@minimoth/sdk-node 0.1.0

package/dist/index.cjs

@@ -0,0 +1,556 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  MiniMoth: () => MiniMoth,
+  MiniMothError: () => MiniMothError
+});
+module.exports = __toCommonJS(index_exports);
+
+// node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+
+// src/otp/OtpClient.ts
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+
+// src/MiniMothError.ts
+var MiniMothError = class extends Error {
+  code;
+  statusCode;
+  constructor(code, message, statusCode, cause) {
+    super(message, cause !== void 0 ? { cause } : void 0);
+    this.name = "MiniMothError";
+    this.code = code;
+    this.statusCode = statusCode;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+
+// src/http.ts
+var import_module = require("module");
+var require2 = (0, import_module.createRequire)(importMetaUrl);
+var pkg = require2("../package.json");
+var BASE_URL = "https://api.minimoth.dev";
+var USER_AGENT = `minimoth-sdk-node/${pkg.version}`;
+var BACKEND_CODE_MAP = {
+  INVALID_ACCESS_TOKEN: "INVALID_TOKEN",
+  TOKEN_EXPIRED: "TOKEN_EXPIRED",
+  TOKEN_REVOKED: "TOKEN_REVOKED",
+  INVALID_OTP: "INVALID_OTP",
+  OTP_NOT_FOUND: "OTP_EXPIRED",
+  OTP_RATE_LIMITED: "RATE_LIMITED",
+  VERIFY_RATE_LIMITED: "RATE_LIMITED",
+  INSUFFICIENT_BALANCE: "INSUFFICIENT_BALANCE",
+  INVALID_PHONE: "INVALID_PHONE"
+};
+async function handleResponse(response) {
+  if (response.ok) return response.json();
+  let body = {};
+  try {
+    body = await response.json();
+  } catch {
+  }
+  const sdkCode = BACKEND_CODE_MAP[body.code ?? ""] ?? "UNKNOWN_ERROR";
+  throw new MiniMothError(sdkCode, body.error ?? "Unknown error", response.status);
+}
+async function apiPost(path, apiKey, body) {
+  let response;
+  try {
+    response = await fetch(`${BASE_URL}${path}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Api-Key": apiKey,
+        "User-Agent": USER_AGENT
+      },
+      body: JSON.stringify(body)
+    });
+  } catch (err) {
+    throw new MiniMothError("NETWORK_ERROR", "Network request failed", 0, err);
+  }
+  return handleResponse(response);
+}
+async function apiGet(path) {
+  let response;
+  try {
+    response = await fetch(`${BASE_URL}${path}`, {
+      headers: { "User-Agent": USER_AGENT }
+    });
+  } catch (err) {
+    throw new MiniMothError("NETWORK_ERROR", "Network request failed", 0, err);
+  }
+  return handleResponse(response);
+}
+
+// src/otp/OtpClient.ts
+var OtpClient = class {
+  constructor(apiKey, store, logger) {
+    this.apiKey = apiKey;
+    this.store = store;
+    this.logger = logger;
+  }
+  apiKey;
+  store;
+  logger;
+  async send(params) {
+    const phone = normalizePhone(params.phone);
+    await apiPost("/v1/otp/send", this.apiKey, { phone });
+    this.logger.info("otp.sent", { phone: maskPhone(phone) });
+  }
+  async verify(params) {
+    const phone = normalizePhone(params.phone);
+    validateOtp(params.otp);
+    try {
+      const res = await apiPost(
+        "/v1/otp/verify",
+        this.apiKey,
+        { phone, code: params.otp }
+      );
+      const payload = import_jsonwebtoken.default.decode(res.access_token);
+      if (!payload?.session_id) {
+        throw new MiniMothError("INVALID_TOKEN", "Could not decode session_id from access token", 0);
+      }
+      try {
+        await this.store.setTokens(payload.session_id, {
+          accessToken: res.access_token,
+          refreshToken: res.refresh_token
+        });
+      } catch {
+        this.logger.error("otp.store.setTokens.failed", { sessionId: payload.session_id.slice(0, 8) });
+      }
+      this.logger.info("otp.verified", { sessionId: payload.session_id.slice(0, 8) });
+      return {
+        valid: true,
+        accessToken: res.access_token,
+        refreshToken: res.refresh_token,
+        sessionId: payload.session_id
+      };
+    } catch (err) {
+      if (err instanceof MiniMothError) {
+        if (err.code === "INVALID_OTP" || err.code === "OTP_EXPIRED" || err.code === "INVALID_PHONE") {
+          this.logger.debug("otp.verify.failed", { code: err.code });
+          return { valid: false, code: err.code };
+        }
+      }
+      throw err;
+    }
+  }
+};
+function normalizePhone(raw) {
+  if (!raw || typeof raw !== "string") {
+    throw new MiniMothError("INVALID_PHONE", "Phone number is required", 422);
+  }
+  if (/[\s-]/.test(raw)) {
+    throw new MiniMothError("INVALID_PHONE", "Phone number must not contain spaces or hyphens", 422);
+  }
+  let phone = raw;
+  if (phone.startsWith("+")) phone = phone.slice(1);
+  if (phone.length === 10) phone = "91" + phone;
+  return phone;
+}
+function validateOtp(otp) {
+  if (!otp || typeof otp !== "string") {
+    throw new MiniMothError("INVALID_OTP", "OTP is required", 422);
+  }
+}
+function maskPhone(phone) {
+  if (phone.length <= 4) return "****";
+  return phone.slice(0, 4) + "*".repeat(Math.max(phone.length - 6, 1)) + phone.slice(-2);
+}
+
+// src/session/SessionClient.ts
+var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
+var SessionClient = class {
+  constructor(apiKey, jwksCache, revocationCache, deduplicator, store, logger) {
+    this.apiKey = apiKey;
+    this.jwksCache = jwksCache;
+    this.revocationCache = revocationCache;
+    this.deduplicator = deduplicator;
+    this.store = store;
+    this.logger = logger;
+  }
+  apiKey;
+  jwksCache;
+  revocationCache;
+  deduplicator;
+  store;
+  logger;
+  async validate(accessToken) {
+    const decoded = import_jsonwebtoken2.default.decode(accessToken, { complete: true });
+    if (!decoded || typeof decoded === "string") {
+      throw new MiniMothError("INVALID_TOKEN", "Token is malformed", 401);
+    }
+    const kid = decoded.header["kid"];
+    if (!kid) throw new MiniMothError("INVALID_TOKEN", "Token is missing kid header", 401);
+    const publicKey = await this.jwksCache.getKey(kid);
+    let currentToken = accessToken;
+    let newTokens;
+    try {
+      import_jsonwebtoken2.default.verify(accessToken, publicKey, { algorithms: ["RS256"] });
+    } catch (err) {
+      if (err instanceof import_jsonwebtoken2.default.TokenExpiredError) {
+        const expiredPayload = decoded.payload;
+        const sessionId = expiredPayload?.session_id;
+        if (!sessionId) throw new MiniMothError("INVALID_TOKEN", "Token is invalid", 401);
+        newTokens = await this.deduplicator.getOrRun(sessionId, async () => {
+          const refreshToken = await this.store.getRefreshToken(sessionId);
+          if (!refreshToken) {
+            throw new MiniMothError("TOKEN_EXPIRED", "Access token expired and no refresh token available", 401);
+          }
+          this.logger.info("session.auto_refresh", { sessionId: sessionId.slice(0, 8) });
+          const res = await apiPost(
+            "/v1/session/refresh",
+            this.apiKey,
+            { refresh_token: refreshToken }
+          );
+          try {
+            await this.store.setTokens(sessionId, {
+              accessToken: res.access_token,
+              refreshToken: res.refresh_token
+            });
+          } catch (err2) {
+            this.logger.error("session.store.setTokens.failed", { sessionId: sessionId.slice(0, 8) });
+          }
+          return { accessToken: res.access_token, refreshToken: res.refresh_token };
+        });
+        currentToken = newTokens.accessToken;
+        const newDecoded = import_jsonwebtoken2.default.decode(currentToken, { complete: true });
+        const newKid = newDecoded?.header?.["kid"];
+        const newKey = newKid ? await this.jwksCache.getKey(newKid) : publicKey;
+        import_jsonwebtoken2.default.verify(currentToken, newKey, { algorithms: ["RS256"] });
+      } else {
+        throw new MiniMothError("INVALID_TOKEN", "Token signature is invalid", 401);
+      }
+    }
+    const payload = import_jsonwebtoken2.default.decode(currentToken);
+    const isValid = await this.revocationCache.check(payload.jti, currentToken);
+    if (!isValid) throw new MiniMothError("TOKEN_REVOKED", "Session has been revoked", 401);
+    const session = {
+      phone: payload.sub,
+      projectId: payload.project_id,
+      sessionId: payload.session_id,
+      expiresAt: new Date(payload.exp * 1e3)
+    };
+    if (newTokens) session.newTokens = newTokens;
+    this.logger.info("session.validated", { sessionId: payload.session_id.slice(0, 8) });
+    return session;
+  }
+  async safeValidate(accessToken) {
+    try {
+      const session = await this.validate(accessToken);
