@geekmidas/auth 0.0.4 → 0.0.5

package/dist/hono/oidc.d.mts

@@ -0,0 +1,48 @@
+import { TokenExtractionOptions } from "../jwt-DH8CJ2xC.mjs";
+import { OidcClaims, OidcConfig, OidcUserInfo, OidcVerifier } from "../oidc-CKOGLxjV.mjs";
+import { Context, MiddlewareHandler } from "hono";
+
+//#region src/hono/oidc.d.ts
+interface OidcMiddlewareOptions<TClaims extends OidcClaims = OidcClaims, TUserInfo extends OidcUserInfo = OidcUserInfo> {
+  config: OidcConfig;
+  extraction?: TokenExtractionOptions;
+  contextKey?: string;
+  fetchUserInfo?: boolean;
+  onError?: (c: Context, error: Error) => Response | Promise<Response>;
+  transformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;
+}
+/**
+ * OIDC Middleware for Hono
+ *
+ * @example
+ * ```typescript
+ * const oidc = new OidcMiddleware({
+ *   config: {
+ *     issuer: 'https://auth.example.com',
+ *     audience: 'my-client-id',
+ *   },
+ * });
+ *
+ * app.use('/api/*', oidc.handler());
+ *
+ * // With user info
+ * const oidcWithUserInfo = new OidcMiddleware({
+ *   config: { issuer: '...', audience: '...' },
+ *   fetchUserInfo: true,
+ * });
+ * ```
+ */
+declare class OidcMiddleware<TClaims extends OidcClaims = OidcClaims, TUserInfo extends OidcUserInfo = OidcUserInfo> {
+  private readonly verifier;
+  private readonly extraction;
+  private readonly contextKey;
+  private readonly fetchUserInfo;
+  private readonly onError?;
+  private readonly transformClaims?;
+  constructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>);
+  handler(): MiddlewareHandler;
+  optional(): MiddlewareHandler;
+}
+//#endregion
+export { OidcClaims, OidcConfig, OidcMiddleware, OidcMiddlewareOptions, OidcUserInfo, OidcVerifier, TokenExtractionOptions };
+//# sourceMappingURL=oidc.d.mts.map

package/dist/hono/oidc.mjs

@@ -0,0 +1,103 @@
+import { OidcVerifier } from "../oidc-KA30gMlx.mjs";
+
+//#region src/hono/oidc.ts
+function extractToken(c, options = {}) {
+	const { headerName = "authorization", cookieName, tokenPrefix = "Bearer " } = options;
+	const headerValue = c.req.header(headerName);
+	if (headerValue) {
+		if (tokenPrefix && headerValue.startsWith(tokenPrefix)) return headerValue.slice(tokenPrefix.length);
+		return headerValue;
+	}
+	if (cookieName) {
+		const cookieHeader = c.req.header("cookie");
+		if (cookieHeader) {
+			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+			if (match) return match[1];
+		}
+	}
+	return null;
+}
+/**
+* OIDC Middleware for Hono
+*
+* @example
+* ```typescript
+* const oidc = new OidcMiddleware({
+*   config: {
+*     issuer: 'https://auth.example.com',
+*     audience: 'my-client-id',
+*   },
+* });
+*
+* app.use('/api/*', oidc.handler());
+*
+* // With user info
+* const oidcWithUserInfo = new OidcMiddleware({
+*   config: { issuer: '...', audience: '...' },
+*   fetchUserInfo: true,
+* });
+* ```
+*/
+var OidcMiddleware = class {
+	verifier;
+	extraction;
+	contextKey;
+	fetchUserInfo;
+	onError;
+	transformClaims;
+	constructor(options) {
+		this.verifier = new OidcVerifier(options.config);
+		this.extraction = options.extraction ?? {};
+		this.contextKey = options.contextKey ?? "oidcClaims";
+		this.fetchUserInfo = options.fetchUserInfo ?? false;
+		this.onError = options.onError;
+		this.transformClaims = options.transformClaims;
+	}
+	handler() {
+		return async (c, next) => {
+			const token = extractToken(c, this.extraction);
+			if (!token) {
+				if (this.onError) return this.onError(c, new Error("No token provided"));
+				return c.json({ error: "Unauthorized" }, 401);
+			}
+			try {
+				const payload = await this.verifier.verify(token);
+				let userInfo;
+				if (this.fetchUserInfo) {
+					userInfo = await this.verifier.fetchUserInfo(token) ?? void 0;
+					c.set("oidcUserInfo", userInfo);
+				}
+				const claims = this.transformClaims ? this.transformClaims(payload, userInfo) : payload;
+				c.set(this.contextKey, claims);
+				c.set("oidcToken", token);
+				await next();
+			} catch (error) {
+				if (this.onError) return this.onError(c, error);
+				return c.json({ error: "Invalid token" }, 401);
+			}
+		};
+	}
+	optional() {
+		return async (c, next) => {
+			const token = extractToken(c, this.extraction);
+			if (token) {
+				const payload = await this.verifier.verifyOrNull(token);
+				if (payload) {
+					let userInfo;
+					if (this.fetchUserInfo) {
+						userInfo = await this.verifier.fetchUserInfo(token) ?? void 0;
+						c.set("oidcUserInfo", userInfo);
+					}
+					const claims = this.transformClaims ? this.transformClaims(payload, userInfo) : payload;
+					c.set(this.contextKey, claims);
+					c.set("oidcToken", token);
+				}
+			}
+			await next();
+		};
+	}
+};
+
+//#endregion
+export { OidcMiddleware, OidcVerifier };
+//# sourceMappingURL=oidc.mjs.map

