{"version":3,"sources":["../src/utils/zod.ts","../src/error.ts","../src/utils/cookie-options.ts","../src/utils/encrypt.ts","../src/utils/config.ts","../src/utils/jwt.ts","../src/utils/encrypt-tokens.ts","../src/utils/helpers.ts","../src/core.ts"],"names":["z","COMPRESSION_REGEX","ENCRYPTION_REGEX","ZodError","nodeGenerateUuid","webApiGenerateUuid","createNodeKey","isNodeKey","secretKey","secretKeyError","encrypted","nodeEncrypt","isWebApiKey","createWebApiKey","webApiEncrypt","decrypted","nodeDecrypt","webApiDecrypt","stringifyObj","parseToObj","CryptoProvider","JwksClient","ConfidentialClientApplication","jwt","error","compressObj","decompressObj","params","azure"],"mappings":";;;;;;;;;;;;;;;;AAIO,SAAS,OAAO,KAAA,EAAiC;AACtD,EAAA,OAAO,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,OAAO,UAAU,QAAA,IAAY,KAAA,CAAM,IAAA,EAAK,CAAE,MAAA,GAAS,CAAA;AACrG;AAEO,SAAS,OAAO,KAAA,EAAkD;AACvE,EAAA,OACE,OAAO,KAAA,KAAU,QAAA,IACjB,KAAA,KAAU,IAAA,IACV,UAAU,MAAA,KACT,MAAA,CAAO,cAAA,CAAe,KAAK,MAAM,MAAA,CAAO,SAAA,IAAa,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,CAAA;AAE3F;AAEO,IAAM,qBAAA,GAAwB,mBAAA;AAE9B,IAAM,IAAA,GAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAA,EAAK;AAC7B,IAAM,KAAA,GAAQA,MAAE,IAAA,EAAK;AACrB,IAAM,IAAA,GAAOA,MAAE,GAAA,EAAI;AACnB,IAAM,MAAA,GAASA,MAAE,KAAA,CAAM,EAAE,SAASA,KAAA,CAAE,OAAA,CAAQ,YAAY,CAAA;AACxCA,MAAE,SAAA;AAClB,IAAM,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,qBAAqB,CAAA;AACjC,IAAA,CAAK,KAAA,CAAMC,6BAAA,CAAkB,OAAO;AAExD,IAAM,eAAeD,KAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,gBAAA,EAAkB,KAAK,CAAC,CAAA;AAC9D,IAAM,YAAYA,KAAA,CAAE,IAAA,CAAK,CAAC,IAAA,EAAM,KAAK,CAAC,CAAA;AACtC,IAAM,cAAcA,KAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,MAAM,CAAC,CAAA;AAC9C,IAAM,kBAAA,GAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAC/C,IAAM,mBAAA,GAAsBA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,IAAI,CAAA;AACtD,IAAM,cAAA,GAAiBA,KAAA,CAAE,KAAA,CAAM,CAAC,IAAA,CAAK,IAAI,IAAI,CAAA,CAAE,SAAA,CAAU,CAAC,GAAA,KAAQ,CAAC,GAAG,CAAC,CAAA,EAAGA,KAAA,CAAE,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,IAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA;AAElG,IAAM,aAAa,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,CAAE,KAAA,CAAME,2BAAiB,OAAO,CAAA;AAChE,IAAM,IAAA,GAAOF,KAAA,CAAE,GAAA,EAAI,CAAE,IAAI,IAAI;AAE7B,IAAM,SAAA,GAAYA,MAAE,KAAA,CAAM,CAACA,MAAE,OAAA,CAAQ,QAAQ,CAAA,EAAG,KAAK,CAAC,CAAA;AACtD,IAAM,SAAS,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAClC,IAAM,iBAAiB,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,CAAE,IAAI,EAAE,CAAA;AAC1C,IAAM,eAAe,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAEvC,IAAM,MAAA,GAASA,MAAE,MAAA,CAAO;AAAA,EAC7B,QAAA,EAAU,KAAA;AAAA,EACV,QAAA,EAAU,SAAA;AAAA,EACV,QAAQA,KAAA,CAAE,KAAA,CAAM,MAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAC7B,cAAc,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EAClC,oBAAoBA,KAAA,CACjB,KAAA;AAAA,IACCA,MAAE,MAAA,CAAO;AAAA,MACP,WAAA,EAAa,YAAA;AAAA,MACb,KAAA,EAAO,MAAA;AAAA,MACP,UAAA,EAAY,cAAA;AAAA,MACZ,aAAA,EAAe,cAAA;AAAA,MACf,UAAA,EAAY,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAAA,MACtC,iBAAA,EAAmB,kBAAA,CAAmB,OAAA,CAAQ,IAAI;AAAA,KACnD;AAAA,GACH,CACC,GAAA,CAAI,CAAC,CAAA,CACL,QAAA,EAAS;AAAA,EACZ,SAASA,KAAA,CACN,KAAA,CAAMA,KAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,YAAA,EAAc,KAAA,EAAO,MAAA,EAAQ,CAAC,CAAA,CACxD,GAAA,CAAI,CAAC,EACL,QAAA;AACL,CAAC,CAAA;AAEM,IAAM,OAAA,GAAUA,MAAE,MAAA,CAAO;AAAA,EAC9B,OAAOA,KAAA,CAAE,KAAA,CAAM,CAAC,MAAA,CAAO,SAAA,CAAU,CAAC,KAAA,KAAU,CAAC,KAAK,CAAC,CAAA,EAAGA,MAAE,KAAA,CAAM,MAAM,EAAE,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA;AAAA,EAC7E,WAAA,EAAa,cAAA;AAAA,EACb,iBAAA,EAAmB,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA;AAAA,EAChC,aAAA,EAAe,cAAA;AAAA,EACf,QAAA,EAAUA,MACP,MAAA,CAAO;AAAA,IACN,WAAA,EAAa,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAA;AAAA,IACvC,iBAAA,EAAmBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,IAC5C,UAAA,EAAY,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAAA,IACtC,kBAAA,EAAoBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,IAC7C,OAAA,EAASA,MACN,MAAA,CAAO;AAAA,MACN,QAAA,EAAU,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA;AAAA,MACjC,aAAA,EAAeA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,MACxC,eAAA,EAAiBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,MAC1C,iBAAA,EAAmB,kBAAA,CAAmB,OAAA,CAAQ,IAAI,CAAA;AAAA,MAClD,kBAAA,EAAoB,mBAAA,CAAoB,OAAA,CAAQ,MAAO;AAAA,KACxD,CAAA,CACA,QAAA,CAAS,EAAE;AAAA,GACf,CAAA,CACA,QAAA,CAAS,EAAE;AAChB,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO,EAAE,UAAU,KAAA,EAAO,QAAA,EAAU,WAAW,CAAA;AAEvE,IAAM,gBAAA,GAAmBA,MAAE,MAAA,CAAO;AAAA,EACvC,KAAA,EAAOA,MAAE,KAAA,CAAM;AAAA,IACb,oBAAA;AAAA,IACA,qBAAqB,MAAA,CAAO;AAAA,MAC1B,cAAc,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,MAClC,SAASA,KAAA,CACN,KAAA,CAAMA,KAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,YAAA,EAAc,KAAA,EAAO,MAAA,EAAQ,CAAC,CAAA,CACxD,GAAA,CAAI,CAAC,EACL,QAAA;AAAS,KACb;AAAA,GACF;AACH,CAAC,CAAA;AAEM,IAAM,MAAA,GAASA,MAAE,MAAA,CAAO;AAAA,EAC7B,OAAA,EAAS,KAAA;AAAA,EACT,WAAA,EAAa,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA;AAAA,EAC1B,YAAA,EAAc,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA;AAAA,EAC1B,KAAA,EAAO,KAAA;AAAA,EACP,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAChC,MAAA,EAAQA,MAAE,IAAA,CAAK,CAAC,SAAS,gBAAgB,CAAC,EAAE,QAAA,EAAS;AAAA,EACrD,QAAA,EAAU;AACZ,CAAC,CAAA;AAEM,IAAM,aAAA,GAAgBA,MAAE,MAAA,CAAO,IAAA,EAAMA,MAAE,GAAA,EAAK,EAAE,QAAA,EAAS;AAEvD,IAAM,SAAA,GAAYA,MAAE,MAAA,CAAO;AAAA,EAChC,EAAA,EAAI,IAAA;AAAA,EACJ,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,QAAA,EAAS;AAAA,EAC7B,KAAKA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EAC/B,GAAA,EAAK;AACP,CAAC,CAAA;AAEM,IAAM,SAAA,GAAYA,MAAE,MAAA,CAAO;AAAA,EAChC,EAAA,EAAI,YAAA;AAAA,EACJ,KAAKA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EAC/B,GAAA,EAAK;AACP,CAAC,CAAA;AAEM,IAAM,QAAA,GAAW;AAAA,EACtB,UAAA,EAAYA,MACT,MAAA,CAAO;AAAA,IACN,WAAA,EAAa,aAAa,QAAA,EAAS;AAAA,IACnC,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,IAChC,WAAA,EAAa,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,QAAA,EAAS;AAAA,IACrC,OAAA,EAAS,MAAM,QAAA;AAAS,GACzB,CAAA,CACA,OAAA,CAAQ,EAAE,CAAA;AAAA,EACb,cAAA,EAAgBA,MAAE,MAAA,CAAO;AAAA,IACvB,MAAM,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,CAAE,MAAM,qBAAqB,CAAA;AAAA,IAChD,KAAA,EAAO;AAAA,GACR,CAAA;AAAA,EACD,YAAA,EAAcA,MACX,MAAA,CAAO;AAAA,IACN,WAAA,EAAa,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,QAAA,EAAS;AAAA,IACrC,OAAA,EAAS,MAAM,QAAA;AAAS,GACzB,CAAA,CACA,OAAA,CAAQ,EAAE,CAAA;AAAA,EACb,cAAA,EAAgBA,MAAE,KAAA,CAAM;AAAA,IACtBA,MACG,MAAA,CAAO;AAAA,MACN,OAAA,EAAS,MAAM,QAAA,EAAS;AAAA,MACxB,GAAA,EAAK;AAAA,KACN,CAAA,CACA,SAAA,CAAU,CAAC,IAAA,MAAU;AAAA,MACpB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,IAAA,EAAM,CAAC,IAAA,CAAK,GAAG;AAAA,KACjB,CAAE,CAAA;AAAA,IACJA,MAAE,MAAA,CAAO;AAAA,MACP,OAAA,EAAS,MAAM,QAAA,EAAS;AAAA,MACxB,MAAMA,KAAA,CAAE,KAAA,CAAM,YAAY,CAAA,CAAE,IAAI,CAAC;AAAA,KAClC;AAAA,GACF,CAAA;AAAA,EACD,kBAAA,EAAoBA,MAAE,KAAA,CAAM;AAAA,IAC1BA,MACG,MAAA,CAAO;AAAA,MACN,aAAaA,KAAA,CAAE,KAAA,CAAM,CAAC,IAAA,EAAM,UAAU,CAAC,CAAA;AAAA,MACvC,OAAA,EAAS,YAAA;AAAA,MACT,OAAA,EAAS,MAAM,QAAA;AAAS,KACzB,CAAA,CACA,SAAA,CAAU,CAAC,IAAA,MAAU;AAAA,MACpB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,QAAA,EAAU,CAAC,IAAA,CAAK,OAAO,CAAA;AAAA,MACvB,SAAS,IAAA,CAAK;AAAA,KAChB,CAAE,CAAA;AAAA,IACJA,MAAE,MAAA,CAAO;AAAA,MACP,aAAaA,KAAA,CAAE,KAAA,CAAM,CAAC,IAAA,EAAM,UAAU,CAAC,CAAA;AAAA,MACvC,UAAUA,KAAA,CAAE,KAAA,CAAM,YAAY,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,MACrC,OAAA,EAAS,MAAM,QAAA;AAAS,KACzB;AAAA,GACF;AACH;;;ACnKO,SAAS,IAAO,MAAA,EAAuB;AAC5C,EAAA,IAAI,MAAA,CAAO,MAAM,CAAA,EAAG;AAClB,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,GAAI,MAAA,EAAkB;AAAA,EAChD;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAO;AACjC;AAKO,SAAS,KACd,GAAA,EAC0B;AAC1B,EAAA,IAAI,eAAe,UAAA,EAAY;AAC7B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,aAAa,GAAA,CAAI,WAAA,EAAa,UAAA,EAAY,GAAA,CAAI,UAAA;AAAW,KAC1F;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,KAAA,EACE,KAAA,IAAS,GAAA,IAAO,MAAA,IAAU,GAAA,GACtB,EAAE,OAAA,EAAS,GAAA,CAAI,GAAA,EAAK,WAAA,EAAa,GAAA,CAAI,IAAA,EAAM,UAAA,EAAY,GAAA,CAAI,MAAA,IAAU,GAAA,EAAI,GACzE,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,WAAA,EAAa,GAAA,CAAI,WAAA,EAAa,UAAA,EAAY,GAAA,CAAI,UAAA,IAAc,GAAA;AAAI,GAChG;AACF;AAUO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EAOpC,YAAY,GAAA,EAAoG;AAC9G,IAAA,IAAI,OAAA,IAAW,GAAA,IAAO,SAAA,IAAa,GAAA,EAAK;AACtC,MAAA,KAAA,CAAO,GAAA,CAAI,MAAoB,OAAO,CAAA;AACtC,MAAA,IAAA,CAAK,UAAA,GAAc,IAAI,KAAA,CAAoB,UAAA;AAC3C,MAAA,IAAA,CAAK,WAAA,GAAe,IAAI,KAAA,CAAoB,WAAA;AAAA,IAC9C,CAAA,MAAA,IAAW,KAAA,IAAS,GAAA,IAAO,MAAA,IAAU,GAAA,EAAK;AACxC,MAAA,KAAA,CAAM,IAAI,GAAG,CAAA;AACb,MAAA,IAAA,CAAK,UAAA,GAAa,IAAI,MAAA,IAAU,GAAA;AAChC,MAAA,IAAA,CAAK,cAAc,GAAA,CAAI,IAAA;AAAA,IACzB,WAAW,SAAA,IAAa,GAAA,IAAO,aAAA,IAAiB,GAAA,IAAO,gBAAgB,GAAA,EAAK;AAC1E,MAAA,KAAA,CAAM,IAAI,OAAO,CAAA;AACjB,MAAA,IAAA,CAAK,aAAa,GAAA,CAAI,UAAA;AACtB,MAAA,IAAA,CAAK,cAAc,GAAA,CAAI,WAAA;AAAA,IACzB,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,2BAA2B,CAAA;AACjC,MAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAClB,MAAA,IAAA,CAAK,WAAA,GAAc,2BAAA;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,YAAA;AAEZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAChD,IAAA,IAAI,MAAM,iBAAA,EAAmB,KAAA,CAAM,iBAAA,CAAkB,IAAA,EAAM,KAAK,WAAW,CAAA;AAAA,EAC7E;AACF;AAEO,SAAS,WAAW,GAAA,EAAsB;AAC/C,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,GAAA,YAAe,UAAA;AAClB,MAAA,OAAO,CAAA,YAAA,EAAe,IAAI,OAAO,CAAA,EAAA,EAAK,IAAI,UAAU,CAAA,IAAA,EAAO,IAAI,WAAW,CAAA,CAAA;AAAA,IAC5E,KAAK,GAAA,YAAeG,YAAA;AAClB,MAAA,OAAO,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAA,CACzC,GAAA,CAAI,CAAC,UAAU,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,MAAA,GAAS,CAAA,GAAI,KAAA,CAAM,KAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAM,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA,CAC3F,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IACf,KAAK,GAAA,YAAe,KAAA;AAClB,MAAA,OAAO,CAAA,MAAA,EAAS,IAAI,IAAI,CAAA,EAAA,EAAK,IAAI,OAAO,CAAA,GAAA,EAAM,GAAA,CAAI,KAAA,IAAS,0BAA0B,CAAA,CAAA;AAAA,IACvF,KAAK,OAAO,GAAA,KAAQ,QAAA;AAClB,MAAA,OAAO,iBAAiB,GAAG,CAAA,CAAA;AAAA,IAC7B,MAAK,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA;AACtC,MAAA,QAAQ,IAAA;AAAM,QACZ,MAAK,SAAA,IAAa,GAAA,IAChB,IAAI,OAAA,KAAY,KAAA,IAChB,WAAW,GAAA,IACX,OAAO,GAAA,CAAI,KAAA,KAAU,YACrB,GAAA,CAAI,KAAA,IACJ,aAAa,GAAA,CAAI,KAAA,IACjB,iBAAiB,GAAA,CAAI,KAAA;AACrB,UAAA,OAAO,oBAAoB,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,EAAG,gBAAgB,GAAA,CAAI,KAAA,GAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,MAAM,UAAU,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,GAAA,EAAM,GAAA,CAAI,MAAM,WAAW,CAAA,CAAA;AAAA,QACzI,MAAK,SAAA,IAAa,GAAA,IAAO,aAAA,IAAiB,GAAA;AACxC,UAAA,OAAO,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAO,CAAA,EAAG,YAAA,IAAgB,GAAA,GAAM,CAAA,EAAA,EAAK,GAAA,CAAI,UAAU,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,GAAA,EAAM,IAAI,WAAW,CAAA,CAAA;AAAA,QACjH,MAAK,KAAA,IAAS,GAAA,IAAO,MAAA,IAAU,GAAA;AAC7B,UAAA,OAAO,CAAA,iBAAA,EAAoB,GAAA,CAAI,GAAG,CAAA,EAAG,QAAA,IAAY,GAAA,GAAM,CAAA,EAAA,EAAK,GAAA,CAAI,MAAM,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,GAAA,EAAM,IAAI,IAAI,CAAA,CAAA;AAAA,QAC9F;AACE,UAAA,IAAI;AACF,YAAA,OAAO,CAAA,cAAA,EAAiB,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,CAAC,CAAA,EAAG,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,CAAE,QAAA,EAAS,GAAI,CAAE,CAAC,CAAA,CAAA;AAAA,UACnG,CAAA,CAAA,MAAQ;AACN,YAAA,OAAO,CAAA,+BAAA,EAAkC,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,UACtD;AAAA;AACJ,IACF;AACE,MAAA,OAAO,CAAA,eAAA,EAAkB,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA;AAE1C;;;AC1HO,IAAM,iBAAA,GAAoB,IAAA;AAC1B,IAAM,kBAAA,GAAqB,IAAA;AAE3B,SAAS,kBAAkB,MAAA,EAMZ;AACpB,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,QAAA,KAAa,KAAA,GAAQ,CAAA,GAAI,GAAA;AAClD,EAAA,MAAM,WAAA,GAAc;AAAA,IAClB,QAAA,EAAU,IAAA;AAAA,IACV,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,UAAU,MAAA,CAAO,QAAA,GAAW,QAAA,GAAW,MAAA,CAAO,SAAS,MAAA,GAAS,MAAA;AAAA,IAChE,IAAA,EAAM;AAAA,GACR;AAEA,EAAA,OAAO;AAAA,IACL,oBAAoB,EAAE,GAAG,aAAa,MAAA,EAAQ,MAAA,CAAO,QAAQ,SAAA,EAAU;AAAA,IACvE,qBAAqB,EAAE,GAAG,aAAa,MAAA,EAAQ,MAAA,CAAO,QAAQ,SAAA,EAAU;AAAA,IACxE,kBAAA,EAAoB,EAAE,GAAG,WAAA,EAAa,QAAQ,CAAA;AAAE,GAClD;AACF;AAEO,SAAS,eAAA,CAAgB,UAAkB,MAAA,EAAkC;AAClF,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,CAAA,EAAG,CAAA,EAAG,MAAA,GAAS,SAAA,GAAY,EAAE,CAAA,EAAG,iBAAiB,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA,CAAA;AAAA,IAChF,gBAAA,EAAkB,CAAA,EAAG,CAAA,EAAG,MAAA,GAAS,SAAA,GAAY,EAAE,CAAA,EAAG,kBAAkB,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAAA,GACpF;AACF;ACVO,SAAS,cAAc,UAAA,EAAkD;AAC9E,EAAA,MAAM,IAAA,GAAO,UAAA,KAAe,MAAA,GAASC,iBAAA,KAAqBC,mBAAA,EAAmB;AAC7E,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,yBAAA,EAA2B,IAAA,EAAM,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,CAAA;AAC5F,EAAA,OAAO,GAAA,CAAI,EAAE,IAAA,EAAM,IAAA,CAAK,QAAQ,CAAA;AAClC;AAUO,SAAS,cAAA,CACd,YACA,IAAA,EAQC;AACD,EAAA,IAAI,eAAe,SAAA,EAAW;AAC5B,IAAA,OAAO,GAAA,CAAI,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,aAAa,EAAC;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAA4B;AAC7D,IAAA,MAAM,EAAE,SAAA,EAAW,KAAA,KAAUC,oBAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA;AACrD,IAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,KAAK,CAAA,iBAAA,EAAoB,IAAI,CAAA,IAAA,CAAA,EAAQ,IAAA,EAAM,CAAA,eAAA,EAAkB,UAAA,CAAW,KAAK,CAAC,IAAI,CAAA;AAC3G,IAAA,UAAA,CAAW,IAAI,CAAA,GAAI,SAAA;AAAA,EACrB;AAEA,EAAA,OAAO,GAAA,CAAI,EAAE,UAAA,EAAwB,CAAA;AACvC;AAEA,eAAsB,QAAA,CACpB,UAAA,EACA,IAAA,EACA,GAAA,EAC6E;AAC7E,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAM,yBAAA,EAA2B,CAAA;AAC/E,EAAA,IAAI,eAAe,MAAA,EAAQ;AACzB,IAAA,IAAI,CAAC,MAAA,CAAO,GAAG,KAAK,CAACC,cAAA,CAAU,GAAG,CAAA,EAAG;AACnC,MAAA,OAAO,KAAK,EAAE,GAAA,EAAK,kBAAA,EAAoB,IAAA,EAAM,8BAA8B,CAAA;AAAA,IAC7E;AACA,IAAA,MAAM,EAAE,SAAA,EAAAC,UAAAA,EAAW,OAAOC,eAAAA,EAAe,GAAIH,qBAAc,GAAG,CAAA;AAC9D,IAAA,IAAIG,eAAAA,EAAgB;AAClB,MAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kCAAA,EAAoC,IAAA,EAAM,kBAAkB,UAAA,CAAWA,eAAc,CAAC,CAAA,CAAA,EAAI,CAAA;AAAA,IAC/G;AAEA,IAAA,MAAMC,UAAAA,GAAYC,YAAA,CAAY,IAAA,EAAMH,UAAS,CAAA;AAC7C,IAAA,IAAIE,UAAAA,CAAU,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAWA,UAAAA,CAAU,KAAK,CAAC,IAAI,CAAA;AAElH,IAAA,OAAO,IAAI,EAAE,SAAA,EAAWA,WAAU,MAAA,EAAQ,YAAA,EAAc,QAAW,CAAA;AAAA,EACrE;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,GAAG,KAAK,CAACE,kBAAA,CAAY,GAAG,CAAA,EAAG;AACrC,IAAA,OAAO,KAAK,EAAE,GAAA,EAAK,kBAAA,EAAoB,IAAA,EAAM,gCAAgC,CAAA;AAAA,EAC/E;AAEA,EAAA,MAAM,EAAE,SAAA,EAAW,KAAA,EAAO,gBAAe,GAAI,MAAMC,uBAAgB,GAAG,CAAA;AACtE,EAAA,IAAI,cAAA,EAAgB,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,uCAAuC,IAAA,EAAM,UAAA,CAAW,cAAc,CAAA,EAAG,CAAA;AAEhH,EAAA,MAAM,SAAA,GAAY,MAAMC,cAAA,CAAc,IAAA,EAAM,SAAS,CAAA;AACrD,EAAA,IAAI,SAAA,CAAU,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,SAAA,CAAU,KAAK,CAAC,IAAI,CAAA;AAElH,EAAA,OAAO,IAAI,EAAE,SAAA,EAAW,UAAU,MAAA,EAAQ,YAAA,EAAc,WAAW,CAAA;AACrE;AAEA,eAAsB,QAAA,CACpB,UAAA,EACA,SAAA,EACA,GAAA,EAC0E;AAC1E,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAM,yBAAA,EAA2B,CAAA;AACpF,EAAA,IAAI,eAAe,MAAA,EAAQ;AACzB,IAAA,IAAI,CAAC,MAAA,CAAO,GAAG,KAAK,CAACP,cAAA,CAAU,GAAG,CAAA,EAAG;AACnC,MAAA,OAAO,KAAK,EAAE,GAAA,EAAK,kBAAA,EAAoB,IAAA,EAAM,8BAA8B,CAAA;AAAA,IAC7E;AAEA,IAAA,MAAM,EAAE,SAAA,EAAAC,UAAAA,EAAW,OAAOC,eAAAA,EAAe,GAAIH,qBAAc,GAAG,CAAA;AAC9D,IAAA,IAAIG,eAAAA,EAAgB,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,oCAAoC,IAAA,EAAM,UAAA,CAAWA,eAAc,CAAA,EAAG,CAAA;AAE7G,IAAA,MAAMM,UAAAA,GAAYC,YAAA,CAAY,SAAA,EAAWR,UAAS,CAAA;AAClD,IAAA,IAAIO,UAAAA,CAAU,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAWA,UAAAA,CAAU,KAAK,CAAC,IAAI,CAAA;AAElH,IAAA,OAAO,IAAI,EAAE,MAAA,EAAQA,WAAU,MAAA,EAAQ,YAAA,EAAc,QAAW,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,GAAG,KAAK,CAACH,kBAAA,CAAY,GAAG,CAAA,EAAG;AACrC,IAAA,OAAO,KAAK,EAAE,GAAA,EAAK,kBAAA,EAAoB,IAAA,EAAM,gCAAgC,CAAA;AAAA,EAC/E;AAEA,EAAA,MAAM,EAAE,SAAA,EAAW,KAAA,EAAO,gBAAe,GAAI,MAAMC,uBAAgB,GAAG,CAAA;AACtE,EAAA,IAAI,cAAA,EAAgB,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,uCAAuC,IAAA,EAAM,UAAA,CAAW,cAAc,CAAA,EAAG,CAAA;AAEhH,EAAA,MAAM,SAAA,GAAY,MAAMI,cAAA,CAAc,SAAA,EAAW,SAAS,CAAA;AAC1D,EAAA,IAAI,SAAA,CAAU,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,SAAA,CAAU,KAAK,CAAC,IAAI,CAAA;AAElH,EAAA,OAAO,IAAI,EAAE,MAAA,EAAQ,UAAU,MAAA,EAAQ,YAAA,EAAc,WAAW,CAAA;AAClE;AAEA,eAAsB,WAAA,CACpB,UAAA,EACA,GAAA,EACA,GAAA,EAC6E;AAC7E,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAM,yBAAA,EAA2B,CAAA;AAC9E,EAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAM,GAAIC,uBAAa,GAAG,CAAA;AAC1C,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,8BAA8B,IAAA,EAAM,UAAA,CAAW,KAAK,CAAA,EAAG,CAAA;AACrF,EAAA,OAAO,MAAM,QAAA,CAAS,UAAA,EAAY,MAAA,EAAQ,GAAG,CAAA;AAC/C;AAEA,eAAsB,WAAA,CACpB,UAAA,EACA,SAAA,EACA,GAAA,EAC2F;AAC3F,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAM,yBAAA,EAA2B,CAAA;AACpF,EAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,UAAA,EAAY,WAAW,GAAG,CAAA;AAC3D,EAAA,IAAI,SAAA,CAAU,OAAO,OAAO,SAAA;AAC5B,EAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAM,GAAIC,oBAAA,CAAW,UAAU,MAAM,CAAA;AACrD,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,0BAA0B,IAAA,EAAM,UAAA,CAAW,KAAK,CAAA,EAAG,CAAA;AACjF,EAAA,OAAO,IAAI,EAAE,MAAA,EAAQ,YAAA,EAAc,SAAA,CAAU,cAAc,CAAA;AAC7D;;;AC/HO,SAAS,aAAa,aAAA,EAU1B;AACD,EAAA,MAAM,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,aAAY,GAAI,OAAA,CAAQ,UAAU,aAAa,CAAA;AAC5E,EAAA,IAAI,WAAA,EAAa,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,MAAA,EAAQ,GAAA,EAAK,CAAA;AAElG,EAAA,MAAM,eAAe,MAAA,CAAO,WAAA;AAE5B,EAAA,MAAM,eAAA,GAAkB,aAAa,GAAA,CAAI,CAAC,QAAQ,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAC9D,EAAA,MAAM,eAAA,GAAkB,IAAI,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA;AAExD,EAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,eAAA,CAAgB,IAAI,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAI,CAAC,CAAA;AACpE,EAAA,MAAM,aAAa,eAAA,CAAgB,IAAA;AAEnC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAA,CAAO,QAAA;AAC3B,EAAA,MAAM,oBAAoB,iBAAA,CAAkB;AAAA,IAC1C,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,OAAO,OAAA,CAAQ,iBAAA;AAAA,IACf,OAAO,OAAA,CAAQ,kBAAA;AAAA,IACf,MAAA,EAAQ,CAAC,OAAA,CAAQ,aAAA,IAAiB,CAAC,eAAA,EAAiB,GAAG,eAAe,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ,GAAA,CAAI,aAAa,QAAQ,CAAA;AAAA,IAChH,QAAA,EAAU,CAAC,OAAA,CAAQ,eAAA,IAAmB,cAAc,IAAA,KAAS,CAAA,IAAK,aAAA,CAAc,GAAA,CAAI,UAAU;AAAA,GAC/F,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