@hyper.authio/client 0.0.0-stage → 0.1.1

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/errors.ts","../src/options.ts","../src/http.ts","../src/discovery.ts","../src/keys.ts","../src/client-authentication.ts","../src/encryption.ts","../src/client.ts","../src/resource-access.ts","../src/webhooks.ts"],"names":["importPKCS8","importJWK","token","seconds"],"mappings":";;;AAGO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,OAAA,EAAS,KAAA;AAAA,EACT,KAAA,EAAO,KAAA;AAAA,EACP,MAAA,EAAQ,KAAA;AAAA,EACR,QAAA,EAAU,KAAA;AAAA,EACV,UAAA,EAAY,KAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,KAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,SAAA,EAAW,KAAA;AAAA,EACX,eAAA,EAAiB,KAAA;AAAA,EACjB,KAAA,EAAO,OAAA;AAAA,EACP,SAAA,EAAW,KAAA;AAAA,EACX,0BAAA,EAA4B,KAAA;AAAA,EAC5B,qBAAA,EAAuB,KAAA;AAAA,EACvB,gBAAA,EAAkB,KAAA;AAAA,EAClB,KAAA,EAAO,OAAA;AAAA,EACP,cAAA,EAAgB,QAAA;AAAA,EAChB,iBAAA,EAAmB,WAAA;AAAA,EACnB,SAAA,EAAW,YAAA;AAAA,EACX,KAAA,EAAO,KAAA;AAAA,EACP,YAAA,EAAc,eAAA;AAAA,EACd,QAAA,EAAU,WAAA;AAAA,EACV,IAAA,EAAM,MAAA;AAAA,EACN,SAAA,EAAW,YAAA;AAAA,EACX,UAAA,EAAY,aAAA;AAAA,EACZ,UAAA,EAAY,aAAA;AAAA,EACZ,iBAAA,EAAmB,oBAAA;AAAA,EACnB,SAAA,EAAW,YAAA;AAAA,EACX,KAAA,EAAO,OAAA;AAAA,EACP,aAAA,EAAe,gBAAA;AAAA,EACf,WAAA,EAAa,cAAA;AAAA,EACb,mBAAA,EAAqB,uBAAA;AAAA,EACrB,YAAA,EAAc,eAAA;AAAA,EACd,YAAA,EAAc,eAAA;AAAA,EACd,cAAA,EAAgB,iBAAA;AAAA,EAChB,kBAAA,EAAoB,sBAAA;AAAA,EACpB,mBAAA,EAAqB,uBAAA;AAAA,EACrB,oBAAA,EAAsB,wBAAA;AAAA,EACtB,kBAAA,EAAoB,sBAAA;AAAA,EACpB,sBAAA,EAAwB,0BAAA;AAAA,EACxB,oBAAA,EAAsB,wBAAA;AAAA,EACtB,oBAAA,EAAsB;AACxB;AAkBO,IAAM,0BAAA,GAAmF,OAAO,MAAA,CAAO;AAAA,EAC5G,CAAC,gBAAA,CAAiB,kBAAkB,GAAG,MAAA;AAAA,EACvC,CAAC,gBAAA,CAAiB,mBAAmB,GAAG,OAAA;AAAA,EACxC,CAAC,gBAAA,CAAiB,oBAAoB,GAAG,QAAA;AAAA,EACzC,CAAC,gBAAA,CAAiB,kBAAkB,GAAG,MAAA;AAAA,EACvC,CAAC,gBAAA,CAAiB,sBAAsB,GAAG,UAAA;AAAA,EAC3C,CAAC,gBAAA,CAAiB,oBAAoB,GAAG,QAAA;AAAA,EACzC,CAAC,gBAAA,CAAiB,oBAAoB,GAAG;AAC3C,CAAC;AAKM,IAAM,YAAA,GAAe;AAAA,EAC1B,MAAA,EAAQ,QAAA;AAAA,EACR,OAAA,EAAS,SAAA;AAAA,EACT,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,aAAA,EAAe;AACjB;AAKO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,iBAAA,EAAmB,oBAAA;AAAA,EACnB,YAAA,EAAc,eAAA;AAAA,EACd,iBAAA,EAAmB,oBAAA;AAAA,EACnB,QAAA,EAAU,UAAA;AAAA,EACV,UAAA,EAAY,8CAAA;AAAA,EACZ,aAAA,EAAe,iDAAA;AAAA,EACf,mBAAA,EAAqB;AACvB;AAKO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,cAAA,EAAgB,+CAAA;AAAA,EAChB,wBAAA,EAA0B,4DAAA;AAAA,EAC1B,WAAA,EAAa,cAAA;AAAA,EACb,YAAA,EAAc;AAChB;AAKO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,cAAA,EAAgB,iBAAA;AAAA,EAChB,aAAA,EAAe,gBAAA;AAAA,EACf,YAAA,EAAc,eAAA;AAAA,EACd,kBAAA,EAAoB,qBAAA;AAAA,EACpB,oBAAA,EAAsB,wBAAA;AAAA,EACtB,YAAA,EAAc,eAAA;AAAA,EACd,aAAA,EAAe,gBAAA;AAAA,EACf,YAAA,EAAc,eAAA;AAAA,EACd,YAAA,EAAc,eAAA;AAAA,EACd,oBAAA,EAAsB,uBAAA;AAAA,EACtB,QAAA,EAAU,WAAA;AAAA,EACV,YAAA,EAAc,eAAA;AAAA,EACd,kBAAA,EAAoB,qBAAA;AAAA,EACpB,2BAAA,EAA6B,+BAAA;AAAA,EAC7B,yBAAA,EAA2B,6BAAA;AAAA,EAC3B,WAAA,EAAa,cAAA;AAAA,EACb,sBAAA,EAAwB;AAC1B;AAKO,IAAM,uBAAA,GAA0B;AAAA,EACrC,WAAA,EAAa,cAAA;AAAA,EACb,WAAA,EAAa,cAAA;AAAA,EACb,WAAA,EAAa,cAAA;AAAA,EACb,cAAA,EAAgB,iBAAA;AAAA,EAChB,WAAA,EAAa,cAAA;AAAA,EACb,aAAA,EAAe,iBAAA;AAAA,EACf,YAAA,EAAc,eAAA;AAAA,EACd,WAAA,EAAa,cAAA;AAAA,EACb,kBAAA,EAAoB,sBAAA;AAAA,EACpB,oBAAA,EAAsB,wBAAA;AAAA,EACtB,oBAAA,EAAsB,wBAAA;AAAA,EACtB,oBAAA,EAAsB,wBAAA;AAAA,EACtB,aAAA,EAAe,gBAAA;AAAA,EACf,mBAAA,EAAqB,uBAAA;AAAA,EACrB,IAAA,EAAM;AACR;AAKO,IAAM,oBAAA,GAAuB;AAAA,EAClC,SAAA,EAAW,oBAAA;AAAA,EACX,KAAA,EAAO,gBAAA;AAAA,EACP,OAAA,EAAS;AACX;AAKO,IAAM,0BAAA,GAA6B;AAAA,EACxC,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF;AAKO,IAAM,cAAA,GAAiB;AAAA,EAC5B,aAAA,EAAe,mCAAA;AAAA,EACf,aAAA,EAAe,YAAA;AAAA,EACf,aAAA,EAAe,QAAA;AAAA,EACf,gBAAA,EAAkB,QAAA;AAAA,EAClB,YAAA,EAAc,KAAA;AAAA,EACd,kBAAA,EAAoB,KAAA;AAAA,EACpB,yBAAA,EAA2B,MAAA;AAAA;AAAA,EAE3B,uBAAA,EAAyB,GAAA;AAAA;AAAA,EAEzB,0BAAA,EAA4B,IAAA;AAAA;AAAA,EAE5B,cAAA,EAAgB,CAAA;AAAA;AAAA,EAEhB,uBAAA,EAAyB,CAAA;AAAA;AAAA,EAEzB,oBAAA,EAAsB,GAAA;AAAA;AAAA,EAEtB,sBAAA,EAAwB,IAAA;AAAA;AAAA,EAExB,WAAA,EAAa,EAAA;AAAA;AAAA,EAEb,gBAAA,EAAkB,EAAA;AAAA;AAAA,EAElB,gBAAA,EAAkB,GAAA;AAAA;AAAA,EAElB,iBAAA,EAAmB,IAAA;AAAA,EACnB,mBAAmB,CAAC,eAAA,EAAiB,qBAAA,EAAuB,WAAA,EAAa,UAAU,YAAY;AACjG;;;AC9MO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAQO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA;AAAA,EAE1C,KAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAET,WAAA,CAAY,KAAA,EAAe,gBAAA,EAA2B,SAAA,EAAoB,QAAiB,OAAA,EAA+B;AACxH,IAAA,KAAA,CAAM,mBAAmB,CAAA,EAAG,KAAK,KAAK,gBAAgB,CAAA,CAAA,GAAK,OAAO,OAAO,CAAA;AACzE,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AACxB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;AAKO,IAAM,oBAAA,GAAN,cAAmC,WAAA,CAAY;AAAC;AAKhD,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAY;AAAC;;;AC3BpD,IAAM,WAAA,GAA2B;AAAA,EACtC,GAAA,EAAK,MAAM,IAAA,CAAK,GAAA,EAAI;AAAA,EACpB,KAAA,EAAO,CAAC,EAAA,EAAI,MAAA,KACV,IAAI,OAAA,CAAc,CAAC,SAAS,MAAA,KAAW;AACrC,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,MAAA,CAAO,OAAO,MAAM,CAAA;AACpB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAM,UAAU,MAAM;AACpB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IACvB,CAAA;AACA,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC;AACL;AAqDO,SAAS,kBAAkB,OAAA,EAAoD;AACpF,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,IAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AAEpC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK;AAAA,IAC1B,CAAC,WAAA,EAAa,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC/B,CAAC,UAAU,MAAM;AAAA,GACnB,EAAY;AACV,IAAA,IAAI,KAAA,IAAS,CAAC,YAAA,CAAa,KAAA,EAAO,YAAY,CAAA;AAC5C,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,CAAA,WAAA,EAAc,IAAI,CAAA,EAAA,EAAK,KAAK,CAAA,iGAAA;AAAA,OAC9B;AAAA,EACJ;AAEA,EAAA,MAAM,mBAAA,GAAsB,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAExD,EAAA,IAAI,OAAO,mBAAA,KAAwB,UAAA;AACjC,IAAA,MAAM,IAAI,yBAAyB,2DAA2D,CAAA;AAEhG,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,YAAA,EAAc,SAAS,cAAA,CAAe,aAAA;AAAA,IACtC,YAAA;AAAA,IACA,0BAA0B,OAAA,CAAQ,OAAA,CAAQ,sBAAA,EAAwB,cAAA,CAAe,wBAAwB,wBAAwB,CAAA;AAAA,IACjI,eAAe,OAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,cAAA,CAAe,aAAa,aAAa,CAAA;AAAA,IACrF,KAAA,EAAO,mBAAA;AAAA,IACP,KAAA,EAAO,QAAQ,KAAA,IAAS;AAAA,GAC1B;AACF;AAOO,SAAS,cAAc,OAAA,EAAkF;AAC9G,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,IAAA,EAAK;AAEpC,EAAA,IAAI,MAAA,EAAQ,OAAO,mBAAA,CAAoB,MAAM,CAAA;AAE7C,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,EAAW,IAAA,EAAK;AAC1C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,EAAO,IAAA,EAAK;AAElC,EAAA,IAAI,CAAC,aAAa,CAAC,KAAA;AACjB,IAAA,MAAM,IAAI,wBAAA;AAAA,MACR;AAAA,KACF;AAEF,EAAA,OAAO,GAAG,mBAAA,CAAoB,SAAS,CAAC,CAAA,QAAA,EAAW,gBAAA,CAAiB,KAAK,CAAC,CAAA,CAAA;AAC5E;AAKO,SAAS,YAAA,CAAa,OAAe,YAAA,EAAgC;AAC1E,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,QAAA,EAAU,OAAO,IAAA;AAEtC,EAAA,OAAO,IAAI,QAAA,KAAa,OAAA,KAAY,CAAC,YAAA,IAAgB,UAAA,CAAW,IAAI,QAAQ,CAAA,CAAA;AAC9E;AAKO,SAAS,iBAAiB,KAAA,EAAuB;AACtD,EAAA,OAAO,mBAAmB,KAAK,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,CAAC,SAAA,KAAc,CAAA,CAAA,EAAI,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA,CAAE,CAAA;AAC9H;AAOO,SAAS,OAAA,CAAQ,KAAA,EAA2B,QAAA,EAAkB,IAAA,EAAsB;AACzF,EAAA,MAAM,WAAW,KAAA,IAAS,QAAA;AAE1B,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,KAAK,QAAA,GAAW,CAAA;AAC3C,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,kBAAA,EAAqB,IAAI,CAAA,0CAAA,CAA4C,CAAA;AAE1G,EAAA,OAAO,QAAA,GAAW,GAAA;AACpB;AAEA,SAAS,oBAAoB,KAAA,EAAuB;AAClD,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACjC;AAEA,SAAS,WAAW,QAAA,EAA2B;AAC7C,EAAA,MAAM,OAAO,QAAA,CAAS,OAAA,CAAQ,UAAA,EAAY,EAAE,EAAE,WAAA,EAAY;AAE1D,EAAA,OAAO,SAAS,WAAA,IAAe,IAAA,KAAS,KAAA,IAAS,qBAAA,CAAsB,KAAK,IAAI,CAAA;AAClF;;;AClKO,SAAS,IAAA,CAAK,UAAA,EAA8B,GAAA,EAAa,IAAA,EAAmB,MAAA,EAAyC;AAC1H,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,OAAA,CAAQ,UAAA,CAAW,aAAa,CAAA;AAE5D,EAAA,OAAO,WAAW,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,MAAM,MAAA,EAAQ,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,CAAC,MAAA,EAAQ,OAAO,CAAC,CAAA,GAAI,SAAS,CAAA;AACzG;AAOO,SAAS,SAAS,UAAA,EAAwE;AAC/F,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AAEjC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,EAAG;AACtD,IAAA,IAAI,KAAA,KAAU,UAAa,KAAA,KAAU,IAAA,IAAQ,UAAU,EAAA,EAAI,IAAA,CAAK,MAAA,CAAO,IAAA,EAAM,KAAK,CAAA;AAAA,EACpF;AAEA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,cAAc,MAAA,EAA0E;AACtG,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,EAAM,OAAO,MAAA;AAEpD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,QAAA,GAAW,CAAC,MAAM,CAAA,GAAI,CAAC,GAAG,MAAM,CAAA;AACjE,EAAA,MAAM,WAAW,CAAC,GAAG,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAC,KAAA,KAAA,CAAW,KAAA,IAAS,EAAA,EAAI,MAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;AAEjG,EAAA,OAAO,SAAS,MAAA,KAAW,CAAA,GAAI,MAAA,GAAY,QAAA,CAAS,KAAK,GAAG,CAAA;AAC9D;AAOA,eAAsB,iBAAoB,QAAA,EAAgC;AACxE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,EAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,eAAA,CAAgB,IAAA,EAAM,SAAS,MAAM,CAAA;AAE7D,EAAA,OAAO,iBAAA,CAAqB,IAAA,EAAM,QAAA,CAAS,MAAM,CAAA;AACnD;AAOA,eAAsB,sBAAsB,QAAA,EAAmC;AAC7E,EAAA,IAAI,SAAS,EAAA,EAAI;AAEjB,EAAA,MAAM,gBAAgB,MAAM,QAAA,CAAS,IAAA,EAAK,EAAG,SAAS,MAAM,CAAA;AAC9D;AAOO,SAAS,iBAAA,CAAqB,MAAc,MAAA,EAAmB;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE7B,IAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,MAAM,IAAI,WAAA,CAAY,gCAAgC,CAAA;AAE/H,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,kBAAA;AAAA,MACA,CAAA,oDAAA,EAAwD,MAAgB,OAAO,CAAA,CAAA;AAAA,MAC/E,MAAA;AAAA,MACA,MAAA;AAAA,MACA,EAAE,OAAO,KAAA;AAAM,KACjB;AAAA,EACF;AACF;AAOO,SAAS,gBAAgB,IAAA,EAA2D;AACzF,EAAA,IAAI,CAAC,IAAA,EAAM,IAAA,EAAK,EAAG,OAAO,MAAA;AAE1B,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE7B,IAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,MAAM,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,KAAA,GAAQ,KAAA,GAAQ,KAAA,CAAA;AAAA,EACxG,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAOO,SAAS,eAAA,CAAgB,MAA0B,MAAA,EAAqC;AAC7F,EAAA,MAAM,KAAA,GAAQ,gBAAgB,IAAI,CAAA;AAElC,EAAA,OAAO,KAAA,GACH,IAAI,mBAAA,CAAoB,KAAA,CAAM,OAAQ,KAAA,CAAM,iBAAA,EAAmB,MAAM,UAAA,EAAY,MAAM,IACvF,IAAI,mBAAA,CAAoB,QAAQ,MAAM,CAAA,CAAA,EAAI,wBAAwB,MAAM,CAAA,wBAAA,CAAA,EAA4B,QAAW,MAAM,CAAA;AAC3H;AAQO,SAAS,MAAA,CAAyB,OAAU,OAAA,EAA+B;AAChF,EAAA,MAAA,CAAO,cAAA,CAAe,KAAA,kBAAO,MAAA,CAAO,GAAA,CAAI,4BAA4B,CAAA,EAAG;AAAA,IACrE,UAAA,EAAY,KAAA;AAAA,IACZ,KAAA,GAAqC;AACnC,MAAA,MAAM,OAAgC,EAAC;AAEvC,MAAA,KAAA,MAAW,CAAC,IAAA,EAAM,MAAM,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAI,CAAA;AAC9C,QAAA,IAAA,CAAK,IAAI,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,IAAK,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,GAAO,cAAA,CAAe,aAAA,GAAgB,MAAA;AAElH,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,GACD,CAAA;AAED,EAAA,OAAO,KAAA;AACT;;;ACpGO,SAAS,4BAA4B,OAAA,EAA4E;AACtH,EAAA,MAAM,aAAa,YAAA,CAAa,OAAO,CAAA,GAAI,OAAA,GAAU,kBAAkB,OAAO,CAAA;AAC9E,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AAEJ,EAAA,MAAM,KAAA,GAAQ,MACZ,MAAA,IAAU,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI,GAAI,MAAA,CAAO,SAAA,GAAY,UAAA,CAAW,wBAAA,GAA2B,MAAA,CAAO,QAAA,GAAW,MAAA;AAEhH,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,MAAM,IAAI,MAAA,EAAQ;AAChB,MAAA,MAAM,UAAU,KAAA,EAAM;AAEtB,MAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,MAAA,OAAA,KAAY,cAAc,UAAA,EAAY,MAAM,CAAA,CACzC,IAAA,CAAK,CAAC,QAAA,KAAa;AAClB,QAAA,MAAA,GAAS,EAAE,QAAA,EAAU,SAAA,EAAW,UAAA,CAAW,KAAA,CAAM,KAAI,EAAE;AACvD,QAAA,OAAO,QAAA;AAAA,MACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,QAAA,OAAA,GAAU,MAAA;AAAA,MACZ,CAAC,CAAA;AAEH,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IACA,UAAA,GAAa;AACX,MAAA,MAAA,GAAS,MAAA;AAAA,IACX;AAAA,GACF;AACF;AAOO,SAAS,eAAA,CAAgB,UAAmC,MAAA,EAAwD;AACzH,EAAA,MAAM,KAAA,GAAQ,SAAS,MAAM,CAAA;AAE7B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA;AAChC,IAAA,MAAM,IAAI,oBAAA,CAAqB,CAAA,qCAAA,EAAwC,MAAM,CAAA,CAAA,CAAG,CAAA;AAElF,EAAA,OAAO,KAAA;AACT;AAEA,eAAe,aAAA,CAAc,YAA8B,MAAA,EAAwD;AACjH,EAAA,MAAM,MAAM,UAAA,CAAW,YAAA;AACvB,EAAA,IAAI,IAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,UAAA,EAAY,KAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,IAAK,MAAM,CAAA;AAE/G,IAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAE3B,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,IAAI,oBAAA,CAAqB,CAAA,qBAAA,EAAwB,QAAA,CAAS,MAAM,CAAA,+BAAA,EAAkC,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,EAClI,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,sBAAsB,MAAM,KAAA;AACjD,IAAA,IAAI,MAAA,EAAQ,SAAS,MAAM,KAAA;AAE3B,IAAA,MAAM,QAAA,GAAY,OAAiB,IAAA,KAAS,cAAA;AAE5C,IAAA,MAAM,IAAI,oBAAA;AAAA,MACR,QAAA,GACI,CAAA,yCAAA,EAA4C,GAAG,CAAA,WAAA,CAAA,GAC/C,oCAAoC,GAAG,CAAA,mBAAA,CAAA;AAAA,MAC3C,EAAE,OAAO,KAAA;AAAM,KACjB;AAAA,EACF;AAEA,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC5B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,qBAAqB,CAAA,iCAAA,EAAoC,GAAG,uBAAuB,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC/G;AAEA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,QAAA,CAAS,MAAA,KAAW,QAAA,IAAY,CAAC,QAAA,CAAS,MAAA,CAAO,IAAA,EAAK;AAC5G,IAAA,MAAM,IAAI,oBAAA,CAAqB,CAAA,iCAAA,EAAoC,GAAG,CAAA,eAAA,CAAiB,CAAA;AAEzF,EAAA,IAAI,SAAS,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,EAAE,MAAM,UAAA,CAAW,MAAA;AACrD,IAAA,MAAM,IAAI,oBAAA;AAAA,MACR,CAAA,gDAAA,EAAmD,QAAA,CAAS,MAAM,CAAA,uBAAA,EAA0B,WAAW,MAAM,CAAA,EAAA;AAAA,KAC/G;AAEF,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAA8E;AAClG,EAAA,OAAO,OAAQ,KAAA,CAA2B,YAAA,KAAiB,QAAA,IAAY,OAAQ,MAA2B,aAAA,KAAkB,QAAA;AAC9H;AC9HA,IAAM,kBAA0C,EAAE,OAAA,EAAS,SAAS,OAAA,EAAS,OAAA,EAAS,SAAS,OAAA,EAAQ;AAYvG,eAAsB,gBAAA,CACpB,KAAA,EACA,SAAA,EACA,KAAA,EACA,MAAA,EAC2B;AAC3B,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,EAAK;AAExB,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,gBAAA,CAAiB,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA,EAAG,SAAA,EAAW,KAAA,EAAO,MAAM,CAAA;AAElG,IAAA,OAAO,SAAA,CAAU,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,MAAM,CAAA;AAAA,EACjD;AAEA,EAAA,IAAI,WAAA,CAAY,KAAK,CAAA,EAAG;AACtB,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,KAAA,EAAO,MAAM,CAAA;AAE7C,IAAA,OAAO,EAAE,KAAK,KAAA,EAAO,SAAA,EAAW,gBAAgB,KAAA,EAAO,SAAA,EAAW,MAAM,CAAA,EAAG,KAAA,EAAM;AAAA,EACnF;AAEA,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,SAAA,EAAW,KAAA,KAAU,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,GAAW,KAAA,CAAM,GAAA,GAAM,MAAA,CAAA,EAAY,MAAM,CAAA;AACjH;AAKO,IAAM,+BAAA,GAAkC;AAQ/C,eAAe,SAAA,CAAU,GAAA,EAAa,SAAA,EAA+B,KAAA,EAA2B,MAAA,EAA2C;AACzI,EAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AAExC,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,SAAA;AAEJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,WAAW,gBAAA,CAAiB,EAAE,KAAK,GAAA,EAAK,MAAA,EAAQ,OAAO,CAAA;AAAA,IACrE,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,yBAAyB,CAAA,EAAG,MAAM,mDAAmD,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IACjH;AAEA,IAAA,MAAM,MAAM,SAAA,CAAU,MAAA,CAAO,EAAE,MAAA,EAAQ,OAAO,CAAA;AAE9C,IAAA,OAAO,aAAA,CAAc,GAAA,EAAK,SAAA,EAAW,KAAA,EAAO,MAAM,CAAA;AAAA,EACpD;AAEA,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,6BAA6B,CAAA;AAC7C,IAAA,MAAM,IAAI,wBAAA;AAAA,MACR,GAAG,MAAM,CAAA,kGAAA;AAAA,KACX;AAEF,EAAA,MAAM,MAAA,GAAS,SAAA,EAAW,IAAA,EAAK,IAAK,OAAA;AAEpC,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,KAAK,MAAM,WAAA,CAAY,KAAK,MAAM,CAAA,EAAG,SAAA,EAAW,MAAA,EAAQ,KAAA,EAAM;AAAA,EACzE,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,MAAM,CAAA,2BAAA,EAA8B,MAAM,CAAA,CAAA,CAAA,EAAK,EAAE,KAAA,EAAO,KAAA,EAAO,CAAA;AAAA,EACvG;AACF;AAEA,eAAe,aAAA,CAAc,GAAA,EAAU,SAAA,EAA+B,KAAA,EAA2B,MAAA,EAA2C;AAC1I,EAAA,IAAI,CAAC,IAAI,CAAA,EAAG,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,MAAM,CAAA,uDAAA,CAAyD,CAAA;AAEjH,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,GAAA,EAAK,MAAM,CAAA;AACrC,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,KAAA,EAAO,SAAA,KAAc,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,GAAW,GAAA,CAAI,GAAA,GAAM,MAAA,CAAA,EAAY,MAAM,CAAA;AAE9G,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,MAAA,EAAO,EAAG,MAAM,CAAA;AAE3D,IAAA,OAAO,EAAE,GAAA,EAAK,SAAA,EAAW,MAAA,EAAQ,KAAA,EAAM;AAAA,EACzC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,MAAM,CAAA,2BAAA,EAA8B,MAAM,CAAA,CAAA,CAAA,EAAK,EAAE,KAAA,EAAO,KAAA,EAAO,CAAA;AAAA,EACvG;AACF;AAEA,SAAS,WAAA,CAAY,KAAU,MAAA,EAA0B;AACvD,EAAA,IAAI,GAAA,CAAI,QAAQ,KAAA,EAAO;AACrB,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,GAAA,CAAI,CAAA,IAAK,EAAE,CAAA,GAAI,CAAA;AAE5C,IAAA,IAAI,OAAO,cAAA,CAAe,iBAAA;AACxB,MAAA,MAAM,IAAI,yBAAyB,CAAA,EAAG,MAAM,SAAS,IAAI,CAAA,2BAAA,EAA8B,cAAA,CAAe,iBAAiB,CAAA,MAAA,CAAQ,CAAA;AAEjI,IAAA,OAAO,EAAE,MAAM,KAAA,EAAM;AAAA,EACvB;AAEA,EAAA,IAAI,GAAA,CAAI,QAAQ,IAAA,EAAM;AACpB,IAAA,IAAI,CAAC,GAAA,CAAI,GAAA,IAAO,CAAC,eAAA,CAAgB,IAAI,GAAG,CAAA;AACtC,MAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,MAAM,CAAA,2EAAA,CAA6E,CAAA;AAE3H,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,IAAI,GAAA,EAAI;AAAA,EACtC;AAEA,EAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,MAAM,CAAA,+CAAA,CAAiD,CAAA;AAC/F;AAEA,SAAS,iBAAA,CAAkB,KAAgB,MAAA,EAA0B;AACnE,EAAA,MAAM,YAAY,GAAA,CAAI,SAAA;AAEtB,EAAA,IAAI,UAAU,IAAA,KAAS,OAAA,IAAW,UAAU,UAAA,IAAc,eAAA,CAAgB,UAAU,UAAU,CAAA;AAC5F,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAU,UAAA,EAAW;AAEnD,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,mBAAA,IAAuB,SAAA,CAAU,SAAS,SAAA,EAAW;AAC1E,IAAA,IAAA,CAAK,SAAA,CAAU,aAAA,IAAiB,CAAA,IAAK,cAAA,CAAe,iBAAA;AAClD,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,GAAG,MAAM,CAAA,MAAA,EAAS,UAAU,aAAa,CAAA,2BAAA,EAA8B,eAAe,iBAAiB,CAAA,MAAA;AAAA,OACzG;AAEF,IAAA,MAAM,OAAO,SAAA,CAAU,IAAA,EAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