package/dist/hono/oidc.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.mjs","names":["c: Context","options: TokenExtractionOptions","options: OidcMiddlewareOptions<TClaims, TUserInfo>","next: Next","userInfo: TUserInfo | undefined"],"sources":["../../src/hono/oidc.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport {\n  type OidcClaims,\n  type OidcConfig,\n  type OidcUserInfo,\n  OidcVerifier,\n  type TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n  OidcVerifier,\n  type OidcClaims,\n  type OidcConfig,\n  type OidcUserInfo,\n  type TokenExtractionOptions,\n};\n\nfunction extractToken(\n  c: Context,\n  options: TokenExtractionOptions = {},\n): string | null {\n  const {\n    headerName = 'authorization',\n    cookieName,\n    tokenPrefix = 'Bearer ',\n  } = options;\n\n  const headerValue = c.req.header(headerName);\n  if (headerValue) {\n    if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n      return headerValue.slice(tokenPrefix.length);\n    }\n    return headerValue;\n  }\n\n  if (cookieName) {\n    const cookieHeader = c.req.header('cookie');\n    if (cookieHeader) {\n      const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n      if (match) {\n        return match[1];\n      }\n    }\n  }\n\n  return null;\n}\n\nexport interface OidcMiddlewareOptions<\n  TClaims extends OidcClaims = OidcClaims,\n  TUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n  config: OidcConfig;\n  extraction?: TokenExtractionOptions;\n  contextKey?: string;\n  fetchUserInfo?: boolean;\n  onError?: (c: Context, error: Error) => Response | Promise<Response>;\n  transformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;\n}\n\n/**\n * OIDC Middleware for Hono\n *\n * @example\n * ```typescript\n * const oidc = new OidcMiddleware({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-client-id',\n *   },\n * });\n *\n * app.use('/api/*', oidc.handler());\n *\n * // With user info\n * const oidcWithUserInfo = new OidcMiddleware({\n *   config: { issuer: '...', audience: '...' },\n *   fetchUserInfo: true,\n * });\n * ```\n */\nexport class OidcMiddleware<\n  TClaims extends OidcClaims = OidcClaims,\n  TUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n  private readonly verifier: OidcVerifier<TClaims, TUserInfo>;\n  private readonly extraction: TokenExtractionOptions;\n  private readonly contextKey: string;\n  private readonly fetchUserInfo: boolean;\n  private readonly onError?: (\n    c: Context,\n    error: Error,\n  ) => Response | Promise<Response>;\n  private readonly transformClaims?: (\n    claims: OidcClaims,\n    userInfo?: TUserInfo,\n  ) => TClaims;\n\n  constructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {\n    this.verifier = new OidcVerifier(options.config);\n    this.extraction = options.extraction ?? {};\n    this.contextKey = options.contextKey ?? 