@happyvertical/auth 0.80.0 → 0.80.2

package/dist/chunks/decode_jwt-BvtACpi_.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode_jwt-BvtACpi_.js","names":["decodeBase64URL","jwk.isJWK","jwk.isSecretJWK","invalidKeyInput","jwk.isPrivateJWK","jwk.isPublicJWK","b64u","#jwks","#cached","#url","#timeoutDuration","#cooldownDuration","#cacheMaxAge","#headers","#customFetch","#cache","#jwksTimestamp","#local","#pendingFetch","b64u"],"sources":["../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/base64.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/util/base64url.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/crypto_key.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/invalid_key_input.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/util/errors.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/is_key_like.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/helpers.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/type_checks.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/signing.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/jwk_to_key.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/normalize_key.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/key/import.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/validate_crit.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/validate_algorithms.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/check_key_type.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jws/flattened/verify.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jws/compact/verify.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwt/verify.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwks/local.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwks/remote.js","../../../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/util/decode_jwt.js"],"sourcesContent":["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n    const size = buffers.reduce((acc, { length }) => acc + length, 0);\n    const buf = new Uint8Array(size);\n    let i = 0;\n    for (const buffer of buffers) {\n        buf.set(buffer, i);\n        i += buffer.length;\n    }\n    return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n    if (value < 0 || value >= MAX_INT32) {\n        throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n    }\n    buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n    const high = Math.floor(value / MAX_INT32);\n    const low = value % MAX_INT32;\n    const buf = new Uint8Array(8);\n    writeUInt32BE(buf, high, 0);\n    writeUInt32BE(buf, low, 4);\n    return buf;\n}\nexport function uint32be(value) {\n    const buf = new Uint8Array(4);\n    writeUInt32BE(buf, value);\n    return buf;\n}\nexport function encode(string) {\n    const bytes = new Uint8Array(string.length);\n    for (let i = 0; i < string.length; i++) {\n        const code = string.charCodeAt(i);\n        if (code > 127) {\n            throw new TypeError('non-ASCII string encountered in encode()');\n        }\n        bytes[i] = code;\n    }\n    return bytes;\n}\n","export function encodeBase64(input) {\n    if (Uint8Array.prototype.toBase64) {\n        return input.toBase64();\n    }\n    const CHUNK_SIZE = 0x8000;\n    const arr = [];\n    for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n    }\n    return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(encoded);\n    }\n    const binary = atob(encoded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n            alphabet: 'base64url',\n        });\n    }\n    let encoded = input;\n    if (encoded instanceof Uint8Array) {\n        encoded = decoder.decode(encoded);\n    }\n    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n    try {\n        return decodeBase64(encoded);\n    }\n    catch {\n        throw new TypeError('The input to be decoded is not correctly encoded.');\n    }\n}\nexport function encode(input) {\n    let unencoded = input;\n    if (typeof unencoded === 'string') {\n        unencoded = encoder.encode(unencoded);\n    }\n    if (Uint8Array.prototype.toBase64) {\n        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n    }\n    return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","const unusable = (name, prop = 'algorithm.name') => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nconst isAlgorithm = (algorithm, name) => algorithm.name === name;\nfunction getHashLength(hash) {\n    return parseInt(hash.name.slice(4), 10);\n}\nfunction checkHashLength(algorithm, expected) {\n    const actual = getHashLength(algorithm.hash);\n    if (actual !== expected)\n        throw unusable(`SHA-${expected}`, 'algorithm.hash');\n}\nfunction getNamedCurve(alg) {\n    switch (alg) {\n        case 'ES256':\n            return 'P-256';\n        case 'ES384':\n            return 'P-384';\n        case 'ES512':\n            return 'P-521';\n        default:\n            throw new Error('unreachable');\n    }\n}\nfunction checkUsage(key, usage) {\n    if (usage && !key.usages.includes(usage)) {\n        throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n    }\n}\nexport function checkSigCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512': {\n            if (!isAlgorithm(key.algorithm, 'HMAC'))\n                throw unusable('HMAC');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'RS256':\n        case 'RS384':\n        case 'RS512': {\n            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))\n                throw unusable('RSASSA-PKCS1-v1_5');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'PS256':\n        case 'PS384':\n        case 'PS512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))\n                throw unusable('RSA-PSS');\n            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));\n            break;\n        }\n        case 'Ed25519':\n        case 'EdDSA': {\n            if (!isAlgorithm(key.algorithm, 'Ed25519'))\n                throw unusable('Ed25519');\n            break;\n        }\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87': {\n            if (!isAlgorithm(key.algorithm, alg))\n                throw unusable(alg);\n            break;\n        }\n        case 'ES256':\n        case 'ES384':\n        case 'ES512': {\n            if (!isAlgorithm(key.algorithm, 'ECDSA'))\n                throw unusable('ECDSA');\n            const expected = getNamedCurve(alg);\n            const actual = key.algorithm.namedCurve;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.namedCurve');\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\nexport function checkEncCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'A128GCM':\n        case 'A192GCM':\n        case 'A256GCM': {\n            if (!isAlgorithm(key.algorithm, 'AES-GCM'))\n                throw unusable('AES-GCM');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'A128KW':\n        case 'A192KW':\n        case 'A256KW': {\n            if (!isAlgorithm(key.algorithm, 'AES-KW'))\n                throw unusable('AES-KW');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'ECDH': {\n            switch (key.algorithm.name) {\n                case 'ECDH':\n                case 'X25519':\n                    break;\n                default:\n                    throw unusable('ECDH or X25519');\n            }\n            break;\n        }\n        case 'PBES2-HS256+A128KW':\n        case 'PBES2-HS384+A192KW':\n        case 'PBES2-HS512+A256KW':\n            if (!isAlgorithm(key.algorithm, 'PBKDF2'))\n                throw unusable('PBKDF2');\n            break;\n        case 'RSA-OAEP':\n        case 'RSA-OAEP-256':\n        case 'RSA-OAEP-384':\n        case 'RSA-OAEP-512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))\n                throw unusable('RSA-OAEP');\n            checkHashLength(key.algorithm, parseInt(alg.slice(9), 10) || 1);\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\n","function message(msg, actual, ...types) {\n    types = types.filter(Boolean);\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `one of type ${types.join(', ')}, or ${last}.`;\n    }\n    else if (types.length === 2) {\n        msg += `one of type ${types[0]} or ${types[1]}.`;\n    }\n    else {\n        msg += `of type ${types[0]}.`;\n    }\n    if (actual == null) {\n        msg += ` Received ${actual}`;\n    }\n    else if (typeof actual === 'function' && actual.name) {\n        msg += ` Received function ${actual.name}`;\n    }\n    else if (typeof actual === 'object' && actual != null) {\n        if (actual.constructor?.name) {\n            msg += ` Received an instance of ${actual.constructor.name}`;\n        }\n    }\n    return msg;\n}\nexport const invalidKeyInput = (actual, ...types) => message('Key must be ', actual, ...types);\nexport const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);\n","export class JOSEError extends Error {\n    static code = 'ERR_JOSE_GENERIC';\n    code = 'ERR_JOSE_GENERIC';\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n    static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JWTExpired extends JOSEError {\n    static code = 'ERR_JWT_EXPIRED';\n    code = 'ERR_JWT_EXPIRED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n    static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n    code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n    static code = 'ERR_JOSE_NOT_SUPPORTED';\n    code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n    static code = 'ERR_JWE_DECRYPTION_FAILED';\n    code = 'ERR_JWE_DECRYPTION_FAILED';\n    constructor(message = 'decryption operation failed', options) {\n        super(message, options);\n    }\n}\nexport class JWEInvalid extends JOSEError {\n    static code = 'ERR_JWE_INVALID';\n    code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n    static code = 'ERR_JWS_INVALID';\n    code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n    static code = 'ERR_JWT_INVALID';\n    code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n    static code = 'ERR_JWK_INVALID';\n    code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n    static code = 'ERR_JWKS_INVALID';\n    code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n    static code = 'ERR_JWKS_NO_MATCHING_KEY';\n    code = 'ERR_JWKS_NO_MATCHING_KEY';\n    constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n    [Symbol.asyncIterator];\n    static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSTimeout extends JOSEError {\n    static code = 'ERR_JWKS_TIMEOUT';\n    code = 'ERR_JWKS_TIMEOUT';\n    constructor(message = 'request timed out', options) {\n        super(message, options);\n    }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n    static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    constructor(message = 'signature verification failed', options) {\n        super(message, options);\n    }\n}\n","export function assertCryptoKey(key) {\n    if (!isCryptoKey(key)) {\n        throw new Error('CryptoKey instance expected');\n    }\n}\nexport const isCryptoKey = (key) => {\n    if (key?.[Symbol.toStringTag] === 'CryptoKey')\n        return true;\n    try {\n        return key instanceof CryptoKey;\n    }\n    catch {\n        return false;\n    }\n};\nexport const isKeyObject = (key) => key?.[Symbol.toStringTag] === 'KeyObject';\nexport const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\n","import { decode } from '../util/base64url.js';\nexport const unprotected = Symbol();\nexport function assertNotSet(value, name) {\n    if (value) {\n        throw new TypeError(`${name} can only be called once`);\n    }\n}\nexport function decodeBase64url(value, label, ErrorClass) {\n    try {\n        return decode(value);\n    }\n    catch {\n        throw new ErrorClass(`Failed to base64url decode the ${label}`);\n    }\n}\nexport async function digest(algorithm, data) {\n    const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n    return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n        return false;\n    }\n    if (Object.getPrototypeOf(input) === null) {\n        return true;\n    }\n    let proto = input;\n    while (Object.getPrototypeOf(proto) !== null) {\n        proto = Object.getPrototypeOf(proto);\n    }\n    return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n    const sources = headers.filter(Boolean);\n    if (sources.length === 0 || sources.length === 1) {\n        return true;\n    }\n    let acc;\n    for (const header of sources) {\n        const parameters = Object.keys(header);\n        if (!acc || acc.size === 0) {\n            acc = new Set(parameters);\n            continue;\n        }\n        for (const parameter of parameters) {\n            if (acc.has(parameter)) {\n                return false;\n            }\n            acc.add(parameter);\n        }\n    }\n    return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nimport { checkSigCryptoKey } from './crypto_key.js';\nimport { invalidKeyInput } from './invalid_key_input.js';\nexport function checkKeyLength(alg, key) {\n    if (alg.startsWith('RS') || alg.startsWith('PS')) {\n        const { modulusLength } = key.algorithm;\n        if (typeof modulusLength !