+      return { valid: true, session };
+    } catch (err) {
+      if (err instanceof MiniMothError) return { valid: false, code: err.code };
+      throw err;
+    }
+  }
+  async refresh(refreshToken) {
+    const res = await apiPost(
+      "/v1/session/refresh",
+      this.apiKey,
+      { refresh_token: refreshToken }
+    );
+    const payload = import_jsonwebtoken2.default.decode(res.access_token);
+    if (payload?.session_id) {
+      try {
+        await this.store.setTokens(payload.session_id, {
+          accessToken: res.access_token,
+          refreshToken: res.refresh_token
+        });
+      } catch (err) {
+        this.logger.error("session.store.setTokens.failed", { sessionId: payload.session_id.slice(0, 8) });
+      }
+    }
+    this.logger.info("session.refreshed");
+    return { accessToken: res.access_token, refreshToken: res.refresh_token };
+  }
+  async logout(params) {
+    const payload = import_jsonwebtoken2.default.decode(params.accessToken);
+    const sessionId = payload?.session_id ?? null;
+    if (!sessionId) throw new MiniMothError("INVALID_TOKEN", "Cannot decode token", 401);
+    let currentAccessToken = params.accessToken;
+    if (payload && payload.exp < Math.floor(Date.now() / 1e3)) {
+      const newTokens = await this.deduplicator.getOrRun(sessionId, async () => {
+        const res = await apiPost(
+          "/v1/session/refresh",
+          this.apiKey,
+          { refresh_token: params.refreshToken }
+        );
+        return { accessToken: res.access_token, refreshToken: res.refresh_token };
+      });
+      currentAccessToken = newTokens.accessToken;
+      try {
+        await this.store.setTokens(sessionId, newTokens);
+      } catch (err) {
+        this.logger.error("session.store.setTokens.failed", { sessionId: sessionId.slice(0, 8) });
+      }
+    }
+    await apiPost(
+      "/v1/session/logout",
+      this.apiKey,
+      { access_token: currentAccessToken }
+    );
+    try {
+      await this.store.deleteSession(sessionId);
+    } catch (err) {
+      this.logger.error("session.store.deleteSession.failed", { sessionId: sessionId.slice(0, 8) });
+    }
+    this.logger.info("session.logged_out", { sessionId: sessionId.slice(0, 8) });
+  }
+};
+
+// src/session/JwksCache.ts
+var import_crypto = __toESM(require("crypto"), 1);
+var CACHE_TTL_MS = 60 * 60 * 1e3;
+var JwksCache = class {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  logger;
+  keyMap = /* @__PURE__ */ new Map();
+  fetchedAt = 0;
+  fetching = null;
+  async getKey(kid) {
+    if (this.keyMap.size === 0 || Date.now() - this.fetchedAt > CACHE_TTL_MS) {
+      await this.fetch();
+    }
+    let key = this.keyMap.get(kid);
+    if (!key) {
+      this.logger.debug("jwks.unknown_kid", { kid });
+      await this.fetch();
+      key = this.keyMap.get(kid);
+    }
+    if (!key) throw new MiniMothError("INVALID_TOKEN", `No public key found for kid: ${kid}`, 401);
+    return key;
+  }
+  fetch() {
+    if (this.fetching) return this.fetching;
+    this.fetching = this.doFetch().finally(() => {
+      this.fetching = null;
+    });
+    return this.fetching;
+  }
+  async doFetch() {
+    this.logger.debug("jwks.fetch");
+    const data = await apiGet("/.well-known/jwks.json");
+    const newMap = /* @__PURE__ */ new Map();
+    for (const jwk of data.keys) {
+      if (jwk["kid"] && jwk["kty"] === "RSA") {
+        const key = import_crypto.default.createPublicKey({ key: jwk, format: "jwk" });
+        newMap.set(jwk["kid"], key);
+      }
+    }
+    this.keyMap = newMap;
+    this.fetchedAt = Date.now();
+    this.logger.debug("jwks.updated", { keyCount: newMap.size });
+  }
+};
+
+// src/session/RevocationCache.ts
+var MODE_TTL_MS = {
+  recheck_1m: 6e4,
+  recheck_3m: 18e4
+};
+var EVICTION_TTL_MS = 5 * 60 * 1e3;
+var CLEANUP_WINDOW_MS = 5 * 60 * 1e3;
+var RevocationCache = class {
+  constructor(mode, apiKey, logger) {
+    this.mode = mode;
+    this.apiKey = apiKey;
+    this.logger = logger;
+  }
+  mode;
+  apiKey;
+  logger;
+  cache = /* @__PURE__ */ new Map();
+  lastCleanedAt = 0;
+  async check(jti, accessToken) {
+    if (this.mode === "instant") return true;
+    if (this.mode !== "strict") this.maybeCleanup();
+    const ttl = MODE_TTL_MS[this.mode] ?? 0;
+    if (ttl > 0) {
+      const entry = this.cache.get(jti);
+      if (entry && Date.now() - entry.checkedAt < ttl) {
+        this.logger.debug("revocation.cache.hit", { jti: jti.slice(0, 8) });
+        return true;
+      }
+    }
+    try {
+      const result = await apiPost(
+        "/v1/session/validate",
+        this.apiKey,
+        { access_token: accessToken }
+      );
+      if (result.valid && ttl > 0) {
+        this.cache.set(jti, { checkedAt: Date.now() });
+      }
+      return result.valid;
+    } catch (err) {
+      if (this.mode === "strict") throw err;
+      this.logger.warn("revocation.check.failed_open", {
+        jti: jti.slice(0, 8),
+        error: err instanceof Error ? err.message : "unknown"
+      });
+      return true;
+    }
+  }
+  maybeCleanup() {
+    const now = Date.now();
+    if (now - this.lastCleanedAt < CLEANUP_WINDOW_MS) return;
+    this.lastCleanedAt = now;
+    for (const [jti, entry] of this.cache) {
+      if (now - entry.checkedAt > EVICTION_TTL_MS) {
+        this.cache.delete(jti);
+      }
+    }
+  }
+};
+
+// src/session/RefreshDeduplicator.ts
+var RefreshDeduplicator = class {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  logger;
+  inflight = /* @__PURE__ */ new Map();
+  getOrRun(sessionId, fn) {
+    const existing = this.inflight.get(sessionId);
+    if (existing) {
+      this.logger.debug("refresh dedup hit", { key: sessionId });
+      return existing;
+    }
+    const promise = fn().finally(() => {
+      this.inflight.delete(sessionId);
+    });
+    this.inflight.set(sessionId, promise);
+    return promise;
+  }
+};
+
+// src/store/DefaultSessionStore.ts
+var DefaultSessionStore = class {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  logger;
+  map = /* @__PURE__ */ new Map();
+  warnedProduction = false;
+  maybeWarn() {
+    if (process.env["NODE_ENV"] === "production" && !this.warnedProduction) {
+      this.warnedProduction = true;
+      this.logger.warn("using default in-memory session store \u2014 not suitable for multi-replica deployments");
+    }
+  }
+  async getRefreshToken(sessionId) {
+    this.maybeWarn();
+    return this.map.get(sessionId)?.refreshToken ?? null;
+  }
+  async setTokens(sessionId, tokens) {
+    this.maybeWarn();
+    this.map.set(sessionId, tokens);
+  }
+  async deleteSession(sessionId) {
+    this.map.delete(sessionId);
+  }
+};
+
+// src/logger/ConsoleLogger.ts
+var LEVEL_ORDER = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+  silent: 4
+};
+var ConsoleLogger = class {
+  level;
+  constructor(level = "info") {
+    this.level = level;
+  }
+  setLevel(level) {
+    this.level = level;
+  }
+  shouldLog(level) {
+    return LEVEL_ORDER[level] >= LEVEL_ORDER[this.level];
+  }
+  format(msg, meta) {
+    if (!meta || Object.keys(meta).length === 0) return `[minimoth] ${msg}`;
+    return `[minimoth] ${msg} ${JSON.stringify(meta)}`;
+  }
+  debug(msg, meta) {
+    if (this.shouldLog("debug")) console.debug(this.format(msg, meta));
+  }
+  info(msg, meta) {
+    if (this.shouldLog("info")) console.info(this.format(msg, meta));
+  }
+  warn(msg, meta) {
+    if (this.shouldLog("warn")) console.warn(this.format(msg, meta));
+  }
+  error(msg, meta) {
+    if (this.shouldLog("error")) console.error(this.format(msg, meta));
+  }
+};
+
+// src/MiniMoth.ts
+var MiniMoth = class {
+  otp;
+  session;
+  consoleLogger;
+  constructor(config) {
+    this.consoleLogger = new ConsoleLogger(config.logLevel ?? "info");
+    const logger = config.logger ?? this.consoleLogger;
+    const store = config.session?.store ?? new DefaultSessionStore(logger);
+    const validateMode = config.session?.validateMode ?? "instant";
+    const jwksCache = new JwksCache(logger);
+    const revocationCache = new RevocationCache(validateMode, config.apiKey, logger);
+    const deduplicator = new RefreshDeduplicator(logger);
+    this.otp = new OtpClient(config.apiKey, store, logger);
+    this.session = new SessionClient(
+      config.apiKey,
+      jwksCache,
+      revocationCache,
+      deduplicator,
+      store,
+      logger
+    );
+  }
+  // Only affects the built-in ConsoleLogger. Has no effect if a custom logger was provided.
