@happyvertical/auth 0.103.0 → 0.103.2

package/dist/chunks/{keycloak-CzPHgI2z.js.map → keycloak-hR2UOZ1n.js.map}

@@ -1 +1 @@
-{"version":3,"file":"keycloak-CzPHgI2z.js","names":[],"sources":["../../src/shared/providers/keycloak.ts"],"sourcesContent":["/**\n * Keycloak Provider - OIDC/OAuth2 Authentication\n *\n * Implements full OIDC/OAuth2 authentication with Keycloak server including:\n * - OIDC Discovery\n * - Authorization Code Flow with PKCE\n * - Token validation using JWKS\n * - Token introspection\n * - User management via Admin API\n * - Session management\n */\n\nimport * as jose from 'jose';\n\nimport {\n  AccessDeniedError,\n  ConfigurationError,\n  InvalidClientError,\n  InvalidCredentialsError,\n  InvalidGrantError,\n  InvalidNonceError,\n  InvalidRedirectUriError,\n  InvalidStateError,\n  InvalidTokenError,\n  MfaRequiredError,\n  NetworkError,\n  NotImplementedError,\n  ProviderError,\n  TokenExpiredError,\n  UserAlreadyExistsError,\n  UserNotFoundError,\n} from '../errors.js';\nimport type {\n  AuthCapabilities,\n  AuthCredentials,\n  AuthInterface,\n  AuthorizationOptions,\n  AuthorizationResult,\n  AuthResult,\n  CodeExchangeParams,\n  CreateUserRequest,\n  KeycloakOptions,\n  LogoutOptions,\n  OIDCDiscoveryDocument,\n  Session,\n  TokenClaims,\n  TokenIntrospection,\n  TokenPayload,\n  TokenValidationOptions,\n  UserListResult,\n  UserProfile,\n  UserQuery,\n} from '../types.js';\n\n/**\n * Generate a random string for state/nonce/PKCE.\n */\nfunction generateRandomString(length = 32): string {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join(\n    '',\n  );\n}\n\n/**\n * Generate PKCE code verifier and challenge.\n */\nasync function generatePKCE(): Promise<{\n  verifier: string;\n  challenge: string;\n}> {\n  const verifier = generateRandomString(32);\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  const challenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n  return { verifier, challenge };\n}\n\n/**\n * Keycloak authentication provider.\n *\n * Implements full OIDC/OAuth2 authentication with Keycloak server.\n */\nexport class KeycloakProvider implements AuthInterface {\n  private options: Required<\n    Pick<KeycloakOptions, 'serverUrl' | 'realm' | 'clientId'>\n  > &\n    KeycloakOptions;\n  private discoveryDocument: OIDCDiscoveryDocument | null = null;\n  private jwks: jose.JWTVerifyGetKey | null = null;\n\n  constructor(options: KeycloakOptions) {\n    if (!options.serverUrl) {\n      throw new ConfigurationError('serverUrl is required', 'keycloak');\n    }\n    if (!options.realm) {\n      throw new ConfigurationError('realm is required', 'keycloak');\n    }\n    if (!options.clientId) {\n      throw new ConfigurationError('clientId is required', 'keycloak');\n    }\n\n    this.options = {\n      usePKCE: true,\n      verifySsl: true,\n      scopes: ['openid', 'profile', 'email'],\n      timeout: 30000,\n      maxRetries: 3,\n      ...options,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // INTERNAL HELPERS\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Get the base URL for the realm.\n   */\n  private getRealmUrl(): string {\n    return `${this.options.serverUrl}/realms/${this.options.realm}`;\n  }\n\n  /**\n   * Get the admin API base URL.\n   */\n  private getAdminUrl(): string {\n    return `${this.options.serverUrl}/admin/realms/${this.options.realm}`;\n  }\n\n  /**\n   * Make an HTTP request with error handling.\n   */\n  private async request<T>(\n    url: string,\n    options: RequestInit = {},\n    adminToken?: string,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...this.options.headers,\n      ...(options.headers as Record<string, string>),\n    };\n\n    if (adminToken) {\n      headers['Authorization'] = `Bearer ${adminToken}`;\n    }\n\n    try {\n      const response = await fetch(url, {\n        ...options,\n        headers,\n        signal: AbortSignal.timeout(this.options.timeout || 30000),\n      });\n\n      if (!response.ok) {\n        const errorBody = await response.text().catch(() => '');\n        let errorData: Record<string, unknown> = {};\n        try {\n          errorData = JSON.parse(errorBody);\n        } catch {\n          // Not JSON\n        }\n\n        this.handleHttpError(response.status, errorData, errorBody);\n      }\n\n      const text = await response.text();\n      if (!text) return {} as T;\n      return JSON.parse(text) as T;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'TimeoutError') {\n        throw new NetworkError('Request timed out', 'keycloak', error);\n      }\n      if (\n        error instanceof InvalidCredentialsError ||\n        error instanceof AccessDeniedError ||\n        error instanceof InvalidGrantError ||\n        error instanceof InvalidClientError ||\n        error instanceof UserNotFoundError ||\n        error instanceof ProviderError\n      ) {\n        throw error;\n      }\n      throw new NetworkError(\n        `Network error: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'keycloak',\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Handle HTTP error responses.\n   */\n  private handleHttpError(\n    status: number,\n    data: Record<string, unknown>,\n    rawBody: string,\n  ): never {\n    const error = data.error as string | undefined;\n    const errorDescription =\n      data.errorMessage || data.error_description || rawBody;\n\n    switch (status) {\n      case 400:\n        if (error === 'invalid_grant') {\n          throw new InvalidGrantError(errorDescription as string, 'keycloak');\n        }\n        if (error === 'invalid_client') {\n          throw new InvalidClientError('keycloak');\n        }\n        throw new ProviderError(`Bad request: ${errorDescription}`, 'keycloak');\n\n      case 401:\n        throw new InvalidCredentialsError('keycloak');\n\n      case 403:\n        throw new AccessDeniedError(errorDescription as string, 'keycloak');\n\n      case 404:\n        throw new UserNotFoundError(undefined, 'keycloak');\n\n      case 409:\n        throw new UserAlreadyExistsError(undefined, 'keycloak');\n\n      default:\n        throw new ProviderError(\n          `Keycloak error (${status}): ${errorDescription}`,\n          'keycloak',\n        );\n    }\n  }\n\n  /**\n   * Fetch and cache the OIDC discovery document.\n   */\n  private async fetchDiscoveryDocument(): Promise<OIDCDiscoveryDocument> {\n    if (this.discoveryDocument) {\n      return this.discoveryDocument;\n    }\n\n    const url = `${this.getRealmUrl()}/.well-known/openid-configuration`;\n    this.discoveryDocument = await this.request<OIDCDiscoveryDocument>(url);\n    return this.discoveryDocument;\n  }\n\n  /**\n   * Get JWKS for token validation.\n   */\n  private async getJWKS(): Promise<jose.JWTVerifyGetKey> {\n    if (this.jwks) {\n      return this.jwks;\n    }\n\n    const discovery = await this.fetchDiscoveryDocument();\n    this.jwks = jose.createRemoteJWKSet(new URL(discovery.jwks_uri));\n    return this.jwks;\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHENTICATION FLOWS\n  // ---------------------------------------------------------------------------\n\n  async getAuthorizationUrl(\n    options?: AuthorizationOptions,\n  ): Promise<AuthorizationResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const state = options?.state || generateRandomString();\n    const nonce = options?.nonce || generateRandomString();\n    const scopes = options?.scopes ||\n      this.options.scopes || ['openid', 'profile', 'email'];\n    const redirectUri = options?.redirectUri || this.options.redirectUri;\n\n    if (!redirectUri) {\n      throw new ConfigurationError('redirectUri is required', 'keycloak');\n    }\n\n    const params = new URLSearchParams({\n      client_id: this.options.clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      scope: scopes.join(' '),\n      state,\n      nonce,\n    });\n\n    if (options?.prompt) {\n      params.set('prompt', options.prompt);\n    }\n\n    if (options?.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n\n    // Add extra params\n    if (options?.extraParams) {\n      for (const [key, value] of Object.entries(options.extraParams)) {\n        params.set(key, value);\n      }\n    }\n\n    let codeVerifier: string | undefined;\n    if (this.options.usePKCE) {\n      const pkce = await generatePKCE();\n      codeVerifier = pkce.verifier;\n      params.set('code_challenge', pkce.challenge);\n      params.set('code_challenge_method', 'S256');\n    }\n\n    const url = `${discovery.authorization_endpoint}?${params.toString()}`;\n\n    return {\n      url,\n      state,\n      nonce,\n      codeVerifier,\n    };\n  }\n\n  async exchangeCode(params: CodeExchangeParams): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const redirectUri = params.redirectUri || this.options.redirectUri;\n    if (!redirectUri) {\n      throw new ConfigurationError('redirectUri is required', 'keycloak');\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      client_id: this.options.clientId,\n      code: params.code,\n      redirect_uri: redirectUri,\n    });\n\n    if (this.options.clientSecret) {\n      body.set('client_secret', this.options.clientSecret);\n    }\n\n    if (params.codeVerifier) {\n      body.set('code_verifier', params.codeVerifier);\n    }\n\n    const response = await this.request<{\n      access_token: string;\n      refresh_token?: string;\n      id_token?: string;\n      expires_in: number;\n      token_type: string;\n      scope?: string;\n    }>(discovery.token_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    // Decode ID token to get user ID\n    let userId = '';\n    if (response.id_token) {\n      const payload = jose.decodeJwt(response.id_token);\n      userId = payload.sub || '';\n    }\n\n    return {\n      accessToken: response.access_token,\n      tokenType: response.token_type || 'Bearer',\n      expiresIn: response.expires_in,\n      refreshToken: response.refresh_token,\n      idToken: response.id_token,\n      scope: response.scope,\n      userId,\n    };\n  }\n\n  async authenticate(credentials: AuthCredentials): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n    const grantType = credentials.grantType || 'password';\n\n    const scopes = credentials.scopes ||\n      this.options.scopes || ['openid', 'profile', 'email'];\n    const body = new URLSearchParams({\n      grant_type: grantType,\n      client_id: this.options.clientId,\n      scope: scopes.join(' '),\n    });\n\n    if (grantType === 'client_credentials') {\n      // Client credentials grant - requires client secret\n      if (!this.options.clientSecret) {\n        throw new InvalidCredentialsError('keycloak', {\n          reason: 'Client secret is required for client_credentials grant',\n        });\n      }\n      body.set('client_secret', this.options.clientSecret);\n    } else {\n      // Password grant - requires username and password\n      if (!credentials.username || !credentials.password) {\n        throw new InvalidCredentialsError('keycloak', {\n          reason: 'Username and password are required',\n        });\n      }\n      body.set('username', credentials.username);\n      body.set('password', credentials.password);\n\n      if (this.options.clientSecret) {\n        body.set('client_secret', this.options.clientSecret);\n      }\n\n      // Add MFA code if provided\n      if (credentials.mfaCode) {\n        body.set('totp', credentials.mfaCode);\n      }\n    }\n\n    try {\n      const response = await this.request<{\n        access_token: string;\n        refresh_token?: string;\n        id_token?: string;\n        expires_in: number;\n        token_type: string;\n        scope?: string;\n      }>(discovery.token_endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: body.toString(),\n      });\n\n      // Decode ID token to get user ID\n      let userId = '';\n      if (response.id_token) {\n        const payload = jose.decodeJwt(response.id_token);\n        userId = payload.sub || '';\n      } else if (response.access_token) {\n        const payload = jose.decodeJwt(response.access_token);\n        userId = payload.sub || '';\n      }\n\n      return {\n        accessToken: response.access_token,\n        tokenType: response.token_type || 'Bearer',\n        expiresIn: response.expires_in,\n        refreshToken: response.refresh_token,\n        idToken: response.id_token,\n        scope: response.scope,\n        userId,\n      };\n    } catch (error) {\n      // Check for MFA required\n      if (\n        error instanceof ProviderError &&\n        error.message.includes('invalid_grant') &&\n        error.message.includes('totp')\n      ) {\n        throw new MfaRequiredError('keycloak', ['totp']);\n      }\n      throw error;\n    }\n  }\n\n  async refresh(refreshToken: string): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.options.clientId,\n      refresh_token: refreshToken,\n    });\n\n    if (this.options.clientSecret) {\n      body.set('client_secret', this.options.clientSecret);\n    }\n\n    const response = await this.request<{\n      access_token: string;\n      refresh_token?: string;\n      id_token?: string;\n      expires_in: number;\n      token_type: string;\n      scope?: string;\n    }>(discovery.token_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    // Decode to get user ID\n    let userId = '';\n    if (response.access_token) {\n      const payload = jose.decodeJwt(response.access_token);\n      userId = payload.sub || '';\n    }\n\n    return {\n      accessToken: response.access_token,\n      tokenType: response.token_type || 'Bearer',\n      expiresIn: response.expires_in,\n      refreshToken: response.refresh_token || refreshToken,\n      idToken: response.id_token,\n      scope: response.scope,\n      userId,\n    };\n  }\n\n  async logout(options?: LogoutOptions): Promise<void> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    if (!discovery.end_session_endpoint) {\n      // Just revoke the token if no end_session_endpoint\n      if (options?.refreshToken && discovery.revocation_endpoint) {\n        await this.request(discovery.revocation_endpoint, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n          body: new URLSearchParams({\n            client_id: this.options.clientId,\n            token: options.refreshToken,\n            token_type_hint: 'refresh_token',\n          }).toString(),\n        });\n      }\n      return;\n    }\n\n    const params = new URLSearchParams({\n      client_id: this.options.clientId,\n    });\n\n    if (options?.token) {\n      params.set('id_token_hint', options.token);\n    }\n\n    if (options?.postLogoutRedirectUri) {\n      params.set('post_logout_redirect_uri', options.postLogoutRedirectUri);\n    }\n\n    // For logout, we typically redirect the user, but for server-side we can POST\n    if (options?.refreshToken && discovery.revocation_endpoint) {\n      const revokeParams = new URLSearchParams({\n        client_id: this.options.clientId,\n        token: options.refreshToken,\n        token_type_hint: 'refresh_token',\n      });\n      if (this.options.clientSecret) {\n        revokeParams.set('client_secret', this.options.clientSecret);\n      }\n      await this.request(discovery.revocation_endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: revokeParams.toString(),\n      });\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // TOKEN OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async validateToken(\n    token: string,\n    options?: TokenValidationOptions,\n  ): Promise<TokenClaims | null> {\n    try {\n      const jwks = await this.getJWKS();\n      const discovery = await this.fetchDiscoveryDocument();\n\n      const verifyOptions: jose.JWTVerifyOptions = {\n        issuer: options?.issuer || discovery.issuer,\n        clockTolerance: options?.clockTolerance || 0,\n      };\n\n      if (options?.audience) {\n        verifyOptions.audience = options.audience;\n      }\n\n      const { payload } = await jose.jwtVerify(token, jwks, verifyOptions);\n\n      // Check nonce if provided\n      if (options?.nonce && payload.nonce !== options.nonce) {\n        throw new InvalidNonceError('keycloak');\n      }\n\n      // Extract roles from Keycloak token structure\n      const roles: string[] = [];\n\n      // Realm roles\n      if (payload.realm_access && typeof payload.realm_access === 'object') {\n        const realmAccess = payload.realm_access as { roles?: string[] };\n        if (realmAccess.roles) {\n          roles.push(...realmAccess.roles);\n        }\n      }\n\n      // Client roles\n      if (\n        payload.resource_access &&\n        typeof payload.resource_access === 'object'\n      ) {\n        const resourceAccess = payload.resource_access as Record<\n          string,\n          { roles?: string[] }\n        >;\n        for (const client of Object.values(resourceAccess)) {\n          if (client.roles) {\n            roles.push(...client.roles);\n          }\n        }\n      }\n\n      return {\n        sub: payload.sub || '',\n        iss: payload.iss || '',\n        aud: payload.aud || '',\n        exp: payload.exp || 0,\n        iat: payload.iat || 0,\n        nbf: payload.nbf,\n        azp: payload.azp as string | undefined,\n        email: payload.email as string | undefined,\n        email_verified: payload.email_verified as boolean | undefined,\n        preferred_username: payload.preferred_username as string | undefined,\n        name: payload.name as string | undefined,\n        roles,\n        ...payload,\n      };\n    } catch (error) {\n      if (error instanceof jose.errors.JWTExpired) {\n        throw new TokenExpiredError('keycloak');\n      }\n      if (error instanceof jose.errors.JWTClaimValidationFailed) {\n        return null;\n      }\n      if (error instanceof jose.errors.JWSSignatureVerificationFailed) {\n        throw new InvalidTokenError('Invalid token signature', 'keycloak');\n      }\n      if (error instanceof InvalidNonceError) {\n        throw error;\n      }\n      return null;\n    }\n  }\n\n  decodeToken(token: string): TokenPayload {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        throw new InvalidTokenError('Invalid JWT format', 'keycloak');\n      }\n\n      const header = JSON.parse(atob(parts[0]));\n      const payload = jose.decodeJwt(token);\n\n      return {\n        header: {\n          alg: header.alg,\n          typ: header.typ,\n          kid: header.kid,\n        },\n        payload: payload as unknown as TokenClaims,\n        signature: parts[2],\n      };\n    } catch {\n      throw new InvalidTokenError('Failed to decode token', 'keycloak');\n    }\n  }\n\n  async introspectToken(token: string): Promise<TokenIntrospection> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    if (!discovery.introspection_endpoint) {\n      // Fallback to local validation\n      const claims = await this.validateToken(token);\n      return {\n        active: claims !== null,\n        claims: claims || undefined,\n      };\n    }\n\n    const body = new URLSearchParams({\n      client_id: this.options.clientId,\n      token,\n    });\n\n    if (this.options.clientSecret) {\n      body.set('client_secret', this.options.clientSecret);\n    }\n\n    const response = await this.request<{\n      active: boolean;\n      sub?: string;\n      iss?: string;\n      aud?: string | string[];\n      exp?: number;\n      iat?: number;\n      client_id?: string;\n      scope?: string;\n      token_type?: string;\n      [key: string]: unknown;\n    }>(discovery.introspection_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    if (!response.active) {\n      return { active: false };\n    }\n\n    return {\n      active: true,\n      claims: {\n        sub: response.sub || '',\n        iss: response.iss || '',\n        aud: response.aud || '',\n        exp: response.exp || 0,\n        iat: response.iat || 0,\n        ...response,\n      },\n      tokenType: response.token_type,\n      clientId: response.client_id,\n      scope: response.scope,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // USER OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async getProfile(tokenOrSession: string): Promise<UserProfile> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const response = await this.request<{\n      sub: string;\n      preferred_username?: string;\n      email?: string;\n      email_verified?: boolean;\n      name?: string;\n      given_name?: string;\n      family_name?: string;\n      picture?: string;\n      [key: string]: unknown;\n    }>(discovery.userinfo_endpoint, {\n      method: 'GET',\n      headers: { Authorization: `Bearer ${tokenOrSession}` },\n    });\n\n    return {\n      id: response.sub,\n      username: response.preferred_username,\n      email: response.email,\n      emailVerified: response.email_verified,\n      firstName: response.given_name,\n      lastName: response.family_name,\n      displayName: response.name,\n      picture: response.picture,\n    };\n  }\n\n  async updateProfile(\n    tokenOrSession: string,\n    profile: Partial<UserProfile>,\n  ): Promise<UserProfile> {\n    // Get user ID from token\n    const payload = jose.decodeJwt(tokenOrSession);\n    const userId = payload.sub;\n\n    if (!userId) {\n      throw new InvalidTokenError('Token does not contain user ID', 'keycloak');\n    }\n\n    // Update via Account API (requires account-api feature in Keycloak)\n    const accountUrl = `${this.getRealmUrl()}/account`;\n\n    const updateData: Record<string, unknown> = {};\n    if (profile.firstName !== undefined)\n      updateData.firstName = profile.firstName;\n    if (profile.lastName !== undefined) updateData.lastName = profile.lastName;\n    if (profile.email !