@auth0/auth0-server-js 1.0.3 → 1.2.0

package/dist/index.cjs

@@ -72,19 +72,19 @@ var MissingSessionError = class extends Error {
 };
 
 // src/state/utils.ts
+var createUpdatedTokenSet = (audience, response) => ({
+  audience,
+  accessToken: response.accessToken,
+  scope: response.scope,
+  expiresAt: response.expiresAt
+});
 function updateStateData(audience, stateDate, tokenEndpointResponse) {
   if (stateDate) {
     const isNewTokenSet = !stateDate.tokenSets.some(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
     );
-    const createUpdatedTokenSet = (response) => ({
-      audience,
-      accessToken: response.accessToken,
-      scope: response.scope,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(response.expiresAt)
-    });
-    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)] : stateDate.tokenSets.map(
-      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(tokenEndpointResponse) : tokenSet
+    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)] : stateDate.tokenSets.map(
+      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(audience, tokenEndpointResponse) : tokenSet
     );
     return {
       ...stateDate,
@@ -99,12 +99,7 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
       idToken: tokenEndpointResponse.idToken,
       refreshToken: tokenEndpointResponse.refreshToken,
       tokenSets: [
-        {
-          audience,
-          accessToken: tokenEndpointResponse.accessToken,
-          scope: tokenEndpointResponse.scope,
-          expiresAt: tokenEndpointResponse.expiresAt
-        }
+        createUpdatedTokenSet(audience, tokenEndpointResponse)
       ],
       internal: {
         sid: user?.sid,
@@ -136,13 +131,34 @@ function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointR
 
 // src/server-client.ts
 var import_auth0_auth_js = require("@auth0/auth0-auth-js");
+
+// src/utils.ts
+var compareScopes = (scopes, requiredScopes) => {
+  if (scopes === requiredScopes) {
+    return true;
+  }
+  if (!scopes || !requiredScopes) {
+    return false;
+  }
+  const scopesSet = new Set(scopes.trim().split(" ").filter(Boolean));
+  const requiredScopesArray = requiredScopes.trim().split(" ").filter(Boolean);
+  return requiredScopesArray.every((scope) => scopesSet.has(scope));
+};
+
+// src/server-client.ts
 var ServerClient = class {
   #options;
   #transactionStore;
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
-  #authClient;
+  /**
+   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+   * 
+   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+   */
+  authClient;
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -155,14 +171,15 @@ var ServerClient = class {
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
-    this.#authClient = new import_auth0_auth_js.AuthClient({
+    this.authClient = new import_auth0_auth_js.AuthClient({
       domain: this.#options.domain,
       clientId: this.#options.clientId,
       clientSecret: this.#options.clientSecret,
       clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
-      customFetch: this.#options.customFetch
+      customFetch: this.#options.customFetch,
+      useMtls: this.#options.useMtls
     });
   }
   /**
@@ -179,7 +196,7 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
-    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({
+    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
@@ -212,7 +229,7 @@ var ServerClient = class {
     if (!transactionData) {
       throw new MissingTransactionError();
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {
+    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {
       codeVerifier: transactionData.codeVerifier
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -238,7 +255,7 @@ var ServerClient = class {
         "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
       );
     }
-    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({
+    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({
       connection: options.connection,
       connectionScope: options.connectionScope,
       idToken: stateData.idToken,
@@ -288,7 +305,7 @@ var ServerClient = class {
         "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
       );
     }
-    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({
+    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({
       connection: options.connection,
       idToken: stateData.idToken,
       authorizationParams: options.authorizationParams
@@ -333,7 +350,7 @@ var ServerClient = class {
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
   async loginBackchannel(options, storeOptions) {
-    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({
+    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
       authorizationParams: options.authorizationParams
@@ -384,7 +401,7 @@ var ServerClient = class {
     const audience = this.#options.authorizationParams?.audience ?? "default";
     const scope = this.#options.authorizationParams?.scope;
     const tokenSet = stateData?.tokenSets.find(
-      (tokenSet2) => tokenSet2.audience === audience && (!scope || tokenSet2.scope === scope)
+      (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
     if (tokenSet && tokenSet.expiresAt > Date.now() / 1e3) {
       return tokenSet;
@@ -394,7 +411,7 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({
+    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({
       refreshToken: stateData.refreshToken
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -435,7 +452,7 @@ var ServerClient = class {
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({
+    const tokenEndpointResponse = await this.authClient.getTokenForConnection({
       connection: options.connection,
       loginHint: options.loginHint,
       refreshToken: stateData.refreshToken
@@ -458,7 +475,7 @@ var ServerClient = class {
    */
   async logout(options, storeOptions) {
     await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
-    return this.#authClient.buildLogoutUrl(options);
+    return this.authClient.buildLogoutUrl(options);
   }
   /**
    * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
@@ -472,7 +489,7 @@ var ServerClient = class {
     if (!logoutToken) {
       throw new BackchannelLogoutError("Missing Logout Token");
     }
-    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });
+    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });
     await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
   }
 };
@@ -622,13 +639,9 @@ var StatefulStateStore = class extends AbstractSessionStore {
     }
     sessionId ??= generateId();
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Date.now() / 1e3 + maxAge;
     const encryptedStateData = await this.encrypt(
       identifier,
@@ -645,7 +658,7 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       const stateData = await this.#store.get(sessionId);
       if (!stateData) {
-        this.#cookieHandler.deleteCookie(identifier, options);
+        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
       }
       return stateData;
     }
@@ -655,7 +668,7 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       await this.#store.delete(sessionId);
     }
-    this.#cookieHandler.deleteCookie(identifier, options);
+    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
   }
   async getSessionId(identifier, options) {
     const cookieValue = this.#cookieHandler.getCookie(identifier, options);
@@ -667,6 +680,15 @@ var StatefulStateStore = class extends AbstractSessionStore {
   deleteByLogoutToken(claims, options) {
     return this.#store.deleteByLogoutToken(claims, options);
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 
 // src/store/stateless-state-store.ts
@@ -680,13 +702,9 @@ var StatelessStateStore = class extends AbstractSessionStore {
   }
   async set(identifier, stateData, removeIfExists, options) {
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure ?? true,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Math.floor(Date.now() / 1e3 + maxAge);
     const encryptedStateData = await this.encrypt(identifier, stateData, expiration);
     const chunkSize = 3072;
@@ -701,7 +719,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
     const existingCookieKeys = this.getCookieKeys(identifier, options);
     const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));
     cookieKeysToRemove.forEach((key) => {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, cookieOpts);
     });
   }
   async get(identifier, options) {
@@ -717,7 +735,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
   async delete(identifier, options) {
     const cookieKeys = this.getCookieKeys(identifier, options);
     for (const key of cookieKeys) {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());
     }
   }
   deleteByLogoutToken() {
@@ -728,6 +746,15 @@ var StatelessStateStore = class extends AbstractSessionStore {
   getCookieKeys(identifier, options) {
     return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["export { ServerClient } from './server-client.js';\nexport { AbstractStateStore } from './store/abstract-state-store.js';\nexport { AbstractTransactionStore } from './store/abstract-transaction-store.js';\n\nexport type { CookieHandler, CookieSerializeOptions } from './store/cookie-handler.js';\nexport { CookieTransactionStore } from './store/cookie-transaction-store.js';\n\nexport { StatefulStateStore } from './store/stateful-state-store.js';\nexport type { StatefulStateStoreOptions } from './store/stateful-state-store.js';\nexport { StatelessStateStore } from './store/stateless-state-store.js';\n\nexport * from './errors.js';\nexport * from './types.js';\n","/**\n * Error thrown when there is no transaction available.\n */\nexport class MissingTransactionError extends Error {\n  public code: string = 'missing_transaction_error';\n\n  constructor(message?: string) {\n    super(message ?? 'The transaction is missing.');\n    this.name = 'MissingTransactionError';\n  }\n}\n\n\n/**\n * Error thrown when backchannel logout fails.\n */\nexport class BackchannelLogoutError extends Error {\n  public code: string = 'backchannel_logout_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'BackchannelLogoutError';\n  }\n}\n\n/**\n * Error thrown when starting the user-linking failed.\n */\nexport class StartLinkUserError extends Error {\n  public code: string = 'start_link_user_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'StartLinkUserError';\n  }\n}\n\n/**\n * Error thrown when a required argument is missing.\n */\nexport class MissingRequiredArgumentError extends Error {\n  public code: string = 'missing_required_argument_error';\n\n  constructor(argument: string) {\n    super(`The argument '${argument}' is required but was not provided.`);\n    this.name = 'MissingRequiredArgumentError';\n  }\n}\n\n/**\n * Error thrown when a session is missing.\n */\nexport class MissingSessionError extends Error {\n  public code: string = 'missing_session_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'MissingSessionError';\n  }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/**\n * Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n */\nexport function updateStateData(\n  audience: string,\n  stateDate: StateData | undefined,\n  tokenEndpointResponse: TokenResponse\n): StateData {\n  if (stateDate) {\n    const isNewTokenSet = !stateDate.tokenSets.some(\n      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n    );\n\n    const createUpdatedTokenSet = (response: TokenResponse) => ({\n      audience,\n      accessToken: response.accessToken,\n      scope: response.scope,\n      expiresAt: Math.floor(Date.now() / 1000) + Number(response.expiresAt),\n    });\n\n    const tokenSets = isNewTokenSet\n      ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)]\n      : stateDate.tokenSets.map((tokenSet) =>\n          tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n            ? createUpdatedTokenSet(tokenEndpointResponse)\n            : tokenSet\n        );\n\n    return {\n      ...stateDate,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n      tokenSets,\n    };\n  } else {\n    const user = tokenEndpointResponse.claims;\n    return {\n      user,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken,\n      tokenSets: [\n        {\n          audience,\n          accessToken: tokenEndpointResponse.accessToken,\n          scope: tokenEndpointResponse.scope,\n          expiresAt:tokenEndpointResponse.expiresAt,\n        },\n      ],\n      internal: {\n        sid: user?.sid as string,\n        createdAt: Math.floor(Date.now() / 1000),\n      },\n    };\n  }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n  options: AccessTokenForConnectionOptions,\n  stateDate: StateData,\n  tokenEndpointResponse: TokenResponse\n) {\n  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];\n\n  const isNewTokenSet = !stateDate.connectionTokenSets.some(\n    (tokenSet) =>\n      tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n  );\n\n  const connectionTokenSet = {\n    connection: options.connection,\n    loginHint: options.loginHint,\n    accessToken: tokenEndpointResponse.accessToken,\n    scope: tokenEndpointResponse.scope,\n    expiresAt: tokenEndpointResponse.expiresAt,\n  };\n\n  const connectionTokenSets = isNewTokenSet\n    ? [...stateDate.connectionTokenSets, connectionTokenSet]\n    : stateDate.connectionTokenSets.map((tokenSet) =>\n        tokenSet.connection === options.connection &&\n        (!options.loginHint || tokenSet.loginHint === options.loginHint)\n          ? connectionTokenSet\n          : tokenSet\n      );\n\n  return {\n    ...stateDate,\n    connectionTokenSets,\n  };\n}\n","import {\n  AccessTokenForConnectionOptions,\n  ConnectionTokenSet,\n  LoginBackchannelOptions,\n  LoginBackchannelResult,\n  LogoutOptions,\n  ServerClientOptions,\n  SessionData,\n  StartInteractiveLoginOptions,\n  StartLinkUserOptions,\n  StartUnlinkUserOptions,\n  StateStore,\n  TokenSet,\n  TransactionData,\n  TransactionStore,\n} from './types.js';\nimport {\n  BackchannelLogoutError,\n  MissingRequiredArgumentError,\n  MissingSessionError,\n  MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n  TokenForConnectionError,\n  AuthClient,\n  AuthorizationDetails,\n  TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n  readonly #options: ServerClientOptions<TStoreOptions>;\n  readonly #transactionStore: TransactionStore<TStoreOptions>;\n  readonly #transactionStoreIdentifier: string;\n  readonly #stateStore: StateStore<TStoreOptions>;\n  readonly #stateStoreIdentifier: string;\n  readonly #authClient: AuthClient;\n\n  constructor(options: ServerClientOptions<TStoreOptions>) {\n    this.