@monocloud/auth-core 0.1.4 → 0.1.6

package/dist/index.cjs

@@ -2,10 +2,24 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_utils_internal = require('./utils/internal.cjs');
 
 //#region src/errors/monocloud-auth-base-error.ts
+/**
+* Base class for all MonoCloud authentication errors.
+*
+* All errors thrown by the MonoCloud SDK extend this class, allowing applications to safely detect and handle MonoCloud-specific failures using `instanceof`.
+*
+* @category Error Classes
+*/
 var MonoCloudAuthBaseError = class extends Error {};
 
 //#endregion
 //#region src/errors/monocloud-op-error.ts
+/**
+* OAuth error returned by the authorization server during an authentication or token request.
+*
+* These errors correspond to standard OAuth / OpenID Connect error responses such as `invalid_request`, `access_denied`, or `invalid_grant`.
+*
+* @category Error Classes
+*/
 var MonoCloudOPError = class extends MonoCloudAuthBaseError {
 	constructor(error, errorDescription) {
 		super(error);
@@ -16,14 +30,31 @@ var MonoCloudOPError = class extends MonoCloudAuthBaseError {
 
 //#endregion
 //#region src/errors/monocloud-http-error.ts
+/**
+* Error thrown when a request to the MonoCloud authorization server fails.
+*
+* This error typically indicates a network failure, an unexpected HTTP response, or an unsuccessful response returned by the authorization server.
+*
+* @category Error Classes
+*/
 var MonoCloudHttpError = class extends MonoCloudAuthBaseError {};
 
 //#endregion
 //#region src/errors/monocloud-token-error.ts
+/**
+* Error thrown when a token operation fails.
+*
+* @category Error Classes
+*/
 var MonoCloudTokenError = class extends MonoCloudAuthBaseError {};
 
 //#endregion
 //#region src/errors/monocloud-validation-error.ts
+/**
+* Error thrown when validation fails.
+*
+* @category Error Classes
+*/
 var MonoCloudValidationError = class extends MonoCloudAuthBaseError {};
 
 //#endregion
@@ -224,12 +255,15 @@ const deserializeJson = async (res) => {
 		);
 	}
 };
+/**
+* @category Classes
+*/
 var MonoCloudOidcClient = class MonoCloudOidcClient {
 	constructor(tenantDomain, clientId, options) {
 		this.jwksCacheExpiry = 0;
-		this.jwksCacheDuration = 60;
+		this.jwksCacheDuration = 300;
 		this.metadataCacheExpiry = 0;
-		this.metadataCacheDuration = 60;
+		this.metadataCacheDuration = 300;
 		tenantDomain ??= "";
 		/* v8 ignore next -- @preserve */
 		this.tenantDomain = `${!tenantDomain.startsWith("https://") ? "https://" : ""}${tenantDomain.endsWith("/") ? tenantDomain.slice(0, -1) : tenantDomain}`;
@@ -245,9 +279,9 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	*
 	* If no values are provided for `responseType`, or `codeChallengeMethod`, they default to `code`, and `S256`, respectively.
 	*
-	* @param params Authorization URL parameters
+	* @param params - Authorization URL parameters.
 	*
-	* @returns Tenant's authorization url.
+	* @returns Tenant's authorization URL.
 	*
 	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
 	* unexpected status code during the request or a serialization error while processing the response.
@@ -306,7 +340,7 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 		return metadata;
 	}
 	/**
-	* Fetches the JSON Web Keys used to sign the id token.
+	* Fetches the JSON Web Keys used to sign the ID token.
 	* The JWKS is cached for 1 minute.
 	*
 	* @param forceRefresh - If `true`, bypasses the cache and fetches fresh set of JWKS from the server.
@@ -332,9 +366,9 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	/**
 	* Performs a pushed authorization request.
 	*
-	* @param params - Authorization Parameters
+	* @param params - Authorization Parameters.
 	*
-	* @returns Response from Pushed Authorization Request (PAR) endpoint
+	* @returns Response from Pushed Authorization Request (PAR) endpoint.
 	*
 	* @throws {@link MonoCloudOPError} - When the request is invalid.
 	*
@@ -424,13 +458,13 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 		return await deserializeJson(response);
 	}
 	/**
-	* Generates OpenID end session url for signing out.
+	* Generates OpenID end session URL for signing out.
 	*
 	* Note - The `state` is added only when `postLogoutRedirectUri` is present.
 	*
-	* @param params - Parameters to build end session url
+	* @param params - Parameters to build end session URL.
 	*
-	* @returns Tenant's end session url
+	* @returns Tenant's end session URL.
 	*
 	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
 	* unexpected status code during the request or a serialization error while processing the response.
@@ -454,7 +488,7 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	* @param code - The authorization code received from the authorization server.
 	* @param redirectUri - The redirect URI used in the initial authorization request.
 	* @param codeVerifier - Code verifier for PKCE.
-	* @param resource - Space-separated list of resources the access token should be scoped to
+	* @param resource - Space-separated list of resources the access token should be scoped to.
 	*
 	* @returns Tokens obtained by exchanging an authorization code at the token endpoint.
 	*
@@ -537,23 +571,23 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	/**
 	* Generates a session with user and tokens by exchanging authorization code from callback params.
 	*
-	* @param code - The authorization code received from the callback
-	* @param redirectUri - The redirect URI that was used in the authorization request
+	* @param code - The authorization code received from the callback.
+	* @param redirectUri - The redirect URI that was used in the authorization request.
 	* @param requestedScopes - A space-separated list of scopes originally requested via the `/authorize` endpoint.
 	* This is stored in the session to ensure the correct access token can be identified and refreshed during `refreshSession()`.
 	* @param resource - A space-separated list of resource indicators originally requested via the `/authorize` endpoint.
 	* Used alongside scopes to uniquely identify and refresh the specific access token associated with these resources.
-	* @param options - Options for authenticating a user with authorization code
+	* @param options - Options for authenticating a user with authorization code.
 	*
 	* @returns The user's session containing authentication tokens and user information.
 	*
 	* @throws {@link MonoCloudValidationError} - When the token scope does not contain the openid scope,
 	* or if 'expires_in' or 'scope' is missing from the token response.
 	*
-	* @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized
+	* @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized.
 	* OAuth 2.0 error response.
 	*
-	* @throws {@link MonoCloudTokenError} - If ID Token validation fails
+	* @throws {@link MonoCloudTokenError} - If ID Token validation fails.
 	*
 	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
 	* unexpected status code during the request or a serialization error while processing the response.
@@ -597,11 +631,11 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	* Refetches user information for an existing session using the userinfo endpoint.
 	* Updates the session's user object with the latest user information while preserving existing properties.
 	*
-	* @param accessToken - Access token used to fetch the userinfo
-	* @param session - The current MonoCloudSession
-	* @param options - Userinfo refetch options
+	* @param accessToken - Access token used to fetch the userinfo.
+	* @param session - The current MonoCloudSession.
+	* @param options - Userinfo refetch options.
 	*
-	* @returns Updated session with the latest userinfo
+	* @returns Updated session with the latest userinfo.
 	*
 	* @throws {@link MonoCloudValidationError} - When the token scope does not contain openid scope
 	*
@@ -628,8 +662,8 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	* Refreshes an existing session using the refresh token.
 	* This function requests new tokens using the refresh token and optionally updates user information.
 	*
-	* @param session - The current MonoCloudSession containing the refresh token
-	* @param options - Session refresh options
+	* @param session - The current MonoCloudSession containing the refresh token.
+	* @param options - Session refresh options.
 	*
 	* @returns User's session containing refreshed authentication tokens and user information.
 	*
@@ -691,10 +725,10 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	/**
 	* Revokes an access token or refresh token, rendering it invalid for future use.
 	*
-	* @param token - The token string to be revoked
-	* @param tokenType - Hint about the token type ('access_token' or 'refresh_token')
+	* @param token - The token string to be revoked.
+	* @param tokenType - Hint about the token type ('access_token' or 'refresh_token').
 	*
-	* @returns If token revocation succeeded
+	* @returns If token revocation succeeded.
 	*
 	* @throws {@link MonoCloudValidationError} - If token is invalid or unsupported token type
 	*
@@ -728,14 +762,14 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	/**
 	* Validates an ID Token.
 	*
-	* @param idToken - The ID Token JWT string to validate
-	* @param jwks - Array of JSON Web Keys (JWK) used to verify the token's signature
-	* @param clockSkew - Number of seconds to adjust the current time to account for clock differences
-	* @param clockTolerance - Additional time tolerance in seconds for time-based claim validation
-	* @param maxAge - maximum authentication age in seconds
-	* @param nonce - nonce value to validate against the token's nonce claim
+	* @param idToken - The ID Token JWT string to validate.
+	* @param jwks - Array of JSON Web Keys (JWK) used to verify the token's signature.
+	* @param clockSkew - Number of seconds to adjust the current time to account for clock differences.
+	* @param clockTolerance - Additional time tolerance in seconds for time-based claim validation.
+	* @param maxAge - Maximum authentication age in seconds.
+	* @param nonce - Nonce value to validate against the token's nonce claim.
 	*
-	* @returns Validated ID Token claims
+	* @returns Validated ID Token claims.
 	*
 	* @throws {@link MonoCloudTokenError} - If ID Token validation fails
 	*
@@ -788,11 +822,12 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 	}
 	/**
 	* Decodes the payload of a JSON Web Token (JWT) and returns it as an object.
-	* **THIS METHOD DOES NOT VERIFY JWT TOKENS**.
 	*
-	* @param jwt - JWT to decode
+	* >Note: THIS METHOD DOES NOT VERIFY JWT TOKENS.
+	*
+	* @param jwt - JWT to decode.
 	*
-	* @returns Decoded payload
+	* @returns Decoded payload.
 	*
 	* @throws {@link MonoCloudTokenError} - If decoding fails
 	*

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["randomBytes","encodeBase64Url","stringToArrayBuffer","parseSpaceSeparated","now","findToken","decodeBase64Url","getPublicSigKeyFromIssuerJwks","stringToArrayBuffer"],"sources":["../src/errors/monocloud-auth-base-error.ts","../src/errors/monocloud-op-error.ts","../src/errors/monocloud-http-error.ts","../src/errors/monocloud-token-error.ts","../src/errors/monocloud-validation-error.ts","../src/client-auth.ts","../src/monocloud-oidc-client.ts"],"sourcesContent":["export class MonoCloudAuthBaseError extends Error {}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\nexport class MonoCloudOPError extends MonoCloudAuthBaseError {\n  error: string;\n\n  errorDescription?: string;\n\n  constructor(error: string, errorDescription?: string) {\n    super(error);\n    this.error = error;\n    this.errorDescription = errorDescription;\n  }\n}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\nexport class MonoCloudHttpError extends MonoCloudAuthBaseError {}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\nexport class MonoCloudTokenError extends MonoCloudAuthBaseError {}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\nexport class MonoCloudValidationError extends MonoCloudAuthBaseError {}\n","import {\n  encodeBase64Url,\n  randomBytes,\n  stringToArrayBuffer,\n} from './utils/internal';\nimport { ClientAuthMethod, Jwk } from './types';\n\nconst algToSubtle = (\n  alg?: string\n): HmacImportParams | RsaHashedImportParams | EcKeyImportParams => {\n  switch (alg) {\n    case 'HS256':\n    case 'HS384':\n    case 'HS512':\n      return { name: 'HMAC', hash: `SHA-${alg.slice(-3)}` };\n    case 'PS256':\n    case 'PS384':\n    case 'PS512':\n      return { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };\n    case 'RS256':\n    case 'RS384':\n    case 'RS512':\n      return { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };\n    case 'ES256':\n    case 'ES384':\n      return { name: 'ECDSA', namedCurve: `P-${alg.slice(-3)}` };\n    case 'ES512':\n      return { name: 'ECDSA', namedCurve: 'P-521' };\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported JWS algorithm');\n  }\n};\n\nconst psAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as RsaHashedKeyAlgorithm).hash.name) {\n    case 'SHA-256':\n      return 'PS256';\n    case 'SHA-384':\n      return 'PS384';\n    case 'SHA-512':\n      return 'PS512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported RsaHashedKeyAlgorithm hash name');\n  }\n};\n\nconst rsAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as RsaHashedKeyAlgorithm).hash.name) {\n    case 'SHA-256':\n      return 'RS256';\n    case 'SHA-384':\n      return 'RS384';\n    case 'SHA-512':\n      return 'RS512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported RsaHashedKeyAlgorithm hash name');\n  }\n};\n\nconst esAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as EcKeyAlgorithm).namedCurve) {\n    case 'P-256':\n      return 'ES256';\n    case 'P-384':\n      return 'ES384';\n    case 'P-521':\n      return 'ES512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported EcKeyAlgorithm namedCurve');\n  }\n};\n\nconst hsAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as HmacKeyAlgorithm).hash.name) {\n    case 'SHA-256':\n      return 'HS256';\n    case 'SHA-384':\n      return 'HS384';\n    case 'SHA-512':\n      return 'HS512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported HMAC Algorithm hash');\n  }\n};\n\nconst keyToJws = (key: CryptoKey): string => {\n  switch (key.algorithm.name) {\n    case 'HMAC':\n      return hsAlg(key);\n    case 'RSA-PSS':\n      return psAlg(key);\n    case 'RSASSA-PKCS1-v1_5':\n      return rsAlg(key);\n    case 'ECDSA':\n      return esAlg(key);\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported CryptoKey algorithm name');\n  }\n};\n\nconst checkRsaKeyAlgorithm = (key: CryptoKey): void => {\n  const { algorithm } = key as CryptoKey & { algorithm: RsaHashedKeyAlgorithm };\n\n  /* v8 ignore if -- @preserve */\n  if (\n    typeof algorithm.modulusLength !