,IAAK,KAAA;AAEzD,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,cAAA,EAAgB,CAAA,EAAG,SAAA,CAAU,IAAA,KAAS,SAAA,GAAY,IAAA,GAAO,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAG;AAAA,EAC/F;AAEA,EAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,MAAM,CAAA,iFAAA,CAAmF,CAAA;AACjI;AAEA,SAAS,eAAA,CAAgB,KAAA,EAAiB,UAAA,EAAgC,MAAA,EAAwB;AAChG,EAAA,MAAM,MAAA,GACJ,KAAA,CAAM,cAAA,KAAmB,MAAA,GACrB,CAAC,KAAA,CAAM,cAAc,CAAA,GACrB,KAAA,CAAM,IAAA,KAAS,IAAA,GACb,CAAC,eAAA,CAAgB,KAAA,CAAM,KAAM,CAAE,CAAA,GAC/B,0BAAA,CAA2B,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAElG,EAAA,MAAM,MAAA,GAAS,UAAA,EAAY,IAAA,EAAK,IAAK,OAAO,CAAC,CAAA;AAE7C,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AACzB,IAAA,MAAM,IAAI,wBAAA;AAAA,MACR,CAAA,uBAAA,EAA0B,MAAM,CAAA,2BAAA,EAA8B,MAAM,iBAAiB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,KACxG;AAEF,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,QAAA,CAAS,MAAc,MAAA,EAAqB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE9B,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,EAAG;AAC9B,MAAA,IAAI,OAAO,IAAA,CAAK,MAAA,KAAW,GAAG,MAAM,IAAI,MAAM,sCAAsC,CAAA;AACpF,MAAA,OAAO,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IACtB;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,yBAAyB,CAAA,EAAG,MAAM,wBAAwB,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EACtF;AACF;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACrC,EAAA,OAAO,IAAA,CAAK,KAAA,CAAO,KAAA,CAAM,MAAA,GAAS,IAAK,CAAC,CAAA;AAC1C;AAEA,SAAS,YAAY,KAAA,EAAoC;AACvD,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,WAAA,IAAe,KAAA,IAAS,MAAA,IAAU,KAAA,IAAS,QAAA,IAAY,KAAA;AAC/G;AAEA,IAAI,gBAAA;AAOG,SAAS,cAAA,GAAoE;AAClF,EAAA,gBAAA,KAAsB,UAAA,CAA8D,OAAA,EAAS,QAAA,EAAU,IAAA,GACnG,OAAO,QAAa,CAAA,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA,GAC3C,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAE7B,EAAA,OAAO,gBAAA;AACT;;;ACjKO,SAAS,oBAAA,CAAqB,UAAkB,YAAA,EAA8B;AACnF,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAA,EAAG,gBAAA,CAAiB,QAAQ,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAiB,YAAY,CAAC,CAAA,CAAE,CAAA;AACxG,EAAA,IAAI,MAAA,GAAS,EAAA;AAEb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAE5D,EAAA,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAC9B;AAQO,SAAS,yBAAA,CAA0B,UAA2C,UAAA,EAAyD;AAC5I,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,QAAA,EAAU,IAAA,EAAK;AAEzC,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,yBAAyB,kCAAkC,CAAA;AAEpF,EAAA,MAAM,SAAS,QAAA,CAAS,gBAAA,KAAqB,MAAA,IAAa,CAAC,CAAC,QAAA,CAAS,oBAAA;AACrE,EAAA,MAAM,SACJ,QAAA,CAAS,oBAAA,KAAyB,CAAC,QAAA,CAAS,YAAA,IAAgB,SAAS,iBAAA,GAAoB,qBAAA,CAAA;AAE3F,EAAA,IAAA,CAAK,MAAA,KAAW,qBAAA,IAAyB,MAAA,KAAW,oBAAA,KAAyB,CAAC,QAAA,CAAS,YAAA;AACrF,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,yCAAA,EAA4C,MAAM,CAAA,CAAA,CAAG,CAAA;AAE1F,EAAA,IAAI,MAAA,KAAW,qBAAqB,CAAC,MAAA;AACnC,IAAA,MAAM,IAAI,yBAAyB,iEAAiE,CAAA;AAEtG,EAAA,MAAM,aAAa,OAAA,CAAQ,QAAA,CAAS,uBAAA,EAAyB,cAAA,CAAe,yBAAyB,yBAAyB,CAAA;AAE9H,EAAA,IAAI,UAAA,IAAc,CAAA,IAAK,UAAA,GAAa,cAAA,CAAe,0BAAA,GAA6B,GAAA;AAC9E,IAAA,MAAM,IAAI,wBAAA;AAAA,MACR,CAAA,mEAAA,EAAsE,eAAe,0BAA0B,CAAA,SAAA;AAAA,KACjH;AAEF,EAAA,MAAM,OAAA,GAAU,MAAA,KAAW,iBAAA,GAAoB,eAAA,CAAgB,QAAQ,CAAA,GAAI,MAAA;AAE3E,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAM,KAAA,CAAM,IAAA,EAAM,OAAA,EAAS;AACzB,MAAA,QAAQ,MAAA;AAAQ,QACd,KAAK,qBAAA;AACH,UAAA,OAAA,CAAQ,IAAI,eAAA,EAAiB,oBAAA,CAAqB,QAAA,EAAU,QAAA,CAAS,YAAa,CAAC,CAAA;AACnF,UAAA;AAAA,QACF,KAAK,oBAAA;AACH,UAAA,IAAA,CAAK,GAAA,CAAI,aAAa,QAAQ,CAAA;AAC9B,UAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,QAAA,CAAS,YAAa,CAAA;AAChD,UAAA;AAAA,QACF,KAAK,iBAAA;AACH,UAAA,IAAA,CAAK,GAAA,CAAI,aAAa,QAAQ,CAAA;AAC9B,UAAA,IAAA,CAAK,GAAA,CAAI,yBAAyB,wDAAwD,CAAA;AAC1F,UAAA,IAAA,CAAK,GAAA,CAAI,kBAAA,EAAoB,MAAM,cAAA,CAAe,QAAA,EAAU,YAAY,UAAA,EAAY,MAAM,OAAA,EAAU,CAAC,CAAA;AACrG,UAAA;AAAA,QACF;AACE,UAAA,IAAA,CAAK,GAAA,CAAI,aAAa,QAAQ,CAAA;AAAA;AAClC,IACF;AAAA,GACF;AACF;AAQA,eAAsB,cAAA,CAAe,QAAA,EAAkB,UAAA,EAA8B,UAAA,EAAoB,OAAA,EAA4C;AACnJ,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,WAAW,KAAA,CAAM,GAAA,KAAQ,GAAI,CAAA;AACpD,EAAA,MAAM,GAAA,GAAM,CAAC,GAAG,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA;AAErH,EAAA,OAAO,IAAI,QAAQ,EAAE,GAAA,EAAK,CAAA,CACvB,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,CAAQ,SAAA,EAAW,KAAK,KAAA,EAAO,GAAI,OAAA,CAAQ,KAAA,GAAQ,EAAE,GAAA,EAAK,QAAQ,KAAA,EAAM,GAAI,EAAC,EAAI,CAAA,CAC3G,UAAU,QAAQ,CAAA,CAClB,UAAA,CAAW,QAAQ,CAAA,CACnB,WAAA,CAAY,WAAW,MAAM,CAAA,CAC7B,WAAA,CAAY,GAAG,CAAA,CACf,YAAA,CAAa,GAAG,CAAA,CAChB,iBAAA,CAAkB,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,GAAI,CAAC,CAAA,CACrD,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACrB;AAEA,SAAS,gBAAgB,QAAA,EAA4E;AACnG,EAAA,IAAI,QAAA,CAAS,qBAAqB,MAAA,EAAW;AAC3C,IAAA,IAAI,MAAA;AAEJ,IAAA,OAAO,MAAM;AACX,MAAA,MAAA,KAAW,iBAAiB,QAAA,CAAS,gBAAA,EAAmB,SAAS,sBAAA,EAAwB,QAAA,CAAS,aAAa,kBAAkB,CAAA;AACjI,MAAA,MAAA,CAAO,MAAM,MAAM;AACjB,QAAA,MAAA,GAAS,MAAA;AAAA,MACX,CAAC,CAAA;AACD,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,QAAA,CAAS,oBAAA;AACtB,EAAA,IAAI,OAAA;AAEJ,EAAA,OAAO,YAAY;AACjB,IAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AAExC,IAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,yBAAyB,iEAAiE,CAAA;AAErH,IAAA,MAAM,EAAE,QAAA,EAAU,IAAA,EAAK,GAAI,MAAM,OAAO,aAAkB,CAAA;AAC1D,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAA,CAAW,MAAM,IAAA,CAAK,IAAI,CAAA,EAAG,OAAA;AAAA,IAC/B,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,yBAAyB,CAAA,sBAAA,EAAyB,IAAI,wBAAwB,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IAC1G;AAEA,IAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,OAAA,EAAS;AAC3C,MAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA,CAAE,IAAA;AAAA,QAAK,CAAC,GAAA,KACvC,gBAAA,CAAiB,GAAA,EAAK,QAAA,CAAS,wBAAwB,QAAA,CAAS,WAAA,EAAa,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAA,CAAG;AAAA,OAC/G;AAEA,MAAA,OAAA,GAAU,EAAE,SAAS,GAAA,EAAI;AACzB,MAAA,GAAA,CAAI,MAAM,MAAM;AACd,QAAA,IAAI,OAAA,EAAS,GAAA,KAAQ,GAAA,EAAK,OAAA,GAAU,MAAA;AAAA,MACtC,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,EACjB,CAAA;AACF;AC3JO,IAAM,6BAAA,GAAgC,CAAC,UAAA,EAAY,cAAc;AAKjE,IAAM,iCAAA,GAAoC,CAAC,eAAA,EAAiB,eAAA,EAAiB,eAAe;AAEnG,IAAM,yBAAyB,CAAC,EAAA,EAAM,EAAA,EAAM,CAAA,EAAM,GAAM,EAAA,EAAM,GAAA,EAAM,EAAA,EAAM,GAAA,EAAM,KAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAA,EAAM,GAAM,CAAI,CAAA;AAKjH,SAAS,uBAAuB,KAAA,EAAiC;AACtE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,MAAM,KAAA,CAAM,GAAG,EAAE,MAAA,KAAW,CAAA;AAClE;AAQO,SAAS,0BAAA,CAA2B,GAAA,EAAsC,OAAA,GAAU,qBAAA,EAA6C;AACtI,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA6C;AAElE,EAAA,MAAM,SAAA,GAAY,CAAC,SAAA,KAAsB;AACvC,IAAA,IAAI,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AAEpC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAA,GAAU,mBAAA,CAAoB,GAAA,EAAM,SAAA,EAAW,OAAO,CAAA;AACtD,MAAA,QAAA,CAAS,GAAA,CAAI,WAAW,OAAO,CAAA;AAC/B,MAAA,OAAA,CAAQ,KAAA,CAAM,MAAM,QAAA,CAAS,MAAA,CAAO,SAAS,CAAC,CAAA;AAAA,IAChD;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,OAAO,KAAA,KAAU;AACtB,IAAA,IAAI,CAAC,sBAAA,CAAuB,KAAK,CAAA,EAAG,OAAO,KAAA;AAE3C,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,4DAA4D,OAAO,CAAA,6DAAA;AAAA,OACrE;AAEF,IAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,cAAA,CAAe,KAAA,EAAO,CAAC,MAAA,KAAW,SAAA,CAAU,MAAA,CAAO,GAAG,CAAA,EAAG;AAAA,MACnF,uBAAA,EAAyB,CAAC,GAAG,6BAA6B,CAAA;AAAA,MAC1D,2BAAA,EAA6B,CAAC,GAAG,iCAAiC;AAAA,KACnE,CAAA;AAED,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAA;AAAA,EAC3C,CAAA;AACF;AAEA,eAAe,mBAAA,CAAoB,GAAA,EAA0B,SAAA,EAAmB,OAAA,EAAkD;AAChI,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU,OAAO,MAAM,gBAAA,CAAiB,GAAA,EAAK,WAAW,OAAO,CAAA;AAElF,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AAEtB,IAAA,OAAO,KAAK,UAAA,CAAW,GAAG,IACtB,MAAM,gBAAA,CAAiB,KAAK,KAAA,CAAM,IAAI,CAAA,EAAU,SAAA,EAAW,OAAO,CAAA,GAClE,MAAMA,YAAY,OAAA,CAAQ,IAAI,GAAG,SAAS,CAAA;AAAA,EAChD,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,0BAA0B,MAAM,KAAA;AACrD,IAAA,MAAM,IAAI,yBAAyB,CAAA,EAAG,OAAO,oDAAoD,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EACnH;AACF;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAU,SAAA,EAAmB,OAAA,EAAkD;AACvG,EAAA,IAAI,CAAC,IAAI,CAAA,EAAG,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,OAAO,CAAA,wEAAA,CAA0E,CAAA;AAEnI,EAAA,OAAOC,SAAAA,CAAU,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO,OAAA,EAAS,MAAA,EAAU,EAAG,SAAS,CAAA;AACxF;AAEA,SAAS,QAAQ,GAAA,EAAqB;AACpC,EAAA,MAAM,aAAa,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,IAAI,EAAE,IAAA,EAAK;AAElD,EAAA,IAAI,CAAC,UAAA,CAAW,QAAA,CAAS,uBAAuB,GAAG,OAAO,UAAA;AAE1D,EAAA,MAAM,QAAQ,UAAA,CAAW,UAAA,CAAW,OAAA,CAAQ,qBAAA,EAAuB,EAAE,CAAC,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,EAAM,CAAA,EAAM,GAAM,GAAG,sBAAA,EAAwB,CAAA,EAAM,GAAG,SAAA,CAAU,KAAA,CAAM,MAAM,CAAA,EAAG,GAAG,KAAK,CAAA;AACrG,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,CAAK,CAAC,EAAA,EAAM,GAAG,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,IAAI,CAAC,CAAA;AACtE,EAAA,MAAM,QAAQ,QAAA,CAAS,GAAG,EAAE,KAAA,CAAM,UAAU,KAAK,EAAC;AAElD,EAAA,OAAO,CAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,yBAAA,CAAA;AACzD;AAEA,SAAS,UAAU,MAAA,EAA0B;AAC3C,EAAA,IAAI,MAAA,GAAS,GAAA,EAAM,OAAO,CAAC,MAAM,CAAA;AAEjC,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,IAAA,GAAO,CAAA,EAAG,SAAS,CAAA,EAAG,KAAA,CAAM,OAAA,CAAQ,IAAA,GAAO,GAAI,CAAA;AAEvE,EAAA,OAAO,CAAC,GAAA,GAAO,KAAA,CAAM,MAAA,EAAQ,GAAG,KAAK,CAAA;AACvC;AAEA,SAAS,WAAW,IAAA,EAA0B;AAC5C,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,EAAG,CAAC,SAAA,KAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAC,CAAA;AAC3E;AAEA,SAAS,SAAS,KAAA,EAA2B;AAC3C,EAAA,IAAI,MAAA,GAAS,EAAA;AAEb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAE5D,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB;ACWO,SAAS,mBAAmB,OAAA,EAA4C;AAC7E,EAAA,MAAM,UAAA,GAAa,kBAAkB,OAAO,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,4BAA4B,UAAU,CAAA;AACxD,EAAA,MAAM,aAAA,GAAgB,yBAAA,CAA0B,OAAA,EAAS,UAAU,CAAA;AACnE,EAAA,MAAM,gBAAgB,OAAA,CAAQ,OAAA,CAAQ,gBAAA,EAAkB,cAAA,CAAe,kBAAkB,kBAAkB,CAAA;AAC3G,EAAA,MAAM,OAAA,GAAU,0BAAA,CAA2B,OAAA,CAAQ,mBAAmB,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAA,EAAY,SAAA,EAAW,aAAa,CAAA;AACrE,EAAA,MAAM,oBAAoB,4BAAA,CAA6B,UAAA,EAAY,aAAA,CAAc,QAAA,EAAU,QAAQ,aAAa,CAAA;AAEhH,EAAA,OAAO;AAAA,IACL,QAAQ,UAAA,CAAW,MAAA;AAAA,IACnB,UAAU,aAAA,CAAc,QAAA;AAAA,IACxB,UAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,iBAAA;AAAA,IACA,MAAM,UAAA,CAAW,KAAA,EAAO,WAAA,GAAc,EAAC,EAAG;AACxC,MAAA,YAAA,CAAa,OAAO,OAAO,CAAA;AAE3B,MAAA,MAAM,WAAW,MAAM,QAAA;AAAA,QACrB,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA,wBAAA;AAAA,QACA,EAAE,KAAA,EAAO,eAAA,EAAiB,WAAA,CAAY,aAAA,EAAc;AAAA,QACpD,WAAA,CAAY;AAAA,OACd;AAEA,MAAA,OAAO,iBAA4C,QAAQ,CAAA;AAAA,IAC7D,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,KAAA,EAAO,WAAA,GAAc,EAAC,EAAG;AACpC,MAAA,YAAA,CAAa,OAAO,OAAO,CAAA;AAE3B,MAAA,MAAM,WAAW,MAAM,QAAA;AAAA,QACrB,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA,qBAAA;AAAA,QACA,EAAE,KAAA,EAAO,eAAA,EAAiB,WAAA,CAAY,aAAA,EAAc;AAAA,QACpD,WAAA,CAAY;AAAA,OACd;AAEA,MAAA,MAAM,sBAAsB,QAAQ,CAAA;AAAA,IACtC,CAAA;AAAA,IACA,MAAM,QAAA,CAAS,WAAA,EAAa,WAAA,GAAc,EAAC,EAAG;AAC5C,MAAA,YAAA,CAAa,aAAa,aAAa,CAAA;AAEvC,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,YAAY,MAAM,CAAA;AACvD,MAAA,MAAM,WAAW,MAAM,IAAA;AAAA,QACrB,UAAA;AAAA,QACA,eAAA,CAAgB,UAAU,mBAAmB,CAAA;AAAA,QAC7C,EAAE,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA,EAAI,MAAA,EAAQ,mCAAA,EAAoC,EAAE;AAAA,QAClH,WAAA,CAAY;AAAA,OACd;AACA,MAAA,MAAM,SAAA,GAAY,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,GAAO,WAAA,EAAY;AAE1F,MAAA,IAAI,QAAA,CAAS,MAAM,SAAA,KAAc,iBAAA;AAC/B,QAAA,OAAO,eAAA,CAAA,CAAiB,MAAM,QAAA,CAAS,IAAA,EAAK,EAAG,IAAA,EAAK,EAAG,QAAA,EAAU,UAAA,EAAY,aAAA,CAAc,QAAA,EAAU,OAAA,EAAS,SAAS,MAAM,CAAA;AAE/H,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,QAAA,MAAM,YAAY,eAAA,CAAgB,IAAI,CAAA,GAAI,MAAA,GAAY,oBAAoB,QAAQ,CAAA;AAElF,QAAA,MAAM,SAAA,GACF,IAAI,mBAAA,CAAoB,SAAA,CAAU,OAAO,SAAA,CAAU,WAAA,EAAa,MAAA,EAAW,QAAA,CAAS,MAAM,CAAA,GAC1F,eAAA,CAAgB,IAAA,EAAM,SAAS,MAAM,CAAA;AAAA,MAC3C;AAEA,MAAA,OAAO,iBAAiC,QAAQ,CAAA;AAAA,IAClD,CAAA;AAAA,IACA,sBAAA,CAAuB,YAAA,GAAe,EAAC,EAAG;AACxC,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,KAAA,IAAS,UAAA,CAAW,KAAA;AAC/C,MAAA,MAAM,MAAM,EAAE,MAAA,EAAQ,aAAa,MAAA,EAAQ,QAAA,EAAU,aAAa,QAAA,EAAS;AAE3E,MAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,QAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AACvC,QAAA,MAAM,OAAO,OAAA,CAAQ,IAAA,GAAO,MAAM,OAAA,CAAQ,aAAY,GAAI,MAAA;AAC1D,QAAA,MAAM,OAAA,GAAU,OAAOC,MAAAA,KAAwC;AAC7D,UAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAE3C,UAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAGA,MAAAA,CAAM,SAAS,CAAA,CAAA,EAAIA,MAAAA,CAAM,WAAW,CAAA,CAAE,CAAA;AAEtE,UAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,EAAE,QAAQ,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,QAAQ,OAAA,CAAQ,MAAA,EAAQ,QAAA,EAAU,OAAA,CAAQ,UAAU,CAAA;AAAA,QACzH,CAAA;AAEA,QAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,QAAA,CAAS,EAAE,GAAG,GAAA,EAAK,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAA;AACjF,QAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,KAAK,CAAA;AAEpC,QAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,EAAK,OAAO,QAAA;AAEpC,QAAA,iBAAA,CAAkB,WAAW,EAAE,GAAG,KAAK,WAAA,EAAa,KAAA,CAAM,aAAa,CAAA;AAEvE,QAAA,OAAO,OAAA,CAAQ,MAAM,iBAAA,CAAkB,QAAA,CAAS,EAAE,GAAG,GAAA,EAAK,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAAA,MACrF,CAAA;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,iBAAA,CAAkB,UAAA,EAA8B,SAAA,EAAkC,aAAA,EAA6D;AACtJ,EAAA,MAAM,YAAA,GAAe,OAAO,UAAA,EAAgD,MAAA,KAAyB;AACnG,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,UAAA,EAAY,WAAW,aAAA,EAAe,gBAAA,EAAkB,YAAY,MAAM,CAAA;AAC1G,IAAA,MAAM,KAAA,GAAQ,MAAM,gBAAA,CAAsC,QAAQ,CAAA;AAElE,IAAA,OAAO,OAAO,KAAA,EAAO,CAAC,cAAA,EAAgB,eAAA,EAAiB,UAAU,CAAC,CAAA;AAAA,EACpE,CAAA;AAEA,EAAA,MAAM,UAAA,GAA8C,OAAO,aAAA,EAAe,OAAA,GAAU,EAAC,KAAM;AACzF,IAAA,YAAA,CAAa,aAAA,EAAe,aAAa,aAAa,CAAA;AAEtD,IAAA,IAAI,IAAA,GAAA,CAAQ,cAAc,QAAA,IAAY,aAAA,CAAc,WAAW,CAAA,GAAI,aAAA,CAAc,QAAA,GAAW,cAAA,CAAe,cAAA,IAAkB,GAAA;AAC7H,IAAA,MAAM,QAAA,GACJ,aAAA,CAAc,UAAA,IAAc,aAAA,CAAc,UAAA,GAAa,CAAA,GAAI,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI,GAAI,aAAA,CAAc,UAAA,GAAa,GAAA,GAAO,MAAA;AAExH,IAAA,WAAS;AACP,MAAA,MAAM,UAAA,CAAW,KAAA,CAAM,KAAA,CAAM,IAAA,EAAM,QAAQ,MAAM,CAAA;AAEjD,MAAA,IAAI,QAAA,KAAa,MAAA,IAAa,UAAA,CAAW,KAAA,CAAM,KAAI,IAAK,QAAA;AACtD,QAAA,MAAM,IAAI,mBAAA,CAAoB,iBAAA,CAAkB,YAAA,EAAc,sDAAsD,CAAA;AAEtH,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,YAAA,CAAa,EAAE,UAAA,EAAY,gBAAA,CAAiB,UAAA,EAAY,WAAA,EAAa,aAAA,CAAc,WAAA,EAAY,EAAG,OAAA,CAAQ,MAAM,CAAA;AAAA,MAC/H,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,EAAE,KAAA,YAAiB,mBAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,IAAI,KAAA,CAAM,KAAA,KAAU,iBAAA,CAAkB,oBAAA,EAAsB;AAC5D,QAAA,IAAI,KAAA,CAAM,KAAA,KAAU,iBAAA,CAAkB,QAAA,EAAU;AAC9C,UAAA,IAAA,IAAQ,eAAe,uBAAA,GAA0B,GAAA;AACjD,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,iBAAA,EAAmB,CAAC,OAAA,GAAU,EAAC,KAC7B,YAAA;AAAA,MACE,EAAE,UAAA,EAAY,gBAAA,CAAiB,iBAAA,EAAmB,KAAA,EAAO,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA,EAAG,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAS;AAAA,MACnH,OAAA,CAAQ;AAAA,KACV;AAAA,IACF,iBAAA,EAAmB,CAAC,OAAA,KAAY;AAC9B,MAAA,YAAA,CAAa,OAAA,EAAS,MAAM,MAAM,CAAA;AAClC,MAAA,YAAA,CAAa,OAAA,CAAQ,aAAa,aAAa,CAAA;AAE/C,MAAA,OAAO,YAAA;AAAA,QACL;AAAA,UACE,YAAY,gBAAA,CAAiB,iBAAA;AAAA,UAC7B,MAAM,OAAA,CAAQ,IAAA;AAAA,UACd,cAAc,OAAA,CAAQ,WAAA;AAAA,UACtB,eAAe,OAAA,CAAQ,YAAA;AAAA,UACvB,UAAU,OAAA,CAAQ;AAAA,SACpB;AAAA,QACA,OAAA,CAAQ;AAAA,OACV;AAAA,IACF,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,OAAA,KAAY;AACpB,MAAA,YAAA,CAAa,OAAA,EAAS,cAAc,cAAc,CAAA;AAElD,MAAA,OAAO,YAAA;AAAA,QACL,EAAE,UAAA,EAAY,gBAAA,CAAiB,YAAA,EAAc,aAAA,EAAe,OAAA,CAAQ,YAAA,EAAc,KAAA,EAAO,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA,EAAE;AAAA,QACvH,OAAA,CAAQ;AAAA,OACV;AAAA,IACF,CAAA;AAAA,IACA,QAAA,EAAU,CAAC,OAAA,KAAY;AACrB,MAAA,YAAA,CAAa,OAAA,EAAS,cAAc,cAAc,CAAA;AAElD,MAAA,OAAO,YAAA;AAAA,QACL;AAAA,UACE,YAAY,gBAAA,CAAiB,aAAA;AAAA,UAC7B,eAAe,OAAA,CAAQ,YAAA;AAAA,UACvB,oBAAoB,gBAAA,CAAiB,cAAA;AAAA,UACrC,sBAAsB,gBAAA,CAAiB,cAAA;AAAA,UACvC,KAAA,EAAO,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAAA,UACnC,UAAU,OAAA,CAAQ;AAAA,SACpB;AAAA,QACA,OAAA,CAAQ;AAAA,OACV;AAAA,IACF,CAAA;AAAA,IACA,MAAM,sBAAsB,OAAA,EAAS;AACnC,MAAA,YAAA,CAAa,OAAA,EAAS,cAAc,cAAc,CAAA;AAClD,MAAA,YAAA,CAAa,OAAA,CAAQ,UAAU,UAAU,CAAA;AAEzC,MAAA,MAAM,WAAW,MAAM,QAAA;AAAA,QACrB,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA,gBAAA;AAAA,QACA;AAAA,UACE,YAAY,gBAAA,CAAiB,aAAA;AAAA,UAC7B,eAAe,OAAA,CAAQ,YAAA;AAAA,UACvB,oBAAoB,gBAAA,CAAiB,cAAA;AAAA,UACrC,sBAAsB,gBAAA,CAAiB,wBAAA;AAAA,UACvC,qBAAqB,OAAA,CAAQ,QAAA;AAAA,UAC7B,eAAe,OAAA,CAAQ;AAAA,SACzB;AAAA,QACA,OAAA,CAAQ;AAAA,OACV;AAEA,MAAA,OAAO,0BAAA,CAA2B,MAAM,QAAA,CAAS,IAAA,IAAQ,QAAA,CAAS,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAAA,IAC5F,CAAA;AAAA,IACA,MAAM,mBAAA,CAAoB,OAAA,GAAU,EAAC,EAAG;AACtC,MAAA,MAAM,WAAW,MAAM,QAAA;AAAA,QACrB,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA,+BAAA;AAAA,QACA,EAAE,KAAA,EAAO,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA,EAAE;AAAA,QACvC,OAAA,CAAQ;AAAA,OACV;AAEA,MAAA,OAAO,OAAO,MAAM,gBAAA,CAA4C,QAAQ,CAAA,EAAG,CAAC,aAAa,CAAC,CAAA;AAAA,IAC5F,CAAA;AAAA,IACA,UAAA;AAAA,IACA,QAAA,EAAU,CAAC,OAAA,KAAY;AACrB,MAAA,YAAA,CAAa,OAAA,EAAS,UAAU,UAAU,CAAA;AAE1C,MAAA,IAAI,OAAO,OAAA,CAAQ,QAAA,KAAa,UAAU,MAAM,IAAI,UAAU,uBAAuB,CAAA;AAErF,MAAA,OAAO,YAAA;AAAA,QACL,EAAE,UAAA,EAAY,gBAAA,CAAiB,QAAA,EAAU,UAAU,OAAA,CAAQ,QAAA,EAAU,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAU,KAAA,EAAO,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA,EAAE;AAAA,QACtI,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,4BAAA,CACP,UAAA,EACA,QAAA,EACA,MAAA,EACA,aAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA0C;AAC9D,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAmD;AAEvE,EAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,EAA2B,QAAA,KACxC,CAAA,EAAG,WAAW,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAA,CAAK,KAAA,IAAS,EAAA,EAAI,MAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,QAAA,IAAY,EAAE,CAAA,CAAA;AAEjH,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,CAAS,OAAA,GAAU,EAAC,EAAG;AAC3B,MAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAC1C,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,QAAQ,CAAA;AACzC,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE9B,MAAA,IAAI,UAAU,UAAA,CAAW,KAAA,CAAM,KAAI,GAAI,MAAA,CAAO,WAAW,OAAO,MAAA;AAEhE,MAAA,IAAI,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE7B,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,MAAA,CACP,iBAAA,CAAkB,EAAE,MAAA,EAAQ,OAAO,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ,QAAQ,MAAA,EAAQ,CAAA,CACvF,IAAA,CAAK,CAAC,QAAA,KAAa;AAClB,UAAA,MAAM,QAAQ,wBAAA,CAAyB,QAAA,EAAU,WAAW,KAAA,CAAM,GAAA,IAAO,aAAa,CAAA;AAEtF,UAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AACtB,UAAA,OAAO,KAAA;AAAA,QACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAC,CAAA;AACpC,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,MAC1B;AAEA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IACA,UAAA,CAAW,OAAA,GAAU,EAAC,EAAG;AACvB,MAAA,MAAM,MAAM,KAAA,CAAM,aAAA,CAAc,QAAQ,MAAM,CAAA,EAAG,QAAQ,QAAQ,CAAA;AAEjE,MAAA,IAAI,OAAA,CAAQ,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,EAAG,WAAA,KAAgB,OAAA,CAAQ,WAAA,EAAa,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA;AAAA,IACpH;AAAA,GACF;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAA,EAA+B,QAAA,EAAkB,aAAA,EAAqD;AAC7I,EAAA,MAAM,QAAA,GAAA,CAAY,SAAS,UAAA,IAAc,QAAA,CAAS,aAAa,CAAA,GAAI,QAAA,CAAS,UAAA,GAAa,cAAA,CAAe,oBAAA,IAAwB,GAAA;AAChI,EAAA,MAAM,YAAY,QAAA,GAAW,QAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,aAAA,EAAe,WAAW,CAAC,CAAA;AAEjD,EAAA,OAAO,MAAA;AAAA,IACL;AAAA,MACE,aAAa,QAAA,CAAS,YAAA;AAAA,MACtB,WAAW,QAAA,CAAS,UAAA,EAAY,IAAA,EAAK,GAAI,SAAS,UAAA,GAAa,QAAA;AAAA,MAC/D,SAAA;AAAA,MACA,WAAW,SAAA,GAAY,IAAA;AAAA,MACvB,OAAO,QAAA,CAAS;AAAA,KAClB;AAAA,IACA,CAAC,aAAa;AAAA,GAChB;AACF;AAOO,SAAS,0BAAA,CAA2B,IAAA,EAAc,MAAA,EAAgB,QAAA,EAAkD;AACzH,EAAA,IAAI,MAAA,IAAU,GAAA,IAAO,MAAA,GAAS,GAAA,EAAK;AACjC,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAA2C,IAAA,EAAM,MAAM,CAAA;AAErE,IAAA,IAAI,OAAO,KAAA,CAAM,YAAA,KAAiB,QAAA,IAAY,KAAA,CAAM,YAAA;AAClD,MAAA,OAAO,MAAA;AAAA,QACL;AAAA,UACE,MAAA,EAAQ,SAAA;AAAA,UACR,aAAa,KAAA,CAAM,YAAA;AAAA,UACnB,QAAA,EAAU,OAAO,KAAA,CAAM,QAAA,KAAa,YAAY,KAAA,CAAM,QAAA,GAAW,MAAM,QAAA,GAAW,QAAA;AAAA,UAClF,cAAc,KAAA,CAAM,aAAA;AAAA,UACpB,cAAc,KAAA,CAAM,aAAA;AAAA,UACpB,WAAW,KAAA,CAAM,UAAA;AAAA,UACjB,iBAAiB,KAAA,CAAM,iBAAA;AAAA,UACvB,OAAO,KAAA,CAAM,KAAA;AAAA,UACb,iBAAiB,KAAA,CAAM,gBAAA;AAAA,UACvB,WAAW,KAAA,CAAM;AAAA,SACnB;AAAA,QACA,CAAC,aAAa;AAAA,OAChB;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,gBAAgB,IAAI,CAAA;AAClC,EAAA,MAAM,WAAA,GAAc,OAAO,iBAAA,EAAmB,IAAA,KAC1C,KAAA,CAAM,iBAAA,GACN,wBAAwB,MAAM,CAAA,yCAAA,CAAA;AAElC,EAAA,QAAQ,OAAO,KAAA;AAAO,IACpB,KAAK,iBAAA,CAAkB,kBAAA;AACrB,MAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,UAAA,EAAY,KAAA,CAAM,aAAa,WAAA,EAAY;AAAA,IAC1E,KAAK,iBAAA,CAAkB,2BAAA;AACrB,MAAA,OAAO,EAAE,QAAQ,oBAAA,EAAsB,WAAA,EAAa,MAAM,WAAA,IAAe,IAAI,WAAA,EAAY;AAAA,IAC3F;AACE,MAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAO,OAAO,KAAA,IAAS,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAA,EAAI,MAAM,KAAA,EAAO,UAAA,EAAY,WAAA,EAAa,UAAA,EAAY,OAAO,WAAA,EAAY;AAAA;AAEhJ;AAEA,eAAe,SACb,UAAA,EACA,SAAA,EACA,aAAA,EACA,QAAA,EACA,YACA,MAAA,EACmB;AACnB,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAC3C,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,QAAA,EAAU,QAAQ,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,SAAS,UAAU,CAAA;AAChC,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,EAAE,QAAQ,kBAAA,EAAoB,cAAA,EAAgB,qCAAqC,CAAA;AAE/G,EAAA,MAAM,aAAA,CAAc,KAAA,CAAM,IAAA,EAAM,OAAO,CAAA;AAEvC,EAAA,OAAO,IAAA,CAAK,UAAA,EAAY,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,IAAA,CAAK,QAAA,EAAS,EAAE,EAAG,MAAM,CAAA;AACzF;AAEA,eAAe,gBACb,GAAA,EACA,QAAA,EACA,UAAA,EACA,QAAA,EACA,SACA,MAAA,EACyB;AACzB,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,sBAAA,CAAuB,GAAG,IAAI,MAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,GAAA;AAElE,IAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,IAAI,GAAA,CAAI,gBAAgB,QAAA,EAAU,UAAU,CAAC,CAAA,EAAG,EAAE,CAAC,WAAW,GAAG,UAAA,CAAW,OAAO,CAAA;AACnH,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,QAAQ,IAAA,EAAM;AAAA,MAChD,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,QAAA,EAAU,QAAA;AAAA,MACV,cAAA,EAAgB;AAAA,KACjB,CAAA;AAED,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,kBAAA;AAAA,MACA,CAAA,wCAAA,EAA4C,KAAA,EAAiB,OAAA,IAAW,iBAAiB,CAAA,CAAA;AAAA,MACzF,MAAA;AAAA,MACA,MAAA;AAAA,MACA,EAAE,OAAO,KAAA;AAAM,KACjB;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAAA,EAAoF;AAC/G,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA;AAEtD,EAAA,IAAI,CAAC,UAAU,CAAC,YAAA,CAAa,KAAK,MAAA,CAAO,IAAA,EAAM,CAAA,EAAG,OAAO,MAAA;AAEzD,EAAA,IAAI,KAAA,GAAQ,EAAA;AACZ,EAAA,IAAI,WAAA;AAEJ,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,QAAA,CAAS,sEAAsE,CAAA,EAAG;AAC3G,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,CAAC,CAAA;AAChC,IAAA,MAAM,KAAA,GAAA,CAAS,KAAA,CAAM,CAAC,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA,EAAI,OAAA,CAAQ,QAAA,EAAU,IAAI,CAAA;AAEjE,IAAA,IAAI,IAAA,KAAS,SAAS,KAAA,GAAQ,KAAA;AAAA,SAAA,IACrB,IAAA,KAAS,qBAAqB,WAAA,GAAc,KAAA;AAAA,EACvD;AAEA,EAAA,OAAO,KAAA,GAAQ,EAAE,KAAA,EAAO,WAAA,EAAY,GAAI,MAAA;AAC1C;AAEA,SAAS,YAAA,CAAa,OAAgB,IAAA,EAAuC;AAC3E,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,EAAK,EAAG,MAAM,IAAI,SAAA,CAAU,CAAA,EAAG,IAAI,CAAA,aAAA,CAAe,CAAA;AAC5F;;;AC5gBA,IAAM,eAAe,IAAI,GAAA,CAAI,OAAO,OAAA,CAAQ,0BAA0B,EAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,MAAM,CAAC,IAAA,CAAK,aAAY,EAAG,MAAM,CAAC,CAAC,CAAA;AAQtH,IAAM,oBAAA,GAAN,MAAM,qBAAA,CAAqB;AAAA;AAAA,EAEhC,OAAgB,KAAA,GAAQ,IAAI,qBAAA,CAAqB,EAAE,CAAA;AAAA;AAAA,EAG1C,OAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,WAAA;AAAA,EAEQ,MAAA;AAAA,EAEjB,YAAY,OAAA,EAA6C;AACvD,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,OAAO,CAAC,CAAA;AACzC,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,oBAAA,CAAqB,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,KAAA,KAAU,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA;AACxF,IAAA,IAAA,CAAK,MAAA,uBAAa,GAAA,EAAI;AAEtB,IAAA,MAAM,cAAwC,EAAC;AAC/C,IAAA,MAAM,QAAA,uBAAe,GAAA,EAAoB;AAEzC,IAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AAChC,MAAA,KAAA,MAAW,CAAC,UAAU,OAAO,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,WAAW,CAAA,EAAG;AACnE,QAAA,MAAM,WAAA,GAAc,SAAS,WAAA,EAAY;AACzC,QAAA,IAAI,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAEzC,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,OAAA,uBAAc,GAAA,EAAI;AAClB,UAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAO,CAAA;AACpC,UAAA,QAAA,CAAS,GAAA,CAAI,aAAa,QAAQ,CAAA;AAClC,UAAA,WAAA,CAAY,QAAQ,IAAI,EAAC;AAAA,QAC3B;AAEA,QAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,UAAA,MAAM,SAAA,GAAY,OAAO,WAAA,EAAY;AAErC,UAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG;AAE5B,UAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,MAAM,CAAA;AAC7B,UAAA,WAAA,CAAY,SAAS,GAAA,CAAI,WAAW,CAAE,CAAA,CAAG,KAAK,MAAM,CAAA;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,WAAA,GAAc,OAAO,MAAA,CAAO,MAAA,CAAO,YAAY,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,OAAO,CAAA,KAAM,CAAC,IAAA,EAAM,MAAA,CAAO,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AAAA,EAC3I;AAAA;AAAA,EAGA,IAAI,OAAA,GAAmB;AACrB,IAAA,OAAO,IAAA,CAAK,QAAQ,MAAA,KAAW,CAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,MAAc,OAAA,EAA0D;AAC9E,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAEhC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,KAAU,SAAA,CAAU,KAAA,EAAO,OAAO,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,WAAA,OAAkB,MAAM,CAAA;AAAA,EACtG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAgB,OAAA,EAA0D;AACjG,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,MAAA,EAAQ,OAAO,KAAA;AAEjC,IAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,SAAU,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAA,CAAS,aAAa,CAAA,EAAG,IAAI,MAAA,CAAO,WAAA,EAAa,CAAA,IAAK,KAAA;AAEnH,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,KAAU,SAAA,CAAU,KAAA,EAAO,OAAO,CAAA,IAAK,WAAA,CAAY,KAAA,EAAO,QAAA,EAAU,MAAM,CAAC,CAAA;AAAA,EACvG;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,MAAA,EAAgE;AACzE,IAAA,OAAO,KAAK,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,CAAM,WAAW,MAAM,CAAA;AAAA,EAC/D;AACF;AAKO,SAAS,uBAAuB,SAAA,EAA8E;AACnH,EAAA,OAAO,YAAY,YAAA,CAAa,GAAA,CAAI,SAAA,CAAU,WAAA,EAAa,CAAA,GAAI,MAAA;AACjE;AAMO,SAAS,oBAAoB,MAAA,EAAwG;AAC1I,EAAA,MAAM,QAA8C,UAAA,CAAW,MAAM,IAAI,MAAA,GAAS,MAAA,CAAO,QAAQ,MAAM,CAAA;AACvG,EAAA,MAAM,QAAoC,EAAC;AAE3C,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,KAAA,EAAO;AACjC,IAAA,MAAM,MAAA,GAAS,uBAAuB,IAAI,CAAA;AAE1C,IAAA,IAAI,QAAQ,KAAA,CAAM,IAAA,CAAK,GAAG,wBAAA,CAAyB,MAAA,EAAQ,KAAK,CAAC,CAAA;AAAA,EACnE;AAEA,EAAA,OAAO,MAAM,MAAA,KAAW,CAAA,GAAI,qBAAqB,KAAA,GAAQ,IAAI,qBAAqB,KAAK,CAAA;AACzF;AAOO,SAAS,wBAAA,CAAyB,QAAoC,KAAA,EAA4C;AACvH,EAAA,MAAM,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,SAAA,CAAU,KAAK,CAAA,GAAI,KAAA;AAE5D,EAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,SAAU,EAAC;AAElC,EAAA,MAAM,QAAoC,EAAC;AAE3C,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,eAAe,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC1D,IAAA,MAAM,WAAA,GAAc,gBAAgB,eAAe,CAAA;AAEnD,IAAA,IAAI,CAAC,WAAA,EAAa,OAAO,EAAC;AAE1B,IAAA,KAAA,CAAM,IAAA,CAAK,OAAO,MAAA,CAAO,EAAE,QAAQ,IAAA,EAAM,WAAA,EAAa,CAAC,CAAA;AAAA,EACzD;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,gBAAgB,KAAA,EAAyE;AAChG,EAAA,IAAI,UAAU,IAAA,EAAM,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC3C,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,MAAA;AAElC,EAAA,MAAM,OAA0C,EAAC;AACjD,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACvD,IAAA,MAAM,GAAA,GAAM,SAAS,WAAA,EAAY;AAEjC,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AAClB,QAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,QAAA,IAAA,CAAK,QAAQ,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAAA,MACnC;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,GAAG,OAAO,MAAA;AAEpC,IAAA,MAAM,UAAoB,EAAC;AAE3B,IAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,MAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,WAAA,IAC1C,MAAA,KAAW,MAAM,OAAO,MAAA;AAAA,IACnC;AAEA,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AAClB,MAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,MAAA,IAAA,CAAK,QAAQ,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AAAA,IACxC;AAAA,EACF;AAEA,EAAA,OAAO,MAAA,CAAO,OAAO,IAAI,CAAA;AAC3B;AAEA,SAAS,WAAA,CAAY,KAAA,EAAiC,QAAA,EAAkB,MAAA,EAAyB;AAC/F,EAAA,MAAM,WAAA,GAAc,SAAS,WAAA,EAAY;AACzC,EAAA,MAAM,SAAA,GAAY,OAAO,WAAA,EAAY;AAErC,EAAA,KAAA,MAAW,CAAC,MAAM,OAAO,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,WAAW,CAAA,EAAG;AAC/D,IAAA,IAAI,IAAA,CAAK,WAAA,EAAY,KAAM,WAAA,EAAa,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAA,EAAY,KAAM,SAAS,CAAA;AAAA,EAC9G;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,OAAiC,OAAA,EAAqE;AACvH,EAAA,OAAO,CAAC,WAAW,OAAA,CAAQ,MAAA,KAAW,KAAK,OAAA,CAAQ,QAAA,CAAS,MAAM,MAAM,CAAA;AAC1E;AAEA,SAAS,qBAAqB,MAAA,EAAqC;AACjE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,KAAU;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,EAAY;AAE9B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAE1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AACH;AAEA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG,OAAO,MAAA;AAEzB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,WAAW,KAAA,EAA+D;AACjF,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,OAAQ,KAAA,CAA4B,MAAA,CAAO,QAAQ,CAAA,KAAM,UAAA;AACjH;;;ACzEA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAYhC,eAAsB,uBACpB,eAAA,EACA,OAAA,EACA,MAAA,EACA,OAAA,GAAgD,EAAC,EACP;AAC1C,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,UAAU,qBAAqB,CAAA;AAEtD,EAAA,IAAI,CAAC,iBAAiB,IAAA,EAAK;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,mBAAA,EAAqB,QAAQ,2CAAA,EAA4C;AAE3G,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AAEnD,EAAA,IAAI,CAAC,MAAA;AACH,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA,EAAS,qBAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACV;AAEF,EAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,MAAA,CAAO,YAAY,GAAI,CAAA;AACjD,EAAA,MAAM,WAAW,MAAM,gBAAA,CAAiB,MAAA,CAAO,SAAA,EAAW,SAAS,MAAM,CAAA;AACzE,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,KAAA,MAAW,aAAa,MAAA,CAAO,UAAA,YAAsB,kBAAA,CAAmB,QAAA,EAAU,SAAS,CAAA,IAAK,OAAA;AAEhG,EAAA,IAAI,CAAC,OAAA;AACH,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA,EAAS,oBAAA;AAAA,MACT,MAAA,EAAQ,gFAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAEF,EAAA,MAAM,SAAA,GAAA,CAAa,OAAA,CAAQ,SAAA,IAAa,cAAA,CAAe,gBAAA,IAAoB,GAAA;AAC3E,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA,EAAI;AAEpC,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,QAAA,CAAS,OAAA,EAAS,CAAA,GAAI,SAAA;AACvC,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA,EAAS,6BAAA;AAAA,MACT,QAAQ,CAAA,0BAAA,EAA6B,QAAA,CAAS,aAAa,CAAA,YAAA,EAAe,YAAY,GAAI,CAAA,kBAAA,CAAA;AAAA,MAC1F,SAAA,EAAW;AAAA,KACb;AAEF,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,QAAA,EAAS;AAC5C;AAOA,eAAsB,6BAAA,CAA8B,OAAA,EAA8B,MAAA,EAAgB,SAAA,EAA2C;AAC3I,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,UAAU,qBAAqB,CAAA;AAEtD,EAAA,MAAMC,QAAAA,GAAU,KAAK,KAAA,CAAA,CAAO,SAAA,YAAqB,OAAO,SAAA,CAAU,OAAA,EAAQ,GAAI,SAAA,IAAa,GAAI,CAAA;AAC/F,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiBA,QAAAA,EAAS,SAAS,MAAM,CAAA;AAEjE,EAAA,OAAO,CAAA,EAAA,EAAKA,QAAO,CAAA,IAAA,EAAO,CAAC,GAAG,SAAS,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,KAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,CAAA;AACrG;AAOO,SAAS,kBAAkB,OAAA,EAAkD;AAClF,EAAA,MAAM,IAAA,GAAO,OAAO,OAAA,KAAY,QAAA,GAAW,UAAU,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AACrF,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE7B,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,MAAM,IAAI,WAAA,CAAY,4BAA4B,CAAA;AACnH,EAAA,IAAI,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,IAAY,CAAC,MAAM,IAAA,EAAM,MAAM,IAAI,WAAA,CAAY,+BAA+B,CAAA;AAExG,EAAA,OAAO,KAAA;AACT;AAKO,SAAS,qBAAqB,OAAA,EAAiF;AACpH,EAAA,IAAI,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,MAAA,EAAW,OAAO,MAAA;AAEtD,EAAA,IAAI;AACF,IAAA,OAAO,kBAAkB,OAAO,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAKO,SAAS,oBAAA,CACd,UACG,KAAA,EACkC;AACrC,EAAA,OAAQ,KAAA,CAAmB,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA;AAChD;AAGO,IAAM,WAAA,GAAc,CAAC,KAAA,KAC1B,QAAA,CAAgC,KAAA,EAAO,wBAAwB,WAAA,EAAa,uBAAA,CAAwB,WAAA,EAAa,uBAAA,CAAwB,WAAW;AAE/I,IAAM,YAAA,GAAe,CAAC,KAAA,KAC3B,QAAA,CAAiC,OAAO,uBAAA,CAAwB,cAAA,EAAgB,wBAAwB,WAAW;AAE9G,IAAM,uBAAuB,CAAC,KAAA,KAA8B,QAAA,CAAyC,KAAA,EAAO,wBAAwB,aAAa;AAEjJ,IAAM,sBAAsB,CAAC,KAAA,KAA8B,QAAA,CAAwC,KAAA,EAAO,wBAAwB,YAAY;AAE9I,IAAM,qBAAqB,CAAC,KAAA,KAA8B,QAAA,CAAuC,KAAA,EAAO,wBAAwB,WAAW;AAE3I,IAAM,4BAA4B,CAAC,KAAA,KACxC,QAAA,CAA8C,KAAA,EAAO,wBAAwB,kBAAkB;AAE1F,IAAM,oBAAA,GAAuB,CAAC,KAAA,KACnC,QAAA;AAAA,EACE,KAAA;AAAA,EACA,uBAAA,CAAwB,oBAAA;AAAA,EACxB,uBAAA,CAAwB,oBAAA;AAAA,EACxB,uBAAA,CAAwB;AAC1B;AAEK,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,QAAA,CAA0C,OAAO,uBAAA,CAAwB,aAAA,EAAe,wBAAwB,mBAAmB;AAE9H,IAAM,cAAc,CAAC,KAAA,KAA8B,QAAA,CAAgC,KAAA,EAAO,wBAAwB,IAAI;AAE7H,SAAS,QAAA,CAAY,UAA8B,KAAA,EAAgC;AACjF,EAAA,OAAO,KAAA,CAAM,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA,IAAK,KAAA,CAAM,IAAA,KAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,KAAS,MAAA,GAAa,KAAA,CAAM,IAAA,GAAa,MAAA;AAC7G;AAEA,SAAS,qBAAqB,MAAA,EAA6E;AACzG,EAAA,IAAI,SAAA,GAAY,CAAA;AAChB,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,MAAM,aAA2B,EAAC;AAElC,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACnC,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AAEtB,IAAA,IAAI,CAAC,IAAA,EAAM;AAEX,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAElC,IAAA,IAAI,SAAA,IAAa,GAAG,OAAO,MAAA;AAE3B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AAEtC,IAAA,IAAI,QAAQ,GAAA,EAAK;AACf,MAAA,UAAA,EAAA;AAEA,MAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,KAAK,GAAG,OAAO,MAAA;AAEjC,MAAA,SAAA,GAAY,OAAO,KAAK,CAAA;AAAA,IAC1B,CAAA,MAAA,IAAW,QAAQ,IAAA,IAAQ,KAAA,CAAM,WAAW,EAAA,IAAM,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,MAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,KAAA,CAAM,MAAM,KAAK,CAAA,CAAG,GAAA,CAAI,CAAC,SAAS,QAAA,CAAS,IAAA,EAAM,EAAE,CAAC,CAAC,CAAC,CAAA;AAAA,IACxF;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,KAAe,CAAA,IAAK,UAAA,CAAW,MAAA,GAAS,CAAA,IAAK,MAAA,CAAO,aAAA,CAAc,SAAS,CAAA,GAAI,EAAE,SAAA,EAAW,UAAA,EAAW,GAAI,MAAA;AACpH;AAEA,eAAe,gBAAA,CAAiB,SAAA,EAAmB,OAAA,EAA8B,MAAA,EAAqC;AACpH,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,SAAS,CAAA,CAAA,CAAG,CAAA;AAC7C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,GAAI,OAAA;AACrE,EAAA,MAAM,UAAU,IAAI,UAAA,CAAW,MAAA,CAAO,MAAA,GAAS,KAAK,MAAM,CAAA;AAE1D,EAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AACrB,EAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AAE/B,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,QAAQ,MAAA,CAAO,MAAM,GAAG,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AAE3H,EAAA,OAAO,IAAI,WAAW,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAC,CAAA;AACtE;AAEA,SAAS,kBAAA,CAAmB,MAAkB,KAAA,EAA4B;AACxE,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAA;AAEzC,EAAA,IAAI,UAAA,GAAa,CAAA;AAEjB,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,IAAA,CAAK,MAAA,EAAQ,KAAA,EAAA,EAAS,UAAA,IAAc,IAAA,CAAK,KAAK,CAAA,GAAK,KAAA,CAAM,KAAK,CAAA;AAE1F,EAAA,OAAO,UAAA,KAAe,CAAA;AACxB","file":"index.js","sourcesContent":["/**\n * Claim names Authio writes into its tokens.