'oidcClaims';\n    this.fetchUserInfo = options.fetchUserInfo ?? false;\n    this.onError = options.onError;\n    this.transformClaims = options.transformClaims;\n  }\n\n  handler(): MiddlewareHandler {\n    return async (c: Context, next: Next) => {\n      const token = extractToken(c, this.extraction);\n\n      if (!token) {\n        if (this.onError) {\n          return this.onError(c, new Error('No token provided'));\n        }\n        return c.json({ error: 'Unauthorized' }, 401);\n      }\n\n      try {\n        const payload = await this.verifier.verify(token);\n\n        let userInfo: TUserInfo | undefined;\n        if (this.fetchUserInfo) {\n          userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n          c.set('oidcUserInfo', userInfo);\n        }\n\n        const claims = this.transformClaims\n          ? this.transformClaims(payload, userInfo)\n          : payload;\n\n        c.set(this.contextKey, claims);\n        c.set('oidcToken', token);\n\n        await next();\n      } catch (error) {\n        if (this.onError) {\n          return this.onError(c, error as Error);\n        }\n        return c.json({ error: 'Invalid token' }, 401);\n      }\n    };\n  }\n\n  optional(): MiddlewareHandler {\n    return async (c: Context, next: Next) => {\n      const token = extractToken(c, this.extraction);\n\n      if (token) {\n        const payload = await this.verifier.verifyOrNull(token);\n        if (payload) {\n          let userInfo: TUserInfo | undefined;\n          if (this.fetchUserInfo) {\n            userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n            c.set('oidcUserInfo', userInfo);\n          }\n\n          const claims = this.transformClaims\n            ? this.transformClaims(payload, userInfo)\n            : payload;\n\n          c.set(this.contextKey, claims);\n          c.set('oidcToken', token);\n        }\n      }\n\n      await next();\n    };\n  }\n}\n"],"mappings":";;;AAiBA,SAAS,aACPA,GACAC,UAAkC,CAAE,GACrB;CACf,MAAM,EACJ,aAAa,iBACb,YACA,cAAc,WACf,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AACf,MAAI,eAAe,YAAY,WAAW,YAAY,CACpD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE9C,SAAO;CACR;AAED,KAAI,YAAY;EACd,MAAM,eAAe,EAAE,IAAI,OAAO,SAAS;AAC3C,MAAI,cAAc;GAChB,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,OAAI,MACF,QAAO,MAAM;EAEhB;CACF;AAED,QAAO;AACR;;;;;;;;;;;;;;;;;;;;;;AAmCD,IAAa,iBAAb,MAGE;CACA,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAKjB,YAAYC,SAAoD;AAC9D,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAChC;CAED,UAA6B;AAC3B,SAAO,OAAOF,GAAYG,SAAe;GACvC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACV,QAAI,KAAK,QACP,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAExD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC9C;AAED,OAAI;IACF,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IAEjD,IAAIC;AACJ,QAAI,KAAK,eAAe;AACtB,gBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,OAAE,IAAI,gBAAgB,SAAS;IAChC;IAED,MAAM,SAAS,KAAK,kBAChB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEJ,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,aAAa,MAAM;AAEzB,UAAM,MAAM;GACb,SAAQ,OAAO;AACd,QAAI,KAAK,QACP,QAAO,KAAK,QAAQ,GAAG,MAAe;AAExC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC/C;EACF;CACF;CAED,WAA8B;AAC5B,SAAO,OAAOJ,GAAYG,SAAe;GACvC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACT,MAAM,UAAU,MAAM,KAAK,SAAS,aAAa,MAAM;AACvD,QAAI,SAAS;KACX,IAAIC;AACJ,SAAI,KAAK,eAAe;AACtB,iBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,QAAE,IAAI,gBAAgB,SAAS;KAChC;KAED,MAAM,SAAS,KAAK,kBAChB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEJ,OAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,OAAE,IAAI,aAAa,MAAM;IAC1B;GACF;AAED,SAAM,MAAM;EACb;CACF;AACF"}