CACnB,GAAA,CAAI,CAAC,KAAA,KAAU;AACd,MAAA,MAAM,MAAM,UAAA,CAAW;AAAA,QACrB,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB,cAAc,KAAA,CAAM;AAAA,OACrB,CAAA;AAED,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AACjC,MAAA,MAAM,MAAM,OAAA,CAAQ;AAAA,QAClB,aAAa,KAAA,CAAM,kBAAA;AAAA,QACnB,MAAA,EAAQ,kBAAkB,kBAAA,CAAmB,MAAA;AAAA,QAC7C,QAAA,EAAU,kBAAkB,kBAAA,CAAmB,QAAA;AAAA,QAC/C,KAAA,EAAO,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,iBAAA;AAAA,QAC/B;AAAA,OACD,CAAA;AAED,MAAA,MAAM,cAAc,eAAA,CAAgB,KAAA,CAAM,QAAA,EAAU,iBAAA,CAAkB,mBAAmB,MAAM,CAAA;AAE/F,MAAA,OAAO;AAAA,QACL,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,YAAA,EAAc,WAAA;AAAA,QACd,GAAA;AAAA,QACA,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,UAAU,GAAA,CAAI,KAAA;AAAA,QACd,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,UAAU,GAAA,CAAI;AAAA,OAChB;AAAA,IACF,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,KAAA,KAAU,CAAC,CAAC,KAAK,CAAA;AAE5B,IAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,GAAA,EAAK,qCAAA;AAAA,QACL,IAAA,EAAM,yEAAA;AAAA,QACN,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,EAAE,YAAY,cAAA,EAAgB,KAAA,EAAO,iBAAgB,GAAI,cAAA,CAAe,MAAA,CAAO,QAAA,CAAS,UAAA,EAAY;AAAA,MACxG,WAAA,EAAa,CAAA,aAAA,EAAgB,MAAA,CAAO,aAAa,CAAA,CAAA;AAAA,MACjD,YAAA,EAAc,CAAA,cAAA,EAAiB,MAAA,CAAO,aAAa,CAAA,CAAA;AAAA,MACnD,KAAA,EAAO,CAAA,MAAA,EAAS,MAAA,CAAO,aAAa,CAAA,CAAA;AAAA,MACpC,MAAA,EAAQ,CAAA,OAAA,EAAU,MAAA,CAAO,aAAa,CAAA;AAAA,KACvC,CAAA;AACD,IAAA,IAAI,eAAA,EAAiB,OAAO,IAAA,CAAK,eAAe,CAAA;AAEhD,IAAA,MAAM,kBAAA,GAAqB,IAAIC,uBAAA,EAAe;AAE9C,IAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAO,SAAA,EAAU,GAAI,WAAA,CAAY,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,MAAA,CAAO,CAAC,CAAA,CAAE,WAAW,QAAQ,CAAA;AACxG,IAAA,IAAI,SAAA,EAAW,OAAO,IAAA,CAAK,SAAS,CAAA;AAEpC,IAAA,MAAM,QAAA,GAA0B;AAAA,MAC9B,WAAA,EAAa,OAAO,QAAA,CAAS,WAAA;AAAA,MAC7B,iBAAA,EAAmB,OAAO,QAAA,CAAS,iBAAA;AAAA,MACnC,UAAA,EAAY,OAAO,QAAA,CAAS,UAAA;AAAA,MAC5B,kBAAA,EAAoB,OAAO,QAAA,CAAS,kBAAA;AAAA,MACpC,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,CAAM,QAAQ,CAAA,GACzC,MAAA,CACE,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,OAAA,EAAS,KAAA,CAAM,QAAA,EAAU,KAAA,EAAO,KAAA,CAAM,QAAA,EAAS,CAAE,CAAA,CACnE,MAAA,CAAO,CAAC,KAAA,KAAU,CAAC,CAAC,KAAK,CAAA,GAC5B,KAAA,CAAA;AAAA,MACJ,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,CAAM,QAAQ,CAAA,GACpD,MAAA,CACE,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,OAAA,EAAS,KAAA,CAAM,QAAA,EAAU,KAAA,EAAO,KAAA,CAAM,QAAA,EAAS,CAAE,CAAA,CACnE,MAAA,CAAO,CAAC,KAAA,KAAU,CAAC,CAAC,KAAK,CAAA,GAC5B,KAAA,CAAA;AAAA,MACJ,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,OAAA,EAAS,KAAA,CAAM,QAAA,EAAU,QAAA,EAAU,KAAA,CAAM,QAAA,EAAS,CAAE,CAAA;AAAA,MAIrF,OAAA,EAAS;AAAA,QACP,QAAA,EAAU,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,QAAA;AAAA,QAClC,QAAA,EAAU,kBAAkB,kBAAA,CAAmB,MAAA;AAAA,QAC/C,UAAA,EAAY,iBAAA,CAAkB,kBAAA,CAAmB,QAAA,KAAa,QAAA;AAAA,QAC9D,eAAA,EAAiB,MAAA,CAAO,CAAC,CAAA,CAAE,YAAA,CAAa,eAAA;AAAA,QACxC,iBAAA,EAAmB,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,iBAAA;AAAA,QAC3C,gBAAA,EAAkB,MAAA,CAAO,CAAC,CAAA,CAAE,YAAA,CAAa,gBAAA;AAAA,QACzC,kBAAA,EAAoB,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,kBAAA;AAAA,QAC5C,WAAA,EAAa,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,UAClC,SAAS,KAAA,CAAM,QAAA;AAAA,UACf,eAAA,EAAiB,MAAM,YAAA,CAAa,eAAA;AAAA,UACpC,gBAAA,EAAkB,MAAM,YAAA,CAAa;AAAA,SACvC,CAAE,CAAA;AAAA,QACF,eAAe,iBAAA,CAAkB;AAAA;AACnC,KACF;AAEA,IAAA,OAAO,GAAA,CAAI;AAAA,MACT,MAAA;AAAA,MACA,YAAA;AAAA,MACA,iBAAA,EAAmB,aAAA;AAAA,MACnB,mBAAmB,MAAA,CAAO,iBAAA;AAAA,MAC1B,iBAAA;AAAA,MACA,cAAA;AAAA,MACA,kBAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAClD,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,uCAAA;AAAA,MACL,IAAA,EAAM,CAAA,6BAAA,EAAgC,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA;AAAA,MACvD,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,SAAS,iBAAiB,MAAA,EAG9B;AACD,EAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAI,gBAAA,CAAiB,UAAU,MAAM,CAAA;AACpF,EAAA,IAAI,WAAA,EAAa,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,MAAA,EAAQ,GAAA,EAAK,CAAA;AAElG,EAAA,MAAM,EAAE,YAAY,KAAA,EAAO,SAAA,KAAc,WAAA,CAAY,YAAA,CAAa,MAAM,QAAQ,CAAA;AAChF,EAAA,IAAI,SAAA,EAAW,OAAO,IAAA,CAAK,SAAS,CAAA;AAEpC,EAAA,IAAI,EAAE,cAAA,IAAkB,YAAA,CAAa,KAAA,CAAA,EAAQ;AAC3C,IAAA,OAAO,GAAA,CAAI;AAAA,MACT,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,aAAa,KAAA,CAAM,QAAA;AAAA,QAC7B,QAAA,EAAU,aAAa,KAAA,CAAM,QAAA;AAAA,QAC7B,GAAA,EAAK,MAAA;AAAA,QACL,OAAA,EAAS;AAAA,OACX;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA;AAC9C,IAAA,MAAM,MAAM,UAAA,CAAW;AAAA,MACrB,QAAA,EAAU,aAAa,KAAA,CAAM,QAAA;AAAA,MAC7B,QAAA,EAAU,aAAa,KAAA,CAAM,QAAA;AAAA,MAC7B,YAAA,EAAc,aAAa,KAAA,CAAM;AAAA,KAClC,CAAA;AAED,IAAA,OAAO,GAAA,CAAI;AAAA,MACT,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,aAAa,KAAA,CAAM,QAAA;AAAA,QAC7B,QAAA,EAAU,aAAa,KAAA,CAAM,QAAA;AAAA,QAC7B,GAAA;AAAA,QACA,SAAS,GAAA,CAAI;AAAA,OACf;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAClD,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,sCAAA;AAAA,MACL,IAAA,EAAM,CAAA,kCAAA,EAAqC,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA;AAAA,MAC5D,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEA,SAAS,YAAY,QAAA,EAAsD;AACzE,EAAA,IAAI;AACF,IAAA,OAAO,GAAA,CAAI;AAAA,MACT,UAAA,EAAY,IAAIC,kBAAA,CAAW;AAAA,QACzB,KAAA,EAAO,IAAA;AAAA,QACP,eAAA,EAAiB,CAAA;AAAA,QACjB,WAAA,EAAa,KAAK,EAAA,GAAK,GAAA;AAAA,QACvB,OAAA,EAAS,qCAAqC,QAAQ,CAAA,oBAAA;AAAA,OACvD;AAAA,KACF,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,8BAAA,EAAgC,IAAA,EAAM,WAAW,KAAK,CAAA,EAAG,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,EAC3F;AACF;AAEA,SAAS,WAAW,MAAA,EAIc;AAChC,EAAA,IAAI;AACF,IAAA,OAAO,IAAIC,sCAAA,CAA8B;AAAA,MACvC,IAAA,EAAM;AAAA,QACJ,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,SAAA,EAAW,CAAA,kCAAA,EAAqC,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,QAC/D,cAAc,MAAA,CAAO;AAAA;AACvB,KACD,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,UAAA,CAAW;AAAA,MACnB,GAAA,EAAK,kDAAA;AAAA,MACL,IAAA,EAAM,WAAW,KAAK,CAAA;AAAA,MACtB,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEA,SAAS,QAAQ,OAAA,EAGf;AACA,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,GAAA,EAAK,MAAA,EAAW,OAAO,MAAA,EAAU;AAExD,EAAA,MAAM,MAAM,IAAI,GAAA;AAAA,IACd,OAAA,CAAQ,GAAA,CAAI,CAAC,GAAA,KAAQ;AAAA,MACnB,GAAA,CAAI,OAAA;AAAA,MACJ,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,OAAO,GAAA,CAAI,KAAA,EAAO,KAAA,EAAO,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,cAAc,IAAA;AAAK,KACjG;AAAA,GACH;AACA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAEnC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,OAAA,CAAQ,MAAA,EAAQ;AACnC,IAAA,MAAM,IAAI,WAAW,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,oBAAA,EAAsB,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,EACzF;AAEA,EAAA,OAAO,EAAE,KAAK,KAAA,EAAsC;AACtD;AAEA,SAAS,OAAA,CAAQ;AAAA,EACf,WAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAA,EAM2F;AACzF,EAAA,IAAI,CAAC,WAAA,EAAa,OAAO,EAAE,GAAA,EAAK,MAAA,EAAW,OAAO,MAAA,EAAU;AAE5D,EAAA,MAAM,MAAM,IAAI,GAAA;AAAA,IACd,WAAA,CAAY,GAAA,CAAI,CAAC,OAAA,KAAY;AAC3B,MAAA,MAAM,iBAAA,GAAoB,QAAQ,UAAA,CAAW,GAAA,CAAI,CAAC,GAAA,KAAQ,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACtE,MAAA,MAAM,eAAA,GAAkB,IAAI,GAAA,CAAI,iBAAA,CAAkB,IAAI,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAI,CAAC,CAAA;AACxE,MAAA,OAAO;AAAA,QACL,OAAA,CAAQ,WAAA;AAAA,QACR;AAAA,UACE,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,UACf,eAAe,OAAA,CAAQ,aAAA;AAAA,UACvB,YAAY,OAAA,CAAQ,UAAA;AAAA,UACpB,QAAA,EAAU,MAAA,IAAU,CAAC,eAAA,EAAiB,GAAG,iBAAiB,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ,GAAA,CAAI,QAAA,KAAa,QAAQ,CAAA;AAAA,UACpG,UAAA,EAAY,aAAa,QAAA,IAAY,eAAA,CAAgB,SAAS,CAAA,IAAK,eAAA,CAAgB,GAAA,CAAI,eAAA,CAAgB,IAAI,CAAA;AAAA,UAC3G,KAAA,EAAO,QAAQ,iBAAA,IAAqB;AAAA;AACtC,OACF;AAAA,IACF,CAAC;AAAA,GACH;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAEnC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,WAAA,CAAY,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,WAAW,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,oBAAA,EAAsB,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,EACzF;AAEA,EAAA,OAAO,EAAE,KAAK,KAAA,EAAsC;AACtD;AClTO,SAAS,wBAAwB,OAAA,EAA0D;AAChG,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,MAAM,6BAAA,EAA+B,MAAA,EAAQ,KAAK,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,KAAQ,OAAA,CAAQ,GAAA;AAEtC,EAAA,OAAO,GAAA,CAAI;AAAA,IACT,IAAA,EAAM;AAAA,MACJ,UAAU,OAAA,CAAQ,GAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ,GAAA;AAAA,MAChB,SAAS,OAAA,CAAQ,GAAA;AAAA,MACjB,UAAU,OAAA,CAAQ,GAAA;AAAA,MAClB,YAAY,OAAA,CAAQ,GAAA;AAAA,MACpB,UAAU,OAAA,CAAQ,GAAA;AAAA,MAClB,SAAS,OAAA,CAAQ,GAAA;AAAA,MACjB,UAAU,OAAA,CAAQ,GAAA;AAAA,MAClB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,eAAe,OAAA,CAAQ,GAAA;AAAA,MACvB,GAAI,KAAA,GACA;AAAA,QACE,KAAA,EAAO,IAAA;AAAA,QACP,OAAO,OAAA,CAAQ;AAAA,OACjB,GACA;AAAA,QACE,KAAA,EAAO,KAAA;AAAA,QACP,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,OAAO,OAAA,CAAQ;AAAA;AACjB;AACN,GACD,CAAA;AACH;AAEA,eAAsB,UAAA,CAAW;AAAA,EAC/B,QAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAA,EAI6D;AAC3D,EAAA,MAAM,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,EAAM,GAAI,kBAAkB,QAAQ,CAAA;AACnE,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,KAAK,cAAA,EAAgB,IAAA,EAAM,CAAA,oBAAA,EAAuB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,MAAA,EAAQ,KAAK,CAAA;AAE7G,EAAA,IAAI,KAAA,CAAM,QAAA,KAAa,QAAA,IAAY,QAAA,KAAa,MAAM,QAAA,EAAU;AAC9D,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,cAAA;AAAA,MACL,IAAA,EAAM,CAAA,yCAAA,EAA4C,KAAA,CAAM,QAAQ,UAAU,QAAQ,CAAA,CAAA;AAAA,MAClF,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,KAAW,CAAA,kCAAA,EAAqC,QAAQ,CAAA,KAAA,CAAA,EAAS;AACnE,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,cAAA;AAAA,MACL,IAAA,EAAM,CAAA,wEAAA,EAA2E,QAAQ,CAAA,YAAA,EAAe,MAAM,CAAA,CAAA;AAAA,MAC9G,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,UAAA,EAAY,GAAG,CAAA;AAErD,IAAA,MAAM,UAAA,GAAaC,oBAAA,CAAI,MAAA,CAAO,QAAA,EAAU,SAAA,EAAW;AAAA,MACjD,UAAA,EAAY,CAAC,OAAO,CAAA;AAAA,MACpB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAAC,QAAM,GAAI,uBAAA,CAAwB,WAAW,OAAO,CAAA;AAClE,IAAA,IAAIA,MAAAA,EAAO,OAAO,IAAA,CAAKA,MAAK,CAAA;AAE5B,IAAA,OAAO,IAAI,EAAE,OAAA,EAAS,UAAA,CAAW,OAAA,EAAuB,MAAY,CAAA;AAAA,EACtE,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,cAAA;AAAA,MACL,MAAM,CAAA,6IAAA,EAAgJ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,MAC9L,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,SAAS,aAAA,CAAc,YAAwB,GAAA,EAA8B;AAClF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,UAAA,CAAW,aAAA,CAAc,GAAA,EAAK,CAAC,GAAA,EAAK,GAAA,KAAQ;AAC1C,MAAA,IAAI,GAAA,IAAO,CAAC,GAAA,EAAK;AACf,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,MAAM,SAAA,GAAY,IAAI,YAAA,EAAa;AACnC,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,sBAAsB,CAAC,CAAA;AACxC,QAAA;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,SAAS,CAAA;AAAA,IACnB,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEO,SAAS,WAAW,QAAA,EAAmD;AAC5E,EAAA,IAAI,CAAC,MAAA,CAAO,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,WAAA,EAAa,CAAA;AAElF,EAAA,IAAI;AACF,IAAA,MAAM,aAAaD,oBAAA,CAAI,MAAA,CAAO,UAAU,EAAE,QAAA,EAAU,MAAM,CAAA;AAC1D,IAAA,IAAI,CAAC,YAAY,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,2BAAA,EAA6B,CAAA;AAE5F,IAAA,OAAO,GAAA,CAAI,EAAE,UAAA,EAAY,CAAA;AAAA,EAC3B,SAAS,KAAA,EAAO;AACd,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,mBAAA;AAAA,MACL,IAAA,EAAM,CAAA,gBAAA,EAAmB,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,KACpH,CAAA;AAAA,EACH;AACF;AAEO,SAAS,WAAW,QAAA,EAA6D;AACtF,EAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAM,GAAI,WAAW,QAAQ,CAAA;AACjD,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,KAAK,CAAA;AAE5B,EAAA,IAAI,OAAO,UAAA,CAAW,OAAA,KAAY,QAAA,EAAU;AAC1C,IAAA,OAAO,KAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,gCAAgC,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,QAAA,GAAW,WAAW,OAAA,CAAQ,GAAA;AACpC,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA;AACtB,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,mBAAA;AAAA,MACL,MAAM,CAAA,uCAAA,EAA0C,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,OAAO,CAAC,CAAA;AAAA,KACnF,CAAA;AAEH,EAAA,MAAM,GAAA,GAAM,WAAW,OAAA,CAAQ,GAAA;AAC/B,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA;AACjB,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,mBAAA;AAAA,MACL,MAAM,CAAA,yCAAA,EAA4C,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,OAAO,CAAC,CAAA;AAAA,KACrF,CAAA;AAEH,EAAA,OAAO,GAAA,CAAI,EAAE,QAAA,EAAU,GAAA,EAAK,CAAA;AAC9B;AAEO,SAAS,kBAAkB,QAAA,EAA6E;AAC7G,EAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAM,GAAI,WAAW,QAAQ,CAAA;AACjD,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,KAAK,CAAA;AAE5B,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,WAAW,MAAA,CAAO,GAAA;AAC9B,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA;AACjB,MAAA,OAAO,IAAA,CAAK;AAAA,QACV,GAAA,EAAK,mBAAA;AAAA,QACL,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,OAC/E,CAAA;AAEH,IAAA,IAAI,OAAO,UAAA,CAAW,OAAA,KAAY,QAAA,EAAU;AAC1C,MAAA,OAAO,KAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,gCAAgC,CAAA;AAAA,IAChF;AAEA,IAAA,MAAM,QAAA,GAAW,WAAW,OAAA,CAAQ,GAAA;AACpC,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA;AACtB,MAAA,OAAO,IAAA,CAAK;AAAA,QACV,GAAA,EAAK,mBAAA;AAAA,QACL,MAAM,CAAA,wCAAA,EAA2C,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,OAAO,CAAC,CAAA;AAAA,OACpF,CAAA;AAEH,IAAA,MAAM,MAAA,GAAS,WAAW,OAAA,CAAQ,GAAA;AAClC,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA;AACpB,MAAA,OAAO,IAAA,CAAK;AAAA,QACV,GAAA,EAAK,mBAAA;AAAA,QACL,MAAM,CAAA,qCAAA,EAAwC,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,OAAO,CAAC,CAAA;AAAA,OACjF,CAAA;AAEH,IAAA,OAAO,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,CAAA;AAAA,EACtC,SAASC,MAAAA,EAAO;AACd,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,mBAAA;AAAA,MACL,IAAA,EAAM,qEAAqEA,MAAAA,YAAiB,KAAA,GAAQA,OAAM,OAAA,GAAU,MAAA,CAAOA,MAAK,CAAC,CAAA;AAAA,KAClI,CAAA;AAAA,EACH;AACF;AAEO,SAAS,aAAa,QAAA,EAAgD;AAC3E,EAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAM,GAAI,WAAW,QAAQ,CAAA;AACjD,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,KAAK,CAAA;AAE5B,EAAA,IAAI,OAAO,UAAA,CAAW,OAAA,KAAY,QAAA,EAAU;AAC1C,IAAA,OAAO,KAAK,EAAE,GAAA,EAAK,mBAAA,EAAqB,IAAA,EAAM,gCAAgC,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,QAAA,GAAW,WAAW,OAAA,CAAQ,GAAA;AAEpC,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA;AACtB,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,mBAAA;AAAA,MACL,MAAM,CAAA,uCAAA,EAA0C,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,OAAO,CAAC,CAAA;AAAA,KACnF,CAAA;AAEH,EAAA,OAAO,GAAA,CAAI,EAAE,QAAA,EAAU,CAAA;AACzB;;;ACvLA,eAAsB,mBAAA,CACpB,OACA,MAAA,EAOwC;AACxC,EAAA,MAAM,EAAE,MAAM,WAAA,EAAa,KAAA,EAAO,UAAS,GAAI,IAAA,CAAK,UAAU,KAAK,CAAA;AACnE,EAAA,IAAI,QAAA,EAAU,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,+BAA+B,IAAA,EAAM,UAAA,CAAW,QAAQ,CAAA,EAAG,CAAA;AAE5F,EAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAI,aAAA,CAAc,SAAA,CAAU,MAAA,CAAO,YAAY,CAAA;AAC9F,EAAA,IAAI,WAAA,EAAa,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gCAAgC,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,CAAA;AAEnG,EAAA,MAAM,YAAA,GACJ,YAAA,IAAgB,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,CAAC,MAAA,CAAO,kBAAA,GAC9DC,uBAAA,CAAY,YAAY,CAAA,GACxB,MAAA;AAEN,EAAA,IAAI,cAAc,KAAA,EAAO;AACvB,IAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kCAAA,EAAoC,IAAA,EAAM,CAAA,cAAA,EAAiB,UAAA,CAAW,YAAA,CAAa,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAAA,EAClH;AAEA,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,EAAA,EAAI,WAAA;AAAA,IACJ,KAAK,YAAA,EAAc,MAAA;AAAA,IACnB,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,MAAA,GAAS,GAAA;AAAA,IAClC,KAAK,MAAA,CAAO;AAAA,GACd;AAEA,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,MAAA,CAAO,UAAA,EAAY,MAAA,EAAQ,MAAA,CAAO,GAAG,CAAA;AAClG,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gCAAA,EAAkC,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAE3G,EAAA,IAAI,OAAO,UAAA,KAAe,KAAA,EAAO,MAAA,CAAO,gBAAA,CAAiB,eAAe,YAAY,CAAA;AAEpF,EAAA,IAAI,SAAA,CAAU,SAAS,IAAA,EAAM;AAC3B,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,gBAAA;AAAA,MACL,IAAA,EAAM,CAAA,kEAAA,EAAqE,SAAA,CAAU,MAAM,CAAA,mBAAA,EAAsB,WAAA,CAAY,MAAM,CAAA,wBAAA,EAA2B,YAAA,EAAc,MAAA,CAAO,MAAA,IAAU,CAAC,CAAA;AAAA,KAC/L,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAsB,CAAA;AACrC;AAEA,eAAsB,mBAAA,CACpB,OACA,MAAA,EACkG;AAClG,EAAA,MAAM,EAAE,MAAM,QAAA,EAAU,OAAA,EAAS,YAAW,GAAI,IAAA,CAAK,UAAU,KAAK,CAAA;AACpE,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,QAAA,EAAS,GAAI,aAAa,QAAQ,CAAA;AAC3D,IAAA,IAAI,QAAA,EAAU,OAAO,IAAA,CAAK,QAAQ,CAAA;AAClC,IAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,UAAU,YAAA,EAAc,MAAA,EAAW,YAAA,EAAc,KAAA,EAAO,CAAA;AAAA,EACrG;AAEA,EAAA,MAAM,EAAE,MAAM,WAAA,EAAa,KAAA,EAAO,kBAAiB,GAAI,UAAA,CAAW,UAAU,KAAK,CAAA;AACjF,EAAA,IAAI,gBAAA,EAAkB,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gBAAgB,IAAA,EAAM,UAAA,CAAW,gBAAgB,CAAA,EAAG,CAAA;AAE7F,EAAA,MAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,MAAA,CAAO,UAAA,EAAY,WAAA,EAAa,MAAA,CAAO,GAAG,CAAA;AACpG,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gCAAA,EAAkC,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAE3G,EAAA,MAAA,CAAO,gBAAA,CAAiB,eAAe,YAAY,CAAA;AAEnD,EAAA,MAAM,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,eAAc,GAAI,SAAA,CAAU,UAAU,MAAM,CAAA;AAC3E,EAAA,IAAI,aAAA,EAAe,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,+BAA+B,IAAA,EAAM,UAAA,CAAW,aAAa,CAAA,EAAG,CAAA;AAEtG,EAAA,IAAI,QAAA,CAAS,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,EAAG;AAC7B,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,sBAAA;AAAA,MACL,IAAA,EAAM,2BAA2B,IAAI,IAAA,CAAK,SAAS,GAAG,CAAA,CAAE,aAAa,CAAA;AAAA,KACtE,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,2BAA2B,QAAA,CAAS,GAAA,GAAMC,yBAAA,CAAc,QAAA,CAAS,GAAG,CAAA,GAAI,MAAA;AAC9E,EAAA,IAAI,0BAA0B,KAAA,EAAO;AACnC,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,oCAAA;AAAA,MACL,IAAA,EAAM,CAAA,gBAAA,EAAmB,UAAA,CAAW,wBAAA,CAAyB,KAAK,CAAC,CAAA;AAAA,KACpE,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,GAAA,CAAI;AAAA,IACT,WAAW,QAAA,CAAS,EAAA;AAAA,IACpB,SAAS,QAAA,CAAS,GAAA;AAAA,IAClB,YAAA,EAAc,wBAAA,GAA4B,wBAAA,CAAyB,MAAA,GAAe,MAAA;AAAA,IAClF,YAAA,EAAc;AAAA,GACf,CAAA;AACH;AAEA,eAAsB,oBAAA,CACpB,OACA,MAAA,EACwC;AACxC,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,YAAW,GAAI,YAAA,CAAa,UAAU,KAAK,CAAA;AAChE,EAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gCAAgC,IAAA,EAAM,UAAA,CAAW,UAAU,CAAA,EAAG,CAAA;AAEjG,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,EAAA,EAAI,IAAA;AAAA,IACJ,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,MAAA,GAAS,GAAA;AAAA,IAClC,KAAK,MAAA,CAAO;AAAA,GACd;AAEA,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,MAAA,CAAO,UAAA,EAAY,MAAA,EAAQ,MAAA,CAAO,GAAG,CAAA;AAClG,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,iCAAA,EAAmC,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAE5G,EAAA,MAAA,CAAO,gBAAA,CAAiB,gBAAgB,YAAY,CAAA;AAEpD,EAAA,IAAI,SAAA,CAAU,SAAS,IAAA,EAAM;AAC3B,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,gBAAA;AAAA,MACL,MAAM,CAAA,mEAAA,EAAsE,SAAA,CAAU,MAAM,CAAA,mBAAA,EAAsB,KAAK,MAAM,CAAA;AAAA,KAC9H,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAsB,CAAA;AACrC;AAEA,eAAsB,oBAAA,CACpB,OACA,MAAA,EACyD;AACzD,EAAA,MAAM,EAAE,MAAM,qBAAA,EAAuB,KAAA,EAAO,4BAA2B,GAAI,UAAA,CAAW,UAAU,KAAK,CAAA;AACrG,EAAA,IAAI,0BAAA,EAA4B,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,0BAA0B,CAAA,EAAG,CAAA;AAEnH,EAAA,MAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,MAAA,CAAO,UAAA,EAAY,qBAAA,EAAuB,MAAA,CAAO,GAAG,CAAA;AAC9G,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,iCAAA,EAAmC,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAE5G,EAAA,MAAM,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,eAAc,GAAI,SAAA,CAAU,UAAU,MAAM,CAAA;AAC3E,EAAA,IAAI,aAAA,EAAe,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,aAAa,CAAA,EAAG,CAAA;AAEzF,EAAA,IAAI,QAAA,CAAS,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,EAAG;AAC7B,IAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gBAAA,EAAkB,MAAM,CAAA,yBAAA,EAA4B,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,CAAE,WAAA,EAAa,IAAI,CAAA;AAAA,EACjH;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,gBAAgB,YAAY,CAAA;AAEpD,EAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAW,QAAA,CAAS,IAAI,OAAA,EAAS,QAAA,CAAS,KAAK,CAAA;AAC9D;AAEA,eAAsB,aAAA,CAAc,OAAsB,MAAA,EAA4D;AACpH,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,YAAW,GAAI,MAAA,CAAO,UAAU,KAAK,CAAA;AAC1D,EAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,UAAU,CAAA,EAAG,CAAA;AAEnF,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,MAAA,CAAO,UAAA,EAAY,IAAA,EAAM,MAAA,CAAO,GAAG,CAAA;AAChG,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,yBAAA,EAA2B,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAEpG,EAAA,MAAA,CAAO,gBAAA,CAAiB,SAAS,YAAY,CAAA;AAE7C,EAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAsB,CAAA;AACrC;AAEA,eAAsB,aAAA,CACpB,OACA,MAAA,EACwD;AACxD,EAAA,MAAM,EAAE,MAAM,cAAA,EAAgB,KAAA,EAAO,qBAAoB,GAAI,UAAA,CAAW,UAAU,KAAK,CAAA;AACvF,EAAA,IAAI,mBAAA,EAAqB,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,mBAAmB,CAAA,EAAG,CAAA;AAErG,EAAA,MAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,MAAA,CAAO,UAAA,EAAY,cAAA,EAAgB,MAAA,CAAO,GAAG,CAAA;AACvG,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,2BAA2B,IAAA,EAAM,UAAA,CAAW,KAAK,CAAA,EAAG,CAAA;AAElF,EAAA,MAAA,CAAO,gBAAA,CAAiB,SAAS,YAAY,CAAA;AAE7C,EAAA,MAAM,EAAE,MAAM,KAAA,EAAO,KAAA,EAAO,YAAW,GAAI,MAAA,CAAO,UAAU,MAAM,CAAA;AAClE,EAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,UAAU,CAAA,EAAG,CAAA;AAEnF,EAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAW,KAAA,EAAO,CAAA;AACjC;AAEA,eAAsB,cAAA,CACpB,UACA,MAAA,EACwC;AACxC,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,YAAW,GAAI,KAAA,CAAM,UAAU,QAAQ,CAAA;AAC5D,EAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,UAAU,CAAA,EAAG,CAAA;AAEnF,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,MAAA,CAAO,UAAA,EAAY,IAAA,EAAM,MAAA,CAAO,GAAG,CAAA;AAC7F,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,0BAAA,EAA4B,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAErG,EAAA,MAAA,CAAO,gBAAA,CAAiB,UAAU,YAAY,CAAA;AAC9C,EAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAsB,CAAA;AACrC;AAEA,eAAsB,cAAA,CACpB,OACA,MAAA,EACwC;AACxC,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,qBAAoB,GAAI,UAAA,CAAW,UAAU,KAAK,CAAA;AACvE,EAAA,IAAI,mBAAA,EAAqB,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,mBAAmB,CAAA,EAAG,CAAA;AAErG,EAAA,MAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,MAAA,CAAO,UAAA,EAAY,IAAA,EAAM,MAAA,CAAO,GAAG,CAAA;AAC1F,EAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,0BAAA,EAA4B,IAAA,EAAM,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAErG,EAAA,MAAA,CAAO,gBAAA,CAAiB,UAAU,YAAY,CAAA;AAE9C,EAAA,MAAM,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,YAAW,GAAI,KAAA,CAAM,UAAU,MAAM,CAAA;AACpE,EAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,UAAU,CAAA,EAAG,CAAA;AAEnF,EAAA,OAAO,GAAA,CAAI,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA;AACpC;;;AC3NO,IAAM,YAAY,CAAA,GAAI;AAEtB,SAAS,sBAAA,CACd,QACA,KAAA,EACwC;AACxC,EAAA,IAAI,KAAA,IAAS,MAAA,KAAW,OAAA,EAAS,OAAO,OAAA;AACxC,EAAA,IAAI,MAAA,KAAW,kBAAkB,OAAO,gBAAA;AACxC,EAAA,OAAO,MAAA;AACT;AAEA,eAAsB,aAAA,CAAoB,OAAY,QAAA,EAAwD;AAC5G,EAAA,OAAA,CACE,MAAM,OAAA,CAAQ,GAAA;AAAA,IACZ,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,KAAS;AACxB,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,SAAS,IAAI,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF,CAAC;AAAA,KAEH,MAAA,CAAO,CAAC,MAAA,KAAiC,CAAC,CAAC,MAAM,CAAA;AACrD;;;AC0BO,IAAM,gBAAN,MAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBzB,YAAY,aAAA,EAA4B;AACtC,IAAA,MAAM,MAAA,GAAS,aAAa,aAAa,CAAA;AACzC,IAAA,IAAI,OAAO,KAAA,EAAO,MAAM,IAAI,UAAA,CAAW,OAAO,KAAK,CAAA;AAEnD,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACrB,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA;AAC3B,IAAA,IAAA,CAAK,oBAAoB,MAAA,CAAO,iBAAA;AAChC,IAAA,IAAA,CAAK,oBAAoB,MAAA,CAAO,iBAAA;AAChC,IAAA,IAAA,CAAK,oBAAoB,MAAA,CAAO,iBAAA;AAChC,IAAA,IAAA,CAAK,iBAAiB,MAAA,CAAO,cAAA;AAC7B,IAAA,IAAA,CAAK,qBAAqB,MAAA,CAAO,kBAAA;AACjC,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,UAAA;AACzB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAW,MAAA,EAQd;AACD,IAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAI,QAAA,CAAS,UAAA,CAAW,SAAA,CAAU,MAAM,CAAA;AACvF,IAAA,IAAI,WAAA,EAAa,MAAM,IAAI,UAAA,CAAW,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,CAAA;AAE9F,IAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAO,UAAA,EAAW,GAAI,KAAK,SAAA,CAAU;AAAA,MAClD,SAAS,YAAA,CAAa,OAAA;AAAA,MACtB,iBAAA,EAAmB,IAAA;AAAA,MACnB,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,IAAI,UAAA,EAAY,MAAM,IAAI,UAAA,CAAW,UAAU,CAAA;AAE/C,IAAA,IAAI,YAAA,CAAa,WAAA,KAAgB,OAAA,IAAW,CAAC,aAAa,KAAA,EAAO;AAC/D,MAAA,MAAM,IAAI,UAAA,CAAW,EAAE,KAAK,gBAAA,EAAkB,IAAA,EAAM,wDAAwD,CAAA;AAAA,IAC9G;AAEA,IAAA,IAAI,YAAA,CAAa,WAAA,IAAe,CAAC,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,IAAI,GAAA,CAAI,YAAA,CAAa,WAAW,CAAA,CAAE,IAAI,CAAA,EAAG;AACnG,MAAA,MAAM,IAAI,WAAW,EAAE,GAAA,EAAK,aAAa,IAAA,EAAM,4BAAA,EAA8B,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAC5F;AAEA,IAAA,MAAM,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,WAAU,GAAI,aAAA,CAAc,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA;AACnF,IAAA,IAAI,SAAA,EAAW,MAAM,IAAI,UAAA,CAAW,SAAS,CAAA;AAE7C,IAAA,IAAI;AACF,MAAA,MAAM,CAAC,IAAA,EAAM,EAAE,SAAA,EAAW,KAAA,EAAO,aAAa,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI;AAAA,QAClE,IAAA,CAAK,mBAAmB,iBAAA,EAAkB;AAAA,QAC1C,IAAA,CAAK,aAAA,CAAc,QAAA,EAAU,QAAQ;AAAA,OACtC,CAAA;AACD,MAAA,IAAI,WAAA,EAAa,MAAM,IAAI,UAAA,CAAW,WAAW,CAAA;AAEjD,MAAA,MAAM,MAAA,GAAS,uBAAuB,YAAA,CAAa,WAAA,IAAe,KAAK,QAAA,CAAS,WAAA,EAAa,aAAa,KAAK,CAAA;AAC/G,MAAA,MAAMC,OAAAA,GAAS,EAAE,KAAA,EAAO,IAAA,CAAK,kBAAA,CAAmB,eAAc,EAAG,SAAA,EAAW,YAAA,CAAa,KAAA,EAAO,MAAA,EAAO;AAEvG,MAAA,MAAM,EAAE,WAAW,cAAA,EAAgB,KAAA,EAAO,cAAa,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,OAAA,EAAS;AAAA,QAC3F,SAAS,KAAA,CAAM,QAAA;AAAA,QACf,WAAA,EAAa,YAAA,CAAa,WAAA,IAAe,IAAA,CAAK,aAAa,CAAC,CAAA;AAAA,QAC5D,cAAc,IAAA,CAAK,QAAA;AAAA,QACnB,QAAA;AAAA,QACA,GAAGA;AAAA,OAC6B,CAAA;AAClC,MAAA,IAAI,YAAA,EAAc,MAAM,IAAI,UAAA,CAAW,YAAY,CAAA;AAEnD,MAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,GAAA,CAAI,cAAA,CAAe;AAAA,QAC7C,GAAGA,OAAAA;AAAA,QACH,KAAA,EAAO,cAAA;AAAA,QACP,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,aAAa,IAAA,CAAK,iBAAA;AAAA,QAClB,YAAA,EAAc,WAAA;AAAA,QACd,mBAAA,EAAqB,MAAA;AAAA,QACrB,eAAe,IAAA,CAAK;AAAA,OACrB,CAAA;AAED,MAAA,IAAI,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,aAAa,2BAAA,EAA6B;AAC7D,QAAA,MAAM,IAAI,UAAA,CAAW;AAAA,UACnB,GAAA,EAAK,kBAAA;AAAA,UACL,IAAA,EAAM,6DAAA;AAAA,UACN,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAU;AAAA,IACtC,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,YAAY,MAAM,KAAA;AACvC,MAAA,MAAM,IAAI,UAAA,CAAW,EAAE,GAAA,EAAK,6BAAA,EAA+B,IAAA,EAAM,CAAA,sBAAA,EAAyB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAAA,IACjH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,eAAe,MAAA,EAMlB;AACD,IAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAI,QAAA,CAAS,cAAA,CAAe,SAAA,CAAU,MAAM,CAAA;AAC3F,IAAA,IAAI,WAAA,EAAa,MAAM,IAAI,UAAA,CAAW,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,CAAA;AAE9F,IAAA,MAAM,EAAE,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,YAAA,EAAa,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,OAAA,EAAS,YAAA,CAAa,KAAK,CAAA;AACtG,IAAA,IAAI,YAAA,EAAc,MAAM,IAAI,UAAA,CAAW,YAAY,CAAA;AAEnD,IAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAO,UAAA,EAAW,GAAI,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA;AAC3F,IAAA,IAAI,UAAA,EAAY,MAAM,IAAI,UAAA,CAAW,UAAU,CAAA;AAE/C,IAAA,IAAI,CAAC,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,IAAI,IAAI,KAAA,CAAM,WAAW,CAAA,CAAE,IAAI,CAAA,EAAG;AAChE,MAAA,MAAM,IAAI,WAAW,EAAE,GAAA,EAAK,aAAa,IAAA,EAAM,4BAAA,EAA8B,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAC5F;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,GAAA,CAAI,kBAAA,CAAmB;AAAA,QACtD,MAAM,YAAA,CAAa,IAAA;AAAA,QACnB,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,aAAa,IAAA,CAAK,iBAAA;AAAA,QAClB,GAAG;AAAA,OACJ,CAAA;AAED,MAAA,MAAM,EAAE,sBAAsB,qBAAA,EAAuB,KAAA,KAAU,MAAM,IAAA,CAAK,cAAA,CAAe,KAAA,EAAO,YAAY,CAAA;AAC5G,MAAA,IAAI,KAAA,EAAO,MAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAErC,MAAA,OAAO;AAAA,QACL,WAAA,EAAa;AAAA,UACX,IAAA,EAAM,MAAM,YAAA,CAAa,eAAA;AAAA,UACzB,KAAA,EAAO,oBAAA;AAAA,UACP,OAAA,EAAS,KAAK,iBAAA,CAAkB;AAAA,SAClC;AAAA,QACA,cAAc,qBAAA,GACV;AAAA,UACE,IAAA,EAAM,MAAM,YAAA,CAAa,gBAAA;AAAA,UACzB,KAAA,EAAO,qBAAA;AAAA,UACP,OAAA,EAAS,KAAK,iBAAA,CAAkB;AAAA,SAClC,GACA,IAAA;AAAA,QACJ,aAAa,KAAA,CAAM,WAAA;AAAA,QACnB,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB;AAAA,OACF;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,YAAY,MAAM,GAAA;AACrC,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,GAAA,EAAK,6BAAA;AAAA,QACL,IAAA,EAAM,CAAA,iBAAA,EAAoB,UAAA,CAAW,GAAG,CAAC,CAAA,wFAAA;AAAA,OAC1C,CAAA;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aAAa,MAAA,EAIhB;AACD,IAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAI,QAAA,CAAS,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AACzF,IAAA,IAAI,WAAA,EAAa,MAAM,IAAI,UAAA,CAAW,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,CAAA;AAE9F,IAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAO,UAAA,EAAW,GAAI,KAAK,SAAA,CAAU;AAAA,MAClD,SAAS,YAAA,CAAa,OAAA;AAAA,MACtB,iBAAA,EAAmB,IAAA;AAAA,MACnB,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,IAAI,UAAA,EAAY,MAAM,IAAI,UAAA,CAAW,UAAU,CAAA;AAE/C,IAAA,IAAI,YAAA,CAAa,WAAA,IAAe,CAAC,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,IAAI,GAAA,CAAI,YAAA,CAAa,WAAW,CAAA,CAAE,IAAI,CAAA,EAAG;AACnG,MAAA,MAAM,IAAI,WAAW,EAAE,GAAA,EAAK,aAAa,IAAA,EAAM,4BAAA,EAA8B,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAC5F;AAEA,IAAA,MAAM,YAAY,IAAI,GAAA,CAAI,CAAA,kCAAA,EAAqC,KAAA,CAAM,QAAQ,CAAA,mBAAA,CAAqB,CAAA;AAClG,IAAA,SAAA,CAAU,YAAA,CAAa,IAAI,0BAAA,EAA4B,YAAA,CAAa,eAAe,IAAA,CAAK,YAAA,CAAa,CAAC,CAAC,CAAA;AAEvG,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,UAAU,QAAA,EAAS;AAAA,MAC9B,iBAAA,EAAmB;AAAA,QACjB,IAAA,EAAM,MAAM,YAAA,CAAa,eAAA;AAAA,QACzB,KAAA,EAAO,EAAA;AAAA,QACP,OAAA,EAAS,KAAK,iBAAA,CAAkB;AAAA,OAClC;AAAA,MACA,kBAAA,EAAoB;AAAA,QAClB,IAAA,EAAM,MAAM,YAAA,CAAa,gBAAA;AAAA,QACzB,KAAA,EAAO,EAAA;AAAA,QACP,OAAA,EAAS,KAAK,iBAAA,CAAkB;AAAA;AAClC,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBACJ,WAAA,EASA;AACA,IAAA,MAAM,EAAE,WAAW,OAAA,EAAS,YAAA,EAAc,cAAc,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,aAAA;AAAA,MAC3E,aAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,KAAK,cAAA,EAAgB,IAAA,EAAM,CAAA,mBAAA,EAAsB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,MAAA,EAAQ,KAAK,CAAA;AAE5G,IAAA,MAAM,EAAE,OAAO,KAAA,EAAO,UAAA,KAAe,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,CAAA;AAC/D,IAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,UAAU,CAAA;AAEtC,IAAA,MAAM,EAAA,GAAK,MAAM,UAAA,CAAW,EAAE,QAAA,EAAU,WAAW,KAAA,EAAc,UAAA,EAAY,IAAA,CAAK,UAAA,EAAY,CAAA;AAC9F,IAAA,IAAI,EAAA,CAAG,KAAA,EAAO,OAAO,IAAA,CAAK,GAAG,KAAK,CAAA;AAElC,IAAA,IAAI,KAAK,QAAA,CAAS,iBAAA,KAAsB,SAAS,EAAA,CAAG,IAAA,CAAK,UAAU,IAAA,EAAM;AACvE,MAAA,OAAO,IAAA,CAAK;AAAA,QACV,GAAA,EAAK,0BAAA;AAAA,QACL,IAAA,EAAM,uEAAA;AAAA,QACN,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,EAAA,CAAG,IAAA,CAAK,KAAA,KAAU,YAAA,EAAc;AAClC,MAAA,OAAO,IAAA,CAAK;AAAA,QACV,GAAA,EAAK,cAAA;AAAA,QACL,IAAA,EAAM,iEAAA;AAAA,QACN,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,GAAA,CAAI;AAAA,MACT,MAAA,EAAQ,SAAA;AAAA,MACR,SAAS,EAAA,CAAG,OAAA;AAAA,MACZ,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,YAAA;AAAA,MACA,eAAA,EAAiB,CAAC,CAAC;AAAA,KACpB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAiB,YAAA,EASrB;AACA,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,MAAM,2BAAA,EAA6B,MAAA,EAAQ,KAAK,CAAA;AAAA,IACrF;AAEA,IAAA,MAAM;AAAA,MACJ,SAAA,EAAW,eAAA;AAAA,MACX,OAAA;AAAA,MACA,KAAA,EAAO;AAAA,KACT,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,gBAAgB,YAAY,CAAA;AACzD,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAM,CAAA,2BAAA,EAA8B,UAAA,CAAW,YAAY,CAAC,CAAA,CAAA,EAAI,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAClH;AAEA,IAAA,MAAM,EAAE,OAAO,KAAA,EAAO,UAAA,KAAe,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,CAAA;AAC/D,IAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,UAAU,CAAA;AAEtC,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,GAAA,CAAI,0BAAA,CAA2B;AAAA,QAC9D,YAAA,EAAc,eAAA;AAAA,QACd,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,MAAM,2CAAA,EAA6C,MAAA,EAAQ,KAAK,CAAA;AAAA,MACrG;AAEA,MAAA,MAAM,EAAA,GAAK,MAAM,UAAA,CAAW;AAAA,QAC1B,UAAU,YAAA,CAAa,WAAA;AAAA,QACvB,YAAY,IAAA,CAAK,UAAA;AAAA,QACjB;AAAA,OACD,CAAA;AACD,MAAA,IAAI,GAAG,KAAA,EAAO;AACZ,QAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAM,CAAA,4BAAA,EAA+B,UAAA,CAAW,EAAA,CAAG,KAAK,CAAC,CAAA,CAAA,EAAI,MAAA,EAAQ,KAAK,CAAA;AAAA,MAC/G;AAEA,MAAA,MAAM,EAAE,sBAAsB,qBAAA,EAAuB,KAAA,KAAU,MAAM,IAAA,CAAK,cAAA,CAAe,KAAA,EAAO,YAAY,CAAA;AAC5G,MAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,EAAE,KAAK,cAAA,EAAgB,IAAA,EAAM,CAAA,iBAAA,EAAoB,UAAA,CAAW,KAAK,CAAC,CAAA,CAAA,EAAI,MAAA,EAAQ,KAAK,CAAA;AAE1G,MAAA,OAAO,GAAA,CAAI;AAAA,QACT,QAAQ,YAAA,CAAa,WAAA;AAAA,QACrB,SAAS,EAAA,CAAG,OAAA;AAAA,QACZ,MAAM,EAAA,CAAG,IAAA;AAAA,QACT,cAAA,EAAgB;AAAA,UACd,IAAA,EAAM,MAAM,YAAA,CAAa,eAAA;AAAA,UACzB,KAAA,EAAO,oBAAA;AAAA,UACP,OAAA,EAAS,KAAK,iBAAA,CAAkB;AAAA,SAClC;AAAA,QACA,iBAAiB,qBAAA,GACb;AAAA,UACE,IAAA,EAAM,MAAM,YAAA,CAAa,gBAAA;AAAA,UACzB,KAAA,EAAO,qBAAA;AAAA,UACP,OAAA,EAAS,KAAK,iBAAA,CAAkB;AAAA,SAClC,GACA,IAAA;AAAA,QACJ;AAAA,OACD,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,UAAA,EAAY,OAAO,IAAA,CAAK,GAAG,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAM,CAAA,gBAAA,EAAmB,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,EAAI,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAC9F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,cAAsD,MAAA,EAGqB;AAC/E,IAAA,MAAM,EAAE,SAAA,EAAW,cAAA,EAAgB,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,aAAA,EAAe,MAAA,CAAO,WAAW,CAAA;AAChH,IAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,KAAK,CAAA;AAE5B,IAAA,MAAM,EAAE,OAAO,KAAA,EAAO,UAAA,KAAe,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,CAAA;AAC/D,IAAA,IAAI,UAAA,EAAY,OAAO,IAAA,CAAK,UAAU,CAAA;AAEtC,IAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,mBAAkB,GAAI,aAAA,CAAc,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA;AAC5F,IAAA,IAAI,iBAAA,EAAmB,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG,CAAA;AAEjG,IAAA,MAAM,EAAE,WAAW,KAAA,EAAO,YAAA,KAAiB,MAAM,IAAA,CAAK,aAAA,CAAc,aAAA,EAAe,cAAA,EAAgB;AAAA,MACjG,OAAA;AAAA,MACA,MAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,iBAAA;AAAA,MAC9B;AAAA,KACD,CAAA;AACD,IAAA,IAAI,YAAA,EAAc,OAAO,IAAA,CAAK,YAAY,CAAA;AAE1C,IAAA,OAAO,GAAA,CAAI;AAAA,MACT,cAAA,EAAgB;AAAA,QACd,IAAA,EAAM,MAAM,YAAA,CAAa,eAAA;AAAA,QACzB,KAAA,EAAO,SAAA;AAAA,QACP,OAAA,EAAS,KAAK,iBAAA,CAAkB;AAAA,OAClC;AAAA,MACA,YAAA,EAAc;AAAA,KACf,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBAAiB,MAAA,EAAuD;AAC5E,IAAA,MAAM,EAAE,WAAW,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,UAAU,MAAM,CAAA;AACtE,IAAA,IAAI,KAAA,EAAO,OAAO,IAAA,CAAK,KAAK,CAAA;AAC5B,IAAA,OAAO,GAAA,CAAI,EAAE,QAAA,EAAU,SAAA,EAAW,CAAA;AAAA,EACpC;AAAA,EAqBA,MAAM,eACJ,MAAA,EACgF;AAChF,IAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAI,QAAA,CAAS,cAAA,CAAe,SAAA,CAAU,MAAM,CAAA;AAC3F,IAAA,IAAI,WAAA,EAAa,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,CAAA;AAErF,IAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAO,UAAA,EAAW,GAAI,KAAK,SAAA,CAAU;AAAA,MAClD,SAAS,YAAA,CAAa,OAAA;AAAA,MACtB,iBAAA,EAAmB,IAAA;AAAA,MACnB,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,IAAI,UAAA,EAAY,MAAM,IAAI,UAAA,CAAW,UAAU,CAAA;AAC/C,IAAA,IAAI,CAAC,KAAA,CAAM,GAAA,EAAK,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,kBAAA,EAAoB,IAAA,EAAM,yBAAA,EAA2B,MAAA,EAAQ,GAAA,EAAK,CAAA;AAErG,IAAA,MAAM,OAAO,YAAA,CAAa,IAAA,CAAK,GAAA,CAAI,CAAC,QAAQ,KAAA,CAAM,GAAA,EAAK,GAAA,CAAI,GAAG,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,GAAA,KAAQ,CAAC,CAAC,GAAG,CAAA;AACtF,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAC9B,MAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,gBAAA,EAAkB,MAAM,mBAAA,EAAqB,MAAA,EAAQ,KAAK,CAAA;AAAA,IAC/E;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAW,MAAM,aAAA,CAAc,IAAA,EAAM,OAAO,GAAA,KAAQ;AACxD,QAAA,IAAI,IAAI,KAAA,IAAS,GAAA,CAAI,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAA,EAAM;AAC5C,UAAA,OAAO;AAAA,YACL,UAAU,KAAA,CAAM,QAAA;AAAA,YAChB,SAAS,GAAA,CAAI,OAAA;AAAA,YACb,OAAO,GAAA,CAAI,GAAA;AAAA,YACX,OAAO,GAAA,CAAI,KAAA;AAAA,YACX,cAAc,GAAA,CAAI,YAAA;AAAA,YAClB,QAAA,EAAU,IAAA;AAAA,YACV,WAAW,GAAA,CAAI;AAAA,WACjB;AAAA,QACF;AAEA,QAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,GAAA,CAAI,8BAAA,CAA+B,EAAE,MAAA,EAAQ,CAAC,GAAA,CAAI,KAAK,CAAA,EAAG,SAAA,EAAW,MAAM,CAAA;AAC5G,QAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,QAAA,MAAM,EAAE,UAAU,GAAA,EAAK,KAAA,EAAO,UAAS,GAAI,UAAA,CAAW,aAAa,WAAW,CAAA;AAC9E,QAAA,IAAI,UAAU,OAAO,IAAA;AAErB,QAAA,KAAA,CAAM,GAAA,EAAK,GAAA,CAAI,GAAA,CAAI,OAAA,EAAS;AAAA,UAC1B,