== 'number' || modulusLength < 2048) {\n            throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n        }\n    }\n}\nfunction subtleAlgorithm(alg, algorithm) {\n    const hash = `SHA-${alg.slice(-3)}`;\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512':\n            return { hash, name: 'HMAC' };\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { hash, name: 'RSA-PSS', saltLength: parseInt(alg.slice(-3), 10) >> 3 };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { hash, name: 'RSASSA-PKCS1-v1_5' };\n        case 'ES256':\n        case 'ES384':\n        case 'ES512':\n            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };\n        case 'Ed25519':\n        case 'EdDSA':\n            return { name: 'Ed25519' };\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return { name: alg };\n        default:\n            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n    }\n}\nasync function getSigKey(alg, key, usage) {\n    if (key instanceof Uint8Array) {\n        if (!alg.startsWith('HS')) {\n            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n        }\n        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);\n    }\n    checkSigCryptoKey(key, alg, usage);\n    return key;\n}\nexport async function sign(alg, key, data) {\n    const cryptoKey = await getSigKey(alg, key, 'sign');\n    checkKeyLength(alg, cryptoKey);\n    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);\n    return new Uint8Array(signature);\n}\nexport async function verify(alg, key, signature, data) {\n    const cryptoKey = await getSigKey(alg, key, 'verify');\n    checkKeyLength(alg, cryptoKey);\n    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);\n    try {\n        return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);\n    }\n    catch {\n        return false;\n    }\n}\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n    let algorithm;\n    let keyUsages;\n    switch (jwk.kty) {\n        case 'AKP': {\n            switch (jwk.alg) {\n                case 'ML-DSA-44':\n                case 'ML-DSA-65':\n                case 'ML-DSA-87':\n                    algorithm = { name: jwk.alg };\n                    keyUsages = jwk.priv ? ['sign'] : ['verify'];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'RSA': {\n            switch (jwk.alg) {\n                case 'PS256':\n                case 'PS384':\n                case 'PS512':\n                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RS256':\n                case 'RS384':\n                case 'RS512':\n                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RSA-OAEP':\n                case 'RSA-OAEP-256':\n                case 'RSA-OAEP-384':\n                case 'RSA-OAEP-512':\n                    algorithm = {\n                        name: 'RSA-OAEP',\n                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n                    };\n                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'EC': {\n            switch (jwk.alg) {\n                case 'ES256':\n                case 'ES384':\n                case 'ES512':\n                    algorithm = {\n                        name: 'ECDSA',\n                        namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n                    };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        case 'OKP': {\n            switch (jwk.alg) {\n                case 'Ed25519':\n                case 'EdDSA':\n                    algorithm = { name: 'Ed25519' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported(unsupportedAlg);\n            }\n            break;\n        }\n        default:\n            throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n    }\n    return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n    if (!jwk.alg) {\n        throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n    }\n    const { algorithm, keyUsages } = subtleMapping(jwk);\n    const keyData = { ...jwk };\n    if (keyData.kty !== 'AKP') {\n        delete keyData.alg;\n    }\n    delete keyData.use;\n    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { isJWK } from './type_checks.js';\nimport { decode } from '../util/base64url.js';\nimport { jwkToKey } from './jwk_to_key.js';\nimport { isCryptoKey, isKeyObject } from './is_key_like.js';\nconst unusableForAlg = 'given KeyObject instance cannot be used for this algorithm';\nlet cache;\nconst handleJWK = async (key, jwk, alg, freeze = false) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(key);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const cryptoKey = await jwkToKey({ ...jwk, alg });\n    if (freeze)\n        Object.freeze(key);\n    if (!cached) {\n        cache.set(key, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nconst handleKeyObject = (keyObject, alg) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(keyObject);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const isPublic = keyObject.type === 'public';\n    const extractable = isPublic ? true : false;\n    let cryptoKey;\n    if (keyObject.asymmetricKeyType === 'x25519') {\n        switch (alg) {\n            case 'ECDH-ES':\n            case 'ECDH-ES+A128KW':\n            case 'ECDH-ES+A192KW':\n            case 'ECDH-ES+A256KW':\n                break;\n            default:\n                throw new TypeError(unusableForAlg);\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);\n    }\n    if (keyObject.asymmetricKeyType === 'ed25519') {\n        if (alg !== 'EdDSA' && alg !== 'Ed25519') {\n            throw new TypeError(unusableForAlg);\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n            isPublic ? 'verify' : 'sign',\n        ]);\n    }\n    switch (keyObject.asymmetricKeyType) {\n        case 'ml-dsa-44':\n        case 'ml-dsa-65':\n        case 'ml-dsa-87': {\n            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {\n                throw new TypeError(unusableForAlg);\n            }\n            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n                isPublic ? 'verify' : 'sign',\n            ]);\n        }\n    }\n    if (keyObject.asymmetricKeyType === 'rsa') {\n        let hash;\n        switch (alg) {\n            case 'RSA-OAEP':\n                hash = 'SHA-1';\n                break;\n            case 'RS256':\n            case 'PS256':\n            case 'RSA-OAEP-256':\n                hash = 'SHA-256';\n                break;\n            case 'RS384':\n            case 'PS384':\n            case 'RSA-OAEP-384':\n                hash = 'SHA-384';\n                break;\n            case 'RS512':\n            case 'PS512':\n            case 'RSA-OAEP-512':\n                hash = 'SHA-512';\n                break;\n            default:\n                throw new TypeError(unusableForAlg);\n        }\n        if (alg.startsWith('RSA-OAEP')) {\n            return keyObject.toCryptoKey({\n                name: 'RSA-OAEP',\n                hash,\n            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);\n        }\n        cryptoKey = keyObject.toCryptoKey({\n            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',\n            hash,\n        }, extractable, [isPublic ? 'verify' : 'sign']);\n    }\n    if (keyObject.asymmetricKeyType === 'ec') {\n        const nist = new Map([\n            ['prime256v1', 'P-256'],\n            ['secp384r1', 'P-384'],\n            ['secp521r1', 'P-521'],\n        ]);\n        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);\n        if (!namedCurve) {\n            throw new TypeError(unusableForAlg);\n        }\n        const expectedCurve = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' };\n        if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg.startsWith('ECDH-ES')) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDH',\n                namedCurve,\n            }, extractable, isPublic ? [] : ['deriveBits']);\n        }\n    }\n    if (!cryptoKey) {\n        throw new TypeError(unusableForAlg);\n    }\n    if (!cached) {\n        cache.set(keyObject, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nexport async function normalizeKey(key, alg) {\n    if (key instanceof Uint8Array) {\n        return key;\n    }\n    if (isCryptoKey(key)) {\n        return key;\n    }\n    if (isKeyObject(key)) {\n        if (key.type === 'secret') {\n            return key.export();\n        }\n        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {\n            try {\n                return handleKeyObject(key, alg);\n            }\n            catch (err) {\n                if (err instanceof TypeError) {\n                    throw err;\n                }\n            }\n        }\n        let jwk = key.export({ format: 'jwk' });\n        return handleJWK(key, jwk, alg);\n    }\n    if (isJWK(key)) {\n        if (key.k) {\n            return decode(key.k);\n        }\n        return handleJWK(key, key, alg, true);\n    }\n    throw new Error('unreachable');\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n        throw new TypeError('\"spki\" must be SPKI formatted string');\n    }\n    return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n        throw new TypeError('\"x509\" must be X.509 formatted string');\n    }\n    return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n        throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n    }\n    return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n    if (!isObject(jwk)) {\n        throw new TypeError('JWK must be an object');\n    }\n    let ext;\n    alg ??= jwk.alg;\n    ext ??= options?.extractable ?? jwk.ext;\n    switch (jwk.kty) {\n        case 'oct':\n            if (typeof jwk.k !== 'string' || !jwk.k) {\n                throw new TypeError('missing \"k\" (Key Value) Parameter value');\n            }\n            return decodeBase64URL(jwk.k);\n        case 'RSA':\n            if ('oth' in jwk && jwk.oth !== undefined) {\n                throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n            }\n            return jwkToKey({ ...jwk, alg, ext });\n        case 'AKP': {\n            if (typeof jwk.alg !== 'string' || !jwk.alg) {\n                throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n            }\n            if (alg !== undefined && alg !== jwk.alg) {\n                throw new TypeError('JWK alg and alg option value mismatch');\n            }\n            return jwkToKey({ ...jwk, ext });\n        }\n        case 'EC':\n        case 'OKP':\n            return jwkToKey({ ...jwk, alg, ext });\n        default:\n            throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n    }\n}\n","import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';\nexport function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n    }\n    if (!protectedHeader || protectedHeader.crit === undefined) {\n        return new Set();\n    }\n    if (!Array.isArray(protectedHeader.crit) ||\n        protectedHeader.crit.length === 0 ||\n        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n    }\n    let recognized;\n    if (recognizedOption !== undefined) {\n        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);\n    }\n    else {\n        recognized = recognizedDefault;\n    }\n    for (const parameter of protectedHeader.crit) {\n        if (!recognized.has(parameter)) {\n            throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n        }\n        if (joseHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n        }\n        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n        }\n    }\n    return new Set(protectedHeader.crit);\n}\n","export function validateAlgorithms(option, algorithms) {\n    if (algorithms !== undefined &&\n        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {\n        throw new TypeError(`\"${option}\" option must be an array of strings`);\n    }\n    if (!algorithms) {\n        return undefined;\n    }\n    return new Set(algorithms);\n}\n","import { withAlg as invalidKeyInput } from './invalid_key_input.js';\nimport { isKeyLike } from './is_key_like.js';\nimport * as jwk from './type_checks.js';\nconst tag = (key) => key?.[Symbol.toStringTag];\nconst jwkMatchesOp = (alg, key, usage) => {\n    if (key.use !== undefined) {\n        let expected;\n        switch (usage) {\n            case 'sign':\n            case 'verify':\n                expected = 'sig';\n                break;\n            case 'encrypt':\n            case 'decrypt':\n                expected = 'enc';\n                break;\n        }\n        if (key.use !== expected) {\n            throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n        }\n    }\n    if (key.alg !== undefined && key.alg !== alg) {\n        throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n    }\n    if (Array.isArray(key.key_ops)) {\n        let expectedKeyOp;\n        switch (true) {\n            case usage === 'sign' || usage === 'verify':\n            case alg === 'dir':\n            case alg.includes('CBC-HS'):\n                expectedKeyOp = usage;\n                break;\n            case alg.startsWith('PBES2'):\n                expectedKeyOp = 'deriveBits';\n                break;\n            case /^A\\d{3}(?:GCM)?(?:KW)?