+  setLogLevel(level) {
+    this.consoleLogger.setLevel(level);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MiniMoth,
+  MiniMothError
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../node_modules/tsup/assets/cjs_shims.js","../src/otp/OtpClient.ts","../src/MiniMothError.ts","../src/http.ts","../src/session/SessionClient.ts","../src/session/JwksCache.ts","../src/session/RevocationCache.ts","../src/session/RefreshDeduplicator.ts","../src/store/DefaultSessionStore.ts","../src/logger/ConsoleLogger.ts","../src/MiniMoth.ts"],"sourcesContent":["export { MiniMoth } from './MiniMoth'\nexport { MiniMothError } from './MiniMothError'\nexport type { MiniMothErrorCode } from './MiniMothError'\nexport type { Session, ValidateMode, MiniMothConfig, AccessTokenPayload } from './types'\nexport type { MiniMothSessionStore } from './store/MiniMothSessionStore'\nexport type { MiniMothLogger } from './logger/MiniMothLogger'\n","// Shim globals in cjs bundle\n// There's a weird bug that esbuild will always inject importMetaUrl\n// if we export it as `const importMetaUrl = ... __filename ...`\n// But using a function will not cause this issue\n\nconst getImportMetaUrl = () => \n  typeof document === \"undefined\" \n    ? new URL(`file:${__filename}`).href \n    : (document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT') \n      ? document.currentScript.src \n      : new URL(\"main.js\", document.baseURI).href;\n\nexport const importMetaUrl = /* @__PURE__ */ getImportMetaUrl()\n","import jwt from 'jsonwebtoken'\nimport { apiPost } from '../http'\nimport { MiniMothError, type MiniMothErrorCode } from '../MiniMothError'\nimport type { MiniMothSessionStore } from '../store/MiniMothSessionStore'\nimport type { MiniMothLogger } from '../logger/MiniMothLogger'\nimport type { AccessTokenPayload } from '../types'\n\ntype VerifyResult =\n  | { valid: true; accessToken: string; refreshToken: string; sessionId: string }\n  | { valid: false; code: MiniMothErrorCode }\n\nexport class OtpClient {\n  constructor(\n    private readonly apiKey: string,\n    private readonly store: MiniMothSessionStore,\n    private readonly logger: MiniMothLogger\n  ) {}\n\n  async send(params: { phone: string }): Promise<void> {\n    const phone = normalizePhone(params.phone)\n    await apiPost<{ message: string }>('/v1/otp/send', this.apiKey, { phone })\n    this.logger.info('otp.sent', { phone: maskPhone(phone) })\n  }\n\n  async verify(params: { phone: string; otp: string }): Promise<VerifyResult> {\n    const phone = normalizePhone(params.phone)\n    validateOtp(params.otp)\n\n    try {\n      const res = await apiPost<{ access_token: string; refresh_token: string; expires_at: string }>(\n        '/v1/otp/verify',\n        this.apiKey,\n        { phone, code: params.otp }\n      )\n\n      const payload = jwt.decode(res.access_token) as AccessTokenPayload | null\n      if (!payload?.session_id) {\n        throw new MiniMothError('INVALID_TOKEN', 'Could not decode session_id from access token', 0)\n      }\n\n      try {\n        await this.store.setTokens(payload.session_id, {\n          accessToken: res.access_token,\n          refreshToken: res.refresh_token,\n        })\n      } catch {\n        this.logger.error('otp.store.setTokens.failed', { sessionId: payload.session_id.slice(0, 8) })\n      }\n\n      this.logger.info('otp.verified', { sessionId: payload.session_id.slice(0, 8) })\n\n      return {\n        valid: true,\n        accessToken: res.access_token,\n        refreshToken: res.refresh_token,\n        sessionId: payload.session_id,\n      }\n    } catch (err) {\n      if (err instanceof MiniMothError) {\n        if (err.code === 'INVALID_OTP' || err.code === 'OTP_EXPIRED' || err.code === 'INVALID_PHONE') {\n          this.logger.debug('otp.verify.failed', { code: err.code })\n          return { valid: false, code: err.code }\n        }\n      }\n      throw err\n    }\n  }\n}\n\n// Normalizes to 12-digit canonical Indian format (91XXXXXXXXXX).\n// Rejects if spaces or hyphens are present.\nfunction normalizePhone(raw: string): string {\n  if (!raw || typeof raw !== 'string') {\n    throw new MiniMothError('INVALID_PHONE', 'Phone number is required', 422)\n  }\n  if (/[\\s-]/.test(raw)) {\n    throw new MiniMothError('INVALID_PHONE', 'Phone number must not contain spaces or hyphens', 422)\n  }\n  let phone = raw\n  if (phone.startsWith('+')) phone = phone.slice(1)\n  // 10-digit subscriber number — prepend country code\n  if (phone.length === 10) phone = '91' + phone\n  return phone\n}\n\nfunction validateOtp(otp: string): void {\n  if (!otp || typeof otp !== 'string') {\n    throw new MiniMothError('INVALID_OTP', 'OTP is required', 422)\n  }\n}\n\nexport function maskPhone(phone: string): string {\n  if (phone.length <= 4) return '****'\n  return phone.slice(0, 4) + '*'.repeat(Math.max(phone.length - 6, 1)) + phone.slice(-2)\n}\n","export type MiniMothErrorCode =\n  | 'TOKEN_EXPIRED'\n  | 'TOKEN_REVOKED'\n  | 'INVALID_TOKEN'\n  | 'INVALID_OTP'\n  | 'OTP_EXPIRED'\n  | 'RATE_LIMITED'\n  | 'INSUFFICIENT_BALANCE'\n  | 'NETWORK_ERROR'\n  | 'INVALID_PHONE'\n  | 'UNKNOWN_ERROR'\n\nexport class MiniMothError extends Error {\n  readonly code: MiniMothErrorCode\n  readonly statusCode: number\n\n  constructor(code: MiniMothErrorCode, message: string, statusCode: number, cause?: unknown) {\n    super(message, cause !