{"version":3,"file":"index.cjs","names":["i","a","o","s","c","l","d","f","p","m","h","decodeBase64URL","jwk.isJWK","jwk.isSecretJWK","invalidKeyInput","jwk.isPrivateJWK","jwk.isPublicJWK","b64u","#jwks","#cached","#url","#timeoutDuration","#cooldownDuration","#cacheMaxAge","#headers","#customFetch","#cache","#jwksTimestamp","#local","#pendingFetch"],"sources":["../logger/index.js","../inject/index.js","../../../packages/auth/src/server/services/session.service.ts","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/base64.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/util/base64url.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/crypto_key.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/invalid_key_input.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/util/errors.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/is_key_like.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/helpers.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/type_checks.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/signing.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/jwk_to_key.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/normalize_key.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/key/import.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/validate_crit.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/validate_algorithms.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/check_key_type.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jws/flattened/verify.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jws/compact/verify.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwt/verify.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwks/local.js","../../.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwks/remote.js","../../../packages/auth/src/server/utils/pkce.ts","../../../packages/auth/src/server/services/oauth-authentication.service.ts","../../../packages/auth/src/server/routes/authenticated.ts","../../../packages/auth/src/server/utils/sanitizeRedirectUrl.ts","../../../packages/auth/src/server/routes/callback.ts","../../.pnpm/uncrypto@0.1.3/node_modules/uncrypto/dist/crypto.web.mjs","../../../packages/auth/src/server/routes/login.ts","../../../packages/auth/src/server/routes/logout.ts","../../../packages/auth/src/server/routes/protected-data.ts","../../../packages/auth/src/server/utils/timing-safe-equal.ts","../../../packages/auth/src/server/routes/refresh-tokens.ts","../../../packages/auth/src/server/routes/user.ts","../../../packages/auth/src/server/functions/registerRoutes.ts","../../../packages/auth/src/server/utils/getLastPathSegment.ts","../../../packages/auth/src/server/functions/handleAuthRoute.ts","../../../packages/auth/src/server/functions/checkAuthentication.ts","../../../packages/auth/src/server/functions/useAnalogAuthMiddleware.ts","../../../packages/auth/src/server/functions/useAnalogAuth.ts"],"sourcesContent":["import { defineEventHandler as e } from \"h3\";\n//#region src/lib/logger.types.ts\nvar t = /* @__PURE__ */ function(e) {\n\treturn e.SkyBlue = \"\\x1B[94m\", e.OceanBlue = \"\\x1B[34m\", e.MidnightBlue = \"\\x1B[38;5;17m\", e.SkyBlueBg = \"\\x1B[104m\", e.OceanBlueBg = \"\\x1B[44m\", e.MidnightBlueBg = \"\\x1B[48;5;17m\", e.MintGreen = \"\\x1B[92m\", e.ForestGreen = \"\\x1B[32m\", e.EmeraldGreen = \"\\x1B[38;5;28m\", e.MintGreenBg = \"\\x1B[102m\", e.ForestGreenBg = \"\\x1B[42m\", e.EmeraldGreenBg = \"\\x1B[48;5;28m\", e.LemonYellow = \"\\x1B[93m\", e.SunflowerYellow = \"\\x1B[33m\", e.GoldYellow = \"\\x1B[38;5;220m\", e.LemonYellowBg = \"\\x1B[103m\", e.SunflowerYellowBg = \"\\x1B[43m\", e.GoldYellowBg = \"\\x1B[48;5;220m\", e.RoseRed = \"\\x1B[91m\", e.FireRed = \"\\x1B[31m\", e.BurgundyRed = \"\\x1B[38;5;88m\", e.RoseRedBg = \"\\x1B[101m\", e.FireRedBg = \"\\x1B[41m\", e.BurgundyRedBg = \"\\x1B[48;5;88m\", e.LavenderPurple = \"\\x1B[95m\", e.RoyalPurple = \"\\x1B[38;5;93m\", e.DeepPurple = \"\\x1B[38;5;54m\", e.LavenderPurpleBg = \"\\x1B[105m\", e.RoyalPurpleBg = \"\\x1B[48;5;93m\", e.DeepPurpleBg = \"\\x1B[48;5;54m\", e.PeachOrange = \"\\x1B[38;5;215m\", e.TangerineOrange = \"\\x1B[38;5;208m\", e.AmberOrange = \"\\x1B[38;5;214m\", e.PeachOrangeBg = \"\\x1B[48;5;215m\", e.TangerineOrangeBg = \"\\x1B[48;5;208m\", e.AmberOrangeBg = \"\\x1B[48;5;214m\", e.SilverGray = \"\\x1B[37m\", e.SlateGray = \"\\x1B[90m\", e.CharcoalGray = \"\\x1B[38;5;238m\", e.SilverGrayBg = \"\\x1B[47m\", e.SlateGrayBg = \"\\x1B[100m\", e.CharcoalGrayBg = \"\\x1B[48;5;238m\", e.PureBlack = \"\\x1B[30m\", e.PureWhite = \"\\x1B[97m\", e.PureBlackBg = \"\\x1B[40m\", e.PureWhiteBg = \"\\x1B[107m\", e.Cyan = \"\\x1B[36m\", e.Reset = \"\\x1B[0m\", e.Bold = \"\\x1B[1m\", e.Dim = \"\\x1B[2m\", e.Underline = \"\\x1B[4m\", e.Blink = \"\\x1B[5m\", e.Reverse = \"\\x1B[7m\", e.Hidden = \"\\x1B[8m\", e;\n}({}), n = /* @__PURE__ */ function(e) {\n\treturn e[e.trace = 0] = \"trace\", e[e.debug = 1] = \"debug\", e[e.info = 2] = \"info\", e[e.warn = 3] = \"warn\", e[e.error = 4] = \"error\", e[e.fatal = 5] = \"fatal\", e[e.silent = 6] = \"silent\", e;\n}({});\nfunction r(e) {\n\treturn [\n\t\t\"trace\",\n\t\t\"debug\",\n\t\t\"info\",\n\t\t\"warn\",\n\t\t\"error\",\n\t\t\"fatal\",\n\t\t\"silent\"\n\t].includes(e);\n}\n//#endregion\n//#region src/lib/error-serialization/error-serializer.ts\nvar i = class e {\n\tstatic {\n\t\tthis.DEFAULT_MAX_DEPTH = 10;\n\t}\n\tstatic {\n\t\tthis.CIRCULAR_REF_PLACEHOLDER = \"[Circular Reference]\";\n\t}\n\tstatic {\n\t\tthis.MAX_DEPTH_PLACEHOLDER = \"[Max Depth Reached]\";\n\t}\n\tstatic {\n\t\tthis.UNABLE_TO_SERIALIZE = \"[Unable to serialize]\";\n\t}\n\tstatic {\n\t\tthis.serializationCache = /* @__PURE__ */ new Map();\n\t}\n\tstatic {\n\t\tthis.MAX_CACHE_SIZE = 100;\n\t}\n\tstatic getCacheKey(e, t, n, r) {\n\t\tif (!e.stack) return null;\n\t\tlet i = e.stack.split(\"\\n\")[0] || \"\";\n\t\treturn `${e.name}:${e.message}:${i}:${t}:${n}:${r}`;\n\t}\n\tstatic addToCache(e, t) {\n\t\tif (this.serializationCache.size >= this.MAX_CACHE_SIZE) {\n\t\t\tlet e = this.serializationCache.keys().next().value;\n\t\t\te && this.serializationCache.delete(e);\n\t\t}\n\t\tthis.serializationCache.set(e, t);\n\t}\n\tstatic serialize(t, n = {}) {\n\t\tlet { includeStack: r = !0, maxDepth: i = e.DEFAULT_MAX_DEPTH, includeNonEnumerable: a = !1 } = n;\n\t\tif (t instanceof Error) {\n\t\t\tlet e = this.getCacheKey(t, r, i, a);\n\t\t\tif (e) {\n\t\t\t\tlet t = this.serializationCache.get(e);\n\t\t\t\tif (t) return t;\n\t\t\t}\n\t\t\tlet n = this.serializeError(t, r, i, a, /* @__PURE__ */ new WeakSet());\n\t\t\treturn e && this.addToCache(e, n), n;\n\t\t}\n\t\tif (typeof t == \"string\") return t;\n\t\tlet o = this.safeStringify(t, i, /* @__PURE__ */ new WeakSet());\n\t\tif (typeof o == \"string\") return o;\n\t\ttry {\n\t\t\treturn JSON.stringify(o, null, 2);\n\t\t} catch {\n\t\t\treturn String(o);\n\t\t}\n\t}\n\tstatic serializeError(e, t, n, r, i = /* @__PURE__ */ new WeakSet()) {\n\t\tif (i.has(e)) return {\n\t\t\tmessage: e.message,\n\t\t\tname: e.name,\n\t\t\t[Symbol.for(\"circular\")]: this.CIRCULAR_REF_PLACEHOLDER\n\t\t};\n\t\ti.add(e);\n\t\tlet a = {\n\t\t\tmessage: e.message,\n\t\t\tname: e.name\n\t\t};\n\t\treturn t && e.stack && (a.stack = e.stack), \"cause\" in e && e.cause !== void 0 && (e.cause instanceof Error ? a.cause = this.serializeError(e.cause, t, n - 1, r, i) : a.cause = this.safeStringify(e.cause, n - 1, i)), Object.keys(e).forEach((t) => {\n\t\t\tif (!(t in a)) try {\n\t\t\t\tlet r = e;\n\t\t\t\ta[t] = this.safeStringify(r[t], n - 1, i);\n\t\t\t} catch {\n\t\t\t\ta[t] = this.UNABLE_TO_SERIALIZE;\n\t\t\t}\n\t\t}), r && Object.getOwnPropertyNames(e).forEach((t) => {\n\t\t\tif (!(t in a) && t !== \"stack\" && t !== \"message\" && t !== \"name\") try {\n\t\t\t\tlet r = Object.getOwnPropertyDescriptor(e, t);\n\t\t\t\tif (r && r.enumerable === !1) {\n\t\t\t\t\tlet r = e;\n\t\t\t\t\ta[t] = this.safeStringify(r[t], n - 1, i);\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\ta[t] = this.UNABLE_TO_SERIALIZE;\n\t\t\t}\n\t\t}), a;\n\t}\n\tstatic safeStringify(e, t, n = /* @__PURE__ */ new WeakSet()) {\n\t\tif (t <= 0) return this.MAX_DEPTH_PLACEHOLDER;\n\t\tif (typeof e != \"object\" || !e) return e;\n\t\tif (n.has(e)) return this.CIRCULAR_REF_PLACEHOLDER;\n\t\tn.add(e);\n\t\ttry {\n\t\t\tif (Array.isArray(e)) {\n\t\t\t\tlet r = e.map((e) => this.safeStringify(e, t - 1, n));\n\t\t\t\treturn n.delete(e), r;\n\t\t\t}\n\t\t\tlet r = {};\n\t\t\tfor (let [i, a] of Object.entries(e)) try {\n\t\t\t\tr[i] = this.safeStringify(a, t - 1, n);\n\t\t\t} catch {\n\t\t\t\tr[i] = this.UNABLE_TO_SERIALIZE;\n\t\t\t}\n\t\t\treturn n.delete(e), r;\n\t\t} catch {\n\t\t\treturn n.delete(e), this.UNABLE_TO_SERIALIZE;\n\t\t}\n\t}\n}, a = {\n\thighlight: {\n\t\tcolor: t.LemonYellow,\n\t\tbold: !0\n\t},\n\taccent: { color: t.SkyBlue },\n\tattention: {\n\t\tcolor: t.RoyalPurple,\n\t\tbold: !0\n\t},\n\tsuccess: { color: t.ForestGreen },\n\twarning: { color: t.TangerineOrange },\n\terror: { color: t.FireRed },\n\tinfo: { color: t.OceanBlue },\n\tdebug: { color: t.SlateGray }\n}, o = {\n\tsuccess: \"✅\",\n\twarning: \"⚠️\",\n\terror: \"❌\",\n\tinfo: \"ℹ️\",\n\tdebug: \"🐞\"\n}, s = {\n\ttrace: t.SlateGray,\n\tdebug: t.Cyan,\n\tinfo: t.ForestGreen,\n\twarn: t.SunflowerYellow,\n\terror: t.FireRed,\n\tfatal: t.FireRed,\n\tsilent: t.Reset\n}, c = class {\n\tresolveStyle(e, t = \"test\", n) {\n\t\treturn this.applyStyle(e, t, n);\n\t}\n\tstatic {\n\t\tthis.INJECTABLE = !0;\n\t}\n\tconstructor(e = {}) {\n\t\tthis.styleCache = /* @__PURE__ */ new Map();\n\t\tlet t = process.env.NODE_ENV === \"test\" || process.env.VITEST === \"true\";\n\t\tthis.useColors = e.useColors === void 0 ? !t : e.useColors, this.globalStyles = {\n\t\t\t...a,\n\t\t\t...e.styles\n\t\t}, this.globalIcons = {\n\t\t\t...o,\n\t\t\t...e.icons\n\t\t};\n\t}\n\tsetUseColors(e) {\n\t\tthis.useColors = e;\n\t}\n\tgetUseColors() {\n\t\treturn this.useColors;\n\t}\n\tupdateStyleConfig(e, t) {\n\t\tthis.globalStyles = {\n\t\t\t...this.globalStyles,\n\t\t\t...e\n\t\t}, this.globalIcons = {\n\t\t\t...this.globalIcons,\n\t\t\t...t\n\t\t};\n\t}\n\tformatMessage(e, n, r, i, a) {\n\t\tlet o = i ? `[${r}:${i}]` : `[${r}]`;\n\t\tif (this.useColors) {\n\t\t\tlet r = this.getColorForLevel(e);\n\t\t\treturn a && (r = a), `${r}${o} ${n}${t.Reset}`;\n\t\t} else return `${o} ${n}`;\n\t}\n\tformatMessageWithMetadata(e, t, n, r, i) {\n\t\tlet a = t, o = this.getColorForLevel(e);\n\t\tif (r?.style) {\n\t\t\tlet e = this.applyStyle(r.style, n, i);\n\t\t\te && (o = e);\n\t\t}\n\t\treturn r?.icon && (a = `${this.resolveIcon(r.icon, n, i)} ${t}`), this.formatMessage(e, a, n, i, o);\n\t}\n\tparseMetadataParameter(e, t = []) {\n\t\tif (e && typeof e == \"object\" && !Array.isArray(e) && (\"style\" in e || \"icon\" in e)) return {\n\t\t\tmetadata: e,\n\t\t\trestData: t\n\t\t};\n\t\tlet n = e === void 0 ? t : [e, ...t];\n\t\tif (n.length > 0) {\n\t\t\tlet e = n[n.length - 1];\n\t\t\tif (e && typeof e == \"object\" && !Array.isArray(e) && (\"style\" in e || \"icon\" in e)) return {\n\t\t\t\tmetadata: e,\n\t\t\t\trestData: n.slice(0, -1)\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tmetadata: void 0,\n\t\t\trestData: n\n\t\t};\n\t}\n\tgetColorForLevel(e) {\n\t\tlet r = s[n[e]];\n\t\treturn e === n.fatal ? `${t.Bold}${r}` : r || t.Reset;\n\t}\n\tapplyStyle(e, t, n) {\n\t\tlet r = this.getStyleCacheValue(e);\n\t\tif (r !== void 0) return r;\n\t\tif (typeof e == \"string\") {\n\t\t\tlet r = this.getSemanticStyleColor(e, t, n);\n\t\t\treturn this.setStyleCache(e, r), r;\n\t\t}\n\t\tif (typeof e == \"object\" && \"color\" in e) {\n\t\t\tif (!this.isValidColor(e.color)) {\n\t\t\t\tthis.setStyleCache(e, void 0), this.logWarning(\"Invalid color provided. Only predefined ColorEnum values are allowed.\", t, n);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlet r = this.constructStyleCode(e);\n\t\t\treturn this.setStyleCache(e, r), r;\n\t\t}\n\t\tthis.setStyleCache(e, void 0), this.logWarning(\"Unknown style configuration provided. Only semantic style names or valid ColorEnum objects are allowed.\", t, n);\n\t}\n\tisValidColor(e) {\n\t\treturn Object.values(t).includes(e);\n\t}\n\tisValidIcon(e) {\n\t\treturn this.isEmojiIcon(e);\n\t}\n\tgetStyleCacheValue(e) {\n\t\treturn this.styleCache.has(e) ? this.styleCache.get(e) : void 0;\n\t}\n\tsetStyleCache(e, t) {\n\t\tthis.styleCache.set(e, t);\n\t}\n\tlogWarning(e, t, n) {\n\t\tlet r = n ? `${t}:${n}` : t;\n\t\tconsole.warn(`[${r}] ${e}`);\n\t}\n\tconstructStyleCode(e) {\n\t\tlet n = e.color.toString();\n\t\treturn e.bold && (n += t.Bold), e.underline && (n += t.Underline), n;\n\t}\n\tgetSemanticStyleColor(e, n, r) {\n\t\tif (this.styleCache.has(e)) return this.styleCache.get(e);\n\t\tlet i = this.globalStyles[e];\n\t\tif (i) {\n\t\t\tlet n = i.color.toString();\n\t\t\treturn i.bold && (n += t.Bold), i.underline && (n += t.Underline), this.styleCache.set(e, n), n;\n\t\t}\n\t\tlet a = r ? `${n}:${r}` : n;\n\t\tconsole.warn(`[${a}] Unknown semantic style: ${e}. Falling back to default.`), this.styleCache.set(e, void 0);\n\t}\n\tgetStyleCache() {\n\t\treturn this.styleCache;\n\t}\n\tresolveIcon(e, t, n) {\n\t\tif (this.isValidIcon(e)) return e;\n\t\tlet r = [\n\t\t\t\"success\",\n\t\t\t\"warning\",\n\t\t\t\"error\",\n\t\t\t\"info\",\n\t\t\t\"debug\"\n\t\t], i = r.find((t) => t === e);\n\t\treturn i && this.globalIcons[i] ? this.globalIcons[i] : (r.includes(e) ? this.logWarning(`Unknown icon: ${e}. Expected a valid emoji or semantic icon name.`, t, n) : this.logWarning(`Invalid icon: ${e}. Expected a valid emoji or semantic icon name.`, t, n), e);\n\t}\n\tisEmojiIcon(e) {\n\t\treturn (/* @__PURE__ */ \"✅.⚠️.❌.ℹ️.🐞.⭐️.🚀.🔥.✔️.✖️.❓.🔒.🔓.⏳.🕒.⬆️.⬇️.➡️.⬅️.📁.📄.👤.👥.✏️.➕.➖.🔔.⚡️.🎁.🐛.🌟.❤️.👀.⚙️.🔧.🔨.🔑.🎉.📝.🚨.📅.💡.🔍.🔗.🔖.📌.📎.✉️.📞.🌍.☁️.🌈.🌙.☀️.❄️.✨.🎵.📷.🎥.🎤.🔊.🔋.🗑️.💰.💳.🎂.🏅.🏆.👑.🛸.🛡️.🛑.▶️.⏸️.⏺️.⏪.⏩.🔁.🔀.🎲.🎈.🍪.☕️.🍵.🍺.🍷.🍕.🍔.🍟.🍎.🍌.🍒.🍋.🥕.🌽.🥦.🥚.🧀.🍞.🍰.🍦.🍫.🍿.🥓.🍤.🐟.🦀.🐙.🐋.🐬.🐧.🐸.🐢.🐍.🐉.🦄.🐱.🐶.🐭.🐰.🐻.🐼.🐨.🐯.🦁.🐒.🐘.🐎.🐄.🐖.🐑.🐔.🦆.🦢.🦉.🦅.🦜.🦚.🦩.🦋.🐝.🐜.🐞.🕷️.🦂.🐌.🪱.🐛.🦗.🦟.🪰.🪳.🪲\".split(\".\")).includes(e);\n\t}\n}, l = class extends Error {\n\tconstructor(e) {\n\t\tsuper(e), this.name = \"LoggerError\";\n\t}\n}, u = class extends Error {\n\tconstructor(e) {\n\t\tsuper(e), this.name = \"LoggerContextError\";\n\t}\n}, d = {\n\tenabled: !1,\n\twindowMs: 5e3,\n\tflushOnCritical: !0\n}, f = [n.error, n.fatal], p = class {\n\tconstructor(e, t, n) {\n\t\tthis.config = e, this.formatter = t, this.loggerName = n, this.entries = /* @__PURE__ */ new Map();\n\t}\n\taddMessage(e, t, n = \"\") {\n\t\tif (!this.config.enabled || this.config.flushOnCritical && f.includes(e)) return !0;\n\t\tlet r = this.generateFingerprint(t, e, n), i = this.entries.get(r);\n\t\treturn i ? i.count++ : this.entries.set(r, {\n\t\t\tmessage: t,\n\t\t\tlevel: e,\n\t\t\tcontext: n,\n\t\t\tfirstSeen: Date.now(),\n\t\t\tcount: 1\n\t\t}), this.scheduleFlush(), !1;\n\t}\n\tflush() {\n\t\tif (this.entries.size !== 0) {\n\t\t\tthis.flushTimer &&= (clearTimeout(this.flushTimer), void 0);\n\t\t\tfor (let e of this.entries.values()) this.outputMessage(e);\n\t\t\tthis.entries.clear();\n\t\t}\n\t}\n\tdestroy() {\n\t\tthis.flushTimer &&= (clearTimeout(this.flushTimer), void 0), this.entries.clear();\n\t}\n\tgenerateFingerprint(e, t, n) {\n\t\treturn `${t}:${n}:${e}`;\n\t}\n\tscheduleFlush() {\n\t\tthis.flushTimer ||= setTimeout(() => {\n\t\t\tthis.flush();\n\t\t}, this.config.windowMs);\n\t}\n\toutputMessage(e) {\n\t\tlet t = e.message;\n\t\te.count > 1 && (t = `${t} (×${e.count})`);\n\t\tlet r = this.formatter.format({\n\t\t\tlevel: e.level,\n\t\t\tmessage: t,\n\t\t\tlogger: this.loggerName,\n\t\t\ttimestamp: new Date(e.firstSeen),\n\t\t\tcontext: e.context || void 0\n\t\t});\n\t\tswitch (e.level) {\n\t\t\tcase n.trace:\n\t\t\t\tconsole.trace(r);\n\t\t\t\tbreak;\n\t\t\tcase n.debug:\n\t\t\t\tconsole.debug(r);\n\t\t\t\tbreak;\n\t\t\tcase n.info:\n\t\t\t\tconsole.info(r);\n\t\t\t\tbreak;\n\t\t\tcase n.warn:\n\t\t\t\tconsole.warn(r);\n\t\t\t\tbreak;\n\t\t\tcase n.error:\n\t\t\t\tconsole.error(r);\n\t\t\t\tbreak;\n\t\t\tcase n.fatal:\n\t\t\t\tconsole.error(r);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}, m = class {\n\tconstructor(e) {\n\t\tthis.styleEngine = e;\n\t}\n\tformat(e) {\n\t\treturn e.styling ? this.styleEngine.formatMessageWithMetadata(e.level, e.message, e.logger, e.styling, e.context) : this.styleEngine.formatMessage(e.level, e.message, e.logger, e.context);\n\t}\n\tisSelfContained() {\n\t\treturn !1;\n\t}\n}, h = class {\n\tconstructor(e) {\n\t\tthis.prettyPrint = e?.prettyPrint ?? !1;\n\t}\n\tformat(e) {\n\t\ttry {\n\t\t\tlet t = {\n\t\t\t\ttimestamp: e.timestamp.toISOString(),\n\t\t\t\tlevel: this.getLevelName(e.level),\n\t\t\t\tlogger: e.logger,\n\t\t\t\tmessage: e.message\n\t\t\t};\n\t\t\treturn e.context && (t.context = e.context), e.correlationId && (t.correlationId = e.correlationId), e.metadata && Object.keys(e.metadata).length > 0 && (t.metadata = e.metadata), e.error && (t.error = i.serialize(e.error)), JSON.stringify(t, null, this.prettyPrint ? 2 : 0);\n\t\t} catch (t) {\n\t\t\treturn console.error(\"JsonFormatter: Failed to serialize log entry to JSON.\", {\n\t\t\t\terror: t,\n\t\t\t\tentry: e\n\t\t\t}), `${e.level} [${e.logger}] ${e.message} (formatting error)`;\n\t\t}\n\t}\n\tisSelfContained() {\n\t\treturn !0;\n\t}\n\tgetLevelName(e) {\n\t\tswitch (e) {\n\t\t\tcase n.trace: return \"trace\";\n\t\t\tcase n.debug: return \"debug\";\n\t\t\tcase n.info: return \"info\";\n\t\t\tcase n.warn: return \"warn\";\n\t\t\tcase n.error: return \"error\";\n\t\t\tcase n.fatal: return \"fatal\";\n\t\t\tdefault: return \"info\";\n\t\t}\n\t}\n}, g = class {\n\tconstructor(e) {\n\t\tthis.formatterFn = e;\n\t}\n\tformat(e) {\n\t\treturn this.formatterFn(e);\n\t}\n\tisSelfContained() {\n\t\treturn !0;\n\t}\n}, _ = class {\n\tstatic createConsole(e) {\n\t\treturn new m(new c({ useColors: e?.useColors }));\n\t}\n\tstatic createJson(e) {\n\t\treturn new h(e);\n\t}\n\tstatic createCustom(e) {\n\t\treturn new g(e);\n\t}\n}, v = {\n\tenabled: !0,\n\tstrategy: \"mask\",\n\tmaxDepth: 10\n}, y = [\n\t/password/i,\n\t/token/i,\n\t/secret/i,\n\t/apikey|api_key|api-key/i,\n\t/authorization/i,\n\t/credential/i,\n\t/private/i\n], b = [\n\t{\n\t\tpattern: /\\beyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}(?!\\w)/g,\n\t\treplacement: \"[TOKEN]\"\n\t},\n\t{\n\t\tpattern: /\\bBearer\\s+[A-Za-z0-9._~+/-]{8,}=*(?!\\w)/gi,\n\t\treplacement: \"Bearer [TOKEN]\"\n\t},\n\t{\n\t\tpattern: /\\b(?:sk_live|sk_test|pk_live|pk_test|ghp|gho|github_pat|xox[baprs]|ya29)[_.-][A-Za-z0-9_.-]{10,}(?!\\w)/g,\n\t\treplacement: \"[TOKEN]\"\n\t},\n\t{\n\t\tpattern: /(token|api_?key|secret|auth_?token)\\s*[:=]\\s*[A-Za-z0-9._~+/-]{10,}=*/gi,\n\t\treplacement: \"$1: [TOKEN]\"\n\t},\n\t{\n\t\tpattern: /\\b(?!(.)\\1{10})[A-Za-z0-9+/]{16,}={1,2}(?!\\w)/g,\n\t\treplacement: \"[TOKEN]\"\n\t},\n\t{\n\t\tpattern: /(?<![A-Za-z0-9+/])(?!(.)\\1{10})(?=[A-Za-z0-9+/]*[+/])(?=[A-Za-z0-9+/]*(?:\\+|[0-9]))[A-Za-z0-9+/]{16,}(?!\\w)/g,\n\t\treplacement: \"[TOKEN]\"\n\t},\n\t{\n\t\tpattern: /\\b(?!(.)\\1{10})(?=[A-Za-z0-9+/]*[0-9])(?=[A-Za-z0-9+/]*[A-Za-z])[A-Za-z0-9+/]{20,}={0,2}(?!\\w)/g,\n\t\treplacement: \"[TOKEN]\"\n\t},\n\t{\n\t\tpattern: /\\b\\d{4}[- ]?\\d{4}[- ]?\\d{4}[- ]?\\d{4}\\b/g,\n\t\treplacement: \"[CARD]\"\n\t},\n\t{\n\t\tpattern: /\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b/g,\n\t\treplacement: \"[EMAIL]\"\n\t},\n\t{\n\t\tpattern: /\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b/g,\n\t\treplacement: \"[IP]\"\n\t},\n\t{\n\t\tpattern: /\\b\\d{3}-\\d{2}-\\d{4}\\b/g,\n\t\treplacement: \"[SSN]\"\n\t}\n];\n//#endregion\n//#region src/lib/sanitization/sanitizer.ts\nfunction x(e) {\n\treturn e.replace(/\\r\\n|\\r|\\n/g, \"\\\\n\").replace(/\\t/g, \"\\\\t\").replace(/[\\x00-\\x1f\\x7f-\\x9f]/g, \"\");\n}\nfunction S(e, t) {\n\tlet n = 0;\n\tfor (let t = 0; t < e.length; t++) {\n\t\tlet r = e.charCodeAt(t);\n\t\tn = (n << 5) - n + r, n &= n;\n\t}\n\treturn Math.abs(n).toString(16).substring(0, t);\n}\nfunction C(e, t) {\n\tswitch (t.strategy) {\n\t\tcase \"mask\": return e.replace(t.pattern, t.replacement);\n\t\tcase \"remove\": return e.replace(t.pattern, \"\");\n\t\tcase \"hash\": return e.replace(t.pattern, (e) => `[HASH:${S(e, t.hashLength)}]`);\n\t\tcase \"custom\": return t.customHandler ? e.replace(t.pattern, t.customHandler) : e.replace(t.pattern, t.replacement);\n\t\tdefault: return e.replace(t.pattern, t.replacement);\n\t}\n}\nfunction w(e, t) {\n\tlet n = e;\n\tfor (let e of t) n = C(n, e);\n\treturn n;\n}\nfunction T(e) {\n\treturn y.some((t) => t.test(e));\n}\nfunction E(e, t, n = 0, r = /* @__PURE__ */ new WeakSet()) {\n\tif (!t.enabled || n > t.maxDepth || e == null) return e;\n\tif (typeof e == \"string\") {\n\t\tlet n = w(e, t.rules);\n\t\treturn n = x(n), n;\n\t}\n\tif (Array.isArray(e)) return r.has(e) ? \"[Circular Reference]\" : (r.add(e), e.map((e) => E(e, t, n + 1, r)));\n\tif (typeof e == \"object\") {\n\t\tif (r.has(e)) return \"[Circular Reference]\";\n\t\tr.add(e);\n\t\tlet i = {};\n\t\tfor (let [a, o] of Object.entries(e)) T(a) && typeof o == \"string\" ? i[a] = \"[REDACTED]\" : i[a] = E(o, t, n + 1, r);\n\t\treturn i;\n\t}\n\treturn e;\n}\nfunction D(e, t) {\n\treturn e.map((e) => ({\n\t\tpattern: e.pattern,\n\t\tstrategy: e.strategy ?? t,\n\t\treplacement: e.replacement ?? \"[REDACTED]\",\n\t\thashLength: e.hashLength ?? 8,\n\t\tcustomHandler: e.customHandler\n\t}));\n}\nfunction O(e) {\n\tlet t = e?.enabled ?? v.enabled, n = e?.strategy ?? v.strategy, r = e?.maxDepth ?? v.maxDepth, i;\n\treturn i = e?.rules ? e.rules : [...b, ...e?.customRules ?? []], {\n\t\tenabled: t,\n\t\trules: D(i, n),\n\t\tmaxDepth: r\n\t};\n}\nfunction k(e, t) {\n\tif (!t.enabled) return e;\n\tlet n = w(e, t.rules);\n\treturn n = x(n), n;\n}\n//#endregion\n//#region ../../node_modules/@analog-tools/inject/index.js\nvar A = class {\n\tstatic {\n\t\tthis.contexts = /* @__PURE__ */ new Map();\n\t}\n\tstatic {\n\t\tthis.defaultScope = \"default\";\n\t}\n\tstatic getRegistry(e = this.defaultScope) {\n\t\tthis.contexts.has(e) || this.contexts.set(e, new I());\n\t\tlet t = this.contexts.get(e);\n\t\tif (!t) throw Error(`Failed to create registry for scope '${e}'`);\n\t\treturn t;\n\t}\n\tstatic createScope(e) {\n\t\tif (this.contexts.has(e)) throw Error(`Scope '${e}' already exists`);\n\t\tlet t = new I();\n\t\treturn this.contexts.set(e, t), t;\n\t}\n\tstatic destroyScope(e) {\n\t\tlet t = this.contexts.get(e);\n\t\tt && (t.destroy(), this.contexts.delete(e));\n\t}\n\tstatic async destroyScopeAsync(e) {\n\t\tlet t = this.contexts.get(e);\n\t\tt && (await t.destroyAsync(), this.contexts.delete(e));\n\t}\n\tstatic async clearAllAsync() {\n\t\tlet e = [], t = Array.from(this.contexts.entries());\n\t\tfor (let [n, r] of t) try {\n\t\t\tawait r.destroyAsync();\n\t\t} catch (t) {\n\t\t\tt instanceof B ? e.push(...t.failures) : t instanceof Error && e.push({\n\t\t\t\tserviceName: `scope:${n}`,\n\t\t\t\terror: t\n\t\t\t});\n\t\t}\n\t\tif (this.contexts.clear(), e.length > 0) throw new B(e);\n\t}\n\tstatic setDefaultScope(e) {\n\t\tthis.defaultScope = e;\n\t}\n\tstatic getActiveScopes() {\n\t\treturn Array.from(this.contexts.keys());\n\t}\n\tstatic clearAll() {\n\t\tlet e = Array.from(this.contexts.values());\n\t\tfor (let t of e) t.destroy();\n\t\tthis.contexts.clear();\n\t}\n}, j = Symbol.for(\"@analog-tools/inject:SERVICE_TOKEN\");\nfunction M(e) {\n\treturn Symbol(e || \"ServiceToken\");\n}\nvar N = class {\n\tstatic {\n\t\tthis.tokens = /* @__PURE__ */ new WeakMap();\n\t}\n\tstatic getToken(e) {\n\t\tif (!this.tokens.has(e)) {\n\t\t\tlet t = M(e.name);\n\t\t\tthis.tokens.set(e, t);\n\t\t}\n\t\tlet t = this.tokens.get(e);\n\t\tif (!t) throw Error(`Failed to get token for service ${e.name}`);\n\t\treturn t;\n\t}\n\tstatic setToken(e, t) {\n\t\tthis.tokens.set(e, t);\n\t}\n};\nfunction P(e) {\n\treturn (t) => {\n\t\tlet n = e || N.getToken(t);\n\t\treturn N.setToken(t, n), t.INJECTABLE = !0, t[j] = n, t;\n\t};\n}\nfunction F() {\n\treturn A.getRegistry();\n}\nvar I = class {\n\tconstructor() {\n\t\tthis.serviceMap = /* @__PURE__ */ new Map(), this.initializingServices = /* @__PURE__ */ new Set(), this.initializationPromises = /* @__PURE__ */ new Map(), this.serviceNames = /* @__PURE__ */ new Map(), this.initializedServices = /* @__PURE__ */ new Set(), this.destroyed = !1;\n\t}\n\tgetServiceKey(e) {\n\t\tlet t = e[j];\n\t\tif (!t) throw new z(e.name);\n\t\treturn this.serviceNames.set(t, e.name), t;\n\t}\n\tgetServiceName(e) {\n\t\treturn this.serviceNames.get(e) ?? \"Unknown\";\n\t}\n\tregister(e, ...t) {\n\t\tlet n = this.getServiceKey(e);\n\t\tif (this.initializingServices.has(n)) throw new R([e.name]);\n\t\tif (!this.serviceMap.has(n) || this.serviceMap.get(n) === void 0) {\n\t\t\tthis.initializingServices.add(n);\n\t\t\ttry {\n\t\t\t\tlet r = t.length === 0 ? new e() : new e(...t);\n\t\t\t\tthis.serviceMap.set(n, r);\n\t\t\t} finally {\n\t\t\t\tthis.initializingServices.delete(n);\n\t\t\t}\n\t\t}\n\t}\n\tregisterAsUndefined(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\tthis.serviceMap.set(t, void 0);\n\t}\n\tregisterCustomServiceInstance(e, t) {\n\t\tlet n = this.getServiceKey(e);\n\t\tthis.serviceNames.set(n, e.name), this.serviceMap.set(n, t);\n\t}\n\tgetService(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\treturn this.serviceMap.has(t) || this.register(e), this.serviceMap.get(t);\n\t}\n\thasService(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\treturn this.serviceMap.has(t);\n\t}\n\tasync ensureAsyncInitialized(e, t) {\n\t\tif (this.initializedServices.has(t)) return;\n\t\tif (this.initializationPromises.has(t)) {\n\t\t\tlet e = this.initializationPromises.get(t);\n\t\t\tif (e) {\n\t\t\t\tawait e;\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t\tlet n = e;\n\t\tif (typeof n.initializeAsync != \"function\") {\n\t\t\tthis.initializedServices.add(t);\n\t\t\tlet e = Promise.resolve();\n\t\t\treturn this.initializationPromises.set(t, e), e;\n\t\t}\n\t\tlet r = n.initializeAsync().then(() => {\n\t\t\tthis.initializedServices.add(t);\n\t\t}).catch((e) => {\n\t\t\tthrow this.initializationPromises.delete(t), e;\n\t\t});\n\t\tthis.initializationPromises.set(t, r), await r;\n\t}\n\tasync getServiceAsync(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\tthis.serviceMap.has(t) || this.register(e);\n\t\tlet n = this.serviceMap.get(t);\n\t\treturn n !== void 0 && await this.ensureAsyncInitialized(n, t), n;\n\t}\n\tasync registerAsync(e, ...t) {\n\t\tlet n = this.getServiceKey(e);\n\t\t(!this.serviceMap.has(n) || this.serviceMap.get(n) === void 0) && this.register(e, ...t);\n\t\tlet r = this.serviceMap.get(n);\n\t\tawait this.ensureAsyncInitialized(r, n);\n\t}\n\tasync destroyAsync() {\n\t\tif (this.destroyed) return;\n\t\tthis.destroyed = !0;\n\t\tlet e = Array.from(this.initializationPromises.values());\n\t\te.length > 0 && await Promise.allSettled(e);\n\t\tlet t = [], n = Array.from(this.serviceMap.entries());\n\t\tfor (let [e, r] of n) {\n\t\t\tif (!this.initializedServices.has(e) || r === void 0) continue;\n\t\t\tlet n = r;\n\t\t\tif (typeof n.onDestroy == \"function\") try {\n\t\t\t\tawait n.onDestroy();\n\t\t\t} catch (n) {\n\t\t\t\tt.push({\n\t\t\t\t\tserviceName: this.getServiceName(e),\n\t\t\t\t\terror: n\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tif (this.serviceMap.clear(), this.initializingServices.clear(), this.initializationPromises.clear(), this.initializedServices.clear(), this.serviceNames.clear(), t.length > 0) throw new B(t);\n\t}\n\tdestroy() {\n\t\tthis.serviceMap.clear(), this.initializingServices.clear(), this.initializationPromises.clear(), this.initializedServices.clear(), this.serviceNames.clear();\n\t}\n}, L = class extends Error {\n\tconstructor(e, t, n) {\n\t\tsuper(e), this.token = t, this.name = \"InjectionError\", n && (this.cause = n);\n\t}\n}, R = class extends L {\n\tconstructor(e) {\n\t\tsuper(`Circular dependency detected: ${e.join(\" -> \")}`), this.name = \"CircularDependencyError\";\n\t}\n}, z = class extends L {\n\tconstructor(e) {\n\t\tsuper(`Service '${e}' is missing SERVICE_TOKEN. Add @Injectable() decorator to the class. See: packages/inject/docs/migrations/symbol-tokens.md`, e), this.name = \"MissingServiceTokenError\";\n\t}\n}, B = class extends L {\n\tconstructor(e) {\n\t\tlet t = e.map((e) => `${e.serviceName}: ${e.error.message}`).join(\"; \");\n\t\tsuper(`Failed to destroy ${e.length} service(s): ${t}`), this.failures = e, this.name = \"AggregateDestructionError\";\n\t}\n\tgetErrors() {\n\t\treturn this.failures.map((e) => e.error);\n\t}\n\thasFailure(e) {\n\t\treturn this.failures.some((t) => t.serviceName === e);\n\t}\n};\nfunction V(e, t = {}) {\n\tlet { required: n = !0 } = t;\n\ttry {\n\t\tlet t = F().getService(e);\n\t\tif (t == null) {\n\t\t\tif (n) throw new L(`Service '${e.name}' not found in registry and is required`, e.name);\n\t\t\treturn;\n\t\t}\n\t\treturn t;\n\t} catch (t) {\n\t\tthrow t instanceof L ? t : new L(`Failed to inject service '${e.name}'`, e.name, t);\n\t}\n}\n//#endregion\n//#region \\0@oxc-project+runtime@0.139.0/helpers/esm/decorateMetadata.js\nfunction H(e, t) {\n\tif (typeof Reflect == \"object\" && typeof Reflect.metadata == \"function\") return Reflect.metadata(e, t);\n}\n//#endregion\n//#region \\0@oxc-project+runtime@0.139.0/helpers/esm/decorate.js\nfunction U(e, t, n, r) {\n\tvar i = arguments.length, a = i < 3 ? t : r === null ? r = Object.getOwnPropertyDescriptor(t, n) : r, o;\n\tif (typeof Reflect == \"object\" && typeof Reflect.decorate == \"function\") a = Reflect.decorate(e, t, n, r);\n\telse for (var s = e.length - 1; s >= 0; s--) (o = e[s]) && (a = (i < 3 ? o(a) : i > 3 ? o(t, n, a) : o(t, n)) || a);\n\treturn i > 3 && a && Object.defineProperty(t, n, a), a;\n}\n//#endregion\n//#region src/lib/logger.service.ts\nvar W, G = W = class {\n\tconstructor(e = {}, t, r, i) {\n\t\tif (this.config = e, this.childLoggers = {}, this.disabledContexts = [], this.activeGroups = [], i) this.parentLogger = i, this.name = i.name, this.context = r, this.logLevel = i.getLogLevel(), this.styleEngine = i.styleEngine, this.formatter = i.formatter, this.correlationId = i.correlationId, this.sanitizer = i.sanitizer;\n\t\telse {\n\t\t\tif (typeof e.level == \"string\" && !Object.keys(n).includes(e.level)) throw new l(`Invalid log level: ${e.level}`);\n\t\t\tif (this.logLevel = this.castLoglevel(e.level || process.env.LOG_LEVEL || \"info\"), this.name = e.name || \"analog-tools\", this.correlationId = e.correlationId, this.setDisabledContexts(e.disabledContexts ?? process.env.LOG_DISABLED_CONTEXTS?.split(\",\") ?? []), this.styleEngine = t || new c({\n\t\t\t\tuseColors: e.useColors,\n\t\t\t\tstyles: {\n\t\t\t\t\t...a,\n\t\t\t\t\t...e.styles\n\t\t\t\t},\n\t\t\t\ticons: {\n\t\t\t\t\t...o,\n\t\t\t\t\t...e.icons\n\t\t\t\t}\n\t\t\t}), this.formatter = e.formatter || _.createConsole({ useColors: this.styleEngine.getUseColors() }), e.deduplication?.enabled) {\n\t\t\t\tlet t = {\n\t\t\t\t\tenabled: !0,\n\t\t\t\t\twindowMs: e.deduplication.windowMs ?? d.windowMs,\n\t\t\t\t\tflushOnCritical: e.deduplication.flushOnCritical ?? d.flushOnCritical\n\t\t\t\t};\n\t\t\t\tthis.deduplicator = new p(t, this.formatter, this.name);\n\t\t\t}\n\t\t\tthis.sanitizer = O(e.sanitization);\n\t\t}\n\t}\n\tresolveMessage(e) {\n\t\tif (typeof e == \"function\") try {\n\t\t\treturn e();\n\t\t} catch (e) {\n\t\t\treturn console.error(\"Logger: Message evaluation failed:\", e), `[Message evaluation failed: ${e}]`;\n\t\t}\n\t\treturn e;\n\t}\n\tisContextEnabled() {\n\t\treturn !this.context || !