$/.test(alg):\n                if (!alg.includes('GCM') && alg.endsWith('KW')) {\n                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';\n                }\n                else {\n                    expectedKeyOp = usage;\n                }\n                break;\n            case usage === 'encrypt' && alg.startsWith('RSA'):\n                expectedKeyOp = 'wrapKey';\n                break;\n            case usage === 'decrypt':\n                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';\n                break;\n        }\n        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {\n            throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n        }\n    }\n    return true;\n};\nconst symmetricTypeCheck = (alg, key, usage) => {\n    if (key instanceof Uint8Array)\n        return;\n    if (jwk.isJWK(key)) {\n        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))\n            return;\n        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present`);\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));\n    }\n    if (key.type !== 'secret') {\n        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type \"secret\"`);\n    }\n};\nconst asymmetricTypeCheck = (alg, key, usage) => {\n    if (jwk.isJWK(key)) {\n        switch (usage) {\n            case 'decrypt':\n            case 'sign':\n                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation must be a private JWK`);\n            case 'encrypt':\n            case 'verify':\n                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation must be a public JWK`);\n        }\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n    }\n    if (key.type === 'secret') {\n        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type \"secret\"`);\n    }\n    if (key.type === 'public') {\n        switch (usage) {\n            case 'sign':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type \"private\"`);\n            case 'decrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type \"private\"`);\n        }\n    }\n    if (key.type === 'private') {\n        switch (usage) {\n            case 'verify':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type \"public\"`);\n            case 'encrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type \"public\"`);\n        }\n    }\n};\nexport function checkKeyType(alg, key, usage) {\n    switch (alg.substring(0, 2)) {\n        case 'A1':\n        case 'A2':\n        case 'di':\n        case 'HS':\n        case 'PB':\n            symmetricTypeCheck(alg, key, usage);\n            break;\n        default:\n            asymmetricTypeCheck(alg, key, usage);\n    }\n}\n","import { decode as b64u } from '../../util/base64url.js';\nimport { verify } from '../../lib/signing.js';\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';\nimport { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';\nimport { decodeBase64url } from '../../lib/helpers.js';\nimport { isDisjoint } from '../../lib/type_checks.js';\nimport { isObject } from '../../lib/type_checks.js';\nimport { checkKeyType } from '../../lib/check_key_type.js';\nimport { validateCrit } from '../../lib/validate_crit.js';\nimport { validateAlgorithms } from '../../lib/validate_algorithms.js';\nimport { normalizeKey } from '../../lib/normalize_key.js';\nexport async function flattenedVerify(jws, key, options) {\n    if (!isObject(jws)) {\n        throw new JWSInvalid('Flattened JWS must be an object');\n    }\n    if (jws.protected === undefined && jws.header === undefined) {\n        throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n    }\n    if (jws.protected !== undefined && typeof jws.protected !== 'string') {\n        throw new JWSInvalid('JWS Protected Header incorrect type');\n    }\n    if (jws.payload === undefined) {\n        throw new JWSInvalid('JWS Payload missing');\n    }\n    if (typeof jws.signature !== 'string') {\n        throw new JWSInvalid('JWS Signature missing or incorrect type');\n    }\n    if (jws.header !== undefined && !isObject(jws.header)) {\n        throw new JWSInvalid('JWS Unprotected Header incorrect type');\n    }\n    let parsedProt = {};\n    if (jws.protected) {\n        try {\n            const protectedHeader = b64u(jws.protected);\n            parsedProt = JSON.parse(decoder.decode(protectedHeader));\n        }\n        catch {\n            throw new JWSInvalid('JWS Protected Header is invalid');\n        }\n    }\n    if (!isDisjoint(parsedProt, jws.header)) {\n        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');\n    }\n    const joseHeader = {\n        ...parsedProt,\n        ...jws.header,\n    };\n    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);\n    let b64 = true;\n    if (extensions.has('b64')) {\n        b64 = parsedProt.b64;\n        if (typeof b64 !== 'boolean') {\n            throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n        }\n    }\n    const { alg } = joseHeader;\n    if (typeof alg !== 'string' || !alg) {\n        throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n    }\n    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);\n    if (algorithms && !algorithms.has(alg)) {\n        throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n    }\n    if (b64) {\n        if (typeof jws.payload !== 'string') {\n            throw new JWSInvalid('JWS Payload must be a string');\n        }\n    }\n    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {\n        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');\n    }\n    let resolvedKey = false;\n    if (typeof key === 'function') {\n        key = await key(parsedProt, jws);\n        resolvedKey = true;\n    }\n    checkKeyType(alg, key, 'verify');\n    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'\n        ? b64\n            ? encode(jws.payload)\n            : encoder.encode(jws.payload)\n        : jws.payload);\n    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);\n    const k = await normalizeKey(key, alg);\n    const verified = await verify(alg, k, signature, data);\n    if (!verified) {\n        throw new JWSSignatureVerificationFailed();\n    }\n    let payload;\n    if (b64) {\n        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);\n    }\n    else if (typeof jws.payload === 'string') {\n        payload = encoder.encode(jws.payload);\n    }\n    else {\n        payload = jws.payload;\n    }\n    const result = { payload };\n    if (jws.protected !== undefined) {\n        result.protectedHeader = parsedProt;\n    }\n    if (jws.header !== undefined) {\n        result.unprotectedHeader = jws.header;\n    }\n    if (resolvedKey) {\n        return { ...result, key: k };\n    }\n    return result;\n}\n","import { flattenedVerify } from '../flattened/verify.js';\nimport { JWSInvalid } from '../../util/errors.js';\nimport { decoder } from '../../lib/buffer_utils.js';\nexport async function compactVerify(jws, key, options) {\n    if (jws instanceof Uint8Array) {\n        jws = decoder.decode(jws);\n    }\n    if (typeof jws !== 'string') {\n        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');\n    }\n    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');\n    if (length !== 3) {\n        throw new JWSInvalid('Invalid Compact JWS');\n    }\n    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);\n    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';\nimport { encoder, decoder } from './buffer_utils.js';\nimport { isObject } from './type_checks.js';\nconst epoch = (date) => Math.floor(date.getTime() / 1000);\nconst minute = 60;\nconst hour = minute * 60;\nconst day = hour * 24;\nconst week = day * 7;\nconst year = day * 365.25;\nconst REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;\nexport function secs(str) {\n    const matched = REGEX.exec(str);\n    if (!matched || (matched[4] && matched[1])) {\n        throw new TypeError('Invalid time period format');\n    }\n    const value = parseFloat(matched[2]);\n    const unit = matched[3].toLowerCase();\n    let numericDate;\n    switch (unit) {\n        case 'sec':\n        case 'secs':\n        case 'second':\n        case 'seconds':\n        case 's':\n            numericDate = Math.round(value);\n            break;\n        case 'minute':\n        case 'minutes':\n        case 'min':\n        case 'mins':\n        case 'm':\n            numericDate = Math.round(value * minute);\n            break;\n        case 'hour':\n        case 'hours':\n        case 'hr':\n        case 'hrs':\n        case 'h':\n            numericDate = Math.round(value * hour);\n            break;\n        case 'day':\n        case 'days':\n        case 'd':\n            numericDate = Math.round(value * day);\n            break;\n        case 'week':\n        case 'weeks':\n        case 'w':\n            numericDate = Math.round(value * week);\n            break;\n        default:\n            numericDate = Math.round(value * year);\n            break;\n    }\n    if (matched[1] === '-' || matched[4] === 'ago') {\n        return -numericDate;\n    }\n    return numericDate;\n}\nfunction validateInput(label, input) {\n    if (!Number.isFinite(input)) {\n        throw new TypeError(`Invalid ${label} input`);\n    }\n    return input;\n}\nconst normalizeTyp = (value) => {\n    if (value.includes('/')) {\n        return value.toLowerCase();\n    }\n    return `application/${value.toLowerCase()}`;\n};\nconst checkAudiencePresence = (audPayload, audOption) => {\n    if (typeof audPayload === 'string') {\n        return audOption.includes(audPayload);\n    }\n    if (Array.isArray(audPayload)) {\n        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));\n    }\n    return false;\n};\nexport function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n    let payload;\n    try {\n        payload = JSON.parse(decoder.decode(encodedPayload));\n    }\n    catch {\n    }\n    if (!isObject(payload)) {\n        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');\n    }\n    const { typ } = options;\n    if (typ &&\n        (typeof protectedHeader.typ !== 'string' ||\n            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {\n        throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, 'typ', 'check_failed');\n    }\n    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;\n    const presenceCheck = [...requiredClaims];\n    if (maxTokenAge !== undefined)\n        presenceCheck.push('iat');\n    if (audience !== undefined)\n        presenceCheck.push('aud');\n    if (subject !== undefined)\n        presenceCheck.push('sub');\n    if (issuer !== undefined)\n        presenceCheck.push('iss');\n    for (const claim of new Set(presenceCheck.reverse())) {\n        if (!(claim in payload)) {\n            throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, 'missing');\n        }\n    }\n    if (issuer &&\n        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {\n        throw new JWTClaimValidationFailed('unexpected \"iss\" claim value', payload, 'iss', 'check_failed');\n    }\n    if (subject && payload.sub !== subject) {\n        throw new JWTClaimValidationFailed('unexpected \"sub\" claim value', payload, 'sub', 'check_failed');\n    }\n    if (audience &&\n        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {\n        throw new JWTClaimValidationFailed('unexpected \"aud\" claim value', payload, 'aud', 'check_failed');\n    }\n    let tolerance;\n    switch (typeof options.clockTolerance) {\n        case 'string':\n            tolerance = secs(options.clockTolerance);\n            break;\n        case 'number':\n            tolerance = options.clockTolerance;\n            break;\n        case 'undefined':\n            tolerance = 0;\n            break;\n        default:\n            throw new TypeError('Invalid clockTolerance option type');\n    }\n    const { currentDate } = options;\n    const now = epoch(currentDate || new Date());\n    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {\n        throw new JWTClaimValidationFailed('\"iat\" claim must be a number', payload, 'iat', 'invalid');\n    }\n    if (payload.nbf !== undefined) {\n        if (typeof payload.nbf !== 'number') {\n            throw new JWTClaimValidationFailed('\"nbf\" claim must be a number', payload, 'nbf', 'invalid');\n        }\n        if (payload.nbf > now + tolerance) {\n            throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, 'nbf', 'check_failed');\n        }\n    }\n    if (payload.exp !== undefined) {\n        if (typeof payload.exp !== 'number') {\n            throw new JWTClaimValidationFailed('\"exp\" claim must be a number', payload, 'exp', 'invalid');\n        }\n        if (payload.exp <= now - tolerance) {\n            throw new JWTExpired('\"exp\" claim timestamp check failed', payload, 'exp', 'check_failed');\n        }\n    }\n    if (maxTokenAge) {\n        const age = now - payload.iat;\n        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);\n        if (age - tolerance > max) {\n            throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');\n        }\n        if (age < 0 - tolerance) {\n            throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');\n        }\n    }\n    return payload;\n}\nexport class JWTClaimsBuilder {\n    #payload;\n    constructor(payload) {\n        if (!isObject(payload)) {\n            throw new TypeError('JWT Claims Set MUST be an object');\n        }\n        this.#payload = structuredClone(payload);\n    }\n    data() {\n        return encoder.encode(JSON.stringify(this.#payload));\n    }\n    get iss() {\n        return this.#payload.iss;\n    }\n    set iss(value) {\n        this.