\n */\nexport const AuthioClaimTypes = {\n  Subject: \"sub\",\n  JwtId: \"jti\",\n  Issuer: \"iss\",\n  Audience: \"aud\",\n  Expiration: \"exp\",\n  IssuedAt: \"iat\",\n  NotBefore: \"nbf\",\n  AuthTime: \"auth_time\",\n  TokenType: \"typ\",\n  AuthorizedParty: \"azp\",\n  Scope: \"scope\",\n  SessionId: \"sid\",\n  AuthenticationContextClass: \"acr\",\n  AuthenticationMethods: \"amr\",\n  IdentityProvider: \"idp\",\n  Nonce: \"nonce\",\n  OrganizationId: \"org_id\",\n  OrganizationAlias: \"org_alias\",\n  AccountId: \"account_id\",\n  Actor: \"act\",\n  DelegationId: \"delegation_id\",\n  ClientId: \"client_id\",\n  Name: \"name\",\n  GivenName: \"given_name\",\n  FamilyName: \"family_name\",\n  UniqueName: \"unique_name\",\n  PreferredUsername: \"preferred_username\",\n  UpdatedAt: \"updated_at\",\n  Email: \"email\",\n  EmailVerified: \"email_verified\",\n  PhoneNumber: \"phone_number\",\n  PhoneNumberVerified: \"phone_number_verified\",\n  ConsumerName: \"consumer_name\",\n  CredentialId: \"credential_id\",\n  CredentialType: \"credential_type\",\n  UserResourceAccess: \"user_resource_access\",\n  RealmResourceAccess: \"realm_resource_access\",\n  ClientResourceAccess: \"client_resource_access\",\n  PlanResourceAccess: \"plan_resource_access\",\n  ConsumerResourceAccess: \"consumer_resource_access\",\n  SecretResourceAccess: \"secret_resource_access\",\n  SystemResourceAccess: \"system_resource_access\",\n} as const;\n\n/**\n * Where a role in a `*_resource_access` claim was granted.\n *\n * - `user`: to the person, directly or through one of their groups.\n * - `realm`: to everyone who signs in to the realm.\n * - `client`: to everyone who signs in through the client.\n * - `plan`: by the plan of an Authio platform account (platform users only).\n * - `consumer`: to a machine consumer of the client.\n * - `secret`: to an account credential (API key, client secret, personal access token).\n * - `system`: to an Authio platform user (the console).\n */\nexport type AuthioResourceAccessSource = \"user\" | \"realm\" | \"client\" | \"plan\" | \"consumer\" | \"secret\" | \"system\";\n\n/**\n * The seven `*_resource_access` claim names, mapped to their source.\n */\nexport const AuthioResourceAccessClaims: Readonly<Record<string, AuthioResourceAccessSource>> = Object.freeze({\n  [AuthioClaimTypes.UserResourceAccess]: \"user\",\n  [AuthioClaimTypes.RealmResourceAccess]: \"realm\",\n  [AuthioClaimTypes.ClientResourceAccess]: \"client\",\n  [AuthioClaimTypes.PlanResourceAccess]: \"plan\",\n  [AuthioClaimTypes.ConsumerResourceAccess]: \"consumer\",\n  [AuthioClaimTypes.SecretResourceAccess]: \"secret\",\n  [AuthioClaimTypes.SystemResourceAccess]: \"system\",\n});\n\n/**\n * Scopes Authio defines.\n */\nexport const AuthioScopes = {\n  OpenId: \"openid\",\n  Profile: \"profile\",\n  Email: \"email\",\n  Phone: \"phone\",\n  Roles: \"roles\",\n  OfflineAccess: \"offline_access\",\n} as const;\n\n/**\n * Grant types Authio's token endpoint accepts.\n */\nexport const AuthioGrantTypes = {\n  AuthorizationCode: \"authorization_code\",\n  RefreshToken: \"refresh_token\",\n  ClientCredentials: \"client_credentials\",\n  Password: \"password\",\n  DeviceCode: \"urn:ietf:params:oauth:grant-type:device_code\",\n  TokenExchange: \"urn:ietf:params:oauth:grant-type:token-exchange\",\n  PersonalAccessToken: \"personal_access_token\",\n} as const;\n\n/**\n * Token type identifiers.\n */\nexport const AuthioTokenTypes = {\n  AccessTokenUrn: \"urn:ietf:params:oauth:token-type:access_token\",\n  ConnectionAccessTokenUrn: \"urn:authio:params:oauth:token-type:connection-access-token\",\n  AccessToken: \"access_token\",\n  RefreshToken: \"refresh_token\",\n} as const;\n\n/**\n * OAuth error codes Authio answers with.\n */\nexport const AuthioOAuthErrors = {\n  InvalidRequest: \"invalid_request\",\n  InvalidClient: \"invalid_client\",\n  InvalidGrant: \"invalid_grant\",\n  UnauthorizedClient: \"unauthorized_client\",\n  UnsupportedGrantType: \"unsupported_grant_type\",\n  InvalidScope: \"invalid_scope\",\n  InvalidTarget: \"invalid_target\",\n  AccessDenied: \"access_denied\",\n  InvalidToken: \"invalid_token\",\n  AuthorizationPending: \"authorization_pending\",\n  SlowDown: \"slow_down\",\n  ExpiredToken: \"expired_token\",\n  ConnectionRequired: \"connection_required\",\n  ConnectionSelectionRequired: \"connection_selection_required\",\n  ConnectionPolicyViolation: \"connection_policy_violation\",\n  ServerError: \"server_error\",\n  TemporarilyUnavailable: \"temporarily_unavailable\",\n} as const;\n\n/**\n * Webhook event types.\n */\nexport const AuthioWebhookEventTypes = {\n  UserCreated: \"user_created\",\n  UserUpdated: \"user_updated\",\n  UserDeleted: \"user_deleted\",\n  LoginSucceeded: \"login_succeeded\",\n  LoginFailed: \"login_failed\",\n  UserLockedOut: \"user_locked_out\",\n  TokenRevoked: \"token_revoked\",\n  KeysRotated: \"keys_rotated\",\n  TokenReuseDetected: \"token_reuse_detected\",\n  AdminResourceCreated: \"admin_resource_created\",\n  AdminResourceUpdated: \"admin_resource_updated\",\n  AdminResourceDeleted: \"admin_resource_deleted\",\n  UserSuspended: \"user_suspended\",\n  UserSuspensionEnded: \"user_suspension_ended\",\n  Ping: \"ping\",\n} as const;\n\n/**\n * Headers Authio sends with a webhook delivery.\n */\nexport const AuthioWebhookHeaders = {\n  Signature: \"X-Authio-Signature\",\n  Event: \"X-Authio-Event\",\n  EventId: \"X-Authio-Event-Id\",\n} as const;\n\n/**\n * Asymmetric signing algorithms Authio issues tokens with and accepts in client assertions.\n */\nexport const AuthioAsymmetricAlgorithms = [\n  \"RS256\",\n  \"RS384\",\n  \"RS512\",\n  \"PS256\",\n  \"PS384\",\n  \"PS512\",\n  \"ES256\",\n  \"ES384\",\n  \"ES512\",\n] as const;\n\n/**\n * Defaults shared by every Authio SDK.\n */\nexport const AuthioDefaults = {\n  DiscoveryPath: \"/.well-known/openid-configuration\",\n  RedactedValue: \"[redacted]\",\n  PlatformRealm: \"authio\",\n  PlatformClientId: \"authio\",\n  ApiKeyPrefix: \"ak_\",\n  ClientSecretPrefix: \"cs_\",\n  PersonalAccessTokenPrefix: \"pat_\",\n  /** Seconds. */\n  ClientAssertionLifetime: 120,\n  /** Seconds. */\n  MaxClientAssertionLifetime: 3600,\n  /** Seconds. */\n  DeviceInterval: 5,\n  /** Seconds. */\n  DeviceSlowDownIncrement: 5,\n  /** Seconds a token without `expires_in` is assumed to live. */\n  AssumedTokenLifetime: 300,\n  /** Seconds. */\n  DiscoveryCacheDuration: 3600,\n  /** Seconds. */\n  HttpTimeout: 30,\n  /** Seconds. */\n  TokenRefreshSkew: 60,\n  /** Seconds. */\n  WebhookTolerance: 300,\n  /** Smallest RSA key Authio verifies a client assertion from, in bits. */\n  MinimumRsaKeySize: 2048,\n  CredentialHeaders: [\"authorization\", \"proxy-authorization\", \"x-api-key\", \"cookie\", \"set-cookie\"],\n} as const;\n","/**\n * Base class of every error the Authio SDKs throw on purpose.\n */\nexport class AuthioError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = new.target.name;\n  }\n}\n\n/**\n * An OAuth error Authio answered with, or an answer the SDK could not read.\n *\n * `error` is the OAuth error code; `http_{status}` when the body carried none, and `invalid_response` when a success\n * body could not be read.\n */\nexport class AuthioProtocolError extends AuthioError {\n  /** The OAuth error code. */\n  readonly error: string;\n  /** The OAuth error description. */\n  readonly errorDescription: string | undefined;\n  /** Authio's own error code (`error_code`), more specific than `error`. */\n  readonly errorCode: string | undefined;\n  /** The HTTP status, when the error came from a response. */\n  readonly status: number | undefined;\n\n  constructor(error: string, errorDescription?: string, errorCode?: string, status?: number, options?: { cause?: unknown }) {\n    super(errorDescription ? `${error}: ${errorDescription}` : error, options);\n    this.error = error;\n    this.errorDescription = errorDescription;\n    this.errorCode = errorCode;\n    this.status = status;\n  }\n}\n\n/**\n * The discovery document could not be read, or names another issuer.\n */\nexport class AuthioDiscoveryError extends AuthioError {}\n\n/**\n * The SDK was configured in a way it cannot work with.\n */\nexport class AuthioConfigurationError extends AuthioError {}\n","import { AuthioDefaults } from \"./constants.js\";\nimport { AuthioConfigurationError } from \"./errors.js\";\n\n/**\n * Time as the SDK sees it. Replace it in tests to control expiry, caching and device polling.\n */\nexport interface AuthioClock {\n  /** Milliseconds since the epoch. */\n  now(): number;\n  /** Waits `ms` milliseconds; rejects when the signal aborts. */\n  sleep(ms: number, signal?: AbortSignal): Promise<void>;\n}\n\n/**\n * The real clock.\n */\nexport const systemClock: AuthioClock = {\n  now: () => Date.now(),\n  sleep: (ms, signal) =>\n    new Promise<void>((resolve, reject) => {\n      if (signal?.aborted) {\n        reject(signal.reason);\n        return;\n      }\n      const timer = setTimeout(() => {\n        signal?.removeEventListener(\"abort\", onAbort);\n        resolve();\n      }, ms);\n      const onAbort = () => {\n        clearTimeout(timer);\n        reject(signal?.reason);\n      };\n      signal?.addEventListener(\"abort\", onAbort, { once: true });\n    }),\n};\n\n/**\n * Where Authio is and how to reach it. Shared by the client, the API verifier and the BFF.\n */\nexport interface AuthioConnectionOptions {\n  /**\n   * The realm's issuer, such as `https://auth.example.com/realms/acme`. When absent it is composed from\n   * `authority` and `realm`.\n   */\n  issuer?: string;\n  /** Authio's base URL, such as `https://auth.example.com`. */\n  authority?: string;\n  /** The realm name. */\n  realm?: string;\n  /**\n   * Refuses an `http` issuer or authority unless it is loopback. Defaults to `true`; turn it off only in\n   * development.\n   */\n  requireHttps?: boolean;\n  /** Seconds the discovery document is kept. Defaults to 3600. */\n  discoveryCacheDuration?: number;\n  /** Seconds every HTTP call may take. Defaults to 30. */\n  httpTimeout?: number;\n  /** The `fetch` every call goes through. Defaults to the global one. */\n  fetch?: typeof fetch;\n  /** The clock. Defaults to the system clock. */\n  clock?: AuthioClock;\n}\n\n/**\n * How the client authenticates to the token, introspection, revocation and device endpoints.\n */\nexport type AuthioClientAuthentication = \"client_secret_basic\" | \"client_secret_post\" | \"private_key_jwt\" | \"none\";\n\n/**\n * The connection settings, resolved once.\n */\nexport interface AuthioConnection {\n  readonly issuer: string;\n  readonly discoveryUrl: string;\n  readonly requireHttps: boolean;\n  readonly discoveryCacheDurationMs: number;\n  readonly httpTimeoutMs: number;\n  readonly fetch: typeof fetch;\n  readonly clock: AuthioClock;\n}\n\n/**\n * Resolves and validates the connection settings.\n *\n * @throws AuthioConfigurationError when the issuer cannot be composed or is not HTTPS.\n */\nexport function resolveConnection(options: AuthioConnectionOptions): AuthioConnection {\n  const requireHttps = options.requireHttps ?? true;\n  const issuer = resolveIssuer(options);\n\n  for (const [name, value] of [\n    [\"authority\", options.authority],\n    [\"issuer\", issuer],\n  ] as const) {\n    if (value && !isAllowedUrl(value, requireHttps))\n      throw new AuthioConfigurationError(\n        `The Authio ${name} '${value}' must be an absolute HTTPS URL (http is allowed only for loopback, or with requireHttps: false).`,\n      );\n  }\n\n  const fetchImplementation = options.fetch ?? globalThis.fetch;\n\n  if (typeof fetchImplementation !== \"function\")\n    throw new AuthioConfigurationError(\"No fetch implementation is available: pass options.fetch.\");\n\n  return {\n    issuer,\n    discoveryUrl: issuer + AuthioDefaults.DiscoveryPath,\n    requireHttps,\n    discoveryCacheDurationMs: seconds(options.discoveryCacheDuration, AuthioDefaults.DiscoveryCacheDuration, \"discoveryCacheDuration\"),\n    httpTimeoutMs: seconds(options.httpTimeout, AuthioDefaults.HttpTimeout, \"httpTimeout\"),\n    fetch: fetchImplementation,\n    clock: options.clock ?? systemClock,\n  };\n}\n\n/**\n * The issuer: `issuer` when set, else `{authority}/realms/{realm}`.\n *\n * @throws AuthioConfigurationError when neither is configured.\n */\nexport function resolveIssuer(options: Pick<AuthioConnectionOptions, \"issuer\" | \"authority\" | \"realm\">): string {\n  const issuer = options.issuer?.trim();\n\n  if (issuer) return trimTrailingSlashes(issuer);\n\n  const authority = options.authority?.trim();\n  const realm = options.realm?.trim();\n\n  if (!authority || !realm)\n    throw new AuthioConfigurationError(\n      \"The Authio issuer is not set, and authority and realm are not both set to compose it.\",\n    );\n\n  return `${trimTrailingSlashes(authority)}/realms/${escapeDataString(realm)}`;\n}\n\n/**\n * Whether a URL may be used to reach Authio: HTTPS, or HTTP on loopback (or anywhere when HTTPS is not required).\n */\nexport function isAllowedUrl(value: string, requireHttps: boolean): boolean {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n\n  if (url.protocol === \"https:\") return true;\n\n  return url.protocol === \"http:\" && (!requireHttps || isLoopback(url.hostname));\n}\n\n/**\n * Percent-encodes everything but RFC 3986 unreserved characters, as .NET's `Uri.EscapeDataString` does.\n */\nexport function escapeDataString(value: string): string {\n  return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);\n}\n\n/**\n * Converts optional seconds to milliseconds, refusing negative or non-finite values.\n *\n * @internal\n */\nexport function seconds(value: number | undefined, fallback: number, name: string): number {\n  const resolved = value ?? fallback;\n\n  if (!Number.isFinite(resolved) || resolved < 0)\n    throw new AuthioConfigurationError(`The Authio option ${name} must be a non-negative number of seconds.`);\n\n  return resolved * 1000;\n}\n\nfunction trimTrailingSlashes(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction isLoopback(hostname: string): boolean {\n  const host = hostname.replace(/^\\[|\\]$/g, \"\").toLowerCase();\n\n  return host === \"localhost\" || host === \"::1\" || /^127(\\.\\d{1,3}){3}$/.test(host);\n}\n","import { AuthioDefaults } from \"./constants.js\";\nimport { AuthioProtocolError } from \"./errors.js\";\nimport type { AuthioConnection } from \"./options.js\";\n\n/**\n * The OAuth error body Authio answers with.\n */\nexport interface AuthioErrorResponse {\n  error?: string;\n  error_description?: string;\n  error_code?: string;\n  connect_uri?: string;\n  connection_provider?: string;\n  connections?: { id: string; label?: string; external_login?: string }[];\n  [member: string]: unknown;\n}\n\n/**\n * Sends a request through the configured `fetch`, bounded by the HTTP timeout and the caller's signal.\n *\n * @internal\n */\nexport function send(connection: AuthioConnection, url: string, init: RequestInit, signal?: AbortSignal): Promise<Response> {\n  const timeout = AbortSignal.timeout(connection.httpTimeoutMs);\n\n  return connection.fetch(url, { ...init, signal: signal ? AbortSignal.any([signal, timeout]) : timeout });\n}\n\n/**\n * Builds an `application/x-www-form-urlencoded` body, skipping empty values.\n *\n * @internal\n */\nexport function formBody(parameters: Record<string, string | undefined | null>): URLSearchParams {\n  const form = new URLSearchParams();\n\n  for (const [name, value] of Object.entries(parameters)) {\n    if (value !== undefined && value !== null && value !== \"\") form.append(name, value);\n  }\n\n  return form;\n}\n\n/**\n * Joins scopes into one space-separated value, splitting values that already hold several and dropping duplicates.\n *\n * @returns `undefined` when there is no scope.\n */\nexport function toScopeString(scopes: Iterable<string> | string | undefined | null): string | undefined {\n  if (scopes === undefined || scopes === null) return undefined;\n\n  const values = typeof scopes === \"string\" ? [scopes] : [...scopes];\n  const distinct = [...new Set(values.flatMap((scope) => (scope ?? \"\").split(\" \").filter(Boolean)))];\n\n  return distinct.length === 0 ? undefined : distinct.join(\" \");\n}\n\n/**\n * Reads a JSON success body, or throws the OAuth error the response carries.\n *\n * @internal\n */\nexport async function readProtocolJson<T>(response: Response): Promise<T> {\n  const body = await response.text();\n\n  if (!response.ok) throw toProtocolError(body, response.status);\n\n  return parseProtocolJson<T>(body, response.status);\n}\n\n/**\n * Throws the OAuth error a failed response carries.\n *\n * @internal\n */\nexport async function ensureProtocolSuccess(response: Response): Promise<void> {\n  if (response.ok) return;\n\n  throw toProtocolError(await response.text(), response.status);\n}\n\n/**\n * Parses a success body.\n *\n * @internal\n */\nexport function parseProtocolJson<T>(body: string, status: number): T {\n  try {\n    const value = JSON.parse(body) as unknown;\n\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) throw new SyntaxError(\"The body is not a JSON object.