package/dist/index.cjs

@@ -1,6 +1,6 @@
 const require_cacheTokenStorage = require('./cacheTokenStorage-CvptztkW.cjs');
 const require_client = require('./client-DaiUm0UZ.cjs');
-const require_tokenManager = require('./tokenManager-B60gFnEF.cjs');
+const require_tokenManager = require('./tokenManager-EPmwgai2.cjs');
 
 exports.CacheTokenStorage = require_cacheTokenStorage.CacheTokenStorage;
 exports.LocalStorageTokenStorage = require_client.LocalStorageTokenStorage;

package/dist/index.d.cts

@@ -1,3 +1,3 @@
 import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-yNUpDD8W.cjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-mpzJKLvX.cjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-H6-lWEah.cjs";
 export { CacheTokenStorage, DecodedToken, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenManager, TokenManagerOptions, TokenPair, TokenPayload, TokenStorage };

package/dist/index.d.mts

@@ -1,3 +1,3 @@
-import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-BlpcZwef.mjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-CCcFk2Py.mjs";
+import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-BzBRJfd-.mjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager--Q93eNYr.mjs";
 export { CacheTokenStorage, DecodedToken, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenManager, TokenManagerOptions, TokenPair, TokenPayload, TokenStorage };

package/dist/jwt-Bo_eACEi.cjs

@@ -0,0 +1,70 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const jose = require_chunk.__toESM(require("jose"));
+
+//#region src/jwt.ts
+function isJwksConfig(config) {
+	return "jwksUri" in config;
+}
+/**
+* JWT Verifier with JWKS caching
+*/
+var JwtVerifier = class {
+	jwks = null;
+	verifyOptions;
+	constructor(config) {
+		this.config = config;
+		this.verifyOptions = {
+			issuer: config.issuer,
+			audience: config.audience,
+			algorithms: config.algorithms ?? (isJwksConfig(config) ? void 0 : ["HS256"])
+		};
+	}
+	async verify(token) {
+		if (isJwksConfig(this.config)) {
+			if (!this.jwks) this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
+			const { payload: payload$1 } = await jose.jwtVerify(token, this.jwks, this.verifyOptions);
+			return payload$1;
+		}
+		const secret = new TextEncoder().encode(this.config.secret);
+		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
+		return payload;
+	}
+	async verifyOrNull(token) {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
+	clearCache() {
+		this.jwks = null;
+	}
+};
+/**
+* Decode a JWT without verification
+* WARNING: This does NOT verify the token signature!
+*/
+function decodeJwt(token) {
+	return jose.decodeJwt(token);
+}
+
+//#endregion
+Object.defineProperty(exports, 'JwtVerifier', {
+  enumerable: true,
+  get: function () {
+    return JwtVerifier;
+  }
+});
+Object.defineProperty(exports, 'decodeJwt', {
+  enumerable: true,
+  get: function () {
+    return decodeJwt;
+  }
+});
+Object.defineProperty(exports, 'isJwksConfig', {
+  enumerable: true,
+  get: function () {
+    return isJwksConfig;
+  }
+});
+//# sourceMappingURL=jwt-Bo_eACEi.cjs.map

package/dist/jwt-Bo_eACEi.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-Bo_eACEi.cjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n  sub?: string;\n  iss?: string;\n  aud?: string | string[];\n  exp?: number;\n  iat?: number;\n  nbf?: number;\n  jti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n  secret: string;\n  issuer?: string;\n  audience?: string | string[];\n  algorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n  jwksUri: string;\n  issuer?: string;\n  audience?: string | string[];\n  algorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n  headerName?: string;\n  cookieName?: string;\n  tokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n  return 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n  private jwks: jose.JWTVerifyGetKey | null = null;\n  private readonly verifyOptions: jose.JWTVerifyOptions;\n\n  constructor(private readonly config: JwtConfig) {\n    this.verifyOptions = {\n      issuer: config.issuer,\n      audience: config.audience,\n      algorithms:\n        config.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n    };\n  }\n\n  async verify(token: string): Promise<TClaims> {\n    if (isJwksConfig(this.config)) {\n      if (!this.jwks) {\n        this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n      }\n      const { payload } = await jose.jwtVerify(\n        token,\n        this.jwks,\n        this.verifyOptions,\n      );\n      return payload as unknown as TClaims;\n    }\n\n    const secret = new TextEncoder().encode(this.config.secret);\n    const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n    return payload as unknown as TClaims;\n  }\n\n  async verifyOrNull(token: string): Promise<TClaims | null> {\n    try {\n      return await this.verify(token);\n    } catch {\n      return null;\n    }\n  }\n\n  clearCache(): void {\n    this.jwks = null;\n  }\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n  token: string,\n): TClaims {\n  return jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;;AA8CA,SAAgB,aAAaA,QAA4C;AACvE,QAAO,aAAa;AACrB;;;;AAKD,IAAa,cAAb,MAAgE;CAC9D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC3B,OAAK,gBAAgB;GACnB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACE,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACrE;CACF;CAED,MAAM,OAAOC,OAAiC;AAC5C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC7B,QAAK,KAAK,KACR,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAEnE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC7B,OACA,KAAK,MACL,KAAK,cACN;AACD,UAAOC;EACR;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACR;CAED,MAAM,aAAaD,OAAwC;AACzD,MAAI;AACF,UAAO,MAAM,KAAK,OAAO,MAAM;EAChC,QAAO;AACN,UAAO;EACR;CACF;CAED,aAAmB;AACjB,OAAK,OAAO;CACb;AACF;;;;;AAMD,SAAgB,UACdA,OACS;AACT,QAAO,KAAK,UAAU,MAAM;AAC7B"}