== undefined) updateData.email = profile.email;\n\n    await this.request(accountUrl, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${tokenOrSession}` },\n      body: JSON.stringify(updateData),\n    });\n\n    return this.getProfile(tokenOrSession);\n  }\n\n  async getUser(userId: string, adminToken?: string): Promise<UserProfile> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    const response = await this.request<KeycloakUser>(\n      `${this.getAdminUrl()}/users/${userId}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    return this.mapKeycloakUser(response);\n  }\n\n  async createUser(\n    user: CreateUserRequest,\n    adminToken: string,\n  ): Promise<UserProfile> {\n    const keycloakUser: Partial<KeycloakUser> = {\n      username: user.username,\n      email: user.email,\n      firstName: user.firstName,\n      lastName: user.lastName,\n      enabled: user.enabled ?? true,\n      emailVerified: user.emailVerified ?? false,\n      attributes: user.attributes as Record<string, string[]>,\n    };\n\n    if (user.password) {\n      keycloakUser.credentials = [\n        {\n          type: 'password',\n          value: user.password,\n          temporary: false,\n        },\n      ];\n    }\n\n    const response = await fetch(`${this.getAdminUrl()}/users`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${adminToken}`,\n      },\n      body: JSON.stringify(keycloakUser),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      if (response.status === 409) {\n        throw new UserAlreadyExistsError(user.username, 'keycloak');\n      }\n      throw new ProviderError(\n        `Failed to create user: ${errorBody}`,\n        'keycloak',\n      );\n    }\n\n    // Get the created user ID from Location header\n    const location = response.headers.get('Location');\n    if (!location) {\n      throw new ProviderError('Failed to get created user ID', 'keycloak');\n    }\n\n    const userId = location.split('/').pop()!;\n\n    // Assign roles if provided\n    if (user.roles?.length) {\n      await this.assignRoles(userId, user.roles, adminToken);\n    }\n\n    // Assign groups if provided\n    if (user.groups?.length) {\n      for (const groupName of user.groups) {\n        await this.addUserToGroup(userId, groupName, adminToken);\n      }\n    }\n\n    return this.getUser(userId, adminToken);\n  }\n\n  async updateUser(\n    userId: string,\n    updates: Partial<CreateUserRequest>,\n    adminToken: string,\n  ): Promise<UserProfile> {\n    const keycloakUser: Partial<KeycloakUser> = {};\n\n    if (updates.username !== undefined)\n      keycloakUser.username = updates.username;\n    if (updates.email !== undefined) keycloakUser.email = updates.email;\n    if (updates.firstName !== undefined)\n      keycloakUser.firstName = updates.firstName;\n    if (updates.lastName !== undefined)\n      keycloakUser.lastName = updates.lastName;\n    if (updates.enabled !== undefined) keycloakUser.enabled = updates.enabled;\n    if (updates.emailVerified !== undefined)\n      keycloakUser.emailVerified = updates.emailVerified;\n    if (updates.attributes !== undefined) {\n      keycloakUser.attributes = updates.attributes as Record<string, string[]>;\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}`,\n      {\n        method: 'PUT',\n        body: JSON.stringify(keycloakUser),\n      },\n      adminToken,\n    );\n\n    // Update password if provided\n    if (updates.password) {\n      await this.request(\n        `${this.getAdminUrl()}/users/${userId}/reset-password`,\n        {\n          method: 'PUT',\n          body: JSON.stringify({\n            type: 'password',\n            value: updates.password,\n            temporary: false,\n          }),\n        },\n        adminToken,\n      );\n    }\n\n    return this.getUser(userId, adminToken);\n  }\n\n  async deleteUser(userId: string, adminToken: string): Promise<void> {\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}`,\n      { method: 'DELETE' },\n      adminToken,\n    );\n  }\n\n  async listUsers(\n    query: UserQuery,\n    adminToken?: string,\n  ): Promise<UserListResult> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    const params = new URLSearchParams();\n\n    if (query.search) params.set('search', query.search);\n    if (query.email) params.set('email', query.email);\n    if (query.username) params.set('username', query.username);\n    if (query.enabled !== undefined)\n      params.set('enabled', String(query.enabled));\n    if (query.limit) params.set('max', String(query.limit));\n    if (query.offset) params.set('first', String(query.offset));\n\n    const users = await this.request<KeycloakUser[]>(\n      `${this.getAdminUrl()}/users?${params.toString()}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    // Get total count\n    const countResponse = await this.request<number>(\n      `${this.getAdminUrl()}/users/count?${params.toString()}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    return {\n      users: users.map((u) => this.mapKeycloakUser(u)),\n      total: countResponse,\n      limit: query.limit || 100,\n      offset: query.offset || 0,\n    };\n  }\n\n  async requestPasswordReset(email: string): Promise<void> {\n    // This requires admin privileges or self-service password reset configured\n    // We'll use the execute-actions-email endpoint\n    throw new NotImplementedError('requestPasswordReset', 'keycloak', {\n      reason:\n        'Requires admin token or use Keycloak login page for self-service reset',\n    });\n  }\n\n  async resetPassword(token: string, newPassword: string): Promise<void> {\n    // Password reset via token is handled by Keycloak's login flow\n    throw new NotImplementedError('resetPassword', 'keycloak', {\n      reason: 'Password reset is handled by Keycloak login flow',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // SESSION OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async listSessions(userId: string, adminToken?: string): Promise<Session[]> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    const sessions = await this.request<KeycloakSession[]>(\n      `${this.getAdminUrl()}/users/${userId}/sessions`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    return sessions.map((s) => ({\n      id: s.id,\n      userId: s.userId,\n      clientId: s.clients ? Object.keys(s.clients).join(', ') : undefined,\n      startedAt: new Date(s.start),\n      lastAccessedAt: new Date(s.lastAccess),\n      ipAddress: s.ipAddress,\n      userAgent: s.userAgent,\n    }));\n  }\n\n  async revokeSession(sessionId: string, adminToken?: string): Promise<void> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/sessions/${sessionId}`,\n      { method: 'DELETE' },\n      adminToken,\n    );\n  }\n\n  async revokeAllSessions(userId: string, adminToken?: string): Promise<void> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/logout`,\n      { method: 'POST' },\n      adminToken,\n    );\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHORIZATION\n  // ---------------------------------------------------------------------------\n\n  async hasRole(tokenOrUserId: string, role: string): Promise<boolean> {\n    const roles = await this.getRoles(tokenOrUserId);\n    return roles.includes(role);\n  }\n\n  async hasPermission(\n    tokenOrUserId: string,\n    permission: string,\n    resource?: string,\n  ): Promise<boolean> {\n    // Keycloak permissions are typically checked via the Authorization Services API\n    // For now, we check if the user has a role matching the permission\n    // A full implementation would use the entitlement API\n    const roles = await this.getRoles(tokenOrUserId);\n    const permissionRole = resource ? `${resource}:${permission}` : permission;\n    return roles.includes(permissionRole) || roles.includes(permission);\n  }\n\n  async getRoles(\n    tokenOrUserId: string,\n    adminToken?: string,\n  ): Promise<string[]> {\n    // First try to decode as JWT\n    try {\n      const claims = await this.validateToken(tokenOrUserId);\n      if (claims) {\n        return claims.roles || [];\n      }\n    } catch {\n      // Not a valid token, might be a user ID\n    }\n\n    // If admin token provided, try to fetch roles by user ID\n    if (adminToken) {\n      try {\n        const roleMappings = await this.request<{\n          realmMappings?: { name: string }[];\n        }>(\n          `${this.getAdminUrl()}/users/${tokenOrUserId}/role-mappings`,\n          { method: 'GET' },\n          adminToken,\n        );\n\n        return roleMappings.realmMappings?.map((r) => r.name) || [];\n      } catch {\n        // User ID not found or other error\n      }\n    }\n\n    return [];\n  }\n\n  async assignRole(\n    userId: string,\n    role: string,\n    adminToken: string,\n  ): Promise<void> {\n    // First, get the role\n    const roles = await this.request<KeycloakRole[]>(\n      `${this.getAdminUrl()}/roles`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const roleObj = roles.find((r) => r.name === role);\n    if (!roleObj) {\n      throw new ProviderError(`Role not found: ${role}`, 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/role-mappings/realm`,\n      {\n        method: 'POST',\n        body: JSON.stringify([roleObj]),\n      },\n      adminToken,\n    );\n  }\n\n  async removeRole(\n    userId: string,\n    role: string,\n    adminToken: string,\n  ): Promise<void> {\n    // First, get the role\n    const roles = await this.request<KeycloakRole[]>(\n      `${this.getAdminUrl()}/roles`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const roleObj = roles.find((r) => r.name === role);\n    if (!roleObj) {\n      throw new ProviderError(`Role not found: ${role}`, 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/role-mappings/realm`,\n      {\n        method: 'DELETE',\n        body: JSON.stringify([roleObj]),\n      },\n      adminToken,\n    );\n  }\n\n  // ---------------------------------------------------------------------------\n  // PROVIDER INFORMATION\n  // ---------------------------------------------------------------------------\n\n  async getCapabilities(): Promise<AuthCapabilities> {\n    return {\n      authorizationCode: true,\n      passwordGrant: true,\n      clientCredentials: true,\n      tokenRefresh: true,\n      oidc: true,\n      userManagement: true,\n      sessionManagement: true,\n      rbac: true,\n      passwordReset: true,\n      mfa: true,\n      socialLogin: true,\n      federation: true,\n      decentralized: false,\n    };\n  }\n\n  async getDiscoveryDocument(): Promise<OIDCDiscoveryDocument | null> {\n    return this.fetchDiscoveryDocument();\n  }\n\n  // ---------------------------------------------------------------------------\n  // PRIVATE HELPERS\n  // ---------------------------------------------------------------------------\n\n  private mapKeycloakUser(user: KeycloakUser): UserProfile {\n    return {\n      id: user.id,\n      username: user.username,\n      email: user.email,\n      emailVerified: user.emailVerified,\n      firstName: user.firstName,\n      lastName: user.lastName,\n      displayName:\n        user.firstName && user.lastName\n          ? `${user.firstName} ${user.lastName}`\n          : user.username,\n      enabled: user.enabled,\n      createdAt: user.createdTimestamp\n        ? new Date(user.createdTimestamp)\n        : undefined,\n      attributes: user.attributes,\n      groups: user.groups,\n    };\n  }\n\n  private async assignRoles(\n    userId: string,\n    roleNames: string[],\n    adminToken: string,\n  ): Promise<void> {\n    const allRoles = await this.request<KeycloakRole[]>(\n      `${this.getAdminUrl()}/roles`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const rolesToAssign = allRoles.filter((r) => roleNames.includes(r.name));\n\n    if (rolesToAssign.length > 0) {\n      await this.request(\n        `${this.getAdminUrl()}/users/${userId}/role-mappings/realm`,\n        {\n          method: 'POST',\n          body: JSON.stringify(rolesToAssign),\n        },\n        adminToken,\n      );\n    }\n  }\n\n  private async addUserToGroup(\n    userId: string,\n    groupName: string,\n    adminToken: string,\n  ): Promise<void> {\n    // Get group by name\n    const groups = await this.request<KeycloakGroup[]>(\n      `${this.getAdminUrl()}/groups?search=${encodeURIComponent(groupName)}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const group = groups.find((g) => g.name === groupName);\n    if (!group) {\n      throw new ProviderError(`Group not found: ${groupName}`, 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/groups/${group.id}`,\n      { method: 'PUT' },\n      adminToken,\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// KEYCLOAK API TYPES\n// ---------------------------------------------------------------------------\n\ninterface KeycloakUser {\n  id: string;\n  username: string;\n  email?: string;\n  emailVerified?: boolean;\n  firstName?: string;\n  lastName?: string;\n  enabled?: boolean;\n  createdTimestamp?: number;\n  attributes?: Record<string, string[]>;\n  groups?: string[];\n  credentials?: Array<{\n    type: string;\n    value: string;\n    temporary?: boolean;\n  }>;\n}\n\ninterface KeycloakSession {\n  id: string;\n  userId: string;\n  username: string;\n  start: number;\n  lastAccess: number;\n  ipAddress?: string;\n  userAgent?: string;\n  clients?: Record<string, string>;\n}\n\ninterface KeycloakRole {\n  id: string;\n  name: string;\n  description?: string;\n  composite?: boolean;\n  clientRole?: boolean;\n  containerId?: string;\n}\n\ninterface KeycloakGroup {\n  id: string;\n  name: string;\n  path?: string;\n  subGroups?: KeycloakGroup[];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAyDA,SAAS,qBAAqB,SAAS,IAAY;CACjD,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,OAAO,gBAAgB,KAAK;CAC5B,OAAO,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KACrE,EACF;AACF;;;;AAKA,eAAe,eAGZ;CACD,MAAM,WAAW,qBAAqB,EAAE;CAExC,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,QAAQ;CACpC,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAKvD,OAAO;EAAE;EAAU,WAJD,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,CAAC,CACjE,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EACC;CAAU;AAC/B;;;;;;AAOA,IAAa,mBAAb,MAAuD;CACrD;CAIA,oBAA0D;CAC1D,OAA4C;CAE5C,YAAY,SAA0B;EACpC,IAAI,CAAC,QAAQ,WACX,MAAM,IAAI,mBAAmB,yBAAyB,UAAU;EAElE,IAAI,CAAC,QAAQ,OACX,MAAM,IAAI,mBAAmB,qBAAqB,UAAU;EAE9D,IAAI,CAAC,QAAQ,UACX,MAAM,IAAI,mBAAmB,wBAAwB,UAAU;EAGjE,KAAK,UAAU;GACb,SAAS;GACT,WAAW;GACX,QAAQ;IAAC;IAAU;IAAW;GAAO;GACrC,SAAS;GACT,YAAY;GACZ,GAAG;EACL;CACF;;;;CASA,cAA8B;EAC5B,OAAO,GAAG,KAAK,QAAQ,UAAU,UAAU,KAAK,QAAQ;CAC1D;;;;CAKA,cAA8B;EAC5B,OAAO,GAAG,KAAK,QAAQ,UAAU,gBAAgB,KAAK,QAAQ;CAChE;;;;CAKA,MAAc,QACZ,KACA,UAAuB,CAAC,GACxB,YACY;EACZ,MAAM,UAAkC;GACtC,gBAAgB;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAI,QAAQ;EACd;EAEA,IAAI,YACF,QAAQ,mBAAmB,UAAU;EAGvC,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,KAAK;IAChC,GAAG;IACH;IACA,QAAQ,YAAY,QAAQ,KAAK,QAAQ,WAAW,GAAK;GAC3D,CAAC;GAED,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,YAAY,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;IACtD,IAAI,YAAqC,CAAC;IAC1C,IAAI;KACF,YAAY,KAAK,MAAM,SAAS;IAClC,QAAQ,CAER;IAEA,KAAK,gBAAgB,SAAS,QAAQ,WAAW,SAAS;GAC5D;GAEA,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,MAAM,OAAO,CAAC;GACnB,OAAO,KAAK,MAAM,IAAI;EACxB,SAAS,OAAO;GACd,IAAI,iBAAiB,SAAS,MAAM,SAAS,gBAC3C,MAAM,IAAI,aAAa,qBAAqB,YAAY,KAAK;GAE/D,IACE,iBAAiB,2BACjB,iBAAiB,qBACjB,iBAAiB,qBACjB,iBAAiB,sBACjB,iBAAiB,qBACjB,iBAAiB,eAEjB,MAAM;GAER,MAAM,IAAI,aACR,kBAAkB,iBAAiB,QAAQ,MAAM,UAAU,mBAC3D,YACA,iBAAiB,QAAQ,QAAQ,KAAA,CACnC;EACF;CACF;;;;CAKA,gBACE,QACA,MACA,SACO;EACP,MAAM,QAAQ,KAAK;EACnB,MAAM,mBACJ,KAAK,gBAAgB,KAAK,qBAAqB;EAEjD,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,iBACZ,MAAM,IAAI,kBAAkB,kBAA4B,UAAU;IAEpE,IAAI,UAAU,kBACZ,MAAM,IAAI,mBAAmB,UAAU;IAEzC,MAAM,IAAI,cAAc,gBAAgB,oBAAoB,UAAU;GAExE,KAAK,KACH,MAAM,IAAI,wBAAwB,UAAU;GAE9C,KAAK,KACH,MAAM,IAAI,kBAAkB,kBAA4B,UAAU;GAEpE,KAAK,KACH,MAAM,IAAI,kBAAkB,KAAA,GAAW,UAAU;GAEnD,KAAK,KACH,MAAM,IAAI,uBAAuB,KAAA,GAAW,UAAU;GAExD,SACE,MAAM,IAAI,cACR,mBAAmB,OAAO,KAAK,oBAC/B,UACF;EACJ;CACF;;;;CAKA,MAAc,yBAAyD;EACrE,IAAI,KAAK,mBACP,OAAO,KAAK;EAGd,MAAM,MAAM,GAAG,KAAK,YAAY,EAAE;EAClC,KAAK,oBAAoB,MAAM,KAAK,QAA+B,GAAG;EACtE,OAAO,KAAK;CACd;;;;CAKA,MAAc,UAAyC;EACrD,IAAI,KAAK,MACP,OAAO,KAAK;EAGd,MAAM,YAAY,MAAM,KAAK,uBAAuB;EACpD,KAAK,OAAO,mBAAwB,IAAI,IAAI,UAAU,QAAQ,CAAC;EAC/D,OAAO,KAAK;CACd;CAMA,MAAM,oBACJ,SAC8B;EAC9B,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EACrD,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EACrD,MAAM,SAAS,SAAS,UACtB,KAAK,QAAQ,UAAU;GAAC;GAAU;GAAW;EAAO;EACtD,MAAM,cAAc,SAAS,eAAe,KAAK,QAAQ;EAEzD,IAAI,CAAC,aACH,MAAM,IAAI,mBAAmB,2BAA2B,UAAU;EAGpE,MAAM,SAAS,IAAI,gBAAgB;GACjC,WAAW,KAAK,QAAQ;GACxB,cAAc;GACd,eAAe;GACf,OAAO,OAAO,KAAK,GAAG;GACtB;GACA;EACF,CAAC;EAED,IAAI,SAAS,QACX,OAAO,IAAI,UAAU,QAAQ,MAAM;EAGrC,IAAI,SAAS,WACX,OAAO,IAAI,cAAc,QAAQ,SAAS;EAI5C,IAAI,SAAS,aACX,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,WAAW,GAC3D,OAAO,IAAI,KAAK,KAAK;EAIzB,IAAI;EACJ,IAAI,KAAK,QAAQ,SAAS;GACxB,MAAM,OAAO,MAAM,aAAa;GAChC,eAAe,KAAK;GACpB,OAAO,IAAI,kBAAkB,KAAK,SAAS;GAC3C,OAAO,IAAI,yBAAyB,MAAM;EAC5C;EAIA,OAAO;GACL,KAAA,GAHa,UAAU,uBAAuB,GAAG,OAAO,SAAS;GAIjE;GACA;GACA;EACF;CACF;CAEA,MAAM,aAAa,QAAiD;EAClE,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,cAAc,OAAO,eAAe,KAAK,QAAQ;EACvD,IAAI,CAAC,aACH,MAAM,IAAI,mBAAmB,2BAA2B,UAAU;EAGpE,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,MAAM,OAAO;GACb,cAAc;EAChB,CAAC;EAED,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EAGrD,IAAI,OAAO,cACT,KAAK,IAAI,iBAAiB,OAAO,YAAY;EAG/C,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;GAC3B,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAGD,IAAI,SAAS;EACb,IAAI,SAAS,UAEX,SADgB,UAAe,SAAS,QAC/B,CAAA,CAAQ,OAAO;EAG1B,OAAO;GACL,aAAa,SAAS;GACtB,WAAW,SAAS,cAAc;GAClC,WAAW,SAAS;GACpB,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB;EACF;CACF;CAEA,MAAM,aAAa,aAAmD;EACpE,MAAM,YAAY,MAAM,KAAK,uBAAuB;EACpD,MAAM,YAAY,YAAY,aAAa;EAE3C,MAAM,SAAS,YAAY,UACzB,KAAK,QAAQ,UAAU;GAAC;GAAU;GAAW;EAAO;EACtD,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,OAAO,OAAO,KAAK,GAAG;EACxB,CAAC;EAED,IAAI,cAAc,sBAAsB;GAEtC,IAAI,CAAC,KAAK,QAAQ,cAChB,MAAM,IAAI,wBAAwB,YAAY,EAC5C,QAAQ,yDACV,CAAC;GAEH,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EACrD,OAAO;GAEL,IAAI,CAAC,YAAY,YAAY,CAAC,YAAY,UACxC,MAAM,IAAI,wBAAwB,YAAY,EAC5C,QAAQ,qCACV,CAAC;GAEH,KAAK,IAAI,YAAY,YAAY,QAAQ;GACzC,KAAK,IAAI,YAAY,YAAY,QAAQ;GAEzC,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;GAIrD,IAAI,YAAY,SACd,KAAK,IAAI,QAAQ,YAAY,OAAO;EAExC;EAEA,IAAI;GACF,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;IAC3B,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,KAAK,SAAS;GACtB,CAAC;GAGD,IAAI,SAAS;GACb,IAAI,SAAS,UAEX,SADgB,UAAe,SAAS,QAC/B,CAAA,CAAQ,OAAO;QACnB,IAAI,SAAS,cAElB,SADgB,UAAe,SAAS,YAC/B,CAAA,CAAQ,OAAO;GAG1B,OAAO;IACL,aAAa,SAAS;IACtB,WAAW,SAAS,cAAc;IAClC,WAAW,SAAS;IACpB,cAAc,SAAS;IACvB,SAAS,SAAS;IAClB,OAAO,SAAS;IAChB;GACF;EACF,SAAS,OAAO;GAEd,IACE,iBAAiB,iBACjB,MAAM,QAAQ,SAAS,eAAe,KACtC,MAAM,QAAQ,SAAS,MAAM,GAE7B,MAAM,IAAI,iBAAiB,YAAY,CAAC,MAAM,CAAC;GAEjD,MAAM;EACR;CACF;CAEA,MAAM,QAAQ,cAA2C;EACvD,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,eAAe;EACjB,CAAC;EAED,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EAGrD,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;GAC3B,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAGD,IAAI,SAAS;EACb,IAAI,SAAS,cAEX,SADgB,UAAe,SAAS,YAC/B,CAAA,CAAQ,OAAO;EAG1B,OAAO;GACL,aAAa,SAAS;GACtB,WAAW,SAAS,cAAc;GAClC,WAAW,SAAS;GACpB,cAAc,SAAS,iBAAiB;GACxC,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB;EACF;CACF;CAEA,MAAM,OAAO,SAAwC;EACnD,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,IAAI,CAAC,UAAU,sBAAsB;GAEnC,IAAI,SAAS,gBAAgB,UAAU,qBACrC,MAAM,KAAK,QAAQ,UAAU,qBAAqB;IAChD,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB,WAAW,KAAK,QAAQ;KACxB,OAAO,QAAQ;KACf,iBAAiB;IACnB,CAAC,CAAC,CAAC,SAAS;GACd,CAAC;GAEH;EACF;EAEA,MAAM,SAAS,IAAI,gBAAgB,EACjC,WAAW,KAAK,QAAQ,SAC1B,CAAC;EAED,IAAI,SAAS,OACX,OAAO,IAAI,iBAAiB,QAAQ,KAAK;EAG3C,IAAI,SAAS,uBACX,OAAO,IAAI,4BAA4B,QAAQ,qBAAqB;EAItE,IAAI,SAAS,gBAAgB,UAAU,qBAAqB;GAC1D,MAAM,eAAe,IAAI,gBAAgB;IACvC,WAAW,KAAK,QAAQ;IACxB,OAAO,QAAQ;IACf,iBAAiB;GACnB,CAAC;GACD,IAAI,KAAK,QAAQ,cACf,aAAa,IAAI,iBAAiB,KAAK,QAAQ,YAAY;GAE7D,MAAM,KAAK,QAAQ,UAAU,qBAAqB;IAChD,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,aAAa,SAAS;GAC9B,CAAC;EACH;CACF;CAMA,MAAM,cACJ,OACA,SAC6B;EAC7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,QAAQ;GAChC,MAAM,YAAY,MAAM,KAAK,uBAAuB;GAEpD,MAAM,gBAAuC;IAC3C,QAAQ,SAAS,UAAU,UAAU;IACrC,gBAAgB,SAAS,kBAAkB;GAC7C;GAEA,IAAI,SAAS,UACX,cAAc,WAAW,QAAQ;GAGnC,MAAM,EAAE,YAAY,MAAM,UAAe,OAAO,MAAM,aAAa;GAGnE,IAAI,SAAS,SAAS,QAAQ,UAAU,QAAQ,OAC9C,MAAM,IAAI,kBAAkB,UAAU;GAIxC,MAAM,QAAkB,CAAC;GAGzB,IAAI,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB,UAAU;IACpE,MAAM,cAAc,QAAQ;IAC5B,IAAI,YAAY,OACd,MAAM,KAAK,GAAG,YAAY,KAAK;GAEnC;GAGA,IACE,QAAQ,mBACR,OAAO,QAAQ,oBAAoB,UACnC;IACA,MAAM,iBAAiB,QAAQ;IAI/B,KAAK,MAAM,UAAU,OAAO,OAAO,cAAc,GAC/C,IAAI,OAAO,OACT,MAAM,KAAK,GAAG,OAAO,KAAK;GAGhC;GAEA,OAAO;IACL,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ;IACb,KAAK,QAAQ;IACb,OAAO,QAAQ;IACf,gBAAgB,QAAQ;IACxB,oBAAoB,QAAQ;IAC5B,MAAM,QAAQ;IACd;IACA,GAAG;GACL;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,YACnB,MAAM,IAAI,kBAAkB,UAAU;GAExC,IAAI,iBAAiB,0BACnB,OAAO;GAET,IAAI,iBAAiB,gCACnB,MAAM,IAAI,kBAAkB,2BAA2B,UAAU;GAEnE,IAAI,iBAAiB,mBACnB,MAAM;GAER,OAAO;EACT;CACF;CAEA,YAAY,OAA6B;EACvC,IAAI;GACF,MAAM,QAAQ,MAAM,MAAM,GAAG;GAC7B,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,kBAAkB,sBAAsB,UAAU;GAG9D,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;GACxC,MAAM,UAAU,UAAe,KAAK;GAEpC,OAAO;IACL,QAAQ;KACN,KAAK,OAAO;KACZ,KAAK,OAAO;KACZ,KAAK,OAAO;IACd;IACS;IACT,WAAW,MAAM;GACnB;EACF,QAAQ;GACN,MAAM,IAAI,kBAAkB,0BAA0B,UAAU;EAClE;CACF;CAEA,MAAM,gBAAgB,OAA4C;EAChE,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,IAAI,CAAC,UAAU,wBAAwB;GAErC,MAAM,SAAS,MAAM,KAAK,cAAc,KAAK;GAC7C,OAAO;IACL,QAAQ,WAAW;IACnB,QAAQ,UAAU,KAAA;GACpB;EACF;EAEA,MAAM,OAAO,IAAI,gBAAgB;GAC/B,WAAW,KAAK,QAAQ;GACxB;EACF,CAAC;EAED,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EAGrD,MAAM,WAAW,MAAM,KAAK,QAWzB,UAAU,wBAAwB;GACnC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,CAAC,SAAS,QACZ,OAAO,EAAE,QAAQ,MAAM;EAGzB,OAAO;GACL,QAAQ;GACR,QAAQ;IACN,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,GAAG;GACL;GACA,WAAW,SAAS;GACpB,UAAU,SAAS;GACnB,OAAO,SAAS;EAClB;CACF;CAMA,MAAM,WAAW,gBAA8C;EAC7D,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,WAAW,MAAM,KAAK,QAUzB,UAAU,mBAAmB;GAC9B,QAAQ;GACR,SAAS,EAAE,eAAe,UAAU,iBAAiB;EACvD,CAAC;EAED,OAAO;GACL,IAAI,SAAS;GACb,UAAU,SAAS;GACnB,OAAO,SAAS;GAChB,eAAe,SAAS;GACxB,WAAW,SAAS;GACpB,UAAU,SAAS;GACnB,aAAa,SAAS;GACtB,SAAS,SAAS;EACpB;CACF;CAEA,MAAM,cACJ,gBACA,SACsB;EAKtB,IAAI,CAHY,UAAe,cAChB,CAAA,CAAQ,KAGrB,MAAM,IAAI,kBAAkB,kCAAkC,UAAU;EAI1E,MAAM,aAAa,GAAG,KAAK,YAAY,EAAE;EAEzC,MAAM,aAAsC,CAAC;EAC7C,IAAI,QAAQ,cAAc,KAAA,GACxB,WAAW,YAAY,QAAQ;EACjC,IAAI,QAAQ,aAAa,KAAA,GAAW,WAAW,WAAW,QAAQ;EAClE,IAAI,QAAQ,UAAU,KAAA,GAAW,WAAW,QAAQ,QAAQ;EAE5D,MAAM,KAAK,QAAQ,YAAY;GAC7B,QAAQ;GACR,SAAS,EAAE,eAAe,UAAU,iBAAiB;GACrD,MAAM,KAAK,UAAU,UAAU;EACjC,CAAC;EAED,OAAO,KAAK,WAAW,cAAc;CACvC;CAEA,MAAM,QAAQ,QAAgB,YAA2C;EACvE,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,WAAW,MAAM,KAAK,QAC1B,GAAG,KAAK,YAAY,EAAE,SAAS,UAC/B,EAAE,QAAQ,MAAM,GAChB,UACF;EAEA,OAAO,KAAK,gBAAgB,QAAQ;CACtC;CAEA,MAAM,WACJ,MACA,YACsB;EACtB,MAAM,eAAsC;GAC1C,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,WAAW,KAAK;GAChB,UAAU,KAAK;GACf,SAAS,KAAK,WAAW;GACzB,eAAe,KAAK,iBAAiB;GACrC,YAAY,KAAK;EACnB;EAEA,IAAI,KAAK,UACP,aAAa,cAAc,CACzB;GACE,MAAM;GACN,OAAO,KAAK;GACZ,WAAW;EACb,CACF;EAGF,MAAM,WAAW,MAAM,MAAM,GAAG,KAAK,YAAY,EAAE,SAAS;GAC1D,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,YAAY;EACnC,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,KAAK;GACtC,IAAI,SAAS,WAAW,KACtB,MAAM,IAAI,uBAAuB,KAAK,UAAU,UAAU;GAE5D,MAAM,IAAI,cACR,0BAA0B,aAC1B,UACF;EACF;EAGA,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;EAChD,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,iCAAiC,UAAU;EAGrE,MAAM,