@sourceregistry/node-jwt 1.5.6 → 1.5.8

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/@sourceregistry/node-jwt?logo=npm)](https://www.npmjs.com/package/@sourceregistry/node-jwt)
 [![JSR](https://jsr.io/badges/@sourceregistry/node-jwt)](https://jsr.io/@sourceregistry/node-jwt)
 [![License](https://img.shields.io/npm/l/@sourceregistry/node-jwt)](https://github.com/SourceRegistry/node-jwt/blob/main/LICENSE)
-[![CI](https://github.com/SourceRegistry/node-jwt/actions/workflows/test.yml/badge.svg)](https://github.com/SourceRegistry/node-jwt/actions)
+[![CI](https://github.com/SourceRegistry/node-jwt/actions/workflows/ci.yml/badge.svg)](https://github.com/SourceRegistry/node-jwt/actions)
 [![Codecov](https://img.shields.io/codecov/c/github/SourceRegistry/node-jwt)](https://codecov.io/gh/SourceRegistry/node-jwt)
 
 A minimal, secure, and production-ready JWT (JSON Web Token) library for Node.js with zero dependencies. Supports all standard signing algorithms (HMAC, RSA, ECDSA, EdDSA, RSASSA-PSS), **automatic algorithm detection**, **JWK/JWKS**, and full claim validation.
@@ -213,6 +213,7 @@ See runnable examples in:
 * ✅ Claim validation (`iss`, `sub`, `aud`, `jti`)
 * ✅ Maximum token age enforcement
 * ✅ Timing-safe signature comparison
+* ✅ Rejects unsupported critical JOSE headers (`crit`)
 * ✅ No insecure defaults
 
 ## ✅ Production Checklist
@@ -249,12 +250,14 @@ For **ECDSA** algorithms (`ES256`, `ES384`, `ES512`, `ES256K`) there are two com
 - **JOSE** (`r || s` raw signature) — required by the JWT/JWS spec and used by systems like **VAPID/Web Push (WNS)**
 
 ### Default behavior
-By default, this library outputs **DER** signatures for `ES*` algorithms to match Node.js/OpenSSL defaults.
+By default, this library outputs **JOSE** signatures for `ES*` algorithms so generated JWTs are JWS-compliant.
+Internally, Node.js/OpenSSL produces DER signatures and the library converts them to JOSE.
 
-### Enable JOSE output
-To generate spec-compliant JOSE ECDSA signatures, set:
+### Enable strict JOSE or DER behavior
+`sign()` and `verify()` accept:
 
-- `signatureFormat: "jose"` in `sign()`
+- `signatureFormat: "jose"` for explicit JOSE handling
+- `signatureFormat: "der"` for interoperability with non-standard DER-based tokens
 
 ```ts
 import { sign, verify } from "@sourceregistry/node-jwt";
@@ -262,7 +265,7 @@ import { sign, verify } from "@sourceregistry/node-jwt";
 const token = sign(
   { sub: "123", iat: Math.floor(Date.now() / 1000) },
   ecPrivateKey,
-  { alg: "ES256", signatureFormat: "jose" }
+  { alg: "ES256" } // defaults to JOSE for ES*
 );
 
 // Verify JOSE-signed token
@@ -271,11 +274,15 @@ const result = verify(token, ecPublicKey, { signatureFormat: "jose" });
 
 ### Auto-detect verification (optional)
 
-If enabled in your version, `verify()` can also validate JOSE ECDSA signatures without specifying `signatureFormat` (it will try DER first, then JOSE).
+`verify()` can also validate JOSE ECDSA signatures without specifying `signatureFormat` (it will try DER first, then JOSE).
 If you want strict behavior, pass `signatureFormat: "der"` or `signatureFormat: "jose"` explicitly.
 
 > 💡 For VAPID/Web Push (e.g. Windows WNS endpoints), you typically need `ES256` with `signatureFormat: "jose"`.
 
+### Critical headers
+Verification rejects tokens that declare unsupported critical header parameters via `crit`.
+This prevents the library from silently accepting JWTs that require header processing it does not implement.
+
 
 ## 📚 API Reference
 
@@ -294,6 +301,7 @@ Includes algorithm whitelist protection and full claim validation.
 * `INVALID_TOKEN`
 * `INVALID_ALGORITHM`
 * `ALGORITHM_NOT_ALLOWED`
+* `UNSUPPORTED_CRITICAL_HEADER`
 * `INVALID_SIGNATURE`
 * `TOKEN_EXPIRED`
 * `TOKEN_NOT_ACTIVE`

package/dist/index-CaEvPIqc.cjs

@@ -0,0 +1,2 @@
+"use strict";const l=require("crypto"),K={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},X=(e,t)=>e.length!==t.length?!1:l.timingSafeEqual(Buffer.from(e),Buffer.from(t)),D=/^[A-Za-z0-9_-]+$/;function $(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function T(e){return typeof e=="number"&&Number.isFinite(e)}function O(e){return Array.isArray(e)&&e.every(t=>typeof t=="string")}function Y(e){const t=[{claim:"iss",valid:e.iss===void 0||typeof e.iss=="string",expected:"string"},{claim:"sub",valid:e.sub===void 0||typeof e.sub=="string",expected:"string"},{claim:"jti",valid:e.jti===void 0||typeof e.jti=="string",expected:"string"},{claim:"sid",valid:e.sid===void 0||typeof e.sid=="string",expected:"string"},{claim:"iat",valid:e.iat===void 0||T(e.iat),expected:"number"},{claim:"exp",valid:e.exp===void 0||T(e.exp),expected:"number"},{claim:"nbf",valid:e.nbf===void 0||T(e.nbf),expected:"number"}];for(const r of t)if(!r.valid)return{reason:`Invalid "${r.claim}" claim: expected ${r.expected}`,code:"INVALID_CLAIM"};return e.aud!==void 0&&!(typeof e.aud=="string"||O(e.aud))?{reason:'Invalid "aud" claim: expected string or string[]',code:"INVALID_CLAIM"}:null}function Z(e){if(e.signatureFormat!==void 0&&e.signatureFormat!=="der"&&e.signatureFormat!=="jose")return{reason:'Invalid signatureFormat option: expected "der" or "jose"',code:"INVALID_OPTIONS"};if(e.clockSkew!==void 0&&(!T(e.clockSkew)||e.clockSkew<0))return{reason:"Invalid clockSkew option: expected a non-negative finite number",code:"INVALID_OPTIONS"};if(e.maxTokenAge!==void 0&&(!T(e.maxTokenAge)||e.maxTokenAge<0))return{reason:"Invalid maxTokenAge option: expected a non-negative finite number",code:"INVALID_OPTIONS"};if(e.issuer!==void 0&&typeof e.issuer!="string")return{reason:"Invalid issuer option: expected string",code:"INVALID_OPTIONS"};if(e.subject!==void 0&&typeof e.subject!="string")return{reason:"Invalid subject option: expected string",code:"INVALID_OPTIONS"};if(e.jwtId!==void 0&&typeof e.jwtId!="string")return{reason:"Invalid jwtId option: expected string",code:"INVALID_OPTIONS"};if(e.audience!==void 0&&!(typeof e.audience=="string"||O(e.audience)))return{reason:"Invalid audience option: expected string or string[]",code:"INVALID_OPTIONS"};if(e.algorithms!==void 0){if(!Array.isArray(e.algorithms))return{reason:"Invalid algorithms option: expected an array",code:"INVALID_OPTIONS"};const t=e.algorithms.find(r=>!(r in v));if(t)return{reason:`Invalid algorithms option: unsupported algorithm "${t}"`,code:"INVALID_OPTIONS"}}return null}function Q(e){return e.crit!==void 0?!O(e.crit)||e.crit.length===0?{reason:'Invalid "crit" header: expected non-empty string[]',code:"INVALID_HEADER"}:{reason:`Unsupported critical header parameters: ${e.crit.join(", ")}`,code:"UNSUPPORTED_CRITICAL_HEADER"}:null}function V(e){switch(e){case"ES256":case"ES256K":return 64;case"ES384":return 96;case"ES512":return 132;default:throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`)}}function ee(e,t){let r=0;if(e[r++]!==48)throw new Error("Invalid DER ECDSA signature");let n=e[r++];if(n&128){const d=n&127;n=0;for(let m=0;m<d;m++)n=n<<8|e[r++]}if(e[r++]!==2)throw new Error("Invalid DER ECDSA signature (r)");const a=e[r++];let c=e.subarray(r,r+a);if(r+=a,e[r++]!==2)throw new Error("Invalid DER ECDSA signature (s)");const o=e[r++];let i=e.subarray(r,r+o);for(;c.length>t/2&&c[0]===0;)c=c.subarray(1);for(;i.length>t/2&&i[0]===0;)i=i.subarray(1);const h=Buffer.concat([Buffer.alloc(t/2-c.length,0),c]),u=Buffer.concat([Buffer.alloc(t/2-i.length,0),i]);return Buffer.concat([h,u])}function R(e){const t=e.length/2;let r=e.subarray(0,t),n=e.subarray(t);for(;r.length>1&&r[0]===0&&(r[1]&128)===0;)r=r.subarray(1);for(;n.length>1&&n[0]===0&&(n[1]&128)===0;)n=n.subarray(1);r[0]&128&&(r=Buffer.concat([Buffer.from([0]),r])),n[0]&128&&(n=Buffer.concat([Buffer.from([0]),n]));const a=Buffer.concat([Buffer.from([2,r.length]),r]),c=Buffer.concat([Buffer.from([2,n.length]),n]),o=a.length+c.length;let i;if(o<128)i=Buffer.from([o]);else{const h=[];let u=o;for(;u>0;)h.unshift(u&255),u>>=8;i=Buffer.from([128|h.length,...h])}return Buffer.concat([Buffer.from([48]),i,a,c])}function W(e){return e==="ES256"||e==="ES384"||e==="ES512"||e==="ES256K"}const P=e=>({sign:(t,r)=>l.createHmac(e,r).update(t).digest("base64url"),verify:(t,r,n)=>{const a=l.createHmac(e,r).update(t).digest("base64url");return X(a,n)}}),E=e=>({sign:(t,r)=>l.createSign(e).update(t).end().sign(r).toString("base64url"),verify:(t,r,n)=>{try{return l.createVerify(e).update(t).end().verify(r,Buffer.from(n,"base64url"))}catch{return!1}}}),k=(e,t)=>({sign:(r,n)=>l.createSign(e).update(r).end().sign({key:n,padding:l.constants.RSA_PKCS1_PSS_PADDING,saltLength:t}).toString("base64url"),verify:(r,n,a)=>{try{return l.createVerify(e).update(r).end().verify({key:n,padding:l.constants.RSA_PKCS1_PSS_PADDING,saltLength:t},Buffer.from(a,"base64url"))}catch{return!1}}}),re={sign:(e,t)=>l.sign(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t).toString("base64url"),verify:(e,t,r)=>{try{return l.verify(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t,Buffer.from(r,"base64url"))}catch{return!1}}},v={HS256:P("sha256"),HS384:P("sha384"),HS512:P("sha512"),RS256:E("RSA-SHA256"),RS384:E("RSA-SHA384"),RS512:E("RSA-SHA512"),ES256:E("SHA256"),ES384:E("SHA384"),ES512:E("SHA512"),ES256K:E("SHA256"),PS256:k("RSA-SHA256",32),PS384:k("RSA-SHA384",48),PS512:k("RSA-SHA512",64),EdDSA:re},te=Object.keys(v);function L(e){if(e.type==="secret")return"HS256";if(e.type!