@gaballahtech/seba 0.0.0-stage → 0.2.1

package/dist/core/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGjE,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;AAEpF,6BAA6B;AAC7B,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAExD,sDAAsD;AACtD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,WAAW,YAAY,CAAC;AAEhE,yDAAyD;AACzD,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AA6BpD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,uFAAuF,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,+EAA+E,CACnG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,eAAe,CAAC,cAAc,KAAK,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;IACnB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,iBAAiB,QAAQ,4BAA4B;YACnD,6GAA6G,CAChH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,eAAe,CACvB,iBAAiB,QAAQ,+BAA+B;YACtD,iHAAiH,CACpH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,iBAAiB,QAAQ,gCAAgC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,WAAmB;IACrE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,WAAW,yBAAyB,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,QAAQ,GAAG,GAA8B,CAAC;IAEhD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,kBAAkB,CAC1B,8BAA8B,WAAW,qDAAqD;YAC5F,qBAAqB,kBAAkB,qBAAqB,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACjG,MAAM,IAAI,kBAAkB,CAC1B,8BAA8B,WAAW,yBAAyB,QAAQ,KAAK;YAC7E,+DAA+D,WAAW,IAAI,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,8BAA8B,WAAW,sDAAsD;YAC7F,qGAAqG,CACxG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,WAAW,uCAAuC,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,8BAA8B,WAAW,iCAAiC,GAAG,kCAAkC,CAChH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,kBAAkB,CAC1B,8BAA8B,WAAW,iCAAiC,GAAG,+BAA+B;gBAC1G,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAC1B,8BAA8B,WAAW,iCAAiC,GAAG,+BAA+B,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAqB;QAC/B,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,YAAwB;KACvC,CAAC;IACF,IAAI,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAuB;IAClF,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,6CAA6C,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAC1F,EAAE,SAAS,EAAE,CACd,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,CAC1B,uCAAuC,GAAG,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;YACzF,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,SAAS,CAAU,IAAI,EAAE,8BAA8B,GAAG,GAAG,CAAC,CAAC;IAC3E,OAAO,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA0B,EAAE,WAAmB;IACxF,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,yBAAyB,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACvD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,YAAY;IAQG;IAPX,KAAK,GAAG,CAAC,CAAC;IACV,IAAI,CAAS;IACJ,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,OAAO,GAAa,EAAE,CAAC;IAChC,YAAY,GAAG,CAAC,CAAC;IAEzB,YACmB,IAAY,EAC7B,OAAe;QADE,SAAI,GAAJ,IAAI,CAAQ;QAG7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;IACtB,CAAC;IAED,KAAK;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACxB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;gBACjG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,cAAc,CAAC,WAAW,GAAG,KAAK;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,KAAK,CAAC,kCAAkC,IAAI,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAEO,wBAAwB,CAAC,OAAe;QAC9C,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,OAAO,IAAI,EAAE,CAAC;gBACZ,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBACxB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;gBAChB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,KAAK,CACd,oFAAoF;oBAClF,mEAAmE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;IACtC,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,iDAAiD,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;IACtC,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,KAAK,CACd,4FAA4F;oBAC1F,sCAAsC,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACrC,CAAC;IAEO,WAAW;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,KAAK,yCAAyC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,QAAQ,EAAE,EAAE,CAAC;QAC9H,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAEO,iBAAiB;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACrB,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;gBAChB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAW,CAAC;YAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,IAAI,CAAC,YAAY,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnD,CAAC;IAEO,UAAU;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,GAAG,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,GAAG,CAAC;YACb,KAAK,IAAI;gBACP,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACnC,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACnC;gBACE,MAAM,IAAI,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAAc;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;QACrB,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAEO,qBAAqB;QAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,MAAM,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,KAAK,CACd,0BAA0B,MAAM,gCAAgC,MAAM,sBAAsB,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;IAChC,CAAC;IAEO,eAAe;QACrB,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAW,CAAC;YAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,kCAAkC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