@auth0/auth0-server-js 1.0.0

package/dist/index.cjs

@@ -0,0 +1,558 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AbstractStateStore: () => AbstractStateStore,
+  AbstractTransactionStore: () => AbstractTransactionStore,
+  BackchannelLogoutError: () => BackchannelLogoutError,
+  MissingRequiredArgumentError: () => MissingRequiredArgumentError,
+  MissingSessionError: () => MissingSessionError,
+  MissingTransactionError: () => MissingTransactionError,
+  ServerClient: () => ServerClient,
+  StartLinkUserError: () => StartLinkUserError
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var MissingTransactionError = class extends Error {
+  code = "missing_transaction_error";
+  constructor(message) {
+    super(message ?? "The transaction is missing.");
+    this.name = "MissingTransactionError";
+  }
+};
+var BackchannelLogoutError = class extends Error {
+  code = "backchannel_logout_error";
+  constructor(message) {
+    super(message);
+    this.name = "BackchannelLogoutError";
+  }
+};
+var StartLinkUserError = class extends Error {
+  code = "start_link_user_error";
+  constructor(message) {
+    super(message);
+    this.name = "StartLinkUserError";
+  }
+};
+var MissingRequiredArgumentError = class extends Error {
+  code = "missing_required_argument_error";
+  constructor(argument) {
+    super(`The argument '${argument}' is required but was not provided.`);
+    this.name = "MissingRequiredArgumentError";
+  }
+};
+var MissingSessionError = class extends Error {
+  code = "missing_session_error";
+  constructor(message) {
+    super(message);
+    this.name = "MissingSessionError";
+  }
+};
+
+// src/state/utils.ts
+function updateStateData(audience, stateDate, tokenEndpointResponse) {
+  if (stateDate) {
+    const isNewTokenSet = !stateDate.tokenSets.some(
+      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
+    );
+    const createUpdatedTokenSet = (response) => ({
+      audience,
+      accessToken: response.accessToken,
+      scope: response.scope,
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(response.expiresAt)
+    });
+    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)] : stateDate.tokenSets.map(
+      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(tokenEndpointResponse) : tokenSet
+    );
+    return {
+      ...stateDate,
+      idToken: tokenEndpointResponse.idToken,
+      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,
+      tokenSets
+    };
+  } else {
+    const user = tokenEndpointResponse.claims;
+    return {
+      user,
+      idToken: tokenEndpointResponse.idToken,
+      refreshToken: tokenEndpointResponse.refreshToken,
+      tokenSets: [
+        {
+          audience,
+          accessToken: tokenEndpointResponse.accessToken,
+          scope: tokenEndpointResponse.scope,
+          expiresAt: tokenEndpointResponse.expiresAt
+        }
+      ],
+      internal: {
+        sid: user?.sid,
+        createdAt: Math.floor(Date.now() / 1e3)
+      }
+    };
+  }
+}
+function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointResponse) {
+  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];
+  const isNewTokenSet = !stateDate.connectionTokenSets.some(
+    (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)
+  );
+  const connectionTokenSet = {
+    connection: options.connection,
+    loginHint: options.loginHint,
+    accessToken: tokenEndpointResponse.accessToken,
+    scope: tokenEndpointResponse.scope,
+    expiresAt: tokenEndpointResponse.expiresAt
+  };
+  const connectionTokenSets = isNewTokenSet ? [...stateDate.connectionTokenSets, connectionTokenSet] : stateDate.connectionTokenSets.map(
+    (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint) ? connectionTokenSet : tokenSet
+  );
+  return {
+    ...stateDate,
+    connectionTokenSets
+  };
+}
+
+// src/server-client.ts
+var import_auth0_auth_js = require("@auth0/auth0-auth-js");
+var ServerClient = class {
+  #options;
+  #transactionStore;
+  #transactionStoreIdentifier;
+  #stateStore;
+  #stateStoreIdentifier;
+  #authClient;
+  constructor(options) {
+    this.#options = options;
+    this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
+    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || "__a0_tx";
+    this.#transactionStore = options.transactionStore;
+    this.#stateStore = options.stateStore;
+    if (!this.#options.stateStore) {
+      throw new MissingRequiredArgumentError("stateStore");
+    }
+    if (!this.#options.transactionStore) {
+      throw new MissingRequiredArgumentError("transactionStore");
+    }
+    this.#authClient = new import_auth0_auth_js.AuthClient({
+      domain: this.#options.domain,
+      clientId: this.#options.clientId,
+      clientSecret: this.#options.clientSecret,
+      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
+      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
+      authorizationParams: this.#options.authorizationParams,
+      customFetch: this.#options.customFetch
+    });
+  }
+  /**
+   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
+   * @param options Optional options used to configure the interactive login process.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.
