npm - @auth0/auth0-server-js - Versions diffs - 1.0.2 → 1.1.0 - Mend

@auth0/auth0-server-js 1.0.2 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/index.cjs CHANGED Viewed

@@ -136,13 +136,34 @@ function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointR
 // src/server-client.ts
 var import_auth0_auth_js = require("@auth0/auth0-auth-js");
+// src/utils.ts
+var compareScopes = (scopes, requiredScopes) => {
+  if (scopes === requiredScopes) {
+    return true;
+  }
+  if (!scopes || !requiredScopes) {
+    return false;
+  }
+  const scopesSet = new Set(scopes.trim().split(" ").filter(Boolean));
+  const requiredScopesArray = requiredScopes.trim().split(" ").filter(Boolean);
+  return requiredScopesArray.every((scope) => scopesSet.has(scope));
+};
+// src/server-client.ts
 var ServerClient = class {
   #options;
   #transactionStore;
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
-  #authClient;
+  /**
+   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+   *
+   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+   */
+  authClient;
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -155,14 +176,15 @@ var ServerClient = class {
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
-    this.#authClient = new import_auth0_auth_js.AuthClient({
+    this.authClient = new import_auth0_auth_js.AuthClient({
       domain: this.#options.domain,
       clientId: this.#options.clientId,
       clientSecret: this.#options.clientSecret,
       clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
-      customFetch: this.#options.customFetch
+      customFetch: this.#options.customFetch,
+      useMtls: this.#options.useMtls
     });
   }
   /**
@@ -179,7 +201,7 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
-    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({
+    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
@@ -212,7 +234,7 @@ var ServerClient = class {
     if (!transactionData) {
       throw new MissingTransactionError();
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {
+    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {
       codeVerifier: transactionData.codeVerifier
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -238,7 +260,7 @@ var ServerClient = class {
         "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
       );
     }
-    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({
+    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({
       connection: options.connection,
       connectionScope: options.connectionScope,
       idToken: stateData.idToken,
@@ -288,7 +310,7 @@ var ServerClient = class {
         "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
       );
     }
-    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({
+    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({
       connection: options.connection,
       idToken: stateData.idToken,
       authorizationParams: options.authorizationParams
@@ -333,7 +355,7 @@ var ServerClient = class {
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
   async loginBackchannel(options, storeOptions) {
-    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({
+    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
       authorizationParams: options.authorizationParams
@@ -384,7 +406,7 @@ var ServerClient = class {
     const audience = this.#options.authorizationParams?.audience ?? "default";
     const scope = this.#options.authorizationParams?.scope;
     const tokenSet = stateData?.tokenSets.find(
-      (tokenSet2) => tokenSet2.audience === audience && (!scope || tokenSet2.scope === scope)
+      (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
     if (tokenSet && tokenSet.expiresAt > Date.now() / 1e3) {
       return tokenSet;
@@ -394,7 +416,7 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({
+    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({
       refreshToken: stateData.refreshToken
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -435,7 +457,7 @@ var ServerClient = class {
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({
+    const tokenEndpointResponse = await this.authClient.getTokenForConnection({
       connection: options.connection,
       loginHint: options.loginHint,
       refreshToken: stateData.refreshToken
@@ -458,7 +480,7 @@ var ServerClient = class {
    */
   async logout(options, storeOptions) {
     await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
-    return this.#authClient.buildLogoutUrl(options);
+    return this.authClient.buildLogoutUrl(options);
   }
   /**
    * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
@@ -472,7 +494,7 @@ var ServerClient = class {
     if (!logoutToken) {
       throw new BackchannelLogoutError("Missing Logout Token");
     }
-    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });
+    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });
     await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
   }
 };
@@ -671,18 +693,20 @@ var StatefulStateStore = class extends AbstractSessionStore {
 // src/store/stateless-state-store.ts
 var StatelessStateStore = class extends AbstractSessionStore {
+  #cookieOptions;
   #cookieHandler;
   constructor(options, cookieHandler) {
     super(options);
+    this.#cookieOptions = options.cookie;
     this.#cookieHandler = cookieHandler;
   }
   async set(identifier, stateData, removeIfExists, options) {
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
     const cookieOpts = {
       httpOnly: true,
-      sameSite: "lax",
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
       path: "/",
-      secure: true,
+      secure: this.#cookieOptions?.secure ?? true,
       maxAge
     };
     const expiration = Math.floor(Date.now() / 1e3 + maxAge);

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["export { ServerClient } from './server-client.js';\nexport { AbstractStateStore } from './store/abstract-state-store.js';\nexport { AbstractTransactionStore } from './store/abstract-transaction-store.js';\n\nexport type { CookieHandler, CookieSerializeOptions } from './store/cookie-handler.js';\nexport { CookieTransactionStore } from './store/cookie-transaction-store.js';\n\nexport { StatefulStateStore } from './store/stateful-state-store.js';\nexport type { StatefulStateStoreOptions } from './store/stateful-state-store.js';\nexport { StatelessStateStore } from './store/stateless-state-store.js';\n\nexport * from './errors.js';\nexport * from './types.js';\n","/*\n Error thrown when there is no transaction available.\n /\nexport class MissingTransactionError extends Error {\n public code: string = 'missing_transaction_error';\n\n constructor(message?: string) {\n super(message ?? 'The transaction is missing.');\n this.name = 'MissingTransactionError';\n }\n}\n\n\n/\n Error thrown when backchannel logout fails.\n /\nexport class BackchannelLogoutError extends Error {\n public code: string = 'backchannel_logout_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'BackchannelLogoutError';\n }\n}\n\n/\n Error thrown when starting the user-linking failed.\n /\nexport class StartLinkUserError extends Error {\n public code: string = 'start_link_user_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'StartLinkUserError';\n }\n}\n\n/\n Error thrown when a required argument is missing.\n /\nexport class MissingRequiredArgumentError extends Error {\n public code: string = 'missing_required_argument_error';\n\n constructor(argument: string) {\n super(`The argument '${argument}' is required but was not provided.`);\n this.name = 'MissingRequiredArgumentError';\n }\n}\n\n/\n Error thrown when a session is missing.\n /\nexport class MissingSessionError extends Error {\n public code: string = 'missing_session_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'MissingSessionError';\n }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/\n Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n /\nexport function updateStateData(\n audience: string,\n stateDate: StateData \| undefined,\n tokenEndpointResponse: TokenResponse\n): StateData {\n if (stateDate) {\n const isNewTokenSet = !stateDate.tokenSets.some(\n (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n );\n\n const createUpdatedTokenSet = (response: TokenResponse) => ({\n audience,\n accessToken: response.accessToken,\n scope: response.scope,\n expiresAt: Math.floor(Date.now() / 1000) + Number(response.expiresAt),\n });\n\n const tokenSets = isNewTokenSet\n ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)]\n : stateDate.tokenSets.map((tokenSet) =>\n tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n ? createUpdatedTokenSet(tokenEndpointResponse)\n : tokenSet\n );\n\n return {\n ...stateDate,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n tokenSets,\n };\n } else {\n const user = tokenEndpointResponse.claims;\n return {\n user,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken,\n tokenSets: [\n {\n audience,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt:tokenEndpointResponse.expiresAt,\n },\n ],\n internal: {\n sid: user?.sid as string,\n createdAt: Math.floor(Date.now() / 1000),\n },\n };\n }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n options: AccessTokenForConnectionOptions,\n stateDate: StateData,\n tokenEndpointResponse: TokenResponse\n) {\n stateDate.connectionTokenSets = stateDate.connectionTokenSets \|\| [];\n\n const isNewTokenSet = !stateDate.connectionTokenSets.some(\n (tokenSet) =>\n tokenSet.connection === options.connection && (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n );\n\n const connectionTokenSet = {\n connection: options.connection,\n loginHint: options.loginHint,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n };\n\n const connectionTokenSets = isNewTokenSet\n ? [...stateDate.connectionTokenSets, connectionTokenSet]\n : stateDate.connectionTokenSets.map((tokenSet) =>\n tokenSet.connection === options.connection &&\n (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n ? connectionTokenSet\n : tokenSet\n );\n\n return {\n ...stateDate,\n connectionTokenSets,\n };\n}\n","import {\n AccessTokenForConnectionOptions,\n ConnectionTokenSet,\n LoginBackchannelOptions,\n LoginBackchannelResult,\n LogoutOptions,\n ServerClientOptions,\n SessionData,\n StartInteractiveLoginOptions,\n StartLinkUserOptions,\n StartUnlinkUserOptions,\n StateStore,\n TokenSet,\n TransactionData,\n TransactionStore,\n} from './types.js';\nimport {\n BackchannelLogoutError,\n MissingRequiredArgumentError,\n MissingSessionError,\n MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n TokenForConnectionError,\n AuthClient,\n AuthorizationDetails,\n TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n readonly #options: ServerClientOptions<TStoreOptions>;\n readonly #transactionStore: TransactionStore<TStoreOptions>;\n readonly #transactionStoreIdentifier: string;\n readonly #stateStore: StateStore<TStoreOptions>;\n readonly #stateStoreIdentifier: string;\n readonly #authClient: AuthClient;\n\n constructor(options: ServerClientOptions<TStoreOptions>) {\n this.#options = options;\n this.#stateStoreIdentifier = this.#options.stateIdentifier \|\| '__a0_session';\n this.#transactionStoreIdentifier = this.#options.transactionIdentifier \|\| '__a0_tx';\n this.#transactionStore = options.transactionStore;\n this.#stateStore = options.stateStore;\n\n if (!this.#options.stateStore) {\n throw new MissingRequiredArgumentError('stateStore');\n }\n\n if (!this.#options.transactionStore) {\n throw new MissingRequiredArgumentError('transactionStore');\n }\n\n this.#authClient = new AuthClient({\n domain: this.#options.domain,\n clientId: this.#options.clientId,\n clientSecret: this.#options.clientSecret,\n clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n authorizationParams: this.#options.authorizationParams,\n customFetch: this.#options.customFetch,\n });\n }\n\n /\n Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Optional options used to configure the interactive login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n if (!redirectUri) {\n throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n }\n\n const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({\n pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n authorizationParams: {\n ...options?.authorizationParams,\n redirect_uri: redirectUri,\n },\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return authorizationUrl;\n }\n\n /\n Completes the interactive login process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n /\n public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n if (!transactionData) {\n throw new MissingTransactionError();\n }\n\n const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {\n codeVerifier: transactionData.codeVerifier,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n appState?: TAppState;\n authorizationDetails?: AuthorizationDetails[];\n };\n }\n\n /\n Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Options used to configure the user linking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n );\n }\n\n const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({\n connection: options.connection,\n connectionScope: options.connectionScope,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return linkUserUrl;\n }\n\n /\n Completes the user linking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n * @param options Options used to configure the user unlinking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n );\n }\n\n const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({\n connection: options.connection,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return unlinkUserUrl;\n }\n\n /\n Completes the user unlinking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Logs in using Client-Initiated Backchannel Authentication.