\");\n\n    return value as T;\n  } catch (error) {\n    throw new AuthioProtocolError(\n      \"invalid_response\",\n      `Authio answered with a body that could not be read: ${(error as Error).message}`,\n      undefined,\n      status,\n      { cause: error },\n    );\n  }\n}\n\n/**\n * Reads the OAuth error of a body, when it has one.\n *\n * @internal\n */\nexport function toErrorResponse(body: string | undefined): AuthioErrorResponse | undefined {\n  if (!body?.trim()) return undefined;\n\n  try {\n    const value = JSON.parse(body) as AuthioErrorResponse;\n\n    return value && typeof value === \"object\" && typeof value.error === \"string\" && value.error ? value : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * The error a failed response stands for.\n *\n * @internal\n */\nexport function toProtocolError(body: string | undefined, status: number): AuthioProtocolError {\n  const error = toErrorResponse(body);\n\n  return error\n    ? new AuthioProtocolError(error.error!, error.error_description, error.error_code, status)\n    : new AuthioProtocolError(`http_${status}`, `Authio answered HTTP ${status} without an OAuth error.`, undefined, status);\n}\n\n/**\n * Makes `console.log` and `util.inspect` print `[redacted]` in place of the named members, without changing what\n * `JSON.stringify` or a spread sees.\n *\n * @internal\n */\nexport function redact<T extends object>(value: T, secrets: readonly string[]): T {\n  Object.defineProperty(value, Symbol.for(\"nodejs.util.inspect.custom\"), {\n    enumerable: false,\n    value(this: Record<string, unknown>) {\n      const copy: Record<string, unknown> = {};\n\n      for (const [name, member] of Object.entries(this))\n        copy[name] = secrets.includes(name) && member !== undefined && member !== null ? AuthioDefaults.RedactedValue : member;\n\n      return copy;\n    },\n  });\n\n  return value;\n}\n","import { AuthioDiscoveryError } from \"./errors.js\";\nimport { send } from \"./http.js\";\nimport { resolveConnection, type AuthioConnection, type AuthioConnectionOptions } from \"./options.js\";\n\n/**\n * The realm's OpenID Connect discovery document. Members not listed are kept as sent.\n */\nexport interface AuthioDiscoveryDocument {\n  issuer: string;\n  authorization_endpoint?: string;\n  token_endpoint?: string;\n  userinfo_endpoint?: string;\n  jwks_uri?: string;\n  introspection_endpoint?: string;\n  revocation_endpoint?: string;\n  end_session_endpoint?: string;\n  device_authorization_endpoint?: string;\n  pushed_authorization_request_endpoint?: string;\n  scopes_supported?: string[];\n  response_types_supported?: string[];\n  response_modes_supported?: string[];\n  grant_types_supported?: string[];\n  subject_types_supported?: string[];\n  id_token_signing_alg_values_supported?: string[];\n  token_endpoint_auth_methods_supported?: string[];\n  token_endpoint_auth_signing_alg_values_supported?: string[];\n  introspection_endpoint_auth_methods_supported?: string[];\n  revocation_endpoint_auth_methods_supported?: string[];\n  code_challenge_methods_supported?: string[];\n  claims_supported?: string[];\n  prompt_values_supported?: string[];\n  authorization_response_iss_parameter_supported?: boolean;\n  [member: string]: unknown;\n}\n\n/**\n * Reads and caches the discovery document.\n */\nexport interface AuthioDiscoveryClient {\n  /** The connection settings the client was built with. */\n  readonly connection: AuthioConnection;\n  /**\n   * The document, read at most once per cache period (concurrent callers share one read).\n   *\n   * @throws AuthioDiscoveryError when it cannot be read or names another issuer.\n   */\n  get(signal?: AbortSignal): Promise<AuthioDiscoveryDocument>;\n  /** Drops the cached document, so the next `get` reads it again. */\n  invalidate(): void;\n}\n\n/**\n * Creates a discovery client. It needs no client credentials, so an API that only validates tokens can use it.\n */\nexport function createAuthioDiscoveryClient(options: AuthioConnectionOptions | AuthioConnection): AuthioDiscoveryClient {\n  const connection = isConnection(options) ? options : resolveConnection(options);\n  let cached: { document: AuthioDiscoveryDocument; fetchedAt: number } | undefined;\n  let pending: Promise<AuthioDiscoveryDocument> | undefined;\n\n  const fresh = () =>\n    cached && connection.clock.now() - cached.fetchedAt < connection.discoveryCacheDurationMs ? cached.document : undefined;\n\n  return {\n    connection,\n    async get(signal) {\n      const current = fresh();\n\n      if (current) return current;\n\n      pending ??= fetchDocument(connection, signal)\n        .then((document) => {\n          cached = { document, fetchedAt: connection.clock.now() };\n          return document;\n        })\n        .finally(() => {\n          pending = undefined;\n        });\n\n      return pending;\n    },\n    invalidate() {\n      cached = undefined;\n    },\n  };\n}\n\n/**\n * The endpoint the document names, or an error saying which one is missing.\n *\n * @internal\n */\nexport function requireEndpoint(document: AuthioDiscoveryDocument, member: keyof AuthioDiscoveryDocument & string): string {\n  const value = document[member];\n\n  if (typeof value !== \"string\" || !value)\n    throw new AuthioDiscoveryError(`The Authio discovery document has no ${member}.`);\n\n  return value;\n}\n\nasync function fetchDocument(connection: AuthioConnection, signal?: AbortSignal): Promise<AuthioDiscoveryDocument> {\n  const url = connection.discoveryUrl;\n  let body: string;\n\n  try {\n    const response = await send(connection, url, { method: \"GET\", headers: { accept: \"application/json\" } }, signal);\n\n    body = await response.text();\n\n    if (!response.ok) throw new AuthioDiscoveryError(`Authio answered HTTP ${response.status} for the discovery document at ${url}.`);\n  } catch (error) {\n    if (error instanceof AuthioDiscoveryError) throw error;\n    if (signal?.aborted) throw error;\n\n    const timedOut = (error as Error)?.name === \"TimeoutError\";\n\n    throw new AuthioDiscoveryError(\n      timedOut\n        ? `Reading the Authio discovery document at ${url} timed out.`\n        : `The Authio discovery document at ${url} could not be read.`,\n      { cause: error },\n    );\n  }\n\n  let document: AuthioDiscoveryDocument;\n\n  try {\n    document = JSON.parse(body) as AuthioDiscoveryDocument;\n  } catch (error) {\n    throw new AuthioDiscoveryError(`The Authio discovery document at ${url} is not valid JSON.`, { cause: error });\n  }\n\n  if (!document || typeof document !== \"object\" || typeof document.issuer !== \"string\" || !document.issuer.trim())\n    throw new AuthioDiscoveryError(`The Authio discovery document at ${url} has no issuer.`);\n\n  if (document.issuer.replace(/\\/+$/, \"\") !== connection.issuer)\n    throw new AuthioDiscoveryError(\n      `The Authio discovery document names the issuer '${document.issuer}', not the configured '${connection.issuer}'.`,\n    );\n\n  return document;\n}\n\nfunction isConnection(value: AuthioConnectionOptions | AuthioConnection): value is AuthioConnection {\n  return typeof (value as AuthioConnection).discoveryUrl === \"string\" && typeof (value as AuthioConnection).httpTimeoutMs === \"number\";\n}\n","import { importJWK, importPKCS8, type CryptoKey, type JWK } from \"jose\";\nimport { AuthioAsymmetricAlgorithms, AuthioDefaults } from \"./constants.js\";\nimport { AuthioConfigurationError } from \"./errors.js\";\n\n/**\n * A private key as the SDK accepts it: PEM text (PKCS#8, PKCS#1 RSA or SEC1 EC; PKCS#1 and SEC1 need Node), a JWK\n * (object or JSON text), or a `CryptoKey`.\n */\nexport type AuthioPrivateKeyInput = string | JWK | CryptoKey;\n\n/**\n * A key ready to sign with, and the algorithm it signs with.\n */\nexport interface AuthioSigningKey {\n  readonly key: CryptoKey | Uint8Array;\n  readonly algorithm: string;\n  readonly keyId: string | undefined;\n}\n\nconst curveAlgorithms: Record<string, string> = { \"P-256\": \"ES256\", \"P-384\": \"ES384\", \"P-521\": \"ES512\" };\n\n/**\n * Imports a signing key and settles its algorithm: the configured one when it suits the key, else RS256 for RSA and\n * the curve's ES algorithm for EC.\n *\n * @param input The key.\n * @param algorithm The configured algorithm, if any.\n * @param keyId The `kid` to send.\n * @param source The setting the key came from, named in errors.\n * @throws AuthioConfigurationError when the key cannot be read, is too weak, or does not suit the algorithm.\n */\nexport async function importSigningKey(\n  input: AuthioPrivateKeyInput,\n  algorithm: string | undefined,\n  keyId: string | undefined,\n  source: string,\n): Promise<AuthioSigningKey> {\n  if (typeof input === \"string\") {\n    const text = input.trim();\n\n    if (text.startsWith(\"{\")) return importSigningKey(parseJwk(text, source), algorithm, keyId, source);\n\n    return importPem(text, algorithm, keyId, source);\n  }\n\n  if (isCryptoKey(input)) {\n    const shape = describeCryptoKey(input, source);\n\n    return { key: input, algorithm: settleAlgorithm(shape, algorithm, source), keyId };\n  }\n\n  return importFromJwk(input, algorithm, keyId ?? (typeof input.kid === \"string\" ? input.kid : undefined), source);\n}\n\n/**\n * The algorithms a client assertion may be signed with.\n */\nexport const AuthioClientAssertionAlgorithms = AuthioAsymmetricAlgorithms;\n\ninterface KeyShape {\n  readonly type: \"RSA\" | \"EC\";\n  readonly curve?: string;\n  readonly fixedAlgorithm?: string;\n}\n\nasync function importPem(pem: string, algorithm: string | undefined, keyId: string | undefined, source: string): Promise<AuthioSigningKey> {\n  const nodeCrypto = await loadNodeCrypto();\n\n  if (nodeCrypto) {\n    let keyObject: import(\"node:crypto\").KeyObject;\n\n    try {\n      keyObject = nodeCrypto.createPrivateKey({ key: pem, format: \"pem\" });\n    } catch (error) {\n      throw new AuthioConfigurationError(`${source} could not be read as an RSA or EC private key.`, { cause: error });\n    }\n\n    const jwk = keyObject.export({ format: \"jwk\" }) as JWK;\n\n    return importFromJwk(jwk, algorithm, keyId, source);\n  }\n\n  if (!pem.includes(\"-----BEGIN PRIVATE KEY-----\"))\n    throw new AuthioConfigurationError(\n      `${source} must be a PKCS#8 PEM (\"BEGIN PRIVATE KEY\") or a JWK outside Node; PKCS#1 and SEC1 keys need Node.`,\n    );\n\n  const chosen = algorithm?.trim() || \"RS256\";\n\n  try {\n    return { key: await importPKCS8(pem, chosen), algorithm: chosen, keyId };\n  } catch (error) {\n    throw new AuthioConfigurationError(`${source} could not be imported for ${chosen}.`, { cause: error });\n  }\n}\n\nasync function importFromJwk(jwk: JWK, algorithm: string | undefined, keyId: string | undefined, source: string): Promise<AuthioSigningKey> {\n  if (!jwk.d) throw new AuthioConfigurationError(`${source} is a public key; Authio needs the private key to sign.`);\n\n  const shape = describeJwk(jwk, source);\n  const chosen = settleAlgorithm(shape, algorithm ?? (typeof jwk.alg === \"string\" ? jwk.alg : undefined), source);\n\n  try {\n    const key = await importJWK({ ...jwk, alg: chosen }, chosen);\n\n    return { key, algorithm: chosen, keyId };\n  } catch (error) {\n    throw new AuthioConfigurationError(`${source} could not be imported for ${chosen}.`, { cause: error });\n  }\n}\n\nfunction describeJwk(jwk: JWK, source: string): KeyShape {\n  if (jwk.kty === \"RSA\") {\n    const bits = base64UrlLength(jwk.n ?? \"\") * 8;\n\n    if (bits < AuthioDefaults.MinimumRsaKeySize)\n      throw new AuthioConfigurationError(`${source} is a ${bits}-bit RSA key; use at least ${AuthioDefaults.MinimumRsaKeySize} bits.`);\n\n    return { type: \"RSA\" };\n  }\n\n  if (jwk.kty === \"EC\") {\n    if (!jwk.crv || !curveAlgorithms[jwk.crv])\n      throw new AuthioConfigurationError(`${source} is an EC key on a curve Authio does not accept; use P-256, P-384 or P-521.`);\n\n    return { type: \"EC\", curve: jwk.crv };\n  }\n\n  throw new AuthioConfigurationError(`${source} could not be read as an RSA or EC private key.`);\n}\n\nfunction describeCryptoKey(key: CryptoKey, source: string): KeyShape {\n  const algorithm = key.algorithm as { name: string; namedCurve?: string; modulusLength?: number; hash?: { name: string } };\n\n  if (algorithm.name === \"ECDSA\" && algorithm.namedCurve && curveAlgorithms[algorithm.namedCurve])\n    return { type: \"EC\", curve: algorithm.namedCurve };\n\n  if (algorithm.name === \"RSASSA-PKCS1-v1_5\" || algorithm.name === \"RSA-PSS\") {\n    if ((algorithm.modulusLength ?? 0) < AuthioDefaults.MinimumRsaKeySize)\n      throw new AuthioConfigurationError(\n        `${source} is a ${algorithm.modulusLength}-bit RSA key; use at least ${AuthioDefaults.MinimumRsaKeySize} bits.`,\n      );\n\n    const size = algorithm.hash?.name.replace(\"SHA-\", \"\") ?? \"256\";\n\n    return { type: \"RSA\", fixedAlgorithm: `${algorithm.name === \"RSA-PSS\" ? \"PS\" : \"RS\"}${size}` };\n  }\n\n  throw new AuthioConfigurationError(`${source} is a CryptoKey Authio cannot sign assertions with; use an RSA or EC signing key.`);\n}\n\nfunction settleAlgorithm(shape: KeyShape, configured: string | undefined, source: string): string {\n  const suited =\n    shape.fixedAlgorithm !== undefined\n      ? [shape.fixedAlgorithm]\n      : shape.type === \"EC\"\n        ? [curveAlgorithms[shape.curve!]!]\n        : AuthioAsymmetricAlgorithms.filter((name) => name.startsWith(\"RS\") || name.startsWith(\"PS\"));\n\n  const chosen = configured?.trim() || suited[0]!;\n\n  if (!suited.includes(chosen))\n    throw new AuthioConfigurationError(\n      `The signing algorithm '${chosen}' does not suit the key in ${source}; use one of: ${suited.join(\", \")}.`,\n    );\n\n  return chosen;\n}\n\nfunction parseJwk(text: string, source: string): JWK {\n  try {\n    const parsed = JSON.parse(text) as JWK & { keys?: JWK[] };\n\n    if (Array.isArray(parsed.keys)) {\n      if (parsed.keys.length !== 1) throw new Error(\"A JWK Set must hold exactly one key.\");\n      return parsed.keys[0]!;\n    }\n\n    return parsed;\n  } catch (error) {\n    throw new AuthioConfigurationError(`${source} is not a valid JWK.`, { cause: error });\n  }\n}\n\nfunction base64UrlLength(value: string): number {\n  const clean = value.replace(/=+$/, \"\");\n  return Math.floor((clean.length * 3) / 4);\n}\n\nfunction isCryptoKey(value: unknown): value is CryptoKey {\n  return typeof value === \"object\" && value !== null && \"algorithm\" in value && \"type\" in value && \"usages\" in value;\n}\n\nlet nodeCryptoModule: Promise<typeof import(\"node:crypto\") | undefined> | undefined;\n\n/**\n * Node's crypto module, or `undefined` outside Node.\n *\n * @internal\n */\nexport function loadNodeCrypto(): Promise<typeof import(\"node:crypto\") | undefined> {\n  nodeCryptoModule ??= (globalThis as { process?: { versions?: { node?: string } } }).process?.versions?.node\n    ? import(\"node:crypto\").catch(() => undefined)\n    : Promise.resolve(undefined);\n\n  return nodeCryptoModule;\n}\n\n","import { SignJWT } from \"jose\";\nimport { AuthioDefaults } from \"./constants.js\";\nimport { AuthioConfigurationError } from \"./errors.js\";\nimport { importSigningKey, loadNodeCrypto, type AuthioPrivateKeyInput, type AuthioSigningKey } from \"./keys.js\";\nimport { escapeDataString, seconds, type AuthioClientAuthentication, type AuthioConnection } from \"./options.js\";\n\n/**\n * How the client proves who it is.\n */\nexport interface AuthioClientCredentialsSettings {\n  /** The client id. */\n  clientId: string;\n  /** The client secret, for `client_secret_basic` and `client_secret_post`. */\n  clientSecret?: string;\n  /**\n   * Defaults to `private_key_jwt` when only a private key is configured, else `client_secret_basic`. A public client\n   * sets `none`.\n   */\n  clientAuthentication?: AuthioClientAuthentication;\n  /** The private key for `private_key_jwt`. */\n  clientPrivateKey?: AuthioPrivateKeyInput;\n  /** A PEM file holding the private key for `private_key_jwt` (Node only); re-read when it changes. */\n  clientPrivateKeyPath?: string;\n  /** The `kid` of the key, as registered in Authio. */\n  clientKeyId?: string;\n  /** The assertion's signing algorithm. Defaults to RS256 for RSA keys and the curve's ES algorithm for EC keys. */\n  clientSigningAlgorithm?: string;\n  /** Seconds a client assertion lives. Defaults to 120, at most 3600. */\n  clientAssertionLifetime?: number;\n}\n\n/**\n * Adds the client's credentials to a request to a protocol endpoint.\n *\n * @internal\n */\nexport interface AuthioClientAuthenticator {\n  readonly clientId: string;\n  readonly method: AuthioClientAuthentication;\n  apply(form: URLSearchParams, headers: Headers): Promise<void>;\n}\n\n/**\n * Builds the HTTP Basic value for a client id and secret, escaping both first as RFC 6749 §2.3.1 asks.\n */\nexport function toBasicAuthorization(clientId: string, clientSecret: string): string {\n  const bytes = new TextEncoder().encode(`${escapeDataString(clientId)}:${escapeDataString(clientSecret)}`);\n  let binary = \"\";\n\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n\n  return `Basic ${btoa(binary)}`;\n}\n\n/**\n * Validates the credential settings and returns the authenticator.\n *\n * @throws AuthioConfigurationError when a setting the method needs is missing.\n * @internal\n */\nexport function createClientAuthenticator(settings: AuthioClientCredentialsSettings, connection: AuthioConnection): AuthioClientAuthenticator {\n  const clientId = settings.clientId?.trim();\n\n  if (!clientId) throw new AuthioConfigurationError(\"The Authio clientId is required.