grants/verify', createVerifyGrantHandler(resolvedStores, config))\n  router.post('/api/grants/batch', createBatchGrantHandler(resolvedStores, config))\n  router.get('/api/grants/:id', createGetGrantHandler(resolvedStores))\n  router.post('/api/grants/:id/approve', createApproveGrantHandler(resolvedStores, config))\n  router.post('/api/grants/:id/deny', createDenyGrantHandler(resolvedStores, config))\n  router.post('/api/grants/:id/revoke', createRevokeGrantHandler(resolvedStores, config))\n  router.post('/api/grants/:id/token', createGrantTokenHandler(resolvedStores, config))\n  router.post('/api/grants/:id/consume', createConsumeGrantHandler(resolvedStores))\n\n  // Delegations\n  router.post('/api/delegations', createCreateDelegationHandler(resolvedStores, config))\n  router.get('/api/delegations', createListDelegationsHandler(resolvedStores, config))\n  router.delete('/api/delegations/:id', createRevokeDelegationHandler(resolvedStores, config))\n  router.post('/api/delegations/:id/validate', createValidateDelegationHandler(resolvedStores, config))\n\n  // Admin\n  router.get('/api/admin/users', createListUsersHandler(resolvedStores, config))\n  router.post('/api/admin/users', createCreateUserHandler(resolvedStores, config))\n  router.delete('/api/admin/users/:email', createDeleteUserHandler(resolvedStores, config))\n  router.post('/api/admin/users/:email/ssh-keys', createAddSshKeyHandler(resolvedStores, config))\n  router.get('/api/admin/users/:email/ssh-keys', createListSshKeysHandler(resolvedStores, config))\n  router.delete('/api/admin/users/:email/ssh-keys/:keyId', createDeleteSshKeyHandler(resolvedStores, config))\n\n  app.use(createSecurityHeadersMiddleware())\n  app.use(createBodyLimitMiddleware())\n  if (config.rateLimitConfig) {\n    app.use(createRateLimitMiddleware(config.rateLimitConfig))\n  }\n  app.use(createCorsMiddleware())\n  app.use(router)\n  return { app, stores: resolvedStores }\n}\n","import { defineEventHandler, readBody } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyEd25519Signature } from '../utils/ed25519.js'\nimport { issueAuthToken } from '../utils/auth-token.js'\n\nexport function createChallengeHandler(stores: IdPStores, _config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const body = await readBody<{ id: string }>(event)\n\n    if (!body.id) {\n      throw createProblemError({ status: 400, title: 'Missing required field: id' })\n    }\n\n    // A deactivated user must not receive challenges, even with SSH keys on file\n    const user = await stores.userStore.findByEmail(body.id)\n    if (user && !user.isActive) {\n      throw createProblemError({ status: 403, title: 'User is inactive' })\n    }\n    if (user) {\n      const challenge = await stores.challengeStore.createChallenge(user.email)\n      return { challenge }\n    }\n\n    // Identities known only by SSH key (no userStore record)\n    const sshKeys = await stores.sshKeyStore.findByUser(body.id)\n    if (sshKeys.length > 0) {\n      const challenge = await stores.challengeStore.createChallenge(body.id)\n      return { challenge }\n    }\n\n    throw createProblemError({ status: 404, title: 'No user with SSH keys found for this identity' })\n  })\n}\n\nexport function createAuthenticateHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const body = await readBody<{\n      id: string\n      challenge: string\n      signature: string\n      public_key?: string\n    }>(event)\n\n    if (!body.id || !body.challenge || !body.signature) {\n      throw createProblemError({ status: 400, title: 'Missing required fields: id, challenge, signature' })\n    }\n\n    const user = await stores.userStore.findByEmail(body.id)\n    if (!user) {\n      throw createProblemError({ status: 404, title: 'User not found' })\n    }\n\n    if (!user.isActive) {\n      throw createProblemError({ status: 403, title: 'User is inactive' })\n    }\n\n    // Determine which SSH key(s) to verify against\n    let keys\n    if (body.public_key) {\n      const sshKey = await stores.sshKeyStore.findByPublicKey(body.public_key)\n      if (!sshKey || sshKey.userEmail !== body.id) {\n        throw createProblemError({ status: 404, title: 'SSH key not found for this user' })\n      }\n      keys = [sshKey]\n    }\n    else {\n      keys = await stores.sshKeyStore.findByUser(body.id)\n      if (keys.length === 0) {\n        throw createProblemError({ status: 404, title: 'No SSH keys found for this user' })\n      }\n    }\n\n    // Consume challenge\n    const valid = await stores.challengeStore.consumeChallenge(body.challenge, body.id)\n    if (!valid) {\n      throw createProblemError({ status: 401, title: 'Invalid, expired, or already used challenge' })\n    }\n\n    // Try each registered key until one verifies\n    const signatureBuffer = Buffer.from(body.signature, 'base64')\n    let isValid = false\n    for (const key of keys) {\n      if (verifyEd25519Signature(key.publicKey, body.challenge, signatureBuffer)) {\n        isValid = true\n        break\n      }\n    }\n    if (!isValid) {\n      throw createProblemError({ status: 401, title: 'Invalid signature', type: 'https://ddisa.org/errors/invalid_token' })\n    }\n\n    // Determine act: explicit type > fallback (owner → agent, no owner → human)\n    const act = user.type ?? (user.owner ? 'agent' as const : 'human' as const)\n\n    const signingKey = await stores.keyStore.getSigningKey()\n    const token = await issueAuthToken(\n      { sub: user.email, act },\n      config.issuer,\n      signingKey.privateKey,\n      signingKey.kid,\n    )\n\n    return {\n      token,\n      id: user.email,\n      email: user.email,\n      name: user.name,\n      act,\n      expires_in: 3600,\n    }\n  })\n}\n","import { createError } from 'h3'\nimport { createProblemDetails } from '@openape/core'\n\nexport function createProblemError(opts: {\n  type?: string\n  title: string\n  status: number\n  detail?: string\n}) {\n  const problem = createProblemDetails(opts)\n  return createError({\n    statusCode: opts.status,\n    statusMessage: opts.title,\n    data: problem,\n  })\n}\n","import type { KeyObject } from 'node:crypto'\nimport { createPublicKey, verify } from 'node:crypto'\n\nconst ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex')\n\nconst RE_WHITESPACE = /\\s+/\n\nfunction parseSSHEd25519PublicKey(sshKey: string): KeyObject {\n  const parts = sshKey.trim().split(RE_WHITESPACE)\n  if (parts[0] !== 'ssh-ed25519' || !parts[1]) {\n    throw new Error('Not an ssh-ed25519 key')\n  }\n\n  const wireFormat = Buffer.from(parts[1], 'base64')\n\n  let offset = 0\n  const typeLen = wireFormat.readUInt32BE(offset)\n  offset += 4\n  const keyType = wireFormat.subarray(offset, offset + typeLen).toString()\n  offset += typeLen\n\n  if (keyType !== 'ssh-ed25519') {\n    throw new Error(`Unexpected key type in wire format: ${keyType}`)\n  }\n\n  const keyLen = wireFormat.readUInt32BE(offset)\n  offset += 4\n  const rawKey = wireFormat.subarray(offset, offset + keyLen)\n\n  if (rawKey.length !== 32) {\n    throw new Error(`Expected 32-byte ed25519 key, got ${rawKey.length}`)\n  }\n\n  const spkiDer = Buffer.concat([ED25519_SPKI_PREFIX, rawKey])\n\n  return createPublicKey({\n    key: spkiDer,\n    format: 'der',\n    type: 'spki',\n  })\n}\n\n/**\n * Parse an SSH Ed25519 public key into a Node.js KeyObject.\n * The returned KeyObject is compatible with jose's KeyLike type\n * and can be used for EdDSA JWT verification.\n */\nexport function sshEd25519ToKeyObject(sshKey: string): KeyObject {\n  return parseSSHEd25519PublicKey(sshKey)\n}\n\nexport function verifyEd25519Signature(\n  sshPublicKey: string,\n  data: Buffer | string,\n  signature: Buffer,\n): boolean {\n  const pubKey = parseSSHEd25519PublicKey(sshPublicKey)\n  const dataBuffer = typeof data === 'string' ? Buffer.from(data) : data\n  return verify(null, dataBuffer, pubKey, signature)\n}\n","import type { ActorType } from '@openape/core'\nimport type { KeyLike } from 'jose'\nimport { jwtVerify, SignJWT } from 'jose'\n\n/**\n * Default audience for CLI-issued tokens. Every token issued by the IdP for\n * the apes ecosystem carries `aud='apes-cli'` so that downstream service\n * providers can enforce `expectedAud='apes-cli'` on their token-exchange\n * endpoints and reject tokens minted for any other purpose.\n */\nexport const DEFAULT_CLI_AUDIENCE = 'apes-cli'\n\nexport interface AuthTokenPayload {\n  sub: string\n  act: ActorType\n  aud?: string\n}\n\nexport async function issueAuthToken(\n  payload: { sub: string, act: ActorType, aud?: string },\n  issuer: string,\n  privateKey: KeyLike,\n  kid?: string,\n): Promise<string> {\n  const jwt = new SignJWT({ sub: payload.sub, act: payload.act })\n    .setProtectedHeader({ alg: 'EdDSA', ...(kid ? { kid } : {}) })\n    .setIssuer(issuer)\n    .setSubject(payload.sub)\n    .setAudience(payload.aud ?? DEFAULT_CLI_AUDIENCE)\n    .setIssuedAt()\n    .setExpirationTime('1h')\n\n  return await jwt.sign(privateKey)\n}\n\nexport async function verifyAuthToken(\n  token: string,\n  issuer: string,\n  publicKey: KeyLike | Uint8Array,\n  expectedAud?: string,\n): Promise<AuthTokenPayload> {\n  const { payload } = await jwtVerify(token, publicKey, {\n    issuer,\n    ...(expectedAud ? { audience: expectedAud } : {}),\n    algorithms: ['EdDSA'],\n  })\n\n  const act = payload.act\n  if (act !== 'agent' && act !== 'human') {\n    throw new Error('Invalid act claim')\n  }\n\n  return {\n    sub: payload.sub as string,\n    act,\n    ...(typeof payload.aud === 'string' ? { aud: payload.aud } : {}),\n  }\n}\n","import { createHash } from 'node:crypto'\nimport { defineEventHandler, readBody } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { sshEd25519ToKeyObject } from '../utils/ed25519.js'\nimport { hasManagementToken } from './admin.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\n\nexport function createEnrollHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    // --- Determine auth method: management token or Bearer token ---\n    const isMgmt = hasManagementToken(event, config)\n\n    let callerEmail: string | undefined\n    if (!isMgmt) {\n      const payload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n      if (!payload) {\n        throw createProblemError({ status: 401, title: 'Authentication required (management token or Bearer token)' })\n      }\n      if (payload.act !== 'human') {\n        throw createProblemError({ status: 403, title: 'Only human users may enroll sub-users' })\n      }\n      callerEmail = payload.sub\n    }\n\n    const body = await readBody<{\n      email: string\n      name: string\n      publicKey: string\n      owner?: string\n      approver?: string\n      type?: 'human' | 'agent'\n    }>(event)\n\n    // --- Validate required fields ---\n    // For management token: owner is required in body\n    // For Bearer token: owner is automatically set to caller\n    if (isMgmt) {\n      if (!body.email || !body.name || !body.publicKey || !body.owner) {\n        throw createProblemError({ status: 400, title: 'Missing required fields: email, name, publicKey, owner' })\n      }\n    }\n    else {\n      if (!body.email || !body.name || !body.publicKey) {\n        throw createProblemError({ status: 400, title: 'Missing required fields: email, name, publicKey' })\n      }\n    }\n\n    // Input length validation\n    if (body.email.length > 255) {\n      throw createProblemError({ status: 400, title: 'Email must not exceed 255 characters' })\n    }\n    if (body.name.length > 255) {\n      throw createProblemError({ status: 400, title: 'Name must not exceed 255 characters' })\n    }\n    if (body.publicKey.length > 1000) {\n      throw createProblemError({ status: 400, title: 'Public key must not exceed 1000 characters' })\n    }\n\n    if (!body.publicKey.startsWith('ssh-ed25519 ')) {\n      throw createProblemError({ status: 400, title: 'Public key must be in ssh-ed25519 format' })\n    }\n\n    // Validate key format\n    try {\n      sshEd25519ToKeyObject(body.publicKey)\n    }\n    catch {\n      throw createProblemError({ status: 400, title: 'Invalid SSH key format' })\n    }\n\n    // Check for duplicate email\n    const existing = await stores.userStore.findByEmail(body.email)\n    if (existing) {\n      throw createProblemError({ status: 409, title: 'A user with this email already exists' })\n    }\n\n    // Check for duplicate public key\n    const existingKey = await stores.sshKeyStore.findByPublicKey(body.publicKey)\n    if (existingKey) {\n      throw createProblemError({ status: 409, title: 'A user with this public key already exists' })\n    }\n\n    // --- Determine owner, approver, type ---\n    const owner = isMgmt ? body.owner! : callerEmail!\n    const approver = isMgmt ? (body.approver ?? owner) : callerEmail!\n    const type = body.type ?? 'agent'\n\n    // Create user\n    const user = await stores.userStore.create({\n      email: body.email,\n      name: body.name,\n      owner,\n      approver,\n      type,\n      isActive: true,\n      createdAt: Date.now(),\n    })\n\n    // Register SSH key\n    const trimmedKey = body.publicKey.trim()\n    const parts = trimmedKey.split(/\\s+/)\n    const keyData = parts[1]!\n    const keyId = createHash('sha256').update(Buffer.from(keyData, 'base64')).digest('hex')\n\n    await stores.sshKeyStore.save({\n      keyId,\n      userEmail: body.email,\n      publicKey: trimmedKey,\n      name: body.name,\n      createdAt: Math.floor(Date.now() / 1000),\n    })\n\n    return {\n      email: user.email,\n      name: user.name,\n      owner: user.owner,\n      approver: user.approver,\n      type,\n      status: 'active',\n    }\n  })\n}\n","import { createHash, timingSafeEqual } from 'node:crypto'\nimport type { H3Event } from 'h3'\nimport { defineEventHandler, getQuery, getRequestHeader, getRouterParam, readBody } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { sshEd25519ToKeyObject } from '../utils/ed25519.js'\n\n/** Timing-safe string comparison to prevent timing attacks on token validation. */\nfunction safeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  return timingSafeEqual(Buffer.from(a), Buffer.from(b))\n}\n\nfunction requireManagementToken(event: H3Event, config: IdPConfig): void {\n  if (!config.managementToken) {\n    throw createProblemError({ status: 501, title: 'Management token not configured' })\n  }\n  const authHeader = getRequestHeader(event, 'authorization')\n  if (!authHeader) {\n    throw createProblemError({ status: 401, title: 'Authorization header required' })\n  }\n  const token = authHeader.replace(/^Bearer\\s+/i, '')\n  if (!safeCompare(token, config.managementToken)) {\n    throw createProblemError({ status: 403, title: 'Invalid management token' })\n  }\n}\n\n/** Check if the request carries a valid management token (non-throwing). */\nexport function hasManagementToken(event: H3Event, config: IdPConfig): boolean {\n  if (!config.managementToken) return false\n  const authHeader = getRequestHeader(event, 'authorization')\n  if (!authHeader) return false\n  const token = authHeader.replace(/^Bearer\\s+/i, '')\n  return safeCompare(token, config.managementToken)\n}\n\n// --- List Users ---\nexport function createListUsersHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    requireManagementToken(event, config)\n    const query = getQuery(event)\n    const result = await stores.userStore.list({\n      limit: query.limit ? Number(query.limit) : undefined,\n      cursor: query.cursor ? String(query.cursor) : undefined,\n      search: query.search ? String(query.search) : undefined,\n    })\n    return {\n      data: result.data.map(u => ({ email: u.email, name: u.name, isActive: u.isActive, owner: u.owner, createdAt: u.createdAt })),\n      pagination: result.pagination,\n    }\n  })\n}\n\n// --- Delete User ---\nexport function createDeleteUserHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    requireManagementToken(event, config)\n\n    const email = decodeURIComponent(getRouterParam(event, 'email')!)