{"version":3,"file":"passkey-DtZ9h2g5.js","names":[],"sources":["../../../node_modules/@simplewebauthn/browser/esm/helpers/bufferToBase64URLString.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/base64URLStringToBuffer.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthn.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/toPublicKeyCredentialDescriptor.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/isValidDomain.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/webAuthnError.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/identifyRegistrationError.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/webAuthnAbortService.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/toAuthenticatorAttachment.js","../../../node_modules/@simplewebauthn/browser/esm/methods/startRegistration.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthnAutofill.js","../../../node_modules/@simplewebauthn/browser/esm/helpers/identifyAuthenticationError.js","../../../node_modules/@simplewebauthn/browser/esm/methods/startAuthentication.js","../../../frontend/application/auth/passkey.js"],"sourcesContent":["/**\n * Convert the given array buffer into a Base64URL-encoded string. Ideal for converting various\n * credential response ArrayBuffers to string for sending back to the server as JSON.\n *\n * Helper method to compliment `base64URLStringToBuffer`\n */\nexport function bufferToBase64URLString(buffer) {\n    const bytes = new Uint8Array(buffer);\n    let str = '';\n    for (const charCode of bytes) {\n        str += String.fromCharCode(charCode);\n    }\n    const base64String = btoa(str);\n    return base64String.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n","/**\n * Convert from a Base64URL-encoded string to an Array Buffer. Best used when converting a\n * credential ID from a JSON string to an ArrayBuffer, like in allowCredentials or\n * excludeCredentials\n *\n * Helper method to compliment `bufferToBase64URLString`\n */\nexport function base64URLStringToBuffer(base64URLString) {\n    // Convert from Base64URL to Base64\n    const base64 = base64URLString.replace(/-/g, '+').replace(/_/g, '/');\n    /**\n     * Pad with '=' until it's a multiple of four\n     * (4 - (85 % 4 = 1) = 3) % 4 = 3 padding\n     * (4 - (86 % 4 = 2) = 2) % 4 = 2 padding\n     * (4 - (87 % 4 = 3) = 1) % 4 = 1 padding\n     * (4 - (88 % 4 = 0) = 4) % 4 = 0 padding\n     */\n    const padLength = (4 - (base64.length % 4)) % 4;\n    const padded = base64.padEnd(base64.length + padLength, '=');\n    // Convert to a binary string\n    const binary = atob(padded);\n    // Convert binary string to buffer\n    const buffer = new ArrayBuffer(binary.length);\n    const bytes = new Uint8Array(buffer);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return buffer;\n}\n","/**\n * Determine if the browser is capable of Webauthn\n */\nexport function browserSupportsWebAuthn() {\n    return _browserSupportsWebAuthnInternals.stubThis(globalThis?.PublicKeyCredential !== undefined &&\n        typeof globalThis.PublicKeyCredential === 'function');\n}\n/**\n * Make it possible to stub the return value during testing\n * @ignore Don't include this in docs output\n */\nexport const _browserSupportsWebAuthnInternals = {\n    stubThis: (value) => value,\n};\n","import { base64URLStringToBuffer } from './base64URLStringToBuffer.js';\nexport function toPublicKeyCredentialDescriptor(descriptor) {\n    const { id } = descriptor;\n    return {\n        ...descriptor,\n        id: base64URLStringToBuffer(id),\n        transports: descriptor.transports,\n        type: descriptor.type,\n    };\n}\n","/**\n * A simple test to determine if a hostname is a properly-formatted domain name\n *\n * A \"valid domain\" is defined here: https://url.spec.whatwg.org/#valid-domain\n *\n * Regex was originally sourced from here, then remixed to add punycode support:\n * https://www.oreilly.com/library/view/regular-expressions-cookbook/9781449327453/ch08s15.html\n */\nexport function isValidDomain(hostname) {\n    return (\n    // Consider localhost valid as well since it's okay wrt Secure Contexts\n    hostname === 'localhost' ||\n        // Support punycode (ACE) or ascii labels and domains\n        /^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(hostname));\n}\n","/**\n * A custom Error used to return a more nuanced error detailing _why_ one of the eight documented\n * errors in the spec was raised after calling `navigator.credentials.create()` or\n * `navigator.credentials.get()`:\n *\n * - `AbortError`\n * - `ConstraintError`\n * - `InvalidStateError`\n * - `NotAllowedError`\n * - `NotSupportedError`\n * - `SecurityError`\n * - `TypeError`\n * - `UnknownError`\n *\n * Error messages were determined through investigation of the spec to determine under which\n * scenarios a given error would be raised.