@happyvertical/auth 0.80.0 → 0.80.2

package/dist/chunks/google-C_p8rExJ.js

@@ -0,0 +1,374 @@
+import { S as ProviderError, T as TokenExpiredError, a as ConfigurationError, b as NetworkError, c as InvalidClientError, p as InvalidNonceError, t as AccessDeniedError, u as InvalidGrantError, v as InvalidTokenError, x as NotImplementedError } from "./errors-RgVH84_1.js";
+import { a as JWTClaimValidationFailed, i as JWSSignatureVerificationFailed, n as createRemoteJWKSet, o as JWTExpired, r as jwtVerify, t as decodeJwt } from "./decode_jwt-BvtACpi_.js";
+//#region src/shared/providers/google.ts
+/**
+* Google Provider - OAuth2/OIDC Authentication
+*
+* Implements OAuth2/OIDC authentication with Google including:
+* - OIDC Discovery
+* - Authorization Code Flow with PKCE
+* - Token validation using JWKS (RS256)
+* - ID token claims extraction
+*/
+/**
+* Generate a random string for state/nonce/PKCE.
+*/
+function generateRandomString(length = 32) {
+	const array = new Uint8Array(length);
+	crypto.getRandomValues(array);
+	return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Generate PKCE code verifier and challenge.
+*/
+async function generatePKCE() {
+	const verifier = generateRandomString(32);
+	const data = new TextEncoder().encode(verifier);
+	const hash = await crypto.subtle.digest("SHA-256", data);
+	return {
+		verifier,
+		challenge: btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+	};
+}
+/**
+* Google authentication provider.
+*
+* Implements OAuth2/OIDC authentication with Google.
+* Uses standard OIDC discovery and PKCE for security.
+*/
+var GoogleProvider = class GoogleProvider {
+	options;
+	discoveryDocument = null;
+	jwks = null;
+	static DISCOVERY_URL = "https://accounts.google.com/.well-known/openid-configuration";
+	constructor(options) {
+		if (!options.clientId) throw new ConfigurationError("clientId is required", "google");
+		if (!options.clientSecret) throw new ConfigurationError("clientSecret is required", "google");
+		this.options = {
+			usePKCE: true,
+			scopes: [
+				"openid",
+				"profile",
+				"email"
+			],
+			timeout: 3e4,
+			maxRetries: 3,
+			...options
+		};
+	}
+	/**
+	* Make an HTTP request with error handling.
+	*/
+	async request(url, options = {}, token) {
+		const headers = {
+			"Content-Type": "application/json",
+			...this.options.headers,
+			...options.headers
+		};
+		if (token) headers.Authorization = `Bearer ${token}`;
+		try {
+			const response = await fetch(url, {
+				...options,
+				headers,
+				signal: AbortSignal.timeout(this.options.timeout || 3e4)
+			});
+			if (!response.ok) {
+				const errorBody = await response.text().catch(() => "");
+				let errorData = {};
+				try {
+					errorData = JSON.parse(errorBody);
+				} catch {}
+				this.handleHttpError(response.status, errorData, errorBody);
+			}
+			const text = await response.text();
+			if (!text) return {};
+			return JSON.parse(text);
+		} catch (error) {
+			if (error instanceof Error && error.name === "TimeoutError") throw new NetworkError("Request timed out", "google", error);
+			if (error instanceof AccessDeniedError || error instanceof InvalidGrantError || error instanceof InvalidClientError || error instanceof ProviderError) throw error;
+			throw new NetworkError(`Network error: ${error instanceof Error ? error.message : "Unknown error"}`, "google", error instanceof Error ? error : void 0);
+		}
+	}
+	/**
+	* Handle HTTP error responses.
+	*/
+	handleHttpError(status, data, rawBody) {
+		const error = data.error;
+		const errorDescription = data.error_description || data.message || rawBody;
+		switch (status) {
+			case 400:
+				if (error === "invalid_grant") throw new InvalidGrantError(errorDescription, "google");
+				if (error === "invalid_client") throw new InvalidClientError("google");
+				throw new ProviderError(`Bad request: ${errorDescription}`, "google");
+			case 401: throw new InvalidClientError("google");
+			case 403: throw new AccessDeniedError(errorDescription, "google");
+			default: throw new ProviderError(`Google error (${status}): ${errorDescription}`, "google");
+		}
+	}
+	/**
+	* Fetch and cache the OIDC discovery document.
+	*/
+	async fetchDiscoveryDocument() {
+		if (this.discoveryDocument) return this.discoveryDocument;
+		this.discoveryDocument = await this.request(GoogleProvider.DISCOVERY_URL);
+		return this.discoveryDocument;
+	}
+	/**
+	* Get JWKS for token validation.
