{"version":3,"sources":["../../src/createAuthlessClient.ts","../../../../node_modules/.pnpm/oauth4webapi@2.17.0/node_modules/oauth4webapi/build/index.js","../../src/throwIfError.ts","../../src/common.ts","../../src/createConfidentialOauthClient.ts","../../src/delay.ts","../../src/utils.ts","../../src/createPublicOauthClient.ts"],"names":["modifyAssertion","clockSkew","useMtlsAlias","jwt","clockTolerance","CustomEvent","TypedEventTarget","invariant","getToken"],"mappings":";;;;;;;;;;AAqBO,SAAS,oBAAA,GAAuB;AAErC,EAAA,OAAO,YAAY;AACjB,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;;;AC1BA,IAAI,UAAA;AACJ,IAAI,OAAO,cAAc,WAAA,IAAe,CAAC,UAAU,SAAA,EAAW,UAAA,GAAa,cAAc,CAAA,EAAG;AAC1F,EAAA,MAAM,IAAA,GAAO,cAAA;AACb,EAAA,MAAM,OAAA,GAAU,SAAA;AAChB,EAAA,UAAA,GAAa,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AACjC;AACA,SAAS,eAAA,CAAgB,OAAO,QAAA,EAAU;AACxC,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,KAAA,YAAiB,QAAA,IAAY,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,CAAE,MAAA,CAAO,WAAW,CAAA,KAAM,QAAA,CAAS,SAAA,CAAU,MAAA,CAAO,WAAW,CAAA;AAAA,EAChI,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AACO,IAAM,YAAY,MAAA,EAAO;AACzB,IAAM,iBAAiB,MAAA,EAAO;AAC9B,IAAM,cAAc,MAAA,EAAO;AAC3B,IAAM,kBAAkB,MAAA,EAAO;AAC/B,IAAM,aAAa,MAAA,EAAO;AAE1B,IAAM,eAAe,MAAA,EAAO;AACnC,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,SAAS,IAAI,KAAA,EAAO;AAClB,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,OAAA,CAAQ,OAAO,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,OAAO,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC7B;AACA,IAAM,UAAA,GAAa,KAAA;AACnB,SAAS,gBAAgB,KAAA,EAAO;AAC9B,EAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,IAAA,KAAA,GAAQ,IAAI,WAAW,KAAK,CAAA;AAAA,EAC9B;AACA,EAAA,MAAM,MAAM,EAAC;AACb,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,UAAA,EAAY,KAAK,UAAA,EAAY;AACrD,IAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,QAAA,CAAS,CAAA,EAAG,CAAA,GAAI,UAAU,CAAC,CAAC,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,KAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAC,EAAE,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA,CAAE,QAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AACpF;AACA,SAAS,gBAAgB,KAAA,EAAO;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA;AAClF,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,IAChC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,IAAI,mDAAA,EAAqD;AAAA,MACjE;AAAA,KACD,CAAA;AAAA,EACH;AACF;AACA,SAAS,KAAK,KAAA,EAAO;AACnB,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,gBAAgB,KAAK,CAAA;AAC9B;AACA,IAAM,MAAN,MAAU;AAAA,EACR,YAAY,OAAA,EAAS;AACnB,IAAA,IAAA,CAAK,KAAA,uBAAY,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,MAAA,uBAAa,GAAA,EAAI;AACtB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EACA,IAAI,GAAA,EAAK;AACP,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,IAAI,CAAA,EAAG;AACL,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AAC5B,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAClB,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EACA,IAAI,GAAA,EAAK;AACP,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAG,KAAK,IAAA,CAAK,MAAA,CAAO,IAAI,GAAG,CAAA;AAAA,EACnD;AAAA,EACA,GAAA,CAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EACA,OAAO,GAAA,EAAK;AACV,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA;AAAA,IAC9B;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACxB,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EACA,MAAA,CAAO,KAAK,KAAA,EAAO;AACjB,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACzB,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,IAAA,IAAQ,IAAA,CAAK,OAAA,EAAS;AACnC,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,KAAA;AACnB,MAAA,IAAA,CAAK,KAAA,uBAAY,GAAA,EAAI;AAAA,IACvB;AAAA,EACF;AACF,CAAA;AACO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAS;AACnB,IAAA,KAAA,CAAM,WAAW,yBAAyB,CAAA;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,KAAA,CAAM,iBAAA,GAAoB,IAAA,EAAM,IAAA,CAAK,WAAW,CAAA;AAAA,EAClD;AACF,CAAA;AACO,IAAM,wBAAA,GAAN,cAAuC,KAAA,CAAM;AAAA,EAClD,WAAA,CAAY,SAAS,OAAA,EAAS;AAC5B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,KAAA,CAAM,iBAAA,GAAoB,IAAA,EAAM,IAAA,CAAK,WAAW,CAAA;AAAA,EAClD;AACF,CAAA;AACA,IAAM,GAAA,GAAM,wBAAA;AACZ,IAAM,UAAA,GAAa,IAAI,GAAA,CAAI,GAAG,CAAA;AAC9B,SAAS,YAAY,GAAA,EAAK;AACxB,EAAA,OAAO,GAAA,YAAe,SAAA;AACxB;AACA,SAAS,aAAa,GAAA,EAAK;AACzB,EAAA,OAAO,WAAA,CAAY,GAAG,CAAA,IAAK,GAAA,CAAI,IAAA,KAAS,SAAA;AAC1C;AACA,SAAS,YAAY,GAAA,EAAK;AACxB,EAAA,OAAO,WAAA,CAAY,GAAG,CAAA,IAAK,GAAA,CAAI,IAAA,KAAS,QAAA;AAC1C;AAEA,SAAS,iBAAiB,QAAA,EAAU;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AAC/C,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,UAAA,CAAW,IAAI,IAAI,GAAA,CAAI,SAAS,GAAG,CAAA,CAAE,QAAQ,KAAK,CAAA;AAAA,IACpD;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAAC;AACT,EAAA,OAAO,QAAA;AACT;AAIA,SAAS,aAAa,KAAA,EAAO;AAC3B,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACvE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AACA,SAAS,eAAe,KAAA,EAAO;AAC7B,EAAA,IAAI,eAAA,CAAgB,KAAA,EAAO,OAAO,CAAA,EAAG;AACnC,IAAA,KAAA,GAAQ,MAAA,CAAO,WAAA,CAAY,KAAA,CAAM,OAAA,EAAS,CAAA;AAAA,EAC5C;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAK,CAAA;AACjC,EAAA,IAAI,UAAA,IAAc,CAAC,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,EAAG;AAC5C,IAAA,OAAA,CAAQ,GAAA,CAAI,cAAc,UAAU,CAAA;AAAA,EACtC;AACA,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,UAAU,oEAAoE,CAAA;AAAA,EAC1F;AACA,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,UAAU,2DAA2D,CAAA;AAAA,EACjF;AACA,EAAA,OAAO,OAAA;AACT;AACA,SAAS,OAAO,KAAA,EAAO;AACrB,EAAA,IAAI,OAAO,UAAU,UAAA,EAAY;AAC/B,IAAA,KAAA,GAAQ,KAAA,EAAM;AAAA,EAChB;AACA,EAAA,IAAI,EAAE,iBAAiB,WAAA,CAAA,EAAc;AACnC,IAAA,MAAM,IAAI,UAAU,+DAA+D,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,KAAA;AACT;AAiCA,SAAS,eAAe,KAAA,EAAO;AAC7B,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,CAAA;AACvD;AA+BA,SAAS,WAAA,GAAc;AACrB,EAAA,OAAO,KAAK,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAC,CAAA;AACxD;AACO,SAAS,0BAAA,GAA6B;AAC3C,EAAA,OAAO,WAAA,EAAY;AACrB;AACO,SAAS,mBAAA,GAAsB;AACpC,EAAA,OAAO,WAAA,EAAY;AACrB;AAIA,eAAsB,2BAA2B,YAAA,EAAc;AAC7D,EAAA,IAAI,CAAC,cAAA,CAAe,YAAY,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,SAAA,EAAW,GAAA,CAAI,YAAY,CAAC,CAAC,CAAA;AACtE;AACA,SAAS,aAAa,KAAA,EAAO;AAC3B,EAAA,IAAI,iBAAiB,SAAA,EAAW;AAC9B,IAAA,OAAO;AAAA,MACL,GAAA,EAAK;AAAA,KACP;AAAA,EACF;AACA,EAAA,IAAI,EAAE,KAAA,EAAO,GAAA,YAAe,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,IAAI,MAAM,GAAA,KAAQ,MAAA,IAAa,CAAC,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,UAAU,kCAAkC,CAAA;AAAA,EACxD;AACA,EAAA,OAAO;AAAA,IACL,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,eAAA,EAAiB,MAAM,eAAe;AAAA,GACxC;AACF;AACA,SAAS,cAAc,KAAA,EAAO;AAC5B,EAAA,OAAO,kBAAA,CAAmB,KAAK,CAAA,CAAE,OAAA,CAAQ,QAAQ,GAAG,CAAA;AACtD;AACA,SAAS,iBAAA,CAAkB,UAAU,YAAA,EAAc;AACjD,EAAA,MAAM,QAAA,GAAW,cAAc,QAAQ,CAAA;AACvC,EAAA,MAAM,QAAA,GAAW,cAAc,YAAY,CAAA;AAC3C,EAAA,MAAM,cAAc,IAAA,CAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAClD,EAAA,OAAO,SAAS,WAAW,CAAA,CAAA;AAC7B;AACA,SAAS,MAAM,GAAA,EAAK;AAClB,EAAA,QAAQ,GAAA,CAAI,SAAA,CAAU,IAAA,CAAK,IAAA;AAAM,IAC/B,KAAK,SAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT;AACE,MAAA,MAAM,IAAI,0BAA0B,6CAA6C,CAAA;AAAA;AAEvF;AACA,SAAS,MAAM,GAAA,EAAK;AAClB,EAAA,QAAQ,GAAA,CAAI,SAAA,CAAU,IAAA,CAAK,IAAA;AAAM,IAC/B,KAAK,SAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT;AACE,MAAA,MAAM,IAAI,0BAA0B,6CAA6C,CAAA;AAAA;AAEvF;AACA,SAAS,MAAM,GAAA,EAAK;AAClB,EAAA,QAAQ,GAAA,CAAI,UAAU,UAAA;AAAY,IAChC,KAAK,OAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT,KAAK,OAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT,KAAK,OAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT;AACE,MAAA,MAAM,IAAI,0BAA0B,uCAAuC,CAAA;AAAA;AAEjF;AACA,SAAS,SAAS,GAAA,EAAK;AACrB,EAAA,QAAQ,GAAA,CAAI,UAAU,IAAA;AAAM,IAC1B,KAAK,SAAA;AACH,MAAA,OAAO,MAAM,GAAG,CAAA;AAAA,IAClB,KAAK,mBAAA;AACH,MAAA,OAAO,MAAM,GAAG,CAAA;AAAA,IAClB,KAAK,OAAA;AACH,MAAA,OAAO,MAAM,GAAG,CAAA;AAAA,IAClB,KAAK,SAAA;AAAA,IACL,KAAK,OAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT;AACE,MAAA,MAAM,IAAI,0BAA0B,sCAAsC,CAAA;AAAA;AAEhF;AACA,SAAS,aAAa,MAAA,EAAQ;AAC5B,EAAA,MAAM,IAAA,GAAO,SAAS,SAAS,CAAA;AAC/B,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,QAAA,CAAS,IAAI,IAAI,IAAA,GAAO,CAAA;AACpE;AACA,SAAS,kBAAkB,MAAA,EAAQ;AACjC,EAAA,MAAM,SAAA,GAAY,SAAS,cAAc,CAAA;AACzC,EAAA,OAAO,OAAO,SAAA,KAAc,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,KAAM,EAAA,GAAK,SAAA,GAAY,EAAA;AAClH;AACA,SAAS,SAAA,GAAY;AACnB,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACrC;AACA,SAAS,eAAA,CAAgB,IAAI,MAAA,EAAQ;AACnC,EAAA,MAAM,GAAA,GAAM,SAAA,EAAU,GAAI,YAAA,CAAa,MAAM,CAAA;AAC7C,EAAA,OAAO;AAAA,IACL,KAAK,WAAA,EAAY;AAAA,IACjB,GAAA,EAAK,CAAC,EAAA,CAAG,MAAA,EAAQ,GAAG,cAAc,CAAA;AAAA,IAClC,KAAK,GAAA,GAAM,EAAA;AAAA,IACX,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK,GAAA;AAAA,IACL,KAAK,MAAA,CAAO,SAAA;AAAA,IACZ,KAAK,MAAA,CAAO;AAAA,GACd;AACF;AACA,eAAe,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,GAAA,EAAK,KAAKA,gBAAAA,EAAiB;AAClE,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,GAAA,EAAK,SAAS,GAAG,CAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,EAAA,EAAI,MAAM,CAAA;AAC1C,EAAAA,gBAAAA,GAAkB,QAAQ,OAAO,CAAA;AACjC,EAAA,OAAO,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AACjC;AACA,SAAS,SAAS,EAAA,EAAI;AACpB,EAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,EAAA,KAAO,IAAA,EAAM;AACzC,IAAA,MAAM,IAAI,UAAU,wBAAwB,CAAA;AAAA,EAC9C;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,EAAA,CAAG,MAAM,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,UAAU,iDAAiD,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,IAAA;AACT;AACA,SAAS,aAAa,MAAA,EAAQ;AAC5B,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,IAAA,MAAM,IAAI,UAAU,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,MAAA,CAAO,SAAS,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,UAAU,wDAAwD,CAAA;AAAA,EAC9E;AACA,EAAA,OAAO,IAAA;AACT;AACA,SAAS,mBAAmB,YAAA,EAAc;AACxC,EAAA,IAAI,CAAC,cAAA,CAAe,YAAY,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,UAAU,4DAA4D,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,YAAA;AACT;AACA,SAAS,wBAAA,CAAyB,kBAAkB,gBAAA,EAAkB;AACpE,EAAA,IAAI,qBAAqB,MAAA,EAAW;AAClC,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,8DAAA,EAAiE,gBAAgB,CAAA,sCAAA,CAAwC,CAAA;AAAA,EAC/I;AACF;AACA,SAAS,oBAAA,CAAqB,kBAAkB,YAAA,EAAc;AAC5D,EAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0DAAA,EAA6D,gBAAgB,CAAA,sCAAA,CAAwC,CAAA;AAAA,EAC3I;AACF;AACA,eAAe,oBAAA,CAAqB,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,SAAS,gBAAA,EAAkB;AAC/E,EAAA,IAAA,CAAK,OAAO,eAAe,CAAA;AAC3B,EAAA,IAAA,CAAK,OAAO,uBAAuB,CAAA;AACnC,EAAA,IAAA,CAAK,OAAO,kBAAkB,CAAA;AAC9B,EAAA,QAAQ,OAAO,0BAAA;AAA4B,IACzC,KAAK,MAAA;AAAA,IACL,KAAK,qBAAA,EACH;AACE,MAAA,wBAAA,CAAyB,uBAAuB,gBAAgB,CAAA;AAChE,MAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,iBAAA,CAAkB,MAAA,CAAO,WAAW,kBAAA,CAAmB,MAAA,CAAO,aAAa,CAAC,CAAC,CAAA;AAC1G,MAAA;AAAA,IACF;AAAA,IACF,KAAK,oBAAA,EACH;AACE,MAAA,wBAAA,CAAyB,sBAAsB,gBAAgB,CAAA;AAC/D,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,kBAAA,CAAmB,MAAA,CAAO,aAAa,CAAC,CAAA;AAClE,MAAA;AAAA,IACF;AAAA,IACF,KAAK,iBAAA,EACH;AACE,MAAA,oBAAA,CAAqB,iBAAA,EAAmB,OAAO,aAAa,CAAA;AAC5D,MAAA,IAAI,qBAAqB,MAAA,EAAW;AAClC,QAAA,MAAM,IAAI,UAAU,2GAA2G,CAAA;AAAA,MACjI;AACA,MAAA,MAAM;AAAA,QACJ,GAAA;AAAA,QACA,GAAA;AAAA,QACA,eAAA,EAAAA;AAAA,OACF,GAAI,aAAa,gBAAgB,CAAA;AACjC,MAAA,IAAI,CAAC,YAAA,CAAa,GAAG,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,UAAU,4DAA4D,CAAA;AAAA,MAClF;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,IAAA,CAAK,GAAA,CAAI,yBAAyB,wDAAwD,CAAA;AAC1F,MAAA,IAAA,CAAK,GAAA,CAAI,oBAAoB,MAAM,aAAA,CAAc,IAAI,MAAA,EAAQ,GAAA,EAAK,GAAA,EAAKA,gBAAe,CAAC,CAAA;AACvF,MAAA;AAAA,IACF;AAAA,IACF,KAAK,iBAAA;AAAA,IACL,KAAK,6BAAA;AAAA,IACL,KAAK,MAAA,EACH;AACE,MAAA,oBAAA,CAAqB,MAAA,CAAO,0BAAA,EAA4B,MAAA,CAAO,aAAa,CAAA;AAC5E,MAAA,wBAAA,CAAyB,MAAA,CAAO,4BAA4B,gBAAgB,CAAA;AAC5E,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA;AAAA,IACF;AAAA,IACF;AACE,MAAA,MAAM,IAAI,0BAA0B,+CAA+C,CAAA;AAAA;AAEzF;AACA,eAAe,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,GAAA,EAAK;AACvC,EAAA,IAAI,CAAC,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,UAAU,uFAAuF,CAAA;AAAA,EAC7G;AACA,EAAA,MAAM,QAAQ,CAAA,EAAG,IAAA,CAAK,IAAI,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAC,CAAC,CAAA,CAAA,EAAI,KAAK,GAAA,CAAI,IAAA,CAAK,UAAU,OAAO,CAAC,CAAC,CAAC,CAAA,CAAA;AACxF,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA,EAAG,GAAA,EAAK,GAAA,CAAI,KAAK,CAAC,CAAC,CAAA;AAClF,EAAA,OAAO,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAC9B;AA2EA,eAAe,aAAa,OAAA,EAAS,OAAA,EAAS,GAAA,EAAK,GAAA,EAAKC,YAAW,WAAA,EAAa;AAC9E,EAAA,MAAM;AAAA,IACJ,UAAA;AAAA,IACA,SAAA;AAAA,IACA,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,MAAM;AAAA,GACnC,GAAI,OAAA;AACJ,EAAA,IAAI,CAAC,YAAA,CAAa,UAAU,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,UAAU,+CAA+C,CAAA;AAAA,EACrE;AACA,EAAA,IAAI,CAAC,WAAA,CAAY,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,UAAU,6CAA6C,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AACjD,IAAA,MAAM,IAAI,UAAU,sDAAsD,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,CAAC,UAAU,WAAA,EAAa;AAC1B,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACjE;AACA,EAAA,MAAM,GAAA,GAAM,WAAU,GAAIA,UAAAA;AAC1B,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,GAAA,EAAK,SAAS,UAAU,CAAA;AAAA,IACxB,GAAA,EAAK,UAAA;AAAA,IACL,GAAA,EAAK,MAAM,SAAA,CAAU,SAAS;AAAA,GAChC;AACA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAA,EAAK,GAAA;AAAA,IACL,KAAK,WAAA,EAAY;AAAA,IACjB,GAAA;AAAA,IACA,KAAA;AAAA,IACA,KAAK,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,IACjC,GAAA,EAAmF;AAAA,GACrF;AACA,EAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,MAAA,EAAQ,OAAO,CAAA;AAC1C,EAAA,OAAA,CAAQ,IAAI,MAAA,EAAQ,MAAM,IAAI,MAAA,EAAQ,OAAA,EAAS,UAAU,CAAC,CAAA;AAC5D;AACA,IAAI,QAAA;AACJ,eAAe,qBAAqB,GAAA,EAAK;AACvC,EAAA,MAAM;AAAA,IACJ,GAAA;AAAA,IACA,CAAA;AAAA,IACA,CAAA;AAAA,IACA,CAAA;AAAA,IACA,CAAA;AAAA,IACA;AAAA,MACE,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,GAAG,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM;AAAA,IACV,GAAA;AAAA,IACA,CAAA;AAAA,IACA,CAAA;AAAA,IACA,CAAA;AAAA,IACA,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,QAAA,CAAS,GAAA,CAAI,KAAK,GAAG,CAAA;AACrB,EAAA,OAAO,GAAA;AACT;AACA,eAAe,UAAU,GAAA,EAAK;AAC5B,EAAA,QAAA,KAAa,QAAA,uBAAe,OAAA,EAAQ,CAAA;AACpC,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,IAAK,qBAAqB,GAAG,CAAA;AACtD;AACA,SAAS,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAUC,aAAAA,EAAc;AACvD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAIA,aAAAA,EAAc;AAChB,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0BAAA,EAA6B,QAAQ,CAAA,kBAAA,CAAoB,CAAA;AAAA,IAC/E;AACA,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,IAAA,EAAO,QAAQ,CAAA,kBAAA,CAAoB,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,IAAI,IAAI,KAAK,CAAA;AACtB;AACA,SAAS,eAAA,CAAgB,EAAA,EAAI,QAAA,EAAUA,aAAAA,GAAe,KAAA,EAAO;AAC3D,EAAA,IAAIA,aAAAA,IAAgB,EAAA,CAAG,qBAAA,IAAyB,QAAA,IAAY,GAAG,qBAAA,EAAuB;AACpF,IAAA,OAAO,iBAAiB,EAAA,CAAG,qBAAA,CAAsB,QAAQ,CAAA,EAAG,UAAUA,aAAY,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,gBAAA,CAAiB,EAAA,CAAG,QAAQ,CAAA,EAAG,UAAUA,aAAY,CAAA;AAC9D;AACA,SAAS,KAAA,CAAM,QAAQ,OAAA,EAAS;AAC9B,EAAA,IAAI,MAAA,CAAO,yBAAA,IAA6B,OAAA,GAAU,YAAY,CAAA,EAAG;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAcO,SAAS,cAAc,KAAA,EAAO;AACnC,EAAA,MAAM,KAAA,GAAQ,KAAA;AACd,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,CAAM,QAAQ,KAAK,CAAA,IAAK,UAAU,IAAA,EAAM;AACvE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAM,KAAA,KAAU,MAAA;AACzB;AAuTA,eAAe,qBAAqB,EAAA,EAAI,MAAA,EAAQ,QAAQ,GAAA,EAAK,IAAA,EAAM,SAAS,OAAA,EAAS;AACnF,EAAA,MAAM,qBAAqB,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,SAAS,gBAAgB,CAAA;AAC/E,EAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,iDAAiD,CAAA;AAC7E,EAAA,OAAA,CAAQ,OAAA,GAAU,WAAW,CAAA,IAAK,KAAA,EAAO,IAAI,IAAA,EAAM;AAAA,IACjD,IAAA;AAAA,IACA,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC7C,MAAA;AAAA,IACA,QAAA,EAAU,QAAA;AAAA,IACV,QAAQ,OAAA,EAAS,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,GAAI;AAAA,GACpD,CAAA,CAAE,IAAA,CAAK,gBAAgB,CAAA;AAC1B;AACA,eAAe,oBAAA,CAAqB,EAAA,EAAI,MAAA,EAAQ,SAAA,EAAW,YAAY,OAAA,EAAS;AAC9E,EAAA,MAAM,MAAM,eAAA,CAAgB,EAAA,EAAI,kBAAkB,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAC,CAAA;AACxE,EAAA,UAAA,CAAW,GAAA,CAAI,cAAc,SAAS,CAAA;AACtC,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