\n    const user = await stores.userStore.findByEmail(email)\n    if (!user) {\n      throw createProblemError({ status: 404, title: 'User not found' })\n    }\n\n    // Delete user's SSH keys first\n    await stores.sshKeyStore.deleteAllForUser(email)\n    await stores.userStore.delete(email)\n    return { ok: true }\n  })\n}\n\n// --- Create User ---\nexport function createCreateUserHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    requireManagementToken(event, config)\n\n    const body = await readBody<{ email: string, name: string, password?: string }>(event)\n    if (!body.email || !body.name) {\n      throw createProblemError({ status: 400, title: 'Missing required fields: email, name' })\n    }\n\n    // Input length validation\n    if (body.email.length > 255) {\n      throw createProblemError({ status: 400, title: 'Email must not exceed 255 characters' })\n    }\n    if (body.name.length > 255) {\n      throw createProblemError({ status: 400, title: 'Name must not exceed 255 characters' })\n    }\n\n    const existing = await stores.userStore.findByEmail(body.email)\n    if (existing) {\n      throw createProblemError({ status: 409, title: 'User already exists' })\n    }\n\n    const user = await stores.userStore.create({\n      email: body.email,\n      name: body.name,\n      isActive: true,\n      createdAt: Date.now(),\n    })\n    return { ok: true, email: user.email, name: user.name }\n  })\n}\n\n// --- Add SSH Key ---\nexport function createAddSshKeyHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    requireManagementToken(event, config)\n\n    const email = decodeURIComponent(getRouterParam(event, 'email')!)\n\n    const body = await readBody<{ publicKey: string, name?: string }>(event)\n    if (!body.publicKey || typeof body.publicKey !== 'string') {\n      throw createProblemError({ status: 400, title: 'Missing required field: publicKey' })\n    }\n\n    // Input length validation\n    if (body.publicKey.length > 1000) {\n      throw createProblemError({ status: 400, title: 'Public key must not exceed 1000 characters' })\n    }\n    if (body.name && body.name.length > 255) {\n      throw createProblemError({ status: 400, title: 'Name must not exceed 255 characters' })\n    }\n\n    const trimmedKey = body.publicKey.trim()\n\n    // Validate ssh-ed25519 format\n    try {\n      sshEd25519ToKeyObject(trimmedKey)\n    }\n    catch {\n      throw createProblemError({ status: 400, title: 'Invalid SSH key. Must be ssh-ed25519 format.' })\n    }\n\n    // Extract comment as fallback name\n    const parts = trimmedKey.split(/\\s+/)\n    const comment = parts.length >= 3 ? parts.slice(2).join(' ') : undefined\n    const name = body.name || comment || 'SSH Key'\n\n    // Compute SHA256 fingerprint as keyId\n    const keyData = parts[1]!\n    const keyId = createHash('sha256').update(Buffer.from(keyData, 'base64')).digest('hex')\n\n    // Check for duplicate key\n    const existing = await stores.sshKeyStore.findByPublicKey(trimmedKey)\n    if (existing) {\n      throw createProblemError({ status: 409, title: 'This SSH key is already registered' })\n    }\n\n    // Ensure user exists — create if not\n    const user = await stores.userStore.findByEmail(email)\n    if (!user) {\n      await stores.userStore.create({\n        email,\n        name,\n        isActive: true,\n        createdAt: Date.now(),\n      })\n    }\n\n    const sshKey = {\n      keyId,\n      userEmail: email,\n      publicKey: trimmedKey,\n      name,\n      createdAt: Math.floor(Date.now() / 1000),\n    }\n\n    await stores.sshKeyStore.save(sshKey)\n    return sshKey\n  })\n}\n\n// --- List SSH Keys ---\nexport function createListSshKeysHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    requireManagementToken(event, config)\n\n    const email = decodeURIComponent(getRouterParam(event, 'email')!)\n\n    return await stores.sshKeyStore.findByUser(email)\n  })\n}\n\n// --- Delete SSH Key ---\nexport function createDeleteSshKeyHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    requireManagementToken(event, config)\n\n    const keyId = getRouterParam(event, 'keyId')!\n\n    const existing = await stores.sshKeyStore.findById(keyId)\n    if (!existing) {\n      throw createProblemError({ status: 404, title: 'SSH key not found' })\n    }\n\n    await stores.sshKeyStore.delete(keyId)\n    return { ok: true }\n  })\n}\n","import type { H3Event } from 'h3'\nimport { getHeader } from 'h3'\nimport type { KeyStore } from '@openape/auth'\nimport type { AuthTokenPayload } from './auth-token.js'\nimport { verifyAuthToken } from './auth-token.js'\n\nfunction extractBearerToken(event: H3Event): string | null {\n  const authHeader = getHeader(event, 'authorization')\n  if (!authHeader?.startsWith('Bearer '))\n    return null\n  return authHeader.slice(7)\n}\n\nexport async function verifyBearerAuth(\n  event: H3Event,\n  keyStore: KeyStore,\n  issuer: string,\n): Promise<AuthTokenPayload | null> {\n  const token = extractBearerToken(event)\n  if (!token)\n    return null\n\n  const signingKey = await keyStore.getSigningKey()\n\n  try {\n    return await verifyAuthToken(token, issuer, signingKey.publicKey)\n  }\n  catch {\n    return null\n  }\n}\n","import type { ActorType, DelegationActClaim, OpenApeAuthorizationDetail } from '@openape/core'\nimport type { AuthorizeParams } from '@openape/auth'\nimport { defineEventHandler, getQuery, sendRedirect, useSession } from 'h3'\nimport { validateAuthorizeRequest } from '@openape/auth'\nimport { approveGrant, createGrant, useGrant, validateDelegation } from '@openape/grants'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\nimport { getSessionConfig } from './session.js'\n\nfunction parseAuthorizationDetails(raw: string | undefined): OpenApeAuthorizationDetail[] {\n  if (!raw) return []\n  try {\n    const parsed = JSON.parse(raw)\n    if (!Array.isArray(parsed)) return []\n    return parsed.filter(\n      (d: unknown): d is OpenApeAuthorizationDetail =>\n        typeof d === 'object'\n        && d !== null\n        && ['openape_grant', 'openape_cli'].includes(String((d as Record<string, unknown>).type ?? ''))\n        && typeof (d as Record<string, unknown>).action === 'string',\n    )\n  }\n  catch {\n    return []\n  }\n}\n\nexport function createAuthorizeHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const query = getQuery(event)\n\n    const params: AuthorizeParams = {\n      client_id: String(query.client_id ?? ''),\n      redirect_uri: String(query.redirect_uri ?? ''),\n      state: String(query.state ?? ''),\n      code_challenge: String(query.code_challenge ?? ''),\n      code_challenge_method: String(query.code_challenge_method ?? ''),\n      nonce: query.nonce ? String(query.nonce) : undefined,\n      response_type: String(query.response_type ?? ''),\n      scope: String(query.scope ?? ''),\n    }\n\n    const error = validateAuthorizeRequest(params)\n    if (error) {\n      if (params.redirect_uri) {\n        try {\n          const errorUrl = new URL(params.redirect_uri)\n          errorUrl.searchParams.set('error', 'invalid_request')\n          errorUrl.searchParams.set('error_description', error)\n          if (params.state) {\n            errorUrl.searchParams.set('state', params.state)\n          }\n          return sendRedirect(event, errorUrl.toString())\n        }\n        catch {\n          // Invalid redirect_uri — fall through to createProblemError\n        }\n      }\n      throw createProblemError({ status: 400, title: error })\n    }\n\n    // Try Bearer token first (CLI/agent flow)\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n\n    let userId: string\n    let actorType: ActorType | undefined\n    let delegationAct: DelegationActClaim | undefined\n    let delegationGrantId: string | undefined\n\n    const delegationGrantParam = String(query.delegation_grant ?? '')\n\n    if (bearerPayload) {\n      // Deactivation must also stop still-valid bearer tokens (#1144\n      // follow-up). Unknown identities pass — only an existing user\n      // with isActive === false is refused.\n      const bearerUser = await stores.userStore.findByEmail(bearerPayload.sub)\n      if (bearerUser && !bearerUser.isActive) {\n        throw createProblemError({ status: 403, title: 'User is inactive' })\n      }\n      if (delegationGrantParam) {\n        const grant = await validateDelegation(\n          delegationGrantParam,\n          bearerPayload.sub,\n          params.client_id,\n          stores.grantStore,\n        )\n        userId = grant.request.delegator!\n        delegationAct = { sub: bearerPayload.sub }\n        delegationGrantId = grant.id\n        await useGrant(grant.id, stores.grantStore)\n      }\n      else {\n        userId = bearerPayload.sub\n        actorType = bearerPayload.act === 'agent' ? 'agent' : undefined\n      }\n    }\n    else {\n      // Try session (browser flow)\n      const session = await useSession(event, getSessionConfig(config))\n\n      if (!session.data.userId) {\n        // No auth at all — redirect to login page\n        const returnTo = `/authorize?${new URLSearchParams(query as Record<string, string>).toString()}`\n        return sendRedirect(event, `/login?returnTo=${encodeURIComponent(returnTo)}`)\n      }\n\n      const sessionUserId = session.data.userId as string\n      const user = await stores.userStore.findByEmail(sessionUserId)\n      if (!user || !user.isActive) {\n        throw createProblemError({ status: 401, title: 'User not found or inactive' })\n      }\n\n      if (delegationGrantParam) {\n        const grant = await validateDelegation(\n          delegationGrantParam,\n          sessionUserId,\n          params.client_id,\n          stores.grantStore,\n        )\n        userId = grant.request.delegator!\n        delegationAct = { sub: sessionUserId }\n        delegationGrantId = grant.id\n        await useGrant(grant.id, stores.grantStore)\n      }\n      else {\n        userId = sessionUserId\n        actorType = user.type ?? (user.owner ? 'agent' : undefined)\n      }\n    }\n\n    // Delegation resolves userId to the delegator — a deactivated\n    // delegator must not have codes minted in their name either.\n    if (delegationGrantParam) {\n      const delegator = await stores.userStore.findByEmail(userId)\n      if (delegator && !delegator.isActive) {\n        throw createProblemError({ status: 403, title: 'User is inactive' })\n      }\n    }\n\n    // Parse and process authorization_details (RFC 9396)\n    const authzDetails = parseAuthorizationDetails(String(query.authorization_details ?? ''))\n    let approvedDetails: OpenApeAuthorizationDetail[] | undefined\n\n    if (authzDetails.length > 0) {\n      approvedDetails = []\n\n      for (const detail of authzDetails) {\n        const grant = await createGrant({\n          requester: bearerPayload ? bearerPayload.sub : userId,\n          target_host: params.client_id,\n          audience: params.client_id,\n          grant_type: detail.approval ?? 'once',\n          permissions: [detail.type === 'openape_cli' ? detail.permission : detail.action],\n          ...(detail.type === 'openape_cli' ? { authorization_details: [detail] } : {}),\n          reason: detail.reason,\n        }, stores.grantStore)\n\n        const approved = await approveGrant(grant.id, userId, stores.grantStore)\n        approvedDetails.push({\n          ...detail,\n          grant_id: approved.id,\n        })\n      }\n    }\n\n    const code = crypto.randomUUID()\n    await stores.codeStore.save({\n      code,\n      clientId: params.client_id,\n      redirectUri: params.redirect_uri,\n      codeChallenge: params.code_challenge,\n      userId,\n      nonce: params.nonce,\n      expiresAt: Date.now() + 60_000,\n      act: actorType,\n      scope: params.scope || undefined,\n      authorizationDetails: approvedDetails,\n      delegationAct,\n      delegationGrant: delegationGrantId,\n    })\n\n    const redirectUrl = new URL(params.redirect_uri)\n    redirectUrl.searchParams.set('code', code)\n    redirectUrl.searchParams.set('state', params.state)\n\n    return sendRedirect(event, redirectUrl.toString())\n  })\n}\n","import type { EventHandler } from 'h3'\nimport { defineEventHandler, getQuery, readBody, useSession } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyEd25519Signature } from '../utils/ed25519.js'\n\nconst IDP_SESSION_NAME = 'openape-idp'\nconst DEFAULT_SESSION_SECRET = 'default-secret-change-me-in-production!'\n\nexport function getSessionConfig(config: IdPConfig) {\n  return {\n    name: IDP_SESSION_NAME,\n    password: config.sessionSecret || DEFAULT_SESSION_SECRET,\n    cookie: {\n      httpOnly: true,\n      secure: config.issuer.startsWith('https://'),\n      sameSite: 'lax' as const,\n      maxAge: 60 * 60 * 24 * 7, // 7 days\n    },\n  }\n}\n\n/**\n * POST /api/session/login\n *\n * Headless session login: accepts { id, challenge, signature },\n * verifies the ed25519 signature, and sets a session cookie with { userId }.\n */\nexport function createSessionLoginHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const body = await readBody<{\n      id: string\n      challenge: string\n      signature: string\n      public_key?: string\n    }>(event)\n\n    if (!body.id || !body.challenge || !body.signature) {\n      throw createProblemError({ status: 400, title: 'Missing required fields: id, challenge, signature' })\n    }\n\n    const user = await stores.userStore.findByEmail(body.id)\n    if (!user) {\n      throw createProblemError({ status: 404, title: 'User not found' })\n    }\n    if (!user.isActive) {\n      throw createProblemError({ status: 403, title: 'User is inactive' })\n    }\n\n    // Determine which SSH key(s) to verify against\n    let keys\n    if (body.public_key) {\n      const sshKey = await stores.sshKeyStore.findByPublicKey(body.public_key)\n      if (!sshKey || sshKey.userEmail !== body.id) {\n        throw createProblemError({ status: 404, title: 'SSH key not found for this user' })\n      }\n      keys = [sshKey]\n    }\n    else {\n      keys = await stores.sshKeyStore.findByUser(body.id)\n      if (keys.length === 0) {\n        throw createProblemError({ status: 404, title: 'No SSH keys found for this user' })\n      }\n    }\n\n    // Consume challenge\n    const valid = await stores.challengeStore.consumeChallenge(body.challenge, body.id)\n    if (!valid) {\n      throw createProblemError({ status: 401, title: 'Invalid, expired, or already used challenge' })\n    }\n\n    // Try each registered key until one verifies\n    const signatureBuffer = Buffer.from(body.signature, 'base64')\n    let isValid = false\n    for (const key of keys) {\n      if (verifyEd25519Signature(key.publicKey, body.challenge, signatureBuffer)) {\n        isValid = true\n        break\n      }\n    }\n    if (!isValid) {\n      throw createProblemError({ status: 401, title: 'Invalid signature', type: 'https://ddisa.org/errors/invalid_token' })\n    }\n\n    // Set session cookie\n    const session = await useSession(event, getSessionConfig(config))\n    await session.update({ userId: user.email })\n\n    return { ok: true }\n  })\n}\n\n/**\n * POST /api/session/logout\n *\n * Clears the IdP session cookie.\n */\nexport function createSessionLogoutHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const session = await useSession(event, getSessionConfig(config))\n    await session.clear()\n    return { ok: true }\n  })\n}\n\n/**\n * GET /login\n *\n * Returns the returnTo parameter as JSON.\n * In a real app this would render a login form;\n * for headless/test usage it signals that login is required.