== 'number' ||\n    algorithm.modulusLength < 2048\n  ) {\n    throw new Error(`Unsupported ${algorithm.name} modulusLength`);\n  }\n};\n\nconst ecdsaHashName = (key: CryptoKey): string => {\n  const { algorithm } = key as CryptoKey & { algorithm: EcKeyAlgorithm };\n  switch (algorithm.namedCurve) {\n    case 'P-256':\n      return 'SHA-256';\n    case 'P-384':\n      return 'SHA-384';\n    case 'P-521':\n      return 'SHA-512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported ECDSA namedCurve');\n  }\n};\n\nexport const keyToSubtle = (\n  key: CryptoKey\n): AlgorithmIdentifier | RsaPssParams | EcdsaParams => {\n  switch (key.algorithm.name) {\n    case 'HMAC': {\n      return { name: key.algorithm.name };\n    }\n    case 'ECDSA':\n      return {\n        name: key.algorithm.name,\n        hash: ecdsaHashName(key),\n      } as EcdsaParams;\n    case 'RSA-PSS': {\n      checkRsaKeyAlgorithm(key);\n      switch ((key.algorithm as RsaHashedKeyAlgorithm).hash.name) {\n        case 'SHA-256': // Fall through\n        case 'SHA-384': // Fall through\n        case 'SHA-512':\n          return {\n            name: key.algorithm.name,\n            saltLength:\n              parseInt(\n                (key.algorithm as RsaHashedKeyAlgorithm).hash.name.slice(-3),\n                10\n              ) >> 3,\n          } as RsaPssParams;\n        /* v8 ignore next */\n        default:\n          throw new Error('unsupported RSA-PSS hash name');\n      }\n    }\n    case 'RSASSA-PKCS1-v1_5':\n      checkRsaKeyAlgorithm(key);\n      return key.algorithm.name;\n  }\n  /* v8 ignore next -- @preserve */\n  throw new Error('unsupported CryptoKey algorithm name');\n};\n\nconst clientAssertionPayload = (\n  issuer: string,\n  clientId: string,\n  skew: number\n): Record<string, number | string> => {\n  const now = Math.floor(Date.now() / 1000) + skew;\n  return {\n    jti: randomBytes(),\n    aud: issuer,\n    exp: now + 60,\n    iat: now,\n    nbf: now,\n    iss: clientId,\n    sub: clientId,\n  };\n};\n\nconst jwtAssertionGenerator = async (\n  issuer: string,\n  clientId: string,\n  clientSecret: Jwk,\n  body: URLSearchParams,\n  skew: number\n): Promise<void> => {\n  const key = await crypto.subtle.importKey(\n    'jwk',\n    clientSecret as JsonWebKey,\n    algToSubtle(clientSecret.alg),\n    false,\n    ['sign']\n  );\n\n  const header = { alg: keyToJws(key), kid: clientSecret.kid };\n  const payload = clientAssertionPayload(issuer, clientId, skew);\n\n  body.set('client_id', clientId);\n  body.set(\n    'client_assertion_type',\n    'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n  );\n\n  const input = `${encodeBase64Url(stringToArrayBuffer(JSON.stringify(header)))}.${encodeBase64Url(stringToArrayBuffer(JSON.stringify(payload)))}`;\n  const signature = encodeBase64Url(\n    await crypto.subtle.sign(\n      keyToSubtle(key),\n      key,\n      stringToArrayBuffer(input) as BufferSource\n    )\n  );\n\n  body.set('client_assertion', `${input}.${signature}`);\n};\n\nexport const clientAuth = async (\n  clientId: string,\n  clientSecret?: string | Jwk,\n  method?: ClientAuthMethod,\n  issuer?: string,\n  headers?: Record<string, string>,\n  body?: URLSearchParams,\n  jwtAssertionSkew?: number\n): Promise<void> => {\n  switch (true) {\n    case method === 'client_secret_basic' && !!headers: {\n      // eslint-disable-next-line no-param-reassign\n      headers.authorization = `Basic ${btoa(`${clientId}:${clientSecret ?? ''}`)}`;\n      break;\n    }\n\n    case method === 'client_secret_post' && !!body: {\n      body.set('client_id', clientId);\n      if (typeof clientSecret === 'string') {\n        body.set('client_secret', clientSecret);\n      }\n      break;\n    }\n\n    case method === 'client_secret_jwt' &&\n      !!issuer &&\n      !!body &&\n      (typeof clientSecret === 'string' || clientSecret?.kty === 'oct'): {\n      const cs =\n        typeof clientSecret === 'string'\n          ? {\n              k: encodeBase64Url(stringToArrayBuffer(clientSecret)),\n              kty: 'oct',\n              alg: 'HS256',\n            }\n          : clientSecret;\n\n      await jwtAssertionGenerator(\n        issuer,\n        clientId,\n        cs,\n        body,\n        jwtAssertionSkew ?? 0\n      );\n      break;\n    }\n\n    case method === 'private_key_jwt' &&\n      typeof clientSecret === 'object' &&\n      clientSecret.kty !== 'oct' &&\n      !!issuer &&\n      !!body: {\n      await jwtAssertionGenerator(\n        issuer,\n        clientId,\n        clientSecret,\n        body,\n        jwtAssertionSkew ?? 0\n      );\n      break;\n    }\n\n    default:\n      throw new Error('Invalid Client Authentication Method');\n  }\n};\n","import {\n  decodeBase64Url,\n  findToken,\n  getPublicSigKeyFromIssuerJwks,\n  now,\n  parseSpaceSeparated,\n  stringToArrayBuffer,\n} from './utils/internal';\nimport { clientAuth, keyToSubtle } from './client-auth';\nimport {\n  AccessToken,\n  AuthenticateOptions,\n  AuthorizationParams,\n  ClientAuthMethod,\n  EndSessionParameters,\n  IdTokenClaims,\n  IssuerMetadata,\n  Jwk,\n  Jwks,\n  JWSAlgorithm,\n  JwsHeaderParameters,\n  MonoCloudClientOptions,\n  MonoCloudSession,\n  MonoCloudUser,\n  ParResponse,\n  PushedAuthorizationParams,\n  RefetchUserInfoOptions,\n  RefreshGrantOptions,\n  RefreshSessionOptions,\n  Tokens,\n  UserinfoResponse,\n} from './types';\nimport { MonoCloudOPError } from './errors/monocloud-op-error';\nimport { MonoCloudHttpError } from './errors/monocloud-http-error';\nimport { MonoCloudValidationError } from './errors/monocloud-validation-error';\nimport { MonoCloudTokenError } from './errors/monocloud-token-error';\nimport { MonoCloudAuthBaseError } from './errors/monocloud-auth-base-error';\n\nconst JWT_ASSERTION_CLOCK_SKEW = 5;\n\nconst FILTER_ID_TOKEN_CLAIMS = [\n  'iss',\n  'exp',\n  'nbf',\n  'aud',\n  'nonce',\n  'iat',\n  'auth_time',\n  'c_hash',\n  'at_hash',\n  's_hash',\n];\n\nfunction assertMetadataProperty<K extends keyof IssuerMetadata>(\n  metadata: IssuerMetadata,\n  property: K\n): asserts metadata is IssuerMetadata & Required<Pick<IssuerMetadata, K>> {\n  if (metadata[property] === undefined || metadata[property] === null) {\n    throw new MonoCloudValidationError(\n      `${property as string} endpoint is required but not available in the issuer metadata`\n    );\n  }\n}\n\nconst innerFetch = async (\n  input: string,\n  reqInit: RequestInit = {}\n): Promise<Response> => {\n  try {\n    return await fetch(input, reqInit);\n  } catch (e) {\n    /* v8 ignore next -- @preserve */\n    throw new MonoCloudHttpError(\n      (e as any).message ?? 'Unexpected Network Error'\n    );\n  }\n};\n\nconst deserializeJson = async <T = any>(res: Response): Promise<T> => {\n  try {\n    return await res.json();\n  } catch (e) {\n    throw new MonoCloudHttpError(\n      /* v8 ignore next -- @preserve */\n      `Failed to parse response body as JSON ${(e as any).message ? `: ${(e as any).message}` : ''}`\n    );\n  }\n};\n\nexport class MonoCloudOidcClient {\n  private readonly tenantDomain: string;\n\n  private readonly clientId: string;\n\n  private readonly clientSecret?: string | Jwk;\n\n  private readonly authMethod: ClientAuthMethod;\n\n  private readonly idTokenSigningAlgorithm: JWSAlgorithm;\n\n  private jwks?: Jwks;\n\n  private jwksCacheExpiry = 0;\n\n  private jwksCacheDuration = 60;\n\n  private metadata?: IssuerMetadata;\n\n  private metadataCacheExpiry = 0;\n\n  private metadataCacheDuration = 60;\n\n  constructor(\n    tenantDomain: string,\n    clientId: string,\n    options?: MonoCloudClientOptions\n  ) {\n    // eslint-disable-next-line no-param-reassign\n    tenantDomain ??= '';\n    /* v8 ignore next -- @preserve */\n    this.tenantDomain = `${!tenantDomain.startsWith('https://') ? 'https://' : ''}${tenantDomain.endsWith('/') ? tenantDomain.slice(0, -1) : tenantDomain}`;\n    this.clientId = clientId;\n    this.clientSecret = options?.clientSecret;\n    this.authMethod = options?.clientAuthMethod ?? 'client_secret_basic';\n    this.idTokenSigningAlgorithm = options?.idTokenSigningAlgorithm ?? 'RS256';\n\n    if (options?.jwksCacheDuration) {\n      this.jwksCacheDuration = options.jwksCacheDuration;\n    }\n\n    if (options?.metadataCacheDuration) {\n      this.metadataCacheDuration = options.metadataCacheDuration;\n    }\n  }\n\n  /**\n   * Generates an authorization URL with specified parameters.\n   *\n   * If no values are provided for `responseType`, or `codeChallengeMethod`, they default to `code`, and `S256`, respectively.\n   *\n   * @param params Authorization URL parameters\n   *\n   * @returns Tenant's authorization url.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async authorizationUrl(params: AuthorizationParams): Promise<string> {\n    const queryParams = new URLSearchParams();\n\n    queryParams.set('client_id', this.clientId);\n\n    if (params.redirectUri) {\n      queryParams.set('redirect_uri', params.redirectUri);\n    }\n\n    if (params.requestUri) {\n      queryParams.set('request_uri', params.requestUri);\n    }\n\n    const scopes = parseSpaceSeparated(params.scopes) ?? [];\n\n    if (scopes.length > 0) {\n      queryParams.set('scope', scopes.join(' '));\n    }\n\n    if (params.responseType && params.responseType.length > 0) {\n      queryParams.set('response_type', params.responseType);\n    }\n\n    if (\n      (!params.responseType || params.responseType.length === 0) &&\n      !params.requestUri\n    ) {\n      queryParams.set('response_type', 'code');\n    }\n\n    if (params.authenticatorHint) {\n      queryParams.set('authenticator_hint', params.authenticatorHint);\n    }\n\n    if (params.loginHint) {\n      queryParams.set('login_hint', params.loginHint);\n    }\n\n    if (params.request) {\n      queryParams.set('request', params.request);\n    }\n\n    if (params.responseMode) {\n      queryParams.set('response_mode', params.responseMode);\n    }\n\n    if (params.acrValues && params.acrValues.length > 0) {\n      queryParams.set('acr_values', params.acrValues.join(' '));\n    }\n\n    if (params.nonce) {\n      queryParams.set('nonce', params.nonce);\n    }\n\n    if (params.uiLocales) {\n      queryParams.set('ui_locales', params.uiLocales);\n    }\n\n    if (params.display) {\n      queryParams.set('display', params.display);\n    }\n\n    if (typeof params.maxAge === 'number') {\n      queryParams.set('max_age', params.maxAge.toString());\n    }\n\n    if (params.prompt) {\n      queryParams.set('prompt', params.prompt);\n    }\n\n    const resource = parseSpaceSeparated(params.resource) ?? [];\n\n    if (resource.length > 0) {\n      for (const r of resource) {\n        queryParams.append('resource', r);\n      }\n    }\n\n    if (params.codeChallenge) {\n      queryParams.set('code_challenge', params.codeChallenge);\n      queryParams.set(\n        'code_challenge_method',\n        params.codeChallengeMethod ?? 'S256'\n      );\n    }\n\n    if (params.state) {\n      queryParams.set('state', params.state);\n    }\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'authorization_endpoint');\n\n    return `${metadata.authorization_endpoint}?${queryParams.toString()}`;\n  }\n\n  /**\n   * Fetches the authorization server metadata from the .well-known endpoint.\n   * The metadata is cached for 1 minute.\n   *\n   * @param forceRefresh - If `true`, bypasses the cache and fetches fresh metadata from the server.\n   *\n   * @returns The issuer metadata for the tenant, retrieved from the OpenID Connect discovery endpoint.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async getMetadata(forceRefresh = false): Promise<IssuerMetadata> {\n    if (!forceRefresh && this.metadata && this.metadataCacheExpiry > now()) {\n      return this.metadata;\n    }\n\n    this.metadata = undefined;\n\n    const response = await innerFetch(\n      `${this.tenantDomain}/.well-known/openid-configuration`\n    );\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while fetching metadata. Unexpected status code: ${response.status}`\n      );\n    }\n\n    const metadata = await deserializeJson<IssuerMetadata>(response);\n\n    this.metadata = metadata;\n    this.metadataCacheExpiry = now() + this.metadataCacheDuration;\n\n    return metadata;\n  }\n\n  /**\n   * Fetches the JSON Web Keys used to sign the id token.\n   * The JWKS is cached for 1 minute.\n   *\n   * @param forceRefresh - If `true`, bypasses the cache and fetches fresh set of JWKS from the server.\n   *\n   * @returns The JSON Web Key Set containing the public keys for token verification.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async getJwks(forceRefresh = false): Promise<Jwks> {\n    if (!forceRefresh && this.jwks && this.jwksCacheExpiry > now()) {\n      return this.jwks;\n    }\n\n    this.jwks = undefined;\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'jwks_uri');\n\n    const response = await innerFetch(metadata.jwks_uri);\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while fetching JWKS. Unexpected status code: ${response.status}`\n      );\n    }\n    const jwks = await deserializeJson<Jwks>(response);\n\n    this.jwks = jwks;\n    this.jwksCacheExpiry = now() + this.jwksCacheDuration;\n\n    return jwks;\n  }\n\n  /**\n   * Performs a pushed authorization request.\n   *\n   * @param params - Authorization Parameters\n   *\n   * @returns Response from Pushed Authorization Request (PAR) endpoint\n   *\n   * @throws {@link MonoCloudOPError} - When the request is invalid.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async pushedAuthorizationRequest(\n    params: PushedAuthorizationParams\n  ): Promise<ParResponse> {\n    const body = new URLSearchParams();\n\n    body.set('client_id', this.clientId);\n\n    if (params.redirectUri) {\n      body.set('redirect_uri', params.redirectUri);\n    }\n\n    const scopes = parseSpaceSeparated(params.scopes) ?? [];\n\n    if (scopes.length > 0) {\n      body.set('scope', scopes.join(' '));\n    }\n\n    if (params.responseType && params.responseType.length > 0) {\n      body.set('response_type', params.responseType);\n    } else {\n      body.set('response_type', 'code');\n    }\n\n    if (params.authenticatorHint) {\n      body.set('authenticator_hint', params.authenticatorHint);\n    }\n\n    if (params.loginHint) {\n      body.set('login_hint', params.loginHint);\n    }\n\n    if (params.request) {\n      body.set('request', params.request);\n    }\n\n    if (params.responseMode) {\n      body.set('response_mode', params.responseMode);\n    }\n\n    if (params.acrValues && params.acrValues.length > 0) {\n      body.set('acr_values', params.acrValues.join(' '));\n    }\n\n    if (params.nonce) {\n      body.set('nonce', params.nonce);\n    }\n\n    if (params.uiLocales) {\n      body.set('ui_locales', params.uiLocales);\n    }\n\n    if (params.display) {\n      body.set('display', params.display);\n    }\n\n    if (typeof params.maxAge === 'number') {\n      body.set('max_age', params.maxAge.toString());\n    }\n\n    if (params.prompt) {\n      body.set('prompt', params.prompt);\n    }\n\n    const resource = parseSpaceSeparated(params.resource) ?? [];\n\n    if (resource.length > 0) {\n      for (const r of resource) {\n        body.append('resource', r);\n      }\n    }\n\n    if (params.codeChallenge) {\n      body.set('code_challenge', params.codeChallenge);\n      body.set('code_challenge_method', params.codeChallengeMethod ?? 'S256');\n    }\n\n    if (params.state) {\n      body.set('state', params.state);\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n      accept: 'application/json',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'pushed_authorization_request_endpoint');\n\n    const response = await innerFetch(\n      metadata.pushed_authorization_request_endpoint,\n      {\n        body: body.toString(),\n        method: 'POST',\n        headers,\n      }\n    );\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'par_request_failed',\n        standardBodyError.error_description ??\n          'Pushed Authorization Request Failed'\n      );\n    }\n\n    if (response.status !== 201) {\n      throw new MonoCloudHttpError(\n        `Error while performing pushed authorization request. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<ParResponse>(response);\n  }\n\n  /**\n   * Fetches userinfo associated with the provided access token.\n   *\n   * @param accessToken - A valid access token used to retrieve userinfo.\n   *\n   * @returns The authenticated user's claims.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error (e.g., 'invalid_token') in the 'WWW-Authenticate' header\n   * following a 401 Unauthorized response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   * @throws {@link MonoCloudValidationError} - When the access token is invalid.