\");\n\n  const hasKey = settings.clientPrivateKey !== undefined || !!settings.clientPrivateKeyPath;\n  const method: AuthioClientAuthentication =\n    settings.clientAuthentication ?? (!settings.clientSecret && hasKey ? \"private_key_jwt\" : \"client_secret_basic\");\n\n  if ((method === \"client_secret_basic\" || method === \"client_secret_post\") && !settings.clientSecret)\n    throw new AuthioConfigurationError(`The Authio clientSecret is required with ${method}.`);\n\n  if (method === \"private_key_jwt\" && !hasKey)\n    throw new AuthioConfigurationError(\"private_key_jwt needs clientPrivateKey or clientPrivateKeyPath.\");\n\n  const lifetimeMs = seconds(settings.clientAssertionLifetime, AuthioDefaults.ClientAssertionLifetime, \"clientAssertionLifetime\");\n\n  if (lifetimeMs <= 0 || lifetimeMs > AuthioDefaults.MaxClientAssertionLifetime * 1000)\n    throw new AuthioConfigurationError(\n      `The Authio clientAssertionLifetime must be more than 0 and at most ${AuthioDefaults.MaxClientAssertionLifetime} seconds.`,\n    );\n\n  const loadKey = method === \"private_key_jwt\" ? createKeyLoader(settings) : undefined;\n\n  return {\n    clientId,\n    method,\n    async apply(form, headers) {\n      switch (method) {\n        case \"client_secret_basic\":\n          headers.set(\"authorization\", toBasicAuthorization(clientId, settings.clientSecret!));\n          return;\n        case \"client_secret_post\":\n          form.set(\"client_id\", clientId);\n          form.set(\"client_secret\", settings.clientSecret!);\n          return;\n        case \"private_key_jwt\":\n          form.set(\"client_id\", clientId);\n          form.set(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n          form.set(\"client_assertion\", await buildAssertion(clientId, connection, lifetimeMs, await loadKey!()));\n          return;\n        default:\n          form.set(\"client_id\", clientId);\n      }\n    },\n  };\n}\n\n/**\n * Signs a client assertion: `iss` = `sub` = the client id, `aud` = the issuer, `iat` = `nbf` = now,\n * `exp` = now + lifetime, a 128-bit random `jti`.\n *\n * @internal\n */\nexport async function buildAssertion(clientId: string, connection: AuthioConnection, lifetimeMs: number, signing: AuthioSigningKey): Promise<string> {\n  const now = Math.floor(connection.clock.now() / 1000);\n  const jti = [...crypto.getRandomValues(new Uint8Array(16))].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\n  return new SignJWT({ jti })\n    .setProtectedHeader({ alg: signing.algorithm, typ: \"JWT\", ...(signing.keyId ? { kid: signing.keyId } : {}) })\n    .setIssuer(clientId)\n    .setSubject(clientId)\n    .setAudience(connection.issuer)\n    .setIssuedAt(now)\n    .setNotBefore(now)\n    .setExpirationTime(now + Math.floor(lifetimeMs / 1000))\n    .sign(signing.key);\n}\n\nfunction createKeyLoader(settings: AuthioClientCredentialsSettings): () => Promise<AuthioSigningKey> {\n  if (settings.clientPrivateKey !== undefined) {\n    let loaded: Promise<AuthioSigningKey> | undefined;\n\n    return () => {\n      loaded ??= importSigningKey(settings.clientPrivateKey!, settings.clientSigningAlgorithm, settings.clientKeyId, \"clientPrivateKey\");\n      loaded.catch(() => {\n        loaded = undefined;\n      });\n      return loaded;\n    };\n  }\n\n  const path = settings.clientPrivateKeyPath!;\n  let current: { written: number; key: Promise<AuthioSigningKey> } | undefined;\n\n  return async () => {\n    const nodeCrypto = await loadNodeCrypto();\n\n    if (!nodeCrypto) throw new AuthioConfigurationError(\"clientPrivateKeyPath needs Node; pass clientPrivateKey instead.\");\n\n    const { readFile, stat } = await import(\"node:fs/promises\");\n    let written: number;\n\n    try {\n      written = (await stat(path)).mtimeMs;\n    } catch (error) {\n      throw new AuthioConfigurationError(`clientPrivateKeyPath '${path}' could not be read.`, { cause: error });\n    }\n\n    if (!current || current.written !== written) {\n      const key = readFile(path, \"utf8\").then((pem) =>\n        importSigningKey(pem, settings.clientSigningAlgorithm, settings.clientKeyId, `clientPrivateKeyPath '${path}'`),\n      );\n\n      current = { written, key };\n      key.catch(() => {\n        if (current?.key === key) current = undefined;\n      });\n    }\n\n    return current.key;\n  };\n}\n","import { compactDecrypt, importJWK, importPKCS8, type CryptoKey, type JWK } from \"jose\";\nimport { AuthioConfigurationError, AuthioError } from \"./errors.js\";\n\n/**\n * The client's own encryption key, the pair Authio encrypts the client's tokens and UserInfo to: the private JWK\n * Authio hands over when it generates the pair (object or JSON text), or a PEM private key (PKCS#8 or PKCS#1 RSA).\n */\nexport type AuthioEncryptionKey = string | JWK;\n\n/**\n * Opens a compact JWE and returns its plaintext; a token that is not a JWE comes back unchanged.\n */\nexport type AuthioTokenDecrypter = (token: string) => Promise<string>;\n\n/**\n * The key management algorithms Authio encrypts with.\n */\nexport const AuthioKeyManagementAlgorithms = [\"RSA-OAEP\", \"RSA-OAEP-256\"] as const;\n\n/**\n * The content encryption algorithms Authio encrypts with.\n */\nexport const AuthioContentEncryptionAlgorithms = [\"A128CBC-HS256\", \"A192CBC-HS384\", \"A256CBC-HS512\"] as const;\n\nconst rsaAlgorithmIdentifier = [0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00];\n\n/**\n * Whether a value is a compact JWE (five segments).\n */\nexport function isAuthioTokenEncrypted(token: unknown): token is string {\n  return typeof token === \"string\" && token.split(\".\").length === 5;\n}\n\n/**\n * Creates a decrypter for the client's own encryption key. Keys are imported once per algorithm.\n *\n * @param key The key, or `undefined` when none is configured: an encrypted token then throws.\n * @param setting The setting the key came from, named in errors.\n */\nexport function createAuthioTokenDecrypter(key: AuthioEncryptionKey | undefined, setting = \"clientEncryptionKey\"): AuthioTokenDecrypter {\n  const imported = new Map<string, Promise<CryptoKey | Uint8Array>>();\n\n  const importFor = (algorithm: string) => {\n    let pending = imported.get(algorithm);\n\n    if (!pending) {\n      pending = importDecryptionKey(key!, algorithm, setting);\n      imported.set(algorithm, pending);\n      pending.catch(() => imported.delete(algorithm));\n    }\n\n    return pending;\n  };\n\n  return async (token) => {\n    if (!isAuthioTokenEncrypted(token)) return token;\n\n    if (!key)\n      throw new AuthioError(\n        `Authio encrypted this token to the client's own key; set ${setting} to the private key Authio showed when it generated the pair.`,\n      );\n\n    const { plaintext } = await compactDecrypt(token, (header) => importFor(header.alg), {\n      keyManagementAlgorithms: [...AuthioKeyManagementAlgorithms],\n      contentEncryptionAlgorithms: [...AuthioContentEncryptionAlgorithms],\n    });\n\n    return new TextDecoder().decode(plaintext);\n  };\n}\n\nasync function importDecryptionKey(key: AuthioEncryptionKey, algorithm: string, setting: string): Promise<CryptoKey | Uint8Array> {\n  try {\n    if (typeof key !== \"string\") return await importPrivateJwk(key, algorithm, setting);\n\n    const text = key.trim();\n\n    return text.startsWith(\"{\")\n      ? await importPrivateJwk(JSON.parse(text) as JWK, algorithm, setting)\n      : await importPKCS8(toPkcs8(text), algorithm);\n  } catch (error) {\n    if (error instanceof AuthioConfigurationError) throw error;\n    throw new AuthioConfigurationError(`${setting} is neither a private JWK nor a PEM private key.`, { cause: error });\n  }\n}\n\nfunction importPrivateJwk(jwk: JWK, algorithm: string, setting: string): Promise<CryptoKey | Uint8Array> {\n  if (!jwk.d) throw new AuthioConfigurationError(`${setting} is a JWK without its private parameters; only the private key decrypts.`);\n\n  return importJWK({ ...jwk, alg: algorithm, use: \"enc\", key_ops: undefined }, algorithm);\n}\n\nfunction toPkcs8(pem: string): string {\n  const normalized = pem.replace(/\\\\n/g, \"\\n\").trim();\n\n  if (!normalized.includes(\"BEGIN RSA PRIVATE KEY\")) return normalized;\n\n  const pkcs1 = fromBase64(normalized.replace(/-----[^-]+-----|\\s/g, \"\"));\n  const body = [0x02, 0x01, 0x00, ...rsaAlgorithmIdentifier, 0x04, ...derLength(pkcs1.length), ...pkcs1];\n  const der = Uint8Array.from([0x30, ...derLength(body.length), ...body]);\n  const lines = toBase64(der).match(/.{1,64}/g) ?? [];\n\n  return `-----BEGIN PRIVATE KEY-----\\n${lines.join(\"\\n\")}\\n-----END PRIVATE KEY-----`;\n}\n\nfunction derLength(length: number): number[] {\n  if (length < 0x80) return [length];\n\n  const bytes: number[] = [];\n\n  for (let rest = length; rest > 0; rest >>= 8) bytes.unshift(rest & 0xff);\n\n  return [0x80 | bytes.length, ...bytes];\n}\n\nfunction fromBase64(text: string): Uint8Array {\n  return Uint8Array.from(atob(text), (character) => character.charCodeAt(0));\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n\n  return btoa(binary);\n}\n","import { createRemoteJWKSet, customFetch, jwtVerify } from \"jose\";\nimport { createClientAuthenticator, type AuthioClientAuthenticator, type AuthioClientCredentialsSettings } from \"./client-authentication.js\";\nimport { AuthioDefaults, AuthioGrantTypes, AuthioOAuthErrors, AuthioTokenTypes } from \"./constants.js\";\nimport { createAuthioDiscoveryClient, requireEndpoint, type AuthioDiscoveryClient, type AuthioDiscoveryDocument } from \"./discovery.js\";\nimport { createAuthioTokenDecrypter, isAuthioTokenEncrypted, type AuthioEncryptionKey } from \"./encryption.js\";\nimport { AuthioProtocolError } from \"./errors.js\";\nimport {\n  ensureProtocolSuccess,\n  formBody,\n  parseProtocolJson,\n  readProtocolJson,\n  redact,\n  send,\n  toErrorResponse,\n  toProtocolError,\n  toScopeString,\n} from \"./http.js\";\nimport type {\n  AuthioClientCredentialsToken,\n  AuthioConnectionExchangeResult,\n  AuthioDeviceAuthorization,\n  AuthioIntrospectionResult,\n  AuthioTokenResponse,\n  AuthioUserInfo,\n} from \"./models.js\";\nimport { resolveConnection, seconds, type AuthioConnection, type AuthioConnectionOptions } from \"./options.js\";\n\n/**\n * Everything the Authio client needs: where Authio is, and the client's credentials.\n */\nexport interface AuthioClientOptions extends AuthioConnectionOptions, AuthioClientCredentialsSettings {\n  /**\n   * Seconds before expiry a cached token is renewed (capped at half its lifetime). Defaults to 60.\n   */\n  tokenRefreshSkew?: number;\n  /** The client's own encryption key, to read a UserInfo Authio answers encrypted. */\n  clientEncryptionKey?: AuthioEncryptionKey;\n}\n\n/**\n * Per-call options.\n */\nexport interface AuthioCallOptions {\n  /** Aborts the call. */\n  signal?: AbortSignal;\n}\n\n/**\n * The token endpoint's grants.\n */\nexport interface AuthioTokenClient {\n  /** `client_credentials`, optionally for a resource (RFC 8707). */\n  clientCredentials(options?: { scopes?: Iterable<string> | string; resource?: string } & AuthioCallOptions): Promise<AuthioTokenResponse>;\n  /** Redeems an authorization code. */\n  authorizationCode(\n    options: { code: string; redirectUri: string; codeVerifier?: string; resource?: string } & AuthioCallOptions,\n  ): Promise<AuthioTokenResponse>;\n  /** Refreshes; the answer carries the rotated refresh token, which must be stored. */\n  refresh(options: { refreshToken: string; scopes?: Iterable<string> | string } & AuthioCallOptions): Promise<AuthioTokenResponse>;\n  /** Exchanges a user's access token for one addressed to another resource (RFC 8693, on-behalf-of). */\n  exchange(\n    options: { subjectToken: string; scopes?: Iterable<string> | string; resource?: string } & AuthioCallOptions,\n  ): Promise<AuthioTokenResponse>;\n  /**\n   * Exchanges a user's access token for the token of one of their connected accounts. OAuth refusals come back as\n   * a result, never thrown.\n   */\n  exchangeForConnection(\n    options: { subjectToken: string; provider: string; connectionId?: string } & AuthioCallOptions,\n  ): Promise<AuthioConnectionExchangeResult>;\n  /** Starts the device flow (RFC 8628). */\n  deviceAuthorization(options?: { scopes?: Iterable<string> | string } & AuthioCallOptions): Promise<AuthioDeviceAuthorization>;\n  /**\n   * Polls until the person approves: waits `interval` (default 5 s) before each poll, adds 5 s on `slow_down`, throws\n   * on `access_denied` and `expired_token`, and throws `expired_token` when `expires_in` elapses locally.\n   */\n  pollDevice(\n    authorization: AuthioDeviceAuthorization | { device_code: string; interval?: number; expires_in?: number },\n    options?: AuthioCallOptions,\n  ): Promise<AuthioTokenResponse>;\n  /** The resource owner password grant, where the client allows it. */\n  password(options: { username: string; password: string; scopes?: Iterable<string> | string } & AuthioCallOptions): Promise<AuthioTokenResponse>;\n}\n\n/**\n * Client-credentials tokens, cached per scopes and resource.\n */\nexport interface AuthioClientCredentialsCache {\n  /**\n   * A token for the scopes and resource, renewed `tokenRefreshSkew` before expiry (at most half its lifetime);\n   * concurrent callers for one key share one request.\n   */\n  getToken(options?: { scopes?: Iterable<string> | string; resource?: string } & AuthioCallOptions): Promise<AuthioClientCredentialsToken>;\n  /** Drops the cached token; with `accessToken`, only when the cache still holds that token. */\n  invalidate(options?: { scopes?: Iterable<string> | string; resource?: string; accessToken?: string }): void;\n}\n\n/**\n * The Authio client.\n */\nexport interface AuthioClient {\n  /** The issuer. */\n  readonly issuer: string;\n  /** The client id. */\n  readonly clientId: string;\n  /** The connection settings. */\n  readonly connection: AuthioConnection;\n  /** The discovery document. */\n  readonly discovery: AuthioDiscoveryClient;\n  /** The token endpoint. */\n  readonly tokens: AuthioTokenClient;\n  /** Cached client-credentials tokens. */\n  readonly clientCredentials: AuthioClientCredentialsCache;\n  /**\n   * Introspects a token as this client (RFC 7662). Authio answers according to who asks: a token requested for a\n   * resource (RFC 8707) is active only to the client that resource server names as its introspection client.\n   */\n  introspect(token: string, options?: { tokenTypeHint?: string } & AuthioCallOptions): Promise<AuthioIntrospectionResult>;\n  /** Revokes a token (RFC 7009). */\n  revoke(token: string, options?: { tokenTypeHint?: string } & AuthioCallOptions): Promise<void>;\n  /**\n   * Reads UserInfo. A UserInfo answered as `application/jwt` is decrypted with `clientEncryptionKey` when it is a\n   * JWE, then verified against the realm's keys (`iss` the issuer, `aud` the client).\n   */\n  userInfo(accessToken: string, options?: AuthioCallOptions): Promise<AuthioUserInfo>;\n  /**\n   * A `fetch` that sends a cached client-credentials token, and on a `401` drops it and retries once.\n   */\n  clientCredentialsFetch(options?: { scopes?: Iterable<string> | string; resource?: string; fetch?: typeof fetch }): typeof fetch;\n}\n\n/**\n * Creates the Authio client.\n *\n * @throws AuthioConfigurationError when the settings are incomplete.\n */\nexport function createAuthioClient(options: AuthioClientOptions): AuthioClient {\n  const connection = resolveConnection(options);\n  const discovery = createAuthioDiscoveryClient(connection);\n  const authenticator = createClientAuthenticator(options, connection);\n  const refreshSkewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, \"tokenRefreshSkew\");\n  const decrypt = createAuthioTokenDecrypter(options.clientEncryptionKey);\n  const tokens = createTokenClient(connection, discovery, authenticator);\n  const clientCredentials = createClientCredentialsCache(connection, authenticator.clientId, tokens, refreshSkewMs);\n\n  return {\n    issuer: connection.issuer,\n    clientId: authenticator.clientId,\n    connection,\n    discovery,\n    tokens,\n    clientCredentials,\n    async introspect(token, callOptions = {}) {\n      requireValue(token, \"token\");\n\n      const response = await postForm(\n        connection,\n        discovery,\n        authenticator,\n        \"introspection_endpoint\",\n        { token, token_type_hint: callOptions.tokenTypeHint },\n        callOptions.signal,\n      );\n\n      return readProtocolJson<AuthioIntrospectionResult>(response);\n    },\n    async revoke(token, callOptions = {}) {\n      requireValue(token, \"token\");\n\n      const response = await postForm(\n        connection,\n        discovery,\n        authenticator,\n        \"revocation_endpoint\",\n        { token, token_type_hint: callOptions.tokenTypeHint },\n        callOptions.signal,\n      );\n\n      await ensureProtocolSuccess(response);\n    },\n    async userInfo(accessToken, callOptions = {}) {\n      requireValue(accessToken, \"accessToken\");\n\n      const document = await discovery.get(callOptions.signal);\n      const response = await send(\n        connection,\n        requireEndpoint(document, \"userinfo_endpoint\"),\n        { method: \"GET\", headers: { authorization: `Bearer ${accessToken}`, accept: \"application/json, application/jwt\" } },\n        callOptions.signal,\n      );\n      const mediaType = response.headers.get(\"content-type\")?.split(\";\")[0]?.trim().toLowerCase();\n\n      if (response.ok && mediaType === \"application/jwt\")\n        return readUserInfoJwt((await response.text()).trim(), document, connection, authenticator.clientId, decrypt, response.status);\n\n      if (!response.ok) {\n        const body = await response.text();\n        const challenge = toErrorResponse(body) ? undefined : readBearerChallenge(response);\n\n        throw challenge\n          ? new AuthioProtocolError(challenge.error, challenge.description, undefined, response.status)\n          : toProtocolError(body, response.status);\n      }\n\n      return readProtocolJson<AuthioUserInfo>(response);\n    },\n    clientCredentialsFetch(fetchOptions = {}) {\n      const inner = fetchOptions.fetch ?? connection.fetch;\n      const key = { scopes: fetchOptions.scopes, resource: fetchOptions.resource };\n\n      return async (input, init) => {\n        const request = new Request(input, init);\n        const body = request.body ? await request.arrayBuffer() : undefined;\n        const attempt = async (token: AuthioClientCredentialsToken) => {\n          const headers = new Headers(request.headers);\n\n          headers.set(\"authorization\", `${token.tokenType} ${token.accessToken}`);\n\n          return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });\n        };\n\n        const token = await clientCredentials.getToken({ ...key, signal: request.signal });\n        const response = await attempt(token);\n\n        if (response.status !