@monocloud/auth-node-core 0.0.0-canary-20251223204113

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["options: MonoCloudOptionsBase","uuid","cookieValue: SessionCookieValue","session: MonoCloudSession","session","options: MonoCloudOptionsBase","decryptedResult: MonoCloudState","valid: boolean","sessionSchema: Joi.ObjectSchema<MonoCloudSessionOptionsBase>","stateSchema: Joi.ObjectSchema<MonoCloudStateOptions>","authParamSchema: Joi.ObjectSchema<AuthorizationParams>","optionalAuthParamSchema: Joi.ObjectSchema<AuthorizationParams>","routesSchema: Joi.ObjectSchema<MonoCloudRoutes>","indicatorOptionsSchema: Joi.ObjectSchema<Indicator>","optionsSchema: Joi.ObjectSchema<MonoCloudOptionsBase>","signInOptionsSchema: Joi.ObjectSchema<SignInOptions>","callbackOptionsSchema: Joi.ObjectSchema<CallbackOptions>","userInfoOptionsSchema: Joi.ObjectSchema<UserInfoOptions>","signOutOptionsSchema: Joi.ObjectSchema<SignOutOptions>","getTokensOptionsSchema: Joi.ObjectSchema<GetTokensOptions>","opt: MonoCloudOptionsBase","requiredEnv: Record<string, string>","MonoCloudValidationError","MonoCloudOidcClient","appState: ApplicationState","MonoCloudValidationError","params: AuthorizationParams","prompt: string | undefined","monoCloudState: MonoCloudState"],"sources":["../src/monocloud-session-service.ts","../src/monocloud-state-service.ts","../src/options/defaults.ts","../src/options/validation.ts","../src/options/get-options.ts","../src/monocloud-node-core-client.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid';\nimport { serialize } from 'cookie';\nimport { decrypt, encrypt } from '@monocloud/auth-core/utils';\nimport type { MonoCloudSession, MonoCloudUser } from '@monocloud/auth-core';\nimport { now } from '@monocloud/auth-core/internal';\nimport { MonoCloudOptionsBase } from './types';\nimport {\n  CookieOptions,\n  IMonoCloudCookieRequest,\n  IMonoCloudCookieResponse,\n  SessionCookieValue,\n} from './types/internal';\n\nconst CHUNK_BYTE_SIZE = 4090;\n\nexport class MonoCloudSessionService {\n  constructor(private readonly options: MonoCloudOptionsBase) {}\n\n  async setSession(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse,\n    session: MonoCloudSession\n  ): Promise<string> {\n    // Generate a session Id\n    const key = uuid();\n\n    // Set the issued and updated time\n    const iat = now();\n    const uat = iat;\n\n    // Calculate the lifetime of the cookie\n    const exp = this.getExpiry(iat, uat);\n\n    // Set the Cookie Value\n    const cookieValue: SessionCookieValue = {\n      key,\n      lifetime: { c: iat, u: uat, e: exp },\n    };\n\n    // Save the Session\n    await this.saveSession(req, res, cookieValue, session);\n\n    // Return the session Id\n    return key;\n  }\n\n  async getSession(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse,\n    shouldResave = true\n  ): Promise<MonoCloudSession | undefined> {\n    // Get the current cookie value\n    const cookieValue = await this.getCookieData(req);\n\n    // Handle no cookie value\n    if (!cookieValue) {\n      await this.deleteAllCookies(req, res);\n      return undefined;\n    }\n\n    // Ensure that the session is valid\n    const isValid = await this.validateSession(req, res, cookieValue);\n\n    // Handle an invalid session\n    if (!isValid) {\n      return undefined;\n    }\n\n    // Get the new expiry for the cookie\n    const uat = now();\n    const exp = this.getExpiry(cookieValue.lifetime.c, uat);\n\n    // if there is no session store\n    if (!this.options.session.store) {\n      const session: MonoCloudSession = { user: {} as MonoCloudUser };\n\n      // ensure that the cookie has a session\n      if (!cookieValue.session) {\n        return undefined;\n      }\n\n      // create a session object\n      Object.assign(session, JSON.parse(JSON.stringify(cookieValue.session)));\n\n      // Resave the session if the new expiry is different from the old one\n      if (shouldResave && exp !== cookieValue.lifetime.e) {\n        await this.saveSession(\n          req,\n          res,\n          {\n            ...cookieValue,\n            lifetime: { c: cookieValue.lifetime.c, u: uat, e: exp },\n          },\n          session\n        );\n      }\n\n      // return the sesison\n      return session;\n    }\n\n    // Get the session from the store\n    const sessionObj = await this.options.session.store.get(cookieValue.key);\n\n    // if there is no session in the store then delete the cookie\n    if (!sessionObj) {\n      await this.deleteAllCookies(req, res);\n      return undefined;\n    }\n\n    // Get the instance of the session\n    const session: MonoCloudSession = { user: {} as MonoCloudUser };\n    Object.assign(session, JSON.parse(JSON.stringify(sessionObj)));\n\n    // Resave the session if the new expiry is different from the old one\n    if (shouldResave && exp !== cookieValue.lifetime.e) {\n      await this.saveSession(\n        req,\n        res,\n        {\n          ...cookieValue,\n          lifetime: { c: cookieValue.lifetime.c, u: uat, e: exp },\n        },\n        session\n      );\n    }\n\n    // return the sesison\n    return session;\n  }\n\n  async updateSession(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse,\n    session: MonoCloudSession\n  ): Promise<boolean> {\n    // Get the current cookie value\n    const cookieValue = await this.getCookieData(req);\n\n    // Handle no cookie value\n    if (!cookieValue) {\n      await this.deleteAllCookies(req, res);\n      return false;\n    }\n\n    // Ensure that the session is valid\n    const isValid = await this.validateSession(req, res, cookieValue);\n\n    // Handle an invalid session\n    if (!isValid) {\n      return false;\n    }\n\n    // Get the new expiry for the cookie\n    const uat = now();\n    const exp = this.getExpiry(cookieValue.lifetime.c, uat);\n\n    // Save the session\n    await this.saveSession(\n      req,\n      res,\n      {\n        ...cookieValue,\n        lifetime: { c: cookieValue.lifetime.c, u: uat, e: exp },\n      },\n      session\n    );\n\n    return true;\n  }\n\n  async removeSession(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse\n  ): Promise<void> {\n    // Get the current cookie value\n    const cookieValue = await this.getCookieData(req);\n\n    // Handle no cookie value\n    if (!cookieValue) {\n      await this.deleteAllCookies(req, res);\n      return;\n    }\n\n    // If session store is present\n    if (this.options.session.store) {\n      // Delete the current session from the store\n      /* v8 ignore else -- @preserve */\n      if (cookieValue.key) {\n        await this.options.session.store.delete(cookieValue.key);\n      }\n    }\n\n    await this.deleteAllCookies(req, res);\n  }\n\n  private async validateSession(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse,\n    cookieValue: SessionCookieValue\n  ): Promise<boolean> {\n    // Get the current time\n    const nowTime = now();\n\n    let isValid = true;\n\n    // Ensure that the expiration has not passed\n    if (cookieValue.lifetime.e && cookieValue.lifetime.e < nowTime) {\n      isValid = false;\n    }\n\n    // If the session is sliding then ensure that the session has not expired based on the last updated time\n    if (\n      this.options.session.sliding &&\n      cookieValue.lifetime.u + this.options.session.duration < nowTime\n    ) {\n      isValid = false;\n    }\n\n    // If the session is sliding then ensure that the session has not crossed the maximum duration allowed\n    if (\n      cookieValue.lifetime.c + this.options.session.maximumDuration <\n      nowTime\n    ) {\n      isValid = false;\n    }\n\n    // return Is Valid if all ok\n    if (isValid) {\n      return true;\n    }\n\n    // If there is a session store then delete the session from the store\n    if (this.options.session.store) {\n      await this.options.session.store.delete(cookieValue.key);\n    }\n\n    await this.deleteAllCookies(req, res);\n\n    return false;\n  }\n\n  private async saveSession(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse,\n    cookieValue: SessionCookieValue,\n    session: MonoCloudSession\n  ): Promise<void> {\n    const cookies = new Set((await this.getRequestCookie(req))?.keys ?? []);\n\n    // If no session store is present\n    if (!this.options.session.store) {\n      // Set the cookie session Value\n      // eslint-disable-next-line no-param-reassign\n      cookieValue.session = session;\n    }\n\n    // If session store is present\n    if (this.options.session.store) {\n      // Get the cookie containing the session Id\n      const cookieData = await this.getCookieData(req);\n\n      // Delete the current session from the store\n      if (cookieData?.key) {\n        await this.options.session.store.delete(cookieData.key);\n      }\n\n      // Ensure there is no session in the cookie value\n      // eslint-disable-next-line no-param-reassign\n      cookieValue.session = undefined;\n\n      // Set the new session in the store\n      await this.options.session.store.set(\n        cookieValue.key,\n        session,\n        cookieValue.lifetime\n      );\n    }\n\n    // Encrypt the cookie value\n    const encryptedData = await encrypt(\n      JSON.stringify(cookieValue),\n      this.options.cookieSecret\n    );\n\n    const cookieExpiry = cookieValue.lifetime.e\n      ? new Date(cookieValue.lifetime.e * 1000)\n      : undefined;\n\n    const cookieOptions = this.getCookieOptions(cookieExpiry);\n    const chunkSize =\n      CHUNK_BYTE_SIZE -\n      serialize(`${this.options.session.cookie.name}.0`, '', cookieOptions)\n        .length;\n\n    // Calculate the number of cookie chunks\n    const chunks = Math.ceil(encryptedData.length / chunkSize);\n\n    for (let i = 0; i < chunks; i += 1) {\n      const encryptedChunk = encryptedData.slice(\n        i * chunkSize,\n        (i + 1) * chunkSize\n      );\n\n      const cookieName =\n        chunks === 1\n          ? this.options.session.cookie.name\n          : `${this.options.session.cookie.name}.${i}`;\n\n      await res.setCookie(\n        cookieName,\n        encryptedChunk,\n        this.getCookieOptions(cookieExpiry)\n      );\n\n      cookies.delete(cookieName);\n    }\n\n    // Delete all cookies which are not required anymore\n    for (const cookie of cookies) {\n      await res.setCookie(cookie, '', this.getCookieOptions(new Date(0)));\n    }\n  }\n\n  private async getCookieData(\n    req: IMonoCloudCookieRequest\n  ): Promise<SessionCookieValue | undefined> {\n    // Get all the cookies\n    const cookieData = await this.getRequestCookie(req);\n\n    // Handle no cookies\n    if (!cookieData?.value) {\n      return undefined;\n    }\n\n    // Decrypt the cookie\n    const data = await decrypt(cookieData.value, this.options.cookieSecret);\n\n    // Handle no data\n    if (!data) {\n      return undefined;\n    }\n\n    // Return the parsed session cookie value\n    return JSON.parse(data);\n  }\n\n  private async getRequestCookie(\n    req: IMonoCloudCookieRequest\n  ): Promise<{ keys: string[]; value: string } | undefined> {\n    // Get all the cookies\n    const cookies = await req.getAllCookies();\n\n    // Handle no cookies\n    if (!cookies.size) {\n      return undefined;\n    }\n\n    // If a cookie exists without chunks then return it\n    const val = cookies.get(this.options.session.cookie.name);\n\n    if (val) {\n      return { keys: [this.options.session.cookie.name], value: val };\n    }\n\n    // Filter out the cookies and only keep the relevant ones\n    const cookieValues = Array.from(cookies.entries())\n      .filter(([cookie]) =>\n        cookie.startsWith(`${this.options.session.cookie.name}.`)\n      )\n      .map(([cookie, value]) => ({\n        // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing\n        key: parseInt(cookie.split('.').pop() || '0', 10),\n        value,\n      }))\n      .sort((a, b) => a.key - b.key);\n\n    // Sort the cookies by chunk numbers\n    const cookieValue = cookieValues.map(({ value }) => value).join('');\n\n    // Handle empty cookie value\n    if (!cookieValue) {\n      return undefined;\n    }\n\n    // Return the cookie names and values\n    return {\n      keys: cookieValues.map(\n        ({ key }) => `${this.options.session.cookie.name}.