package/dist/jwt-D88cPJyT.mjs

@@ -0,0 +1,52 @@
+import * as jose from "jose";
+
+//#region src/jwt.ts
+function isJwksConfig(config) {
+	return "jwksUri" in config;
+}
+/**
+* JWT Verifier with JWKS caching
+*/
+var JwtVerifier = class {
+	jwks = null;
+	verifyOptions;
+	constructor(config) {
+		this.config = config;
+		this.verifyOptions = {
+			issuer: config.issuer,
+			audience: config.audience,
+			algorithms: config.algorithms ?? (isJwksConfig(config) ? void 0 : ["HS256"])
+		};
+	}
+	async verify(token) {
+		if (isJwksConfig(this.config)) {
+			if (!this.jwks) this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
+			const { payload: payload$1 } = await jose.jwtVerify(token, this.jwks, this.verifyOptions);
+			return payload$1;
+		}
+		const secret = new TextEncoder().encode(this.config.secret);
+		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
+		return payload;
+	}
+	async verifyOrNull(token) {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
+	clearCache() {
+		this.jwks = null;
+	}
+};
+/**
+* Decode a JWT without verification
+* WARNING: This does NOT verify the token signature!
+*/
+function decodeJwt(token) {
+	return jose.decodeJwt(token);
+}
+
+//#endregion
+export { JwtVerifier, decodeJwt, isJwksConfig };
+//# sourceMappingURL=jwt-D88cPJyT.mjs.map

package/dist/jwt-D88cPJyT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-D88cPJyT.mjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n  sub?: string;\n  iss?: string;\n  aud?: string | string[];\n  exp?: number;\n  iat?: number;\n  nbf?: number;\n  jti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n  secret: string;\n  issuer?: string;\n  audience?: string | string[];\n  algorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n  jwksUri: string;\n  issuer?: string;\n  audience?: string | string[];\n  algorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n  headerName?: string;\n  cookieName?: string;\n  tokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n  return 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n  private jwks: jose.JWTVerifyGetKey | null = null;\n  private readonly verifyOptions: jose.JWTVerifyOptions;\n\n  constructor(private readonly config: JwtConfig) {\n    this.verifyOptions = {\n      issuer: config.issuer,\n      audience: config.audience,\n      algorithms:\n        config.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n    };\n  }\n\n  async verify(token: string): Promise<TClaims> {\n    if (isJwksConfig(this.config)) {\n      if (!this.jwks) {\n        this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n      }\n      const { payload } = await jose.jwtVerify(\n        token,\n        this.jwks,\n        this.verifyOptions,\n      );\n      return payload as unknown as TClaims;\n    }\n\n    const secret = new TextEncoder().encode(this.config.secret);\n    const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n    return payload as unknown as TClaims;\n  }\n\n  async verifyOrNull(token: string): Promise<TClaims | null> {\n    try {\n      return await this.verify(token);\n    } catch {\n      return null;\n    }\n  }\n\n  clearCache(): void {\n    this.jwks = null;\n  }\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n  token: string,\n): TClaims {\n  return jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;AA8CA,SAAgB,aAAaA,QAA4C;AACvE,QAAO,aAAa;AACrB;;;;AAKD,IAAa,cAAb,MAAgE;CAC9D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC3B,OAAK,gBAAgB;GACnB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACE,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACrE;CACF;CAED,MAAM,OAAOC,OAAiC;AAC5C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC7B,QAAK,KAAK,KACR,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAEnE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC7B,OACA,KAAK,MACL,KAAK,cACN;AACD,UAAOC;EACR;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACR;CAED,MAAM,aAAaD,OAAwC;AACzD,MAAI;AACF,UAAO,MAAM,KAAK,OAAO,MAAM;EAChC,QAAO;AACN,UAAO;EACR;CACF;CAED,aAAmB;AACjB,OAAK,OAAO;CACb;AACF;;;;;AAMD,SAAgB,UACdA,OACS;AACT,QAAO,KAAK,UAAU,MAAM;AAC7B"}