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,OAAO,YAAA,CAAa,WAAA;AAAA,UACpB,KAAK,GAAA,GAAM,SAAA;AAAA,UACX,GAAA,EAAK,QAAA;AAAA,UACL;AAAA,SACgB,CAAA;AAElB,QAAA,OAAO;AAAA,UACL,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,KAAA,EAAO,QAAA;AAAA,UACP,OAAO,YAAA,CAAa,WAAA;AAAA,UACpB,YAAA;AAAA,UACA,QAAA,EAAU,KAAA;AAAA,UACV,SAAA,EAAW;AAAA,SACb;AAAA,MACF,CAAC,CAAA;AAED,MAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACpC,QAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,uBAAA,EAAyB,MAAM,yBAAA,EAA2B,MAAA,EAAQ,KAAK,CAAA;AAAA,MAC5F;AAEA,MAAA,OAAO,GAAA,CAAI,KAAA,IAAS,MAAA,GAAS,EAAE,MAAA,EAAQ,OAAA,CAAQ,CAAC,CAAA,EAAE,GAAI,EAAE,OAAA,EAAS,CAAA;AAAA,IACnE,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,UAAA,EAAY,OAAO,IAAA,CAAK,GAAG,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,EAAE,GAAA,EAAK,uBAAA,EAAyB,IAAA,EAAM,WAAW,GAAG,CAAA,EAAG,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAClF;AAAA,EACF;AAAA,EAyBA,MAAM,mBACJ,MAAA,EAIwE;AACxE,IAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAI,QAAA,CAAS,kBAAA,CAAmB,SAAA,CAAU,MAAM,CAAA;AAC/F,IAAA,IAAI,WAAA,EAAa,MAAM,IAAI,UAAA,CAAW,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,UAAA,CAAW,WAAW,CAAA,EAAG,CAAA;AAE9F,IAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAO,UAAA,EAAW,GAAI,KAAK,SAAA,CAAU;AAAA,MAClD,SAAS,YAAA,CAAa,OAAA;AAAA,MACtB,iBAAA,EAAmB,IAAA;AAAA,MACnB,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,IAAI,UAAA,EAAY,MAAM,IAAI,UAAA,CAAW,UAAU,CAAA;AAC/C,IAAA,IAAI,CAAC,KAAA,CAAM,GAAA,EAAK,MAAM,IAAI,UAAA,CAAW,EAAE,GAAA,EAAK,kBAAA,EAAoB,IAAA,EAAM,6BAAA,EAA+B,MAAA,EAAQ,KAAK,CAAA;AAElH,IAAA,MAAM,WAAW,YAAA,CAAa,QAAA,CAAS,GAAA,CAAI,CAAC,YAAY,KAAA,CAAM,GAAA,EAAK,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,OAAA,KAAY,CAAC,CAAC,OAAO,CAAA;AAE9G,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,WAAW,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAM,uBAAA,EAAyB,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAC5F;AAEA,IAAA,MAAM,EAAE,SAAA,EAAW,cAAA,EAAgB,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,aAAA,EAAe,YAAA,CAAa,WAAW,CAAA;AAC7G,IAAA,IAAI,KAAA,EAAO,MAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAErC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAW,MAAM,aAAA,CAAc,QAAA,EAAU,OAAO,OAAA,KAAY;AAChE,QAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,GAAA,CAAI,sBAAA,CAAuB;AAAA,UAC1D,YAAA,EAAc,cAAA;AAAA,UACd,MAAA,EAAQ,CAAC,OAAA,CAAQ,KAAK,CAAA;AAAA,UACtB,SAAA,EAAW;AAAA,SACZ,CAAA;AAED,QAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,QAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,UAAS,GAAI,UAAA,CAAW,aAAa,WAAW,CAAA;AAEzE,QAAA,IAAI,UAAU,OAAO,IAAA;AAErB,QAAA,MAAM,EAAE,SAAA,EAAW,KAAA,EAAAH,MAAAA,EAAM,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,aAAA,EAAe,YAAA,CAAa,WAAA,EAAa;AAAA,UAC7F,OAAA,EAAS,QAAA;AAAA,UACT,QAAQ,OAAA,CAAQ,KAAA;AAAA,UAChB,YAAY,OAAA,CAAQ,UAAA;AAAA,UACpB,cAAA,EAAgB,CAAA,aAAA,EAAgB,OAAA,CAAQ,aAAa,CAAA;AAAA,SACtD,CAAA;AAED,QAAA,IAAIA,QAAO,OAAO,IAAA;AAElB,QAAA,MAAM,gBAAgB,iBAAA,CAAkB;AAAA,UACtC,QAAQ,OAAA,CAAQ,QAAA;AAAA,UAChB,UAAU,OAAA,CAAQ,UAAA;AAAA,UAClB,QAAA,EAAU,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,QAAA;AAAA,UAChC,OAAO,OAAA,CAAQ,KAAA;AAAA,UACf,KAAA,EAAO;AAAA;AAAA,SACR,CAAA;AAED,QAAA,MAAM,EAAE,eAAA,EAAgB,GAAI,eAAA,CAAgB,QAAA,EAAU,QAAQ,QAAQ,CAAA;AAEtE,QAAA,OAAO;AAAA,UACL,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,SAAA,EAAW,QAAA;AAAA,UACX,WAAA,EAAa,EAAE,IAAA,EAAM,eAAA,EAAiB,OAAO,SAAA,EAAW,OAAA,EAAS,cAAc,kBAAA,EAAmB;AAAA,UAClG;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AAED,MAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,WAAW,EAAE,GAAA,EAAK,yBAAyB,IAAA,EAAM,yBAAA,EAA2B,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,MACrG;AAEA,MAAA,OAAO,SAAA,IAAa,SAAS,EAAE,MAAA,EAAQ,QAAQ,CAAC,CAAA,EAAE,GAAI,EAAE,OAAA,EAAQ;AAAA,IAClE,SAASA,MAAAA,EAAO;AACd,MAAA,IAAIA,MAAAA,YAAiB,YAAY,MAAMA,MAAAA;AACvC,MAAA,MAAM,IAAI,UAAA,CAAW,EAAE,GAAA,EAAK,uBAAA,EAAyB,IAAA,EAAM,UAAA,CAAWA,MAAK,CAAA,EAAG,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IAC7F;AAAA,EACF;AAAA,EAEQ,SAAA,CAAU;AAAA,IAChB,OAAA;AAAA,IACA,iBAAA,GAAoB,KAAA;AAAA,IACpB,MAAA,GAAS;AAAA,GACX,EAI6B;AAC3B,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAACI,MAAAA,KAAUA,MAAAA,CAAM,QAAA,KAAa,OAAO,CAAA,GAAI,MAAA;AAClF,IAAA,IAAI,KAAA,EAAO,OAAO,GAAA,CAAI,EAAE,OAAO,CAAA;AAE/B,IAAA,IAAI,iBAAA,SAA0B,GAAA,CAAI,EAAE,OAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,EAAG,CAAA;AAE3D,IAAA,OAAO,IAAA,CAAK;AAAA,MACV,GAAA,EAAK,MAAA,KAAW,GAAA,GAAM,cAAA,GAAiB,gBAAA;AAAA,MACvC,IAAA,EAAM,uDAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAc,cAAA,CACZ,KAAA,EACA,YAAA,EACyF;AACzF,IAAA,MAAM,CAAC,cAAA,EAAgB,eAAe,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,MAC1D,IAAA,CAAK,aAAA,CAAc,aAAA,EAAe,YAAA,CAAa,WAAA,EAAa;AAAA,QAC1D,SAAS,KAAA,CAAM,QAAA;AAAA,QACf,MAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ;AAAA,OAC/B,CAAA;AAAA,MACD,IAAA,CAAK,mBAAA,CAAoB,KAAA,EAAO,YAAY;AAAA,KAC7C,CAAA;AAED,IAAA,IAAI,cAAA,CAAe,KAAA,EAAO,OAAO,IAAA,CAAK,eAAe,KAAK,CAAA;AAG1D,IAAA,OAAO,GAAA,CAAI;AAAA,MACT,sBAAsB,cAAA,CAAe,SAAA;AAAA,MACrC,qBAAA,EAAuB,gBAAgB,SAAA,IAAa;AAAA,KACrD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAc,mBAAA,CAAoB,KAAA,EAAc,YAAA,EAAoE;AAClH,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,aAAA,EAAc;AACtC,MAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,WAAW,CAAA;AACpD,MAAA,MAAM,aAAA,GAAgB,eAAA,EAAiB,YAAA,IAAgB,EAAC;AACxD,MAAA,MAAM,IAAA,GAAO,OAAO,aAAA,KAAkB,QAAA,GAAW,OAAO,IAAA,CAAK,aAAa,IAAI,EAAC;AAC/E,MAAA,MAAM,eAAA,GAAkB,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,UAAA,CAAW,YAAA,CAAa,QAAQ,CAAC,CAAA;AAChF,MAAA,IAAI,aAAa,OAAA,EAAS,MAAM,KAAA,CAAM,aAAA,CAAc,aAAa,OAAO,CAAA;AACxE,MAAA,MAAM,YAAA,GAAe,eAAA,GAAmB,aAAA,CAAc,eAAe,EAAE,MAAA,GAAoB,KAAA,CAAA;AAC3F,MAAA,OAAO,MAAM,IAAA,CAAK,aAAA,CAAc,cAAA,EAAgB,YAAA,EAAc;AAAA,QAC5D,SAAS,KAAA,CAAM,QAAA;AAAA,QACf,MAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ;AAAA,OAC/B,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA,CAAK;AAAA,QACV,GAAA,EAAK,gCAAA;AAAA,QACL,IAAA,EAAM,gDAAA;AAAA,QACN,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAAA,EACF;AAAA;AAAA,EAGQ,gBAAA,CAAiB,SAA2C,SAAA,EAAkC;AACpG,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,UAAA,KAAe,SAAA,IAAa,CAAC,SAAA,EAAW;AAC1D,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,cAAA,CAAe,OAAO,CAAA;AAC9C,IAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,MAAA,IAAA,CAAK,cAAA,CAAe,OAAO,CAAA,GAAI,SAAA;AAAA,IACjC;AAAA,EACF;AAAA,EAcA,MAAc,aAAA,CACZ,OAAA,EACA,KAAA,EACA,MAAA,EACwC;AACxC,IAAA,MAAM,UAAA,GAAa;AAAA,MACjB,GAAA,EAAK,MAAA,EAAQ,cAAA,IAAkB,IAAA,CAAK,eAAe,OAAO,CAAA;AAAA,MAC1D,UAAA,EAAY,MAAA,EAAQ,UAAA,IAAc,IAAA,CAAK,QAAA,CAAS,UAAA;AAAA,MAChD,gBAAA,EAAkB,IAAA,CAAK,gBAAA,CAAiB,IAAA,CAAK,IAAI;AAAA,KACnD;AACA,IAAA,QAAQ,OAAA;AAAS,MACf,KAAK,aAAA;AACH,QAAA,OAAO,oBAAuB,KAAA,EAAwB;AAAA,UACpD,GAAG,UAAA;AAAA,UACH,QAAQ,MAAA,EAAQ,MAAA;AAAA,UAChB,SAAS,MAAA,EAAQ,OAAA;AAAA,UACjB,UAAA,EAAY,CAAC,CAAC,MAAA,EAAQ,cAAA;AAAA,UACtB,cAAc,MAAA,EAAQ,YAAA;AAAA,UACtB,kBAAA,EAAoB,KAAK,QAAA,CAAS;AAAA,SACnC,CAAA;AAAA,MACH,KAAK,cAAA;AACH,QAAA,OAAO,qBAAqB,KAAA,EAAwB;AAAA,UAClD,GAAG,UAAA;AAAA,UACH,QAAQ,MAAA,EAAQ,MAAA;AAAA,UAChB,SAAS,MAAA,EAAQ;AAAA,SAClB,CAAA;AAAA,MACH,KAAK,OAAA;AACH,QAAA,OAAO,aAAA,CAAc,OAAwB,UAAU,CAAA;AAAA,MACzD,KAAK,QAAA;AACH,QAAA,OAAO,cAAA,CAAe,OAAwB,UAAU,CAAA;AAAA,MAC1D;AACE,QAAA,OAAO,IAAA,CAAK;AAAA,UACV,GAAA,EAAK,6BAAA;AAAA,UACL,IAAA,EAAM,aAAa,OAAO,CAAA,iCAAA;AAAA,SAC3B,CAAA;AAAA;AACL,EACF;AAAA,EAeA,MAAc,aAAA,CACZ,OAAA,EACA,KAAA,EAGA;AACA,IAAA,MAAM,UAAA,GAAa;AAAA,MACjB,GAAA,EAAK,IAAA,CAAK,cAAA,CAAe,OAAO,CAAA;AAAA,MAChC,UAAA,EAAY,KAAK,QAAA,CAAS,UAAA;AAAA,MAC1B,gBAAA,EAAkB,IAAA,CAAK,gBAAA,CAAiB,IAAA,CAAK,IAAI;AAAA,KACnD;AACA,IAAA,QAAQ,OAAA;AAAS,MACf,KAAK,aAAA;AACH,QAAA,OAAO,mBAAA,CAAoB,OAAO,UAAU,CAAA;AAAA,MAC9C,KAAK,cAAA;AACH,QAAA,OAAO,oBAAA,CAAqB,OAAO,UAAU,CAAA;AAAA,MAC/C,KAAK,OAAA;AACH,QAAA,OAAO,aAAA,CAAc,OAAO,UAAU,CAAA;AAAA,MACxC,KAAK,QAAA;AACH,QAAA,OAAO,cAAA,CAAe,OAAO,UAAU,CAAA;AAAA,MACzC;AACE,QAAA,OAAO,IAAA,CAAK;AAAA,UACV,GAAA,EAAK,6BAAA;AAAA,UACL,IAAA,EAAM,aAAa,OAAO,CAAA,iCAAA;AAAA,SAC3B,CAAA;AAAA;AACL,EACF;AACF","file":"chunk-7MTPXR5V.cjs","sourcesContent":["import { ENCRYPTION_REGEX } from 'cipher-kit';\r\nimport { COMPRESSION_REGEX } from 'compress-kit';\r\nimport { z } from 'zod';\r\n\r\nexport function $isStr(value: unknown): value is string {\r\n  return value !== null && value !== undefined && typeof value === 'string' && value.trim().length > 0;\r\n}\r\n\r\nexport function $isObj(value: unknown): value is Record<string, unknown> {\r\n  return (\r\n    typeof value === 'object' &&\r\n    value !== null &&\r\n    value !== undefined &&\r\n    (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)\r\n  );\r\n}\r\n\r\nexport const base64urlWithDotRegex = /^[A-Za-z0-9._-]+$/;\r\n\r\nexport const zStr = z.string().trim();\r\nexport const zUuid = z.uuid();\r\nexport const zUrl = z.url();\r\nexport const zEmail = z.email({ pattern: z.regexes.html5Email });\r\nexport const zBase64 = z.base64url();\r\nexport const zLooseBase64 = zStr.regex(base64urlWithDotRegex);\r\nexport const zCompressed = zStr.regex(COMPRESSION_REGEX.GENERAL);\r\n\r\nexport const zLoginPrompt = z.enum(['email', 'select-account', 'sso']);\r\nexport const zTimeUnit = z.enum(['ms', 'sec']);\r\nexport const zCryptoType = z.enum(['web-api', 'node']);\r\nexport const zAccessTokenExpiry = z.number().positive();\r\nexport const zRefreshTokenExpiry = z.number().min(3600);\r\nconst zOneOrMoreUrls = z.union([zUrl.max(2048).transform((url) => [url]), z.array(zUrl.max(2048)).min(1)]);\r\n\r\nexport const zEncrypted = zStr.max(4096).regex(ENCRYPTION_REGEX.GENERAL);\r\nexport const zJwt = z.jwt().max(4096);\r\n\r\nexport const zTenantId = z.union([z.literal('common'), zUuid]);\r\nexport const zScope = zStr.min(3).max(128);\r\nexport const zEncryptionKey = zStr.min(32).max(64);\r\nexport const zServiceName = zStr.min(1).max(64);\r\n\r\nexport const zAzure = z.object({\r\n  clientId: zUuid,\r\n  tenantId: zTenantId,\r\n  scopes: z.array(zScope).min(1),\r\n  clientSecret: zStr.min(32).max(128),\r\n  downstreamServices: z\r\n    .array(\r\n      z.object({\r\n        serviceName: zServiceName,\r\n        scope: zScope,\r\n        serviceUrl: zOneOrMoreUrls,\r\n        encryptionKey: zEncryptionKey,\r\n        cryptoType: zCryptoType.default('node'),\r\n        accessTokenExpiry: zAccessTokenExpiry.default(3600),\r\n      }),\r\n    )\r\n    .min(1)\r\n    .optional(),\r\n  b2bApps: z\r\n    .array(z.object({ appName: zServiceName, scope: zScope }))\r\n    .min(1)\r\n    .optional(),\r\n});\r\n\r\nexport const zConfig = z.object({\r\n  azure: z.union([zAzure.transform((azure) => [azure]), z.array(zAzure).min(1)]),\r\n  frontendUrl: zOneOrMoreUrls,\r\n  serverCallbackUrl: zUrl.max(2048),\r\n  encryptionKey: zEncryptionKey,\r\n  advanced: z\r\n    .object({\r\n      loginPrompt: zLoginPrompt.default('sso'),\r\n      acceptB2BRequests: z.boolean().default(false),\r\n      cryptoType: zCryptoType.default('node'),\r\n      disableCompression: z.boolean().default(false),\r\n      cookies: z\r\n        .object({\r\n          timeUnit: zTimeUnit.default('sec'),\r\n          disableSecure: z.boolean().default(false),\r\n          disableSameSite: z.boolean().default(false),\r\n          accessTokenExpiry: zAccessTokenExpiry.default(3600),\r\n          refreshTokenExpiry: zRefreshTokenExpiry.default(2592000),\r\n        })\r\n        .prefault({}),\r\n    })\r\n    .prefault({}),\r\n});\r\n\r\nconst zJwtClientConfigBase = z.object({ clientId: zUuid, tenantId: zTenantId });\r\n\r\nexport const zJwtClientConfig = z.object({\r\n  azure: z.union([\r\n    zJwtClientConfigBase,\r\n    zJwtClientConfigBase.extend({\r\n      clientSecret: zStr.min(32).max(128),\r\n      b2bApps: z\r\n        .array(z.object({ appName: zServiceName, scope: zScope }))\r\n        .min(1)\r\n        .optional(),\r\n    }),\r\n  ]),\r\n});\r\n\r\nexport const zState = z.object({\r\n  azureId: zUuid,\r\n  frontendUrl: zUrl.max(2048),\r\n  codeVerifier: zStr.max(256),\r\n  nonce: zUuid,\r\n  email: zEmail.max(320).optional(),\r\n  prompt: z.enum(['login', 'select_account']).optional(),\r\n  ticketId: zUuid,\r\n});\r\n\r\nexport const zInjectedData = z.record(zStr, z.any()).optional();\r\n\r\nexport const zAtStruct = z.object({\r\n  at: zJwt,\r\n  inj: zStr.max(4096).optional(),\r\n  exp: z.number().int().positive(),\r\n  aid: zUuid,\r\n});\r\n\r\nexport const zRtStruct = z.object({\r\n  rt: zLooseBase64,\r\n  exp: z.number().int().positive(),\r\n  aid: zUuid,\r\n});\r\n\r\nexport const zMethods = {\r\n  getAuthUrl: z\r\n    .object({\r\n      loginPrompt: zLoginPrompt.optional(),\r\n      email: zEmail.max(320).optional(),\r\n      frontendUrl: zUrl.max(2048).optional(),\r\n      azureId: zUuid.optional(),\r\n    })\r\n    .default({}),\r\n  getTokenByCode: z.object({\r\n    code: zStr.max(2048).regex(base64urlWithDotRegex),\r\n    state: zEncrypted,\r\n  }),\r\n  getLogoutUrl: z\r\n    .object({\r\n      frontendUrl: zUrl.max(2048).optional(),\r\n      azureId: zUuid.optional(),\r\n    })\r\n    .default({}),\r\n  tryGetB2BToken: z.union([\r\n    z\r\n      .object({\r\n        azureId: zUuid.optional(),\r\n        app: zServiceName,\r\n      })\r\n      .transform((data) => ({\r\n        azureId: data.azureId,\r\n        apps: [data.app],\r\n      })),\r\n    z.object({\r\n      azureId: zUuid.optional(),\r\n      apps: z.array(zServiceName).min(1),\r\n    }),\r\n  ]),\r\n  getTokenOnBehalfOf: z.union([\r\n    z\r\n      .object({\r\n        accessToken: z.union([zJwt, zEncrypted]),\r\n        service: zServiceName,\r\n        azureId: zUuid.optional(),\r\n      })\r\n      .transform((data) => ({\r\n        accessToken: data.accessToken,\r\n        services: [data.service],\r\n        azureId: data.azureId,\r\n      })),\r\n    z.object({\r\n      accessToken: z.union([zJwt, zEncrypted]),\r\n      services: z.array(zServiceName).min(1),\r\n      azureId: zUuid.optional(),\r\n    }),\r\n  ]),\r\n};\r\n","import { ZodError } from 'zod';\r\nimport { $isObj } from './utils/zod';\r\n\r\nexport type HttpErrorCodes = 400 | 401 | 403 | 500;\r\n\r\nexport interface ResultErr {\r\n  readonly message: string;\r\n  readonly description: string;\r\n  readonly statusCode: HttpErrorCodes;\r\n}\r\n\r\nexport type Result<T, E = ResultErr> = T extends object\r\n  ?\r\n      | ({ readonly [K in keyof T]: T[K] } & { readonly success: true; readonly error?: undefined })\r\n      | ({ readonly [K in keyof T]?: undefined } & { readonly success: false; readonly error: E })\r\n  :\r\n      | { readonly success: true; readonly result: T; readonly error?: undefined }\r\n      | { readonly success: false; readonly error: E; readonly result?: undefined };\r\n\r\nexport function $ok<T>(result?: T): Result<T> {\r\n  if ($isObj(result)) {\r\n    return { success: true, ...(result as object) } as Result<T>;\r\n  }\r\n  return { success: true, result } as Result<T>;\r\n}\r\n\r\nexport function $err(err: { msg: string; desc: string; status?: HttpErrorCodes }): Result<never, ResultErr>;\r\nexport function $err(err: ResultErr): Result<never, ResultErr>;\r\nexport function $err(err: OAuthError): Result<never, ResultErr>;\r\nexport function $err(\r\n  err: { msg: string; desc: string; status?: HttpErrorCodes } | ResultErr | OAuthError,\r\n): Result<never, ResultErr> {\r\n  if (err instanceof OAuthError) {\r\n    return {\r\n      success: false,\r\n      error: { message: err.message, description: err.description, statusCode: err.statusCode },\r\n    } as Result<never, ResultErr>;\r\n  }\r\n\r\n  return {\r\n    success: false,\r\n    error:\r\n      'msg' in err && 'desc' in err\r\n        ? { message: err.msg, description: err.desc, statusCode: err.status ?? 400 }\r\n        : { message: err.message, description: err.description, statusCode: err.statusCode ?? 400 },\r\n  } as Result<never, ResultErr>;\r\n}\r\n\r\n/**\r\n * Custom error class for handling OAuth-related errors.\r\n *\r\n * This error is designed for use in OAuth authentication flows,\r\n * providing an HTTP status code, a message, and an optional description.\r\n *\r\n * @extends {Error}\r\n */\r\nexport class OAuthError extends Error {\r\n  readonly statusCode: HttpErrorCodes;\r\n  readonly description: string;\r\n\r\n  constructor(err: ResultErr);\r\n  constructor(err: Result<never, ResultErr>);\r\n  constructor(err: { msg: string; desc: string; status?: HttpErrorCodes });\r\n  constructor(err: { msg: string; desc: string; status?: HttpErrorCodes } | ResultErr | Result<never, ResultErr>) {\r\n    if ('error' in err && 'success' in err) {\r\n      super((err.error as ResultErr).message);\r\n      this.statusCode = (err.error as ResultErr).statusCode;\r\n      this.description = (err.error as ResultErr).description;\r\n    } else if ('msg' in err && 'desc' in err) {\r\n      super(err.msg);\r\n      this.statusCode = err.status ?? 400;\r\n      this.description = err.desc;\r\n    } else if ('message' in err && 'description' in err && 'statusCode' in err) {\r\n      super(err.message);\r\n      this.statusCode = err.statusCode;\r\n      this.description = err.description;\r\n    } else {\r\n      super('An unknown error occurred');\r\n      this.statusCode = 500;\r\n      this.description = 'An unknown error occurred';\r\n    }\r\n    this.name = 'OAuthError';\r\n\r\n    Object.setPrototypeOf(this, new.target.prototype);\r\n    if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);\r\n  }\r\n}\r\n\r\nexport function $stringErr(err: unknown): string {\r\n  switch (true) {\r\n    case err instanceof OAuthError:\r\n      return `OAuthError: ${err.message} (${err.statusCode}) - ${err.description}`;\r\n    case err instanceof ZodError:\r\n      return `ZodError (Schema Validation): ${err.issues\r\n        .map((issue) => `${issue.path.length > 0 ? issue.path.join('.') : 'root'}: ${issue.message}`)\r\n        .join('. ')}`;\r\n    case err instanceof Error:\r\n      return `Error ${err.name}: ${err.message} - ${err.stack ?? 'No stack trace available'}`;\r\n    case typeof err === 'string':\r\n      return `String Error: ${err}`;\r\n    case typeof err === 'object' && err !