\n */\nexport function createLoginPageHandler(): EventHandler {\n  return defineEventHandler((event) => {\n    const query = getQuery(event)\n    return { loginRequired: true, returnTo: query.returnTo || '/' }\n  })\n}\n","import type { H3Event } from 'h3'\nimport type { TokenExchangeParams } from '@openape/auth'\nimport { defineEventHandler, getRequestHeader, readRawBody, setResponseStatus } from 'h3'\nimport { handleRefreshGrant, handleTokenExchange, InactiveUserError, issueAssertion, validateClientAssertion } from '@openape/auth'\nimport { useGrant, validateDelegation } from '@openape/grants'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { sshEd25519ToKeyObject } from '../utils/ed25519.js'\nimport { issueAuthToken } from '../utils/auth-token.js'\n\nconst RE_WHITESPACE = /\\s+/\n\nfunction oauthError(event: H3Event, status: number, error: string, description: string) {\n  setResponseStatus(event, status)\n  return { error, error_description: description }\n}\n\nfunction parseScope(scope?: string): Set<string> {\n  if (!scope) return new Set()\n  return new Set(scope.split(RE_WHITESPACE).filter(Boolean))\n}\n\nfunction resolveUserClaimsFactory(stores: IdPStores) {\n  return async (userId: string, scope?: string) => {\n    const scopes = parseScope(scope)\n    const claims: { email?: string, name?: string } = {}\n\n    const includeAll = scopes.size === 0\n    const needsUser = includeAll || scopes.has('email') || scopes.has('profile')\n\n    if (needsUser) {\n      const user = await stores.userStore.findByEmail(userId)\n      if (user) {\n        if (includeAll || scopes.has('email')) {\n          claims.email = user.email\n        }\n        if (includeAll || scopes.has('profile')) {\n          claims.name = user.name\n        }\n      }\n    }\n\n    return claims\n  }\n}\n\nexport function createTokenHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const contentType = getRequestHeader(event, 'content-type') || ''\n    const rawBody = await readRawBody(event, 'utf-8') || ''\n\n    let body: Record<string, string>\n    if (contentType.includes('application/x-www-form-urlencoded')) {\n      body = Object.fromEntries(new URLSearchParams(rawBody))\n    }\n    else {\n      try {\n        body = JSON.parse(rawBody || '{}')\n      }\n      catch {\n        return oauthError(event, 400, 'invalid_request', 'Malformed request body')\n      }\n    }\n\n    const grantType = body.grant_type\n\n    if (grantType === 'client_credentials') {\n      return handleClientCredentialsGrant(event, body, stores, config)\n    }\n\n    if (grantType === 'refresh_token') {\n      return handleRefreshTokenGrant(event, body, stores, config)\n    }\n\n    if (grantType === 'authorization_code') {\n      return handleAuthorizationCodeGrant(event, body as unknown as TokenExchangeParams, stores, config)\n    }\n\n    return oauthError(event, 400, 'unsupported_grant_type', 'Grant type not supported')\n  })\n}\n\nasync function handleClientCredentialsGrant(\n  event: H3Event,\n  body: Record<string, string>,\n  stores: IdPStores,\n  config: IdPConfig,\n) {\n  const assertionType = body.client_assertion_type\n  const assertion = body.client_assertion\n  const delegationGrantParam = body.delegation_grant\n  const audience = body.audience\n\n  if (assertionType !== 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer') {\n    return oauthError(event, 400, 'invalid_request', 'Unsupported client_assertion_type')\n  }\n\n  if (!assertion) {\n    return oauthError(event, 400, 'invalid_request', 'Missing client_assertion')\n  }\n\n  try {\n    const { sub } = await validateClientAssertion(\n      assertion,\n      `${config.issuer}/token`,\n      async (userEmail) => {\n        const user = await stores.userStore.findByEmail(userEmail)\n        if (!user || !user.isActive) return null\n        // Look up SSH key for this user\n        const keys = await stores.sshKeyStore.findByUser(userEmail)\n        if (keys.length === 0) return null\n        return sshEd25519ToKeyObject(keys[0]!.publicKey)\n      },\n      stores.jtiStore,\n    )\n\n    // Delegation flow\n    if (delegationGrantParam) {\n      if (!audience) {\n        return oauthError(event, 400, 'invalid_request', 'Missing audience for delegation')\n      }\n\n      const grant = await validateDelegation(delegationGrantParam, sub, audience, stores.grantStore)\n      await useGrant(grant.id, stores.grantStore)\n\n      const token = await issueAssertion(\n        {\n          sub: grant.request.delegator!,\n          aud: audience,\n          nonce: crypto.randomUUID(),\n          delegation_act: { sub },\n          delegation_grant: grant.id,\n          // Mirror the grant's scopes into the assertion (grants.md §6.1,\n          // protocol#6). Fail-closed: legacy grants without scopes yield\n          // `scope: []` — a delegated token must always state its own limits,\n          // and [] means \"nothing allowed\", not \"everything allowed\".\n          scope: grant.request.scopes ?? [],\n        },\n        stores.keyStore,\n        config.issuer,\n      )\n\n      return {\n        access_token: token,\n        token_type: 'Bearer',\n        expires_in: 300,\n      }\n    }\n\n    // Standard agent token\n    const signingKey = await stores.keyStore.getSigningKey()\n    const token = await issueAuthToken(\n      { sub, act: 'agent' },\n      config.issuer,\n      signingKey.privateKey,\n      signingKey.kid,\n    )\n\n    return {\n      access_token: token,\n      token_type: 'Bearer',\n      expires_in: 3600,\n    }\n  }\n  catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Client credentials authentication failed'\n    return oauthError(event, 401, 'invalid_client', message)\n  }\n}\n\nasync function handleRefreshTokenGrant(\n  event: H3Event,\n  body: Record<string, string>,\n  stores: IdPStores,\n  config: IdPConfig,\n) {\n  const refreshToken = body.refresh_token\n  const clientId = body.client_id\n\n  if (!refreshToken) {\n    return oauthError(event, 400, 'invalid_request', 'Missing refresh_token')\n  }\n\n  if (!clientId) {\n    return oauthError(event, 400, 'invalid_request', 'Missing client_id')\n  }\n\n  try {\n    const result = await handleRefreshGrant(\n      refreshToken,\n      clientId,\n      stores.refreshTokenStore,\n      stores.keyStore,\n      config.issuer,\n      resolveUserClaimsFactory(stores),\n      // Deactivation invalidates existing refresh tokens (#1144 follow-up).\n      // Unknown identities pass — only an existing user with\n      // isActive === false is refused.\n      async (userId) => {\n        const user = await stores.userStore.findByEmail(userId)\n        return !user || user.isActive\n      },\n    )\n    return result\n  }\n  catch (err: unknown) {\n    if (err instanceof InactiveUserError) {\n      return oauthError(event, 403, 'invalid_grant', err.message)\n    }\n    const message = err instanceof Error ? err.message : 'Refresh token exchange failed'\n    return oauthError(event, 400, 'invalid_grant', message)\n  }\n}\n\nasync function handleAuthorizationCodeGrant(\n  event: H3Event,\n  body: TokenExchangeParams,\n  stores: IdPStores,\n  config: IdPConfig,\n) {\n  if (!body.grant_type || !body.code || !body.code_verifier || !body.redirect_uri || !body.client_id) {\n    return oauthError(event, 400, 'invalid_request', 'Missing required fields: grant_type, code, code_verifier, redirect_uri, client_id')\n  }\n\n  try {\n    const result = await handleTokenExchange(\n      body,\n      stores.codeStore,\n      stores.keyStore,\n      config.issuer,\n      resolveUserClaimsFactory(stores),\n      stores.refreshTokenStore,\n    )\n    return result\n  }\n  catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Token exchange failed'\n    return oauthError(event, 400, 'invalid_grant', message)\n  }\n}\n","import { defineEventHandler, setResponseHeader } from 'h3'\nimport { exportJWK } from 'jose'\nimport type { IdPStores } from '../config.js'\n\nexport function createJWKSHandler(stores: IdPStores) {\n  return defineEventHandler(async (event) => {\n    // Override the default no-store with a cacheable policy for public keys\n    setResponseHeader(event, 'Cache-Control', 'public, max-age=3600')\n\n    const entries = await stores.keyStore.getAllPublicKeys()\n    const keys = await Promise.all(\n      entries.map(async (entry) => {\n        const jwk = await exportJWK(entry.publicKey)\n        return { ...jwk, kid: entry.kid, alg: 'EdDSA', use: 'sig' }\n      }),\n    )\n    return { keys }\n  })\n}\n","import { defineEventHandler, setResponseHeader } from 'h3'\nimport type { IdPConfig } from '../config.js'\n\nexport function createDiscoveryHandler(config: IdPConfig) {\n  return defineEventHandler((event) => {\n    // Override the default no-store with a cacheable policy for discovery metadata\n    setResponseHeader(event, 'Cache-Control', 'public, max-age=3600')\n    const issuer = config.issuer\n\n    return {\n      issuer,\n      authorization_endpoint: `${issuer}/authorize`,\n      token_endpoint: `${issuer}/token`,\n      userinfo_endpoint: `${issuer}/userinfo`,\n      jwks_uri: `${issuer}/.well-known/jwks.json`,\n      response_types_supported: ['code'],\n      revocation_endpoint: `${issuer}/revoke`,\n      grant_types_supported: ['authorization_code', 'client_credentials', 'refresh_token'],\n      subject_types_supported: ['public'],\n      id_token_signing_alg_values_supported: ['EdDSA'],\n      token_endpoint_auth_methods_supported: ['none', 'private_key_jwt'],\n      token_endpoint_auth_signing_alg_values_supported: ['EdDSA'],\n      code_challenge_methods_supported: ['S256'],\n      scopes_supported: ['openid', 'email', 'profile', 'offline_access'],\n      claims_supported: ['sub', 'iss', 'aud', 'exp', 'iat', 'nonce', 'act', 'email', 'name', 'authorization_details', 'delegation_grant'],\n      authorization_details_types_supported: ['openape_grant', 'openape_cli'],\n\n      // DDISA extensions\n      ddisa_version: '1.0',\n      ddisa_auth_methods_supported: ['ed25519', 'ssh-key'],\n      ddisa_auth_challenge_endpoint: `${issuer}/api/auth/challenge`,\n      ddisa_auth_authenticate_endpoint: `${issuer}/api/auth/authenticate`,\n\n      // OpenApe extensions\n      openape_grants_endpoint: `${issuer}/api/grants`,\n      openape_delegations_endpoint: `${issuer}/api/delegations`,\n      openape_grant_types_supported: ['once', 'timed', 'always'],\n      openape_grant_categories_supported: ['command', 'delegation'],\n    }\n  })\n}\n","import type { GrantStatus, GrantType, OpenApeGrantRequest, ProblemDetails } from '@openape/core'\nimport type { ApproveGrantOverrides } from '@openape/grants'\nimport { approveGrant, createGrant, denyGrant, introspectGrant, issueAuthzJWT, revokeGrant, useGrant, verifyAuthzJWT } from '@openape/grants'\nimport { defineEventHandler, getHeader, getQuery, getRequestHeader, getRouterParam, readBody, setResponseHeader, setResponseStatus } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\nimport { hasManagementToken } from './admin.js'\n\nconst VALID_GRANT_TYPES: GrantType[] = ['once', 'timed', 'always']\n\nfunction requireBearerIdentity(payload: { sub: string } | null): string {\n  if (!payload) {\n    throw createProblemError({ status: 401, title: 'Bearer token required' })\n  }\n  return payload.sub\n}\n\nfunction requireManagementOrBearer(\n  event: import('h3').H3Event,\n  config: IdPConfig,\n  bearerPayload: { sub: string } | null,\n): string {\n  if (hasManagementToken(event, config)) {\n    return '_management_'\n  }\n  return requireBearerIdentity(bearerPayload)\n}\n\n// --- List Grants ---\nexport function createListGrantsHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const query = getQuery(event)\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n\n    const limit = Math.min(Math.max(Number(query.limit) || 20, 1), 100)\n    const cursor = query.cursor ? String(query.cursor) : undefined\n    const status = query.status ? String(query.status) as GrantStatus : undefined\n    const requester = query.requester ? String(query.requester) : undefined\n\n    if (requester) {\n      return stores.grantStore.listGrants({ limit, cursor, status, requester })\n    }\n\n    const identity = requireBearerIdentity(bearerPayload)\n\n    // Get self + owned agents → single IN query\n    const ownedUsers = await stores.userStore.findByOwner(identity)\n    const requesters = [identity, ...ownedUsers.map(u => u.email)]\n\n    return stores.grantStore.listGrants({ limit, cursor, status, requester: requesters })\n  })\n}\n\n// --- Create Grant ---\nexport function createCreateGrantHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const body = await readBody<OpenApeGrantRequest>(event)\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n\n    if (bearerPayload) {\n      body.requester = bearerPayload.sub\n    }\n\n    if (!body.requester || !body.target_host || !body.audience) {\n      throw createProblemError({ status: 400, title: 'Missing required fields: requester, target_host, audience' })\n    }\n\n    if (!body.grant_type) {\n      body.grant_type = 'once'\n    }\n\n    if (!VALID_GRANT_TYPES.includes(body.grant_type)) {\n      throw createProblemError({ status: 400, title: `Invalid grant_type. Must be one of: ${VALID_GRANT_TYPES.join(', ')}` })\n    }\n\n    if (body.grant_type === 'timed' && !body.duration) {\n      throw createProblemError({ status: 400, title: 'Duration is required for timed grants' })\n    }\n\n    const grant = await createGrant(body, stores.grantStore)\n    setResponseStatus(event, 201)\n    return grant\n  })\n}\n\n// --- Get Grant ---\nexport function createGetGrantHandler(stores: IdPStores) {\n  return defineEventHandler(async (event) => {\n    const id = getRouterParam(event, 'id')!\n\n    const grant = await introspectGrant(id, stores.grantStore)\n    if (!grant) {\n      throw createProblemError({ status: 404, title: 'Grant not found' })\n    }\n\n    const etag = `W/\"${grant.status}:${grant.decided_at || grant.created_at}\"`\n    setResponseHeader(event, 'ETag', etag)\n\n    const ifNoneMatch = getRequestHeader(event, 'if-none-match')\n    if (ifNoneMatch === etag) {\n      setResponseStatus(event, 304)\n      return ''\n    }\n\n    return grant\n  })\n}\n\n// --- Approve Grant ---\nexport function createApproveGrantHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const id = getRouterParam(event, 'id')!\n\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const email = requireManagementOrBearer(event, config, bearerPayload)\n\n    const body = await readBody(event).catch(() => ({})) as Record<string, unknown>\n\n    if (body.grant_type !== undefined) {\n      if (!VALID_GRANT_TYPES.includes(body.grant_type as GrantType)) {\n        throw createProblemError({ status: 400, title: `Invalid grant_type. Must be one of: ${VALID_GRANT_TYPES.join(', ')}` })\n      }\n      if (body.grant_type === 'timed' && (!body.duration || typeof body.duration !== 'number' || body.duration <= 0)) {\n        throw createProblemError({ status: 400, title: 'Duration must be a positive number for timed grants' })\n      }\n    }\n\n    const grant = await stores.grantStore.findById(id)\n    if (!grant) {\n      throw createProblemError({ status: 404, title: 'Grant not found' })\n    }\n\n    // Authorize: requester can self-approve, or owner/approver of the requester's agent\n    if (email !== '_management_') {\n      const isRequester = grant.request.requester === email\n      if (!isRequester) {\n        const requesterUser = await stores.userStore.findByEmail(grant.request.requester)\n        if (!requesterUser) {\n          throw createProblemError({ status: 403, title: 'Requester user not found for this grant' })\n        }\n        const isOwnerOrApprover = requesterUser.owner === email || requesterUser.approver === email\n        if (!isOwnerOrApprover) {\n          throw createProblemError({ status: 403, title: 'Only the requester, owner, or approver can approve this grant' })\n        }\n      }\n    }\n\n    try {\n      const overrides: ApproveGrantOverrides | undefined = body.grant_type\n        ? { grant_type: body.grant_type as GrantType, duration: body.duration as number | undefined }\n        : undefined\n      const approved = await approveGrant(id, email, stores.grantStore, overrides)\n\n      const signingKey = await stores.keyStore.getSigningKey()\n      const authzJwt = await issueAuthzJWT(approved, config.issuer, signingKey.privateKey, signingKey.kid)\n      return { grant: approved, authz_jwt: authzJwt }\n    }\n    catch (err: unknown) {\n      if (err && typeof err === 'object' && 'statusCode' in err) throw err\n      const message = err instanceof Error ? err.message : 'Failed to approve grant'\n      throw createProblemError({ status: 400, title: message })\n    }\n  })\n}\n\n// --- Deny Grant ---\nexport function createDenyGrantHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const id = getRouterParam(event, 'id')!\n\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const email = requireManagementOrBearer(event, config, bearerPayload)\n\n    const grant = await stores.grantStore.findById(id)\n    if (!grant) {\n      throw createProblemError({ status: 404, title: 'Grant not found' })\n    }\n\n    if (email !== '_management_') {\n      const isRequester = grant.request.requester === email\n      if (!isRequester) {\n        const requesterUser = await stores.userStore.findByEmail(grant.request.requester)\n        if (!requesterUser) {\n          throw createProblemError({ status: 403, title: 'Requester user not found for this grant' })\n        }\n        const isOwnerOrApprover = requesterUser.owner === email || requesterUser.approver === email\n        if (!isOwnerOrApprover) {\n          throw createProblemError({ status: 403, title: 'Only the requester, owner, or approver can deny this grant' })\n        }\n      }\n    }\n\n    try {\n      const denied = await denyGrant(id, email, stores.grantStore)\n      return denied\n    }\n    catch (err: unknown) {\n      const message = err instanceof Error ? err.message : 'Failed to deny grant'\n      throw createProblemError({ status: 400, title: message })\n    }\n  })\n}\n\n// --- Revoke Grant ---\nexport function createRevokeGrantHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const id = getRouterParam(event, 'id')!