;gBACtF,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,GAAG,IAAI,kCAAkC,CAAC,CAAC;YAChF,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzB,CAAC;IAEO,UAAU;QAChB,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAEO,eAAe;QACrB,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QACvB,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEO,cAAc;QACpB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAW,CAAC;YAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;oBACvD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;gBAClB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;IAC7B,CAAC;IAEO,IAAI;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,OAAe;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,IAAI,kBAAkB,CAC3B,+CAA+C,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,CACpG,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA0B;IAChE,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/E,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,WAAmB;IACpE,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACvD,MAAM,EAAE,GAAI,KAAiC,CAAC,KAAK,CAAC,CAAC;oBACrD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,CAAC;IACX,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,IAAY;IAC5D,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY;IAC7C,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,QAAgB;IACrE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACpD,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa,EAAE,SAAuB;IACjF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,QAAQ,CAAC,WAAW,EACpB;QACE,OAAO,EAAE;YACP,MAAM,EAAE,oEAAoE;SAC7E;QACD,QAAQ,EAAE,QAAQ;KACnB,EACD,EAAE,SAAS,EAAE,CACd,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,KAAK,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;YACvF,aAAa,QAAQ,CAAC,WAAW,0CAA0C,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/E,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEvD,IAAI,UAAU,GAAsB,EAAE,CAAC;IACvC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QACzE,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtG,IAAI,CAAC;YACH,UAAU,GAAG,uBAAuB,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAClG,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,0BAA0B,KAAK,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAClG,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC,YAAY,EAAE,CAAC;QAChG,MAAM,IAAI,kBAAkB,CAC1B,0BAA0B,KAAK,sBAAsB,QAAQ,CAAC,KAAK,MAAM,qBAAqB,cAAc;YAC1G,GAAG,MAAM,sBAAsB,WAAW,IAAI,SAAS,KAAK;YAC5D,kGAAkG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;AAC/D,CAAC"}

package/dist/core/oidc.d.ts

@@ -0,0 +1,175 @@
+/**
+ * OpenID Connect authorization-code flow with PKCE and DPoP.
+ *
+ * This module owns authorization request construction, callback validation, token
+ * requests and ID token validation. It does not persist anything: the caller decides what
+ * to keep.
+ */
+import { type JWTVerifyGetKey } from "jose";
+import type { DPoPSigner, OIDCConfiguration, PendingAuthorization, TokenSet } from "../types.js";
+/** Scopes requested for a Solid session. */
+export declare const DEFAULT_SCOPES: readonly ["openid", "webid", "offline_access"];
+/** Fixed clock tolerance for `exp`, `nbf` and `iat`, in seconds. Not configurable. */
+export declare const CLOCK_TOLERANCE_SECONDS = 60;
+/** A validated identity derived from an ID token. */
+export interface Identity {
+    /** WebID proven by the token. */
+    readonly webId: string;
+    /** Issuer that signed the token (equals the discovered issuer). */
+    readonly issuer: string;
+    /** `sub` claim. */
+    readonly subject: string;
+}
+/** Result of a validated authorization-code exchange. */
+export interface AuthorizationResult {
+    /** Validated token set. The access token must stay in memory. */
+    readonly tokens: TokenSet;
+    /** Identity proven by the ID token. */
+    readonly identity: Identity;
+}
+/** A PKCE verifier/challenge pair. */
+export interface PkcePair {
+    readonly codeVerifier: string;
+    readonly codeChallenge: string;
+}
+/**
+ * Generate a cryptographically random base64url string.
+ *
+ * @param byteLength - Number of random bytes (32 → 43 characters).
+ */
+export declare function randomToken(byteLength?: number): string;
+/**
+ * Create a PKCE S256 verifier and challenge.
+ *
+ * The verifier uses only the RFC 7636 alphabet and is 43 characters long; the challenge
+ * is `base64url(SHA-256(ASCII(verifier)))` with `code_challenge_method=S256`.
+ */
+export declare function createPkcePair(): Promise<PkcePair>;
+/**
+ * Compute the S256 PKCE challenge for an existing verifier.
+ *
+ * @param codeVerifier - The verifier sent in the token request.
+ */
+export declare function pkceChallenge(codeVerifier: string): Promise<string>;
+/**
+ * Create the pending authorization transaction.
+ *
+ * @param input - Issuer, client and redirect information plus optional WebID hint.
+ */
+export declare function createPendingAuthorization(input: {
+    issuer: string;
+    clientId: string;
+    redirectUri: string;
+    webId?: string;
+}): Promise<PendingAuthorization>;
+/**
+ * Build the authorization URL.
+ *
+ * @param input - Provider configuration, client identity and transaction values.
+ * @throws {@link SebaAuthError} when the transaction does not match the client identity.