${key}`\n      ),\n      value: cookieValue,\n    };\n  }\n\n  private getExpiry(iat: number, uat: number): number | undefined {\n    // Return null if session is not persistent\n    if (!this.options.session.cookie.persistent) {\n      return undefined;\n    }\n\n    // If session is not sliding the return the absolute expiration\n    if (!this.options.session.sliding) {\n      return Math.floor(iat + this.options.session.duration);\n    }\n\n    // If session is sliding then return the lesser of the next extended time or the maximum duration\n    return Math.floor(\n      Math.min(\n        uat + this.options.session.duration,\n        iat + this.options.session.maximumDuration\n      )\n    );\n  }\n\n  private getCookieOptions(exp?: Date): CookieOptions {\n    return {\n      domain: this.options.session.cookie.domain,\n      httpOnly: this.options.session.cookie.httpOnly,\n      sameSite: this.options.session.cookie.sameSite,\n      secure: this.options.session.cookie.secure,\n      path: this.options.session.cookie.path,\n      expires: exp,\n    };\n  }\n\n  private async deleteAllCookies(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse\n  ): Promise<void> {\n    const reqCookie = await this.getRequestCookie(req);\n\n    const cookies = reqCookie?.keys?.filter(x =>\n      x.startsWith(this.options.session.cookie.name)\n    );\n\n    for (const cookie of cookies ?? []) {\n      await res.setCookie(cookie, '', this.getCookieOptions(new Date(0)));\n    }\n  }\n}\n","import { decryptAuthState, encryptAuthState } from '@monocloud/auth-core/utils';\nimport { MonoCloudOptionsBase, MonoCloudState, SameSiteValues } from './types';\nimport {\n  CookieOptions,\n  IMonoCloudCookieRequest,\n  IMonoCloudCookieResponse,\n} from './types/internal';\n\nexport class MonoCloudStateService {\n  constructor(private readonly options: MonoCloudOptionsBase) {}\n\n  async setState(\n    res: IMonoCloudCookieResponse,\n    state: MonoCloudState,\n    overrideSameSite?: SameSiteValues\n  ): Promise<void> {\n    await res.setCookie(\n      this.options.state.cookie.name,\n      await encryptAuthState(state, this.options.cookieSecret),\n      this.getCookieOptions(overrideSameSite)\n    );\n  }\n\n  async getState(\n    req: IMonoCloudCookieRequest,\n    res: IMonoCloudCookieResponse\n  ): Promise<MonoCloudState | undefined> {\n    // Get the cookie\n    const cookie = await req.getCookie(this.options.state.cookie.name);\n\n    // Handle no cookie\n    if (!cookie) {\n      return undefined;\n    }\n\n    let decryptedResult: MonoCloudState;\n\n    try {\n      // Decrypt the cookie value\n      decryptedResult = await decryptAuthState(\n        cookie,\n        this.options.cookieSecret\n      );\n    } catch {\n      return undefined;\n    }\n\n    // Remove the cookie\n    await res.setCookie(this.options.state.cookie.name, '', {\n      ...this.getCookieOptions(),\n      expires: new Date(0),\n    });\n\n    // return the state\n    return decryptedResult;\n  }\n\n  private getCookieOptions(sameSite?: SameSiteValues): CookieOptions {\n    return {\n      domain: this.options.state.cookie.domain,\n      httpOnly: this.options.state.cookie.httpOnly,\n      sameSite: sameSite ?? this.options.state.cookie.sameSite,\n      secure: this.options.state.cookie.secure,\n      path: this.options.state.cookie.path,\n    };\n  }\n}\n","export const DEFAULT_OPTIONS = {\n  routes: {\n    callback: '/api/auth/callback',\n    backChannelLogout: '/api/auth/backchannel-logout',\n    signIn: '/api/auth/signin',\n    signOut: '/api/auth/signout',\n    userInfo: '/api/auth/userinfo',\n  },\n  clockSkew: 60,\n  responseTimeout: 10000,\n  usePar: false,\n  userInfo: true,\n  refetchUserInfo: false,\n  federatedSignOut: true,\n  defaultAuthParams: {\n    scopes: 'openid profile email',\n    responseType: 'code',\n  },\n  session: {\n    cookie: {\n      httpOnly: true,\n      name: 'session',\n      path: '/',\n      sameSite: 'lax',\n      persistent: true,\n    },\n    sliding: false,\n    duration: 24 * 60 * 60,\n    maximumDuration: 7 * 24 * 60 * 60,\n  },\n  state: {\n    cookie: {\n      httpOnly: true,\n      name: 'state',\n      path: '/',\n      sameSite: 'lax',\n      persistent: false,\n    },\n  },\n  idTokenSigningAlg: 'RS256',\n  filteredIdTokenClaims: [\n    'iss',\n    'exp',\n    'nbf',\n    'aud',\n    'nonce',\n    'iat',\n    'auth_time',\n    'c_hash',\n    'at_hash',\n    's_hash',\n  ],\n  debugger: 'node-auth-core',\n  userAgent: 'node-auth-core',\n};\n","import Joi from 'joi';\nimport type { AuthorizationParams } from '@monocloud/auth-core';\nimport {\n  CallbackOptions,\n  GetTokensOptions,\n  Indicator,\n  MonoCloudOptionsBase,\n  MonoCloudRoutes,\n  MonoCloudSessionOptionsBase,\n  MonoCloudStateOptions,\n  SignInOptions,\n  SignOutOptions,\n  UserInfoOptions,\n} from '../types';\n\nconst stringRequired = Joi.string().required();\nconst stringOptional = Joi.string().optional();\nconst boolRequired = Joi.boolean().required();\nconst boolOptional = Joi.boolean().optional();\nconst numRequired = Joi.number().required();\nconst numOptional = Joi.number().optional();\nconst objectOptional = Joi.object().optional();\nconst funcOptional = Joi.function().optional();\n\nconst sessionCookieSchema = Joi.object({\n  name: stringRequired,\n  path: stringRequired.uri({ relativeOnly: true }),\n  domain: stringOptional,\n  httpOnly: boolRequired,\n  secure: boolRequired.when(Joi.ref('/appUrl'), {\n    is: Joi.string().pattern(/^https:/i),\n    then: Joi.valid(true).messages({\n      'any.only':\n        'Cookie must be set to secure when app url protocol is https.',\n    }),\n    otherwise: Joi.valid(false),\n  }),\n  sameSite: stringRequired.valid('strict', 'lax', 'none'),\n  persistent: boolRequired,\n}).required();\n\nconst resourceSchema = stringRequired.custom((value, helpers) => {\n  let valid: boolean;\n  try {\n    const url = new URL(value);\n    valid = url.searchParams.size === 0 && url.hash.length === 0;\n  } catch {\n    valid = false;\n  }\n\n  if (!valid) {\n    return helpers.message({\n      custom: 'Resource must be a valid URL without query or hash parameters',\n    });\n  }\n\n  return value;\n});\n\nexport const resourceValidationSchema = Joi.string()\n  .custom((value, helpers) => {\n    const parts = value\n      .split(/\\s+/)\n      .map((x: string) => x.trim())\n      .filter(Boolean);\n\n    if (parts.length === 0) {\n      return helpers.message({ custom: 'Resource must not be empty' });\n    }\n\n    for (const part of parts) {\n      const { error } = resourceSchema.validate(part);\n      if (error) {\n        return helpers.message({\n          custom: `Invalid resource \"${part}\": ${error.message}`,\n        });\n      }\n    }\n\n    return parts.join(' ');\n  })\n  .messages({\n    'string.base': 'Resource must be a space-separated string of URLs',\n  });\n\nconst sessionSchema: Joi.ObjectSchema<MonoCloudSessionOptionsBase> = Joi.object(\n  {\n    cookie: sessionCookieSchema,\n    sliding: boolRequired,\n    duration: numRequired.min(1),\n    maximumDuration: numRequired.min(1).greater(Joi.ref('duration')),\n    store: objectOptional,\n  }\n).required();\n\nconst stateSchema: Joi.ObjectSchema<MonoCloudStateOptions> = Joi.object({\n  cookie: sessionCookieSchema,\n}).required();\n\nconst scopesSchema = stringRequired\n  .custom((value, helpers) => {\n    const scopes = value\n      .split(/\\s+/)\n      .map((x: string) => x.trim())\n      .filter(Boolean);\n\n    if (scopes.length === 0) {\n      return helpers.message({\n        custom: 'Scopes must be a space-separated string',\n      });\n    }\n\n    if (!scopes.includes('openid')) {\n      return helpers.message({ custom: 'Scope must contain openid' });\n    }\n\n    return scopes.join(' ');\n  })\n  .messages({ 'string.base': 'Scopes must be a space-separated string' });\n\nconst authParamSchema: Joi.ObjectSchema<AuthorizationParams> = Joi.object({\n  scopes: scopesSchema,\n  responseType: stringOptional.valid('code').optional(),\n  responseMode: stringOptional.valid('query', 'form_post'),\n  resource: resourceValidationSchema.optional(),\n})\n  .unknown(true)\n  .required();\n\nconst optionalAuthParamSchema: Joi.ObjectSchema<AuthorizationParams> =\n  Joi.object({\n    scopes: scopesSchema,\n    responseType: stringOptional.valid('code').optional(),\n    responseMode: stringOptional.valid('query', 'form_post'),\n  })\n    .unknown(true)\n    .optional();\n\nconst routesSchema: Joi.ObjectSchema<MonoCloudRoutes> = Joi.object({\n  callback: stringRequired.uri({ relativeOnly: true }),\n  backChannelLogout: stringRequired.uri({ relativeOnly: true }),\n  signIn: stringRequired.uri({ relativeOnly: true }),\n  signOut: stringRequired.uri({ relativeOnly: true }),\n  userInfo: stringRequired.uri({ relativeOnly: true }),\n}).required();\n\nexport const scopesValidationSchema = stringRequired\n  .custom((value, helpers) => {\n    const scopes = value\n      .split(/\\s+/)\n      .map((x: string) => x.trim())\n      .filter(Boolean);\n\n    if (scopes.length === 0) {\n      return helpers.message({\n        custom: 'Scopes must be a space-separated string',\n      });\n    }\n\n    return scopes.join(' ');\n  })\n  .messages({ 'string.base': 'Scopes must be a space-separated string' });\n\nexport const indicatorOptionsSchema: Joi.ObjectSchema<Indicator> = Joi.object({\n  resource: resourceValidationSchema,\n  scopes: scopesValidationSchema.optional(),\n});\n\nexport const optionsSchema: Joi.ObjectSchema<MonoCloudOptionsBase> = Joi.object(\n  {\n    clientId: stringRequired,\n    clientSecret: stringRequired,\n    tenantDomain: stringRequired.uri(),\n    cookieSecret: stringRequired.min(8),\n    appUrl: stringRequired.uri(),\n    routes: routesSchema,\n    clockSkew: numRequired,\n    responseTimeout: numRequired.min(1000),\n    usePar: boolRequired,\n    postLogoutRedirectUri: stringOptional.uri({ allowRelative: true }),\n    federatedSignOut: boolRequired,\n    userInfo: boolRequired,\n    refetchUserInfo: boolRequired,\n    defaultAuthParams: authParamSchema,\n    resources: Joi.array<Indicator>().items(indicatorOptionsSchema).optional(),\n    session: sessionSchema,\n    state: stateSchema,\n    idTokenSigningAlg: Joi.string().valid(\n      'RS256',\n      'RS384',\n      'RS512',\n      'PS256',\n      'PS384',\n      'PS512',\n      'ES256',\n      'ES384',\n      'ES512'\n    ),\n    filteredIdTokenClaims: Joi.array<string>().items(stringRequired),\n    debugger: stringRequired,\n    userAgent: stringRequired,\n    jwksCacheDuration: numOptional,\n    metadataCacheDuration: numOptional,\n    onBackChannelLogout: funcOptional,\n    onSetApplicationState: funcOptional,\n    onSessionCreating: funcOptional,\n  }\n);\n\nexport const signInOptionsSchema: Joi.ObjectSchema<SignInOptions> = Joi.object({\n  returnUrl: stringOptional.uri({ allowRelative: true }),\n  register: boolOptional,\n  authParams: optionalAuthParamSchema,\n  onError: funcOptional,\n});\n\nexport const callbackOptionsSchema: Joi.ObjectSchema<CallbackOptions> =\n  Joi.object({\n    userInfo: boolOptional,\n    redirectUri: stringOptional.uri(),\n    onError: funcOptional,\n  });\n\nexport const userInfoOptionsSchema: Joi.ObjectSchema<UserInfoOptions> =\n  Joi.object({\n    refresh: boolOptional,\n    onError: funcOptional,\n  });\n\nexport const signOutOptionsSchema: Joi.ObjectSchema<SignOutOptions> =\n  Joi.object({\n    postLogoutRedirectUri: stringOptional.uri({ allowRelative: true }),\n    idToken: stringOptional,\n    state: stringOptional,\n    federatedSignOut: boolOptional,\n    onError: funcOptional,\n  });\n\nexport const getTokensOptionsSchema: Joi.ObjectSchema<GetTokensOptions> =\n  Joi.object({\n    forceRefresh: boolOptional,\n    refetchUserInfo: boolOptional,\n    resource: resourceValidationSchema.optional(),\n    scopes: scopesValidationSchema.optional(),\n  });\n","/* eslint-disable prefer-destructuring */\n/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport {\n  getBoolean,\n  getNumber,\n  removeTrailingSlash,\n} from '@monocloud/auth-core/internal';\nimport {\n  MonoCloudOptions,\n  MonoCloudOptionsBase,\n  SameSiteValues,\n  SecurityAlgorithms,\n} from '../types';\nimport { DEFAULT_OPTIONS } from './defaults';\nimport { optionsSchema } from './validation';\nimport { MonoCloudValidationError } from '@monocloud/auth-core';\n\nexport const getOptions = (\n  options?: MonoCloudOptions,\n  throwOnError = true\n): MonoCloudOptionsBase => {\n  const MONOCLOUD_AUTH_CLIENT_ID = process.env.MONOCLOUD_AUTH_CLIENT_ID;\n  const MONOCLOUD_AUTH_CLIENT_SECRET = process.env.MONOCLOUD_AUTH_CLIENT_SECRET;\n  const MONOCLOUD_AUTH_TENANT_DOMAIN = process.env.MONOCLOUD_AUTH_TENANT_DOMAIN;\n  const MONOCLOUD_AUTH_SCOPES = process.env.MONOCLOUD_AUTH_SCOPES;\n  const MONOCLOUD_AUTH_COOKIE_SECRET = process.env.MONOCLOUD_AUTH_COOKIE_SECRET;\n  const MONOCLOUD_AUTH_APP_URL = process.env.MONOCLOUD_AUTH_APP_URL;\n  const MONOCLOUD_AUTH_CALLBACK_URL = process.env.MONOCLOUD_AUTH_CALLBACK_URL;\n  const MONOCLOUD_AUTH_BACK_CHANNEL_LOGOUT_URL =\n    process.env.MONOCLOUD_AUTH_BACK_CHANNEL_LOGOUT_URL;\n  const MONOCLOUD_AUTH_SIGNIN_URL = process.env.MONOCLOUD_AUTH_SIGNIN_URL;\n  const MONOCLOUD_AUTH_SIGNOUT_URL = process.env.MONOCLOUD_AUTH_SIGNOUT_URL;\n  const MONOCLOUD_AUTH_USER_INFO_URL = process.env.MONOCLOUD_AUTH_USER_INFO_URL;\n  const MONOCLOUD_AUTH_RESOURCE = process.env.MONOCLOUD_AUTH_RESOURCE;\n  const MONOCLOUD_AUTH_CLOCK_SKEW = process.env.MONOCLOUD_AUTH_CLOCK_SKEW;\n  const MONOCLOUD_AUTH_RESPONSE_TIMEOUT =\n    process.env.MONOCLOUD_AUTH_RESPONSE_TIMEOUT;\n  const MONOCLOUD_AUTH_USE_PAR = process.env.MONOCLOUD_AUTH_USE_PAR;\n  const MONOCLOUD_AUTH_POST_LOGOUT_REDIRECT_URI =\n    process.env.MONOCLOUD_AUTH_POST_LOGOUT_REDIRECT_URI;\n  const MONOCLOUD_AUTH_FEDERATED_SIGNOUT =\n    process.env.MONOCLOUD_AUTH_FEDERATED_SIGNOUT;\n  const MONOCLOUD_AUTH_USER_INFO = process.env.MONOCLOUD_AUTH_USER_INFO;\n  const MONOCLOUD_AUTH_REFETCH_USER_INFO =\n    process.env.MONOCLOUD_AUTH_REFETCH_USER_INFO;\n  const MONOCLOUD_AUTH_SESSION_COOKIE_NAME =\n    process.env.MONOCLOUD_AUTH_SESSION_COOKIE_NAME;\n  const MONOCLOUD_AUTH_SESSION_COOKIE_PATH =\n    process.env.MONOCLOUD_AUTH_SESSION_COOKIE_PATH;\n  const MONOCLOUD_AUTH_SESSION_COOKIE_DOMAIN =\n    process.env.MONOCLOUD_AUTH_SESSION_COOKIE_DOMAIN;\n  const MONOCLOUD_AUTH_SESSION_COOKIE_HTTP_ONLY =\n    process.env.MONOCLOUD_AUTH_SESSION_COOKIE_HTTP_ONLY;\n  const MONOCLOUD_AUTH_SESSION_COOKIE_SECURE =\n    process.env.MONOCLOUD_AUTH_SESSION_COOKIE_SECURE;\n  const MONOCLOUD_AUTH_SESSION_COOKIE_SAME_SITE =\n    process.env.MONOCLOUD_AUTH_SESSION_COOKIE_SAME_SITE;\n  const MONOCLOUD_AUTH_SESSION_COOKIE_PERSISTENT =\n    process.env.MONOCLOUD_AUTH_SESSION_COOKIE_PERSISTENT;\n  const MONOCLOUD_AUTH_SESSION_SLIDING =\n    process.env.MONOCLOUD_AUTH_SESSION_SLIDING;\n  const MONOCLOUD_AUTH_SESSION_DURATION =\n    process.env.MONOCLOUD_AUTH_SESSION_DURATION;\n  const MONOCLOUD_AUTH_SESSION_MAX_DURATION =\n    process.env.MONOCLOUD_AUTH_SESSION_MAX_DURATION;\n  const MONOCLOUD_AUTH_STATE_COOKIE_NAME =\n    process.env.MONOCLOUD_AUTH_STATE_COOKIE_NAME;\n  const MONOCLOUD_AUTH_STATE_COOKIE_PATH =\n    process.env.MONOCLOUD_AUTH_STATE_COOKIE_PATH;\n  const MONOCLOUD_AUTH_STATE_COOKIE_DOMAIN =\n    process.env.MONOCLOUD_AUTH_STATE_COOKIE_DOMAIN;\n  const MONOCLOUD_AUTH_STATE_COOKIE_SECURE =\n    process.env.MONOCLOUD_AUTH_STATE_COOKIE_SECURE;\n  const MONOCLOUD_AUTH_STATE_COOKIE_SAME_SITE =\n    process.env.MONOCLOUD_AUTH_STATE_COOKIE_SAME_SITE;\n  const MONOCLOUD_AUTH_STATE_COOKIE_PERSISTENT =\n    process.env.MONOCLOUD_AUTH_STATE_COOKIE_PERSISTENT;\n  const MONOCLOUD_AUTH_ID_TOKEN_SIGNING_ALG =\n    process.env.MONOCLOUD_AUTH_ID_TOKEN_SIGNING_ALG;\n  const MONOCLOUD_AUTH_FILTERED_ID_TOKEN_CLAIMS =\n    process.env.MONOCLOUD_AUTH_FILTERED_ID_TOKEN_CLAIMS;\n  const MONOCLOUD_AUTH_JWKS_CACHE_DURATION =\n    process.env.MONOCLOUD_AUTH_JWKS_CACHE_DURATION;\n  const MONOCLOUD_AUTH_METADATA_CACHE_DURATION =\n    process.env.MONOCLOUD_AUTH_METADATA_CACHE_DURATION;\n\n  const appUrl = options?.appUrl ?? MONOCLOUD_AUTH_APP_URL!;\n\n  const opt: MonoCloudOptionsBase = {\n    clientId: options?.clientId ?? MONOCLOUD_AUTH_CLIENT_ID!,\n    clientSecret: options?.clientSecret ?? MONOCLOUD_AUTH_CLIENT_SECRET,\n    tenantDomain: options?.tenantDomain ?? MONOCLOUD_AUTH_TENANT_DOMAIN!,\n    defaultAuthParams: {\n      ...(options?.defaultAuthParams ?? {}),\n      scopes:\n        options?.defaultAuthParams?.scopes ??\n        MONOCLOUD_AUTH_SCOPES ??\n        DEFAULT_OPTIONS.defaultAuthParams.scopes,\n      responseType:\n        options?.defaultAuthParams?.responseType ??\n        (DEFAULT_OPTIONS.defaultAuthParams.responseType as any),\n      resource: options?.defaultAuthParams?.resource ?? MONOCLOUD_AUTH_RESOURCE,\n    },\n    resources: options?.resources,\n    cookieSecret: options?.cookieSecret ?? MONOCLOUD_AUTH_COOKIE_SECRET!,\n    appUrl: removeTrailingSlash(appUrl),\n    routes: {\n      callback: removeTrailingSlash(\n        options?.routes?.callback ??\n          MONOCLOUD_AUTH_CALLBACK_URL ??\n          DEFAULT_OPTIONS.routes.callback\n      ),\n      backChannelLogout: removeTrailingSlash(\n        options?.routes?.backChannelLogout ??\n          MONOCLOUD_AUTH_BACK_CHANNEL_LOGOUT_URL ??\n          DEFAULT_OPTIONS.routes.backChannelLogout\n      ),\n      signIn: removeTrailingSlash(\n        options?.routes?.signIn ??\n          MONOCLOUD_AUTH_SIGNIN_URL ??\n          DEFAULT_OPTIONS.routes.signIn\n      ),\n      signOut: removeTrailingSlash(\n        options?.routes?.signOut ??\n          MONOCLOUD_AUTH_SIGNOUT_URL ??\n          DEFAULT_OPTIONS.routes.signOut\n      ),\n      userInfo: removeTrailingSlash(\n        options?.routes?.userInfo ??\n          MONOCLOUD_AUTH_USER_INFO_URL ??\n          DEFAULT_OPTIONS.routes.userInfo\n      ),\n    },\n    clockSkew:\n      options?.clockSkew ??\n      getNumber(MONOCLOUD_AUTH_CLOCK_SKEW) ??\n      DEFAULT_OPTIONS.clockSkew,\n    responseTimeout:\n      options?.responseTimeout ??\n      getNumber(MONOCLOUD_AUTH_RESPONSE_TIMEOUT) ??\n      DEFAULT_OPTIONS.responseTimeout,\n    usePar:\n      options?.usePar ??\n      getBoolean(MONOCLOUD_AUTH_USE_PAR) ??\n      DEFAULT_OPTIONS.usePar,\n    postLogoutRedirectUri:\n      options?.postLogoutRedirectUri ?? MONOCLOUD_AUTH_POST_LOGOUT_REDIRECT_URI,\n    federatedSignOut:\n      options?.federatedSignOut ??\n      getBoolean(MONOCLOUD_AUTH_FEDERATED_SIGNOUT) ??\n      DEFAULT_OPTIONS.federatedSignOut,\n    userInfo:\n      options?.userInfo ??\n      getBoolean(MONOCLOUD_AUTH_USER_INFO) ??\n      DEFAULT_OPTIONS.userInfo,\n    refetchUserInfo:\n      options?.refetchUserInfo ??\n      getBoolean(MONOCLOUD_AUTH_REFETCH_USER_INFO) ??\n      DEFAULT_OPTIONS.refetchUserInfo,\n    session: {\n      cookie: {\n        name:\n          options?.session?.cookie?.name ??\n          MONOCLOUD_AUTH_SESSION_COOKIE_NAME ??\n          DEFAULT_OPTIONS.session.cookie.name,\n        path:\n          options?.session?.cookie?.path ??\n          MONOCLOUD_AUTH_SESSION_COOKIE_PATH ??\n          DEFAULT_OPTIONS.session.cookie.path,\n        domain:\n          options?.session?.cookie?.domain ??\n          MONOCLOUD_AUTH_SESSION_COOKIE_DOMAIN,\n        httpOnly:\n          options?.session?.cookie?.httpOnly ??\n          getBoolean(MONOCLOUD_AUTH_SESSION_COOKIE_HTTP_ONLY) ??\n          DEFAULT_OPTIONS.session.cookie.httpOnly,\n        secure:\n          options?.session?.cookie?.secure ??\n          getBoolean(MONOCLOUD_AUTH_SESSION_COOKIE_SECURE) ??\n          appUrl?.startsWith('https:'),\n        sameSite:\n          options?.session?.cookie?.sameSite ??\n          (MONOCLOUD_AUTH_SESSION_COOKIE_SAME_SITE as SameSiteValues) ??\n          DEFAULT_OPTIONS.session.cookie.sameSite,\n        persistent:\n          options?.session?.cookie?.persistent ??\n          getBoolean(MONOCLOUD_AUTH_SESSION_COOKIE_PERSISTENT) ??\n          DEFAULT_OPTIONS.session.cookie.persistent,\n      },\n      sliding:\n        options?.session?.sliding ??\n        getBoolean(MONOCLOUD_AUTH_SESSION_SLIDING) ??\n        DEFAULT_OPTIONS.session.sliding,\n      duration:\n        options?.session?.duration ??\n        getNumber(MONOCLOUD_AUTH_SESSION_DURATION) ??\n        DEFAULT_OPTIONS.session.duration,\n      maximumDuration:\n        options?.session?.maximumDuration ??\n        getNumber(MONOCLOUD_AUTH_SESSION_MAX_DURATION) ??\n        DEFAULT_OPTIONS.session.maximumDuration,\n      store: options?.session?.store,\n    },\n    state: {\n      cookie: {\n        name:\n          options?.state?.cookie?.name ??\n          MONOCLOUD_AUTH_STATE_COOKIE_NAME ??\n          DEFAULT_OPTIONS.state.cookie.name,\n        path:\n          options?.state?.cookie?.path ??\n          MONOCLOUD_AUTH_STATE_COOKIE_PATH ??\n          DEFAULT_OPTIONS.state.cookie.path,\n        domain:\n          options?.state?.cookie?.domain ?? MONOCLOUD_AUTH_STATE_COOKIE_DOMAIN,\n        httpOnly: DEFAULT_OPTIONS.state.cookie.httpOnly,\n        secure:\n          options?.state?.cookie?.secure ??\n          getBoolean(MONOCLOUD_AUTH_STATE_COOKIE_SECURE) ??\n          appUrl?.startsWith('https:'),\n        sameSite:\n          options?.state?.cookie?.sameSite ??\n          (MONOCLOUD_AUTH_STATE_COOKIE_SAME_SITE as SameSiteValues) ??\n          DEFAULT_OPTIONS.state.cookie.sameSite,\n        persistent:\n          options?.state?.cookie?.persistent ??\n          getBoolean(MONOCLOUD_AUTH_STATE_COOKIE_PERSISTENT) ??\n          DEFAULT_OPTIONS.state.cookie.persistent,\n      },\n    },\n    idTokenSigningAlg:\n      options?.idTokenSigningAlg ??\n      (MONOCLOUD_AUTH_ID_TOKEN_SIGNING_ALG as SecurityAlgorithms) ??\n      DEFAULT_OPTIONS.idTokenSigningAlg,\n    filteredIdTokenClaims:\n      options?.filteredIdTokenClaims ??\n      MONOCLOUD_AUTH_FILTERED_ID_TOKEN_CLAIMS?.split(' ')\n        .map(x => x.trim())\n        .filter(x => x.length) ??\n      DEFAULT_OPTIONS.filteredIdTokenClaims,\n    debugger: options?.debugger ?? DEFAULT_OPTIONS.debugger,\n    userAgent: options?.userAgent ?? DEFAULT_OPTIONS.userAgent,\n    jwksCacheDuration:\n      options?.jwksCacheDuration ??\n      getNumber(MONOCLOUD_AUTH_JWKS_CACHE_DURATION),\n    metadataCacheDuration:\n      options?.metadataCacheDuration ??\n      getNumber(MONOCLOUD_AUTH_METADATA_CACHE_DURATION),\n    onBackChannelLogout: options?.onBackChannelLogout,\n    onSetApplicationState: options?.onSetApplicationState,\n    onSessionCreating: options?.onSessionCreating,\n  };\n\n  const { value, error } = optionsSchema.validate(opt, { abortEarly: false });\n\n  const requiredEnv: Record<string, string> = {\n    tenantDomain: 'MONOCLOUD_AUTH_TENANT_DOMAIN',\n    clientId: 'MONOCLOUD_AUTH_CLIENT_ID',\n    clientSecret: 'MONOCLOUD_AUTH_CLIENT_SECRET',\n    appUrl: 'MONOCLOUD_AUTH_APP_URL',\n    cookieSecret: 'MONOCLOUD_AUTH_COOKIE_SECRET',\n  };\n\n  if (error) {\n    if (throwOnError) {\n      throw new MonoCloudValidationError(error.details[0].message);\n    }\n\n    // eslint-disable-next-line no-console\n    console.warn(\n      'WARNING: One or more configuration options were not provided for MonoCloudClient.'\n    );\n    error.details.forEach(detail => {\n      if (detail.context?.key && requiredEnv[detail.context.key]) {\n        // eslint-disable-next-line no-console\n        console.warn(\n          `Missing: ${detail.context.key} - Set ${requiredEnv[detail.context.key]} enviornment variable in your .env file.`\n        );\n      }\n    });\n  }\n\n  return value;\n};\n","import { createRemoteJWKSet, JWTPayload, jwtVerify } from 'jose';\nimport {\n  ensureLeadingSlash,\n  findToken,\n  isAbsoluteUrl,\n  isPresent,\n  isSameHost,\n  now,\n  parseSpaceSeparated,\n  parseSpaceSeparatedSet,\n  setsEqual,\n} from '@monocloud/auth-core/internal';\nimport {\n  generateNonce,\n  generatePKCE,\n  generateState,\n  isUserInGroup,\n  mergeArrays,\n  parseCallbackParams,\n} from '@monocloud/auth-core/utils';\nimport type {\n  Authenticators,\n  AuthorizationParams,\n  DisplayOptions,\n  IssuerMetadata,\n  MonoCloudSession,\n  Prompt,\n} from '@monocloud/auth-core';\nimport {\n  MonoCloudOidcClient,\n  MonoCloudValidationError,\n} from '@monocloud/auth-core';\nimport { MonoCloudSessionService } from './monocloud-session-service';\nimport { MonoCloudStateService } from './monocloud-state-service';\nimport { getOptions } from './options/get-options';\nimport {\n  ApplicationState,\n  CallbackOptions,\n  GetTokensOptions,\n  MonoCloudOptions,\n  MonoCloudOptionsBase,\n  MonoCloudState,\n  MonoCloudTokens,\n  SignInOptions,\n  SignOutOptions,\n  UserInfoOptions,\n} from './types';\nimport {\n  IMonoCloudCookieRequest,\n  IMonoCloudCookieResponse,\n  MonoCloudRequest,\n  MonoCloudResponse,\n} from './types/internal';\nimport {\n  callbackOptionsSchema,\n  getTokensOptionsSchema,\n  resourceValidationSchema,\n  scopesValidationSchema,\n  signInOptionsSchema,\n  signOutOptionsSchema,\n  userInfoOptionsSchema,\n} from './options/validation';\nimport dbug, { Debugger } from 'debug';\n\nexport class MonoCloudCoreClient {\n  public readonly oidcClient: MonoCloudOidcClient;\n\n  private readonly options: MonoCloudOptionsBase;\n\n  private readonly stateService: MonoCloudStateService;\n\n  private readonly sessionService: MonoCloudSessionService;\n\n  private readonly debug: Debugger;\n\n  private optionsValidated = false;\n\n  constructor(partialOptions?: MonoCloudOptions) {\n    this.options = getOptions(partialOptions, false);\n    this.oidcClient = new MonoCloudOidcClient(\n      this.options.tenantDomain,\n      this.options.clientId,\n      {\n        clientSecret: this.options.clientSecret,\n        idTokenSigningAlgorithm: this.options.idTokenSigningAlg,\n      }\n    );\n    this.debug = dbug(this.options.debugger);\n    this.stateService = new MonoCloudStateService(this.options);\n    this.sessionService = new MonoCloudSessionService(this.options);\n\n    /* v8 ignore next -- @preserve */\n    if (process.env.DEBUG && !this.debug.enabled) {\n      dbug.enable(process.env.DEBUG);\n    }\n\n    this.debug('Debug logging enabled.');\n  }\n\n  /**\n   * Initiates the sign-in flow by redirecting the user to the MonoCloud authorization endpoint.\n   *\n   * This method handles scope and resource merging, state generation (nonce, state, PKCE),\n   * and Constructing the final authorization URL.\n   *\n   * @param request - MonoCloud request object.\n   * @param response - MonoCloud response object.\n   * @param signInOptions - Optional configuration to customize the sign-in behavior.\n   * @returns A promise that resolves when the callback processing and redirection are complete.\n   *\n   * @throws {@link MonoCloudValidationError} When validation of parameters or state fails.\n   */\n  async signIn(\n    request: MonoCloudRequest,\n    response: MonoCloudResponse,\n    signInOptions?: SignInOptions\n  ): Promise<any> {\n    this.debug('Starting sign-in handler');\n    try {\n      this.validateOptions();\n\n      const { method } = await request.getRawRequest();\n\n      if (method.toLowerCase() !