\n   *\n   */\n  async userinfo(accessToken: string): Promise<UserinfoResponse> {\n    if (!accessToken.trim().length) {\n      throw new MonoCloudValidationError(\n        'Access token is required for fetching userinfo'\n      );\n    }\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'userinfo_endpoint');\n\n    const response = await innerFetch(metadata.userinfo_endpoint, {\n      method: 'GET',\n      headers: {\n        authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (response.status === 401) {\n      const authenticateError = response.headers.get('WWW-Authenticate');\n\n      if (authenticateError) {\n        const errorMatch = /error=\"([^\"]+)\"/.exec(authenticateError);\n        const error = errorMatch ? errorMatch[1] : 'userinfo_failed';\n\n        const errorDescMatch = /error_description=\"([^\"]+)\"/.exec(\n          authenticateError\n        );\n\n        const errorDescription = errorDescMatch\n          ? errorDescMatch[1]\n          : 'Userinfo authentication error';\n\n        throw new MonoCloudOPError(error, errorDescription);\n      }\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while fetching userinfo. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<UserinfoResponse>(response);\n  }\n\n  /**\n   * Generates OpenID end session url for signing out.\n   *\n   * Note - The `state` is added only when `postLogoutRedirectUri` is present.\n   *\n   * @param params - Parameters to build end session url\n   *\n   * @returns Tenant's end session url\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async endSessionUrl(params: EndSessionParameters): Promise<string> {\n    const queryParams = new URLSearchParams();\n\n    queryParams.set('client_id', this.clientId);\n\n    if (params.idToken) {\n      queryParams.set('id_token_hint', params.idToken);\n    }\n\n    if (params.postLogoutRedirectUri) {\n      queryParams.set('post_logout_redirect_uri', params.postLogoutRedirectUri);\n\n      if (params.state) {\n        queryParams.set('state', params.state);\n      }\n    }\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'end_session_endpoint');\n\n    return `${metadata.end_session_endpoint}?${queryParams.toString()}`;\n  }\n\n  /**\n   * Exchanges an authorization code for tokens.\n   *\n   * @param code - The authorization code received from the authorization server.\n   * @param redirectUri - The redirect URI used in the initial authorization request.\n   * @param codeVerifier - Code verifier for PKCE.\n   * @param resource - Space-separated list of resources the access token should be scoped to\n   *\n   * @returns Tokens obtained by exchanging an authorization code at the token endpoint.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async exchangeAuthorizationCode(\n    code: string,\n    redirectUri: string,\n    codeVerifier?: string,\n    resource?: string\n  ): Promise<Tokens> {\n    const body = new URLSearchParams();\n\n    body.set('grant_type', 'authorization_code');\n    body.set('code', code);\n    body.set('redirect_uri', redirectUri);\n\n    if (codeVerifier) {\n      body.set('code_verifier', codeVerifier);\n    }\n\n    const resources = parseSpaceSeparated(resource) ?? [];\n\n    if (resources.length > 0) {\n      for (const r of resources) {\n        body.append('resource', r);\n      }\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n      accept: 'application/json',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'token_endpoint');\n\n    const response = await innerFetch(metadata.token_endpoint, {\n      method: 'POST',\n      body: body.toString(),\n      headers,\n    });\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'code_grant_failed',\n        standardBodyError.error_description ?? 'Authorization code grant failed'\n      );\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while performing token grant. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<Tokens>(response);\n  }\n\n  /**\n   * Exchanges a refresh token for new tokens.\n   *\n   * @param refreshToken - The refresh token used to request new tokens.\n   * @param options - Refresh grant options.\n   *\n   * @returns Tokens obtained by exchanging a refresh token at the token endpoint.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async refreshGrant(\n    refreshToken: string,\n    options?: RefreshGrantOptions\n  ): Promise<Tokens> {\n    const body = new URLSearchParams();\n\n    body.set('grant_type', 'refresh_token');\n    body.set('refresh_token', refreshToken);\n\n    const scopes = parseSpaceSeparated(options?.scopes) ?? [];\n\n    if (scopes.length > 0) {\n      body.set('scope', scopes.join(' '));\n    }\n\n    const resource = parseSpaceSeparated(options?.resource) ?? [];\n\n    if (resource.length > 0) {\n      for (const r of resource) {\n        body.append('resource', r);\n      }\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n      accept: 'application/json',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'token_endpoint');\n\n    const response = await innerFetch(metadata.token_endpoint, {\n      method: 'POST',\n      body: body.toString(),\n      headers,\n    });\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'refresh_grant_failed',\n        standardBodyError.error_description ?? 'Refresh token grant failed'\n      );\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while performing refresh token grant. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<Tokens>(response);\n  }\n\n  /**\n   * Generates a session with user and tokens by exchanging authorization code from callback params.\n   *\n   * @param code - The authorization code received from the callback\n   * @param redirectUri - The redirect URI that was used in the authorization request\n   * @param requestedScopes - A space-separated list of scopes originally requested via the `/authorize` endpoint.\n   * This is stored in the session to ensure the correct access token can be identified and refreshed during `refreshSession()`.\n   * @param resource - A space-separated list of resource indicators originally requested via the `/authorize` endpoint.\n   * Used alongside scopes to uniquely identify and refresh the specific access token associated with these resources.\n   * @param options - Options for authenticating a user with authorization code\n   *\n   * @returns The user's session containing authentication tokens and user information.\n   *\n   * @throws {@link MonoCloudValidationError} - When the token scope does not contain the openid scope,\n   * or if 'expires_in' or 'scope' is missing from the token response.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async authenticate(\n    code: string,\n    redirectUri: string,\n    requestedScopes: string,\n    resource?: string,\n    options?: AuthenticateOptions\n  ): Promise<MonoCloudSession> {\n    const tokens = await this.exchangeAuthorizationCode(\n      code,\n      redirectUri,\n      options?.codeVerifier,\n      resource\n    );\n\n    const accessTokenExpiration =\n      typeof tokens.expires_in === 'number'\n        ? now() + tokens.expires_in\n        : undefined;\n\n    if (!accessTokenExpiration) {\n      throw new MonoCloudValidationError(\"Missing required 'expires_in' field\");\n    }\n\n    if (!tokens.scope) {\n      throw new MonoCloudValidationError(\"Missing or invalid 'scope' field\");\n    }\n\n    let userinfo: MonoCloudUser | undefined;\n\n    if (options?.fetchUserInfo && tokens.scope?.includes('openid')) {\n      userinfo = await this.userinfo(tokens.access_token);\n    }\n\n    let idTokenClaims: Partial<IdTokenClaims> = {};\n\n    if (tokens.id_token) {\n      if (options?.validateIdToken ?? true) {\n        const jwks = options?.jwks ?? (await this.getJwks());\n\n        idTokenClaims = await this.validateIdToken(\n          tokens.id_token,\n          jwks.keys,\n          options?.idTokenClockSkew ?? 0,\n          options?.idTokenClockTolerance ?? 0,\n          options?.idTokenMaxAge,\n          options?.idTokenNonce\n        );\n      } else {\n        idTokenClaims = MonoCloudOidcClient.decodeJwt(tokens.id_token);\n      }\n    }\n\n    (options?.filteredIdTokenClaims ?? FILTER_ID_TOKEN_CLAIMS).forEach(x => {\n      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete\n      delete idTokenClaims[x];\n    });\n\n    const session: MonoCloudSession = {\n      user: {\n        ...idTokenClaims,\n        ...(userinfo ?? {}),\n      } as MonoCloudUser,\n      idToken: tokens.id_token,\n      refreshToken: tokens.refresh_token,\n      authorizedScopes: requestedScopes,\n      accessTokens: [\n        {\n          scopes: tokens.scope,\n          accessToken: tokens.access_token,\n          accessTokenExpiration,\n          resource,\n          requestedScopes,\n        },\n      ],\n    };\n\n    await options?.onSessionCreating?.(session, idTokenClaims, userinfo);\n\n    return session;\n  }\n\n  /**\n   * Refetches user information for an existing session using the userinfo endpoint.\n   * Updates the session's user object with the latest user information while preserving existing properties.\n   *\n   * @param accessToken - Access token used to fetch the userinfo\n   * @param session - The current MonoCloudSession\n   * @param options - Userinfo refetch options\n   *\n   * @returns Updated session with the latest userinfo\n   *\n   * @throws {@link MonoCloudValidationError} - When the token scope does not contain openid scope\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async refetchUserInfo(\n    accessToken: AccessToken,\n    session: MonoCloudSession,\n    options?: RefetchUserInfoOptions\n  ): Promise<MonoCloudSession> {\n    if (!accessToken.scopes?.includes('openid')) {\n      throw new MonoCloudValidationError(\n        'Fetching userinfo requires the openid scope'\n      );\n    }\n\n    const userinfo = await this.userinfo(accessToken.accessToken);\n\n    // eslint-disable-next-line no-param-reassign\n    session.user = { ...session.user, ...userinfo };\n\n    await options?.onSessionCreating?.(session, undefined, userinfo);\n\n    return session;\n  }\n\n  /**\n   * Refreshes an existing session using the refresh token.\n   * This function requests new tokens using the refresh token and optionally updates user information.\n   *\n   * @param session - The current MonoCloudSession containing the refresh token\n   * @param options - Session refresh options\n   *\n   * @returns User's session containing refreshed authentication tokens and user information.\n   *\n   * @throws {@link MonoCloudValidationError} - If the refresh token is not present in the session,\n   * or if 'expires_in' or 'scope' (including the openid scope) is missing from the token response.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async refreshSession(\n    session: MonoCloudSession,\n    options?: RefreshSessionOptions\n  ): Promise<MonoCloudSession> {\n    if (!session.refreshToken) {\n      throw new MonoCloudValidationError(\n        'Session does not contain refresh token'\n      );\n    }\n\n    const tokens = await this.refreshGrant(\n      session.refreshToken,\n      options?.refreshGrantOptions\n    );\n\n    const accessTokenExpiration =\n      typeof tokens.expires_in === 'number'\n        ? now() + tokens.expires_in\n        : undefined;\n\n    if (!accessTokenExpiration) {\n      throw new MonoCloudValidationError(\"Missing required 'expires_in' field\");\n    }\n\n    if (!tokens.scope) {\n      throw new MonoCloudValidationError(\"Missing or invalid 'scope' field\");\n    }\n\n    let userinfo: MonoCloudUser | undefined;\n\n    if (options?.fetchUserInfo && tokens.scope?.includes('openid')) {\n      userinfo = await this.userinfo(tokens.access_token);\n    }\n\n    let idTokenClaims: Partial<IdTokenClaims> = {};\n\n    if (tokens.id_token) {\n      if (options?.validateIdToken ?? true) {\n        const jwks = options?.jwks ?? (await this.getJwks());\n\n        idTokenClaims = await this.validateIdToken(\n          tokens.id_token,\n          jwks.keys,\n          options?.idTokenClockSkew ?? 0,\n          options?.idTokenClockTolerance ?? 0\n        );\n      } else {\n        idTokenClaims = MonoCloudOidcClient.decodeJwt(tokens.id_token);\n      }\n    }\n\n    (options?.filteredIdTokenClaims ?? FILTER_ID_TOKEN_CLAIMS).forEach(x => {\n      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete\n      delete idTokenClaims[x];\n    });\n\n    const resource = options?.refreshGrantOptions?.resource;\n    let scopes = options?.refreshGrantOptions?.scopes;\n\n    if (!resource && !scopes) {\n      scopes = session.authorizedScopes;\n    }\n\n    const accessToken = findToken(session.accessTokens, resource, scopes);\n\n    const user =\n      Object.keys(idTokenClaims).length === 0 && !userinfo\n        ? session.user\n        : ({\n            ...session.user,\n            ...idTokenClaims,\n            ...(userinfo ?? {}),\n          } as MonoCloudUser);\n\n    const newTokens =\n      session.accessTokens?.filter(t => t !== accessToken) ?? [];\n\n    newTokens.push({\n      scopes: tokens.scope,\n      accessToken: tokens.access_token,\n      accessTokenExpiration,\n      resource,\n      requestedScopes: scopes,\n    });\n\n    const updatedSession: MonoCloudSession = {\n      ...session,\n      user,\n      idToken: tokens.id_token ?? session.idToken,\n      refreshToken: tokens.refresh_token ?? session.refreshToken,\n      accessTokens: newTokens,\n    };\n\n    await options?.onSessionCreating?.(updatedSession, idTokenClaims, userinfo);\n\n    return updatedSession;\n  }\n\n  /**\n   * Revokes an access token or refresh token, rendering it invalid for future use.\n   *\n   * @param token - The token string to be revoked\n   * @param tokenType - Hint about the token type ('access_token' or 'refresh_token')\n   *\n   * @returns If token revocation succeeded\n   *\n   * @throws {@link MonoCloudValidationError} - If token is invalid or unsupported token type\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   */\n  async revokeToken(token: string, tokenType?: string): Promise<void> {\n    if (!token.trim().length) {\n      throw new MonoCloudValidationError('Invalid token');\n    }\n\n    if (\n      tokenType &&\n      tokenType !== 'access_token' &&\n      tokenType !== 'refresh_token'\n    ) {\n      throw new MonoCloudValidationError(\n        'Only access_token and refresh_token types are supported.'\n      );\n    }\n\n    const body = new URLSearchParams();\n    body.set('token', token);\n    if (tokenType) {\n      body.set('token_type_hint', tokenType);\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'revocation_endpoint');\n\n    const response = await innerFetch(metadata.revocation_endpoint, {\n      method: 'POST',\n      body: body.toString(),\n      headers,\n    });\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'revocation_failed',\n        standardBodyError.error_description ?? 'Token revocation failed'\n      );\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while performing revocation request. Unexpected status code: ${response.status}`\n      );\n    }\n  }\n\n  /**\n   * Validates an ID Token.\n   *\n   * @param idToken - The ID Token JWT string to validate\n   * @param jwks - Array of JSON Web Keys (JWK) used to verify the token's signature\n   * @param clockSkew - Number of seconds to adjust the current time to account for clock differences\n   * @param clockTolerance - Additional time tolerance in seconds for time-based claim validation\n   * @param maxAge - maximum authentication age in seconds\n   * @param nonce - nonce value to validate against the token's nonce claim\n   *\n   * @returns Validated ID Token claims\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails\n   *\n   */\n  async validateIdToken(\n    idToken: string,\n    jwks: Jwk[],\n    clockSkew: number,\n    clockTolerance: number,\n    maxAge?: number,\n    nonce?: string\n  ): Promise<IdTokenClaims> {\n    if (typeof idToken !== 'string' || idToken.trim().length === 0) {\n      throw new MonoCloudTokenError(\n        'ID Token must be a valid non-empty string'\n      );\n    }\n\n    const {\n      0: protectedHeader,\n      1: payload,\n      2: encodedSignature,\n      length,\n    } = idToken.split('.');\n\n    if (length !