,OAAA,EAAS,OAAO,CAAA;AAC/C,EAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,kBAAkB,CAAA;AACxC,EAAA,IAAI,OAAA,EAAS,SAAS,MAAA,EAAW;AAC/B,IAAA,MAAM,YAAA,CAAa,SAAS,OAAA,CAAQ,IAAA,EAAM,KAAK,MAAA,EAAQ,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,qBAAqB,EAAA,EAAI,MAAA,EAAQ,QAAQ,GAAA,EAAK,UAAA,EAAY,SAAS,OAAO,CAAA;AACnF;AACA,eAAsB,wBAAA,CAAyB,EAAA,EAAI,MAAA,EAAQ,YAAA,EAAc,OAAA,EAAS;AAChF,EAAA,QAAA,CAAS,EAAE,CAAA;AACX,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,IAAI,CAAC,cAAA,CAAe,YAAY,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACjE;AACA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,CAAgB,OAAA,EAAS,oBAAoB,CAAA;AACpE,EAAA,UAAA,CAAW,GAAA,CAAI,iBAAiB,YAAY,CAAA;AAC5C,EAAA,OAAO,oBAAA,CAAqB,EAAA,EAAI,MAAA,EAAQ,eAAA,EAAiB,YAAY,OAAO,CAAA;AAC9E;AACA,IAAM,aAAA,uBAAoB,OAAA,EAAQ;AAsDlC,eAAe,kCAAkC,EAAA,EAAI,MAAA,EAAQ,UAAU,aAAA,GAAgB,KAAA,EAAO,qBAAqB,KAAA,EAAO;AACxH,EAAA,QAAA,CAAS,EAAE,CAAA;AACX,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,IAAI,CAAC,eAAA,CAAgB,QAAA,EAAU,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,UAAU,4CAA4C,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,GAAA,GAAM,MAAM,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AAC9C,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,IAAI,qDAAqD,CAAA;AAAA,EACrE;AACA,EAAA,sBAAA,CAAuB,QAAQ,CAAA;AAC/B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,IAAI,yCAAA,EAA2C;AAAA,MACvD;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,YAAA,CAAa,IAAI,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,IAAI,4CAA4C,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,YAAY,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,IAAI,oEAAoE,CAAA;AAAA,EACpF;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,UAAU,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,IAAI,kEAAkE,CAAA;AAAA,EAClF;AACA,EAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,WAAA,EAAY;AAC9C,EAAA,IAAI,IAAA,CAAK,UAAA,KAAe,MAAA,IAAU,IAAA,CAAK,eAAe,QAAA,EAAU;AAC9D,IAAA,MAAM,IAAI,0BAA0B,gCAAgC,CAAA;AAAA,EACtE;AACA,EAAA,IAAI,IAAA,CAAK,eAAe,MAAA,KAAc,OAAO,KAAK,UAAA,KAAe,QAAA,IAAY,IAAA,CAAK,UAAA,IAAc,CAAA,CAAA,EAAI;AAClG,IAAA,MAAM,IAAI,IAAI,iEAAiE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,CAAC,sBAAsB,IAAA,CAAK,aAAA,KAAkB,UAAa,CAAC,cAAA,CAAe,IAAA,CAAK,aAAa,CAAA,EAAG;AAClG,IAAA,MAAM,IAAI,IAAI,qEAAqE,CAAA;AAAA,EACrF;AACA,EAAA,IAAI,KAAK,KAAA,KAAU,MAAA,IAAa,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC9D,IAAA,MAAM,IAAI,IAAI,mDAAmD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,IAAI,KAAK,QAAA,KAAa,MAAA,IAAa,CAAC,cAAA,CAAe,IAAA,CAAK,QAAQ,CAAA,EAAG;AACjE,MAAA,MAAM,IAAI,IAAI,gEAAgE,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,MAAM;AAAA,QACJ,MAAA;AAAA,QACA,GAAA,EAAAC;AAAA,OACF,GAAI,MAAM,WAAA,CAAY,IAAA,CAAK,UAAU,qBAAA,CAAsB,IAAA,CAAK,MAAA,EAAW,MAAA,CAAO,4BAAA,EAA8B,EAAA,CAAG,qCAAqC,CAAA,EAAG,gBAAA,EAAkB,YAAA,CAAa,MAAM,CAAA,EAAG,iBAAA,CAAkB,MAAM,CAAA,EAAG,MAAA,CAAO,UAAU,CAAC,CAAA,CAAE,IAAA,CAAK,iBAAiB,IAAA,CAAK,MAAA,EAAW,CAAC,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,OAAO,KAAK,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,cAAA,CAAe,KAAK,MAAA,EAAW,EAAA,CAAG,MAAM,CAAC,CAAA,CAAE,IAAA,CAAK,iBAAiB,IAAA,CAAK,MAAA,EAAW,MAAA,CAAO,SAAS,CAAC,CAAA;AACra,MAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,CAAO,GAAG,KAAK,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA,EAAG;AACxD,QAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,UAAA,MAAM,IAAI,IAAI,yEAAyE,CAAA;AAAA,QACzF;AACA,QAAA,IAAI,MAAA,CAAO,GAAA,KAAQ,MAAA,CAAO,SAAA,EAAW;AACnC,UAAA,MAAM,IAAI,IAAI,0DAA0D,CAAA;AAAA,QAC1E;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAA,KAAc,MAAA,KAAc,CAAC,OAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,IAAK,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,SAAS,MAAM,CAAA,CAAA,EAAI;AAC/G,QAAA,MAAM,IAAI,IAAI,sEAAsE,CAAA;AAAA,MACtF;AACA,MAAA,aAAA,CAAc,GAAA,CAAI,IAAA,EAAM,CAAC,MAAA,EAAQA,IAAG,CAAC,CAAA;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAUA,SAAS,gBAAA,CAAiB,UAAU,MAAA,EAAQ;AAC1C,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,EAAG;AACpC,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,GAAA,CAAI,QAAA,CAAS,QAAQ,CAAA,EAAG;AACzC,MAAA,MAAM,IAAI,IAAI,6CAA6C,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA,MAAA,IAAW,MAAA,CAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AACzC,IAAA,MAAM,IAAI,IAAI,6CAA6C,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,cAAA,CAAe,UAAU,MAAA,EAAQ;AACxC,EAAA,IAAI,MAAA,CAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,IAAA,MAAM,IAAI,IAAI,2CAA2C,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,MAAA;AACT;AACA,IAAM,OAAA,uBAAc,OAAA,EAAQ;AAC5B,SAAS,MAAM,YAAA,EAAc;AAC3B,EAAA,OAAA,CAAQ,IAAI,YAAY,CAAA;AACxB,EAAA,OAAO,YAAA;AACT;AACA,eAAsB,8BAA8B,EAAA,EAAI,MAAA,EAAQ,kBAAA,EAAoB,WAAA,EAAa,cAAc,OAAA,EAAS;AACtH,EAAA,QAAA,CAAS,EAAE,CAAA;AACX,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,UAAU,mIAAmI,CAAA;AAAA,EACzJ;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,WAAW,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,UAAU,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,YAAY,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACjE;AACA,EAAA,MAAM,IAAA,GAAO,qBAAA,CAAsB,kBAAA,EAAoB,MAAM,CAAA;AAC7D,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,IAAI,IAAI,+CAA+C,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,CAAgB,OAAA,EAAS,oBAAoB,CAAA;AACpE,EAAA,UAAA,CAAW,GAAA,CAAI,gBAAgB,WAAW,CAAA;AAC1C,EAAA,UAAA,CAAW,GAAA,CAAI,iBAAiB,YAAY,CAAA;AAC5C,EAAA,UAAA,CAAW,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC3B,EAAA,OAAO,oBAAA,CAAqB,EAAA,EAAI,MAAA,EAAQ,oBAAA,EAAsB,YAAY,OAAO,CAAA;AACnF;AACA,IAAM,aAAA,GAAgB;AAAA,EACpB,GAAA,EAAK,UAAA;AAAA,EACL,MAAA,EAAQ,WAAA;AAAA,EACR,SAAA,EAAW,WAAA;AAAA,EACX,GAAA,EAAK,iBAAA;AAAA,EACL,GAAA,EAAK,WAAA;AAAA,EACL,GAAA,EAAK,QAAA;AAAA,EACL,GAAA,EAAK,QAAA;AAAA,EACL,KAAA,EAAO,OAAA;AAAA,EACP,MAAA,EAAQ,YAAA;AAAA,EACR,GAAA,EAAK,SAAA;AAAA,EACL,GAAA,EAAK,mBAAA;AAAA,EACL,GAAA,EAAK,aAAA;AAAA,EACL,GAAA,EAAK,UAAA;AAAA,EACL,GAAA,EAAK;AACP,CAAA;AACA,SAAS,gBAAA,CAAiB,UAAU,MAAA,EAAQ;AAC1C,EAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,KAAM,MAAA,EAAW;AACtC,MAAA,MAAM,IAAI,IAAI,CAAA,KAAA,EAAQ,KAAK,MAAM,aAAA,CAAc,KAAK,CAAC,CAAA,eAAA,CAAiB,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AA8CA,eAAsB,sCAAA,CAAuC,EAAA,EAAI,MAAA,EAAQ,QAAA,EAAU;AACjF,EAAA,MAAM,SAAS,MAAM,iCAAA,CAAkC,EAAA,EAAI,MAAA,EAAQ,UAAU,IAAI,CAAA;AACjF,EAAA,IAAI,aAAA,CAAc,MAAM,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAW;AACjC,IAAA,IAAI,OAAO,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,MAAA,CAAO,SAAS,MAAA,EAAQ;AACjE,MAAA,MAAM,IAAI,IAAI,mHAAmH,CAAA;AAAA,IACnI;AACA,IAAA,OAAO,MAAA,CAAO,QAAA;AAAA,EAChB;AACA,EAAA,OAAO,MAAA;AACT;AAOA,eAAsB,6BAAA,CAA8B,EAAA,EAAI,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAS;AACnF,EAAA,QAAA,CAAS,EAAE,CAAA;AACX,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,OAAO,oBAAA,CAAqB,IAAI,MAAA,EAAQ,oBAAA,EAAsB,IAAI,eAAA,CAAgB,UAAU,GAAG,OAAO,CAAA;AACxG;AASA,eAAsB,gCAAA,CAAiC,EAAA,EAAI,MAAA,EAAQ,QAAA,EAAU;AAC3E,EAAA,MAAM,SAAS,MAAM,iCAAA,CAAkC,IAAI,MAAA,EAAQ,QAAA,EAAU,MAAM,IAAI,CAAA;AACvF,EAAA,IAAI,aAAA,CAAc,MAAM,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;AACA,eAAsB,iBAAA,CAAkB,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS;AAClE,EAAA,QAAA,CAAS,EAAE,CAAA;AACX,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,UAAU,oCAAoC,CAAA;AAAA,EAC1D;AACA,EAAA,MAAM,MAAM,eAAA,CAAgB,EAAA,EAAI,uBAAuB,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAC,CAAA;AAC7E,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,oBAAoB,CAAA;AAC9D,EAAA,IAAA,CAAK,GAAA,CAAI,SAAS,KAAK,CAAA;AACvB,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,OAAA,EAAS,OAAO,CAAA;AAC/C,EAAA,OAAA,CAAQ,OAAO,QAAQ,CAAA;AACvB,EAAA,OAAO,qBAAqB,EAAA,EAAI,MAAA,EAAQ,QAAQ,GAAA,EAAK,IAAA,EAAM,SAAS,OAAO,CAAA;AAC7E;AACA,eAAsB,0BAA0B,QAAA,EAAU;AACxD,EAAA,IAAI,CAAC,eAAA,CAAgB,QAAA,EAAU,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,UAAU,4CAA4C,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,GAAA,GAAM,MAAM,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AAC9C,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,IAAI,0DAA0D,CAAA;AAAA,EAC1E;AACA,EAAA,OAAO,MAAA;AACT;AACA,SAAS,uBAAuB,QAAA,EAAU;AACxC,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,MAAM,IAAI,UAAU,uCAAuC,CAAA;AAAA,EAC7D;AACF;AAqGA,eAAe,qBAAqB,QAAA,EAAU;AAC5C,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,GAAA,IAAO,QAAA,CAAS,SAAS,GAAA,EAAK;AAClD,IAAA,sBAAA,CAAuB,QAAQ,CAAA;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,IAAI,YAAA,CAAa,IAAI,CAAA,IAAK,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ;AAC7E,QAAA,IAAI,KAAK,iBAAA,KAAsB,KAAA,CAAA,IAAa,OAAO,IAAA,CAAK,sBAAsB,QAAA,EAAU;AACtF,UAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,QACd;AACA,QAAA,IAAI,KAAK,SAAA,KAAc,KAAA,CAAA,IAAa,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACtE,UAAA,OAAO,IAAA,CAAK,SAAA;AAAA,QACd;AACA,QAAA,IAAI,KAAK,IAAA,KAAS,KAAA,CAAA,IAAa,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AAC5D,UAAA,OAAO,IAAA,CAAK,IAAA;AAAA,QACd;AACA,QAAA,IAAI,KAAK,KAAA,KAAU,KAAA,CAAA,IAAa,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC9D,UAAA,OAAO,IAAA,CAAK,KAAA;AAAA,QACd;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,qBAAqB,SAAA,EAAW;AACvC,EAAA,IAAI,OAAO,SAAA,CAAU,aAAA,KAAkB,QAAA,IAAY,SAAA,CAAU,gBAAgB,IAAA,EAAM;AACjF,IAAA,MAAM,IAAI,GAAA,CAAI,CAAA,EAAG,SAAA,CAAU,IAAI,CAAA,yCAAA,CAA2C,CAAA;AAAA,EAC5E;AACF;AACA,SAAS,cAAc,UAAA,EAAY;AACjC,EAAA,QAAQ,UAAA;AAAY,IAClB,KAAK,OAAA;AACH,MAAA,OAAO,SAAA;AAAA,IACT,KAAK,OAAA;AACH,MAAA,OAAO,SAAA;AAAA,IACT,KAAK,OAAA;AACH,MAAA,OAAO,SAAA;AAAA,IACT;AACE,MAAA,MAAM,IAAI,yBAAA,EAA0B;AAAA;AAE1C;AACA,SAAS,YAAY,GAAA,EAAK;AACxB,EAAA,QAAQ,GAAA,CAAI,UAAU,IAAA;AAAM,IAC1B,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,IAAI,SAAA,CAAU,IAAA;AAAA,QACpB,IAAA,EAAM,aAAA,CAAc,GAAA,CAAI,SAAA,CAAU,UAAU;AAAA,OAC9C;AAAA,IACF,KAAK,SAAA,EACH;AACE,MAAA,oBAAA,CAAqB,IAAI,SAAS,CAAA;AAClC,MAAA,QAAQ,GAAA,CAAI,SAAA,CAAU,IAAA,CAAK,IAAA;AAAM,QAC/B,KAAK,SAAA;AAAA,QACL,KAAK,SAAA;AAAA,QACL,KAAK,SAAA;AACH,UAAA,OAAO;AAAA,YACL,IAAA,EAAM,IAAI,SAAA,CAAU,IAAA;AAAA,YACpB,UAAA,EAAY,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,IAAA,CAAK,KAAK,KAAA,CAAM,EAAE,CAAA,EAAG,EAAE,CAAA,IAAK;AAAA,WACjE;AAAA,QACF;AACE,UAAA,MAAM,IAAI,yBAAA,EAA0B;AAAA;AACxC,IACF;AAAA,IACF,KAAK,mBAAA;AACH,MAAA,oBAAA,CAAqB,IAAI,SAAS,CAAA;AAClC,MAAA,OAAO,IAAI,SAAA,CAAU,IAAA;AAAA,IACvB,KAAK,OAAA;AAAA,IACL,KAAK,SAAA;AACH,MAAA,OAAO,IAAI,SAAA,CAAU,IAAA;AAAA;AAEzB,EAAA,MAAM,IAAI,yBAAA,EAA0B;AACtC;AACA,IAAM,mBAAmB,MAAA,EAAO;AAChC,eAAe,oBAAA,CAAqB,eAAA,EAAiB,OAAA,EAAS,GAAA,EAAK,SAAA,EAAW;AAC5E,EAAA,MAAM,KAAA,GAAQ,CAAA,EAAG,eAAe,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAC3C,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,GAAG,CAAA,EAAG,GAAA,EAAK,SAAA,EAAW,GAAA,CAAI,KAAK,CAAC,CAAA;AACxF,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,IAAI,IAAI,mCAAmC,CAAA;AAAA,EACnD;AACF;AACA,eAAe,YAAY,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQF,UAAAA,EAAWG,iBAAgB,UAAA,EAAY;AACvF,EAAA,IAAI;AAAA,IACF,CAAA,EAAG,eAAA;AAAA,IACH,CAAA,EAAG,OAAA;AAAA,IACH,CAAA,EAAG,gBAAA;AAAA,IACH;AAAA,GACF,GAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AACjB,EAAA,IAAI,WAAW,CAAA,EAAG;AAChB,IAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,MAAA,GAAA,GAAM,MAAM,WAAW,GAAG,CAAA;AAC1B,MAAA,CAAC;AAAA,QACC,CAAA,EAAG,eAAA;AAAA,QACH,CAAA,EAAG,OAAA;AAAA,QACH,CAAA,EAAG,gBAAA;AAAA,QACH;AAAA,OACF,GAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AAAA,IACnB,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,0BAA0B,sCAAsC,CAAA;AAAA,IAC5E;AAAA,EACF;AACA,EAAA,IAAI,WAAW,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,eAAe,CAAC,CAAC,CAAA;AAAA,EAChD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,IAAI,2DAAA,EAA6D;AAAA,MACzE;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,YAAA,CAAa,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAI,IAAI,uCAAuC,CAAA;AAAA,EACvD;AACA,EAAA,QAAA,CAAS,MAAM,CAAA;AACf,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAW;AAC7B,IAAA,MAAM,IAAI,IAAI,wCAAwC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,SAAA,GAAY,KAAK,gBAAgB,CAAA;AACvC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,WAAW,gBAAA,EAAkB;AAC/B,IAAA,GAAA,GAAM,MAAM,OAAO,MAAM,CAAA;AACzB,IAAA,MAAM,oBAAA,CAAqB,eAAA,EAAiB,OAAA,EAAS,GAAA,EAAK,SAAS,CAAA;AAAA,EACrE;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAC,CAAC,CAAA;AAAA,EACxC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,IAAI,4DAAA,EAA8D;AAAA,MAC1E;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,YAAA,CAAa,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAI,IAAI,wCAAwC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,GAAA,GAAM,WAAU,GAAIH,UAAAA;AAC1B,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,IAAI,mDAAmD,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,IAAO,GAAA,GAAMG,eAAAA,EAAgB;AACtC,MAAA,MAAM,IAAI,IAAI,2EAA2E,CAAA;AAAA,IAC3F;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,IAAI,6CAA6C,CAAA;AAAA,IAC7D;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,IAAI,0CAA0C,CAAA;AAAA,IAC1D;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,IAAI,8CAA8C,CAAA;AAAA,IAC9D;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,GAAM,GAAA,GAAMA,eAAAA,EAAgB;AACrC,MAAA,MAAM,IAAI,IAAI,qEAAqE,CAAA;AAAA,IACrF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,IAAI,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA,EAAG;AAChE,MAAA,MAAM,IAAI,IAAI,4CAA4C,CAAA;AAAA,IAC5D;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA,EAAK;AAAA,GACP;AACF;AAyJA,SAAS,qBAAA,CAAsB,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ;AACrD,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,MAAA,MAAM,IAAI,IAAI,uCAAuC,CAAA;AAAA,IACvD;AACA,IAAA;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,EAAG;AAChC,MAAA,MAAM,IAAI,IAAI,uCAAuC,CAAA;AAAA,IACvD;AACA,IAAA;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAQ,OAAA,EAAS;AAC1B,IAAA,MAAM,IAAI,IAAI,uCAAuC,CAAA;AAAA,EACvD;AACF;AACA,SAAS,qBAAA,CAAsB,YAAY,IAAA,EAAM;AAC/C,EAAA,MAAM;AAAA,IACJ,CAAA,EAAG,KAAA;AAAA,IACH;AAAA,GACF,GAAI,UAAA,CAAW,MAAA,CAAO,IAAI,CAAA;AAC1B,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,IAAI,GAAA,CAAI,CAAA,CAAA,EAAI,IAAI,CAAA,sCAAA,CAAwC,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,KAAA;AACT;AACO,IAAM,iBAAiB,MAAA,EAAO;AAC9B,IAAM,gBAAgB,MAAA,EAAO;AAC7B,SAAS,oBAAA,CAAqB,EAAA,EAAI,MAAA,EAAQ,UAAA,EAAY,aAAA,EAAe;AAC1E,EAAA,QAAA,CAAS,EAAE,CAAA;AACX,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,IAAI,sBAAsB,GAAA,EAAK;AAC7B,IAAA,UAAA,GAAa,UAAA,CAAW,YAAA;AAAA,EAC1B;AACA,EAAA,IAAI,EAAE,sBAAsB,eAAA,CAAA,EAAkB;AAC5C,IAAA,MAAM,IAAI,UAAU,6DAA6D,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,qBAAA,CAAsB,UAAA,EAAY,UAAU,CAAA,EAAG;AACjD,IAAA,MAAM,IAAI,IAAI,wGAAwG,CAAA;AAAA,EACxH;AACA,EAAA,MAAM,GAAA,GAAM,qBAAA,CAAsB,UAAA,EAAY,KAAK,CAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,qBAAA,CAAsB,UAAA,EAAY,OAAO,CAAA;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,EAAA,CAAG,8CAAA,EAAgD;AAC7D,IAAA,MAAM,IAAI,IAAI,2CAA2C,CAAA;AAAA,EAC3D;AACA,EAAA,IAAI,GAAA,IAAO,GAAA,KAAQ,EAAA,CAAG,MAAA,EAAQ;AAC5B,IAAA,MAAM,IAAI,IAAI,oDAAoD,CAAA;AAAA,EACpE;AACA,EAAA,QAAQ,aAAA;AAAe,IACrB,KAAK,MAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,MAAM,IAAI,IAAI,mDAAmD,CAAA;AAAA,MACnE;AACA,MAAA;AAAA,IACF,KAAK,cAAA;AACH,MAAA;AAAA,IACF;AACE,MAAA,IAAI,CAAC,cAAA,CAAe,aAAa,CAAA,EAAG;AAClC,QAAA,MAAM,IAAI,IAAI,4CAA4C,CAAA;AAAA,MAC5D;AACA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,MAAM,IAAI,IAAI,oCAAoC,CAAA;AAAA,MACpD;AACA,MAAA,IAAI,UAAU,aAAA,EAAe;AAC3B,QAAA,MAAM,IAAI,IAAI,6CAA6C,CAAA;AAAA,MAC7D;AAAA;AAEJ,EAAA,MAAM,KAAA,GAAQ,qBAAA,CAAsB,UAAA,EAAY,OAAO,CAAA;AACvD,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO;AAAA,MACL,KAAA;AAAA,MACA,iBAAA,EAAmB,qBAAA,CAAsB,UAAA,EAAY,mBAAmB,CAAA;AAAA,MACxE,SAAA,EAAW,qBAAA,CAAsB,UAAA,EAAY,WAAW;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,UAAA,EAAY,UAAU,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAQ,qBAAA,CAAsB,UAAA,EAAY,OAAO,CAAA;AACvD,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,KAAA,KAAU,MAAA,EAAW;AACjD,IAAA,MAAM,IAAI,0BAA0B,6CAA6C,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,KAAA,CAAM,IAAI,eAAA,CAAgB,UAAU,CAAC,CAAA;AAC9C;;;ACrwDO,SAAS,aAAa,MAAA,EAAQ;AACnC,EAAA,IAAI,aAAA,CAAc,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA;AACT;;;ACAA,IAAM,WAAA,GAA0E,WAAW,WAAA,IAAe,MAAMC,qBAAoB,KAAA,CAAM;AAAA,EACxI,OAAA;AAAA,EACA,WAAA,CAAY,MAAM,OAAA,EAAS;AACzB,IAAA,KAAA,CAAM,MAAM,OAAO,CAAA;AACnB,IAAA,IAAA,CAAK,OAAA,GAAU,SAAS,MAAA,IAAU,IAAA;AAAA,EACpC;AAAA,EACA,IAAI,MAAA,GAAS;AACX,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AACF,CAAA;AAUA,SAAS,gBAAgB,MAAA,EAAQ;AAC/B,EAAA,OAAO,CAAA,wBAAA,EAA2B,OAAO,SAAS,CAAA,CAAA;AACpD;AAQO,SAAS,WAAW,WAAA,EAAa;AACtC,EAAA,IAAI,WAAA,KAAgB,QAAQ,OAAO,MAAA;AAGnC,EAAsC;AACpC,IAAA,OAAO,MAAA;AAAA,EACT;AAGF;AACO,SAAS,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,OAAA,EAAS;AAC5C,EAAA,OAAA,EAAS,QAAQ,eAAA,CAAgB,MAAM,GAAG,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA;AAC7D;AACO,SAAS,WAAA,CAAY,QAAQ,OAAA,EAAS;AAC3C,EAAA,OAAA,EAAS,UAAA,CAAW,eAAA,CAAgB,MAAM,CAAC,CAAA;AAC7C;AACO,SAAS,SAAA,CAAU,QAAQ,OAAA,EAAS;AACzC,EAAA,OAAO,IAAA,CAAK,MAAM,OAAA,EAAS,OAAA,CAAQ,gBAAgB,MAAM,CAAC,KAAK,IAAI,CAAA;AACrE;AACO,SAAS,WAAA,CAAY,QAAQ,CAAA,EAAG;AAErC,EAAA,UAAA,CAAW,cAAA,EAAgB,QAAQ,eAAA,CAAgB,MAAM,GAAG,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA;AAC/E;AACO,SAAS,cAAc,MAAA,EAAQ;AAEpC,EAAA,UAAA,CAAW,cAAA,EAAgB,UAAA,CAAW,eAAA,CAAgB,MAAM,CAAC,CAAA;AAC/D;AACO,SAAS,YAAY,MAAA,EAAQ;AAClC,EAAA,OAAO,IAAA,CAAK,KAAA;AAAA;AAAA,IAEZ,WAAW,cAAA,EAAgB,OAAA,CAAQ,eAAA,CAAgB,MAAM,CAAC,CAAA,IAAK;AAAA,GAAI;AACrE;AACO,SAAS,MAAA,CAAO,QAAQ,EAAA,EAAI,OAAA,EAAS,kBAAkB,OAAA,EAAS,kBAAA,EAAoB,QAAQ,OAAA,EAAS;AAC1G,EAAA,IAAI,KAAA;AACJ,EAAA,MAAM,WAAA,GAAc,IAAIC,sCAAA,EAAiB;AACzC,EAAA,SAAS,uBAAA,CAAwB,MAAM,IAAA,EAAM;AAC3C,IAAA,MAAM;AAAA,MACJ,aAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACF,GAAI,IAAA;AACJ,IAAA,EAAE,UAAA,IAAc,IAAA,CAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,GAAeC,2BAAA,CAAU,KAAK,CAAA,GAAIA,2BAAA,CAAU,KAAK,CAAA,GAAI,MAAA;AACtG,IAAA,SAAA,CAAU,MAAA,EAAQ;AAAA,MAChB,aAAA;AAAA,MACA,kBAAA;AAAA,MACA,eAAA,EAAiB;AAAA,OAChB,OAAO,CAAA;AACV,IAAA,KAAA,GAAQ;AAAA,MACN,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,UAAA,GAAa;AAAA,KACxC;AACA,IAAA,WAAA,CAAY,kBAAA,CAAmB,IAAA,EAAM,IAAI,WAAA,CAAY,IAAA,EAAM;AAAA,MACzD,MAAA,EAAQ;AAAA,KACT,CAAC,CAAA;AACF,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,cAAA;AACJ,EAAA,SAAS,SAAA,GAAY;AACnB,IAAA,IAAI,cAAA,eAA6B,cAAc,CAAA;AAAA,EACjD;AACA,EAAA,SAAS,oBAAoB,GAAA,EAAK;AAChC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,SAAA,EAAU;AACV,MAAA,cAAA,GAAiB,WAAW,OAAA,EAAS,GAAA,CAAI,OAAO,UAAA,GAAa,GAAA,GAAO,KAAK,GAAI,CAAA;AAAA,IAC/E;AAAA,EACF;AACA,EAAA,eAAe,OAAA,GAAU;AACvB,IAAA,CAAC,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,GAAeA,2BAAA,CAAU,KAAA,EAAO,eAAe,CAAA,GAAIA,2BAAA,CAAU,KAAK,CAAA,GAAI,MAAA;AACxG,IAAA,MAAM,MAAA,GAAS,MAAM,yBAAA,CAA0B,MAAM,iBAAA,CAAkB,IAAI,MAAA,EAAQ,KAAA,CAAM,YAAA,EAAc,gBAAgB,CAAC,CAAA;AACxH,IAAA,SAAA,EAAU;AAGV,IAAA,WAAA,CAAY,QAAQ,OAAO,CAAA;AAC3B,IAAA,KAAA,GAAQ,MAAA;AACR,IAAA,YAAA,CAAa,MAAM,CAAA;AACnB,IAAA,WAAA,CAAY,kBAAA,CAAmB,SAAA,EAAW,IAAI,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,aAAA;AACJ,EAAA,eAAe,MAAA,GAAS;AACtB,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,OAAO,aAAA;AAAA,IACT;AACA,IAAA,IAAI;AACF,MAAA,aAAA,GAAgB,OAAA,EAAQ;AACxB,MAAA,OAAO,MAAM,aAAA;AAAA,IACf,CAAA,SAAE;AACA,MAAA,aAAA,GAAgB,MAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,WAAA,CAAY,gBAAA,CAAiB,UAAU,mBAAmB,CAAA;AAC1D,EAAA,WAAA,CAAY,gBAAA,CAAiB,WAAW,mBAAmB,CAAA;AAC3D,EAAA,SAAS,mBAAA,GAAsB;AAC7B,IAAA,IAAI,CAAC,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI,IAAK,MAAM,UAAA,EAAY;AAC5C,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA,EAAO,YAAA;AAAA,EAChB;AACA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,eAAeC,SAAAA,GAAW;AACvD,IAAA,IAAI,CAAC,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI,IAAK,MAAM,UAAA,EAAY;AAC5C,MAAA,KAAA,GAAQ,MAAM,MAAA,EAAO;AAAA,IACvB;AACA,IAAA,OAAO,KAAA,EAAO,YAAA;AAAA,EAChB,CAAA,EAAG;AAAA,IACD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA,EAAkB,WAAA,CAAY,gBAAA,CAAiB,IAAA,CAAK,WAAW,CAAA;AAAA,IAC/D,mBAAA,EAAqB,WAAA,CAAY,mBAAA,CAAoB,IAAA,CAAK,WAAW;AAAA,GACtE,CAAA;AACD,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA;AAAA,GACF;AACF;AACO,SAAS,yBAAA,CAA0B,SAAS,GAAA,EAAK;AACtD,EAAA,MAAM,MAAA,GAAS,CAAA,EAAG,IAAI,GAAA,CAAI,OAAA,EAAS,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,GAAM,GAAA,GAAM,GAAG,CAAC,CAAA,CAAA;AACvE,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,GAAG,MAAM,CAAA,iBAAA,CAAA;AAAA,IACzB,sBAAA,EAAwB,GAAG,MAAM,CAAA,qBAAA,CAAA;AAAA,IACjC,mBAAA,EAAqB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IAC9B;AAAA,GACF;AACF;;;ACpJO,SAAS,6BAAA,CAA8B,SAAA,EAAW,aAAA,EAAe,GAAA,EAAK,SAAS,CAAC,eAAA,EAAiB,gBAAA,EAAkB,yBAAA,EAA2B,0BAA0B,CAAA,EAAG,OAAA,GAAU,UAAA,CAAW,KAAA,EAAO,UAAU,WAAA,EAAa;AACnO,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,OAAA,EAAS,GAAG,CAAA;AACzD,EAAA,MAAM,gBAAA,GAAmB;AAAA,IACvB,CAAC,WAAW,GAAG;AAAA,GACjB;AACA,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AACpC,EAAA,MAAM;AAAA,IACJ,QAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAO,MAAA,EAAQ,UAAA,EAAY,SAAS,gBAAA,EAAkB,MAAA,EAAW,MAAA,EAAW,YAAA,EAAc,MAAS,CAAA;AACvG,EAAA,eAAe,OAAA,GAAU;AACvB,IAAA,OAAO,uBAAA,CAAwB,YAAA,CAAa,MAAM,gCAAA,CAAiC,UAAA,EAAY,MAAA,EAAQ,MAAM,6BAAA,CAA8B,UAAA,EAAY,MAAA,EAAQ,IAAI,eAAA,CAAgB;AAAA,MACjL,KAAA,EAAO;AAAA,KACR,CAAA,EAAG,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA;AAAA,EACnC;AACA,EAAA,OAAO,QAAA;AACT;;;ACjCO,SAAS,MAAM,EAAA,EAAI;AACxB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACvD;ACDO,SAAS,+BAAA,CAAgC,KAAK,YAAA,EAAc,UAAA,EAAY,WAAW,aAAA,EAAe,MAAA,EAAQ,SAAS,OAAA,EAAS;AACjI,EAAA,IAAI,UAAU,EAAC;AACf,EAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,IAAA,EAAE,CAAC,aAAa,CAAC,aAAA,IAAiB,CAAC,MAAA,IAAU,CAAC,WAAW,CAAC,OAAA,CAAA,GAAW,QAAQ,GAAA,CAAI,QAAA,KAAa,eAAeD,2BAAAA,CAAU,KAAA,EAAO,kEAAkE,CAAA,GAAIA,2BAAAA,CAAU,KAAK,CAAA,GAAI,MAAA;AACvN,IAAA,OAAA,GAAU,UAAA;AAAA,EACZ,CAAA,MAAO;AACL,IAAA,OAAA,GAAU;AAAA,MACR,UAAA;AAAA,MACA,SAAA;AAAA,MACA,aAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,CAAC,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,GAAeA,2BAAAA,CAAU,KAAA,EAAO,iBAAiB,CAAA,GAAIA,2BAAAA,CAAU,KAAK,CAAA,GAAI,MAAA;AACxG,EAAA,CAAC,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,GAAeA,2BAAAA,CAAU,KAAA,EAAO,yBAAyB,CAAA,GAAIA,2BAAAA,CAAU,KAAK,CAAA,GAAI,MAAA;AAGzH,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,QAAQ,UAAA,IAAc,IAAA;AAAA,IAClC,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,aAAA,EAAe,OAAA,CAAQ,aAAA,IAAiB,MAAA,CAAO,SAAS,QAAA,EAAS;AAAA,IACjE,YAAA,EAAc,CAAC,GAAI,OAAA,CAAQ,UAAU,CAAC,eAAA,EAAiB,gBAAA,EAAkB,yBAAA,EAA2B,0BAA0B,CAAE,CAAA,CAAE,IAAA,EAAK,CAAE,KAAK,GAAG,CAAA;AAAA,IACjJ,OAAA,EAAS,OAAA,CAAQ,OAAA,IAAW,UAAA,CAAW,KAAA;AAAA,IACvC,OAAA,EAAS,QAAQ,OAAA,IAAW,WAAA;AAAA,IAC5B,oBAAoB,OAAA,CAAQ,kBAAA;AAAA,IAC5B,YAAA,EAAc,QAAQ,YAAA,IAAgB,cAAA;AAAA,IACtC,QAAQ,OAAA,CAAQ;AAAA,GAClB;AACF;;;ACAO,SAAS,uBAAA,CAAwB,WAAW,GAAA,EAAK,YAAA,EAAc,YAAY,SAAA,EAAW,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,OAAA,EAAS;AACpI,EAAA,IAAI,kBAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,MAAA;AACJ,EAAA,CAAC;AAAA,IACC,UAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,kBAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACF,GAAI,gCAAgC,GAAA,EAAK,YAAA,EAAc,YAAY,SAAA,EAAW,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AACrH,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,SAAA;AAAA,IACA,0BAAA,EAA4B;AAAA,GAC9B;AACA,EAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,OAAA,EAAS,GAAG,CAAA;AACzD,EAAA,MAAM,gBAAA,GAAmB;AAAA,IACvB,CAAC,WAAW,GAAG;AAAA,GACjB;AACA,EAAA,MAAM,OAAA,GAAU,WAAW,YAAY,CAAA;AACvC,EAAA,MAAM;AAAA,IACJ,uBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAA,CAAO,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAS,gBAAA,EAAkB,YAAA,CAAa,IAAA,CAAK,UAAA,EAAY,IAAI,CAAA,EAAG,kBAAA,EAAoB,cAAc,OAAO,CAAA;AAGxI,EAAA,MAAM,EAAA,GAAK,OAAM,CAAA,KAAK;AACpB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAA,CAAO,OAAA,CAAQ,YAAA,CAAa,EAAC,EAAG,IAAI,CAAC,CAAA;AACrC,MAAA;AAAA,IACF,CAAA,MAAO,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA;AAC/B,IAAA,MAAM,MAAM,GAAI,CAAA;AAChB,IAAA,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAAA,EACtC,CAAA;AACA,EAAA,eAAe,aAAa,kBAAA,EAAoB;AAC9C,IAAA,IAAI,iBAAiB,MAAA,EAAQ;AAC3B,MAAA,IAAI,kBAAA,EAAoB,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA;AAChE,MAAA;AAAA,IACF;AACA,IAAA,MAAM;AAAA,MACJ,aAAA;AAAA,MACA,kBAAA,EAAoB,sBAAA;AAAA,MACpB,eAAA,EAAiB;AAAA,KACnB,GAAI,SAAA,CAAU,MAAA,EAAQ,OAAO,CAAA;AAC7B,IAAA,MAAM,cAAA,GAAiB,sBAAA,IAA0B,IAAA,IAAQ,YAAA,KAAiB,sBAAA;AAC1E,IAAA,IAAI,CAAC,aAAA,IAAiB,sBAAA,KAA2B,kBAAA,IAAsB,CAAC,cAAA,EAAgB;AACtF,MAAA,IAAI,kBAAA,EAAoB,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA;AAChE,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AAGF,MAAA,MAAM,SAAS,uBAAA,CAAwB,YAAA,CAAa,MAAM,sCAAA,CAAuC,YAAY,MAAA,EAAQ,MAAM,wBAAA,CAAyB,UAAA,EAAY,QAAQ,aAAA,EAAe,gBAAgB,CAAC,CAAC,GAAG,SAAS,CAAA;AACrN,MAAA,IAAI,MAAA,IAAU,OAAO,QAAA,CAAS,QAAA,KAAa,IAAI,GAAA,CAAI,YAAY,EAAE,QAAA,EAAU;AACzE,QAAA,MAAM;AAAA,UACJ;AAAA,SACF,GAAI,YAAY,MAAM,CAAA;AAEtB,QAAA,KAAK,EAAA,CAAG,UAAU,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,QAAA,MAAA,EAAQ,IAAA,CAAK,8DAA8D,CAAC,CAAA;AAAA,MAC9E;AACA,MAAA,WAAA,CAAY,QAAQ,OAAO,CAAA;AAC3B,MAAA,IAAI,kBAAA,EAAoB;AACtB,QAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACA,EAAA,eAAe,qBAAA,GAAwB;AACrC,IAAA,MAAM;AAAA,MACJ,KAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF,GAAI,YAAY,MAAM,CAAA;AACtB,IAAA,IAAI,CAAC,YAAA,EAAc;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,uBAAA,CAAwB,YAAA,CAAa,MAAM,sCAAA,CAAuC,UAAA,EAAY,MAAA,EAAQ,MAAM,6BAAA,CAA8B,UAAA,EAAY,MAAA,EAAQ,YAAA,CAAa,qBAAqB,UAAA,EAAY,MAAA,EAAQ,IAAI,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG,KAAK,CAAC,CAAA,EAAG,YAAA,EAAc,YAAA,EAAc,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA;AACjU,MAAA,KAAK,GAAG,MAAM,CAAA;AACd,MAAA,OAAO,GAAA;AAAA,IACT,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,QAAA,MAAA,EAAQ,IAAA,CAAK,qFAAqF,CAAC,CAAA;AAAA,MACrG;AACA,MAAA,WAAA,CAAY,QAAQ,OAAO,CAAA;AAC3B,MAAA,aAAA,CAAc,MAAM,CAAA;AACpB,MAAA,MAAM,CAAA;AAAA,IACR;AAAA,EACF;AAGA,EAAA,MAAM,wBAAwB,YAAY;AACxC,IAAA,IAAI,SAAA,IAAa,OAAO,QAAA,CAAS,IAAA,KAAS,aAAa,MAAA,CAAO,QAAA,CAAS,aAAa,SAAA,EAAW;AAC7F,MAAA,SAAA,CAAU,MAAA,EAAQ,EAAC,EAAG,OAAO,CAAA;AAC7B,MAAA,WAAA,CAAY,MAAA,EAAQ;AAAA,QAClB,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,MAAM,GAAG,SAAS,CAAA;AAClB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,QAAQ,mBAAA,EAAoB;AAClC,IAAA,MAAM,eAAe,0BAAA,EAA2B;AAChD,IAAA,MAAM,SAAS,WAAA,CAAY,MAAM,EAAE,MAAA,IAAU,MAAA,CAAO,SAAS,QAAA,EAAS;AACtE,IAAA,SAAA,CAAU,MAAA,EAAQ,EAAC,EAAG,OAAO,CAAA;AAC7B,IAAA,WAAA,CAAY,MAAA,EAAQ;AAAA,MAClB,YAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,WAAA,GAAc,YAAA,KAAiB,MAAA,GAAS,YAAA,GAAe,kBAAkB,YAAY,CAAA,CAAA;AAC3F,IAAA,MAAA,CAAO,SAAS,MAAA,CAAO,CAAA,EAAG,WAAW,sBAAsB,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB;AAAA,MACjF,SAAA;AAAA,MACA,aAAA,EAAe,MAAA;AAAA,MACf,KAAA;AAAA,MACA,YAAA;AAAA,MACA,cAAA,EAAgB,MAAM,0BAAA,CAA2B,YAAY,CAAA;AAAA,MAC7D,qBAAA,EAAuB,MAAA;AAAA,MACvB,KAAA,EAAO;AAAA,KACR,CAAC,CAAA,CAAE,CAAA;AAGJ,IAAA,MAAM,MAAM,GAAI,CAAA;AAChB,IAAA,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAAA,EACtC,CAAA;AAGA,EAAA,eAAe,OAAA,GAAU;AAEvB,IAAA,OAAQ,MAAM,YAAA,EAAa;AAAA,IAE3B,MAAM,qBAAA,EAAsB;AAAA,IAE5B,MAAM,qBAAA,EAAsB;AAAA,EAC9B;AACA,EAAA,OAAO,QAAA;AACT","file":"index.cjs","sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Use this function to initialize an authless client that returns a public token.\n *\n * @returns A token provider function that returns a Promise resolving to a public token\n */\nexport function createAuthlessClient() {\n  // oxlint-disable-next-line require-await -- intentionally async: returns a Promise to satisfy its declared/contract type; no await needed\n  return async () => {\n    return \"PUBLIC\";\n  };\n}","let USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n  const NAME = 'oauth4webapi';\n  const VERSION = 'v2.17.0';\n  USER_AGENT = `${NAME}/${VERSION}`;\n}\nfunction looseInstanceOf(input, expected) {\n  if (input == null) {\n    return false;\n  }\n  try {\n    return input instanceof expected || Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag];\n  } catch {\n    return false;\n  }\n}\nexport const clockSkew = Symbol();\nexport const clockTolerance = Symbol();\nexport const customFetch = Symbol();\nexport const modifyAssertion = Symbol();\nexport const jweDecrypt = Symbol();\nexport const jwksCache = Symbol();\nexport const useMtlsAlias = Symbol();\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\nfunction buf(input) {\n  if (typeof input === 'string') {\n    return encoder.encode(input);\n  }\n  return decoder.decode(input);\n}\nconst CHUNK_SIZE = 0x8000;\nfunction encodeBase64Url(input) {\n  if (input instanceof ArrayBuffer) {\n    input = new Uint8Array(input);\n  }\n  const arr = [];\n  for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {\n    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n  }\n  return btoa(arr.join('')).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\nfunction decodeBase64Url(input) {\n  try {\n    const binary = atob(input.replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, ''));\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n  } catch (cause) {\n    throw new OPE('The input to be decoded is not correctly encoded.', {\n      cause\n    });\n  }\n}\nfunction b64u(input) {\n  if (typeof input === 'string') {\n    return decodeBase64Url(input);\n  }\n  return encodeBase64Url(input);\n}\nclass LRU {\n  constructor(maxSize) {\n    this.cache = new Map();\n    this._cache = new Map();\n    this.maxSize = maxSize;\n  }\n  get(key) {\n    let v = this.cache.get(key);\n    if (v) {\n      return v;\n    }\n    if (v = this._cache.get(key)) {\n      this.update(key, v);\n      return v;\n    }\n    return undefined;\n  }\n  has(key) {\n    return this.cache.has(key) || this._cache.has(key);\n  }\n  set(key, value) {\n    if (this.cache.has(key)) {\n      this.cache.set(key, value);\n    } else {\n      this.update(key, value);\n    }\n    return this;\n  }\n  delete(key) {\n    if (this.cache.has(key)) {\n      return this.cache.delete(key);\n    }\n    if (this._cache.has(key)) {\n      return this._cache.delete(key);\n    }\n    return false;\n  }\n  update(key, value) {\n    this.cache.set(key, value);\n    if (this.cache.size >= this.maxSize) {\n      this._cache = this.cache;\n      this.cache = new Map();\n    }\n  }\n}\nexport class UnsupportedOperationError extends Error {\n  constructor(message) {\n    super(message ?? 'operation not supported');\n    this.name = this.constructor.name;\n    Error.captureStackTrace?.(this, this.constructor);\n  }\n}\nexport class OperationProcessingError extends Error {\n  constructor(message, options) {\n    super(message, options);\n    this.name = this.constructor.name;\n    Error.captureStackTrace?.(this, this.constructor);\n  }\n}\nconst OPE = OperationProcessingError;\nconst dpopNonces = new LRU(100);\nfunction isCryptoKey(key) {\n  return key instanceof CryptoKey;\n}\nfunction isPrivateKey(key) {\n  return isCryptoKey(key) && key.type === 'private';\n}\nfunction isPublicKey(key) {\n  return isCryptoKey(key) && key.type === 'public';\n}\nconst SUPPORTED_JWS_ALGS = ['PS256', 'ES256', 'RS256', 'PS384', 'ES384', 'RS384', 'PS512', 'ES512', 'RS512', 'EdDSA'];\nfunction processDpopNonce(response) {\n  try {\n    const nonce = response.headers.get('dpop-nonce');\n    if (nonce) {\n      dpopNonces.set(new URL(response.url).origin, nonce);\n    }\n  } catch {}\n  return response;\n}\nfunction normalizeTyp(value) {\n  return value.toLowerCase().replace(/^application\\//, '');\n}\nfunction isJsonObject(input) {\n  if (input === null || typeof input !== 'object' || Array.isArray(input)) {\n    return false;\n  }\n  return true;\n}\nfunction prepareHeaders(input) {\n  if (looseInstanceOf(input, Headers)) {\n    input = Object.fromEntries(input.entries());\n  }\n  const headers = new Headers(input);\n  if (USER_AGENT && !headers.has('user-agent')) {\n    headers.set('user-agent', USER_AGENT);\n  }\n  if (headers.has('authorization')) {\n    throw new TypeError('\"options.headers\" must not include the \"authorization\" header name');\n  }\n  if (headers.has('dpop')) {\n    throw new TypeError('\"options.headers\" must not include the \"dpop\" header name');\n  }\n  return headers;\n}\nfunction signal(value) {\n  if (typeof value === 'function') {\n    value = value();\n  }\n  if (!(value instanceof AbortSignal)) {\n    throw new TypeError('\"options.signal\" must return or be an instance of AbortSignal');\n  }\n  return value;\n}\nexport async function discoveryRequest(issuerIdentifier, options) {\n  if (!