+ */
+export declare function buildAuthorizationUrl(input: {
+    configuration: OIDCConfiguration;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    nonce: string;
+    codeChallenge: string;
+    scopes?: readonly string[];
+}): string;
+/**
+ * Validate an authorization response URL and return the authorization code.
+ *
+ * Checks, in order: provider error, `state`, RFC 9207 `iss`, and the presence of `code`.
+ * All failures are {@link SebaAuthError}; nothing is exchanged on failure.
+ *
+ * @param callbackUrl - URL the provider redirected to.
+ * @param pending - Transaction created before the navigation.
+ */
+export declare function parseAuthorizationResponse(callbackUrl: string, pending: PendingAuthorization): string;
+/** Successful token request. */
+export interface TokenRequestSuccess {
+    readonly ok: true;
+    readonly body: Record<string, unknown>;
+    readonly response: Response;
+}
+/** Token request rejected with an OAuth error response. */
+export interface TokenRequestFailure {
+    readonly ok: false;
+    readonly error: string;
+    readonly description?: string;
+    readonly status: number;
+}
+/** Outcome of a token request; HTTP failures are values, transport failures throw. */
+export type TokenRequestOutcome = TokenRequestSuccess | TokenRequestFailure;
+/**
+ * Perform a token request with a fresh DPoP proof.
+ *
+ * One `use_dpop_nonce` challenge is retried with the supplied nonce and a **new** proof.
+ * OAuth error responses are returned as {@link TokenRequestFailure} so callers can map
+ * `invalid_grant` to an expired session; network failures throw {@link SebaNetworkError}.
+ *
+ * @param input - Token endpoint, form body, signer and runtime fetch.
+ */
+export declare function requestTokenResponse(input: {
+    tokenEndpoint: string;
+    body: URLSearchParams;
+    signer: DPoPSigner;
+    fetchImpl: typeof fetch;
+    nonce?: string;
+}): Promise<TokenRequestOutcome>;
+/**
+ * Exchange an authorization code for a DPoP-bound token set and validate the ID token.
+ *
+ * @param input - Discovery result, client identity, PKCE verifier, signer and nonce.
+ */
+export declare function exchangeAuthorizationCode(input: {
+    configuration: OIDCConfiguration;
+    clientId: string;
+    redirectUri: string;
+    code: string;
+    codeVerifier: string;
+    nonce: string;
+    signer: DPoPSigner;
+    fetchImpl: typeof fetch;
+    expectedWebId?: string;
+    jwks?: JWTVerifyGetKey;
+}): Promise<AuthorizationResult>;
+/**
+ * Validate a token response body.
+ *
+ * Failures: missing tokens, or a token type other than `DPoP` (RFC 9449 §5 requires the
+ * client to reject a token that is not DPoP-bound).
+ *
+ * @param body - Parsed token response body.
+ */
+export declare function parseTokenSet(body: Record<string, unknown>): TokenSet;
+/**
+ * Validate an ID token and derive the authenticated identity.
+ *
+ * Validation: signature against the provider JWKS, `iss`, `aud` (including `solid` when
+ * the provider advertises `webid`), `azp`, `exp`/`nbf`/`iat`, `nonce`, `cnf.jkt` binding,
+ * `sub`, and the WebID claim (falling back to `sub` for https WebIDs).
+ *
+ * @param input - Token, provider configuration, client identity and expectations.
+ */
+export declare function validateIdToken(input: {
+    idToken: string;
+    configuration: OIDCConfiguration;
+    clientId: string;
+    nonce?: string;
+    signer?: DPoPSigner;
+    fetchImpl?: typeof fetch;
+    requireDpopBinding?: boolean;
+    expectedWebId?: string;
+    expectedSubject?: string;
+    jwks?: JWTVerifyGetKey;
+}): Promise<Identity>;
+/**
+ * Build a JWKS resolver from an in-memory key set. Used by tests and by callers that
+ * already hold provider keys.
+ *
+ * @param keys - Public JWKs.