== 3) {\n      throw new MonoCloudTokenError(\n        'ID Token must have a header, payload and signature'\n      );\n    }\n\n    let header: JwsHeaderParameters;\n    try {\n      header = JSON.parse(decodeBase64Url(protectedHeader));\n    } catch {\n      throw new MonoCloudTokenError('Failed to parse JWT Header');\n    }\n\n    if (\n      header === null ||\n      typeof header !== 'object' ||\n      Array.isArray(header)\n    ) {\n      throw new MonoCloudTokenError('JWT Header must be a top level object');\n    }\n\n    if (this.idTokenSigningAlgorithm !== header.alg) {\n      throw new MonoCloudTokenError('Invalid signing alg');\n    }\n\n    if (header.crit !== undefined) {\n      throw new MonoCloudTokenError('Unexpected JWT \"crit\" header parameter');\n    }\n\n    const binary = decodeBase64Url(encodedSignature);\n\n    const signature = new Uint8Array(binary.length);\n\n    for (let i = 0; i < binary.length; i++) {\n      signature[i] = binary.charCodeAt(i);\n    }\n\n    const key = await getPublicSigKeyFromIssuerJwks(jwks, header);\n\n    const input = `${protectedHeader}.${payload}`;\n\n    const verified = await crypto.subtle.verify(\n      keyToSubtle(key),\n      key,\n      signature,\n      stringToArrayBuffer(input) as BufferSource\n    );\n\n    if (!verified) {\n      throw new MonoCloudTokenError('JWT signature verification failed');\n    }\n\n    let claims: IdTokenClaims;\n\n    try {\n      claims = JSON.parse(decodeBase64Url(payload));\n    } catch {\n      throw new MonoCloudTokenError('Failed to parse JWT Payload');\n    }\n\n    if (\n      claims === null ||\n      typeof claims !== 'object' ||\n      Array.isArray(claims)\n    ) {\n      throw new MonoCloudTokenError('JWT Payload must be a top level object');\n    }\n\n    if ((claims.nonce || nonce) && claims.nonce !== nonce) {\n      throw new MonoCloudTokenError('Nonce mismatch');\n    }\n\n    const current = now() + clockSkew;\n\n    /* v8 ignore else -- @preserve */\n    if (claims.exp !== undefined) {\n      if (typeof claims.exp !== 'number') {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"exp\" (expiration time) claim type'\n        );\n      }\n\n      if (claims.exp <= current - clockTolerance) {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"exp\" (expiration time) claim value, timestamp is <= now()'\n        );\n      }\n    }\n\n    /* v8 ignore else -- @preserve */\n    if (claims.iat !== undefined) {\n      if (typeof claims.iat !== 'number') {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"iat\" (issued at) claim type'\n        );\n      }\n    }\n\n    if (\n      typeof claims.auth_time === 'number' &&\n      typeof maxAge === 'number' &&\n      claims.auth_time + maxAge < current\n    ) {\n      throw new MonoCloudTokenError(\n        'Too much time has elapsed since the last End-User authentication'\n      );\n    }\n\n    if (claims.iss !== this.tenantDomain) {\n      throw new MonoCloudTokenError('Invalid Issuer');\n    }\n\n    if (claims.nbf !== undefined) {\n      if (typeof claims.nbf !== 'number') {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"nbf\" (not before) claim type'\n        );\n      }\n\n      if (claims.nbf > current + clockTolerance) {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"nbf\" (not before) claim value, timestamp is > now()'\n        );\n      }\n    }\n\n    const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];\n\n    if (!audience.includes(this.clientId)) {\n      throw new MonoCloudTokenError('Invalid audience claim');\n    }\n\n    return claims;\n  }\n\n  /**\n   * Decodes the payload of a JSON Web Token (JWT) and returns it as an object.\n   * **THIS METHOD DOES NOT VERIFY JWT TOKENS**.\n   *\n   * @param jwt - JWT to decode\n   *\n   * @returns Decoded payload\n   *\n   * @throws {@link MonoCloudTokenError} - If decoding fails\n   *\n   */\n  static decodeJwt(jwt: string): IdTokenClaims {\n    try {\n      const [, payload] = jwt.split('.');\n\n      if (!payload?.trim()) {\n        throw new MonoCloudTokenError('JWT does not contain payload');\n      }\n\n      const decoded = decodeBase64Url(payload);\n\n      if (!decoded.startsWith('{')) {\n        throw new MonoCloudTokenError('Payload is not an object');\n      }\n\n      return JSON.parse(decoded) as IdTokenClaims;\n    } catch (e) {\n      if (e instanceof MonoCloudAuthBaseError) {\n        throw e;\n      }\n\n      throw new MonoCloudTokenError(\n        'Could not parse payload. Malformed payload'\n      );\n    }\n  }\n}\n"],"mappings":";;;;AAAA,IAAa,yBAAb,cAA4C,MAAM;;;;ACElD,IAAa,mBAAb,cAAsC,uBAAuB;CAK3D,YAAY,OAAe,kBAA2B;AACpD,QAAM,MAAM;AACZ,OAAK,QAAQ;AACb,OAAK,mBAAmB;;;;;;ACR5B,IAAa,qBAAb,cAAwC,uBAAuB;;;;ACA/D,IAAa,sBAAb,cAAyC,uBAAuB;;;;ACAhE,IAAa,2BAAb,cAA8C,uBAAuB;;;;ACKrE,MAAM,eACJ,QACiE;AACjE,SAAQ,KAAR;EACE,KAAK;EACL,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAQ,MAAM,OAAO,IAAI,MAAM,GAAG;GAAI;EACvD,KAAK;EACL,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAW,MAAM,OAAO,IAAI,MAAM,GAAG;GAAI;EAC1D,KAAK;EACL,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAqB,MAAM,OAAO,IAAI,MAAM,GAAG;GAAI;EACpE,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAS,YAAY,KAAK,IAAI,MAAM,GAAG;GAAI;EAC5D,KAAK,QACH,QAAO;GAAE,MAAM;GAAS,YAAY;GAAS;EAE/C,QACE,OAAM,IAAI,MAAM,4BAA4B;;;AAIlD,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAAoC,KAAK,MAAtD;EACE,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,8CAA8C;;;AAIpE,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAAoC,KAAK,MAAtD;EACE,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,8CAA8C;;;AAIpE,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAA6B,YAA1C;EACE,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,wCAAwC;;;AAI9D,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAA+B,KAAK,MAAjD;EACE,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,kCAAkC;;;AAIxD,MAAM,YAAY,QAA2B;AAC3C,SAAQ,IAAI,UAAU,MAAtB;EACE,KAAK,OACH,QAAO,MAAM,IAAI;EACnB,KAAK,UACH,QAAO,MAAM,IAAI;EACnB,KAAK,oBACH,QAAO,MAAM,IAAI;EACnB,KAAK,QACH,QAAO,MAAM,IAAI;EAEnB,QACE,OAAM,IAAI,MAAM,uCAAuC;;;AAI7D,MAAM,wBAAwB,QAAyB;CACrD,MAAM,EAAE,cAAc;;AAGtB,KACE,OAAO,UAAU,kBAAkB,YACnC,UAAU,gBAAgB,KAE1B,OAAM,IAAI,MAAM,eAAe,UAAU,KAAK,gBAAgB;;AAIlE,MAAM,iBAAiB,QAA2B;CAChD,MAAM,EAAE,cAAc;AACtB,SAAQ,UAAU,YAAlB;EACE,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,+BAA+B;;;AAIrD,MAAa,eACX,QACqD;AACrD,SAAQ,IAAI,UAAU,MAAtB;EACE,KAAK,OACH,QAAO,EAAE,MAAM,IAAI,UAAU,MAAM;EAErC,KAAK,QACH,QAAO;GACL,MAAM,IAAI,UAAU;GACpB,MAAM,cAAc,IAAI;GACzB;EACH,KAAK;AACH,wBAAqB,IAAI;AACzB,WAAS,IAAI,UAAoC,KAAK,MAAtD;IACE,KAAK;IACL,KAAK;IACL,KAAK,UACH,QAAO;KACL,MAAM,IAAI,UAAU;KACpB,YACE,SACG,IAAI,UAAoC,KAAK,KAAK,MAAM,GAAG,EAC5D,GACD,IAAI;KACR;IAEH,QACE,OAAM,IAAI,MAAM,gCAAgC;;EAGtD,KAAK;AACH,wBAAqB,IAAI;AACzB,UAAO,IAAI,UAAU;;;AAGzB,OAAM,IAAI,MAAM,uCAAuC;;AAGzD,MAAM,0BACJ,QACA,UACA,SACoC;CACpC,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAC5C,QAAO;EACL,KAAKA,oCAAa;EAClB,KAAK;EACL,KAAK,MAAM;EACX,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACN;;AAGH,MAAM,wBAAwB,OAC5B,QACA,UACA,cACA,MACA,SACkB;CAClB,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,cACA,YAAY,aAAa,IAAI,EAC7B,OACA,CAAC,OAAO,CACT;CAED,MAAM,SAAS;EAAE,KAAK,SAAS,IAAI;EAAE,KAAK,aAAa;EAAK;CAC5D,MAAM,UAAU,uBAAuB,QAAQ,UAAU,KAAK;AAE9D,MAAK,IAAI,aAAa,SAAS;AAC/B,MAAK,IACH,yBACA,yDACD;CAED,MAAM,QAAQ,GAAGC,uCAAgBC,2CAAoB,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,GAAGD,uCAAgBC,2CAAoB,KAAK,UAAU,QAAQ,CAAC,CAAC;CAC9I,MAAM,YAAYD,uCAChB,MAAM,OAAO,OAAO,KAClB,YAAY,IAAI,EAChB,KACAC,2CAAoB,MAAM,CAC3B,CACF;AAED,MAAK,IAAI,oBAAoB,GAAG,MAAM,GAAG,YAAY;;AAGvD,MAAa,aAAa,OACxB,UACA,cACA,QACA,QACA,SACA,MACA,qBACkB;AAClB,SAAQ,MAAR;EACE,KAAK,WAAW,yBAAyB,CAAC,CAAC;AAEzC,WAAQ,gBAAgB,SAAS,KAAK,GAAG,SAAS,GAAG,gBAAgB,KAAK;AAC1E;EAGF,KAAK,WAAW,wBAAwB,CAAC,CAAC;AACxC,QAAK,IAAI,aAAa,SAAS;AAC/B,OAAI,OAAO,iBAAiB,SAC1B,MAAK,IAAI,iBAAiB,aAAa;AAEzC;EAGF,KAAK,WAAW,uBACd,CAAC,CAAC,UACF,CAAC,CAAC,SACD,OAAO,iBAAiB,YAAY,cAAc,QAAQ;AAU3D,SAAM,sBACJ,QACA,UAVA,OAAO,iBAAiB,WACpB;IACE,GAAGD,uCAAgBC,2CAAoB,aAAa,CAAC;IACrD,KAAK;IACL,KAAK;IACN,GACD,cAMJ,MACA,oBAAoB,EACrB;AACD;EAGF,KAAK,WAAW,qBACd,OAAO,iBAAiB,YACxB,aAAa,QAAQ,SACrB,CAAC,CAAC,UACF,CAAC,CAAC;AACF,SAAM,sBACJ,QACA,UACA,cACA,MACA,oBAAoB,EACrB;AACD;EAGF,QACE,OAAM,IAAI,MAAM,uCAAuC;;;;;;AC1P7D,MAAM,2BAA2B;AAEjC,MAAM,yBAAyB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAS,uBACP,UACA,UACwE;AACxE,KAAI,SAAS,cAAc,UAAa,SAAS,cAAc,KAC7D,OAAM,IAAI,yBACR,GAAG,SAAmB,gEACvB;;AAIL,MAAM,aAAa,OACjB,OACA,UAAuB,EAAE,KACH;AACtB,KAAI;AACF,SAAO,MAAM,MAAM,OAAO,QAAQ;UAC3B,GAAG;;AAEV,QAAM,IAAI,mBACP,EAAU,WAAW,2BACvB;;;AAIL,MAAM,kBAAkB,OAAgB,QAA8B;AACpE,KAAI;AACF,SAAO,MAAM,IAAI,MAAM;UAChB,GAAG;AACV,QAAM,IAAI;;GAER,yCAA0C,EAAU,UAAU,KAAM,EAAU,YAAY;GAC3F;;;AAIL,IAAa,sBAAb,MAAa,oBAAoB;CAuB/B,YACE,cACA,UACA,SACA;yBAdwB;2BAEE;6BAIE;+BAEE;AAQ9B,mBAAiB;;AAEjB,OAAK,eAAe,GAAG,CAAC,aAAa,WAAW,WAAW,GAAG,aAAa,KAAK,aAAa,SAAS,IAAI,GAAG,aAAa,MAAM,GAAG,GAAG,GAAG;AACzI,OAAK,WAAW;AAChB,OAAK,eAAe,SAAS;AAC7B,OAAK,aAAa,SAAS,oBAAoB;AAC/C,OAAK,0BAA0B,SAAS,2BAA2B;AAEnE,MAAI,SAAS,kBACX,MAAK,oBAAoB,QAAQ;AAGnC,MAAI,SAAS,sBACX,MAAK,wBAAwB,QAAQ;;;;;;;;;;;;;;;CAiBzC,MAAM,iBAAiB,QAA8C;EACnE,MAAM,cAAc,IAAI,iBAAiB;AAEzC,cAAY,IAAI,aAAa,KAAK,SAAS;AAE3C,MAAI,OAAO,YACT,aAAY,IAAI,gBAAgB,OAAO,YAAY;AAGrD,MAAI,OAAO,WACT,aAAY,IAAI,eAAe,OAAO,WAAW;EAGnD,MAAM,SAASC,2CAAoB,OAAO,OAAO,IAAI,EAAE;AAEvD,MAAI,OAAO,SAAS,EAClB,aAAY,IAAI,SAAS,OAAO,KAAK,IAAI,CAAC;AAG5C,MAAI,OAAO,gBAAgB,OAAO,aAAa,SAAS,EACtD,aAAY,IAAI,iBAAiB,OAAO,aAAa;AAGvD,OACG,CAAC,OAAO,gBAAgB,OAAO,aAAa,WAAW,MACxD,CAAC,OAAO,WAER,aAAY,IAAI,iBAAiB,OAAO;AAG1C,MAAI,OAAO,kBACT,aAAY,IAAI,sBAAsB,OAAO,kBAAkB;AAGjE,MAAI,OAAO,UACT,aAAY,IAAI,cAAc,OAAO,UAAU;AAGjD,MAAI,OAAO,QACT,aAAY,IAAI,WAAW,OAAO,QAAQ;AAG5C,MAAI,OAAO,aACT,aAAY,IAAI,iBAAiB,OAAO,aAAa;AAGvD,MAAI,OAAO,aAAa,OAAO,UAAU,SAAS,EAChD,aAAY,IAAI,cAAc,OAAO,UAAU,KAAK,IAAI,CAAC;AAG3D,MAAI,OAAO,MACT,aAAY,IAAI,SAAS,OAAO,MAAM;AAGxC,MAAI,OAAO,UACT,aAAY,IAAI,cAAc,OAAO,UAAU;AAGjD,MAAI,OAAO,QACT,aAAY,IAAI,WAAW,OAAO,QAAQ;AAG5C,MAAI,OAAO,OAAO,WAAW,SAC3B,aAAY,IAAI,WAAW,OAAO,OAAO,UAAU,CAAC;AAGtD,MAAI,OAAO,OACT,aAAY,IAAI,UAAU,OAAO,OAAO;EAG1C,MAAM,WAAWA,2CAAoB,OAAO,SAAS,IAAI,EAAE;AAE3D,MAAI,SAAS,SAAS,EACpB,MAAK,MAAM,KAAK,SACd,aAAY,OAAO,YAAY,EAAE;AAIrC,MAAI,OAAO,eAAe;AACxB,eAAY,IAAI,kBAAkB,OAAO,cAAc;AACvD,eAAY,IACV,yBACA,OAAO,uBAAuB,OAC/B;;AAGH,MAAI,OAAO,MACT,aAAY,IAAI,SAAS,OAAO,MAAM;EAGxC,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,yBAAyB;AAE1D,SAAO,GAAG,SAAS,uBAAuB,GAAG,YAAY,UAAU;;;;;;;;;;;;;;CAerE,MAAM,YAAY,eAAe,OAAgC;AAC/D,MAAI,CAAC,gBAAgB,KAAK,YAAY,KAAK,sBAAsBC,4BAAK,CACpE,QAAO,KAAK;AAGd,OAAK,WAAW;EAEhB,MAAM,WAAW,MAAM,WACrB,GAAG,KAAK,aAAa,mCACtB;AAED,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,0DAA0D,SAAS,SACpE;EAGH,MAAM,WAAW,MAAM,gBAAgC,SAAS;AAEhE,OAAK,WAAW;AAChB,OAAK,sBAAsBA,4BAAK,GAAG,KAAK;AAExC,SAAO;;;;;;;;;;;;;;CAeT,MAAM,QAAQ,eAAe,OAAsB;AACjD,MAAI,CAAC,gBAAgB,KAAK,QAAQ,KAAK,kBAAkBA,4BAAK,CAC5D,QAAO,KAAK;AAGd,OAAK,OAAO;EAEZ,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,WAAW;EAE5C,MAAM,WAAW,MAAM,WAAW,SAAS,SAAS;AAEpD,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,sDAAsD,SAAS,SAChE;EAEH,MAAM,OAAO,MAAM,gBAAsB,SAAS;AAElD,OAAK,OAAO;AACZ,OAAK,kBAAkBA,4BAAK,GAAG,KAAK;AAEpC,SAAO;;;;;;;;;;;;;;;CAgBT,MAAM,2BACJ,QACsB;EACtB,MAAM,OAAO,IAAI,iBAAiB;AAElC,OAAK,IAAI,aAAa,KAAK,SAAS;AAEpC,MAAI,OAAO,YACT,MAAK,IAAI,gBAAgB,OAAO,YAAY;EAG9C,MAAM,SAASD,2CAAoB,OAAO,OAAO,IAAI,EAAE;AAEvD,MAAI,OAAO,SAAS,EAClB,MAAK,IAAI,SAAS,OAAO,KAAK,IAAI,CAAC;AAGrC,MAAI,OAAO,gBAAgB,OAAO,aAAa,SAAS,EACtD,MAAK,IAAI,iBAAiB,OAAO,aAAa;MAE9C,MAAK,IAAI,iBAAiB,OAAO;AAGnC,MAAI,OAAO,kBACT,MAAK,IAAI,sBAAsB,OAAO,kBAAkB;AAG1D,MAAI,OAAO,UACT,MAAK,IAAI,cAAc,OAAO,UAAU;AAG1C,MAAI,OAAO,QACT,MAAK,IAAI,WAAW,OAAO,QAAQ;AAGrC,MAAI,OAAO,aACT,MAAK,IAAI,iBAAiB,OAAO,aAAa;AAGhD,MAAI,OAAO,aAAa,OAAO,UAAU,SAAS,EAChD,MAAK,IAAI,cAAc,OAAO,UAAU,KAAK,IAAI,CAAC;AAGpD,MAAI,OAAO,MACT,MAAK,IAAI,SAAS,OAAO,MAAM;AAGjC,MAAI,OAAO,UACT,MAAK,IAAI,cAAc,OAAO,UAAU;AAG1C,MAAI,OAAO,QACT,MAAK,IAAI,WAAW,OAAO,QAAQ;AAGrC,MAAI,OAAO,OAAO,WAAW,SAC3B,MAAK,IAAI,WAAW,OAAO,OAAO,UAAU,CAAC;AAG/C,MAAI,OAAO,OACT,MAAK,IAAI,UAAU,OAAO,OAAO;EAGnC,MAAM,WAAWA,2CAAoB,OAAO,SAAS,IAAI,EAAE;AAE3D,MAAI,SAAS,SAAS,EACpB,MAAK,MAAM,KAAK,SACd,MAAK,OAAO,YAAY,EAAE;AAI9B,MAAI,OAAO,eAAe;AACxB,QAAK,IAAI,kBAAkB,OAAO,cAAc;AAChD,QAAK,IAAI,yBAAyB,OAAO,uBAAuB,OAAO;;AAGzE,MAAI,OAAO,MACT,MAAK,IAAI,SAAS,OAAO,MAAM;EAGjC,MAAM,UAAU;GACd,gBAAgB;GAChB,QAAQ;GACT;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,wCAAwC;EAEzE,MAAM,WAAW,MAAM,WACrB,SAAS,uCACT;GACE,MAAM,KAAK,UAAU;GACrB,QAAQ;GACR;GACD,CACF;AAED,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,sBAC3B,kBAAkB,qBAChB,sCACH;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,gFAAgF,SAAS,SAC1F;AAGH,SAAO,MAAM,gBAA6B,SAAS;;;;;;;;;;;;;;;;;;;CAoBrD,MAAM,SAAS,aAAgD;AAC7D,MAAI,CAAC,YAAY,MAAM,CAAC,OACtB,OAAM,IAAI,yBACR,iDACD;EAGH,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,oBAAoB;EAErD,MAAM,WAAW,MAAM,WAAW,SAAS,mBAAmB;GAC5D,QAAQ;GACR,SAAS,EACP,eAAe,UAAU,eAC1B;GACF,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,SAAS,QAAQ,IAAI,mBAAmB;AAElE,OAAI,mBAAmB;IACrB,MAAM,aAAa,kBAAkB,KAAK,kBAAkB;IAC5D,MAAM,QAAQ,aAAa,WAAW,KAAK;IAE3C,MAAM,iBAAiB,8BAA8B,KACnD,kBACD;AAMD,UAAM,IAAI,iBAAiB,OAJF,iBACrB,eAAe,KACf,gCAE+C;;;AAIvD,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,0DAA0D,SAAS,SACpE;AAGH,SAAO,MAAM,gBAAkC,SAAS;;;;;;;;;;;;;;;CAgB1D,MAAM,cAAc,QAA+C;EACjE,MAAM,cAAc,IAAI,iBAAiB;AAEzC,cAAY,IAAI,aAAa,KAAK,SAAS;AAE3C,MAAI,OAAO,QACT,aAAY,IAAI,iBAAiB,OAAO,QAAQ;AAGlD,MAAI,OAAO,uBAAuB;AAChC,eAAY,IAAI,4BAA4B,OAAO,sBAAsB;AAEzE,OAAI,OAAO,MACT,aAAY,IAAI,SAAS,OAAO,MAAM;;EAI1C,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,uBAAuB;AAExD,SAAO,GAAG,SAAS,qBAAqB,GAAG,YAAY,UAAU;;;;;;;;;;;;;;;;;;;CAoBnE,MAAM,0BACJ,MACA,aACA,cACA,UACiB;EACjB,MAAM,OAAO,IAAI,iBAAiB;AAElC,OAAK,IAAI,cAAc,qBAAqB;AAC5C,OAAK,IAAI,QAAQ,KAAK;AACtB,OAAK,IAAI,gBAAgB,YAAY;AAErC,MAAI,aACF,MAAK,IAAI,iBAAiB,aAAa;EAGzC,MAAM,YAAYA,2CAAoB,SAAS,IAAI,EAAE;AAErD,MAAI,UAAU,SAAS,EACrB,MAAK,MAAM,KAAK,UACd,MAAK,OAAO,YAAY,EAAE;EAI9B,MAAM,UAAU;GACd,gBAAgB;GAChB,QAAQ;GACT;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,iBAAiB;EAElD,MAAM,WAAW,MAAM,WAAW,SAAS,gBAAgB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU;GACrB;GACD,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,qBAC3B,kBAAkB,qBAAqB,kCACxC;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,+DAA+D,SAAS,SACzE;AAGH,SAAO,MAAM,gBAAwB,SAAS;;;;;;;;;;;;;;;;;CAkBhD,MAAM,aACJ,cACA,SACiB;EACjB,MAAM,OAAO,IAAI,iBAAiB;AAElC,OAAK,IAAI,cAAc,gBAAgB;AACvC,OAAK,IAAI,iBAAiB,aAAa;EAEvC,MAAM,SAASA,2CAAoB,SAAS,OAAO,IAAI,EAAE;AAEzD,MAAI,OAAO,SAAS,EAClB,MAAK,IAAI,SAAS,OAAO,KAAK,IAAI,CAAC;EAGrC,MAAM,WAAWA,2CAAoB,SAAS,SAAS,IAAI,EAAE;AAE7D,MAAI,SAAS,SAAS,EACpB,MAAK,MAAM,KAAK,SACd,MAAK,OAAO,YAAY,EAAE;EAI9B,MAAM,UAAU;GACd,gBAAgB;GAChB,QAAQ;GACT;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,iBAAiB;EAElD,MAAM,WAAW,MAAM,WAAW,SAAS,gBAAgB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU;GACrB;GACD,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,wBAC3B,kBAAkB,qBAAqB,6BACxC;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,uEAAuE,SAAS,SACjF;AAGH,SAAO,MAAM,gBAAwB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BhD,MAAM,aACJ,MACA,aACA,iBACA,UACA,SAC2B;EAC3B,MAAM,SAAS,MAAM,KAAK,0BACxB,MACA,aACA,SAAS,cACT,SACD;EAED,MAAM,wBACJ,OAAO,OAAO,eAAe,WACzBC,4BAAK,GAAG,OAAO,aACf;AAEN,MAAI,CAAC,sBACH,OAAM,IAAI,yBAAyB,sCAAsC;AAG3E,MAAI,CAAC,OAAO,MACV,OAAM,IAAI,yBAAyB,mCAAmC;EAGxE,IAAI;AAEJ,MAAI,SAAS,iBAAiB,OAAO,OAAO,SAAS,SAAS,CAC5D,YAAW,MAAM,KAAK,SAAS,OAAO,aAAa;EAGrD,IAAI,gBAAwC,EAAE;AAE9C,MAAI,OAAO,SACT,KAAI,SAAS,mBAAmB,MAAM;GACpC,MAAM,OAAO,SAAS,QAAS,MAAM,KAAK,SAAS;AAEnD,mBAAgB,MAAM,KAAK,gBACzB,OAAO,UACP,KAAK,MACL,SAAS,oBAAoB,GAC7B,SAAS,yBAAyB,GAClC,SAAS,eACT,SAAS,aACV;QAED,iBAAgB,oBAAoB,UAAU,OAAO,SAAS;AAIlE,GAAC,SAAS,yBAAyB,wBAAwB,SAAQ,MAAK;AAEtE,UAAO,cAAc;IACrB;EAEF,MAAM,UAA4B;GAChC,MAAM;IACJ,GAAG;IACH,GAAI,YAAY,EAAE;IACnB;GACD,SAAS,OAAO;GAChB,cAAc,OAAO;GACrB,kBAAkB;GAClB,cAAc,CACZ;IACE,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB;IACA;IACA;IACD,CACF;GACF;