#payload.iss = value;\n    }\n    get sub() {\n        return this.#payload.sub;\n    }\n    set sub(value) {\n        this.#payload.sub = value;\n    }\n    get aud() {\n        return this.#payload.aud;\n    }\n    set aud(value) {\n        this.#payload.aud = value;\n    }\n    set jti(value) {\n        this.#payload.jti = value;\n    }\n    set nbf(value) {\n        if (typeof value === 'number') {\n            this.#payload.nbf = validateInput('setNotBefore', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.nbf = validateInput('setNotBefore', epoch(value));\n        }\n        else {\n            this.#payload.nbf = epoch(new Date()) + secs(value);\n        }\n    }\n    set exp(value) {\n        if (typeof value === 'number') {\n            this.#payload.exp = validateInput('setExpirationTime', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.exp = validateInput('setExpirationTime', epoch(value));\n        }\n        else {\n            this.#payload.exp = epoch(new Date()) + secs(value);\n        }\n    }\n    set iat(value) {\n        if (value === undefined) {\n            this.#payload.iat = epoch(new Date());\n        }\n        else if (value instanceof Date) {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(value));\n        }\n        else if (typeof value === 'string') {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));\n        }\n        else {\n            this.#payload.iat = validateInput('setIssuedAt', value);\n        }\n    }\n}\n","import { compactVerify } from '../jws/compact/verify.js';\nimport { validateClaimsSet } from '../lib/jwt_claims_set.js';\nimport { JWTInvalid } from '../util/errors.js';\nexport async function jwtVerify(jwt, key, options) {\n    const verified = await compactVerify(jwt, key, options);\n    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {\n        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');\n    }\n    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n    const result = { payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import { importJWK } from '../key/import.js';\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nfunction getKtyFromAlg(alg) {\n    switch (typeof alg === 'string' && alg.slice(0, 2)) {\n        case 'RS':\n        case 'PS':\n            return 'RSA';\n        case 'ES':\n            return 'EC';\n        case 'Ed':\n            return 'OKP';\n        case 'ML':\n            return 'AKP';\n        default:\n            throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n    }\n}\nfunction isJWKSLike(jwks) {\n    return (jwks &&\n        typeof jwks === 'object' &&\n        Array.isArray(jwks.keys) &&\n        jwks.keys.every(isJWKLike));\n}\nfunction isJWKLike(key) {\n    return isObject(key);\n}\nclass LocalJWKSet {\n    #jwks;\n    #cached = new WeakMap();\n    constructor(jwks) {\n        if (!isJWKSLike(jwks)) {\n            throw new JWKSInvalid('JSON Web Key Set malformed');\n        }\n        this.#jwks = structuredClone(jwks);\n    }\n    jwks() {\n        return this.#jwks;\n    }\n    async getKey(protectedHeader, token) {\n        const { alg, kid } = { ...protectedHeader, ...token?.header };\n        const kty = getKtyFromAlg(alg);\n        const candidates = this.#jwks.keys.filter((jwk) => {\n            let candidate = kty === jwk.kty;\n            if (candidate && typeof kid === 'string') {\n                candidate = kid === jwk.kid;\n            }\n            if (candidate && (typeof jwk.alg === 'string' || kty === 'AKP')) {\n                candidate = alg === jwk.alg;\n            }\n            if (candidate && typeof jwk.use === 'string') {\n                candidate = jwk.use === 'sig';\n            }\n            if (candidate && Array.isArray(jwk.key_ops)) {\n                candidate = jwk.key_ops.includes('verify');\n            }\n            if (candidate) {\n                switch (alg) {\n                    case 'ES256':\n                        candidate = jwk.crv === 'P-256';\n                        break;\n                    case 'ES384':\n                        candidate = jwk.crv === 'P-384';\n                        break;\n                    case 'ES512':\n                        candidate = jwk.crv === 'P-521';\n                        break;\n                    case 'Ed25519':\n                    case 'EdDSA':\n                        candidate = jwk.crv === 'Ed25519';\n                        break;\n                }\n            }\n            return candidate;\n        });\n        const { 0: jwk, length } = candidates;\n        if (length === 0) {\n            throw new JWKSNoMatchingKey();\n        }\n        if (length !== 1) {\n            const error = new JWKSMultipleMatchingKeys();\n            const _cached = this.#cached;\n            error[Symbol.asyncIterator] = async function* () {\n                for (const jwk of candidates) {\n                    try {\n                        yield await importWithAlgCache(_cached, jwk, alg);\n                    }\n                    catch { }\n                }\n            };\n            throw error;\n        }\n        return importWithAlgCache(this.#cached, jwk, alg);\n    }\n}\nasync function importWithAlgCache(cache, jwk, alg) {\n    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);\n    if (cached[alg] === undefined) {\n        const key = await importJWK({ ...jwk, ext: true }, alg);\n        if (key instanceof Uint8Array || key.type !== 'public') {\n            throw new JWKSInvalid('JSON Web Key Set members must be public keys');\n        }\n        cached[alg] = key;\n    }\n    return cached[alg];\n}\nexport function createLocalJWKSet(jwks) {\n    const set = new LocalJWKSet(jwks);\n    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);\n    Object.defineProperties(localJWKSet, {\n        jwks: {\n            value: () => structuredClone(set.jwks()),\n            enumerable: false,\n            configurable: false,\n            writable: false,\n        },\n    });\n    return localJWKSet;\n}\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';\nimport { createLocalJWKSet } from './local.js';\nimport { isObject } from '../lib/type_checks.js';\nfunction isCloudflareWorkers() {\n    return (typeof WebSocketPair !== 'undefined' ||\n        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||\n        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));\n}\nlet USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'jose';\n    const VERSION = 'v6.2.2';\n    USER_AGENT = `${NAME}/${VERSION}`;\n}\nexport const customFetch = Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n    const response = await fetchImpl(url, {\n        method: 'GET',\n        signal,\n        redirect: 'manual',\n        headers,\n    }).catch((err) => {\n        if (err.name === 'TimeoutError') {\n            throw new JWKSTimeout();\n        }\n        throw err;\n    });\n    if (response.status !== 200) {\n        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');\n    }\n    try {\n        return await response.json();\n    }\n    catch {\n        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');\n    }\n}\nexport const jwksCache = Symbol();\nfunction isFreshJwksCache(input, cacheMaxAge) {\n    if (typeof input !== 'object' || input === null) {\n        return false;\n    }\n    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {\n        return false;\n    }\n    if (!('jwks' in input) ||\n        !isObject(input.jwks) ||\n        !Array.isArray(input.jwks.keys) ||\n        !Array.prototype.every.call(input.jwks.keys, isObject)) {\n        return false;\n    }\n    return true;\n}\nclass RemoteJWKSet {\n    #url;\n    #timeoutDuration;\n    #cooldownDuration;\n    #cacheMaxAge;\n    #jwksTimestamp;\n    #pendingFetch;\n    #headers;\n    #customFetch;\n    #local;\n    #cache;\n    constructor(url, options) {\n        if (!(url instanceof URL)) {\n            throw new TypeError('url must be an instance of URL');\n        }\n        this.#url = new URL(url.href);\n        this.#timeoutDuration =\n            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;\n        this.#cooldownDuration =\n            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;\n        this.#cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;\n        this.#headers = new Headers(options?.headers);\n        if (USER_AGENT && !this.#headers.has('User-Agent')) {\n            this.#headers.set('User-Agent', USER_AGENT);\n        }\n        if (!this.#headers.has('accept')) {\n            this.#headers.set('accept', 'application/json');\n            this.#headers.append('accept', 'application/jwk-set+json');\n        }\n        this.#customFetch = options?.[customFetch];\n        if (options?.[jwksCache] !== undefined) {\n            this.#cache = options?.[jwksCache];\n            if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {\n                this.#jwksTimestamp = this.#cache.uat;\n                this.#local = createLocalJWKSet(this.#cache.jwks);\n            }\n        }\n    }\n    pendingFetch() {\n        return !!this.#pendingFetch;\n    }\n    coolingDown() {\n        return typeof this.#jwksTimestamp === 'number'\n            ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration\n            : false;\n    }\n    fresh() {\n        return typeof this.#jwksTimestamp === 'number'\n            ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge\n            : false;\n    }\n    jwks() {\n        return this.#local?.jwks();\n    }\n    async getKey(protectedHeader, token) {\n        if (!this.#local || !this.fresh()) {\n            await this.reload();\n        }\n        try {\n            return await this.#local(protectedHeader, token);\n        }\n        catch (err) {\n            if (err instanceof JWKSNoMatchingKey) {\n                if (this.coolingDown() === false) {\n                    await this.reload();\n                    return this.#local(protectedHeader, token);\n                }\n            }\n            throw err;\n        }\n    }\n    async reload() {\n        if (this.#pendingFetch && isCloudflareWorkers()) {\n            this.#pendingFetch = undefined;\n        }\n        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)\n            .then((json) => {\n            this.#local = createLocalJWKSet(json);\n            if (this.#cache) {\n                this.#cache.uat = Date.now();\n                this.#cache.jwks = json;\n            }\n            this.#jwksTimestamp = Date.now();\n            this.#pendingFetch = undefined;\n        })\n            .catch((err) => {\n            this.#pendingFetch = undefined;\n            throw err;\n        });\n        await this.#pendingFetch;\n    }\n}\nexport function createRemoteJWKSet(url, options) {\n    const set = new RemoteJWKSet(url, options);\n    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);\n    Object.defineProperties(remoteJWKSet, {\n        coolingDown: {\n            get: () => set.coolingDown(),\n            enumerable: true,\n            configurable: false,\n        },\n        fresh: {\n            get: () => set.fresh(),\n            enumerable: true,\n            configurable: false,\n        },\n        reload: {\n            value: () => set.reload(),\n            enumerable: true,\n            configurable: false,\n            writable: false,\n        },\n        reloading: {\n            get: () => set.pendingFetch(),\n            enumerable: true,\n            configurable: false,\n        },\n        jwks: {\n            value: () => set.jwks(),\n            enumerable: true,\n            configurable: false,\n            writable: false,\n        },\n    });\n    return remoteJWKSet;\n}\n","import { decode as b64u } from './base64url.js';\nimport { decoder } from '../lib/buffer_utils.js';\nimport { isObject } from '../lib/type_checks.js';\nimport { JWTInvalid } from './errors.js';\nexport function decodeJwt(jwt) {\n    if (typeof jwt !== 'string')\n        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');\n    const { 1: payload, length } = jwt.split('.');\n    if (length === 5)\n        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');\n    if (length !