== 'get') {\n        response.methodNotAllowed();\n        return response.done();\n      }\n\n      const indicatorResource = this.options.resources\n        ?.map(x => x.resource)\n        .filter(x => !!x)\n        .reduce((acc, x) => `${acc} ${x}`, '');\n      const indicatorScopes = this.options.resources\n        ?.map(x => x.scopes)\n        .filter(x => !!x)\n        .reduce((acc, x) => `${acc} ${x}`, '');\n\n      const mergedScopes = mergeArrays(\n        parseSpaceSeparated(signInOptions?.authParams?.scopes),\n        parseSpaceSeparated(this.options.defaultAuthParams.scopes),\n        parseSpaceSeparated(indicatorScopes)\n      ) ?? ['openid'];\n\n      const mergedResources = mergeArrays(\n        parseSpaceSeparated(signInOptions?.authParams?.resource),\n        parseSpaceSeparated(this.options.defaultAuthParams.resource),\n        parseSpaceSeparated(indicatorResource)\n      );\n\n      // Merge the sign-in options and the default options\n      const opt = {\n        ...(signInOptions ?? {}),\n        authParams: {\n          ...this.options.defaultAuthParams,\n          ...signInOptions?.authParams,\n          scopes: mergedScopes.join(' '),\n          acrValues: mergeArrays(\n            signInOptions?.authParams?.acrValues,\n            this.options.defaultAuthParams.acrValues\n          ),\n          resource: mergedResources?.join(' '),\n        },\n      };\n\n      let appState: ApplicationState = {};\n\n      // Set the application state if the onSetApplicationState function is set\n      if (this.options.onSetApplicationState) {\n        appState = await this.options.onSetApplicationState(request);\n\n        // Validate the custom sign-in state\n        if (\n          appState === null ||\n          appState === undefined ||\n          typeof appState !== 'object' ||\n          Array.isArray(appState)\n        ) {\n          throw new MonoCloudValidationError(\n            'Invalid Application State. Expected state to be an object'\n          );\n        }\n      }\n\n      // Set the return url if passed down\n      const retUrl = request.getQuery('return_url') ?? opt.returnUrl;\n      if (\n        typeof retUrl === 'string' &&\n        retUrl &&\n        (!isAbsoluteUrl(retUrl) || isSameHost(this.options.appUrl, retUrl))\n      ) {\n        opt.returnUrl = retUrl;\n      }\n\n      // Validate the options\n      const { error } = signInOptionsSchema.validate(opt, { abortEarly: true });\n\n      if (error) {\n        throw new MonoCloudValidationError(error.details[0].message);\n      }\n\n      // Generate the state, nonce & code verifier\n      const state = generateState();\n      const nonce = generateNonce();\n      const { codeChallenge, codeVerifier } = await generatePKCE();\n\n      const maxAgeQuery = request.getQuery('max_age');\n      if (typeof maxAgeQuery === 'string' && maxAgeQuery) {\n        const parsedMaxAge = parseInt(maxAgeQuery, 10);\n        if (!isNaN(parsedMaxAge)) {\n          opt.authParams.maxAge = parsedMaxAge;\n        }\n      }\n\n      // Ensure that return to is present, if not then use the base url as the return to\n      const returnUrl = encodeURIComponent(\n        opt.returnUrl ?? this.options.appUrl\n      );\n\n      const redirectUrl = `${this.options.appUrl}${ensureLeadingSlash(this.options.routes.callback)}`;\n\n      // Create the Authorization Parameters\n      let params: AuthorizationParams = {\n        redirectUri: redirectUrl,\n        ...opt.authParams,\n        nonce,\n        state,\n        codeChallenge,\n      };\n\n      // Set the Authenticator if passed down\n      const authenticatorHint =\n        request.getQuery('authenticator_hint') ??\n        opt.authParams.authenticatorHint;\n      if (typeof authenticatorHint === 'string' && authenticatorHint) {\n        params.authenticatorHint = authenticatorHint as Authenticators;\n      }\n\n      const reqScope = request.getQuery('scope');\n\n      const scopes =\n        (typeof reqScope === 'string' ? reqScope : undefined) ??\n        opt.authParams.scopes;\n\n      if (scopes) {\n        const { error: e } = scopesValidationSchema.validate(scopes, {\n          abortEarly: true,\n        });\n\n        if (!e) {\n          params.scopes = scopes;\n        }\n      }\n\n      const reqResource = request.getQuery('resource');\n\n      const resource =\n        (typeof reqResource === 'string' ? reqResource : undefined) ??\n        opt.authParams.resource;\n\n      // Set the resources mode if passed down\n      if (resource) {\n        const { error: e } = resourceValidationSchema.validate(resource, {\n          abortEarly: true,\n        });\n\n        if (!e) {\n          params.resource = resource;\n        }\n      }\n\n      // Set the display if passed down\n      const display = request.getQuery('display') ?? opt.authParams.display;\n      if (typeof display === 'string' && display) {\n        params.display = display as unknown as DisplayOptions;\n      }\n\n      // Set the ui locales if passed down\n      const uiLocales =\n        request.getQuery('ui_locales') ?? opt.authParams.uiLocales;\n      if (typeof uiLocales === 'string' && uiLocales) {\n        params.uiLocales = uiLocales;\n      }\n\n      // Set the acr values if passed down\n      const acrValues =\n        request.getQuery('acr_values') ?? opt.authParams.acrValues;\n      if (typeof acrValues === 'string' && acrValues) {\n        params.acrValues = acrValues\n          .split(' ')\n          .map(x => x.trim())\n          .filter(x => x !== '');\n      }\n\n      // Set the login hint if passed down\n      const loginHint =\n        request.getQuery('login_hint') ?? opt.authParams.loginHint;\n      if (typeof loginHint === 'string' && loginHint) {\n        params.loginHint = loginHint;\n      }\n\n      // Set the prompt if passed down\n      let prompt: string | undefined;\n      if (typeof request.getQuery('prompt') === 'string') {\n        prompt = request.getQuery('prompt') as string;\n      } else {\n        prompt = opt.register ? 'create' : opt.authParams.prompt;\n      }\n\n      if (prompt) {\n        params.prompt = prompt as Prompt;\n      }\n\n      /* v8 ignore next -- @preserve */\n      if (!params.scopes || params.scopes.length < 0) {\n        throw new MonoCloudValidationError(\n          'Scopes are required for signing in'\n        );\n      }\n\n      // Generate the monocloud state\n      const monoCloudState: MonoCloudState = {\n        returnUrl,\n        state,\n        nonce,\n        codeVerifier,\n        maxAge: opt.authParams.maxAge,\n        appState: JSON.stringify(appState),\n        resource: this.options.defaultAuthParams.resource,\n        scopes: params.scopes,\n      };\n\n      if (this.options.usePar) {\n        const { request_uri } =\n          await this.oidcClient.pushedAuthorizationRequest(params);\n\n        params = {\n          requestUri: request_uri,\n        };\n      }\n\n      // Create authorize url\n      const authUrl = await this.oidcClient.authorizationUrl(params);\n\n      // Set the state cookie\n      await this.stateService.setState(\n        response,\n        monoCloudState,\n        params.responseMode === 'form_post' ? 'none' : undefined\n      );\n      // Redirect to authorize url\n      response.redirect(authUrl, 302);\n    } catch (error) {\n      if (typeof signInOptions?.onError === 'function') {\n        return signInOptions.onError(error as Error);\n      } else {\n        this.handleCatchAll(error as Error, response);\n      }\n    }\n\n    return response.done();\n  }\n\n  /**\n   * Handles the OpenID callback after the user authenticates with MonoCloud.\n   *\n   * Processes the authorization code, validates the state and nonce, exchanges the code for tokens,\n   * initializes the user session, and performs the final redirect to the application's return URL.\n   *\n   * @param request - MonoCloud request object.\n   * @param response - MonoCloud response object.\n   * @param callbackOptions - Optional configuration for the callback handler.\n   * @returns A promise that resolves when the callback processing and redirection are complete.\n   *\n   * @throws {@link MonoCloudValidationError} If the state is mismatched or tokens are invalid.\n   */\n  async callback(\n    request: MonoCloudRequest,\n    response: MonoCloudResponse,\n    callbackOptions?: CallbackOptions\n  ): Promise<any> {\n    this.debug('Starting callback handler');\n\n    try {\n      this.validateOptions();\n\n      const { method, url, body } = await request.getRawRequest();\n\n      if (method.toLowerCase() !== 'get' && method.toLowerCase() !== 'post') {\n        response.methodNotAllowed();\n        return response.done();\n      }\n\n      // Validate the callback Options\n      if (callbackOptions) {\n        const { error } = callbackOptionsSchema.validate(callbackOptions, {\n          abortEarly: true,\n        });\n\n        if (error) {\n          throw new MonoCloudValidationError(error.details[0].message);\n        }\n      }\n\n      // Get the state value\n      const monoCloudState = await this.stateService.getState(\n        request,\n        response\n      );\n\n      // Handle invalid state\n      if (!monoCloudState) {\n        throw new MonoCloudValidationError('Invalid Authentication State');\n      }\n\n      let fullUrl = url;\n\n      // check if the url is a relative url\n      if (!isAbsoluteUrl(url)) {\n        fullUrl = `${this.options.appUrl}${ensureLeadingSlash(url)}`;\n      }\n\n      // Get the search parameters or the body\n      const payload =\n        method.toLowerCase() === 'post'\n          ? new URLSearchParams(body)\n          : new URL(fullUrl).searchParams;\n\n      // Get the parameters returned from the server\n      const callbackParams = parseCallbackParams(payload);\n\n      if (callbackParams.state !== monoCloudState.state) {\n        throw new MonoCloudValidationError('Invalid state');\n      }\n\n      // Get the redirect Url to be validated\n      const redirectUri =\n        callbackOptions?.redirectUri ??\n        `${this.options.appUrl}${ensureLeadingSlash(this.options.routes.callback)}`;\n\n      if (!callbackParams.code) {\n        throw new MonoCloudValidationError(\n          'Authorization code not found in callback params'\n        );\n      }\n\n      // Parse the client state\n      const appState: ApplicationState = JSON.parse(monoCloudState.appState);\n\n      const session = await this.oidcClient.authenticate(\n        callbackParams.code,\n        redirectUri,\n        monoCloudState.scopes,\n        monoCloudState.resource,\n        {\n          codeVerifier: monoCloudState.codeVerifier,\n          validateIdToken: true,\n          idTokenClockSkew: this.options.clockSkew,\n          idTokenNonce: monoCloudState.nonce,\n          idTokenMaxAge: monoCloudState.maxAge,\n          idTokenClockTolerance: 5,\n          fetchUserInfo: callbackOptions?.userInfo ?? this.options.userInfo,\n          filteredIdTokenClaims: this.options.filteredIdTokenClaims,\n          onSessionCreating: async (s, i, u) =>\n            await this.options.onSessionCreating?.(s, i, u, appState),\n        }\n      );\n\n      // Set the user session\n      await this.sessionService.setSession(request, response, session);\n\n      // Return to base url if no return url was set\n      if (!monoCloudState.returnUrl) {\n        response.redirect(this.options.appUrl);\n        return response.done();\n      }\n\n      // Return to a valid return to url\n      try {\n        const decodedUrl = decodeURIComponent(monoCloudState.returnUrl);\n\n        if (!isAbsoluteUrl(decodedUrl)) {\n          response.redirect(\n            `${this.options.appUrl}${ensureLeadingSlash(decodedUrl)}`\n          );\n          return response.done();\n        }\n\n        if (isSameHost(this.options.appUrl, decodedUrl)) {\n          response.redirect(decodedUrl);\n          return response.done();\n        }\n        /* c8 ignore start */\n      } catch {\n        // do nothing\n      }\n      /* c8 ignore stop */\n\n      response.redirect(this.options.appUrl);\n    } catch (error) {\n      if (typeof callbackOptions?.onError === 'function') {\n        return callbackOptions.onError(error as Error);\n      } else {\n        this.handleCatchAll(error as Error, response);\n      }\n    }\n\n    return response.done();\n  }\n\n  /**\n   * Retrieves user information, optionally refetching fresh data from the UserInfo endpoint.\n   *\n   * @param request - MonoCloud request object.\n   * @param response - MonoCloud response object.\n   * @param userinfoOptions - Configuration to control refetching and error handling.\n   * @returns A promise that resolves with the user information sent as a JSON response.\n   *\n   * @remarks\n   * If `refresh` is true, the session is updated with fresh claims from the identity provider.