@happyvertical/smrt-app-mcp 0.53.3 → 0.53.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/AGENTS.md +23 -0
  2. package/README.md +154 -0
  3. package/dist/auth.d.ts +114 -2
  4. package/dist/auth.d.ts.map +1 -1
  5. package/dist/auth.js +147 -9
  6. package/dist/auth.js.map +1 -1
  7. package/dist/chunks/protocol-BlbEg3jn.js +7647 -0
  8. package/dist/chunks/protocol-BlbEg3jn.js.map +1 -0
  9. package/dist/defaults.d.ts +87 -0
  10. package/dist/defaults.d.ts.map +1 -0
  11. package/dist/errors.d.ts +2 -0
  12. package/dist/errors.d.ts.map +1 -1
  13. package/dist/index.d.ts +4 -3
  14. package/dist/index.d.ts.map +1 -1
  15. package/dist/index.js +3 -7351
  16. package/dist/index.js.map +1 -1
  17. package/dist/manifest.json +1 -1
  18. package/dist/own-data.d.ts +21 -0
  19. package/dist/own-data.d.ts.map +1 -0
  20. package/dist/server.d.ts +41 -0
  21. package/dist/server.d.ts.map +1 -1
  22. package/dist/smrt-knowledge.json +5 -5
  23. package/dist/sveltekit.d.ts +161 -1
  24. package/dist/sveltekit.d.ts.map +1 -1
  25. package/dist/sveltekit.js +158 -3
  26. package/dist/sveltekit.js.map +1 -1
  27. package/dist/tools.d.ts +18 -0
  28. package/dist/tools.d.ts.map +1 -1
  29. package/package.json +4 -4
  30. package/dist/chunks/protocol-Ce0U_XSp.js +0 -184
  31. package/dist/chunks/protocol-Ce0U_XSp.js.map +0 -1
package/dist/auth.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.js","names":[],"sources":["../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/local.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/remote.js","../src/auth.ts"],"sourcesContent":["const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder(\"utf-8\", { fatal: !0 }), MAX_INT32 = 2 ** 32;\nfunction concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers)\n buf.set(buffer, i), i += buffer.length;\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32)\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);\n}\nfunction uint64be(value) {\n const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);\n return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;\n}\nfunction uint32be(value) {\n const buf = new Uint8Array(4);\n return writeUInt32BE(buf, value), buf;\n}\nconst NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n if (typeof string == \"string\" && string.length >= 128) {\n if (NON_ASCII.test(string))\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n return encoder.encode(string);\n }\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127)\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n bytes[i] = code;\n }\n return bytes;\n}\nfunction encodeBase64(input, url = !1) {\n if (Uint8Array.prototype.toBase64)\n return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n const CHUNK_SIZE = 32768, arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE)\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n const encoded = btoa(arr.join(\"\"));\n return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = !1) {\n if (Uint8Array.fromBase64)\n return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n if (url) {\n if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n throw new TypeError(\"Invalid base64url\");\n encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n }\n const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++)\n bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\nasync function digest(algorithm, data) {\n const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\nexport {\n concat,\n decodeBase64,\n decoder,\n digest,\n encode,\n encodeBase64,\n encoder,\n strictDecoder,\n uint32be,\n uint64be\n};\n","class JOSEError extends Error {\n static code = \"ERR_JOSE_GENERIC\";\n code = \"ERR_JOSE_GENERIC\";\n constructor(message, options) {\n super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n }\n}\nclass JWTClaimValidationFailed extends JOSEError {\n static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JWTExpired extends JOSEError {\n static code = \"ERR_JWT_EXPIRED\";\n code = \"ERR_JWT_EXPIRED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JOSEAlgNotAllowed extends JOSEError {\n static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\nclass JOSENotSupported extends JOSEError {\n static code = \"ERR_JOSE_NOT_SUPPORTED\";\n code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWEDecryptionFailed extends JOSEError {\n static code = \"ERR_JWE_DECRYPTION_FAILED\";\n code = \"ERR_JWE_DECRYPTION_FAILED\";\n constructor(message = \"decryption operation failed\", options) {\n super(message, options);\n }\n}\nclass JWEInvalid extends JOSEError {\n static code = \"ERR_JWE_INVALID\";\n code = \"ERR_JWE_INVALID\";\n}\nclass JWSInvalid extends JOSEError {\n static code = \"ERR_JWS_INVALID\";\n code = \"ERR_JWS_INVALID\";\n}\nclass JWTInvalid extends JOSEError {\n static code = \"ERR_JWT_INVALID\";\n code = \"ERR_JWT_INVALID\";\n}\nclass JWKInvalid extends JOSEError {\n static code = \"ERR_JWK_INVALID\";\n code = \"ERR_JWK_INVALID\";\n}\nclass JWKSInvalid extends JOSEError {\n static code = \"ERR_JWKS_INVALID\";\n code = \"ERR_JWKS_INVALID\";\n}\nclass JWKSNoMatchingKey extends JOSEError {\n static code = \"ERR_JWKS_NO_MATCHING_KEY\";\n code = \"ERR_JWKS_NO_MATCHING_KEY\";\n constructor(message = \"no applicable key found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator] = async function* () {\n };\n static code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n constructor(message = \"multiple matching keys found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSTimeout extends JOSEError {\n static code = \"ERR_JWKS_TIMEOUT\";\n code = \"ERR_JWKS_TIMEOUT\";\n constructor(message = \"request timed out\", options) {\n super(message, options);\n }\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n constructor(message = \"signature verification failed\", options) {\n super(message, options);\n }\n}\nexport {\n JOSEAlgNotAllowed,\n JOSEError,\n JOSENotSupported,\n JWEDecryptionFailed,\n JWEInvalid,\n JWKInvalid,\n JWKSInvalid,\n JWKSMultipleMatchingKeys,\n JWKSNoMatchingKey,\n JWKSTimeout,\n JWSInvalid,\n JWSSignatureVerificationFailed,\n JWTClaimValidationFailed,\n JWTExpired,\n JWTInvalid\n};\n","import { encoder, decoder, encodeBase64, decodeBase64 } from \"../lib/buffer_utils.js\";\nconst invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n try {\n return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), !0);\n } catch (cause) {\n throw new TypeError(invalid, { cause });\n }\n}\nfunction encode(input) {\n return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, !0);\n}\nexport {\n decode,\n encode\n};\n","import { JOSENotSupported, JWSInvalid } from \"../util/errors.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { encode, strictDecoder } from \"./buffer_utils.js\";\nfunction assertUint8Array(input, label) {\n if (!(input instanceof Uint8Array))\n throw new TypeError(`${label} must be an instance of Uint8Array`);\n}\nfunction isObject(input) {\n if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n return !1;\n const prototype = Object.getPrototypeOf(input);\n return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isJwkSet(input) {\n return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);\n}\nfunction isDisjoint(...headers) {\n const parameters = /* @__PURE__ */ new Set();\n for (const header of headers)\n if (header)\n for (const parameter of Object.keys(header)) {\n if (parameters.has(parameter))\n return !1;\n parameters.add(parameter);\n }\n return !0;\n}\nfunction assertNotSet(value, name) {\n if (value !== void 0)\n throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n try {\n return decode(value);\n } catch {\n throw new ErrorClass(`Failed to base64url decode the ${label}`);\n }\n}\nfunction encodeBase64url(value, label, ErrorClass) {\n try {\n return encode(value);\n } catch {\n throw new ErrorClass(`The ${label} is not a valid base64url string`);\n }\n}\nfunction parseJoseHeader(b64, ErrorClass, message) {\n let parsed;\n try {\n parsed = JSON.parse(strictDecoder.decode(decode(b64)));\n } catch {\n throw new ErrorClass(message);\n }\n if (!isObject(parsed))\n throw new ErrorClass(message);\n return parsed;\n}\nconst JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };\nfunction validateAlgorithms(option, algorithms) {\n if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n throw new TypeError(`\"${option}\" option must be an array of strings`);\n return algorithms === void 0 ? void 0 : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n const { crit } = protectedHeader ?? {};\n if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)\n throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n if (!protectedHeader || protectedHeader.crit === void 0)\n return [];\n if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n for (const parameter of protectedHeader.crit) {\n if (!(parameter in recognized))\n throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)\n throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))\n throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n }\n return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n if (extensions.includes(\"b64\")) {\n const b64 = protectedHeader.b64;\n if (typeof b64 != \"boolean\")\n throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n return b64;\n }\n return !0;\n}\nfunction serializeJoseHeader(Err, header) {\n let serialized, parsed;\n try {\n serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n } catch (cause) {\n throw new Err(\"JOSE Header is not valid JSON\", { cause });\n }\n if (!isObject(parsed))\n throw new Err(\"JOSE Header is not a JSON object\");\n return [parsed, serialized];\n}\nexport {\n JWE_RECOGNIZED,\n JWS_RECOGNIZED,\n assertNotSet,\n assertUint8Array,\n decodeBase64url,\n encodeBase64url,\n isDisjoint,\n isJwkSet,\n isObject,\n parseJoseHeader,\n serializeJoseHeader,\n validateAlgorithms,\n validateB64,\n validateCrit,\n validateCritDuplicates\n};\n","import { isObject } from \"./validate.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nconst tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {\n const { alg } = entry;\n if (key.use !== void 0) {\n const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n if (key.use !== expected)\n throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n }\n if (key.alg !== void 0 && key.alg !== alg)\n throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n if (Array.isArray(key.key_ops)) {\n const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n }\n};\nasync function prepareKey(entry, key, usage) {\n const { alg, secret } = entry, privateKey = usage === \"decrypt\" || usage === \"sign\";\n if (secret && key instanceof Uint8Array)\n return key;\n let normalized, keyObject;\n if (isObject(key)) {\n if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n throw invalidKeyType(alg, key, secret);\n if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (privateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === void 0 && normalized.priv === void 0)))\n throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? \"private\" : \"public\"} JWK`);\n if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n return decode(normalized.k);\n if (!Object.isFrozen(key)) {\n const { key_ops } = key;\n Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n }\n } else {\n if (!isKeyLike(key))\n throw invalidKeyType(alg, key, secret);\n const expectedType = secret ? \"secret\" : privateKey ? \"private\" : \"public\";\n if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n if (isCryptoKey(key))\n return key;\n if (keyObject = key, keyObject.type === \"secret\")\n return keyObject.export();\n }\n cache ||= /* @__PURE__ */ new WeakMap();\n const cacheKey = key;\n let cached = cache.get(cacheKey);\n if (cached?.[alg])\n return cached[alg];\n if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n }\n return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nlet cache;\nconst nist = {\n __proto__: null,\n prime256v1: \"P-256\",\n secp384r1: \"P-384\",\n secp521r1: \"P-521\"\n};\nfunction assertCryptoKey(key) {\n if (!isCryptoKey(key))\n throw new Error(\"CryptoKey instance expected\");\n}\nconst isCryptoKey = (key) => {\n if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n return !0;\n try {\n return key instanceof CryptoKey;\n } catch {\n return !1;\n }\n}, isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n if (types.length > 2) {\n const last = types.pop();\n msg += `one of type ${types.join(\", \")}, or ${last}.`;\n } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nconst invalidKeyInput = (actual, ...types) => message(\"Key must be \", actual, ...types);\nfunction invalidKeyType(alg, actual, secret) {\n const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nconst unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n if (usage && !key.usages.includes(usage))\n throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n const { modulusLength } = key.algorithm;\n if (typeof modulusLength != \"number\" || modulusLength < 2048)\n throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n const algorithm = key.algorithm;\n if (algorithm.name !== expected.name)\n throw unusable(expected.name);\n if (expected.hash && algorithm.hash?.name !== expected.hash)\n throw unusable(expected.hash, \"algorithm.hash\");\n if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n if (expected.length !== void 0 && algorithm.length !== expected.length)\n throw unusable(expected.length, \"algorithm.length\");\n checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n const normalized = snapshotJwk(jwk);\n if (normalized.ext !== void 0 && typeof normalized.ext != \"boolean\")\n throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n if (normalized.key_ops !== void 0) {\n const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;\n if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n normalized.key_ops = keyOps;\n }\n return normalized;\n}\nfunction validateExtractableOption(extractable) {\n if (extractable !== void 0 && typeof extractable != \"boolean\")\n throw new TypeError('\"extractable\" option must be a boolean');\n return extractable;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n if (!entry.kty.includes(jwk.kty))\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = !1) {\n return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\nexport {\n assertCryptoKey,\n checkCryptoKey,\n checkModulusLength,\n checkUsage,\n invalidKeyInput,\n isCryptoKey,\n isKeyLike,\n isKeyObject,\n jwkToKey,\n normalizeJwk,\n prepareKey,\n rawKey,\n snapshotJwk,\n validateExtractableOption\n};\n","function table(entries) {\n const out = { __proto__: null };\n for (const alg in entries)\n out[alg] = { ...entries[alg], alg };\n return out;\n}\nexport {\n table\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n return { kty: [\"oct\"], secret: !0, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n return {\n kty: [\"RSA\"],\n subtle,\n signing: saltLength ? { ...subtle, saltLength } : subtle,\n usages: sig,\n minRsaBits: 2048\n };\n}\nfunction ecdsa(crv, bits) {\n return {\n kty: [\"EC\"],\n crv,\n subtle: { name: \"ECDSA\", namedCurve: crv },\n signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n usages: sig\n };\n}\nfunction eddsa() {\n const subtle = { name: \"Ed25519\" };\n return {\n kty: [\"OKP\"],\n crv: \"Ed25519\",\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nfunction mldsa(bits) {\n const subtle = { name: `ML-DSA-${bits}` };\n return {\n kty: [\"AKP\"],\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nconst JWS = table({\n HS256: hmac(256),\n HS384: hmac(384),\n HS512: hmac(512),\n RS256: rsa(256),\n RS384: rsa(384),\n RS512: rsa(512),\n PS256: rsa(256, 32),\n PS384: rsa(384, 48),\n PS512: rsa(512, 64),\n ES256: ecdsa(\"P-256\", 256),\n ES384: ecdsa(\"P-384\", 384),\n ES512: ecdsa(\"P-521\", 512),\n EdDSA: eddsa(),\n Ed25519: eddsa(),\n \"ML-DSA-44\": mldsa(44),\n \"ML-DSA-65\": mldsa(65),\n \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n const entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry)\n throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n return entry;\n}\nexport {\n JWS,\n jwsAlgorithm\n};\n","import { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from \"../util/errors.js\";\nimport { concat, decoder, encoder, encode } from \"./buffer_utils.js\";\nimport { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from \"./validate.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nfunction snapshotJws(jws, sharedPayload) {\n const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;\n let payload = sharedPayload ? sharedPayload[0] : jws.payload;\n !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));\n const signature = jws.signature, snapshot = { payload, signature };\n if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)\n throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n if (encodedProtected !== void 0 && typeof encodedProtected != \"string\")\n throw new JWSInvalid(\"JWS Protected Header incorrect type\");\n if (payload === void 0)\n throw new JWSInvalid(\"JWS Payload missing\");\n if (typeof signature != \"string\")\n throw new JWSInvalid(\"JWS Signature missing or incorrect type\");\n if (header !== void 0 && !isObject(header))\n throw new JWSInvalid(\"JWS Unprotected Header incorrect type\");\n return snapshot;\n}\nfunction prepareVerify(options) {\n return [options && validateAlgorithms(\"algorithms\", options.algorithms), options?.crit];\n}\nfunction parseProtectedHeader(encodedProtected) {\n return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, \"JWS Protected Header is invalid\");\n}\nfunction encodeJsonUnencodedPayload(payload) {\n const invalid = /[\\p{Cs}\\p{Cn}]/u.exec(payload)?.