@hyper.authio/server 0.0.0-stage → 0.1.1

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/user.ts","../src/rules.ts","../src/errors.ts","../src/verifier.ts","../src/webhooks.ts","../src/downstream.ts"],"names":["AuthioClaimTypes","parseResourceAccess","seconds","AuthioError","AuthioConfigurationError","resolveConnection","createAuthioDiscoveryClient","client","AuthioAsymmetricAlgorithms","AuthioTokenTypes","createRemoteJWKSet","customFetch","isAuthioTokenEncrypted","jwtVerify","createAuthioClient","errors","decodeProtectedHeader","systemClock","AuthioWebhookHeaders","verifyWebhookSignature","tryParseWebhookEvent","until","toScopeString","AuthioDefaults","toClientCredentialsToken","token"],"mappings":";;;;;;AAgCO,IAAM,aAAN,MAAiB;AAAA;AAAA,EAEb,OAAA;AAAA;AAAA,EAEA,QAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,iBAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,GAAA;AAAA;AAAA,EAEA,mBAAA;AAAA;AAAA,EAEA,qBAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,eAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,YAAA;AAAA,EACA,KAAA;AAAA,EACA,aAAA;AAAA,EACA,IAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAIQ,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjB,WAAA,CAAY,MAAA,EAA2C,QAAA,GAAoC,IAAI,KAAA,EAAgB;AAC7G,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,KAAkB,OAAO,MAAA,CAAO,IAAI,CAAA,KAAM,QAAA,IAAY,MAAA,CAAO,IAAI,CAAA,GAAK,MAAA,CAAO,IAAI,CAAA,GAAe,MAAA;AAE9G,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,QAAQ,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAKA,uBAAA,CAAiB,OAAO,CAAA,IAAK,EAAA;AACjD,IAAA,IAAA,CAAK,WAAW,IAAA,CAAKA,uBAAA,CAAiB,eAAe,CAAA,IAAK,IAAA,CAAKA,wBAAiB,QAAQ,CAAA;AACxF,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAKA,uBAAA,CAAiB,SAAS,CAAA;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAKA,uBAAA,CAAiB,KAAK,CAAA;AAC1C,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,OAAOA,uBAAA,CAAiB,QAAQ,CAAC,CAAC,CAAC,CAAA;AACpF,IAAA,IAAA,CAAK,MAAA,GAAS,OAAO,MAAA,CAAO,QAAA,CAAS,SAAS,MAAA,CAAOA,uBAAA,CAAiB,KAAK,CAAC,CAAA,CAAE,QAAQ,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AACrI,IAAA,IAAA,CAAK,cAAA,GAAiBC,2BAAoB,MAAM,CAAA;AAChD,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,MAAA,CAAA,CAAQ,QAAA,CAAS,UAAA,IAAc,CAAC,MAAM,CAAA,EAAG,OAAA,CAAQ,CAAC,SAAS,QAAA,CAAS,MAAA,CAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAC1G,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,oBAAA,CAAqB,CAAC,GAAG,IAAA,CAAK,cAAA,CAAe,KAAA,EAAO,GAAG,IAAA,CAAK,SAAS,CAAC,CAAC,CAAA;AAClG,IAAA,IAAA,CAAK,WAAA,GAAc,KAAK,cAAA,CAAe,WAAA;AACvC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA,CAAO,UAAU,QAAA,CAAS,WAAA,IAAe,CAAC,QAAQ,CAAA,EAAG,OAAA,CAAQ,CAAC,SAAS,QAAA,CAAS,MAAA,CAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AACpH,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAKD,uBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA,CAAKA,uBAAA,CAAiB,iBAAiB,CAAA;AAChE,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAKA,uBAAA,CAAiB,SAAS,CAAA;AAChD,IAAA,IAAA,CAAK,MAAM,QAAA,CAAS,MAAA,CAAOA,wBAAiB,0BAA0B,CAAC,EAAE,CAAC,CAAA;AAC1E,IAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA,CAAK,GAAA,KAAQ,MAAA,IAAa,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACjG,IAAA,IAAA,CAAK,qBAAA,GAAwB,MAAA,CAAO,MAAA,CAAO,oBAAA,CAAqB,QAAA,CAAS,OAAOA,uBAAA,CAAiB,qBAAqB,CAAC,CAAC,CAAC,CAAA;AACzH,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAKA,uBAAA,CAAiB,gBAAgB,CAAA;AAC9D,IAAA,IAAA,CAAK,eAAA,GAAkB,MAAA,CAAO,MAAA,CAAOA,uBAAA,CAAiB,QAAQ,CAAC,CAAA;AAC/D,IAAA,IAAA,CAAK,KAAA,GAAQ,SAAA,CAAU,MAAA,CAAOA,uBAAA,CAAiB,KAAK,CAAC,CAAA;AACrD,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAKA,uBAAA,CAAiB,YAAY,CAAA;AACtD,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA,CAAKA,uBAAA,CAAiB,KAAK,CAAA;AACxC,IAAA,IAAA,CAAK,aAAA,GAAgB,SAAA,CAAU,MAAA,CAAOA,uBAAA,CAAiB,aAAa,CAAC,CAAA;AACrE,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAKA,uBAAA,CAAiB,IAAI,CAAA;AACtC,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA,CAAKA,uBAAA,CAAiB,iBAAiB,CAAA;AAChE,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAKA,uBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAKA,uBAAA,CAAiB,YAAY,CAAA;AAEtD,IAAA,MAAA,CAAO,cAAA,CAAe,MAAM,OAAA,EAAS,EAAE,OAAO,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAAA,EAC1E;AAAA;AAAA,EAGA,IAAI,WAAA,GAAuB;AACzB,IAAA,OAAO,KAAK,KAAA,KAAU,MAAA;AAAA,EACxB;AAAA;AAAA,EAGA,SAAS,KAAA,EAAwB;AAC/B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,IAAA,EAAc,OAAA,GAA+D,EAAC,EAAY;AAChG,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,IAAA,EAAM,OAAA,CAAQ,OAAO,CAAA;AAE3G,IAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAEhC,IAAA,OAAO,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,IAAI,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,OAAkB,MAAM,CAAA;AAAA,EACzG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,QAAA,EAAkB,MAAA,EAAgB,OAAA,GAA+D,EAAC,EAAY;AAC1H,IAAA,OAAO,KAAK,cAAA,CAAe,MAAA,CAAO,QAAA,EAAU,MAAA,EAAQ,QAAQ,OAAO,CAAA;AAAA,EACrE;AAAA;AAAA,EAGA,SAAS,KAAA,EAAwB;AAC/B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,CAAS,SAAiB,MAAA,EAA2B;AACnD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AAErC,IAAA,OAAO,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,KAAU,MAAA,CAAO,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,IAAA,EAAwB;AAClC,IAAA,OAAO,QAAA,CAAS,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,MAAA,GAAkC;AAChC,IAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAY,GAAG,SAAQ,GAAI,IAAA;AAE9C,IAAA,OAAO,EAAE,GAAG,OAAA,EAAS,cAAA,EAAgB,KAAK,cAAA,CAAe,OAAA,EAAS,WAAA,EAAa,IAAA,CAAK,WAAA,EAAY;AAAA,EAClG;AACF;AAOO,SAAS,SAAS,KAAA,EAA0B;AACjD,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,SAAa,EAAC;AACnD,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,QAAQ,CAAC,IAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,KAAS,SAAY,EAAC,GAAI,CAAC,MAAA,CAAO,IAAI,CAAC,CAAE,CAAA;AAEpH,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AACtD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAE/B,MAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,SAAS,MAAM,CAAA;AAAA,IACnD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,CAAC,KAAK,CAAA;AAAA,IACf;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,MAAA,CAAO,KAAK,CAAC,CAAA;AACvB;AAEA,SAAS,OAAO,KAAA,EAAwB;AACtC,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAC7G;AAEA,SAAS,SAAA,CAAU,KAAA,EAAgB,KAAA,GAAQ,CAAA,EAA4B;AACrE,EAAA,IAAI,KAAA,GAAQ,KAAA;AAEZ,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,GAAQ,EAAA,EAAI,OAAO,MAAA;AAEtF,EAAA,MAAM,MAAA,GAAS,KAAA;AAEf,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,UAAU,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,GAAW,OAAO,SAAA,GAAY,MAAA;AAAA,IACpE,SAAS,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,MAAA;AAAA,IACvD,KAAA,EAAO,SAAA,CAAU,MAAA,CAAO,GAAA,EAAK,QAAQ,CAAC;AAAA,GACvC,CAAA;AACH;AAEA,SAAS,OAAO,KAAA,EAAkC;AAChD,EAAA,MAAME,QAAAA,GAAU,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA;AAEvH,EAAA,OAAOA,aAAY,MAAA,GAAY,MAAA,GAAY,IAAI,IAAA,CAAKA,WAAU,GAAI,CAAA;AACpE;AAEA,SAAS,UAAU,KAAA,EAAqC;AACtD,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,KAAA;AACvC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,EAAA,IAAI,KAAA,KAAU,SAAS,OAAO,KAAA;AAE9B,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,SAAS,MAAA,EAAqC;AACrD,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAC5B;AAEA,SAAS,qBAAqB,MAAA,EAAqC;AACjE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,KAAU;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,EAAY;AAE9B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAE1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AACH;;;ACrOO,SAAS,SAAA,CAAU,SAAqB,KAAA,EAAoD;AACjG,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,OAAA,KAA0C,YAAY,MAAS,CAAA;AAE9H,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAElC,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,CAAC,YAAY,OAAA,CAAQ,KAAA,KAAU,kCAAkC,CAAA,IAAK,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,QAAQ,KAAK,CAAA;AAE3I,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,SAAS,GAAA,CAAI,CAAC,YAAY,OAAA,CAAQ,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,IAC5D,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU,EAAC;AAAA,IAC/C,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU;AAAC,GACjD;AACF;AAKO,SAAS,YAAA,CAAa,MAAA,EAAoC,KAAA,GAAqB,KAAA,EAAmB;AACvG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAEvC,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,cAAA,EAAiB,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAAA,IAC3D,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,KAAA,KAAU,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,IACtD,MAAA,GACA;AAAA,MACE,SAAS,CAAA,oCAAA,EAAuC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,MAC7E,KAAA,EAAO,oBAAA;AAAA,MACP,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,GAAG;AAAA;AAC1B,GACR;AACF;AAKO,SAAS,WAAA,CACd,KAAA,EACA,OAAA,GAAoF,EAAC,EACzE;AACZ,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,KAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,OAAA,CAAQ,OAAO,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,gBAAgB,KAAK,CAAA,GAAA,EAAM,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA;AAAA,IAClE,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,IAAA,KAAS,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,SAAS,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,GACjF,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,oCAAA,EAAuC,KAAK,CAAA,GAAA,EAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA,CAAA;AAAI,GACnG;AACF;AAKO,SAAS,iBAAA,CAAkB,QAAA,EAAkB,MAAA,EAAgB,OAAA,GAA+D,EAAC,EAAe;AACjJ,EAAA,IAAI,CAAC,QAAA,EAAU,IAAA,EAAK,IAAK,CAAC,MAAA,EAAQ,IAAA,EAAK,EAAG,MAAM,IAAI,SAAA,CAAU,6CAA6C,CAAA;AAE3G,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,OAAA,CAAQ,OAAO,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAA,EAAI,MAAM,GAAG,IAAI,CAAA,CAAA;AAAA,IAC5D,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,cAAc,QAAA,EAAU,MAAA,EAAQ,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA,GAAI,MAAA,GAAY,EAAE,OAAA,EAAS,CAAA,gCAAA,EAAmC,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,EAAG,IAAI,CAAA,CAAA,CAAA;AAAI,GAChK;AACF;AAKO,SAAS,YAAA,CAAa,MAAA,EAAoC,KAAA,GAAqB,KAAA,EAAmB;AACvG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAEvC,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,cAAA,EAAiB,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC5D,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,UAAU,KAAA,EAAO,CAAC,KAAA,KAAU,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,CAAA,GACtD,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,yCAAA,EAA4C,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GACjG;AACF;AAMO,SAAS,YAAA,CAAa,SAAiB,MAAA,EAA8B;AAC1E,EAAA,IAAI,CAAC,IAAA,EAAM,IAAA,IAAQ,MAAM,IAAI,UAAU,kCAAkC,CAAA;AAEzE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,CAAA,cAAA,EAAiB,IAAI,CAAA,CAAA,GAAK,CAAA,cAAA,EAAiB,IAAI,CAAA,IAAA,EAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC1G,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,QAAA,CAAS,MAAM,GAAG,MAAM,CAAA,GACzB,MAAA,GACA,EAAE,OAAA,EAAS,OAAO,MAAA,KAAW,CAAA,GAAI,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAA,CAAA,GAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,gBAAA,EAAmB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GACjJ;AACF;AAKO,SAAS,oBAAoB,YAAA,EAAmC;AACrE,EAAA,MAAM,MAAA,GAAS,YAAA,EAAc,IAAA,EAAK,IAAK,MAAA;AAEvC,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,qBAAA,EAAwB,MAAA,IAAU,KAAK,CAAA,CAAA;AAAA,IACpD,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,YACJ,CAAC,CAAC,KAAK,cAAA,KACN,CAAC,UACA,IAAA,CAAK,iBAAA,EAAmB,aAAY,KAAM,MAAA,CAAO,aAAY,IAC7D,IAAA,CAAK,eAAe,WAAA,EAAY,KAAM,OAAO,WAAA,EAAY,CAAA;AAE7D,MAAA,OAAO,SAAA,GACH,SACA,EAAE,OAAA,EAAS,SAAS,CAAA,qCAAA,EAAwC,MAAM,MAAM,wCAAA,EAAyC;AAAA,IACvH;AAAA,GACF;AACF;AAKO,SAAS,2BAA2B,YAAA,EAAkC;AAC3E,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,YAAY,CAAA,IAAK,eAAe,CAAA,EAAG,MAAM,IAAI,UAAA,CAAW,mDAAmD,CAAA;AAEjI,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,kCAAkC,YAAY,CAAA,CAAA;AAAA,IAC3D,OAAO,CAAC,IAAA,KACN,IAAA,CAAK,mBAAA,KAAwB,UAAa,IAAA,CAAK,mBAAA,IAAuB,YAAA,GAClE,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,0CAAA,EAA6C,YAAY,CAAA,CAAA,CAAA,EAAK,OAAO,kCAAA;AAAmC,GAC3H;AACF;AAKO,SAAS,2BAAA,CAA4B,OAAA,EAAqC,KAAA,GAAqB,KAAA,EAAmB;AACvH,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,EAAS,uBAAuB,CAAA;AAExD,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,8BAAA,EAAiC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC5E,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,IAAA,GAAO,KAAK,qBAAA,CAAsB,GAAA,CAAI,CAAC,MAAA,KAAW,MAAA,CAAO,aAAa,CAAA;AAE5E,MAAA,OAAO,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,MAAA,KAAW,KAAK,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,CAAC,CAAA,GAC7E,SACA,EAAE,OAAA,EAAS,CAAA,iCAAA,EAAoC,KAAK,CAAA,GAAA,EAAM,QAAA,CAAS,KAAK,IAAI,CAAC,CAAA,CAAA,CAAA,EAAK,KAAA,EAAO,kCAAA,EAAmC;AAAA,IAClI;AAAA,GACF;AACF;AAKO,SAAS,cAAc,SAAA,EAAmD;AAC/E,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,EAAW,WAAW,CAAA;AAE9C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,eAAA,EAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAClD,OAAO,CAAC,IAAA,KACN,KAAK,QAAA,KAAa,MAAA,IAAa,SAAS,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,GAC1D,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