\n   */\n  async userInfo(\n    request: MonoCloudRequest,\n    response: MonoCloudResponse,\n    userinfoOptions?: UserInfoOptions\n  ): Promise<any> {\n    this.debug('Starting userinfo handler');\n\n    try {\n      this.validateOptions();\n\n      const { method } = await request.getRawRequest();\n\n      if (method.toLowerCase() !== 'get') {\n        response.methodNotAllowed();\n        return response.done();\n      }\n\n      // Validate the User Info options\n      if (userinfoOptions) {\n        const { error } = userInfoOptionsSchema.validate(userinfoOptions, {\n          abortEarly: true,\n        });\n\n        if (error) {\n          throw new MonoCloudValidationError(error.details[0].message);\n        }\n      }\n\n      const refetchUserInfo =\n        userinfoOptions?.refresh ?? this.options.refetchUserInfo;\n\n      // Get the user session\n      const session = await this.sessionService.getSession(\n        request,\n        response,\n        !refetchUserInfo\n      );\n\n      // Handle no session\n      if (!session) {\n        response.setNoCache();\n        response.noContent();\n        return response.done();\n      }\n\n      const defaultToken = findToken(\n        session.accessTokens,\n        this.options.defaultAuthParams.resource,\n        session.authorizedScopes\n      );\n\n      // If refetch is false then return the session\n      if (!refetchUserInfo || !defaultToken) {\n        response.sendJson(session.user);\n        return response.done();\n      }\n\n      // Get the new session\n      const newSession = await this.oidcClient.refetchUserInfo(\n        defaultToken,\n        session,\n        {\n          onSessionCreating: this.options.onSessionCreating?.bind(this),\n        }\n      );\n\n      // Update the session containing the new claims\n      const updated = await this.sessionService.updateSession(\n        request,\n        response,\n        newSession\n      );\n\n      // Handle session was not updated successfully\n      if (!updated) {\n        response.setNoCache();\n        response.noContent();\n        return response.done();\n      }\n\n      // Return the Claims\n      response.sendJson(session.user);\n    } catch (error) {\n      if (typeof userinfoOptions?.onError === 'function') {\n        return userinfoOptions.onError(error as Error);\n      } else {\n        this.handleCatchAll(error as Error, response);\n      }\n    }\n\n    return response.done();\n  }\n\n  /**\n   * Initiates the sign-out flow, destroying the local session and optionally performing federated sign-out.\n   *\n   * @param request - MonoCloud request object.\n   * @param response - MonoCloud response object.\n   * @param signOutOptions - Configuration for post-logout behavior and federated sign-out.\n   *\n   * @returns A promise that resolves when the sign-out redirection is initiated.\n   */\n  async signOut(\n    request: MonoCloudRequest,\n    response: MonoCloudResponse,\n    signOutOptions?: SignOutOptions\n  ): Promise<any> {\n    this.debug('Starting sign-out handler');\n\n    try {\n      this.validateOptions();\n\n      const { method } = await request.getRawRequest();\n\n      if (method.toLowerCase() !== 'get') {\n        response.methodNotAllowed();\n        return response.done();\n      }\n\n      // Validate the sign-out options\n      if (signOutOptions) {\n        const { error } = signOutOptionsSchema.validate(signOutOptions, {\n          abortEarly: true,\n        });\n\n        if (error) {\n          throw new MonoCloudValidationError(error.details[0].message);\n        }\n      }\n\n      // Build the return to url\n      let returnUrl =\n        this.options.postLogoutRedirectUri ??\n        signOutOptions?.postLogoutRedirectUri ??\n        this.options.appUrl;\n\n      // Set the return url if passed down\n      const retUrl = request.getQuery('post_logout_url');\n      if (typeof retUrl === 'string' && retUrl) {\n        const { error } = signOutOptionsSchema.validate({\n          postLogoutRedirectUri: retUrl,\n        });\n\n        if (!error) {\n          returnUrl = retUrl;\n        }\n      }\n\n      // Ensure the return to is an absolute one\n      if (!isAbsoluteUrl(returnUrl)) {\n        returnUrl = `${this.options.appUrl}${ensureLeadingSlash(returnUrl)}`;\n      }\n\n      // Get the current session\n      const session = await this.sessionService.getSession(\n        request,\n        response,\n        false\n      );\n\n      // Redirect to return url if session doesn't exist\n      if (!session) {\n        response.redirect(returnUrl);\n        return response.done();\n      }\n\n      await this.sessionService.removeSession(request, response);\n\n      // Handle Federated Sign Out\n      const isFederatedSignOut =\n        signOutOptions?.federatedSignOut ?? this.options.federatedSignOut;\n\n      if (!isFederatedSignOut) {\n        response.redirect(returnUrl);\n        return response.done();\n      }\n\n      // Build the end session Url\n      const url = await this.oidcClient.endSessionUrl({\n        idToken: session.idToken,\n        postLogoutRedirectUri: returnUrl,\n        state: signOutOptions?.state,\n      });\n\n      // Redirect the user to the end session endpoint\n      response.redirect(url);\n    } catch (error) {\n      if (typeof signOutOptions?.onError === 'function') {\n        return signOutOptions.onError(error as Error);\n      } else {\n        this.handleCatchAll(error as Error, response);\n      }\n    }\n\n    return response.done();\n  }\n\n  /**\n   * Handles Back-Channel Logout notifications from the identity provider.\n   *\n   * Validates the Logout Token and triggers the `onBackChannelLogout` callback defined in options.\n   *\n   * @param request - MonoCloud request object.\n   * @param response - MonoCloud response object.\n   *\n   * @returns A promise that resolves when the logout notification has been processed.\n   *\n   * @throws {@link MonoCloudValidationError} If the logout token is missing or invalid.\n   */\n  async backChannelLogout(\n    request: MonoCloudRequest,\n    response: MonoCloudResponse\n  ): Promise<any> {\n    this.debug('Starting back-channel logout handler');\n\n    try {\n      this.validateOptions();\n\n      response.setNoCache();\n\n      if (!this.options.onBackChannelLogout) {\n        response.notFound();\n        return response.done();\n      }\n\n      const { method, body } = await request.getRawRequest();\n\n      if (method.toLowerCase() !== 'post') {\n        response.methodNotAllowed();\n        return response.done();\n      }\n\n      const params = new URLSearchParams(body);\n      const logoutToken = params.get('logout_token');\n\n      if (!logoutToken) {\n        throw new MonoCloudValidationError('Missing Logout Token');\n      }\n\n      const metadata = await this.oidcClient.getMetadata();\n\n      const { sid, sub } = await this.verifyLogoutToken(logoutToken, metadata);\n\n      await this.options.onBackChannelLogout(sub, sid as any);\n\n      response.noContent();\n    } catch (error) {\n      this.handleCatchAll(error as Error, response);\n    }\n\n    return response.done();\n  }\n\n  /**\n   * Checks if the current request has an active and authenticated session.\n   *\n   * @param request - MonoCloud cookie request object.\n   * @param response - MonoCloud cookie response object.\n   *\n   * @returns `true` if a valid session with user data exists, `false` otherwise.\n   *\n   */\n  async isAuthenticated(\n    request: IMonoCloudCookieRequest,\n    response: IMonoCloudCookieResponse\n  ): Promise<boolean> {\n    // Get the session\n    const session = await this.sessionService.getSession(request, response);\n\n    // Return true if the session exists\n    return !!session?.user;\n  }\n\n  /**\n   * Checks if the current session user belongs to the specified groups.\n   *\n   * @param request - MonoCloud cookie request object.\n   * @param response - MonoCloud cookie response object.\n   * @param groups - List of group names or IDs to check.\n   * @param groupsClaim - Optional claim name that holds groups. Defaults to \"groups\".\n   * @param matchAll - If `true`, requires membership in all groups; otherwise any one group is sufficient.\n   *\n   * @returns `true` if the user satisfies the group condition, `false` otherwise.\n   */\n  async isUserInGroup(\n    request: IMonoCloudCookieRequest,\n    response: IMonoCloudCookieResponse,\n    groups: string[],\n    groupsClaim?: string,\n    matchAll?: boolean\n  ): Promise<boolean> {\n    const session = await this.sessionService.getSession(request, response);\n\n    if (!session?.user) {\n      return false;\n    }\n\n    return isUserInGroup(session.user, groups, groupsClaim, matchAll);\n  }\n\n  /**\n   * Retrieves the current user's session data.\n   *\n   * @param request - MonoCloud cookie request object.\n   * @param response - MonoCloud cookie response object.\n   *\n   * @returns Session or `undefined`.\n   */\n  getSession(\n    request: IMonoCloudCookieRequest,\n    response: IMonoCloudCookieResponse\n  ): Promise<MonoCloudSession | undefined> {\n    return this.sessionService.getSession(request, response);\n  }\n\n  /**\n   * Updates the current user's session with new data.\n   *\n   * @param request - MonoCloud cookie request object.\n   * @param response - MonoCloud cookie response object.\n   * @param session - The updated session object to persist.\n   */\n  async updateSession(\n    request: IMonoCloudCookieRequest,\n    response: IMonoCloudCookieResponse,\n    session: MonoCloudSession\n  ): Promise<void> {\n    await this.sessionService.updateSession(request, response, session);\n  }\n\n  /**\n   * Returns a copy of the current client configuration options.\n   *\n   * @returns A copy of the initialized configuration.\n   */\n  getOptions(): MonoCloudOptionsBase {\n    return { ...this.options };\n  }\n\n  /**\n   * Destroys the local user session.\n   *\n   * @param request - MonoCloud cookie request object.\n   * @param response - MonoCloud cookie response object.\n   *\n   * @remarks\n   * This does not perform federated sign-out. For identity provider sign-out, use `signOut` handler.\n   */\n  destroySession(\n    request: IMonoCloudCookieRequest,\n    response: IMonoCloudCookieResponse\n  ): Promise<void> {\n    return this.sessionService.removeSession(request, response);\n  }\n\n  /**\n   * Retrieves active tokens (Access, ID, Refresh), performing a refresh if they are expired or missing.\n   *\n   * @param request - MonoCloud cookie request object.\n   * @param response - MonoCloud cookie response object.\n   * @param options - Configuration for token retrieval (force refresh, specific scopes/resources).\n   *\n   * @returns Fetched tokens\n   *\n   * @throws {@link MonoCloudValidationError} If the session does not exist or tokens cannot be found/refreshed.\n   */\n  async getTokens(\n    request: IMonoCloudCookieRequest,\n    response: IMonoCloudCookieResponse,\n    options?: GetTokensOptions\n  ): Promise<MonoCloudTokens> {\n    // Validate the get tokens options\n    if (options) {\n      const { error } = getTokensOptionsSchema.validate(options, {\n        abortEarly: true,\n      });\n\n      if (error) {\n        throw new MonoCloudValidationError(error.details[0].message);\n      }\n    }\n\n    // Get the session\n    const session = await this.sessionService.getSession(request, response);\n\n    if (!session) {\n      throw new MonoCloudValidationError('Session does not exist');\n    }\n\n    let scopes = options?.scopes;\n\n    const resource =\n      options?.resource ?? this.options.defaultAuthParams.resource;\n\n    if (isPresent(options?.resource)) {\n      if (!isPresent(scopes)) {\n        // Check if there is a resource with undefined scope\n        const noScopeResource = this.options.resources?.find(\n          x =>\n            setsEqual(\n              parseSpaceSeparatedSet(x.resource),\n              parseSpaceSeparatedSet(resource)\n            ) && !x.scopes\n        );\n\n        // Search for the same resource with scopes defined\n        if (!noScopeResource) {\n          scopes = this.options.resources?.find(x =>\n            setsEqual(\n              parseSpaceSeparatedSet(x.resource),\n              parseSpaceSeparatedSet(resource)\n            )\n          )?.scopes;\n        }\n      }\n    }\n\n    const findTokenScopes =\n      !isPresent(options?.resource) && !isPresent(scopes)\n        ? session.authorizedScopes\n        : scopes;\n\n    let token = findToken(session.accessTokens, resource, findTokenScopes);\n\n    const tokenExpired = !!token && token.accessTokenExpiration - 30 < now();\n\n    let { idToken } = session;\n    let { refreshToken } = session;\n\n    if (options?.forceRefresh || !token || tokenExpired) {\n      const updatedSession = await this.oidcClient.refreshSession(session, {\n        fetchUserInfo: options?.refetchUserInfo ?? this.options.refetchUserInfo,\n        validateIdToken: true,\n        idTokenClockSkew: this.options.clockSkew,\n        idTokenClockTolerance: 5,\n        refreshGrantOptions: {\n          resource,\n          scopes,\n        },\n        filteredIdTokenClaims: this.options.filteredIdTokenClaims,\n        onSessionCreating: this.options.onSessionCreating?.bind(this),\n      });\n\n      await this.sessionService.updateSession(\n        request,\n        response,\n        updatedSession\n      );\n\n      token = findToken(\n        updatedSession?.accessTokens,\n        resource,\n        findTokenScopes\n      );\n\n      idToken = updatedSession.idToken;\n      refreshToken = updatedSession.refreshToken;\n    }\n\n    // Just in case. At this point, the access token should be present\n    /* v8 ignore next -- @preserve */\n    if (!token) {\n      throw new MonoCloudValidationError('Access token not found');\n    }\n\n    return {\n      ...token,\n      idToken,\n      refreshToken,\n      isExpired: token.accessTokenExpiration - 30 < now(),\n    };\n  }\n\n  private async verifyLogoutToken(\n    token: string,\n    metadata: IssuerMetadata\n  ): Promise<JWTPayload> {\n    const jwks = createRemoteJWKSet(new URL(metadata.jwks_uri));\n\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: metadata.issuer,\n      audience: this.options.clientId,\n      algorithms: [this.options.idTokenSigningAlg],\n      requiredClaims: ['iat'],\n    });\n\n    if (\n      (!payload.sid && !payload.sub) ||\n      payload.nonce ||\n      !payload.events ||\n      typeof payload.events !