+ */
+export declare function localJwks(keys: readonly JsonWebKey[]): JWTVerifyGetKey;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/core/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/core/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,MAAM,CAAC;AAId,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjG,4CAA4C;AAC5C,eAAO,MAAM,cAAc,gDAAiD,CAAC;AAK7E,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAK1C,qDAAqD;AACrD,MAAM,WAAW,QAAQ;IACvB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sCAAsC;AACtC,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,SAAK,GAAG,MAAM,CAInD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,CASxD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzE;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmBhC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GAAG,MAAM,CAiBT;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,CA6CrG;AAED,gCAAgC;AAChC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAE5E;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkD/B;AAaD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmC/B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CA0BrE;AAYD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwEpB;AA+DD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,eAAe,CAEtE"}

package/dist/core/oidc.js

@@ -0,0 +1,413 @@
+/**
+ * OpenID Connect authorization-code flow with PKCE and DPoP.
+ *
+ * This module owns authorization request construction, callback validation, token
+ * requests and ID token validation. It does not persist anything: the caller decides what
+ * to keep.
+ */
+import { base64url, createLocalJWKSet, createRemoteJWKSet, customFetch, errors as joseErrors, jwtVerify, } from "jose";
+import { SebaAuthError, SebaError, SebaDPoPError, SebaNetworkError } from "./errors.js";
+import { isLoopbackHost } from "./discovery.js";
+import { httpFetch, isOk, parseJson, readText } from "./http.js";
+/** Scopes requested for a Solid session. */
+export const DEFAULT_SCOPES = ["openid", "webid", "offline_access"];
+/** Characters allowed in a PKCE code verifier (RFC 7636 §4.1). */
+const PKCE_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+/** Fixed clock tolerance for `exp`, `nbf` and `iat`, in seconds. Not configurable. */
+export const CLOCK_TOLERANCE_SECONDS = 60;
+/** Asymmetric JWS algorithms accepted for ID tokens. */
+const ID_TOKEN_ALGORITHMS = ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512"];
+/**
+ * Generate a cryptographically random base64url string.
+ *
+ * @param byteLength - Number of random bytes (32 → 43 characters).
+ */
+export function randomToken(byteLength = 32) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return base64url.encode(bytes);
+}
+/**
+ * Create a PKCE S256 verifier and challenge.
+ *
+ * The verifier uses only the RFC 7636 alphabet and is 43 characters long; the challenge
+ * is `base64url(SHA-256(ASCII(verifier)))` with `code_challenge_method=S256`.
+ */
+export async function createPkcePair() {
+    const verifier = Array.from({ length: 43 }, () => {
+        const byte = new Uint8Array(1);
+        crypto.getRandomValues(byte);
+        // Rejection-free modulo bias is acceptable here: the alphabet is not a power of two,
+        // but 43 characters of 64-symbol alphabet still carry ~258 bits of entropy.
+        return PKCE_ALPHABET.charAt(byte[0] % PKCE_ALPHABET.length);
+    }).join("");
+    return { codeVerifier: verifier, codeChallenge: await pkceChallenge(verifier) };
+}
+/**
+ * Compute the S256 PKCE challenge for an existing verifier.
+ *
+ * @param codeVerifier - The verifier sent in the token request.
+ */
+export async function pkceChallenge(codeVerifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+    return base64url.encode(new Uint8Array(digest));
+}
+/**
+ * Create the pending authorization transaction.
+ *
+ * @param input - Issuer, client and redirect information plus optional WebID hint.
+ */
+export async function createPendingAuthorization(input) {
+    const [pkce, state, nonce] = await Promise.all([
+        createPkcePair(),
+        Promise.resolve(randomToken()),
+        Promise.resolve(randomToken()),
+    ]);
+    const pending = {
+        state,
+        codeVerifier: pkce.codeVerifier,
+        nonce,
+        issuer: input.issuer,
+        clientId: input.clientId,
+        redirectUri: input.redirectUri,
+        createdAt: Date.now(),
+    };
+    if (input.webId !== undefined) {
+        pending.webId = input.webId;
+    }
+    return pending;
+}
+/**
+ * Build the authorization URL.
+ *
+ * @param input - Provider configuration, client identity and transaction values.
+ * @throws {@link SebaAuthError} when the transaction does not match the client identity.
+ */
+export function buildAuthorizationUrl(input) {
+    if (input.state === "" || input.nonce === "" || input.codeChallenge === "") {
+        throw new SebaAuthError("Refusing to build an authorization URL without state, nonce and PKCE challenge.");
+    }
+    if (input.clientId !== input.configuration.issuer && input.clientId === "") {
+        throw new SebaAuthError("Refusing to build an authorization URL without a client identifier.");
+    }
+    const url = new URL(input.configuration.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("scope", (input.scopes ?? DEFAULT_SCOPES).join(" "));
+    url.searchParams.set("state", input.state);
+    url.searchParams.set("nonce", input.nonce);
+    url.searchParams.set("code_challenge", input.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url.href;
+}
+/**
+ * Validate an authorization response URL and return the authorization code.