\n \n Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n * @param options Options used to configure the backchannel login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n \n @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n /\n public async loginBackchannel(\n options: LoginBackchannelOptions,\n storeOptions?: TStoreOptions\n ): Promise<LoginBackchannelResult> {\n const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({\n bindingMessage: options.bindingMessage,\n loginHint: options.loginHint,\n authorizationParams: options.authorizationParams,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(\n this.#options.authorizationParams?.audience ?? 'default',\n existingStateData,\n tokenEndpointResponse\n );\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n return {\n authorizationDetails: tokenEndpointResponse.authorizationDetails,\n };\n }\n\n /\n Retrieves the user from the store, or undefined if no user found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The user, or undefined if no user found in the store.\n /\n public async getUser(storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n return stateData?.user;\n }\n\n /\n Retrieve the user session from the store, or undefined if no session found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The sessionm or undefined if no session found in the store.\n /\n public async getSession(storeOptions?: TStoreOptions): Promise<SessionData \| undefined> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (stateData) {\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n const { internal, ...sessionData } = stateData;\n return sessionData;\n }\n }\n\n /\n Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n * Also updates the store when a new token was retrieved from Auth0.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Token Set, containing the access token, as well as additional information.\n /\n public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const audience = this.#options.authorizationParams?.audience ?? 'default';\n const scope = this.#options.authorizationParams?.scope;\n\n const tokenSet = stateData?.tokenSets.find(\n (tokenSet) => tokenSet.audience === audience && (!scope \|\| tokenSet.scope === scope)\n );\n\n if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n return tokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenByRefreshTokenError(\n 'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n );\n }\n\n const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({\n refreshToken: stateData.refreshToken,\n });\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n audience: audience,\n };\n }\n\n /\n Retrieves an access token for a connection.\n \n This method attempts to obtain an access token for a specified connection.\n * It first checks if a refresh token exists in the store.\n * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n * that the refresh token was not found.\n \n @param options - Options for retrieving an access token for a connection.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n /\n public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const connectionTokenSet = stateData?.connectionTokenSets?.find(\n (tokenSet) => tokenSet.connection === options.connection\n );\n\n if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n return connectionTokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenForConnectionError(\n 'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n );\n }\n\n const tokenEndpointResponse = await this.#authClient.getTokenForConnection({\n connection: options.connection,\n loginHint: options.loginHint,\n refreshToken: stateData.refreshToken,\n });\n\n const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n connection: options.connection,\n loginHint: options.loginHint,\n };\n }\n\n /\n Logs the user out and returns a URL to redirect the user-agent to after they log out.\n * @param options Options used to configure the logout process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns {URL}\n /\n public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n return this.#authClient.buildLogoutUrl(options);\n }\n\n /\n Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n * @param logoutToken The logout token to verify and use to delete the session from the store.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelLogoutError} If the logout token is missing.\n * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n /\n public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n if (!logoutToken) {\n throw new BackchannelLogoutError('Missing Logout Token');\n }\n\n const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });\n\n await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n }\n}\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder \| undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n encoder \|\|= new TextEncoder();\n const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n return new Uint8Array(\n await crypto.subtle.deriveBits(\n {\n name: 'HKDF',\n hash: DIGEST,\n info: encoder.encode(HKDF_INFO),\n salt: encoder.encode(`${salt}${kid}`),\n } as HkdfParams,\n key,\n BIT_LENGTH\n )\n );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n const kid = crypto.randomUUID();\n const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n return await new EncryptJWT(payload)\n .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n .setExpirationTime(expiration)\n .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n const res = await jwtDecrypt<T>(\n value,\n async (protectedHeader) => {\n\n // This error shouldn't happen, as we always set a kid.\n // However, leaving this here as a safety net.\n if (!protectedHeader.kid) {\n throw new Error('Missing \"kid\" in JWE header');\n }\n\n return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n },\n { clockTolerance: 15 }\n );\n return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n protected readonly options: EncryptedStoreOptions;\n\n constructor(options: EncryptedStoreOptions) {\n this.options = options;\n }\n\n abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions \| undefined): Promise<void>;\n abstract get(identifier: string, options?: TStoreOptions \| undefined): Promise<TData \| undefined>;\n abstract delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void>;\n\n protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n return await encrypt(stateData, this.options.secret, identifier, expiration);\n }\n\n protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n\n abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n transactionData: TransactionData,\n removeIfExists?: boolean,\n options?: TStoreOptions\n ): Promise<void> { \n const maxAge = 60 60;\n const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions): Promise<TransactionData \| undefined> {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n if (cookieValue) {\n return await this.decrypt(identifier, cookieValue);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n readonly #rolling: boolean;\n readonly #absoluteDuration: number;\n readonly #inactivityDuration: number;\n\n constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n super(options);\n\n this.#rolling = options.rolling ?? true;\n this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n }\n\n /*\n calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n /\n protected calculateMaxAge(createdAt: number) {\n if (!this.#rolling) {\n return this.#absoluteDuration;\n }\n\n const now = (Date.now() / 1000) \| 0;\n const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n const maxAge = expiresAt - now;\n\n return maxAge > 0 ? maxAge : 0;\n }\n}","import type {\n EncryptedStoreOptions,\n LogoutTokenClaims,\n SessionConfiguration,\n SessionCookieOptions,\n SessionStore,\n StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n const bytes = new Uint8Array(16);\n crypto.getRandomValues(bytes);\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #store: SessionStore<TStoreOptions>;\n readonly #cookieOptions: SessionCookieOptions \| undefined;\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(\n options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n cookieHandler: CookieHandler<TStoreOptions>\n ) {\n super(options);\n\n this.#store = options.store;\n this.#cookieOptions = options.cookie;\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n let sessionId = await this.getSessionId(identifier, options);\n\n // if this is a new session created by a new login we need to remove the old session\n // from the store and regenerate the session ID to prevent session fixation.\n if (sessionId && removeIfExists) {\n await this.#store.delete(sessionId);\n sessionId = generateId();\n }\n\n sessionId ??= generateId();\n\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n path: '/',\n secure: this.#cookieOptions?.secure,\n maxAge,\n };\n const expiration = Date.now() / 1000 + maxAge;\n const encryptedStateData = await this.encrypt<{ id: string }>(\n identifier,\n {\n id: sessionId,\n },\n expiration\n );\n\n await this.#store.set(sessionId, stateData);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n const stateData = await this.#store.get(sessionId);\n\n // If we have a session cookie, but no `stateData`, we should remove the cookie.\n if (!stateData) {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n return stateData;\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n await this.#store.delete(sessionId);\n }\n\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n private async getSessionId(identifier: string, options?: TStoreOptions) {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n if (cookieValue) {\n const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n return sessionCookie.id;\n }\n }\n\n deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void> {\n return this.#store.deleteByLogoutToken(claims, options);\n }\n}\n","import type { EncryptedStoreOptions, StateData } from './../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: 'lax',\n path: '/',\n secure: true,\n maxAge,\n };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n const chunkSize = 3072;\n const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n const chunks = [...Array(chunkCount).keys()].map((i) => ({\n value: encryptedStateData.substring(i chunkSize, (i + 1) * chunkSize),\n name: `${identifier}.${i}`,\n }));\n\n chunks.forEach((chunk) => {\n this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n });\n\n const existingCookieKeys = this.getCookieKeys(identifier, options);\n const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n cookieKeysToRemove.forEach((key) => {\n this.#cookieHandler.deleteCookie(key, options);\n });\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n const encryptedStateData = cookieKeys\n .map((key) => ({\n index: parseInt(key.split('.')[1] as string, 10),\n value: this.#cookieHandler.getCookie(key, options),\n }))\n .sort((a, b) => a.index - b.index)\n .map((item) => item.value)\n .join('');\n\n if (encryptedStateData) {\n return await this.decrypt(identifier, encryptedStateData);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n for (const key of cookieKeys) {\n this.#cookieHandler.deleteCookie(key, options);\n }\n }\n\n deleteByLogoutToken(): Promise<void> {\n throw new Error(\n 'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n );\n }\n\n private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACjDO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,wBAAwB,CAAC,cAA6B;AAAA,MAC1D;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,OAAO,SAAS;AAAA,MAChB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,OAAO,SAAS,SAAS;AAAA,IACtE;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,qBAAqB,CAAC,IACrE,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,qBAAqB,IAC3C;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT;AAAA,UACE;AAAA,UACA,aAAa,sBAAsB;AAAA,UACnC,OAAO,sBAAsB;AAAA,UAC7B,WAAU,sBAAsB;AAAA,QAClC;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAC/B,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAClD,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA,2BAKO;AAEA,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,cAAc,IAAI,gCAAW;AAAA,MAChC,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACtF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,eAAe,KAAK;AAAA,MACvE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,YAAY,iBAAiB;AAAA,MAC5E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,YAAY,mBAAmB;AAAA,MAChF,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,YAAY,0BAA0B;AAAA,MAC7E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAASA,UAAS,UAAU;AAAA,IAChF;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,uBAAuB;AAAA,MAC1E,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACzE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,YAAY,eAAe,OAAO;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,YAAY,kBAAkB,EAAE,YAAY,CAAC;AAElF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AC9bA,kBAAuC;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,uBAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,UAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,OAAO;AAAA,MACtD;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AACF;;;AC9GO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AAEb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AACF;","names":["tokenSet"]}