+	*/
+	async getJWKS() {
+		if (this.jwks) return this.jwks;
+		const discovery = await this.fetchDiscoveryDocument();
+		this.jwks = createRemoteJWKSet(new URL(discovery.jwks_uri));
+		return this.jwks;
+	}
+	async getAuthorizationUrl(options) {
+		const discovery = await this.fetchDiscoveryDocument();
+		const state = options?.state || generateRandomString();
+		const nonce = options?.nonce || generateRandomString();
+		const scopes = options?.scopes || this.options.scopes || [
+			"openid",
+			"profile",
+			"email"
+		];
+		const redirectUri = options?.redirectUri || this.options.redirectUri;
+		if (!redirectUri) throw new ConfigurationError("redirectUri is required", "google");
+		const params = new URLSearchParams({
+			client_id: this.options.clientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			scope: scopes.join(" "),
+			state,
+			nonce,
+			access_type: "offline"
+		});
+		if (options?.prompt) params.set("prompt", options.prompt);
+		if (options?.loginHint) params.set("login_hint", options.loginHint);
+		if (options?.extraParams) for (const [key, value] of Object.entries(options.extraParams)) params.set(key, value);
+		let codeVerifier;
+		if (this.options.usePKCE !== false) {
+			const pkce = await generatePKCE();
+			codeVerifier = pkce.verifier;
+			params.set("code_challenge", pkce.challenge);
+			params.set("code_challenge_method", "S256");
+		}
+		return {
+			url: `${discovery.authorization_endpoint}?${params.toString()}`,
+			state,
+			nonce,
+			codeVerifier
+		};
+	}
+	async exchangeCode(params) {
+		const discovery = await this.fetchDiscoveryDocument();
+		const redirectUri = params.redirectUri || this.options.redirectUri;
+		if (!redirectUri) throw new ConfigurationError("redirectUri is required", "google");
+		const body = new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: this.options.clientId,
+			client_secret: this.options.clientSecret,
+			code: params.code,
+			redirect_uri: redirectUri
+		});
+		if (params.codeVerifier) body.set("code_verifier", params.codeVerifier);
+		const response = await this.request(discovery.token_endpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: body.toString()
+		});
+		let userId = "";
+		if (response.id_token) userId = decodeJwt(response.id_token).sub || "";
+		return {
+			accessToken: response.access_token,
+			tokenType: response.token_type || "Bearer",
+			expiresIn: response.expires_in,
+			refreshToken: response.refresh_token,
+			idToken: response.id_token,
+			scope: response.scope,
+			userId
+		};
+	}
+	async authenticate(_credentials) {
+		throw new NotImplementedError("authenticate", "google", { reason: "Google only supports authorization code flow. Use getAuthorizationUrl() and exchangeCode() instead." });
+	}
+	async refresh(refreshToken) {
+		const discovery = await this.fetchDiscoveryDocument();
+		const body = new URLSearchParams({
+			grant_type: "refresh_token",
+			client_id: this.options.clientId,
+			client_secret: this.options.clientSecret,
+			refresh_token: refreshToken
+		});
+		const response = await this.request(discovery.token_endpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: body.toString()
+		});
+		let userId = "";
+		if (response.id_token) userId = decodeJwt(response.id_token).sub || "";
+		return {
+			accessToken: response.access_token,
+			tokenType: response.token_type || "Bearer",
+			expiresIn: response.expires_in,
+			refreshToken: response.refresh_token || refreshToken,
+			idToken: response.id_token,
+			scope: response.scope,
+			userId
+		};
+	}
+	async logout(options) {
+		if (options?.token) try {
+			await fetch(`https://oauth2.googleapis.com/revoke?token=${options.token}`, { method: "POST" });
+		} catch {}
+		if (options?.refreshToken) try {
+			await fetch(`https://oauth2.googleapis.com/revoke?token=${options.refreshToken}`, { method: "POST" });
+		} catch {}
+	}
+	async validateToken(token, options) {
+		try {
+			const jwks = await this.getJWKS();
+			const discovery = await this.fetchDiscoveryDocument();
+			const verifyOptions = {
+				issuer: options?.issuer || discovery.issuer,
+				clockTolerance: options?.clockTolerance || 0
+			};
+			if (!options?.issuer) verifyOptions.issuer = ["https://accounts.google.com", "accounts.google.com"];
+			if (options?.audience) verifyOptions.audience = options.audience;
+			const { payload } = await jwtVerify(token, jwks, verifyOptions);
+			if (options?.nonce && payload.nonce !== options.nonce) throw new InvalidNonceError("google");
+			return {
+				sub: payload.sub || "",
+				iss: payload.iss || "",
+				aud: payload.aud || "",
+				exp: payload.exp || 0,
+				iat: payload.iat || 0,
+				nbf: payload.nbf,
+				azp: payload.azp,
+				email: payload.email,
+				email_verified: payload.email_verified,
+				name: payload.name,
+				picture: payload.picture,
+				given_name: payload.given_name,
+				family_name: payload.family_name,
+				locale: payload.locale,
+				...payload
+			};
+		} catch (error) {
+			if (error instanceof JWTExpired) throw new TokenExpiredError("google");
+			if (error instanceof JWTClaimValidationFailed) return null;
+			if (error instanceof JWSSignatureVerificationFailed) throw new InvalidTokenError("Invalid token signature", "google");