== null:\r\n      switch (true) {\r\n        case 'success' in err &&\r\n          err.success === false &&\r\n          'error' in err &&\r\n          typeof err.error === 'object' &&\r\n          err.error &&\r\n          'message' in err.error &&\r\n          'description' in err.error:\r\n          return `ResultErr Error: ${err.error.message}${'statusCode' in err.error ? ` (${err.error.statusCode})` : ''} - ${err.error.description}`;\r\n        case 'message' in err && 'description' in err:\r\n          return `ResultErr Error: ${err.message}${'statusCode' in err ? ` (${err.statusCode})` : ''} - ${err.description}`;\r\n        case 'msg' in err && 'desc' in err:\r\n          return `ResultErr Error: ${err.msg}${'status' in err ? ` (${err.status})` : ''} - ${err.desc}`;\r\n        default:\r\n          try {\r\n            return `Object Error: ${JSON.stringify(err, (_, v) => (typeof v === 'bigint' ? v.toString() : v))}`;\r\n          } catch {\r\n            return `Object Error: [Unserializable] ${String(err)}`;\r\n          }\r\n      }\r\n    default:\r\n      return `Unknown Error: ${String(err)}`;\r\n  }\r\n}\r\n","import type { BaseCookieNames, BaseCookieOptions } from '~/types';\r\n\r\nexport const ACCESS_TOKEN_NAME = 'at' as const;\r\nexport const REFRESH_TOKEN_NAME = 'rt' as const;\r\n\r\nexport function $getCookieOptions(params: {\r\n  secure: boolean;\r\n  sameSite: boolean;\r\n  timeUnit: 'sec' | 'ms';\r\n  atExp: number;\r\n  rtExp: number;\r\n}): BaseCookieOptions {\r\n  const timeFrame = params.timeUnit === 'sec' ? 1 : 1000;\r\n  const baseOptions = {\r\n    httpOnly: true,\r\n    secure: params.secure,\r\n    sameSite: params.sameSite ? 'strict' : params.secure ? 'none' : undefined,\r\n    path: '/',\r\n  } as const;\r\n\r\n  return {\r\n    accessTokenOptions: { ...baseOptions, maxAge: params.atExp * timeFrame },\r\n    refreshTokenOptions: { ...baseOptions, maxAge: params.rtExp * timeFrame },\r\n    deleteTokenOptions: { ...baseOptions, maxAge: 0 },\r\n  } as const;\r\n}\r\n\r\nexport function $getCookieNames(clientId: string, secure: boolean): BaseCookieNames {\r\n  return {\r\n    accessTokenName: `${`${secure ? '__Host-' : ''}${ACCESS_TOKEN_NAME}-${clientId}`}`,\r\n    refreshTokenName: `${`${secure ? '__Host-' : ''}${REFRESH_TOKEN_NAME}-${clientId}`}`,\r\n  } as const;\r\n}\r\n","import { parseToObj, stringifyObj } from 'cipher-kit';\r\nimport {\r\n  createSecretKey as createNodeKey,\r\n  isNodeKey,\r\n  type NodeKey,\r\n  decrypt as nodeDecrypt,\r\n  encrypt as nodeEncrypt,\r\n  generateUuid as nodeGenerateUuid,\r\n} from 'cipher-kit/node';\r\nimport {\r\n  createSecretKey as createWebApiKey,\r\n  isWebApiKey,\r\n  type WebApiKey,\r\n  decrypt as webApiDecrypt,\r\n  encrypt as webApiEncrypt,\r\n  generateUuid as webApiGenerateUuid,\r\n} from 'cipher-kit/web-api';\r\nimport { $err, $ok, $stringErr } from '~/error';\r\nimport type { Result } from '~/exports';\r\nimport type { CryptoType } from '~/types';\r\nimport { $isStr } from './zod';\r\n\r\nexport function $generateUuid(cryptoType: CryptoType): Result<{ uuid: string }> {\r\n  const uuid = cryptoType === 'node' ? nodeGenerateUuid() : webApiGenerateUuid();\r\n  if (uuid.error) return $err({ msg: 'Failed to generate UUID', desc: $stringErr(uuid.error) });\r\n  return $ok({ uuid: uuid.result });\r\n}\r\n\r\nexport function $createSecretKey(cryptoType: CryptoType, key: string): Result<{ newSecretKey: string | NodeKey }> {\r\n  if (cryptoType === 'web-api') return $ok({ newSecretKey: key });\r\n\r\n  const { secretKey, error } = createNodeKey(key);\r\n  if (error) return $err({ msg: 'Failed to create Node secret key', desc: $stringErr(error) });\r\n  return $ok({ newSecretKey: secretKey });\r\n}\r\n\r\nexport function $newSecretKeys(\r\n  cryptoType: CryptoType,\r\n  keys: { accessToken: string; refreshToken: string; state: string; ticket: string },\r\n): Result<{\r\n  secretKeys: {\r\n    accessToken: string | NodeKey;\r\n    refreshToken: string | NodeKey;\r\n    state: string | NodeKey;\r\n    ticket: string | NodeKey;\r\n  };\r\n}> {\r\n  if (cryptoType === 'web-api') {\r\n    return $ok({ secretKeys: keys });\r\n  }\r\n\r\n  const secretKeys = {} as Record<keyof typeof keys, NodeKey>;\r\n  for (const name of Object.keys(keys) as (keyof typeof keys)[]) {\r\n    const { secretKey, error } = createNodeKey(keys[name]);\r\n    if (error) return $err({ msg: `Failed to create ${name} key`, desc: `Key Creation - ${$stringErr(error)}` });\r\n    secretKeys[name] = secretKey;\r\n  }\r\n\r\n  return $ok({ secretKeys: secretKeys });\r\n}\r\n\r\nexport async function $encrypt(\r\n  cryptoType: CryptoType,\r\n  data: string | null,\r\n  key: string | WebApiKey | NodeKey,\r\n): Promise<Result<{ encrypted: string; newSecretKey: WebApiKey | undefined }>> {\r\n  if (!data) return $err({ msg: 'Invalid data', desc: 'Empty string to encrypt' });\r\n  if (cryptoType === 'node') {\r\n    if (!$isStr(key) && !isNodeKey(key)) {\r\n      return $err({ msg: 'Invalid key type', desc: 'Expected NodeKey or string' });\r\n    }\r\n    const { secretKey, error: secretKeyError } = createNodeKey(key);\r\n    if (secretKeyError) {\r\n      return $err({ msg: 'Failed to create Node secret key', desc: `Key Creation - ${$stringErr(secretKeyError)}` });\r\n    }\r\n\r\n    const encrypted = nodeEncrypt(data, secretKey);\r\n    if (encrypted.error) return $err({ msg: 'Encryption failed', desc: `Encryption - ${$stringErr(encrypted.error)}` });\r\n\r\n    return $ok({ encrypted: encrypted.result, newSecretKey: undefined });\r\n  }\r\n\r\n  if (!$isStr(key) && !isWebApiKey(key)) {\r\n    return $err({ msg: 'Invalid key type', desc: 'Expected string or WebApiKey' });\r\n  }\r\n\r\n  const { secretKey, error: secretKeyError } = await createWebApiKey(key);\r\n  if (secretKeyError) return $err({ msg: 'Failed to create Web API secret key', desc: $stringErr(secretKeyError) });\r\n\r\n  const encrypted = await webApiEncrypt(data, secretKey);\r\n  if (encrypted.error) return $err({ msg: 'Encryption failed', desc: `Encryption - ${$stringErr(encrypted.error)}` });\r\n\r\n  return $ok({ encrypted: encrypted.result, newSecretKey: secretKey });\r\n}\r\n\r\nexport async function $decrypt(\r\n  cryptoType: CryptoType,\r\n  encrypted: string | null,\r\n  key: string | WebApiKey | NodeKey,\r\n): Promise<Result<{ result: string; newSecretKey: WebApiKey | undefined }>> {\r\n  if (!encrypted) return $err({ msg: 'Invalid data', desc: 'Empty string to decrypt' });\r\n  if (cryptoType === 'node') {\r\n    if (!$isStr(key) && !isNodeKey(key)) {\r\n      return $err({ msg: 'Invalid key type', desc: 'Expected NodeKey or string' });\r\n    }\r\n\r\n    const { secretKey, error: secretKeyError } = createNodeKey(key);\r\n    if (secretKeyError) return $err({ msg: 'Failed to create Node secret key', desc: $stringErr(secretKeyError) });\r\n\r\n    const decrypted = nodeDecrypt(encrypted, secretKey);\r\n    if (decrypted.error) return $err({ msg: 'Decryption failed', desc: `Decryption - ${$stringErr(decrypted.error)}` });\r\n\r\n    return $ok({ result: decrypted.result, newSecretKey: undefined });\r\n  }\r\n  if (!$isStr(key) && !isWebApiKey(key)) {\r\n    return $err({ msg: 'Invalid key type', desc: 'Expected string or WebApiKey' });\r\n  }\r\n\r\n  const { secretKey, error: secretKeyError } = await createWebApiKey(key);\r\n  if (secretKeyError) return $err({ msg: 'Failed to create Web API secret key', desc: $stringErr(secretKeyError) });\r\n\r\n  const decrypted = await webApiDecrypt(encrypted, secretKey);\r\n  if (decrypted.error) return $err({ msg: 'Decryption failed', desc: `Decryption - ${$stringErr(decrypted.error)}` });\r\n\r\n  return $ok({ result: decrypted.result, newSecretKey: secretKey });\r\n}\r\n\r\nexport async function $encryptObj(\r\n  cryptoType: CryptoType,\r\n  obj: Record<string, unknown> | null,\r\n  key: string | WebApiKey | NodeKey,\r\n): Promise<Result<{ encrypted: string; newSecretKey: WebApiKey | undefined }>> {\r\n  if (!obj) return $err({ msg: 'Invalid data', desc: 'Empty object to encrypt' });\r\n  const { result, error } = stringifyObj(obj);\r\n  if (error) return $err({ msg: 'Failed to stringify object', desc: $stringErr(error) });\r\n  return await $encrypt(cryptoType, result, key);\r\n}\r\n\r\nexport async function $decryptObj(\r\n  cryptoType: CryptoType,\r\n  encrypted: string | null,\r\n  key: string | WebApiKey | NodeKey,\r\n): Promise<Result<{ result: Record<string, unknown>; newSecretKey: WebApiKey | undefined }>> {\r\n  if (!encrypted) return $err({ msg: 'Invalid data', desc: 'Empty string to decrypt' });\r\n  const decrypted = await $decrypt(cryptoType, encrypted, key);\r\n  if (decrypted.error) return decrypted;\r\n  const { result, error } = parseToObj(decrypted.result);\r\n  if (error) return $err({ msg: 'Failed to parse object', desc: $stringErr(error) });\r\n  return $ok({ result, newSecretKey: decrypted.newSecretKey });\r\n}\r\n","import { ConfidentialClientApplication, CryptoProvider } from '@azure/msal-node';\r\nimport { JwksClient } from 'jwks-rsa';\r\nimport type { z } from 'zod';\r\nimport { $err, $ok, $stringErr, OAuthError, type Result } from '~/error';\r\nimport type {\r\n  AccessTokenName,\r\n  Azure,\r\n  B2BApp,\r\n  BaseCookieOptions,\r\n  EncryptionKeys,\r\n  LiteConfig,\r\n  MinimalAzure,\r\n  NonEmptyArray,\r\n  OAuthConfig,\r\n  OAuthSettings,\r\n  OboService,\r\n  RefreshTokenName,\r\n} from '~/types';\r\nimport { $getCookieNames, $getCookieOptions } from './cookie-options';\r\nimport { $newSecretKeys } from './encrypt';\r\nimport { type zAzure, zConfig, zJwtClientConfig } from './zod';\r\n\r\nexport function $oauthConfig(configuration: OAuthConfig): Result<{\r\n  azures: NonEmptyArray<Azure>;\r\n  frontendUrls: NonEmptyArray<string>;\r\n  frontendWhitelist: Set<string>;\r\n  serverCallbackUrl: string;\r\n  baseCookieOptions: BaseCookieOptions;\r\n  encryptionKeys: EncryptionKeys;\r\n  msalCryptoProvider: CryptoProvider;\r\n  jwksClient: JwksClient;\r\n  settings: OAuthSettings;\r\n}> {\r\n  const { data: config, error: configError } = zConfig.safeParse(configuration);\r\n  if (configError) return $err({ msg: 'Invalid config', desc: $stringErr(configError), status: 500 });\r\n\r\n  const frontendUrls = config.frontendUrl as NonEmptyArray<string>;\r\n\r\n  const frontUrlObjects = frontendUrls.map((url) => new URL(url));\r\n  const serverUrlObject = new URL(config.serverCallbackUrl);\r\n\r\n  const frontendHosts = new Set(frontUrlObjects.map((url) => url.host));\r\n  const serverHost = serverUrlObject.host;\r\n\r\n  const { cookies } = config.advanced;\r\n  const baseCookieOptions = $getCookieOptions({\r\n    timeUnit: cookies.timeUnit,\r\n    atExp: cookies.accessTokenExpiry,\r\n    rtExp: cookies.refreshTokenExpiry,\r\n    secure: !cookies.disableSecure && [serverUrlObject, ...frontUrlObjects].every((url) => url.protocol === 'https:'),\r\n    sameSite: !cookies.disableSameSite && frontendHosts.size === 1 && frontendHosts.has(serverHost),\r\n  });\r\n\r\n  try {\r\n    const azures = config.azure\r\n      .map((azure) => {\r\n        const cca = $createCca({\r\n          clientId: azure.clientId,\r\n          tenantId: azure.tenantId,\r\n          clientSecret: azure.clientSecret,\r\n        });\r\n\r\n        const b2b = $getB2B(azure.b2bApps);\r\n        const obo = $getObo({\r\n          oboServices: azure.downstreamServices,\r\n          secure: baseCookieOptions.accessTokenOptions.secure,\r\n          sameSite: baseCookieOptions.accessTokenOptions.sameSite,\r\n          atExp: config.advanced.cookies.accessTokenExpiry,\r\n          serverUrlObject: serverUrlObject,\r\n        });\r\n\r\n        const cookieNames = $getCookieNames(azure.clientId, baseCookieOptions.accessTokenOptions.secure);\r\n\r\n        return {\r\n          clientId: azure.clientId,\r\n          tenantId: azure.tenantId,\r\n          scopes: azure.scopes as NonEmptyArray<string>,\r\n          cookiesNames: cookieNames,\r\n          cca: cca,\r\n          b2b: b2b.map,\r\n          b2bNames: b2b.names,\r\n          obo: obo.map,\r\n          oboNames: obo.names,\r\n        } satisfies Azure;\r\n      })\r\n      .filter((azure) => !!azure) as NonEmptyArray<Azure>;\r\n\r\n    if (azures.length === 0) {\r\n      throw new OAuthError({\r\n        msg: 'No valid Azure configurations found',\r\n        desc: 'Ensure at least one Azure configuration is provided in the config file.',\r\n        status: 500,\r\n      });\r\n    }\r\n\r\n    const { secretKeys: encryptionKeys, error: secretKeysError } = $newSecretKeys(config.advanced.cryptoType, {\r\n      accessToken: `access-token-${config.encryptionKey}`,\r\n      refreshToken: `refresh-token-${config.encryptionKey}`,\r\n      state: `state-${config.encryptionKey}`,\r\n      ticket: `ticket-${config.encryptionKey}`,\r\n    });\r\n    if (secretKeysError) return $err(secretKeysError);\r\n\r\n    const msalCryptoProvider = new CryptoProvider();\r\n\r\n    const { jwksClient, error: jwksError } = $createJwks(azures.length === 1 ? azures[0].tenantId : 'common');\r\n    if (jwksError) return $err(jwksError);\r\n\r\n    const settings: OAuthSettings = {\r\n      loginPrompt: config.advanced.loginPrompt,\r\n      acceptB2BRequests: config.advanced.acceptB2BRequests,\r\n      cryptoType: config.advanced.cryptoType,\r\n      disableCompression: config.advanced.disableCompression,\r\n      b2bApps: azures.some((azure) => azure.b2bNames)\r\n        ? (azures\r\n            .map((azure) => ({ azureId: azure.clientId, names: azure.b2bNames }))\r\n            .filter((azure) => !!azure) as NonEmptyArray<{ azureId: string; names: NonEmptyArray<string> }>)\r\n        : undefined,\r\n      downstreamServices: azures.some((azure) => azure.oboNames)\r\n        ? (azures\r\n            .map((azure) => ({ azureId: azure.clientId, names: azure.oboNames }))\r\n            .filter((azure) => !!azure) as NonEmptyArray<{ azureId: string; names: NonEmptyArray<string> }>)\r\n        : undefined,\r\n      azures: azures.map((azure) => ({ azureId: azure.clientId, tenantId: azure.tenantId })) as NonEmptyArray<{\r\n        azureId: string;\r\n        tenantId: string;\r\n      }>,\r\n      cookies: {\r\n        timeUnit: config.advanced.cookies.timeUnit,\r\n        isSecure: baseCookieOptions.accessTokenOptions.secure,\r\n        isSameSite: baseCookieOptions.accessTokenOptions.sameSite === 'strict',\r\n        accessTokenName: azures[0].cookiesNames.accessTokenName,\r\n        accessTokenExpiry: config.advanced.cookies.accessTokenExpiry,\r\n        refreshTokenName: azures[0].cookiesNames.refreshTokenName,\r\n        refreshTokenExpiry: config.advanced.cookies.refreshTokenExpiry,\r\n        cookieNames: azures.map((azure) => ({\r\n          azureId: azure.clientId,\r\n          accessTokenName: azure.cookiesNames.accessTokenName,\r\n          refreshTokenName: azure.cookiesNames.refreshTokenName,\r\n        })) as NonEmptyArray<{ azureId: string; accessTokenName: AccessTokenName; refreshTokenName: RefreshTokenName }>,\r\n        deleteOptions: baseCookieOptions.deleteTokenOptions,\r\n      },\r\n    };\r\n\r\n    return $ok({\r\n      azures: azures,\r\n      frontendUrls: frontendUrls,\r\n      frontendWhitelist: frontendHosts,\r\n      serverCallbackUrl: config.serverCallbackUrl,\r\n      baseCookieOptions: baseCookieOptions,\r\n      encryptionKeys: encryptionKeys,\r\n      msalCryptoProvider: msalCryptoProvider,\r\n      jwksClient: jwksClient,\r\n      settings: settings,\r\n    });\r\n  } catch (error) {\r\n    if (error instanceof OAuthError) return $err(error);\r\n    return $err({\r\n      msg: 'Failed to create Azure configurations',\r\n      desc: `OAuth Provider Constructor - ${$stringErr(error)}`,\r\n      status: 500,\r\n    });\r\n  }\r\n}\r\n\r\nexport function $jwtClientConfig(config: LiteConfig): Result<{\r\n  azure: MinimalAzure;\r\n  jwksClient: JwksClient;\r\n}> {\r\n  const { data: parsedConfig, error: configError } = zJwtClientConfig.safeParse(config);\r\n  if (configError) return $err({ msg: 'Invalid config', desc: $stringErr(configError), status: 500 });\r\n\r\n  const { jwksClient, error: jwksError } = $createJwks(parsedConfig.azure.tenantId);\r\n  if (jwksError) return $err(jwksError);\r\n\r\n  if (!('clientSecret' in parsedConfig.azure)) {\r\n    return $ok({\r\n      azure: {\r\n        clientId: parsedConfig.azure.clientId,\r\n        tenantId: parsedConfig.azure.tenantId,\r\n        cca: undefined,\r\n        b2bApps: undefined,\r\n      },\r\n      jwksClient: jwksClient,\r\n    });\r\n  }\r\n  try {\r\n    const b2b = $getB2B(parsedConfig.azure.b2bApps);\r\n    const cca = $createCca({\r\n      clientId: parsedConfig.azure.clientId,\r\n      tenantId: parsedConfig.azure.tenantId,\r\n      clientSecret: parsedConfig.azure.clientSecret,\r\n    });\r\n\r\n    return $ok({\r\n      azure: {\r\n        clientId: parsedConfig.azure.clientId,\r\n        tenantId: parsedConfig.azure.tenantId,\r\n        cca: cca,\r\n        b2bApps: b2b.map,\r\n      },\r\n      jwksClient: jwksClient,\r\n    });\r\n  } catch (error) {\r\n    if (error instanceof OAuthError) return $err(error);\r\n    return $err({\r\n      msg: 'Failed to create Azure configuration',\r\n      desc: `OAuth Lite Provider Constructor - ${$stringErr(error)}`,\r\n      status: 500,\r\n    });\r\n  }\r\n}\r\n\r\nfunction $createJwks(tenantId: string): Result<{ jwksClient: JwksClient }> {\r\n  try {\r\n    return $ok({\r\n      jwksClient: new JwksClient({\r\n        cache: true,\r\n        cacheMaxEntries: 5,\r\n        cacheMaxAge: 10 * 60 * 1000,\r\n        jwksUri: `https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`,\r\n      }),\r\n    });\r\n  } catch (error) {\r\n    return $err({ msg: 'Failed to create JWKS client', desc: $stringErr(error), status: 500 });\r\n  }\r\n}\r\n\r\nfunction $createCca(params: {\r\n  clientId: string;\r\n  tenantId: string;\r\n  clientSecret: string;\r\n}): ConfidentialClientApplication {\r\n  try {\r\n    return new ConfidentialClientApplication({\r\n      auth: {\r\n        clientId: params.clientId,\r\n        authority: `https://login.microsoftonline.com/${params.tenantId}`,\r\n        clientSecret: params.clientSecret,\r\n      },\r\n    });\r\n  } catch (error) {\r\n    throw new OAuthError({\r\n      msg: 'Failed to create Confidential Client Application',\r\n      desc: $stringErr(error),\r\n      status: 500,\r\n    });\r\n  }\r\n}\r\n\r\nfunction $getB2B(b2bApps: z.infer<typeof zAzure>['b2bApps']): {\r\n  map: Map<string, B2BApp> | undefined;\r\n  names: NonEmptyArray<string> | undefined;\r\n} {\r\n  if (!b2bApps) return { map: undefined, names: undefined };\r\n\r\n  const map = new Map<string, B2BApp>(\r\n    b2bApps.map((app) => [\r\n      app.appName,\r\n      { appName: app.appName, scope: app.scope, token: null, exp: null, aud: null, msalResponse: null },\r\n    ]),\r\n  );\r\n  const names = Array.from(map.keys());\r\n\r\n  if (names.length !