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI;EAGvC,IAAI,KAAK,OAAO,QACd,MAAM,KAAK,YAAY,QAAQ,KAAK,OAAO,UAAU;EAIvD,IAAI,KAAK,QAAQ,QACf,KAAK,MAAM,aAAa,KAAK,QAC3B,MAAM,KAAK,eAAe,QAAQ,WAAW,UAAU;EAI3D,OAAO,KAAK,QAAQ,QAAQ,UAAU;CACxC;CAEA,MAAM,WACJ,QACA,SACA,YACsB;EACtB,MAAM,eAAsC,CAAC;EAE7C,IAAI,QAAQ,aAAa,KAAA,GACvB,aAAa,WAAW,QAAQ;EAClC,IAAI,QAAQ,UAAU,KAAA,GAAW,aAAa,QAAQ,QAAQ;EAC9D,IAAI,QAAQ,cAAc,KAAA,GACxB,aAAa,YAAY,QAAQ;EACnC,IAAI,QAAQ,aAAa,KAAA,GACvB,aAAa,WAAW,QAAQ;EAClC,IAAI,QAAQ,YAAY,KAAA,GAAW,aAAa,UAAU,QAAQ;EAClE,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,aAAa,gBAAgB,QAAQ;EACvC,IAAI,QAAQ,eAAe,KAAA,GACzB,aAAa,aAAa,QAAQ;EAGpC,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,UAC/B;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,YAAY;EACnC,GACA,UACF;EAGA,IAAI,QAAQ,UACV,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,kBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,OAAO,QAAQ;IACf,WAAW;GACb,CAAC;EACH,GACA,UACF;EAGF,OAAO,KAAK,QAAQ,QAAQ,UAAU;CACxC;CAEA,MAAM,WAAW,QAAgB,YAAmC;EAClE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,UAC/B,EAAE,QAAQ,SAAS,GACnB,UACF;CACF;CAEA,MAAM,UACJ,OACA,YACyB;EACzB,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,SAAS,IAAI,gBAAgB;EAEnC,IAAI,MAAM,QAAQ,OAAO,IAAI,UAAU,MAAM,MAAM;EACnD,IAAI,MAAM,OAAO,OAAO,IAAI,SAAS,MAAM,KAAK;EAChD,IAAI,MAAM,UAAU,OAAO,IAAI,YAAY,MAAM,QAAQ;EACzD,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,IAAI,WAAW,OAAO,MAAM,OAAO,CAAC;EAC7C,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC;EACtD,IAAI,MAAM,QAAQ,OAAO,IAAI,SAAS,OAAO,MAAM,MAAM,CAAC;EAE1D,MAAM,QAAQ,MAAM,KAAK,QACvB,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,SAAS,KAC/C,EAAE,QAAQ,MAAM,GAChB,UACF;EAGA,MAAM,gBAAgB,MAAM,KAAK,QAC/B,GAAG,KAAK,YAAY,EAAE,eAAe,OAAO,SAAS,KACrD,EAAE,QAAQ,MAAM,GAChB,UACF;EAEA,OAAO;GACL,OAAO,MAAM,KAAK,MAAM,KAAK,gBAAgB,CAAC,CAAC;GAC/C,OAAO;GACP,OAAO,MAAM,SAAS;GACtB,QAAQ,MAAM,UAAU;EAC1B;CACF;CAEA,MAAM,qBAAqB,OAA8B;EAGvD,MAAM,IAAI,oBAAoB,wBAAwB,YAAY,EAChE,QACE,yEACJ,CAAC;CACH;CAEA,MAAM,cAAc,OAAe,aAAoC;EAErE,MAAM,IAAI,oBAAoB,iBAAiB,YAAY,EACzD,QAAQ,mDACV,CAAC;CACH;CAMA,MAAM,aAAa,QAAgB,YAAyC;EAC1E,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAShE,QAAO,MANgB,KAAK,QAC1B,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,YACtC,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEgB,KAAK,OAAO;GAC1B,IAAI,EAAE;GACN,QAAQ,EAAE;GACV,UAAU,EAAE,UAAU,OAAO,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,KAAA;GAC1D,WAAW,IAAI,KAAK,EAAE,KAAK;GAC3B,gBAAgB,IAAI,KAAK,EAAE,UAAU;GACrC,WAAW,EAAE;GACb,WAAW,EAAE;EACf,EAAE;CACJ;CAEA,MAAM,cAAc,WAAmB,YAAoC;EACzE,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,YAAY,aAClC,EAAE,QAAQ,SAAS,GACnB,UACF;CACF;CAEA,MAAM,kBAAkB,QAAgB,YAAoC;EAC1E,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,UACtC,EAAE,QAAQ,OAAO,GACjB,UACF;CACF;CAMA,MAAM,QAAQ,eAAuB,MAAgC;EAEnE,QAAO,MADa,KAAK,SAAS,aAAa,EAAA,CAClC,SAAS,IAAI;CAC5B;CAEA,MAAM,cACJ,eACA,YACA,UACkB;EAIlB,MAAM,QAAQ,MAAM,KAAK,SAAS,aAAa;EAC/C,MAAM,iBAAiB,WAAW,GAAG,SAAS,GAAG,eAAe;EAChE,OAAO,MAAM,SAAS,cAAc,KAAK,MAAM,SAAS,UAAU;CACpE;CAEA,MAAM,SACJ,eACA,YACmB;EAEnB,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,cAAc,aAAa;GACrD,IAAI,QACF,OAAO,OAAO,SAAS,CAAC;EAE5B,QAAQ,CAER;EAGA,IAAI,YACF,IAAI;GASF,QAAO,MARoB,KAAK,QAG9B,GAAG,KAAK,YAAY,EAAE,SAAS,cAAc,iBAC7C,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEoB,eAAe,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC;EAC5D,QAAQ,CAER;EAGF,OAAO,CAAC;CACV;CAEA,MAAM,WACJ,QACA,MACA,YACe;EAQf,MAAM,WAAU,MANI,KAAK,QACvB,GAAG,KAAK,YAAY,EAAE,SACtB,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEsB,MAAM,MAAM,EAAE,SAAS,IAAI;EACjD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,mBAAmB,QAAQ,UAAU;EAG/D,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,uBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;EAChC,GACA,UACF;CACF;CAEA,MAAM,WACJ,QACA,MACA,YACe;EAQf,MAAM,WAAU,MANI,KAAK,QACvB,GAAG,KAAK,YAAY,EAAE,SACtB,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEsB,MAAM,MAAM,EAAE,SAAS,IAAI;EACjD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,mBAAmB,QAAQ,UAAU;EAG/D,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,uBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;EAChC,GACA,UACF;CACF;CAMA,MAAM,kBAA6C;EACjD,OAAO;GACL,mBAAmB;GACnB,eAAe;GACf,mBAAmB;GACnB,cAAc;GACd,MAAM;GACN,gBAAgB;GAChB,mBAAmB;GACnB,MAAM;GACN,eAAe;GACf,KAAK;GACL,aAAa;GACb,YAAY;GACZ,eAAe;EACjB;CACF;CAEA,MAAM,uBAA8D;EAClE,OAAO,KAAK,uBAAuB;CACrC;CAMA,gBAAwB,MAAiC;EACvD,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,eAAe,KAAK;GACpB,WAAW,KAAK;GAChB,UAAU,KAAK;GACf,aACE,KAAK,aAAa,KAAK,WACnB,GAAG,KAAK,UAAU,GAAG,KAAK,aAC1B,KAAK;GACX,SAAS,KAAK;GACd,WAAW,KAAK,mBACZ,IAAI,KAAK,KAAK,gBAAgB,IAC9B,KAAA;GACJ,YAAY,KAAK;GACjB,QAAQ,KAAK;EACf;CACF;CAEA,MAAc,YACZ,QACA,WACA,YACe;EAOf,MAAM,iBAAgB,MANC,KAAK,QAC1B,GAAG,KAAK,YAAY,EAAE,SACtB,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAE+B,QAAQ,MAAM,UAAU,SAAS,EAAE,IAAI,CAAC;EAEvE,IAAI,cAAc,SAAS,GACzB,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,uBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,aAAa;EACpC,GACA,UACF;CAEJ;CAEA,MAAc,eACZ,QACA,WACA,YACe;EAQf,MAAM,SAAQ,MANO,KAAK,QACxB,GAAG,KAAK,YAAY,EAAE,iBAAiB,mBAAmB,SAAS,KACnE,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEqB,MAAM,MAAM,EAAE,SAAS,SAAS;EACrD,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,oBAAoB,aAAa,UAAU;EAGrE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,UAAU,MAAM,MACtD,EAAE,QAAQ,MAAM,GAChB,UACF;CACF;AACF"}
+{"version":3,"file":"keycloak-hR2UOZ1n.js","names":[],"sources":["../../src/shared/providers/keycloak.ts"],"sourcesContent":["/**\n * Keycloak Provider - OIDC/OAuth2 Authentication\n *\n * Implements full OIDC/OAuth2 authentication with Keycloak server including:\n * - OIDC Discovery\n * - Authorization Code Flow with PKCE\n * - Token validation using JWKS\n * - Token introspection\n * - User management via Admin API\n * - Session management\n */\n\nimport * as jose from 'jose';\n\nimport {\n  AccessDeniedError,\n  ConfigurationError,\n  InvalidClientError,\n  InvalidCredentialsError,\n  InvalidGrantError,\n  InvalidNonceError,\n  InvalidRedirectUriError,\n  InvalidStateError,\n  InvalidTokenError,\n  MfaRequiredError,\n  NetworkError,\n  NotImplementedError,\n  ProviderError,\n  TokenExpiredError,\n  UserAlreadyExistsError,\n  UserNotFoundError,\n} from '../errors.js';\nimport type {\n  AuthCapabilities,\n  AuthCredentials,\n  AuthInterface,\n  AuthorizationOptions,\n  AuthorizationResult,\n  AuthResult,\n  CodeExchangeParams,\n  CreateUserRequest,\n  KeycloakOptions,\n  LogoutOptions,\n  OIDCDiscoveryDocument,\n  Session,\n  TokenClaims,\n  TokenIntrospection,\n  TokenPayload,\n  TokenValidationOptions,\n  UserListResult,\n  UserProfile,\n  UserQuery,\n} from '../types.js';\n\n/**\n * Generate a random string for state/nonce/PKCE.\n */\nfunction generateRandomString(length = 32): string {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join(\n    '',\n  );\n}\n\n/**\n * Generate PKCE code verifier and challenge.\n */\nasync function generatePKCE(): Promise<{\n  verifier: string;\n  challenge: string;\n}> {\n  const verifier = generateRandomString(32);\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  const challenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n  return { verifier, challenge };\n}\n\n/**\n * Keycloak authentication provider.\n *\n * Implements full OIDC/OAuth2 authentication with Keycloak server.\n */\nexport class KeycloakProvider implements AuthInterface {\n  private options: Required<\n    Pick<KeycloakOptions, 'serverUrl' | 'realm' | 'clientId'>\n  > &\n    KeycloakOptions;\n  private discoveryDocument: OIDCDiscoveryDocument | null = null;\n  private jwks: jose.JWTVerifyGetKey | null = null;\n\n  constructor(options: KeycloakOptions) {\n    if (!options.serverUrl) {\n      throw new ConfigurationError('serverUrl is required', 'keycloak');\n    }\n    if (!options.realm) {\n      throw new ConfigurationError('realm is required', 'keycloak');\n    }\n    if (!options.clientId) {\n      throw new ConfigurationError('clientId is required', 'keycloak');\n    }\n\n    this.options = {\n      usePKCE: true,\n      verifySsl: true,\n      scopes: ['openid', 'profile', 'email'],\n      timeout: 30000,\n      maxRetries: 3,\n      ...options,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // INTERNAL HELPERS\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Get the base URL for the realm.\n   */\n  private getRealmUrl(): string {\n    return `${this.options.serverUrl}/realms/${this.options.realm}`;\n  }\n\n  /**\n   * Get the admin API base URL.\n   */\n  private getAdminUrl(): string {\n    return `${this.options.serverUrl}/admin/realms/${this.options.realm}`;\n  }\n\n  /**\n   * Make an HTTP request with error handling.\n   */\n  private async request<T>(\n    url: string,\n    options: RequestInit = {},\n    adminToken?: string,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...this.options.headers,\n      ...(options.headers as Record<string, string>),\n    };\n\n    if (adminToken) {\n      headers['Authorization'] = `Bearer ${adminToken}`;\n    }\n\n    try {\n      const response = await fetch(url, {\n        ...options,\n        headers,\n        signal: AbortSignal.timeout(this.options.timeout || 30000),\n      });\n\n      if (!response.ok) {\n        const errorBody = await response.text().catch(() => '');\n        let errorData: Record<string, unknown> = {};\n        try {\n          errorData = JSON.parse(errorBody);\n        } catch {\n          // Not JSON\n        }\n\n        this.handleHttpError(response.status, errorData, errorBody);\n      }\n\n      const text = await response.text();\n      if (!text) return {} as T;\n      return JSON.parse(text) as T;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'TimeoutError') {\n        throw new NetworkError('Request timed out', 'keycloak', error);\n      }\n      if (\n        error instanceof InvalidCredentialsError ||\n        error instanceof AccessDeniedError ||\n        error instanceof InvalidGrantError ||\n        error instanceof InvalidClientError ||\n        error instanceof UserNotFoundError ||\n        error instanceof ProviderError\n      ) {\n        throw error;\n      }\n      throw new NetworkError(\n        `Network error: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'keycloak',\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Handle HTTP error responses.\n   */\n  private handleHttpError(\n    status: number,\n    data: Record<string, unknown>,\n    rawBody: string,\n  ): never {\n    const error = data.error as string | undefined;\n    const errorDescription =\n      data.errorMessage || data.error_description || rawBody;\n\n    switch (status) {\n      case 400:\n        if (error === 'invalid_grant') {\n          throw new InvalidGrantError(errorDescription as string, 'keycloak');\n        }\n        if (error === 'invalid_client') {\n          throw new InvalidClientError('keycloak');\n        }\n        throw new ProviderError(`Bad request: ${errorDescription}`, 'keycloak');\n\n      case 401:\n        throw new InvalidCredentialsError('keycloak');\n\n      case 403:\n        throw new AccessDeniedError(errorDescription as string, 'keycloak');\n\n      case 404:\n        throw new UserNotFoundError(undefined, 'keycloak');\n\n      case 409:\n        throw new UserAlreadyExistsError(undefined, 'keycloak');\n\n      default:\n        throw new ProviderError(\n          `Keycloak error (${status}): ${errorDescription}`,\n          'keycloak',\n        );\n    }\n  }\n\n  /**\n   * Fetch and cache the OIDC discovery document.\n   */\n  private async fetchDiscoveryDocument(): Promise<OIDCDiscoveryDocument> {\n    if (this.discoveryDocument) {\n      return this.discoveryDocument;\n    }\n\n    const url = `${this.getRealmUrl()}/.well-known/openid-configuration`;\n    this.discoveryDocument = await this.request<OIDCDiscoveryDocument>(url);\n    return this.discoveryDocument;\n  }\n\n  /**\n   * Get JWKS for token validation.\n   */\n  private async getJWKS(): Promise<jose.JWTVerifyGetKey> {\n    if (this.jwks) {\n      return this.jwks;\n    }\n\n    const discovery = await this.fetchDiscoveryDocument();\n    this.jwks = jose.createRemoteJWKSet(new URL(discovery.jwks_uri));\n    return this.jwks;\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHENTICATION FLOWS\n  // ---------------------------------------------------------------------------\n\n  async getAuthorizationUrl(\n    options?: AuthorizationOptions,\n  ): Promise<AuthorizationResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const state = options?.state || generateRandomString();\n    const nonce = options?.nonce || generateRandomString();\n    const scopes = options?.scopes ||\n      this.options.scopes || ['openid', 'profile', 'email'];\n    const redirectUri = options?.redirectUri || this.options.redirectUri;\n\n    if (!redirectUri) {\n      throw new ConfigurationError('redirectUri is required', 'keycloak');\n    }\n\n    const params = new URLSearchParams({\n      client_id: this.options.clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      scope: scopes.join(' '),\n      state,\n      nonce,\n    });\n\n    if (options?.prompt) {\n      params.set('prompt', options.prompt);\n    }\n\n    if (options?.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n\n    // Add extra params\n    if (options?.extraParams) {\n      for (const [key, value] of Object.entries(options.extraParams)) {\n        params.set(key, value);\n      }\n    }\n\n    let codeVerifier: string | undefined;\n    if (this.options.usePKCE) {\n      const pkce = await generatePKCE();\n      codeVerifier = pkce.verifier;\n      params.set('code_challenge', pkce.challenge);\n      params.set('code_challenge_method', 'S256');\n    }\n\n    const url = `${discovery.authorization_endpoint}?${params.toString()}`;\n\n    return {\n      url,\n      state,\n      nonce,\n      codeVerifier,\n    };\n  }\n\n  async exchangeCode(params: CodeExchangeParams): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const redirectUri = params.redirectUri || this.options.redirectUri;\n    if (!redirectUri) {\n      throw new ConfigurationError('redirectUri is required', 'keycloak');\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      client_id: this.options.clientId,\n      code: params.code,\n      redirect_uri: redirectUri,\n    });\n\n    if (this.options.clientSecret) {\n      body.set('client_secret', this.options.clientSecret);\n    }\n\n    if (params.codeVerifier) {\n      body.set('code_verifier', params.codeVerifier);\n    }\n\n    const response = await this.request<{\n      access_token: string;\n      refresh_token?: string;\n      id_token?: string;\n      expires_in: number;\n      token_type: string;\n      scope?: string;\n    }>(discovery.token_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    // Decode ID token to get user ID\n    let userId = '';\n    if (response.id_token) {\n      const payload = jose.decodeJwt(response.id_token);\n      userId = payload.sub || '';\n    }\n\n    return {\n      accessToken: response.access_token,\n      tokenType: response.token_type || 'Bearer',\n      expiresIn: response.expires_in,\n      refreshToken: response.refresh_token,\n      idToken: response.id_token,\n      scope: response.scope,\n      userId,\n    };\n  }\n\n  async authenticate(credentials: AuthCredentials): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n    const grantType = credentials.grantType || 'password';\n\n    const scopes = credentials.scopes ||\n      this.options.scopes || ['openid', 'profile', 'email'];\n    const body = new URLSearchParams({\n      grant_type: grantType,\n      client_id: this.options.clientId,\n      scope: scopes.join(' '),\n    });\n\n    if (grantType === 'client_credentials') {\n      // Client credentials grant - requires client secret\n      if (!this.options.clientSecret) {\n        throw new InvalidCredentialsError('keycloak', {\n          reason: 'Client secret is required for client_credentials grant',\n        });\n      }\n      body.set('client_secret', this.options.clientSecret);\n    } else {\n      // Password grant - requires username and password\n      if (!credentials.username || !credentials.password) {\n        throw new InvalidCredentialsError('keycloak', {\n          reason: 'Username and password are required',\n        });\n      }\n      body.set('username', credentials.username);\n      body.set('password', credentials.password);\n\n      if (this.options.clientSecret) {\n        body.set('client_secret', this.options.clientSecret);\n      }\n\n      // Add MFA code if provided\n      if (credentials.mfaCode) {\n        body.set('totp', credentials.mfaCode);\n      }\n    }\n\n    try {\n      const response = await this.request<{\n        access_token: string;\n        refresh_token?: string;\n        id_token?: string;\n        expires_in: number;\n        token_type: string;\n        scope?: string;\n      }>(discovery.token_endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: body.toString(),\n      });\n\n      // Decode ID token to get user ID\n      let userId = '';\n      if (response.id_token) {\n        const payload = jose.decodeJwt(response.id_token);\n        userId = payload.sub || '';\n      } else if (response.access_token) {\n        const payload = jose.decodeJwt(response.access_token);\n        userId = payload.sub || '';\n      }\n\n      return {\n        accessToken: response.access_token,\n        tokenType: response.token_type || 'Bearer',\n        expiresIn: response.expires_in,\n        refreshToken: response.refresh_token,\n        idToken: response.id_token,\n        scope: response.scope,\n        userId,\n      };\n    } catch (error) {\n      // Check for MFA required\n      if (\n        error instanceof ProviderError &&\n        error.message.includes('invalid_grant') &&\n        error.message.includes('totp')\n      ) {\n        throw new MfaRequiredError('keycloak', ['totp']);\n      }\n      throw error;\n    }\n  }\n\n  async refresh(refreshToken: string): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.options.clientId,\n      refresh_token: refreshToken,\n    });\n\n    if (this.options.clientSecret) {\n      body.set('client_secret', this.options.clientSecret);\n    }\n\n    const response = await this.request<{\n      access_token: string;\n      refresh_token?: string;\n      id_token?: string;\n      expires_in: number;\n      token_type: string;\n      scope?: string;\n    }>(discovery.token_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    // Decode to get user ID\n    let userId = '';\n    if (response.access_token) {\n      const payload = jose.decodeJwt(response.access_token);\n      userId = payload.sub || '';\n    }\n\n    return {\n      accessToken: response.access_token,\n      tokenType: response.token_type || 'Bearer',\n      expiresIn: response.expires_in,\n      refreshToken: response.refresh_token || refreshToken,\n      idToken: response.id_token,\n      scope: response.scope,\n      userId,\n    };\n  }\n\n  async logout(options?: LogoutOptions): Promise<void> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    if (!discovery.end_session_endpoint) {\n      // Just revoke the token if no end_session_endpoint\n      if (options?.refreshToken && discovery.revocation_endpoint) {\n        await this.request(discovery.revocation_endpoint, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n          body: new URLSearchParams({\n            client_id: this.options.clientId,\n            token: options.refreshToken,\n            token_type_hint: 'refresh_token',\n          }).toString(),\n        });\n      }\n      return;\n    }\n\n    const params = new URLSearchParams({\n      client_id: this.options.clientId,\n    });\n\n    if (options?.token) {\n      params.set('id_token_hint', options.token);\n    }\n\n    if (options?.postLogoutRedirectUri) {\n      params.set('post_logout_redirect_uri', options.postLogoutRedirectUri);\n    }\n\n    // For logout, we typically redirect the user, but for server-side we can POST\n    if (options?.refreshToken && discovery.revocation_endpoint) {\n      const revokeParams = new URLSearchParams({\n        client_id: this.options.clientId,\n        token: options.refreshToken,\n        token_type_hint: 'refresh_token',\n      });\n      if (this.options.clientSecret) {\n        revokeParams.set('client_secret', this.options.clientSecret);\n      }\n      await this.request(discovery.revocation_endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: revokeParams.toString(),\n      });\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // TOKEN OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async validateToken(\n    token: string,\n    options?: TokenValidationOptions,\n  ): Promise<TokenClaims | null> {\n    try {\n      const jwks = await this.getJWKS();\n      const discovery = await this.fetchDiscoveryDocument();\n\n      const verifyOptions: jose.JWTVerifyOptions = {\n        issuer: options?.issuer || discovery.issuer,\n        clockTolerance: options?.clockTolerance || 0,\n      };\n\n      if (options?.audience) {\n        verifyOptions.audience = options.audience;\n      }\n\n      const { payload } = await jose.jwtVerify(token, jwks, verifyOptions);\n\n      // Check nonce if provided\n      if (options?.nonce && payload.nonce !== options.nonce) {\n        throw new InvalidNonceError('keycloak');\n      }\n\n      // Extract roles from Keycloak token structure\n      const roles: string[] = [];\n\n      // Realm roles\n      if (payload.realm_access && typeof payload.realm_access === 'object') {\n        const realmAccess = payload.realm_access as { roles?: string[] };\n        if (realmAccess.roles) {\n          roles.push(...realmAccess.roles);\n        }\n      }\n\n      // Client roles\n      if (\n        payload.resource_access &&\n        typeof payload.resource_access === 'object'\n      ) {\n        const resourceAccess = payload.resource_access as Record<\n          string,\n          { roles?: string[] }\n        >;\n        for (const client of Object.values(resourceAccess)) {\n          if (client.roles) {\n            roles.push(...client.roles);\n          }\n        }\n      }\n\n      return {\n        sub: payload.sub || '',\n        iss: payload.iss || '',\n        aud: payload.aud || '',\n        exp: payload.exp || 0,\n        iat: payload.iat || 0,\n        nbf: payload.nbf,\n        azp: payload.azp as string | undefined,\n        email: payload.email as string | undefined,\n        email_verified: payload.email_verified as boolean | undefined,\n        preferred_username: payload.preferred_username as string | undefined,\n        name: payload.name as string | undefined,\n        roles,\n        ...payload,\n      };\n    } catch (error) {\n      if (error instanceof jose.errors.JWTExpired) {\n        throw new TokenExpiredError('keycloak');\n      }\n      if (error instanceof jose.errors.JWTClaimValidationFailed) {\n        return null;\n      }\n      if (error instanceof jose.errors.JWSSignatureVerificationFailed) {\n        throw new InvalidTokenError('Invalid token signature', 'keycloak');\n      }\n      if (error instanceof InvalidNonceError) {\n        throw error;\n      }\n      return null;\n    }\n  }\n\n  decodeToken(token: string): TokenPayload {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        throw new InvalidTokenError('Invalid JWT format', 'keycloak');\n      }\n\n      const header = JSON.parse(atob(parts[0]));\n      const payload = jose.decodeJwt(token);\n\n      return {\n        header: {\n          alg: header.alg,\n          typ: header.typ,\n          kid: header.kid,\n        },\n        payload: payload as unknown as TokenClaims,\n        signature: parts[2],\n      };\n    } catch {\n      throw new InvalidTokenError('Failed to decode token', 'keycloak');\n    }\n  }\n\n  async introspectToken(token: string): Promise<TokenIntrospection> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    if (!discovery.introspection_endpoint) {\n      // Fallback to local validation\n      const claims = await this.validateToken(token);\n      return {\n        active: claims !