[0];\n if (invalid !== void 0)\n throw new JWSInvalid(/\\p{Cs}/u.test(invalid) ? \"JWS Payload must be a well-formed Unicode string\" : \"JWS Payload must not contain unassigned Unicode code points\");\n return encoder.encode(payload);\n}\nfunction encodeCompactUnencodedPayload(payload) {\n try {\n return encode(payload);\n } catch {\n throw new JWSInvalid(\"JWS Compact Serialization payload must use only ASCII characters\");\n }\n}\nasync function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {\n const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);\n if (!isDisjoint(parsedProt, header))\n throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;\n if (typeof alg != \"string\" || !alg)\n throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n if (shared[0] && !shared[0].has(alg))\n throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n if (b64) {\n if (typeof inputPayload != \"string\")\n throw new JWSInvalid(\"JWS Payload must be a string\");\n } else if (typeof inputPayload != \"string\" && !(inputPayload instanceof Uint8Array))\n throw new JWSInvalid(\"JWS Payload must be a string or an Uint8Array instance\");\n const signingPayload = b64 || typeof inputPayload != \"string\" ? inputPayload : encodeUnencodedPayload(inputPayload);\n let resolvedKey = !1;\n typeof key == \"function\" && (key = await key(parsedProt, jws), resolvedKey = !0);\n const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode(\".\"), typeof signingPayload == \"string\" ? shared[2] ??= encodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, \"signature\", JWSInvalid), k = await prepareKey(entry, key, \"verify\"), cryptoKey = await rawKey(k, entry.subtle, \"verify\");\n entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);\n let verified = !1;\n try {\n verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);\n } catch {\n }\n if (!verified)\n throw new JWSSignatureVerificationFailed();\n const result = { payload: typeof signingPayload == \"string\" ? decodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload };\n return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];\n}\nasync function verifyCompact(jws, shared, key) {\n if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != \"string\")\n throw new JWSInvalid(\"Compact JWS must be a string or Uint8Array\");\n const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(\".\");\n if (length !== 3)\n throw new JWSInvalid(\"Invalid Compact JWS\");\n return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);\n}\nexport {\n encodeJsonUnencodedPayload,\n parseProtectedHeader,\n prepareVerify,\n snapshotJws,\n verifyCompact,\n verifySignature\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from \"../util/errors.js\";\nimport { encoder, strictDecoder } from \"./buffer_utils.js\";\nimport { isObject } from \"./validate.js\";\nconst epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {\n s: 1,\n m: 60,\n h: 3600,\n d: 86400,\n w: 604800,\n y: 31557600\n}, REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = \"check_failed\";\nfunction invalidDuration() {\n throw new TypeError(\"Invalid time period format\");\n}\nfunction secs(str) {\n typeof str != \"string\" && invalidDuration();\n const matched = REGEX.exec(str);\n (!matched || matched[4] && matched[1]) && invalidDuration();\n const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);\n return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === \"-\" || matched[4] === \"ago\" ? -numericDate2 : numericDate2;\n}\nfunction validateInput(label, input) {\n if (!Number.isFinite(input))\n throw new TypeError(`Invalid ${label} input`);\n return input;\n}\nfunction validateStringClaim(claim, value) {\n if (typeof value != \"string\")\n throw new TypeError(`\"${claim}\" claim must be a string`);\n}\nfunction validateAudienceClaim(value) {\n if (typeof value != \"string\" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != \"string\")))\n throw new TypeError('\"aud\" claim must be a string or an array of strings');\n}\nfunction numericDate(value, label) {\n return typeof value == \"number\" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);\n}\nconst normalizeTyp = (value) => {\n const normalized = value.toLowerCase();\n return value.includes(\"/\") ? normalized : `application/${normalized}`;\n}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == \"string\" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;\nfunction validateNumericDate(payload, claim, required = !1) {\n const value = payload[claim];\n if (!(value === void 0 && !required)) {\n if (typeof value != \"number\")\n throw new JWTClaimValidationFailed(`\"${claim}\" claim must be a number`, payload, claim, \"invalid\");\n return value;\n }\n}\nfunction unexpectedClaim(payload, claim) {\n throw new JWTClaimValidationFailed(`unexpected \"${claim}\" claim value`, payload, claim, checkFailed);\n}\nfunction validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n let payload;\n try {\n payload = JSON.parse(strictDecoder.decode(encodedPayload));\n } catch {\n }\n if (!isObject(payload))\n throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\");\n const { typ } = options;\n if (typ !== void 0 && (typeof protectedHeader.typ != \"string\" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))\n throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, \"typ\", checkFailed);\n const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];\n maxTokenAge !== void 0 && presenceCheck.push(\"iat\"), audience !== void 0 && presenceCheck.push(\"aud\"), subject !== void 0 && presenceCheck.push(\"sub\"), issuer !== void 0 && presenceCheck.push(\"iss\");\n for (const claim of new Set(presenceCheck.reverse()))\n if (!Object.hasOwn(payload, claim))\n throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, \"missing\");\n issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, \"iss\"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, \"sub\"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == \"string\" ? [audience] : audience) && unexpectedClaim(payload, \"aud\");\n const { clockTolerance } = options;\n let tolerance = 0;\n if (typeof clockTolerance == \"string\")\n tolerance = secs(clockTolerance);\n else if (clockTolerance !== void 0) {\n if (typeof clockTolerance != \"number\")\n throw new TypeError(\"Invalid clockTolerance option type\");\n tolerance = clockTolerance;\n }\n validateInput(\"clockTolerance option\", tolerance);\n const { currentDate } = options, now = validateInput(\"currentDate option\", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, \"iat\", maxTokenAge !== void 0), nbf = validateNumericDate(payload, \"nbf\");\n if (nbf !== void 0 && nbf > now + tolerance)\n throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, \"nbf\", checkFailed);\n const exp = validateNumericDate(payload, \"exp\");\n if (exp !== void 0 && exp <= now - tolerance)\n throw new JWTExpired('\"exp\" claim timestamp check failed', payload, \"exp\", checkFailed);\n if (maxTokenAge !== void 0) {\n const age = now - iat, max = validateInput(\"maxTokenAge option\", typeof maxTokenAge == \"number\" ? maxTokenAge : secs(maxTokenAge));\n if (age - tolerance > max)\n throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, \"iat\", checkFailed);\n if (age < -tolerance)\n throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, \"iat\", checkFailed);\n }\n return payload;\n}\nlet producerPayloads;\nfunction producerPayload(producer) {\n return producerPayloads.get(producer);\n}\nfunction jwtData(producer) {\n const payload = producerPayload(producer);\n for (const claim of [\"iat\", \"nbf\", \"exp\"]) {\n const value = payload[claim];\n if (typeof value == \"number\" && !Number.isFinite(value))\n throw new TypeError(`\"${claim}\" claim must be a finite number`);\n }\n return encoder.encode(JSON.stringify(payload));\n}\nfunction jwtClaim(producer, claim) {\n return producerPayload(producer)[claim];\n}\nclass JWTClaimsBuilder {\n constructor(payload = {}) {\n if (!isObject(payload))\n throw new TypeError(\"JWT Claims Set MUST be an object\");\n (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));\n }\n setIssuer(value) {\n return validateStringClaim(\"iss\", value), producerPayload(this).iss = value, this;\n }\n setSubject(value) {\n return validateStringClaim(\"sub\", value), producerPayload(this).sub = value, this;\n }\n setAudience(value) {\n return validateAudienceClaim(value), producerPayload(this).aud = value, this;\n }\n setJti(value) {\n return validateStringClaim(\"jti\", value), producerPayload(this).jti = value, this;\n }\n setNotBefore(value) {\n return producerPayload(this).nbf = numericDate(value, \"setNotBefore\"), this;\n }\n setExpirationTime(value) {\n return producerPayload(this).exp = numericDate(value, \"setExpirationTime\"), this;\n }\n setIssuedAt(value) {\n const payload = producerPayload(this);\n return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == \"string\" ? payload.iat = validateInput(\"setIssuedAt\", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, \"setIssuedAt\"), this;\n }\n}\nexport {\n JWTClaimsBuilder,\n jwtClaim,\n jwtData,\n secs,\n validateClaimsSet\n};\n","import { prepareVerify, verifyCompact } from \"../lib/jws_verify.js\";\nimport { validateClaimsSet } from \"../lib/jwt_claims_set.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nasync function jwtVerify(jwt, key, options) {\n const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);\n if (!b64)\n throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n return { ...verified, payload };\n}\nexport {\n jwtVerify\n};\n","import { jwkToKey, snapshotJwk } from \"../lib/key.js\";\nimport { JWS } from \"../lib/jws_algorithms.js\";\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from \"../util/errors.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isUsableJWK(jwk, entry, alg, kid) {\n const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;\n return (ext === void 0 || typeof ext == \"boolean\") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == \"string\" && keyOps.indexOf(operation) === index) && keyOps.includes(\"verify\")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == \"string\" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== \"AKP\" : alg === jwkAlg) && (use === void 0 || use === \"sig\") && (!entry.crv || crv === entry.crv);\n}\nasync function importWithAlgCache(cache, jwk, entry) {\n const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;\n if (cached[alg] === void 0) {\n const pending = jwkToKey(entry, jwk, !0).then((key) => {\n if (key.type !== \"public\")\n throw new JWKSInvalid(\"JSON Web Key Set members must be public keys\");\n return cached[alg] = key, key;\n }).catch((error) => {\n throw cached[alg] === pending && delete cached[alg], error;\n });\n cached[alg] = pending;\n }\n return cached[alg];\n}\nfunction createLocalJWKSet(jwks) {\n let snapshot;\n try {\n snapshot = structuredClone(jwks);\n } catch {\n }\n if (!isJwkSet(snapshot))\n throw new JWKSInvalid(\"JSON Web Key Set malformed\");\n const metadata = snapshot.keys.map((jwk) => {\n const normalized = snapshotJwk(jwk);\n return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;\n }), cached = /* @__PURE__ */ new WeakMap();\n return Object.defineProperty(async (protectedHeader, token) => {\n const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry || entry.secret)\n throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;\n if (!length)\n throw new JWKSNoMatchingKey();\n if (length !== 1) {\n const error = new JWKSMultipleMatchingKeys();\n throw error[Symbol.asyncIterator] = async function* () {\n for (const jwk2 of candidates)\n try {\n yield await importWithAlgCache(cached, jwk2, entry);\n } catch {\n }\n }, error;\n }\n return importWithAlgCache(cached, jwk, entry);\n }, \"jwks\", {\n value: () => structuredClone(snapshot)\n });\n}\nexport {\n createLocalJWKSet\n};\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from \"../util/errors.js\";\nimport { createLocalJWKSet } from \"./local.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isCloudflareWorkers() {\n return typeof WebSocketPair < \"u\" || typeof navigator < \"u\" && navigator.userAgent === \"Cloudflare-Workers\" || typeof EdgeRuntime < \"u\" && EdgeRuntime === \"vercel\";\n}\nlet USER_AGENT;\n(typeof navigator > \"u\" || !navigator.userAgent?.startsWith?.(\"Mozilla/5.0 \")) && (USER_AGENT = \"jose/v6.2.12\");\nconst customFetch = /* @__PURE__ */ Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n const response = await fetchImpl(url, {\n method: \"GET\",\n signal,\n redirect: \"manual\",\n headers\n }).catch((err) => {\n throw err.name === \"TimeoutError\" ? new JWKSTimeout() : err;\n });\n if (response.status !== 200)\n throw new JOSEError(\"Expected 200 OK from the JSON Web Key Set HTTP response\");\n try {\n return await response.json();\n } catch {\n throw new JOSEError(\"Failed to parse the JSON Web Key Set HTTP response as JSON\");\n }\n}\nconst jwksCache = /* @__PURE__ */ Symbol();\nfunction isFreshFor(timestamp, duration) {\n return Number.isFinite(timestamp) && Date.now() < timestamp + duration;\n}\nfunction validateDuration(value, fallback, option) {\n if (Number.isNaN(value))\n throw new TypeError(`\"${option}\" option must not be NaN`);\n return typeof value == \"number\" ? value : fallback;\n}\nfunction createRemoteJWKSet(url, options) {\n if (!(url instanceof URL))\n throw new TypeError(\"url must be an instance of URL\");\n const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;\n if (typeof timeoutOption == \"number\" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))\n throw new TypeError('\"timeoutDuration\" option must be a non-negative integer');\n const timeoutDuration = typeof timeoutOption == \"number\" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, \"cooldownDuration\"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, \"cacheMaxAge\"), headers = new Headers(opts.headers);\n USER_AGENT && !headers.has(\"User-Agent\") && headers.set(\"User-Agent\", USER_AGENT), headers.has(\"accept\") || headers.set(\"accept\", \"application/json, application/jwk-set+json\");\n const fetchImpl = opts[customFetch], cache = opts[jwksCache];\n let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;\n if (cache && typeof cache == \"object\") {\n const { uat, jwks } = cache;\n isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));\n }\n const reload = async () => {\n if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {\n const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {\n const next = createLocalJWKSet(json);\n if (sequence <= appliedSequence)\n return;\n local = next;\n const updatedAt = Date.now();\n cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;\n }).finally(() => {\n pendingFetch === current && (pendingFetch = void 0);\n });\n }\n await pendingFetch;\n };\n return Object.defineProperties(async (protectedHeader, token) => {\n (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();\n try {\n return await local(protectedHeader, token);\n } catch (err) {\n if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))\n return await reload(), local(protectedHeader, token);\n throw err;\n }\n }, {\n coolingDown: {\n get: () => isFreshFor(jwksTimestamp, cooldownDuration),\n enumerable: !0\n },\n fresh: {\n get: () => isFreshFor(jwksTimestamp, cacheMaxAge),\n enumerable: !0\n },\n reload: {\n value: reload,\n enumerable: !0\n },\n reloading: {\n get: () => !!pendingFetch,\n enumerable: !0\n },\n jwks: {\n value: () => local?.jwks(),\n enumerable: !0\n }\n });\n}\nexport {\n createRemoteJWKSet,\n customFetch,\n jwksCache\n};\n","/** Server-only OAuth protected-resource boundary. This is not an issuer. */\nimport { createRemoteJWKSet, type JWTPayload, jwtVerify } from 'jose';\nimport type { McpAppPrincipal } from './server.js';\n\nexport type McpDeploymentProfile = 'local' | 'self-hosted' | 'cloud';\nexport interface McpVerifiedIdentity {\n readonly issuer: string;\n readonly subject: string;\n readonly scopes: readonly string[];\n readonly claims: Readonly<JWTPayload>;\n}\nexport interface McpPrincipalMapping {\n id: string;\n tenantId?: string;\n kind?: string;\n roles?: string[];\n}\nexport interface McpResourceAuthOptions {\n profile: McpDeploymentProfile;\n /** Exact public resource identifier; also the required token audience. */\n resource: string;\n /** Exact issuer identifier, including any trailing slash. */\n issuer: string;\n /** Operator-configured signing keys. Never derived from an untrusted token. */\n jwksUri: string;\n scopes: readonly string[];\n algorithms: readonly ('RS256' | 'ES256')[];\n /** Default at+jwt. Select JWT only for a provider that uses it for access tokens. */\n tokenType?: 'at+jwt' | 'JWT';\n /** Default true. Set false only for an explicitly single-tenant application. */\n requireTenant?: boolean;\n /** Re-run for every request; return null for revoked/disabled/unmapped users.\n * Resolve active tenant/membership in trusted application state, never request\n * arguments. Provider JWT revocation is NOT detected by offline validation.\n */\n resolvePrincipal(\n identity: McpVerifiedIdentity,\n ): Promise<McpPrincipalMapping | null>;\n}\n\nconst scopePattern = /^[\\x21\\x23-\\x5b\\x5d-\\x7e]+$/u;\nfunction validateUrl(value: string, profile: McpDeploymentProfile): URL {\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n throw new Error('Invalid MCP authorization URL.');\n }\n const loopback = ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname);\n if (\n url.username ||\n url.password ||\n url.search ||\n url.hash ||\n /[\\s\"\\\\]/u.test(value) ||\n (profile === 'local'\n ? !loopback || !