1	+ {"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/utils.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["export { ServerClient } from './server-client.js';\nexport { AbstractStateStore } from './store/abstract-state-store.js';\nexport { AbstractTransactionStore } from './store/abstract-transaction-store.js';\n\nexport type { CookieHandler, CookieSerializeOptions } from './store/cookie-handler.js';\nexport { CookieTransactionStore } from './store/cookie-transaction-store.js';\n\nexport { StatefulStateStore } from './store/stateful-state-store.js';\nexport type { StatefulStateStoreOptions } from './store/stateful-state-store.js';\nexport { StatelessStateStore } from './store/stateless-state-store.js';\n\nexport * from './errors.js';\nexport * from './types.js';\n","/*\n Error thrown when there is no transaction available.\n /\nexport class MissingTransactionError extends Error {\n public code: string = 'missing_transaction_error';\n\n constructor(message?: string) {\n super(message ?? 'The transaction is missing.');\n this.name = 'MissingTransactionError';\n }\n}\n\n\n/\n Error thrown when backchannel logout fails.\n /\nexport class BackchannelLogoutError extends Error {\n public code: string = 'backchannel_logout_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'BackchannelLogoutError';\n }\n}\n\n/\n Error thrown when starting the user-linking failed.\n /\nexport class StartLinkUserError extends Error {\n public code: string = 'start_link_user_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'StartLinkUserError';\n }\n}\n\n/\n Error thrown when a required argument is missing.\n /\nexport class MissingRequiredArgumentError extends Error {\n public code: string = 'missing_required_argument_error';\n\n constructor(argument: string) {\n super(`The argument '${argument}' is required but was not provided.`);\n this.name = 'MissingRequiredArgumentError';\n }\n}\n\n/\n Error thrown when a session is missing.\n /\nexport class MissingSessionError extends Error {\n public code: string = 'missing_session_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'MissingSessionError';\n }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/\n Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n /\nexport function updateStateData(\n audience: string,\n stateDate: StateData \| undefined,\n tokenEndpointResponse: TokenResponse\n): StateData {\n if (stateDate) {\n const isNewTokenSet = !stateDate.tokenSets.some(\n (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n );\n\n const createUpdatedTokenSet = (response: TokenResponse) => ({\n audience,\n accessToken: response.accessToken,\n scope: response.scope,\n expiresAt: Math.floor(Date.now() / 1000) + Number(response.expiresAt),\n });\n\n const tokenSets = isNewTokenSet\n ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)]\n : stateDate.tokenSets.map((tokenSet) =>\n tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n ? createUpdatedTokenSet(tokenEndpointResponse)\n : tokenSet\n );\n\n return {\n ...stateDate,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n tokenSets,\n };\n } else {\n const user = tokenEndpointResponse.claims;\n return {\n user,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken,\n tokenSets: [\n {\n audience,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt:tokenEndpointResponse.expiresAt,\n },\n ],\n internal: {\n sid: user?.sid as string,\n createdAt: Math.floor(Date.now() / 1000),\n },\n };\n }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n options: AccessTokenForConnectionOptions,\n stateDate: StateData,\n tokenEndpointResponse: TokenResponse\n) {\n stateDate.connectionTokenSets = stateDate.connectionTokenSets \|\| [];\n\n const isNewTokenSet = !stateDate.connectionTokenSets.some(\n (tokenSet) =>\n tokenSet.connection === options.connection && (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n );\n\n const connectionTokenSet = {\n connection: options.connection,\n loginHint: options.loginHint,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n };\n\n const connectionTokenSets = isNewTokenSet\n ? [...stateDate.connectionTokenSets, connectionTokenSet]\n : stateDate.connectionTokenSets.map((tokenSet) =>\n tokenSet.connection === options.connection &&\n (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n ? connectionTokenSet\n : tokenSet\n );\n\n return {\n ...stateDate,\n connectionTokenSets,\n };\n}\n","import {\n AccessTokenForConnectionOptions,\n ConnectionTokenSet,\n LoginBackchannelOptions,\n LoginBackchannelResult,\n LogoutOptions,\n ServerClientOptions,\n SessionData,\n StartInteractiveLoginOptions,\n StartLinkUserOptions,\n StartUnlinkUserOptions,\n StateStore,\n TokenSet,\n TransactionData,\n TransactionStore,\n} from './types.js';\nimport {\n BackchannelLogoutError,\n MissingRequiredArgumentError,\n MissingSessionError,\n MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n TokenForConnectionError,\n AuthClient,\n AuthorizationDetails,\n TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\nimport { compareScopes } from './utils.js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n readonly #options: ServerClientOptions<TStoreOptions>;\n readonly #transactionStore: TransactionStore<TStoreOptions>;\n readonly #transactionStoreIdentifier: string;\n readonly #stateStore: StateStore<TStoreOptions>;\n readonly #stateStoreIdentifier: string;\n\n /\n The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.\n * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.\n * \n * Important: the methods exposed on the `authClient` instance do not handle any session or state management.\n /\n readonly authClient: AuthClient;\n\n constructor(options: ServerClientOptions<TStoreOptions>) {\n this.#options = options;\n this.#stateStoreIdentifier = this.#options.stateIdentifier \|\| '__a0_session';\n this.#transactionStoreIdentifier = this.#options.transactionIdentifier \|\| '__a0_tx';\n this.#transactionStore = options.transactionStore;\n this.#stateStore = options.stateStore;\n\n if (!this.#options.stateStore) {\n throw new MissingRequiredArgumentError('stateStore');\n }\n\n if (!this.#options.transactionStore) {\n throw new MissingRequiredArgumentError('transactionStore');\n }\n\n this.authClient = new AuthClient({\n domain: this.#options.domain,\n clientId: this.#options.clientId,\n clientSecret: this.#options.clientSecret,\n clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n authorizationParams: this.#options.authorizationParams,\n customFetch: this.#options.customFetch,\n useMtls: this.#options.useMtls,\n });\n }\n\n /\n Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Optional options used to configure the interactive login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n if (!redirectUri) {\n throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n }\n\n const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({\n pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n authorizationParams: {\n ...options?.authorizationParams,\n redirect_uri: redirectUri,\n },\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return authorizationUrl;\n }\n\n /\n Completes the interactive login process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n /\n public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n if (!transactionData) {\n throw new MissingTransactionError();\n }\n\n const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {\n codeVerifier: transactionData.codeVerifier,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n appState?: TAppState;\n authorizationDetails?: AuthorizationDetails[];\n };\n }\n\n /\n Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Options used to configure the user linking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n );\n }\n\n const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({\n connection: options.connection,\n connectionScope: options.connectionScope,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return linkUserUrl;\n }\n\n /\n Completes the user linking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n * @param options Options used to configure the user unlinking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n );\n }\n\n const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({\n connection: options.connection,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return unlinkUserUrl;\n }\n\n /\n Completes the user unlinking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Logs in using Client-Initiated Backchannel Authentication.\n \n Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n * @param options Options used to configure the backchannel login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n \n @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n /\n public async loginBackchannel(\n options: LoginBackchannelOptions,\n storeOptions?: TStoreOptions\n ): Promise<LoginBackchannelResult> {\n const tokenEndpointResponse = await this.authClient.backchannelAuthentication({\n bindingMessage: options.bindingMessage,\n loginHint: options.loginHint,\n authorizationParams: options.authorizationParams,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(\n this.#options.authorizationParams?.audience ?? 'default',\n existingStateData,\n tokenEndpointResponse\n );\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n return {\n authorizationDetails: tokenEndpointResponse.authorizationDetails,\n };\n }\n\n /\n Retrieves the user from the store, or undefined if no user found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The user, or undefined if no user found in the store.\n /\n public async getUser(storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n return stateData?.user;\n }\n\n /\n Retrieve the user session from the store, or undefined if no session found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The sessionm or undefined if no session found in the store.\n /\n public async getSession(storeOptions?: TStoreOptions): Promise<SessionData \| undefined> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (stateData) {\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n const { internal, ...sessionData } = stateData;\n return sessionData;\n }\n }\n\n /\n Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n * Also updates the store when a new token was retrieved from Auth0.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Token Set, containing the access token, as well as additional information.\n /\n public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const audience = this.#options.authorizationParams?.audience ?? 'default';\n const scope = this.#options.authorizationParams?.scope;\n\n const tokenSet = stateData?.tokenSets.find(\n (tokenSet) => tokenSet.audience === audience && (!scope \|\| compareScopes(tokenSet.scope, scope))\n );\n\n if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n return tokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenByRefreshTokenError(\n 'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n );\n }\n\n const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({\n refreshToken: stateData.refreshToken,\n });\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n audience: audience,\n };\n }\n\n /\n Retrieves an access token for a connection.\n \n This method attempts to obtain an access token for a specified connection.\n * It first checks if a refresh token exists in the store.\n * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n * that the refresh token was not found.\n \n @param options - Options for retrieving an access token for a connection.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n /\n public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const connectionTokenSet = stateData?.connectionTokenSets?.find(\n (tokenSet) => tokenSet.connection === options.connection\n );\n\n if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n return connectionTokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenForConnectionError(\n 'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n );\n }\n\n const tokenEndpointResponse = await this.authClient.getTokenForConnection({\n connection: options.connection,\n loginHint: options.loginHint,\n refreshToken: stateData.refreshToken,\n });\n\n const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n connection: options.connection,\n loginHint: options.loginHint,\n };\n }\n\n /\n Logs the user out and returns a URL to redirect the user-agent to after they log out.