== null,\n        claims: claims || undefined,\n      };\n    }\n\n    const body = new URLSearchParams({\n      client_id: this.options.clientId,\n      token,\n    });\n\n    if (this.options.clientSecret) {\n      body.set('client_secret', this.options.clientSecret);\n    }\n\n    const response = await this.request<{\n      active: boolean;\n      sub?: string;\n      iss?: string;\n      aud?: string | string[];\n      exp?: number;\n      iat?: number;\n      client_id?: string;\n      scope?: string;\n      token_type?: string;\n      [key: string]: unknown;\n    }>(discovery.introspection_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    if (!response.active) {\n      return { active: false };\n    }\n\n    return {\n      active: true,\n      claims: {\n        sub: response.sub || '',\n        iss: response.iss || '',\n        aud: response.aud || '',\n        exp: response.exp || 0,\n        iat: response.iat || 0,\n        ...response,\n      },\n      tokenType: response.token_type,\n      clientId: response.client_id,\n      scope: response.scope,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // USER OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async getProfile(tokenOrSession: string): Promise<UserProfile> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const response = await this.request<{\n      sub: string;\n      preferred_username?: string;\n      email?: string;\n      email_verified?: boolean;\n      name?: string;\n      given_name?: string;\n      family_name?: string;\n      picture?: string;\n      [key: string]: unknown;\n    }>(discovery.userinfo_endpoint, {\n      method: 'GET',\n      headers: { Authorization: `Bearer ${tokenOrSession}` },\n    });\n\n    return {\n      id: response.sub,\n      username: response.preferred_username,\n      email: response.email,\n      emailVerified: response.email_verified,\n      firstName: response.given_name,\n      lastName: response.family_name,\n      displayName: response.name,\n      picture: response.picture,\n    };\n  }\n\n  async updateProfile(\n    tokenOrSession: string,\n    profile: Partial<UserProfile>,\n  ): Promise<UserProfile> {\n    // Get user ID from token\n    const payload = jose.decodeJwt(tokenOrSession);\n    const userId = payload.sub;\n\n    if (!userId) {\n      throw new InvalidTokenError('Token does not contain user ID', 'keycloak');\n    }\n\n    // Update via Account API (requires account-api feature in Keycloak)\n    const accountUrl = `${this.getRealmUrl()}/account`;\n\n    const updateData: Record<string, unknown> = {};\n    if (profile.firstName !== undefined)\n      updateData.firstName = profile.firstName;\n    if (profile.lastName !== undefined) updateData.lastName = profile.lastName;\n    if (profile.email !== undefined) updateData.email = profile.email;\n\n    await this.request(accountUrl, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${tokenOrSession}` },\n      body: JSON.stringify(updateData),\n    });\n\n    return this.getProfile(tokenOrSession);\n  }\n\n  async getUser(userId: string, adminToken?: string): Promise<UserProfile> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    const response = await this.request<KeycloakUser>(\n      `${this.getAdminUrl()}/users/${userId}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    return this.mapKeycloakUser(response);\n  }\n\n  async createUser(\n    user: CreateUserRequest,\n    adminToken: string,\n  ): Promise<UserProfile> {\n    const keycloakUser: Partial<KeycloakUser> = {\n      username: user.username,\n      email: user.email,\n      firstName: user.firstName,\n      lastName: user.lastName,\n      enabled: user.enabled ?? true,\n      emailVerified: user.emailVerified ?? false,\n      attributes: user.attributes as Record<string, string[]>,\n    };\n\n    if (user.password) {\n      keycloakUser.credentials = [\n        {\n          type: 'password',\n          value: user.password,\n          temporary: false,\n        },\n      ];\n    }\n\n    const response = await fetch(`${this.getAdminUrl()}/users`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${adminToken}`,\n      },\n      body: JSON.stringify(keycloakUser),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      if (response.status === 409) {\n        throw new UserAlreadyExistsError(user.username, 'keycloak');\n      }\n      throw new ProviderError(\n        `Failed to create user: ${errorBody}`,\n        'keycloak',\n      );\n    }\n\n    // Get the created user ID from Location header\n    const location = response.headers.get('Location');\n    if (!location) {\n      throw new ProviderError('Failed to get created user ID', 'keycloak');\n    }\n\n    const userId = location.split('/').pop()!;\n\n    // Assign roles if provided\n    if (user.roles?.length) {\n      await this.assignRoles(userId, user.roles, adminToken);\n    }\n\n    // Assign groups if provided\n    if (user.groups?.length) {\n      for (const groupName of user.groups) {\n        await this.addUserToGroup(userId, groupName, adminToken);\n      }\n    }\n\n    return this.getUser(userId, adminToken);\n  }\n\n  async updateUser(\n    userId: string,\n    updates: Partial<CreateUserRequest>,\n    adminToken: string,\n  ): Promise<UserProfile> {\n    const keycloakUser: Partial<KeycloakUser> = {};\n\n    if (updates.username !== undefined)\n      keycloakUser.username = updates.username;\n    if (updates.email !== undefined) keycloakUser.email = updates.email;\n    if (updates.firstName !== undefined)\n      keycloakUser.firstName = updates.firstName;\n    if (updates.lastName !== undefined)\n      keycloakUser.lastName = updates.lastName;\n    if (updates.enabled !== undefined) keycloakUser.enabled = updates.enabled;\n    if (updates.emailVerified !== undefined)\n      keycloakUser.emailVerified = updates.emailVerified;\n    if (updates.attributes !== undefined) {\n      keycloakUser.attributes = updates.attributes as Record<string, string[]>;\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}`,\n      {\n        method: 'PUT',\n        body: JSON.stringify(keycloakUser),\n      },\n      adminToken,\n    );\n\n    // Update password if provided\n    if (updates.password) {\n      await this.request(\n        `${this.getAdminUrl()}/users/${userId}/reset-password`,\n        {\n          method: 'PUT',\n          body: JSON.stringify({\n            type: 'password',\n            value: updates.password,\n            temporary: false,\n          }),\n        },\n        adminToken,\n      );\n    }\n\n    return this.getUser(userId, adminToken);\n  }\n\n  async deleteUser(userId: string, adminToken: string): Promise<void> {\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}`,\n      { method: 'DELETE' },\n      adminToken,\n    );\n  }\n\n  async listUsers(\n    query: UserQuery,\n    adminToken?: string,\n  ): Promise<UserListResult> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    const params = new URLSearchParams();\n\n    if (query.search) params.set('search', query.search);\n    if (query.email) params.set('email', query.email);\n    if (query.username) params.set('username', query.username);\n    if (query.enabled !== undefined)\n      params.set('enabled', String(query.enabled));\n    if (query.limit) params.set('max', String(query.limit));\n    if (query.offset) params.set('first', String(query.offset));\n\n    const users = await this.request<KeycloakUser[]>(\n      `${this.getAdminUrl()}/users?${params.toString()}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    // Get total count\n    const countResponse = await this.request<number>(\n      `${this.getAdminUrl()}/users/count?${params.toString()}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    return {\n      users: users.map((u) => this.mapKeycloakUser(u)),\n      total: countResponse,\n      limit: query.limit || 100,\n      offset: query.offset || 0,\n    };\n  }\n\n  async requestPasswordReset(email: string): Promise<void> {\n    // This requires admin privileges or self-service password reset configured\n    // We'll use the execute-actions-email endpoint\n    throw new NotImplementedError('requestPasswordReset', 'keycloak', {\n      reason:\n        'Requires admin token or use Keycloak login page for self-service reset',\n    });\n  }\n\n  async resetPassword(token: string, newPassword: string): Promise<void> {\n    // Password reset via token is handled by Keycloak's login flow\n    throw new NotImplementedError('resetPassword', 'keycloak', {\n      reason: 'Password reset is handled by Keycloak login flow',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // SESSION OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async listSessions(userId: string, adminToken?: string): Promise<Session[]> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    const sessions = await this.request<KeycloakSession[]>(\n      `${this.getAdminUrl()}/users/${userId}/sessions`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    return sessions.map((s) => ({\n      id: s.id,\n      userId: s.userId,\n      clientId: s.clients ? Object.keys(s.clients).join(', ') : undefined,\n      startedAt: new Date(s.start),\n      lastAccessedAt: new Date(s.lastAccess),\n      ipAddress: s.ipAddress,\n      userAgent: s.userAgent,\n    }));\n  }\n\n  async revokeSession(sessionId: string, adminToken?: string): Promise<void> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/sessions/${sessionId}`,\n      { method: 'DELETE' },\n      adminToken,\n    );\n  }\n\n  async revokeAllSessions(userId: string, adminToken?: string): Promise<void> {\n    if (!adminToken) {\n      throw new AccessDeniedError('Admin token required', 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/logout`,\n      { method: 'POST' },\n      adminToken,\n    );\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHORIZATION\n  // ---------------------------------------------------------------------------\n\n  async hasRole(tokenOrUserId: string, role: string): Promise<boolean> {\n    const roles = await this.getRoles(tokenOrUserId);\n    return roles.includes(role);\n  }\n\n  async hasPermission(\n    tokenOrUserId: string,\n    permission: string,\n    resource?: string,\n  ): Promise<boolean> {\n    // Keycloak permissions are typically checked via the Authorization Services API\n    // For now, we check if the user has a role matching the permission\n    // A full implementation would use the entitlement API\n    const roles = await this.getRoles(tokenOrUserId);\n    const permissionRole = resource ? `${resource}:${permission}` : permission;\n    return roles.includes(permissionRole) || roles.includes(permission);\n  }\n\n  async getRoles(\n    tokenOrUserId: string,\n    adminToken?: string,\n  ): Promise<string[]> {\n    // First try to decode as JWT\n    try {\n      const claims = await this.validateToken(tokenOrUserId);\n      if (claims) {\n        return claims.roles || [];\n      }\n    } catch {\n      // Not a valid token, might be a user ID\n    }\n\n    // If admin token provided, try to fetch roles by user ID\n    if (adminToken) {\n      try {\n        const roleMappings = await this.request<{\n          realmMappings?: { name: string }[];\n        }>(\n          `${this.getAdminUrl()}/users/${tokenOrUserId}/role-mappings`,\n          { method: 'GET' },\n          adminToken,\n        );\n\n        return roleMappings.realmMappings?.map((r) => r.name) || [];\n      } catch {\n        // User ID not found or other error\n      }\n    }\n\n    return [];\n  }\n\n  async assignRole(\n    userId: string,\n    role: string,\n    adminToken: string,\n  ): Promise<void> {\n    // First, get the role\n    const roles = await this.request<KeycloakRole[]>(\n      `${this.getAdminUrl()}/roles`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const roleObj = roles.find((r) => r.name === role);\n    if (!roleObj) {\n      throw new ProviderError(`Role not found: ${role}`, 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/role-mappings/realm`,\n      {\n        method: 'POST',\n        body: JSON.stringify([roleObj]),\n      },\n      adminToken,\n    );\n  }\n\n  async removeRole(\n    userId: string,\n    role: string,\n    adminToken: string,\n  ): Promise<void> {\n    // First, get the role\n    const roles = await this.request<KeycloakRole[]>(\n      `${this.getAdminUrl()}/roles`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const roleObj = roles.find((r) => r.name === role);\n    if (!roleObj) {\n      throw new ProviderError(`Role not found: ${role}`, 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/role-mappings/realm`,\n      {\n        method: 'DELETE',\n        body: JSON.stringify([roleObj]),\n      },\n      adminToken,\n    );\n  }\n\n  // ---------------------------------------------------------------------------\n  // PROVIDER INFORMATION\n  // ---------------------------------------------------------------------------\n\n  async getCapabilities(): Promise<AuthCapabilities> {\n    return {\n      authorizationCode: true,\n      passwordGrant: true,\n      clientCredentials: true,\n      tokenRefresh: true,\n      oidc: true,\n      userManagement: true,\n      sessionManagement: true,\n      rbac: true,\n      passwordReset: true,\n      mfa: true,\n      socialLogin: true,\n      federation: true,\n      decentralized: false,\n    };\n  }\n\n  async getDiscoveryDocument(): Promise<OIDCDiscoveryDocument | null> {\n    return this.fetchDiscoveryDocument();\n  }\n\n  // ---------------------------------------------------------------------------\n  // PRIVATE HELPERS\n  // ---------------------------------------------------------------------------\n\n  private mapKeycloakUser(user: KeycloakUser): UserProfile {\n    return {\n      id: user.id,\n      username: user.username,\n      email: user.email,\n      emailVerified: user.emailVerified,\n      firstName: user.firstName,\n      lastName: user.lastName,\n      displayName:\n        user.firstName && user.lastName\n          ? `${user.firstName} ${user.lastName}`\n          : user.username,\n      enabled: user.enabled,\n      createdAt: user.createdTimestamp\n        ? new Date(user.createdTimestamp)\n        : undefined,\n      attributes: user.attributes,\n      groups: user.groups,\n    };\n  }\n\n  private async assignRoles(\n    userId: string,\n    roleNames: string[],\n    adminToken: string,\n  ): Promise<void> {\n    const allRoles = await this.request<KeycloakRole[]>(\n      `${this.getAdminUrl()}/roles`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const rolesToAssign = allRoles.filter((r) => roleNames.includes(r.name));\n\n    if (rolesToAssign.length > 0) {\n      await this.request(\n        `${this.getAdminUrl()}/users/${userId}/role-mappings/realm`,\n        {\n          method: 'POST',\n          body: JSON.stringify(rolesToAssign),\n        },\n        adminToken,\n      );\n    }\n  }\n\n  private async addUserToGroup(\n    userId: string,\n    groupName: string,\n    adminToken: string,\n  ): Promise<void> {\n    // Get group by name\n    const groups = await this.request<KeycloakGroup[]>(\n      `${this.getAdminUrl()}/groups?search=${encodeURIComponent(groupName)}`,\n      { method: 'GET' },\n      adminToken,\n    );\n\n    const group = groups.find((g) => g.name === groupName);\n    if (!group) {\n      throw new ProviderError(`Group not found: ${groupName}`, 'keycloak');\n    }\n\n    await this.request(\n      `${this.getAdminUrl()}/users/${userId}/groups/${group.id}`,\n      { method: 'PUT' },\n      adminToken,\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// KEYCLOAK API TYPES\n// ---------------------------------------------------------------------------\n\ninterface KeycloakUser {\n  id: string;\n  username: string;\n  email?: string;\n  emailVerified?: boolean;\n  firstName?: string;\n  lastName?: string;\n  enabled?: boolean;\n  createdTimestamp?: number;\n  attributes?: Record<string, string[]>;\n  groups?: string[];\n  credentials?: Array<{\n    type: string;\n    value: string;\n    temporary?: boolean;\n  }>;\n}\n\ninterface KeycloakSession {\n  id: string;\n  userId: string;\n  username: string;\n  start: number;\n  lastAccess: number;\n  ipAddress?: string;\n  userAgent?: string;\n  clients?: Record<string, string>;\n}\n\ninterface KeycloakRole {\n  id: string;\n  name: string;\n  description?: string;\n  composite?: boolean;\n  clientRole?: boolean;\n  containerId?: string;\n}\n\ninterface KeycloakGroup {\n  id: string;\n  name: string;\n  path?: string;\n  subGroups?: KeycloakGroup[];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyDA,SAAS,qBAAqB,SAAS,IAAY;CACjD,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,OAAO,gBAAgB,KAAK;CAC5B,OAAO,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KACrE,EACF;AACF;;;;AAKA,eAAe,eAGZ;CACD,MAAM,WAAW,qBAAqB,EAAE;CAExC,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,QAAQ;CACpC,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAKvD,OAAO;EAAE;EAAU,WAJD,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,CAAC,CACjE,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EACC;CAAU;AAC/B;;;;;;AAOA,IAAa,mBAAb,MAAuD;CACrD;CAIA,oBAA0D;CAC1D,OAA4C;CAE5C,YAAY,SAA0B;EACpC,IAAI,CAAC,QAAQ,WACX,MAAM,IAAI,mBAAmB,yBAAyB,UAAU;EAElE,IAAI,CAAC,QAAQ,OACX,MAAM,IAAI,mBAAmB,qBAAqB,UAAU;EAE9D,IAAI,CAAC,QAAQ,UACX,MAAM,IAAI,mBAAmB,wBAAwB,UAAU;EAGjE,KAAK,UAAU;GACb,SAAS;GACT,WAAW;GACX,QAAQ;IAAC;IAAU;IAAW;GAAO;GACrC,SAAS;GACT,YAAY;GACZ,GAAG;EACL;CACF;;;;CASA,cAA8B;EAC5B,OAAO,GAAG,KAAK,QAAQ,UAAU,UAAU,KAAK,QAAQ;CAC1D;;;;CAKA,cAA8B;EAC5B,OAAO,GAAG,KAAK,QAAQ,UAAU,gBAAgB,KAAK,QAAQ;CAChE;;;;CAKA,MAAc,QACZ,KACA,UAAuB,CAAC,GACxB,YACY;EACZ,MAAM,UAAkC;GACtC,gBAAgB;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAI,QAAQ;EACd;EAEA,IAAI,YACF,QAAQ,mBAAmB,UAAU;EAGvC,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,KAAK;IAChC,GAAG;IACH;IACA,QAAQ,YAAY,QAAQ,KAAK,QAAQ,WAAW,GAAK;GAC3D,CAAC;GAED,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,YAAY,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;IACtD,IAAI,YAAqC,CAAC;IAC1C,IAAI;KACF,YAAY,KAAK,MAAM,SAAS;IAClC,QAAQ,CAER;IAEA,KAAK,gBAAgB,SAAS,QAAQ,WAAW,SAAS;GAC5D;GAEA,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,MAAM,OAAO,CAAC;GACnB,OAAO,KAAK,MAAM,IAAI;EACxB,SAAS,OAAO;GACd,IAAI,iBAAiB,SAAS,MAAM,SAAS,gBAC3C,MAAM,IAAI,aAAa,qBAAqB,YAAY,KAAK;GAE/D,IACE,iBAAiB,2BACjB,iBAAiB,qBACjB,iBAAiB,qBACjB,iBAAiB,sBACjB,iBAAiB,qBACjB,iBAAiB,eAEjB,MAAM;GAER,MAAM,IAAI,aACR,kBAAkB,iBAAiB,QAAQ,MAAM,UAAU,mBAC3D,YACA,iBAAiB,QAAQ,QAAQ,KAAA,CACnC;EACF;CACF;;;;CAKA,gBACE,QACA,MACA,SACO;EACP,MAAM,QAAQ,KAAK;EACnB,MAAM,mBACJ,KAAK,gBAAgB,KAAK,qBAAqB;EAEjD,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,iBACZ,MAAM,IAAI,kBAAkB,kBAA4B,UAAU;IAEpE,IAAI,UAAU,kBACZ,MAAM,IAAI,mBAAmB,UAAU;IAEzC,MAAM,IAAI,cAAc,gBAAgB,oBAAoB,UAAU;GAExE,KAAK,KACH,MAAM,IAAI,wBAAwB,UAAU;GAE9C,KAAK,KACH,MAAM,IAAI,kBAAkB,kBAA4B,UAAU;GAEpE,KAAK,KACH,MAAM,IAAI,kBAAkB,KAAA,GAAW,UAAU;GAEnD,KAAK,KACH,MAAM,IAAI,uBAAuB,KAAA,GAAW,UAAU;GAExD,SACE,MAAM,IAAI,cACR,mBAAmB,OAAO,KAAK,oBAC/B,UACF;EACJ;CACF;;;;CAKA,MAAc,yBAAyD;EACrE,IAAI,KAAK,mBACP,OAAO,KAAK;EAGd,MAAM,MAAM,GAAG,KAAK,YAAY,EAAE;EAClC,KAAK,oBAAoB,MAAM,KAAK,QAA+B,GAAG;EACtE,OAAO,KAAK;CACd;;;;CAKA,MAAc,UAAyC;EACrD,IAAI,KAAK,MACP,OAAO,KAAK;EAGd,MAAM,YAAY,MAAM,KAAK,uBAAuB;EACpD,KAAK,OAAO,mBAAwB,IAAI,IAAI,UAAU,QAAQ,CAAC;EAC/D,OAAO,KAAK;CACd;CAMA,MAAM,oBACJ,SAC8B;EAC9B,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EACrD,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EACrD,MAAM,SAAS,SAAS,UACtB,KAAK,QAAQ,UAAU;GAAC;GAAU;GAAW;EAAO;EACtD,MAAM,cAAc,SAAS,eAAe,KAAK,QAAQ;EAEzD,IAAI,CAAC,aACH,MAAM,IAAI,mBAAmB,2BAA2B,UAAU;EAGpE,MAAM,SAAS,IAAI,gBAAgB;GACjC,WAAW,KAAK,QAAQ;GACxB,cAAc;GACd,eAAe;GACf,OAAO,OAAO,KAAK,GAAG;GACtB;GACA;EACF,CAAC;EAED,IAAI,SAAS,QACX,OAAO,IAAI,UAAU,QAAQ,MAAM;EAGrC,IAAI,SAAS,WACX,OAAO,IAAI,cAAc,QAAQ,SAAS;EAI5C,IAAI,SAAS,aACX,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,WAAW,GAC3D,OAAO,IAAI,KAAK,KAAK;EAIzB,IAAI;EACJ,IAAI,KAAK,QAAQ,SAAS;GACxB,MAAM,OAAO,MAAM,aAAa;GAChC,eAAe,KAAK;GACpB,OAAO,IAAI,kBAAkB,KAAK,SAAS;GAC3C,OAAO,IAAI,yBAAyB,MAAM;EAC5C;EAIA,OAAO;GACL,KAAA,GAHa,UAAU,uBAAuB,GAAG,OAAO,SAAS;GAIjE;GACA;GACA;EACF;CACF;CAEA,MAAM,aAAa,QAAiD;EAClE,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,cAAc,OAAO,eAAe,KAAK,QAAQ;EACvD,IAAI,CAAC,aACH,MAAM,IAAI,mBAAmB,2BAA2B,UAAU;EAGpE,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,MAAM,OAAO;GACb,cAAc;EAChB,CAAC;EAED,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EAGrD,IAAI,OAAO,cACT,KAAK,IAAI,iBAAiB,OAAO,YAAY;EAG/C,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;GAC3B,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAGD,IAAI,SAAS;EACb,IAAI,SAAS,UAEX,SADgB,UAAe,SAAS,QAC/B,CAAA,CAAQ,OAAO;EAG1B,OAAO;GACL,aAAa,SAAS;GACtB,WAAW,SAAS,cAAc;GAClC,WAAW,SAAS;GACpB,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB;EACF;CACF;CAEA,MAAM,aAAa,aAAmD;EACpE,MAAM,YAAY,MAAM,KAAK,uBAAuB;EACpD,MAAM,YAAY,YAAY,aAAa;EAE3C,MAAM,SAAS,YAAY,UACzB,KAAK,QAAQ,UAAU;GAAC;GAAU;GAAW;EAAO;EACtD,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,OAAO,OAAO,KAAK,GAAG;EACxB,CAAC;EAED,IAAI,cAAc,sBAAsB;GAEtC,IAAI,CAAC,KAAK,QAAQ,cAChB,MAAM,IAAI,wBAAwB,YAAY,EAC5C,QAAQ,yDACV,CAAC;GAEH,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EACrD,OAAO;GAEL,IAAI,CAAC,YAAY,YAAY,CAAC,YAAY,UACxC,MAAM,IAAI,wBAAwB,YAAY,EAC5C,QAAQ,qCACV,CAAC;GAEH,KAAK,IAAI,YAAY,YAAY,QAAQ;GACzC,KAAK,IAAI,YAAY,YAAY,QAAQ;GAEzC,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;GAIrD,IAAI,YAAY,SACd,KAAK,IAAI,QAAQ,YAAY,OAAO;EAExC;EAEA,IAAI;GACF,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