@sourceregistry/node-jwt 1.2.1 → 1.3.0

package/dist/index-DyXdSqEc.js

@@ -0,0 +1,515 @@
+import l, { sign as D, createSign as i, createHmac as S, verify as R, createVerify as o, timingSafeEqual as x, createPrivateKey as A, createSecretKey as b, createPublicKey as I, createHash as E } from "crypto";
+const g = {
+  encode: (e) => Buffer.from(e).toString("base64url"),
+  decode: (e) => Buffer.from(e, "base64url").toString()
+}, v = (e, r) => e.length !== r.length ? !1 : x(Buffer.from(e), Buffer.from(r)), y = {
+  // HMAC
+  HS256: {
+    sign: (e, r) => S("sha256", r).update(e).digest("base64url"),
+    verify: (e, r, t) => {
+      const a = S("sha256", r).update(e).digest("base64url");
+      return v(a, t);
+    }
+  },
+  HS384: {
+    sign: (e, r) => S("sha384", r).update(e).digest("base64url"),
+    verify: (e, r, t) => {
+      const a = S("sha384", r).update(e).digest("base64url");
+      return v(a, t);
+    }
+  },
+  HS512: {
+    sign: (e, r) => S("sha512", r).update(e).digest("base64url"),
+    verify: (e, r, t) => {
+      const a = S("sha512", r).update(e).digest("base64url");
+      return v(a, t);
+    }
+  },
+  // RSA (DER-encoded signatures, base64url)
+  RS256: {
+    sign: (e, r) => i("RSA-SHA256").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("RSA-SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  RS384: {
+    sign: (e, r) => i("RSA-SHA384").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("RSA-SHA384").update(e).end().verify(r, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  RS512: {
+    sign: (e, r) => i("RSA-SHA512").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("RSA-SHA512").update(e).end().verify(r, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  // ECDSA (DER-encoded by default — no dsaEncoding!)
+  ES256: {
+    sign: (e, r) => i("SHA256").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  ES384: {
+    sign: (e, r) => i("SHA384").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("SHA384").update(e).end().verify(r, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  ES512: {
+    sign: (e, r) => i("SHA512").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("SHA512").update(e).end().verify(r, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  ES256K: {
+    sign: (e, r) => i("SHA256").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  PS256: {
+    sign: (e, r) => i("RSA-SHA256").update(e).end().sign({
+      //@ts-ignore
+      key: r,
+      padding: l.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: 32
+    }).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("RSA-SHA256").update(e).end().verify({
+          //@ts-ignore
+          key: r,
+          padding: l.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: 32
+        }, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  PS384: {
+    sign: (e, r) => i("RSA-SHA384").update(e).end().sign({
+      //@ts-ignore
+      key: r,
+      padding: l.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: 48
+    }).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("RSA-SHA384").update(e).end().verify({
+          //@ts-ignore
+          key: r,
+          padding: l.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: 48
+        }, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  PS512: {
+    sign: (e, r) => i("RSA-SHA512").update(e).end().sign({
+      //@ts-ignore
+      key: r,
+      padding: l.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: 64
+    }).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return o("RSA-SHA512").update(e).end().verify({
+          //@ts-ignore
+          key: r,
+          padding: l.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: 64
+        }, Buffer.from(t, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  EdDSA: {
+    sign: (e, r) => D(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, r).toString("base64url"),
+    verify: (e, r, t) => {
+      try {
+        return R(
+          null,
+          typeof e == "string" ? Buffer.from(e, "utf8") : e,
+          r,
+          Buffer.from(t, "base64url")
+        );
+      } catch {
+        return !1;
+      }
+    }
+  }
+}, V = Object.keys(y);
+function O(e) {
+  if (e.type === "secret") return "HS256";
+  if (e.type !== "private") throw new Error("Only private or symmetric keys can be used to sign JWTs");
+  const r = e.asymmetricKeyType, t = e.asymmetricKeyDetails;
+  switch (r) {
+    case "rsa":
+      return "RS256";
+    case "rsa-pss": {
+      const a = t?.hashAlgorithm ?? "sha256";
+      switch (a) {
+        case "sha256":
+          return "PS256";
+        case "sha384":
+          return "PS384";
+        case "sha512":
+          return "PS512";
+        default:
+          throw new Error(`Unsupported RSA-PSS hash algorithm: ${a}`);
+      }
+    }
+    case "ec": {
+      const a = t?.namedCurve;
+      switch (a) {
+        case "P-256":
+        case "prime256v1":
+          return "ES256";
+        case "P-384":
+        case "secp384r1":
+          return "ES384";
+        case "P-521":
+        case "secp521r1":
+          return "ES512";
+        case "secp256k1":
+          return "ES256K";
+        default:
+          throw new Error(`Unsupported EC curve: ${a}`);
+      }
+    }
+    case "ed25519":
+      return "EdDSA";
+    default:
+      throw new Error(`Unsupported asymmetric key type: ${r}`);
+  }
+}
+function H(e) {
+  if (typeof e == "object" && "type" in e) return e;
+  try {
+    return A(e);
+  } catch {
+    const r = typeof e == "string" ? Buffer.from(e, "utf8") : Buffer.isBuffer(e) ? e : (() => {
+      throw new Error("Unsupported key type");
+    })();
+    return b(r);
+  }
+}
+const K = (e) => {
+  const r = e.split(".");
+  if (r.length !== 3)
+    throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
+  const [t, a, s] = r;
+  if (!t || !a || !s)
+    throw new Error("Invalid JWT: empty part detected");
+  try {
+    const n = JSON.parse(g.decode(t)), d = JSON.parse(g.decode(a));
+    return { header: n, payload: d, signature: s };
+  } catch (n) {
+    throw new Error(`Invalid JWT: malformed header or payload (${n.message})`);
+  }
+}, $ = (e, r, t = {}) => {
+  const a = H(r), s = t.alg ?? O(a), n = t.typ ?? "JWT";
+  if (!(s in y))
+    throw new Error(`Unsupported algorithm: ${s}`);
+  const d = { alg: s, typ: n };
+  t.kid && (d.kid = t.kid);
+  const c = g.encode(JSON.stringify(d)), p = g.encode(JSON.stringify(e)), m = `${c}.${p}`, f = y[s].sign(m, r);
+  return `${c}.${p}.${f}`;
+}, W = (e, r, t = {}) => {
+  let a;
+  try {
+    a = K(e);
+  } catch (u) {
+    return {
+      valid: !1,
+      error: {
+        reason: u.message,
+        code: "INVALID_TOKEN"
+      }
+    };
+  }
+  const { header: s, payload: n, signature: d } = a, c = s.alg;