\n */\nexport class WebAuthnError extends Error {\n    constructor({ message, code, cause, name, }) {\n        // @ts-ignore: help Rollup understand that `cause` is okay to set\n        super(message, { cause });\n        Object.defineProperty(this, \"code\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n        this.name = name ?? cause.name;\n        this.code = code;\n    }\n}\n","import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.create()`\n */\nexport function identifyRegistrationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Registration ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'ConstraintError') {\n        if (publicKey.authenticatorSelection?.requireResidentKey === true) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 4)\n            return new WebAuthnError({\n                message: 'Discoverable credentials were required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT',\n                cause: error,\n            });\n        }\n        else if (\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        options.mediation === 'conditional' &&\n            publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://w3c.github.io/webauthn/#sctn-createCredential (Step 22.4)\n            return new WebAuthnError({\n                message: 'User verification was required during automatic registration but it could not be performed',\n                code: 'ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE',\n                cause: error,\n            });\n        }\n        else if (publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 5)\n            return new WebAuthnError({\n                message: 'User verification was required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'InvalidStateError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 20)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 3)\n        return new WebAuthnError({\n            message: 'The authenticator was previously registered',\n            code: 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotSupportedError') {\n        const validPubKeyCredParams = publicKey.pubKeyCredParams.filter((param) => param.type === 'public-key');\n        if (validPubKeyCredParams.length === 0) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 10)\n            return new WebAuthnError({\n                message: 'No entry in pubKeyCredParams was of type \"public-key\"',\n                code: 'ERROR_MALFORMED_PUBKEYCREDPARAMS',\n                cause: error,\n            });\n        }\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 2)\n        return new WebAuthnError({\n            message: 'No available authenticator supported any of the specified pubKeyCredParams algorithms',\n            code: 'ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 7)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rp.id !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 8)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rp.id}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'TypeError') {\n        if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 5)\n            return new WebAuthnError({\n                message: 'User ID was not between 1 and 64 characters',\n                code: 'ERROR_INVALID_USER_ID_LENGTH',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 8)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new credential',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n","class BaseWebAuthnAbortService {\n    constructor() {\n        Object.defineProperty(this, \"controller\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n    }\n    createNewAbortSignal() {\n        // Abort any existing calls to navigator.credentials.create() or navigator.credentials.get()\n        if (this.controller) {\n            const abortError = new Error('Cancelling existing WebAuthn API call for new one');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n        }\n        const newController = new AbortController();\n        this.controller = newController;\n        return newController.signal;\n    }\n    cancelCeremony() {\n        if (this.controller) {\n            const abortError = new Error('Manually cancelling existing WebAuthn API call');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n            this.controller = undefined;\n        }\n    }\n}\n/**\n * A service singleton to help ensure that only a single WebAuthn ceremony is active at a time.