+			if (error instanceof InvalidNonceError) throw error;
+			return null;
+		}
+	}
+	decodeToken(token) {
+		try {
+			const parts = token.split(".");
+			if (parts.length !== 3) throw new InvalidTokenError("Invalid JWT format", "google");
+			const header = JSON.parse(atob(parts[0]));
+			const payload = decodeJwt(token);
+			return {
+				header: {
+					alg: header.alg,
+					typ: header.typ,
+					kid: header.kid
+				},
+				payload,
+				signature: parts[2]
+			};
+		} catch {
+			throw new InvalidTokenError("Failed to decode token", "google");
+		}
+	}
+	async introspectToken(token) {
+		const claims = await this.validateToken(token);
+		return {
+			active: claims !== null,
+			claims: claims || void 0
+		};
+	}
+	async getProfile(tokenOrSession) {
+		const response = await this.request("https://www.googleapis.com/oauth2/v3/userinfo", { method: "GET" }, tokenOrSession);
+		return {
+			id: response.sub,
+			email: response.email,
+			emailVerified: response.email_verified,
+			firstName: response.given_name,
+			lastName: response.family_name,
+			displayName: response.name,
+			picture: response.picture
+		};
+	}
+	async updateProfile(_tokenOrSession, _profile) {
+		throw new NotImplementedError("updateProfile", "google", { reason: "Google does not support profile updates via OAuth2" });
+	}
+	async getUser(_userId, _adminToken) {
+		throw new NotImplementedError("getUser", "google", { reason: "Google does not expose admin user management" });
+	}
+	async createUser(_user, _adminToken) {
+		throw new NotImplementedError("createUser", "google", { reason: "Google does not expose user creation" });
+	}
+	async updateUser(_userId, _updates, _adminToken) {
+		throw new NotImplementedError("updateUser", "google", { reason: "Google does not expose user management" });
+	}
+	async deleteUser(_userId, _adminToken) {
+		throw new NotImplementedError("deleteUser", "google", { reason: "Google does not expose user management" });
+	}
+	async listUsers(_query, _adminToken) {
+		throw new NotImplementedError("listUsers", "google", { reason: "Google does not expose user listing" });
+	}
+	async requestPasswordReset(_email) {
+		throw new NotImplementedError("requestPasswordReset", "google", { reason: "Password management is handled by Google" });
+	}
+	async resetPassword(_token, _newPassword) {
+		throw new NotImplementedError("resetPassword", "google", { reason: "Password management is handled by Google" });
+	}
+	async listSessions(_userId, _adminToken) {
+		throw new NotImplementedError("listSessions", "google", { reason: "Session management is handled by Google" });
+	}
+	async revokeSession(_sessionId, _adminToken) {
+		throw new NotImplementedError("revokeSession", "google", { reason: "Session management is handled by Google" });
+	}
+	async revokeAllSessions(_userId, _adminToken) {
+		throw new NotImplementedError("revokeAllSessions", "google", { reason: "Session management is handled by Google" });
+	}
+	async hasRole(_tokenOrUserId, _role) {
+		return false;
+	}
+	async hasPermission(_tokenOrUserId, _permission, _resource) {
+		return false;
+	}
+	async getRoles(_tokenOrUserId, _adminToken) {
+		return [];
+	}
+	async assignRole(_userId, _role, _adminToken) {
+		throw new NotImplementedError("assignRole", "google", { reason: "Google does not support role management" });
+	}
+	async removeRole(_userId, _role, _adminToken) {
+		throw new NotImplementedError("removeRole", "google", { reason: "Google does not support role management" });
+	}
+	async getCapabilities() {
+		return {
+			authorizationCode: true,
+			passwordGrant: false,
+			clientCredentials: false,
+			tokenRefresh: true,
+			oidc: true,
+			userManagement: false,
+			sessionManagement: false,
+			rbac: false,
+			passwordReset: false,
+			mfa: true,
+			socialLogin: true,
+			federation: false,
+			decentralized: false
+		};
+	}
+	async getDiscoveryDocument() {
+		return this.fetchDiscoveryDocument();
+	}
+};
+//#endregion
+export { GoogleProvider };
+
+//# sourceMappingURL=google-C_p8rExJ.js.map

package/dist/chunks/google-C_p8rExJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-C_p8rExJ.js","names":[],"sources":["../../src/shared/providers/google.ts"],"sourcesContent":["/**\n * Google Provider - OAuth2/OIDC Authentication\n *\n * Implements OAuth2/OIDC authentication with Google including:\n * - OIDC Discovery\n * - Authorization Code Flow with PKCE\n * - Token validation using JWKS (RS256)\n * - ID token claims extraction\n */\n\nimport * as jose from 'jose';\n\nimport {\n  AccessDeniedError,\n  ConfigurationError,\n  InvalidClientError,\n  InvalidGrantError,\n  InvalidNonceError,\n  InvalidTokenError,\n  NetworkError,\n  NotImplementedError,\n  ProviderError,\n  TokenExpiredError,\n} from '../errors.js';\nimport type {\n  AuthCapabilities,\n  AuthCredentials,\n  AuthInterface,\n  AuthorizationOptions,\n  AuthorizationResult,\n  AuthResult,\n  CodeExchangeParams,\n  CreateUserRequest,\n  GoogleOptions,\n  LogoutOptions,\n  OIDCDiscoveryDocument,\n  Session,\n  TokenClaims,\n  TokenIntrospection,\n  TokenPayload,\n  TokenValidationOptions,\n  UserListResult,\n  UserProfile,\n  UserQuery,\n} from '../types.js';\n\n/**\n * Generate a random string for state/nonce/PKCE.