AAED,QAAM,SAAS,oBAAoB,SAAS,eAAe,SAAS;AAEpE,SAAO;;;;;;;;;;;;;;;;;;;;;;;CAwBT,MAAM,gBACJ,aACA,SACA,SAC2B;AAC3B,MAAI,CAAC,YAAY,QAAQ,SAAS,SAAS,CACzC,OAAM,IAAI,yBACR,8CACD;EAGH,MAAM,WAAW,MAAM,KAAK,SAAS,YAAY,YAAY;AAG7D,UAAQ,OAAO;GAAE,GAAG,QAAQ;GAAM,GAAG;GAAU;AAE/C,QAAM,SAAS,oBAAoB,SAAS,QAAW,SAAS;AAEhE,SAAO;;;;;;;;;;;;;;;;;;;;;;;CAwBT,MAAM,eACJ,SACA,SAC2B;AAC3B,MAAI,CAAC,QAAQ,aACX,OAAM,IAAI,yBACR,yCACD;EAGH,MAAM,SAAS,MAAM,KAAK,aACxB,QAAQ,cACR,SAAS,oBACV;EAED,MAAM,wBACJ,OAAO,OAAO,eAAe,WACzBA,4BAAK,GAAG,OAAO,aACf;AAEN,MAAI,CAAC,sBACH,OAAM,IAAI,yBAAyB,sCAAsC;AAG3E,MAAI,CAAC,OAAO,MACV,OAAM,IAAI,yBAAyB,mCAAmC;EAGxE,IAAI;AAEJ,MAAI,SAAS,iBAAiB,OAAO,OAAO,SAAS,SAAS,CAC5D,YAAW,MAAM,KAAK,SAAS,OAAO,aAAa;EAGrD,IAAI,gBAAwC,EAAE;AAE9C,MAAI,OAAO,SACT,KAAI,SAAS,mBAAmB,MAAM;GACpC,MAAM,OAAO,SAAS,QAAS,MAAM,KAAK,SAAS;AAEnD,mBAAgB,MAAM,KAAK,gBACzB,OAAO,UACP,KAAK,MACL,SAAS,oBAAoB,GAC7B,SAAS,yBAAyB,EACnC;QAED,iBAAgB,oBAAoB,UAAU,OAAO,SAAS;AAIlE,GAAC,SAAS,yBAAyB,wBAAwB,SAAQ,MAAK;AAEtE,UAAO,cAAc;IACrB;EAEF,MAAM,WAAW,SAAS,qBAAqB;EAC/C,IAAI,SAAS,SAAS,qBAAqB;AAE3C,MAAI,CAAC,YAAY,CAAC,OAChB,UAAS,QAAQ;EAGnB,MAAM,cAAcC,iCAAU,QAAQ,cAAc,UAAU,OAAO;EAErE,MAAM,OACJ,OAAO,KAAK,cAAc,CAAC,WAAW,KAAK,CAAC,WACxC,QAAQ,OACP;GACC,GAAG,QAAQ;GACX,GAAG;GACH,GAAI,YAAY,EAAE;GACnB;EAEP,MAAM,YACJ,QAAQ,cAAc,QAAO,MAAK,MAAM,YAAY,IAAI,EAAE;AAE5D,YAAU,KAAK;GACb,QAAQ,OAAO;GACf,aAAa,OAAO;GACpB;GACA;GACA,iBAAiB;GAClB,CAAC;EAEF,MAAM,iBAAmC;GACvC,GAAG;GACH;GACA,SAAS,OAAO,YAAY,QAAQ;GACpC,cAAc,OAAO,iBAAiB,QAAQ;GAC9C,cAAc;GACf;AAED,QAAM,SAAS,oBAAoB,gBAAgB,eAAe,SAAS;AAE3E,SAAO;;;;;;;;;;;;;;;;;;CAmBT,MAAM,YAAY,OAAe,WAAmC;AAClE,MAAI,CAAC,MAAM,MAAM,CAAC,OAChB,OAAM,IAAI,yBAAyB,gBAAgB;AAGrD,MACE,aACA,cAAc,kBACd,cAAc,gBAEd,OAAM,IAAI,yBACR,2DACD;EAGH,MAAM,OAAO,IAAI,iBAAiB;AAClC,OAAK,IAAI,SAAS,MAAM;AACxB,MAAI,UACF,MAAK,IAAI,mBAAmB,UAAU;EAGxC,MAAM,UAAU,EACd,gBAAgB,qCACjB;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,sBAAsB;EAEvD,MAAM,WAAW,MAAM,WAAW,SAAS,qBAAqB;GAC9D,QAAQ;GACR,MAAM,KAAK,UAAU;GACrB;GACD,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,qBAC3B,kBAAkB,qBAAqB,0BACxC;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,sEAAsE,SAAS,SAChF;;;;;;;;;;;;;;;;;CAmBL,MAAM,gBACJ,SACA,MACA,WACA,gBACA,QACA,OACwB;AACxB,MAAI,OAAO,YAAY,YAAY,QAAQ,MAAM,CAAC,WAAW,EAC3D,OAAM,IAAI,oBACR,4CACD;EAGH,MAAM,EACJ,GAAG,iBACH,GAAG,SACH,GAAG,kBACH,WACE,QAAQ,MAAM,IAAI;AAEtB,MAAI,WAAW,EACb,OAAM,IAAI,oBACR,qDACD;EAGH,IAAI;AACJ,MAAI;AACF,YAAS,KAAK,MAAMC,uCAAgB,gBAAgB,CAAC;UAC/C;AACN,SAAM,IAAI,oBAAoB,6BAA6B;;AAG7D,MACE,WAAW,QACX,OAAO,WAAW,YAClB,MAAM,QAAQ,OAAO,CAErB,OAAM,IAAI,oBAAoB,wCAAwC;AAGxE,MAAI,KAAK,4BAA4B,OAAO,IAC1C,OAAM,IAAI,oBAAoB,sBAAsB;AAGtD,MAAI,OAAO,SAAS,OAClB,OAAM,IAAI,oBAAoB,2CAAyC;EAGzE,MAAM,SAASA,uCAAgB,iBAAiB;EAEhD,MAAM,YAAY,IAAI,WAAW,OAAO,OAAO;AAE/C,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,IACjC,WAAU,KAAK,OAAO,WAAW,EAAE;EAGrC,MAAM,MAAM,MAAMC,qDAA8B,MAAM,OAAO;EAE7D,MAAM,QAAQ,GAAG,gBAAgB,GAAG;AASpC,MAAI,CAPa,MAAM,OAAO,OAAO,OACnC,YAAY,IAAI,EAChB,KACA,WACAC,2CAAoB,MAAM,CAC3B,CAGC,OAAM,IAAI,oBAAoB,oCAAoC;EAGpE,IAAI;AAEJ,MAAI;AACF,YAAS,KAAK,MAAMF,uCAAgB,QAAQ,CAAC;UACvC;AACN,SAAM,IAAI,oBAAoB,8BAA8B;;AAG9D,MACE,WAAW,QACX,OAAO,WAAW,YAClB,MAAM,QAAQ,OAAO,CAErB,OAAM,IAAI,oBAAoB,yCAAyC;AAGzE,OAAK,OAAO,SAAS,UAAU,OAAO,UAAU,MAC9C,OAAM,IAAI,oBAAoB,iBAAiB;EAGjD,MAAM,UAAUF,4BAAK,GAAG;;AAGxB,MAAI,OAAO,QAAQ,QAAW;AAC5B,OAAI,OAAO,OAAO,QAAQ,SACxB,OAAM,IAAI,oBACR,sDACD;AAGH,OAAI,OAAO,OAAO,UAAU,eAC1B,OAAM,IAAI,oBACR,8EACD;;;AAKL,MAAI,OAAO,QAAQ,QACjB;OAAI,OAAO,OAAO,QAAQ,SACxB,OAAM,IAAI,oBACR,gDACD;;AAIL,MACE,OAAO,OAAO,cAAc,YAC5B,OAAO,WAAW,YAClB,OAAO,YAAY,SAAS,QAE5B,OAAM,IAAI,oBACR,mEACD;AAGH,MAAI,OAAO,QAAQ,KAAK,aACtB,OAAM,IAAI,oBAAoB,iBAAiB;AAGjD,MAAI,OAAO,QAAQ,QAAW;AAC5B,OAAI,OAAO,OAAO,QAAQ,SACxB,OAAM,IAAI,oBACR,iDACD;AAGH,OAAI,OAAO,MAAM,UAAU,eACzB,OAAM,IAAI,oBACR,wEACD;;AAML,MAAI,EAFa,MAAM,QAAQ,OAAO,IAAI,GAAG,OAAO,MAAM,CAAC,OAAO,IAAI,EAExD,SAAS,KAAK,SAAS,CACnC,OAAM,IAAI,oBAAoB,yBAAyB;AAGzD,SAAO;;;;;;;;;;;;;CAcT,OAAO,UAAU,KAA4B;AAC3C,MAAI;GACF,MAAM,GAAG,WAAW,IAAI,MAAM,IAAI;AAElC,OAAI,CAAC,SAAS,MAAM,CAClB,OAAM,IAAI,oBAAoB,+BAA+B;GAG/D,MAAM,UAAUE,uCAAgB,QAAQ;AAExC,OAAI,CAAC,QAAQ,WAAW,IAAI,CAC1B,OAAM,IAAI,oBAAoB,2BAA2B;AAG3D,UAAO,KAAK,MAAM,QAAQ;WACnB,GAAG;AACV,OAAI,aAAa,uBACf,OAAM;AAGR,SAAM,IAAI,oBACR,6CACD"}
+{"version":3,"file":"index.cjs","names":["randomBytes","encodeBase64Url","stringToArrayBuffer","parseSpaceSeparated","now","findToken","decodeBase64Url","getPublicSigKeyFromIssuerJwks","stringToArrayBuffer"],"sources":["../src/errors/monocloud-auth-base-error.ts","../src/errors/monocloud-op-error.ts","../src/errors/monocloud-http-error.ts","../src/errors/monocloud-token-error.ts","../src/errors/monocloud-validation-error.ts","../src/client-auth.ts","../src/monocloud-oidc-client.ts"],"sourcesContent":["/**\n * Base class for all MonoCloud authentication errors.\n *\n * All errors thrown by the MonoCloud SDK extend this class, allowing applications to safely detect and handle MonoCloud-specific failures using `instanceof`.\n *\n * @category Error Classes\n */\nexport class MonoCloudAuthBaseError extends Error {}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\n/**\n * OAuth error returned by the authorization server during an authentication or token request.\n *\n * These errors correspond to standard OAuth / OpenID Connect error responses such as `invalid_request`, `access_denied`, or `invalid_grant`.\n *\n * @category Error Classes\n */\nexport class MonoCloudOPError extends MonoCloudAuthBaseError {\n  /** OAuth error code returned by the authorization server. */\n  error: string;\n\n  /** Human-readable description of the error. */\n  errorDescription?: string;\n\n  constructor(error: string, errorDescription?: string) {\n    super(error);\n    this.error = error;\n    this.errorDescription = errorDescription;\n  }\n}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\n/**\n * Error thrown when a request to the MonoCloud authorization server fails.\n *\n * This error typically indicates a network failure, an unexpected HTTP response, or an unsuccessful response returned by the authorization server.\n *\n * @category Error Classes\n */\nexport class MonoCloudHttpError extends MonoCloudAuthBaseError {}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\n/**\n * Error thrown when a token operation fails.\n *\n * @category Error Classes\n */\nexport class MonoCloudTokenError extends MonoCloudAuthBaseError {}\n","import { MonoCloudAuthBaseError } from './monocloud-auth-base-error';\n\n/**\n * Error thrown when validation fails.\n *\n * @category Error Classes\n */\nexport class MonoCloudValidationError extends MonoCloudAuthBaseError {}\n","import {\n  encodeBase64Url,\n  randomBytes,\n  stringToArrayBuffer,\n} from './utils/internal';\nimport { ClientAuthMethod, Jwk } from './types';\n\nconst algToSubtle = (\n  alg?: string\n): HmacImportParams | RsaHashedImportParams | EcKeyImportParams => {\n  switch (alg) {\n    case 'HS256':\n    case 'HS384':\n    case 'HS512':\n      return { name: 'HMAC', hash: `SHA-${alg.slice(-3)}` };\n    case 'PS256':\n    case 'PS384':\n    case 'PS512':\n      return { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };\n    case 'RS256':\n    case 'RS384':\n    case 'RS512':\n      return { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };\n    case 'ES256':\n    case 'ES384':\n      return { name: 'ECDSA', namedCurve: `P-${alg.slice(-3)}` };\n    case 'ES512':\n      return { name: 'ECDSA', namedCurve: 'P-521' };\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported JWS algorithm');\n  }\n};\n\nconst psAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as RsaHashedKeyAlgorithm).hash.name) {\n    case 'SHA-256':\n      return 'PS256';\n    case 'SHA-384':\n      return 'PS384';\n    case 'SHA-512':\n      return 'PS512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported RsaHashedKeyAlgorithm hash name');\n  }\n};\n\nconst rsAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as RsaHashedKeyAlgorithm).hash.name) {\n    case 'SHA-256':\n      return 'RS256';\n    case 'SHA-384':\n      return 'RS384';\n    case 'SHA-512':\n      return 'RS512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported RsaHashedKeyAlgorithm hash name');\n  }\n};\n\nconst esAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as EcKeyAlgorithm).namedCurve) {\n    case 'P-256':\n      return 'ES256';\n    case 'P-384':\n      return 'ES384';\n    case 'P-521':\n      return 'ES512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported EcKeyAlgorithm namedCurve');\n  }\n};\n\nconst hsAlg = (key: CryptoKey): string => {\n  switch ((key.algorithm as HmacKeyAlgorithm).hash.name) {\n    case 'SHA-256':\n      return 'HS256';\n    case 'SHA-384':\n      return 'HS384';\n    case 'SHA-512':\n      return 'HS512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported HMAC Algorithm hash');\n  }\n};\n\nconst keyToJws = (key: CryptoKey): string => {\n  switch (key.algorithm.name) {\n    case 'HMAC':\n      return hsAlg(key);\n    case 'RSA-PSS':\n      return psAlg(key);\n    case 'RSASSA-PKCS1-v1_5':\n      return rsAlg(key);\n    case 'ECDSA':\n      return esAlg(key);\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported CryptoKey algorithm name');\n  }\n};\n\nconst checkRsaKeyAlgorithm = (key: CryptoKey): void => {\n  const { algorithm } = key as CryptoKey & { algorithm: RsaHashedKeyAlgorithm };\n\n  /* v8 ignore if -- @preserve */\n  if (\n    typeof algorithm.modulusLength !== 'number' ||\n    algorithm.modulusLength < 2048\n  ) {\n    throw new Error(`Unsupported ${algorithm.name} modulusLength`);\n  }\n};\n\nconst ecdsaHashName = (key: CryptoKey): string => {\n  const { algorithm } = key as CryptoKey & { algorithm: EcKeyAlgorithm };\n  switch (algorithm.namedCurve) {\n    case 'P-256':\n      return 'SHA-256';\n    case 'P-384':\n      return 'SHA-384';\n    case 'P-521':\n      return 'SHA-512';\n    /* v8 ignore next */\n    default:\n      throw new Error('unsupported ECDSA namedCurve');\n  }\n};\n\nexport const keyToSubtle = (\n  key: CryptoKey\n): AlgorithmIdentifier | RsaPssParams | EcdsaParams => {\n  switch (key.algorithm.name) {\n    case 'HMAC': {\n      return { name: key.algorithm.name };\n    }\n    case 'ECDSA':\n      return {\n        name: key.algorithm.name,\n        hash: ecdsaHashName(key),\n      } as EcdsaParams;\n    case 'RSA-PSS': {\n      checkRsaKeyAlgorithm(key);\n      switch ((key.algorithm as RsaHashedKeyAlgorithm).hash.name) {\n        case 'SHA-256': // Fall through\n        case 'SHA-384': // Fall through\n        case 'SHA-512':\n          return {\n            name: key.algorithm.name,\n            saltLength:\n              parseInt(\n                (key.algorithm as RsaHashedKeyAlgorithm).hash.name.slice(-3),\n                10\n              ) >> 3,\n          } as RsaPssParams;\n        /* v8 ignore next */\n        default:\n          throw new Error('unsupported RSA-PSS hash name');\n      }\n    }\n    case 'RSASSA-PKCS1-v1_5':\n      checkRsaKeyAlgorithm(key);\n      return key.algorithm.name;\n  }\n  /* v8 ignore next -- @preserve */\n  throw new Error('unsupported CryptoKey algorithm name');\n};\n\nconst clientAssertionPayload = (\n  issuer: string,\n  clientId: string,\n  skew: number\n): Record<string, number | string> => {\n  const now = Math.floor(Date.now() / 1000) + skew;\n  return {\n    jti: randomBytes(),\n    aud: issuer,\n    exp: now + 60,\n    iat: now,\n    nbf: now,\n    iss: clientId,\n    sub: clientId,\n  };\n};\n\nconst jwtAssertionGenerator = async (\n  issuer: string,\n  clientId: string,\n  clientSecret: Jwk,\n  body: URLSearchParams,\n  skew: number\n): Promise<void> => {\n  const key = await crypto.subtle.importKey(\n    'jwk',\n    clientSecret as JsonWebKey,\n    algToSubtle(clientSecret.alg),\n    false,\n    ['sign']\n  );\n\n  const header = { alg: keyToJws(key), kid: clientSecret.kid };\n  const payload = clientAssertionPayload(issuer, clientId, skew);\n\n  body.set('client_id', clientId);\n  body.set(\n    'client_assertion_type',\n    'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n  );\n\n  const input = `${encodeBase64Url(stringToArrayBuffer(JSON.stringify(header)))}.${encodeBase64Url(stringToArrayBuffer(JSON.stringify(payload)))}`;\n  const signature = encodeBase64Url(\n    await crypto.subtle.sign(\n      keyToSubtle(key),\n      key,\n      stringToArrayBuffer(input) as BufferSource\n    )\n  );\n\n  body.set('client_assertion', `${input}.${signature}`);\n};\n\nexport const clientAuth = async (\n  clientId: string,\n  clientSecret?: string | Jwk,\n  method?: ClientAuthMethod,\n  issuer?: string,\n  headers?: Record<string, string>,\n  body?: URLSearchParams,\n  jwtAssertionSkew?: number\n): Promise<void> => {\n  switch (true) {\n    case method === 'client_secret_basic' && !!headers: {\n      // eslint-disable-next-line no-param-reassign\n      headers.authorization = `Basic ${btoa(`${clientId}:${clientSecret ?? ''}`)}`;\n      break;\n    }\n\n    case method === 'client_secret_post' && !!body: {\n      body.set('client_id', clientId);\n      if (typeof clientSecret === 'string') {\n        body.set('client_secret', clientSecret);\n      }\n      break;\n    }\n\n    case method === 'client_secret_jwt' &&\n      !!issuer &&\n      !!body &&\n      (typeof clientSecret === 'string' || clientSecret?.kty === 'oct'): {\n      const cs =\n        typeof clientSecret === 'string'\n          ? {\n              k: encodeBase64Url(stringToArrayBuffer(clientSecret)),\n              kty: 'oct',\n              alg: 'HS256',\n            }\n          : clientSecret;\n\n      await jwtAssertionGenerator(\n        issuer,\n        clientId,\n        cs,\n        body,\n        jwtAssertionSkew ?? 0\n      );\n      break;\n    }\n\n    case method === 'private_key_jwt' &&\n      typeof clientSecret === 'object' &&\n      clientSecret.kty !== 'oct' &&\n      !!issuer &&\n      !!body: {\n      await jwtAssertionGenerator(\n        issuer,\n        clientId,\n        clientSecret,\n        body,\n        jwtAssertionSkew ?? 0\n      );\n      break;\n    }\n\n    default:\n      throw new Error('Invalid Client Authentication Method');\n  }\n};\n","import {\n  decodeBase64Url,\n  findToken,\n  getPublicSigKeyFromIssuerJwks,\n  now,\n  parseSpaceSeparated,\n  stringToArrayBuffer,\n} from './utils/internal';\nimport { clientAuth, keyToSubtle } from './client-auth';\nimport {\n  AccessToken,\n  AuthenticateOptions,\n  AuthorizationParams,\n  ClientAuthMethod,\n  EndSessionParameters,\n  IdTokenClaims,\n  IssuerMetadata,\n  Jwk,\n  Jwks,\n  SecurityAlgorithms,\n  JwsHeaderParameters,\n  MonoCloudClientOptions,\n  MonoCloudSession,\n  MonoCloudUser,\n  ParResponse,\n  PushedAuthorizationParams,\n  RefetchUserInfoOptions,\n  RefreshGrantOptions,\n  RefreshSessionOptions,\n  Tokens,\n  UserinfoResponse,\n} from './types';\nimport { MonoCloudOPError } from './errors/monocloud-op-error';\nimport { MonoCloudHttpError } from './errors/monocloud-http-error';\nimport { MonoCloudValidationError } from './errors/monocloud-validation-error';\nimport { MonoCloudTokenError } from './errors/monocloud-token-error';\nimport { MonoCloudAuthBaseError } from './errors/monocloud-auth-base-error';\n\nconst JWT_ASSERTION_CLOCK_SKEW = 5;\n\nconst FILTER_ID_TOKEN_CLAIMS = [\n  'iss',\n  'exp',\n  'nbf',\n  'aud',\n  'nonce',\n  'iat',\n  'auth_time',\n  'c_hash',\n  'at_hash',\n  's_hash',\n];\n\nfunction assertMetadataProperty<K extends keyof IssuerMetadata>(\n  metadata: IssuerMetadata,\n  property: K\n): asserts metadata is IssuerMetadata & Required<Pick<IssuerMetadata, K>> {\n  if (metadata[property] === undefined || metadata[property] === null) {\n    throw new MonoCloudValidationError(\n      `${property as string} endpoint is required but not available in the issuer metadata`\n    );\n  }\n}\n\nconst innerFetch = async (\n  input: string,\n  reqInit: RequestInit = {}\n): Promise<Response> => {\n  try {\n    return await fetch(input, reqInit);\n  } catch (e) {\n    /* v8 ignore next -- @preserve */\n    throw new MonoCloudHttpError(\n      (e as any).message ?? 