(issuerIdentifier instanceof URL)) {\n    throw new TypeError('\"issuerIdentifier\" must be an instance of URL');\n  }\n  if (issuerIdentifier.protocol !== 'https:' && issuerIdentifier.protocol !== 'http:') {\n    throw new TypeError('\"issuer.protocol\" must be \"https:\" or \"http:\"');\n  }\n  const url = new URL(issuerIdentifier.href);\n  switch (options?.algorithm) {\n    case undefined:\n    case 'oidc':\n      url.pathname = `${url.pathname}/.well-known/openid-configuration`.replace('//', '/');\n      break;\n    case 'oauth2':\n      if (url.pathname === '/') {\n        url.pathname = '.well-known/oauth-authorization-server';\n      } else {\n        url.pathname = `.well-known/oauth-authorization-server/${url.pathname}`.replace('//', '/');\n      }\n      break;\n    default:\n      throw new TypeError('\"options.algorithm\" must be \"oidc\" (default), or \"oauth2\"');\n  }\n  const headers = prepareHeaders(options?.headers);\n  headers.set('accept', 'application/json');\n  return (options?.[customFetch] || fetch)(url.href, {\n    headers: Object.fromEntries(headers.entries()),\n    method: 'GET',\n    redirect: 'manual',\n    signal: options?.signal ? signal(options.signal) : null\n  }).then(processDpopNonce);\n}\nfunction validateString(input) {\n  return typeof input === 'string' && input.length !== 0;\n}\nexport async function processDiscoveryResponse(expectedIssuerIdentifier, response) {\n  if (!(expectedIssuerIdentifier instanceof URL)) {\n    throw new TypeError('\"expectedIssuer\" must be an instance of URL');\n  }\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 200) {\n    throw new OPE('\"response\" is not a conform Authorization Server Metadata response');\n  }\n  assertReadableResponse(response);\n  let json;\n  try {\n    json = await response.json();\n  } catch (cause) {\n    throw new OPE('failed to parse \"response\" body as JSON', {\n      cause\n    });\n  }\n  if (!isJsonObject(json)) {\n    throw new OPE('\"response\" body must be a top level object');\n  }\n  if (!validateString(json.issuer)) {\n    throw new OPE('\"response\" body \"issuer\" property must be a non-empty string');\n  }\n  if (new URL(json.issuer).href !== expectedIssuerIdentifier.href) {\n    throw new OPE('\"response\" body \"issuer\" does not match \"expectedIssuer\"');\n  }\n  return json;\n}\nfunction randomBytes() {\n  return b64u(crypto.getRandomValues(new Uint8Array(32)));\n}\nexport function generateRandomCodeVerifier() {\n  return randomBytes();\n}\nexport function generateRandomState() {\n  return randomBytes();\n}\nexport function generateRandomNonce() {\n  return randomBytes();\n}\nexport async function calculatePKCECodeChallenge(codeVerifier) {\n  if (!validateString(codeVerifier)) {\n    throw new TypeError('\"codeVerifier\" must be a non-empty string');\n  }\n  return b64u(await crypto.subtle.digest('SHA-256', buf(codeVerifier)));\n}\nfunction getKeyAndKid(input) {\n  if (input instanceof CryptoKey) {\n    return {\n      key: input\n    };\n  }\n  if (!(input?.key instanceof CryptoKey)) {\n    return {};\n  }\n  if (input.kid !== undefined && !validateString(input.kid)) {\n    throw new TypeError('\"kid\" must be a non-empty string');\n  }\n  return {\n    key: input.key,\n    kid: input.kid,\n    modifyAssertion: input[modifyAssertion]\n  };\n}\nfunction formUrlEncode(token) {\n  return encodeURIComponent(token).replace(/%20/g, '+');\n}\nfunction clientSecretBasic(clientId, clientSecret) {\n  const username = formUrlEncode(clientId);\n  const password = formUrlEncode(clientSecret);\n  const credentials = btoa(`${username}:${password}`);\n  return `Basic ${credentials}`;\n}\nfunction psAlg(key) {\n  switch (key.algorithm.hash.name) {\n    case 'SHA-256':\n      return 'PS256';\n    case 'SHA-384':\n      return 'PS384';\n    case 'SHA-512':\n      return 'PS512';\n    default:\n      throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name');\n  }\n}\nfunction rsAlg(key) {\n  switch (key.algorithm.hash.name) {\n    case 'SHA-256':\n      return 'RS256';\n    case 'SHA-384':\n      return 'RS384';\n    case 'SHA-512':\n      return 'RS512';\n    default:\n      throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name');\n  }\n}\nfunction esAlg(key) {\n  switch (key.algorithm.namedCurve) {\n    case 'P-256':\n      return 'ES256';\n    case 'P-384':\n      return 'ES384';\n    case 'P-521':\n      return 'ES512';\n    default:\n      throw new UnsupportedOperationError('unsupported EcKeyAlgorithm namedCurve');\n  }\n}\nfunction keyToJws(key) {\n  switch (key.algorithm.name) {\n    case 'RSA-PSS':\n      return psAlg(key);\n    case 'RSASSA-PKCS1-v1_5':\n      return rsAlg(key);\n    case 'ECDSA':\n      return esAlg(key);\n    case 'Ed25519':\n    case 'Ed448':\n      return 'EdDSA';\n    default:\n      throw new UnsupportedOperationError('unsupported CryptoKey algorithm name');\n  }\n}\nfunction getClockSkew(client) {\n  const skew = client?.[clockSkew];\n  return typeof skew === 'number' && Number.isFinite(skew) ? skew : 0;\n}\nfunction getClockTolerance(client) {\n  const tolerance = client?.[clockTolerance];\n  return typeof tolerance === 'number' && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1 ? tolerance : 30;\n}\nfunction epochTime() {\n  return Math.floor(Date.now() / 1000);\n}\nfunction clientAssertion(as, client) {\n  const now = epochTime() + getClockSkew(client);\n  return {\n    jti: randomBytes(),\n    aud: [as.issuer, as.token_endpoint],\n    exp: now + 60,\n    iat: now,\n    nbf: now,\n    iss: client.client_id,\n    sub: client.client_id\n  };\n}\nasync function privateKeyJwt(as, client, key, kid, modifyAssertion) {\n  const header = {\n    alg: keyToJws(key),\n    kid\n  };\n  const payload = clientAssertion(as, client);\n  modifyAssertion?.(header, payload);\n  return jwt(header, payload, key);\n}\nfunction assertAs(as) {\n  if (typeof as !== 'object' || as === null) {\n    throw new TypeError('\"as\" must be an object');\n  }\n  if (!validateString(as.issuer)) {\n    throw new TypeError('\"as.issuer\" property must be a non-empty string');\n  }\n  return true;\n}\nfunction assertClient(client) {\n  if (typeof client !== 'object' || client === null) {\n    throw new TypeError('\"client\" must be an object');\n  }\n  if (!validateString(client.client_id)) {\n    throw new TypeError('\"client.client_id\" property must be a non-empty string');\n  }\n  return true;\n}\nfunction assertClientSecret(clientSecret) {\n  if (!validateString(clientSecret)) {\n    throw new TypeError('\"client.client_secret\" property must be a non-empty string');\n  }\n  return clientSecret;\n}\nfunction assertNoClientPrivateKey(clientAuthMethod, clientPrivateKey) {\n  if (clientPrivateKey !== undefined) {\n    throw new TypeError(`\"options.clientPrivateKey\" property must not be provided when ${clientAuthMethod} client authentication method is used.`);\n  }\n}\nfunction assertNoClientSecret(clientAuthMethod, clientSecret) {\n  if (clientSecret !== undefined) {\n    throw new TypeError(`\"client.client_secret\" property must not be provided when ${clientAuthMethod} client authentication method is used.`);\n  }\n}\nasync function clientAuthentication(as, client, body, headers, clientPrivateKey) {\n  body.delete('client_secret');\n  body.delete('client_assertion_type');\n  body.delete('client_assertion');\n  switch (client.token_endpoint_auth_method) {\n    case undefined:\n    case 'client_secret_basic':\n      {\n        assertNoClientPrivateKey('client_secret_basic', clientPrivateKey);\n        headers.set('authorization', clientSecretBasic(client.client_id, assertClientSecret(client.client_secret)));\n        break;\n      }\n    case 'client_secret_post':\n      {\n        assertNoClientPrivateKey('client_secret_post', clientPrivateKey);\n        body.set('client_id', client.client_id);\n        body.set('client_secret', assertClientSecret(client.client_secret));\n        break;\n      }\n    case 'private_key_jwt':\n      {\n        assertNoClientSecret('private_key_jwt', client.client_secret);\n        if (clientPrivateKey === undefined) {\n          throw new TypeError('\"options.clientPrivateKey\" must be provided when \"client.token_endpoint_auth_method\" is \"private_key_jwt\"');\n        }\n        const {\n          key,\n          kid,\n          modifyAssertion\n        } = getKeyAndKid(clientPrivateKey);\n        if (!isPrivateKey(key)) {\n          throw new TypeError('\"options.clientPrivateKey.key\" must be a private CryptoKey');\n        }\n        body.set('client_id', client.client_id);\n        body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n        body.set('client_assertion', await privateKeyJwt(as, client, key, kid, modifyAssertion));\n        break;\n      }\n    case 'tls_client_auth':\n    case 'self_signed_tls_client_auth':\n    case 'none':\n      {\n        assertNoClientSecret(client.token_endpoint_auth_method, client.client_secret);\n        assertNoClientPrivateKey(client.token_endpoint_auth_method, clientPrivateKey);\n        body.set('client_id', client.client_id);\n        break;\n      }\n    default:\n      throw new UnsupportedOperationError('unsupported client token_endpoint_auth_method');\n  }\n}\nasync function jwt(header, payload, key) {\n  if (!key.usages.includes('sign')) {\n    throw new TypeError('CryptoKey instances used for signing assertions must include \"sign\" in their \"usages\"');\n  }\n  const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;\n  const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));\n  return `${input}.${signature}`;\n}\nexport async function issueRequestObject(as, client, parameters, privateKey) {\n  assertAs(as);\n  assertClient(client);\n  parameters = new URLSearchParams(parameters);\n  const {\n    key,\n    kid,\n    modifyAssertion\n  } = getKeyAndKid(privateKey);\n  if (!isPrivateKey(key)) {\n    throw new TypeError('\"privateKey.key\" must be a private CryptoKey');\n  }\n  parameters.set('client_id', client.client_id);\n  const now = epochTime() + getClockSkew(client);\n  const claims = {\n    ...Object.fromEntries(parameters.entries()),\n    jti: randomBytes(),\n    aud: as.issuer,\n    exp: now + 60,\n    iat: now,\n    nbf: now,\n    iss: client.client_id\n  };\n  let resource;\n  if (parameters.has('resource') && (resource = parameters.getAll('resource')) && resource.length > 1) {\n    claims.resource = resource;\n  }\n  {\n    let value = parameters.get('max_age');\n    if (value !== null) {\n      claims.max_age = parseInt(value, 10);\n      if (!Number.isFinite(claims.max_age)) {\n        throw new OPE('\"max_age\" parameter must be a number');\n      }\n    }\n  }\n  {\n    let value = parameters.get('claims');\n    if (value !== null) {\n      try {\n        claims.claims = JSON.parse(value);\n      } catch (cause) {\n        throw new OPE('failed to parse the \"claims\" parameter as JSON', {\n          cause\n        });\n      }\n      if (!isJsonObject(claims.claims)) {\n        throw new OPE('\"claims\" parameter must be a JSON with a top level object');\n      }\n    }\n  }\n  {\n    let value = parameters.get('authorization_details');\n    if (value !== null) {\n      try {\n        claims.authorization_details = JSON.parse(value);\n      } catch (cause) {\n        throw new OPE('failed to parse the \"authorization_details\" parameter as JSON', {\n          cause\n        });\n      }\n      if (!Array.isArray(claims.authorization_details)) {\n        throw new OPE('\"authorization_details\" parameter must be a JSON with a top level array');\n      }\n    }\n  }\n  const header = {\n    alg: keyToJws(key),\n    typ: 'oauth-authz-req+jwt',\n    kid\n  };\n  modifyAssertion?.(header, claims);\n  return jwt(header, claims, key);\n}\nasync function dpopProofJwt(headers, options, url, htm, clockSkew, accessToken) {\n  const {\n    privateKey,\n    publicKey,\n    nonce = dpopNonces.get(url.origin)\n  } = options;\n  if (!isPrivateKey(privateKey)) {\n    throw new TypeError('\"DPoP.privateKey\" must be a private CryptoKey');\n  }\n  if (!isPublicKey(publicKey)) {\n    throw new TypeError('\"DPoP.publicKey\" must be a public CryptoKey');\n  }\n  if (nonce !== undefined && !validateString(nonce)) {\n    throw new TypeError('\"DPoP.nonce\" must be a non-empty string or undefined');\n  }\n  if (!publicKey.extractable) {\n    throw new TypeError('\"DPoP.publicKey.extractable\" must be true');\n  }\n  const now = epochTime() + clockSkew;\n  const header = {\n    alg: keyToJws(privateKey),\n    typ: 'dpop+jwt',\n    jwk: await publicJwk(publicKey)\n  };\n  const payload = {\n    iat: now,\n    jti: randomBytes(),\n    htm,\n    nonce,\n    htu: `${url.origin}${url.pathname}`,\n    ath: accessToken ? b64u(await crypto.subtle.digest('SHA-256', buf(accessToken))) : undefined\n  };\n  options[modifyAssertion]?.(header, payload);\n  headers.set('dpop', await jwt(header, payload, privateKey));\n}\nlet jwkCache;\nasync function getSetPublicJwkCache(key) {\n  const {\n    kty,\n    e,\n    n,\n    x,\n    y,\n    crv\n  } = await crypto.subtle.exportKey('jwk', key);\n  const jwk = {\n    kty,\n    e,\n    n,\n    x,\n    y,\n    crv\n  };\n  jwkCache.set(key, jwk);\n  return jwk;\n}\nasync function publicJwk(key) {\n  jwkCache || (jwkCache = new WeakMap());\n  return jwkCache.get(key) || getSetPublicJwkCache(key);\n}\nfunction validateEndpoint(value, endpoint, useMtlsAlias) {\n  if (typeof value !== 'string') {\n    if (useMtlsAlias) {\n      throw new TypeError(`\"as.mtls_endpoint_aliases.${endpoint}\" must be a string`);\n    }\n    throw new TypeError(`\"as.${endpoint}\" must be a string`);\n  }\n  return new URL(value);\n}\nfunction resolveEndpoint(as, endpoint, useMtlsAlias = false) {\n  if (useMtlsAlias && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) {\n    return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, useMtlsAlias);\n  }\n  return validateEndpoint(as[endpoint], endpoint, useMtlsAlias);\n}\nfunction alias(client, options) {\n  if (client.use_mtls_endpoint_aliases || options?.[useMtlsAlias]) {\n    return true;\n  }\n  return false;\n}\nexport async function pushedAuthorizationRequest(as, client, parameters, options) {\n  assertAs(as);\n  assertClient(client);\n  const url = resolveEndpoint(as, 'pushed_authorization_request_endpoint', alias(client, options));\n  const body = new URLSearchParams(parameters);\n  body.set('client_id', client.client_id);\n  const headers = prepareHeaders(options?.headers);\n  headers.set('accept', 'application/json');\n  if (options?.DPoP !== undefined) {\n    await dpopProofJwt(headers, options.DPoP, url, 'POST', getClockSkew(client));\n  }\n  return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport function isOAuth2Error(input) {\n  const value = input;\n  if (typeof value !== 'object' || Array.isArray(value) || value === null) {\n    return false;\n  }\n  return value.error !== undefined;\n}\nfunction unquote(value) {\n  if (value.length >= 2 && value[0] === '\"' && value[value.length - 1] === '\"') {\n    return value.slice(1, -1);\n  }\n  return value;\n}\nconst SPLIT_REGEXP = /((?:,|, )?[0-9a-zA-Z!#$%&'*+-.^_`|~]+=)/;\nconst SCHEMES_REGEXP = /(?:^|, ?)([0-9a-zA-Z!#$%&'*+\\-.^_`|~]+)(?=$|[ ,])/g;\nfunction wwwAuth(scheme, params) {\n  const arr = params.split(SPLIT_REGEXP).slice(1);\n  if (!arr.length) {\n    return {\n      scheme: scheme.toLowerCase(),\n      parameters: {}\n    };\n  }\n  arr[arr.length - 1] = arr[arr.length - 1].replace(/,$/, '');\n  const parameters = {};\n  for (let i = 1; i < arr.length; i += 2) {\n    const idx = i;\n    if (arr[idx][0] === '\"') {\n      while (arr[idx].slice(-1) !== '\"' && ++i < arr.length) {\n        arr[idx] += arr[i];\n      }\n    }\n    const key = arr[idx - 1].replace(/^(?:, ?)