#options = options;\n    this.#stateStoreIdentifier = this.#options.stateIdentifier || '__a0_session';\n    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || '__a0_tx';\n    this.#transactionStore = options.transactionStore;\n    this.#stateStore = options.stateStore;\n\n    if (!this.#options.stateStore) {\n      throw new MissingRequiredArgumentError('stateStore');\n    }\n\n    if (!this.#options.transactionStore) {\n      throw new MissingRequiredArgumentError('transactionStore');\n    }\n\n    this.#authClient = new AuthClient({\n      domain: this.#options.domain,\n      clientId: this.#options.clientId,\n      clientSecret: this.#options.clientSecret,\n      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n      authorizationParams: this.#options.authorizationParams,\n      customFetch: this.#options.customFetch,\n    });\n  }\n\n  /**\n   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Optional options used to configure the interactive login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n    if (!redirectUri) {\n      throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n    }\n\n    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({\n      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n      authorizationParams: {\n        ...options?.authorizationParams,\n        redirect_uri: redirectUri,\n      },\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return authorizationUrl;\n  }\n\n  /**\n   * Completes the interactive login process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n   */\n  public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n    if (!transactionData) {\n      throw new MissingTransactionError();\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {\n      codeVerifier: transactionData.codeVerifier,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n      appState?: TAppState;\n      authorizationDetails?: AuthorizationDetails[];\n    };\n  }\n\n  /**\n   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Options used to configure the user linking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n      );\n    }\n\n    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({\n      connection: options.connection,\n      connectionScope: options.connectionScope,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return linkUserUrl;\n  }\n\n  /**\n   * Completes the user linking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n   * @param options Options used to configure the user unlinking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n      );\n    }\n\n    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({\n      connection: options.connection,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return unlinkUserUrl;\n  }\n\n  /**\n   * Completes the user unlinking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Logs in using Client-Initiated Backchannel Authentication.\n   *\n   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n   * @param options Options used to configure the backchannel login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n   *\n   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n   */\n  public async loginBackchannel(\n    options: LoginBackchannelOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginBackchannelResult> {\n    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({\n      bindingMessage: options.bindingMessage,\n      loginHint: options.loginHint,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return {\n      authorizationDetails: tokenEndpointResponse.authorizationDetails,\n    };\n  }\n\n  /**\n   * Retrieves the user from the store, or undefined if no user found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The user, or undefined if no user found in the store.\n   */\n  public async getUser(storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    return stateData?.user;\n  }\n\n  /**\n   * Retrieve the user session from the store, or undefined if no session found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The sessionm or undefined if no session found in the store.\n   */\n  public async getSession(storeOptions?: TStoreOptions): Promise<SessionData | undefined> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (stateData) {\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { internal, ...sessionData } = stateData;\n      return sessionData;\n    }\n  }\n\n  /**\n   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n   * Also updates the store when a new token was retrieved from Auth0.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Token Set, containing the access token, as well as additional information.\n   */\n  public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const audience = this.#options.authorizationParams?.audience ?? 'default';\n    const scope = this.#options.authorizationParams?.scope;\n\n    const tokenSet = stateData?.tokenSets.find(\n      (tokenSet) => tokenSet.audience === audience && (!scope || tokenSet.scope === scope)\n    );\n\n    if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n      return tokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenByRefreshTokenError(\n        'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({\n      refreshToken: stateData.refreshToken,\n    });\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      audience: audience,\n    };\n  }\n\n  /**\n   * Retrieves an access token for a connection.\n   *\n   * This method attempts to obtain an access token for a specified connection.\n   * It first checks if a refresh token exists in the store.\n   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n   * that the refresh token was not found.\n   *\n   * @param options - Options for retrieving an access token for a connection.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n   */\n  public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const connectionTokenSet = stateData?.connectionTokenSets?.find(\n      (tokenSet) => tokenSet.connection === options.connection\n    );\n\n    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n      return connectionTokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenForConnectionError(\n        'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({\n      connection: options.connection,\n      loginHint: options.loginHint,\n      refreshToken: stateData.refreshToken,\n    });\n\n    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      connection: options.connection,\n      loginHint: options.loginHint,\n    };\n  }\n\n  /**\n   * Logs the user out and returns a URL to redirect the user-agent to after they log out.\n   * @param options Options used to configure the logout process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns {URL}\n   */\n  public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n    return this.#authClient.buildLogoutUrl(options);\n  }\n\n  /**\n   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n   * @param logoutToken The logout token to verify and use to delete the session from the store.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelLogoutError} If the logout token is missing.\n   * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n   */\n  public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n    if (!logoutToken) {\n      throw new BackchannelLogoutError('Missing Logout Token');\n    }\n\n    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });\n\n    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n  }\n}\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder | undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n  encoder ||= new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n  return new Uint8Array(\n    await crypto.subtle.deriveBits(\n      {\n        name: 'HKDF',\n        hash: DIGEST,\n        info: encoder.encode(HKDF_INFO),\n        salt: encoder.encode(`${salt}${kid}`),\n      } as HkdfParams,\n      key,\n      BIT_LENGTH\n    )\n  );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n  const kid = crypto.randomUUID();\n  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n  return await new EncryptJWT(payload)\n    .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n    .setExpirationTime(expiration)\n    .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n  const res = await jwtDecrypt<T>(\n    value,\n    async (protectedHeader) => {\n\n      // This error shouldn't happen, as we always set a kid.\n      // However, leaving this here as a safety net.\n      if (!protectedHeader.kid) {\n        throw new Error('Missing \"kid\" in JWE header');\n      }\n\n      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n    },\n    { clockTolerance: 15 }\n  );\n  return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n  protected readonly options: EncryptedStoreOptions;\n\n  constructor(options: EncryptedStoreOptions) {\n    this.options = options;\n  }\n\n  abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;\n  abstract get(identifier: string, options?: TStoreOptions | undefined): Promise<TData | undefined>;\n  abstract delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;\n\n  protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n    return await encrypt(stateData, this.options.secret, identifier, expiration);\n  }\n\n  protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n    return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n  }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n\n  abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    transactionData: TransactionData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions\n  ): Promise<void> {   \n    const maxAge = 60 * 60;\n    const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions): Promise<TransactionData | undefined> {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n    if (cookieValue) {\n      return await this.decrypt(identifier, cookieValue);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n  readonly #rolling: boolean;\n  readonly #absoluteDuration: number;\n  readonly #inactivityDuration: number;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n    super(options);\n\n    this.#rolling = options.rolling ?? true;\n    this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n    this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n  }\n\n  /**\n   * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n   */\n  protected calculateMaxAge(createdAt: number) {\n    if (!this.#rolling) {\n      return this.#absoluteDuration;\n    }\n\n    const now = (Date.now() / 1000) | 0;\n    const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n    const maxAge = expiresAt - now;\n\n    return maxAge > 0 ? maxAge : 0;\n  }\n}","import type {\n  EncryptedStoreOptions,\n  LogoutTokenClaims,\n  SessionConfiguration,\n  SessionCookieOptions,\n  SessionStore,\n  StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n  store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #store: SessionStore<TStoreOptions>;\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(\n    options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n    cookieHandler: CookieHandler<TStoreOptions>\n  ) {\n    super(options);\n\n    this.#store = options.store;\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    let sessionId = await this.getSessionId(identifier, options);\n\n    // if this is a new session created by a new login we need to remove the old session\n    // from the store and regenerate the session ID to prevent session fixation.\n    if (sessionId && removeIfExists) {\n      await this.#store.delete(sessionId);\n      sessionId = generateId();\n    }\n\n    sessionId ??= generateId();\n\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts: CookieSerializeOptions = {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: '/',\n      secure: this.#cookieOptions?.secure,\n      maxAge,\n    };\n    const expiration = Date.now() / 1000 + maxAge;\n    const encryptedStateData = await this.encrypt<{ id: string }>(\n      identifier,\n      {\n        id: sessionId,\n      },\n      expiration\n    );\n\n    await this.#store.set(sessionId, stateData);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      const stateData = await this.#store.get(sessionId);\n\n      // If we have a session cookie, but no `stateData`, we should remove the cookie.\n      if (!stateData) {\n        this.#cookieHandler.deleteCookie(identifier, options);\n      }\n\n      return stateData;\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      await this.#store.delete(sessionId);\n    }\n\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n\n  private async getSessionId(identifier: string, options?: TStoreOptions) {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n    if (cookieValue) {\n      const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n      return sessionCookie.id;\n    }\n  }\n\n  deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void> {\n    return this.#store.deleteByLogoutToken(claims, options);\n  }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts: CookieSerializeOptions = {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      maxAge,\n    };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n    const chunkSize = 3072;\n    const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n    const chunks = [...Array(chunkCount).keys()].map((i) => ({\n      value: encryptedStateData.substring(i * chunkSize, (i + 1) * chunkSize),\n      name: `${identifier}.${i}`,\n    }));\n\n    chunks.forEach((chunk) => {\n      this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n    });\n\n    const existingCookieKeys = this.getCookieKeys(identifier, options);\n    const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n    cookieKeysToRemove.forEach((key) => {\n      this.#cookieHandler.deleteCookie(key, options);\n    });\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    const encryptedStateData = cookieKeys\n      .map((key) => ({\n        index: parseInt(key.split('.')[1] as string, 10),\n        value: this.#cookieHandler.getCookie(key, options),\n      }))\n      .sort((a, b) => a.index - b.index)\n      .map((item) => item.value)\n      .join('');\n\n    if (encryptedStateData) {\n      return await this.decrypt(identifier, encryptedStateData);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    for (const key of cookieKeys) {\n      this.