\n */\nfunction generateRandomString(length = 32): string {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join(\n    '',\n  );\n}\n\n/**\n * Generate PKCE code verifier and challenge.\n */\nasync function generatePKCE(): Promise<{\n  verifier: string;\n  challenge: string;\n}> {\n  const verifier = generateRandomString(32);\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  const challenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n  return { verifier, challenge };\n}\n\n/**\n * Google authentication provider.\n *\n * Implements OAuth2/OIDC authentication with Google.\n * Uses standard OIDC discovery and PKCE for security.\n */\nexport class GoogleProvider implements AuthInterface {\n  private options: Required<Pick<GoogleOptions, 'clientId'>> & GoogleOptions;\n  private discoveryDocument: OIDCDiscoveryDocument | null = null;\n  private jwks: jose.JWTVerifyGetKey | null = null;\n\n  private static readonly DISCOVERY_URL =\n    'https://accounts.google.com/.well-known/openid-configuration';\n\n  constructor(options: GoogleOptions) {\n    if (!options.clientId) {\n      throw new ConfigurationError('clientId is required', 'google');\n    }\n    if (!options.clientSecret) {\n      throw new ConfigurationError('clientSecret is required', 'google');\n    }\n\n    this.options = {\n      usePKCE: true,\n      scopes: ['openid', 'profile', 'email'],\n      timeout: 30000,\n      maxRetries: 3,\n      ...options,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // INTERNAL HELPERS\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Make an HTTP request with error handling.\n   */\n  private async request<T>(\n    url: string,\n    options: RequestInit = {},\n    token?: string,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...this.options.headers,\n      ...(options.headers as Record<string, string>),\n    };\n\n    if (token) {\n      headers.Authorization = `Bearer ${token}`;\n    }\n\n    try {\n      const response = await fetch(url, {\n        ...options,\n        headers,\n        signal: AbortSignal.timeout(this.options.timeout || 30000),\n      });\n\n      if (!response.ok) {\n        const errorBody = await response.text().catch(() => '');\n        let errorData: Record<string, unknown> = {};\n        try {\n          errorData = JSON.parse(errorBody);\n        } catch {\n          // Not JSON\n        }\n\n        this.handleHttpError(response.status, errorData, errorBody);\n      }\n\n      const text = await response.text();\n      if (!text) return {} as T;\n      return JSON.parse(text) as T;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'TimeoutError') {\n        throw new NetworkError('Request timed out', 'google', error);\n      }\n      if (\n        error instanceof AccessDeniedError ||\n        error instanceof InvalidGrantError ||\n        error instanceof InvalidClientError ||\n        error instanceof ProviderError\n      ) {\n        throw error;\n      }\n      throw new NetworkError(\n        `Network error: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'google',\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Handle HTTP error responses.\n   */\n  private handleHttpError(\n    status: number,\n    data: Record<string, unknown>,\n    rawBody: string,\n  ): never {\n    const error = data.error as string | undefined;\n    const errorDescription = data.error_description || data.message || rawBody;\n\n    switch (status) {\n      case 400:\n        if (error === 'invalid_grant') {\n          throw new InvalidGrantError(errorDescription as string, 'google');\n        }\n        if (error === 'invalid_client') {\n          throw new InvalidClientError('google');\n        }\n        throw new ProviderError(`Bad request: ${errorDescription}`, 'google');\n\n      case 401:\n        throw new InvalidClientError('google');\n\n      case 403:\n        throw new AccessDeniedError(errorDescription as string, 'google');\n\n      default:\n        throw new ProviderError(\n          `Google error (${status}): ${errorDescription}`,\n          'google',\n        );\n    }\n  }\n\n  /**\n   * Fetch and cache the OIDC discovery document.\n   */\n  private async fetchDiscoveryDocument(): Promise<OIDCDiscoveryDocument> {\n    if (this.discoveryDocument) {\n      return this.discoveryDocument;\n    }\n\n    this.discoveryDocument = await this.request<OIDCDiscoveryDocument>(\n      GoogleProvider.DISCOVERY_URL,\n    );\n    return this.discoveryDocument;\n  }\n\n  /**\n   * Get JWKS for token validation.\n   */\n  private async getJWKS(): Promise<jose.JWTVerifyGetKey> {\n    if (this.jwks) {\n      return this.jwks;\n    }\n\n    const discovery = await this.fetchDiscoveryDocument();\n    this.jwks = jose.createRemoteJWKSet(new URL(discovery.jwks_uri));\n    return this.jwks;\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHENTICATION FLOWS\n  // ---------------------------------------------------------------------------\n\n  async getAuthorizationUrl(\n    options?: AuthorizationOptions,\n  ): Promise<AuthorizationResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const state = options?.state || generateRandomString();\n    const nonce = options?.nonce || generateRandomString();\n    const scopes = options?.scopes ||\n      this.options.scopes || ['openid', 'profile', 'email'];\n    const redirectUri = options?.redirectUri || this.options.redirectUri;\n\n    if (!redirectUri) {\n      throw new ConfigurationError('redirectUri is required', 'google');\n    }\n\n    const params = new URLSearchParams({\n      client_id: this.options.clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      scope: scopes.join(' '),\n      state,\n      nonce,\n      access_type: 'offline', // Request refresh token\n    });\n\n    if (options?.prompt) {\n      params.set('prompt', options.prompt);\n    }\n\n    if (options?.