\n *\n * Users of **@simplewebauthn/browser** shouldn't typically need to use this, but it can help e.g.\n * developers building projects that use client-side routing to better control the behavior of\n * their UX in response to router navigation events.\n */\nexport const WebAuthnAbortService = new BaseWebAuthnAbortService();\n","const attachments = ['cross-platform', 'platform'];\n/**\n * If possible coerce a `string` value into a known `AuthenticatorAttachment`\n */\nexport function toAuthenticatorAttachment(attachment) {\n    if (!attachment) {\n        return;\n    }\n    if (attachments.indexOf(attachment) < 0) {\n        return;\n    }\n    return attachment;\n}\n","import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyRegistrationError } from '../helpers/identifyRegistrationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"registration\" via WebAuthn attestation\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateRegistrationOptions()`\n * @param useAutoRegister (Optional) Try to silently create a passkey with the password manager that the user just signed in with. Defaults to `false`.\n */\nexport async function startRegistration(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useAutoRegister = false } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        user: {\n            ...optionsJSON.user,\n            id: base64URLStringToBuffer(optionsJSON.user.id),\n        },\n        excludeCredentials: optionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor),\n    };\n    // Prepare options for `.create()`\n    const createOptions = {};\n    /**\n     * Try to use conditional create to register a passkey for the user with the password manager\n     * the user just used to authenticate with. The user won't be shown any prominent UI by the\n     * browser.\n     */\n    if (useAutoRegister) {\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        createOptions.mediation = 'conditional';\n    }\n    // Finalize options\n    createOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    createOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete attestation\n    let credential;\n    try {\n        credential = (await navigator.credentials.create(\n        // TODO: Newer versions of Deno require this casting, revisit once we're using Deno 2.6+\n        createOptions));\n    }\n    catch (err) {\n        throw identifyRegistrationError({ error: err, options: createOptions });\n    }\n    if (!credential) {\n        throw new Error('Registration was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    // Continue to play it safe with `getTransports()` for now, even when L3 types say it's required\n    let transports = undefined;\n    if (typeof response.getTransports === 'function') {\n        transports = response.getTransports();\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responsePublicKeyAlgorithm = undefined;\n    if (typeof response.getPublicKeyAlgorithm === 'function') {\n        try {\n            responsePublicKeyAlgorithm = response.getPublicKeyAlgorithm();\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKeyAlgorithm()', error);\n        }\n    }\n    let responsePublicKey = undefined;\n    if (typeof response.getPublicKey === 'function') {\n        try {\n            const _publicKey = response.getPublicKey();\n            if (_publicKey !