@cboxdk/id-js 0.3.0 → 0.5.0

package/README.md

@@ -20,6 +20,10 @@ first-class **Next.js** adapter.
 
 ## Install
 
+> **Where do `issuer`, `clientId` and `redirectUri` come from?**
+> Register an application in your environment console — see
+> [Integrate your app](https://github.com/cboxdk/cbox-id/blob/main/docs/getting-started/integrate-your-app.md).
+
 ```bash
 npm install @cboxdk/id-js
 ```

package/dist/{chunk-U6KYO2XA.js → chunk-J4GSNFRQ.js}

@@ -310,11 +310,14 @@ var CboxIdClient = class {
     if (typeof sub !== "string" || sub === "") {
       throw new AuthenticationError("The verified token carried no subject.");
     }
+    const organizations = parseOrganizations(claims["organizations"]);
     return {
       id: sub,
       email: typeof claims["email"] === "string" ? claims["email"] : null,
       name: typeof claims["name"] === "string" ? claims["name"] : null,
       organizationId: typeof claims["org"] === "string" ? claims["org"] : null,
+      // Only present when the instance emitted the claim (exactOptionalPropertyTypes).
+      ...organizations ? { organizations } : {},
       claims,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? null,
@@ -322,6 +325,39 @@ var CboxIdClient = class {
       expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0
     };
   }
+  /**
+   * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`
+   * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the
+   * returned `refreshToken` and discard the one you passed — presenting a rotated
+   * token again revokes the entire token family.
+   *
+   * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.
+   */
+  async refresh(refreshToken) {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: this.config.clientId,
+      refresh_token: refreshToken
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const response = await this.post(await this.discovery.endpoint("token_endpoint"), body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Token refresh failed: ${await response.text()}`);
+    }
+    const tokens = await response.json();
+    if (!tokens.access_token) {
+      throw new AuthenticationError("The refresh response carried no access token.");
+    }
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token ?? null,
+      idToken: tokens.id_token ?? null,
+      expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0,
+      scope: typeof tokens.scope === "string" ? tokens.scope : null
+    };
+  }
   /**
    * The URL of the instance's hosted account/profile page (self-service password,
    * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox
@@ -487,7 +523,25 @@ function timingSafeEqualString(a, b) {
   }
   return mismatch === 0;
 }
+function parseOrganizations(claim) {
+  if (!Array.isArray(claim)) {
+    return void 0;
+  }
+  const orgs = [];
+  for (const entry of claim) {
+    if (typeof entry !== "object" || entry === null) {
+      continue;
+    }
+    const record = entry;
+    const id = record["id"];
+    const name = record["name"];
+    if (typeof id === "string" && id !== "" && typeof name === "string" && name !== "") {
+      orgs.push({ id, name, role: typeof record["role"] === "string" ? record["role"] : null });
+    }
+  }
+  return orgs;
+}
 
 export { AuthenticationError, CboxIdClient, CboxIdError, ConfigurationError, Discovery, InvalidStateError, VaultClient, challenge, createVerifier, randomToken, verifyWebhook };
-//# sourceMappingURL=chunk-U6KYO2XA.js.map
-//# sourceMappingURL=chunk-U6KYO2XA.js.map
+//# sourceMappingURL=chunk-J4GSNFRQ.js.map
+//# sourceMappingURL=chunk-J4GSNFRQ.js.map

package/dist/chunk-J4GSNFRQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/pkce.ts","../src/vault.ts","../src/webhook.ts","../src/discovery.ts","../src/client.ts"],"names":["key"],"mappings":";;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC;AAM9C,IAAM,iBAAA,GAAN,cAAgC,WAAA,CAAY;AAAC;AAM7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC;;;ACnBtD,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;AAGO,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB;AAGA,eAAsB,UAAU,QAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACvF,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC;;;ACQO,IAAM,cAAN,MAAkB;AAAA,EAGvB,WAAA,CACE,MAAA,EACiB,KAAA,EACA,SAAA,GAAY,GAAA,EAC7B;AAFiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAEjB,IAAA,IAAA,CAAK,OAAO,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,aAAA,CAAA;AAAA,EAC1C;AAAA,EAJmB,KAAA;AAAA,EACA,SAAA;AAAA,EALF,IAAA;AAAA;AAAA,EAWjB,MAAM,KAAA,EAAkD;AACtD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY;AAAA,MACnD,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,YAAY,KAAA,CAAM,SAAA;AAAA,MAClB,UAAU,KAAA,CAAM,OAAA;AAAA,MAChB,YAAY,KAAA,CAAM;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAA,CAAO,UAAkB,MAAA,EAAyC;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAAA,EACxG;AAAA;AAAA,EAGA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAM,KAAK,OAAA,CAAQ,QAAA,EAAU,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACzE;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,QAAA,EACA,aAAA,EAC+E;AAC/E,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MAC1E,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB;AAAA,KAClB,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACf,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,UAAU,CAAA,CAAE,SAAA,EAAW,UAAU,CAAA,CAAE,SAAA,EAAW,aAAA,EAAe,CAAA,CAAE,eAAA,EAAgB;AAAA,IAC1F,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,QAAA,EAAkB,QAAA,EAAiC;AACnE,IAAA,MAAM,IAAA,CAAK,OAAA;AAAA,MACT,QAAA;AAAA,MACA,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,UAAkB,OAAA,EAAsC;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,mBAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU,EAAE,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACpG,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,QAAA,EAAU,CAAA,CAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW;AAAA,IAClG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,IAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA2C;AAC7F,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,OAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AACrG,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAoB;AAAA,QACxB,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,UACnC,GAAI,IAAA,GAAO,EAAE,cAAA,EAAgB,kBAAA,KAAuB;AAAC,SACvD;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACrB;AACA,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACjC;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA;AACxD,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,oBAAoB,CAAA,MAAA,EAAS,MAAM,IAAI,IAAI,CAAA,oBAAA,EAAuB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AACA,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;;;AC3HA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAEA,SAAS,MAAM,KAAA,EAA4B;AACzC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,CACpC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAgBA,eAAsB,cAAc,OAAA,EAAiD;AACnF,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAiB,MAAA,EAAO,GAAI,OAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,OAAA,IAAW,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,CAACA,MAAK,KAAK,CAAA,GAAI,QAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChD,IAAA,IAAIA,IAAAA,EAAK;AACP,MAAA,KAAA,CAAMA,IAAG,IAAI,KAAA,IAAS,EAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,GAAG,CAAA,IAAK,EAAA;AAChC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AAEjC,EAAA,IAAI,SAAA,KAAc,MAAM,SAAA,KAAc,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,QAAA,GAAW,KAAA;AAAA,IACf,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,EAAE,CAAC;AAAA,GAC3F;AAEA,EAAA,OAAO,eAAA,CAAgB,UAAU,SAAS,CAAA;AAC5C;;;ACxEO,IAAM,YAAN,MAAgB;AAAA,EAGrB,YACmB,MAAA,EACA,SAAA,EACA,UAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EAC1C;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAChB;AAAA,EAJgB,MAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,GAAA;AAAA,EANX,MAAA,GAA+D,IAAA;AAAA,EASvE,MAAM,QAAA,GAAuC;AAC3C,IAAA,IAAI,KAAK,MAAA,IAAU,IAAA,CAAK,OAAO,SAAA,GAAY,IAAA,CAAK,KAAI,EAAG;AACrD,MAAA,OAAO,KAAK,MAAA,CAAO,GAAA;AAAA,IACrB;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iCAAA,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC1F;AACA,MAAA,GAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACxC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,0BAAA,EAA6B,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAA,EAAK,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,KAAK,UAAA,EAAW;AAC7D,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAgD;AAC7D,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,IAAA,EAAuD;AAC5E,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,KAAK,KAAA,GAAQ,IAAA;AAAA,EAC7D;AACF;;;AChBO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAA6B,MAAA,EAAsB;AAAtB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,MAAM,IAAI,mBAAmB,wCAAwC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAA,CAAK,YAAY,IAAI,SAAA;AAAA,MACnB,MAAA,CAAO,MAAA;AAAA,MACP,OAAO,SAAA,IAAa,GAAA;AAAA,MACpB,OAAO,UAAA,IAAc;AAAA,KACvB;AAAA,EACF;AAAA,EAf6B,MAAA;AAAA,EAHZ,SAAA;AAAA,EACA,SAAA,uBAAgB,GAAA,EAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB3D,MAAM,0BAAA,CAA2B,OAAA,GAO7B,EAAC,EAAkC;AACrC,IAAA,MAAM,eAAe,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,CAAY,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,aAAA,EAAe,MAAA;AAAA,MACf,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,YAAA,EAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACjD,QAAQ,OAAA,CAAQ,MAAA,IAAU,KAAK,MAAA,EAAO,EAAG,KAAK,GAAG,CAAA;AAAA,MACjD,KAAA;AAAA,MACA,KAAA;AAAA,MACA,cAAA,EAAgB,MAAM,SAAA,CAAU,YAAY,CAAA;AAAA,MAC5C,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA;AAAA,IACrC;AACA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,YAAA,EAAc,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAO,YAAA,EAAc,KAAA,EAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,KAAA,EAIG;AACpB,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAE3B,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,qBAAA,CAAsB,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxF,MAAA,MAAM,IAAI,kBAAkB,0EAAqE,CAAA;AAAA,IACnG;AAEA,IAAA,IAAI,OAAO,KAAA,EAAO;AAChB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,EAAG,MAAA,CAAO,oBAAoB,CAAA,EAAA,EAAK,MAAA,CAAO,iBAAiB,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,OAC/G;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,MAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,IACjF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,IAAA,EAAM,MAAA,CAAO,YAAA,EAAc,KAAA,CAAM,WAAW,CAAA;AAEtF,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,SAAkC,EAAC;AACvC,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,OAAO,KAAK,CAAA;AAAA,IACjE;AAEA,IAAA,MAAA,GAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,EAAG;AAEpE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,MAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,MAAA,CAAO,eAAe,CAAC,CAAA;AAEhE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA;AAAA,MACJ,KAAA,EAAO,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,IAAA;AAAA,MAC/D,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,IAAA;AAAA,MAC5D,cAAA,EAAgB,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,IAAA;AAAA;AAAA,MAEpE,GAAI,aAAA,GAAgB,EAAE,aAAA,KAAkB,EAAC;AAAA,MACzC,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,YAAA,EAAgD;AAC5D,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,eAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,sBAAA,EAAyB,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IAChF;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,OAAO;AAAA,MACL,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa,CAAA;AAAA,MACvE,OAAO,OAAO,MAAA,CAAO,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAAA,EAA2B;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA;AAC1E,IAAA,OAAO,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GAAK,IAAA;AAAA,EAC3F;AAAA;AAAA,EAGA,MAAM,UAAU,QAAA,EAA2C;AACzD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,sBAAsB,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,QAAA,GACH,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,wBAAA,EAA0B,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GACrF,QAAA;AAAA,EACN;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CAAa,OAAA,GAAoD,EAAC,EAAoB;AAC1F,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe,KAAK,aAAA;AAAc,KACnC,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC/C,MAAA,IAAA,CAAK,IAAI,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,EAAiC,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACxF;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,oBAAoB,yCAAyC,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,SAAS,WAAA,EAAuD;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAC1E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU;AAAA,MACrD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,0BAA0B,CAAA;AAAA,IAC1D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,KAAA,EAAiD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,aAAA,EAAe,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,CAAA;AAAA,MAC7B,EAAE,aAAA,EAAe,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA;AAAG,KACpC;AACA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,cAAc,OAAA,EAAiD;AAC7D,IAAA,OAAO,cAAc,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,EAAkC;AACtC,IAAA,OAAO,IAAI,YAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAAA,EACzF;AAAA,EAEA,MAAc,QAAA,CAAS,IAAA,EAAc,QAAA,EAAkB,WAAA,EAA8C;AACnG,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,YAAA,EAAc,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACzC,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,uBAAA,EAA0B,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACjF;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,aAAA,CAAc,OAAA,EAAiB,KAAA,EAAiD;AAC5F,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,UAAU,CAAA;AACxD,IAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAW,kBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,SAAS,QAAA,EAAU;AAAA,QAChD,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,QACpB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,oCAAA,EAAuC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,OAAO,CAAA,KAAM,KAAA,EAAO;AACvC,MAAA,MAAM,IAAI,oBAAoB,0DAAqD,CAAA;AAAA,IACrF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,MAAA,GAAmB;AACzB,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA;AAC3B,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,QAAA,EAAU,WAAW,OAAO,CAAA;AAAA,EAC7E;AAAA,EAEQ,WAAA,GAAsB;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,MAAA,CAAO,WAAA;AACzB,IAAA,OAAO,IAAA,IAAQ,SAAS,EAAA,GAAK,CAAA,CAAA,EAAI,KAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,CAAA,GAAK,WAAA;AAAA,EAC/D;AAAA,EAEQ,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AAC7B,MAAA,MAAM,IAAI,mBAAmB,8DAA8D,CAAA;AAAA,IAC7F;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA;AAAA,EACrB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,IAAA,EAAuB,OAAA,GAAkC,EAAC,EAAsB;AACxG,IAAA,OAAO,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,GAAG,OAAA,EAAQ;AAAA,MAC3E;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAsC;AAChF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAClF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;AAGA,SAAS,qBAAA,CAAsB,GAAW,CAAA,EAAoB;AAC5D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAOA,SAAS,mBAAmB,KAAA,EAAgD;AAC1E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,OAA2B,EAAC;AAClC,EAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,MAAM,EAAA,GAAK,OAAO,IAAI,CAAA;AACtB,IAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,KAAO,MAAM,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,EAAA,EAAI;AAClF,MAAA,IAAA,CAAK,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,MAAM,OAAO,MAAA,CAAO,MAAM,CAAA,KAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,MAAM,CAAA;AAAA,IAC1F;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-J4GSNFRQ.js","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n */\nexport class AuthenticationError extends CboxIdError {}\n","/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n","import { AuthenticationError } from './errors.js';\n\n/** A stored vault secret's metadata (never its plaintext). */\nexport interface VaultSecretRef {\n  id: string;\n  name: string;\n  provider: string;\n  ownerType: string | null;\n  ownerId: string | null;\n  expiresAt: string | null;\n  revoked: boolean;\n}\n\n/** A brokered credential — the plaintext, for immediate use. */\nexport interface VaultLease {\n  secretId: string;\n  provider: string;\n  secret: string;\n  expiresAt: string;\n}\n\nexport interface StoreSecretInput {\n  name: string;\n  provider: string;\n  secret: string;\n  ownerType?: 'organization' | 'user';\n  ownerId?: string;\n  expiresAt?: string;\n}\n\n/**\n * Client for a Cbox ID instance's Token Vault API. Bind it to an access token\n * (obtain one with {@link CboxIdClient.machineToken}, scoped `vault.manage` for\n * provisioning or `vault.lease` for redeeming). All calls are server-to-server.\n */\nexport class VaultClient {\n  private readonly base: string;\n\n  constructor(\n    issuer: string,\n    private readonly token: string,\n    private readonly timeoutMs = 10_000,\n  ) {\n    this.base = `${issuer.replace(/\\/$/, '')}/api/v1/vault`;\n  }\n\n  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */\n  store(input: StoreSecretInput): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', '/secrets', {\n      name: input.name,\n      provider: input.provider,\n      secret: input.secret,\n      owner_type: input.ownerType,\n      owner_id: input.ownerId,\n      expires_at: input.expiresAt,\n    });\n  }\n\n  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */\n  rotate(secretId: string, secret: string): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });\n  }\n\n  /** Revoke a secret permanently (scope `vault.manage`). */\n  async revoke(secretId: string): Promise<void> {\n    await this.request('DELETE', `/secrets/${encodeURIComponent(secretId)}`);\n  }\n\n  /** Authorize an agent client to lease a secret (scope `vault.manage`). */\n  grant(\n    secretId: string,\n    clientId: string,\n    maxTtlSeconds?: number,\n  ): Promise<{ secretId: string; clientId: string; maxTtlSeconds: number | null }> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/grants`, {\n      client_id: clientId,\n      max_ttl_seconds: maxTtlSeconds,\n    }).then((raw) => {\n      const r = raw as { secret_id: string; client_id: string; max_ttl_seconds: number | null };\n      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };\n    });\n  }\n\n  /** Revoke an agent's authorization (scope `vault.manage`). */\n  async revokeGrant(secretId: string, clientId: string): Promise<void> {\n    await this.request(\n      'DELETE',\n      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`,\n    );\n  }\n\n  /**\n   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller\n   * is identified by the token's client; a lease with no live grant is refused.\n   */\n  lease(secretId: string, purpose: string): Promise<VaultLease> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {\n      const r = raw as { secret_id: string; provider: string; secret: string; expires_at: string };\n      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };\n    });\n  }\n\n  private async json<T>(method: string, path: string, body: Record<string, unknown>): Promise<T> {\n    const response = await this.request(method, path, body);\n    return (await response.json()) as T;\n  }\n\n  private async request(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    try {\n      const init: RequestInit = {\n        method,\n        headers: {\n          authorization: `Bearer ${this.token}`,\n          ...(body ? { 'content-type': 'application/json' } : {}),\n        },\n        signal: controller.signal,\n      };\n      if (body) {\n        init.body = JSON.stringify(body);\n      }\n      const response = await fetch(`${this.base}${path}`, init);\n      if (!response.ok) {\n        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);\n      }\n      return response;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n","/**\n * Verify a Cbox ID webhook / inline-action signature. The header is\n * `X-Cbox-Signature: t={unix},v1={hex hmac}` — an HMAC-SHA256 over\n * `\"{timestamp}.{raw body}\"`, valid within a freshness window. Built on Web Crypto\n * so it runs on Node, edge and the browser.\n */\n\n/** Constant-time compare of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport interface VerifyWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The value of the `X-Cbox-Signature` header. */\n  signatureHeader: string | null | undefined;\n  /** The signing secret issued when the webhook/action endpoint was registered. */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\n/** Returns `true` only when the signature is present, fresh and valid. Never throws. */\nexport async function verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n  const { payload, signatureHeader, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  if (!signatureHeader) {\n    return false;\n  }\n\n  const parts: Record<string, string> = {};\n  for (const segment of signatureHeader.split(',')) {\n    const [key, value] = segment.trim().split('=', 2);\n    if (key) {\n      parts[key] = value ?? '';\n    }\n  }\n\n  const timestamp = parts['t'] ?? '';\n  const signature = parts['v1'] ?? '';\n\n  if (timestamp === '' || signature === '' || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const expected = toHex(\n    await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${payload}`)),\n  );\n\n  return timingSafeEqual(expected, signature);\n}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport type { DiscoveryDocument } from './types.js';\n\n/**\n * Fetches and caches an instance's OIDC discovery document. One instance of this\n * lives per {@link CboxIdClient}; the document is refetched only after the TTL.\n */\nexport class Discovery {\n  private cached: { doc: DiscoveryDocument; expiresAt: number } | null = null;\n\n  constructor(\n    private readonly issuer: string,\n    private readonly timeoutMs: number,\n    private readonly cacheTtlMs: number,\n    private readonly now: () => number = Date.now,\n  ) {}\n\n  async document(): Promise<DiscoveryDocument> {\n    if (this.cached && this.cached.expiresAt > this.now()) {\n      return this.cached.doc;\n    }\n\n    const url = `${this.issuer.replace(/\\/$/, '')}/.well-known/openid-configuration`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let doc: DiscoveryDocument;\n    try {\n      const response = await fetch(url, { signal: controller.signal });\n      if (!response.ok) {\n        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);\n      }\n      doc = (await response.json()) as DiscoveryDocument;\n    } catch (error) {\n      if (error instanceof AuthenticationError) {\n        throw error;\n      }\n      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (typeof doc.issuer !== 'string' || doc.issuer === '') {\n      throw new AuthenticationError('The discovery document was missing an issuer.');\n    }\n\n    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };\n    return doc;\n  }\n\n  /** A required endpoint from the discovery document. */\n  async endpoint(name: keyof DiscoveryDocument): Promise<string> {\n    const value = (await this.document())[name];\n    if (typeof value !== 'string' || value === '') {\n      throw new ConfigurationError(`The instance does not advertise a ${name}.`);\n    }\n    return value;\n  }\n\n  /** An optional endpoint, or null when the instance advertises none. */\n  async optionalEndpoint(name: keyof DiscoveryDocument): Promise<string | null> {\n    const value = (await this.document())[name];\n    return typeof value === 'string' && value !== '' ? value : null;\n  }\n}\n","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError, InvalidStateError } from './errors.js';\nimport { challenge, createVerifier, randomToken } from './pkce.js';\nimport type {\n  AuthorizationRequest,\n  CboxIdConfig,\n  CboxOrganization,\n  CboxUser,\n  RefreshedTokens,\n  TokenResponse,\n} from './types.js';\nimport { VaultClient } from './vault.js';\nimport { verifyWebhook, type VerifyWebhookOptions } from './webhook.js';\n\ntype JwksResolver = ReturnType<typeof createRemoteJWKSet>;\n\n/** Query parameters as they arrive on your callback route. */\nexport interface CallbackParams {\n  code?: string | null;\n  state?: string | null;\n  error?: string | null;\n  error_description?: string | null;\n}\n\n/** The values you persisted from {@link CboxIdClient.createAuthorizationRequest}. */\nexport interface StoredAuthState {\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n}\n\n/**\n * Turnkey Cbox ID client for JavaScript/TypeScript. It speaks standard OpenID\n * Connect against a Cbox ID instance — so integrating is a redirect and a callback,\n * not a rewrite — and adds the conveniences a hosted-identity product needs: a\n * redirect to the instance's hosted profile page, and back-channel helpers (machine\n * tokens, userinfo, introspection, webhook verification).\n *\n * Login is hardened by default: PKCE (S256), a CSRF state check, a nonce, and full\n * id_token signature + issuer + audience verification against the instance's JWKS\n * (via `jose`).\n *\n * The class is framework-agnostic: {@link createAuthorizationRequest} hands you the\n * `state`, `codeVerifier` and `nonce` to persist however you like, and\n * {@link authenticate} takes them back. For Next.js, the `@cboxdk/id-js/nextjs`\n * entry wires this to cookies for you.\n */\nexport class CboxIdClient {\n  private readonly discovery: Discovery;\n  private readonly jwksByUri = new Map<string, JwksResolver>();\n\n  constructor(private readonly config: CboxIdConfig) {\n    if (!config.issuer) {\n      throw new ConfigurationError('Cbox ID config `issuer` is required.');\n    }\n    if (!config.clientId) {\n      throw new ConfigurationError('Cbox ID config `clientId` is required.');\n    }\n    if (!config.redirectUri) {\n      throw new ConfigurationError('Cbox ID config `redirectUri` is required.');\n    }\n    this.discovery = new Discovery(\n      config.issuer,\n      config.timeoutMs ?? 10_000,\n      config.cacheTtlMs ?? 3_600_000,\n    );\n  }\n\n  /**\n   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and\n   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back\n   * to {@link authenticate} on the callback.\n   */\n  async createAuthorizationRequest(options: {\n    scopes?: string[];\n    redirectUri?: string;\n    state?: string;\n    prompt?: string;\n    loginHint?: string;\n    maxAge?: number;\n  } = {}): Promise<AuthorizationRequest> {\n    const codeVerifier = createVerifier();\n    const state = options.state ?? randomToken(16);\n    const nonce = randomToken(16);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: options.redirectUri ?? this.config.redirectUri,\n      scope: (options.scopes ?? this.scopes()).join(' '),\n      state,\n      nonce,\n      code_challenge: await challenge(codeVerifier),\n      code_challenge_method: 'S256',\n    });\n    if (options.prompt) {\n      params.set('prompt', options.prompt);\n    }\n    if (options.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n    if (typeof options.maxAge === 'number') {\n      params.set('max_age', String(options.maxAge));\n    }\n\n    const endpoint = await this.discovery.endpoint('authorization_endpoint');\n    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };\n  }\n\n  /**\n   * Complete login on your callback route: verify state, exchange the code with the\n   * PKCE verifier, verify the id_token, and return the authenticated user.\n   *\n   * @throws InvalidStateError when state does not match (forged/stale request)\n   * @throws AuthenticationError on any other failure\n   */\n  async authenticate(input: {\n    params: CallbackParams;\n    stored: StoredAuthState;\n    redirectUri?: string;\n  }): Promise<CboxUser> {\n    const { params, stored } = input;\n\n    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {\n      throw new InvalidStateError('The login state did not match — the request may be forged or stale.');\n    }\n\n    if (params.error) {\n      throw new AuthenticationError(\n        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ''}`,\n      );\n    }\n\n    if (!params.code) {\n      throw new AuthenticationError('The callback was missing an authorization code.');\n    }\n\n    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);\n\n    if (!tokens.access_token) {\n      throw new AuthenticationError('No access token was returned.');\n    }\n\n    let claims: Record<string, unknown> = {};\n    if (tokens.id_token) {\n      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);\n    }\n    // Enrich with userinfo (email/name/org a minimal id_token may omit).\n    claims = { ...claims, ...(await this.userinfo(tokens.access_token)) };\n\n    const sub = claims['sub'];\n    if (typeof sub !== 'string' || sub === '') {\n      throw new AuthenticationError('The verified token carried no subject.');\n    }\n\n    const organizations = parseOrganizations(claims['organizations']);\n\n    return {\n      id: sub,\n      email: typeof claims['email'] === 'string' ? claims['email'] : null,\n      name: typeof claims['name'] === 'string' ? claims['name'] : null,\n      organizationId: typeof claims['org'] === 'string' ? claims['org'] : null,\n      // Only present when the instance emitted the claim (exactOptionalPropertyTypes).\n      ...(organizations ? { organizations } : {}),\n      claims,\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n    };\n  }\n\n  /**\n   * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`\n   * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the\n   * returned `refreshToken` and discard the one you passed — presenting a rotated\n   * token again revokes the entire token family.\n   *\n   * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.\n   */\n  async refresh(refreshToken: string): Promise<RefreshedTokens> {\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.config.clientId,\n      refresh_token: refreshToken,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token refresh failed: ${await response.text()}`);\n    }\n\n    const tokens = (await response.json()) as TokenResponse;\n    if (!tokens.access_token) {\n      throw new AuthenticationError('The refresh response carried no access token.');\n    }\n\n    return {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n      scope: typeof tokens.scope === 'string' ? tokens.scope : null,\n    };\n  }\n\n  /**\n   * The URL of the instance's hosted account/profile page (self-service password,\n   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox\n   * ID session; `returnTo` is passed so the page can link back to your app.\n   */\n  profileUrl(returnTo?: string): string {\n    const base = `${this.config.issuer.replace(/\\/$/, '')}${this.accountPath()}`;\n    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;\n  }\n\n  /** The RP-initiated logout URL, or null when the instance advertises none. */\n  async logoutUrl(returnTo?: string): Promise<string | null> {\n    const endpoint = await this.discovery.optionalEndpoint('end_session_endpoint');\n    if (!endpoint) {\n      return null;\n    }\n    return returnTo\n      ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}`\n      : endpoint;\n  }\n\n  /**\n   * A machine (client-credentials) access token for calling Cbox ID APIs as your\n   * app, not on a user's behalf. Requires a client secret.\n   */\n  async machineToken(options: { scopes?: string[]; resource?: string } = {}): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.config.clientId,\n      client_secret: this.requireSecret(),\n    });\n    if (options.scopes && options.scopes.length > 0) {\n      body.set('scope', options.scopes.join(' '));\n    }\n    if (options.resource) {\n      body.set('resource', options.resource);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token?: unknown };\n    if (typeof json.access_token !== 'string') {\n      throw new AuthenticationError('The token response had no access_token.');\n    }\n    return json.access_token;\n  }\n\n  /** The OIDC userinfo claims for an access token. */\n  async userinfo(accessToken: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.optionalEndpoint('userinfo_endpoint');\n    if (!endpoint) {\n      return {};\n    }\n    const response = await this.fetchWithTimeout(endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    if (!response.ok) {\n      throw new AuthenticationError('Userinfo request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7662 token introspection (confidential-client auth). Returns the raw\n   * response; `active` tells you if the token is currently valid. Requires a secret.\n   */\n  async introspect(token: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.endpoint('introspection_endpoint');\n    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);\n    const response = await this.post(\n      endpoint,\n      new URLSearchParams({ token }),\n      { authorization: `Basic ${basic}` },\n    );\n    if (!response.ok) {\n      throw new AuthenticationError('Introspection request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */\n  verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n    return verifyWebhook(options);\n  }\n\n  /**\n   * A Token Vault client bound to an access token. Obtain the token with\n   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to\n   * redeem), then call `store` / `grant` / `lease` etc.\n   */\n  vault(accessToken: string): VaultClient {\n    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 10_000);\n  }\n\n  private async exchange(code: string, verifier: string, redirectUri?: string): Promise<TokenResponse> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri ?? this.config.redirectUri,\n      client_id: this.config.clientId,\n      code_verifier: verifier,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);\n    }\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async verifyIdToken(idToken: string, nonce: string): Promise<Record<string, unknown>> {\n    const jwksUri = await this.discovery.endpoint('jwks_uri');\n    let resolver = this.jwksByUri.get(jwksUri);\n    if (!resolver) {\n      resolver = createRemoteJWKSet(new URL(jwksUri));\n      this.jwksByUri.set(jwksUri, resolver);\n    }\n\n    let payload: JWTPayload;\n    try {\n      ({ payload } = await jwtVerify(idToken, resolver, {\n        issuer: this.config.issuer,\n        audience: this.config.clientId,\n      }));\n    } catch (error) {\n      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);\n    }\n\n    if (nonce && payload['nonce'] !== nonce) {\n      throw new AuthenticationError('The id_token nonce did not match — possible replay.');\n    }\n\n    return payload as Record<string, unknown>;\n  }\n\n  private scopes(): string[] {\n    const scopes = this.config.scopes;\n    return scopes && scopes.length > 0 ? scopes : ['openid', 'profile', 'email'];\n  }\n\n  private accountPath(): string {\n    const path = this.config.accountPath;\n    return path && path !== '' ? `/${path.replace(/^\\//, '')}` : '/settings';\n  }\n\n  private requireSecret(): string {\n    if (!this.config.clientSecret) {\n      throw new ConfigurationError('This call requires a `clientSecret`, but none is configured.');\n    }\n    return this.config.clientSecret;\n  }\n\n  private post(url: string, body: URLSearchParams, headers: Record<string, string> = {}): Promise<Response> {\n    return this.fetchWithTimeout(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded', ...headers },\n      body,\n    });\n  }\n\n  private async fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 10_000);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/** Constant-time string compare, so state validation doesn't leak via timing. */\nfunction timingSafeEqualString(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\n/**\n * Parse an `organizations` claim into typed orgs, ignoring anything malformed. The\n * claim is optional and instance-specific; absent or non-array → undefined, so\n * callers can tell \"no claim\" from \"empty\".\n */\nfunction parseOrganizations(claim: unknown): CboxOrganization[] | undefined {\n  if (!Array.isArray(claim)) {\n    return undefined;\n  }\n  const orgs: CboxOrganization[] = [];\n  for (const entry of claim) {\n    if (typeof entry !== 'object' || entry === null) {\n      continue;\n    }\n    const record = entry as Record<string, unknown>;\n    const id = record['id'];\n    const name = record['name'];\n    if (typeof id === 'string' && id !== '' && typeof name === 'string' && name !== '') {\n      orgs.push({ id, name, role: typeof record['role'] === 'string' ? record['role'] : null });\n    }\n  }\n  return orgs;\n}\n"]}