== 401) return response;\n\n        clientCredentials.invalidate({ ...key, accessToken: token.accessToken });\n\n        return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));\n      };\n    },\n  };\n}\n\nfunction createTokenClient(connection: AuthioConnection, discovery: AuthioDiscoveryClient, authenticator: AuthioClientAuthenticator): AuthioTokenClient {\n  const requestToken = async (parameters: Record<string, string | undefined>, signal?: AbortSignal) => {\n    const response = await postForm(connection, discovery, authenticator, \"token_endpoint\", parameters, signal);\n    const token = await readProtocolJson<AuthioTokenResponse>(response);\n\n    return redact(token, [\"access_token\", \"refresh_token\", \"id_token\"]);\n  };\n\n  const pollDevice: AuthioTokenClient[\"pollDevice\"] = async (authorization, options = {}) => {\n    requireValue(authorization?.device_code, \"device_code\");\n\n    let wait = (authorization.interval && authorization.interval > 0 ? authorization.interval : AuthioDefaults.DeviceInterval) * 1000;\n    const deadline =\n      authorization.expires_in && authorization.expires_in > 0 ? connection.clock.now() + authorization.expires_in * 1000 : undefined;\n\n    for (;;) {\n      await connection.clock.sleep(wait, options.signal);\n\n      if (deadline !== undefined && connection.clock.now() >= deadline)\n        throw new AuthioProtocolError(AuthioOAuthErrors.ExpiredToken, \"The device code expired before the user approved it.\");\n\n      try {\n        return await requestToken({ grant_type: AuthioGrantTypes.DeviceCode, device_code: authorization.device_code }, options.signal);\n      } catch (error) {\n        if (!(error instanceof AuthioProtocolError)) throw error;\n        if (error.error === AuthioOAuthErrors.AuthorizationPending) continue;\n        if (error.error === AuthioOAuthErrors.SlowDown) {\n          wait += AuthioDefaults.DeviceSlowDownIncrement * 1000;\n          continue;\n        }\n        throw error;\n      }\n    }\n  };\n\n  return {\n    clientCredentials: (options = {}) =>\n      requestToken(\n        { grant_type: AuthioGrantTypes.ClientCredentials, scope: toScopeString(options.scopes), resource: options.resource },\n        options.signal,\n      ),\n    authorizationCode: (options) => {\n      requireValue(options?.code, \"code\");\n      requireValue(options.redirectUri, \"redirectUri\");\n\n      return requestToken(\n        {\n          grant_type: AuthioGrantTypes.AuthorizationCode,\n          code: options.code,\n          redirect_uri: options.redirectUri,\n          code_verifier: options.codeVerifier,\n          resource: options.resource,\n        },\n        options.signal,\n      );\n    },\n    refresh: (options) => {\n      requireValue(options?.refreshToken, \"refreshToken\");\n\n      return requestToken(\n        { grant_type: AuthioGrantTypes.RefreshToken, refresh_token: options.refreshToken, scope: toScopeString(options.scopes) },\n        options.signal,\n      );\n    },\n    exchange: (options) => {\n      requireValue(options?.subjectToken, \"subjectToken\");\n\n      return requestToken(\n        {\n          grant_type: AuthioGrantTypes.TokenExchange,\n          subject_token: options.subjectToken,\n          subject_token_type: AuthioTokenTypes.AccessTokenUrn,\n          requested_token_type: AuthioTokenTypes.AccessTokenUrn,\n          scope: toScopeString(options.scopes),\n          resource: options.resource,\n        },\n        options.signal,\n      );\n    },\n    async exchangeForConnection(options) {\n      requireValue(options?.subjectToken, \"subjectToken\");\n      requireValue(options.provider, \"provider\");\n\n      const response = await postForm(\n        connection,\n        discovery,\n        authenticator,\n        \"token_endpoint\",\n        {\n          grant_type: AuthioGrantTypes.TokenExchange,\n          subject_token: options.subjectToken,\n          subject_token_type: AuthioTokenTypes.AccessTokenUrn,\n          requested_token_type: AuthioTokenTypes.ConnectionAccessTokenUrn,\n          connection_provider: options.provider,\n          connection_id: options.connectionId,\n        },\n        options.signal,\n      );\n\n      return toConnectionExchangeResult(await response.text(), response.status, options.provider);\n    },\n    async deviceAuthorization(options = {}) {\n      const response = await postForm(\n        connection,\n        discovery,\n        authenticator,\n        \"device_authorization_endpoint\",\n        { scope: toScopeString(options.scopes) },\n        options.signal,\n      );\n\n      return redact(await readProtocolJson<AuthioDeviceAuthorization>(response), [\"device_code\"]);\n    },\n    pollDevice,\n    password: (options) => {\n      requireValue(options?.username, \"username\");\n\n      if (typeof options.password !== \"string\") throw new TypeError(\"password is required.\");\n\n      return requestToken(\n        { grant_type: AuthioGrantTypes.Password, username: options.username, password: options.password, scope: toScopeString(options.scopes) },\n        options.signal,\n      );\n    },\n  };\n}\n\nfunction createClientCredentialsCache(\n  connection: AuthioConnection,\n  clientId: string,\n  tokens: AuthioTokenClient,\n  refreshSkewMs: number,\n): AuthioClientCredentialsCache {\n  const entries = new Map<string, AuthioClientCredentialsToken>();\n  const pending = new Map<string, Promise<AuthioClientCredentialsToken>>();\n\n  const keyOf = (scope: string | undefined, resource: string | undefined) =>\n    `${connection.issuer}|${clientId}|${(scope ?? \"\").split(\" \").filter(Boolean).sort().join(\" \")}|${resource ?? \"\"}`;\n\n  return {\n    async getToken(options = {}) {\n      const scope = toScopeString(options.scopes);\n      const key = keyOf(scope, options.resource);\n      const cached = entries.get(key);\n\n      if (cached && connection.clock.now() < cached.refreshAt) return cached;\n\n      let request = pending.get(key);\n\n      if (!request) {\n        request = tokens\n          .clientCredentials({ scopes: scope, resource: options.resource, signal: options.signal })\n          .then((response) => {\n            const token = toClientCredentialsToken(response, connection.clock.now(), refreshSkewMs);\n\n            entries.set(key, token);\n            return token;\n          })\n          .finally(() => pending.delete(key));\n        pending.set(key, request);\n      }\n\n      return request;\n    },\n    invalidate(options = {}) {\n      const key = keyOf(toScopeString(options.scopes), options.resource);\n\n      if (options.accessToken === undefined || entries.get(key)?.accessToken === options.accessToken) entries.delete(key);\n    },\n  };\n}\n\n/**\n * When a token answer expires, and when a cache should renew it: `expires_in` (else 5 minutes) after `issuedAt`,\n * renewed `refreshSkewMs` before that, at most half its lifetime.\n */\nexport function toClientCredentialsToken(response: AuthioTokenResponse, issuedAt: number, refreshSkewMs: number): AuthioClientCredentialsToken {\n  const lifetime = (response.expires_in && response.expires_in > 0 ? response.expires_in : AuthioDefaults.AssumedTokenLifetime) * 1000;\n  const expiresAt = issuedAt + lifetime;\n  const skew = Math.min(refreshSkewMs, lifetime / 2);\n\n  return redact(\n    {\n      accessToken: response.access_token,\n      tokenType: response.token_type?.trim() ? response.token_type : \"Bearer\",\n      expiresAt,\n      refreshAt: expiresAt - skew,\n      scope: response.scope,\n    },\n    [\"accessToken\"],\n  );\n}\n\n/**\n * Reads the answer of a connected-account token exchange.\n *\n * @internal\n */\nexport function toConnectionExchangeResult(body: string, status: number, provider: string): AuthioConnectionExchangeResult {\n  if (status >= 200 && status < 300) {\n    const token = parseProtocolJson<Record<string, unknown>>(body, status);\n\n    if (typeof token.access_token === \"string\" && token.access_token)\n      return redact(\n        {\n          status: \"granted\" as const,\n          accessToken: token.access_token,\n          provider: typeof token.provider === \"string\" && token.provider ? token.provider : provider,\n          providerType: token.provider_type as string | undefined,\n          connectionId: token.connection_id as string | undefined,\n          tokenType: token.token_type as string | undefined,\n          issuedTokenType: token.issued_token_type as string | undefined,\n          scope: token.scope as string | undefined,\n          externalAccount: token.external_account as never,\n          expiresIn: token.expires_in as number | undefined,\n        },\n        [\"accessToken\"],\n      );\n  }\n\n  const error = toErrorResponse(body);\n  const description = error?.error_description?.trim()\n    ? error.error_description\n    : `Authio answered HTTP ${status} to the connected-account token exchange.`;\n\n  switch (error?.error) {\n    case AuthioOAuthErrors.ConnectionRequired:\n      return { status: \"required\", connectUri: error.connect_uri, description };\n    case AuthioOAuthErrors.ConnectionSelectionRequired:\n      return { status: \"selection_required\", connections: error.connections ?? [], description };\n    default:\n      return { status: \"refused\", error: error?.error ?? `http_${status}`, code: error?.error_code, description, connectUri: error?.connect_uri };\n  }\n}\n\nasync function postForm(\n  connection: AuthioConnection,\n  discovery: AuthioDiscoveryClient,\n  authenticator: AuthioClientAuthenticator,\n  endpoint: \"token_endpoint\" | \"introspection_endpoint\" | \"revocation_endpoint\" | \"device_authorization_endpoint\",\n  parameters: Record<string, string | undefined>,\n  signal?: AbortSignal,\n): Promise<Response> {\n  const document = await discovery.get(signal);\n  const url = requireEndpoint(document, endpoint);\n  const form = formBody(parameters);\n  const headers = new Headers({ accept: \"application/json\", \"content-type\": \"application/x-www-form-urlencoded\" });\n\n  await authenticator.apply(form, headers);\n\n  return send(connection, url, { method: \"POST\", headers, body: form.toString() }, signal);\n}\n\nasync function readUserInfoJwt(\n  jwt: string,\n  document: AuthioDiscoveryDocument,\n  connection: AuthioConnection,\n  clientId: string,\n  decrypt: (token: string) => Promise<string>,\n  status: number,\n): Promise<AuthioUserInfo> {\n  try {\n    const signed = isAuthioTokenEncrypted(jwt) ? await decrypt(jwt) : jwt;\n\n    const keys = createRemoteJWKSet(new URL(requireEndpoint(document, \"jwks_uri\")), { [customFetch]: connection.fetch });\n    const { payload } = await jwtVerify(signed, keys, {\n      issuer: document.issuer,\n      audience: clientId,\n      clockTolerance: 30,\n    });\n\n    return payload as AuthioUserInfo;\n  } catch (error) {\n    throw new AuthioProtocolError(\n      \"invalid_userinfo\",\n      `The userinfo JWT could not be verified: ${(error as Error)?.message ?? \"unknown reason.\"}`,\n      undefined,\n      status,\n      { cause: error },\n    );\n  }\n}\n\nfunction readBearerChallenge(response: Response): { error: string; description: string | undefined } | undefined {\n  const header = response.headers.get(\"www-authenticate\");\n\n  if (!header || !/^bearer\\s/i.test(header.trim())) return undefined;\n\n  let error = \"\";\n  let description: string | undefined;\n\n  for (const match of header.matchAll(/([a-zA-Z_]+)\\s*=\\s*\"((?:[^\"\\\\]|\\\\.)*)\"|([a-zA-Z_]+)\\s*=\\s*([^,\\s]+)/g)) {\n    const name = match[1] ?? match[3];\n    const value = (match[2] ?? match[4] ?? \"\").replace(/\\\\(.)/g, \"$1\");\n\n    if (name === \"error\") error = value;\n    else if (name === \"error_description\") description = value;\n  }\n\n  return error ? { error, description } : undefined;\n}\n\nfunction requireValue(value: unknown, name: string): asserts value is string {\n  if (typeof value !== \"string\" || !value.trim()) throw new TypeError(`${name} is required.`);\n}\n","import { AuthioResourceAccessClaims, type AuthioResourceAccessSource } from \"./constants.js\";\n\n/**\n * One role read from a `*_resource_access` claim, with the permissions it grants.\n */\nexport interface AuthioResourceAccessRole {\n  /** The claim the role came from. */\n  readonly source: AuthioResourceAccessSource;\n  /** The role name. */\n  readonly name: string;\n  /** Resource → methods the role allows on it. */\n  readonly permissions: Readonly<Record<string, readonly string[]>>;\n}\n\nconst claimSources = new Map(Object.entries(AuthioResourceAccessClaims).map(([name, source]) => [name.toLowerCase(), source]));\n\n/**\n * The roles and permissions a token carries in its `*_resource_access` claims, merged across sources.\n *\n * Every comparison is case-insensitive, as Authio's own check is. When a name appears in different case, the first\n * spelling read is the one listed.\n */\nexport class AuthioResourceAccess {\n  /** No role at all. */\n  static readonly empty = new AuthioResourceAccess([]);\n\n  /** Every role read, in claim order, one entry per source it came from. */\n  readonly entries: readonly AuthioResourceAccessRole[];\n  /** Every distinct role name. */\n  readonly roles: readonly string[];\n  /** Resource → every method any role allows on it. */\n  readonly permissions: Readonly<Record<string, readonly string[]>>;\n\n  private readonly lookup: Map<string, Map<string, string>>;\n\n  constructor(entries: Iterable<AuthioResourceAccessRole>) {\n    this.entries = Object.freeze([...entries]);\n    this.roles = Object.freeze(distinctIgnoringCase(this.entries.map((entry) => entry.name)));\n    this.lookup = new Map();\n\n    const permissions: Record<string, string[]> = {};\n    const spelling = new Map<string, string>();\n\n    for (const entry of this.entries) {\n      for (const [resource, methods] of Object.entries(entry.permissions)) {\n        const resourceKey = resource.toLowerCase();\n        let allowed = this.lookup.get(resourceKey);\n\n        if (!allowed) {\n          allowed = new Map();\n          this.lookup.set(resourceKey, allowed);\n          spelling.set(resourceKey, resource);\n          permissions[resource] = [];\n        }\n\n        for (const method of methods) {\n          const methodKey = method.toLowerCase();\n\n          if (allowed.has(methodKey)) continue;\n\n          allowed.set(methodKey, method);\n          permissions[spelling.get(resourceKey)!]!.push(method);\n        }\n      }\n    }\n\n    this.permissions = Object.freeze(Object.fromEntries(Object.entries(permissions).map(([name, methods]) => [name, Object.freeze(methods)])));\n  }\n\n  /** Whether no role was read. */\n  get isEmpty(): boolean {\n    return this.entries.length === 0;\n  }\n\n  /**\n   * Whether the token holds the role, from any source or only from the given ones.\n   */\n  hasRole(role: string, sources?: readonly AuthioResourceAccessSource[]): boolean {\n    if (!role) return false;\n\n    const wanted = role.toLowerCase();\n\n    return this.entries.some((entry) => inSources(entry, sources) && entry.name.toLowerCase() === wanted);\n  }\n\n  /**\n   * Authio's grant rule: whether any role (from any source, or only from the given ones) allows `method` on\n   * `resource`.\n   */\n  grants(resource: string, method: string, sources?: readonly AuthioResourceAccessSource[]): boolean {\n    if (!resource || !method) return false;\n\n    if (!sources || sources.length === 0) return this.lookup.get(resource.toLowerCase())?.has(method.toLowerCase()) ?? false;\n\n    return this.entries.some((entry) => inSources(entry, sources) && entryGrants(entry, resource, method));\n  }\n\n  /**\n   * The roles that came from one source.\n   */\n  fromSource(source: AuthioResourceAccessSource): AuthioResourceAccessRole[] {\n    return this.entries.filter((entry) => entry.source === source);\n  }\n}\n\n/**\n * The source a claim name stands for, when it is one of the seven `*_resource_access` claims.