+   *
+   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
+   */
+  async startInteractiveLogin(options, storeOptions) {
+    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;
+    if (!redirectUri) {
+      throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
+    }
+    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({
+      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
+      authorizationParams: {
+        ...options?.authorizationParams,
+        redirect_uri: redirectUri
+      }
+    });
+    const transactionState = {
+      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
+      codeVerifier
+    };
+    if (options?.appState) {
+      transactionState.appState = options.appState;
+    }
+    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);
+    return authorizationUrl;
+  }
+  /**
+   * Completes the interactive login process.
+   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.
+   * @param url The URl from which the query params should be extracted to exchange for a token.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {MissingTransactionError} When no transaction was found.
+   * @throws {TokenByCodeError} If there was an issue requesting the access token.
+   *
+   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
+   */
+  async completeInteractiveLogin(url, storeOptions) {
+    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);
+    if (!transactionData) {
+      throw new MissingTransactionError();
+    }
+    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {
+      codeVerifier: transactionData.codeVerifier
+    });
+    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse);
+    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
+    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
+    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails };
+  }
+  /**
+   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
+   * @param options Options used to configure the user linking process.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {MissingSessionError} If there is no active session.
+   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.
+   *
+   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
+   */
+  async startLinkUser(options, storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    if (!stateData || !stateData.idToken) {
+      throw new MissingSessionError(
+        "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
+      );
+    }
+    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({
+      connection: options.connection,
+      connectionScope: options.connectionScope,
+      idToken: stateData.idToken,
+      authorizationParams: options.authorizationParams
+    });
+    const transactionState = {
+      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
+      codeVerifier
+    };
+    if (options?.appState) {
+      transactionState.appState = options.appState;
+    }
+    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);
+    return linkUserUrl;
+  }
+  /**
+   * Completes the user linking process.
+   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.
+   * @param url The URl from which the query params should be extracted to exchange for a token.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {MissingTransactionError} When no transaction was found.
+   * @throws {TokenByCodeError} If there was an issue requesting the access token.
+   *
+   * @returns A promise resolving to an object, containing the original appState (if present).
+   */
+  async completeLinkUser(url, storeOptions) {
+    const result = await this.completeInteractiveLogin(url, storeOptions);
+    return {
+      appState: result.appState
+    };
+  }
+  /**
+   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.
+   * @param options Options used to configure the user unlinking process.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {MissingSessionError} If there is no active session.
+   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.
+   *
+   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
+   */
+  async startUnlinkUser(options, storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    if (!stateData || !stateData.idToken) {
+      throw new MissingSessionError(
+        "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
+      );
+    }
+    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({
+      connection: options.connection,
+      idToken: stateData.idToken,
+      authorizationParams: options.authorizationParams
+    });
+    const transactionState = {
+      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
+      codeVerifier
+    };
+    if (options?.appState) {
+      transactionState.appState = options.appState;
+    }
+    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);
+    return unlinkUserUrl;
+  }
+  /**
+   * Completes the user unlinking process.
+   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.