['http:', 'https:'].includes(url.protocol)\n : url.protocol !== 'https:')\n )\n throw new Error('Invalid MCP authorization URL for deployment profile.');\n return url;\n}\nfunction validString(value: unknown): value is string {\n return (\n typeof value === 'string' &&\n value.length > 0 &&\n value.length <= 1024 &&\n value.trim() === value &&\n [...value].every(\n (character) =>\n character.charCodeAt(0) > 31 && character.charCodeAt(0) !== 127,\n )\n );\n}\n\nexport interface McpResourceAuth {\n /** Mount GET at this URL. Paths use RFC 9728's well-known path insertion. */\n readonly metadataUrl: string;\n metadataResponse(): Response;\n /** A failure response contains no token, claims or upstream error details. */\n authenticate(\n request: Request,\n ): Promise<\n | { ok: true; principal: McpAppPrincipal & { id: string } }\n | { ok: false; response: Response }\n >;\n}\n\nexport function createMcpResourceAuth(\n options: McpResourceAuthOptions,\n): McpResourceAuth {\n if (!['local', 'self-hosted', 'cloud'].includes(options.profile)) {\n throw new Error('Unknown MCP deployment profile.');\n }\n const resourceUrl = validateUrl(options.resource, options.profile);\n validateUrl(options.issuer, options.profile);\n validateUrl(options.jwksUri, options.profile);\n if (\n !options.algorithms.length ||\n options.algorithms.some((alg) => !['RS256', 'ES256'].includes(alg))\n ) {\n throw new Error('Explicit asymmetric MCP token algorithms are required.');\n }\n if (options.scopes.some((scope) => !scopePattern.test(scope))) {\n throw new Error('Invalid MCP OAuth scope.');\n }\n if (\n options.tokenType !== undefined &&\n !['at+jwt', 'JWT'].includes(options.tokenType)\n ) {\n throw new Error('Unsupported MCP access-token type.');\n }\n // Snapshot configuration so later caller mutation cannot broaden authority.\n const issuer = options.issuer;\n const resource = options.resource;\n const scopes = [...new Set(options.scopes)];\n const algorithms = [...options.algorithms];\n const tokenType = options.tokenType ?? 'at+jwt';\n const requireTenant = options.requireTenant !== false;\n const resolvePrincipal = options.resolvePrincipal;\n const keys = createRemoteJWKSet(new URL(options.jwksUri), {\n timeoutDuration: 5000,\n });\n const metadataUrl = `${resourceUrl.origin}/.well-known/oauth-protected-resource${resourceUrl.pathname === '/' ? '' : resourceUrl.pathname}`;\n function deny(error?: 'invalid_token' | 'insufficient_scope'): {\n ok: false;\n response: Response;\n } {\n const challenge = [\n `Bearer resource_metadata=\"${metadataUrl}\"`,\n ...(scopes.length ? [`scope=\"${scopes.join(' ')}\"`] : []),\n ...(error ? [`error=\"${error}\"`] : []),\n ].join(', ');\n return {\n ok: false,\n response: new Response(null, {\n status: error === 'insufficient_scope' ? 403 : 401,\n headers: { 'WWW-Authenticate': challenge, 'Cache-Control': 'no-store' },\n }),\n };\n }\n return {\n metadataUrl,\n metadataResponse: () =>\n Response.json(\n {\n resource,\n authorization_servers: [issuer],\n scopes_supported: scopes,\n bearer_methods_supported: ['header'],\n },\n { headers: { 'Cache-Control': 'no-store' } },\n ),\n async authenticate(request) {\n const authorization = request.headers.get('authorization');\n if (!authorization) return deny();\n const match =\n /^Bearer +([A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)$/iu.exec(\n authorization,\n );\n if (!match) return deny('invalid_token');\n try {\n const { payload } = await jwtVerify(match[1], keys, {\n issuer,\n audience: resource,\n algorithms,\n typ: tokenType,\n requiredClaims: ['iss', 'aud', 'sub', 'exp'],\n clockTolerance: 0,\n });\n if (!validString(payload.sub) || typeof payload.scope !== 'string')\n return deny('invalid_token');\n const granted = payload.scope === '' ? [] : payload.scope.split(' ');\n if (granted.some((scope) => !scopePattern.test(scope)))\n return deny('invalid_token');\n if (scopes.some((scope) => !granted.includes(scope)))\n return deny('insufficient_scope');\n const mapping = await resolvePrincipal(\n Object.freeze({\n issuer,\n subject: payload.sub,\n scopes: Object.freeze([...granted]),\n claims: Object.freeze(payload),\n }),\n );\n if (\n !mapping ||\n !validString(mapping.id) ||\n (requireTenant && !validString(mapping.tenantId)) ||\n (mapping.tenantId !== undefined && !validString(mapping.tenantId)) ||\n (mapping.kind !== undefined && !validString(mapping.kind)) ||\n (mapping.roles !== undefined &&\n (!Array.isArray(mapping.roles) ||\n !mapping.roles.every(validString)))\n ) {\n return deny('invalid_token');\n }\n return {\n ok: true,\n principal: {\n id: mapping.id,\n tenantId: mapping.tenantId,\n kind: mapping.kind,\n roles: mapping.roles ? [...mapping.roles] : undefined,\n scopes: [...granted],\n },\n };\n } catch {\n return deny('invalid_token');\n }\n },\n };\n}\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11],"mappings":";AAAA,IAAM,UAAU,IAAI,YAAY,GAAG,UAAU,IAAI,YAAY,GAAG,gBAAgB,IAAI,YAAY,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;AACtH,SAAS,OAAO,GAAG,SAAS;CAC1B,MAAM,OAAO,QAAQ,QAAQ,KAAK,EAAE,aAAa,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI,WAAW,IAAI;CAC5F,IAAI,IAAI;CACR,KAAK,MAAM,UAAU,SACnB,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO;CAClC,OAAO;AACT;AAcA,IAAM,YAAY;AAClB,SAAS,OAAO,QAAQ;CACtB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK;EACrD,IAAI,UAAU,KAAK,MAAM,GACvB,MAAM,IAAI,UAAU,0CAA0C;EAChE,OAAO,QAAQ,OAAO,MAAM;CAC9B;CACA,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACtC,MAAM,OAAO,OAAO,WAAW,CAAC;EAChC,IAAI,OAAO,KACT,MAAM,IAAI,UAAU,0CAA0C;EAChE,MAAM,KAAK;CACb;CACA,OAAO;AACT;AAUA,SAAS,aAAa,SAAS,MAAM,CAAC,GAAG;CACvC,IAAI,WAAW,YACb,OAAO,WAAW,WAAW,SAAS,EAAE,UAAU,MAAM,cAAc,SAAS,CAAC;CAClF,IAAI,KAAK;EACP,IAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAC/C,MAAM,IAAI,UAAU,mBAAmB;EACzC,UAAU,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACxD;CACA,MAAM,SAAS,KAAK,OAAO,GAAG,QAAQ,IAAI,WAAW,OAAO,MAAM;CAClE,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KACjC,MAAM,KAAK,OAAO,WAAW,CAAC;CAChC,OAAO;AACT;;;AC1DA,IAAM,YAAN,cAAwB,MAAM;CAC5B,OAAO,OAAO;CACd,OAAO;CACP,YAAY,SAAS,SAAS;EAC5B,MAAM,SAAS,OAAO,GAAG,KAAK,OAAO,KAAK,YAAY,MAAM,MAAM,oBAAoB,MAAM,KAAK,WAAW;CAC9G;AACF;AACA,IAAM,2BAAN,cAAuC,UAAU;CAC/C,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EAC3E,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC,GAAG,KAAK,QAAQ,OAAO,KAAK,SAAS,QAAQ,KAAK,UAAU;CAClH;AACF;AACA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EAC3E,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC,GAAG,KAAK,QAAQ,OAAO,KAAK,SAAS,QAAQ,KAAK,UAAU;CAClH;AACF;AACA,IAAM,oBAAN,cAAgC,UAAU;CACxC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,mBAAN,cAA+B,UAAU;CACvC,OAAO,OAAO;CACd,OAAO;AACT;AAYA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;AACT;AAKA,IAAM,cAAN,cAA0B,UAAU;CAClC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,oBAAN,cAAgC,UAAU;CACxC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,mDAAmD,SAAS;EAChF,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,2BAAN,cAAuC,UAAU;CAC/C,CAAC,OAAO,iBAAiB,mBAAmB,CAC5C;CACA,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,wDAAwD,SAAS;EACrF,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,cAAN,cAA0B,UAAU;CAClC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,qBAAqB,SAAS;EAClD,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,iCAAN,cAA6C,UAAU;CACrD,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,iCAAiC,SAAS;EAC9D,MAAM,SAAS,OAAO;CACxB;AACF;;;AC1FA,IAAM,UAAU;AAChB,SAAS,OAAO,OAAO;CACrB,IAAI;EACF,OAAO,aAAa,OAAO,SAAS,WAAW,QAAQ,QAAQ,OAAO,KAAK,GAAG,CAAC,CAAC;CAClF,SAAS,OAAO;EACd,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,CAAC;CACxC;AACF;;;ACDA,SAAS,SAAS,OAAO;CACvB,IAAI,OAAO,SAAS,YAAY,UAAU,QAAQ,OAAO,UAAU,SAAS,KAAK,KAAK,MAAM,mBAC1F,OAAO,CAAC;CACV,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,OAAO,cAAc,QAAQ,OAAO,eAAe,SAAS,MAAM;AACpE;AACA,SAAS,SAAS,OAAO;CACvB,OAAO,SAAS,KAAK,KAAK,MAAM,QAAQ,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,QAAQ;AAC9F;AACA,SAAS,WAAW,GAAG,SAAS;CAC9B,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,UAAU,SACnB,IAAI,QACF,KAAK,MAAM,aAAa,OAAO,KAAK,MAAM,GAAG;EAC3C,IAAI,WAAW,IAAI,SAAS,GAC1B,OAAO,CAAC;EACV,WAAW,IAAI,SAAS;CAC1B;CACJ,OAAO,CAAC;AACV;AAKA,SAAS,gBAAgB,OAAO,OAAO,YAAY;CACjD,IAAI;EACF,OAAO,OAAO,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,WAAW,kCAAkC,OAAO;CAChE;AACF;AACA,SAAS,gBAAgB,OAAO,OAAO,YAAY;CACjD,IAAI;EACF,OAAO,OAAO,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,WAAW,OAAO,MAAM,iCAAiC;CACrE;AACF;AACA,SAAS,gBAAgB,KAAK,YAAY,SAAS;CACjD,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,cAAc,OAAO,OAAO,GAAG,CAAC,CAAC;CACvD,QAAQ;EACN,MAAM,IAAI,WAAW,OAAO;CAC9B;CACA,IAAI,CAAC,SAAS,MAAM,GAClB,MAAM,IAAI,WAAW,OAAO;CAC9B,OAAO;AACT;AACA,IAAM,iBAAiB;CAAE,WAAW;CAAM,KAAK,CAAC;AAAE;AAClD,SAAS,mBAAmB,QAAQ,YAAY;CAC9C,IAAI,eAAe,KAAK,MAAM,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,MAAM,MAAM,OAAO,KAAK,QAAQ,IACrG,MAAM,IAAI,UAAU,IAAI,OAAO,qCAAqC;CACtE,OAAO,eAAe,KAAK,IAAI,KAAK,IAAI,IAAI,IAAI,UAAU;AAC5D;AAMA,SAAS,aAAa,KAAK,mBAAmB,kBAAkB,iBAAiB,YAAY;CAC3F,IAAI,WAAW,SAAS,KAAK,KAAK,iBAAiB,SAAS,KAAK,GAC/D,MAAM,IAAI,IAAI,kEAAgE;CAChF,IAAI,CAAC,mBAAmB,gBAAgB,SAAS,KAAK,GACpD,OAAO,CAAC;CACV,IAAI,CAAC,MAAM,QAAQ,gBAAgB,IAAI,KAAK,gBAAgB,KAAK,WAAW,KAAK,gBAAgB,KAAK,MAAM,UAAU,OAAO,SAAS,YAAY,MAAM,WAAW,CAAC,GAClK,MAAM,IAAI,IAAI,yFAAuF;CACvG,MAAM,aAAa,qBAAqB,KAAK,IAAI,oBAAoB;EAAE,WAAW;EAAM,GAAG;EAAkB,GAAG;CAAkB;CAClI,KAAK,MAAM,aAAa,gBAAgB,MAAM;EAC5C,IAAI,EAAE,aAAa,aACjB,MAAM,IAAI,iBAAiB,+BAA+B,UAAU,oBAAoB;EAC1F,IAAI,CAAC,OAAO,OAAO,YAAY,SAAS,KAAK,WAAW,eAAe,KAAK,GAC1E,MAAM,IAAI,IAAI,+BAA+B,UAAU,aAAa;EACtE,IAAI,WAAW,eAAe,CAAC,OAAO,OAAO,iBAAiB,SAAS,KAAK,gBAAgB,eAAe,KAAK,IAC9G,MAAM,IAAI,IAAI,+BAA+B,UAAU,8BAA8B;CACzF;CACA,OAAO,gBAAgB;AACzB;AACA,SAAS,YAAY,iBAAiB,YAAY;CAChD,IAAI,WAAW,SAAS,KAAK,GAAG;EAC9B,MAAM,MAAM,gBAAgB;EAC5B,IAAI,OAAO,OAAO,WAChB,MAAM,IAAI,WAAW,2EAAyE;EAChG,OAAO;CACT;CACA,OAAO,CAAC;AACV;;;AC1FA,IAAM,OAAO,QAAQ,IAAI,OAAO,cAAc,gBAAgB,OAAO,KAAK,UAAU;CAClF,MAAM,EAAE,QAAQ;CAChB,IAAI,IAAI,QAAQ,KAAK,GAAG;EACtB,MAAM,WAAW,UAAU,UAAU,UAAU,WAAW,QAAQ;EAClE,IAAI,IAAI,QAAQ,UACd,MAAM,IAAI,UAAU,sDAAsD,SAAS,eAAe;CACtG;CACA,IAAI,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KACpC,MAAM,IAAI,UAAU,sDAAsD,IAAI,eAAe;CAC/F,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG;EAC9B,MAAM,gBAAgB,UAAU,aAAa,UAAU,YAAY,MAAM,MAAM,UAAU,YAAY,IAAI,KAAK;EAC9G,IAAI,iBAAiB,CAAC,IAAI,QAAQ,SAAS,aAAa,GACtD,MAAM,IAAI,UAAU,+DAA+D,cAAc,eAAe;CACpH;AACF;AACA,eAAe,WAAW,OAAO,KAAK,OAAO;CAC3C,MAAM,EAAE,KAAK,WAAW,OAAO,aAAa,UAAU,aAAa,UAAU;CAC7E,IAAI,UAAU,eAAe,YAC3B,OAAO;CACT,IAAI,YAAY;CAChB,IAAI,SAAS,GAAG,GAAG;EACjB,IAAI,aAAa,aAAa,GAAG,GAAG,OAAO,WAAW,OAAO,UAC3D,MAAM,eAAe,KAAK,KAAK,MAAM;EACvC,IAAI,EAAE,SAAS,WAAW,QAAQ,SAAS,OAAO,WAAW,KAAK,WAAW,WAAW,QAAQ,UAAU,aAAa,WAAW,QAAQ,SAAS,OAAO,WAAW,QAAQ,YAAY,OAAO,WAAW,KAAK,WAAW,WAAW,MAAM,KAAK,KAAK,WAAW,SAAS,KAAK,KAC7Q,MAAM,IAAI,UAAU,SAAS,kIAA4H,6CAA6C,aAAa,YAAY,SAAS,KAAK;EAC/O,IAAI,aAAa,OAAO,YAAY,KAAK,GAAG,WAAW,QAAQ,OAC7D,OAAO,OAAO,WAAW,CAAC;EAC5B,IAAI,CAAC,OAAO,SAAS,GAAG,GAAG;GACzB,MAAM,EAAE,YAAY;GACpB,MAAM,QAAQ,OAAO,KAAK,OAAO,OAAO,OAAO,GAAG,OAAO,OAAO,GAAG;EACrE;CACF,OAAO;EACL,IAAI,CAAC,UAAU,GAAG,GAChB,MAAM,eAAe,KAAK,KAAK,MAAM;EACvC,MAAM,eAAe,SAAS,WAAW,aAAa,YAAY;EAClE,IAAI,IAAI,SAAS,iBAAiB,UAAU;GAAC;GAAU;GAAU;EAAS,CAAC,CAAC,SAAS,IAAI,IAAI,IAC3F,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,8BAA8B,aAAa,YAAY,IAAI,WAAW;EACxG,IAAI,YAAY,GAAG,GACjB,OAAO;EACT,IAAI,YAAY,KAAK,UAAU,SAAS,UACtC,OAAO,UAAU,OAAO;CAC5B;CACA,0BAA0B,IAAI,QAAQ;CACtC,MAAM,WAAW;CACjB,IAAI,SAAS,MAAM,IAAI,QAAQ;CAC/B,IAAI,SAAS,MACX,OAAO,OAAO;CAChB,IAAI,UAAU,MAAM,IAAI,UAAU,SAAS,CAAC,CAAC,GAAG,aAAa,OAAO,UAAU,eAAe,YAAY;EACvG,MAAM,WAAW,UAAU,SAAS,UAAU,MAAM,KAAK,UAAU,sBAAsB,aAAa,SAAS,MAAM,UAAU;GAAE;GAAK,mBAAmB,UAAU;EAAkB,CAAC,KAAK,MAAM;EACjM,OAAO,OAAO,OAAO,UAAU,YAAY,QAAQ,UAAU,MAAM,OAAO,WAAW,IAAI,EAAE;CAC7F;CACA,OAAO,eAAe,UAAU,OAAO,EAAE,QAAQ,MAAM,CAAC,GAAG,WAAW,MAAM,KAAK,OAAO,OAAO,MAAM,SAAS,OAAO,UAAU;AACjI;AACA,IAAI;AACJ,IAAM,OAAO;CACX,WAAW;CACX,YAAY;CACZ,WAAW;CACX,WAAW;AACb;AAKA,IAAM,eAAe,QAAQ;CAC3B,IAAI,MAAM,OAAO,iBAAiB,aAChC,OAAO,CAAC;CACV,IAAI;EACF,OAAO,eAAe;CACxB,QAAQ;EACN,OAAO,CAAC;CACV;AACF,GAAG,eAAe,QAAQ,MAAM,OAAO,iBAAiB,aAAa,aAAa,QAAQ,YAAY,GAAG,KAAK,YAAY,GAAG;AAC7H,SAAS,QAAQ,KAAK,QAAQ,GAAG,OAAO;CACtC,IAAI,MAAM,SAAS,GAAG;EACpB,MAAM,OAAO,MAAM,IAAI;EACvB,OAAO,eAAe,MAAM,KAAK,IAAI,EAAE,OAAO,KAAK;CACrD,OAAO,MAAM,WAAW,IAAI,OAAO,eAAe,MAAM,GAAG,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,MAAM,GAAG;CAC1G,OAAO,UAAU,OAAO,OAAO,aAAa,WAAW,OAAO,UAAU,cAAc,OAAO,OAAO,OAAO,sBAAsB,OAAO,SAAS,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAO,aAAa,SAAS,OAAO,4BAA4B,OAAO,YAAY,SAAS;AAC9R;AAEA,SAAS,eAAe,KAAK,QAAQ,QAAQ;CAC3C,MAAM,QAAQ;EAAC;EAAa;EAAa;CAAc;CACvD,OAAO,UAAU,MAAM,KAAK,YAAY,GAAG,IAAI,UAAU,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,GAAG,KAAK,CAAC;AAC7H;AACA,IAAM,YAAY,MAAM,OAAO,qCAAqB,IAAI,UAAU,kDAAkD,KAAK,WAAW,MAAM;AAC1I,SAAS,WAAW,KAAK,OAAO;CAC9B,IAAI,SAAS,CAAC,IAAI,OAAO,SAAS,KAAK,GACrC,MAAM,IAAI,UAAU,sEAAsE,MAAM,EAAE;AACtG;AACA,SAAS,mBAAmB,KAAK,KAAK;CACpC,MAAM,EAAE,kBAAkB,IAAI;CAC9B,IAAI,OAAO,iBAAiB,YAAY,gBAAgB,MACtD,MAAM,IAAI,UAAU,GAAG,IAAI,sDAAsD;AACrF;AACA,SAAS,eAAe,KAAK,UAAU,OAAO;CAC5C,MAAM,YAAY,IAAI;CACtB,IAAI,UAAU,SAAS,SAAS,MAC9B,MAAM,SAAS,SAAS,IAAI;CAC9B,IAAI,SAAS,QAAQ,UAAU,MAAM,SAAS,SAAS,MACrD,MAAM,SAAS,SAAS,MAAM,gBAAgB;CAChD,IAAI,SAAS,cAAc,UAAU,eAAe,SAAS,YAC3D,MAAM,SAAS,SAAS,YAAY,sBAAsB;CAC5D,IAAI,SAAS,WAAW,KAAK,KAAK,UAAU,WAAW,SAAS,QAC9D,MAAM,SAAS,SAAS,QAAQ,kBAAkB;CACpD,WAAW,KAAK,KAAK;AACvB;AACA,SAAS,YAAY,KAAK;CACxB,OAAO;EAAE,WAAW;EAAM,GAAG;CAAI;AACnC;AACA,SAAS,aAAa,KAAK;CACzB,MAAM,aAAa,YAAY,GAAG;CAClC,IAAI,WAAW,QAAQ,KAAK,KAAK,OAAO,WAAW,OAAO,WACxD,MAAM,IAAI,UAAU,mDAAiD;CACvE,IAAI,WAAW,YAAY,KAAK,GAAG;EACjC,MAAM,QAAQ,WAAW,SAAS,SAAS,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK;EACpF,IAAI,CAAC,UAAU,OAAO,MAAM,cAAc,OAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,QACzG,MAAM,IAAI,UAAU,2EAAyE;EAC/F,WAAW,UAAU;CACvB;CACA,OAAO;AACT;AAMA,eAAe,SAAS,OAAO,KAAK,aAAa;CAC/C,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,GAAG,GAC7B,MAAM,IAAI,iBAAiB,gEAA8D;CAC3F,MAAM,YAAY,MAAM,UAAU;EAAE,KAAK,IAAI;EAAK,KAAK,IAAI;CAAI,CAAC,KAAK,MAAM,QAAQ,YAAY,CAAC,EAAE,IAAI,KAAK,IAAI,OAAO,UAAU;EAAE,GAAG;EAAK,KAAK,eAAe,IAAI;CAAI;CACtK,OAAO,QAAQ,QAAQ,SAAS,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,OAAO,OAAO,UAAU,OAAO,SAAS,WAAW,QAAQ,OAAO,CAAC,WAAW,IAAI,WAAW,MAAM,OAAO,YAAY,IAAI,EAAE;AACtM;AACA,eAAe,OAAO,KAAK,UAAU,OAAO,cAAc,CAAC,GAAG;CAC5D,OAAO,eAAe,eAAe,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,KAAK,UAAU,aAAa,CAAC,KAAK,CAAC,IAAI,eAAe,KAAK,UAAU,KAAK,GAAG;AAC/J;;;AC1IA,SAAS,MAAM,SAAS;CACtB,MAAM,MAAM,EAAE,WAAW,KAAK;CAC9B,KAAK,MAAM,OAAO,SAChB,IAAI,OAAO;EAAE,GAAG,QAAQ;EAAM;CAAI;CACpC,OAAO;AACT;;;ACHA,IAAM,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC;AACjC,SAAS,KAAK,MAAM;CAClB,MAAM,SAAS;EAAE,MAAM;EAAQ,MAAM,OAAO;CAAO;CACnD,OAAO;EAAE,KAAK,CAAC,KAAK;EAAG,QAAQ,CAAC;EAAG;EAAQ,SAAS;EAAQ,QAAQ;CAAI;AAC1E;AACA,SAAS,IAAI,MAAM,YAAY;CAC7B,MAAM,SAAS;EAAE,MAAM,aAAa,YAAY;EAAqB,MAAM,OAAO;CAAO;CACzF,OAAO;EACL,KAAK,CAAC,KAAK;EACX;EACA,SAAS,aAAa;GAAE,GAAG;GAAQ;EAAW,IAAI;EAClD,QAAQ;EACR,YAAY;CACd;AACF;AACA,SAAS,MAAM,KAAK,MAAM;CACxB,OAAO;EACL,KAAK,CAAC,IAAI;EACV;EACA,QAAQ;GAAE,MAAM;GAAS,YAAY;EAAI;EACzC,SAAS;GAAE,MAAM;GAAS,MAAM,OAAO;EAAO;EAC9C,QAAQ;CACV;AACF;AACA,SAAS,QAAQ;CACf,MAAM,SAAS,EAAE,MAAM,UAAU;CACjC,OAAO;EACL,KAAK,CAAC,KAAK;EACX,KAAK;EACL;EACA,SAAS;EACT,QAAQ;CACV;AACF;AACA,SAAS,MAAM,MAAM;CACnB,MAAM,SAAS,EAAE,MAAM,UAAU,OAAO;CACxC,OAAO;EACL,KAAK,CAAC,KAAK;EACX;EACA,SAAS;EACT,QAAQ;CACV;AACF;AACA,IAAM,MAAM,MAAM;CAChB,OAAO,KAAK,GAAG;CACf,OAAO,KAAK,GAAG;CACf,OAAO,KAAK,GAAG;CACf,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM;CACb,SAAS,MAAM;CACf,aAAa,MAAM,EAAE;CACrB,aAAa,MAAM,EAAE;CACrB,aAAa,MAAM,EAAE;AACvB,CAAC;AACD,SAAS,aAAa,KAAK;CACzB,MAAM,QAAQ,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;CACvD,IAAI,CAAC,OACH,MAAM,IAAI,iBAAiB,OAAO,IAAI,4DAA4D;CACpG,OAAO;AACT;;;AC/CA,SAAS,cAAc,SAAS;CAC9B,OAAO,CAAC,WAAW,mBAAmB,cAAc,QAAQ,UAAU,GAAG,SAAS,IAAI;AACxF;AACA,SAAS,qBAAqB,kBAAkB;CAC9C,OAAO,qBAAqB,KAAK,IAAI,CAAC,IAAI,gBAAgB,kBAAkB,YAAY,iCAAiC;AAC3H;AAOA,SAAS,8BAA8B,SAAS;CAC9C,IAAI;EACF,OAAO,OAAO,OAAO;CACvB,QAAQ;EACN,MAAM,IAAI,WAAW,kEAAkE;CACzF;AACF;AACA,eAAe,gBAAgB,KAAK,QAAQ,KAAK,wBAAwB,iBAAiB;CACxF,MAAM,EAAE,WAAW,kBAAkB,QAAQ,SAAS,iBAAiB,KAAK,aAAa,mBAAmB,qBAAqB,gBAAgB;CACjJ,IAAI,CAAC,WAAW,YAAY,MAAM,GAChC,MAAM,IAAI,WAAW,2EAA2E;CAClG,MAAM,aAAa;EAAE,GAAG;EAAY,GAAG;CAAO,GAAG,MAAM,YAAY,YAAY,aAAa,YAAY,gBAAgB,OAAO,IAAI,YAAY,UAAU,CAAC,GAAG,EAAE,QAAQ;CACvK,IAAI,OAAO,OAAO,YAAY,CAAC,KAC7B,MAAM,IAAI,WAAW,6DAA2D;CAClF,IAAI,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,GACjC,MAAM,IAAI,kBAAkB,wDAAsD;CACpF,IAAI;MACE,OAAO,gBAAgB,UACzB,MAAM,IAAI,WAAW,8BAA8B;CAAA,OAChD,IAAI,OAAO,gBAAgB,YAAY,EAAE,wBAAwB,aACtE,MAAM,IAAI,WAAW,wDAAwD;CAC/E,MAAM,iBAAiB,OAAO,OAAO,gBAAgB,WAAW,eAAe,uBAAuB,YAAY;CAClH,IAAI,cAAc,CAAC;CACnB,OAAO,OAAO,eAAe,MAAM,MAAM,IAAI,YAAY,GAAG,GAAG,cAAc,CAAC;CAC9E,MAAM,QAAQ,aAAa,GAAG,GAAG,OAAO,OAAO,qBAAqB,KAAK,IAAI,OAAO,gBAAgB,oBAAI,IAAI,WAAW,GAAG,OAAO,GAAG,GAAG,OAAO,kBAAkB,WAAW,OAAO,OAAO,gBAAgB,gBAAgB,WAAW,UAAU,IAAI,cAAc,GAAG,YAAY,gBAAgB,IAAI,WAAW,aAAa,UAAU,GAAG,IAAI,MAAM,WAAW,OAAO,KAAK,QAAQ,GAAG,YAAY,MAAM,OAAO,GAAG,MAAM,QAAQ,QAAQ;CACta,MAAM,cAAc,mBAAmB,MAAM,KAAK,SAAS;CAC3D,IAAI,WAAW,CAAC;CAChB,IAAI;EACF,WAAW,MAAM,OAAO,OAAO,OAAO,MAAM,SAAS,WAAW,WAAW,IAAI;CACjF,QAAQ,CACR;CACA,IAAI,CAAC,UACH,MAAM,IAAI,+BAA+B;CAC3C,MAAM,SAAS,EAAE,SAAS,OAAO,kBAAkB,WAAW,gBAAgB,gBAAgB,WAAW,UAAU,IAAI,eAAe;CACtI,OAAO,qBAAqB,KAAK,MAAM,OAAO,kBAAkB,aAAa,WAAW,KAAK,MAAM,OAAO,oBAAoB,SAAS,cAAc,CAAC;EAAE,GAAG;EAAQ,KAAK;CAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG;AAClM;AACA,eAAe,cAAc,KAAK,QAAQ,KAAK;CAC7C,IAAI,eAAe,eAAe,MAAM,QAAQ,OAAO,GAAG,IAAI,OAAO,OAAO,UAC1E,MAAM,IAAI,WAAW,4CAA4C;CACnE,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