package/dist/{client-CjmGxfIA.d.cts → client-BJ8m6qgt.d.cts}

@@ -59,6 +59,25 @@ interface TokenResponse {
     expires_in?: number;
     scope?: string;
 }
+/**
+ * The tokens returned by {@link CboxIdClient.refresh}. Cbox ID ROTATES refresh
+ * tokens and detects reuse, so `refreshToken` is a NEW value — store it and discard
+ * the one you presented; replaying a rotated token revokes the whole family.
+ */
+interface RefreshedTokens {
+    accessToken: string;
+    refreshToken: string | null;
+    idToken: string | null;
+    expiresIn: number;
+    scope: string | null;
+}
+/** One organization a user belongs to, from the `organizations` claim when present. */
+interface CboxOrganization {
+    id: string;
+    name: string;
+    /** The member's role in this organization, when the claim carries it. */
+    role?: string | null;
+}
 /**
  * The authenticated Cbox ID user. `id` is the stable opaque subject (`sub`) you key
  * your local account on. `claims` is the full verified id_token + userinfo claim
@@ -68,7 +87,14 @@ interface CboxUser {
     id: string;
     email: string | null;
     name: string | null;
+    /** The active organization's id (`org` claim). */
     organizationId: string | null;
+    /**
+     * The organizations this user belongs to, when the instance emits an
+     * `organizations` claim. Undefined when the claim is absent (single-org apps, or
+     * an instance that doesn't include it). Pass straight to `<OrganizationSwitcher>`.
+     */
+    organizations?: CboxOrganization[];
     claims: Record<string, unknown>;
     accessToken: string;
     refreshToken: string | null;
@@ -214,6 +240,15 @@ declare class CboxIdClient {
         stored: StoredAuthState;
         redirectUri?: string;
     }): Promise<CboxUser>;
+    /**
+     * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`
+     * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the
+     * returned `refreshToken` and discard the one you passed — presenting a rotated
+     * token again revokes the entire token family.
+     *
+     * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.
+     */
+    refresh(refreshToken: string): Promise<RefreshedTokens>;
     /**
      * The URL of the instance's hosted account/profile page (self-service password,
      * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox
@@ -254,4 +289,4 @@ declare class CboxIdClient {
     private fetchWithTimeout;
 }
 
-export { type AuthorizationRequest as A, type CallbackParams as C, type DiscoveryDocument as D, type StoreSecretInput as S, type TokenResponse as T, VaultClient as V, CboxIdClient as a, type CboxIdConfig as b, type CboxUser as c, type StoredAuthState as d, type VaultLease as e, type VaultSecretRef as f, type VerifyWebhookOptions as g, verifyWebhook as v };
+export { type AuthorizationRequest as A, type CallbackParams as C, type DiscoveryDocument as D, type RefreshedTokens as R, type StoreSecretInput as S, type TokenResponse as T, VaultClient as V, CboxIdClient as a, type CboxIdConfig as b, type CboxUser as c, type StoredAuthState as d, type VaultLease as e, type VaultSecretRef as f, type VerifyWebhookOptions as g, verifyWebhook as v };

package/dist/{client-CjmGxfIA.d.ts → client-BJ8m6qgt.d.ts}

@@ -59,6 +59,25 @@ interface TokenResponse {
     expires_in?: number;
     scope?: string;
 }
+/**
+ * The tokens returned by {@link CboxIdClient.refresh}. Cbox ID ROTATES refresh
+ * tokens and detects reuse, so `refreshToken` is a NEW value — store it and discard
+ * the one you presented; replaying a rotated token revokes the whole family.
+ */
+interface RefreshedTokens {
+    accessToken: string;
+    refreshToken: string | null;
+    idToken: string | null;
+    expiresIn: number;
+    scope: string | null;
+}
+/** One organization a user belongs to, from the `organizations` claim when present. */
+interface CboxOrganization {
+    id: string;
+    name: string;
+    /** The member's role in this organization, when the claim carries it. */
+    role?: string | null;
+}
 /**
  * The authenticated Cbox ID user. `id` is the stable opaque subject (`sub`) you key
  * your local account on. `claims` is the full verified id_token + userinfo claim
@@ -68,7 +87,14 @@ interface CboxUser {
     id: string;
     email: string | null;
     name: string | null;
+    /** The active organization's id (`org` claim). */
     organizationId: string | null;
+    /**
+     * The organizations this user belongs to, when the instance emits an
+     * `organizations` claim. Undefined when the claim is absent (single-org apps, or
+     * an instance that doesn't include it). Pass straight to `<OrganizationSwitcher>`.
+     */
+    organizations?: CboxOrganization[];
     claims: Record<string, unknown>;
     accessToken: string;
     refreshToken: string | null;
@@ -214,6 +240,15 @@ declare class CboxIdClient {
         stored: StoredAuthState;
         redirectUri?: string;
     }): Promise<CboxUser>;
+    /**
+     * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`
+     * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the
+     * returned `refreshToken` and discard the one you passed — presenting a rotated
+     * token again revokes the entire token family.
+     *
+     * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.
+     */
+    refresh(refreshToken: string): Promise<RefreshedTokens>;
     /**
      * The URL of the instance's hosted account/profile page (self-service password,
      * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox
@@ -254,4 +289,4 @@ declare class CboxIdClient {
     private fetchWithTimeout;
 }
 
-export { type AuthorizationRequest as A, type CallbackParams as C, type DiscoveryDocument as D, type StoreSecretInput as S, type TokenResponse as T, VaultClient as V, CboxIdClient as a, type CboxIdConfig as b, type CboxUser as c, type StoredAuthState as d, type VaultLease as e, type VaultSecretRef as f, type VerifyWebhookOptions as g, verifyWebhook as v };
+export { type AuthorizationRequest as A, type CallbackParams as C, type DiscoveryDocument as D, type RefreshedTokens as R, type StoreSecretInput as S, type TokenResponse as T, VaultClient as V, CboxIdClient as a, type CboxIdConfig as b, type CboxUser as c, type StoredAuthState as d, type VaultLease as e, type VaultSecretRef as f, type VerifyWebhookOptions as g, verifyWebhook as v };

package/dist/index.cjs

@@ -314,11 +314,14 @@ var CboxIdClient = class {
     if (typeof sub !== "string" || sub === "") {
       throw new AuthenticationError("The verified token carried no subject.");
     }
+    const organizations = parseOrganizations(claims["organizations"]);
     return {
       id: sub,
       email: typeof claims["email"] === "string" ? claims["email"] : null,
       name: typeof claims["name"] === "string" ? claims["name"] : null,
       organizationId: typeof claims["org"] === "string" ? claims["org"] : null,
+      // Only present when the instance emitted the claim (exactOptionalPropertyTypes).
+      ...organizations ? { organizations } : {},
       claims,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? null,
@@ -326,6 +329,39 @@ var CboxIdClient = class {
       expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0
     };
   }
+  /**
+   * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`
+   * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the
+   * returned `refreshToken` and discard the one you passed — presenting a rotated
+   * token again revokes the entire token family.
+   *
+   * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.
+   */
+  async refresh(refreshToken) {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: this.config.clientId,
+      refresh_token: refreshToken
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const response = await this.post(await this.discovery.endpoint("token_endpoint"), body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Token refresh failed: ${await response.text()}`);
+    }
+    const tokens = await response.json();
+    if (!tokens.access_token) {
+      throw new AuthenticationError("The refresh response carried no access token.");
+    }
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token ?? null,
+      idToken: tokens.id_token ?? null,
+      expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0,
+      scope: typeof tokens.scope === "string" ? tokens.scope : null
+    };
+  }
   /**
    * The URL of the instance's hosted account/profile page (self-service password,
    * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox
@@ -491,6 +527,24 @@ function timingSafeEqualString(a, b) {
   }
   return mismatch === 0;
 }
+function parseOrganizations(claim) {
+  if (!Array.isArray(claim)) {
+    return void 0;
+  }
+  const orgs = [];
+  for (const entry of claim) {
+    if (typeof entry !== "object" || entry === null) {
+      continue;
+    }
+    const record = entry;
+    const id = record["id"];
+    const name = record["name"];
+    if (typeof id === "string" && id !== "" && typeof name === "string" && name !== "") {
+      orgs.push({ id, name, role: typeof record["role"] === "string" ? record["role"] : null });
+    }
+  }
+  return orgs;
+}
 