,gDAAA,EAAmD,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA,CAAA;AAAK,GAC9F;AACF;AAKO,SAAS,SAAS,KAAA,EAAiC;AACxD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,OAAO,CAAA;AAAA,IAC/D,OAAO,CAAC,IAAA,KAAS,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK;AAAA,GAC3C;AACF;AAKO,SAAS,SAAS,KAAA,EAAiC;AACxD,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,gCAAgC,CAAA;AAE5E,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AAAA,IAC9D,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAErD,MAAA,OAAO,QAAA,CAAS,KAAK,CAAC,OAAA,KAAY,YAAY,MAAS,CAAA,GAAI,MAAA,GAAY,QAAA,CAAS,CAAC,CAAA;AAAA,IACnF;AAAA,GACF;AACF;AAEA,SAAS,MAAA,CAAO,QAAoC,IAAA,EAAwB;AAC1E,EAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAI,KAAK,OAAO,MAAA,KAAW,QAAA,GAAW,CAAC,MAAM,CAAA,GAAI,CAAC,GAAG,MAAM,GAAG,MAAA,CAAO,CAAC,UAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAC,CAAA;AAEhH,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG,MAAM,IAAI,SAAA,CAAU,CAAA,aAAA,EAAgB,IAAI,CAAA,aAAA,CAAe,CAAA;AAE9E,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAA,CAAU,QAAA,EAA6B,KAAA,EAAoB,KAAA,EAA4C;AAC9G,EAAA,OAAO,KAAA,KAAU,QAAQ,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,QAAA,CAAS,KAAK,KAAK,CAAA;AACtE;AAEA,SAAS,gBAAgB,OAAA,EAAoE;AAC3F,EAAA,OAAO,OAAA,IAAW,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACvF;AChPO,IAAM,iBAAA,GAAN,cAAgCC,kBAAA,CAAY;AAAA,EACxC,MAAA,GAAS,GAAA;AAAA;AAAA,EAET,KAAA;AAAA;AAAA,EAEA,WAAA;AAAA,EAET,WAAA,CAAY,WAAA,EAAiC,OAAA,GAAoE,EAAC,EAAG;AACnH,IAAA,KAAA,CAAM,eAAe,0CAAA,EAA4C,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,CAAA;AACzF,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,IAAW,OAAA,GAAU,OAAA,CAAQ,KAAA,GAAQ,eAAA;AAClD,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA,KAAgB,MAAA,GAAY,MAAA,GAAY,aAAa,WAAW,CAAA;AAAA,EACrF;AAAA;AAAA,EAGA,IAAI,eAAA,GAA0B;AAC5B,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,OAAO,QAAA;AAExB,IAAA,OAAO,IAAA,CAAK,WAAA,GAAc,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAK,CAAA,sBAAA,EAAyB,IAAA,CAAK,WAAW,CAAA,CAAA,CAAA,GAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAK,CAAA,CAAA,CAAA;AAAA,EACjI;AACF;AAKO,IAAM,oBAAA,GAAN,cAAmCA,kBAAA,CAAY;AAAA,EAC3C,MAAA,GAAS,GAAA;AAAA,EACT,OAAA;AAAA,EAET,YAAY,OAAA,EAA4B;AACtC,IAAA,KAAA,CAAM,QAAQ,OAAO,CAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,eAAA,GAAsC;AACxC,IAAA,OAAO,oBAAA,CAAqB,KAAK,OAAO,CAAA;AAAA,EAC1C;AACF;AAMO,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,EAAO,OAAO,MAAA;AAE3B,EAAA,MAAM,KAAA,GAAQ,iBAAiB,OAAA,CAAQ,KAAK,yBAAyB,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAA,CAAA;AAElG,EAAA,OAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG,KAAK,YAAY,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAC,CAAA,CAAA,CAAA,GAAM,KAAA;AAC9E;AAKO,SAAS,iBAAiB,KAAA,EAA0E;AACzG,EAAA,IAAI,KAAA,YAAiB,iBAAA;AACnB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,oDAAA;AAAA,MACN,KAAA,EAAO,cAAA;AAAA,MACP,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACV;AAEF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,oDAAA;AAAA,IACN,KAAA,EAAO,WAAA;AAAA,IACP,MAAA,EAAQ,GAAA;AAAA,IACR,MAAA,EAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,IAAW,oDAAA;AAAA,IACjC,GAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,IAC5D,GAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,GAC9D;AACF;AAOO,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,OAAO,CAAC,GAAG,IAAI,EAAE,GAAA,CAAI,CAAC,cAAe,SAAA,IAAa,GAAA,IAAO,aAAa,GAAA,IAAO,SAAA,KAAc,OAAO,SAAA,KAAc,IAAA,GAAO,YAAY,GAAI,CAAA,CAAE,KAAK,EAAE,CAAA;AAClJ;AAEA,SAAS,aAAa,KAAA,EAAuB;AAC3C,EAAA,OAAO,MAAM,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,MAAM,KAAK,CAAA;AACzD;ACHO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,QAAA,EACE,gNAAA;AAAA,EACF,WAAA,EAAa,kEAAA;AAAA,EACb,KAAA,EAAO,qBAAA;AAAA,EACP,SAAA,EAAW,+EAAA;AAAA,EACX,sBAAA,EAAwB;AAC1B;AAEA,IAAM,gBAAA,GAAmB,GAAA;AAOlB,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,MAAM,SAAA,GAAY,CAAC,GAAG,IAAI,GAAA,CAAA,CAAK,OAAO,OAAA,CAAQ,SAAA,KAAc,QAAA,GAAW,CAAC,OAAA,CAAQ,SAAS,CAAA,GAAI,CAAC,GAAI,OAAA,CAAQ,SAAA,IAAa,EAAG,CAAA,EAAG,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAC,CAAA;AAE9J,EAAA,IAAI,UAAU,MAAA,KAAW,CAAA,EAAG,MAAM,IAAIC,gCAAyB,8FAA8F,CAAA;AAE7J,EAAA,MAAM,UAAA,GAAaC,yBAAkB,OAAO,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAYC,mCAA4B,UAAU,CAAA;AACxD,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,MAAA;AAC/C,EAAA,MAAMC,QAAA,GAAS,cAAc,OAAO,CAAA;AAEpC,EAAA,IAAI,aAAA,KAAkB,UAAU,CAACA,QAAA;AAC/B,IAAA,MAAM,IAAIH,+BAAA;AAAA,MACR,0BAA0B,aAAa,CAAA,8GAAA;AAAA,KACzC;AAEF,EAAA,MAAM,eAAA,GAAkBF,cAAA,CAAQ,OAAA,CAAQ,0BAAA,EAA4B,IAAI,4BAA4B,CAAA;AACpG,EAAA,MAAM,YAAYA,cAAA,CAAQ,OAAA,CAAQ,SAAA,EAAW,EAAA,EAAI,WAAW,CAAA,GAAI,GAAA;AAChE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,eAAA,IAAmB,OAAA,CAAQ,gBAAgB,MAAA,GAAS,CAAA,GAAI,CAAC,GAAG,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAC,GAAGM,iCAA0B,CAAA;AAChJ,EAAA,MAAM,qBAAA,GAAwB,QAAQ,qBAAA,IAAyB,IAAA;AAC/D,EAAA,MAAM,gBAAyC,EAAE,UAAA,EAAY,QAAQ,UAAA,EAAY,WAAA,EAAa,QAAQ,WAAA,EAAY;AAClH,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAkE;AACpF,EAAA,IAAI,IAAA;AAEJ,EAAA,MAAM,UAAA,GAAa,OAAO,KAAA,EAAe,GAAA,EAAa,MAAA,KAAyE;AAC7H,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI;AACjC,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAE5B,IAAA,IAAI,MAAA,IAAU,MAAA,CAAO,KAAA,GAAQ,GAAA,SAAY,MAAA,CAAO,MAAA;AAEhD,IAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAEhB,IAAA,MAAM,MAAA,GAAS,MAAMD,QAAA,CAAQ,UAAA,CAAW,KAAA,EAAO,EAAE,aAAA,EAAeE,uBAAA,CAAiB,WAAA,EAAa,MAAA,EAAQ,CAAA;AAEtG,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAA;AAE3B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,GAAM,eAAA,EAAiB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,GAAA,GAAM,GAAA,GAAO,OAAO,iBAAiB,CAAA;AAE3H,IAAA,IAAI,QAAQ,GAAA,EAAK;AACf,MAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,gBAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,MAAM,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAM,CAAA;AAC3E,MAAA,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,IAClC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,WAAA,GAAc,OAAO,MAAA,KAAyB;AAClD,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAC3C,IAAA,MAAM,MAAM,QAAA,CAAS,QAAA;AAErB,IAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAIN,mBAAY,gDAAgD,CAAA;AAEhF,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,GAAA,SAAY,EAAE,GAAA,EAAK,GAAA,EAAKO,uBAAA,CAAmB,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG,EAAE,CAACC,gBAAW,GAAG,UAAA,CAAW,OAAO,eAAA,EAAiB,UAAA,CAAW,aAAA,EAAe,CAAA,EAAE;AAEnK,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,EACd,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,EAAe,MAAA,KAA8C;AACpF,IAAA,IAAIC,8BAAuB,KAAK,CAAA,QAAS,IAAI,iBAAA,CAAkB,8BAA8B,SAAS,CAAA;AAEtG,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,YAAY,MAAM,CAAA;AAAA,IACnC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,iBAAA,CAAkB,6BAAA,CAA8B,wBAAwB,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IACpG;AAEA,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,OAAO,MAAA,EAAQ;AAAA,QAC5C,QAAQ,UAAA,CAAW,MAAA;AAAA,QACnB,QAAA,EAAU,SAAA;AAAA,QACV,UAAA;AAAA,QACA,cAAA,EAAgB,SAAA;AAAA,QAChB,cAAA,EAAgB,CAAC,KAAK,CAAA;AAAA,QACtB,aAAa,IAAI,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,KAAK;AAAA,OAC7C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,CAAmB,KAAA,EAAO,SAAA,EAAW,KAAK,CAAA,EAAG,EAAE,KAAA,EAAO,KAAA,EAAO,CAAA;AAAA,IAC3F;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,GAAW,QAAQ,GAAA,GAAM,MAAA;AAE7D,IAAA,IAAI,qBAAA,IAAyB,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,aAAY,KAAM,QAAA;AACxE,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,sDAAA,EAAyD,IAAI,CAAA,EAAA,CAAI,CAAA;AAE/F,IAAA,IAAI,kBAAkB,aAAA,EAAe,MAAM,aAAA,CAAc,KAAA,EAAO,SAAS,MAAM,CAAA;AAE/E,IAAA,OAAO,IAAI,UAAA,CAAW,OAAA,EAAS,aAAA,EAAe,KAAK,CAAA;AAAA,EACrD,CAAA;AAEA,EAAA,MAAM,aAAA,GAAgB,OAAO,KAAA,EAAe,OAAA,EAAqB,MAAA,KAAyB;AACxF,IAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,QAAQ,GAAG,CAAA,CAAA,GAAK,MAAM,WAAA,CAAY,KAAK,CAAA;AACxE,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,UAAA,CAAW,KAAA,EAAO,GAAA,EAAK,MAAM,CAAA;AAAA,IAC9C,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,MAAA,EAAQ,SAAS,MAAM,KAAA;AAC3B,MAAA,MAAM,IAAI,iBAAA,CAAkB,6BAAA,CAA8B,aAAa,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IACzF;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,QAAQ,CAAA;AAAA,EACjF,CAAA;AAEA,EAAA,MAAM,qBAAA,GAAwB,OAAO,KAAA,EAAe,MAAA,KAA8C;AAChG,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,UAAA,CAAW,KAAA,EAAO,MAAM,WAAA,CAAY,KAAK,GAAG,MAAM,CAAA;AAAA,IACnE,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,MAAA,EAAQ,SAAS,MAAM,KAAA;AAC3B,MAAA,MAAM,IAAI,iBAAA,CAAkB,6BAAA,CAA8B,aAAa,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IACzF;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,QAAQ,CAAA;AAE/E,IAAA,IAAI,MAAA,CAAO,GAAA,IAAO,MAAA,CAAO,GAAA,KAAQ,UAAA,CAAW,MAAA,EAAQ,MAAM,IAAI,iBAAA,CAAkB,CAAA,YAAA,EAAe,MAAA,CAAO,GAAG,CAAA,YAAA,CAAc,CAAA;AAEvH,IAAA,MAAM,iBAAiB,CAAC,MAAA,CAAO,OAAO,EAAE,EAAE,IAAA,EAAK;AAE/C,IAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,CAAC,QAAA,KAAa,UAAU,QAAA,CAAS,QAAQ,CAAC,CAAA,QAAS,IAAI,iBAAA,CAAkB,gBAAA,CAAiB,cAAA,EAAgB,SAAS,CAAC,CAAA;AAE7I,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IAAA,CAAa,MAAA,CAAO,MAAM,SAAA,IAAa,GAAA,IAAQ,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI;AAC5F,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,sBAAA,EAAyB,IAAI,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,CAAG,CAAA;AAEnG,IAAA,MAAM,EAAE,QAAQ,OAAA,EAAS,UAAA,EAAY,WAAW,QAAA,EAAU,GAAG,SAAQ,GAAI,MAAA;AACzE,IAAA,MAAM,MAAA,GAAkC,EAAE,GAAG,OAAA,EAAQ;AAErD,IAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,OAAO,GAAA,KAAQ,MAAA,SAAkB,GAAA,GAAM,SAAA;AAC5E,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,kBAAA,KAAuB,MAAA,SAAkB,kBAAA,GAAqB,QAAA;AACzG,IAAA,IAAI,OAAO,OAAO,SAAA,KAAc,QAAA,IAAY,OAAO,GAAA,KAAQ,MAAA,EAAW,MAAA,CAAO,GAAA,GAAM,MAAA,CAAO,SAAA;AAE1F,IAAA,MAAM,OAAO,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,MAAA;AAE3D,IAAA,IAAI,qBAAA,IAAyB,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,aAAY,KAAM,QAAA;AACxE,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,sDAAA,EAAyD,IAAI,CAAA,EAAA,CAAI,CAAA;AAE/F,IAAA,OAAO,IAAI,UAAA,CAAW,MAAA,EAAQ,aAAA,EAAe,KAAK,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAAe,MAAA,KAA8C;AACjF,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,EAAK,EAAG,MAAM,IAAI,iBAAA,CAAkB,6BAAA,CAA8B,KAAK,CAAA;AAE/G,IAAA,OAAO,aAAA,KAAkB,mBAAA,GAAsB,qBAAA,CAAsB,KAAA,CAAM,IAAA,EAAK,EAAG,MAAM,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,IAAA,EAAK,EAAG,MAAM,CAAA;AAAA,EAC7H,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,YACAN,QAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAM,yBAAA,CAA0B,MAAA,EAAQ,MAAA,EAAQ;AAC9C,MAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AAEpC,MAAA,IAAI,KAAA,KAAU,QAAW,MAAM,IAAI,kBAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAA;AAEpF,MAAA,OAAO,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAKO,SAAS,gBAAgB,MAAA,EAAuD;AACrF,EAAA,MAAM,KAAA,GAAQ,yBAAA,CAA0B,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAEzD,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAOA,eAAsB,YAAY,KAAA,EAAgC;AAChE,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW,MAAM,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAEpG,EAAA,OAAO,SAAS,CAAC,GAAG,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,CAAA;AACxF;AAEA,SAAS,cAAc,OAAA,EAA0D;AAC/E,EAAA,MAAM,QAAQ,OAAA,CAAQ,MAAA;AAEtB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAE5B,EAAA,OAAOO,yBAAA,CAAmB;AAAA,IACxB,GAAG,KAAA;AAAA,IACH,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,IAChC,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,OAAO,OAAA,CAAQ;AAAA,GACO,CAAA;AAC1B;AAEA,SAAS,SAAS,KAAA,EAAuC;AACvD,EAAA,OAAO,OAAQ,KAAA,CAAuB,UAAA,KAAe,UAAA,IAAc,OAAQ,MAAuB,MAAA,KAAW,QAAA;AAC/G;AAEA,SAAS,kBAAA,CAAmB,KAAA,EAAgB,SAAA,EAA8B,KAAA,EAAmC;AAC3G,EAAA,IAAI,KAAA,YAAiBC,YAAO,UAAA,EAAY;AACtC,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA;AAE1B,IAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,CAAA,sBAAA,EAAyB,IAAI,IAAA,CAAK,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,CAAA,GAAM,uBAAA;AAAA,EACpG;AAEA,EAAA,IAAI,KAAA,YAAiBA,YAAO,wBAAA,EAA0B;AACpD,IAAA,QAAQ,MAAM,KAAA;AAAO,MACnB,KAAK,KAAA;AACH,QAAA,OAAO,gBAAA,CAAiB,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,IAAO,EAAE,CAAA,CAAE,IAAA,EAAK,EAAG,SAAS,CAAA;AAAA,MACrE,KAAK,KAAA;AACH,QAAA,OAAO,CAAA,YAAA,EAAe,KAAA,CAAM,OAAA,CAAQ,GAAA,IAAO,EAAE,CAAA,YAAA,CAAA;AAAA,MAC/C,KAAK,KAAA;AACH,QAAA,OAAO,OAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,KAAQ,WAAW,CAAA,+BAAA,EAAkC,IAAI,IAAA,CAAK,KAAA,CAAM,QAAQ,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,CAAA,GAAM,4BAAA;AAAA,MACzI,KAAK,KAAA;AACH,QAAA,OAAO,6BAAA;AAAA,MACT;AACE,QAAA,OAAO,CAAA,YAAA,EAAe,MAAM,KAAK,CAAA,iBAAA,CAAA;AAAA;AACrC,EACF;AAEA,EAAA,IAAI,KAAA,YAAiBA,WAAA,CAAO,8BAAA,EAAgC,OAAO,0BAAA;AACnE,EAAA,IAAI,KAAA,YAAiBA,WAAA,CAAO,iBAAA,EAAmB,OAAO,iCAAA;AACtD,EAAA,IAAI,iBAAiBA,WAAA,CAAO,iBAAA,SAA0B,CAAA,eAAA,EAAkB,WAAA,CAAY,KAAK,CAAC,CAAA,kBAAA,CAAA;AAC1F,EAAA,IAAI,iBAAiBA,WAAA,CAAO,WAAA,IAAe,iBAAiBA,WAAA,CAAO,WAAA,SAAoB,6BAAA,CAA8B,sBAAA;AACrH,EAAA,IAAI,iBAAiBA,WAAA,CAAO,UAAA,IAAc,KAAA,YAAiBA,WAAA,CAAO,YAAY,OAAO,wBAAA;AAErF,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,gBAAA,CAAiB,gBAAmC,SAAA,EAAsC;AACjG,EAAA,MAAM,QAAQ,cAAA,CAAe,MAAA,KAAW,CAAA,GAAI,EAAA,GAAK,IAAI,cAAA,CAAe,GAAA,CAAI,CAAC,QAAA,KAAa,IAAI,QAAQ,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,OAAO,CAAC,CAAA,CAAA;AACpH,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,KAAa,IAAI,QAAQ,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AAEzE,EAAA,OAAO,SAAA,CAAU,MAAA,KAAW,CAAA,GACxB,CAAA,oDAAA,EAAuD,KAAK,CAAA,QAAA,EAAW,QAAQ,CAAA,iDAAA,CAAA,GAC/E,CAAA,oDAAA,EAAuD,KAAK,CAAA,QAAA,EAAW,QAAQ,CAAA,0DAAA,CAAA;AACrF;AAEA,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAOC,0BAAA,CAAsB,KAAK,CAAA,CAAE,OAAO,EAAE,CAAA;AAAA,EACtD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;ACpRO,SAAS,qBAAqB,OAAA,EAA+C;AAClF,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,IAAI,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA,CAAE,MAAA,CAAO,CAAC,MAAA,KAA6B,CAAC,CAAC,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAEhI,EAAA,IAAI,QAAQ,MAAA,KAAW,CAAA,EAAG,MAAM,IAAIZ,gCAAyB,4CAA4C,CAAA;AAEzG,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAASa,kBAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AACvC,EAAA,MAAM,QAAA,GAAA,CAAY,OAAA,CAAQ,mBAAA,IAAuB,KAAA,IAAU,GAAA;AAC3D,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,GAAO,IAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,aAAA,IAAiB,UAAU,KAAK,CAAA;AACnE,EAAA,MAAM,WAA8D,EAAC;AAErE,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC/B,WAAA;AAAA,IACA,EAAA,CAAG,MAAc,OAAA,EAA+B;AAC9C,MAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,UAAU,qCAAqC,CAAA;AAEpE,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC/B,MAAA,OAAO,QAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,OAAO,QAAA,EAAU;AACrB,MAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,GAAI,QAAA,CAAS,IAAA;AAEpG,MAAA,IAAI,IAAA,CAAK,aAAa,WAAA,EAAa,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAQ,WAAA,EAAY;AAE7E,MAAA,MAAM,SAAA,GAAY,QAAA,CAAS,QAAA,CAAS,OAAA,EAASC,4BAAqB,SAAS,CAAA;AAC3E,MAAA,IAAI,OAAA,GAAU,2BAAA;AAEd,MAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,QAAA,MAAM,MAAA,GAAS,MAAMC,6BAAA,CAAuB,SAAA,EAAW,IAAA,EAAM,MAAA,EAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,KAAA,CAAM,GAAA,EAAI,EAAG,CAAA;AAEpG,QAAA,IAAI,OAAO,KAAA,EAAO;AAChB,UAAA,OAAA,GAAU,EAAA;AACV,UAAA;AAAA,QACF;AAEA,QAAA,OAAA,GAAU,MAAA,CAAO,MAAA;AAAA,MACnB;AAEA,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,OAAA,GAAU,IAAI,KAAA,CAAM,OAAO,GAAG,EAAE,MAAA,EAAQ,YAAY,CAAA;AAC5D,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,UAAA,EAAW;AAAA,MAC3C;AAEA,MAAA,MAAM,KAAA,GAAQC,4BAAqB,IAAI,CAAA;AAEvC,MAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAQ,YAAA,EAAa;AAEvD,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,QAAA,CAAS,OAAA,EAASF,2BAAA,CAAqB,OAAO,CAAA,EAAG,IAAA,EAAK,IAAK,MAAA,CAAO,KAAA,CAAM,EAAA,IAAM,EAAE,CAAA;AAEzG,MAAA,IAAI,OAAA,IAAW,CAAE,MAAM,KAAA,CAAM,SAAS,OAAA,EAAS,QAAQ,CAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,aAAa,KAAA,EAAM;AAE5G,MAAA,IAAI;AACF,QAAA,KAAA,MAAW,EAAE,IAAA,EAAM,OAAA,EAAQ,IAAK,QAAA,EAAU,IAAI,IAAA,KAAS,GAAA,IAAO,IAAA,KAAS,KAAA,CAAM,IAAA,EAAM,MAAM,QAAQ,KAAK,CAAA;AAAA,MACxG,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA;AACxC,QAAA,OAAA,CAAQ,OAAA,GAAU,OAAO,EAAE,MAAA,EAAQ,kBAAkB,OAAA,EAAS,SAAA,EAAW,KAAA,CAAM,IAAA,EAAM,CAAA;AACrF,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,kBAAkB,KAAA,EAAM;AAAA,MACxD;AAEA,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,WAAW,KAAA,EAAM;AAAA,IACjD;AAAA,GACF;AAEA,EAAA,OAAO,QAAA;AACT;AAKO,SAAS,8BAAA,CAA+B,QAAqBD,kBAAA,EAA8C;AAChH,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAoB;AAErC,EAAA,OAAO;AAAA,IACL,QAAA,CAAS,SAAS,QAAA,EAAU;AAC1B,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,EAAI;AAEtB,MAAA,KAAA,MAAW,CAAC,EAAA,EAAII,MAAK,CAAA,IAAK,IAAA,EAAM;AAC9B,QAAA,IAAIA,SAAQ,GAAA,EAAK;AACjB,QAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,MAChB;AAEA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA;AAE9B,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,GAAQ,GAAA,EAAK,OAAO,KAAA;AAE/C,MAAA,IAAA,CAAK,OAAO,OAAO,CAAA;AACnB,MAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,GAAA,GAAM,QAAQ,CAAA;AAChC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,QAAQ,OAAA,EAAS;AACf,MAAA,IAAA,CAAK,OAAO,OAAO,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAEA,SAAS,YAAA,CAAa,eAAmE,KAAA,EAAqD;AAC5I,EAAA,IAAI,aAAA,KAAkB,QAAQ,OAAO,EAAE,UAAU,MAAM,IAAA,EAAM,OAAA,EAAS,MAAM,MAAA,EAAU;AACtF,EAAA,IAAI,aAAA,KAAkB,QAAA,EAAU,OAAO,8BAAA,CAA+B,KAAK,CAAA;AAE3E,EAAA,OAAO,aAAA;AACT;AAEA,SAAS,QAAA,CAAS,SAAkE,IAAA,EAAkC;AACpH,EAAA,IAAI,OAAQ,QAAoB,GAAA,KAAQ,UAAA,SAAoB,OAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAE7F,EAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAEhC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAwD,CAAA,EAAG;AACnG,IAAA,IAAI,GAAA,CAAI,WAAA,EAAY,KAAM,MAAA,EAAQ,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA;AAAA,EAC7E;AAEA,EAAA,OAAO,MAAA;AACT;AC7KO,SAAS,qBAAA,CAAsB,OAAA,EAA8C,KAAA,GAAsB,UAAA,CAAW,KAAA,EAAqB;AACxI,EAAA,MAAM,KAAA,GAAQ,QAAQ,OAAO,CAAA;AAE7B,EAAA,OAAO,CAAC,OAAO,IAAA,KAAS;AACtB,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAEpC,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,EAAM,YAAY,KAAA,YAAiB,OAAA,GAAU,KAAA,CAAM,OAAA,GAAU,MAAA,CAAU,CAAA;AAEnG,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAE9C,IAAA,OAAO,MAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC1C,CAAA;AACF;AAyBO,SAAS,iBAAiB,OAAA,EAAuI;AACtK,EAAA,MAAM,UAAEd,UAAO,GAAI,OAAA;AACnB,EAAA,MAAM,KAAA,GAAQe,oBAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAC1C,EAAA,MAAM,WAAA,GAAA,CAAe,KAAA,IAAS,EAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA;AAC5E,EAAA,MAAM,SAASpB,cAAAA,CAAQ,OAAA,CAAQ,gBAAA,EAAkBqB,qBAAA,CAAe,kBAAkB,kBAAkB,CAAA;AACpG,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA0C;AAC9D,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAmD;AAEvE,EAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,KAAqC;AACxD,IAAA,MAAM,KAAA,GAAQ,QAAQ,OAAO,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,QAAA,GAAW,SAAY,OAAA,CAAQ,OAAA;AAE9D,IAAA,OAAO,CAAA,EAAG,GAAA,GAAM,CAAA,IAAA,EAAO,GAAG,KAAK,MAAM,WAAA,CAAY,KAAK,CAAC,CAAA,CAAA,EAAI,OAAA,CAAQ,QAAA,IAAY,EAAE,IAAI,WAAW,CAAA,CAAA;AAAA,EAClG,CAAA;AAEA,EAAA,MAAM,QAAA,GAAyC,OAAO,OAAA,EAAS,MAAA,KAAW;AACxE,IAAA,MAAM,QAAA,GAAW,QAAQ,OAAO,CAAA;AAEhC,IAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAIpB,mBAAY,yEAAyE,CAAA;AAE9G,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAQ,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE9B,IAAA,IAAI,MAAA,IAAUI,SAAO,UAAA,CAAW,KAAA,CAAM,KAAI,GAAI,MAAA,CAAO,WAAW,OAAO,MAAA;AAEvE,IAAA,IAAI,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE7B,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAA,GAAUA,SAAO,MAAA,CACd,QAAA,CAAS,EAAE,YAAA,EAAc,UAAU,MAAA,EAAQ,KAAA,EAAO,QAAA,EAAU,OAAA,CAAQ,UAAU,MAAA,EAAQ,CAAA,CACtF,IAAA,CAAK,CAAC,QAAA,KAAa;AAClB,QAAA,MAAM,KAAA,GAAQiB,gCAAyB,QAAA,EAAUjB,QAAA,CAAO,WAAW,KAAA,CAAM,GAAA,IAAO,MAAM,CAAA;AAEtF,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AACtB,QAAA,OAAO,KAAA;AAAA,MACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAC,CAAA;AACpC,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,IAC1B;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,UAAA,GAA6C,OAAO,OAAA,EAAS,WAAA,KAAgB;AACjF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAO,CAAA;AAE/B,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,GAAG,GAAG,WAAA,KAAgB,WAAA,EAAa,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA;AAAA,EACpG,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAA,CAAM,OAAA,EAAS,KAAA,GAAQA,QAAA,CAAO,WAAW,KAAA,EAAO;AAC9C,MAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,QAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AACvC,QAAA,MAAM,OAAO,OAAA,CAAQ,IAAA,GAAO,MAAM,OAAA,CAAQ,aAAY,GAAI,MAAA;AAC1D,QAAA,MAAM,OAAA,GAAU,CAACkB,MAAAA,KAAwC;AACvD,UAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAE3C,UAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAGA,MAAAA,CAAM,SAAS,CAAA,CAAA,EAAIA,MAAAA,CAAM,WAAW,CAAA,CAAE,CAAA;AAEtE,UAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,EAAE,QAAQ,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,QAAQ,OAAA,CAAQ,MAAA,EAAQ,QAAA,EAAU,OAAA,CAAQ,UAAU,CAAA;AAAA,QACzH,CAAA;AAEA,QAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,QAAQ,MAAM,CAAA;AACpD,QAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,KAAK,CAAA;AAEpC,QAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,EAAK,OAAO,QAAA;AAEpC,QAAA,MAAM,UAAA,CAAW,OAAA,EAAU,KAAA,CAAM,WAAW,CAAA;AAE5C,QAAA,OAAO,QAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,MACxD,CAAA;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,QAAQ,OAAA,EAAkE;AACjF,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,OAAA,CAAQ,KAAA;AACzD","file":"index.cjs","sourcesContent":["import { AuthioClaimTypes, parseResourceAccess, type AuthioResourceAccess, type AuthioResourceAccessSource } from \"@hyper.authio/client\";\n\n/**\n * The party acting for the subject, from the `act` claim (RFC 8693): who exchanged the token, nested when the chain\n * is longer.\n */\nexport interface AuthioActor {\n  readonly clientId: string | undefined;\n  readonly subject: string | undefined;\n  readonly actor: AuthioActor | undefined;\n}\n\n/**\n * Where the user reads flat (non-`*_resource_access`) roles and groups from.\n */\nexport interface AuthioUserClaimSettings {\n  /**\n   * Claims holding role names directly, such as one written by a claim mapper with the Role source. They count for\n   * `hasRole` without a source filter. Defaults to `[\"role\"]`.\n   */\n  roleClaims?: readonly string[];\n  /**\n   * Claims holding group names, such as one written by a claim mapper with the Group source. Defaults to\n   * `[\"groups\"]`.\n   */\n  groupClaims?: readonly string[];\n}\n\n/**\n * The caller of an API, read from a validated access token or an introspection answer: identity, every form of\n * permission Authio issues, and the raw claims for anything else.\n */\nexport class AuthioUser {\n  /** `sub`: the person's id, or the credential's for a machine caller. */\n  readonly subject: string;\n  /** The client the token was issued to (`azp`, else `client_id`). */\n  readonly clientId: string | undefined;\n  /** `sid`. */\n  readonly sessionId: string | undefined;\n  /** `jti`. */\n  readonly tokenId: string | undefined;\n  /** `aud`. */\n  readonly audiences: readonly string[];\n  /** The granted scopes. */\n  readonly scopes: readonly string[];\n  /** The roles of the seven `*_resource_access` claims, with their source and permissions. */\n  readonly resourceAccess: AuthioResourceAccess;\n  /** Every role name: the `*_resource_access` roles, then the flat role claims. */\n  readonly roles: readonly string[];\n  /** Resource → every method any role allows on it. */\n  readonly permissions: Readonly<Record<string, readonly string[]>>;\n  /** The group names of the group claims. */\n  readonly groups: readonly string[];\n  /** `org_id`. */\n  readonly organizationId: string | undefined;\n  /** `org_alias`. */\n  readonly organizationAlias: string | undefined;\n  /** `account_id`. */\n  readonly accountId: string | undefined;\n  /** `acr`. */\n  readonly acr: string | undefined;\n  /** `acr` as a number: 1 one factor, 2 several, 3 one of them phishing-resistant. */\n  readonly authenticationLevel: number | undefined;\n  /** `amr`. */\n  readonly authenticationMethods: readonly string[];\n  /** `idp`. */\n  readonly identityProvider: string | undefined;\n  /** `auth_time`. */\n  readonly authenticatedAt: Date | undefined;\n  /** `act`. */\n  readonly actor: AuthioActor | undefined;\n  /** `delegation_id`. */\n  readonly delegationId: string | undefined;\n  readonly email: string | undefined;\n  readonly emailVerified: boolean | undefined;\n  readonly name: string | undefined;\n  readonly preferredUsername: string | undefined;\n  /** `credential_type`, on a token issued to an account credential or a consumer. */\n  readonly credentialType: string | undefined;\n  /** `credential_id`. */\n  readonly credentialId: string | undefined;\n  /** Every claim, as the token or the introspection answer carried it. */\n  readonly claims: Readonly<Record<string, unknown>>;\n  /** The access token the user was read from. Not enumerable, so it stays out of logs and JSON. */\n  declare readonly token: string | undefined;\n\n  private readonly flatRoles: readonly string[];\n\n  /**\n   * @param claims The token's payload, or the introspection answer's members.\n   * @param settings Where flat roles and groups are read from.\n   * @param token The access token, kept for forwarding and on-behalf-of.