@auth0/auth0-server-js 1.5.0 → 1.6.1

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/utils.ts","../src/telemetry.ts","../src/mfa/server-mfa-client.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts","../src/mfa/index.ts"],"sourcesContent":["/**\n * Error thrown when there is no transaction available.\n */\nexport class MissingTransactionError extends Error {\n  public code: string = 'missing_transaction_error';\n\n  constructor(message?: string) {\n    super(message ?? 'The transaction is missing.');\n    this.name = 'MissingTransactionError';\n  }\n}\n\n\n/**\n * Error thrown when backchannel logout fails.\n */\nexport class BackchannelLogoutError extends Error {\n  public code: string = 'backchannel_logout_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'BackchannelLogoutError';\n  }\n}\n\n/**\n * Error thrown when starting the user-linking failed.\n */\nexport class StartLinkUserError extends Error {\n  public code: string = 'start_link_user_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'StartLinkUserError';\n  }\n}\n\n/**\n * Error thrown when a required argument is missing.\n */\nexport class MissingRequiredArgumentError extends Error {\n  public code: string = 'missing_required_argument_error';\n\n  constructor(argument: string) {\n    super(`The argument '${argument}' is required but was not provided.`);\n    this.name = 'MissingRequiredArgumentError';\n  }\n}\n\n/**\n * Error thrown when a session is missing.\n */\nexport class MissingSessionError extends Error {\n  public code: string = 'missing_session_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'MissingSessionError';\n  }\n}\n\n/**\n * Error thrown when a configuration is invalid.\n */\nexport class InvalidConfigurationError extends Error {\n  public code: string = 'invalid_configuration_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'InvalidConfigurationError';\n  }\n}\n\n/**\n * Error thrown when the issuer validation fails.\n */\nexport class IssuerValidationError extends Error {\n  public code: string = 'issuer_validation_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'IssuerValidationError';\n  }\n}\n","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/**\n * Creates an updated token set object from the token endpoint response\n * @param audience The audience for which the token was requested\n * @param response The response from the token endpoint\n * @returns Updated token set object\n */\nconst createUpdatedTokenSet = (audience: string, response: TokenResponse) => ({\n  audience,\n  accessToken: response.accessToken,\n  scope: response.scope,\n  expiresAt: response.expiresAt,\n});\n\n/**\n * Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateData The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n */\nexport function updateStateData(\n  audience: string,\n  stateData: StateData | undefined,\n  tokenEndpointResponse: TokenResponse,\n  context?: { domain?: string }\n): StateData {\n  // If we already have a session and the new token belongs to a different user (iss or sub mismatch),\n  // wipe the existing state to start a fresh session. This handles the case where a user logs in\n  // as a different user without explicitly logging out first.\n  if (stateData && tokenEndpointResponse.claims) {\n    const newSub = tokenEndpointResponse.claims.sub;\n    const newIss = tokenEndpointResponse.claims.iss;\n    const existingSub = stateData.user?.sub;\n    const existingIss = stateData.user?.iss;\n\n    const subMismatch = newSub !== undefined && existingSub !== undefined && newSub !== existingSub;\n    const issMismatch = newIss !== undefined && existingIss !== undefined && newIss !== existingIss;\n\n    if (subMismatch || issMismatch) {\n      stateData = undefined;\n    }\n  }\n\n  if (stateData) {\n    const isNewTokenSet = !stateData.tokenSets.some(\n      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n    );\n\n    const tokenSets = isNewTokenSet\n      ? [...stateData.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)]\n      : stateData.tokenSets.map((tokenSet) =>\n          tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n            ? createUpdatedTokenSet(audience, tokenEndpointResponse)\n            : tokenSet\n        );\n\n    return {\n      ...stateData,\n      idToken: tokenEndpointResponse.idToken ?? stateData.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken ?? stateData.refreshToken,\n      tokenSets,\n      domain: context?.domain ?? stateData.domain,\n    };\n  } else {\n    const user = tokenEndpointResponse.claims;\n    return {\n      user,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken,\n      tokenSets: [createUpdatedTokenSet(audience, tokenEndpointResponse)],\n      domain: context?.domain,\n      internal: {\n        sid: user?.sid as string,\n        createdAt: Math.floor(Date.now() / 1000),\n      },\n    };\n  }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n  options: AccessTokenForConnectionOptions,\n  stateData: StateData,\n  tokenEndpointResponse: TokenResponse\n) {\n  stateData.connectionTokenSets = stateData.connectionTokenSets || [];\n\n  const isNewTokenSet = !stateData.connectionTokenSets.some(\n    (tokenSet) =>\n      tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n  );\n\n  const connectionTokenSet = {\n    connection: options.connection,\n    loginHint: options.loginHint,\n    accessToken: tokenEndpointResponse.accessToken,\n    scope: tokenEndpointResponse.scope,\n    expiresAt: tokenEndpointResponse.expiresAt,\n  };\n\n  const connectionTokenSets = isNewTokenSet\n    ? [...stateData.connectionTokenSets, connectionTokenSet]\n    : stateData.connectionTokenSets.map((tokenSet) =>\n        tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n          ? connectionTokenSet\n          : tokenSet\n      );\n\n  return {\n    ...stateData,\n    connectionTokenSets,\n  };\n}\n","import {\n  AccessTokenForConnectionOptions,\n  ConnectionTokenSet,\n  DomainResolver,\n  LoginBackchannelOptions,\n  LoginBackchannelResult,\n  LogoutOptions,\n  ServerClientOptions,\n  SessionData,\n  StartInteractiveLoginOptions,\n  StartLinkUserOptions,\n  StartUnlinkUserOptions,\n  StateData,\n  StateStore,\n  TokenSet,\n  TransactionData,\n  TransactionStore,\n} from './types.js';\nimport {\n  BackchannelLogoutError,\n  InvalidConfigurationError,\n  MissingRequiredArgumentError,\n  MissingSessionError,\n  MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n  TokenForConnectionError,\n  AuthClient,\n  AuthorizationDetails,\n  TokenByRefreshTokenError,\n} from '@auth0/auth0-auth-js';\nimport { compareScopes } from './utils.js';\nimport { decodeJwt } from 'jose';\nimport type { AuthClientOptions } from '@auth0/auth0-auth-js';\nimport { getTelemetryConfig } from './telemetry.js';\nimport { ServerMfaClient } from './mfa/server-mfa-client.js';\n\nconst DEFAULT_SCOPES = 'openid profile email offline_access';\n\nconst normalizeDomain = (value: string) => {\n  const trimmed = value.trim();\n  const parsed = trimmed.startsWith('http') ? new URL(trimmed) : new URL(`https://${trimmed}`);\n  return parsed.host.toLowerCase();\n};\n\nconst decodeIssuer = (token: string) => {\n  try {\n    const { iss } = decodeJwt(token);\n    return typeof iss === 'string' ? iss : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Ensures that the \"openid\" scope is always included in the scope string.\n *\n * @param scope - The scope provided by the user (optional)\n * @returns A scope string that includes \"openid\" if it was not already present.\n */\nconst ensureOpenIdScope = (scope?: string) => {\n  if (!scope) {\n    return DEFAULT_SCOPES;\n  }\n\n  const scopes = scope.split(' ');\n  if (!scopes.includes('openid')) {\n    scopes.unshift('openid');\n  }\n\n  return scopes.join(' ');\n};\n\nexport class ServerClient<TStoreOptions = unknown> {\n  readonly #options: ServerClientOptions<TStoreOptions>;\n  readonly #transactionStore: TransactionStore<TStoreOptions>;\n  readonly #transactionStoreIdentifier: string;\n  readonly #stateStore: StateStore<TStoreOptions>;\n  readonly #stateStoreIdentifier: string;\n  readonly #authClientOptions: Omit<AuthClientOptions, 'domain'>;\n  readonly #staticDomain?: string;\n  readonly #authClient?: AuthClient;\n  readonly #mfaClient?: ServerMfaClient<TStoreOptions>;\n\n  /**\n   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.\n   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.\n   *\n   * This property can only be used when `domain` is configured as a static string.\n   * In resolver mode (`domain` as a function), the SDK resolves the domain per request,\n   * so use `ServerClient` methods instead.\n   *\n   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.\n   */\n  public get authClient(): AuthClient {\n    if (!this.#authClient) {\n      throw new InvalidConfigurationError('authClient is only available when using a static domain configuration.');\n    }\n    return this.#authClient;\n  }\n\n  /**\n   * The MFA client for managing multi-factor authentication operations.\n   *\n   * Provides methods to list, enroll, and challenge MFA authenticators,\n   * as well as verify MFA challenges to complete authentication.\n   *\n   * The `verify` method integrates with the session state store, persisting tokens\n   * and user data after successful MFA verification.\n   *\n   * This property can only be used when `domain` is configured as a static string.\n   * In resolver mode (`domain` as a function), MFA is not supported.\n   */\n  public get mfa(): ServerMfaClient<TStoreOptions> {\n    if (!this.#mfaClient) {\n      throw new InvalidConfigurationError('mfa is only available when using a static domain configuration.');\n    }\n    return this.#mfaClient;\n  }\n\n  constructor(options: ServerClientOptions<TStoreOptions>) {\n    this.#options = options;\n    this.#stateStoreIdentifier = this.#options.stateIdentifier || '__a0_session';\n    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || '__a0_tx';\n    this.#transactionStore = options.transactionStore;\n    this.#stateStore = options.stateStore;\n\n    if (!this.#options.stateStore) {\n      throw new MissingRequiredArgumentError('stateStore');\n    }\n\n    if (!this.#options.transactionStore) {\n      throw new MissingRequiredArgumentError('transactionStore');\n    }\n\n    if (typeof this.#options.domain !== 'string' && typeof this.#options.domain !== 'function') {\n      throw new InvalidConfigurationError('domain must be a string or resolver function');\n    }\n\n    this.#authClientOptions = {\n      clientId: this.#options.clientId,\n      clientSecret: this.#options.clientSecret,\n      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n      authorizationParams: this.#options.authorizationParams,\n      discoveryCache: this.#options.discoveryCache,\n      customFetch: this.#options.customFetch,\n      useMtls: this.#options.useMtls,\n    };\n\n    if (typeof this.#options.domain === 'string') {\n      const domain = normalizeDomain(this.#options.domain);\n      this.#staticDomain = domain;\n      this.#authClient = new AuthClient({\n        domain,\n        ...this.#authClientOptions,\n        telemetry: getTelemetryConfig(this.#options.telemetry),\n      });\n\n      this.#mfaClient = new ServerMfaClient({\n        authClient: this.#authClient,\n        domain,\n        stateStore: this.#stateStore,\n        stateStoreIdentifier: this.#stateStoreIdentifier,\n        defaultAudience: this.#options.authorizationParams?.audience ?? 'default',\n      });\n    }\n  }\n\n  async #resolveDomain(storeOptions?: TStoreOptions): Promise<string> {\n    if (typeof this.#options.domain === 'function') {\n      const resolved = await (this.#options.domain as DomainResolver<TStoreOptions>)(storeOptions);\n      if (typeof resolved !== 'string' || resolved.trim().length === 0) {\n        throw new InvalidConfigurationError('domainResolver returned no domain');\n      }\n      return normalizeDomain(resolved);\n    }\n\n    return normalizeDomain(this.#options.domain);\n  }\n\n  #createAuthClient(domain: string): AuthClient {\n    return new AuthClient({\n      domain,\n      ...this.#authClientOptions,\n      telemetry: getTelemetryConfig(this.#options.telemetry),\n    });\n  }\n\n  #getAuthClient(domain: string): AuthClient {\n    const normalizedDomain = normalizeDomain(domain);\n    if (this.#authClient && this.#staticDomain === normalizedDomain) {\n      return this.#authClient;\n    }\n    return this.#createAuthClient(normalizedDomain);\n  }\n\n  #getSessionDomain(stateData: StateData): string | undefined {\n    if (stateData.domain) {\n      return normalizeDomain(stateData.domain);\n    }\n\n    if (this.#staticDomain) {\n      return this.#staticDomain;\n    }\n\n    // Legacy sessions may not have `domain` persisted yet; infer it from ID token claims.\n    const issuerFromClaims = stateData.user?.iss;\n    if (typeof issuerFromClaims === 'string' && issuerFromClaims.trim().length > 0) {\n      return normalizeDomain(issuerFromClaims);\n    }\n\n    return;\n  }\n\n  #isResolverMode(): boolean {\n    return typeof this.#options.domain === 'function';\n  }\n\n  async #isSessionForCurrentDomain(stateData: StateData, storeOptions?: TStoreOptions): Promise<boolean> {\n    const sessionDomain = this.#getSessionDomain(stateData);\n    if (!sessionDomain) {\n      return false;\n    }\n    const resolvedDomain = await this.#resolveDomain(storeOptions);\n    return sessionDomain === resolvedDomain;\n  }\n\n  /**\n   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Optional options used to configure the interactive login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n    if (!redirectUri) {\n      throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n    }\n\n    const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);\n\n    const domain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(domain);\n    const { codeVerifier, authorizationUrl } = await authClient.buildAuthorizationUrl({\n      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n      authorizationParams: {\n        ...options?.authorizationParams,\n        redirect_uri: redirectUri,\n        scope,\n      },\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n      domain,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return authorizationUrl;\n  }\n\n  /**\n   * Completes the interactive login process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n   */\n  public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n    if (!transactionData) {\n      throw new MissingTransactionError();\n    }\n\n    const domain = transactionData.domain ?? (await this.#resolveDomain(storeOptions));\n    const authClient = this.#getAuthClient(domain);\n    const tokenEndpointResponse = await authClient.getTokenByCode(url, {\n      codeVerifier: transactionData.codeVerifier,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse, {\n      domain,\n    });\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n      appState?: TAppState;\n      authorizationDetails?: AuthorizationDetails[];\n    };\n  }\n\n  /**\n   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Options used to configure the user linking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n      );\n    }\n\n    if (this.#isResolverMode()) {\n      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n      if (!isCurrentDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const domain = this.#getSessionDomain(stateData)!;\n    const authClient = this.#getAuthClient(domain);\n    const { linkUserUrl, codeVerifier } = await authClient.buildLinkUserUrl({\n      connection: options.connection,\n      connectionScope: options.connectionScope,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n      domain,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return linkUserUrl;\n  }\n\n  /**\n   * Completes the user linking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n   * @param options Options used to configure the user unlinking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n      );\n    }\n\n    if (this.#isResolverMode()) {\n      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n      if (!isCurrentDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const domain = this.#getSessionDomain(stateData)!;\n    const authClient = this.#getAuthClient(domain);\n    const { unlinkUserUrl, codeVerifier } = await authClient.buildUnlinkUserUrl({\n      connection: options.connection,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n      domain,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return unlinkUserUrl;\n  }\n\n  /**\n   * Completes the user unlinking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Logs in using Client-Initiated Backchannel Authentication.