\n * @param options Options used to configure the logout process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns {URL}\n /\n public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n return this.authClient.buildLogoutUrl(options);\n }\n\n /\n Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n * @param logoutToken The logout token to verify and use to delete the session from the store.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelLogoutError} If the logout token is missing.\n * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n /\n public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n if (!logoutToken) {\n throw new BackchannelLogoutError('Missing Logout Token');\n }\n\n const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });\n\n await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n }\n}\n","/\n Compares two sets of scopes to determine if all required scopes are present in the provided scopes.\n * @param scopes Scopes to compare\n * @param requiredScopes Scopes required to be present in the scopes\n * @returns True if all required scopes are present in the scopes, false otherwise\n /\nexport const compareScopes = (scopes: string \| undefined, requiredScopes: string \| undefined) => {\n // When the scopes and requiredScopes are exactly the same, return true\n // This handles cases where both are empty or undefined or both are the same string\n if (scopes === requiredScopes) {\n return true;\n }\n\n if (!scopes \|\| !requiredScopes) {\n return false;\n }\n\n const scopesSet = new Set(scopes.trim().split(' ').filter(Boolean));\n const requiredScopesArray = requiredScopes.trim().split(' ').filter(Boolean);\n\n return requiredScopesArray.every((scope) => scopesSet.has(scope));\n};\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder \| undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n encoder \|\|= new TextEncoder();\n const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n return new Uint8Array(\n await crypto.subtle.deriveBits(\n {\n name: 'HKDF',\n hash: DIGEST,\n info: encoder.encode(HKDF_INFO),\n salt: encoder.encode(`${salt}${kid}`),\n } as HkdfParams,\n key,\n BIT_LENGTH\n )\n );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n const kid = crypto.randomUUID();\n const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n return await new EncryptJWT(payload)\n .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n .setExpirationTime(expiration)\n .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n const res = await jwtDecrypt<T>(\n value,\n async (protectedHeader) => {\n\n // This error shouldn't happen, as we always set a kid.\n // However, leaving this here as a safety net.\n if (!protectedHeader.kid) {\n throw new Error('Missing \"kid\" in JWE header');\n }\n\n return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n },\n { clockTolerance: 15 }\n );\n return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n protected readonly options: EncryptedStoreOptions;\n\n constructor(options: EncryptedStoreOptions) {\n this.options = options;\n }\n\n abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions \| undefined): Promise<void>;\n abstract get(identifier: string, options?: TStoreOptions \| undefined): Promise<TData \| undefined>;\n abstract delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void>;\n\n protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n return await encrypt(stateData, this.options.secret, identifier, expiration);\n }\n\n protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n\n abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n transactionData: TransactionData,\n removeIfExists?: boolean,\n options?: TStoreOptions\n ): Promise<void> { \n const maxAge = 60 60;\n const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions): Promise<TransactionData \| undefined> {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n if (cookieValue) {\n return await this.decrypt(identifier, cookieValue);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n readonly #rolling: boolean;\n readonly #absoluteDuration: number;\n readonly #inactivityDuration: number;\n\n constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n super(options);\n\n this.#rolling = options.rolling ?? true;\n this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n }\n\n /*\n calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n /\n protected calculateMaxAge(createdAt: number) {\n if (!this.#rolling) {\n return this.#absoluteDuration;\n }\n\n const now = (Date.now() / 1000) \| 0;\n const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n const maxAge = expiresAt - now;\n\n return maxAge > 0 ? maxAge : 0;\n }\n}","import type {\n EncryptedStoreOptions,\n LogoutTokenClaims,\n SessionConfiguration,\n SessionCookieOptions,\n SessionStore,\n StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n const bytes = new Uint8Array(16);\n crypto.getRandomValues(bytes);\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #store: SessionStore<TStoreOptions>;\n readonly #cookieOptions: SessionCookieOptions \| undefined;\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(\n options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n cookieHandler: CookieHandler<TStoreOptions>\n ) {\n super(options);\n\n this.#store = options.store;\n this.#cookieOptions = options.cookie;\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n let sessionId = await this.getSessionId(identifier, options);\n\n // if this is a new session created by a new login we need to remove the old session\n // from the store and regenerate the session ID to prevent session fixation.\n if (sessionId && removeIfExists) {\n await this.#store.delete(sessionId);\n sessionId = generateId();\n }\n\n sessionId ??= generateId();\n\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n path: '/',\n secure: this.#cookieOptions?.secure,\n maxAge,\n };\n const expiration = Date.now() / 1000 + maxAge;\n const encryptedStateData = await this.encrypt<{ id: string }>(\n identifier,\n {\n id: sessionId,\n },\n expiration\n );\n\n await this.#store.set(sessionId, stateData);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n const stateData = await this.#store.get(sessionId);\n\n // If we have a session cookie, but no `stateData`, we should remove the cookie.\n if (!stateData) {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n return stateData;\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n await this.#store.delete(sessionId);\n }\n\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n private async getSessionId(identifier: string, options?: TStoreOptions) {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n if (cookieValue) {\n const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n return sessionCookie.id;\n }\n }\n\n deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void> {\n return this.#store.deleteByLogoutToken(claims, options);\n }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #cookieOptions: SessionCookieOptions \| undefined;\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n\n this.#cookieOptions = options.cookie;\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n path: '/',\n secure: this.#cookieOptions?.secure ?? true,\n maxAge,\n };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n const chunkSize = 3072;\n const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n const chunks = [...Array(chunkCount).keys()].map((i) => ({\n value: encryptedStateData.substring(i chunkSize, (i + 1) * chunkSize),\n name: `${identifier}.${i}`,\n }));\n\n chunks.forEach((chunk) => {\n this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n });\n\n const existingCookieKeys = this.getCookieKeys(identifier, options);\n const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n cookieKeysToRemove.forEach((key) => {\n this.#cookieHandler.deleteCookie(key, options);\n });\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n const encryptedStateData = cookieKeys\n .map((key) => ({\n index: parseInt(key.split('.')[1] as string, 10),\n value: this.#cookieHandler.getCookie(key, options),\n }))\n .sort((a, b) => a.index - b.index)\n .map((item) => item.value)\n .join('');\n\n if (encryptedStateData) {\n return await this.decrypt(identifier, encryptedStateData);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n for (const key of cookieKeys) {\n this.#cookieHandler.deleteCookie(key, options);\n }\n }\n\n deleteByLogoutToken(): Promise<void> {\n throw new Error(\n 'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n );\n }\n\n private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACjDO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,wBAAwB,CAAC,cAA6B;AAAA,MAC1D;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,OAAO,SAAS;AAAA,MAChB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,OAAO,SAAS,SAAS;AAAA,IACtE;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,qBAAqB,CAAC,IACrE,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,qBAAqB,IAC3C;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT;AAAA,UACE;AAAA,UACA,aAAa,sBAAsB;AAAA,UACnC,OAAO,sBAAsB;AAAA,UAC7B,WAAU,sBAAsB;AAAA,QAClC;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAC/B,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAClD,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA,2BAKO;;;ACtBA,IAAM,gBAAgB,CAAC,QAA4B,mBAAuC;AAG/F,MAAI,WAAW,gBAAgB;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC;AAClE,QAAM,sBAAsB,eAAe,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3E,SAAO,oBAAoB,MAAM,CAAC,UAAU,UAAU,IAAI,KAAK,CAAC;AAClE;;;ADUO,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,aAAa,IAAI,gCAAW;AAAA,MAC/B,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,SAAS;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACrF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,eAAe,KAAK;AAAA,MACtE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,WAAW,iBAAiB;AAAA,MAC3E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,WAAW,mBAAmB;AAAA,MAC/E,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,WAAW,0BAA0B;AAAA,MAC5E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAAS,cAAcA,UAAS,OAAO,KAAK;AAAA,IAChG;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,uBAAuB;AAAA,MACzE,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACxE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,WAAW,eAAe,OAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,WAAW,kBAAkB,EAAE,YAAY,CAAC;AAEjF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AEvcA,kBAAuC;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,uBAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,UAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,OAAO;AAAA,MACtD;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AACF;;;AC9GO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC;AAAA,IACF;AACA,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AACF;","names":["tokenSet"]}

package/dist/index.d.cts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { AuthorizationDetails } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, AuthClient } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 interface ServerClientOptions<TStoreOptions = unknown> {
@@ -16,6 +16,12 @@ interface ServerClientOptions<TStoreOptions = unknown> {
     customFetch?: typeof fetch;
     transactionStore: TransactionStore<TStoreOptions>;
     stateStore: StateStore<TStoreOptions>;
+    /**
+     * Indicates whether the SDK should use the mTLS endpoints if they are available.
+     *
+     * When set to `true`, using a `customFetch` is required.
+     */
+    useMtls?: boolean;
 }
 interface UserClaims {
     sub: string;
@@ -178,6 +184,13 @@ interface SessionCookieOptions {
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
+    /**
+     * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+     * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+     *
+     * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+     */
+    readonly authClient: AuthClient;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -432,7 +445,7 @@ declare class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TSt
 declare class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {
     #private;
-    constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>);
+    constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>);
     set(identifier: string, stateData: StateData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;
     get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined>;
     delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;

package/dist/index.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { AuthorizationDetails } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, AuthClient } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 interface ServerClientOptions<TStoreOptions = unknown> {
@@ -16,6 +16,12 @@ interface ServerClientOptions<TStoreOptions = unknown> {
     customFetch?: typeof fetch;
     transactionStore: TransactionStore<TStoreOptions>;
     stateStore: StateStore<TStoreOptions>;
+    /**
+     * Indicates whether the SDK should use the mTLS endpoints if they are available.
+     *
+     * When set to `true`, using a `customFetch` is required.