 // src/authz.ts
 function defineAuthz(declaration) {

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/discovery.ts","../src/pkce.ts","../src/vault.ts","../src/webhook.ts","../src/client.ts","../src/authz.ts"],"names":["key","createRemoteJWKSet","jwtVerify"],"mappings":";;;;;;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC;AAM9C,IAAM,iBAAA,GAAN,cAAgC,WAAA,CAAY;AAAC;AAM7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC;;;ACjB/C,IAAM,YAAN,MAAgB;AAAA,EAGrB,YACmB,MAAA,EACA,SAAA,EACA,UAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EAC1C;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAChB;AAAA,EAJgB,MAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,GAAA;AAAA,EANX,MAAA,GAA+D,IAAA;AAAA,EASvE,MAAM,QAAA,GAAuC;AAC3C,IAAA,IAAI,KAAK,MAAA,IAAU,IAAA,CAAK,OAAO,SAAA,GAAY,IAAA,CAAK,KAAI,EAAG;AACrD,MAAA,OAAO,KAAK,MAAA,CAAO,GAAA;AAAA,IACrB;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iCAAA,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC1F;AACA,MAAA,GAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACxC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,0BAAA,EAA6B,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAA,EAAK,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,KAAK,UAAA,EAAW;AAC7D,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAgD;AAC7D,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,IAAA,EAAuD;AAC5E,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,KAAK,KAAA,GAAQ,IAAA;AAAA,EAC7D;AACF,CAAA;;;AC3DA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;AAGO,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB;AAGA,eAAsB,UAAU,QAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACvF,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC;;;ACQO,IAAM,cAAN,MAAkB;AAAA,EAGvB,WAAA,CACE,MAAA,EACiB,KAAA,EACA,SAAA,GAAY,GAAA,EAC7B;AAFiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAEjB,IAAA,IAAA,CAAK,OAAO,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,aAAA,CAAA;AAAA,EAC1C;AAAA,EAJmB,KAAA;AAAA,EACA,SAAA;AAAA,EALF,IAAA;AAAA;AAAA,EAWjB,MAAM,KAAA,EAAkD;AACtD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY;AAAA,MACnD,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,YAAY,KAAA,CAAM,SAAA;AAAA,MAClB,UAAU,KAAA,CAAM,OAAA;AAAA,MAChB,YAAY,KAAA,CAAM;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAA,CAAO,UAAkB,MAAA,EAAyC;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAAA,EACxG;AAAA;AAAA,EAGA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAM,KAAK,OAAA,CAAQ,QAAA,EAAU,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACzE;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,QAAA,EACA,aAAA,EAC+E;AAC/E,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MAC1E,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB;AAAA,KAClB,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACf,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,UAAU,CAAA,CAAE,SAAA,EAAW,UAAU,CAAA,CAAE,SAAA,EAAW,aAAA,EAAe,CAAA,CAAE,eAAA,EAAgB;AAAA,IAC1F,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,QAAA,EAAkB,QAAA,EAAiC;AACnE,IAAA,MAAM,IAAA,CAAK,OAAA;AAAA,MACT,QAAA;AAAA,MACA,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,UAAkB,OAAA,EAAsC;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,mBAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU,EAAE,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACpG,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,QAAA,EAAU,CAAA,CAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW;AAAA,IAClG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,IAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA2C;AAC7F,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,OAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AACrG,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAoB;AAAA,QACxB,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,UACnC,GAAI,IAAA,GAAO,EAAE,cAAA,EAAgB,kBAAA,KAAuB;AAAC,SACvD;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACrB;AACA,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACjC;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA;AACxD,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,oBAAoB,CAAA,MAAA,EAAS,MAAM,IAAI,IAAI,CAAA,oBAAA,EAAuB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AACA,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;;;AC3HA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAEA,SAAS,MAAM,KAAA,EAA4B;AACzC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,CACpC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAgBA,eAAsB,cAAc,OAAA,EAAiD;AACnF,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAiB,MAAA,EAAO,GAAI,OAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,OAAA,IAAW,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,CAACA,MAAK,KAAK,CAAA,GAAI,QAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChD,IAAA,IAAIA,IAAAA,EAAK;AACP,MAAA,KAAA,CAAMA,IAAG,IAAI,KAAA,IAAS,EAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,GAAG,CAAA,IAAK,EAAA;AAChC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AAEjC,EAAA,IAAI,SAAA,KAAc,MAAM,SAAA,KAAc,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,QAAA,GAAW,KAAA;AAAA,IACf,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,EAAE,CAAC;AAAA,GAC3F;AAEA,EAAA,OAAO,eAAA,CAAgB,UAAU,SAAS,CAAA;AAC5C;;;ACjCO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAA6B,MAAA,EAAsB;AAAtB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,MAAM,IAAI,mBAAmB,wCAAwC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAA,CAAK,YAAY,IAAI,SAAA;AAAA,MACnB,MAAA,CAAO,MAAA;AAAA,MACP,OAAO,SAAA,IAAa,GAAA;AAAA,MACpB,OAAO,UAAA,IAAc;AAAA,KACvB;AAAA,EACF;AAAA,EAf6B,MAAA;AAAA,EAHZ,SAAA;AAAA,EACA,SAAA,uBAAgB,GAAA,EAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB3D,MAAM,0BAAA,CAA2B,OAAA,GAO7B,EAAC,EAAkC;AACrC,IAAA,MAAM,eAAe,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,CAAY,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,aAAA,EAAe,MAAA;AAAA,MACf,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,YAAA,EAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACjD,QAAQ,OAAA,CAAQ,MAAA,IAAU,KAAK,MAAA,EAAO,EAAG,KAAK,GAAG,CAAA;AAAA,MACjD,KAAA;AAAA,MACA,KAAA;AAAA,MACA,cAAA,EAAgB,MAAM,SAAA,CAAU,YAAY,CAAA;AAAA,MAC5C,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA;AAAA,IACrC;AACA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,YAAA,EAAc,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAO,YAAA,EAAc,KAAA,EAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,KAAA,EAIG;AACpB,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAE3B,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,qBAAA,CAAsB,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxF,MAAA,MAAM,IAAI,kBAAkB,0EAAqE,CAAA;AAAA,IACnG;AAEA,IAAA,IAAI,OAAO,KAAA,EAAO;AAChB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,EAAG,MAAA,CAAO,oBAAoB,CAAA,EAAA,EAAK,MAAA,CAAO,iBAAiB,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,OAC/G;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,MAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,IACjF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,IAAA,EAAM,MAAA,CAAO,YAAA,EAAc,KAAA,CAAM,WAAW,CAAA;AAEtF,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,SAAkC,EAAC;AACvC,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,OAAO,KAAK,CAAA;AAAA,IACjE;AAEA,IAAA,MAAA,GAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,EAAG;AAEpE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,MAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,IACxE;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA;AAAA,MACJ,KAAA,EAAO,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,IAAA;AAAA,MAC/D,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,IAAA;AAAA,MAC5D,cAAA,EAAgB,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,IAAA;AAAA,MACpE,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAAA,EAA2B;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA;AAC1E,IAAA,OAAO,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GAAK,IAAA;AAAA,EAC3F;AAAA;AAAA,EAGA,MAAM,UAAU,QAAA,EAA2C;AACzD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,sBAAsB,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,QAAA,GACH,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,wBAAA,EAA0B,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GACrF,QAAA;AAAA,EACN;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CAAa,OAAA,GAAoD,EAAC,EAAoB;AAC1F,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe,KAAK,aAAA;AAAc,KACnC,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC/C,MAAA,IAAA,CAAK,IAAI,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,EAAiC,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACxF;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,oBAAoB,yCAAyC,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,SAAS,WAAA,EAAuD;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAC1E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU;AAAA,MACrD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,0BAA0B,CAAA;AAAA,IAC1D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,KAAA,EAAiD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,aAAA,EAAe,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,CAAA;AAAA,MAC7B,EAAE,aAAA,EAAe,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA;AAAG,KACpC;AACA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,cAAc,OAAA,EAAiD;AAC7D,IAAA,OAAO,cAAc,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,EAAkC;AACtC,IAAA,OAAO,IAAI,YAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAAA,EACzF;AAAA,EAEA,MAAc,QAAA,CAAS,IAAA,EAAc,QAAA,EAAkB,WAAA,EAA8C;AACnG,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,YAAA,EAAc,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACzC,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,uBAAA,EAA0B,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACjF;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,aAAA,CAAc,OAAA,EAAiB,KAAA,EAAiD;AAC5F,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,UAAU,CAAA;AACxD,IAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAWC,uBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,SAAS,QAAA,EAAU;AAAA,QAChD,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,QACpB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,oCAAA,EAAuC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,OAAO,CAAA,KAAM,KAAA,EAAO;AACvC,MAAA,MAAM,IAAI,oBAAoB,0DAAqD,CAAA;AAAA,IACrF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,MAAA,GAAmB;AACzB,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA;AAC3B,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,QAAA,EAAU,WAAW,OAAO,CAAA;AAAA,EAC7E;AAAA,EAEQ,WAAA,GAAsB;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,MAAA,CAAO,WAAA;AACzB,IAAA,OAAO,IAAA,IAAQ,SAAS,EAAA,GAAK,CAAA,CAAA,EAAI,KAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,CAAA,GAAK,WAAA;AAAA,EAC/D;AAAA,EAEQ,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AAC7B,MAAA,MAAM,IAAI,mBAAmB,8DAA8D,CAAA;AAAA,IAC7F;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA;AAAA,EACrB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,IAAA,EAAuB,OAAA,GAAkC,EAAC,EAAsB;AACxG,IAAA,OAAO,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,GAAG,OAAA,EAAQ;AAAA,MAC3E;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAsC;AAChF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAClF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;AAGA,SAAS,qBAAA,CAAsB,GAAW,CAAA,EAAoB;AAC5D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;;;ACrRO,SAAS,YAAY,WAAA,EAA2D;AACrF,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,WAAA,IAAe,EAAC;AAChD,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAA,IAAS,EAAC;AACpC,EAAA,iBAAA,CAAkB,aAAa,KAAK,CAAA;AACpC,EAAA,OAAO,EAAE,aAAa,KAAA,EAAM;AAC9B;AAOA,eAAsB,cAAc,WAAA,EAAuD;AACzF,EAAA,MAAM,eAAe,WAAA,CAAY,WAAA,IAAe,EAAC,EAAG,IAAI,mBAAmB,CAAA;AAC3E,EAAA,MAAM,SAAS,WAAA,CAAY,KAAA,IAAS,EAAC,EAAG,IAAI,aAAa,CAAA;AACzD,EAAA,iBAAA,CAAkB,aAAa,KAAK,CAAA;AAEpC,EAAA,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,GAAA,CAAI,aAAA,CAAc,CAAA,CAAE,GAAG,CAAC,CAAA;AACrD,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,GAAA,CAAI,aAAA,CAAc,CAAA,CAAE,GAAG,CAAC,CAAA;AAE/C,EAAA,MAAM,OAAA,GAAA,CAAW,MAAM,SAAA,CAAU,IAAA,CAAK,SAAA,CAAU,EAAE,WAAA,EAAa,KAAA,EAAO,CAAC,CAAA,EAAG,KAAA,CAAM,GAAG,EAAE,CAAA;AACrF,EAAA,OAAO,EAAE,OAAA,EAAS,WAAA,EAAa,KAAA,EAAM;AACvC;AAeA,eAAsB,eAAA,CACpB,QACA,WAAA,EAC8B;AAC9B,EAAA,IAAI,CAAC,OAAO,MAAA,IAAU,CAAC,OAAO,QAAA,IAAY,CAAC,OAAO,YAAA,EAAc;AAC9D,IAAA,MAAM,IAAI,mBAAmB,gEAAgE,CAAA;AAAA,EAC/F;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACtC,EAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,WAAW,CAAA;AAChD,EAAA,MAAM,YAAY,IAAI,SAAA,CAAU,MAAA,CAAO,MAAA,EAAQ,WAAW,IAAS,CAAA;AAEnE,EAAA,MAAM,KAAA,GAAQ,MAAM,SAAA,CAAU,MAAA,EAAQ,WAAW,SAAS,CAAA;AAE1D,EAAA,MAAM,WAAW,MAAM,gBAAA;AAAA,IACrB,GAAG,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,qBAAA,CAAA;AAAA,IACnC;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA;AAAA,QAC9B,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,QAAQ;AAAA,KAC/B;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,2BAAA,EAA8B,QAAA,CAAS,MAAM,IAAI,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACxG;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,EAAA,OAAO,SAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,GAAY,OAA+B,EAAC;AACtF;AAEA,eAAe,SAAA,CACb,MAAA,EACA,SAAA,EACA,SAAA,EACiB;AACjB,EAAA,MAAM,WAAW,MAAM,gBAAA;AAAA,IACrB,MAAM,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA;AAAA,IACzC;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,oBAAA;AAAA,QACZ,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,MAAA,CAAO,YAAA;AAAA,QACtB,KAAA,EAAO;AAAA,OACR;AAAA,KACH;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,IAAY,IAAA,CAAK,iBAAiB,EAAA,EAAI;AACrE,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA,CAAK,YAAA;AACd;AAEA,SAAS,iBAAA,CAAkB,aAAqC,KAAA,EAA+B;AAC7F,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAAY;AACvC,EAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACpC,IAAA,IAAI,CAAC,WAAW,GAAA,EAAK;AACnB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,cAAA,CAAe,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,YAAA,EAAe,UAAA,CAAW,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC3F;AACA,IAAA,cAAA,CAAe,GAAA,CAAI,WAAW,GAAG,CAAA;AAAA,EACnC;AAEA,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AACjC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,CAAC,KAAK,GAAA,EAAK;AACb,MAAA,MAAM,IAAI,mBAAmB,qCAAqC,CAAA;AAAA,IACpE;AACA,IAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC/E;AACA,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC/E;AACA,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,GAAG,CAAA;AACrB,IAAA,KAAA,MAAW,SAAA,IAAa,KAAK,WAAA,EAAa;AACxC,MAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,SAAS,CAAA,EAAG;AAClC,QAAA,MAAM,IAAI,kBAAA;AAAA,UACR,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,yBAAA,EAA4B,SAAS,CAAA,yBAAA;AAAA,SACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,oBAAoB,UAAA,EAAwD;AACnF,EAAA,OAAO,UAAA,CAAW,WAAA,KAAgB,MAAA,GAC9B,EAAE,KAAK,UAAA,CAAW,GAAA,EAAI,GACtB,EAAE,GAAA,EAAK,UAAA,CAAW,GAAA,EAAK,WAAA,EAAa,WAAW,WAAA,EAAY;AACjE;AAGA,SAAS,cAAc,IAAA,EAAsC;AAC3D,EAAA,MAAM,WAAA,GAAc,CAAC,GAAG,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,gBAAgB,MAAA,GACxB,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,WAAA,KAClC,EAAE,GAAA,EAAK,KAAK,GAAA,EAAK,IAAA,EAAM,KAAK,IAAA,EAAM,WAAA,EAAa,IAAA,CAAK,WAAA,EAAa,WAAA,EAAY;AACnF;AAEA,eAAe,UAAU,KAAA,EAAgC;AACvD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AACpF,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACrC,IAAI,CAAC,IAAA,KAAS,KAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAChD,KAAK,EAAE,CAAA;AACZ;AAEA,eAAe,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAmB,SAAA,EAAsC;AACpG,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,EAChE,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AACF","file":"index.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n */\nexport class AuthenticationError extends CboxIdError {}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport type { DiscoveryDocument } from './types.js';\n\n/**\n * Fetches and caches an instance's OIDC discovery document. One instance of this\n * lives per {@link CboxIdClient}; the document is refetched only after the TTL.\n */\nexport class Discovery {\n  private cached: { doc: DiscoveryDocument; expiresAt: number } | null = null;\n\n  constructor(\n    private readonly issuer: string,\n    private readonly timeoutMs: number,\n    private readonly cacheTtlMs: number,\n    private readonly now: () => number = Date.now,\n  ) {}\n\n  async document(): Promise<DiscoveryDocument> {\n    if (this.cached && this.cached.expiresAt > this.now()) {\n      return this.cached.doc;\n    }\n\n    const url = `${this.issuer.replace(/\\/$/, '')}/.well-known/openid-configuration`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let doc: DiscoveryDocument;\n    try {\n      const response = await fetch(url, { signal: controller.signal });\n      if (!response.ok) {\n        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);\n      }\n      doc = (await response.json()) as DiscoveryDocument;\n    } catch (error) {\n      if (error instanceof AuthenticationError) {\n        throw error;\n      }\n      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (typeof doc.issuer !== 'string' || doc.issuer === '') {\n      throw new AuthenticationError('The discovery document was missing an issuer.');\n    }\n\n    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };\n    return doc;\n  }\n\n  /** A required endpoint from the discovery document. */\n  async endpoint(name: keyof DiscoveryDocument): Promise<string> {\n    const value = (await this.document())[name];\n    if (typeof value !== 'string' || value === '') {\n      throw new ConfigurationError(`The instance does not advertise a ${name}.`);\n    }\n    return value;\n  }\n\n  /** An optional endpoint, or null when the instance advertises none. */\n  async optionalEndpoint(name: keyof DiscoveryDocument): Promise<string | null> {\n    const value = (await this.document())[name];\n    return typeof value === 'string' && value !== '' ? value : null;\n  }\n}\n","/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n","import { AuthenticationError } from './errors.js';\n\n/** A stored vault secret's metadata (never its plaintext). */\nexport interface VaultSecretRef {\n  id: string;\n  name: string;\n  provider: string;\n  ownerType: string | null;\n  ownerId: string | null;\n  expiresAt: string | null;\n  revoked: boolean;\n}\n\n/** A brokered credential — the plaintext, for immediate use. */\nexport interface VaultLease {\n  secretId: string;\n  provider: string;\n  secret: string;\n  expiresAt: string;\n}\n\nexport interface StoreSecretInput {\n  name: string;\n  provider: string;\n  secret: string;\n  ownerType?: 'organization' | 'user';\n  ownerId?: string;\n  expiresAt?: string;\n}\n\n/**\n * Client for a Cbox ID instance's Token Vault API. Bind it to an access token\n * (obtain one with {@link CboxIdClient.machineToken}, scoped `vault.manage` for\n * provisioning or `vault.lease` for redeeming). All calls are server-to-server.\n */\nexport class VaultClient {\n  private readonly base: string;\n\n  constructor(\n    issuer: string,\n    private readonly token: string,\n    private readonly timeoutMs = 10_000,\n  ) {\n    this.base = `${issuer.replace(/\\/$/, '')}/api/v1/vault`;\n  }\n\n  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */\n  store(input: StoreSecretInput): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', '/secrets', {\n      name: input.name,\n      provider: input.provider,\n      secret: input.secret,\n      owner_type: input.ownerType,\n      owner_id: input.ownerId,\n      expires_at: input.expiresAt,\n    });\n  }\n\n  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */\n  rotate(secretId: string, secret: string): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });\n  }\n\n  /** Revoke a secret permanently (scope `vault.manage`). */\n  async revoke(secretId: string): Promise<void> {\n    await this.request('DELETE', `/secrets/${encodeURIComponent(secretId)}`);\n  }\n\n  /** Authorize an agent client to lease a secret (scope `vault.manage`). */\n  grant(\n    secretId: string,\n    clientId: string,\n    maxTtlSeconds?: number,\n  ): Promise<{ secretId: string; clientId: string; maxTtlSeconds: number | null }> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/grants`, {\n      client_id: clientId,\n      max_ttl_seconds: maxTtlSeconds,\n    }).then((raw) => {\n      const r = raw as { secret_id: string; client_id: string; max_ttl_seconds: number | null };\n      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };\n    });\n  }\n\n  /** Revoke an agent's authorization (scope `vault.manage`). */\n  async revokeGrant(secretId: string, clientId: string): Promise<void> {\n    await this.request(\n      'DELETE',\n      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`,\n    );\n  }\n\n  /**\n   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller\n   * is identified by the token's client; a lease with no live grant is refused.\n   */\n  lease(secretId: string, purpose: string): Promise<VaultLease> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {\n      const r = raw as { secret_id: string; provider: string; secret: string; expires_at: string };\n      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };\n    });\n  }\n\n  private async json<T>(method: string, path: string, body: Record<string, unknown>): Promise<T> {\n    const response = await this.request(method, path, body);\n    return (await response.json()) as T;\n  }\n\n  private async request(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    try {\n      const init: RequestInit = {\n        method,\n        headers: {\n          authorization: `Bearer ${this.token}`,\n          ...(body ? { 'content-type': 'application/json' } : {}),\n        },\n        signal: controller.signal,\n      };\n      if (body) {\n        init.body = JSON.stringify(body);\n      }\n      const response = await fetch(`${this.base}${path}`, init);\n      if (!response.ok) {\n        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);\n      }\n      return response;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n","/**\n * Verify a Cbox ID webhook / inline-action signature. The header is\n * `X-Cbox-Signature: t={unix},v1={hex hmac}` — an HMAC-SHA256 over\n * `\"{timestamp}.{raw body}\"`, valid within a freshness window. Built on Web Crypto\n * so it runs on Node, edge and the browser.\n */\n\n/** Constant-time compare of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport interface VerifyWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The value of the `X-Cbox-Signature` header. */\n  signatureHeader: string | null | undefined;\n  /** The signing secret issued when the webhook/action endpoint was registered. */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\n/** Returns `true` only when the signature is present, fresh and valid. Never throws. */\nexport async function verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n  const { payload, signatureHeader, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  if (!signatureHeader) {\n    return false;\n  }\n\n  const parts: Record<string, string> = {};\n  for (const segment of signatureHeader.split(',')) {\n    const [key, value] = segment.trim().split('=', 2);\n    if (key) {\n      parts[key] = value ?? '';\n    }\n  }\n\n  const timestamp = parts['t'] ?? '';\n  const signature = parts['v1'] ?? '';\n\n  if (timestamp === '' || signature === '' || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const expected = toHex(\n    await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${payload}`)),\n  );\n\n  return timingSafeEqual(expected, signature);\n}\n","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError, InvalidStateError } from './errors.js';\nimport { challenge, createVerifier, randomToken } from './pkce.js';\nimport type {\n  AuthorizationRequest,\n  CboxIdConfig,\n  CboxUser,\n  TokenResponse,\n} from './types.js';\nimport { VaultClient } from './vault.js';\nimport { verifyWebhook, type VerifyWebhookOptions } from './webhook.js';\n\ntype JwksResolver = ReturnType<typeof createRemoteJWKSet>;\n\n/** Query parameters as they arrive on your callback route. */\nexport interface CallbackParams {\n  code?: string | null;\n  state?: string | null;\n  error?: string | null;\n  error_description?: string | null;\n}\n\n/** The values you persisted from {@link CboxIdClient.createAuthorizationRequest}. */\nexport interface StoredAuthState {\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n}\n\n/**\n * Turnkey Cbox ID client for JavaScript/TypeScript. It speaks standard OpenID\n * Connect against a Cbox ID instance — so integrating is a redirect and a callback,\n * not a rewrite — and adds the conveniences a hosted-identity product needs: a\n * redirect to the instance's hosted profile page, and back-channel helpers (machine\n * tokens, userinfo, introspection, webhook verification).\n *\n * Login is hardened by default: PKCE (S256), a CSRF state check, a nonce, and full\n * id_token signature + issuer + audience verification against the instance's JWKS\n * (via `jose`).\n *\n * The class is framework-agnostic: {@link createAuthorizationRequest} hands you the\n * `state`, `codeVerifier` and `nonce` to persist however you like, and\n * {@link authenticate} takes them back. For Next.js, the `@cboxdk/id-js/nextjs`\n * entry wires this to cookies for you.\n */\nexport class CboxIdClient {\n  private readonly discovery: Discovery;\n  private readonly jwksByUri = new Map<string, JwksResolver>();\n\n  constructor(private readonly config: CboxIdConfig) {\n    if (!config.issuer) {\n      throw new ConfigurationError('Cbox ID config `issuer` is required.');\n    }\n    if (!config.clientId) {\n      throw new ConfigurationError('Cbox ID config `clientId` is required.');\n    }\n    if (!config.redirectUri) {\n      throw new ConfigurationError('Cbox ID config `redirectUri` is required.');\n    }\n    this.discovery = new Discovery(\n      config.issuer,\n      config.timeoutMs ?? 10_000,\n      config.cacheTtlMs ?? 3_600_000,\n    );\n  }\n\n  /**\n   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and\n   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back\n   * to {@link authenticate} on the callback.\n   */\n  async createAuthorizationRequest(options: {\n    scopes?: string[];\n    redirectUri?: string;\n    state?: string;\n    prompt?: string;\n    loginHint?: string;\n    maxAge?: number;\n  } = {}): Promise<AuthorizationRequest> {\n    const codeVerifier = createVerifier();\n    const state = options.state ?? randomToken(16);\n    const nonce = randomToken(16);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: options.redirectUri ?? this.config.redirectUri,\n      scope: (options.scopes ?? this.scopes()).join(' '),\n      state,\n      nonce,\n      code_challenge: await challenge(codeVerifier),\n      code_challenge_method: 'S256',\n    });\n    if (options.prompt) {\n      params.set('prompt', options.prompt);\n    }\n    if (options.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n    if (typeof options.maxAge === 'number') {\n      params.set('max_age', String(options.maxAge));\n    }\n\n    const endpoint = await this.discovery.endpoint('authorization_endpoint');\n    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };\n  }\n\n  /**\n   * Complete login on your callback route: verify state, exchange the code with the\n   * PKCE verifier, verify the id_token, and return the authenticated user.\n   *\n   * @throws InvalidStateError when state does not match (forged/stale request)\n   * @throws AuthenticationError on any other failure\n   */\n  async authenticate(input: {\n    params: CallbackParams;\n    stored: StoredAuthState;\n    redirectUri?: string;\n  }): Promise<CboxUser> {\n    const { params, stored } = input;\n\n    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {\n      throw new InvalidStateError('The login state did not match — the request may be forged or stale.');\n    }\n\n    if (params.error) {\n      throw new AuthenticationError(\n        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ''}`,\n      );\n    }\n\n    if (!params.code) {\n      throw new AuthenticationError('The callback was missing an authorization code.');\n    }\n\n    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);\n\n    if (!tokens.access_token) {\n      throw new AuthenticationError('No access token was returned.');\n    }\n\n    let claims: Record<string, unknown> = {};\n    if (tokens.id_token) {\n      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);\n    }\n    // Enrich with userinfo (email/name/org a minimal id_token may omit).\n    claims = { ...claims, ...(await this.userinfo(tokens.access_token)) };\n\n    const sub = claims['sub'];\n    if (typeof sub !== 'string' || sub === '') {\n      throw new AuthenticationError('The verified token carried no subject.');\n    }\n\n    return {\n      id: sub,\n      email: typeof claims['email'] === 'string' ? claims['email'] : null,\n      name: typeof claims['name'] === 'string' ? claims['name'] : null,\n      organizationId: typeof claims['org'] === 'string' ? claims['org'] : null,\n      claims,\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n    };\n  }\n\n  /**\n   * The URL of the instance's hosted account/profile page (self-service password,\n   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox\n   * ID session; `returnTo` is passed so the page can link back to your app.\n   */\n  profileUrl(returnTo?: string): string {\n    const base = `${this.config.issuer.replace(/\\/$/, '')}${this.accountPath()}`;\n    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;\n  }\n\n  /** The RP-initiated logout URL, or null when the instance advertises none. */\n  async logoutUrl(returnTo?: string): Promise<string | null> {\n    const endpoint = await this.discovery.optionalEndpoint('end_session_endpoint');\n    if (!endpoint) {\n      return null;\n    }\n    return returnTo\n      ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}`\n      : endpoint;\n  }\n\n  /**\n   * A machine (client-credentials) access token for calling Cbox ID APIs as your\n   * app, not on a user's behalf. Requires a client secret.\n   */\n  async machineToken(options: { scopes?: string[]; resource?: string } = {}): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.config.clientId,\n      client_secret: this.requireSecret(),\n    });\n    if (options.scopes && options.scopes.length > 0) {\n      body.set('scope', options.scopes.join(' '));\n    }\n    if (options.resource) {\n      body.set('resource', options.resource);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token?: unknown };\n    if (typeof json.access_token !== 'string') {\n      throw new AuthenticationError('The token response had no access_token.');\n    }\n    return json.access_token;\n  }\n\n  /** The OIDC userinfo claims for an access token. */\n  async userinfo(accessToken: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.optionalEndpoint('userinfo_endpoint');\n    if (!endpoint) {\n      return {};\n    }\n    const response = await this.fetchWithTimeout(endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    if (!response.ok) {\n      throw new AuthenticationError('Userinfo request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7662 token introspection (confidential-client auth). Returns the raw\n   * response; `active` tells you if the token is currently valid. Requires a secret.\n   */\n  async introspect(token: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.endpoint('introspection_endpoint');\n    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);\n    const response = await this.post(\n      endpoint,\n      new URLSearchParams({ token }),\n      { authorization: `Basic ${basic}` },\n    );\n    if (!response.ok) {\n      throw new AuthenticationError('Introspection request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */\n  verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n    return verifyWebhook(options);\n  }\n\n  /**\n   * A Token Vault client bound to an access token. Obtain the token with\n   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to\n   * redeem), then call `store` / `grant` / `lease` etc.\n   */\n  vault(accessToken: string): VaultClient {\n    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 10_000);\n  }\n\n  private async exchange(code: string, verifier: string, redirectUri?: string): Promise<TokenResponse> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri ?? this.config.redirectUri,\n      client_id: this.config.clientId,\n      code_verifier: verifier,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);\n    }\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async verifyIdToken(idToken: string, nonce: string): Promise<Record<string, unknown>> {\n    const jwksUri = await this.discovery.endpoint('jwks_uri');\n    let resolver = this.jwksByUri.get(jwksUri);\n    if (!resolver) {\n      resolver = createRemoteJWKSet(new URL(jwksUri));\n      this.jwksByUri.set(jwksUri, resolver);\n    }\n\n    let payload: JWTPayload;\n    try {\n      ({ payload } = await jwtVerify(idToken, resolver, {\n        issuer: this.config.issuer,\n        audience: this.config.clientId,\n      }));\n    } catch (error) {\n      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);\n    }\n\n    if (nonce && payload['nonce'] !== nonce) {\n      throw new AuthenticationError('The id_token nonce did not match — possible replay.');\n    }\n\n    return payload as Record<string, unknown>;\n  }\n\n  private scopes(): string[] {\n    const scopes = this.config.scopes;\n    return scopes && scopes.length > 0 ? scopes : ['openid', 'profile', 'email'];\n  }\n\n  private accountPath(): string {\n    const path = this.config.accountPath;\n    return path && path !== '' ? `/${path.replace(/^\\//, '')}` : '/settings';\n  }\n\n  private requireSecret(): string {\n    if (!this.config.clientSecret) {\n      throw new ConfigurationError('This call requires a `clientSecret`, but none is configured.');\n    }\n    return this.config.clientSecret;\n  }\n\n  private post(url: string, body: URLSearchParams, headers: Record<string, string> = {}): Promise<Response> {\n    return this.fetchWithTimeout(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded', ...headers },\n      body,\n    });\n  }\n\n  private async fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 10_000);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/** Constant-time string compare, so state validation doesn't leak via timing. */\nfunction timingSafeEqualString(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n","import { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError } from './errors.js';\n\n/**\n * A permission your app declares. `key` is a `feature:action` slug (e.g.\n * `invoices:create`); `description` is human-facing copy for the Cbox ID console.\n */\nexport interface PermissionDefinition {\n  key: string;\n  description?: string;\n}\n\n/**\n * A role your app declares. `permissions` lists the permission keys the role\n * grants — each must reference a declared {@link PermissionDefinition}.\n */\nexport interface RoleDefinition {\n  key: string;\n  name: string;\n  description?: string;\n  permissions: string[];\n}\n\n/**\n * The roles + permissions an app declares in code. Either list may be omitted.\n * Pass this to {@link defineAuthz} (to validate up front) or straight to\n * {@link buildManifest} / {@link publishManifest}.\n */\nexport interface AuthzDeclaration {\n  permissions?: PermissionDefinition[];\n  roles?: RoleDefinition[];\n}\n\n/**\n * The manifest as it is sent to Cbox ID: the declared permissions + roles plus a\n * content-derived `version`, so republishing an unchanged catalog is a no-op.\n */\nexport interface AuthzManifest {\n  version: string;\n  permissions: PermissionDefinition[];\n  roles: RoleDefinition[];\n}\n\n/** What {@link publishManifest} needs to authenticate the push. */\nexport interface ManifestPublisherConfig {\n  /** Base URL (issuer) of the Cbox ID instance — the `token_endpoint` is discovered from it. */\n  issuer: string;\n  /** Your OAuth client id. The client must hold the `apps.manifest` scope. */\n  clientId: string;\n  /** Your OAuth client secret. The push uses the client-credentials grant. */\n  clientSecret: string;\n  /** Timeout (ms) for back-channel HTTP calls. Defaults to `10000`. */\n  timeoutMs?: number;\n}\n\n/**\n * The server's sync summary. The named fields are the ones the SDK/CLI reads;\n * the index signature keeps any extra fields the server returns.\n */\nexport interface ManifestSyncSummary {\n  unchanged?: boolean;\n  roles_declared?: number;\n  permissions_declared?: number;\n  version?: string;\n  [key: string]: unknown;\n}\n\n/**\n * Validate a roles/permissions declaration and return it normalized (both lists\n * always present). Call this where you declare your catalog so mistakes — a role\n * that grants an undeclared permission, a duplicate key — surface immediately\n * rather than on deploy.\n *\n * @throws ConfigurationError on a missing key/name, a duplicate, or a role that\n *   references a permission that was never declared.\n */\nexport function defineAuthz(declaration: AuthzDeclaration): Required<AuthzDeclaration> {\n  const permissions = declaration.permissions ?? [];\n  const roles = declaration.roles ?? [];\n  assertDeclaration(permissions, roles);\n  return { permissions, roles };\n}\n\n/**\n * Build the manifest — the declared catalog plus a stable content hash `version`\n * (first 16 hex chars of the sha256 of the canonicalized catalog). The catalog is\n * sorted by key first, so declaration order never changes the version.\n */\nexport async function buildManifest(declaration: AuthzDeclaration): Promise<AuthzManifest> {\n  const permissions = (declaration.permissions ?? []).map(canonicalPermission);\n  const roles = (declaration.roles ?? []).map(canonicalRole);\n  assertDeclaration(permissions, roles);\n\n  permissions.sort((a, b) => a.key.localeCompare(b.key));\n  roles.sort((a, b) => a.key.localeCompare(b.key));\n\n  const version = (await sha256Hex(JSON.stringify({ permissions, roles }))).slice(0, 16);\n  return { version, permissions, roles };\n}\n\n/**\n * Publish this app's authorization manifest (its declared roles + permissions) to\n * Cbox ID. The app owns what a role means; Cbox ID owns identity and who holds it.\n *\n * It mints a client-credentials token with the `apps.manifest` scope (token\n * endpoint discovered from the issuer's OIDC configuration), then POSTs the\n * manifest to `{issuer}/api/v1/apps/manifest`. Run it on deploy or from a script;\n * an unchanged catalog is a server-side no-op.\n *\n * @returns the server's sync summary (`unchanged`, `roles_declared`, …).\n * @throws ConfigurationError when config or the declaration is invalid.\n * @throws AuthenticationError when the token cannot be minted or the push fails.\n */\nexport async function publishManifest(\n  config: ManifestPublisherConfig,\n  declaration: AuthzDeclaration,\n): Promise<ManifestSyncSummary> {\n  if (!config.issuer || !config.clientId || !config.clientSecret) {\n    throw new ConfigurationError('Publishing a manifest needs issuer, clientId and clientSecret.');\n  }\n\n  const timeoutMs = config.timeoutMs ?? 10_000;\n  const manifest = await buildManifest(declaration);\n  const discovery = new Discovery(config.issuer, timeoutMs, 3_600_000);\n\n  const token = await mintToken(config, discovery, timeoutMs);\n\n  const response = await fetchWithTimeout(\n    `${config.issuer.replace(/\\/$/, '')}/api/v1/apps/manifest`,\n    {\n      method: 'POST',\n      headers: {\n        authorization: `Bearer ${token}`,\n        accept: 'application/json',\n        'content-type': 'application/json',\n      },\n      body: JSON.stringify(manifest),\n    },\n    timeoutMs,\n  );\n\n  if (!response.ok) {\n    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status} ${await response.text()}`);\n  }\n\n  const json = (await response.json()) as unknown;\n  return json !== null && typeof json === 'object' ? (json as ManifestSyncSummary) : {};\n}\n\nasync function mintToken(\n  config: ManifestPublisherConfig,\n  discovery: Discovery,\n  timeoutMs: number,\n): Promise<string> {\n  const response = await fetchWithTimeout(\n    await discovery.endpoint('token_endpoint'),\n    {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'client_credentials',\n        client_id: config.clientId,\n        client_secret: config.clientSecret,\n        scope: 'apps.manifest',\n      }),\n    },\n    timeoutMs,\n  );\n\n  const json = (await response.json().catch(() => ({}))) as { access_token?: unknown };\n  if (typeof json.access_token !== 'string' || json.access_token === '') {\n    throw new AuthenticationError(\n      'Could not obtain an apps.manifest access token — check the client credentials and that the client holds the apps.manifest scope.',\n    );\n  }\n  return json.access_token;\n}\n\nfunction assertDeclaration(permissions: PermissionDefinition[], roles: RoleDefinition[]): void {\n  const permissionKeys = new Set<string>();\n  for (const permission of permissions) {\n    if (!permission.key) {\n      throw new ConfigurationError('Every permission needs a non-empty `key`.');\n    }\n    if (permissionKeys.has(permission.key)) {\n      throw new ConfigurationError(`Permission \"${permission.key}\" is declared more than once.`);\n    }\n    permissionKeys.add(permission.key);\n  }\n\n  const roleKeys = new Set<string>();\n  for (const role of roles) {\n    if (!role.key) {\n      throw new ConfigurationError('Every role needs a non-empty `key`.');\n    }\n    if (!role.name) {\n      throw new ConfigurationError(`Role \"${role.key}\" needs a non-empty \\`name\\`.`);\n    }\n    if (roleKeys.has(role.key)) {\n      throw new ConfigurationError(`Role \"${role.key}\" is declared more than once.`);\n    }\n    roleKeys.add(role.key);\n    for (const reference of role.permissions) {\n      if (!permissionKeys.has(reference)) {\n        throw new ConfigurationError(\n          `Role \"${role.key}\" references permission \"${reference}\", which is not declared.