,GAAG,WAAW,WAAW,IAAI,MAAM,GAAG;CAC9E,IAAI,WAAW,GACb,MAAM,IAAI,WAAW,qBAAqB;CAC5C,OAAO,gBAAgB;EAAE;EAAS,WAAW;EAAiB;CAAU,GAAG,QAAQ,KAAK,6BAA6B;AACvH;;;AC1EA,IAAM,SAAS,SAAS,KAAK,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAG,cAAc;CACtE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;AACL,GAAG,QAAQ,qIAAqI,cAAc;AAC9J,SAAS,kBAAkB;CACzB,MAAM,IAAI,UAAU,4BAA4B;AAClD;AACA,SAAS,KAAK,KAAK;CACjB,OAAO,OAAO,YAAY,gBAAgB;CAC1C,MAAM,UAAU,MAAM,KAAK,GAAG;CAC9B,CAAC,CAAC,WAAW,QAAQ,MAAM,QAAQ,OAAO,gBAAgB;CAC1D,MAAM,QAAQ,WAAW,QAAQ,EAAE,GAAG,eAAe,KAAK,MAAM,QAAQ,YAAY,QAAQ,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE;CAChH,OAAO,OAAO,SAAS,YAAY,KAAK,gBAAgB,GAAG,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ,CAAC,eAAe;AAC1H;AACA,SAAS,cAAc,OAAO,OAAO;CACnC,IAAI,CAAC,OAAO,SAAS,KAAK,GACxB,MAAM,IAAI,UAAU,WAAW,MAAM,OAAO;CAC9C,OAAO;AACT;AAYA,IAAM,gBAAgB,UAAU;CAC9B,MAAM,aAAa,MAAM,YAAY;CACrC,OAAO,MAAM,SAAS,GAAG,IAAI,aAAa,eAAe;AAC3D,GAAG,yBAAyB,YAAY,cAAc,OAAO,cAAc,WAAW,UAAU,SAAS,UAAU,IAAI,MAAM,QAAQ,UAAU,IAAI,UAAU,MAAM,QAAQ,WAAW,SAAS,GAAG,CAAC,IAAI,CAAC;AACxM,SAAS,oBAAoB,SAAS,OAAO,WAAW,CAAC,GAAG;CAC1D,MAAM,QAAQ,QAAQ;CACtB,IAAI,EAAE,UAAU,KAAK,KAAK,CAAC,WAAW;EACpC,IAAI,OAAO,SAAS,UAClB,MAAM,IAAI,yBAAyB,IAAI,MAAM,2BAA2B,SAAS,OAAO,SAAS;EACnG,OAAO;CACT;AACF;AACA,SAAS,gBAAgB,SAAS,OAAO;CACvC,MAAM,IAAI,yBAAyB,eAAe,MAAM,gBAAgB,SAAS,OAAO,WAAW;AACrG;AACA,SAAS,kBAAkB,iBAAiB,gBAAgB,UAAU,CAAC,GAAG;CACxE,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,cAAc,OAAO,cAAc,CAAC;CAC3D,QAAQ,CACR;CACA,IAAI,CAAC,SAAS,OAAO,GACnB,MAAM,IAAI,WAAW,gDAAgD;CACvE,MAAM,EAAE,QAAQ;CAChB,IAAI,QAAQ,KAAK,MAAM,OAAO,gBAAgB,OAAO,YAAY,aAAa,gBAAgB,GAAG,MAAM,aAAa,GAAG,IACrH,MAAM,IAAI,yBAAyB,uCAAqC,SAAS,OAAO,WAAW;CACrG,MAAM,EAAE,iBAAiB,CAAC,GAAG,QAAQ,SAAS,UAAU,gBAAgB,SAAS,gBAAgB,CAAC,GAAG,cAAc;CACnH,gBAAgB,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,aAAa,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,YAAY,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,WAAW,KAAK,KAAK,cAAc,KAAK,KAAK;CACrM,KAAK,MAAM,SAAS,IAAI,IAAI,cAAc,QAAQ,CAAC,GACjD,IAAI,CAAC,OAAO,OAAO,SAAS,KAAK,GAC/B,MAAM,IAAI,yBAAyB,qBAAqB,MAAM,UAAU,SAAS,OAAO,SAAS;CACrG,WAAW,KAAK,KAAK,EAAE,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM,EAAA,CAAG,SAAS,QAAQ,GAAG,KAAK,gBAAgB,SAAS,KAAK,GAAG,YAAY,KAAK,KAAK,QAAQ,QAAQ,WAAW,gBAAgB,SAAS,KAAK,GAAG,aAAa,KAAK,KAAK,CAAC,sBAAsB,QAAQ,KAAK,OAAO,YAAY,WAAW,CAAC,QAAQ,IAAI,QAAQ,KAAK,gBAAgB,SAAS,KAAK;CAC/V,MAAM,EAAE,mBAAmB;CAC3B,IAAI,YAAY;CAChB,IAAI,OAAO,kBAAkB,UAC3B,YAAY,KAAK,cAAc;MAC5B,IAAI,mBAAmB,KAAK,GAAG;EAClC,IAAI,OAAO,kBAAkB,UAC3B,MAAM,IAAI,UAAU,oCAAoC;EAC1D,YAAY;CACd;CACA,cAAc,yBAAyB,SAAS;CAChD,MAAM,EAAE,gBAAgB,SAAS,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,KAAK,oBAAoB,IAAI,KAAK,IAAI,WAAW,CAAC,GAAG,MAAM,oBAAoB,SAAS,OAAO,gBAAgB,KAAK,CAAC,GAAG,MAAM,oBAAoB,SAAS,KAAK;CACjQ,IAAI,QAAQ,KAAK,KAAK,MAAM,MAAM,WAChC,MAAM,IAAI,yBAAyB,wCAAsC,SAAS,OAAO,WAAW;CACtG,MAAM,MAAM,oBAAoB,SAAS,KAAK;CAC9C,IAAI,QAAQ,KAAK,KAAK,OAAO,MAAM,WACjC,MAAM,IAAI,WAAW,wCAAsC,SAAS,OAAO,WAAW;CACxF,IAAI,gBAAgB,KAAK,GAAG;EAC1B,MAAM,MAAM,MAAM,KAAK,MAAM,cAAc,sBAAsB,OAAO,eAAe,WAAW,cAAc,KAAK,WAAW,CAAC;EACjI,IAAI,MAAM,YAAY,KACpB,MAAM,IAAI,WAAW,8DAA4D,SAAS,OAAO,WAAW;EAC9G,IAAI,MAAM,CAAC,WACT,MAAM,IAAI,yBAAyB,mEAAiE,SAAS,OAAO,WAAW;CACnI;CACA,OAAO;AACT;;;AC1FA,eAAe,UAAU,KAAK,KAAK,SAAS;CAC1C,MAAM,CAAC,UAAU,OAAO,MAAM,cAAc,KAAK,cAAc,OAAO,GAAG,GAAG;CAC5E,IAAI,CAAC,KACH,MAAM,IAAI,WAAW,qCAAqC;CAC5D,MAAM,UAAU,kBAAkB,SAAS,iBAAiB,SAAS,SAAS,OAAO;CACrF,OAAO;EAAE,GAAG;EAAU;CAAQ;AAChC;;;ACLA,SAAS,YAAY,KAAK,OAAO,KAAK,KAAK;CACzC,MAAM,EAAE,KAAK,SAAS,QAAQ,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ;CAC1E,QAAQ,QAAQ,KAAK,KAAK,OAAO,OAAO,eAAe,WAAW,KAAK,KAAK,MAAM,QAAQ,MAAM,KAAK,OAAO,OAAO,WAAW,UAAU,OAAO,aAAa,YAAY,OAAO,QAAQ,SAAS,MAAM,KAAK,KAAK,OAAO,SAAS,QAAQ,MAAM,MAAM,IAAI,SAAS,GAAG,MAAM,QAAQ,KAAK,KAAK,OAAO,OAAO,YAAY,QAAQ,YAAY,WAAW,KAAK,IAAI,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,KAAK,KAAK,QAAQ,WAAW,CAAC,MAAM,OAAO,QAAQ,MAAM;AACrc;AACA,eAAe,mBAAmB,OAAO,KAAK,OAAO;CACnD,MAAM,SAAS,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,QAAQ;CACxE,IAAI,OAAO,SAAS,KAAK,GAAG;EAC1B,MAAM,UAAU,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ;GACrD,IAAI,IAAI,SAAS,UACf,MAAM,IAAI,YAAY,8CAA8C;GACtE,OAAO,OAAO,OAAO,KAAK;EAC5B,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,MAAM,OAAO,SAAS,WAAW,OAAO,OAAO,MAAM;EACvD,CAAC;EACD,OAAO,OAAO;CAChB;CACA,OAAO,OAAO;AAChB;AACA,SAAS,kBAAkB,MAAM;CAC/B,IAAI;CACJ,IAAI;EACF,WAAW,gBAAgB,IAAI;CACjC,QAAQ,CACR;CACA,IAAI,CAAC,SAAS,QAAQ,GACpB,MAAM,IAAI,YAAY,4BAA4B;CACpD,MAAM,WAAW,SAAS,KAAK,KAAK,QAAQ;EAC1C,MAAM,aAAa,YAAY,GAAG;EAClC,OAAO,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,UAAU,CAAC,GAAG,WAAW,OAAO,IAAI;CAC9F,CAAC,GAAG,yBAAyB,IAAI,QAAQ;CACzC,OAAO,OAAO,eAAe,OAAO,iBAAiB,UAAU;EAC7D,MAAM,EAAE,KAAK,QAAQ;GAAE,GAAG;GAAiB,GAAG,OAAO;EAAO,GAAG,QAAQ,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;EAChH,IAAI,CAAC,SAAS,MAAM,QAClB,MAAM,IAAI,iBAAiB,kDAAgD;EAC7E,MAAM,aAAa,SAAS,KAAK,QAAQ,GAAG,UAAU,YAAY,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,WAAW;EAC3H,IAAI,CAAC,QACH,MAAM,IAAI,kBAAkB;EAC9B,IAAI,WAAW,GAAG;GAChB,MAAM,QAAQ,IAAI,yBAAyB;GAC3C,MAAM,MAAM,OAAO,iBAAiB,mBAAmB;IACrD,KAAK,MAAM,QAAQ,YACjB,IAAI;KACF,MAAM,MAAM,mBAAmB,QAAQ,MAAM,KAAK;IACpD,QAAQ,CACR;GACJ,GAAG;EACL;EACA,OAAO,mBAAmB,QAAQ,KAAK,KAAK;CAC9C,GAAG,QAAQ,EACT,aAAa,gBAAgB,QAAQ,EACvC,CAAC;AACH;;;ACpDA,SAAS,sBAAsB;CAC7B,OAAO,OAAO,gBAAgB,OAAO,OAAO,YAAY,OAAO,UAAU,cAAc,wBAAwB,OAAO,cAAc,OAAO,gBAAgB;AAC7J;AACA,IAAI;CACH,OAAO,YAAY,OAAO,CAAC,UAAU,WAAW,aAAa,cAAc,OAAO,aAAa;AAChG,IAAM,cAA8B,uBAAO;AAC3C,eAAe,UAAU,KAAK,SAAS,QAAQ,YAAY,OAAO;CAChE,MAAM,WAAW,MAAM,UAAU,KAAK;EACpC,QAAQ;EACR;EACA,UAAU;EACV;CACF,CAAC,CAAC,CAAC,OAAO,QAAQ;EAChB,MAAM,IAAI,SAAS,iBAAiB,IAAI,YAAY,IAAI;CAC1D,CAAC;CACD,IAAI,SAAS,WAAW,KACtB,MAAM,IAAI,UAAU,yDAAyD;CAC/E,IAAI;EACF,OAAO,MAAM,SAAS,KAAK;CAC7B,QAAQ;EACN,MAAM,IAAI,UAAU,4DAA4D;CAClF;AACF;AACA,IAAM,YAA4B,uBAAO;AACzC,SAAS,WAAW,WAAW,UAAU;CACvC,OAAO,OAAO,SAAS,SAAS,KAAK,KAAK,IAAI,IAAI,YAAY;AAChE;AACA,SAAS,iBAAiB,OAAO,UAAU,QAAQ;CACjD,IAAI,OAAO,MAAM,KAAK,GACpB,MAAM,IAAI,UAAU,IAAI,OAAO,yBAAyB;CAC1D,OAAO,OAAO,SAAS,WAAW,QAAQ;AAC5C;AACA,SAAS,mBAAmB,KAAK,SAAS;CACxC,IAAI,EAAE,eAAe,MACnB,MAAM,IAAI,UAAU,gCAAgC;CACtD,MAAM,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,GAAG,gBAAgB,KAAK;CAChF,IAAI,OAAO,iBAAiB,aAAa,CAAC,OAAO,UAAU,aAAa,KAAK,gBAAgB,IAC3F,MAAM,IAAI,UAAU,2DAAyD;CAC/E,MAAM,kBAAkB,OAAO,iBAAiB,WAAW,gBAAgB,KAAK,mBAAmB,iBAAiB,KAAK,kBAAkB,KAAK,kBAAkB,GAAG,cAAc,iBAAiB,KAAK,aAAa,KAAK,aAAa,GAAG,UAAU,IAAI,QAAQ,KAAK,OAAO;CAC7Q,cAAc,CAAC,QAAQ,IAAI,YAAY,KAAK,QAAQ,IAAI,cAAc,UAAU,GAAG,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,4CAA4C;CAC9K,MAAM,YAAY,KAAK,cAAc,QAAQ,KAAK;CAClD,IAAI,eAAe,cAAc,iBAAiB,GAAG,kBAAkB,GAAG;CAC1E,IAAI,SAAS,OAAO,SAAS,UAAU;EACrC,MAAM,EAAE,KAAK,SAAS;EACtB,WAAW,KAAK,WAAW,KAAK,SAAS,IAAI,MAAM,gBAAgB,KAAK,QAAQ,kBAAkB,IAAI;CACxG;CACA,MAAM,SAAS,YAAY;EACzB,IAAI,gBAAgB,oBAAoB,MAAM,eAAe,KAAK,IAAI,CAAC,cAAc;GACnF,MAAM,WAAW,EAAE,gBAAgB,UAAU,eAAe,UAAU,MAAM,SAAS,YAAY,QAAQ,eAAe,GAAG,SAAS,CAAC,CAAC,MAAM,SAAS;IACnJ,MAAM,OAAO,kBAAkB,IAAI;IACnC,IAAI,YAAY,iBACd;IACF,QAAQ;IACR,MAAM,YAAY,KAAK,IAAI;IAC3B,UAAU,MAAM,MAAM,WAAW,MAAM,OAAO,OAAO,gBAAgB,WAAW,kBAAkB;GACpG,CAAC,CAAC,CAAC,cAAc;IACf,iBAAiB,YAAY,eAAe,KAAK;GACnD,CAAC;EACH;EACA,MAAM;CACR;CACA,OAAO,OAAO,iBAAiB,OAAO,iBAAiB,UAAU;EAC/D,CAAC,CAAC,SAAS,CAAC,WAAW,eAAe,WAAW,MAAM,MAAM,OAAO;EACpE,IAAI;GACF,OAAO,MAAM,MAAM,iBAAiB,KAAK;EAC3C,SAAS,KAAK;GACZ,IAAI,eAAe,qBAAqB,CAAC,WAAW,eAAe,gBAAgB,GACjF,OAAO,MAAM,OAAO,GAAG,MAAM,iBAAiB,KAAK;GACrD,MAAM;EACR;CACF,GAAG;EACD,aAAa;GACX,WAAW,WAAW,eAAe,gBAAgB;GACrD,YAAY,CAAC;EACf;EACA,OAAO;GACL,WAAW,WAAW,eAAe,WAAW;GAChD,YAAY,CAAC;EACf;EACA,QAAQ;GACN,OAAO;GACP,YAAY,CAAC;EACf;EACA,WAAW;GACT,WAAW,CAAC,CAAC;GACb,YAAY,CAAC;EACf;EACA,MAAM;GACJ,aAAa,OAAO,KAAK;GACzB,YAAY,CAAC;EACf;CACF,CAAC;AACH;;;ACvDA,IAAM,eAAe;AACrB,SAAS,YAAY,OAAe,SAAoC;CACtE,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,MAAM,gCAAgC;CAClD;CACA,MAAM,WAAW;EAAC;EAAa;EAAS;CAAW,CAAA,CAAE,SAAS,IAAI,QAAQ;CAC1E,IACE,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,WAAW,KAAK,KAAK,MACpB,YAAY,UACT,CAAC,YAAY,CAAC,CAAC,SAAS,QAAQ,CAAA,CAAE,SAAS,IAAI,QAAQ,IACvD,IAAI,aAAa,WAErB,MAAM,IAAI,MAAM,uDAAuD;CACzE,OAAO;AACT;AACA,SAAS,YAAY,OAAiC;CACpD,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,QAChB,MAAM,KAAK,MAAM,SACjB,CAAC,GAAG,KAAK,CAAA,CAAE,OACR,cACC,UAAU,WAAW,CAAC,IAAI,MAAM,UAAU,WAAW,CAAC,MAAM,GAChE;AAEJ;AAeO,SAAS,sBACd,SACiB;CACjB,IAAI,CAAC;EAAC;EAAS;EAAe;CAAO,CAAA,CAAE,SAAS,QAAQ,OAAO,GAC7D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,MAAM,cAAc,YAAY,QAAQ,UAAU,QAAQ,OAAO;CACjE,YAAY,QAAQ,QAAQ,QAAQ,OAAO;CAC3C,YAAY,QAAQ,SAAS,QAAQ,OAAO;CAC5C,IACE,CAAC,QAAQ,WAAW,UACpB,QAAQ,WAAW,MAAM,QAAQ,CAAC,CAAC,SAAS,OAAO,CAAA,CAAE,SAAS,GAAG,CAAC,GAElE,MAAM,IAAI,MAAM,wDAAwD;CAE1E,IAAI,QAAQ,OAAO,MAAM,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC,GAC1D,MAAM,IAAI,MAAM,0BAA0B;CAE5C,IACE,QAAQ,cAAc,KAAA,KACtB,CAAC,CAAC,UAAU,KAAK,CAAA,CAAE,SAAS,QAAQ,SAAS,GAE7C,MAAM,IAAI,MAAM,oCAAoC;CAGtD,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW,QAAQ;CACzB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,CAAC;CAC1C,MAAM,aAAa,CAAC,GAAG,QAAQ,UAAU;CACzC,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,gBAAgB,QAAQ,kBAAkB;CAChD,MAAM,mBAAmB,QAAQ;CACjC,MAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,OAAO,GAAG,EACxD,iBAAiB,IACnB,CAAC;CACD,MAAM,cAAc,GAAG,YAAY,OAAM,uCAAwC,YAAY,aAAa,MAAM,KAAK,YAAY;CACjI,SAAS,KAAK,OAGZ;EACA,MAAM,YAAY;GAChB,6BAA6B,YAAW;GACxC,GAAI,OAAO,SAAS,CAAC,UAAU,OAAO,KAAK,GAAG,EAAC,EAAG,IAAI,CAAC;GACvD,GAAI,QAAQ,CAAC,UAAU,MAAK,EAAG,IAAI,CAAC;EACtC,CAAA,CAAE,KAAK,IAAI;EACX,OAAO;GACL,IAAI;GACJ,UAAU,IAAI,SAAS,MAAM;IAC3B,QAAQ,UAAU,uBAAuB,MAAM;IAC/C,SAAS;KAAE,oBAAoB;KAAW,iBAAiB;IAAW;GACxE,CAAC;EACH;CACF;CACA,OAAO;EACL;EACA,wBACE,SAAS,KACP;GACE;GACA,uBAAuB,CAAC,MAAM;GAC9B,kBAAkB;GAClB,0BAA0B,CAAC,QAAQ;EACrC,GACA,EAAE,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAC7C;EACF,MAAM,aAAa,SAAS;GAC1B,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;GACzD,IAAI,CAAC,eAAe,OAAO,KAAK;GAChC,MAAM,QACJ,+DAA+D,KAC7D,aACF;GACF,IAAI,CAAC,OAAO,OAAO,KAAK,eAAe;GACvC,IAAI;IACF,MAAM,EAAE,YAAY,MAAM,UAAU,MAAM,IAAI,MAAM;KAClD;KACA,UAAU;KACV;KACA,KAAK;KACL,gBAAgB;MAAC;MAAO;MAAO;MAAO;KAAK;KAC3C,gBAAgB;IAClB,CAAC;IACD,IAAI,CAAC,YAAY,QAAQ,GAAG,KAAK,OAAO,QAAQ,UAAU,UACxD,OAAO,KAAK,eAAe;IAC7B,MAAM,UAAU,QAAQ,UAAU,KAAK,CAAC,IAAI,QAAQ,MAAM,MAAM,GAAG;IACnE,IAAI,QAAQ,MAAM,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC,GACnD,OAAO,KAAK,eAAe;IAC7B,IAAI,OAAO,MAAM,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC,GACjD,OAAO,KAAK,oBAAoB;IAClC,MAAM,UAAU,MAAM,iBACpB,OAAO,OAAO;KACZ;KACA,SAAS,QAAQ;KACjB,QAAQ,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC;KAClC,QAAQ,OAAO,OAAO,OAAO;IAC/B,CAAC,CACH;IACA,IACE,CAAC,WACD,CAAC,YAAY,QAAQ,EAAE,KACtB,iBAAiB,CAAC,YAAY,QAAQ,QAAQ,KAC9C,QAAQ,aAAa,KAAA,KAAa,CAAC,YAAY,QAAQ,QAAQ,KAC/D,QAAQ,SAAS,KAAA,KAAa,CAAC,YAAY,QAAQ,IAAI,KACvD,QAAQ,UAAU,KAAA,MAChB,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAC3B,CAAC,QAAQ,MAAM,MAAM,WAAW,IAEpC,OAAO,KAAK,eAAe;IAE7B,OAAO;KACL,IAAI;KACJ,WAAW;MACT,IAAI,QAAQ;MACZ,UAAU,QAAQ;MAClB,MAAM,QAAQ;MACd,OAAO,QAAQ,QAAQ,CAAC,GAAG,QAAQ,KAAK,IAAI,KAAA;MAC5C,QAAQ,CAAC,GAAG,OAAO;KACrB;IACF;GACF,QAAQ;IACN,OAAO,KAAK,eAAe;GAC7B;EACF;CACF;AACF"}
1
+ {"version":3,"file":"auth.js","names":[],"sources":["../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/local.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/remote.js","../src/own-data.ts","../src/auth.ts"],"sourcesContent":["const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder(\"utf-8\", { fatal: !0 }), MAX_INT32 = 2 ** 32;\nfunction concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers)\n buf.set(buffer, i), i += buffer.length;\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32)\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);\n}\nfunction uint64be(value) {\n const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);\n return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;\n}\nfunction uint32be(value) {\n const buf = new Uint8Array(4);\n return writeUInt32BE(buf, value), buf;\n}\nconst NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n if (typeof string == \"string\" && string.length >= 128) {\n if (NON_ASCII.test(string))\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n return encoder.encode(string);\n }\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127)\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n bytes[i] = code;\n }\n return bytes;\n}\nfunction encodeBase64(input, url = !1) {\n if (Uint8Array.prototype.toBase64)\n return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n const CHUNK_SIZE = 32768, arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE)\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n const encoded = btoa(arr.join(\"\"));\n return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = !1) {\n if (Uint8Array.fromBase64)\n return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n if (url) {\n if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n throw new TypeError(\"Invalid base64url\");\n encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n }\n const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++)\n bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\nasync function digest(algorithm, data) {\n const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\nexport {\n concat,\n decodeBase64,\n decoder,\n digest,\n encode,\n encodeBase64,\n encoder,\n strictDecoder,\n uint32be,\n uint64be\n};\n","class JOSEError extends Error {\n static code = \"ERR_JOSE_GENERIC\";\n code = \"ERR_JOSE_GENERIC\";\n constructor(message, options) {\n super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n }\n}\nclass JWTClaimValidationFailed extends JOSEError {\n static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JWTExpired extends JOSEError {\n static code = \"ERR_JWT_EXPIRED\";\n code = \"ERR_JWT_EXPIRED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JOSEAlgNotAllowed extends JOSEError {\n static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\nclass JOSENotSupported extends JOSEError {\n static code = \"ERR_JOSE_NOT_SUPPORTED\";\n code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWEDecryptionFailed extends JOSEError {\n static code = \"ERR_JWE_DECRYPTION_FAILED\";\n code = \"ERR_JWE_DECRYPTION_FAILED\";\n constructor(message = \"decryption operation failed\", options) {\n super(message, options);\n }\n}\nclass JWEInvalid extends JOSEError {\n static code = \"ERR_JWE_INVALID\";\n code = \"ERR_JWE_INVALID\";\n}\nclass JWSInvalid extends JOSEError {\n static code = \"ERR_JWS_INVALID\";\n code = \"ERR_JWS_INVALID\";\n}\nclass JWTInvalid extends JOSEError {\n static code = \"ERR_JWT_INVALID\";\n code = \"ERR_JWT_INVALID\";\n}\nclass JWKInvalid extends JOSEError {\n static code = \"ERR_JWK_INVALID\";\n code = \"ERR_JWK_INVALID\";\n}\nclass JWKSInvalid extends JOSEError {\n static code = \"ERR_JWKS_INVALID\";\n code = \"ERR_JWKS_INVALID\";\n}\nclass JWKSNoMatchingKey extends JOSEError {\n static code = \"ERR_JWKS_NO_MATCHING_KEY\";\n code = \"ERR_JWKS_NO_MATCHING_KEY\";\n constructor(message = \"no applicable key found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator] = async function* () {\n };\n static code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n constructor(message = \"multiple matching keys found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSTimeout extends JOSEError {\n static code = \"ERR_JWKS_TIMEOUT\";\n code = \"ERR_JWKS_TIMEOUT\";\n constructor(message = \"request timed out\", options) {\n super(message, options);\n }\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n constructor(message = \"signature verification failed\", options) {\n super(message, options);\n }\n}\nexport {\n JOSEAlgNotAllowed,\n JOSEError,\n JOSENotSupported,\n JWEDecryptionFailed,\n JWEInvalid,\n JWKInvalid,\n JWKSInvalid,\n JWKSMultipleMatchingKeys,\n JWKSNoMatchingKey,\n JWKSTimeout,\n JWSInvalid,\n JWSSignatureVerificationFailed,\n JWTClaimValidationFailed,\n JWTExpired,\n JWTInvalid\n};\n","import { encoder, decoder, encodeBase64, decodeBase64 } from \"../lib/buffer_utils.js\";\nconst invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n try {\n return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), !0);\n } catch (cause) {\n throw new TypeError(invalid, { cause });\n }\n}\nfunction encode(input) {\n return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, !0);\n}\nexport {\n decode,\n encode\n};\n","import { JOSENotSupported, JWSInvalid } from \"../util/errors.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { encode, strictDecoder } from \"./buffer_utils.js\";\nfunction assertUint8Array(input, label) {\n if (!(input instanceof Uint8Array))\n throw new TypeError(`${label} must be an instance of Uint8Array`);\n}\nfunction isObject(input) {\n if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n return !1;\n const prototype = Object.getPrototypeOf(input);\n return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isJwkSet(input) {\n return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);\n}\nfunction isDisjoint(...headers) {\n const parameters = /* @__PURE__ */ new Set();\n for (const header of headers)\n if (header)\n for (const parameter of Object.keys(header)) {\n if (parameters.has(parameter))\n return !1;\n parameters.add(parameter);\n }\n return !0;\n}\nfunction assertNotSet(value, name) {\n if (value !