;IAC3B,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,KAAK,SAAS;GACtB,CAAC;GAGD,IAAI,SAAS;GACb,IAAI,SAAS,UAEX,SADgB,UAAe,SAAS,QAC/B,CAAA,CAAQ,OAAO;QACnB,IAAI,SAAS,cAElB,SADgB,UAAe,SAAS,YAC/B,CAAA,CAAQ,OAAO;GAG1B,OAAO;IACL,aAAa,SAAS;IACtB,WAAW,SAAS,cAAc;IAClC,WAAW,SAAS;IACpB,cAAc,SAAS;IACvB,SAAS,SAAS;IAClB,OAAO,SAAS;IAChB;GACF;EACF,SAAS,OAAO;GAEd,IACE,iBAAiB,iBACjB,MAAM,QAAQ,SAAS,eAAe,KACtC,MAAM,QAAQ,SAAS,MAAM,GAE7B,MAAM,IAAI,iBAAiB,YAAY,CAAC,MAAM,CAAC;GAEjD,MAAM;EACR;CACF;CAEA,MAAM,QAAQ,cAA2C;EACvD,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,eAAe;EACjB,CAAC;EAED,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EAGrD,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;GAC3B,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAGD,IAAI,SAAS;EACb,IAAI,SAAS,cAEX,SADgB,UAAe,SAAS,YAC/B,CAAA,CAAQ,OAAO;EAG1B,OAAO;GACL,aAAa,SAAS;GACtB,WAAW,SAAS,cAAc;GAClC,WAAW,SAAS;GACpB,cAAc,SAAS,iBAAiB;GACxC,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB;EACF;CACF;CAEA,MAAM,OAAO,SAAwC;EACnD,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,IAAI,CAAC,UAAU,sBAAsB;GAEnC,IAAI,SAAS,gBAAgB,UAAU,qBACrC,MAAM,KAAK,QAAQ,UAAU,qBAAqB;IAChD,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB,WAAW,KAAK,QAAQ;KACxB,OAAO,QAAQ;KACf,iBAAiB;IACnB,CAAC,CAAC,CAAC,SAAS;GACd,CAAC;GAEH;EACF;EAEA,MAAM,SAAS,IAAI,gBAAgB,EACjC,WAAW,KAAK,QAAQ,SAC1B,CAAC;EAED,IAAI,SAAS,OACX,OAAO,IAAI,iBAAiB,QAAQ,KAAK;EAG3C,IAAI,SAAS,uBACX,OAAO,IAAI,4BAA4B,QAAQ,qBAAqB;EAItE,IAAI,SAAS,gBAAgB,UAAU,qBAAqB;GAC1D,MAAM,eAAe,IAAI,gBAAgB;IACvC,WAAW,KAAK,QAAQ;IACxB,OAAO,QAAQ;IACf,iBAAiB;GACnB,CAAC;GACD,IAAI,KAAK,QAAQ,cACf,aAAa,IAAI,iBAAiB,KAAK,QAAQ,YAAY;GAE7D,MAAM,KAAK,QAAQ,UAAU,qBAAqB;IAChD,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,aAAa,SAAS;GAC9B,CAAC;EACH;CACF;CAMA,MAAM,cACJ,OACA,SAC6B;EAC7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,QAAQ;GAChC,MAAM,YAAY,MAAM,KAAK,uBAAuB;GAEpD,MAAM,gBAAuC;IAC3C,QAAQ,SAAS,UAAU,UAAU;IACrC,gBAAgB,SAAS,kBAAkB;GAC7C;GAEA,IAAI,SAAS,UACX,cAAc,WAAW,QAAQ;GAGnC,MAAM,EAAE,YAAY,MAAM,UAAe,OAAO,MAAM,aAAa;GAGnE,IAAI,SAAS,SAAS,QAAQ,UAAU,QAAQ,OAC9C,MAAM,IAAI,kBAAkB,UAAU;GAIxC,MAAM,QAAkB,CAAC;GAGzB,IAAI,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB,UAAU;IACpE,MAAM,cAAc,QAAQ;IAC5B,IAAI,YAAY,OACd,MAAM,KAAK,GAAG,YAAY,KAAK;GAEnC;GAGA,IACE,QAAQ,mBACR,OAAO,QAAQ,oBAAoB,UACnC;IACA,MAAM,iBAAiB,QAAQ;IAI/B,KAAK,MAAM,UAAU,OAAO,OAAO,cAAc,GAC/C,IAAI,OAAO,OACT,MAAM,KAAK,GAAG,OAAO,KAAK;GAGhC;GAEA,OAAO;IACL,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ;IACb,KAAK,QAAQ;IACb,OAAO,QAAQ;IACf,gBAAgB,QAAQ;IACxB,oBAAoB,QAAQ;IAC5B,MAAM,QAAQ;IACd;IACA,GAAG;GACL;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,YACnB,MAAM,IAAI,kBAAkB,UAAU;GAExC,IAAI,iBAAiB,0BACnB,OAAO;GAET,IAAI,iBAAiB,gCACnB,MAAM,IAAI,kBAAkB,2BAA2B,UAAU;GAEnE,IAAI,iBAAiB,mBACnB,MAAM;GAER,OAAO;EACT;CACF;CAEA,YAAY,OAA6B;EACvC,IAAI;GACF,MAAM,QAAQ,MAAM,MAAM,GAAG;GAC7B,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,kBAAkB,sBAAsB,UAAU;GAG9D,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;GACxC,MAAM,UAAU,UAAe,KAAK;GAEpC,OAAO;IACL,QAAQ;KACN,KAAK,OAAO;KACZ,KAAK,OAAO;KACZ,KAAK,OAAO;IACd;IACS;IACT,WAAW,MAAM;GACnB;EACF,QAAQ;GACN,MAAM,IAAI,kBAAkB,0BAA0B,UAAU;EAClE;CACF;CAEA,MAAM,gBAAgB,OAA4C;EAChE,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,IAAI,CAAC,UAAU,wBAAwB;GAErC,MAAM,SAAS,MAAM,KAAK,cAAc,KAAK;GAC7C,OAAO;IACL,QAAQ,WAAW;IACnB,QAAQ,UAAU,KAAA;GACpB;EACF;EAEA,MAAM,OAAO,IAAI,gBAAgB;GAC/B,WAAW,KAAK,QAAQ;GACxB;EACF,CAAC;EAED,IAAI,KAAK,QAAQ,cACf,KAAK,IAAI,iBAAiB,KAAK,QAAQ,YAAY;EAGrD,MAAM,WAAW,MAAM,KAAK,QAWzB,UAAU,wBAAwB;GACnC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,CAAC,SAAS,QACZ,OAAO,EAAE,QAAQ,MAAM;EAGzB,OAAO;GACL,QAAQ;GACR,QAAQ;IACN,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,KAAK,SAAS,OAAO;IACrB,GAAG;GACL;GACA,WAAW,SAAS;GACpB,UAAU,SAAS;GACnB,OAAO,SAAS;EAClB;CACF;CAMA,MAAM,WAAW,gBAA8C;EAC7D,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,WAAW,MAAM,KAAK,QAUzB,UAAU,mBAAmB;GAC9B,QAAQ;GACR,SAAS,EAAE,eAAe,UAAU,iBAAiB;EACvD,CAAC;EAED,OAAO;GACL,IAAI,SAAS;GACb,UAAU,SAAS;GACnB,OAAO,SAAS;GAChB,eAAe,SAAS;GACxB,WAAW,SAAS;GACpB,UAAU,SAAS;GACnB,aAAa,SAAS;GACtB,SAAS,SAAS;EACpB;CACF;CAEA,MAAM,cACJ,gBACA,SACsB;EAKtB,IAAI,CAHY,UAAe,cAChB,CAAA,CAAQ,KAGrB,MAAM,IAAI,kBAAkB,kCAAkC,UAAU;EAI1E,MAAM,aAAa,GAAG,KAAK,YAAY,EAAE;EAEzC,MAAM,aAAsC,CAAC;EAC7C,IAAI,QAAQ,cAAc,KAAA,GACxB,WAAW,YAAY,QAAQ;EACjC,IAAI,QAAQ,aAAa,KAAA,GAAW,WAAW,WAAW,QAAQ;EAClE,IAAI,QAAQ,UAAU,KAAA,GAAW,WAAW,QAAQ,QAAQ;EAE5D,MAAM,KAAK,QAAQ,YAAY;GAC7B,QAAQ;GACR,SAAS,EAAE,eAAe,UAAU,iBAAiB;GACrD,MAAM,KAAK,UAAU,UAAU;EACjC,CAAC;EAED,OAAO,KAAK,WAAW,cAAc;CACvC;CAEA,MAAM,QAAQ,QAAgB,YAA2C;EACvE,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,WAAW,MAAM,KAAK,QAC1B,GAAG,KAAK,YAAY,EAAE,SAAS,UAC/B,EAAE,QAAQ,MAAM,GAChB,UACF;EAEA,OAAO,KAAK,gBAAgB,QAAQ;CACtC;CAEA,MAAM,WACJ,MACA,YACsB;EACtB,MAAM,eAAsC;GAC1C,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,WAAW,KAAK;GAChB,UAAU,KAAK;GACf,SAAS,KAAK,WAAW;GACzB,eAAe,KAAK,iBAAiB;GACrC,YAAY,KAAK;EACnB;EAEA,IAAI,KAAK,UACP,aAAa,cAAc,CACzB;GACE,MAAM;GACN,OAAO,KAAK;GACZ,WAAW;EACb,CACF;EAGF,MAAM,WAAW,MAAM,MAAM,GAAG,KAAK,YAAY,EAAE,SAAS;GAC1D,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,YAAY;EACnC,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,KAAK;GACtC,IAAI,SAAS,WAAW,KACtB,MAAM,IAAI,uBAAuB,KAAK,UAAU,UAAU;GAE5D,MAAM,IAAI,cACR,0BAA0B,aAC1B,UACF;EACF;EAGA,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;EAChD,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,iCAAiC,UAAU;EAGrE,MAAM,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI;EAGvC,IAAI,KAAK,OAAO,QACd,MAAM,KAAK,YAAY,QAAQ,KAAK,OAAO,UAAU;EAIvD,IAAI,KAAK,QAAQ,QACf,KAAK,MAAM,aAAa,KAAK,QAC3B,MAAM,KAAK,eAAe,QAAQ,WAAW,UAAU;EAI3D,OAAO,KAAK,QAAQ,QAAQ,UAAU;CACxC;CAEA,MAAM,WACJ,QACA,SACA,YACsB;EACtB,MAAM,eAAsC,CAAC;EAE7C,IAAI,QAAQ,aAAa,KAAA,GACvB,aAAa,WAAW,QAAQ;EAClC,IAAI,QAAQ,UAAU,KAAA,GAAW,aAAa,QAAQ,QAAQ;EAC9D,IAAI,QAAQ,cAAc,KAAA,GACxB,aAAa,YAAY,QAAQ;EACnC,IAAI,QAAQ,aAAa,KAAA,GACvB,aAAa,WAAW,QAAQ;EAClC,IAAI,QAAQ,YAAY,KAAA,GAAW,aAAa,UAAU,QAAQ;EAClE,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,aAAa,gBAAgB,QAAQ;EACvC,IAAI,QAAQ,eAAe,KAAA,GACzB,aAAa,aAAa,QAAQ;EAGpC,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,UAC/B;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,YAAY;EACnC,GACA,UACF;EAGA,IAAI,QAAQ,UACV,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,kBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,OAAO,QAAQ;IACf,WAAW;GACb,CAAC;EACH,GACA,UACF;EAGF,OAAO,KAAK,QAAQ,QAAQ,UAAU;CACxC;CAEA,MAAM,WAAW,QAAgB,YAAmC;EAClE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,UAC/B,EAAE,QAAQ,SAAS,GACnB,UACF;CACF;CAEA,MAAM,UACJ,OACA,YACyB;EACzB,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,SAAS,IAAI,gBAAgB;EAEnC,IAAI,MAAM,QAAQ,OAAO,IAAI,UAAU,MAAM,MAAM;EACnD,IAAI,MAAM,OAAO,OAAO,IAAI,SAAS,MAAM,KAAK;EAChD,IAAI,MAAM,UAAU,OAAO,IAAI,YAAY,MAAM,QAAQ;EACzD,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,IAAI,WAAW,OAAO,MAAM,OAAO,CAAC;EAC7C,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC;EACtD,IAAI,MAAM,QAAQ,OAAO,IAAI,SAAS,OAAO,MAAM,MAAM,CAAC;EAE1D,MAAM,QAAQ,MAAM,KAAK,QACvB,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,SAAS,KAC/C,EAAE,QAAQ,MAAM,GAChB,UACF;EAGA,MAAM,gBAAgB,MAAM,KAAK,QAC/B,GAAG,KAAK,YAAY,EAAE,eAAe,OAAO,SAAS,KACrD,EAAE,QAAQ,MAAM,GAChB,UACF;EAEA,OAAO;GACL,OAAO,MAAM,KAAK,MAAM,KAAK,gBAAgB,CAAC,CAAC;GAC/C,OAAO;GACP,OAAO,MAAM,SAAS;GACtB,QAAQ,MAAM,UAAU;EAC1B;CACF;CAEA,MAAM,qBAAqB,OAA8B;EAGvD,MAAM,IAAI,oBAAoB,wBAAwB,YAAY,EAChE,QACE,yEACJ,CAAC;CACH;CAEA,MAAM,cAAc,OAAe,aAAoC;EAErE,MAAM,IAAI,oBAAoB,iBAAiB,YAAY,EACzD,QAAQ,mDACV,CAAC;CACH;CAMA,MAAM,aAAa,QAAgB,YAAyC;EAC1E,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAShE,QAAO,MANgB,KAAK,QAC1B,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,YACtC,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEgB,KAAK,OAAO;GAC1B,IAAI,EAAE;GACN,QAAQ,EAAE;GACV,UAAU,EAAE,UAAU,OAAO,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,KAAA;GAC1D,WAAW,IAAI,KAAK,EAAE,KAAK;GAC3B,gBAAgB,IAAI,KAAK,EAAE,UAAU;GACrC,WAAW,EAAE;GACb,WAAW,EAAE;EACf,EAAE;CACJ;CAEA,MAAM,cAAc,WAAmB,YAAoC;EACzE,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,YAAY,aAClC,EAAE,QAAQ,SAAS,GACnB,UACF;CACF;CAEA,MAAM,kBAAkB,QAAgB,YAAoC;EAC1E,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB,wBAAwB,UAAU;EAGhE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,UACtC,EAAE,QAAQ,OAAO,GACjB,UACF;CACF;CAMA,MAAM,QAAQ,eAAuB,MAAgC;EAEnE,QAAO,MADa,KAAK,SAAS,aAAa,EAAA,CAClC,SAAS,IAAI;CAC5B;CAEA,MAAM,cACJ,eACA,YACA,UACkB;EAIlB,MAAM,QAAQ,MAAM,KAAK,SAAS,aAAa;EAC/C,MAAM,iBAAiB,WAAW,GAAG,SAAS,GAAG,eAAe;EAChE,OAAO,MAAM,SAAS,cAAc,KAAK,MAAM,SAAS,UAAU;CACpE;CAEA,MAAM,SACJ,eACA,YACmB;EAEnB,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,cAAc,aAAa;GACrD,IAAI,QACF,OAAO,OAAO,SAAS,CAAC;EAE5B,QAAQ,CAER;EAGA,IAAI,YACF,IAAI;GASF,QAAO,MARoB,KAAK,QAG9B,GAAG,KAAK,YAAY,EAAE,SAAS,cAAc,iBAC7C,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEoB,eAAe,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC;EAC5D,QAAQ,CAER;EAGF,OAAO,CAAC;CACV;CAEA,MAAM,WACJ,QACA,MACA,YACe;EAQf,MAAM,WAAU,MANI,KAAK,QACvB,GAAG,KAAK,YAAY,EAAE,SACtB,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEsB,MAAM,MAAM,EAAE,SAAS,IAAI;EACjD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,mBAAmB,QAAQ,UAAU;EAG/D,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,uBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;EAChC,GACA,UACF;CACF;CAEA,MAAM,WACJ,QACA,MACA,YACe;EAQf,MAAM,WAAU,MANI,KAAK,QACvB,GAAG,KAAK,YAAY,EAAE,SACtB,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEsB,MAAM,MAAM,EAAE,SAAS,IAAI;EACjD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,mBAAmB,QAAQ,UAAU;EAG/D,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,uBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;EAChC,GACA,UACF;CACF;CAMA,MAAM,kBAA6C;EACjD,OAAO;GACL,mBAAmB;GACnB,eAAe;GACf,mBAAmB;GACnB,cAAc;GACd,MAAM;GACN,gBAAgB;GAChB,mBAAmB;GACnB,MAAM;GACN,eAAe;GACf,KAAK;GACL,aAAa;GACb,YAAY;GACZ,eAAe;EACjB;CACF;CAEA,MAAM,uBAA8D;EAClE,OAAO,KAAK,uBAAuB;CACrC;CAMA,gBAAwB,MAAiC;EACvD,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,eAAe,KAAK;GACpB,WAAW,KAAK;GAChB,UAAU,KAAK;GACf,aACE,KAAK,aAAa,KAAK,WACnB,GAAG,KAAK,UAAU,GAAG,KAAK,aAC1B,KAAK;GACX,SAAS,KAAK;GACd,WAAW,KAAK,mBACZ,IAAI,KAAK,KAAK,gBAAgB,IAC9B,KAAA;GACJ,YAAY,KAAK;GACjB,QAAQ,KAAK;EACf;CACF;CAEA,MAAc,YACZ,QACA,WACA,YACe;EAOf,MAAM,iBAAgB,MANC,KAAK,QAC1B,GAAG,KAAK,YAAY,EAAE,SACtB,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAE+B,QAAQ,MAAM,UAAU,SAAS,EAAE,IAAI,CAAC;EAEvE,IAAI,cAAc,SAAS,GACzB,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,uBACtC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,aAAa;EACpC,GACA,UACF;CAEJ;CAEA,MAAc,eACZ,QACA,WACA,YACe;EAQf,MAAM,SAAQ,MANO,KAAK,QACxB,GAAG,KAAK,YAAY,EAAE,iBAAiB,mBAAmB,SAAS,KACnE,EAAE,QAAQ,MAAM,GAChB,UACF,EAAA,CAEqB,MAAM,MAAM,EAAE,SAAS,SAAS;EACrD,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,oBAAoB,aAAa,UAAU;EAGrE,MAAM,KAAK,QACT,GAAG,KAAK,YAAY,EAAE,SAAS,OAAO,UAAU,MAAM,MACtD,EAAE,QAAQ,MAAM,GAChB,UACF;CACF;AACF"}

package/dist/chunks/{decode_jwt-BvtACpi_.js → remote-C3O0f74l.js}

@@ -1155,29 +1155,6 @@ function createRemoteJWKSet(url, options) {
 	return remoteJWKSet;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/util/decode_jwt.js
-function decodeJwt(jwt) {
-	if (typeof jwt !== "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
-	const { 1: payload, length } = jwt.split(".");
-	if (length === 5) throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
-	if (length !== 3) throw new JWTInvalid("Invalid JWT");
-	if (!payload) throw new JWTInvalid("JWTs must contain a payload");
-	let decoded;
-	try {
-		decoded = decode(payload);
-	} catch {
-		throw new JWTInvalid("Failed to base64url decode the payload");
-	}
-	let result;
-	try {
-		result = JSON.parse(decoder.decode(decoded));
-	} catch {
-		throw new JWTInvalid("Failed to parse the decoded payload as JSON");
-	}
-	if (!isObject(result)) throw new JWTInvalid("Invalid JWT Claims Set");
-	return result;
-}
-//#endregion
-export { JWTClaimValidationFailed as a, JWSSignatureVerificationFailed as i, createRemoteJWKSet as n, JWTExpired as o, jwtVerify as r, decodeJwt as t };
+export { JWTClaimValidationFailed as a, decode as c, JWSSignatureVerificationFailed as i, decoder as l, jwtVerify as n, JWTExpired as o, isObject as r, JWTInvalid as s, createRemoteJWKSet as t };
 
-//# sourceMappingURL=decode_jwt-BvtACpi_.js.map
+//# sourceMappingURL=remote-C3O0f74l.js.map

package/dist/chunks/remote-C3O0f74l.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-C3O0f74l.js","names":["decodeBase64URL","jwk.isJWK","jwk.isSecretJWK","invalidKeyInput","jwk.isPrivateJWK","jwk.isPublicJWK","b64u","#jwks","#cached","#url","#timeoutDuration","#cooldownDuration","#cacheMaxAge","#headers","#customFetch","#cache","#jwksTimestamp","#local","#pendingFetch"],"sources":["../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/base64.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/util/base64url.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/crypto_key.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/invalid_key_input.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/util/errors.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/is_key_like.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/helpers.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/type_checks.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/signing.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/jwk_to_key.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/normalize_key.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/key/import.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/validate_crit.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/validate_algorithms.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/check_key_type.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jws/flattened/verify.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jws/compact/verify.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwt/verify.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwks/local.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwks/remote.js"],"sourcesContent":["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n    const size = buffers.reduce((acc, { length }) => acc + length, 0);\n    const buf = new Uint8Array(size);\n    let i = 0;\n    for (const buffer of buffers) {\n        buf.set(buffer, i);\n        i += buffer.length;\n    }\n    return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n    if (value < 0 || value >= MAX_INT32) {\n        throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n    }\n    buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n    const high = Math.floor(value / MAX_INT32);\n    const low = value % MAX_INT32;\n    const buf = new Uint8Array(8);\n    writeUInt32BE(buf, high, 0);\n    writeUInt32BE(buf, low, 4);\n    return buf;\n}\nexport function uint32be(value) {\n    const buf = new Uint8Array(4);\n    writeUInt32BE(buf, value);\n    return buf;\n}\nexport function encode(string) {\n    const bytes = new Uint8Array(string.length);\n    for (let i = 0; i < string.length; i++) {\n        const code = string.charCodeAt(i);\n        if (code > 127) {\n            throw new TypeError('non-ASCII string encountered in encode()');\n        }\n        bytes[i] = code;\n    }\n    return bytes;\n}\n","export function encodeBase64(input) {\n    if (Uint8Array.prototype.toBase64) {\n        return input.toBase64();\n    }\n    const CHUNK_SIZE = 0x8000;\n    const arr = [];\n    for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n    }\n    return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(encoded);\n    }\n    const binary = atob(encoded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n            alphabet: 'base64url',\n        });\n    }\n    let encoded = input;\n    if (encoded instanceof Uint8Array) {\n        encoded = decoder.decode(encoded);\n    }\n    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n    try {\n        return decodeBase64(encoded);\n    }\n    catch {\n        throw new TypeError('The input to be decoded is not correctly encoded.');\n    }\n}\nexport function encode(input) {\n    let unencoded = input;\n    if (typeof unencoded === 'string') {\n        unencoded = encoder.encode(unencoded);\n    }\n    if (Uint8Array.prototype.toBase64) {\n        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n    }\n    return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","const unusable = (name, prop = 'algorithm.name') => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nconst isAlgorithm = (algorithm, name) => algorithm.name === name;\nfunction getHashLength(hash) {\n    return parseInt(hash.name.slice(4), 10);\n}\nfunction checkHashLength(algorithm, expected) {\n    const actual = getHashLength(algorithm.hash);\n    if (actual !== expected)\n        throw unusable(`SHA-${expected}`, 'algorithm.hash');\n}\nfunction getNamedCurve(alg) {\n    switch (alg) {\n        case 'ES256':\n            return 'P-256';\n        case 'ES384':\n            return 'P-384';\n        case 'ES512':\n            return 'P-521';\n        default:\n            throw new Error('unreachable');\n    }\n}\nfunction checkUsage(key, usage) {\n    if (usage && !key.usages.includes(usage)) {\n        throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n    }\n}\nexport function checkSigCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512': {\n            if (!isAlgorithm(key.algorithm, 'HMAC'))\n                throw unusable('HMAC');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'RS256':\n        case 'RS384':\n        case 'RS512': {\n            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))\n                throw unusable('RSASSA-PKCS1-v1_5');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'PS256':\n        case 'PS384':\n        case 'PS512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))\n                throw unusable('RSA-PSS');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'Ed25519':\n        case 'EdDSA': {\n            if (!isAlgorithm(key.algorithm, 'Ed25519'))\n                throw unusable('Ed25519');\n            break;\n        }\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87': {\n            if (!isAlgorithm(key.algorithm, alg))\n                throw unusable(alg);\n            break;\n        }\n        case 'ES256':\n        case 'ES384':\n        case 'ES512': {\n            if (!isAlgorithm(key.algorithm, 'ECDSA'))\n                throw unusable('ECDSA');\n            const expected = getNamedCurve(alg);\n            const actual = key.algorithm.namedCurve;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.namedCurve');\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\nexport function checkEncCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'A128GCM':\n        case 'A192GCM':\n        case 'A256GCM': {\n            if (!isAlgorithm(key.algorithm, 'AES-GCM'))\n                throw unusable('AES-GCM');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'A128KW':\n        case 'A192KW':\n        case 'A256KW': {\n            if (!isAlgorithm(key.algorithm, 'AES-KW'))\n                throw unusable('AES-KW');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'ECDH': {\n            switch (key.algorithm.name) {\n                case 'ECDH':\n                case 'X25519':\n                    break;\n                default:\n                    throw unusable('ECDH or X25519');\n            }\n            break;\n        }\n        case 'PBES2-HS256+A128KW':\n        case 'PBES2-HS384+A192KW':\n        case 'PBES2-HS512+A256KW':\n            if (!isAlgorithm(key.algorithm, 'PBKDF2'))\n                throw unusable('PBKDF2');\n            break;\n        case 'RSA-OAEP':\n        case 'RSA-OAEP-256':\n        case 'RSA-OAEP-384':\n        case 'RSA-OAEP-512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))\n                throw unusable('RSA-OAEP');\n            checkHashLength(key.algorithm, parseInt(alg.slice(9), 10) || 1);\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\n","function message(msg, actual, ...types) {\n    types = types.filter(Boolean);\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `one of type ${types.join(', ')}, or ${last}.`;\n    }\n    else if (types.length === 2) {\n        msg += `one of type ${types[0]} or ${types[1]}.`;\n    }\n    else {\n        msg += `of type ${types[0]}.`;\n    }\n    if (actual == null) {\n        msg += ` Received ${actual}`;\n    }\n    else if (typeof actual === 'function' && actual.name) {\n        msg += ` Received function ${actual.name}`;\n    }\n    else if (typeof actual === 'object' && actual != null) {\n        if (actual.constructor?.name) {\n            msg += ` Received an instance of ${actual.constructor.name}`;\n        }\n    }\n    return msg;\n}\nexport const invalidKeyInput = (actual, ...types) => message('Key must be ', actual, ...types);\nexport const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);\n","export class JOSEError extends Error {\n    static code = 'ERR_JOSE_GENERIC';\n    code = 'ERR_JOSE_GENERIC';\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n    static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JWTExpired extends JOSEError {\n    static code = 'ERR_JWT_EXPIRED';\n    code = 'ERR_JWT_EXPIRED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n    static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n    code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n    static code = 'ERR_JOSE_NOT_SUPPORTED';\n    code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n    static code = 'ERR_JWE_DECRYPTION_FAILED';\n    code = 'ERR_JWE_DECRYPTION_FAILED';\n    constructor(message = 'decryption operation failed', options) {\n        super(message, options);\n    }\n}\nexport class JWEInvalid extends JOSEError {\n    static code = 'ERR_JWE_INVALID';\n    code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n    static code = 'ERR_JWS_INVALID';\n    code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n    static code = 'ERR_JWT_INVALID';\n    code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n    static code = 'ERR_JWK_INVALID';\n    code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n    static code = 'ERR_JWKS_INVALID';\n    code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n    static code = 'ERR_JWKS_NO_MATCHING_KEY';\n    code = 'ERR_JWKS_NO_MATCHING_KEY';\n    constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n    [Symbol.asyncIterator];\n    static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSTimeout extends JOSEError {\n    static code = 'ERR_JWKS_TIMEOUT';\n    code = 'ERR_JWKS_TIMEOUT';\n    constructor(message = 'request timed out', options) {\n        super(message, options);\n    }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n    static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    constructor(message = 'signature verification failed', options) {\n        super(message, options);\n    }\n}\n","export function assertCryptoKey(key) {\n    if (!isCryptoKey(key)) {\n        throw new Error('CryptoKey instance expected');\n    }\n}\nexport const isCryptoKey = (key) => {\n    if (key?.