+  if (!(c in y))
+    return {
+      valid: !1,
+      error: {
+        reason: `Unsupported or unknown algorithm: ${s.alg}`,
+        code: "INVALID_ALGORITHM"
+      }
+    };
+  if (t.algorithms && t.algorithms.length > 0 && !t.algorithms.includes(c))
+    return {
+      valid: !1,
+      error: {
+        reason: `Algorithm "${c}" is not in the allowed algorithms list`,
+        code: "ALGORITHM_NOT_ALLOWED"
+      }
+    };
+  if (s.typ !== void 0 && s.typ !== "JWT")
+    return {
+      valid: !1,
+      error: {
+        reason: `Invalid token type: expected 'JWT', got '${s.typ}'`,
+        code: "INVALID_TYPE"
+      }
+    };
+  const p = `${g.encode(JSON.stringify(s))}.${g.encode(JSON.stringify(n))}`;
+  if (!y[c].verify(p, r, d))
+    return {
+      valid: !1,
+      error: {
+        reason: "Signature verification failed",
+        code: "INVALID_SIGNATURE"
+      }
+    };
+  const f = Math.floor(Date.now() / 1e3), h = t.clockSkew ?? 0;
+  if (!t.ignoreExpiration && n.exp !== void 0 && f > n.exp + h)
+    return {
+      valid: !1,
+      error: {
+        reason: "Token expired",
+        code: "TOKEN_EXPIRED"
+      }
+    };
+  if (n.nbf !== void 0 && f + h < n.nbf)
+    return {
+      valid: !1,
+      error: {
+        reason: "Token not yet valid",
+        code: "TOKEN_NOT_ACTIVE"
+      }
+    };
+  if (n.iat !== void 0 && f + h < n.iat)
+    return {
+      valid: !1,
+      error: {
+        reason: "Token issued in the future",
+        code: "TOKEN_FUTURE_ISSUED"
+      }
+    };
+  if (t.maxTokenAge !== void 0 && n.iat !== void 0) {
+    const u = f - n.iat;
+    if (u > t.maxTokenAge)
+      return {
+        valid: !1,
+        error: {
+          reason: `Token age (${u}s) exceeds maximum allowed age (${t.maxTokenAge}s)`,
+          code: "TOKEN_TOO_OLD"
+        }
+      };
+  }
+  if (t.issuer !== void 0) {
+    if (n.iss === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required issuer claim ("iss")',
+          code: "MISSING_ISSUER"
+        }
+      };
+    if (t.issuer !== n.iss)
+      return {
+        valid: !1,
+        error: {
+          reason: `Invalid token issuer: expected "${t.issuer}", got "${n.iss}"`,
+          code: "INVALID_ISSUER"
+        }
+      };
+  }
+  if (t.subject !== void 0) {
+    if (n.sub === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required subject claim ("sub")',
+          code: "MISSING_SUBJECT"
+        }
+      };
+    if (t.subject !== n.sub)
+      return {
+        valid: !1,
+        error: {
+          reason: `Invalid token subject: expected "${t.subject}", got "${n.sub}"`,
+          code: "INVALID_SUBJECT"
+        }
+      };
+  }
+  if (t.audience !== void 0) {
+    const u = n.aud;
+    if (u === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required audience claim ("aud")',
+          code: "MISSING_AUDIENCE"
+        }
+      };
+    const P = Array.isArray(t.audience) ? t.audience : [t.audience], J = Array.isArray(u) ? u : [u];
+    if (!P.some((N) => J.includes(N)))
+      return {
+        valid: !1,
+        error: {
+          reason: "Audience claim mismatch",
+          code: "INVALID_AUDIENCE"
+        }
+      };
+  }
+  if (t.jwtId !== void 0) {
+    if (n.jti === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required JWT ID claim ("jti")',
+          code: "MISSING_JTI"
+        }
+      };
+    if (t.jwtId !== n.jti)
+      return {
+        valid: !1,
+        error: {
+          reason: `Invalid JWT ID: expected "${t.jwtId}", got "${n.jti}"`,
+          code: "INVALID_JTI"
+        }
+      };
+  }
+  return { valid: !0, header: s, payload: n, signature: d };
+}, M = {
+  sign: $,
+  verify: W,
+  decode: K,
+  algorithms: y
+};
+function k(e) {
+  if (!e || typeof e != "object") throw new Error("Invalid KeyObject");
+  return e.export({ format: "jwk" });
+}
+function T(e) {
+  if (!e || typeof e != "object") throw new Error("Invalid JWK");
+  switch (e.kty) {
+    case "oct": {
+      if (!("k" in e) || typeof e.k != "string")
+        throw new Error('Invalid oct JWK: missing "k"');
+      return b(Buffer.from(e.k, "base64url"));
+    }
+    case "RSA":
+    case "EC":
+    case "OKP":
+      return "d" in e && typeof e.d == "string" ? A({ format: "jwk", key: e }) : I({ format: "jwk", key: e });
+    default:
+      throw new Error(`Unsupported JWK key type: ${e.kty}`);
+  }
+}
+function B(e) {
+  if (!e || typeof e != "object")
+    throw new Error("Invalid KeyObject");
+  const t = (e.type === "private" ? I(e) : e).export({ format: "jwk" });
+  return delete t.d, delete t.p, delete t.q, delete t.dp, delete t.dq, delete t.qi, t;
+}
+function _(e, r = "sha256") {
+  if (!e || typeof e != "object")
+    throw new Error("Invalid JWK");
+  let t;
+  switch (e.kty) {
+    case "RSA":
+      t = { e: e.e, kty: e.kty, n: e.n };
+      break;
+    case "EC":
+      t = { crv: e.crv, kty: e.kty, x: e.x, y: e.y };
+      break;
+    case "OKP":
+      t = { crv: e.crv, kty: e.kty, x: e.x };
+      break;
+    case "oct":
+      t = { k: e.k, kty: e.kty };
+      break;
+    default:
+      throw new Error(`Unsupported JWK key type: ${e.kty}`);
+  }
+  const a = JSON.stringify(
+    Object.keys(t).sort().reduce((s, n) => (s[n] = t[n], s), {})
+  );
+  return E(r).update(a).digest("base64url");
+}
+function w(e) {
+  if (e.x5c?.length)
+    return E("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
+}
+const q = {
+  export: k,
+  import: T,
+  toPublic: B,
+  thumbprint: _
+};
+function L(e, r) {
+  if (!e || !Array.isArray(e.keys)) throw new Error("Invalid JWKS");
+  let t;
+  if (r && (t = e.keys.find((a) => a.kid === r)), !t && e.keys.length === 1 && (t = e.keys[0]), !t) throw new Error("Key not found in JWKS");
+  return T(t);
+}
+function U(e) {
+  return {
+    keys: e.keys.map((r) => ({
+      ...r,
+      kid: r.kid ?? _(r),
+      x5t: r.x5t ?? w(r)
+    }))
+  };
+}
+const z = {
+  toKeyObject: L,
+  normalize: U
+};
+export {
+  O as A,
+  M as J,
+  y as S,
+  V as a,
+  g as b,
+  w as c,
+  K as d,
+  k as e,
+  q as f,
+  _ as g,
+  L as h,
+  T as i,
+  z as j,
+  U as n,
+  $ as s,
+  B as t,
+  W as v
+};
+//# sourceMappingURL=index-DyXdSqEc.js.map