'Unexpected Network Error'\n    );\n  }\n};\n\nconst deserializeJson = async <T = any>(res: Response): Promise<T> => {\n  try {\n    return await res.json();\n  } catch (e) {\n    throw new MonoCloudHttpError(\n      /* v8 ignore next -- @preserve */\n      `Failed to parse response body as JSON ${(e as any).message ? `: ${(e as any).message}` : ''}`\n    );\n  }\n};\n\n/**\n * @category Classes\n */\nexport class MonoCloudOidcClient {\n  private readonly tenantDomain: string;\n\n  private readonly clientId: string;\n\n  private readonly clientSecret?: string | Jwk;\n\n  private readonly authMethod: ClientAuthMethod;\n\n  private readonly idTokenSigningAlgorithm: SecurityAlgorithms;\n\n  private jwks?: Jwks;\n\n  private jwksCacheExpiry = 0;\n\n  private jwksCacheDuration = 300;\n\n  private metadata?: IssuerMetadata;\n\n  private metadataCacheExpiry = 0;\n\n  private metadataCacheDuration = 300;\n\n  constructor(\n    tenantDomain: string,\n    clientId: string,\n    options?: MonoCloudClientOptions\n  ) {\n    // eslint-disable-next-line no-param-reassign\n    tenantDomain ??= '';\n    /* v8 ignore next -- @preserve */\n    this.tenantDomain = `${!tenantDomain.startsWith('https://') ? 'https://' : ''}${tenantDomain.endsWith('/') ? tenantDomain.slice(0, -1) : tenantDomain}`;\n    this.clientId = clientId;\n    this.clientSecret = options?.clientSecret;\n    this.authMethod = options?.clientAuthMethod ?? 'client_secret_basic';\n    this.idTokenSigningAlgorithm = options?.idTokenSigningAlgorithm ?? 'RS256';\n\n    if (options?.jwksCacheDuration) {\n      this.jwksCacheDuration = options.jwksCacheDuration;\n    }\n\n    if (options?.metadataCacheDuration) {\n      this.metadataCacheDuration = options.metadataCacheDuration;\n    }\n  }\n\n  /**\n   * Generates an authorization URL with specified parameters.\n   *\n   * If no values are provided for `responseType`, or `codeChallengeMethod`, they default to `code`, and `S256`, respectively.\n   *\n   * @param params - Authorization URL parameters.\n   *\n   * @returns Tenant's authorization URL.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async authorizationUrl(params: AuthorizationParams): Promise<string> {\n    const queryParams = new URLSearchParams();\n\n    queryParams.set('client_id', this.clientId);\n\n    if (params.redirectUri) {\n      queryParams.set('redirect_uri', params.redirectUri);\n    }\n\n    if (params.requestUri) {\n      queryParams.set('request_uri', params.requestUri);\n    }\n\n    const scopes = parseSpaceSeparated(params.scopes) ?? [];\n\n    if (scopes.length > 0) {\n      queryParams.set('scope', scopes.join(' '));\n    }\n\n    if (params.responseType && params.responseType.length > 0) {\n      queryParams.set('response_type', params.responseType);\n    }\n\n    if (\n      (!params.responseType || params.responseType.length === 0) &&\n      !params.requestUri\n    ) {\n      queryParams.set('response_type', 'code');\n    }\n\n    if (params.authenticatorHint) {\n      queryParams.set('authenticator_hint', params.authenticatorHint);\n    }\n\n    if (params.loginHint) {\n      queryParams.set('login_hint', params.loginHint);\n    }\n\n    if (params.request) {\n      queryParams.set('request', params.request);\n    }\n\n    if (params.responseMode) {\n      queryParams.set('response_mode', params.responseMode);\n    }\n\n    if (params.acrValues && params.acrValues.length > 0) {\n      queryParams.set('acr_values', params.acrValues.join(' '));\n    }\n\n    if (params.nonce) {\n      queryParams.set('nonce', params.nonce);\n    }\n\n    if (params.uiLocales) {\n      queryParams.set('ui_locales', params.uiLocales);\n    }\n\n    if (params.display) {\n      queryParams.set('display', params.display);\n    }\n\n    if (typeof params.maxAge === 'number') {\n      queryParams.set('max_age', params.maxAge.toString());\n    }\n\n    if (params.prompt) {\n      queryParams.set('prompt', params.prompt);\n    }\n\n    const resource = parseSpaceSeparated(params.resource) ?? [];\n\n    if (resource.length > 0) {\n      for (const r of resource) {\n        queryParams.append('resource', r);\n      }\n    }\n\n    if (params.codeChallenge) {\n      queryParams.set('code_challenge', params.codeChallenge);\n      queryParams.set(\n        'code_challenge_method',\n        params.codeChallengeMethod ?? 'S256'\n      );\n    }\n\n    if (params.state) {\n      queryParams.set('state', params.state);\n    }\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'authorization_endpoint');\n\n    return `${metadata.authorization_endpoint}?${queryParams.toString()}`;\n  }\n\n  /**\n   * Fetches the authorization server metadata from the .well-known endpoint.\n   * The metadata is cached for 1 minute.\n   *\n   * @param forceRefresh - If `true`, bypasses the cache and fetches fresh metadata from the server.\n   *\n   * @returns The issuer metadata for the tenant, retrieved from the OpenID Connect discovery endpoint.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async getMetadata(forceRefresh = false): Promise<IssuerMetadata> {\n    if (!forceRefresh && this.metadata && this.metadataCacheExpiry > now()) {\n      return this.metadata;\n    }\n\n    this.metadata = undefined;\n\n    const response = await innerFetch(\n      `${this.tenantDomain}/.well-known/openid-configuration`\n    );\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while fetching metadata. Unexpected status code: ${response.status}`\n      );\n    }\n\n    const metadata = await deserializeJson<IssuerMetadata>(response);\n\n    this.metadata = metadata;\n    this.metadataCacheExpiry = now() + this.metadataCacheDuration;\n\n    return metadata;\n  }\n\n  /**\n   * Fetches the JSON Web Keys used to sign the ID token.\n   * The JWKS is cached for 1 minute.\n   *\n   * @param forceRefresh - If `true`, bypasses the cache and fetches fresh set of JWKS from the server.\n   *\n   * @returns The JSON Web Key Set containing the public keys for token verification.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async getJwks(forceRefresh = false): Promise<Jwks> {\n    if (!forceRefresh && this.jwks && this.jwksCacheExpiry > now()) {\n      return this.jwks;\n    }\n\n    this.jwks = undefined;\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'jwks_uri');\n\n    const response = await innerFetch(metadata.jwks_uri);\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while fetching JWKS. Unexpected status code: ${response.status}`\n      );\n    }\n    const jwks = await deserializeJson<Jwks>(response);\n\n    this.jwks = jwks;\n    this.jwksCacheExpiry = now() + this.jwksCacheDuration;\n\n    return jwks;\n  }\n\n  /**\n   * Performs a pushed authorization request.\n   *\n   * @param params - Authorization Parameters.\n   *\n   * @returns Response from Pushed Authorization Request (PAR) endpoint.\n   *\n   * @throws {@link MonoCloudOPError} - When the request is invalid.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async pushedAuthorizationRequest(\n    params: PushedAuthorizationParams\n  ): Promise<ParResponse> {\n    const body = new URLSearchParams();\n\n    body.set('client_id', this.clientId);\n\n    if (params.redirectUri) {\n      body.set('redirect_uri', params.redirectUri);\n    }\n\n    const scopes = parseSpaceSeparated(params.scopes) ?? [];\n\n    if (scopes.length > 0) {\n      body.set('scope', scopes.join(' '));\n    }\n\n    if (params.responseType && params.responseType.length > 0) {\n      body.set('response_type', params.responseType);\n    } else {\n      body.set('response_type', 'code');\n    }\n\n    if (params.authenticatorHint) {\n      body.set('authenticator_hint', params.authenticatorHint);\n    }\n\n    if (params.loginHint) {\n      body.set('login_hint', params.loginHint);\n    }\n\n    if (params.request) {\n      body.set('request', params.request);\n    }\n\n    if (params.responseMode) {\n      body.set('response_mode', params.responseMode);\n    }\n\n    if (params.acrValues && params.acrValues.length > 0) {\n      body.set('acr_values', params.acrValues.join(' '));\n    }\n\n    if (params.nonce) {\n      body.set('nonce', params.nonce);\n    }\n\n    if (params.uiLocales) {\n      body.set('ui_locales', params.uiLocales);\n    }\n\n    if (params.display) {\n      body.set('display', params.display);\n    }\n\n    if (typeof params.maxAge === 'number') {\n      body.set('max_age', params.maxAge.toString());\n    }\n\n    if (params.prompt) {\n      body.set('prompt', params.prompt);\n    }\n\n    const resource = parseSpaceSeparated(params.resource) ?? [];\n\n    if (resource.length > 0) {\n      for (const r of resource) {\n        body.append('resource', r);\n      }\n    }\n\n    if (params.codeChallenge) {\n      body.set('code_challenge', params.codeChallenge);\n      body.set('code_challenge_method', params.codeChallengeMethod ?? 'S256');\n    }\n\n    if (params.state) {\n      body.set('state', params.state);\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n      accept: 'application/json',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'pushed_authorization_request_endpoint');\n\n    const response = await innerFetch(\n      metadata.pushed_authorization_request_endpoint,\n      {\n        body: body.toString(),\n        method: 'POST',\n        headers,\n      }\n    );\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'par_request_failed',\n        standardBodyError.error_description ??\n          'Pushed Authorization Request Failed'\n      );\n    }\n\n    if (response.status !== 201) {\n      throw new MonoCloudHttpError(\n        `Error while performing pushed authorization request. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<ParResponse>(response);\n  }\n\n  /**\n   * Fetches userinfo associated with the provided access token.\n   *\n   * @param accessToken - A valid access token used to retrieve userinfo.\n   *\n   * @returns The authenticated user's claims.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error (e.g., 'invalid_token') in the 'WWW-Authenticate' header\n   * following a 401 Unauthorized response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   * @throws {@link MonoCloudValidationError} - When the access token is invalid.\n   *\n   */\n  async userinfo(accessToken: string): Promise<UserinfoResponse> {\n    if (!accessToken.trim().length) {\n      throw new MonoCloudValidationError(\n        'Access token is required for fetching userinfo'\n      );\n    }\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'userinfo_endpoint');\n\n    const response = await innerFetch(metadata.userinfo_endpoint, {\n      method: 'GET',\n      headers: {\n        authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (response.status === 401) {\n      const authenticateError = response.headers.get('WWW-Authenticate');\n\n      if (authenticateError) {\n        const errorMatch = /error=\"([^\"]+)\"/.exec(authenticateError);\n        const error = errorMatch ? errorMatch[1] : 'userinfo_failed';\n\n        const errorDescMatch = /error_description=\"([^\"]+)\"/.exec(\n          authenticateError\n        );\n\n        const errorDescription = errorDescMatch\n          ? errorDescMatch[1]\n          : 'Userinfo authentication error';\n\n        throw new MonoCloudOPError(error, errorDescription);\n      }\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while fetching userinfo. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<UserinfoResponse>(response);\n  }\n\n  /**\n   * Generates OpenID end session URL for signing out.\n   *\n   * Note - The `state` is added only when `postLogoutRedirectUri` is present.\n   *\n   * @param params - Parameters to build end session URL.\n   *\n   * @returns Tenant's end session URL.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async endSessionUrl(params: EndSessionParameters): Promise<string> {\n    const queryParams = new URLSearchParams();\n\n    queryParams.set('client_id', this.clientId);\n\n    if (params.idToken) {\n      queryParams.set('id_token_hint', params.idToken);\n    }\n\n    if (params.postLogoutRedirectUri) {\n      queryParams.set('post_logout_redirect_uri', params.postLogoutRedirectUri);\n\n      if (params.state) {\n        queryParams.set('state', params.state);\n      }\n    }\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'end_session_endpoint');\n\n    return `${metadata.end_session_endpoint}?${queryParams.toString()}`;\n  }\n\n  /**\n   * Exchanges an authorization code for tokens.\n   *\n   * @param code - The authorization code received from the authorization server.\n   * @param redirectUri - The redirect URI used in the initial authorization request.\n   * @param codeVerifier - Code verifier for PKCE.\n   * @param resource - Space-separated list of resources the access token should be scoped to.\n   *\n   * @returns Tokens obtained by exchanging an authorization code at the token endpoint.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async exchangeAuthorizationCode(\n    code: string,\n    redirectUri: string,\n    codeVerifier?: string,\n    resource?: string\n  ): Promise<Tokens> {\n    const body = new URLSearchParams();\n\n    body.set('grant_type', 'authorization_code');\n    body.set('code', code);\n    body.set('redirect_uri', redirectUri);\n\n    if (codeVerifier) {\n      body.set('code_verifier', codeVerifier);\n    }\n\n    const resources = parseSpaceSeparated(resource) ?? [];\n\n    if (resources.length > 0) {\n      for (const r of resources) {\n        body.append('resource', r);\n      }\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n      accept: 'application/json',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'token_endpoint');\n\n    const response = await innerFetch(metadata.token_endpoint, {\n      method: 'POST',\n      body: body.toString(),\n      headers,\n    });\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'code_grant_failed',\n        standardBodyError.error_description ?? 'Authorization code grant failed'\n      );\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while performing token grant. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<Tokens>(response);\n  }\n\n  /**\n   * Exchanges a refresh token for new tokens.\n   *\n   * @param refreshToken - The refresh token used to request new tokens.\n   * @param options - Refresh grant options.\n   *\n   * @returns Tokens obtained by exchanging a refresh token at the token endpoint.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async refreshGrant(\n    refreshToken: string,\n    options?: RefreshGrantOptions\n  ): Promise<Tokens> {\n    const body = new URLSearchParams();\n\n    body.set('grant_type', 'refresh_token');\n    body.set('refresh_token', refreshToken);\n\n    const scopes = parseSpaceSeparated(options?.scopes) ?? [];\n\n    if (scopes.length > 0) {\n      body.set('scope', scopes.join(' '));\n    }\n\n    const resource = parseSpaceSeparated(options?.resource) ?? [];\n\n    if (resource.length > 0) {\n      for (const r of resource) {\n        body.append('resource', r);\n      }\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n      accept: 'application/json',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'token_endpoint');\n\n    const response = await innerFetch(metadata.token_endpoint, {\n      method: 'POST',\n      body: body.toString(),\n      headers,\n    });\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'refresh_grant_failed',\n        standardBodyError.error_description ?? 'Refresh token grant failed'\n      );\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while performing refresh token grant. Unexpected status code: ${response.status}`\n      );\n    }\n\n    return await deserializeJson<Tokens>(response);\n  }\n\n  /**\n   * Generates a session with user and tokens by exchanging authorization code from callback params.