== 3)\n        throw new JWTInvalid('Invalid JWT');\n    if (!payload)\n        throw new JWTInvalid('JWTs must contain a payload');\n    let decoded;\n    try {\n        decoded = b64u(payload);\n    }\n    catch {\n        throw new JWTInvalid('Failed to base64url decode the payload');\n    }\n    let result;\n    try {\n        result = JSON.parse(decoder.decode(decoded));\n    }\n    catch {\n        throw new JWTInvalid('Failed to parse the decoded payload as JSON');\n    }\n    if (!isObject(result))\n        throw new JWTInvalid('Invalid JWT Claims Set');\n    return result;\n}\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22],"mappings":";AAAA,IAAa,UAAU,IAAI,YAAY;AACvC,IAAa,UAAU,IAAI,YAAY;AAEvC,SAAgB,OAAO,GAAG,SAAS;CAC/B,MAAM,OAAO,QAAQ,QAAQ,KAAK,EAAE,aAAa,MAAM,QAAQ,CAAC;CAChE,MAAM,MAAM,IAAI,WAAW,IAAI;CAC/B,IAAI,IAAI;CACR,KAAK,MAAM,UAAU,SAAS;EAC1B,IAAI,IAAI,QAAQ,CAAC;EACjB,KAAK,OAAO;CAChB;CACA,OAAO;AACX;AAoBA,SAAgB,OAAO,QAAQ;CAC3B,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACpC,MAAM,OAAO,OAAO,WAAW,CAAC;EAChC,IAAI,OAAO,KACP,MAAM,IAAI,UAAU,0CAA0C;EAElE,MAAM,KAAK;CACf;CACA,OAAO;AACX;;;AC/BA,SAAgB,aAAa,SAAS;CAClC,IAAI,WAAW,YACX,OAAO,WAAW,WAAW,OAAO;CAExC,MAAM,SAAS,KAAK,OAAO;CAC3B,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAC/B,MAAM,KAAK,OAAO,WAAW,CAAC;CAElC,OAAO;AACX;;;ACnBA,SAAgB,OAAO,OAAO;CAC1B,IAAI,WAAW,YACX,OAAO,WAAW,WAAW,OAAO,UAAU,WAAW,QAAQ,QAAQ,OAAO,KAAK,GAAG,EACpF,UAAU,YACd,CAAC;CAEL,IAAI,UAAU;CACd,IAAI,mBAAmB,YACnB,UAAU,QAAQ,OAAO,OAAO;CAEpC,UAAU,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACtD,IAAI;EACA,OAAO,aAAa,OAAO;CAC/B,QACM;EACF,MAAM,IAAI,UAAU,mDAAmD;CAC3E;AACJ;;;ACnBA,IAAM,YAAY,MAAM,OAAO,qCAAqB,IAAI,UAAU,kDAAkD,KAAK,WAAW,MAAM;AAC1I,IAAM,eAAe,WAAW,SAAS,UAAU,SAAS;AAC5D,SAAS,cAAc,MAAM;CACzB,OAAO,SAAS,KAAK,KAAK,MAAM,CAAC,GAAG,EAAE;AAC1C;AACA,SAAS,gBAAgB,WAAW,UAAU;CAE1C,IADe,cAAc,UAAU,IAC9B,MAAM,UACX,MAAM,SAAS,OAAO,YAAY,gBAAgB;AAC1D;AACA,SAAS,cAAc,KAAK;CACxB,QAAQ,KAAR;EACI,KAAK,SACD,OAAO;EACX,KAAK,SACD,OAAO;EACX,KAAK,SACD,OAAO;EACX,SACI,MAAM,IAAI,MAAM,aAAa;CACrC;AACJ;AACA,SAAS,WAAW,KAAK,OAAO;CAC5B,IAAI,SAAS,CAAC,IAAI,OAAO,SAAS,KAAK,GACnC,MAAM,IAAI,UAAU,sEAAsE,MAAM,EAAE;AAE1G;AACA,SAAgB,kBAAkB,KAAK,KAAK,OAAO;CAC/C,QAAQ,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,MAAM,GAClC,MAAM,SAAS,MAAM;GACzB,gBAAgB,IAAI,WAAW,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;GACzD;EAEJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,mBAAmB,GAC/C,MAAM,SAAS,mBAAmB;GACtC,gBAAgB,IAAI,WAAW,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;GACzD;EAEJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,SAAS,GACrC,MAAM,SAAS,SAAS;GAC5B,gBAAgB,IAAI,WAAW,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;GACzD;EAEJ,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,SAAS,GACrC,MAAM,SAAS,SAAS;GAC5B;EAEJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,CAAC,YAAY,IAAI,WAAW,GAAG,GAC/B,MAAM,SAAS,GAAG;GACtB;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;GACV,IAAI,CAAC,YAAY,IAAI,WAAW,OAAO,GACnC,MAAM,SAAS,OAAO;GAC1B,MAAM,WAAW,cAAc,GAAG;GAElC,IADe,IAAI,UAAU,eACd,UACX,MAAM,SAAS,UAAU,sBAAsB;GACnD;EACJ;EACA,SACI,MAAM,IAAI,UAAU,2CAA2C;CACvE;CACA,WAAW,KAAK,KAAK;AACzB;;;ACjFA,SAAS,QAAQ,KAAK,QAAQ,GAAG,OAAO;CACpC,QAAQ,MAAM,OAAO,OAAO;CAC5B,IAAI,MAAM,SAAS,GAAG;EAClB,MAAM,OAAO,MAAM,IAAI;EACvB,OAAO,eAAe,MAAM,KAAK,IAAI,EAAE,OAAO,KAAK;CACvD,OACK,IAAI,MAAM,WAAW,GACtB,OAAO,eAAe,MAAM,GAAG,MAAM,MAAM,GAAG;MAG9C,OAAO,WAAW,MAAM,GAAG;CAE/B,IAAI,UAAU,MACV,OAAO,aAAa;MAEnB,IAAI,OAAO,WAAW,cAAc,OAAO,MAC5C,OAAO,sBAAsB,OAAO;MAEnC,IAAI,OAAO,WAAW,YAAY,UAAU;MACzC,OAAO,aAAa,MACpB,OAAO,4BAA4B,OAAO,YAAY;CAAA;CAG9D,OAAO;AACX;AACA,IAAa,mBAAmB,QAAQ,GAAG,UAAU,QAAQ,gBAAgB,QAAQ,GAAG,KAAK;AAC7F,IAAa,WAAW,KAAK,QAAQ,GAAG,UAAU,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,GAAG,KAAK;;;AC1BnH,IAAa,YAAb,cAA+B,MAAM;CACjC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,SAAS,SAAS;EAC1B,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO,KAAK,YAAY;EAC7B,MAAM,oBAAoB,MAAM,KAAK,WAAW;CACpD;AACJ;AACA,IAAa,2BAAb,cAA8C,UAAU;CACpD,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EACzE,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC;EACpD,KAAK,QAAQ;EACb,KAAK,SAAS;EACd,KAAK,UAAU;CACnB;AACJ;AACA,IAAa,aAAb,cAAgC,UAAU;CACtC,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EACzE,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC;EACpD,KAAK,QAAQ;EACb,KAAK,SAAS;EACd,KAAK,UAAU;CACnB;AACJ;AACA,IAAa,oBAAb,cAAuC,UAAU;CAC7C,OAAO,OAAO;CACd,OAAO;AACX;AACA,IAAa,mBAAb,cAAsC,UAAU;CAC5C,OAAO,OAAO;CACd,OAAO;AACX;AAYA,IAAa,aAAb,cAAgC,UAAU;CACtC,OAAO,OAAO;CACd,OAAO;AACX;AACA,IAAa,aAAb,cAAgC,UAAU;CACtC,OAAO,OAAO;CACd,OAAO;AACX;AAKA,IAAa,cAAb,cAAiC,UAAU;CACvC,OAAO,OAAO;CACd,OAAO;AACX;AACA,IAAa,oBAAb,cAAuC,UAAU;CAC7C,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,mDAAmD,SAAS;EAC9E,MAAM,SAAS,OAAO;CAC1B;AACJ;AACA,IAAa,2BAAb,cAA8C,UAAU;CACpD,CAAC,OAAO;CACR,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,wDAAwD,SAAS;EACnF,MAAM,SAAS,OAAO;CAC1B;AACJ;AACA,IAAa,cAAb,cAAiC,UAAU;CACvC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,qBAAqB,SAAS;EAChD,MAAM,SAAS,OAAO;CAC1B;AACJ;AACA,IAAa,iCAAb,cAAoD,UAAU;CAC1D,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,iCAAiC,SAAS;EAC5D,MAAM,SAAS,OAAO;CAC1B;AACJ;;;AC7FA,IAAa,eAAe,QAAQ;CAChC,IAAI,MAAM,OAAO,iBAAiB,aAC9B,OAAO;CACX,IAAI;EACA,OAAO,eAAe;CAC1B,QACM;EACF,OAAO;CACX;AACJ;AACA,IAAa,eAAe,QAAQ,MAAM,OAAO,iBAAiB;AAClE,IAAa,aAAa,QAAQ,YAAY,GAAG,KAAK,YAAY,GAAG;;;ACTrE,SAAgB,gBAAgB,OAAO,OAAO,YAAY;CACtD,IAAI;EACA,OAAO,OAAO,KAAK;CACvB,QACM;EACF,MAAM,IAAI,WAAW,kCAAkC,OAAO;CAClE;AACJ;;;ACdA,IAAM,gBAAgB,UAAU,OAAO,UAAU,YAAY,UAAU;AACvE,SAAgB,SAAS,OAAO;CAC5B,IAAI,CAAC,aAAa,KAAK,KAAK,OAAO,UAAU,SAAS,KAAK,KAAK,MAAM,mBAClE,OAAO;CAEX,IAAI,OAAO,eAAe,KAAK,MAAM,MACjC,OAAO;CAEX,IAAI,QAAQ;CACZ,OAAO,OAAO,eAAe,KAAK,MAAM,MACpC,QAAQ,OAAO,eAAe,KAAK;CAEvC,OAAO,OAAO,eAAe,KAAK,MAAM;AAC5C;AACA,SAAgB,WAAW,GAAG,SAAS;CACnC,MAAM,UAAU,QAAQ,OAAO,OAAO;CACtC,IAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAC3C,OAAO;CAEX,IAAI;CACJ,KAAK,MAAM,UAAU,SAAS;EAC1B,MAAM,aAAa,OAAO,KAAK,MAAM;EACrC,IAAI,CAAC,OAAO,IAAI,SAAS,GAAG;GACxB,MAAM,IAAI,IAAI,UAAU;GACxB;EACJ;EACA,KAAK,MAAM,aAAa,YAAY;GAChC,IAAI,IAAI,IAAI,SAAS,GACjB,OAAO;GAEX,IAAI,IAAI,SAAS;EACrB;CACJ;CACA,OAAO;AACX;AACA,IAAa,SAAS,QAAQ,SAAS,GAAG,KAAK,OAAO,IAAI,QAAQ;AAClE,IAAa,gBAAgB,QAAQ,IAAI,QAAQ,UAC3C,IAAI,QAAQ,SAAS,OAAO,IAAI,SAAS,YAAa,OAAO,IAAI,MAAM;AAC7E,IAAa,eAAe,QAAQ,IAAI,QAAQ,SAAS,IAAI,MAAM,KAAA,KAAa,IAAI,SAAS,KAAA;AAC7F,IAAa,eAAe,QAAQ,IAAI,QAAQ,SAAS,OAAO,IAAI,MAAM;;;ACpC1E,SAAgB,eAAe,KAAK,KAAK;CACrC,IAAI,IAAI,WAAW,IAAI,KAAK,IAAI,WAAW,IAAI,GAAG;EAC9C,MAAM,EAAE,kBAAkB,IAAI;EAC9B,IAAI,OAAO,kBAAkB,YAAY,gBAAgB,MACrD,MAAM,IAAI,UAAU,GAAG,IAAI,sDAAsD;CAEzF;AACJ;AACA,SAAS,gBAAgB,KAAK,WAAW;CACrC,MAAM,OAAO,OAAO,IAAI,MAAM,EAAE;CAChC,QAAQ,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;EAAO;EAChC,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;GAAW,YAAY,SAAS,IAAI,MAAM,EAAE,GAAG,EAAE,KAAK;EAAE;EACjF,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;EAAoB;EAC7C,KAAK;EACL,KAAK;EACL,KAAK,SACD,OAAO;GAAE;GAAM,MAAM;GAAS,YAAY,UAAU;EAAW;EACnE,KAAK;EACL,KAAK,SACD,OAAO,EAAE,MAAM,UAAU;EAC7B,KAAK;EACL,KAAK;EACL,KAAK,aACD,OAAO,EAAE,MAAM,IAAI;EACvB,SACI,MAAM,IAAI,iBAAiB,OAAO,IAAI,4DAA4D;CAC1G;AACJ;AACA,eAAe,UAAU,KAAK,KAAK,OAAO;CACtC,IAAI,eAAe,YAAY;EAC3B,IAAI,CAAC,IAAI,WAAW,IAAI,GACpB,MAAM,IAAI,UAAU,gBAAgB,KAAK,aAAa,aAAa,cAAc,CAAC;EAEtF,OAAO,OAAO,OAAO,UAAU,OAAO,KAAK;GAAE,MAAM,OAAO,IAAI,MAAM,EAAE;GAAK,MAAM;EAAO,GAAG,OAAO,CAAC,KAAK,CAAC;CAC7G;CACA,kBAAkB,KAAK,KAAK,KAAK;CACjC,OAAO;AACX;AAOA,eAAsB,OAAO,KAAK,KAAK,WAAW,MAAM;CACpD,MAAM,YAAY,MAAM,UAAU,KAAK,KAAK,QAAQ;CACpD,eAAe,KAAK,SAAS;CAC7B,MAAM,YAAY,gBAAgB,KAAK,UAAU,SAAS;CAC1D,IAAI;EACA,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,WAAW,WAAW,IAAI;CAC3E,QACM;EACF,OAAO;CACX;AACJ;;;AClEA,IAAM,iBAAiB;AACvB,SAAS,cAAc,KAAK;CACxB,IAAI;CACJ,IAAI;CACJ,QAAQ,IAAI,KAAZ;EACI,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY,EAAE,MAAM,IAAI,IAAI;KAC5B,YAAY,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ;KAC3C;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MAAE,MAAM;MAAW,MAAM,OAAO,IAAI,IAAI,MAAM,EAAE;KAAI;KAChE,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MAAE,MAAM;MAAqB,MAAM,OAAO,IAAI,IAAI,MAAM,EAAE;KAAI;KAC1E,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MACR,MAAM;MACN,MAAM,OAAO,SAAS,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,KAAK;KACpD;KACA,YAAY,IAAI,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,WAAW,SAAS;KACpE;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MACR,MAAM;MACN,YAAY;OAAE,OAAO;OAAS,OAAO;OAAS,OAAO;MAAQ,EAAE,IAAI;KACvE;KACA,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY;MAAE,MAAM;MAAQ,YAAY,IAAI;KAAI;KAChD,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC;KACtC;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,KAAK;GACD,QAAQ,IAAI,KAAZ;IACI,KAAK;IACL,KAAK;KACD,YAAY,EAAE,MAAM,UAAU;KAC9B,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;KACxC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;KACD,YAAY,EAAE,MAAM,IAAI,IAAI;KAC5B,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC;KACtC;IACJ,SACI,MAAM,IAAI,iBAAiB,cAAc;GACjD;GACA;EAEJ,SACI,MAAM,IAAI,iBAAiB,+DAA6D;CAChG;CACA,OAAO;EAAE;EAAW;CAAU;AAClC;AACA,eAAsB,SAAS,KAAK;CAChC,IAAI,CAAC,IAAI,KACL,MAAM,IAAI,UAAU,8DAA0D;CAElF,MAAM,EAAE,WAAW,cAAc,cAAc,GAAG;CAClD,MAAM,UAAU,EAAE,GAAG,IAAI;CACzB,IAAI,QAAQ,QAAQ,OAChB,OAAO,QAAQ;CAEnB,OAAO,QAAQ;CACf,OAAO,OAAO,OAAO,UAAU,OAAO,SAAS,WAAW,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,IAAI,WAAW,SAAS;AACrI;;;ACtGA,IAAM,iBAAiB;AACvB,IAAI;AACJ,IAAM,YAAY,OAAO,KAAK,KAAK,KAAK,SAAS,UAAU;CACvD,0BAAU,IAAI,QAAQ;CACtB,IAAI,SAAS,MAAM,IAAI,GAAG;CAC1B,IAAI,SAAS,MACT,OAAO,OAAO;CAElB,MAAM,YAAY,MAAM,SAAS;EAAE,GAAG;EAAK;CAAI,CAAC;CAChD,IAAI,QACA,OAAO,OAAO,GAAG;CACrB,IAAI,CAAC,QACD,MAAM,IAAI,KAAK,GAAG,MAAM,UAAU,CAAC;MAGnC,OAAO,OAAO;CAElB,OAAO;AACX;AACA,IAAM,mBAAmB,WAAW,QAAQ;CACxC,0BAAU,IAAI,QAAQ;CACtB,IAAI,SAAS,MAAM,IAAI,SAAS;CAChC,IAAI,SAAS,MACT,OAAO,OAAO;CAElB,MAAM,WAAW,UAAU,SAAS;CACpC,MAAM,cAAc,WAAW,OAAO;CACtC,IAAI;CACJ,IAAI,UAAU,sBAAsB,UAAU;EAC1C,QAAQ,KAAR;GACI,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,kBACD;GACJ,SACI,MAAM,IAAI,UAAU,cAAc;EAC1C;EACA,YAAY,UAAU,YAAY,UAAU,mBAAmB,aAAa,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;CAC9G;CACA,IAAI,UAAU,sBAAsB,WAAW;EAC3C,IAAI,QAAQ,WAAW,QAAQ,WAC3B,MAAM,IAAI,UAAU,cAAc;EAEtC,YAAY,UAAU,YAAY,UAAU,mBAAmB,aAAa,CACxE,WAAW,WAAW,MAC1B,CAAC;CACL;CACA,QAAQ,UAAU,mBAAlB;EACI,KAAK;EACL,KAAK;EACL,KAAK;GACD,IAAI,QAAQ,UAAU,kBAAkB,YAAY,GAChD,MAAM,IAAI,UAAU,cAAc;GAEtC,YAAY,UAAU,YAAY,UAAU,mBAAmB,aAAa,CACxE,WAAW,WAAW,MAC1B,CAAC;CAET;CACA,IAAI,UAAU,sBAAsB,OAAO;EACvC,IAAI;EACJ,QAAQ,KAAR;GACI,KAAK;IACD,OAAO;IACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,SACI,MAAM,IAAI,UAAU,cAAc;EAC1C;EACA,IAAI,IAAI,WAAW,UAAU,GACzB,OAAO,UAAU,YAAY;GACzB,MAAM;GACN;EACJ,GAAG,aAAa,WAAW,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC;EAExD,YAAY,UAAU,YAAY;GAC9B,MAAM,IAAI,WAAW,IAAI,IAAI,YAAY;GACzC;EACJ,GAAG,aAAa,CAAC,WAAW,WAAW,MAAM,CAAC;CAClD;CACA,IAAI,UAAU,sBAAsB,MAAM;EAMtC,MAAM,8BAAa,IALF,IAAI;GACjB,CAAC,cAAc,OAAO;GACtB,CAAC,aAAa,OAAO;GACrB,CAAC,aAAa,OAAO;EACzB,CACsB,EAAA,CAAE,IAAI,UAAU,sBAAsB,UAAU;EACtE,IAAI,CAAC,YACD,MAAM,IAAI,UAAU,cAAc;EAEtC,MAAM,gBAAgB;GAAE,OAAO;GAAS,OAAO;GAAS,OAAO;EAAQ;EACvE,IAAI,cAAc,QAAQ,eAAe,cAAc,MACnD,YAAY,UAAU,YAAY;GAC9B,MAAM;GACN;EACJ,GAAG,aAAa,CAAC,WAAW,WAAW,MAAM,CAAC;EAElD,IAAI,IAAI,WAAW,SAAS,GACxB,YAAY,UAAU,YAAY;GAC9B,MAAM;GACN;EACJ,GAAG,aAAa,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;CAEtD;CACA,IAAI,CAAC,WACD,MAAM,IAAI,UAAU,cAAc;CAEtC,IAAI,CAAC,QACD,MAAM,IAAI,WAAW,GAAG,MAAM,UAAU,CAAC;MAGzC,OAAO,OAAO;CAElB,OAAO;AACX;AACA,eAAsB,aAAa,KAAK,KAAK;CACzC,IAAI,eAAe,YACf,OAAO;CAEX,IAAI,YAAY,GAAG,GACf,OAAO;CAEX,IAAI,YAAY,GAAG,GAAG;EAClB,IAAI,IAAI,SAAS,UACb,OAAO,IAAI,OAAO;EAEtB,IAAI,iBAAiB,OAAO,OAAO,IAAI,gBAAgB,YACnD,IAAI;GACA,OAAO,gBAAgB,KAAK,GAAG;EACnC,SACO,KAAK;GACR,IAAI,eAAe,WACf,MAAM;EAEd;EAGJ,OAAO,UAAU,KADP,IAAI,OAAO,EAAE,QAAQ,MAAM,CACf,GAAK,GAAG;CAClC;CACA,IAAI,MAAM,GAAG,GAAG;EACZ,IAAI,IAAI,GACJ,OAAO,OAAO,IAAI,CAAC;EAEvB,OAAO,UAAU,KAAK,KAAK,KAAK,IAAI;CACxC;CACA,MAAM,IAAI,MAAM,aAAa;AACjC;;;AC9IA,eAAsB,UAAU,KAAK,KAAK,SAAS;CAC/C,IAAI,CAAC,SAAS,GAAG,GACb,MAAM,IAAI,UAAU,uBAAuB;CAE/C,IAAI;CACJ,QAAQ,IAAI;CACZ,QAAQ,SAAS,eAAe,IAAI;CACpC,QAAQ,IAAI,KAAZ;EACI,KAAK;GACD,IAAI,OAAO,IAAI,MAAM,YAAY,CAAC,IAAI,GAClC,MAAM,IAAI,UAAU,2CAAyC;GAEjE,OAAOA,OAAgB,IAAI,CAAC;EAChC,KAAK;GACD,IAAI,SAAS,OAAO,IAAI,QAAQ,KAAA,GAC5B,MAAM,IAAI,iBAAiB,sEAAoE;GAEnG,OAAO,SAAS;IAAE,GAAG;IAAK;IAAK;GAAI,CAAC;EACxC,KAAK;GACD,IAAI,OAAO,IAAI,QAAQ,YAAY,CAAC,IAAI,KACpC,MAAM,IAAI,UAAU,6CAA2C;GAEnE,IAAI,QAAQ,KAAA,KAAa,QAAQ,IAAI,KACjC,MAAM,IAAI,UAAU,uCAAuC;GAE/D,OAAO,SAAS;IAAE,GAAG;IAAK;GAAI,CAAC;EAEnC,KAAK;EACL,KAAK,OACD,OAAO,SAAS;GAAE,GAAG;GAAK;GAAK;EAAI,CAAC;EACxC,SACI,MAAM,IAAI,iBAAiB,gDAA8C;CACjF;AACJ;;;ACvDA,SAAgB,aAAa,KAAK,mBAAmB,kBAAkB,iBAAiB,YAAY;CAChG,IAAI,WAAW,SAAS,KAAA,KAAa,iBAAiB,SAAS,KAAA,GAC3D,MAAM,IAAI,IAAI,kEAAgE;CAElF,IAAI,CAAC,mBAAmB,gBAAgB,SAAS,KAAA,GAC7C,uBAAO,IAAI,IAAI;CAEnB,IAAI,CAAC,MAAM,QAAQ,gBAAgB,IAAI,KACnC,gBAAgB,KAAK,WAAW,KAChC,gBAAgB,KAAK,MAAM,UAAU,OAAO,UAAU,YAAY,MAAM,WAAW,CAAC,GACpF,MAAM,IAAI,IAAI,yFAAuF;CAEzG,IAAI;CACJ,IAAI,qBAAqB,KAAA,GACrB,aAAa,IAAI,IAAI,CAAC,GAAG,OAAO,QAAQ,gBAAgB,GAAG,GAAG,kBAAkB,QAAQ,CAAC,CAAC;MAG1F,aAAa;CAEjB,KAAK,MAAM,aAAa,gBAAgB,MAAM;EAC1C,IAAI,CAAC,WAAW,IAAI,SAAS,GACzB,MAAM,IAAI,iBAAiB,+BAA+B,UAAU,oBAAoB;EAE5F,IAAI,WAAW,eAAe,KAAA,GAC1B,MAAM,IAAI,IAAI,+BAA+B,UAAU,aAAa;EAExE,IAAI,WAAW,IAAI,SAAS,KAAK,gBAAgB,eAAe,KAAA,GAC5D,MAAM,IAAI,IAAI,+BAA+B,UAAU,8BAA8B;CAE7F;CACA,OAAO,IAAI,IAAI,gBAAgB,IAAI;AACvC;;;AChCA,SAAgB,mBAAmB,QAAQ,YAAY;CACnD,IAAI,eAAe,KAAA,MACd,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,MAAM,MAAM,OAAO,MAAM,QAAQ,IAC3E,MAAM,IAAI,UAAU,IAAI,OAAO,qCAAqC;CAExE,IAAI,CAAC,YACD;CAEJ,OAAO,IAAI,IAAI,UAAU;AAC7B;;;ACNA,IAAM,OAAO,QAAQ,MAAM,OAAO;AAClC,IAAM,gBAAgB,KAAK,KAAK,UAAU;CACtC,IAAI,IAAI,QAAQ,KAAA,GAAW;EACvB,IAAI;EACJ,QAAQ,OAAR;GACI,KAAK;GACL,KAAK;IACD,WAAW;IACX;GACJ,KAAK;GACL,KAAK;IACD,WAAW;IACX;EACR;EACA,IAAI,IAAI,QAAQ,UACZ,MAAM,IAAI,UAAU,sDAAsD,SAAS,eAAe;CAE1G;CACA,IAAI,IAAI,QAAQ,KAAA,KAAa,IAAI,QAAQ,KACrC,MAAM,IAAI,UAAU,sDAAsD,IAAI,eAAe;CAEjG,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG;EAC5B,IAAI;EACJ,QAAQ,MAAR;GACI,KAAK,UAAU,UAAU,UAAU;GACnC,KAAK,QAAQ;GACb,KAAK,IAAI,SAAS,QAAQ;IACtB,gBAAgB;IAChB;GACJ,KAAK,IAAI,WAAW,OAAO;IACvB,gBAAgB;IAChB;GACJ,KAAK,0BAA0B,KAAK,GAAG;IACnC,IAAI,CAAC,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,IAAI,GACzC,gBAAgB,UAAU,YAAY,YAAY;SAGlD,gBAAgB;IAEpB;GACJ,KAAK,UAAU,aAAa,IAAI,WAAW,KAAK;IAC5C,gBAAgB;IAChB;GACJ,KAAK,UAAU;IACX,gBAAgB,IAAI,WAAW,KAAK,IAAI,cAAc;IACtD;EACR;EACA,IAAI,iBAAiB,IAAI,SAAS,WAAW,aAAa,MAAM,OAC5D,MAAM,IAAI,UAAU,+DAA+D,cAAc,eAAe;CAExH;CACA,OAAO;AACX;AACA,IAAM,sBAAsB,KAAK,KAAK,UAAU;CAC5C,IAAI,eAAe,YACf;CACJ,IAAIC,MAAU,GAAG,GAAG;EAChB,IAAIC,YAAgB,GAAG,KAAK,aAAa,KAAK,KAAK,KAAK,GACpD;EACJ,MAAM,IAAI,UAAU,yHAAyH;CACjJ;CACA,IAAI,CAAC,UAAU,GAAG,GACd,MAAM,IAAI,UAAUC,QAAgB,KAAK,KAAK,aAAa,aAAa,gBAAgB,YAAY,CAAC;CAEzG,IAAI,IAAI,SAAS,UACb,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,6DAA6D;AAErG;AACA,IAAM,uBAAuB,KAAK,KAAK,UAAU;CAC7C,IAAIF,MAAU,GAAG,GACb,QAAQ,OAAR;EACI,KAAK;EACL,KAAK;GACD,IAAIG,aAAiB,GAAG,KAAK,aAAa,KAAK,KAAK,KAAK,GACrD;GACJ,MAAM,IAAI,UAAU,uDAAuD;EAC/E,KAAK;EACL,KAAK;GACD,IAAIC,YAAgB,GAAG,KAAK,aAAa,KAAK,KAAK,KAAK,GACpD;GACJ,MAAM,IAAI,UAAU,sDAAsD;CAClF;CAEJ,IAAI,CAAC,UAAU,GAAG,GACd,MAAM,IAAI,UAAUF,QAAgB,KAAK,KAAK,aAAa,aAAa,cAAc,CAAC;CAE3F,IAAI,IAAI,SAAS,UACb,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,kEAAkE;CAEtG,IAAI,IAAI,SAAS,UACb,QAAQ,OAAR;EACI,KAAK,QACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,sEAAsE;EAC1G,KAAK,WACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,yEAAyE;CACjH;CAEJ,IAAI,IAAI,SAAS,WACb,QAAQ,OAAR;EACI,KAAK,UACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,uEAAuE;EAC3G,KAAK,WACD,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,wEAAwE;CAChH;AAER;AACA,SAAgB,aAAa,KAAK,KAAK,OAAO;CAC1C,QAAQ,IAAI,UAAU,GAAG,CAAC,GAA1B;EACI,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,mBAAmB,KAAK,KAAK,KAAK;GAClC;EACJ,SACI,oBAAoB,KAAK,KAAK,KAAK;CAC3C;AACJ;;;AC9GA,eAAsB,gBAAgB,KAAK,KAAK,SAAS;CACrD,IAAI,CAAC,SAAS,GAAG,GACb,MAAM,IAAI,WAAW,iCAAiC;CAE1D,IAAI,IAAI,cAAc,KAAA,KAAa,IAAI,WAAW,KAAA,GAC9C,MAAM,IAAI,WAAW,2EAAuE;CAEhG,IAAI,IAAI,cAAc,KAAA,KAAa,OAAO,IAAI,cAAc,UACxD,MAAM,IAAI,WAAW,qCAAqC;CAE9D,IAAI,IAAI,YAAY,KAAA,GAChB,MAAM,IAAI,WAAW,qBAAqB;CAE9C,IAAI,OAAO,IAAI,cAAc,UACzB,MAAM,IAAI,WAAW,yCAAyC;CAElE,IAAI,IAAI,WAAW,KAAA,KAAa,CAAC,SAAS,IAAI,MAAM,GAChD,MAAM,IAAI,WAAW,uCAAuC;CAEhE,IAAI,aAAa,CAAC;CAClB,IAAI,IAAI,WACJ,IAAI;EACA,MAAM,kBAAkBG,OAAK,IAAI,SAAS;EAC1C,aAAa,KAAK,MAAM,QAAQ,OAAO,eAAe,CAAC;CAC3D,QACM;EACF,MAAM,IAAI,WAAW,iCAAiC;CAC1D;CAEJ,IAAI,CAAC,WAAW,YAAY,IAAI,MAAM,GAClC,MAAM,IAAI,WAAW,2EAA2E;CAEpG,MAAM,aAAa;EACf,GAAG;EACH,GAAG,IAAI;CACX;CACA,MAAM,aAAa,aAAa,4BAAY,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,SAAS,MAAM,YAAY,UAAU;CAC3G,IAAI,MAAM;CACV,IAAI,WAAW,IAAI,KAAK,GAAG;EACvB,MAAM,WAAW;EACjB,IAAI,OAAO,QAAQ,WACf,MAAM,IAAI,WAAW,2EAAyE;CAEtG;CACA,MAAM,EAAE,QAAQ;CAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,KAC5B,MAAM,IAAI,WAAW,6DAA2D;CAEpF,MAAM,aAAa,WAAW,mBAAmB,cAAc,QAAQ,UAAU;CACjF,IAAI,cAAc,CAAC,WAAW,IAAI,GAAG,GACjC,MAAM,IAAI,kBAAkB,wDAAsD;CAEtF,IAAI;MACI,OAAO,IAAI,YAAY,UACvB,MAAM,IAAI,WAAW,8BAA8B;CAAA,OAGtD,IAAI,OAAO,IAAI,YAAY,YAAY,EAAE,IAAI,mBAAmB,aACjE,MAAM,IAAI,WAAW,wDAAwD;CAEjF,IAAI,cAAc;CAClB,IAAI,OAAO,QAAQ,YAAY;EAC3B,MAAM,MAAM,IAAI,YAAY,GAAG;EAC/B,cAAc;CAClB;CACA,aAAa,KAAK,KAAK,QAAQ;CAC/B,MAAM,OAAO,OAAO,IAAI,cAAc,KAAA,IAAY,OAAO,IAAI,SAAS,oBAAI,IAAI,WAAW,GAAG,OAAO,GAAG,GAAG,OAAO,IAAI,YAAY,WAC1H,MACI,OAAO,IAAI,OAAO,IAClB,QAAQ,OAAO,IAAI,OAAO,IAC9B,IAAI,OAAO;CACjB,MAAM,YAAY,gBAAgB,IAAI,WAAW,aAAa,UAAU;CACxE,MAAM,IAAI,MAAM,aAAa,KAAK,GAAG;CAErC,IAAI,CAAC,MADkB,OAAO,KAAK,GAAG,WAAW,IAAI,GAEjD,MAAM,IAAI,+BAA+B;CAE7C,IAAI;CACJ,IAAI,KACA,UAAU,gBAAgB,IAAI,SAAS,WAAW,UAAU;MAE3D,IAAI,OAAO,IAAI,YAAY,UAC5B,UAAU,QAAQ,OAAO,IAAI,OAAO;MAGpC,UAAU,IAAI;CAElB,MAAM,SAAS,EAAE,QAAQ;CACzB,IAAI,IAAI,cAAc,KAAA,GAClB,OAAO,kBAAkB;CAE7B,IAAI,IAAI,WAAW,KAAA,GACf,OAAO,oBAAoB,IAAI;CAEnC,IAAI,aACA,OAAO;EAAE,GAAG;EAAQ,KAAK;CAAE;CAE/B,OAAO;AACX;;;AC1GA,eAAsB,cAAc,KAAK,KAAK,SAAS;CACnD,IAAI,eAAe,YACf,MAAM,QAAQ,OAAO,GAAG;CAE5B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,WAAW,4CAA4C;CAErE,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,GAAG,WAAW,WAAW,IAAI,MAAM,GAAG;CAC9E,IAAI,WAAW,GACX,MAAM,IAAI,WAAW,qBAAqB;CAE9C,MAAM,WAAW,MAAM,gBAAgB;EAAE;EAAS,WAAW;EAAiB;CAAU,GAAG,KAAK,OAAO;CACvG,MAAM,SAAS;EAAE,SAAS,SAAS;EAAS,iBAAiB,SAAS;CAAgB;CACtF,IAAI,OAAO,QAAQ,YACf,OAAO;EAAE,GAAG;EAAQ,KAAK,SAAS;CAAI;CAE1C,OAAO;AACX;;;ACjBA,IAAM,SAAS,SAAS,KAAK,MAAM,KAAK,QAAQ,IAAI,GAAI;AACxD,IAAM,SAAS;AACf,IAAM,OAAO,SAAS;AACtB,IAAM,MAAM,OAAO;AACnB,IAAM,OAAO,MAAM;AACnB,IAAM,OAAO,MAAM;AACnB,IAAM,QAAQ;AACd,SAAgB,KAAK,KAAK;CACtB,MAAM,UAAU,MAAM,KAAK,GAAG;CAC9B,IAAI,CAAC,WAAY,QAAQ,MAAM,QAAQ,IACnC,MAAM,IAAI,UAAU,4BAA4B;CAEpD,MAAM,QAAQ,WAAW,QAAQ,EAAE;CACnC,MAAM,OAAO,QAAQ,EAAE,CAAC,YAAY;CACpC,IAAI;CACJ,QAAQ,MAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,KAAK;GAC9B;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,MAAM;GACvC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,IAAI;GACrC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,GAAG;GACpC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;GACD,cAAc,KAAK,MAAM,QAAQ,IAAI;GACrC;EACJ;GACI,cAAc,KAAK,MAAM,QAAQ,IAAI;GACrC;CACR;CACA,IAAI,QAAQ,OAAO,OAAO,QAAQ,OAAO,OACrC,OAAO,CAAC;CAEZ,OAAO;AACX;AAOA,IAAM,gBAAgB,UAAU;CAC5B,IAAI,MAAM,SAAS,GAAG,GAClB,OAAO,MAAM,YAAY;CAE7B,OAAO,eAAe,MAAM,YAAY;AAC5C;AACA,IAAM,yBAAyB,YAAY,cAAc;CACrD,IAAI,OAAO,eAAe,UACtB,OAAO,UAAU,SAAS,UAAU;CAExC,IAAI,MAAM,QAAQ,UAAU,GACxB,OAAO,UAAU,KAAK,IAAI,UAAU,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC;CAErE,OAAO;AACX;AACA,SAAgB,kBAAkB,iBAAiB,gBAAgB,UAAU,CAAC,GAAG;CAC7E,IAAI;CACJ,IAAI;EACA,UAAU,KAAK,MAAM,QAAQ,OAAO,cAAc,CAAC;CACvD,QACM,CACN;CACA,IAAI,CAAC,SAAS,OAAO,GACjB,MAAM,IAAI,WAAW,gDAAgD;CAEzE,MAAM,EAAE,QAAQ;CAChB,IAAI,QACC,OAAO,gBAAgB,QAAQ,YAC5B,aAAa,gBAAgB,GAAG,MAAM,aAAa,GAAG,IAC1D,MAAM,IAAI,yBAAyB,uCAAqC,SAAS,OAAO,cAAc;CAE1G,MAAM,EAAE,iBAAiB,CAAC,GAAG,QAAQ,SAAS,UAAU,gBAAgB;CACxE,MAAM,gBAAgB,CAAC,GAAG,cAAc;CACxC,IAAI,gBAAgB,KAAA,GAChB,cAAc,KAAK,KAAK;CAC5B,IAAI,aAAa,KAAA,GACb,cAAc,KAAK,KAAK;CAC5B,IAAI,YAAY,KAAA,GACZ,cAAc,KAAK,KAAK;CAC5B,IAAI,WAAW,KAAA,GACX,cAAc,KAAK,KAAK;CAC5B,KAAK,MAAM,SAAS,IAAI,IAAI,cAAc,QAAQ,CAAC,GAC/C,IAAI,EAAE,SAAS,UACX,MAAM,IAAI,yBAAyB,qBAAqB,MAAM,UAAU,SAAS,OAAO,SAAS;CAGzG,IAAI,UACA,EAAE,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM,EAAA,CAAG,SAAS,QAAQ,GAAG,GACjE,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,cAAc;CAErG,IAAI,WAAW,QAAQ,QAAQ,SAC3B,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,cAAc;CAErG,IAAI,YACA,CAAC,sBAAsB,QAAQ,KAAK,OAAO,aAAa,WAAW,CAAC,QAAQ,IAAI,QAAQ,GACxF,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,cAAc;CAErG,IAAI;CACJ,QAAQ,OAAO,QAAQ,gBAAvB;EACI,KAAK;GACD,YAAY,KAAK,QAAQ,cAAc;GACvC;EACJ,KAAK;GACD,YAAY,QAAQ;GACpB;EACJ,KAAK;GACD,YAAY;GACZ;EACJ,SACI,MAAM,IAAI,UAAU,oCAAoC;CAChE;CACA,MAAM,EAAE,gBAAgB;CACxB,MAAM,MAAM,MAAM,+BAAe,IAAI,KAAK,CAAC;CAC3C,KAAK,QAAQ,QAAQ,KAAA,KAAa,gBAAgB,OAAO,QAAQ,QAAQ,UACrE,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,SAAS;CAEhG,IAAI,QAAQ,QAAQ,KAAA,GAAW;EAC3B,IAAI,OAAO,QAAQ,QAAQ,UACvB,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,SAAS;EAEhG,IAAI,QAAQ,MAAM,MAAM,WACpB,MAAM,IAAI,yBAAyB,wCAAsC,SAAS,OAAO,cAAc;CAE/G;CACA,IAAI,QAAQ,QAAQ,KAAA,GAAW;EAC3B,IAAI,OAAO,QAAQ,QAAQ,UACvB,MAAM,IAAI,yBAAyB,kCAAgC,SAAS,OAAO,SAAS;EAEhG,IAAI,QAAQ,OAAO,MAAM,WACrB,MAAM,IAAI,WAAW,wCAAsC,SAAS,OAAO,cAAc;CAEjG;CACA,IAAI,aAAa;EACb,MAAM,MAAM,MAAM,QAAQ;EAC1B,MAAM,MAAM,OAAO,gBAAgB,WAAW,cAAc,KAAK,WAAW;EAC5E,IAAI,MAAM,YAAY,KAClB,MAAM,IAAI,WAAW,8DAA4D,SAAS,OAAO,cAAc;EAEnH,IAAI,MAAM,IAAI,WACV,MAAM,IAAI,yBAAyB,mEAAiE,SAAS,OAAO,cAAc;CAE1I;CACA,OAAO;AACX;;;ACrKA,eAAsB,UAAU,KAAK,KAAK,SAAS;CAC/C,MAAM,WAAW,MAAM,cAAc,KAAK,KAAK,OAAO;CACtD,IAAI,SAAS,gBAAgB,MAAM,SAAS,KAAK,KAAK,SAAS,gBAAgB,QAAQ,OACnF,MAAM,IAAI,WAAW,qCAAqC;CAG9D,MAAM,SAAS;EAAE,SADD,kBAAkB,SAAS,iBAAiB,SAAS,SAAS,OACvD;EAAG,iBAAiB,SAAS;CAAgB;CACpE,IAAI,OAAO,QAAQ,YACf,OAAO;EAAE,GAAG;EAAQ,KAAK,SAAS;CAAI;CAE1C,OAAO;AACX;;;ACXA,SAAS,cAAc,KAAK;CACxB,QAAQ,OAAO,QAAQ,YAAY,IAAI,MAAM,GAAG,CAAC,GAAjD;EACI,KAAK;EACL,KAAK,MACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,SACI,MAAM,IAAI,iBAAiB,kDAAgD;CACnF;AACJ;AACA,SAAS,WAAW,MAAM;CACtB,OAAQ,QACJ,OAAO,SAAS,YAChB,MAAM,QAAQ,KAAK,IAAI,KACvB,KAAK,KAAK,MAAM,SAAS;AACjC;AACA,SAAS,UAAU,KAAK;CACpB,OAAO,SAAS,GAAG;AACvB;AACA,IAAM,cAAN,MAAkB;CACd;CACA,0BAAU,IAAI,QAAQ;CACtB,YAAY,MAAM;EACd,IAAI,CAAC,WAAW,IAAI,GAChB,MAAM,IAAI,YAAY,4BAA4B;EAEtD,KAAKC,QAAQ,gBAAgB,IAAI;CACrC;CACA,OAAO;EACH,OAAO,KAAKA;CAChB;CACA,MAAM,OAAO,iBAAiB,OAAO;EACjC,MAAM,EAAE,KAAK,QAAQ;GAAE,GAAG;GAAiB,GAAG,OAAO;EAAO;EAC5D,MAAM,MAAM,cAAc,GAAG;EAC7B,MAAM,aAAa,KAAKA,MAAM,KAAK,QAAQ,QAAQ;GAC/C,IAAI,YAAY,QAAQ,IAAI;GAC5B,IAAI,aAAa,OAAO,QAAQ,UAC5B,YAAY,QAAQ,IAAI;GAE5B,IAAI,cAAc,OAAO,IAAI,QAAQ,YAAY,QAAQ,QACrD,YAAY,QAAQ,IAAI;GAE5B,IAAI,aAAa,OAAO,IAAI,QAAQ,UAChC,YAAY,IAAI,QAAQ;GAE5B,IAAI,aAAa,MAAM,QAAQ,IAAI,OAAO,GACtC,YAAY,IAAI,QAAQ,SAAS,QAAQ;GAE7C,IAAI,WACA,QAAQ,KAAR;IACI,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;IACJ,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;IACJ,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;IACJ,KAAK;IACL,KAAK;KACD,YAAY,IAAI,QAAQ;KACxB;GACR;GAEJ,OAAO;EACX,CAAC;EACD,MAAM,EAAE,GAAG,KAAK,WAAW;EAC3B,IAAI,WAAW,GACX,MAAM,IAAI,kBAAkB;EAEhC,IAAI,WAAW,GAAG;GACd,MAAM,QAAQ,IAAI,yBAAyB;GAC3C,MAAM,UAAU,KAAKC;GACrB,MAAM,OAAO,iBAAiB,mBAAmB;IAC7C,KAAK,MAAM,OAAO,YACd,IAAI;KACA,MAAM,MAAM,mBAAmB,SAAS,KAAK,GAAG;IACpD,QACM,CAAE;GAEhB;GACA,MAAM;EACV;EACA,OAAO,mBAAmB,KAAKA,SAAS,KAAK,GAAG;CACpD;AACJ;AACA,eAAe,mBAAmB,OAAO,KAAK,KAAK;CAC/C,MAAM,SAAS,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;CAC3D,IAAI,OAAO,SAAS,KAAA,GAAW;EAC3B,MAAM,MAAM,MAAM,UAAU;GAAE,GAAG;GAAK,KAAK;EAAK,GAAG,GAAG;EACtD,IAAI,eAAe,cAAc,IAAI,SAAS,UAC1C,MAAM,IAAI,YAAY,8CAA8C;EAExE,OAAO,OAAO;CAClB;CACA,OAAO,OAAO;AAClB;AACA,SAAgB,kBAAkB,MAAM;CACpC,MAAM,MAAM,IAAI,YAAY,IAAI;CAChC,MAAM,cAAc,OAAO,iBAAiB,UAAU,IAAI,OAAO,iBAAiB,KAAK;CACvF,OAAO,iBAAiB,aAAa,EACjC,MAAM;EACF,aAAa,gBAAgB,IAAI,KAAK,CAAC;EACvC,YAAY;EACZ,cAAc;EACd,UAAU;CACd,EACJ,CAAC;CACD,OAAO;AACX;;;ACnHA,SAAS,sBAAsB;CAC3B,OAAQ,OAAO,kBAAkB,eAC5B,OAAO,cAAc,eAAe,UAAU,cAAc,wBAC5D,OAAO,gBAAgB,eAAe,gBAAgB;AAC/D;AACA,IAAI;AACJ,IAAI,OAAO,cAAc,eAAe,CAAC,UAAU,WAAW,aAAa,cAAc,GAGrF,aAAa;AAEjB,IAAa,cAAc,OAAO;AAClC,eAAe,UAAU,KAAK,SAAS,QAAQ,YAAY,OAAO;CAC9D,MAAM,WAAW,MAAM,UAAU,KAAK;EAClC,QAAQ;EACR;EACA,UAAU;EACV;CACJ,CAAC,CAAC,CAAC,OAAO,QAAQ;EACd,IAAI,IAAI,SAAS,gBACb,MAAM,IAAI,YAAY;EAE1B,MAAM;CACV,CAAC;CACD,IAAI,SAAS,WAAW,KACpB,MAAM,IAAI,UAAU,yDAAyD;CAEjF,IAAI;EACA,OAAO,MAAM,SAAS,KAAK;CAC/B,QACM;EACF,MAAM,IAAI,UAAU,4DAA4D;CACpF;AACJ;AACA,IAAa,YAAY,OAAO;AAChC,SAAS,iBAAiB,OAAO,aAAa;CAC1C,IAAI,OAAO,UAAU,YAAY,UAAU,MACvC,OAAO;CAEX,IAAI,EAAE,SAAS,UAAU,OAAO,MAAM,QAAQ,YAAY,KAAK,IAAI,IAAI,MAAM,OAAO,aAChF,OAAO;CAEX,IAAI,EAAE,UAAU,UACZ,CAAC,SAAS,MAAM,IAAI,KACpB,CAAC,MAAM,QAAQ,MAAM,KAAK,IAAI,KAC9B,CAAC,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK,MAAM,QAAQ,GACrD,OAAO;CAEX,OAAO;AACX;AACA,IAAM,eAAN,MAAmB;CACf;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,YAAY,KAAK,SAAS;EACtB,IAAI,EAAE,eAAe,MACjB,MAAM,IAAI,UAAU,gCAAgC;EAExD,KAAKC,OAAO,IAAI,IAAI,IAAI,IAAI;EAC5B,KAAKC,mBACD,OAAO,SAAS,oBAAoB,WAAW,SAAS,kBAAkB;EAC9E,KAAKC,oBACD,OAAO,SAAS,qBAAqB,WAAW,SAAS,mBAAmB;EAChF,KAAKC,eAAe,OAAO,SAAS,gBAAgB,WAAW,SAAS,cAAc;EACtF,KAAKC,WAAW,IAAI,QAAQ,SAAS,OAAO;EAC5C,IAAI,cAAc,CAAC,KAAKA,SAAS,IAAI,YAAY,GAC7C,KAAKA,SAAS,IAAI,cAAc,UAAU;EAE9C,IAAI,CAAC,KAAKA,SAAS,IAAI,QAAQ,GAAG;GAC9B,KAAKA,SAAS,IAAI,UAAU,kBAAkB;GAC9C,KAAKA,SAAS,OAAO,UAAU,0BAA0B;EAC7D;EACA,KAAKC,eAAe,UAAU;EAC9B,IAAI,UAAU,eAAe,KAAA,GAAW;GACpC,KAAKC,SAAS,UAAU;GACxB,IAAI,iBAAiB,UAAU,YAAY,KAAKH,YAAY,GAAG;IAC3D,KAAKI,iBAAiB,KAAKD,OAAO;IAClC,KAAKE,SAAS,kBAAkB,KAAKF,OAAO,IAAI;GACpD;EACJ;CACJ;CACA,eAAe;EACX,OAAO,CAAC,CAAC,KAAKG;CAClB;CACA,cAAc;EACV,OAAO,OAAO,KAAKF,mBAAmB,WAChC,KAAK,IAAI,IAAI,KAAKA,iBAAiB,KAAKL,oBACxC;CACV;CACA,QAAQ;EACJ,OAAO,OAAO,KAAKK,mBAAmB,WAChC,KAAK,IAAI,IAAI,KAAKA,iBAAiB,KAAKJ,eACxC;CACV;CACA,OAAO;EACH,OAAO,KAAKK,QAAQ,KAAK;CAC7B;CACA,MAAM,OAAO,iBAAiB,OAAO;EACjC,IAAI,CAAC,KAAKA,UAAU,CAAC,KAAK,MAAM,GAC5B,MAAM,KAAK,OAAO;EAEtB,IAAI;GACA,OAAO,MAAM,KAAKA,OAAO,iBAAiB,KAAK;EACnD,SACO,KAAK;GACR,IAAI,eAAe;QACX,KAAK,YAAY,MAAM,OAAO;KAC9B,MAAM,KAAK,OAAO;KAClB,OAAO,KAAKA,OAAO,iBAAiB,KAAK;IAC7C;;GAEJ,MAAM;EACV;CACJ;CACA,MAAM,SAAS;EACX,IAAI,KAAKC,iBAAiB,oBAAoB,GAC1C,KAAKA,gBAAgB,KAAA;EAEzB,KAAKA,kBAAkB,UAAU,KAAKT,KAAK,MAAM,KAAKI,UAAU,YAAY,QAAQ,KAAKH,gBAAgB,GAAG,KAAKI,YAAY,CAAC,CACzH,MAAM,SAAS;GAChB,KAAKG,SAAS,kBAAkB,IAAI;GACpC,IAAI,KAAKF,QAAQ;IACb,KAAKA,OAAO,MAAM,KAAK,IAAI;IAC3B,KAAKA,OAAO,OAAO;GACvB;GACA,KAAKC,iBAAiB,KAAK,IAAI;GAC/B,KAAKE,gBAAgB,KAAA;EACzB,CAAC,CAAC,CACG,OAAO,QAAQ;GAChB,KAAKA,gBAAgB,KAAA;GACrB,MAAM;EACV,CAAC;EACD,MAAM,KAAKA;CACf;AACJ;AACA,SAAgB,mBAAmB,KAAK,SAAS;CAC7C,MAAM,MAAM,IAAI,aAAa,KAAK,OAAO;CACzC,MAAM,eAAe,OAAO,iBAAiB,UAAU,IAAI,OAAO,iBAAiB,KAAK;CACxF,OAAO,iBAAiB,cAAc;EAClC,aAAa;GACT,WAAW,IAAI,YAAY;GAC3B,YAAY;GACZ,cAAc;EAClB;EACA,OAAO;GACH,WAAW,IAAI,MAAM;GACrB,YAAY;GACZ,cAAc;EAClB;EACA,QAAQ;GACJ,aAAa,IAAI,OAAO;GACxB,YAAY;GACZ,cAAc;GACd,UAAU;EACd;EACA,WAAW;GACP,WAAW,IAAI,aAAa;GAC5B,YAAY;GACZ,cAAc;EAClB;EACA,MAAM;GACF,aAAa,IAAI,KAAK;GACtB,YAAY;GACZ,cAAc;GACd,UAAU;EACd;CACJ,CAAC;CACD,OAAO;AACX;;;AC9KA,SAAgB,UAAU,KAAK;CAC3B,IAAI,OAAO,QAAQ,UACf,MAAM,IAAI,WAAW,+DAA+D;CACxF,MAAM,EAAE,GAAG,SAAS,WAAW,IAAI,MAAM,GAAG;CAC5C,IAAI,WAAW,GACX,MAAM,IAAI,WAAW,0DAA0D;CACnF,IAAI,WAAW,GACX,MAAM,IAAI,WAAW,aAAa;CACtC,IAAI,CAAC,SACD,MAAM,IAAI,WAAW,6BAA6B;CACtD,IAAI;CACJ,IAAI;EACA,UAAUC,OAAK,OAAO;CAC1B,QACM;EACF,MAAM,IAAI,WAAW,wCAAwC;CACjE;CACA,IAAI;CACJ,IAAI;EACA,SAAS,KAAK,MAAM,QAAQ,OAAO,OAAO,CAAC;CAC/C,QACM;EACF,MAAM,IAAI,WAAW,6CAA6C;CACtE;CACA,IAAI,CAAC,SAAS,MAAM,GAChB,MAAM,IAAI,WAAW,wBAAwB;CACjD,OAAO;AACX"}

package/dist/chunks/errors-RgVH84_1.js

@@ -0,0 +1,343 @@
+//#region src/shared/errors.ts
+/**
+* @happyvertical/auth - Error Classes
+*
+* Standardized authentication error types for consistent error handling
+* across all providers (Keycloak, Cognito, Nostr).
+*/
+/**
+* Authentication error codes.