+ *
+ * Checks, in order: provider error, `state`, RFC 9207 `iss`, and the presence of `code`.
+ * All failures are {@link SebaAuthError}; nothing is exchanged on failure.
+ *
+ * @param callbackUrl - URL the provider redirected to.
+ * @param pending - Transaction created before the navigation.
+ */
+export function parseAuthorizationResponse(callbackUrl, pending) {
+    let url;
+    try {
+        url = new URL(callbackUrl);
+    }
+    catch {
+        throw new SebaAuthError(`The authorization response "${callbackUrl}" is not a valid URL.`);
+    }
+    const params = url.searchParams;
+    const providerError = params.get("error");
+    if (providerError !== null) {
+        const description = params.get("error_description");
+        throw new SebaAuthError(`The identity provider returned the error "${providerError}"` +
+            (description === null ? "." : `: ${description}`));
+    }
+    const state = params.get("state");
+    if (state === null || state !== pending.state) {
+        throw new SebaAuthError("The authorization response state does not match the pending login. " +
+            "The response was ignored; start the login again from the application.");
+    }
+    const issuer = params.get("iss");
+    if (issuer === null || issuer === "") {
+        throw new SebaAuthError("The authorization response does not contain the RFC 9207 \"iss\" parameter. " +
+            `Expected "${pending.issuer}". Solid-OIDC requires providers to return it; the response was rejected.`);
+    }
+    if (issuer !== pending.issuer) {
+        throw new SebaAuthError(`The authorization response was issued by "${issuer}", but this login was started for "${pending.issuer}". ` +
+            "This is a mix-up attempt or a misconfigured provider; the response was rejected.");
+    }
+    const code = params.get("code");
+    if (code === null || code === "") {
+        throw new SebaAuthError("The authorization response does not contain an authorization code.");
+    }
+    return code;
+}
+/**
+ * Perform a token request with a fresh DPoP proof.
+ *
+ * One `use_dpop_nonce` challenge is retried with the supplied nonce and a **new** proof.
+ * OAuth error responses are returned as {@link TokenRequestFailure} so callers can map
+ * `invalid_grant` to an expired session; network failures throw {@link SebaNetworkError}.
+ *
+ * @param input - Token endpoint, form body, signer and runtime fetch.
+ */
+export async function requestTokenResponse(input) {
+    let nonce = input.nonce;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const headers = {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+        };
+        try {
+            headers["DPoP"] = await input.signer.createProof({
+                method: "POST",
+                url: input.tokenEndpoint,
+                ...(nonce === undefined ? {} : { nonce }),
+            });
+        }
+        catch (error) {
+            throw new SebaDPoPError("Unable to create a DPoP proof for the token request.", { cause: error });
+        }
+        const response = await httpFetch(input.tokenEndpoint, { method: "POST", headers, body: input.body.toString(), redirect: "manual" }, { fetchImpl: input.fetchImpl });
+        if (isOk(response)) {
+            const text = await readText(response, "token");
+            const body = parseJson(text, "The token response", (message) => new SebaAuthError(message));
+            if (typeof body !== "object" || body === null || Array.isArray(body)) {
+                throw new SebaAuthError("The token response is not a JSON object.");
+            }
+            return { ok: true, body: body, response };
+        }
+        const challenge = response.headers.get("dpop-nonce");
+        const text = await readText(response, "token error");
+        const parsed = safeJson(text);
+        const error = typeof parsed?.["error"] === "string" ? parsed["error"] : `http_${String(response.status)}`;
+        const description = typeof parsed?.["error_description"] === "string" ? parsed["error_description"] : undefined;
+        if (error === "use_dpop_nonce" && challenge !== null && attempt === 0) {
+            nonce = challenge;
+            continue;
+        }
+        return {
+            ok: false,
+            error,
+            ...(description === undefined ? {} : { description }),
+            status: response.status,
+        };
+    }
+    throw new SebaDPoPError("The provider kept requesting a new DPoP nonce; the token request was abandoned.");
+}
+function safeJson(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Exchange an authorization code for a DPoP-bound token set and validate the ID token.