`,\n        );\n      }\n    }\n  }\n}\n\n/** A permission with keys in a fixed order and no `undefined` fields (stable to hash). */\nfunction canonicalPermission(permission: PermissionDefinition): PermissionDefinition {\n  return permission.description === undefined\n    ? { key: permission.key }\n    : { key: permission.key, description: permission.description };\n}\n\n/** A role with keys in a fixed order, sorted permission refs, and no `undefined` fields. */\nfunction canonicalRole(role: RoleDefinition): RoleDefinition {\n  const permissions = [...role.permissions].sort((a, b) => a.localeCompare(b));\n  return role.description === undefined\n    ? { key: role.key, name: role.name, permissions }\n    : { key: role.key, name: role.name, description: role.description, permissions };\n}\n\nasync function sha256Hex(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nasync function fetchWithTimeout(url: string, init: RequestInit, timeoutMs: number): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    return await fetch(url, { ...init, signal: controller.signal });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/discovery.ts","../src/pkce.ts","../src/vault.ts","../src/webhook.ts","../src/client.ts","../src/authz.ts"],"names":["key","createRemoteJWKSet","jwtVerify"],"mappings":";;;;;;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC;AAM9C,IAAM,iBAAA,GAAN,cAAgC,WAAA,CAAY;AAAC;AAM7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC;;;ACjB/C,IAAM,YAAN,MAAgB;AAAA,EAGrB,YACmB,MAAA,EACA,SAAA,EACA,UAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EAC1C;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAChB;AAAA,EAJgB,MAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,GAAA;AAAA,EANX,MAAA,GAA+D,IAAA;AAAA,EASvE,MAAM,QAAA,GAAuC;AAC3C,IAAA,IAAI,KAAK,MAAA,IAAU,IAAA,CAAK,OAAO,SAAA,GAAY,IAAA,CAAK,KAAI,EAAG;AACrD,MAAA,OAAO,KAAK,MAAA,CAAO,GAAA;AAAA,IACrB;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iCAAA,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC1F;AACA,MAAA,GAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACxC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,0BAAA,EAA6B,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAA,EAAK,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,KAAK,UAAA,EAAW;AAC7D,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAgD;AAC7D,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,IAAA,EAAuD;AAC5E,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,KAAK,KAAA,GAAQ,IAAA;AAAA,EAC7D;AACF,CAAA;;;AC3DA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;AAGO,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB;AAGA,eAAsB,UAAU,QAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACvF,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC;;;ACQO,IAAM,cAAN,MAAkB;AAAA,EAGvB,WAAA,CACE,MAAA,EACiB,KAAA,EACA,SAAA,GAAY,GAAA,EAC7B;AAFiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAEjB,IAAA,IAAA,CAAK,OAAO,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,aAAA,CAAA;AAAA,EAC1C;AAAA,EAJmB,KAAA;AAAA,EACA,SAAA;AAAA,EALF,IAAA;AAAA;AAAA,EAWjB,MAAM,KAAA,EAAkD;AACtD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY;AAAA,MACnD,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,YAAY,KAAA,CAAM,SAAA;AAAA,MAClB,UAAU,KAAA,CAAM,OAAA;AAAA,MAChB,YAAY,KAAA,CAAM;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAA,CAAO,UAAkB,MAAA,EAAyC;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAAA,EACxG;AAAA;AAAA,EAGA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAM,KAAK,OAAA,CAAQ,QAAA,EAAU,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACzE;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,QAAA,EACA,aAAA,EAC+E;AAC/E,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MAC1E,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB;AAAA,KAClB,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACf,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,UAAU,CAAA,CAAE,SAAA,EAAW,UAAU,CAAA,CAAE,SAAA,EAAW,aAAA,EAAe,CAAA,CAAE,eAAA,EAAgB;AAAA,IAC1F,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,QAAA,EAAkB,QAAA,EAAiC;AACnE,IAAA,MAAM,IAAA,CAAK,OAAA;AAAA,MACT,QAAA;AAAA,MACA,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,UAAkB,OAAA,EAAsC;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,mBAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU,EAAE,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACpG,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,QAAA,EAAU,CAAA,CAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW;AAAA,IAClG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,IAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA2C;AAC7F,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,OAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AACrG,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAoB;AAAA,QACxB,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,UACnC,GAAI,IAAA,GAAO,EAAE,cAAA,EAAgB,kBAAA,KAAuB;AAAC,SACvD;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACrB;AACA,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACjC;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA;AACxD,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,oBAAoB,CAAA,MAAA,EAAS,MAAM,IAAI,IAAI,CAAA,oBAAA,EAAuB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AACA,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;;;AC3HA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAEA,SAAS,MAAM,KAAA,EAA4B;AACzC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,CACpC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAgBA,eAAsB,cAAc,OAAA,EAAiD;AACnF,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAiB,MAAA,EAAO,GAAI,OAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,OAAA,IAAW,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,CAACA,MAAK,KAAK,CAAA,GAAI,QAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChD,IAAA,IAAIA,IAAAA,EAAK;AACP,MAAA,KAAA,CAAMA,IAAG,IAAI,KAAA,IAAS,EAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,GAAG,CAAA,IAAK,EAAA;AAChC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AAEjC,EAAA,IAAI,SAAA,KAAc,MAAM,SAAA,KAAc,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,QAAA,GAAW,KAAA;AAAA,IACf,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,EAAE,CAAC;AAAA,GAC3F;AAEA,EAAA,OAAO,eAAA,CAAgB,UAAU,SAAS,CAAA;AAC5C;;;AC/BO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAA6B,MAAA,EAAsB;AAAtB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,MAAM,IAAI,mBAAmB,wCAAwC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAA,CAAK,YAAY,IAAI,SAAA;AAAA,MACnB,MAAA,CAAO,MAAA;AAAA,MACP,OAAO,SAAA,IAAa,GAAA;AAAA,MACpB,OAAO,UAAA,IAAc;AAAA,KACvB;AAAA,EACF;AAAA,EAf6B,MAAA;AAAA,EAHZ,SAAA;AAAA,EACA,SAAA,uBAAgB,GAAA,EAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB3D,MAAM,0BAAA,CAA2B,OAAA,GAO7B,EAAC,EAAkC;AACrC,IAAA,MAAM,eAAe,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,CAAY,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,aAAA,EAAe,MAAA;AAAA,MACf,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,YAAA,EAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACjD,QAAQ,OAAA,CAAQ,MAAA,IAAU,KAAK,MAAA,EAAO,EAAG,KAAK,GAAG,CAAA;AAAA,MACjD,KAAA;AAAA,MACA,KAAA;AAAA,MACA,cAAA,EAAgB,MAAM,SAAA,CAAU,YAAY,CAAA;AAAA,MAC5C,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA;AAAA,IACrC;AACA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,YAAA,EAAc,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAO,YAAA,EAAc,KAAA,EAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,KAAA,EAIG;AACpB,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAE3B,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,qBAAA,CAAsB,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxF,MAAA,MAAM,IAAI,kBAAkB,0EAAqE,CAAA;AAAA,IACnG;AAEA,IAAA,IAAI,OAAO,KAAA,EAAO;AAChB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,EAAG,MAAA,CAAO,oBAAoB,CAAA,EAAA,EAAK,MAAA,CAAO,iBAAiB,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,OAC/G;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,MAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,IACjF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,IAAA,EAAM,MAAA,CAAO,YAAA,EAAc,KAAA,CAAM,WAAW,CAAA;AAEtF,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,SAAkC,EAAC;AACvC,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,OAAO,KAAK,CAAA;AAAA,IACjE;AAEA,IAAA,MAAA,GAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,EAAG;AAEpE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,MAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,MAAA,CAAO,eAAe,CAAC,CAAA;AAEhE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA;AAAA,MACJ,KAAA,EAAO,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,IAAA;AAAA,MAC/D,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,IAAA;AAAA,MAC5D,cAAA,EAAgB,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,IAAA;AAAA;AAAA,MAEpE,GAAI,aAAA,GAAgB,EAAE,aAAA,KAAkB,EAAC;AAAA,MACzC,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,YAAA,EAAgD;AAC5D,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,eAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,sBAAA,EAAyB,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IAChF;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,OAAO;AAAA,MACL,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa,CAAA;AAAA,MACvE,OAAO,OAAO,MAAA,CAAO,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAAA,EAA2B;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA;AAC1E,IAAA,OAAO,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GAAK,IAAA;AAAA,EAC3F;AAAA;AAAA,EAGA,MAAM,UAAU,QAAA,EAA2C;AACzD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,sBAAsB,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,QAAA,GACH,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,wBAAA,EAA0B,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GACrF,QAAA;AAAA,EACN;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CAAa,OAAA,GAAoD,EAAC,EAAoB;AAC1F,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe,KAAK,aAAA;AAAc,KACnC,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC/C,MAAA,IAAA,CAAK,IAAI,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,EAAiC,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACxF;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,oBAAoB,yCAAyC,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,SAAS,WAAA,EAAuD;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAC1E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU;AAAA,MACrD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,0BAA0B,CAAA;AAAA,IAC1D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,KAAA,EAAiD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,aAAA,EAAe,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,CAAA;AAAA,MAC7B,EAAE,aAAA,EAAe,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA;AAAG,KACpC;AACA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,cAAc,OAAA,EAAiD;AAC7D,IAAA,OAAO,cAAc,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,EAAkC;AACtC,IAAA,OAAO,IAAI,YAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAAA,EACzF;AAAA,EAEA,MAAc,QAAA,CAAS,IAAA,EAAc,QAAA,EAAkB,WAAA,EAA8C;AACnG,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,YAAA,EAAc,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACzC,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,uBAAA,EAA0B,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACjF;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,aAAA,CAAc,OAAA,EAAiB,KAAA,EAAiD;AAC5F,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,UAAU,CAAA;AACxD,IAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAWC,uBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,SAAS,QAAA,EAAU;AAAA,QAChD,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,QACpB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,oCAAA,EAAuC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,OAAO,CAAA,KAAM,KAAA,EAAO;AACvC,MAAA,MAAM,IAAI,oBAAoB,0DAAqD,CAAA;AAAA,IACrF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,MAAA,GAAmB;AACzB,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA;AAC3B,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,QAAA,EAAU,WAAW,OAAO,CAAA;AAAA,EAC7E;AAAA,EAEQ,WAAA,GAAsB;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,MAAA,CAAO,WAAA;AACzB,IAAA,OAAO,IAAA,IAAQ,SAAS,EAAA,GAAK,CAAA,CAAA,EAAI,KAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,CAAA,GAAK,WAAA;AAAA,EAC/D;AAAA,EAEQ,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AAC7B,MAAA,MAAM,IAAI,mBAAmB,8DAA8D,CAAA;AAAA,IAC7F;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA;AAAA,EACrB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,IAAA,EAAuB,OAAA,GAAkC,EAAC,EAAsB;AACxG,IAAA,OAAO,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,GAAG,OAAA,EAAQ;AAAA,MAC3E;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAsC;AAChF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAClF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;AAGA,SAAS,qBAAA,CAAsB,GAAW,CAAA,EAAoB;AAC5D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAOA,SAAS,mBAAmB,KAAA,EAAgD;AAC1E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,OAA2B,EAAC;AAClC,EAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,MAAM,EAAA,GAAK,OAAO,IAAI,CAAA;AACtB,IAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,KAAO,MAAM,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,EAAA,EAAI;AAClF,MAAA,IAAA,CAAK,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,MAAM,OAAO,MAAA,CAAO,MAAM,CAAA,KAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,MAAM,CAAA;AAAA,IAC1F;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;;;ACxVO,SAAS,YAAY,WAAA,EAA2D;AACrF,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,WAAA,IAAe,EAAC;AAChD,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAA,IAAS,EAAC;AACpC,EAAA,iBAAA,CAAkB,aAAa,KAAK,CAAA;AACpC,EAAA,OAAO,EAAE,aAAa,KAAA,EAAM;AAC9B;AAOA,eAAsB,cAAc,WAAA,EAAuD;AACzF,EAAA,MAAM,eAAe,WAAA,CAAY,WAAA,IAAe,EAAC,EAAG,IAAI,mBAAmB,CAAA;AAC3E,EAAA,MAAM,SAAS,WAAA,CAAY,KAAA,IAAS,EAAC,EAAG,IAAI,aAAa,CAAA;AACzD,EAAA,iBAAA,CAAkB,aAAa,KAAK,CAAA;AAEpC,EAAA,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,GAAA,CAAI,aAAA,CAAc,CAAA,CAAE,GAAG,CAAC,CAAA;AACrD,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,GAAA,CAAI,aAAA,CAAc,CAAA,CAAE,GAAG,CAAC,CAAA;AAE/C,EAAA,MAAM,OAAA,GAAA,CAAW,MAAM,SAAA,CAAU,IAAA,CAAK,SAAA,CAAU,EAAE,WAAA,EAAa,KAAA,EAAO,CAAC,CAAA,EAAG,KAAA,CAAM,GAAG,EAAE,CAAA;AACrF,EAAA,OAAO,EAAE,OAAA,EAAS,WAAA,EAAa,KAAA,EAAM;AACvC;AAeA,eAAsB,eAAA,CACpB,QACA,WAAA,EAC8B;AAC9B,EAAA,IAAI,CAAC,OAAO,MAAA,IAAU,CAAC,OAAO,QAAA,IAAY,CAAC,OAAO,YAAA,EAAc;AAC9D,IAAA,MAAM,IAAI,mBAAmB,gEAAgE,CAAA;AAAA,EAC/F;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACtC,EAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,WAAW,CAAA;AAChD,EAAA,MAAM,YAAY,IAAI,SAAA,CAAU,MAAA,CAAO,MAAA,EAAQ,WAAW,IAAS,CAAA;AAEnE,EAAA,MAAM,KAAA,GAAQ,MAAM,SAAA,CAAU,MAAA,EAAQ,WAAW,SAAS,CAAA;AAE1D,EAAA,MAAM,WAAW,MAAM,gBAAA;AAAA,IACrB,GAAG,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,qBAAA,CAAA;AAAA,IACnC;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA;AAAA,QAC9B,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,QAAQ;AAAA,KAC/B;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,2BAAA,EAA8B,QAAA,CAAS,MAAM,IAAI,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACxG;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,EAAA,OAAO,SAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,GAAY,OAA+B,EAAC;AACtF;AAEA,eAAe,SAAA,CACb,MAAA,EACA,SAAA,EACA,SAAA,EACiB;AACjB,EAAA,MAAM,WAAW,MAAM,gBAAA;AAAA,IACrB,MAAM,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA;AAAA,IACzC;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,oBAAA;AAAA,QACZ,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,MAAA,CAAO,YAAA;AAAA,QACtB,KAAA,EAAO;AAAA,OACR;AAAA,KACH;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,IAAY,IAAA,CAAK,iBAAiB,EAAA,EAAI;AACrE,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA,CAAK,YAAA;AACd;AAEA,SAAS,iBAAA,CAAkB,aAAqC,KAAA,EAA+B;AAC7F,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAAY;AACvC,EAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACpC,IAAA,IAAI,CAAC,WAAW,GAAA,EAAK;AACnB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,cAAA,CAAe,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,YAAA,EAAe,UAAA,CAAW,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC3F;AACA,IAAA,cAAA,CAAe,GAAA,CAAI,WAAW,GAAG,CAAA;AAAA,EACnC;AAEA,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AACjC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,CAAC,KAAK,GAAA,EAAK;AACb,MAAA,MAAM,IAAI,mBAAmB,qCAAqC,CAAA;AAAA,IACpE;AACA,IAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC/E;AACA,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC/E;AACA,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,GAAG,CAAA;AACrB,IAAA,KAAA,MAAW,SAAA,IAAa,KAAK,WAAA,EAAa;AACxC,MAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,SAAS,CAAA,EAAG;AAClC,QAAA,MAAM,IAAI,kBAAA;AAAA,UACR,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,yBAAA,EAA4B,SAAS,CAAA,yBAAA;AAAA,SACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,oBAAoB,UAAA,EAAwD;AACnF,EAAA,OAAO,UAAA,CAAW,WAAA,KAAgB,MAAA,GAC9B,EAAE,KAAK,UAAA,CAAW,GAAA,EAAI,GACtB,EAAE,GAAA,EAAK,UAAA,CAAW,GAAA,EAAK,WAAA,EAAa,WAAW,WAAA,EAAY;AACjE;AAGA,SAAS,cAAc,IAAA,EAAsC;AAC3D,EAAA,MAAM,WAAA,GAAc,CAAC,GAAG,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,gBAAgB,MAAA,GACxB,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,WAAA,KAClC,EAAE,GAAA,EAAK,KAAK,GAAA,EAAK,IAAA,EAAM,KAAK,IAAA,EAAM,WAAA,EAAa,IAAA,CAAK,WAAA,EAAa,WAAA,EAAY;AACnF;AAEA,eAAe,UAAU,KAAA,EAAgC;AACvD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AACpF,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACrC,IAAI,CAAC,IAAA,KAAS,KAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAChD,KAAK,EAAE,CAAA;AACZ;AAEA,eAAe,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAmB,SAAA,EAAsC;AACpG,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,EAChE,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AACF","file":"index.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n */\nexport class AuthenticationError extends CboxIdError {}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport type { DiscoveryDocument } from './types.js';\n\n/**\n * Fetches and caches an instance's OIDC discovery document. One instance of this\n * lives per {@link CboxIdClient}; the document is refetched only after the TTL.\n */\nexport class Discovery {\n  private cached: { doc: DiscoveryDocument; expiresAt: number } | null = null;\n\n  constructor(\n    private readonly issuer: string,\n    private readonly timeoutMs: number,\n    private readonly cacheTtlMs: number,\n    private readonly now: () => number = Date.now,\n  ) {}\n\n  async document(): Promise<DiscoveryDocument> {\n    if (this.cached && this.cached.expiresAt > this.now()) {\n      return this.cached.doc;\n    }\n\n    const url = `${this.issuer.replace(/\\/$/, '')}/.well-known/openid-configuration`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let doc: DiscoveryDocument;\n    try {\n      const response = await fetch(url, { signal: controller.signal });\n      if (!response.ok) {\n        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);\n      }\n      doc = (await response.json()) as DiscoveryDocument;\n    } catch (error) {\n      if (error instanceof AuthenticationError) {\n        throw error;\n      }\n      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (typeof doc.issuer !== 'string' || doc.issuer === '') {\n      throw new AuthenticationError('The discovery document was missing an issuer.');\n    }\n\n    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };\n    return doc;\n  }\n\n  /** A required endpoint from the discovery document. */\n  async endpoint(name: keyof DiscoveryDocument): Promise<string> {\n    const value = (await this.document())[name];\n    if (typeof value !== 'string' || value === '') {\n      throw new ConfigurationError(`The instance does not advertise a ${name}.`);\n    }\n    return value;\n  }\n\n  /** An optional endpoint, or null when the instance advertises none. */\n  async optionalEndpoint(name: keyof DiscoveryDocument): Promise<string | null> {\n    const value = (await this.document())[name];\n    return typeof value === 'string' && value !== '' ? value : null;\n  }\n}\n","/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n","import { AuthenticationError } from './errors.js';\n\n/** A stored vault secret's metadata (never its plaintext). */\nexport interface VaultSecretRef {\n  id: string;\n  name: string;\n  provider: string;\n  ownerType: string | null;\n  ownerId: string | null;\n  expiresAt: string | null;\n  revoked: boolean;\n}\n\n/** A brokered credential — the plaintext, for immediate use. */\nexport interface VaultLease {\n  secretId: string;\n  provider: string;\n  secret: string;\n  expiresAt: string;\n}\n\nexport interface StoreSecretInput {\n  name: string;\n  provider: string;\n  secret: string;\n  ownerType?: 'organization' | 'user';\n  ownerId?: string;\n  expiresAt?: string;\n}\n\n/**\n * Client for a Cbox ID instance's Token Vault API. Bind it to an access token\n * (obtain one with {@link CboxIdClient.machineToken}, scoped `vault.manage` for\n * provisioning or `vault.lease` for redeeming). All calls are server-to-server.\n */\nexport class VaultClient {\n  private readonly base: string;\n\n  constructor(\n    issuer: string,\n    private readonly token: string,\n    private readonly timeoutMs = 10_000,\n  ) {\n    this.base = `${issuer.replace(/\\/$/, '')}/api/v1/vault`;\n  }\n\n  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */\n  store(input: StoreSecretInput): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', '/secrets', {\n      name: input.name,\n      provider: input.provider,\n      secret: input.secret,\n      owner_type: input.ownerType,\n      owner_id: input.ownerId,\n      expires_at: input.expiresAt,\n    });\n  }\n\n  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */\n  rotate(secretId: string, secret: string): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });\n  }\n\n  /** Revoke a secret permanently (scope `vault.manage`). */\n  async revoke(secretId: string): Promise<void> {\n    await this.request('DELETE', `/secrets/${encodeURIComponent(secretId)}`);\n  }\n\n  /** Authorize an agent client to lease a secret (scope `vault.manage`). */\n  grant(\n    secretId: string,\n    clientId: string,\n    maxTtlSeconds?: number,\n  ): Promise<{ secretId: string; clientId: string; maxTtlSeconds: number | null }> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/grants`, {\n      client_id: clientId,\n      max_ttl_seconds: maxTtlSeconds,\n    }).then((raw) => {\n      const r = raw as { secret_id: string; client_id: string; max_ttl_seconds: number | null };\n      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };\n    });\n  }\n\n  /** Revoke an agent's authorization (scope `vault.manage`). */\n  async revokeGrant(secretId: string, clientId: string): Promise<void> {\n    await this.request(\n      'DELETE',\n      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`,\n    );\n  }\n\n  /**\n   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller\n   * is identified by the token's client; a lease with no live grant is refused.\n   */\n  lease(secretId: string, purpose: string): Promise<VaultLease> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {\n      const r = raw as { secret_id: string; provider: string; secret: string; expires_at: string };\n      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };\n    });\n  }\n\n  private async json<T>(method: string, path: string, body: Record<string, unknown>): Promise<T> {\n    const response = await this.request(method, path, body);\n    return (await response.json()) as T;\n  }\n\n  private async request(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    try {\n      const init: RequestInit = {\n        method,\n        headers: {\n          authorization: `Bearer ${this.token}`,\n          ...(body ? { 'content-type': 'application/json' } : {}),\n        },\n        signal: controller.signal,\n      };\n      if (body) {\n        init.body = JSON.stringify(body);\n      }\n      const response = await fetch(`${this.base}${path}`, init);\n      if (!response.ok) {\n        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);\n      }\n      return response;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n","/**\n * Verify a Cbox ID webhook / inline-action signature. The header is\n * `X-Cbox-Signature: t={unix},v1={hex hmac}` — an HMAC-SHA256 over\n * `\"{timestamp}.{raw body}\"`, valid within a freshness window. Built on Web Crypto\n * so it runs on Node, edge and the browser.\n */\n\n/** Constant-time compare of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport interface VerifyWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The value of the `X-Cbox-Signature` header. */\n  signatureHeader: string | null | undefined;\n  /** The signing secret issued when the webhook/action endpoint was registered. */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\n/** Returns `true` only when the signature is present, fresh and valid. Never throws. */\nexport async function verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n  const { payload, signatureHeader, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  if (!signatureHeader) {\n    return false;\n  }\n\n  const parts: Record<string, string> = {};\n  for (const segment of signatureHeader.split(',')) {\n    const [key, value] = segment.trim().split('=', 2);\n    if (key) {\n      parts[key] = value ?? '';\n    }\n  }\n\n  const timestamp = parts['t'] ?? '';\n  const signature = parts['v1'] ?? '';\n\n  if (timestamp === '' || signature === '' || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const expected = toHex(\n    await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${payload}`)),\n  );\n\n  return timingSafeEqual(expected, signature);\n}\n","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError, InvalidStateError } from './errors.js';\nimport { challenge, createVerifier, randomToken } from './pkce.js';\nimport type {\n  AuthorizationRequest,\n  CboxIdConfig,\n  CboxOrganization,\n  CboxUser,\n  RefreshedTokens,\n  TokenResponse,\n} from './types.js';\nimport { VaultClient } from './vault.js';\nimport { verifyWebhook, type VerifyWebhookOptions } from './webhook.js';\n\ntype JwksResolver = ReturnType<typeof createRemoteJWKSet>;\n\n/** Query parameters as they arrive on your callback route. */\nexport interface CallbackParams {\n  code?: string | null;\n  state?: string | null;\n  error?: string | null;\n  error_description?: string | null;\n}\n\n/** The values you persisted from {@link CboxIdClient.createAuthorizationRequest}. */\nexport interface StoredAuthState {\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n}\n\n/**\n * Turnkey Cbox ID client for JavaScript/TypeScript. It speaks standard OpenID\n * Connect against a Cbox ID instance — so integrating is a redirect and a callback,\n * not a rewrite — and adds the conveniences a hosted-identity product needs: a\n * redirect to the instance's hosted profile page, and back-channel helpers (machine\n * tokens, userinfo, introspection, webhook verification).\n *\n * Login is hardened by default: PKCE (S256), a CSRF state check, a nonce, and full\n * id_token signature + issuer + audience verification against the instance's JWKS\n * (via `jose`).\n *\n * The class is framework-agnostic: {@link createAuthorizationRequest} hands you the\n * `state`, `codeVerifier` and `nonce` to persist however you like, and\n * {@link authenticate} takes them back. For Next.js, the `@cboxdk/id-js/nextjs`\n * entry wires this to cookies for you.\n */\nexport class CboxIdClient {\n  private readonly discovery: Discovery;\n  private readonly jwksByUri = new Map<string, JwksResolver>();\n\n  constructor(private readonly config: CboxIdConfig) {\n    if (!config.issuer) {\n      throw new ConfigurationError('Cbox ID config `issuer` is required.');\n    }\n    if (!config.clientId) {\n      throw new ConfigurationError('Cbox ID config `clientId` is required.');\n    }\n    if (!config.redirectUri) {\n      throw new ConfigurationError('Cbox ID config `redirectUri` is required.');\n    }\n    this.discovery = new Discovery(\n      config.issuer,\n      config.timeoutMs ?? 10_000,\n      config.cacheTtlMs ?? 3_600_000,\n    );\n  }\n\n  /**\n   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and\n   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back\n   * to {@link authenticate} on the callback.\n   */\n  async createAuthorizationRequest(options: {\n    scopes?: string[];\n    redirectUri?: string;\n    state?: string;\n    prompt?: string;\n    loginHint?: string;\n    maxAge?: number;\n  } = {}): Promise<AuthorizationRequest> {\n    const codeVerifier = createVerifier();\n    const state = options.state ?? randomToken(16);\n    const nonce = randomToken(16);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: options.redirectUri ?? this.config.redirectUri,\n      scope: (options.scopes ?? this.scopes()).join(' '),\n      state,\n      nonce,\n      code_challenge: await challenge(codeVerifier),\n      code_challenge_method: 'S256',\n    });\n    if (options.prompt) {\n      params.set('prompt', options.prompt);\n    }\n    if (options.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n    if (typeof options.maxAge === 'number') {\n      params.set('max_age', String(options.maxAge));\n    }\n\n    const endpoint = await this.discovery.endpoint('authorization_endpoint');\n    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };\n  }\n\n  /**\n   * Complete login on your callback route: verify state, exchange the code with the\n   * PKCE verifier, verify the id_token, and return the authenticated user.\n   *\n   * @throws InvalidStateError when state does not match (forged/stale request)\n   * @throws AuthenticationError on any other failure\n   */\n  async authenticate(input: {\n    params: CallbackParams;\n    stored: StoredAuthState;\n    redirectUri?: string;\n  }): Promise<CboxUser> {\n    const { params, stored } = input;\n\n    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {\n      throw new InvalidStateError('The login state did not match — the request may be forged or stale.');\n    }\n\n    if (params.error) {\n      throw new AuthenticationError(\n        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ''}`,\n      );\n    }\n\n    if (!params.code) {\n      throw new AuthenticationError('The callback was missing an authorization code.');\n    }\n\n    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);\n\n    if (!tokens.access_token) {\n      throw new AuthenticationError('No access token was returned.');\n    }\n\n    let claims: Record<string, unknown> = {};\n    if (tokens.id_token) {\n      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);\n    }\n    // Enrich with userinfo (email/name/org a minimal id_token may omit).\n    claims = { ...claims, ...(await this.userinfo(tokens.access_token)) };\n\n    const sub = claims['sub'];\n    if (typeof sub !== 'string' || sub === '') {\n      throw new AuthenticationError('The verified token carried no subject.');\n    }\n\n    const organizations = parseOrganizations(claims['organizations']);\n\n    return {\n      id: sub,\n      email: typeof claims['email'] === 'string' ? claims['email'] : null,\n      name: typeof claims['name'] === 'string' ? claims['name'] : null,\n      organizationId: typeof claims['org'] === 'string' ? claims['org'] : null,\n      // Only present when the instance emitted the claim (exactOptionalPropertyTypes).\n      ...(organizations ? { organizations } : {}),\n      claims,\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n    };\n  }\n\n  /**\n   * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`\n   * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the\n   * returned `refreshToken` and discard the one you passed — presenting a rotated\n   * token again revokes the entire token family.\n   *\n   * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.\n   */\n  async refresh(refreshToken: string): Promise<RefreshedTokens> {\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.config.clientId,\n      refresh_token: refreshToken,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token refresh failed: ${await response.text()}`);\n    }\n\n    const tokens = (await response.json()) as TokenResponse;\n    if (!tokens.access_token) {\n      throw new AuthenticationError('The refresh response carried no access token.');\n    }\n\n    return {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n      scope: typeof tokens.scope === 'string' ? tokens.scope : null,\n    };\n  }\n\n  /**\n   * The URL of the instance's hosted account/profile page (self-service password,\n   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox\n   * ID session; `returnTo` is passed so the page can link back to your app.\n   */\n  profileUrl(returnTo?: string): string {\n    const base = `${this.config.issuer.replace(/\\/$/, '')}${this.accountPath()}`;\n    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;\n  }\n\n  /** The RP-initiated logout URL, or null when the instance advertises none. */\n  async logoutUrl(returnTo?: string): Promise<string | null> {\n    const endpoint = await this.discovery.optionalEndpoint('end_session_endpoint');\n    if (!endpoint) {\n      return null;\n    }\n    return returnTo\n      ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}`\n      : endpoint;\n  }\n\n  /**\n   * A machine (client-credentials) access token for calling Cbox ID APIs as your\n   * app, not on a user's behalf. Requires a client secret.\n   */\n  async machineToken(options: { scopes?: string[]; resource?: string } = {}): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.config.clientId,\n      client_secret: this.requireSecret(),\n    });\n    if (options.scopes && options.scopes.length > 0) {\n      body.set('scope', options.scopes.join(' '));\n    }\n    if (options.resource) {\n      body.set('resource', options.resource);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token?: unknown };\n    if (typeof json.access_token !== 'string') {\n      throw new AuthenticationError('The token response had no access_token.');\n    }\n    return json.access_token;\n  }\n\n  /** The OIDC userinfo claims for an access token. */\n  async userinfo(accessToken: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.optionalEndpoint('userinfo_endpoint');\n    if (!endpoint) {\n      return {};\n    }\n    const response = await this.fetchWithTimeout(endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    if (!response.ok) {\n      throw new AuthenticationError('Userinfo request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7662 token introspection (confidential-client auth). Returns the raw\n   * response; `active` tells you if the token is currently valid. Requires a secret.\n   */\n  async introspect(token: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.endpoint('introspection_endpoint');\n    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);\n    const response = await this.post(\n      endpoint,\n      new URLSearchParams({ token }),\n      { authorization: `Basic ${basic}` },\n    );\n    if (!response.ok) {\n      throw new AuthenticationError('Introspection request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */\n  verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n    return verifyWebhook(options);\n  }\n\n  /**\n   * A Token Vault client bound to an access token. Obtain the token with\n   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to\n   * redeem), then call `store` / `grant` / `lease` etc.\n   */\n  vault(accessToken: string): VaultClient {\n    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 10_000);\n  }\n\n  private async exchange(code: string, verifier: string, redirectUri?: string): Promise<TokenResponse> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri ?? this.config.redirectUri,\n      client_id: this.config.clientId,\n      code_verifier: verifier,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);\n    }\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async verifyIdToken(idToken: string, nonce: string): Promise<Record<string, unknown>> {\n    const jwksUri = await this.discovery.endpoint('jwks_uri');\n    let resolver = this.jwksByUri.get(jwksUri);\n    if (!resolver) {\n      resolver = createRemoteJWKSet(new URL(jwksUri));\n      this.jwksByUri.set(jwksUri, resolver);\n    }\n\n    let payload: JWTPayload;\n    try {\n      ({ payload } = await jwtVerify(idToken, resolver, {\n        issuer: this.config.issuer,\n        audience: this.config.clientId,\n      }));\n    } catch (error) {\n      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);\n    }\n\n    if (nonce && payload['nonce'] !== nonce) {\n      throw new AuthenticationError('The id_token nonce did not match — possible replay.');\n    }\n\n    return payload as Record<string, unknown>;\n  }\n\n  private scopes(): string[] {\n    const scopes = this.config.scopes;\n    return scopes && scopes.length > 0 ? scopes : ['openid', 'profile', 'email'];\n  }\n\n  private accountPath(): string {\n    const path = this.config.accountPath;\n    return path && path !== '' ? `/${path.replace(/^\\//, '')}` : '/settings';\n  }\n\n  private requireSecret(): string {\n    if (!this.config.clientSecret) {\n      throw new ConfigurationError('This call requires a `clientSecret`, but none is configured.');\n    }\n    return this.config.clientSecret;\n  }\n\n  private post(url: string, body: URLSearchParams, headers: Record<string, string> = {}): Promise<Response> {\n    return this.fetchWithTimeout(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded', ...headers },\n      body,\n    });\n  }\n\n  private async fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 10_000);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/** Constant-time string compare, so state validation doesn't leak via timing. */\nfunction timingSafeEqualString(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\n/**\n * Parse an `organizations` claim into typed orgs, ignoring anything malformed. The\n * claim is optional and instance-specific; absent or non-array → undefined, so\n * callers can tell \"no claim\" from \"empty\".\n */\nfunction parseOrganizations(claim: unknown): CboxOrganization[] | undefined {\n  if (!Array.isArray(claim)) {\n    return undefined;\n  }\n  const orgs: CboxOrganization[] = [];\n  for (const entry of claim) {\n    if (typeof entry !== 'object' || entry === null) {\n      continue;\n    }\n    const record = entry as Record<string, unknown>;\n    const id = record['id'];\n    const name = record['name'];\n    if (typeof id === 'string' && id !== '' && typeof name === 'string' && name !== '') {\n      orgs.push({ id, name, role: typeof record['role'] === 'string' ? record['role'] : null });\n    }\n  }\n  return orgs;\n}\n","import { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError } from './errors.js';\n\n/**\n * A permission your app declares. `key` is a `feature:action` slug (e.g.\n * `invoices:create`); `description` is human-facing copy for the Cbox ID console.\n */\nexport interface PermissionDefinition {\n  key: string;\n  description?: string;\n}\n\n/**\n * A role your app declares. `permissions` lists the permission keys the role\n * grants — each must reference a declared {@link PermissionDefinition}.\n */\nexport interface RoleDefinition {\n  key: string;\n  name: string;\n  description?: string;\n  permissions: string[];\n}\n\n/**\n * The roles + permissions an app declares in code. Either list may be omitted.\n * Pass this to {@link defineAuthz} (to validate up front) or straight to\n * {@link buildManifest} / {@link publishManifest}.\n */\nexport interface AuthzDeclaration {\n  permissions?: PermissionDefinition[];\n  roles?: RoleDefinition[];\n}\n\n/**\n * The manifest as it is sent to Cbox ID: the declared permissions + roles plus a\n * content-derived `version`, so republishing an unchanged catalog is a no-op.\n */\nexport interface AuthzManifest {\n  version: string;\n  permissions: PermissionDefinition[];\n  roles: RoleDefinition[];\n}\n\n/** What {@link publishManifest} needs to authenticate the push. */\nexport interface ManifestPublisherConfig {\n  /** Base URL (issuer) of the Cbox ID instance — the `token_endpoint` is discovered from it. */\n  issuer: string;\n  /** Your OAuth client id. The client must hold the `apps.manifest` scope. */\n  clientId: string;\n  /** Your OAuth client secret. The push uses the client-credentials grant. */\n  clientSecret: string;\n  /** Timeout (ms) for back-channel HTTP calls. Defaults to `10000`. */\n  timeoutMs?: number;\n}\n\n/**\n * The server's sync summary. The named fields are the ones the SDK/CLI reads;\n * the index signature keeps any extra fields the server returns.\n */\nexport interface ManifestSyncSummary {\n  unchanged?: boolean;\n  roles_declared?: number;\n  permissions_declared?: number;\n  version?: string;\n  [key: string]: unknown;\n}\n\n/**\n * Validate a roles/permissions declaration and return it normalized (both lists\n * always present). Call this where you declare your catalog so mistakes — a role\n * that grants an undeclared permission, a duplicate key — surface immediately\n * rather than on deploy.\n *\n * @throws ConfigurationError on a missing key/name, a duplicate, or a role that\n *   references a permission that was never declared.\n */\nexport function defineAuthz(declaration: AuthzDeclaration): Required<AuthzDeclaration> {\n  const permissions = declaration.permissions ?? [];\n  const roles = declaration.roles ?? [];\n  assertDeclaration(permissions, roles);\n  return { permissions, roles };\n}\n\n/**\n * Build the manifest — the declared catalog plus a stable content hash `version`\n * (first 16 hex chars of the sha256 of the canonicalized catalog). The catalog is\n * sorted by key first, so declaration order never changes the version.\n */\nexport async function buildManifest(declaration: AuthzDeclaration): Promise<AuthzManifest> {\n  const permissions = (declaration.permissions ?? []).map(canonicalPermission);\n  const roles = (declaration.roles ?? []).map(canonicalRole);\n  assertDeclaration(permissions, roles);\n\n  permissions.sort((a, b) => a.key.localeCompare(b.key));\n  roles.sort((a, b) => a.key.localeCompare(b.key));\n\n  const version = (await sha256Hex(JSON.stringify({ permissions, roles }))).slice(0, 16);\n  return { version, permissions, roles };\n}\n\n/**\n * Publish this app's authorization manifest (its declared roles + permissions) to\n * Cbox ID. The app owns what a role means; Cbox ID owns identity and who holds it.\n *\n * It mints a client-credentials token with the `apps.manifest` scope (token\n * endpoint discovered from the issuer's OIDC configuration), then POSTs the\n * manifest to `{issuer}/api/v1/apps/manifest`. Run it on deploy or from a script;\n * an unchanged catalog is a server-side no-op.\n *\n * @returns the server's sync summary (`unchanged`, `roles_declared`, …).\n * @throws ConfigurationError when config or the declaration is invalid.\n * @throws AuthenticationError when the token cannot be minted or the push fails.\n */\nexport async function publishManifest(\n  config: ManifestPublisherConfig,\n  declaration: AuthzDeclaration,\n): Promise<ManifestSyncSummary> {\n  if (!config.issuer || !config.clientId || !config.clientSecret) {\n    throw new ConfigurationError('Publishing a manifest needs issuer, clientId and clientSecret.');\n  }\n\n  const timeoutMs = config.timeoutMs ?? 10_000;\n  const manifest = await buildManifest(declaration);\n  const discovery = new Discovery(config.issuer, timeoutMs, 3_600_000);\n\n  const token = await mintToken(config, discovery, timeoutMs);\n\n  const response = await fetchWithTimeout(\n    `${config.issuer.replace(/\\/$/, '')}/api/v1/apps/manifest`,\n    {\n      method: 'POST',\n      headers: {\n        authorization: `Bearer ${token}`,\n        accept: 'application/json',\n        'content-type': 'application/json',\n      },\n      body: JSON.stringify(manifest),\n    },\n    timeoutMs,\n  );\n\n  if (!response.ok) {\n    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status} ${await response.text()}`);\n  }\n\n  const json = (await response.json()) as unknown;\n  return json !== null && typeof json === 'object' ? (json as ManifestSyncSummary) : {};\n}\n\nasync function mintToken(\n  config: ManifestPublisherConfig,\n  discovery: Discovery,\n  timeoutMs: number,\n): Promise<string> {\n  const response = await fetchWithTimeout(\n    await discovery.endpoint('token_endpoint'),\n    {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'client_credentials',\n        client_id: config.clientId,\n        client_secret: config.clientSecret,\n        scope: 'apps.manifest',\n      }),\n    },\n    timeoutMs,\n  );\n\n  const json = (await response.json().catch(() => ({}))) as { access_token?: unknown };\n  if (typeof json.access_token !== 'string' || json.access_token === '') {\n    throw new AuthenticationError(\n      'Could not obtain an apps.manifest access token — check the client credentials and that the client holds the apps.manifest scope.',\n    );\n  }\n  return json.access_token;\n}\n\nfunction assertDeclaration(permissions: PermissionDefinition[], roles: RoleDefinition[]): void {\n  const permissionKeys = new Set<string>();\n  for (const permission of permissions) {\n    if (!permission.key) {\n      throw new ConfigurationError('Every permission needs a non-empty `key`.');\n    }\n    if (permissionKeys.has(permission.key)) {\n      throw new ConfigurationError(`Permission \"${permission.key}\" is declared more than once.`);\n    }\n    permissionKeys.add(permission.key);\n  }\n\n  const roleKeys = new Set<string>();\n  for (const role of roles) {\n    if (!role.key) {\n      throw new ConfigurationError('Every role needs a non-empty `key`.');\n    }\n    if (!role.name) {\n      throw new ConfigurationError(`Role \"${role.key}\" needs a non-empty \\`name\\`.`);\n    }\n    if (roleKeys.has(role.key)) {\n      throw new ConfigurationError(`Role \"${role.key}\" is declared more than once.`);\n    }\n    roleKeys.add(role.key);\n    for (const reference of role.permissions) {\n      if (!permissionKeys.has(reference)) {\n        throw new ConfigurationError(\n          `Role \"${role.key}\" references permission \"${reference}\", which is not declared.`,\n        );\n      }\n    }\n  }\n}\n\n/** A permission with keys in a fixed order and no `undefined` fields (stable to hash). */\nfunction canonicalPermission(permission: PermissionDefinition): PermissionDefinition {\n  return permission.description === undefined\n    ? { key: permission.key }\n    : { key: permission.key, description: permission.description };\n}\n\n/** A role with keys in a fixed order, sorted permission refs, and no `undefined` fields. */\nfunction canonicalRole(role: RoleDefinition): RoleDefinition {\n  const permissions = [...role.permissions].sort((a, b) => a.localeCompare(b));\n  return role.description === undefined\n    ? { key: role.key, name: role.name, permissions }\n    : { key: role.key, name: role.name, description: role.description, permissions };\n}\n\nasync function sha256Hex(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nasync function fetchWithTimeout(url: string, init: RequestInit, timeoutMs: number): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    return await fetch(url, { ...init, signal: controller.signal });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n"]}