\n   *\n   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n   * @param options Options used to configure the backchannel login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n   *\n   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n   */\n  public async loginBackchannel(\n    options: LoginBackchannelOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginBackchannelResult> {\n    const scope = ensureOpenIdScope(options.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);\n    const domain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(domain);\n    const tokenEndpointResponse = await authClient.backchannelAuthentication({\n      bindingMessage: options.bindingMessage,\n      loginHint: options.loginHint,\n      authorizationParams: {\n        ...options.authorizationParams,\n        scope,\n      },\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse,\n      { domain }\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return {\n      authorizationDetails: tokenEndpointResponse.authorizationDetails,\n    };\n  }\n\n  /**\n   * Retrieves the user from the store, or undefined if no user found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The user, or undefined if no user found in the store.\n   */\n  public async getUser(storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData) {\n      return;\n    }\n\n    if (this.#isResolverMode()) {\n      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n      if (!isCurrentDomain) {\n        return;\n      }\n    }\n\n    return stateData.user;\n  }\n\n  /**\n   * Retrieve the user session from the store, or undefined if no session found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The session or undefined if no session found in the store.\n   */\n  public async getSession(storeOptions?: TStoreOptions): Promise<SessionData | undefined> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (stateData) {\n      if (this.#isResolverMode()) {\n        const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n        if (!isCurrentDomain) {\n          return;\n        }\n      }\n\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { internal, ...sessionData } = stateData;\n      return sessionData;\n    }\n  }\n\n  /**\n   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n   * Also updates the store when a new token was retrieved from Auth0.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token. When the cause is `mfa_required`, use `isMfaRequiredError(error)` to narrow the error and read `cause.mfa_token`.\n   *\n   * @returns The Token Set, containing the access token, as well as additional information.\n   */\n  public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const audience = this.#options.authorizationParams?.audience ?? 'default';\n    const scope = this.#options.authorizationParams?.scope;\n\n    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;\n    if (this.#isResolverMode()) {\n      if (!stateData) {\n        throw new MissingSessionError('Unable to retrieve access token without a logged in user.');\n      }\n      if (!sessionDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n      const resolvedDomain = await this.#resolveDomain(storeOptions);\n      if (sessionDomain !== resolvedDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const tokenSet = stateData?.tokenSets.find(\n      (tokenSet) => tokenSet.audience === audience && (!scope || compareScopes(tokenSet.scope, scope))\n    );\n\n    if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n      return tokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenByRefreshTokenError(\n        'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n      );\n    }\n\n    const domainForSession = sessionDomain!;\n    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenByRefreshToken({\n      refreshToken: stateData.refreshToken,\n    });\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse, {\n      domain: domainForSession,\n    });\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      audience: audience,\n    };\n  }\n\n  /**\n   * Retrieves an access token for a connection.\n   *\n   * This method attempts to obtain an access token for a specified connection.\n   * It first checks if a refresh token exists in the store.\n   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n   * that the refresh token was not found.\n   *\n   * @param options - Options for retrieving an access token for a connection.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n   */\n  public async getAccessTokenForConnection(\n    options: AccessTokenForConnectionOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<ConnectionTokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;\n    if (this.#isResolverMode()) {\n      if (!stateData) {\n        throw new MissingSessionError('Unable to retrieve an access token for a connection without a logged in user.');\n      }\n      if (!sessionDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n      const resolvedDomain = await this.#resolveDomain(storeOptions);\n      if (sessionDomain !== resolvedDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const connectionTokenSet = stateData?.connectionTokenSets?.find(\n      (tokenSet) => tokenSet.connection === options.connection\n    );\n\n    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n      return connectionTokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenForConnectionError(\n        'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n      );\n    }\n\n    const domainForSession = sessionDomain!;\n    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenForConnection({\n      connection: options.connection,\n      loginHint: options.loginHint,\n      refreshToken: stateData.refreshToken,\n    });\n\n    const updatedStateData = updateStateDataForConnectionTokenSet(\n      options,\n      {\n        ...stateData,\n        domain: stateData.domain ?? domainForSession,\n      },\n      tokenEndpointResponse\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      connection: options.connection,\n      loginHint: options.loginHint,\n    };\n  }\n\n  /**\n   * Logs the user out and returns a URL to redirect the user-agent to after they log out.\n   * @param options Options used to configure the logout process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns {URL}\n   */\n  public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n    if (!this.#isResolverMode()) {\n      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n      return this.authClient.buildLogoutUrl(options);\n    }\n\n    const resolvedDomain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(resolvedDomain);\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : undefined;\n\n    if (!stateData) {\n      // No local session, still return a logout URL for the current domain.\n      return authClient.buildLogoutUrl(options);\n    }\n\n    if (sessionDomain && sessionDomain === resolvedDomain) {\n      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n    }\n\n    return authClient.buildLogoutUrl(options);\n  }\n\n  /**\n   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n   * @param logoutToken The logout token to verify and use to delete the session from the store.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelLogoutError} If the logout token is missing.\n   * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n   */\n  public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n    if (!logoutToken) {\n      throw new BackchannelLogoutError('Missing Logout Token');\n    }\n\n    if (!this.#isResolverMode()) {\n      const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });\n      await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n      return;\n    }\n\n    const issuer = decodeIssuer(logoutToken);\n    if (!issuer) {\n      throw new BackchannelLogoutError('Logout token is missing an issuer');\n    }\n\n    const resolvedDomain = await this.#resolveDomain(storeOptions);\n    const domain = normalizeDomain(issuer);\n    if (domain !== resolvedDomain) {\n      throw new BackchannelLogoutError('Logout token issuer does not match the resolved domain');\n    }\n\n    const authClient = this.#getAuthClient(domain);\n    const logoutTokenClaims = await authClient.verifyLogoutToken({ logoutToken });\n\n    await this.#stateStore.deleteByLogoutToken({ ...logoutTokenClaims, iss: issuer }, storeOptions);\n  }\n}\n","/**\n * Compares two sets of scopes to determine if all required scopes are present in the provided scopes.\n * @param scopes Scopes to compare\n * @param requiredScopes Scopes required to be present in the scopes\n * @returns True if all required scopes are present in the scopes, false otherwise\n */\nexport const compareScopes = (scopes: string | undefined, requiredScopes: string | undefined) => {\n  // When the scopes and requiredScopes are exactly the same, return true\n  // This handles cases where both are empty or undefined or both are the same string\n  if (scopes === requiredScopes) {\n    return true;\n  }\n\n  if (!scopes || !requiredScopes) {\n    return false;\n  }\n\n  const scopesSet = new Set(scopes.trim().split(' ').filter(Boolean));\n  const requiredScopesArray = requiredScopes.trim().split(' ').filter(Boolean);\n\n  return requiredScopesArray.every((scope) => scopesSet.has(scope));\n};\n","import { TelemetryConfig } from '@auth0/auth0-auth-js';\n\n// These constants are injected at build time via tsup\ndeclare const __AUTH0_SERVER_JS_PACKAGE_NAME__: string;\ndeclare const __AUTH0_SERVER_JS_PACKAGE_VERSION__: string;\n\nexport function getTelemetryConfig(config?: TelemetryConfig): TelemetryConfig {\n  if (config?.enabled === false) {\n    return config;\n  }\n\n  return {\n    enabled: true,\n    name: config?.name ?? __AUTH0_SERVER_JS_PACKAGE_NAME__,\n    version: config?.version ?? __AUTH0_SERVER_JS_PACKAGE_VERSION__,\n  };\n}\n","import { updateStateData } from '../state/utils.js';\nimport type { ServerMfaClientOptions, MfaVerifyResponse } from './types.js';\nimport type {\n  ListAuthenticatorsOptions,\n  AuthenticatorResponse,\n  EnrollAuthenticatorOptions,\n  EnrollmentResponse,\n  ChallengeOptions,\n  ChallengeResponse,\n  MfaVerifyOptions,\n} from '@auth0/auth0-auth-js';\n\nexport class ServerMfaClient<TStoreOptions = unknown> {\n  readonly #options: ServerMfaClientOptions<TStoreOptions>;\n\n  /**\n   * @internal\n   */\n  constructor(options: ServerMfaClientOptions<TStoreOptions>) {\n    this.#options = options;\n  }\n\n  /**\n   * Lists all MFA authenticators enrolled by the user.\n   *\n   * @param options - Options for listing authenticators\n   * @returns Promise resolving to an array of enrolled authenticators\n   * @throws {MfaListAuthenticatorsError} When the request fails\n   */\n  async listAuthenticators(options: ListAuthenticatorsOptions): Promise<AuthenticatorResponse[]> {\n    return this.#options.authClient.mfa.listAuthenticators(options);\n  }\n\n  /**\n   * Enrolls a new MFA authenticator for the user.\n   *\n   * @param options - Enrollment options\n   * @returns Promise resolving to enrollment response with authenticator details\n   * @throws {MfaEnrollmentError} When enrollment fails\n   */\n  async enrollAuthenticator(options: EnrollAuthenticatorOptions): Promise<EnrollmentResponse> {\n    return this.#options.authClient.mfa.enrollAuthenticator(options);\n  }\n\n  /**\n   * Initiates an MFA challenge for user verification.\n   *\n   * @param options - Challenge options\n   * @returns Promise resolving to challenge response with challenge details\n   * @throws {MfaChallengeError} When the challenge fails\n   */\n  async challengeAuthenticator(options: ChallengeOptions): Promise<ChallengeResponse> {\n    return this.#options.authClient.mfa.challengeAuthenticator(options);\n  }\n\n  /**\n   * Verifies an MFA challenge and completes the authentication flow.\n   *\n   * Exchanges the MFA token and verification code for access, ID, and refresh tokens,\n   * then saves them into the user's session automatically.\n   *\n   * @param options - The MFA token, factor type (otp / oob / recovery-code), and the code to verify\n   * @param storeOptions - Optional options forwarded to the session store. Can be omitted when\n   *   using the built-in stores; required if your custom store needs extra context (e.g. a request object).\n   * @returns The tokens returned by Auth0 after successful verification\n   * @throws {MfaVerifyError} When verification fails (e.g. invalid token, wrong code)\n   */\n  async verify(options: MfaVerifyOptions, storeOptions?: TStoreOptions): Promise<MfaVerifyResponse> {\n    const tokenResponse = await this.#options.authClient.mfa.verify(options);\n\n    const audience = options.audience ?? this.#options.defaultAudience;\n    const existingStateData = await this.#options.stateStore.get(\n      this.#options.stateStoreIdentifier,\n      storeOptions\n    );\n\n    const updatedStateData = updateStateData(audience, existingStateData, tokenResponse, {\n      domain: this.#options.domain,\n    });\n\n    await this.#options.stateStore.set(\n      this.#options.stateStoreIdentifier,\n      updatedStateData,\n      true,\n      storeOptions\n    );\n\n    const result: MfaVerifyResponse = {\n      accessToken: tokenResponse.accessToken,\n      tokenType: tokenResponse.tokenType ?? 'bearer',\n      expiresAt: tokenResponse.expiresAt,\n      scope: tokenResponse.scope,\n    };\n\n    if (tokenResponse.idToken) result.idToken = tokenResponse.idToken;\n    if (tokenResponse.refreshToken) result.refreshToken = tokenResponse.refreshToken;\n    if (tokenResponse.recoveryCode) result.recoveryCode = tokenResponse.recoveryCode;\n\n    return result;\n  }\n}\n","import { EncryptJWT, jwtDecrypt, errors } from 'jose';\nimport type { JWTPayload } from 'jose';\nimport { InvalidConfigurationError } from '../errors.js';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder | undefined;\n\n/**\n * Type guard to determine if an error is a decryption-related error.\n * Decryption errors (JWEDecryptionFailed, JWEInvalid) indicate issues with the encryption key or data format.\n * These are distinct from claim validation errors (like expiration), which indicate a valid token with invalid claims.\n * @param e - The error thrown during decryption\n * @returns True if the error is a decryption error, false otherwise\n */\nexport function isDecryptionError(e: unknown): e is Error {\n  return e instanceof errors.JWEDecryptionFailed || e instanceof errors.JWEInvalid;\n}\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n  encoder ||= new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n  return new Uint8Array(\n    await crypto.subtle.deriveBits(\n      {\n        name: 'HKDF',\n        hash: DIGEST,\n        info: encoder.encode(HKDF_INFO),\n        salt: encoder.encode(`${salt}${kid}`),\n      } as HkdfParams,\n      key,\n      BIT_LENGTH\n    )\n  );\n}\n\n/**\n * Encrypts a payload using the provided secret and salt, with an expiration time.\n * @param payload The payload to encrypt.\n * @param secret The secret to use for encryption.\n * @param salt The salt to use for encryption.\n * @param expiration The expiration time for the encrypted payload.\n * @returns The encrypted payload.\n */\nasync function _encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n  const kid = crypto.randomUUID();\n  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n  return await new EncryptJWT(payload)\n    .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n    .setExpirationTime(expiration)\n    .encrypt(encryptionSecret);\n}\n\n/**\n * Encrypts a payload using the provided secret and salt, with an expiration time.\n * The secret can be a single string or an array of strings for secret rotation support.\n * When using an array of secrets, only the first one is used for encryption (all secrets are tried for decryption).\n * @param payload The payload to encrypt.\n * @param secret The secret(s) to use for encryption. Can be a single string or an array of strings for secret rotation support.\n * @param salt The salt to use for encryption.\n * @param expiration The expiration time for the encrypted payload.\n * @returns The encrypted payload.\n */\nexport async function encrypt(payload: JWTPayload, secret: string | string[], salt: string, expiration: number) {\n  if (typeof secret === 'string') {\n    return await _encrypt(payload, secret, salt, expiration);\n  } else {\n    // For encryption, we only use the newest secret, as the old secrets are only used for backward compatibility during decryption.\n    const [newSecret] = secret;\n\n    if (!newSecret) {\n      throw new InvalidConfigurationError('At least one secret must be provided');\n    }\n\n    return await _encrypt(payload, newSecret, salt, expiration);\n  }\n}\n\n/**\n * Decrypts an encrypted payload using the provided secret(s) and salt.\n * @param value The encrypted payload to decrypt.\n * @param secret The secret to use for decryption.\n * @param salt The salt to use for decryption.