|=$/g, '').toLowerCase();\n    parameters[key] = unquote(arr[idx]);\n  }\n  return {\n    scheme: scheme.toLowerCase(),\n    parameters\n  };\n}\nexport function parseWwwAuthenticateChallenges(response) {\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  const header = response.headers.get('www-authenticate');\n  if (header === null) {\n    return undefined;\n  }\n  const result = [];\n  for (const {\n    1: scheme,\n    index\n  } of header.matchAll(SCHEMES_REGEXP)) {\n    result.push([scheme, index]);\n  }\n  if (!result.length) {\n    return undefined;\n  }\n  const challenges = result.map(([scheme, indexOf], i, others) => {\n    const next = others[i + 1];\n    let parameters;\n    if (next) {\n      parameters = header.slice(indexOf, next[1]);\n    } else {\n      parameters = header.slice(indexOf);\n    }\n    return wwwAuth(scheme, parameters);\n  });\n  return challenges;\n}\nexport async function processPushedAuthorizationResponse(as, client, response) {\n  assertAs(as);\n  assertClient(client);\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 201) {\n    let err;\n    if (err = await handleOAuthBodyError(response)) {\n      return err;\n    }\n    throw new OPE('\"response\" is not a conform Pushed Authorization Request Endpoint response');\n  }\n  assertReadableResponse(response);\n  let json;\n  try {\n    json = await response.json();\n  } catch (cause) {\n    throw new OPE('failed to parse \"response\" body as JSON', {\n      cause\n    });\n  }\n  if (!isJsonObject(json)) {\n    throw new OPE('\"response\" body must be a top level object');\n  }\n  if (!validateString(json.request_uri)) {\n    throw new OPE('\"response\" body \"request_uri\" property must be a non-empty string');\n  }\n  if (typeof json.expires_in !== 'number' || json.expires_in <= 0) {\n    throw new OPE('\"response\" body \"expires_in\" property must be a positive number');\n  }\n  return json;\n}\nexport async function protectedResourceRequest(accessToken, method, url, headers, body, options) {\n  if (!validateString(accessToken)) {\n    throw new TypeError('\"accessToken\" must be a non-empty string');\n  }\n  if (!(url instanceof URL)) {\n    throw new TypeError('\"url\" must be an instance of URL');\n  }\n  headers = prepareHeaders(headers);\n  if (options?.DPoP === undefined) {\n    headers.set('authorization', `Bearer ${accessToken}`);\n  } else {\n    await dpopProofJwt(headers, options.DPoP, url, method.toUpperCase(), getClockSkew({\n      [clockSkew]: options?.[clockSkew]\n    }), accessToken);\n    headers.set('authorization', `DPoP ${accessToken}`);\n  }\n  return (options?.[customFetch] || fetch)(url.href, {\n    body,\n    headers: Object.fromEntries(headers.entries()),\n    method,\n    redirect: 'manual',\n    signal: options?.signal ? signal(options.signal) : null\n  }).then(processDpopNonce);\n}\nexport async function userInfoRequest(as, client, accessToken, options) {\n  assertAs(as);\n  assertClient(client);\n  const url = resolveEndpoint(as, 'userinfo_endpoint', alias(client, options));\n  const headers = prepareHeaders(options?.headers);\n  if (client.userinfo_signed_response_alg) {\n    headers.set('accept', 'application/jwt');\n  } else {\n    headers.set('accept', 'application/json');\n    headers.append('accept', 'application/jwt');\n  }\n  return protectedResourceRequest(accessToken, 'GET', url, headers, null, {\n    ...options,\n    [clockSkew]: getClockSkew(client)\n  });\n}\nlet jwksMap;\nfunction setJwksCache(as, jwks, uat, cache) {\n  jwksMap || (jwksMap = new WeakMap());\n  jwksMap.set(as, {\n    jwks,\n    uat,\n    get age() {\n      return epochTime() - this.uat;\n    }\n  });\n  if (cache) {\n    Object.assign(cache, {\n      jwks: structuredClone(jwks),\n      uat\n    });\n  }\n}\nfunction isFreshJwksCache(input) {\n  if (typeof input !== 'object' || input === null) {\n    return false;\n  }\n  if (!('uat' in input) || typeof input.uat !== 'number' || epochTime() - input.uat >= 300) {\n    return false;\n  }\n  if (!('jwks' in input) || !isJsonObject(input.jwks) || !Array.isArray(input.jwks.keys) || !Array.prototype.every.call(input.jwks.keys, isJsonObject)) {\n    return false;\n  }\n  return true;\n}\nfunction clearJwksCache(as, cache) {\n  jwksMap?.delete(as);\n  delete cache?.jwks;\n  delete cache?.uat;\n}\nasync function getPublicSigKeyFromIssuerJwksUri(as, options, header) {\n  const {\n    alg,\n    kid\n  } = header;\n  checkSupportedJwsAlg(alg);\n  if (!jwksMap?.has(as) && isFreshJwksCache(options?.[jwksCache])) {\n    setJwksCache(as, options?.[jwksCache].jwks, options?.[jwksCache].uat);\n  }\n  let jwks;\n  let age;\n  if (jwksMap?.has(as)) {\n    ;\n    ({\n      jwks,\n      age\n    } = jwksMap.get(as));\n    if (age >= 300) {\n      clearJwksCache(as, options?.[jwksCache]);\n      return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    }\n  } else {\n    jwks = await jwksRequest(as, options).then(processJwksResponse);\n    age = 0;\n    setJwksCache(as, jwks, epochTime(), options?.[jwksCache]);\n  }\n  let kty;\n  switch (alg.slice(0, 2)) {\n    case 'RS':\n    case 'PS':\n      kty = 'RSA';\n      break;\n    case 'ES':\n      kty = 'EC';\n      break;\n    case 'Ed':\n      kty = 'OKP';\n      break;\n    default:\n      throw new UnsupportedOperationError();\n  }\n  const candidates = jwks.keys.filter(jwk => {\n    if (jwk.kty !== kty) {\n      return false;\n    }\n    if (kid !== undefined && kid !== jwk.kid) {\n      return false;\n    }\n    if (jwk.alg !== undefined && alg !== jwk.alg) {\n      return false;\n    }\n    if (jwk.use !== undefined && jwk.use !== 'sig') {\n      return false;\n    }\n    if (jwk.key_ops?.includes('verify') === false) {\n      return false;\n    }\n    switch (true) {\n      case alg === 'ES256' && jwk.crv !== 'P-256':\n      case alg === 'ES384' && jwk.crv !== 'P-384':\n      case alg === 'ES512' && jwk.crv !== 'P-521':\n      case alg === 'EdDSA' && !(jwk.crv === 'Ed25519' || jwk.crv === 'Ed448'):\n        return false;\n    }\n    return true;\n  });\n  const {\n    0: jwk,\n    length\n  } = candidates;\n  if (!length) {\n    if (age >= 60) {\n      clearJwksCache(as, options?.[jwksCache]);\n      return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    }\n    throw new OPE('error when selecting a JWT verification key, no applicable keys found');\n  }\n  if (length !== 1) {\n    throw new OPE('error when selecting a JWT verification key, multiple applicable keys found, a \"kid\" JWT Header Parameter is required');\n  }\n  const key = await importJwk(alg, jwk);\n  if (key.type !== 'public') {\n    throw new OPE('jwks_uri must only contain public keys');\n  }\n  return key;\n}\nexport const skipSubjectCheck = Symbol();\nfunction getContentType(response) {\n  return response.headers.get('content-type')?.split(';')[0];\n}\nexport async function processUserInfoResponse(as, client, expectedSubject, response) {\n  assertAs(as);\n  assertClient(client);\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 200) {\n    throw new OPE('\"response\" is not a conform UserInfo Endpoint response');\n  }\n  let json;\n  if (getContentType(response) === 'application/jwt') {\n    assertReadableResponse(response);\n    const {\n      claims,\n      jwt\n    } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.userinfo_signed_response_alg, as.userinfo_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client), client[jweDecrypt]).then(validateOptionalAudience.bind(undefined, client.client_id)).then(validateOptionalIssuer.bind(undefined, as.issuer));\n    jwtResponseBodies.set(response, jwt);\n    json = claims;\n  } else {\n    if (client.userinfo_signed_response_alg) {\n      throw new OPE('JWT UserInfo Response expected');\n    }\n    assertReadableResponse(response);\n    try {\n      json = await response.json();\n    } catch (cause) {\n      throw new OPE('failed to parse \"response\" body as JSON', {\n        cause\n      });\n    }\n  }\n  if (!isJsonObject(json)) {\n    throw new OPE('\"response\" body must be a top level object');\n  }\n  if (!validateString(json.sub)) {\n    throw new OPE('\"response\" body \"sub\" property must be a non-empty string');\n  }\n  switch (expectedSubject) {\n    case skipSubjectCheck:\n      break;\n    default:\n      if (!validateString(expectedSubject)) {\n        throw new OPE('\"expectedSubject\" must be a non-empty string');\n      }\n      if (json.sub !== expectedSubject) {\n        throw new OPE('unexpected \"response\" body \"sub\" value');\n      }\n  }\n  return json;\n}\nasync function authenticatedRequest(as, client, method, url, body, headers, options) {\n  await clientAuthentication(as, client, body, headers, options?.clientPrivateKey);\n  headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');\n  return (options?.[customFetch] || fetch)(url.href, {\n    body,\n    headers: Object.fromEntries(headers.entries()),\n    method,\n    redirect: 'manual',\n    signal: options?.signal ? signal(options.signal) : null\n  }).then(processDpopNonce);\n}\nasync function tokenEndpointRequest(as, client, grantType, parameters, options) {\n  const url = resolveEndpoint(as, 'token_endpoint', alias(client, options));\n  parameters.set('grant_type', grantType);\n  const headers = prepareHeaders(options?.headers);\n  headers.set('accept', 'application/json');\n  if (options?.DPoP !== undefined) {\n    await dpopProofJwt(headers, options.DPoP, url, 'POST', getClockSkew(client));\n  }\n  return authenticatedRequest(as, client, 'POST', url, parameters, headers, options);\n}\nexport async function refreshTokenGrantRequest(as, client, refreshToken, options) {\n  assertAs(as);\n  assertClient(client);\n  if (!validateString(refreshToken)) {\n    throw new TypeError('\"refreshToken\" must be a non-empty string');\n  }\n  const parameters = new URLSearchParams(options?.additionalParameters);\n  parameters.set('refresh_token', refreshToken);\n  return tokenEndpointRequest(as, client, 'refresh_token', parameters, options);\n}\nconst idTokenClaims = new WeakMap();\nconst jwtResponseBodies = new WeakMap();\nexport function getValidatedIdTokenClaims(ref) {\n  if (!ref.id_token) {\n    return undefined;\n  }\n  const claims = idTokenClaims.get(ref);\n  if (!claims) {\n    throw new TypeError('\"ref\" was already garbage collected or did not resolve from the proper sources');\n  }\n  return claims[0];\n}\nexport async function validateIdTokenSignature(as, ref, options) {\n  assertAs(as);\n  if (!idTokenClaims.has(ref)) {\n    throw new OPE('\"ref\" does not contain an ID Token to verify the signature of');\n  }\n  const {\n    0: protectedHeader,\n    1: payload,\n    2: encodedSignature\n  } = idTokenClaims.get(ref)[1].split('.');\n  const header = JSON.parse(buf(b64u(protectedHeader)));\n  if (header.alg.startsWith('HS')) {\n    throw new UnsupportedOperationError();\n  }\n  let key;\n  key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n  await validateJwsSignature(protectedHeader, payload, key, b64u(encodedSignature));\n}\nasync function validateJwtResponseSignature(as, ref, options) {\n  assertAs(as);\n  if (!jwtResponseBodies.has(ref)) {\n    throw new OPE('\"ref\" does not contain a processed JWT Response to verify the signature of');\n  }\n  const {\n    0: protectedHeader,\n    1: payload,\n    2: encodedSignature\n  } = jwtResponseBodies.get(ref).split('.');\n  const header = JSON.parse(buf(b64u(protectedHeader)));\n  if (header.alg.startsWith('HS')) {\n    throw new UnsupportedOperationError();\n  }\n  let key;\n  key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n  await validateJwsSignature(protectedHeader, payload, key, b64u(encodedSignature));\n}\nexport function validateJwtUserInfoSignature(as, ref, options) {\n  return validateJwtResponseSignature(as, ref, options);\n}\nexport function validateJwtIntrospectionSignature(as, ref, options) {\n  return validateJwtResponseSignature(as, ref, options);\n}\nasync function processGenericAccessTokenResponse(as, client, response, ignoreIdToken = false, ignoreRefreshToken = false) {\n  assertAs(as);\n  assertClient(client);\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 200) {\n    let err;\n    if (err = await handleOAuthBodyError(response)) {\n      return err;\n    }\n    throw new OPE('\"response\" is not a conform Token Endpoint response');\n  }\n  assertReadableResponse(response);\n  let json;\n  try {\n    json = await response.json();\n  } catch (cause) {\n    throw new OPE('failed to parse \"response\" body as JSON', {\n      cause\n    });\n  }\n  if (!isJsonObject(json)) {\n    throw new OPE('\"response\" body must be a top level object');\n  }\n  if (!validateString(json.access_token)) {\n    throw new OPE('\"response\" body \"access_token\" property must be a non-empty string');\n  }\n  if (!validateString(json.token_type)) {\n    throw new OPE('\"response\" body \"token_type\" property must be a non-empty string');\n  }\n  json.token_type = json.token_type.toLowerCase();\n  if (json.token_type !== 'dpop' && json.token_type !== 'bearer') {\n    throw new UnsupportedOperationError('unsupported `token_type` value');\n  }\n  if (json.expires_in !== undefined && (typeof json.expires_in !== 'number' || json.expires_in <= 0)) {\n    throw new OPE('\"response\" body \"expires_in\" property must be a positive number');\n  }\n  if (!ignoreRefreshToken && json.refresh_token !== undefined && !validateString(json.refresh_token)) {\n    throw new OPE('\"response\" body \"refresh_token\" property must be a non-empty string');\n  }\n  if (json.scope !== undefined && typeof json.scope !== 'string') {\n    throw new OPE('\"response\" body \"scope\" property must be a string');\n  }\n  if (!ignoreIdToken) {\n    if (json.id_token !== undefined && !validateString(json.id_token)) {\n      throw new OPE('\"response\" body \"id_token\" property must be a non-empty string');\n    }\n    if (json.id_token) {\n      const {\n        claims,\n        jwt\n      } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client), client[jweDecrypt]).then(validatePresence.bind(undefined, ['aud', 'exp', 'iat', 'iss', 'sub'])).then(validateIssuer.bind(undefined, as.issuer)).then(validateAudience.bind(undefined, client.client_id));\n      if (Array.isArray(claims.aud) && claims.aud.length !== 1) {\n        if (claims.azp === undefined) {\n          throw new OPE('ID Token \"aud\" (audience) claim includes additional untrusted audiences');\n        }\n        if (claims.azp !== client.client_id) {\n          throw new OPE('unexpected ID Token \"azp\" (authorized party) claim value');\n        }\n      }\n      if (claims.auth_time !== undefined && (!Number.isFinite(claims.auth_time) || Math.sign(claims.auth_time) !== 1)) {\n        throw new OPE('ID Token \"auth_time\" (authentication time) must be a positive number');\n      }\n      idTokenClaims.set(json, [claims, jwt]);\n    }\n  }\n  return json;\n}\nexport async function processRefreshTokenResponse(as, client, response) {\n  return processGenericAccessTokenResponse(as, client, response);\n}\nfunction validateOptionalAudience(expected, result) {\n  if (result.claims.aud !== undefined) {\n    return validateAudience(expected, result);\n  }\n  return result;\n}\nfunction validateAudience(expected, result) {\n  if (Array.isArray(result.claims.aud)) {\n    if (!result.claims.aud.includes(expected)) {\n      throw new OPE('unexpected JWT \"aud\" (audience) claim value');\n    }\n  } else if (result.claims.aud !== expected) {\n    throw new OPE('unexpected JWT \"aud\" (audience) claim value');\n  }\n  return result;\n}\nfunction validateOptionalIssuer(expected, result) {\n  if (result.claims.iss !== undefined) {\n    return validateIssuer(expected, result);\n  }\n  return result;\n}\nfunction validateIssuer(expected, result) {\n  if (result.claims.iss !