== void 0)\n throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n try {\n return decode(value);\n } catch {\n throw new ErrorClass(`Failed to base64url decode the ${label}`);\n }\n}\nfunction encodeBase64url(value, label, ErrorClass) {\n try {\n return encode(value);\n } catch {\n throw new ErrorClass(`The ${label} is not a valid base64url string`);\n }\n}\nfunction parseJoseHeader(b64, ErrorClass, message) {\n let parsed;\n try {\n parsed = JSON.parse(strictDecoder.decode(decode(b64)));\n } catch {\n throw new ErrorClass(message);\n }\n if (!isObject(parsed))\n throw new ErrorClass(message);\n return parsed;\n}\nconst JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };\nfunction validateAlgorithms(option, algorithms) {\n if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n throw new TypeError(`\"${option}\" option must be an array of strings`);\n return algorithms === void 0 ? void 0 : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n const { crit } = protectedHeader ?? {};\n if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)\n throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n if (!protectedHeader || protectedHeader.crit === void 0)\n return [];\n if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n for (const parameter of protectedHeader.crit) {\n if (!(parameter in recognized))\n throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)\n throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))\n throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n }\n return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n if (extensions.includes(\"b64\")) {\n const b64 = protectedHeader.b64;\n if (typeof b64 != \"boolean\")\n throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n return b64;\n }\n return !0;\n}\nfunction serializeJoseHeader(Err, header) {\n let serialized, parsed;\n try {\n serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n } catch (cause) {\n throw new Err(\"JOSE Header is not valid JSON\", { cause });\n }\n if (!isObject(parsed))\n throw new Err(\"JOSE Header is not a JSON object\");\n return [parsed, serialized];\n}\nexport {\n JWE_RECOGNIZED,\n JWS_RECOGNIZED,\n assertNotSet,\n assertUint8Array,\n decodeBase64url,\n encodeBase64url,\n isDisjoint,\n isJwkSet,\n isObject,\n parseJoseHeader,\n serializeJoseHeader,\n validateAlgorithms,\n validateB64,\n validateCrit,\n validateCritDuplicates\n};\n","import { isObject } from \"./validate.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nconst tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {\n const { alg } = entry;\n if (key.use !== void 0) {\n const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n if (key.use !== expected)\n throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n }\n if (key.alg !== void 0 && key.alg !== alg)\n throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n if (Array.isArray(key.key_ops)) {\n const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n }\n};\nasync function prepareKey(entry, key, usage) {\n const { alg, secret } = entry, privateKey = usage === \"decrypt\" || usage === \"sign\";\n if (secret && key instanceof Uint8Array)\n return key;\n let normalized, keyObject;\n if (isObject(key)) {\n if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n throw invalidKeyType(alg, key, secret);\n if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (privateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === void 0 && normalized.priv === void 0)))\n throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? \"private\" : \"public\"} JWK`);\n if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n return decode(normalized.k);\n if (!Object.isFrozen(key)) {\n const { key_ops } = key;\n Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n }\n } else {\n if (!isKeyLike(key))\n throw invalidKeyType(alg, key, secret);\n const expectedType = secret ? \"secret\" : privateKey ? \"private\" : \"public\";\n if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n if (isCryptoKey(key))\n return key;\n if (keyObject = key, keyObject.type === \"secret\")\n return keyObject.export();\n }\n cache ||= /* @__PURE__ */ new WeakMap();\n const cacheKey = key;\n let cached = cache.get(cacheKey);\n if (cached?.[alg])\n return cached[alg];\n if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n }\n return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nlet cache;\nconst nist = {\n __proto__: null,\n prime256v1: \"P-256\",\n secp384r1: \"P-384\",\n secp521r1: \"P-521\"\n};\nfunction assertCryptoKey(key) {\n if (!isCryptoKey(key))\n throw new Error(\"CryptoKey instance expected\");\n}\nconst isCryptoKey = (key) => {\n if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n return !0;\n try {\n return key instanceof CryptoKey;\n } catch {\n return !1;\n }\n}, isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n if (types.length > 2) {\n const last = types.pop();\n msg += `one of type ${types.join(\", \")}, or ${last}.`;\n } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nconst invalidKeyInput = (actual, ...types) => message(\"Key must be \", actual, ...types);\nfunction invalidKeyType(alg, actual, secret) {\n const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nconst unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n if (usage && !key.usages.includes(usage))\n throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n const { modulusLength } = key.algorithm;\n if (typeof modulusLength != \"number\" || modulusLength < 2048)\n throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n const algorithm = key.algorithm;\n if (algorithm.name !== expected.name)\n throw unusable(expected.name);\n if (expected.hash && algorithm.hash?.name !== expected.hash)\n throw unusable(expected.hash, \"algorithm.hash\");\n if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n if (expected.length !== void 0 && algorithm.length !== expected.length)\n throw unusable(expected.length, \"algorithm.length\");\n checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n const normalized = snapshotJwk(jwk);\n if (normalized.ext !== void 0 && typeof normalized.ext != \"boolean\")\n throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n if (normalized.key_ops !== void 0) {\n const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;\n if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n normalized.key_ops = keyOps;\n }\n return normalized;\n}\nfunction validateExtractableOption(extractable) {\n if (extractable !== void 0 && typeof extractable != \"boolean\")\n throw new TypeError('\"extractable\" option must be a boolean');\n return extractable;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n if (!entry.kty.includes(jwk.kty))\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = !1) {\n return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\nexport {\n assertCryptoKey,\n checkCryptoKey,\n checkModulusLength,\n checkUsage,\n invalidKeyInput,\n isCryptoKey,\n isKeyLike,\n isKeyObject,\n jwkToKey,\n normalizeJwk,\n prepareKey,\n rawKey,\n snapshotJwk,\n validateExtractableOption\n};\n","function table(entries) {\n const out = { __proto__: null };\n for (const alg in entries)\n out[alg] = { ...entries[alg], alg };\n return out;\n}\nexport {\n table\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n return { kty: [\"oct\"], secret: !0, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n return {\n kty: [\"RSA\"],\n subtle,\n signing: saltLength ? { ...subtle, saltLength } : subtle,\n usages: sig,\n minRsaBits: 2048\n };\n}\nfunction ecdsa(crv, bits) {\n return {\n kty: [\"EC\"],\n crv,\n subtle: { name: \"ECDSA\", namedCurve: crv },\n signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n usages: sig\n };\n}\nfunction eddsa() {\n const subtle = { name: \"Ed25519\" };\n return {\n kty: [\"OKP\"],\n crv: \"Ed25519\",\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nfunction mldsa(bits) {\n const subtle = { name: `ML-DSA-${bits}` };\n return {\n kty: [\"AKP\"],\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nconst JWS = table({\n HS256: hmac(256),\n HS384: hmac(384),\n HS512: hmac(512),\n RS256: rsa(256),\n RS384: rsa(384),\n RS512: rsa(512),\n PS256: rsa(256, 32),\n PS384: rsa(384, 48),\n PS512: rsa(512, 64),\n ES256: ecdsa(\"P-256\", 256),\n ES384: ecdsa(\"P-384\", 384),\n ES512: ecdsa(\"P-521\", 512),\n EdDSA: eddsa(),\n Ed25519: eddsa(),\n \"ML-DSA-44\": mldsa(44),\n \"ML-DSA-65\": mldsa(65),\n \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n const entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry)\n throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n return entry;\n}\nexport {\n JWS,\n jwsAlgorithm\n};\n","import { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from \"../util/errors.js\";\nimport { concat, decoder, encoder, encode } from \"./buffer_utils.js\";\nimport { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from \"./validate.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nfunction snapshotJws(jws, sharedPayload) {\n const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;\n let payload = sharedPayload ? sharedPayload[0] : jws.payload;\n !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));\n const signature = jws.signature, snapshot = { payload, signature };\n if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)\n throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n if (encodedProtected !== void 0 && typeof encodedProtected != \"string\")\n throw new JWSInvalid(\"JWS Protected Header incorrect type\");\n if (payload === void 0)\n throw new JWSInvalid(\"JWS Payload missing\");\n if (typeof signature != \"string\")\n throw new JWSInvalid(\"JWS Signature missing or incorrect type\");\n if (header !== void 0 && !isObject(header))\n throw new JWSInvalid(\"JWS Unprotected Header incorrect type\");\n return snapshot;\n}\nfunction prepareVerify(options) {\n return [options && validateAlgorithms(\"algorithms\", options.algorithms), options?.crit];\n}\nfunction parseProtectedHeader(encodedProtected) {\n return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, \"JWS Protected Header is invalid\");\n}\nfunction encodeJsonUnencodedPayload(payload) {\n const invalid = /[\\p{Cs}\\p{Cn}]/u.exec(payload)?.[0];\n if (invalid !== void 0)\n throw new JWSInvalid(/\\p{Cs}/u.test(invalid) ? \"JWS Payload must be a well-formed Unicode string\" : \"JWS Payload must not contain unassigned Unicode code points\");\n return encoder.encode(payload);\n}\nfunction encodeCompactUnencodedPayload(payload) {\n try {\n return encode(payload);\n } catch {\n throw new JWSInvalid(\"JWS Compact Serialization payload must use only ASCII characters\");\n }\n}\nasync function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {\n const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);\n if (!isDisjoint(parsedProt, header))\n throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;\n if (typeof alg != \"string\" || !alg)\n throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n if (shared[0] && !shared[0].has(alg))\n throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n if (b64) {\n if (typeof inputPayload != \"string\")\n throw new JWSInvalid(\"JWS Payload must be a string\");\n } else if (typeof inputPayload != \"string\" && !(inputPayload instanceof Uint8Array))\n throw new JWSInvalid(\"JWS Payload must be a string or an Uint8Array instance\");\n const signingPayload = b64 || typeof inputPayload != \"string\" ? inputPayload : encodeUnencodedPayload(inputPayload);\n let resolvedKey = !1;\n typeof key == \"function\" && (key = await key(parsedProt, jws), resolvedKey = !0);\n const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode(\".\"), typeof signingPayload == \"string\" ? shared[2] ??= encodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, \"signature\", JWSInvalid), k = await prepareKey(entry, key, \"verify\"), cryptoKey = await rawKey(k, entry.subtle, \"verify\");\n entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);\n let verified = !1;\n try {\n verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);\n } catch {\n }\n if (!verified)\n throw new JWSSignatureVerificationFailed();\n const result = { payload: typeof signingPayload == \"string\" ? decodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload };\n return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];\n}\nasync function verifyCompact(jws, shared, key) {\n if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != \"string\")\n throw new JWSInvalid(\"Compact JWS must be a string or Uint8Array\");\n const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(\".\");\n if (length !== 3)\n throw new JWSInvalid(\"Invalid Compact JWS\");\n return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);\n}\nexport {\n encodeJsonUnencodedPayload,\n parseProtectedHeader,\n prepareVerify,\n snapshotJws,\n verifyCompact,\n verifySignature\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from \"../util/errors.js\";\nimport { encoder, strictDecoder } from \"./buffer_utils.js\";\nimport { isObject } from \"./validate.js\";\nconst epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {\n s: 1,\n m: 60,\n h: 3600,\n d: 86400,\n w: 604800,\n y: 31557600\n}, REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = \"check_failed\";\nfunction invalidDuration() {\n throw new TypeError(\"Invalid time period format\");\n}\nfunction secs(str) {\n typeof str != \"string\" && invalidDuration();\n const matched = REGEX.exec(str);\n (!matched || matched[4] && matched[1]) && invalidDuration();\n const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);\n return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === \"-\" || matched[4] === \"ago\" ? -numericDate2 : numericDate2;\n}\nfunction validateInput(label, input) {\n if (!Number.isFinite(input))\n throw new TypeError(`Invalid ${label} input`);\n return input;\n}\nfunction validateStringClaim(claim, value) {\n if (typeof value != \"string\")\n throw new TypeError(`\"${claim}\" claim must be a string`);\n}\nfunction validateAudienceClaim(value) {\n if (typeof value != \"string\" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != \"string\")))\n throw new TypeError('\"aud\" claim must be a string or an array of strings');\n}\nfunction numericDate(value, label) {\n return typeof value == \"number\" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);\n}\nconst normalizeTyp = (value) => {\n const normalized = value.toLowerCase();\n return value.includes(\"/\") ? normalized : `application/${normalized}`;\n}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == \"string\" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;\nfunction validateNumericDate(payload, claim, required = !1) {\n const value = payload[claim];\n if (!(value === void 0 && !required)) {\n if (typeof value != \"number\")\n throw new JWTClaimValidationFailed(`\"${claim}\" claim must be a number`, payload, claim, \"invalid\");\n return value;\n }\n}\nfunction unexpectedClaim(payload, claim) {\n throw new JWTClaimValidationFailed(`unexpected \"${claim}\" claim value`, payload, claim, checkFailed);\n}\nfunction validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n let payload;\n try {\n payload = JSON.parse(strictDecoder.decode(encodedPayload));\n } catch {\n }\n if (!isObject(payload))\n throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\");\n const { typ } = options;\n if (typ !== void 0 && (typeof protectedHeader.typ != \"string\" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))\n throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, \"typ\", checkFailed);\n const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];\n maxTokenAge !== void 0 && presenceCheck.push(\"iat\"), audience !== void 0 && presenceCheck.push(\"aud\"), subject !== void 0 && presenceCheck.push(\"sub\"), issuer !== void 0 && presenceCheck.push(\"iss\");\n for (const claim of new Set(presenceCheck.reverse()))\n if (!Object.hasOwn(payload, claim))\n throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, \"missing\");\n issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, \"iss\"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, \"sub\"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == \"string\" ? [audience] : audience) && unexpectedClaim(payload, \"aud\");\n const { clockTolerance } = options;\n let tolerance = 0;\n if (typeof clockTolerance == \"string\")\n tolerance = secs(clockTolerance);\n else if (clockTolerance !== void 0) {\n if (typeof clockTolerance != \"number\")\n throw new TypeError(\"Invalid clockTolerance option type\");\n tolerance = clockTolerance;\n }\n validateInput(\"clockTolerance option\", tolerance);\n const { currentDate } = options, now = validateInput(\"currentDate option\", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, \"iat\", maxTokenAge !== void 0), nbf = validateNumericDate(payload, \"nbf\");\n if (nbf !== void 0 && nbf > now + tolerance)\n throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, \"nbf\", checkFailed);\n const exp = validateNumericDate(payload, \"exp\");\n if (exp !== void 0 && exp <= now - tolerance)\n throw new JWTExpired('\"exp\" claim timestamp check failed', payload, \"exp\", checkFailed);\n if (maxTokenAge !