package/dist/index-DyXdSqEc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-DyXdSqEc.js","sources":["../src/jwt/index.ts","../src/jwks/index.ts"],"sourcesContent":["import crypto, {\n    createHmac,\n    createSign,\n    createVerify,\n    createPrivateKey,\n    createSecretKey,\n    sign as cryptoSign,\n    verify as cryptoVerify,\n    timingSafeEqual,\n    type BinaryLike,\n    type KeyLike,\n    type KeyObject\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n    encode: (input: string | Buffer): string =>\n        Buffer.from(input).toString('base64url'),\n\n    decode: (input: string): string => {\n        // Node.js Buffer handles unpadded base64url since v16, but we normalize for safety\n        return Buffer.from(input, 'base64url').toString();\n    }\n};\n\n/**\n * Timing-safe string comparison to prevent timing attacks\n * @param a\n * @param b\n */\nconst timingSafeCompare = (a: string, b: string): boolean => {\n    if (a.length !== b.length) {\n        return false;\n    }\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n    /**\n     * Issuer\n     */\n    iss?: string;\n    /**\n     * Subject\n     */\n    sub?: string;\n    /**\n     * Audience\n     */\n    aud?: string | string[];\n    /**\n     * Expiration Time (as UNIX timestamp)\n     */\n    exp?: number;\n    /**\n     * Not Before (as UNIX timestamp)\n     */\n    nbf?: number;\n    /**\n     * Issued At (as UNIX timestamp)\n     */\n    iat?: number;\n    /**\n     * JWT ID\n     */\n    jti?: string;\n    /**\n     * Session ID\n     */\n    sid?: string;\n\n    /**\n     * Custom claims\n     */\n    [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n    alg: string; // Allow unknown algs during decode\n    typ?: string;\n    kid?: string;\n}\n\nexport interface JWT {\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string;\n}\n\n// Signature algorithms\nexport const SignatureAlgorithm = {\n    // HMAC\n    HS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha256', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            const expected = createHmac('sha256', secret).update(data).digest('base64url');\n            return timingSafeCompare(expected, signature);\n        }\n    },\n    HS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha384', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            const expected = createHmac('sha384', secret).update(data).digest('base64url');\n            return timingSafeCompare(expected, signature);\n        }\n    },\n    HS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha512', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            const expected = createHmac('sha512', secret).update(data).digest('base64url');\n            return timingSafeCompare(expected, signature);\n        }\n    },\n\n    // RSA (DER-encoded signatures, base64url)\n    RS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA256')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    RS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA384')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    RS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA512')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n\n    // ECDSA (DER-encoded by default — no dsaEncoding!)\n    ES256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA256')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    ES384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA384')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    ES512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA512')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    ES256K: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA256')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    PS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA256')\n                .update(data)\n                .end()\n                .sign({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength: 32\n                })\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA256')\n                    .update(data)\n                    .end()\n                    .verify({\n                        //@ts-ignore\n                        key: secret,\n                        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                        saltLength: 32\n                    }, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    PS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA384')\n                .update(data)\n                .end()\n                .sign({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength: 48\n                })\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA384')\n                    .update(data)\n                    .end()\n                    .verify({\n                        //@ts-ignore\n                        key: secret,\n                        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                        saltLength: 48\n                    }, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    PS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA512')\n                .update(data)\n                .end()\n                .sign({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength: 64\n                })\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA512')\n                    .update(data)\n                    .end()\n                    .verify({\n                        //@ts-ignore\n                        key: secret,\n                        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                        saltLength: 64\n                    }, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    EdDSA: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            cryptoSign(null, typeof data === 'string' ? Buffer.from(data, 'utf8') : data, secret)\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return cryptoVerify(\n                    null,\n                    typeof data === 'string' ? Buffer.from(data, 'utf8') : data,\n                    secret,\n                    Buffer.from(signature, 'base64url')\n                );\n            } catch {\n                return false;\n            }\n        }\n    }\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Autodetection of algorithm for KeyObjects\n * @param key\n * @constructor\n */\nexport function AutodetectAlgorithm(key: KeyObject): SupportedAlgorithm {\n    if (key.type === 'secret') return 'HS256';\n    if (key.type !== 'private') throw new Error('Only private or symmetric keys can be used to sign JWTs');\n\n    const asymKeyType = key.asymmetricKeyType;\n    const details = key.asymmetricKeyDetails;\n\n    switch (asymKeyType) {\n        case 'rsa':\n            return 'RS256';\n        case 'rsa-pss': {\n            const hash = details?.hashAlgorithm ?? 