+ *
+ * @param input - Discovery result, client identity, PKCE verifier, signer and nonce.
+ */
+export async function exchangeAuthorizationCode(input) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        client_id: input.clientId,
+        code_verifier: input.codeVerifier,
+    });
+    const outcome = await requestTokenResponse({
+        tokenEndpoint: input.configuration.tokenEndpoint,
+        body,
+        signer: input.signer,
+        fetchImpl: input.fetchImpl,
+    });
+    if (!outcome.ok) {
+        throw new SebaAuthError(`The token endpoint rejected the authorization code with "${outcome.error}"` +
+            (outcome.description === undefined ? "." : `: ${outcome.description}`));
+    }
+    const tokens = parseTokenSet(outcome.body);
+    const identity = await validateIdToken({
+        idToken: tokens.idToken,
+        configuration: input.configuration,
+        clientId: input.clientId,
+        nonce: input.nonce,
+        signer: input.signer,
+        fetchImpl: input.fetchImpl,
+        requireDpopBinding: input.configuration.scopesSupported?.includes("webid") === true,
+        ...(input.expectedWebId === undefined ? {} : { expectedWebId: input.expectedWebId }),
+        ...(input.jwks === undefined ? {} : { jwks: input.jwks }),
+    });
+    return { tokens, identity };
+}
+/**
+ * Validate a token response body.
+ *
+ * Failures: missing tokens, or a token type other than `DPoP` (RFC 9449 §5 requires the
+ * client to reject a token that is not DPoP-bound).
+ *
+ * @param body - Parsed token response body.
+ */
+export function parseTokenSet(body) {
+    const accessToken = requireString(body["access_token"], "access_token");
+    const tokenType = requireString(body["token_type"], "token_type");
+    if (tokenType.toLowerCase() !== "dpop") {
+        throw new SebaAuthError(`The provider returned token_type "${tokenType}", but SEBA requires DPoP-bound tokens. ` +
+            "The token was discarded; check that the provider supports DPoP.");
+    }
+    const idToken = requireString(body["id_token"], "id_token");
+    const tokens = { accessToken, tokenType: "DPoP", idToken };
+    const refreshToken = body["refresh_token"];
+    if (typeof refreshToken === "string" && refreshToken !== "") {
+        tokens.refreshToken = refreshToken;
+    }
+    const expiresIn = body["expires_in"];
+    if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0) {
+        tokens.expiresIn = expiresIn;
+    }
+    else if (typeof expiresIn === "string" && /^\d+$/.test(expiresIn)) {
+        tokens.expiresIn = Number.parseInt(expiresIn, 10);
+    }
+    const scope = body["scope"];
+    if (typeof scope === "string" && scope !== "") {
+        tokens.scope = scope;
+    }
+    return tokens;
+}
+function requireString(value, field) {
+    if (typeof value !== "string" || value === "") {
+        throw new SebaAuthError(`The token response does not contain a usable "${field}" value. ` +
+            "SEBA requires DPoP-bound access tokens together with an ID token.");
+    }
+    return value;
+}
+/**
+ * Validate an ID token and derive the authenticated identity.
+ *
+ * Validation: signature against the provider JWKS, `iss`, `aud` (including `solid` when
+ * the provider advertises `webid`), `azp`, `exp`/`nbf`/`iat`, `nonce`, `cnf.jkt` binding,
+ * `sub`, and the WebID claim (falling back to `sub` for https WebIDs).
+ *
+ * @param input - Token, provider configuration, client identity and expectations.