package/dist/jwt-DF9kFbmh.d.cts

@@ -0,0 +1,61 @@
+//#region src/jwt.d.ts
+/**
+ * Standard JWT claims
+ */
+interface JwtClaims {
+  sub?: string;
+  iss?: string;
+  aud?: string | string[];
+  exp?: number;
+  iat?: number;
+  nbf?: number;
+  jti?: string;
+}
+/**
+ * Configuration for JWT verification with a symmetric secret
+ */
+interface JwtSecretConfig {
+  secret: string;
+  issuer?: string;
+  audience?: string | string[];
+  algorithms?: string[];
+}
+/**
+ * Configuration for JWT verification with JWKS
+ */
+interface JwtJwksConfig {
+  jwksUri: string;
+  issuer?: string;
+  audience?: string | string[];
+  algorithms?: string[];
+}
+type JwtConfig = JwtSecretConfig | JwtJwksConfig;
+/**
+ * Options for token extraction from requests
+ */
+interface TokenExtractionOptions {
+  headerName?: string;
+  cookieName?: string;
+  tokenPrefix?: string;
+}
+declare function isJwksConfig(config: JwtConfig): config is JwtJwksConfig;
+/**
+ * JWT Verifier with JWKS caching
+ */
+declare class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {
+  private readonly config;
+  private jwks;
+  private readonly verifyOptions;
+  constructor(config: JwtConfig);
+  verify(token: string): Promise<TClaims>;
+  verifyOrNull(token: string): Promise<TClaims | null>;
+  clearCache(): void;
+}
+/**
+ * Decode a JWT without verification
+ * WARNING: This does NOT verify the token signature!
+ */
+declare function decodeJwt<TClaims extends JwtClaims = JwtClaims>(token: string): TClaims;
+//#endregion
+export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };
+//# sourceMappingURL=jwt-DF9kFbmh.d.cts.map

package/dist/jwt-DH8CJ2xC.d.mts

@@ -0,0 +1,61 @@
+//#region src/jwt.d.ts
+/**
+ * Standard JWT claims
+ */
+interface JwtClaims {
+  sub?: string;
+  iss?: string;
+  aud?: string | string[];
+  exp?: number;
+  iat?: number;
+  nbf?: number;
+  jti?: string;
+}
+/**
+ * Configuration for JWT verification with a symmetric secret
+ */
+interface JwtSecretConfig {
+  secret: string;
+  issuer?: string;
+  audience?: string | string[];
+  algorithms?: string[];
+}
+/**
+ * Configuration for JWT verification with JWKS
+ */
+interface JwtJwksConfig {
+  jwksUri: string;
+  issuer?: string;
+  audience?: string | string[];
+  algorithms?: string[];
+}
+type JwtConfig = JwtSecretConfig | JwtJwksConfig;
+/**
+ * Options for token extraction from requests
+ */
+interface TokenExtractionOptions {
+  headerName?: string;
+  cookieName?: string;
+  tokenPrefix?: string;
+}
+declare function isJwksConfig(config: JwtConfig): config is JwtJwksConfig;
+/**
+ * JWT Verifier with JWKS caching
+ */
+declare class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {
+  private readonly config;
+  private jwks;
+  private readonly verifyOptions;
+  constructor(config: JwtConfig);
+  verify(token: string): Promise<TClaims>;
+  verifyOrNull(token: string): Promise<TClaims | null>;
+  clearCache(): void;
+}
+/**
+ * Decode a JWT without verification
+ * WARNING: This does NOT verify the token signature!
+ */
+declare function decodeJwt<TClaims extends JwtClaims = JwtClaims>(token: string): TClaims;
+//#endregion
+export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };
+//# sourceMappingURL=jwt-DH8CJ2xC.d.mts.map