'sha256';\n            switch (hash) {\n                case 'sha256':\n                    return 'PS256';\n                case 'sha384':\n                    return 'PS384';\n                case 'sha512':\n                    return 'PS512';\n                default:\n                    throw new Error(`Unsupported RSA-PSS hash algorithm: ${hash}`);\n            }\n        }\n        case 'ec': {\n            const curve = details?.namedCurve;\n            switch (curve) {\n                case 'P-256':\n                case 'prime256v1':\n                    return 'ES256';\n                case 'P-384':\n                case 'secp384r1':\n                    return 'ES384';\n                case 'P-521':\n                case 'secp521r1':\n                    return 'ES512';\n                case 'secp256k1':\n                    return 'ES256K';\n                default:\n                    throw new Error(`Unsupported EC curve: ${curve}`);\n            }\n        }\n        case 'ed25519':\n            return 'EdDSA';\n        default:\n            throw new Error(`Unsupported asymmetric key type: ${asymKeyType}`);\n    }\n}\n\n/**\n * Normalize KeyLike input to a KeyObject\n * @param key\n */\nfunction toKeyObject(key: KeyLike): KeyObject {\n    // Already a KeyObject (private, public, or secret)\n    if (typeof key === 'object' && 'type' in key) return key as KeyObject;\n\n    // Try asymmetric private key (PEM / DER / JWK)\n    try {\n        return createPrivateKey(key);\n    } catch {\n        // Fallback: symmetric key (HMAC)\n        const buffer =\n            typeof key === 'string'\n                ? Buffer.from(key, 'utf8')\n                : Buffer.isBuffer(key)\n                    ? key\n                    : (() => {\n                        throw new Error('Unsupported key type');\n                    })();\n\n        return createSecretKey(buffer);\n    }\n}\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): JWT => {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n        throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n    }\n\n    const [headerPart, payloadPart, signature] = parts;\n\n    if (!headerPart || !payloadPart || !signature) {\n        throw new Error('Invalid JWT: empty part detected');\n    }\n\n    try {\n        const header = JSON.parse(base64Url.decode(headerPart)) as JWTHeader;\n        const payload = JSON.parse(base64Url.decode(payloadPart)) as JWTPayload;\n        return {header, payload, signature};\n    } catch (err) {\n        throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n    }\n};\n\n/**\n * Sign a JWT\n * @param payload\n * @param secret\n * @param options\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: {\n        alg?: SupportedAlgorithm;\n        kid?: string;\n        typ?: string;\n    } = {}\n): string => {\n    const key = toKeyObject(secret);\n    const alg = options.alg ?? AutodetectAlgorithm(key); // ← fixed: use `key`\n    const typ = options.typ ?? 'JWT';\n\n    if (!(alg in SignatureAlgorithm)) {\n        throw new Error(`Unsupported algorithm: ${alg}`);\n    }\n\n    const header: JWTHeader = {alg, typ};\n    if (options.kid) header.kid = options.kid;\n\n    const headerEncoded = base64Url.encode(JSON.stringify(header));\n    const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n    const signingInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = SignatureAlgorithm[alg].sign(signingInput, secret); // ← note: pass original `secret` to sign()\n\n    return `${headerEncoded}.${payloadEncoded}.${signature}`;\n};\n\n/**\n * Verify and validate a JWT\n * @param token\n * @param secret\n * @param options\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: {\n        algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n        issuer?: string;\n        subject?: string;\n        audience?: string | string[];\n        jwtId?: string;\n        ignoreExpiration?: boolean;\n        clockSkew?: number; // in seconds, default 0\n        maxTokenAge?: number; // Maximum age in seconds\n    } = {}\n):\n    | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n    | { valid: false; error: { reason: string; code: string } } => {\n    let decoded: JWT;\n    try {\n        decoded = decode(token);\n    } catch (err) {\n        return {\n            valid: false,\n            error: {\n                reason: (err as Error).message,\n                code: 'INVALID_TOKEN'\n            }\n        };\n    }\n\n    const {header, payload, signature} = decoded;\n\n    // Validate algorithm\n    const alg = header.alg as SupportedAlgorithm;\n    if (!(alg in SignatureAlgorithm)) {\n        return {\n            valid: false,\n            error: {\n                reason: `Unsupported or unknown algorithm: ${header.alg}`,\n                code: 'INVALID_ALGORITHM'\n            }\n        };\n    }\n\n    // Algorithm whitelist validation (prevents algorithm confusion attacks)\n    if (options.algorithms && options.algorithms.length > 0) {\n        if (!options.algorithms.includes(alg)) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Algorithm \"${alg}\" is not in the allowed algorithms list`,\n                    code: 'ALGORITHM_NOT_ALLOWED'\n                }\n            };\n        }\n    }\n\n    // Validate 'typ' header (must be 'JWT' if present)\n    if (header.typ !== undefined && header.typ !== 'JWT') {\n        return {\n            valid: false,\n            error: {\n                reason: `Invalid token type: expected 'JWT', got '${header.typ}'`,\n                code: 'INVALID_TYPE'\n            }\n        };\n    }\n\n    // Verify signature\n    const signingInput = `${base64Url.encode(JSON.stringify(header))}.${base64Url.encode(JSON.stringify(payload))}`;\n    const isValidSignature = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n\n    if (!isValidSignature) {\n        return {\n            valid: false,\n            error: {\n                reason: \"Signature verification failed\",\n                code: 'INVALID_SIGNATURE'\n            }\n        };\n    }\n\n    // Time validation\n    const now = Math.floor(Date.now() / 1000);\n    const skew = options.clockSkew ?? 0;\n\n    if (!options.ignoreExpiration) {\n        if (payload.exp !== undefined && now > payload.exp + skew) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token expired',\n                    code: 'TOKEN_EXPIRED'\n                }\n            };\n        }\n    }\n\n    if (payload.nbf !== undefined && now + skew < payload.nbf) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token not yet valid',\n                code: 'TOKEN_NOT_ACTIVE'\n            }\n        };\n    }\n\n    if (payload.iat !== undefined && now + skew < payload.iat) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token issued in the future',\n                code: 'TOKEN_FUTURE_ISSUED'\n            }\n        };\n    }\n\n    // Maximum token age validation\n    if (options.maxTokenAge !== undefined && payload.iat !