== undefined ? { cause } : undefined)\n    this.name = 'MiniMothError'\n    this.code = code\n    this.statusCode = statusCode\n    // Restore prototype chain for instanceof checks across module boundaries\n    Object.setPrototypeOf(this, new.target.prototype)\n  }\n}\n","import { MiniMothError, type MiniMothErrorCode } from './MiniMothError'\nimport { createRequire } from 'module'\n\nconst require = createRequire(import.meta.url)\n// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\nconst pkg = require('../package.json') as { version: string }\n\nconst BASE_URL = 'https://api.minimoth.dev'\nconst USER_AGENT = `minimoth-sdk-node/${pkg.version}`\n\nconst BACKEND_CODE_MAP: Record<string, MiniMothErrorCode> = {\n  INVALID_ACCESS_TOKEN: 'INVALID_TOKEN',\n  TOKEN_EXPIRED: 'TOKEN_EXPIRED',\n  TOKEN_REVOKED: 'TOKEN_REVOKED',\n  INVALID_OTP: 'INVALID_OTP',\n  OTP_NOT_FOUND: 'OTP_EXPIRED',\n  OTP_RATE_LIMITED: 'RATE_LIMITED',\n  VERIFY_RATE_LIMITED: 'RATE_LIMITED',\n  INSUFFICIENT_BALANCE: 'INSUFFICIENT_BALANCE',\n  INVALID_PHONE: 'INVALID_PHONE',\n}\n\nasync function handleResponse<T>(response: Response): Promise<T> {\n  if (response.ok) return response.json() as Promise<T>\n\n  let body: { code?: string; error?: string } = {}\n  try { body = await response.json() as { code?: string; error?: string } } catch {}\n\n  const sdkCode: MiniMothErrorCode = BACKEND_CODE_MAP[body.code ?? ''] ?? 'UNKNOWN_ERROR'\n  throw new MiniMothError(sdkCode, body.error ?? 'Unknown error', response.status)\n}\n\nexport async function apiPost<T>(\n  path: string,\n  apiKey: string,\n  body: Record<string, unknown>\n): Promise<T> {\n  let response: Response\n  try {\n    response = await fetch(`${BASE_URL}${path}`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        'X-Api-Key': apiKey,\n        'User-Agent': USER_AGENT,\n      },\n      body: JSON.stringify(body),\n    })\n  } catch (err) {\n    throw new MiniMothError('NETWORK_ERROR', 'Network request failed', 0, err)\n  }\n  return handleResponse<T>(response)\n}\n\nexport async function apiGet<T>(path: string): Promise<T> {\n  let response: Response\n  try {\n    response = await fetch(`${BASE_URL}${path}`, {\n      headers: { 'User-Agent': USER_AGENT },\n    })\n  } catch (err) {\n    throw new MiniMothError('NETWORK_ERROR', 'Network request failed', 0, err)\n  }\n  return handleResponse<T>(response)\n}\n","import jwt from 'jsonwebtoken'\nimport { apiPost } from '../http'\nimport { MiniMothError, type MiniMothErrorCode } from '../MiniMothError'\nimport type { JwksCache } from './JwksCache'\nimport type { RevocationCache } from './RevocationCache'\nimport type { RefreshDeduplicator } from './RefreshDeduplicator'\nimport type { MiniMothSessionStore } from '../store/MiniMothSessionStore'\nimport type { MiniMothLogger } from '../logger/MiniMothLogger'\nimport type { Session, AccessTokenPayload } from '../types'\n\ntype Tokens = { accessToken: string; refreshToken: string }\n\ntype SafeValidateResult =\n  | { valid: true; session: Session }\n  | { valid: false; code: MiniMothErrorCode }\n\nexport class SessionClient {\n  constructor(\n    private readonly apiKey: string,\n    private readonly jwksCache: JwksCache,\n    private readonly revocationCache: RevocationCache,\n    private readonly deduplicator: RefreshDeduplicator,\n    private readonly store: MiniMothSessionStore,\n    private readonly logger: MiniMothLogger\n  ) {}\n\n  async validate(accessToken: string): Promise<Session> {\n    const decoded = jwt.decode(accessToken, { complete: true })\n    if (!decoded || typeof decoded === 'string') {\n      throw new MiniMothError('INVALID_TOKEN', 'Token is malformed', 401)\n    }\n\n    const kid = (decoded.header as unknown as Record<string, string>)['kid']\n    if (!kid) throw new MiniMothError('INVALID_TOKEN', 'Token is missing kid header', 401)\n\n    const publicKey = await this.jwksCache.getKey(kid)\n\n    let currentToken = accessToken\n    let newTokens: Tokens | undefined\n\n    try {\n      jwt.verify(accessToken, publicKey, { algorithms: ['RS256'] })\n    } catch (err) {\n      if (err instanceof jwt.TokenExpiredError) {\n        const expiredPayload = decoded.payload as AccessTokenPayload\n        const sessionId = expiredPayload?.session_id\n        if (!sessionId) throw new MiniMothError('INVALID_TOKEN', 'Token is invalid', 401)\n\n        newTokens = await this.deduplicator.getOrRun(sessionId, async () => {\n          const refreshToken = await this.store.getRefreshToken(sessionId)\n          if (!refreshToken) {\n            throw new MiniMothError('TOKEN_EXPIRED', 'Access token expired and no refresh token available', 401)\n          }\n\n          this.logger.info('session.auto_refresh', { sessionId: sessionId.slice(0, 8) })\n          const res = await apiPost<{ access_token: string; refresh_token: string }>(\n            '/v1/session/refresh',\n            this.apiKey,\n            { refresh_token: refreshToken }\n          )\n\n          try {\n            await this.store.setTokens(sessionId, {\n              accessToken: res.access_token,\n              refreshToken: res.refresh_token,\n            })\n          } catch (err) {\n            this.logger.error('session.store.setTokens.failed', { sessionId: sessionId.slice(0, 8) })\n          }\n\n          return { accessToken: res.access_token, refreshToken: res.refresh_token }\n        })\n\n        currentToken = newTokens.accessToken\n\n        // Verify the new token\n        const newDecoded = jwt.decode(currentToken, { complete: true })\n        const newKid = (newDecoded?.header as Record<string, string> | undefined)?.