+   * @param url The URl from which the query params should be extracted to exchange for a token.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {MissingTransactionError} When no transaction was found.
+   * @throws {TokenByCodeError} If there was an issue requesting the access token.
+   *
+   * @returns A promise resolving to an object, containing the original appState (if present).
+   */
+  async completeUnlinkUser(url, storeOptions) {
+    const result = await this.completeInteractiveLogin(url, storeOptions);
+    return {
+      appState: result.appState
+    };
+  }
+  /**
+   * Logs in using Client-Initiated Backchannel Authentication.
+   *
+   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.
+   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow
+   * @param options Options used to configure the backchannel login process.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.
+   *
+   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
+   */
+  async loginBackchannel(options, storeOptions) {
+    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({
+      bindingMessage: options.bindingMessage,
+      loginHint: options.loginHint,
+      authorizationParams: options.authorizationParams
+    });
+    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const stateData = updateStateData(
+      this.#options.authorizationParams?.audience ?? "default",
+      existingStateData,
+      tokenEndpointResponse
+    );
+    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
+    return {
+      authorizationDetails: tokenEndpointResponse.authorizationDetails
+    };
+  }
+  /**
+   * Retrieves the user from the store, or undefined if no user found.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   * @returns The user, or undefined if no user found in the store.
+   */
+  async getUser(storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    return stateData?.user;
+  }
+  /**
+   * Retrieve the user session from the store, or undefined if no session found.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   * @returns The sessionm or undefined if no session found in the store.
+   */
+  async getSession(storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    if (stateData) {
+      const { internal, ...sessionData } = stateData;
+      return sessionData;
+    }
+  }
+  /**
+   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.
+   * Also updates the store when a new token was retrieved from Auth0.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.
+   *
+   * @returns The Token Set, containing the access token, as well as additional information.
+   */
+  async getAccessToken(storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const audience = this.#options.authorizationParams?.audience ?? "default";
+    const scope = this.#options.authorizationParams?.scope;
+    const tokenSet = stateData?.tokenSets.find(
+      (tokenSet2) => tokenSet2.audience === audience && (!scope || tokenSet2.scope === scope)
+    );
+    if (tokenSet && tokenSet.expiresAt > Date.now() / 1e3) {
+      return tokenSet;
+    }
+    if (!stateData?.refreshToken) {
+      throw new import_auth0_auth_js.TokenByRefreshTokenError(
+        "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
+      );
+    }
+    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({
+      refreshToken: stateData.refreshToken
+    });
+    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);
+    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
+    return {
+      accessToken: tokenEndpointResponse.accessToken,
+      scope: tokenEndpointResponse.scope,
+      expiresAt: tokenEndpointResponse.expiresAt,
+      audience
+    };
+  }
+  /**
+   * Retrieves an access token for a connection.
+   *
+   * This method attempts to obtain an access token for a specified connection.
+   * It first checks if a refresh token exists in the store.
+   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating
+   * that the refresh token was not found.
+   *
+   * @param options - Options for retrieving an access token for a connection.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.
+   *
+   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.
+   */
+  async getAccessTokenForConnection(options, storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const connectionTokenSet = stateData?.connectionTokenSets?.find(
+      (tokenSet) => tokenSet.connection === options.connection
+    );
+    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1e3) {
+      return connectionTokenSet;
+    }
+    if (!stateData?.refreshToken) {
+      throw new import_auth0_auth_js.TokenForConnectionError(
+        "A refresh token was not found but is required to be able to retrieve an access token for a connection."
+      );
+    }
+    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({
+      connection: options.connection,
+      loginHint: options.loginHint,
+      refreshToken: stateData.refreshToken
+    });
+    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);
+    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
+    return {
+      accessToken: tokenEndpointResponse.accessToken,
+      scope: tokenEndpointResponse.scope,
+      expiresAt: tokenEndpointResponse.expiresAt,
+      connection: options.connection,
+      loginHint: options.loginHint
+    };
+  }
+  /**
+   * Logs the user out and returns a URL to redirect the user-agent to after they log out.