== undefined) {\n        const tokenAge = now - payload.iat;\n        if (tokenAge > options.maxTokenAge) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Token age (${tokenAge}s) exceeds maximum allowed age (${options.maxTokenAge}s)`,\n                    code: 'TOKEN_TOO_OLD'\n                }\n            };\n        }\n    }\n\n    // --- Claim validations (only if options provided) ---\n\n    // Issuer (`iss`)\n    if (options.issuer !== undefined) {\n        if (payload.iss === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required issuer claim (\"iss\")',\n                    code: 'MISSING_ISSUER'\n                }\n            };\n        }\n        if (options.issuer !== payload.iss) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token issuer: expected \"${options.issuer}\", got \"${payload.iss}\"`,\n                    code: 'INVALID_ISSUER'\n                }\n            };\n        }\n    }\n\n    // Subject (`sub`)\n    if (options.subject !== undefined) {\n        if (payload.sub === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required subject claim (\"sub\")',\n                    code: 'MISSING_SUBJECT'\n                }\n            };\n        }\n        if (options.subject !== payload.sub) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token subject: expected \"${options.subject}\", got \"${payload.sub}\"`,\n                    code: 'INVALID_SUBJECT'\n                }\n            };\n        }\n    }\n\n    // Audience (`aud`)\n    if (options.audience !== undefined) {\n        const aud = payload.aud;\n        if (aud === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required audience claim (\"aud\")',\n                    code: 'MISSING_AUDIENCE'\n                }\n            };\n        }\n\n        const expectedAud = Array.isArray(options.audience) ? options.audience : [options.audience];\n        const tokenAud = Array.isArray(aud) ? aud : [aud];\n\n        const hasMatch = expectedAud.some(a => tokenAud.includes(a));\n        if (!hasMatch) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Audience claim mismatch',\n                    code: 'INVALID_AUDIENCE'\n                }\n            };\n        }\n    }\n\n    // JWT ID (`jti`)\n    if (options.jwtId !== undefined) {\n        if (payload.jti === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required JWT ID claim (\"jti\")',\n                    code: 'MISSING_JTI'\n                }\n            };\n        }\n        if (options.jwtId !== payload.jti) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid JWT ID: expected \"${options.jwtId}\", got \"${payload.jti}\"`,\n                    code: 'INVALID_JTI'\n                }\n            };\n        }\n    }\n\n    return {valid: true, header, payload, signature};\n};\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n\n","import {\n    createPrivateKey,\n    createPublicKey,\n    createSecretKey,\n    createHash,\n    type KeyObject\n} from 'crypto';\n\n// JWK Types\nexport type JWK =\n    | RSAJWK\n    | ECJWK\n    | OKPJWK\n    | OctJWK;\n\ninterface BaseJWK {\n    kty: string;\n    kid?: string;\n    alg?: string;\n    use?: 'sig' | 'enc';\n    key_ops?: Array<'sign' | 'verify'>;\n    x5c?: string[]; // X.509 cert chain\n    x5t?: string;   // Base64url thumbprint\n}\n\nexport interface RSAJWK extends BaseJWK {\n    kty: 'RSA';\n    n: string;\n    e: string;\n    d?: string;\n    p?: string;\n    q?: string;\n    dp?: string;\n    dq?: string;\n    qi?: string;\n}\n\nexport interface ECJWK extends BaseJWK {\n    kty: 'EC';\n    crv: 'P-256' | 'P-384' | 'P-521' | 'secp256k1';\n    x: string;\n    y: string;\n    d?: string;\n}\n\nexport interface OKPJWK extends BaseJWK {\n    kty: 'OKP';\n    crv: 'Ed25519';\n    x: string;\n    d?: string;\n}\n\nexport interface OctJWK extends BaseJWK {\n    kty: 'oct';\n    k: string;\n}\n\n/**\n * Export KeyObject to JWK\n * @param key\n */\nexport function exportJWK(key: KeyObject): JWK {\n    if (!key || typeof key !== 'object') throw new Error('Invalid KeyObject');\n    return key.export({format: 'jwk'}) as JWK;\n}\n\n/**\n * Import JWK to KeyObject\n * @param jwk\n */\nexport function importJWK(jwk: JWK): KeyObject {\n    if (!jwk || typeof jwk !== 'object') throw new Error('Invalid JWK');\n\n    switch (jwk.kty) {\n        case 'oct': {\n            if (!('k' in jwk) || typeof jwk.k !== 'string') {\n                throw new Error('Invalid oct JWK: missing \"k\"');\n            }\n\n            return createSecretKey(Buffer.from(jwk.k, 'base64url'));\n        }\n\n        case 'RSA':\n        case 'EC':\n        case 'OKP': {\n            // private key\n            if ('d' in jwk && typeof (jwk as any).d === 'string') {\n                // @ts-ignore\n                return createPrivateKey({format: 'jwk', key: jwk});\n            }\n\n            // public key\n            // @ts-ignore\n            return createPublicKey({format: 'jwk', key: jwk});\n        }\n\n        default:\n            throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n    }\n}\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport function toPublicJWK(key: KeyObject): JWK {\n    if (!key || typeof key !== 'object') {\n        throw new Error('Invalid KeyObject');\n    }\n\n    const publicKey =\n        key.type === 'private'\n            ? createPublicKey(key)\n            : key;\n\n    const jwk = publicKey.export({format: 'jwk'}) as JWK;\n\n    // Ensure private fields are not present\n    delete (jwk as any).d;\n    delete (jwk as any).p;\n    delete (jwk as any).q;\n    delete (jwk as any).dp;\n    delete (jwk as any).dq;\n    delete (jwk as any).qi;\n    return jwk;\n}\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport function getJWKThumbprint(jwk: JWK, hashAlg: 'sha256' = 'sha256'): string {\n    if (!jwk || typeof jwk !== 'object') {\n        throw new Error('Invalid JWK');\n    }\n\n    let fields: Record<string, string>;\n\n    switch (jwk.kty) {\n        case 'RSA':\n            fields = {e: jwk.e, kty: jwk.kty, n: jwk.n};\n            break;\n\n        case 'EC':\n            fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y};\n            break;\n\n        case 'OKP':\n            fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x};\n            break;\n\n        case 'oct':\n            fields = {k: jwk.k, kty: jwk.kty};\n            break;\n\n        default:\n            throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n    }\n\n    // Lexicographically sorted JSON\n    const json = JSON.stringify(\n        Object.keys(fields)\n            .sort()\n            .reduce((acc, k) => {\n                acc[k] = fields[k];\n                return acc;\n            }, {} as Record<string, string>)\n    );\n\n    return createHash(hashAlg)\n        .update(json)\n        .digest('base64url');\n}\n\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport function computeX5T(jwk: JWK): string | undefined {\n    if (!jwk.x5c?.length) return undefined;\n    return createHash('sha1').update(Buffer.from(jwk.x5c[0], 'base64')).digest('base64url');\n}\n\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n}\n\nexport interface JWKS {\n    keys: JWK[];\n}\n\n/**\n * Convert JWKS specific key of first key to KeyObject\n * @param jwks\n * @param kid\n * @constructor\n */\nexport function JWKSToKeyObject(\n    jwks: JWKS,\n    kid?: string\n): KeyObject {\n    if (!jwks || !Array.isArray(jwks.keys)) throw new Error('Invalid JWKS');\n\n    let jwk: JWK | undefined;\n\n    if (kid) jwk = jwks.keys.find(k => k.kid === kid);\n\n    // Fallback: single-key JWKS\n    if (!jwk && jwks.keys.length === 1) jwk = jwks.keys[0];\n\n    if (!jwk) throw new Error('Key not found in JWKS');\n    return importJWK(jwk);\n}\n\n/**\n * Normalize JWKS\n * @param jwks\n */\nexport function normalizeJWKS(jwks: JWKS): JWKS {\n    return {\n        keys: jwks.keys.map(jwk => ({\n            ...jwk,\n            kid: jwk.kid ?? getJWKThumbprint(jwk),\n            x5t: jwk.x5t ?? computeX5T(jwk)\n        }))\n    };\n}\n\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS\n}\n"],"names":["base64Url","input","timingSafeCompare","a","b","timingSafeEqual","SignatureAlgorithm","data","secret","createHmac","signature","expected","createSign","createVerify","crypto","cryptoSign","cryptoVerify","SupportedAlgorithms","AutodetectAlgorithm","key","asymKeyType","details","hash","curve","toKeyObject","createPrivateKey","buffer","createSecretKey","decode","token","parts","headerPart","payloadPart","header","payload","err","sign","options","alg","typ","headerEncoded","payloadEncoded","signingInput","verify","decoded","now","skew","tokenAge","aud","expectedAud","tokenAud","JWT","exportJWK","importJWK","jwk","createPublicKey","toPublicJWK","getJWKThumbprint","hashAlg","fields","json","acc","k","createHash","computeX5T","JWK","JWKSToKeyObject","jwks","kid","normalizeJWKS","JWKS"],"mappings":";AAeO,MAAMA,IAAY;AAAA,EACrB,QAAQ,CAACC,MACL,OAAO,KAAKA,CAAK,EAAE,SAAS,WAAW;AAAA,EAE3C,QAAQ,CAACA,MAEE,OAAO,KAAKA,GAAO,WAAW,EAAE,SAAA;AAE/C,GAOMC,IAAoB,CAACC,GAAWC,MAC9BD,EAAE,WAAWC,EAAE,SACR,KAEJC,EAAgB,OAAO,KAAKF,CAAC,GAAG,OAAO,KAAKC,CAAC,CAAC,GAyD5CE,IAAqB;AAAA;AAAA,EAE9B,OAAO;AAAA,IACH,MAAM,CAACC,GAAkBC,MACrBC,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAAA,IAChE,QAAQ,CAACA,GAAkBC,GAAiBE,MAAsB;AAC9D,YAAMC,IAAWF,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAC7E,aAAOL,EAAkBS,GAAUD,CAAS;AAAA,IAChD;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBC,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAAA,IAChE,QAAQ,CAACA,GAAkBC,GAAiBE,MAAsB;AAC9D,YAAMC,IAAWF,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAC7E,aAAOL,EAAkBS,GAAUD,CAAS;AAAA,IAChD;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBC,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAAA,IAChE,QAAQ,CAACA,GAAkBC,GAAiBE,MAAsB;AAC9D,YAAMC,IAAWF,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAC7E,aAAOL,EAAkBS,GAAUD,CAAS;AAAA,IAChD;AAAA,EAAA;AAAA;AAAA,EAIJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IACjF,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,MAC3D,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IACjF,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,MAC3D,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IACjF,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,MAC3D,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA;AAAA,EAIJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IAC7E,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,MAC3D,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IAC7E,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,MAC3D,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IAC7E,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,MAC3D,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,QAAQ;AAAA,IACJ,MAAM,CAACH,GAAkBC,MACrBI,EAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IAC7E,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,MAC3D,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK;AAAA;AAAA,MAEF,KAAKC;AAAA,MACL,SAASM,EAAO,UAAU;AAAA,MAC1B,YAAY;AAAA,IAAA,CACf,EACA,SAAS,WAAW;AAAA,IAC7B,QAAQ,CAACP,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO;AAAA;AAAA,UAEJ,KAAKC;AAAA,UACL,SAASM,EAAO,UAAU;AAAA,UAC1B,YAAY;AAAA,QAAA,GACb,OAAO,KAAKJ,GAAW,WAAW,CAAC;AAAA,MAC9C,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK;AAAA;AAAA,MAEF,KAAKC;AAAA,MACL,SAASM,EAAO,UAAU;AAAA,MAC1B,YAAY;AAAA,IAAA,CACf,EACA,SAAS,WAAW;AAAA,IAC7B,QAAQ,CAACP,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO;AAAA;AAAA,UAEJ,KAAKC;AAAA,UACL,SAASM,EAAO,UAAU;AAAA,UAC1B,YAAY;AAAA,QAAA,GACb,OAAO,KAAKJ,GAAW,WAAW,CAAC;AAAA,MAC9C,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBI,EAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK;AAAA;AAAA,MAEF,KAAKC;AAAA,MACL,SAASM,EAAO,UAAU;AAAA,MAC1B,YAAY;AAAA,IAAA,CACf,EACA,SAAS,WAAW;AAAA,IAC7B,QAAQ,CAACP,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOG,EAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO;AAAA;AAAA,UAEJ,KAAKC;AAAA,UACL,SAASM,EAAO,UAAU;AAAA,UAC1B,YAAY;AAAA,QAAA,GACb,OAAO,KAAKJ,GAAW,WAAW,CAAC;AAAA,MAC9C,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAAA,EAEJ,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBO,EAAW,MAAM,OAAOR,KAAS,WAAW,OAAO,KAAKA,GAAM,MAAM,IAAIA,GAAMC,CAAM,EAC/E,SAAS,WAAW;AAAA,IAC7B,QAAQ,CAACD,GAAkBC,GAAiBE,MAAsB;AAC9D,UAAI;AACA,eAAOM;AAAAA,UACH;AAAA,UACA,OAAOT,KAAS,WAAW,OAAO,KAAKA,GAAM,MAAM,IAAIA;AAAA,UACvDC;AAAA,UACA,OAAO,KAAKE,GAAW,WAAW;AAAA,QAAA;AAAA,MAE1C,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EAAA;AAER,GAIaO,IAAsB,OAAO,KAAKX,CAAkB;AAO1D,SAASY,EAAoBC,GAAoC;AACpE,MAAIA,EAAI,SAAS,SAAU,QAAO;AAClC,MAAIA,EAAI,SAAS,UAAW,OAAM,IAAI,MAAM,yDAAyD;AAErG,QAAMC,IAAcD,EAAI,mBAClBE,IAAUF,EAAI;AAEpB,UAAQC,GAAA;AAAA,IACJ,KAAK;AACD,aAAO;AAAA,IACX,KAAK,WAAW;AACZ,YAAME,IAAOD,GAAS,iBAAiB;AACvC,cAAQC,GAAA;AAAA,QACJ,KAAK;AACD,iBAAO;AAAA,QACX,KAAK;AACD,iBAAO;AAAA,QACX,KAAK;AACD,iBAAO;AAAA,QACX;AACI,gBAAM,IAAI,MAAM,uCAAuCA,CAAI,EAAE;AAAA,MAAA;AAAA,IAEzE;AAAA,IACA,KAAK,MAAM;AACP,YAAMC,IAAQF,GAAS;AACvB,cAAQE,GAAA;AAAA,QACJ,KAAK;AAAA,QACL,KAAK;AACD,iBAAO;AAAA,QACX,KAAK;AAAA,QACL,KAAK;AACD,iBAAO;AAAA,QACX,KAAK;AAAA,QACL,KAAK;AACD,iBAAO;AAAA,QACX,KAAK;AACD,iBAAO;AAAA,QACX;AACI,gBAAM,IAAI,MAAM,yBAAyBA,CAAK,EAAE;AAAA,MAAA;AAAA,IAE5D;AAAA,IACA,KAAK;AACD,aAAO;AAAA,IACX;AACI,YAAM,IAAI,MAAM,oCAAoCH,CAAW,EAAE;AAAA,EAAA;AAE7E;AAMA,SAASI,EAAYL,GAAyB;AAE1C,MAAI,OAAOA,KAAQ,YAAY,UAAUA,EAAK,QAAOA;AAGrD,MAAI;AACA,WAAOM,EAAiBN,CAAG;AAAA,EAC/B,QAAQ;AAEJ,UAAMO,IACF,OAAOP,KAAQ,WACT,OAAO,KAAKA,GAAK,MAAM,IACvB,OAAO,SAASA,CAAG,IACfA,KACC,MAAM;AACL,YAAM,IAAI,MAAM,sBAAsB;AAAA,IAC1C,GAAA;AAEZ,WAAOQ,EAAgBD,CAAM;AAAA,EACjC;AACJ;AAMO,MAAME,IAAS,CAACC,MAAuB;AAC1