\n */\nexport function resourceAccessSourceOf(claimType: string | undefined | null): AuthioResourceAccessSource | undefined {\n  return claimType ? claimSources.get(claimType.toLowerCase()) : undefined;\n}\n\n/**\n * Reads the roles of every `*_resource_access` claim. Takes a JWT payload or introspection answer, or\n * `[type, value]` pairs; each value may be the JSON object itself or its JSON text. Other claims are ignored.\n */\nexport function parseResourceAccess(claims: Readonly<Record<string, unknown>> | Iterable<readonly [string, unknown]>): AuthioResourceAccess {\n  const pairs: Iterable<readonly [string, unknown]> = isIterable(claims) ? claims : Object.entries(claims);\n  const roles: AuthioResourceAccessRole[] = [];\n\n  for (const [type, value] of pairs) {\n    const source = resourceAccessSourceOf(type);\n\n    if (source) roles.push(...parseResourceAccessClaim(source, value));\n  }\n\n  return roles.length === 0 ? AuthioResourceAccess.empty : new AuthioResourceAccess(roles);\n}\n\n/**\n * Reads the roles of one claim value, as strictly as Authio does: a value that is not exactly\n * `{role: {resource: [method]}}` contributes nothing at all. `null` roles, resources and methods are allowed and grant\n * nothing.\n */\nexport function parseResourceAccessClaim(source: AuthioResourceAccessSource, value: unknown): AuthioResourceAccessRole[] {\n  const root = typeof value === \"string\" ? parseJson(value) : value;\n\n  if (!isPlainObject(root)) return [];\n\n  const roles: AuthioResourceAccessRole[] = [];\n\n  for (const [name, rolePermissions] of Object.entries(root)) {\n    const permissions = readPermissions(rolePermissions);\n\n    if (!permissions) return [];\n\n    roles.push(Object.freeze({ source, name, permissions }));\n  }\n\n  return roles;\n}\n\nfunction readPermissions(value: unknown): Readonly<Record<string, readonly string[]>> | undefined {\n  if (value === null) return Object.freeze({});\n  if (!isPlainObject(value)) return undefined;\n\n  const read: Record<string, readonly string[]> = {};\n  const seen = new Set<string>();\n\n  for (const [resource, methods] of Object.entries(value)) {\n    const key = resource.toLowerCase();\n\n    if (methods === null) {\n      if (!seen.has(key)) {\n        seen.add(key);\n        read[resource] = Object.freeze([]);\n      }\n      continue;\n    }\n\n    if (!Array.isArray(methods)) return undefined;\n\n    const allowed: string[] = [];\n\n    for (const method of methods) {\n      if (typeof method === \"string\") allowed.push(method);\n      else if (method !== null) return undefined;\n    }\n\n    if (!seen.has(key)) {\n      seen.add(key);\n      read[resource] = Object.freeze(allowed);\n    }\n  }\n\n  return Object.freeze(read);\n}\n\nfunction entryGrants(entry: AuthioResourceAccessRole, resource: string, method: string): boolean {\n  const resourceKey = resource.toLowerCase();\n  const methodKey = method.toLowerCase();\n\n  for (const [name, methods] of Object.entries(entry.permissions)) {\n    if (name.toLowerCase() === resourceKey) return methods.some((allowed) => allowed.toLowerCase() === methodKey);\n  }\n\n  return false;\n}\n\nfunction inSources(entry: AuthioResourceAccessRole, sources: readonly AuthioResourceAccessSource[] | undefined): boolean {\n  return !sources || sources.length === 0 || sources.includes(entry.source);\n}\n\nfunction distinctIgnoringCase(values: readonly string[]): string[] {\n  const seen = new Set<string>();\n\n  return values.filter((value) => {\n    const key = value.toLowerCase();\n\n    if (seen.has(key)) return false;\n\n    seen.add(key);\n    return true;\n  });\n}\n\nfunction parseJson(text: string): unknown {\n  if (!text.trim()) return undefined;\n\n  try {\n    return JSON.parse(text);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isIterable(value: unknown): value is Iterable<readonly [string, unknown]> {\n  return typeof value === \"object\" && value !== null && typeof (value as Iterable<unknown>)[Symbol.iterator] === \"function\";\n}\n","import { AuthioDefaults, AuthioWebhookEventTypes } from \"./constants.js\";\n\n/**\n * Why a webhook delivery failed verification.\n */\nexport type AuthioWebhookVerificationFailure =\n  | \"missing_signature\"\n  | \"malformed_signature\"\n  | \"signature_mismatch\"\n  | \"timestamp_outside_tolerance\";\n\n/**\n * The outcome of verifying a webhook signature.\n */\nexport type AuthioWebhookVerificationResult =\n  | { readonly valid: true; readonly timestamp: Date }\n  | { readonly valid: false; readonly failure: AuthioWebhookVerificationFailure; readonly reason: string; readonly timestamp?: Date };\n\n/**\n * A webhook event. `data` holds the event-specific payload; read it typed with the `as…` helpers.\n */\nexport interface AuthioWebhookEvent {\n  readonly id: string;\n  readonly type: string;\n  /** Seconds since the epoch. */\n  readonly created_at: number;\n  readonly realm_id?: string;\n  readonly client_id?: string;\n  readonly data: unknown;\n  [member: string]: unknown;\n}\n\n/** `user_created`, `user_updated`, `user_deleted`. */\nexport interface AuthioWebhookUserData {\n  id: string;\n  username?: string;\n  email?: string;\n  first_name?: string;\n  last_name?: string;\n  email_confirmed: boolean;\n  status?: string;\n  realm_id?: string;\n  client_id?: string;\n}\n\n/** `login_succeeded`, `login_failed`. */\nexport interface AuthioWebhookLoginData {\n  grant_type?: string;\n  user_id?: string;\n  username?: string;\n  email?: string;\n  ip_address?: string;\n  user_agent?: string;\n  session_id?: string;\n  failure_reason?: string;\n  resource?: string;\n  scopes?: string;\n}\n\n/** `user_locked_out`. */\nexport interface AuthioWebhookUserLockedOutData {\n  user_id: string;\n  username?: string;\n  email?: string;\n  lockout_end?: string;\n  access_failed_count: number;\n}\n\n/** `token_revoked`. */\nexport interface AuthioWebhookTokenRevokedData {\n  token_id?: string;\n  subject?: string;\n  session_id?: string;\n  token_type_hint?: string;\n}\n\n/** `keys_rotated`. */\nexport interface AuthioWebhookKeysRotatedData {\n  signing_key_id?: string;\n  encryption_key_id?: string;\n  revoked_keys_count?: number;\n  rotation_days?: number;\n  automatic?: boolean;\n}\n\n/** `token_reuse_detected`. */\nexport interface AuthioWebhookTokenReuseDetectedData {\n  token_id?: string;\n  subject?: string;\n  session_id?: string;\n  ip_address?: string;\n  user_agent?: string;\n}\n\n/** `admin_resource_created`, `admin_resource_updated`, `admin_resource_deleted`. */\nexport interface AuthioWebhookAdminResourceData {\n  action?: string;\n  resource_type?: string;\n  resource_id?: string;\n  realm_id?: string;\n  client_id?: string;\n  actor_user_id?: string;\n  actor_username?: string;\n  actor_email?: string;\n  ip_address?: string;\n  method?: string;\n  path?: string;\n}\n\n/** `user_suspended`, `user_suspension_ended`. */\nexport interface AuthioWebhookUserSuspensionData {\n  id: string;\n  user_id: string;\n  level?: string;\n  status?: string;\n  starts_at?: string;\n  ends_at?: string;\n  restricted_scopes: string[];\n  revokes_every_role: boolean;\n  revoked_role_ids: string[];\n  sessions_terminated_at?: string;\n  lifted_at?: string;\n}\n\n/** `ping`. */\nexport interface AuthioWebhookPingData {\n  message?: string;\n  subscription?: string;\n}\n\n/**\n * The data shape of each event type.\n */\nexport interface AuthioWebhookDataByType {\n  user_created: AuthioWebhookUserData;\n  user_updated: AuthioWebhookUserData;\n  user_deleted: AuthioWebhookUserData;\n  login_succeeded: AuthioWebhookLoginData;\n  login_failed: AuthioWebhookLoginData;\n  user_locked_out: AuthioWebhookUserLockedOutData;\n  token_revoked: AuthioWebhookTokenRevokedData;\n  keys_rotated: AuthioWebhookKeysRotatedData;\n  token_reuse_detected: AuthioWebhookTokenReuseDetectedData;\n  admin_resource_created: AuthioWebhookAdminResourceData;\n  admin_resource_updated: AuthioWebhookAdminResourceData;\n  admin_resource_deleted: AuthioWebhookAdminResourceData;\n  user_suspended: AuthioWebhookUserSuspensionData;\n  user_suspension_ended: AuthioWebhookUserSuspensionData;\n  ping: AuthioWebhookPingData;\n}\n\n/**\n * An event narrowed to one type, with its data typed.\n */\nexport type AuthioTypedWebhookEvent<T extends keyof AuthioWebhookDataByType> = AuthioWebhookEvent & {\n  readonly type: T;\n  readonly data: AuthioWebhookDataByType[T];\n};\n\nconst encoder = new TextEncoder();\n\n/**\n * Verifies the `X-Authio-Signature` header (`t={unixSeconds},v1={hex}`) against the raw body: HMAC-SHA256 of\n * `{t}.{body}` with the secret, compared in constant time, any matching `v1` accepted, the signature checked before\n * the timestamp.\n *\n * @param signatureHeader The header value.\n * @param rawBody The body exactly as received.\n * @param secret The webhook's secret.\n * @param options `tolerance` in seconds (default 300) and `now` in milliseconds (default the current time).\n */\nexport async function verifyWebhookSignature(\n  signatureHeader: string | null | undefined,\n  rawBody: string | Uint8Array,\n  secret: string,\n  options: { tolerance?: number; now?: number } = {},\n): Promise<AuthioWebhookVerificationResult> {\n  if (!secret) throw new TypeError(\"secret is required.\");\n\n  if (!signatureHeader?.trim())\n    return { valid: false, failure: \"missing_signature\", reason: \"The X-Authio-Signature header is missing.\" };\n\n  const parsed = parseSignatureHeader(signatureHeader);\n\n  if (!parsed)\n    return {\n      valid: false,\n      failure: \"malformed_signature\",\n      reason: \"The X-Authio-Signature header is not of the form t={unixSeconds},v1={hex}.\",\n    };\n\n  const signedAt = new Date(parsed.timestamp * 1000);\n  const expected = await computeSignature(parsed.timestamp, rawBody, secret);\n  let matched = false;\n\n  for (const signature of parsed.signatures) matched = constantTimeEquals(expected, signature) || matched;\n\n  if (!matched)\n    return {\n      valid: false,\n      failure: \"signature_mismatch\",\n      reason: \"No v1 signature matches the body: the secret is wrong or the body was altered.\",\n      timestamp: signedAt,\n    };\n\n  const tolerance = (options.tolerance ?? AuthioDefaults.WebhookTolerance) * 1000;\n  const now = options.now ?? Date.now();\n\n  if (Math.abs(now - signedAt.getTime()) > tolerance)\n    return {\n      valid: false,\n      failure: \"timestamp_outside_tolerance\",\n      reason: `The signature was made at ${signedAt.toISOString()}, more than ${tolerance / 1000} seconds from now.`,\n      timestamp: signedAt,\n    };\n\n  return { valid: true, timestamp: signedAt };\n}\n\n/**\n * Computes the `X-Authio-Signature` value Authio would send, for tests and replays.\n *\n * @param timestamp Milliseconds since the epoch, or a date.\n */\nexport async function computeWebhookSignatureHeader(rawBody: string | Uint8Array, secret: string, timestamp: number | Date): Promise<string> {\n  if (!secret) throw new TypeError(\"secret is required.\");\n\n  const seconds = Math.floor((timestamp instanceof Date ? timestamp.getTime() : timestamp) / 1000);\n  const signature = await computeSignature(seconds, rawBody, secret);\n\n  return `t=${seconds},v1=${[...signature].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\")}`;\n}\n\n/**\n * Parses a webhook body.\n *\n * @throws SyntaxError when it is not JSON or has no `type`.\n */\nexport function parseWebhookEvent(rawBody: string | Uint8Array): AuthioWebhookEvent {\n  const text = typeof rawBody === \"string\" ? rawBody : new TextDecoder().decode(rawBody);\n  const value = JSON.parse(text) as AuthioWebhookEvent | null;\n\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new SyntaxError(\"The webhook body is empty.\");\n  if (typeof value.type !== \"string\" || !value.type) throw new SyntaxError(\"The webhook body has no type.\");\n\n  return value;\n}\n\n/**\n * Parses a webhook body, or returns `undefined` when it cannot be read.\n */\nexport function tryParseWebhookEvent(rawBody: string | Uint8Array | null | undefined): AuthioWebhookEvent | undefined {\n  if (rawBody === null || rawBody === undefined) return undefined;\n\n  try {\n    return parseWebhookEvent(rawBody);\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether the event is of one of the given types, narrowing its data.\n */\nexport function isWebhookEventOfType<T extends keyof AuthioWebhookDataByType>(\n  event: AuthioWebhookEvent,\n  ...types: T[]\n): event is AuthioTypedWebhookEvent<T> {\n  return (types as string[]).includes(event.type);\n}\n\n/** The data of a user event, or `undefined` for any other type. */\nexport const asUserEvent = (event: AuthioWebhookEvent) =>\n  dataWhen<AuthioWebhookUserData>(event, AuthioWebhookEventTypes.UserCreated, AuthioWebhookEventTypes.UserUpdated, AuthioWebhookEventTypes.UserDeleted);\n/** The data of a login event, or `undefined` for any other type. */\nexport const asLoginEvent = (event: AuthioWebhookEvent) =>\n  dataWhen<AuthioWebhookLoginData>(event, AuthioWebhookEventTypes.LoginSucceeded, AuthioWebhookEventTypes.LoginFailed);\n/** The data of a lockout event, or `undefined` for any other type. */\nexport const asUserLockedOutEvent = (event: AuthioWebhookEvent) => dataWhen<AuthioWebhookUserLockedOutData>(event, AuthioWebhookEventTypes.UserLockedOut);\n/** The data of a revocation event, or `undefined` for any other type. */\nexport const asTokenRevokedEvent = (event: AuthioWebhookEvent) => dataWhen<AuthioWebhookTokenRevokedData>(event, AuthioWebhookEventTypes.TokenRevoked);\n/** The data of a key rotation event, or `undefined` for any other type. */\nexport const asKeysRotatedEvent = (event: AuthioWebhookEvent) => dataWhen<AuthioWebhookKeysRotatedData>(event, AuthioWebhookEventTypes.KeysRotated);\n/** The data of a refresh token reuse event, or `undefined` for any other type. */\nexport const asTokenReuseDetectedEvent = (event: AuthioWebhookEvent) =>\n  dataWhen<AuthioWebhookTokenReuseDetectedData>(event, AuthioWebhookEventTypes.TokenReuseDetected);\n/** The data of an admin resource event, or `undefined` for any other type. */\nexport const asAdminResourceEvent = (event: AuthioWebhookEvent) =>\n  dataWhen<AuthioWebhookAdminResourceData>(\n    event,\n    AuthioWebhookEventTypes.AdminResourceCreated,\n    AuthioWebhookEventTypes.AdminResourceUpdated,\n    AuthioWebhookEventTypes.AdminResourceDeleted,\n  );\n/** The data of a suspension event, or `undefined` for any other type. */\nexport const asUserSuspensionEvent = (event: AuthioWebhookEvent) =>\n  dataWhen<AuthioWebhookUserSuspensionData>(event, AuthioWebhookEventTypes.UserSuspended, AuthioWebhookEventTypes.UserSuspensionEnded);\n/** The data of a ping, or `undefined` for any other type. */\nexport const asPingEvent = (event: AuthioWebhookEvent) => dataWhen<AuthioWebhookPingData>(event, AuthioWebhookEventTypes.Ping);\n\nfunction dataWhen<T>(event: AuthioWebhookEvent, ...types: string[]): T | undefined {\n  return types.includes(event.type) && event.data !== null && event.data !== undefined ? (event.data as T) : undefined;\n}\n\nfunction parseSignatureHeader(header: string): { timestamp: number; signatures: Uint8Array[] } | undefined {\n  let timestamp = 0;\n  let timestamps = 0;\n  const signatures: Uint8Array[] = [];\n\n  for (const raw of header.split(\",\")) {\n    const part = raw.trim();\n\n    if (!part) continue;\n\n    const separator = part.indexOf(\"=\");\n\n    if (separator <= 0) return undefined;\n\n    const key = part.slice(0, separator);\n    const value = part.slice(separator + 1);\n\n    if (key === \"t\") {\n      timestamps++;\n\n      if (!/^\\d+$/.test(value)) return undefined;\n\n      timestamp = Number(value);\n    } else if (key === \"v1\" && value.length === 64 && /^[0-9a-fA-F]+$/.test(value)) {\n      signatures.push(Uint8Array.from(value.match(/../g)!.map((pair) => parseInt(pair, 16))));\n    }\n  }\n\n  return timestamps === 1 && signatures.length > 0 && Number.isSafeInteger(timestamp) ? { timestamp, signatures } : undefined;\n}\n\nasync function computeSignature(timestamp: number, rawBody: string | Uint8Array, secret: string): Promise<Uint8Array> {\n  const prefix = encoder.encode(`${timestamp}.`);\n  const body = typeof rawBody === \"string\" ? encoder.encode(rawBody) : rawBody;\n  const message = new Uint8Array(prefix.length + body.length);\n\n  message.set(prefix, 0);\n  message.set(body, prefix.length);\n\n  const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n\n  return new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, message));\n}\n\nfunction constantTimeEquals(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.length !== right.length) return false;\n\n  let difference = 0;\n\n  for (let index = 0; index < left.length; index++) difference |= left[index]! ^ right[index]!;\n\n  return difference === 0;\n}\n"]}

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@hyper.authio/client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Authio client for Node.js and edge runtimes: discovery, every grant, introspection, client-credentials cache, roles and permissions, webhooks.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "scripts": {
+    "build": "tsup"
+  },
+  "dependencies": {
+    "jose": "^6.1.0"
+  },
+  "keywords": [
+    "authio",
+    "oauth",
+    "oidc",
+    "jwt",
+    "authorization"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/LeonardoFerreira1209/authio-node.git",
+    "directory": "packages/client"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}