=="private")throw new Error("Only private or symmetric keys can be used to sign JWTs");const t=e.asymmetricKeyType,r=e.asymmetricKeyDetails;switch(t){case"rsa":return"RS256";case"rsa-pss":{const n=(r==null?void 0:r.hashAlgorithm)??"sha256";switch(n){case"sha256":return"PS256";case"sha384":return"PS384";case"sha512":return"PS512";default:throw new Error(`Unsupported RSA-PSS hash algorithm: ${n}`)}}case"ec":{const n=r==null?void 0:r.namedCurve;switch(n){case"P-256":case"prime256v1":return"ES256";case"P-384":case"secp384r1":return"ES384";case"P-521":case"secp521r1":return"ES512";case"secp256k1":return"ES256K";default:throw new Error(`Unsupported EC curve: ${n}`)}}case"ed25519":return"EdDSA";default:throw new Error(`Unsupported asymmetric key type: ${t}`)}}function ne(e){if(typeof e=="object"&&"type"in e)return e;try{return l.createPrivateKey(e)}catch{const t=typeof e=="string"?Buffer.from(e,"utf8"):Buffer.isBuffer(e)?e:(()=>{throw new Error("Unsupported key type")})();return l.createSecretKey(t)}}const _=e=>{const t=e.split(".");if(t.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[r,n,a]=t;if(!r||!n||!a)throw new Error("Invalid JWT: empty part detected");if(!D.test(r)||!D.test(n)||!D.test(a))throw new Error("Invalid JWT: non-base64url characters detected");try{const c=JSON.parse(K.decode(r)),o=JSON.parse(K.decode(n));if(!$(c)||!$(o))throw new Error("header and payload must be JSON objects");const i=c,h=o;if(typeof i.alg!="string"||i.alg.length===0)throw new Error("header.alg must be a non-empty string");if(i.typ!==void 0&&typeof i.typ!="string")throw new Error("header.typ must be a string");if(i.kid!==void 0&&typeof i.kid!="string")throw new Error("header.kid must be a string");if(i.crit!==void 0&&(!O(i.crit)||i.crit.length===0))throw new Error("header.crit must be a non-empty string[]");return{header:i,payload:h,signature:a}}catch(c){throw new Error(`Invalid JWT: malformed header or payload (${c.message})`)}},U=(e,t,r={})=>{const n=ne(t),a=r.alg??L(n),c=r.signatureFormat??(W(a)?"jose":"der"),o=r.typ??"JWT";if(!(a in v))throw new Error(`Unsupported algorithm: ${a}`);const i={alg:a,typ:o};r.kid&&(i.kid=r.kid);const h=K.encode(JSON.stringify(i)),u=K.encode(JSON.stringify(e)),d=`${h}.${u}`;let m=v[a].sign(d,t);if(c==="jose"&&W(a)){const p=Buffer.from(m,"base64url");m=ee(p,V(a)).toString("base64url")}return`${h}.${u}.${m}`},j=(e,t,r={})=>{const n=Z(r);if(n)return{valid:!1,error:n};let a;try{a=_(e)}catch(s){return{valid:!1,error:{reason:s.message,code:"INVALID_TOKEN"}}}const{header:c,payload:o,signature:i}=a,h=Q(c);if(h)return{valid:!1,error:h};const u=Y(o);if(u)return{valid:!1,error:u};const d=c.alg;if(!(d in v))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${c.alg}`,code:"INVALID_ALGORITHM"}};if(r.algorithms&&r.algorithms.length>0&&!r.algorithms.includes(d))return{valid:!1,error:{reason:`Algorithm "${d}" is not in the allowed algorithms list`,code:"ALGORITHM_NOT_ALLOWED"}};if(c.typ!==void 0&&c.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${c.typ}'`,code:"INVALID_TYPE"}};const[m,p]=e.split("."),I=`${m}.${p}`;if(W(d)){const s=r.signatureFormat;let f;if(s==="jose")try{const y=Buffer.from(i,"base64url"),S=R(y).toString("base64url");f=v[d].verify(I,t,S)}catch{f=!1}else if(s==="der")f=v[d].verify(I,t,i);else if(f=v[d].verify(I,t,i),!f)try{const y=Buffer.from(i,"base64url");if(y.length===V(d)){const S=R(y).toString("base64url");f=v[d].verify(I,t,S)}}catch{}if(!f)return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}}}else{let s=!1;try{s=v[d].verify(I,t,i)}catch{s=!1}if(!s)return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}}}const A=Math.floor(Date.now()/1e3),g=r.clockSkew??0;if(!r.ignoreExpiration&&o.exp!==void 0&&A>o.exp+g)return{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}};if(o.nbf!==void 0&&A+g<o.nbf)return{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}};if(o.iat!==void 0&&A+g<o.iat)return{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}};if(r.maxTokenAge!==void 0&&o.iat!==void 0){const s=A-o.iat;if(s>r.maxTokenAge)return{valid:!1,error:{reason:`Token age (${s}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,code:"TOKEN_TOO_OLD"}}}if(r.issuer!==void 0){if(o.iss===void 0)return{valid:!1,error:{reason:'Token missing required issuer claim ("iss")',code:"MISSING_ISSUER"}};if(r.issuer!==o.iss)return{valid:!1,error:{reason:`Invalid token issuer: expected "${r.issuer}", got "${o.iss}"`,code:"INVALID_ISSUER"}}}if(r.subject!==void 0){if(o.sub===void 0)return{valid:!1,error:{reason:'Token missing required subject claim ("sub")',code:"MISSING_SUBJECT"}};if(r.subject!==o.sub)return{valid:!1,error:{reason:`Invalid token subject: expected "${r.subject}", got "${o.sub}"`,code:"INVALID_SUBJECT"}}}if(r.audience!==void 0){const s=o.aud;if(s===void 0)return{valid:!1,error:{reason:'Token missing required audience claim ("aud")',code:"MISSING_AUDIENCE"}};const f=Array.isArray(r.audience)?r.audience:[r.audience],y=Array.isArray(s)?s:[s];if(!f.some(b=>y.includes(b)))return{valid:!1,error:{reason:"Audience claim mismatch",code:"INVALID_AUDIENCE"}}}if(r.jwtId!==void 0){if(o.jti===void 0)return{valid:!1,error:{reason:'Token missing required JWT ID claim ("jti")',code:"MISSING_JTI"}};if(r.jwtId!==o.jti)return{valid:!1,error:{reason:`Invalid JWT ID: expected "${r.jwtId}", got "${o.jti}"`,code:"INVALID_JTI"}}}return{valid:!0,header:c,payload:o,signature:i}},ie={sign:U,verify:j,decode:_,algorithms:v};function H(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");return e.export({format:"jwk"})}function J(e){if(!e||typeof e!="object")throw new Error("Invalid JWK");switch(e.kty){case"oct":{if(!("k"in e)||typeof e.k!="string")throw new Error('Invalid oct JWK: missing "k"');return l.createSecretKey(Buffer.from(e.k,"base64url"))}case"RSA":case"EC":case"OKP":return"d"in e&&typeof e.d=="string"?l.createPrivateKey({format:"jwk",key:e}):l.createPublicKey({format:"jwk",key:e});default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}}function C(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");const r=(e.type==="private"?l.createPublicKey(e):e).export({format:"jwk"});return delete r.d,delete r.p,delete r.q,delete r.dp,delete r.dq,delete r.qi,r}function B(e,t="sha256"){if(!e||typeof e!="object")throw new Error("Invalid JWK");let r;switch(e.kty){case"RSA":r={e:e.e,kty:e.kty,n:e.n};break;case"EC":r={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":r={crv:e.crv,kty:e.kty,x:e.x};break;case"oct":r={k:e.k,kty:e.kty};break;default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}const n=JSON.stringify(Object.keys(r).sort().reduce((a,c)=>(a[c]=r[c],a),{}));return l.createHash(t).update(n).digest("base64url")}function M(e){var t;if((t=e.x5c)!=null&&t.length)return l.createHash("sha1").update(Buffer.from(e.x5c[0],"base64")).digest("base64url")}const ae={export:H,import:J,toPublic:C,thumbprint:B};function F(e,t){if(!e||!Array.isArray(e.keys))throw new Error("Invalid JWKS");let r;if(t&&(r=e.keys.find(n=>n.kid===t)),!r&&e.keys.length===1&&(r=e.keys[0]),!r)throw new Error("Key not found in JWKS");return J(r)}function N(e){return{keys:w(...e.keys)}}function w(...e){return e.map(t=>{const r={...t,kid:t.kid??B(t),x5t:t.x5t??M(t)};return Object.defineProperty(r,"toKeyObject",{enumerable:!1,configurable:!1,writable:!1,value:()=>J(r)}),r})}const G=async(e,t={})=>{const r=typeof e=="string"?e:e.toString(),n=t.fetch??globalThis.fetch,a=Math.max(0,t.ttl??5*6e4),c=Math.max(0,t.timeoutMs??5e3),o="/.well-known/jwks.json";if(!n)throw new Error("No fetch implementation available");const i=(()=>{if(t.endpointOverride){const g=t.endpointOverride;try{return new URL(g,r).toString()}catch{return g}}return t.overrideEndpointCheck||r.endsWith(o)?r:`${r.replace(/\/+$/,"")}${o}`})(),h=(()=>{if(t.cache)return t.cache;let g;return{get:()=>g,set:(s,f)=>{g=f}}})();let u,d=0,m,p=0;const I=async g=>{if(m)return m;m=(async()=>{const s=new AbortController;let f;c>0&&(f=setTimeout(()=>s.abort(),c));let y;try{y=await n(i,{signal:s.signal})}catch(b){throw s.signal.aborted?new Error(`JWKS fetch timed out after ${c}ms`):b}finally{f&&clearTimeout(f)}if(!y.ok)throw new Error(`Failed to fetch JWKS: ${y.status} ${y.statusText}`);const S=await y.json();if(!S||typeof S!