\n   */\n  constructor(claims: Readonly<Record<string, unknown>>, settings: AuthioUserClaimSettings = {}, token?: string) {\n    const text = (name: string) => (typeof claims[name] === \"string\" && claims[name] ? (claims[name] as string) : undefined);\n\n    this.claims = Object.freeze({ ...claims });\n    this.subject = text(AuthioClaimTypes.Subject) ?? \"\";\n    this.clientId = text(AuthioClaimTypes.AuthorizedParty) ?? text(AuthioClaimTypes.ClientId);\n    this.sessionId = text(AuthioClaimTypes.SessionId);\n    this.tokenId = text(AuthioClaimTypes.JwtId);\n    this.audiences = Object.freeze(distinct(valuesOf(claims[AuthioClaimTypes.Audience])));\n    this.scopes = Object.freeze(distinct(valuesOf(claims[AuthioClaimTypes.Scope]).flatMap((scope) => scope.split(/\\s+/)).filter(Boolean)));\n    this.resourceAccess = parseResourceAccess(claims);\n    this.flatRoles = Object.freeze((settings.roleClaims ?? [\"role\"]).flatMap((name) => valuesOf(claims[name])));\n    this.roles = Object.freeze(distinctIgnoringCase([...this.resourceAccess.roles, ...this.flatRoles]));\n    this.permissions = this.resourceAccess.permissions;\n    this.groups = Object.freeze(distinct((settings.groupClaims ?? [\"groups\"]).flatMap((name) => valuesOf(claims[name]))));\n    this.organizationId = text(AuthioClaimTypes.OrganizationId);\n    this.organizationAlias = text(AuthioClaimTypes.OrganizationAlias);\n    this.accountId = text(AuthioClaimTypes.AccountId);\n    this.acr = valuesOf(claims[AuthioClaimTypes.AuthenticationContextClass])[0];\n    this.authenticationLevel = this.acr !== undefined && /^\\d+$/.test(this.acr) ? Number(this.acr) : undefined;\n    this.authenticationMethods = Object.freeze(distinctIgnoringCase(valuesOf(claims[AuthioClaimTypes.AuthenticationMethods])));\n    this.identityProvider = text(AuthioClaimTypes.IdentityProvider);\n    this.authenticatedAt = toDate(claims[AuthioClaimTypes.AuthTime]);\n    this.actor = readActor(claims[AuthioClaimTypes.Actor]);\n    this.delegationId = text(AuthioClaimTypes.DelegationId);\n    this.email = text(AuthioClaimTypes.Email);\n    this.emailVerified = toBoolean(claims[AuthioClaimTypes.EmailVerified]);\n    this.name = text(AuthioClaimTypes.Name);\n    this.preferredUsername = text(AuthioClaimTypes.PreferredUsername);\n    this.credentialType = text(AuthioClaimTypes.CredentialType);\n    this.credentialId = text(AuthioClaimTypes.CredentialId);\n\n    Object.defineProperty(this, \"token\", { value: token, enumerable: false });\n  }\n\n  /** Whether an actor exchanged the token on the subject's behalf. */\n  get isDelegated(): boolean {\n    return this.actor !== undefined;\n  }\n\n  /** Whether the scope was granted. */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope);\n  }\n\n  /**\n   * Whether the user holds the role. Without sources, from any `*_resource_access` claim or a flat role claim; with\n   * sources, only from those `*_resource_access` claims.\n   */\n  hasRole(role: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): boolean {\n    if (!role) return false;\n    if (options.sources && options.sources.length > 0) return this.resourceAccess.hasRole(role, options.sources);\n\n    const wanted = role.toLowerCase();\n\n    return this.resourceAccess.hasRole(role) || this.flatRoles.some((name) => name.toLowerCase() === wanted);\n  }\n\n  /**\n   * Authio's grant rule: whether a role (from any source, or only from the given ones) allows `method` on\n   * `resource`. Case-insensitive.\n   */\n  hasPermission(resource: string, method: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): boolean {\n    return this.resourceAccess.grants(resource, method, options.sources);\n  }\n\n  /** Whether the user is in the group (exact match). */\n  hasGroup(group: string): boolean {\n    return this.groups.includes(group);\n  }\n\n  /**\n   * Whether the claim is present (not `null`), and, given values, whether it holds one of them (exact match; an\n   * array claim matches when any item does).\n   */\n  hasClaim(type: string, ...values: string[]): boolean {\n    const present = this.claimValues(type);\n\n    return values.length === 0 ? present.length > 0 : present.some((value) => values.includes(value));\n  }\n\n  /**\n   * The claim's values as text: one for a scalar, one per item for an array, JSON text for an object.\n   */\n  claimValues(type: string): string[] {\n    return valuesOf(this.claims[type]);\n  }\n\n  /** Every member but the raw token. */\n  toJSON(): Record<string, unknown> {\n    const { flatRoles: _flatRoles, ...members } = this as unknown as Record<string, unknown>;\n\n    return { ...members, resourceAccess: this.resourceAccess.entries, isDelegated: this.isDelegated };\n  }\n}\n\n/**\n * A claim's values as text.\n *\n * @internal\n */\nexport function valuesOf(value: unknown): string[] {\n  if (value === undefined || value === null) return [];\n  if (Array.isArray(value)) return value.flatMap((item) => (item === null || item === undefined ? [] : [toText(item)]));\n\n  if (typeof value === \"string\" && value.startsWith(\"[\")) {\n    try {\n      const parsed = JSON.parse(value) as unknown;\n\n      if (Array.isArray(parsed)) return valuesOf(parsed);\n    } catch {\n      return [value];\n    }\n  }\n\n  return [toText(value)];\n}\n\nfunction toText(value: unknown): string {\n  return typeof value === \"string\" ? value : typeof value === \"object\" ? JSON.stringify(value) : String(value);\n}\n\nfunction readActor(value: unknown, depth = 0): AuthioActor | undefined {\n  let actor = value;\n\n  if (typeof actor === \"string\") {\n    try {\n      actor = JSON.parse(actor);\n    } catch {\n      return undefined;\n    }\n  }\n\n  if (!actor || typeof actor !== \"object\" || Array.isArray(actor) || depth > 16) return undefined;\n\n  const record = actor as Record<string, unknown>;\n\n  return Object.freeze({\n    clientId: typeof record.client_id === \"string\" ? record.client_id : undefined,\n    subject: typeof record.sub === \"string\" ? record.sub : undefined,\n    actor: readActor(record.act, depth + 1),\n  });\n}\n\nfunction toDate(value: unknown): Date | undefined {\n  const seconds = typeof value === \"number\" ? value : typeof value === \"string\" && /^\\d+$/.test(value) ? Number(value) : undefined;\n\n  return seconds === undefined ? undefined : new Date(seconds * 1000);\n}\n\nfunction toBoolean(value: unknown): boolean | undefined {\n  if (typeof value === \"boolean\") return value;\n  if (value === \"true\") return true;\n  if (value === \"false\") return false;\n\n  return undefined;\n}\n\nfunction distinct(values: readonly string[]): string[] {\n  return [...new Set(values)];\n}\n\nfunction distinctIgnoringCase(values: readonly string[]): string[] {\n  const seen = new Set<string>();\n\n  return values.filter((value) => {\n    const key = value.toLowerCase();\n\n    if (seen.has(key)) return false;\n\n    seen.add(key);\n    return true;\n  });\n}\n","import type { AuthioResourceAccessSource } from \"@hyper.authio/client\";\nimport type { AuthioUser } from \"./user.js\";\n\n/**\n * How several required values combine.\n */\nexport type AuthioMatch = \"any\" | \"all\";\n\n/**\n * Why a rule refused the caller.\n */\nexport interface AuthioRuleFailure {\n  /** What is missing, in words. */\n  readonly message: string;\n  /**\n   * The RFC 6750 / RFC 9470 error to put in `WWW-Authenticate`: `insufficient_scope` for scopes,\n   * `insufficient_user_authentication` for `acr`/`amr`, none otherwise.\n   */\n  readonly error?: \"insufficient_scope\" | \"insufficient_user_authentication\";\n  /** The required scopes, for `insufficient_scope`. */\n  readonly scope?: string;\n}\n\n/**\n * A condition on the caller.\n */\nexport interface AuthioRule {\n  /** What the rule requires, for logs. */\n  readonly description: string;\n  /** `undefined` when the caller satisfies the rule, else why not. */\n  check(user: AuthioUser): AuthioRuleFailure | undefined;\n}\n\n/**\n * Checks every rule. On refusal the message joins every rule's, and the error is the one asking for a stronger\n * sign-in, else the first one that has an error.\n */\nexport function authorize(user: AuthioUser, ...rules: AuthioRule[]): AuthioRuleFailure | undefined {\n  const failures = rules.map((rule) => rule.check(user)).filter((failure): failure is AuthioRuleFailure => failure !== undefined);\n\n  if (failures.length === 0) return undefined;\n\n  const bearer = failures.find((failure) => failure.error === \"insufficient_user_authentication\") ?? failures.find((failure) => failure.error);\n\n  return {\n    message: failures.map((failure) => failure.message).join(\" \"),\n    ...(bearer?.error ? { error: bearer.error } : {}),\n    ...(bearer?.scope ? { scope: bearer.scope } : {}),\n  };\n}\n\n/**\n * Requires granted scopes.\n */\nexport function requireScope(scopes: string | readonly string[], match: AuthioMatch = \"any\"): AuthioRule {\n  const required = listOf(scopes, \"scope\");\n\n  return {\n    description: `Authio scope (${match}): ${required.join(\" \")}`,\n    check: (user) =>\n      satisfies(required, match, (scope) => user.hasScope(scope))\n        ? undefined\n        : {\n            message: `The token lacks the required scope (${match}): ${required.join(\" \")}.`,\n            error: \"insufficient_scope\",\n            scope: required.join(\" \"),\n          },\n  };\n}\n\n/**\n * Requires roles, from any source or only from the given `*_resource_access` claims.\n */\nexport function requireRole(\n  roles: string | readonly string[],\n  options: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] } = {},\n): AuthioRule {\n  const required = listOf(roles, \"role\");\n  const match = options.match ?? \"any\";\n  const from = describeSources(options.sources);\n\n  return {\n    description: `Authio role (${match}): ${required.join(\", \")}${from}`,\n    check: (user) =>\n      satisfies(required, match, (role) => user.hasRole(role, { sources: options.sources }))\n        ? undefined\n        : { message: `The caller lacks the required role (${match}): ${required.join(\", \")}${from}.` },\n  };\n}\n\n/**\n * Requires a permission (`method` on `resource`), granted by a role from any source or only from the given ones.\n */\nexport function requirePermission(resource: string, method: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): AuthioRule {\n  if (!resource?.trim() || !method?.trim()) throw new TypeError(\"A permission needs a resource and a method.\");\n\n  const from = describeSources(options.sources);\n\n  return {\n    description: `Authio permission: ${resource}:${method}${from}`,\n    check: (user) =>\n      user.hasPermission(resource, method, { sources: options.sources }) ? undefined : { message: `The caller lacks the permission ${resource}:${method}${from}.` },\n  };\n}\n\n/**\n * Requires groups, read from the group claims (a claim mapper with the Group source).\n */\nexport function requireGroup(groups: string | readonly string[], match: AuthioMatch = \"any\"): AuthioRule {\n  const required = listOf(groups, \"group\");\n\n  return {\n    description: `Authio group (${match}): ${required.join(\", \")}`,\n    check: (user) =>\n      satisfies(required, match, (group) => user.hasGroup(group))\n        ? undefined\n        : { message: `The caller is not in the required group (${match}): ${required.join(\", \")}.` },\n  };\n}\n\n/**\n * Requires a claim: present, or holding one of the given values. Fits claim-mapper claims, the user's own claims and\n * any other claim Authio issues.\n */\nexport function requireClaim(type: string, ...values: string[]): AuthioRule {\n  if (!type?.trim()) throw new TypeError(\"A claim rule needs a claim type.\");\n\n  return {\n    description: values.length === 0 ? `Authio claim: ${type}` : `Authio claim: ${type} in ${values.join(\", \")}`,\n    check: (user) =>\n      user.hasClaim(type, ...values)\n        ? undefined\n        : { message: values.length === 0 ? `The token lacks the claim ${type}.` : `The token's claim ${type} is not one of: ${values.join(\", \")}.` },\n  };\n}\n\n/**\n * Requires an organization context, or a given organization (alias or id, case-insensitive).\n */\nexport function requireOrganization(organization?: string): AuthioRule {\n  const wanted = organization?.trim() || undefined;\n\n  return {\n    description: `Authio organization: ${wanted ?? \"any\"}`,\n    check: (user) => {\n      const satisfied =\n        !!user.organizationId &&\n        (!wanted ||\n          user.organizationAlias?.toLowerCase() === wanted.toLowerCase() ||\n          user.organizationId.toLowerCase() === wanted.toLowerCase());\n\n      return satisfied\n        ? undefined\n        : { message: wanted ? `The token is not in the organization ${wanted}.` : \"The token has no organization context.\" };\n    },\n  };\n}\n\n/**\n * Requires a minimum authentication level (`acr`): 1 one factor, 2 several, 3 one of them phishing-resistant.\n */\nexport function requireAuthenticationLevel(minimumLevel: number): AuthioRule {\n  if (!Number.isInteger(minimumLevel) || minimumLevel < 0) throw new RangeError(\"The minimum level must be a non-negative integer.\");\n\n  return {\n    description: `Authio authentication level >= ${minimumLevel}`,\n    check: (user) =>\n      user.authenticationLevel !== undefined && user.authenticationLevel >= minimumLevel\n        ? undefined\n        : { message: `The authentication level must be at least ${minimumLevel}.`, error: \"insufficient_user_authentication\" },\n  };\n}\n\n/**\n * Requires authentication methods (`amr`, case-insensitive), such as `otp`, `swk` or `fed`.