+   * @param options Options used to configure the logout process.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   * @returns {URL}
+   */
+  async logout(options, storeOptions) {
+    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+    return this.#authClient.buildLogoutUrl(options);
+  }
+  /**
+   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
+   * @param logoutToken The logout token to verify and use to delete the session from the store.
+   * @param storeOptions Optional options used to pass to the Transaction and State Store.
+   *
+   * @throws {BackchannelLogoutError} If the logout token is missing.
+   * @throws {VerifyLogoutTokenError} If the logout token is invalid.
+   */
+  async handleBackchannelLogout(logoutToken, storeOptions) {
+    if (!logoutToken) {
+      throw new BackchannelLogoutError("Missing Logout Token");
+    }
+    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });
+    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
+  }
+};
+
+// src/encryption/index.ts
+var import_jose = require("jose");
+var ENC = "A256CBC-HS512";
+var ALG = "dir";
+var DIGEST = "SHA-256";
+var BIT_LENGTH = 512;
+var HKDF_INFO = "derived cookie encryption secret";
+var encoder;
+async function deriveEncryptionSecret(secret, salt, kid) {
+  encoder ||= new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveBits"]);
+  return new Uint8Array(
+    await crypto.subtle.deriveBits(
+      {
+        name: "HKDF",
+        hash: DIGEST,
+        info: encoder.encode(HKDF_INFO),
+        salt: encoder.encode(`${salt}${kid}`)
+      },
+      key,
+      BIT_LENGTH
+    )
+  );
+}
+async function encrypt(payload, secret, salt, expiration) {
+  const kid = crypto.randomUUID();
+  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);
+  return await new import_jose.EncryptJWT(payload).setProtectedHeader({ enc: ENC, alg: ALG, kid }).setExpirationTime(expiration).encrypt(encryptionSecret);
+}
+async function decrypt(value, secret, salt) {
+  const res = await (0, import_jose.jwtDecrypt)(
+    value,
+    async (protectedHeader) => {
+      if (!protectedHeader.kid) {
+        throw new Error('Missing "kid" in JWE header');
+      }
+      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);
+    },
+    { clockTolerance: 15 }
+  );
+  return res.payload;
+}
+
+// src/store/abstract-store.ts
+var AbstractStore = class {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  async encrypt(identifier, stateData, expiration) {
+    return await encrypt(stateData, this.options.secret, identifier, expiration);
+  }
+  async decrypt(identifier, encryptedStateData) {
+    return await decrypt(encryptedStateData, this.options.secret, identifier);
+  }
+};
+
+// src/store/abstract-state-store.ts
+var AbstractStateStore = class extends AbstractStore {
+  constructor(options) {
+    super(options);
+  }
+};
+
+// src/store/abstract-transaction-store.ts
+var AbstractTransactionStore = class extends AbstractStore {
+  constructor(options) {
+    super(options);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AbstractStateStore,
+  AbstractTransactionStore,
+  BackchannelLogoutError,
+  MissingRequiredArgumentError,
+  MissingSessionError,
+  MissingTransactionError,
+  ServerClient,
+  StartLinkUserError
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts"],"sourcesContent":["export { ServerClient } from './server-client.js';\nexport { AbstractStateStore } from './store/abstract-state-store.js';\nexport { AbstractTransactionStore } from './store/abstract-transaction-store.js';\nexport * from './errors.js';\nexport * from './types.js';","/**\n * Error thrown when there is no transaction available.\n */\nexport class MissingTransactionError extends Error {\n  public code: string = 'missing_transaction_error';\n\n  constructor(message?: string) {\n    super(message ?? 'The transaction is missing.');\n    this.name = 'MissingTransactionError';\n  }\n}\n\n\n/**\n * Error thrown when backchannel logout fails.\n */\nexport class BackchannelLogoutError extends Error {\n  public code: string = 'backchannel_logout_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'BackchannelLogoutError';\n  }\n}\n\n/**\n * Error thrown when starting the user-linking failed.\n */\nexport class StartLinkUserError extends Error {\n  public code: string = 'start_link_user_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'StartLinkUserError';\n  }\n}\n\n/**\n * Error thrown when a required argument is missing.\n */\nexport class MissingRequiredArgumentError extends Error {\n  public code: string = 'missing_required_argument_error';\n\n  constructor(argument: string) {\n    super(`The argument '${argument}' is required but was not provided.`);\n    this.name = 'MissingRequiredArgumentError';\n  }\n}\n\n/**\n * Error thrown when a session is missing.