\n * @returns The decrypted payload.\n */\nexport async function _decrypt<T>(value: string, secret: string, salt: string) {\n  const res = await jwtDecrypt<T>(\n    value,\n    async (protectedHeader) => {\n      // This error shouldn't happen, as we always set a kid.\n      // However, leaving this here as a safety net.\n      if (!protectedHeader.kid) {\n        throw new Error('Missing \"kid\" in JWE header');\n      }\n\n      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n    },\n    { clockTolerance: 15 }\n  );\n  return res.payload;\n}\n\n/**\n * Decrypts an encrypted payload using the provided secret(s) and salt.\n * The secret can be a single string or an array of strings for secret rotation support.\n * When using an array of secrets, the function will try to decrypt with each secret in order until it succeeds or exhausts all options.\n * Only decryption-related errors (JWEDecryptionFailed, JWEInvalid) will trigger fallback to old secrets.\n * Other errors (like expiration) will be thrown immediately.\n * @param value The encrypted payload to decrypt.\n * @param secret The secret(s) to use for decryption. Can be a single string or an array of strings for secret rotation support.\n * @param salt The salt to use for decryption.\n * @returns The decrypted payload.\n */\nexport async function decrypt<T>(value: string, secret: string | string[], salt: string) {\n  if (typeof secret === 'string') {\n    return await _decrypt<T>(value, secret, salt);\n  } else {\n    const [newSecret, ...oldSecrets] = secret;\n\n    if (!newSecret) {\n      throw new InvalidConfigurationError('At least one secret must be provided');\n    }\n\n    let firstError: Error | undefined;\n\n    try {\n      return await _decrypt<T>(value, newSecret, salt);\n    } catch (err) {\n      firstError = err as Error;\n\n      // Only try old secrets if this is a decryption-related error\n      // Other errors (like expiration) should be thrown immediately\n      if (!isDecryptionError(err)) {\n        throw firstError;\n      }\n\n      for (const oldSecret of oldSecrets) {\n        try {\n          return await _decrypt(value, oldSecret, salt);\n        } catch (fallbackErr) {\n          // Only ignore decryption errors with old secrets and continue trying with the next one\n          // If it's a different type of error, throw it\n          if (!isDecryptionError(fallbackErr)) {\n            throw fallbackErr;\n          }\n        }\n      }\n\n      // If we've exhausted all secrets and still can't decrypt, throw the original error.\n      throw firstError;\n    }\n  }\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt, isDecryptionError } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n  protected readonly options: EncryptedStoreOptions;\n\n  constructor(options: EncryptedStoreOptions) {\n    this.options = options;\n  }\n\n  abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;\n  abstract get(identifier: string, options?: TStoreOptions | undefined): Promise<TData | undefined>;\n  abstract delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;\n\n  protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n    return await encrypt(stateData, this.options.secret, identifier, expiration);\n  }\n\n  protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n    try {\n      return (await decrypt(encryptedStateData, this.options.secret, identifier)) as TData;\n    } catch (e: unknown){\n      // When the error is a decryption failure, we want to ignore it and return undefined, as this likely means the session has expired or the data is invalid.\n      if (isDecryptionError(e)) {\n        return;\n      }\n\n      throw e;\n    }\n  }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n\n  abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n}","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    transactionData: TransactionData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions\n  ): Promise<void> {   \n    const maxAge = 60 * 60;\n    const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions): Promise<TransactionData | undefined> {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n    if (cookieValue) {\n      return await this.decrypt(identifier, cookieValue);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n  readonly #rolling: boolean;\n  readonly #absoluteDuration: number;\n  readonly #inactivityDuration: number;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n    super(options);\n\n    this.#rolling = options.rolling ?? true;\n    this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n    this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n  }\n\n  /**\n   * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n   */\n  protected calculateMaxAge(createdAt: number) {\n    if (!this.#rolling) {\n      return this.#absoluteDuration;\n    }\n\n    const now = (Date.now() / 1000) | 0;\n    const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n    const maxAge = expiresAt - now;\n\n    return maxAge > 0 ? maxAge : 0;\n  }\n}","import type {\n  EncryptedStoreOptions,\n  LogoutTokenClaims,\n  SessionConfiguration,\n  SessionCookieOptions,\n  SessionStore,\n  StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n  store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #store: SessionStore<TStoreOptions>;\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(\n    options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n    cookieHandler: CookieHandler<TStoreOptions>\n  ) {\n    super(options);\n\n    this.#store = options.store;\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    let sessionId = await this.getSessionId(identifier, options);\n\n    // if this is a new session created by a new login we need to remove the old session\n    // from the store and regenerate the session ID to prevent session fixation.\n    if (sessionId && removeIfExists) {\n      await this.#store.delete(sessionId);\n      sessionId = generateId();\n    }\n\n    sessionId ??= generateId();\n\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Date.now() / 1000 + maxAge;\n    const encryptedStateData = await this.encrypt<{ id: string }>(\n      identifier,\n      {\n        id: sessionId,\n      },\n      expiration\n    );\n\n    await this.#store.set(sessionId, stateData);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      const stateData = await this.#store.get(sessionId);\n\n      // If we have a session cookie, but no `stateData`, we should remove the cookie.\n      if (!stateData) {\n        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n      }\n\n      return stateData;\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      await this.#store.delete(sessionId);\n    }\n\n    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n  }\n\n  private async getSessionId(identifier: string, options?: TStoreOptions) {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n    if (cookieValue) {\n      const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n      \n      if (sessionCookie) {\n        return sessionCookie.id;\n      }\n    }\n  }\n\n  deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void> {\n    return this.#store.deleteByLogoutToken(claims, options);\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n    const chunkSize = 3072;\n    const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n    const chunks = [...Array(chunkCount).keys()].map((i) => ({\n      value: encryptedStateData.substring(i * chunkSize, (i + 1) * chunkSize),\n      name: `${identifier}.${i}`,\n    }));\n\n    chunks.forEach((chunk) => {\n      this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n    });\n\n    const existingCookieKeys = this.getCookieKeys(identifier, options);\n    const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n    cookieKeysToRemove.forEach((key) => {\n      this.#cookieHandler.deleteCookie(key, options, cookieOpts);\n    });\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    const encryptedStateData = cookieKeys\n      .map((key) => ({\n        index: parseInt(key.split('.')[1] as string, 10),\n        value: this.#cookieHandler.getCookie(key, options),\n      }))\n      .sort((a, b) => a.index - b.index)\n      .map((item) => item.value)\n      .join('');\n\n    if (encryptedStateData) {\n      return await this.decrypt(identifier, encryptedStateData);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    for (const key of cookieKeys) {\n      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());\n    }\n  }\n\n  deleteByLogoutToken(): Promise<void> {\n    throw new Error(\n      'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n    );\n  }\n\n  private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n    return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n","export { ServerMfaClient } from './server-mfa-client.js';\nexport type { MfaVerifyResponse } from './types.js';\nexport type {\n  MfaFactorType,\n  MfaVerifyOtpOptions,\n  MfaVerifyOobOptions,\n  MfaVerifyRecoveryCodeOptions,\n  MfaVerifyOptions,\n} from '@auth0/auth0-auth-js';\n\n// Re-export MFA types and errors from auth0-auth-js for convenience\nexport type {\n  AuthenticatorResponse,\n  AuthenticatorType,\n  OobChannel,\n  ListAuthenticatorsOptions,\n  EnrollOtpOptions,\n  EnrollOobOptions,\n  EnrollEmailOptions,\n  EnrollAuthenticatorOptions,\n  OtpEnrollmentResponse,\n  OobEnrollmentResponse,\n  EnrollmentResponse,\n  ChallengeOptions,\n  ChallengeResponse,\n  MfaRequirements,\n} from '@auth0/auth0-auth-js';\n\nexport {\n  MfaListAuthenticatorsError,\n  MfaEnrollmentError,\n  MfaChallengeError,\n  MfaVerifyError,\n  isMfaRequiredError,\n} from '@auth0/auth0-auth-js';\n"],"mappings":";AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC5C,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EACxC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;AC1EA,IAAM,wBAAwB,CAAC,UAAkB,cAA6B;AAAA,EAC5E;AAAA,EACA,aAAa,SAAS;AAAA,EACtB,OAAO,SAAS;AAAA,EAChB,WAAW,SAAS;AACtB;AASO,SAAS,gBACd,UACA,WACA,uBACA,SACW;AAIX,MAAI,aAAa,sBAAsB,QAAQ;AAC7C,UAAM,SAAS,sBAAsB,OAAO;AAC5C,UAAM,SAAS,sBAAsB,OAAO;AAC5C,UAAM,cAAc,UAAU,MAAM;AACpC,UAAM,cAAc,UAAU,MAAM;AAEpC,UAAM,cAAc,WAAW,UAAa,gBAAgB,UAAa,WAAW;AACpF,UAAM,cAAc,WAAW,UAAa,gBAAgB,UAAa,WAAW;AAEpF,QAAI,eAAe,aAAa;AAC9B,kBAAY;AAAA,IACd;AAAA,EACF;AAEA,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,UAAU,qBAAqB,CAAC,IAC/E,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,UAAU,qBAAqB,IACrD;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB,WAAW,UAAU;AAAA,MACpD,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,MACA,QAAQ,SAAS,UAAU,UAAU;AAAA,IACvC;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW,CAAC,sBAAsB,UAAU,qBAAqB,CAAC;AAAA,MAClE,QAAQ,SAAS;AAAA,MACjB,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAChG,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACxFA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;;;ACzBA,IAAM,gBAAgB,CAAC,QAA4B,mBAAuC;AAG/F,MAAI,WAAW,gBAAgB;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC;AAClE,QAAM,sBAAsB,eAAe,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3E,SAAO,oBAAoB,MAAM,CAAC,UAAU,UAAU,IAAI,KAAK,CAAC;AAClE;;;ADYA,SAAS,iBAAiB;;;AE3BnB,SAAS,mBAAmB,QAA2C;AAC5E,MAAI,QAAQ,YAAY,OAAO;AAC7B,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM,QAAQ,QAAQ;AAAA,IACtB,SAAS,QAAQ,WAAW;AAAA,EAC9B;AACF;;;ACJO,IAAM,kBAAN,MAA+C;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKT,YAAY,SAAgD;AAC1D,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,mBAAmB,SAAsE;AAC7F,WAAO,KAAK,SAAS,WAAW,IAAI,mBAAmB,OAAO;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,oBAAoB,SAAkE;AAC1F,WAAO,KAAK,SAAS,WAAW,IAAI,oBAAoB,OAAO;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK,SAAS,WAAW,IAAI,uBAAuB,OAAO;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,OAAO,SAA2B,cAA0D;AAChG,UAAM,gBAAgB,MAAM,KAAK,SAAS,WAAW,IAAI,OAAO,OAAO;AAEvE,UAAM,WAAW,QAAQ,YAAY,KAAK,SAAS;AACnD,UAAM,oBAAoB,MAAM,KAAK,SAAS,WAAW;AAAA,MACvD,KAAK,SAAS;AAAA,MACd;AAAA,IACF;AAEA,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,eAAe;AAAA,MACnF,QAAQ,KAAK,SAAS;AAAA,IACxB,CAAC;AAED,UAAM,KAAK,SAAS,WAAW;AAAA,MAC7B,KAAK,SAAS;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,SAA4B;AAAA,MAChC,aAAa,cAAc;AAAA,MAC3B,WAAW,cAAc,aAAa;AAAA,MACtC,WAAW,cAAc;AAAA,MACzB,OAAO,cAAc;AAAA,IACvB;AAEA,QAAI,cAAc,QAAS,QAAO,UAAU,cAAc;AAC1D,QAAI,cAAc,aAAc,QAAO,eAAe,cAAc;AACpE,QAAI,cAAc,aAAc,QAAO,eAAe,cAAc;AAEpE,WAAO;AAAA,EACT;AACF;;;AH9DA,IAAM,iBAAiB;AAEvB,IAAM,kBAAkB,CAAC,UAAkB;AACzC,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,SAAS,QAAQ,WAAW,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,OAAO,EAAE;AAC3F,SAAO,OAAO,KAAK,YAAY;AACjC;AAEA,IAAM,eAAe,CAAC,UAAkB;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,UAAU,KAAK;AAC/B,WAAO,OAAO,QAAQ,WAAW,MAAM;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,IAAM,oBAAoB,CAAC,UAAmB;AAC5C,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,MAAM,MAAM,GAAG;AAC9B,MAAI,CAAC,OAAO,SAAS,QAAQ,GAAG;AAC9B,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,SAAO,OAAO,KAAK,GAAG;AACxB;AAEO,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYT,IAAW,aAAyB;AAClC,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI,0BAA0B,wEAAwE;AAAA,IAC9G;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,IAAW,MAAsC;AAC/C,QAAI,CAAC,KAAK,YAAY;AACpB,YAAM,IAAI,0BAA0B,iEAAiE;AAAA,IACvG;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,QAAI,OAAO,KAAK,SAAS,WAAW,YAAY,OAAO,KAAK,SAAS,WAAW,YAAY;AAC1F,YAAM,IAAI,0BAA0B,8CAA8C;AAAA,IACpF;AAEA,SAAK,qBAAqB;AAAA,MACxB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,gBAAgB,KAAK,SAAS;AAAA,MAC9B,aAAa,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,SAAS;AAAA,IACzB;AAEA,QAAI,OAAO,KAAK,SAAS,WAAW,UAAU;AAC5C,YAAM,SAAS,gBAAgB,KAAK,SAAS,MAAM;AACnD,WAAK,gBAAgB;AACrB,WAAK,cAAc,IAAI,WAAW;AAAA,QAChC;AAAA,QACA,GAAG,KAAK;AAAA,QACR,WAAW,mBAAmB,KAAK,SAAS,SAAS;AAAA,MACvD,CAAC;AAED,WAAK,aAAa,IAAI,gBAAgB;AAAA,QACpC,YAAY,KAAK;AAAA,QACjB;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,sBAAsB,KAAK;AAAA,QAC3B,iBAAiB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAClE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,cAA+C;AAClE,QAAI,OAAO,KAAK,SAAS,WAAW,YAAY;AAC9C,YAAM,WAAW,MAAO,KAAK,SAAS,OAAyC,YAAY;AAC3F,UAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,WAAW,GAAG;AAChE,cAAM,IAAI,0BAA0B,mCAAmC;AAAA,MACzE;AACA,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAEA,WAAO,gBAAgB,KAAK,SAAS,MAAM;AAAA,EAC7C;AAAA,EAEA,kBAAkB,QAA4B;AAC5C,WAAO,IAAI,WAAW;AAAA,MACpB;AAAA,MACA,GAAG,KAAK;AAAA,MACR,WAAW,mBAAmB,KAAK,SAAS,SAAS;AAAA,IACvD,CAAC;AAAA,EACH;AAAA,EAEA,eAAe,QAA4B;AACzC,UAAM,mBAAmB,gBAAgB,MAAM;AAC/C,QAAI,KAAK,eAAe,KAAK,kBAAkB,kBAAkB;AAC/D,aAAO,KAAK;AAAA,IACd;AACA,WAAO,KAAK,kBAAkB,gBAAgB;AAAA,EAChD;AAAA,EAEA,kBAAkB,WAA0C;AAC1D,QAAI,UAAU,QAAQ;AACpB,aAAO,gBAAgB,UAAU,MAAM;AAAA,IACzC;AAEA,QAAI,KAAK,eAAe;AACtB,aAAO,KAAK;AAAA,IACd;AAGA,UAAM,mBAAmB,UAAU,MAAM;AACzC,QAAI,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,GAAG;AAC9E,aAAO,gBAAgB,gBAAgB;AAAA,IACzC;AAEA;AAAA,EACF;AAAA,EAEA,kBAA2B;AACzB,WAAO,OAAO,KAAK,SAAS,WAAW;AAAA,EACzC;AAAA,EAEA,MAAM,2BAA2B,WAAsB,cAAgD;AACrG,UAAM,gBAAgB,KAAK,kBAAkB,SAAS;AACtD,QAAI,CAAC,eAAe;AAClB,aAAO;AAAA,IACT;AACA,UAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,WAAO,kBAAkB;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,QAAQ,kBAAkB,SAAS,qBAAqB,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAE/G,UAAM,SAAS,MAAM,KAAK,eAAe,YAAY;AACrD,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,WAAW,sBAAsB;AAAA,MAChF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,QACd;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,SAAS,gBAAgB,UAAW,MAAM,KAAK,eAAe,YAAY;AAChF,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,wBAAwB,MAAM,WAAW,eAAe,KAAK;AAAA,MACjE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,uBAAuB;AAAA,MACjH;AAAA,IACF,CAAC;AAED,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,gBAAgB,GAAG;AAC1B,YAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,UAAI,CAAC,iBAAiB;AACpB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB,SAAS;AAC/C,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,WAAW,iBAAiB;AAAA,MACtE,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,gBAAgB,GAAG;AAC1B,YAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,UAAI,CAAC,iBAAiB;AACpB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB,SAAS;AAC/C,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,WAAW,mBAAmB;AAAA,MAC1E,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,QAAQ,kBAAkB,QAAQ,qBAAqB,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC9G,UAAM,SAAS,MAAM,KAAK,eAAe,YAAY;AACrD,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,wBAAwB,MAAM,WAAW,0BAA0B;AAAA,MACvE,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB;AAAA,QACnB,GAAG,QAAQ;AAAA,QACX;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,EAAE,OAAO;AAAA,IACX;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,WAAW;AACd;AAAA,IACF;AAEA,QAAI,KAAK,gBAAgB,GAAG;AAC1B,YAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,UAAI,CAAC,iBAAiB;AACpB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AACb,UAAI,KAAK,gBAAgB,GAAG;AAC1B,cAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,YAAI,CAAC,iBAAiB;AACpB;AAAA,QACF;AAAA,MACF;AAGA,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,gBAAgB,YAAY,KAAK,kBAAkB,SAAS,IAAI,KAAK;AAC3E,QAAI,KAAK,gBAAgB,GAAG;AAC1B,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,oBAAoB,2DAA2D;AAAA,MAC3F;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AACA,YAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAI,kBAAkB,gBAAgB;AACpC,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAAS,cAAcA,UAAS,OAAO,KAAK;AAAA,IAChG;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB;AACzB,UAAM,wBAAwB,MAAM,KAAK,eAAe,gBAAgB,EAAE,uBAAuB;AAAA,MAC/F,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,uBAAuB;AAAA,MAC3F,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BACX,SACA,cAC6B;AAC7B,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,gBAAgB,YAAY,KAAK,kBAAkB,SAAS,IAAI,KAAK;AAC3E,QAAI,KAAK,gBAAgB,GAAG;AAC1B,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,oBAAoB,+EAA+E;AAAA,MAC/G;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AACA,YAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAI,kBAAkB,gBAAgB;AACpC,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB;AACzB,UAAM,wBAAwB,MAAM,KAAK,eAAe,gBAAgB,EAAE,sBAAsB;AAAA,MAC9F,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA;AAAA,QACE,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,YAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AACtE,aAAO,KAAK,WAAW,eAAe,OAAO;AAAA,IAC/C;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAM,aAAa,KAAK,eAAe,cAAc;AACrD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,gBAAgB,YAAY,KAAK,kBAAkB,SAAS,IAAI;AAEtE,QAAI,CAAC,WAAW;AAEd,aAAO,WAAW,eAAe,OAAO;AAAA,IAC1C;AAEA,QAAI,iBAAiB,kBAAkB,gBAAgB;AACrD,YAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAAA,IACxE;AAEA,WAAO,WAAW,eAAe,OAAO;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,YAAMC,qBAAoB,MAAM,KAAK,WAAW,kBAAkB,EAAE,YAAY,CAAC;AACjF,YAAM,KAAK,YAAY,oBAAoBA,oBAAmB,YAAY;AAC1E;AAAA,IACF;AAEA,UAAM,SAAS,aAAa,WAAW;AACvC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,uBAAuB,mCAAmC;AAAA,IACtE;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAM,SAAS,gBAAgB,MAAM;AACrC,QAAI,WAAW,gBAAgB;AAC7B,YAAM,IAAI,uBAAuB,wDAAwD;AAAA,IAC3F;AAEA,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,oBAAoB,MAAM,WAAW,kBAAkB,EAAE,YAAY,CAAC;AAE5E,UAAM,KAAK,YAAY,oBAAoB,EAAE,GAAG,mBAAmB,KAAK,OAAO,GAAG,YAAY;AAAA,EAChG;AACF;;;AItuBA,SAAS,YAAY,YAAY,cAAc;AAI/C,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AASG,SAAS,kBAAkB,GAAwB;AACxD,SAAO,aAAa,OAAO,uBAAuB,aAAa,OAAO;AACxE;AAEA,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAUA,eAAe,SAAS,SAAqB,QAAgB,MAAc,YAAoB;AAC7F,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,WAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAYA,eAAsB,QAAQ,SAAqB,QAA2B,MAAc,YAAoB;AAC9G,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,MAAM,SAAS,SAAS,QAAQ,MAAM,UAAU;AAAA,EACzD,OAAO;AAEL,UAAM,CAAC,SAAS,IAAI;AAEpB,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,0BAA0B,sCAAsC;AAAA,IAC5E;AAEA,WAAO,MAAM,SAAS,SAAS,WAAW,MAAM,UAAU;AAAA,EAC5D;AACF;AASA,eAAsB,SAAY,OAAe,QAAgB,MAAc;AAC7E,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAGzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;AAaA,eAAsB,QAAW,OAAe,QAA2B,MAAc;AACvF,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,MAAM,SAAY,OAAO,QAAQ,IAAI;AAAA,EAC9C,OAAO;AACL,UAAM,CAAC,WAAW,GAAG,UAAU,IAAI;AAEnC,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,0BAA0B,sCAAsC;AAAA,IAC5E;AAEA,QAAI;AAEJ,QAAI;AACF,aAAO,MAAM,SAAY,OAAO,WAAW,IAAI;AAAA,IACjD,SAAS,KAAK;AACZ,mBAAa;AAIb,UAAI,CAAC,kBAAkB,GAAG,GAAG;AAC3B,cAAM;AAAA,MACR;AAEA,iBAAW,aAAa,YAAY;AAClC,YAAI;AACF,iBAAO,MAAM,SAAS,OAAO,WAAW,IAAI;AAAA,QAC9C,SAAS,aAAa;AAGpB,cAAI,CAAC,kBAAkB,WAAW,GAAG;AACnC,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;ACvJO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,QAAI;AACF,aAAQ,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,IAC3E,SAAS,GAAW;AAElB,UAAI,kBAAkB,CAAC,GAAG;AACxB;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;AC7BO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNO,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,MAChF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,EAChF;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAEhF,UAAI,eAAe;AACjB,eAAO,cAAc;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;ACvHO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,SAAS,UAAU;AAAA,IAC3D,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,SAAS,KAAK,kBAAkB,CAAC;AAAA,IACzE;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;AC5DA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":["tokenSet","logoutTokenClaims"]}
+{"version":3,"sources":["../src/errors.ts","../src/state/utils.ts","../src/server-client.ts","../src/utils.ts","../src/telemetry.ts","../src/mfa/server-mfa-client.ts","../src/encryption/index.ts","../src/store/abstract-store.ts","../src/store/abstract-state-store.ts","../src/store/abstract-transaction-store.ts","../src/index.ts","../src/store/cookie-transaction-store.ts","../src/store/abstract-session-store.ts","../src/store/stateful-state-store.ts","../src/store/stateless-state-store.ts","../src/mfa/index.ts"],"sourcesContent":["/**\n * Error thrown when there is no transaction available.\n */\nexport class MissingTransactionError extends Error {\n  public code: string = 'missing_transaction_error';\n\n  constructor(message?: string) {\n    super(message ?? 'The transaction is missing.');\n    this.name = 'MissingTransactionError';\n  }\n}\n\n\n/**\n * Error thrown when backchannel logout fails.\n */\nexport class BackchannelLogoutError extends Error {\n  public code: string = 'backchannel_logout_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'BackchannelLogoutError';\n  }\n}\n\n/**\n * Error thrown when starting the user-linking failed.\n */\nexport class StartLinkUserError extends Error {\n  public code: string = 'start_link_user_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'StartLinkUserError';\n  }\n}\n\n/**\n * Error thrown when a required argument is missing.\n */\nexport class MissingRequiredArgumentError extends Error {\n  public code: string = 'missing_required_argument_error';\n\n  constructor(argument: string) {\n    super(`The argument '${argument}' is required but was not provided.`);\n    this.name = 'MissingRequiredArgumentError';\n  }\n}\n\n/**\n * Error thrown when a session is missing.\n */\nexport class MissingSessionError extends Error {\n  public code: string = 'missing_session_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'MissingSessionError';\n  }\n}\n\n/**\n * Error thrown when a configuration is invalid.\n */\nexport class InvalidConfigurationError extends Error {\n  public code: string = 'invalid_configuration_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'InvalidConfigurationError';\n  }\n}\n\n/**\n * Error thrown when the issuer validation fails.\n */\nexport class IssuerValidationError extends Error {\n  public code: string = 'issuer_validation_error';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'IssuerValidationError';\n  }\n}\n","import type { AccessTokenForConnectionOptions, StateData } from '../types.js';\nimport { TokenResponse } from '@auth0/auth0-auth-js';\n\n/**\n * Creates an updated token set object from the token endpoint response\n * @param audience The audience for which the token was requested\n * @param response The response from the token endpoint\n * @returns Updated token set object\n */\nconst createUpdatedTokenSet = (audience: string, response: TokenResponse) => ({\n  audience,\n  accessToken: response.accessToken,\n  scope: response.scope,\n  expiresAt: response.expiresAt,\n});\n\n/**\n * Utility function to update the state with a new response from the token endpoint\n * @param audience The audience of the token endpoint response\n * @param stateData The existing state data to update, or undefined if no state data available.\n * @param tokenEndpointResponse The response from the token endpoint.\n * @returns Updated state data.\n */\nexport function updateStateData(\n  audience: string,\n  stateData: StateData | undefined,\n  tokenEndpointResponse: TokenResponse,\n  context?: { domain?: string }\n): StateData {\n  // If we already have a session and the new token belongs to a different user (iss or sub mismatch),\n  // wipe the existing state to start a fresh session. This handles the case where a user logs in\n  // as a different user without explicitly logging out first.\n  if (stateData && tokenEndpointResponse.claims) {\n    const newSub = tokenEndpointResponse.claims.sub;\n    const newIss = tokenEndpointResponse.claims.iss;\n    const existingSub = stateData.user?.sub;\n    const existingIss = stateData.user?.iss;\n\n    const subMismatch = newSub !== undefined && existingSub !== undefined && newSub !== existingSub;\n    const issMismatch = newIss !== undefined && existingIss !== undefined && newIss !== existingIss;\n\n    if (subMismatch || issMismatch) {\n      stateData = undefined;\n    }\n  }\n\n  if (stateData) {\n    const isNewTokenSet = !stateData.tokenSets.some(\n      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n    );\n\n    const tokenSets = isNewTokenSet\n      ? [...stateData.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)]\n      : stateData.tokenSets.map((tokenSet) =>\n          tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope\n            ? createUpdatedTokenSet(audience, tokenEndpointResponse)\n            : tokenSet\n        );\n\n    return {\n      ...stateData,\n      idToken: tokenEndpointResponse.idToken ?? stateData.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken ?? stateData.refreshToken,\n      tokenSets,\n      domain: context?.domain ?? stateData.domain,\n    };\n  } else {\n    const user = tokenEndpointResponse.claims;\n    return {\n      user,\n      idToken: tokenEndpointResponse.idToken,\n      refreshToken: tokenEndpointResponse.refreshToken,\n      tokenSets: [createUpdatedTokenSet(audience, tokenEndpointResponse)],\n      domain: context?.domain,\n      internal: {\n        sid: user?.sid as string,\n        createdAt: Math.floor(Date.now() / 1000),\n      },\n    };\n  }\n}\n\nexport function updateStateDataForConnectionTokenSet(\n  options: AccessTokenForConnectionOptions,\n  stateData: StateData,\n  tokenEndpointResponse: TokenResponse\n) {\n  stateData.connectionTokenSets = stateData.connectionTokenSets || [];\n\n  const isNewTokenSet = !stateData.connectionTokenSets.some(\n    (tokenSet) =>\n      tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n  );\n\n  const connectionTokenSet = {\n    connection: options.connection,\n    loginHint: options.loginHint,\n    accessToken: tokenEndpointResponse.accessToken,\n    scope: tokenEndpointResponse.scope,\n    expiresAt: tokenEndpointResponse.expiresAt,\n  };\n\n  const connectionTokenSets = isNewTokenSet\n    ? [...stateData.connectionTokenSets, connectionTokenSet]\n    : stateData.connectionTokenSets.map((tokenSet) =>\n        tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)\n          ? connectionTokenSet\n          : tokenSet\n      );\n\n  return {\n    ...stateData,\n    connectionTokenSets,\n  };\n}\n","import {\n  AccessTokenForConnectionOptions,\n  ConnectionTokenSet,\n  CustomTokenExchangeOptions,\n  DomainResolver,\n  LoginBackchannelOptions,\n  LoginBackchannelResult,\n  LoginWithCustomTokenExchangeOptions,\n  LoginWithCustomTokenExchangeResult,\n  LogoutOptions,\n  ServerClientOptions,\n  SessionData,\n  StartInteractiveLoginOptions,\n  StartLinkUserOptions,\n  StartUnlinkUserOptions,\n  StateData,\n  StateStore,\n  TokenSet,\n  TransactionData,\n  TransactionStore,\n} from './types.js';\nimport {\n  BackchannelLogoutError,\n  InvalidConfigurationError,\n  MissingRequiredArgumentError,\n  MissingSessionError,\n  MissingTransactionError,\n} from './errors.js';\nimport { updateStateData, updateStateDataForConnectionTokenSet } from './state/utils.js';\nimport {\n  TokenForConnectionError,\n  AuthClient,\n  AuthorizationDetails,\n  TokenByRefreshTokenError,\n  TokenResponse,\n} from '@auth0/auth0-auth-js';\nimport { compareScopes } from './utils.js';\nimport { decodeJwt } from 'jose';\nimport type { AuthClientOptions } from '@auth0/auth0-auth-js';\nimport { getTelemetryConfig } from './telemetry.js';\nimport { ServerMfaClient } from './mfa/server-mfa-client.js';\n\nconst DEFAULT_SCOPES = 'openid profile email offline_access';\n\nconst normalizeDomain = (value: string) => {\n  const trimmed = value.trim();\n  const parsed = trimmed.startsWith('http') ? new URL(trimmed) : new URL(`https://${trimmed}`);\n  return parsed.host.toLowerCase();\n};\n\nconst decodeIssuer = (token: string) => {\n  try {\n    const { iss } = decodeJwt(token);\n    return typeof iss === 'string' ? iss : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Ensures that the \"openid\" scope is always included in the scope string.\n *\n * @param scope - The scope provided by the user (optional)\n * @returns A scope string that includes \"openid\" if it was not already present.\n */\nconst ensureOpenIdScope = (scope?: string) => {\n  if (!scope) {\n    return DEFAULT_SCOPES;\n  }\n\n  const scopes = scope.split(' ');\n  if (!scopes.includes('openid')) {\n    scopes.unshift('openid');\n  }\n\n  return scopes.join(' ');\n};\n\nexport class ServerClient<TStoreOptions = unknown> {\n  readonly #options: ServerClientOptions<TStoreOptions>;\n  readonly #transactionStore: TransactionStore<TStoreOptions>;\n  readonly #transactionStoreIdentifier: string;\n  readonly #stateStore: StateStore<TStoreOptions>;\n  readonly #stateStoreIdentifier: string;\n  readonly #authClientOptions: Omit<AuthClientOptions, 'domain'>;\n  readonly #staticDomain?: string;\n  readonly #authClient?: AuthClient;\n  readonly #mfaClient?: ServerMfaClient<TStoreOptions>;\n\n  /**\n   * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.\n   * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.\n   *\n   * This property can only be used when `domain` is configured as a static string.\n   * In resolver mode (`domain` as a function), the SDK resolves the domain per request,\n   * so use `ServerClient` methods instead.\n   *\n   * Important: the methods exposed on the `authClient` instance do not handle any session or state management.\n   */\n  public get authClient(): AuthClient {\n    if (!this.#authClient) {\n      throw new InvalidConfigurationError('authClient is only available when using a static domain configuration.');\n    }\n    return this.#authClient;\n  }\n\n  /**\n   * The MFA client for managing multi-factor authentication operations.\n   *\n   * Provides methods to list, enroll, and challenge MFA authenticators,\n   * as well as verify MFA challenges to complete authentication.\n   *\n   * The `verify` method integrates with the session state store, persisting tokens\n   * and user data after successful MFA verification.\n   *\n   * This property can only be used when `domain` is configured as a static string.\n   * In resolver mode (`domain` as a function), MFA is not supported.\n   */\n  public get mfa(): ServerMfaClient<TStoreOptions> {\n    if (!this.#mfaClient) {\n      throw new InvalidConfigurationError('mfa is only available when using a static domain configuration.');\n    }\n    return this.#mfaClient;\n  }\n\n  constructor(options: ServerClientOptions<TStoreOptions>) {\n    this.#options = options;\n    this.#stateStoreIdentifier = this.#options.stateIdentifier || '__a0_session';\n    this.#transactionStoreIdentifier = this.#options.transactionIdentifier || '__a0_tx';\n    this.#transactionStore = options.transactionStore;\n    this.#stateStore = options.stateStore;\n\n    if (!this.#options.stateStore) {\n      throw new MissingRequiredArgumentError('stateStore');\n    }\n\n    if (!this.#options.transactionStore) {\n      throw new MissingRequiredArgumentError('transactionStore');\n    }\n\n    if (typeof this.#options.domain !== 'string' && typeof this.#options.domain !== 'function') {\n      throw new InvalidConfigurationError('domain must be a string or resolver function');\n    }\n\n    this.#authClientOptions = {\n      clientId: this.#options.clientId,\n      clientSecret: this.#options.clientSecret,\n      clientAssertionSigningKey: this.#options.clientAssertionSigningKey,\n      clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,\n      authorizationParams: this.#options.authorizationParams,\n      discoveryCache: this.#options.discoveryCache,\n      customFetch: this.#options.customFetch,\n      useMtls: this.#options.useMtls,\n    };\n\n    if (typeof this.#options.domain === 'string') {\n      const domain = normalizeDomain(this.#options.domain);\n      this.#staticDomain = domain;\n      this.