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n\n    // Add extra params\n    if (options?.extraParams) {\n      for (const [key, value] of Object.entries(options.extraParams)) {\n        params.set(key, value);\n      }\n    }\n\n    // PKCE\n    let codeVerifier: string | undefined;\n    if (this.options.usePKCE !== false) {\n      const pkce = await generatePKCE();\n      codeVerifier = pkce.verifier;\n      params.set('code_challenge', pkce.challenge);\n      params.set('code_challenge_method', 'S256');\n    }\n\n    const url = `${discovery.authorization_endpoint}?${params.toString()}`;\n\n    return {\n      url,\n      state,\n      nonce,\n      codeVerifier,\n    };\n  }\n\n  async exchangeCode(params: CodeExchangeParams): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const redirectUri = params.redirectUri || this.options.redirectUri;\n    if (!redirectUri) {\n      throw new ConfigurationError('redirectUri is required', 'google');\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      client_id: this.options.clientId,\n      client_secret: this.options.clientSecret!,\n      code: params.code,\n      redirect_uri: redirectUri,\n    });\n\n    // Code verifier for PKCE\n    if (params.codeVerifier) {\n      body.set('code_verifier', params.codeVerifier);\n    }\n\n    const response = await this.request<{\n      access_token: string;\n      refresh_token?: string;\n      id_token?: string;\n      expires_in: number;\n      token_type: string;\n      scope?: string;\n    }>(discovery.token_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    // Decode ID token to get user ID\n    let userId = '';\n    if (response.id_token) {\n      const payload = jose.decodeJwt(response.id_token);\n      userId = payload.sub || '';\n    }\n\n    return {\n      accessToken: response.access_token,\n      tokenType: response.token_type || 'Bearer',\n      expiresIn: response.expires_in,\n      refreshToken: response.refresh_token,\n      idToken: response.id_token,\n      scope: response.scope,\n      userId,\n    };\n  }\n\n  async authenticate(_credentials: AuthCredentials): Promise<AuthResult> {\n    throw new NotImplementedError('authenticate', 'google', {\n      reason:\n        'Google only supports authorization code flow. Use getAuthorizationUrl() and exchangeCode() instead.',\n    });\n  }\n\n  async refresh(refreshToken: string): Promise<AuthResult> {\n    const discovery = await this.fetchDiscoveryDocument();\n\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.options.clientId,\n      client_secret: this.options.clientSecret!,\n      refresh_token: refreshToken,\n    });\n\n    const response = await this.request<{\n      access_token: string;\n      refresh_token?: string;\n      id_token?: string;\n      expires_in: number;\n      token_type: string;\n      scope?: string;\n    }>(discovery.token_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    // Decode to get user ID\n    let userId = '';\n    if (response.id_token) {\n      const payload = jose.decodeJwt(response.id_token);\n      userId = payload.sub || '';\n    }\n\n    return {\n      accessToken: response.access_token,\n      tokenType: response.token_type || 'Bearer',\n      expiresIn: response.expires_in,\n      refreshToken: response.refresh_token || refreshToken,\n      idToken: response.id_token,\n      scope: response.scope,\n      userId,\n    };\n  }\n\n  async logout(options?: LogoutOptions): Promise<void> {\n    // Google uses token revocation endpoint\n    if (options?.token) {\n      try {\n        await fetch(\n          `https://oauth2.googleapis.com/revoke?token=${options.token}`,\n          { method: 'POST' },\n        );\n      } catch {\n        // Ignore revocation errors\n      }\n    }\n\n    if (options?.refreshToken) {\n      try {\n        await fetch(\n          `https://oauth2.googleapis.com/revoke?token=${options.refreshToken}`,\n          { method: 'POST' },\n        );\n      } catch {\n        // Ignore revocation errors\n      }\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // TOKEN OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async validateToken(\n    token: string,\n    options?: TokenValidationOptions,\n  ): Promise<TokenClaims | null> {\n    try {\n      const jwks = await this.getJWKS();\n      const discovery = await this.fetchDiscoveryDocument();\n\n      const verifyOptions: jose.JWTVerifyOptions = {\n        issuer: options?.issuer || discovery.issuer,\n        clockTolerance: options?.clockTolerance || 0,\n      };\n\n      // Google tokens can have 'accounts.google.com' or 'https://accounts.google.com' as issuer\n      if (!options?.issuer) {\n        verifyOptions.issuer = [\n          'https://accounts.google.com',\n          'accounts.google.com',\n        ];\n      }\n\n      if (options?.audience) {\n        verifyOptions.audience = options.audience;\n      }\n\n      const { payload } = await jose.jwtVerify(token, jwks, verifyOptions);\n\n      // Check nonce if provided\n      if (options?.nonce && payload.nonce !