(this.parentLogger || this).disabledContexts.includes(this.context);\n\t}\n\tsetDisabledContexts(e) {\n\t\tthis.disabledContexts = e;\n\t}\n\tgetLogLevel() {\n\t\treturn this.logLevel;\n\t}\n\tgetDisabledContexts() {\n\t\treturn (this.parentLogger || this).disabledContexts || [];\n\t}\n\tsetUseColors(e) {\n\t\t(this.parentLogger || this).styleEngine.setUseColors(e);\n\t}\n\tgetUseColors() {\n\t\treturn (this.parentLogger || this).styleEngine.getUseColors();\n\t}\n\tsetCorrelationId(e) {\n\t\tthis.correlationId = e;\n\t}\n\tgetCorrelationId() {\n\t\treturn this.correlationId;\n\t}\n\tclearCorrelationId() {\n\t\tthis.correlationId = void 0;\n\t}\n\tforContext(e) {\n\t\treturn this.childLoggers[e] || (this.childLoggers[e] = new W({}, void 0, e, this)), this.childLoggers[e];\n\t}\n\tgroup(e) {\n\t\tif (!this.isContextEnabled()) return;\n\t\t(this.parentLogger?.activeGroups || this.activeGroups).push(e);\n\t\tlet t = this.formatter.format({\n\t\t\tlevel: n.info,\n\t\t\tmessage: `Group: ${e}`,\n\t\t\tlogger: this.name,\n\t\t\tcontext: this.context,\n\t\t\ttimestamp: /* @__PURE__ */ new Date(),\n\t\t\tcorrelationId: this.getCorrelationId()\n\t\t});\n\t\tconsole.group(`${t} ▼`);\n\t}\n\tgroupEnd(e) {\n\t\tif (!this.isContextEnabled()) return;\n\t\tlet t = this.parentLogger?.activeGroups || this.activeGroups;\n\t\tif (e) {\n\t\t\tlet n = t.lastIndexOf(e);\n\t\t\tif (n !== -1) {\n\t\t\t\tlet e = t.splice(n);\n\t\t\t\tfor (let t = 0; t < e.length; t++) console.groupEnd(), console.log(\"\");\n\t\t\t}\n\t\t} else t.length > 0 && (t.pop(), console.groupEnd(), console.log(\"\"));\n\t}\n\ttrace(e, t, ...r) {\n\t\tthis.doLog(n.trace, e, t, ...r);\n\t}\n\tdebug(e, t, ...r) {\n\t\tthis.doLog(n.debug, e, t, ...r);\n\t}\n\tinfo(e, t, ...r) {\n\t\tthis.doLog(n.info, e, t, ...r);\n\t}\n\twarn(e, t, ...r) {\n\t\tthis.doLog(n.warn, e, t, ...r);\n\t}\n\terror(e, t, r, ...i) {\n\t\tif (!this.isContextEnabled() || this.logLevel > n.error) return;\n\t\tlet { message: a, serializedError: o, rawError: s, context: c, data: l } = this.parseErrorParameters(e, t, r, i), u = k(a, this.sanitizer), d = c ? E(c, this.sanitizer) : void 0, f = l || [], p, m = f;\n\t\tif (f.length > 0) {\n\t\t\tlet e = f[f.length - 1];\n\t\t\te && typeof e == \"object\" && !Array.isArray(e) && (\"style\" in e || \"icon\" in e) && (p = e, m = f.slice(0, -1));\n\t\t}\n\t\tlet h = {\n\t\t\tlevel: n.error,\n\t\t\tmessage: u,\n\t\t\tlogger: this.name,\n\t\t\tcontext: this.context,\n\t\t\ttimestamp: /* @__PURE__ */ new Date(),\n\t\t\tmetadata: d,\n\t\t\terror: s,\n\t\t\tstyling: p,\n\t\t\tcorrelationId: this.getCorrelationId()\n\t\t}, g = this.formatter.format(h);\n\t\tif (this.formatter.isSelfContained()) console.error(g);\n\t\telse {\n\t\t\tlet e = [g];\n\t\t\to && e.push(o), d && e.push(d), console.error(...e, ...m);\n\t\t}\n\t}\n\tfatal(e, t, r, ...i) {\n\t\tif (!this.isContextEnabled() || this.logLevel > n.fatal) return;\n\t\tif (typeof e == \"string\" && t && typeof t == \"object\" && !Array.isArray(t) && (\"style\" in t || \"icon\" in t)) {\n\t\t\tlet r = t, i = k(`FATAL: ${e}`, this.sanitizer), a = this.styleEngine.formatMessageWithMetadata(n.fatal, i, this.name, r, this.context);\n\t\t\tconsole.error(a);\n\t\t\treturn;\n\t\t}\n\t\tlet { message: a, serializedError: o, rawError: s, context: c, data: l } = this.parseErrorParameters(e, t, r, i), u = k(a, this.sanitizer), d = c ? E(c, this.sanitizer) : void 0, f = l || [], p, m = f;\n\t\tif (f.length > 0) {\n\t\t\tlet e = f[f.length - 1];\n\t\t\te && typeof e == \"object\" && !Array.isArray(e) && (\"style\" in e || \"icon\" in e) && (p = e, m = f.slice(0, -1));\n\t\t}\n\t\tlet h = {\n\t\t\tlevel: n.fatal,\n\t\t\tmessage: `FATAL: ${u}`,\n\t\t\tlogger: this.name,\n\t\t\tcontext: this.context,\n\t\t\ttimestamp: /* @__PURE__ */ new Date(),\n\t\t\tmetadata: d,\n\t\t\terror: s,\n\t\t\tstyling: p,\n\t\t\tcorrelationId: this.getCorrelationId()\n\t\t}, g = this.formatter.format(h);\n\t\tif (this.formatter.isSelfContained()) console.error(g);\n\t\telse {\n\t\t\tlet e = [g];\n\t\t\to && e.push(o), d && e.push(d), console.error(...e, ...m);\n\t\t}\n\t}\n\tparseErrorParameters(e, t, n, r = []) {\n\t\tif (e instanceof Error && t === void 0) return {\n\t\t\tmessage: e.message,\n\t\t\tserializedError: i.serialize(e),\n\t\t\trawError: e,\n\t\t\tdata: []\n\t\t};\n\t\tif (typeof e == \"string\" && t === void 0) return {\n\t\t\tmessage: e,\n\t\t\tdata: []\n\t\t};\n\t\tif (typeof e == \"string\" && t instanceof Error && n === void 0) return {\n\t\t\tmessage: e,\n\t\t\tserializedError: i.serialize(t),\n\t\t\trawError: t,\n\t\t\tdata: []\n\t\t};\n\t\tif (typeof e == \"string\" && this.isLogContext(t) && n === void 0) return {\n\t\t\tmessage: e,\n\t\t\tcontext: t,\n\t\t\tdata: []\n\t\t};\n\t\tif (typeof e == \"string\" && t instanceof Error && this.isLogContext(n)) return {\n\t\t\tmessage: e,\n\t\t\tserializedError: i.serialize(t),\n\t\t\trawError: t,\n\t\t\tcontext: n,\n\t\t\tdata: r\n\t\t};\n\t\tlet a = typeof e == \"string\" ? e : \"Unknown error\", o = t instanceof Error ? t : void 0;\n\t\treturn {\n\t\t\tmessage: a,\n\t\t\tserializedError: t ? i.serialize(t) : void 0,\n\t\t\trawError: o,\n\t\t\tdata: n === void 0 ? r : [n, ...r]\n\t\t};\n\t}\n\tisLogContext(e) {\n\t\treturn typeof e == \"object\" && !!e && !Array.isArray(e) && !(e instanceof Error) && !(e instanceof Date) && !(e instanceof RegExp) && typeof e != \"function\";\n\t}\n\tdoLog(e, t, r, ...i) {\n\t\tif (!this.isContextEnabled() || this.logLevel > e) return;\n\t\tlet { metadata: a, restData: o } = this.styleEngine.parseMetadataParameter(r, i), s = this.resolveMessage(t);\n\t\tif (s = k(s, this.sanitizer), !this.handleDeduplication(e, s, a, o)) return;\n\t\tlet c = o?.map((e) => E(e, this.sanitizer)), l, u = {};\n\t\tc && c.length > 0 && c.forEach((e, t) => {\n\t\t\te instanceof Error && !l ? l = e : typeof e == \"object\" && e ? Object.assign(u, e) : u[`arg${t}`] = e;\n\t\t});\n\t\tlet d = {\n\t\t\tlevel: e,\n\t\t\tmessage: s,\n\t\t\tlogger: this.name,\n\t\t\tcontext: this.context,\n\t\t\ttimestamp: /* @__PURE__ */ new Date(),\n\t\t\tmetadata: Object.keys(u).length > 0 ? u : void 0,\n\t\t\terror: l,\n\t\t\tstyling: a,\n\t\t\tcorrelationId: this.getCorrelationId()\n\t\t}, f = this.formatter.format(d), p = this.formatter.isSelfContained();\n\t\tswitch (e) {\n\t\t\tcase n.trace:\n\t\t\t\tp ? console.trace(f) : console.trace(f, ...c || []);\n\t\t\t\tbreak;\n\t\t\tcase n.debug:\n\t\t\t\tp ? console.debug(f) : console.debug(f, ...c || []);\n\t\t\t\tbreak;\n\t\t\tcase n.info:\n\t\t\t\tp ? console.info(f) : console.info(f, ...c || []);\n\t\t\t\tbreak;\n\t\t\tcase n.warn:\n\t\t\t\tp ? console.warn(f) : console.warn(f, ...c || []);\n\t\t\t\tbreak;\n\t\t\tcase n.error:\n\t\t\tcase n.fatal:\n\t\t\t\tp ? console.error(f) : console.error(f, ...c || []);\n\t\t\t\tbreak;\n\t\t}\n\t}\n\tcastLoglevel(e) {\n\t\tif (r(e)) switch (e) {\n\t\t\tcase \"trace\": return n.trace;\n\t\t\tcase \"debug\": return n.debug;\n\t\t\tcase \"info\": return n.info;\n\t\t\tcase \"warn\": return n.warn;\n\t\t\tcase \"error\": return n.error;\n\t\t\tcase \"fatal\": return n.fatal;\n\t\t\tcase \"silent\": return n.silent;\n\t\t}\n\t\tthrow r(e.toLowerCase()) ? new l(`Invalid log level: ${e}. Log levels are case-sensitive. Valid levels: trace, debug, info, warn, error, fatal, silent.`) : new l(`Invalid log level: ${e}. Valid levels: trace, debug, info, warn, error, fatal, silent.`);\n\t}\n\tshouldLogImmediately(e, t) {\n\t\tlet n = (this.parentLogger || this).deduplicator;\n\t\tif (!n) return !0;\n\t\ttry {\n\t\t\treturn n.addMessage(e, t, this.context);\n\t\t} catch (e) {\n\t\t\treturn console.error(\"Logger deduplication error:\", e), !0;\n\t\t}\n\t}\n\thandleDeduplication(e, t, n, r) {\n\t\treturn !n && r.length === 0 ? this.shouldLogImmediately(e, t) : !0;\n\t}\n};\nG = W = U([P(), H(\"design:paramtypes\", [\n\tObject,\n\tc === void 0 ? Object : c,\n\tString,\n\tG === void 0 ? Object : G\n])], G);\n//#endregion\n//#region src/lib/nitro.ts\nfunction K(t = \"api\") {\n\treturn e((e) => {\n\t\tlet n = V(G).forContext(t);\n\t\te.context.logger = n, n.debug(\"Request received\", {\n\t\t\tmethod: e.method,\n\t\t\tpath: e.path,\n\t\t\trequestId: e.context.id\n\t\t});\n\t});\n}\nfunction q(t, n = {}) {\n\tlet { namespace: r = \"api\", level: i = \"debug\", logResponse: a = !1 } = n;\n\treturn e(async (e) => {\n\t\tlet n = V(G).forContext(r), o = Date.now();\n\t\ttry {\n\t\t\tlet r = await t(e), s = Date.now() - o, c = {\n\t\t\t\ttrace: \"trace\",\n\t\t\t\tdebug: \"debug\",\n\t\t\t\tinfo: \"info\",\n\t\t\t\twarn: \"warn\",\n\t\t\t\terror: \"error\",\n\t\t\t\tfatal: \"fatal\",\n\t\t\t\tsilent: void 0\n\t\t\t}[i];\n\t\t\treturn c && typeof n[c] == \"function\" && n[c](`Request completed in ${s}ms`, {\n\t\t\t\tmethod: e.method,\n\t\t\t\tpath: e.path,\n\t\t\t\tduration: s,\n\t\t\t\t...a && r ? { response: r } : {}\n\t\t\t}), r;\n\t\t} catch (t) {\n\t\t\tlet r = Date.now() - o;\n\t\t\tthrow n.error(`Request failed after ${r}ms`, t, {\n\t\t\t\tmethod: e.method,\n\t\t\t\tpath: e.path,\n\t\t\t\tduration: r\n\t\t\t}), t;\n\t\t}\n\t});\n}\n//#endregion\nexport { f as CRITICAL_LEVELS, t as ColorEnum, d as DEFAULT_DEDUPLICATION_CONFIG, v as DEFAULT_SANITIZATION_CONFIG, b as DEFAULT_VALUE_RULES, i as ErrorSerializer, _ as FormatterFactory, p as LogDeduplicator, n as LogLevelEnum, u as LoggerContextError, l as LoggerError, G as LoggerService, c as LoggerStyleEngine, y as SENSITIVE_KEY_PATTERNS, w as applySanitizationRules, D as compileRules, K as createLoggerMiddleware, O as createSanitizer, r as isValidLogLevel, x as sanitizeControlChars, k as sanitizeMessage, E as sanitizeValue, q as withLogging };\n","//#region src/lib/injection-context.ts\nvar e = class {\n\tstatic {\n\t\tthis.contexts = /* @__PURE__ */ new Map();\n\t}\n\tstatic {\n\t\tthis.defaultScope = \"default\";\n\t}\n\tstatic getRegistry(e = this.defaultScope) {\n\t\tthis.contexts.has(e) || this.contexts.set(e, new l());\n\t\tlet t = this.contexts.get(e);\n\t\tif (!t) throw Error(`Failed to create registry for scope '${e}'`);\n\t\treturn t;\n\t}\n\tstatic createScope(e) {\n\t\tif (this.contexts.has(e)) throw Error(`Scope '${e}' already exists`);\n\t\tlet t = new l();\n\t\treturn this.contexts.set(e, t), t;\n\t}\n\tstatic destroyScope(e) {\n\t\tlet t = this.contexts.get(e);\n\t\tt && (t.destroy(), this.contexts.delete(e));\n\t}\n\tstatic async destroyScopeAsync(e) {\n\t\tlet t = this.contexts.get(e);\n\t\tt && (await t.destroyAsync(), this.contexts.delete(e));\n\t}\n\tstatic async clearAllAsync() {\n\t\tlet e = [], t = Array.from(this.contexts.entries());\n\t\tfor (let [n, r] of t) try {\n\t\t\tawait r.destroyAsync();\n\t\t} catch (t) {\n\t\t\tt instanceof p ? e.push(...t.failures) : t instanceof Error && e.push({\n\t\t\t\tserviceName: `scope:${n}`,\n\t\t\t\terror: t\n\t\t\t});\n\t\t}\n\t\tif (this.contexts.clear(), e.length > 0) throw new p(e);\n\t}\n\tstatic setDefaultScope(e) {\n\t\tthis.defaultScope = e;\n\t}\n\tstatic getActiveScopes() {\n\t\treturn Array.from(this.contexts.keys());\n\t}\n\tstatic clearAll() {\n\t\tlet e = Array.from(this.contexts.values());\n\t\tfor (let t of e) t.destroy();\n\t\tthis.contexts.clear();\n\t}\n};\nfunction t(t, n, r = {}) {\n\tlet i = e.getRegistry(n), { required: a = !0 } = r;\n\ttry {\n\t\tlet e = i.getService(t);\n\t\tif (e == null) {\n\t\t\tif (a) throw new u(`Service '${t.name}' not found in scope '${n || \"default\"}' and is required`, t.name);\n\t\t\treturn;\n\t\t}\n\t\treturn e;\n\t} catch (e) {\n\t\tthrow e instanceof u ? e : new u(`Failed to inject service '${t.name}' from scope '${n || \"default\"}'`, t.name, e);\n\t}\n}\nfunction n(t, n, ...r) {\n\tlet i = e.getRegistry(n);\n\ttry {\n\t\ti.register(t, ...r);\n\t} catch (e) {\n\t\tthrow new u(`Failed to register service '${t.name}' in scope '${n || \"default\"}'`, t.name, e);\n\t}\n}\nfunction r(t, n) {\n\tlet r = e.getRegistry(n);\n\ttry {\n\t\tr.registerAsUndefined(t);\n\t} catch (e) {\n\t\tthrow new u(`Failed to register service '${t.name}' as undefined in scope '${n || \"default\"}'`, t.name, e);\n\t}\n}\n//#endregion\n//#region src/lib/symbol-registry.ts\nvar i = Symbol.for(\"@analog-tools/inject:SERVICE_TOKEN\");\nfunction a(e) {\n\treturn Symbol(e || \"ServiceToken\");\n}\nvar o = class {\n\tstatic {\n\t\tthis.tokens = /* @__PURE__ */ new WeakMap();\n\t}\n\tstatic getToken(e) {\n\t\tif (!this.tokens.has(e)) {\n\t\t\tlet t = a(e.name);\n\t\t\tthis.tokens.set(e, t);\n\t\t}\n\t\tlet t = this.tokens.get(e);\n\t\tif (!t) throw Error(`Failed to get token for service ${e.name}`);\n\t\treturn t;\n\t}\n\tstatic setToken(e, t) {\n\t\tthis.tokens.set(e, t);\n\t}\n};\nfunction s(e) {\n\treturn (t) => {\n\t\tlet n = e || o.getToken(t);\n\t\treturn o.setToken(t, n), t.INJECTABLE = !0, t[i] = n, t;\n\t};\n}\n//#endregion\n//#region src/lib/service-registry.ts\nfunction c() {\n\treturn e.getRegistry();\n}\nvar l = class {\n\tconstructor() {\n\t\tthis.serviceMap = /* @__PURE__ */ new Map(), this.initializingServices = /* @__PURE__ */ new Set(), this.initializationPromises = /* @__PURE__ */ new Map(), this.serviceNames = /* @__PURE__ */ new Map(), this.initializedServices = /* @__PURE__ */ new Set(), this.destroyed = !1;\n\t}\n\tgetServiceKey(e) {\n\t\tlet t = e[i];\n\t\tif (!t) throw new f(e.name);\n\t\treturn this.serviceNames.set(t, e.name), t;\n\t}\n\tgetServiceName(e) {\n\t\treturn this.serviceNames.get(e) ?? \"Unknown\";\n\t}\n\tregister(e, ...t) {\n\t\tlet n = this.getServiceKey(e);\n\t\tif (this.initializingServices.has(n)) throw new d([e.name]);\n\t\tif (!this.serviceMap.has(n) || this.serviceMap.get(n) === void 0) {\n\t\t\tthis.initializingServices.add(n);\n\t\t\ttry {\n\t\t\t\tlet r = t.length === 0 ? new e() : new e(...t);\n\t\t\t\tthis.serviceMap.set(n, r);\n\t\t\t} finally {\n\t\t\t\tthis.initializingServices.delete(n);\n\t\t\t}\n\t\t}\n\t}\n\tregisterAsUndefined(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\tthis.serviceMap.set(t, void 0);\n\t}\n\tregisterCustomServiceInstance(e, t) {\n\t\tlet n = this.getServiceKey(e);\n\t\tthis.serviceNames.set(n, e.name), this.serviceMap.set(n, t);\n\t}\n\tgetService(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\treturn this.serviceMap.has(t) || this.register(e), this.serviceMap.get(t);\n\t}\n\thasService(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\treturn this.serviceMap.has(t);\n\t}\n\tasync ensureAsyncInitialized(e, t) {\n\t\tif (this.initializedServices.has(t)) return;\n\t\tif (this.initializationPromises.has(t)) {\n\t\t\tlet e = this.initializationPromises.get(t);\n\t\t\tif (e) {\n\t\t\t\tawait e;\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t\tlet n = e;\n\t\tif (typeof n.initializeAsync != \"function\") {\n\t\t\tthis.initializedServices.add(t);\n\t\t\tlet e = Promise.resolve();\n\t\t\treturn this.initializationPromises.set(t, e), e;\n\t\t}\n\t\tlet r = n.initializeAsync().then(() => {\n\t\t\tthis.initializedServices.add(t);\n\t\t}).catch((e) => {\n\t\t\tthrow this.initializationPromises.delete(t), e;\n\t\t});\n\t\tthis.initializationPromises.set(t, r), await r;\n\t}\n\tasync getServiceAsync(e) {\n\t\tlet t = this.getServiceKey(e);\n\t\tthis.serviceMap.has(t) || this.register(e);\n\t\tlet n = this.serviceMap.get(t);\n\t\treturn n !== void 0 && await this.ensureAsyncInitialized(n, t), n;\n\t}\n\tasync registerAsync(e, ...t) {\n\t\tlet n = this.getServiceKey(e);\n\t\t(!this.serviceMap.has(n) || this.serviceMap.get(n) === void 0) && this.register(e, ...t);\n\t\tlet r = this.serviceMap.get(n);\n\t\tawait this.ensureAsyncInitialized(r, n);\n\t}\n\tasync destroyAsync() {\n\t\tif (this.destroyed) return;\n\t\tthis.destroyed = !0;\n\t\tlet e = Array.from(this.initializationPromises.values());\n\t\te.length > 0 && await Promise.allSettled(e);\n\t\tlet t = [], n = Array.from(this.serviceMap.entries());\n\t\tfor (let [e, r] of n) {\n\t\t\tif (!this.initializedServices.has(e) || r === void 0) continue;\n\t\t\tlet n = r;\n\t\t\tif (typeof n.onDestroy == \"function\") try {\n\t\t\t\tawait n.onDestroy();\n\t\t\t} catch (n) {\n\t\t\t\tt.push({\n\t\t\t\t\tserviceName: this.getServiceName(e),\n\t\t\t\t\terror: n\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tif (this.serviceMap.clear(), this.initializingServices.clear(), this.initializationPromises.clear(), this.initializedServices.clear(), this.serviceNames.clear(), t.length > 0) throw new p(t);\n\t}\n\tdestroy() {\n\t\tthis.serviceMap.clear(), this.initializingServices.clear(), this.initializationPromises.clear(), this.initializedServices.clear(), this.serviceNames.clear();\n\t}\n}, u = class extends Error {\n\tconstructor(e, t, n) {\n\t\tsuper(e), this.token = t, this.name = \"InjectionError\", n && (this.cause = n);\n\t}\n}, d = class extends u {\n\tconstructor(e) {\n\t\tsuper(`Circular dependency detected: ${e.join(\" -> \")}`), this.name = \"CircularDependencyError\";\n\t}\n}, f = class extends u {\n\tconstructor(e) {\n\t\tsuper(`Service '${e}' is missing SERVICE_TOKEN. Add @Injectable() decorator to the class. See: packages/inject/docs/migrations/symbol-tokens.md`, e), this.name = \"MissingServiceTokenError\";\n\t}\n}, p = class extends u {\n\tconstructor(e) {\n\t\tlet t = e.map((e) => `${e.serviceName}: ${e.error.message}`).join(\"; \");\n\t\tsuper(`Failed to destroy ${e.length} service(s): ${t}`), this.failures = e, this.name = \"AggregateDestructionError\";\n\t}\n\tgetErrors() {\n\t\treturn this.failures.map((e) => e.error);\n\t}\n\thasFailure(e) {\n\t\treturn this.failures.some((t) => t.serviceName === e);\n\t}\n};\nfunction m(e, t = {}) {\n\tlet { required: n = !0 } = t;\n\ttry {\n\t\tlet t = c().getService(e);\n\t\tif (t == null) {\n\t\t\tif (n) throw new u(`Service '${e.name}' not found in registry and is required`, e.name);\n\t\t\treturn;\n\t\t}\n\t\treturn t;\n\t} catch (t) {\n\t\tthrow t instanceof u ? t : new u(`Failed to inject service '${e.name}'`, e.name, t);\n\t}\n}\nfunction h(e, ...t) {\n\ttry {\n\t\tc().register(e, ...t);\n\t} catch (t) {\n\t\tthrow new u(`Failed to register service '${e.name}'`, e.name, t);\n\t}\n}\nfunction g(e) {\n\ttry {\n\t\tc().registerAsUndefined(e);\n\t} catch (t) {\n\t\tthrow new u(`Failed to register service '${e.name}' as undefined`, e.name, t);\n\t}\n}\nfunction _(e) {\n\ttry {\n\t\treturn c().hasService(e);\n\t} catch {\n\t\treturn !1;\n\t}\n}\nfunction v(e) {\n\treturn m(e, { required: !1 });\n}\nasync function y(e, t = {}) {\n\tlet { required: n = !0 } = t;\n\ttry {\n\t\tlet t = await c().getServiceAsync(e);\n\t\tif (t == null) {\n\t\t\tif (n) throw new u(`Service '${e.name}' not found in registry and is required`, e.name);\n\t\t\treturn;\n\t\t}\n\t\treturn t;\n\t} catch (t) {\n\t\tthrow t instanceof u ? t : new u(`Failed to inject async service '${e.name}'`, e.name, t);\n\t}\n}\nasync function b(e, ...t) {\n\ttry {\n\t\tawait c().registerAsync(e, ...t);\n\t} catch (t) {\n\t\tthrow t instanceof u ? t : new u(`Failed to register async service '${e.name}'`, e.name, t);\n\t}\n}\nasync function x() {\n\treturn c().destroyAsync();\n}\n//#endregion\n//#region src/lib/inject.testing-util.ts\nfunction S(e, t) {\n\tc().registerCustomServiceInstance(e, t);\n}\nfunction C() {\n\te.clearAll();\n}\nfunction w(t, n, r) {\n\te.getRegistry(r).registerCustomServiceInstance(t, n);\n}\nfunction T(t) {\n\te.destroyScope(t);\n}\n//#endregion\nexport { p as AggregateDestructionError, d as CircularDependencyError, s as Injectable, e as InjectionContext, u as InjectionError, f as MissingServiceTokenError, i as SERVICE_TOKEN, a as createServiceToken, x as destroyAllServicesAsync, _ as hasService, m as inject, y as injectAsync, t as injectScoped, b as registerAsync, S as registerMockService, w as registerMockServiceScoped, h as registerService, g as registerServiceAsUndefined, r as registerServiceAsUndefinedScoped, n as registerServiceScoped, C as resetAllInjections, T as resetScopedInjections, v as tryInject };\n","import { createError, H3Event } from 'h3';\nimport {\n  useSession,\n  getSession,\n  updateSession,\n  destroySession,\n  createUnstorageStore,\n} from '@analog-tools/session';\nimport type { Storage } from 'unstorage';\nimport { AuthSessionData, SessionWithSave, SessionWithHandler } from '../types/auth-session.types';\nimport { LoggerService } from '@analog-tools/logger';\nimport { inject, Injectable } from '@analog-tools/inject';\nimport { type SessionStorageConfig } from '../types/auth.types';\n\n@Injectable()\nexport class SessionService {\n  private readonly storageConfig: SessionStorageConfig;\n  private readonly sessionSecret: string | string[];\n  private store!: Storage<AuthSessionData>;\n  private logger: LoggerService;\n\n  constructor(config: SessionStorageConfig) {\n    this.storageConfig = config;\n\n    this.logger = inject(LoggerService).forContext('SessionService');\n    this.sessionSecret = this.resolveSessionSecret();\n  }\n\n  /**\n   * Resolve and validate the session signing secret. A missing secret is a\n   * fatal misconfiguration: the library used to silently fall back to a shared,\n   * source-visible default, which let anyone forge session cookies. A non-empty\n   * array of secrets is accepted to support key rotation (first entry signs,\n   * the rest still verify).\n   */\n  private resolveSessionSecret(): string | string[] {\n    const secret = this.storageConfig.sessionSecret;\n    const secrets = Array.isArray(secret) ? secret : [secret];\n    const allValid =\n      secrets.length > 0 &&\n      secrets.every((s) => typeof s === 'string' && s.trim().length > 0);\n    if (!allValid) {\n      throw new Error(\n        'sessionStorage.sessionSecret is required. Provide a strong, unique ' +\n          'value or a non-empty array of values (e.g. from a SESSION_SECRET ' +\n          'environment variable) — the library no longer falls back to a ' +\n          'shared default secret.'\n      );\n    }\n    if ((secrets as string[]).some((s) => s.length < 32)) {\n      this.logger.warn(\n        'sessionStorage.sessionSecret is shorter than 32 characters; use a ' +\n          'longer, high-entropy value for HMAC-SHA256 cookie signing.'\n      );\n    }\n    return secret as string | string[];\n  }\n\n  async initSession(event: H3Event): Promise<void> {\n    // Check if session is already initialized\n    const existingSession = getSession<AuthSessionData>(event);\n    \n    if (!existingSession) {\n      this.logger.debug('Initializing request session context');\n      \n      // Create appropriate store based on config\n      if (!this.store) {\n        this.store = await createUnstorageStore<AuthSessionData>(this.storageConfig.driver);\n      }\n      \n      await useSession<AuthSessionData>(event, {\n        store: this.store,\n        secret: this.sessionSecret,\n        name: this.storageConfig.cookieName || 'auth.session',\n        maxAge: 60 * 60 * 24, // 24 hours\n        cookie: {\n          httpOnly: true,\n          secure: process.env['NODE_ENV'] === 'production',\n          sameSite: 'lax', // Always use 'lax' to allow OAuth redirects\n        },\n        // Initialize default session structure with auth property\n        generate: () => ({\n          auth: {\n            isAuthenticated: false,\n          },\n        }),\n      });\n    } else {\n      this.logger.debug(\n        'Session already exists, skipping initialization'\n      );\n    }\n  }\n\n  /**\n   * Get a session by session ID\n   * @param sessionId The session ID\n   * @returns The session object or null if not found\n   */\n  async getSession(sessionId: string): Promise<SessionWithSave | null> {\n    try {\n      const sessionData = await this.store.getItem(sessionId);\n\n      if (!sessionData) {\n        return null;\n      }\n\n      // Create a session object with basic needed functionality\n      return {\n        id: sessionId,\n        data: sessionData as AuthSessionData,\n        save: async () => {\n          await this.store.setItem(sessionId, sessionData);\n        },\n      };\n    } catch (error) {\n      this.logger.error(`Error retrieving session`, error, { sessionId });\n      return null;\n    }\n  }\n\n  /**\n   * Get all active sessions from storage\n   * @returns Array of session objects with update capability\n   */\n  async getActiveSessions(): Promise<SessionWithHandler[]> {\n    try {\n      // Get all session keys from storage\n      const sessionKeys = await this.store.getKeys();\n\n      // Map keys to session objects\n      const sessions = await Promise.all(\n        sessionKeys.map(async (key) => {\n          const sessionData = await this.store.getItem(key);\n          if (!sessionData) return null;\n\n          // Extract session ID from the key (remove prefix if exists)\n          const sessionId = this.storageConfig.prefix && key.startsWith(`${this.storageConfig.prefix}:`)\n            ? key.substring(`${this.storageConfig.prefix}:`.length)\n            : key;\n\n          return {\n            id: sessionId,\n            data: sessionData,\n            update: (updater: (data: AuthSessionData) => AuthSessionData) => {\n              // Apply the updater function to get new data\n              const updatedData = updater(sessionData as AuthSessionData);\n              // Update the local data reference\n              Object.assign(sessionData, updatedData);\n            },\n            save: async () => {\n              await this.store.setItem(key, sessionData);\n            },\n            refetch: async () => {\n              return (await this.store.getItem(key)) as AuthSessionData | null;\n            },\n          };\n        })\n      );\n\n      // Filter out null values\n      return sessions.filter((session): session is SessionWithHandler => session !== null);\n    } catch (error) {\n      this.logger.error('Error retrieving active sessions', error);\n      return [];\n    }\n  }\n\n  async destroyAuthSession(event: H3Event): Promise<void> {\n    try {\n      await this.initSession(event);\n      \n      // Get current session data to check if auth exists\n      const sessionData = getSession<AuthSessionData>(event);\n      \n      if (sessionData?.auth) {\n        // Clear auth data first\n        await updateSession<AuthSessionData>(event, (data) => {\n          const updatedData = { ...data };\n          delete updatedData.auth;\n          return updatedData;\n        });\n      }\n\n      // Destroy the session using new API\n      await destroySession(event);\n      \n    } catch (error) {\n      this.logger.error('Session destruction failed', error);\n      throw createError({\n        statusCode: 500,\n        message: 'Session handling failed',\n      });\n    }\n  }\n\n  async getSessionData<T>(\n    event: H3Event,\n    key: keyof AuthSessionData\n  ): Promise<T | null> {\n    await this.initSession(event);\n    \n    const sessionData = getSession<AuthSessionData>(event);\n    \n    this.logger.debug(\n      `Retrieved session data`,\n      sessionData\n    );\n\n    return (sessionData?.[key] as T) || null;\n  }\n\n  async setSessionData<T>(\n    event: H3Event,\n    key: keyof AuthSessionData,\n    value: T\n  ): Promise<void> {\n    await this.initSession(event);\n    \n    await updateSession<AuthSessionData>(event, (data) => ({\n      ...data,\n      [key]: value,\n    }));\n  }\n\n  async isValidSession(event: H3Event): Promise<boolean> {\n    await this.initSession(event);\n    const sessionData = getSession<AuthSessionData>(event);\n    return !!sessionData;\n  }\n}\n","export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n    const size = buffers.reduce((acc, { length }) => acc + length, 0);\n    const buf = new Uint8Array(size);\n    let i = 0;\n    for (const buffer of buffers) {\n        buf.set(buffer, i);\n        i += buffer.length;\n    }\n    return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n    if (value < 0 || value >= MAX_INT32) {\n        throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n    }\n    buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n    const high = Math.floor(value / MAX_INT32);\n    const low = value % MAX_INT32;\n    const buf = new Uint8Array(8);\n    writeUInt32BE(buf, high, 0);\n    writeUInt32BE(buf, low, 4);\n    return buf;\n}\nexport function uint32be(value) {\n    const buf = new Uint8Array(4);\n    writeUInt32BE(buf, value);\n    return buf;\n}\nexport function encode(string) {\n    const bytes = new Uint8Array(string.length);\n    for (let i = 0; i < string.length; i++) {\n        const code = string.charCodeAt(i);\n        if (code > 127) {\n            throw new TypeError('non-ASCII string encountered in encode()');\n        }\n        bytes[i] = code;\n    }\n    return bytes;\n}\n","export function encodeBase64(input) {\n    if (Uint8Array.prototype.toBase64) {\n        return input.toBase64();\n    }\n    const CHUNK_SIZE = 0x8000;\n    const arr = [];\n    for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n    }\n    return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(encoded);\n    }\n    const binary = atob(encoded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n            alphabet: 'base64url',\n        });\n    }\n    let encoded = input;\n    if (encoded instanceof Uint8Array) {\n        encoded = decoder.decode(encoded);\n    }\n    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n    try {\n        return decodeBase64(encoded);\n    }\n    catch {\n        throw new TypeError('The input to be decoded is not correctly encoded.');\n    }\n}\nexport function encode(input) {\n    let unencoded = input;\n    if (typeof unencoded === 'string') {\n        unencoded = encoder.encode(unencoded);\n    }\n    if (Uint8Array.prototype.toBase64) {\n        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n    }\n    return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","const unusable = (name, prop = 'algorithm.name') => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nconst isAlgorithm = (algorithm, name) => algorithm.name === name;\nfunction getHashLength(hash) {\n    return parseInt(hash.name.slice(4), 10);\n}\nfunction checkHashLength(algorithm, expected) {\n    const actual = getHashLength(algorithm.hash);\n    if (actual !