['kid']\n        const newKey = newKid ? await this.jwksCache.getKey(newKid) : publicKey\n        jwt.verify(currentToken, newKey, { algorithms: ['RS256'] })\n      } else {\n        throw new MiniMothError('INVALID_TOKEN', 'Token signature is invalid', 401)\n      }\n    }\n\n    const payload = jwt.decode(currentToken) as AccessTokenPayload\n    const isValid = await this.revocationCache.check(payload.jti, currentToken)\n    if (!isValid) throw new MiniMothError('TOKEN_REVOKED', 'Session has been revoked', 401)\n\n    const session: Session = {\n      phone: payload.sub,\n      projectId: payload.project_id,\n      sessionId: payload.session_id,\n      expiresAt: new Date(payload.exp * 1000),\n    }\n    if (newTokens) session.newTokens = newTokens\n\n    this.logger.info('session.validated', { sessionId: payload.session_id.slice(0, 8) })\n    return session\n  }\n\n  async safeValidate(accessToken: string): Promise<SafeValidateResult> {\n    try {\n      const session = await this.validate(accessToken)\n      return { valid: true, session }\n    } catch (err) {\n      if (err instanceof MiniMothError) return { valid: false, code: err.code }\n      throw err\n    }\n  }\n\n  async refresh(refreshToken: string): Promise<Tokens> {\n    const res = await apiPost<{ access_token: string; refresh_token: string }>(\n      '/v1/session/refresh',\n      this.apiKey,\n      { refresh_token: refreshToken }\n    )\n\n    // Update store if session_id is decodable from new token\n    const payload = jwt.decode(res.access_token) as AccessTokenPayload | null\n    if (payload?.session_id) {\n      try {\n        await this.store.setTokens(payload.session_id, {\n          accessToken: res.access_token,\n          refreshToken: res.refresh_token,\n        })\n      } catch (err) {\n        this.logger.error('session.store.setTokens.failed', { sessionId: payload.session_id.slice(0, 8) })\n      }\n    }\n\n    this.logger.info('session.refreshed')\n    return { accessToken: res.access_token, refreshToken: res.refresh_token }\n  }\n\n  async logout(params: { accessToken: string; refreshToken: string }): Promise<void> {\n    const payload = jwt.decode(params.accessToken) as AccessTokenPayload | null\n    const sessionId = payload?.session_id ?? null\n\n    if (!sessionId) throw new MiniMothError('INVALID_TOKEN', 'Cannot decode token', 401)\n\n    let currentAccessToken = params.accessToken\n\n    // If token is expired, refresh before logout — deduplicated to prevent concurrent refresh races\n    if (payload && payload.exp < Math.floor(Date.now() / 1000)) {\n      const newTokens = await this.deduplicator.getOrRun(sessionId, async () => {\n        const res = await apiPost<{ access_token: string; refresh_token: string }>(\n          '/v1/session/refresh',\n          this.apiKey,\n          { refresh_token: params.refreshToken }\n        )\n        return { accessToken: res.access_token, refreshToken: res.refresh_token }\n      })\n      currentAccessToken = newTokens.accessToken\n      try {\n        await this.store.setTokens(sessionId, newTokens)\n      } catch (err) {\n        this.logger.error('session.store.setTokens.failed', { sessionId: sessionId.slice(0, 8) })\n      }\n    }\n\n    await apiPost<{ message: string }>(\n      '/v1/session/logout',\n      this.apiKey,\n      { access_token: currentAccessToken }\n    )\n\n    try {\n      await this.store.deleteSession(sessionId)\n    } catch (err) {\n      this.logger.error('session.store.deleteSession.failed', { sessionId: sessionId.slice(0, 8) })\n    }\n    this.logger.info('session.logged_out', { sessionId: sessionId.slice(0, 8) })\n  }\n}\n","import crypto from 'crypto'\nimport { apiGet } from '../http'\nimport { MiniMothError } from '../MiniMothError'\nimport type { MiniMothLogger } from '../logger/MiniMothLogger'\n\nconst CACHE_TTL_MS = 60 * 60 * 1000  // 1 hour\n\ntype JwkEntry = Record<string, string>\n\nexport class JwksCache {\n  private keyMap = new Map<string, crypto.KeyObject>()\n  private fetchedAt = 0\n  private fetching: Promise<void> | null = null\n\n  constructor(private readonly logger: MiniMothLogger) {}\n\n  async getKey(kid: string): Promise<crypto.KeyObject> {\n    if (this.keyMap.size === 0 || Date.now() - this.fetchedAt > CACHE_TTL_MS) {\n      await this.fetch()\n    }\n\n    let key = this.keyMap.get(kid)\n    if (!key) {\n      this.logger.debug('jwks.unknown_kid', { kid })\n      await this.fetch()\n      key = this.keyMap.get(kid)\n    }\n\n    if (!key) throw new MiniMothError('INVALID_TOKEN', `No public key found for kid: ${kid}`, 401)\n    return key\n  }\n\n  private fetch(): Promise<void> {\n    if (this.fetching) return this.fetching\n    this.fetching = this.doFetch().finally(() => { this.fetching = null })\n    return this.fetching\n  }\n\n  private async doFetch(): Promise<void> {\n    this.logger.debug('jwks.fetch')\n    const data = await apiGet<{ keys: JwkEntry[] }>('/.well-known/jwks.json')\n    const newMap = new Map<string, crypto.KeyObject>()\n    for (const jwk of data.keys) {\n      if (jwk['kid'] && jwk['kty'] === 'RSA') {\n        const key = crypto.createPublicKey({ key: jwk as unknown as crypto.JsonWebKey, format: 'jwk' })\n        newMap.set(jwk['kid'], key)\n      }\n    }\n    this.keyMap = newMap\n    this.fetchedAt = Date.now()\n    this.logger.debug('jwks.updated', { keyCount: newMap.size })\n  }\n}\n","import { apiPost } from '../http'\nimport type { MiniMothLogger } from '../logger/MiniMothLogger'\nimport type { ValidateMode } from '../types'\n\nconst MODE_TTL_MS: Partial<Record<ValidateMode, number>> = {\n  recheck_1m: 60_000,\n  recheck_3m: 180_000,\n}\n\nconst EVICTION_TTL_MS = 5 * 60 * 1000  // JWT max lifetime\nconst CLEANUP_WINDOW_MS = 5 * 60 * 1000\n\ntype Entry = { checkedAt: number }\n\nexport class RevocationCache {\n  private readonly cache = new Map<string, Entry>()\n  private lastCleanedAt = 0\n\n  constructor(\n    private readonly mode: ValidateMode,\n    private readonly apiKey: string,\n    private readonly logger: MiniMothLogger\n  ) {}\n\n  async check(jti: string, accessToken: string): Promise<boolean> {\n    if (this.mode === 'instant') return true\n\n    if (this.mode !== 'strict') this.maybeCleanup()\n\n    const ttl = MODE_TTL_MS[this.mode] ?? 