C,QAAMC,IAAQD,EAAM,MAAM,GAAG;AAC7B,MAAIC,EAAM,WAAW;AACjB,UAAM,IAAI,MAAM,4DAA4D;AAGhF,QAAM,CAACC,GAAYC,GAAatB,CAAS,IAAIoB;AAE7C,MAAI,CAACC,KAAc,CAACC,KAAe,CAACtB;AAChC,UAAM,IAAI,MAAM,kCAAkC;AAGtD,MAAI;AACA,UAAMuB,IAAS,KAAK,MAAMjC,EAAU,OAAO+B,CAAU,CAAC,GAChDG,IAAU,KAAK,MAAMlC,EAAU,OAAOgC,CAAW,CAAC;AACxD,WAAO,EAAC,QAAAC,GAAQ,SAAAC,GAAS,WAAAxB,EAAA;AAAA,EAC7B,SAASyB,GAAK;AACV,UAAM,IAAI,MAAM,6CAA8CA,EAAc,OAAO,GAAG;AAAA,EAC1F;AACJ,GAQaC,IAAO,CAChBF,GACA1B,GACA6B,IAII,CAAA,MACK;AACT,QAAMlB,IAAMK,EAAYhB,CAAM,GACxB8B,IAAMD,EAAQ,OAAOnB,EAAoBC,CAAG,GAC5CoB,IAAMF,EAAQ,OAAO;AAE3B,MAAI,EAAEC,KAAOhC;AACT,UAAM,IAAI,MAAM,0BAA0BgC,CAAG,EAAE;AAGnD,QAAML,IAAoB,EAAC,KAAAK,GAAK,KAAAC,EAAA;AAChC,EAAIF,EAAQ,QAAKJ,EAAO,MAAMI,EAAQ;AAEtC,QAAMG,IAAgBxC,EAAU,OAAO,KAAK,UAAUiC,CAAM,CAAC,GACvDQ,IAAiBzC,EAAU,OAAO,KAAK,UAAUkC,CAAO,CAAC,GAEzDQ,IAAe,GAAGF,CAAa,IAAIC,CAAc,IACjD/B,IAAYJ,EAAmBgC,CAAG,EAAE,KAAKI,GAAclC,CAAM;AAEnE,SAAO,GAAGgC,CAAa,IAAIC,CAAc,IAAI/B,CAAS;AAC1D,GAQaiC,IAAS,CAClBd,GACArB,GACA6B,IASI,CAAA,MAG2D;AAC/D,MAAIO;AACJ,MAAI;AACA,IAAAA,IAAUhB,EAAOC,CAAK;AAAA,EAC1B,SAASM,GAAK;AACV,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAASA,EAAc;AAAA,QACvB,MAAM;AAAA,MAAA;AAAA,IACV;AAAA,EAER;AAEA,QAAM,EAAC,QAAAF,GAAQ,SAAAC,GAAS,WAAAxB,EAAA,IAAakC,GAG/BN,IAAML,EAAO;AACnB,MAAI,EAAEK,KAAOhC;AACT,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ,qCAAqC2B,EAAO,GAAG;AAAA,QACvD,MAAM;AAAA,MAAA;AAAA,IACV;AAKR,MAAII,EAAQ,cAAcA,EAAQ,WAAW,SAAS,KAC9C,CAACA,EAAQ,WAAW,SAASC,CAAG;AAChC,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ,cAAcA,CAAG;AAAA,QACzB,MAAM;AAAA,MAAA;AAAA,IACV;AAMZ,MAAIL,EAAO,QAAQ,UAAaA,EAAO,QAAQ;AAC3C,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ,4CAA4CA,EAAO,GAAG;AAAA,QAC9D,MAAM;AAAA,MAAA;AAAA,IACV;AAKR,QAAMS,IAAe,GAAG1C,EAAU,OAAO,KAAK,UAAUiC,CAAM,CAAC,CAAC,IAAIjC,EAAU,OAAO,KAAK,UAAUkC,CAAO,CAAC,CAAC;AAG7G,MAAI,CAFqB5B,EAAmBgC,CAAG,EAAE,OAAOI,GAAclC,GAAQE,CAAS;AAGnF,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ;AAAA,QACR,MAAM;AAAA,MAAA;AAAA,IACV;AAKR,QAAMmC,IAAM,KAAK,MAAM,KAAK,IAAA,IAAQ,GAAI,GAClCC,IAAOT,EAAQ,aAAa;AAElC,MAAI,CAACA,EAAQ,oBACLH,EAAQ,QAAQ,UAAaW,IAAMX,EAAQ,MAAMY;AACjD,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ;AAAA,QACR,MAAM;AAAA,MAAA;AAAA,IACV;AAKZ,MAAIZ,EAAQ,QAAQ,UAAaW,IAAMC,IAAOZ,EAAQ;AAClD,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ;AAAA,QACR,MAAM;AAAA,MAAA;AAAA,IACV;AAIR,MAAIA,EAAQ,QAAQ,UAAaW,IAAMC,IAAOZ,EAAQ;AAClD,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ;AAAA,QACR,MAAM;AAAA,MAAA;AAAA,IACV;AAKR,MAAIG,EAAQ,gBAAgB,UAAaH,EAAQ,QAAQ,QAAW;AAChE,UAAMa,IAAWF,IAAMX,EAAQ;AAC/B,QAAIa,IAAWV,EAAQ;AACnB,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ,cAAcU,CAAQ,mCAAmCV,EAAQ,WAAW;AAAA,UACpF,MAAM;AAAA,QAAA;AAAA,MACV;AAAA,EAGZ;AAKA,MAAIA,EAAQ,WAAW,QAAW;AAC9B,QAAIH,EAAQ,QAAQ;AAChB,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ;AAAA,UACR,MAAM;AAAA,QAAA;AAAA,MACV;AAGR,QAAIG,EAAQ,WAAWH,EAAQ;AAC3B,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ,mCAAmCG,EAAQ,MAAM,WAAWH,EAAQ,GAAG;AAAA,UAC/E,MAAM;AAAA,QAAA;AAAA,MACV;AAAA,EAGZ;AAGA,MAAIG,EAAQ,YAAY,QAAW;AAC/B,QAAIH,EAAQ,QAAQ;AAChB,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ;AAAA,UACR,MAAM;AAAA,QAAA;AAAA,MACV;AAGR,QAAIG,EAAQ,YAAYH,EAAQ;AAC5B,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ,oCAAoCG,EAAQ,OAAO,WAAWH,EAAQ,GAAG;AAAA,UACjF,MAAM;AAAA,QAAA;AAAA,MACV;AAAA,EAGZ;AAGA,MAAIG,EAAQ,aAAa,QAAW;AAChC,UAAMW,IAAMd,EAAQ;AACpB,QAAIc,MAAQ;AACR,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ;AAAA,UACR,MAAM;AAAA,QAAA;AAAA,MACV;AAIR,UAAMC,IAAc,MAAM,QAAQZ,EAAQ,QAAQ,IAAIA,EAAQ,WAAW,CAACA,EAAQ,QAAQ,GACpFa,IAAW,MAAM,QAAQF,CAAG,IAAIA,IAAM,CAACA,CAAG;AAGhD,QAAI,CADaC,EAAY,KAAK,OAAKC,EAAS,SAAS/C,CAAC,CAAC;AAEvD,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ;AAAA,UACR,MAAM;AAAA,QAAA;AAAA,MACV;AAAA,EAGZ;AAGA,MAAIkC,EAAQ,UAAU,QAAW;AAC7B,QAAIH,EAAQ,QAAQ;AAChB,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ;AAAA,UACR,MAAM;AAAA,QAAA;AAAA,MACV;AAGR,QAAIG,EAAQ,UAAUH,EAAQ;AAC1B,aAAO;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,UACH,QAAQ,6BAA6BG,EAAQ,KAAK,WAAWH,EAAQ,GAAG;AAAA,UACxE,MAAM;AAAA,QAAA;AAAA,MACV;AAAA,EAGZ;AAEA,SAAO,EAAC,OAAO,IAAM,QAAAD,GAAQ,SAAAC,GAAS,WAAAxB,EAAA;AAC1C,GAGayC,IAAM;AAAA,EACf,MAAAf;AAAA,EACA,QAAAO;AAAA,EACA,QAAAf;AAAA,EACA,YAAYtB;AAChB;ACtoBO,SAAS8C,EAAUjC,GAAqB;AAC3C,MAAI,CAACA,KAAO,OAAOA,KAAQ,SAAU,OAAM,IAAI,MAAM,mBAAmB;AACxE,SAAOA,EAAI,OAAO,EAAC,QAAQ,OAAM;AACrC;AAMO,SAASkC,EAAUC,GAAqB;AAC3C,MAAI,CAACA,KAAO,OAAOA,KAAQ,SAAU,OAAM,IAAI,MAAM,aAAa;AAElE,UAAQA,EAAI,KAAA;AAAA,IACR,KAAK,OAAO;AACR,UAAI,EAAE,OAAOA,MAAQ,OAAOA,EAAI,KAAM;AAClC,cAAM,IAAI,MAAM,8BAA8B;AAGlD,aAAO3B,EAAgB,OAAO,KAAK2B,EAAI,GAAG,WAAW,CAAC;AAAA,IAC1D;AAAA,IAEA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAED,aAAI,OAAOA,KAAO,OAAQA,EAAY,KAAM,WAEjC7B,EAAiB,EAAC,QAAQ,OAAO,KAAK6B,GAAI,IAK9CC,EAAgB,EAAC,QAAQ,OAAO,KAAKD,GAAI;AAAA,IAGpD;AACI,YAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE;AAAA,EAAA;AAE3E;AAMO,SAASE,EAAYrC,GAAqB;AAC7C,MAAI,CAACA,KAAO,OAAOA,KAAQ;AACvB,UAAM,IAAI,MAAM,mBAAmB;AAQvC,QAAMmC,KAJFnC,EAAI,SAAS,YACPoC,EAAgBpC,CAAG,IACnBA,GAEY,OAAO,EAAC,QAAQ,OAAM;AAG5C,gBAAQmC,EAAY,GACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,IACpB,OAAQA,EAAY,IACpB,OAAQA,EAAY,IACbA;AACX;AAOO,SAASG,EAAiBH,GAAUI,IAAoB,UAAkB;AAC7E,MAAI,CAACJ,KAAO,OAAOA,KAAQ;AACvB,UAAM,IAAI,MAAM,aAAa;AAGjC,MAAIK;AAEJ,UAAQL,EAAI,KAAA;AAAA,IACR,KAAK;AACD,MAAAK,IAAS,EAAC,GAAGL,EAAI,GAAG,KAAKA,EAAI,KAAK,GAAGA,EAAI,EAAA;AACzC;AAAA,IAEJ,KAAK;AACD,MAAAK,IAAS,EAAC,KAAKL,EAAI,KAAK,KAAKA,EAAI,KAAK,GAAGA,EAAI,GAAG,GAAGA,EAAI,EAAA;AACvD;AAAA,IAEJ,KAAK;AACD,MAAAK,IAAS,EAAC,KAAKL,EAAI,KAAK,KAAKA,EAAI,KAAK,GAAGA,EAAI,EAAA;AAC7C;AAAA,IAEJ,KAAK;AACD,MAAAK,IAAS,EAAC,GAAGL,EAAI,GAAG,KAAKA,EAAI,IAAA;AAC7B;AAAA,IAEJ;AACI,YAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE;AAAA,EAAA;AAIvE,QAAMM,IAAO,KAAK;AAAA,IACd,OAAO,KAAKD,CAAM,EACb,OACA,OAAO,CAACE,GAAKC,OACVD,EAAIC,CAAC,IAAIH,EAAOG,CAAC,GACVD,IACR,CAAA,CAA4B;AAAA,EAAA;AAGvC,SAAOE,EAAWL,CAAO,EACpB,OAAOE,CAAI,EACX,OAAO,WAAW;AAC3B;AAOO,SAASI,EAAWV,GAA8B;AACrD,MAAKA,EAAI,KAAK;AACd,WAAOS,EAAW,MAAM,EAAE,OAAO,OAAO,KAAKT,EAAI,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,OAAO,WAAW;AAC1F;AAEO,MAAMW,IAAM;AAAA,EACf,QAAQb;AAAA,EACR,QAAQC;AAAA,EACR,UAAUG;AAAA,EACV,YAAYC;AAChB;AAYO,SAASS,EACZC,GACAC,GACS;AACT,MAAI,CAACD,KAAQ,CAAC,MAAM,QAAQA,EAAK,IAAI,EAAG,OAAM,IAAI,MAAM,cAAc;AAEtE,MAAIb;AAOJ,MALIc,UAAWD,EAAK,KAAK,KAAK,CAAAL,MAAKA,EAAE,QAAQM,CAAG,IAG5C,CAACd,KAAOa,EAAK,KAAK,WAAW,MAAGb,IAAMa,EAAK,KAAK,CAAC,IAEjD,CAACb,EAAK,OAAM,IAAI,MAAM,uBAAuB;AACjD,SAAOD,EAAUC,CAAG;AACxB;AAMO,SAASe,EAAcF,GAAkB;AAC5C,SAAO;AAAA,IACH,MAAMA,EAAK,KAAK,IAAI,CAAAb,OAAQ;AAAA,MACxB,GAAGA;AAAA,MACH,KAAKA,EAAI,OAAOG,EAAiBH,CAAG;AAAA,MACpC,KAAKA,EAAI,OAAOU,EAAWV,CAAG;AAAA,IAAA,EAChC;AAAA,EAAA;AAEV;AAEO,MAAMgB,IAAO;AAAA,EAChB,aAAaJ;AAAA,EACb,WAAWG;AACf;"}