="object"||!Array.isArray(S.keys))throw new Error("Invalid JWKS");return N(S)})();try{const s=await m;return u=s,await h.set(i,s),p=0,a>0&&(d=Date.now()+a),s}catch(s){if(!g||!u)throw s;if(p+=1,a>0){const f=Math.min(Math.max(a,3e4)*Math.pow(2,p-1),9e5);d=Date.now()+f}return console.warn(`JWKS refresh failed for "${i}", using stale cache.`,s),u}finally{m=void 0}};u=await h.get(i),u?(u=N(u),a>0&&(d=Date.now()+a)):u=await I(!1);const A={async list(){return a>0&&Date.now()>=d&&await I(!0),w(...u.keys)},async refresh(){return await I(!1),A},async key(g){const f=(await A.list()).find(y=>y.kid===g);if(f)return w(f)[0]},async find(g){const s=await A.list(),f=Object.entries(g);return f.length===0?w(...s):w(...s.filter(y=>f.every(([S,b])=>{const x=y[S];return Array.isArray(b)?Array.isArray(x)&&x.length===b.length&&x.every((q,z)=>q===b[z]):x===b})))},async findFirst(g){return A.find(g).then(([s])=>s)},export(){return u}};return A},oe={toKeyObject:F,normalize:N,fromWeb:G};exports.AutodetectAlgorithm=L;exports.JWK=ae;exports.JWKS=oe;exports.JWKSToKeyObject=F;exports.JWT=ie;exports.SignatureAlgorithm=v;exports.SupportedAlgorithms=te;exports.base64Url=K;exports.computeX5T=M;exports.decode=_;exports.exportJWK=H;exports.fromWeb=G;exports.getJWKThumbprint=B;exports.importJWK=J;exports.normalizeJWK=w;exports.normalizeJWKS=N;exports.sign=U;exports.toPublicJWK=C;exports.verify=j;
+//# sourceMappingURL=index-CaEvPIqc.cjs.map

package/dist/index-CaEvPIqc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CaEvPIqc.cjs","sources":["../src/jwt/index.ts","../src/jwks/index.ts"],"sourcesContent":["import crypto, {\n    createHmac,\n    createSign,\n    createVerify,\n    createPrivateKey,\n    createSecretKey,\n    sign as cryptoSign,\n    verify as cryptoVerify,\n    timingSafeEqual,\n    type BinaryLike,\n    type KeyLike,\n    type KeyObject\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n    encode: (input: string | Buffer): string => Buffer.from(input).toString('base64url'),\n    decode: (input: string): string => Buffer.from(input, 'base64url').toString()\n};\n\n/**\n * Timing-safe string comparison to prevent timing attacks\n * @param a\n * @param b\n */\nconst timingSafeCompare = (a: string, b: string): boolean => {\n    if (a.length !== b.length) {\n        return false;\n    }\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n    /**\n     * Issuer\n     */\n    iss?: string;\n    /**\n     * Subject\n     */\n    sub?: string;\n    /**\n     * Audience\n     */\n    aud?: string | string[];\n    /**\n     * Expiration Time (as UNIX timestamp)\n     */\n    exp?: number;\n    /**\n     * Not Before (as UNIX timestamp)\n     */\n    nbf?: number;\n    /**\n     * Issued At (as UNIX timestamp)\n     */\n    iat?: number;\n    /**\n     * JWT ID\n     */\n    jti?: string;\n    /**\n     * Session ID\n     */\n    sid?: string;\n\n    /**\n     * Custom claims\n     */\n    [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n    alg: string; // Allow unknown algs during decode\n    typ?: string;\n    kid?: string;\n    crit?: string[];\n    [key: string]: unknown;\n}\n\nexport interface JWT {\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string;\n}\n\nconst BASE64URL_SEGMENT_REGEX = /^[A-Za-z0-9_-]+$/;\n\nfunction isPlainObject(input: unknown): input is Record<string, unknown> {\n    return typeof input === 'object' && input !== null && !Array.isArray(input);\n}\n\nfunction isFiniteNumber(input: unknown): input is number {\n    return typeof input === 'number' && Number.isFinite(input);\n}\n\nfunction isStringArray(input: unknown): input is string[] {\n    return Array.isArray(input) && input.every((value) => typeof value === 'string');\n}\n\nfunction validateRegisteredClaims(payload: JWTPayload): { reason: string; code: string } | null {\n    const claimValidators: Array<{ claim: keyof JWTPayload; valid: boolean; expected: string }> = [\n        {claim: 'iss', valid: payload.iss === undefined || typeof payload.iss === 'string', expected: 'string'},\n        {claim: 'sub', valid: payload.sub === undefined || typeof payload.sub === 'string', expected: 'string'},\n        {claim: 'jti', valid: payload.jti === undefined || typeof payload.jti === 'string', expected: 'string'},\n        {claim: 'sid', valid: payload.sid === undefined || typeof payload.sid === 'string', expected: 'string'},\n        {claim: 'iat', valid: payload.iat === undefined || isFiniteNumber(payload.iat), expected: 'number'},\n        {claim: 'exp', valid: payload.exp === undefined || isFiniteNumber(payload.exp), expected: 'number'},\n        {claim: 'nbf', valid: payload.nbf === undefined || isFiniteNumber(payload.nbf), expected: 'number'},\n    ];\n\n    for (const entry of claimValidators) {\n        if (!entry.valid) {\n            return {\n                reason: `Invalid \"${entry.claim}\" claim: expected ${entry.expected}`,\n                code: 'INVALID_CLAIM'\n            };\n        }\n    }\n\n    if (payload.aud !== undefined) {\n        const isValidAudience = typeof payload.aud === 'string' || isStringArray(payload.aud);\n        if (!isValidAudience) {\n            return {\n                reason: 'Invalid \"aud\" claim: expected string or string[]',\n                code: 'INVALID_CLAIM'\n            };\n        }\n    }\n\n    return null;\n}\n\nfunction validateVerifyOptions(options: VerifyOptions): { reason: string; code: string } | null {\n    if (options.signatureFormat !== undefined && options.signatureFormat !== 'der' && options.signatureFormat !== 'jose') {\n        return {\n            reason: 'Invalid signatureFormat option: expected \"der\" or \"jose\"',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.clockSkew !== undefined && (!isFiniteNumber(options.clockSkew) || options.clockSkew < 0)) {\n        return {\n            reason: 'Invalid clockSkew option: expected a non-negative finite number',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.maxTokenAge !== undefined && (!isFiniteNumber(options.maxTokenAge) || options.maxTokenAge < 0)) {\n        return {\n            reason: 'Invalid maxTokenAge option: expected a non-negative finite number',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.issuer !== undefined && typeof options.issuer !== 'string') {\n        return {\n            reason: 'Invalid issuer option: expected string',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.subject !== undefined && typeof options.subject !== 'string') {\n        return {\n            reason: 'Invalid subject option: expected string',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.jwtId !== undefined && typeof options.jwtId !== 'string') {\n        return {\n            reason: 'Invalid jwtId option: expected string',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.audience !== undefined) {\n        const isValidAudience = typeof options.audience === 'string' || isStringArray(options.audience);\n        if (!isValidAudience) {\n            return {\n                reason: 'Invalid audience option: expected string or string[]',\n                code: 'INVALID_OPTIONS'\n            };\n        }\n    }\n\n    if (options.algorithms !== undefined) {\n        if (!Array.isArray(options.algorithms)) {\n            return {\n                reason: 'Invalid algorithms option: expected an array',\n                code: 'INVALID_OPTIONS'\n            };\n        }\n\n        const invalidAlgorithm = options.algorithms.find((alg) => !(alg in SignatureAlgorithm));\n        if (invalidAlgorithm) {\n            return {\n                reason: `Invalid algorithms option: unsupported algorithm \"${invalidAlgorithm}\"`,\n                code: 'INVALID_OPTIONS'\n            };\n        }\n    }\n\n    return null;\n}\n\nfunction validateProtectedHeader(header: JWTHeader): { reason: string; code: string } | null {\n    if (header.crit !