+     */
+    useMtls?: boolean;
 }
 interface UserClaims {
     sub: string;
@@ -178,6 +184,13 @@ interface SessionCookieOptions {
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
+    /**
+     * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+     * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+     *
+     * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+     */
+    readonly authClient: AuthClient;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -432,7 +445,7 @@ declare class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TSt
 declare class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {
     #private;
-    constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>);
+    constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>);
     set(identifier: string, stateData: StateData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;
     get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined>;
     delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;

package/dist/index.js CHANGED Viewed

@@ -104,13 +104,34 @@ import {
   AuthClient,
   TokenByRefreshTokenError
 } from "@auth0/auth0-auth-js";
+// src/utils.ts
+var compareScopes = (scopes, requiredScopes) => {
+  if (scopes === requiredScopes) {
+    return true;
+  }
+  if (!scopes || !requiredScopes) {
+    return false;
+  }
+  const scopesSet = new Set(scopes.trim().split(" ").filter(Boolean));
+  const requiredScopesArray = requiredScopes.trim().split(" ").filter(Boolean);
+  return requiredScopesArray.every((scope) => scopesSet.has(scope));
+};
+// src/server-client.ts
 var ServerClient = class {
   #options;
   #transactionStore;
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
-  #authClient;
+  /**
+   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+   *
+   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+   */
+  authClient;
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -123,14 +144,15 @@ var ServerClient = class {
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
-    this.#authClient = new AuthClient({
+    this.authClient = new AuthClient({
       domain: this.#options.domain,
       clientId: this.#options.clientId,
       clientSecret: this.#options.clientSecret,
       clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
-      customFetch: this.#options.customFetch
+      customFetch: this.#options.customFetch,
+      useMtls: this.#options.useMtls
     });
   }
   /**
@@ -147,7 +169,7 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
-    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({
+    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
@@ -180,7 +202,7 @@ var ServerClient = class {
     if (!transactionData) {
       throw new MissingTransactionError();
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {
+    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {
       codeVerifier: transactionData.codeVerifier
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -206,7 +228,7 @@ var ServerClient = class {
         "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
       );
     }
-    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({
+    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({
       connection: options.connection,
       connectionScope: options.connectionScope,
       idToken: stateData.idToken,
@@ -256,7 +278,7 @@ var ServerClient = class {
         "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
       );
     }
-    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({
+    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({
       connection: options.connection,
       idToken: stateData.idToken,
       authorizationParams: options.authorizationParams
@@ -301,7 +323,7 @@ var ServerClient = class {
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
   async loginBackchannel(options, storeOptions) {
-    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({
+    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
       authorizationParams: options.authorizationParams
@@ -352,7 +374,7 @@ var ServerClient = class {
     const audience = this.#options.authorizationParams?.audience ?? "default";
     const scope = this.#options.authorizationParams?.scope;
     const tokenSet = stateData?.tokenSets.find(
-      (tokenSet2) => tokenSet2.audience === audience && (!scope || tokenSet2.scope === scope)
+      (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
     if (tokenSet && tokenSet.expiresAt > Date.now() / 1e3) {
       return tokenSet;
@@ -362,7 +384,7 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({
+    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({
       refreshToken: stateData.refreshToken
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -403,7 +425,7 @@ var ServerClient = class {
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({
+    const tokenEndpointResponse = await this.authClient.getTokenForConnection({
       connection: options.connection,
       loginHint: options.loginHint,
       refreshToken: stateData.refreshToken
@@ -426,7 +448,7 @@ var ServerClient = class {
    */
   async logout(options, storeOptions) {
     await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
-    return this.#authClient.buildLogoutUrl(options);
+    return this.authClient.buildLogoutUrl(options);
   }
   /**
    * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
@@ -440,7 +462,7 @@ var ServerClient = class {
     if (!logoutToken) {
       throw new BackchannelLogoutError("Missing Logout Token");
     }
-    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });
+    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });
     await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
   }
 };
@@ -639,18 +661,20 @@ var StatefulStateStore = class extends AbstractSessionStore {
 // src/store/stateless-state-store.ts
 var StatelessStateStore = class extends AbstractSessionStore {
+  #cookieOptions;
   #cookieHandler;
   constructor(options, cookieHandler) {
     super(options);
+    this.#cookieOptions = options.cookie;
     this.#cookieHandler = cookieHandler;
   }
   async set(identifier, stateData, removeIfExists, options) {
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
     const cookieOpts = {
       httpOnly: true,
-      sameSite: "lax",
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
       path: "/",
-      secure: true,
+      secure: this.#cookieOptions?.secure ?? true,
       maxAge
     };
     const expiration = Math.floor(Date.now() / 1e3 + maxAge);

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["/*\n Error thrown when there is no transaction available.\n /\nexport class MissingTransactionError extends Error {\n public code: string = 'missing_transaction_error';\n\n constructor(message?: string) {\n super(message ?? 'The transaction is missing.');\n this.name = 'MissingTransactionError';\n }\n}\n\n\n/\n Error thrown when backchannel logout fails.\n /\nexport class BackchannelLogoutError extends Error {\n public code: string = 'backchannel_logout_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'BackchannelLogoutError';\n }\n}\n\n/\n Error thrown when starting the user-linking failed.\n /\nexport class StartLinkUserError extends Error {\n public code: string = 'start_link_user_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'StartLinkUserError';\n }\n}\n\n/\n Error thrown when a required argument is missing.\n /\nexport class MissingRequiredArgumentError extends Error {\n public code: string = 'missing_required_argument_error';\n\n constructor(argument: string) {\n super(`The argument '${argument}' is required but was not provided.`);\n this.name = 'MissingRequiredArgumentError';\n }\n}\n\n/\n Error thrown when a session is missing.\n /\nexport class MissingSessionError extends Error {\n public code: string = 'missing_session_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'MissingSessionError';\n }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/\n Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n /\nexport function updateStateData(\n audience: string,\n stateDate: StateData \| undefined,\n tokenEndpointResponse: TokenResponse\n): StateData {\n if (stateDate) {\n const isNewTokenSet = !stateDate.tokenSets.some(\n (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n );\n\n const createUpdatedTokenSet = (response: TokenResponse) => ({\n audience,\n accessToken: response.accessToken,\n scope: response.scope,\n expiresAt: Math.floor(Date.now() / 1000) + Number(response.expiresAt),\n });\n\n const tokenSets = isNewTokenSet\n ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)]\n : stateDate.tokenSets.map((tokenSet) =>\n tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n ? createUpdatedTokenSet(tokenEndpointResponse)\n : tokenSet\n );\n\n return {\n ...stateDate,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n tokenSets,\n };\n } else {\n const user = tokenEndpointResponse.claims;\n return {\n user,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken,\n tokenSets: [\n {\n audience,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt:tokenEndpointResponse.expiresAt,\n },\n ],\n internal: {\n sid: user?.sid as string,\n createdAt: Math.floor(Date.now() / 1000),\n },\n };\n }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n options: AccessTokenForConnectionOptions,\n stateDate: StateData,\n tokenEndpointResponse: TokenResponse\n) {\n stateDate.connectionTokenSets = stateDate.connectionTokenSets \|\| [];\n\n const isNewTokenSet = !stateDate.connectionTokenSets.some(\n (tokenSet) =>\n tokenSet.connection === options.connection && (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n );\n\n const connectionTokenSet = {\n connection: options.connection,\n loginHint: options.loginHint,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n };\n\n const connectionTokenSets = isNewTokenSet\n ? [...stateDate.connectionTokenSets, connectionTokenSet]\n : stateDate.connectionTokenSets.map((tokenSet) =>\n tokenSet.connection === options.connection &&\n (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n ? connectionTokenSet\n : tokenSet\n );\n\n return {\n ...stateDate,\n connectionTokenSets,\n };\n}\n","import {\n AccessTokenForConnectionOptions,\n ConnectionTokenSet,\n LoginBackchannelOptions,\n LoginBackchannelResult,\n LogoutOptions,\n ServerClientOptions,\n SessionData,\n StartInteractiveLoginOptions,\n StartLinkUserOptions,\n StartUnlinkUserOptions,\n StateStore,\n TokenSet,\n TransactionData,\n TransactionStore,\n} from './types.js';\nimport {\n BackchannelLogoutError,\n MissingRequiredArgumentError,\n MissingSessionError,\n MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n TokenForConnectionError,\n AuthClient,\n AuthorizationDetails,\n TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n readonly #options: ServerClientOptions<TStoreOptions>;\n readonly #transactionStore: TransactionStore<TStoreOptions>;\n readonly #transactionStoreIdentifier: string;\n readonly #stateStore: StateStore<TStoreOptions>;\n readonly #stateStoreIdentifier: string;\n readonly #authClient: AuthClient;\n\n constructor(options: ServerClientOptions<TStoreOptions>) {\n this.#options = options;\n this.#stateStoreIdentifier = this.#options.stateIdentifier \|\| '__a0_session';\n this.#transactionStoreIdentifier = this.#options.transactionIdentifier \|\| '__a0_tx';\n this.#transactionStore = options.transactionStore;\n this.#stateStore = options.stateStore;\n\n if (!this.#options.stateStore) {\n throw new MissingRequiredArgumentError('stateStore');\n }\n\n if (!this.#options.transactionStore) {\n throw new MissingRequiredArgumentError('transactionStore');\n }\n\n this.#authClient = new AuthClient({\n domain: this.#options.domain,\n clientId: this.#options.clientId,\n clientSecret: this.#options.clientSecret,\n clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n authorizationParams: this.#options.authorizationParams,\n customFetch: this.#options.customFetch,\n });\n }\n\n /\n Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Optional options used to configure the interactive login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n if (!redirectUri) {\n throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n }\n\n const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({\n pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n authorizationParams: {\n ...options?.authorizationParams,\n redirect_uri: redirectUri,\n },\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return authorizationUrl;\n }\n\n /\n Completes the interactive login process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n /\n public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n if (!transactionData) {\n throw new MissingTransactionError();\n }\n\n const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {\n codeVerifier: transactionData.codeVerifier,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n appState?: TAppState;\n authorizationDetails?: AuthorizationDetails[];\n };\n }\n\n /\n Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Options used to configure the user linking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n );\n }\n\n const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({\n connection: options.connection,\n connectionScope: options.connectionScope,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return linkUserUrl;\n }\n\n /\n Completes the user linking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n * @param options Options used to configure the user unlinking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n );\n }\n\n const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({\n connection: options.connection,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return unlinkUserUrl;\n }\n\n /\n Completes the user unlinking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Logs in using Client-Initiated Backchannel Authentication.