[Symbol.toStringTag] === 'CryptoKey')\n        return true;\n    try {\n        return key instanceof CryptoKey;\n    }\n    catch {\n        return false;\n    }\n};\nexport const isKeyObject = (key) => key?.[Symbol.toStringTag] === 'KeyObject';\nexport const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\n","import { decode } from '../util/base64url.js';\nexport const unprotected = Symbol();\nexport function assertNotSet(value, name) {\n    if (value) {\n        throw new TypeError(`${name} can only be called once`);\n    }\n}\nexport function decodeBase64url(value, label, ErrorClass) {\n    try {\n        return decode(value);\n    }\n    catch {\n        throw new ErrorClass(`Failed to base64url decode the ${label}`);\n    }\n}\nexport async function digest(algorithm, data) {\n    const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n    return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n        return false;\n    }\n    if (Object.getPrototypeOf(input) === null) {\n        return true;\n    }\n    let proto = input;\n    while (Object.getPrototypeOf(proto) !== null) {\n        proto = Object.getPrototypeOf(proto);\n    }\n    return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n    const sources = headers.filter(Boolean);\n    if (sources.length === 0 || sources.length === 1) {\n        return true;\n    }\n    let acc;\n    for (const header of sources) {\n        const parameters = Object.keys(header);\n        if (!acc || acc.size === 0) {\n            acc = new Set(parameters);\n            continue;\n        }\n        for (const parameter of parameters) {\n            if (acc.has(parameter)) {\n                return false;\n            }\n            acc.add(parameter);\n        }\n    }\n    return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nimport { checkSigCryptoKey } from './crypto_key.js';\nimport { invalidKeyInput } from './invalid_key_input.js';\nexport function checkKeyLength(alg, key) {\n    if (alg.startsWith('RS') || alg.startsWith('PS')) {\n        const { modulusLength } = key.algorithm;\n        if (typeof modulusLength !== 'number' || modulusLength < 2048) {\n            throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n        }\n    }\n}\nfunction subtleAlgorithm(alg, algorithm) {\n    const hash = `SHA-${alg.slice(-3)}`;\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512':\n            return { hash, name: 'HMAC' };\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { hash, name: 'RSA-PSS', saltLength: parseInt(alg.slice(-3), 10) >> 3 };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { hash, name: 'RSASSA-PKCS1-v1_5' };\n        case 'ES256':\n        case 'ES384':\n        case 'ES512':\n            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };\n        case 'Ed25519':\n        case 'EdDSA':\n            return { name: 'Ed25519' };\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return { name: alg };\n        default:\n            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n    }\n}\nasync function getSigKey(alg, key, usage) {\n    if (key instanceof Uint8Array) {\n        if (!alg.startsWith('HS')) {\n            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n        }\n        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);\n    }\n    checkSigCryptoKey(key, alg, usage);\n    return key;\n}\nexport async function sign(alg, key, data) {\n    const cryptoKey = await getSigKey(alg, key, 'sign');\n    checkKeyLength(alg, cryptoKey);\n    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);\n    return new Uint8Array(signature);\n}\nexport async function verify(alg, key, signature, data) {\n    const cryptoKey = await getSigKey(alg, key, 'verify');\n    checkKeyLength(alg, cryptoKey);\n    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);\n    try {\n        return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);\n    }\n    catch {\n        return false;\n    }\n}\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n    let algorithm;\n    let keyUsages;\n    switch (jwk.kty) {\n        case 'AKP': {\n            switch (jwk.alg) {\n                case 'ML-DSA-44':\n                case 'ML-DSA-65':\n                case 'ML-DSA-87':\n                    algorithm = { name: jwk.alg };\n                    keyUsages = jwk.priv ? ['sign'] : ['verify'];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'RSA': {\n            switch (jwk.alg) {\n                case 'PS256':\n                case 'PS384':\n                case 'PS512':\n                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RS256':\n                case 'RS384':\n                case 'RS512':\n                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RSA-OAEP':\n                case 'RSA-OAEP-256':\n                case 'RSA-OAEP-384':\n                case 'RSA-OAEP-512':\n                    algorithm = {\n                        name: 'RSA-OAEP',\n                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n                    };\n                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'EC': {\n            switch (jwk.alg) {\n                case 'ES256':\n                case 'ES384':\n                case 'ES512':\n                    algorithm = {\n                        name: 'ECDSA',\n                        namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n                    };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'OKP': {\n            switch (jwk.alg) {\n                case 'Ed25519':\n                case 'EdDSA':\n                    algorithm = { name: 'Ed25519' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        default:\n            throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n    }\n    return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n    if (!jwk.alg) {\n        throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n    }\n    const { algorithm, keyUsages } = subtleMapping(jwk);\n    const keyData = { ...jwk };\n    if (keyData.kty !== 'AKP') {\n        delete keyData.alg;\n    }\n    delete keyData.use;\n    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { isJWK } from './type_checks.js';\nimport { decode } from '../util/base64url.js';\nimport { jwkToKey } from './jwk_to_key.js';\nimport { isCryptoKey, isKeyObject } from './is_key_like.js';\nconst unusableForAlg = 'given KeyObject instance cannot be used for this algorithm';\nlet cache;\nconst handleJWK = async (key, jwk, alg, freeze = false) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(key);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const cryptoKey = await jwkToKey({ ...jwk, alg });\n    if (freeze)\n        Object.freeze(key);\n    if (!cached) {\n        cache.set(key, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nconst handleKeyObject = (keyObject, alg) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(keyObject);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const isPublic = keyObject.type === 'public';\n    const extractable = isPublic ? true : false;\n    let cryptoKey;\n    if (keyObject.asymmetricKeyType === 'x25519') {\n        switch (alg) {\n            case 'ECDH-ES':\n            case 'ECDH-ES+A128KW':\n            case 'ECDH-ES+A192KW':\n            case 'ECDH-ES+A256KW':\n                break;\n            default:\n                throw new TypeError(unusableForAlg);\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);\n    }\n    if (keyObject.asymmetricKeyType === 'ed25519') {\n        if (alg !== 'EdDSA' && alg !== 'Ed25519') {\n            throw new TypeError(unusableForAlg);\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n            isPublic ? 'verify' : 'sign',\n        ]);\n    }\n    switch (keyObject.asymmetricKeyType) {\n        case 'ml-dsa-44':\n        case 'ml-dsa-65':\n        case 'ml-dsa-87': {\n            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {\n                throw new TypeError(unusableForAlg);\n            }\n            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n                isPublic ? 'verify' : 'sign',\n            ]);\n        }\n    }\n    if (keyObject.asymmetricKeyType === 'rsa') {\n        let hash;\n        switch (alg) {\n            case 'RSA-OAEP':\n                hash = 'SHA-1';\n                break;\n            case 'RS256':\n            case 'PS256':\n            case 'RSA-OAEP-256':\n                hash = 'SHA-256';\n                break;\n            case 'RS384':\n            case 'PS384':\n            case 'RSA-OAEP-384':\n                hash = 'SHA-384';\n                break;\n            case 'RS512':\n            case 'PS512':\n            case 'RSA-OAEP-512':\n                hash = 'SHA-512';\n                break;\n            default:\n                throw new TypeError(unusableForAlg);\n        }\n        if (alg.startsWith('RSA-OAEP')) {\n            return keyObject.toCryptoKey({\n                name: 'RSA-OAEP',\n                hash,\n            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);\n        }\n        cryptoKey = keyObject.toCryptoKey({\n            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',\n            hash,\n        }, extractable, [isPublic ? 'verify' : 'sign']);\n    }\n    if (keyObject.asymmetricKeyType === 'ec') {\n        const nist = new Map([\n            ['prime256v1', 'P-256'],\n            ['secp384r1', 'P-384'],\n            ['secp521r1', 'P-521'],\n        ]);\n        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);\n        if (!namedCurve) {\n            throw new TypeError(unusableForAlg);\n        }\n        const expectedCurve = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' };\n        if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg.startsWith('ECDH-ES')) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDH',\n                namedCurve,\n            }, extractable, isPublic ? [] : ['deriveBits']);\n        }\n    }\n    if (!cryptoKey) {\n        throw new TypeError(unusableForAlg);\n    }\n    if (!cached) {\n        cache.set(keyObject, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nexport async function normalizeKey(key, alg) {\n    if (key instanceof Uint8Array) {\n        return key;\n    }\n    if (isCryptoKey(key)) {\n        return key;\n    }\n    if (isKeyObject(key)) {\n        if (key.type === 'secret') {\n            return key.export();\n        }\n        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {\n            try {\n                return handleKeyObject(key, alg);\n            }\n            catch (err) {\n                if (err instanceof TypeError) {\n                    throw err;\n                }\n            }\n        }\n        let jwk = key.export({ format: 'jwk' });\n        return handleJWK(key, jwk, alg);\n    }\n    if (isJWK(key)) {\n        if (key.k) {\n            return decode(key.k);\n        }\n        return handleJWK(key, key, alg, true);\n    }\n    throw new Error('unreachable');\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n        throw new TypeError('\"spki\" must be SPKI formatted string');\n    }\n    return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n        throw new TypeError('\"x509\" must be X.509 formatted string');\n    }\n    return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n        throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n    }\n    return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n    if (!isObject(jwk)) {\n        throw new TypeError('JWK must be an object');\n    }\n    let ext;\n    alg ??= jwk.alg;\n    ext ??= options?.extractable ?? jwk.ext;\n    switch (jwk.kty) {\n        case 'oct':\n            if (typeof jwk.k !== 'string' || !jwk.k) {\n                throw new TypeError('missing \"k\" (Key Value) Parameter value');\n            }\n            return decodeBase64URL(jwk.k);\n        case 'RSA':\n            if ('oth' in jwk && jwk.oth !== undefined) {\n                throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n            }\n            return jwkToKey({ ...jwk, alg, ext });\n        case 'AKP': {\n            if (typeof jwk.alg !== 'string' || !jwk.alg) {\n                throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n            }\n            if (alg !== undefined && alg !== jwk.alg) {\n                throw new TypeError('JWK alg and alg option value mismatch');\n            }\n            return jwkToKey({ ...jwk, ext });\n        }\n        case 'EC':\n        case 'OKP':\n            return jwkToKey({ ...jwk, alg, ext });\n        default:\n            throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n    }\n}\n","import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';\nexport function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n    }\n    if (!protectedHeader || protectedHeader.crit === undefined) {\n        return new Set();\n    }\n    if (!Array.isArray(protectedHeader.crit) ||\n        protectedHeader.crit.length === 0 ||\n        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n    }\n    let recognized;\n    if (recognizedOption !== undefined) {\n        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);\n    }\n    else {\n        recognized = recognizedDefault;\n    }\n    for (const parameter of protectedHeader.crit) {\n        if (!recognized.has(parameter)) {\n            throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n        }\n        if (joseHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n        }\n        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n        }\n    }\n    return new Set(protectedHeader.crit);\n}\n","export function validateAlgorithms(option, algorithms) {\n    if (algorithms !== undefined &&\n        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {\n        throw new TypeError(`\"${option}\" option must be an array of strings`);\n    }\n    if (!algorithms) {\n        return undefined;\n    }\n    return new Set(algorithms);\n}\n","import { withAlg as invalidKeyInput } from './invalid_key_input.js';\nimport { isKeyLike } from './is_key_like.js';\nimport * as jwk from './type_checks.js';\nconst tag = (key) => key?.[Symbol.toStringTag];\nconst jwkMatchesOp = (alg, key, usage) => {\n    if (key.use !== undefined) {\n        let expected;\n        switch (usage) {\n            case 'sign':\n            case 'verify':\n                expected = 'sig';\n                break;\n            case 'encrypt':\n            case 'decrypt':\n                expected = 'enc';\n                break;\n        }\n        if (key.use !== expected) {\n            throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n        }\n    }\n    if (key.alg !== undefined && key.alg !== alg) {\n        throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n    }\n    if (Array.isArray(key.key_ops)) {\n        let expectedKeyOp;\n        switch (true) {\n            case usage === 'sign' || usage === 'verify':\n            case alg === 'dir':\n            case alg.includes('CBC-HS'):\n                expectedKeyOp = usage;\n                break;\n            case alg.startsWith('PBES2'):\n                expectedKeyOp = 'deriveBits';\n                break;\n            case /^A\\d{3}(?:GCM)?(?:KW)?$/.test(alg):\n                if (!alg.includes('GCM') && alg.endsWith('KW')) {\n                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';\n                }\n                else {\n                    expectedKeyOp = usage;\n                }\n                break;\n            case usage === 'encrypt' && alg.startsWith('RSA'):\n                expectedKeyOp = 'wrapKey';\n                break;\n            case usage === 'decrypt':\n                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';\n                break;\n        }\n        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {\n            throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n        }\n    }\n    return true;\n};\nconst symmetricTypeCheck = (alg, key, usage) => {\n    if (key instanceof Uint8Array)\n        return;\n    if (jwk.isJWK(key)) {\n        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))\n            return;\n        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present`);\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));\n    }\n    if (key.type !== 'secret') {\n        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type \"secret\"`);\n    }\n};\nconst asymmetricTypeCheck = (alg, key, usage) => {\n    if (jwk.isJWK(key)) {\n        switch (usage) {\n            case 'decrypt':\n            case 'sign':\n                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation must be a private JWK`);\n            case 'encrypt':\n            case 'verify':\n                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation must be a public JWK`);\n        }\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n    }\n    if (key.type === 'secret') {\n        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type \"secret\"`);\n    }\n    if (key.type === 'public') {\n        switch (usage) {\n            case 'sign':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type \"private\"`);\n            case 'decrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type \"private\"`);\n        }\n    }\n    if (key.type === 'private') {\n        switch (usage) {\n            case 'verify':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type \"public\"`);\n            case 'encrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type \"public\"`);\n        }\n    }\n};\nexport function checkKeyType(alg, key, usage) {\n    switch (alg.substring(0, 2)) {\n        case 'A1':\n        case 'A2':\n        case 'di':\n        case 'HS':\n        case 'PB':\n            symmetricTypeCheck(alg, key, usage);\n            break;\n        default:\n            asymmetricTypeCheck(alg, key, usage);\n    }\n}\n","import { decode as b64u } from '../../util/base64url.js';\nimport { verify } from '../../lib/signing.js';\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';\nimport { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';\nimport { decodeBase64url } from '../../lib/helpers.js';\nimport { isDisjoint } from '../../lib/type_checks.js';\nimport { isObject } from '../../lib/type_checks.js';\nimport { checkKeyType } from '../../lib/check_key_type.js';\nimport { validateCrit } from '../../lib/validate_crit.js';\nimport { validateAlgorithms } from '../../lib/validate_algorithms.js';\nimport { normalizeKey } from '../../lib/normalize_key.js';\nexport async function flattenedVerify(jws, key, options) {\n    if (!isObject(jws)) {\n        throw new JWSInvalid('Flattened JWS must be an object');\n    }\n    if (jws.protected === undefined && jws.header === undefined) {\n        throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n    }\n    if (jws.protected !== undefined && typeof jws.protected !== 'string') {\n        throw new JWSInvalid('JWS Protected Header incorrect type');\n    }\n    if (jws.payload === undefined) {\n        throw new JWSInvalid('JWS Payload missing');\n    }\n    if (typeof jws.signature !== 'string') {\n        throw new JWSInvalid('JWS Signature missing or incorrect type');\n    }\n    if (jws.header !== undefined && !isObject(jws.header)) {\n        throw new JWSInvalid('JWS Unprotected Header incorrect type');\n    }\n    let parsedProt = {};\n    if (jws.protected) {\n        try {\n            const protectedHeader = b64u(jws.protected);\n            parsedProt = JSON.parse(decoder.decode(protectedHeader));\n        }\n        catch {\n            throw new JWSInvalid('JWS Protected Header is invalid');\n        }\n    }\n    if (!isDisjoint(parsedProt, jws.header)) {\n        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');\n    }\n    const joseHeader = {\n        ...parsedProt,\n        ...jws.header,\n    };\n    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);\n    let b64 = true;\n    if (extensions.has('b64')) {\n        b64 = parsedProt.b64;\n        if (typeof b64 !== 'boolean') {\n            throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n        }\n    }\n    const { alg } = joseHeader;\n    if (typeof alg !== 'string' || !alg) {\n        throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n    }\n    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);\n    if (algorithms && !algorithms.has(alg)) {\n        throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n    }\n    if (b64) {\n        if (typeof jws.payload !== 'string') {\n            throw new JWSInvalid('JWS Payload must be a string');\n        }\n    }\n    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {\n        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');\n    }\n    let resolvedKey = false;\n    if (typeof key === 'function') {\n        key = await key(parsedProt, jws);\n        resolvedKey = true;\n    }\n    checkKeyType(alg, key, 'verify');\n    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'\n        ? b64\n            ? encode(jws.payload)\n            : encoder.encode(jws.payload)\n        : jws.payload);\n    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);\n    const k = await normalizeKey(key, alg);\n    const verified = await verify(alg, k, signature, data);\n    if (!verified) {\n        throw new JWSSignatureVerificationFailed();\n    }\n    let payload;\n    if (b64) {\n        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);\n    }\n    else if (typeof jws.payload === 'string') {\n        payload = encoder.encode(jws.payload);\n    }\n    else {\n        payload = jws.payload;\n    }\n    const result = { payload };\n    if (jws.protected !== undefined) {\n        result.protectedHeader = parsedProt;\n    }\n    if (jws.header !== undefined) {\n        result.unprotectedHeader = jws.header;\n    }\n    if (resolvedKey) {\n        return { ...result, key: k };\n    }\n    return result;\n}\n","import { flattenedVerify } from '../flattened/verify.js';\nimport { JWSInvalid } from '../../util/errors.js';\nimport { decoder } from '../../lib/buffer_utils.js';\nexport async function compactVerify(jws, key, options) {\n    if (jws instanceof Uint8Array) {\n        jws = decoder.decode(jws);\n    }\n    if (typeof jws !== 'string') {\n        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');\n    }\n    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');\n    if (length !