== undefined) {\n        if (!isStringArray(header.crit) || header.crit.length === 0) {\n            return {\n                reason: 'Invalid \"crit\" header: expected non-empty string[]',\n                code: 'INVALID_HEADER'\n            };\n        }\n\n        return {\n            reason: `Unsupported critical header parameters: ${header.crit.join(', ')}`,\n            code: 'UNSUPPORTED_CRITICAL_HEADER'\n        };\n    }\n\n    return null;\n}\n\n\n//JOSE-helpers\nfunction joseLenForAlg(alg: string): number {\n    switch (alg) {\n        case 'ES256':\n        case 'ES256K':\n            return 64;  // 32 + 32\n        case 'ES384':\n            return 96;  // 48 + 48\n        case 'ES512':\n            return 132; // 66 + 66 (P-521)\n        /* c8 ignore next 2 */\n        default:\n            throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${alg}`);\n    }\n}\n\nfunction derToJose(der: Buffer, outLen: number): Buffer {\n    let i = 0;\n    if (der[i++] !== 0x30) throw new Error('Invalid DER ECDSA signature');\n\n    // seq length (short/long form)\n    let seqLen = der[i++];\n    if (seqLen & 0x80) {\n        const n = seqLen & 0x7f;\n        seqLen = 0;\n        for (let k = 0; k < n; k++) seqLen = (seqLen << 8) | der[i++];\n    }\n\n    if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (r)');\n    const rLen = der[i++];\n    let r = der.subarray(i, i + rLen);\n    i += rLen;\n\n    if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (s)');\n    const sLen = der[i++];\n    let s = der.subarray(i, i + sLen);\n\n    // strip leading zeros\n    while (r.length > outLen / 2 && r[0] === 0x00) r = r.subarray(1);\n    while (s.length > outLen / 2 && s[0] === 0x00) s = s.subarray(1);\n\n    const rPad = Buffer.concat([Buffer.alloc(outLen / 2 - r.length, 0), r]);\n    const sPad = Buffer.concat([Buffer.alloc(outLen / 2 - s.length, 0), s]);\n    return Buffer.concat([rPad, sPad]);\n}\n\nfunction joseToDer(jose: Buffer): Buffer {\n    const half = jose.length / 2;\n    let r = jose.subarray(0, half);\n    let s = jose.subarray(half);\n\n    // trim leading zeros\n    while (r.length > 1 && r[0] === 0x00 && (r[1] & 0x80) === 0) r = r.subarray(1);\n    while (s.length > 1 && s[0] === 0x00 && (s[1] & 0x80) === 0) s = s.subarray(1);\n\n    // if high bit set, prepend 0x00\n    if (r[0] & 0x80) r = Buffer.concat([Buffer.from([0x00]), r]);\n    if (s[0] & 0x80) s = Buffer.concat([Buffer.from([0x00]), s]);\n\n    const rPart = Buffer.concat([Buffer.from([0x02, r.length]), r]);\n    const sPart = Buffer.concat([Buffer.from([0x02, s.length]), s]);\n\n    const seqLen = rPart.length + sPart.length;\n\n    let lenBytes: Buffer;\n    if (seqLen < 0x80) {\n        lenBytes = Buffer.from([seqLen]);\n    } else {\n        const tmp: number[] = [];\n        let n = seqLen;\n        while (n > 0) {\n            tmp.unshift(n & 0xff);\n            n >>= 8;\n        }\n        lenBytes = Buffer.from([0x80 | tmp.length, ...tmp]);\n    }\n\n    return Buffer.concat([Buffer.from([0x30]), lenBytes, rPart, sPart]);\n}\n\nfunction isEcdsaAlg(alg: string): boolean {\n    return alg === 'ES256' || alg === 'ES384' || alg === 'ES512' || alg === 'ES256K';\n}\n\ntype SignatureAlgorithmImplementation = {\n    sign: (data: BinaryLike, secret: KeyLike) => string;\n    verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;\n};\n\ntype SignatureAlgorithmsMap = {\n    HS256: SignatureAlgorithmImplementation;\n    HS384: SignatureAlgorithmImplementation;\n    HS512: SignatureAlgorithmImplementation;\n    RS256: SignatureAlgorithmImplementation;\n    RS384: SignatureAlgorithmImplementation;\n    RS512: SignatureAlgorithmImplementation;\n    ES256: SignatureAlgorithmImplementation;\n    ES384: SignatureAlgorithmImplementation;\n    ES512: SignatureAlgorithmImplementation;\n    ES256K: SignatureAlgorithmImplementation;\n    PS256: SignatureAlgorithmImplementation;\n    PS384: SignatureAlgorithmImplementation;\n    PS512: SignatureAlgorithmImplementation;\n    EdDSA: SignatureAlgorithmImplementation;\n};\n\nconst createHmacAlgorithm = (algorithm: string): SignatureAlgorithmImplementation => ({\n    sign: (data: BinaryLike, secret: KeyLike): string =>\n        createHmac(algorithm, secret).update(data).digest('base64url'),\n    verify: (data: BinaryLike, secret: KeyLike, signature: string): boolean => {\n        const expected = createHmac(algorithm, secret).update(data).digest('base64url');\n        return timingSafeCompare(expected, signature);\n    }\n});\n\nconst createVerifyAlgorithm = (algorithm: string): SignatureAlgorithmImplementation => ({\n    sign: (data: BinaryLike, secret: KeyLike): string =>\n        createSign(algorithm).update(data).end().sign(secret).toString('base64url'),\n    verify: (data: BinaryLike, secret: KeyLike, signature: string): boolean => {\n        try {\n            return createVerify(algorithm)\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'));\n        } catch {\n            return false;\n        }\n    }\n});\n\nconst createPssAlgorithm = (algorithm: string, saltLength: number): SignatureAlgorithmImplementation => ({\n    sign: (data: BinaryLike, secret: KeyLike): string =>\n        createSign(algorithm)\n            .update(data)\n            .end()\n            .sign({\n                //@ts-ignore\n                key: secret,\n                padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                saltLength\n            })\n            .toString('base64url'),\n    verify: (data: BinaryLike, secret: KeyLike, signature: string): boolean => {\n        try {\n            return createVerify(algorithm)\n                .update(data)\n                .end()\n                .verify({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength\n                }, Buffer.from(signature, 'base64url'));\n        } catch {\n            return false;\n        }\n    }\n});\n\nconst edDsaAlgorithm: SignatureAlgorithmImplementation = {\n    sign: (data: BinaryLike, secret: KeyLike): string =>\n        cryptoSign(null, typeof data === 'string' ? Buffer.from(data, 'utf8') : data, secret)\n            .toString('base64url'),\n    verify: (data: BinaryLike, secret: KeyLike, signature: string): boolean => {\n        try {\n            return cryptoVerify(\n                null,\n                typeof data === 'string' ? Buffer.from(data, 'utf8') : data,\n                secret,\n                Buffer.from(signature, 'base64url')\n            );\n        } catch {\n            return false;\n        }\n    }\n};\n\n\n// Signature algorithms\nexport const SignatureAlgorithm: SignatureAlgorithmsMap = {\n    // HMAC\n    HS256: createHmacAlgorithm('sha256'),\n    HS384: createHmacAlgorithm('sha384'),\n    HS512: createHmacAlgorithm('sha512'),\n\n    // RSA (DER-encoded signatures, base64url)\n    RS256: createVerifyAlgorithm('RSA-SHA256'),\n    RS384: createVerifyAlgorithm('RSA-SHA384'),\n    RS512: createVerifyAlgorithm('RSA-SHA512'),\n\n    // ECDSA (Node/OpenSSL emits DER; sign() converts to JOSE by default for JWTs)\n    ES256: createVerifyAlgorithm('SHA256'),\n    ES384: createVerifyAlgorithm('SHA384'),\n    ES512: createVerifyAlgorithm('SHA512'),\n    ES256K: createVerifyAlgorithm('SHA256'),\n    PS256: createPssAlgorithm('RSA-SHA256', 32),\n    PS384: createPssAlgorithm('RSA-SHA384', 48),\n    PS512: createPssAlgorithm('RSA-SHA512', 64),\n    EdDSA: edDsaAlgorithm\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Autodetection of algorithm for KeyObjects\n * @param key\n * @constructor\n */\nexport function AutodetectAlgorithm(key: KeyObject): SupportedAlgorithm {\n    if (key.type === 'secret') return 'HS256';\n    if (key.type !== 'private') throw new Error('Only private or symmetric keys can be used to sign JWTs');\n\n    const asymKeyType = key.asymmetricKeyType;\n    const details = key.asymmetricKeyDetails;\n\n    switch (asymKeyType) {\n        case 'rsa':\n            return 'RS256';\n        case 'rsa-pss': {\n            const hash = details?.hashAlgorithm ?? 