0\n    if (ttl > 0) {\n      const entry = this.cache.get(jti)\n      if (entry && Date.now() - entry.checkedAt < ttl) {\n        this.logger.debug('revocation.cache.hit', { jti: jti.slice(0, 8) })\n        return true\n      }\n    }\n\n    try {\n      const result = await apiPost<{ valid: boolean }>(\n        '/v1/session/validate',\n        this.apiKey,\n        { access_token: accessToken }\n      )\n\n      if (result.valid && ttl > 0) {\n        this.cache.set(jti, { checkedAt: Date.now() })\n      }\n\n      return result.valid\n    } catch (err) {\n      if (this.mode === 'strict') throw err\n\n      // recheck_*m: fail open\n      this.logger.warn('revocation.check.failed_open', {\n        jti: jti.slice(0, 8),\n        error: err instanceof Error ? err.message : 'unknown',\n      })\n      return true\n    }\n  }\n\n  private maybeCleanup(): void {\n    const now = Date.now()\n    if (now - this.lastCleanedAt < CLEANUP_WINDOW_MS) return\n    this.lastCleanedAt = now  // set before iteration to prevent concurrent double-clean\n    for (const [jti, entry] of this.cache) {\n      if (now - entry.checkedAt > EVICTION_TTL_MS) {\n        this.cache.delete(jti)\n      }\n    }\n  }\n}\n","import { MiniMothLogger } from '../logger/MiniMothLogger'\n\ntype Tokens = { accessToken: string; refreshToken: string }\n\nexport class RefreshDeduplicator {\n  private readonly inflight = new Map<string, Promise<unknown>>()\n\n  constructor(private readonly logger: MiniMothLogger) {}\n\n  getOrRun<T>(sessionId: string, fn: () => Promise<T>): Promise<T> {\n    const existing = this.inflight.get(sessionId)\n    if (existing) {\n      this.logger.debug('refresh dedup hit', { key: sessionId })\n      return existing as Promise<T>\n    }\n\n    const promise = fn().finally(() => {\n      this.inflight.delete(sessionId)\n    })\n\n    this.inflight.set(sessionId, promise)\n    return promise\n  }\n}\n","import type { MiniMothSessionStore } from './MiniMothSessionStore'\nimport type { MiniMothLogger } from '../logger/MiniMothLogger'\n\ntype Entry = { accessToken: string; refreshToken: string }\n\nexport class DefaultSessionStore implements MiniMothSessionStore {\n  private readonly map = new Map<string, Entry>()\n  private warnedProduction = false\n\n  constructor(private readonly logger: MiniMothLogger) {}\n\n  private maybeWarn(): void {\n    if (process.env['NODE_ENV'] === 'production' && !this.warnedProduction) {\n      this.warnedProduction = true\n      this.logger.warn('using default in-memory session store — not suitable for multi-replica deployments')\n    }\n  }\n\n  async getRefreshToken(sessionId: string): Promise<string | null> {\n    this.maybeWarn()\n    return this.map.get(sessionId)?.refreshToken ?? null\n  }\n\n  async setTokens(sessionId: string, tokens: { accessToken: string; refreshToken: string }): Promise<void> {\n    this.maybeWarn()\n    this.map.set(sessionId, tokens)\n  }\n\n  async deleteSession(sessionId: string): Promise<void> {\n    this.map.delete(sessionId)\n  }\n}\n","import type { MiniMothLogger } from './MiniMothLogger'\n\ntype LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent'\n\nconst LEVEL_ORDER: Record<LogLevel, number> = {\n  debug: 0, info: 1, warn: 2, error: 3, silent: 4,\n}\n\nexport class ConsoleLogger implements MiniMothLogger {\n  private level: LogLevel\n\n  constructor(level: LogLevel = 'info') {\n    this.level = level\n  }\n\n  setLevel(level: LogLevel): void {\n    this.level = level\n  }\n\n  private shouldLog(level: LogLevel): boolean {\n    return LEVEL_ORDER[level] >= LEVEL_ORDER[this.level]\n  }\n\n  private format(msg: string, meta?: Record<string, unknown>): string {\n    if (!meta || Object.keys(meta).length === 0) return `[minimoth] ${msg}`\n    return `[minimoth] ${msg} ${JSON.stringify(meta)}`\n  }\n\n  debug(msg: string, meta?: Record<string, unknown>): void {\n    if (this.shouldLog('debug')) console.debug(this.format(msg, meta))\n  }\n\n  info(msg: string, meta?: Record<string, unknown>): void {\n    if (this.shouldLog('info')) console.info(this.format(msg, meta))\n  }\n\n  warn(msg: string, meta?: Record<string, unknown>): void {\n    if (this.shouldLog('warn')) console.warn(this.format(msg, meta))\n  }\n\n  error(msg: string, meta?: Record<string, unknown>): void {\n    if (this.shouldLog('error')) console.error(this.format(msg, meta))\n  }\n}\n","import { OtpClient } from './otp/OtpClient'\nimport { SessionClient } from './session/SessionClient'\nimport { JwksCache } from './session/JwksCache'\nimport { RevocationCache } from './session/RevocationCache'\nimport { RefreshDeduplicator } from './session/RefreshDeduplicator'\nimport { DefaultSessionStore } from './store/DefaultSessionStore'\nimport { ConsoleLogger } from './logger/ConsoleLogger'\nimport type { MiniMothConfig } from './types'\n\ntype LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent'\n\nexport class MiniMoth {\n  readonly otp: OtpClient\n  readonly session: SessionClient\n  private readonly consoleLogger: ConsoleLogger\n\n  constructor(config: MiniMothConfig) {\n    this.consoleLogger = new ConsoleLogger(config.logLevel ?? 'info')\n    const logger = config.logger ?? this.consoleLogger\n\n    const store = config.session?.store ?? new DefaultSessionStore(logger)\n    const validateMode = config.session?.validateMode ?? 'instant'\n\n    const jwksCache = new JwksCache(logger)\n    const revocationCache = new RevocationCache(validateMode, config.apiKey, logger)\n    const deduplicator = new RefreshDeduplicator(logger)\n\n    this.otp = new OtpClient(config.apiKey, store, logger)\n    this.session = new SessionClient(\n      config.apiKey,\n      jwksCache,\n      revocationCache,\n      deduplicator,\n      store,\n      logger\n    )\n  }\n\n  // Only affects the built-in ConsoleLogger. Has no effect if a custom logger was provided.