package/dist/jwt.cjs

@@ -0,0 +1,5 @@
+const require_jwt = require('./jwt-Bo_eACEi.cjs');
+
+exports.JwtVerifier = require_jwt.JwtVerifier;
+exports.decodeJwt = require_jwt.decodeJwt;
+exports.isJwksConfig = require_jwt.isJwksConfig;

package/dist/jwt.d.cts

@@ -0,0 +1,2 @@
+import { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig } from "./jwt-DF9kFbmh.cjs";
+export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };

package/dist/jwt.d.mts

@@ -0,0 +1,2 @@
+import { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig } from "./jwt-DH8CJ2xC.mjs";
+export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };

package/dist/jwt.mjs

@@ -0,0 +1,3 @@
+import { JwtVerifier, decodeJwt, isJwksConfig } from "./jwt-D88cPJyT.mjs";
+
+export { JwtVerifier, decodeJwt, isJwksConfig };

package/dist/lambda/jwt.cjs

@@ -0,0 +1,126 @@
+const require_jwt = require('../jwt-Bo_eACEi.cjs');
+
+//#region src/lambda/jwt.ts
+function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
+	return {
+		principalId,
+		policyDocument,
+		context
+	};
+}
+function getWildcardResource(methodArn) {
+	const parts = methodArn.split("/");
+	return `${parts[0]}/${parts[1]}/*`;
+}
+/**
+* JWT Lambda Authorizer
+*
+* @example
+* ```typescript
+* const authorizer = new JwtAuthorizer({
+*   config: {
+*     jwksUri: 'https://auth.example.com/.well-known/jwks.json',
+*     issuer: 'https://auth.example.com',
+*   },
+*   getContext: (claims) => ({ userId: claims.sub! }),
+* });
+*
+* // TOKEN authorizer
+* export const tokenHandler = authorizer.tokenHandler();
+*
+* // REQUEST authorizer
+* export const requestHandler = authorizer.requestHandler();
+* ```
+*/
+var JwtAuthorizer = class {
+	verifier;
+	extraction;
+	wildcardResource;
+	getPrincipalId;
+	getContext;
+	authorize;
+	constructor(options) {
+		this.verifier = new require_jwt.JwtVerifier(options.config);
+		this.extraction = options.extraction ?? {};
+		this.wildcardResource = options.wildcardResource ?? true;
+		this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? "unknown");
+		this.getContext = options.getContext;
+		this.authorize = options.authorize;
+	}
+	/**
+	* Returns a TOKEN authorizer handler
+	*/
+	tokenHandler() {
+		return async (event, _context) => {
+			const { authorizationToken, methodArn } = event;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = authorizationToken.startsWith("Bearer ") ? authorizationToken.slice(7) : authorizationToken;
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+	/**
+	* Returns a REQUEST authorizer handler
+	*/
+	requestHandler() {
+		const { headerName = "authorization", cookieName, tokenPrefix = "Bearer " } = this.extraction;
+		const extractToken = (event) => {
+			const headers = event.headers ?? {};
+			const headerKey = Object.keys(headers).find((k) => k.toLowerCase() === headerName.toLowerCase());
+			if (headerKey) {
+				const headerValue = headers[headerKey];
+				if (headerValue) {
+					if (tokenPrefix && headerValue.startsWith(tokenPrefix)) return headerValue.slice(tokenPrefix.length);
+					return headerValue;
+				}
+			}
+			if (cookieName) {
+				const cookieHeader = headers["cookie"] ?? headers["Cookie"] ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match) return match[1];
+			}
+			return null;
+		};
+		return async (event, _context) => {
+			const methodArn = event.methodArn;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = extractToken(event);
+			if (!token) return generatePolicy("unauthorized", "Deny", resource);
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+};
+
+//#endregion
+exports.JwtAuthorizer = JwtAuthorizer;
+exports.JwtVerifier = require_jwt.JwtVerifier;
+//# sourceMappingURL=jwt.cjs.map