== expected)\n        throw unusable(`SHA-${expected}`, 'algorithm.hash');\n}\nfunction getNamedCurve(alg) {\n    switch (alg) {\n        case 'ES256':\n            return 'P-256';\n        case 'ES384':\n            return 'P-384';\n        case 'ES512':\n            return 'P-521';\n        default:\n            throw new Error('unreachable');\n    }\n}\nfunction checkUsage(key, usage) {\n    if (usage && !key.usages.includes(usage)) {\n        throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n    }\n}\nexport function checkSigCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512': {\n            if (!isAlgorithm(key.algorithm, 'HMAC'))\n                throw unusable('HMAC');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'RS256':\n        case 'RS384':\n        case 'RS512': {\n            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))\n                throw unusable('RSASSA-PKCS1-v1_5');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'PS256':\n        case 'PS384':\n        case 'PS512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))\n                throw unusable('RSA-PSS');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'Ed25519':\n        case 'EdDSA': {\n            if (!isAlgorithm(key.algorithm, 'Ed25519'))\n                throw unusable('Ed25519');\n            break;\n        }\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87': {\n            if (!isAlgorithm(key.algorithm, alg))\n                throw unusable(alg);\n            break;\n        }\n        case 'ES256':\n        case 'ES384':\n        case 'ES512': {\n            if (!isAlgorithm(key.algorithm, 'ECDSA'))\n                throw unusable('ECDSA');\n            const expected = getNamedCurve(alg);\n            const actual = key.algorithm.namedCurve;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.namedCurve');\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\nexport function checkEncCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'A128GCM':\n        case 'A192GCM':\n        case 'A256GCM': {\n            if (!isAlgorithm(key.algorithm, 'AES-GCM'))\n                throw unusable('AES-GCM');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'A128KW':\n        case 'A192KW':\n        case 'A256KW': {\n            if (!isAlgorithm(key.algorithm, 'AES-KW'))\n                throw unusable('AES-KW');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'ECDH': {\n            switch (key.algorithm.name) {\n                case 'ECDH':\n                case 'X25519':\n                    break;\n                default:\n                    throw unusable('ECDH or X25519');\n            }\n            break;\n        }\n        case 'PBES2-HS256+A128KW':\n        case 'PBES2-HS384+A192KW':\n        case 'PBES2-HS512+A256KW':\n            if (!isAlgorithm(key.algorithm, 'PBKDF2'))\n                throw unusable('PBKDF2');\n            break;\n        case 'RSA-OAEP':\n        case 'RSA-OAEP-256':\n        case 'RSA-OAEP-384':\n        case 'RSA-OAEP-512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))\n                throw unusable('RSA-OAEP');\n            checkHashLength(key.algorithm, parseInt(alg.slice(9), 10) || 1);\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\n","function message(msg, actual, ...types) {\n    types = types.filter(Boolean);\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `one of type ${types.join(', ')}, or ${last}.`;\n    }\n    else if (types.length === 2) {\n        msg += `one of type ${types[0]} or ${types[1]}.`;\n    }\n    else {\n        msg += `of type ${types[0]}.`;\n    }\n    if (actual == null) {\n        msg += ` Received ${actual}`;\n    }\n    else if (typeof actual === 'function' && actual.name) {\n        msg += ` Received function ${actual.name}`;\n    }\n    else if (typeof actual === 'object' && actual != null) {\n        if (actual.constructor?.name) {\n            msg += ` Received an instance of ${actual.constructor.name}`;\n        }\n    }\n    return msg;\n}\nexport const invalidKeyInput = (actual, ...types) => message('Key must be ', actual, ...types);\nexport const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);\n","export class JOSEError extends Error {\n    static code = 'ERR_JOSE_GENERIC';\n    code = 'ERR_JOSE_GENERIC';\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n    static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JWTExpired extends JOSEError {\n    static code = 'ERR_JWT_EXPIRED';\n    code = 'ERR_JWT_EXPIRED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n    static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n    code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n    static code = 'ERR_JOSE_NOT_SUPPORTED';\n    code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n    static code = 'ERR_JWE_DECRYPTION_FAILED';\n    code = 'ERR_JWE_DECRYPTION_FAILED';\n    constructor(message = 'decryption operation failed', options) {\n        super(message, options);\n    }\n}\nexport class JWEInvalid extends JOSEError {\n    static code = 'ERR_JWE_INVALID';\n    code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n    static code = 'ERR_JWS_INVALID';\n    code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n    static code = 'ERR_JWT_INVALID';\n    code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n    static code = 'ERR_JWK_INVALID';\n    code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n    static code = 'ERR_JWKS_INVALID';\n    code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n    static code = 'ERR_JWKS_NO_MATCHING_KEY';\n    code = 'ERR_JWKS_NO_MATCHING_KEY';\n    constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n    [Symbol.asyncIterator];\n    static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSTimeout extends JOSEError {\n    static code = 'ERR_JWKS_TIMEOUT';\n    code = 'ERR_JWKS_TIMEOUT';\n    constructor(message = 'request timed out', options) {\n        super(message, options);\n    }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n    static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    constructor(message = 'signature verification failed', options) {\n        super(message, options);\n    }\n}\n","export function assertCryptoKey(key) {\n    if (!isCryptoKey(key)) {\n        throw new Error('CryptoKey instance expected');\n    }\n}\nexport const isCryptoKey = (key) => {\n    if (key?.[Symbol.toStringTag] === 'CryptoKey')\n        return true;\n    try {\n        return key instanceof CryptoKey;\n    }\n    catch {\n        return false;\n    }\n};\nexport const isKeyObject = (key) => key?.[Symbol.toStringTag] === 'KeyObject';\nexport const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\n","import { decode } from '../util/base64url.js';\nexport const unprotected = Symbol();\nexport function assertNotSet(value, name) {\n    if (value) {\n        throw new TypeError(`${name} can only be called once`);\n    }\n}\nexport function decodeBase64url(value, label, ErrorClass) {\n    try {\n        return decode(value);\n    }\n    catch {\n        throw new ErrorClass(`Failed to base64url decode the ${label}`);\n    }\n}\nexport async function digest(algorithm, data) {\n    const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n    return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n        return false;\n    }\n    if (Object.getPrototypeOf(input) === null) {\n        return true;\n    }\n    let proto = input;\n    while (Object.getPrototypeOf(proto) !== null) {\n        proto = Object.getPrototypeOf(proto);\n    }\n    return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n    const sources = headers.filter(Boolean);\n    if (sources.length === 0 || sources.length === 1) {\n        return true;\n    }\n    let acc;\n    for (const header of sources) {\n        const parameters = Object.keys(header);\n        if (!acc || acc.size === 0) {\n            acc = new Set(parameters);\n            continue;\n        }\n        for (const parameter of parameters) {\n            if (acc.has(parameter)) {\n                return false;\n            }\n            acc.add(parameter);\n        }\n    }\n    return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nimport { checkSigCryptoKey } from './crypto_key.js';\nimport { invalidKeyInput } from './invalid_key_input.js';\nexport function checkKeyLength(alg, key) {\n    if (alg.startsWith('RS') || alg.startsWith('PS')) {\n        const { modulusLength } = key.algorithm;\n        if (typeof modulusLength !== 'number' || modulusLength < 2048) {\n            throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n        }\n    }\n}\nfunction subtleAlgorithm(alg, algorithm) {\n    const hash = `SHA-${alg.slice(-3)}`;\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512':\n            return { hash, name: 'HMAC' };\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { hash, name: 'RSA-PSS', saltLength: parseInt(alg.slice(-3), 10) >> 3 };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { hash, name: 'RSASSA-PKCS1-v1_5' };\n        case 'ES256':\n        case 'ES384':\n        case 'ES512':\n            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };\n        case 'Ed25519':\n        case 'EdDSA':\n            return { name: 'Ed25519' };\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return { name: alg };\n        default:\n            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n    }\n}\nasync function getSigKey(alg, key, usage) {\n    if (key instanceof Uint8Array) {\n        if (!alg.startsWith('HS')) {\n            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n        }\n        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);\n    }\n    checkSigCryptoKey(key, alg, usage);\n    return key;\n}\nexport async function sign(alg, key, data) {\n    const cryptoKey = await getSigKey(alg, key, 'sign');\n    checkKeyLength(alg, cryptoKey);\n    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);\n    return new Uint8Array(signature);\n}\nexport async function verify(alg, key, signature, data) {\n    const cryptoKey = await getSigKey(alg, key, 'verify');\n    checkKeyLength(alg, cryptoKey);\n    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);\n    try {\n        return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);\n    }\n    catch {\n        return false;\n    }\n}\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n    let algorithm;\n    let keyUsages;\n    switch (jwk.kty) {\n        case 'AKP': {\n            switch (jwk.alg) {\n                case 'ML-DSA-44':\n                case 'ML-DSA-65':\n                case 'ML-DSA-87':\n                    algorithm = { name: jwk.alg };\n                    keyUsages = jwk.priv ? ['sign'] : ['verify'];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'RSA': {\n            switch (jwk.alg) {\n                case 'PS256':\n                case 'PS384':\n                case 'PS512':\n                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RS256':\n                case 'RS384':\n                case 'RS512':\n                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RSA-OAEP':\n                case 'RSA-OAEP-256':\n                case 'RSA-OAEP-384':\n                case 'RSA-OAEP-512':\n                    algorithm = {\n                        name: 'RSA-OAEP',\n                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n                    };\n                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'EC': {\n            switch (jwk.alg) {\n                case 'ES256':\n                case 'ES384':\n                case 'ES512':\n                    algorithm = {\n                        name: 'ECDSA',\n                        namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n                    };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'OKP': {\n            switch (jwk.alg) {\n                case 'Ed25519':\n                case 'EdDSA':\n                    algorithm = { name: 'Ed25519' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        default:\n            throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n    }\n    return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n    if (!jwk.alg) {\n        throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n    }\n    const { algorithm, keyUsages } = subtleMapping(jwk);\n    const keyData = { ...jwk };\n    if (keyData.kty !== 'AKP') {\n        delete keyData.alg;\n    }\n    delete keyData.use;\n    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { isJWK } from './type_checks.js';\nimport { decode } from '../util/base64url.js';\nimport { jwkToKey } from './jwk_to_key.js';\nimport { isCryptoKey, isKeyObject } from './is_key_like.js';\nconst unusableForAlg = 'given KeyObject instance cannot be used for this algorithm';\nlet cache;\nconst handleJWK = async (key, jwk, alg, freeze = false) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(key);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const cryptoKey = await jwkToKey({ ...jwk, alg });\n    if (freeze)\n        Object.freeze(key);\n    if (!cached) {\n        cache.set(key, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nconst handleKeyObject = (keyObject, alg) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(keyObject);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const isPublic = keyObject.type === 'public';\n    const extractable = isPublic ? true : false;\n    let cryptoKey;\n    if (keyObject.asymmetricKeyType === 'x25519') {\n        switch (alg) {\n            case 'ECDH-ES':\n            case 'ECDH-ES+A128KW':\n            case 'ECDH-ES+A192KW':\n            case 'ECDH-ES+A256KW':\n                break;\n            default:\n                throw new TypeError(unusableForAlg);\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);\n    }\n    if (keyObject.asymmetricKeyType === 'ed25519') {\n        if (alg !== 'EdDSA' && alg !== 'Ed25519') {\n            throw new TypeError(unusableForAlg);\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n            isPublic ? 'verify' : 'sign',\n        ]);\n    }\n    switch (keyObject.asymmetricKeyType) {\n        case 'ml-dsa-44':\n        case 'ml-dsa-65':\n        case 'ml-dsa-87': {\n            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {\n                throw new TypeError(unusableForAlg);\n            }\n            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n                isPublic ? 'verify' : 'sign',\n            ]);\n        }\n    }\n    if (keyObject.asymmetricKeyType === 'rsa') {\n        let hash;\n        switch (alg) {\n            case 'RSA-OAEP':\n                hash = 'SHA-1';\n                break;\n            case 'RS256':\n            case 'PS256':\n            case 'RSA-OAEP-256':\n                hash = 'SHA-256';\n                break;\n            case 'RS384':\n            case 'PS384':\n            case 'RSA-OAEP-384':\n                hash = 'SHA-384';\n                break;\n            case 'RS512':\n            case 'PS512':\n            case 'RSA-OAEP-512':\n                hash = 'SHA-512';\n                break;\n            default:\n                throw new TypeError(unusableForAlg);\n        }\n        if (alg.startsWith('RSA-OAEP')) {\n            return keyObject.toCryptoKey({\n                name: 'RSA-OAEP',\n                hash,\n            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);\n        }\n        cryptoKey = keyObject.toCryptoKey({\n            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',\n            hash,\n        }, extractable, [isPublic ? 'verify' : 'sign']);\n    }\n    if (keyObject.asymmetricKeyType === 'ec') {\n        const nist = new Map([\n            ['prime256v1', 'P-256'],\n            ['secp384r1', 'P-384'],\n            ['secp521r1', 'P-521'],\n        ]);\n        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);\n        if (!namedCurve) {\n            throw new TypeError(unusableForAlg);\n        }\n        const expectedCurve = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' };\n        if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg.startsWith('ECDH-ES')) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDH',\n                namedCurve,\n            }, extractable, isPublic ? [] : ['deriveBits']);\n        }\n    }\n    if (!cryptoKey) {\n        throw new TypeError(unusableForAlg);\n    }\n    if (!cached) {\n        cache.set(keyObject, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nexport async function normalizeKey(key, alg) {\n    if (key instanceof Uint8Array) {\n        return key;\n    }\n    if (isCryptoKey(key)) {\n        return key;\n    }\n    if (isKeyObject(key)) {\n        if (key.type === 'secret') {\n            return key.export();\n        }\n        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {\n            try {\n                return handleKeyObject(key, alg);\n            }\n            catch (err) {\n                if (err instanceof TypeError) {\n                    throw err;\n                }\n            }\n        }\n        let jwk = key.export({ format: 'jwk' });\n        return handleJWK(key, jwk, alg);\n    }\n    if (isJWK(key)) {\n        if (key.k) {\n            return decode(key.k);\n        }\n        return handleJWK(key, key, alg, true);\n    }\n    throw new Error('unreachable');\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n        throw new TypeError('\"spki\" must be SPKI formatted string');\n    }\n    return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n        throw new TypeError('\"x509\" must be X.509 formatted string');\n    }\n    return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n        throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n    }\n    return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n    if (!isObject(jwk)) {\n        throw new TypeError('JWK must be an object');\n    }\n    let ext;\n    alg ??= jwk.alg;\n    ext ??= options?.extractable ?? jwk.ext;\n    switch (jwk.kty) {\n        case 'oct':\n            if (typeof jwk.k !== 'string' || !jwk.k) {\n                throw new TypeError('missing \"k\" (Key Value) Parameter value');\n            }\n            return decodeBase64URL(jwk.k);\n        case 'RSA':\n            if ('oth' in jwk && jwk.oth !== undefined) {\n                throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n            }\n            return jwkToKey({ ...jwk, alg, ext });\n        case 'AKP': {\n            if (typeof jwk.alg !== 'string' || !jwk.alg) {\n                throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n            }\n            if (alg !== undefined && alg !== jwk.alg) {\n                throw new TypeError('JWK alg and alg option value mismatch');\n            }\n            return jwkToKey({ ...jwk, ext });\n        }\n        case 'EC':\n        case 'OKP':\n            return jwkToKey({ ...jwk, alg, ext });\n        default:\n            throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n    }\n}\n","import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';\nexport function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n    }\n    if (!protectedHeader || protectedHeader.crit === undefined) {\n        return new Set();\n    }\n    if (!Array.isArray(protectedHeader.crit) ||\n        protectedHeader.crit.length === 0 ||\n        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n    }\n    let recognized;\n    if (recognizedOption !== undefined) {\n        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);\n    }\n    else {\n        recognized = recognizedDefault;\n    }\n    for (const parameter of protectedHeader.crit) {\n        if (!recognized.has(parameter)) {\n            throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n        }\n        if (joseHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n        }\n        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n        }\n    }\n    return new Set(protectedHeader.crit);\n}\n","export function validateAlgorithms(option, algorithms) {\n    if (algorithms !== undefined &&\n        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {\n        throw new TypeError(`\"${option}\" option must be an array of strings`);\n    }\n    if (!algorithms) {\n        return undefined;\n    }\n    return new Set(algorithms);\n}\n","import { withAlg as invalidKeyInput } from './invalid_key_input.js';\nimport { isKeyLike } from './is_key_like.js';\nimport * as jwk from './type_checks.js';\nconst tag = (key) => key?.[Symbol.toStringTag];\nconst jwkMatchesOp = (alg, key, usage) => {\n    if (key.use !== undefined) {\n        let expected;\n        switch (usage) {\n            case 'sign':\n            case 'verify':\n                expected = 'sig';\n                break;\n            case 'encrypt':\n            case 'decrypt':\n                expected = 'enc';\n                break;\n        }\n        if (key.use !== expected) {\n            throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n        }\n    }\n    if (key.alg !== undefined && key.alg !== alg) {\n        throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n    }\n    if (Array.isArray(key.key_ops)) {\n        let expectedKeyOp;\n        switch (true) {\n            case usage === 'sign' || usage === 'verify':\n            case alg === 'dir':\n            case alg.includes('CBC-HS'):\n                expectedKeyOp = usage;\n                break;\n            case alg.startsWith('PBES2'):\n                expectedKeyOp = 'deriveBits';\n                break;\n            case /^A\\d{3}(?:GCM)?(?:KW)?$/.test(alg):\n                if (!alg.includes('GCM') && alg.endsWith('KW')) {\n                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';\n                }\n                else {\n                    expectedKeyOp = usage;\n                }\n                break;\n            case usage === 'encrypt' && alg.startsWith('RSA'):\n                expectedKeyOp = 'wrapKey';\n                break;\n            case usage === 'decrypt':\n                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';\n                break;\n        }\n        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {\n            throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n        }\n    }\n    return true;\n};\nconst symmetricTypeCheck = (alg, key, usage) => {\n    if (key instanceof Uint8Array)\n        return;\n    if (jwk.isJWK(key)) {\n        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))\n            return;\n        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present`);\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));\n    }\n    if (key.type !== 'secret') {\n        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type \"secret\"`);\n    }\n};\nconst asymmetricTypeCheck = (alg, key, usage) => {\n    if (jwk.isJWK(key)) {\n        switch (usage) {\n            case 'decrypt':\n            case 'sign':\n                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation must be a private JWK`);\n            case 'encrypt':\n            case 'verify':\n                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation must be a public JWK`);\n        }\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n    }\n    if (key.type === 'secret') {\n        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type \"secret\"`);\n    }\n    if (key.type === 'public') {\n        switch (usage) {\n            case 'sign':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type \"private\"`);\n            case 'decrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type \"private\"`);\n        }\n    }\n    if (key.type === 'private') {\n        switch (usage) {\n            case 'verify':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type \"public\"`);\n            case 'encrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type \"public\"`);\n        }\n    }\n};\nexport function checkKeyType(alg, key, usage) {\n    switch (alg.substring(0, 2)) {\n        case 'A1':\n        case 'A2':\n        case 'di':\n        case 'HS':\n        case 'PB':\n            symmetricTypeCheck(alg, key, usage);\n            break;\n        default:\n            asymmetricTypeCheck(alg, key, usage);\n    }\n}\n","import { decode as b64u } from '../../util/base64url.js';\nimport { verify } from '../../lib/signing.js';\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';\nimport { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';\nimport { decodeBase64url } from '../../lib/helpers.js';\nimport { isDisjoint } from '../../lib/type_checks.js';\nimport { isObject } from '../../lib/type_checks.js';\nimport { checkKeyType } from '../../lib/check_key_type.js';\nimport { validateCrit } from '../../lib/validate_crit.js';\nimport { validateAlgorithms } from '../../lib/validate_algorithms.js';\nimport { normalizeKey } from '../../lib/normalize_key.js';\nexport async function flattenedVerify(jws, key, options) {\n    if (!isObject(jws)) {\n        throw new JWSInvalid('Flattened JWS must be an object');\n    }\n    if (jws.protected === undefined && jws.header === undefined) {\n        throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n    }\n    if (jws.protected !== undefined && typeof jws.protected !== 'string') {\n        throw new JWSInvalid('JWS Protected Header incorrect type');\n    }\n    if (jws.payload === undefined) {\n        throw new JWSInvalid('JWS Payload missing');\n    }\n    if (typeof jws.signature !== 'string') {\n        throw new JWSInvalid('JWS Signature missing or incorrect type');\n    }\n    if (jws.header !== undefined && !isObject(jws.header)) {\n        throw new JWSInvalid('JWS Unprotected Header incorrect type');\n    }\n    let parsedProt = {};\n    if (jws.protected) {\n        try {\n            const protectedHeader = b64u(jws.protected);\n            parsedProt = JSON.parse(decoder.decode(protectedHeader));\n        }\n        catch {\n            throw new JWSInvalid('JWS Protected Header is invalid');\n        }\n    }\n    if (!isDisjoint(parsedProt, jws.header)) {\n        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');\n    }\n    const joseHeader = {\n        ...parsedProt,\n        ...jws.header,\n    };\n    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);\n    let b64 = true;\n    if (extensions.has('b64')) {\n        b64 = parsedProt.b64;\n        if (typeof b64 !== 'boolean') {\n            throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n        }\n    }\n    const { alg } = joseHeader;\n    if (typeof alg !== 'string' || !alg) {\n        throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n    }\n    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);\n    if (algorithms && !algorithms.has(alg)) {\n        throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n    }\n    if (b64) {\n        if (typeof jws.payload !== 'string') {\n            throw new JWSInvalid('JWS Payload must be a string');\n        }\n    }\n    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {\n        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');\n    }\n    let resolvedKey = false;\n    if (typeof key === 'function') {\n        key = await key(parsedProt, jws);\n        resolvedKey = true;\n    }\n    checkKeyType(alg, key, 'verify');\n    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'\n        ? b64\n            ? encode(jws.payload)\n            : encoder.encode(jws.payload)\n        : jws.payload);\n    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);\n    const k = await normalizeKey(key, alg);\n    const verified = await verify(alg, k, signature, data);\n    if (!verified) {\n        throw new JWSSignatureVerificationFailed();\n    }\n    let payload;\n    if (b64) {\n        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);\n    }\n    else if (typeof jws.payload === 'string') {\n        payload = encoder.encode(jws.payload);\n    }\n    else {\n        payload = jws.payload;\n    }\n    const result = { payload };\n    if (jws.protected !== undefined) {\n        result.protectedHeader = parsedProt;\n    }\n    if (jws.header !== undefined) {\n        result.unprotectedHeader = jws.header;\n    }\n    if (resolvedKey) {\n        return { ...result, key: k };\n    }\n    return result;\n}\n","import { flattenedVerify } from '../flattened/verify.js';\nimport { JWSInvalid } from '../../util/errors.js';\nimport { decoder } from '../../lib/buffer_utils.js';\nexport async function compactVerify(jws, key, options) {\n    if (jws instanceof Uint8Array) {\n        jws = decoder.decode(jws);\n    }\n    if (typeof jws !== 'string') {\n        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');\n    }\n    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');\n    if (length !== 3) {\n        throw new JWSInvalid('Invalid Compact JWS');\n    }\n    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);\n    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';\nimport { encoder, decoder } from './buffer_utils.js';\nimport { isObject } from './type_checks.js';\nconst epoch = (date) => Math.floor(date.getTime() / 1000);\nconst minute = 60;\nconst hour = minute * 60;\nconst day = hour * 24;\nconst week = day * 7;\nconst year = day * 365.25;\nconst REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;\nexport function secs(str) {\n    const matched = REGEX.exec(str);\n    if (!matched || (matched[4] && matched[1])) {\n        throw new TypeError('Invalid time period format');\n    }\n    const value = parseFloat(matched[2]);\n    const unit = matched[3].toLowerCase();\n    let numericDate;\n    switch (unit) {\n        case 'sec':\n        case 'secs':\n        case 'second':\n        case 'seconds':\n        case 's':\n            numericDate = Math.round(value);\n            break;\n        case 'minute':\n        case 'minutes':\n        case 'min':\n        case 'mins':\n        case 'm':\n            numericDate = Math.round(value * minute);\n            break;\n        case 'hour':\n        case 'hours':\n        case 'hr':\n        case 'hrs':\n        case 'h':\n            numericDate = Math.round(value * hour);\n            break;\n        case 'day':\n        case 'days':\n        case 'd':\n            numericDate = Math.round(value * day);\n            break;\n        case 'week':\n        case 'weeks':\n        case 'w':\n            numericDate = Math.round(value * week);\n            break;\n        default:\n            numericDate = Math.round(value * year);\n            break;\n    }\n    if (matched[1] === '-' || matched[4] === 'ago') {\n        return -numericDate;\n    }\n    return numericDate;\n}\nfunction validateInput(label, input) {\n    if (!Number.isFinite(input)) {\n        throw new TypeError(`Invalid ${label} input`);\n    }\n    return input;\n}\nconst normalizeTyp = (value) => {\n    if (value.includes('/')) {\n        return value.toLowerCase();\n    }\n    return `application/${value.toLowerCase()}`;\n};\nconst checkAudiencePresence = (audPayload, audOption) => {\n    if (typeof audPayload === 'string') {\n        return audOption.includes(audPayload);\n    }\n    if (Array.isArray(audPayload)) {\n        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));\n    }\n    return false;\n};\nexport function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n    let payload;\n    try {\n        payload = JSON.parse(decoder.decode(encodedPayload));\n    }\n    catch {\n    }\n    if (!isObject(payload)) {\n        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');\n    }\n    const { typ } = options;\n    if (typ &&\n        (typeof protectedHeader.typ !== 'string' ||\n            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {\n        throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, 'typ', 'check_failed');\n    }\n    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;\n    const presenceCheck = [...requiredClaims];\n    if (maxTokenAge !== undefined)\n        presenceCheck.push('iat');\n    if (audience !== undefined)\n        presenceCheck.push('aud');\n    if (subject !== undefined)\n        presenceCheck.push('sub');\n    if (issuer !== undefined)\n        presenceCheck.push('iss');\n    for (const claim of new Set(presenceCheck.reverse())) {\n        if (!(claim in payload)) {\n            throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, 'missing');\n        }\n    }\n    if (issuer &&\n        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {\n        throw new JWTClaimValidationFailed('unexpected \"iss\" claim value', payload, 'iss', 'check_failed');\n    }\n    if (subject && payload.sub !