package/dist/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("crypto"),c={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},y=(e,r)=>e.length!==r.length?!1:a.timingSafeEqual(Buffer.from(e),Buffer.from(r)),f={HS256:{sign:(e,r)=>a.createHmac("sha256",r).update(e).digest("base64url"),verify:(e,r,t)=>{const i=a.createHmac("sha256",r).update(e).digest("base64url");return y(i,t)}},HS384:{sign:(e,r)=>a.createHmac("sha384",r).update(e).digest("base64url"),verify:(e,r,t)=>{const i=a.createHmac("sha384",r).update(e).digest("base64url");return y(i,t)}},HS512:{sign:(e,r)=>a.createHmac("sha512",r).update(e).digest("base64url"),verify:(e,r,t)=>{const i=a.createHmac("sha512",r).update(e).digest("base64url");return y(i,t)}},RS256:{sign:(e,r)=>a.createSign("RSA-SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},RS384:{sign:(e,r)=>a.createSign("RSA-SHA384").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA384").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},RS512:{sign:(e,r)=>a.createSign("RSA-SHA512").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA512").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES256:{sign:(e,r)=>a.createSign("SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES384:{sign:(e,r)=>a.createSign("SHA384").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA384").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES512:{sign:(e,r)=>a.createSign("SHA512").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA512").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES256K:{sign:(e,r)=>a.createSign("SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},PS256:{sign:(e,r)=>a.createSign("RSA-SHA256").update(e).end().sign({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:32}).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA256").update(e).end().verify({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:32},Buffer.from(t,"base64url"))}catch{return!1}}},PS384:{sign:(e,r)=>a.createSign("RSA-SHA384").update(e).end().sign({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:48}).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA384").update(e).end().verify({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:48},Buffer.from(t,"base64url"))}catch{return!1}}},PS512:{sign:(e,r)=>a.createSign("RSA-SHA512").update(e).end().sign({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:64}).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA512").update(e).end().verify({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:64},Buffer.from(t,"base64url"))}catch{return!1}}},EdDSA:{sign:(e,r)=>a.sign(null,typeof e=="string"?Buffer.from(e,"utf8"):e,r).toString("base64url"),verify:(e,r,t)=>{try{return a.verify(null,typeof e=="string"?Buffer.from(e,"utf8"):e,r,Buffer.from(t,"base64url"))}catch{return!1}}}},T=Object.keys(f),A=e=>{const r=e.split(".");if(r.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[t,i,s]=r;if(!t||!i||!s)throw new Error("Invalid JWT: empty part detected");try{const n=JSON.parse(c.decode(t)),u=JSON.parse(c.decode(i));return{header:n,payload:u,signature:s}}catch(n){throw new Error(`Invalid JWT: malformed header or payload (${n.message})`)}},m=(e,r,t={})=>{const i=t.alg??"HS256",s=t.typ??"JWT";if(!(i in f))throw new Error(`Unsupported algorithm: ${i}`);const n={alg:i,typ:s};t.kid&&(n.kid=t.kid);const u=c.encode(JSON.stringify(n)),o=c.encode(JSON.stringify(e)),g=`${u}.${o}`,v=f[i].sign(g,r);return`${u}.${o}.${v}`},h=(e,r,t={})=>{let i;try{i=A(e)}catch(d){return{valid:!1,error:{reason:d.message,code:"INVALID_TOKEN"}}}const{header:s,payload:n,signature:u}=i,o=s.alg;if(!(o in f))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${s.alg}`,code:"INVALID_ALGORITHM"}};if(t.algorithms&&t.algorithms.length>0&&!t.algorithms.includes(o))return{valid:!1,error:{reason:`Algorithm "${o}" is not in the allowed algorithms list`,code:"ALGORITHM_NOT_ALLOWED"}};if(s.typ!==void 0&&s.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${s.typ}'`,code:"INVALID_TYPE"}};const g=`${c.encode(JSON.stringify(s))}.${c.encode(JSON.stringify(n))}`;if(!f[o].verify(g,r,u))return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}};const l=Math.floor(Date.now()/1e3),S=t.clockSkew??0;if(!t.ignoreExpiration&&n.exp!==void 0&&l>n.exp+S)return{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}};if(n.nbf!==void 0&&l+S<n.nbf)return{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}};if(n.iat!==void 0&&l+S<n.iat)return{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}};if(t.maxTokenAge!==void 0&&n.iat!==void 0){const d=l-n.iat;if(d>t.maxTokenAge)return{valid:!1,error:{reason:`Token age (${d}s) exceeds maximum allowed age (${t.maxTokenAge}s)`,code:"TOKEN_TOO_OLD"}}}if(t.issuer!==void 0){if(n.iss===void 0)return{valid:!1,error:{reason:'Token missing required issuer claim ("iss")',code:"MISSING_ISSUER"}};if(t.issuer!==n.iss)return{valid:!1,error:{reason:`Invalid token issuer: expected "${t.issuer}", got "${n.iss}"`,code:"INVALID_ISSUER"}}}if(t.subject!==void 0){if(n.sub===void 0)return{valid:!1,error:{reason:'Token missing required subject claim ("sub")',code:"MISSING_SUBJECT"}};if(t.subject!==n.sub)return{valid:!1,error:{reason:`Invalid token subject: expected "${t.subject}", got "${n.sub}"`,code:"INVALID_SUBJECT"}}}if(t.audience!==void 0){const d=n.aud;if(d===void 0)return{valid:!1,error:{reason:'Token missing required audience claim ("aud")',code:"MISSING_AUDIENCE"}};const I=Array.isArray(t.audience)?t.audience:[t.audience],p=Array.isArray(d)?d:[d];if(!I.some(b=>p.includes(b)))return{valid:!1,error:{reason:"Audience claim mismatch",code:"INVALID_AUDIENCE"}}}if(t.jwtId!==void 0){if(n.jti===void 0)return{valid:!1,error:{reason:'Token missing required JWT ID claim ("jti")',code:"MISSING_JTI"}};if(t.jwtId!==n.jti)return{valid:!1,error:{reason:`Invalid JWT ID: expected "${t.jwtId}", got "${n.jti}"`,code:"INVALID_JTI"}}}return{valid:!0,header:s,payload:n,signature:u}},_={sign:m,verify:h,decode:A,algorithms:f};exports.JWT=_;exports.SignatureAlgorithm=f;exports.SupportedAlgorithms=T;exports.base64Url=c;exports.decode=A;exports.sign=m;exports.verify=h;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("./index-CSRWSLal.cjs");exports.AutodetectAlgorithm=e.AutodetectAlgorithm;exports.JWK=e.JWK;exports.JWKS=e.JWKS;exports.JWKSToKeyObject=e.JWKSToKeyObject;exports.JWT=e.JWT;exports.SignatureAlgorithm=e.SignatureAlgorithm;exports.SupportedAlgorithms=e.SupportedAlgorithms;exports.base64Url=e.base64Url;exports.computeX5T=e.computeX5T;exports.decode=e.decode;exports.exportJWK=e.exportJWK;exports.getJWKThumbprint=e.getJWKThumbprint;exports.importJWK=e.importJWK;exports.normalizeJWKS=e.normalizeJWKS;exports.sign=e.sign;exports.toPublicJWK=e.toPublicJWK;exports.verify=e.verify;
 //# sourceMappingURL=index.cjs.js.map