\n \n Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n * @param options Options used to configure the backchannel login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n \n @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n /\n public async loginBackchannel(\n options: LoginBackchannelOptions,\n storeOptions?: TStoreOptions\n ): Promise<LoginBackchannelResult> {\n const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({\n bindingMessage: options.bindingMessage,\n loginHint: options.loginHint,\n authorizationParams: options.authorizationParams,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(\n this.#options.authorizationParams?.audience ?? 'default',\n existingStateData,\n tokenEndpointResponse\n );\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n return {\n authorizationDetails: tokenEndpointResponse.authorizationDetails,\n };\n }\n\n /\n Retrieves the user from the store, or undefined if no user found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The user, or undefined if no user found in the store.\n /\n public async getUser(storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n return stateData?.user;\n }\n\n /\n Retrieve the user session from the store, or undefined if no session found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The sessionm or undefined if no session found in the store.\n /\n public async getSession(storeOptions?: TStoreOptions): Promise<SessionData \| undefined> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (stateData) {\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n const { internal, ...sessionData } = stateData;\n return sessionData;\n }\n }\n\n /\n Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n * Also updates the store when a new token was retrieved from Auth0.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Token Set, containing the access token, as well as additional information.\n /\n public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const audience = this.#options.authorizationParams?.audience ?? 'default';\n const scope = this.#options.authorizationParams?.scope;\n\n const tokenSet = stateData?.tokenSets.find(\n (tokenSet) => tokenSet.audience === audience && (!scope \|\| tokenSet.scope === scope)\n );\n\n if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n return tokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenByRefreshTokenError(\n 'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n );\n }\n\n const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({\n refreshToken: stateData.refreshToken,\n });\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n audience: audience,\n };\n }\n\n /\n Retrieves an access token for a connection.\n \n This method attempts to obtain an access token for a specified connection.\n * It first checks if a refresh token exists in the store.\n * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n * that the refresh token was not found.\n \n @param options - Options for retrieving an access token for a connection.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n /\n public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const connectionTokenSet = stateData?.connectionTokenSets?.find(\n (tokenSet) => tokenSet.connection === options.connection\n );\n\n if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n return connectionTokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenForConnectionError(\n 'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n );\n }\n\n const tokenEndpointResponse = await this.#authClient.getTokenForConnection({\n connection: options.connection,\n loginHint: options.loginHint,\n refreshToken: stateData.refreshToken,\n });\n\n const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n connection: options.connection,\n loginHint: options.loginHint,\n };\n }\n\n /\n Logs the user out and returns a URL to redirect the user-agent to after they log out.\n * @param options Options used to configure the logout process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns {URL}\n /\n public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n return this.#authClient.buildLogoutUrl(options);\n }\n\n /\n Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n * @param logoutToken The logout token to verify and use to delete the session from the store.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelLogoutError} If the logout token is missing.\n * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n /\n public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n if (!logoutToken) {\n throw new BackchannelLogoutError('Missing Logout Token');\n }\n\n const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });\n\n await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n }\n}\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder \| undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n encoder \|\|= new TextEncoder();\n const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n return new Uint8Array(\n await crypto.subtle.deriveBits(\n {\n name: 'HKDF',\n hash: DIGEST,\n info: encoder.encode(HKDF_INFO),\n salt: encoder.encode(`${salt}${kid}`),\n } as HkdfParams,\n key,\n BIT_LENGTH\n )\n );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n const kid = crypto.randomUUID();\n const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n return await new EncryptJWT(payload)\n .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n .setExpirationTime(expiration)\n .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n const res = await jwtDecrypt<T>(\n value,\n async (protectedHeader) => {\n\n // This error shouldn't happen, as we always set a kid.\n // However, leaving this here as a safety net.\n if (!protectedHeader.kid) {\n throw new Error('Missing \"kid\" in JWE header');\n }\n\n return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n },\n { clockTolerance: 15 }\n );\n return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n protected readonly options: EncryptedStoreOptions;\n\n constructor(options: EncryptedStoreOptions) {\n this.options = options;\n }\n\n abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions \| undefined): Promise<void>;\n abstract get(identifier: string, options?: TStoreOptions \| undefined): Promise<TData \| undefined>;\n abstract delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void>;\n\n protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n return await encrypt(stateData, this.options.secret, identifier, expiration);\n }\n\n protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n\n abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n transactionData: TransactionData,\n removeIfExists?: boolean,\n options?: TStoreOptions\n ): Promise<void> { \n const maxAge = 60 60;\n const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions): Promise<TransactionData \| undefined> {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n if (cookieValue) {\n return await this.decrypt(identifier, cookieValue);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n readonly #rolling: boolean;\n readonly #absoluteDuration: number;\n readonly #inactivityDuration: number;\n\n constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n super(options);\n\n this.#rolling = options.rolling ?? true;\n this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n }\n\n /*\n calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n /\n protected calculateMaxAge(createdAt: number) {\n if (!this.#rolling) {\n return this.#absoluteDuration;\n }\n\n const now = (Date.now() / 1000) \| 0;\n const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n const maxAge = expiresAt - now;\n\n return maxAge > 0 ? maxAge : 0;\n }\n}","import type {\n EncryptedStoreOptions,\n LogoutTokenClaims,\n SessionConfiguration,\n SessionCookieOptions,\n SessionStore,\n StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n const bytes = new Uint8Array(16);\n crypto.getRandomValues(bytes);\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #store: SessionStore<TStoreOptions>;\n readonly #cookieOptions: SessionCookieOptions \| undefined;\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(\n options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n cookieHandler: CookieHandler<TStoreOptions>\n ) {\n super(options);\n\n this.#store = options.store;\n this.#cookieOptions = options.cookie;\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n let sessionId = await this.getSessionId(identifier, options);\n\n // if this is a new session created by a new login we need to remove the old session\n // from the store and regenerate the session ID to prevent session fixation.\n if (sessionId && removeIfExists) {\n await this.#store.delete(sessionId);\n sessionId = generateId();\n }\n\n sessionId ??= generateId();\n\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n path: '/',\n secure: this.#cookieOptions?.secure,\n maxAge,\n };\n const expiration = Date.now() / 1000 + maxAge;\n const encryptedStateData = await this.encrypt<{ id: string }>(\n identifier,\n {\n id: sessionId,\n },\n expiration\n );\n\n await this.#store.set(sessionId, stateData);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n const stateData = await this.#store.get(sessionId);\n\n // If we have a session cookie, but no `stateData`, we should remove the cookie.\n if (!stateData) {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n return stateData;\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n await this.#store.delete(sessionId);\n }\n\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n private async getSessionId(identifier: string, options?: TStoreOptions) {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n if (cookieValue) {\n const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n return sessionCookie.id;\n }\n }\n\n deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void> {\n return this.#store.deleteByLogoutToken(claims, options);\n }\n}\n","import type { EncryptedStoreOptions, StateData } from './../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: 'lax',\n path: '/',\n secure: true,\n maxAge,\n };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n const chunkSize = 3072;\n const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n const chunks = [...Array(chunkCount).keys()].map((i) => ({\n value: encryptedStateData.substring(i chunkSize, (i + 1) * chunkSize),\n name: `${identifier}.${i}`,\n }));\n\n chunks.forEach((chunk) => {\n this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n });\n\n const existingCookieKeys = this.getCookieKeys(identifier, options);\n const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n cookieKeysToRemove.forEach((key) => {\n this.#cookieHandler.deleteCookie(key, options);\n });\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n const encryptedStateData = cookieKeys\n .map((key) => ({\n index: parseInt(key.split('.')[1] as string, 10),\n value: this.#cookieHandler.getCookie(key, options),\n }))\n .sort((a, b) => a.index - b.index)\n .map((item) => item.value)\n .join('');\n\n if (encryptedStateData) {\n return await this.decrypt(identifier, encryptedStateData);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n for (const key of cookieKeys) {\n this.#cookieHandler.deleteCookie(key, options);\n }\n }\n\n deleteByLogoutToken(): Promise<void> {\n throw new Error(\n 'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n );\n }\n\n private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n }\n}\n"],"mappings":";AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACjDO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,wBAAwB,CAAC,cAA6B;AAAA,MAC1D;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,OAAO,SAAS;AAAA,MAChB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,OAAO,SAAS,SAAS;AAAA,IACtE;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,qBAAqB,CAAC,IACrE,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,qBAAqB,IAC3C;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT;AAAA,UACE;AAAA,UACA,aAAa,sBAAsB;AAAA,UACnC,OAAO,sBAAsB;AAAA,UAC7B,WAAU,sBAAsB;AAAA,QAClC;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAC/B,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAClD,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAEA,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,cAAc,IAAI,WAAW;AAAA,MAChC,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACtF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,eAAe,KAAK;AAAA,MACvE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,YAAY,iBAAiB;AAAA,MAC5E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,YAAY,mBAAmB;AAAA,MAChF,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,YAAY,0BAA0B;AAAA,MAC7E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAASA,UAAS,UAAU;AAAA,IAChF;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,uBAAuB;AAAA,MAC1E,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACzE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,YAAY,eAAe,OAAO;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,YAAY,kBAAkB,EAAE,YAAY,CAAC;AAElF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AC9bA,SAAS,YAAY,kBAAkB;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,WAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,OAAO;AAAA,MACtD;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AACF;;;AC9GO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AAEb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AACF;","names":["tokenSet"]}