== 'object'\n    ) {\n      throw new MonoCloudValidationError('Invalid logout token');\n    }\n\n    const event = (payload.events as any)[\n      'http://schemas.openid.net/event/backchannel-logout'\n    ];\n\n    if (!event || typeof event !== 'object') {\n      throw new MonoCloudValidationError('Invalid logout token');\n    }\n\n    return payload;\n  }\n\n  private handleCatchAll(error: Error, res: MonoCloudResponse): void {\n    // eslint-disable-next-line no-console\n    console.error(error);\n    res.internalServerError();\n  }\n\n  private validateOptions(): void {\n    if (!this.optionsValidated) {\n      this.optionsValidated = true;\n      getOptions(this.options);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAaA,MAAM,kBAAkB;AAExB,IAAa,0BAAb,MAAqC;CACnC,YAAY,AAAiBA,SAA+B;EAA/B;;CAE7B,MAAM,WACJ,KACA,KACA,SACiB;EAEjB,MAAM,MAAMC,IAAM;EAGlB,MAAM,MAAM,KAAK;EACjB,MAAM,MAAM;EAMZ,MAAMC,cAAkC;GACtC;GACA,UAAU;IAAE,GAAG;IAAK,GAAG;IAAK,GALlB,KAAK,UAAU,KAAK,IAAI;IAKE;GACrC;AAGD,QAAM,KAAK,YAAY,KAAK,KAAK,aAAa,QAAQ;AAGtD,SAAO;;CAGT,MAAM,WACJ,KACA,KACA,eAAe,MACwB;EAEvC,MAAM,cAAc,MAAM,KAAK,cAAc,IAAI;AAGjD,MAAI,CAAC,aAAa;AAChB,SAAM,KAAK,iBAAiB,KAAK,IAAI;AACrC;;AAOF,MAAI,CAHY,MAAM,KAAK,gBAAgB,KAAK,KAAK,YAAY,CAI/D;EAIF,MAAM,MAAM,KAAK;EACjB,MAAM,MAAM,KAAK,UAAU,YAAY,SAAS,GAAG,IAAI;AAGvD,MAAI,CAAC,KAAK,QAAQ,QAAQ,OAAO;GAC/B,MAAMC,YAA4B,EAAE,MAAM,EAAE,EAAmB;AAG/D,OAAI,CAAC,YAAY,QACf;AAIF,UAAO,OAAOC,WAAS,KAAK,MAAM,KAAK,UAAU,YAAY,QAAQ,CAAC,CAAC;AAGvE,OAAI,gBAAgB,QAAQ,YAAY,SAAS,EAC/C,OAAM,KAAK,YACT,KACA,KACA;IACE,GAAG;IACH,UAAU;KAAE,GAAG,YAAY,SAAS;KAAG,GAAG;KAAK,GAAG;KAAK;IACxD,EACDA,UACD;AAIH,UAAOA;;EAIT,MAAM,aAAa,MAAM,KAAK,QAAQ,QAAQ,MAAM,IAAI,YAAY,IAAI;AAGxE,MAAI,CAAC,YAAY;AACf,SAAM,KAAK,iBAAiB,KAAK,IAAI;AACrC;;EAIF,MAAMD,UAA4B,EAAE,MAAM,EAAE,EAAmB;AAC/D,SAAO,OAAO,SAAS,KAAK,MAAM,KAAK,UAAU,WAAW,CAAC,CAAC;AAG9D,MAAI,gBAAgB,QAAQ,YAAY,SAAS,EAC/C,OAAM,KAAK,YACT,KACA,KACA;GACE,GAAG;GACH,UAAU;IAAE,GAAG,YAAY,SAAS;IAAG,GAAG;IAAK,GAAG;IAAK;GACxD,EACD,QACD;AAIH,SAAO;;CAGT,MAAM,cACJ,KACA,KACA,SACkB;EAElB,MAAM,cAAc,MAAM,KAAK,cAAc,IAAI;AAGjD,MAAI,CAAC,aAAa;AAChB,SAAM,KAAK,iBAAiB,KAAK,IAAI;AACrC,UAAO;;AAOT,MAAI,CAHY,MAAM,KAAK,gBAAgB,KAAK,KAAK,YAAY,CAI/D,QAAO;EAIT,MAAM,MAAM,KAAK;EACjB,MAAM,MAAM,KAAK,UAAU,YAAY,SAAS,GAAG,IAAI;AAGvD,QAAM,KAAK,YACT,KACA,KACA;GACE,GAAG;GACH,UAAU;IAAE,GAAG,YAAY,SAAS;IAAG,GAAG;IAAK,GAAG;IAAK;GACxD,EACD,QACD;AAED,SAAO;;CAGT,MAAM,cACJ,KACA,KACe;EAEf,MAAM,cAAc,MAAM,KAAK,cAAc,IAAI;AAGjD,MAAI,CAAC,aAAa;AAChB,SAAM,KAAK,iBAAiB,KAAK,IAAI;AACrC;;AAIF,MAAI,KAAK,QAAQ,QAAQ,OAGvB;;OAAI,YAAY,IACd,OAAM,KAAK,QAAQ,QAAQ,MAAM,OAAO,YAAY,IAAI;;AAI5D,QAAM,KAAK,iBAAiB,KAAK,IAAI;;CAGvC,MAAc,gBACZ,KACA,KACA,aACkB;EAElB,MAAM,UAAU,KAAK;EAErB,IAAI,UAAU;AAGd,MAAI,YAAY,SAAS,KAAK,YAAY,SAAS,IAAI,QACrD,WAAU;AAIZ,MACE,KAAK,QAAQ,QAAQ,WACrB,YAAY,SAAS,IAAI,KAAK,QAAQ,QAAQ,WAAW,QAEzD,WAAU;AAIZ,MACE,YAAY,SAAS,IAAI,KAAK,QAAQ,QAAQ,kBAC9C,QAEA,WAAU;AAIZ,MAAI,QACF,QAAO;AAIT,MAAI,KAAK,QAAQ,QAAQ,MACvB,OAAM,KAAK,QAAQ,QAAQ,MAAM,OAAO,YAAY,IAAI;AAG1D,QAAM,KAAK,iBAAiB,KAAK,IAAI;AAErC,SAAO;;CAGT,MAAc,YACZ,KACA,KACA,aACA,SACe;;EACf,MAAM,UAAU,IAAI,8BAAK,MAAM,KAAK,iBAAiB,IAAI,gFAAG,SAAQ,EAAE,CAAC;AAGvE,MAAI,CAAC,KAAK,QAAQ,QAAQ,MAGxB,aAAY,UAAU;AAIxB,MAAI,KAAK,QAAQ,QAAQ,OAAO;GAE9B,MAAM,aAAa,MAAM,KAAK,cAAc,IAAI;AAGhD,+DAAI,WAAY,IACd,OAAM,KAAK,QAAQ,QAAQ,MAAM,OAAO,WAAW,IAAI;AAKzD,eAAY,UAAU;AAGtB,SAAM,KAAK,QAAQ,QAAQ,MAAM,IAC/B,YAAY,KACZ,SACA,YAAY,SACb;;EAIH,MAAM,gBAAgB,MAAM,QAC1B,KAAK,UAAU,YAAY,EAC3B,KAAK,QAAQ,aACd;EAED,MAAM,eAAe,YAAY,SAAS,oBACtC,IAAI,KAAK,YAAY,SAAS,IAAI,IAAK,GACvC;EAEJ,MAAM,gBAAgB,KAAK,iBAAiB,aAAa;EACzD,MAAM,YACJ,kBACA,UAAU,GAAG,KAAK,QAAQ,QAAQ,OAAO,KAAK,KAAK,IAAI,cAAc,CAClE;EAGL,MAAM,SAAS,KAAK,KAAK,cAAc,SAAS,UAAU;AAE1D,OAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,GAAG;GAClC,MAAM,iBAAiB,cAAc,MACnC,IAAI,YACH,IAAI,KAAK,UACX;GAED,MAAM,aACJ,WAAW,IACP,KAAK,QAAQ,QAAQ,OAAO,OAC5B,GAAG,KAAK,QAAQ,QAAQ,OAAO,KAAK,GAAG;AAE7C,SAAM,IAAI,UACR,YACA,gBACA,KAAK,iBAAiB,aAAa,CACpC;AAED,WAAQ,OAAO,WAAW;;AAI5B,OAAK,MAAM,UAAU,QACnB,OAAM,IAAI,UAAU,QAAQ,IAAI,KAAK,iCAAiB,IAAI,KAAK,EAAE,CAAC,CAAC;;CAIvE,MAAc,cACZ,KACyC;EAEzC,MAAM,aAAa,MAAM,KAAK,iBAAiB,IAAI;AAGnD,MAAI,0DAAC,WAAY,OACf;EAIF,MAAM,OAAO,MAAM,QAAQ,WAAW,OAAO,KAAK,QAAQ,aAAa;AAGvE,MAAI,CAAC,KACH;AAIF,SAAO,KAAK,MAAM,KAAK;;CAGzB,MAAc,iBACZ,KACwD;EAExD,MAAM,UAAU,MAAM,IAAI,eAAe;AAGzC,MAAI,CAAC,QAAQ,KACX;EAIF,MAAM,MAAM,QAAQ,IAAI,KAAK,QAAQ,QAAQ,OAAO,KAAK;AAEzD,MAAI,IACF,QAAO;GAAE,MAAM,CAAC,KAAK,QAAQ,QAAQ,OAAO,KAAK;GAAE,OAAO;GAAK;EAIjE,MAAM,eAAe,MAAM,KAAK,QAAQ,SAAS,CAAC,CAC/C,QAAQ,CAAC,YACR,OAAO,WAAW,GAAG,KAAK,QAAQ,QAAQ,OAAO,KAAK,GAAG,CAC1D,CACA,KAAK,CAAC,QAAQ,YAAY;GAEzB,KAAK,SAAS,OAAO,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,GAAG;GACjD;GACD,EAAE,CACF,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI;EAGhC,MAAM,cAAc,aAAa,KAAK,EAAE,YAAY,MAAM,CAAC,KAAK,GAAG;AAGnE,MAAI,CAAC,YACH;AAIF,SAAO;GACL,MAAM,aAAa,KAChB,EAAE,UAAU,GAAG,KAAK,QAAQ,QAAQ,OAAO,KAAK,GAAG,MACrD;GACD,OAAO;GACR;;CAGH,AAAQ,UAAU,KAAa,KAAiC;AAE9D,MAAI,CAAC,KAAK,QAAQ,QAAQ,OAAO,WAC/B;AAIF,MAAI,CAAC,KAAK,QAAQ,QAAQ,QACxB,QAAO,KAAK,MAAM,MAAM,KAAK,QAAQ,QAAQ,SAAS;AAIxD,SAAO,KAAK,MACV,KAAK,IACH,MAAM,KAAK,QAAQ,QAAQ,UAC3B,MAAM,KAAK,QAAQ,QAAQ,gBAC5B,CACF;;CAGH,AAAQ,iBAAiB,KAA2B;AAClD,SAAO;GACL,QAAQ,KAAK,QAAQ,QAAQ,OAAO;GACpC,UAAU,KAAK,QAAQ,QAAQ,OAAO;GACtC,UAAU,KAAK,QAAQ,QAAQ,OAAO;GACtC,QAAQ,KAAK,QAAQ,QAAQ,OAAO;GACpC,MAAM,KAAK,QAAQ,QAAQ,OAAO;GAClC,SAAS;GACV;;CAGH,MAAc,iBACZ,KACA,KACe;;EACf,MAAM,YAAY,MAAM,KAAK,iBAAiB,IAAI;EAElD,MAAM,2EAAU,UAAW,wEAAM,QAAO,MACtC,EAAE,WAAW,KAAK,QAAQ,QAAQ,OAAO,KAAK,CAC/C;AAED,OAAK,MAAM,UAAU,WAAW,EAAE,CAChC,OAAM,IAAI,UAAU,QAAQ,IAAI,KAAK,iCAAiB,IAAI,KAAK,EAAE,CAAC,CAAC;;;;;;AC5azE,IAAa,wBAAb,MAAmC;CACjC,YAAY,AAAiBE,SAA+B;EAA/B;;CAE7B,MAAM,SACJ,KACA,OACA,kBACe;AACf,QAAM,IAAI,UACR,KAAK,QAAQ,MAAM,OAAO,MAC1B,MAAM,iBAAiB,OAAO,KAAK,QAAQ,aAAa,EACxD,KAAK,iBAAiB,iBAAiB,CACxC;;CAGH,MAAM,SACJ,KACA,KACqC;EAErC,MAAM,SAAS,MAAM,IAAI,UAAU,KAAK,QAAQ,MAAM,OAAO,KAAK;AAGlE,MAAI,CAAC,OACH;EAGF,IAAIC;AAEJ,MAAI;AAEF,qBAAkB,MAAM,iBACtB,QACA,KAAK,QAAQ,aACd;UACK;AACN;;AAIF,QAAM,IAAI,UAAU,KAAK,QAAQ,MAAM,OAAO,MAAM,IAAI;GACtD,GAAG,KAAK,kBAAkB;GAC1B,yBAAS,IAAI,KAAK,EAAE;GACrB,CAAC;AAGF,SAAO;;CAGT,AAAQ,iBAAiB,UAA0C;AACjE,SAAO;GACL,QAAQ,KAAK,QAAQ,MAAM,OAAO;GAClC,UAAU,KAAK,QAAQ,MAAM,OAAO;GACpC,UAAU,YAAY,KAAK,QAAQ,MAAM,OAAO;GAChD,QAAQ,KAAK,QAAQ,MAAM,OAAO;GAClC,MAAM,KAAK,QAAQ,MAAM,OAAO;GACjC;;;;;;AChEL,MAAa,kBAAkB;CAC7B,QAAQ;EACN,UAAU;EACV,mBAAmB;EACnB,QAAQ;EACR,SAAS;EACT,UAAU;EACX;CACD,WAAW;CACX,iBAAiB;CACjB,QAAQ;CACR,UAAU;CACV,iBAAiB;CACjB,kBAAkB;CAClB,mBAAmB;EACjB,QAAQ;EACR,cAAc;EACf;CACD,SAAS;EACP,QAAQ;GACN,UAAU;GACV,MAAM;GACN,MAAM;GACN,UAAU;GACV,YAAY;GACb;EACD,SAAS;EACT,UAAU,OAAU;EACpB,iBAAiB,QAAc;EAChC;CACD,OAAO,EACL,QAAQ;EACN,UAAU;EACV,MAAM;EACN,MAAM;EACN,UAAU;EACV,YAAY;EACb,EACF;CACD,mBAAmB;CACnB,uBAAuB;EACrB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,UAAU;CACV,WAAW;CACZ;;;;ACvCD,MAAM,iBAAiB,IAAI,QAAQ,CAAC,UAAU;AAC9C,MAAM,iBAAiB,IAAI,QAAQ,CAAC,UAAU;AAC9C,MAAM,eAAe,IAAI,SAAS,CAAC,UAAU;AAC7C,MAAM,eAAe,IAAI,SAAS,CAAC,UAAU;AAC7C,MAAM,cAAc,IAAI,QAAQ,CAAC,UAAU;AAC3C,MAAM,cAAc,IAAI,QAAQ,CAAC,UAAU;AAC3C,MAAM,iBAAiB,IAAI,QAAQ,CAAC,UAAU;AAC9C,MAAM,eAAe,IAAI,UAAU,CAAC,UAAU;AAE9C,MAAM,sBAAsB,IAAI,OAAO;CACrC,MAAM;CACN,MAAM,eAAe,IAAI,EAAE,cAAc,MAAM,CAAC;CAChD,QAAQ;CACR,UAAU;CACV,QAAQ,aAAa,KAAK,IAAI,IAAI,UAAU,EAAE;EAC5C,IAAI,IAAI,QAAQ,CAAC,QAAQ,WAAW;EACpC,MAAM,IAAI,MAAM,KAAK,CAAC,SAAS,EAC7B,YACE,gEACH,CAAC;EACF,WAAW,IAAI,MAAM,MAAM;EAC5B,CAAC;CACF,UAAU,eAAe,MAAM,UAAU,OAAO,OAAO;CACvD,YAAY;CACb,CAAC,CAAC,UAAU;AAEb,MAAM,iBAAiB,eAAe,QAAQ,OAAO,YAAY;CAC/D,IAAIC;AACJ,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,UAAQ,IAAI,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;SACrD;AACN,UAAQ;;AAGV,KAAI,CAAC,MACH,QAAO,QAAQ,QAAQ,EACrB,QAAQ,iEACT,CAAC;AAGJ,QAAO;EACP;AAEF,MAAa,2BAA2B,IAAI,QAAQ,CACjD,QAAQ,OAAO,YAAY;CAC1B,MAAM,QAAQ,MACX,MAAM,MAAM,CACZ,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,OAAO,QAAQ;AAElB,KAAI,MAAM,WAAW,EACnB,QAAO,QAAQ,QAAQ,EAAE,QAAQ,8BAA8B,CAAC;AAGlE,MAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,EAAE,UAAU,eAAe,SAAS,KAAK;AAC/C,MAAI,MACF,QAAO,QAAQ,QAAQ,EACrB,QAAQ,qBAAqB,KAAK,KAAK,MAAM,WAC9C,CAAC;;AAIN,QAAO,MAAM,KAAK,IAAI;EACtB,CACD,SAAS,EACR,eAAe,qDAChB,CAAC;AAEJ,MAAMC,gBAA+D,IAAI,OACvE;CACE,QAAQ;CACR,SAAS;CACT,UAAU,YAAY,IAAI,EAAE;CAC5B,iBAAiB,YAAY,IAAI,EAAE,CAAC,QAAQ,IAAI,IAAI,WAAW,CAAC;CAChE,OAAO;CACR,CACF,CAAC,UAAU;AAEZ,MAAMC,cAAuD,IAAI,OAAO,EACtE,QAAQ,qBACT,CAAC,CAAC,UAAU;AAEb,MAAM,eAAe,eAClB,QAAQ,OAAO,YAAY;CAC1B,MAAM,SAAS,MACZ,MAAM,MAAM,CACZ,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,OAAO,QAAQ;AAElB,KAAI,OAAO,WAAW,EACpB,QAAO,QAAQ,QAAQ,EACrB,QAAQ,2CACT,CAAC;AAGJ,KAAI,CAAC,OAAO,SAAS,SAAS,CAC5B,QAAO,QAAQ,QAAQ,EAAE,QAAQ,6BAA6B,CAAC;AAGjE,QAAO,OAAO,KAAK,IAAI;EACvB,CACD,SAAS,EAAE,eAAe,2CAA2C,CAAC;AAEzE,MAAMC,kBAAyD,IAAI,OAAO;CACxE,QAAQ;CACR,cAAc,eAAe,MAAM,OAAO,CAAC,UAAU;CACrD,cAAc,eAAe,MAAM,SAAS,YAAY;CACxD,UAAU,yBAAyB,UAAU;CAC9C,CAAC,CACC,QAAQ,KAAK,CACb,UAAU;AAEb,MAAMC,0BACJ,IAAI,OAAO;CACT,QAAQ;CACR,cAAc,eAAe,MAAM,OAAO,CAAC,UAAU;CACrD,cAAc,eAAe,MAAM,SAAS,YAAY;CACzD,CAAC,CACC,QAAQ,KAAK,CACb,UAAU;AAEf,MAAMC,eAAkD,IAAI,OAAO;CACjE,UAAU,eAAe,IAAI,EAAE,cAAc,MAAM,CAAC;CACpD,mBAAmB,eAAe,IAAI,EAAE,cAAc,MAAM,CAAC;CAC7D,QAAQ,eAAe,IAAI,EAAE,cAAc,MAAM,CAAC;CAClD,SAAS,eAAe,IAAI,EAAE,cAAc,MAAM,CAAC;CACnD,UAAU,eAAe,IAAI,EAAE,cAAc,MAAM,CAAC;CACrD,CAAC,CAAC,UAAU;AAEb,MAAa,yBAAyB,eACnC,QAAQ,OAAO,YAAY;CAC1B,MAAM,SAAS,MACZ,MAAM,MAAM,CACZ,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,OAAO,QAAQ;AAElB,KAAI,OAAO,WAAW,EACpB,QAAO,QAAQ,QAAQ,EACrB,QAAQ,2CACT,CAAC;AAGJ,QAAO,OAAO,KAAK,IAAI;EACvB,CACD,SAAS,EAAE,eAAe,2CAA2C,CAAC;AAEzE,MAAaC,yBAAsD,IAAI,OAAO;CAC5E,UAAU;CACV,QAAQ,uBAAuB,UAAU;CAC1C,CAAC;AAEF,MAAaC,gBAAwD,IAAI,OACvE;CACE,UAAU;CACV,cAAc;CACd,cAAc,eAAe,KAAK;CAClC,cAAc,eAAe,IAAI,EAAE;CACnC,QAAQ,eAAe,KAAK;CAC5B,QAAQ;CACR,WAAW;CACX,iBAAiB,YAAY,IAAI,IAAK;CACtC,QAAQ;CACR,uBAAuB,eAAe,IAAI,EAAE,eAAe,MAAM,CAAC;CAClE,kBAAkB;CAClB,UAAU;CACV,iBAAiB;CACjB,mBAAmB;CACnB,WAAW,IAAI,OAAkB,CAAC,MAAM,uBAAuB,CAAC,UAAU;CAC1E,SAAS;CACT,OAAO;CACP,mBAAmB,IAAI,QAAQ,CAAC,MAC9B,SACA,SACA,SACA,SACA,SACA,SACA,SACA,SACA,QACD;CACD,uBAAuB,IAAI,OAAe,CAAC,MAAM,eAAe;CAChE,UAAU;CACV,WAAW;CACX,mBAAmB;CACnB,uBAAuB;CACvB,qBAAqB;CACrB,uBAAuB;CACvB,mBAAmB;CACpB,CACF;AAED,MAAaC,sBAAuD,IAAI,OAAO;CAC7E,WAAW,eAAe,IAAI,EAAE,eAAe,MAAM,CAAC;CACtD,UAAU;CACV,YAAY;CACZ,SAAS;CACV,CAAC;AAEF,MAAaC,wBACX,IAAI,OAAO;CACT,UAAU;CACV,aAAa,eAAe,KAAK;CACjC,SAAS;CACV,CAAC;AAEJ,MAAaC,wBACX,IAAI,OAAO;CACT,SAAS;CACT,SAAS;CACV,CAAC;AAEJ,MAAaC,uBACX,IAAI,OAAO;CACT,uBAAuB,eAAe,IAAI,EAAE,eAAe,MAAM,CAAC;CAClE,SAAS;CACT,OAAO;CACP,kBAAkB;CAClB,SAAS;CACV,CAAC;AAEJ,MAAaC,yBACX,IAAI,OAAO;CACT,cAAc;CACd,iBAAiB;CACjB,UAAU,yBAAyB,UAAU;CAC7C,QAAQ,uBAAuB,UAAU;CAC1C,CAAC;;;;ACnOJ,MAAa,cACX,SACA,eAAe,SACU;;CACzB,MAAM,2BAA2B,QAAQ,IAAI;CAC7C,MAAM,+BAA+B,QAAQ,IAAI;CACjD,MAAM,+BAA+B,QAAQ,IAAI;CACjD,MAAM,wBAAwB,QAAQ,IAAI;CAC1C,MAAM,+BAA+B,QAAQ,IAAI;CACjD,MAAM,yBAAyB,QAAQ,IAAI;CAC3C,MAAM,8BAA8B,QAAQ,IAAI;CAChD,MAAM,yCACJ,QAAQ,IAAI;CACd,MAAM,4BAA4B,QAAQ,IAAI;CAC9C,MAAM,6BAA6B,QAAQ,IAAI;CAC/C,MAAM,+BAA+B,QAAQ,IAAI;CACjD,MAAM,0BAA0B,QAAQ,IAAI;CAC5C,MAAM,4BAA4B,QAAQ,IAAI;CAC9C,MAAM,kCACJ,QAAQ,IAAI;CACd,MAAM,yBAAyB,QAAQ,IAAI;CAC3C,MAAM,0CACJ,QAAQ,IAAI;CACd,MAAM,mCACJ,QAAQ,IAAI;CACd,MAAM,2BAA2B,QAAQ,IAAI;CAC7C,MAAM,mCACJ,QAAQ,IAAI;CACd,MAAM,qCACJ,QAAQ,IAAI;CACd,MAAM,qCACJ,QAAQ,IAAI;CACd,MAAM,uCACJ,QAAQ,IAAI;CACd,MAAM,0CACJ,QAAQ,IAAI;CACd,MAAM,uCACJ,QAAQ,IAAI;CACd,MAAM,0CACJ,QAAQ,IAAI;CACd,MAAM,2CACJ,QAAQ,IAAI;CACd,MAAM,iCACJ,QAAQ,IAAI;CACd,MAAM,kCACJ,QAAQ,IAAI;CACd,MAAM,sCACJ,QAAQ,IAAI;CACd,MAAM,mCACJ,QAAQ,IAAI;CACd,MAAM,mCACJ,QAAQ,IAAI;CACd,MAAM,qCACJ,QAAQ,IAAI;CACd,MAAM,qCACJ,QAAQ,IAAI;CACd,MAAM,wCACJ,QAAQ,IAAI;CACd,MAAM,yCACJ,QAAQ,IAAI;CACd,MAAM,sCACJ,QAAQ,IAAI;CACd,MAAM,0CACJ,QAAQ,IAAI;CACd,MAAM,qCACJ,QAAQ,IAAI;CACd,MAAM,yCACJ,QAAQ,IAAI;CAEd,MAAM,4DAAS,QAAS,WAAU;CAElC,MAAMC,MAA4B;EAChC,6DAAU,QAAS,aAAY;EAC/B,iEAAc,