== options.nonce) {\n        throw new InvalidNonceError('google');\n      }\n\n      return {\n        sub: payload.sub || '',\n        iss: payload.iss || '',\n        aud: payload.aud || '',\n        exp: payload.exp || 0,\n        iat: payload.iat || 0,\n        nbf: payload.nbf,\n        azp: payload.azp as string | undefined,\n        email: payload.email as string | undefined,\n        email_verified: payload.email_verified as boolean | undefined,\n        name: payload.name as string | undefined,\n        picture: payload.picture as string | undefined,\n        given_name: payload.given_name as string | undefined,\n        family_name: payload.family_name as string | undefined,\n        locale: payload.locale as string | undefined,\n        ...payload,\n      };\n    } catch (error) {\n      if (error instanceof jose.errors.JWTExpired) {\n        throw new TokenExpiredError('google');\n      }\n      if (error instanceof jose.errors.JWTClaimValidationFailed) {\n        return null;\n      }\n      if (error instanceof jose.errors.JWSSignatureVerificationFailed) {\n        throw new InvalidTokenError('Invalid token signature', 'google');\n      }\n      if (error instanceof InvalidNonceError) {\n        throw error;\n      }\n      return null;\n    }\n  }\n\n  decodeToken(token: string): TokenPayload {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        throw new InvalidTokenError('Invalid JWT format', 'google');\n      }\n\n      const header = JSON.parse(atob(parts[0]));\n      const payload = jose.decodeJwt(token);\n\n      return {\n        header: {\n          alg: header.alg,\n          typ: header.typ,\n          kid: header.kid,\n        },\n        payload: payload as unknown as TokenClaims,\n        signature: parts[2],\n      };\n    } catch {\n      throw new InvalidTokenError('Failed to decode token', 'google');\n    }\n  }\n\n  async introspectToken(token: string): Promise<TokenIntrospection> {\n    // Google doesn't have a public introspection endpoint\n    // Fall back to local validation\n    const claims = await this.validateToken(token);\n    return {\n      active: claims !== null,\n      claims: claims || undefined,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // USER OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async getProfile(tokenOrSession: string): Promise<UserProfile> {\n    const response = await this.request<{\n      sub: string;\n      email?: string;\n      email_verified?: boolean;\n      name?: string;\n      given_name?: string;\n      family_name?: string;\n      picture?: string;\n      locale?: string;\n    }>(\n      'https://www.googleapis.com/oauth2/v3/userinfo',\n      { method: 'GET' },\n      tokenOrSession,\n    );\n\n    return {\n      id: response.sub,\n      email: response.email,\n      emailVerified: response.email_verified,\n      firstName: response.given_name,\n      lastName: response.family_name,\n      displayName: response.name,\n      picture: response.picture,\n    };\n  }\n\n  async updateProfile(\n    _tokenOrSession: string,\n    _profile: Partial<UserProfile>,\n  ): Promise<UserProfile> {\n    throw new NotImplementedError('updateProfile', 'google', {\n      reason: 'Google does not support profile updates via OAuth2',\n    });\n  }\n\n  async getUser(_userId: string, _adminToken?: string): Promise<UserProfile> {\n    throw new NotImplementedError('getUser', 'google', {\n      reason: 'Google does not expose admin user management',\n    });\n  }\n\n  async createUser(\n    _user: CreateUserRequest,\n    _adminToken: string,\n  ): Promise<UserProfile> {\n    throw new NotImplementedError('createUser', 'google', {\n      reason: 'Google does not expose user creation',\n    });\n  }\n\n  async updateUser(\n    _userId: string,\n    _updates: Partial<CreateUserRequest>,\n    _adminToken: string,\n  ): Promise<UserProfile> {\n    throw new NotImplementedError('updateUser', 'google', {\n      reason: 'Google does not expose user management',\n    });\n  }\n\n  async deleteUser(_userId: string, _adminToken: string): Promise<void> {\n    throw new NotImplementedError('deleteUser', 'google', {\n      reason: 'Google does not expose user management',\n    });\n  }\n\n  async listUsers(\n    _query: UserQuery,\n    _adminToken?: string,\n  ): Promise<UserListResult> {\n    throw new NotImplementedError('listUsers', 'google', {\n      reason: 'Google does not expose user listing',\n    });\n  }\n\n  async requestPasswordReset(_email: string): Promise<void> {\n    throw new NotImplementedError('requestPasswordReset', 'google', {\n      reason: 'Password management is handled by Google',\n    });\n  }\n\n  async resetPassword(_token: string, _newPassword: string): Promise<void> {\n    throw new NotImplementedError('resetPassword', 'google', {\n      reason: 'Password management