{"version":3,"file":"auth-UMQCo-ad.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import * as z from 'zod/v4';\n\n/**\n * Reusable URL validation that disallows `javascript:` scheme\n */\nexport const SafeUrlSchema = z\n    .url()\n    .superRefine((val, ctx) => {\n        if (!URL.canParse(val)) {\n            ctx.addIssue({\n                code: z.ZodIssueCode.custom,\n                message: 'URL must be parseable',\n                fatal: true\n            });\n\n            return z.NEVER;\n        }\n    })\n    .refine(\n        url => {\n            const u = new URL(url);\n            return u.protocol !== 'javascript:' && u.protocol !== 'data:' && u.protocol !== 'vbscript:';\n        },\n        { message: 'URL cannot use javascript:, data:, or vbscript: scheme' }\n    );\n\n/**\n * RFC 9728 OAuth Protected Resource Metadata\n */\nexport const OAuthProtectedResourceMetadataSchema = z.looseObject({\n    resource: z.string().url(),\n    authorization_servers: z.array(SafeUrlSchema).optional(),\n    jwks_uri: z.string().url().optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    bearer_methods_supported: z.array(z.string()).optional(),\n    resource_signing_alg_values_supported: z.array(z.string()).optional(),\n    resource_name: z.string().optional(),\n    resource_documentation: z.string().optional(),\n    resource_policy_uri: z.string().url().optional(),\n    resource_tos_uri: z.string().url().optional(),\n    tls_client_certificate_bound_access_tokens: z.boolean().optional(),\n    authorization_details_types_supported: z.array(z.string()).optional(),\n    dpop_signing_alg_values_supported: z.array(z.string()).optional(),\n    dpop_bound_access_tokens_required: z.boolean().optional()\n});\n\n/**\n * RFC 8414 OAuth 2.0 Authorization Server Metadata\n */\nexport const OAuthMetadataSchema = z.looseObject({\n    issuer: z.string(),\n    authorization_endpoint: SafeUrlSchema,\n    token_endpoint: SafeUrlSchema,\n    registration_endpoint: SafeUrlSchema.optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    response_types_supported: z.array(z.string()),\n    response_modes_supported: z.array(z.string()).optional(),\n    grant_types_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    service_documentation: SafeUrlSchema.optional(),\n    revocation_endpoint: SafeUrlSchema.optional(),\n    revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    revocation_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    introspection_endpoint: z.string().optional(),\n    introspection_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    introspection_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    code_challenge_methods_supported: z.array(z.string()).optional(),\n    client_id_metadata_document_supported: z.boolean().optional(),\n    // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n    authorization_response_iss_parameter_supported: z.boolean().optional().catch(undefined),\n    /**\n     * RFC 9449 §5.1 (DPoP, SEP-1932): the JWS `alg` values this authorization server accepts for\n     * DPoP proofs at the token endpoint. A server supporting DPoP MUST publish this field.\n     */\n    dpop_signing_alg_values_supported: z.array(z.string()).optional()\n});\n\n/**\n * OpenID Connect Discovery 1.0 Provider Metadata\n *\n * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata\n */\nexport const OpenIdProviderMetadataSchema = z.looseObject({\n    issuer: z.string(),\n    authorization_endpoint: SafeUrlSchema,\n    token_endpoint: SafeUrlSchema,\n    userinfo_endpoint: SafeUrlSchema.optional(),\n    jwks_uri: SafeUrlSchema,\n    registration_endpoint: SafeUrlSchema.optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    response_types_supported: z.array(z.string()),\n    response_modes_supported: z.array(z.string()).optional(),\n    grant_types_supported: z.array(z.string()).optional(),\n    acr_values_supported: z.array(z.string()).optional(),\n    subject_types_supported: z.array(z.string()),\n    id_token_signing_alg_values_supported: z.array(z.string()),\n    id_token_encryption_alg_values_supported: z.array(z.string()).optional(),\n    id_token_encryption_enc_values_supported: z.array(z.string()).optional(),\n    userinfo_signing_alg_values_supported: z.array(z.string()).optional(),\n    userinfo_encryption_alg_values_supported: z.array(z.string()).optional(),\n    userinfo_encryption_enc_values_supported: z.array(z.string()).optional(),\n    request_object_signing_alg_values_supported: z.array(z.string()).optional(),\n    request_object_encryption_alg_values_supported: z.array(z.string()).optional(),\n    request_object_encryption_enc_values_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    display_values_supported: z.array(z.string()).optional(),\n    claim_types_supported: z.array(z.string()).optional(),\n    claims_supported: z.array(z.string()).optional(),\n    service_documentation: z.string().optional(),\n    claims_locales_supported: z.array(z.string()).optional(),\n    ui_locales_supported: z.array(z.string()).optional(),\n    claims_parameter_supported: z.boolean().optional(),\n    request_parameter_supported: z.boolean().optional(),\n    request_uri_parameter_supported: z.boolean().optional(),\n    require_request_uri_registration: z.boolean().optional(),\n    op_policy_uri: SafeUrlSchema.optional(),\n    op_tos_uri: SafeUrlSchema.optional(),\n    client_id_metadata_document_supported: z.boolean().optional(),\n    // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n    authorization_response_iss_parameter_supported: z.boolean().optional().catch(undefined)\n});\n\n/**\n * OpenID Connect Discovery metadata that may include OAuth 2.0 fields\n * This schema represents the real-world scenario where OIDC providers\n * return a mix of OpenID Connect and OAuth 2.0 metadata fields\n */\nexport const OpenIdProviderDiscoveryMetadataSchema = z.object({\n    ...OpenIdProviderMetadataSchema.shape,\n    ...OAuthMetadataSchema.pick({\n        code_challenge_methods_supported: true\n    }).shape\n});\n\n/**\n * OAuth 2.1 token response\n */\nexport const OAuthTokensSchema = z\n    .object({\n        access_token: z.string(),\n        id_token: z.string().optional(), // Optional for OAuth 2.1, but necessary in OpenID Connect\n        token_type: z.string(),\n        expires_in: z.coerce.number().optional(),\n        scope: z.string().optional(),\n        refresh_token: z.string().optional(),\n        /**\n         * Not part of the wire format: the authorization server this value was obtained from, added by\n         * the client's `auth()` before it is stored and compared when it is read back (SEP-2352).\n         */\n        // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n        issuer: z.string().optional().catch(undefined)\n    })\n    .strip();\n\n/**\n * RFC 8693 §2.2.1 Token Exchange response for ID-JAG tokens.\n *\n * `token_type` is intentionally optional: per RFC 8693 §2.2.1 it is informational when\n * the issued token is not an access token, and per RFC 6749 §5.1 it is case-insensitive,\n * so strict checking rejects conformant IdPs.\n */\nexport const IdJagTokenExchangeResponseSchema = z\n    .object({\n        issued_token_type: z.literal('urn:ietf:params:oauth:token-type:id-jag'),\n        access_token: z.string(),\n        token_type: z.string().optional(),\n        expires_in: z.number().optional(),\n        scope: z.string().optional()\n    })\n    .strip();\n\nexport type IdJagTokenExchangeResponse = z.infer<typeof IdJagTokenExchangeResponseSchema>;\n\n/**\n * OAuth 2.1 error response\n */\nexport const OAuthErrorResponseSchema = z.object({\n    error: z.string(),\n    error_description: z.string().optional(),\n    error_uri: z.string().optional()\n});\n\n/**\n * Optional version of {@linkcode SafeUrlSchema} that allows empty string for backward compatibility on `tos_uri` and `logo_uri`\n */\n// eslint-disable-next-line unicorn/no-useless-undefined\nexport const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(z.literal('').transform(() => undefined));\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata\n */\nexport const OAuthClientMetadataSchema = z\n    .object({\n        redirect_uris: z.array(SafeUrlSchema),\n        token_endpoint_auth_method: z.string().optional(),\n        grant_types: z.array(z.string()).optional(),\n        response_types: z.array(z.string()).optional(),\n        /**\n         * OIDC Dynamic Client Registration `application_type`. MCP clients MUST set\n         * this to `'native'` or `'web'` when registering (SEP-837); the SDK defaults\n         * it from `redirect_uris` when omitted. Typed as `string` (not an enum) so\n         * that parsing an authorization server's registration response — which under\n         * RFC 7591 may echo extension values — never rejects the document on this\n         * field alone.