#cookieHandler.deleteCookie(key, options);\n    }\n  }\n\n  deleteByLogoutToken(): Promise<void> {\n    throw new Error(\n      'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n    );\n  }\n\n  private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n    return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACjDO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,wBAAwB,CAAC,cAA6B;AAAA,MAC1D;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,OAAO,SAAS;AAAA,MAChB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,OAAO,SAAS,SAAS;AAAA,IACtE;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,qBAAqB,CAAC,IACrE,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,qBAAqB,IAC3C;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT;AAAA,UACE;AAAA,UACA,aAAa,sBAAsB;AAAA,UACnC,OAAO,sBAAsB;AAAA,UAC7B,WAAU,sBAAsB;AAAA,QAClC;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAC/B,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAClD,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA,2BAKO;AAEA,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,cAAc,IAAI,gCAAW;AAAA,MAChC,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACtF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,eAAe,KAAK;AAAA,MACvE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,YAAY,iBAAiB;AAAA,MAC5E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,YAAY,mBAAmB;AAAA,MAChF,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,YAAY,0BAA0B;AAAA,MAC7E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAASA,UAAS,UAAU;AAAA,IAChF;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,uBAAuB;AAAA,MAC1E,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACzE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,YAAY,eAAe,OAAO;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,YAAY,kBAAkB,EAAE,YAAY,CAAC;AAElF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AC9bA,kBAAuC;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,uBAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,UAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,OAAO;AAAA,MACtD;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AACF;;;AC9GO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC;AAAA,IACF;AACA,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AACF;","names":["tokenSet"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/utils.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["export { ServerClient } from './server-client.js';\nexport { AbstractStateStore } from './store/abstract-state-store.js';\nexport { AbstractTransactionStore } from './store/abstract-transaction-store.js';\n\nexport type { CookieHandler, CookieSerializeOptions } from './store/cookie-handler.js';\nexport { CookieTransactionStore } from './store/cookie-transaction-store.js';\n\nexport { StatefulStateStore } from './store/stateful-state-store.js';\nexport type { StatefulStateStoreOptions } from './store/stateful-state-store.js';\nexport { StatelessStateStore } from './store/stateless-state-store.js';\n\nexport * from './errors.js';\nexport * from './types.js';\n","/**\n * Error thrown when there is no transaction available.\n */\nexport class MissingTransactionError extends Error {\n  public code: string = 'missing_transaction_error';\n\n  constructor(message?: string) {\n    super(message ?? 'The transaction is missing.');\n    this.name = 'MissingTransactionError';\n  }\n}\n\n\n/**\n * Error thrown when backchannel logout fails.\n */\nexport class BackchannelLogoutError extends Error {\n  public code: string = 'backchannel_logout_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'BackchannelLogoutError';\n  }\n}\n\n/**\n * Error thrown when starting the user-linking failed.\n */\nexport class StartLinkUserError extends Error {\n  public code: string = 'start_link_user_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'StartLinkUserError';\n  }\n}\n\n/**\n * Error thrown when a required argument is missing.\n */\nexport class MissingRequiredArgumentError extends Error {\n  public code: string = 'missing_required_argument_error';\n\n  constructor(argument: string) {\n    super(`The argument '${argument}' is required but was not provided.`);\n    this.name = 'MissingRequiredArgumentError';\n  }\n}\n\n/**\n * Error thrown when a session is missing.\n */\nexport class MissingSessionError extends Error {\n  public code: string = 'missing_session_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'MissingSessionError';\n  }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/**\n * Creates an updated token set object from the token endpoint response\n * @param audience The audience for which the token was requested\n * @param response The response from the token endpoint\n * @returns Updated token set object\n */\nconst createUpdatedTokenSet = (audience: string, response: TokenResponse) => ({\n  audience,\n  accessToken: response.accessToken,\n  scope: response.scope,\n  expiresAt: response.expiresAt,\n});\n\n/**\n * Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n */\nexport function updateStateData(\n  audience: string,\n  stateDate: StateData | undefined,\n  tokenEndpointResponse: TokenResponse\n): StateData {\n  if (stateDate) {\n    const isNewTokenSet = !stateDate.tokenSets.some(\n      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n    );\n\n    const tokenSets = isNewTokenSet\n      ? [...stateDate.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)]\n      : stateDate.tokenSets.map((tokenSet) =>\n          tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n            ? createUpdatedTokenSet(audience, tokenEndpointResponse)\n            : tokenSet\n        );\n\n    return {\n      ...stateDate,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n      tokenSets,\n    };\n  } else {\n    const user = tokenEndpointResponse.claims;\n    return {\n      user,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken,\n      tokenSets: [\n        createUpdatedTokenSet(audience, tokenEndpointResponse),\n      ],\n      internal: {\n        sid: user?.sid as string,\n        createdAt: Math.floor(Date.now() / 1000),\n      },\n    };\n  }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n  options: AccessTokenForConnectionOptions,\n  stateDate: StateData,\n  tokenEndpointResponse: TokenResponse\n) {\n  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];\n\n  const isNewTokenSet = !stateDate.connectionTokenSets.some(\n    (tokenSet) =>\n      tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n  );\n\n  const connectionTokenSet = {\n    connection: options.connection,\n    loginHint: options.loginHint,\n    accessToken: tokenEndpointResponse.accessToken,\n    scope: tokenEndpointResponse.scope,\n    expiresAt: tokenEndpointResponse.expiresAt,\n  };\n\n  const connectionTokenSets = isNewTokenSet\n    ? [...stateDate.connectionTokenSets, connectionTokenSet]\n    : stateDate.connectionTokenSets.map((tokenSet) =>\n        tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n          ? connectionTokenSet\n          : tokenSet\n      );\n\n  return {\n    ...stateDate,\n    connectionTokenSets,\n  };\n}\n","import {\n  AccessTokenForConnectionOptions,\n  ConnectionTokenSet,\n  LoginBackchannelOptions,\n  LoginBackchannelResult,\n  LogoutOptions,\n  ServerClientOptions,\n  SessionData,\n  StartInteractiveLoginOptions,\n  StartLinkUserOptions,\n  StartUnlinkUserOptions,\n  StateStore,\n  TokenSet,\n  TransactionData,\n  TransactionStore,\n} from './types.js';\nimport {\n  BackchannelLogoutError,\n  MissingRequiredArgumentError,\n  MissingSessionError,\n  MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n  TokenForConnectionError,\n  AuthClient,\n  AuthorizationDetails,\n  TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\nimport { compareScopes } from './utils.js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n  readonly #options: ServerClientOptions<TStoreOptions>;\n  readonly #transactionStore: TransactionStore<TStoreOptions>;\n  readonly #transactionStoreIdentifier: string;\n  readonly #stateStore: StateStore<TStoreOptions>;\n  readonly #stateStoreIdentifier: string;\n\n  /**\n   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.\n   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.\n   * \n   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.\n   */\n  readonly authClient: AuthClient;\n\n  constructor(options: ServerClientOptions<TStoreOptions>) {\n    this.#options = options;\n    this.#stateStoreIdentifier = this.#options.stateIdentifier || '__a0_session';\n    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || '__a0_tx';\n    this.#transactionStore = options.transactionStore;\n    this.#stateStore = options.stateStore;\n\n    if (!this.#options.stateStore) {\n      throw new MissingRequiredArgumentError('stateStore');\n    }\n\n    if (!this.#options.transactionStore) {\n      throw new MissingRequiredArgumentError('transactionStore');\n    }\n\n    this.authClient = new AuthClient({\n      domain: this.#options.domain,\n      clientId: this.#options.clientId,\n      clientSecret: this.#options.clientSecret,\n      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n      authorizationParams: this.#options.authorizationParams,\n      customFetch: this.#options.customFetch,\n      useMtls: this.#options.useMtls,\n    });\n  }\n\n  /**\n   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Optional options used to configure the interactive login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n    if (!redirectUri) {\n      throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n    }\n\n    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({\n      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n      authorizationParams: {\n        ...options?.authorizationParams,\n        redirect_uri: redirectUri,\n      },\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return authorizationUrl;\n  }\n\n  /**\n   * Completes the interactive login process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n   */\n  public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n    if (!transactionData) {\n      throw new MissingTransactionError();\n    }\n\n    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {\n      codeVerifier: transactionData.codeVerifier,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n      appState?: TAppState;\n      authorizationDetails?: AuthorizationDetails[];\n    };\n  }\n\n  /**\n   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Options used to configure the user linking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n      );\n    }\n\n    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({\n      connection: options.connection,\n      connectionScope: options.connectionScope,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return linkUserUrl;\n  }\n\n  /**\n   * Completes the user linking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n   * @param options Options used to configure the user unlinking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n      );\n    }\n\n    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({\n      connection: options.connection,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return unlinkUserUrl;\n  }\n\n  /**\n   * Completes the user unlinking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Logs in using Client-Initiated Backchannel Authentication.\n   *\n   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n   * @param options Options used to configure the backchannel login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n   *\n   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n   */\n  public async loginBackchannel(\n    options: LoginBackchannelOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginBackchannelResult> {\n    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({\n      bindingMessage: options.bindingMessage,\n      loginHint: options.loginHint,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return {\n      authorizationDetails: tokenEndpointResponse.authorizationDetails,\n    };\n  }\n\n  /**\n   * Retrieves the user from the store, or undefined if no user found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The user, or undefined if no user found in the store.\n   */\n  public async getUser(storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    return stateData?.user;\n  }\n\n  /**\n   * Retrieve the user session from the store, or undefined if no session found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The sessionm or undefined if no session found in the store.\n   */\n  public async getSession(storeOptions?: TStoreOptions): Promise<SessionData | undefined> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (stateData) {\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { internal, ...sessionData } = stateData;\n      return sessionData;\n    }\n  }\n\n  /**\n   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n   * Also updates the store when a new token was retrieved from Auth0.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Token Set, containing the access token, as well as additional information.\n   */\n  public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const audience = this.#options.authorizationParams?.audience ?? 'default';\n    const scope = this.#options.authorizationParams?.scope;\n\n    const tokenSet = stateData?.tokenSets.find(\n      (tokenSet) => tokenSet.audience === audience && (!scope || compareScopes(tokenSet.scope, scope))\n    );\n\n    if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n      return tokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenByRefreshTokenError(\n        'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({\n      refreshToken: stateData.refreshToken,\n    });\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      audience: audience,\n    };\n  }\n\n  /**\n   * Retrieves an access token for a connection.\n   *\n   * This method attempts to obtain an access token for a specified connection.\n   * It first checks if a refresh token exists in the store.\n   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n   * that the refresh token was not found.\n   *\n   * @param options - Options for retrieving an access token for a connection.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n   */\n  public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const connectionTokenSet = stateData?.connectionTokenSets?.find(\n      (tokenSet) => tokenSet.connection === options.connection\n    );\n\n    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n      return connectionTokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenForConnectionError(\n        'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.authClient.getTokenForConnection({\n      connection: options.connection,\n      loginHint: options.loginHint,\n      refreshToken: stateData.refreshToken,\n    });\n\n    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      connection: options.connection,\n      loginHint: options.loginHint,\n    };\n  }\n\n  /**\n   * Logs the user out and returns a URL to redirect the user-agent to after they log out.