\n\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const identity = requireManagementOrBearer(event, config, bearerPayload)\n\n    const grant = await stores.grantStore.findById(id)\n    if (!grant) {\n      throw createProblemError({ status: 404, title: 'Grant not found' })\n    }\n\n    if (identity !== '_management_') {\n      const isRequester = grant.request.requester === identity\n      if (!isRequester) {\n        const requesterUser = await stores.userStore.findByEmail(grant.request.requester)\n        const isApprover = requesterUser && requesterUser.approver === identity\n        const isAdmin = config.adminEmails?.includes(identity)\n        if (!isApprover && !isAdmin) {\n          throw createProblemError({ status: 403, title: 'Only the requester, approver, or admin can revoke this grant' })\n        }\n      }\n    }\n\n    try {\n      const revoked = await revokeGrant(id, stores.grantStore)\n      return revoked\n    }\n    catch (err: unknown) {\n      const message = err instanceof Error ? err.message : 'Failed to revoke grant'\n      throw createProblemError({ status: 400, title: message })\n    }\n  })\n}\n\n// --- Grant Token ---\nexport function createGrantTokenHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const identity = requireBearerIdentity(bearerPayload)\n\n    const id = getRouterParam(event, 'id')!\n\n    const grant = await introspectGrant(id, stores.grantStore)\n    if (!grant) {\n      throw createProblemError({ status: 404, title: 'Grant not found' })\n    }\n\n    if (grant.request.requester !== identity) {\n      throw createProblemError({ status: 403, title: 'Grant does not belong to this identity' })\n    }\n\n    if (grant.status !== 'approved') {\n      throw createProblemError({ status: 400, title: `Grant is not approved (status: ${grant.status})` })\n    }\n\n    const signingKey = await stores.keyStore.getSigningKey()\n    const authzJwt = await issueAuthzJWT(grant, config.issuer, signingKey.privateKey, signingKey.kid)\n\n    return { authz_jwt: authzJwt, grant }\n  })\n}\n\n// --- Consume Grant ---\nexport function createConsumeGrantHandler(stores: IdPStores) {\n  return defineEventHandler(async (event) => {\n    const id = getRouterParam(event, 'id')!\n\n    const authHeader = getHeader(event, 'authorization')\n    if (!authHeader?.startsWith('Bearer ')) {\n      throw createProblemError({ status: 401, title: 'Missing or invalid Authorization header' })\n    }\n    const token = authHeader.slice(7)\n\n    const signingKey = await stores.keyStore.getSigningKey()\n    const result = await verifyAuthzJWT(token, {\n      publicKey: signingKey.publicKey,\n    })\n\n    if (!result.valid) {\n      throw createProblemError({ status: 401, title: `Invalid grant token: ${result.error}` })\n    }\n\n    if (result.claims?.grant_id !== id) {\n      throw createProblemError({ status: 400, title: 'Grant ID in token does not match URL' })\n    }\n\n    const grant = await introspectGrant(id, stores.grantStore)\n    if (!grant) {\n      throw createProblemError({ status: 404, title: 'Grant not found' })\n    }\n\n    switch (grant.status) {\n      case 'used':\n        return { error: 'already_consumed', status: grant.status }\n      case 'revoked':\n        return { error: 'revoked', status: grant.status }\n      case 'denied':\n        return { error: 'denied', status: grant.status }\n      case 'expired':\n        return { error: 'expired', status: grant.status }\n      case 'pending':\n        return { error: 'not_approved', status: grant.status }\n    }\n\n    if (grant.request.grant_type === 'once') {\n      const used = await useGrant(id, stores.grantStore)\n      return { status: 'consumed', grant: used }\n    }\n\n    return { status: 'valid', grant }\n  })\n}\n\n// --- Batch ---\ninterface BatchOperation {\n  id: string\n  action: 'approve' | 'deny' | 'revoke'\n  grant_type?: GrantType\n  duration?: number\n}\n\ninterface BatchResult {\n  id: string\n  status: string\n  success: boolean\n  error?: ProblemDetails\n}\n\nexport function createBatchGrantHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const email = requireManagementOrBearer(event, config, bearerPayload)\n\n    const body = await readBody<{ operations: BatchOperation[] }>(event)\n\n    if (!body?.operations || !Array.isArray(body.operations) || body.operations.length === 0) {\n      throw createProblemError({ status: 400, title: 'Missing or empty operations array' })\n    }\n\n    const results: BatchResult[] = []\n    let hasError = false\n\n    for (const item of body.operations) {\n      try {\n        let grant\n        switch (item.action) {\n          case 'approve': {\n            const overrides: ApproveGrantOverrides | undefined = item.grant_type\n              ? { grant_type: item.grant_type, duration: item.duration }\n              : undefined\n            grant = await approveGrant(item.id, email, stores.grantStore, overrides)\n            break\n          }\n          case 'deny':\n            grant = await denyGrant(item.id, email, stores.grantStore)\n            break\n          case 'revoke':\n            grant = await revokeGrant(item.id, stores.grantStore)\n            break\n          default:\n            throw new Error(`Invalid action: ${(item as { action: string }).action}`)\n        }\n        results.push({ id: item.id, status: grant.status, success: true })\n      }\n      catch (err) {\n        hasError = true\n        results.push({\n          id: item.id,\n          status: 'error',\n          success: false,\n          error: {\n            type: 'https://openape.org/errors/grant_already_decided',\n            title: err instanceof Error ? err.message : 'Operation failed',\n            status: 400,\n          },\n        })\n      }\n    }\n\n    if (hasError) {\n      setResponseStatus(event, 207)\n    }\n\n    return { results }\n  })\n}\n\n// --- Verify AuthZ-JWT ---\nexport function createVerifyGrantHandler(stores: IdPStores, _config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const body = await readBody<{ token: string }>(event)\n\n    if (!body?.token) {\n      return { valid: false, error: 'Missing token' }\n    }\n\n    const signingKey = await stores.keyStore.getSigningKey()\n    const result = await verifyAuthzJWT(body.token, {\n      publicKey: signingKey.publicKey,\n    })\n\n    if (!result.valid) {\n      return { valid: false, error: result.error }\n    }\n\n    const grantId = result.claims?.grant_id\n    if (!grantId) {\n      return { valid: false, error: 'Missing grant_id in token' }\n    }\n\n    const grant = await introspectGrant(grantId, stores.grantStore)\n    if (!grant) {\n      return { valid: false, error: 'Grant not found' }\n    }\n\n    if (grant.status !== 'approved') {\n      return { valid: false, error: `Grant is not approved (status: ${grant.status})` }\n    }\n\n    if (grant.request.grant_type === 'once') {\n      const used = await useGrant(grantId, stores.grantStore)\n      return { valid: true, claims: result.claims, grant: used }\n    }\n\n    return { valid: true, claims: result.claims, grant }\n  })\n}\n","import type { GrantType } from '@openape/core'\nimport { createDelegation, revokeGrant, validateDelegation } from '@openape/grants'\nimport { defineEventHandler, getQuery, getRouterParam, readBody, setResponseStatus } from 'h3'\nimport type { IdPConfig, IdPStores } from '../config.js'\nimport { createProblemError } from '../utils/problem.js'\nimport { verifyBearerAuth } from '../utils/bearer-auth.js'\n\nconst VALID_GRANT_TYPES: GrantType[] = ['once', 'timed', 'always']\n\nfunction requireHumanBearer(payload: { sub: string, act: string } | null): string {\n  if (!payload) {\n    throw createProblemError({ status: 401, title: 'Bearer token required' })\n  }\n  if (payload.act !== 'human') {\n    throw createProblemError({ status: 403, title: 'Only human users may create delegations' })\n  }\n  return payload.sub\n}\n\nfunction requireBearer(payload: { sub: string } | null): string {\n  if (!payload) {\n    throw createProblemError({ status: 401, title: 'Bearer token required' })\n  }\n  return payload.sub\n}\n\n// --- Create Delegation ---\nexport function createCreateDelegationHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const delegator = requireHumanBearer(bearerPayload)\n\n    const body = await readBody(event)\n\n    if (!body?.delegate || typeof body.delegate !== 'string') {\n      throw createProblemError({ status: 400, title: 'Missing delegate' })\n    }\n    if (!body?.audience || typeof body.audience !== 'string') {\n      throw createProblemError({ status: 400, title: 'Missing audience' })\n    }\n\n    const grantType = body.grant_type || 'once'\n    if (!VALID_GRANT_TYPES.includes(grantType)) {\n      throw createProblemError({ status: 400, title: `Invalid grant_type. Must be one of: ${VALID_GRANT_TYPES.join(', ')}` })\n    }\n\n    if (grantType === 'timed' && (!body.duration || typeof body.duration !== 'number')) {\n      throw createProblemError({ status: 400, title: 'Duration is required for timed grants' })\n    }\n\n    const grant = await createDelegation({\n      delegator,\n      delegate: body.delegate,\n      audience: body.audience,\n      scopes: Array.isArray(body.scopes) ? body.scopes : undefined,\n      grant_type: grantType,\n      duration: typeof body.duration === 'number' ? body.duration : undefined,\n    }, stores.grantStore)\n\n    setResponseStatus(event, 201)\n    return grant\n  })\n}\n\n// --- List Delegations ---\nexport function createListDelegationsHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const email = requireBearer(bearerPayload)\n\n    const query = getQuery(event)\n    const role = query.role as string | undefined\n    const search = query.search as string | undefined\n    const cursor = query.cursor as string | undefined\n    const queryLimit = query.limit ? Number(query.limit) : undefined\n\n    const grantStore = stores.grantStore\n\n    let delegations: import('@openape/core').OpenApeGrant[]\n\n    if (role === 'delegator') {\n      if (!grantStore.findByDelegator) {\n        throw createProblemError({ status: 501, title: 'Delegation queries not supported by this store' })\n      }\n      delegations = await grantStore.findByDelegator(email)\n    }\n    else if (role === 'delegate') {\n      if (!grantStore.findByDelegate) {\n        throw createProblemError({ status: 501, title: 'Delegation queries not supported by this store' })\n      }\n      delegations = await grantStore.findByDelegate(email)\n    }\n    else {\n      // No role filter: return all delegations for this user (as delegator or delegate)\n      const [asDelegator, asDelegate] = await Promise.all([\n        grantStore.findByDelegator ? grantStore.findByDelegator(email) : [],\n        grantStore.findByDelegate ? grantStore.findByDelegate(email) : [],\n      ])\n\n      const seen = new Set<string>()\n      delegations = []\n      for (const grant of [...asDelegator, ...asDelegate]) {\n        if (!seen.has(grant.id)) {\n          seen.add(grant.id)\n          delegations.push(grant)\n        }\n      }\n    }\n\n    // Sort by created_at DESC\n    delegations.sort((a, b) => b.created_at - a.created_at)\n\n    // Search filter\n    if (search) {\n      const q = search.toLowerCase()\n      delegations = delegations.filter(g =>\n        g.request.delegator?.toLowerCase().includes(q)\n        || g.request.delegate?.toLowerCase().includes(q)\n        || g.request.audience?.toLowerCase().includes(q),\n      )\n    }\n\n    // Cursor pagination (cursor = grant ID)\n    if (cursor) {\n      const idx = delegations.findIndex(g => g.id === cursor)\n      if (idx >= 0) delegations = delegations.slice(idx + 1)\n    }\n\n    const limit = Math.min(Math.max(queryLimit ?? 50, 1), 100)\n    const hasMore = delegations.length > limit\n    const data = delegations.slice(0, limit)\n\n    return {\n      data,\n      pagination: {\n        cursor: data.length > 0 ? data.at(-1)!.id : null,\n        has_more: hasMore,\n      },\n    }\n  })\n}\n\n// --- Revoke Delegation ---\nexport function createRevokeDelegationHandler(stores: IdPStores, config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const bearerPayload = await verifyBearerAuth(event, stores.keyStore, config.issuer)\n    const email = requireBearer(bearerPayload)\n\n    const id = getRouterParam(event, 'id')\n    if (!id) {\n      throw createProblemError({ status: 400, title: 'Missing delegation ID' })\n    }\n\n    const grant = await stores.grantStore.findById(id)\n    if (!grant || grant.type !== 'delegation') {\n      throw createProblemError({ status: 404, title: 'Delegation not found' })\n    }\n\n    // Only the delegator can revoke their own delegation\n    if (grant.request.delegator !== email) {\n      throw createProblemError({ status: 403, title: 'Not authorized to revoke this delegation' })\n    }\n\n    try {\n      const revoked = await revokeGrant(id, stores.grantStore)\n      return revoked\n    }\n    catch (err: unknown) {\n      const message = err instanceof Error ? err.message : 'Failed to revoke delegation'\n      throw createProblemError({ status: 400, title: message })\n    }\n  })\n}\n\n// --- Validate Delegation ---\nexport function createValidateDelegationHandler(stores: IdPStores, _config: IdPConfig) {\n  return defineEventHandler(async (event) => {\n    const id = getRouterParam(event, 'id')\n    if (!id) {\n      throw createProblemError({ status: 400, title: 'Missing delegation ID' })\n    }\n\n    const body = await readBody<{ delegate: string, audience: string }>(event)\n    if (!body?.delegate || !body?.audience) {\n      throw createProblemError({ status: 400, title: 'Missing delegate or audience' })\n    }\n\n    try {\n      const grant = await validateDelegation(id, body.delegate, body.audience, stores.grantStore)\n      return {\n        valid: true,\n        delegation: grant,\n        scopes: grant.request.scopes || [],\n      }\n    }\n    catch (err) {\n      return {\n        valid: false,\n        error: err instanceof Error ? err.message : 'Delegation validation failed',\n      }\n    }\n  })\n}\n","import { defineEventHandler, setResponseHeaders } from 'h3'\n\nexport function createSecurityHeadersMiddleware() {\n  return defineEventHandler((event) => {\n    setResponseHeaders(event, {\n      'X-Content-Type-Options': 'nosniff',\n      'X-Frame-Options': 'DENY',\n      'Content-Security-Policy': 'frame-ancestors \\'none\\'',\n      'X-XSS-Protection': '0',\n      'Referrer-Policy': 'strict-origin-when-cross-origin',\n      'Cache-Control': 'no-store',\n    })\n  })\n}\n","import { defineEventHandler, getRequestIP, getRequestURL } from 'h3'\nimport { createProblemError } from '../utils/problem.js'\n\ninterface RateLimitEntry {\n  count: number\n  resetAt: number\n}\n\nexport interface RateLimitConfig {\n  /** Max requests per window (default: 10) */\n  maxRequests?: number\n  /** Window duration in ms (default: 60000 = 1 minute) */\n  windowMs?: number\n  /** Paths to rate-limit (default: auth endpoints) */\n  paths?: string[]\n}\n\nexport function createRateLimitMiddleware(config: RateLimitConfig = {}) {\n  const maxRequests = config.maxRequests ?? 10\n  const windowMs = config.windowMs ?? 60_000\n  const paths = config.paths ?? [\n    '/api/auth/challenge',\n    '/api/auth/authenticate',\n    '/api/auth/enroll',\n    '/api/session/login',\n    '/api/agent/challenge',\n    '/api/agent/authenticate',\n  ]\n\n  const store = new Map<string, RateLimitEntry>()\n\n  // Cleanup expired entries periodically\n  const cleanup = setInterval(() => {\n    const now = Date.now()\n    for (const [key, entry] of store) {\n      if (entry.resetAt <= now) store.delete(key)\n    }\n  }, windowMs)\n  cleanup.unref()\n\n  return defineEventHandler((event) => {\n    const path = getRequestURL(event).pathname\n    if (!paths.includes(path)) return\n\n    const ip = getRequestIP(event, { xForwardedFor: true }) || 'unknown'\n    const key = `${ip}:${path}`\n    const now = Date.now()\n\n    let entry = store.get(key)\n    if (!entry || entry.resetAt <= now) {\n      entry = { count: 0, resetAt: now + windowMs }\n      store.set(key, entry)\n    }\n\n    entry.count++\n\n    event.node.res.setHeader('X-RateLimit-Limit', maxRequests.toString())\n    event.node.res.setHeader('X-RateLimit-Remaining', Math.max(0, maxRequests - entry.count).toString())\n    event.node.res.setHeader('X-RateLimit-Reset', Math.ceil(entry.resetAt / 1000).toString())\n\n    if (entry.count > maxRequests) {\n      throw createProblemError({\n        status: 429,\n        title: 'Too many requests',\n        detail: `Rate limit exceeded. Try again in ${Math.ceil((entry.resetAt - now) / 1000)} seconds.