== subject) {\n        throw new JWTClaimValidationFailed('unexpected \"sub\" claim value', payload, 'sub', 'check_failed');\n    }\n    if (audience &&\n        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {\n        throw new JWTClaimValidationFailed('unexpected \"aud\" claim value', payload, 'aud', 'check_failed');\n    }\n    let tolerance;\n    switch (typeof options.clockTolerance) {\n        case 'string':\n            tolerance = secs(options.clockTolerance);\n            break;\n        case 'number':\n            tolerance = options.clockTolerance;\n            break;\n        case 'undefined':\n            tolerance = 0;\n            break;\n        default:\n            throw new TypeError('Invalid clockTolerance option type');\n    }\n    const { currentDate } = options;\n    const now = epoch(currentDate || new Date());\n    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {\n        throw new JWTClaimValidationFailed('\"iat\" claim must be a number', payload, 'iat', 'invalid');\n    }\n    if (payload.nbf !== undefined) {\n        if (typeof payload.nbf !== 'number') {\n            throw new JWTClaimValidationFailed('\"nbf\" claim must be a number', payload, 'nbf', 'invalid');\n        }\n        if (payload.nbf > now + tolerance) {\n            throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, 'nbf', 'check_failed');\n        }\n    }\n    if (payload.exp !== undefined) {\n        if (typeof payload.exp !== 'number') {\n            throw new JWTClaimValidationFailed('\"exp\" claim must be a number', payload, 'exp', 'invalid');\n        }\n        if (payload.exp <= now - tolerance) {\n            throw new JWTExpired('\"exp\" claim timestamp check failed', payload, 'exp', 'check_failed');\n        }\n    }\n    if (maxTokenAge) {\n        const age = now - payload.iat;\n        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);\n        if (age - tolerance > max) {\n            throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');\n        }\n        if (age < 0 - tolerance) {\n            throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');\n        }\n    }\n    return payload;\n}\nexport class JWTClaimsBuilder {\n    #payload;\n    constructor(payload) {\n        if (!isObject(payload)) {\n            throw new TypeError('JWT Claims Set MUST be an object');\n        }\n        this.#payload = structuredClone(payload);\n    }\n    data() {\n        return encoder.encode(JSON.stringify(this.#payload));\n    }\n    get iss() {\n        return this.#payload.iss;\n    }\n    set iss(value) {\n        this.#payload.iss = value;\n    }\n    get sub() {\n        return this.#payload.sub;\n    }\n    set sub(value) {\n        this.#payload.sub = value;\n    }\n    get aud() {\n        return this.#payload.aud;\n    }\n    set aud(value) {\n        this.#payload.aud = value;\n    }\n    set jti(value) {\n        this.#payload.jti = value;\n    }\n    set nbf(value) {\n        if (typeof value === 'number') {\n            this.#payload.nbf = validateInput('setNotBefore', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.nbf = validateInput('setNotBefore', epoch(value));\n        }\n        else {\n            this.#payload.nbf = epoch(new Date()) + secs(value);\n        }\n    }\n    set exp(value) {\n        if (typeof value === 'number') {\n            this.#payload.exp = validateInput('setExpirationTime', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.exp = validateInput('setExpirationTime', epoch(value));\n        }\n        else {\n            this.#payload.exp = epoch(new Date()) + secs(value);\n        }\n    }\n    set iat(value) {\n        if (value === undefined) {\n            this.#payload.iat = epoch(new Date());\n        }\n        else if (value instanceof Date) {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(value));\n        }\n        else if (typeof value === 'string') {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));\n        }\n        else {\n            this.#payload.iat = validateInput('setIssuedAt', value);\n        }\n    }\n}\n","import { compactVerify } from '../jws/compact/verify.js';\nimport { validateClaimsSet } from '../lib/jwt_claims_set.js';\nimport { JWTInvalid } from '../util/errors.js';\nexport async function jwtVerify(jwt, key, options) {\n    const verified = await compactVerify(jwt, key, options);\n    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {\n        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');\n    }\n    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n    const result = { payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import { importJWK } from '../key/import.js';\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nfunction getKtyFromAlg(alg) {\n    switch (typeof alg === 'string' && alg.slice(0, 2)) {\n        case 'RS':\n        case 'PS':\n            return 'RSA';\n        case 'ES':\n            return 'EC';\n        case 'Ed':\n            return 'OKP';\n        case 'ML':\n            return 'AKP';\n        default:\n            throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n    }\n}\nfunction isJWKSLike(jwks) {\n    return (jwks &&\n        typeof jwks === 'object' &&\n        Array.isArray(jwks.keys) &&\n        jwks.keys.every(isJWKLike));\n}\nfunction isJWKLike(key) {\n    return isObject(key);\n}\nclass LocalJWKSet {\n    #jwks;\n    #cached = new WeakMap();\n    constructor(jwks) {\n        if (!isJWKSLike(jwks)) {\n            throw new JWKSInvalid('JSON Web Key Set malformed');\n        }\n        this.#jwks = structuredClone(jwks);\n    }\n    jwks() {\n        return this.#jwks;\n    }\n    async getKey(protectedHeader, token) {\n        const { alg, kid } = { ...protectedHeader, ...token?.header };\n        const kty = getKtyFromAlg(alg);\n        const candidates = this.#jwks.keys.filter((jwk) => {\n            let candidate = kty === jwk.kty;\n            if (candidate && typeof kid === 'string') {\n                candidate = kid === jwk.kid;\n            }\n            if (candidate && (typeof jwk.alg === 'string' || kty === 'AKP')) {\n                candidate = alg === jwk.alg;\n            }\n            if (candidate && typeof jwk.use === 'string') {\n                candidate = jwk.use === 'sig';\n            }\n            if (candidate && Array.isArray(jwk.key_ops)) {\n                candidate = jwk.key_ops.includes('verify');\n            }\n            if (candidate) {\n                switch (alg) {\n                    case 'ES256':\n                        candidate = jwk.crv === 'P-256';\n                        break;\n                    case 'ES384':\n                        candidate = jwk.crv === 'P-384';\n                        break;\n                    case 'ES512':\n                        candidate = jwk.crv === 'P-521';\n                        break;\n                    case 'Ed25519':\n                    case 'EdDSA':\n                        candidate = jwk.crv === 'Ed25519';\n                        break;\n                }\n            }\n            return candidate;\n        });\n        const { 0: jwk, length } = candidates;\n        if (length === 0) {\n            throw new JWKSNoMatchingKey();\n        }\n        if (length !== 1) {\n            const error = new JWKSMultipleMatchingKeys();\n            const _cached = this.#cached;\n            error[Symbol.asyncIterator] = async function* () {\n                for (const jwk of candidates) {\n                    try {\n                        yield await importWithAlgCache(_cached, jwk, alg);\n                    }\n                    catch { }\n                }\n            };\n            throw error;\n        }\n        return importWithAlgCache(this.#cached, jwk, alg);\n    }\n}\nasync function importWithAlgCache(cache, jwk, alg) {\n    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);\n    if (cached[alg] === undefined) {\n        const key = await importJWK({ ...jwk, ext: true }, alg);\n        if (key instanceof Uint8Array || key.type !== 'public') {\n            throw new JWKSInvalid('JSON Web Key Set members must be public keys');\n        }\n        cached[alg] = key;\n    }\n    return cached[alg];\n}\nexport function createLocalJWKSet(jwks) {\n    const set = new LocalJWKSet(jwks);\n    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);\n    Object.defineProperties(localJWKSet, {\n        jwks: {\n            value: () => structuredClone(set.jwks()),\n            enumerable: false,\n            configurable: false,\n            writable: false,\n        },\n    });\n    return localJWKSet;\n}\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';\nimport { createLocalJWKSet } from './local.js';\nimport { isObject } from '../lib/type_checks.js';\nfunction isCloudflareWorkers() {\n    return (typeof WebSocketPair !== 'undefined' ||\n        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||\n        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));\n}\nlet USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'jose';\n    const VERSION = 'v6.2.3';\n    USER_AGENT = `${NAME}/${VERSION}`;\n}\nexport const customFetch = Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n    const response = await fetchImpl(url, {\n        method: 'GET',\n        signal,\n        redirect: 'manual',\n        headers,\n    }).catch((err) => {\n        if (err.name === 'TimeoutError') {\n            throw new JWKSTimeout();\n        }\n        throw err;\n    });\n    if (response.status !== 200) {\n        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');\n    }\n    try {\n        return await response.json();\n    }\n    catch {\n        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');\n    }\n}\nexport const jwksCache = Symbol();\nfunction isFreshJwksCache(input, cacheMaxAge) {\n    if (typeof input !== 'object' || input === null) {\n        return false;\n    }\n    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {\n        return false;\n    }\n    if (!('jwks' in input) ||\n        !isObject(input.jwks) ||\n        !Array.isArray(input.jwks.keys) ||\n        !Array.prototype.every.call(input.jwks.keys, isObject)) {\n        return false;\n    }\n    return true;\n}\nclass RemoteJWKSet {\n    #url;\n    #timeoutDuration;\n    #cooldownDuration;\n    #cacheMaxAge;\n    #jwksTimestamp;\n    #pendingFetch;\n    #headers;\n    #customFetch;\n    #local;\n    #cache;\n    constructor(url, options) {\n        if (!(url instanceof URL)) {\n            throw new TypeError('url must be an instance of URL');\n        }\n        this.#url = new URL(url.href);\n        this.#timeoutDuration =\n            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;\n        this.#cooldownDuration =\n            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;\n        this.#cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;\n        this.#headers = new Headers(options?.headers);\n        if (USER_AGENT && !this.#headers.has('User-Agent')) {\n            this.#headers.set('User-Agent', USER_AGENT);\n        }\n        if (!this.#headers.has('accept')) {\n            this.#headers.set('accept', 'application/json');\n            this.#headers.append('accept', 'application/jwk-set+json');\n        }\n        this.#customFetch = options?.[customFetch];\n        if (options?.[jwksCache] !== undefined) {\n            this.#cache = options?.[jwksCache];\n            if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {\n                this.#jwksTimestamp = this.#cache.uat;\n                this.#local = createLocalJWKSet(this.#cache.jwks);\n            }\n        }\n    }\n    pendingFetch() {\n        return !!this.#pendingFetch;\n    }\n    coolingDown() {\n        return typeof this.#jwksTimestamp === 'number'\n            ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration\n            : false;\n    }\n    fresh() {\n        return typeof this.#jwksTimestamp === 'number'\n            ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge\n            : false;\n    }\n    jwks() {\n        return this.#local?.jwks();\n    }\n    async getKey(protectedHeader, token) {\n        if (!this.#local || !this.fresh()) {\n            await this.reload();\n        }\n        try {\n            return await this.#local(protectedHeader, token);\n        }\n        catch (err) {\n            if (err instanceof JWKSNoMatchingKey) {\n                if (this.coolingDown() === false) {\n                    await this.reload();\n                    return this.#local(protectedHeader, token);\n                }\n            }\n            throw err;\n        }\n    }\n    async reload() {\n        if (this.#pendingFetch && isCloudflareWorkers()) {\n            this.#pendingFetch = undefined;\n        }\n        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)\n            .then((json) => {\n            this.#local = createLocalJWKSet(json);\n            if (this.#cache) {\n                this.#cache.uat = Date.now();\n                this.#cache.jwks = json;\n            }\n            this.#jwksTimestamp = Date.now();\n            this.#pendingFetch = undefined;\n        })\n            .catch((err) => {\n            this.#pendingFetch = undefined;\n            throw err;\n        });\n        await this.#pendingFetch;\n    }\n}\nexport function createRemoteJWKSet(url, options) {\n    const set = new RemoteJWKSet(url, options);\n    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);\n    Object.defineProperties(remoteJWKSet, {\n        coolingDown: {\n            get: () => set.coolingDown(),\n            enumerable: true,\n            configurable: false,\n        },\n        fresh: {\n            get: () => set.fresh(),\n            enumerable: true,\n            configurable: false,\n        },\n        reload: {\n            value: () => set.reload(),\n            enumerable: true,\n            configurable: false,\n            writable: false,\n        },\n        reloading: {\n            get: () => set.pendingFetch(),\n            enumerable: true,\n            configurable: false,\n        },\n        jwks: {\n            value: () => set.jwks(),\n            enumerable: true,\n            configurable: false,\n            writable: false,\n        },\n    });\n    return remoteJWKSet;\n}\n","/**\n * PKCE (RFC 7636) helpers for the authorization-code flow with S256.\n */\n\nexport function base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n}\n\n/**\n * Generate a high-entropy `code_verifier` (43 chars, url-safe).\n */\nexport function generateCodeVerifier(): string {\n  return base64url(globalThis.crypto.getRandomValues(new Uint8Array(32)));\n}\n\n/**\n * Derive the S256 `code_challenge` for a `code_verifier`.\n */\nexport async function deriveCodeChallenge(verifier: string): Promise<string> {\n  const digest = await globalThis.crypto.subtle.digest(\n    'SHA-256',\n    new TextEncoder().encode(verifier)\n  );\n  return base64url(new Uint8Array(digest));\n}\n","import { createError, H3Event } from 'h3';\nimport { SessionService } from './session.service';\nimport { AuthSessionData } from '../types/auth-session.types';\nimport type { AnalogAuthConfig } from '../types/auth.types';\nimport { inject, registerService, Injectable } from '@analog-tools/inject';\nimport { LoggerService } from '@analog-tools/logger';\nimport { getSession, refetchSession, regenerateSession, updateSession } from '@analog-tools/session';\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { base64url } from '../utils/pkce';\n\nconst AUTH_FAILED_MESSAGE = 'Authentication failed';\n\n// http is only acceptable for these hosts (local development).\nfunction isLocalDevHost(hostname: string): boolean {\n  return (\n    hostname === 'localhost' ||\n    hostname === '::1' ||\n    hostname === '[::1]' ||\n    /^127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/.test(hostname)\n  );\n}\n\n/**\n * Parse a URL and require https, except for local-development hosts. Guards\n * against tokens/secrets being sent over cleartext or to a non-https endpoint\n * advertised by a tampered discovery document.\n */\nfunction assertSecureUrl(\n  rawUrl: string,\n  label: string,\n  allowInsecureLocalhost: boolean\n): URL {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw createError({ statusCode: 500, message: `Invalid ${label} URL` });\n  }\n  const isSecure =\n    url.protocol === 'https:' ||\n    (allowInsecureLocalhost &&\n      url.protocol === 'http:' &&\n      isLocalDevHost(url.hostname));\n  if (!isSecure) {\n    throw createError({\n      statusCode: 500,\n      message: `${label} must use https (http is only permitted for a localhost issuer during development)`,\n    });\n  }\n  return url;\n}\n\nfunction normalizeIssuer(issuer: string): string {\n  return issuer.replace(/\\/+$/, '');\n}\n\n/**\n * Build the set of `iss` claim values (trailing-slash variants) accepted for\n * a single configured issuer. Providers disagree on the canonical form:\n * Auth0 emits `https://tenant.auth0.com/` (trailing slash) in both the\n * discovery document and the id_token `iss`, while Keycloak and most others\n * emit it without the slash. The variants stay anchored to the one configured\n * issuer, so they never broaden trust to a different host.\n */\nfunction issuerVariants(issuer: string): string[] {\n  const normalized = normalizeIssuer(issuer);\n  return [...new Set([issuer, normalized, `${normalized}/`])];\n}\n// OIDC Core §3.1.3.6: at_hash is half of the access token hashed with the\n// digest matching the ID token's signing algorithm's bit size (EdDSA uses\n// SHA-512 per the OIDC errata). Unknown algs return null so the caller can\n// fail closed instead of skipping a claim that's actually present.\nfunction hashAlgForJwsAlg(alg: string): 'SHA-256' | 'SHA-384' | 'SHA-512' | null {\n  if (alg === 'EdDSA') return 'SHA-512';\n  const bits = /^[A-Z]{2}(256|384|512)$/.exec(alg)?.[1];\n  return bits ? (`SHA-${bits}` as 'SHA-256' | 'SHA-384' | 'SHA-512') : null;\n}\n\nasync function computeAtHash(accessToken: string, alg: string): Promise<string | null> {\n  const hashAlg = hashAlgForJwsAlg(alg);\n  if (!hashAlg) return null;\n  const digest = await globalThis.crypto.subtle.digest(\n    hashAlg,\n    new TextEncoder().encode(accessToken)\n  );\n  const bytes = new Uint8Array(digest);\n  return base64url(bytes.slice(0, bytes.length / 2));\n}\n\n/**\n * Service for handling OAuth authentication in a Backend-for-Frontend pattern\n */\n\n@Injectable()\nexport class OAuthAuthenticationService {\n  private logger: LoggerService;\n  private inflightRefreshes = new Map<\n    string,\n    Promise<{\n      access_token: string;\n      id_token?: string;\n      refresh_token?: string;\n      expires_in: number;\n    }>\n  >();\n\n  constructor(config: AnalogAuthConfig) {\n    this.logger = inject(LoggerService).forContext(\n      'OAuthAuthenticationService'\n    );\n    registerService(SessionService, config.sessionStorage);\n    this.config = config;\n  }\n\n  // Config object with default values\n  private readonly config!: AnalogAuthConfig;\n\n  // OpenID Configuration cache\n  private openIDConfigCache: OpenIDConfiguration | null = null;\n  private configLastFetched: number | null = null;\n  private readonly CONFIG_CACHE_TTL = 3600000; // 1 hour in milliseconds\n\n  // Add these properties for token refresh configuration\n  private TOKEN_REFRESH_SAFETY_MARGIN = 60 * 5; // 5 minutes in seconds\n\n  // Cached normalized whitelist extensions for efficient lookups\n  private normalizedWhitelistExtensions: Set<string> = new Set();\n\n  // Cached remote JWKS for ID-token verification (keyed by jwks_uri)\n  private jwks?: ReturnType<typeof createRemoteJWKSet>;\n  private jwksUri?: string;\n\n  /**\n   * Validate that the service has been properly initialized\n   * @throws Error if mandatory configuration is missing\n   */\n  private validateConfiguration(): void {\n    if (\n      !this.config.issuer ||\n      !this.config.clientId ||\n      !this.config.clientSecret ||\n      !this.config.callbackUri\n    ) {\n      throw new Error(\n        'OAuth Authentication Service not properly initialized. ' +\n          'Make sure to call AnalogAuth() with valid configuration before using authentication features.'\n      );\n    }\n  }\n\n  // Rest of the code converted to class methods...\n\n  /**\n   * Initialize session for the request\n   */\n  async initSession(event: H3Event): Promise<void> {\n    return await inject(SessionService).initSession(event);\n  }\n\n  getConfig(): AnalogAuthConfig {\n    this.validateConfiguration();\n    return this.config;\n  }\n\n  /**\n   * Safely access a configuration value\n   * @param key The configuration key to retrieve\n   * @param fallbackValue Optional fallback value if the config value doesn't exist\n   * @returns The configuration value or fallback value\n   * @throws Error if the configuration value doesn't exist and no fallback is provided\n   */\n  getConfigValue<K extends keyof AnalogAuthConfig>(\n    key: K,\n    fallbackValue?: AnalogAuthConfig[K]\n  ): AnalogAuthConfig[K] {\n    const value = this.config[key];\n    // Check if value is undefined or empty string\n    if (value === undefined || (typeof value === 'string' && value === '')) {\n      if (fallbackValue !== undefined) {\n        return fallbackValue;\n      }\n\n      // These config values are optional and should return a safe default if missing\n      if (key === 'userHandler' || key === 'logoutUrl' || key === 'audience') {\n        return undefined as AnalogAuthConfig[K];\n      }\n      if (key === 'unprotectedRoutes') {\n        return [] as string[] as AnalogAuthConfig[K];\n      }\n\n      throw new Error(`Configuration value for '${key}' doesn't exist`);\n    }\n    return value;\n  }\n\n  /**\n   * Check if the route is unprotected\n   * @param path The request path\n   * @returns True if the route is unprotected, false otherwise\n   */\n  isUnprotectedRoute(path: string): boolean {\n    const unprotectedRoutes = this.getConfigValue(\n      'unprotectedRoutes',\n      [] as string[]\n    );\n    \n    if (!Array.isArray(unprotectedRoutes)) {\n      return false;\n    }\n    \n    return unprotectedRoutes.some((route) => {\n      // Handle wildcard routes (ending with *)\n      if (route.endsWith('*')) {\n        const routePrefix = route.slice(0, -1);\n        \n        // For wildcards, we want to match paths that have actual content after the prefix\n        // Examples:\n        // - `/api/public/*` should NOT match `/api/public` or `/api/public/`\n        // - `/api/public/*` should match `/api/public/subpath`, `/api/public/anything`\n        if (!path.startsWith(routePrefix)) {\n          return false;\n        }\n        \n        // Check if there's actual content after the prefix (not just empty or single slash)\n        const afterPrefix = path.slice(routePrefix.length);\n        return afterPrefix.length > 0 && afterPrefix !== '/';\n      }\n      \n      // Handle exact route matching - normalize trailing slashes\n      const normalizedRoute = route.endsWith('/') ? route : route + '/';\n      const normalizedPath = path.endsWith('/') ? path : path + '/';\n      \n      // Check both with and without trailing slash\n      return path === route || normalizedPath === normalizedRoute;\n    });\n  }\n\n  /**\n   * Get OAuth authorization URL for login\n   */\n  async getAuthorizationUrl(params: {\n    state: string;\n    codeChallenge: string;\n    nonce: string;\n    redirectUri?: string;\n  }): Promise<string> {\n    this.validateConfiguration();\n\n    const config = await this.getOpenIDConfiguration();\n\n    const audience = this.getConfigValue('audience', undefined);\n\n    const searchparams = {\n      response_type: 'code',\n      client_id: this.getConfigValue('clientId'),\n      redirect_uri: params.redirectUri || this.getConfigValue('callbackUri'),\n      scope: this.getConfigValue('scope'),\n      state: params.state,\n      nonce: params.nonce,\n      code_challenge: params.codeChallenge,\n      code_challenge_method: 'S256',\n      ...(audience ? { audience } : {}),\n    };\n\n    const urlParams = new URLSearchParams(searchparams);\n\n    return `${config.authorization_endpoint}?${urlParams.toString()}`;\n  }\n\n  /**\n   * Exchange authorization code for tokens\n   */\n  private async exchangeCodeForTokens(\n    code: string,\n    codeVerifier: string,\n    redirectUri?: string\n  ) {\n    const config = await this.getOpenIDConfiguration();\n\n    const response = await fetch(config.token_endpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.getConfigValue('clientId'),\n        client_secret: this.getConfigValue('clientSecret'),\n        code,\n        code_verifier: codeVerifier,\n        redirect_uri: redirectUri || this.getConfigValue('callbackUri'),\n      }).toString(),\n    });\n    if (!response.ok) {\n      const error = await response.json();\n      this.logger.error('Error exchanging code for tokens', error);\n      throw createError({\n        statusCode: 401,\n        message: 'Failed to exchange authorization code',\n      });\n    }\n\n    return await response.json();\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  private async refreshTokens(refreshToken: string): Promise<{\n    access_token: string;\n    id_token?: string;\n    refresh_token?: string;\n    expires_in: number;\n  }> {\n    const config = await this.getOpenIDConfiguration();\n\n    try {\n      const response = await fetch(config.token_endpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'refresh_token',\n          client_id: this.getConfigValue('clientId'),\n          client_secret: this.getConfigValue('clientSecret'),\n          refresh_token: refreshToken,\n        }).toString(),\n      });\n\n      if (!response.ok) {\n        const error = await response\n          .json()\n          .catch(() => ({ error: 'Unknown error' }));\n        this.logger.error('Error refreshing token', error);\n        throw createError({\n          statusCode: 401,\n          message: 'Failed to refresh token',\n        });\n      }\n\n      return await response.json();\n    } catch (error) {\n      this.logger.error('Error during token refresh', error);\n      throw createError({\n        statusCode: 401,\n        message: 'Failed to refresh authentication token',\n      });\n    }\n  }\n\n  private async refreshTokensDeduped(refreshToken: string): Promise<{\n    access_token: string;\n    id_token?: string;\n    refresh_token?: string;\n    expires_in: number;\n  }> {\n    const existingRefresh = this.inflightRefreshes.get(refreshToken);\n    if (existingRefresh) {\n      return existingRefresh;\n    }\n\n    const refreshPromise = this.refreshTokens(refreshToken).finally(() => {\n      this.inflightRefreshes.delete(refreshToken);\n    });\n\n    this.inflightRefreshes.set(refreshToken, refreshPromise);\n    return refreshPromise;\n  }\n\n  /**\n   * Get user info from OAuth provider with improved error handling and retry logic\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  private async getUserInfo(accessToken: string, maxRetries = 3): Promise<any> {\n    const config = await this.getOpenIDConfiguration();\n    let lastError: Error | null = null;\n\n    // Retry logic for network issues\n    for (let attempt = 1; attempt <= maxRetries; attempt++) {\n      try {\n        const response = await fetch(config.userinfo_endpoint, {\n          headers: {\n            Authorization: `Bearer ${accessToken}`,\n          },\n          // Add timeout to prevent hanging requests\n          signal: AbortSignal.timeout(10000), // 10 second timeout\n        });\n\n        if (!response.ok) {\n          const errorData = await response\n            .json()\n            .catch(() => ({ error: 'Unknown error' }));\n          this.logger.error(`Error getting user info`, errorData, {\n            attempt,\n            maxRetries,\n          });\n\n          // Handle different error scenarios\n          if (response.status === 401) {\n            throw createError({\n              statusCode: 401,\n              message: 'Authentication token is invalid or expired',\n            });\n          } else if (response.status === 429) {\n            // Rate limiting - wait longer before retry\n            const retryAfter = parseInt(\n              response.headers.get('Retry-After') || '5',\n              10\n            );\n            await new Promise((resolve) =>\n              setTimeout(resolve, retryAfter * 1000)\n            );\n            continue;\n          } else if (response.status >= 500) {\n            // Server error - retry after delay\n            await new Promise((resolve) => setTimeout(resolve, attempt * 1000));\n            continue;\n          } else {\n            throw createError({\n              statusCode: response.status,\n              message: `Failed to get user info: ${\n                errorData.error || 'Unknown error'\n              }`,\n            });\n          }\n        }\n\n        const userData = await response.json();\n\n        // Basic validation of user data\n        if (!userData || (!userData.sub && !userData.id)) {\n          throw createError({\n            statusCode: 500,\n            message: 'Invalid user data received from provider',\n          });\n        }\n\n        return userData;\n      } catch (error: unknown) {\n        lastError = error as Error;\n\n        // Don't retry certain errors like invalid token\n        if (\n          error instanceof Error &&\n          'statusCode' in error &&\n          (error as { statusCode: number }).statusCode === 401\n        ) {\n          throw error;\n        }\n\n        // Network errors are retryable\n        if (\n          error instanceof TypeError ||\n          (error instanceof Error && error.name === 'AbortError')\n        ) {\n          this.logger.error(`Network error fetching user info`, error, {\n            attempt,\n            maxRetries,\n          });\n          if (attempt < maxRetries) {\n            // Exponential backoff\n            await new Promise((resolve) =>\n              setTimeout(resolve, Math.pow(2, attempt) * 500)\n            );\n            continue;\n          }\n        }\n\n        // If we're out of retries, rethrow the last error\n        if (attempt === maxRetries) {\n          this.logger.error(`Failed to get user info after multiple attempts`, {\n            maxRetries,\n          });\n          throw createError({\n            statusCode: 500,\n            message: 'Failed to get user info after multiple attempts',\n            cause: lastError,\n          });\n        }\n      }\n    }\n\n    // This should never be reached due to the throw in the last attempt\n    throw createError({\n      statusCode: 500,\n      message: 'Unexpected error getting user info',\n    });\n  }\n\n  /**\n   * Verify an OIDC ID token: signature (via the provider's JWKS), `iss`, `aud`,\n   * `exp`/`nbf`, the per-login `nonce`, `azp` (when present), and — when the\n   * provider sends it — `at_hash` binding the token to `accessToken`. Returns\n   * the verified claims\n   * so the caller can anchor identity in the cryptographically validated token.