== expected) {\n    throw new OPE('unexpected JWT \"iss\" (issuer) claim value');\n  }\n  return result;\n}\nconst branded = new WeakSet();\nfunction brand(searchParams) {\n  branded.add(searchParams);\n  return searchParams;\n}\nexport async function authorizationCodeGrantRequest(as, client, callbackParameters, redirectUri, codeVerifier, options) {\n  assertAs(as);\n  assertClient(client);\n  if (!branded.has(callbackParameters)) {\n    throw new TypeError('\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()');\n  }\n  if (!validateString(redirectUri)) {\n    throw new TypeError('\"redirectUri\" must be a non-empty string');\n  }\n  if (!validateString(codeVerifier)) {\n    throw new TypeError('\"codeVerifier\" must be a non-empty string');\n  }\n  const code = getURLSearchParameter(callbackParameters, 'code');\n  if (!code) {\n    throw new OPE('no authorization code in \"callbackParameters\"');\n  }\n  const parameters = new URLSearchParams(options?.additionalParameters);\n  parameters.set('redirect_uri', redirectUri);\n  parameters.set('code_verifier', codeVerifier);\n  parameters.set('code', code);\n  return tokenEndpointRequest(as, client, 'authorization_code', parameters, options);\n}\nconst jwtClaimNames = {\n  aud: 'audience',\n  c_hash: 'code hash',\n  client_id: 'client id',\n  exp: 'expiration time',\n  iat: 'issued at',\n  iss: 'issuer',\n  jti: 'jwt id',\n  nonce: 'nonce',\n  s_hash: 'state hash',\n  sub: 'subject',\n  ath: 'access token hash',\n  htm: 'http method',\n  htu: 'http uri',\n  cnf: 'confirmation'\n};\nfunction validatePresence(required, result) {\n  for (const claim of required) {\n    if (result.claims[claim] === undefined) {\n      throw new OPE(`JWT \"${claim}\" (${jwtClaimNames[claim]}) claim missing`);\n    }\n  }\n  return result;\n}\nexport const expectNoNonce = Symbol();\nexport const skipAuthTimeCheck = Symbol();\nexport async function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge) {\n  const result = await processGenericAccessTokenResponse(as, client, response);\n  if (isOAuth2Error(result)) {\n    return result;\n  }\n  if (!validateString(result.id_token)) {\n    throw new OPE('\"response\" body \"id_token\" property must be a non-empty string');\n  }\n  maxAge ?? (maxAge = client.default_max_age ?? skipAuthTimeCheck);\n  const claims = getValidatedIdTokenClaims(result);\n  if ((client.require_auth_time || maxAge !== skipAuthTimeCheck) && claims.auth_time === undefined) {\n    throw new OPE('ID Token \"auth_time\" (authentication time) claim missing');\n  }\n  if (maxAge !== skipAuthTimeCheck) {\n    if (typeof maxAge !== 'number' || maxAge < 0) {\n      throw new TypeError('\"maxAge\" must be a non-negative number');\n    }\n    const now = epochTime() + getClockSkew(client);\n    const tolerance = getClockTolerance(client);\n    if (claims.auth_time + maxAge < now - tolerance) {\n      throw new OPE('too much time has elapsed since the last End-User authentication');\n    }\n  }\n  switch (expectedNonce) {\n    case undefined:\n    case expectNoNonce:\n      if (claims.nonce !== undefined) {\n        throw new OPE('unexpected ID Token \"nonce\" claim value');\n      }\n      break;\n    default:\n      if (!validateString(expectedNonce)) {\n        throw new TypeError('\"expectedNonce\" must be a non-empty string');\n      }\n      if (claims.nonce === undefined) {\n        throw new OPE('ID Token \"nonce\" claim missing');\n      }\n      if (claims.nonce !== expectedNonce) {\n        throw new OPE('unexpected ID Token \"nonce\" claim value');\n      }\n  }\n  return result;\n}\nexport async function processAuthorizationCodeOAuth2Response(as, client, response) {\n  const result = await processGenericAccessTokenResponse(as, client, response, true);\n  if (isOAuth2Error(result)) {\n    return result;\n  }\n  if (result.id_token !== undefined) {\n    if (typeof result.id_token === 'string' && result.id_token.length) {\n      throw new OPE('Unexpected ID Token returned, use processAuthorizationCodeOpenIDResponse() for OpenID Connect callback processing');\n    }\n    delete result.id_token;\n  }\n  return result;\n}\nfunction checkJwtType(expected, result) {\n  if (typeof result.header.typ !== 'string' || normalizeTyp(result.header.typ) !== expected) {\n    throw new OPE('unexpected JWT \"typ\" header parameter value');\n  }\n  return result;\n}\nexport async function clientCredentialsGrantRequest(as, client, parameters, options) {\n  assertAs(as);\n  assertClient(client);\n  return tokenEndpointRequest(as, client, 'client_credentials', new URLSearchParams(parameters), options);\n}\nexport async function genericTokenEndpointRequest(as, client, grantType, parameters, options) {\n  assertAs(as);\n  assertClient(client);\n  if (!validateString(grantType)) {\n    throw new TypeError('\"grantType\" must be a non-empty string');\n  }\n  return tokenEndpointRequest(as, client, grantType, new URLSearchParams(parameters), options);\n}\nexport async function processClientCredentialsResponse(as, client, response) {\n  const result = await processGenericAccessTokenResponse(as, client, response, true, true);\n  if (isOAuth2Error(result)) {\n    return result;\n  }\n  return result;\n}\nexport async function revocationRequest(as, client, token, options) {\n  assertAs(as);\n  assertClient(client);\n  if (!validateString(token)) {\n    throw new TypeError('\"token\" must be a non-empty string');\n  }\n  const url = resolveEndpoint(as, 'revocation_endpoint', alias(client, options));\n  const body = new URLSearchParams(options?.additionalParameters);\n  body.set('token', token);\n  const headers = prepareHeaders(options?.headers);\n  headers.delete('accept');\n  return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport async function processRevocationResponse(response) {\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 200) {\n    let err;\n    if (err = await handleOAuthBodyError(response)) {\n      return err;\n    }\n    throw new OPE('\"response\" is not a conform Revocation Endpoint response');\n  }\n  return undefined;\n}\nfunction assertReadableResponse(response) {\n  if (response.bodyUsed) {\n    throw new TypeError('\"response\" body has been used already');\n  }\n}\nexport async function introspectionRequest(as, client, token, options) {\n  assertAs(as);\n  assertClient(client);\n  if (!validateString(token)) {\n    throw new TypeError('\"token\" must be a non-empty string');\n  }\n  const url = resolveEndpoint(as, 'introspection_endpoint', alias(client, options));\n  const body = new URLSearchParams(options?.additionalParameters);\n  body.set('token', token);\n  const headers = prepareHeaders(options?.headers);\n  if (options?.requestJwtResponse ?? client.introspection_signed_response_alg) {\n    headers.set('accept', 'application/token-introspection+jwt');\n  } else {\n    headers.set('accept', 'application/json');\n  }\n  return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport async function processIntrospectionResponse(as, client, response) {\n  assertAs(as);\n  assertClient(client);\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 200) {\n    let err;\n    if (err = await handleOAuthBodyError(response)) {\n      return err;\n    }\n    throw new OPE('\"response\" is not a conform Introspection Endpoint response');\n  }\n  let json;\n  if (getContentType(response) === 'application/token-introspection+jwt') {\n    assertReadableResponse(response);\n    const {\n      claims,\n      jwt\n    } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.introspection_signed_response_alg, as.introspection_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client), client[jweDecrypt]).then(checkJwtType.bind(undefined, 'token-introspection+jwt')).then(validatePresence.bind(undefined, ['aud', 'iat', 'iss'])).then(validateIssuer.bind(undefined, as.issuer)).then(validateAudience.bind(undefined, client.client_id));\n    jwtResponseBodies.set(response, jwt);\n    json = claims.token_introspection;\n    if (!isJsonObject(json)) {\n      throw new OPE('JWT \"token_introspection\" claim must be a JSON object');\n    }\n  } else {\n    assertReadableResponse(response);\n    try {\n      json = await response.json();\n    } catch (cause) {\n      throw new OPE('failed to parse \"response\" body as JSON', {\n        cause\n      });\n    }\n    if (!isJsonObject(json)) {\n      throw new OPE('\"response\" body must be a top level object');\n    }\n  }\n  if (typeof json.active !== 'boolean') {\n    throw new OPE('\"response\" body \"active\" property must be a boolean');\n  }\n  return json;\n}\nasync function jwksRequest(as, options) {\n  assertAs(as);\n  const url = resolveEndpoint(as, 'jwks_uri');\n  const headers = prepareHeaders(options?.headers);\n  headers.set('accept', 'application/json');\n  headers.append('accept', 'application/jwk-set+json');\n  return (options?.[customFetch] || fetch)(url.href, {\n    headers: Object.fromEntries(headers.entries()),\n    method: 'GET',\n    redirect: 'manual',\n    signal: options?.signal ? signal(options.signal) : null\n  }).then(processDpopNonce);\n}\nasync function processJwksResponse(response) {\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 200) {\n    throw new OPE('\"response\" is not a conform JSON Web Key Set response');\n  }\n  assertReadableResponse(response);\n  let json;\n  try {\n    json = await response.json();\n  } catch (cause) {\n    throw new OPE('failed to parse \"response\" body as JSON', {\n      cause\n    });\n  }\n  if (!isJsonObject(json)) {\n    throw new OPE('\"response\" body must be a top level object');\n  }\n  if (!Array.isArray(json.keys)) {\n    throw new OPE('\"response\" body \"keys\" property must be an array');\n  }\n  if (!Array.prototype.every.call(json.keys, isJsonObject)) {\n    throw new OPE('\"response\" body \"keys\" property members must be JWK formatted objects');\n  }\n  return json;\n}\nasync function handleOAuthBodyError(response) {\n  if (response.status > 399 && response.status < 500) {\n    assertReadableResponse(response);\n    try {\n      const json = await response.json();\n      if (isJsonObject(json) && typeof json.error === 'string' && json.error.length) {\n        if (json.error_description !== undefined && typeof json.error_description !== 'string') {\n          delete json.error_description;\n        }\n        if (json.error_uri !== undefined && typeof json.error_uri !== 'string') {\n          delete json.error_uri;\n        }\n        if (json.algs !== undefined && typeof json.algs !== 'string') {\n          delete json.algs;\n        }\n        if (json.scope !== undefined && typeof json.scope !== 'string') {\n          delete json.scope;\n        }\n        return json;\n      }\n    } catch {}\n  }\n  return undefined;\n}\nfunction checkSupportedJwsAlg(alg) {\n  if (!SUPPORTED_JWS_ALGS.includes(alg)) {\n    throw new UnsupportedOperationError('unsupported JWS \"alg\" identifier');\n  }\n  return alg;\n}\nfunction checkRsaKeyAlgorithm(algorithm) {\n  if (typeof algorithm.modulusLength !== 'number' || algorithm.modulusLength < 2048) {\n    throw new OPE(`${algorithm.name} modulusLength must be at least 2048 bits`);\n  }\n}\nfunction ecdsaHashName(namedCurve) {\n  switch (namedCurve) {\n    case 'P-256':\n      return 'SHA-256';\n    case 'P-384':\n      return 'SHA-384';\n    case 'P-521':\n      return 'SHA-512';\n    default:\n      throw new UnsupportedOperationError();\n  }\n}\nfunction keyToSubtle(key) {\n  switch (key.algorithm.name) {\n    case 'ECDSA':\n      return {\n        name: key.algorithm.name,\n        hash: ecdsaHashName(key.algorithm.namedCurve)\n      };\n    case 'RSA-PSS':\n      {\n        checkRsaKeyAlgorithm(key.algorithm);\n        switch (key.algorithm.hash.name) {\n          case 'SHA-256':\n          case 'SHA-384':\n          case 'SHA-512':\n            return {\n              name: key.algorithm.name,\n              saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3\n            };\n          default:\n            throw new UnsupportedOperationError();\n        }\n      }\n    case 'RSASSA-PKCS1-v1_5':\n      checkRsaKeyAlgorithm(key.algorithm);\n      return key.algorithm.name;\n    case 'Ed448':\n    case 'Ed25519':\n      return key.algorithm.name;\n  }\n  throw new UnsupportedOperationError();\n}\nconst noSignatureCheck = Symbol();\nasync function validateJwsSignature(protectedHeader, payload, key, signature) {\n  const input = `${protectedHeader}.${payload}`;\n  const verified = await crypto.subtle.verify(keyToSubtle(key), key, signature, buf(input));\n  if (!verified) {\n    throw new OPE('JWT signature verification failed');\n  }\n}\nasync function validateJwt(jws, checkAlg, getKey, clockSkew, clockTolerance, decryptJwt) {\n  let {\n    0: protectedHeader,\n    1: payload,\n    2: encodedSignature,\n    length\n  } = jws.split('.');\n  if (length === 5) {\n    if (decryptJwt !== undefined) {\n      jws = await decryptJwt(jws);\n      ({\n        0: protectedHeader,\n        1: payload,\n        2: encodedSignature,\n        length\n      } = jws.split('.'));\n    } else {\n      throw new UnsupportedOperationError('JWE structure JWTs are not supported');\n    }\n  }\n  if (length !== 3) {\n    throw new OPE('Invalid JWT');\n  }\n  let header;\n  try {\n    header = JSON.parse(buf(b64u(protectedHeader)));\n  } catch (cause) {\n    throw new OPE('failed to parse JWT Header body as base64url encoded JSON', {\n      cause\n    });\n  }\n  if (!isJsonObject(header)) {\n    throw new OPE('JWT Header must be a top level object');\n  }\n  checkAlg(header);\n  if (header.crit !== undefined) {\n    throw new OPE('unexpected JWT \"crit\" header parameter');\n  }\n  const signature = b64u(encodedSignature);\n  let key;\n  if (getKey !== noSignatureCheck) {\n    key = await getKey(header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n  }\n  let claims;\n  try {\n    claims = JSON.parse(buf(b64u(payload)));\n  } catch (cause) {\n    throw new OPE('failed to parse JWT Payload body as base64url encoded JSON', {\n      cause\n    });\n  }\n  if (!isJsonObject(claims)) {\n    throw new OPE('JWT Payload must be a top level object');\n  }\n  const now = epochTime() + clockSkew;\n  if (claims.exp !== undefined) {\n    if (typeof claims.exp !== 'number') {\n      throw new OPE('unexpected JWT \"exp\" (expiration time) claim type');\n    }\n    if (claims.exp <= now - clockTolerance) {\n      throw new OPE('unexpected JWT \"exp\" (expiration time) claim value, timestamp is <= now()');\n    }\n  }\n  if (claims.iat !== undefined) {\n    if (typeof claims.iat !== 'number') {\n      throw new OPE('unexpected JWT \"iat\" (issued at) claim type');\n    }\n  }\n  if (claims.iss !== undefined) {\n    if (typeof claims.iss !== 'string') {\n      throw new OPE('unexpected JWT \"iss\" (issuer) claim type');\n    }\n  }\n  if (claims.nbf !== undefined) {\n    if (typeof claims.nbf !== 'number') {\n      throw new OPE('unexpected JWT \"nbf\" (not before) claim type');\n    }\n    if (claims.nbf > now + clockTolerance) {\n      throw new OPE('unexpected JWT \"nbf\" (not before) claim value, timestamp is > now()');\n    }\n  }\n  if (claims.aud !== undefined) {\n    if (typeof claims.aud !== 'string' && !Array.isArray(claims.aud)) {\n      throw new OPE('unexpected JWT \"aud\" (audience) claim type');\n    }\n  }\n  return {\n    header,\n    claims,\n    signature,\n    key,\n    jwt: jws\n  };\n}\nexport async function validateJwtAuthResponse(as, client, parameters, expectedState, options) {\n  assertAs(as);\n  assertClient(client);\n  if (parameters instanceof URL) {\n    parameters = parameters.searchParams;\n  }\n  if (!(parameters instanceof URLSearchParams)) {\n    throw new TypeError('\"parameters\" must be an instance of URLSearchParams, or URL');\n  }\n  const response = getURLSearchParameter(parameters, 'response');\n  if (!response) {\n    throw new OPE('\"parameters\" does not contain a JARM response');\n  }\n  const {\n    claims\n  } = await validateJwt(response, checkSigningAlgorithm.bind(undefined, client.authorization_signed_response_alg, as.authorization_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options), getClockSkew(client), getClockTolerance(client), client[jweDecrypt]).then(validatePresence.bind(undefined, ['aud', 'exp', 'iss'])).then(validateIssuer.bind(undefined, as.issuer)).then(validateAudience.bind(undefined, client.client_id));\n  const result = new URLSearchParams();\n  for (const [key, value] of Object.entries(claims)) {\n    if (typeof value === 'string' && key !