`,\n      })\n    }\n  })\n}\n","import { defineEventHandler } from 'h3'\nimport { createProblemError } from '../utils/problem.js'\n\nexport function createBodyLimitMiddleware(maxBytes: number = 100_000) {\n  return defineEventHandler((event) => {\n    const contentLength = event.node.req.headers['content-length']\n    if (contentLength && Number.parseInt(contentLength) > maxBytes) {\n      throw createProblemError({\n        status: 413,\n        title: 'Request body too large',\n        detail: `Content-Length ${contentLength} exceeds maximum of ${maxBytes} bytes.`,\n      })\n    }\n  })\n}\n","import { WELL_KNOWN_OAUTH_CLIENT_METADATA } from '@openape/core'\nimport { createApp, createRouter } from 'h3'\nimport type { SPConfig, SPInstance } from './config.js'\nimport { createApiCallbackHandler } from './handlers/api-callback.js'\nimport { createApiGrantCallbackHandler } from './handlers/api-grant-callback.js'\nimport { createApiGrantStatusHandler } from './handlers/api-grant-status.js'\nimport { createApiLoginHandler } from './handlers/api-login.js'\nimport { createApiMeHandler } from './handlers/api-me.js'\nimport { createApiProtectedActionHandler } from './handlers/api-protected-action.js'\nimport { createApiRequestPermissionHandler } from './handlers/api-request-permission.js'\nimport { createCallbackHandler } from './handlers/callback.js'\nimport { createLoginHandler } from './handlers/login.js'\nimport { createMeHandler } from './handlers/me.js'\nimport { createMetadataHandler } from './handlers/metadata.js'\n\nexport function createSPApp(config: SPConfig): SPInstance {\n  const app = createApp()\n  const router = createRouter()\n\n  // Original headless routes (JSON-based sessions)\n  router.get('/login', createLoginHandler(config))\n  router.get('/callback', createCallbackHandler(config))\n  router.get('/me', createMeHandler())\n  router.get(WELL_KNOWN_OAUTH_CLIENT_METADATA, createMetadataHandler(config))\n\n  // Nuxt-compatible API routes (cookie-based sessions, redirect-based callback)\n  router.post('/api/login', createApiLoginHandler(config))\n  router.get('/api/callback', createApiCallbackHandler(config))\n  router.get('/api/me', createApiMeHandler())\n\n  // Grant-related SP routes (used by grant-rerequest E2E test)\n  router.post('/api/request-permission', createApiRequestPermissionHandler(config))\n  router.get('/api/grant-callback', createApiGrantCallbackHandler())\n  router.post('/api/protected-action', createApiProtectedActionHandler(config))\n  router.get('/api/grant-status', createApiGrantStatusHandler())\n\n  app.use(router)\n  return { app }\n}\n","import type { EventHandler } from 'h3'\nimport { handleCallback } from '@openape/auth'\nimport { defineEventHandler, getQuery, getRequestURL, sendRedirect, useSession } from 'h3'\nimport type { SPConfig } from '../config.js'\nimport { clearFlowState, getFlowState, SESSION_SECRET } from './api-login.js'\n\nconst SP_SESSION_NAME = 'openape-sp'\n\nexport function createApiCallbackHandler(config: SPConfig): EventHandler {\n  return defineEventHandler(async (event) => {\n    const query = getQuery(event)\n    const { code, state, error, error_description } = query as Record<string, string>\n    const origin = getRequestURL(event).origin\n    const redirectUri = `${origin}/api/callback`\n\n    if (error) {\n      const msg = error_description || error\n      return sendRedirect(event, `/?error=${encodeURIComponent(msg)}`)\n    }\n\n    if (!code || !state) {\n      return sendRedirect(event, `/?error=${encodeURIComponent('Invalid or expired state — please try again')}`)\n    }\n\n    const flowState = await getFlowState(event, state)\n    if (!flowState) {\n      return sendRedirect(event, `/?error=${encodeURIComponent('Invalid or expired state — please try again')}`)\n    }\n\n    try {\n      const result = await handleCallback({\n        code,\n        state,\n        flowState,\n        clientId: config.clientId,\n        redirectUri,\n      })\n\n      await clearFlowState(event)\n\n      // Store claims in session cookie\n      const session = await useSession(event, {\n        name: SP_SESSION_NAME,\n        password: SESSION_SECRET,\n      })\n      await session.update({\n        claims: result.claims,\n        authorizationDetails: result.authorizationDetails,\n      })\n\n      return sendRedirect(event, '/dashboard')\n    }\n    catch (err: unknown) {\n      await clearFlowState(event)\n      const message = err instanceof Error ? err.message : 'Callback processing failed'\n      return sendRedirect(event, `/?error=${encodeURIComponent(message)}`)\n    }\n  })\n}\n\nexport { SP_SESSION_NAME }\n","import type { AuthFlowState } from '@openape/core'\nimport type { EventHandler } from 'h3'\nimport { createAuthorizationURL, discoverIdP } from '@openape/auth'\nimport { createError, defineEventHandler, getRequestURL, readBody, useSession } from 'h3'\nimport type { SPConfig } from '../config.js'\n\nconst FLOW_COOKIE = 'openape-flow'\nconst SESSION_SECRET = 'e2e-test-session-secret-at-least-32-chars!'\n\nexport function createApiLoginHandler(config: SPConfig): EventHandler {\n  return defineEventHandler(async (event) => {\n    const body = await readBody<{ email: string }>(event)\n    const origin = getRequestURL(event).origin\n    const redirectUri = `${origin}/api/callback`\n\n    if (!body?.email || !body.email.includes('@')) {\n      throw createError({ statusCode: 400, statusMessage: 'Valid email required' })\n    }\n\n    const email = body.email.trim()\n\n    const idpConfig = await discoverIdP(email, config.resolverOptions)\n    if (!idpConfig) {\n      const domain = email.split('@')[1]\n      throw createError({ statusCode: 404, statusMessage: `No DDISA IdP found for domain \"${domain}\"` })\n    }\n\n    const { url, flowState } = await createAuthorizationURL(idpConfig, {\n      clientId: config.clientId,\n      redirectUri,\n      email,\n    })\n\n    // Store flow state in encrypted cookie (matches Nuxt SP behavior)\n    const session = await useSession(event, {\n      name: FLOW_COOKIE,\n      password: SESSION_SECRET,\n      maxAge: 600,\n    })\n    await session.update({\n      state: flowState.state,\n      flow: flowState,\n      exp: Date.now() + 10 * 60 * 1000,\n    })\n\n    return { redirectUrl: url }\n  })\n}\n\nexport async function getFlowState(event: import('h3').H3Event, expectedState: string): Promise<AuthFlowState | null> {\n  const session = await useSession(event, {\n    name: FLOW_COOKIE,\n    password: SESSION_SECRET,\n  })\n  const data = session.data\n  if (!data?.state) return null\n  if (data.state !== expectedState) return null\n  if ((data.exp as number) < Date.now()) return null\n  return data.flow as AuthFlowState\n}\n\nexport async function clearFlowState(event: import('h3').H3Event): Promise<void> {\n  const session = await useSession(event, {\n    name: FLOW_COOKIE,\n    password: SESSION_SECRET,\n  })\n  await session.clear()\n}\n\nexport { SESSION_SECRET }\n","import type { EventHandler } from 'h3'\nimport { defineEventHandler, getQuery, sendRedirect, useSession } from 'h3'\nimport { SESSION_SECRET } from './api-login.js'\nimport { SP_SESSION_NAME } from './api-callback.js'\n\nexport function createApiGrantCallbackHandler(): EventHandler {\n  return defineEventHandler(async (event) => {\n    const query = getQuery(event)\n    const { grant_id, authz_jwt, status } = query as Record<string, string>\n\n    if (status === 'denied') {\n      return sendRedirect(event, '/dashboard?grant_status=denied')\n    }\n\n    if (!authz_jwt || !grant_id) {\n      return sendRedirect(event, '/dashboard?grant_status=error')\n    }\n\n    // Store the AuthZ-JWT in session\n    const session = await useSession(event, {\n      name: SP_SESSION_NAME,\n      password: SESSION_SECRET,\n    })\n    await session.update({\n      authzJWT: authz_jwt,\n      grantId: grant_id,\n    })\n\n    return sendRedirect(event, '/dashboard?grant_status=approved')\n  })\n}\n","import type { EventHandler } from 'h3'\nimport { defineEventHandler, useSession } from 'h3'\nimport { SESSION_SECRET } from './api-login.js'\nimport { SP_SESSION_NAME } from './api-callback.js'\n\nexport function createApiGrantStatusHandler(): EventHandler {\n  return defineEventHandler(async (event) => {\n    const session = await useSession(event, {\n      name: SP_SESSION_NAME,\n      password: SESSION_SECRET,\n    })\n    const data = session.data as Record<string, unknown>\n    return {\n      hasAuthzJWT: !!data.authzJWT,\n    }\n  })\n}\n","import type { EventHandler } from 'h3'\nimport { createError, defineEventHandler, useSession } from 'h3'\nimport { SESSION_SECRET } from './api-login.js'\nimport { SP_SESSION_NAME } from './api-callback.js'\n\nexport function createApiMeHandler(): EventHandler {\n  return defineEventHandler(async (event) => {\n    const session = await useSession(event, {\n      name: SP_SESSION_NAME,\n      password: SESSION_SECRET,\n    })\n    const data = session.data as Record<string, unknown>\n\n    if (!data.claims) {\n      throw createError({ statusCode: 401, statusMessage: 'Not authenticated' })\n    }\n\n    return data.claims\n  })\n}\n","import type { EventHandler } from 'h3'\nimport { createError, defineEventHandler, getHeader, useSession } from 'h3'\nimport type { SPConfig } from '../config.js'\nimport { SESSION_SECRET } from './api-login.js'\nimport { SP_SESSION_NAME } from './api-callback.js'\n\nexport function createApiProtectedActionHandler(config: SPConfig): EventHandler {\n  return defineEventHandler(async (event) => {\n    const session = await useSession(event, {\n      name: SP_SESSION_NAME,\n      password: SESSION_SECRET,\n    })\n    const data = session.data as Record<string, unknown>\n    const claims = data.claims as { sub?: string } | undefined\n\n    if (!claims?.sub) {\n      throw createError({ statusCode: 401, statusMessage: 'Not authenticated' })\n    }\n\n    // Check for AuthZ-JWT in Authorization header or session\n    const authHeader = getHeader(event, 'authorization')\n    const token = authHeader?.startsWith('Bearer ')\n      ? authHeader.slice(7)\n      : (data.authzJWT as string | undefined)\n\n    if (!token) {\n      throw createError({ statusCode: 403, statusMessage: 'Authorization JWT required. Please request permission first.' })\n    }\n\n    const idpUrl = config.idpUrl\n    if (!idpUrl) {\n      throw createError({ statusCode: 500, statusMessage: 'IdP URL not configured' })\n    }\n\n    // Verify the AuthZ-JWT and consume once-grants via the IdP verify endpoint\n    const verifyRes = await fetch(`${idpUrl}/api/grants/verify`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ token }),\n    })\n\n    const result = await verifyRes.json() as {\n      valid: boolean\n      claims?: Record<string, unknown>\n      grant?: { status: string, request: { grant_type: string } }\n      error?: string\n    }\n\n    if (!result.valid) {\n      // Clear stale session data so user can request a new grant\n      await session.update({ authzJWT: undefined, grantId: undefined })\n      throw createError({ statusCode: 403, statusMessage: `Authorization failed: ${result.error}` })\n    }\n\n    // Once-grant consumed -- clear session so user can request a new one\n    const grantConsumed = result.grant?.request?.grant_type === 'once'\n    if (grantConsumed) {\n      await session.update({ authzJWT: undefined, grantId: undefined })\n    }\n\n    return {\n      success: true,\n      message: 'Protected action executed successfully',\n      user: claims.sub,\n      grant: result.claims,\n      grantConsumed,\n      timestamp: new Date().toISOString(),\n    }\n  })\n}\n","import type { EventHandler } from 'h3'\nimport { createError, defineEventHandler, getRequestURL, readBody, useSession } from 'h3'\nimport type { SPConfig } from '../config.js'\nimport { SESSION_SECRET } from './api-login.js'\nimport { SP_SESSION_NAME } from './api-callback.js'\n\nexport function createApiRequestPermissionHandler(config: SPConfig): EventHandler {\n  return defineEventHandler(async (event) => {\n    const session = await useSession(event, {\n      name: SP_SESSION_NAME,\n      password: SESSION_SECRET,\n    })\n    const data = session.data as Record<string, unknown>\n    const claims = data.claims as { sub?: string } | undefined\n\n    if (!claims?.sub) {\n      throw createError({ statusCode: 401, statusMessage: 'Not authenticated' })\n    }\n\n    const body = await readBody<{ action?: string, reason?: string }>(event)\n    const origin = getRequestURL(event).origin\n    const idpUrl = config.idpUrl\n\n    if (!idpUrl) {\n      throw createError({ statusCode: 500, statusMessage: 'IdP URL not configured' })\n    }\n\n    // Create grant request on the IdP\n    const grantRes = await fetch(`${idpUrl}/api/grants`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        requester: claims.sub,\n        target_host: config.clientId,\n        audience: config.clientId,\n        grant_type: 'once',\n        permissions: [body.action || 'protected-action'],\n        reason: body.reason || 'User requested permission for protected action',\n      }),\n    })\n\n    if (!grantRes.ok) {\n      const errText = await grantRes.text().catch(() => '')\n      throw createError({ statusCode: grantRes.status, statusMessage: `Grant creation failed: ${errText}` })\n    }\n\n    const grant = await grantRes.json() as { id: string }\n\n    // Build callback URL that the IdP will redirect back to after approval\n    const callbackBase = `${origin}/api/grant-callback`\n\n    // Build redirect URL to grant-approval page on IdP\n    const approvalUrl = new URL(`${idpUrl}/grant-approval`)\n    approvalUrl.searchParams.set('grant_id', grant.id)\n    approvalUrl.searchParams.set('callback', callbackBase)\n\n    return { redirectUrl: approvalUrl.toString(), grantId: grant.id }\n  })\n}\n","import type { DDISAAssertionClaims } from '@openape/core'\nimport type { EventHandler } from 'h3'\nimport { handleCallback as authHandleCallback } from '@openape/auth'\nimport { createError, defineEventHandler, getQuery } from 'h3'\nimport type { SPConfig } from '../config.js'\nimport { flowStates } from './login.js'\n\n// In-memory session storage (keyed by session token)\nconst sessions = new Map<string, DDISAAssertionClaims>()\n\nexport function createCallbackHandler(config: SPConfig): EventHandler {\n  return defineEventHandler(async (event) => {\n    const query = getQuery(event)\n    const code = String(query.code ?? '')\n    const state = String(query.state ?? '')\n\n    if (!code || !state) {\n      throw createError({ statusCode: 400, message: 'Missing code or state' })\n    }\n\n    const flowState = flowStates.get(state)\n    if (!flowState) {\n      throw createError({ statusCode: 400, message: 'Invalid or expired state' })\n    }\n    flowStates.delete(state)\n\n    const result = await authHandleCallback({\n      code,\n      state,\n      flowState,\n      clientId: config.clientId,\n      redirectUri: config.redirectUri,\n    })\n\n    // Store claims in a simple session\n    const sessionId = crypto.randomUUID()\n    sessions.set(sessionId, result.claims)\n\n    return { sessionId, claims: result.claims }\n  })\n}\n\nexport { sessions }\n","import type { AuthFlowState } from '@openape/core'\nimport type { EventHandler } from 'h3'\nimport { createAuthorizationURL, discoverIdP } from '@openape/auth'\nimport { createError, defineEventHandler, getQuery } from 'h3'\nimport type { SPConfig } from '../config.js'\n\n// In-memory flow state storage (keyed by state parameter)\nconst flowStates = new Map<string, AuthFlowState>()\n\nexport function createLoginHandler(config: SPConfig): EventHandler {\n  return defineEventHandler(async (event) => {\n    const query = getQuery(event)\n    const email = String(query.email ?? '')\n    if (!email) {\n      throw createError({ statusCode: 400, message: 'Missing ?email= parameter' })\n    }\n\n    const idpConfig = await discoverIdP(email, config.resolverOptions)\n    if (!idpConfig) {\n      throw createError({ statusCode: 404, message: 'IdP not found for this domain' })\n    }\n\n    const { url, flowState } = await createAuthorizationURL(idpConfig, {\n      clientId: config.clientId,\n      redirectUri: config.redirectUri,\n      email,\n    })\n\n    // Store flow state keyed by state param\n    flowStates.set(flowState.state, flowState)\n\n    return { redirectUrl: url }\n  })\n}\n\nexport { flowStates }\n","import type { EventHandler } from 'h3'\nimport { createError, defineEventHandler, getHeader } from 'h3'\nimport { sessions } from './callback.js'\n\nexport function createMeHandler(): EventHandler {\n  return defineEventHandler((event) => {\n    const auth = getHeader(event, 'authorization')\n    if (!auth?.startsWith('Bearer ')) {\n      throw createError({ statusCode: 401, message: 'Missing or invalid Authorization header' })\n    }\n\n    const sessionId = auth.slice('Bearer '.length)\n    const claims = sessions.get(sessionId)\n    if (!claims) {\n      throw createError({ statusCode: 401, message: 'Invalid or expired session' })\n    }\n\n    return claims\n  })\n}\n","import type { EventHandler } from 'h3'\nimport { createClientMetadata } from '@openape/auth'\nimport { defineEventHandler } from 'h3'\nimport type { SPConfig } from '../config.js'\n\nexport function createMetadataHandler(config: SPConfig): EventHandler {\n  return defineEventHandler(() => {\n    return createClientMetadata({\n      client_id: config.clientId,\n      client_name: config.spName ?? config.clientId,\n      redirect_uris: [config.redirectUri],\n    })\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,cAAwE;AACxE,IAAAC,eAQO;AACP,IAAAC,iBAAmC;;;ACVnC,IAAAC,aAA6C;;;ACA7C,gBAA4B;AAC5B,kBAAqC;AAE9B,SAAS,mBAAmB,MAKhC;AACD,QAAM,cAAU,kCAAqB,IAAI;AACzC,aAAO,uBAAY;AAAA,IACjB,YAAY,KAAK;AAAA,IACjB,eAAe,KAAK;AAAA,IACpB,MAAM;AAAA,EACR,CAAC;AACH;;;ACdA,yBAAwC;AAExC,IAAM,sBAAsB,OAAO,KAAK,4BAA4B,KAAK;AAEzE,IAAM,gBAAgB;AAEtB,SAAS,yBAAyB,QAA2B;AAC3D,QAAM,QAAQ,OAAO,KAAK,EAAE,MAAM,aAAa;AAC/C,MAAI,MAAM,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG;AAC3C,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AAEA,QAAM,aAAa,OAAO,KAAK,MAAM,CAAC,GAAG,QAAQ;AAEjD,MAAI,SAAS;AACb,QAAM,UAAU,WAAW,aAAa,MAAM;AAC9C,YAAU;AACV,QAAM,UAAU,WAAW,SAAS,QAAQ,SAAS,OAAO,EAAE,SAAS;AACvE,YAAU;AAEV,MAAI,YAAY,eAAe;AAC7B,UAAM,IAAI,MAAM,uCAAuC,OAAO,EAAE;AAAA,EAClE;AAEA,QAAM,SAAS,WAAW,aAAa,MAAM;AAC7C,YAAU;AACV,QAAM,SAAS,WAAW,SAAS,QAAQ,SAAS,MAAM;AAE1D,MAAI,OAAO,WAAW,IAAI;AACxB,UAAM,IAAI,MAAM,qCAAqC,OAAO,MAAM,EAAE;AAAA,EACtE;AAEA,QAAM,UAAU,OAAO,OAAO,CAAC,qBAAqB,MAAM,CAAC;AAE3D,aAAO,oCAAgB;AAAA,IACrB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;AAOO,SAAS,sBAAsB,QAA2B;AAC/D,SAAO,yBAAyB,MAAM;AACxC;AAEO,SAAS,uBACd,cACA,MACA,WACS;AACT,QAAM,SAAS,yBAAyB,YAAY;AACpD,QAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,IAAI,IAAI;AAClE,aAAO,2BAAO,MAAM,YAAY,QAAQ,SAAS;AACnD;;;ACzDA,kBAAmC;AAQ5B,IAAM,uBAAuB;AAQpC,eAAsB,eACpB,SACA,QACA,YACA,KACiB;AACjB,QAAM,MAAM,IAAI,oBAAQ,EAAE,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CAAC,EAC3D,mBAAmB,EAAE,KAAK,SAAS,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC,EAAG,CAAC,EAC5D,UAAU,MAAM,EAChB,WAAW,QAAQ,GAAG,EACtB,YAAY,QAAQ,OAAO,oBAAoB,EAC/C,YAAY,EACZ,kBAAkB,IAAI;AAEzB,SAAO,MAAM,IAAI,KAAK,UAAU;AAClC;AAEA,eAAsB,gBACpB,OACA,QACA,WACA,aAC2B;AAC3B,QAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,WAAW;AAAA,IACpD;AAAA,IACA,GAAI,cAAc,EAAE,UAAU,YAAY,IAAI,CAAC;AAAA,IAC/C,YAAY,CAAC,OAAO;AAAA,EACtB,CAAC;AAED,QAAM,MAAM,QAAQ;AACpB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb;AAAA,IACA,GAAI,OAAO,QAAQ,QAAQ,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EAChE;AACF;;;AHnDO,SAAS,uBAAuB,QAAmB,SAAoB;AAC5E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,qBAAyB,KAAK;AAEjD,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6BAA6B,CAAC;AAAA,IAC/E;AAGA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK,EAAE;AACvD,QAAI,QAAQ,CAAC,KAAK,UAAU;AAC1B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AACA,QAAI,MAAM;AACR,YAAM,YAAY,MAAM,OAAO,eAAe,gBAAgB,KAAK,KAAK;AACxE,aAAO,EAAE,UAAU;AAAA,IACrB;AAGA,UAAM,UAAU,MAAM,OAAO,YAAY,WAAW,KAAK,EAAE;AAC3D,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,YAAY,MAAM,OAAO,eAAe,gBAAgB,KAAK,EAAE;AACrE,aAAO,EAAE,UAAU;AAAA,IACrB;AAEA,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,gDAAgD,CAAC;AAAA,EAClG,CAAC;AACH;AAEO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,qBAKhB,KAAK;AAER,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,WAAW;AAClD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oDAAoD,CAAC;AAAA,IACtG;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK,EAAE;AACvD,QAAI,CAAC,MAAM;AACT,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iBAAiB,CAAC;AAAA,IACnE;AAEA,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AAGA,QAAI;AACJ,QAAI,KAAK,YAAY;AACnB,YAAM,SAAS,MAAM,OAAO,YAAY,gBAAgB,KAAK,UAAU;AACvE,UAAI,CAAC,UAAU,OAAO,cAAc,KAAK,IAAI;AAC3C,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AACA,aAAO,CAAC,MAAM;AAAA,IAChB,OACK;AACH,aAAO,MAAM,OAAO,YAAY,WAAW,KAAK,EAAE;AAClD,UAAI,KAAK,WAAW,GAAG;AACrB,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM,OAAO,eAAe,iBAAiB,KAAK,WAAW,KAAK,EAAE;AAClF,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,8CAA8C,CAAC;AAAA,IAChG;AAGA,UAAM,kBAAkB,OAAO,KAAK,KAAK,WAAW,QAAQ;AAC5D,QAAI,UAAU;AACd,eAAW,OAAO,MAAM;AACtB,UAAI,uBAAuB,IAAI,WAAW,KAAK,WAAW,eAAe,GAAG;AAC1E,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,qBAAqB,MAAM,yCAAyC,CAAC;AAAA,IACtH;AAGA,UAAM,MAAM,KAAK,SAAS,KAAK,QAAQ,UAAmB;AAE1D,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,KAAK,KAAK,OAAO,IAAI;AAAA,MACvB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAEA,WAAO;AAAA,MACL;AAAA,MACA,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX;AAAA,MACA,YAAY;AAAA,IACd;AAAA,EACF,CAAC;AACH;;;AIhHA,IAAAC,sBAA2B;AAC3B,IAAAC,aAA6C;;;ACD7C,IAAAC,sBAA4C;AAE5C,IAAAC,aAAyF;AAMzF,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,aAAO,qCAAgB,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC;AACvD;AAEA,SAAS,uBAAuB,OAAgB,QAAyB;AACvE,MAAI,CAAC,OAAO,iBAAiB;AAC3B,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,EACpF;AACA,QAAM,iBAAa,6BAAiB,OAAO,eAAe;AAC1D,MAAI,CAAC,YAAY;AACf,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,gCAAgC,CAAC;AAAA,EAClF;AACA,QAAM,QAAQ,WAAW,QAAQ,eAAe,EAAE;AAClD,MAAI,CAAC,YAAY,OAAO,OAAO,eAAe,GAAG;AAC/C,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,2BAA2B,CAAC;AAAA,EAC7E;AACF;AAGO,SAAS,mBAAmB,OAAgB,QAA4B;AAC7E,MAAI,CAAC,OAAO,gBAAiB,QAAO;AACpC,QAAM,iBAAa,6BAAiB,OAAO,eAAe;AAC1D,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,QAAQ,WAAW,QAAQ,eAAe,EAAE;AAClD,SAAO,YAAY,OAAO,OAAO,eAAe;AAClD;AAGO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AACpC,UAAM,YAAQ,qBAAS,KAAK;AAC5B,UAAM,SAAS,MAAM,OAAO,UAAU,KAAK;AAAA,MACzC,OAAO,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI;AAAA,MAC3C,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,MAC9C,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,IAChD,CAAC;AACD,WAAO;AAAA,MACL,MAAM,OAAO,KAAK,IAAI,QAAM,EAAE,OAAO,EAAE,OAAO,MAAM,EAAE,MAAM,UAAU,EAAE,UAAU,OAAO,EAAE,OAAO,WAAW,EAAE,UAAU,EAAE;AAAA,MAC3H,YAAY,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,QAAQ,uBAAmB,2BAAe,OAAO,OAAO,CAAE;AAChE,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK;AACrD,QAAI,CAAC,MAAM;AACT,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iBAAiB,CAAC;AAAA,IACnE;AAGA,UAAM,OAAO,YAAY,iBAAiB,KAAK;AAC/C,UAAM,OAAO,UAAU,OAAO,KAAK;AACnC,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,OAAO,UAAM,qBAA6D,KAAK;AACrF,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,MAAM;AAC7B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AAGA,QAAI,KAAK,MAAM,SAAS,KAAK;AAC3B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AACA,QAAI,KAAK,KAAK,SAAS,KAAK;AAC1B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sCAAsC,CAAC;AAAA,IACxF;AAEA,UAAM,WAAW,MAAM,OAAO,UAAU,YAAY,KAAK,KAAK;AAC9D,QAAI,UAAU;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sBAAsB,CAAC;AAAA,IACxE;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,OAAO;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,UAAU;AAAA,MACV,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AACD,WAAO,EAAE,IAAI,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK;AAAA,EACxD,CAAC;AACH;AAGO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,QAAQ,uBAAmB,2BAAe,OAAO,OAAO,CAAE;AAEhE,UAAM,OAAO,UAAM,qBAA+C,KAAK;AACvE,QAAI,CAAC,KAAK,aAAa,OAAO,KAAK,cAAc,UAAU;AACzD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oCAAoC,CAAC;AAAA,IACtF;AAGA,QAAI,KAAK,UAAU,SAAS,KAAM;AAChC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6CAA6C,CAAC;AAAA,IAC/F;AACA,QAAI,KAAK,QAAQ,KAAK,KAAK,SAAS,KAAK;AACvC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sCAAsC,CAAC;AAAA,IACxF;AAEA,UAAM,aAAa,KAAK,UAAU,KAAK;AAGvC,QAAI;AACF,4BAAsB,UAAU;AAAA,IAClC,QACM;AACJ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,+CAA+C,CAAC;AAAA,IACjG;AAGA,UAAM,QAAQ,WAAW,MAAM,KAAK;AACpC,UAAM,UAAU,MAAM,UAAU,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,IAAI;AAC/D,UAAM,OAAO,KAAK,QAAQ,WAAW;AAGrC,UAAM,UAAU,MAAM,CAAC;AACvB,UAAM,YAAQ,gCAAW,QAAQ,EAAE,OAAO,OAAO,KAAK,SAAS,QAAQ,CAAC,EAAE,OAAO,KAAK;AAGtF,UAAM,WAAW,MAAM,OAAO,YAAY,gBAAgB,UAAU;AACpE,QAAI,UAAU;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,qCAAqC,CAAC;AAAA,IACvF;AAGA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK;AACrD,QAAI,CAAC,MAAM;AACT,YAAM,OAAO,UAAU,OAAO;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,SAAS;AAAA,MACb;AAAA,MACA,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,MACA,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACzC;AAEA,UAAM,OAAO,YAAY,KAAK,MAAM;AACpC,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,QAAmB;AAC7E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,QAAQ,uBAAmB,2BAAe,OAAO,OAAO,CAAE;AAEhE,WAAO,MAAM,OAAO,YAAY,WAAW,KAAK;AAAA,EAClD,CAAC;AACH;AAGO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,+BAAmB,OAAO,UAAU;AACzC,2BAAuB,OAAO,MAAM;AAEpC,UAAM,YAAQ,2BAAe,OAAO,OAAO;AAE3C,UAAM,WAAW,MAAM,OAAO,YAAY,SAAS,KAAK;AACxD,QAAI,CAAC,UAAU;AACb,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oBAAoB,CAAC;AAAA,IACtE;AAEA,UAAM,OAAO,YAAY,OAAO,KAAK;AACrC,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;;;ACtMA,IAAAC,aAA0B;AAK1B,SAAS,mBAAmB,OAA+B;AACzD,QAAM,iBAAa,sBAAU,OAAO,eAAe;AACnD,MAAI,CAAC,YAAY,WAAW,SAAS;AACnC,WAAO;AACT,SAAO,WAAW,MAAM,CAAC;AAC3B;AAEA,eAAsB,iBACpB,OACA,UACA,QACkC;AAClC,QAAM,QAAQ,mBAAmB,KAAK;AACtC,MAAI,CAAC;AACH,WAAO;AAET,QAAM,aAAa,MAAM,SAAS,cAAc;AAEhD,MAAI;AACF,WAAO,MAAM,gBAAgB,OAAO,QAAQ,WAAW,SAAS;AAAA,EAClE,QACM;AACJ,WAAO;AAAA,EACT;AACF;;;AFtBO,SAAS,oBAAoB,QAAmB,QAAmB;AACxE,aAAO,+BAAmB,OAAO,UAAU;AAEzC,UAAM,SAAS,mBAAmB,OAAO,MAAM;AAE/C,QAAI;AACJ,QAAI,CAAC,QAAQ;AACX,YAAM,UAAU,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAC5E,UAAI,CAAC,SAAS;AACZ,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6DAA6D,CAAC;AAAA,MAC/G;AACA,UAAI,QAAQ,QAAQ,SAAS;AAC3B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,MAC1F;AACA,oBAAc,QAAQ;AAAA,IACxB;AAEA,UAAM,OAAO,UAAM,qBAOhB,KAAK;AAKR,QAAI,QAAQ;AACV,UAAI,CAAC,KAAK,SAAS,CAAC,KAAK,QAAQ,CAAC,KAAK,aAAa,CAAC,KAAK,OAAO;AAC/D,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,yDAAyD,CAAC;AAAA,MAC3G;AAAA,IACF,OACK;AACH,UAAI,CAAC,KAAK,SAAS,CAAC,KAAK,QAAQ,CAAC,KAAK,WAAW;AAChD,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kDAAkD,CAAC;AAAA,MACpG;AAAA,IACF;AAGA,QAAI,KAAK,MAAM,SAAS,KAAK;AAC3B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AACA,QAAI,KAAK,KAAK,SAAS,KAAK;AAC1B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sCAAsC,CAAC;AAAA,IACxF;AACA,QAAI,KAAK,UAAU,SAAS,KAAM;AAChC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6CAA6C,CAAC;AAAA,IAC/F;AAEA,QAAI,CAAC,KAAK,UAAU,WAAW,cAAc,GAAG;AAC9C,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,2CAA2C,CAAC;AAAA,IAC7F;AAGA,QAAI;AACF,4BAAsB,KAAK,SAAS;AAAA,IACtC,QACM;AACJ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,yBAAyB,CAAC;AAAA,IAC3E;AAGA,UAAM,WAAW,MAAM,OAAO,UAAU,YAAY,KAAK,KAAK;AAC9D,QAAI,UAAU;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,IAC1F;AAGA,UAAM,cAAc,MAAM,OAAO,YAAY,gBAAgB,KAAK,SAAS;AAC3E,QAAI,aAAa;AACf,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6CAA6C,CAAC;AAAA,IAC/F;AAGA,UAAM,QAAQ,SAAS,KAAK,QAAS;AACrC,UAAM,WAAW,SAAU,KAAK,YAAY,QAAS;AACrD,UAAM,OAAO,KAAK,QAAQ;AAG1B,UAAM,OAAO,MAAM,OAAO,UAAU,OAAO;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAGD,UAAM,aAAa,KAAK,UAAU,KAAK;AACvC,UAAM,QAAQ,WAAW,MAAM,KAAK;AACpC,UAAM,UAAU,MAAM,CAAC;AACvB,UAAM,YAAQ,gCAAW,QAAQ,EAAE,OAAO,OAAO,KAAK,SAAS,QAAQ,CAAC,EAAE,OAAO,KAAK;AAEtF,UAAM,OAAO,YAAY,KAAK;AAAA,MAC5B;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW;AAAA,MACX,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACzC,CAAC;AAED,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;AGxHA,IAAAC,aAAuE;AACvE,kBAAyC;AACzC,oBAAwE;;;ACHxE,IAAAC,aAAmE;AAKnE,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAExB,SAAS,iBAAiB,QAAmB;AAClD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,OAAO,iBAAiB;AAAA,IAClC,QAAQ;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,OAAO,OAAO,WAAW,UAAU;AAAA,MAC3C,UAAU;AAAA,MACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,IACzB;AAAA,EACF;AACF;AAQO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,qBAKhB,KAAK;AAER,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,WAAW;AAClD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oDAAoD,CAAC;AAAA,IACtG;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,YAAY,KAAK,EAAE;AACvD,QAAI,CAAC,MAAM;AACT,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iBAAiB,CAAC;AAAA,IACnE;AACA,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AAGA,QAAI;AACJ,QAAI,KAAK,YAAY;AACnB,YAAM,SAAS,MAAM,OAAO,YAAY,gBAAgB,KAAK,UAAU;AACvE,UAAI,CAAC,UAAU,OAAO,cAAc,KAAK,IAAI;AAC3C,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AACA,aAAO,CAAC,MAAM;AAAA,IAChB,OACK;AACH,aAAO,MAAM,OAAO,YAAY,WAAW,KAAK,EAAE;AAClD,UAAI,KAAK,WAAW,GAAG;AACrB,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,CAAC;AAAA,MACpF;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM,OAAO,eAAe,iBAAiB,KAAK,WAAW,KAAK,EAAE;AAClF,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,8CAA8C,CAAC;AAAA,IAChG;AAGA,UAAM,kBAAkB,OAAO,KAAK,KAAK,WAAW,QAAQ;AAC5D,QAAI,UAAU;AACd,eAAW,OAAO,MAAM;AACtB,UAAI,uBAAuB,IAAI,WAAW,KAAK,WAAW,eAAe,GAAG;AAC1E,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,qBAAqB,MAAM,yCAAyC,CAAC;AAAA,IACtH;AAGA,UAAM,UAAU,UAAM,uBAAW,OAAO,iBAAiB,MAAM,CAAC;AAChE,UAAM,QAAQ,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC;AAE3C,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;AAOO,SAAS,2BAA2B,QAAmB,QAAmB;AAC/E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,UAAU,UAAM,uBAAW,OAAO,iBAAiB,MAAM,CAAC;AAChE,UAAM,QAAQ,MAAM;AACpB,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,CAAC;AACH;AASO,SAAS,yBAAuC;AACrD,aAAO,+BAAmB,CAAC,UAAU;AACnC,UAAM,YAAQ,qBAAS,KAAK;AAC5B,WAAO,EAAE,eAAe,MAAM,UAAU,MAAM,YAAY,IAAI;AAAA,EAChE,CAAC;AACH;;;AD3GA,SAAS,0BAA0B,KAAuD;AACxF,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,WAAO,OAAO;AAAA,MACZ,CAAC,MACC,OAAO,MAAM,YACV,MAAM,QACN,CAAC,iBAAiB,aAAa,EAAE,SAAS,OAAQ,EAA8B,QAAQ,EAAE,CAAC,KAC3F,OAAQ,EAA8B,WAAW;AAAA,IACxD;AAAA,EACF,QACM;AACJ,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,qBAAS,KAAK;AAE5B,UAAM,SAA0B;AAAA,MAC9B,WAAW,OAAO,MAAM,aAAa,EAAE;AAAA,MACvC,cAAc,OAAO,MAAM,gBAAgB,EAAE;AAAA,MAC7C,OAAO,OAAO,MAAM,SAAS,EAAE;AAAA,MAC/B,gBAAgB,OAAO,MAAM,kBAAkB,EAAE;AAAA,MACjD,uBAAuB,OAAO,MAAM,yBAAyB,EAAE;AAAA,MAC/D,OAAO,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI;AAAA,MAC3C,eAAe,OAAO,MAAM,iBAAiB,EAAE;AAAA,MAC/C,OAAO,OAAO,MAAM,SAAS,EAAE;AAAA,IACjC;AAEA,UAAM,YAAQ,sCAAyB,MAAM;AAC7C,QAAI,OAAO;AACT,UAAI,OAAO,cAAc;AACvB,YAAI;AACF,gBAAM,WAAW,IAAI,IAAI,OAAO,YAAY;AAC5C,mBAAS,aAAa,IAAI,SAAS,iBAAiB;AACpD,mBAAS,aAAa,IAAI,qBAAqB,KAAK;AACpD,cAAI,OAAO,OAAO;AAChB,qBAAS,aAAa,IAAI,SAAS,OAAO,KAAK;AAAA,UACjD;AACA,qBAAO,yBAAa,OAAO,SAAS,SAAS,CAAC;AAAA,QAChD,QACM;AAAA,QAEN;AAAA,MACF;AACA,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,MAAM,CAAC;AAAA,IACxD;AAGA,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAElF,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,UAAM,uBAAuB,OAAO,MAAM,oBAAoB,EAAE;AAEhE,QAAI,eAAe;AAIjB,YAAM,aAAa,MAAM,OAAO,UAAU,YAAY,cAAc,GAAG;AACvE,UAAI,cAAc,CAAC,WAAW,UAAU;AACtC,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,MACrE;AACA,UAAI,sBAAsB;AACxB,cAAM,QAAQ,UAAM;AAAA,UAClB;AAAA,UACA,cAAc;AAAA,UACd,OAAO;AAAA,UACP,OAAO;AAAA,QACT;AACA,iBAAS,MAAM,QAAQ;AACvB,wBAAgB,EAAE,KAAK,cAAc,IAAI;AACzC,4BAAoB,MAAM;AAC1B,kBAAM,wBAAS,MAAM,IAAI,OAAO,UAAU;AAAA,MAC5C,OACK;AACH,iBAAS,cAAc;AACvB,oBAAY,cAAc,QAAQ,UAAU,UAAU;AAAA,MACxD;AAAA,IACF,OACK;AAEH,YAAM,UAAU,UAAM,uBAAW,OAAO,iBAAiB,MAAM,CAAC;AAEhE,UAAI,CAAC,QAAQ,KAAK,QAAQ;AAExB,cAAM,WAAW,cAAc,IAAI,gBAAgB,KAA+B,EAAE,SAAS,CAAC;AAC9F,mBAAO,yBAAa,OAAO,mBAAmB,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MAC9E;AAEA,YAAM,gBAAgB,QAAQ,KAAK;AACnC,YAAM,OAAO,MAAM,OAAO,UAAU,YAAY,aAAa;AAC7D,UAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6BAA6B,CAAC;AAAA,MAC/E;AAEA,UAAI,sBAAsB;AACxB,cAAM,QAAQ,UAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA,OAAO;AAAA,UACP,OAAO;AAAA,QACT;AACA,iBAAS,MAAM,QAAQ;AACvB,wBAAgB,EAAE,KAAK,cAAc;AACrC,4BAAoB,MAAM;AAC1B,kBAAM,wBAAS,MAAM,IAAI,OAAO,UAAU;AAAA,MAC5C,OACK;AACH,iBAAS;AACT,oBAAY,KAAK,SAAS,KAAK,QAAQ,UAAU;AAAA,MACnD;AAAA,IACF;AAIA,QAAI,sBAAsB;AACxB,YAAM,YAAY,MAAM,OAAO,UAAU,YAAY,MAAM;AAC3D,UAAI,aAAa,CAAC,UAAU,UAAU;AACpC,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,MACrE;AAAA,IACF;AAGA,UAAM,eAAe,0BAA0B,OAAO,MAAM,yBAAyB,EAAE,CAAC;AACxF,QAAI;AAEJ,QAAI,aAAa,SAAS,GAAG;AAC3B,wBAAkB,CAAC;AAEnB,iBAAW,UAAU,cAAc;AACjC,cAAM,QAAQ,UAAM,2BAAY;AAAA,UAC9B,WAAW,gBAAgB,cAAc,MAAM;AAAA,UAC/C,aAAa,OAAO;AAAA,UACpB,UAAU,OAAO;AAAA,UACjB,YAAY,OAAO,YAAY;AAAA,UAC/B,aAAa,CAAC,OAAO,SAAS,gBAAgB,OAAO,aAAa,OAAO,MAAM;AAAA,UAC/E,GAAI,OAAO,SAAS,gBAAgB,EAAE,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC;AAAA,UAC3E,QAAQ,OAAO;AAAA,QACjB,GAAG,OAAO,UAAU;AAEpB,cAAM,WAAW,UAAM,4BAAa,MAAM,IAAI,QAAQ,OAAO,UAAU;AACvE,wBAAgB,KAAK;AAAA,UACnB,GAAG;AAAA,UACH,UAAU,SAAS;AAAA,QACrB,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,OAAO,OAAO,WAAW;AAC/B,UAAM,OAAO,UAAU,KAAK;AAAA,MAC1B;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,eAAe,OAAO;AAAA,MACtB;AAAA,MACA,OAAO,OAAO;AAAA,MACd,WAAW,KAAK,IAAI,IAAI;AAAA,MACxB,KAAK;AAAA,MACL,OAAO,OAAO,SAAS;AAAA,MACvB,sBAAsB;AAAA,MACtB;AAAA,MACA,iBAAiB;AAAA,IACnB,CAAC;AAED,UAAM,cAAc,IAAI,IAAI,OAAO,YAAY;AAC/C,gBAAY,aAAa,IAAI,QAAQ,IAAI;AACzC,gBAAY,aAAa,IAAI,SAAS,OAAO,KAAK;AAElD,eAAO,yBAAa,OAAO,YAAY,SAAS,CAAC;AAAA,EACnD,CAAC;AACH;;;AE1LA,IAAAC,aAAqF;AACrF,IAAAC,eAAoH;AACpH,IAAAC,iBAA6C;AAK7C,IAAMC,iBAAgB;AAEtB,SAAS,WAAW,OAAgB,QAAgB,OAAe,aAAqB;AACtF,oCAAkB,OAAO,MAAM;AAC/B,SAAO,EAAE,OAAO,mBAAmB,YAAY;AACjD;AAEA,SAAS,WAAW,OAA6B;AAC/C,MAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,SAAO,IAAI,IAAI,MAAM,MAAMA,cAAa,EAAE,OAAO,OAAO,CAAC;AAC3D;AAEA,SAAS,yBAAyB,QAAmB;AACnD,SAAO,OAAO,QAAgB,UAAmB;AAC/C,UAAM,SAAS,WAAW,KAAK;AAC/B,UAAM,SAA4C,CAAC;AAEnD,UAAM,aAAa,OAAO,SAAS;AACnC,UAAM,YAAY,cAAc,OAAO,IAAI,OAAO,KAAK,OAAO,IAAI,SAAS;AAE3E,QAAI,WAAW;AACb,YAAM,OAAO,MAAM,OAAO,UAAU,YAAY,MAAM;AACtD,UAAI,MAAM;AACR,YAAI,cAAc,OAAO,IAAI,OAAO,GAAG;AACrC,iBAAO,QAAQ,KAAK;AAAA,QACtB;AACA,YAAI,cAAc,OAAO,IAAI,SAAS,GAAG;AACvC,iBAAO,OAAO,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mBAAmB,QAAmB,QAAmB;AACvE,aAAO,+BAAmB,OAAO,UAAU;AACzC,UAAM,kBAAc,6BAAiB,OAAO,cAAc,KAAK;AAC/D,UAAM,UAAU,UAAM,wBAAY,OAAO,OAAO,KAAK;AAErD,QAAI;AACJ,QAAI,YAAY,SAAS,mCAAmC,GAAG;AAC7D,aAAO,OAAO,YAAY,IAAI,gBAAgB,OAAO,CAAC;AAAA,IACxD,OACK;AACH,UAAI;AACF,eAAO,KAAK,MAAM,WAAW,IAAI;AAAA,MACnC,QACM;AACJ,eAAO,WAAW,OAAO,KAAK,mBAAmB,wBAAwB;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,YAAY,KAAK;AAEvB,QAAI,cAAc,sBAAsB;AACtC,aAAO,6BAA6B,OAAO,MAAM,QAAQ,MAAM;AAAA,IACjE;AAEA,QAAI,cAAc,iBAAiB;AACjC,aAAO,wBAAwB,OAAO,MAAM,QAAQ,MAAM;AAAA,IAC5D;AAEA,QAAI,cAAc,sBAAsB;AACtC,aAAO,6BAA6B,OAAO,MAAwC,QAAQ,MAAM;AAAA,IACnG;AAEA,WAAO,WAAW,OAAO,KAAK,0BAA0B,0BAA0B;AAAA,EACpF,CAAC;AACH;AAEA,eAAe,6BACb,OACA,MACA,QACA,QACA;AACA,QAAM,gBAAgB,KAAK;AAC3B,QAAM,YAAY,KAAK;AACvB,QAAM,uBAAuB,KAAK;AAClC,QAAM,WAAW,KAAK;AAEtB,MAAI,kBAAkB,0DAA0D;AAC9E,WAAO,WAAW,OAAO,KAAK,mBAAmB,mCAAmC;AAAA,EACtF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO,WAAW,OAAO,KAAK,mBAAmB,0BAA0B;AAAA,EAC7E;AAEA,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,UAAM;AAAA,MACpB;AAAA,MACA,GAAG,OAAO,MAAM;AAAA,MAChB,OAAO,cAAc;AACnB,cAAM,OAAO,MAAM,OAAO,UAAU,YAAY,SAAS;AACzD,YAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO;AAEpC,cAAM,OAAO,MAAM,OAAO,YAAY,WAAW,SAAS;AAC1D,YAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,eAAO,sBAAsB,KAAK,CAAC,EAAG,SAAS;AAAA,MACjD;AAAA,MACA,OAAO;AAAA,IACT;AAGA,QAAI,sBAAsB;AACxB,UAAI,CAAC,UAAU;AACb,eAAO,WAAW,OAAO,KAAK,mBAAmB,iCAAiC;AAAA,MACpF;AAEA,YAAM,QAAQ,UAAM,mCAAmB,sBAAsB,KAAK,UAAU,OAAO,UAAU;AAC7F,gBAAM,yBAAS,MAAM,IAAI,OAAO,UAAU;AAE1C,YAAMC,SAAQ,UAAM;AAAA,QAClB;AAAA,UACE,KAAK,MAAM,QAAQ;AAAA,UACnB,KAAK;AAAA,UACL,OAAO,OAAO,WAAW;AAAA,UACzB,gBAAgB,EAAE,IAAI;AAAA,UACtB,kBAAkB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,UAKxB,OAAO,MAAM,QAAQ,UAAU,CAAC;AAAA,QAClC;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAEA,aAAO;AAAA,QACL,cAAcA;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,KAAK,KAAK,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAEA,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AAAA,EACF,SACO,KAAc;AACnB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,WAAW,OAAO,KAAK,kBAAkB,OAAO;AAAA,EACzD;AACF;AAEA,eAAe,wBACb,OACA,MACA,QACA,QACA;AACA,QAAM,eAAe,KAAK;AAC1B,QAAM,WAAW,KAAK;AAEtB,MAAI,CAAC,cAAc;AACjB,WAAO,WAAW,OAAO,KAAK,mBAAmB,uBAAuB;AAAA,EAC1E;AAEA,MAAI,CAAC,UAAU;AACb,WAAO,WAAW,OAAO,KAAK,mBAAmB,mBAAmB;AAAA,EACtE;AAEA,MAAI;AACF,UAAM,SAAS,UAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,yBAAyB,MAAM;AAAA;AAAA;AAAA;AAAA,MAI/B,OAAO,WAAW;AAChB,cAAM,OAAO,MAAM,OAAO,UAAU,YAAY,MAAM;AACtD,eAAO,CAAC,QAAQ,KAAK;AAAA,MACvB;AAAA,IACF;AACA,WAAO;AAAA,EACT,SACO,KAAc;AACnB,QAAI,eAAe,gCAAmB;AACpC,aAAO,WAAW,OAAO,KAAK,iBAAiB,IAAI,OAAO;AAAA,IAC5D;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,WAAW,OAAO,KAAK,iBAAiB,OAAO;AAAA,EACxD;AACF;AAEA,eAAe,6BACb,OACA,MACA,QACA,QACA;AACA,MAAI,CAAC,KAAK,cAAc,CAAC,KAAK,QAAQ,CAAC,KAAK,iBAAiB,CAAC,KAAK,gBAAgB,CAAC,KAAK,WAAW;AAClG,WAAO,WAAW,OAAO,KAAK,mBAAmB,mFAAmF;AAAA,EACtI;AAEA,MAAI;AACF,UAAM,SAAS,UAAM;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,yBAAyB,MAAM;AAAA,MAC/B,OAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,SACO,KAAc;AACnB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,WAAW,OAAO,KAAK,iBAAiB,OAAO;AAAA,EACxD;AACF;;;AC9OA,IAAAC,aAAsD;AACtD,IAAAC,eAA0B;AAGnB,SAAS,kBAAkB,QAAmB;AACnD,aAAO,+BAAmB,OAAO,UAAU;AAEzC,sCAAkB,OAAO,iBAAiB,sBAAsB;AAEhE,UAAM,UAAU,MAAM,OAAO,SAAS,iBAAiB;AACvD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,QAAQ,IAAI,OAAO,UAAU;AAC3B,cAAM,MAAM,UAAM,wBAAU,MAAM,SAAS;AAC3C,eAAO,EAAE,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,SAAS,KAAK,MAAM;AAAA,MAC5D,CAAC;AAAA,IACH;AACA,WAAO,EAAE,KAAK;AAAA,EAChB,CAAC;AACH;;;AClBA,IAAAC,cAAsD;AAG/C,SAAS,uBAAuB,QAAmB;AACxD,aAAO,gCAAmB,CAAC,UAAU;AAEnC,uCAAkB,OAAO,iBAAiB,sBAAsB;AAChE,UAAM,SAAS,OAAO;AAEtB,WAAO;AAAA,MACL;AAAA,MACA,wBAAwB,GAAG,MAAM;AAAA,MACjC,gBAAgB,GAAG,MAAM;AAAA,MACzB,mBAAmB,GAAG,MAAM;AAAA,MAC5B,UAAU,GAAG,MAAM;AAAA,MACnB,0BAA0B,CAAC,MAAM;AAAA,MACjC,qBAAqB,GAAG,MAAM;AAAA,MAC9B,uBAAuB,CAAC,sBAAsB,sBAAsB,eAAe;AAAA,MACnF,yBAAyB,CAAC,QAAQ;AAAA,MAClC,uCAAuC,CAAC,OAAO;AAAA,MAC/C,uCAAuC,CAAC,QAAQ,iBAAiB;AAAA,MACjE,kDAAkD,CAAC,OAAO;AAAA,MAC1D,kCAAkC,CAAC,MAAM;AAAA,MACzC,kBAAkB,CAAC,UAAU,SAAS,WAAW,gBAAgB;AAAA,MACjE,kBAAkB,CAAC,OAAO,OAAO,OAAO,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,yBAAyB,kBAAkB;AAAA,MAClI,uCAAuC,CAAC,iBAAiB,aAAa;AAAA;AAAA,MAGtE,eAAe;AAAA,MACf,8BAA8B,CAAC,WAAW,SAAS;AAAA,MACnD,+BAA+B,GAAG,MAAM;AAAA,MACxC,kCAAkC,GAAG,MAAM;AAAA;AAAA,MAG3C,yBAAyB,GAAG,MAAM;AAAA,MAClC,8BAA8B,GAAG,MAAM;AAAA,MACvC,+BAA+B,CAAC,QAAQ,SAAS,QAAQ;AAAA,MACzD,oCAAoC,CAAC,WAAW,YAAY;AAAA,IAC9D;AAAA,EACF,CAAC;AACH;;;ACtCA,IAAAC,iBAA4H;AAC5H,IAAAC,cAA0I;AAM1I,IAAM,oBAAiC,CAAC,QAAQ,SAAS,QAAQ;AAEjE,SAAS,sBAAsB,SAAyC;AACtE,MAAI,CAAC,SAAS;AACZ,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,EAC1E;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,0BACP,OACA,QACA,eACQ;AACR,MAAI,mBAAmB,OAAO,MAAM,GAAG;AACrC,WAAO;AAAA,EACT;AACA,SAAO,sBAAsB,aAAa;AAC5C;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAElF,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,GAAG;AAClE,UAAM,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AACrD,UAAM,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM,IAAmB;AACpE,UAAM,YAAY,MAAM,YAAY,OAAO,MAAM,SAAS,IAAI;AAE9D,QAAI,WAAW;AACb,aAAO,OAAO,WAAW,WAAW,EAAE,OAAO,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC1E;AAEA,UAAM,WAAW,sBAAsB,aAAa;AAGpD,UAAM,aAAa,MAAM,OAAO,UAAU,YAAY,QAAQ;AAC9D,UAAM,aAAa,CAAC,UAAU,GAAG,WAAW,IAAI,OAAK,EAAE,KAAK,CAAC;AAE7D,WAAO,OAAO,WAAW,WAAW,EAAE,OAAO,QAAQ,QAAQ,WAAW,WAAW,CAAC;AAAA,EACtF,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,QAAmB;AAC7E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,sBAA8B,KAAK;AACtD,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAElF,QAAI,eAAe;AACjB,WAAK,YAAY,cAAc;AAAA,IACjC;AAEA,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,eAAe,CAAC,KAAK,UAAU;AAC1D,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,4DAA4D,CAAC;AAAA,IAC9G;AAEA,QAAI,CAAC,KAAK,YAAY;AACpB,WAAK,aAAa;AAAA,IACpB;AAEA,QAAI,CAAC,kBAAkB,SAAS,KAAK,UAAU,GAAG;AAChD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,kBAAkB,KAAK,IAAI,CAAC,GAAG,CAAC;AAAA,IACxH;AAEA,QAAI,KAAK,eAAe,WAAW,CAAC,KAAK,UAAU;AACjD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,IAC1F;AAEA,UAAM,QAAQ,UAAM,4BAAY,MAAM,OAAO,UAAU;AACvD,uCAAkB,OAAO,GAAG;AAC5B,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,sBAAsB,QAAmB;AACvD,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,QAAQ,UAAM,gCAAgB,IAAI,OAAO,UAAU;AACzD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,UAAM,OAAO,MAAM,MAAM,MAAM,IAAI,MAAM,cAAc,MAAM,UAAU;AACvE,uCAAkB,OAAO,QAAQ,IAAI;AAErC,UAAM,kBAAc,8BAAiB,OAAO,eAAe;AAC3D,QAAI,gBAAgB,MAAM;AACxB,yCAAkB,OAAO,GAAG;AAC5B,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,0BAA0B,QAAmB,QAAmB;AAC9E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,0BAA0B,OAAO,QAAQ,aAAa;AAEpE,UAAM,OAAO,UAAM,sBAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAEnD,QAAI,KAAK,eAAe,QAAW;AACjC,UAAI,CAAC,kBAAkB,SAAS,KAAK,UAAuB,GAAG;AAC7D,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,kBAAkB,KAAK,IAAI,CAAC,GAAG,CAAC;AAAA,MACxH;AACA,UAAI,KAAK,eAAe,YAAY,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,KAAK,YAAY,IAAI;AAC9G,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,sDAAsD,CAAC;AAAA,MACxG;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAGA,QAAI,UAAU,gBAAgB;AAC5B,YAAM,cAAc,MAAM,QAAQ,cAAc;AAChD,UAAI,CAAC,aAAa;AAChB,cAAM,gBAAgB,MAAM,OAAO,UAAU,YAAY,MAAM,QAAQ,SAAS;AAChF,YAAI,CAAC,eAAe;AAClB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,QAC5F;AACA,cAAM,oBAAoB,cAAc,UAAU,SAAS,cAAc,aAAa;AACtF,YAAI,CAAC,mBAAmB;AACtB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,gEAAgE,CAAC;AAAA,QAClH;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,YAA+C,KAAK,aACtD,EAAE,YAAY,KAAK,YAAyB,UAAU,KAAK,SAA+B,IAC1F;AACJ,YAAM,WAAW,UAAM,6BAAa,IAAI,OAAO,OAAO,YAAY,SAAS;AAE3E,YAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,YAAM,WAAW,UAAM,8BAAc,UAAU,OAAO,QAAQ,WAAW,YAAY,WAAW,GAAG;AACnG,aAAO,EAAE,OAAO,UAAU,WAAW,SAAS;AAAA,IAChD,SACO,KAAc;AACnB,UAAI,OAAO,OAAO,QAAQ,YAAY,gBAAgB,IAAK,OAAM;AACjE,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,uBAAuB,QAAmB,QAAmB;AAC3E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,0BAA0B,OAAO,QAAQ,aAAa;AAEpE,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,QAAI,UAAU,gBAAgB;AAC5B,YAAM,cAAc,MAAM,QAAQ,cAAc;AAChD,UAAI,CAAC,aAAa;AAChB,cAAM,gBAAgB,MAAM,OAAO,UAAU,YAAY,MAAM,QAAQ,SAAS;AAChF,YAAI,CAAC,eAAe;AAClB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,QAC5F;AACA,cAAM,oBAAoB,cAAc,UAAU,SAAS,cAAc,aAAa;AACtF,YAAI,CAAC,mBAAmB;AACtB,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,6DAA6D,CAAC;AAAA,QAC/G;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,UAAM,0BAAU,IAAI,OAAO,OAAO,UAAU;AAC3D,aAAO;AAAA,IACT,SACO,KAAc;AACnB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,QAAmB;AAC7E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,WAAW,0BAA0B,OAAO,QAAQ,aAAa;AAEvE,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,QAAI,aAAa,gBAAgB;AAC/B,YAAM,cAAc,MAAM,QAAQ,cAAc;AAChD,UAAI,CAAC,aAAa;AAChB,cAAM,gBAAgB,MAAM,OAAO,UAAU,YAAY,MAAM,QAAQ,SAAS;AAChF,cAAM,aAAa,iBAAiB,cAAc,aAAa;AAC/D,cAAM,UAAU,OAAO,aAAa,SAAS,QAAQ;AACrD,YAAI,CAAC,cAAc,CAAC,SAAS;AAC3B,gBAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,+DAA+D,CAAC;AAAA,QACjH;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,UAAM,4BAAY,IAAI,OAAO,UAAU;AACvD,aAAO;AAAA,IACT,SACO,KAAc;AACnB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,WAAW,sBAAsB,aAAa;AAEpD,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,QAAQ,UAAM,gCAAgB,IAAI,OAAO,UAAU;AACzD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,QAAI,MAAM,QAAQ,cAAc,UAAU;AACxC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,yCAAyC,CAAC;AAAA,IAC3F;AAEA,QAAI,MAAM,WAAW,YAAY;AAC/B,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kCAAkC,MAAM,MAAM,IAAI,CAAC;AAAA,IACpG;AAEA,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,WAAW,UAAM,8BAAc,OAAO,OAAO,QAAQ,WAAW,YAAY,WAAW,GAAG;AAEhG,WAAO,EAAE,WAAW,UAAU,MAAM;AAAA,EACtC,CAAC;AACH;AAGO,SAAS,0BAA0B,QAAmB;AAC3D,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AAErC,UAAM,iBAAa,uBAAU,OAAO,eAAe;AACnD,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,IAC5F;AACA,UAAM,QAAQ,WAAW,MAAM,CAAC;AAEhC,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,SAAS,UAAM,+BAAe,OAAO;AAAA,MACzC,WAAW,WAAW;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,OAAO,OAAO;AACjB,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,OAAO,KAAK,GAAG,CAAC;AAAA,IACzF;AAEA,QAAI,OAAO,QAAQ,aAAa,IAAI;AAClC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuC,CAAC;AAAA,IACzF;AAEA,UAAM,QAAQ,UAAM,gCAAgB,IAAI,OAAO,UAAU;AACzD,QAAI,CAAC,OAAO;AACV,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,kBAAkB,CAAC;AAAA,IACpE;AAEA,YAAQ,MAAM,QAAQ;AAAA,MACpB,KAAK;AACH,eAAO,EAAE,OAAO,oBAAoB,QAAQ,MAAM,OAAO;AAAA,MAC3D,KAAK;AACH,eAAO,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO;AAAA,MAClD,KAAK;AACH,eAAO,EAAE,OAAO,UAAU,QAAQ,MAAM,OAAO;AAAA,MACjD,KAAK;AACH,eAAO,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO;AAAA,MAClD,KAAK;AACH,eAAO,EAAE,OAAO,gBAAgB,QAAQ,MAAM,OAAO;AAAA,IACzD;AAEA,QAAI,MAAM,QAAQ,eAAe,QAAQ;AACvC,YAAM,OAAO,UAAM,yBAAS,IAAI,OAAO,UAAU;AACjD,aAAO,EAAE,QAAQ,YAAY,OAAO,KAAK;AAAA,IAC3C;AAEA,WAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,EAClC,CAAC;AACH;AAiBO,SAAS,wBAAwB,QAAmB,QAAmB;AAC5E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,0BAA0B,OAAO,QAAQ,aAAa;AAEpE,UAAM,OAAO,UAAM,sBAA2C,KAAK;AAEnE,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,QAAQ,KAAK,UAAU,KAAK,KAAK,WAAW,WAAW,GAAG;AACxF,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,oCAAoC,CAAC;AAAA,IACtF;AAEA,UAAM,UAAyB,CAAC;AAChC,QAAI,WAAW;AAEf,eAAW,QAAQ,KAAK,YAAY;AAClC,UAAI;AACF,YAAI;AACJ,gBAAQ,KAAK,QAAQ;AAAA,UACnB,KAAK,WAAW;AACd,kBAAM,YAA+C,KAAK,aACtD,EAAE,YAAY,KAAK,YAAY,UAAU,KAAK,SAAS,IACvD;AACJ,oBAAQ,UAAM,6BAAa,KAAK,IAAI,OAAO,OAAO,YAAY,SAAS;AACvE;AAAA,UACF;AAAA,UACA,KAAK;AACH,oBAAQ,UAAM,0BAAU,KAAK,IAAI,OAAO,OAAO,UAAU;AACzD;AAAA,UACF,KAAK;AACH,oBAAQ,UAAM,4BAAY,KAAK,IAAI,OAAO,UAAU;AACpD;AAAA,UACF;AACE,kBAAM,IAAI,MAAM,mBAAoB,KAA4B,MAAM,EAAE;AAAA,QAC5E;AACA,gBAAQ,KAAK,EAAE,IAAI,KAAK,IAAI,QAAQ,MAAM,QAAQ,SAAS,KAAK,CAAC;AAAA,MACnE,SACO,KAAK;AACV,mBAAW;AACX,gBAAQ,KAAK;AAAA,UACX,IAAI,KAAK;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,OAAO;AAAA,YACL,MAAM;AAAA,YACN,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,YAC5C,QAAQ;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,yCAAkB,OAAO,GAAG;AAAA,IAC9B;AAEA,WAAO,EAAE,QAAQ;AAAA,EACnB,CAAC;AACH;AAGO,SAAS,yBAAyB,QAAmB,SAAoB;AAC9E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,sBAA4B,KAAK;AAEpD,QAAI,CAAC,MAAM,OAAO;AAChB,aAAO,EAAE,OAAO,OAAO,OAAO,gBAAgB;AAAA,IAChD;AAEA,UAAM,aAAa,MAAM,OAAO,SAAS,cAAc;AACvD,UAAM,SAAS,UAAM,+BAAe,KAAK,OAAO;AAAA,MAC9C,WAAW,WAAW;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO,EAAE,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,IAC7C;AAEA,UAAM,UAAU,OAAO,QAAQ;AAC/B,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,OAAO,OAAO,OAAO,4BAA4B;AAAA,IAC5D;AAEA,UAAM,QAAQ,UAAM,gCAAgB,SAAS,OAAO,UAAU;AAC9D,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,OAAO,OAAO,OAAO,kBAAkB;AAAA,IAClD;AAEA,QAAI,MAAM,WAAW,YAAY;AAC/B,aAAO,EAAE,OAAO,OAAO,OAAO,kCAAkC,MAAM,MAAM,IAAI;AAAA,IAClF;AAEA,QAAI,MAAM,QAAQ,eAAe,QAAQ;AACvC,YAAM,OAAO,UAAM,yBAAS,SAAS,OAAO,UAAU;AACtD,aAAO,EAAE,OAAO,MAAM,QAAQ,OAAO,QAAQ,OAAO,KAAK;AAAA,IAC3D;AAEA,WAAO,EAAE,OAAO,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrD,CAAC;AACH;;;AC/aA,IAAAC,iBAAkE;AAClE,IAAAC,cAA0F;AAK1F,IAAMC,qBAAiC,CAAC,QAAQ,SAAS,QAAQ;AAEjE,SAAS,mBAAmB,SAAsD;AAChF,MAAI,CAAC,SAAS;AACZ,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,EAC1E;AACA,MAAI,QAAQ,QAAQ,SAAS;AAC3B,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,0CAA0C,CAAC;AAAA,EAC5F;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,SAAyC;AAC9D,MAAI,CAAC,SAAS;AACZ,UAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,EAC1E;AACA,SAAO,QAAQ;AACjB;AAGO,SAAS,8BAA8B,QAAmB,QAAmB;AAClF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,YAAY,mBAAmB,aAAa;AAElD,UAAM,OAAO,UAAM,sBAAS,KAAK;AAEjC,QAAI,CAAC,MAAM,YAAY,OAAO,KAAK,aAAa,UAAU;AACxD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AACA,QAAI,CAAC,MAAM,YAAY,OAAO,KAAK,aAAa,UAAU;AACxD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,mBAAmB,CAAC;AAAA,IACrE;AAEA,UAAM,YAAY,KAAK,cAAc;AACrC,QAAI,CAACA,mBAAkB,SAAS,SAAS,GAAG;AAC1C,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uCAAuCA,mBAAkB,KAAK,IAAI,CAAC,GAAG,CAAC;AAAA,IACxH;AAEA,QAAI,cAAc,YAAY,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,WAAW;AAClF,