\n */\nexport class MissingSessionError extends Error {\n  public code: string = 'missing_session_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'MissingSessionError';\n  }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/**\n * Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n */\nexport function updateStateData(\n  audience: string,\n  stateDate: StateData | undefined,\n  tokenEndpointResponse: TokenResponse\n): StateData {\n  if (stateDate) {\n    const isNewTokenSet = !stateDate.tokenSets.some(\n      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n    );\n\n    const createUpdatedTokenSet = (response: TokenResponse) => ({\n      audience,\n      accessToken: response.accessToken,\n      scope: response.scope,\n      expiresAt: Math.floor(Date.now() / 1000) + Number(response.expiresAt),\n    });\n\n    const tokenSets = isNewTokenSet\n      ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)]\n      : stateDate.tokenSets.map((tokenSet) =>\n          tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n            ? createUpdatedTokenSet(tokenEndpointResponse)\n            : tokenSet\n        );\n\n    return {\n      ...stateDate,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n      tokenSets,\n    };\n  } else {\n    const user = tokenEndpointResponse.claims;\n    return {\n      user,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken,\n      tokenSets: [\n        {\n          audience,\n          accessToken: tokenEndpointResponse.accessToken,\n          scope: tokenEndpointResponse.scope,\n          expiresAt:tokenEndpointResponse.expiresAt,\n        },\n      ],\n      internal: {\n        sid: user?.sid as string,\n        createdAt: Math.floor(Date.now() / 1000),\n      },\n    };\n  }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n  options: AccessTokenForConnectionOptions,\n  stateDate: StateData,\n  tokenEndpointResponse: TokenResponse\n) {\n  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];\n\n  const isNewTokenSet = !stateDate.connectionTokenSets.some(\n    (tokenSet) =>\n      tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n  );\n\n  const connectionTokenSet = {\n    connection: options.connection,\n    loginHint: options.loginHint,\n    accessToken: tokenEndpointResponse.accessToken,\n    scope: tokenEndpointResponse.scope,\n    expiresAt: tokenEndpointResponse.expiresAt,\n  };\n\n  const connectionTokenSets = isNewTokenSet\n    ? [...stateDate.connectionTokenSets, connectionTokenSet]\n    : stateDate.connectionTokenSets.map((tokenSet) =>\n        tokenSet.connection === options.connection &&\n        (!options.loginHint || tokenSet.loginHint === options.loginHint)\n          ? connectionTokenSet\n          : tokenSet\n      );\n\n  return {\n    ...stateDate,\n    connectionTokenSets,\n  };\n}\n","import {\n  AccessTokenForConnectionOptions,\n  ConnectionTokenSet,\n  LoginBackchannelOptions,\n  LoginBackchannelResult,\n  LogoutOptions,\n  ServerClientOptions,\n  SessionData,\n  StartInteractiveLoginOptions,\n  StartLinkUserOptions,\n  StartUnlinkUserOptions,\n  StateStore,\n  TokenSet,\n  TransactionData,\n  TransactionStore,\n} from './types.js';\nimport {\n  BackchannelLogoutError,\n  MissingRequiredArgumentError,\n  MissingSessionError,\n  MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n  TokenForConnectionError,\n  AuthClient,\n  AuthorizationDetails,\n  TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n  readonly #options: ServerClientOptions<TStoreOptions>;\n  readonly #transactionStore: TransactionStore<TStoreOptions>;\n  readonly #transactionStoreIdentifier: string;\n  readonly #stateStore: StateStore<TStoreOptions>;\n  readonly #stateStoreIdentifier: string;\n  readonly #authClient: AuthClient;\n\n  constructor(options: ServerClientOptions<TStoreOptions>) {\n    this.#options = options;\n    this.#stateStoreIdentifier = this.#options.stateIdentifier || '__a0_session';\n    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || '__a0_tx';\n    this.#transactionStore = options.transactionStore;\n    this.#stateStore = options.stateStore;\n\n    if (!this.#options.stateStore) {\n      throw new MissingRequiredArgumentError('stateStore');\n    }\n\n    if (!this.#options.transactionStore) {\n      throw new MissingRequiredArgumentError('transactionStore');\n    }\n\n    this.#authClient = new AuthClient({\n      domain: this.#options.domain,\n      clientId: this.#options.clientId,\n      clientSecret: this.#options.clientSecret,\n      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n      authorizationParams: this.#options.authorizationParams,\n      customFetch: this.