\n   */\n  private async validateIdToken(\n    idToken: string,\n    nonce: string,\n    accessToken: string\n  ): Promise<JWTPayload> {\n    const config = await this.getOpenIDConfiguration();\n\n    if (!config.jwks_uri) {\n      throw createError({\n        statusCode: 500,\n        message: 'OpenID configuration is missing jwks_uri; cannot verify ID token',\n      });\n    }\n\n    // Only a localhost issuer (development) may use cleartext http; a production\n    // (https) issuer must never fetch signing keys over http, even for localhost.\n    const configuredIssuer = this.getConfigValue('issuer');\n    const issuerUrl = assertSecureUrl(configuredIssuer, 'OAuth issuer', true);\n    const allowInsecureLocalhost =\n      issuerUrl.protocol === 'http:' && isLocalDevHost(issuerUrl.hostname);\n\n    const jwksUrl = assertSecureUrl(\n      config.jwks_uri,\n      'jwks_uri',\n      allowInsecureLocalhost\n    );\n\n    if (!this.jwks || this.jwksUri !== config.jwks_uri) {\n      this.jwks = createRemoteJWKSet(jwksUrl);\n      this.jwksUri = config.jwks_uri;\n    }\n\n    let payload: JWTPayload;\n    let protectedHeader: { alg: string };\n    try {\n      ({ payload, protectedHeader } = await jwtVerify(idToken, this.jwks, {\n        // Trust anchor is the configured issuer, never the fetched metadata.\n        // Accept every trailing-slash variant of the configured issuer so an\n        // id_token `iss` from both slash-preferring providers (Auth0) and\n        // slash-stripping providers (Keycloak) verify against the same config.\n        issuer: issuerVariants(configuredIssuer),\n        audience: this.getConfigValue('clientId'),\n      }));\n    } catch (error) {\n      this.logger.error('ID token validation failed', error);\n      throw createError({ statusCode: 401, message: AUTH_FAILED_MESSAGE });\n    }\n\n    if (payload['nonce'] !== nonce) {\n      this.logger.error('ID token nonce mismatch');\n      throw createError({ statusCode: 401, message: AUTH_FAILED_MESSAGE });\n    }\n\n    if (\n      typeof payload['azp'] !== 'undefined' &&\n      payload['azp'] !== this.getConfigValue('clientId')\n    ) {\n      this.logger.error('ID token azp does not match client ID');\n      throw createError({ statusCode: 401, message: AUTH_FAILED_MESSAGE });\n    }\n\n    // Bind the ID token to the access token it was issued alongside, when the\n    // provider sends at_hash (OIDC Core §3.1.3.6). Absent = provider doesn't\n    // send it; present-but-wrong = token substitution, fail closed either way.\n    if (typeof payload['at_hash'] === 'string') {\n      const expected = await computeAtHash(accessToken, protectedHeader.alg);\n      if (expected === null || expected !== payload['at_hash']) {\n        this.logger.error('ID token at_hash mismatch');\n        throw createError({ statusCode: 401, message: AUTH_FAILED_MESSAGE });\n      }\n    }\n\n    return payload;\n  }\n\n  /**\n   * Handle OAuth callback\n   */\n  async handleCallback(event: H3Event, code: string, state: string) {\n    // Verify state parameter (should be implemented with CSRF protection)\n    if (!state) {\n      throw createError({\n        statusCode: 400,\n        message: 'Invalid state parameter',\n      });\n    }\n\n    // PKCE verifier and nonce were stored on the session by the login route.\n    const session = getSession<AuthSessionData>(event);\n    const codeVerifier = session?.codeVerifier;\n    const nonce = session?.nonce;\n    if (!codeVerifier || !nonce) {\n      throw createError({\n        statusCode: 400,\n        message: 'Missing PKCE verifier or nonce; restart the login flow',\n      });\n    }\n\n    // Exchange code for tokens (PKCE)\n    const tokens = await this.exchangeCodeForTokens(code, codeVerifier);\n    const { access_token, id_token, refresh_token, expires_in } = tokens;\n\n    const requestsOpenIdScope = this.getConfigValue('scope')\n      .split(' ')\n      .includes('openid');\n    if (requestsOpenIdScope && !id_token) {\n      this.logger.error(\n        'Token response is missing id_token for an openid-scoped request'\n      );\n      throw createError({ statusCode: 401, message: AUTH_FAILED_MESSAGE });\n    }\n\n    // Verify the ID token (authenticity + nonce replay protection) when present.\n    let idTokenSub: string | undefined;\n    if (id_token) {\n      const claims = await this.validateIdToken(id_token, nonce, access_token);\n      if (typeof claims.sub !== 'string' || claims.sub.length === 0) {\n        this.logger.error('ID token is missing a subject');\n        throw createError({ statusCode: 401, message: AUTH_FAILED_MESSAGE });\n      }\n      idTokenSub = claims.sub;\n    }\n\n    // Get user info from OAuth provider (profile enrichment)\n    const userData = await this.getUserInfo(access_token);\n\n    // Anchor identity in the verified ID token: userinfo must describe the same\n    // subject, otherwise the tokens have been mixed/substituted.\n    if (\n      idTokenSub &&\n      (typeof userData?.sub !== 'string' || userData.sub !== idTokenSub)\n    ) {\n      this.logger.error('ID token subject does not match userinfo subject');\n      throw createError({ statusCode: 401, message: AUTH_FAILED_MESSAGE });\n    }\n\n    // Store user in database\n    const userHandler = this.getConfigValue('userHandler', undefined);\n\n    let user = userData;\n    if (userHandler && 'createOrUpdateUser' in userHandler) {\n      user = await userHandler.createOrUpdateUser?.(userData);\n    }\n\n    // Store auth data in session using new session API\n    const auth = {\n      isAuthenticated: true,\n      accessToken: access_token,\n      idToken: id_token,\n      refreshToken: refresh_token,\n      expiresAt: Date.now() + expires_in * 1000,\n      userInfo: userData,\n    };\n\n    // Regenerate the session id on privilege elevation (anonymous ->\n    // authenticated) so any pre-auth id a fixation attacker may have planted is\n    // discarded before the authenticated tokens are stored under a fresh id.\n    await regenerateSession(event);\n\n    // Update session with user and auth data; clear transient PKCE/nonce.\n    await updateSession(event, () => ({\n      user,\n      auth,\n      codeVerifier: undefined,\n      nonce: undefined,\n    }));\n\n    if (this.getConfigValue('singleSessionPerUser', false)) {\n      // Optional policy: keep current request session and invalidate\n      // other authenticated sessions for the same resolved user identity.\n      // Guarded so a storage error in this optional cleanup can't fail an\n      // otherwise-successful login (tokens are already saved above).\n      try {\n        await this.invalidateOtherUserSessions(event, user, userData);\n      } catch (error) {\n        this.logger.error('Failed to invalidate other user sessions', error);\n      }\n    }\n\n    // Log successful session save\n    this.logger.debug('Authentication session data saved successfully');\n\n    return { user, tokens };\n  }\n\n  private resolveUserIdentity(\n    user: Record<string, unknown> | null | undefined,\n    userData: Record<string, unknown> | null | undefined\n  ): string | null {\n    const candidates = [\n      user?.['id'],\n      user?.['sub'],\n      userData?.['id'],\n      userData?.['sub'],\n      userData?.['email'],\n    ];\n\n    for (const candidate of candidates) {\n      if (typeof candidate === 'string' && candidate.length > 0) {\n        return candidate;\n      }\n    }\n\n    return null;\n  }\n\n  private resolveSessionIdentity(session: AuthSessionData): string | null {\n    const sessionUser =\n      session.user && typeof session.user === 'object'\n        ? (session.user as Record<string, unknown>)\n        : null;\n    const sessionUserInfo =\n      session.auth?.userInfo && typeof session.auth.userInfo === 'object'\n        ? (session.auth.userInfo as Record<string, unknown>)\n        : null;\n\n    const candidates = [\n      sessionUser?.['id'],\n      sessionUser?.['sub'],\n      sessionUserInfo?.['id'],\n      sessionUserInfo?.['sub'],\n      sessionUserInfo?.['email'],\n    ];\n\n    for (const candidate of candidates) {\n      if (typeof candidate === 'string' && candidate.length > 0) {\n        return candidate;\n      }\n    }\n\n    return null;\n  }\n\n  private async invalidateOtherUserSessions(\n    event: H3Event,\n    user: Record<string, unknown> | null | undefined,\n    userData: Record<string, unknown> | null | undefined\n  ): Promise<void> {\n    const targetIdentity = this.resolveUserIdentity(user, userData);\n    if (!targetIdentity) {\n      this.logger.debug(\n        'Skipping session invalidation because user identity could not be resolved'\n      );\n      return;\n    }\n\n    const currentSessionId =\n      typeof event.context['__session_id__'] === 'string'\n        ? (event.context['__session_id__'] as string)\n        : null;\n\n    if (!currentSessionId) {\n      this.logger.debug(\n        'Skipping session invalidation because current session id is unavailable'\n      );\n      return;\n    }\n\n    const sessionService = inject(SessionService);\n    const activeSessions = await sessionService.getActiveSessions();\n\n    for (const activeSession of activeSessions) {\n      if (activeSession.id === currentSessionId) {\n        continue;\n      }\n\n      if (!activeSession.data.auth?.isAuthenticated) {\n        continue;\n      }\n\n      const sessionIdentity = this.resolveSessionIdentity(activeSession.data);\n      if (!sessionIdentity || sessionIdentity !== targetIdentity) {\n        continue;\n      }\n\n      activeSession.update((data) => {\n        const currentAuth = data.auth;\n        return {\n          ...data,\n          auth: {\n            ...(currentAuth ?? { isAuthenticated: false }),\n            isAuthenticated: false,\n            accessToken: undefined,\n            idToken: undefined,\n            refreshToken: undefined,\n            expiresAt: undefined,\n            userInfo: undefined,\n          },\n          user: null,\n        };\n      });\n\n      await activeSession.save();\n      this.logger.debug('Invalidated stale authenticated session', {\n        sessionId: activeSession.id,\n      });\n    }\n  }\n\n  /**\n   * Calculate if token needs refresh based on safety margin\n   * @param expiresAt Timestamp when token expires\n   * @returns True if token should be refreshed\n   */\n  private shouldRefreshToken(expiresAt: number): boolean {\n    const now = Date.now();\n    // Convert safety margin to milliseconds\n    const safetyMargin = this.TOKEN_REFRESH_SAFETY_MARGIN * 1000;\n    // Return true if token will expire within safety margin\n    return now + safetyMargin > expiresAt;\n  }\n\n  /**\n   * Serverless-compatible method to refresh expiring tokens\n   * This should be called by a scheduled function/CRON job\n   * rather than using setInterval which doesn't work reliably in serverless\n   */\n  async refreshExpiringTokens(): Promise<{\n    refreshed: number;\n    failed: number;\n    total: number;\n  }> {\n    this.logger.debug('Starting bulk token refresh process');\n    \n    try {\n      // Get all active sessions from the session service\n      const sessionService = inject(SessionService);\n      const activeSessions = await sessionService.getActiveSessions();\n      \n      let refreshed = 0;\n      let failed = 0;\n      const total = activeSessions.length;\n      \n      this.logger.debug(`Found ${total} active sessions to check`);\n      \n      // Process each session\n      for (const session of activeSessions) {\n        try {\n          // Skip sessions without valid auth data\n          if (!session.data.auth?.isAuthenticated || \n              !session.data.auth.refreshToken || \n              !session.data.auth.expiresAt) {\n            this.logger.debug(`Skipping session ${session.id} - no valid auth data`);\n            continue;\n          }\n          \n          // Check if token needs refresh (within safety margin)\n          if (!this.shouldRefreshToken(session.data.auth.expiresAt)) {\n            this.logger.debug(`Skipping session ${session.id} - token not expiring soon`);\n            continue;\n          }\n          \n          this.logger.debug(`Refreshing token for session ${session.id}`);\n          \n          // Refresh the token (deduped so this doesn't race a concurrent\n          // request-driven refresh for the same refresh token)\n          const tokens = await this.refreshTokensDeduped(\n            session.data.auth.refreshToken\n          );\n          \n          // Update session data\n          session.update((data) => {\n            const currentAuth = data.auth;\n            if (!currentAuth) return data;\n            \n            return {\n              ...data,\n              auth: {\n                ...currentAuth,\n                accessToken: tokens.access_token,\n                idToken: tokens.id_token || currentAuth.idToken,\n                refreshToken: tokens.refresh_token || currentAuth.refreshToken,\n                expiresAt: Date.now() + tokens.expires_in * 1000,\n              },\n            };\n          });\n          \n          // Save the updated session\n          await session.save();\n          \n          refreshed++;\n          this.logger.debug(`Successfully refreshed token for session ${session.id}`);\n          \n        } catch (error) {\n          failed++;\n          this.logger.error(\n            'Failed to refresh token for session',\n            error,\n            { sessionId: session.id }\n          );\n\n          // Mark session as unauthenticated on refresh failure, unless a\n          // concurrent request-driven refresh already updated this same\n          // session (in storage) with a still-valid token in the meantime.\n          try {\n            const latestData = await session.refetch();\n            const hasLatestValidAuth =\n              !!latestData?.auth?.isAuthenticated &&\n              typeof latestData.auth.expiresAt === 'number' &&\n              latestData.auth.expiresAt > Date.now();\n\n            if (hasLatestValidAuth) {\n              failed--;\n              this.logger.debug(\n                `Skipping unauthenticated mark for session ${session.id} - already refreshed concurrently`\n              );\n              continue;\n            }\n\n            session.update((data) => {\n              const currentAuth = data.auth;\n              if (!currentAuth) return data;\n\n              return {\n                ...data,\n                auth: {\n                  ...currentAuth,\n                  isAuthenticated: false,\n                },\n              };\n            });\n            await session.save();\n          } catch (updateError) {\n            this.logger.error(\n              'Failed to update session after refresh failure',\n              updateError,\n              { sessionId: session.id }\n            );\n          }\n        }\n      }\n      \n      const result = { refreshed, failed, total };\n      this.logger.info(`Bulk token refresh completed`, result);\n      \n      return result;\n      \n    } catch (error) {\n      this.logger.error('Error during bulk token refresh', error);\n      throw createError({\n        statusCode: 500,\n        message: 'Failed to refresh expiring tokens',\n      });\n    }\n  }\n\n  /**\n   * Check if user is authenticated\n   */\n  async isAuthenticated(event: H3Event): Promise<boolean> {\n    await inject(SessionService).initSession(event);\n\n    const session = (await getSession(event)) as AuthSessionData;\n\n    // Ensure auth object exists in session data\n    if (!session?.auth) {\n      await updateSession(event, () => ({\n        auth: { isAuthenticated: false },\n      }));\n\n      return false;\n    }\n\n    // Check if session has auth data\n    if (!session.auth.isAuthenticated) {\n      return false;\n    }\n\n    // Check if token is expired\n    if (session.auth.expiresAt && session.auth.expiresAt < Date.now()) {\n      // Token is expired, try to refresh if refresh token exists\n      if (session.auth.refreshToken) {\n        try {\n          // Refresh the token\n          const tokens = await this.refreshTokensDeduped(\n            session.auth.refreshToken\n          );\n\n          // Update session with new tokens\n          await updateSession(event, (currentSession: AuthSessionData) => ({\n            auth: {\n              ...currentSession.auth,\n              isAuthenticated: true,\n              accessToken: tokens.access_token,\n              idToken: tokens.id_token || session?.auth?.idToken,\n              refreshToken: tokens.refresh_token || session?.auth?.refreshToken,\n              expiresAt: Date.now() + tokens.expires_in * 1000,\n            },\n          }));\n\n          return true;\n        } catch (error) {\n          this.logger.error('Error refreshing token', error);\n\n          // Re-read from storage, not the request-scoped context copy: a\n          // concurrent request may have already refreshed this session\n          // successfully, and getSession(event) can never observe that.\n          const latestSession = await refetchSession<AuthSessionData>(event);\n          const hasLatestValidAuth =\n            !!latestSession?.auth?.isAuthenticated &&\n            typeof latestSession.auth.expiresAt === 'number' &&\n            latestSession.auth.expiresAt > Date.now();\n\n          if (hasLatestValidAuth) {\n            return true;\n          }\n\n          // Clear auth data on refresh token failure\n          await updateSession(event, (currentSession: AuthSessionData) => ({\n            auth: {\n              ...currentSession.auth,\n              isAuthenticated: false,\n            },\n          }));\n\n          this.logger.info('error occurred while refreshing token');\n          this.logger.groupEnd(\n            'OAuthAuthenticationService.isAuthenticated ' + event.path\n          );\n          return false;\n        }\n      } else {\n        // No refresh token available\n        this.logger.info(' No refresh token available');\n        this.logger.groupEnd(\n          'OAuthAuthenticationService.isAuthenticated ' + event.path\n        );\n        return false;\n      }\n    }\n\n    // Check if token needs proactive refresh\n    if (\n      session.auth.expiresAt &&\n      this.shouldRefreshToken(session.auth.expiresAt)\n    ) {\n      // Refresh in background without blocking the request\n      setTimeout(async () => {\n        try {\n          const currentSession = (await getSession(event)) as AuthSessionData;\n          if (\n            !currentSession?.auth?.isAuthenticated ||\n            !currentSession.auth.refreshToken\n          ) {\n            return; // Session no longer valid\n          }\n\n          const tokens = await this.refreshTokensDeduped(\n            currentSession.auth.refreshToken\n          );\n\n          // Update session with new tokens\n          await updateSession(event, (session: AuthSessionData) => ({\n            auth: {\n              ...session.auth,\n              isAuthenticated: true,\n              accessToken: tokens.access_token,\n              idToken: tokens.id_token || currentSession?.auth?.idToken,\n              refreshToken:\n                tokens.refresh_token || currentSession?.auth?.refreshToken,\n              expiresAt: Date.now() + tokens.expires_in * 1000,\n            },\n          }));\n\n          this.logger.debug('Background token refresh completed');\n        } catch (error) {\n          this.logger.error('Background token refresh failed', error);\n        }\n      }, 0);\n    }\n\n    return true;\n  }\n\n  /**\n   * Get authenticated user\n   */\n  async getAuthenticatedUser(event: H3Event) {\n    // Check if user is authenticated\n    if (!(await this.isAuthenticated(event))) {\n      return null;\n    }\n\n    const session = getSession(event) as AuthSessionData;\n\n    const userHandler = this.getConfigValue('userHandler', undefined);\n\n    if (userHandler && 'mapUserToLocal' in userHandler) {\n      return userHandler.mapUserToLocal?.(session.auth?.userInfo);\n    }\n\n    return session.auth?.userInfo;\n  }\n\n  /**\n   * Revoke an access token\n   */\n  private async revokeToken(token: string): Promise<void> {\n    const config = await this.getOpenIDConfiguration();\n    const response = await fetch(config.revocation_endpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        client_id: this.getConfigValue('clientId'),\n        client_secret: this.getConfigValue('clientSecret'),\n        token,\n      }),\n    });\n\n    if (!response.ok) {\n      throw new Error('Failed to revoke token');\n    }\n  }\n\n  /**\n   * Logout user\n   */\n  async logout(event: H3Event): Promise<string> {\n    await inject(SessionService).initSession(event);\n    const session = getSession(event) as AuthSessionData;\n    const config = await this.getOpenIDConfiguration();\n\n    // Revoke access token if it exists\n    if (session?.['auth']?.accessToken) {\n      try {\n        await this.revokeToken(session['auth'].accessToken);\n      } catch (error) {\n        this.logger.error('Failed to revoke access token', error);\n      }\n    }\n\n    // Revoke refresh token if it exists\n    if (session?.auth?.refreshToken) {\n      try {\n        await this.revokeToken(session.auth.refreshToken);\n      } catch (error) {\n        this.logger.error('Failed to revoke refresh token', error);\n      }\n    }\n\n    // Get OAuth logout URL\n    const logoutUrl = new URL(config.end_session_endpoint);\n    logoutUrl.searchParams.append('client_id', this.getConfigValue('clientId'));\n\n    // Add returnTo parameter if configured\n    const returnTo = this.getConfigValue('logoutUrl');\n\n    if (returnTo) {\n      logoutUrl.searchParams.append('returnTo', returnTo);\n    }\n\n    // Clear session\n    await updateSession(event, () => ({\n      auth: { isAuthenticated: false },\n      user: null,\n    }));\n\n    return logoutUrl.toString();\n  }\n\n  /**\n   * Fetch OpenID Configuration from the well-known endpoint\n   */\n  private async getOpenIDConfiguration(): Promise<OpenIDConfiguration> {\n    const now = Date.now();\n\n    // Return cached config if it's still valid\n    if (\n      this.openIDConfigCache &&\n      this.configLastFetched &&\n      now - this.configLastFetched < this.CONFIG_CACHE_TTL\n    ) {\n      return this.openIDConfigCache;\n    }\n\n    const issuer = this.getConfigValue('issuer');\n    // Enforce https on the issuer itself: over TLS the discovery document and\n    // every subsequent token/userinfo call are authenticated, so a network\n    // attacker cannot forge the endpoints the client trusts. Only a localhost\n    // dev issuer may use http; a production https issuer then forces https on\n    // every advertised endpoint too.\n    const issuerUrl = assertSecureUrl(issuer, 'OAuth issuer', true);\n    const allowInsecureLocalhost =\n      issuerUrl.protocol === 'http:' && isLocalDevHost(issuerUrl.hostname);\n\n    let config: OpenIDConfiguration;\n    try {\n      const response = await fetch(\n        `${normalizeIssuer(issuer)}/.well-known/openid-configuration`,\n        {\n          // Reject redirects: a network attacker could otherwise redirect\n          // discovery to an attacker-controlled https endpoint that still\n          // passes validation.\n          redirect: 'error',\n          signal: AbortSignal.timeout(\n            this.getConfigValue('discoveryTimeoutMs', 10000) as number\n          ),\n        }\n      );\n\n      if (!response.ok) {\n        throw new Error(\n          `Failed to fetch OpenID configuration: ${response.statusText}`\n        );\n      }\n\n      config = await response.json();\n    } catch (error) {\n      this.logger.error('Error fetching OpenID configuration', error);\n      throw createError({\n        statusCode: 500,\n        message: 'Failed to fetch OpenID configuration',\n      });\n    }\n\n    this.assertTrustedOpenIDConfiguration(\n      config,\n      issuer,\n      allowInsecureLocalhost\n    );\n\n    this.openIDConfigCache = config;\n    this.configLastFetched = now;\n\n    return config;\n  }\n\n  /**\n   * Validate a fetched OpenID configuration before trusting its endpoints:\n   * the document's `issuer` must match the configured issuer (OIDC Discovery\n   * §4.3), and every advertised endpoint we use must be https (localhost aside).\n   */\n  private assertTrustedOpenIDConfiguration(\n    config: OpenIDConfiguration,\n    issuer: string,\n    allowInsecureLocalhost: boolean\n  ): void {\n    if (\n      typeof config.issuer !== 'string' ||\n      normalizeIssuer(config.issuer) !== normalizeIssuer(issuer)\n    ) {\n      this.logger.error('OpenID configuration issuer mismatch', {\n        expected: issuer,\n        received: config.issuer,\n      });\n      throw createError({\n        statusCode: 500,\n        message:\n          'OpenID configuration issuer does not match the configured issuer',\n      });\n    }\n\n    const endpointKeys = [\n      'authorization_endpoint',\n      'token_endpoint',\n      'userinfo_endpoint',\n      'end_session_endpoint',\n      'revocation_endpoint',\n    ] as const;\n\n    for (const key of endpointKeys) {\n      const endpoint = config[key];\n      if (typeof endpoint !== 'string' || endpoint.length === 0) {\n        throw createError({\n          statusCode: 500,\n          message: `OpenID configuration is missing ${key}`,\n        });\n      }\n      assertSecureUrl(endpoint, `OpenID ${key}`, allowInsecureLocalhost);\n    }\n  }\n}\n\n// OpenID Configuration interface\ninterface OpenIDConfiguration {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint: string;\n  end_session_endpoint: string;\n  revocation_endpoint: string;\n  jwks_uri?: string;\n}\n","import { H3Event } from 'h3';\nimport { inject } from '@analog-tools/inject';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { AuthRoute } from '../types/auth.types';\nimport { LoggerService } from '@analog-tools/logger';\n\n/**\n * Example of a route that checks if the user is authenticated\n * The authentication middleware will automatically handle token refresh if needed\n */\nconst route: AuthRoute = {\n  path: 'authenticated',\n  handler: async (event: H3Event) => {\n    const authService = inject(OAuthAuthenticationService);\n    const logger = inject(LoggerService).forContext('AuthMiddleware');\n\n    const result = { authenticated: await authService.isAuthenticated(event) };\n\n    logger.info('User authentication status checked', result);\n\n    return result;\n  },\n};\n\nexport default route;\n","const SAME_ORIGIN_BASE_URL = 'http://analog-tools.local';\n\nfunction containsControlCharacter(value: string): boolean {\n  for (const character of value) {\n    const characterCode = character.charCodeAt(0);\n\n    if (characterCode <= 0x1f || characterCode === 0x7f) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nexport function sanitizeRedirectUrl(redirectUrl: unknown): string {\n  if (typeof redirectUrl !== 'string') {\n    return '/';\n  }\n\n  const normalizedRedirectUrl = redirectUrl.trim();\n\n  if (\n    normalizedRedirectUrl === '' ||\n    !normalizedRedirectUrl.startsWith('/') ||\n    normalizedRedirectUrl.startsWith('//') ||\n    normalizedRedirectUrl.includes('\\\\') ||\n    containsControlCharacter(normalizedRedirectUrl)\n  ) {\n    return '/';\n  }\n\n  try {\n    const parsedUrl = new URL(normalizedRedirectUrl, SAME_ORIGIN_BASE_URL);\n\n    if (parsedUrl.origin !== SAME_ORIGIN_BASE_URL) {\n      return '/';\n    }\n\n    const safeRedirectUrl = `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;\n\n    return safeRedirectUrl.startsWith('//') ? '/' : safeRedirectUrl;\n  } catch {\n    return '/';\n  }\n}\n","import { createError, getQuery, H3Event, sendRedirect } from 'h3';\nimport { AuthRoute } from '../types/auth.types';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { AuthSessionData } from '../types/auth-session.types';\nimport { inject } from '@analog-tools/inject';\nimport { getSession, updateSession } from '@analog-tools/session';\nimport { sanitizeRedirectUrl } from '../utils/sanitizeRedirectUrl';\n\n/**\n * Handles the OAuth callback from the authentication provider.\n * This route is responsible for processing the authorization code\n * and exchanging it for an access token.\n *\n * @param event - The H3 event object containing request and response data.\n * @returns A redirect to the application or an error if the state is invalid.\n */\n/**\n * Reads the sanitized redirectUrl from session and clears it, so a stale\n * value can't be reused by a later hit to this route.\n *\n * `updateSession` merges the updater's return value over the current\n * session data (`{ ...currentData, ...updates }`), so simply omitting the\n * key (e.g. via `delete`) does not clear it - the field must be explicitly\n * set to `undefined` to override the spread.\n */\nasync function resolveAndClearRedirect(event: H3Event): Promise<string> {\n  const currentSessionData = getSession<AuthSessionData>(event);\n  const redirectUrl = sanitizeRedirectUrl(currentSessionData?.redirectUrl);\n\n  await updateSession<AuthSessionData>(event, (data) => ({\n    ...data,\n    redirectUrl: undefined,\n  }));\n\n  return redirectUrl;\n}\n\nconst route: AuthRoute = {\n  path: 'callback',\n  handler: async (event: H3Event) => {\n    const authService = inject(OAuthAuthenticationService);\n\n    // Initialize session\n    await authService.initSession(event);\n\n    if (await authService.isAuthenticated(event)) {\n      const redirectUrl = await resolveAndClearRedirect(event);\n      return sendRedirect(event, redirectUrl);\n    }\n\n    // Get code and state from query parameters\n    const query = getQuery(event);\n    const code = query['code'] as string;\n    const state = query['state'] as string;\n\n    // Verify state parameter with proper null checks and error handling\n    const sessionData = getSession<AuthSessionData>(event);\n    const sessionState = sessionData?.state;\n\n    if (!state || !sessionState || state !== sessionState) {\n      throw createError({\n        statusCode: 400,\n        message:\n          'Invalid or missing state parameter. Authentication flow may have been tampered with.',\n        statusMessage: 'Authorization Failed',\n      });\n    }\n\n    // Clear state from session\n    await updateSession<AuthSessionData>(event, (data) => ({\n      ...data,\n      state: undefined,\n    }));\n\n    // Handle callback\n    await authService.handleCallback(event, code, state);\n\n    // Get redirect URL from session (or default) and clear it\n    const redirectUrl = await resolveAndClearRedirect(event);\n\n    // Redirect to application\n    return sendRedirect(event, redirectUrl);\n  },\n};\n\nexport default route;\n","const webCrypto = globalThis.crypto;\nconst subtle = webCrypto.subtle;\nconst randomUUID = () => {\n  return webCrypto.randomUUID();\n};\nconst getRandomValues = (array) => {\n  return webCrypto.getRandomValues(array);\n};\nconst _crypto = {\n  randomUUID,\n  getRandomValues,\n  subtle\n};\n\nexport { _crypto as default, getRandomValues, randomUUID, subtle };\n","import { getQuery, H3Event, sendRedirect } from 'h3';\nimport { randomUUID } from 'uncrypto';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { AuthSessionData } from '../types/auth-session.types';\nimport { AuthRoute } from '../types/auth.types';\nimport { inject } from '@analog-tools/inject';\nimport { updateSession } from '@analog-tools/session';\nimport { sanitizeRedirectUrl } from '../utils/sanitizeRedirectUrl';\nimport { deriveCodeChallenge, generateCodeVerifier } from '../utils/pkce';\n\nconst route: AuthRoute = {\n  path: 'login',\n  handler: async (event: H3Event) => {\n    const authService = inject(OAuthAuthenticationService);\n\n    // Initialize session\n    await authService.initSession(event);\n\n    // Generate CSRF state, PKCE verifier/challenge, and an OIDC nonce.