== null) {\n                responsePublicKey = bufferToBase64URLString(_publicKey);\n            }\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKey()', error);\n        }\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responseAuthenticatorData;\n    if (typeof response.getAuthenticatorData === 'function') {\n        try {\n            responseAuthenticatorData = bufferToBase64URLString(response.getAuthenticatorData());\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getAuthenticatorData()', error);\n        }\n    }\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            attestationObject: bufferToBase64URLString(response.attestationObject),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            transports,\n            publicKeyAlgorithm: responsePublicKeyAlgorithm,\n            publicKey: responsePublicKey,\n            authenticatorData: responseAuthenticatorData,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n/**\n * Visibly warn when we detect an issue related to a passkey provider intercepting WebAuthn API\n * calls\n */\nfunction warnOnBrokenImplementation(methodName, cause) {\n    console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${methodName}. You should report this error to them.\\n`, cause);\n}\n","import { browserSupportsWebAuthn } from './browserSupportsWebAuthn.js';\n/**\n * Determine if the browser supports conditional UI, so that WebAuthn credentials can\n * be shown to the user in the browser's typical password autofill popup.\n */\nexport function browserSupportsWebAuthnAutofill() {\n    if (!browserSupportsWebAuthn()) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    /**\n     * I don't like the `as unknown` here but there's a `declare var PublicKeyCredential` in\n     * TS' DOM lib that's making it difficult for me to just go `as PublicKeyCredentialFuture` as I\n     * want. I think I'm fine with this for now since it's _supposed_ to be temporary, until TS types\n     * have a chance to catch up.\n     */\n    const globalPublicKeyCredential = globalThis\n        .PublicKeyCredential;\n    if (globalPublicKeyCredential?.isConditionalMediationAvailable === undefined) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    return _browserSupportsWebAuthnAutofillInternals.stubThis(globalPublicKeyCredential.isConditionalMediationAvailable());\n}\n// Make it possible to stub the return value during testing\nexport const _browserSupportsWebAuthnAutofillInternals = {\n    stubThis: (value) => value,\n};\n","import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.get()`\n */\nexport function identifyAuthenticationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Authentication ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 5)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rpId !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 6)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rpId}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 12)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new assertion signature',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n","import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { browserSupportsWebAuthnAutofill } from '../helpers/browserSupportsWebAuthnAutofill.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyAuthenticationError } from '../helpers/identifyAuthenticationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"login\" via WebAuthn assertion\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateAuthenticationOptions()`\n * @param useBrowserAutofill (Optional) Initialize conditional UI to enable logging in via browser autofill prompts. Defaults to `false`.\n * @param verifyBrowserAutofillInput (Optional) Ensure a suitable `<input>` element is present when `useBrowserAutofill` is `true`. Defaults to `true`.\n */\nexport async function startAuthentication(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useBrowserAutofill = false, verifyBrowserAutofillInput = true, } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to avoid passing empty array to avoid blocking retrieval\n    // of public key\n    let allowCredentials;\n    if (optionsJSON.allowCredentials?.length !== 0) {\n        allowCredentials = optionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        allowCredentials,\n    };\n    // Prepare options for `.get()`\n    const getOptions = {};\n    /**\n     * Set up the page to prompt the user to select a credential for authentication via the browser's\n     * input autofill mechanism.\n     */\n    if (useBrowserAutofill) {\n        if (!