+*/
+var AuthErrorCode = /* @__PURE__ */ function(AuthErrorCode) {
+	AuthErrorCode["INVALID_CREDENTIALS"] = "INVALID_CREDENTIALS";
+	AuthErrorCode["INVALID_TOKEN"] = "INVALID_TOKEN";
+	AuthErrorCode["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
+	AuthErrorCode["INVALID_REFRESH_TOKEN"] = "INVALID_REFRESH_TOKEN";
+	AuthErrorCode["SESSION_EXPIRED"] = "SESSION_EXPIRED";
+	AuthErrorCode["MFA_REQUIRED"] = "MFA_REQUIRED";
+	AuthErrorCode["INVALID_MFA_CODE"] = "INVALID_MFA_CODE";
+	AuthErrorCode["ACCESS_DENIED"] = "ACCESS_DENIED";
+	AuthErrorCode["INSUFFICIENT_SCOPE"] = "INSUFFICIENT_SCOPE";
+	AuthErrorCode["INVALID_ROLE"] = "INVALID_ROLE";
+	AuthErrorCode["USER_NOT_FOUND"] = "USER_NOT_FOUND";
+	AuthErrorCode["USER_ALREADY_EXISTS"] = "USER_ALREADY_EXISTS";
+	AuthErrorCode["USER_DISABLED"] = "USER_DISABLED";
+	AuthErrorCode["PROVIDER_ERROR"] = "PROVIDER_ERROR";
+	AuthErrorCode["CONFIGURATION_ERROR"] = "CONFIGURATION_ERROR";
+	AuthErrorCode["NETWORK_ERROR"] = "NETWORK_ERROR";
+	AuthErrorCode["INVALID_STATE"] = "INVALID_STATE";
+	AuthErrorCode["INVALID_NONCE"] = "INVALID_NONCE";
+	AuthErrorCode["INVALID_GRANT"] = "INVALID_GRANT";
+	AuthErrorCode["INVALID_CLIENT"] = "INVALID_CLIENT";
+	AuthErrorCode["INVALID_REDIRECT_URI"] = "INVALID_REDIRECT_URI";
+	AuthErrorCode["INVALID_SIGNATURE"] = "INVALID_SIGNATURE";
+	AuthErrorCode["RELAY_ERROR"] = "RELAY_ERROR";
+	AuthErrorCode["CHALLENGE_EXPIRED"] = "CHALLENGE_EXPIRED";
+	AuthErrorCode["EXTENSION_NOT_FOUND"] = "EXTENSION_NOT_FOUND";
+	AuthErrorCode["INVALID_KEY"] = "INVALID_KEY";
+	AuthErrorCode["NOT_IMPLEMENTED"] = "NOT_IMPLEMENTED";
+	AuthErrorCode["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
+	return AuthErrorCode;
+}({});
+/**
+* Base authentication error class.
+*/
+var AuthError = class AuthError extends Error {
+	code;
+	provider;
+	context;
+	constructor(message, code, provider, context) {
+		super(message);
+		this.name = "AuthError";
+		this.code = code;
+		this.provider = provider;
+		this.context = context;
+		if (Error.captureStackTrace) Error.captureStackTrace(this, AuthError);
+	}
+	/**
+	* Convert error to JSON for logging/serialization.
+	*/
+	toJSON() {
+		return {
+			name: this.name,
+			message: this.message,
+			code: this.code,
+			provider: this.provider,
+			context: this.context,
+			stack: this.stack
+		};
+	}
+};
+/**
+* Invalid credentials error.
+*/
+var InvalidCredentialsError = class extends AuthError {
+	constructor(provider, context) {
+		super("Invalid credentials", "INVALID_CREDENTIALS", provider, context);
+		this.name = "InvalidCredentialsError";
+	}
+};
+/**
+* Invalid token error.
+*/
+var InvalidTokenError = class extends AuthError {
+	constructor(message, provider, context) {
+		super(message || "Invalid token", "INVALID_TOKEN", provider, context);
+		this.name = "InvalidTokenError";
+	}
+};
+/**
+* Token expired error.
+*/
+var TokenExpiredError = class extends AuthError {
+	expiredAt;
+	constructor(provider, expiredAt, context) {
+		super("Token has expired", "TOKEN_EXPIRED", provider, context);
+		this.name = "TokenExpiredError";
+		this.expiredAt = expiredAt;
+	}
+};
+/**
+* Invalid refresh token error.
+*/
+var InvalidRefreshTokenError = class extends AuthError {
+	constructor(provider, context) {
+		super("Invalid or expired refresh token", "INVALID_REFRESH_TOKEN", provider, context);
+		this.name = "InvalidRefreshTokenError";
+	}
+};
+/**
+* Session expired error.
+*/
+var SessionExpiredError = class extends AuthError {
+	constructor(provider, context) {
+		super("Session has expired", "SESSION_EXPIRED", provider, context);
+		this.name = "SessionExpiredError";
+	}
+};
+/**
+* MFA required error.
+*/
+var MfaRequiredError = class extends AuthError {
+	mfaMethods;
+	constructor(provider, mfaMethods, context) {
+		super("Multi-factor authentication required", "MFA_REQUIRED", provider, context);
+		this.name = "MfaRequiredError";
+		this.mfaMethods = mfaMethods;
+	}
+};
+/**
+* Invalid MFA code error.
+*/
+var InvalidMfaCodeError = class extends AuthError {
+	constructor(provider, context) {
+		super("Invalid MFA code", "INVALID_MFA_CODE", provider, context);
+		this.name = "InvalidMfaCodeError";
+	}
+};
+/**
+* Access denied error.
+*/
+var AccessDeniedError = class extends AuthError {
+	constructor(message, provider, context) {
+		super(message || "Access denied", "ACCESS_DENIED", provider, context);
+		this.name = "AccessDeniedError";
+	}
+};
+/**
+* Insufficient scope error.
+*/
+var InsufficientScopeError = class extends AuthError {
+	requiredScopes;
+	grantedScopes;
+	constructor(requiredScopes, grantedScopes, provider, context) {
+		super(`Insufficient scope. Required: ${requiredScopes?.join(", ") || "unknown"}`, "INSUFFICIENT_SCOPE", provider, context);
+		this.name = "InsufficientScopeError";
+		this.requiredScopes = requiredScopes;
+		this.grantedScopes = grantedScopes;
+	}
+};
+/**
+* User not found error.
+*/
+var UserNotFoundError = class extends AuthError {
+	userId;
+	constructor(userId, provider, context) {
+		super(userId ? `User not found: ${userId}` : "User not found", "USER_NOT_FOUND", provider, context);
+		this.name = "UserNotFoundError";
+		this.userId = userId;
+	}
+};
+/**
+* User already exists error.
+*/
+var UserAlreadyExistsError = class extends AuthError {
+	constructor(identifier, provider, context) {
+		super(identifier ? `User already exists: ${identifier}` : "User already exists", "USER_ALREADY_EXISTS", provider, context);
+		this.name = "UserAlreadyExistsError";
+	}
+};
+/**
+* User disabled error.
+*/
+var UserDisabledError = class extends AuthError {
+	constructor(userId, provider, context) {
+		super(userId ? `User is disabled: ${userId}` : "User is disabled", "USER_DISABLED", provider, context);
+		this.name = "UserDisabledError";
+	}
+};
+/**
+* Provider error.
+*/
+var ProviderError = class extends AuthError {
+	originalError;
+	constructor(message, provider, originalError, context) {
+		super(message, "PROVIDER_ERROR", provider, context);
+		this.name = "ProviderError";
+		this.originalError = originalError;
+	}
+};
+/**
+* Configuration error.
+*/
+var ConfigurationError = class extends AuthError {
+	constructor(message, provider, context) {
+		super(message, "CONFIGURATION_ERROR", provider, context);
+		this.name = "ConfigurationError";
+	}
+};
+/**
+* Network error.
+*/
+var NetworkError = class extends AuthError {
+	originalError;
+	constructor(message, provider, originalError, context) {
+		super(message || "Network error", "NETWORK_ERROR", provider, context);
+		this.name = "NetworkError";
+		this.originalError = originalError;
+	}
+};
+/**
+* Invalid state error.
+*/
+var InvalidStateError = class extends AuthError {
+	constructor(provider, context) {
+		super("Invalid or mismatched state parameter", "INVALID_STATE", provider, context);
+		this.name = "InvalidStateError";
+	}
+};
+/**
+* Invalid nonce error.
+*/
+var InvalidNonceError = class extends AuthError {
+	constructor(provider, context) {
+		super("Invalid or mismatched nonce", "INVALID_NONCE", provider, context);
+		this.name = "InvalidNonceError";
+	}
+};
+/**
+* Invalid grant error.
+*/
+var InvalidGrantError = class extends AuthError {
+	constructor(message, provider, context) {
+		super(message || "Invalid grant", "INVALID_GRANT", provider, context);
+		this.name = "InvalidGrantError";
+	}
+};
+/**
+* Invalid client error.
+*/
+var InvalidClientError = class extends AuthError {
+	constructor(provider, context) {
+		super("Invalid client credentials", "INVALID_CLIENT", provider, context);
+		this.name = "InvalidClientError";
+	}
+};
+/**
+* Invalid redirect URI error.
+*/
+var InvalidRedirectUriError = class extends AuthError {
+	constructor(provider, context) {
+		super("Invalid or mismatched redirect URI", "INVALID_REDIRECT_URI", provider, context);
+		this.name = "InvalidRedirectUriError";
+	}
+};
+/**
+* Invalid signature error.
+*/
+var InvalidSignatureError = class extends AuthError {
+	constructor(message, context) {
+		super(message || "Invalid event signature", "INVALID_SIGNATURE", "nostr", context);
+		this.name = "InvalidSignatureError";
+	}
+};
+/**
+* Relay error.
+*/
+var RelayError = class extends AuthError {
+	relayUrl;
+	originalError;
+	constructor(message, relayUrl, originalError, context) {
+		super(message, "RELAY_ERROR", "nostr", {
+			...context,
+			relayUrl
+		});
+		this.name = "RelayError";
+		this.relayUrl = relayUrl;
+		this.originalError = originalError;
+	}
+};
+/**
+* Challenge expired error.
+*/
+var ChallengeExpiredError = class extends AuthError {
+	constructor(context) {
+		super("Authentication challenge has expired", "CHALLENGE_EXPIRED", "nostr", context);
+		this.name = "ChallengeExpiredError";
+	}
+};
+/**
+* NIP-07 extension not found error.
+*/
+var ExtensionNotFoundError = class extends AuthError {
+	constructor(context) {
+		super("NIP-07 browser extension not found. Install nos2x, Alby, or similar.", "EXTENSION_NOT_FOUND", "nostr", context);
+		this.name = "ExtensionNotFoundError";
+	}
+};
+/**
+* Invalid key error.
+*/
+var InvalidKeyError = class extends AuthError {
+	constructor(message, context) {
+		super(message || "Invalid key format", "INVALID_KEY", "nostr", context);
+		this.name = "InvalidKeyError";
+	}
+};
+/**
+* Not implemented error.
+*/
+var NotImplementedError = class extends AuthError {
+	operation;
+	constructor(operation, provider, context) {
+		super(`Operation '${operation}' is not supported by this provider`, "NOT_IMPLEMENTED", provider, context);
+		this.name = "NotImplementedError";
+		this.operation = operation;
+	}
+};
+/**
+* Check if an error is an AuthError.
+*/
+function isAuthError(error) {
+	return error instanceof AuthError;
+}
+/**
+* Check if an error has a specific error code.
+*/
+function hasErrorCode(error, code) {
+	return isAuthError(error) && error.code === code;
+}
+//#endregion
+export { isAuthError as A, RelayError as C, UserDisabledError as D, UserAlreadyExistsError as E, UserNotFoundError as O, ProviderError as S, TokenExpiredError as T, InvalidStateError as _, ConfigurationError as a, NetworkError as b, InvalidClientError as c, InvalidKeyError as d, InvalidMfaCodeError as f, InvalidSignatureError as g, InvalidRefreshTokenError as h, ChallengeExpiredError as i, hasErrorCode as k, InvalidCredentialsError as l, InvalidRedirectUriError as m, AuthError as n, ExtensionNotFoundError as o, InvalidNonceError as p, AuthErrorCode as r, InsufficientScopeError as s, AccessDeniedError as t, InvalidGrantError as u, InvalidTokenError as v, SessionExpiredError as w, NotImplementedError as x, MfaRequiredError as y };
+
+//# sourceMappingURL=errors-RgVH84_1.js.map

package/dist/chunks/errors-RgVH84_1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-RgVH84_1.js","names":[],"sources":["../../src/shared/errors.ts"],"sourcesContent":["/**\n * @happyvertical/auth - Error Classes\n *\n * Standardized authentication error types for consistent error handling\n * across all providers (Keycloak, Cognito, Nostr).\n */\n\n/**\n * Authentication error codes.\n */\nexport enum AuthErrorCode {\n  // Authentication errors\n  INVALID_CREDENTIALS = 'INVALID_CREDENTIALS',\n  INVALID_TOKEN = 'INVALID_TOKEN',\n  TOKEN_EXPIRED = 'TOKEN_EXPIRED',\n  INVALID_REFRESH_TOKEN = 'INVALID_REFRESH_TOKEN',\n  SESSION_EXPIRED = 'SESSION_EXPIRED',\n  MFA_REQUIRED = 'MFA_REQUIRED',\n  INVALID_MFA_CODE = 'INVALID_MFA_CODE',\n\n  // Authorization errors\n  ACCESS_DENIED = 'ACCESS_DENIED',\n  INSUFFICIENT_SCOPE = 'INSUFFICIENT_SCOPE',\n  INVALID_ROLE = 'INVALID_ROLE',\n\n  // User management errors\n  USER_NOT_FOUND = 'USER_NOT_FOUND',\n  USER_ALREADY_EXISTS = 'USER_ALREADY_EXISTS',\n  USER_DISABLED = 'USER_DISABLED',\n\n  // Provider errors\n  PROVIDER_ERROR = 'PROVIDER_ERROR',\n  CONFIGURATION_ERROR = 'CONFIGURATION_ERROR',\n  NETWORK_ERROR = 'NETWORK_ERROR',\n\n  // OAuth/OIDC errors\n  INVALID_STATE = 'INVALID_STATE',\n  INVALID_NONCE = 'INVALID_NONCE',\n  INVALID_GRANT = 'INVALID_GRANT',\n  INVALID_CLIENT = 'INVALID_CLIENT',\n  INVALID_REDIRECT_URI = 'INVALID_REDIRECT_URI',\n\n  // Nostr-specific errors\n  INVALID_SIGNATURE = 'INVALID_SIGNATURE',\n  RELAY_ERROR = 'RELAY_ERROR',\n  CHALLENGE_EXPIRED = 'CHALLENGE_EXPIRED',\n  EXTENSION_NOT_FOUND = 'EXTENSION_NOT_FOUND',\n  INVALID_KEY = 'INVALID_KEY',\n\n  // General\n  NOT_IMPLEMENTED = 'NOT_IMPLEMENTED',\n  UNKNOWN_ERROR = 'UNKNOWN_ERROR',\n}\n\n/**\n * Base authentication error class.\n */\nexport class AuthError extends Error {\n  public readonly code: AuthErrorCode;\n  public readonly provider?: string;\n  public readonly context?: Record<string, unknown>;\n\n  constructor(\n    message: string,\n    code: AuthErrorCode,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = 'AuthError';\n    this.code = code;\n    this.provider = provider;\n    this.context = context;\n\n    // Maintains proper stack trace for where our error was thrown (only available on V8)\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, AuthError);\n    }\n  }\n\n  /**\n   * Convert error to JSON for logging/serialization.\n   */\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      message: this.message,\n      code: this.code,\n      provider: this.provider,\n      context: this.context,\n      stack: this.stack,\n    };\n  }\n}\n\n// =============================================================================\n// AUTHENTICATION ERRORS\n// =============================================================================\n\n/**\n * Invalid credentials error.\n */\nexport class InvalidCredentialsError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Invalid credentials',\n      AuthErrorCode.INVALID_CREDENTIALS,\n      provider,\n      context,\n    );\n    this.name = 'InvalidCredentialsError';\n  }\n}\n\n/**\n * Invalid token error.\n */\nexport class InvalidTokenError extends AuthError {\n  constructor(\n    message?: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      message || 'Invalid token',\n      AuthErrorCode.INVALID_TOKEN,\n      provider,\n      context,\n    );\n    this.name = 'InvalidTokenError';\n  }\n}\n\n/**\n * Token expired error.\n */\nexport class TokenExpiredError extends AuthError {\n  public readonly expiredAt?: Date;\n\n  constructor(\n    provider?: string,\n    expiredAt?: Date,\n    context?: Record<string, unknown>,\n  ) {\n    super('Token has expired', AuthErrorCode.TOKEN_EXPIRED, provider, context);\n    this.name = 'TokenExpiredError';\n    this.expiredAt = expiredAt;\n  }\n}\n\n/**\n * Invalid refresh token error.