\n   * @param options Options used to configure the logout process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns {URL}\n   */\n  public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n    return this.authClient.buildLogoutUrl(options);\n  }\n\n  /**\n   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n   * @param logoutToken The logout token to verify and use to delete the session from the store.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelLogoutError} If the logout token is missing.\n   * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n   */\n  public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n    if (!logoutToken) {\n      throw new BackchannelLogoutError('Missing Logout Token');\n    }\n\n    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });\n\n    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n  }\n}\n","/**\n * Compares two sets of scopes to determine if all required scopes are present in the provided scopes.\n * @param scopes Scopes to compare\n * @param requiredScopes Scopes required to be present in the scopes\n * @returns True if all required scopes are present in the scopes, false otherwise\n */\nexport const compareScopes = (scopes: string | undefined, requiredScopes: string | undefined) => {\n  // When the scopes and requiredScopes are exactly the same, return true\n  // This handles cases where both are empty or undefined or both are the same string\n  if (scopes === requiredScopes) {\n    return true;\n  }\n\n  if (!scopes || !requiredScopes) {\n    return false;\n  }\n\n  const scopesSet = new Set(scopes.trim().split(' ').filter(Boolean));\n  const requiredScopesArray = requiredScopes.trim().split(' ').filter(Boolean);\n\n  return requiredScopesArray.every((scope) => scopesSet.has(scope));\n};\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder | undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n  encoder ||= new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n  return new Uint8Array(\n    await crypto.subtle.deriveBits(\n      {\n        name: 'HKDF',\n        hash: DIGEST,\n        info: encoder.encode(HKDF_INFO),\n        salt: encoder.encode(`${salt}${kid}`),\n      } as HkdfParams,\n      key,\n      BIT_LENGTH\n    )\n  );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n  const kid = crypto.randomUUID();\n  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n  return await new EncryptJWT(payload)\n    .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n    .setExpirationTime(expiration)\n    .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n  const res = await jwtDecrypt<T>(\n    value,\n    async (protectedHeader) => {\n\n      // This error shouldn't happen, as we always set a kid.\n      // However, leaving this here as a safety net.\n      if (!protectedHeader.kid) {\n        throw new Error('Missing \"kid\" in JWE header');\n      }\n\n      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n    },\n    { clockTolerance: 15 }\n  );\n  return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n  protected readonly options: EncryptedStoreOptions;\n\n  constructor(options: EncryptedStoreOptions) {\n    this.options = options;\n  }\n\n  abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;\n  abstract get(identifier: string, options?: TStoreOptions | undefined): Promise<TData | undefined>;\n  abstract delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;\n\n  protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n    return await encrypt(stateData, this.options.secret, identifier, expiration);\n  }\n\n  protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n    return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n  }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n\n  abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    transactionData: TransactionData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions\n  ): Promise<void> {   \n    const maxAge = 60 * 60;\n    const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions): Promise<TransactionData | undefined> {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n    if (cookieValue) {\n      return await this.decrypt(identifier, cookieValue);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n  readonly #rolling: boolean;\n  readonly #absoluteDuration: number;\n  readonly #inactivityDuration: number;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n    super(options);\n\n    this.#rolling = options.rolling ?? true;\n    this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n    this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n  }\n\n  /**\n   * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n   */\n  protected calculateMaxAge(createdAt: number) {\n    if (!this.#rolling) {\n      return this.#absoluteDuration;\n    }\n\n    const now = (Date.now() / 1000) | 0;\n    const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n    const maxAge = expiresAt - now;\n\n    return maxAge > 0 ? maxAge : 0;\n  }\n}","import type {\n  EncryptedStoreOptions,\n  LogoutTokenClaims,\n  SessionConfiguration,\n  SessionCookieOptions,\n  SessionStore,\n  StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n  store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #store: SessionStore<TStoreOptions>;\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(\n    options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n    cookieHandler: CookieHandler<TStoreOptions>\n  ) {\n    super(options);\n\n    this.#store = options.store;\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    let sessionId = await this.getSessionId(identifier, options);\n\n    // if this is a new session created by a new login we need to remove the old session\n    // from the store and regenerate the session ID to prevent session fixation.\n    if (sessionId && removeIfExists) {\n      await this.#store.delete(sessionId);\n      sessionId = generateId();\n    }\n\n    sessionId ??= generateId();\n\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Date.now() / 1000 + maxAge;\n    const encryptedStateData = await this.encrypt<{ id: string }>(\n      identifier,\n      {\n        id: sessionId,\n      },\n      expiration\n    );\n\n    await this.#store.set(sessionId, stateData);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      const stateData = await this.#store.get(sessionId);\n\n      // If we have a session cookie, but no `stateData`, we should remove the cookie.\n      if (!stateData) {\n        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n      }\n\n      return stateData;\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      await this.#store.delete(sessionId);\n    }\n\n    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n  }\n\n  private async getSessionId(identifier: string, options?: TStoreOptions) {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n    if (cookieValue) {\n      const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n      return sessionCookie.id;\n    }\n  }\n\n  deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void> {\n    return this.#store.deleteByLogoutToken(claims, options);\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n    const chunkSize = 3072;\n    const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n    const chunks = [...Array(chunkCount).keys()].map((i) => ({\n      value: encryptedStateData.substring(i * chunkSize, (i + 1) * chunkSize),\n      name: `${identifier}.${i}`,\n    }));\n\n    chunks.forEach((chunk) => {\n      this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n    });\n\n    const existingCookieKeys = this.getCookieKeys(identifier, options);\n    const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n    cookieKeysToRemove.forEach((key) => {\n      this.#cookieHandler.deleteCookie(key, options, cookieOpts);\n    });\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    const encryptedStateData = cookieKeys\n      .map((key) => ({\n        index: parseInt(key.split('.')[1] as string, 10),\n        value: this.#cookieHandler.getCookie(key, options),\n      }))\n      .sort((a, b) => a.index - b.index)\n      .map((item) => item.value)\n      .join('');\n\n    if (encryptedStateData) {\n      return await this.decrypt(identifier, encryptedStateData);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    for (const key of cookieKeys) {\n      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());\n    }\n  }\n\n  deleteByLogoutToken(): Promise<void> {\n    throw new Error(\n      'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n    );\n  }\n\n  private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n    return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;AClDA,IAAM,wBAAwB,CAAC,UAAkB,cAA6B;AAAA,EAC5E;AAAA,EACA,aAAa,SAAS;AAAA,EACtB,OAAO,SAAS;AAAA,EAChB,WAAW,SAAS;AACtB;AASO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,UAAU,qBAAqB,CAAC,IAC/E,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,UAAU,qBAAqB,IACrD;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT,sBAAsB,UAAU,qBAAqB;AAAA,MACvD;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAChG,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA,2BAKO;;;ACtBA,IAAM,gBAAgB,CAAC,QAA4B,mBAAuC;AAG/F,MAAI,WAAW,gBAAgB;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC;AAClE,QAAM,sBAAsB,eAAe,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3E,SAAO,oBAAoB,MAAM,CAAC,UAAU,UAAU,IAAI,KAAK,CAAC;AAClE;;;ADUO,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,aAAa,IAAI,gCAAW;AAAA,MAC/B,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,SAAS;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACrF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,eAAe,KAAK;AAAA,MACtE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,WAAW,iBAAiB;AAAA,MAC3E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,WAAW,mBAAmB;AAAA,MAC/E,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,WAAW,0BAA0B;AAAA,MAC5E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAAS,cAAcA,UAAS,OAAO,KAAK;AAAA,IAChG;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,uBAAuB;AAAA,MACzE,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACxE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,WAAW,eAAe,OAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,WAAW,kBAAkB,EAAE,YAAY,CAAC;AAEjF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AEvcA,kBAAuC;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,uBAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,UAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,MAChF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,EAChF;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;ACpHO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,SAAS,UAAU;AAAA,IAC3D,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,SAAS,KAAK,kBAAkB,CAAC;AAAA,IACzE;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;","names":["tokenSet"]}

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { AuthorizationDetails } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, AuthClient } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 interface ServerClientOptions<TStoreOptions = unknown> {
@@ -16,6 +16,12 @@ interface ServerClientOptions<TStoreOptions = unknown> {
     customFetch?: typeof fetch;
     transactionStore: TransactionStore<TStoreOptions>;
     stateStore: StateStore<TStoreOptions>;
+    /**
+     * Indicates whether the SDK should use the mTLS endpoints if they are available.
+     *
+     * When set to `true`, using a `customFetch` is required.
+     */
+    useMtls?: boolean;
 }
 interface UserClaims {
     sub: string;
@@ -174,10 +180,31 @@ interface SessionCookieOptions {
      * Default: depends on the protocol of the application's base URL. If the protocol is `https`, then `true`, otherwise `false`.
      */
     secure?: boolean;
+    /**
+     * The path attribute of the session cookie.
+     *
+     * Default: `/`.
+     *
+     * @remarks
+     * Changing the cookie path will cause existing cookies to behave differently:
+     *
+     * - If the cookie path is currently "/" (which is the default) and you change it to "/something", existing cookies (using "/" as the path) will be picked up when using "/something", but also for anything outside of "/something", additionally logout will not correctly delete the cookie.
+     * - If the cookiepath is "/something" and you change it to "/", the existing cookie will not be picked up by anything other than "/something".
+     *
+     *  In general, changing the cookie path affects existing cookies and needs to be done with extra care around existing cookie implications.
+     */
+    path?: string;
 }
 
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
+    /**
+     * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+     * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+     *
+     * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+     */
+    readonly authClient: AuthClient;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -396,8 +423,9 @@ interface CookieHandler<TStoreOptions> {
      * Delete a cookie using the framework specific integration.
      * @param name The name of the cookie to delete.
      * @param storeOptions The options for the store, which may include framework-specific configurations.
+     * @param options The options for serializing the cookie.
      */
-    deleteCookie: (name: string, storeOptions?: TStoreOptions) => void;
+    deleteCookie: (name: string, storeOptions?: TStoreOptions, options?: CookieSerializeOptions) => void;
 }
 
 declare class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AuthorizationDetails } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, AuthClient } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 interface ServerClientOptions<TStoreOptions = unknown> {
@@ -16,6 +16,12 @@ interface ServerClientOptions<TStoreOptions = unknown> {
     customFetch?: typeof fetch;
     transactionStore: TransactionStore<TStoreOptions>;
     stateStore: StateStore<TStoreOptions>;
+    /**
+     * Indicates whether the SDK should use the mTLS endpoints if they are available.
+     *
+     * When set to `true`, using a `customFetch` is required.
+     */
+    useMtls?: boolean;
 }
 interface UserClaims {
     sub: string;
@@ -174,10 +180,31 @@ interface SessionCookieOptions {
      * Default: depends on the protocol of the application's base URL. If the protocol is `https`, then `true`, otherwise `false`.