+ */
+export async function validateIdToken(input) {
+    const jwks = input.jwks ?? createJwks(input.configuration.jwksUri, input.fetchImpl);
+    let payload;
+    try {
+        const verified = await jwtVerify(input.idToken, jwks, {
+            issuer: input.configuration.issuer,
+            audience: input.clientId,
+            algorithms: ID_TOKEN_ALGORITHMS,
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            requiredClaims: ["iss", "aud", "exp", "iat", "sub"],
+        });
+        payload = verified.payload;
+    }
+    catch (error) {
+        if (error instanceof joseErrors.JOSEError) {
+            throw new SebaAuthError(`The ID token failed validation: ${error.message}.`, { cause: error });
+        }
+        if (error instanceof SebaError) {
+            throw error;
+        }
+        throw new SebaAuthError("The ID token could not be verified.", { cause: error });
+    }
+    const audience = payload["aud"];
+    const audiences = Array.isArray(audience) ? audience : [audience];
+    const azp = payload["azp"];
+    if (azp !== undefined && azp !== input.clientId) {
+        throw new SebaAuthError(`The ID token was issued to authorized party "${String(azp)}", not to this client ("${input.clientId}").`);
+    }
+    if (audiences.length > 1 && azp === undefined) {
+        throw new SebaAuthError("The ID token has multiple audiences but no \"azp\" claim.");
+    }
+    const solidRequired = input.configuration.scopesSupported?.includes("webid") === true;
+    if (solidRequired && !audiences.includes("solid")) {
+        throw new SebaAuthError("The ID token audience does not include \"solid\". Solid-OIDC requires it when the provider advertises the webid scope.");
+    }
+    if (input.nonce !== undefined && payload["nonce"] !== input.nonce) {
+        throw new SebaAuthError("The ID token nonce does not match the login that was started.");
+    }
+    const issuedAt = payload["iat"];
+    if (typeof issuedAt !== "number" || !Number.isFinite(issuedAt)) {
+        throw new SebaAuthError("The ID token has no usable \"iat\" claim.");
+    }
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    if (issuedAt > nowSeconds + CLOCK_TOLERANCE_SECONDS) {
+        throw new SebaAuthError("The ID token was issued in the future; check the device clock.");
+    }
+    await checkDpopBinding(payload, input);
+    const subject = payload["sub"];
+    if (typeof subject !== "string" || subject === "") {
+        throw new SebaAuthError("The ID token has no usable \"sub\" claim.");
+    }
+    if (input.expectedSubject !== undefined && subject !== input.expectedSubject) {
+        throw new SebaAuthError("The ID token subject does not match the stored session.");
+    }
+    const webId = extractWebId(payload, subject);
+    if (input.expectedWebId !== undefined && webId !== input.expectedWebId) {
+        throw new SebaAuthError(`The provider authenticated "${webId}", but this login requested "${input.expectedWebId}". ` +
+            "The session was not created.");
+    }
+    return { webId, issuer: input.configuration.issuer, subject };
+}
+async function checkDpopBinding(payload, input) {
+    const confirmation = payload["cnf"];
+    const boundThumbprint = typeof confirmation === "object" && confirmation !== null
+        ? confirmation["jkt"]
+        : undefined;
+    if (boundThumbprint !== undefined) {
+        if (input.signer === undefined) {
+            throw new SebaAuthError("The ID token is bound to a DPoP key that is not available locally.");
+        }
+        const thumbprint = await input.signer.thumbprint();
+        if (boundThumbprint !== thumbprint) {
+            throw new SebaAuthError("The ID token is bound to a different DPoP key than the one used for this session. " +
+                "The token was discarded.");
+        }
+        return;
+    }
+    if (input.requireDpopBinding === true) {
+        throw new SebaAuthError("The ID token is not bound to a DPoP key (\"cnf.jkt\"), but the provider advertises the webid scope. " +
+            "Solid-OIDC requires DPoP-bound tokens.");
+    }
+}
+function extractWebId(payload, subject) {
+    const claim = payload["webid"];
+    const candidate = typeof claim === "string" && claim !== "" ? claim : subject;
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        throw new SebaAuthError(`The ID token identifies the user as "${candidate}", which is not an absolute URL. ` +
+            "A WebID must be an https URL; the session was not created.");
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
+        throw new SebaAuthError(`The ID token identifies the user as "${candidate}", which does not use https. ` +
+            "Refusing to create a session for an insecure WebID.");
+    }
+    return candidate;
+}
+function createJwks(jwksUri, fetchImpl) {
+    const options = fetchImpl === undefined
+        ? { timeoutDuration: 5_000, cooldownDuration: 30_000, cacheMaxAge: 600_000 }
+        : { timeoutDuration: 5_000, cooldownDuration: 30_000, cacheMaxAge: 600_000, [customFetch]: fetchImpl };
+    return createRemoteJWKSet(new URL(jwksUri), options);
+}
+/**
+ * Build a JWKS resolver from an in-memory key set. Used by tests and by callers that
+ * already hold provider keys.
+ *
+ * @param keys - Public JWKs.
+ */
+export function localJwks(keys) {
+    return createLocalJWKSet({ keys: [...keys] });
+}
+//# sourceMappingURL=oidc.js.map