\n         */\n        application_type: z.string().optional(),\n        client_name: z.string().optional(),\n        client_uri: SafeUrlSchema.optional(),\n        logo_uri: OptionalSafeUrlSchema,\n        scope: z.string().optional(),\n        contacts: z.array(z.string()).optional(),\n        tos_uri: OptionalSafeUrlSchema,\n        policy_uri: z.string().optional(),\n        jwks_uri: SafeUrlSchema.optional(),\n        jwks: z.any().optional(),\n        software_id: z.string().optional(),\n        software_version: z.string().optional(),\n        software_statement: z.string().optional()\n    })\n    .strip();\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration client information\n */\nexport const OAuthClientInformationSchema = z\n    .object({\n        client_id: z.string(),\n        client_secret: z.string().optional(),\n        client_id_issued_at: z.number().optional(),\n        client_secret_expires_at: z.number().optional(),\n        /**\n         * Not part of the wire format: the authorization server this value was obtained from, added by\n         * the client's `auth()` before it is stored and compared when it is read back (SEP-2352).\n         */\n        // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n        issuer: z.string().optional().catch(undefined)\n    })\n    .strip();\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)\n */\nexport const OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration error response\n */\nexport const OAuthClientRegistrationErrorSchema = z\n    .object({\n        error: z.string(),\n        error_description: z.string().optional()\n    })\n    .strip();\n\n/**\n * RFC 7009 OAuth 2.0 Token Revocation request\n */\nexport const OAuthTokenRevocationRequestSchema = z\n    .object({\n        token: z.string(),\n        token_type_hint: z.string().optional()\n    })\n    .strip();\n\nexport type OAuthMetadata = z.infer<typeof OAuthMetadataSchema>;\nexport type OpenIdProviderMetadata = z.infer<typeof OpenIdProviderMetadataSchema>;\nexport type OpenIdProviderDiscoveryMetadata = z.infer<typeof OpenIdProviderDiscoveryMetadataSchema>;\n\nexport type OAuthTokens = z.infer<typeof OAuthTokensSchema>;\nexport type OAuthErrorResponse = z.infer<typeof OAuthErrorResponseSchema>;\nexport type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;\nexport type OAuthClientInformation = z.infer<typeof OAuthClientInformationSchema>;\nexport type OAuthClientInformationFull = z.infer<typeof OAuthClientInformationFullSchema>;\nexport type OAuthClientInformationMixed = OAuthClientInformation | OAuthClientInformationFull;\n\n/**\n * {@linkcode OAuthTokens} as persisted by an `OAuthClientProvider`. Adds an\n * SDK-stamped authorization-server `issuer` identifier so stored tokens are\n * bound to the AS that issued them. The `issuer` field is **not** part of the\n * RFC 6749 wire response; the client SDK writes it before calling `saveTokens`.\n */\nexport type StoredOAuthTokens = OAuthTokens & { issuer?: string | undefined };\n\n/**\n * {@linkcode OAuthClientInformationMixed} as persisted by an\n * `OAuthClientProvider`. Adds an SDK-stamped authorization-server `issuer`\n * identifier so stored client credentials are bound to the AS that issued them.\n * The `issuer` field is **not** part of the RFC 7591 wire response; the client SDK\n * writes it before calling `saveClientInformation`.\n */\nexport type StoredOAuthClientInformation = OAuthClientInformationMixed & { issuer?: string | undefined };\n\nexport type OAuthClientRegistrationError = z.infer<typeof OAuthClientRegistrationErrorSchema>;\nexport type OAuthTokenRevocationRequest = z.infer<typeof OAuthTokenRevocationRequestSchema>;\nexport type OAuthProtectedResourceMetadata = z.infer<typeof OAuthProtectedResourceMetadataSchema>;\n\n// Unified type for authorization server metadata\nexport type AuthorizationServerMetadata = OAuthMetadata | OpenIdProviderDiscoveryMetadata;\n"],"mappings":";;;;;;AAKA,MAAa,gBAAgB,EACxB,KAAK,CACL,aAAa,KAAK,QAAQ;AACvB,KAAI,CAAC,IAAI,SAAS,IAAI,EAAE;AACpB,MAAI,SAAS;GACT,MAAM,EAAE,aAAa;GACrB,SAAS;GACT,OAAO;GACV,CAAC;AAEF,SAAO,EAAE;;EAEf,CACD,QACG,QAAO;CACH,MAAM,IAAI,IAAI,IAAI,IAAI;AACtB,QAAO,EAAE,aAAa,iBAAiB,EAAE,aAAa,WAAW,EAAE,aAAa;GAEpF,EAAE,SAAS,0DAA0D,CACxE;;;;AAKL,MAAa,uCAAuC,EAAE,YAAY;CAC9D,UAAU,EAAE,QAAQ,CAAC,KAAK;CAC1B,uBAAuB,EAAE,MAAM,cAAc,CAAC,UAAU;CACxD,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACrC,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,eAAe,EAAE,QAAQ,CAAC,UAAU;CACpC,wBAAwB,EAAE,QAAQ,CAAC,UAAU;CAC7C,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CAChD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CAC7C,4CAA4C,EAAE,SAAS,CAAC,UAAU;CAClE,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,mCAAmC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACjE,mCAAmC,EAAE,SAAS,CAAC,UAAU;CAC5D,CAAC;;;;AAKF,MAAa,sBAAsB,EAAE,YAAY;CAC7C,QAAQ,EAAE,QAAQ;CAClB,wBAAwB;CACxB,gBAAgB;CAChB,uBAAuB,cAAc,UAAU;CAC/C,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC7C,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,kDAAkD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChF,uBAAuB,cAAc,UAAU;CAC/C,qBAAqB,cAAc,UAAU;CAC7C,4CAA4C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC1E,uDAAuD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrF,wBAAwB,EAAE,QAAQ,CAAC,UAAU;CAC7C,+CAA+C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC7E,0DAA0D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxF,kCAAkC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChE,uCAAuC,EAAE,SAAS,CAAC,UAAU;CAE7D,gDAAgD,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,OAAU;CAKvF,mCAAmC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACpE,CAAC;;;;;;AAOF,MAAa,+BAA+B,EAAE,YAAY;CACtD,QAAQ,EAAE,QAAQ;CAClB,wBAAwB;CACxB,gBAAgB;CAChB,mBAAmB,cAAc,UAAU;CAC3C,UAAU;CACV,uBAAuB,cAAc,UAAU;CAC/C,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC7C,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACpD,yBAAyB,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC5C,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1D,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,6CAA6C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC3E,gDAAgD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC9E,gDAAgD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC9E,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,kDAAkD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChF,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,uBAAuB,EAAE,QAAQ,CAAC,UAAU;CAC5C,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACpD,4BAA4B,EAAE,SAAS,CAAC,UAAU;CAClD,6BAA6B,EAAE,SAAS,CAAC,UAAU;CACnD,iCAAiC,EAAE,SAAS,CAAC,UAAU;CACvD,kCAAkC,EAAE,SAAS,CAAC,UAAU;CACxD,eAAe,cAAc,UAAU;CACvC,YAAY,cAAc,UAAU;CACpC,uCAAuC,EAAE,SAAS,CAAC,UAAU;CAE7D,gDAAgD,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,OAAU;CAC1F,CAAC;;;;;;AAOF,MAAa,wCAAwC,EAAE,OAAO;CAC1D,GAAG,6BAA6B;CAChC,GAAG,oBAAoB,KAAK,EACxB,kCAAkC,MACrC,CAAC,CAAC;CACN,CAAC;;;;AAKF,MAAa,oBAAoB,EAC5B,OAAO;CACJ,cAAc,EAAE,QAAQ;CACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,YAAY,EAAE,QAAQ;CACtB,YAAY,EAAE,OAAO,QAAQ,CAAC,UAAU;CACxC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,eAAe,EAAE,QAAQ,CAAC,UAAU;CAMpC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,OAAU;CACjD,CAAC,CACD,OAAO;;;;;;;;AASZ,MAAa,mCAAmC,EAC3C,OAAO;CACJ,mBAAmB,EAAE,QAAQ,0CAA0C;CACvE,cAAc,EAAE,QAAQ;CACxB,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC/B,CAAC,CACD,OAAO;;;;AAOZ,MAAa,2BAA2B,EAAE,OAAO;CAC7C,OAAO,EAAE,QAAQ;CACjB,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,WAAW,EAAE,QAAQ,CAAC,UAAU;CACnC,CAAC;;;;AAMF,MAAa,wBAAwB,cAAc,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,gBAAgB,OAAU,CAAC;;;;AAK1G,MAAa,4BAA4B,EACpC,OAAO;CACJ,eAAe,EAAE,MAAM,cAAc;CACrC,4BAA4B,EAAE,QAAQ,CAAC,UAAU;CACjD,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC3C,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAS9C,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,YAAY,cAAc,UAAU;CACpC,UAAU;CACV,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxC,SAAS;CACT,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,cAAc,UAAU;CAClC,MAAM,EAAE,KAAK,CAAC,UAAU;CACxB,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,oBAAoB,EAAE,QAAQ,CAAC,UAAU;CAC5C,CAAC,CACD,OAAO;;;;AAKZ,MAAa,+BAA+B,EACvC,OAAO;CACJ,WAAW,EAAE,QAAQ;CACrB,eAAe,EAAE,QAAQ,CAAC,UAAU;CACpC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,0BAA0B,EAAE,QAAQ,CAAC,UAAU;CAM/C,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,OAAU;CACjD,CAAC,CACD,OAAO;;;;AAKZ,MAAa,mCAAmC,0BAA0B,MAAM,6BAA6B;;;;AAK7G,MAAa,qCAAqC,EAC7C,OAAO;CACJ,OAAO,EAAE,QAAQ;CACjB,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CAC3C,CAAC,CACD,OAAO;;;;AAKZ,MAAa,oCAAoC,EAC5C,OAAO;CACJ,OAAO,EAAE,QAAQ;CACjB,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACzC,CAAC,CACD,OAAO"}