      */
     secure?: boolean;
+    /**
+     * The path attribute of the session cookie.
+     *
+     * Default: `/`.
+     *
+     * @remarks
+     * Changing the cookie path will cause existing cookies to behave differently:
+     *
+     * - If the cookie path is currently "/" (which is the default) and you change it to "/something", existing cookies (using "/" as the path) will be picked up when using "/something", but also for anything outside of "/something", additionally logout will not correctly delete the cookie.
+     * - If the cookiepath is "/something" and you change it to "/", the existing cookie will not be picked up by anything other than "/something".
+     *
+     *  In general, changing the cookie path affects existing cookies and needs to be done with extra care around existing cookie implications.
+     */
+    path?: string;
 }
 
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
+    /**
+     * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+     * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+     *
+     * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+     */
+    readonly authClient: AuthClient;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -396,8 +423,9 @@ interface CookieHandler<TStoreOptions> {
      * Delete a cookie using the framework specific integration.
      * @param name The name of the cookie to delete.
      * @param storeOptions The options for the store, which may include framework-specific configurations.
+     * @param options The options for serializing the cookie.
      */
-    deleteCookie: (name: string, storeOptions?: TStoreOptions) => void;
+    deleteCookie: (name: string, storeOptions?: TStoreOptions, options?: CookieSerializeOptions) => void;
 }
 
 declare class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {

package/dist/index.js

@@ -36,19 +36,19 @@ var MissingSessionError = class extends Error {
 };
 
 // src/state/utils.ts
+var createUpdatedTokenSet = (audience, response) => ({
+  audience,
+  accessToken: response.accessToken,
+  scope: response.scope,
+  expiresAt: response.expiresAt
+});
 function updateStateData(audience, stateDate, tokenEndpointResponse) {
   if (stateDate) {
     const isNewTokenSet = !stateDate.tokenSets.some(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
     );
-    const createUpdatedTokenSet = (response) => ({
-      audience,
-      accessToken: response.accessToken,
-      scope: response.scope,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(response.expiresAt)
-    });
-    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)] : stateDate.tokenSets.map(
-      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(tokenEndpointResponse) : tokenSet
+    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)] : stateDate.tokenSets.map(
+      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(audience, tokenEndpointResponse) : tokenSet
     );
     return {
       ...stateDate,
@@ -63,12 +63,7 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
       idToken: tokenEndpointResponse.idToken,
       refreshToken: tokenEndpointResponse.refreshToken,
       tokenSets: [
-        {
-          audience,
-          accessToken: tokenEndpointResponse.accessToken,
-          scope: tokenEndpointResponse.scope,
-          expiresAt: tokenEndpointResponse.expiresAt
-        }
+        createUpdatedTokenSet(audience, tokenEndpointResponse)
       ],
       internal: {
         sid: user?.sid,
@@ -104,13 +99,34 @@ import {
   AuthClient,
   TokenByRefreshTokenError
 } from "@auth0/auth0-auth-js";
+
+// src/utils.ts
+var compareScopes = (scopes, requiredScopes) => {
+  if (scopes === requiredScopes) {
+    return true;
+  }
+  if (!scopes || !requiredScopes) {
+    return false;
+  }
+  const scopesSet = new Set(scopes.trim().split(" ").filter(Boolean));
+  const requiredScopesArray = requiredScopes.trim().split(" ").filter(Boolean);
+  return requiredScopesArray.every((scope) => scopesSet.has(scope));
+};
+
+// src/server-client.ts
 var ServerClient = class {
   #options;
   #transactionStore;
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
-  #authClient;
+  /**
+   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
+   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
+   * 
+   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
+   */
+  authClient;
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -123,14 +139,15 @@ var ServerClient = class {
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
-    this.#authClient = new AuthClient({
+    this.authClient = new AuthClient({
       domain: this.#options.domain,
       clientId: this.#options.clientId,
       clientSecret: this.#options.clientSecret,
       clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
-      customFetch: this.#options.customFetch
+      customFetch: this.#options.customFetch,
+      useMtls: this.#options.useMtls
     });
   }
   /**
@@ -147,7 +164,7 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
-    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({
+    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
@@ -180,7 +197,7 @@ var ServerClient = class {
     if (!transactionData) {
       throw new MissingTransactionError();
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {
+    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {
       codeVerifier: transactionData.codeVerifier
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -206,7 +223,7 @@ var ServerClient = class {
         "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
       );
     }
-    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({
+    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({
       connection: options.connection,
       connectionScope: options.connectionScope,
       idToken: stateData.idToken,
@@ -256,7 +273,7 @@ var ServerClient = class {
         "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
       );
     }
-    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({
+    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({
       connection: options.connection,
       idToken: stateData.idToken,
       authorizationParams: options.authorizationParams
@@ -301,7 +318,7 @@ var ServerClient = class {
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
   async loginBackchannel(options, storeOptions) {
-    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({
+    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
       authorizationParams: options.authorizationParams
@@ -352,7 +369,7 @@ var ServerClient = class {
     const audience = this.#options.authorizationParams?.audience ?? "default";
     const scope = this.#options.authorizationParams?.scope;
     const tokenSet = stateData?.tokenSets.find(
-      (tokenSet2) => tokenSet2.audience === audience && (!scope || tokenSet2.scope === scope)
+      (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
     if (tokenSet && tokenSet.expiresAt > Date.now() / 1e3) {
       return tokenSet;
@@ -362,7 +379,7 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({
+    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({
       refreshToken: stateData.refreshToken
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -403,7 +420,7 @@ var ServerClient = class {
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
-    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({
+    const tokenEndpointResponse = await this.authClient.getTokenForConnection({
       connection: options.connection,
       loginHint: options.loginHint,
       refreshToken: stateData.refreshToken
@@ -426,7 +443,7 @@ var ServerClient = class {
    */
   async logout(options, storeOptions) {
     await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
-    return this.#authClient.buildLogoutUrl(options);
+    return this.authClient.buildLogoutUrl(options);
   }
   /**
    * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
@@ -440,7 +457,7 @@ var ServerClient = class {
     if (!logoutToken) {
       throw new BackchannelLogoutError("Missing Logout Token");
     }
-    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });
+    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });
     await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
   }
 };
@@ -590,13 +607,9 @@ var StatefulStateStore = class extends AbstractSessionStore {
     }
     sessionId ??= generateId();
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Date.now() / 1e3 + maxAge;
     const encryptedStateData = await this.encrypt(
       identifier,
@@ -613,7 +626,7 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       const stateData = await this.#store.get(sessionId);
       if (!stateData) {
-        this.#cookieHandler.deleteCookie(identifier, options);
+        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
       }
       return stateData;
     }
@@ -623,7 +636,7 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       await this.#store.delete(sessionId);
     }
-    this.#cookieHandler.deleteCookie(identifier, options);
+    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
   }
   async getSessionId(identifier, options) {
     const cookieValue = this.#cookieHandler.getCookie(identifier, options);
@@ -635,6 +648,15 @@ var StatefulStateStore = class extends AbstractSessionStore {
   deleteByLogoutToken(claims, options) {
     return this.#store.deleteByLogoutToken(claims, options);
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 
 // src/store/stateless-state-store.ts
@@ -648,13 +670,9 @@ var StatelessStateStore = class extends AbstractSessionStore {
   }
   async set(identifier, stateData, removeIfExists, options) {
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure ?? true,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Math.floor(Date.now() / 1e3 + maxAge);
     const encryptedStateData = await this.encrypt(identifier, stateData, expiration);
     const chunkSize = 3072;
@@ -669,7 +687,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
     const existingCookieKeys = this.getCookieKeys(identifier, options);
     const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));
     cookieKeysToRemove.forEach((key) => {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, cookieOpts);
     });
   }
   async get(identifier, options) {
@@ -685,7 +703,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
   async delete(identifier, options) {
     const cookieKeys = this.getCookieKeys(identifier, options);
     for (const key of cookieKeys) {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());
     }
   }
   deleteByLogoutToken() {
@@ -696,6 +714,15 @@ var StatelessStateStore = class extends AbstractSessionStore {
   getCookieKeys(identifier, options) {
     return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 export {
   AbstractStateStore,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["/**\n * Error thrown when there is no transaction available.\n */\nexport class MissingTransactionError extends Error {\n  public code: string = 'missing_transaction_error';\n\n  constructor(message?: string) {\n    super(message ?? 'The transaction is missing.');\n    this.name = 'MissingTransactionError';\n  }\n}\n\n\n/**\n * Error thrown when backchannel logout fails.\n */\nexport class BackchannelLogoutError extends Error {\n  public code: string = 'backchannel_logout_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'BackchannelLogoutError';\n  }\n}\n\n/**\n * Error thrown when starting the user-linking failed.\n */\nexport class StartLinkUserError extends Error {\n  public code: string = 'start_link_user_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'StartLinkUserError';\n  }\n}\n\n/**\n * Error thrown when a required argument is missing.\n */\nexport class MissingRequiredArgumentError extends Error {\n  public code: string = 'missing_required_argument_error';\n\n  constructor(argument: string) {\n    super(`The argument '${argument}' is required but was not provided.`);\n    this.name = 'MissingRequiredArgumentError';\n  }\n}\n\n/**\n * Error thrown when a session is missing.\n */\nexport class MissingSessionError extends Error {\n  public code: string = 'missing_session_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'MissingSessionError';\n  }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/**\n * Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n */\nexport function updateStateData(\n  audience: string,\n  stateDate: StateData | undefined,\n  tokenEndpointResponse: TokenResponse\n): StateData {\n  if (stateDate) {\n    const isNewTokenSet = !stateDate.tokenSets.some(\n      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n    );\n\n    const createUpdatedTokenSet = (response: TokenResponse) => ({\n      audience,\n      accessToken: response.accessToken,\n      scope: response.scope,\n      expiresAt: Math.floor(Date.now() / 1000) + Number(response.expiresAt),\n    });\n\n    const tokenSets = isNewTokenSet\n      ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)]\n      : stateDate.tokenSets.map((tokenSet) =>\n          tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n            ? createUpdatedTokenSet(tokenEndpointResponse)\n            : tokenSet\n        );\n\n    return {\n      ...stateDate,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n      tokenSets,\n    };\n  } else {\n    const user = tokenEndpointResponse.claims;\n    return {\n      user,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken,\n      tokenSets: [\n        {\n          audience,\n          accessToken: tokenEndpointResponse.accessToken,\n          scope: tokenEndpointResponse.scope,\n          expiresAt:tokenEndpointResponse.expiresAt,\n        },\n      ],\n      internal: {\n        sid: user?.sid as string,\n        createdAt: Math.floor(Date.now() / 1000),\n      },\n    };\n  }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n  options: AccessTokenForConnectionOptions,\n  stateDate: StateData,\n  tokenEndpointResponse: TokenResponse\n) {\n  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];\n\n  const isNewTokenSet = !stateDate.connectionTokenSets.some(\n    (tokenSet) =>\n      tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n  );\n\n  const connectionTokenSet = {\n    connection: options.connection,\n    loginHint: options.loginHint,\n    accessToken: tokenEndpointResponse.accessToken,\n    scope: tokenEndpointResponse.scope,\n    expiresAt: tokenEndpointResponse.expiresAt,\n  };\n\n  const connectionTokenSets = isNewTokenSet\n    ? [...stateDate.connectionTokenSets, connectionTokenSet]\n    : stateDate.connectionTokenSets.map((tokenSet) =>\n        tokenSet.connection === options.connection &&\n        (!options.loginHint || tokenSet.loginHint === options.loginHint)\n          ? connectionTokenSet\n          : tokenSet\n      );\n\n  return {\n    ...stateDate,\n    connectionTokenSets,\n  };\n}\n","import {\n  AccessTokenForConnectionOptions,\n  ConnectionTokenSet,\n  LoginBackchannelOptions,\n  LoginBackchannelResult,\n  LogoutOptions,\n  ServerClientOptions,\n  SessionData,\n  StartInteractiveLoginOptions,\n  StartLinkUserOptions,\n  StartUnlinkUserOptions,\n  StateStore,\n  TokenSet,\n  TransactionData,\n  TransactionStore,\n} from './types.js';\nimport {\n  BackchannelLogoutError,\n  MissingRequiredArgumentError,\n  MissingSessionError,\n  MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n  TokenForConnectionError,\n  AuthClient,\n  AuthorizationDetails,\n  TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n  readonly #options: ServerClientOptions<TStoreOptions>;\n  readonly #transactionStore: TransactionStore<TStoreOptions>;\n  readonly #transactionStoreIdentifier: string;\n  readonly #stateStore: StateStore<TStoreOptions>;\n  readonly #stateStoreIdentifier: string;\n  readonly #authClient: AuthClient;\n\n  constructor(options: ServerClientOptions<TStoreOptions>) {\n    this.