== b2bApps.length) {\r\n    throw new OAuthError({ msg: 'Invalid config', desc: 'B2B has duplicates', status: 500 });\r\n  }\r\n\r\n  return { map, names: names as NonEmptyArray<string> };\r\n}\r\n\r\nfunction $getObo({\r\n  oboServices,\r\n  secure,\r\n  sameSite,\r\n  atExp,\r\n  serverUrlObject,\r\n}: {\r\n  oboServices: z.infer<typeof zAzure>['downstreamServices'];\r\n  secure: boolean;\r\n  sameSite: 'strict' | 'none' | undefined;\r\n  atExp: number;\r\n  serverUrlObject: URL;\r\n}): { map: Map<string, OboService> | undefined; names: NonEmptyArray<string> | undefined } {\r\n  if (!oboServices) return { map: undefined, names: undefined };\r\n\r\n  const map = new Map<string, OboService>(\r\n    oboServices.map((service) => {\r\n      const serviceUrlObjects = service.serviceUrl.map((url) => new URL(url));\r\n      const serviceUrlHosts = new Set(serviceUrlObjects.map((url) => url.host));\r\n      return [\r\n        service.serviceName,\r\n        {\r\n          serviceName: service.serviceName,\r\n          scope: service.scope,\r\n          encryptionKey: service.encryptionKey,\r\n          cryptoType: service.cryptoType,\r\n          isSecure: secure && [serverUrlObject, ...serviceUrlObjects].every((url) => url.protocol === 'https:'),\r\n          isSamesite: sameSite === 'strict' && serviceUrlHosts.size === 1 && serviceUrlHosts.has(serverUrlObject.host),\r\n          atExp: service.accessTokenExpiry ?? atExp,\r\n        },\r\n      ];\r\n    }),\r\n  );\r\n\r\n  const names = Array.from(map.keys());\r\n\r\n  if (names.length !== oboServices.length) {\r\n    throw new OAuthError({ msg: 'Invalid config', desc: 'OBO has duplicates', status: 500 });\r\n  }\r\n\r\n  return { map, names: names as NonEmptyArray<string> };\r\n}\r\n","import jwt from 'jsonwebtoken';\r\nimport type { JwksClient } from 'jwks-rsa';\r\nimport { $err, $ok, $stringErr, type Result } from '~/error';\r\nimport type { JwtPayload, Metadata } from '~/types';\r\nimport { $isStr } from './zod';\r\n\r\nexport function $extractDataFromPayload(payload: JwtPayload | string): Result<{ meta: Metadata }> {\r\n  if (!payload || typeof payload === 'string') {\r\n    return $err({ msg: 'Unauthorized', desc: 'Payload is a string or null', status: 401 });\r\n  }\r\n\r\n  const isApp = payload.sub === payload.oid;\r\n\r\n  return $ok({\r\n    meta: {\r\n      audience: payload.aud as string | undefined,\r\n      issuer: payload.iss,\r\n      subject: payload.sub,\r\n      issuedAt: payload.iat,\r\n      expiration: payload.exp,\r\n      uniqueId: payload.oid as string | undefined,\r\n      azureId: payload.aud as string | undefined,\r\n      tenantId: payload.tid as string | undefined,\r\n      roles: payload.roles as string[] | undefined,\r\n      uniqueTokenId: payload.uti as string | undefined,\r\n      ...(isApp\r\n        ? {\r\n            isApp: true as const,\r\n            appId: payload.azp as string | undefined,\r\n          }\r\n        : {\r\n            isApp: false as const,\r\n            name: payload.name as string | undefined,\r\n            email: payload.preferred_username as string | undefined,\r\n          }),\r\n    },\r\n  });\r\n}\r\n\r\nexport async function $verifyJwt({\r\n  jwtToken,\r\n  azure,\r\n  jwksClient,\r\n}: {\r\n  jwtToken: string;\r\n  azure: { clientId: string; tenantId: string };\r\n  jwksClient: JwksClient;\r\n}): Promise<Result<{ payload: JwtPayload; meta: Metadata }>> {\r\n  const { kid, tenantId, issuer, error } = $getKeyIdAndExtra(jwtToken);\r\n  if (error) return $err({ msg: 'Unauthorized', desc: `Key ID Extraction - ${$stringErr(error)}`, status: 401 });\r\n\r\n  if (azure.tenantId !== 'common' && tenantId !== azure.tenantId) {\r\n    return $err({\r\n      msg: 'Unauthorized',\r\n      desc: `Invalid tenant ID (tid) claim, expected: ${azure.tenantId}, got: ${tenantId}`,\r\n      status: 401,\r\n    });\r\n  }\r\n\r\n  if (issuer !== `https://login.microsoftonline.com/${tenantId}/v2.0`) {\r\n    return $err({\r\n      msg: 'Unauthorized',\r\n      desc: `Invalid issuer (iss) claim, expected: https://login.microsoftonline.com/${tenantId}/v2.0, got: ${issuer}`,\r\n      status: 401,\r\n    });\r\n  }\r\n\r\n  try {\r\n    const publicKey = await $getPublicKey(jwksClient, kid);\r\n\r\n    const decodedJwt = jwt.verify(jwtToken, publicKey, {\r\n      algorithms: ['RS256'],\r\n      audience: azure.clientId,\r\n      complete: true,\r\n    });\r\n\r\n    const { meta, error } = $extractDataFromPayload(decodedJwt.payload);\r\n    if (error) return $err(error);\r\n\r\n    return $ok({ payload: decodedJwt.payload as JwtPayload, meta: meta });\r\n  } catch (err) {\r\n    return $err({\r\n      msg: 'Unauthorized',\r\n      desc: `Failed to verify JWT token. Check your Azure Portal, make sure the 'accessTokenAcceptedVersion' is set to '2' in the 'Manifest' area. Error: ${err instanceof Error ? err.message : err}`,\r\n      status: 401,\r\n    });\r\n  }\r\n}\r\n\r\nexport function $getPublicKey(jwksClient: JwksClient, kid: string): Promise<string> {\r\n  return new Promise((resolve, reject) => {\r\n    jwksClient.getSigningKey(kid, (err, key) => {\r\n      if (err || !key) {\r\n        reject(new Error('Error retrieving signing key'));\r\n        return;\r\n      }\r\n      const publicKey = key.getPublicKey();\r\n      if (!publicKey) {\r\n        reject(new Error('Public key not found'));\r\n        return;\r\n      }\r\n      resolve(publicKey);\r\n    });\r\n  });\r\n}\r\n\r\nexport function $decodeJwt(jwtToken: string): Result<{ decodedJwt: jwt.Jwt }> {\r\n  if (!$isStr(jwtToken)) return $err({ msg: 'Invalid JWT token', desc: 'Empty JWT' });\r\n\r\n  try {\r\n    const decodedJwt = jwt.decode(jwtToken, { complete: true });\r\n    if (!decodedJwt) return $err({ msg: 'Invalid JWT token', desc: \"Couldn't decode JWT token\" });\r\n\r\n    return $ok({ decodedJwt });\r\n  } catch (error) {\r\n    return $err({\r\n      msg: 'Invalid JWT token',\r\n      desc: `Decoding error: ${error instanceof Error ? error.message : typeof error === 'string' ? error : String(error)}`,\r\n    });\r\n  }\r\n}\r\n\r\nexport function $getExpiry(jwtToken: string): Result<{ clientId: string; exp: number }> {\r\n  const { decodedJwt, error } = $decodeJwt(jwtToken);\r\n  if (error) return $err(error);\r\n\r\n  if (typeof decodedJwt.payload === 'string') {\r\n    return $err({ msg: 'Invalid JWT token', desc: \"Couldn't get the JWT payload\" });\r\n  }\r\n\r\n  const clientId = decodedJwt.payload.aud;\r\n  if (typeof clientId !== 'string')\r\n    return $err({\r\n      msg: 'Invalid JWT token',\r\n      desc: `Invalid audience (aud) claim, payload: ${JSON.stringify(decodedJwt.payload)}`,\r\n    });\r\n\r\n  const exp = decodedJwt.payload.exp;\r\n  if (typeof exp !== 'number')\r\n    return $err({\r\n      msg: 'Invalid JWT token',\r\n      desc: `Invalid expiration (exp) claim, payload: ${JSON.stringify(decodedJwt.payload)}`,\r\n    });\r\n\r\n  return $ok({ clientId, exp });\r\n}\r\n\r\nexport function $getKeyIdAndExtra(jwtToken: string): Result<{ kid: string; tenantId: string; issuer: string }> {\r\n  const { decodedJwt, error } = $decodeJwt(jwtToken);\r\n  if (error) return $err(error);\r\n\r\n  try {\r\n    const kid = decodedJwt.header.kid;\r\n    if (typeof kid !== 'string')\r\n      return $err({\r\n        msg: 'Invalid JWT token',\r\n        desc: `Invalid key ID (kid) claim, header: ${JSON.stringify(decodedJwt.header)}`,\r\n      });\r\n\r\n    if (typeof decodedJwt.payload === 'string') {\r\n      return $err({ msg: 'Invalid JWT token', desc: \"Couldn't get the JWT payload\" });\r\n    }\r\n\r\n    const tenantId = decodedJwt.payload.tid;\r\n    if (typeof tenantId !== 'string')\r\n      return $err({\r\n        msg: 'Invalid JWT token',\r\n        desc: `Invalid tenant ID (tid) claim, payload: ${JSON.stringify(decodedJwt.payload)}`,\r\n      });\r\n\r\n    const issuer = decodedJwt.payload.iss;\r\n    if (typeof issuer !== 'string')\r\n      return $err({\r\n        msg: 'Invalid JWT token',\r\n        desc: `Invalid issuer (iss) claim, payload: ${JSON.stringify(decodedJwt.payload)}`,\r\n      });\r\n\r\n    return $ok({ kid, tenantId, issuer });\r\n  } catch (error) {\r\n    return $err({\r\n      msg: 'Invalid JWT token',\r\n      desc: `Error extracting key ID (kid), tenant ID (tid), and issuer (iss): ${error instanceof Error ? error.message : String(error)}`,\r\n    });\r\n  }\r\n}\r\n\r\nexport function $getClientId(jwtToken: string): Result<{ clientId: string }> {\r\n  const { decodedJwt, error } = $decodeJwt(jwtToken);\r\n  if (error) return $err(error);\r\n\r\n  if (typeof decodedJwt.payload === 'string') {\r\n    return $err({ msg: 'Invalid JWT token', desc: \"Couldn't get the JWT payload\" });\r\n  }\r\n\r\n  const clientId = decodedJwt.payload.aud;\r\n\r\n  if (typeof clientId !== 'string')\r\n    return $err({\r\n      msg: 'Invalid JWT token',\r\n      desc: `Invalid audience (aud) claim, payload: ${JSON.stringify(decodedJwt.payload)}`,\r\n    });\r\n\r\n  return $ok({ clientId });\r\n}\r\n","import type { WebApiKey } from 'cipher-kit';\r\nimport { compressObj, decompressObj } from 'compress-kit';\r\nimport type { z } from 'zod';\r\nimport { $err, $ok, $stringErr, type Result } from '~/error';\r\nimport type { CryptoType, EncryptionKey } from '~/types';\r\nimport { $decrypt, $decryptObj, $encrypt, $encryptObj } from './encrypt';\r\nimport { $getClientId } from './jwt';\r\nimport { zAtStruct, zEncrypted, zInjectedData, zJwt, zLooseBase64, zRtStruct, zState, zUuid } from './zod';\r\n\r\ntype BaseParams = {\r\n  key: EncryptionKey;\r\n  cryptoType: CryptoType;\r\n  $updateSecretKey: UpdateSecretKeyFunc;\r\n};\r\n\r\ntype UpdateSecretKeyFunc = (\r\n  key: 'accessToken' | 'refreshToken' | 'state' | 'ticket',\r\n  secretKey: WebApiKey | undefined,\r\n) => void;\r\n\r\nexport async function $encryptAccessToken<T extends object = Record<string, any>>(\r\n  value: string | null,\r\n  params: BaseParams & {\r\n    expiry: number;\r\n    azureId: string;\r\n    isOtherKey: boolean;\r\n    disableCompression?: boolean;\r\n    dataToInject?: T;\r\n  },\r\n): Promise<Result<{ encrypted: string }>> {\r\n  const { data: accessToken, error: jwtError } = zJwt.safeParse(value);\r\n  if (jwtError) return $err({ msg: 'Invalid access token format', desc: $stringErr(jwtError) });\r\n\r\n  const { data: dataToInject, error: injectError } = zInjectedData.safeParse(params.dataToInject);\r\n  if (injectError) return $err({ msg: 'Invalid injected data format', desc: $stringErr(injectError) });\r\n\r\n  const injectedData =\r\n    dataToInject && Object.keys(dataToInject).length !== 0 && !params.disableCompression\r\n      ? compressObj(dataToInject)\r\n      : undefined;\r\n\r\n  if (injectedData?.error) {\r\n    return $err({ msg: 'Failed to compress injected data', desc: `Compression - ${$stringErr(injectedData.error)}` });\r\n  }\r\n\r\n  const struct = {\r\n    at: accessToken,\r\n    inj: injectedData?.result,\r\n    exp: Date.now() + params.expiry * 1000,\r\n    aid: params.azureId,\r\n  } satisfies z.infer<typeof zAtStruct>;\r\n\r\n  const { encrypted, newSecretKey, error } = await $encryptObj(params.cryptoType, struct, params.key);\r\n  if (error) return $err({ msg: 'Failed to encrypt access token', desc: `Encryption - ${$stringErr(error)}` });\r\n\r\n  if (params.isOtherKey === false) params.$updateSecretKey('accessToken', newSecretKey);\r\n\r\n  if (encrypted.length > 4096) {\r\n    return $err({\r\n      msg: 'Token too long',\r\n      desc: `Encrypted access token exceeds 4096 characters. Encrypted length: ${encrypted.length}, original length: ${accessToken.length}, injected data length: ${injectedData?.result.length ?? 0}`,\r\n    });\r\n  }\r\n\r\n  return $ok({ encrypted: encrypted });\r\n}\r\n\r\nexport async function $decryptAccessToken<T extends object = Record<string, any>>(\r\n  value: string | undefined,\r\n  params: BaseParams,\r\n): Promise<Result<{ decrypted: string; azureId: string; injectedData?: T; wasEncrypted: boolean }>> {\r\n  const { data: jwtToken, success: jwtSuccess } = zJwt.safeParse(value);\r\n  if (jwtSuccess) {\r\n    const { clientId, error: jwtError } = $getClientId(jwtToken);\r\n    if (jwtError) return $err(jwtError);\r\n    return $ok({ decrypted: jwtToken, azureId: clientId, injectedData: undefined, wasEncrypted: false });\r\n  }\r\n\r\n  const { data: encryptedAt, error: encryptedAtError } = zEncrypted.safeParse(value);\r\n  if (encryptedAtError) return $err({ msg: 'Unauthorized', desc: $stringErr(encryptedAtError) });\r\n\r\n  const { result, newSecretKey, error } = await $decryptObj(params.cryptoType, encryptedAt, params.key);\r\n  if (error) return $err({ msg: 'Failed to decrypt access token', desc: `Decryption - ${$stringErr(error)}` });\r\n\r\n  params.$updateSecretKey('accessToken', newSecretKey);\r\n\r\n  const { data: atStruct, error: atStructError } = zAtStruct.safeParse(result);\r\n  if (atStructError) return $err({ msg: 'Invalid access token format', desc: $stringErr(atStructError) });\r\n\r\n  if (atStruct.exp < Date.now()) {\r\n    return $err({\r\n      msg: 'Access token expired',\r\n      desc: `Access token expired at ${new Date(atStruct.exp).toISOString()}`,\r\n    });\r\n  }\r\n\r\n  const decompressedInjectedData = atStruct.inj ? decompressObj(atStruct.inj) : undefined;\r\n  if (decompressedInjectedData?.error) {\r\n    return $err({\r\n      msg: 'Failed to decompress injected data',\r\n      desc: `Decompression - ${$stringErr(decompressedInjectedData.error)}`,\r\n    });\r\n  }\r\n\r\n  return $ok({\r\n    decrypted: atStruct.at,\r\n    azureId: atStruct.aid,\r\n    injectedData: decompressedInjectedData ? (decompressedInjectedData.result as T) : undefined,\r\n    wasEncrypted: true,\r\n  });\r\n}\r\n\r\nexport async function $encryptRefreshToken(\r\n  value: string | null,\r\n  params: BaseParams & { expiry: number; azureId: string },\r\n): Promise<Result<{ encrypted: string }>> {\r\n  const { data, error: parseError } = zLooseBase64.safeParse(value);\r\n  if (parseError) return $err({ msg: 'Invalid refresh token format', desc: $stringErr(parseError) });\r\n\r\n  const struct = {\r\n    rt: data,\r\n    exp: Date.now() + params.expiry * 1000,\r\n    aid: params.azureId,\r\n  } satisfies z.infer<typeof zRtStruct>;\r\n\r\n  const { encrypted, newSecretKey, error } = await $encryptObj(params.cryptoType, struct, params.key);\r\n  if (error) return $err({ msg: 'Failed to encrypt refresh token', desc: `Encryption - ${$stringErr(error)}` });\r\n\r\n  params.$updateSecretKey('refreshToken', newSecretKey);\r\n\r\n  if (encrypted.length > 4096) {\r\n    return $err({\r\n      msg: 'Invalid format',\r\n      desc: `Encrypted refresh token exceeds 4096 characters. Encrypted length: ${encrypted.length}, original length: ${data.length}`,\r\n    });\r\n  }\r\n\r\n  return $ok({ encrypted: encrypted });\r\n}\r\n\r\nexport async function $decryptRefreshToken(\r\n  value: string | undefined,\r\n  params: BaseParams,\r\n): Promise<Result<{ decrypted: string; azureId: string }>> {\r\n  const { data: encryptedRefreshToken, error: encryptedRefreshTokenError } = zEncrypted.safeParse(value);\r\n  if (encryptedRefreshTokenError) return $err({ msg: 'Invalid format', desc: $stringErr(encryptedRefreshTokenError) });\r\n\r\n  const { result, newSecretKey, error } = await $decryptObj(params.cryptoType, encryptedRefreshToken, params.key);\r\n  if (error) return $err({ msg: 'Failed to decrypt refresh token', desc: `Decryption - ${$stringErr(error)}` });\r\n\r\n  const { data: rtStruct, error: rtStructError } = zRtStruct.safeParse(result);\r\n  if (rtStructError) return $err({ msg: 'Invalid format', desc: $stringErr(rtStructError) });\r\n\r\n  if (rtStruct.exp < Date.now()) {\r\n    return $err({ msg: 'Invalid Params', desc: `Refresh token expired at ${new Date(rtStruct.exp).toISOString()}` });\r\n  }\r\n\r\n  params.$updateSecretKey('refreshToken', newSecretKey);\r\n\r\n  return $ok({ decrypted: rtStruct.rt, azureId: rtStruct.aid });\r\n}\r\n\r\nexport async function $encryptState(value: object | null, params: BaseParams): Promise<Result<{ encrypted: string }>> {\r\n  const { data, error: parseError } = zState.safeParse(value);\r\n  if (parseError) return $err({ msg: 'Invalid format', desc: $stringErr(parseError) });\r\n\r\n  const { encrypted, newSecretKey, error } = await $encryptObj(params.cryptoType, data, params.key);\r\n  if (error) return $err({ msg: 'Failed to encrypt state', desc: `Encryption - ${$stringErr(error)}` });\r\n\r\n  params.$updateSecretKey('state', newSecretKey);\r\n\r\n  return $ok({ encrypted: encrypted });\r\n}\r\n\r\nexport async function $decryptState(\r\n  value: string | undefined,\r\n  params: BaseParams,\r\n): Promise<Result<{ decrypted: z.infer<typeof zState> }>> {\r\n  const { data: encryptedState, error: encryptedStateError } = zEncrypted.safeParse(value);\r\n  if (encryptedStateError) return $err({ msg: 'Invalid format', desc: $stringErr(encryptedStateError) });\r\n\r\n  const { result, newSecretKey, error } = await $decryptObj(params.cryptoType, encryptedState, params.key);\r\n  if (error) return $err({ msg: 'Failed to decrypt state', desc: $stringErr(error) });\r\n\r\n  params.$updateSecretKey('state', newSecretKey);\r\n\r\n  const { data: state, error: stateError } = zState.safeParse(result);\r\n  if (stateError) return $err({ msg: 'Invalid format', desc: $stringErr(stateError) });\r\n\r\n  return $ok({ decrypted: state });\r\n}\r\n\r\nexport async function $encryptTicket(\r\n  ticketId: string | null,\r\n  params: BaseParams,\r\n): Promise<Result<{ encrypted: string }>> {\r\n  const { data, error: parseError } = zUuid.safeParse(ticketId);\r\n  if (parseError) return $err({ msg: 'Invalid format', desc: $stringErr(parseError) });\r\n\r\n  const { encrypted, newSecretKey, error } = await $encrypt(params.cryptoType, data, params.key);\r\n  if (error) return $err({ msg: 'Failed to encrypt ticket', desc: `Encryption - ${$stringErr(error)}` });\r\n\r\n  params.