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AuthorizationRequest, C as CallbackParams, a as CboxIdClient, b as CboxIdConfig, c as CboxUser, D as DiscoveryDocument, S as StoreSecretInput, d as StoredAuthState, T as TokenResponse, V as VaultClient, e as VaultLease, f as VaultSecretRef, g as VerifyWebhookOptions, v as verifyWebhook } from './client-CjmGxfIA.cjs';
+export { A as AuthorizationRequest, C as CallbackParams, a as CboxIdClient, b as CboxIdConfig, c as CboxUser, D as DiscoveryDocument, R as RefreshedTokens, S as StoreSecretInput, d as StoredAuthState, T as TokenResponse, V as VaultClient, e as VaultLease, f as VaultSecretRef, g as VerifyWebhookOptions, v as verifyWebhook } from './client-BJ8m6qgt.cjs';
 
 /**
  * Base class for every error this SDK throws, so callers can `catch (e) { if (e

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AuthorizationRequest, C as CallbackParams, a as CboxIdClient, b as CboxIdConfig, c as CboxUser, D as DiscoveryDocument, S as StoreSecretInput, d as StoredAuthState, T as TokenResponse, V as VaultClient, e as VaultLease, f as VaultSecretRef, g as VerifyWebhookOptions, v as verifyWebhook } from './client-CjmGxfIA.js';
+export { A as AuthorizationRequest, C as CallbackParams, a as CboxIdClient, b as CboxIdConfig, c as CboxUser, D as DiscoveryDocument, R as RefreshedTokens, S as StoreSecretInput, d as StoredAuthState, T as TokenResponse, V as VaultClient, e as VaultLease, f as VaultSecretRef, g as VerifyWebhookOptions, v as verifyWebhook } from './client-BJ8m6qgt.js';
 
 /**
  * Base class for every error this SDK throws, so callers can `catch (e) { if (e

package/dist/index.js

@@ -1,5 +1,5 @@
-import { ConfigurationError, Discovery, AuthenticationError } from './chunk-U6KYO2XA.js';
-export { AuthenticationError, CboxIdClient, CboxIdError, ConfigurationError, InvalidStateError, VaultClient, challenge, createVerifier, randomToken, verifyWebhook } from './chunk-U6KYO2XA.js';
+import { ConfigurationError, Discovery, AuthenticationError } from './chunk-J4GSNFRQ.js';
+export { AuthenticationError, CboxIdClient, CboxIdError, ConfigurationError, InvalidStateError, VaultClient, challenge, createVerifier, randomToken, verifyWebhook } from './chunk-J4GSNFRQ.js';
 
 // src/authz.ts
 function defineAuthz(declaration) {

package/dist/nextjs.cjs

@@ -315,11 +315,14 @@ var CboxIdClient = class {
     if (typeof sub !== "string" || sub === "") {
       throw new AuthenticationError("The verified token carried no subject.");
     }
+    const organizations = parseOrganizations(claims["organizations"]);
     return {
       id: sub,
       email: typeof claims["email"] === "string" ? claims["email"] : null,
       name: typeof claims["name"] === "string" ? claims["name"] : null,
       organizationId: typeof claims["org"] === "string" ? claims["org"] : null,
+      // Only present when the instance emitted the claim (exactOptionalPropertyTypes).
+      ...organizations ? { organizations } : {},
       claims,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? null,
@@ -327,6 +330,39 @@ var CboxIdClient = class {
       expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0
     };
   }
+  /**
+   * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`
+   * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the
+   * returned `refreshToken` and discard the one you passed — presenting a rotated
+   * token again revokes the entire token family.
+   *
+   * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.
+   */
+  async refresh(refreshToken) {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: this.config.clientId,
+      refresh_token: refreshToken
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const response = await this.post(await this.discovery.endpoint("token_endpoint"), body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Token refresh failed: ${await response.text()}`);
+    }
+    const tokens = await response.json();
+    if (!tokens.access_token) {
+      throw new AuthenticationError("The refresh response carried no access token.");
+    }
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token ?? null,
+      idToken: tokens.id_token ?? null,
+      expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0,
+      scope: typeof tokens.scope === "string" ? tokens.scope : null
+    };
+  }
   /**
    * The URL of the instance's hosted account/profile page (self-service password,
    * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox
@@ -492,6 +528,24 @@ function timingSafeEqualString(a, b) {
   }
   return mismatch === 0;
 }
+function parseOrganizations(claim) {
+  if (!Array.isArray(claim)) {
+    return void 0;
+  }
+  const orgs = [];
+  for (const entry of claim) {
+    if (typeof entry !== "object" || entry === null) {
+      continue;
+    }
+    const record = entry;
+    const id = record["id"];
+    const name = record["name"];
+    if (typeof id === "string" && id !== "" && typeof name === "string" && name !== "") {
+      orgs.push({ id, name, role: typeof record["role"] === "string" ? record["role"] : null });
+    }
+  }
+  return orgs;
+}
 