'sha256';\n            switch (hash) {\n                case 'sha256':\n                    return 'PS256';\n                case 'sha384':\n                    return 'PS384';\n                case 'sha512':\n                    return 'PS512';\n                default:\n                    throw new Error(`Unsupported RSA-PSS hash algorithm: ${hash}`);\n            }\n        }\n        case 'ec': {\n            const curve = details?.namedCurve;\n            switch (curve) {\n                case 'P-256':\n                case 'prime256v1':\n                    return 'ES256';\n                case 'P-384':\n                case 'secp384r1':\n                    return 'ES384';\n                case 'P-521':\n                case 'secp521r1':\n                    return 'ES512';\n                case 'secp256k1':\n                    return 'ES256K';\n                default:\n                    throw new Error(`Unsupported EC curve: ${curve}`);\n            }\n        }\n        case 'ed25519':\n            return 'EdDSA';\n        default:\n            throw new Error(`Unsupported asymmetric key type: ${asymKeyType}`);\n    }\n}\n\n/**\n * Normalize KeyLike input to a KeyObject\n * @param key\n */\nfunction toKeyObject(key: KeyLike): KeyObject {\n    // Already a KeyObject (private, public, or secret)\n    if (typeof key === 'object' && 'type' in key) return key as KeyObject;\n\n    // Try asymmetric private key (PEM / DER / JWK)\n    try {\n        return createPrivateKey(key);\n    } catch {\n        // Fallback: symmetric key (HMAC)\n        const buffer =\n            typeof key === 'string'\n                ? Buffer.from(key, 'utf8')\n                : Buffer.isBuffer(key)\n                    ? key\n                    : (() => {\n                        throw new Error('Unsupported key type');\n                    })();\n\n        return createSecretKey(buffer);\n    }\n}\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): JWT => {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n        throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n    }\n\n    const [headerPart, payloadPart, signature] = parts;\n\n    if (!headerPart || !payloadPart || !signature) {\n        throw new Error('Invalid JWT: empty part detected');\n    }\n\n    if (!BASE64URL_SEGMENT_REGEX.test(headerPart) || !BASE64URL_SEGMENT_REGEX.test(payloadPart) || !BASE64URL_SEGMENT_REGEX.test(signature)) {\n        throw new Error('Invalid JWT: non-base64url characters detected');\n    }\n\n    try {\n        const decodedHeader = JSON.parse(base64Url.decode(headerPart));\n        const decodedPayload = JSON.parse(base64Url.decode(payloadPart));\n\n        if (!isPlainObject(decodedHeader) || !isPlainObject(decodedPayload)) {\n            throw new Error('header and payload must be JSON objects');\n        }\n\n        const header = decodedHeader as unknown as JWTHeader;\n        const payload = decodedPayload as JWTPayload;\n\n        if (typeof header.alg !== 'string' || header.alg.length === 0) {\n            throw new Error('header.alg must be a non-empty string');\n        }\n        if (header.typ !== undefined && typeof header.typ !== 'string') {\n            throw new Error('header.typ must be a string');\n        }\n        if (header.kid !== undefined && typeof header.kid !== 'string') {\n            throw new Error('header.kid must be a string');\n        }\n        if (header.crit !== undefined && (!isStringArray(header.crit) || header.crit.length === 0)) {\n            throw new Error('header.crit must be a non-empty string[]');\n        }\n\n        return {header, payload, signature};\n    } catch (err) {\n        throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n    }\n}\n\nexport type SignOptions = {\n    alg?: SupportedAlgorithm;\n    kid?: string;\n    typ?: string;\n    /**\n     * default 'jose' for ECDSA JWTs, 'der' otherwise\n     */\n    signatureFormat?: 'der' | 'jose';\n}\n\n/**\n * Sign a JWT\n * @param payload\n * @param secret\n * @param options\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: SignOptions = {}\n): string => {\n    const key = toKeyObject(secret);\n    const alg = options.alg ?? AutodetectAlgorithm(key);\n    const signatureFormat = options.signatureFormat ?? (isEcdsaAlg(alg) ? 'jose' : 'der');\n    const typ = options.typ ?? 'JWT';\n\n    if (!(alg in SignatureAlgorithm)) throw new Error(`Unsupported algorithm: ${alg}`);\n\n    const header: JWTHeader = {alg, typ};\n    if (options.kid) header.kid = options.kid;\n\n    const headerEncoded = base64Url.encode(JSON.stringify(header));\n    const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n    const signingInput = `${headerEncoded}.${payloadEncoded}`;\n\n    // Node/OpenSSL produces DER signatures for ECDSA; convert to JOSE for JWT output by default.\n    let signature = SignatureAlgorithm[alg].sign(signingInput, secret);\n\n    // If ES* and caller requested JOSE, convert the DER signature bytes to JOSE bytes\n    if (signatureFormat === 'jose' && isEcdsaAlg(alg)) {\n        const der = Buffer.from(signature, 'base64url');\n        const jose = derToJose(der, joseLenForAlg(alg));\n        signature = jose.toString('base64url');\n    }\n\n    return `${headerEncoded}.${payloadEncoded}.${signature}`;\n\n};\n\nexport type VerifyOptions = {\n    algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n    issuer?: string;\n    subject?: string;\n    audience?: string | string[];\n    jwtId?: string;\n    ignoreExpiration?: boolean;\n    clockSkew?: number; // in seconds, default 0\n    maxTokenAge?: number; // Maximum age in seconds\n    signatureFormat?: 'der' | 'jose';\n};\n\n/**\n * Verify and validate a JWT\n * @param token\n * @param secret\n * @param options\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: VerifyOptions  = {}\n):\n    | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n    | { valid: false; error: { reason: string; code: string } } => {\n    const invalidOptions = validateVerifyOptions(options);\n    if (invalidOptions) {\n        return {\n            valid: false,\n            error: invalidOptions\n        };\n    }\n\n    let decoded: JWT;\n    try {\n        decoded = decode(token);\n    } catch (err) {\n        return {\n            valid: false,\n            error: {\n                reason: (err as Error).message,\n                code: 'INVALID_TOKEN'\n            }\n        };\n    }\n\n    const {header, payload, signature} = decoded;\n    const invalidHeader = validateProtectedHeader(header);\n    if (invalidHeader) {\n        return {\n            valid: false,\n            error: invalidHeader\n        };\n    }\n\n    const invalidClaims = validateRegisteredClaims(payload);\n    if (invalidClaims) {\n        return {\n            valid: false,\n            error: invalidClaims\n        };\n    }\n\n    // Validate algorithm\n    const alg = header.alg as SupportedAlgorithm;\n    if (!(alg in SignatureAlgorithm)) {\n        return {\n            valid: false,\n            error: {\n                reason: `Unsupported or unknown algorithm: ${header.alg}`,\n                code: 'INVALID_ALGORITHM'\n            }\n        };\n    }\n\n    // Algorithm whitelist validation (prevents algorithm confusion attacks)\n    if (options.algorithms && options.algorithms.length > 0) {\n        if (!options.algorithms.includes(alg)) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Algorithm \"${alg}\" is not in the allowed algorithms list`,\n                    code: 'ALGORITHM_NOT_ALLOWED'\n                }\n            };\n        }\n    }\n\n    // Validate 'typ' header (must be 'JWT' if present)\n    if (header.typ !== undefined && header.typ !== 'JWT') {\n        return {\n            valid: false,\n            error: {\n                reason: `Invalid token type: expected 'JWT', got '${header.typ}'`,\n                code: 'INVALID_TYPE'\n            }\n        };\n    }\n\n    // Verify signature against the exact original JWT signing input.\n    const [headerPart, payloadPart] = token.split('.');\n    const signingInput = `${headerPart}.${payloadPart}`;\n\n    if (!isEcdsaAlg(alg)) {\n        // non-ES* algorithms unchanged\n        let isValidSignature = false;\n        try {\n            isValidSignature = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n        } catch {\n            isValidSignature = false;\n        }\n        if (!isValidSignature) {\n            return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n        }\n    } else {\n        // ES* algorithms accept strict DER/JOSE modes or auto-detect for interoperability.