(await browserSupportsWebAuthnAutofill())) {\n            throw Error('Browser does not support WebAuthn autofill');\n        }\n        // Check for an <input> with \"webauthn\" in its `autocomplete` attribute\n        const eligibleInputs = document.querySelectorAll(\"input[autocomplete$='webauthn']\");\n        // WebAuthn autofill requires at least one valid input\n        if (eligibleInputs.length < 1 && verifyBrowserAutofillInput) {\n            throw Error('No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected');\n        }\n        // `CredentialMediationRequirement` doesn't know about \"conditional\" yet as of\n        // typescript@4.6.3\n        getOptions.mediation = 'conditional';\n        // Conditional UI requires an empty allow list\n        publicKey.allowCredentials = [];\n    }\n    // Finalize options\n    getOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    getOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete assertion\n    let credential;\n    try {\n        credential = (await navigator.credentials.get(\n        // TODO: Newer versions of Deno require this casting, revisit once we're using Deno 2.6+\n        getOptions));\n    }\n    catch (err) {\n        throw identifyAuthenticationError({ error: err, options: getOptions });\n    }\n    if (!credential) {\n        throw new Error('Authentication was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    let userHandle = undefined;\n    if (response.userHandle) {\n        userHandle = bufferToBase64URLString(response.userHandle);\n    }\n    // Convert values to base64 to make it easier to send back to the server\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            authenticatorData: bufferToBase64URLString(response.authenticatorData),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            signature: bufferToBase64URLString(response.signature),\n            userHandle,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n","/**\n * WebAuthn / Passkey client handler for Aurora CRM (Production-Ready).\n * Integrates with @simplewebauthn/browser for biometric / security key operations.\n */\n\nimport { startAuthentication, startRegistration } from \"@simplewebauthn/browser\";\n\nfunction getCsrfToken() {\n  const tokenInput = document.querySelector(\"[name=csrfmiddlewaretoken]\");\n  if (tokenInput && tokenInput.value) {\n    return tokenInput.value;\n  }\n  const match = document.cookie.match(/csrftoken=([^;]+)/);\n  return match ? match[1] : \"\";\n}\n\nexport const SAVED_USER_KEY = \"aurora_saved_biometric_user\";\n\nexport function saveBiometricUserToStorage(userEmail, userName) {\n  if (!userEmail) return;\n  try {\n    const lastAccessed = new Date().toLocaleDateString(undefined, {\n      month: \"short\",\n      day: \"numeric\",\n      year: \"numeric\",\n    });\n    localStorage.setItem(\n      SAVED_USER_KEY,\n      JSON.stringify({\n        email: userEmail,\n        name: userName || userEmail,\n        lastAccessed,\n        enabled: true,\n      })\n    );\n  } catch (e) {\n    console.warn(\"Could not save biometric user profile to localStorage:\", e);\n  }\n}\n\n/**\n * Handle 1-click Passkey login from login page.\n */\nexport async function handlePasskeyLogin(options = {}) {\n  let email = \"\";\n  let buttonElement = null;\n\n  if (options && typeof options === \"object\") {\n    if (typeof HTMLElement !== \"undefined\" && options instanceof HTMLElement) {\n      buttonElement = options;\n    } else {\n      email = options.email || \"\";\n      buttonElement = options.buttonElement || null;\n    }\n  }\n\n  const originalContent = buttonElement ? buttonElement.innerHTML : \"\";\n  if (buttonElement) {\n    buttonElement.disabled = true;\n    buttonElement.innerHTML = `<i class=\"fa-solid fa-circle-notch fa-spin\"></i> Authenticating...`;\n  }\n\n  try {\n    const csrfToken = getCsrfToken();\n\n    // 1. Fetch authentication options\n    const optionsResp = await fetch(\"/auth/passkey/login/options/\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"X-CSRFToken\": csrfToken,\n      },\n      body: JSON.stringify({ email }),\n    });\n\n    if (!optionsResp.ok) {\n      const errData = await optionsResp.json().catch(() => ({}));\n      throw new Error(errData.error || \"Failed to initialize passkey authentication.\");\n    }\n\n    const optionsJSON = await optionsResp.json();\n\n    // 2. Invoke browser WebAuthn API\n    const assertion = await startAuthentication({ optionsJSON });\n\n    // 3. Post assertion to backend for verification\n    const rememberMe = document.getElementById(\"id_remember_me\")?.checked || false;\n    const verifyResp = await fetch(\"/auth/passkey/login/verify/\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"X-CSRFToken\": csrfToken,\n      },\n      body: JSON.stringify({ ...assertion, remember_me: rememberMe }),\n    });\n\n    const verifyResult = await verifyResp.json();\n\n    if (!verifyResp.ok || !verifyResult.success) {\n      throw new Error(verifyResult.error || \"Passkey verification failed.