#options = options;\n    this.#stateStoreIdentifier = this.#options.stateIdentifier || '__a0_session';\n    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || '__a0_tx';\n    this.#transactionStore = options.transactionStore;\n    this.#stateStore = options.stateStore;\n\n    if (!this.#options.stateStore) {\n      throw new MissingRequiredArgumentError('stateStore');\n    }\n\n    if (!this.#options.transactionStore) {\n      throw new MissingRequiredArgumentError('transactionStore');\n    }\n\n    this.#authClient = new AuthClient({\n      domain: this.#options.domain,\n      clientId: this.#options.clientId,\n      clientSecret: this.#options.clientSecret,\n      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n      authorizationParams: this.#options.authorizationParams,\n      customFetch: this.#options.customFetch,\n    });\n  }\n\n  /**\n   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Optional options used to configure the interactive login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n    if (!redirectUri) {\n      throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n    }\n\n    const { codeVerifier, authorizationUrl } = await this.#authClient.buildAuthorizationUrl({\n      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n      authorizationParams: {\n        ...options?.authorizationParams,\n        redirect_uri: redirectUri,\n      },\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return authorizationUrl;\n  }\n\n  /**\n   * Completes the interactive login process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n   */\n  public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n    if (!transactionData) {\n      throw new MissingTransactionError();\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenByCode(url, {\n      codeVerifier: transactionData.codeVerifier,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n      appState?: TAppState;\n      authorizationDetails?: AuthorizationDetails[];\n    };\n  }\n\n  /**\n   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Options used to configure the user linking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n      );\n    }\n\n    const { linkUserUrl, codeVerifier } = await this.#authClient.buildLinkUserUrl({\n      connection: options.connection,\n      connectionScope: options.connectionScope,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return linkUserUrl;\n  }\n\n  /**\n   * Completes the user linking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n   * @param options Options used to configure the user unlinking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n      );\n    }\n\n    const { unlinkUserUrl, codeVerifier } = await this.#authClient.buildUnlinkUserUrl({\n      connection: options.connection,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return unlinkUserUrl;\n  }\n\n  /**\n   * Completes the user unlinking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Logs in using Client-Initiated Backchannel Authentication.\n   *\n   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n   * @param options Options used to configure the backchannel login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n   *\n   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n   */\n  public async loginBackchannel(\n    options: LoginBackchannelOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginBackchannelResult> {\n    const tokenEndpointResponse = await this.#authClient.backchannelAuthentication({\n      bindingMessage: options.bindingMessage,\n      loginHint: options.loginHint,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return {\n      authorizationDetails: tokenEndpointResponse.authorizationDetails,\n    };\n  }\n\n  /**\n   * Retrieves the user from the store, or undefined if no user found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The user, or undefined if no user found in the store.\n   */\n  public async getUser(storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    return stateData?.user;\n  }\n\n  /**\n   * Retrieve the user session from the store, or undefined if no session found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The sessionm or undefined if no session found in the store.\n   */\n  public async getSession(storeOptions?: TStoreOptions): Promise<SessionData | undefined> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (stateData) {\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { internal, ...sessionData } = stateData;\n      return sessionData;\n    }\n  }\n\n  /**\n   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n   * Also updates the store when a new token was retrieved from Auth0.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Token Set, containing the access token, as well as additional information.\n   */\n  public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const audience = this.#options.authorizationParams?.audience ?? 'default';\n    const scope = this.#options.authorizationParams?.scope;\n\n    const tokenSet = stateData?.tokenSets.find(\n      (tokenSet) => tokenSet.audience === audience && (!scope || tokenSet.scope === scope)\n    );\n\n    if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n      return tokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenByRefreshTokenError(\n        'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenByRefreshToken({\n      refreshToken: stateData.refreshToken,\n    });\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      audience: audience,\n    };\n  }\n\n  /**\n   * Retrieves an access token for a connection.\n   *\n   * This method attempts to obtain an access token for a specified connection.\n   * It first checks if a refresh token exists in the store.\n   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n   * that the refresh token was not found.\n   *\n   * @param options - Options for retrieving an access token for a connection.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n   */\n  public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const connectionTokenSet = stateData?.connectionTokenSets?.find(\n      (tokenSet) => tokenSet.connection === options.connection\n    );\n\n    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n      return connectionTokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenForConnectionError(\n        'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.#authClient.getTokenForConnection({\n      connection: options.connection,\n      loginHint: options.loginHint,\n      refreshToken: stateData.refreshToken,\n    });\n\n    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      connection: options.connection,\n      loginHint: options.loginHint,\n    };\n  }\n\n  /**\n   * Logs the user out and returns a URL to redirect the user-agent to after they log out.\n   * @param options Options used to configure the logout process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns {URL}\n   */\n  public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n    return this.#authClient.buildLogoutUrl(options);\n  }\n\n  /**\n   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n   * @param logoutToken The logout token to verify and use to delete the session from the store.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelLogoutError} If the logout token is missing.\n   * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n   */\n  public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n    if (!logoutToken) {\n      throw new BackchannelLogoutError('Missing Logout Token');\n    }\n\n    const logoutTokenClaims = await this.#authClient.verifyLogoutToken({ logoutToken });\n\n    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n  }\n}\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder | undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n  encoder ||= new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n  return new Uint8Array(\n    await crypto.subtle.deriveBits(\n      {\n        name: 'HKDF',\n        hash: DIGEST,\n        info: encoder.encode(HKDF_INFO),\n        salt: encoder.encode(`${salt}${kid}`),\n      } as HkdfParams,\n      key,\n      BIT_LENGTH\n    )\n  );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n  const kid = crypto.randomUUID();\n  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n  return await new EncryptJWT(payload)\n    .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n    .setExpirationTime(expiration)\n    .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n  const res = await jwtDecrypt<T>(\n    value,\n    async (protectedHeader) => {\n\n      // This error shouldn't happen, as we always set a kid.\n      // However, leaving this here as a safety net.\n      if (!protectedHeader.kid) {\n        throw new Error('Missing \"kid\" in JWE header');\n      }\n\n      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n    },\n    { clockTolerance: 15 }\n  );\n  return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n  protected readonly options: EncryptedStoreOptions;\n\n  constructor(options: EncryptedStoreOptions) {\n    this.options = options;\n  }\n\n  abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;\n  abstract get(identifier: string, options?: TStoreOptions | undefined): Promise<TData | undefined>;\n  abstract delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;\n\n  protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n    return await encrypt(stateData, this.options.secret, identifier, expiration);\n  }\n\n  protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n    return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n  }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n\n  abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    transactionData: TransactionData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions\n  ): Promise<void> {   \n    const maxAge = 60 * 60;\n    const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions): Promise<TransactionData | undefined> {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n    if (cookieValue) {\n      return await this.decrypt(identifier, cookieValue);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n  readonly #rolling: boolean;\n  readonly #absoluteDuration: number;\n  readonly #inactivityDuration: number;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n    super(options);\n\n    this.#rolling = options.rolling ?? true;\n    this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n    this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n  }\n\n  /**\n   * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n   */\n  protected calculateMaxAge(createdAt: number) {\n    if (!this.#rolling) {\n      return this.#absoluteDuration;\n    }\n\n    const now = (Date.now() / 1000) | 0;\n    const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n    const maxAge = expiresAt - now;\n\n    return maxAge > 0 ? maxAge : 0;\n  }\n}","import type {\n  EncryptedStoreOptions,\n  LogoutTokenClaims,\n  SessionConfiguration,\n  SessionCookieOptions,\n  SessionStore,\n  StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n  store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #store: SessionStore<TStoreOptions>;\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(\n    options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n    cookieHandler: CookieHandler<TStoreOptions>\n  ) {\n    super(options);\n\n    this.#store = options.store;\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    let sessionId = await this.getSessionId(identifier, options);\n\n    // if this is a new session created by a new login we need to remove the old session\n    // from the store and regenerate the session ID to prevent session fixation.\n    if (sessionId && removeIfExists) {\n      await this.#store.delete(sessionId);\n      sessionId = generateId();\n    }\n\n    sessionId ??= generateId();\n\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts: CookieSerializeOptions = {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: '/',\n      secure: this.#cookieOptions?.secure,\n      maxAge,\n    };\n    const expiration = Date.now() / 1000 + maxAge;\n    const encryptedStateData = await this.encrypt<{ id: string }>(\n      identifier,\n      {\n        id: sessionId,\n      },\n      expiration\n    );\n\n    await this.#store.set(sessionId, stateData);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      const stateData = await this.#store.get(sessionId);\n\n      // If we have a session cookie, but no `stateData`, we should remove the cookie.\n      if (!stateData) {\n        this.#cookieHandler.deleteCookie(identifier, options);\n      }\n\n      return stateData;\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      await this.#store.delete(sessionId);\n    }\n\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n\n  private async getSessionId(identifier: string, options?: TStoreOptions) {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n    if (cookieValue) {\n      const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n      return sessionCookie.id;\n    }\n  }\n\n  deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void> {\n    return this.