is handled by Google',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // SESSION OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async listSessions(\n    _userId: string,\n    _adminToken?: string,\n  ): Promise<Session[]> {\n    throw new NotImplementedError('listSessions', 'google', {\n      reason: 'Session management is handled by Google',\n    });\n  }\n\n  async revokeSession(_sessionId: string, _adminToken?: string): Promise<void> {\n    throw new NotImplementedError('revokeSession', 'google', {\n      reason: 'Session management is handled by Google',\n    });\n  }\n\n  async revokeAllSessions(\n    _userId: string,\n    _adminToken?: string,\n  ): Promise<void> {\n    throw new NotImplementedError('revokeAllSessions', 'google', {\n      reason: 'Session management is handled by Google',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHORIZATION\n  // ---------------------------------------------------------------------------\n\n  async hasRole(_tokenOrUserId: string, _role: string): Promise<boolean> {\n    // Google doesn't have a concept of roles in OAuth\n    return false;\n  }\n\n  async hasPermission(\n    _tokenOrUserId: string,\n    _permission: string,\n    _resource?: string,\n  ): Promise<boolean> {\n    return false;\n  }\n\n  async getRoles(\n    _tokenOrUserId: string,\n    _adminToken?: string,\n  ): Promise<string[]> {\n    return [];\n  }\n\n  async assignRole(\n    _userId: string,\n    _role: string,\n    _adminToken: string,\n  ): Promise<void> {\n    throw new NotImplementedError('assignRole', 'google', {\n      reason: 'Google does not support role management',\n    });\n  }\n\n  async removeRole(\n    _userId: string,\n    _role: string,\n    _adminToken: string,\n  ): Promise<void> {\n    throw new NotImplementedError('removeRole', 'google', {\n      reason: 'Google does not support role management',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // PROVIDER INFORMATION\n  // ---------------------------------------------------------------------------\n\n  async getCapabilities(): Promise<AuthCapabilities> {\n    return {\n      authorizationCode: true,\n      passwordGrant: false,\n      clientCredentials: false,\n      tokenRefresh: true,\n      oidc: true,\n      userManagement: false,\n      sessionManagement: false,\n      rbac: false,\n      passwordReset: false,\n      mfa: true, // Google supports 2FA\n      socialLogin: true,\n      federation: false,\n      decentralized: false,\n    };\n  }\n\n  async getDiscoveryDocument(): Promise<OIDCDiscoveryDocument | null> {\n    return this.fetchDiscoveryDocument();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiDA,SAAS,qBAAqB,SAAS,IAAY;CACjD,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,OAAO,gBAAgB,KAAK;CAC5B,OAAO,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KACrE,EACF;AACF;;;;AAKA,eAAe,eAGZ;CACD,MAAM,WAAW,qBAAqB,EAAE;CAExC,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,QAAQ;CACpC,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAKvD,OAAO;EAAE;EAAU,WAJD,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,CAAC,CACjE,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EACC;CAAU;AAC/B;;;;;;;AAQA,IAAa,iBAAb,MAAa,eAAwC;CACnD;CACA,oBAA0D;CAC1D,OAA4C;CAE5C,OAAwB,gBACtB;CAEF,YAAY,SAAwB;EAClC,IAAI,CAAC,QAAQ,UACX,MAAM,IAAI,mBAAmB,wBAAwB,QAAQ;EAE/D,IAAI,CAAC,QAAQ,cACX,MAAM,IAAI,mBAAmB,4BAA4B,QAAQ;EAGnE,KAAK,UAAU;GACb,SAAS;GACT,QAAQ;IAAC;IAAU;IAAW;GAAO;GACrC,SAAS;GACT,YAAY;GACZ,GAAG;EACL;CACF;;;;CASA,MAAc,QACZ,KACA,UAAuB,CAAC,GACxB,OACY;EACZ,MAAM,UAAkC;GACtC,gBAAgB;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAI,QAAQ;EACd;EAEA,IAAI,OACF,QAAQ,gBAAgB,UAAU;EAGpC,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,KAAK;IAChC,GAAG;IACH;IACA,QAAQ,YAAY,QAAQ,KAAK,QAAQ,WAAW,GAAK;GAC3D,CAAC;GAED,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,YAAY,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;IACtD,IAAI,YAAqC,CAAC;IAC1C,IAAI;KACF,YAAY,KAAK,MAAM,SAAS;IAClC,QAAQ,CAER;IAEA,KAAK,gBAAgB,SAAS,QAAQ,WAAW,SAAS;GAC5D;GAEA,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,MAAM,OAAO,CAAC;GACnB,OAAO,KAAK,MAAM,IAAI;EACxB,SAAS,OAAO;GACd,IAAI,iBAAiB,SAAS,MAAM,SAAS,gBAC3C,MAAM,IAAI,aAAa,qBAAqB,UAAU,KAAK;GAE7D,IACE,iBAAiB,qBACjB,iBAAiB,qBACjB,iBAAiB,sBACjB,iBAAiB,eAEjB,MAAM;GAER,MAAM,IAAI,aACR,kBAAkB,iBAAiB,QAAQ,MAAM,UAAU,mBAC3D,UACA,iBAAiB,QAAQ,QAAQ,KAAA,CACnC;EACF;CACF;;;;CAKA,gBACE,QACA,MACA,SACO;EACP,MAAM,QAAQ,KAAK;EACnB,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,WAAW;EAEnE,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,iBACZ,MAAM,IAAI,kBAAkB,kBAA4B,QAAQ;IAElE,IAAI,UAAU,kBACZ,MAAM,IAAI,mBAAmB,QAAQ;IAEvC,MAAM,IAAI,cAAc,gBAAgB,oBAAoB,QAAQ;GAEtE,KAAK,KACH,MAAM,IAAI,mBAAmB,QAAQ;GAEvC,KAAK,KACH,MAAM,IAAI,kBAAkB,kBAA4B,QAAQ;GAElE,SACE,MAAM,IAAI,cACR,iBAAiB,OAAO,KAAK,oBAC7B,QACF;EACJ;CACF;;;;CAKA,MAAc,yBAAyD;EACrE,IAAI,KAAK,mBACP,OAAO,KAAK;EAGd,KAAK,oBAAoB,MAAM,KAAK,QAClC,eAAe,aACjB;EACA,OAAO,KAAK;CACd;;;;CAKA,MAAc,UAAyC;EACrD,IAAI,KAAK,MACP,OAAO,KAAK;EAGd,MAAM,YAAY,MAAM,KAAK,uBAAuB;EACpD,KAAK,OAAO,mBAAwB,IAAI,IAAI,UAAU,QAAQ,CAAC;EAC/D,OAAO,KAAK;CACd;CAMA,MAAM,oBACJ,SAC8B;EAC9B,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EACrD,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EACrD,MAAM,SAAS,SAAS,UACtB,KAAK,QAAQ,UAAU;GAAC;GAAU;GAAW;EAAO;EACtD,MAAM,cAAc,SAAS,eAAe,KAAK,QAAQ;EAEzD,IAAI,CAAC,aACH,MAAM,IAAI,mBAAmB,2BAA2B,QAAQ;EAGlE,MAAM,SAAS,IAAI,gBAAgB;GACjC,WAAW,KAAK,QAAQ;GACxB,cAAc;GACd,eAAe;GACf,OAAO,OAAO,KAAK,GAAG;GACtB;GACA;GACA,aAAa;EACf,CAAC;EAED,IAAI,SAAS,QACX,OAAO,IAAI,UAAU,QAAQ,MAAM;EAGrC,IAAI,SAAS,WACX,OAAO,IAAI,cAAc,QAAQ,SAAS;EAI5C,IAAI,SAAS,aACX,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,WAAW,GAC3D,OAAO,IAAI,KAAK,KAAK;EAKzB,IAAI;EACJ,IAAI,KAAK,QAAQ,YAAY,OAAO;GAClC,MAAM,OAAO,MAAM,aAAa;GAChC,eAAe,KAAK;GACpB,OAAO,IAAI,kBAAkB,KAAK,SAAS;GAC3C,OAAO,IAAI,yBAAyB,MAAM;EAC5C;EAIA,OAAO;GACL,KAAA,GAHa,UAAU,uBAAuB,GAAG,OAAO,SAAS;GAIjE;GACA;GACA;EACF;CACF;CAEA,MAAM,aAAa,QAAiD;EAClE,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,cAAc,OAAO,eAAe,KAAK,QAAQ;EACvD,IAAI,CAAC,aACH,MAAM,IAAI,mBAAmB,2BAA2B,QAAQ;EAGlE,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,eAAe,KAAK,QAAQ;GAC5B,MAAM,OAAO;GACb,cAAc;EAChB,CAAC;EAGD,IAAI,OAAO,cACT,KAAK,IAAI,iBAAiB,OAAO,YAAY;EAG/C,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;GAC3B,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAGD,IAAI,SAAS;EACb,IAAI,SAAS,UAEX,SADgB,UAAe,SAAS,QAC/B,CAAA,CAAQ,OAAO;EAG1B,OAAO;GACL,aAAa,SAAS;GACtB,WAAW,SAAS,cAAc;GAClC,WAAW,SAAS;GACpB,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB;EACF;CACF;CAEA,MAAM,aAAa,cAAoD;EACrE,MAAM,IAAI,oBAAoB,gBAAgB,UAAU,EACtD,QACE,sGACJ,CAAC;CACH;CAEA,MAAM,QAAQ,cAA2C;EACvD,MAAM,YAAY,MAAM,KAAK,uBAAuB;EAEpD,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,QAAQ;GACxB,eAAe,KAAK,QAAQ;GAC5B,eAAe;EACjB,CAAC;EAED,MAAM,WAAW,MAAM,KAAK,QAOzB,UAAU,gBAAgB;GAC3B,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAGD,IAAI,SAAS;EACb,IAAI,SAAS,UAEX,SADgB,UAAe,SAAS,QAC/B,CAAA,CAAQ,OAAO;EAG1B,OAAO;GACL,aAAa,SAAS;GACtB,WAAW,SAAS,cAAc;GAClC,WAAW,SAAS;GACpB,cAAc,SAAS,iBAAiB;GACxC,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB;EACF;CACF;CAEA,MAAM,OAAO,SAAwC;EAEnD,IAAI,SAAS,OACX,IAAI;GACF,MAAM,MACJ,8CAA8C,QAAQ,SACtD,EAAE,QAAQ,OAAO,CACnB;EACF,QAAQ,CAER;EAGF,IAAI,SAAS,cACX,IAAI;GACF,MAAM,MACJ,8CAA8C,QAAQ,gBACtD,EAAE,QAAQ,OAAO,CACnB;EACF,QAAQ,CAER;CAEJ;CAMA,MAAM,cACJ,OACA,SAC6B;EAC7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,QAAQ;GAChC,MAAM,YAAY,MAAM,KAAK,uBAAuB;GAEpD,MAAM,gBAAuC;IAC3C,QAAQ,SAAS,UAAU,UAAU;IACrC,gBAAgB,SAAS,kBAAkB;GAC7C;GAGA,IAAI,CAAC,SAAS,QACZ,cAAc,SAAS,CACrB,+BACA,qBACF;GAGF,IAAI,SAAS,UACX,cAAc,WAAW,QAAQ;GAGnC,MAAM,EAAE,YAAY,MAAM,UAAe,OAAO,MAAM,aAAa;GAGnE,IAAI,SAAS,SAAS,QAAQ,UAAU,QAAQ,OAC9C,MAAM,IAAI,kBAAkB,QAAQ;GAGtC,OAAO;IACL,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ,OAAO;IACpB,KAAK,QAAQ;IACb,KAAK,QAAQ;IACb,OAAO,QAAQ;IACf,gBAAgB,QAAQ;IACxB,MAAM,QAAQ;IACd,SAAS,QAAQ;IACjB,YAAY,QAAQ;IACpB,aAAa,QAAQ;IACrB,QAAQ,QAAQ;IAChB,GAAG;GACL;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,YACnB,MAAM,IAAI,kBAAkB,QAAQ;GAEtC,IAAI,iBAAiB,0BACnB,OAAO;GAET,IAAI,iBAAiB,gCACnB,MAAM,IAAI,kBAAkB,2BAA2B,QAAQ;GAEjE,IAAI,iBAAiB,mBACnB,MAAM;GAER,OAAO;EACT;CACF;CAEA,YAAY,OAA6B;EACvC,IAAI;GACF,MAAM,QAAQ,MAAM,MAAM,GAAG;GAC7B,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,kBAAkB,sBAAsB,QAAQ;GAG5D,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;GACxC,MAAM,UAAU,UAAe,KAAK;GAEpC,OAAO;IACL,QAAQ;KACN,KAAK,OAAO;KACZ,KAAK,OAAO;KACZ,KAAK,OAAO;IACd;IACS;IACT,WAAW,MAAM;GACnB;EACF,QAAQ;GACN,MAAM,IAAI,kBAAkB,0BAA0B,QAAQ;EAChE;CACF;CAEA,MAAM,gBAAgB,OAA4C;EAGhE,MAAM,SAAS,MAAM,KAAK,cAAc,KAAK;EAC7C,OAAO;GACL,QAAQ,WAAW;GACnB,QAAQ,UAAU,KAAA;EACpB;CACF;CAMA,MAAM,WAAW,gBAA8C;EAC7D,MAAM,WAAW,MAAM,KAAK,QAU1B,iDACA,EAAE,QAAQ,MAAM,GAChB,cACF;EAEA,OAAO;GACL,IAAI,SAAS;GACb,OAAO,SAAS;GAChB,eAAe,SAAS;GACxB,WAAW,SAAS;GACpB,UAAU,SAAS;GACnB,aAAa,SAAS;GACtB,SAAS,SAAS;EACpB;CACF;CAEA,MAAM,cACJ,iBACA,UACsB;EACtB,MAAM,IAAI,oBAAoB,iBAAiB,UAAU,EACvD,QAAQ,qDACV,CAAC;CACH;CAEA,MAAM,QAAQ,SAAiB,aAA4C;EACzE,MAAM,IAAI,oBAAoB,WAAW,UAAU,EACjD,QAAQ,+CACV,CAAC;CACH;CAEA,MAAM,WACJ,OACA,aACsB;EACtB,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,uCACV,CAAC;CACH;CAEA,MAAM,WACJ,SACA,UACA,aACsB;EACtB,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,yCACV,CAAC;CACH;CAEA,MAAM,WAAW,SAAiB,aAAoC;EACpE,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,yCACV,CAAC;CACH;CAEA,MAAM,UACJ,QACA,aACyB;EACzB,MAAM,IAAI,oBAAoB,aAAa,UAAU,EACnD,QAAQ,sCACV,CAAC;CACH;CAEA,MAAM,qBAAqB,QAA+B;EACxD,MAAM,IAAI,oBAAoB,wBAAwB,UAAU,EAC9D,QAAQ,2CACV,CAAC;CACH;CAEA,MAAM,cAAc,QAAgB,cAAqC;EACvE,MAAM,IAAI,oBAAoB,iBAAiB,UAAU,EACvD,QAAQ,2CACV,CAAC;CACH;CAMA,MAAM,aACJ,SACA,aACoB;EACpB,MAAM,IAAI,oBAAoB,gBAAgB,UAAU,EACtD,QAAQ,0CACV,CAAC;CACH;CAEA,MAAM,cAAc,YAAoB,aAAqC;EAC3E,MAAM,IAAI,oBAAoB,iBAAiB,UAAU,EACvD,QAAQ,0CACV,CAAC;CACH;CAEA,MAAM,kBACJ,SACA,aACe;EACf,MAAM,IAAI,oBAAoB,qBAAqB,UAAU,EAC3D,QAAQ,0CACV,CAAC;CACH;CAMA,MAAM,QAAQ,gBAAwB,OAAiC;EAErE,OAAO;CACT;CAEA,MAAM,cACJ,gBACA,aACA,WACkB;EAClB,OAAO;CACT;CAEA,MAAM,SACJ,gBACA,aACmB;EACnB,OAAO,CAAC;CACV;CAEA,MAAM,WACJ,SACA,OACA,aACe;EACf,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,0CACV,CAAC;CACH;CAEA,MAAM,WACJ,SACA,OACA,aACe;EACf,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,0CACV,CAAC;CACH;CAMA,MAAM,kBAA6C;EACjD,OAAO;GACL,mBAAmB;GACnB,eAAe;GACf,mBAAmB;GACnB,cAAc;GACd,MAAM;GACN,gBAAgB;GAChB,mBAAmB;GACnB,MAAM;GACN,eAAe;GACf,KAAK;GACL,aAAa;GACb,YAAY;GACZ,eAAe;EACjB;CACF;CAEA,MAAM,uBAA8D;EAClE,OAAO,KAAK,uBAAuB;CACrC;AACF"}