QAAS,iBAAgB;EACvC,iEAAc,QAAS,iBAAgB;EACvC,mBAAmB;GACjB,sDAAI,QAAS,sBAAqB,EAAE;GACpC,4EACE,QAAS,iGAAmB,WAC5B,yBACA,gBAAgB,kBAAkB;GACpC,mFACE,QAAS,mGAAmB,iBAC3B,gBAAgB,kBAAkB;GACrC,+EAAU,QAAS,mGAAmB,aAAY;GACnD;EACD,6DAAW,QAAS;EACpB,iEAAc,QAAS,iBAAgB;EACvC,QAAQ,oBAAoB,OAAO;EACnC,QAAQ;GACN,UAAU,kFACR,QAAS,0EAAQ,aACf,+BACA,gBAAgB,OAAO,SAC1B;GACD,mBAAmB,mFACjB,QAAS,4EAAQ,sBACf,0CACA,gBAAgB,OAAO,kBAC1B;GACD,QAAQ,mFACN,QAAS,4EAAQ,WACf,6BACA,gBAAgB,OAAO,OAC1B;GACD,SAAS,mFACP,QAAS,4EAAQ,YACf,8BACA,gBAAgB,OAAO,QAC1B;GACD,UAAU,mFACR,QAAS,4EAAQ,aACf,gCACA,gBAAgB,OAAO,SAC1B;GACF;EACD,8DACE,QAAS,cACT,UAAU,0BAA0B,IACpC,gBAAgB;EAClB,oEACE,QAAS,oBACT,UAAU,gCAAgC,IAC1C,gBAAgB;EAClB,2DACE,QAAS,WACT,WAAW,uBAAuB,IAClC,gBAAgB;EAClB,0EACE,QAAS,0BAAyB;EACpC,qEACE,QAAS,qBACT,WAAW,iCAAiC,IAC5C,gBAAgB;EAClB,6DACE,QAAS,aACT,WAAW,yBAAyB,IACpC,gBAAgB;EAClB,oEACE,QAAS,oBACT,WAAW,iCAAiC,IAC5C,gBAAgB;EAClB,SAAS;GACP,QAAQ;IACN,qEACE,QAAS,yFAAS,4EAAQ,SAC1B,sCACA,gBAAgB,QAAQ,OAAO;IACjC,sEACE,QAAS,4FAAS,8EAAQ,SAC1B,sCACA,gBAAgB,QAAQ,OAAO;IACjC,wEACE,QAAS,4FAAS,8EAAQ,WAC1B;IACF,0EACE,QAAS,4FAAS,8EAAQ,aAC1B,WAAW,wCAAwC,IACnD,gBAAgB,QAAQ,OAAO;IACjC,wEACE,QAAS,4FAAS,8EAAQ,WAC1B,WAAW,qCAAqC,qDAChD,OAAQ,WAAW,SAAS;IAC9B,0EACE,QAAS,4FAAS,8EAAQ,aACzB,2CACD,gBAAgB,QAAQ,OAAO;IACjC,4EACE,QAAS,4FAAS,8EAAQ,eAC1B,WAAW,yCAAyC,IACpD,gBAAgB,QAAQ,OAAO;IAClC;GACD,yEACE,QAAS,+EAAS,YAClB,WAAW,+BAA+B,IAC1C,gBAAgB,QAAQ;GAC1B,0EACE,QAAS,+EAAS,aAClB,UAAU,gCAAgC,IAC1C,gBAAgB,QAAQ;GAC1B,kFACE,QAAS,iFAAS,oBAClB,UAAU,oCAAoC,IAC9C,gBAAgB,QAAQ;GAC1B,uEAAO,QAAS,iFAAS;GAC1B;EACD,OAAO,EACL,QAAQ;GACN,mEACE,QAAS,iFAAO,wEAAQ,SACxB,oCACA,gBAAgB,MAAM,OAAO;GAC/B,oEACE,QAAS,oFAAO,0EAAQ,SACxB,oCACA,gBAAgB,MAAM,OAAO;GAC/B,sEACE,QAAS,oFAAO,0EAAQ,WAAU;GACpC,UAAU,gBAAgB,MAAM,OAAO;GACvC,sEACE,QAAS,oFAAO,0EAAQ,WACxB,WAAW,mCAAmC,qDAC9C,OAAQ,WAAW,SAAS;GAC9B,wEACE,QAAS,oFAAO,0EAAQ,aACvB,yCACD,gBAAgB,MAAM,OAAO;GAC/B,0EACE,QAAS,oFAAO,0EAAQ,eACxB,WAAW,uCAAuC,IAClD,gBAAgB,MAAM,OAAO;GAChC,EACF;EACD,sEACE,QAAS,sBACR,uCACD,gBAAgB;EAClB,0EACE,QAAS,6IACT,wCAAyC,MAAM,IAAI,CAChD,KAAI,MAAK,EAAE,MAAM,CAAC,CAClB,QAAO,MAAK,EAAE,OAAO,KACxB,gBAAgB;EAClB,6DAAU,QAAS,aAAY,gBAAgB;EAC/C,8DAAW,QAAS,cAAa,gBAAgB;EACjD,sEACE,QAAS,sBACT,UAAU,mCAAmC;EAC/C,0EACE,QAAS,0BACT,UAAU,uCAAuC;EACnD,uEAAqB,QAAS;EAC9B,yEAAuB,QAAS;EAChC,qEAAmB,QAAS;EAC7B;CAED,MAAM,EAAE,OAAO,UAAU,cAAc,SAAS,KAAK,EAAE,YAAY,OAAO,CAAC;CAE3E,MAAMC,cAAsC;EAC1C,cAAc;EACd,UAAU;EACV,cAAc;EACd,QAAQ;EACR,cAAc;EACf;AAED,KAAI,OAAO;AACT,MAAI,aACF,OAAM,IAAIC,2BAAyB,MAAM,QAAQ,GAAG,QAAQ;AAI9D,UAAQ,KACN,oFACD;AACD,QAAM,QAAQ,SAAQ,WAAU;;AAC9B,2BAAI,OAAO,2EAAS,QAAO,YAAY,OAAO,QAAQ,KAEpD,SAAQ,KACN,YAAY,OAAO,QAAQ,IAAI,SAAS,YAAY,OAAO,QAAQ,KAAK,0CACzE;IAEH;;AAGJ,QAAO;;;;;AC1NT,IAAa,sBAAb,MAAiC;CAa/B,YAAY,gBAAmC;0BAFpB;AAGzB,OAAK,UAAU,WAAW,gBAAgB,MAAM;AAChD,OAAK,aAAa,IAAIC,sBACpB,KAAK,QAAQ,cACb,KAAK,QAAQ,UACb;GACE,cAAc,KAAK,QAAQ;GAC3B,yBAAyB,KAAK,QAAQ;GACvC,CACF;AACD,OAAK,QAAQ,KAAK,KAAK,QAAQ,SAAS;AACxC,OAAK,eAAe,IAAI,sBAAsB,KAAK,QAAQ;AAC3D,OAAK,iBAAiB,IAAI,wBAAwB,KAAK,QAAQ;;AAG/D,MAAI,QAAQ,IAAI,SAAS,CAAC,KAAK,MAAM,QACnC,MAAK,OAAO,QAAQ,IAAI,MAAM;AAGhC,OAAK,MAAM,yBAAyB;;;;;;;;;;;;;;;CAgBtC,MAAM,OACJ,SACA,UACA,eACc;AACd,OAAK,MAAM,2BAA2B;AACtC,MAAI;;AACF,QAAK,iBAAiB;GAEtB,MAAM,EAAE,WAAW,MAAM,QAAQ,eAAe;AAEhD,OAAI,OAAO,aAAa,KAAK,OAAO;AAClC,aAAS,kBAAkB;AAC3B,WAAO,SAAS,MAAM;;GAGxB,MAAM,6CAAoB,KAAK,QAAQ,yFACnC,KAAI,MAAK,EAAE,SAAS,CACrB,QAAO,MAAK,CAAC,CAAC,EAAE,CAChB,QAAQ,KAAK,MAAM,GAAG,IAAI,GAAG,KAAK,GAAG;GACxC,MAAM,4CAAkB,KAAK,QAAQ,2FACjC,KAAI,MAAK,EAAE,OAAO,CACnB,QAAO,MAAK,CAAC,CAAC,EAAE,CAChB,QAAQ,KAAK,MAAM,GAAG,IAAI,GAAG,KAAK,GAAG;GAExC,MAAM,eAAe,YACnB,mGAAoB,cAAe,0FAAY,OAAO,EACtD,oBAAoB,KAAK,QAAQ,kBAAkB,OAAO,EAC1D,oBAAoB,gBAAgB,CACrC,IAAI,CAAC,SAAS;GAEf,MAAM,kBAAkB,YACtB,oGAAoB,cAAe,4FAAY,SAAS,EACxD,oBAAoB,KAAK,QAAQ,kBAAkB,SAAS,EAC5D,oBAAoB,kBAAkB,CACvC;GAGD,MAAM,MAAM;IACV,GAAI,iBAAiB,EAAE;IACvB,YAAY;KACV,GAAG,KAAK,QAAQ;KAChB,iEAAG,cAAe;KAClB,QAAQ,aAAa,KAAK,IAAI;KAC9B,WAAW,4FACT,cAAe,4FAAY,WAC3B,KAAK,QAAQ,kBAAkB,UAChC;KACD,4EAAU,gBAAiB,KAAK,IAAI;KACrC;IACF;GAED,IAAIC,WAA6B,EAAE;AAGnC,OAAI,KAAK,QAAQ,uBAAuB;AACtC,eAAW,MAAM,KAAK,QAAQ,sBAAsB,QAAQ;AAG5D,QACE,aAAa,QACb,aAAa,UACb,OAAO,aAAa,YACpB,MAAM,QAAQ,SAAS,CAEvB,OAAM,IAAIC,2BACR,4DACD;;GAKL,MAAM,SAAS,QAAQ,SAAS,aAAa,IAAI,IAAI;AACrD,OACE,OAAO,WAAW,YAClB,WACC,CAAC,cAAc,OAAO,IAAI,WAAW,KAAK,QAAQ,QAAQ,OAAO,EAElE,KAAI,YAAY;GAIlB,MAAM,EAAE,UAAU,oBAAoB,SAAS,KAAK,EAAE,YAAY,MAAM,CAAC;AAEzE,OAAI,MACF,OAAM,IAAIA,2BAAyB,MAAM,QAAQ,GAAG,QAAQ;GAI9D,MAAM,QAAQ,eAAe;GAC7B,MAAM,QAAQ,eAAe;GAC7B,MAAM,EAAE,eAAe,iBAAiB,MAAM,cAAc;GAE5D,MAAM,cAAc,QAAQ,SAAS,UAAU;AAC/C,OAAI,OAAO,gBAAgB,YAAY,aAAa;IAClD,MAAM,eAAe,SAAS,aAAa,GAAG;AAC9C,QAAI,CAAC,MAAM,aAAa,CACtB,KAAI,WAAW,SAAS;;GAK5B,MAAM,YAAY,mBAChB,IAAI,aAAa,KAAK,QAAQ,OAC/B;GAKD,IAAIC,SAA8B;IAChC,aAJkB,GAAG,KAAK,QAAQ,SAAS,mBAAmB,KAAK,QAAQ,OAAO,SAAS;IAK3F,GAAG,IAAI;IACP;IACA;IACA;IACD;GAGD,MAAM,oBACJ,QAAQ,SAAS,qBAAqB,IACtC,IAAI,WAAW;AACjB,OAAI,OAAO,sBAAsB,YAAY,kBAC3C,QAAO,oBAAoB;GAG7B,MAAM,WAAW,QAAQ,SAAS,QAAQ;GAE1C,MAAM,UACH,OAAO,aAAa,WAAW,WAAW,WAC3C,IAAI,WAAW;AAEjB,OAAI,QAAQ;IACV,MAAM,EAAE,OAAO,MAAM,uBAAuB,SAAS,QAAQ,EAC3D,YAAY,MACb,CAAC;AAEF,QAAI,CAAC,EACH,QAAO,SAAS;;GAIpB,MAAM,cAAc,QAAQ,SAAS,WAAW;GAEhD,MAAM,YACH,OAAO,gBAAgB,WAAW,cAAc,WACjD,IAAI,WAAW;AAGjB,OAAI,UAAU;IACZ,MAAM,EAAE,OAAO,MAAM,yBAAyB,SAAS,UAAU,EAC/D,YAAY,MACb,CAAC;AAEF,QAAI,CAAC,EACH,QAAO,WAAW;;GAKtB,MAAM,UAAU,QAAQ,SAAS,UAAU,IAAI,IAAI,WAAW;AAC9D,OAAI,OAAO,YAAY,YAAY,QACjC,QAAO,UAAU;GAInB,MAAM,YACJ,QAAQ,SAAS,aAAa,IAAI,IAAI,WAAW;AACnD,OAAI,OAAO,cAAc,YAAY,UACnC,QAAO,YAAY;GAIrB,MAAM,YACJ,QAAQ,SAAS,aAAa,IAAI,IAAI,WAAW;AACnD,OAAI,OAAO,cAAc,YAAY,UACnC,QAAO,YAAY,UAChB,MAAM,IAAI,CACV,KAAI,MAAK,EAAE,MAAM,CAAC,CAClB,QAAO,MAAK,MAAM,GAAG;GAI1B,MAAM,YACJ,QAAQ,SAAS,aAAa,IAAI,IAAI,WAAW;AACnD,OAAI,OAAO,cAAc,YAAY,UACnC,QAAO,YAAY;GAIrB,IAAIC;AACJ,OAAI,OAAO,QAAQ,SAAS,SAAS,KAAK,SACxC,UAAS,QAAQ,SAAS,SAAS;OAEnC,UAAS,IAAI,WAAW,WAAW,IAAI,WAAW;AAGpD,OAAI,OACF,QAAO,SAAS;;AAIlB,OAAI,CAAC,OAAO,UAAU,OAAO,OAAO,SAAS,EAC3C,OAAM,IAAIF,2BACR,qCACD;GAIH,MAAMG,iBAAiC;IACrC;IACA;IACA;IACA;IACA,QAAQ,IAAI,WAAW;IACvB,UAAU,KAAK,UAAU,SAAS;IAClC,UAAU,KAAK,QAAQ,kBAAkB;IACzC,QAAQ,OAAO;IAChB;AAED,OAAI,KAAK,QAAQ,QAAQ;IACvB,MAAM,EAAE,gBACN,MAAM,KAAK,WAAW,2BAA2B,OAAO;AAE1D,aAAS,EACP,YAAY,aACb;;GAIH,MAAM,UAAU,MAAM,KAAK,WAAW,iBAAiB,OAAO;AAG9D,SAAM,KAAK,aAAa,SACtB,UACA,gBACA,OAAO,iBAAiB,cAAc,SAAS,OAChD;AAED,YAAS,SAAS,SAAS,IAAI;WACxB,OAAO;AACd,OAAI,sEAAO,cAAe,aAAY,WACpC,QAAO,cAAc,QAAQ,MAAe;OAE5C,MAAK,eAAe,OAAgB,SAAS;;AAIjD,SAAO,SAAS,MAAM;;;;;;;;;;;;;;;CAgBxB,MAAM,SACJ,SACA,UACA,iBACc;AACd,OAAK,MAAM,4BAA4B;AAEvC,MAAI;AACF,QAAK,iBAAiB;GAEtB,MAAM,EAAE,QAAQ,KAAK,SAAS,MAAM,QAAQ,eAAe;AAE3D,OAAI,OAAO,aAAa,KAAK,SAAS,OAAO,aAAa,KAAK,QAAQ;AACrE,aAAS,kBAAkB;AAC3B,WAAO,SAAS,MAAM;;AAIxB,OAAI,iBAAiB;IACnB,MAAM,EAAE,UAAU,sBAAsB,SAAS,iBAAiB,EAChE,YAAY,MACb,CAAC;AAEF,QAAI,MACF,OAAM,IAAIH,2BAAyB,MAAM,QAAQ,GAAG,QAAQ;;GAKhE,MAAM,iBAAiB,MAAM,KAAK,aAAa,SAC7C,SACA,SACD;AAGD,OAAI,CAAC,eACH,OAAM,IAAIA,2BAAyB,+BAA+B;GAGpE,IAAI,UAAU;AAGd,OAAI,CAAC,cAAc,IAAI,CACrB,WAAU,GAAG,KAAK,QAAQ,SAAS,mBAAmB,IAAI;GAU5D,MAAM,iBAAiB,oBALrB,OAAO,aAAa,KAAK,SACrB,IAAI,gBAAgB,KAAK,GACzB,IAAI,IAAI,QAAQ,CAAC,aAG4B;AAEnD,OAAI,eAAe,UAAU,eAAe,MAC1C,OAAM,IAAIA,2BAAyB,gBAAgB;GAIrD,MAAM,iFACJ,gBAAiB,gBACjB,GAAG,KAAK,QAAQ,SAAS,mBAAmB,KAAK,QAAQ,OAAO,SAAS;AAE3E,OAAI,CAAC,eAAe,KAClB,OAAM,IAAIA,2BACR,kDACD;GAIH,MAAMD,WAA6B,KAAK,MAAM,eAAe,SAAS;GAEtE,MAAM,UAAU,MAAM,KAAK,WAAW,aACpC,eAAe,MACf,aACA,eAAe,QACf,eAAe,UACf;IACE,cAAc,eAAe;IAC7B,iBAAiB;IACjB,kBAAkB,KAAK,QAAQ;IAC/B,cAAc,eAAe;IAC7B,eAAe,eAAe;IAC9B,uBAAuB;IACvB,kFAAe,gBAAiB,aAAY,KAAK,QAAQ;IACzD,uBAAuB,KAAK,QAAQ;IACpC,mBAAmB,OAAO,GAAG,GAAG,MAC9B;;6DAAM,KAAK,SAAQ,qHAAoB,GAAG,GAAG,GAAG,SAAS;;IAC5D,CACF;AAGD,SAAM,KAAK,eAAe,WAAW,SAAS,UAAU,QAAQ;AAGhE,OAAI,CAAC,eAAe,WAAW;AAC7B,aAAS,SAAS,KAAK,QAAQ,OAAO;AACtC,WAAO,SAAS,MAAM;;AAIxB,OAAI;IACF,MAAM,aAAa,mBAAmB,eAAe,UAAU;AAE/D,QAAI,CAAC,cAAc,WAAW,EAAE;AAC9B,cAAS,SACP,GAAG,KAAK,QAAQ,SAAS,mBAAmB,WAAW,GACxD;AACD,YAAO,SAAS,MAAM;;AAGxB,QAAI,WAAW,KAAK,QAAQ,QAAQ,WAAW,EAAE;AAC/C,cAAS,SAAS,WAAW;AAC7B,YAAO,SAAS,MAAM;;WAGlB;;AAKR,YAAS,SAAS,KAAK,QAAQ,OAAO;WAC/B,OAAO;AACd,OAAI,0EAAO,gBAAiB,aAAY,WACtC,QAAO,gBAAgB,QAAQ,MAAe;OAE9C,MAAK,eAAe,OAAgB,SAAS;;AAIjD,SAAO,SAAS,MAAM;;;;;;;;;;;;;CAcxB,MAAM,SACJ,SACA,UACA,iBACc;AACd,OAAK,MAAM,4BAA4B;AAEvC,MAAI;;AACF,QAAK,iBAAiB;GAEtB,MAAM,EAAE,WAAW,MAAM,QAAQ,eAAe;AAEhD,OAAI,OAAO,aAAa,KAAK,OAAO;AAClC,aAAS,kBAAkB;AAC3B,WAAO,SAAS,MAAM;;AAIxB,OAAI,iBAAiB;IACnB,MAAM,EAAE,UAAU,sBAAsB,SAAS,iBAAiB,EAChE,YAAY,MACb,CAAC;AAEF,QAAI,MACF,OAAM,IAAIC,2BAAyB,MAAM,QAAQ,GAAG,QAAQ;;GAIhE,MAAM,qFACJ,gBAAiB,YAAW,KAAK,QAAQ;GAG3C,MAAM,UAAU,MAAM,KAAK,eAAe,WACxC,SACA,UACA,CAAC,gBACF;AAGD,OAAI,CAAC,SAAS;AACZ,aAAS,YAAY;AACrB,aAAS,WAAW;AACpB,WAAO,SAAS,MAAM;;GAGxB,MAAM,eAAe,UACnB,QAAQ,cACR,KAAK,QAAQ,kBAAkB,UAC/B,QAAQ,iBACT;AAGD,OAAI,CAAC,mBAAmB,CAAC,cAAc;AACrC,aAAS,SAAS,QAAQ,KAAK;AAC/B,WAAO,SAAS,MAAM;;GAIxB,MAAM,aAAa,MAAM,KAAK,WAAW,gBACvC,cACA,SACA,EACE,6CAAmB,KAAK,QAAQ,mGAAmB,KAAK,KAAK,EAC9D,CACF;AAUD,OAAI,CAPY,MAAM,KAAK,eAAe,cACxC,SACA,UACA,WACD,EAGa;AACZ,aAAS,YAAY;AACrB,aAAS,WAAW;AACpB,WAAO,SAAS,MAAM;;AAIxB,YAAS,SAAS,QAAQ,KAAK;WACxB,OAAO;AACd,OAAI,0EAAO,gBAAiB,aAAY,WACtC,QAAO,gBAAgB,QAAQ,MAAe;OAE9C,MAAK,eAAe,OAAgB,SAAS;;AAIjD,SAAO,SAAS,MAAM;;;;;;;;;;;CAYxB,MAAM,QACJ,SACA,UACA,gBACc;AACd,OAAK,MAAM,4BAA4B;AAEvC,MAAI;AACF,QAAK,iBAAiB;GAEtB,MAAM,EAAE,WAAW,MAAM,QAAQ,eAAe;AAEhD,OAAI,OAAO,aAAa,KAAK,OAAO;AAClC,aAAS,kBAAkB;AAC3B,WAAO,SAAS,MAAM;;AAIxB,OAAI,gBAAgB;IAClB,MAAM,EAAE,UAAU,qBAAqB,SAAS,gBAAgB,EAC9D,YAAY,MACb,CAAC;AAEF,QAAI,MACF,OAAM,IAAIA,2BAAyB,MAAM,QAAQ,GAAG,QAAQ;;GAKhE,IAAI,YACF,KAAK,QAAQ,0FACb,eAAgB,0BAChB,KAAK,QAAQ;GAGf,MAAM,SAAS,QAAQ,SAAS,kBAAkB;AAClD,OAAI,OAAO,WAAW,YAAY,QAAQ;IACxC,MAAM,EAAE,UAAU,qBAAqB,SAAS,EAC9C,uBAAuB,QACxB,CAAC;AAEF,QAAI,CAAC,MACH,aAAY;;AAKhB,OAAI,CAAC,cAAc,UAAU,CAC3B,aAAY,GAAG,KAAK,QAAQ,SAAS,mBAAmB,UAAU;GAIpE,MAAM,UAAU,MAAM,KAAK,eAAe,WACxC,SACA,UACA,MACD;AAGD,OAAI,CAAC,SAAS;AACZ,aAAS,SAAS,UAAU;AAC5B,WAAO,SAAS,MAAM;;AAGxB,SAAM,KAAK,eAAe,cAAc,SAAS,SAAS;AAM1D,OAAI,mEAFF,eAAgB,qBAAoB,KAAK,QAAQ,mBAE1B;AACvB,aAAS,SAAS,UAAU;AAC5B,WAAO,SAAS,MAAM;;GAIxB,MAAM,MAAM,MAAM,KAAK,WAAW,cAAc;IAC9C,SAAS,QAAQ;IACjB,uBAAuB;IACvB,uEAAO,eAAgB;IACxB,CAAC;AAGF,YAAS,SAAS,IAAI;WACf,OAAO;AACd,OAAI,wEAAO,eAAgB,aAAY,WACrC,QAAO,eAAe,QAAQ,MAAe;OAE7C,MAAK,eAAe,OAAgB,SAAS;;AAIjD,SAAO,SAAS,MAAM;;;;;;;;;;;;;;CAexB,MAAM,kBACJ,SACA,UACc;AACd,OAAK,MAAM,uCAAuC;AAElD,MAAI;AACF,QAAK,iBAAiB;AAEtB,YAAS,YAAY;AAErB,OAAI,CAAC,KAAK,QAAQ,qBAAqB;AACrC,aAAS,UAAU;AACnB,WAAO,SAAS,MAAM;;GAGxB,MAAM,EAAE,QAAQ,SAAS,MAAM,QAAQ,eAAe;AAEtD,OAAI,OAAO,aAAa,KAAK,QAAQ;AACnC,aAAS,kBAAkB;AAC3B,WAAO,SAAS,MAAM;;GAIxB,MAAM,cADS,IAAI,gBAAgB,KAAK,CACb,IAAI,eAAe;AAE9C,OAAI,CAAC,YACH,OAAM,IAAIA,2BAAyB,uBAAuB;GAG5D,MAAM,WAAW,MAAM,KAAK,WAAW,aAAa;GAEpD,MAAM,EAAE,KAAK,QAAQ,MAAM,KAAK,kBAAkB,aAAa,SAAS;AAExE,SAAM,KAAK,QAAQ,oBAAoB,KAAK,IAAW;AAEvD,YAAS,WAAW;WACb,OAAO;AACd,QAAK,eAAe,OAAgB,SAAS;;AAG/C,SAAO,SAAS,MAAM;;;;;;;;;;;CAYxB,MAAM,gBACJ,SACA,UACkB;EAElB,MAAM,UAAU,MAAM,KAAK,eAAe,WAAW,SAAS,SAAS;AAGvE,SAAO,CAAC,oDAAC,QAAS;;;;;;;;;;;;;CAcpB,MAAM,cACJ,SACA,UACA,QACA,aACA,UACkB;EAClB,MAAM,UAAU,MAAM,KAAK,eAAe,WAAW,SAAS,SAAS;AAEvE,MAAI,oDAAC,QAAS,MACZ,QAAO;AAGT,SAAO,cAAc,QAAQ,MAAM,QAAQ,aAAa,SAAS;;;;;;;;;;CAWnE,WACE,SACA,UACuC;AACvC,SAAO,KAAK,eAAe,WAAW,SAAS,SAAS;;;;;;;;;CAU1D,MAAM,cACJ,SACA,UACA,SACe;AACf,QAAM,KAAK,eAAe,cAAc,SAAS,UAAU,QAAQ;;;;;;;CAQrE,aAAmC;AACjC,SAAO,EAAE,GAAG,KAAK,SAAS;;;;;;;;;;;CAY5B,eACE,SACA,UACe;AACf,SAAO,KAAK,eAAe,cAAc,SAAS,SAAS;;;;;;;;;;;;;CAc7D,MAAM,UACJ,SACA,UACA,SAC0B;AAE1B,MAAI,SAAS;GACX,MAAM,EAAE,UAAU,uBAAuB,SAAS,SAAS,EACzD,YAAY,MACb,CAAC;AAEF,OAAI,MACF,OAAM,IAAIA,2BAAyB,MAAM,QAAQ,GAAG,QAAQ;;EAKhE,MAAM,UAAU,MAAM,KAAK,eAAe,WAAW,SAAS,SAAS;AAEvE,MAAI,CAAC,QACH,OAAM,IAAIA,2BAAyB,yBAAyB;EAG9D,IAAI,2DAAS,QAAS;EAEtB,MAAM,8DACJ,QAAS,aAAY,KAAK,QAAQ,kBAAkB;AAEtD,MAAI,4DAAU,QAAS,SAAS,EAC9B;OAAI,CAAC,UAAU,OAAO,EAAE;;AAWtB,QAAI,4BAToB,KAAK,QAAQ,2FAAW,MAC9C,MACE,UACE,uBAAuB,EAAE,SAAS,EAClC,uBAAuB,SAAS,CACjC,IAAI,CAAC,EAAE,OACX,GAGqB;;AACpB,wCAAS,KAAK,QAAQ,6GAAW,MAAK,MACpC,UACE,uBAAuB,EAAE,SAAS,EAClC,uBAAuB,SAAS,CACjC,CACF,kFAAE;;;;EAKT,MAAM,kBACJ,CAAC,4DAAU,QAAS,SAAS,IAAI,CAAC,UAAU,OAAO,GAC/C,QAAQ,mBACR;EAEN,IAAI,QAAQ,UAAU,QAAQ,cAAc,UAAU,gBAAgB;EAEtE,MAAM,eAAe,CAAC,CAAC,SAAS,MAAM,wBAAwB,KAAK,KAAK;EAExE,IAAI,EAAE,YAAY;EAClB,IAAI,EAAE,iBAAiB;AAEvB,yDAAI,QAAS,iBAAgB,CAAC,SAAS,cAAc;;GACnD,MAAM,iBAAiB,MAAM,KAAK,WAAW,eAAe,SAAS;IACnE,kEAAe,QAAS,oBAAmB,KAAK,QAAQ;IACxD,iBAAiB;IACjB,kBAAkB,KAAK,QAAQ;IAC/B,uBAAuB;IACvB,qBAAqB;KACnB;KACA;KACD;IACD,uBAAuB,KAAK,QAAQ;IACpC,6CAAmB,KAAK,QAAQ,mGAAmB,KAAK,KAAK;IAC9D,CAAC;AAEF,SAAM,KAAK,eAAe,cACxB,SACA,UACA,eACD;AAED,WAAQ,0EACN,eAAgB,cAChB,UACA,gBACD;AAED,aAAU,eAAe;AACzB,kBAAe,eAAe;;;AAKhC,MAAI,CAAC,MACH,OAAM,IAAIA,2BAAyB,yBAAyB;AAG9D,SAAO;GACL,GAAG;GACH;GACA;GACA,WAAW,MAAM,wBAAwB,KAAK,KAAK;GACpD;;CAGH,MAAc,kBACZ,OACA,UACqB;EAGrB,MAAM,EAAE,YAAY,MAAM,UAAU,OAFvB,mBAAmB,IAAI,IAAI,SAAS,SAAS,CAAC,EAEV;GAC/C,QAAQ,SAAS;GACjB,UAAU,KAAK,QAAQ;GACvB,YAAY,CAAC,KAAK,QAAQ,kBAAkB;GAC5C,gBAAgB,CAAC,MAAM;GACxB,CAAC;AAEF,MACG,CAAC,QAAQ,OAAO,CAAC,QAAQ,OAC1B,QAAQ,SACR,CAAC,QAAQ,UACT,OAAO,QAAQ,WAAW,SAE1B,OAAM,IAAIA,2BAAyB,uBAAuB;EAG5D,MAAM,QAAS,QAAQ,OACrB;AAGF,MAAI,CAAC,SAAS,OAAO,UAAU,SAC7B,OAAM,IAAIA,2BAAyB,uBAAuB;AAG5D,SAAO;;CAGT,AAAQ,eAAe,OAAc,KAA8B;AAEjE,UAAQ,MAAM,MAAM;AACpB,MAAI,qBAAqB;;CAG3B,AAAQ,kBAAwB;AAC9B,MAAI,CAAC,KAAK,kBAAkB;AAC1B,QAAK,mBAAmB;AACxB,cAAW,KAAK,QAAQ"}