#store.deleteByLogoutToken(claims, options);\n  }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts: CookieSerializeOptions = {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      maxAge,\n    };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n    const chunkSize = 3072;\n    const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n    const chunks = [...Array(chunkCount).keys()].map((i) => ({\n      value: encryptedStateData.substring(i * chunkSize, (i + 1) * chunkSize),\n      name: `${identifier}.${i}`,\n    }));\n\n    chunks.forEach((chunk) => {\n      this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n    });\n\n    const existingCookieKeys = this.getCookieKeys(identifier, options);\n    const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n    cookieKeysToRemove.forEach((key) => {\n      this.#cookieHandler.deleteCookie(key, options);\n    });\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    const encryptedStateData = cookieKeys\n      .map((key) => ({\n        index: parseInt(key.split('.')[1] as string, 10),\n        value: this.#cookieHandler.getCookie(key, options),\n      }))\n      .sort((a, b) => a.index - b.index)\n      .map((item) => item.value)\n      .join('');\n\n    if (encryptedStateData) {\n      return await this.decrypt(identifier, encryptedStateData);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    for (const key of cookieKeys) {\n      this.#cookieHandler.deleteCookie(key, options);\n    }\n  }\n\n  deleteByLogoutToken(): Promise<void> {\n    throw new Error(\n      'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n    );\n  }\n\n  private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n    return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n  }\n}\n"],"mappings":";AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACjDO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,wBAAwB,CAAC,cAA6B;AAAA,MAC1D;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,OAAO,SAAS;AAAA,MAChB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,OAAO,SAAS,SAAS;AAAA,IACtE;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,qBAAqB,CAAC,IACrE,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,qBAAqB,IAC3C;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT;AAAA,UACE;AAAA,UACA,aAAa,sBAAsB;AAAA,UACnC,OAAO,sBAAsB;AAAA,UAC7B,WAAU,sBAAsB;AAAA,QAClC;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAC/B,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAClD,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAEA,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,cAAc,IAAI,WAAW;AAAA,MAChC,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACtF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,eAAe,KAAK;AAAA,MACvE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,YAAY,iBAAiB;AAAA,MAC5E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,YAAY,mBAAmB;AAAA,MAChF,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,YAAY,0BAA0B;AAAA,MAC7E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAASA,UAAS,UAAU;AAAA,IAChF;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,uBAAuB;AAAA,MAC1E,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,YAAY,sBAAsB;AAAA,MACzE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,YAAY,eAAe,OAAO;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,YAAY,kBAAkB,EAAE,YAAY,CAAC;AAElF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AC9bA,SAAS,YAAY,kBAAkB;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,WAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,OAAO;AAAA,MACtD;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AACF;;;AC9GO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAqC;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC;AAAA,IACF;AACA,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AACF;","names":["tokenSet"]}
+{"version":3,"sources":["../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/utils.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts"],"sourcesContent":["/**\n * Error thrown when there is no transaction available.\n */\nexport class MissingTransactionError extends Error {\n  public code: string = 'missing_transaction_error';\n\n  constructor(message?: string) {\n    super(message ?? 'The transaction is missing.');\n    this.name = 'MissingTransactionError';\n  }\n}\n\n\n/**\n * Error thrown when backchannel logout fails.\n */\nexport class BackchannelLogoutError extends Error {\n  public code: string = 'backchannel_logout_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'BackchannelLogoutError';\n  }\n}\n\n/**\n * Error thrown when starting the user-linking failed.\n */\nexport class StartLinkUserError extends Error {\n  public code: string = 'start_link_user_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'StartLinkUserError';\n  }\n}\n\n/**\n * Error thrown when a required argument is missing.\n */\nexport class MissingRequiredArgumentError extends Error {\n  public code: string = 'missing_required_argument_error';\n\n  constructor(argument: string) {\n    super(`The argument '${argument}' is required but was not provided.`);\n    this.name = 'MissingRequiredArgumentError';\n  }\n}\n\n/**\n * Error thrown when a session is missing.\n */\nexport class MissingSessionError extends Error {\n  public code: string = 'missing_session_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'MissingSessionError';\n  }\n}","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/**\n * Creates an updated token set object from the token endpoint response\n * @param audience The audience for which the token was requested\n * @param response The response from the token endpoint\n * @returns Updated token set object\n */\nconst createUpdatedTokenSet = (audience: string, response: TokenResponse) => ({\n  audience,\n  accessToken: response.accessToken,\n  scope: response.scope,\n  expiresAt: response.expiresAt,\n});\n\n/**\n * Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateDate The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n */\nexport function updateStateData(\n  audience: string,\n  stateDate: StateData | undefined,\n  tokenEndpointResponse: TokenResponse\n): StateData {\n  if (stateDate) {\n    const isNewTokenSet = !stateDate.tokenSets.some(\n      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n    );\n\n    const tokenSets = isNewTokenSet\n      ? [...stateDate.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)]\n      : stateDate.tokenSets.map((tokenSet) =>\n          tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n            ? createUpdatedTokenSet(audience, tokenEndpointResponse)\n            : tokenSet\n        );\n\n    return {\n      ...stateDate,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,\n      tokenSets,\n    };\n  } else {\n    const user = tokenEndpointResponse.claims;\n    return {\n      user,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken,\n      tokenSets: [\n        createUpdatedTokenSet(audience, tokenEndpointResponse),\n      ],\n      internal: {\n        sid: user?.sid as string,\n        createdAt: Math.floor(Date.now() / 1000),\n      },\n    };\n  }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n  options: AccessTokenForConnectionOptions,\n  stateDate: StateData,\n  tokenEndpointResponse: TokenResponse\n) {\n  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];\n\n  const isNewTokenSet = !stateDate.connectionTokenSets.some(\n    (tokenSet) =>\n      tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n  );\n\n  const connectionTokenSet = {\n    connection: options.connection,\n    loginHint: options.loginHint,\n    accessToken: tokenEndpointResponse.accessToken,\n    scope: tokenEndpointResponse.scope,\n    expiresAt: tokenEndpointResponse.expiresAt,\n  };\n\n  const connectionTokenSets = isNewTokenSet\n    ? [...stateDate.connectionTokenSets, connectionTokenSet]\n    : stateDate.connectionTokenSets.map((tokenSet) =>\n        tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n          ? connectionTokenSet\n          : tokenSet\n      );\n\n  return {\n    ...stateDate,\n    connectionTokenSets,\n  };\n}\n","import {\n  AccessTokenForConnectionOptions,\n  ConnectionTokenSet,\n  LoginBackchannelOptions,\n  LoginBackchannelResult,\n  LogoutOptions,\n  ServerClientOptions,\n  SessionData,\n  StartInteractiveLoginOptions,\n  StartLinkUserOptions,\n  StartUnlinkUserOptions,\n  StateStore,\n  TokenSet,\n  TransactionData,\n  TransactionStore,\n} from './types.js';\nimport {\n  BackchannelLogoutError,\n  MissingRequiredArgumentError,\n  MissingSessionError,\n  MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n  TokenForConnectionError,\n  AuthClient,\n  AuthorizationDetails,\n  TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\nimport { compareScopes } from './utils.js';\n\nexport class ServerClient<TStoreOptions = unknown> {\n  readonly #options: ServerClientOptions<TStoreOptions>;\n  readonly #transactionStore: TransactionStore<TStoreOptions>;\n  readonly #transactionStoreIdentifier: string;\n  readonly #stateStore: StateStore<TStoreOptions>;\n  readonly #stateStoreIdentifier: string;\n\n  /**\n   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.\n   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.\n   * \n   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.\n   */\n  readonly authClient: AuthClient;\n\n  constructor(options: ServerClientOptions<TStoreOptions>) {\n    this.#options = options;\n    this.#stateStoreIdentifier = this.#options.stateIdentifier || '__a0_session';\n    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || '__a0_tx';\n    this.#transactionStore = options.transactionStore;\n    this.#stateStore = options.stateStore;\n\n    if (!this.#options.stateStore) {\n      throw new MissingRequiredArgumentError('stateStore');\n    }\n\n    if (!this.#options.transactionStore) {\n      throw new MissingRequiredArgumentError('transactionStore');\n    }\n\n    this.authClient = new AuthClient({\n      domain: this.#options.domain,\n      clientId: this.#options.clientId,\n      clientSecret: this.#options.clientSecret,\n      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n      authorizationParams: this.#options.authorizationParams,\n      customFetch: this.#options.customFetch,\n      useMtls: this.#options.useMtls,\n    });\n  }\n\n  /**\n   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Optional options used to configure the interactive login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n    if (!redirectUri) {\n      throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n    }\n\n    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({\n      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n      authorizationParams: {\n        ...options?.authorizationParams,\n        redirect_uri: redirectUri,\n      },\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return authorizationUrl;\n  }\n\n  /**\n   * Completes the interactive login process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n   */\n  public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n    if (!transactionData) {\n      throw new MissingTransactionError();\n    }\n\n    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {\n      codeVerifier: transactionData.codeVerifier,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n      appState?: TAppState;\n      authorizationDetails?: AuthorizationDetails[];\n    };\n  }\n\n  /**\n   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Options used to configure the user linking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n      );\n    }\n\n    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({\n      connection: options.connection,\n      connectionScope: options.connectionScope,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return linkUserUrl;\n  }\n\n  /**\n   * Completes the user linking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n   * @param options Options used to configure the user unlinking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n      );\n    }\n\n    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({\n      connection: options.connection,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return unlinkUserUrl;\n  }\n\n  /**\n   * Completes the user unlinking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Logs in using Client-Initiated Backchannel Authentication.\n   *\n   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n   * @param options Options used to configure the backchannel login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n   *\n   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n   */\n  public async loginBackchannel(\n    options: LoginBackchannelOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginBackchannelResult> {\n    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({\n      bindingMessage: options.bindingMessage,\n      loginHint: options.loginHint,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return {\n      authorizationDetails: tokenEndpointResponse.authorizationDetails,\n    };\n  }\n\n  /**\n   * Retrieves the user from the store, or undefined if no user found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The user, or undefined if no user found in the store.\n   */\n  public async getUser(storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    return stateData?.user;\n  }\n\n  /**\n   * Retrieve the user session from the store, or undefined if no session found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The sessionm or undefined if no session found in the store.\n   */\n  public async getSession(storeOptions?: TStoreOptions): Promise<SessionData | undefined> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (stateData) {\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { internal, ...sessionData } = stateData;\n      return sessionData;\n    }\n  }\n\n  /**\n   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n   * Also updates the store when a new token was retrieved from Auth0.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Token Set, containing the access token, as well as additional information.\n   */\n  public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const audience = this.#options.authorizationParams?.audience ?? 'default';\n    const scope = this.#options.authorizationParams?.scope;\n\n    const tokenSet = stateData?.tokenSets.find(\n      (tokenSet) => tokenSet.audience === audience && (!scope || compareScopes(tokenSet.scope, scope))\n    );\n\n    if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n      return tokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenByRefreshTokenError(\n        'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({\n      refreshToken: stateData.refreshToken,\n    });\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      audience: audience,\n    };\n  }\n\n  /**\n   * Retrieves an access token for a connection.