\n */\nexport function requireAuthenticationMethod(methods: string | readonly string[], match: AuthioMatch = \"any\"): AuthioRule {\n  const required = listOf(methods, \"authentication method\");\n\n  return {\n    description: `Authio authentication method (${match}): ${required.join(\", \")}`,\n    check: (user) => {\n      const used = user.authenticationMethods.map((method) => method.toLowerCase());\n\n      return satisfies(required, match, (method) => used.includes(method.toLowerCase()))\n        ? undefined\n        : { message: `The user must authenticate with (${match}): ${required.join(\", \")}.`, error: \"insufficient_user_authentication\" };\n    },\n  };\n}\n\n/**\n * Requires the token to have been issued to one of the clients (`azp`, else `client_id`).\n */\nexport function requireClient(clientIds: string | readonly string[]): AuthioRule {\n  const required = listOf(clientIds, \"client id\");\n\n  return {\n    description: `Authio client: ${required.join(\", \")}`,\n    check: (user) =>\n      user.clientId !== undefined && required.includes(user.clientId)\n        ? undefined\n        : { message: `The token was not issued to an accepted client (${required.join(\", \")}).` },\n  };\n}\n\n/**\n * Requires every rule.\n */\nexport function allOf(...rules: AuthioRule[]): AuthioRule {\n  return {\n    description: rules.map((rule) => rule.description).join(\" and \"),\n    check: (user) => authorize(user, ...rules),\n  };\n}\n\n/**\n * Requires at least one rule; the refusal is the first rule's.\n */\nexport function anyOf(...rules: AuthioRule[]): AuthioRule {\n  if (rules.length === 0) throw new TypeError(\"anyOf needs at least one rule.\");\n\n  return {\n    description: rules.map((rule) => rule.description).join(\" or \"),\n    check: (user) => {\n      const failures = rules.map((rule) => rule.check(user));\n\n      return failures.some((failure) => failure === undefined) ? undefined : failures[0];\n    },\n  };\n}\n\nfunction listOf(values: string | readonly string[], name: string): string[] {\n  const list = [...new Set((typeof values === \"string\" ? [values] : [...values]).filter((value) => value?.trim()))];\n\n  if (list.length === 0) throw new TypeError(`At least one ${name} is required.`);\n\n  return list;\n}\n\nfunction satisfies(required: readonly string[], match: AuthioMatch, holds: (value: string) => boolean): boolean {\n  return match === \"all\" ? required.every(holds) : required.some(holds);\n}\n\nfunction describeSources(sources: readonly AuthioResourceAccessSource[] | undefined): string {\n  return sources && sources.length > 0 ? ` from ${[...new Set(sources)].join(\", \")}` : \"\";\n}\n","import { AuthioError } from \"@hyper.authio/client\";\nimport type { AuthioRuleFailure } from \"./rules.js\";\n\n/**\n * The request carries no valid access token: answer `401` with `wwwAuthenticate`.\n */\nexport class AuthioBearerError extends AuthioError {\n  readonly status = 401;\n  /** `invalid_token`, or `undefined` when the request had no token at all (RFC 6750 §3.1). */\n  readonly error: \"invalid_token\" | undefined;\n  /** Why the token was refused, safe to send to the caller. */\n  readonly description: string | undefined;\n\n  constructor(description: string | undefined, options: { error?: \"invalid_token\" | undefined; cause?: unknown } = {}) {\n    super(description ?? \"A valid Authio access token is required.\", { cause: options.cause });\n    this.error = \"error\" in options ? options.error : \"invalid_token\";\n    this.description = description === undefined ? undefined : toHeaderText(description);\n  }\n\n  /** The `WWW-Authenticate` value. */\n  get wwwAuthenticate(): string {\n    if (!this.error) return \"Bearer\";\n\n    return this.description ? `Bearer error=\"${this.error}\", error_description=\"${this.description}\"` : `Bearer error=\"${this.error}\"`;\n  }\n}\n\n/**\n * The caller is known but not allowed: answer `403`, with `wwwAuthenticate` when the refusal has a bearer error.\n */\nexport class AuthioForbiddenError extends AuthioError {\n  readonly status = 403;\n  readonly failure: AuthioRuleFailure;\n\n  constructor(failure: AuthioRuleFailure) {\n    super(failure.message);\n    this.failure = failure;\n  }\n\n  /** The `WWW-Authenticate` value, or `undefined` when the refusal is not about scopes or the sign-in. */\n  get wwwAuthenticate(): string | undefined {\n    return toForbiddenChallenge(this.failure);\n  }\n}\n\n/**\n * The `WWW-Authenticate` value of a refusal: `insufficient_scope` (with `scope`) or\n * `insufficient_user_authentication`.\n */\nexport function toForbiddenChallenge(failure: AuthioRuleFailure): string | undefined {\n  if (!failure.error) return undefined;\n\n  const value = `Bearer error=\"${failure.error}\", error_description=\"${escapeQuoted(failure.message)}\"`;\n\n  return failure.scope ? `${value}, scope=\"${escapeQuoted(failure.scope)}\"` : value;\n}\n\n/**\n * Problem details (RFC 9457) for a `401` or `403`.\n */\nexport function toProblemDetails(error: AuthioBearerError | AuthioForbiddenError): Record<string, unknown> {\n  if (error instanceof AuthioBearerError)\n    return {\n      type: \"https://tools.ietf.org/html/rfc9110#section-15.5.2\",\n      title: \"Unauthorized\",\n      status: 401,\n      detail: \"A valid Authio access token is required.\",\n    };\n\n  return {\n    type: \"https://tools.ietf.org/html/rfc9110#section-15.5.4\",\n    title: \"Forbidden\",\n    status: 403,\n    detail: error.failure.message || \"The caller is not allowed to access this resource.\",\n    ...(error.failure.error ? { error: error.failure.error } : {}),\n    ...(error.failure.scope ? { scope: error.failure.scope } : {}),\n  };\n}\n\n/**\n * Keeps only the characters RFC 6750 §3 allows in an `error_description`.\n *\n * @internal\n */\nexport function toHeaderText(text: string): string {\n  return [...text].map((character) => (character >= \" \" && character <= \"~\" && character !== '\"' && character !== \"\\\\\" ? character : \"?\")).join(\"\");\n}\n\nfunction escapeQuoted(value: string): string {\n  return value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"');\n}\n","import {\n  AuthioAsymmetricAlgorithms,\n  AuthioConfigurationError,\n  AuthioError,\n  AuthioTokenTypes,\n  createAuthioClient,\n  createAuthioDiscoveryClient,\n  isAuthioTokenEncrypted,\n  resolveConnection,\n  seconds,\n  type AuthioClient,\n  type AuthioClientOptions,\n  type AuthioConnection,\n  type AuthioConnectionOptions,\n  type AuthioDiscoveryClient,\n  type AuthioIntrospectionResult,\n} from \"@hyper.authio/client\";\nimport { createRemoteJWKSet, customFetch, decodeProtectedHeader, errors, jwtVerify, type JWTPayload } from \"jose\";\nimport { AuthioBearerError } from \"./errors.js\";\nimport { AuthioUser, type AuthioUserClaimSettings } from \"./user.js\";\n\n/**\n * Whether and how Authio's introspection endpoint takes part in validating a token.\n *\n * - `none`: the JWT is validated locally (signature, issuer, audience, lifetime). Fastest; a revoked token stays\n *   valid until it expires.\n * - `activeCheck`: validated locally, then confirmed active by introspection (cached per `jti`).\n * - `introspectionOnly`: introspection alone, for opaque (reference) or encrypted tokens.\n */\nexport type AuthioIntrospectionMode = \"none\" | \"activeCheck\" | \"introspectionOnly\";\n\n/**\n * How an API validates Authio access tokens.\n */\nexport interface AuthioVerifierOptions extends AuthioConnectionOptions, AuthioUserClaimSettings {\n  /** The audiences this API accepts: its resource identifier (RFC 8707) or client id. Required. */\n  audiences: string | readonly string[];\n  /** Defaults to `none`. */\n  introspection?: AuthioIntrospectionMode;\n  /**\n   * The API's confidential client, for introspection: a client already created, or its options (issuer settings are\n   * taken from these options when absent). It must be the client the resource server names as its introspection\n   * client, since Authio answers introspection according to who asks.\n   */\n  client?: AuthioClient | Omit<AuthioClientOptions, keyof AuthioConnectionOptions>;\n  /** Seconds an active introspection answer is kept (never past the token's expiry). Defaults to 30. */\n  introspectionCacheDuration?: number;\n  /** Seconds of clock skew tolerated on `exp` and `nbf`. Defaults to 30. */\n  clockSkew?: number;\n  /** Accepted signing algorithms. Defaults to the asymmetric ones (RS*, PS*, ES*). */\n  validAlgorithms?: readonly string[];\n  /** Refuses a token whose `typ` claim is present and not `Bearer` (an ID token, for one). Defaults to `true`. */\n  rejectNonAccessTokens?: boolean;\n}\n\n/**\n * Validates Authio access tokens and reads the caller.\n */\nexport interface AuthioVerifier {\n  /** The connection settings. */\n  readonly connection: AuthioConnection;\n  /** The discovery document. */\n  readonly discovery: AuthioDiscoveryClient;\n  /** The accepted audiences. */\n  readonly audiences: readonly string[];\n  /** The introspection mode. */\n  readonly introspection: AuthioIntrospectionMode;\n  /** The client used for introspection, when there is one. */\n  readonly client: AuthioClient | undefined;\n  /**\n   * Validates a token and reads the caller.\n   *\n   * @throws AuthioBearerError when the token is not valid for this API.\n   */\n  verify(token: string, signal?: AbortSignal): Promise<AuthioUser>;\n  /**\n   * Validates the token of an `Authorization: Bearer` header.\n   *\n   * @throws AuthioBearerError without an error code when there is no bearer token, with `invalid_token` when it is\n   * not valid.\n   */\n  verifyAuthorizationHeader(header: string | null | undefined, signal?: AbortSignal): Promise<AuthioUser>;\n}\n\n/**\n * Error descriptions of the refusals the SDK makes itself.\n */\nexport const AuthioBearerErrorDescriptions = {\n  Inactive:\n    \"Authio reports the token as not active to this API's client. It was revoked or has expired or its session ended; or this API's client is not the introspection client of the resource server the token is for.\",\n  Unconfirmed: \"Authio could not be reached to confirm that the token is active.\",\n  Empty: \"The token is empty.\",\n  Encrypted: \"The token is encrypted; validate it with introspection ('introspectionOnly').\",\n  SigningKeysUnavailable: \"Authio could not be reached to read its signing keys.\",\n} as const;\n\nconst maxCachedAnswers = 10_000;\n\n/**\n * Creates a token verifier.\n *\n * @throws AuthioConfigurationError when no audience is given, or introspection is asked for without a client.\n */\nexport function createAuthioVerifier(options: AuthioVerifierOptions): AuthioVerifier {\n  const audiences = [...new Set((typeof options.audiences === \"string\" ? [options.audiences] : [...(options.audiences ?? [])]).filter((value) => value?.trim()))];\n\n  if (audiences.length === 0) throw new AuthioConfigurationError(\"The Authio verifier needs at least one audience: the API's resource identifier or client id.\");\n\n  const connection = resolveConnection(options);\n  const discovery = createAuthioDiscoveryClient(connection);\n  const introspection = options.introspection ?? \"none\";\n  const client = resolveClient(options);\n\n  if (introspection !== \"none\" && !client)\n    throw new AuthioConfigurationError(\n      `Authio introspection ('${introspection}') needs the API's confidential client: pass options.client with its clientId and clientSecret or private key.`,\n    );\n\n  const cacheDurationMs = seconds(options.introspectionCacheDuration, 30, \"introspectionCacheDuration\");\n  const clockSkew = seconds(options.clockSkew, 30, \"clockSkew\") / 1000;\n  const algorithms = options.validAlgorithms && options.validAlgorithms.length > 0 ? [...options.validAlgorithms] : [...AuthioAsymmetricAlgorithms];\n  const rejectNonAccessTokens = options.rejectNonAccessTokens ?? true;\n  const claimSettings: AuthioUserClaimSettings = { roleClaims: options.roleClaims, groupClaims: options.groupClaims };\n  const cache = new Map<string, { result: AuthioIntrospectionResult; until: number }>();\n  let keys: { uri: string; set: ReturnType<typeof createRemoteJWKSet> } | undefined;\n\n  const introspect = async (token: string, key: string, signal?: AbortSignal): Promise<AuthioIntrospectionResult | undefined> => {\n    const now = connection.clock.now();\n    const cached = cache.get(key);\n\n    if (cached && cached.until > now) return cached.result;\n\n    cache.delete(key);\n\n    const result = await client!.introspect(token, { tokenTypeHint: AuthioTokenTypes.AccessToken, signal });\n\n    if (!result.active) return undefined;\n\n    const until = Math.min(now + cacheDurationMs, typeof result.exp === \"number\" ? result.exp * 1000 : Number.POSITIVE_INFINITY);\n\n    if (until > now) {\n      if (cache.size >= maxCachedAnswers) cache.delete(cache.keys().next().value!);\n      cache.set(key, { result, until });\n    }\n\n    return result;\n  };\n\n  const signingKeys = async (signal?: AbortSignal) => {\n    const document = await discovery.get(signal);\n    const uri = document.jwks_uri;\n\n    if (!uri) throw new AuthioError(\"The Authio discovery document has no jwks_uri.\");\n\n    if (!keys || keys.uri !