== 'aud') {\n      result.set(key, value);\n    }\n  }\n  return validateAuthResponse(as, client, result, expectedState);\n}\nasync function idTokenHash(alg, data, key) {\n  let algorithm;\n  switch (alg) {\n    case 'RS256':\n    case 'PS256':\n    case 'ES256':\n      algorithm = 'SHA-256';\n      break;\n    case 'RS384':\n    case 'PS384':\n    case 'ES384':\n      algorithm = 'SHA-384';\n      break;\n    case 'RS512':\n    case 'PS512':\n    case 'ES512':\n      algorithm = 'SHA-512';\n      break;\n    case 'EdDSA':\n      if (key.algorithm.name === 'Ed25519') {\n        algorithm = 'SHA-512';\n        break;\n      }\n      throw new UnsupportedOperationError();\n    default:\n      throw new UnsupportedOperationError();\n  }\n  const digest = await crypto.subtle.digest(algorithm, buf(data));\n  return b64u(digest.slice(0, digest.byteLength / 2));\n}\nasync function idTokenHashMatches(data, actual, alg, key) {\n  const expected = await idTokenHash(alg, data, key);\n  return actual === expected;\n}\nexport async function validateDetachedSignatureResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n  assertAs(as);\n  assertClient(client);\n  if (parameters instanceof URL) {\n    if (!parameters.hash.length) {\n      throw new TypeError('\"parameters\" as an instance of URL must contain a hash (fragment) with the Authorization Response parameters');\n    }\n    parameters = new URLSearchParams(parameters.hash.slice(1));\n  }\n  if (!(parameters instanceof URLSearchParams)) {\n    throw new TypeError('\"parameters\" must be an instance of URLSearchParams');\n  }\n  parameters = new URLSearchParams(parameters);\n  const id_token = getURLSearchParameter(parameters, 'id_token');\n  parameters.delete('id_token');\n  switch (expectedState) {\n    case undefined:\n    case expectNoState:\n      break;\n    default:\n      if (!validateString(expectedState)) {\n        throw new TypeError('\"expectedState\" must be a non-empty string');\n      }\n  }\n  const result = validateAuthResponse({\n    ...as,\n    authorization_response_iss_parameter_supported: false\n  }, client, parameters, expectedState);\n  if (isOAuth2Error(result)) {\n    return result;\n  }\n  if (!id_token) {\n    throw new OPE('\"parameters\" does not contain an ID Token');\n  }\n  const code = getURLSearchParameter(parameters, 'code');\n  if (!code) {\n    throw new OPE('\"parameters\" does not contain an Authorization Code');\n  }\n  const requiredClaims = ['aud', 'exp', 'iat', 'iss', 'sub', 'nonce', 'c_hash'];\n  if (typeof expectedState === 'string') {\n    requiredClaims.push('s_hash');\n  }\n  const {\n    claims,\n    header,\n    key\n  } = await validateJwt(id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options), getClockSkew(client), getClockTolerance(client), client[jweDecrypt]).then(validatePresence.bind(undefined, requiredClaims)).then(validateIssuer.bind(undefined, as.issuer)).then(validateAudience.bind(undefined, client.client_id));\n  const clockSkew = getClockSkew(client);\n  const now = epochTime() + clockSkew;\n  if (claims.iat < now - 3600) {\n    throw new OPE('unexpected JWT \"iat\" (issued at) claim value, it is too far in the past');\n  }\n  if (typeof claims.c_hash !== 'string' || (await idTokenHashMatches(code, claims.c_hash, header.alg, key)) !== true) {\n    throw new OPE('invalid ID Token \"c_hash\" (code hash) claim value');\n  }\n  if (claims.s_hash !== undefined && typeof expectedState !== 'string') {\n    throw new OPE('could not verify ID Token \"s_hash\" (state hash) claim value');\n  }\n  if (typeof expectedState === 'string' && (typeof claims.s_hash !== 'string' || (await idTokenHashMatches(expectedState, claims.s_hash, header.alg, key)) !== true)) {\n    throw new OPE('invalid ID Token \"s_hash\" (state hash) claim value');\n  }\n  if (claims.auth_time !== undefined && (!Number.isFinite(claims.auth_time) || Math.sign(claims.auth_time) !== 1)) {\n    throw new OPE('ID Token \"auth_time\" (authentication time) must be a positive number');\n  }\n  maxAge ?? (maxAge = client.default_max_age ?? skipAuthTimeCheck);\n  if ((client.require_auth_time || maxAge !== skipAuthTimeCheck) && claims.auth_time === undefined) {\n    throw new OPE('ID Token \"auth_time\" (authentication time) claim missing');\n  }\n  if (maxAge !== skipAuthTimeCheck) {\n    if (typeof maxAge !== 'number' || maxAge < 0) {\n      throw new TypeError('\"maxAge\" must be a non-negative number');\n    }\n    const now = epochTime() + getClockSkew(client);\n    const tolerance = getClockTolerance(client);\n    if (claims.auth_time + maxAge < now - tolerance) {\n      throw new OPE('too much time has elapsed since the last End-User authentication');\n    }\n  }\n  if (!validateString(expectedNonce)) {\n    throw new TypeError('\"expectedNonce\" must be a non-empty string');\n  }\n  if (claims.nonce !== expectedNonce) {\n    throw new OPE('unexpected ID Token \"nonce\" claim value');\n  }\n  if (Array.isArray(claims.aud) && claims.aud.length !== 1) {\n    if (claims.azp === undefined) {\n      throw new OPE('ID Token \"aud\" (audience) claim includes additional untrusted audiences');\n    }\n    if (claims.azp !== client.client_id) {\n      throw new OPE('unexpected ID Token \"azp\" (authorized party) claim value');\n    }\n  }\n  return result;\n}\nfunction checkSigningAlgorithm(client, issuer, header) {\n  if (client !== undefined) {\n    if (header.alg !== client) {\n      throw new OPE('unexpected JWT \"alg\" header parameter');\n    }\n    return;\n  }\n  if (Array.isArray(issuer)) {\n    if (!issuer.includes(header.alg)) {\n      throw new OPE('unexpected JWT \"alg\" header parameter');\n    }\n    return;\n  }\n  if (header.alg !== 'RS256') {\n    throw new OPE('unexpected JWT \"alg\" header parameter');\n  }\n}\nfunction getURLSearchParameter(parameters, name) {\n  const {\n    0: value,\n    length\n  } = parameters.getAll(name);\n  if (length > 1) {\n    throw new OPE(`\"${name}\" parameter must be provided only once`);\n  }\n  return value;\n}\nexport const skipStateCheck = Symbol();\nexport const expectNoState = Symbol();\nexport function validateAuthResponse(as, client, parameters, expectedState) {\n  assertAs(as);\n  assertClient(client);\n  if (parameters instanceof URL) {\n    parameters = parameters.searchParams;\n  }\n  if (!(parameters instanceof URLSearchParams)) {\n    throw new TypeError('\"parameters\" must be an instance of URLSearchParams, or URL');\n  }\n  if (getURLSearchParameter(parameters, 'response')) {\n    throw new OPE('\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()');\n  }\n  const iss = getURLSearchParameter(parameters, 'iss');\n  const state = getURLSearchParameter(parameters, 'state');\n  if (!iss && as.authorization_response_iss_parameter_supported) {\n    throw new OPE('response parameter \"iss\" (issuer) missing');\n  }\n  if (iss && iss !== as.issuer) {\n    throw new OPE('unexpected \"iss\" (issuer) response parameter value');\n  }\n  switch (expectedState) {\n    case undefined:\n    case expectNoState:\n      if (state !== undefined) {\n        throw new OPE('unexpected \"state\" response parameter encountered');\n      }\n      break;\n    case skipStateCheck:\n      break;\n    default:\n      if (!validateString(expectedState)) {\n        throw new OPE('\"expectedState\" must be a non-empty string');\n      }\n      if (state === undefined) {\n        throw new OPE('response parameter \"state\" missing');\n      }\n      if (state !== expectedState) {\n        throw new OPE('unexpected \"state\" response parameter value');\n      }\n  }\n  const error = getURLSearchParameter(parameters, 'error');\n  if (error) {\n    return {\n      error,\n      error_description: getURLSearchParameter(parameters, 'error_description'),\n      error_uri: getURLSearchParameter(parameters, 'error_uri')\n    };\n  }\n  const id_token = getURLSearchParameter(parameters, 'id_token');\n  const token = getURLSearchParameter(parameters, 'token');\n  if (id_token !== undefined || token !== undefined) {\n    throw new UnsupportedOperationError('implicit and hybrid flows are not supported');\n  }\n  return brand(new URLSearchParams(parameters));\n}\nfunction algToSubtle(alg, crv) {\n  switch (alg) {\n    case 'PS256':\n    case 'PS384':\n    case 'PS512':\n      return {\n        name: 'RSA-PSS',\n        hash: `SHA-${alg.slice(-3)}`\n      };\n    case 'RS256':\n    case 'RS384':\n    case 'RS512':\n      return {\n        name: 'RSASSA-PKCS1-v1_5',\n        hash: `SHA-${alg.slice(-3)}`\n      };\n    case 'ES256':\n    case 'ES384':\n      return {\n        name: 'ECDSA',\n        namedCurve: `P-${alg.slice(-3)}`\n      };\n    case 'ES512':\n      return {\n        name: 'ECDSA',\n        namedCurve: 'P-521'\n      };\n    case 'EdDSA':\n      {\n        switch (crv) {\n          case 'Ed25519':\n          case 'Ed448':\n            return crv;\n          default:\n            throw new UnsupportedOperationError();\n        }\n      }\n    default:\n      throw new UnsupportedOperationError();\n  }\n}\nasync function importJwk(alg, jwk) {\n  const {\n    ext,\n    key_ops,\n    use,\n    ...key\n  } = jwk;\n  return crypto.subtle.importKey('jwk', key, algToSubtle(alg, jwk.crv), true, ['verify']);\n}\nexport async function deviceAuthorizationRequest(as, client, parameters, options) {\n  assertAs(as);\n  assertClient(client);\n  const url = resolveEndpoint(as, 'device_authorization_endpoint', alias(client, options));\n  const body = new URLSearchParams(parameters);\n  body.set('client_id', client.client_id);\n  const headers = prepareHeaders(options?.headers);\n  headers.set('accept', 'application/json');\n  return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport async function processDeviceAuthorizationResponse(as, client, response) {\n  assertAs(as);\n  assertClient(client);\n  if (!looseInstanceOf(response, Response)) {\n    throw new TypeError('\"response\" must be an instance of Response');\n  }\n  if (response.status !== 200) {\n    let err;\n    if (err = await handleOAuthBodyError(response)) {\n      return err;\n    }\n    throw new OPE('\"response\" is not a conform Device Authorization Endpoint response');\n  }\n  assertReadableResponse(response);\n  let json;\n  try {\n    json = await response.json();\n  } catch (cause) {\n    throw new OPE('failed to parse \"response\" body as JSON', {\n      cause\n    });\n  }\n  if (!isJsonObject(json)) {\n    throw new OPE('\"response\" body must be a top level object');\n  }\n  if (!validateString(json.device_code)) {\n    throw new OPE('\"response\" body \"device_code\" property must be a non-empty string');\n  }\n  if (!validateString(json.user_code)) {\n    throw new OPE('\"response\" body \"user_code\" property must be a non-empty string');\n  }\n  if (!validateString(json.verification_uri)) {\n    throw new OPE('\"response\" body \"verification_uri\" property must be a non-empty string');\n  }\n  if (typeof json.expires_in !== 'number' || json.expires_in <= 0) {\n    throw new OPE('\"response\" body \"expires_in\" property must be a positive number');\n  }\n  if (json.verification_uri_complete !== undefined && !validateString(json.verification_uri_complete)) {\n    throw new OPE('\"response\" body \"verification_uri_complete\" property must be a non-empty string');\n  }\n  if (json.interval !== undefined && (typeof json.interval !== 'number' || json.interval <= 0)) {\n    throw new OPE('\"response\" body \"interval\" property must be a positive number');\n  }\n  return json;\n}\nexport async function deviceCodeGrantRequest(as, client, deviceCode, options) {\n  assertAs(as);\n  assertClient(client);\n  if (!validateString(deviceCode)) {\n    throw new TypeError('\"deviceCode\" must be a non-empty string');\n  }\n  const parameters = new URLSearchParams(options?.additionalParameters);\n  parameters.set('device_code', deviceCode);\n  return tokenEndpointRequest(as, client, 'urn:ietf:params:oauth:grant-type:device_code', parameters, options);\n}\nexport async function processDeviceCodeResponse(as, client, response) {\n  return processGenericAccessTokenResponse(as, client, response);\n}\nexport async function generateKeyPair(alg, options) {\n  if (!validateString(alg)) {\n    throw new TypeError('\"alg\" must be a non-empty string');\n  }\n  const algorithm = algToSubtle(alg, alg === 'EdDSA' ? options?.crv ?? 'Ed25519' : undefined);\n  if (alg.startsWith('PS') || alg.startsWith('RS')) {\n    Object.assign(algorithm, {\n      modulusLength: options?.modulusLength ?? 2048,\n      publicExponent: new Uint8Array([0x01, 0x00, 0x01])\n    });\n  }\n  return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, ['sign', 'verify']);\n}\nfunction normalizeHtu(htu) {\n  const url = new URL(htu);\n  url.search = '';\n  url.hash = '';\n  return url.href;\n}\nasync function validateDPoP(as, request, accessToken, accessTokenClaims, options) {\n  const header = request.headers.get('dpop');\n  if (header === null) {\n    throw new OPE('operation indicated DPoP use but the request has no DPoP HTTP Header');\n  }\n  if (request.headers.get('authorization')?.toLowerCase().startsWith('dpop ') === false) {\n    throw new OPE(`operation indicated DPoP use but the request's Authorization HTTP Header scheme is not DPoP`);\n  }\n  if (typeof accessTokenClaims.cnf?.jkt !== 'string') {\n    throw new OPE('operation indicated DPoP use but the JWT Access Token has no jkt confirmation claim');\n  }\n  const clockSkew = getClockSkew(options);\n  const proof = await validateJwt(header, checkSigningAlgorithm.bind(undefined, undefined, as?.dpop_signing_alg_values_supported || SUPPORTED_JWS_ALGS), async ({\n    jwk,\n    alg\n  }) => {\n    if (!jwk) {\n      throw new OPE('DPoP Proof is missing the jwk header parameter');\n    }\n    const key = await importJwk(alg, jwk);\n    if (key.type !== 'public') {\n      throw new OPE('DPoP Proof jwk header parameter must contain a public key');\n    }\n    return key;\n  }, clockSkew, getClockTolerance(options), undefined).then(checkJwtType.bind(undefined, 'dpop+jwt')).then(validatePresence.bind(undefined, ['iat', 'jti', 'ath', 'htm', 'htu']));\n  const now = epochTime() + clockSkew;\n  const diff = Math.abs(now - proof.claims.iat);\n  if (diff > 300) {\n    throw new OPE('DPoP Proof iat is not recent enough');\n  }\n  if (proof.claims.htm !== request.method) {\n    throw new OPE('DPoP Proof htm mismatch');\n  }\n  if (typeof proof.claims.htu !== 'string' || normalizeHtu(proof.claims.htu) !== normalizeHtu(request.url)) {\n    throw new OPE('DPoP Proof htu mismatch');\n  }\n  {\n    const expected = b64u(await crypto.subtle.digest('SHA-256', encoder.encode(accessToken)));\n    if (proof.claims.ath !== expected) {\n      throw new OPE('DPoP Proof ath mismatch');\n    }\n  }\n  {\n    let components;\n    switch (proof.header.jwk.kty) {\n      case 'EC':\n        components = {\n          crv: proof.header.jwk.crv,\n          kty: proof.header.jwk.kty,\n          x: proof.header.jwk.x,\n          y: proof.header.jwk.y\n        };\n        break;\n      case 'OKP':\n        components = {\n          crv: proof.header.jwk.crv,\n          kty: proof.header.jwk.kty,\n          x: proof.header.jwk.x\n        };\n        break;\n      case 'RSA':\n        components = {\n          e: proof.header.jwk.e,\n          kty: proof.header.jwk.kty,\n          n: proof.header.jwk.n\n        };\n        break;\n      default:\n        throw new UnsupportedOperationError();\n    }\n    const expected = b64u(await crypto.subtle.digest('SHA-256', encoder.encode(JSON.stringify(components))));\n    if (accessTokenClaims.cnf.jkt !== expected) {\n      throw new OPE('JWT Access Token confirmation mismatch');\n    }\n  }\n}\nexport async function validateJwtAccessToken(as, request, expectedAudience, options) {\n  assertAs(as);\n  if (!looseInstanceOf(request, Request)) {\n    throw new TypeError('\"request\" must be an instance of Request');\n  }\n  if (!validateString(expectedAudience)) {\n    throw new OPE('\"expectedAudience\" must be a non-empty string');\n  }\n  const authorization = request.headers.get('authorization');\n  if (authorization === null) {\n    throw new OPE('\"request\" is missing an Authorization HTTP Header');\n  }\n  let {\n    0: scheme,\n    1: accessToken,\n    length\n  } = authorization.split(' ');\n  scheme = scheme.toLowerCase();\n  switch (scheme) {\n    case 'dpop':\n    case 'bearer':\n      break;\n    default:\n      throw new UnsupportedOperationError('unsupported Authorization HTTP Header scheme');\n  }\n  if (length !== 2) {\n    throw new OPE('invalid Authorization HTTP Header format');\n  }\n  const requiredClaims = ['iss', 'exp', 'aud', 'sub', 'iat', 'jti', 'client_id'];\n  if (options?.requireDPoP || scheme === 'dpop' || request.headers.has('dpop')) {\n    requiredClaims.push('cnf');\n  }\n  const {\n    claims\n  } = await validateJwt(accessToken, checkSigningAlgorithm.bind(undefined, undefined, SUPPORTED_JWS_ALGS), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options), getClockSkew(options), getClockTolerance(options), undefined).then(checkJwtType.bind(undefined, 'at+jwt')).then(validatePresence.bind(undefined, requiredClaims)).then(validateIssuer.bind(undefined, as.issuer)).then(validateAudience.bind(undefined, expectedAudience));\n  for (const claim of ['client_id', 'jti', 'sub']) {\n    if (typeof claims[claim] !