\n   *\n   * This method attempts to obtain an access token for a specified connection.\n   * It first checks if a refresh token exists in the store.\n   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n   * that the refresh token was not found.\n   *\n   * @param options - Options for retrieving an access token for a connection.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n   */\n  public async getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const connectionTokenSet = stateData?.connectionTokenSets?.find(\n      (tokenSet) => tokenSet.connection === options.connection\n    );\n\n    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n      return connectionTokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenForConnectionError(\n        'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n      );\n    }\n\n    const tokenEndpointResponse = await this.authClient.getTokenForConnection({\n      connection: options.connection,\n      loginHint: options.loginHint,\n      refreshToken: stateData.refreshToken,\n    });\n\n    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      connection: options.connection,\n      loginHint: options.loginHint,\n    };\n  }\n\n  /**\n   * Logs the user out and returns a URL to redirect the user-agent to after they log out.\n   * @param options Options used to configure the logout process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns {URL}\n   */\n  public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n\n    return this.authClient.buildLogoutUrl(options);\n  }\n\n  /**\n   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n   * @param logoutToken The logout token to verify and use to delete the session from the store.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelLogoutError} If the logout token is missing.\n   * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n   */\n  public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n    if (!logoutToken) {\n      throw new BackchannelLogoutError('Missing Logout Token');\n    }\n\n    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });\n\n    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n  }\n}\n","/**\n * Compares two sets of scopes to determine if all required scopes are present in the provided scopes.\n * @param scopes Scopes to compare\n * @param requiredScopes Scopes required to be present in the scopes\n * @returns True if all required scopes are present in the scopes, false otherwise\n */\nexport const compareScopes = (scopes: string | undefined, requiredScopes: string | undefined) => {\n  // When the scopes and requiredScopes are exactly the same, return true\n  // This handles cases where both are empty or undefined or both are the same string\n  if (scopes === requiredScopes) {\n    return true;\n  }\n\n  if (!scopes || !requiredScopes) {\n    return false;\n  }\n\n  const scopesSet = new Set(scopes.trim().split(' ').filter(Boolean));\n  const requiredScopesArray = requiredScopes.trim().split(' ').filter(Boolean);\n\n  return requiredScopesArray.every((scope) => scopesSet.has(scope));\n};\n","import { EncryptJWT, jwtDecrypt } from 'jose';\nimport type { JWTPayload } from 'jose';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder | undefined;\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n  encoder ||= new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n  return new Uint8Array(\n    await crypto.subtle.deriveBits(\n      {\n        name: 'HKDF',\n        hash: DIGEST,\n        info: encoder.encode(HKDF_INFO),\n        salt: encoder.encode(`${salt}${kid}`),\n      } as HkdfParams,\n      key,\n      BIT_LENGTH\n    )\n  );\n}\n\nexport async function encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n  const kid = crypto.randomUUID();\n  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n  return await new EncryptJWT(payload)\n    .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n    .setExpirationTime(expiration)\n    .encrypt(encryptionSecret);\n}\n\nexport async function decrypt<T>(value: string, secret: string, salt: string) {\n  const res = await jwtDecrypt<T>(\n    value,\n    async (protectedHeader) => {\n\n      // This error shouldn't happen, as we always set a kid.\n      // However, leaving this here as a safety net.\n      if (!protectedHeader.kid) {\n        throw new Error('Missing \"kid\" in JWE header');\n      }\n\n      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n    },\n    { clockTolerance: 15 }\n  );\n  return res.payload;\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n  protected readonly options: EncryptedStoreOptions;\n\n  constructor(options: EncryptedStoreOptions) {\n    this.options = options;\n  }\n\n  abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;\n  abstract get(identifier: string, options?: TStoreOptions | undefined): Promise<TData | undefined>;\n  abstract delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;\n\n  protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n    return await encrypt(stateData, this.options.secret, identifier, expiration);\n  }\n\n  protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n    return await decrypt(encryptedStateData, this.options.secret, identifier) as TData;\n  }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n\n  abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    transactionData: TransactionData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions\n  ): Promise<void> {   \n    const maxAge = 60 * 60;\n    const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions): Promise<TransactionData | undefined> {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n    if (cookieValue) {\n      return await this.decrypt(identifier, cookieValue);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n  readonly #rolling: boolean;\n  readonly #absoluteDuration: number;\n  readonly #inactivityDuration: number;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n    super(options);\n\n    this.#rolling = options.rolling ?? true;\n    this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n    this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n  }\n\n  /**\n   * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n   */\n  protected calculateMaxAge(createdAt: number) {\n    if (!this.#rolling) {\n      return this.#absoluteDuration;\n    }\n\n    const now = (Date.now() / 1000) | 0;\n    const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n    const maxAge = expiresAt - now;\n\n    return maxAge > 0 ? maxAge : 0;\n  }\n}","import type {\n  EncryptedStoreOptions,\n  LogoutTokenClaims,\n  SessionConfiguration,\n  SessionCookieOptions,\n  SessionStore,\n  StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n  store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #store: SessionStore<TStoreOptions>;\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(\n    options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n    cookieHandler: CookieHandler<TStoreOptions>\n  ) {\n    super(options);\n\n    this.#store = options.store;\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    let sessionId = await this.getSessionId(identifier, options);\n\n    // if this is a new session created by a new login we need to remove the old session\n    // from the store and regenerate the session ID to prevent session fixation.\n    if (sessionId && removeIfExists) {\n      await this.#store.delete(sessionId);\n      sessionId = generateId();\n    }\n\n    sessionId ??= generateId();\n\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Date.now() / 1000 + maxAge;\n    const encryptedStateData = await this.encrypt<{ id: string }>(\n      identifier,\n      {\n        id: sessionId,\n      },\n      expiration\n    );\n\n    await this.#store.set(sessionId, stateData);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      const stateData = await this.#store.get(sessionId);\n\n      // If we have a session cookie, but no `stateData`, we should remove the cookie.\n      if (!stateData) {\n        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n      }\n\n      return stateData;\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      await this.#store.delete(sessionId);\n    }\n\n    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n  }\n\n  private async getSessionId(identifier: string, options?: TStoreOptions) {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n    if (cookieValue) {\n      const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n      return sessionCookie.id;\n    }\n  }\n\n  deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void> {\n    return this.#store.deleteByLogoutToken(claims, options);\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n    const chunkSize = 3072;\n    const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n    const chunks = [...Array(chunkCount).keys()].map((i) => ({\n      value: encryptedStateData.substring(i * chunkSize, (i + 1) * chunkSize),\n      name: `${identifier}.${i}`,\n    }));\n\n    chunks.forEach((chunk) => {\n      this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n    });\n\n    const existingCookieKeys = this.getCookieKeys(identifier, options);\n    const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n    cookieKeysToRemove.forEach((key) => {\n      this.#cookieHandler.deleteCookie(key, options, cookieOpts);\n    });\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    const encryptedStateData = cookieKeys\n      .map((key) => ({\n        index: parseInt(key.split('.')[1] as string, 10),\n        value: this.#cookieHandler.getCookie(key, options),\n      }))\n      .sort((a, b) => a.index - b.index)\n      .map((item) => item.value)\n      .join('');\n\n    if (encryptedStateData) {\n      return await this.decrypt(identifier, encryptedStateData);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    for (const key of cookieKeys) {\n      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());\n    }\n  }\n\n  deleteByLogoutToken(): Promise<void> {\n    throw new Error(\n      'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n    );\n  }\n\n  private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n    return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n"],"mappings":";AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;AClDA,IAAM,wBAAwB,CAAC,UAAkB,cAA6B;AAAA,EAC5E;AAAA,EACA,aAAa,SAAS;AAAA,EACtB,OAAO,SAAS;AAAA,EAChB,WAAW,SAAS;AACtB;AASO,SAAS,gBACd,UACA,WACA,uBACW;AACX,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,UAAU,qBAAqB,CAAC,IAC/E,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,UAAU,qBAAqB,IACrD;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW;AAAA,QACT,sBAAsB,UAAU,qBAAqB;AAAA,MACvD;AAAA,MACA,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAChG,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACzEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;;;ACtBA,IAAM,gBAAgB,CAAC,QAA4B,mBAAuC;AAG/F,MAAI,WAAW,gBAAgB;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC;AAClE,QAAM,sBAAsB,eAAe,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3E,SAAO,oBAAoB,MAAM,CAAC,UAAU,UAAU,IAAI,KAAK,CAAC;AAClE;;;ADUO,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,EAET,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,SAAK,aAAa,IAAI,WAAW;AAAA,MAC/B,QAAQ,KAAK,SAAS;AAAA,MACtB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,aAAa,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,SAAS;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACrF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,eAAe,KAAK;AAAA,MACtE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,qBAAqB;AAEjH,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,KAAK,WAAW,iBAAiB;AAAA,MAC3E,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,KAAK,WAAW,mBAAmB;AAAA,MAC/E,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,wBAAwB,MAAM,KAAK,WAAW,0BAA0B;AAAA,MAC5E,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AAEb,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAAS,cAAcA,UAAS,OAAO,KAAK;AAAA,IAChG;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,uBAAuB;AAAA,MACzE,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,qBAAqB;AAE3F,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BAA4B,SAA0C,cAA2D;AAC5I,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB,MAAM,KAAK,WAAW,sBAAsB;AAAA,MACxE,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB,qCAAqC,SAAS,WAAW,qBAAqB;AAEvG,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,UAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAEtE,WAAO,KAAK,WAAW,eAAe,OAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,UAAM,oBAAoB,MAAM,KAAK,WAAW,kBAAkB,EAAE,YAAY,CAAC;AAEjF,UAAM,KAAK,YAAY,oBAAoB,mBAAmB,YAAY;AAAA,EAC5E;AACF;;;AEvcA,SAAS,YAAY,kBAAkB;AAGvC,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AAEJ,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,QAAQ,SAAqB,QAAgB,MAAc,YAAoB;AACnG,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,WAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAEA,eAAsB,QAAW,OAAe,QAAgB,MAAc;AAC5E,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAIzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;;;AChDO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,WAAO,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC1E;AACF;;;ACpBO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,MAChF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,EAChF;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAChF,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;ACpHO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,SAAS,UAAU;AAAA,IAC3D,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,SAAS,KAAK,kBAAkB,CAAC;AAAA,IACzE;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;","names":["tokenSet"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth0/auth0-server-js",
-  "version": "1.0.3",
+  "version": "1.2.0",
   "description": "Auth0 Authentication SDK for Server-Side Applications on JavaScript runtimes",
   "author": "Auth0",
   "license": "MIT",
@@ -24,10 +24,11 @@
     }
   },
   "dependencies": {
-    "@auth0/auth0-auth-js": "^1.0.0",
+    "@auth0/auth0-auth-js": "^1.1.0",
     "jose": "^6.0.8"
   },
   "devDependencies": {
+    "@auth0/typescript-config": "*",
     "@eslint/js": "^9.20.0",
     "@vitest/coverage-v8": "^3.0.6",
     "eslint": "^9.20.1",