\n  setLogLevel(level: LogLevel): void {\n    this.consoleLogger.setLevel(level)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,IAAM,mBAAmB,MACvB,OAAO,aAAa,cAChB,IAAI,IAAI,QAAQ,UAAU,EAAE,EAAE,OAC7B,SAAS,iBAAiB,SAAS,cAAc,QAAQ,YAAY,MAAM,WAC1E,SAAS,cAAc,MACvB,IAAI,IAAI,WAAW,SAAS,OAAO,EAAE;AAEtC,IAAM,gBAAgC,iCAAiB;;;ACZ9D,0BAAgB;;;ACYT,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EAET,YAAY,MAAyB,SAAiB,YAAoB,OAAiB;AACzF,UAAM,SAAS,UAAU,SAAY,EAAE,MAAM,IAAI,MAAS;AAC1D,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAElB,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;;;ACvBA,oBAA8B;AAE9B,IAAMA,eAAU,6BAAc,aAAe;AAE7C,IAAM,MAAMA,SAAQ,iBAAiB;AAErC,IAAM,WAAW;AACjB,IAAM,aAAa,qBAAqB,IAAI,OAAO;AAEnD,IAAM,mBAAsD;AAAA,EAC1D,sBAAsB;AAAA,EACtB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,aAAa;AAAA,EACb,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,eAAe;AACjB;AAEA,eAAe,eAAkB,UAAgC;AAC/D,MAAI,SAAS,GAAI,QAAO,SAAS,KAAK;AAEtC,MAAI,OAA0C,CAAC;AAC/C,MAAI;AAAE,WAAO,MAAM,SAAS,KAAK;AAAA,EAAuC,QAAQ;AAAA,EAAC;AAEjF,QAAM,UAA6B,iBAAiB,KAAK,QAAQ,EAAE,KAAK;AACxE,QAAM,IAAI,cAAc,SAAS,KAAK,SAAS,iBAAiB,SAAS,MAAM;AACjF;AAEA,eAAsB,QACpB,MACA,QACA,MACY;AACZ,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,MAAM,GAAG,QAAQ,GAAG,IAAI,IAAI;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,cAAc,iBAAiB,0BAA0B,GAAG,GAAG;AAAA,EAC3E;AACA,SAAO,eAAkB,QAAQ;AACnC;AAEA,eAAsB,OAAU,MAA0B;AACxD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,MAAM,GAAG,QAAQ,GAAG,IAAI,IAAI;AAAA,MAC3C,SAAS,EAAE,cAAc,WAAW;AAAA,IACtC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,cAAc,iBAAiB,0BAA0B,GAAG,GAAG;AAAA,EAC3E;AACA,SAAO,eAAkB,QAAQ;AACnC;;;AFrDO,IAAM,YAAN,MAAgB;AAAA,EACrB,YACmB,QACA,OACA,QACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAHgB;AAAA,EACA;AAAA,EACA;AAAA,EAGnB,MAAM,KAAK,QAA0C;AACnD,UAAM,QAAQ,eAAe,OAAO,KAAK;AACzC,UAAM,QAA6B,gBAAgB,KAAK,QAAQ,EAAE,MAAM,CAAC;AACzE,SAAK,OAAO,KAAK,YAAY,EAAE,OAAO,UAAU,KAAK,EAAE,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,OAAO,QAA+D;AAC1E,UAAM,QAAQ,eAAe,OAAO,KAAK;AACzC,gBAAY,OAAO,GAAG;AAEtB,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,KAAK;AAAA,QACL,EAAE,OAAO,MAAM,OAAO,IAAI;AAAA,MAC5B;AAEA,YAAM,UAAU,oBAAAC,QAAI,OAAO,IAAI,YAAY;AAC3C,UAAI,CAAC,SAAS,YAAY;AACxB,cAAM,IAAI,cAAc,iBAAiB,iDAAiD,CAAC;AAAA,MAC7F;AAEA,UAAI;AACF,cAAM,KAAK,MAAM,UAAU,QAAQ,YAAY;AAAA,UAC7C,aAAa,IAAI;AAAA,UACjB,cAAc,IAAI;AAAA,QACpB,CAAC;AAAA,MACH,QAAQ;AACN,aAAK,OAAO,MAAM,8BAA8B,EAAE,WAAW,QAAQ,WAAW,MAAM,GAAG,CAAC,EAAE,CAAC;AAAA,MAC/F;AAEA,WAAK,OAAO,KAAK,gBAAgB,EAAE,WAAW,QAAQ,WAAW,MAAM,GAAG,CAAC,EAAE,CAAC;AAE9E,aAAO;AAAA,QACL,OAAO;AAAA,QACP,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI;AAAA,QAClB,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,eAAe;AAChC,YAAI,IAAI,SAAS,iBAAiB,IAAI,SAAS,iBAAiB,IAAI,SAAS,iBAAiB;AAC5F,eAAK,OAAO,MAAM,qBAAqB,EAAE,MAAM,IAAI,KAAK,CAAC;AACzD,iBAAO,EAAE,OAAO,OAAO,MAAM,IAAI,KAAK;AAAA,QACxC;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAIA,SAAS,eAAe,KAAqB;AAC3C,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,cAAc,iBAAiB,4BAA4B,GAAG;AAAA,EAC1E;AACA,MAAI,QAAQ,KAAK,GAAG,GAAG;AACrB,UAAM,IAAI,cAAc,iBAAiB,mDAAmD,GAAG;AAAA,EACjG;AACA,MAAI,QAAQ;AACZ,MAAI,MAAM,WAAW,GAAG,EAAG,SAAQ,MAAM,MAAM,CAAC;AAEhD,MAAI,MAAM,WAAW,GAAI,SAAQ,OAAO;AACxC,SAAO;AACT;AAEA,SAAS,YAAY,KAAmB;AACtC,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,cAAc,eAAe,mBAAmB,GAAG;AAAA,EAC/D;AACF;AAEO,SAAS,UAAU,OAAuB;AAC/C,MAAI,MAAM,UAAU,EAAG,QAAO;AAC9B,SAAO,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,KAAK,IAAI,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,MAAM,MAAM,EAAE;AACvF;;;AG9FA,IAAAC,uBAAgB;AAgBT,IAAM,gBAAN,MAAoB;AAAA,EACzB,YACmB,QACA,WACA,iBACA,cACA,OACA,QACjB;AANiB;AACA;AACA;AACA;AACA;AACA;AAAA,EAChB;AAAA,EANgB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGnB,MAAM,SAAS,aAAuC;AACpD,UAAM,UAAU,qBAAAC,QAAI,OAAO,aAAa,EAAE,UAAU,KAAK,CAAC;AAC1D,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,cAAc,iBAAiB,sBAAsB,GAAG;AAAA,IACpE;AAEA,UAAM,MAAO,QAAQ,OAA6C,KAAK;AACvE,QAAI,CAAC,IAAK,OAAM,IAAI,cAAc,iBAAiB,+BAA+B,GAAG;AAErF,UAAM,YAAY,MAAM,KAAK,UAAU,OAAO,GAAG;AAEjD,QAAI,eAAe;AACnB,QAAI;AAEJ,QAAI;AACF,2BAAAA,QAAI,OAAO,aAAa,WAAW,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;AAAA,IAC9D,SAAS,KAAK;AACZ,UAAI,eAAe,qBAAAA,QAAI,mBAAmB;AACxC,cAAM,iBAAiB,QAAQ;AAC/B,cAAM,YAAY,gBAAgB;AAClC,YAAI,CAAC,UAAW,OAAM,IAAI,cAAc,iBAAiB,oBAAoB,GAAG;AAEhF,oBAAY,MAAM,KAAK,aAAa,SAAS,WAAW,YAAY;AAClE,gBAAM,eAAe,MAAM,KAAK,MAAM,gBAAgB,SAAS;AAC/D,cAAI,CAAC,cAAc;AACjB,kBAAM,IAAI,cAAc,iBAAiB,uDAAuD,GAAG;AAAA,UACrG;AAEA,eAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC,EAAE,CAAC;AAC7E,gBAAM,MAAM,MAAM;AAAA,YAChB;AAAA,YACA,KAAK;AAAA,YACL,EAAE,eAAe,aAAa;AAAA,UAChC;AAEA,cAAI;AACF,kBAAM,KAAK,MAAM,UAAU,WAAW;AAAA,cACpC,aAAa,IAAI;AAAA,cACjB,cAAc,IAAI;AAAA,YACpB,CAAC;AAAA,UACH,SAASC,MAAK;AACZ,iBAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC,EAAE,CAAC;AAAA,UAC1F;AAEA,iBAAO,EAAE,aAAa,IAAI,cAAc,cAAc,IAAI,cAAc;AAAA,QAC1E,CAAC;AAED,uBAAe,UAAU;AAGzB,cAAM,aAAa,qBAAAD,QAAI,OAAO,cAAc,EAAE,UAAU,KAAK,CAAC;AAC9D,cAAM,SAAU,YAAY,SAAgD,KAAK;AACjF,cAAM,SAAS,SAAS,MAAM,KAAK,UAAU,OAAO,MAAM,IAAI;AAC9D,6BAAAA,QAAI,OAAO,cAAc,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;AAAA,MAC5D,OAAO;AACL,cAAM,IAAI,cAAc,iBAAiB,8BAA8B,GAAG;AAAA,MAC5E;AAAA,IACF;AAEA,UAAM,UAAU,qBAAAA,QAAI,OAAO,YAAY;AACvC,UAAM,UAAU,MAAM,KAAK,gBAAgB,MAAM,QAAQ,KAAK,YAAY;AAC1E,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,iBAAiB,4BAA4B,GAAG;AAEtF,UAAM,UAAmB;AAAA,MACvB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,MACnB,WAAW,IAAI,KAAK,QAAQ,MAAM,GAAI;AAAA,IACxC;AACA,QAAI,UAAW,SAAQ,YAAY;AAEnC,SAAK,OAAO,KAAK,qBAAqB,EAAE,WAAW,QAAQ,WAAW,MAAM,GAAG,CAAC,EAAE,CAAC;AACnF,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,aAAkD;AACnE,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,SAAS,WAAW;AAC/C,aAAO,EAAE,OAAO,MAAM,QAAQ;AAAA,IAChC,SAAS,KAAK;AACZ,UAAI,eAAe,cAAe,QAAO,EAAE,OAAO,OAAO,MAAM,IAAI,KAAK;AACxE,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,cAAuC;AACnD,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,MACL,EAAE,eAAe,aAAa;AAAA,IAChC;AAGA,UAAM,UAAU,qBAAAA,QAAI,OAAO,IAAI,YAAY;AAC3C,QAAI,SAAS,YAAY;AACvB,UAAI;AACF,cAAM,KAAK,MAAM,UAAU,QAAQ,YAAY;AAAA,UAC7C,aAAa,IAAI;AAAA,UACjB,cAAc,IAAI;AAAA,QACpB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,aAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,QAAQ,WAAW,MAAM,GAAG,CAAC,EAAE,CAAC;AAAA,MACnG;AAAA,IACF;AAEA,SAAK,OAAO,KAAK,mBAAmB;AACpC,WAAO,EAAE,aAAa,IAAI,cAAc,cAAc,IAAI,cAAc;AAAA,EAC1E;AAAA,EAEA,MAAM,OAAO,QAAsE;AACjF,UAAM,UAAU,qBAAAA,QAAI,OAAO,OAAO,WAAW;AAC7C,UAAM,YAAY,SAAS,cAAc;AAEzC,QAAI,CAAC,UAAW,OAAM,IAAI,cAAc,iBAAiB,uBAAuB,GAAG;AAEnF,QAAI,qBAAqB,OAAO;AAGhC,QAAI,WAAW,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AAC1D,YAAM,YAAY,MAAM,KAAK,aAAa,SAAS,WAAW,YAAY;AACxE,cAAM,MAAM,MAAM;AAAA,UAChB;AAAA,UACA,KAAK;AAAA,UACL,EAAE,eAAe,OAAO,aAAa;AAAA,QACvC;AACA,eAAO,EAAE,aAAa,IAAI,cAAc,cAAc,IAAI,cAAc;AAAA,MAC1E,CAAC;AACD,2BAAqB,UAAU;AAC/B,UAAI;AACF,cAAM,KAAK,MAAM,UAAU,WAAW,SAAS;AAAA,MACjD,SAAS,KAAK;AACZ,aAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC,EAAE,CAAC;AAAA,MAC1F;AAAA,IACF;AAEA,UAAM;AAAA,MACJ;AAAA,MACA,KAAK;AAAA,MACL,EAAE,cAAc,mBAAmB;AAAA,IACrC;AAEA,QAAI;AACF,YAAM,KAAK,MAAM,cAAc,SAAS;AAAA,IAC1C,SAAS,KAAK;AACZ,WAAK,OAAO,MAAM,sCAAsC,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC,EAAE,CAAC;AAAA,IAC9F;AACA,SAAK,OAAO,KAAK,sBAAsB,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC,EAAE,CAAC;AAAA,EAC7E;AACF;;;AC9KA,oBAAmB;AAKnB,IAAM,eAAe,KAAK,KAAK;AAIxB,IAAM,YAAN,MAAgB;AAAA,EAKrB,YAA6B,QAAwB;AAAxB;AAAA,EAAyB;AAAA,EAAzB;AAAA,EAJrB,SAAS,oBAAI,IAA8B;AAAA,EAC3C,YAAY;AAAA,EACZ,WAAiC;AAAA,EAIzC,MAAM,OAAO,KAAwC;AACnD,QAAI,KAAK,OAAO,SAAS,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,cAAc;AACxE,YAAM,KAAK,MAAM;AAAA,IACnB;AAEA,QAAI,MAAM,KAAK,OAAO,IAAI,GAAG;AAC7B,QAAI,CAAC,KAAK;AACR,WAAK,OAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC;AAC7C,YAAM,KAAK,MAAM;AACjB,YAAM,KAAK,OAAO,IAAI,GAAG;AAAA,IAC3B;AAEA,QAAI,CAAC,IAAK,OAAM,IAAI,cAAc,iBAAiB,gCAAgC,GAAG,IAAI,GAAG;AAC7F,WAAO;AAAA,EACT;AAAA,EAEQ,QAAuB;AAC7B,QAAI,KAAK,SAAU,QAAO,KAAK;AAC/B,SAAK,WAAW,KAAK,QAAQ,EAAE,QAAQ,MAAM;AAAE,WAAK,WAAW;AAAA,IAAK,CAAC;AACrE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UAAyB;AACrC,SAAK,OAAO,MAAM,YAAY;AAC9B,UAAM,OAAO,MAAM,OAA6B,wBAAwB;AACxE,UAAM,SAAS,oBAAI,IAA8B;AACjD,eAAW,OAAO,KAAK,MAAM;AAC3B,UAAI,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,OAAO;AACtC,cAAM,MAAM,cAAAE,QAAO,gBAAgB,EAAE,KAAK,KAAqC,QAAQ,MAAM,CAAC;AAC9F,eAAO,IAAI,IAAI,KAAK,GAAG,GAAG;AAAA,MAC5B;AAAA,IACF;AACA,SAAK,SAAS;AACd,SAAK,YAAY,KAAK,IAAI;AAC1B,SAAK,OAAO,MAAM,gBAAgB,EAAE,UAAU,OAAO,KAAK,CAAC;AAAA,EAC7D;AACF;;;AChDA,IAAM,cAAqD;AAAA,EACzD,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,IAAM,kBAAkB,IAAI,KAAK;AACjC,IAAM,oBAAoB,IAAI,KAAK;AAI5B,IAAM,kBAAN,MAAsB;AAAA,EAI3B,YACmB,MACA,QACA,QACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAHgB;AAAA,EACA;AAAA,EACA;AAAA,EANF,QAAQ,oBAAI,IAAmB;AAAA,EACxC,gBAAgB;AAAA,EAQxB,MAAM,MAAM,KAAa,aAAuC;AAC9D,QAAI,KAAK,SAAS,UAAW,QAAO;AAEpC,QAAI,KAAK,SAAS,SAAU,MAAK,aAAa;AAE9C,UAAM,MAAM,YAAY,KAAK,IAAI,KAAK;AACtC,QAAI,MAAM,GAAG;AACX,YAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,UAAI,SAAS,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK;AAC/C,aAAK,OAAO,MAAM,wBAAwB,EAAE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;AAClE,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,EAAE,cAAc,YAAY;AAAA,MAC9B;AAEA,UAAI,OAAO,SAAS,MAAM,GAAG;AAC3B,aAAK,MAAM,IAAI,KAAK,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,MAC/C;AAEA,aAAO,OAAO;AAAA,IAChB,SAAS,KAAK;AACZ,UAAI,KAAK,SAAS,SAAU,OAAM;AAGlC,WAAK,OAAO,KAAK,gCAAgC;AAAA,QAC/C,KAAK,IAAI,MAAM,GAAG,CAAC;AAAA,QACnB,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,MAC9C,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,MAAM,KAAK,gBAAgB,kBAAmB;AAClD,SAAK,gBAAgB;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,OAAO;AACrC,UAAI,MAAM,MAAM,YAAY,iBAAiB;AAC3C,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;ACpEO,IAAM,sBAAN,MAA0B;AAAA,EAG/B,YAA6B,QAAwB;AAAxB;AAAA,EAAyB;AAAA,EAAzB;AAAA,EAFZ,WAAW,oBAAI,IAA8B;AAAA,EAI9D,SAAY,WAAmB,IAAkC;AAC/D,UAAM,WAAW,KAAK,SAAS,IAAI,SAAS;AAC5C,QAAI,UAAU;AACZ,WAAK,OAAO,MAAM,qBAAqB,EAAE,KAAK,UAAU,CAAC;AACzD,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,GAAG,EAAE,QAAQ,MAAM;AACjC,WAAK,SAAS,OAAO,SAAS;AAAA,IAChC,CAAC;AAED,SAAK,SAAS,IAAI,WAAW,OAAO;AACpC,WAAO;AAAA,EACT;AACF;;;AClBO,IAAM,sBAAN,MAA0D;AAAA,EAI/D,YAA6B,QAAwB;AAAxB;AAAA,EAAyB;AAAA,EAAzB;AAAA,EAHZ,MAAM,oBAAI,IAAmB;AAAA,EACtC,mBAAmB;AAAA,EAInB,YAAkB;AACxB,QAAI,QAAQ,IAAI,UAAU,MAAM,gBAAgB,CAAC,KAAK,kBAAkB;AACtE,WAAK,mBAAmB;AACxB,WAAK,OAAO,KAAK,yFAAoF;AAAA,IACvG;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,WAA2C;AAC/D,SAAK,UAAU;AACf,WAAO,KAAK,IAAI,IAAI,SAAS,GAAG,gBAAgB;AAAA,EAClD;AAAA,EAEA,MAAM,UAAU,WAAmB,QAAsE;AACvG,SAAK,UAAU;AACf,SAAK,IAAI,IAAI,WAAW,MAAM;AAAA,EAChC;AAAA,EAEA,MAAM,cAAc,WAAkC;AACpD,SAAK,IAAI,OAAO,SAAS;AAAA,EAC3B;AACF;;;AC3BA,IAAM,cAAwC;AAAA,EAC5C,OAAO;AAAA,EAAG,MAAM;AAAA,EAAG,MAAM;AAAA,EAAG,OAAO;AAAA,EAAG,QAAQ;AAChD;AAEO,IAAM,gBAAN,MAA8C;AAAA,EAC3C;AAAA,EAER,YAAY,QAAkB,QAAQ;AACpC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,SAAS,OAAuB;AAC9B,SAAK,QAAQ;AAAA,EACf;AAAA,EAEQ,UAAU,OAA0B;AAC1C,WAAO,YAAY,KAAK,KAAK,YAAY,KAAK,KAAK;AAAA,EACrD;AAAA,EAEQ,OAAO,KAAa,MAAwC;AAClE,QAAI,CAAC,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW,EAAG,QAAO,cAAc,GAAG;AACrE,WAAO,cAAc,GAAG,IAAI,KAAK,UAAU,IAAI,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,KAAa,MAAsC;AACvD,QAAI,KAAK,UAAU,OAAO,EAAG,SAAQ,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,EACnE;AAAA,EAEA,KAAK,KAAa,MAAsC;AACtD,QAAI,KAAK,UAAU,MAAM,EAAG,SAAQ,KAAK,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,EACjE;AAAA,EAEA,KAAK,KAAa,MAAsC;AACtD,QAAI,KAAK,UAAU,MAAM,EAAG,SAAQ,KAAK,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,EACjE;AAAA,EAEA,MAAM,KAAa,MAAsC;AACvD,QAAI,KAAK,UAAU,OAAO,EAAG,SAAQ,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,EACnE;AACF;;;AChCO,IAAM,WAAN,MAAe;AAAA,EACX;AAAA,EACA;AAAA,EACQ;AAAA,EAEjB,YAAY,QAAwB;AAClC,SAAK,gBAAgB,IAAI,cAAc,OAAO,YAAY,MAAM;AAChE,UAAM,SAAS,OAAO,UAAU,KAAK;AAErC,UAAM,QAAQ,OAAO,SAAS,SAAS,IAAI,oBAAoB,MAAM;AACrE,UAAM,eAAe,OAAO,SAAS,gBAAgB;AAErD,UAAM,YAAY,IAAI,UAAU,MAAM;AACtC,UAAM,kBAAkB,IAAI,gBAAgB,cAAc,OAAO,QAAQ,MAAM;AAC/E,UAAM,eAAe,IAAI,oBAAoB,MAAM;AAEnD,SAAK,MAAM,IAAI,UAAU,OAAO,QAAQ,OAAO,MAAM;AACrD,SAAK,UAAU,IAAI;AAAA,MACjB,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,YAAY,OAAuB;AACjC,SAAK,cAAc,SAAS,KAAK;AAAA,EACnC;AACF;","names":["require","jwt","import_jsonwebtoken","jwt","err","crypto"]}