\n        const format = options.signatureFormat; // undefined means \"auto\"\n\n        let ok: boolean;\n\n        // 1) If explicitly JOSE -> convert to DER for verification\n        if (format === 'jose') {\n            try {\n                const jose = Buffer.from(signature, 'base64url');\n                const derSigB64Url = joseToDer(jose).toString('base64url');\n                ok = SignatureAlgorithm[alg].verify(signingInput, secret, derSigB64Url);\n            } catch {\n                ok = false;\n            }\n        }\n        // 2) If explicitly DER -> verify as-is\n        else if (format === 'der') {\n            ok = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n        }\n        // 3) Auto-detect: try DER first, then JOSE\n        else {\n            ok = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n            if (!ok) {\n                try {\n                    const jose = Buffer.from(signature, 'base64url');\n                    // quick sanity: only attempt conversion if size matches expected\n                    if (jose.length === joseLenForAlg(alg)) {\n                        const derSigB64Url = joseToDer(jose).toString('base64url');\n                        ok = SignatureAlgorithm[alg].verify(signingInput, secret, derSigB64Url);\n                    }\n                } catch {\n                    // ignore\n                }\n            }\n        }\n\n        if (!ok) {\n            return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n        }\n    }\n\n    // Time validation\n    const now = Math.floor(Date.now() / 1000);\n    const skew = options.clockSkew ?? 0;\n\n    if (!options.ignoreExpiration) {\n        if (payload.exp !== undefined && now > payload.exp + skew) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token expired',\n                    code: 'TOKEN_EXPIRED'\n                }\n            };\n        }\n    }\n\n    if (payload.nbf !== undefined && now + skew < payload.nbf) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token not yet valid',\n                code: 'TOKEN_NOT_ACTIVE'\n            }\n        };\n    }\n\n    if (payload.iat !== undefined && now + skew < payload.iat) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token issued in the future',\n                code: 'TOKEN_FUTURE_ISSUED'\n            }\n        };\n    }\n\n    // Maximum token age validation\n    if (options.maxTokenAge !== undefined && payload.iat !== undefined) {\n        const tokenAge = now - payload.iat;\n        if (tokenAge > options.maxTokenAge) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Token age (${tokenAge}s) exceeds maximum allowed age (${options.maxTokenAge}s)`,\n                    code: 'TOKEN_TOO_OLD'\n                }\n            };\n        }\n    }\n\n    // --- Claim validations (only if options provided) ---\n\n    // Issuer (`iss`)\n    if (options.issuer !== undefined) {\n        if (payload.iss === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required issuer claim (\"iss\")',\n                    code: 'MISSING_ISSUER'\n                }\n            };\n        }\n        if (options.issuer !== payload.iss) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token issuer: expected \"${options.issuer}\", got \"${payload.iss}\"`,\n                    code: 'INVALID_ISSUER'\n                }\n            };\n        }\n    }\n\n    // Subject (`sub`)\n    if (options.subject !== undefined) {\n        if (payload.sub === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required subject claim (\"sub\")',\n                    code: 'MISSING_SUBJECT'\n                }\n            };\n        }\n        if (options.subject !== payload.sub) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token subject: expected \"${options.subject}\", got \"${payload.sub}\"`,\n                    code: 'INVALID_SUBJECT'\n                }\n            };\n        }\n    }\n\n    // Audience (`aud`)\n    if (options.audience !== undefined) {\n        const aud = payload.aud;\n        if (aud === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required audience claim (\"aud\")',\n                    code: 'MISSING_AUDIENCE'\n                }\n            };\n        }\n\n        const expectedAud = Array.isArray(options.audience) ? options.audience : [options.audience];\n        const tokenAud = Array.isArray(aud) ? aud : [aud];\n\n        const hasMatch = expectedAud.some(a => tokenAud.includes(a));\n        if (!hasMatch) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Audience claim mismatch',\n                    code: 'INVALID_AUDIENCE'\n                }\n            };\n        }\n    }\n\n    // JWT ID (`jti`)\n    if (options.jwtId !== undefined) {\n        if (payload.jti === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required JWT ID claim (\"jti\")',\n                    code: 'MISSING_JTI'\n                }\n            };\n        }\n        if (options.jwtId !== payload.jti) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid JWT ID: expected \"${options.jwtId}\", got \"${payload.jti}\"`,\n                    code: 'INVALID_JTI'\n                }\n            };\n        }\n    }\n\n    return {valid: true, header, payload, signature};\n};\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n} as const;\n","import {\n    createPrivateKey,\n    createPublicKey,\n    createSecretKey,\n    createHash,\n    type KeyObject\n} from 'crypto';\n\n// JWK Types\nexport type JWK =\n    | RSAJWK\n    | ECJWK\n    | OKPJWK\n    | OctJWK;\n\nexport type JWKWithHelpers = JWK & {\n    toKeyObject(): KeyObject;\n};\n\nexport interface BaseJWK {\n    kty: string;\n    kid?: string;\n    alg?: string;\n    use?: 'sig' | 'enc';\n    key_ops?: Array<'sign' | 'verify'>;\n    x5c?: string[]; // X.509 cert chain\n    x5t?: string;   // Base64url thumbprint\n}\n\nexport interface RSAJWK extends BaseJWK {\n    kty: 'RSA';\n    n: string;\n    e: string;\n    d?: string;\n    p?: string;\n    q?: string;\n    dp?: string;\n    dq?: string;\n    qi?: string;\n}\n\nexport interface ECJWK extends BaseJWK {\n    kty: 'EC';\n    crv: 'P-256' | 'P-384' | 'P-521' | 'secp256k1';\n    x: string;\n    y: string;\n    d?: string;\n}\n\nexport interface OKPJWK extends BaseJWK {\n    kty: 'OKP';\n    crv: 'Ed25519';\n    x: string;\n    d?: string;\n}\n\nexport interface OctJWK extends BaseJWK {\n    kty: 'oct';\n    k: string;\n}\n\n/**\n * Export KeyObject to JWK\n * @param key\n */\nexport function exportJWK(key: KeyObject): JWK {\n    if (!key || typeof key !== 'object') throw new Error('Invalid KeyObject');\n    return key.export({format: 'jwk'}) as JWK;\n}\n\n/**\n * Import JWK to KeyObject\n * @param jwk\n */\nexport function importJWK(jwk: JWK): KeyObject {\n    if (!jwk || typeof jwk !== 'object') throw new Error('Invalid JWK');\n\n    switch (jwk.kty) {\n        case 'oct': {\n            if (!('k' in jwk) || typeof jwk.k !== 'string') {\n                throw new Error('Invalid oct JWK: missing \"k\"');\n            }\n\n            return createSecretKey(Buffer.from(jwk.k, 'base64url'));\n        }\n\n        case 'RSA':\n        case 'EC':\n        case 'OKP': {\n            // private key\n            if ('d' in jwk && typeof (jwk as any).d === 'string') {\n                // @ts-ignore\n                return createPrivateKey({format: 'jwk', key: jwk});\n            }\n\n            // public key\n            // @ts-ignore\n            return createPublicKey({format: 'jwk', key: jwk});\n        }\n\n        default:\n            throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n    }\n}\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport function toPublicJWK(key: KeyObject): JWK {\n    if (!key || typeof key !== 'object') {\n        throw new Error('Invalid KeyObject');\n    }\n\n    const publicKey =\n        key.type === 'private'\n            ? createPublicKey(key)\n            : key;\n\n    const jwk = publicKey.export({format: 'jwk'}) as JWK;\n\n    // Ensure private fields are not present\n    delete (jwk as any).d;\n    delete (jwk as any).p;\n    delete (jwk as any).q;\n    delete (jwk as any).dp;\n    delete (jwk as any).dq;\n    delete (jwk as any).qi;\n    return jwk;\n}\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport function getJWKThumbprint(jwk: JWK, hashAlg: 'sha256' = 'sha256'): string {\n    if (!jwk || typeof jwk !