package/dist/lambda/jwt.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","JwtVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n  APIGatewayAuthorizerResult,\n  APIGatewayRequestAuthorizerEvent,\n  APIGatewayTokenAuthorizerEvent,\n  Context as LambdaContext,\n  PolicyDocument,\n} from 'aws-lambda';\nimport {\n  type JwtClaims,\n  type JwtConfig,\n  JwtVerifier,\n  type TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n  JwtVerifier,\n  type JwtClaims,\n  type JwtConfig,\n  type TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n  principalId: string,\n  effect: 'Allow' | 'Deny',\n  resource: string,\n  context?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n  const policyDocument: PolicyDocument = {\n    Version: '2012-10-17',\n    Statement: [\n      {\n        Action: 'execute-api:Invoke',\n        Effect: effect,\n        Resource: resource,\n      },\n    ],\n  };\n\n  return {\n    principalId,\n    policyDocument,\n    context,\n  };\n}\n\nfunction getWildcardResource(methodArn: string): string {\n  const parts = methodArn.split('/');\n  return `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n  config: JwtConfig;\n  extraction?: TokenExtractionOptions;\n  wildcardResource?: boolean;\n  getPrincipalId?: (claims: TClaims) => string;\n  getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n  private readonly verifier: JwtVerifier<TClaims>;\n  private readonly extraction: TokenExtractionOptions;\n  private readonly wildcardResource: boolean;\n  private readonly getPrincipalId: (claims: TClaims) => string;\n  private readonly getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n  constructor(options: JwtAuthorizerOptions<TClaims>) {\n    this.verifier = new JwtVerifier(options.config);\n    this.extraction = options.extraction ?? {};\n    this.wildcardResource = options.wildcardResource ?? true;\n    this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n    this.getContext = options.getContext;\n    this.authorize = options.authorize;\n  }\n\n  /**\n   * Returns a TOKEN authorizer handler\n   */\n  tokenHandler() {\n    return async (\n      event: APIGatewayTokenAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const { authorizationToken, methodArn } = event;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = authorizationToken.startsWith('Bearer ')\n        ? authorizationToken.slice(7)\n        : authorizationToken;\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n\n  /**\n   * Returns a REQUEST authorizer handler\n   */\n  requestHandler() {\n    const {\n      headerName = 'authorization',\n      cookieName,\n      tokenPrefix = 'Bearer ',\n    } = this.extraction;\n\n    const extractToken = (\n      event: APIGatewayRequestAuthorizerEvent,\n    ): string | null => {\n      const headers = event.headers ?? {};\n      const headerKey = Object.keys(headers).find(\n        (k) => k.toLowerCase() === headerName.toLowerCase(),\n      );\n      if (headerKey) {\n        const headerValue = headers[headerKey];\n        if (headerValue) {\n          if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n            return headerValue.slice(tokenPrefix.length);\n          }\n          return headerValue;\n        }\n      }\n\n      if (cookieName) {\n        const cookieHeader = headers['cookie'] ?? headers['Cookie'] ?? '';\n        const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n        if (match) {\n          return match[1];\n        }\n      }\n\n      return null;\n    };\n\n    return async (\n      event: APIGatewayRequestAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const methodArn = event.methodArn;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = extractToken(event);\n\n      if (!token) {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n}\n"],"mappings":";;;AAqBA,SAAS,eACPA,aACAC,QACAC,UACAC,SAC4B;CAC5B,MAAMC,iBAAiC;EACrC,SAAS;EACT,WAAW,CACT;GACE,QAAQ;GACR,QAAQ;GACR,UAAU;EACX,CACF;CACF;AAED,QAAO;EACL;EACA;EACA;CACD;AACF;AAED,SAAS,oBAAoBC,WAA2B;CACtD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CAChE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AAClD,OAAK,WAAW,IAAIC,wBAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CAC1B;;;;CAKD,eAAe;AACb,SAAO,OACLC,OACAC,aACwC;GACxC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GAClD,mBAAmB,MAAM,EAAE,GAC3B;AAEJ,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;;;;CAKD,iBAAiB;EACf,MAAM,EACJ,aAAa,iBACb,YACA,cAAc,WACf,GAAG,KAAK;EAET,MAAM,eAAe,CACnBC,UACkB;GAClB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACrC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACpD;AACD,OAAI,WAAW;IACb,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AACf,SAAI,eAAe,YAAY,WAAW,YAAY,CACpD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE9C,YAAO;IACR;GACF;AAED,OAAI,YAAY;IACd,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;IAC/D,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,MACF,QAAO,MAAM;GAEhB;AAED,UAAO;EACR;AAED,SAAO,OACLA,OACAD,aACwC;GACxC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGzD,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;AACF"}