 // src/nextjs.ts
 var COOKIE = {

package/dist/nextjs.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/discovery.ts","../src/pkce.ts","../src/vault.ts","../src/webhook.ts","../src/client.ts","../src/nextjs.ts"],"names":["key","createRemoteJWKSet","jwtVerify","NextResponse"],"mappings":";;;;;;;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC,CAAA;AAM9C,IAAM,iBAAA,GAAN,cAAgC,WAAA,CAAY;AAAC,CAAA;AAM7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC,CAAA;;;ACjB/C,IAAM,YAAN,MAAgB;AAAA,EAGrB,YACmB,MAAA,EACA,SAAA,EACA,UAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EAC1C;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAChB;AAAA,EAJgB,MAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,GAAA;AAAA,EANX,MAAA,GAA+D,IAAA;AAAA,EASvE,MAAM,QAAA,GAAuC;AAC3C,IAAA,IAAI,KAAK,MAAA,IAAU,IAAA,CAAK,OAAO,SAAA,GAAY,IAAA,CAAK,KAAI,EAAG;AACrD,MAAA,OAAO,KAAK,MAAA,CAAO,GAAA;AAAA,IACrB;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iCAAA,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC1F;AACA,MAAA,GAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACxC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,0BAAA,EAA6B,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAA,EAAK,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,KAAK,UAAA,EAAW;AAC7D,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAgD;AAC7D,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,IAAA,EAAuD;AAC5E,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,KAAK,KAAA,GAAQ,IAAA;AAAA,EAC7D;AACF,CAAA;;;AC3DA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;AAGO,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB;AAGA,eAAsB,UAAU,QAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACvF,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC;;;ACQO,IAAM,cAAN,MAAkB;AAAA,EAGvB,WAAA,CACE,MAAA,EACiB,KAAA,EACA,SAAA,GAAY,GAAA,EAC7B;AAFiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAEjB,IAAA,IAAA,CAAK,OAAO,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,aAAA,CAAA;AAAA,EAC1C;AAAA,EAJmB,KAAA;AAAA,EACA,SAAA;AAAA,EALF,IAAA;AAAA;AAAA,EAWjB,MAAM,KAAA,EAAkD;AACtD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY;AAAA,MACnD,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,YAAY,KAAA,CAAM,SAAA;AAAA,MAClB,UAAU,KAAA,CAAM,OAAA;AAAA,MAChB,YAAY,KAAA,CAAM;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAA,CAAO,UAAkB,MAAA,EAAyC;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAAA,EACxG;AAAA;AAAA,EAGA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAM,KAAK,OAAA,CAAQ,QAAA,EAAU,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACzE;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,QAAA,EACA,aAAA,EAC+E;AAC/E,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MAC1E,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB;AAAA,KAClB,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACf,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,UAAU,CAAA,CAAE,SAAA,EAAW,UAAU,CAAA,CAAE,SAAA,EAAW,aAAA,EAAe,CAAA,CAAE,eAAA,EAAgB;AAAA,IAC1F,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,QAAA,EAAkB,QAAA,EAAiC;AACnE,IAAA,MAAM,IAAA,CAAK,OAAA;AAAA,MACT,QAAA;AAAA,MACA,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,UAAkB,OAAA,EAAsC;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,mBAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU,EAAE,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACpG,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,QAAA,EAAU,CAAA,CAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW;AAAA,IAClG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,IAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA2C;AAC7F,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,OAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AACrG,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAoB;AAAA,QACxB,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,UACnC,GAAI,IAAA,GAAO,EAAE,cAAA,EAAgB,kBAAA,KAAuB;AAAC,SACvD;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACrB;AACA,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACjC;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA;AACxD,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,oBAAoB,CAAA,MAAA,EAAS,MAAM,IAAI,IAAI,CAAA,oBAAA,EAAuB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AACA,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF,CAAA;;;AC3HA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAEA,SAAS,MAAM,KAAA,EAA4B;AACzC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,CACpC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAgBA,eAAsB,cAAc,OAAA,EAAiD;AACnF,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAiB,MAAA,EAAO,GAAI,OAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,OAAA,IAAW,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,CAACA,MAAK,KAAK,CAAA,GAAI,QAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChD,IAAA,IAAIA,IAAAA,EAAK;AACP,MAAA,KAAA,CAAMA,IAAG,IAAI,KAAA,IAAS,EAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,GAAG,CAAA,IAAK,EAAA;AAChC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AAEjC,EAAA,IAAI,SAAA,KAAc,MAAM,SAAA,KAAc,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,QAAA,GAAW,KAAA;AAAA,IACf,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,EAAE,CAAC;AAAA,GAC3F;AAEA,EAAA,OAAO,eAAA,CAAgB,UAAU,SAAS,CAAA;AAC5C;;;ACjCO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAA6B,MAAA,EAAsB;AAAtB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,MAAM,IAAI,mBAAmB,wCAAwC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAA,CAAK,YAAY,IAAI,SAAA;AAAA,MACnB,MAAA,CAAO,MAAA;AAAA,MACP,OAAO,SAAA,IAAa,GAAA;AAAA,MACpB,OAAO,UAAA,IAAc;AAAA,KACvB;AAAA,EACF;AAAA,EAf6B,MAAA;AAAA,EAHZ,SAAA;AAAA,EACA,SAAA,uBAAgB,GAAA,EAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB3D,MAAM,0BAAA,CAA2B,OAAA,GAO7B,EAAC,EAAkC;AACrC,IAAA,MAAM,eAAe,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,CAAY,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,aAAA,EAAe,MAAA;AAAA,MACf,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,YAAA,EAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACjD,QAAQ,OAAA,CAAQ,MAAA,IAAU,KAAK,MAAA,EAAO,EAAG,KAAK,GAAG,CAAA;AAAA,MACjD,KAAA;AAAA,MACA,KAAA;AAAA,MACA,cAAA,EAAgB,MAAM,SAAA,CAAU,YAAY,CAAA;AAAA,MAC5C,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA;AAAA,IACrC;AACA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,YAAA,EAAc,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAO,YAAA,EAAc,KAAA,EAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,KAAA,EAIG;AACpB,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAE3B,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,qBAAA,CAAsB,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxF,MAAA,MAAM,IAAI,kBAAkB,0EAAqE,CAAA;AAAA,IACnG;AAEA,IAAA,IAAI,OAAO,KAAA,EAAO;AAChB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,EAAG,MAAA,CAAO,oBAAoB,CAAA,EAAA,EAAK,MAAA,CAAO,iBAAiB,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,OAC/G;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,MAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,IACjF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,IAAA,EAAM,MAAA,CAAO,YAAA,EAAc,KAAA,CAAM,WAAW,CAAA;AAEtF,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,SAAkC,EAAC;AACvC,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,OAAO,KAAK,CAAA;AAAA,IACjE;AAEA,IAAA,MAAA,GAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,EAAG;AAEpE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,MAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,IACxE;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA;AAAA,MACJ,KAAA,EAAO,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,IAAA;AAAA,MAC/D,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,IAAA;AAAA,MAC5D,cAAA,EAAgB,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,IAAA;AAAA,MACpE,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAAA,EAA2B;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA;AAC1E,IAAA,OAAO,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GAAK,IAAA;AAAA,EAC3F;AAAA;AAAA,EAGA,MAAM,UAAU,QAAA,EAA2C;AACzD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,sBAAsB,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,QAAA,GACH,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,wBAAA,EAA0B,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GACrF,QAAA;AAAA,EACN;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CAAa,OAAA,GAAoD,EAAC,EAAoB;AAC1F,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe,KAAK,aAAA;AAAc,KACnC,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC/C,MAAA,IAAA,CAAK,IAAI,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,EAAiC,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACxF;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,oBAAoB,yCAAyC,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,SAAS,WAAA,EAAuD;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAC1E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU;AAAA,MACrD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,0BAA0B,CAAA;AAAA,IAC1D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,KAAA,EAAiD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,aAAA,EAAe,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,CAAA;AAAA,MAC7B,EAAE,aAAA,EAAe,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA;AAAG,KACpC;AACA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,cAAc,OAAA,EAAiD;AAC7D,IAAA,OAAO,cAAc,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,EAAkC;AACtC,IAAA,OAAO,IAAI,YAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAAA,EACzF;AAAA,EAEA,MAAc,QAAA,CAAS,IAAA,EAAc,QAAA,EAAkB,WAAA,EAA8C;AACnG,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,YAAA,EAAc,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACzC,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,uBAAA,EAA0B,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACjF;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,aAAA,CAAc,OAAA,EAAiB,KAAA,EAAiD;AAC5F,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,UAAU,CAAA;AACxD,IAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAWC,uBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,SAAS,QAAA,EAAU;AAAA,QAChD,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,QACpB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,oCAAA,EAAuC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,OAAO,CAAA,KAAM,KAAA,EAAO;AACvC,MAAA,MAAM,IAAI,oBAAoB,0DAAqD,CAAA;AAAA,IACrF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,MAAA,GAAmB;AACzB,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA;AAC3B,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,QAAA,EAAU,WAAW,OAAO,CAAA;AAAA,EAC7E;AAAA,EAEQ,WAAA,GAAsB;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,MAAA,CAAO,WAAA;AACzB,IAAA,OAAO,IAAA,IAAQ,SAAS,EAAA,GAAK,CAAA,CAAA,EAAI,KAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,CAAA,GAAK,WAAA;AAAA,EAC/D;AAAA,EAEQ,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AAC7B,MAAA,MAAM,IAAI,mBAAmB,8DAA8D,CAAA;AAAA,IAC7F;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA;AAAA,EACrB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,IAAA,EAAuB,OAAA,GAAkC,EAAC,EAAsB;AACxG,IAAA,OAAO,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,GAAG,OAAA,EAAQ;AAAA,MAC3E;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAsC;AAChF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAClF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF,CAAA;AAGA,SAAS,qBAAA,CAAsB,GAAW,CAAA,EAAoB;AAC5D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;;;AC1UA,IAAM,MAAA,GAAS;AAAA,EACb,KAAA,EAAO,eAAA;AAAA,EACP,QAAA,EAAU,kBAAA;AAAA,EACV,KAAA,EAAO;AACT,CAAA;AAEA,IAAM,mBAAA,GAAsB,GAAA;AAsBrB,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,MAAM,QAAA,GAAW,cAAc,MAAM,CAAA;AACrC,EAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAa,QAAQ,CAAA;AAExC,EAAA,MAAM,iBAAA,GAAoB;AAAA,IACxB,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU,KAAA;AAAA,IACV,IAAA,EAAM,GAAA;AAAA,IACN,MAAA,EAAQ;AAAA,GACV;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IAEA,MAAM,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,0BAAA,CAA2B,OAAO,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAWC,mBAAA,CAAa,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAClD,MAAA,QAAA,CAAS,QAAQ,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,OAAA,CAAQ,OAAO,iBAAiB,CAAA;AACnE,MAAA,QAAA,CAAS,QAAQ,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,OAAA,CAAQ,cAAc,iBAAiB,CAAA;AAC7E,MAAA,QAAA,CAAS,QAAQ,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,OAAA,CAAQ,OAAO,iBAAiB,CAAA;AACnE,MAAA,OAAO,QAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,SAAS,OAAA,EAAS;AACtB,MAAA,OAAO,OAAO,YAAA,CAAa;AAAA,QACzB,MAAA,EAAQ;AAAA,UACN,IAAA,EAAM,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,MAAM,CAAA;AAAA,UAC7C,KAAA,EAAO,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,OAAO,CAAA;AAAA,UAC/C,KAAA,EAAO,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,OAAO,CAAA;AAAA,UAC/C,iBAAA,EAAmB,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,mBAAmB;AAAA,SACzE;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,MAAA,CAAO,KAAK,GAAG,KAAA,IAAS,EAAA;AAAA,UACnD,cAAc,OAAA,CAAQ,OAAA,CAAQ,IAAI,MAAA,CAAO,QAAQ,GAAG,KAAA,IAAS,EAAA;AAAA,UAC7D,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,MAAA,CAAO,KAAK,GAAG,KAAA,IAAS;AAAA;AACrD,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,WAAW,QAAA,EAAU;AACnB,MAAA,OAAO,MAAA,CAAO,WAAW,QAAQ,CAAA;AAAA,IACnC,CAAA;AAAA,IAEA,gBAAgB,QAAA,EAAU;AACxB,MAAA,OAAOA,mBAAA,CAAa,QAAA,CAAS,MAAA,CAAO,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,IAC1D,CAAA;AAAA,IAEA,WAAW,QAAA,EAAU;AACnB,MAAA,OAAO,MAAA,CAAO,UAAU,QAAQ,CAAA;AAAA,IAClC;AAAA,GACF;AACF;AAEA,SAAS,cAAc,MAAA,EAA8C;AACnE,EAAA,MAAM,MAAA,GAAS,MAAA,EAAQ,MAAA,IAAU,OAAA,CAAQ,IAAI,gBAAgB,CAAA;AAC7D,EAAA,MAAM,QAAA,GAAW,MAAA,EAAQ,QAAA,IAAY,OAAA,CAAQ,IAAI,mBAAmB,CAAA;AACpE,EAAA,MAAM,WAAA,GAAc,MAAA,EAAQ,WAAA,IAAe,OAAA,CAAQ,IAAI,sBAAsB,CAAA;AAC7E,EAAA,MAAM,YAAA,GAAe,MAAA,EAAQ,YAAA,IAAgB,OAAA,CAAQ,IAAI,uBAAuB,CAAA;AAEhF,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAA,IAAY,CAAC,WAAA,EAAa;AACxC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB,EAAC;AAAA,IACvC,GAAI,QAAQ,MAAA,GAAS,EAAE,QAAQ,MAAA,CAAO,MAAA,KAAW,EAAC;AAAA,IAClD,GAAI,QAAQ,WAAA,GAAc,EAAE,aAAa,MAAA,CAAO,WAAA,KAAgB,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,GAAY,EAAE,WAAW,MAAA,CAAO,SAAA,KAAc,EAAC;AAAA,IAC3D,GAAI,QAAQ,UAAA,GAAa,EAAE,YAAY,MAAA,CAAO,UAAA,KAAe;AAAC,GAChE;AACF","file":"nextjs.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n */\nexport class AuthenticationError extends CboxIdError {}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport type { DiscoveryDocument } from './types.js';\n\n/**\n * Fetches and caches an instance's OIDC discovery document. One instance of this\n * lives per {@link CboxIdClient}; the document is refetched only after the TTL.\n */\nexport class Discovery {\n  private cached: { doc: DiscoveryDocument; expiresAt: number } | null = null;\n\n  constructor(\n    private readonly issuer: string,\n    private readonly timeoutMs: number,\n    private readonly cacheTtlMs: number,\n    private readonly now: () => number = Date.now,\n  ) {}\n\n  async document(): Promise<DiscoveryDocument> {\n    if (this.cached && this.cached.expiresAt > this.now()) {\n      return this.cached.doc;\n    }\n\n    const url = `${this.issuer.replace(/\\/$/, '')}/.well-known/openid-configuration`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let doc: DiscoveryDocument;\n    try {\n      const response = await fetch(url, { signal: controller.signal });\n      if (!response.ok) {\n        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);\n      }\n      doc = (await response.json()) as DiscoveryDocument;\n    } catch (error) {\n      if (error instanceof AuthenticationError) {\n        throw error;\n      }\n      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (typeof doc.issuer !== 'string' || doc.issuer === '') {\n      throw new AuthenticationError('The discovery document was missing an issuer.');\n    }\n\n    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };\n    return doc;\n  }\n\n  /** A required endpoint from the discovery document. */\n  async endpoint(name: keyof DiscoveryDocument): Promise<string> {\n    const value = (await this.document())[name];\n    if (typeof value !== 'string' || value === '') {\n      throw new ConfigurationError(`The instance does not advertise a ${name}.`);\n    }\n    return value;\n  }\n\n  /** An optional endpoint, or null when the instance advertises none. */\n  async optionalEndpoint(name: keyof DiscoveryDocument): Promise<string | null> {\n    const value = (await this.document())[name];\n    return typeof value === 'string' && value !== '' ? value : null;\n  }\n}\n","/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n","import { AuthenticationError } from './errors.js';\n\n/** A stored vault secret's metadata (never its plaintext). */\nexport interface VaultSecretRef {\n  id: string;\n  name: string;\n  provider: string;\n  ownerType: string | null;\n  ownerId: string | null;\n  expiresAt: string | null;\n  revoked: boolean;\n}\n\n/** A brokered credential — the plaintext, for immediate use. */\nexport interface VaultLease {\n  secretId: string;\n  provider: string;\n  secret: string;\n  expiresAt: string;\n}\n\nexport interface StoreSecretInput {\n  name: string;\n  provider: string;\n  secret: string;\n  ownerType?: 'organization' | 'user';\n  ownerId?: string;\n  expiresAt?: string;\n}\n\n/**\n * Client for a Cbox ID instance's Token Vault API. Bind it to an access token\n * (obtain one with {@link CboxIdClient.machineToken}, scoped `vault.manage` for\n * provisioning or `vault.lease` for redeeming). All calls are server-to-server.\n */\nexport class VaultClient {\n  private readonly base: string;\n\n  constructor(\n    issuer: string,\n    private readonly token: string,\n    private readonly timeoutMs = 10_000,\n  ) {\n    this.base = `${issuer.replace(/\\/$/, '')}/api/v1/vault`;\n  }\n\n  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */\n  store(input: StoreSecretInput): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', '/secrets', {\n      name: input.name,\n      provider: input.provider,\n      secret: input.secret,\n      owner_type: input.ownerType,\n      owner_id: input.ownerId,\n      expires_at: input.expiresAt,\n    });\n  }\n\n  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */\n  rotate(secretId: string, secret: string): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });\n  }\n\n  /** Revoke a secret permanently (scope `vault.manage`). */\n  async revoke(secretId: string): Promise<void> {\n    await this.request('DELETE', `/secrets/${encodeURIComponent(secretId)}`);\n  }\n\n  /** Authorize an agent client to lease a secret (scope `vault.manage`). */\n  grant(\n    secretId: string,\n    clientId: string,\n    maxTtlSeconds?: number,\n  ): Promise<{ secretId: string; clientId: string; maxTtlSeconds: number | null }> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/grants`, {\n      client_id: clientId,\n      max_ttl_seconds: maxTtlSeconds,\n    }).then((raw) => {\n      const r = raw as { secret_id: string; client_id: string; max_ttl_seconds: number | null };\n      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };\n    });\n  }\n\n  /** Revoke an agent's authorization (scope `vault.manage`). */\n  async revokeGrant(secretId: string, clientId: string): Promise<void> {\n    await this.request(\n      'DELETE',\n      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`,\n    );\n  }\n\n  /**\n   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller\n   * is identified by the token's client; a lease with no live grant is refused.\n   */\n  lease(secretId: string, purpose: string): Promise<VaultLease> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {\n      const r = raw as { secret_id: string; provider: string; secret: string; expires_at: string };\n      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };\n    });\n  }\n\n  private async json<T>(method: string, path: string, body: Record<string, unknown>): Promise<T> {\n    const response = await this.request(method, path, body);\n    return (await response.json()) as T;\n  }\n\n  private async request(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    try {\n      const init: RequestInit = {\n        method,\n        headers: {\n          authorization: `Bearer ${this.token}`,\n          ...(body ? { 'content-type': 'application/json' } : {}),\n        },\n        signal: controller.signal,\n      };\n      if (body) {\n        init.body = JSON.stringify(body);\n      }\n      const response = await fetch(`${this.base}${path}`, init);\n      if (!response.ok) {\n        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);\n      }\n      return response;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n","/**\n * Verify a Cbox ID webhook / inline-action signature. The header is\n * `X-Cbox-Signature: t={unix},v1={hex hmac}` — an HMAC-SHA256 over\n * `\"{timestamp}.{raw body}\"`, valid within a freshness window. Built on Web Crypto\n * so it runs on Node, edge and the browser.\n */\n\n/** Constant-time compare of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport interface VerifyWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The value of the `X-Cbox-Signature` header. */\n  signatureHeader: string | null | undefined;\n  /** The signing secret issued when the webhook/action endpoint was registered. */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\n/** Returns `true` only when the signature is present, fresh and valid. Never throws. */\nexport async function verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n  const { payload, signatureHeader, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  if (!signatureHeader) {\n    return false;\n  }\n\n  const parts: Record<string, string> = {};\n  for (const segment of signatureHeader.split(',')) {\n    const [key, value] = segment.trim().split('=', 2);\n    if (key) {\n      parts[key] = value ?? '';\n    }\n  }\n\n  const timestamp = parts['t'] ?? '';\n  const signature = parts['v1'] ?? '';\n\n  if (timestamp === '' || signature === '' || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const expected = toHex(\n    await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${payload}`)),\n  );\n\n  return timingSafeEqual(expected, signature);\n}\n","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError, InvalidStateError } from './errors.js';\nimport { challenge, createVerifier, randomToken } from './pkce.js';\nimport type {\n  AuthorizationRequest,\n  CboxIdConfig,\n  CboxUser,\n  TokenResponse,\n} from './types.js';\nimport { VaultClient } from './vault.js';\nimport { verifyWebhook, type VerifyWebhookOptions } from './webhook.js';\n\ntype JwksResolver = ReturnType<typeof createRemoteJWKSet>;\n\n/** Query parameters as they arrive on your callback route. */\nexport interface CallbackParams {\n  code?: string | null;\n  state?: string | null;\n  error?: string | null;\n  error_description?: string | null;\n}\n\n/** The values you persisted from {@link CboxIdClient.createAuthorizationRequest}. */\nexport interface StoredAuthState {\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n}\n\n/**\n * Turnkey Cbox ID client for JavaScript/TypeScript. It speaks standard OpenID\n * Connect against a Cbox ID instance — so integrating is a redirect and a callback,\n * not a rewrite — and adds the conveniences a hosted-identity product needs: a\n * redirect to the instance's hosted profile page, and back-channel helpers (machine\n * tokens, userinfo, introspection, webhook verification).\n *\n * Login is hardened by default: PKCE (S256), a CSRF state check, a nonce, and full\n * id_token signature + issuer + audience verification against the instance's JWKS\n * (via `jose`).\n *\n * The class is framework-agnostic: {@link createAuthorizationRequest} hands you the\n * `state`, `codeVerifier` and `nonce` to persist however you like, and\n * {@link authenticate} takes them back. For Next.js, the `@cboxdk/id-js/nextjs`\n * entry wires this to cookies for you.\n */\nexport class CboxIdClient {\n  private readonly discovery: Discovery;\n  private readonly jwksByUri = new Map<string, JwksResolver>();\n\n  constructor(private readonly config: CboxIdConfig) {\n    if (!config.issuer) {\n      throw new ConfigurationError('Cbox ID config `issuer` is required.');\n    }\n    if (!config.clientId) {\n      throw new ConfigurationError('Cbox ID config `clientId` is required.');\n    }\n    if (!config.redirectUri) {\n      throw new ConfigurationError('Cbox ID config `redirectUri` is required.');\n    }\n    this.discovery = new Discovery(\n      config.issuer,\n      config.timeoutMs ?? 10_000,\n      config.cacheTtlMs ?? 3_600_000,\n    );\n  }\n\n  /**\n   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and\n   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back\n   * to {@link authenticate} on the callback.\n   */\n  async createAuthorizationRequest(options: {\n    scopes?: string[];\n    redirectUri?: string;\n    state?: string;\n    prompt?: string;\n    loginHint?: string;\n    maxAge?: number;\n  } = {}): Promise<AuthorizationRequest> {\n    const codeVerifier = createVerifier();\n    const state = options.state ?? randomToken(16);\n    const nonce = randomToken(16);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: options.redirectUri ?? this.config.redirectUri,\n      scope: (options.scopes ?? this.scopes()).join(' '),\n      state,\n      nonce,\n      code_challenge: await challenge(codeVerifier),\n      code_challenge_method: 'S256',\n    });\n    if (options.prompt) {\n      params.set('prompt', options.prompt);\n    }\n    if (options.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n    if (typeof options.maxAge === 'number') {\n      params.set('max_age', String(options.maxAge));\n    }\n\n    const endpoint = await this.discovery.endpoint('authorization_endpoint');\n    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };\n  }\n\n  /**\n   * Complete login on your callback route: verify state, exchange the code with the\n   * PKCE verifier, verify the id_token, and return the authenticated user.\n   *\n   * @throws InvalidStateError when state does not match (forged/stale request)\n   * @throws AuthenticationError on any other failure\n   */\n  async authenticate(input: {\n    params: CallbackParams;\n    stored: StoredAuthState;\n    redirectUri?: string;\n  }): Promise<CboxUser> {\n    const { params, stored } = input;\n\n    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {\n      throw new InvalidStateError('The login state did not match — the request may be forged or stale.');\n    }\n\n    if (params.error) {\n      throw new AuthenticationError(\n        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ''}`,\n      );\n    }\n\n    if (!params.code) {\n      throw new AuthenticationError('The callback was missing an authorization code.');\n    }\n\n    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);\n\n    if (!tokens.access_token) {\n      throw new AuthenticationError('No access token was returned.');\n    }\n\n    let claims: Record<string, unknown> = {};\n    if (tokens.id_token) {\n      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);\n    }\n    // Enrich with userinfo (email/name/org a minimal id_token may omit).\n    claims = { ...claims, ...(await this.userinfo(tokens.access_token)) };\n\n    const sub = claims['sub'];\n    if (typeof sub !== 'string' || sub === '') {\n      throw new AuthenticationError('The verified token carried no subject.');\n    }\n\n    return {\n      id: sub,\n      email: typeof claims['email'] === 'string' ? claims['email'] : null,\n      name: typeof claims['name'] === 'string' ? claims['name'] : null,\n      organizationId: typeof claims['org'] === 'string' ? claims['org'] : null,\n      claims,\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n    };\n  }\n\n  /**\n   * The URL of the instance's hosted account/profile page (self-service password,\n   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox\n   * ID session; `returnTo` is passed so the page can link back to your app.\n   */\n  profileUrl(returnTo?: string): string {\n    const base = `${this.config.issuer.replace(/\\/$/, '')}${this.accountPath()}`;\n    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;\n  }\n\n  /** The RP-initiated logout URL, or null when the instance advertises none. */\n  async logoutUrl(returnTo?: string): Promise<string | null> {\n    const endpoint = await this.discovery.optionalEndpoint('end_session_endpoint');\n    if (!endpoint) {\n      return null;\n    }\n    return returnTo\n      ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}`\n      : endpoint;\n  }\n\n  /**\n   * A machine (client-credentials) access token for calling Cbox ID APIs as your\n   * app, not on a user's behalf. Requires a client secret.\n   */\n  async machineToken(options: { scopes?: string[]; resource?: string } = {}): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.config.clientId,\n      client_secret: this.requireSecret(),\n    });\n    if (options.scopes && options.scopes.length > 0) {\n      body.set('scope', options.scopes.join(' '));\n    }\n    if (options.resource) {\n      body.set('resource', options.resource);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token?: unknown };\n    if (typeof json.access_token !== 'string') {\n      throw new AuthenticationError('The token response had no access_token.');\n    }\n    return json.access_token;\n  }\n\n  /** The OIDC userinfo claims for an access token. */\n  async userinfo(accessToken: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.optionalEndpoint('userinfo_endpoint');\n    if (!endpoint) {\n      return {};\n    }\n    const response = await this.fetchWithTimeout(endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    if (!response.ok) {\n      throw new AuthenticationError('Userinfo request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7662 token introspection (confidential-client auth). Returns the raw\n   * response; `active` tells you if the token is currently valid. Requires a secret.\n   */\n  async introspect(token: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.endpoint('introspection_endpoint');\n    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);\n    const response = await this.post(\n      endpoint,\n      new URLSearchParams({ token }),\n      { authorization: `Basic ${basic}` },\n    );\n    if (!response.ok) {\n      throw new AuthenticationError('Introspection request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */\n  verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n    return verifyWebhook(options);\n  }\n\n  /**\n   * A Token Vault client bound to an access token. Obtain the token with\n   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to\n   * redeem), then call `store` / `grant` / `lease` etc.\n   */\n  vault(accessToken: string): VaultClient {\n    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 10_000);\n  }\n\n  private async exchange(code: string, verifier: string, redirectUri?: string): Promise<TokenResponse> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri ?? this.config.redirectUri,\n      client_id: this.config.clientId,\n      code_verifier: verifier,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);\n    }\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async verifyIdToken(idToken: string, nonce: string): Promise<Record<string, unknown>> {\n    const jwksUri = await this.discovery.endpoint('jwks_uri');\n    let resolver = this.jwksByUri.get(jwksUri);\n    if (!resolver) {\n      resolver = createRemoteJWKSet(new URL(jwksUri));\n      this.jwksByUri.set(jwksUri, resolver);\n    }\n\n    let payload: JWTPayload;\n    try {\n      ({ payload } = await jwtVerify(idToken, resolver, {\n        issuer: this.config.issuer,\n        audience: this.config.clientId,\n      }));\n    } catch (error) {\n      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);\n    }\n\n    if (nonce && payload['nonce'] !== nonce) {\n      throw new AuthenticationError('The id_token nonce did not match — possible replay.');\n    }\n\n    return payload as Record<string, unknown>;\n  }\n\n  private scopes(): string[] {\n    const scopes = this.config.scopes;\n    return scopes && scopes.length > 0 ? scopes : ['openid', 'profile', 'email'];\n  }\n\n  private accountPath(): string {\n    const path = this.config.accountPath;\n    return path && path !== '' ? `/${path.replace(/^\\//, '')}` : '/settings';\n  }\n\n  private requireSecret(): string {\n    if (!this.config.clientSecret) {\n      throw new ConfigurationError('This call requires a `clientSecret`, but none is configured.');\n    }\n    return this.config.clientSecret;\n  }\n\n  private post(url: string, body: URLSearchParams, headers: Record<string, string> = {}): Promise<Response> {\n    return this.fetchWithTimeout(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded', ...headers },\n      body,\n    });\n  }\n\n  private async fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 10_000);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/** Constant-time string compare, so state validation doesn't leak via timing. */\nfunction timingSafeEqualString(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n","import { NextResponse, type NextRequest } from 'next/server';\nimport { CboxIdClient } from './client.js';\nimport { ConfigurationError } from './errors.js';\nimport type { CboxIdConfig, CboxUser } from './types.js';\n\n/**\n * First-class Next.js (App Router) adapter for {@link CboxIdClient}. It wires the\n * framework-agnostic core to short-lived, httpOnly cookies so login is a couple of\n * route handlers:\n *\n * ```ts\n * // app/auth/[...cbox]/route.ts is up to you; a minimal wiring:\n * import { cboxId } from '@/lib/cbox';\n *\n * export async function GET(request: NextRequest) {\n *   return cboxId.signIn();\n * }\n * ```\n *\n * The temporary state/verifier/nonce cookies are httpOnly, `SameSite=Lax`, and\n * expire in 10 minutes, so a stalled login cleans itself up.\n */\n\nconst COOKIE = {\n  state: 'cbox_id_state',\n  verifier: 'cbox_id_verifier',\n  nonce: 'cbox_id_nonce',\n} as const;\n\nconst TEMP_COOKIE_MAX_AGE = 600; // 10 minutes\n\nexport interface CboxIdNext {\n  /** The underlying framework-agnostic client. */\n  readonly client: CboxIdClient;\n  /** Redirect to Cbox ID's authorize endpoint, stashing PKCE/state/nonce in cookies. */\n  signIn(options?: { scopes?: string[]; prompt?: string; loginHint?: string }): Promise<NextResponse>;\n  /** Complete login on your callback route; returns the authenticated user. */\n  callback(request: NextRequest): Promise<CboxUser>;\n  /** The hosted profile-page URL (`return_to` appended when given). */\n  profileUrl(returnTo?: string): string;\n  /** A redirect response to the hosted profile page. */\n  profileRedirect(returnTo?: string): NextResponse;\n  /** RP-initiated logout URL, or null when the instance advertises none. */\n  signOutUrl(returnTo?: string): Promise<string | null>;\n}\n\n/**\n * Build a Next.js adapter. Pass a config, or omit it to read from the environment\n * (`CBOX_ID_ISSUER`, `CBOX_ID_CLIENT_ID`, `CBOX_ID_CLIENT_SECRET`,\n * `CBOX_ID_REDIRECT_URI`).\n */\nexport function createCboxId(config?: Partial<CboxIdConfig>): CboxIdNext {\n  const resolved = resolveConfig(config);\n  const client = new CboxIdClient(resolved);\n\n  const tempCookieOptions = {\n    httpOnly: true,\n    secure: true,\n    sameSite: 'lax' as const,\n    path: '/',\n    maxAge: TEMP_COOKIE_MAX_AGE,\n  };\n\n  return {\n    client,\n\n    async signIn(options = {}) {\n      const request = await client.createAuthorizationRequest(options);\n      const response = NextResponse.redirect(request.url);\n      response.cookies.set(COOKIE.state, request.state, tempCookieOptions);\n      response.cookies.set(COOKIE.verifier, request.codeVerifier, tempCookieOptions);\n      response.cookies.set(COOKIE.nonce, request.nonce, tempCookieOptions);\n      return response;\n    },\n\n    async callback(request) {\n      return client.authenticate({\n        params: {\n          code: request.nextUrl.searchParams.get('code'),\n          state: request.nextUrl.searchParams.get('state'),\n          error: request.nextUrl.searchParams.get('error'),\n          error_description: request.nextUrl.searchParams.get('error_description'),\n        },\n        stored: {\n          state: request.cookies.get(COOKIE.state)?.value ?? '',\n          codeVerifier: request.cookies.get(COOKIE.verifier)?.value ?? '',\n          nonce: request.cookies.get(COOKIE.nonce)?.value ?? '',\n        },\n      });\n    },\n\n    profileUrl(returnTo) {\n      return client.profileUrl(returnTo);\n    },\n\n    profileRedirect(returnTo) {\n      return NextResponse.redirect(client.profileUrl(returnTo));\n    },\n\n    signOutUrl(returnTo) {\n      return client.logoutUrl(returnTo);\n    },\n  };\n}\n\nfunction resolveConfig(config?: Partial<CboxIdConfig>): CboxIdConfig {\n  const issuer = config?.issuer ?? process.env['CBOX_ID_ISSUER'];\n  const clientId = config?.clientId ?? process.env['CBOX_ID_CLIENT_ID'];\n  const redirectUri = config?.redirectUri ?? process.env['CBOX_ID_REDIRECT_URI'];\n  const clientSecret = config?.clientSecret ?? process.env['CBOX_ID_CLIENT_SECRET'];\n\n  if (!issuer || !clientId || !redirectUri) {\n    throw new ConfigurationError(\n      'Cbox ID needs issuer, clientId and redirectUri — pass them to createCboxId() or set CBOX_ID_ISSUER / CBOX_ID_CLIENT_ID / CBOX_ID_REDIRECT_URI.',\n    );\n  }\n\n  return {\n    issuer,\n    clientId,\n    redirectUri,\n    ...(clientSecret ? { clientSecret } : {}),\n    ...(config?.scopes ? { scopes: config.scopes } : {}),\n    ...(config?.accountPath ? { accountPath: config.accountPath } : {}),\n    ...(config?.timeoutMs ? { timeoutMs: config.timeoutMs } : {}),\n    ...