\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await deriveCodeChallenge(codeVerifier);\n\n    // Persist the values the callback needs to verify the response.\n    await updateSession<AuthSessionData>(event, (currentSession) => ({\n      ...currentSession,\n      state,\n      nonce,\n      codeVerifier,\n    }));\n\n    // Get redirect URL from query parameters\n    const query = getQuery(event);\n    const redirectUri = query['redirect_uri'] as string;\n\n    const sanitizedTargetPath = redirectUri\n      ? sanitizeRedirectUrl(redirectUri)\n      : '/';\n\n    await updateSession<AuthSessionData>(event, (currentSession) => ({\n      ...currentSession,\n      redirectUrl:\n        sanitizedTargetPath !== '/' ? sanitizedTargetPath : undefined,\n    }));\n\n    // Get authorization URL\n    const authUrl = await authService.getAuthorizationUrl({\n      state,\n      codeChallenge,\n      nonce,\n    });\n\n    // Redirect to OAuth provider\n    return sendRedirect(event, authUrl);\n  },\n};\n\nexport default route;\n","import { createError, H3Event, sendRedirect } from 'h3';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { AuthRoute } from '../types/auth.types';\nimport { LoggerService } from '@analog-tools/logger';\nimport { inject } from '@analog-tools/inject';\n\nconst route: AuthRoute = {\n  path: 'logout',\n  handler: async (event: H3Event) => {\n    const logger = inject(LoggerService).forContext('LogoutRoute');\n\n    try {\n      const authService = inject(OAuthAuthenticationService);\n\n      // Initialize session\n      await authService.initSession(event);\n\n      // Get logout URL using updated auth service method (which now uses sessionHandler)\n      const logoutUrl = await authService.logout(event);\n\n      // The sessionHandler is already cleared in the logout method\n      // No need to manually destroy it here\n\n      return sendRedirect(event, logoutUrl);\n    } catch (error) {\n      logger.error('Logout failed', error);\n      throw createError({\n        statusCode: 500,\n        message: 'Logout failed',\n      });\n    }\n  },\n};\n\nexport default route;\n","import { H3Event } from 'h3';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { AuthRoute } from '../types/auth.types';\nimport { inject } from '@analog-tools/inject';\n\nconst route: AuthRoute = {\n  path: 'protected-data',\n  handler: async (event: H3Event) => {\n    const authService = inject(OAuthAuthenticationService);\n\n    // The middleware has already verified authentication and refreshed tokens if needed\n    // Now we can get the authenticated user\n    const user = await authService.getAuthenticatedUser(event);\n\n    return {\n      message: 'This is protected data that requires authentication',\n      user,\n    };\n  },\n};\n\nexport default route;\n","/**\n * Constant-time string comparison that leaks neither length nor content through\n * timing.\n *\n * Both inputs are HMAC'd under a fresh random per-call key, so the comparison\n * runs over two fixed-length (32-byte) digests without an early return, and an\n * attacker cannot precompute or correlate the digests across calls. Use this for\n * comparing secrets (e.g. API keys) instead of `===`, which short-circuits on\n * the first differing byte.\n */\nexport async function timingSafeEqual(a: string, b: string): Promise<boolean> {\n  const encoder = new TextEncoder();\n  const keyBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));\n  const key = await globalThis.crypto.subtle.importKey(\n    'raw',\n    keyBytes,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n\n  const digestA = new Uint8Array(\n    await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(a))\n  );\n  const digestB = new Uint8Array(\n    await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(b))\n  );\n\n  let diff = 0;\n  for (let i = 0; i < digestA.length; i++) {\n    diff |= digestA[i] ^ digestB[i];\n  }\n  return diff === 0;\n}\n","import { getRequestHeaders, createError, H3Event } from 'h3';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { AuthRoute } from '../types/auth.types';\nimport { inject } from '@analog-tools/inject';\nimport { LoggerService } from '@analog-tools/logger';\nimport { timingSafeEqual } from '../utils/timing-safe-equal';\n\nconst route: AuthRoute = {\n  path: 'refresh-tokens',\n  handler: async (event: H3Event) => {\n    const logger = inject(LoggerService).forContext('TokenRefresh');\n    const authService = inject(OAuthAuthenticationService);\n    \n    // Verify authorization - use tokenRefreshApiKey from config or fall back to env variable\n    const apiKey = authService.getConfig().tokenRefreshApiKey;\n    if (!apiKey) {\n      logger.error('Token refresh API key not configured in either AnalogAuthConfig.tokenRefreshApiKey or TOKEN_REFRESH_API_KEY env variable');\n      throw createError({\n        statusCode: 500,\n        message: 'Server configuration error',\n      });\n    }\n\n    const authHeader = getRequestHeaders(event).authorization;\n    if (!authHeader || !(await timingSafeEqual(authHeader, `Bearer ${apiKey}`))) {\n      logger.warn('Unauthorized token refresh attempt');\n      throw createError({\n        statusCode: 401,\n        message: 'Unauthorized',\n      });\n    }\n\n    try {\n      \n      const result = await authService.refreshExpiringTokens();\n\n      // Log the results\n      logger.info(`Token refresh job completed`, {\n        refreshed: result.refreshed,\n        failed: result.failed,\n        total: result.total,\n      });\n\n      return {\n        success: true,\n        ...result,\n      };\n    } catch (error) {\n      logger.error('Error in token refresh job', error);\n      throw createError({\n        statusCode: 500,\n        message: 'Failed to refresh tokens',\n      });\n    }\n  },\n};\n\nexport default route;\n","import { createError, H3Event } from 'h3';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { AuthRoute } from '../types/auth.types';\nimport { inject } from '@analog-tools/inject';\n\nconst route: AuthRoute = {\n  path: 'user',\n  handler: async (event: H3Event) => {\n    const authService = inject(OAuthAuthenticationService);\n\n    // Initialize session\n    await authService.initSession(event);\n\n    // Check if user is authenticated\n    if (!(await authService.isAuthenticated(event))) {\n      throw createError({\n        statusCode: 401,\n        message: 'Unauthorized',\n      });\n    }\n\n    // Get authenticated user\n    return authService.getAuthenticatedUser(event);\n  },\n};\n\nexport default route;\n","import authenticated from '../routes/authenticated';\nimport callback from '../routes/callback';\nimport login from '../routes/login';\nimport logout from '../routes/logout';\nimport protectedData from '../routes/protected-data';\nimport refreshTokens from '../routes/refresh-tokens';\nimport user from '../routes/user';\n\n/**\n * Registers all authentication routes dynamically\n * @returns A record of route paths mapped to their handler functions\n */\nexport function registerRoutes() {\n  return { \n    [authenticated.path]: authenticated.handler,\n    [callback.path]: callback.handler,\n    [login.path]: login.handler,\n    [logout.path]: logout.handler,\n    [protectedData.path]: protectedData.handler,\n    [refreshTokens.path]: refreshTokens.handler,\n    [user.path]: user.handler\n  };\n}","export function getLastPathSegment(path: string): string {\n    // Erstellen Sie ein URL-Objekt, um den Pfad zu analysieren\n    const url = new URL(path, 'http://dummy-base'); // Basis-URL erforderlich für relative Pfade\n\n    // Extrahieren Sie den Pfadnamen und teilen Sie ihn in Segmente\n    const segments = url.pathname.split('/').filter(Boolean);\n\n    // Geben Sie den letzten Pfadabschnitt zurück\n    return segments.pop() ?? '';\n}\n","import { createError, H3Event } from 'h3';\nimport { registerRoutes } from './registerRoutes';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { getLastPathSegment } from '../utils/getLastPathSegment';\nimport { inject } from '@analog-tools/inject';\n\nexport async function handleAuthRoute(event: H3Event) {\n  if (event.path.includes('/api/auth/')) {\n    const path = getLastPathSegment(event.path);\n\n    if (!path) {\n      throw createError({\n        statusCode: 400,\n        statusMessage: 'Missing path parameter',\n      });\n    }\n\n    const authService = inject(OAuthAuthenticationService);\n    await authService.initSession(event);\n\n    // Check if the requested path exists in our routes\n    const routes = registerRoutes();\n\n    if (routes[path]) {\n      return routes[path](event);\n    }\n\n    // If route doesn't exist, return a 404 error handler\n\n    throw createError({\n      statusCode: 404,\n      statusMessage: `Authentication route '${path}' not found`,\n    });\n  }\n}\n","import { H3Event } from 'h3';\nimport { inject } from '@analog-tools/inject';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\n\nexport async function checkAuthentication(event: H3Event) {\n  const authService = inject(OAuthAuthenticationService);\n\n  await authService.initSession(event);\n  // Check authentication with token refresh capability\n  return authService.isAuthenticated(event);\n}\n","import { getHeader, getRequestURL, H3Event, sendRedirect } from 'h3';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { LoggerService } from '@analog-tools/logger';\nimport { inject } from '@analog-tools/inject';\nimport { TRPCError } from '@trpc/server';\nimport { checkAuthentication } from './checkAuthentication';\nimport { updateSession } from '@analog-tools/session';\nimport { sanitizeRedirectUrl } from '../utils/sanitizeRedirectUrl';\n\nexport async function useAnalogAuthMiddleware(event: H3Event) {\n  const requestUrl = getRequestURL(event);\n  const pathname = requestUrl.pathname;\n  const authService = inject(OAuthAuthenticationService);\n  const logger = inject(LoggerService).forContext('AuthMiddleware');\n\n  logger.info('Processing authentication middleware', pathname);\n\n  // All /api/auth/* routes are handled by handleAuthRoute.\n  if (pathname.startsWith('/api/auth/')) {\n    return;\n  }\n\n  // tRPC procedures enforce their own auth per-procedure, so the HTTP gate lets\n  // the tRPC endpoint through. Match it on a path boundary — a bare `startsWith`\n  // would also exempt unrelated routes like `/api/trpc-admin`.\n  if (\n    authService.isUnprotectedRoute(pathname) ||\n    pathname === '/api/trpc' ||\n    pathname.startsWith('/api/trpc/')\n  ) {\n    return;\n  }\n\n  await authService.initSession(event);\n  if (await checkAuthentication(event)) {\n    return;\n  }\n\n  // Not authenticated: API calls (fetch=true from the HTTP interceptor) receive\n  // a 401 they can handle; browser navigations are sent to the login page.\n  if (getHeader(event, 'fetch') === 'true') {\n    throw new TRPCError({\n      code: 'UNAUTHORIZED',\n      message: 'User is not authenticated',\n    });\n  }\n\n  logger.debug('Redirecting to login page', { path: pathname });\n  await updateSession(event, (currentSession: Record<string, unknown>) => ({\n    ...currentSession,\n    redirectUrl: sanitizeRedirectUrl(`${requestUrl.pathname}${requestUrl.search}`),\n  }));\n  await sendRedirect(event, '/api/auth/login');\n}\n","import { H3Event } from 'h3';\nimport type { AnalogAuthConfig } from '../types/auth.types';\nimport { OAuthAuthenticationService } from '../services/oauth-authentication.service';\nimport { handleAuthRoute } from './handleAuthRoute';\nimport { useAnalogAuthMiddleware } from './useAnalogAuthMiddleware';\nimport { registerService } from '@analog-tools/inject';\n\n/**\n * Configures and initializes the OAuth authentication service\n *\n * @param config The OAuth authentication configuration\n * @param event The H3 event object\n * @throws Error if any mandatory configuration values are missing\n */\nexport async function useAnalogAuth(config: AnalogAuthConfig, event: H3Event) {\n  // Validate mandatory configuration values\n  const mandatoryFields: Array<keyof AnalogAuthConfig> = [\n    'issuer',\n    'clientId',\n    'clientSecret',\n    'callbackUri',\n  ];\n\n  const missingFields = mandatoryFields.filter((field) => !config[field]);\n\n  if (missingFields.length > 0) {\n    throw new Error(\n      `AnalogAuth initialization failed: Missing mandatory configuration values: ${missingFields.join(\n        ', '\n      )}`\n    );\n  }\n\n  // Initialize the authentication service with validated config\n  registerService(OAuthAuthenticationService, config);\n\n  await useAnalogAuthMiddleware(event);\n\n  return handleAuthRoute(event);\n}\n"],"x_google_ignoreList":[3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,30],"mappings":"oJAEA,IAAI,EAAoB,SAAS,EAAG,CACnC,MAAO,GAAE,QAAU,WAAY,EAAE,UAAY,WAAY,EAAE,aAAe,gBAAiB,EAAE,UAAY,YAAa,EAAE,YAAc,WAAY,EAAE,eAAiB,gBAAiB,EAAE,UAAY,WAAY,EAAE,YAAc,WAAY,EAAE,aAAe,gBAAiB,EAAE,YAAc,YAAa,EAAE,cAAgB,WAAY,EAAE,eAAiB,gBAAiB,EAAE,YAAc,WAAY,EAAE,gBAAkB,WAAY,EAAE,WAAa,iBAAkB,EAAE,cAAgB,YAAa,EAAE,kBAAoB,WAAY,EAAE,aAAe,iBAAkB,EAAE,QAAU,WAAY,EAAE,QAAU,WAAY,EAAE,YAAc,gBAAiB,EAAE,UAAY,YAAa,EAAE,UAAY,WAAY,EAAE,cAAgB,gBAAiB,EAAE,eAAiB,WAAY,EAAE,YAAc,gBAAiB,EAAE,WAAa,gBAAiB,EAAE,iBAAmB,YAAa,EAAE,cAAgB,gBAAiB,EAAE,aAAe,gBAAiB,EAAE,YAAc,iBAAkB,EAAE,gBAAkB,iBAAkB,EAAE,YAAc,iBAAkB,EAAE,cAAgB,iBAAkB,EAAE,kBAAoB,iBAAkB,EAAE,cAAgB,iBAAkB,EAAE,WAAa,WAAY,EAAE,UAAY,WAAY,EAAE,aAAe,iBAAkB,EAAE,aAAe,WAAY,EAAE,YAAc,YAAa,EAAE,eAAiB,iBAAkB,EAAE,UAAY,WAAY,EAAE,UAAY,WAAY,EAAE,YAAc,WAAY,EAAE,YAAc,YAAa,EAAE,KAAO,WAAY,EAAE,MAAQ,UAAW,EAAE,KAAO,UAAW,EAAE,IAAM,UAAW,EAAE,UAAY,UAAW,EAAE,MAAQ,UAAW,EAAE,QAAU,UAAW,EAAE,OAAS,UAAW,CACzkD,EAAE,CAAC,CAAC,EAAG,EAAoB,SAAS,EAAG,CACtC,MAAO,GAAE,EAAE,MAAQ,GAAK,QAAS,EAAE,EAAE,MAAQ,GAAK,QAAS,EAAE,EAAE,KAAO,GAAK,OAAQ,EAAE,EAAE,KAAO,GAAK,OAAQ,EAAE,EAAE,MAAQ,GAAK,QAAS,EAAE,EAAE,MAAQ,GAAK,QAAS,EAAE,EAAE,OAAS,GAAK,SAAU,CAC5L,EAAE,CAAC,CAAC,EACJ,SAAS,EAAE,EAAG,CACb,MAAO,CACN,QACA,QACA,OACA,OACA,QACA,QACA,QACD,CAAC,CAAC,SAAS,CAAC,CACb,CAGA,IAAIA,EAAI,MAAM,CAAE,CACf,OACC,KAAK,kBAAoB,EAC1B,CACA,OACC,KAAK,yBAA2B,sBACjC,CACA,OACC,KAAK,sBAAwB,qBAC9B,CACA,OACC,KAAK,oBAAsB,uBAC5B,CACA,OACC,KAAK,mBAAqC,IAAI,GAC/C,CACA,OACC,KAAK,eAAiB,GACvB,CACA,OAAO,YAAY,EAAG,EAAG,EAAG,EAAG,CAC9B,GAAI,CAAC,EAAE,MAAO,OAAO,KACrB,IAAI,EAAI,EAAE,MAAM,MAAM;CAAI,CAAC,CAAC,IAAM,GAClC,MAAO,GAAG,EAAE,KAAK,GAAG,EAAE,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GACjD,CACA,OAAO,WAAW,EAAG,EAAG,CACvB,GAAI,KAAK,mBAAmB,MAAQ,KAAK,eAAgB,CACxD,IAAI,EAAI,KAAK,mBAAmB,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,MAC9C,GAAK,KAAK,mBAAmB,OAAO,CAAC,CACtC,CACA,KAAK,mBAAmB,IAAI,EAAG,CAAC,CACjC,CACA,OAAO,UAAU,EAAG,EAAI,CAAC,EAAG,CAC3B,GAAI,CAAE,aAAc,EAAI,CAAC,EAAG,SAAU,EAAI,EAAE,kBAAmB,qBAAsB,EAAI,CAAC,GAAM,EAChG,GAAI,aAAa,MAAO,CACvB,IAAI,EAAI,KAAK,YAAY,EAAG,EAAG,EAAG,CAAC,EACnC,GAAI,EAAG,CACN,IAAI,EAAI,KAAK,mBAAmB,IAAI,CAAC,EACrC,GAAI,EAAG,OAAO,CACf,CACA,IAAI,EAAI,KAAK,eAAe,EAAG,EAAG,EAAG,EAAmB,IAAI,OAAS,EACrE,OAAO,GAAK,KAAK,WAAW,EAAG,CAAC,EAAG,CACpC,CACA,GAAI,OAAO,GAAK,SAAU,OAAO,EACjC,IAAI,EAAI,KAAK,cAAc,EAAG,EAAmB,IAAI,OAAS,EAC9D,GAAI,OAAO,GAAK,SAAU,OAAO,EACjC,GAAI,CACH,OAAO,KAAK,UAAU,EAAG,KAAM,CAAC,CACjC,MAAQ,CACP,OAAO,OAAO,CAAC,CAChB,CACD,CACA,OAAO,eAAe,EAAG,EAAG,EAAG,EAAG,EAAoB,IAAI,QAAW,CACpE,GAAI,EAAE,IAAI,CAAC,EAAG,MAAO,CACpB,QAAS,EAAE,QACX,KAAM,EAAE,MACP,OAAO,IAAI,UAAU,GAAI,KAAK,wBAChC,EACA,EAAE,IAAI,CAAC,EACP,IAAI,EAAI,CACP,QAAS,EAAE,QACX,KAAM,EAAE,IACT,EACA,OAAO,GAAK,EAAE,QAAU,EAAE,MAAQ,EAAE,OAAQ,UAAW,GAAK,EAAE,QAAU,IAAK,KAAM,EAAE,iBAAiB,MAAQ,EAAE,MAAQ,KAAK,eAAe,EAAE,MAAO,EAAG,EAAI,EAAG,EAAG,CAAC,EAAI,EAAE,MAAQ,KAAK,cAAc,EAAE,MAAO,EAAI,EAAG,CAAC,GAAI,OAAO,KAAK,CAAC,CAAC,CAAC,QAAS,GAAM,CACtP,GAAI,EAAE,KAAK,GAAI,GAAI,CAClB,IAAI,EAAI,EACR,EAAE,GAAK,KAAK,cAAc,EAAE,GAAI,EAAI,EAAG,CAAC,CACzC,MAAQ,CACP,EAAE,GAAK,KAAK,mBACb,CACD,CAAC,EAAG,GAAK,OAAO,oBAAoB,CAAC,CAAC,CAAC,QAAS,GAAM,CACrD,GAAI,EAAE,KAAK,IAAM,IAAM,SAAW,IAAM,WAAa,IAAM,OAAQ,GAAI,CACtE,IAAI,EAAI,OAAO,yBAAyB,EAAG,CAAC,EAC5C,GAAI,GAAK,EAAE,aAAe,CAAC,EAAG,CAC7B,IAAI,EAAI,EACR,EAAE,GAAK,KAAK,cAAc,EAAE,GAAI,EAAI,EAAG,CAAC,CACzC,CACD,MAAQ,CACP,EAAE,GAAK,KAAK,mBACb,CACD,CAAC,EAAG,CACL,CACA,OAAO,cAAc,EAAG,EAAG,EAAoB,IAAI,QAAW,CAC7D,GAAI,GAAK,EAAG,OAAO,KAAK,sBACxB,GAAI,OAAO,GAAK,UAAY,CAAC,EAAG,OAAO,EACvC,GAAI,EAAE,IAAI,CAAC,EAAG,OAAO,KAAK,yBAC1B,EAAE,IAAI,CAAC,EACP,GAAI,CACH,GAAI,MAAM,QAAQ,CAAC,EAAG,CACrB,IAAI,EAAI,EAAE,IAAK,GAAM,KAAK,cAAc,EAAG,EAAI,EAAG,CAAC,CAAC,EACpD,OAAO,EAAE,OAAO,CAAC,EAAG,CACrB,CACA,IAAI,EAAI,CAAC,EACT,IAAK,GAAI,CAAC,EAAG,KAAM,OAAO,QAAQ,CAAC,EAAG,GAAI,CACzC,EAAE,GAAK,KAAK,cAAc,EAAG,EAAI,EAAG,CAAC,CACtC,MAAQ,CACP,EAAE,GAAK,KAAK,mBACb,CACA,OAAO,EAAE,OAAO,CAAC,EAAG,CACrB,MAAQ,CACP,OAAO,EAAE,OAAO,CAAC,EAAG,KAAK,mBAC1B,CACD,CACD,EAAGC,EAAI,CACN,UAAW,CACV,MAAO,EAAE,YACT,KAAM,CAAC,CACR,EACA,OAAQ,CAAE,MAAO,EAAE,OAAQ,EAC3B,UAAW,CACV,MAAO,EAAE,YACT,KAAM,CAAC,CACR,EACA,QAAS,CAAE,MAAO,EAAE,WAAY,EAChC,QAAS,CAAE,MAAO,EAAE,eAAgB,EACpC,MAAO,CAAE,MAAO,EAAE,OAAQ,EAC1B,KAAM,CAAE,MAAO,EAAE,SAAU,EAC3B,MAAO,CAAE,MAAO,EAAE,SAAU,CAC7B,EAAGC,EAAI,CACN,QAAS,IACT,QAAS,KACT,MAAO,IACP,KAAM,KACN,MAAO,IACR,EAAGC,EAAI,CACN,MAAO,EAAE,UACT,MAAO,EAAE,KACT,KAAM,EAAE,YACR,KAAM,EAAE,gBACR,MAAO,EAAE,QACT,MAAO,EAAE,QACT,OAAQ,EAAE,KACX,EAAGC,EAAI,KAAM,CACZ,aAAa,EAAG,EAAI,OAAQ,EAAG,CAC9B,OAAO,KAAK,WAAW,EAAG,EAAG,CAAC,CAC/B,CACA,OACC,KAAK,WAAa,CAAC,CACpB,CACA,YAAY,EAAI,CAAC,EAAG,CACnB,KAAK,WAA6B,IAAI,IACtC,IAAI,EAAA,QAAA,IAAA,WAA6B,QAAU,QAAQ,IAAI,SAAW,OAClE,KAAK,UAAY,EAAE,YAAc,IAAK,GAAI,CAAC,EAAI,EAAE,UAAW,KAAK,aAAe,CAC/E,GAAGH,EACH,GAAG,EAAE,MACN,EAAG,KAAK,YAAc,CACrB,GAAGC,EACH,GAAG,EAAE,KACN,CACD,CACA,aAAa,EAAG,CACf,KAAK,UAAY,CAClB,CACA,cAAe,CACd,OAAO,KAAK,SACb,CACA,kBAAkB,EAAG,EAAG,CACvB,KAAK,aAAe,CACnB,GAAG,KAAK,aACR,GAAG,CACJ,EAAG,KAAK,YAAc,CACrB,GAAG,KAAK,YACR,GAAG,CACJ,CACD,CACA,cAAc,EAAG,EAAG,EAAG,EAAG,EAAG,CAC5B,IAAI,EAAI,EAAI,IAAI,EAAE,GAAG,EAAE,GAAK,IAAI,EAAE,GAClC,GAAI,KAAK,UAAW,CACnB,IAAI,EAAI,KAAK,iBAAiB,CAAC,EAC/B,OAAO,IAAM,EAAI,GAAI,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,OACxC,MAAO,MAAO,GAAG,EAAE,GAAG,GACvB,CACA,0BAA0B,EAAG,EAAG,EAAG,EAAG,EAAG,CACxC,IAAI,EAAI,EAAG,EAAI,KAAK,iBAAiB,CAAC,EACtC,GAAI,GAAG,MAAO,CACb,IAAI,EAAI,KAAK,WAAW,EAAE,MAAO,EAAG,CAAC,EACrC,IAAM,EAAI,EACX,CACA,OAAO,GAAG,OAAS,EAAI,GAAG,KAAK,YAAY,EAAE,KAAM,EAAG,CAAC,EAAE,GAAG,KAAM,KAAK,cAAc,EAAG,EAAG,EAAG,EAAG,CAAC,CACnG,CACA,uBAAuB,EAAG,EAAI,CAAC,EAAG,CACjC,GAAI,GAAK,OAAO,GAAK,UAAY,CAAC,MAAM,QAAQ,CAAC,IAAM,UAAW,GAAK,SAAU,GAAI,MAAO,CAC3F,SAAU,EACV,SAAU,CACX,EACA,IAAI,EAAI,IAAM,IAAK,GAAI,EAAI,CAAC,EAAG,GAAG,CAAC,EACnC,GAAI,EAAE,OAAS,EAAG,CACjB,IAAI,EAAI,EAAE,EAAE,OAAS,GACrB,GAAI,GAAK,OAAO,GAAK,UAAY,CAAC,MAAM,QAAQ,CAAC,IAAM,UAAW,GAAK,SAAU,GAAI,MAAO,CAC3F,SAAU,EACV,SAAU,EAAE,MAAM,EAAG,EAAE,CACxB,CACD,CACA,MAAO,CACN,SAAU,IAAK,GACf,SAAU,CACX,CACD,CACA,iBAAiB,EAAG,CACnB,IAAI,EAAIC,EAAE,EAAE,IACZ,OAAO,IAAM,EAAE,MAAQ,GAAG,EAAE,OAAO,IAAM,GAAK,EAAE,KACjD,CACA,WAAW,EAAG,EAAG,EAAG,CACnB,IAAI,EAAI,KAAK,mBAAmB,CAAC,EACjC,GAAI,IAAM,IAAK,GAAG,OAAO,EACzB,GAAI,OAAO,GAAK,SAAU,CACzB,IAAI,EAAI,KAAK,sBAAsB,EAAG,EAAG,CAAC,EAC1C,OAAO,KAAK,cAAc,EAAG,CAAC,EAAG,CAClC,CACA,GAAI,OAAO,GAAK,UAAY,UAAW,EAAG,CACzC,GAAI,CAAC,KAAK,aAAa,EAAE,KAAK,EAAG,CAChC,KAAK,cAAc,EAAG,IAAK,EAAC,EAAG,KAAK,WAAW,wEAAyE,EAAG,CAAC,EAC5H,MACD,CACA,IAAI,EAAI,KAAK,mBAAmB,CAAC,EACjC,OAAO,KAAK,cAAc,EAAG,CAAC,EAAG,CAClC,CACA,KAAK,cAAc,EAAG,IAAK,EAAC,EAAG,KAAK,WAAW,0GAA2G,EAAG,CAAC,CAC/J,CACA,aAAa,EAAG,CACf,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CACnC,CACA,YAAY,EAAG,CACd,OAAO,KAAK,YAAY,CAAC,CAC1B,CACA,mBAAmB,EAAG,CACrB,OAAO,KAAK,WAAW,IAAI,CAAC,EAAI,KAAK,WAAW,IAAI,CAAC,EAAI,IAAK,EAC/D,CACA,cAAc,EAAG,EAAG,CACnB,KAAK,WAAW,IAAI,EAAG,CAAC,CACzB,CACA,WAAW,EAAG,EAAG,EAAG,CACnB,IAAI,EAAI,EAAI,GAAG,EAAE,GAAG,IAAM,EAC1B,QAAQ,KAAK,IAAI,EAAE,IAAI,GAAG,CAC3B,CACA,mBAAmB,EAAG,CACrB,IAAI,EAAI,EAAE,MAAM,SAAS,EACzB,OAAO,EAAE,OAAS,GAAK,EAAE,MAAO,EAAE,YAAc,GAAK,EAAE,WAAY,CACpE,CACA,sBAAsB,EAAG,EAAG,EAAG,CAC9B,GAAI,KAAK,WAAW,IAAI,CAAC,EAAG,OAAO,KAAK,WAAW,IAAI,CAAC,EACxD,IAAI,EAAI,KAAK,aAAa,GAC1B,GAAI,EAAG,CACN,IAAI,EAAI,EAAE,MAAM,SAAS,EACzB,OAAO,EAAE,OAAS,GAAK,EAAE,MAAO,EAAE,YAAc,GAAK,EAAE,WAAY,KAAK,WAAW,IAAI,EAAG,CAAC,EAAG,CAC/F,CACA,IAAI,EAAI,EAAI,GAAG,EAAE,GAAG,IAAM,EAC1B,QAAQ,KAAK,IAAI,EAAE,4BAA4B,EAAE,2BAA2B,EAAG,KAAK,WAAW,IAAI,EAAG,IAAK,EAAC,CAC7G,CACA,eAAgB,CACf,OAAO,KAAK,UACb,CACA,YAAY,EAAG,EAAG,EAAG,CACpB,GAAI,KAAK,YAAY,CAAC,EAAG,OAAO,EAChC,IAAI,EAAI,CACP,UACA,UACA,QACA,OACA,OACD,EAAG,EAAI,EAAE,KAAM,GAAM,IAAM,CAAC,EAC5B,OAAO,GAAK,KAAK,YAAY,GAAK,KAAK,YAAY,IAAM,EAAE,SAAS,CAAC,EAAI,KAAK,WAAW,iBAAiB,EAAE,iDAAkD,EAAG,CAAC,EAAI,KAAK,WAAW,iBAAiB,EAAE,iDAAkD,EAAG,CAAC,EAAG,EACnQ,CACA,YAAY,EAAG,CACd,MAAwB,ucAAuc,MAAM,GAAG,CAAA,CAAG,SAAS,CAAC,CACtf,CACD,EAAGE,EAAI,cAAc,KAAM,CAC1B,YAAY,EAAG,CACd,MAAM,CAAC,EAAG,KAAK,KAAO,aACvB,CACD,EAIGC,EAAI,CACN,QAAS,CAAC,EACV,SAAU,IACV,gBAAiB,CAAC,CACnB,EAAGC,EAAI,CAAC,EAAE,MAAO,EAAE,KAAK,EAAGC,EAAI,KAAM,CACpC,YAAY,EAAG,EAAG,EAAG,CACpB,KAAK,OAAS,EAAG,KAAK,UAAY,EAAG,KAAK,WAAa,EAAG,KAAK,QAA0B,IAAI,GAC9F,CACA,WAAW,EAAG,EAAG,EAAI,GAAI,CACxB,GAAI,CAAC,KAAK,OAAO,SAAW,KAAK,OAAO,iBAAmBD,EAAE,SAAS,CAAC,EAAG,MAAO,CAAC,EAClF,IAAI,EAAI,KAAK,oBAAoB,EAAG,EAAG,CAAC,EAAG,EAAI,KAAK,QAAQ,IAAI,CAAC,EACjE,OAAO,EAAI,EAAE,QAAU,KAAK,QAAQ,IAAI,EAAG,CAC1C,QAAS,EACT,MAAO,EACP,QAAS,EACT,UAAW,KAAK,IAAI,EACpB,MAAO,CACR,CAAC,EAAG,KAAK,cAAc,EAAG,CAAC,CAC5B,CACA,OAAQ,CACP,GAAI,KAAK,QAAQ,OAAS,EAAG,CAC5B,KAAK,cAAgB,aAAa,KAAK,UAAU,EAAG,IAAK,IACzD,IAAK,IAAI,KAAK,KAAK,QAAQ,OAAO,EAAG,KAAK,cAAc,CAAC,EACzD,KAAK,QAAQ,MAAM,CACpB,CACD,CACA,SAAU,CACT,KAAK,cAAgB,aAAa,KAAK,UAAU,EAAG,IAAK,IAAI,KAAK,QAAQ,MAAM,CACjF,CACA,oBAAoB,EAAG,EAAG,EAAG,CAC5B,MAAO,GAAG,EAAE,GAAG,EAAE,GAAG,GACrB,CACA,eAAgB,CACf,KAAK,aAAe,eAAiB,CACpC,KAAK,MAAM,CACZ,EAAG,KAAK,OAAO,QAAQ,CACxB,CACA,cAAc,EAAG,CAChB,IAAI,EAAI,EAAE,QACV,EAAE,MAAQ,IAAM,EAAI,GAAG,EAAE,KAAK,EAAE,MAAM,IACtC,IAAI,EAAI,KAAK,UAAU,OAAO,CAC7B,MAAO,EAAE,MACT,QAAS,EACT,OAAQ,KAAK,WACb,UAAW,IAAI,KAAK,EAAE,SAAS,EAC/B,QAAS,EAAE,SAAW,IAAK,EAC5B,CAAC,EACD,OAAQ,EAAE,MAAV,CACC,KAAK,EAAE,MACN,QAAQ,MAAM,CAAC,EACf,MACD,KAAK,EAAE,MACN,QAAQ,MAAM,CAAC,EACf,MACD,KAAK,EAAE,KACN,QAAQ,KAAK,CAAC,EACd,MACD,KAAK,EAAE,KACN,QAAQ,KAAK,CAAC,EACd,MACD,KAAK,EAAE,MACN,QAAQ,MAAM,CAAC,EACf,MACD,KAAK,EAAE,MACN,QAAQ,MAAM,CAAC,EACf,KACF,CACD,CACD,EAAGE,EAAI,KAAM,CACZ,YAAY,EAAG,CACd,KAAK,YAAc,CACpB,CACA,OAAO,EAAG,CACT,OAAO,EAAE,QAAU,KAAK,YAAY,0BAA0B,EAAE,MAAO,EAAE,QAAS,EAAE,OAAQ,EAAE,QAAS,EAAE,OAAO,EAAI,KAAK,YAAY,cAAc,EAAE,MAAO,EAAE,QAAS,EAAE,OAAQ,EAAE,OAAO,CAC3L,CACA,iBAAkB,CACjB,MAAO,CAAC,CACT,CACD,EAAGC,EAAI,KAAM,CACZ,YAAY,EAAG,CACd,KAAK,YAAc,GAAG,aAAe,CAAC,CACvC,CACA,OAAO,EAAG,CACT,GAAI,CACH,IAAI,EAAI,CACP,UAAW,EAAE,UAAU,YAAY,EACnC,MAAO,KAAK,aAAa,EAAE,KAAK,EAChC,OAAQ,EAAE,OACV,QAAS,EAAE,OACZ,EACA,OAAO,EAAE,UAAY,EAAE,QAAU,EAAE,SAAU,EAAE,gBAAkB,EAAE,cAAgB,EAAE,eAAgB,EAAE,UAAY,OAAO,KAAK,EAAE,QAAQ,CAAC,CAAC,OAAS,IAAM,EAAE,SAAW,EAAE,UAAW,EAAE,QAAU,EAAE,MAAQV,EAAE,UAAU,EAAE,KAAK,GAAI,KAAK,UAAU,EAAG,KAAM,KAAK,YAAc,EAAI,CAAC,CAClR,OAAS,EAAG,CACX,OAAO,QAAQ,MAAM,wDAAyD,CAC7E,MAAO,EACP,MAAO,CACR,CAAC,EAAG,GAAG,EAAE,MAAM,IAAI,EAAE,OAAO,IAAI,EAAE,QAAQ,oBAC3C,CACD,CACA,iBAAkB,CACjB,MAAO,CAAC,CACT,CACA,aAAa,EAAG,CACf,OAAQ,EAAR,CACC,KAAK,EAAE,MAAO,MAAO,QACrB,KAAK,EAAE,MAAO,MAAO,QACrB,KAAK,EAAE,KAAM,MAAO,OACpB,KAAK,EAAE,KAAM,MAAO,OACpB,KAAK,EAAE,MAAO,MAAO,QACrB,KAAK,EAAE,MAAO,MAAO,QACrB,QAAS,MAAO,MACjB,CACD,CACD,EAAG,GAAI,KAAM,CACZ,YAAY,EAAG,CACd,KAAK,YAAc,CACpB,CACA,OAAO,EAAG,CACT,OAAO,KAAK,YAAY,CAAC,CAC1B,CACA,iBAAkB,CACjB,MAAO,CAAC,CACT,CACD,EAAG,GAAI,KAAM,CACZ,OAAO,cAAc,EAAG,CACvB,OAAO,IAAIS,EAAE,IAAIL,EAAE,CAAE,UAAW,GAAG,SAAU,CAAC,CAAC,CAChD,CACA,OAAO,WAAW,EAAG,CACpB,OAAO,IAAIM,EAAE,CAAC,CACf,CACA,OAAO,aAAa,EAAG,CACtB,OAAO,IAAI,GAAE,CAAC,CACf,CACD,EAAG,GAAI,CACN,QAAS,CAAC,EACV,SAAU,OACV,SAAU,EACX,EAAG,GAAI,CACN,YACA,SACA,UACA,0BACA,iBACA,cACA,UACD,EAAG,GAAI,CACN,CACC,QAAS,yEACT,YAAa,SACd,EACA,CACC,QAAS,6CACT,YAAa,gBACd,EACA,CACC,QAAS,0GACT,YAAa,SACd,EACA,CACC,QAAS,0EACT,YAAa,aACd,EACA,CACC,QAAS,iDACT,YAAa,SACd,EACA,CACC,QAAS,+GACT,YAAa,SACd,EACA,CACC,QAAS,kGACT,YAAa,SACd,EACA,CACC,QAAS,2CACT,YAAa,QACd,EACA,CACC,QAAS,uDACT,YAAa,SACd,EACA,CACC,QAAS,iGACT,YAAa,MACd,EACA,CACC,QAAS,yBACT,YAAa,OACd,CACD,EAGA,SAAS,GAAE,EAAG,CACb,OAAO,EAAE,QAAQ,cAAe,KAAK,CAAC,CAAC,QAAQ,MAAO,KAAK,CAAC,CAAC,QAAQ,wBAAyB,EAAE,CACjG,CACA,SAAS,GAAE,EAAG,EAAG,CAChB,IAAI,EAAI,EACR,IAAK,IAAI,EAAI,EAAG,EAAI,EAAE,OAAQ,IAAK,CAClC,IAAI,EAAI,EAAE,WAAW,CAAC,EACtB,GAAK,GAAK,GAAK,EAAI,EAAG,GAAK,CAC5B,CACA,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,EAAG,CAAC,CAC/C,CACA,SAAS,GAAE,EAAG,EAAG,CAChB,OAAQ,EAAE,SAAV,CACC,IAAK,OAAQ,OAAO,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EACtD,IAAK,SAAU,OAAO,EAAE,QAAQ,EAAE,QAAS,EAAE,EAC7C,IAAK,OAAQ,OAAO,EAAE,QAAQ,EAAE,QAAU,GAAM,SAAS,GAAE,EAAG,EAAE,UAAU,EAAE,EAAE,EAC9E,IAAK,SAAU,OAAO,EAAE,cAAgB,EAAE,QAAQ,EAAE,QAAS,EAAE,aAAa,EAAI,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EAClH,QAAS,OAAO,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,CACnD,CACD,CACA,SAAS,GAAE,EAAG,EAAG,CAChB,IAAI,EAAI,EACR,IAAK,IAAI,KAAK,EAAG,EAAI,GAAE,EAAG,CAAC,EAC3B,OAAO,CACR,CACA,SAAS,GAAE,EAAG,CACb,OAAO,GAAE,KAAM,GAAM,EAAE,KAAK,CAAC,CAAC,CAC/B,CACA,SAAS,EAAE,EAAG,EAAG,EAAI,EAAG,EAAoB,IAAI,QAAW,CAC1D,GAAI,CAAC,EAAE,SAAW,EAAI,EAAE,UAAY,GAAK,KAAM,OAAO,EACtD,GAAI,OAAO,GAAK,SAAU,CACzB,IAAI,EAAI,GAAE,EAAG,EAAE,KAAK,EACpB,MAAO,GAAI,GAAE,CAAC,EAAG,CAClB,CACA,GAAI,MAAM,QAAQ,CAAC,EAAG,OAAO,EAAE,IAAI,CAAC,EAAI,wBAA0B,EAAE,IAAI,CAAC,EAAG,EAAE,IAAK,GAAM,EAAE,EAAG,EAAG,EAAI,EAAG,CAAC,CAAC,GAC1G,GAAI,OAAO,GAAK,SAAU,CACzB,GAAI,EAAE,IAAI,CAAC,EAAG,MAAO,uBACrB,EAAE,IAAI,CAAC,EACP,IAAI,EAAI,CAAC,EACT,IAAK,GAAI,CAAC,EAAG,KAAM,OAAO,QAAQ,CAAC,EAAG,GAAE,CAAC,GAAK,OAAO,GAAK,SAAW,EAAE,GAAK,aAAe,EAAE,GAAK,EAAE,EAAG,EAAG,EAAI,EAAG,CAAC,EAClH,OAAO,CACR,CACA,OAAO,CACR,CACA,SAAS,GAAE,EAAG,EAAG,CAChB,OAAO,EAAE,IAAK,IAAO,CACpB,QAAS,EAAE,QACX,SAAU,EAAE,UAAY,EACxB,YAAa,EAAE,aAAe,aAC9B,WAAY,EAAE,YAAc,EAC5B,cAAe,EAAE,aAClB,EAAE,CACH,CACA,SAAS,GAAE,EAAG,CACb,IAAI,EAAI,GAAG,SAAW,GAAE,QAAS,EAAI,GAAG,UAAY,GAAE,SAAU,EAAI,GAAG,UAAY,GAAE,SAAU,EAC/F,MAAO,GAAI,GAAG,MAAQ,EAAE,MAAQ,CAAC,GAAG,GAAG,GAAG,GAAG,aAAe,CAAC,CAAC,EAAG,CAChE,QAAS,EACT,MAAO,GAAE,EAAG,CAAC,EACb,SAAU,CACX,CACD,CACA,SAAS,EAAE,EAAG,EAAG,CAChB,GAAI,CAAC,EAAE,QAAS,OAAO,EACvB,IAAI,EAAI,GAAE,EAAG,EAAE,KAAK,EACpB,MAAO,GAAI,GAAE,CAAC,EAAG,CAClB,EAGQ,KAAM,CACb,OACC,KAAK,SAA2B,IAAI,GACrC,CACA,OACC,KAAK,aAAe,SACrB,CACA,OAAO,YAAY,EAAI,KAAK,aAAc,CACzC,KAAK,SAAS,IAAI,CAAC,GAAK,KAAK,SAAS,IAAI,EAAG,IAAI,EAAG,EACpD,IAAI,EAAI,KAAK,SAAS,IAAI,CAAC,EAC3B,GAAI,CAAC,EAAG,MAAM,MAAM,wCAAwC,EAAE,EAAE,EAChE,OAAO,CACR,CACA,OAAO,YAAY,EAAG,CACrB,GAAI,KAAK,SAAS,IAAI,CAAC,EAAG,MAAM,MAAM,UAAU,EAAE,iBAAiB,EACnE,IAAI,EAAI,IAAI,GACZ,OAAO,KAAK,SAAS,IAAI,EAAG,CAAC,EAAG,CACjC,CACA,OAAO,aAAa,EAAG,CACtB,IAAI,EAAI,KAAK,SAAS,IAAI,CAAC,EAC3B,IAAM,EAAE,QAAQ,EAAG,KAAK,SAAS,OAAO,CAAC,EAC1C,CACA,aAAa,kBAAkB,EAAG,CACjC,IAAI,EAAI,KAAK,SAAS,IAAI,CAAC,EAC3B,IAAM,MAAM,EAAE,aAAa,EAAG,KAAK,SAAS,OAAO,CAAC,EACrD,CACA,aAAa,eAAgB,CAC5B,IAAI,EAAI,CAAC,EAAG,EAAI,MAAM,KAAK,KAAK,SAAS,QAAQ,CAAC,EAClD,IAAK,GAAI,CAAC,EAAG,KAAM,EAAG,GAAI,CACzB,MAAM,EAAE,aAAa,CACtB,OAAS,EAAG,CACX,aAAa,EAAI,EAAE,KAAK,GAAG,EAAE,QAAQ,EAAI,aAAa,OAAS,EAAE,KAAK,CACrE,YAAa,SAAS,IACtB,MAAO,CACR,CAAC,CACF,CACA,GAAI,KAAK,SAAS,MAAM,EAAG,EAAE,OAAS,EAAG,MAAM,IAAI,EAAE,CAAC,CACvD,CACA,OAAO,gBAAgB,EAAG,CACzB,KAAK,aAAe,CACrB,CACA,OAAO,iBAAkB,CACxB,OAAO,MAAM,KAAK,KAAK,SAAS,KAAK,CAAC,CACvC,CACA,OAAO,UAAW,CACjB,IAAI,EAAI,MAAM,KAAK,KAAK,SAAS,OAAO,CAAC,EACzC,IAAK,IAAI,KAAK,EAAG,EAAE,QAAQ,EAC3B,KAAK,SAAS,MAAM,CACrB,CACD,OAAG,GAAI,OAAO,IAAI,oCAAoC,EACtD,SAAS,GAAE,EAAG,CACb,OAAO,OAAO,GAAK,cAAc,CAClC,CACA,IAAI,GAAI,KAAM,CACb,OACC,KAAK,OAAyB,IAAI,OACnC,CACA,OAAO,SAAS,EAAG,CAClB,GAAI,CAAC,KAAK,OAAO,IAAI,CAAC,EAAG,CACxB,IAAI,EAAI,GAAE,EAAE,IAAI,EAChB,KAAK,OAAO,IAAI,EAAG,CAAC,CACrB,CACA,IAAI,EAAI,KAAK,OAAO,IAAI,CAAC,EACzB,GAAI,CAAC,EAAG,MAAM,MAAM,mCAAmC,EAAE,MAAM,EAC/D,OAAO,CACR,CACA,OAAO,SAAS,EAAG,EAAG,CACrB,KAAK,OAAO,IAAI,EAAG,CAAC,CACrB,CACD,EACA,SAAS,GAAE,EAAG,CACb,MAAQ,IAAM,CACb,IAAI,EAAI,GAAK,GAAE,SAAS,CAAC,EACzB,OAAO,GAAE,SAAS,EAAG,CAAC,EAAG,EAAE,WAAa,CAAC,EAAG,EAAE,IAAK,EAAG,CACvD,CACD,CAIA,IAAI,GAAI,KAAM,CACb,aAAc,CACb,KAAK,WAA6B,IAAI,IAAO,KAAK,qBAAuC,IAAI,IAAO,KAAK,uBAAyC,IAAI,IAAO,KAAK,aAA+B,IAAI,IAAO,KAAK,oBAAsC,IAAI,IAAO,KAAK,UAAY,CAAC,CACrR,CACA,cAAc,EAAG,CAChB,IAAI,EAAI,EAAE,IACV,GAAI,CAAC,EAAG,MAAM,IAAI,GAAE,EAAE,IAAI,EAC1B,OAAO,KAAK,aAAa,IAAI,EAAG,EAAE,IAAI,EAAG,CAC1C,CACA,eAAe,EAAG,CACjB,OAAO,KAAK,aAAa,IAAI,CAAC,GAAK,SACpC,CACA,SAAS,EAAG,GAAG,EAAG,CACjB,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,GAAI,KAAK,qBAAqB,IAAI,CAAC,EAAG,MAAM,IAAI,GAAE,CAAC,EAAE,IAAI,CAAC,EAC1D,GAAI,CAAC,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,WAAW,IAAI,CAAC,IAAM,IAAK,GAAG,CACjE,KAAK,qBAAqB,IAAI,CAAC,EAC/B,GAAI,CACH,IAAI,EAAI,EAAE,SAAW,EAAI,IAAI,EAAM,IAAI,EAAE,GAAG,CAAC,EAC7C,KAAK,WAAW,IAAI,EAAG,CAAC,CACzB,QAAU,CACT,KAAK,qBAAqB,OAAO,CAAC,CACnC,CACD,CACD,CACA,oBAAoB,EAAG,CACtB,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,KAAK,WAAW,IAAI,EAAG,IAAK,EAAC,CAC9B,CACA,8BAA8B,EAAG,EAAG,CACnC,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,KAAK,aAAa,IAAI,EAAG,EAAE,IAAI,EAAG,KAAK,WAAW,IAAI,EAAG,CAAC,CAC3D,CACA,WAAW,EAAG,CACb,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,OAAO,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,SAAS,CAAC,EAAG,KAAK,WAAW,IAAI,CAAC,CACzE,CACA,WAAW,EAAG,CACb,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,OAAO,KAAK,WAAW,IAAI,CAAC,CAC7B,CACA,MAAM,uBAAuB,EAAG,EAAG,CAClC,GAAI,KAAK,oBAAoB,IAAI,CAAC,EAAG,OACrC,GAAI,KAAK,uBAAuB,IAAI,CAAC,EAAG,CACvC,IAAI,EAAI,KAAK,uBAAuB,IAAI,CAAC,EACzC,GAAI,EAAG,CACN,MAAM,EACN,MACD,CACD,CACA,IAAI,EAAI,EACR,GAAI,OAAO,EAAE,iBAAmB,WAAY,CAC3C,KAAK,oBAAoB,IAAI,CAAC,EAC9B,IAAI,EAAI,QAAQ,QAAQ,EACxB,OAAO,KAAK,uBAAuB,IAAI,EAAG,CAAC,EAAG,CAC/C,CACA,IAAI,EAAI,EAAE,gBAAgB,CAAC,CAAC,SAAW,CACtC,KAAK,oBAAoB,IAAI,CAAC,CAC/B,CAAC,CAAC,CAAC,MAAO,GAAM,CACf,MAAM,KAAK,uBAAuB,OAAO,CAAC,EAAG,CAC9C,CAAC,EACD,KAAK,uBAAuB,IAAI,EAAG,CAAC,EAAG,MAAM,CAC9C,CACA,MAAM,gBAAgB,EAAG,CACxB,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,SAAS,CAAC,EACzC,IAAI,EAAI,KAAK,WAAW,IAAI,CAAC,EAC7B,OAAO,IAAM,IAAK,IAAK,MAAM,KAAK,uBAAuB,EAAG,CAAC,EAAG,CACjE,CACA,MAAM,cAAc,EAAG,GAAG,EAAG,CAC5B,IAAI,EAAI,KAAK,cAAc,CAAC,GAC3B,CAAC,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,WAAW,IAAI,CAAC,IAAM,IAAK,KAAM,KAAK,SAAS,EAAG,GAAG,CAAC,EACvF,IAAI,EAAI,KAAK,WAAW,IAAI,CAAC,EAC7B,MAAM,KAAK,uBAAuB,EAAG,CAAC,CACvC,CACA,MAAM,cAAe,CACpB,GAAI,KAAK,UAAW,OACpB,KAAK,UAAY,CAAC,EAClB,IAAI,EAAI,MAAM,KAAK,KAAK,uBAAuB,OAAO,CAAC,EACvD,EAAE,OAAS,GAAK,MAAM,QAAQ,WAAW,CAAC,EAC1C,IAAI,EAAI,CAAC,EAAG,EAAI,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EACpD,IAAK,GAAI,CAAC,EAAG,KAAM,EAAG,CACrB,GAAI,CAAC,KAAK,oBAAoB,IAAI,CAAC,GAAK,IAAM,IAAK,GAAG,SACtD,IAAI,EAAI,EACR,GAAI,OAAO,EAAE,WAAa,WAAY,GAAI,CACzC,MAAM,EAAE,UAAU,CACnB,OAAS,EAAG,CACX,EAAE,KAAK,CACN,YAAa,KAAK,eAAe,CAAC,EAClC,MAAO,CACR,CAAC,CACF,CACD,CACA,GAAI,KAAK,WAAW,MAAM,EAAG,KAAK,qBAAqB,MAAM,EAAG,KAAK,uBAAuB,MAAM,EAAG,KAAK,oBAAoB,MAAM,EAAG,KAAK,aAAa,MAAM,EAAG,EAAE,OAAS,EAAG,MAAM,IAAI,EAAE,CAAC,CAC9L,CACA,SAAU,CACT,KAAK,WAAW,MAAM,EAAG,KAAK,qBAAqB,MAAM,EAAG,KAAK