== 3) {\n        throw new JWSInvalid('Invalid Compact JWS');\n    }\n    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);\n    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';\nimport { encoder, decoder } from './buffer_utils.js';\nimport { isObject } from './type_checks.js';\nconst epoch = (date) => Math.floor(date.getTime() / 1000);\nconst minute = 60;\nconst hour = minute * 60;\nconst day = hour * 24;\nconst week = day * 7;\nconst year = day * 365.25;\nconst REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;\nexport function secs(str) {\n    const matched = REGEX.exec(str);\n    if (!matched || (matched[4] && matched[1])) {\n        throw new TypeError('Invalid time period format');\n    }\n    const value = parseFloat(matched[2]);\n    const unit = matched[3].toLowerCase();\n    let numericDate;\n    switch (unit) {\n        case 'sec':\n        case 'secs':\n        case 'second':\n        case 'seconds':\n        case 's':\n            numericDate = Math.round(value);\n            break;\n        case 'minute':\n        case 'minutes':\n        case 'min':\n        case 'mins':\n        case 'm':\n            numericDate = Math.round(value * minute);\n            break;\n        case 'hour':\n        case 'hours':\n        case 'hr':\n        case 'hrs':\n        case 'h':\n            numericDate = Math.round(value * hour);\n            break;\n        case 'day':\n        case 'days':\n        case 'd':\n            numericDate = Math.round(value * day);\n            break;\n        case 'week':\n        case 'weeks':\n        case 'w':\n            numericDate = Math.round(value * week);\n            break;\n        default:\n            numericDate = Math.round(value * year);\n            break;\n    }\n    if (matched[1] === '-' || matched[4] === 'ago') {\n        return -numericDate;\n    }\n    return numericDate;\n}\nfunction validateInput(label, input) {\n    if (!Number.isFinite(input)) {\n        throw new TypeError(`Invalid ${label} input`);\n    }\n    return input;\n}\nconst normalizeTyp = (value) => {\n    if (value.includes('/')) {\n        return value.toLowerCase();\n    }\n    return `application/${value.toLowerCase()}`;\n};\nconst checkAudiencePresence = (audPayload, audOption) => {\n    if (typeof audPayload === 'string') {\n        return audOption.includes(audPayload);\n    }\n    if (Array.isArray(audPayload)) {\n        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));\n    }\n    return false;\n};\nexport function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n    let payload;\n    try {\n        payload = JSON.parse(decoder.decode(encodedPayload));\n    }\n    catch {\n    }\n    if (!isObject(payload)) {\n        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');\n    }\n    const { typ } = options;\n    if (typ &&\n        (typeof protectedHeader.typ !== 'string' ||\n            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {\n        throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, 'typ', 'check_failed');\n    }\n    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;\n    const presenceCheck = [...requiredClaims];\n    if (maxTokenAge !== undefined)\n        presenceCheck.push('iat');\n    if (audience !== undefined)\n        presenceCheck.push('aud');\n    if (subject !== undefined)\n        presenceCheck.push('sub');\n    if (issuer !== undefined)\n        presenceCheck.push('iss');\n    for (const claim of new Set(presenceCheck.reverse())) {\n        if (!(claim in payload)) {\n            throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, 'missing');\n        }\n    }\n    if (issuer &&\n        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {\n        throw new JWTClaimValidationFailed('unexpected \"iss\" claim value', payload, 'iss', 'check_failed');\n    }\n    if (subject && payload.sub !== subject) {\n        throw new JWTClaimValidationFailed('unexpected \"sub\" claim value', payload, 'sub', 'check_failed');\n    }\n    if (audience &&\n        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {\n        throw new JWTClaimValidationFailed('unexpected \"aud\" claim value', payload, 'aud', 'check_failed');\n    }\n    let tolerance;\n    switch (typeof options.clockTolerance) {\n        case 'string':\n            tolerance = secs(options.clockTolerance);\n            break;\n        case 'number':\n            tolerance = options.clockTolerance;\n            break;\n        case 'undefined':\n            tolerance = 0;\n            break;\n        default:\n            throw new TypeError('Invalid clockTolerance option type');\n    }\n    const { currentDate } = options;\n    const now = epoch(currentDate || new Date());\n    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {\n        throw new JWTClaimValidationFailed('\"iat\" claim must be a number', payload, 'iat', 'invalid');\n    }\n    if (payload.nbf !== undefined) {\n        if (typeof payload.nbf !== 'number') {\n            throw new JWTClaimValidationFailed('\"nbf\" claim must be a number', payload, 'nbf', 'invalid');\n        }\n        if (payload.nbf > now + tolerance) {\n            throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, 'nbf', 'check_failed');\n        }\n    }\n    if (payload.exp !== undefined) {\n        if (typeof payload.exp !== 'number') {\n            throw new JWTClaimValidationFailed('\"exp\" claim must be a number', payload, 'exp', 'invalid');\n        }\n        if (payload.exp <= now - tolerance) {\n            throw new JWTExpired('\"exp\" claim timestamp check failed', payload, 'exp', 'check_failed');\n        }\n    }\n    if (maxTokenAge) {\n        const age = now - payload.iat;\n        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);\n        if (age - tolerance > max) {\n            throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');\n        }\n        if (age < 0 - tolerance) {\n            throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');\n        }\n    }\n    return payload;\n}\nexport class JWTClaimsBuilder {\n    #payload;\n    constructor(payload) {\n        if (!isObject(payload)) {\n            throw new TypeError('JWT Claims Set MUST be an object');\n        }\n        this.#payload = structuredClone(payload);\n    }\n    data() {\n        return encoder.encode(JSON.stringify(this.#payload));\n    }\n    get iss() {\n        return this.#payload.iss;\n    }\n    set iss(value) {\n        this.#payload.iss = value;\n    }\n    get sub() {\n        return this.#payload.sub;\n    }\n    set sub(value) {\n        this.#payload.sub = value;\n    }\n    get aud() {\n        return this.#payload.aud;\n    }\n    set aud(value) {\n        this.#payload.aud = value;\n    }\n    set jti(value) {\n        this.#payload.jti = value;\n    }\n    set nbf(value) {\n        if (typeof value === 'number') {\n            this.#payload.nbf = validateInput('setNotBefore', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.nbf = validateInput('setNotBefore', epoch(value));\n        }\n        else {\n            this.#payload.nbf = epoch(new Date()) + secs(value);\n        }\n    }\n    set exp(value) {\n        if (typeof value === 'number') {\n            this.#payload.exp = validateInput('setExpirationTime', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.exp = validateInput('setExpirationTime', epoch(value));\n        }\n        else {\n            this.#payload.exp = epoch(new Date()) + secs(value);\n        }\n    }\n    set iat(value) {\n        if (value === undefined) {\n            this.#payload.iat = epoch(new Date());\n        }\n        else if (value instanceof Date) {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(value));\n        }\n        else if (typeof value === 'string') {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));\n        }\n        else {\n            this.#payload.iat = validateInput('setIssuedAt', value);\n        }\n    }\n}\n","import { compactVerify } from '../jws/compact/verify.js';\nimport { validateClaimsSet } from '../lib/jwt_claims_set.js';\nimport { JWTInvalid } from '../util/errors.js';\nexport async function jwtVerify(jwt, key, options) {\n    const verified = await compactVerify(jwt, key, options);\n    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {\n        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');\n    }\n    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n    const result = { payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import { importJWK } from '../key/import.js';\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nfunction getKtyFromAlg(alg) {\n    switch (typeof alg === 'string' && alg.slice(0, 2)) {\n        case 'RS':\n        case 'PS':\n            return 'RSA';\n        case 'ES':\n            return 'EC';\n        case 'Ed':\n            return 'OKP';\n        case 'ML':\n            return 'AKP';\n        default:\n            throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n    }\n}\nfunction isJWKSLike(jwks) {\n    return (jwks &&\n        typeof jwks === 'object' &&\n        Array.isArray(jwks.keys) &&\n        jwks.keys.every(isJWKLike));\n}\nfunction isJWKLike(key) {\n    return isObject(key);\n}\nclass LocalJWKSet {\n    #jwks;\n    #cached = new WeakMap();\n    constructor(jwks) {\n        if (!isJWKSLike(jwks)) {\n            throw new JWKSInvalid('JSON Web Key Set malformed');\n        }\n        this.#jwks = structuredClone(jwks);\n    }\n    jwks() {\n        return this.#jwks;\n    }\n    async getKey(protectedHeader, token) {\n        const { alg, kid } = { ...protectedHeader, ...token?.header };\n        const kty = getKtyFromAlg(alg);\n        const candidates = this.#jwks.keys.filter((jwk) => {\n            let candidate = kty === jwk.kty;\n            if (candidate && typeof kid === 'string') {\n                candidate = kid === jwk.kid;\n            }\n            if (candidate && (typeof jwk.alg === 'string' || kty === 'AKP')) {\n                candidate = alg === jwk.alg;\n            }\n            if (candidate && typeof jwk.use === 'string') {\n                candidate = jwk.use === 'sig';\n            }\n            if (candidate && Array.isArray(jwk.key_ops)) {\n                candidate = jwk.key_ops.includes('verify');\n            }\n            if (candidate) {\n                switch (alg) {\n                    case 'ES256':\n                        candidate = jwk.crv === 'P-256';\n                        break;\n                    case 'ES384':\n                        candidate = jwk.crv === 'P-384';\n                        break;\n                    case 'ES512':\n                        candidate = jwk.crv === 'P-521';\n                        break;\n                    case 'Ed25519':\n                    case 'EdDSA':\n                        candidate = jwk.crv === 'Ed25519';\n                        break;\n                }\n            }\n            return candidate;\n        });\n        const { 0: jwk, length } = candidates;\n        if (length === 0) {\n            throw new JWKSNoMatchingKey();\n        }\n        if (length !== 1) {\n            const error = new JWKSMultipleMatchingKeys();\n            const _cached = this.#cached;\n            error[Symbol.asyncIterator] = async function* () {\n                for (const jwk of candidates) {\n                    try {\n                        yield await importWithAlgCache(_cached, jwk, alg);\n                    }\n                    catch { }\n                }\n            };\n            throw error;\n        }\n        return importWithAlgCache(this.#cached, jwk, alg);\n    }\n}\nasync function importWithAlgCache(cache, jwk, alg) {\n    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);\n    if (cached[alg] === undefined) {\n        const key = await importJWK({ ...jwk, ext: true }, alg);\n        if (key instanceof Uint8Array || key.type !== 'public') {\n            throw new JWKSInvalid('JSON Web Key Set members must be public keys');\n        }\n        cached[alg] = key;\n    }\n    return cached[alg];\n}\nexport function createLocalJWKSet(jwks) {\n    const set = new LocalJWKSet(jwks);\n    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);\n    Object.defineProperties(localJWKSet, {\n        jwks: {\n            value: () => structuredClone(set.jwks()),\n            enumerable: false,\n            configurable: false,\n            writable: false,\n        },\n    });\n    return localJWKSet;\n}\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';\nimport { createLocalJWKSet } from './local.js';\nimport { isObject } from '../lib/type_checks.js';\nfunction isCloudflareWorkers() {\n    return (typeof WebSocketPair !== 'undefined' ||\n        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||\n        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));\n}\nlet USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'jose';\n    const VERSION = 'v6.2.2';\n    USER_AGENT = `${NAME}/${VERSION}`;\n}\nexport const customFetch = Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n    const response = await fetchImpl(url, {\n        method: 'GET',\n        signal,\n        redirect: 'manual',\n        headers,\n    }).catch((err) => {\n        if (err.name === 'TimeoutError') {\n            throw new JWKSTimeout();\n        }\n        throw err;\n    });\n    if (response.status !== 200) {\n        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');\n    }\n    try {\n        return await response.json();\n    }\n    catch {\n        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');\n    }\n}\nexport const jwksCache = Symbol();\nfunction isFreshJwksCache(input, cacheMaxAge) {\n    if (typeof input !== 'object' || input === null) {\n        return false;\n    }\n    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {\n        return false;\n    }\n    if (!('jwks' in input) ||\n        !isObject(input.jwks) ||\n        !Array.isArray(input.jwks.keys) ||\n        !Array.prototype.every.call(input.jwks.keys, isObject)) {\n        return false;\n    }\n    return true;\n}\nclass RemoteJWKSet {\n    #url;\n    #timeoutDuration;\n    #cooldownDuration;\n    #cacheMaxAge;\n    #jwksTimestamp;\n    #pendingFetch;\n    #headers;\n    #customFetch;\n    #local;\n    #cache;\n    constructor(url, options) {\n        if (!(url instanceof URL)) {\n            throw new TypeError('url must be an instance of URL');\n        }\n        this.#url = new URL(url.href);\n        this.#timeoutDuration =\n            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;\n        this.#cooldownDuration =\n            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;\n        this.#cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;\n        this.#headers = new Headers(options?.headers);\n        if (USER_AGENT && !this.#headers.has('User-Agent')) {\n            this.#headers.set('User-Agent', USER_AGENT);\n        }\n        if (!this.#headers.has('accept')) {\n            this.#headers.set('accept', 'application/json');\n            this.#headers.append('accept', 'application/jwk-set+json');\n        }\n        this.#customFetch = options?.[customFetch];\n        if (options?.[jwksCache] !== undefined) {\n            this.#cache = options?.[jwksCache];\n            if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {\n                this.#jwksTimestamp = this.#cache.uat;\n                this.#local = createLocalJWKSet(this.#cache.jwks);\n            }\n        }\n    }\n    pendingFetch() {\n        return !!this.#pendingFetch;\n    }\n    coolingDown() {\n        return typeof this.#jwksTimestamp === 'number'\n            ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration\n            : false;\n    }\n    fresh() {\n        return typeof this.#jwksTimestamp === 'number'\n            ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge\n            : false;\n    }\n    jwks() {\n        return this.#local?.jwks();\n    }\n    async getKey(protectedHeader, token) {\n        if (!this.#local || !this.fresh()) {\n            await this.reload();\n        }\n        try {\n            return await this.#local(protectedHeader, token);\n        }\n        catch (err) {\n            if (err instanceof JWKSNoMatchingKey) {\n                if (this.coolingDown() === false) {\n                    await this.reload();\n                    return this.#local(protectedHeader, token);\n                }\n            }\n            throw err;\n        }\n    }\n    async reload() {\n        if (this.#pendingFetch && isCloudflareWorkers()) {\n            this.#pendingFetch = undefined;\n        }\n        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)\n            .then((json) => {\n            this.#local = createLocalJWKSet(json);\n            if (this.#cache) {\n                this.#cache.uat = Date.now();\n                this.#cache.jwks = json;\n            }\n            this.#jwksTimestamp = Date.now();\n            this.#pendingFetch = undefined;\n        })\n            .catch((err) => {\n            this.#pendingFetch = undefined;\n            throw err;\n        });\n        await this.#pendingFetch;\n    }\n}\nexport function createRemoteJWKSet(url, options) {\n    const set = new RemoteJWKSet(url, options);\n    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);\n    Object.defineProperties(remoteJWKSet, {\n        coolingDown: {\n            get: () => set.coolingDown(),\n            enumerable: true,\n            configurable: false,\n        },\n        fresh: {\n            get: () => set.fresh(),\n            enumerable: true,\n            configurable: false,\n        },\n        reload: {\n            value: () => set.reload(),\n            enumerable: true,\n            configurable: false,\n            writable: false,\n        },\n        reloading: {\n            get: () => set.pendingFetch(),\n            enumerable: true,\n            configurable: false,\n        },\n        jwks: {\n            value: () => set.jwks(),\n            enumerable: true,\n            configurable: false,\n            writable: false,\n        },\n    });\n    return remoteJWKSet;\n}\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21],"mappings":";AAAA,IAAa,UAAU,IAAI,YAAY;AACvC,IAAa,UAAU,IAAI,YAAY;AAEvC,SAAgB,OAAO,GAAG,SAAS;CAC/B,MAAM,OAAO,QAAQ,QAAQ,KAAK,EAAE,aAAa,MAAM,QAAQ,CAAC;CAChE,MAAM,MAAM,IAAI,WAAW,IAAI;CAC/B,IAAI,IAAI;CACR,KAAK,MAAM,UAAU,SAAS;EAC1B,IAAI,IAAI,QAAQ,CAAC;EACjB,KAAK,OAAO;CAChB;CACA,OAAO;AACX;AAoBA,SAAgB,OAAO,QAAQ;CAC3B,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACpC,MAAM,OAAO,OAAO,WAAW,CAAC;EAChC,IAAI,OAAO,KACP,MAAM,IAAI,UAAU,0CAA0C;EAElE,MAAM,KAAK;CACf;CACA,OAAO;AACX;;;AC/BA,SAAgB,aAAa,SAAS;CAClC,IAAI,WAAW,YACX,OAAO,WAAW,WAAW,OAAO;CAExC,MAAM,SAAS,KAAK,OAAO;CAC3B,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAC/B,MAAM,KAAK,OAAO,WAAW,CAAC;CAElC,OAAO;AACX;;;ACnBA,SAAgB,OAAO,OAAO;CAC1B,IAAI,WAAW,YACX,OAAO,WAAW,WAAW,OAAO,UAAU,WAAW,QAAQ,QAAQ,OAAO,KAAK,GAAG,EACpF,UAAU,YACd,CAAC;CAEL,IAAI,UAAU;CACd,IAAI,mBAAmB,YACnB,UAAU,QAAQ,OAAO,OAAO;CAEpC,UAAU,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACtD,IAAI;EACA,OAAO,aAAa,OAAO;CAC/B,QACM;EACF,MAAM,IAAI,UAAU,mDAAmD;CAC3E;AACJ;;;ACnBA,IAAM,YAAY,MAAM,OAAO,qCAAqB,IAAI,UAAU,kDAAkD,KAAK,WAAW,MAAM;AAC1I,IAAM,eAAe,WAAW,SAAS,UAAU,SAAS;AAC5D,SAAS,cAAc,MAAM;CACzB,OAAO,SAAS,KAAK,KAAK,MAAM,CAAC,GAAG,EAAE;AAC1C;AACA,SAAS,gBAAgB,WAAW,UAAU;CAE1C,IADe,cAAc,UAAU,IAC9B,MAAM,UACX,MAAM,SAAS,OAAO,YAAY,gBAAgB;AAC1D;AACA,SAAS,cAAc,KAAK;CACxB,QAAQ,KAAR;EACI,KAAK,SACD,OAAO;EACX,KAAK,SACD,OAAO;EACX,KAAK,SACD,OAAO;EACX,SACI,MAAM,IAAI,MAAM,aAAa;CACrC;AACJ;AACA,SAAS,WAAW,KAAK,OAAO;CAC5B,IAAI,SAAS,CAAC,IAAI,OAAO,SAAS,KAAK,GACnC,MAAM,IAAI,UAAU,sEAAsE,MAAM,EAAE;AAE1G;AACA,SAAgB,kBAAkB,KAAK,KAAK,OAAO;CAC/C,QAAQ,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,MAAM,GAClC,MAAM,SAAS,MAAM;GACzB,gBAAgB,IAAI,WAAW,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;GACzD;EAEJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,mBAAmB,GAC/C,MAAM,SAAS,mBAAmB;GACtC,gBAAgB,IAAI,WAAW,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;GACzD;EAEJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,SAAS,GACrC,MAAM,SAAS,SAAS;GAC5B,gBAAgB,IAAI,WAAW,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;GACzD;EAEJ,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,SAAS,GACrC,MAAM,SAAS,SAAS;GAC5B;EAEJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,GAAG,GAC/B,MAAM,SAAS,GAAG;GACtB;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;GACV,IAAI,CAAC,YAAY,IAAI,WAAW,OAAO,GACnC,MAAM,SAAS,OAAO;GAC1B,MAAM,WAAW,cAAc,GAAG;GAElC,IADe,IAAI,UAAU,eACd,UACX,MAAM,SAAS,UAAU,sBAAsB;GACnD;EACJ;EACA,SACI,MAAM,IAAI,UAAU,2CAA2C;CACvE;CACA,WAAW,KAAK,KAAK;AACzB;;;ACjFA,SAAS,QAAQ,KAAK,QAAQ,GAAG,OAAO;CACpC,QAAQ,MAAM,OAAO,OAAO;CAC5B,IAAI,MAAM,SAAS,GAAG;EAClB,MAAM,OAAO,MAAM,IAAI;EACvB,OAAO,eAAe,MAAM,KAAK,IAAI,EAAE,OAAO,KAAK;CACvD,OACK,IAAI,MAAM,WAAW,GACtB,OAAO,eAAe,MAAM,GAAG,MAAM,MAAM,GAAG;MAG9C,OAAO,WAAW,MAAM,GAAG;CAE/B,IAAI,UAAU,MACV,OAAO,aAAa;MAEnB,IAAI,OAAO,WAAW,cAAc,OAAO,MAC5C,OAAO,sBAAsB,OAAO;MAEnC,IAAI,OAAO,WAAW,YAAY,UAAU;MACzC,OAAO,aAAa,MACpB,OAAO,4BAA4B,OAAO,YAAY;CAAA;CAG9D,OAAO;AACX;AACA,IAAa,mBAAmB,QAAQ,GAAG,UAAU,QAAQ,gBAAgB,QAAQ,GAAG,KAAK;AAC7F,IAAa,WAAW,KAAK,QAAQ,GAAG,UAAU,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,GAAG,KAAK;;;AC1BnH,IAAa,YAAb,cAA+B,MAAM;CACjC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,SAAS,SAAS;EAC1B,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO,KAAK,YAAY;EAC7B,MAAM,oBAAoB,MAAM,KAAK,WAAW;CACpD;AACJ;AACA,IAAa,2BAAb,cAA8C,UAAU;CACpD,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EACzE,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC;EACpD,KAAK,QAAQ;EACb,KAAK,SAAS;EACd,KAAK,UAAU;CACnB;AACJ;AACA,IAAa,aAAb,cAAgC,UAAU;CACtC,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EACzE,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC;EACpD,KAAK,QAAQ;EACb,KAAK,SAAS;EACd,KAAK,UAAU;CACnB;AACJ;AACA,IAAa,oBAAb,cAAuC,UAAU;CAC7C,OAAO,OAAO;CACd,OAAO;AACX;AACA,IAAa,mBAAb,cAAsC,UAAU;CAC5C,OAAO,OAAO;CACd,OAAO;AACX;AAYA,IAAa,aAAb,cAAgC,UAAU;CACtC,OAAO,OAAO;CACd,OAAO;AACX;AACA,IAAa,aAAb,cAAgC,UAAU;CACtC,OAAO,OAAO;CACd,OAAO;AACX;AAKA,IAAa,cAAb,cAAiC,UAAU;CACvC,OAAO,OAAO;CACd,OAAO;AACX;AACA,IAAa,oBAAb,cAAuC,UAAU;CAC7C,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,mDAAmD,SAAS;EAC9E,MAAM,SAAS,OAAO;CAC1B;AACJ;AACA,IAAa,2BAAb,cAA8C,UAAU;CACpD,CAAC,OAAO;CACR,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,wDAAwD,SAAS;EACnF,MAAM,SAAS,OAAO;CAC1B;AACJ;AACA,IAAa,cAAb,cAAiC,UAAU;CACvC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,qBAAqB,SAAS;EAChD,MAAM,SAAS,OAAO;CAC1B;AACJ;AACA,IAAa,iCAAb,cAAoD,UAAU;CAC1D,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,iCAAiC,SAAS;EAC5D,MAAM,SAAS,OAAO;CAC1B;AACJ;;;AC7FA,IAAa,eAAe,QAAQ;CAChC,IAAI,MAAM,OAAO,iBAAiB,aAC9B,OAAO;CACX,IAAI;EACA,OAAO,eAAe;CAC1B,QACM;EACF,OAAO;CACX;AACJ;AACA,IAAa,eAAe,QAAQ,MAAM,OAAO,iBAAiB;AAClE,IAAa,aAAa,QAAQ,YAAY,GAAG,KAAK,YAAY,GAAG;;;ACTrE,SAAgB,gBAAgB,OAAO,OAAO,YAAY;CACtD,IAAI;EACA,OAAO,OAAO,KAAK;CACvB,QACM;EACF,MAAM,IAAI,WAAW,kCAAkC,OAAO;CAClE;AACJ;;;ACdA,IAAM,gBAAgB,UAAU,OAAO,UAAU,YAAY,UAAU;AACvE,SAAgB,SAAS,OAAO;CAC5B,IAAI,CAAC,aAAa,KAAK,KAAK,OAAO,UAAU,SAAS,KAAK,KAAK,MAAM,mBAClE,OAAO;CAEX,IAAI,OAAO,eAAe,KAAK,MAAM,MACjC,OAAO;CAEX,IAAI,QAAQ;CACZ,OAAO,OAAO,eAAe,KAAK,MAAM,MACpC,QAAQ,OAAO,eAAe,KAAK;CAEvC,OAAO,OAAO,eAAe,KAAK,MAAM;AAC5C;AACA,SAAgB,WAAW,GAAG,SAAS;CACnC,MAAM,UAAU,QAAQ,OAAO,OAAO;CACtC,IAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAC3C,OAAO;CAEX,IAAI;CACJ,KAAK,MAAM,UAAU,SAAS;EAC1B,MAAM,aAAa,OAAO,KAAK,MAAM;EACrC,IAAI,CAAC,OAAO,IAAI,SAAS,GAAG;GACxB,MAAM,IAAI,IAAI,UAAU;GACxB;EACJ;EACA,KAAK,MAAM,aAAa,YAAY;GAChC,IAAI,IAAI,IAAI,SAAS,GACjB,OAAO;GAEX,IAAI,IAAI,SAAS;EACrB;CACJ;CACA,OAAO;AACX;AACA,IAAa,SAAS,QAAQ,SAAS,GAAG,KAAK,OAAO,IAAI,QAAQ;AAClE,IAAa,gBAAgB,QAAQ,IAAI,QAAQ,UAC3C,IAAI,QAAQ,SAAS,OAAO,IAAI,SAAS,YAAa,OAAO,IAAI,MAAM;AAC7E,IAAa,eAAe,QAAQ,IAAI,QAAQ,SAAS,IAAI,MAAM,KAAA,KAAa,IAAI,SAAS,KAAA;AAC7F,IAAa,eAAe,QAAQ,IAAI,QAAQ,SAAS,OAAO,IAAI,MAAM;;;ACpC1E,SAAgB,eAAe,KAAK,KAAK;CACrC,IAAI,IAAI,WAAW,IAAI,KAAK,IAAI,WAAW,IAAI,GAAG;EAC9C,MAAM,EAAE,kBAAkB,IAAI;EAC9B,IAAI,OAAO,kBAAkB,YAAY,gBAAgB,MACrD,MAAM,IAAI,UAAU,GAAG,IAAI,sDAAsD;CAEzF;AACJ;AACA,SAAS,gBAAgB,KAAK,WAAW;CACrC,MAAM,OAAO,OAAO,IAAI,MAAM,EAAE;CAChC,QAAQ,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;EAAO;EAChC,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;GAAW,YAAY,SAAS,IAAI,MAAM,EAAE,GAAG,EAAE,KAAK;EAAE;EACjF,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;EAAoB;EAC7C,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;GAAS,YAAY,UAAU;EAAW;EACnE,KAAK;EACL,KAAK,SACD,OAAO,EAAE,MAAM,UAAU;EAC7B,KAAK;EACL,KAAK;EACL,KAAK,aACD,OAAO,EAAE,MAAM,IAAI;EACvB,SACI,MAAM,IAAI,iBAAiB,OAAO,IAAI,4DAA4D;CAC1G;AACJ;AACA,eAAe,UAAU,KAAK,KAAK,OAAO;CACtC,IAAI,eAAe,YAAY;EAC3B,IAAI,CAAC,IAAI,WAAW,IAAI,GACpB,MAAM,IAAI,UAAU,gBAAgB,KAAK,aAAa,aAAa,cAAc,CAAC;EAEtF,OAAO,OAAO,OAAO,UAAU,OAAO,KAAK;GAAE,MAAM,OAAO,IAAI,MAAM,EAAE;GAAK,MAAM;EAAO,GAAG,OAAO,CAAC,KAAK,CAAC;CAC7G;CACA,kBAAkB,KAAK,KAAK,KAAK;CACjC,OAAO;AACX;AAOA,eAAsB,OAAO,KAAK,KAAK,WAAW,MAAM;CACpD,MAAM,YAAY,MAAM,UAAU,KAAK,KAAK,QAAQ;CACpD,eAAe,KAAK,SAAS;CAC7B,MAAM,YAAY,gBAAgB,KAAK,UAAU,SAAS;CAC1D,IAAI;EACA,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,WAAW,WAAW,IAAI;CAC3E,QACM;EACF,OAAO;CACX;AACJ;;;AClEA,IAAM,iBAAiB;AACvB,SAAS,cAAc,KAAK;CACxB,IAAI;CACJ,IAAI;CACJ,QAAQ,IAAI,KAAZ;EACI,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY,EAAE,MAAM,IAAI,IAAI;KAC5B,YAAY,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ;KAC3C;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MAAE,MAAM;MAAW,MAAM,OAAO,IAAI,IAAI,MAAM,EAAE;KAAI;KAChE,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MAAE,MAAM;MAAqB,MAAM,OAAO,IAAI,IAAI,MAAM,EAAE;KAAI;KAC1E,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MACR,MAAM;MACN,MAAM,OAAO,SAAS,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,KAAK;KACpD;KACA,YAAY,IAAI,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,WAAW,SAAS;KACpE;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MACR,MAAM;MACN,YAAY;OAAE,OAAO;OAAS,OAAO;OAAS,OAAO;MAAQ,EAAE,IAAI;KACvE;KACA,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MAAE,MAAM;MAAQ,YAAY,IAAI;KAAI;KAChD,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC;KACtC;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;KACD,YAAY,EAAE,MAAM,UAAU;KAC9B,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY,EAAE,MAAM,IAAI,IAAI;KAC5B,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC;KACtC;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,SACI,MAAM,IAAI,iBAAiB,+DAA6D;CAChG;CACA,OAAO;EAAE;EAAW;CAAU;AAClC;AACA,eAAsB,SAAS,KAAK;CAChC,IAAI,CAAC,IAAI,KACL,MAAM,IAAI,UAAU,8DAA0D;CAElF,MAAM,EAAE,WAAW,cAAc,cAAc,GAAG;CAClD,MAAM,UAAU,EAAE,GAAG,IAAI;CACzB,IAAI,QAAQ,QAAQ,OAChB,OAAO,QAAQ;CAEnB,OAAO,QAAQ;CACf,OAAO,OAAO,OAAO,UAAU,OAAO,SAAS,WAAW,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,IAAI,WAAW,SAAS;AACrI;;;ACtGA,IAAM,iBAAiB;AACvB,IAAI;AACJ,IAAM,YAAY,OAAO,KAAK,KAAK,KAAK,SAAS,UAAU;CACvD,0BAAU,IAAI,QAAQ;CACtB,IAAI,SAAS,MAAM,IAAI,GAAG;CAC1B,IAAI,SAAS,MACT,OAAO,OAAO;CAElB,MAAM,YAAY,MAAM,SAAS;EAAE,GAAG;EAAK;CAAI,CAAC;CAChD,IAAI,QACA,OAAO,OAAO,GAAG;CACrB,IAAI,CAAC,QACD,MAAM,IAAI,KAAK,GAAG,MAAM,UAAU,CAAC;MAGnC,OAAO,OAAO;CAElB,OAAO;AACX;AACA,IAAM,mBAAmB,WAAW,QAAQ;CACxC,0BAAU,IAAI,QAAQ;CACtB,IAAI,SAAS,MAAM,IAAI,SAAS;CAChC,IAAI,SAAS,MACT,OAAO,OAAO;CAElB,MAAM,WAAW,UAAU,SAAS;CACpC,MAAM,cAAc,WAAW,OAAO;CACtC,IAAI;CACJ,IAAI,UAAU,sBAAsB,UAAU;EAC1C,QAAQ,KAAR;GACI,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,kBACD;GACJ,SACI,MAAM,IAAI,UAAU,cAAc;EAC1C;EACA,YAAY,UAAU,YAAY,UAAU,mBAAmB,aAAa,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;CAC9G;CACA,IAAI,UAAU,sBAAsB,WAAW;EAC3C,IAAI,QAAQ,WAAW,QAAQ,WAC3B,MAAM,IAAI,UAAU,cAAc;EAEtC,YAAY,UAAU,YAAY,UAAU,mBAAmB,aAAa,CACxE,WAAW,WAAW,MAC1B,CAAC;CACL;CACA,QAAQ,UAAU,mBAAlB;EACI,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,QAAQ,UAAU,kBAAkB,YAAY,GAChD,MAAM,IAAI,UAAU,cAAc;GAEtC,YAAY,UAAU,YAAY,UAAU,mBAAmB,aAAa,CACxE,WAAW,WAAW,MAC1B,CAAC;CAET;CACA,IAAI,UAAU,sBAAsB,OAAO;EACvC,IAAI;EACJ,QAAQ,KAAR;GACI,KAAK;IACD,OAAO;IACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,SACI,MAAM,IAAI,UAAU,cAAc;EAC1C;EACA,IAAI,IAAI,WAAW,UAAU,GACzB,OAAO,UAAU,YAAY;GACzB,MAAM;GACN;EACJ,GAAG,aAAa,WAAW,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC;EAExD,YAAY,UAAU,YAAY;GAC9B,MAAM,IAAI,WAAW,IAAI,IAAI,YAAY;GACzC;EACJ,GAAG,aAAa,CAAC,WAAW,WAAW,MAAM,CAAC;CAClD;CACA,IAAI,UAAU,sBAAsB,MAAM;EAMtC,MAAM,8BAAa,IALF,IAAI;GACjB,CAAC,cAAc,OAAO;GACtB,CAAC,aAAa,OAAO;GACrB,CAAC,aAAa,OAAO;EACzB,CACsB,EAAA,CAAE,IAAI,UAAU,sBAAsB,UAAU;EACtE,IAAI,CAAC,YACD,MAAM,IAAI,UAAU,cAAc;EAEtC,MAAM,gBAAgB;GAAE,OAAO;GAAS,OAAO;GAAS,OAAO;EAAQ;EACvE,IAAI,cAAc,QAAQ,eAAe,cAAc,MACnD,YAAY,UAAU,YAAY;GAC9B,MAAM;GACN;EACJ,GAAG,aAAa,CAAC,WAAW,WAAW,MAAM,CAAC;EAElD,IAAI,IAAI,WAAW,SAAS,GACxB,YAAY,UAAU,YAAY;GAC9B,MAAM;GACN;EACJ,GAAG,aAAa,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;CAEtD;CACA,IAAI,CAAC,WACD,MAAM,IAAI,UAAU,cAAc;CAEtC,IAAI,CAAC,QACD,MAAM,IAAI,WAAW,GAAG,MAAM,UAAU,CAAC;MAGzC,OAAO,OAAO;CAElB,OAAO;AACX;AACA,eAAsB,aAAa,KAAK,KAAK;CACzC,IAAI,eAAe,YACf,OAAO;CAEX,IAAI,YAAY,GAAG,GACf,OAAO;CAEX,IAAI,YAAY,GAAG,GAAG;EAClB,IAAI,IAAI,SAAS,UACb,OAAO,IAAI,OAAO;EAEtB,IAAI,iBAAiB,OAAO,OAAO,IAAI,gBAAgB,YACnD,IAAI;GACA,OAAO,gBAAgB,KAAK,GAAG;EACnC,SACO,KAAK;GACR,IAAI,eAAe,WACf,MAAM;EAEd;EAGJ,OAAO,UAAU,KADP,IAAI,OAAO,EAAE,QAAQ,MAAM,CACf,GAAK,GAAG;CAClC;CACA,IAAI,MAAM,GAAG,GAAG;EACZ,IAAI,IAAI,GACJ,OAAO,OAAO,IAAI,CAAC;EAEvB,OAAO,UAAU,KAAK,KAAK,KAAK,IAAI;CACxC;CACA,MAAM,IAAI,MAAM,aAAa;AACjC;;;AC9IA,eAAsB,UAAU,KAAK,KAAK,SAAS;CAC/C,IAAI,CAAC,SAAS,GAAG,GACb,MAAM,IAAI,UAAU,uBAAuB;CAE/C,IAAI;CACJ,QAAQ,IAAI;CACZ,QAAQ,SAAS,eAAe,IAAI;CACpC,QAAQ,IAAI,KAAZ;EACI,KAAK;GACD,IAAI,OAAO,IAAI,MAAM,YAAY,CAAC,IAAI,GAClC,MAAM,IAAI,UAAU,2CAAyC;GAEjE,OAAOA,OAAgB,IAAI,CAAC;EAChC,KAAK;GACD,IAAI,SAAS,OAAO,IAAI,QAAQ,KAAA,GAC5B,MAAM,IAAI,iBAAiB,sEAAoE;GAEnG,OAAO,SAAS;IAAE,GAAG;IAAK;IAAK;GAAI,CAAC;EACxC,KAAK;GACD,IAAI,OAAO,IAAI,QAAQ,YAAY,CAAC,IAAI,KACpC,MAAM,IAAI,UAAU,6CAA2C;GAEnE,IAAI,QAAQ,KAAA,KAAa,QAAQ,IAAI,KACjC,MAAM,IAAI,UAAU,uCAAuC;GAE/D,OAAO,SAAS;IAAE,GAAG;IAAK;GAAI,CAAC;EAEnC,KAAK;EACL,KAAK,OACD,OAAO,SAAS;GAAE,GAAG;GAAK;GAAK;EAAI,CAAC;EACxC,SACI,MAAM,IAAI,iBAAiB,gDAA8C;CACjF;AACJ;;;ACvDA,SAAgB,aAAa,KAAK,mBAAmB,kBAAkB,iBAAiB,YAAY;CAChG,IAAI,WAAW,SAAS,KAAA,KAAa,iBAAiB,SAAS,KAAA,GAC3D,MAAM,IAAI,IAAI,kEAAgE;CAElF,IAAI,CAAC,mBAAmB,gBAAgB,SAAS,KAAA,GAC7C,uBAAO,IAAI,IAAI;CAEnB,IAAI,CAAC,MAAM,QAAQ,gBAAgB,IAAI,KACnC,gBAAgB,KAAK,WAAW,KAChC,gBAAgB,KAAK,MAAM,UAAU,OAAO,UAAU,YAAY,MAAM,WAAW,CAAC,GACpF,MAAM,IAAI,IAAI,yFAAuF;CAEzG,IAAI;CACJ,IAAI,qBAAqB,KAAA,GACrB,aAAa,IAAI,IAAI,CAAC,GAAG,OAAO,QAAQ,gBAAgB,GAAG,GAAG,kBAAkB,QAAQ,CAAC,CAAC;MAG1F,aAAa;CAEjB,KAAK,MAAM,aAAa,gBAAgB,MAAM;EAC1C,IAAI,CAAC,WAAW,IAAI,SAAS,GACzB,MAAM,IAAI,iBAAiB,+BAA+B,UAAU,oBAAoB;EAE5F,IAAI,WAAW,eAAe,KAAA,GAC1B,MAAM,IAAI,IAAI,+BAA+B,UAAU,aAAa;EAExE,IAAI,WAAW,IAAI,SAAS,KAAK,gBAAgB,eAAe,KAAA,GAC5D,MAAM,IAAI,IAAI,+BAA+B,UAAU,8BAA8B;CAE7F;CACA,OAAO,IAAI,IAAI,gBAAgB,IAAI;AACvC;;;AChCA,SAAgB,mBAAmB,QAAQ,YAAY;CACnD,IAAI,eAAe,KAAA,MACd,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,MAAM,MAAM,OAAO,MAAM,QAAQ,IAC3E,MAAM,IAAI,UAAU,IAAI,OAAO,qCAAqC;CAExE,IAAI,CAAC,YACD;CAEJ,OAAO,IAAI,IAAI,UAAU;AAC7B;;;ACNA,IAAM,OAAO,QAAQ,MAAM,OAAO;AAClC,IAAM,gBAAgB,KAAK,KAAK,UAAU;CACtC,IAAI,IAAI,QAAQ,KAAA,GAAW;EACvB,IAAI;EACJ,QAAQ,OAAR;GACI,KAAK;GACL,KAAK;IACD,WAAW;IACX;GACJ,KAAK;GACL,KAAK;IACD,WAAW;IACX;EACR;EACA,IAAI,IAAI,QAAQ,UACZ,MAAM,IAAI,UAAU,sDAAsD,SAAS,eAAe;CAE1G;CACA,IAAI,IAAI,QAAQ,KAAA,KAAa,IAAI,QAAQ,KACrC,MAAM,IAAI,UAAU,sDAAsD,IAAI,eAAe;CAEjG,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG;EAC5B,IAAI;EACJ,QAAQ,MAAR;GACI,KAAK,UAAU,UAAU,UAAU;GACnC,KAAK,QAAQ;GACb,KAAK,IAAI,SAAS,QAAQ;IACtB,gBAAgB;IAChB;GACJ,KAAK,IAAI,WAAW,OAAO;IACvB,gBAAgB;IAChB;GACJ,KAAK,0BAA0B,KAAK,GAAG;IACnC,IAAI,CAAC,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,IAAI,GACzC,gBAAgB,UAAU,YAAY,YAAY;SAGlD,gBAAgB;IAEpB;GACJ,KAAK,UAAU,aAAa,IAAI,WAAW,KAAK;IAC5C,gBAAgB;IAChB;GACJ,KAAK,UAAU;IACX,gBAAgB,IAAI,WAAW,KAAK,IAAI,cAAc;IACtD;EACR;EACA,IAAI,iBAAiB,IAAI,SAAS,WAAW,aAAa,MAAM,OAC5D,MAAM,IAAI,UAAU,+DAA+D,cAAc,eAAe;CAExH;CACA,OAAO;AACX;AACA,IAAM,sBAAsB,KAAK,KAAK,UAAU;CAC5C,IAAI,eAAe,YACf;CACJ,IAAIC,MAAU,GAAG,GAAG;EAChB,IAAIC,YAAgB,GAAG,KAAK,aAAa,KAAK,KAAK,KAAK,GACpD;EACJ,MAAM,IAAI,UAAU,yHAAyH;CACjJ;CACA,IAAI,CAAC,UAAU,GAAG,GACd,MAAM,IAAI,UAAUC,QAAgB,KAAK,KAAK,aAAa,aAAa,gBAAgB,YAAY,CAAC;CAEzG,IAAI,IAAI,SAAS,UACb,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,6DAA6D;AAErG;AACA,IAAM,uBAAuB,KAAK,KAAK,UAAU;CAC7C,IAAIF,MAAU,GAAG,GACb,QAAQ,OAAR;EACI,KAAK;EACL,KAAK;GACD,IAAIG,aAAiB,GAAG,KAAK,aAAa,KAAK,KAAK,KAAK,GACrD;GACJ,MAAM,IAAI,UAAU,uDAAuD;EAC/E,KAAK;EACL,KAAK;GACD,IAAIC,YAAgB,GAAG,KAAK,aAAa,KAAK,KAAK,KAAK,GACpD;GACJ,MAAM,IAAI,UAAU,sDAAsD;CAClF;CAEJ,IAAI,CAAC,UAAU,GAAG,GACd,MAAM,IAAI,UAAUF,QAAgB,KAAK,KAAK,aAAa,aAAa,cAAc,CAAC;CAE3F,IAAI,IAAI,SAAS,UACb,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,kEAAkE;CAEtG,IAAI,IAAI,SAAS,UACb,QAAQ,OAAR;EACI,KAAK,QACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,sEAAsE;EAC1G,KAAK,WACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,yEAAyE;CACjH;CAEJ,IAAI,IAAI,SAAS,WACb,QAAQ,OAAR;EACI,KAAK,UACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,uEAAuE;EAC3G,KAAK,WACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,wEAAwE;CAChH;AAER;AACA,SAAgB,aAAa,KAAK,KAAK,OAAO;CAC1C,QAAQ,IAAI,UAAU,GAAG,CAAC,GAA1B;EACI,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,mBAAmB,KAAK,KAAK,KAAK;GAClC;EACJ,SACI,oBAAoB,KAAK,KAAK,KAAK;CAC3C;AACJ;;;AC9GA,eAAsB,gBAAgB,KAAK,KAAK,SAAS;CACrD,IAAI,CAAC,SAAS,GAAG,GACb,MAAM,IAAI,WAAW,iCAAiC;CAE1D,IAAI,IAAI,cAAc,KAAA,KAAa,IAAI,WAAW,KAAA,GAC9C,MAAM,IAAI,WAAW,2EAAuE;CAEhG,IAAI,IAAI,cAAc,KAAA,KAAa,OAAO,IAAI,cAAc,UACxD,MAAM,IAAI,WAAW,qCAAqC;CAE9D,IAAI,IAAI,YAAY,KAAA,GAChB,MAAM,IAAI,WAAW,qBAAqB;CAE9C,IAAI,OAAO,IAAI,cAAc,UACzB,MAAM,IAAI,WAAW,yCAAyC;CAElE,IAAI,IAAI,WAAW,KAAA,KAAa,CAAC,SAAS,IAAI,MAAM,GAChD,MAAM,IAAI,WAAW,uCAAuC;CAEhE,IAAI,aAAa,CAAC;CAClB,IAAI,IAAI,WACJ,IAAI;EACA,MAAM,kBAAkBG,OAAK,IAAI,SAAS;EAC1C,aAAa,KAAK,MAAM,QAAQ,OAAO,eAAe,CAAC;CAC3D,QACM;EACF,MAAM,IAAI,WAAW,iCAAiC;CAC1D;CAEJ,IAAI,CAAC,WAAW,YAAY,IAAI,MAAM,GAClC,MAAM,IAAI,WAAW,2EAA2E;CAEpG,MAAM,aAAa;EACf,GAAG;EACH,GAAG,IAAI;CACX;CACA,MAAM,aAAa,aAAa,4BAAY,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,SAAS,MAAM,YAAY,UAAU;CAC3G,IAAI,MAAM;CACV,IAAI,WAAW,IAAI,KAAK,GAAG;EACvB,MAAM,WAAW;EACjB,IAAI,OAAO,QAAQ,WACf,MAAM,IAAI,WAAW,2EAAyE;CAEtG;CACA,MAAM,EAAE,QAAQ;CAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,KAC5B,MAAM,IAAI,WAAW,6DAA2D;CAEpF,MAAM,aAAa,WAAW,mBAAmB,cAAc,QAAQ,UAAU;CACjF,IAAI,cAAc,CAAC,WAAW,IAAI,GAAG,GACjC,MAAM,IAAI,kBAAkB,wDAAsD;CAEtF,IAAI;MACI,OAAO,IAAI,YAAY,UACvB,MAAM,IAAI,WAAW,8BAA8B;CAAA,OAGtD,IAAI,OAAO,IAAI,YAAY,YAAY,EAAE,IAAI,mBAAmB,aACjE,MAAM,IAAI,WAAW,wDAAwD;CAEjF,IAAI,cAAc;CAClB,IAAI,OAAO,QAAQ,YAAY;EAC3B,MAAM,MAAM,IAAI,YAAY,GAAG;EAC/B,cAAc;CAClB;CACA,aAAa,KAAK,KAAK,QAAQ;CAC/B,MAAM,OAAO,OAAO,IAAI,cAAc,KAAA,IAAY,OAAO,IAAI,SAAS,oBAAI,IAAI,WAAW,GAAG,OAAO,GAAG,GAAG,OAAO,IAAI,YAAY,WAC1H,MACI,OAAO,IAAI,OAAO,IAClB,QAAQ,OAAO,IAAI,OAAO,IAC9B,IAAI,OAAO;CACjB,MAAM,YAAY,gBAAgB,IAAI,WAAW,aAAa,UAAU;CACxE,MAAM,IAAI,MAAM,aAAa,KAAK,GAAG;CAErC,IAAI,CAAC,MADkB,OAAO,KAAK,GAAG,WAAW,IAAI,GAEjD,MAAM,IAAI,+BAA+B;CAE7C,IAAI;CACJ,IAAI,KACA,UAAU,gBAAgB,IAAI,SAAS,WAAW,UAAU;MAE3D,IAAI,OAAO,IAAI,YAAY,UAC5B,UAAU,QAAQ,OAAO,IAAI,OAAO;MAGpC,UAAU,IAAI;CAElB,MAAM,SAAS,EAAE,QAAQ;CACzB,IAAI,IAAI,cAAc,KAAA,GAClB,OAAO,kBAAkB;CAE7B,IAAI,IAAI,WAAW,KAAA,GACf,OAAO,oBAAoB,IAAI;CAEnC,IAAI,aACA,OAAO;EAAE,GAAG;EAAQ,KAAK;CAAE;CAE/B,OAAO;AACX;;;AC1GA,eAAsB,cAAc,KAAK,KAAK,SAAS;CACnD,IAAI,eAAe,YACf,MAAM,QAAQ,OAAO,GAAG;CAE5B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,WAAW,4CAA4C;CAErE,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,GAAG,WAAW,WAAW,IAAI,MAAM,GAAG;CAC9E,IAAI,WAAW,GACX,MAAM,IAAI,WAAW,qBAAqB;CAE9C,MAAM,WAAW,MAAM,gBAAgB;EAAE;EAAS,WAAW;EAAiB;CAAU,GAAG,KAAK,OAAO;CACvG,MAAM,SAAS;EAAE,SAAS,SAAS;EAAS,iBAAiB,SAAS;CAAgB;CACtF,IAAI,OAAO,QAAQ,YACf,OAAO;EAAE,GAAG;EAAQ,KAAK,SAAS;CAAI;CAE1C,OAAO;AACX;;;ACjBA,IAAM,SAAS,SAAS,KAAK,MAAM,KAAK,QAAQ,IAAI,GAAI;AACxD,IAAM,SAAS;AACf,IAAM,OAAO,SAAS;AACtB,IAAM,MAAM,OAAO;AACnB,IAAM,OAAO,MAAM;AACnB,IAAM,OAAO,MAAM;AACnB,IAAM,QAAQ;AACd,SAAgB,KAAK,KAAK;CACtB,MAAM,UAAU,MAAM,KAAK,GAAG;CAC9B,IAAI,CAAC,WAAY,QAAQ,MAAM,QAAQ,IACnC,MAAM,IAAI,UAAU,4BAA4B;CAEpD,MAAM,QAAQ,WAAW,QAAQ,EAAE;CACnC,MAAM,OAAO,QAAQ,EAAE,CAAC,YAAY;CACpC,IAAI;CACJ,QAAQ,MAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,KAAK;GAC9B;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,MAAM;GACvC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,IAAI;GACrC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,GAAG;GACpC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,IAAI;GACrC;EACJ;GACI,cAAc,KAAK,MAAM,QAAQ,IAAI;GACrC;CACR;CACA,IAAI,QAAQ,OAAO,OAAO,QAAQ,OAAO,OACrC,OAAO,CAAC;CAEZ,OAAO;AACX;AAOA,IAAM,gBAAgB,UAAU;CAC5B,IAAI,MAAM,SAAS,GAAG,GAClB,OAAO,MAAM,YAAY;CAE7B,OAAO,eAAe,MAAM,YAAY;AAC5C;AACA,IAAM,yBAAyB,YAAY,cAAc;CACrD,IAAI,OAAO,eAAe,UACtB,OAAO,UAAU,SAAS,UAAU;CAExC,IAAI,MAAM,QAAQ,UAAU,GACxB,OAAO,UAAU,KAAK,IAAI,UAAU,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC;CAErE,OAAO;AACX;AACA,SAAgB,kBAAkB,iBAAiB,gBAAgB,UAAU,CAAC,GAAG;CAC7E,IAAI;CACJ,IAAI;EACA,UAAU,KAAK,MAAM,QAAQ,OAAO,cAAc,CAAC;CACvD,QACM,CACN;CACA,IAAI,CAAC,SAAS,OAAO,GACjB,MAAM,IAAI,WAAW,gDAAgD;CAEzE,MAAM,EAAE,QAAQ;CAChB,IAAI,QACC,OAAO,gBAAgB,QAAQ,YAC5B,aAAa,gBAAgB,GAAG,MAAM,aAAa,GAAG,IAC1D,MAAM,IAAI,yBAAyB,uCAAqC,SAAS,OAAO,cAAc;CAE1G,MAAM,EAAE,iBAAiB,CAAC,GAAG,QAAQ,SAAS,UAAU,gBAAgB;CACxE,MAAM,gBAAgB,CAAC,GAAG,cAAc;CACxC,IAAI,gBAAgB,KAAA,GAChB,cAAc,KAAK,KAAK;CAC5B,IAAI,aAAa,KAAA,GACb,cAAc,KAAK,KAAK;CAC5B,IAAI,YAAY,KAAA,GACZ,cAAc,KAAK,KAAK;CAC5B,IAAI,WAAW,KAAA,GACX,cAAc,KAAK,KAAK;CAC5B,KAAK,MAAM,SAAS,IAAI,IAAI,cAAc,QAAQ,CAAC,GAC/C,IAAI,EAAE,SAAS,UACX,MAAM,IAAI,yBAAyB,qBAAqB,MAAM,UAAU,SAAS,OAAO,SAAS;CAGzG,IAAI,UACA,EAAE,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM,EAAA,CAAG,SAAS,QAAQ,GAAG,GACjE,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,cAAc;CAErG,IAAI,WAAW,QAAQ,QAAQ,SAC3B,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,cAAc;CAErG,IAAI,YACA,CAAC,sBAAsB,QAAQ,KAAK,OAAO,aAAa,WAAW,CAAC,QAAQ,IAAI,QAAQ,GACxF,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,cAAc;CAErG,IAAI;CACJ,QAAQ,OAAO,QAAQ,gBAAvB;EACI,KAAK;GACD,YAAY,KAAK,QAAQ,cAAc;GACvC;EACJ,KAAK;GACD,YAAY,QAAQ;GACpB;EACJ,KAAK;GACD,YAAY;GACZ;EACJ,SACI,MAAM,IAAI,UAAU,oCAAoC;CAChE;CACA,MAAM,EAAE,gBAAgB;CACxB,MAAM,MAAM,MAAM,+BAAe,IAAI,KAAK,CAAC;CAC3C,KAAK,QAAQ,QAAQ,KAAA,KAAa,gBAAgB,OAAO,QAAQ,QAAQ,UACrE,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,SAAS;CAEhG,IAAI,QAAQ,QAAQ,KAAA,GAAW;EAC3B,IAAI,OAAO,QAAQ,QAAQ,UACvB,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,SAAS;EAEhG,IAAI,QAAQ,MAAM,MAAM,WACpB,MAAM,IAAI,yBAAyB,wCAAsC,SAAS,OAAO,cAAc;CAE/G;CACA,IAAI,QAAQ,QAAQ,KAAA,GAAW;EAC3B,IAAI,OAAO,QAAQ,QAAQ,UACvB,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,SAAS;EAEhG,IAAI,QAAQ,OAAO,MAAM,WACrB,MAAM,IAAI,WAAW,wCAAsC,SAAS,OAAO,cAAc;CAEjG;CACA,IAAI,aAAa;EACb,MAAM,MAAM,MAAM,QAAQ;EAC1B,MAAM,MAAM,OAAO,gBAAgB,WAAW,cAAc,KAAK,WAAW;EAC5E,IAAI,MAAM,YAAY,KAClB,MAAM,IAAI,WAAW,8DAA4D,SAAS,OAAO,cAAc;EAEnH,IAAI,MAAM,IAAI,WACV,MAAM,IAAI,yBAAyB,mEAAiE,SAAS,OAAO,cAAc;CAE1I;CACA,OAAO;AACX;;;ACrKA,eAAsB,UAAU,KAAK,KAAK,SAAS;CAC/C,MAAM,WAAW,MAAM,cAAc,KAAK,KAAK,OAAO;CACtD,IAAI,SAAS,gBAAgB,MAAM,SAAS,KAAK,KAAK,SAAS,gBAAgB,QAAQ,OACnF,MAAM,IAAI,WAAW,qCAAqC;CAG9D,MAAM,SAAS;EAAE,SADD,kBAAkB,SAAS,iBAAiB,SAAS,SAAS,OACvD;EAAG,iBAAiB,SAAS;CAAgB;CACpE,IAAI,OAAO,QAAQ,YACf,OAAO;EAAE,GAAG;EAAQ,KAAK,SAAS;CAAI;CAE1C,OAAO;AACX;;;ACXA,SAAS,cAAc,KAAK;CACxB,QAAQ,OAAO,QAAQ,YAAY,IAAI,MAAM,GAAG,CAAC,GAAjD;EACI,KAAK;EACL,KAAK,MACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,SACI,MAAM,IAAI,iBAAiB,kDAAgD;CACnF;AACJ;AACA,SAAS,WAAW,MAAM;CACtB,OAAQ,QACJ,OAAO,SAAS,YAChB,MAAM,QAAQ,KAAK,IAAI,KACvB,KAAK,KAAK,MAAM,SAAS;AACjC;AACA,SAAS,UAAU,KAAK;CACpB,OAAO,SAAS,GAAG;AACvB;AACA,IAAM,cAAN,MAAkB;CACd;CACA,0BAAU,IAAI,QAAQ;CACtB,YAAY,MAAM;EACd,IAAI,CAAC,WAAW,IAAI,GAChB,MAAM,IAAI,YAAY,4BAA4B;EAEtD,KAAKC,QAAQ,gBAAgB,IAAI;CACrC;CACA,OAAO;EACH,OAAO,KAAKA;CAChB;CACA,MAAM,OAAO,iBAAiB,OAAO;EACjC,MAAM,EAAE,KAAK,QAAQ;GAAE,GAAG;GAAiB,GAAG,OAAO;EAAO;EAC5D,MAAM,MAAM,cAAc,GAAG;EAC7B,MAAM,aAAa,KAAKA,MAAM,KAAK,QAAQ,QAAQ;GAC/C,IAAI,YAAY,QAAQ,IAAI;GAC5B,IAAI,aAAa,OAAO,QAAQ,UAC5B,YAAY,QAAQ,IAAI;GAE5B,IAAI,cAAc,OAAO,IAAI,QAAQ,YAAY,QAAQ,QACrD,YAAY,QAAQ,IAAI;GAE5B,IAAI,aAAa,OAAO,IAAI,QAAQ,UAChC,YAAY,IAAI,QAAQ;GAE5B,IAAI,aAAa,MAAM,QAAQ,IAAI,OAAO,GACtC,YAAY,IAAI,QAAQ,SAAS,QAAQ;GAE7C,IAAI,WACA,QAAQ,KAAR;IACI,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;IACJ,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;IACJ,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;IACJ,KAAK;IACL,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;GACR;GAEJ,OAAO;EACX,CAAC;EACD,MAAM,EAAE,GAAG,KAAK,WAAW;EAC3B,IAAI,WAAW,GACX,MAAM,IAAI,kBAAkB;EAEhC,IAAI,WAAW,GAAG;GACd,MAAM,QAAQ,IAAI,yBAAyB;GAC3C,MAAM,UAAU,KAAKC;GACrB,MAAM,OAAO,iBAAiB,mBAAmB;IAC7C,KAAK,MAAM,OAAO,YACd,IAAI;KACA,MAAM,MAAM,mBAAmB,SAAS,KAAK,GAAG;IACpD,QACM,CAAE;GAEhB;GACA,MAAM;EACV;EACA,OAAO,mBAAmB,KAAKA,SAAS,KAAK,GAAG;CACpD;AACJ;AACA,eAAe,mBAAmB,OAAO,KAAK,KAAK;CAC/C,MAAM,SAAS,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;CAC3D,IAAI,OAAO,SAAS,KAAA,GAAW;EAC3B,MAAM,MAAM,MAAM,UAAU;GAAE,GAAG;GAAK,KAAK;EAAK,GAAG,GAAG;EACtD,IAAI,eAAe,cAAc,IAAI,SAAS,UAC1C,MAAM,IAAI,YAAY,8CAA8C;EAExE,OAAO,OAAO;CAClB;CACA,OAAO,OAAO;AAClB;AACA,SAAgB,kBAAkB,MAAM;CACpC,MAAM,MAAM,IAAI,YAAY,IAAI;CAChC,MAAM,cAAc,OAAO,iBAAiB,UAAU,IAAI,OAAO,iBAAiB,KAAK;CACvF,OAAO,iBAAiB,aAAa,EACjC,MAAM;EACF,aAAa,gBAAgB,IAAI,KAAK,CAAC;EACvC,YAAY;EACZ,cAAc;EACd,UAAU;CACd,EACJ,CAAC;CACD,OAAO;AACX;;;ACnHA,SAAS,sBAAsB;CAC3B,OAAQ,OAAO,kBAAkB,eAC5B,OAAO,cAAc,eAAe,UAAU,cAAc,wBAC5D,OAAO,gBAAgB,eAAe,gBAAgB;AAC/D;AACA,IAAI;AACJ,IAAI,OAAO,cAAc,eAAe,CAAC,UAAU,WAAW,aAAa,cAAc,GAGrF,aAAa;AAEjB,IAAa,cAAc,OAAO;AAClC,eAAe,UAAU,KAAK,SAAS,QAAQ,YAAY,OAAO;CAC9D,MAAM,WAAW,MAAM,UAAU,KAAK;EAClC,QAAQ;EACR;EACA,UAAU;EACV;CACJ,CAAC,CAAC,CAAC,OAAO,QAAQ;EACd,IAAI,IAAI,SAAS,gBACb,MAAM,IAAI,YAAY;EAE1B,MAAM;CACV,CAAC;CACD,IAAI,SAAS,WAAW,KACpB,MAAM,IAAI,UAAU,yDAAyD;CAEjF,IAAI;EACA,OAAO,MAAM,SAAS,KAAK;CAC/B,QACM;EACF,MAAM,IAAI,UAAU,4DAA4D;CACpF;AACJ;AACA,IAAa,YAAY,OAAO;AAChC,SAAS,iBAAiB,OAAO,aAAa;CAC1C,IAAI,OAAO,UAAU,YAAY,UAAU,MACvC,OAAO;CAEX,IAAI,EAAE,SAAS,UAAU,OAAO,MAAM,QAAQ,YAAY,KAAK,IAAI,IAAI,MAAM,OAAO,aAChF,OAAO;CAEX,IAAI,EAAE,UAAU,UACZ,CAAC,SAAS,MAAM,IAAI,KACpB,CAAC,MAAM,QAAQ,MAAM,KAAK,IAAI,KAC9B,CAAC,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK,MAAM,QAAQ,GACrD,OAAO;CAEX,OAAO;AACX;AACA,IAAM,eAAN,MAAmB;CACf;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,YAAY,KAAK,SAAS;EACtB,IAAI,EAAE,eAAe,MACjB,MAAM,IAAI,UAAU,gCAAgC;EAExD,KAAKC,OAAO,IAAI,IAAI,IAAI,IAAI;EAC5B,KAAKC,mBACD,OAAO,SAAS,oBAAoB,WAAW,SAAS,kBAAkB;EAC9E,KAAKC,oBACD,OAAO,SAAS,qBAAqB,WAAW,SAAS,mBAAmB;EAChF,KAAKC,eAAe,OAAO,SAAS,gBAAgB,WAAW,SAAS,cAAc;EACtF,KAAKC,WAAW,IAAI,QAAQ,SAAS,OAAO;EAC5C,IAAI,cAAc,CAAC,KAAKA,SAAS,IAAI,YAAY,GAC7C,KAAKA,SAAS,IAAI,cAAc,UAAU;EAE9C,IAAI,CAAC,KAAKA,SAAS,IAAI,QAAQ,GAAG;GAC9B,KAAKA,SAAS,IAAI,UAAU,kBAAkB;GAC9C,KAAKA,SAAS,OAAO,UAAU,0BAA0B;EAC7D;EACA,KAAKC,eAAe,UAAU;EAC9B,IAAI,UAAU,eAAe,KAAA,GAAW;GACpC,KAAKC,SAAS,UAAU;GACxB,IAAI,iBAAiB,UAAU,YAAY,KAAKH,YAAY,GAAG;IAC3D,KAAKI,iBAAiB,KAAKD,OAAO;IAClC,KAAKE,SAAS,kBAAkB,KAAKF,OAAO,IAAI;GACpD;EACJ;CACJ;CACA,eAAe;EACX,OAAO,CAAC,CAAC,KAAKG;CAClB;CACA,cAAc;EACV,OAAO,OAAO,KAAKF,mBAAmB,WAChC,KAAK,IAAI,IAAI,KAAKA,iBAAiB,KAAKL,oBACxC;CACV;CACA,QAAQ;EACJ,OAAO,OAAO,KAAKK,mBAAmB,WAChC,KAAK,IAAI,IAAI,KAAKA,iBAAiB,KAAKJ,eACxC;CACV;CACA,OAAO;EACH,OAAO,KAAKK,QAAQ,KAAK;CAC7B;CACA,MAAM,OAAO,iBAAiB,OAAO;EACjC,IAAI,CAAC,KAAKA,UAAU,CAAC,KAAK,MAAM,GAC5B,MAAM,KAAK,OAAO;EAEtB,IAAI;GACA,OAAO,MAAM,KAAKA,OAAO,iBAAiB,KAAK;EACnD,SACO,KAAK;GACR,IAAI,eAAe;QACX,KAAK,YAAY,MAAM,OAAO;KAC9B,MAAM,KAAK,OAAO;KAClB,OAAO,KAAKA,OAAO,iBAAiB,KAAK;IAC7C;;GAEJ,MAAM;EACV;CACJ;CACA,MAAM,SAAS;EACX,IAAI,KAAKC,iBAAiB,oBAAoB,GAC1C,KAAKA,gBAAgB,KAAA;EAEzB,KAAKA,kBAAkB,UAAU,KAAKT,KAAK,MAAM,KAAKI,UAAU,YAAY,QAAQ,KAAKH,gBAAgB,GAAG,KAAKI,YAAY,CAAC,CACzH,MAAM,SAAS;GAChB,KAAKG,SAAS,kBAAkB,IAAI;GACpC,IAAI,KAAKF,QAAQ;IACb,KAAKA,OAAO,MAAM,KAAK,IAAI;IAC3B,KAAKA,OAAO,OAAO;GACvB;GACA,KAAKC,iBAAiB,KAAK,IAAI;GAC/B,KAAKE,gBAAgB,KAAA;EACzB,CAAC,CAAC,CACG,OAAO,QAAQ;GAChB,KAAKA,gBAAgB,KAAA;GACrB,MAAM;EACV,CAAC;EACD,MAAM,KAAKA;CACf;AACJ;AACA,SAAgB,mBAAmB,KAAK,SAAS;CAC7C,MAAM,MAAM,IAAI,aAAa,KAAK,OAAO;CACzC,MAAM,eAAe,OAAO,iBAAiB,UAAU,IAAI,OAAO,iBAAiB,KAAK;CACxF,OAAO,iBAAiB,cAAc;EAClC,aAAa;GACT,WAAW,IAAI,YAAY;GAC3B,YAAY;GACZ,cAAc;EAClB;EACA,OAAO;GACH,WAAW,IAAI,MAAM;GACrB,YAAY;GACZ,cAAc;EAClB;EACA,QAAQ;GACJ,aAAa,IAAI,OAAO;GACxB,YAAY;GACZ,cAAc;GACd,UAAU;EACd;EACA,WAAW;GACP,WAAW,IAAI,aAAa;GAC5B,YAAY;GACZ,cAAc;EAClB;EACA,MAAM;GACF,aAAa,IAAI,KAAK;GACtB,YAAY;GACZ,cAAc;GACd,UAAU;EACd;CACJ,CAAC;CACD,OAAO;AACX"}

package/dist/cli/claude-context.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { copyFileSync, existsSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { copyFileSync, existsSync, mkdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/cli/claude-context.ts
 /**

package/dist/index.js

@@ -124,7 +124,7 @@ async function getAuth(options) {
 		}
 	});
 	if (isKeycloakOptions(options)) {
-		const { KeycloakProvider } = await import("./chunks/keycloak-CzPHgI2z.js");
+		const { KeycloakProvider } = await import("./chunks/keycloak-hR2UOZ1n.js");
 		return new KeycloakProvider(options);
 	}
 	if (isCognitoOptions(options)) {
@@ -136,11 +136,11 @@ async function getAuth(options) {
 		return new NostrProvider(options);
 	}
 	if (isKanidmOptions(options)) {
-		const { KanidmProvider } = await import("./chunks/kanidm-DTcc6ufi.js");
+		const { KanidmProvider } = await import("./chunks/kanidm-YfZNisdt.js");
 		return new KanidmProvider(options);
 	}
 	if (isGoogleOptions(options)) {
-		const { GoogleProvider } = await import("./chunks/google-C_p8rExJ.js");
+		const { GoogleProvider } = await import("./chunks/google-D8L8_cDF.js");
 		return new GoogleProvider(options);
 	}
 	if (isGitHubOptions(options)) {