$updateSecretKey('ticket', newSecretKey);\r\n  return $ok({ encrypted: encrypted });\r\n}\r\n\r\nexport async function $decryptTicket(\r\n  value: string | undefined,\r\n  params: BaseParams,\r\n): Promise<Result<{ decrypted: string }>> {\r\n  const { data, error: encryptedStateError } = zEncrypted.safeParse(value);\r\n  if (encryptedStateError) return $err({ msg: 'Invalid format', desc: $stringErr(encryptedStateError) });\r\n\r\n  const { result, newSecretKey, error } = await $decrypt(params.cryptoType, data, params.key);\r\n  if (error) return $err({ msg: 'Failed to decrypt ticket', desc: `Decryption - ${$stringErr(error)}` });\r\n\r\n  params.$updateSecretKey('ticket', newSecretKey);\r\n\r\n  const { data: ticketId, error: stateError } = zUuid.safeParse(result);\r\n  if (stateError) return $err({ msg: 'Invalid format', desc: $stringErr(stateError) });\r\n\r\n  return $ok({ decrypted: ticketId });\r\n}\r\n","import type { LoginPrompt } from '~/types';\r\n\r\n/** Time skew in seconds to account for clock drift between client and server */\r\nexport const TIME_SKEW = 5 * 60;\r\n\r\nexport function $transformToMsalPrompt(\r\n  prompt: LoginPrompt,\r\n  email: string | undefined,\r\n): 'login' | 'select_account' | undefined {\r\n  if (email || prompt === 'email') return 'login';\r\n  if (prompt === 'select-account') return 'select_account';\r\n  return undefined;\r\n}\r\n\r\nexport async function $mapAndFilter<T, R>(items: T[], callback: (item: T) => Promise<R | null>): Promise<R[]> {\r\n  return (\r\n    await Promise.all(\r\n      items.map(async (item) => {\r\n        try {\r\n          return await callback(item);\r\n        } catch {\r\n          return null;\r\n        }\r\n      }),\r\n    )\r\n  ).filter((result): result is Awaited<R> => !!result);\r\n}\r\n","import type { CryptoProvider } from '@azure/msal-node';\r\nimport type { WebApiKey } from 'cipher-kit/web-api';\r\nimport type { JwksClient } from 'jwks-rsa';\r\nimport type { z } from 'zod';\r\nimport { $err, $ok, $stringErr, OAuthError, type Result } from './error';\r\nimport type {\r\n  Azure,\r\n  B2BApp,\r\n  B2BResult,\r\n  BaseCookieOptions,\r\n  Cookies,\r\n  CryptoType,\r\n  EncryptionKeys,\r\n  JwtPayload,\r\n  LoginPrompt,\r\n  Metadata,\r\n  MsalResponse,\r\n  NonEmptyArray,\r\n  OAuthConfig,\r\n  OAuthSettings,\r\n  OboResult,\r\n} from './types';\r\nimport { $oauthConfig } from './utils/config';\r\nimport { $getCookieNames, $getCookieOptions } from './utils/cookie-options';\r\nimport { $generateUuid } from './utils/encrypt';\r\nimport {\r\n  $decryptAccessToken,\r\n  $decryptRefreshToken,\r\n  $decryptState,\r\n  $decryptTicket,\r\n  $encryptAccessToken,\r\n  $encryptRefreshToken,\r\n  $encryptState,\r\n  $encryptTicket,\r\n} from './utils/encrypt-tokens';\r\nimport { $mapAndFilter, $transformToMsalPrompt, TIME_SKEW } from './utils/helpers';\r\nimport { $getExpiry, $verifyJwt } from './utils/jwt';\r\nimport { zInjectedData, zMethods, type zState } from './utils/zod';\r\n\r\n/**\r\n * Core OAuth2/PKCE provider for Microsoft Entra ID (Azure AD).\r\n *\r\n * Responsibilities:\r\n *  - PKCE authorization URL generation\r\n *  - Authorization‐code and refresh‐token exchanges\r\n *  - Secure encryption/decryption of state & cookies\r\n *  - JWT validation via JWKS\r\n *  - B2B client‐credentials flow\r\n *  - On‐Behalf-Of (OBO) flow for downstream services\r\n *\r\n * Designed to be framework-agnostic (Express, NestJS, etc.)\r\n */\r\nexport class OAuthProvider {\r\n  private readonly azures: NonEmptyArray<Azure>;\r\n  private readonly frontendUrls: NonEmptyArray<string>;\r\n  private readonly frontendWhitelist: Set<string>;\r\n  private readonly serverCallbackUrl: string;\r\n  private readonly baseCookieOptions: BaseCookieOptions;\r\n  private readonly encryptionKeys: EncryptionKeys;\r\n  private readonly msalCryptoProvider: CryptoProvider;\r\n  private readonly jwksClient: JwksClient;\r\n  readonly settings: OAuthSettings;\r\n\r\n  /**\r\n   * @param configuration The OAuth configuration object:\r\n   * - `azure`: clientId, tenantId, scopes, clientSecret, B2B apps, and downstream services. Can be an array of Azure configurations.\r\n   * - `frontendUrl`: allowed redirect URIs\r\n   * - `serverCallbackUrl`: your server’s Azure callback endpoint\r\n   * - `encryptionKey`: 32 characters base encryption secret\r\n   * - `advanced`: optional behaviors\r\n   * @throws {OAuthError} if the config fails validation or has duplicate service names\r\n   */\r\n  constructor(configuration: OAuthConfig) {\r\n    const result = $oauthConfig(configuration);\r\n    if (result.error) throw new OAuthError(result.error);\r\n\r\n    this.azures = result.azures;\r\n    this.frontendUrls = result.frontendUrls;\r\n    this.frontendWhitelist = result.frontendWhitelist;\r\n    this.serverCallbackUrl = result.serverCallbackUrl;\r\n    this.baseCookieOptions = result.baseCookieOptions;\r\n    this.encryptionKeys = result.encryptionKeys;\r\n    this.msalCryptoProvider = result.msalCryptoProvider;\r\n    this.jwksClient = result.jwksClient;\r\n    this.settings = result.settings;\r\n  }\r\n\r\n  /**\r\n   * Generate an OAuth2 authorization URL for user login (PKCE-backed).\r\n   *\r\n   * @param params (optional) - Parameters to customize the auth URL:\r\n   * - `loginPrompt` (optional) - Override the default prompt (`sso`|`email`|`select-account`)\r\n   * - `email` (optional) - Email address to pre-fill the login form\r\n   * - `frontendUrl` (optional) - Frontend URL override to redirect the user after authentication\r\n   * - `azureId` (optional) - Azure configuration ID to use, relevant if multiple Azure configurations (Defaults to the first one)\r\n   * @returns A result containing the authorization URL and a ticket (which is used for bearer flow only)\r\n   * @throws {OAuthError} if something goes wrong.\r\n   */\r\n  async getAuthUrl(params?: {\r\n    loginPrompt?: LoginPrompt;\r\n    email?: string;\r\n    frontendUrl?: string;\r\n    azureId?: string;\r\n  }): Promise<{\r\n    authUrl: string;\r\n    ticket: string;\r\n  }> {\r\n    const { data: parsedParams, error: paramsError } = zMethods.getAuthUrl.safeParse(params);\r\n    if (paramsError) throw new OAuthError({ msg: 'Invalid Params', desc: $stringErr(paramsError) });\r\n\r\n    const { azure, error: azureError } = this.$getAzure({\r\n      azureId: parsedParams.azureId,\r\n      fallbackToDefault: true,\r\n      status: 400,\r\n    });\r\n    if (azureError) throw new OAuthError(azureError);\r\n\r\n    if (parsedParams.loginPrompt === 'email' && !parsedParams.email) {\r\n      throw new OAuthError({ msg: 'Invalid params', desc: 'Email is required when loginPrompt is set to \"email\"' });\r\n    }\r\n\r\n    if (parsedParams.frontendUrl && !this.frontendWhitelist.has(new URL(parsedParams.frontendUrl).host)) {\r\n      throw new OAuthError({ msg: 'Forbidden', desc: 'Unlisted host frontend URL', status: 403 });\r\n    }\r\n\r\n    const { uuid: ticketId, error: uuidError } = $generateUuid(this.settings.cryptoType);\r\n    if (uuidError) throw new OAuthError(uuidError);\r\n\r\n    try {\r\n      const [pkce, { encrypted, error: ticketError }] = await Promise.all([\r\n        this.msalCryptoProvider.generatePkceCodes(),\r\n        this.$encryptToken('ticket', ticketId),\r\n      ]);\r\n      if (ticketError) throw new OAuthError(ticketError);\r\n\r\n      const prompt = $transformToMsalPrompt(parsedParams.loginPrompt ?? this.settings.loginPrompt, parsedParams.email);\r\n      const params = { nonce: this.msalCryptoProvider.createNewGuid(), loginHint: parsedParams.email, prompt };\r\n\r\n      const { encrypted: encryptedState, error: encryptError } = await this.$encryptToken('state', {\r\n        azureId: azure.clientId,\r\n        frontendUrl: parsedParams.frontendUrl ?? this.frontendUrls[0],\r\n        codeVerifier: pkce.verifier,\r\n        ticketId: ticketId,\r\n        ...params,\r\n      } satisfies z.infer<typeof zState>);\r\n      if (encryptError) throw new OAuthError(encryptError);\r\n\r\n      const authUrl = await azure.cca.getAuthCodeUrl({\r\n        ...params,\r\n        state: encryptedState,\r\n        scopes: azure.scopes,\r\n        redirectUri: this.serverCallbackUrl,\r\n        responseMode: 'form_post',\r\n        codeChallengeMethod: 'S256',\r\n        codeChallenge: pkce.challenge,\r\n      });\r\n\r\n      if (new URL(authUrl).hostname !== 'login.microsoftonline.com') {\r\n        throw new OAuthError({\r\n          msg: 'Invalid auth URL',\r\n          desc: 'The generated auth URL does not point to Microsoft Entra ID',\r\n          status: 500,\r\n        });\r\n      }\r\n      return { authUrl, ticket: encrypted };\r\n    } catch (error) {\r\n      if (error instanceof OAuthError) throw error;\r\n      throw new OAuthError({ msg: 'Failed to generate auth URL', desc: `Auth URL Generation - ${$stringErr(error)}` });\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Exchange an authorization code for encrypted tokens and metadata.\r\n   *\r\n   * @param params - The parameters containing the authorization code and state.\r\n   * - `code` - The authorization code received from the OAuth flow.\r\n   * - `state` -  The state parameter received from Microsoft.\r\n   * @returns A result containing the access token, refresh token (if available), frontend URL, and MSAL response.\r\n   * @throws {OAuthError} if something goes wrong.\r\n   */\r\n  async getTokenByCode(params: { code: string; state: string }): Promise<{\r\n    accessToken: Cookies['AccessToken'];\r\n    refreshToken: Cookies['RefreshToken'] | null;\r\n    frontendUrl: string;\r\n    ticketId: string;\r\n    msalResponse: MsalResponse;\r\n  }> {\r\n    const { data: parsedParams, error: paramsError } = zMethods.getTokenByCode.safeParse(params);\r\n    if (paramsError) throw new OAuthError({ msg: 'Invalid Params', desc: $stringErr(paramsError) });\r\n\r\n    const { decrypted: state, error: decryptError } = await this.$decryptToken('state', parsedParams.state);\r\n    if (decryptError) throw new OAuthError(decryptError);\r\n\r\n    const { azure, error: azureError } = this.$getAzure({ azureId: state.azureId, status: 400 });\r\n    if (azureError) throw new OAuthError(azureError);\r\n\r\n    if (!this.frontendWhitelist.has(new URL(state.frontendUrl).host)) {\r\n      throw new OAuthError({ msg: 'Forbidden', desc: 'Unlisted host frontend URL', status: 403 });\r\n    }\r\n\r\n    try {\r\n      const msalResponse = await azure.cca.acquireTokenByCode({\r\n        code: parsedParams.code,\r\n        scopes: azure.scopes,\r\n        redirectUri: this.serverCallbackUrl,\r\n        ...state,\r\n      });\r\n\r\n      const { encryptedAccessToken, encryptedRefreshToken, error } = await this.$extractTokens(azure, msalResponse);\r\n      if (error) throw new OAuthError(error);\r\n\r\n      return {\r\n        accessToken: {\r\n          name: azure.cookiesNames.accessTokenName,\r\n          value: encryptedAccessToken,\r\n          options: this.baseCookieOptions.accessTokenOptions,\r\n        },\r\n        refreshToken: encryptedRefreshToken\r\n          ? {\r\n              name: azure.cookiesNames.refreshTokenName,\r\n              value: encryptedRefreshToken,\r\n              options: this.baseCookieOptions.refreshTokenOptions,\r\n            }\r\n          : null,\r\n        frontendUrl: state.frontendUrl,\r\n        ticketId: state.ticketId,\r\n        msalResponse,\r\n      };\r\n    } catch (err) {\r\n      if (err instanceof OAuthError) throw err;\r\n      throw new OAuthError({\r\n        msg: 'Failed to get token by code',\r\n        desc: `Token Exchange - ${$stringErr(err)} ,Make sure to check Azure credentials (client ID, tenant ID, client secret) and scopes.`,\r\n      });\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Build a logout URL and cookie-deletion instructions.\r\n   *\r\n   * @param params (optional) - Parameters to customize the logout URL:\r\n   * - `frontendUrl` (optional) - Frontend URL override to redirect the user after log out\r\n   * - `azureId` (optional) - Azure configuration ID to use, relevant if multiple Azure configurations (Defaults to the first one)\r\n   * @returns A result containing the logout URL and cookie deletion instructions.\r\n   * @throws {OAuthError} if something goes wrong.\r\n   */\r\n  async getLogoutUrl(params?: { frontendUrl?: string; azureId?: string }): Promise<{\r\n    logoutUrl: string;\r\n    deleteAccessToken: Cookies['DeleteAccessToken'];\r\n    deleteRefreshToken: Cookies['DeleteRefreshToken'];\r\n  }> {\r\n    const { data: parsedParams, error: paramsError } = zMethods.getLogoutUrl.safeParse(params);\r\n    if (paramsError) throw new OAuthError({ msg: 'Invalid Params', desc: $stringErr(paramsError) });\r\n\r\n    const { azure, error: azureError } = this.$getAzure({\r\n      azureId: parsedParams.azureId,\r\n      fallbackToDefault: true,\r\n      status: 400,\r\n    });\r\n    if (azureError) throw new OAuthError(azureError);\r\n\r\n    if (parsedParams.frontendUrl && !this.frontendWhitelist.has(new URL(parsedParams.frontendUrl).host)) {\r\n      throw new OAuthError({ msg: 'Forbidden', desc: 'Unlisted host frontend URL', status: 403 });\r\n    }\r\n\r\n    const logoutUrl = new URL(`https://login.microsoftonline.com/${azure.tenantId}/oauth2/v2.0/logout`);\r\n    logoutUrl.searchParams.set('post_logout_redirect_uri', parsedParams.frontendUrl ?? this.frontendUrls[0]);\r\n\r\n    return {\r\n      logoutUrl: logoutUrl.toString(),\r\n      deleteAccessToken: {\r\n        name: azure.cookiesNames.accessTokenName,\r\n        value: '',\r\n        options: this.baseCookieOptions.deleteTokenOptions,\r\n      },\r\n      deleteRefreshToken: {\r\n        name: azure.cookiesNames.refreshTokenName,\r\n        value: '',\r\n        options: this.baseCookieOptions.deleteTokenOptions,\r\n      },\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Verify the access token (either encrypted or in JWT format) and extract its payload.\r\n   * Make sure that user access tokens are encrypted and app tokens aren't\r\n   *\r\n   * @param accessToken - The access token string either encrypted or in JWT format\r\n   * @returns A result containing the raw access token, its payload, any injected data, and whether it is an app token.\r\n   * @template T - Type of any injected data in the encrypted token\r\n   */\r\n  async verifyAccessToken<T extends object = Record<string, any>>(\r\n    accessToken: string | undefined,\r\n  ): Promise<\r\n    Result<{\r\n      payload: JwtPayload;\r\n      meta: Metadata;\r\n      rawJwt: string;\r\n      injectedData: T | undefined;\r\n      hasInjectedData: boolean;\r\n    }>\r\n  > {\r\n    const { decrypted, azureId, injectedData, wasEncrypted, error } = await this.$decryptToken<T>(\r\n      'accessToken',\r\n      accessToken,\r\n    );\r\n    if (error) return $err({ msg: 'Unauthorized', desc: `Token Decryption - ${$stringErr(error)}`, status: 401 });\r\n\r\n    const { azure, error: azureError } = this.$getAzure({ azureId });\r\n    if (azureError) return $err(azureError);\r\n\r\n    const at = await $verifyJwt({ jwtToken: decrypted, azure: azure, jwksClient: this.jwksClient });\r\n    if (at.error) return $err(at.error);\r\n\r\n    if (this.settings.acceptB2BRequests === false && at.meta.isApp === true) {\r\n      return $err({\r\n        msg: 'B2B requests not allowed',\r\n        desc: 'B2B requests are not allowed, please enable them in the configuration',\r\n        status: 403,\r\n      });\r\n    }\r\n\r\n    if (at.meta.isApp === wasEncrypted) {\r\n      return $err({\r\n        msg: 'Unauthorized',\r\n        desc: 'User tokens must be encrypted, app tokens must not be encrypted',\r\n        status: 401,\r\n      });\r\n    }\r\n\r\n    return $ok({\r\n      rawJwt: decrypted,\r\n      payload: at.payload,\r\n      meta: at.meta,\r\n      injectedData: injectedData,\r\n      hasInjectedData: !!injectedData,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Verifies and uses the refresh token to get new set of access and refresh tokens.\r\n   *\r\n   * @param refreshToken - Encrypted refresh-token value\r\n   * @returns A result containing the new access token, optional new refresh token, the raw access token, its payload, and the MSAL response.\r\n   */\r\n  async tryRefreshTokens(refreshToken: string | undefined): Promise<\r\n    Result<{\r\n      newAccessToken: Cookies['AccessToken'];\r\n      newRefreshToken: Cookies['RefreshToken'] | null;\r\n      payload: JwtPayload;\r\n      meta: Metadata;\r\n      rawJwt: string;\r\n      msalResponse: MsalResponse;\r\n    }>\r\n  > {\r\n    if (!refreshToken) {\r\n      return $err({ msg: 'Unauthorized', desc: 'Refresh token is required', status: 401 });\r\n    }\r\n\r\n    const {\r\n      decrypted: rawRefreshToken,\r\n      azureId,\r\n      error: decryptError,\r\n    } = await this.$decryptToken('refreshToken', refreshToken);\r\n    if (decryptError) {\r\n      return $err({ msg: 'Unauthorized', desc: `Refresh Token Decryption - ${$stringErr(decryptError)}`, status: 401 });\r\n    }\r\n\r\n    const { azure, error: azureError } = this.$getAzure({ azureId });\r\n    if (azureError) return $err(azureError);\r\n\r\n    try {\r\n      const msalResponse = await azure.cca.acquireTokenByRefreshToken({\r\n        refreshToken: rawRefreshToken,\r\n        scopes: azure.scopes,\r\n        forceCache: true,\r\n      });\r\n      if (!msalResponse) {\r\n        return $err({ msg: 'Unauthorized', desc: 'Failed to refresh token, no msal response', status: 401 });\r\n      }\r\n\r\n      const at = await $verifyJwt({\r\n        jwtToken: msalResponse.accessToken,\r\n        jwksClient: this.jwksClient,\r\n        azure: azure,\r\n      });\r\n      if (at.error) {\r\n        return $err({ msg: 'Unauthorized', desc: `Access Token Verification - ${$stringErr(at.error)}`, status: 401 });\r\n      }\r\n\r\n      const { encryptedAccessToken, encryptedRefreshToken, error } = await this.$extractTokens(azure, msalResponse);\r\n      if (error) return $err({ msg: 'Unauthorized', desc: `Extract Tokens - ${$stringErr(error)}`, status: 401 });\r\n\r\n      return $ok({\r\n        rawJwt: msalResponse.accessToken,\r\n        payload: at.payload,\r\n        meta: at.meta,\r\n        newAccessToken: {\r\n          name: azure.cookiesNames.accessTokenName,\r\n          value: encryptedAccessToken,\r\n          options: this.baseCookieOptions.accessTokenOptions,\r\n        },\r\n        newRefreshToken: encryptedRefreshToken\r\n          ? {\r\n              name: azure.cookiesNames.refreshTokenName,\r\n              value: encryptedRefreshToken,\r\n              options: this.baseCookieOptions.refreshTokenOptions,\r\n            }\r\n          : null,\r\n        msalResponse: msalResponse,\r\n      });\r\n    } catch (err) {\r\n      if (err instanceof OAuthError) return $err(err);\r\n      return $err({ msg: 'Unauthorized', desc: `Token Refresh - ${$stringErr(err)}`, status: 401 });\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Inject non-sensitive metadata into the access token.