== uri) keys = { uri, set: createRemoteJWKSet(new URL(uri), { [customFetch]: connection.fetch, timeoutDuration: connection.httpTimeoutMs }) };\n\n    return keys.set;\n  };\n\n  const verifyJwt = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n    if (isAuthioTokenEncrypted(token)) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Encrypted);\n\n    let keySet: Awaited<ReturnType<typeof signingKeys>>;\n\n    try {\n      keySet = await signingKeys(signal);\n    } catch (error) {\n      throw new AuthioBearerError(AuthioBearerErrorDescriptions.SigningKeysUnavailable, { cause: error });\n    }\n\n    let payload: JWTPayload;\n\n    try {\n      ({ payload } = await jwtVerify(token, keySet, {\n        issuer: connection.issuer,\n        audience: audiences,\n        algorithms,\n        clockTolerance: clockSkew,\n        requiredClaims: [\"exp\"],\n        currentDate: new Date(connection.clock.now()),\n      }));\n    } catch (error) {\n      throw new AuthioBearerError(describeJwtFailure(error, audiences, token), { cause: error });\n    }\n\n    const type = typeof payload.typ === \"string\" ? payload.typ : undefined;\n\n    if (rejectNonAccessTokens && type !== undefined && type.toLowerCase() !== \"bearer\")\n      throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`);\n\n    if (introspection === \"activeCheck\") await confirmActive(token, payload, signal);\n\n    return new AuthioUser(payload, claimSettings, token);\n  };\n\n  const confirmActive = async (token: string, payload: JWTPayload, signal?: AbortSignal) => {\n    const key = payload.jti ? `jti:${payload.jti}` : await keyForToken(token);\n    let result: AuthioIntrospectionResult | undefined;\n\n    try {\n      result = await introspect(token, key, signal);\n    } catch (error) {\n      if (signal?.aborted) throw error;\n      throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error });\n    }\n\n    if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive);\n  };\n\n  const verifyByIntrospection = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n    let result: AuthioIntrospectionResult | undefined;\n\n    try {\n      result = await introspect(token, await keyForToken(token), signal);\n    } catch (error) {\n      if (signal?.aborted) throw error;\n      throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error });\n    }\n\n    if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive);\n\n    if (result.iss && result.iss !== connection.issuer) throw new AuthioBearerError(`The issuer '${result.iss}' is invalid`);\n\n    const tokenAudiences = [result.aud ?? []].flat();\n\n    if (!tokenAudiences.some((audience) => audiences.includes(audience))) throw new AuthioBearerError(describeAudience(tokenAudiences, audiences));\n\n    if (typeof result.exp === \"number\" && (result.exp + clockSkew) * 1000 <= connection.clock.now())\n      throw new AuthioBearerError(`The token expired at '${new Date(result.exp * 1000).toISOString()}'`);\n\n    const { active: _active, token_type: tokenType, username, ...members } = result;\n    const claims: Record<string, unknown> = { ...members };\n\n    if (typeof tokenType === \"string\" && claims.typ === undefined) claims.typ = tokenType;\n    if (typeof username === \"string\" && claims.preferred_username === undefined) claims.preferred_username = username;\n    if (typeof result.client_id === \"string\" && claims.azp === undefined) claims.azp = result.client_id;\n\n    const type = typeof claims.typ === \"string\" ? claims.typ : undefined;\n\n    if (rejectNonAccessTokens && type !== undefined && type.toLowerCase() !== \"bearer\")\n      throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`);\n\n    return new AuthioUser(claims, claimSettings, token);\n  };\n\n  const verify = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n    if (typeof token !== \"string\" || !token.trim()) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Empty);\n\n    return introspection === \"introspectionOnly\" ? verifyByIntrospection(token.trim(), signal) : verifyJwt(token.trim(), signal);\n  };\n\n  return {\n    connection,\n    discovery,\n    audiences,\n    introspection,\n    client,\n    verify,\n    async verifyAuthorizationHeader(header, signal) {\n      const token = readBearerToken(header);\n\n      if (token === undefined) throw new AuthioBearerError(undefined, { error: undefined });\n\n      return verify(token, signal);\n    },\n  };\n}\n\n/**\n * The token of an `Authorization: Bearer` header, or `undefined` when the header is absent or of another scheme.\n */\nexport function readBearerToken(header: string | null | undefined): string | undefined {\n  const match = /^\\s*Bearer\\s+(\\S+)\\s*$/i.exec(header ?? \"\");\n\n  return match?.[1];\n}\n\n/**\n * The cache key of a token: `token:` and the hex SHA-256 of the token.\n *\n * @internal\n */\nexport async function keyForToken(token: string): Promise<string> {\n  const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(token)));\n\n  return `token:${[...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\")}`;\n}\n\nfunction resolveClient(options: AuthioVerifierOptions): AuthioClient | undefined {\n  const given = options.client;\n\n  if (!given) return undefined;\n  if (isClient(given)) return given;\n\n  return createAuthioClient({\n    ...given,\n    issuer: options.issuer,\n    authority: options.authority,\n    realm: options.realm,\n    requireHttps: options.requireHttps,\n    discoveryCacheDuration: options.discoveryCacheDuration,\n    httpTimeout: options.httpTimeout,\n    fetch: options.fetch,\n    clock: options.clock,\n  } as AuthioClientOptions);\n}\n\nfunction isClient(value: unknown): value is AuthioClient {\n  return typeof (value as AuthioClient).introspect === \"function\" && typeof (value as AuthioClient).tokens === \"object\";\n}\n\nfunction describeJwtFailure(error: unknown, audiences: readonly string[], token: string): string | undefined {\n  if (error instanceof errors.JWTExpired) {\n    const exp = error.payload.exp;\n\n    return typeof exp === \"number\" ? `The token expired at '${new Date(exp * 1000).toISOString()}'` : \"The token has expired\";\n  }\n\n  if (error instanceof errors.JWTClaimValidationFailed) {\n    switch (error.claim) {\n      case \"aud\":\n        return describeAudience([error.payload.aud ?? []].flat(), audiences);\n      case \"iss\":\n        return `The issuer '${error.payload.iss ?? \"\"}' is invalid`;\n      case \"nbf\":\n        return typeof error.payload.nbf === \"number\" ? `The token is not valid before '${new Date(error.payload.nbf * 1000).toISOString()}'` : \"The token is not valid yet\";\n      case \"exp\":\n        return \"The token has no expiration\";\n      default:\n        return `The token's ${error.claim} claim is invalid`;\n    }\n  }\n\n  if (error instanceof errors.JWSSignatureVerificationFailed) return \"The signature is invalid\";\n  if (error instanceof errors.JWKSNoMatchingKey) return \"The signature key was not found\";\n  if (error instanceof errors.JOSEAlgNotAllowed) return `The algorithm '${algorithmOf(token)}' is not available`;\n  if (error instanceof errors.JWKSTimeout || error instanceof errors.JWKSInvalid) return AuthioBearerErrorDescriptions.SigningKeysUnavailable;\n  if (error instanceof errors.JWTInvalid || error instanceof errors.JWSInvalid) return \"The token is malformed\";\n\n  return undefined;\n}\n\nfunction describeAudience(tokenAudiences: readonly string[], audiences: readonly string[]): string {\n  const known = tokenAudiences.length === 0 ? \"\" : ` ${tokenAudiences.map((audience) => `'${audience}'`).join(\" and \")}`;\n  const accepted = audiences.map((audience) => `'${audience}'`).join(\" or \");\n\n  return audiences.length === 1\n    ? `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for that resource (RFC 8707).`\n    : `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for one of those resources (RFC 8707).`;\n}\n\nfunction algorithmOf(token: string): string {\n  try {\n    return String(decodeProtectedHeader(token).alg ?? \"\");\n  } catch {\n    return \"\";\n  }\n}\n","import {\n  AuthioConfigurationError,\n  AuthioWebhookHeaders,\n  systemClock,\n  tryParseWebhookEvent,\n  verifyWebhookSignature,\n  type AuthioClock,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n  type AuthioWebhookEvent,\n} from \"@hyper.authio/client\";\n\n/**\n * Remembers delivered event ids, so a redelivery is acknowledged without running the handlers twice.\n */\nexport interface AuthioWebhookDeduplicationStore {\n  /** Records the id; `false` when it was already recorded within the window. */\n  tryBegin(eventId: string, windowMs: number): boolean | Promise<boolean>;\n  /** Forgets the id, after a handler failed, so the redelivery runs again. */\n  release(eventId: string): void | Promise<void>;\n}\n\n/**\n * How webhook deliveries are received.\n */\nexport interface AuthioWebhookOptions {\n  /** The webhook's secret. */\n  secret?: string;\n  /** Several secrets, while one is being rotated; a delivery signed with any of them is accepted. */\n  secrets?: readonly string[];\n  /** Seconds a signature's timestamp may differ from now. Defaults to 300. */\n  tolerance?: number;\n  /** `memory` (default), `none`, or a store shared between instances. */\n  deduplication?: \"memory\" | \"none\" | AuthioWebhookDeduplicationStore;\n  /** Seconds a delivered id is remembered. Defaults to 86400. */\n  deduplicationWindow?: number;\n  /** The largest body accepted, in bytes. Defaults to 1 MiB. */\n  maxBodySize?: number;\n  /** The clock. */\n  clock?: AuthioClock;\n  /** Called when a delivery is refused or a handler fails. */\n  onError?: (error: unknown, context: { reason: string; eventId?: string; eventType?: string }) => void;\n}\n\n/**\n * A handler of one event type, or of every type.\n */\nexport type AuthioWebhookHandler<E extends AuthioWebhookEvent = AuthioWebhookEvent> = (event: E) => void | Promise<void>;\n\n/**\n * What to answer a delivery with.\n */\nexport interface AuthioWebhookOutcome {\n  /** `200` handled, duplicate or ping; `400` unreadable; `401` bad or stale signature; `413` too large; `500` a handler failed. */\n  readonly status: 200 | 400 | 401 | 413 | 500;\n  /** Why, for logs. */\n  readonly reason: \"handled\" | \"duplicate\" | \"unreadable\" | \"unsigned\" | \"too_large\" | \"handler_failed\";\n  readonly event?: AuthioWebhookEvent;\n}\n\n/**\n * Receives Authio webhook deliveries: verifies, deduplicates and dispatches them.\n */\nexport interface AuthioWebhooks {\n  /** Handles one event type, typed. */\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhooks;\n  /** Handles another event type, or `*` for every type. */\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhooks;\n  /**\n   * Handles a delivery: the body exactly as received and the request headers.\n   */\n  handle(delivery: { body: string | Uint8Array; headers: Headers | Record<string, string | string[] | undefined> }): Promise<AuthioWebhookOutcome>;\n  /** The largest body accepted, in bytes. */\n  readonly maxBodySize: number;\n}\n\n/**\n * Creates a webhook receiver. Handlers run in registration order; a `*` handler sees every event.\n *\n * @throws AuthioConfigurationError when no secret is configured.\n */\nexport function createAuthioWebhooks(options: AuthioWebhookOptions): AuthioWebhooks {\n  const secrets = [...new Set([options.secret, ...(options.secrets ?? [])].filter((secret): secret is string => !!secret?.trim()))];\n\n  if (secrets.length === 0) throw new AuthioConfigurationError(\"Authio webhooks need the webhook's secret.\");\n\n  const clock = options.clock ?? systemClock;\n  const tolerance = options.tolerance ?? 300;\n  const windowMs = (options.deduplicationWindow ?? 86_400) * 1000;\n  const maxBodySize = options.maxBodySize ?? 1024 * 1024;\n  const store = resolveStore(options.deduplication ?? \"memory\", clock);\n  const handlers: { type: string; handler: AuthioWebhookHandler }[] = [];\n\n  const webhooks: AuthioWebhooks = {\n    maxBodySize,\n    on(type: string, handler: AuthioWebhookHandler) {\n      if (!type) throw new TypeError(\"An event type (or '*') is required.\");\n\n      handlers.push({ type, handler });\n      return webhooks;\n    },\n    async handle(delivery) {\n      const body = typeof delivery.body === \"string\" ? new TextEncoder().encode(delivery.body) : delivery.body;\n\n      if (body.byteLength > maxBodySize) return { status: 413, reason: \"too_large\" };\n\n      const signature = headerOf(delivery.headers, AuthioWebhookHeaders.Signature);\n      let refusal = \"no webhook secret matched\";\n\n      for (const secret of secrets) {\n        const result = await verifyWebhookSignature(signature, body, secret, { tolerance, now: clock.now() });\n\n        if (result.valid) {\n          refusal = \"\";\n          break;\n        }\n\n        refusal = result.reason;\n      }\n\n      if (refusal) {\n        options.onError?.(new Error(refusal), { reason: \"unsigned\" });\n        return { status: 401, reason: \"unsigned\" };\n      }\n\n      const event = tryParseWebhookEvent(body);\n\n      if (!event) return { status: 400, reason: \"unreadable\" };\n\n      const eventId = headerOf(delivery.headers, AuthioWebhookHeaders.EventId)?.trim() || String(event.id ?? \"\");\n\n      if (eventId && !