,uBAAuB,MAAM,EAAG,KAAK,oBAAoB,MAAM,EAAG,KAAK,aAAa,MAAM,CAC5J,CACD,EAAG,EAAI,cAAc,KAAM,CAC1B,YAAY,EAAG,EAAG,EAAG,CACpB,MAAM,CAAC,EAAG,KAAK,MAAQ,EAAG,KAAK,KAAO,iBAAkB,IAAM,KAAK,MAAQ,EAC5E,CACD,EAAG,GAAI,cAAc,CAAE,CACtB,YAAY,EAAG,CACd,MAAM,iCAAiC,EAAE,KAAK,MAAM,GAAG,EAAG,KAAK,KAAO,yBACvE,CACD,EAAG,GAAI,cAAc,CAAE,CACtB,YAAY,EAAG,CACd,MAAM,YAAY,EAAE,6HAA8H,CAAC,EAAG,KAAK,KAAO,0BACnK,CACD,EAAG,EAAI,cAAc,CAAE,CACtB,YAAY,EAAG,CACd,IAAI,EAAI,EAAE,IAAK,GAAM,GAAG,EAAE,YAAY,IAAI,EAAE,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,EACtE,MAAM,qBAAqB,EAAE,OAAO,eAAe,GAAG,EAAG,KAAK,SAAW,EAAG,KAAK,KAAO,2BACzF,CACA,WAAY,CACX,OAAO,KAAK,SAAS,IAAK,GAAM,EAAE,KAAK,CACxC,CACA,WAAW,EAAG,CACb,OAAO,KAAK,SAAS,KAAM,GAAM,EAAE,cAAgB,CAAC,CACrD,CACD,EAgBA,SAAS,GAAE,EAAG,EAAG,CAChB,GAAI,OAAO,SAAW,UAAY,OAAO,QAAQ,UAAY,WAAY,OAAO,QAAQ,SAAS,EAAG,CAAC,CACtG,CAGA,SAAS,GAAE,EAAG,EAAG,EAAG,EAAG,CACtB,IAAI,EAAI,UAAU,OAAQ,EAAI,EAAI,EAAI,EAAI,IAAM,KAAO,EAAI,OAAO,yBAAyB,EAAG,CAAC,EAAI,EAAG,EACtG,GAAI,OAAO,SAAW,UAAY,OAAO,QAAQ,UAAY,WAAY,EAAI,QAAQ,SAAS,EAAG,EAAG,EAAG,CAAC,OACnG,IAAK,IAAI,EAAI,EAAE,OAAS,EAAG,GAAK,EAAG,KAAM,EAAI,EAAE,MAAQ,GAAK,EAAI,EAAI,EAAE,CAAC,EAAI,EAAI,EAAI,EAAE,EAAG,EAAG,CAAC,EAAI,EAAE,EAAG,CAAC,IAAM,GACjH,OAAO,EAAI,GAAK,GAAK,OAAO,eAAe,EAAG,EAAG,CAAC,EAAG,CACtD,CAGA,IAAI,EAAG,EAAI,EAAI,KAAM,CACpB,YAAY,EAAI,CAAC,EAAG,EAAG,EAAG,EAAG,CAC5B,GAAI,KAAK,OAAS,EAAG,KAAK,aAAe,CAAC,EAAG,KAAK,iBAAmB,CAAC,EAAG,KAAK,aAAe,CAAC,EAAG,EAAG,KAAK,aAAe,EAAG,KAAK,KAAO,EAAE,KAAM,KAAK,QAAU,EAAG,KAAK,SAAW,EAAE,YAAY,EAAG,KAAK,YAAc,EAAE,YAAa,KAAK,UAAY,EAAE,UAAW,KAAK,cAAgB,EAAE,cAAe,KAAK,UAAY,EAAE,cACtT,CACJ,GAAI,OAAO,EAAE,OAAS,UAAY,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAG,MAAM,IAAIL,EAAE,sBAAsB,EAAE,OAAO,EAChH,GAAI,KAAK,SAAW,KAAK,aAAa,EAAE,OAAS,QAAQ,IAAI,WAAa,MAAM,EAAG,KAAK,KAAO,EAAE,MAAQ,eAAgB,KAAK,cAAgB,EAAE,cAAe,KAAK,oBAAoB,EAAE,kBAAoB,QAAQ,IAAI,uBAAuB,MAAM,GAAG,GAAK,CAAC,CAAC,EAAG,KAAK,YAAc,GAAK,IAAID,EAAE,CACjS,UAAW,EAAE,UACb,OAAQ,CACP,GAAGH,EACH,GAAG,EAAE,MACN,EACA,MAAO,CACN,GAAGC,EACH,GAAG,EAAE,KACN,CACD,CAAC,EAAG,KAAK,UAAY,EAAE,WAAa,GAAE,cAAc,CAAE,UAAW,KAAK,YAAY,aAAa,CAAE,CAAC,EAAG,EAAE,eAAe,QAAS,CAC9H,IAAI,EAAI,CACP,QAAS,CAAC,EACV,SAAU,EAAE,cAAc,UAAYI,EAAE,SACxC,gBAAiB,EAAE,cAAc,iBAAmBA,EAAE,eACvD,EACA,KAAK,aAAe,IAAIE,EAAE,EAAG,KAAK,UAAW,KAAK,IAAI,CACvD,CACA,KAAK,UAAY,GAAE,EAAE,YAAY,CAClC,CACD,CACA,eAAe,EAAG,CACjB,GAAI,OAAO,GAAK,WAAY,GAAI,CAC/B,OAAO,EAAE,CACV,OAAS,EAAG,CACX,OAAO,QAAQ,MAAM,qCAAsC,CAAC,EAAG,+BAA+B,EAAE,EACjG,CACA,OAAO,CACR,CACA,kBAAmB,CAClB,MAAO,CAAC,KAAK,SAAW,EAAE,KAAK,cAAgB,KAAA,CAAM,iBAAiB,SAAS,KAAK,OAAO,CAC5F,CACA,oBAAoB,EAAG,CACtB,KAAK,iBAAmB,CACzB,CACA,aAAc,CACb,OAAO,KAAK,QACb,CACA,qBAAsB,CACrB,OAAQ,KAAK,cAAgB,KAAA,CAAM,kBAAoB,CAAC,CACzD,CACA,aAAa,EAAG,EACd,KAAK,cAAgB,KAAA,CAAM,YAAY,aAAa,CAAC,CACvD,CACA,cAAe,CACd,OAAQ,KAAK,cAAgB,KAAA,CAAM,YAAY,aAAa,CAC7D,CACA,iBAAiB,EAAG,CACnB,KAAK,cAAgB,CACtB,CACA,kBAAmB,CAClB,OAAO,KAAK,aACb,CACA,oBAAqB,CACpB,KAAK,cAAgB,IAAK,EAC3B,CACA,WAAW,EAAG,CACb,OAAO,KAAK,aAAa,KAAO,KAAK,aAAa,GAAK,IAAI,EAAE,CAAC,EAAG,IAAK,GAAG,EAAG,IAAI,GAAI,KAAK,aAAa,EACvG,CACA,MAAM,EAAG,CACR,GAAI,CAAC,KAAK,iBAAiB,EAAG,QAC7B,KAAK,cAAc,cAAgB,KAAK,aAAA,CAAc,KAAK,CAAC,EAC7D,IAAI,EAAI,KAAK,UAAU,OAAO,CAC7B,MAAO,EAAE,KACT,QAAS,UAAU,IACnB,OAAQ,KAAK,KACb,QAAS,KAAK,QACd,UAA2B,IAAI,KAC/B,cAAe,KAAK,iBAAiB,CACtC,CAAC,EACD,QAAQ,MAAM,GAAG,EAAE,GAAG,CACvB,CACA,SAAS,EAAG,CACX,GAAI,CAAC,KAAK,iBAAiB,EAAG,OAC9B,IAAI,EAAI,KAAK,cAAc,cAAgB,KAAK,aAChD,GAAI,EAAG,CACN,IAAI,EAAI,EAAE,YAAY,CAAC,EACvB,GAAI,IAAM,GAAI,CACb,IAAI,EAAI,EAAE,OAAO,CAAC,EAClB,IAAK,IAAI,EAAI,EAAG,EAAI,EAAE,OAAQ,IAAK,QAAQ,SAAS,EAAG,QAAQ,IAAI,EAAE,CACtE,CACD,MAAO,EAAE,OAAS,IAAM,EAAE,IAAI,EAAG,QAAQ,SAAS,EAAG,QAAQ,IAAI,EAAE,EACpE,CACA,MAAM,EAAG,EAAG,GAAG,EAAG,CACjB,KAAK,MAAM,EAAE,MAAO,EAAG,EAAG,GAAG,CAAC,CAC/B,CACA,MAAM,EAAG,EAAG,GAAG,EAAG,CACjB,KAAK,MAAM,EAAE,MAAO,EAAG,EAAG,GAAG,CAAC,CAC/B,CACA,KAAK,EAAG,EAAG,GAAG,EAAG,CAChB,KAAK,MAAM,EAAE,KAAM,EAAG,EAAG,GAAG,CAAC,CAC9B,CACA,KAAK,EAAG,EAAG,GAAG,EAAG,CAChB,KAAK,MAAM,EAAE,KAAM,EAAG,EAAG,GAAG,CAAC,CAC9B,CACA,MAAM,EAAG,EAAG,EAAG,GAAG,EAAG,CACpB,GAAI,CAAC,KAAK,iBAAiB,GAAK,KAAK,SAAW,EAAE,MAAO,OACzD,GAAI,CAAE,QAAS,EAAG,gBAAiB,EAAG,SAAU,EAAG,QAAS,EAAG,KAAM,GAAM,KAAK,qBAAqB,EAAG,EAAG,EAAG,CAAC,EAAG,EAAI,EAAE,EAAG,KAAK,SAAS,EAAG,EAAI,EAAI,EAAE,EAAG,KAAK,SAAS,EAAI,IAAK,GAAG,EAAI,GAAK,CAAC,EAAG,EAAG,EAAI,EACvM,GAAI,EAAE,OAAS,EAAG,CACjB,IAAI,EAAI,EAAE,EAAE,OAAS,GACrB,GAAK,OAAO,GAAK,UAAY,CAAC,MAAM,QAAQ,CAAC,IAAM,UAAW,GAAK,SAAU,KAAO,EAAI,EAAG,EAAI,EAAE,MAAM,EAAG,EAAE,EAC7G,CACA,IAAI,EAAI,CACP,MAAO,EAAE,MACT,QAAS,EACT,OAAQ,KAAK,KACb,QAAS,KAAK,QACd,UAA2B,IAAI,KAC/B,SAAU,EACV,MAAO,EACP,QAAS,EACT,cAAe,KAAK,iBAAiB,CACtC,EAAG,EAAI,KAAK,UAAU,OAAO,CAAC,EAC9B,GAAI,KAAK,UAAU,gBAAgB,EAAG,QAAQ,MAAM,CAAC,MAChD,CACJ,IAAI,EAAI,CAAC,CAAC,EACV,GAAK,EAAE,KAAK,CAAC,EAAG,GAAK,EAAE,KAAK,CAAC,EAAG,QAAQ,MAAM,GAAG,EAAG,GAAG,CAAC,CACzD,CACD,CACA,MAAM,EAAG,EAAG,EAAG,GAAG,EAAG,CACpB,GAAI,CAAC,KAAK,iBAAiB,GAAK,KAAK,SAAW,EAAE,MAAO,OACzD,GAAI,OAAO,GAAK,UAAY,GAAK,OAAO,GAAK,UAAY,CAAC,MAAM,QAAQ,CAAC,IAAM,UAAW,GAAK,SAAU,GAAI,CAC5G,IAAI,EAAI,EAAG,EAAI,EAAE,UAAU,IAAK,KAAK,SAAS,EAAG,EAAI,KAAK,YAAY,0BAA0B,EAAE,MAAO,EAAG,KAAK,KAAM,EAAG,KAAK,OAAO,EACtI,QAAQ,MAAM,CAAC,EACf,MACD,CACA,GAAI,CAAE,QAAS,EAAG,gBAAiB,EAAG,SAAU,EAAG,QAAS,EAAG,KAAM,GAAM,KAAK,qBAAqB,EAAG,EAAG,EAAG,CAAC,EAAG,EAAI,EAAE,EAAG,KAAK,SAAS,EAAG,EAAI,EAAI,EAAE,EAAG,KAAK,SAAS,EAAI,IAAK,GAAG,EAAI,GAAK,CAAC,EAAG,EAAG,EAAI,EACvM,GAAI,EAAE,OAAS,EAAG,CACjB,IAAI,EAAI,EAAE,EAAE,OAAS,GACrB,GAAK,OAAO,GAAK,UAAY,CAAC,MAAM,QAAQ,CAAC,IAAM,UAAW,GAAK,SAAU,KAAO,EAAI,EAAG,EAAI,EAAE,MAAM,EAAG,EAAE,EAC7G,CACA,IAAI,EAAI,CACP,MAAO,EAAE,MACT,QAAS,UAAU,IACnB,OAAQ,KAAK,KACb,QAAS,KAAK,QACd,UAA2B,IAAI,KAC/B,SAAU,EACV,MAAO,EACP,QAAS,EACT,cAAe,KAAK,iBAAiB,CACtC,EAAG,EAAI,KAAK,UAAU,OAAO,CAAC,EAC9B,GAAI,KAAK,UAAU,gBAAgB,EAAG,QAAQ,MAAM,CAAC,MAChD,CACJ,IAAI,EAAI,CAAC,CAAC,EACV,GAAK,EAAE,KAAK,CAAC,EAAG,GAAK,EAAE,KAAK,CAAC,EAAG,QAAQ,MAAM,GAAG,EAAG,GAAG,CAAC,CACzD,CACD,CACA,qBAAqB,EAAG,EAAG,EAAG,EAAI,CAAC,EAAG,CACrC,GAAI,aAAa,OAAS,IAAM,IAAK,GAAG,MAAO,CAC9C,QAAS,EAAE,QACX,gBAAiBR,EAAE,UAAU,CAAC,EAC9B,SAAU,EACV,KAAM,CAAC,CACR,EACA,GAAI,OAAO,GAAK,UAAY,IAAM,IAAK,GAAG,MAAO,CAChD,QAAS,EACT,KAAM,CAAC,CACR,EACA,GAAI,OAAO,GAAK,UAAY,aAAa,OAAS,IAAM,IAAK,GAAG,MAAO,CACtE,QAAS,EACT,gBAAiBA,EAAE,UAAU,CAAC,EAC9B,SAAU,EACV,KAAM,CAAC,CACR,EACA,GAAI,OAAO,GAAK,UAAY,KAAK,aAAa,CAAC,GAAK,IAAM,IAAK,GAAG,MAAO,CACxE,QAAS,EACT,QAAS,EACT,KAAM,CAAC,CACR,EACA,GAAI,OAAO,GAAK,UAAY,aAAa,OAAS,KAAK,aAAa,CAAC,EAAG,MAAO,CAC9E,QAAS,EACT,gBAAiBA,EAAE,UAAU,CAAC,EAC9B,SAAU,EACV,QAAS,EACT,KAAM,CACP,EACA,IAAI,EAAI,OAAO,GAAK,SAAW,EAAI,gBAAiB,EAAI,aAAa,MAAQ,EAAI,IAAK,GACtF,MAAO,CACN,QAAS,EACT,gBAAiB,EAAIA,EAAE,UAAU,CAAC,EAAI,IAAK,GAC3C,SAAU,EACV,KAAM,IAAM,IAAK,GAAI,EAAI,CAAC,EAAG,GAAG,CAAC,CAClC,CACD,CACA,aAAa,EAAG,CACf,OAAO,OAAO,GAAK,UAAY,CAAC,CAAC,GAAK,CAAC,MAAM,QAAQ,CAAC,GAAK,EAAE,aAAa,QAAU,EAAE,aAAa,OAAS,EAAE,aAAa,SAAW,OAAO,GAAK,UACnJ,CACA,MAAM,EAAG,EAAG,EAAG,GAAG,EAAG,CACpB,GAAI,CAAC,KAAK,iBAAiB,GAAK,KAAK,SAAW,EAAG,OACnD,GAAI,CAAE,SAAU,EAAG,SAAU,GAAM,KAAK,YAAY,uBAAuB,EAAG,CAAC,EAAG,EAAI,KAAK,eAAe,CAAC,EAC3G,GAAI,EAAI,EAAE,EAAG,KAAK,SAAS,EAAG,CAAC,KAAK,oBAAoB,EAAG,EAAG,EAAG,CAAC,EAAG,OACrE,IAAI,EAAI,GAAG,IAAK,GAAM,EAAE,EAAG,KAAK,SAAS,CAAC,EAAG,EAAG,EAAI,CAAC,EACrD,GAAK,EAAE,OAAS,GAAK,EAAE,SAAS,EAAG,IAAM,CACxC,aAAa,OAAS,CAAC,EAAI,EAAI,EAAI,OAAO,GAAK,UAAY,EAAI,OAAO,OAAO,EAAG,CAAC,EAAI,EAAE,MAAM,KAAO,CACrG,CAAC,EACD,IAAI,EAAI,CACP,MAAO,EACP,QAAS,EACT,OAAQ,KAAK,KACb,QAAS,KAAK,QACd,UAA2B,IAAI,KAC/B,SAAU,OAAO,KAAK,CAAC,CAAC,CAAC,OAAS,EAAI,EAAI,IAAK,GAC/C,MAAO,EACP,QAAS,EACT,cAAe,KAAK,iBAAiB,CACtC,EAAG,EAAI,KAAK,UAAU,OAAO,CAAC,EAAG,EAAI,KAAK,UAAU,gBAAgB,EACpE,OAAQ,EAAR,CACC,KAAK,EAAE,MACN,EAAI,QAAQ,MAAM,CAAC,EAAI,QAAQ,MAAM,EAAG,GAAG,GAAK,CAAC,CAAC,EAClD,MACD,KAAK,EAAE,MACN,EAAI,QAAQ,MAAM,CAAC,EAAI,QAAQ,MAAM,EAAG,GAAG,GAAK,CAAC,CAAC,EAClD,MACD,KAAK,EAAE,KACN,EAAI,QAAQ,KAAK,CAAC,EAAI,QAAQ,KAAK,EAAG,GAAG,GAAK,CAAC,CAAC,EAChD,MACD,KAAK,EAAE,KACN,EAAI,QAAQ,KAAK,CAAC,EAAI,QAAQ,KAAK,EAAG,GAAG,GAAK,CAAC,CAAC,EAChD,MACD,KAAK,EAAE,MACP,KAAK,EAAE,MACN,EAAI,QAAQ,MAAM,CAAC,EAAI,QAAQ,MAAM,EAAG,GAAG,GAAK,CAAC,CAAC,EAClD,KACF,CACD,CACA,aAAa,EAAG,CACf,GAAI,EAAE,CAAC,EAAG,OAAQ,EAAR,CACT,IAAK,QAAS,OAAO,EAAE,MACvB,IAAK,QAAS,OAAO,EAAE,MACvB,IAAK,OAAQ,OAAO,EAAE,KACtB,IAAK,OAAQ,OAAO,EAAE,KACtB,IAAK,QAAS,OAAO,EAAE,MACvB,IAAK,QAAS,OAAO,EAAE,MACvB,IAAK,SAAU,OAAO,EAAE,MACzB,CACA,MAAM,EAAE,EAAE,YAAY,CAAC,EAAI,IAAIK,EAAE,sBAAsB,EAAE,+FAA+F,EAAI,IAAIA,EAAE,sBAAsB,EAAE,gEAAgE,CAC3P,CACA,qBAAqB,EAAG,EAAG,CAC1B,IAAI,GAAK,KAAK,cAAgB,KAAA,CAAM,aACpC,GAAI,CAAC,EAAG,MAAO,CAAC,EAChB,GAAI,CACH,OAAO,EAAE,WAAW,EAAG,EAAG,KAAK,OAAO,CACvC,OAAS,EAAG,CACX,OAAO,QAAQ,MAAM,8BAA+B,CAAC,EAAG,CAAC,CAC1D,CACD,CACA,oBAAoB,EAAG,EAAG,EAAG,EAAG,CAC/B,MAAO,CAAC,GAAK,EAAE,SAAW,EAAI,KAAK,qBAAqB,EAAG,CAAC,EAAI,CAAC,CAClE,CACD,EACA,EAAI,EAAI,GAAE,CAAC,GAAE,EAAG,GAAE,oBAAqB,CACtC,OACAD,IAAM,IAAK,GAAI,OAASA,EACxB,OACA,IAAM,IAAK,GAAI,OAAS,CACzB,CAAC,CAAC,EAAG,CAAC,EClhCN,IAAI,GAAI,KAAM,CACb,OACC,KAAK,SAA2B,IAAI,GACrC,CACA,OACC,KAAK,aAAe,SACrB,CACA,OAAO,YAAY,EAAI,KAAK,aAAc,CACzC,KAAK,SAAS,IAAI,CAAC,GAAK,KAAK,SAAS,IAAI,EAAG,IAAI,EAAG,EACpD,IAAI,EAAI,KAAK,SAAS,IAAI,CAAC,EAC3B,GAAI,CAAC,EAAG,MAAM,MAAM,wCAAwC,EAAE,EAAE,EAChE,OAAO,CACR,CACA,OAAO,YAAY,EAAG,CACrB,GAAI,KAAK,SAAS,IAAI,CAAC,EAAG,MAAM,MAAM,UAAU,EAAE,iBAAiB,EACnE,IAAI,EAAI,IAAI,GACZ,OAAO,KAAK,SAAS,IAAI,EAAG,CAAC,EAAG,CACjC,CACA,OAAO,aAAa,EAAG,CACtB,IAAI,EAAI,KAAK,SAAS,IAAI,CAAC,EAC3B,IAAM,EAAE,QAAQ,EAAG,KAAK,SAAS,OAAO,CAAC,EAC1C,CACA,aAAa,kBAAkB,EAAG,CACjC,IAAI,EAAI,KAAK,SAAS,IAAI,CAAC,EAC3B,IAAM,MAAM,EAAE,aAAa,EAAG,KAAK,SAAS,OAAO,CAAC,EACrD,CACA,aAAa,eAAgB,CAC5B,IAAI,EAAI,CAAC,EAAG,EAAI,MAAM,KAAK,KAAK,SAAS,QAAQ,CAAC,EAClD,IAAK,GAAI,CAAC,EAAG,KAAM,EAAG,GAAI,CACzB,MAAM,EAAE,aAAa,CACtB,OAAS,EAAG,CACX,aAAa,EAAI,EAAE,KAAK,GAAG,EAAE,QAAQ,EAAI,aAAa,OAAS,EAAE,KAAK,CACrE,YAAa,SAAS,IACtB,MAAO,CACR,CAAC,CACF,CACA,GAAI,KAAK,SAAS,MAAM,EAAG,EAAE,OAAS,EAAG,MAAM,IAAI,EAAE,CAAC,CACvD,CACA,OAAO,gBAAgB,EAAG,CACzB,KAAK,aAAe,CACrB,CACA,OAAO,iBAAkB,CACxB,OAAO,MAAM,KAAK,KAAK,SAAS,KAAK,CAAC,CACvC,CACA,OAAO,UAAW,CACjB,IAAI,EAAI,MAAM,KAAK,KAAK,SAAS,OAAO,CAAC,EACzC,IAAK,IAAI,KAAK,EAAG,EAAE,QAAQ,EAC3B,KAAK,SAAS,MAAM,CACrB,CACD,EAgCI,GAAI,OAAO,IAAI,oCAAoC,EACvD,SAAS,GAAE,EAAG,CACb,OAAO,OAAO,GAAK,cAAc,CAClC,CACA,IAAI,GAAI,KAAM,CACb,OACC,KAAK,OAAyB,IAAI,OACnC,CACA,OAAO,SAAS,EAAG,CAClB,GAAI,CAAC,KAAK,OAAO,IAAI,CAAC,EAAG,CACxB,IAAI,EAAI,GAAE,EAAE,IAAI,EAChB,KAAK,OAAO,IAAI,EAAG,CAAC,CACrB,CACA,IAAI,EAAI,KAAK,OAAO,IAAI,CAAC,EACzB,GAAI,CAAC,EAAG,MAAM,MAAM,mCAAmC,EAAE,MAAM,EAC/D,OAAO,CACR,CACA,OAAO,SAAS,EAAG,EAAG,CACrB,KAAK,OAAO,IAAI,EAAG,CAAC,CACrB,CACD,EACA,SAAS,GAAE,EAAG,CACb,MAAQ,IAAM,CACb,IAAI,EAAI,GAAK,GAAE,SAAS,CAAC,EACzB,OAAO,GAAE,SAAS,EAAG,CAAC,EAAG,EAAE,WAAa,CAAC,EAAG,EAAE,IAAK,EAAG,CACvD,CACD,CAGA,SAAS,IAAI,CACZ,OAAO,GAAE,YAAY,CACtB,CACA,IAAI,GAAI,KAAM,CACb,aAAc,CACb,KAAK,WAA6B,IAAI,IAAO,KAAK,qBAAuC,IAAI,IAAO,KAAK,uBAAyC,IAAI,IAAO,KAAK,aAA+B,IAAI,IAAO,KAAK,oBAAsC,IAAI,IAAO,KAAK,UAAY,CAAC,CACrR,CACA,cAAc,EAAG,CAChB,IAAI,EAAI,EAAE,IACV,GAAI,CAAC,EAAG,MAAM,IAAI,GAAE,EAAE,IAAI,EAC1B,OAAO,KAAK,aAAa,IAAI,EAAG,EAAE,IAAI,EAAG,CAC1C,CACA,eAAe,EAAG,CACjB,OAAO,KAAK,aAAa,IAAI,CAAC,GAAK,SACpC,CACA,SAAS,EAAG,GAAG,EAAG,CACjB,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,GAAI,KAAK,qBAAqB,IAAI,CAAC,EAAG,MAAM,IAAI,GAAE,CAAC,EAAE,IAAI,CAAC,EAC1D,GAAI,CAAC,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,WAAW,IAAI,CAAC,IAAM,IAAK,GAAG,CACjE,KAAK,qBAAqB,IAAI,CAAC,EAC/B,GAAI,CACH,IAAI,EAAI,EAAE,SAAW,EAAI,IAAI,EAAM,IAAI,EAAE,GAAG,CAAC,EAC7C,KAAK,WAAW,IAAI,EAAG,CAAC,CACzB,QAAU,CACT,KAAK,qBAAqB,OAAO,CAAC,CACnC,CACD,CACD,CACA,oBAAoB,EAAG,CACtB,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,KAAK,WAAW,IAAI,EAAG,IAAK,EAAC,CAC9B,CACA,8BAA8B,EAAG,EAAG,CACnC,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,KAAK,aAAa,IAAI,EAAG,EAAE,IAAI,EAAG,KAAK,WAAW,IAAI,EAAG,CAAC,CAC3D,CACA,WAAW,EAAG,CACb,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,OAAO,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,SAAS,CAAC,EAAG,KAAK,WAAW,IAAI,CAAC,CACzE,CACA,WAAW,EAAG,CACb,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,OAAO,KAAK,WAAW,IAAI,CAAC,CAC7B,CACA,MAAM,uBAAuB,EAAG,EAAG,CAClC,GAAI,KAAK,oBAAoB,IAAI,CAAC,EAAG,OACrC,GAAI,KAAK,uBAAuB,IAAI,CAAC,EAAG,CACvC,IAAI,EAAI,KAAK,uBAAuB,IAAI,CAAC,EACzC,GAAI,EAAG,CACN,MAAM,EACN,MACD,CACD,CACA,IAAI,EAAI,EACR,GAAI,OAAO,EAAE,iBAAmB,WAAY,CAC3C,KAAK,oBAAoB,IAAI,CAAC,EAC9B,IAAI,EAAI,QAAQ,QAAQ,EACxB,OAAO,KAAK,uBAAuB,IAAI,EAAG,CAAC,EAAG,CAC/C,CACA,IAAI,EAAI,EAAE,gBAAgB,CAAC,CAAC,SAAW,CACtC,KAAK,oBAAoB,IAAI,CAAC,CAC/B,CAAC,CAAC,CAAC,MAAO,GAAM,CACf,MAAM,KAAK,uBAAuB,OAAO,CAAC,EAAG,CAC9C,CAAC,EACD,KAAK,uBAAuB,IAAI,EAAG,CAAC,EAAG,MAAM,CAC9C,CACA,MAAM,gBAAgB,EAAG,CACxB,IAAI,EAAI,KAAK,cAAc,CAAC,EAC5B,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,SAAS,CAAC,EACzC,IAAI,EAAI,KAAK,WAAW,IAAI,CAAC,EAC7B,OAAO,IAAM,IAAK,IAAK,MAAM,KAAK,uBAAuB,EAAG,CAAC,EAAG,CACjE,CACA,MAAM,cAAc,EAAG,GAAG,EAAG,CAC5B,IAAI,EAAI,KAAK,cAAc,CAAC,GAC3B,CAAC,KAAK,WAAW,IAAI,CAAC,GAAK,KAAK,WAAW,IAAI,CAAC,IAAM,IAAK,KAAM,KAAK,SAAS,EAAG,GAAG,CAAC,EACvF,IAAI,EAAI,KAAK,WAAW,IAAI,CAAC,EAC7B,MAAM,KAAK,uBAAuB,EAAG,CAAC,CACvC,CACA,MAAM,cAAe,CACpB,GAAI,KAAK,UAAW,OACpB,KAAK,UAAY,CAAC,EAClB,IAAI,EAAI,MAAM,KAAK,KAAK,uBAAuB,OAAO,CAAC,EACvD,EAAE,OAAS,GAAK,MAAM,QAAQ,WAAW,CAAC,EAC1C,IAAI,EAAI,CAAC,EAAG,EAAI,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EACpD,IAAK,GAAI,CAAC,EAAG,KAAM,EAAG,CACrB,GAAI,CAAC,KAAK,oBAAoB,IAAI,CAAC,GAAK,IAAM,IAAK,GAAG,SACtD,IAAI,EAAI,EACR,GAAI,OAAO,EAAE,WAAa,WAAY,GAAI,CACzC,MAAM,EAAE,UAAU,CACnB,OAAS,EAAG,CACX,EAAE,KAAK,CACN,YAAa,KAAK,eAAe,CAAC,EAClC,MAAO,CACR,CAAC,CACF,CACD,CACA,GAAI,KAAK,WAAW,MAAM,EAAG,KAAK,qBAAqB,MAAM,EAAG,KAAK,uBAAuB,MAAM,EAAG,KAAK,oBAAoB,MAAM,EAAG,KAAK,aAAa,MAAM,EAAG,EAAE,OAAS,EAAG,MAAM,IAAI,EAAE,CAAC,CAC9L,CACA,SAAU,CACT,KAAK,WAAW,MAAM,EAAG,KAAK,qBAAqB,MAAM,EAAG,KAAK,uBAAuB,MAAM,EAAG,KAAK,oBAAoB,MAAM,EAAG,KAAK,aAAa,MAAM,CAC5J,CACD,EAAG,EAAI,cAAc,KAAM,CAC1B,YAAY,EAAG,EAAG,EAAG,CACpB,MAAM,CAAC,EAAG,KAAK,MAAQ,EAAG,KAAK,KAAO,iBAAkB,IAAM,KAAK,MAAQ,EAC5E,CACD,EAAG,GAAI,cAAc,CAAE,CACtB,YAAY,EAAG,CACd,MAAM,iCAAiC,EAAE,KAAK,MAAM,GAAG,EAAG,KAAK,KAAO,yBACvE,CACD,EAAG,GAAI,cAAc,CAAE,CACtB,YAAY,EAAG,CACd,MAAM,YAAY,EAAE,6HAA8H,CAAC,EAAG,KAAK,KAAO,0BACnK,CACD,EAAG,EAAI,cAAc,CAAE,CACtB,YAAY,EAAG,CACd,IAAI,EAAI,EAAE,IAAK,GAAM,GAAG,EAAE,YAAY,IAAI,EAAE,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,EACtE,MAAM,qBAAqB,EAAE,OAAO,eAAe,GAAG,EAAG,KAAK,SAAW,EAAG,KAAK,KAAO,2BACzF,CACA,WAAY,CACX,OAAO,KAAK,SAAS,IAAK,GAAM,EAAE,KAAK,CACxC,CACA,WAAW,EAAG,CACb,OAAO,KAAK,SAAS,KAAM,GAAM,EAAE,cAAgB,CAAC,CACrD,CACD,EACA,SAAS,EAAE,EAAG,EAAI,CAAC,EAAG,CACrB,GAAI,CAAE,SAAU,EAAI,CAAC,GAAM,EAC3B,GAAI,CACH,IAAI,EAAI,GAAE,CAAC,CAAC,WAAW,CAAC,EACxB,GAAI,GAAK,KAAM,CACd,GAAI,EAAG,MAAM,IAAI,EAAE,YAAY,EAAE,KAAK,yCAA0C,EAAE,IAAI,EACtF,MACD,CACA,OAAO,CACR,OAAS,EAAG,CACX,MAAM,aAAa,EAAI,EAAI,IAAI,EAAE,6BAA6B,EAAE,KAAK,GAAI,EAAE,KAAM,CAAC,CACnF,CACD,CACA,SAAS,GAAE,EAAG,GAAG,EAAG,CACnB,GAAI,CACH,GAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CACrB,OAAS,EAAG,CACX,MAAM,IAAI,EAAE,+BAA+B,EAAE,KAAK,GAAI,EAAE,KAAM,CAAC,CAChE,CACD,sbChPO,IAAA,EAAA,KAAqB,CAM1B,YAAY,EAA8B,CACxC,KAAK,cAAgB,EAErB,KAAK,OAAS,EAAO,CAAa,CAAC,CAAC,WAAW,gBAAgB,EAC/D,KAAK,cAAgB,KAAK,qBAAqB,CACjD,CASA,sBAAkD,CAChD,IAAM,EAAS,KAAK,cAAc,cAC5B,EAAU,MAAM,QAAQ,CAAM,EAAI,EAAS,CAAC,CAAM,EAIxD,GAAI,EAFF,EAAQ,OAAS,GACjB,EAAQ,MAAO,GAAM,OAAO,GAAM,UAAY,EAAE,KAAK,CAAC,CAAC,OAAS,CAAC,GAEjE,MAAU,MACR,0NAIF,EAQF,OANK,EAAqB,KAAM,GAAM,EAAE,OAAS,EAAE,GACjD,KAAK,OAAO,KACV,8HAEF,EAEK,CACT,CAEA,MAAM,YAAY,EAA+B,EAI3C,EAAA,EAAA,WAAA,CAFgD,CAE/C,EA0BH,KAAK,OAAO,MACV,iDACF,GA3BA,KAAK,OAAO,MAAM,sCAAsC,EAGxD,AACE,KAAK,QAAQ,MAAA,EAAA,EAAA,qBAAA,CAA4C,KAAK,cAAc,MAAM,EAGpF,MAAA,EAAA,EAAA,WAAA,CAAkC,EAAO,CACvC,MAAO,KAAK,MACZ,OAAQ,KAAK,cACb,KAAM,KAAK,cAAc,YAAc,eACvC,OAAQ,KAAU,GAClB,OAAQ,CACN,SAAU,GACV,OAAA,QAAA,IAAA,WAAoC,aACpC,SAAU,KACZ,EAEA,cAAiB,CACf,KAAM,CACJ,gBAAiB,EACnB,CACF,EACF,CAAC,EAML,CAOA,MAAM,WAAW,EAAoD,CACnE,GAAI,CACF,IAAM,EAAc,MAAM,KAAK,MAAM,QAAQ,CAAS,EAOtD,OALK,EAKE,CACL,GAAI,EACJ,KAAM,EACN,KAAM,SAAY,CAChB,MAAM,KAAK,MAAM,QAAQ,EAAW,CAAW,CACjD,CACF,EAVS,IAWX,OAAS,EAAO,CAEd,OADA,KAAK,OAAO,MAAM,2BAA4B,EAAO,CAAE,WAAU,CAAC,EAC3D,IACT,CACF,CAMA,MAAM,mBAAmD,CACvD,GAAI,CAEF,IAAM,EAAc,MAAM,KAAK,MAAM,QAAQ,EAiC7C,OAAO,MA9BgB,QAAQ,IAC7B,EAAY,IAAI,KAAO,IAAQ,CAC7B,IAAM,EAAc,MAAM,KAAK,MAAM,QAAQ,CAAG,EAQhD,OAPK,EAOE,CACL,GALgB,KAAK,cAAc,QAAU,EAAI,WAAW,GAAG,KAAK,cAAc,OAAO,EAAE,EACzF,EAAI,UAAU,GAAG,KAAK,cAAc,OAAO,GAAG,MAAM,EACpD,EAIF,KAAM,EACN,OAAS,GAAwD,CAE/D,IAAM,EAAc,EAAQ,CAA8B,EAE1D,OAAO,OAAO,EAAa,CAAW,CACxC,EACA,KAAM,SAAY,CAChB,MAAM,KAAK,MAAM,QAAQ,EAAK,CAAW,CAC3C,EACA,QAAS,SACC,MAAM,KAAK,MAAM,QAAQ,CAAG,CAExC,EAtByB,IAuB3B,CAAC,CACH,EAAA,CAGgB,OAAQ,GAA2C,IAAY,IAAI,CACrF,OAAS,EAAO,CAEd,OADA,KAAK,OAAO,MAAM,mCAAoC,CAAK,EACpD,CAAC,CACV,CACF,CAEA,MAAM,mBAAmB,EAA+B,CACtD,GAAI,CACF,MAAM,KAAK,YAAY,CAAK,GAK5B,EAAA,EAAA,WAAA,CAFgD,CAE5C,CAAA,EAAa,MAEf,MAAA,EAAA,EAAA,cAAA,CAAqC,EAAQ,GAAS,CACpD,IAAM,EAAc,CAAE,GAAG,CAAK,EAE9B,OADA,OAAO,EAAY,KACZ,CACT,CAAC,EAIH,MAAA,EAAA,EAAA,eAAA,CAAqB,CAAK,CAE5B,OAAS,EAAO,CAEd,MADA,KAAK,OAAO,MAAM,6BAA8B,CAAK,GACrD,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,yBACX,CAAC,CACH,CACF,CAEA,MAAM,eACJ,EACA,EACmB,CACnB,MAAM,KAAK,YAAY,CAAK,EAE5B,IAAM,GAAA,EAAA,EAAA,WAAA,CAA0C,CAAK,EAOrD,OALA,KAAK,OAAO,MACV,yBACA,CACF,EAEQ,IAAc,IAAc,IACtC,CAEA,MAAM,eACJ,EACA,EACA,EACe,CACf,MAAM,KAAK,YAAY,CAAK,EAE5B,MAAA,EAAA,EAAA,cAAA,CAAqC,EAAQ,IAAU,CACrD,GAAG,GACF,GAAM,CACT,EAAE,CACJ,CAEA,MAAM,eAAe,EAAkC,CAGrD,OAFA,MAAM,KAAK,YAAY,CAAK,EAErB,CAAC,EAAA,EAAA,EAAA,WAAA,CADwC,CACvC,CACX,CACF,QAxNC,GAAW,EAAA,GAAA,oBAAA,CAAA,MAAA,CAAA,CAAA,EAAA,CAAA,ECdZ,IAAa,GAAU,IAAI,YACd,EAAU,IAAI,YAE3B,SAAgB,GAAO,GAAG,EAAS,CAC/B,IAAM,EAAO,EAAQ,QAAQ,EAAK,CAAE,YAAa,EAAM,EAAQ,CAAC,EAC1D,EAAM,IAAI,WAAW,CAAI,EAC3B,EAAI,EACR,IAAK,IAAM,KAAU,EACjB,EAAI,IAAI,EAAQ,CAAC,EACjB,GAAK,EAAO,OAEhB,OAAO,CACX,CAoBA,SAAgB,EAAO,EAAQ,CAC3B,IAAM,EAAQ,IAAI,WAAW,EAAO,MAAM,EAC1C,IAAK,IAAI,EAAI,EAAG,EAAI,EAAO,OAAQ,IAAK,CACpC,IAAM,EAAO,EAAO,WAAW,CAAC,EAChC,GAAI,EAAO,IACP,MAAU,UAAU,0CAA0C,EAElE,EAAM,GAAK,CACf,CACA,OAAO,CACX,CC/BA,SAAgB,GAAa,EAAS,CAClC,GAAI,WAAW,WACX,OAAO,WAAW,WAAW,CAAO,EAExC,IAAM,EAAS,KAAK,CAAO,EACrB,EAAQ,IAAI,WAAW,EAAO,MAAM,EAC1C,IAAK,IAAI,EAAI,EAAG,EAAI,EAAO,OAAQ,IAC/B,EAAM,GAAK,EAAO,WAAW,CAAC,EAElC,OAAO,CACX,CCnBA,SAAgB,EAAO,EAAO,CAC1B,GAAI,WAAW,WACX,OAAO,WAAW,WAAW,OAAO,GAAU,SAAW,EAAQ,EAAQ,OAAO,CAAK,EAAG,CACpF,SAAU,WACd,CAAC,EAEL,IAAI,EAAU,EACV,aAAmB,aACnB,EAAU,EAAQ,OAAO,CAAO,GAEpC,EAAU,EAAQ,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EACtD,GAAI,CACA,OAAO,GAAa,CAAO,CAC/B,MACM,CACF,MAAU,UAAU,mDAAmD,CAC3E,CACJ,CCnBA,IAAM,GAAY,EAAM,EAAO,mBAAyB,UAAU,kDAAkD,EAAK,WAAW,GAAM,EACpI,GAAe,EAAW,IAAS,EAAU,OAAS,EAC5D,SAAS,GAAc,EAAM,CACzB,OAAO,SAAS,EAAK,KAAK,MAAM,CAAC,EAAG,EAAE,CAC1C,CACA,SAAS,EAAgB,EAAW,EAAU,CAE1C,GADe,GAAc,EAAU,IAC9B,IAAM,EACX,MAAM,EAAS,OAAO,IAAY,gBAAgB,CAC1D,CACA,SAAS,GAAc,EAAK,CACxB,OAAQ,EAAR,CACI,IAAK,QACD,MAAO,QACX,IAAK,QACD,MAAO,QACX,IAAK,QACD,MAAO,QACX,QACI,MAAU,MAAM,aAAa,CACrC,CACJ,CACA,SAAS,GAAW,EAAK,EAAO,CAC5B,GAAI,GAAS,CAAC,EAAI,OAAO,SAAS,CAAK,EACnC,MAAU,UAAU,sEAAsE,EAAM,EAAE,CAE1G,CACA,SAAgB,GAAkB,EAAK,EAAK,EAAO,CAC/C,OAAQ,EAAR,CACI,IAAK,QACL,IAAK,QACL,IAAK,QACD,GAAI,CAAC,EAAY,EAAI,UAAW,MAAM,EAClC,MAAM,EAAS,MAAM,EACzB,EAAgB,EAAI,UAAW,SAAS,EAAI,MAAM,CAAC,EAAG,EAAE,CAAC,EACzD,MAEJ,IAAK,QACL,IAAK,QACL,IAAK,QACD,GAAI,CAAC,EAAY,EAAI,UAAW,mBAAmB,EAC/C,MAAM,EAAS,mBAAmB,EACtC,EAAgB,EAAI,UAAW,SAAS,EAAI,MAAM,CAAC,EAAG,EAAE,CAAC,EACzD,MAEJ,IAAK,QACL,IAAK,QACL,IAAK,QACD,GAAI,CAAC,EAAY,EAAI,UAAW,SAAS,EACrC,MAAM,EAAS,SAAS,EAC5B,EAAgB,EAAI,UAAW,SAAS,EAAI,MAAM,CAAC,EAAG,EAAE,CAAC,EACzD,MAEJ,IAAK,UACL,IAAK,QACD,GAAI,CAAC,EAAY,EAAI,UAAW,SAAS,EACrC,MAAM,EAAS,SAAS,EAC5B,MAEJ,IAAK,YACL,IAAK,YACL,IAAK,YACD,GAAI,CAAC,EAAY,EAAI,UAAW,CAAG,EAC/B,MAAM,EAAS,CAAG,EACtB,MAEJ,IAAK,QACL,IAAK,QACL,IAAK,QAAS,CACV,GAAI,CAAC,EAAY,EAAI,UAAW,OAAO,EACnC,MAAM,EAAS,OAAO,EAC1B,IAAM,EAAW,GAAc,CAAG,EAElC,GADe,EAAI,UAAU,aACd,EACX,MAAM,EAAS,EAAU,sBAAsB,EACnD,KACJ,CACA,QACI,MAAU,UAAU,2CAA2C,CACvE,CACA,GAAW,EAAK,CAAK,CACzB,CCjFA,SAAS,GAAQ,EAAK,EAAQ,GAAG,EAAO,CAEpC,GADA,EAAQ,EAAM,OAAO,OAAO,EACxB,EAAM,OAAS,EAAG,CAClB,IAAM,EAAO,EAAM,IAAI,EACvB,GAAO,eAAe,EAAM,KAAK,IAAI,EAAE,OAAO,EAAK,EACvD,MACS,EAAM,SAAW,EACtB,GAAO,eAAe,EAAM,GAAG,MAAM,EAAM,GAAG,GAG9C,GAAO,WAAW,EAAM,GAAG,GAa/B,OAXI,GAAU,KACV,GAAO,aAAa,IAEf,OAAO,GAAW,YAAc,EAAO,KAC5C,GAAO,sBAAsB,EAAO,OAE/B,OAAO,GAAW,UAAY,GAC/B,EAAO,aAAa,OACpB,GAAO,4BAA4B,EAAO,YAAY,QAGvD,CACX,CACA,IAAa,IAAmB,EAAQ,GAAG,IAAU,GAAQ,eAAgB,EAAQ,GAAG,CAAK,EAChF,IAAW,EAAK,EAAQ,GAAG,IAAU,GAAQ,eAAe,EAAI,qBAAsB,EAAQ,GAAG,CAAK,EC1BtG,EAAb,cAA+B,KAAM,CACjC,OAAO,KAAO,mBACd,KAAO,mBACP,YAAY,EAAS,EAAS,CAC1B,MAAM,EAAS,CAAO,EACtB,KAAK,KAAO,KAAK,YAAY,KAC7B,MAAM,oBAAoB,KAAM,KAAK,WAAW,CACpD,CACJ,EACa,EAAb,cAA8C,CAAU,CACpD,OAAO,KAAO,kCACd,KAAO,kCACP,MACA,OACA,QACA,YAAY,EAAS,EAAS,EAAQ,cAAe,EAAS,cAAe,CACzE,MAAM,EAAS,CAAE,MAAO,CAAE,QAAO,SAAQ,SAAQ,CAAE,CAAC,EACpD,KAAK,MAAQ,EACb,KAAK,OAAS,EACd,KAAK,QAAU,CACnB,CACJ,EACa,GAAb,cAAgC,CAAU,CACtC,OAAO,KAAO,kBACd,KAAO,kBACP,MACA,OACA,QACA,YAAY,EAAS,EAAS,EAAQ,cAAe,EAAS,cAAe,CACzE,MAAM,EAAS,CAAE,MAAO,CAAE,QAAO,SAAQ,SAAQ,CAAE,CAAC,EACpD,KAAK,MAAQ,EACb,KAAK,OAAS,EACd,KAAK,QAAU,CACnB,CACJ,EACa,GAAb,cAAuC,CAAU,CAC7C,OAAO,KAAO,2BACd,KAAO,0BACX,EACa,EAAb,cAAsC,CAAU,CAC5C,OAAO,KAAO,yBACd,KAAO,wBACX,EAYa,EAAb,cAAgC,CAAU,CACtC,OAAO,KAAO,kBACd,KAAO,iBACX,EACa,GAAb,cAAgC,CAAU,CACtC,OAAO,KAAO,kBACd,KAAO,iBACX,EAKa,GAAb,cAAiC,CAAU,CACvC,OAAO,KAAO,mBACd,KAAO,kBACX,EACa,GAAb,cAAuC,CAAU,CAC7C,OAAO,KAAO,2BACd,KAAO,2BACP,YAAY,EAAU,kDAAmD,EAAS,CAC9E,MAAM,EAAS,CAAO,CAC1B,CACJ,EACa,GAAb,cAA8C,CAAU,CACpD,CAAC,OAAO,eACR,OAAO,KAAO,kCACd,KAAO,kCACP,YAAY,EAAU,uDAAwD,EAAS,CACnF,MAAM,EAAS,CAAO,CAC1B,CACJ,EACa,GAAb,cAAiC,CAAU,CACvC,OAAO,KAAO,mBACd,KAAO,mBACP,YAAY,EAAU,oBAAqB,EAAS,CAChD,MAAM,EAAS,CAAO,CAC1B,CACJ,EACa,GAAb,cAAoD,CAAU,CAC1D,OAAO,KAAO,wCACd,KAAO,wCACP,YAAY,EAAU,gCAAiC,EAAS,CAC5D,MAAM,EAAS,CAAO,CAC1B,CACJ,EC7Fa,GAAe,GAAQ,CAChC,GAAI,IAAM,OAAO,eAAiB,YAC9B,MAAO,GACX,GAAI,CACA,OAAO,aAAe,SAC1B,MACM,CACF,MAAO,EACX,CACJ,EACa,GAAe,GAAQ,IAAM,OAAO,eAAiB,YACrD,GAAa,GAAQ,GAAY,CAAG,GAAK,GAAY,CAAG,ECTrE,SAAgB,GAAgB,EAAO,EAAO,EAAY,CACtD,GAAI,CACA,OAAO,EAAO,CAAK,CACvB,MACM,CACF,MAAM,IAAI,EAAW,kCAAkC,GAAO,CAClE,CACJ,CCdA,IAAM,GAAgB,GAAU,OAAO,GAAU,YAAY,EAC7D,SAAgB,EAAS,EAAO,CAC5B,GAAI,CAAC,GAAa,CAAK,GAAK,OAAO,UAAU,SAAS,KAAK,CAAK,IAAM,kBAClE,MAAO,GAEX,GAAI,OAAO,eAAe,CAAK,IAAM,KACjC,MAAO,GAEX,IAAI,EAAQ,EACZ,KAAO,OAAO,eAAe,CAAK,IAAM,MACpC,EAAQ,OAAO,eAAe,CAAK,EAEvC,OAAO,OAAO,eAAe,CAAK,IAAM,CAC5C,CACA,SAAgB,GAAW,GAAG,EAAS,CACnC,IAAM,EAAU,EAAQ,OAAO,OAAO,EACtC,GAAI,EAAQ,SAAW,GAAK,EAAQ,SAAW,EAC3C,MAAO,GAEX,IAAI,EACJ,IAAK,IAAM,KAAU,EAAS,CAC1B,IAAM,EAAa,OAAO,KAAK,CAAM,EACrC,GAAI,CAAC,GAAO,EAAI,OAAS,EAAG,CACxB,EAAM,IAAI,IAAI,CAAU,EACxB,QACJ,CACA,IAAK,IAAM,KAAa,EAAY,CAChC,GAAI,EAAI,IAAI,CAAS,EACjB,MAAO,GAEX,EAAI,IAAI,CAAS,CACrB,CACJ,CACA,MAAO,EACX,CACA,IAAa,EAAS,GAAQ,EAAS,CAAG,GAAK,OAAO,EAAI,KAAQ,SACrD,GAAgB,GAAQ,EAAI,MAAQ,QAC3C,EAAI,MAAQ,OAAS,OAAO,EAAI,MAAS,UAAa,OAAO,EAAI,GAAM,UAChE,GAAe,GAAQ,EAAI,MAAQ,OAAS,EAAI,IAAM,IAAA,IAAa,EAAI,OAAS,IAAA,GAChF,GAAe,GAAQ,EAAI,MAAQ,OAAS,OAAO,EAAI,GAAM,SCpC1E,SAAgB,GAAe,EAAK,EAAK,CACrC,GAAI,EAAI,WAAW,IAAI,GAAK,EAAI,WAAW,IAAI,EAAG,CAC9C,GAAM,CAAE,iBAAkB,EAAI,UAC9B,GAAI,OAAO,GAAkB,UAAY,EAAgB,KACrD,MAAU,UAAU,GAAG,EAAI,sDAAsD,CAEzF,CACJ,CACA,SAAS,GAAgB,EAAK,EAAW,CACrC,IAAM,EAAO,OAAO,EAAI,MAAM,EAAE,IAChC,OAAQ,EAAR,CACI,IAAK,QACL,IAAK,QACL,IAAK,QACD,MAAO,CAAE,OAAM,KAAM,MAAO,EAChC,IAAK,QACL,IAAK,QACL,IAAK,QACD,MAAO,CAAE,OAAM,KAAM,UAAW,WAAY,SAAS,EAAI,MAAM,EAAE,EAAG,EAAE,GAAK,CAAE,EACjF,IAAK,QACL,IAAK,QACL,IAAK,QACD,MAAO,CAAE,OAAM,KAAM,mBAAoB,EAC7C,IAAK,QACL,IAAK,QACL,IAAK,QACD,MAAO,CAAE,OAAM,KAAM,QAAS,WAAY,EAAU,UAAW,EACnE,IAAK,UACL,IAAK,QACD,MAAO,CAAE,KAAM,SAAU,EAC7B,IAAK,YACL,IAAK,YACL,IAAK,YACD,MAAO,CAAE,KAAM,CAAI,EACvB,QACI,MAAM,IAAI,EAAiB,OAAO,EAAI,4DAA4D,CAC1G,CACJ,CACA,eAAe,GAAU,EAAK,EAAK,EAAO,CACtC,GAAI,aAAe,WAAY,CAC3B,GAAI,CAAC,EAAI,WAAW,IAAI,EACpB,MAAU,UAAU,GAAgB,EAAK,YAAa,YAAa,cAAc,CAAC,EAEtF,OAAO,OAAO,OAAO,UAAU,MAAO,EAAK,CAAE,KAAM,OAAO,EAAI,MAAM,EAAE,IAAK,KAAM,MAAO,EAAG,GAAO,CAAC,CAAK,CAAC,CAC7G,CAEA,OADA,GAAkB,EAAK,EAAK,CAAK,EAC1B,CACX,CAOA,eAAsB,GAAO,EAAK,EAAK,EAAW,EAAM,CACpD,IAAM,EAAY,MAAM,GAAU,EAAK,EAAK,QAAQ,EACpD,GAAe,EAAK,CAAS,EAC7B,IAAM,EAAY,GAAgB,EAAK,EAAU,SAAS,EAC1D,GAAI,CACA,OAAO,MAAM,OAAO,OAAO,OAAO,EAAW,EAAW,EAAW,CAAI,CAC3E,MACM,CACF,MAAO,EACX,CACJ,CClEA,IAAM,EAAiB,+DACvB,SAAS,GAAc,EAAK,CACxB,IAAI,EACA,EACJ,OAAQ,EAAI,IAAZ,CACI,IAAK,MACD,OAAQ,EAAI,IAAZ,CACI,IAAK,YACL,IAAK,YACL,IAAK,YACD,EAAY,CAAE,KAAM,EAAI,GAAI,EAC5B,EAAY,EAAI,KAAO,CAAC,MAAM,EAAI,CAAC,QAAQ,EAC3C,MACJ,QACI,MAAM,IAAI,EAAiB,CAAc,CACjD,CACA,MAEJ,IAAK,MACD,OAAQ,EAAI,IAAZ,CACI,IAAK,QACL,IAAK,QACL,IAAK,QACD,EAAY,CAAE,KAAM,UAAW,KAAM,OAAO,EAAI,IAAI,MAAM,EAAE,GAAI,EAChE,EAAY,EAAI,EAAI,CAAC,MAAM,EAAI,CAAC,QAAQ,EACxC,MACJ,IAAK,QACL,IAAK,QACL,IAAK,QACD,EAAY,CAAE,KAAM,oBAAqB,KAAM,OAAO,EAAI,IAAI,MAAM,EAAE,GAAI,EAC1E,EAAY,EAAI,EAAI,CAAC,MAAM,EAAI,CAAC,QAAQ,EACxC,MACJ,IAAK,WACL,IAAK,eACL,IAAK,eACL,IAAK,eACD,EAAY,CACR,KAAM,WACN,KAAM,OAAO,SAAS,EAAI,IAAI,MAAM,EAAE,EAAG,EAAE,GAAK,GACpD,EACA,EAAY,EAAI,EAAI,CAAC,UAAW,WAAW,EAAI,CAAC,UAAW,SAAS,EACpE,MACJ,QACI,MAAM,IAAI,EAAiB,CAAc,CACjD,CACA,MAEJ,IAAK,KACD,OAAQ,EAAI,IAAZ,CACI,IAAK,QACL,IAAK,QACL,IAAK,QACD,EAAY,CACR,KAAM,QACN,WAAY,CAAE,MAAO,QAAS,MAAO,QAAS,MAAO,OAAQ,EAAE,EAAI,IACvE,EACA,EAAY,EAAI,EAAI,CAAC,MAAM,EAAI,CAAC,QAAQ,EACxC,MACJ,IAAK,UACL,IAAK,iBACL,IAAK,iBACL,IAAK,iBACD,EAAY,CAAE,KAAM,OAAQ,WAAY,EAAI,GAAI,EAChD,EAAY,EAAI,EAAI,CAAC,YAAY,EAAI,CAAC,EACtC,MACJ,QACI,MAAM,IAAI,EAAiB,CAAc,CACjD,CACA,MAEJ,IAAK,MACD,OAAQ,EAAI,IAAZ,CACI,IAAK,UACL,IAAK,QACD,EAAY,CAAE,KAAM,SAAU,EAC9B,EAAY,EAAI,EAAI,CAAC,MAAM,EAAI,CAAC,QAAQ,EACxC,MACJ,IAAK,UACL,IAAK,iBACL,IAAK,iBACL,IAAK,iBACD,EAAY,CAAE,KAAM,EAAI,GAAI,EAC5B,EAAY,EAAI,EAAI,CAAC,YAAY,EAAI,CAAC,EACtC,MACJ,QACI,MAAM,IAAI,EAAiB,CAAc,CACjD,CACA,MAEJ,QACI,MAAM,IAAI,EAAiB,6DAA6D,CAChG,CACA,MAAO,CAAE,YAAW,WAAU,CAClC,CACA,eAAsB,EAAS,EAAK,CAChC,GAAI,CAAC,EAAI,IACL,MAAU,UAAU,0DAA0D,EAElF,GAAM,CAAE,YAAW,aAAc,GAAc,CAAG,EAC5C,EAAU,CAAE,GAAG,CAAI,EAKzB,OAJI,EAAQ,MAAQ,OAChB,OAAO,EAAQ,IAEnB,OAAO,EAAQ,IACR,OAAO,OAAO,UAAU,MAAO,EAAS,EAAW,EAAI,KAAQ,IAAI,GAAK,EAAI,MAAsB,EAAI,SAAW,CAAS,CACrI,CCtGA,IAAM,EAAiB,6DACnB,EACE,GAAY,MAAO,EAAK,EAAK,EAAK,EAAS,KAAU,CACvD,IAAU,IAAI,QACd,IAAI,EAAS,EAAM,IAAI,CAAG,EAC1B,GAAI,IAAS,GACT,OAAO,EAAO,GAElB,IAAM,EAAY,MAAM,EAAS,CAAE,GAAG,EAAK,KAAI,CAAC,EAShD,OARI,GACA,OAAO,OAAO,CAAG,EAChB,EAID,EAAO,GAAO,EAHd,EAAM,IAAI,EAAK,EAAG,GAAM,CAAU,CAAC,EAKhC,CACX,EACM,IAAmB,EAAW,IAAQ,CACxC,IAAU,IAAI,QACd,IAAI,EAAS,EAAM,IAAI,CAAS,EAChC,GAAI,IAAS,GACT,OAAO,EAAO,GAElB,IAAM,EAAW,EAAU,OAAS,SAC9B,EAAc,IAChB,EACJ,GAAI,EAAU,oBAAsB,SAAU,CAC1C,OAAQ,EAAR,CACI,IAAK,UACL,IAAK,iBACL,IAAK,iBACL,IAAK,iBACD,MACJ,QACI,MAAU,UAAU,CAAc,CAC1C,CACA,EAAY,EAAU,YAAY,EAAU,kBAAmB,EAAa,EAAW,CAAC,EAAI,CAAC,YAAY,CAAC,CAC9G,CACA,GAAI,EAAU,oBAAsB,UAAW,CAC3C,GAAI,IAAQ,SAAW,IAAQ,UAC3B,MAAU,UAAU,CAAc,EAEtC,EAAY,EAAU,YAAY,EAAU,kBAAmB,EAAa,CACxE,EAAW,SAAW,MAC1B,CAAC,CACL,CACA,OAAQ,EAAU,kBAAlB,CACI,IAAK,YACL,IAAK,YACL,IAAK,YACD,GAAI,IAAQ,EAAU,kBAAkB,YAAY,EAChD,MAAU,UAAU,CAAc,EAEtC,EAAY,EAAU,YAAY,EAAU,kBAAmB,EAAa,CACxE,EAAW,SAAW,MAC1B,CAAC,CAET,CACA,GAAI,EAAU,oBAAsB,MAAO,CACvC,IAAI,EACJ,OAAQ,EAAR,CACI,IAAK,WACD,EAAO,QACP,MACJ,IAAK,QACL,IAAK,QACL,IAAK,eACD,EAAO,UACP,MACJ,IAAK,QACL,IAAK,QACL,IAAK,eACD,EAAO,UACP,MACJ,IAAK,QACL,IAAK,QACL,IAAK,eACD,EAAO,UACP,MACJ,QACI,MAAU,UAAU,CAAc,CAC1C,CACA,GAAI,EAAI,WAAW,UAAU,EACzB,OAAO,EAAU,YAAY,CACzB,KAAM,WACN,MACJ,EAAG,EAAa,EAAW,CAAC,SAAS,EAAI,CAAC,SAAS,CAAC,EAExD,EAAY,EAAU,YAAY,CAC9B,KAAM,EAAI,WAAW,IAAI,EAAI,UAAY,oBACzC,MACJ,EAAG,EAAa,CAAC,EAAW,SAAW,MAAM,CAAC,CAClD,CACA,GAAI,EAAU,oBAAsB,KAAM,CAMtC,IAAM,EAAa,IALF,IAAI,CACjB,CAAC,aAAc,OAAO,EACtB,CAAC,YAAa,OAAO,EACrB,CAAC,YAAa,OAAO,CACzB,CACsB,CAAA,CAAE,IAAI,EAAU,sBAAsB,UAAU,EACtE,GAAI,CAAC,EACD,MAAU,UAAU,CAAc,EAEtC,IAAM,EAAgB,CAAE,MAAO,QAAS,MAAO,QAAS,MAAO,OAAQ,EACnE,EAAc,IAAQ,IAAe,EAAc,KACnD,EAAY,EAAU,YAAY,CAC9B,KAAM,QACN,YACJ,EAAG,EAAa,CAAC,EAAW,SAAW,MAAM,CAAC,GAE9C,EAAI,WAAW,SAAS,IACxB,EAAY,EAAU,YAAY,CAC9B,KAAM,OACN,YACJ,EAAG,EAAa,EAAW,CAAC,EAAI,CAAC,YAAY,CAAC,EAEtD,CACA,GAAI,CAAC,EACD,MAAU,UAAU,CAAc,EAQtC,OANK,EAID,EAAO,GAAO,EAHd,EAAM,IAAI,EAAW,EAAG,GAAM,CAAU,CAAC,EAKtC,CACX,EACA,eAAsB,GAAa,EAAK,EAAK,CAIzC,GAHI,aAAe,YAGf,GAAY,CAAG,EACf,OAAO,EAEX,GAAI,GAAY,CAAG,EAAG,CAClB,GAAI,EAAI,OAAS,SACb,OAAO,EAAI,OAAO,EAEtB,GAAI,gBAAiB,GAAO,OAAO,EAAI,aAAgB,WACnD,GAAI,CACA,OAAO,GAAgB,EAAK,CAAG,CACnC,OACO,EAAK,CACR,GAAI,aAAe,UACf,MAAM,CAEd,CAGJ,OAAO,GAAU,EADP,EAAI,OAAO,CAAE,OAAQ,KAAM,CACf,EAAK,CAAG,CAClC,CACA,GAAI,EAAM,CAAG,EAIT,OAHI,EAAI,EACG,EAAO,EAAI,CAAC,EAEhB,GAAU,EAAK,EAAK,EAAK,EAAI,EAExC,MAAU,MAAM,aAAa,CACjC,CC9IA,eAAsB,GAAU,EAAK,EAAK,EAAS,CAC/C,GAAI,CAAC,EAAS,CAAG,EACb,MAAU,UAAU,uBAAuB,EAE/C,IAAI,EAGJ,OAFA,IAAQ,EAAI,IACZ,IAAQ,GAAS,aAAe,EAAI,IAC5B,EAAI,IAAZ,CACI,IAAK,MACD,GAAI,OAAO,EAAI,GAAM,UAAY,CAAC,EAAI,EAClC,MAAU,UAAU,yCAAyC,EAEjE,OAAOO,EAAgB,EAAI,CAAC,EAChC,IAAK,MACD,GAAI,QAAS,GAAO,EAAI,MAAQ,IAAA,GAC5B,MAAM,IAAI,EAAiB,oEAAoE,EAEnG,OAAO,EAAS,CAAE,GAAG,EAAK,MAAK,KAAI,CAAC,EACxC,IAAK,MACD,GAAI,OAAO,EAAI,KAAQ,UAAY,CAAC,EAAI,IACpC,MAAU,UAAU,2CAA2C,EAEnE,GAAI,IAAQ,IAAA,IAAa,IAAQ,EAAI,IACjC,MAAU,UAAU,uCAAuC,EAE/D,OAAO,EAAS,CAAE,GAAG,EAAK,KAAI,CAAC,EAEnC,IAAK,KACL,IAAK,MACD,OAAO,EAAS,CAAE,GAAG,EAAK,MAAK,KAAI,CAAC,EACxC,QACI,MAAM,IAAI,EAAiB,8CAA8C,CACjF,CACJ,CCvDA,SAAgB,GAAa,EAAK,EAAmB,EAAkB,EAAiB,EAAY,CAChG,GAAI,EAAW,OAAS,IAAA,IAAa,GAAiB,OAAS,IAAA,GAC3D,MAAM,IAAI,EAAI,gEAAgE,EAElF,GAAI,CAAC,GAAmB,EAAgB,OAAS,IAAA,GAC7C,OAAO,IAAI,IAEf,GAAI,CAAC,MAAM,QAAQ,EAAgB,IAAI,GACnC,EAAgB,KAAK,SAAW,GAChC,EAAgB,KAAK,KAAM,GAAU,OAAO,GAAU,UAAY,EAAM,SAAW,CAAC,EACpF,MAAM,IAAI,EAAI,uFAAuF,EAEzG,IAAI,EACJ,AACI,EADA,IAAqB,IAAA,GAIR,EAHA,IAAI,IAAI,CAAC,GAAG,OAAO,QAAQ,CAAgB,EAAG,GAAG,EAAkB,QAAQ,CAAC,CAAC,EAK9F,IAAK,IAAM,KAAa,EAAgB,KAAM,CAC1C,GAAI,CAAC,EAAW,IAAI,CAAS,EACzB,MAAM,IAAI,EAAiB,+BAA+B,EAAU,oBAAoB,EAE5F,GAAI,EAAW,KAAe,IAAA,GAC1B,MAAM,IAAI,EAAI,+BAA+B,EAAU,aAAa,EAExE,GAAI,EAAW,IAAI,CAAS,GAAK,EAAgB,KAAe,IAAA,GAC5D,MAAM,IAAI,EAAI,+BAA+B,EAAU,8BAA8B,CAE7F,CACA,OAAO,IAAI,IAAI,EAAgB,IAAI,CACvC,CChCA,SAAgB,GAAmB,EAAQ,EAAY,CACnD,GAAI,IAAe,IAAA,KACd,CAAC,MAAM,QAAQ,CAAU,GAAK,EAAW,KAAM,GAAM,OAAO,GAAM,QAAQ,GAC3E,MAAU,UAAU,IAAI,EAAO,qCAAqC,EAEnE,KAGL,OAAO,IAAI,IAAI,CAAU,CAC7B,CCNA,IAAM,EAAO,GAAQ,IAAM,OAAO,aAC5B,GAAgB,EAAK,EAAK,IAAU,CACtC,GAAI,EAAI,MAAQ,IAAA,GAAW,CACvB,IAAI,EACJ,OAAQ,EAAR,CACI,IAAK,OACL,IAAK,SACD,EAAW,MACX,MACJ,IAAK,UACL,IAAK,UACD,EAAW,MACX,KACR,CACA,GAAI,EAAI,MAAQ,EACZ,MAAU,UAAU,sDAAsD,EAAS,eAAe,CAE1G,CACA,GAAI,EAAI,MAAQ,IAAA,IAAa,EAAI,MAAQ,EACrC,MAAU,UAAU,sDAAsD,EAAI,eAAe,EAEjG,GAAI,MAAM,QAAQ,EAAI,OAAO,EAAG,CAC5B,IAAI,EACJ,OAAQ,GAAR,CACI,KAAK,IAAU,QAAU,IAAU,SACnC,KAAK,IAAQ,MACb,KAAK,EAAI,SAAS,QAAQ,EACtB,EAAgB,EAChB,MACJ,KAAK,EAAI,WAAW,OAAO,EACvB,EAAgB,aAChB,MACJ,IAAK,0BAA0B,KAAK,CAAG,EACnC,AAII,EAJA,CAAC,EAAI,SAAS,KAAK,GAAK,EAAI,SAAS,IAAI,EACzB,IAAU,UAAY,UAAY,YAGlC,EAEpB,MACJ,KAAK,IAAU,WAAa,EAAI,WAAW,KAAK,EAC5C,EAAgB,UAChB,MACJ,KAAK,IAAU,UACX,EAAgB,EAAI,WAAW,KAAK,EAAI,YAAc,aACtD,KACR,CACA,GAAI,GAAiB,EAAI,SAAS,WAAW,CAAa,IAAM,GAC5D,MAAU,UAAU,+DAA+D,EAAc,eAAe,CAExH,CACA,MAAO,EACX,EACM,IAAsB,EAAK,EAAK,IAAU,CACxC,kBAAe,YAEnB,IAAIC,EAAU,CAAG,EAAG,CAChB,GAAIC,GAAgB,CAAG,GAAK,EAAa,EAAK,EAAK,CAAK,EACpD,OACJ,MAAU,UAAU,yHAAyH,CACjJ,CACA,GAAI,CAAC,GAAU,CAAG,EACd,MAAU,UAAUC,GAAgB,EAAK,EAAK,YAAa,YAAa,eAAgB,YAAY,CAAC,EAEzG,GAAI,EAAI,OAAS,SACb,MAAU,UAAU,GAAG,EAAI,CAAG,EAAE,6DAA6D,CALjG,CAOJ,EACM,IAAuB,EAAK,EAAK,IAAU,CAC7C,GAAIF,EAAU,CAAG,EACb,OAAQ,EAAR,CACI,IAAK,UACL,IAAK,OACD,GAAIG,GAAiB,CAAG,GAAK,EAAa,EAAK,EAAK,CAAK,EACrD,OACJ,MAAU,UAAU,uDAAuD,EAC/E,IAAK,UACL,IAAK,SACD,GAAIC,GAAgB,CAAG,GAAK,EAAa,EAAK,EAAK,CAAK,EACpD,OACJ,MAAU,UAAU,sDAAsD,CAClF,CAEJ,GAAI,CAAC,GAAU,CAAG,EACd,MAAU,UAAUF,GAAgB,EAAK,EAAK,YAAa,YAAa,cAAc,CAAC,EAE3F,GAAI,EAAI,OAAS,SACb,MAAU,UAAU,GAAG,EAAI,CAAG,EAAE,kEAAkE,EAEtG,GAAI,EAAI,OAAS,SACb,OAAQ,EAAR,CACI,IAAK,OACD,MAAU,UAAU,GAAG,EAAI,CAAG,EAAE,sEAAsE,EAC1G,IAAK,UACD,MAAU,UAAU,GAAG,EAAI,CAAG,EAAE,yEAAyE,CACjH,CAEJ,GAAI,EAAI,OAAS,UACb,OAAQ,EAAR,