== 'object') {\n        throw new Error('Invalid JWK');\n    }\n\n    let fields: Record<string, string>;\n\n    switch (jwk.kty) {\n        case 'RSA':\n            fields = {e: jwk.e, kty: jwk.kty, n: jwk.n};\n            break;\n\n        case 'EC':\n            fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y};\n            break;\n\n        case 'OKP':\n            fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x};\n            break;\n\n        case 'oct':\n            fields = {k: jwk.k, kty: jwk.kty};\n            break;\n\n        default:\n            throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n    }\n\n    // Lexicographically sorted JSON\n    const json = JSON.stringify(\n        Object.keys(fields)\n            .sort()\n            .reduce((acc, k) => {\n                acc[k] = fields[k];\n                return acc;\n            }, {} as Record<string, string>)\n    );\n\n    return createHash(hashAlg)\n        .update(json)\n        .digest('base64url');\n}\n\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport function computeX5T(jwk: JWK): string | undefined {\n    if (!jwk.x5c?.length) return undefined;\n    return createHash('sha1').update(Buffer.from(jwk.x5c[0], 'base64')).digest('base64url');\n}\n\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n}\n\nexport interface JWKS {\n    keys: JWK[];\n}\n\nexport interface JWKSResolver {\n    list(): Promise<JWKWithHelpers[]>;\n    refresh(): Promise<JWKSResolver>;\n    key(kid: string): Promise<JWKWithHelpers | undefined>;\n    find(input: Partial<BaseJWK>): Promise<JWKWithHelpers[]>;\n    findFirst(input: Partial<BaseJWK>): Promise<JWKWithHelpers | undefined>;\n    export(): JWKS | undefined;\n}\n\n/**\n * Convert JWKS specific key of first key to KeyObject\n * @param jwks\n * @param kid\n * @constructor\n */\nexport function JWKSToKeyObject(\n    jwks: JWKS,\n    kid?: string\n): KeyObject {\n    if (!jwks || !Array.isArray(jwks.keys)) throw new Error('Invalid JWKS');\n\n    let jwk: JWK | undefined;\n\n    if (kid) jwk = jwks.keys.find(k => k.kid === kid);\n\n    // Fallback: single-key JWKS\n    if (!jwk && jwks.keys.length === 1) jwk = jwks.keys[0];\n\n    if (!jwk) throw new Error('Key not found in JWKS');\n    return importJWK(jwk);\n}\n\n/**\n * Normalize JWKS\n * @param jwks\n */\nexport function normalizeJWKS(jwks: JWKS): JWKS {\n    return {\n        keys: normalizeJWK(...jwks.keys)\n    };\n}\n\nexport function normalizeJWK(...keys: JWK[]): JWKWithHelpers[] {\n    return keys.map((jwk) => {\n        const normalized = {\n            ...jwk,\n            kid: jwk.kid ?? getJWKThumbprint(jwk),\n            x5t: jwk.x5t ?? computeX5T(jwk)\n        } as JWKWithHelpers;\n\n        // Keep helper API out of object enumeration/serialization.\n        Object.defineProperty(normalized, 'toKeyObject', {\n            enumerable: false,\n            configurable: false,\n            writable: false,\n            value: () => importJWK(normalized)\n        });\n\n        return normalized;\n    })\n}\n\nexport const fromWeb = async (\n    url: string | URL,\n    options: Partial<{\n        fetch: typeof fetch;\n        ttl: number;\n        timeoutMs: number;\n        endpointOverride: string;\n        overrideEndpointCheck: boolean;\n        cache: {\n            get: (key: string) => JWKS | undefined | Promise<JWKS | undefined>;\n            set: (key: string, value: JWKS) => void | Promise<void>;\n        };\n    }> = {}\n): Promise<JWKSResolver> => {\n    const baseUrl = typeof url === 'string' ? url : url.toString();\n    const fetchFn = options.fetch ?? globalThis.fetch;\n    const ttl = Math.max(0, options.ttl ?? 5 * 60_000);\n    const timeoutMs = Math.max(0, options.timeoutMs ?? 5_000);\n    const wellKnownPath = '/.well-known/jwks.json';\n\n    if (!fetchFn) {\n        throw new Error('No fetch implementation available');\n    }\n\n    const endpoint = (() => {\n        if (options.endpointOverride) {\n            const override = options.endpointOverride;\n            try {\n                return new URL(override, baseUrl).toString();\n            } catch {\n                return override;\n            }\n        }\n\n        if (options.overrideEndpointCheck) {\n            return baseUrl;\n        }\n\n        if (baseUrl.endsWith(wellKnownPath)) {\n            return baseUrl;\n        }\n\n        return `${baseUrl.replace(/\\/+$/, '')}${wellKnownPath}`;\n    })();\n\n    const cache = (() => {\n        if (options.cache) return options.cache;\n        let memoryValue: JWKS | undefined;\n        return {\n            get: () => memoryValue,\n            set: (_key: string, value: JWKS) => {\n                memoryValue = value;\n            }\n        };\n    })();\n\n    let cachedJWKS: JWKS | undefined;\n    let nextRefreshAt = 0;\n    let refreshInFlight: Promise<JWKS> | undefined;\n    let consecutiveFailures = 0;\n\n    const fetchJWKS = async (allowStaleOnFailure: boolean): Promise<JWKS> => {\n        if (refreshInFlight) return refreshInFlight;\n\n        refreshInFlight = (async () => {\n            const controller = new AbortController();\n            let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n\n            if (timeoutMs > 0) {\n                timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);\n            }\n\n            let response: Response;\n            try {\n                response = await fetchFn(endpoint, {signal: controller.signal});\n            } catch (error) {\n                if (controller.signal.aborted) {\n                    throw new Error(`JWKS fetch timed out after ${timeoutMs}ms`);\n                }\n                throw error;\n            } finally {\n                if (timeoutHandle) clearTimeout(timeoutHandle);\n            }\n\n            if (!response.ok) {\n                throw new Error(`Failed to fetch JWKS: ${response.status} ${response.statusText}`);\n            }\n\n            const body = await response.json();\n            if (!body || typeof body !== 'object' || !Array.isArray((body as any).keys)) {\n                throw new Error('Invalid JWKS');\n            }\n\n            return normalizeJWKS(body as JWKS);\n        })();\n\n        try {\n            const fresh = await refreshInFlight;\n            cachedJWKS = fresh;\n            await cache.set(endpoint, fresh);\n            consecutiveFailures = 0;\n            if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n            return fresh;\n        } catch (error) {\n            if (!allowStaleOnFailure || !cachedJWKS) {\n                throw error;\n            }\n\n            consecutiveFailures += 1;\n            /* c8 ignore start - stale-on-failure is only reachable when ttl > 0 (auto-refresh path) */\n            if (ttl > 0) {\n                const backoff = Math.min(\n                    Math.max(ttl, 30_000) * Math.pow(2, consecutiveFailures - 1),\n                    15 * 60_000\n                );\n                nextRefreshAt = Date.now() + backoff;\n            }\n            /* c8 ignore stop */\n            console.warn(`JWKS refresh failed for \"${endpoint}\", using stale cache.`, error);\n            return cachedJWKS;\n        } finally {\n            refreshInFlight = undefined;\n        }\n    };\n\n    cachedJWKS = await cache.get(endpoint);\n    if (!cachedJWKS) {\n        cachedJWKS = await fetchJWKS(false);\n    } else {\n        cachedJWKS = normalizeJWKS(cachedJWKS);\n        if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n    }\n\n\n    const resolver: JWKSResolver = {\n        async list(): Promise<JWKWithHelpers[]> {\n            if (ttl > 0 && Date.now() >= nextRefreshAt) {\n                await fetchJWKS(true);\n            }\n            return normalizeJWK(...(cachedJWKS as JWKS).keys);\n        },\n        async refresh(): Promise<JWKSResolver> {\n            await fetchJWKS(false);\n            return resolver;\n        },\n        async key(kid: string): Promise<JWKWithHelpers | undefined> {\n            const keys = await resolver.list();\n            const key = keys.find((v) => v.kid === kid)\n            if (!key) return undefined;\n            return normalizeJWK(key)[0];\n        },\n        async find(input: Partial<BaseJWK>): Promise<JWKWithHelpers[]> {\n            const keys = await resolver.list();\n            const entries = Object.entries(input) as Array<[keyof BaseJWK, BaseJWK[keyof BaseJWK]]>;\n\n            if (entries.length === 0) return normalizeJWK(...keys);\n\n            return normalizeJWK(...keys.filter((key) =>\n                entries.every(([field, expected]) => {\n                    const value = key[field];\n                    if (Array.isArray(expected)) {\n                        return Array.isArray(value)\n                            && value.length === expected.length\n                            && value.every((item, i) => item === expected[i]);\n                    }\n                    return value === expected;\n                })\n            ));\n        },\n        async findFirst(input: Partial<BaseJWK>): Promise<JWKWithHelpers | undefined> {\n            return resolver.find(input).then(([key]) => key);\n        },\n        export(): JWKS | undefined {\n            return cachedJWKS;\n        }\n    };\n\n    return resolver;\n}\n\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n    