#authClient = new AuthClient({\n        domain,\n        ...this.#authClientOptions,\n        telemetry: getTelemetryConfig(this.#options.telemetry),\n      });\n\n      this.#mfaClient = new ServerMfaClient({\n        authClient: this.#authClient,\n        domain,\n        stateStore: this.#stateStore,\n        stateStoreIdentifier: this.#stateStoreIdentifier,\n        defaultAudience: this.#options.authorizationParams?.audience ?? 'default',\n      });\n    }\n  }\n\n  async #resolveDomain(storeOptions?: TStoreOptions): Promise<string> {\n    if (typeof this.#options.domain === 'function') {\n      const resolved = await (this.#options.domain as DomainResolver<TStoreOptions>)(storeOptions);\n      if (typeof resolved !== 'string' || resolved.trim().length === 0) {\n        throw new InvalidConfigurationError('domainResolver returned no domain');\n      }\n      return normalizeDomain(resolved);\n    }\n\n    return normalizeDomain(this.#options.domain);\n  }\n\n  #createAuthClient(domain: string): AuthClient {\n    return new AuthClient({\n      domain,\n      ...this.#authClientOptions,\n      telemetry: getTelemetryConfig(this.#options.telemetry),\n    });\n  }\n\n  #getAuthClient(domain: string): AuthClient {\n    const normalizedDomain = normalizeDomain(domain);\n    if (this.#authClient && this.#staticDomain === normalizedDomain) {\n      return this.#authClient;\n    }\n    return this.#createAuthClient(normalizedDomain);\n  }\n\n  #getSessionDomain(stateData: StateData): string | undefined {\n    if (stateData.domain) {\n      return normalizeDomain(stateData.domain);\n    }\n\n    if (this.#staticDomain) {\n      return this.#staticDomain;\n    }\n\n    // Legacy sessions may not have `domain` persisted yet; infer it from ID token claims.\n    const issuerFromClaims = stateData.user?.iss;\n    if (typeof issuerFromClaims === 'string' && issuerFromClaims.trim().length > 0) {\n      return normalizeDomain(issuerFromClaims);\n    }\n\n    return;\n  }\n\n  #isResolverMode(): boolean {\n    return typeof this.#options.domain === 'function';\n  }\n\n  async #isSessionForCurrentDomain(stateData: StateData, storeOptions?: TStoreOptions): Promise<boolean> {\n    const sessionDomain = this.#getSessionDomain(stateData);\n    if (!sessionDomain) {\n      return false;\n    }\n    const resolvedDomain = await this.#resolveDomain(storeOptions);\n    return sessionDomain === resolvedDomain;\n  }\n\n  /**\n   * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Optional options used to configure the interactive login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startInteractiveLogin(options?: StartInteractiveLoginOptions, storeOptions?: TStoreOptions) {\n    const redirectUri = options?.authorizationParams?.redirect_uri ?? this.#options.authorizationParams?.redirect_uri;\n    if (!redirectUri) {\n      throw new MissingRequiredArgumentError('authorizationParams.redirect_uri');\n    }\n\n    const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);\n\n    const domain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(domain);\n    const { codeVerifier, authorizationUrl } = await authClient.buildAuthorizationUrl({\n      pushedAuthorizationRequests: options?.pushedAuthorizationRequests,\n      authorizationParams: {\n        ...options?.authorizationParams,\n        redirect_uri: redirectUri,\n        scope,\n      },\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n      domain,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return authorizationUrl;\n  }\n\n  /**\n   * Completes the interactive login process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).\n   */\n  public async completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    const transactionData = await this.#transactionStore.get(this.#transactionStoreIdentifier, storeOptions);\n\n    if (!transactionData) {\n      throw new MissingTransactionError();\n    }\n\n    const domain = transactionData.domain ?? (await this.#resolveDomain(storeOptions));\n    const authClient = this.#getAuthClient(domain);\n    const tokenEndpointResponse = await authClient.getTokenByCode(url, {\n      codeVerifier: transactionData.codeVerifier,\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const stateData = updateStateData(transactionData.audience ?? 'default', existingStateData, tokenEndpointResponse, {\n      domain,\n    });\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);\n\n    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails } as {\n      appState?: TAppState;\n      authorizationDetails?: AuthorizationDetails[];\n    };\n  }\n\n  /**\n   * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.\n   * @param options Options used to configure the user linking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startLinkUser(options: StartLinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process.'\n      );\n    }\n\n    if (this.#isResolverMode()) {\n      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n      if (!isCurrentDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const domain = this.#getSessionDomain(stateData)!;\n    const authClient = this.#getAuthClient(domain);\n    const { linkUserUrl, codeVerifier } = await authClient.buildLinkUserUrl({\n      connection: options.connection,\n      connectionScope: options.connectionScope,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n      domain,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return linkUserUrl;\n  }\n\n  /**\n   * Completes the user linking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeLinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user linking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Starts the user unlinking process, and returns a URL to redirect the user-agent to to initialize user unlinking at Auth0.\n   * @param options Options used to configure the user unlinking process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingSessionError} If there is no active session.\n   * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.\n   *\n   * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.\n   */\n  public async startUnlinkUser(options: StartUnlinkUserOptions, storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData || !stateData.idToken) {\n      throw new MissingSessionError(\n        'Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process.'\n      );\n    }\n\n    if (this.#isResolverMode()) {\n      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n      if (!isCurrentDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const domain = this.#getSessionDomain(stateData)!;\n    const authClient = this.#getAuthClient(domain);\n    const { unlinkUserUrl, codeVerifier } = await authClient.buildUnlinkUserUrl({\n      connection: options.connection,\n      idToken: stateData.idToken,\n      authorizationParams: options.authorizationParams,\n    });\n\n    const transactionState: TransactionData = {\n      audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,\n      codeVerifier,\n      domain,\n    };\n\n    if (options?.appState) {\n      transactionState.appState = options.appState;\n    }\n\n    await this.#transactionStore.set(this.#transactionStoreIdentifier, transactionState, false, storeOptions);\n\n    return unlinkUserUrl;\n  }\n\n  /**\n   * Completes the user unlinking process.\n   * Takes an URL, extract the Authorization Code flow query parameters and requests a token.\n   * @param url The URl from which the query params should be extracted to exchange for a token.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {MissingTransactionError} When no transaction was found.\n   * @throws {TokenByCodeError} If there was an issue requesting the access token.\n   *\n   * @returns A promise resolving to an object, containing the original appState (if present).\n   */\n  public async completeUnlinkUser<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions) {\n    // In order to complete the link user flow, we need to exchange the code for a token in the same\n    // way as we do for the interactive login flow.\n    const result = await this.completeInteractiveLogin<TAppState>(url, storeOptions);\n\n    // As we currently do not support RAR when starting the user unlinking flow, we will ommit it from being returned as optional altogether.\n    return {\n      appState: result.appState,\n    };\n  }\n\n  /**\n   * Logs in using Client-Initiated Backchannel Authentication.\n   *\n   * Using Client-Initiated Backchannel Authentication requires the feature to be enabled in the Auth0 dashboard.\n   * @see https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow\n   * @param options Options used to configure the backchannel login process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.\n   *\n   * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).\n   */\n  public async loginBackchannel(\n    options: LoginBackchannelOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginBackchannelResult> {\n    const scope = ensureOpenIdScope(options.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);\n    const domain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(domain);\n    const tokenEndpointResponse = await authClient.backchannelAuthentication({\n      bindingMessage: options.bindingMessage,\n      loginHint: options.loginHint,\n      authorizationParams: {\n        ...options.authorizationParams,\n        scope,\n      },\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse,\n      { domain }\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return {\n      authorizationDetails: tokenEndpointResponse.authorizationDetails,\n    };\n  }\n\n  /**\n   * Retrieves the user from the store, or undefined if no user found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The user, or undefined if no user found in the store.\n   */\n  public async getUser(storeOptions?: TStoreOptions) {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (!stateData) {\n      return;\n    }\n\n    if (this.#isResolverMode()) {\n      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n      if (!isCurrentDomain) {\n        return;\n      }\n    }\n\n    return stateData.user;\n  }\n\n  /**\n   * Retrieve the user session from the store, or undefined if no session found.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns The session or undefined if no session found in the store.\n   */\n  public async getSession(storeOptions?: TStoreOptions): Promise<SessionData | undefined> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    if (stateData) {\n      if (this.#isResolverMode()) {\n        const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);\n        if (!isCurrentDomain) {\n          return;\n        }\n      }\n\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { internal, ...sessionData } = stateData;\n      return sessionData;\n    }\n  }\n\n  /**\n   * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.\n   * Also updates the store when a new token was retrieved from Auth0.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token. When the cause is `mfa_required`, use `isMfaRequiredError(error)` to narrow the error and read `cause.mfa_token`.\n   *\n   * @returns The Token Set, containing the access token, as well as additional information.\n   */\n  public async getAccessToken(storeOptions?: TStoreOptions): Promise<TokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const audience = this.#options.authorizationParams?.audience ?? 'default';\n    const scope = this.#options.authorizationParams?.scope;\n\n    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;\n    if (this.#isResolverMode()) {\n      if (!stateData) {\n        throw new MissingSessionError('Unable to retrieve access token without a logged in user.');\n      }\n      if (!sessionDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n      const resolvedDomain = await this.#resolveDomain(storeOptions);\n      if (sessionDomain !== resolvedDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const tokenSet = stateData?.tokenSets.find(\n      (tokenSet) => tokenSet.audience === audience && (!scope || compareScopes(tokenSet.scope, scope))\n    );\n\n    if (tokenSet && tokenSet.expiresAt > Date.now() / 1000) {\n      return tokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenByRefreshTokenError(\n        'The access token has expired and a refresh token was not provided. The user needs to re-authenticate.'\n      );\n    }\n\n    const domainForSession = sessionDomain!;\n    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenByRefreshToken({\n      refreshToken: stateData.refreshToken,\n    });\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse, {\n      domain: domainForSession,\n    });\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      audience: audience,\n    };\n  }\n\n  /**\n   * Retrieves an access token for a connection.\n   *\n   * This method attempts to obtain an access token for a specified connection.\n   * It first checks if a refresh token exists in the store.\n   * If no refresh token is found, it throws an `AccessTokenForConnectionError` indicating\n   * that the refresh token was not found.\n   *\n   * @param options - Options for retrieving an access token for a connection.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {TokenForConnectionError} If the refresh token was not found or there was an issue requesting the access token.\n   *\n   * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.\n   */\n  public async getAccessTokenForConnection(\n    options: AccessTokenForConnectionOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<ConnectionTokenSet> {\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n\n    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;\n    if (this.#isResolverMode()) {\n      if (!stateData) {\n        throw new MissingSessionError('Unable to retrieve an access token for a connection without a logged in user.');\n      }\n      if (!sessionDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n      const resolvedDomain = await this.#resolveDomain(storeOptions);\n      if (sessionDomain !== resolvedDomain) {\n        throw new MissingSessionError('Session domain does not match the current domain.');\n      }\n    }\n\n    const connectionTokenSet = stateData?.connectionTokenSets?.find(\n      (tokenSet) => tokenSet.connection === options.connection\n    );\n\n    if (connectionTokenSet && connectionTokenSet.expiresAt > Date.now() / 1000) {\n      return connectionTokenSet;\n    }\n\n    if (!stateData?.refreshToken) {\n      throw new TokenForConnectionError(\n        'A refresh token was not found but is required to be able to retrieve an access token for a connection.'\n      );\n    }\n\n    const domainForSession = sessionDomain!;\n    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenForConnection({\n      connection: options.connection,\n      loginHint: options.loginHint,\n      refreshToken: stateData.refreshToken,\n    });\n\n    const updatedStateData = updateStateDataForConnectionTokenSet(\n      options,\n      {\n        ...stateData,\n        domain: stateData.domain ?? domainForSession,\n      },\n      tokenEndpointResponse\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);\n\n    return {\n      accessToken: tokenEndpointResponse.accessToken,\n      scope: tokenEndpointResponse.scope,\n      expiresAt: tokenEndpointResponse.expiresAt,\n      connection: options.connection,\n      loginHint: options.loginHint,\n    };\n  }\n\n  /**\n   * Logs the user out and returns a URL to redirect the user-agent to after they log out.\n   * @param options Options used to configure the logout process.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   * @returns {URL}\n   */\n  public async logout(options: LogoutOptions, storeOptions?: TStoreOptions) {\n    if (!this.#isResolverMode()) {\n      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n      return this.authClient.buildLogoutUrl(options);\n    }\n\n    const resolvedDomain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(resolvedDomain);\n    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : undefined;\n\n    if (!stateData) {\n      // No local session, still return a logout URL for the current domain.\n      return authClient.buildLogoutUrl(options);\n    }\n\n    if (sessionDomain && sessionDomain === resolvedDomain) {\n      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);\n    }\n\n    return authClient.buildLogoutUrl(options);\n  }\n\n  /**\n   * Exchanges a custom token for Auth0 tokens and persists the resulting session (RFC 8693).\n   *\n   * Calls the token endpoint using the RFC 8693 Token Exchange grant, then stores the\n   * resulting tokens in the StateStore — effectively logging the user in without an\n   * interactive browser flow. Use this when the caller already holds a trusted external\n   * token (e.g. a Google ID token, a legacy system token) and wants to establish an\n   * Auth0 session from it.