(config?.cacheTtlMs ? { cacheTtlMs: config.cacheTtlMs } : {}),\n  };\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/discovery.ts","../src/pkce.ts","../src/vault.ts","../src/webhook.ts","../src/client.ts","../src/nextjs.ts"],"names":["key","createRemoteJWKSet","jwtVerify","NextResponse"],"mappings":";;;;;;;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC,CAAA;AAM9C,IAAM,iBAAA,GAAN,cAAgC,WAAA,CAAY;AAAC,CAAA;AAM7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC,CAAA;;;ACjB/C,IAAM,YAAN,MAAgB;AAAA,EAGrB,YACmB,MAAA,EACA,SAAA,EACA,UAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EAC1C;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAChB;AAAA,EAJgB,MAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,GAAA;AAAA,EANX,MAAA,GAA+D,IAAA;AAAA,EASvE,MAAM,QAAA,GAAuC;AAC3C,IAAA,IAAI,KAAK,MAAA,IAAU,IAAA,CAAK,OAAO,SAAA,GAAY,IAAA,CAAK,KAAI,EAAG;AACrD,MAAA,OAAO,KAAK,MAAA,CAAO,GAAA;AAAA,IACrB;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iCAAA,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC1F;AACA,MAAA,GAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACxC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,0BAAA,EAA6B,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAA,EAAK,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,KAAK,UAAA,EAAW;AAC7D,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAgD;AAC7D,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,IAAA,EAAuD;AAC5E,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,KAAK,KAAA,GAAQ,IAAA;AAAA,EAC7D;AACF,CAAA;;;AC3DA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;AAGO,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB;AAGA,eAAsB,UAAU,QAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACvF,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC;;;ACQO,IAAM,cAAN,MAAkB;AAAA,EAGvB,WAAA,CACE,MAAA,EACiB,KAAA,EACA,SAAA,GAAY,GAAA,EAC7B;AAFiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAEjB,IAAA,IAAA,CAAK,OAAO,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,aAAA,CAAA;AAAA,EAC1C;AAAA,EAJmB,KAAA;AAAA,EACA,SAAA;AAAA,EALF,IAAA;AAAA;AAAA,EAWjB,MAAM,KAAA,EAAkD;AACtD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY;AAAA,MACnD,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,YAAY,KAAA,CAAM,SAAA;AAAA,MAClB,UAAU,KAAA,CAAM,OAAA;AAAA,MAChB,YAAY,KAAA,CAAM;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAA,CAAO,UAAkB,MAAA,EAAyC;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAAA,EACxG;AAAA;AAAA,EAGA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAM,KAAK,OAAA,CAAQ,QAAA,EAAU,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACzE;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,QAAA,EACA,aAAA,EAC+E;AAC/E,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MAC1E,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB;AAAA,KAClB,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACf,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,UAAU,CAAA,CAAE,SAAA,EAAW,UAAU,CAAA,CAAE,SAAA,EAAW,aAAA,EAAe,CAAA,CAAE,eAAA,EAAgB;AAAA,IAC1F,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,QAAA,EAAkB,QAAA,EAAiC;AACnE,IAAA,MAAM,IAAA,CAAK,OAAA;AAAA,MACT,QAAA;AAAA,MACA,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,UAAkB,OAAA,EAAsC;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,mBAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU,EAAE,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACpG,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,QAAA,EAAU,CAAA,CAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW;AAAA,IAClG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,IAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA2C;AAC7F,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,OAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AACrG,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAoB;AAAA,QACxB,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,UACnC,GAAI,IAAA,GAAO,EAAE,cAAA,EAAgB,kBAAA,KAAuB;AAAC,SACvD;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACrB;AACA,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACjC;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA;AACxD,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,oBAAoB,CAAA,MAAA,EAAS,MAAM,IAAI,IAAI,CAAA,oBAAA,EAAuB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AACA,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF,CAAA;;;AC3HA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAEA,SAAS,MAAM,KAAA,EAA4B;AACzC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,CACpC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAgBA,eAAsB,cAAc,OAAA,EAAiD;AACnF,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAiB,MAAA,EAAO,GAAI,OAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,OAAA,IAAW,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,CAACA,MAAK,KAAK,CAAA,GAAI,QAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChD,IAAA,IAAIA,IAAAA,EAAK;AACP,MAAA,KAAA,CAAMA,IAAG,IAAI,KAAA,IAAS,EAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,GAAG,CAAA,IAAK,EAAA;AAChC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AAEjC,EAAA,IAAI,SAAA,KAAc,MAAM,SAAA,KAAc,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,QAAA,GAAW,KAAA;AAAA,IACf,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,EAAE,CAAC;AAAA,GAC3F;AAEA,EAAA,OAAO,eAAA,CAAgB,UAAU,SAAS,CAAA;AAC5C;;;AC/BO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAA6B,MAAA,EAAsB;AAAtB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,MAAM,IAAI,mBAAmB,wCAAwC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAA,CAAK,YAAY,IAAI,SAAA;AAAA,MACnB,MAAA,CAAO,MAAA;AAAA,MACP,OAAO,SAAA,IAAa,GAAA;AAAA,MACpB,OAAO,UAAA,IAAc;AAAA,KACvB;AAAA,EACF;AAAA,EAf6B,MAAA;AAAA,EAHZ,SAAA;AAAA,EACA,SAAA,uBAAgB,GAAA,EAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB3D,MAAM,0BAAA,CAA2B,OAAA,GAO7B,EAAC,EAAkC;AACrC,IAAA,MAAM,eAAe,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,CAAY,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,aAAA,EAAe,MAAA;AAAA,MACf,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,YAAA,EAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACjD,QAAQ,OAAA,CAAQ,MAAA,IAAU,KAAK,MAAA,EAAO,EAAG,KAAK,GAAG,CAAA;AAAA,MACjD,KAAA;AAAA,MACA,KAAA;AAAA,MACA,cAAA,EAAgB,MAAM,SAAA,CAAU,YAAY,CAAA;AAAA,MAC5C,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA;AAAA,IACrC;AACA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,YAAA,EAAc,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAO,YAAA,EAAc,KAAA,EAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,KAAA,EAIG;AACpB,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAE3B,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,qBAAA,CAAsB,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxF,MAAA,MAAM,IAAI,kBAAkB,0EAAqE,CAAA;AAAA,IACnG;AAEA,IAAA,IAAI,OAAO,KAAA,EAAO;AAChB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,EAAG,MAAA,CAAO,oBAAoB,CAAA,EAAA,EAAK,MAAA,CAAO,iBAAiB,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,OAC/G;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,MAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,IACjF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,IAAA,EAAM,MAAA,CAAO,YAAA,EAAc,KAAA,CAAM,WAAW,CAAA;AAEtF,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,SAAkC,EAAC;AACvC,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,OAAO,KAAK,CAAA;AAAA,IACjE;AAEA,IAAA,MAAA,GAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,EAAG;AAEpE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,MAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,MAAA,CAAO,eAAe,CAAC,CAAA;AAEhE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA;AAAA,MACJ,KAAA,EAAO,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,IAAA;AAAA,MAC/D,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,IAAA;AAAA,MAC5D,cAAA,EAAgB,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,IAAA;AAAA;AAAA,MAEpE,GAAI,aAAA,GAAgB,EAAE,aAAA,KAAkB,EAAC;AAAA,MACzC,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,YAAA,EAAgD;AAC5D,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,eAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,sBAAA,EAAyB,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IAChF;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,OAAO;AAAA,MACL,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa,CAAA;AAAA,MACvE,OAAO,OAAO,MAAA,CAAO,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAAA,EAA2B;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA;AAC1E,IAAA,OAAO,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GAAK,IAAA;AAAA,EAC3F;AAAA;AAAA,EAGA,MAAM,UAAU,QAAA,EAA2C;AACzD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,sBAAsB,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,QAAA,GACH,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,wBAAA,EAA0B,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GACrF,QAAA;AAAA,EACN;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CAAa,OAAA,GAAoD,EAAC,EAAoB;AAC1F,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe,KAAK,aAAA;AAAc,KACnC,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC/C,MAAA,IAAA,CAAK,IAAI,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,EAAiC,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACxF;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,oBAAoB,yCAAyC,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,SAAS,WAAA,EAAuD;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAC1E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU;AAAA,MACrD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,0BAA0B,CAAA;AAAA,IAC1D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,KAAA,EAAiD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,aAAA,EAAe,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,CAAA;AAAA,MAC7B,EAAE,aAAA,EAAe,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA;AAAG,KACpC;AACA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,cAAc,OAAA,EAAiD;AAC7D,IAAA,OAAO,cAAc,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,EAAkC;AACtC,IAAA,OAAO,IAAI,YAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAAA,EACzF;AAAA,EAEA,MAAc,QAAA,CAAS,IAAA,EAAc,QAAA,EAAkB,WAAA,EAA8C;AACnG,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,YAAA,EAAc,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACzC,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,uBAAA,EAA0B,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACjF;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,aAAA,CAAc,OAAA,EAAiB,KAAA,EAAiD;AAC5F,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,UAAU,CAAA;AACxD,IAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAWC,uBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,SAAS,QAAA,EAAU;AAAA,QAChD,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,QACpB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,oCAAA,EAAuC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,OAAO,CAAA,KAAM,KAAA,EAAO;AACvC,MAAA,MAAM,IAAI,oBAAoB,0DAAqD,CAAA;AAAA,IACrF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,MAAA,GAAmB;AACzB,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA;AAC3B,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,QAAA,EAAU,WAAW,OAAO,CAAA;AAAA,EAC7E;AAAA,EAEQ,WAAA,GAAsB;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,MAAA,CAAO,WAAA;AACzB,IAAA,OAAO,IAAA,IAAQ,SAAS,EAAA,GAAK,CAAA,CAAA,EAAI,KAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,CAAA,GAAK,WAAA;AAAA,EAC/D;AAAA,EAEQ,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AAC7B,MAAA,MAAM,IAAI,mBAAmB,8DAA8D,CAAA;AAAA,IAC7F;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA;AAAA,EACrB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,IAAA,EAAuB,OAAA,GAAkC,EAAC,EAAsB;AACxG,IAAA,OAAO,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,GAAG,OAAA,EAAQ;AAAA,MAC3E;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAsC;AAChF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAClF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF,CAAA;AAGA,SAAS,qBAAA,CAAsB,GAAW,CAAA,EAAoB;AAC5D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAOA,SAAS,mBAAmB,KAAA,EAAgD;AAC1E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,OAA2B,EAAC;AAClC,EAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,MAAM,EAAA,GAAK,OAAO,IAAI,CAAA;AACtB,IAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,KAAO,MAAM,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,EAAA,EAAI;AAClF,MAAA,IAAA,CAAK,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,MAAM,OAAO,MAAA,CAAO,MAAM,CAAA,KAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,MAAM,CAAA;AAAA,IAC1F;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;;;AC7YA,IAAM,MAAA,GAAS;AAAA,EACb,KAAA,EAAO,eAAA;AAAA,EACP,QAAA,EAAU,kBAAA;AAAA,EACV,KAAA,EAAO;AACT,CAAA;AAEA,IAAM,mBAAA,GAAsB,GAAA;AAsBrB,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,MAAM,QAAA,GAAW,cAAc,MAAM,CAAA;AACrC,EAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAa,QAAQ,CAAA;AAExC,EAAA,MAAM,iBAAA,GAAoB;AAAA,IACxB,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU,KAAA;AAAA,IACV,IAAA,EAAM,GAAA;AAAA,IACN,MAAA,EAAQ;AAAA,GACV;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IAEA,MAAM,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,0BAAA,CAA2B,OAAO,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAWC,mBAAA,CAAa,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAClD,MAAA,QAAA,CAAS,QAAQ,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,OAAA,CAAQ,OAAO,iBAAiB,CAAA;AACnE,MAAA,QAAA,CAAS,QAAQ,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,OAAA,CAAQ,cAAc,iBAAiB,CAAA;AAC7E,MAAA,QAAA,CAAS,QAAQ,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,OAAA,CAAQ,OAAO,iBAAiB,CAAA;AACnE,MAAA,OAAO,QAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,SAAS,OAAA,EAAS;AACtB,MAAA,OAAO,OAAO,YAAA,CAAa;AAAA,QACzB,MAAA,EAAQ;AAAA,UACN,IAAA,EAAM,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,MAAM,CAAA;AAAA,UAC7C,KAAA,EAAO,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,OAAO,CAAA;AAAA,UAC/C,KAAA,EAAO,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,OAAO,CAAA;AAAA,UAC/C,iBAAA,EAAmB,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,mBAAmB;AAAA,SACzE;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,MAAA,CAAO,KAAK,GAAG,KAAA,IAAS,EAAA;AAAA,UACnD,cAAc,OAAA,CAAQ,OAAA,CAAQ,IAAI,MAAA,CAAO,QAAQ,GAAG,KAAA,IAAS,EAAA;AAAA,UAC7D,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,MAAA,CAAO,KAAK,GAAG,KAAA,IAAS;AAAA;AACrD,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,WAAW,QAAA,EAAU;AACnB,MAAA,OAAO,MAAA,CAAO,WAAW,QAAQ,CAAA;AAAA,IACnC,CAAA;AAAA,IAEA,gBAAgB,QAAA,EAAU;AACxB,MAAA,OAAOA,mBAAA,CAAa,QAAA,CAAS,MAAA,CAAO,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,IAC1D,CAAA;AAAA,IAEA,WAAW,QAAA,EAAU;AACnB,MAAA,OAAO,MAAA,CAAO,UAAU,QAAQ,CAAA;AAAA,IAClC;AAAA,GACF;AACF;AAEA,SAAS,cAAc,MAAA,EAA8C;AACnE,EAAA,MAAM,MAAA,GAAS,MAAA,EAAQ,MAAA,IAAU,OAAA,CAAQ,IAAI,gBAAgB,CAAA;AAC7D,EAAA,MAAM,QAAA,GAAW,MAAA,EAAQ,QAAA,IAAY,OAAA,CAAQ,IAAI,mBAAmB,CAAA;AACpE,EAAA,MAAM,WAAA,GAAc,MAAA,EAAQ,WAAA,IAAe,OAAA,CAAQ,IAAI,sBAAsB,CAAA;AAC7E,EAAA,MAAM,YAAA,GAAe,MAAA,EAAQ,YAAA,IAAgB,OAAA,CAAQ,IAAI,uBAAuB,CAAA;AAEhF,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAA,IAAY,CAAC,WAAA,EAAa;AACxC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB,EAAC;AAAA,IACvC,GAAI,QAAQ,MAAA,GAAS,EAAE,QAAQ,MAAA,CAAO,MAAA,KAAW,EAAC;AAAA,IAClD,GAAI,QAAQ,WAAA,GAAc,EAAE,aAAa,MAAA,CAAO,WAAA,KAAgB,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,GAAY,EAAE,WAAW,MAAA,CAAO,SAAA,KAAc,EAAC;AAAA,IAC3D,GAAI,QAAQ,UAAA,GAAa,EAAE,YAAY,MAAA,CAAO,UAAA,KAAe;AAAC,GAChE;AACF","file":"nextjs.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n */\nexport class AuthenticationError extends CboxIdError {}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport type { DiscoveryDocument } from './types.js';\n\n/**\n * Fetches and caches an instance's OIDC discovery document. One instance of this\n * lives per {@link CboxIdClient}; the document is refetched only after the TTL.\n */\nexport class Discovery {\n  private cached: { doc: DiscoveryDocument; expiresAt: number } | null = null;\n\n  constructor(\n    private readonly issuer: string,\n    private readonly timeoutMs: number,\n    private readonly cacheTtlMs: number,\n    private readonly now: () => number = Date.now,\n  ) {}\n\n  async document(): Promise<DiscoveryDocument> {\n    if (this.cached && this.cached.expiresAt > this.now()) {\n      return this.cached.doc;\n    }\n\n    const url = `${this.issuer.replace(/\\/$/, '')}/.well-known/openid-configuration`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let doc: DiscoveryDocument;\n    try {\n      const response = await fetch(url, { signal: controller.signal });\n      if (!response.ok) {\n        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);\n      }\n      doc = (await response.json()) as DiscoveryDocument;\n    } catch (error) {\n      if (error instanceof AuthenticationError) {\n        throw error;\n      }\n      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (typeof doc.issuer !== 'string' || doc.issuer === '') {\n      throw new AuthenticationError('The discovery document was missing an issuer.');\n    }\n\n    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };\n    return doc;\n  }\n\n  /** A required endpoint from the discovery document. */\n  async endpoint(name: keyof DiscoveryDocument): Promise<string> {\n    const value = (await this.document())[name];\n    if (typeof value !== 'string' || value === '') {\n      throw new ConfigurationError(`The instance does not advertise a ${name}.`);\n    }\n    return value;\n  }\n\n  /** An optional endpoint, or null when the instance advertises none. */\n  async optionalEndpoint(name: keyof DiscoveryDocument): Promise<string | null> {\n    const value = (await this.document())[name];\n    return typeof value === 'string' && value !== '' ? value : null;\n  }\n}\n","/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n","import { AuthenticationError } from './errors.js';\n\n/** A stored vault secret's metadata (never its plaintext). */\nexport interface VaultSecretRef {\n  id: string;\n  name: string;\n  provider: string;\n  ownerType: string | null;\n  ownerId: string | null;\n  expiresAt: string | null;\n  revoked: boolean;\n}\n\n/** A brokered credential — the plaintext, for immediate use. */\nexport interface VaultLease {\n  secretId: string;\n  provider: string;\n  secret: string;\n  expiresAt: string;\n}\n\nexport interface StoreSecretInput {\n  name: string;\n  provider: string;\n  secret: string;\n  ownerType?: 'organization' | 'user';\n  ownerId?: string;\n  expiresAt?: string;\n}\n\n/**\n * Client for a Cbox ID instance's Token Vault API. Bind it to an access token\n * (obtain one with {@link CboxIdClient.machineToken}, scoped `vault.manage` for\n * provisioning or `vault.lease` for redeeming). All calls are server-to-server.\n */\nexport class VaultClient {\n  private readonly base: string;\n\n  constructor(\n    issuer: string,\n    private readonly token: string,\n    private readonly timeoutMs = 10_000,\n  ) {\n    this.base = `${issuer.replace(/\\/$/, '')}/api/v1/vault`;\n  }\n\n  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */\n  store(input: StoreSecretInput): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', '/secrets', {\n      name: input.name,\n      provider: input.provider,\n      secret: input.secret,\n      owner_type: input.ownerType,\n      owner_id: input.ownerId,\n      expires_at: input.expiresAt,\n    });\n  }\n\n  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */\n  rotate(secretId: string, secret: string): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });\n  }\n\n  /** Revoke a secret permanently (scope `vault.manage`). */\n  async revoke(secretId: string): Promise<void> {\n    await this.request('DELETE', `/secrets/${encodeURIComponent(secretId)}`);\n  }\n\n  /** Authorize an agent client to lease a secret (scope `vault.manage`). */\n  grant(\n    secretId: string,\n    clientId: string,\n    maxTtlSeconds?: number,\n  ): Promise<{ secretId: string; clientId: string; maxTtlSeconds: number | null }> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/grants`, {\n      client_id: clientId,\n      max_ttl_seconds: maxTtlSeconds,\n    }).then((raw) => {\n      const r = raw as { secret_id: string; client_id: string; max_ttl_seconds: number | null };\n      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };\n    });\n  }\n\n  /** Revoke an agent's authorization (scope `vault.manage`). */\n  async revokeGrant(secretId: string, clientId: string): Promise<void> {\n    await this.request(\n      'DELETE',\n      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`,\n    );\n  }\n\n  /**\n   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller\n   * is identified by the token's client; a lease with no live grant is refused.\n   */\n  lease(secretId: string, purpose: string): Promise<VaultLease> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {\n      const r = raw as { secret_id: string; provider: string; secret: string; expires_at: string };\n      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };\n    });\n  }\n\n  private async json<T>(method: string, path: string, body: Record<string, unknown>): Promise<T> {\n    const response = await this.request(method, path, body);\n    return (await response.json()) as T;\n  }\n\n  private async request(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    try {\n      const init: RequestInit = {\n        method,\n        headers: {\n          authorization: `Bearer ${this.token}`,\n          ...(body ? { 'content-type': 'application/json' } : {}),\n        },\n        signal: controller.signal,\n      };\n      if (body) {\n        init.body = JSON.stringify(body);\n      }\n      const response = await fetch(`${this.base}${path}`, init);\n      if (!response.ok) {\n        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);\n      }\n      return response;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n","/**\n * Verify a Cbox ID webhook / inline-action signature. The header is\n * `X-Cbox-Signature: t={unix},v1={hex hmac}` — an HMAC-SHA256 over\n * `\"{timestamp}.{raw body}\"`, valid within a freshness window. Built on Web Crypto\n * so it runs on Node, edge and the browser.\n */\n\n/** Constant-time compare of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport interface VerifyWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The value of the `X-Cbox-Signature` header. */\n  signatureHeader: string | null | undefined;\n  /** The signing secret issued when the webhook/action endpoint was registered. */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\n/** Returns `true` only when the signature is present, fresh and valid. Never throws. */\nexport async function verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n  const { payload, signatureHeader, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  if (!signatureHeader) {\n    return false;\n  }\n\n  const parts: Record<string, string> = {};\n  for (const segment of signatureHeader.split(',')) {\n    const [key, value] = segment.trim().split('=', 2);\n    if (key) {\n      parts[key] = value ?? '';\n    }\n  }\n\n  const timestamp = parts['t'] ?? '';\n  const signature = parts['v1'] ?? '';\n\n  if (timestamp === '' || signature === '' || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const expected = toHex(\n    await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${payload}`)),\n  );\n\n  return timingSafeEqual(expected, signature);\n}\n","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError, InvalidStateError } from './errors.js';\nimport { challenge, createVerifier, randomToken } from './pkce.js';\nimport type {\n  AuthorizationRequest,\n  CboxIdConfig,\n  CboxOrganization,\n  CboxUser,\n  RefreshedTokens,\n  TokenResponse,\n} from './types.js';\nimport { VaultClient } from './vault.js';\nimport { verifyWebhook, type VerifyWebhookOptions } from './webhook.js';\n\ntype JwksResolver = ReturnType<typeof createRemoteJWKSet>;\n\n/** Query parameters as they arrive on your callback route. */\nexport interface CallbackParams {\n  code?: string | null;\n  state?: string | null;\n  error?: string | null;\n  error_description?: string | null;\n}\n\n/** The values you persisted from {@link CboxIdClient.createAuthorizationRequest}. */\nexport interface StoredAuthState {\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n}\n\n/**\n * Turnkey Cbox ID client for JavaScript/TypeScript. It speaks standard OpenID\n * Connect against a Cbox ID instance — so integrating is a redirect and a callback,\n * not a rewrite — and adds the conveniences a hosted-identity product needs: a\n * redirect to the instance's hosted profile page, and back-channel helpers (machine\n * tokens, userinfo, introspection, webhook verification).\n *\n * Login is hardened by default: PKCE (S256), a CSRF state check, a nonce, and full\n * id_token signature + issuer + audience verification against the instance's JWKS\n * (via `jose`).\n *\n * The class is framework-agnostic: {@link createAuthorizationRequest} hands you the\n * `state`, `codeVerifier` and `nonce` to persist however you like, and\n * {@link authenticate} takes them back. For Next.js, the `@cboxdk/id-js/nextjs`\n * entry wires this to cookies for you.\n */\nexport class CboxIdClient {\n  private readonly discovery: Discovery;\n  private readonly jwksByUri = new Map<string, JwksResolver>();\n\n  constructor(private readonly config: CboxIdConfig) {\n    if (!config.issuer) {\n      throw new ConfigurationError('Cbox ID config `issuer` is required.');\n    }\n    if (!config.clientId) {\n      throw new ConfigurationError('Cbox ID config `clientId` is required.');\n    }\n    if (!config.redirectUri) {\n      throw new ConfigurationError('Cbox ID config `redirectUri` is required.');\n    }\n    this.discovery = new Discovery(\n      config.issuer,\n      config.timeoutMs ?? 10_000,\n      config.cacheTtlMs ?? 3_600_000,\n    );\n  }\n\n  /**\n   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and\n   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back\n   * to {@link authenticate} on the callback.\n   */\n  async createAuthorizationRequest(options: {\n    scopes?: string[];\n    redirectUri?: string;\n    state?: string;\n    prompt?: string;\n    loginHint?: string;\n    maxAge?: number;\n  } = {}): Promise<AuthorizationRequest> {\n    const codeVerifier = createVerifier();\n    const state = options.state ?? randomToken(16);\n    const nonce = randomToken(16);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: options.redirectUri ?? this.config.redirectUri,\n      scope: (options.scopes ?? this.scopes()).join(' '),\n      state,\n      nonce,\n      code_challenge: await challenge(codeVerifier),\n      code_challenge_method: 'S256',\n    });\n    if (options.prompt) {\n      params.set('prompt', options.prompt);\n    }\n    if (options.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n    if (typeof options.maxAge === 'number') {\n      params.set('max_age', String(options.maxAge));\n    }\n\n    const endpoint = await this.discovery.endpoint('authorization_endpoint');\n    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };\n  }\n\n  /**\n   * Complete login on your callback route: verify state, exchange the code with the\n   * PKCE verifier, verify the id_token, and return the authenticated user.\n   *\n   * @throws InvalidStateError when state does not match (forged/stale request)\n   * @throws AuthenticationError on any other failure\n   */\n  async authenticate(input: {\n    params: CallbackParams;\n    stored: StoredAuthState;\n    redirectUri?: string;\n  }): Promise<CboxUser> {\n    const { params, stored } = input;\n\n    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {\n      throw new InvalidStateError('The login state did not match — the request may be forged or stale.');\n    }\n\n    if (params.error) {\n      throw new AuthenticationError(\n        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ''}`,\n      );\n    }\n\n    if (!params.code) {\n      throw new AuthenticationError('The callback was missing an authorization code.');\n    }\n\n    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);\n\n    if (!tokens.access_token) {\n      throw new AuthenticationError('No access token was returned.');\n    }\n\n    let claims: Record<string, unknown> = {};\n    if (tokens.id_token) {\n      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);\n    }\n    // Enrich with userinfo (email/name/org a minimal id_token may omit).\n    claims = { ...claims, ...(await this.userinfo(tokens.access_token)) };\n\n    const sub = claims['sub'];\n    if (typeof sub !== 'string' || sub === '') {\n      throw new AuthenticationError('The verified token carried no subject.');\n    }\n\n    const organizations = parseOrganizations(claims['organizations']);\n\n    return {\n      id: sub,\n      email: typeof claims['email'] === 'string' ? claims['email'] : null,\n      name: typeof claims['name'] === 'string' ? claims['name'] : null,\n      organizationId: typeof claims['org'] === 'string' ? claims['org'] : null,\n      // Only present when the instance emitted the claim (exactOptionalPropertyTypes).\n      ...(organizations ? { organizations } : {}),\n      claims,\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n    };\n  }\n\n  /**\n   * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`\n   * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the\n   * returned `refreshToken` and discard the one you passed — presenting a rotated\n   * token again revokes the entire token family.\n   *\n   * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.\n   */\n  async refresh(refreshToken: string): Promise<RefreshedTokens> {\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.config.clientId,\n      refresh_token: refreshToken,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token refresh failed: ${await response.text()}`);\n    }\n\n    const tokens = (await response.json()) as TokenResponse;\n    if (!tokens.access_token) {\n      throw new AuthenticationError('The refresh response carried no access token.');\n    }\n\n    return {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n      scope: typeof tokens.scope === 'string' ? tokens.scope : null,\n    };\n  }\n\n  /**\n   * The URL of the instance's hosted account/profile page (self-service password,\n   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox\n   * ID session; `returnTo` is passed so the page can link back to your app.\n   */\n  profileUrl(returnTo?: string): string {\n    const base = `${this.config.issuer.replace(/\\/$/, '')}${this.accountPath()}`;\n    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;\n  }\n\n  /** The RP-initiated logout URL, or null when the instance advertises none. */\n  async logoutUrl(returnTo?: string): Promise<string | null> {\n    const endpoint = await this.discovery.optionalEndpoint('end_session_endpoint');\n    if (!endpoint) {\n      return null;\n    }\n    return returnTo\n      ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}`\n      : endpoint;\n  }\n\n  /**\n   * A machine (client-credentials) access token for calling Cbox ID APIs as your\n   * app, not on a user's behalf. Requires a client secret.\n   */\n  async machineToken(options: { scopes?: string[]; resource?: string } = {}): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.config.clientId,\n      client_secret: this.requireSecret(),\n    });\n    if (options.scopes && options.scopes.length > 0) {\n      body.set('scope', options.scopes.join(' '));\n    }\n    if (options.resource) {\n      body.set('resource', options.resource);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token?: unknown };\n    if (typeof json.access_token !== 'string') {\n      throw new AuthenticationError('The token response had no access_token.');\n    }\n    return json.access_token;\n  }\n\n  /** The OIDC userinfo claims for an access token. */\n  async userinfo(accessToken: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.optionalEndpoint('userinfo_endpoint');\n    if (!endpoint) {\n      return {};\n    }\n    const response = await this.fetchWithTimeout(endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    if (!response.ok) {\n      throw new AuthenticationError('Userinfo request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7662 token introspection (confidential-client auth). Returns the raw\n   * response; `active` tells you if the token is currently valid. Requires a secret.\n   */\n  async introspect(token: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.endpoint('introspection_endpoint');\n    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);\n    const response = await this.post(\n      endpoint,\n      new URLSearchParams({ token }),\n      { authorization: `Basic ${basic}` },\n    );\n    if (!response.ok) {\n      throw new AuthenticationError('Introspection request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */\n  verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n    return verifyWebhook(options);\n  }\n\n  /**\n   * A Token Vault client bound to an access token. Obtain the token with\n   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to\n   * redeem), then call `store` / `grant` / `lease` etc.\n   */\n  vault(accessToken: string): VaultClient {\n    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 10_000);\n  }\n\n  private async exchange(code: string, verifier: string, redirectUri?: string): Promise<TokenResponse> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri ?? this.config.redirectUri,\n      client_id: this.config.clientId,\n      code_verifier: verifier,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);\n    }\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async verifyIdToken(idToken: string, nonce: string): Promise<Record<string, unknown>> {\n    const jwksUri = await this.discovery.endpoint('jwks_uri');\n    let resolver = this.jwksByUri.get(jwksUri);\n    if (!resolver) {\n      resolver = createRemoteJWKSet(new URL(jwksUri));\n      this.jwksByUri.set(jwksUri, resolver);\n    }\n\n    let payload: JWTPayload;\n    try {\n      ({ payload } = await jwtVerify(idToken, resolver, {\n        issuer: this.config.issuer,\n        audience: this.config.clientId,\n      }));\n    } catch (error) {\n      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);\n    }\n\n    if (nonce && payload['nonce'] !== nonce) {\n      throw new AuthenticationError('The id_token nonce did not match — possible replay.');\n    }\n\n    return payload as Record<string, unknown>;\n  }\n\n  private scopes(): string[] {\n    const scopes = this.config.scopes;\n    return scopes && scopes.length > 0 ? scopes : ['openid', 'profile', 'email'];\n  }\n\n  private accountPath(): string {\n    const path = this.config.accountPath;\n    return path && path !== '' ? `/${path.replace(/^\\//, '')}` : '/settings';\n  }\n\n  private requireSecret(): string {\n    if (!this.config.clientSecret) {\n      throw new ConfigurationError('This call requires a `clientSecret`, but none is configured.');\n    }\n    return this.config.clientSecret;\n  }\n\n  private post(url: string, body: URLSearchParams, headers: Record<string, string> = {}): Promise<Response> {\n    return this.fetchWithTimeout(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded', ...headers },\n      body,\n    });\n  }\n\n  private async fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 10_000);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/** Constant-time string compare, so state validation doesn't leak via timing. */\nfunction timingSafeEqualString(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\n/**\n * Parse an `organizations` claim into typed orgs, ignoring anything malformed. The\n * claim is optional and instance-specific; absent or non-array → undefined, so\n * callers can tell \"no claim\" from \"empty\".\n */\nfunction parseOrganizations(claim: unknown): CboxOrganization[] | undefined {\n  if (!Array.isArray(claim)) {\n    return undefined;\n  }\n  const orgs: CboxOrganization[] = [];\n  for (const entry of claim) {\n    if (typeof entry !== 'object' || entry === null) {\n      continue;\n    }\n    const record = entry as Record<string, unknown>;\n    const id = record['id'];\n    const name = record['name'];\n    if (typeof id === 'string' && id !== '' && typeof name === 'string' && name !== '') {\n      orgs.push({ id, name, role: typeof record['role'] === 'string' ? record['role'] : null });\n    }\n  }\n  return orgs;\n}\n","import { NextResponse, type NextRequest } from 'next/server';\nimport { CboxIdClient } from './client.js';\nimport { ConfigurationError } from './errors.js';\nimport type { CboxIdConfig, CboxUser } from './types.js';\n\n/**\n * First-class Next.js (App Router) adapter for {@link CboxIdClient}. It wires the\n * framework-agnostic core to short-lived, httpOnly cookies so login is a couple of\n * route handlers:\n *\n * ```ts\n * // app/auth/[...cbox]/route.ts is up to you; a minimal wiring:\n * import { cboxId } from '@/lib/cbox';\n *\n * export async function GET(request: NextRequest) {\n *   return cboxId.signIn();\n * }\n * ```\n *\n * The temporary state/verifier/nonce cookies are httpOnly, `SameSite=Lax`, and\n * expire in 10 minutes, so a stalled login cleans itself up.\n */\n\nconst COOKIE = {\n  state: 'cbox_id_state',\n  verifier: 'cbox_id_verifier',\n  nonce: 'cbox_id_nonce',\n} as const;\n\nconst TEMP_COOKIE_MAX_AGE = 600; // 10 minutes\n\nexport interface CboxIdNext {\n  /** The underlying framework-agnostic client. */\n  readonly client: CboxIdClient;\n  /** Redirect to Cbox ID's authorize endpoint, stashing PKCE/state/nonce in cookies. */\n  signIn(options?: { scopes?: string[]; prompt?: string; loginHint?: string }): Promise<NextResponse>;\n  /** Complete login on your callback route; returns the authenticated user. */\n  callback(request: NextRequest): Promise<CboxUser>;\n  /** The hosted profile-page URL (`return_to` appended when given). */\n  profileUrl(returnTo?: string): string;\n  /** A redirect response to the hosted profile page. */\n  profileRedirect(returnTo?: string): NextResponse;\n  /** RP-initiated logout URL, or null when the instance advertises none. */\n  signOutUrl(returnTo?: string): Promise<string | null>;\n}\n\n/**\n * Build a Next.js adapter. Pass a config, or omit it to read from the environment\n * (`CBOX_ID_ISSUER`, `CBOX_ID_CLIENT_ID`, `CBOX_ID_CLIENT_SECRET`,\n * `CBOX_ID_REDIRECT_URI`).\n */\nexport function createCboxId(config?: Partial<CboxIdConfig>): CboxIdNext {\n  const resolved = resolveConfig(config);\n  const client = new CboxIdClient(resolved);\n\n  const tempCookieOptions = {\n    httpOnly: true,\n    secure: true,\n    sameSite: 'lax' as const,\n    path: '/',\n    maxAge: TEMP_COOKIE_MAX_AGE,\n  };\n\n  return {\n    client,\n\n    async signIn(options = {}) {\n      const request = await client.createAuthorizationRequest(options);\n      const response = NextResponse.redirect(request.url);\n      response.cookies.set(COOKIE.state, request.state, tempCookieOptions);\n      response.cookies.set(COOKIE.verifier, request.codeVerifier, tempCookieOptions);\n      response.cookies.set(COOKIE.nonce, request.nonce, tempCookieOptions);\n      return response;\n    },\n\n    async callback(request) {\n      return client.authenticate({\n        params: {\n          code: request.nextUrl.searchParams.get('code'),\n          state: request.nextUrl.searchParams.get('state'),\n          error: request.nextUrl.searchParams.get('error'),\n          error_description: request.nextUrl.searchParams.get('error_description'),\n        },\n        stored: {\n          state: request.cookies.get(COOKIE.state)?.value ?? '',\n          codeVerifier: request.cookies.get(COOKIE.verifier)?.value ?? '',\n          nonce: request.cookies.get(COOKIE.nonce)?.value ?? '',\n        },\n      });\n    },\n\n    profileUrl(returnTo) {\n      return client.profileUrl(returnTo);\n    },\n\n    profileRedirect(returnTo) {\n      return NextResponse.redirect(client.profileUrl(returnTo));\n    },\n\n    signOutUrl(returnTo) {\n      return client.logoutUrl(returnTo);\n    },\n  };\n}\n\nfunction resolveConfig(config?: Partial<CboxIdConfig>): CboxIdConfig {\n  const issuer = config?.issuer ?? process.env['CBOX_ID_ISSUER'];\n  const clientId = config?.clientId ?? process.env['CBOX_ID_CLIENT_ID'];\n  const redirectUri = config?.redirectUri ?? process.env['CBOX_ID_REDIRECT_URI'];\n  const clientSecret = config?.clientSecret ?? process.env['CBOX_ID_CLIENT_SECRET'];\n\n  if (!issuer || !clientId || !redirectUri) {\n    throw new ConfigurationError(\n      'Cbox ID needs issuer, clientId and redirectUri — pass them to createCboxId() or set CBOX_ID_ISSUER / CBOX_ID_CLIENT_ID / CBOX_ID_REDIRECT_URI.',\n    );\n  }\n\n  return {\n    issuer,\n    clientId,\n    redirectUri,\n    ...(clientSecret ? { clientSecret } : {}),\n    ...(config?.scopes ? { scopes: config.scopes } : {}),\n    ...(config?.accountPath ? { accountPath: config.accountPath } : {}),\n    ...(config?.timeoutMs ? { timeoutMs: config.timeoutMs } : {}),\n    ...(config?.cacheTtlMs ? { cacheTtlMs: config.cacheTtlMs } : {}),\n  };\n}\n"]}