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wCAAwC,CAAC;AAAA,IAC1F;AAEA,UAAM,QAAQ,UAAM,iCAAiB;AAAA,MACnC;AAAA,MACA,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,QAAQ,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,SAAS;AAAA,MACnD,YAAY;AAAA,MACZ,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAChE,GAAG,OAAO,UAAU;AAEpB,uCAAkB,OAAO,GAAG;AAC5B,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,6BAA6B,QAAmB,QAAmB;AACjF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,cAAc,aAAa;AAEzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,OAAO,MAAM;AACnB,UAAM,SAAS,MAAM;AACrB,UAAM,SAAS,MAAM;AACrB,UAAM,aAAa,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI;AAEvD,UAAM,aAAa,OAAO;AAE1B,QAAI;AAEJ,QAAI,SAAS,aAAa;AACxB,UAAI,CAAC,WAAW,iBAAiB;AAC/B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iDAAiD,CAAC;AAAA,MACnG;AACA,oBAAc,MAAM,WAAW,gBAAgB,KAAK;AAAA,IACtD,WACS,SAAS,YAAY;AAC5B,UAAI,CAAC,WAAW,gBAAgB;AAC9B,cAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,iDAAiD,CAAC;AAAA,MACnG;AACA,oBAAc,MAAM,WAAW,eAAe,KAAK;AAAA,IACrD,OACK;AAEH,YAAM,CAAC,aAAa,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,QAClD,WAAW,kBAAkB,WAAW,gBAAgB,KAAK,IAAI,CAAC;AAAA,QAClE,WAAW,iBAAiB,WAAW,eAAe,KAAK,IAAI,CAAC;AAAA,MAClE,CAAC;AAED,YAAM,OAAO,oBAAI,IAAY;AAC7B,oBAAc,CAAC;AACf,iBAAW,SAAS,CAAC,GAAG,aAAa,GAAG,UAAU,GAAG;AACnD,YAAI,CAAC,KAAK,IAAI,MAAM,EAAE,GAAG;AACvB,eAAK,IAAI,MAAM,EAAE;AACjB,sBAAY,KAAK,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAGA,gBAAY,KAAK,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;AAGtD,QAAI,QAAQ;AACV,YAAM,IAAI,OAAO,YAAY;AAC7B,oBAAc,YAAY;AAAA,QAAO,OAC/B,EAAE,QAAQ,WAAW,YAAY,EAAE,SAAS,CAAC,KAC1C,EAAE,QAAQ,UAAU,YAAY,EAAE,SAAS,CAAC,KAC5C,EAAE,QAAQ,UAAU,YAAY,EAAE,SAAS,CAAC;AAAA,MACjD;AAAA,IACF;AAGA,QAAI,QAAQ;AACV,YAAM,MAAM,YAAY,UAAU,OAAK,EAAE,OAAO,MAAM;AACtD,UAAI,OAAO,EAAG,eAAc,YAAY,MAAM,MAAM,CAAC;AAAA,IACvD;AAEA,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,cAAc,IAAI,CAAC,GAAG,GAAG;AACzD,UAAM,UAAU,YAAY,SAAS;AACrC,UAAM,OAAO,YAAY,MAAM,GAAG,KAAK;AAEvC,WAAO;AAAA,MACL;AAAA,MACA,YAAY;AAAA,QACV,QAAQ,KAAK,SAAS,IAAI,KAAK,GAAG,EAAE,EAAG,KAAK;AAAA,QAC5C,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAGO,SAAS,8BAA8B,QAAmB,QAAmB;AAClF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,gBAAgB,MAAM,iBAAiB,OAAO,OAAO,UAAU,OAAO,MAAM;AAClF,UAAM,QAAQ,cAAc,aAAa;AAEzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AACrC,QAAI,CAAC,IAAI;AACP,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,IAC1E;AAEA,UAAM,QAAQ,MAAM,OAAO,WAAW,SAAS,EAAE;AACjD,QAAI,CAAC,SAAS,MAAM,SAAS,cAAc;AACzC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,uBAAuB,CAAC;AAAA,IACzE;AAGA,QAAI,MAAM,QAAQ,cAAc,OAAO;AACrC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,2CAA2C,CAAC;AAAA,IAC7F;AAEA,QAAI;AACF,YAAM,UAAU,UAAM,4BAAY,IAAI,OAAO,UAAU;AACvD,aAAO;AAAA,IACT,SACO,KAAc;AACnB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,gCAAgC,QAAmB,SAAoB;AACrF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,SAAK,4BAAe,OAAO,IAAI;AACrC,QAAI,CAAC,IAAI;AACP,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,wBAAwB,CAAC;AAAA,IAC1E;AAEA,UAAM,OAAO,UAAM,sBAAiD,KAAK;AACzE,QAAI,CAAC,MAAM,YAAY,CAAC,MAAM,UAAU;AACtC,YAAM,mBAAmB,EAAE,QAAQ,KAAK,OAAO,+BAA+B,CAAC;AAAA,IACjF;AAEA,QAAI;AACF,YAAM,QAAQ,UAAM,mCAAmB,IAAI,KAAK,UAAU,KAAK,UAAU,OAAO,UAAU;AAC1F,aAAO;AAAA,QACL,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,QAAQ,MAAM,QAAQ,UAAU,CAAC;AAAA,MACnC;AAAA,IACF,SACO,KAAK;AACV,aAAO;AAAA,QACL,OAAO;AAAA,QACP,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,MAC9C;AAAA,IACF;AAAA,EACF,CAAC;AACH;;;AC1MA,IAAAC,cAAuD;AAEhD,SAAS,kCAAkC;AAChD,aAAO,gCAAmB,CAAC,UAAU;AACnC,wCAAmB,OAAO;AAAA,MACxB,0BAA0B;AAAA,MAC1B,mBAAmB;AAAA,MACnB,2BAA2B;AAAA,MAC3B,oBAAoB;AAAA,MACpB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH,CAAC;AACH;;;ACbA,IAAAC,cAAgE;AAiBzD,SAAS,0BAA0B,SAA0B,CAAC,GAAG;AACtE,QAAM,cAAc,OAAO,eAAe;AAC1C,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,QAAQ,OAAO,SAAS;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,QAAQ,oBAAI,IAA4B;AAG9C,QAAM,UAAU,YAAY,MAAM;AAChC,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO;AAChC,UAAI,MAAM,WAAW,IAAK,OAAM,OAAO,GAAG;AAAA,IAC5C;AAAA,EACF,GAAG,QAAQ;AACX,UAAQ,MAAM;AAEd,aAAO,gCAAmB,CAAC,UAAU;AACnC,UAAM,WAAO,2BAAc,KAAK,EAAE;AAClC,QAAI,CAAC,MAAM,SAAS,IAAI,EAAG;AAE3B,UAAM,SAAK,0BAAa,OAAO,EAAE,eAAe,KAAK,CAAC,KAAK;AAC3D,UAAM,MAAM,GAAG,EAAE,IAAI,IAAI;AACzB,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,QAAI,CAAC,SAAS,MAAM,WAAW,KAAK;AAClC,cAAQ,EAAE,OAAO,GAAG,SAAS,MAAM,SAAS;AAC5C,YAAM,IAAI,KAAK,KAAK;AAAA,IACtB;AAEA,UAAM;AAEN,UAAM,KAAK,IAAI,UAAU,qBAAqB,YAAY,SAAS,CAAC;AACpE,UAAM,KAAK,IAAI,UAAU,yBAAyB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK,EAAE,SAAS,CAAC;AACnG,UAAM,KAAK,IAAI,UAAU,qBAAqB,KAAK,KAAK,MAAM,UAAU,GAAI,EAAE,SAAS,CAAC;AAExF,QAAI,MAAM,QAAQ,aAAa;AAC7B,YAAM,mBAAmB;AAAA,QACvB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,QAAQ,qCAAqC,KAAK,MAAM,MAAM,UAAU,OAAO,GAAI,CAAC;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;;;ACpEA,IAAAC,cAAmC;AAG5B,SAAS,0BAA0B,WAAmB,KAAS;AACpE,aAAO,gCAAmB,CAAC,UAAU;AACnC,UAAM,gBAAgB,MAAM,KAAK,IAAI,QAAQ,gBAAgB;AAC7D,QAAI,iBAAiB,OAAO,SAAS,aAAa,IAAI,UAAU;AAC9D,YAAM,mBAAmB;AAAA,QACvB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,QAAQ,kBAAkB,aAAa,uBAAuB,QAAQ;AAAA,MACxE,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;;;AjBkCA,SAAS,sBAAiC;AACxC,SAAO;AAAA,IACL,WAAW,IAAI,+BAAkB;AAAA,IACjC,aAAa,IAAI,iCAAoB;AAAA,IACrC,UAAU,IAAI,8BAAiB;AAAA,IAC/B,WAAW,IAAI,+BAAkB;AAAA,IACjC,gBAAgB,IAAI,yCAA4B;AAAA,IAChD,YAAY,IAAI,kCAAmB;AAAA,IACnC,UAAU,IAAI,8BAAiB;AAAA,IAC/B,mBAAmB,IAAI,uCAA0B;AAAA,EACnD;AACF;AAEA,IAAM,qBAAqB;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,uBAAuB;AAC9B,aAAO,gCAAmB,CAAC,UAAU;AACnC,UAAM,OAAO,MAAM;AACnB,UAAM,YAAY,mBAAmB,KAAK,OAAK,KAAK,WAAW,CAAC,CAAC;AAEjE,QAAI,WAAW;AACb,YAAM,cAAU,wBAAW,OAAO;AAAA,QAChC,QAAQ;AAAA,QACR,SAAS,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS;AAAA,QACnD,cAAc,CAAC,gBAAgB,eAAe;AAAA,QAC9C,eAAe,CAAC,cAAc;AAAA,QAC9B,WAAW,EAAE,YAAY,IAAI;AAAA,MAC/B,CAAC;AACD,UAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,aAAa,QAAmB,QAA0C;AACxF,QAAM,iBAA4B,EAAE,GAAG,oBAAoB,GAAG,GAAG,OAAO;AACxE,QAAM,UAAM,uBAAU;AACtB,QAAM,aAAS,0BAAa;AAG5B,SAAO,KAAK,uBAAuB,uBAAuB,gBAAgB,MAAM,CAAC;AACjF,SAAO,KAAK,0BAA0B,0BAA0B,gBAAgB,MAAM,CAAC;AACvF,SAAO,KAAK,oBAAoB,oBAAoB,gBAAgB,MAAM,CAAC;AAG3E,SAAO,IAAI,UAAU,uBAAuB,CAAC;AAC7C,SAAO,KAAK,sBAAsB,0BAA0B,gBAAgB,MAAM,CAAC;AACnF,SAAO,KAAK,uBAAuB,2BAA2B,gBAAgB,MAAM,CAAC;AAGrF,SAAO,IAAI,cAAc,uBAAuB,gBAAgB,MAAM,CAAC;AACvE,SAAO,KAAK,UAAU,mBAAmB,gBAAgB,MAAM,CAAC;AAChE,SAAO,IAAI,0BAA0B,kBAAkB,cAAc,CAAC;AACtE,SAAO,IAAI,qCAAqC,uBAAuB,MAAM,CAAC;AAG9E,SAAO,IAAI,eAAe,wBAAwB,gBAAgB,MAAM,CAAC;AACzE,SAAO,KAAK,eAAe,yBAAyB,gBAAgB,MAAM,CAAC;AAC3E,SAAO,KAAK,sBAAsB,yBAAyB,gBAAgB,MAAM,CAAC;AAClF,SAAO,KAAK,qBAAqB,wBAAwB,gBAAgB,MAAM,CAAC;AAChF,SAAO,IAAI,mBAAmB,sBAAsB,cAAc,CAAC;AACnE,SAAO,KAAK,2BAA2B,0BAA0B,gBAAgB,MAAM,CAAC;AACxF,SAAO,KAAK,wBAAwB,uBAAuB,gBAAgB,MAAM,CAAC;AAClF,SAAO,KAAK,0BAA0B,yBAAyB,gBAAgB,MAAM,CAAC;AACtF,SAAO,KAAK,yBAAyB,wBAAwB,gBAAgB,MAAM,CAAC;AACpF,SAAO,KAAK,2BAA2B,0BAA0B,cAAc,CAAC;AAGhF,SAAO,KAAK,oBAAoB,8BAA8B,gBAAgB,MAAM,CAAC;AACrF,SAAO,IAAI,oBAAoB,6BAA6B,gBAAgB,MAAM,CAAC;AACnF,SAAO,OAAO,wBAAwB,8BAA8B,gBAAgB,MAAM,CAAC;AAC3F,SAAO,KAAK,iCAAiC,gCAAgC,gBAAgB,MAAM,CAAC;AAGpG,SAAO,IAAI,oBAAoB,uBAAuB,gBAAgB,MAAM,CAAC;AAC7E,SAAO,KAAK,oBAAoB,wBAAwB,gBAAgB,MAAM,CAAC;AAC/E,SAAO,OAAO,2BAA2B,wBAAwB,gBAAgB,MAAM,CAAC;AACxF,SAAO,KAAK,oCAAoC,uBAAuB,gBAAgB,MAAM,CAAC;AAC9F,SAAO,IAAI,oCAAoC,yBAAyB,gBAAgB,MAAM,CAAC;AAC/F,SAAO,OAAO,2CAA2C,0BAA0B,gBAAgB,MAAM,CAAC;AAE1G,MAAI,IAAI,gCAAgC,CAAC;AACzC,MAAI,IAAI,0BAA0B,CAAC;AACnC,MAAI,OAAO,iBAAiB;AAC1B,QAAI,IAAI,0BAA0B,OAAO,eAAe,CAAC;AAAA,EAC3D;AACA,MAAI,IAAI,qBAAqB,CAAC;AAC9B,MAAI,IAAI,MAAM;AACd,SAAO,EAAE,KAAK,QAAQ,eAAe;AACvC;;;AkBlJA,IAAAC,eAAiD;AACjD,IAAAC,cAAwC;;;ACAxC,IAAAC,eAA+B;AAC/B,IAAAC,cAAsF;;;ACAtF,IAAAC,eAAoD;AACpD,IAAAC,cAAqF;AAGrF,IAAM,cAAc;AACpB,IAAM,iBAAiB;AAEhB,SAAS,sBAAsB,QAAgC;AACpE,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,OAAO,UAAM,sBAA4B,KAAK;AACpD,UAAM,aAAS,2BAAc,KAAK,EAAE;AACpC,UAAM,cAAc,GAAG,MAAM;AAE7B,QAAI,CAAC,MAAM,SAAS,CAAC,KAAK,MAAM,SAAS,GAAG,GAAG;AAC7C,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,uBAAuB,CAAC;AAAA,IAC9E;AAEA,UAAM,QAAQ,KAAK,MAAM,KAAK;AAE9B,UAAM,YAAY,UAAM,0BAAY,OAAO,OAAO,eAAe;AACjE,QAAI,CAAC,WAAW;AACd,YAAM,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC;AACjC,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,kCAAkC,MAAM,IAAI,CAAC;AAAA,IACnG;AAEA,UAAM,EAAE,KAAK,UAAU,IAAI,UAAM,qCAAuB,WAAW;AAAA,MACjE,UAAU,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,MACtC,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,QAAQ,OAAO;AAAA,MACnB,OAAO,UAAU;AAAA,MACjB,MAAM;AAAA,MACN,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,IAC9B,CAAC;AAED,WAAO,EAAE,aAAa,IAAI;AAAA,EAC5B,CAAC;AACH;AAEA,eAAsB,aAAa,OAA6B,eAAsD;AACpH,QAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,IACtC,MAAM;AAAA,IACN,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,MAAM,MAAO,QAAO;AACzB,MAAI,KAAK,UAAU,cAAe,QAAO;AACzC,MAAK,KAAK,MAAiB,KAAK,IAAI,EAAG,QAAO;AAC9C,SAAO,KAAK;AACd;AAEA,eAAsB,eAAe,OAA4C;AAC/E,QAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,IACtC,MAAM;AAAA,IACN,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,QAAQ,MAAM;AACtB;;;AD7DA,IAAM,kBAAkB;AAEjB,SAAS,yBAAyB,QAAgC;AACvE,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,EAAE,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAClD,UAAM,aAAS,2BAAc,KAAK,EAAE;AACpC,UAAM,cAAc,GAAG,MAAM;AAE7B,QAAI,OAAO;AACT,YAAM,MAAM,qBAAqB;AACjC,iBAAO,0BAAa,OAAO,WAAW,mBAAmB,GAAG,CAAC,EAAE;AAAA,IACjE;AAEA,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,iBAAO,0BAAa,OAAO,WAAW,mBAAmB,kDAA6C,CAAC,EAAE;AAAA,IAC3G;AAEA,UAAM,YAAY,MAAM,aAAa,OAAO,KAAK;AACjD,QAAI,CAAC,WAAW;AACd,iBAAO,0BAAa,OAAO,WAAW,mBAAmB,kDAA6C,CAAC,EAAE;AAAA,IAC3G;AAEA,QAAI;AACF,YAAM,SAAS,UAAM,6BAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU,OAAO;AAAA,QACjB;AAAA,MACF,CAAC;AAED,YAAM,eAAe,KAAK;AAG1B,YAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,QACtC,MAAM;AAAA,QACN,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,QAAQ,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,sBAAsB,OAAO;AAAA,MAC/B,CAAC;AAED,iBAAO,0BAAa,OAAO,YAAY;AAAA,IACzC,SACO,KAAc;AACnB,YAAM,eAAe,KAAK;AAC1B,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAO,0BAAa,OAAO,WAAW,mBAAmB,OAAO,CAAC,EAAE;AAAA,IACrE;AAAA,EACF,CAAC;AACH;;;AEzDA,IAAAC,cAAuE;AAIhE,SAAS,gCAA8C;AAC5D,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,EAAE,UAAU,WAAW,OAAO,IAAI;AAExC,QAAI,WAAW,UAAU;AACvB,iBAAO,0BAAa,OAAO,gCAAgC;AAAA,IAC7D;AAEA,QAAI,CAAC,aAAa,CAAC,UAAU;AAC3B,iBAAO,0BAAa,OAAO,+BAA+B;AAAA,IAC5D;AAGA,UAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,MACtC,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,QAAQ,OAAO;AAAA,MACnB,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AAED,eAAO,0BAAa,OAAO,kCAAkC;AAAA,EAC/D,CAAC;AACH;;;AC7BA,IAAAC,cAA+C;AAIxC,SAAS,8BAA4C;AAC1D,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,MACtC,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,MACL,aAAa,CAAC,CAAC,KAAK;AAAA,IACtB;AAAA,EACF,CAAC;AACH;;;ACfA,IAAAC,cAA4D;AAIrD,SAAS,qBAAmC;AACjD,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,MACtC,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,OAAO,QAAQ;AAErB,QAAI,CAAC,KAAK,QAAQ;AAChB,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,oBAAoB,CAAC;AAAA,IAC3E;AAEA,WAAO,KAAK;AAAA,EACd,CAAC;AACH;;;AClBA,IAAAC,cAAuE;AAKhE,SAAS,gCAAgC,QAAgC;AAC9E,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,MACtC,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,KAAK;AAEpB,QAAI,CAAC,QAAQ,KAAK;AAChB,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,oBAAoB,CAAC;AAAA,IAC3E;AAGA,UAAM,iBAAa,uBAAU,OAAO,eAAe;AACnD,UAAM,QAAQ,YAAY,WAAW,SAAS,IAC1C,WAAW,MAAM,CAAC,IACjB,KAAK;AAEV,QAAI,CAAC,OAAO;AACV,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,+DAA+D,CAAC;AAAA,IACtH;AAEA,UAAM,SAAS,OAAO;AACtB,QAAI,CAAC,QAAQ;AACX,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,yBAAyB,CAAC;AAAA,IAChF;AAGA,UAAM,YAAY,MAAM,MAAM,GAAG,MAAM,sBAAsB;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,IAChC,CAAC;AAED,UAAM,SAAS,MAAM,UAAU,KAAK;AAOpC,QAAI,CAAC,OAAO,OAAO;AAEjB,YAAM,QAAQ,OAAO,EAAE,UAAU,QAAW,SAAS,OAAU,CAAC;AAChE,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,yBAAyB,OAAO,KAAK,GAAG,CAAC;AAAA,IAC/F;AAGA,UAAM,gBAAgB,OAAO,OAAO,SAAS,eAAe;AAC5D,QAAI,eAAe;AACjB,YAAM,QAAQ,OAAO,EAAE,UAAU,QAAW,SAAS,OAAU,CAAC;AAAA,IAClE;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,MAAM,OAAO;AAAA,MACb,OAAO,OAAO;AAAA,MACd;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;;;ACpEA,IAAAC,cAAqF;AAK9E,SAAS,kCAAkC,QAAgC;AAChF,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,UAAU,UAAM,wBAAW,OAAO;AAAA,MACtC,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,KAAK;AAEpB,QAAI,CAAC,QAAQ,KAAK;AAChB,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,oBAAoB,CAAC;AAAA,IAC3E;AAEA,UAAM,OAAO,UAAM,sBAA+C,KAAK;AACvE,UAAM,aAAS,2BAAc,KAAK,EAAE;AACpC,UAAM,SAAS,OAAO;AAEtB,QAAI,CAAC,QAAQ;AACX,gBAAM,yBAAY,EAAE,YAAY,KAAK,eAAe,yBAAyB,CAAC;AAAA,IAChF;AAGA,UAAM,WAAW,MAAM,MAAM,GAAG,MAAM,eAAe;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,WAAW,OAAO;AAAA,QAClB,aAAa,OAAO;AAAA,QACpB,UAAU,OAAO;AAAA,QACjB,YAAY;AAAA,QACZ,aAAa,CAAC,KAAK,UAAU,kBAAkB;AAAA,QAC/C,QAAQ,KAAK,UAAU;AAAA,MACzB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACpD,gBAAM,yBAAY,EAAE,YAAY,SAAS,QAAQ,eAAe,0BAA0B,OAAO,GAAG,CAAC;AAAA,IACvG;AAEA,UAAM,QAAQ,MAAM,SAAS,KAAK;AAGlC,UAAM,eAAe,GAAG,MAAM;AAG9B,UAAM,cAAc,IAAI,IAAI,GAAG,MAAM,iBAAiB;AACtD,gBAAY,aAAa,IAAI,YAAY,MAAM,EAAE;AACjD,gBAAY,aAAa,IAAI,YAAY,YAAY;AAErD,WAAO,EAAE,aAAa,YAAY,SAAS,GAAG,SAAS,MAAM,GAAG;AAAA,EAClE,CAAC;AACH;;;ACxDA,IAAAC,eAAqD;AACrD,IAAAC,cAA0D;;;ACD1D,IAAAC,eAAoD;AACpD,IAAAC,cAA0D;AAI1D,IAAM,aAAa,oBAAI,IAA2B;AAE3C,SAAS,mBAAmB,QAAgC;AACjE,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,QAAQ,OAAO,MAAM,SAAS,EAAE;AACtC,QAAI,CAAC,OAAO;AACV,gBAAM,yBAAY,EAAE,YAAY,KAAK,SAAS,4BAA4B,CAAC;AAAA,IAC7E;AAEA,UAAM,YAAY,UAAM,0BAAY,OAAO,OAAO,eAAe;AACjE,QAAI,CAAC,WAAW;AACd,gBAAM,yBAAY,EAAE,YAAY,KAAK,SAAS,gCAAgC,CAAC;AAAA,IACjF;AAEA,UAAM,EAAE,KAAK,UAAU,IAAI,UAAM,qCAAuB,WAAW;AAAA,MACjE,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB;AAAA,IACF,CAAC;AAGD,eAAW,IAAI,UAAU,OAAO,SAAS;AAEzC,WAAO,EAAE,aAAa,IAAI;AAAA,EAC5B,CAAC;AACH;;;ADzBA,IAAM,WAAW,oBAAI,IAAkC;AAEhD,SAAS,sBAAsB,QAAgC;AACpE,aAAO,gCAAmB,OAAO,UAAU;AACzC,UAAM,YAAQ,sBAAS,KAAK;AAC5B,UAAM,OAAO,OAAO,MAAM,QAAQ,EAAE;AACpC,UAAM,QAAQ,OAAO,MAAM,SAAS,EAAE;AAEtC,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,gBAAM,yBAAY,EAAE,YAAY,KAAK,SAAS,wBAAwB,CAAC;AAAA,IACzE;AAEA,UAAM,YAAY,WAAW,IAAI,KAAK;AACtC,QAAI,CAAC,WAAW;AACd,gBAAM,yBAAY,EAAE,YAAY,KAAK,SAAS,2BAA2B,CAAC;AAAA,IAC5E;AACA,eAAW,OAAO,KAAK;AAEvB,UAAM,SAAS,UAAM,aAAAC,gBAAmB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,IACtB,CAAC;AAGD,UAAM,YAAY,OAAO,WAAW;AACpC,aAAS,IAAI,WAAW,OAAO,MAAM;AAErC,WAAO,EAAE,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC5C,CAAC;AACH;;;AEvCA,IAAAC,cAA2D;AAGpD,SAAS,kBAAgC;AAC9C,aAAO,gCAAmB,CAAC,UAAU;AACnC,UAAM,WAAO,uBAAU,OAAO,eAAe;AAC7C,QAAI,CAAC,MAAM,WAAW,SAAS,GAAG;AAChC,gBAAM,yBAAY,EAAE,YAAY,KAAK,SAAS,0CAA0C,CAAC;AAAA,IAC3F;AAEA,UAAM,YAAY,KAAK,MAAM,UAAU,MAAM;AAC7C,UAAM,SAAS,SAAS,IAAI,SAAS;AACrC,QAAI,CAAC,QAAQ;AACX,gBAAM,yBAAY,EAAE,YAAY,KAAK,SAAS,6BAA6B,CAAC;AAAA,IAC9E;AAEA,WAAO;AAAA,EACT,CAAC;AACH;;;AClBA,IAAAC,eAAqC;AACrC,IAAAC,cAAmC;AAG5B,SAAS,sBAAsB,QAAgC;AACpE,aAAO,gCAAmB,MAAM;AAC9B,eAAO,mCAAqB;AAAA,MAC1B,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO,UAAU,OAAO;AAAA,MACrC,eAAe,CAAC,OAAO,WAAW;AAAA,IACpC,CAAC;AAAA,EACH,CAAC;AACH;;;AXEO,SAAS,YAAY,QAA8B;AACxD,QAAM,UAAM,uBAAU;AACtB,QAAM,aAAS,0BAAa;AAG5B,SAAO,IAAI,UAAU,mBAAmB,MAAM,CAAC;AAC/C,SAAO,IAAI,aAAa,sBAAsB,MAAM,CAAC;AACrD,SAAO,IAAI,OAAO,gBAAgB,CAAC;AACnC,SAAO,IAAI,+CAAkC,sBAAsB,MAAM,CAAC;AAG1E,SAAO,KAAK,cAAc,sBAAsB,MAAM,CAAC;AACvD,SAAO,IAAI,iBAAiB,yBAAyB,MAAM,CAAC;AAC5D,SAAO,IAAI,WAAW,mBAAmB,CAAC;AAG1C,SAAO,KAAK,2BAA2B,kCAAkC,MAAM,CAAC;AAChF,SAAO,IAAI,uBAAuB,8BAA8B,CAAC;AACjE,SAAO,KAAK,yBAAyB,gCAAgC,MAAM,CAAC;AAC5E,SAAO,IAAI,qBAAqB,4BAA4B,CAAC;AAE7D,MAAI,IAAI,MAAM;AACd,SAAO,EAAE,IAAI;AACf;","names":["import_h3","import_auth","import_grants","import_h3","import_node_crypto","import_h3","import_node_crypto","import_h3","import_h3","import_h3","import_h3","import_h3","import_auth","import_grants","RE_WHITESPACE","token","import_h3","import_jose","import_h3","import_grants","import_h3","import_grants","import_h3","VALID_GRANT_TYPES","import_h3","import_h3","import_h3","import_core","import_h3","import_auth","import_h3","import_auth","import_h3","import_h3","import_h3","import_h3","import_h3","import_h3","import_auth","import_h3","import_auth","import_h3","authHandleCallback","import_h3","import_auth","import_h3"]}