\n   *\n   * Requires a Token Exchange Profile configured in your Auth0 tenant.\n   *\n   * @param options Options for the custom token exchange, including the subject token and its type.\n   * @param storeOptions Optional options passed to the StateStore.\n   *\n   * @throws {TokenExchangeError} If the exchange fails or the subject token is invalid.\n   * @throws {MissingClientAuthError} If client credentials are not configured.\n   *\n   * @returns A promise resolving to an object containing `authorizationDetails` when RAR was used.\n   */\n  public async loginWithCustomTokenExchange(\n    options: LoginWithCustomTokenExchangeOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<LoginWithCustomTokenExchangeResult> {\n    const domain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(domain);\n    const tokenEndpointResponse = await authClient.exchangeToken({\n      ...options,\n      scope: ensureOpenIdScope(options.scope),\n    });\n\n    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);\n    const stateData = updateStateData(\n      this.#options.authorizationParams?.audience ?? 'default',\n      existingStateData,\n      tokenEndpointResponse,\n      { domain }\n    );\n\n    await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);\n\n    return { authorizationDetails: tokenEndpointResponse.authorizationDetails };\n  }\n\n  /**\n   * Exchanges a custom token for Auth0 tokens without establishing a session (RFC 8693).\n   *\n   * Performs the same RFC 8693 Token Exchange as `loginWithCustomTokenExchange` but\n   * returns the raw token response without writing anything to the StateStore. Use this\n   * for delegation or impersonation flows where you need downstream tokens but do not\n   * want to create or modify the current user session.\n   *\n   * Requires a Token Exchange Profile configured in your Auth0 tenant.\n   *\n   * @param options Options for the custom token exchange, including the subject token and its type.\n   * @param storeOptions Optional options passed to the StateStore (used only for domain resolution in resolver mode).\n   *\n   * @throws {TokenExchangeError} If the exchange fails or the subject token is invalid.\n   * @throws {MissingClientAuthError} If client credentials are not configured.\n   *\n   * @returns A promise resolving to the token response from Auth0.\n   */\n  public async customTokenExchange(\n    options: CustomTokenExchangeOptions,\n    storeOptions?: TStoreOptions\n  ): Promise<TokenResponse> {\n    const domain = await this.#resolveDomain(storeOptions);\n    const authClient = this.#getAuthClient(domain);\n    return authClient.exchangeToken(options);\n  }\n\n  /**\n   * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.\n   * @param logoutToken The logout token to verify and use to delete the session from the store.\n   * @param storeOptions Optional options used to pass to the Transaction and State Store.\n   *\n   * @throws {BackchannelLogoutError} If the logout token is missing.\n   * @throws {VerifyLogoutTokenError} If the logout token is invalid.\n   */\n  public async handleBackchannelLogout(logoutToken: string, storeOptions?: TStoreOptions) {\n    if (!logoutToken) {\n      throw new BackchannelLogoutError('Missing Logout Token');\n    }\n\n    if (!this.#isResolverMode()) {\n      const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });\n      await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);\n      return;\n    }\n\n    const issuer = decodeIssuer(logoutToken);\n    if (!issuer) {\n      throw new BackchannelLogoutError('Logout token is missing an issuer');\n    }\n\n    const resolvedDomain = await this.#resolveDomain(storeOptions);\n    const domain = normalizeDomain(issuer);\n    if (domain !== resolvedDomain) {\n      throw new BackchannelLogoutError('Logout token issuer does not match the resolved domain');\n    }\n\n    const authClient = this.#getAuthClient(domain);\n    const logoutTokenClaims = await authClient.verifyLogoutToken({ logoutToken });\n\n    await this.#stateStore.deleteByLogoutToken({ ...logoutTokenClaims, iss: issuer }, storeOptions);\n  }\n}\n","/**\n * Compares two sets of scopes to determine if all required scopes are present in the provided scopes.\n * @param scopes Scopes to compare\n * @param requiredScopes Scopes required to be present in the scopes\n * @returns True if all required scopes are present in the scopes, false otherwise\n */\nexport const compareScopes = (scopes: string | undefined, requiredScopes: string | undefined) => {\n  // When the scopes and requiredScopes are exactly the same, return true\n  // This handles cases where both are empty or undefined or both are the same string\n  if (scopes === requiredScopes) {\n    return true;\n  }\n\n  if (!scopes || !requiredScopes) {\n    return false;\n  }\n\n  const scopesSet = new Set(scopes.trim().split(' ').filter(Boolean));\n  const requiredScopesArray = requiredScopes.trim().split(' ').filter(Boolean);\n\n  return requiredScopesArray.every((scope) => scopesSet.has(scope));\n};\n","import { TelemetryConfig } from '@auth0/auth0-auth-js';\n\n// These constants are injected at build time via tsup\ndeclare const __AUTH0_SERVER_JS_PACKAGE_NAME__: string;\ndeclare const __AUTH0_SERVER_JS_PACKAGE_VERSION__: string;\n\nexport function getTelemetryConfig(config?: TelemetryConfig): TelemetryConfig {\n  if (config?.enabled === false) {\n    return config;\n  }\n\n  return {\n    enabled: true,\n    name: config?.name ?? __AUTH0_SERVER_JS_PACKAGE_NAME__,\n    version: config?.version ?? __AUTH0_SERVER_JS_PACKAGE_VERSION__,\n  };\n}\n","import { updateStateData } from '../state/utils.js';\nimport type { ServerMfaClientOptions, MfaVerifyResponse } from './types.js';\nimport type {\n  ListAuthenticatorsOptions,\n  AuthenticatorResponse,\n  EnrollAuthenticatorOptions,\n  EnrollmentResponse,\n  ChallengeOptions,\n  ChallengeResponse,\n  MfaVerifyOptions,\n} from '@auth0/auth0-auth-js';\n\nexport class ServerMfaClient<TStoreOptions = unknown> {\n  readonly #options: ServerMfaClientOptions<TStoreOptions>;\n\n  /**\n   * @internal\n   */\n  constructor(options: ServerMfaClientOptions<TStoreOptions>) {\n    this.#options = options;\n  }\n\n  /**\n   * Lists all MFA authenticators enrolled by the user.\n   *\n   * @param options - Options for listing authenticators\n   * @returns Promise resolving to an array of enrolled authenticators\n   * @throws {MfaListAuthenticatorsError} When the request fails\n   */\n  async listAuthenticators(options: ListAuthenticatorsOptions): Promise<AuthenticatorResponse[]> {\n    return this.#options.authClient.mfa.listAuthenticators(options);\n  }\n\n  /**\n   * Enrolls a new MFA authenticator for the user.\n   *\n   * @param options - Enrollment options\n   * @returns Promise resolving to enrollment response with authenticator details\n   * @throws {MfaEnrollmentError} When enrollment fails\n   */\n  async enrollAuthenticator(options: EnrollAuthenticatorOptions): Promise<EnrollmentResponse> {\n    return this.#options.authClient.mfa.enrollAuthenticator(options);\n  }\n\n  /**\n   * Initiates an MFA challenge for user verification.\n   *\n   * @param options - Challenge options\n   * @returns Promise resolving to challenge response with challenge details\n   * @throws {MfaChallengeError} When the challenge fails\n   */\n  async challengeAuthenticator(options: ChallengeOptions): Promise<ChallengeResponse> {\n    return this.#options.authClient.mfa.challengeAuthenticator(options);\n  }\n\n  /**\n   * Verifies an MFA challenge and completes the authentication flow.\n   *\n   * Exchanges the MFA token and verification code for access, ID, and refresh tokens,\n   * then saves them into the user's session automatically.\n   *\n   * @param options - The MFA token, factor type (otp / oob / recovery-code), and the code to verify\n   * @param storeOptions - Optional options forwarded to the session store. Can be omitted when\n   *   using the built-in stores; required if your custom store needs extra context (e.g. a request object).\n   * @returns The tokens returned by Auth0 after successful verification\n   * @throws {MfaVerifyError} When verification fails (e.g. invalid token, wrong code)\n   */\n  async verify(options: MfaVerifyOptions, storeOptions?: TStoreOptions): Promise<MfaVerifyResponse> {\n    const tokenResponse = await this.#options.authClient.mfa.verify(options);\n\n    const audience = options.audience ?? this.#options.defaultAudience;\n    const existingStateData = await this.#options.stateStore.get(\n      this.#options.stateStoreIdentifier,\n      storeOptions\n    );\n\n    const updatedStateData = updateStateData(audience, existingStateData, tokenResponse, {\n      domain: this.#options.domain,\n    });\n\n    await this.#options.stateStore.set(\n      this.#options.stateStoreIdentifier,\n      updatedStateData,\n      true,\n      storeOptions\n    );\n\n    const result: MfaVerifyResponse = {\n      accessToken: tokenResponse.accessToken,\n      tokenType: tokenResponse.tokenType ?? 'bearer',\n      expiresAt: tokenResponse.expiresAt,\n      scope: tokenResponse.scope,\n    };\n\n    if (tokenResponse.idToken) result.idToken = tokenResponse.idToken;\n    if (tokenResponse.refreshToken) result.refreshToken = tokenResponse.refreshToken;\n    if (tokenResponse.recoveryCode) result.recoveryCode = tokenResponse.recoveryCode;\n\n    return result;\n  }\n}\n","import { EncryptJWT, jwtDecrypt, errors } from 'jose';\nimport type { JWTPayload } from 'jose';\nimport { InvalidConfigurationError } from '../errors.js';\n\nconst ENC = 'A256CBC-HS512';\nconst ALG = 'dir';\nconst DIGEST = 'SHA-256';\nconst BIT_LENGTH = 512;\nconst HKDF_INFO = 'derived cookie encryption secret';\n\nlet encoder: TextEncoder | undefined;\n\n/**\n * Type guard to determine if an error is a decryption-related error.\n * Decryption errors (JWEDecryptionFailed, JWEInvalid) indicate issues with the encryption key or data format.\n * These are distinct from claim validation errors (like expiration), which indicate a valid token with invalid claims.\n * @param e - The error thrown during decryption\n * @returns True if the error is a decryption error, false otherwise\n */\nexport function isDecryptionError(e: unknown): e is Error {\n  return e instanceof errors.JWEDecryptionFailed || e instanceof errors.JWEInvalid;\n}\n\nasync function deriveEncryptionSecret(secret: string, salt: string, kid: string) {\n  encoder ||= new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);\n\n  return new Uint8Array(\n    await crypto.subtle.deriveBits(\n      {\n        name: 'HKDF',\n        hash: DIGEST,\n        info: encoder.encode(HKDF_INFO),\n        salt: encoder.encode(`${salt}${kid}`),\n      } as HkdfParams,\n      key,\n      BIT_LENGTH\n    )\n  );\n}\n\n/**\n * Encrypts a payload using the provided secret and salt, with an expiration time.\n * @param payload The payload to encrypt.\n * @param secret The secret to use for encryption.\n * @param salt The salt to use for encryption.\n * @param expiration The expiration time for the encrypted payload.\n * @returns The encrypted payload.\n */\nasync function _encrypt(payload: JWTPayload, secret: string, salt: string, expiration: number) {\n  const kid = crypto.randomUUID();\n  const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);\n\n  return await new EncryptJWT(payload)\n    .setProtectedHeader({ enc: ENC, alg: ALG, kid: kid })\n    .setExpirationTime(expiration)\n    .encrypt(encryptionSecret);\n}\n\n/**\n * Encrypts a payload using the provided secret and salt, with an expiration time.\n * The secret can be a single string or an array of strings for secret rotation support.\n * When using an array of secrets, only the first one is used for encryption (all secrets are tried for decryption).\n * @param payload The payload to encrypt.\n * @param secret The secret(s) to use for encryption. Can be a single string or an array of strings for secret rotation support.\n * @param salt The salt to use for encryption.\n * @param expiration The expiration time for the encrypted payload.\n * @returns The encrypted payload.\n */\nexport async function encrypt(payload: JWTPayload, secret: string | string[], salt: string, expiration: number) {\n  if (typeof secret === 'string') {\n    return await _encrypt(payload, secret, salt, expiration);\n  } else {\n    // For encryption, we only use the newest secret, as the old secrets are only used for backward compatibility during decryption.\n    const [newSecret] = secret;\n\n    if (!newSecret) {\n      throw new InvalidConfigurationError('At least one secret must be provided');\n    }\n\n    return await _encrypt(payload, newSecret, salt, expiration);\n  }\n}\n\n/**\n * Decrypts an encrypted payload using the provided secret(s) and salt.\n * @param value The encrypted payload to decrypt.\n * @param secret The secret to use for decryption.\n * @param salt The salt to use for decryption.\n * @returns The decrypted payload.\n */\nexport async function _decrypt<T>(value: string, secret: string, salt: string) {\n  const res = await jwtDecrypt<T>(\n    value,\n    async (protectedHeader) => {\n      // This error shouldn't happen, as we always set a kid.\n      // However, leaving this here as a safety net.\n      if (!protectedHeader.kid) {\n        throw new Error('Missing \"kid\" in JWE header');\n      }\n\n      return await deriveEncryptionSecret(secret, salt, protectedHeader.kid);\n    },\n    { clockTolerance: 15 }\n  );\n  return res.payload;\n}\n\n/**\n * Decrypts an encrypted payload using the provided secret(s) and salt.\n * The secret can be a single string or an array of strings for secret rotation support.\n * When using an array of secrets, the function will try to decrypt with each secret in order until it succeeds or exhausts all options.\n * Only decryption-related errors (JWEDecryptionFailed, JWEInvalid) will trigger fallback to old secrets.\n * Other errors (like expiration) will be thrown immediately.\n * @param value The encrypted payload to decrypt.\n * @param secret The secret(s) to use for decryption. Can be a single string or an array of strings for secret rotation support.\n * @param salt The salt to use for decryption.\n * @returns The decrypted payload.\n */\nexport async function decrypt<T>(value: string, secret: string | string[], salt: string) {\n  if (typeof secret === 'string') {\n    return await _decrypt<T>(value, secret, salt);\n  } else {\n    const [newSecret, ...oldSecrets] = secret;\n\n    if (!newSecret) {\n      throw new InvalidConfigurationError('At least one secret must be provided');\n    }\n\n    let firstError: Error | undefined;\n\n    try {\n      return await _decrypt<T>(value, newSecret, salt);\n    } catch (err) {\n      firstError = err as Error;\n\n      // Only try old secrets if this is a decryption-related error\n      // Other errors (like expiration) should be thrown immediately\n      if (!isDecryptionError(err)) {\n        throw firstError;\n      }\n\n      for (const oldSecret of oldSecrets) {\n        try {\n          return await _decrypt(value, oldSecret, salt);\n        } catch (fallbackErr) {\n          // Only ignore decryption errors with old secrets and continue trying with the next one\n          // If it's a different type of error, throw it\n          if (!isDecryptionError(fallbackErr)) {\n            throw fallbackErr;\n          }\n        }\n      }\n\n      // If we've exhausted all secrets and still can't decrypt, throw the original error.\n      throw firstError;\n    }\n  }\n}\n","import type { EncryptedStoreOptions, AbstractDataStore } from '../types.js';\nimport { encrypt, decrypt, isDecryptionError } from '../encryption/index.js';\nimport { JWTPayload } from 'jose';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStore<TData extends JWTPayload, TStoreOptions = unknown> implements AbstractDataStore<TData, TStoreOptions>\n{\n  protected readonly options: EncryptedStoreOptions;\n\n  constructor(options: EncryptedStoreOptions) {\n    this.options = options;\n  }\n\n  abstract set(identifier: string, state: TData, removeIfExists?: boolean, options?: TStoreOptions | undefined): Promise<void>;\n  abstract get(identifier: string, options?: TStoreOptions | undefined): Promise<TData | undefined>;\n  abstract delete(identifier: string, options?: TStoreOptions | undefined): Promise<void>;\n\n  protected async encrypt<TData extends JWTPayload>(identifier: string, stateData: TData, expiration: number) {\n    return await encrypt(stateData, this.options.secret, identifier, expiration);\n  }\n\n  protected async decrypt<TData>(identifier: string, encryptedStateData: string) {\n    try {\n      return (await decrypt(encryptedStateData, this.options.secret, identifier)) as TData;\n    } catch (e: unknown){\n      // When the error is a decryption failure, we want to ignore it and return undefined, as this likely means the session has expired or the data is invalid.