package/dist/utils/index.cjs

@@ -0,0 +1,9 @@
+
+
+var _monocloud_auth_core_utils = require("@monocloud/auth-core/utils");
+Object.keys(_monocloud_auth_core_utils).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+    enumerable: true,
+    get: function () { return _monocloud_auth_core_utils[k]; }
+  });
+});

package/dist/utils/index.d.cts

@@ -0,0 +1 @@
+export * from "@monocloud/auth-core/utils";

package/dist/utils/index.d.mts

@@ -0,0 +1 @@
+export * from "@monocloud/auth-core/utils";

package/dist/utils/index.mjs

@@ -0,0 +1,3 @@
+export * from "@monocloud/auth-core/utils"
+
+export {  };

package/dist/utils/internal.cjs

@@ -0,0 +1,9 @@
+
+
+var _monocloud_auth_core_internal = require("@monocloud/auth-core/internal");
+Object.keys(_monocloud_auth_core_internal).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+    enumerable: true,
+    get: function () { return _monocloud_auth_core_internal[k]; }
+  });
+});

package/dist/utils/internal.d.cts

@@ -0,0 +1 @@
+export * from "@monocloud/auth-core/internal";

package/dist/utils/internal.d.mts

@@ -0,0 +1 @@
+export * from "@monocloud/auth-core/internal";

package/dist/utils/internal.mjs

@@ -0,0 +1,3 @@
+export * from "@monocloud/auth-core/internal"
+
+export {  };

package/package.json

@@ -0,0 +1,80 @@
+{
+  "name": "@monocloud/auth-node-core",
+  "version": "0.0.0-canary-20251223204113",
+  "description": "MonoCloud NodeJS Authentication Core SDK",
+  "keywords": [
+    "monocloud",
+    "authentication",
+    "auth",
+    "sdk",
+    "base",
+    "core",
+    "node"
+  ],
+  "homepage": "https://www.monocloud.com",
+  "bugs": {
+    "url": "https://github.com/monocloud/auth-js/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/monocloud/auth-js.git",
+    "directory": "packages/node-core"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "MonoCloud",
+    "email": "support@monocloud.com"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.mjs"
+    },
+    "./utils": {
+      "types": "./dist/utils/index.d.mts",
+      "import": "./dist/utils/index.mjs",
+      "require": "./dist/utils/index.cjs",
+      "default": "./dist/utils/index.mjs"
+    },
+    "./internal": {
+      "types": "./dist/utils/internal.d.mts",
+      "import": "./dist/utils/internal.mjs",
+      "require": "./dist/utils/internal.cjs",
+      "default": "./dist/utils/internal.mjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "cookie": "1.1.1",
+    "debug": "4.4.3",
+    "joi": "18.0.2",
+    "jose": "6.1.3",
+    "uuid": "13.0.0",
+    "@monocloud/auth-core": "0.0.0-canary-20251223204113"
+  },
+  "devDependencies": {
+    "@types/debug": "4.1.12",
+    "eslint": "9.39.2",
+    "nock": "15.0.0",
+    "type-fest": "5.3.1",
+    "@monocloud/auth-test-utils": "0.0.0"
+  },
+  "engines": {
+    "node": ">=16"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "lint:es": "eslint src tests",
+    "lint:ts": "tsc",
+    "lint": "pnpm run lint:es && pnpm run lint:ts",
+    "test": "eslint tests && rimraf coverage && vitest --config vitest.node.config.mts --reporter=junit --outputFile=coverage/junit.node.xml && vitest --config vitest.edge.config.mts --reporter=junit --outputFile=coverage/junit.edge.xml && pnpm report",
+    "report": "shx cp ./coverage/node/coverage-final.json ./coverage/coverage-0.json && shx cp ./coverage/edge/coverage-final.json ./coverage/coverage-1.json && nyc merge ./coverage ./coverage/coverage.json && nyc report --reporter json-summary --reporter html --reporter text -t ./coverage --report-dir ./coverage/summary && npx @monocloud/auth-test-utils check-coverage"
+  }
+}