package/dist/nextjs.d.cts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { a as CboxIdClient, c as CboxUser, b as CboxIdConfig } from './client-CjmGxfIA.cjs';
+import { a as CboxIdClient, c as CboxUser, b as CboxIdConfig } from './client-BJ8m6qgt.cjs';
 
 interface CboxIdNext {
     /** The underlying framework-agnostic client. */

package/dist/nextjs.d.ts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { a as CboxIdClient, c as CboxUser, b as CboxIdConfig } from './client-CjmGxfIA.js';
+import { a as CboxIdClient, c as CboxUser, b as CboxIdConfig } from './client-BJ8m6qgt.js';
 
 interface CboxIdNext {
     /** The underlying framework-agnostic client. */

package/dist/nextjs.js

@@ -1,4 +1,4 @@
-import { CboxIdClient, ConfigurationError } from './chunk-U6KYO2XA.js';
+import { CboxIdClient, ConfigurationError } from './chunk-J4GSNFRQ.js';
 import { NextResponse } from 'next/server';
 
 var COOKIE = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cboxdk/id-js",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Turnkey Cbox ID client for JavaScript/TypeScript — OpenID Connect login (PKCE + id_token verification via JWKS), hosted profile-management redirect, machine tokens, UserInfo, RFC 7662 introspection, and webhook signature verification. Runs on Node, edge, and the browser, with a first-class Next.js adapter.",
   "type": "module",
   "license": "MIT",

package/dist/chunk-U6KYO2XA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/errors.ts","../src/pkce.ts","../src/vault.ts","../src/webhook.ts","../src/discovery.ts","../src/client.ts"],"names":["key"],"mappings":";;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC;AAM9C,IAAM,iBAAA,GAAN,cAAgC,WAAA,CAAY;AAAC;AAM7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC;;;ACnBtD,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;AAGO,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB;AAGA,eAAsB,UAAU,QAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACvF,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC;;;ACQO,IAAM,cAAN,MAAkB;AAAA,EAGvB,WAAA,CACE,MAAA,EACiB,KAAA,EACA,SAAA,GAAY,GAAA,EAC7B;AAFiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAEjB,IAAA,IAAA,CAAK,OAAO,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,aAAA,CAAA;AAAA,EAC1C;AAAA,EAJmB,KAAA;AAAA,EACA,SAAA;AAAA,EALF,IAAA;AAAA;AAAA,EAWjB,MAAM,KAAA,EAAkD;AACtD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY;AAAA,MACnD,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,YAAY,KAAA,CAAM,SAAA;AAAA,MAClB,UAAU,KAAA,CAAM,OAAA;AAAA,MAChB,YAAY,KAAA,CAAM;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAA,CAAO,UAAkB,MAAA,EAAyC;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAAA,EACxG;AAAA;AAAA,EAGA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAM,KAAK,OAAA,CAAQ,QAAA,EAAU,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACzE;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,QAAA,EACA,aAAA,EAC+E;AAC/E,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MAC1E,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB;AAAA,KAClB,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACf,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,UAAU,CAAA,CAAE,SAAA,EAAW,UAAU,CAAA,CAAE,SAAA,EAAW,aAAA,EAAe,CAAA,CAAE,eAAA,EAAgB;AAAA,IAC1F,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,QAAA,EAAkB,QAAA,EAAiC;AACnE,IAAA,MAAM,IAAA,CAAK,OAAA;AAAA,MACT,QAAA;AAAA,MACA,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,UAAkB,OAAA,EAAsC;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,mBAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU,EAAE,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACpG,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,QAAA,EAAU,CAAA,CAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW;AAAA,IAClG,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,IAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA2C;AAC7F,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,OAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AACrG,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAoB;AAAA,QACxB,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,UACnC,GAAI,IAAA,GAAO,EAAE,cAAA,EAAgB,kBAAA,KAAuB;AAAC,SACvD;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACrB;AACA,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACjC;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA;AACxD,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,oBAAoB,CAAA,MAAA,EAAS,MAAM,IAAI,IAAI,CAAA,oBAAA,EAAuB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AACA,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;;;AC3HA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAEA,SAAS,MAAM,KAAA,EAA4B;AACzC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,CACpC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAgBA,eAAsB,cAAc,OAAA,EAAiD;AACnF,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAiB,MAAA,EAAO,GAAI,OAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,OAAA,IAAW,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,CAACA,MAAK,KAAK,CAAA,GAAI,QAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChD,IAAA,IAAIA,IAAAA,EAAK;AACP,MAAA,KAAA,CAAMA,IAAG,IAAI,KAAA,IAAS,EAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,GAAG,CAAA,IAAK,EAAA;AAChC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AAEjC,EAAA,IAAI,SAAA,KAAc,MAAM,SAAA,KAAc,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,QAAA,GAAW,KAAA;AAAA,IACf,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,EAAE,CAAC;AAAA,GAC3F;AAEA,EAAA,OAAO,eAAA,CAAgB,UAAU,SAAS,CAAA;AAC5C;;;ACxEO,IAAM,YAAN,MAAgB;AAAA,EAGrB,YACmB,MAAA,EACA,SAAA,EACA,UAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EAC1C;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAChB;AAAA,EAJgB,MAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,GAAA;AAAA,EANX,MAAA,GAA+D,IAAA;AAAA,EASvE,MAAM,QAAA,GAAuC;AAC3C,IAAA,IAAI,KAAK,MAAA,IAAU,IAAA,CAAK,OAAO,SAAA,GAAY,IAAA,CAAK,KAAI,EAAG;AACrD,MAAA,OAAO,KAAK,MAAA,CAAO,GAAA;AAAA,IACrB;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iCAAA,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC1F;AACA,MAAA,GAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACxC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,0BAAA,EAA6B,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAA,EAAK,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,KAAK,UAAA,EAAW;AAC7D,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAgD;AAC7D,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,IAAA,EAAuD;AAC5E,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,KAAK,KAAA,GAAQ,IAAA;AAAA,EAC7D;AACF;;;AClBO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAA6B,MAAA,EAAsB;AAAtB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,MAAM,IAAI,mBAAmB,wCAAwC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,IAC1E;AACA,IAAA,IAAA,CAAK,YAAY,IAAI,SAAA;AAAA,MACnB,MAAA,CAAO,MAAA;AAAA,MACP,OAAO,SAAA,IAAa,GAAA;AAAA,MACpB,OAAO,UAAA,IAAc;AAAA,KACvB;AAAA,EACF;AAAA,EAf6B,MAAA;AAAA,EAHZ,SAAA;AAAA,EACA,SAAA,uBAAgB,GAAA,EAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB3D,MAAM,0BAAA,CAA2B,OAAA,GAO7B,EAAC,EAAkC;AACrC,IAAA,MAAM,eAAe,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,CAAY,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,aAAA,EAAe,MAAA;AAAA,MACf,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,YAAA,EAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACjD,QAAQ,OAAA,CAAQ,MAAA,IAAU,KAAK,MAAA,EAAO,EAAG,KAAK,GAAG,CAAA;AAAA,MACjD,KAAA;AAAA,MACA,KAAA;AAAA,MACA,cAAA,EAAgB,MAAM,SAAA,CAAU,YAAY,CAAA;AAAA,MAC5C,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA;AAAA,IACrC;AACA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,YAAA,EAAc,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAO,YAAA,EAAc,KAAA,EAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,KAAA,EAIG;AACpB,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAE3B,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,qBAAA,CAAsB,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxF,MAAA,MAAM,IAAI,kBAAkB,0EAAqE,CAAA;AAAA,IACnG;AAEA,IAAA,IAAI,OAAO,KAAA,EAAO;AAChB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,EAAG,MAAA,CAAO,oBAAoB,CAAA,EAAA,EAAK,MAAA,CAAO,iBAAiB,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,OAC/G;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,MAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,IACjF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,IAAA,EAAM,MAAA,CAAO,YAAA,EAAc,KAAA,CAAM,WAAW,CAAA;AAEtF,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,SAAkC,EAAC;AACvC,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,OAAO,KAAK,CAAA;AAAA,IACjE;AAEA,IAAA,MAAA,GAAS,EAAE,GAAG,MAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA,EAAG;AAEpE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,MAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,IACxE;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA;AAAA,MACJ,KAAA,EAAO,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,IAAA;AAAA,MAC/D,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,IAAA;AAAA,MAC5D,cAAA,EAAgB,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,IAAA;AAAA,MACpE,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAAA,EAA2B;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA;AAC1E,IAAA,OAAO,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GAAK,IAAA;AAAA,EAC3F;AAAA;AAAA,EAGA,MAAM,UAAU,QAAA,EAA2C;AACzD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,sBAAsB,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,QAAA,GACH,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,wBAAA,EAA0B,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GACrF,QAAA;AAAA,EACN;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CAAa,OAAA,GAAoD,EAAC,EAAoB;AAC1F,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe,KAAK,aAAA;AAAc,KACnC,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC/C,MAAA,IAAA,CAAK,IAAI,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,EAAiC,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACxF;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,oBAAoB,yCAAyC,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,SAAS,WAAA,EAAuD;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAC1E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU;AAAA,MACrD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,0BAA0B,CAAA;AAAA,IAC1D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,KAAA,EAAiD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,aAAA,EAAe,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,CAAA;AAAA,MAC7B,EAAE,aAAA,EAAe,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA;AAAG,KACpC;AACA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,cAAc,OAAA,EAAiD;AAC7D,IAAA,OAAO,cAAc,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,EAAkC;AACtC,IAAA,OAAO,IAAI,YAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAAA,EACzF;AAAA,EAEA,MAAc,QAAA,CAAS,IAAA,EAAc,QAAA,EAAkB,WAAA,EAA8C;AACnG,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,YAAA,EAAc,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAAA,MACzC,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,uBAAA,EAA0B,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACjF;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,aAAA,CAAc,OAAA,EAAiB,KAAA,EAAiD;AAC5F,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,UAAU,CAAA;AACxD,IAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAW,kBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,SAAS,QAAA,EAAU;AAAA,QAChD,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,QACpB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,oCAAA,EAAuC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,OAAO,CAAA,KAAM,KAAA,EAAO;AACvC,MAAA,MAAM,IAAI,oBAAoB,0DAAqD,CAAA;AAAA,IACrF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,MAAA,GAAmB;AACzB,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA;AAC3B,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,QAAA,EAAU,WAAW,OAAO,CAAA;AAAA,EAC7E;AAAA,EAEQ,WAAA,GAAsB;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,MAAA,CAAO,WAAA;AACzB,IAAA,OAAO,IAAA,IAAQ,SAAS,EAAA,GAAK,CAAA,CAAA,EAAI,KAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,CAAA,GAAK,WAAA;AAAA,EAC/D;AAAA,EAEQ,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AAC7B,MAAA,MAAM,IAAI,mBAAmB,8DAA8D,CAAA;AAAA,IAC7F;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA;AAAA,EACrB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,IAAA,EAAuB,OAAA,GAAkC,EAAC,EAAsB;AACxG,IAAA,OAAO,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,GAAG,OAAA,EAAQ;AAAA,MAC3E;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAsC;AAChF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAClF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;AAGA,SAAS,qBAAA,CAAsB,GAAW,CAAA,EAAoB;AAC5D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB","file":"chunk-U6KYO2XA.js","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n */\nexport class AuthenticationError extends CboxIdError {}\n","/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n","import { AuthenticationError } from './errors.js';\n\n/** A stored vault secret's metadata (never its plaintext). */\nexport interface VaultSecretRef {\n  id: string;\n  name: string;\n  provider: string;\n  ownerType: string | null;\n  ownerId: string | null;\n  expiresAt: string | null;\n  revoked: boolean;\n}\n\n/** A brokered credential — the plaintext, for immediate use. */\nexport interface VaultLease {\n  secretId: string;\n  provider: string;\n  secret: string;\n  expiresAt: string;\n}\n\nexport interface StoreSecretInput {\n  name: string;\n  provider: string;\n  secret: string;\n  ownerType?: 'organization' | 'user';\n  ownerId?: string;\n  expiresAt?: string;\n}\n\n/**\n * Client for a Cbox ID instance's Token Vault API. Bind it to an access token\n * (obtain one with {@link CboxIdClient.machineToken}, scoped `vault.manage` for\n * provisioning or `vault.lease` for redeeming). All calls are server-to-server.\n */\nexport class VaultClient {\n  private readonly base: string;\n\n  constructor(\n    issuer: string,\n    private readonly token: string,\n    private readonly timeoutMs = 10_000,\n  ) {\n    this.base = `${issuer.replace(/\\/$/, '')}/api/v1/vault`;\n  }\n\n  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */\n  store(input: StoreSecretInput): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', '/secrets', {\n      name: input.name,\n      provider: input.provider,\n      secret: input.secret,\n      owner_type: input.ownerType,\n      owner_id: input.ownerId,\n      expires_at: input.expiresAt,\n    });\n  }\n\n  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */\n  rotate(secretId: string, secret: string): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });\n  }\n\n  /** Revoke a secret permanently (scope `vault.manage`). */\n  async revoke(secretId: string): Promise<void> {\n    await this.request('DELETE', `/secrets/${encodeURIComponent(secretId)}`);\n  }\n\n  /** Authorize an agent client to lease a secret (scope `vault.manage`). */\n  grant(\n    secretId: string,\n    clientId: string,\n    maxTtlSeconds?: number,\n  ): Promise<{ secretId: string; clientId: string; maxTtlSeconds: number | null }> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/grants`, {\n      client_id: clientId,\n      max_ttl_seconds: maxTtlSeconds,\n    }).then((raw) => {\n      const r = raw as { secret_id: string; client_id: string; max_ttl_seconds: number | null };\n      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };\n    });\n  }\n\n  /** Revoke an agent's authorization (scope `vault.manage`). */\n  async revokeGrant(secretId: string, clientId: string): Promise<void> {\n    await this.request(\n      'DELETE',\n      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`,\n    );\n  }\n\n  /**\n   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller\n   * is identified by the token's client; a lease with no live grant is refused.\n   */\n  lease(secretId: string, purpose: string): Promise<VaultLease> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {\n      const r = raw as { secret_id: string; provider: string; secret: string; expires_at: string };\n      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };\n    });\n  }\n\n  private async json<T>(method: string, path: string, body: Record<string, unknown>): Promise<T> {\n    const response = await this.request(method, path, body);\n    return (await response.json()) as T;\n  }\n\n  private async request(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    try {\n      const init: RequestInit = {\n        method,\n        headers: {\n          authorization: `Bearer ${this.token}`,\n          ...(body ? { 'content-type': 'application/json' } : {}),\n        },\n        signal: controller.signal,\n      };\n      if (body) {\n        init.body = JSON.stringify(body);\n      }\n      const response = await fetch(`${this.base}${path}`, init);\n      if (!response.ok) {\n        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);\n      }\n      return response;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n","/**\n * Verify a Cbox ID webhook / inline-action signature. The header is\n * `X-Cbox-Signature: t={unix},v1={hex hmac}` — an HMAC-SHA256 over\n * `\"{timestamp}.{raw body}\"`, valid within a freshness window. Built on Web Crypto\n * so it runs on Node, edge and the browser.\n */\n\n/** Constant-time compare of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport interface VerifyWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The value of the `X-Cbox-Signature` header. */\n  signatureHeader: string | null | undefined;\n  /** The signing secret issued when the webhook/action endpoint was registered. */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\n/** Returns `true` only when the signature is present, fresh and valid. Never throws. */\nexport async function verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n  const { payload, signatureHeader, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  if (!signatureHeader) {\n    return false;\n  }\n\n  const parts: Record<string, string> = {};\n  for (const segment of signatureHeader.split(',')) {\n    const [key, value] = segment.trim().split('=', 2);\n    if (key) {\n      parts[key] = value ?? '';\n    }\n  }\n\n  const timestamp = parts['t'] ?? '';\n  const signature = parts['v1'] ?? '';\n\n  if (timestamp === '' || signature === '' || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const expected = toHex(\n    await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${payload}`)),\n  );\n\n  return timingSafeEqual(expected, signature);\n}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport type { DiscoveryDocument } from './types.js';\n\n/**\n * Fetches and caches an instance's OIDC discovery document. One instance of this\n * lives per {@link CboxIdClient}; the document is refetched only after the TTL.\n */\nexport class Discovery {\n  private cached: { doc: DiscoveryDocument; expiresAt: number } | null = null;\n\n  constructor(\n    private readonly issuer: string,\n    private readonly timeoutMs: number,\n    private readonly cacheTtlMs: number,\n    private readonly now: () => number = Date.now,\n  ) {}\n\n  async document(): Promise<DiscoveryDocument> {\n    if (this.cached && this.cached.expiresAt > this.now()) {\n      return this.cached.doc;\n    }\n\n    const url = `${this.issuer.replace(/\\/$/, '')}/.well-known/openid-configuration`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let doc: DiscoveryDocument;\n    try {\n      const response = await fetch(url, { signal: controller.signal });\n      if (!response.ok) {\n        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);\n      }\n      doc = (await response.json()) as DiscoveryDocument;\n    } catch (error) {\n      if (error instanceof AuthenticationError) {\n        throw error;\n      }\n      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (typeof doc.issuer !== 'string' || doc.issuer === '') {\n      throw new AuthenticationError('The discovery document was missing an issuer.');\n    }\n\n    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };\n    return doc;\n  }\n\n  /** A required endpoint from the discovery document. */\n  async endpoint(name: keyof DiscoveryDocument): Promise<string> {\n    const value = (await this.document())[name];\n    if (typeof value !== 'string' || value === '') {\n      throw new ConfigurationError(`The instance does not advertise a ${name}.`);\n    }\n    return value;\n  }\n\n  /** An optional endpoint, or null when the instance advertises none. */\n  async optionalEndpoint(name: keyof DiscoveryDocument): Promise<string | null> {\n    const value = (await this.document())[name];\n    return typeof value === 'string' && value !== '' ? value : null;\n  }\n}\n","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { Discovery } from './discovery.js';\nimport { AuthenticationError, ConfigurationError, InvalidStateError } from './errors.js';\nimport { challenge, createVerifier, randomToken } from './pkce.js';\nimport type {\n  AuthorizationRequest,\n  CboxIdConfig,\n  CboxUser,\n  TokenResponse,\n} from './types.js';\nimport { VaultClient } from './vault.js';\nimport { verifyWebhook, type VerifyWebhookOptions } from './webhook.js';\n\ntype JwksResolver = ReturnType<typeof createRemoteJWKSet>;\n\n/** Query parameters as they arrive on your callback route. */\nexport interface CallbackParams {\n  code?: string | null;\n  state?: string | null;\n  error?: string | null;\n  error_description?: string | null;\n}\n\n/** The values you persisted from {@link CboxIdClient.createAuthorizationRequest}. */\nexport interface StoredAuthState {\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n}\n\n/**\n * Turnkey Cbox ID client for JavaScript/TypeScript. It speaks standard OpenID\n * Connect against a Cbox ID instance — so integrating is a redirect and a callback,\n * not a rewrite — and adds the conveniences a hosted-identity product needs: a\n * redirect to the instance's hosted profile page, and back-channel helpers (machine\n * tokens, userinfo, introspection, webhook verification).\n *\n * Login is hardened by default: PKCE (S256), a CSRF state check, a nonce, and full\n * id_token signature + issuer + audience verification against the instance's JWKS\n * (via `jose`).\n *\n * The class is framework-agnostic: {@link createAuthorizationRequest} hands you the\n * `state`, `codeVerifier` and `nonce` to persist however you like, and\n * {@link authenticate} takes them back. For Next.js, the `@cboxdk/id-js/nextjs`\n * entry wires this to cookies for you.\n */\nexport class CboxIdClient {\n  private readonly discovery: Discovery;\n  private readonly jwksByUri = new Map<string, JwksResolver>();\n\n  constructor(private readonly config: CboxIdConfig) {\n    if (!config.issuer) {\n      throw new ConfigurationError('Cbox ID config `issuer` is required.');\n    }\n    if (!config.clientId) {\n      throw new ConfigurationError('Cbox ID config `clientId` is required.');\n    }\n    if (!config.redirectUri) {\n      throw new ConfigurationError('Cbox ID config `redirectUri` is required.');\n    }\n    this.discovery = new Discovery(\n      config.issuer,\n      config.timeoutMs ?? 10_000,\n      config.cacheTtlMs ?? 3_600_000,\n    );\n  }\n\n  /**\n   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and\n   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back\n   * to {@link authenticate} on the callback.\n   */\n  async createAuthorizationRequest(options: {\n    scopes?: string[];\n    redirectUri?: string;\n    state?: string;\n    prompt?: string;\n    loginHint?: string;\n    maxAge?: number;\n  } = {}): Promise<AuthorizationRequest> {\n    const codeVerifier = createVerifier();\n    const state = options.state ?? randomToken(16);\n    const nonce = randomToken(16);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: options.redirectUri ?? this.config.redirectUri,\n      scope: (options.scopes ?? this.scopes()).join(' '),\n      state,\n      nonce,\n      code_challenge: await challenge(codeVerifier),\n      code_challenge_method: 'S256',\n    });\n    if (options.prompt) {\n      params.set('prompt', options.prompt);\n    }\n    if (options.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n    if (typeof options.maxAge === 'number') {\n      params.set('max_age', String(options.maxAge));\n    }\n\n    const endpoint = await this.discovery.endpoint('authorization_endpoint');\n    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };\n  }\n\n  /**\n   * Complete login on your callback route: verify state, exchange the code with the\n   * PKCE verifier, verify the id_token, and return the authenticated user.\n   *\n   * @throws InvalidStateError when state does not match (forged/stale request)\n   * @throws AuthenticationError on any other failure\n   */\n  async authenticate(input: {\n    params: CallbackParams;\n    stored: StoredAuthState;\n    redirectUri?: string;\n  }): Promise<CboxUser> {\n    const { params, stored } = input;\n\n    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {\n      throw new InvalidStateError('The login state did not match — the request may be forged or stale.');\n    }\n\n    if (params.error) {\n      throw new AuthenticationError(\n        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ''}`,\n      );\n    }\n\n    if (!params.code) {\n      throw new AuthenticationError('The callback was missing an authorization code.');\n    }\n\n    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);\n\n    if (!tokens.access_token) {\n      throw new AuthenticationError('No access token was returned.');\n    }\n\n    let claims: Record<string, unknown> = {};\n    if (tokens.id_token) {\n      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);\n    }\n    // Enrich with userinfo (email/name/org a minimal id_token may omit).\n    claims = { ...claims, ...(await this.userinfo(tokens.access_token)) };\n\n    const sub = claims['sub'];\n    if (typeof sub !== 'string' || sub === '') {\n      throw new AuthenticationError('The verified token carried no subject.');\n    }\n\n    return {\n      id: sub,\n      email: typeof claims['email'] === 'string' ? claims['email'] : null,\n      name: typeof claims['name'] === 'string' ? claims['name'] : null,\n      organizationId: typeof claims['org'] === 'string' ? claims['org'] : null,\n      claims,\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n    };\n  }\n\n  /**\n   * The URL of the instance's hosted account/profile page (self-service password,\n   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox\n   * ID session; `returnTo` is passed so the page can link back to your app.\n   */\n  profileUrl(returnTo?: string): string {\n    const base = `${this.config.issuer.replace(/\\/$/, '')}${this.accountPath()}`;\n    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;\n  }\n\n  /** The RP-initiated logout URL, or null when the instance advertises none. */\n  async logoutUrl(returnTo?: string): Promise<string | null> {\n    const endpoint = await this.discovery.optionalEndpoint('end_session_endpoint');\n    if (!endpoint) {\n      return null;\n    }\n    return returnTo\n      ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}`\n      : endpoint;\n  }\n\n  /**\n   * A machine (client-credentials) access token for calling Cbox ID APIs as your\n   * app, not on a user's behalf. Requires a client secret.\n   */\n  async machineToken(options: { scopes?: string[]; resource?: string } = {}): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.config.clientId,\n      client_secret: this.requireSecret(),\n    });\n    if (options.scopes && options.scopes.length > 0) {\n      body.set('scope', options.scopes.join(' '));\n    }\n    if (options.resource) {\n      body.set('resource', options.resource);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token?: unknown };\n    if (typeof json.access_token !== 'string') {\n      throw new AuthenticationError('The token response had no access_token.');\n    }\n    return json.access_token;\n  }\n\n  /** The OIDC userinfo claims for an access token. */\n  async userinfo(accessToken: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.optionalEndpoint('userinfo_endpoint');\n    if (!endpoint) {\n      return {};\n    }\n    const response = await this.fetchWithTimeout(endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    if (!response.ok) {\n      throw new AuthenticationError('Userinfo request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7662 token introspection (confidential-client auth). Returns the raw\n   * response; `active` tells you if the token is currently valid. Requires a secret.\n   */\n  async introspect(token: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.endpoint('introspection_endpoint');\n    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);\n    const response = await this.post(\n      endpoint,\n      new URLSearchParams({ token }),\n      { authorization: `Basic ${basic}` },\n    );\n    if (!response.ok) {\n      throw new AuthenticationError('Introspection request failed.');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */\n  verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n    return verifyWebhook(options);\n  }\n\n  /**\n   * A Token Vault client bound to an access token. Obtain the token with\n   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to\n   * redeem), then call `store` / `grant` / `lease` etc.\n   */\n  vault(accessToken: string): VaultClient {\n    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 10_000);\n  }\n\n  private async exchange(code: string, verifier: string, redirectUri?: string): Promise<TokenResponse> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri ?? this.config.redirectUri,\n      client_id: this.config.clientId,\n      code_verifier: verifier,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);\n    }\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async verifyIdToken(idToken: string, nonce: string): Promise<Record<string, unknown>> {\n    const jwksUri = await this.discovery.endpoint('jwks_uri');\n    let resolver = this.jwksByUri.get(jwksUri);\n    if (!resolver) {\n      resolver = createRemoteJWKSet(new URL(jwksUri));\n      this.jwksByUri.set(jwksUri, resolver);\n    }\n\n    let payload: JWTPayload;\n    try {\n      ({ payload } = await jwtVerify(idToken, resolver, {\n        issuer: this.config.issuer,\n        audience: this.config.clientId,\n      }));\n    } catch (error) {\n      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);\n    }\n\n    if (nonce && payload['nonce'] !== nonce) {\n      throw new AuthenticationError('The id_token nonce did not match — possible replay.');\n    }\n\n    return payload as Record<string, unknown>;\n  }\n\n  private scopes(): string[] {\n    const scopes = this.config.scopes;\n    return scopes && scopes.length > 0 ? scopes : ['openid', 'profile', 'email'];\n  }\n\n  private accountPath(): string {\n    const path = this.config.accountPath;\n    return path && path !== '' ? `/${path.replace(/^\\//, '')}` : '/settings';\n  }\n\n  private requireSecret(): string {\n    if (!this.config.clientSecret) {\n      throw new ConfigurationError('This call requires a `clientSecret`, but none is configured.');\n    }\n    return this.config.clientSecret;\n  }\n\n  private post(url: string, body: URLSearchParams, headers: Record<string, string> = {}): Promise<Response> {\n    return this.fetchWithTimeout(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded', ...headers },\n      body,\n    });\n  }\n\n  private async fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 10_000);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/** Constant-time string compare, so state validation doesn't leak via timing. */\nfunction timingSafeEqualString(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n"]}