\n      if (isDecryptionError(e)) {\n        return;\n      }\n\n      throw e;\n    }\n  }\n}\n","import type { StateData, EncryptedStoreOptions, StateStore, LogoutTokenClaims } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT State Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractStateStore<TStoreOptions = unknown> extends AbstractStore<StateData, TStoreOptions> implements StateStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n\n  abstract deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void>;\n}","import type { EncryptedStoreOptions, TransactionData, TransactionStore } from '../types.js';\nimport { AbstractStore } from './abstract-store.js';\n\n/**\n * Abstract class that can be used to implement an Encrypted JWT Transaction Store, using the 'A256CBC-HS512' encryption algorithm.\n */\nexport abstract class AbstractTransactionStore<TStoreOptions = unknown> extends AbstractStore<TransactionData, TStoreOptions> implements TransactionStore<TStoreOptions> {\n  constructor(options: EncryptedStoreOptions) {\n    super(options);\n  }\n}","export { ServerClient } from './server-client.js';\nexport { AbstractStateStore } from './store/abstract-state-store.js';\nexport { AbstractTransactionStore } from './store/abstract-transaction-store.js';\nexport type { TokenResponse, ActClaim } from '@auth0/auth0-auth-js';\nexport { TokenExchangeError, MissingClientAuthError } from '@auth0/auth0-auth-js';\n\nexport type { CookieHandler, CookieSerializeOptions } from './store/cookie-handler.js';\nexport { CookieTransactionStore } from './store/cookie-transaction-store.js';\n\nexport { StatefulStateStore } from './store/stateful-state-store.js';\nexport type { StatefulStateStoreOptions } from './store/stateful-state-store.js';\nexport { StatelessStateStore } from './store/stateless-state-store.js';\n\nexport * from './errors.js';\nexport * from './types.js';\nexport * from './mfa/index.js';\n","import type { EncryptedStoreOptions, TransactionData } from './../types.js';\nimport { AbstractTransactionStore } from './abstract-transaction-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class CookieTransactionStore<TStoreOptions> extends AbstractTransactionStore<TStoreOptions> {\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    transactionData: TransactionData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions\n  ): Promise<void> {   \n    const maxAge = 60 * 60;\n    const cookieOpts: CookieSerializeOptions = { httpOnly: true, sameSite: 'lax', path: '/', maxAge };\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, transactionData, expiration);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions): Promise<TransactionData | undefined> {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n\n    if (cookieValue) {\n      return await this.decrypt(identifier, cookieValue);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    this.#cookieHandler.deleteCookie(identifier, options);\n  }\n}\n","import { AbstractStateStore } from './abstract-state-store.js';\nimport type { EncryptedStoreOptions, SessionConfiguration } from '../types.js';\n\nexport abstract class AbstractSessionStore<TStoreOptions> extends AbstractStateStore<TStoreOptions> {\n  readonly #rolling: boolean;\n  readonly #absoluteDuration: number;\n  readonly #inactivityDuration: number;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions) {\n    super(options);\n\n    this.#rolling = options.rolling ?? true;\n    this.#absoluteDuration = options.absoluteDuration ?? 60 * 60 * 24 * 3;\n    this.#inactivityDuration = options.inactivityDuration ?? 60 * 60 * 24 * 1;\n  }\n\n  /**\n   * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.\n   */\n  protected calculateMaxAge(createdAt: number) {\n    if (!this.#rolling) {\n      return this.#absoluteDuration;\n    }\n\n    const now = (Date.now() / 1000) | 0;\n    const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);\n    const maxAge = expiresAt - now;\n\n    return maxAge > 0 ? maxAge : 0;\n  }\n}","import type {\n  EncryptedStoreOptions,\n  LogoutTokenClaims,\n  SessionConfiguration,\n  SessionCookieOptions,\n  SessionStore,\n  StateData,\n} from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {\n  store: SessionStore<TStoreOptions>;\n}\n\nconst generateId = () => {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n};\n\nexport class StatefulStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #store: SessionStore<TStoreOptions>;\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(\n    options: StatefulStateStoreOptions<TStoreOptions> & SessionConfiguration,\n    cookieHandler: CookieHandler<TStoreOptions>\n  ) {\n    super(options);\n\n    this.#store = options.store;\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    let sessionId = await this.getSessionId(identifier, options);\n\n    // if this is a new session created by a new login we need to remove the old session\n    // from the store and regenerate the session ID to prevent session fixation.\n    if (sessionId && removeIfExists) {\n      await this.#store.delete(sessionId);\n      sessionId = generateId();\n    }\n\n    sessionId ??= generateId();\n\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Date.now() / 1000 + maxAge;\n    const encryptedStateData = await this.encrypt<{ id: string }>(\n      identifier,\n      {\n        id: sessionId,\n      },\n      expiration\n    );\n\n    await this.#store.set(sessionId, stateData);\n\n    this.#cookieHandler.setCookie(identifier, encryptedStateData, cookieOpts, options);\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      const stateData = await this.#store.get(sessionId);\n\n      // If we have a session cookie, but no `stateData`, we should remove the cookie.\n      if (!stateData) {\n        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n      }\n\n      return stateData;\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const sessionId = await this.getSessionId(identifier, options);\n\n    if (sessionId) {\n      await this.#store.delete(sessionId);\n    }\n\n    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());\n  }\n\n  private async getSessionId(identifier: string, options?: TStoreOptions) {\n    const cookieValue = this.#cookieHandler.getCookie(identifier, options);\n    if (cookieValue) {\n      const sessionCookie = await this.decrypt<{ id: string }>(identifier, cookieValue);\n      \n      if (sessionCookie) {\n        return sessionCookie.id;\n      }\n    }\n  }\n\n  deleteByLogoutToken(claims: LogoutTokenClaims, options?: TStoreOptions | undefined): Promise<void> {\n    return this.#store.deleteByLogoutToken(claims, options);\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n","import type { EncryptedStoreOptions, SessionConfiguration, SessionCookieOptions, StateData } from '../types.js';\nimport { AbstractSessionStore } from './abstract-session-store.js';\nimport type { CookieHandler, CookieSerializeOptions } from './cookie-handler.js';\n\nexport class StatelessStateStore<TStoreOptions> extends AbstractSessionStore<TStoreOptions> {\n  readonly #cookieOptions: SessionCookieOptions | undefined;\n  readonly #cookieHandler: CookieHandler<TStoreOptions>;\n\n  constructor(options: SessionConfiguration & EncryptedStoreOptions, cookieHandler: CookieHandler<TStoreOptions>) {\n    super(options);\n\n    this.#cookieOptions = options.cookie;\n    this.#cookieHandler = cookieHandler;\n  }\n\n  async set(\n    identifier: string,\n    stateData: StateData,\n    removeIfExists?: boolean,\n    options?: TStoreOptions | undefined\n  ): Promise<void> {\n    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);\n    const cookieOpts = this.#getCookieOptions({\n      maxAge,\n    });\n    const expiration = Math.floor(Date.now() / 1000 + maxAge);\n    const encryptedStateData = await this.encrypt(identifier, stateData, expiration);\n\n    const chunkSize = 3072;\n    const chunkCount = Math.ceil(encryptedStateData.length / chunkSize);\n    const chunks = [...Array(chunkCount).keys()].map((i) => ({\n      value: encryptedStateData.substring(i * chunkSize, (i + 1) * chunkSize),\n      name: `${identifier}.${i}`,\n    }));\n\n    chunks.forEach((chunk) => {\n      this.#cookieHandler.setCookie(chunk.name, chunk.value, cookieOpts, options);\n    });\n\n    const existingCookieKeys = this.getCookieKeys(identifier, options);\n    const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));\n    cookieKeysToRemove.forEach((key) => {\n      this.#cookieHandler.deleteCookie(key, options, cookieOpts);\n    });\n  }\n\n  async get(identifier: string, options?: TStoreOptions | undefined): Promise<StateData | undefined> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    const encryptedStateData = cookieKeys\n      .map((key) => ({\n        index: parseInt(key.split('.')[1] as string, 10),\n        value: this.#cookieHandler.getCookie(key, options),\n      }))\n      .sort((a, b) => a.index - b.index)\n      .map((item) => item.value)\n      .join('');\n\n    if (encryptedStateData) {\n      return await this.decrypt(identifier, encryptedStateData);\n    }\n  }\n\n  async delete(identifier: string, options?: TStoreOptions | undefined): Promise<void> {\n    const cookieKeys = this.getCookieKeys(identifier, options);\n    for (const key of cookieKeys) {\n      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());\n    }\n  }\n\n  deleteByLogoutToken(): Promise<void> {\n    throw new Error(\n      'Backchannel logout is not available when using Stateless Storage. Use Stateful Storage by providing a `sessionStore`'\n    );\n  }\n\n  private getCookieKeys(identifier: string, options?: TStoreOptions): string[] {\n    return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));\n  }\n\n  #getCookieOptions(partial?: Partial<CookieSerializeOptions>): CookieSerializeOptions {\n    return {\n      httpOnly: true,\n      sameSite: this.#cookieOptions?.sameSite ?? 'lax',\n      path: this.#cookieOptions?.path ?? '/',\n      secure: this.#cookieOptions?.secure ?? true,\n      ...partial,\n    };\n  }\n}\n","export { ServerMfaClient } from './server-mfa-client.js';\nexport type { MfaVerifyResponse } from './types.js';\nexport type {\n  MfaFactorType,\n  MfaVerifyOtpOptions,\n  MfaVerifyOobOptions,\n  MfaVerifyRecoveryCodeOptions,\n  MfaVerifyOptions,\n} from '@auth0/auth0-auth-js';\n\n// Re-export MFA types and errors from auth0-auth-js for convenience\nexport type {\n  AuthenticatorResponse,\n  AuthenticatorType,\n  OobChannel,\n  ListAuthenticatorsOptions,\n  EnrollOtpOptions,\n  EnrollOobOptions,\n  EnrollEmailOptions,\n  EnrollAuthenticatorOptions,\n  OtpEnrollmentResponse,\n  OobEnrollmentResponse,\n  EnrollmentResponse,\n  ChallengeOptions,\n  ChallengeResponse,\n  MfaRequirements,\n} from '@auth0/auth0-auth-js';\n\nexport {\n  MfaListAuthenticatorsError,\n  MfaEnrollmentError,\n  MfaChallengeError,\n  MfaVerifyError,\n  isMfaRequiredError,\n} from '@auth0/auth0-auth-js';\n"],"mappings":";AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC1C,OAAe;AAAA,EAEtB,YAAY,SAAkB;AAC5B,UAAM,WAAW,6BAA6B;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACzC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC/C,OAAe;AAAA,EAEtB,YAAY,UAAkB;AAC5B,UAAM,iBAAiB,QAAQ,qCAAqC;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACtC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC5C,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EACxC,OAAe;AAAA,EAEtB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;AC1EA,IAAM,wBAAwB,CAAC,UAAkB,cAA6B;AAAA,EAC5E;AAAA,EACA,aAAa,SAAS;AAAA,EACtB,OAAO,SAAS;AAAA,EAChB,WAAW,SAAS;AACtB;AASO,SAAS,gBACd,UACA,WACA,uBACA,SACW;AAIX,MAAI,aAAa,sBAAsB,QAAQ;AAC7C,UAAM,SAAS,sBAAsB,OAAO;AAC5C,UAAM,SAAS,sBAAsB,OAAO;AAC5C,UAAM,cAAc,UAAU,MAAM;AACpC,UAAM,cAAc,UAAU,MAAM;AAEpC,UAAM,cAAc,WAAW,UAAa,gBAAgB,UAAa,WAAW;AACpF,UAAM,cAAc,WAAW,UAAa,gBAAgB,UAAa,WAAW;AAEpF,QAAI,eAAe,aAAa;AAC9B,kBAAY;AAAA,IACd;AAAA,EACF;AAEA,MAAI,WAAW;AACb,UAAM,gBAAgB,CAAC,UAAU,UAAU;AAAA,MACzC,CAAC,aAAa,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB;AAAA,IAC3F;AAEA,UAAM,YAAY,gBACd,CAAC,GAAG,UAAU,WAAW,sBAAsB,UAAU,qBAAqB,CAAC,IAC/E,UAAU,UAAU;AAAA,MAAI,CAAC,aACvB,SAAS,aAAa,YAAY,SAAS,UAAU,sBAAsB,QACvE,sBAAsB,UAAU,qBAAqB,IACrD;AAAA,IACN;AAEJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,sBAAsB,WAAW,UAAU;AAAA,MACpD,cAAc,sBAAsB,gBAAgB,UAAU;AAAA,MAC9D;AAAA,MACA,QAAQ,SAAS,UAAU,UAAU;AAAA,IACvC;AAAA,EACF,OAAO;AACL,UAAM,OAAO,sBAAsB;AACnC,WAAO;AAAA,MACL;AAAA,MACA,SAAS,sBAAsB;AAAA,MAC/B,cAAc,sBAAsB;AAAA,MACpC,WAAW,CAAC,sBAAsB,UAAU,qBAAqB,CAAC;AAAA,MAClE,QAAQ,SAAS;AAAA,MACjB,UAAU;AAAA,QACR,KAAK,MAAM;AAAA,QACX,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCACd,SACA,WACA,uBACA;AACA,YAAU,sBAAsB,UAAU,uBAAuB,CAAC;AAElE,QAAM,gBAAgB,CAAC,UAAU,oBAAoB;AAAA,IACnD,CAAC,aACC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ;AAAA,EACxG;AAEA,QAAM,qBAAqB;AAAA,IACzB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,sBAAsB;AAAA,IACnC,OAAO,sBAAsB;AAAA,IAC7B,WAAW,sBAAsB;AAAA,EACnC;AAEA,QAAM,sBAAsB,gBACxB,CAAC,GAAG,UAAU,qBAAqB,kBAAkB,IACrD,UAAU,oBAAoB;AAAA,IAAI,CAAC,aACjC,SAAS,eAAe,QAAQ,eAAe,CAAC,QAAQ,aAAa,SAAS,cAAc,QAAQ,aAChG,qBACA;AAAA,EACN;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;;;ACrFA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OAEK;;;AC7BA,IAAM,gBAAgB,CAAC,QAA4B,mBAAuC;AAG/F,MAAI,WAAW,gBAAgB;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC;AAClE,QAAM,sBAAsB,eAAe,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3E,SAAO,oBAAoB,MAAM,CAAC,UAAU,UAAU,IAAI,KAAK,CAAC;AAClE;;;ADgBA,SAAS,iBAAiB;;;AE/BnB,SAAS,mBAAmB,QAA2C;AAC5E,MAAI,QAAQ,YAAY,OAAO;AAC7B,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM,QAAQ,QAAQ;AAAA,IACtB,SAAS,QAAQ,WAAW;AAAA,EAC9B;AACF;;;ACJO,IAAM,kBAAN,MAA+C;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKT,YAAY,SAAgD;AAC1D,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,mBAAmB,SAAsE;AAC7F,WAAO,KAAK,SAAS,WAAW,IAAI,mBAAmB,OAAO;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,oBAAoB,SAAkE;AAC1F,WAAO,KAAK,SAAS,WAAW,IAAI,oBAAoB,OAAO;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK,SAAS,WAAW,IAAI,uBAAuB,OAAO;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,OAAO,SAA2B,cAA0D;AAChG,UAAM,gBAAgB,MAAM,KAAK,SAAS,WAAW,IAAI,OAAO,OAAO;AAEvE,UAAM,WAAW,QAAQ,YAAY,KAAK,SAAS;AACnD,UAAM,oBAAoB,MAAM,KAAK,SAAS,WAAW;AAAA,MACvD,KAAK,SAAS;AAAA,MACd;AAAA,IACF;AAEA,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,eAAe;AAAA,MACnF,QAAQ,KAAK,SAAS;AAAA,IACxB,CAAC;AAED,UAAM,KAAK,SAAS,WAAW;AAAA,MAC7B,KAAK,SAAS;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,SAA4B;AAAA,MAChC,aAAa,cAAc;AAAA,MAC3B,WAAW,cAAc,aAAa;AAAA,MACtC,WAAW,cAAc;AAAA,MACzB,OAAO,cAAc;AAAA,IACvB;AAEA,QAAI,cAAc,QAAS,QAAO,UAAU,cAAc;AAC1D,QAAI,cAAc,aAAc,QAAO,eAAe,cAAc;AACpE,QAAI,cAAc,aAAc,QAAO,eAAe,cAAc;AAEpE,WAAO;AAAA,EACT;AACF;;;AH1DA,IAAM,iBAAiB;AAEvB,IAAM,kBAAkB,CAAC,UAAkB;AACzC,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,SAAS,QAAQ,WAAW,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,OAAO,EAAE;AAC3F,SAAO,OAAO,KAAK,YAAY;AACjC;AAEA,IAAM,eAAe,CAAC,UAAkB;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,UAAU,KAAK;AAC/B,WAAO,OAAO,QAAQ,WAAW,MAAM;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,IAAM,oBAAoB,CAAC,UAAmB;AAC5C,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,MAAM,MAAM,GAAG;AAC9B,MAAI,CAAC,OAAO,SAAS,QAAQ,GAAG;AAC9B,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,SAAO,OAAO,KAAK,GAAG;AACxB;AAEO,IAAM,eAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYT,IAAW,aAAyB;AAClC,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI,0BAA0B,wEAAwE;AAAA,IAC9G;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,IAAW,MAAsC;AAC/C,QAAI,CAAC,KAAK,YAAY;AACpB,YAAM,IAAI,0BAA0B,iEAAiE;AAAA,IACvG;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,YAAY,SAA6C;AACvD,SAAK,WAAW;AAChB,SAAK,wBAAwB,KAAK,SAAS,mBAAmB;AAC9D,SAAK,8BAA8B,KAAK,SAAS,yBAAyB;AAC1E,SAAK,oBAAoB,QAAQ;AACjC,SAAK,cAAc,QAAQ;AAE3B,QAAI,CAAC,KAAK,SAAS,YAAY;AAC7B,YAAM,IAAI,6BAA6B,YAAY;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS,kBAAkB;AACnC,YAAM,IAAI,6BAA6B,kBAAkB;AAAA,IAC3D;AAEA,QAAI,OAAO,KAAK,SAAS,WAAW,YAAY,OAAO,KAAK,SAAS,WAAW,YAAY;AAC1F,YAAM,IAAI,0BAA0B,8CAA8C;AAAA,IACpF;AAEA,SAAK,qBAAqB;AAAA,MACxB,UAAU,KAAK,SAAS;AAAA,MACxB,cAAc,KAAK,SAAS;AAAA,MAC5B,2BAA2B,KAAK,SAAS;AAAA,MACzC,2BAA2B,KAAK,SAAS;AAAA,MACzC,qBAAqB,KAAK,SAAS;AAAA,MACnC,gBAAgB,KAAK,SAAS;AAAA,MAC9B,aAAa,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,SAAS;AAAA,IACzB;AAEA,QAAI,OAAO,KAAK,SAAS,WAAW,UAAU;AAC5C,YAAM,SAAS,gBAAgB,KAAK,SAAS,MAAM;AACnD,WAAK,gBAAgB;AACrB,WAAK,cAAc,IAAI,WAAW;AAAA,QAChC;AAAA,QACA,GAAG,KAAK;AAAA,QACR,WAAW,mBAAmB,KAAK,SAAS,SAAS;AAAA,MACvD,CAAC;AAED,WAAK,aAAa,IAAI,gBAAgB;AAAA,QACpC,YAAY,KAAK;AAAA,QACjB;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,sBAAsB,KAAK;AAAA,QAC3B,iBAAiB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAClE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,cAA+C;AAClE,QAAI,OAAO,KAAK,SAAS,WAAW,YAAY;AAC9C,YAAM,WAAW,MAAO,KAAK,SAAS,OAAyC,YAAY;AAC3F,UAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,WAAW,GAAG;AAChE,cAAM,IAAI,0BAA0B,mCAAmC;AAAA,MACzE;AACA,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAEA,WAAO,gBAAgB,KAAK,SAAS,MAAM;AAAA,EAC7C;AAAA,EAEA,kBAAkB,QAA4B;AAC5C,WAAO,IAAI,WAAW;AAAA,MACpB;AAAA,MACA,GAAG,KAAK;AAAA,MACR,WAAW,mBAAmB,KAAK,SAAS,SAAS;AAAA,IACvD,CAAC;AAAA,EACH;AAAA,EAEA,eAAe,QAA4B;AACzC,UAAM,mBAAmB,gBAAgB,MAAM;AAC/C,QAAI,KAAK,eAAe,KAAK,kBAAkB,kBAAkB;AAC/D,aAAO,KAAK;AAAA,IACd;AACA,WAAO,KAAK,kBAAkB,gBAAgB;AAAA,EAChD;AAAA,EAEA,kBAAkB,WAA0C;AAC1D,QAAI,UAAU,QAAQ;AACpB,aAAO,gBAAgB,UAAU,MAAM;AAAA,IACzC;AAEA,QAAI,KAAK,eAAe;AACtB,aAAO,KAAK;AAAA,IACd;AAGA,UAAM,mBAAmB,UAAU,MAAM;AACzC,QAAI,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,GAAG;AAC9E,aAAO,gBAAgB,gBAAgB;AAAA,IACzC;AAEA;AAAA,EACF;AAAA,EAEA,kBAA2B;AACzB,WAAO,OAAO,KAAK,SAAS,WAAW;AAAA,EACzC;AAAA,EAEA,MAAM,2BAA2B,WAAsB,cAAgD;AACrG,UAAM,gBAAgB,KAAK,kBAAkB,SAAS;AACtD,QAAI,CAAC,eAAe;AAClB,aAAO;AAAA,IACT;AACA,UAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,WAAO,kBAAkB;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,sBAAsB,SAAwC,cAA8B;AACvG,UAAM,cAAc,SAAS,qBAAqB,gBAAgB,KAAK,SAAS,qBAAqB;AACrG,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,6BAA6B,kCAAkC;AAAA,IAC3E;AAEA,UAAM,QAAQ,kBAAkB,SAAS,qBAAqB,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAE/G,UAAM,SAAS,MAAM,KAAK,eAAe,YAAY;AACrD,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,EAAE,cAAc,iBAAiB,IAAI,MAAM,WAAW,sBAAsB;AAAA,MAChF,6BAA6B,SAAS;AAAA,MACtC,qBAAqB;AAAA,QACnB,GAAG,SAAS;AAAA,QACZ,cAAc;AAAA,QACd;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,yBAA8C,KAAU,cAA8B;AACjG,UAAM,kBAAkB,MAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,YAAY;AAEvG,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,wBAAwB;AAAA,IACpC;AAEA,UAAM,SAAS,gBAAgB,UAAW,MAAM,KAAK,eAAe,YAAY;AAChF,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,wBAAwB,MAAM,WAAW,eAAe,KAAK;AAAA,MACjE,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,YAAY,gBAAgB,gBAAgB,YAAY,WAAW,mBAAmB,uBAAuB;AAAA,MACjH;AAAA,IACF,CAAC;AAED,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AACpF,UAAM,KAAK,kBAAkB,OAAO,KAAK,6BAA6B,YAAY;AAElF,WAAO,EAAE,UAAU,gBAAgB,UAAU,sBAAsB,sBAAsB,qBAAqB;AAAA,EAIhH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,cAAc,SAA+B,cAA8B;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,gBAAgB,GAAG;AAC1B,YAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,UAAI,CAAC,iBAAiB;AACpB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB,SAAS;AAC/C,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,EAAE,aAAa,aAAa,IAAI,MAAM,WAAW,iBAAiB;AAAA,MACtE,YAAY,QAAQ;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,iBAAsC,KAAU,cAA8B;AAGzF,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,gBAAgB,SAAiC,cAA8B;AAC1F,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,aAAa,CAAC,UAAU,SAAS;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,gBAAgB,GAAG;AAC1B,YAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,UAAI,CAAC,iBAAiB;AACpB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB,SAAS;AAC/C,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM,WAAW,mBAAmB;AAAA,MAC1E,YAAY,QAAQ;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAED,UAAM,mBAAoC;AAAA,MACxC,UAAU,SAAS,qBAAqB,YAAY,KAAK,SAAS,qBAAqB;AAAA,MACvF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,SAAS,UAAU;AACrB,uBAAiB,WAAW,QAAQ;AAAA,IACtC;AAEA,UAAM,KAAK,kBAAkB,IAAI,KAAK,6BAA6B,kBAAkB,OAAO,YAAY;AAExG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAwC,KAAU,cAA8B;AAG3F,UAAM,SAAS,MAAM,KAAK,yBAAoC,KAAK,YAAY;AAG/E,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAa,iBACX,SACA,cACiC;AACjC,UAAM,QAAQ,kBAAkB,QAAQ,qBAAqB,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC9G,UAAM,SAAS,MAAM,KAAK,eAAe,YAAY;AACrD,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,wBAAwB,MAAM,WAAW,0BAA0B;AAAA,MACvE,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,qBAAqB;AAAA,QACnB,GAAG,QAAQ;AAAA,QACX;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAE7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,EAAE,OAAO;AAAA,IACX;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO;AAAA,MACL,sBAAsB,sBAAsB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,QAAQ,cAA8B;AACjD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,CAAC,WAAW;AACd;AAAA,IACF;AAEA,QAAI,KAAK,gBAAgB,GAAG;AAC1B,YAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,UAAI,CAAC,iBAAiB;AACpB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,cAAgE;AACtF,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,QAAI,WAAW;AACb,UAAI,KAAK,gBAAgB,GAAG;AAC1B,cAAM,kBAAkB,MAAM,KAAK,2BAA2B,WAAW,YAAY;AACrF,YAAI,CAAC,iBAAiB;AACpB;AAAA,QACF;AAAA,MACF;AAGA,YAAM,EAAE,UAAU,GAAG,YAAY,IAAI;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,eAAe,cAAiD;AAC3E,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,WAAW,KAAK,SAAS,qBAAqB,YAAY;AAChE,UAAM,QAAQ,KAAK,SAAS,qBAAqB;AAEjD,UAAM,gBAAgB,YAAY,KAAK,kBAAkB,SAAS,IAAI,KAAK;AAC3E,QAAI,KAAK,gBAAgB,GAAG;AAC1B,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,oBAAoB,2DAA2D;AAAA,MAC3F;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AACA,YAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAI,kBAAkB,gBAAgB;AACpC,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,WAAW,WAAW,UAAU;AAAA,MACpC,CAACA,cAAaA,UAAS,aAAa,aAAa,CAAC,SAAS,cAAcA,UAAS,OAAO,KAAK;AAAA,IAChG;AAEA,QAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAM;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB;AACzB,UAAM,wBAAwB,MAAM,KAAK,eAAe,gBAAgB,EAAE,uBAAuB;AAAA,MAC/F,cAAc,UAAU;AAAA,IAC1B,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,mBAAmB,gBAAgB,UAAU,mBAAmB,uBAAuB;AAAA,MAC3F,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAa,4BACX,SACA,cAC6B;AAC7B,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAErF,UAAM,gBAAgB,YAAY,KAAK,kBAAkB,SAAS,IAAI,KAAK;AAC3E,QAAI,KAAK,gBAAgB,GAAG;AAC1B,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,oBAAoB,+EAA+E;AAAA,MAC/G;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AACA,YAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAI,kBAAkB,gBAAgB;AACpC,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,qBAAqB,WAAW,qBAAqB;AAAA,MACzD,CAAC,aAAa,SAAS,eAAe,QAAQ;AAAA,IAChD;AAEA,QAAI,sBAAsB,mBAAmB,YAAY,KAAK,IAAI,IAAI,KAAM;AAC1E,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,WAAW,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB;AACzB,UAAM,wBAAwB,MAAM,KAAK,eAAe,gBAAgB,EAAE,sBAAsB;AAAA,MAC9F,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,cAAc,UAAU;AAAA,IAC1B,CAAC;AAED,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA;AAAA,QACE,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,kBAAkB,OAAO,YAAY;AAE5F,WAAO;AAAA,MACL,aAAa,sBAAsB;AAAA,MACnC,OAAO,sBAAsB;AAAA,MAC7B,WAAW,sBAAsB;AAAA,MACjC,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,OAAO,SAAwB,cAA8B;AACxE,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,YAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AACtE,aAAO,KAAK,WAAW,eAAe,OAAO;AAAA,IAC/C;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAM,aAAa,KAAK,eAAe,cAAc;AACrD,UAAM,YAAY,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AACrF,UAAM,gBAAgB,YAAY,KAAK,kBAAkB,SAAS,IAAI;AAEtE,QAAI,CAAC,WAAW;AAEd,aAAO,WAAW,eAAe,OAAO;AAAA,IAC1C;AAEA,QAAI,iBAAiB,kBAAkB,gBAAgB;AACrD,YAAM,KAAK,YAAY,OAAO,KAAK,uBAAuB,YAAY;AAAA,IACxE;AAEA,WAAO,WAAW,eAAe,OAAO;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAa,6BACX,SACA,cAC6C;AAC7C,UAAM,SAAS,MAAM,KAAK,eAAe,YAAY;AACrD,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,wBAAwB,MAAM,WAAW,cAAc;AAAA,MAC3D,GAAG;AAAA,MACH,OAAO,kBAAkB,QAAQ,KAAK;AAAA,IACxC,CAAC;AAED,UAAM,oBAAoB,MAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,YAAY;AAC7F,UAAM,YAAY;AAAA,MAChB,KAAK,SAAS,qBAAqB,YAAY;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,EAAE,OAAO;AAAA,IACX;AAEA,UAAM,KAAK,YAAY,IAAI,KAAK,uBAAuB,WAAW,MAAM,YAAY;AAEpF,WAAO,EAAE,sBAAsB,sBAAsB,qBAAqB;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAa,oBACX,SACA,cACwB;AACxB,UAAM,SAAS,MAAM,KAAK,eAAe,YAAY;AACrD,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,WAAO,WAAW,cAAc,OAAO;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,wBAAwB,aAAqB,cAA8B;AACtF,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IACzD;AAEA,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,YAAMC,qBAAoB,MAAM,KAAK,WAAW,kBAAkB,EAAE,YAAY,CAAC;AACjF,YAAM,KAAK,YAAY,oBAAoBA,oBAAmB,YAAY;AAC1E;AAAA,IACF;AAEA,UAAM,SAAS,aAAa,WAAW;AACvC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,uBAAuB,mCAAmC;AAAA,IACtE;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,YAAY;AAC7D,UAAM,SAAS,gBAAgB,MAAM;AACrC,QAAI,WAAW,gBAAgB;AAC7B,YAAM,IAAI,uBAAuB,wDAAwD;AAAA,IAC3F;AAEA,UAAM,aAAa,KAAK,eAAe,MAAM;AAC7C,UAAM,oBAAoB,MAAM,WAAW,kBAAkB,EAAE,YAAY,CAAC;AAE5E,UAAM,KAAK,YAAY,oBAAoB,EAAE,GAAG,mBAAmB,KAAK,OAAO,GAAG,YAAY;AAAA,EAChG;AACF;;;AIhzBA,SAAS,YAAY,YAAY,cAAc;AAI/C,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,SAAS;AACf,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAI;AASG,SAAS,kBAAkB,GAAwB;AACxD,SAAO,aAAa,OAAO,uBAAuB,aAAa,OAAO;AACxE;AAEA,eAAe,uBAAuB,QAAgB,MAAc,KAAa;AAC/E,cAAY,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAEtG,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,SAAS;AAAA,QAC9B,MAAM,QAAQ,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAUA,eAAe,SAAS,SAAqB,QAAgB,MAAc,YAAoB;AAC7F,QAAM,MAAM,OAAO,WAAW;AAC9B,QAAM,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,GAAG;AAEvE,SAAO,MAAM,IAAI,WAAW,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,KAAK,KAAK,IAAS,CAAC,EACnD,kBAAkB,UAAU,EAC5B,QAAQ,gBAAgB;AAC7B;AAYA,eAAsB,QAAQ,SAAqB,QAA2B,MAAc,YAAoB;AAC9G,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,MAAM,SAAS,SAAS,QAAQ,MAAM,UAAU;AAAA,EACzD,OAAO;AAEL,UAAM,CAAC,SAAS,IAAI;AAEpB,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,0BAA0B,sCAAsC;AAAA,IAC5E;AAEA,WAAO,MAAM,SAAS,SAAS,WAAW,MAAM,UAAU;AAAA,EAC5D;AACF;AASA,eAAsB,SAAY,OAAe,QAAgB,MAAc;AAC7E,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,OAAO,oBAAoB;AAGzB,UAAI,CAAC,gBAAgB,KAAK;AACxB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,aAAO,MAAM,uBAAuB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,IACvE;AAAA,IACA,EAAE,gBAAgB,GAAG;AAAA,EACvB;AACA,SAAO,IAAI;AACb;AAaA,eAAsB,QAAW,OAAe,QAA2B,MAAc;AACvF,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,MAAM,SAAY,OAAO,QAAQ,IAAI;AAAA,EAC9C,OAAO;AACL,UAAM,CAAC,WAAW,GAAG,UAAU,IAAI;AAEnC,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,0BAA0B,sCAAsC;AAAA,IAC5E;AAEA,QAAI;AAEJ,QAAI;AACF,aAAO,MAAM,SAAY,OAAO,WAAW,IAAI;AAAA,IACjD,SAAS,KAAK;AACZ,mBAAa;AAIb,UAAI,CAAC,kBAAkB,GAAG,GAAG;AAC3B,cAAM;AAAA,MACR;AAEA,iBAAW,aAAa,YAAY;AAClC,YAAI;AACF,iBAAO,MAAM,SAAS,OAAO,WAAW,IAAI;AAAA,QAC9C,SAAS,aAAa;AAGpB,cAAI,CAAC,kBAAkB,WAAW,GAAG;AACnC,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;ACvJO,IAAe,gBAAf,MACP;AAAA,EACqB;AAAA,EAEnB,YAAY,SAAgC;AAC1C,SAAK,UAAU;AAAA,EACjB;AAAA,EAMA,MAAgB,QAAkC,YAAoB,WAAkB,YAAoB;AAC1G,WAAO,MAAM,QAAQ,WAAW,KAAK,QAAQ,QAAQ,YAAY,UAAU;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAe,YAAoB,oBAA4B;AAC7E,QAAI;AACF,aAAQ,MAAM,QAAQ,oBAAoB,KAAK,QAAQ,QAAQ,UAAU;AAAA,IAC3E,SAAS,GAAW;AAElB,UAAI,kBAAkB,CAAC,GAAG;AACxB;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;AC7BO,IAAe,qBAAf,cAAmE,cAA6E;AAAA,EACrJ,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AAGF;;;ACNO,IAAe,2BAAf,cAAyE,cAAyF;AAAA,EACvK,YAAY,SAAgC;AAC1C,UAAM,OAAO;AAAA,EACf;AACF;;;ACNA,SAAS,oBAAoB,8BAA8B;;;ACApD,IAAM,yBAAN,cAAoD,yBAAwC;AAAA,EACxF;AAAA,EAET,YAAY,SAAgC,eAA6C;AACvF,UAAM,OAAO;AACb,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,iBACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK;AACpB,UAAM,aAAqC,EAAE,UAAU,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO;AAChG,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,iBAAiB,UAAU;AAErF,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAA+D;AAC3F,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AAErE,QAAI,aAAa;AACf,aAAO,MAAM,KAAK,QAAQ,YAAY,WAAW;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,SAAK,eAAe,aAAa,YAAY,OAAO;AAAA,EACtD;AACF;;;AClCO,IAAe,uBAAf,cAA2D,mBAAkC;AAAA,EACzF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAuD;AACjE,UAAM,OAAO;AAEb,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,oBAAoB,QAAQ,oBAAoB,KAAK,KAAK,KAAK;AACpE,SAAK,sBAAsB,QAAQ,sBAAsB,KAAK,KAAK,KAAK;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKU,gBAAgB,WAAmB;AAC3C,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAO,KAAK,IAAI,IAAI,MAAQ;AAClC,UAAM,YAAY,KAAK,IAAI,MAAM,KAAK,qBAAqB,YAAY,KAAK,iBAAiB;AAC7F,UAAM,SAAS,YAAY;AAE3B,WAAO,SAAS,IAAI,SAAS;AAAA,EAC/B;AACF;;;ACfA,IAAM,aAAa,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,KAAK,EACpB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,IAAM,qBAAN,cAAgD,qBAAoC;AAAA,EAChF;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,eACA;AACA,UAAM,OAAO;AAEb,SAAK,SAAS,QAAQ;AACtB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,QAAI,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAI3D,QAAI,aAAa,gBAAgB;AAC/B,YAAM,KAAK,OAAO,OAAO,SAAS;AAClC,kBAAY,WAAW;AAAA,IACzB;AAEA,kBAAc,WAAW;AAEzB,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,IAAI,MAAO;AACvC,UAAM,qBAAqB,MAAM,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,IAAI,WAAW,SAAS;AAE1C,SAAK,eAAe,UAAU,YAAY,oBAAoB,YAAY,OAAO;AAAA,EACnF;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,YAAY,MAAM,KAAK,OAAO,IAAI,SAAS;AAGjD,UAAI,CAAC,WAAW;AACd,aAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,MAChF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,YAAY,MAAM,KAAK,aAAa,YAAY,OAAO;AAE7D,QAAI,WAAW;AACb,YAAM,KAAK,OAAO,OAAO,SAAS;AAAA,IACpC;AAEA,SAAK,eAAe,aAAa,YAAY,SAAS,KAAK,kBAAkB,CAAC;AAAA,EAChF;AAAA,EAEA,MAAc,aAAa,YAAoB,SAAyB;AACtE,UAAM,cAAc,KAAK,eAAe,UAAU,YAAY,OAAO;AACrE,QAAI,aAAa;AACf,YAAM,gBAAgB,MAAM,KAAK,QAAwB,YAAY,WAAW;AAEhF,UAAI,eAAe;AACjB,eAAO,cAAc;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAoB,QAA2B,SAAoD;AACjG,WAAO,KAAK,OAAO,oBAAoB,QAAQ,OAAO;AAAA,EACxD;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;ACvHO,IAAM,sBAAN,cAAiD,qBAAoC;AAAA,EACjF;AAAA,EACA;AAAA,EAET,YAAY,SAAuD,eAA6C;AAC9G,UAAM,OAAO;AAEb,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,IACJ,YACA,WACA,gBACA,SACe;AACf,UAAM,SAAS,KAAK,gBAAgB,UAAU,SAAS,SAAS;AAChE,UAAM,aAAa,KAAK,kBAAkB;AAAA,MACxC;AAAA,IACF,CAAC;AACD,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,MAAO,MAAM;AACxD,UAAM,qBAAqB,MAAM,KAAK,QAAQ,YAAY,WAAW,UAAU;AAE/E,UAAM,YAAY;AAClB,UAAM,aAAa,KAAK,KAAK,mBAAmB,SAAS,SAAS;AAClE,UAAM,SAAS,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACvD,OAAO,mBAAmB,UAAU,IAAI,YAAY,IAAI,KAAK,SAAS;AAAA,MACtE,MAAM,GAAG,UAAU,IAAI,CAAC;AAAA,IAC1B,EAAE;AAEF,WAAO,QAAQ,CAAC,UAAU;AACxB,WAAK,eAAe,UAAU,MAAM,MAAM,MAAM,OAAO,YAAY,OAAO;AAAA,IAC5E,CAAC;AAED,UAAM,qBAAqB,KAAK,cAAc,YAAY,OAAO;AACjE,UAAM,qBAAqB,mBAAmB,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,GAAG,CAAC;AACzG,uBAAmB,QAAQ,CAAC,QAAQ;AAClC,WAAK,eAAe,aAAa,KAAK,SAAS,UAAU;AAAA,IAC3D,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,IAAI,YAAoB,SAAqE;AACjG,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,UAAM,qBAAqB,WACxB,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,GAAa,EAAE;AAAA,MAC/C,OAAO,KAAK,eAAe,UAAU,KAAK,OAAO;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,KAAK,EAAE;AAEV,QAAI,oBAAoB;AACtB,aAAO,MAAM,KAAK,QAAQ,YAAY,kBAAkB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAoD;AACnF,UAAM,aAAa,KAAK,cAAc,YAAY,OAAO;AACzD,eAAW,OAAO,YAAY;AAC5B,WAAK,eAAe,aAAa,KAAK,SAAS,KAAK,kBAAkB,CAAC;AAAA,IACzE;AAAA,EACF;AAAA,EAEA,sBAAqC;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAc,YAAoB,SAAmC;AAC3E,WAAO,OAAO,KAAK,KAAK,eAAe,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,CAAC;AAAA,EACxG;AAAA,EAEA,kBAAkB,SAAmE;AACnF,WAAO;AAAA,MACL,UAAU;AAAA,MACV,UAAU,KAAK,gBAAgB,YAAY;AAAA,MAC3C,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACnC,QAAQ,KAAK,gBAAgB,UAAU;AAAA,MACvC,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;AC5DA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":["tokenSet","logoutTokenClaims"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth0/auth0-server-js",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "Auth0 Authentication SDK for Server-Side Applications on JavaScript runtimes",
   "author": "Auth0",
   "license": "MIT",
@@ -11,7 +11,8 @@
     "clean": "rm -rf ./dist",
     "lint": "eslint \"./**/*.ts*\"",
     "test": "vitest run",
-    "test:ci": "vitest --watch false --coverage"
+    "test:ci": "vitest --watch false --coverage",
+    "test:workers": "vitest run --config vitest.config.workers.ts"
   },
   "types": "./dist/index.d.ts",
   "main": "./dist/index.cjs",
@@ -24,7 +25,7 @@
     }
   },
   "dependencies": {
-    "@auth0/auth0-auth-js": "^1.8.0",
+    "@auth0/auth0-auth-js": "^1.9.1",
     "jose": "^6.0.8"
   },
   "devDependencies": {
@@ -36,7 +37,9 @@
     "tsup": "^8.4.0",
     "typescript": "~5.8.3",
     "typescript-eslint": "^8.24.0",
-    "vitest": "^3.0.5"
+    "vitest": "^3.0.5",
+    "@cloudflare/vitest-pool-workers": "^0.12.10",
+    "wrangler": "^4.98.0"
   },
   "files": [
     "dist"