== 'string') {\n      throw new OPE(`unexpected JWT \"${claim}\" claim type`);\n    }\n  }\n  if ('cnf' in claims) {\n    if (!isJsonObject(claims.cnf)) {\n      throw new OPE('unexpected JWT \"cnf\" (confirmation) claim value');\n    }\n    const {\n      0: cnf,\n      length\n    } = Object.keys(claims.cnf);\n    if (length) {\n      if (length !== 1) {\n        throw new UnsupportedOperationError('multiple confirmation claims are not supported');\n      }\n      if (cnf !== 'jkt') {\n        throw new UnsupportedOperationError('unsupported JWT Confirmation method');\n      }\n    }\n  }\n  if (options?.requireDPoP || scheme === 'dpop' || claims.cnf?.jkt !== undefined || request.headers.has('dpop')) {\n    await validateDPoP(as, request, accessToken, claims, options);\n  }\n  return claims;\n}\nexport const experimentalCustomFetch = customFetch;\nexport const experimental_customFetch = customFetch;\nexport const experimentalUseMtlsAlias = useMtlsAlias;\nexport const experimental_useMtlsAlias = useMtlsAlias;\nexport const experimental_validateDetachedSignatureResponse = (...args) => validateDetachedSignatureResponse(...args);\nexport const experimental_validateJwtAccessToken = (...args) => validateJwtAccessToken(...args);\nexport const validateJwtUserinfoSignature = (...args) => validateJwtUserInfoSignature(...args);\nexport const experimental_jwksCache = jwksCache;","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isOAuth2Error } from \"oauth4webapi\";\nexport function throwIfError(result) {\n  if (isOAuth2Error(result)) {\n    throw new Error(`Failed to get token: ${result.error}`);\n  }\n  return result;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { processRevocationResponse, revocationRequest } from \"oauth4webapi\";\nimport invariant from \"tiny-invariant\";\nimport { TypedEventTarget } from \"typescript-event-target\";\nimport { throwIfError } from \"./throwIfError.js\";\n// Node 18 is supposed to have a `CustomEvent` but it is not exposed on `globalThis`\n// which creates a problem for making a single codebase for node and browser. This polyfill works around it\nconst CustomEvent = process.env.TARGET === \"browser\" ? globalThis.CustomEvent : globalThis.CustomEvent ?? class CustomEvent extends Event {\n  #detail;\n  constructor(type, options) {\n    super(type, options);\n    this.#detail = options?.detail ?? null;\n  }\n  get detail() {\n    return this.#detail;\n  }\n};\n\n/**\n * Specifies where to store refresh tokens.\n *\n * - `'localStorage'`: Tokens persist across browser sessions. Best UX but vulnerable on shared devices without browser separation.\n * - `'sessionStorage'`: Tokens cleared when browser/tab closes. Recommended for shared devices.\n * - `'none'`: Tokens never stored. Users re-authenticate on every page load.\n */\n\nfunction localStorageKey(client) {\n  return `@osdk/oauth : refresh : ${client.client_id}`;\n}\n\n/**\n * Returns the appropriate Storage object based on the storage type.\n * Returns undefined if storage type is 'none' or if running in Node.js (where storage APIs don't exist).\n *\n * Call this once at client initialization and pass the result to storage functions.\n */\nexport function getStorage(storageType) {\n  if (storageType === \"none\") return undefined;\n\n  // Node.js doesn't have Web Storage APIs\n  if (process.env.TARGET !== \"browser\") {\n    return undefined;\n  }\n  if (storageType === \"sessionStorage\") return globalThis.sessionStorage;\n  return globalThis.localStorage;\n}\nexport function saveLocal(client, x, storage) {\n  storage?.setItem(localStorageKey(client), JSON.stringify(x));\n}\nexport function removeLocal(client, storage) {\n  storage?.removeItem(localStorageKey(client));\n}\nexport function readLocal(client, storage) {\n  return JSON.parse(storage?.getItem(localStorageKey(client)) ?? \"{}\");\n}\nexport function saveSession(client, x) {\n  // MUST `sessionStorage?` as nodejs does not have sessionStorage\n  globalThis.sessionStorage?.setItem(localStorageKey(client), JSON.stringify(x));\n}\nexport function removeSession(client) {\n  // MUST `sessionStorage?` as nodejs does not have sessionStorage\n  globalThis.sessionStorage?.removeItem(localStorageKey(client));\n}\nexport function readSession(client) {\n  return JSON.parse(\n  // MUST `sessionStorage?` as nodejs does not have sessionStorage\n  globalThis.sessionStorage?.getItem(localStorageKey(client)) ?? \"{}\");\n}\nexport function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMarker, scopes, storage) {\n  let token;\n  const eventTarget = new TypedEventTarget();\n  function makeTokenAndSaveRefresh(resp, type) {\n    const {\n      refresh_token,\n      expires_in,\n      access_token\n    } = resp;\n    !(expires_in != null) ? process.env.NODE_ENV !== \"production\" ? invariant(false) : invariant(false) : void 0;\n    saveLocal(client, {\n      refresh_token,\n      refreshTokenMarker,\n      requestedScopes: scopes\n    }, storage);\n    token = {\n      refresh_token,\n      expires_in,\n      access_token,\n      expires_at: Date.now() + expires_in * 1000\n    };\n    eventTarget.dispatchTypedEvent(type, new CustomEvent(type, {\n      detail: token\n    }));\n    return token;\n  }\n  let refreshTimeout;\n  function rmTimeout() {\n    if (refreshTimeout) clearTimeout(refreshTimeout);\n  }\n  function restartRefreshTimer(evt) {\n    if (refresh) {\n      rmTimeout();\n      refreshTimeout = setTimeout(refresh, evt.detail.expires_in * 1000 - 60 * 1000);\n    }\n  }\n  async function signOut() {\n    !token ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"not signed in\") : invariant(false) : void 0;\n    const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));\n    rmTimeout();\n\n    // Clean up\n    removeLocal(client, storage);\n    token = undefined;\n    throwIfError(result);\n    eventTarget.dispatchTypedEvent(\"signOut\", new Event(\"signOut\"));\n  }\n  let pendingSignIn;\n  async function signIn() {\n    if (pendingSignIn) {\n      return pendingSignIn;\n    }\n    try {\n      pendingSignIn = _signIn();\n      return await pendingSignIn;\n    } finally {\n      pendingSignIn = undefined;\n    }\n  }\n  eventTarget.addEventListener(\"signIn\", restartRefreshTimer);\n  eventTarget.addEventListener(\"refresh\", restartRefreshTimer);\n  function getTokenOrUndefined() {\n    if (!token || Date.now() >= token.expires_at) {\n      return undefined;\n    }\n    return token?.access_token;\n  }\n  const getToken = Object.assign(async function getToken() {\n    if (!token || Date.now() >= token.expires_at) {\n      token = await signIn();\n    }\n    return token?.access_token;\n  }, {\n    signIn,\n    refresh,\n    signOut,\n    rmTimeout,\n    getTokenOrUndefined,\n    addEventListener: eventTarget.addEventListener.bind(eventTarget),\n    removeEventListener: eventTarget.removeEventListener.bind(eventTarget)\n  });\n  return {\n    getToken,\n    makeTokenAndSaveRefresh\n  };\n}\nexport function createAuthorizationServer(ctxPath, url) {\n  const issuer = `${new URL(ctxPath, url.endsWith(\"/\") ? url : url + \"/\")}`;\n  return {\n    token_endpoint: `${issuer}/api/oauth2/token`,\n    authorization_endpoint: `${issuer}/api/oauth2/authorize`,\n    revocation_endpoint: `${issuer}/api/oauth2/revoke_token`,\n    issuer\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { clientCredentialsGrantRequest, customFetch, processClientCredentialsResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n\n/**\n * @param client_id\n * @param client_secret\n * @param url the base url of your foundry server\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns which can be used as a token provider\n */\nexport function createConfidentialOauthClient(client_id, client_secret, url, scopes = [\"api:read-data\", \"api:write-data\", \"api:use-ontologies-read\", \"api:use-ontologies-write\"], fetchFn = globalThis.fetch, ctxPath = \"multipass\") {\n  const client = {\n    client_id,\n    client_secret\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const joinedScopes = scopes.join(\" \");\n  const {\n    getToken,\n    makeTokenAndSaveRefresh\n  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, undefined, joinedScopes, undefined);\n  async function _signIn() {\n    return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({\n      scope: joinedScopes\n    }), oauthHttpOptions))), \"signIn\");\n  }\n  return getToken;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport function delay(ms) {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport invariant from \"tiny-invariant\";\nexport function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath) {\n  let options = {};\n  if (typeof useHistory === \"object\") {\n    !(!loginPage && !postLoginPage && !scopes && !fetchFn && !ctxPath) ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"If useHistory is an object, other options should not be provided\") : invariant(false) : void 0;\n    options = useHistory;\n  } else {\n    options = {\n      useHistory,\n      loginPage,\n      postLoginPage,\n      scopes,\n      fetchFn,\n      ctxPath\n    };\n  }\n  !url ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"url is required\") : invariant(false) : void 0;\n  !redirect_uri ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"redirectUrl is required\") : invariant(false) : void 0;\n\n  // Assign defaults\n  return {\n    useHistory: options.useHistory ?? true,\n    loginPage: options.loginPage,\n    postLoginPage: options.postLoginPage || window.location.toString(),\n    joinedScopes: [...(options.scopes ?? [\"api:read-data\", \"api:write-data\", \"api:use-ontologies-read\", \"api:use-ontologies-write\"])].sort().join(\" \"),\n    fetchFn: options.fetchFn ?? globalThis.fetch,\n    ctxPath: options.ctxPath ?? \"multipass\",\n    refreshTokenMarker: options.refreshTokenMarker,\n    tokenStorage: options.tokenStorage ?? \"localStorage\",\n    logger: options.logger\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, getStorage, readLocal, readSession, removeLocal, removeSession, saveLocal, saveSession } from \"./common.js\";\nimport { delay } from \"./delay.js\";\nimport { throwIfError } from \"./throwIfError.js\";\nimport { processOptionsAndAssignDefaults } from \"./utils.js\";\n\n/**\n * Creates a PublicOauthClient for authentication.\n *\n * @param {string} clientId - The client_id from the OAuth configuration on the server\n * @param {string} url - The base URL of your Foundry server\n * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server\n * @param {PublicOauthClientOptions} options - Additional options for the client\n * @returns {PublicOauthClient} A client that can be used as a token provider\n */\n\n/**\n * Creates a PublicOauthClient for authentication.\n *\n * @param {string} clientId - The client_id from the OAuth configuration on the server\n * @param {string} url - The base URL of your Foundry server\n * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server\n * @param {boolean} useHistory - If true, uses `history.replaceState()`, otherwise uses `window.location.assign()` (defaults to true)\n * @param {string} loginPage - Custom landing page URL prior to logging in\n * @param {string} postLoginPage - URL to return to after completed authentication cycle (defaults to `window.location.toString()`)\n * @param {string[]} scopes - OAuth scopes to request. If not provided, defaults to `[\"api:read-data\", \"api:write-data\", \"api:use-ontologies-read\", \"api:use-ontologies-write\"]`\n * @param {typeof globalThis.fetch} fetchFn - Custom fetch function to use for requests (defaults to `globalThis.fetch`)\n * @param {string} ctxPath - Context path for the authorization server (defaults to \"multipass\")\n * @returns {PublicOauthClient} A client that can be used as a token provider\n */\n\nexport function createPublicOauthClient(client_id, url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath) {\n  let refreshTokenMarker;\n  let joinedScopes;\n  let tokenStorage;\n  let logger;\n  ({\n    useHistory,\n    loginPage,\n    postLoginPage,\n    joinedScopes,\n    fetchFn,\n    ctxPath,\n    refreshTokenMarker,\n    tokenStorage,\n    logger\n  } = processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath));\n  const client = {\n    client_id,\n    token_endpoint_auth_method: \"none\"\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const storage = getStorage(tokenStorage);\n  const {\n    makeTokenAndSaveRefresh,\n    getToken\n  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), refreshTokenMarker, joinedScopes, storage);\n\n  // as an arrow function, `useHistory` is known to be a boolean\n  const go = async x => {\n    if (useHistory) {\n      window.history.replaceState({}, \"\", x);\n      return;\n    } else window.location.assign(x);\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  };\n  async function maybeRefresh(expectRefreshToken) {\n    if (tokenStorage === \"none\") {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    const {\n      refresh_token,\n      refreshTokenMarker: lastRefreshTokenMarker,\n      requestedScopes: initialRequestedScopes\n    } = readLocal(client, storage);\n    const areScopesEqual = initialRequestedScopes != null && joinedScopes === initialRequestedScopes;\n    if (!refresh_token || lastRefreshTokenMarker !== refreshTokenMarker || !areScopesEqual) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      const result = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n      if (result && window.location.pathname === new URL(redirect_uri).pathname) {\n        const {\n          oldUrl\n        } = readSession(client);\n        // don't block on the redirect\n        void go(oldUrl ?? \"/\");\n      }\n      return result;\n    } catch (e) {\n      if (process.env.NODE_ENV !== \"production\") {\n        logger?.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n      }\n      removeLocal(client, storage);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n  async function maybeHandleAuthReturn() {\n    const {\n      state,\n      oldUrl,\n      codeVerifier\n    } = readSession(client);\n    if (!codeVerifier) return;\n    try {\n      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirect_uri, codeVerifier, oauthHttpOptions))), \"signIn\");\n      void go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process.env.NODE_ENV !== \"production\") {\n        logger?.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n      }\n      removeLocal(client, storage);\n      removeSession(client);\n      throw e;\n    }\n  }\n\n  // As an arrow function, `scopes` and `postLoginPage` are known at compile time\n  const initiateLoginRedirect = async () => {\n    if (loginPage && window.location.href !== loginPage && window.location.pathname !== loginPage) {\n      saveLocal(client, {}, storage);\n      saveSession(client, {\n        oldUrl: postLoginPage\n      });\n      await go(loginPage);\n      return;\n    }\n    const state = generateRandomState();\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readSession(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {}, storage);\n    saveSession(client, {\n      codeVerifier,\n      state,\n      oldUrl\n    });\n\n    // Only request offline_access (refresh tokens) if we're going to store them\n    const scopeString = tokenStorage === \"none\" ? joinedScopes : `offline_access ${joinedScopes}`;\n    window.location.assign(`${authServer.authorization_endpoint}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: scopeString\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  };\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return (await maybeRefresh()) ?? (\n    // 2. If there is no refresh token we are likely trying to perform the callback\n    await maybeHandleAuthReturn()) ?? (\n    // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n    await initiateLoginRedirect());\n  }\n  return getToken;\n}"]}