== void 0) {\n const age = now - iat, max = validateInput(\"maxTokenAge option\", typeof maxTokenAge == \"number\" ? maxTokenAge : secs(maxTokenAge));\n if (age - tolerance > max)\n throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, \"iat\", checkFailed);\n if (age < -tolerance)\n throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, \"iat\", checkFailed);\n }\n return payload;\n}\nlet producerPayloads;\nfunction producerPayload(producer) {\n return producerPayloads.get(producer);\n}\nfunction jwtData(producer) {\n const payload = producerPayload(producer);\n for (const claim of [\"iat\", \"nbf\", \"exp\"]) {\n const value = payload[claim];\n if (typeof value == \"number\" && !Number.isFinite(value))\n throw new TypeError(`\"${claim}\" claim must be a finite number`);\n }\n return encoder.encode(JSON.stringify(payload));\n}\nfunction jwtClaim(producer, claim) {\n return producerPayload(producer)[claim];\n}\nclass JWTClaimsBuilder {\n constructor(payload = {}) {\n if (!isObject(payload))\n throw new TypeError(\"JWT Claims Set MUST be an object\");\n (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));\n }\n setIssuer(value) {\n return validateStringClaim(\"iss\", value), producerPayload(this).iss = value, this;\n }\n setSubject(value) {\n return validateStringClaim(\"sub\", value), producerPayload(this).sub = value, this;\n }\n setAudience(value) {\n return validateAudienceClaim(value), producerPayload(this).aud = value, this;\n }\n setJti(value) {\n return validateStringClaim(\"jti\", value), producerPayload(this).jti = value, this;\n }\n setNotBefore(value) {\n return producerPayload(this).nbf = numericDate(value, \"setNotBefore\"), this;\n }\n setExpirationTime(value) {\n return producerPayload(this).exp = numericDate(value, \"setExpirationTime\"), this;\n }\n setIssuedAt(value) {\n const payload = producerPayload(this);\n return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == \"string\" ? payload.iat = validateInput(\"setIssuedAt\", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, \"setIssuedAt\"), this;\n }\n}\nexport {\n JWTClaimsBuilder,\n jwtClaim,\n jwtData,\n secs,\n validateClaimsSet\n};\n","import { prepareVerify, verifyCompact } from \"../lib/jws_verify.js\";\nimport { validateClaimsSet } from \"../lib/jwt_claims_set.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nasync function jwtVerify(jwt, key, options) {\n const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);\n if (!b64)\n throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n return { ...verified, payload };\n}\nexport {\n jwtVerify\n};\n","import { jwkToKey, snapshotJwk } from \"../lib/key.js\";\nimport { JWS } from \"../lib/jws_algorithms.js\";\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from \"../util/errors.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isUsableJWK(jwk, entry, alg, kid) {\n const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;\n return (ext === void 0 || typeof ext == \"boolean\") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == \"string\" && keyOps.indexOf(operation) === index) && keyOps.includes(\"verify\")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == \"string\" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== \"AKP\" : alg === jwkAlg) && (use === void 0 || use === \"sig\") && (!entry.crv || crv === entry.crv);\n}\nasync function importWithAlgCache(cache, jwk, entry) {\n const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;\n if (cached[alg] === void 0) {\n const pending = jwkToKey(entry, jwk, !0).then((key) => {\n if (key.type !== \"public\")\n throw new JWKSInvalid(\"JSON Web Key Set members must be public keys\");\n return cached[alg] = key, key;\n }).catch((error) => {\n throw cached[alg] === pending && delete cached[alg], error;\n });\n cached[alg] = pending;\n }\n return cached[alg];\n}\nfunction createLocalJWKSet(jwks) {\n let snapshot;\n try {\n snapshot = structuredClone(jwks);\n } catch {\n }\n if (!isJwkSet(snapshot))\n throw new JWKSInvalid(\"JSON Web Key Set malformed\");\n const metadata = snapshot.keys.map((jwk) => {\n const normalized = snapshotJwk(jwk);\n return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;\n }), cached = /* @__PURE__ */ new WeakMap();\n return Object.defineProperty(async (protectedHeader, token) => {\n const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry || entry.secret)\n throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;\n if (!length)\n throw new JWKSNoMatchingKey();\n if (length !== 1) {\n const error = new JWKSMultipleMatchingKeys();\n throw error[Symbol.asyncIterator] = async function* () {\n for (const jwk2 of candidates)\n try {\n yield await importWithAlgCache(cached, jwk2, entry);\n } catch {\n }\n }, error;\n }\n return importWithAlgCache(cached, jwk, entry);\n }, \"jwks\", {\n value: () => structuredClone(snapshot)\n });\n}\nexport {\n createLocalJWKSet\n};\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from \"../util/errors.js\";\nimport { createLocalJWKSet } from \"./local.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isCloudflareWorkers() {\n return typeof WebSocketPair < \"u\" || typeof navigator < \"u\" && navigator.userAgent === \"Cloudflare-Workers\" || typeof EdgeRuntime < \"u\" && EdgeRuntime === \"vercel\";\n}\nlet USER_AGENT;\n(typeof navigator > \"u\" || !navigator.userAgent?.startsWith?.(\"Mozilla/5.0 \")) && (USER_AGENT = \"jose/v6.2.12\");\nconst customFetch = /* @__PURE__ */ Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n const response = await fetchImpl(url, {\n method: \"GET\",\n signal,\n redirect: \"manual\",\n headers\n }).catch((err) => {\n throw err.name === \"TimeoutError\" ? new JWKSTimeout() : err;\n });\n if (response.status !== 200)\n throw new JOSEError(\"Expected 200 OK from the JSON Web Key Set HTTP response\");\n try {\n return await response.json();\n } catch {\n throw new JOSEError(\"Failed to parse the JSON Web Key Set HTTP response as JSON\");\n }\n}\nconst jwksCache = /* @__PURE__ */ Symbol();\nfunction isFreshFor(timestamp, duration) {\n return Number.isFinite(timestamp) && Date.now() < timestamp + duration;\n}\nfunction validateDuration(value, fallback, option) {\n if (Number.isNaN(value))\n throw new TypeError(`\"${option}\" option must not be NaN`);\n return typeof value == \"number\" ? value : fallback;\n}\nfunction createRemoteJWKSet(url, options) {\n if (!(url instanceof URL))\n throw new TypeError(\"url must be an instance of URL\");\n const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;\n if (typeof timeoutOption == \"number\" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))\n throw new TypeError('\"timeoutDuration\" option must be a non-negative integer');\n const timeoutDuration = typeof timeoutOption == \"number\" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, \"cooldownDuration\"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, \"cacheMaxAge\"), headers = new Headers(opts.headers);\n USER_AGENT && !headers.has(\"User-Agent\") && headers.set(\"User-Agent\", USER_AGENT), headers.has(\"accept\") || headers.set(\"accept\", \"application/json, application/jwk-set+json\");\n const fetchImpl = opts[customFetch], cache = opts[jwksCache];\n let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;\n if (cache && typeof cache == \"object\") {\n const { uat, jwks } = cache;\n isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));\n }\n const reload = async () => {\n if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {\n const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {\n const next = createLocalJWKSet(json);\n if (sequence <= appliedSequence)\n return;\n local = next;\n const updatedAt = Date.now();\n cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;\n }).finally(() => {\n pendingFetch === current && (pendingFetch = void 0);\n });\n }\n await pendingFetch;\n };\n return Object.defineProperties(async (protectedHeader, token) => {\n (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();\n try {\n return await local(protectedHeader, token);\n } catch (err) {\n if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))\n return await reload(), local(protectedHeader, token);\n throw err;\n }\n }, {\n coolingDown: {\n get: () => isFreshFor(jwksTimestamp, cooldownDuration),\n enumerable: !0\n },\n fresh: {\n get: () => isFreshFor(jwksTimestamp, cacheMaxAge),\n enumerable: !0\n },\n reload: {\n value: reload,\n enumerable: !0\n },\n reloading: {\n get: () => !!pendingFetch,\n enumerable: !0\n },\n jwks: {\n value: () => local?.jwks(),\n enumerable: !0\n }\n });\n}\nexport {\n createRemoteJWKSet,\n customFetch,\n jwksCache\n};\n","/**\n * Own-data reads of application-supplied principal mappings (#3413 review\n * N1). Inherited values, accessors and prototype-poison keys never become\n * authority.\n *\n * @internal\n */\n\nconst FORBIDDEN_KEYS: ReadonlySet<string> = new Set([\n '__proto__',\n 'constructor',\n 'prototype',\n]);\n\n/**\n * The listed own data fields of a plain object (prototype `Object.prototype`\n * or `null`) in a null-prototype record, or `null` when `value` is not a\n * plain object, has an own `__proto__`/`constructor`/`prototype` key, or any\n * listed field is an accessor. Absent fields are omitted.\n */\nexport function readOwnFields(\n value: unknown,\n keys: readonly string[],\n): Record<string, unknown> | null {\n if (!value || typeof value !== 'object' || Array.isArray(value)) return null;\n const prototype = Object.getPrototypeOf(value);\n if (prototype !== Object.prototype && prototype !== null) return null;\n for (const key of Reflect.ownKeys(value)) {\n if (typeof key === 'string' && FORBIDDEN_KEYS.has(key)) return null;\n }\n const fields = Object.create(null) as Record<string, unknown>;\n for (const key of keys) {\n const descriptor = Reflect.getOwnPropertyDescriptor(value, key);\n if (!descriptor) continue;\n if (!('value' in descriptor)) return null;\n fields[key] = descriptor.value;\n }\n return fields;\n}\n\n/**\n * A copy of a dense, plain array of strings read from own data properties,\n * or `null` for anything else (sparse, subclassed, extra keys, accessors,\n * non-strings).\n */\nexport function ownStringArray(value: unknown): string[] | null {\n if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype)\n return null;\n const length = value.length;\n for (const key of Reflect.ownKeys(value)) {\n if (key === 'length') continue;\n if (\n typeof key !== 'string' ||\n !/^(?:0|[1-9][0-9]*)$/u.test(key) ||\n Number(key) >= length\n ) {\n return null;\n }\n }\n const copy: string[] = [];\n for (let index = 0; index < length; index += 1) {\n const descriptor = Reflect.getOwnPropertyDescriptor(value, index);\n if (\n !descriptor ||\n !('value' in descriptor) ||\n typeof descriptor.value !== 'string'\n ) {\n return null;\n }\n copy.push(descriptor.value);\n }\n return copy;\n}\n","/** Server-only OAuth protected-resource boundary. This is not an issuer. */\nimport { createRemoteJWKSet, type JWTPayload, jwtVerify } from 'jose';\nimport { ownStringArray, readOwnFields } from './own-data.js';\nimport type { McpAppPrincipal, McpTenantBinding } from './server.js';\n\nexport type McpDeploymentProfile = 'local' | 'self-hosted' | 'cloud';\nexport interface McpVerifiedIdentity {\n readonly issuer: string;\n readonly subject: string;\n readonly scopes: readonly string[];\n readonly claims: Readonly<JWTPayload>;\n}\nexport interface McpPrincipalMapping {\n id: string;\n tenantId?: string;\n kind?: string;\n roles?: string[];\n /**\n * How the mapped tenant authority may be bound. Defaults to\n * `direct-or-inherited`; a mapping that selected a direct membership\n * returns `direct` so inheritance can never substitute for it.\n */\n tenantBinding?: McpTenantBinding;\n}\n\nconst TENANT_BINDINGS: readonly string[] = ['direct', 'direct-or-inherited'];\nexport interface McpResourceAuthOptions {\n profile: McpDeploymentProfile;\n /** Exact public resource identifier; also the required token audience. */\n resource: string;\n /** Exact issuer identifier, including any trailing slash. */\n issuer: string;\n /** Operator-configured signing keys. Never derived from an untrusted token. */\n jwksUri: string;\n scopes: readonly string[];\n algorithms: readonly ('RS256' | 'ES256')[];\n /** Default at+jwt. Select JWT only for a provider that uses it for access tokens. */\n tokenType?: 'at+jwt' | 'JWT';\n /** Default true. Set false only for an explicitly single-tenant application. */\n requireTenant?: boolean;\n /** Re-run for every request; return null for revoked/disabled/unmapped users.\n * Resolve active tenant/membership in trusted application state, never request\n * arguments. Provider JWT revocation is NOT detected by offline validation.\n */\n resolvePrincipal(\n identity: McpVerifiedIdentity,\n ): Promise<McpPrincipalMapping | null>;\n}\n\nconst scopePattern = /^[\\x21\\x23-\\x5b\\x5d-\\x7e]+$/u;\nfunction validateUrl(value: string, profile: McpDeploymentProfile): URL {\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n throw new Error('Invalid MCP authorization URL.');\n }\n const loopback = ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname);\n if (\n url.username ||\n url.password ||\n url.search ||\n url.hash ||\n /[\\s\"\\\\]/u.test(value) ||\n (profile === 'local'\n ? !loopback || !['http:', 'https:'].includes(url.protocol)\n : url.protocol !== 'https:')\n )\n throw new Error('Invalid MCP authorization URL for deployment profile.');\n return url;\n}\nfunction validString(value: unknown): value is string {\n return (\n typeof value === 'string' &&\n value.length > 0 &&\n value.length <= 1024 &&\n value.trim() === value &&\n [...value].every(\n (character) =>\n character.charCodeAt(0) > 31 && character.charCodeAt(0) !== 127,\n )\n );\n}\n\nexport interface McpResourceAuth {\n /**\n * Mount GET at this URL. Paths use RFC 9728's well-known path insertion.\n * Empty for a {@link McpResourceAuth.sessionFallback} adapter, which\n * advertises no OAuth metadata.\n */\n readonly metadataUrl: string;\n metadataResponse(): Response;\n /**\n * When `true`, a request that carries no `Authorization` header is not\n * challenged: the route resolves its session principal instead (today's\n * local-profile behaviour). A presented bearer must still verify; an\n * invalid one is refused and never falls back to the session. Only the\n * local owner-token adapter ({@link createLocalMcpTokenAuth}) sets it.\n */\n readonly sessionFallback?: boolean;\n /** A failure response contains no token, claims or upstream error details. */\n authenticate(\n request: Request,\n ): Promise<\n | { ok: true; principal: McpAppPrincipal & { id: string } }\n | { ok: false; response: Response }\n >;\n}\n\n/**\n * Credential bindings an application runtime can supply to\n * {@link createHostedMcpResourceAuth}, structurally satisfied by the SMRT\n * SvelteKit runtime from `@happyvertical/smrt-app-runtime/sveltekit`.\n */\n/**\n * A verified local-token principal as a runtime returns it. Its `scopes` may\n * be a frozen (readonly) array; the adapter copies it.\n */\nexport type McpLocalTokenPrincipal = Omit<McpAppPrincipal, 'scopes'> & {\n id: string;\n scopes?: readonly string[];\n};\n\nexport interface McpAuthRuntime {\n /**\n * Verify an owner-minted local MCP token (`smrt app token`). Resolve the\n * token principal (with scopes already capped to live permissions), or\n * `null` to deny. Used only in the `local` profile.\n */\n verifyLocalMcpToken?(token: string): Promise<McpLocalTokenPrincipal | null>;\n /**\n * Default hosted identity mapping, used when no explicit\n * `resolvePrincipal` is given (for example the runtime's membership-backed\n * resolver).\n */\n resolveMcpPrincipal?(\n identity: McpVerifiedIdentity,\n ): Promise<McpPrincipalMapping | null>;\n}\n\n/** Options for {@link createLocalMcpTokenAuth}. */\nexport interface LocalMcpTokenAuthOptions {\n /**\n * Resolve a presented token to its principal, or `null` to deny. A thrown\n * error is also a denial. The principal needs a non-empty `id` and\n * `tenantId` and string `scopes`; `allowCrossTenant` is never honoured.\n */\n verify(token: string): Promise<McpLocalTokenPrincipal | null>;\n}\n\nconst LOCAL_BEARER_PATTERN = /^Bearer +([A-Za-z0-9._~+/-]{16,512}=*)$/iu;\n\n/**\n * Bearer adapter for owner-minted local MCP tokens. It is a\n * {@link McpResourceAuth.sessionFallback} adapter: without an `Authorization`\n * header the route keeps its session principal; with one, the token must\n * verify, otherwise the response is `401` with\n * `WWW-Authenticate: Bearer error=\"invalid_token\"` and no token, claim or\n * upstream detail. It advertises no OAuth metadata (the metadata route 404s).\n */\nexport function createLocalMcpTokenAuth(\n options: LocalMcpTokenAuthOptions,\n): McpResourceAuth {\n const verify = options?.verify;\n if (typeof verify !== 'function') {\n throw new TypeError('Local MCP token auth requires a verify function.');\n }\n const deny = (): { ok: false; response: Response } => ({\n ok: false,\n response: new Response(null, {\n status: 401,\n headers: {\n 'WWW-Authenticate': 'Bearer error=\"invalid_token\"',\n 'Cache-Control': 'no-store',\n },\n }),\n });\n return Object.freeze({\n metadataUrl: '',\n sessionFallback: true,\n metadataResponse: () =>\n new Response(null, {\n status: 404,\n headers: { 'Cache-Control': 'no-store' },\n }),\n async authenticate(request: Request) {\n const match = LOCAL_BEARER_PATTERN.exec(\n request.headers.get('authorization') ?? '',\n );\n if (!match) return deny();\n let principal: McpLocalTokenPrincipal | null;\n try {\n principal = await verify(match[1]);\n } catch {\n return deny();\n }\n // Own plain data only: inherited values, accessors and poison keys\n // never become the bound identity.\n const fields = readOwnFields(principal, [\n 'id',\n 'tenantId',\n 'kind',\n 'scopes',\n ]);\n const scopes = fields ? ownStringArray(fields.scopes) : null;\n if (\n !fields ||\n !scopes ||\n !validString(fields.id) ||\n !validString(fields.tenantId) ||\n (fields.kind !== undefined && !validString(fields.kind)) ||\n !scopes.every((scope) => scopePattern.test(scope))\n ) {\n return deny();\n }\n return {\n ok: true as const,\n principal: {\n id: fields.id,\n tenantId: fields.tenantId,\n kind: fields.kind as string | undefined,\n scopes,\n // Owner tokens bind only through the direct membership.\n tenantBinding: 'direct' as const,\n },\n };\n },\n });\n}\n\n/** Options for {@link createHostedMcpResourceAuth}. */\nexport interface HostedMcpResourceAuthOptions {\n /**\n * Deployment profile, or a thunk read on every call. `local` disables bearer\n * authentication; the route then uses its session principal.