\n */\nexport class InvalidRefreshTokenError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Invalid or expired refresh token',\n      AuthErrorCode.INVALID_REFRESH_TOKEN,\n      provider,\n      context,\n    );\n    this.name = 'InvalidRefreshTokenError';\n  }\n}\n\n/**\n * Session expired error.\n */\nexport class SessionExpiredError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Session has expired',\n      AuthErrorCode.SESSION_EXPIRED,\n      provider,\n      context,\n    );\n    this.name = 'SessionExpiredError';\n  }\n}\n\n/**\n * MFA required error.\n */\nexport class MfaRequiredError extends AuthError {\n  public readonly mfaMethods?: string[];\n\n  constructor(\n    provider?: string,\n    mfaMethods?: string[],\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      'Multi-factor authentication required',\n      AuthErrorCode.MFA_REQUIRED,\n      provider,\n      context,\n    );\n    this.name = 'MfaRequiredError';\n    this.mfaMethods = mfaMethods;\n  }\n}\n\n/**\n * Invalid MFA code error.\n */\nexport class InvalidMfaCodeError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Invalid MFA code',\n      AuthErrorCode.INVALID_MFA_CODE,\n      provider,\n      context,\n    );\n    this.name = 'InvalidMfaCodeError';\n  }\n}\n\n// =============================================================================\n// AUTHORIZATION ERRORS\n// =============================================================================\n\n/**\n * Access denied error.\n */\nexport class AccessDeniedError extends AuthError {\n  constructor(\n    message?: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      message || 'Access denied',\n      AuthErrorCode.ACCESS_DENIED,\n      provider,\n      context,\n    );\n    this.name = 'AccessDeniedError';\n  }\n}\n\n/**\n * Insufficient scope error.\n */\nexport class InsufficientScopeError extends AuthError {\n  public readonly requiredScopes?: string[];\n  public readonly grantedScopes?: string[];\n\n  constructor(\n    requiredScopes?: string[],\n    grantedScopes?: string[],\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      `Insufficient scope. Required: ${requiredScopes?.join(', ') || 'unknown'}`,\n      AuthErrorCode.INSUFFICIENT_SCOPE,\n      provider,\n      context,\n    );\n    this.name = 'InsufficientScopeError';\n    this.requiredScopes = requiredScopes;\n    this.grantedScopes = grantedScopes;\n  }\n}\n\n// =============================================================================\n// USER MANAGEMENT ERRORS\n// =============================================================================\n\n/**\n * User not found error.\n */\nexport class UserNotFoundError extends AuthError {\n  public readonly userId?: string;\n\n  constructor(\n    userId?: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      userId ? `User not found: ${userId}` : 'User not found',\n      AuthErrorCode.USER_NOT_FOUND,\n      provider,\n      context,\n    );\n    this.name = 'UserNotFoundError';\n    this.userId = userId;\n  }\n}\n\n/**\n * User already exists error.\n */\nexport class UserAlreadyExistsError extends AuthError {\n  constructor(\n    identifier?: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      identifier ? `User already exists: ${identifier}` : 'User already exists',\n      AuthErrorCode.USER_ALREADY_EXISTS,\n      provider,\n      context,\n    );\n    this.name = 'UserAlreadyExistsError';\n  }\n}\n\n/**\n * User disabled error.\n */\nexport class UserDisabledError extends AuthError {\n  constructor(\n    userId?: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      userId ? `User is disabled: ${userId}` : 'User is disabled',\n      AuthErrorCode.USER_DISABLED,\n      provider,\n      context,\n    );\n    this.name = 'UserDisabledError';\n  }\n}\n\n// =============================================================================\n// PROVIDER ERRORS\n// =============================================================================\n\n/**\n * Provider error.\n */\nexport class ProviderError extends AuthError {\n  public readonly originalError?: Error;\n\n  constructor(\n    message: string,\n    provider?: string,\n    originalError?: Error,\n    context?: Record<string, unknown>,\n  ) {\n    super(message, AuthErrorCode.PROVIDER_ERROR, provider, context);\n    this.name = 'ProviderError';\n    this.originalError = originalError;\n  }\n}\n\n/**\n * Configuration error.\n */\nexport class ConfigurationError extends AuthError {\n  constructor(\n    message: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(message, AuthErrorCode.CONFIGURATION_ERROR, provider, context);\n    this.name = 'ConfigurationError';\n  }\n}\n\n/**\n * Network error.\n */\nexport class NetworkError extends AuthError {\n  public readonly originalError?: Error;\n\n  constructor(\n    message?: string,\n    provider?: string,\n    originalError?: Error,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      message || 'Network error',\n      AuthErrorCode.NETWORK_ERROR,\n      provider,\n      context,\n    );\n    this.name = 'NetworkError';\n    this.originalError = originalError;\n  }\n}\n\n// =============================================================================\n// OAUTH/OIDC ERRORS\n// =============================================================================\n\n/**\n * Invalid state error.\n */\nexport class InvalidStateError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Invalid or mismatched state parameter',\n      AuthErrorCode.INVALID_STATE,\n      provider,\n      context,\n    );\n    this.name = 'InvalidStateError';\n  }\n}\n\n/**\n * Invalid nonce error.\n */\nexport class InvalidNonceError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Invalid or mismatched nonce',\n      AuthErrorCode.INVALID_NONCE,\n      provider,\n      context,\n    );\n    this.name = 'InvalidNonceError';\n  }\n}\n\n/**\n * Invalid grant error.\n */\nexport class InvalidGrantError extends AuthError {\n  constructor(\n    message?: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      message || 'Invalid grant',\n      AuthErrorCode.INVALID_GRANT,\n      provider,\n      context,\n    );\n    this.name = 'InvalidGrantError';\n  }\n}\n\n/**\n * Invalid client error.\n */\nexport class InvalidClientError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Invalid client credentials',\n      AuthErrorCode.INVALID_CLIENT,\n      provider,\n      context,\n    );\n    this.name = 'InvalidClientError';\n  }\n}\n\n/**\n * Invalid redirect URI error.\n */\nexport class InvalidRedirectUriError extends AuthError {\n  constructor(provider?: string, context?: Record<string, unknown>) {\n    super(\n      'Invalid or mismatched redirect URI',\n      AuthErrorCode.INVALID_REDIRECT_URI,\n      provider,\n      context,\n    );\n    this.name = 'InvalidRedirectUriError';\n  }\n}\n\n// =============================================================================\n// NOSTR-SPECIFIC ERRORS\n// =============================================================================\n\n/**\n * Invalid signature error.\n */\nexport class InvalidSignatureError extends AuthError {\n  constructor(message?: string, context?: Record<string, unknown>) {\n    super(\n      message || 'Invalid event signature',\n      AuthErrorCode.INVALID_SIGNATURE,\n      'nostr',\n      context,\n    );\n    this.name = 'InvalidSignatureError';\n  }\n}\n\n/**\n * Relay error.\n */\nexport class RelayError extends AuthError {\n  public readonly relayUrl?: string;\n  public readonly originalError?: Error;\n\n  constructor(\n    message: string,\n    relayUrl?: string,\n    originalError?: Error,\n    context?: Record<string, unknown>,\n  ) {\n    super(message, AuthErrorCode.RELAY_ERROR, 'nostr', {\n      ...context,\n      relayUrl,\n    });\n    this.name = 'RelayError';\n    this.relayUrl = relayUrl;\n    this.originalError = originalError;\n  }\n}\n\n/**\n * Challenge expired error.\n */\nexport class ChallengeExpiredError extends AuthError {\n  constructor(context?: Record<string, unknown>) {\n    super(\n      'Authentication challenge has expired',\n      AuthErrorCode.CHALLENGE_EXPIRED,\n      'nostr',\n      context,\n    );\n    this.name = 'ChallengeExpiredError';\n  }\n}\n\n/**\n * NIP-07 extension not found error.\n */\nexport class ExtensionNotFoundError extends AuthError {\n  constructor(context?: Record<string, unknown>) {\n    super(\n      'NIP-07 browser extension not found. Install nos2x, Alby, or similar.',\n      AuthErrorCode.EXTENSION_NOT_FOUND,\n      'nostr',\n      context,\n    );\n    this.name = 'ExtensionNotFoundError';\n  }\n}\n\n/**\n * Invalid key error.\n */\nexport class InvalidKeyError extends AuthError {\n  constructor(message?: string, context?: Record<string, unknown>) {\n    super(\n      message || 'Invalid key format',\n      AuthErrorCode.INVALID_KEY,\n      'nostr',\n      context,\n    );\n    this.name = 'InvalidKeyError';\n  }\n}\n\n// =============================================================================\n// GENERAL ERRORS\n// =============================================================================\n\n/**\n * Not implemented error.\n */\nexport class NotImplementedError extends AuthError {\n  public readonly operation: string;\n\n  constructor(\n    operation: string,\n    provider?: string,\n    context?: Record<string, unknown>,\n  ) {\n    super(\n      `Operation '${operation}' is not supported by this provider`,\n      AuthErrorCode.NOT_IMPLEMENTED,\n      provider,\n      context,\n    );\n    this.name = 'NotImplementedError';\n    this.operation = operation;\n  }\n}\n\n/**\n * Check if an error is an AuthError.\n */\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError;\n}\n\n/**\n * Check if an error has a specific error code.\n */\nexport function hasErrorCode(error: unknown, code: AuthErrorCode): boolean {\n  return isAuthError(error) && error.code === code;\n}\n"],"mappings":";;;;;;;;;;AAUA,IAAY,gBAAL,yBAAA,eAAA;CAEL,cAAA,yBAAA;CACA,cAAA,mBAAA;CACA,cAAA,mBAAA;CACA,cAAA,2BAAA;CACA,cAAA,qBAAA;CACA,cAAA,kBAAA;CACA,cAAA,sBAAA;CAGA,cAAA,mBAAA;CACA,cAAA,wBAAA;CACA,cAAA,kBAAA;CAGA,cAAA,oBAAA;CACA,cAAA,yBAAA;CACA,cAAA,mBAAA;CAGA,cAAA,oBAAA;CACA,cAAA,yBAAA;CACA,cAAA,mBAAA;CAGA,cAAA,mBAAA;CACA,cAAA,mBAAA;CACA,cAAA,mBAAA;CACA,cAAA,oBAAA;CACA,cAAA,0BAAA;CAGA,cAAA,uBAAA;CACA,cAAA,iBAAA;CACA,cAAA,uBAAA;CACA,cAAA,yBAAA;CACA,cAAA,iBAAA;CAGA,cAAA,qBAAA;CACA,cAAA,mBAAA;;AACF,EAAA,CAAA,CAAA;;;;AAKA,IAAa,YAAb,MAAa,kBAAkB,MAAM;CACnC;CACA;CACA;CAEA,YACE,SACA,MACA,UACA,SACA;EACA,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,KAAK,UAAU;EAGf,IAAI,MAAM,mBACR,MAAM,kBAAkB,MAAM,SAAS;CAE3C;;;;CAKA,SAAkC;EAChC,OAAO;GACL,MAAM,KAAK;GACX,SAAS,KAAK;GACd,MAAM,KAAK;GACX,UAAU,KAAK;GACf,SAAS,KAAK;GACd,OAAO,KAAK;EACd;CACF;AACF;;;;AASA,IAAa,0BAAb,cAA6C,UAAU;CACrD,YAAY,UAAmB,SAAmC;EAChE,MACE,uBAAA,uBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YACE,SACA,UACA,SACA;EACA,MACE,WAAW,iBAAA,iBAEX,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,oBAAb,cAAuC,UAAU;CAC/C;CAEA,YACE,UACA,WACA,SACA;EACA,MAAM,qBAAA,iBAAkD,UAAU,OAAO;EACzE,KAAK,OAAO;EACZ,KAAK,YAAY;CACnB;AACF;;;;AAKA,IAAa,2BAAb,cAA8C,UAAU;CACtD,YAAY,UAAmB,SAAmC;EAChE,MACE,oCAAA,yBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,sBAAb,cAAyC,UAAU;CACjD,YAAY,UAAmB,SAAmC;EAChE,MACE,uBAAA,mBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,mBAAb,cAAsC,UAAU;CAC9C;CAEA,YACE,UACA,YACA,SACA;EACA,MACE,wCAAA,gBAEA,UACA,OACF;EACA,KAAK,OAAO;EACZ,KAAK,aAAa;CACpB;AACF;;;;AAKA,IAAa,sBAAb,cAAyC,UAAU;CACjD,YAAY,UAAmB,SAAmC;EAChE,MACE,oBAAA,oBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AASA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YACE,SACA,UACA,SACA;EACA,MACE,WAAW,iBAAA,iBAEX,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,yBAAb,cAA4C,UAAU;CACpD;CACA;CAEA,YACE,gBACA,eACA,UACA,SACA;EACA,MACE,iCAAiC,gBAAgB,KAAK,IAAI,KAAK,aAAA,sBAE/D,UACA,OACF;EACA,KAAK,OAAO;EACZ,KAAK,iBAAiB;EACtB,KAAK,gBAAgB;CACvB;AACF;;;;AASA,IAAa,oBAAb,cAAuC,UAAU;CAC/C;CAEA,YACE,QACA,UACA,SACA;EACA,MACE,SAAS,mBAAmB,WAAW,kBAAA,kBAEvC,UACA,OACF;EACA,KAAK,OAAO;EACZ,KAAK,SAAS;CAChB;AACF;;;;AAKA,IAAa,yBAAb,cAA4C,UAAU;CACpD,YACE,YACA,UACA,SACA;EACA,MACE,aAAa,wBAAwB,eAAe,uBAAA,uBAEpD,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YACE,QACA,UACA,SACA;EACA,MACE,SAAS,qBAAqB,WAAW,oBAAA,iBAEzC,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AASA,IAAa,gBAAb,cAAmC,UAAU;CAC3C;CAEA,YACE,SACA,UACA,eACA,SACA;EACA,MAAM,SAAA,kBAAuC,UAAU,OAAO;EAC9D,KAAK,OAAO;EACZ,KAAK,gBAAgB;CACvB;AACF;;;;AAKA,IAAa,qBAAb,cAAwC,UAAU;CAChD,YACE,SACA,UACA,SACA;EACA,MAAM,SAAA,uBAA4C,UAAU,OAAO;EACnE,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,eAAb,cAAkC,UAAU;CAC1C;CAEA,YACE,SACA,UACA,eACA,SACA;EACA,MACE,WAAW,iBAAA,iBAEX,UACA,OACF;EACA,KAAK,OAAO;EACZ,KAAK,gBAAgB;CACvB;AACF;;;;AASA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YAAY,UAAmB,SAAmC;EAChE,MACE,yCAAA,iBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YAAY,UAAmB,SAAmC;EAChE,MACE,+BAAA,iBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YACE,SACA,UACA,SACA;EACA,MACE,WAAW,iBAAA,iBAEX,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,qBAAb,cAAwC,UAAU;CAChD,YAAY,UAAmB,SAAmC;EAChE,MACE,8BAAA,kBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,0BAAb,cAA6C,UAAU;CACrD,YAAY,UAAmB,SAAmC;EAChE,MACE,sCAAA,wBAEA,UACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AASA,IAAa,wBAAb,cAA2C,UAAU;CACnD,YAAY,SAAkB,SAAmC;EAC/D,MACE,WAAW,2BAAA,qBAEX,SACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,aAAb,cAAgC,UAAU;CACxC;CACA;CAEA,YACE,SACA,UACA,eACA,SACA;EACA,MAAM,SAAA,eAAoC,SAAS;GACjD,GAAG;GACH;EACF,CAAC;EACD,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,KAAK,gBAAgB;CACvB;AACF;;;;AAKA,IAAa,wBAAb,cAA2C,UAAU;CACnD,YAAY,SAAmC;EAC7C,MACE,wCAAA,qBAEA,SACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,yBAAb,cAA4C,UAAU;CACpD,YAAY,SAAmC;EAC7C,MACE,wEAAA,uBAEA,SACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,YAAY,SAAkB,SAAmC;EAC/D,MACE,WAAW,sBAAA,eAEX,SACA,OACF;EACA,KAAK,OAAO;CACd;AACF;;;;AASA,IAAa,sBAAb,cAAyC,UAAU;CACjD;CAEA,YACE,WACA,UACA,SACA;EACA,MACE,cAAc,UAAU,sCAAA,mBAExB,UACA,OACF;EACA,KAAK,OAAO;EACZ,KAAK,YAAY;CACnB;AACF;;;;AAKA,SAAgB,YAAY,OAAoC;CAC9D,OAAO,iBAAiB;AAC1B;;;;AAKA,SAAgB,aAAa,OAAgB,MAA8B;CACzE,OAAO,YAAY,KAAK,KAAK,MAAM,SAAS;AAC9C"}