#options.customFetch,\n    });\n  }\n\n  /**\n   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Optional options used to configure the interactive login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n    if (!redirectUri) {\n      throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n    }\n\n    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({\n      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n      authorizationParams: {\n        ...options?.authorizationParams,\n        redirect_uri: redirectUri,\n      },\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return authorizationUrl;\n  }\n\n  /**\n   * Completes the interactive login process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n   */\n  public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n    if (!transactionData) {\n      throw new MissingTransactionError();\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {\n      codeVerifier: transactionData.codeVerifier,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n      appState?: TAppState;\n      authorizationDetails?: AuthorizationDetails[];\n    };\n  }\n\n  /**\n   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Options used to configure the user linking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n      );\n    }\n\n    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({\n      connection: options.connection,\n      connectionScope: options.connectionScope,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return linkUserUrl;\n  }\n\n  /**\n   * Completes the user linking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n   * @param options Options used to configure the user unlinking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n      );\n    }\n\n    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({\n      connection: options.connection,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return unlinkUserUrl;\n  }\n\n  /**\n   * Completes the user unlinking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Logs in using Client-Initiated Backchannel Authentication.\n   *\n   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n   * @param options Options used to configure the backchannel login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n   *\n   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n   */\n  public async loginBackchannel(\n    options: LoginBackchannelOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginBackchannelResult> {\n    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({\n      bindingMessage: options.bindingMessage,\n      loginHint: options.loginHint,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return {\n      authorizationDetails: tokenEndpointResponse.authorizationDetails,\n    };\n  }\n\n  /**\n   * Retrieves the user from the store, or undefined if no user found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The user, or undefined if no user found in the store.\n   */\n  public async getUser(storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    return stateData?.user;\n  }\n\n  /**\n   * Retrieve the user session from the store, or undefined if no session found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The sessionm or undefined if no session found in the store.\n   */\n  public async getSession(storeOptions?: TStoreOptions): Promise<SessionData | undefined> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (stateData) {\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { internal, ...sessionData } = stateData;\n      return sessionData;\n    }\n  }\n\n  /**\n   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n   * Also updates the store when a new token was retrieved from Auth0.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Token Set, containing the access token, as well as additional information.\n   */\n  public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const audience = this.#options.authorizationParams?.audience ?? 'default';\n    const scope = this.#options.authorizationParams?.scope;\n\n    const tokenSet = stateData?.tokenSets.find(\n      (tokenSet) => tokenSet.audience === audience && (!scope || tokenSet.scope === scope)\n    );\n\n    if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n      return tokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenByRefreshTokenError(\n        'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({\n      refreshToken: stateData.refreshToken,\n    });\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      audience: audience,\n    };\n  }\n\n  /**\n   * Retrieves an access token for a connection.\n   *\n   * This method attempts to obtain an access token for a specified connection.\n   * It first checks if a refresh token exists in the store.\n   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n   * that the refresh token was not found.\n   *\n   * @param options - Options for retrieving an access token for a connection.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n   */\n  public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const connectionTokenSet = stateData?.connectionTokenSets?.find(\n      (tokenSet) => tokenSet.connection === options.connection\n    );\n\n    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n      return connectionTokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenForConnectionError(\n        'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({\n      connection: options.connection,\n      loginHint: options.loginHint,\n      refreshToken: stateData.refreshToken,\n    });\n\n    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      connection: options.connection,\n      loginHint: options.loginHint,\n    };\n  }\n\n  /**\n   * Logs the user out and returns a URL to redirect the user-agent to after they log out.