\n */\n profile: McpDeploymentProfile | (() => McpDeploymentProfile);\n /**\n * Application-owned mapping from a verified identity to a current account\n * and active membership; token claims never select a tenant. Overrides\n * `runtime.resolveMcpPrincipal`. A hosted profile with neither throws on\n * first use.\n */\n resolvePrincipal?: McpResourceAuthOptions['resolvePrincipal'];\n /**\n * The application runtime (for example the SMRT SvelteKit runtime). In the\n * `local` profile its `verifyLocalMcpToken` turns on owner-minted bearer\n * tokens through {@link createLocalMcpTokenAuth} (requests without a\n * bearer keep the session principal); without it the thunk yields `null`\n * as before. In hosted profiles its membership-backed\n * `resolveMcpPrincipal` is the default identity mapping.\n */\n runtime?: McpAuthRuntime;\n /** Environment source. Defaults to `process.env`, read lazily. */\n env?: Readonly<Record<string, string | undefined>>;\n /** Default `['RS256']`. */\n algorithms?: McpResourceAuthOptions['algorithms'];\n tokenType?: McpResourceAuthOptions['tokenType'];\n requireTenant?: McpResourceAuthOptions['requireTenant'];\n}\n\n/** Environment variables read by {@link createHostedMcpResourceAuth}. */\nexport const HOSTED_MCP_AUTH_ENV = Object.freeze({\n resource: 'SMRT_MCP_RESOURCE',\n issuer: 'SMRT_MCP_ISSUER',\n jwksUri: 'SMRT_MCP_JWKS_URI',\n scopes: 'SMRT_MCP_SCOPES',\n});\n\n/**\n * Lazily build the hosted protected-resource adapter from operator\n * environment. The returned thunk yields `null` for the `local` profile,\n * otherwise one cached `createMcpResourceAuth` instance configured from\n * `SMRT_MCP_RESOURCE`, `SMRT_MCP_ISSUER`, `SMRT_MCP_JWKS_URI` and the\n * whitespace-separated `SMRT_MCP_SCOPES`. Missing configuration throws (fail\n * closed); a failed construction is not cached, so a corrected environment\n * is picked up on the next request. Pass the thunk as the `auth` option of\n * `mountMcpRoute`/`mountMcpAppRoute` and to\n * `mountMcpProtectedResourceMetadataRoute`.\n */\nexport function createHostedMcpResourceAuth(\n options: HostedMcpResourceAuthOptions,\n): () => McpResourceAuth | null {\n let cached: McpResourceAuth | undefined;\n let local: McpResourceAuth | undefined;\n const runtime = options.runtime;\n return () => {\n const profile =\n typeof options.profile === 'function'\n ? options.profile()\n : options.profile;\n if (profile === 'local') {\n const verify = runtime?.verifyLocalMcpToken;\n if (typeof verify !== 'function') return null;\n local ??= createLocalMcpTokenAuth({\n verify: (token) => verify.call(runtime, token),\n });\n return local;\n }\n if (cached) return cached;\n const env =\n options.env ??\n (globalThis as { process?: { env?: Record<string, string | undefined> } })\n .process?.env ??\n {};\n const required = (name: string): string => {\n const value = env[name]?.trim();\n if (!value) throw new Error(`Hosted MCP requires ${name}.`);\n return value;\n };\n const runtimeResolver = runtime?.resolveMcpPrincipal;\n const resolvePrincipal =\n options.resolvePrincipal ??\n (typeof runtimeResolver === 'function'\n ? (identity: McpVerifiedIdentity) =>\n runtimeResolver.call(runtime, identity)\n : undefined);\n if (!resolvePrincipal) {\n throw new Error(\n 'Hosted MCP requires an application-owned resolvePrincipal binding or a runtime with resolveMcpPrincipal.',\n );\n }\n cached = createMcpResourceAuth({\n profile,\n resource: required(HOSTED_MCP_AUTH_ENV.resource),\n issuer: required(HOSTED_MCP_AUTH_ENV.issuer),\n jwksUri: required(HOSTED_MCP_AUTH_ENV.jwksUri),\n scopes: required(HOSTED_MCP_AUTH_ENV.scopes).split(/\\s+/u),\n algorithms: options.algorithms ?? ['RS256'],\n tokenType: options.tokenType,\n requireTenant: options.requireTenant,\n resolvePrincipal,\n });\n return cached;\n };\n}\n\nexport function createMcpResourceAuth(\n options: McpResourceAuthOptions,\n): McpResourceAuth {\n if (!['local', 'self-hosted', 'cloud'].includes(options.profile)) {\n throw new Error('Unknown MCP deployment profile.');\n }\n const resourceUrl = validateUrl(options.resource, options.profile);\n validateUrl(options.issuer, options.profile);\n validateUrl(options.jwksUri, options.profile);\n if (\n !options.algorithms.length ||\n options.algorithms.some((alg) => !['RS256', 'ES256'].includes(alg))\n ) {\n throw new Error('Explicit asymmetric MCP token algorithms are required.');\n }\n if (options.scopes.some((scope) => !scopePattern.test(scope))) {\n throw new Error('Invalid MCP OAuth scope.');\n }\n if (\n options.tokenType !== undefined &&\n !['at+jwt', 'JWT'].includes(options.tokenType)\n ) {\n throw new Error('Unsupported MCP access-token type.');\n }\n // Snapshot configuration so later caller mutation cannot broaden authority.\n const issuer = options.issuer;\n const resource = options.resource;\n const scopes = [...new Set(options.scopes)];\n const algorithms = [...options.algorithms];\n const tokenType = options.tokenType ?? 'at+jwt';\n const requireTenant = options.requireTenant !== false;\n const resolvePrincipal = options.resolvePrincipal;\n const keys = createRemoteJWKSet(new URL(options.jwksUri), {\n timeoutDuration: 5000,\n });\n const metadataUrl = `${resourceUrl.origin}/.well-known/oauth-protected-resource${resourceUrl.pathname === '/' ? '' : resourceUrl.pathname}`;\n function deny(error?: 'invalid_token' | 'insufficient_scope'): {\n ok: false;\n response: Response;\n } {\n const challenge = [\n `Bearer resource_metadata=\"${metadataUrl}\"`,\n ...(scopes.length ? [`scope=\"${scopes.join(' ')}\"`] : []),\n ...(error ? [`error=\"${error}\"`] : []),\n ].join(', ');\n return {\n ok: false,\n response: new Response(null, {\n status: error === 'insufficient_scope' ? 403 : 401,\n headers: { 'WWW-Authenticate': challenge, 'Cache-Control': 'no-store' },\n }),\n };\n }\n return {\n metadataUrl,\n metadataResponse: () =>\n Response.json(\n {\n resource,\n authorization_servers: [issuer],\n scopes_supported: scopes,\n bearer_methods_supported: ['header'],\n },\n { headers: { 'Cache-Control': 'no-store' } },\n ),\n async authenticate(request) {\n const authorization = request.headers.get('authorization');\n if (!authorization) return deny();\n const match =\n /^Bearer +([A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)$/iu.exec(\n authorization,\n );\n if (!match) return deny('invalid_token');\n try {\n const { payload } = await jwtVerify(match[1], keys, {\n issuer,\n audience: resource,\n algorithms,\n typ: tokenType,\n requiredClaims: ['iss', 'aud', 'sub', 'exp'],\n clockTolerance: 0,\n });\n if (!validString(payload.sub) || typeof payload.scope !== 'string')\n return deny('invalid_token');\n const granted = payload.scope === '' ? [] : payload.scope.split(' ');\n if (granted.some((scope) => !scopePattern.test(scope)))\n return deny('invalid_token');\n if (scopes.some((scope) => !granted.includes(scope)))\n return deny('insufficient_scope');\n const mapping = await resolvePrincipal(\n Object.freeze({\n issuer,\n subject: payload.sub,\n scopes: Object.freeze([...granted]),\n claims: Object.freeze(payload),\n }),\n );\n // Own plain data only: inherited values, accessors and poison keys\n // never become the bound identity or tenant.\n const fields = readOwnFields(mapping, [\n 'id',\n 'tenantId',\n 'kind',\n 'roles',\n 'tenantBinding',\n ]);\n const roles =\n fields?.roles === undefined\n ? undefined\n : ownStringArray(fields.roles);\n if (\n !fields ||\n roles === null ||\n !validString(fields.id) ||\n (requireTenant && !validString(fields.tenantId)) ||\n (fields.tenantId !== undefined && !validString(fields.tenantId)) ||\n (fields.kind !== undefined && !validString(fields.kind)) ||\n (roles !== undefined && !roles.every(validString)) ||\n (fields.tenantBinding !== undefined &&\n (typeof fields.tenantBinding !== 'string' ||\n !TENANT_BINDINGS.includes(fields.tenantBinding)))\n ) {\n return deny('invalid_token');\n }\n return {\n ok: true,\n principal: {\n id: fields.id,\n tenantId: fields.tenantId as string | undefined,\n kind: fields.kind as string | undefined,\n roles,\n scopes: [...granted],\n tenantBinding:\n (fields.tenantBinding as McpTenantBinding | undefined) ??\n 'direct-or-inherited',\n },\n };\n } catch {\n return deny('invalid_token');\n }\n },\n };\n}\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11],"mappings":";AAAA,IAAM,UAAU,IAAI,YAAY,GAAG,UAAU,IAAI,YAAY,GAAG,gBAAgB,IAAI,YAAY,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;AACtH,SAAS,OAAO,GAAG,SAAS;CAC1B,MAAM,OAAO,QAAQ,QAAQ,KAAK,EAAE,aAAa,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI,WAAW,IAAI;CAC5F,IAAI,IAAI;CACR,KAAK,MAAM,UAAU,SACnB,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO;CAClC,OAAO;AACT;AAcA,IAAM,YAAY;AAClB,SAAS,OAAO,QAAQ;CACtB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK;EACrD,IAAI,UAAU,KAAK,MAAM,GACvB,MAAM,IAAI,UAAU,0CAA0C;EAChE,OAAO,QAAQ,OAAO,MAAM;CAC9B;CACA,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACtC,MAAM,OAAO,OAAO,WAAW,CAAC;EAChC,IAAI,OAAO,KACT,MAAM,IAAI,UAAU,0CAA0C;EAChE,MAAM,KAAK;CACb;CACA,OAAO;AACT;AAUA,SAAS,aAAa,SAAS,MAAM,CAAC,GAAG;CACvC,IAAI,WAAW,YACb,OAAO,WAAW,WAAW,SAAS,EAAE,UAAU,MAAM,cAAc,SAAS,CAAC;CAClF,IAAI,KAAK;EACP,IAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAC/C,MAAM,IAAI,UAAU,mBAAmB;EACzC,UAAU,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACxD;CACA,MAAM,SAAS,KAAK,OAAO,GAAG,QAAQ,IAAI,WAAW,OAAO,MAAM;CAClE,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KACjC,MAAM,KAAK,OAAO,WAAW,CAAC;CAChC,OAAO;AACT;;;AC1DA,IAAM,YAAN,cAAwB,MAAM;CAC5B,OAAO,OAAO;CACd,OAAO;CACP,YAAY,SAAS,SAAS;EAC5B,MAAM,SAAS,OAAO,GAAG,KAAK,OAAO,KAAK,YAAY,MAAM,MAAM,oBAAoB,MAAM,KAAK,WAAW;CAC9G;AACF;AACA,IAAM,2BAAN,cAAuC,UAAU;CAC/C,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EAC3E,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC,GAAG,KAAK,QAAQ,OAAO,KAAK,SAAS,QAAQ,KAAK,UAAU;CAClH;AACF;AACA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EAC3E,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC,GAAG,KAAK,QAAQ,OAAO,KAAK,SAAS,QAAQ,KAAK,UAAU;CAClH;AACF;AACA,IAAM,oBAAN,cAAgC,UAAU;CACxC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,mBAAN,cAA+B,UAAU;CACvC,OAAO,OAAO;CACd,OAAO;AACT;AAYA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;AACT;AAKA,IAAM,cAAN,cAA0B,UAAU;CAClC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,oBAAN,cAAgC,UAAU;CACxC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,mDAAmD,SAAS;EAChF,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,2BAAN,cAAuC,UAAU;CAC/C,CAAC,OAAO,iBAAiB,mBAAmB,CAC5C;CACA,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,wDAAwD,SAAS;EACrF,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,cAAN,cAA0B,UAAU;CAClC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,qBAAqB,SAAS;EAClD,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,iCAAN,cAA6C,UAAU;CACrD,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,iCAAiC,SAAS;EAC9D,MAAM,SAAS,OAAO;CACxB;AACF;;;AC1FA,IAAM,UAAU;AAChB,SAAS,OAAO,OAAO;CACrB,IAAI;EACF,OAAO,aAAa,OAAO,SAAS,WAAW,QAAQ,QAAQ,OAAO,KAAK,GAAG,CAAC,CAAC;CAClF,SAAS,OAAO;EACd,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,CAAC;CACxC;AACF;;;ACDA,SAAS,SAAS,OAAO;CACvB,IAAI,OAAO,SAAS,YAAY,UAAU,QAAQ,OAAO,UAAU,SAAS,KAAK,KAAK,MAAM,mBAC1F,OAAO,CAAC;CACV,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,OAAO,cAAc,QAAQ,OAAO,eAAe,SAAS,MAAM;AACpE;AACA,SAAS,SAAS,OAAO;CACvB,OAAO,SAAS,KAAK,KAAK,MAAM,QAAQ,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,QAAQ;AAC9F;AACA,SAAS,WAAW,GAAG,SAAS;CAC9B,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,UAAU,SACnB,IAAI,QACF,KAAK,MAAM,aAAa,OAAO,KAAK,MAAM,GAAG;EAC3C,IAAI,WAAW,IAAI,SAAS,GAC1B,OAAO,CAAC;EACV,WAAW,IAAI,SAAS;CAC1B;CACJ,OAAO,CAAC;AACV;AAKA,SAAS,gBAAgB,OAAO,OAAO,YAAY;CACjD,IAAI;EACF,OAAO,OAAO,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,WAAW,kCAAkC,OAAO;CAChE;AACF;AACA,SAAS,gBAAgB,OAAO,OAAO,YAAY;CACjD,IAAI;EACF,OAAO,OAAO,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,WAAW,OAAO,MAAM,iCAAiC;CACrE;AACF;AACA,SAAS,gBAAgB,KAAK,YAAY,SAAS;CACjD,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,cAAc,OAAO,OAAO,GAAG,CAAC,CAAC;CACvD,QAAQ;EACN,MAAM,IAAI,WAAW,OAAO;CAC9B;CACA,IAAI,CAAC,SAAS,MAAM,GAClB,MAAM,IAAI,WAAW,OAAO;CAC9B,OAAO;AACT;AACA,IAAM,iBAAiB;CAAE,WAAW;CAAM,KAAK,CAAC;AAAE;AAClD,SAAS,mBAAmB,QAAQ,YAAY;CAC9C,IAAI,eAAe,KAAK,MAAM,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,MAAM,MAAM,OAAO,KAAK,QAAQ,IACrG,MAAM,IAAI,UAAU,IAAI,OAAO,qCAAqC;CACtE,OAAO,eAAe,KAAK,IAAI,KAAK,IAAI,IAAI,IAAI,UAAU;AAC5D;AAMA,SAAS,aAAa,KAAK,mBAAmB,kBAAkB,iBAAiB,YAAY;CAC3F,IAAI,WAAW,SAAS,KAAK,KAAK,iBAAiB,SAAS,KAAK,GAC/D,MAAM,IAAI,IAAI,kEAAgE;CAChF,IAAI,CAAC,mBAAmB,gBAAgB,SAAS,KAAK,GACpD,OAAO,CAAC;CACV,IAAI,CAAC,MAAM,QAAQ,gBAAgB,IAAI,KAAK,gBAAgB,KAAK,WAAW,KAAK,gBAAgB,KAAK,MAAM,UAAU,OAAO,SAAS,YAAY,MAAM,WAAW,CAAC,GAClK,MAAM,IAAI,IAAI,yFAAuF;CACvG,MAAM,aAAa,qBAAqB,KAAK,IAAI,oBAAoB;EAAE,WAAW;EAAM,GAAG;EAAkB,GAAG;CAAkB;CAClI,KAAK,MAAM,aAAa,gBAAgB,MAAM;EAC5C,IAAI,EAAE,aAAa,aACjB,MAAM,IAAI,iBAAiB,+BAA+B,UAAU,oBAAoB;EAC1F,IAAI,CAAC,OAAO,OAAO,YAAY,SAAS,KAAK,WAAW,eAAe,KAAK,GAC1E,MAAM,IAAI,IAAI,+BAA+B,UAAU,aAAa;EACtE,IAAI,WAAW,eAAe,CAAC,OAAO,OAAO,iBAAiB,SAAS,KAAK,gBAAgB,eAAe,KAAK,IAC9G,MAAM,IAAI,IAAI,+BAA+B,UAAU,8BAA8B;CACzF;CACA,OAAO,gBAAgB;AACzB;AACA,SAAS,YAAY,iBAAiB,YAAY;CAChD,IAAI,WAAW,SAAS,KAAK,GAAG;EAC9B,MAAM,MAAM,gBAAgB;EAC5B,IAAI,OAAO,OAAO,WAChB,MAAM,IAAI,WAAW,2EAAyE;EAChG,OAAO;CACT;CACA,OAAO,CAAC;AACV;;;AC1FA,IAAM,OAAO,QAAQ,IAAI,OAAO,cAAc,gBAAgB,OAAO,KAAK,UAAU;CAClF,MAAM,EAAE,QAAQ;CAChB,IAAI,IAAI,QAAQ,KAAK,GAAG;EACtB,MAAM,WAAW,UAAU,UAAU,UAAU,WAAW,QAAQ;EAClE,IAAI,IAAI,QAAQ,UACd,MAAM,IAAI,UAAU,sDAAsD,SAAS,eAAe;CACtG;CACA,IAAI,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KACpC,MAAM,IAAI,UAAU,sDAAsD,IAAI,eAAe;CAC/F,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG;EAC9B,MAAM,gBAAgB,UAAU,aAAa,UAAU,YAAY,MAAM,MAAM,UAAU,YAAY,IAAI,KAAK;EAC9G,IAAI,iBAAiB,CAAC,IAAI,QAAQ,SAAS,aAAa,GACtD,MAAM,IAAI,UAAU,+DAA+D,cAAc,eAAe;CACpH;AACF;AACA,eAAe,WAAW,OAAO,KAAK,OAAO;CAC3C,MAAM,EAAE,KAAK,WAAW,OAAO,aAAa,UAAU,aAAa,UAAU;CAC7E,IAAI,UAAU,eAAe,YAC3B,OAAO;CACT,IAAI,YAAY;CAChB,IAAI,SAAS,GAAG,GAAG;EACjB,IAAI,aAAa,aAAa,GAAG,GAAG,OAAO,WAAW,OAAO,UAC3D,MAAM,eAAe,KAAK,KAAK,MAAM;EACvC,IAAI,EAAE,SAAS,WAAW,QAAQ,SAAS,OAAO,WAAW,KAAK,WAAW,WAAW,QAAQ,UAAU,aAAa,WAAW,QAAQ,SAAS,OAAO,WAAW,QAAQ,YAAY,OAAO,WAAW,KAAK,WAAW,WAAW,MAAM,KAAK,KAAK,WAAW,SAAS,KAAK,KAC7Q,MAAM,IAAI,UAAU,SAAS,kIAA4H,6CAA6C,aAAa,YAAY,SAAS,KAAK;EAC/O,IAAI,aAAa,OAAO,YAAY,KAAK,GAAG,WAAW,QAAQ,OAC7D,OAAO,OAAO,WAAW,CAAC;EAC5B,IAAI,CAAC,OAAO,SAAS,GAAG,GAAG;GACzB,MAAM,EAAE,YAAY;GACpB,MAAM,QAAQ,OAAO,KAAK,OAAO,OAAO,OAAO,GAAG,OAAO,OAAO,GAAG;EACrE;CACF,OAAO;EACL,IAAI,CAAC,UAAU,GAAG,GAChB,MAAM,eAAe,KAAK,KAAK,MAAM;EACvC,MAAM,eAAe,SAAS,WAAW,aAAa,YAAY;EAClE,IAAI,IAAI,SAAS,iBAAiB,UAAU;GAAC;GAAU;GAAU;EAAS,CAAC,CAAC,SAAS,IAAI,IAAI,IAC3F,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,8BAA8B,aAAa,YAAY,IAAI,WAAW;EACxG,IAAI,YAAY,GAAG,GACjB,OAAO;EACT,IAAI,YAAY,KAAK,UAAU,SAAS,UACtC,OAAO,UAAU,OAAO;CAC5B;CACA,0BAA0B,IAAI,QAAQ;CACtC,MAAM,WAAW;CACjB,IAAI,SAAS,MAAM,IAAI,QAAQ;CAC/B,IAAI,SAAS,MACX,OAAO,OAAO;CAChB,IAAI,UAAU,MAAM,IAAI,UAAU,SAAS,CAAC,CAAC,GAAG,aAAa,OAAO,UAAU,eAAe,YAAY;EACvG,MAAM,WAAW,UAAU,SAAS,UAAU,MAAM,KAAK,UAAU,sBAAsB,aAAa,SAAS,MAAM,UAAU;GAAE;GAAK,mBAAmB,UAAU;EAAkB,CAAC,KAAK,MAAM;EACjM,OAAO,OAAO,OAAO,UAAU,YAAY,QAAQ,UAAU,MAAM,OAAO,WAAW,IAAI,EAAE;CAC7F;CACA,OAAO,eAAe,UAAU,OAAO,EAAE,QAAQ,MAAM,CAAC,GAAG,WAAW,MAAM,KAAK,OAAO,OAAO,MAAM,SAAS,OAAO,UAAU;AACjI;AACA,IAAI;AACJ,IAAM,OAAO;CACX,WAAW;CACX,YAAY;CACZ,WAAW;CACX,WAAW;AACb;AAKA,IAAM,eAAe,QAAQ;CAC3B,IAAI,MAAM,OAAO,iBAAiB,aAChC,OAAO,CAAC;CACV,IAAI;EACF,OAAO,eAAe;CACxB,QAAQ;EACN,OAAO,CAAC;CACV;AACF,GAAG,eAAe,QAAQ,MAAM,OAAO,iBAAiB,aAAa,aAAa,QAAQ,YAAY,GAAG,KAAK,YAAY,GAAG;AAC7H,SAAS,QAAQ,KAAK,QAAQ,GAAG,OAAO;CACtC,IAAI,MAAM,SAAS,GAAG;EACpB,MAAM,OAAO,MAAM,IAAI;EACvB,OAAO,eAAe,MAAM,KAAK,IAAI,EAAE,OAAO,KAAK;CACrD,OAAO,MAAM,WAAW,IAAI,OAAO,eAAe,MAAM,GAAG,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,MAAM,GAAG;CAC1G,OAAO,UAAU,OAAO,OAAO,aAAa,WAAW,OAAO,UAAU,cAAc,OAAO,OAAO,OAAO,sBAAsB,OAAO,SAAS,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAO,aAAa,SAAS,OAAO,4BAA4B,OAAO,YAAY,SAAS;AAC9R;AAEA,SAAS,eAAe,KAAK,QAAQ,QAAQ;CAC3C,MAAM,QAAQ;EAAC;EAAa;EAAa;CAAc;CACvD,OAAO,UAAU,MAAM,KAAK,YAAY,GAAG,IAAI,UAAU,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,GAAG,KAAK,CAAC;AAC7H;AACA,IAAM,YAAY,MAAM,OAAO,qCAAqB,IAAI,UAAU,kDAAkD,KAAK,WAAW,MAAM;AAC1I,SAAS,WAAW,KAAK,OAAO;CAC9B,IAAI,SAAS,CAAC,IAAI,OAAO,SAAS,KAAK,GACrC,MAAM,IAAI,UAAU,sEAAsE,MAAM,EAAE;AACtG;AACA,SAAS,mBAAmB,KAAK,KAAK;CACpC,MAAM,EAAE,kBAAkB,IAAI;CAC9B,IAAI,OAAO,iBAAiB,YAAY,gBAAgB,MACtD,MAAM,IAAI,UAAU,GAAG,IAAI,sDAAsD;AACrF;AACA,SAAS,eAAe,KAAK,UAAU,OAAO;CAC5C,MAAM,YAAY,IAAI;CACtB,IAAI,UAAU,SAAS,SAAS,MAC9B,MAAM,SAAS,SAAS,IAAI;CAC9B,IAAI,SAAS,QAAQ,UAAU,MAAM,SAAS,SAAS,MACrD,MAAM,SAAS,SAAS,MAAM,gBAAgB;CAChD,IAAI,SAAS,cAAc,UAAU,eAAe,SAAS,YAC3D,MAAM,SAAS,SAAS,YAAY,sBAAsB;CAC5D,IAAI,SAAS,WAAW,KAAK,KAAK,UAAU,WAAW,SAAS,QAC9D,MAAM,SAAS,SAAS,QAAQ,kBAAkB;CACpD,WAAW,KAAK,KAAK;AACvB;AACA,SAAS,YAAY,KAAK;CACxB,OAAO;EAAE,WAAW;EAAM,GAAG;CAAI;AACnC;AACA,SAAS,aAAa,KAAK;CACzB,MAAM,aAAa,YAAY,GAAG;CAClC,IAAI,WAAW,QAAQ,KAAK,KAAK,OAAO,WAAW,OAAO,WACxD,MAAM,IAAI,UAAU,mDAAiD;CACvE,IAAI,WAAW,YAAY,KAAK,GAAG;EACjC,MAAM,QAAQ,WAAW,SAAS,SAAS,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK;EACpF,IAAI,CAAC,UAAU,OAAO,MAAM,cAAc,OAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,QACzG,MAAM,IAAI,UAAU,2EAAyE;EAC/F,WAAW,UAAU;CACvB;CACA,OAAO;AACT;AAMA,eAAe,SAAS,OAAO,KAAK,aAAa;CAC/C,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,GAAG,GAC7B,MAAM,IAAI,iBAAiB,gEAA8D;CAC3F,MAAM,YAAY,MAAM,UAAU;EAAE,KAAK,IAAI;EAAK,KAAK,IAAI;CAAI,CAAC,KAAK,MAAM,QAAQ,YAAY,CAAC,EAAE,IAAI,KAAK,IAAI,OAAO,UAAU;EAAE,GAAG;EAAK,KAAK,eAAe,IAAI;CAAI;CACtK,OAAO,QAAQ,QAAQ,SAAS,