CACI,IAAK,SACD,MAAU,UAAU,GAAG,EAAI,CAAG,EAAE,uEAAuE,EAC3G,IAAK,UACD,MAAU,UAAU,GAAG,EAAI,CAAG,EAAE,wEAAwE,CAChH,CAER,EACA,SAAgB,GAAa,EAAK,EAAK,EAAO,CAC1C,OAAQ,EAAI,UAAU,EAAG,CAAC,EAA1B,CACI,IAAK,KACL,IAAK,KACL,IAAK,KACL,IAAK,KACL,IAAK,KACD,GAAmB,EAAK,EAAK,CAAK,EAClC,MACJ,QACI,GAAoB,EAAK,EAAK,CAAK,CAC3C,CACJ,CC9GA,eAAsB,GAAgB,EAAK,EAAK,EAAS,CACrD,GAAI,CAAC,EAAS,CAAG,EACb,MAAM,IAAI,EAAW,iCAAiC,EAE1D,GAAI,EAAI,YAAc,IAAA,IAAa,EAAI,SAAW,IAAA,GAC9C,MAAM,IAAI,EAAW,uEAAuE,EAEhG,GAAI,EAAI,YAAc,IAAA,IAAa,OAAO,EAAI,WAAc,SACxD,MAAM,IAAI,EAAW,qCAAqC,EAE9D,GAAI,EAAI,UAAY,IAAA,GAChB,MAAM,IAAI,EAAW,qBAAqB,EAE9C,GAAI,OAAO,EAAI,WAAc,SACzB,MAAM,IAAI,EAAW,yCAAyC,EAElE,GAAI,EAAI,SAAW,IAAA,IAAa,CAAC,EAAS,EAAI,MAAM,EAChD,MAAM,IAAI,EAAW,uCAAuC,EAEhE,IAAI,EAAa,CAAC,EAClB,GAAI,EAAI,UACJ,GAAI,CACA,IAAM,EAAkBG,EAAK,EAAI,SAAS,EAC1C,EAAa,KAAK,MAAM,EAAQ,OAAO,CAAe,CAAC,CAC3D,MACM,CACF,MAAM,IAAI,EAAW,iCAAiC,CAC1D,CAEJ,GAAI,CAAC,GAAW,EAAY,EAAI,MAAM,EAClC,MAAM,IAAI,EAAW,2EAA2E,EAEpG,IAAM,EAAa,CACf,GAAG,EACH,GAAG,EAAI,MACX,EACM,EAAa,GAAa,EAAY,IAAI,IAAI,CAAC,CAAC,MAAO,EAAI,CAAC,CAAC,EAAG,GAAS,KAAM,EAAY,CAAU,EACvG,EAAM,GACV,GAAI,EAAW,IAAI,KAAK,IACpB,EAAM,EAAW,IACb,OAAO,GAAQ,WACf,MAAM,IAAI,EAAW,yEAAyE,EAGtG,GAAM,CAAE,OAAQ,EAChB,GAAI,OAAO,GAAQ,UAAY,CAAC,EAC5B,MAAM,IAAI,EAAW,2DAA2D,EAEpF,IAAM,EAAa,GAAW,GAAmB,aAAc,EAAQ,UAAU,EACjF,GAAI,GAAc,CAAC,EAAW,IAAI,CAAG,EACjC,MAAM,IAAI,GAAkB,sDAAsD,EAEtF,GAAI,MACI,OAAO,EAAI,SAAY,SACvB,MAAM,IAAI,EAAW,8BAA8B,CAAA,MAGtD,GAAI,OAAO,EAAI,SAAY,UAAY,EAAE,EAAI,mBAAmB,YACjE,MAAM,IAAI,EAAW,wDAAwD,EAEjF,IAAI,EAAc,GACd,OAAO,GAAQ,aACf,EAAM,MAAM,EAAI,EAAY,CAAG,EAC/B,EAAc,IAElB,GAAa,EAAK,EAAK,QAAQ,EAC/B,IAAM,EAAO,GAAO,EAAI,YAAc,IAAA,GAAoC,IAAI,WAA5B,EAAO,EAAI,SAAS,EAAsB,EAAO,GAAG,EAAG,OAAO,EAAI,SAAY,SAC1H,EACI,EAAO,EAAI,OAAO,EAClB,GAAQ,OAAO,EAAI,OAAO,EAC9B,EAAI,OAAO,EACX,EAAY,GAAgB,EAAI,UAAW,YAAa,CAAU,EAClE,EAAI,MAAM,GAAa,EAAK,CAAG,EAErC,GAAI,CAAC,MADkB,GAAO,EAAK,EAAG,EAAW,CAAI,EAEjD,MAAM,IAAI,GAEd,IAAI,EACJ,AAOI,EAPA,EACU,GAAgB,EAAI,QAAS,UAAW,CAAU,EAEvD,OAAO,EAAI,SAAY,SAClB,GAAQ,OAAO,EAAI,OAAO,EAG1B,EAAI,QAElB,IAAM,EAAS,CAAE,SAAQ,EAUzB,OATI,EAAI,YAAc,IAAA,KAClB,EAAO,gBAAkB,GAEzB,EAAI,SAAW,IAAA,KACf,EAAO,kBAAoB,EAAI,QAE/B,EACO,CAAE,GAAG,EAAQ,IAAK,CAAE,EAExB,CACX,CC1GA,eAAsB,GAAc,EAAK,EAAK,EAAS,CAInD,GAHI,aAAe,aACf,EAAM,EAAQ,OAAO,CAAG,GAExB,OAAO,GAAQ,SACf,MAAM,IAAI,EAAW,4CAA4C,EAErE,GAAM,CAAE,EAAG,EAAiB,EAAG,EAAS,EAAG,EAAW,UAAW,EAAI,MAAM,GAAG,EAC9E,GAAI,IAAW,EACX,MAAM,IAAI,EAAW,qBAAqB,EAE9C,IAAM,EAAW,MAAM,GAAgB,CAAE,UAAS,UAAW,EAAiB,WAAU,EAAG,EAAK,CAAO,EACjG,EAAS,CAAE,QAAS,EAAS,QAAS,gBAAiB,EAAS,eAAgB,EAItF,OAHI,OAAO,GAAQ,WACR,CAAE,GAAG,EAAQ,IAAK,EAAS,GAAI,EAEnC,CACX,CCjBA,IAAM,GAAS,GAAS,KAAK,MAAM,EAAK,QAAQ,EAAI,GAAI,EAClD,GAAS,GACT,GAAO,GAAS,GAChB,EAAM,GAAO,GACb,GAAO,EAAM,EACb,GAAO,EAAM,OACb,GAAQ,oIACd,SAAgB,GAAK,EAAK,CACtB,IAAM,EAAU,GAAM,KAAK,CAAG,EAC9B,GAAI,CAAC,GAAY,EAAQ,IAAM,EAAQ,GACnC,MAAU,UAAU,4BAA4B,EAEpD,IAAM,EAAQ,WAAW,EAAQ,EAAE,EAC7B,EAAO,EAAQ,EAAE,CAAC,YAAY,EAChC,EACJ,OAAQ,EAAR,CACI,IAAK,MACL,IAAK,OACL,IAAK,SACL,IAAK,UACL,IAAK,IACD,EAAc,KAAK,MAAM,CAAK,EAC9B,MACJ,IAAK,SACL,IAAK,UACL,IAAK,MACL,IAAK,OACL,IAAK,IACD,EAAc,KAAK,MAAM,EAAQ,EAAM,EACvC,MACJ,IAAK,OACL,IAAK,QACL,IAAK,KACL,IAAK,MACL,IAAK,IACD,EAAc,KAAK,MAAM,EAAQ,EAAI,EACrC,MACJ,IAAK,MACL,IAAK,OACL,IAAK,IACD,EAAc,KAAK,MAAM,EAAQ,CAAG,EACpC,MACJ,IAAK,OACL,IAAK,QACL,IAAK,IACD,EAAc,KAAK,MAAM,EAAQ,EAAI,EACrC,MACJ,QACI,EAAc,KAAK,MAAM,EAAQ,EAAI,EACrC,KACR,CAIA,OAHI,EAAQ,KAAO,KAAO,EAAQ,KAAO,MAC9B,CAAC,EAEL,CACX,CAOA,IAAM,GAAgB,GACd,EAAM,SAAS,GAAG,EACX,EAAM,YAAY,EAEtB,eAAe,EAAM,YAAY,IAEtC,IAAyB,EAAY,IACnC,OAAO,GAAe,SACf,EAAU,SAAS,CAAU,EAEpC,MAAM,QAAQ,CAAU,EACjB,EAAU,KAAK,IAAI,UAAU,IAAI,KAAK,IAAI,IAAI,CAAU,CAAC,CAAC,EAE9D,GAEX,SAAgB,GAAkB,EAAiB,EAAgB,EAAU,CAAC,EAAG,CAC7E,IAAI,EACJ,GAAI,CACA,EAAU,KAAK,MAAM,EAAQ,OAAO,CAAc,CAAC,CACvD,MACM,CACN,CACA,GAAI,CAAC,EAAS,CAAO,EACjB,MAAM,IAAI,GAAW,gDAAgD,EAEzE,GAAM,CAAE,OAAQ,EAChB,GAAI,IACC,OAAO,EAAgB,KAAQ,UAC5B,GAAa,EAAgB,GAAG,IAAM,GAAa,CAAG,GAC1D,MAAM,IAAI,EAAyB,oCAAqC,EAAS,MAAO,cAAc,EAE1G,GAAM,CAAE,iBAAiB,CAAC,EAAG,SAAQ,UAAS,WAAU,eAAgB,EAClE,EAAgB,CAAC,GAAG,CAAc,EACpC,IAAgB,IAAA,IAChB,EAAc,KAAK,KAAK,EACxB,IAAa,IAAA,IACb,EAAc,KAAK,KAAK,EACxB,IAAY,IAAA,IACZ,EAAc,KAAK,KAAK,EACxB,IAAW,IAAA,IACX,EAAc,KAAK,KAAK,EAC5B,IAAK,IAAM,KAAS,IAAI,IAAI,EAAc,QAAQ,CAAC,EAC/C,GAAI,EAAE,KAAS,GACX,MAAM,IAAI,EAAyB,qBAAqB,EAAM,SAAU,EAAS,EAAO,SAAS,EAGzG,GAAI,GACA,EAAE,MAAM,QAAQ,CAAM,EAAI,EAAS,CAAC,CAAM,EAAA,CAAG,SAAS,EAAQ,GAAG,EACjE,MAAM,IAAI,EAAyB,+BAAgC,EAAS,MAAO,cAAc,EAErG,GAAI,GAAW,EAAQ,MAAQ,EAC3B,MAAM,IAAI,EAAyB,+BAAgC,EAAS,MAAO,cAAc,EAErG,GAAI,GACA,CAAC,GAAsB,EAAQ,IAAK,OAAO,GAAa,SAAW,CAAC,CAAQ,EAAI,CAAQ,EACxF,MAAM,IAAI,EAAyB,+BAAgC,EAAS,MAAO,cAAc,EAErG,IAAI,EACJ,OAAQ,OAAO,EAAQ,eAAvB,CACI,IAAK,SACD,EAAY,GAAK,EAAQ,cAAc,EACvC,MACJ,IAAK,SACD,EAAY,EAAQ,eACpB,MACJ,IAAK,YACD,EAAY,EACZ,MACJ,QACI,MAAU,UAAU,oCAAoC,CAChE,CACA,GAAM,CAAE,eAAgB,EAClB,EAAM,GAAM,GAAe,IAAI,IAAM,EAC3C,IAAK,EAAQ,MAAQ,IAAA,IAAa,IAAgB,OAAO,EAAQ,KAAQ,SACrE,MAAM,IAAI,EAAyB,+BAAgC,EAAS,MAAO,SAAS,EAEhG,GAAI,EAAQ,MAAQ,IAAA,GAAW,CAC3B,GAAI,OAAO,EAAQ,KAAQ,SACvB,MAAM,IAAI,EAAyB,+BAAgC,EAAS,MAAO,SAAS,EAEhG,GAAI,EAAQ,IAAM,EAAM,EACpB,MAAM,IAAI,EAAyB,qCAAsC,EAAS,MAAO,cAAc,CAE/G,CACA,GAAI,EAAQ,MAAQ,IAAA,GAAW,CAC3B,GAAI,OAAO,EAAQ,KAAQ,SACvB,MAAM,IAAI,EAAyB,+BAAgC,EAAS,MAAO,SAAS,EAEhG,GAAI,EAAQ,KAAO,EAAM,EACrB,MAAM,IAAI,GAAW,qCAAsC,EAAS,MAAO,cAAc,CAEjG,CACA,GAAI,EAAa,CACb,IAAM,EAAM,EAAM,EAAQ,IACpB,EAAM,OAAO,GAAgB,SAAW,EAAc,GAAK,CAAW,EAC5E,GAAI,EAAM,EAAY,EAClB,MAAM,IAAI,GAAW,2DAA4D,EAAS,MAAO,cAAc,EAEnH,GAAI,EAAM,EAAI,EACV,MAAM,IAAI,EAAyB,gEAAiE,EAAS,MAAO,cAAc,CAE1I,CACA,OAAO,CACX,CCrKA,eAAsB,GAAU,EAAK,EAAK,EAAS,CAC/C,IAAM,EAAW,MAAM,GAAc,EAAK,EAAK,CAAO,EACtD,GAAI,EAAS,gBAAgB,MAAM,SAAS,KAAK,GAAK,EAAS,gBAAgB,MAAQ,GACnF,MAAM,IAAI,GAAW,qCAAqC,EAG9D,IAAM,EAAS,CAAE,QADD,GAAkB,EAAS,gBAAiB,EAAS,QAAS,CACvD,EAAG,gBAAiB,EAAS,eAAgB,EAIpE,OAHI,OAAO,GAAQ,WACR,CAAE,GAAG,EAAQ,IAAK,EAAS,GAAI,EAEnC,CACX,CCXA,SAAS,GAAc,EAAK,CACxB,OAAQ,OAAO,GAAQ,UAAY,EAAI,MAAM,EAAG,CAAC,EAAjD,CACI,IAAK,KACL,IAAK,KACD,MAAO,MACX,IAAK,KACD,MAAO,KACX,IAAK,KACD,MAAO,MACX,IAAK,KACD,MAAO,MACX,QACI,MAAM,IAAI,EAAiB,gDAAgD,CACnF,CACJ,CACA,SAAS,GAAW,EAAM,CACtB,OAAQ,GACJ,OAAO,GAAS,UAChB,MAAM,QAAQ,EAAK,IAAI,GACvB,EAAK,KAAK,MAAM,EAAS,CACjC,CACA,SAAS,GAAU,EAAK,CACpB,OAAO,EAAS,CAAG,CACvB,CACA,IAAM,GAAN,KAAkB,CACd,GACA,GAAU,IAAI,QACd,YAAY,EAAM,CACd,GAAI,CAAC,GAAW,CAAI,EAChB,MAAM,IAAI,GAAY,4BAA4B,EAEtD,KAAKC,GAAQ,gBAAgB,CAAI,CACrC,CACA,MAAO,CACH,OAAO,KAAKA,EAChB,CACA,MAAM,OAAO,EAAiB,EAAO,CACjC,GAAM,CAAE,MAAK,OAAQ,CAAE,GAAG,EAAiB,GAAG,GAAO,MAAO,EACtD,EAAM,GAAc,CAAG,EACvB,EAAa,KAAKA,GAAM,KAAK,OAAQ,GAAQ,CAC/C,IAAI,EAAY,IAAQ,EAAI,IAa5B,GAZI,GAAa,OAAO,GAAQ,WAC5B,EAAY,IAAQ,EAAI,KAExB,IAAc,OAAO,EAAI,KAAQ,UAAY,IAAQ,SACrD,EAAY,IAAQ,EAAI,KAExB,GAAa,OAAO,EAAI,KAAQ,WAChC,EAAY,EAAI,MAAQ,OAExB,GAAa,MAAM,QAAQ,EAAI,OAAO,IACtC,EAAY,EAAI,QAAQ,SAAS,QAAQ,GAEzC,EACA,OAAQ,EAAR,CACI,IAAK,QACD,EAAY,EAAI,MAAQ,QACxB,MACJ,IAAK,QACD,EAAY,EAAI,MAAQ,QACxB,MACJ,IAAK,QACD,EAAY,EAAI,MAAQ,QACxB,MACJ,IAAK,UACL,IAAK,QACD,EAAY,EAAI,MAAQ,UACxB,KACR,CAEJ,OAAO,CACX,CAAC,EACK,CAAE,EAAG,EAAK,UAAW,EAC3B,GAAI,IAAW,EACX,MAAM,IAAI,GAEd,GAAI,IAAW,EAAG,CACd,IAAM,EAAQ,IAAI,GACZ,EAAU,KAAKC,GASrB,KARA,GAAM,OAAO,eAAiB,iBAAmB,CAC7C,IAAK,IAAM,KAAO,EACd,GAAI,CACA,MAAM,MAAM,GAAmB,EAAS,EAAK,CAAG,CACpD,MACM,CAAE,CAEhB,EACM,CACV,CACA,OAAO,GAAmB,KAAKA,GAAS,EAAK,CAAG,CACpD,CACJ,EACA,eAAe,GAAmB,EAAO,EAAK,EAAK,CAC/C,IAAM,EAAS,EAAM,IAAI,CAAG,GAAK,EAAM,IAAI,EAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAG,EAC3D,GAAI,EAAO,KAAS,IAAA,GAAW,CAC3B,IAAM,EAAM,MAAM,GAAU,CAAE,GAAG,EAAK,IAAK,EAAK,EAAG,CAAG,EACtD,GAAI,aAAe,YAAc,EAAI,OAAS,SAC1C,MAAM,IAAI,GAAY,8CAA8C,EAExE,EAAO,GAAO,CAClB,CACA,OAAO,EAAO,EAClB,CACA,SAAgB,GAAkB,EAAM,CACpC,IAAM,EAAM,IAAI,GAAY,CAAI,EAC1B,EAAc,MAAO,EAAiB,IAAU,EAAI,OAAO,EAAiB,CAAK,EASvF,OARA,OAAO,iBAAiB,EAAa,CACjC,KAAM,CACF,UAAa,gBAAgB,EAAI,KAAK,CAAC,EACvC,WAAY,GACZ,aAAc,GACd,SAAU,EACd,CACJ,CAAC,EACM,CACX,CCnHA,SAAS,IAAsB,CAC3B,OAAQ,OAAO,cAAkB,KAC5B,OAAO,UAAc,KAAe,UAAU,YAAc,sBAC5D,OAAO,YAAgB,KAAe,cAAgB,QAC/D,CACA,IAAI,GACA,OAAO,UAAc,KAAe,CAAC,UAAU,WAAW,aAAa,cAAc,KAGrF,EAAa,eAEjB,IAAa,GAAc,OAAO,EAClC,eAAe,GAAU,EAAK,EAAS,EAAQ,EAAY,MAAO,CAC9D,IAAM,EAAW,MAAM,EAAU,EAAK,CAClC,OAAQ,MACR,SACA,SAAU,SACV,SACJ,CAAC,CAAC,CAAC,MAAO,GAAQ,CAId,MAHI,EAAI,OAAS,eACP,IAAI,GAER,CACV,CAAC,EACD,GAAI,EAAS,SAAW,IACpB,MAAM,IAAI,EAAU,yDAAyD,EAEjF,GAAI,CACA,OAAO,MAAM,EAAS,KAAK,CAC/B,MACM,CACF,MAAM,IAAI,EAAU,4DAA4D,CACpF,CACJ,CACA,IAAa,EAAY,OAAO,EAChC,SAAS,GAAiB,EAAO,EAAa,CAa1C,MANA,EANI,OAAO,GAAU,WAAY,GAG7B,EAAE,QAAS,IAAU,OAAO,EAAM,KAAQ,UAAY,KAAK,IAAI,EAAI,EAAM,KAAO,GAGhF,EAAE,SAAU,IACZ,CAAC,EAAS,EAAM,IAAI,GACpB,CAAC,MAAM,QAAQ,EAAM,KAAK,IAAI,GAC9B,CAAC,MAAM,UAAU,MAAM,KAAK,EAAM,KAAK,KAAM,CAAQ,EAI7D,CACA,IAAM,GAAN,KAAmB,CACf,GACA,GACA,GACA,GACA,GACA,GACA,GACA,GACA,GACA,GACA,YAAY,EAAK,EAAS,CACtB,GAAI,EAAE,aAAe,KACjB,MAAU,UAAU,gCAAgC,EAExD,KAAKC,GAAO,IAAI,IAAI,EAAI,IAAI,EAC5B,KAAKC,GACD,OAAO,GAAS,iBAAoB,SAAW,GAAS,gBAAkB,IAC9E,KAAKC,GACD,OAAO,GAAS,kBAAqB,SAAW,GAAS,iBAAmB,IAChF,KAAKC,GAAe,OAAO,GAAS,aAAgB,SAAW,GAAS,YAAc,IACtF,KAAKC,GAAW,IAAI,QAAQ,GAAS,OAAO,EACxC,GAAc,CAAC,KAAKA,GAAS,IAAI,YAAY,GAC7C,KAAKA,GAAS,IAAI,aAAc,CAAU,EAEzC,KAAKA,GAAS,IAAI,QAAQ,IAC3B,KAAKA,GAAS,IAAI,SAAU,kBAAkB,EAC9C,KAAKA,GAAS,OAAO,SAAU,0BAA0B,GAE7D,KAAKC,GAAe,IAAU,IAC1B,IAAU,KAAe,IAAA,KACzB,KAAKC,GAAS,IAAU,GACpB,GAAiB,IAAU,GAAY,KAAKH,EAAY,IACxD,KAAKI,GAAiB,KAAKD,GAAO,IAClC,KAAKE,GAAS,GAAkB,KAAKF,GAAO,IAAI,GAG5D,CACA,cAAe,CACX,MAAO,CAAC,CAAC,KAAKG,EAClB,CACA,aAAc,CACV,OAAO,OAAO,KAAKF,IAAmB,UAChC,KAAK,IAAI,EAAI,KAAKA,GAAiB,KAAKL,EAElD,CACA,OAAQ,CACJ,OAAO,OAAO,KAAKK,IAAmB,UAChC,KAAK,IAAI,EAAI,KAAKA,GAAiB,KAAKJ,EAElD,CACA,MAAO,CACH,OAAO,KAAKK,IAAQ,KAAK,CAC7B,CACA,MAAM,OAAO,EAAiB,EAAO,EAC7B,CAAC,KAAKA,IAAU,CAAC,KAAK,MAAM,IAC5B,MAAM,KAAK,OAAO,EAEtB,GAAI,CACA,OAAO,MAAM,KAAKA,GAAO,EAAiB,CAAK,CACnD,OACO,EAAK,CACR,GAAI,aAAe,IACX,KAAK,YAAY,IAAM,GAEvB,OADA,MAAM,KAAK,OAAO,EACX,KAAKA,GAAO,EAAiB,CAAK,EAGjD,MAAM,CACV,CACJ,CACA,MAAM,QAAS,CACP,KAAKC,IAAiB,GAAoB,IAC1C,KAAKA,GAAgB,IAAA,IAEzB,KAAKA,KAAkB,GAAU,KAAKT,GAAK,KAAM,KAAKI,GAAU,YAAY,QAAQ,KAAKH,EAAgB,EAAG,KAAKI,EAAY,CAAC,CACzH,KAAM,GAAS,CAChB,KAAKG,GAAS,GAAkB,CAAI,EAChC,KAAKF,KACL,KAAKA,GAAO,IAAM,KAAK,IAAI,EAC3B,KAAKA,GAAO,KAAO,GAEvB,KAAKC,GAAiB,KAAK,IAAI,EAC/B,KAAKE,GAAgB,IAAA,EACzB,CAAC,CAAC,CACG,MAAO,GAAQ,CAEhB,KADA,MAAKA,GAAgB,IAAA,GACf,CACV,CAAC,EACD,MAAM,KAAKA,EACf,CACJ,EACA,SAAgB,GAAmB,EAAK,EAAS,CAC7C,IAAM,EAAM,IAAI,GAAa,EAAK,CAAO,EACnC,EAAe,MAAO,EAAiB,IAAU,EAAI,OAAO,EAAiB,CAAK,EA8BxF,OA7BA,OAAO,iBAAiB,EAAc,CAClC,YAAa,CACT,QAAW,EAAI,YAAY,EAC3B,WAAY,GACZ,aAAc,EAClB,EACA,MAAO,CACH,QAAW,EAAI,MAAM,EACrB,WAAY,GACZ,aAAc,EAClB,EACA,OAAQ,CACJ,UAAa,EAAI,OAAO,EACxB,WAAY,GACZ,aAAc,GACd,SAAU,EACd,EACA,UAAW,CACP,QAAW,EAAI,aAAa,EAC5B,WAAY,GACZ,aAAc,EAClB,EACA,KAAM,CACF,UAAa,EAAI,KAAK,EACtB,WAAY,GACZ,aAAc,GACd,SAAU,EACd,CACJ,CAAC,EACM,CACX,CC9KA,SAAgB,EAAU,EAA2B,CACnD,IAAI,EAAS,GACb,IAAK,IAAM,KAAQ,EACjB,GAAU,OAAO,aAAa,CAAI,EAEpC,OAAO,KAAK,CAAM,CAAC,CAChB,QAAQ,MAAO,GAAG,CAAC,CACnB,QAAQ,MAAO,GAAG,CAAC,CACnB,QAAQ,MAAO,EAAE,CACtB,CAKA,SAAgB,IAA+B,CAC7C,OAAO,EAAU,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,CACxE,CAKA,eAAsB,GAAoB,EAAmC,CAC3E,IAAM,EAAS,MAAM,WAAW,OAAO,OAAO,OAC5C,UACA,IAAI,YAAY,CAAC,CAAC,OAAO,CAAQ,CACnC,EACA,OAAO,EAAU,IAAI,WAAW,CAAM,CAAC,CACzC,CCrBA,IAAM,EAAsB,wBAG5B,SAAS,EAAe,EAA2B,CACjD,OACE,IAAa,aACb,IAAa,OACb,IAAa,SACb,mCAAmC,KAAK,CAAQ,CAEpD,CAOA,SAAS,EACP,EACA,EACA,EACK,CACL,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAM,CACtB,MAAQ,CACN,MAAA,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,WAAW,EAAM,KAAM,CAAC,CACxE,CAMA,GAAI,EAJF,EAAI,WAAa,UAChB,GACC,EAAI,WAAa,SACjB,EAAe,EAAI,QAAQ,GAE7B,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,GAAG,EAAM,mFACpB,CAAC,EAEH,OAAO,CACT,CAEA,SAAS,EAAgB,EAAwB,CAC/C,OAAO,EAAO,QAAQ,OAAQ,EAAE,CAClC,CAUA,SAAS,GAAe,EAA0B,CAChD,IAAM,EAAa,EAAgB,CAAM,EACzC,MAAO,CAAC,GAAG,IAAI,IAAI,CAAC,EAAQ,EAAY,GAAG,EAAW,EAAE,CAAC,CAAC,CAC5D,CAKA,SAAS,GAAiB,EAAuD,CAC/E,GAAI,IAAQ,QAAS,MAAO,UAC5B,IAAM,EAAO,0BAA0B,KAAK,CAAG,CAAC,GAAG,GACnD,OAAO,EAAQ,OAAO,IAA+C,IACvE,CAEA,eAAe,GAAc,EAAqB,EAAqC,CACrF,IAAM,EAAU,GAAiB,CAAG,EACpC,GAAI,CAAC,EAAS,OAAO,KACrB,IAAM,EAAS,MAAM,WAAW,OAAO,OAAO,OAC5C,EACA,IAAI,YAAY,CAAC,CAAC,OAAO,CAAW,CACtC,EACM,EAAQ,IAAI,WAAW,CAAM,EACnC,OAAO,EAAU,EAAM,MAAM,EAAG,EAAM,OAAS,CAAC,CAAC,CACnD,CAOO,IAAA,EAAA,KAAiC,CAYtC,YAAY,EAA0B,wBAVV,IAAI,2BAsBwB,4BACb,2BACP,sCAGE,uCAGe,IAAI,IAnBvD,KAAK,OAAS,EAAO,CAAa,CAAC,CAAC,WAClC,4BACF,EACA,GAAgB,EAAgB,EAAO,cAAc,EACrD,KAAK,OAAS,CAChB,CAwBA,uBAAsC,CACpC,GACE,CAAC,KAAK,OAAO,QACb,CAAC,KAAK,OAAO,UACb,CAAC,KAAK,OAAO,cACb,CAAC,KAAK,OAAO,YAEb,MAAU,MACR,sJAEF,CAEJ,CAOA,MAAM,YAAY,EAA+B,CAC/C,OAAO,MAAM,EAAO,CAAc,CAAC,CAAC,YAAY,CAAK,CACvD,CAEA,WAA8B,CAE5B,OADA,KAAK,sBAAsB,EACpB,KAAK,MACd,CASA,eACE,EACA,EACqB,CACrB,IAAM,EAAQ,KAAK,OAAO,GAE1B,GAAI,IAAU,IAAA,IAAc,OAAO,GAAU,UAAY,IAAU,GAAK,CACtE,GAAI,IAAkB,IAAA,GACpB,OAAO,EAIT,GAAI,IAAQ,eAAiB,IAAQ,aAAe,IAAQ,WAC1D,OAEF,GAAI,IAAQ,oBACV,MAAO,CAAC,EAGV,MAAU,MAAM,4BAA4B,EAAI,gBAAgB,CAClE,CACA,OAAO,CACT,CAOA,mBAAmB,EAAuB,CACxC,IAAM,EAAoB,KAAK,eAC7B,oBACA,CAAC,CACH,EAMA,OAJK,MAAM,QAAQ,CAAiB,EAI7B,EAAkB,KAAM,GAAU,CAEvC,GAAI,EAAM,SAAS,GAAG,EAAG,CACvB,IAAM,EAAc,EAAM,MAAM,EAAG,EAAE,EAMrC,GAAI,CAAC,EAAK,WAAW,CAAW,EAC9B,MAAO,GAIT,IAAM,EAAc,EAAK,MAAM,EAAY,MAAM,EACjD,OAAO,EAAY,OAAS,GAAK,IAAgB,GACnD,CAGA,IAAM,EAAkB,EAAM,SAAS,GAAG,EAAI,EAAQ,EAAQ,IACxD,EAAiB,EAAK,SAAS,GAAG,EAAI,EAAO,EAAO,IAG1D,OAAO,IAAS,GAAS,IAAmB,CAC9C,CAAC,EA3BQ,EA4BX,CAKA,MAAM,oBAAoB,EAKN,CAClB,KAAK,sBAAsB,EAE3B,IAAM,EAAS,MAAM,KAAK,uBAAuB,EAE3C,EAAW,KAAK,eAAe,WAAY,IAAA,EAAS,EAEpD,EAAe,CACnB,cAAe,OACf,UAAW,KAAK,eAAe,UAAU,EACzC,aAAc,EAAO,aAAe,KAAK,eAAe,aAAa,EACrE,MAAO,KAAK,eAAe,OAAO,EAClC,MAAO,EAAO,MACd,MAAO,EAAO,MACd,eAAgB,EAAO,cACvB,sBAAuB,OACvB,GAAI,EAAW,CAAE,UAAS,EAAI,CAAC,CACjC,EAEM,EAAY,IAAI,gBAAgB,CAAY,EAElD,MAAO,GAAG,EAAO,uBAAuB,GAAG,EAAU,SAAS,GAChE,CAKA,MAAc,sBACZ,EACA,EACA,EACA,CACA,IAAM,EAAS,MAAM,KAAK,uBAAuB,EAE3C,EAAW,MAAM,MAAM,EAAO,eAAgB,CAClD,OAAQ,OACR,QAAS,CACP,eAAgB,mCAClB,EACA,KAAM,IAAI,gBAAgB,CACxB,WAAY,qBACZ,UAAW,KAAK,eAAe,UAAU,EACzC,cAAe,KAAK,eAAe,cAAc,EACjD,OACA,cAAe,EACf,aAAc,GAAe,KAAK,eAAe,aAAa,CAChE,CAAC,CAAC,CAAC,SAAS,CACd,CAAC,EACD,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAQ,MAAM,EAAS,KAAK,EAElC,MADA,KAAK,OAAO,MAAM,mCAAoC,CAAK,GAC3D,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,uCACX,CAAC,CACH,CAEA,OAAO,MAAM,EAAS,KAAK,CAC7B,CAKA,MAAc,cAAc,EAKzB,CACD,IAAM,EAAS,MAAM,KAAK,uBAAuB,EAEjD,GAAI,CACF,IAAM,EAAW,MAAM,MAAM,EAAO,eAAgB,CAClD,OAAQ,OACR,QAAS,CACP,eAAgB,mCAClB,EACA,KAAM,IAAI,gBAAgB,CACxB,WAAY,gBACZ,UAAW,KAAK,eAAe,UAAU,EACzC,cAAe,KAAK,eAAe,cAAc,EACjD,cAAe,CACjB,CAAC,CAAC,CAAC,SAAS,CACd,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAQ,MAAM,EACjB,KAAK,CAAC,CACN,WAAa,CAAE,MAAO,eAAgB,EAAE,EAE3C,MADA,KAAK,OAAO,MAAM,yBAA0B,CAAK,GACjD,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,yBACX,CAAC,CACH,CAEA,OAAO,MAAM,EAAS,KAAK,CAC7B,OAAS,EAAO,CAEd,MADA,KAAK,OAAO,MAAM,6BAA8B,CAAK,GACrD,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,wCACX,CAAC,CACH,CACF,CAEA,MAAc,qBAAqB,EAKhC,CACD,IAAM,EAAkB,KAAK,kBAAkB,IAAI,CAAY,EAC/D,GAAI,EACF,OAAO,EAGT,IAAM,EAAiB,KAAK,cAAc,CAAY,CAAC,CAAC,YAAc,CACpE,KAAK,kBAAkB,OAAO,CAAY,CAC5C,CAAC,EAGD,OADA,KAAK,kBAAkB,IAAI,EAAc,CAAc,EAChD,CACT,CAMA,MAAc,YAAY,EAAqB,EAAa,EAAiB,CAC3E,IAAM,EAAS,MAAM,KAAK,uBAAuB,EAC7C,EAA0B,KAG9B,IAAK,IAAI,EAAU,EAAG,GAAW,EAAY,IAC3C,GAAI,CACF,IAAM,EAAW,MAAM,MAAM,EAAO,kBAAmB,CACrD,QAAS,CACP,cAAe,UAAU,GAC3B,EAEA,OAAQ,YAAY,QAAQ,GAAK,CACnC,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAY,MAAM,EACrB,KAAK,CAAC,CACN,WAAa,CAAE,MAAO,eAAgB,EAAE,EAO3C,GANA,KAAK,OAAO,MAAM,0BAA2B,EAAW,CACtD,UACA,YACF,CAAC,EAGG,EAAS,SAAW,IACtB,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,4CACX,CAAC,EACI,GAAI,EAAS,SAAW,IAAK,CAElC,IAAM,EAAa,SACjB,EAAS,QAAQ,IAAI,aAAa,GAAK,IACvC,EACF,EACA,MAAM,IAAI,QAAS,GACjB,WAAW,EAAS,EAAa,GAAI,CACvC,EACA,QACF,MAAO,GAAI,EAAS,QAAU,IAAK,CAEjC,MAAM,IAAI,QAAS,GAAY,WAAW,EAAS,EAAU,GAAI,CAAC,EAClE,QACF,MACE,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,EAAS,OACrB,QAAS,4BACP,EAAU,OAAS,iBAEvB,CAAC,CAEL,CAEA,IAAM,EAAW,MAAM,EAAS,KAAK,EAGrC,GAAI,CAAC,GAAa,CAAC,EAAS,KAAO,CAAC,EAAS,GAC3C,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,0CACX,CAAC,EAGH,OAAO,CACT,OAAS,EAAgB,CAIvB,GAHA,EAAY,EAIV,aAAiB,OACjB,eAAgB,GACf,EAAiC,aAAe,IAEjD,MAAM,EAIR,IACE,aAAiB,WAChB,aAAiB,OAAS,EAAM,OAAS,gBAE1C,KAAK,OAAO,MAAM,mCAAoC,EAAO,CAC3D,UACA,YACF,CAAC,EACG,EAAU,GAAY,CAExB,MAAM,IAAI,QAAS,GACjB,WAAW,EAAkB,GAAG,EAAW,GAAG,CAChD,EACA,QACF,CAIF,GAAI,IAAY,EAId,MAHA,KAAK,OAAO,MAAM,kDAAmD,CACnE,YACF,CAAC,GACD,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,kDACT,MAAO,CACT,CAAC,CAEL,CAIF,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,oCACX,CAAC,CACH,CASA,MAAc,gBACZ,EACA,EACA,EACqB,CACrB,IAAM,EAAS,MAAM,KAAK,uBAAuB,EAEjD,GAAI,CAAC,EAAO,SACV,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,kEACX,CAAC,EAKH,IAAM,EAAmB,KAAK,eAAe,QAAQ,EAC/C,EAAY,EAAgB,EAAkB,eAAgB,EAAI,EAClE,EACJ,EAAU,WAAa,SAAW,EAAe,EAAU,QAAQ,EAE/D,EAAU,EACd,EAAO,SACP,WACA,CACF,GAEI,CAAC,KAAK,MAAQ,KAAK,UAAY,EAAO,YACxC,KAAK,KAAO,GAAmB,CAAO,EACtC,KAAK,QAAU,EAAO,UAGxB,IAAI,EACA,EACJ,GAAI,EACD,8BAA+B,MAAM,GAAU,EAAS,KAAK,KAAM,CAKlE,OAAQ,GAAe,CAAgB,EACvC,SAAU,KAAK,eAAe,UAAU,CAC1C,CAAC,EACH,OAAS,EAAO,CAEd,MADA,KAAK,OAAO,MAAM,6BAA8B,CAAK,GACrD,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,CAAoB,CAAC,CACrE,CAEA,GAAI,EAAQ,QAAa,EAEvB,MADA,KAAK,OAAO,MAAM,yBAAyB,GAC3C,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,CAAoB,CAAC,EAGrE,GACS,EAAQ,MAAW,QAC1B,EAAQ,MAAW,KAAK,eAAe,UAAU,EAGjD,MADA,KAAK,OAAO,MAAM,uCAAuC,GACzD,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,CAAoB,CAAC,EAMrE,GAAI,OAAO,EAAQ,SAAe,SAAU,CAC1C,IAAM,EAAW,MAAM,GAAc,EAAa,EAAgB,GAAG,EACrE,GAAI,IAAa,MAAQ,IAAa,EAAQ,QAE5C,MADA,KAAK,OAAO,MAAM,2BAA2B,GAC7C,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,CAAoB,CAAC,CAEvE,CAEA,OAAO,CACT,CAKA,MAAM,eAAe,EAAgB,EAAc,EAAe,CAEhE,GAAI,CAAC,EACH,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,yBACX,CAAC,EAIH,IAAM,GAAA,EAAA,EAAA,WAAA,CAAsC,CAAK,EAC3C,EAAe,GAAS,aACxB,EAAQ,GAAS,MACvB,GAAI,CAAC,GAAgB,CAAC,EACpB,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,wDACX,CAAC,EAIH,IAAM,EAAS,MAAM,KAAK,sBAAsB,EAAM,CAAY,EAC5D,CAAE,eAAc,WAAU,gBAAe,cAAe,EAK9D,GAH4B,KAAK,eAAe,OAAO,CAAC,CACrD,MAAM,GAAG,CAAC,CACV,SAAS,QACR,GAAuB,CAAC,EAI1B,MAHA,KAAK,OAAO,MACV,iEACF,GACA,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,CAAoB,CAAC,EAIrE,IAAI,EACJ,GAAI,EAAU,CACZ,IAAM,EAAS,MAAM,KAAK,gBAAgB,EAAU,EAAO,CAAY,EACvE,GAAI,OAAO,EAAO,KAAQ,UAAY,EAAO,IAAI,SAAW,EAE1D,MADA,KAAK,OAAO,MAAM,+BAA+B,GACjD,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,CAAoB,CAAC,EAErE,EAAa,EAAO,GACtB,CAGA,IAAM,EAAW,MAAM,KAAK,YAAY,CAAY,EAIpD,GACE,IACC,OAAO,GAAU,KAAQ,UAAY,EAAS,MAAQ,GAGvD,MADA,KAAK,OAAO,MAAM,kDAAkD,GACpE,EAAA,EAAA,YAAA,CAAkB,CAAE,WAAY,IAAK,QAAS,CAAoB,CAAC,EAIrE,IAAM,EAAc,KAAK,eAAe,cAAe,IAAA,EAAS,EAE5D,EAAO,EACP,GAAe,uBAAwB,IACzC,EAAO,MAAM,EAAY,qBAAqB,CAAQ,GAIxD,IAAM,GAAO,CACX,gBAAiB,GACjB,YAAa,EACb,QAAS,EACT,aAAc,EACd,UAAW,KAAK,IAAI,EAAI,EAAa,IACrC,SAAU,CACZ,EAeA,GAVA,MAAA,EAAA,EAAA,kBAAA,CAAwB,CAAK,EAG7B,MAAA,EAAA,EAAA,cAAA,CAAoB,OAAc,CAChC,OACA,QACA,aAAc,IAAA,GACd,MAAO,IAAA,EACT,EAAE,EAEE,KAAK,eAAe,uBAAwB,EAAK,EAKnD,GAAI,CACF,MAAM,KAAK,4BAA4B,EAAO,EAAM,CAAQ,CAC9D,OAAS,EAAO,CACd,KAAK,OAAO,MAAM,2CAA4C,CAAK,CACrE,CAMF,OAFA,KAAK,OAAO,MAAM,gDAAgD,EAE3D,CAAE,OAAM,QAAO,CACxB,CAEA,oBACE,EACA,EACe,CACf,IAAM,EAAa,CACjB,GAAO,GACP,GAAO,IACP,GAAW,GACX,GAAW,IACX,GAAW,KACb,EAEA,IAAK,IAAM,KAAa,EACtB,GAAI,OAAO,GAAc,UAAY,EAAU,OAAS,EACtD,OAAO,EAIX,OAAO,IACT,CAEA,uBAA+B,EAAyC,CACtE,IAAM,EACJ,EAAQ,MAAQ,OAAO,EAAQ,MAAS,SACnC,EAAQ,KACT,KACA,EACJ,EAAQ,MAAM,UAAY,OAAO,EAAQ,KAAK,UAAa,SACtD,EAAQ,KAAK,SACd,KAEA,EAAa,CACjB,GAAc,GACd,GAAc,IACd,GAAkB,GAClB,GAAkB,IAClB,GAAkB,KACpB,EAEA,IAAK,IAAM,KAAa,EACtB,GAAI,OAAO,GAAc,UAAY,EAAU,OAAS,EACtD,OAAO,EAIX,OAAO,IACT,CAEA,MAAc,4BACZ,EACA,EACA,EACe,CACf,IAAM,EAAiB,KAAK,oBAAoB,EAAM,CAAQ,EAC9D,GAAI,CAAC,EAAgB,CACnB,KAAK,OAAO,MACV,2EACF,EACA,MACF,CAEA,IAAM,EACJ,OAAO,EAAM,QAAQ,gBAAsB,SACtC,EAAM,QAAQ,eACf,KAEN,GAAI,CAAC,EAAkB,CACrB,KAAK,OAAO,MACV,yEACF,EACA,MACF,CAGA,IAAM,EAAiB,MADA,EAAO,CACD,CAAA,CAAe,kBAAkB,EAE9D,IAAK,IAAM,KAAiB,EAAgB,CAK1C,GAJI,EAAc,KAAO,GAIrB,CAAC,EAAc,KAAK,MAAM,gBAC5B,SAGF,IAAM,EAAkB,KAAK,uBAAuB,EAAc,IAAI,EAClE,CAAC,GAAmB,IAAoB,IAI5C,EAAc,OAAQ,GAAS,CAC7B,IAAM,EAAc,EAAK,KACzB,MAAO,CACL,GAAG,EACH,KAAM,CACJ,GAAI,GAAe,CAAE,gBAAiB,EAAM,EAC5C,gBAAiB,GACjB,YAAa,IAAA,GACb,QAAS,IAAA,GACT,aAAc,IAAA,GACd,UAAW,IAAA,GACX,SAAU,IAAA,EACZ,EACA,KAAM,IACR,CACF,CAAC,EAED,MAAM,EAAc,KAAK,EACzB,KAAK,OAAO,MAAM,0CAA2C,CAC3D,UAAW,EAAc,EAC3B,CAAC,EACH,CACF,CAOA,mBAA2B,EAA4B,CAKrD,OAJY,KAAK,IAIV,EAFc,KAAK,4BAA8B,IAE5B,CAC9B,CAOA,MAAM,uBAIH,CACD,KAAK,OAAO,MAAM,qCAAqC,EAEvD,GAAI,CAGF,IAAM,EAAiB,MADA,EAAO,CACD,CAAA,CAAe,kBAAkB,EAE1D,EAAY,EACZ,EAAS,EACP,EAAQ,EAAe,OAE7B,KAAK,OAAO,MAAM,SAAS,EAAM,0BAA0B,EAG3D,IAAK,IAAM,KAAW,EACpB,GAAI,CAEF,GAAI,CAAC,EAAQ,KAAK,MAAM,iBACpB,CAAC,EAAQ,KAAK,KAAK,cACnB,CAAC,EAAQ,KAAK,KAAK,UAAW,CAChC,KAAK,OAAO,MAAM,oBAAoB,EAAQ,GAAG,sBAAsB,EACvE,QACF,CAGA,GAAI,CAAC,KAAK,mBAAmB,EAAQ,KAAK,KAAK,SAAS,EAAG,CACzD,KAAK,OAAO,MAAM,oBAAoB,EAAQ,GAAG,2BAA2B,EAC5E,QACF,CAEA,KAAK,OAAO,MAAM,gCAAgC,EAAQ,IAAI,EAI9D,IAAM,EAAS,MAAM,KAAK,qBACxB,EAAQ,KAAK,KAAK,YACpB,EAGA,EAAQ,OAAQ,GAAS,CACvB,IAAM,EAAc,EAAK,KAGzB,OAFK,EAEE,CACL,GAAG,EACH,KAAM,CACJ,GAAG,EACH,YAAa,EAAO,aACpB,QAAS,EAAO,UAAY,EAAY,QACxC,aAAc,EAAO,eAAiB,EAAY,aAClD,UAAW,KAAK,IAAI,EAAI,EAAO,WAAa,GAC9C,CACF,EAXyB,CAY3B,CAAC,EAGD,MAAM,EAAQ,KAAK,EAEnB,IACA,KAAK,OAAO,MAAM,4CAA4C,EAAQ,IAAI,CAE5E,OAAS,EAAO,CACd,IACA,KAAK,OAAO,MACV,sCACA,EACA,CAAE,UAAW,EAAQ,EAAG,CAC1B,EAKA,GAAI,CACF,IAAM,EAAa,MAAM,EAAQ,QAAQ,EAMzC,GAJI,GAAY,MAAM,iBACpB,OAAO,EAAW,KAAK,WAAc,UACrC,EAAW,KAAK,UAAY,KAAK,IAAI,EAEf,CACtB,IACA,KAAK,OAAO,MACV,6CAA6C,EAAQ,GAAG,kCAC1D,EACA,QACF,CAEA,EAAQ,OAAQ,GAAS,CACvB,IAAM,EAAc,EAAK,KAGzB,OAFK,EAEE,CACL,GAAG,EACH,KAAM,CACJ,GAAG,EACH,gBAAiB,EACnB,CACF,EARyB,CAS3B,CAAC,EACD,MAAM,EAAQ,KAAK,CACrB,OAAS,EAAa,CACpB,KAAK,OAAO,MACV,iDACA,EACA,CAAE,UAAW,EAAQ,EAAG,CAC1B,CACF,CACF,CAGF,IAAM,EAAS,CAAE,YAAW,SAAQ,OAAM,EAG1C,OAFA,KAAK,OAAO,KAAK,+BAAgC,CAAM,EAEhD,CAET,OAAS,EAAO,CAEd,MADA,KAAK,OAAO,MAAM,kCAAmC,CAAK,GAC1D,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,mCACX,CAAC,CACH,CACF,CAKA,MAAM,gBAAgB,EAAkC,CACtD,MAAM,EAAO,CAAc,CAAC,CAAC,YAAY,CAAK,EAE9C,IAAM,EAAW,MAAA,EAAA,EAAA,WAAA,CAAiB,CAAK,EAGvC,GAAI,CAAC,GAAS,KAKZ,OAJA,MAAA,EAAA,EAAA,cAAA,CAAoB,OAAc,CAChC,KAAM,CAAE,gBAAiB,EAAM,CACjC,EAAE,EAEK,GAIT,GAAI,CAAC,EAAQ,KAAK,gBAChB,MAAO,GAIT,GAAI,EAAQ,KAAK,WAAa,EAAQ,KAAK,UAAY,KAAK,IAAI,EAE9D,GAAI,EAAQ,KAAK,aACf,GAAI,CAEF,IAAM,EAAS,MAAM,KAAK,qBACxB,EAAQ,KAAK,YACf,EAcA,OAXA,MAAA,EAAA,EAAA,cAAA,CAAoB,EAAQ,IAAqC,CAC/D,KAAM,CACJ,GAAG,EAAe,KAClB,gBAAiB,GACjB,YAAa,EAAO,aACpB,QAAS,EAAO,UAAY,GAAS,MAAM,QAC3C,aAAc,EAAO,eAAiB,GAAS,MAAM,aACrD,UAAW,KAAK,IAAI,EAAI,EAAO,WAAa,GAC9C,CACF,EAAE,EAEK,EACT,OAAS,EAAO,CACd,KAAK,OAAO,MAAM,yBAA0B,CAAK,EAKjD,IAAM,EAAgB,MAAA,EAAA,EAAA,eAAA,CAAsC,CAAK,EAsBjE,OApBI,GAAe,MAAM,iBACvB,OAAO,EAAc,KAAK,WAAc,UACxC,EAAc,KAAK,UAAY,KAAK,IAAI,EAGjC,IAIT,MAAA,EAAA,EAAA,cAAA,CAAoB,EAAQ,IAAqC,CAC/D,KAAM,CACJ,GAAG,EAAe,KAClB,gBAAiB,EACnB,CACF,EAAE,EAEF,KAAK,OAAO,KAAK,uCAAuC,EACxD,KAAK,OAAO,SACV,8CAAgD,EAAM,IACxD,EACO,GACT,MAOA,OAJA,KAAK,OAAO,KAAK,6BAA6B,EAC9C,KAAK,OAAO,SACV,8CAAgD,EAAM,IACxD,EACO,GA4CX,OAtCE,EAAQ,KAAK,WACb,KAAK,mBAAmB,EAAQ,KAAK,SAAS,GAG9C,WAAW,SAAY,CACrB,GAAI,CACF,IAAM,EAAkB,MAAA,EAAA,EAAA,WAAA,CAAiB,CAAK,EAC9C,GACE,CAAC,GAAgB,MAAM,iBACvB,CAAC,EAAe,KAAK,aAErB,OAGF,IAAM,EAAS,MAAM,KAAK,qBACxB,EAAe,KAAK,YACtB,EAGA,MAAA,EAAA,EAAA,cAAA,CAAoB,EAAQ,IAA8B,CACxD,KAAM,CACJ,GAAG,EAAQ,KACX,gBAAiB,GACjB,YAAa,EAAO,aACpB,QAAS,EAAO,UAAY,GAAgB,MAAM,QAClD,aACE,EAAO,eAAiB,GAAgB,MAAM,aAChD,UAAW,KAAK,IAAI,EAAI,EAAO,WAAa,GAC9C,CACF,EAAE,EAEF,KAAK,OAAO,MAAM,oCAAoC,CACxD,OAAS,EAAO,CACd,KAAK,OAAO,MAAM,kCAAmC,CAAK,CAC5D,CACF,EAAG,CAAC,EAGC,EACT,CAKA,MAAM,qBAAqB,EAAgB,CAEzC,GAAI,CAAE,MAAM,KAAK,gBAAgB,CAAK,EACpC,OAAO,KAGT,IAAM,GAAA,EAAA,EAAA,WAAA,CAAqB,CAAK,EAE1B,EAAc,KAAK,eAAe,cAAe,IAAA,EAAS,EAMhE,OAJI,GAAe,mBAAoB,EAC9B,EAAY,iBAAiB,EAAQ,MAAM,QAAQ,EAGrD,EAAQ,MAAM,QACvB,CAKA,MAAc,YAAY,EAA8B,CACtD,IAAM,EAAS,MAAM,KAAK,uBAAuB,EAajD,GAAI,EAAC,MAZkB,MAAM,EAAO,oBAAqB,CACvD,OAAQ,OACR,QAAS,CACP,eAAgB,mCAClB,EACA,KAAM,IAAI,gBAAgB,CACxB,UAAW,KAAK,eAAe,UAAU,EACzC,cAAe,KAAK,eAAe,cAAc,EACjD,OACF,CAAC,CACH,CAAC,EAAA,CAEa,GACZ,MAAU,MAAM,wBAAwB,CAE5C,CAKA,MAAM,OAAO,EAAiC,CAC5C,MAAM,EAAO,CAAc,CAAC,CAAC,YAAY,CAAK,EAC9C,IAAM,GAAA,EAAA,EAAA,WAAA,CAAqB,CAAK,EAC1B,EAAS,MAAM,KAAK,uBAAuB,EAGjD,GAAI,GAAU,MAAS,YACrB,GAAI,CACF,MAAM,KAAK,YAAY,EAAQ,KAAQ,WAAW,CACpD,OAAS,EAAO,CACd,KAAK,OAAO,MAAM,gCAAiC,CAAK,CAC1D,CAIF,GAAI,GAAS,MAAM,aACjB,GAAI,CACF,MAAM,KAAK,YAAY,EAAQ,KAAK,YAAY,CAClD,OAAS,EAAO,CACd,KAAK,OAAO,MAAM,iCAAkC,CAAK,CAC3D,CAIF,IAAM,EAAY,IAAI,IAAI,EAAO,oBAAoB,EACrD,EAAU,aAAa,OAAO,YAAa,KAAK,eAAe,UAAU,CAAC,EAG1E,IAAM,EAAW,KAAK,eAAe,WAAW,EAYhD,OAVI,GACF,EAAU,aAAa,OAAO,WAAY,CAAQ,EAIpD,MAAA,EAAA,EAAA,cAAA,CAAoB,OAAc,CAChC,KAAM,CAAE,gBAAiB,EAAM,EAC/B,KAAM,IACR,EAAE,EAEK,EAAU,SAAS,CAC5B,CAKA,MAAc,wBAAuD,CACnE,IAAM,EAAM,KAAK,IAAI,EAGrB,GACE,KAAK,mBACL,KAAK,mBACL,EAAM,KAAK,kBAAoB,KAAK,iBAEpC,OAAO,KAAK,kBAGd,IAAM,EAAS,KAAK,eAAe,QAAQ,EAMrC,EAAY,EAAgB,EAAQ,eAAgB,EAAI,EACxD,EACJ,EAAU,WAAa,SAAW,EAAe,EAAU,QAAQ,EAEjE,EACJ,GAAI,CACF,IAAM,EAAW,MAAM,MACrB,GAAG,EAAgB,CAAM,EAAE,mCAC3B,CAIE,SAAU,QACV,OAAQ,YAAY,QAClB,KAAK,eAAe,qBAAsB,GAAK,CACjD,CACF,CACF,EAEA,GAAI,CAAC,EAAS,GACZ,MAAU,MACR,yCAAyC,EAAS,YACpD,EAGF,EAAS,MAAM,EAAS,KAAK,CAC/B,OAAS,EAAO,CAEd,MADA,KAAK,OAAO,MAAM,sCAAuC,CAAK,GAC9D,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,sCACX,CAAC,CACH,CAWA,OATA,KAAK,iCACH,EACA,EACA,CACF,EAEA,KAAK,kBAAoB,EACzB,KAAK,kBAAoB,EAElB,CACT,CAOA,iCACE,EACA,EACA,EACM,CACN,GACE,OAAO,EAAO,QAAW,UACzB,EAAgB,EAAO,MAAM,IAAM,EAAgB,CAAM,EAMzD,MAJA,KAAK,OAAO,MAAM,uCAAwC,CACxD,SAAU,EACV,SAAU,EAAO,MACnB,CAAC,GACD,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QACE,kEACJ,CAAC,EAWH,IAAK,IAAM,IAAO,CAPhB,yBACA,iBACA,oBACA,uBACA,qBAGgB,EAAc,CAC9B,IAAM,EAAW,EAAO,GACxB,GAAI,OAAO,GAAa,UAAY,EAAS,SAAW,EACtD,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,mCAAmC,GAC9C,CAAC,EAEH,EAAgB,EAAU,UAAU,IAAO,CAAsB,CACnE,CACF,CACF,QAzpCC,GAAW,EAAA,GAAA,oBAAA,CAAA,MAAA,CAAA,CAAA,EAAA,CAAA,ECnFZ,IAAM,GAAmB,CACvB,KAAM,gBACN,QAAS,KAAO,IAAmB,CACjC,IAAM,EAAc,EAAO,CAA0B,EAC/C,EAAS,EAAO,CAAa,CAAC,CAAC,WAAW,gBAAgB,EAE1D,EAAS,CAAE,cAAe,MAAM,EAAY,gBAAgB,CAAK,CAAE,EAIzE,OAFA,EAAO,KAAK,qCAAsC,CAAM,EAEjD,CACT,CACF,ECtBM,GAAuB,4BAE7B,SAAS,GAAyB,EAAwB,CACxD,IAAK,IAAM,KAAa,EAAO,CAC7B,IAAM,EAAgB,EAAU,WAAW,CAAC,EAE5C,GAAI,GAAiB,IAAQ,IAAkB,IAC7C,MAAO,EAEX,CAEA,MAAO,EACT,CAEA,SAAgB,GAAoB,EAA8B,CAChE,GAAI,OAAO,GAAgB,SACzB,MAAO,IAGT,IAAM,EAAwB,EAAY,KAAK,EAE/C,GACE,IAA0B,IAC1B,CAAC,EAAsB,WAAW,GAAG,GACrC,EAAsB,WAAW,IAAI,GACrC,EAAsB,SAAS,IAAI,GACnC,GAAyB,CAAqB,EAE9C,MAAO,IAGT,GAAI,CACF,IAAM,EAAY,IAAI,IAAI,EAAuB,EAAoB,EAErE,GAAI,EAAU,SAAW,GACvB,MAAO,IAGT,IAAM,EAAkB,GAAG,EAAU,WAAW,EAAU,SAAS,EAAU,OAE7E,OAAO,EAAgB,WAAW,IAAI,EAAI,IAAM,CAClD,MAAQ,CACN,MAAO,GACT,CACF,CCnBA,eAAe,GAAwB,EAAiC,CAEtE,IAAM,EAAc,IAAA,EAAA,EAAA,WAAA,CADmC,CACf,CAAA,EAAoB,WAAW,EAOvE,OALA,MAAA,EAAA,EAAA,cAAA,CAAqC,EAAQ,IAAU,CACrD,GAAG,EACH,YAAa,IAAA,EACf,EAAE,EAEK,CACT,CAEA,IAAM,GAAmB,CACvB,KAAM,WACN,QAAS,KAAO,IAAmB,CACjC,IAAM,EAAc,EAAO,CAA0B,EAKrD,GAFA,MAAM,EAAY,YAAY,CAAK,EAE/B,MAAM,EAAY,gBAAgB,CAAK,EAEzC,OAAA,EAAA,EAAA,aAAA,CAAoB,EAAO,MADD,GAAwB,CAAK,CACjB,EAIxC,IAAM,GAAA,EAAA,EAAA,SAAA,CAAiB,CAAK,EACtB,EAAO,EAAM,KACb,EAAQ,EAAM,MAId,GAAA,EAAA,EAAA,WAAA,CAD0C,CAC3B,CAAA,EAAa,MAElC,GAAI,CAAC,GAAS,CAAC,GAAgB,IAAU,EACvC,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QACE,uFACF,cAAe,sBACjB,CAAC,EAgBH,OAZA,MAAA,EAAA,EAAA,cAAA,CAAqC,EAAQ,IAAU,CACrD,GAAG,EACH,MAAO,IAAA,EACT,EAAE,EAGF,MAAM,EAAY,eAAe,EAAO,EAAM,CAAK,GAMnD,EAAA,EAAA,aAAA,CAAoB,EAAO,MAHD,GAAwB,CAAK,CAGjB,CACxC,CACF,ECnFM,GAAY,WAAW,OACd,GAAU,OACzB,IAAM,OACG,GAAU,WAAW,ECOxB,GAAmB,CACvB,KAAM,QACN,QAAS,KAAO,IAAmB,CACjC,IAAM,EAAc,EAAO,CAA0B,EAGrD,MAAM,EAAY,YAAY,CAAK,EAGnC,IAAM,EAAQ,GAAW,EACnB,EAAQ,GAAW,EACnB,EAAe,GAAqB,EACpC,EAAgB,MAAM,GAAoB,CAAY,EAG5D,MAAA,EAAA,EAAA,cAAA,CAAqC,EAAQ,IAAoB,CAC/D,GAAG,EACH,QACA,QACA,cACF,EAAE,EAIF,IAAM,GAAA,EAAA,EAAA,SAAA,CADiB,CACH,CAAA,CAAM,aAEpB,EAAsB,EACxB,GAAoB,CAAW,EAC/B,IAgBJ,OAdA,MAAA,EAAA,EAAA,cAAA,CAAqC,EAAQ,IAAoB,CAC/D,GAAG,EACH,YACE,IAAwB,IAA4B,IAAA,GAAtB,CAClC,EAAE,GAUF,EAAA,EAAA,aAAA,CAAoB,EAAO,MAPL,EAAY,oBAAoB,CACpD,QACA,gBACA,OACF,CAAC,CAGiC,CACpC,CACF,EClDM,GAAmB,CACvB,KAAM,SACN,QAAS,KAAO,IAAmB,CACjC,IAAM,EAAS,EAAO,CAAa,CAAC,CAAC,WAAW,aAAa,EAE7D,GAAI,CACF,IAAM,EAAc,EAAO,CAA0B,EAWrD,OARA,MAAM,EAAY,YAAY,CAAK,GAQnC,EAAA,EAAA,aAAA,CAAoB,EAAO,MALH,EAAY,OAAO,CAAK,CAKZ,CACtC,OAAS,EAAO,CAEd,MADA,EAAO,MAAM,gBAAiB,CAAK,GACnC,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,eACX,CAAC,CACH,CACF,CACF,EC3BM,GAAmB,CACvB,KAAM,iBACN,QAAS,KAAO,KAOP,CACL,QAAS,sDACT,KAAA,MARkB,EAAO,CAIR,CAAA,CAAY,qBAAqB,CAAK,CAKzD,EAEJ,ECTA,eAAsB,GAAgB,EAAW,EAA6B,CAC5E,IAAM,EAAU,IAAI,YACd,EAAW,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAC/D,EAAM,MAAM,WAAW,OAAO,OAAO,UACzC,MACA,EACA,CAAE,KAAM,OAAQ,KAAM,SAAU,EAChC,GACA,CAAC,MAAM,CACT,EAEM,EAAU,IAAI,WAClB,MAAM,WAAW,OAAO,OAAO,KAAK,OAAQ,EAAK,EAAQ,OAAO,CAAC,CAAC,CACpE,EACM,EAAU,IAAI,WAClB,MAAM,WAAW,OAAO,OAAO,KAAK,OAAQ,EAAK,EAAQ,OAAO,CAAC,CAAC,CACpE,EAEI,EAAO,EACX,IAAK,IAAI,EAAI,EAAG,EAAI,EAAQ,OAAQ,IAClC,GAAQ,EAAQ,GAAK,EAAQ,GAE/B,OAAO,IAAS,CAClB,CC1BA,IAAM,GAAmB,CACvB,KAAM,iBACN,QAAS,KAAO,IAAmB,CACjC,IAAM,EAAS,EAAO,CAAa,CAAC,CAAC,WAAW,cAAc,EACxD,EAAc,EAAO,CAA0B,EAG/C,EAAS,EAAY,UAAU,CAAC,CAAC,mBACvC,GAAI,CAAC,EAEH,MADA,EAAO,MAAM,0HAA0H,GACvI,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,4BACX,CAAC,EAGH,IAAM,GAAA,EAAA,EAAA,kBAAA,CAA+B,CAAK,CAAC,CAAC,cAC5C,GAAI,CAAC,GAAc,CAAE,MAAM,GAAgB,EAAY,UAAU,GAAQ,EAEvE,MADA,EAAO,KAAK,oCAAoC,GAChD,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,cACX,CAAC,EAGH,GAAI,CAEF,IAAM,EAAS,MAAM,EAAY,sBAAsB,EASvD,OANA,EAAO,KAAK,8BAA+B,CACzC,UAAW,EAAO,UAClB,OAAQ,EAAO,OACf,MAAO,EAAO,KAChB,CAAC,EAEM,CACL,QAAS,GACT,GAAG,CACL,CACF,OAAS,EAAO,CAEd,MADA,EAAO,MAAM,6BAA8B,CAAK,GAChD,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,0BACX,CAAC,CACH,CACF,CACF,EClDM,GAAmB,CACvB,KAAM,OACN,QAAS,KAAO,IAAmB,CACjC,IAAM,EAAc,EAAO,CAA0B,EAMrD,GAHA,MAAM,EAAY,YAAY,CAAK,EAG/B,CAAE,MAAM,EAAY,gBAAgB,CAAK,EAC3C,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,QAAS,cACX,CAAC,EAIH,OAAO,EAAY,qBAAqB,CAAK,CAC/C,CACF,ECZA,SAAgB,IAAiB,CAC/B,MAAO,EACJ,GAAc,MAAO,GAAc,SACnC,GAAS,MAAO,GAAS,SACzB,GAAM,MAAO,GAAM,SACnB,GAAO,MAAO,GAAO,SACrB,GAAc,MAAO,GAAc,SACnC,GAAc,MAAO,GAAc,SACnC,GAAK,MAAO,GAAK,OACpB,CACF,CCtBA,SAAgB,GAAmB,EAAsB,CAQrD,OAHiB,IAHD,IAAI,EAAM,mBAGT,CAAA,CAAI,SAAS,MAAM,GAAG,CAAC,CAAC,OAAO,OAGzC,CAAA,CAAS,IAAI,GAAK,EAC7B,CCHA,eAAsB,GAAgB,EAAgB,CACpD,GAAI,EAAM,KAAK,SAAS,YAAY,EAAG,CACrC,IAAM,EAAO,GAAmB,EAAM,IAAI,EAE1C,GAAI,CAAC,EACH,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,cAAe,wBACjB,CAAC,EAIH,MADoB,EAAO,CACrB,CAAA,CAAY,YAAY,CAAK,EAGnC,IAAM,EAAS,GAAe,EAE9B,GAAI,EAAO,GACT,OAAO,EAAO,EAAK,CAAC,CAAK,EAK3B,MAAA,EAAA,EAAA,YAAA,CAAkB,CAChB,WAAY,IACZ,cAAe,yBAAyB,EAAK,YAC/C,CAAC,CACH,CACF,CC9BA,eAAsB,GAAoB,EAAgB,CACxD,IAAM,EAAc,EAAO,CAA0B,EAIrD,OAFA,MAAM,EAAY,YAAY,CAAK,EAE5B,EAAY,gBAAgB,CAAK,CAC1C,CCDA,eAAsB,GAAwB,EAAgB,CAC5D,IAAM,GAAA,EAAA,EAAA,cAAA,CAA2B,CAAK,EAChC,EAAW,EAAW,SACtB,EAAc,EAAO,CAA0B,EAC/C,EAAS,EAAO,CAAa,CAAC,CAAC,WAAW,gBAAgB,EAEhE,KAAO,KAAK,uCAAwC,CAAQ,EAGxD,GAAS,WAAW,YAAY,GAQlC,IAAY,mBAAmB,CAAQ,GACvC,IAAa,aACb,EAAS,WAAW,YAAY,KAKlC,MAAM,EAAY,YAAY,CAAK,EAC/B,OAAM,GAAoB,CAAK,GAMnC,KAAA,EAAA,EAAA,UAAA,CAAc,EAAO,OAAO,IAAM,OAChC,MAAM,IAAI,EAAA,UAAU,CAClB,KAAM,eACN,QAAS,2BACX,CAAC,EAGH,EAAO,MAAM,4BAA6B,CAAE,KAAM,CAAS,CAAC,EAC5D,MAAA,EAAA,EAAA,cAAA,CAAoB,EAAQ,IAA6C,CACvE,GAAG,EACH,YAAa,GAAoB,GAAG,EAAW,WAAW,EAAW,QAAQ,CAC/E,EAAE,EACF,MAAA,EAAA,EAAA,aAAA,CAAmB,EAAO,iBAAiB,CARxC,CASL,CCvCA,eAAsB,GAAc,EAA0B,EAAgB,CAS5E,IAAM,EAAgB,CANpB,SACA,WACA,eACA,aAGoB,CAAA,CAAgB,OAAQ,GAAU,CAAC,EAAO,EAAM,EAEtE,GAAI,EAAc,OAAS,EACzB,MAAU,MACR,6EAA6E,EAAc,KACzF,IACF,GACF,EAQF,OAJA,GAAgB,EAA4B,CAAM,EAElD,MAAM,GAAwB,CAAK,EAE5B,GAAgB,CAAK,CAC9B"}