\");\n    }\n\n    // 4. Initialize session storage for browser close lifecycle\n    sessionStorage.setItem(\"aurora_crm_browser_session\", \"1\");\n    localStorage.setItem(\"aurora_crm_last_activity\", Date.now().toString());\n\n    // Auto-update saved user profile for returning user card\n    if (verifyResult.user_email) {\n      saveBiometricUserToStorage(verifyResult.user_email, verifyResult.user_name);\n    }\n\n    // 5. Redirect to role dashboard on success\n    window.location.href = verifyResult.redirect_url || \"/dashboard/\";\n    return verifyResult;\n  } catch (err) {\n    if (buttonElement) {\n      buttonElement.disabled = false;\n      buttonElement.innerHTML = originalContent;\n    }\n    throw err;\n  }\n}\n\n/**\n * Handle new Passkey registration from Account Settings.\n */\nexport async function handlePasskeyRegistration(passkeyName, onSuccess, onError) {\n  try {\n    const csrfToken = getCsrfToken();\n\n    // 1. Fetch registration options\n    const optionsResp = await fetch(\"/auth/passkey/register/options/\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"X-CSRFToken\": csrfToken,\n      },\n    });\n\n    if (!optionsResp.ok) {\n      const errData = await optionsResp.json().catch(() => ({}));\n      throw new Error(errData.error || \"Failed to start registration.\");\n    }\n\n    const optionsJSON = await optionsResp.json();\n\n    // 2. Invoke browser WebAuthn API\n    const credential = await startRegistration({ optionsJSON });\n\n    // 3. Post credential to backend for verification\n    const verifyResp = await fetch(\"/auth/passkey/register/verify/\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"X-CSRFToken\": csrfToken,\n      },\n      body: JSON.stringify({\n        name: passkeyName,\n        credential: credential,\n      }),\n    });\n\n    const verifyResult = await verifyResp.json();\n\n    if (!verifyResp.ok || !verifyResult.success) {\n      throw new Error(verifyResult.error || \"Failed to save passkey.\");\n    }\n\n    // Auto-persist enrolled biometric user to localStorage so Returning User Card shows on login\n    if (verifyResult.user_email) {\n      saveBiometricUserToStorage(verifyResult.user_email, verifyResult.user_name);\n    }\n\n    if (typeof onSuccess === \"function\") {\n      onSuccess(verifyResult);\n    }\n  } catch (err) {\n    if (err.name === \"NotAllowedError\") {\n      if (typeof onError === \"function\") {\n        onError(err);\n      }\n      return; // User cancelled prompt\n    }\n    if (typeof onError === \"function\") {\n      onError(err);\n    } else {\n      alert(err.message || \"Passkey registration failed.\");\n    }\n  }\n}\n\n/**\n * Delete / revoke a passkey credential.\n */\nexport async function handlePasskeyDelete(passkeyId, onSuccess, onError) {\n  try {\n    const csrfToken = getCsrfToken();\n    const resp = await fetch(`/auth/passkey/${passkeyId}/delete/`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"X-CSRFToken\": csrfToken,\n      },\n    });\n\n    const result = await resp.json();\n    if (!resp.ok || !result.success) {\n      throw new Error(result.error || \"Failed to delete passkey.\");\n    }\n\n    if (typeof onSuccess === \"function\") {\n      onSuccess(result);\n    }\n  } catch (err) {\n    if (typeof onError === \"function\") {\n      onError(err);\n    } else {\n      alert(err.message || \"Error removing passkey.\");\n    }\n  }\n}\n\n// Attach to window object for global / Alpine.js access\nwindow.handlePasskeyLogin = handlePasskeyLogin;\nwindow.handlePasskeyRegistration = handlePasskeyRegistration;\nwindow.handlePasskeyDelete = handlePasskeyDelete;\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12],"mappings":"AAMA,SAAgB,EAAwB,EAAQ,CAC5C,IAAM,EAAQ,IAAI,WAAW,CAAM,EAC/B,EAAM,GACV,IAAK,IAAM,KAAY,EACnB,GAAO,OAAO,aAAa,CAAQ,EAGvC,OADqB,KAAK,CACR,CAAC,CAAC,QAAQ,MAAO,GAAG,CAAC,CAAC,QAAQ,MAAO,GAAG,CAAC,CAAC,QAAQ,KAAM,EAAE,CAChF,CCPA,SAAgB,EAAwB,EAAiB,CAErD,IAAM,EAAS,EAAgB,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EAQ7D,GAAa,EAAK,EAAO,OAAS,GAAM,EACxC,EAAS,EAAO,OAAO,EAAO,OAAS,EAAW,GAAG,EAErD,EAAS,KAAK,CAAM,EAEpB,EAAS,IAAI,YAAY,EAAO,MAAM,EACtC,EAAQ,IAAI,WAAW,CAAM,EACnC,IAAK,IAAI,EAAI,EAAG,EAAI,EAAO,OAAQ,IAC/B,EAAM,GAAK,EAAO,WAAW,CAAC,EAElC,OAAO,CACX,CCzBA,SAAgB,GAA0B,CACtC,OAAO,EAAkC,SAAS,YAAY,sBAAwB,IAAA,IAClF,OAAO,WAAW,qBAAwB,UAAU,CAC5D,CAKA,IAAa,EAAoC,CAC7C,SAAW,GAAU,CACzB,ECZA,SAAgB,EAAgC,EAAY,CACxD,GAAM,CAAE,MAAO,EACf,MAAO,CACH,GAAG,EACH,GAAI,EAAwB,CAAE,EAC9B,WAAY,EAAW,WACvB,KAAM,EAAW,IACrB,CACJ,CCDA,SAAgB,EAAc,EAAU,CACpC,OAEA,IAAa,aAET,4EAA4E,KAAK,CAAQ,CACjG,CCGA,IAAa,EAAb,cAAmC,KAAM,CACrC,YAAY,CAAE,UAAS,OAAM,QAAO,QAAS,CAEzC,MAAM,EAAS,CAAE,OAAM,CAAC,EACxB,OAAO,eAAe,KAAM,OAAQ,CAChC,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAK,EAChB,CAAC,EACD,KAAK,KAAO,GAAQ,EAAM,KAC1B,KAAK,KAAO,CAChB,CACJ,ECzBA,SAAgB,EAA0B,CAAE,QAAO,WAAY,CAC3D,GAAM,CAAE,aAAc,EACtB,GAAI,CAAC,EACD,MAAM,MAAM,iDAAiD,EAEjE,GAAI,EAAM,OAAS,aACX,IAAA,EAAQ,kBAAkB,YAE1B,OAAO,IAAI,EAAc,CACrB,QAAS,iDACT,KAAM,yBACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,kBAAmB,CACvC,GAAI,EAAU,wBAAwB,qBAAuB,GAEzD,OAAO,IAAI,EAAc,CACrB,QAAS,qFACT,KAAM,8DACN,MAAO,CACX,CAAC,EAEA,GAEL,EAAQ,YAAc,eAClB,EAAU,wBAAwB,mBAAqB,WAEvD,OAAO,IAAI,EAAc,CACrB,QAAS,6FACT,KAAM,gDACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,wBAAwB,mBAAqB,WAE5D,OAAO,IAAI,EAAc,CACrB,QAAS,6EACT,KAAM,wDACN,MAAO,CACX,CAAC,CAET,MACK,GAAI,EAAM,OAAS,oBAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,8CACT,KAAM,4CACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,kBAKpB,OAAO,IAAI,EAAc,CACrB,QAAS,EAAM,QACf,KAAM,uCACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,oBAWpB,OAV8B,EAAU,iBAAiB,OAAQ,GAAU,EAAM,OAAS,YAClE,CAAC,CAAC,SAAW,EAE1B,IAAI,EAAc,CACrB,QAAS,wDACT,KAAM,mCACN,MAAO,CACX,CAAC,EAGE,IAAI,EAAc,CACrB,QAAS,wFACT,KAAM,wDACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,gBAAiB,CACrC,IAAM,EAAkB,WAAW,SAAS,SAC5C,GAAI,CAAC,EAAc,CAAe,EAE9B,OAAO,IAAI,EAAc,CACrB,QAAS,GAAG,WAAW,SAAS,SAAS,uBACzC,KAAM,uBACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,GAAG,KAAO,EAEzB,OAAO,IAAI,EAAc,CACrB,QAAS,cAAc,EAAU,GAAG,GAAG,8BACvC,KAAM,sBACN,MAAO,CACX,CAAC,CAET,MACK,GAAI,EAAM,OAAS,YAChB,IAAA,EAAU,KAAK,GAAG,WAAa,GAAK,EAAU,KAAK,GAAG,WAAa,GAEnE,OAAO,IAAI,EAAc,CACrB,QAAS,8CACT,KAAM,+BACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,eAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,sGACT,KAAM,oCACN,MAAO,CACX,CAAC,EAEL,OAAO,CACX,CCzFA,IAAa,EAAuB,IAAI,KApCT,CAC3B,aAAc,CACV,OAAO,eAAe,KAAM,aAAc,CACtC,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAK,EAChB,CAAC,CACL,CACA,sBAAuB,CAEnB,GAAI,KAAK,WAAY,CACjB,IAAM,EAAiB,MAAM,mDAAmD,EAChF,EAAW,KAAO,aAClB,KAAK,WAAW,MAAM,CAAU,CACpC,CACA,IAAM,EAAgB,IAAI,gBAE1B,MADA,MAAK,WAAa,EACX,EAAc,MACzB,CACA,gBAAiB,CACb,GAAI,KAAK,WAAY,CACjB,IAAM,EAAiB,MAAM,gDAAgD,EAC7E,EAAW,KAAO,aAClB,KAAK,WAAW,MAAM,CAAU,EAChC,KAAK,WAAa,IAAA,EACtB,CACJ,CACJ,EC5BM,EAAc,CAAC,iBAAkB,UAAU,EAIjD,SAAgB,EAA0B,EAAY,CAC7C,MAGD,IAAY,QAAQ,CAAU,EAAI,GAGtC,OAAO,CACX,CCCA,eAAsB,EAAkB,EAAS,CAEzC,CAAC,EAAQ,aAAe,EAAQ,YAChC,QAAQ,KAAK,4TAA4T,EAEzU,EAAU,CAAE,YAAa,CAAQ,GAErC,GAAM,CAAE,cAAa,kBAAkB,IAAU,EACjD,GAAI,CAAC,EAAwB,EACzB,MAAU,MAAM,2CAA2C,EAG/D,IAAM,EAAY,CACd,GAAG,EACH,UAAW,EAAwB,EAAY,SAAS,EACxD,KAAM,CACF,GAAG,EAAY,KACf,GAAI,EAAwB,EAAY,KAAK,EAAE,CACnD,EACA,mBAAoB,EAAY,oBAAoB,IAAI,CAA+B,CAC3F,EAEM,EAAgB,CAAC,EAMnB,IAEA,EAAc,UAAY,eAG9B,EAAc,UAAY,EAE1B,EAAc,OAAS,EAAqB,qBAAqB,EAEjE,IAAI,EACJ,GAAI,CACA,EAAc,MAAM,UAAU,YAAY,OAE1C,CAAa,CACjB,OACO,EAAK,CACR,MAAM,EAA0B,CAAE,MAAO,EAAK,QAAS,CAAc,CAAC,CAC1E,CACA,GAAI,CAAC,EACD,MAAU,MAAM,gCAAgC,EAEpD,GAAM,CAAE,KAAI,QAAO,WAAU,QAAS,EAElC,EACA,OAAO,EAAS,eAAkB,aAClC,EAAa,EAAS,cAAc,GAGxC,IAAI,EACJ,GAAI,OAAO,EAAS,uBAA0B,WAC1C,GAAI,CACA,EAA6B,EAAS,sBAAsB,CAChE,OACO,EAAO,CACV,EAA2B,0BAA2B,CAAK,CAC/D,CAEJ,IAAI,EACJ,GAAI,OAAO,EAAS,cAAiB,WACjC,GAAI,CACA,IAAM,EAAa,EAAS,aAAa,EACrC,IAAe,OACf,EAAoB,EAAwB,CAAU,EAE9D,OACO,EAAO,CACV,EAA2B,iBAAkB,CAAK,CACtD,CAGJ,IAAI,EACJ,GAAI,OAAO,EAAS,sBAAyB,WACzC,GAAI,CACA,EAA4B,EAAwB,EAAS,qBAAqB,CAAC,CACvF,OACO,EAAO,CACV,EAA2B,yBAA0B,CAAK,CAC9D,CAEJ,MAAO,CACH,KACA,MAAO,EAAwB,CAAK,EACpC,SAAU,CACN,kBAAmB,EAAwB,EAAS,iBAAiB,EACrE,eAAgB,EAAwB,EAAS,cAAc,EAC/D,aACA,mBAAoB,EACpB,UAAW,EACX,kBAAmB,CACvB,EACA,OACA,uBAAwB,EAAW,0BAA0B,EAC7D,wBAAyB,EAA0B,EAAW,uBAAuB,CACzF,CACJ,CAKA,SAAS,EAA2B,EAAY,EAAO,CACnD,QAAQ,KAAK,yFAAyF,EAAW,2CAA4C,CAAK,CACtK,CCrHA,SAAgB,GAAkC,CAC9C,GAAI,CAAC,EAAwB,EACzB,OAAO,EAA0C,SAAS,IAAI,QAAS,GAAY,EAAQ,EAAK,CAAC,CAAC,EAQtG,IAAM,EAA4B,WAC7B,oBAIL,OAHI,GAA2B,kCAAoC,IAAA,GACxD,EAA0C,SAAS,IAAI,QAAS,GAAY,EAAQ,EAAK,CAAC,CAAC,EAE/F,EAA0C,SAAS,EAA0B,gCAAgC,CAAC,CACzH,CAEA,IAAa,EAA4C,CACrD,SAAW,GAAU,CACzB,ECpBA,SAAgB,EAA4B,CAAE,QAAO,WAAY,CAC7D,GAAM,CAAE,aAAc,EACtB,GAAI,CAAC,EACD,MAAM,MAAM,iDAAiD,EAEjE,GAAI,EAAM,OAAS,aACX,IAAA,EAAQ,kBAAkB,YAE1B,OAAO,IAAI,EAAc,CACrB,QAAS,mDACT,KAAM,yBACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,kBAKpB,OAAO,IAAI,EAAc,CACrB,QAAS,EAAM,QACf,KAAM,uCACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,gBAAiB,CACrC,IAAM,EAAkB,WAAW,SAAS,SAC5C,GAAI,CAAC,EAAc,CAAe,EAE9B,OAAO,IAAI,EAAc,CACrB,QAAS,GAAG,WAAW,SAAS,SAAS,uBACzC,KAAM,uBACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,OAAS,EAExB,OAAO,IAAI,EAAc,CACrB,QAAS,cAAc,EAAU,KAAK,8BACtC,KAAM,sBACN,MAAO,CACX,CAAC,CAET,MACK,GAAI,EAAM,OAAS,eAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,+GACT,KAAM,oCACN,MAAO,CACX,CAAC,EAEL,OAAO,CACX,CC7CA,eAAsB,EAAoB,EAAS,CAE3C,CAAC,EAAQ,aAAe,EAAQ,YAChC,QAAQ,KAAK,8TAA8T,EAE3U,EAAU,CAAE,YAAa,CAAQ,GAErC,GAAM,CAAE,cAAa,qBAAqB,GAAO,6BAA6B,IAAU,EACxF,GAAI,CAAC,EAAwB,EACzB,MAAU,MAAM,2CAA2C,EAI/D,IAAI,EACA,EAAY,kBAAkB,SAAW,IACzC,EAAmB,EAAY,kBAAkB,IAAI,CAA+B,GAGxF,IAAM,EAAY,CACd,GAAG,EACH,UAAW,EAAwB,EAAY,SAAS,EACxD,kBACJ,EAEM,EAAa,CAAC,EAKpB,GAAI,EAAoB,CACpB,GAAI,CAAE,MAAM,EAAgC,EACxC,MAAM,MAAM,4CAA4C,EAK5D,GAFuB,SAAS,iBAAiB,iCAEhC,CAAC,CAAC,OAAS,GAAK,EAC7B,MAAM,MAAM,mGAAmG,EAInH,EAAW,UAAY,cAEvB,EAAU,iBAAmB,CAAC,CAClC,CAEA,EAAW,UAAY,EAEvB,EAAW,OAAS,EAAqB,qBAAqB,EAE9D,IAAI,EACJ,GAAI,CACA,EAAc,MAAM,UAAU,YAAY,IAE1C,CAAU,CACd,OACO,EAAK,CACR,MAAM,EAA4B,CAAE,MAAO,EAAK,QAAS,CAAW,CAAC,CACzE,CACA,GAAI,CAAC,EACD,MAAU,MAAM,kCAAkC,EAEtD,GAAM,CAAE,KAAI,QAAO,WAAU,QAAS,EAClC,EAKJ,OAJI,EAAS,aACT,EAAa,EAAwB,EAAS,UAAU,GAGrD,CACH,KACA,MAAO,EAAwB,CAAK,EACpC,SAAU,CACN,kBAAmB,EAAwB,EAAS,iBAAiB,EACrE,eAAgB,EAAwB,EAAS,cAAc,EAC/D,UAAW,EAAwB,EAAS,SAAS,EACrD,YACJ,EACA,OACA,uBAAwB,EAAW,0BAA0B,EAC7D,wBAAyB,EAA0B,EAAW,uBAAuB,CACzF,CACJ,CCzFA,SAAS,GAAe,CACtB,IAAM,EAAa,SAAS,cAAc,4BAA4B,EACtE,GAAI,GAAc,EAAW,MAC3B,OAAO,EAAW,MAEpB,IAAM,EAAQ,SAAS,OAAO,MAAM,mBAAmB,EACvD,OAAO,EAAQ,EAAM,GAAK,EAC5B,CAEA,IAAa,EAAiB,8BAE9B,SAAgB,EAA2B,EAAW,EAAU,CACzD,KACL,GAAI,CACF,IAAM,EAAe,IAAI,KAAK,CAAA,CAAE,mBAAmB,IAAA,GAAW,CAC5D,MAAO,QACP,IAAK,UACL,KAAM,SACR,CAAC,EACD,aAAa,QACX,EACA,KAAK,UAAU,CACb,MAAO,EACP,KAAM,GAAY,EAClB,eACA,QAAS,EACX,CAAC,CACH,CACF,OAAS,EAAG,CACV,QAAQ,KAAK,yDAA0D,CAAC,CAC1E,CACF,CAKA,eAAsB,EAAmB,EAAU,CAAC,EAAG,CACrD,IAAI,EAAQ,GACR,EAAgB,KAEhB,GAAW,OAAO,GAAY,WAC5B,OAAO,YAAgB,KAAe,aAAmB,YAC3D,EAAgB,GAEhB,EAAQ,EAAQ,OAAS,GACzB,EAAgB,EAAQ,eAAiB,OAI7C,IAAM,EAAkB,EAAgB,EAAc,UAAY,GAC9D,IACF,EAAc,SAAW,GACzB,EAAc,UAAY,sEAG5B,GAAI,CACF,IAAM,EAAY,EAAa,EAGzB,EAAc,MAAM,MAAM,+BAAgC,CAC9D,OAAQ,OACR,QAAS,CACP,eAAgB,mBAChB,cAAe,CACjB,EACA,KAAM,KAAK,UAAU,CAAE,OAAM,CAAC,CAChC,CAAC,EAED,GAAI,CAAC,EAAY,GAAI,CACnB,IAAM,EAAU,MAAM,EAAY,KAAK,CAAC,CAAC,WAAa,CAAC,EAAE,EACzD,MAAU,MAAM,EAAQ,OAAS,8CAA8C,CACjF,CAKA,IAAM,EAAY,MAAM,EAAoB,CAAE,kBAHpB,EAAY,KAAK,CAGe,CAAC,EAGrD,EAAa,SAAS,eAAe,gBAAgB,CAAC,EAAE,SAAW,GACnE,EAAa,MAAM,MAAM,8BAA+B,CAC5D,OAAQ,OACR,QAAS,CACP,eAAgB,mBAChB,cAAe,CACjB,EACA,KAAM,KAAK,UAAU,CAAE,GAAG,EAAW,YAAa,CAAW,CAAC,CAChE,CAAC,EAEK,EAAe,MAAM,EAAW,KAAK,EAE3C,GAAI,CAAC,EAAW,IAAM,CAAC,EAAa,QAClC,MAAU,MAAM,EAAa,OAAS,8BAA8B,EActE,OAVA,eAAe,QAAQ,6BAA8B,GAAG,EACxD,aAAa,QAAQ,2BAA4B,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,EAGlE,EAAa,YACf,EAA2B,EAAa,WAAY,EAAa,SAAS,EAI5E,OAAO,SAAS,KAAO,EAAa,cAAgB,cAC7C,CACT,OAAS,EAAK,CAKZ,MAJI,IACF,EAAc,SAAW,GACzB,EAAc,UAAY,GAEtB,CACR,CACF,CAKA,eAAsB,EAA0B,EAAa,EAAW,EAAS,CAC/E,GAAI,CACF,IAAM,EAAY,EAAa,EAGzB,EAAc,MAAM,MAAM,kCAAmC,CACjE,OAAQ,OACR,QAAS,CACP,eAAgB,mBAChB,cAAe,CACjB,CACF,CAAC,EAED,GAAI,CAAC,EAAY,GAAI,CACnB,IAAM,EAAU,MAAM,EAAY,KAAK,CAAC,CAAC,WAAa,CAAC,EAAE,EACzD,MAAU,MAAM,EAAQ,OAAS,+BAA+B,CAClE,CAKA,IAAM,EAAa,MAAM,EAAkB,CAAE,kBAHnB,EAAY,KAAK,CAGc,CAAC,EAGpD,EAAa,MAAM,MAAM,iCAAkC,CAC/D,OAAQ,OACR,QAAS,CACP,eAAgB,mBAChB,cAAe,CACjB,EACA,KAAM,KAAK,UAAU,CACnB,KAAM,EACM,YACd,CAAC,CACH,CAAC,EAEK,EAAe,MAAM,EAAW,KAAK,EAE3C,GAAI,CAAC,EAAW,IAAM,CAAC,EAAa,QAClC,MAAU,MAAM,EAAa,OAAS,yBAAyB,EAI7D,EAAa,YACf,EAA2B,EAAa,WAAY,EAAa,SAAS,EAGxE,OAAO,GAAc,YACvB,EAAU,CAAY,CAE1B,OAAS,EAAK,CACZ,GAAI,EAAI,OAAS,kBAAmB,CAC9B,OAAO,GAAY,YACrB,EAAQ,CAAG,EAEb,MACF,CACI,OAAO,GAAY,WACrB,EAAQ,CAAG,EAEX,MAAM,EAAI,SAAW,8BAA8B,CAEvD,CACF,CAKA,eAAsB,EAAoB,EAAW,EAAW,EAAS,CACvE,GAAI,CACF,IAAM,EAAY,EAAa,EACzB,EAAO,MAAM,MAAM,iBAAiB,EAAU,UAAW,CAC7D,OAAQ,OACR,QAAS,CACP,eAAgB,mBAChB,cAAe,CACjB,CACF,CAAC,EAEK,EAAS,MAAM,EAAK,KAAK,EAC/B,GAAI,CAAC,EAAK,IAAM,CAAC,EAAO,QACtB,MAAU,MAAM,EAAO,OAAS,2BAA2B,EAGzD,OAAO,GAAc,YACvB,EAAU,CAAM,CAEpB,OAAS,EAAK,CACR,OAAO,GAAY,WACrB,EAAQ,CAAG,EAEX,MAAM,EAAI,SAAW,yBAAyB,CAElD,CACF,CAGA,OAAO,mBAAqB,EAC5B,OAAO,0BAA4B,EACnC,OAAO,oBAAsB"}