1	+ {"version":3,"sources":["../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/utils.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["/*\n Error thrown when there is no transaction available.\n /\nexport class MissingTransactionError extends Error {\n public code: string = 'missing_transaction_error';\n\n constructor(message?: string) {\n super(message ?? 'The transaction is missing.');\n this.name = 'MissingTransactionError';\n }\n}\n\n\n/\n Error thrown when backchannel logout fails.\n /\nexport class BackchannelLogoutError extends Error {\n public code: string = 'backchannel_logout_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'BackchannelLogoutError';\n }\n}\n\n/\n Error thrown when starting the user-linking failed.\n /\nexport class StartLinkUserError extends Error {\n public code: string = 'start_link_user_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'StartLinkUserError';\n }\n}\n\n/\n Error thrown when a required argument is missing.\n /\nexport class MissingRequiredArgumentError extends Error {\n public code: string = 'missing_required_argument_error';\n\n constructor(argument: string) {\n super(`The argument '${argument}' is required but was not provided.`);\n this.name = 'MissingRequiredArgumentError';\n }\n}\n\n/\n Error thrown when a session is missing.\n /\nexport class MissingSessionError extends Error {\n public code: string = 'missing_session_error';\n\n constructor(message: string) {\n super(message);\n this.name = 'MissingSessionError';\n }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/\n Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n /\nexport function updateStateData(\n audience: string,\n stateDate: StateData \| undefined,\n tokenEndpointResponse: TokenResponse\n): StateData {\n if (stateDate) {\n const isNewTokenSet = !stateDate.tokenSets.some(\n (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n );\n\n const createUpdatedTokenSet = (response: TokenResponse) => ({\n audience,\n accessToken: response.accessToken,\n scope: response.scope,\n expiresAt: Math.floor(Date.now() / 1000) + Number(response.expiresAt),\n });\n\n const tokenSets = isNewTokenSet\n ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)]\n : stateDate.tokenSets.map((tokenSet) =>\n tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n ? createUpdatedTokenSet(tokenEndpointResponse)\n : tokenSet\n );\n\n return {\n ...stateDate,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n tokenSets,\n };\n } else {\n const user = tokenEndpointResponse.claims;\n return {\n user,\n idToken: tokenEndpointResponse.idToken,\n refreshToken: tokenEndpointResponse.refreshToken,\n tokenSets: [\n {\n audience,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt:tokenEndpointResponse.expiresAt,\n },\n ],\n internal: {\n sid: user?.sid as string,\n createdAt: Math.floor(Date.now() / 1000),\n },\n };\n }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n options: AccessTokenForConnectionOptions,\n stateDate: StateData,\n tokenEndpointResponse: TokenResponse\n) {\n stateDate.connectionTokenSets = stateDate.connectionTokenSets \|\| [];\n\n const isNewTokenSet = !stateDate.connectionTokenSets.some(\n (tokenSet) =>\n tokenSet.connection === options.connection && (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n );\n\n const connectionTokenSet = {\n connection: options.connection,\n loginHint: options.loginHint,\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n };\n\n const connectionTokenSets = isNewTokenSet\n ? [...stateDate.connectionTokenSets, connectionTokenSet]\n : stateDate.connectionTokenSets.map((tokenSet) =>\n tokenSet.connection === options.connection &&\n (!options.loginHint \|\| tokenSet.loginHint === options.loginHint)\n ? connectionTokenSet\n : tokenSet\n );\n\n return {\n ...stateDate,\n connectionTokenSets,\n };\n}\n","import {\n AccessTokenForConnectionOptions,\n ConnectionTokenSet,\n LoginBackchannelOptions,\n LoginBackchannelResult,\n LogoutOptions,\n ServerClientOptions,\n SessionData,\n StartInteractiveLoginOptions,\n StartLinkUserOptions,\n StartUnlinkUserOptions,\n StateStore,\n TokenSet,\n TransactionData,\n TransactionStore,\n} from './types.js';\nimport {\n BackchannelLogoutError,\n MissingRequiredArgumentError,\n MissingSessionError,\n MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n TokenForConnectionError,\n AuthClient,\n AuthorizationDetails,\n TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\nimport { compareScopes } from './utils.js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n readonly #options: ServerClientOptions<TStoreOptions>;\n readonly #transactionStore: TransactionStore<TStoreOptions>;\n readonly #transactionStoreIdentifier: string;\n readonly #stateStore: StateStore<TStoreOptions>;\n readonly #stateStoreIdentifier: string;\n\n /\n The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.\n * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.\n * \n * Important: the methods exposed on the `authClient` instance do not handle any session or state management.\n /\n readonly authClient: AuthClient;\n\n constructor(options: ServerClientOptions<TStoreOptions>) {\n this.#options = options;\n this.#stateStoreIdentifier = this.#options.stateIdentifier \|\| '__a0_session';\n this.#transactionStoreIdentifier = this.#options.transactionIdentifier \|\| '__a0_tx';\n this.#transactionStore = options.transactionStore;\n this.#stateStore = options.stateStore;\n\n if (!this.#options.stateStore) {\n throw new MissingRequiredArgumentError('stateStore');\n }\n\n if (!this.#options.transactionStore) {\n throw new MissingRequiredArgumentError('transactionStore');\n }\n\n this.authClient = new AuthClient({\n domain: this.#options.domain,\n clientId: this.#options.clientId,\n clientSecret: this.#options.clientSecret,\n clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n authorizationParams: this.#options.authorizationParams,\n customFetch: this.#options.customFetch,\n useMtls: this.#options.useMtls,\n });\n }\n\n /\n Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Optional options used to configure the interactive login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n if (!redirectUri) {\n throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n }\n\n const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({\n pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n authorizationParams: {\n ...options?.authorizationParams,\n redirect_uri: redirectUri,\n },\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return authorizationUrl;\n }\n\n /\n Completes the interactive login process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n /\n public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n if (!transactionData) {\n throw new MissingTransactionError();\n }\n\n const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {\n codeVerifier: transactionData.codeVerifier,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n appState?: TAppState;\n authorizationDetails?: AuthorizationDetails[];\n };\n }\n\n /\n Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n * @param options Options used to configure the user linking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n );\n }\n\n const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({\n connection: options.connection,\n connectionScope: options.connectionScope,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return linkUserUrl;\n }\n\n /\n Completes the user linking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n * @param options Options used to configure the user unlinking process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingSessionError} If there is no active session.\n * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n \n @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n /\n public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (!stateData \|\| !stateData.idToken) {\n throw new MissingSessionError(\n 'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n );\n }\n\n const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({\n connection: options.connection,\n idToken: stateData.idToken,\n authorizationParams: options.authorizationParams,\n });\n\n const transactionState: TransactionData = {\n audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n codeVerifier,\n };\n\n if (options?.appState) {\n transactionState.appState = options.appState;\n }\n\n await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n return unlinkUserUrl;\n }\n\n /\n Completes the user unlinking process.\n * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n * @param url The URl from which the query params should be extracted to exchange for a token.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {MissingTransactionError} When no transaction was found.\n * @throws {TokenByCodeError} If there was an issue requesting the access token.\n \n @returns A promise resolving to an object, containing the original appState (if present).\n /\n public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n // In order to complete the link user flow, we need to exchange the code for a token in the same\n // way as we do for the interactive login flow.\n const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n return {\n appState: result.appState,\n };\n }\n\n /\n Logs in using Client-Initiated Backchannel Authentication.\n \n Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n * @param options Options used to configure the backchannel login process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n \n @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n /\n public async loginBackchannel(\n options: LoginBackchannelOptions,\n storeOptions?: TStoreOptions\n ): Promise<LoginBackchannelResult> {\n const tokenEndpointResponse = await this.authClient.backchannelAuthentication({\n bindingMessage: options.bindingMessage,\n loginHint: options.loginHint,\n authorizationParams: options.authorizationParams,\n });\n\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const stateData = updateStateData(\n this.#options.authorizationParams?.audience ?? 'default',\n existingStateData,\n tokenEndpointResponse\n );\n\n await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n return {\n authorizationDetails: tokenEndpointResponse.authorizationDetails,\n };\n }\n\n /\n Retrieves the user from the store, or undefined if no user found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The user, or undefined if no user found in the store.\n /\n public async getUser(storeOptions?: TStoreOptions) {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n return stateData?.user;\n }\n\n /\n Retrieve the user session from the store, or undefined if no session found.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns The sessionm or undefined if no session found in the store.\n /\n public async getSession(storeOptions?: TStoreOptions): Promise<SessionData \| undefined> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n if (stateData) {\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n const { internal, ...sessionData } = stateData;\n return sessionData;\n }\n }\n\n /\n Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n * Also updates the store when a new token was retrieved from Auth0.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Token Set, containing the access token, as well as additional information.\n /\n public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const audience = this.#options.authorizationParams?.audience ?? 'default';\n const scope = this.#options.authorizationParams?.scope;\n\n const tokenSet = stateData?.tokenSets.find(\n (tokenSet) => tokenSet.audience === audience && (!scope \|\| compareScopes(tokenSet.scope, scope))\n );\n\n if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n return tokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenByRefreshTokenError(\n 'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n );\n }\n\n const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({\n refreshToken: stateData.refreshToken,\n });\n const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n audience: audience,\n };\n }\n\n /\n Retrieves an access token for a connection.\n \n This method attempts to obtain an access token for a specified connection.\n * It first checks if a refresh token exists in the store.\n * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n * that the refresh token was not found.\n \n @param options - Options for retrieving an access token for a connection.