\n   * @param options Options used to configure the logout process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns {URL}\n   */\n  public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n    return this.#authClient.buildLogoutUrl(options);\n  }\n\n  /**\n   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n   * @param logoutToken The logout token to verify and use to delete the session from the store.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelLogoutError} If the logout token is missing.\n   * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n   */\n  public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n    if (!logoutToken) {\n      throw new BackchannelLogoutError('Missing Logout Token');\n    }\n\n    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });\n\n    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n  }\n}\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder | undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n  encoder ||= new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n  return new Uint8Array(\n    await crypto.subtle.deriveBits(\n      {\n        name: 'HKDF',\n        hash: DIGEST,\n        info: encoder.encode(HKDF_INFO),\n        salt: encoder.encode(`${salt}${kid}`),\n      } as HkdfParams,\n      key,\n      BIT_LENGTH\n    )\n  );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n  const kid = crypto.randomUUID();\n  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n  return await new EncryptJWT(payload)\n    .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n    .setExpirationTime(expiration)\n    .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n  const res = await jwtDecrypt<T>(\n    value,\n    async (protectedHeader) => {\n\n      // This error shouldn't happen, as we always set a kid.\n      // However, leaving this here as a safety net.\n      if (!protectedHeader.kid) {\n        throw new Error('Missing \"kid\" in JWE header');\n      }\n\n      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n    },\n    { clockTolerance: 15 }\n  );\n  return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n  protected readonly options: EncryptedStoreOptions;\n\n  constructor(options: EncryptedStoreOptions) {\n    this.options = options;\n  }\n\n  abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;\n  abstract get(identifier: string, options?: TStoreOptions | undefined): Promise<TData | undefined>;\n  abstract delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;\n\n  protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n    return await encrypt(stateData, this.options.secret, identifier, expiration);\n  }\n\n  protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n    return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n  }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n\n  abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACjDO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,wBAAwB,CAAC,cAA6B;AAAA,MAC1D;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,OAAO,SAAS;AAAA,MAChB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,OAAO,SAAS,SAAS;AAAA,IACtE;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,qBAAqB,CAAC,IACrE,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,qBAAqB,IAC3C;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT;AAAA,UACE;AAAA,UACA,aAAa,sBAAsB;AAAA,UACnC,OAAO,sBAAsB;AAAA,UAC7B,WAAU,sBAAsB;AAAA,QAClC;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAC/B,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAClD,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA,2BAKO;AAEA,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,cAAc,IAAI,gCAAW;AAAA,MAChC,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACtF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,eAAe,KAAK;AAAA,MACvE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,YAAY,iBAAiB;AAAA,MAC5E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,YAAY,mBAAmB;AAAA,MAChF,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,YAAY,0BAA0B;AAAA,MAC7E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAASA,UAAS,UAAU;AAAA,IAChF;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,uBAAuB;AAAA,MAC1E,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACzE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,YAAY,eAAe,OAAO;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,YAAY,kBAAkB,EAAE,YAAY,CAAC;AAElF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AC9bA,kBAAuC;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,uBAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,UAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;","names":["tokenSet"]}