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,OAAO,OAAO,UAAU,OAAO,SAAS,WAAW,QAAQ,OAAO,CAAC,WAAW,IAAI,WAAW,MAAM,OAAO,YAAY,IAAI,EAAE;AACtM;AACA,eAAe,OAAO,KAAK,UAAU,OAAO,cAAc,CAAC,GAAG;CAC5D,OAAO,eAAe,eAAe,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,KAAK,UAAU,aAAa,CAAC,KAAK,CAAC,IAAI,eAAe,KAAK,UAAU,KAAK,GAAG;AAC/J;;;AC1IA,SAAS,MAAM,SAAS;CACtB,MAAM,MAAM,EAAE,WAAW,KAAK;CAC9B,KAAK,MAAM,OAAO,SAChB,IAAI,OAAO;EAAE,GAAG,QAAQ;EAAM;CAAI;CACpC,OAAO;AACT;;;ACHA,IAAM,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC;AACjC,SAAS,KAAK,MAAM;CAClB,MAAM,SAAS;EAAE,MAAM;EAAQ,MAAM,OAAO;CAAO;CACnD,OAAO;EAAE,KAAK,CAAC,KAAK;EAAG,QAAQ,CAAC;EAAG;EAAQ,SAAS;EAAQ,QAAQ;CAAI;AAC1E;AACA,SAAS,IAAI,MAAM,YAAY;CAC7B,MAAM,SAAS;EAAE,MAAM,aAAa,YAAY;EAAqB,MAAM,OAAO;CAAO;CACzF,OAAO;EACL,KAAK,CAAC,KAAK;EACX;EACA,SAAS,aAAa;GAAE,GAAG;GAAQ;EAAW,IAAI;EAClD,QAAQ;EACR,YAAY;CACd;AACF;AACA,SAAS,MAAM,KAAK,MAAM;CACxB,OAAO;EACL,KAAK,CAAC,IAAI;EACV;EACA,QAAQ;GAAE,MAAM;GAAS,YAAY;EAAI;EACzC,SAAS;GAAE,MAAM;GAAS,MAAM,OAAO;EAAO;EAC9C,QAAQ;CACV;AACF;AACA,SAAS,QAAQ;CACf,MAAM,SAAS,EAAE,MAAM,UAAU;CACjC,OAAO;EACL,KAAK,CAAC,KAAK;EACX,KAAK;EACL;EACA,SAAS;EACT,QAAQ;CACV;AACF;AACA,SAAS,MAAM,MAAM;CACnB,MAAM,SAAS,EAAE,MAAM,UAAU,OAAO;CACxC,OAAO;EACL,KAAK,CAAC,KAAK;EACX;EACA,SAAS;EACT,QAAQ;CACV;AACF;AACA,IAAM,MAAM,MAAM;CAChB,OAAO,KAAK,GAAG;CACf,OAAO,KAAK,GAAG;CACf,OAAO,KAAK,GAAG;CACf,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM;CACb,SAAS,MAAM;CACf,aAAa,MAAM,EAAE;CACrB,aAAa,MAAM,EAAE;CACrB,aAAa,MAAM,EAAE;AACvB,CAAC;AACD,SAAS,aAAa,KAAK;CACzB,MAAM,QAAQ,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;CACvD,IAAI,CAAC,OACH,MAAM,IAAI,iBAAiB,OAAO,IAAI,4DAA4D;CACpG,OAAO;AACT;;;AC/CA,SAAS,cAAc,SAAS;CAC9B,OAAO,CAAC,WAAW,mBAAmB,cAAc,QAAQ,UAAU,GAAG,SAAS,IAAI;AACxF;AACA,SAAS,qBAAqB,kBAAkB;CAC9C,OAAO,qBAAqB,KAAK,IAAI,CAAC,IAAI,gBAAgB,kBAAkB,YAAY,iCAAiC;AAC3H;AAOA,SAAS,8BAA8B,SAAS;CAC9C,IAAI;EACF,OAAO,OAAO,OAAO;CACvB,QAAQ;EACN,MAAM,IAAI,WAAW,kEAAkE;CACzF;AACF;AACA,eAAe,gBAAgB,KAAK,QAAQ,KAAK,wBAAwB,iBAAiB;CACxF,MAAM,EAAE,WAAW,kBAAkB,QAAQ,SAAS,iBAAiB,KAAK,aAAa,mBAAmB,qBAAqB,gBAAgB;CACjJ,IAAI,CAAC,WAAW,YAAY,MAAM,GAChC,MAAM,IAAI,WAAW,2EAA2E;CAClG,MAAM,aAAa;EAAE,GAAG;EAAY,GAAG;CAAO,GAAG,MAAM,YAAY,YAAY,aAAa,YAAY,gBAAgB,OAAO,IAAI,YAAY,UAAU,CAAC,GAAG,EAAE,QAAQ;CACvK,IAAI,OAAO,OAAO,YAAY,CAAC,KAC7B,MAAM,IAAI,WAAW,6DAA2D;CAClF,IAAI,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,GACjC,MAAM,IAAI,kBAAkB,wDAAsD;CACpF,IAAI;MACE,OAAO,gBAAgB,UACzB,MAAM,IAAI,WAAW,8BAA8B;CAAA,OAChD,IAAI,OAAO,gBAAgB,YAAY,EAAE,wBAAwB,aACtE,MAAM,IAAI,WAAW,wDAAwD;CAC/E,MAAM,iBAAiB,OAAO,OAAO,gBAAgB,WAAW,eAAe,uBAAuB,YAAY;CAClH,IAAI,cAAc,CAAC;CACnB,OAAO,OAAO,eAAe,MAAM,MAAM,IAAI,YAAY,GAAG,GAAG,cAAc,CAAC;CAC9E,MAAM,QAAQ,aAAa,GAAG,GAAG,OAAO,OAAO,qBAAqB,KAAK,IAAI,OAAO,gBAAgB,oBAAI,IAAI,WAAW,GAAG,OAAO,GAAG,GAAG,OAAO,kBAAkB,WAAW,OAAO,OAAO,gBAAgB,gBAAgB,WAAW,UAAU,IAAI,cAAc,GAAG,YAAY,gBAAgB,IAAI,WAAW,aAAa,UAAU,GAAG,IAAI,MAAM,WAAW,OAAO,KAAK,QAAQ,GAAG,YAAY,MAAM,OAAO,GAAG,MAAM,QAAQ,QAAQ;CACta,MAAM,cAAc,mBAAmB,MAAM,KAAK,SAAS;CAC3D,IAAI,WAAW,CAAC;CAChB,IAAI;EACF,WAAW,MAAM,OAAO,OAAO,OAAO,MAAM,SAAS,WAAW,WAAW,IAAI;CACjF,QAAQ,CACR;CACA,IAAI,CAAC,UACH,MAAM,IAAI,+BAA+B;CAC3C,MAAM,SAAS,EAAE,SAAS,OAAO,kBAAkB,WAAW,gBAAgB,gBAAgB,WAAW,UAAU,IAAI,eAAe;CACtI,OAAO,qBAAqB,KAAK,MAAM,OAAO,kBAAkB,aAAa,WAAW,KAAK,MAAM,OAAO,oBAAoB,SAAS,cAAc,CAAC;EAAE,GAAG;EAAQ,KAAK;CAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG;AAClM;AACA,eAAe,cAAc,KAAK,QAAQ,KAAK;CAC7C,IAAI,eAAe,eAAe,MAAM,QAAQ,OAAO,GAAG,IAAI,OAAO,OAAO,UAC1E,MAAM,IAAI,WAAW,4CAA4C;CACnE,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,GAAG,WAAW,WAAW,IAAI,MAAM,GAAG;CAC9E,IAAI,WAAW,GACb,MAAM,IAAI,WAAW,qBAAqB;CAC5C,OAAO,gBAAgB;EAAE;EAAS,WAAW;EAAiB;CAAU,GAAG,QAAQ,KAAK,6BAA6B;AACvH;;;AC1EA,IAAM,SAAS,SAAS,KAAK,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAG,cAAc;CACtE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;AACL,GAAG,QAAQ,qIAAqI,cAAc;AAC9J,SAAS,kBAAkB;CACzB,MAAM,IAAI,UAAU,4BAA4B;AAClD;AACA,SAAS,KAAK,KAAK;CACjB,OAAO,OAAO,YAAY,gBAAgB;CAC1C,MAAM,UAAU,MAAM,KAAK,GAAG;CAC9B,CAAC,CAAC,WAAW,QAAQ,MAAM,QAAQ,OAAO,gBAAgB;CAC1D,MAAM,QAAQ,WAAW,QAAQ,EAAE,GAAG,eAAe,KAAK,MAAM,QAAQ,YAAY,QAAQ,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE;CAChH,OAAO,OAAO,SAAS,YAAY,KAAK,gBAAgB,GAAG,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ,CAAC,eAAe;AAC1H;AACA,SAAS,cAAc,OAAO,OAAO;CACnC,IAAI,CAAC,OAAO,SAAS,KAAK,GACxB,MAAM,IAAI,UAAU,WAAW,MAAM,OAAO;CAC9C,OAAO;AACT;AAYA,IAAM,gBAAgB,UAAU;CAC9B,MAAM,aAAa,MAAM,YAAY;CACrC,OAAO,MAAM,SAAS,GAAG,IAAI,aAAa,eAAe;AAC3D,GAAG,yBAAyB,YAAY,cAAc,OAAO,cAAc,WAAW,UAAU,SAAS,UAAU,IAAI,MAAM,QAAQ,UAAU,IAAI,UAAU,MAAM,QAAQ,WAAW,SAAS,GAAG,CAAC,IAAI,CAAC;AACxM,SAAS,oBAAoB,SAAS,OAAO,WAAW,CAAC,GAAG;CAC1D,MAAM,QAAQ,QAAQ;CACtB,IAAI,EAAE,UAAU,KAAK,KAAK,CAAC,WAAW;EACpC,IAAI,OAAO,SAAS,UAClB,MAAM,IAAI,yBAAyB,IAAI,MAAM,2BAA2B,SAAS,OAAO,SAAS;EACnG,OAAO;CACT;AACF;AACA,SAAS,gBAAgB,SAAS,OAAO;CACvC,MAAM,IAAI,yBAAyB,eAAe,MAAM,gBAAgB,SAAS,OAAO,WAAW;AACrG;AACA,SAAS,kBAAkB,iBAAiB,gBAAgB,UAAU,CAAC,GAAG;CACxE,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,cAAc,OAAO,cAAc,CAAC;CAC3D,QAAQ,CACR;CACA,IAAI,CAAC,SAAS,OAAO,GACnB,MAAM,IAAI,WAAW,gDAAgD;CACvE,MAAM,EAAE,QAAQ;CAChB,IAAI,QAAQ,KAAK,MAAM,OAAO,gBAAgB,OAAO,YAAY,aAAa,gBAAgB,GAAG,MAAM,aAAa,GAAG,IACrH,MAAM,IAAI,yBAAyB,uCAAqC,SAAS,OAAO,WAAW;CACrG,MAAM,EAAE,iBAAiB,CAAC,GAAG,QAAQ,SAAS,UAAU,gBAAgB,SAAS,gBAAgB,CAAC,GAAG,cAAc;CACnH,gBAAgB,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,aAAa,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,YAAY,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,WAAW,KAAK,KAAK,cAAc,KAAK,KAAK;CACrM,KAAK,MAAM,SAAS,IAAI,IAAI,cAAc,QAAQ,CAAC,GACjD,IAAI,CAAC,OAAO,OAAO,SAAS,KAAK,GAC/B,MAAM,IAAI,yBAAyB,qBAAqB,MAAM,UAAU,SAAS,OAAO,SAAS;CACrG,WAAW,KAAK,KAAK,EAAE,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM,EAAA,CAAG,SAAS,QAAQ,GAAG,KAAK,gBAAgB,SAAS,KAAK,GAAG,YAAY,KAAK,KAAK,QAAQ,QAAQ,WAAW,gBAAgB,SAAS,KAAK,GAAG,aAAa,KAAK,KAAK,CAAC,sBAAsB,QAAQ,KAAK,OAAO,YAAY,WAAW,CAAC,QAAQ,IAAI,QAAQ,KAAK,gBAAgB,SAAS,KAAK;CAC/V,MAAM,EAAE,mBAAmB;CAC3B,IAAI,YAAY;CAChB,IAAI,OAAO,kBAAkB,UAC3B,YAAY,KAAK,cAAc;MAC5B,IAAI,mBAAmB,KAAK,GAAG;EAClC,IAAI,OAAO,kBAAkB,UAC3B,MAAM,IAAI,UAAU,oCAAoC;EAC1D,YAAY;CACd;CACA,cAAc,yBAAyB,SAAS;CAChD,MAAM,EAAE,gBAAgB,SAAS,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,KAAK,oBAAoB,IAAI,KAAK,IAAI,WAAW,CAAC,GAAG,MAAM,oBAAoB,SAAS,OAAO,gBAAgB,KAAK,CAAC,GAAG,MAAM,oBAAoB,SAAS,KAAK;CACjQ,IAAI,QAAQ,KAAK,KAAK,MAAM,MAAM,WAChC,MAAM,IAAI,yBAAyB,wCAAsC,SAAS,OAAO,WAAW;CACtG,MAAM,MAAM,oBAAoB,SAAS,KAAK;CAC9C,IAAI,QAAQ,KAAK,KAAK,OAAO,MAAM,WACjC,MAAM,IAAI,WAAW,wCAAsC,SAAS,OAAO,WAAW;CACxF,IAAI,gBAAgB,KAAK,GAAG;EAC1B,MAAM,MAAM,MAAM,KAAK,MAAM,cAAc,sBAAsB,OAAO,eAAe,WAAW,cAAc,KAAK,WAAW,CAAC;EACjI,IAAI,MAAM,YAAY,KACpB,MAAM,IAAI,WAAW,8DAA4D,SAAS,OAAO,WAAW;EAC9G,IAAI,MAAM,CAAC,WACT,MAAM,IAAI,yBAAyB,mEAAiE,SAAS,OAAO,WAAW;CACnI;CACA,OAAO;AACT;;;AC1FA,eAAe,UAAU,KAAK,KAAK,SAAS;CAC1C,MAAM,CAAC,UAAU,OAAO,MAAM,cAAc,KAAK,cAAc,OAAO,GAAG,GAAG;CAC5E,IAAI,CAAC,KACH,MAAM,IAAI,WAAW,qCAAqC;CAC5D,MAAM,UAAU,kBAAkB,SAAS,iBAAiB,SAAS,SAAS,OAAO;CACrF,OAAO;EAAE,GAAG;EAAU;CAAQ;AAChC;;;ACLA,SAAS,YAAY,KAAK,OAAO,KAAK,KAAK;CACzC,MAAM,EAAE,KAAK,SAAS,QAAQ,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ;CAC1E,QAAQ,QAAQ,KAAK,KAAK,OAAO,OAAO,eAAe,WAAW,KAAK,KAAK,MAAM,QAAQ,MAAM,KAAK,OAAO,OAAO,WAAW,UAAU,OAAO,aAAa,YAAY,OAAO,QAAQ,SAAS,MAAM,KAAK,KAAK,OAAO,SAAS,QAAQ,MAAM,MAAM,IAAI,SAAS,GAAG,MAAM,QAAQ,KAAK,KAAK,OAAO,OAAO,YAAY,QAAQ,YAAY,WAAW,KAAK,IAAI,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,KAAK,KAAK,QAAQ,WAAW,CAAC,MAAM,OAAO,QAAQ,MAAM;AACrc;AACA,eAAe,mBAAmB,OAAO,KAAK,OAAO;CACnD,MAAM,SAAS,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,QAAQ;CACxE,IAAI,OAAO,SAAS,KAAK,GAAG;EAC1B,MAAM,UAAU,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ;GACrD,IAAI,IAAI,SAAS,UACf,MAAM,IAAI,YAAY,8CAA8C;GACtE,OAAO,OAAO,OAAO,KAAK;EAC5B,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,MAAM,OAAO,SAAS,WAAW,OAAO,OAAO,MAAM;EACvD,CAAC;EACD,OAAO,OAAO;CAChB;CACA,OAAO,OAAO;AAChB;AACA,SAAS,kBAAkB,MAAM;CAC/B,IAAI;CACJ,IAAI;EACF,WAAW,gBAAgB,IAAI;CACjC,QAAQ,CACR;CACA,IAAI,CAAC,SAAS,QAAQ,GACpB,MAAM,IAAI,YAAY,4BAA4B;CACpD,MAAM,WAAW,SAAS,KAAK,KAAK,QAAQ;EAC1C,MAAM,aAAa,YAAY,GAAG;EAClC,OAAO,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,UAAU,CAAC,GAAG,WAAW,OAAO,IAAI;CAC9F,CAAC,GAAG,yBAAyB,IAAI,QAAQ;CACzC,OAAO,OAAO,eAAe,OAAO,iBAAiB,UAAU;EAC7D,MAAM,EAAE,KAAK,QAAQ;GAAE,GAAG;GAAiB,GAAG,OAAO;EAAO,GAAG,QAAQ,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;EAChH,IAAI,CAAC,SAAS,MAAM,QAClB,MAAM,IAAI,iBAAiB,kDAAgD;EAC7E,MAAM,aAAa,SAAS,KAAK,QAAQ,GAAG,UAAU,YAAY,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,WAAW;EAC3H,IAAI,CAAC,QACH,MAAM,IAAI,kBAAkB;EAC9B,IAAI,WAAW,GAAG;GAChB,MAAM,QAAQ,IAAI,yBAAyB;GAC3C,MAAM,MAAM,OAAO,iBAAiB,mBAAmB;IACrD,KAAK,MAAM,QAAQ,YACjB,IAAI;KACF,MAAM,MAAM,mBAAmB,QAAQ,MAAM,KAAK;IACpD,QAAQ,CACR;GACJ,GAAG;EACL;EACA,OAAO,mBAAmB,QAAQ,KAAK,KAAK;CAC9C,GAAG,QAAQ,EACT,aAAa,gBAAgB,QAAQ,EACvC,CAAC;AACH;;;ACpDA,SAAS,sBAAsB;CAC7B,OAAO,OAAO,gBAAgB,OAAO,OAAO,YAAY,OAAO,UAAU,cAAc,wBAAwB,OAAO,cAAc,OAAO,gBAAgB;AAC7J;AACA,IAAI;CACH,OAAO,YAAY,OAAO,CAAC,UAAU,WAAW,aAAa,cAAc,OAAO,aAAa;AAChG,IAAM,cAA8B,uBAAO;AAC3C,eAAe,UAAU,KAAK,SAAS,QAAQ,YAAY,OAAO;CAChE,MAAM,WAAW,MAAM,UAAU,KAAK;EACpC,QAAQ;EACR;EACA,UAAU;EACV;CACF,CAAC,CAAC,CAAC,OAAO,QAAQ;EAChB,MAAM,IAAI,SAAS,iBAAiB,IAAI,YAAY,IAAI;CAC1D,CAAC;CACD,IAAI,SAAS,WAAW,KACtB,MAAM,IAAI,UAAU,yDAAyD;CAC/E,IAAI;EACF,OAAO,MAAM,SAAS,KAAK;CAC7B,QAAQ;EACN,MAAM,IAAI,UAAU,4DAA4D;CAClF;AACF;AACA,IAAM,YAA4B,uBAAO;AACzC,SAAS,WAAW,WAAW,UAAU;CACvC,OAAO,OAAO,SAAS,SAAS,KAAK,KAAK,IAAI,IAAI,YAAY;AAChE;AACA,SAAS,iBAAiB,OAAO,UAAU,QAAQ;CACjD,IAAI,OAAO,MAAM,KAAK,GACpB,MAAM,IAAI,UAAU,IAAI,OAAO,yBAAyB;CAC1D,OAAO,OAAO,SAAS,WAAW,QAAQ;AAC5C;AACA,SAAS,mBAAmB,KAAK,SAAS;CACxC,IAAI,EAAE,eAAe,MACnB,MAAM,IAAI,UAAU,gCAAgC;CACtD,MAAM,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,GAAG,gBAAgB,KAAK;CAChF,IAAI,OAAO,iBAAiB,aAAa,CAAC,OAAO,UAAU,aAAa,KAAK,gBAAgB,IAC3F,MAAM,IAAI,UAAU,2DAAyD;CAC/E,MAAM,kBAAkB,OAAO,iBAAiB,WAAW,gBAAgB,KAAK,mBAAmB,iBAAiB,KAAK,kBAAkB,KAAK,kBAAkB,GAAG,cAAc,iBAAiB,KAAK,aAAa,KAAK,aAAa,GAAG,UAAU,IAAI,QAAQ,KAAK,OAAO;CAC7Q,cAAc,CAAC,QAAQ,IAAI,YAAY,KAAK,QAAQ,IAAI,cAAc,UAAU,GAAG,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,4CAA4C;CAC9K,MAAM,YAAY,KAAK,cAAc,QAAQ,KAAK;CAClD,IAAI,eAAe,cAAc,iBAAiB,GAAG,kBAAkB,GAAG;CAC1E,IAAI,SAAS,OAAO,SAAS,UAAU;EACrC,MAAM,EAAE,KAAK,SAAS;EACtB,WAAW,KAAK,WAAW,KAAK,SAAS,IAAI,MAAM,gBAAgB,KAAK,QAAQ,kBAAkB,IAAI;CACxG;CACA,MAAM,SAAS,YAAY;EACzB,IAAI,gBAAgB,oBAAoB,MAAM,eAAe,KAAK,IAAI,CAAC,cAAc;GACnF,MAAM,WAAW,EAAE,gBAAgB,UAAU,eAAe,UAAU,MAAM,SAAS,YAAY,QAAQ,eAAe,GAAG,SAAS,CAAC,CAAC,MAAM,SAAS;IACnJ,MAAM,OAAO,kBAAkB,IAAI;IACnC,IAAI,YAAY,iBACd;IACF,QAAQ;IACR,MAAM,YAAY,KAAK,IAAI;IAC3B,UAAU,MAAM,MAAM,WAAW,MAAM,OAAO,OAAO,gBAAgB,WAAW,kBAAkB;GACpG,CAAC,CAAC,CAAC,cAAc;IACf,iBAAiB,YAAY,eAAe,KAAK;GACnD,CAAC;EACH;EACA,MAAM;CACR;CACA,OAAO,OAAO,iBAAiB,OAAO,iBAAiB,UAAU;EAC/D,CAAC,CAAC,SAAS,CAAC,WAAW,eAAe,WAAW,MAAM,MAAM,OAAO;EACpE,IAAI;GACF,OAAO,MAAM,MAAM,iBAAiB,KAAK;EAC3C,SAAS,KAAK;GACZ,IAAI,eAAe,qBAAqB,CAAC,WAAW,eAAe,gBAAgB,GACjF,OAAO,MAAM,OAAO,GAAG,MAAM,iBAAiB,KAAK;GACrD,MAAM;EACR;CACF,GAAG;EACD,aAAa;GACX,WAAW,WAAW,eAAe,gBAAgB;GACrD,YAAY,CAAC;EACf;EACA,OAAO;GACL,WAAW,WAAW,eAAe,WAAW;GAChD,YAAY,CAAC;EACf;EACA,QAAQ;GACN,OAAO;GACP,YAAY,CAAC;EACf;EACA,WAAW;GACT,WAAW,CAAC,CAAC;GACb,YAAY,CAAC;EACf;EACA,MAAM;GACJ,aAAa,OAAO,KAAK;GACzB,YAAY,CAAC;EACf;CACF,CAAC;AACH;;;ACvFA,IAAM,iCAAsC,IAAI,IAAI;CAClD;CACA;CACA;AACF,CAAC;AAQM,SAAS,cACd,OACA,MACgC;CAChC,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG,OAAO;CACxE,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAAM,OAAO;CACjE,KAAA,MAAW,OAAO,QAAQ,QAAQ,KAAK,GACrC,IAAI,OAAO,QAAQ,YAAY,eAAe,IAAI,GAAG,GAAG,OAAO;CAEjE,MAAM,SAAS,uBAAO,OAAO,IAAI;CACjC,KAAA,MAAW,OAAO,MAAM;EACtB,MAAM,aAAa,QAAQ,yBAAyB,OAAO,GAAG;EAC9D,IAAI,CAAC,YAAY;EACjB,IAAI,EAAE,WAAW,aAAa,OAAO;EACrC,OAAO,OAAO,WAAW;CAC3B;CACA,OAAO;AACT;AAOO,SAAS,eAAe,OAAiC;CAC9D,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,MAAM,WAClE,OAAO;CACT,MAAM,SAAS,MAAM;CACrB,KAAA,MAAW,OAAO,QAAQ,QAAQ,KAAK,GAAG;EACxC,IAAI,QAAQ,UAAU;EACtB,IACE,OAAO,QAAQ,YACf,CAAC,uBAAuB,KAAK,GAAG,KAChC,OAAO,GAAG,KAAK,QAEf,OAAO;CAEX;CACA,MAAM,OAAiB,CAAC;CACxB,KAAA,IAAS,QAAQ,GAAG,QAAQ,QAAQ,SAAS,GAAG;EAC9C,MAAM,aAAa,QAAQ,yBAAyB,OAAO,KAAK;EAChE,IACE,CAAC,cACD,EAAE,WAAW,eACb,OAAO,WAAW,UAAU,UAE5B,OAAO;EAET,KAAK,KAAK,WAAW,KAAK;CAC5B;CACA,OAAO;AACT;;;AC/CA,IAAM,kBAAqC,CAAC,UAAU,qBAAqB;AAwB3E,IAAM,eAAe;AACrB,SAAS,YAAY,OAAe,SAAoC;CACtE,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,MAAM,gCAAgC;CAClD;CACA,MAAM,WAAW;EAAC;EAAa;EAAS;CAAW,CAAA,CAAE,SAAS,IAAI,QAAQ;CAC1E,IACE,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,WAAW,KAAK,KAAK,MACpB,YAAY,UACT,CAAC,YAAY,CAAC,CAAC,SAAS,QAAQ,CAAA,CAAE,SAAS,IAAI,QAAQ,IACvD,IAAI,aAAa,WAErB,MAAM,IAAI,MAAM,uDAAuD;CACzE,OAAO;AACT;AACA,SAAS,YAAY,OAAiC;CACpD,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,QAChB,MAAM,KAAK,MAAM,SACjB,CAAC,GAAG,KAAK,CAAA,CAAE,OACR,cACC,UAAU,WAAW,CAAC,IAAI,MAAM,UAAU,WAAW,CAAC,MAAM,GAChE;AAEJ;AAoEA,IAAM,uBAAuB;AAUtB,SAAS,wBACd,SACiB;CACjB,MAAM,SAAS,SAAS;CACxB,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,UAAU,kDAAkD;CAExE,MAAM,cAAiD;EACrD,IAAI;EACJ,UAAU,IAAI,SAAS,MAAM;GAC3B,QAAQ;GACR,SAAS;IACP,oBAAoB;IACpB,iBAAiB;GACnB;EACF,CAAC;CACH;CACA,OAAO,OAAO,OAAO;EACnB,aAAa;EACb,iBAAiB;EACjB,wBACE,IAAI,SAAS,MAAM;GACjB,QAAQ;GACR,SAAS,EAAE,iBAAiB,WAAW;EACzC,CAAC;EACH,MAAM,aAAa,SAAkB;GACnC,MAAM,QAAQ,qBAAqB,KACjC,QAAQ,QAAQ,IAAI,eAAe,KAAK,EAC1C;GACA,IAAI,CAAC,OAAO,OAAO,KAAK;GACxB,IAAI;GACJ,IAAI;IACF,YAAY,MAAM,OAAO,MAAM,EAAE;GACnC,QAAQ;IACN,OAAO,KAAK;GACd;GAGA,MAAM,SAAS,cAAc,WAAW;IACtC;IACA;IACA;IACA;GACF,CAAC;GACD,MAAM,SAAS,SAAS,eAAe,OAAO,MAAM,IAAI;GACxD,IACE,CAAC,UACD,CAAC,UACD,CAAC,YAAY,OAAO,EAAE,KACtB,CAAC,YAAY,OAAO,QAAQ,KAC3B,OAAO,SAAS,KAAA,KAAa,CAAC,YAAY,OAAO,IAAI,KACtD,CAAC,OAAO,OAAO,UAAU,aAAa,KAAK,KAAK,CAAC,GAEjD,OAAO,KAAK;GAEd,OAAO;IACL,IAAI;IACJ,WAAW;KACT,IAAI,OAAO;KACX,UAAU,OAAO;KACjB,MAAM,OAAO;KACb;KAEA,eAAe;IACjB;GACF;EACF;CACF,CAAC;AACH;AAkCO,IAAM,sBAAsB,OAAO,OAAO;CAC/C,UAAU;CACV,QAAQ;CACR,SAAS;CACT,QAAQ;AACV,CAAC;AAaM,SAAS,4BACd,SAC8B;CAC9B,IAAI;CACJ,IAAI;CACJ,MAAM,UAAU,QAAQ;CACxB,aAAa;EACX,MAAM,UACJ,OAAO,QAAQ,YAAY,aACvB,QAAQ,QAAQ,IAChB,QAAQ;EACd,IAAI,YAAY,SAAS;GACvB,MAAM,SAAS,SAAS;GACxB,IAAI,OAAO,WAAW,YAAY,OAAO;GACzC,UAAU,wBAAwB,EAChC,SAAS,UAAU,OAAO,KAAK,SAAS,KAAK,EAC/C,CAAC;GACD,OAAO;EACT;EACA,IAAI,QAAQ,OAAO;EACnB,MAAM,MACJ,QAAQ,OACP,WACE,SAAS,OACZ,CAAC;EACH,MAAM,YAAY,SAAyB;GACzC,MAAM,QAAQ,IAAI,KAAI,EAAG,KAAK;GAC9B,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,uBAAuB,KAAI,EAAG;GAC1D,OAAO;EACT;EACA,MAAM,kBAAkB,SAAS;EACjC,MAAM,mBACJ,QAAQ,qBACP,OAAO,oBAAoB,cACvB,aACC,gBAAgB,KAAK,SAAS,QAAQ,IACxC,KAAA;EACN,IAAI,CAAC,kBACH,MAAM,IAAI,MACR,0GACF;EAEF,SAAS,sBAAsB;GAC7B;GACA,UAAU,SAAS,oBAAoB,QAAQ;GAC/C,QAAQ,SAAS,oBAAoB,MAAM;GAC3C,SAAS,SAAS,oBAAoB,OAAO;GAC7C,QAAQ,SAAS,oBAAoB,MAAM,CAAA,CAAE,MAAM,MAAM;GACzD,YAAY,QAAQ,cAAc,CAAC,OAAO;GAC1C,WAAW,QAAQ;GACnB,eAAe,QAAQ;GACvB;EACF,CAAC;EACD,OAAO;CACT;AACF;AAEO,SAAS,sBACd,SACiB;CACjB,IAAI,CAAC;EAAC;EAAS;EAAe;CAAO,CAAA,CAAE,SAAS,QAAQ,OAAO,GAC7D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,MAAM,cAAc,YAAY,QAAQ,UAAU,QAAQ,OAAO;CACjE,YAAY,QAAQ,QAAQ,QAAQ,OAAO;CAC3C,YAAY,QAAQ,SAAS,QAAQ,OAAO;CAC5C,IACE,CAAC,QAAQ,WAAW,UACpB,QAAQ,WAAW,MAAM,QAAQ,CAAC,CAAC,SAAS,OAAO,CAAA,CAAE,SAAS,GAAG,CAAC,GAElE,MAAM,IAAI,MAAM,wDAAwD;CAE1E,IAAI,QAAQ,OAAO,MAAM,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC,GAC1D,MAAM,IAAI,MAAM,0BAA0B;CAE5C,IACE,QAAQ,cAAc,KAAA,KACtB,CAAC,CAAC,UAAU,KAAK,CAAA,CAAE,SAAS,QAAQ,SAAS,GAE7C,MAAM,IAAI,MAAM,oCAAoC;CAGtD,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW,QAAQ;CACzB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,CAAC;CAC1C,MAAM,aAAa,CAAC,GAAG,QAAQ,UAAU;CACzC,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,gBAAgB,QAAQ,kBAAkB;CAChD,MAAM,mBAAmB,QAAQ;CACjC,MAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,OAAO,GAAG,EACxD,iBAAiB,IACnB,CAAC;CACD,MAAM,cAAc,GAAG,YAAY,OAAM,uCAAwC,YAAY,aAAa,MAAM,KAAK,YAAY;CACjI,SAAS,KAAK,OAGZ;EACA,MAAM,YAAY;GAChB,6BAA6B,YAAW;GACxC,GAAI,OAAO,SAAS,CAAC,UAAU,OAAO,KAAK,GAAG,EAAC,EAAG,IAAI,CAAC;GACvD,GAAI,QAAQ,CAAC,UAAU,MAAK,EAAG,IAAI,CAAC;EACtC,CAAA,CAAE,KAAK,IAAI;EACX,OAAO;GACL,IAAI;GACJ,UAAU,IAAI,SAAS,MAAM;IAC3B,QAAQ,UAAU,uBAAuB,MAAM;IAC/C,SAAS;KAAE,oBAAoB;KAAW,iBAAiB;IAAW;GACxE,CAAC;EACH;CACF;CACA,OAAO;EACL;EACA,wBACE,SAAS,KACP;GACE;GACA,uBAAuB,CAAC,MAAM;GAC9B,kBAAkB;GAClB,0BAA0B,CAAC,QAAQ;EACrC,GACA,EAAE,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAC7C;EACF,MAAM,aAAa,SAAS;GAC1B,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;GACzD,IAAI,CAAC,eAAe,OAAO,KAAK;GAChC,MAAM,QACJ,+DAA+D,KAC7D,aACF;GACF,IAAI,CAAC,OAAO,OAAO,KAAK,eAAe;GACvC,IAAI;IACF,MAAM,EAAE,YAAY,MAAM,UAAU,MAAM,IAAI,MAAM;KAClD;KACA,UAAU;KACV;KACA,KAAK;KACL,gBAAgB;MAAC;MAAO;MAAO;MAAO;KAAK;KAC3C,gBAAgB;IAClB,CAAC;IACD,IAAI,CAAC,YAAY,QAAQ,GAAG,KAAK,OAAO,QAAQ,UAAU,UACxD,OAAO,KAAK,eAAe;IAC7B,MAAM,UAAU,QAAQ,UAAU,KAAK,CAAC,IAAI,QAAQ,MAAM,MAAM,GAAG;IACnE,IAAI,QAAQ,MAAM,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC,GACnD,OAAO,KAAK,eAAe;IAC7B,IAAI,OAAO,MAAM,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC,GACjD,OAAO,KAAK,oBAAoB;IAWlC,MAAM,SAAS,cAAc,MAVP,iBACpB,OAAO,OAAO;KACZ;KACA,SAAS,QAAQ;KACjB,QAAQ,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC;KAClC,QAAQ,OAAO,OAAO,OAAO;IAC/B,CAAC,CACH,GAGsC;KACpC;KACA;KACA;KACA;KACA;IACF,CAAC;IACD,MAAM,QACJ,QAAQ,UAAU,KAAA,IACd,KAAA,IACA,eAAe,OAAO,KAAK;IACjC,IACE,CAAC,UACD,UAAU,QACV,CAAC,YAAY,OAAO,EAAE,KACrB,iBAAiB,CAAC,YAAY,OAAO,QAAQ,KAC7C,OAAO,aAAa,KAAA,KAAa,CAAC,YAAY,OAAO,QAAQ,KAC7D,OAAO,SAAS,KAAA,KAAa,CAAC,YAAY,OAAO,IAAI,KACrD,UAAU,KAAA,KAAa,CAAC,MAAM,MAAM,WAAW,KAC/C,OAAO,kBAAkB,KAAA,MACvB,OAAO,OAAO,kBAAkB,YAC/B,CAAC,gBAAgB,SAAS,OAAO,aAAa,IAElD,OAAO,KAAK,eAAe;IAE7B,OAAO;KACL,IAAI;KACJ,WAAW;MACT,IAAI,OAAO;MACX,UAAU,OAAO;MACjB,MAAM,OAAO;MACb;MACA,QAAQ,CAAC,GAAG,OAAO;MACnB,eACG,OAAO,iBACR;KACJ;IACF;GACF,QAAQ;IACN,OAAO,KAAK,eAAe;GAC7B;EACF;CACF;AACF"}