\n   *\n   * @param code - The authorization code received from the callback.\n   * @param redirectUri - The redirect URI that was used in the authorization request.\n   * @param requestedScopes - A space-separated list of scopes originally requested via the `/authorize` endpoint.\n   * This is stored in the session to ensure the correct access token can be identified and refreshed during `refreshSession()`.\n   * @param resource - A space-separated list of resource indicators originally requested via the `/authorize` endpoint.\n   * Used alongside scopes to uniquely identify and refresh the specific access token associated with these resources.\n   * @param options - Options for authenticating a user with authorization code.\n   *\n   * @returns The user's session containing authentication tokens and user information.\n   *\n   * @throws {@link MonoCloudValidationError} - When the token scope does not contain the openid scope,\n   * or if 'expires_in' or 'scope' is missing from the token response.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized.\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async authenticate(\n    code: string,\n    redirectUri: string,\n    requestedScopes: string,\n    resource?: string,\n    options?: AuthenticateOptions\n  ): Promise<MonoCloudSession> {\n    const tokens = await this.exchangeAuthorizationCode(\n      code,\n      redirectUri,\n      options?.codeVerifier,\n      resource\n    );\n\n    const accessTokenExpiration =\n      typeof tokens.expires_in === 'number'\n        ? now() + tokens.expires_in\n        : undefined;\n\n    if (!accessTokenExpiration) {\n      throw new MonoCloudValidationError(\"Missing required 'expires_in' field\");\n    }\n\n    if (!tokens.scope) {\n      throw new MonoCloudValidationError(\"Missing or invalid 'scope' field\");\n    }\n\n    let userinfo: MonoCloudUser | undefined;\n\n    if (options?.fetchUserInfo && tokens.scope?.includes('openid')) {\n      userinfo = await this.userinfo(tokens.access_token);\n    }\n\n    let idTokenClaims: Partial<IdTokenClaims> = {};\n\n    if (tokens.id_token) {\n      if (options?.validateIdToken ?? true) {\n        const jwks = options?.jwks ?? (await this.getJwks());\n\n        idTokenClaims = await this.validateIdToken(\n          tokens.id_token,\n          jwks.keys,\n          options?.idTokenClockSkew ?? 0,\n          options?.idTokenClockTolerance ?? 0,\n          options?.idTokenMaxAge,\n          options?.idTokenNonce\n        );\n      } else {\n        idTokenClaims = MonoCloudOidcClient.decodeJwt(tokens.id_token);\n      }\n    }\n\n    (options?.filteredIdTokenClaims ?? FILTER_ID_TOKEN_CLAIMS).forEach(x => {\n      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete\n      delete idTokenClaims[x];\n    });\n\n    const session: MonoCloudSession = {\n      user: {\n        ...idTokenClaims,\n        ...(userinfo ?? {}),\n      } as MonoCloudUser,\n      idToken: tokens.id_token,\n      refreshToken: tokens.refresh_token,\n      authorizedScopes: requestedScopes,\n      accessTokens: [\n        {\n          scopes: tokens.scope,\n          accessToken: tokens.access_token,\n          accessTokenExpiration,\n          resource,\n          requestedScopes,\n        },\n      ],\n    };\n\n    await options?.onSessionCreating?.(session, idTokenClaims, userinfo);\n\n    return session;\n  }\n\n  /**\n   * Refetches user information for an existing session using the userinfo endpoint.\n   * Updates the session's user object with the latest user information while preserving existing properties.\n   *\n   * @param accessToken - Access token used to fetch the userinfo.\n   * @param session - The current MonoCloudSession.\n   * @param options - Userinfo refetch options.\n   *\n   * @returns Updated session with the latest userinfo.\n   *\n   * @throws {@link MonoCloudValidationError} - When the token scope does not contain openid scope\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async refetchUserInfo(\n    accessToken: AccessToken,\n    session: MonoCloudSession,\n    options?: RefetchUserInfoOptions\n  ): Promise<MonoCloudSession> {\n    if (!accessToken.scopes?.includes('openid')) {\n      throw new MonoCloudValidationError(\n        'Fetching userinfo requires the openid scope'\n      );\n    }\n\n    const userinfo = await this.userinfo(accessToken.accessToken);\n\n    // eslint-disable-next-line no-param-reassign\n    session.user = { ...session.user, ...userinfo };\n\n    await options?.onSessionCreating?.(session, undefined, userinfo);\n\n    return session;\n  }\n\n  /**\n   * Refreshes an existing session using the refresh token.\n   * This function requests new tokens using the refresh token and optionally updates user information.\n   *\n   * @param session - The current MonoCloudSession containing the refresh token.\n   * @param options - Session refresh options.\n   *\n   * @returns User's session containing refreshed authentication tokens and user information.\n   *\n   * @throws {@link MonoCloudValidationError} - If the refresh token is not present in the session,\n   * or if 'expires_in' or 'scope' (including the openid scope) is missing from the token response.\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   *\n   */\n  async refreshSession(\n    session: MonoCloudSession,\n    options?: RefreshSessionOptions\n  ): Promise<MonoCloudSession> {\n    if (!session.refreshToken) {\n      throw new MonoCloudValidationError(\n        'Session does not contain refresh token'\n      );\n    }\n\n    const tokens = await this.refreshGrant(\n      session.refreshToken,\n      options?.refreshGrantOptions\n    );\n\n    const accessTokenExpiration =\n      typeof tokens.expires_in === 'number'\n        ? now() + tokens.expires_in\n        : undefined;\n\n    if (!accessTokenExpiration) {\n      throw new MonoCloudValidationError(\"Missing required 'expires_in' field\");\n    }\n\n    if (!tokens.scope) {\n      throw new MonoCloudValidationError(\"Missing or invalid 'scope' field\");\n    }\n\n    let userinfo: MonoCloudUser | undefined;\n\n    if (options?.fetchUserInfo && tokens.scope?.includes('openid')) {\n      userinfo = await this.userinfo(tokens.access_token);\n    }\n\n    let idTokenClaims: Partial<IdTokenClaims> = {};\n\n    if (tokens.id_token) {\n      if (options?.validateIdToken ?? true) {\n        const jwks = options?.jwks ?? (await this.getJwks());\n\n        idTokenClaims = await this.validateIdToken(\n          tokens.id_token,\n          jwks.keys,\n          options?.idTokenClockSkew ?? 0,\n          options?.idTokenClockTolerance ?? 0\n        );\n      } else {\n        idTokenClaims = MonoCloudOidcClient.decodeJwt(tokens.id_token);\n      }\n    }\n\n    (options?.filteredIdTokenClaims ?? FILTER_ID_TOKEN_CLAIMS).forEach(x => {\n      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete\n      delete idTokenClaims[x];\n    });\n\n    const resource = options?.refreshGrantOptions?.resource;\n    let scopes = options?.refreshGrantOptions?.scopes;\n\n    if (!resource && !scopes) {\n      scopes = session.authorizedScopes;\n    }\n\n    const accessToken = findToken(session.accessTokens, resource, scopes);\n\n    const user =\n      Object.keys(idTokenClaims).length === 0 && !userinfo\n        ? session.user\n        : ({\n            ...session.user,\n            ...idTokenClaims,\n            ...(userinfo ?? {}),\n          } as MonoCloudUser);\n\n    const newTokens =\n      session.accessTokens?.filter(t => t !== accessToken) ?? [];\n\n    newTokens.push({\n      scopes: tokens.scope,\n      accessToken: tokens.access_token,\n      accessTokenExpiration,\n      resource,\n      requestedScopes: scopes,\n    });\n\n    const updatedSession: MonoCloudSession = {\n      ...session,\n      user,\n      idToken: tokens.id_token ?? session.idToken,\n      refreshToken: tokens.refresh_token ?? session.refreshToken,\n      accessTokens: newTokens,\n    };\n\n    await options?.onSessionCreating?.(updatedSession, idTokenClaims, userinfo);\n\n    return updatedSession;\n  }\n\n  /**\n   * Revokes an access token or refresh token, rendering it invalid for future use.\n   *\n   * @param token - The token string to be revoked.\n   * @param tokenType - Hint about the token type ('access_token' or 'refresh_token').\n   *\n   * @returns If token revocation succeeded.\n   *\n   * @throws {@link MonoCloudValidationError} - If token is invalid or unsupported token type\n   *\n   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized\n   * OAuth 2.0 error response.\n   *\n   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or\n   * unexpected status code during the request or a serialization error while processing the response.\n   */\n  async revokeToken(token: string, tokenType?: string): Promise<void> {\n    if (!token.trim().length) {\n      throw new MonoCloudValidationError('Invalid token');\n    }\n\n    if (\n      tokenType &&\n      tokenType !== 'access_token' &&\n      tokenType !== 'refresh_token'\n    ) {\n      throw new MonoCloudValidationError(\n        'Only access_token and refresh_token types are supported.'\n      );\n    }\n\n    const body = new URLSearchParams();\n    body.set('token', token);\n    if (tokenType) {\n      body.set('token_type_hint', tokenType);\n    }\n\n    const headers = {\n      'content-type': 'application/x-www-form-urlencoded',\n    };\n\n    await clientAuth(\n      this.clientId,\n      this.clientSecret,\n      this.authMethod,\n      this.tenantDomain,\n      headers,\n      body,\n      JWT_ASSERTION_CLOCK_SKEW\n    );\n\n    const metadata = await this.getMetadata();\n\n    assertMetadataProperty(metadata, 'revocation_endpoint');\n\n    const response = await innerFetch(metadata.revocation_endpoint, {\n      method: 'POST',\n      body: body.toString(),\n      headers,\n    });\n\n    if (response.status === 400) {\n      const standardBodyError = await deserializeJson(response);\n\n      throw new MonoCloudOPError(\n        standardBodyError.error ?? 'revocation_failed',\n        standardBodyError.error_description ?? 'Token revocation failed'\n      );\n    }\n\n    if (response.status !== 200) {\n      throw new MonoCloudHttpError(\n        `Error while performing revocation request. Unexpected status code: ${response.status}`\n      );\n    }\n  }\n\n  /**\n   * Validates an ID Token.\n   *\n   * @param idToken - The ID Token JWT string to validate.\n   * @param jwks - Array of JSON Web Keys (JWK) used to verify the token's signature.\n   * @param clockSkew - Number of seconds to adjust the current time to account for clock differences.\n   * @param clockTolerance - Additional time tolerance in seconds for time-based claim validation.\n   * @param maxAge - Maximum authentication age in seconds.\n   * @param nonce - Nonce value to validate against the token's nonce claim.\n   *\n   * @returns Validated ID Token claims.\n   *\n   * @throws {@link MonoCloudTokenError} - If ID Token validation fails\n   *\n   */\n  async validateIdToken(\n    idToken: string,\n    jwks: Jwk[],\n    clockSkew: number,\n    clockTolerance: number,\n    maxAge?: number,\n    nonce?: string\n  ): Promise<IdTokenClaims> {\n    if (typeof idToken !== 'string' || idToken.trim().length === 0) {\n      throw new MonoCloudTokenError(\n        'ID Token must be a valid non-empty string'\n      );\n    }\n\n    const {\n      0: protectedHeader,\n      1: payload,\n      2: encodedSignature,\n      length,\n    } = idToken.split('.');\n\n    if (length !== 3) {\n      throw new MonoCloudTokenError(\n        'ID Token must have a header, payload and signature'\n      );\n    }\n\n    let header: JwsHeaderParameters;\n    try {\n      header = JSON.parse(decodeBase64Url(protectedHeader));\n    } catch {\n      throw new MonoCloudTokenError('Failed to parse JWT Header');\n    }\n\n    if (\n      header === null ||\n      typeof header !== 'object' ||\n      Array.isArray(header)\n    ) {\n      throw new MonoCloudTokenError('JWT Header must be a top level object');\n    }\n\n    if (this.idTokenSigningAlgorithm !== header.alg) {\n      throw new MonoCloudTokenError('Invalid signing alg');\n    }\n\n    if (header.crit !== undefined) {\n      throw new MonoCloudTokenError('Unexpected JWT \"crit\" header parameter');\n    }\n\n    const binary = decodeBase64Url(encodedSignature);\n\n    const signature = new Uint8Array(binary.length);\n\n    for (let i = 0; i < binary.length; i++) {\n      signature[i] = binary.charCodeAt(i);\n    }\n\n    const key = await getPublicSigKeyFromIssuerJwks(jwks, header);\n\n    const input = `${protectedHeader}.${payload}`;\n\n    const verified = await crypto.subtle.verify(\n      keyToSubtle(key),\n      key,\n      signature,\n      stringToArrayBuffer(input) as BufferSource\n    );\n\n    if (!verified) {\n      throw new MonoCloudTokenError('JWT signature verification failed');\n    }\n\n    let claims: IdTokenClaims;\n\n    try {\n      claims = JSON.parse(decodeBase64Url(payload));\n    } catch {\n      throw new MonoCloudTokenError('Failed to parse JWT Payload');\n    }\n\n    if (\n      claims === null ||\n      typeof claims !== 'object' ||\n      Array.isArray(claims)\n    ) {\n      throw new MonoCloudTokenError('JWT Payload must be a top level object');\n    }\n\n    if ((claims.nonce || nonce) && claims.nonce !== nonce) {\n      throw new MonoCloudTokenError('Nonce mismatch');\n    }\n\n    const current = now() + clockSkew;\n\n    /* v8 ignore else -- @preserve */\n    if (claims.exp !== undefined) {\n      if (typeof claims.exp !== 'number') {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"exp\" (expiration time) claim type'\n        );\n      }\n\n      if (claims.exp <= current - clockTolerance) {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"exp\" (expiration time) claim value, timestamp is <= now()'\n        );\n      }\n    }\n\n    /* v8 ignore else -- @preserve */\n    if (claims.iat !== undefined) {\n      if (typeof claims.iat !== 'number') {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"iat\" (issued at) claim type'\n        );\n      }\n    }\n\n    if (\n      typeof claims.auth_time === 'number' &&\n      typeof maxAge === 'number' &&\n      claims.auth_time + maxAge < current\n    ) {\n      throw new MonoCloudTokenError(\n        'Too much time has elapsed since the last End-User authentication'\n      );\n    }\n\n    if (claims.iss !== this.tenantDomain) {\n      throw new MonoCloudTokenError('Invalid Issuer');\n    }\n\n    if (claims.nbf !== undefined) {\n      if (typeof claims.nbf !== 'number') {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"nbf\" (not before) claim type'\n        );\n      }\n\n      if (claims.nbf > current + clockTolerance) {\n        throw new MonoCloudTokenError(\n          'Unexpected JWT \"nbf\" (not before) claim value, timestamp is > now()'\n        );\n      }\n    }\n\n    const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];\n\n    if (!audience.includes(this.clientId)) {\n      throw new MonoCloudTokenError('Invalid audience claim');\n    }\n\n    return claims;\n  }\n\n  /**\n   * Decodes the payload of a JSON Web Token (JWT) and returns it as an object.\n   *\n   * >Note: THIS METHOD DOES NOT VERIFY JWT TOKENS.\n   *\n   * @param jwt - JWT to decode.\n   *\n   * @returns Decoded payload.