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n \n @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n /\n public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n const connectionTokenSet = stateData?.connectionTokenSets?.find(\n (tokenSet) => tokenSet.connection === options.connection\n );\n\n if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n return connectionTokenSet;\n }\n\n if (!stateData?.refreshToken) {\n throw new TokenForConnectionError(\n 'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n );\n }\n\n const tokenEndpointResponse = await this.authClient.getTokenForConnection({\n connection: options.connection,\n loginHint: options.loginHint,\n refreshToken: stateData.refreshToken,\n });\n\n const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n return {\n accessToken: tokenEndpointResponse.accessToken,\n scope: tokenEndpointResponse.scope,\n expiresAt: tokenEndpointResponse.expiresAt,\n connection: options.connection,\n loginHint: options.loginHint,\n };\n }\n\n /\n Logs the user out and returns a URL to redirect the user-agent to after they log out.\n * @param options Options used to configure the logout process.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n * @returns {URL}\n /\n public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n return this.authClient.buildLogoutUrl(options);\n }\n\n /\n Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n * @param logoutToken The logout token to verify and use to delete the session from the store.\n * @param storeOptions Optional options used to pass to the Transaction and State Store.\n \n @throws {BackchannelLogoutError} If the logout token is missing.\n * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n /\n public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n if (!logoutToken) {\n throw new BackchannelLogoutError('Missing Logout Token');\n }\n\n const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });\n\n await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n }\n}\n","/\n Compares two sets of scopes to determine if all required scopes are present in the provided scopes.\n * @param scopes Scopes to compare\n * @param requiredScopes Scopes required to be present in the scopes\n * @returns True if all required scopes are present in the scopes, false otherwise\n /\nexport const compareScopes = (scopes: string \| undefined, requiredScopes: string \| undefined) => {\n // When the scopes and requiredScopes are exactly the same, return true\n // This handles cases where both are empty or undefined or both are the same string\n if (scopes === requiredScopes) {\n return true;\n }\n\n if (!scopes \|\| !requiredScopes) {\n return false;\n }\n\n const scopesSet = new Set(scopes.trim().split(' ').filter(Boolean));\n const requiredScopesArray = requiredScopes.trim().split(' ').filter(Boolean);\n\n return requiredScopesArray.every((scope) => scopesSet.has(scope));\n};\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder \| undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n encoder \|\|= new TextEncoder();\n const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n return new Uint8Array(\n await crypto.subtle.deriveBits(\n {\n name: 'HKDF',\n hash: DIGEST,\n info: encoder.encode(HKDF_INFO),\n salt: encoder.encode(`${salt}${kid}`),\n } as HkdfParams,\n key,\n BIT_LENGTH\n )\n );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n const kid = crypto.randomUUID();\n const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n return await new EncryptJWT(payload)\n .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n .setExpirationTime(expiration)\n .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n const res = await jwtDecrypt<T>(\n value,\n async (protectedHeader) => {\n\n // This error shouldn't happen, as we always set a kid.\n // However, leaving this here as a safety net.\n if (!protectedHeader.kid) {\n throw new Error('Missing \"kid\" in JWE header');\n }\n\n return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n },\n { clockTolerance: 15 }\n );\n return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n protected readonly options: EncryptedStoreOptions;\n\n constructor(options: EncryptedStoreOptions) {\n this.options = options;\n }\n\n abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions \| undefined): Promise<void>;\n abstract get(identifier: string, options?: TStoreOptions \| undefined): Promise<TData \| undefined>;\n abstract delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void>;\n\n protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n return await encrypt(stateData, this.options.secret, identifier, expiration);\n }\n\n protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n\n abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/\n Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n /\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n constructor(options: EncryptedStoreOptions) {\n super(options);\n }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n transactionData: TransactionData,\n removeIfExists?: boolean,\n options?: TStoreOptions\n ): Promise<void> { \n const maxAge = 60 60;\n const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions): Promise<TransactionData \| undefined> {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n if (cookieValue) {\n return await this.decrypt(identifier, cookieValue);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n readonly #rolling: boolean;\n readonly #absoluteDuration: number;\n readonly #inactivityDuration: number;\n\n constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n super(options);\n\n this.#rolling = options.rolling ?? true;\n this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n }\n\n /*\n calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n /\n protected calculateMaxAge(createdAt: number) {\n if (!this.#rolling) {\n return this.#absoluteDuration;\n }\n\n const now = (Date.now() / 1000) \| 0;\n const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n const maxAge = expiresAt - now;\n\n return maxAge > 0 ? maxAge : 0;\n }\n}","import type {\n EncryptedStoreOptions,\n LogoutTokenClaims,\n SessionConfiguration,\n SessionCookieOptions,\n SessionStore,\n StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n const bytes = new Uint8Array(16);\n crypto.getRandomValues(bytes);\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #store: SessionStore<TStoreOptions>;\n readonly #cookieOptions: SessionCookieOptions \| undefined;\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(\n options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n cookieHandler: CookieHandler<TStoreOptions>\n ) {\n super(options);\n\n this.#store = options.store;\n this.#cookieOptions = options.cookie;\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n let sessionId = await this.getSessionId(identifier, options);\n\n // if this is a new session created by a new login we need to remove the old session\n // from the store and regenerate the session ID to prevent session fixation.\n if (sessionId && removeIfExists) {\n await this.#store.delete(sessionId);\n sessionId = generateId();\n }\n\n sessionId ??= generateId();\n\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n path: '/',\n secure: this.#cookieOptions?.secure,\n maxAge,\n };\n const expiration = Date.now() / 1000 + maxAge;\n const encryptedStateData = await this.encrypt<{ id: string }>(\n identifier,\n {\n id: sessionId,\n },\n expiration\n );\n\n await this.#store.set(sessionId, stateData);\n\n this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n const stateData = await this.#store.get(sessionId);\n\n // If we have a session cookie, but no `stateData`, we should remove the cookie.\n if (!stateData) {\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n return stateData;\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const sessionId = await this.getSessionId(identifier, options);\n\n if (sessionId) {\n await this.#store.delete(sessionId);\n }\n\n this.#cookieHandler.deleteCookie(identifier, options);\n }\n\n private async getSessionId(identifier: string, options?: TStoreOptions) {\n const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n if (cookieValue) {\n const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n return sessionCookie.id;\n }\n }\n\n deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions \| undefined): Promise<void> {\n return this.#store.deleteByLogoutToken(claims, options);\n }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n readonly #cookieOptions: SessionCookieOptions \| undefined;\n readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n super(options);\n\n this.#cookieOptions = options.cookie;\n this.#cookieHandler = cookieHandler;\n }\n\n async set(\n identifier: string,\n stateData: StateData,\n removeIfExists?: boolean,\n options?: TStoreOptions \| undefined\n ): Promise<void> {\n const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n const cookieOpts: CookieSerializeOptions = {\n httpOnly: true,\n sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n path: '/',\n secure: this.#cookieOptions?.secure ?? true,\n maxAge,\n };\n const expiration = Math.floor(Date.now() / 1000 + maxAge);\n const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n const chunkSize = 3072;\n const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n const chunks = [...Array(chunkCount).keys()].map((i) => ({\n value: encryptedStateData.substring(i chunkSize, (i + 1) * chunkSize),\n name: `${identifier}.${i}`,\n }));\n\n chunks.forEach((chunk) => {\n this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n });\n\n const existingCookieKeys = this.getCookieKeys(identifier, options);\n const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n cookieKeysToRemove.forEach((key) => {\n this.#cookieHandler.deleteCookie(key, options);\n });\n }\n\n async get(identifier: string, options?: TStoreOptions \| undefined): Promise<StateData \| undefined> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n const encryptedStateData = cookieKeys\n .map((key) => ({\n index: parseInt(key.split('.')[1] as string, 10),\n value: this.#cookieHandler.getCookie(key, options),\n }))\n .sort((a, b) => a.index - b.index)\n .map((item) => item.value)\n .join('');\n\n if (encryptedStateData) {\n return await this.decrypt(identifier, encryptedStateData);\n }\n }\n\n async delete(identifier: string, options?: TStoreOptions \| undefined): Promise<void> {\n const cookieKeys = this.getCookieKeys(identifier, options);\n for (const key of cookieKeys) {\n this.#cookieHandler.deleteCookie(key, options);\n }\n }\n\n deleteByLogoutToken(): Promise<void> {\n throw new Error(\n 'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n );\n }\n\n private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n }\n}\n"],"mappings":";AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACjDO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,wBAAwB,CAAC,cAA6B;AAAA,MAC1D;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,OAAO,SAAS;AAAA,MAChB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,OAAO,SAAS,SAAS;AAAA,IACtE;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,qBAAqB,CAAC,IACrE,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,qBAAqB,IAC3C;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT;AAAA,UACE;AAAA,UACA,aAAa,sBAAsB;AAAA,UACnC,OAAO,sBAAsB;AAAA,UAC7B,WAAU,sBAAsB;AAAA,QAClC;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAC/B,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAClD,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;;;ACtBA,IAAM,gBAAgB,CAAC,QAA4B,mBAAuC;AAG/F,MAAI,WAAW,gBAAgB;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC;AAClE,QAAM,sBAAsB,eAAe,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3E,SAAO,oBAAoB,MAAM,CAAC,UAAU,UAAU,IAAI,KAAK,CAAC;AAClE;;;ADUO,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,aAAa,IAAI,WAAW;AAAA,MAC/B,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,SAAS;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACrF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,eAAe,KAAK;AAAA,MACtE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,WAAW,iBAAiB;AAAA,MAC3E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,WAAW,mBAAmB;AAAA,MAC/E,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,WAAW,0BAA0B;AAAA,MAC5E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAAS,cAAcA,UAAS,OAAO,KAAK;AAAA,IAChG;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,uBAAuB;AAAA,MACzE,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACxE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,WAAW,eAAe,OAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,WAAW,kBAAkB,EAAE,YAAY,CAAC;AAEjF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AEvcA,SAAS,YAAY,kBAAkB;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,WAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,OAAO;AAAA,MACtD;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AACF;;;AC9GO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC;AAAA,IACF;AACA,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AACF;","names":["tokenSet"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@auth0/auth0-server-js",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Auth0 Authentication SDK for Server-Side Applications on JavaScript runtimes",
   "author": "Auth0",
   "license": "MIT",
@@ -24,10 +24,11 @@
     }
   },
   "dependencies": {
-    "@auth0/auth0-auth-js": "^1.0.0",
+    "@auth0/auth0-auth-js": "^1.1.0",
     "jose": "^6.0.8"
   },
   "devDependencies": {
+    "@auth0/typescript-config": "*",
     "@eslint/js": "^9.20.0",
     "@vitest/coverage-v8": "^3.0.6",
     "eslint": "^9.20.1",