\r\n   *\r\n   * @param params - The parameters containing the access token and data to inject.\r\n   * - `accessToken` - The encrypted access token to inject data into.\r\n   * - `data` - The data to inject into the access token.\r\n   * @returns A result containing the new encrypted access token with injected data and the injected data.\r\n   * @template T - Type of the data to inject into the access token.\r\n   */\r\n  async tryInjectData<T extends object = Record<string, any>>(params: {\r\n    accessToken: string;\r\n    data: T;\r\n  }): Promise<Result<{ newAccessToken: Cookies['AccessToken']; injectedData: T }>> {\r\n    const { decrypted: rawAccessToken, azureId, error } = await this.$decryptToken('accessToken', params.accessToken);\r\n    if (error) return $err(error);\r\n\r\n    const { azure, error: azureError } = this.$getAzure({ azureId });\r\n    if (azureError) return $err(azureError);\r\n\r\n    const { data: dataToInject, error: dataToInjectError } = zInjectedData.safeParse(params.data);\r\n    if (dataToInjectError) return $err({ msg: 'Invalid Params', desc: $stringErr(dataToInjectError) });\r\n\r\n    const { encrypted, error: encryptError } = await this.$encryptToken('accessToken', rawAccessToken, {\r\n      azureId,\r\n      expiry: this.settings.cookies.accessTokenExpiry,\r\n      dataToInject: dataToInject,\r\n    });\r\n    if (encryptError) return $err(encryptError);\r\n\r\n    return $ok({\r\n      newAccessToken: {\r\n        name: azure.cookiesNames.accessTokenName,\r\n        value: encrypted,\r\n        options: this.baseCookieOptions.accessTokenOptions,\r\n      },\r\n      injectedData: dataToInject as T,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Decrypts a ticket and returns the ticket ID.\r\n   * Useful for bearer flow.\r\n   *\r\n   * @param ticket - The encrypted ticket string to decrypt (generated by getAuthUrl).\r\n   * @returns A result containing the ticket ID (returned by getTokenByCode).\r\n   */\r\n  async tryDecryptTicket(ticket: string): Promise<Result<{ ticketId: string }>> {\r\n    const { decrypted, error } = await this.$decryptToken('ticket', ticket);\r\n    if (error) return $err(error);\r\n    return $ok({ ticketId: decrypted });\r\n  }\r\n\r\n  /**\r\n   * Acquire client-credential tokens for one or multiple B2B apps.\r\n   * Caches tokens for better performance.\r\n   *\r\n   * @overload\r\n   * @param params.appName - The name of the B2B app to get the token for.\r\n   * @param params.azureId (optional) - Azure configuration ID to use, relevant if multiple Azure configurations (Defaults to the first one)\r\n   * @returns A result containing the B2B app token and metadata.\r\n   *\r\n   * @overload\r\n   * @param params.appsNames - An array of B2B app names to get tokens for.\r\n   * @param params.azureId (optional) - Azure configuration ID to use, relevant if multiple Azure configurations (Defaults to the first one)\r\n   * @returns Results containing an array of B2B app tokens and metadata.\r\n   */\r\n  async tryGetB2BToken(params: { app: string; azureId?: string }): Promise<Result<{ result: B2BResult }>>;\r\n  async tryGetB2BToken(params: {\r\n    apps: string[];\r\n    azureId?: string;\r\n  }): Promise<Result<{ results: NonEmptyArray<B2BResult> }>>;\r\n  async tryGetB2BToken(\r\n    params: { azureId?: string } & ({ app: string } | { apps: string[] }),\r\n  ): Promise<Result<{ result: B2BResult } | { results: NonEmptyArray<B2BResult> }>> {\r\n    const { data: parsedParams, error: paramsError } = zMethods.tryGetB2BToken.safeParse(params);\r\n    if (paramsError) return $err({ msg: 'Invalid Params', desc: $stringErr(paramsError) });\r\n\r\n    const { azure, error: azureError } = this.$getAzure({\r\n      azureId: parsedParams.azureId,\r\n      fallbackToDefault: true,\r\n      status: 400,\r\n    });\r\n    if (azureError) throw new OAuthError(azureError);\r\n    if (!azure.b2b) return $err({ msg: 'Misconfiguration', desc: 'B2B apps not configured', status: 500 });\r\n\r\n    const apps = parsedParams.apps.map((app) => azure.b2b?.get(app)).filter((app) => !!app);\r\n    if (!apps || apps.length === 0) {\r\n      return $err({ msg: 'Invalid Params', desc: 'B2B app not found', status: 400 });\r\n    }\r\n\r\n    try {\r\n      const results = (await $mapAndFilter(apps, async (app) => {\r\n        if (app.token && app.exp > Date.now() / 1000) {\r\n          return {\r\n            clientId: azure.clientId,\r\n            appName: app.appName,\r\n            appId: app.aud,\r\n            token: app.token,\r\n            msalResponse: app.msalResponse,\r\n            isCached: true,\r\n            expiresAt: app.exp,\r\n          } satisfies B2BResult;\r\n        }\r\n\r\n        const msalResponse = await azure.cca.acquireTokenByClientCredential({ scopes: [app.scope], skipCache: true });\r\n        if (!msalResponse) return null;\r\n\r\n        const { clientId, exp, error: audError } = $getExpiry(msalResponse.accessToken);\r\n        if (audError) return null;\r\n\r\n        azure.b2b?.set(app.appName, {\r\n          appName: app.appName,\r\n          scope: app.scope,\r\n          token: msalResponse.accessToken,\r\n          exp: exp - TIME_SKEW,\r\n          aud: clientId,\r\n          msalResponse: msalResponse,\r\n        } satisfies B2BApp);\r\n\r\n        return {\r\n          clientId: azure.clientId,\r\n          appName: app.appName,\r\n          appId: clientId,\r\n          token: msalResponse.accessToken,\r\n          msalResponse: msalResponse,\r\n          isCached: false,\r\n          expiresAt: 0,\r\n        } satisfies B2BResult;\r\n      })) as NonEmptyArray<B2BResult>;\r\n\r\n      if (!results || results.length === 0) {\r\n        return $err({ msg: 'Internal Server Error', desc: 'Failed to get B2B token', status: 500 });\r\n      }\r\n\r\n      return $ok('app' in params ? { result: results[0] } : { results });\r\n    } catch (err) {\r\n      if (err instanceof OAuthError) return $err(err);\r\n      return $err({ msg: 'Internal Server Error', desc: $stringErr(err), status: 500 });\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Acquire On-Behalf-Of tokens for downstream services.\r\n   *\r\n   * @overload\r\n   * @param params.accessToken - The encrypted access token to use for OBO.\r\n   * @param params.serviceName - The name of the service to get the token for.\r\n   * @param params.azureId (optional) - Azure configuration ID to use, relevant if multiple Azure configurations (Defaults to the first one)\r\n   * @returns A result containing the OBO token and metadata for the specified service.\r\n   * @throws {OAuthError} if something goes wrong.\r\n   *\r\n   * @overload\r\n   * @param params.accessToken - The encrypted access token to use for OBO.\r\n   * @param params.serviceNames - An array of service names to get tokens for.\r\n   * @param params.azureId (optional) - Azure configuration ID to use, relevant if multiple Azure configurations (Defaults to the first one)\r\n   * @returns Results containing an array of OBO tokens and metadata for the specified services.\r\n   * @throws {OAuthError} if something goes wrong.\r\n   */\r\n  async getTokenOnBehalfOf(params: { accessToken: string; service: string; azureId?: string }): Promise<{\r\n    result: OboResult;\r\n  }>;\r\n  async getTokenOnBehalfOf(params: { accessToken: string; services: string[]; azureId?: string }): Promise<{\r\n    results: NonEmptyArray<OboResult>;\r\n  }>;\r\n  async getTokenOnBehalfOf(\r\n    params: ({ service: string } | { services: string[] }) & {\r\n      accessToken: string;\r\n      azureId?: string;\r\n    },\r\n  ): Promise<{ result: OboResult } | { results: NonEmptyArray<OboResult> }> {\r\n    const { data: parsedParams, error: paramsError } = zMethods.getTokenOnBehalfOf.safeParse(params);\r\n    if (paramsError) throw new OAuthError({ msg: 'Invalid Params', desc: $stringErr(paramsError) });\r\n\r\n    const { azure, error: azureError } = this.$getAzure({\r\n      azureId: parsedParams.azureId,\r\n      fallbackToDefault: true,\r\n      status: 400,\r\n    });\r\n\r\n    if (azureError) throw new OAuthError(azureError);\r\n    if (!azure.obo) throw new OAuthError({ msg: 'Misconfiguration', desc: 'OBO services not configured', status: 500 });\r\n\r\n    const services = parsedParams.services.map((service) => azure.obo?.get(service)).filter((service) => !!service);\r\n\r\n    if (!services || services.length === 0) {\r\n      throw new OAuthError({ msg: 'Invalid Params', desc: 'OBO service not found', status: 400 });\r\n    }\r\n\r\n    const { decrypted: rawAccessToken, error } = await this.$decryptToken('accessToken', parsedParams.accessToken);\r\n    if (error) throw new OAuthError(error);\r\n\r\n    try {\r\n      const results = (await $mapAndFilter(services, async (service) => {\r\n        const msalResponse = await azure.cca.acquireTokenOnBehalfOf({\r\n          oboAssertion: rawAccessToken,\r\n          scopes: [service.scope],\r\n          skipCache: true,\r\n        });\r\n\r\n        if (!msalResponse) return null;\r\n\r\n        const { clientId, error: audError } = $getExpiry(msalResponse.accessToken);\r\n\r\n        if (audError) return null;\r\n\r\n        const { encrypted, error } = await this.$encryptToken('accessToken', msalResponse.accessToken, {\r\n          azureId: clientId,\r\n          expiry: service.atExp,\r\n          cryptoType: service.cryptoType,\r\n          otherSecretKey: `access-token-${service.encryptionKey}`,\r\n        });\r\n\r\n        if (error) return null;\r\n\r\n        const cookieOptions = $getCookieOptions({\r\n          secure: service.isSecure,\r\n          sameSite: service.isSamesite,\r\n          timeUnit: this.settings.cookies.timeUnit,\r\n          atExp: service.atExp,\r\n          rtExp: 0, // No refresh token\r\n        });\r\n\r\n        const { accessTokenName } = $getCookieNames(clientId, service.isSecure);\r\n\r\n        return {\r\n          clientId: azure.clientId,\r\n          serviceName: service.serviceName,\r\n          serviceId: clientId,\r\n          accessToken: { name: accessTokenName, value: encrypted, options: cookieOptions.accessTokenOptions },\r\n          msalResponse: msalResponse,\r\n        } satisfies OboResult;\r\n      })) as NonEmptyArray<OboResult>;\r\n\r\n      if (!results || results.length === 0) {\r\n        throw new OAuthError({ msg: 'Internal Server Error', desc: 'Failed to get OBO token', status: 500 });\r\n      }\r\n\r\n      return 'service' in params ? { result: results[0] } : { results };\r\n    } catch (error) {\r\n      if (error instanceof OAuthError) throw error;\r\n      throw new OAuthError({ msg: 'Internal Server Error', desc: $stringErr(error), status: 500 });\r\n    }\r\n  }\r\n\r\n  private $getAzure({\r\n    azureId,\r\n    fallbackToDefault = false,\r\n    status = 401,\r\n  }: {\r\n    azureId: string | undefined;\r\n    fallbackToDefault?: boolean;\r\n    status?: 401 | 400;\r\n  }): Result<{ azure: Azure }> {\r\n    const azure = azureId ? this.azures.find((azure) => azure.clientId === azureId) : undefined;\r\n    if (azure) return $ok({ azure });\r\n\r\n    if (fallbackToDefault) return $ok({ azure: this.azures[0] });\r\n\r\n    return $err({\r\n      msg: status === 401 ? 'Unauthorized' : 'Invalid Params',\r\n      desc: 'Azure configuration not found for the given client ID',\r\n      status,\r\n    });\r\n  }\r\n\r\n  /** Extracts and encrypts both tokens */\r\n  private async $extractTokens(\r\n    azure: Azure,\r\n    msalResponse: MsalResponse,\r\n  ): Promise<Result<{ encryptedAccessToken: string; encryptedRefreshToken: string | null }>> {\r\n    const [accessTokenRes, refreshTokenRes] = await Promise.all([\r\n      this.$encryptToken('accessToken', msalResponse.accessToken, {\r\n        azureId: azure.clientId,\r\n        expiry: this.settings.cookies.accessTokenExpiry,\r\n      }),\r\n      this.$obtainRefreshToken(azure, msalResponse),\r\n    ]);\r\n\r\n    if (accessTokenRes.error) return $err(accessTokenRes.error);\r\n    // ! If the refresh token has any error, we still return the access token\r\n\r\n    return $ok({\r\n      encryptedAccessToken: accessTokenRes.encrypted,\r\n      encryptedRefreshToken: refreshTokenRes.encrypted ?? null,\r\n    });\r\n  }\r\n\r\n  /** Extracts the refresh token from the cache that msal created, and removes the account from the cache. */\r\n  private async $obtainRefreshToken(azure: Azure, msalResponse: MsalResponse): Promise<Result<{ encrypted: string }>> {\r\n    try {\r\n      const cache = azure.cca.getTokenCache();\r\n      const serializedCache = JSON.parse(cache.serialize());\r\n      const refreshTokens = serializedCache?.RefreshToken ?? {};\r\n      const keys = typeof refreshTokens === 'object' ? Object.keys(refreshTokens) : [];\r\n      const refreshTokenKey = keys.find((key) => key.startsWith(msalResponse.uniqueId));\r\n      if (msalResponse.account) await cache.removeAccount(msalResponse.account);\r\n      const refreshToken = refreshTokenKey ? (refreshTokens[refreshTokenKey].secret as string) : undefined;\r\n      return await this.$encryptToken('refreshToken', refreshToken, {\r\n        azureId: azure.clientId,\r\n        expiry: this.settings.cookies.refreshTokenExpiry,\r\n      });\r\n    } catch {\r\n      return $err({\r\n        msg: 'Failed to obtain refresh token',\r\n        desc: 'Failed to obtain refresh token from MSAL cache',\r\n        status: 500,\r\n      });\r\n    }\r\n  }\r\n\r\n  /** Updates the secret key for a specific token type if it is a string. */\r\n  private $updateSecretKey(keyType: keyof typeof this.encryptionKeys, secretKey: WebApiKey | undefined) {\r\n    if (this.settings.cryptoType !== 'web-api' || !secretKey) return;\r\n    const currentKey = this.encryptionKeys[keyType];\r\n    if (typeof currentKey === 'string') {\r\n      this.encryptionKeys[keyType] = secretKey;\r\n    }\r\n  }\r\n\r\n  private async $encryptToken<T extends object = Record<string, any>>(\r\n    keyType: 'accessToken',\r\n    value: string | undefined,\r\n    params?: { expiry: number; azureId: string; dataToInject?: T; otherSecretKey?: string; cryptoType?: CryptoType },\r\n  ): Promise<Result<{ encrypted: string }>>;\r\n  private async $encryptToken(\r\n    keyType: 'refreshToken',\r\n    value: string | undefined,\r\n    params?: { expiry: number; azureId: string },\r\n  ): Promise<Result<{ encrypted: string }>>;\r\n  private async $encryptToken(keyType: 'ticket', value: string | undefined): Promise<Result<{ encrypted: string }>>;\r\n  private async $encryptToken(keyType: 'state', value: object | undefined): Promise<Result<{ encrypted: string }>>;\r\n  private async $encryptToken<T extends object = Record<string, any>>(\r\n    keyType: keyof typeof this.encryptionKeys,\r\n    value: string | object | undefined,\r\n    params?: { expiry?: number; azureId?: string; dataToInject?: T; otherSecretKey?: string; cryptoType?: CryptoType },\r\n  ): Promise<Result<{ encrypted: string }>> {\r\n    const baseParams = {\r\n      key: params?.otherSecretKey ?? this.encryptionKeys[keyType],\r\n      cryptoType: params?.cryptoType ?? this.settings.cryptoType,\r\n      $updateSecretKey: this.$updateSecretKey.bind(this),\r\n    };\r\n    switch (keyType) {\r\n      case 'accessToken':\r\n        return $encryptAccessToken<T>(value as string | null, {\r\n          ...baseParams,\r\n          expiry: params?.expiry as number,\r\n          azureId: params?.azureId as string,\r\n          isOtherKey: !!params?.otherSecretKey,\r\n          dataToInject: params?.dataToInject,\r\n          disableCompression: this.settings.disableCompression,\r\n        });\r\n      case 'refreshToken':\r\n        return $encryptRefreshToken(value as string | null, {\r\n          ...baseParams,\r\n          expiry: params?.expiry as number,\r\n          azureId: params?.azureId as string,\r\n        });\r\n      case 'state':\r\n        return $encryptState(value as object | null, baseParams);\r\n      case 'ticket':\r\n        return $encryptTicket(value as string | null, baseParams);\r\n      default:\r\n        return $err({\r\n          msg: 'Invalid encryption key type',\r\n          desc: `Key type '${keyType}' is not supported for encryption`,\r\n        });\r\n    }\r\n  }\r\n\r\n  private async $decryptToken<T extends object = Record<string, any>>(\r\n    keyType: 'accessToken',\r\n    value: string | undefined,\r\n  ): Promise<Result<{ decrypted: string; azureId: string; injectedData?: T; wasEncrypted: boolean }>>;\r\n  private async $decryptToken(\r\n    keyType: 'refreshToken',\r\n    value: string | undefined,\r\n  ): Promise<Result<{ decrypted: string; azureId: string }>>;\r\n  private async $decryptToken(\r\n    keyType: 'state',\r\n    value: string | undefined,\r\n  ): Promise<Result<{ decrypted: z.infer<typeof zState> }>>;\r\n  private async $decryptToken(keyType: 'ticket', value: string | undefined): Promise<Result<{ decrypted: string }>>;\r\n  private async $decryptToken<T extends object = Record<string, any>>(\r\n    keyType: keyof typeof this.encryptionKeys,\r\n    value: string | undefined,\r\n  ): Promise<\r\n    Result<{ decrypted: string | z.infer<typeof zState>; injectedData?: T; wasEncrypted?: boolean; azureId?: string }>\r\n  > {\r\n    const baseParams = {\r\n      key: this.encryptionKeys[keyType],\r\n      cryptoType: this.settings.cryptoType,\r\n      $updateSecretKey: this.$updateSecretKey.bind(this),\r\n    };\r\n    switch (keyType) {\r\n      case 'accessToken':\r\n        return $decryptAccessToken(value, baseParams);\r\n      case 'refreshToken':\r\n        return $decryptRefreshToken(value, baseParams);\r\n      case 'state':\r\n        return $decryptState(value, baseParams);\r\n      case 'ticket':\r\n        return $decryptTicket(value, baseParams);\r\n      default:\r\n        return $err({\r\n          msg: 'Invalid encryption key type',\r\n          desc: `Key type '${keyType}' is not supported for encryption`,\r\n        });\r\n    }\r\n  }\r\n}\r\n"]}