\n   *\n   * @throws {@link MonoCloudTokenError} - If decoding fails\n   *\n   */\n  static decodeJwt(jwt: string): IdTokenClaims {\n    try {\n      const [, payload] = jwt.split('.');\n\n      if (!payload?.trim()) {\n        throw new MonoCloudTokenError('JWT does not contain payload');\n      }\n\n      const decoded = decodeBase64Url(payload);\n\n      if (!decoded.startsWith('{')) {\n        throw new MonoCloudTokenError('Payload is not an object');\n      }\n\n      return JSON.parse(decoded) as IdTokenClaims;\n    } catch (e) {\n      if (e instanceof MonoCloudAuthBaseError) {\n        throw e;\n      }\n\n      throw new MonoCloudTokenError(\n        'Could not parse payload. Malformed payload'\n      );\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAOA,IAAa,yBAAb,cAA4C,MAAM;;;;;;;;;;;ACElD,IAAa,mBAAb,cAAsC,uBAAuB;CAO3D,YAAY,OAAe,kBAA2B;AACpD,QAAM,MAAM;AACZ,OAAK,QAAQ;AACb,OAAK,mBAAmB;;;;;;;;;;;;;ACV5B,IAAa,qBAAb,cAAwC,uBAAuB;;;;;;;;;ACF/D,IAAa,sBAAb,cAAyC,uBAAuB;;;;;;;;;ACAhE,IAAa,2BAAb,cAA8C,uBAAuB;;;;ACArE,MAAM,eACJ,QACiE;AACjE,SAAQ,KAAR;EACE,KAAK;EACL,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAQ,MAAM,OAAO,IAAI,MAAM,GAAG;GAAI;EACvD,KAAK;EACL,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAW,MAAM,OAAO,IAAI,MAAM,GAAG;GAAI;EAC1D,KAAK;EACL,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAqB,MAAM,OAAO,IAAI,MAAM,GAAG;GAAI;EACpE,KAAK;EACL,KAAK,QACH,QAAO;GAAE,MAAM;GAAS,YAAY,KAAK,IAAI,MAAM,GAAG;GAAI;EAC5D,KAAK,QACH,QAAO;GAAE,MAAM;GAAS,YAAY;GAAS;EAE/C,QACE,OAAM,IAAI,MAAM,4BAA4B;;;AAIlD,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAAoC,KAAK,MAAtD;EACE,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,8CAA8C;;;AAIpE,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAAoC,KAAK,MAAtD;EACE,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,8CAA8C;;;AAIpE,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAA6B,YAA1C;EACE,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,wCAAwC;;;AAI9D,MAAM,SAAS,QAA2B;AACxC,SAAS,IAAI,UAA+B,KAAK,MAAjD;EACE,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,UACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,kCAAkC;;;AAIxD,MAAM,YAAY,QAA2B;AAC3C,SAAQ,IAAI,UAAU,MAAtB;EACE,KAAK,OACH,QAAO,MAAM,IAAI;EACnB,KAAK,UACH,QAAO,MAAM,IAAI;EACnB,KAAK,oBACH,QAAO,MAAM,IAAI;EACnB,KAAK,QACH,QAAO,MAAM,IAAI;EAEnB,QACE,OAAM,IAAI,MAAM,uCAAuC;;;AAI7D,MAAM,wBAAwB,QAAyB;CACrD,MAAM,EAAE,cAAc;;AAGtB,KACE,OAAO,UAAU,kBAAkB,YACnC,UAAU,gBAAgB,KAE1B,OAAM,IAAI,MAAM,eAAe,UAAU,KAAK,gBAAgB;;AAIlE,MAAM,iBAAiB,QAA2B;CAChD,MAAM,EAAE,cAAc;AACtB,SAAQ,UAAU,YAAlB;EACE,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EAET,QACE,OAAM,IAAI,MAAM,+BAA+B;;;AAIrD,MAAa,eACX,QACqD;AACrD,SAAQ,IAAI,UAAU,MAAtB;EACE,KAAK,OACH,QAAO,EAAE,MAAM,IAAI,UAAU,MAAM;EAErC,KAAK,QACH,QAAO;GACL,MAAM,IAAI,UAAU;GACpB,MAAM,cAAc,IAAI;GACzB;EACH,KAAK;AACH,wBAAqB,IAAI;AACzB,WAAS,IAAI,UAAoC,KAAK,MAAtD;IACE,KAAK;IACL,KAAK;IACL,KAAK,UACH,QAAO;KACL,MAAM,IAAI,UAAU;KACpB,YACE,SACG,IAAI,UAAoC,KAAK,KAAK,MAAM,GAAG,EAC5D,GACD,IAAI;KACR;IAEH,QACE,OAAM,IAAI,MAAM,gCAAgC;;EAGtD,KAAK;AACH,wBAAqB,IAAI;AACzB,UAAO,IAAI,UAAU;;;AAGzB,OAAM,IAAI,MAAM,uCAAuC;;AAGzD,MAAM,0BACJ,QACA,UACA,SACoC;CACpC,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAC5C,QAAO;EACL,KAAKA,oCAAa;EAClB,KAAK;EACL,KAAK,MAAM;EACX,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACN;;AAGH,MAAM,wBAAwB,OAC5B,QACA,UACA,cACA,MACA,SACkB;CAClB,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,cACA,YAAY,aAAa,IAAI,EAC7B,OACA,CAAC,OAAO,CACT;CAED,MAAM,SAAS;EAAE,KAAK,SAAS,IAAI;EAAE,KAAK,aAAa;EAAK;CAC5D,MAAM,UAAU,uBAAuB,QAAQ,UAAU,KAAK;AAE9D,MAAK,IAAI,aAAa,SAAS;AAC/B,MAAK,IACH,yBACA,yDACD;CAED,MAAM,QAAQ,GAAGC,uCAAgBC,2CAAoB,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,GAAGD,uCAAgBC,2CAAoB,KAAK,UAAU,QAAQ,CAAC,CAAC;CAC9I,MAAM,YAAYD,uCAChB,MAAM,OAAO,OAAO,KAClB,YAAY,IAAI,EAChB,KACAC,2CAAoB,MAAM,CAC3B,CACF;AAED,MAAK,IAAI,oBAAoB,GAAG,MAAM,GAAG,YAAY;;AAGvD,MAAa,aAAa,OACxB,UACA,cACA,QACA,QACA,SACA,MACA,qBACkB;AAClB,SAAQ,MAAR;EACE,KAAK,WAAW,yBAAyB,CAAC,CAAC;AAEzC,WAAQ,gBAAgB,SAAS,KAAK,GAAG,SAAS,GAAG,gBAAgB,KAAK;AAC1E;EAGF,KAAK,WAAW,wBAAwB,CAAC,CAAC;AACxC,QAAK,IAAI,aAAa,SAAS;AAC/B,OAAI,OAAO,iBAAiB,SAC1B,MAAK,IAAI,iBAAiB,aAAa;AAEzC;EAGF,KAAK,WAAW,uBACd,CAAC,CAAC,UACF,CAAC,CAAC,SACD,OAAO,iBAAiB,YAAY,cAAc,QAAQ;AAU3D,SAAM,sBACJ,QACA,UAVA,OAAO,iBAAiB,WACpB;IACE,GAAGD,uCAAgBC,2CAAoB,aAAa,CAAC;IACrD,KAAK;IACL,KAAK;IACN,GACD,cAMJ,MACA,oBAAoB,EACrB;AACD;EAGF,KAAK,WAAW,qBACd,OAAO,iBAAiB,YACxB,aAAa,QAAQ,SACrB,CAAC,CAAC,UACF,CAAC,CAAC;AACF,SAAM,sBACJ,QACA,UACA,cACA,MACA,oBAAoB,EACrB;AACD;EAGF,QACE,OAAM,IAAI,MAAM,uCAAuC;;;;;;AC1P7D,MAAM,2BAA2B;AAEjC,MAAM,yBAAyB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAS,uBACP,UACA,UACwE;AACxE,KAAI,SAAS,cAAc,UAAa,SAAS,cAAc,KAC7D,OAAM,IAAI,yBACR,GAAG,SAAmB,gEACvB;;AAIL,MAAM,aAAa,OACjB,OACA,UAAuB,EAAE,KACH;AACtB,KAAI;AACF,SAAO,MAAM,MAAM,OAAO,QAAQ;UAC3B,GAAG;;AAEV,QAAM,IAAI,mBACP,EAAU,WAAW,2BACvB;;;AAIL,MAAM,kBAAkB,OAAgB,QAA8B;AACpE,KAAI;AACF,SAAO,MAAM,IAAI,MAAM;UAChB,GAAG;AACV,QAAM,IAAI;;GAER,yCAA0C,EAAU,UAAU,KAAM,EAAU,YAAY;GAC3F;;;;;;AAOL,IAAa,sBAAb,MAAa,oBAAoB;CAuB/B,YACE,cACA,UACA,SACA;yBAdwB;2BAEE;6BAIE;+BAEE;AAQ9B,mBAAiB;;AAEjB,OAAK,eAAe,GAAG,CAAC,aAAa,WAAW,WAAW,GAAG,aAAa,KAAK,aAAa,SAAS,IAAI,GAAG,aAAa,MAAM,GAAG,GAAG,GAAG;AACzI,OAAK,WAAW;AAChB,OAAK,eAAe,SAAS;AAC7B,OAAK,aAAa,SAAS,oBAAoB;AAC/C,OAAK,0BAA0B,SAAS,2BAA2B;AAEnE,MAAI,SAAS,kBACX,MAAK,oBAAoB,QAAQ;AAGnC,MAAI,SAAS,sBACX,MAAK,wBAAwB,QAAQ;;;;;;;;;;;;;;;CAiBzC,MAAM,iBAAiB,QAA8C;EACnE,MAAM,cAAc,IAAI,iBAAiB;AAEzC,cAAY,IAAI,aAAa,KAAK,SAAS;AAE3C,MAAI,OAAO,YACT,aAAY,IAAI,gBAAgB,OAAO,YAAY;AAGrD,MAAI,OAAO,WACT,aAAY,IAAI,eAAe,OAAO,WAAW;EAGnD,MAAM,SAASC,2CAAoB,OAAO,OAAO,IAAI,EAAE;AAEvD,MAAI,OAAO,SAAS,EAClB,aAAY,IAAI,SAAS,OAAO,KAAK,IAAI,CAAC;AAG5C,MAAI,OAAO,gBAAgB,OAAO,aAAa,SAAS,EACtD,aAAY,IAAI,iBAAiB,OAAO,aAAa;AAGvD,OACG,CAAC,OAAO,gBAAgB,OAAO,aAAa,WAAW,MACxD,CAAC,OAAO,WAER,aAAY,IAAI,iBAAiB,OAAO;AAG1C,MAAI,OAAO,kBACT,aAAY,IAAI,sBAAsB,OAAO,kBAAkB;AAGjE,MAAI,OAAO,UACT,aAAY,IAAI,cAAc,OAAO,UAAU;AAGjD,MAAI,OAAO,QACT,aAAY,IAAI,WAAW,OAAO,QAAQ;AAG5C,MAAI,OAAO,aACT,aAAY,IAAI,iBAAiB,OAAO,aAAa;AAGvD,MAAI,OAAO,aAAa,OAAO,UAAU,SAAS,EAChD,aAAY,IAAI,cAAc,OAAO,UAAU,KAAK,IAAI,CAAC;AAG3D,MAAI,OAAO,MACT,aAAY,IAAI,SAAS,OAAO,MAAM;AAGxC,MAAI,OAAO,UACT,aAAY,IAAI,cAAc,OAAO,UAAU;AAGjD,MAAI,OAAO,QACT,aAAY,IAAI,WAAW,OAAO,QAAQ;AAG5C,MAAI,OAAO,OAAO,WAAW,SAC3B,aAAY,IAAI,WAAW,OAAO,OAAO,UAAU,CAAC;AAGtD,MAAI,OAAO,OACT,aAAY,IAAI,UAAU,OAAO,OAAO;EAG1C,MAAM,WAAWA,2CAAoB,OAAO,SAAS,IAAI,EAAE;AAE3D,MAAI,SAAS,SAAS,EACpB,MAAK,MAAM,KAAK,SACd,aAAY,OAAO,YAAY,EAAE;AAIrC,MAAI,OAAO,eAAe;AACxB,eAAY,IAAI,kBAAkB,OAAO,cAAc;AACvD,eAAY,IACV,yBACA,OAAO,uBAAuB,OAC/B;;AAGH,MAAI,OAAO,MACT,aAAY,IAAI,SAAS,OAAO,MAAM;EAGxC,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,yBAAyB;AAE1D,SAAO,GAAG,SAAS,uBAAuB,GAAG,YAAY,UAAU;;;;;;;;;;;;;;CAerE,MAAM,YAAY,eAAe,OAAgC;AAC/D,MAAI,CAAC,gBAAgB,KAAK,YAAY,KAAK,sBAAsBC,4BAAK,CACpE,QAAO,KAAK;AAGd,OAAK,WAAW;EAEhB,MAAM,WAAW,MAAM,WACrB,GAAG,KAAK,aAAa,mCACtB;AAED,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,0DAA0D,SAAS,SACpE;EAGH,MAAM,WAAW,MAAM,gBAAgC,SAAS;AAEhE,OAAK,WAAW;AAChB,OAAK,sBAAsBA,4BAAK,GAAG,KAAK;AAExC,SAAO;;;;;;;;;;;;;;CAeT,MAAM,QAAQ,eAAe,OAAsB;AACjD,MAAI,CAAC,gBAAgB,KAAK,QAAQ,KAAK,kBAAkBA,4BAAK,CAC5D,QAAO,KAAK;AAGd,OAAK,OAAO;EAEZ,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,WAAW;EAE5C,MAAM,WAAW,MAAM,WAAW,SAAS,SAAS;AAEpD,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,sDAAsD,SAAS,SAChE;EAEH,MAAM,OAAO,MAAM,gBAAsB,SAAS;AAElD,OAAK,OAAO;AACZ,OAAK,kBAAkBA,4BAAK,GAAG,KAAK;AAEpC,SAAO;;;;;;;;;;;;;;;CAgBT,MAAM,2BACJ,QACsB;EACtB,MAAM,OAAO,IAAI,iBAAiB;AAElC,OAAK,IAAI,aAAa,KAAK,SAAS;AAEpC,MAAI,OAAO,YACT,MAAK,IAAI,gBAAgB,OAAO,YAAY;EAG9C,MAAM,SAASD,2CAAoB,OAAO,OAAO,IAAI,EAAE;AAEvD,MAAI,OAAO,SAAS,EAClB,MAAK,IAAI,SAAS,OAAO,KAAK,IAAI,CAAC;AAGrC,MAAI,OAAO,gBAAgB,OAAO,aAAa,SAAS,EACtD,MAAK,IAAI,iBAAiB,OAAO,aAAa;MAE9C,MAAK,IAAI,iBAAiB,OAAO;AAGnC,MAAI,OAAO,kBACT,MAAK,IAAI,sBAAsB,OAAO,kBAAkB;AAG1D,MAAI,OAAO,UACT,MAAK,IAAI,cAAc,OAAO,UAAU;AAG1C,MAAI,OAAO,QACT,MAAK,IAAI,WAAW,OAAO,QAAQ;AAGrC,MAAI,OAAO,aACT,MAAK,IAAI,iBAAiB,OAAO,aAAa;AAGhD,MAAI,OAAO,aAAa,OAAO,UAAU,SAAS,EAChD,MAAK,IAAI,cAAc,OAAO,UAAU,KAAK,IAAI,CAAC;AAGpD,MAAI,OAAO,MACT,MAAK,IAAI,SAAS,OAAO,MAAM;AAGjC,MAAI,OAAO,UACT,MAAK,IAAI,cAAc,OAAO,UAAU;AAG1C,MAAI,OAAO,QACT,MAAK,IAAI,WAAW,OAAO,QAAQ;AAGrC,MAAI,OAAO,OAAO,WAAW,SAC3B,MAAK,IAAI,WAAW,OAAO,OAAO,UAAU,CAAC;AAG/C,MAAI,OAAO,OACT,MAAK,IAAI,UAAU,OAAO,OAAO;EAGnC,MAAM,WAAWA,2CAAoB,OAAO,SAAS,IAAI,EAAE;AAE3D,MAAI,SAAS,SAAS,EACpB,MAAK,MAAM,KAAK,SACd,MAAK,OAAO,YAAY,EAAE;AAI9B,MAAI,OAAO,eAAe;AACxB,QAAK,IAAI,kBAAkB,OAAO,cAAc;AAChD,QAAK,IAAI,yBAAyB,OAAO,uBAAuB,OAAO;;AAGzE,MAAI,OAAO,MACT,MAAK,IAAI,SAAS,OAAO,MAAM;EAGjC,MAAM,UAAU;GACd,gBAAgB;GAChB,QAAQ;GACT;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,wCAAwC;EAEzE,MAAM,WAAW,MAAM,WACrB,SAAS,uCACT;GACE,MAAM,KAAK,UAAU;GACrB,QAAQ;GACR;GACD,CACF;AAED,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,sBAC3B,kBAAkB,qBAChB,sCACH;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,gFAAgF,SAAS,SAC1F;AAGH,SAAO,MAAM,gBAA6B,SAAS;;;;;;;;;;;;;;;;;;;CAoBrD,MAAM,SAAS,aAAgD;AAC7D,MAAI,CAAC,YAAY,MAAM,CAAC,OACtB,OAAM,IAAI,yBACR,iDACD;EAGH,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,oBAAoB;EAErD,MAAM,WAAW,MAAM,WAAW,SAAS,mBAAmB;GAC5D,QAAQ;GACR,SAAS,EACP,eAAe,UAAU,eAC1B;GACF,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,SAAS,QAAQ,IAAI,mBAAmB;AAElE,OAAI,mBAAmB;IACrB,MAAM,aAAa,kBAAkB,KAAK,kBAAkB;IAC5D,MAAM,QAAQ,aAAa,WAAW,KAAK;IAE3C,MAAM,iBAAiB,8BAA8B,KACnD,kBACD;AAMD,UAAM,IAAI,iBAAiB,OAJF,iBACrB,eAAe,KACf,gCAE+C;;;AAIvD,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,0DAA0D,SAAS,SACpE;AAGH,SAAO,MAAM,gBAAkC,SAAS;;;;;;;;;;;;;;;CAgB1D,MAAM,cAAc,QAA+C;EACjE,MAAM,cAAc,IAAI,iBAAiB;AAEzC,cAAY,IAAI,aAAa,KAAK,SAAS;AAE3C,MAAI,OAAO,QACT,aAAY,IAAI,iBAAiB,OAAO,QAAQ;AAGlD,MAAI,OAAO,uBAAuB;AAChC,eAAY,IAAI,4BAA4B,OAAO,sBAAsB;AAEzE,OAAI,OAAO,MACT,aAAY,IAAI,SAAS,OAAO,MAAM;;EAI1C,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,uBAAuB;AAExD,SAAO,GAAG,SAAS,qBAAqB,GAAG,YAAY,UAAU;;;;;;;;;;;;;;;;;;;CAoBnE,MAAM,0BACJ,MACA,aACA,cACA,UACiB;EACjB,MAAM,OAAO,IAAI,iBAAiB;AAElC,OAAK,IAAI,cAAc,qBAAqB;AAC5C,OAAK,IAAI,QAAQ,KAAK;AACtB,OAAK,IAAI,gBAAgB,YAAY;AAErC,MAAI,aACF,MAAK,IAAI,iBAAiB,aAAa;EAGzC,MAAM,YAAYA,2CAAoB,SAAS,IAAI,EAAE;AAErD,MAAI,UAAU,SAAS,EACrB,MAAK,MAAM,KAAK,UACd,MAAK,OAAO,YAAY,EAAE;EAI9B,MAAM,UAAU;GACd,gBAAgB;GAChB,QAAQ;GACT;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,iBAAiB;EAElD,MAAM,WAAW,MAAM,WAAW,SAAS,gBAAgB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU;GACrB;GACD,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,qBAC3B,kBAAkB,qBAAqB,kCACxC;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,+DAA+D,SAAS,SACzE;AAGH,SAAO,MAAM,gBAAwB,SAAS;;;;;;;;;;;;;;;;;CAkBhD,MAAM,aACJ,cACA,SACiB;EACjB,MAAM,OAAO,IAAI,iBAAiB;AAElC,OAAK,IAAI,cAAc,gBAAgB;AACvC,OAAK,IAAI,iBAAiB,aAAa;EAEvC,MAAM,SAASA,2CAAoB,SAAS,OAAO,IAAI,EAAE;AAEzD,MAAI,OAAO,SAAS,EAClB,MAAK,IAAI,SAAS,OAAO,KAAK,IAAI,CAAC;EAGrC,MAAM,WAAWA,2CAAoB,SAAS,SAAS,IAAI,EAAE;AAE7D,MAAI,SAAS,SAAS,EACpB,MAAK,MAAM,KAAK,SACd,MAAK,OAAO,YAAY,EAAE;EAI9B,MAAM,UAAU;GACd,gBAAgB;GAChB,QAAQ;GACT;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,iBAAiB;EAElD,MAAM,WAAW,MAAM,WAAW,SAAS,gBAAgB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU;GACrB;GACD,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,wBAC3B,kBAAkB,qBAAqB,6BACxC;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,uEAAuE,SAAS,SACjF;AAGH,SAAO,MAAM,gBAAwB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BhD,MAAM,aACJ,MACA,aACA,iBACA,UACA,SAC2B;EAC3B,MAAM,SAAS,MAAM,KAAK,0BACxB,MACA,aACA,SAAS,cACT,SACD;EAED,MAAM,wBACJ,OAAO,OAAO,eAAe,WACzBC,4BAAK,GAAG,OAAO,aACf;AAEN,MAAI,CAAC,sBACH,OAAM,IAAI,yBAAyB,sCAAsC;AAG3E,MAAI,CAAC,OAAO,MACV,OAAM,IAAI,yBAAyB,mCAAmC;EAGxE,IAAI;AAEJ,MAAI,SAAS,iBAAiB,OAAO,OAAO,SAAS,SAAS,CAC5D,YAAW,MAAM,KAAK,SAAS,OAAO,aAAa;EAGrD,IAAI,gBAAwC,EAAE;AAE9C,MAAI,OAAO,SACT,KAAI,SAAS,mBAAmB,MAAM;GACpC,MAAM,OAAO,SAAS,QAAS,MAAM,KAAK,SAAS;AAEnD,mBAAgB,MAAM,KAAK,gBACzB,OAAO,UACP,KAAK,MACL,SAAS,oBAAoB,GAC7B,SAAS,yBAAyB,GAClC,SAAS,eACT,SAAS,aACV;QAED,iBAAgB,oBAAoB,UAAU,OAAO,SAAS;AAIlE,GAAC,SAAS,yBAAyB,wBAAwB,SAAQ,MAAK;AAEtE,UAAO,cAAc;IACrB;EAEF,MAAM,UAA4B;GAChC,MAAM;IACJ,GAAG;IACH,GAAI,YAAY,EAAE;IACnB;GACD,SAAS,OAAO;GAChB,cAAc,OAAO;GACrB,kBAAkB;GAClB,cAAc,CACZ;IACE,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB;IACA;IACA;IACD,CACF;GACF;AAED,QAAM,SAAS,oBAAoB,SAAS,eAAe,SAAS;AAEpE,SAAO;;;;;;;;;;;;;;;;;;;;;;;CAwBT,MAAM,gBACJ,aACA,SACA,SAC2B;AAC3B,MAAI,CAAC,YAAY,QAAQ,SAAS,SAAS,CACzC,OAAM,IAAI,yBACR,8CACD;EAGH,MAAM,WAAW,MAAM,KAAK,SAAS,YAAY,YAAY;AAG7D,UAAQ,OAAO;GAAE,GAAG,QAAQ;GAAM,GAAG;GAAU;AAE/C,QAAM,SAAS,oBAAoB,SAAS,QAAW,SAAS;AAEhE,SAAO;;;;;;;;;;;;;;;;;;;;;;;CAwBT,MAAM,eACJ,SACA,SAC2B;AAC3B,MAAI,CAAC,QAAQ,aACX,OAAM,IAAI,yBACR,yCACD;EAGH,MAAM,SAAS,MAAM,KAAK,aACxB,QAAQ,cACR,SAAS,oBACV;EAED,MAAM,wBACJ,OAAO,OAAO,eAAe,WACzBA,4BAAK,GAAG,OAAO,aACf;AAEN,MAAI,CAAC,sBACH,OAAM,IAAI,yBAAyB,sCAAsC;AAG3E,MAAI,CAAC,OAAO,MACV,OAAM,IAAI,yBAAyB,mCAAmC;EAGxE,IAAI;AAEJ,MAAI,SAAS,iBAAiB,OAAO,OAAO,SAAS,SAAS,CAC5D,YAAW,MAAM,KAAK,SAAS,OAAO,aAAa;EAGrD,IAAI,gBAAwC,EAAE;AAE9C,MAAI,OAAO,SACT,KAAI,SAAS,mBAAmB,MAAM;GACpC,MAAM,OAAO,SAAS,QAAS,MAAM,KAAK,SAAS;AAEnD,mBAAgB,MAAM,KAAK,gBACzB,OAAO,UACP,KAAK,MACL,SAAS,oBAAoB,GAC7B,SAAS,yBAAyB,EACnC;QAED,iBAAgB,oBAAoB,UAAU,OAAO,SAAS;AAIlE,GAAC,SAAS,yBAAyB,wBAAwB,SAAQ,MAAK;AAEtE,UAAO,cAAc;IACrB;EAEF,MAAM,WAAW,SAAS,qBAAqB;EAC/C,IAAI,SAAS,SAAS,qBAAqB;AAE3C,MAAI,CAAC,YAAY,CAAC,OAChB,UAAS,QAAQ;EAGnB,MAAM,cAAcC,iCAAU,QAAQ,cAAc,UAAU,OAAO;EAErE,MAAM,OACJ,OAAO,KAAK,cAAc,CAAC,WAAW,KAAK,CAAC,WACxC,QAAQ,OACP;GACC,GAAG,QAAQ;GACX,GAAG;GACH,GAAI,YAAY,EAAE;GACnB;EAEP,MAAM,YACJ,QAAQ,cAAc,QAAO,MAAK,MAAM,YAAY,IAAI,EAAE;AAE5D,YAAU,KAAK;GACb,QAAQ,OAAO;GACf,aAAa,OAAO;GACpB;GACA;GACA,iBAAiB;GAClB,CAAC;EAEF,MAAM,iBAAmC;GACvC,GAAG;GACH;GACA,SAAS,OAAO,YAAY,QAAQ;GACpC,cAAc,OAAO,iBAAiB,QAAQ;GAC9C,cAAc;GACf;AAED,QAAM,SAAS,oBAAoB,gBAAgB,eAAe,SAAS;AAE3E,SAAO;;;;;;;;;;;;;;;;;;CAmBT,MAAM,YAAY,OAAe,WAAmC;AAClE,MAAI,CAAC,MAAM,MAAM,CAAC,OAChB,OAAM,IAAI,yBAAyB,gBAAgB;AAGrD,MACE,aACA,cAAc,kBACd,cAAc,gBAEd,OAAM,IAAI,yBACR,2DACD;EAGH,MAAM,OAAO,IAAI,iBAAiB;AAClC,OAAK,IAAI,SAAS,MAAM;AACxB,MAAI,UACF,MAAK,IAAI,mBAAmB,UAAU;EAGxC,MAAM,UAAU,EACd,gBAAgB,qCACjB;AAED,QAAM,WACJ,KAAK,UACL,KAAK,cACL,KAAK,YACL,KAAK,cACL,SACA,MACA,yBACD;EAED,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,yBAAuB,UAAU,sBAAsB;EAEvD,MAAM,WAAW,MAAM,WAAW,SAAS,qBAAqB;GAC9D,QAAQ;GACR,MAAM,KAAK,UAAU;GACrB;GACD,CAAC;AAEF,MAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB,MAAM,gBAAgB,SAAS;AAEzD,SAAM,IAAI,iBACR,kBAAkB,SAAS,qBAC3B,kBAAkB,qBAAqB,0BACxC;;AAGH,MAAI,SAAS,WAAW,IACtB,OAAM,IAAI,mBACR,sEAAsE,SAAS,SAChF;;;;;;;;;;;;;;;;;CAmBL,MAAM,gBACJ,SACA,MACA,WACA,gBACA,QACA,OACwB;AACxB,MAAI,OAAO,YAAY,YAAY,QAAQ,MAAM,CAAC,WAAW,EAC3D,OAAM,IAAI,oBACR,4CACD;EAGH,MAAM,EACJ,GAAG,iBACH,GAAG,SACH,GAAG,kBACH,WACE,QAAQ,MAAM,IAAI;AAEtB,MAAI,WAAW,EACb,OAAM,IAAI,oBACR,qDACD;EAGH,IAAI;AACJ,MAAI;AACF,YAAS,KAAK,MAAMC,uCAAgB,gBAAgB,CAAC;UAC/C;AACN,SAAM,IAAI,oBAAoB,6BAA6B;;AAG7D,MACE,WAAW,QACX,OAAO,WAAW,YAClB,MAAM,QAAQ,OAAO,CAErB,OAAM,IAAI,oBAAoB,wCAAwC;AAGxE,MAAI,KAAK,4BAA4B,OAAO,IAC1C,OAAM,IAAI,oBAAoB,sBAAsB;AAGtD,MAAI,OAAO,SAAS,OAClB,OAAM,IAAI,oBAAoB,2CAAyC;EAGzE,MAAM,SAASA,uCAAgB,iBAAiB;EAEhD,MAAM,YAAY,IAAI,WAAW,OAAO,OAAO;AAE/C,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,IACjC,WAAU,KAAK,OAAO,WAAW,EAAE;EAGrC,MAAM,MAAM,MAAMC,qDAA8B,MAAM,OAAO;EAE7D,MAAM,QAAQ,GAAG,gBAAgB,GAAG;AASpC,MAAI,CAPa,MAAM,OAAO,OAAO,OACnC,YAAY,IAAI,EAChB,KACA,WACAC,2CAAoB,MAAM,CAC3B,CAGC,OAAM,IAAI,oBAAoB,oCAAoC;EAGpE,IAAI;AAEJ,MAAI;AACF,YAAS,KAAK,MAAMF,uCAAgB,QAAQ,CAAC;UACvC;AACN,SAAM,IAAI,oBAAoB,8BAA8B;;AAG9D,MACE,WAAW,QACX,OAAO,WAAW,YAClB,MAAM,QAAQ,OAAO,CAErB,OAAM,IAAI,oBAAoB,yCAAyC;AAGzE,OAAK,OAAO,SAAS,UAAU,OAAO,UAAU,MAC9C,OAAM,IAAI,oBAAoB,iBAAiB;EAGjD,MAAM,UAAUF,4BAAK,GAAG;;AAGxB,MAAI,OAAO,QAAQ,QAAW;AAC5B,OAAI,OAAO,OAAO,QAAQ,SACxB,OAAM,IAAI,oBACR,sDACD;AAGH,OAAI,OAAO,OAAO,UAAU,eAC1B,OAAM,IAAI,oBACR,8EACD;;;AAKL,MAAI,OAAO,QAAQ,QACjB;OAAI,OAAO,OAAO,QAAQ,SACxB,OAAM,IAAI,oBACR,gDACD;;AAIL,MACE,OAAO,OAAO,cAAc,YAC5B,OAAO,WAAW,YAClB,OAAO,YAAY,SAAS,QAE5B,OAAM,IAAI,oBACR,mEACD;AAGH,MAAI,OAAO,QAAQ,KAAK,aACtB,OAAM,IAAI,oBAAoB,iBAAiB;AAGjD,MAAI,OAAO,QAAQ,QAAW;AAC5B,OAAI,OAAO,OAAO,QAAQ,SACxB,OAAM,IAAI,oBACR,iDACD;AAGH,OAAI,OAAO,MAAM,UAAU,eACzB,OAAM,IAAI,oBACR,wEACD;;AAML,MAAI,EAFa,MAAM,QAAQ,OAAO,IAAI,GAAG,OAAO,MAAM,CAAC,OAAO,IAAI,EAExD,SAAS,KAAK,SAAS,CACnC,OAAM,IAAI,oBAAoB,yBAAyB;AAGzD,SAAO;;;;;;;;;;;;;;CAeT,OAAO,UAAU,KAA4B;AAC3C,MAAI;GACF,MAAM,GAAG,WAAW,IAAI,MAAM,IAAI;AAElC,OAAI,CAAC,SAAS,MAAM,CAClB,OAAM,IAAI,oBAAoB,+BAA+B;GAG/D,MAAM,UAAUE,uCAAgB,QAAQ;AAExC,OAAI,CAAC,QAAQ,WAAW,IAAI,CAC1B,OAAM,IAAI,oBAAoB,2BAA2B;AAG3D,UAAO,KAAK,MAAM,QAAQ;WACnB,GAAG;AACV,OAAI,aAAa,uBACf,OAAM;AAGR,SAAM,IAAI,oBACR,6CACD"}