(await store.tryBegin(eventId, windowMs))) return { status: 200, reason: \"duplicate\", event };\n\n      try {\n        for (const { type, handler } of handlers) if (type === \"*\" || type === event.type) await handler(event);\n      } catch (error) {\n        if (eventId) await store.release(eventId);\n        options.onError?.(error, { reason: \"handler_failed\", eventId, eventType: event.type });\n        return { status: 500, reason: \"handler_failed\", event };\n      }\n\n      return { status: 200, reason: \"handled\", event };\n    },\n  };\n\n  return webhooks;\n}\n\n/**\n * A deduplication store kept in this process's memory.\n */\nexport function createMemoryDeduplicationStore(clock: AuthioClock = systemClock): AuthioWebhookDeduplicationStore {\n  const seen = new Map<string, number>();\n\n  return {\n    tryBegin(eventId, windowMs) {\n      const now = clock.now();\n\n      for (const [id, until] of seen) {\n        if (until > now) break;\n        seen.delete(id);\n      }\n\n      const until = seen.get(eventId);\n\n      if (until !== undefined && until > now) return false;\n\n      seen.delete(eventId);\n      seen.set(eventId, now + windowMs);\n      return true;\n    },\n    release(eventId) {\n      seen.delete(eventId);\n    },\n  };\n}\n\nfunction resolveStore(deduplication: NonNullable<AuthioWebhookOptions[\"deduplication\"]>, clock: AuthioClock): AuthioWebhookDeduplicationStore {\n  if (deduplication === \"none\") return { tryBegin: () => true, release: () => undefined };\n  if (deduplication === \"memory\") return createMemoryDeduplicationStore(clock);\n\n  return deduplication;\n}\n\nfunction headerOf(headers: Headers | Record<string, string | string[] | undefined>, name: string): string | undefined {\n  if (typeof (headers as Headers).get === \"function\") return (headers as Headers).get(name) ?? undefined;\n\n  const wanted = name.toLowerCase();\n\n  for (const [key, value] of Object.entries(headers as Record<string, string | string[] | undefined>)) {\n    if (key.toLowerCase() === wanted) return Array.isArray(value) ? value[0] : value;\n  }\n\n  return undefined;\n}\n","import {\n  AuthioDefaults,\n  AuthioError,\n  seconds,\n  toClientCredentialsToken,\n  toScopeString,\n  type AuthioClient,\n  type AuthioClientCredentialsToken,\n} from \"@hyper.authio/client\";\nimport type { AuthioUser } from \"./user.js\";\nimport { keyForToken } from \"./verifier.js\";\n\n/**\n * Who a downstream call is made for: a caller read by the verifier, or the incoming access token itself.\n */\nexport type AuthioDownstreamSubject = AuthioUser | string;\n\n/**\n * A `fetch` that forwards the caller's own access token, unchanged, to a downstream API that accepts the same\n * audience. Sends no `Authorization` when there is no token.\n */\nexport function createForwardingFetch(subject: AuthioDownstreamSubject | undefined, inner: typeof fetch = globalThis.fetch): typeof fetch {\n  const token = tokenOf(subject);\n\n  return (input, init) => {\n    if (!token) return inner(input, init);\n\n    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));\n\n    headers.set(\"authorization\", `Bearer ${token}`);\n\n    return inner(input, { ...init, headers });\n  };\n}\n\n/**\n * Exchanges the caller's token for one addressed to a downstream API (RFC 8693), and caches it.\n */\nexport interface AuthioOnBehalfOf {\n  /**\n   * A token for the downstream API on the caller's behalf: cached per incoming `jti` (else token hash), resource and\n   * sorted scopes, renewed `tokenRefreshSkew` before expiry (at most half its lifetime); concurrent callers share\n   * one exchange.\n   *\n   * @throws AuthioError when there is no incoming token.\n   */\n  getToken(subject: AuthioDownstreamSubject | undefined, signal?: AbortSignal): Promise<AuthioClientCredentialsToken>;\n  /** Drops a cached token; with `accessToken`, only when the cache still holds that token. */\n  invalidate(subject: AuthioDownstreamSubject, accessToken?: string): Promise<void>;\n  /** A `fetch` that sends the exchanged token, and on a `401` drops it and retries once. */\n  fetch(subject: AuthioDownstreamSubject | undefined, inner?: typeof fetch): typeof fetch;\n}\n\n/**\n * Creates an on-behalf-of exchanger.\n *\n * @param options `client` (the API's confidential client), the downstream `resource` and `scopes`.\n */\nexport function createOnBehalfOf(options: { client: AuthioClient; resource?: string; scopes?: Iterable<string> | string; tokenRefreshSkew?: number }): AuthioOnBehalfOf {\n  const { client } = options;\n  const scope = toScopeString(options.scopes);\n  const sortedScope = (scope ?? \"\").split(\" \").filter(Boolean).sort().join(\" \");\n  const skewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, \"tokenRefreshSkew\");\n  const entries = new Map<string, AuthioClientCredentialsToken>();\n  const pending = new Map<string, Promise<AuthioClientCredentialsToken>>();\n\n  const keyOf = async (subject: AuthioDownstreamSubject) => {\n    const token = tokenOf(subject)!;\n    const jti = typeof subject === \"string\" ? undefined : subject.tokenId;\n\n    return `${jti ? `jti:${jti}` : await keyForToken(token)}|${options.resource ?? \"\"}|${sortedScope}`;\n  };\n\n  const getToken: AuthioOnBehalfOf[\"getToken\"] = async (subject, signal) => {\n    const incoming = tokenOf(subject);\n\n    if (!incoming) throw new AuthioError(\"On-behalf-of needs the caller's access token, and the request has none.\");\n\n    const key = await keyOf(subject!);\n    const cached = entries.get(key);\n\n    if (cached && client.connection.clock.now() < cached.refreshAt) return cached;\n\n    let request = pending.get(key);\n\n    if (!request) {\n      request = client.tokens\n        .exchange({ subjectToken: incoming, scopes: scope, resource: options.resource, signal })\n        .then((response) => {\n          const token = toClientCredentialsToken(response, client.connection.clock.now(), skewMs);\n\n          entries.set(key, token);\n          return token;\n        })\n        .finally(() => pending.delete(key));\n      pending.set(key, request);\n    }\n\n    return request;\n  };\n\n  const invalidate: AuthioOnBehalfOf[\"invalidate\"] = async (subject, accessToken) => {\n    const key = await keyOf(subject);\n\n    if (accessToken === undefined || entries.get(key)?.accessToken === accessToken) entries.delete(key);\n  };\n\n  return {\n    getToken,\n    invalidate,\n    fetch(subject, inner = client.connection.fetch) {\n      return async (input, init) => {\n        const request = new Request(input, init);\n        const body = request.body ? await request.arrayBuffer() : undefined;\n        const attempt = (token: AuthioClientCredentialsToken) => {\n          const headers = new Headers(request.headers);\n\n          headers.set(\"authorization\", `${token.tokenType} ${token.accessToken}`);\n\n          return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });\n        };\n\n        const token = await getToken(subject, request.signal);\n        const response = await attempt(token);\n\n        if (response.status !== 401) return response;\n\n        await invalidate(subject!, token.accessToken);\n\n        return attempt(await getToken(subject, request.signal));\n      };\n    },\n  };\n}\n\nfunction tokenOf(subject: AuthioDownstreamSubject | undefined): string | undefined {\n  if (!subject) return undefined;\n\n  return typeof subject === \"string\" ? subject : subject.token;\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,439 @@
+import { AuthioResourceAccess, AuthioResourceAccessSource, AuthioError, AuthioConnection, AuthioDiscoveryClient, AuthioClient, AuthioConnectionOptions, AuthioClientOptions, AuthioWebhookEvent, AuthioClock, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioClientCredentialsToken } from '@hyper.authio/client';
+
+/**
+ * The party acting for the subject, from the `act` claim (RFC 8693): who exchanged the token, nested when the chain
+ * is longer.
+ */
+interface AuthioActor {
+    readonly clientId: string | undefined;
+    readonly subject: string | undefined;
+    readonly actor: AuthioActor | undefined;
+}
+/**
+ * Where the user reads flat (non-`*_resource_access`) roles and groups from.
+ */
+interface AuthioUserClaimSettings {
+    /**
+     * Claims holding role names directly, such as one written by a claim mapper with the Role source. They count for
+     * `hasRole` without a source filter. Defaults to `["role"]`.
+     */
+    roleClaims?: readonly string[];
+    /**
+     * Claims holding group names, such as one written by a claim mapper with the Group source. Defaults to
+     * `["groups"]`.
+     */
+    groupClaims?: readonly string[];
+}
+/**
+ * The caller of an API, read from a validated access token or an introspection answer: identity, every form of
+ * permission Authio issues, and the raw claims for anything else.
+ */
+declare class AuthioUser {
+    /** `sub`: the person's id, or the credential's for a machine caller. */
+    readonly subject: string;
+    /** The client the token was issued to (`azp`, else `client_id`). */
+    readonly clientId: string | undefined;
+    /** `sid`. */
+    readonly sessionId: string | undefined;
+    /** `jti`. */
+    readonly tokenId: string | undefined;
+    /** `aud`. */
+    readonly audiences: readonly string[];
+    /** The granted scopes. */
+    readonly scopes: readonly string[];
+    /** The roles of the seven `*_resource_access` claims, with their source and permissions. */
+    readonly resourceAccess: AuthioResourceAccess;
+    /** Every role name: the `*_resource_access` roles, then the flat role claims. */
+    readonly roles: readonly string[];
+    /** Resource → every method any role allows on it. */
+    readonly permissions: Readonly<Record<string, readonly string[]>>;
+    /** The group names of the group claims. */
+    readonly groups: readonly string[];
+    /** `org_id`. */
+    readonly organizationId: string | undefined;
+    /** `org_alias`. */
+    readonly organizationAlias: string | undefined;
+    /** `account_id`. */
+    readonly accountId: string | undefined;
+    /** `acr`. */
+    readonly acr: string | undefined;
+    /** `acr` as a number: 1 one factor, 2 several, 3 one of them phishing-resistant. */
+    readonly authenticationLevel: number | undefined;
+    /** `amr`. */
+    readonly authenticationMethods: readonly string[];
+    /** `idp`. */
+    readonly identityProvider: string | undefined;
+    /** `auth_time`. */
+    readonly authenticatedAt: Date | undefined;
+    /** `act`. */
+    readonly actor: AuthioActor | undefined;
+    /** `delegation_id`. */
+    readonly delegationId: string | undefined;
+    readonly email: string | undefined;
+    readonly emailVerified: boolean | undefined;
+    readonly name: string | undefined;
+    readonly preferredUsername: string | undefined;
+    /** `credential_type`, on a token issued to an account credential or a consumer. */
+    readonly credentialType: string | undefined;
+    /** `credential_id`. */
+    readonly credentialId: string | undefined;
+    /** Every claim, as the token or the introspection answer carried it. */
+    readonly claims: Readonly<Record<string, unknown>>;
+    /** The access token the user was read from. Not enumerable, so it stays out of logs and JSON. */
+    readonly token: string | undefined;
+    private readonly flatRoles;
+    /**
+     * @param claims The token's payload, or the introspection answer's members.
+     * @param settings Where flat roles and groups are read from.
+     * @param token The access token, kept for forwarding and on-behalf-of.
+     */
+    constructor(claims: Readonly<Record<string, unknown>>, settings?: AuthioUserClaimSettings, token?: string);
+    /** Whether an actor exchanged the token on the subject's behalf. */
+    get isDelegated(): boolean;
+    /** Whether the scope was granted. */
+    hasScope(scope: string): boolean;
+    /**
+     * Whether the user holds the role. Without sources, from any `*_resource_access` claim or a flat role claim; with
+     * sources, only from those `*_resource_access` claims.
+     */
+    hasRole(role: string, options?: {
+        sources?: readonly AuthioResourceAccessSource[];
+    }): boolean;
+    /**
+     * Authio's grant rule: whether a role (from any source, or only from the given ones) allows `method` on
+     * `resource`. Case-insensitive.
+     */
+    hasPermission(resource: string, method: string, options?: {
+        sources?: readonly AuthioResourceAccessSource[];
+    }): boolean;
+    /** Whether the user is in the group (exact match). */
+    hasGroup(group: string): boolean;
+    /**
+     * Whether the claim is present (not `null`), and, given values, whether it holds one of them (exact match; an
+     * array claim matches when any item does).
+     */
+    hasClaim(type: string, ...values: string[]): boolean;
+    /**
+     * The claim's values as text: one for a scalar, one per item for an array, JSON text for an object.
+     */
+    claimValues(type: string): string[];
+    /** Every member but the raw token. */
+    toJSON(): Record<string, unknown>;
+}
+
+/**
+ * How several required values combine.
+ */
+type AuthioMatch = "any" | "all";
+/**
+ * Why a rule refused the caller.
+ */
+interface AuthioRuleFailure {
+    /** What is missing, in words. */
+    readonly message: string;
+    /**
+     * The RFC 6750 / RFC 9470 error to put in `WWW-Authenticate`: `insufficient_scope` for scopes,
+     * `insufficient_user_authentication` for `acr`/`amr`, none otherwise.
+     */
+    readonly error?: "insufficient_scope" | "insufficient_user_authentication";
+    /** The required scopes, for `insufficient_scope`. */
+    readonly scope?: string;
+}
+/**
+ * A condition on the caller.
+ */
+interface AuthioRule {
+    /** What the rule requires, for logs. */
+    readonly description: string;
+    /** `undefined` when the caller satisfies the rule, else why not. */
+    check(user: AuthioUser): AuthioRuleFailure | undefined;
+}
+/**
+ * Checks every rule. On refusal the message joins every rule's, and the error is the one asking for a stronger
+ * sign-in, else the first one that has an error.
+ */
+declare function authorize(user: AuthioUser, ...rules: AuthioRule[]): AuthioRuleFailure | undefined;
+/**
+ * Requires granted scopes.
+ */
+declare function requireScope(scopes: string | readonly string[], match?: AuthioMatch): AuthioRule;
+/**
+ * Requires roles, from any source or only from the given `*_resource_access` claims.
+ */
+declare function requireRole(roles: string | readonly string[], options?: {
+    match?: AuthioMatch;
+    sources?: readonly AuthioResourceAccessSource[];
+}): AuthioRule;
+/**
+ * Requires a permission (`method` on `resource`), granted by a role from any source or only from the given ones.
+ */
+declare function requirePermission(resource: string, method: string, options?: {
+    sources?: readonly AuthioResourceAccessSource[];
+}): AuthioRule;
+/**
+ * Requires groups, read from the group claims (a claim mapper with the Group source).
+ */
+declare function requireGroup(groups: string | readonly string[], match?: AuthioMatch): AuthioRule;
+/**
+ * Requires a claim: present, or holding one of the given values. Fits claim-mapper claims, the user's own claims and
+ * any other claim Authio issues.
+ */
+declare function requireClaim(type: string, ...values: string[]): AuthioRule;
+/**
+ * Requires an organization context, or a given organization (alias or id, case-insensitive).
+ */
+declare function requireOrganization(organization?: string): AuthioRule;
+/**
+ * Requires a minimum authentication level (`acr`): 1 one factor, 2 several, 3 one of them phishing-resistant.
+ */
+declare function requireAuthenticationLevel(minimumLevel: number): AuthioRule;
+/**
+ * Requires authentication methods (`amr`, case-insensitive), such as `otp`, `swk` or `fed`.
+ */
+declare function requireAuthenticationMethod(methods: string | readonly string[], match?: AuthioMatch): AuthioRule;
+/**
+ * Requires the token to have been issued to one of the clients (`azp`, else `client_id`).
+ */
+declare function requireClient(clientIds: string | readonly string[]): AuthioRule;
+/**
+ * Requires every rule.
+ */
+declare function allOf(...rules: AuthioRule[]): AuthioRule;
+/**
+ * Requires at least one rule; the refusal is the first rule's.
+ */
+declare function anyOf(...rules: AuthioRule[]): AuthioRule;
+
+/**
+ * The request carries no valid access token: answer `401` with `wwwAuthenticate`.
+ */
+declare class AuthioBearerError extends AuthioError {
+    readonly status = 401;
+    /** `invalid_token`, or `undefined` when the request had no token at all (RFC 6750 §3.1). */
+    readonly error: "invalid_token" | undefined;
+    /** Why the token was refused, safe to send to the caller. */
+    readonly description: string | undefined;
+    constructor(description: string | undefined, options?: {
+        error?: "invalid_token" | undefined;
+        cause?: unknown;
+    });
+    /** The `WWW-Authenticate` value. */
+    get wwwAuthenticate(): string;
+}
+/**
+ * The caller is known but not allowed: answer `403`, with `wwwAuthenticate` when the refusal has a bearer error.
+ */
+declare class AuthioForbiddenError extends AuthioError {
+    readonly status = 403;
+    readonly failure: AuthioRuleFailure;
+    constructor(failure: AuthioRuleFailure);
+    /** The `WWW-Authenticate` value, or `undefined` when the refusal is not about scopes or the sign-in. */
+    get wwwAuthenticate(): string | undefined;
+}
+/**
+ * The `WWW-Authenticate` value of a refusal: `insufficient_scope` (with `scope`) or
+ * `insufficient_user_authentication`.
+ */
+declare function toForbiddenChallenge(failure: AuthioRuleFailure): string | undefined;
+/**
+ * Problem details (RFC 9457) for a `401` or `403`.
+ */
+declare function toProblemDetails(error: AuthioBearerError | AuthioForbiddenError): Record<string, unknown>;
+
+/**
+ * Whether and how Authio's introspection endpoint takes part in validating a token.
+ *
+ * - `none`: the JWT is validated locally (signature, issuer, audience, lifetime). Fastest; a revoked token stays
+ *   valid until it expires.
+ * - `activeCheck`: validated locally, then confirmed active by introspection (cached per `jti`).
+ * - `introspectionOnly`: introspection alone, for opaque (reference) or encrypted tokens.
+ */
+type AuthioIntrospectionMode = "none" | "activeCheck" | "introspectionOnly";
+/**
+ * How an API validates Authio access tokens.
+ */
+interface AuthioVerifierOptions extends AuthioConnectionOptions, AuthioUserClaimSettings {
+    /** The audiences this API accepts: its resource identifier (RFC 8707) or client id. Required. */
+    audiences: string | readonly string[];
+    /** Defaults to `none`. */
+    introspection?: AuthioIntrospectionMode;
+    /**
+     * The API's confidential client, for introspection: a client already created, or its options (issuer settings are
+     * taken from these options when absent). It must be the client the resource server names as its introspection
+     * client, since Authio answers introspection according to who asks.
+     */
+    client?: AuthioClient | Omit<AuthioClientOptions, keyof AuthioConnectionOptions>;
+    /** Seconds an active introspection answer is kept (never past the token's expiry). Defaults to 30. */
+    introspectionCacheDuration?: number;
+    /** Seconds of clock skew tolerated on `exp` and `nbf`. Defaults to 30. */
+    clockSkew?: number;
+    /** Accepted signing algorithms. Defaults to the asymmetric ones (RS*, PS*, ES*). */
+    validAlgorithms?: readonly string[];
+    /** Refuses a token whose `typ` claim is present and not `Bearer` (an ID token, for one). Defaults to `true`. */
+    rejectNonAccessTokens?: boolean;
+}
+/**
+ * Validates Authio access tokens and reads the caller.
+ */
+interface AuthioVerifier {
+    /** The connection settings. */
+    readonly connection: AuthioConnection;
+    /** The discovery document. */
+    readonly discovery: AuthioDiscoveryClient;
+    /** The accepted audiences. */
+    readonly audiences: readonly string[];
+    /** The introspection mode. */
+    readonly introspection: AuthioIntrospectionMode;
+    /** The client used for introspection, when there is one. */
+    readonly client: AuthioClient | undefined;
+    /**
+     * Validates a token and reads the caller.
+     *
+     * @throws AuthioBearerError when the token is not valid for this API.
+     */
+    verify(token: string, signal?: AbortSignal): Promise<AuthioUser>;
+    /**
+     * Validates the token of an `Authorization: Bearer` header.
+     *
+     * @throws AuthioBearerError without an error code when there is no bearer token, with `invalid_token` when it is
+     * not valid.
+     */
+    verifyAuthorizationHeader(header: string | null | undefined, signal?: AbortSignal): Promise<AuthioUser>;
+}
+/**
+ * Error descriptions of the refusals the SDK makes itself.
+ */
+declare const AuthioBearerErrorDescriptions: {
+    readonly Inactive: "Authio reports the token as not active to this API's client. It was revoked or has expired or its session ended; or this API's client is not the introspection client of the resource server the token is for.";
+    readonly Unconfirmed: "Authio could not be reached to confirm that the token is active.";
+    readonly Empty: "The token is empty.";
+    readonly Encrypted: "The token is encrypted; validate it with introspection ('introspectionOnly').";
+    readonly SigningKeysUnavailable: "Authio could not be reached to read its signing keys.";
+};
+/**
+ * Creates a token verifier.
+ *
+ * @throws AuthioConfigurationError when no audience is given, or introspection is asked for without a client.
+ */
+declare function createAuthioVerifier(options: AuthioVerifierOptions): AuthioVerifier;
+/**
+ * The token of an `Authorization: Bearer` header, or `undefined` when the header is absent or of another scheme.
+ */
+declare function readBearerToken(header: string | null | undefined): string | undefined;
+
+/**
+ * Remembers delivered event ids, so a redelivery is acknowledged without running the handlers twice.
+ */
+interface AuthioWebhookDeduplicationStore {
+    /** Records the id; `false` when it was already recorded within the window. */
+    tryBegin(eventId: string, windowMs: number): boolean | Promise<boolean>;
+    /** Forgets the id, after a handler failed, so the redelivery runs again. */
+    release(eventId: string): void | Promise<void>;
+}
+/**
+ * How webhook deliveries are received.
+ */
+interface AuthioWebhookOptions {
+    /** The webhook's secret. */
+    secret?: string;
+    /** Several secrets, while one is being rotated; a delivery signed with any of them is accepted. */
+    secrets?: readonly string[];
+    /** Seconds a signature's timestamp may differ from now. Defaults to 300. */
+    tolerance?: number;
+    /** `memory` (default), `none`, or a store shared between instances. */
+    deduplication?: "memory" | "none" | AuthioWebhookDeduplicationStore;
+    /** Seconds a delivered id is remembered. Defaults to 86400. */
+    deduplicationWindow?: number;
+    /** The largest body accepted, in bytes. Defaults to 1 MiB. */
+    maxBodySize?: number;
+    /** The clock. */
+    clock?: AuthioClock;
+    /** Called when a delivery is refused or a handler fails. */
+    onError?: (error: unknown, context: {
+        reason: string;
+        eventId?: string;
+        eventType?: string;
+    }) => void;
+}
+/**
+ * A handler of one event type, or of every type.
+ */
+type AuthioWebhookHandler<E extends AuthioWebhookEvent = AuthioWebhookEvent> = (event: E) => void | Promise<void>;
+/**
+ * What to answer a delivery with.
+ */
+interface AuthioWebhookOutcome {
+    /** `200` handled, duplicate or ping; `400` unreadable; `401` bad or stale signature; `413` too large; `500` a handler failed. */
+    readonly status: 200 | 400 | 401 | 413 | 500;
+    /** Why, for logs. */
+    readonly reason: "handled" | "duplicate" | "unreadable" | "unsigned" | "too_large" | "handler_failed";
+    readonly event?: AuthioWebhookEvent;
+}
+/**
+ * Receives Authio webhook deliveries: verifies, deduplicates and dispatches them.
+ */
+interface AuthioWebhooks {
+    /** Handles one event type, typed. */
+    on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhooks;
+    /** Handles another event type, or `*` for every type. */
+    on(type: string, handler: AuthioWebhookHandler): AuthioWebhooks;
+    /**
+     * Handles a delivery: the body exactly as received and the request headers.
+     */
+    handle(delivery: {
+        body: string | Uint8Array;
+        headers: Headers | Record<string, string | string[] | undefined>;
+    }): Promise<AuthioWebhookOutcome>;
+    /** The largest body accepted, in bytes. */
+    readonly maxBodySize: number;
+}
+/**
+ * Creates a webhook receiver. Handlers run in registration order; a `*` handler sees every event.
+ *
+ * @throws AuthioConfigurationError when no secret is configured.
+ */
+declare function createAuthioWebhooks(options: AuthioWebhookOptions): AuthioWebhooks;
+/**
+ * A deduplication store kept in this process's memory.
+ */
+declare function createMemoryDeduplicationStore(clock?: AuthioClock): AuthioWebhookDeduplicationStore;
+
+/**
+ * Who a downstream call is made for: a caller read by the verifier, or the incoming access token itself.
+ */
+type AuthioDownstreamSubject = AuthioUser | string;
+/**
+ * A `fetch` that forwards the caller's own access token, unchanged, to a downstream API that accepts the same
+ * audience. Sends no `Authorization` when there is no token.
+ */
+declare function createForwardingFetch(subject: AuthioDownstreamSubject | undefined, inner?: typeof fetch): typeof fetch;
+/**
+ * Exchanges the caller's token for one addressed to a downstream API (RFC 8693), and caches it.
+ */
+interface AuthioOnBehalfOf {
+    /**
+     * A token for the downstream API on the caller's behalf: cached per incoming `jti` (else token hash), resource and
+     * sorted scopes, renewed `tokenRefreshSkew` before expiry (at most half its lifetime); concurrent callers share
+     * one exchange.
+     *
+     * @throws AuthioError when there is no incoming token.
+     */
+    getToken(subject: AuthioDownstreamSubject | undefined, signal?: AbortSignal): Promise<AuthioClientCredentialsToken>;
+    /** Drops a cached token; with `accessToken`, only when the cache still holds that token. */
+    invalidate(subject: AuthioDownstreamSubject, accessToken?: string): Promise<void>;
+    /** A `fetch` that sends the exchanged token, and on a `401` drops it and retries once. */
+    fetch(subject: AuthioDownstreamSubject | undefined, inner?: typeof fetch): typeof fetch;
+}
+/**
+ * Creates an on-behalf-of exchanger.
+ *
+ * @param options `client` (the API's confidential client), the downstream `resource` and `scopes`.
+ */
+declare function createOnBehalfOf(options: {
+    client: AuthioClient;
+    resource?: string;
+    scopes?: Iterable<string> | string;
+    tokenRefreshSkew?: number;
+}): AuthioOnBehalfOf;
+
+export { type AuthioActor, AuthioBearerError, AuthioBearerErrorDescriptions, type AuthioDownstreamSubject, AuthioForbiddenError, type AuthioIntrospectionMode, type AuthioMatch, type AuthioOnBehalfOf, type AuthioRule, type AuthioRuleFailure, AuthioUser, type AuthioUserClaimSettings, type AuthioVerifier, type AuthioVerifierOptions, type AuthioWebhookDeduplicationStore, type AuthioWebhookHandler, type AuthioWebhookOptions, type AuthioWebhookOutcome, type AuthioWebhooks, allOf, anyOf, authorize, createAuthioVerifier, createAuthioWebhooks, createForwardingFetch, createMemoryDeduplicationStore, createOnBehalfOf, readBearerToken, requireAuthenticationLevel, requireAuthenticationMethod, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRole, requireScope, toForbiddenChallenge, toProblemDetails };