fromWeb\n}\n"],"names":["base64Url","input","timingSafeCompare","a","b","timingSafeEqual","BASE64URL_SEGMENT_REGEX","isPlainObject","isFiniteNumber","isStringArray","value","validateRegisteredClaims","payload","claimValidators","entry","validateVerifyOptions","options","invalidAlgorithm","alg","SignatureAlgorithm","validateProtectedHeader","header","joseLenForAlg","derToJose","der","outLen","i","seqLen","n","k","rLen","r","sLen","s","rPad","sPad","joseToDer","jose","half","rPart","sPart","lenBytes","tmp","isEcdsaAlg","createHmacAlgorithm","algorithm","data","secret","createHmac","signature","expected","createVerifyAlgorithm","createSign","createVerify","createPssAlgorithm","saltLength","crypto","edDsaAlgorithm","cryptoSign","cryptoVerify","SupportedAlgorithms","AutodetectAlgorithm","key","asymKeyType","details","hash","curve","toKeyObject","createPrivateKey","buffer","createSecretKey","decode","token","parts","headerPart","payloadPart","decodedHeader","decodedPayload","err","sign","signatureFormat","typ","headerEncoded","payloadEncoded","signingInput","verify","invalidOptions","decoded","invalidHeader","invalidClaims","format","ok","derSigB64Url","isValidSignature","now","skew","tokenAge","aud","expectedAud","tokenAud","JWT","exportJWK","importJWK","jwk","createPublicKey","toPublicJWK","getJWKThumbprint","hashAlg","fields","json","acc","createHash","computeX5T","_a","JWK","JWKSToKeyObject","jwks","kid","normalizeJWKS","normalizeJWK","keys","normalized","fromWeb","url","baseUrl","fetchFn","ttl","timeoutMs","wellKnownPath","endpoint","override","cache","memoryValue","_key","cachedJWKS","nextRefreshAt","refreshInFlight","consecutiveFailures","fetchJWKS","allowStaleOnFailure","controller","timeoutHandle","response","error","body","fresh","backoff","resolver","v","entries","field","item","JWKS"],"mappings":"uCAeaA,EAAY,CACrB,OAASC,GAAmC,OAAO,KAAKA,CAAK,EAAE,SAAS,WAAW,EACnF,OAASA,GAA0B,OAAO,KAAKA,EAAO,WAAW,EAAE,SAAA,CACvE,EAOMC,EAAoB,CAACC,EAAWC,IAC9BD,EAAE,SAAWC,EAAE,OACR,GAEJC,EAAAA,gBAAgB,OAAO,KAAKF,CAAC,EAAG,OAAO,KAAKC,CAAC,CAAC,EA0DnDE,EAA0B,mBAEhC,SAASC,EAAcN,EAAkD,CACrE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC9E,CAEA,SAASO,EAAeP,EAAiC,CACrD,OAAO,OAAOA,GAAU,UAAY,OAAO,SAASA,CAAK,CAC7D,CAEA,SAASQ,EAAcR,EAAmC,CACtD,OAAO,MAAM,QAAQA,CAAK,GAAKA,EAAM,MAAOS,GAAU,OAAOA,GAAU,QAAQ,CACnF,CAEA,SAASC,EAAyBC,EAA8D,CAC5F,MAAMC,EAAwF,CAC1F,CAAC,MAAO,MAAO,MAAOD,EAAQ,MAAQ,QAAa,OAAOA,EAAQ,KAAQ,SAAU,SAAU,QAAA,EAC9F,CAAC,MAAO,MAAO,MAAOA,EAAQ,MAAQ,QAAa,OAAOA,EAAQ,KAAQ,SAAU,SAAU,QAAA,EAC9F,CAAC,MAAO,MAAO,MAAOA,EAAQ,MAAQ,QAAa,OAAOA,EAAQ,KAAQ,SAAU,SAAU,QAAA,EAC9F,CAAC,MAAO,MAAO,MAAOA,EAAQ,MAAQ,QAAa,OAAOA,EAAQ,KAAQ,SAAU,SAAU,QAAA,EAC9F,CAAC,MAAO,MAAO,MAAOA,EAAQ,MAAQ,QAAaJ,EAAeI,EAAQ,GAAG,EAAG,SAAU,QAAA,EAC1F,CAAC,MAAO,MAAO,MAAOA,EAAQ,MAAQ,QAAaJ,EAAeI,EAAQ,GAAG,EAAG,SAAU,QAAA,EAC1F,CAAC,MAAO,MAAO,MAAOA,EAAQ,MAAQ,QAAaJ,EAAeI,EAAQ,GAAG,EAAG,SAAU,QAAA,CAAQ,EAGtG,UAAWE,KAASD,EAChB,GAAI,CAACC,EAAM,MACP,MAAO,CACH,OAAQ,YAAYA,EAAM,KAAK,qBAAqBA,EAAM,QAAQ,GAClE,KAAM,eAAA,EAKlB,OAAIF,EAAQ,MAAQ,QAEZ,EADoB,OAAOA,EAAQ,KAAQ,UAAYH,EAAcG,EAAQ,GAAG,GAEzE,CACH,OAAQ,mDACR,KAAM,eAAA,EAKX,IACX,CAEA,SAASG,EAAsBC,EAAiE,CAC5F,GAAIA,EAAQ,kBAAoB,QAAaA,EAAQ,kBAAoB,OAASA,EAAQ,kBAAoB,OAC1G,MAAO,CACH,OAAQ,2DACR,KAAM,iBAAA,EAId,GAAIA,EAAQ,YAAc,SAAc,CAACR,EAAeQ,EAAQ,SAAS,GAAKA,EAAQ,UAAY,GAC9F,MAAO,CACH,OAAQ,kEACR,KAAM,iBAAA,EAId,GAAIA,EAAQ,cAAgB,SAAc,CAACR,EAAeQ,EAAQ,WAAW,GAAKA,EAAQ,YAAc,GACpG,MAAO,CACH,OAAQ,oEACR,KAAM,iBAAA,EAId,GAAIA,EAAQ,SAAW,QAAa,OAAOA,EAAQ,QAAW,SAC1D,MAAO,CACH,OAAQ,yCACR,KAAM,iBAAA,EAId,GAAIA,EAAQ,UAAY,QAAa,OAAOA,EAAQ,SAAY,SAC5D,MAAO,CACH,OAAQ,0CACR,KAAM,iBAAA,EAId,GAAIA,EAAQ,QAAU,QAAa,OAAOA,EAAQ,OAAU,SACxD,MAAO,CACH,OAAQ,wCACR,KAAM,iBAAA,EAId,GAAIA,EAAQ,WAAa,QAEjB,EADoB,OAAOA,EAAQ,UAAa,UAAYP,EAAcO,EAAQ,QAAQ,GAE1F,MAAO,CACH,OAAQ,uDACR,KAAM,iBAAA,EAKlB,GAAIA,EAAQ,aAAe,OAAW,CAClC,GAAI,CAAC,MAAM,QAAQA,EAAQ,UAAU,EACjC,MAAO,CACH,OAAQ,+CACR,KAAM,iBAAA,EAId,MAAMC,EAAmBD,EAAQ,WAAW,KAAME,GAAQ,EAAEA,KAAOC,EAAmB,EACtF,GAAIF,EACA,MAAO,CACH,OAAQ,qDAAqDA,CAAgB,IAC7E,KAAM,iBAAA,CAGlB,CAEA,OAAO,IACX,CAEA,SAASG,EAAwBC,EAA4D,CACzF,OAAIA,EAAO,OAAS,OACZ,CAACZ,EAAcY,EAAO,IAAI,GAAKA,EAAO,KAAK,SAAW,EAC/C,CACH,OAAQ,qDACR,KAAM,gBAAA,EAIP,CACH,OAAQ,2CAA2CA,EAAO,KAAK,KAAK,IAAI,CAAC,GACzE,KAAM,6BAAA,EAIP,IACX,CAIA,SAASC,EAAcJ,EAAqB,CACxC,OAAQA,EAAA,CACJ,IAAK,QACL,IAAK,SACD,MAAO,IACX,IAAK,QACD,MAAO,IACX,IAAK,QACD,MAAO,KAEX,QACI,MAAM,IAAI,MAAM,8CAA8CA,CAAG,EAAE,CAAA,CAE/E,CAEA,SAASK,GAAUC,EAAaC,EAAwB,CACpD,IAAIC,EAAI,EACR,GAAIF,EAAIE,GAAG,IAAM,GAAM,MAAM,IAAI,MAAM,6BAA6B,EAGpE,IAAIC,EAASH,EAAIE,GAAG,EACpB,GAAIC,EAAS,IAAM,CACf,MAAMC,EAAID,EAAS,IACnBA,EAAS,EACT,QAASE,EAAI,EAAGA,EAAID,EAAGC,IAAKF,EAAUA,GAAU,EAAKH,EAAIE,GAAG,CAChE,CAEA,GAAIF,EAAIE,GAAG,IAAM,EAAM,MAAM,IAAI,MAAM,iCAAiC,EACxE,MAAMI,EAAON,EAAIE,GAAG,EACpB,IAAIK,EAAIP,EAAI,SAASE,EAAGA,EAAII,CAAI,EAGhC,GAFAJ,GAAKI,EAEDN,EAAIE,GAAG,IAAM,EAAM,MAAM,IAAI,MAAM,iCAAiC,EACxE,MAAMM,EAAOR,EAAIE,GAAG,EACpB,IAAIO,EAAIT,EAAI,SAASE,EAAGA,EAAIM,CAAI,EAGhC,KAAOD,EAAE,OAASN,EAAS,GAAKM,EAAE,CAAC,IAAM,GAAMA,EAAIA,EAAE,SAAS,CAAC,EAC/D,KAAOE,EAAE,OAASR,EAAS,GAAKQ,EAAE,CAAC,IAAM,GAAMA,EAAIA,EAAE,SAAS,CAAC,EAE/D,MAAMC,EAAO,OAAO,OAAO,CAAC,OAAO,MAAMT,EAAS,EAAIM,EAAE,OAAQ,CAAC,EAAGA,CAAC,CAAC,EAChEI,EAAO,OAAO,OAAO,CAAC,OAAO,MAAMV,EAAS,EAAIQ,EAAE,OAAQ,CAAC,EAAGA,CAAC,CAAC,EACtE,OAAO,OAAO,OAAO,CAACC,EAAMC,CAAI,CAAC,CACrC,CAEA,SAASC,EAAUC,EAAsB,CACrC,MAAMC,EAAOD,EAAK,OAAS,EAC3B,IAAI,EAAIA,EAAK,SAAS,EAAGC,CAAI,EACzBL,EAAII,EAAK,SAASC,CAAI,EAG1B,KAAO,EAAE,OAAS,GAAK,EAAE,CAAC,IAAM,IAAS,EAAE,CAAC,EAAI,OAAU,GAAG,EAAI,EAAE,SAAS,CAAC,EAC7E,KAAOL,EAAE,OAAS,GAAKA,EAAE,CAAC,IAAM,IAASA,EAAE,CAAC,EAAI,OAAU,GAAGA,EAAIA,EAAE,SAAS,CAAC,EAGzE,EAAE,CAAC,EAAI,QAAU,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,EAAG,CAAC,CAAC,GACvDA,EAAE,CAAC,EAAI,QAAU,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,EAAGA,CAAC,CAAC,GAE3D,MAAMM,EAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAM,EAAE,MAAM,CAAC,EAAG,CAAC,CAAC,EACxDC,EAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAMP,EAAE,MAAM,CAAC,EAAGA,CAAC,CAAC,EAExDN,EAASY,EAAM,OAASC,EAAM,OAEpC,IAAIC,EACJ,GAAId,EAAS,IACTc,EAAW,OAAO,KAAK,CAACd,CAAM,CAAC,MAC5B,CACH,MAAMe,EAAgB,CAAA,EACtB,IAAId,EAAID,EACR,KAAOC,EAAI,GACPc,EAAI,QAAQd,EAAI,GAAI,EACpBA,IAAM,EAEVa,EAAW,OAAO,KAAK,CAAC,IAAOC,EAAI,OAAQ,GAAGA,CAAG,CAAC,CACtD,CAEA,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAI,CAAC,EAAGD,EAAUF,EAAOC,CAAK,CAAC,CACtE,CAEA,SAASG,EAAWzB,EAAsB,CACtC,OAAOA,IAAQ,SAAWA,IAAQ,SAAWA,IAAQ,SAAWA,IAAQ,QAC5E,CAwBA,MAAM0B,EAAuBC,IAAyD,CAClF,KAAM,CAACC,EAAkBC,IACrBC,EAAAA,WAAWH,EAAWE,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EACjE,OAAQ,CAACA,EAAkBC,EAAiBE,IAA+B,CACvE,MAAMC,EAAWF,aAAWH,EAAWE,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC9E,OAAO5C,EAAkBgD,EAAUD,CAAS,CAChD,CACJ,GAEME,EAAyBN,IAAyD,CACpF,KAAM,CAACC,EAAkBC,IACrBK,EAAAA,WAAWP,CAAS,EAAE,OAAOC,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC9E,OAAQ,CAACD,EAAkBC,EAAiBE,IAA+B,CACvE,GAAI,CACA,OAAOI,EAAAA,aAAaR,CAAS,EACxB,OAAOC,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CACJ,GAEMK,EAAqB,CAACT,EAAmBU,KAA0D,CACrG,KAAM,CAACT,EAAkBC,IACrBK,aAAWP,CAAS,EACf,OAAOC,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASS,EAAO,UAAU,sBAC1B,WAAAD,CAAA,CACH,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACT,EAAkBC,EAAiBE,IAA+B,CACvE,GAAI,CACA,OAAOI,EAAAA,aAAaR,CAAS,EACxB,OAAOC,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASS,EAAO,UAAU,sBAC1B,WAAAD,CAAA,EACD,OAAO,KAAKN,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CACJ,GAEMQ,GAAmD,CACrD,KAAM,CAACX,EAAkBC,IACrBW,EAAAA,KAAW,KAAM,OAAOZ,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EAAMC,CAAM,EAC/E,SAAS,WAAW,EAC7B,OAAQ,CAACD,EAAkBC,EAAiBE,IAA+B,CACvE,GAAI,CACA,OAAOU,EAAAA,OACH,KACA,OAAOb,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EACvDC,EACA,OAAO,KAAKE,EAAW,WAAW,CAAA,CAE1C,MAAQ,CACJ,MAAO,EACX,CACJ,CACJ,EAIa9B,EAA6C,CAEtD,MAAOyB,EAAoB,QAAQ,EACnC,MAAOA,EAAoB,QAAQ,EACnC,MAAOA,EAAoB,QAAQ,EAGnC,MAAOO,EAAsB,YAAY,EACzC,MAAOA,EAAsB,YAAY,EACzC,MAAOA,EAAsB,YAAY,EAGzC,MAAOA,EAAsB,QAAQ,EACrC,MAAOA,EAAsB,QAAQ,EACrC,MAAOA,EAAsB,QAAQ,EACrC,OAAQA,EAAsB,QAAQ,EACtC,MAAOG,EAAmB,aAAc,EAAE,EAC1C,MAAOA,EAAmB,aAAc,EAAE,EAC1C,MAAOA,EAAmB,aAAc,EAAE,EAC1C,MAAOG,EACX,EAIaG,GAAsB,OAAO,KAAKzC,CAAkB,EAO1D,SAAS0C,EAAoBC,EAAoC,CACpE,GAAIA,EAAI,OAAS,SAAU,MAAO,QAClC,GAAIA,EAAI,OAAS,UAAW,MAAM,IAAI,MAAM,yDAAyD,EAErG,MAAMC,EAAcD,EAAI,kBAClBE,EAAUF,EAAI,qBAEpB,OAAQC,EAAA,CACJ,IAAK,MACD,MAAO,QACX,IAAK,UAAW,CACZ,MAAME,GAAOD,GAAA,YAAAA,EAAS,gBAAiB,SACvC,OAAQC,EAAA,CACJ,IAAK,SACD,MAAO,QACX,IAAK,SACD,MAAO,QACX,IAAK,SACD,MAAO,QACX,QACI,MAAM,IAAI,MAAM,uCAAuCA,CAAI,EAAE,CAAA,CAEzE,CACA,IAAK,KAAM,CACP,MAAMC,EAAQF,GAAA,YAAAA,EAAS,WACvB,OAAQE,EAAA,CACJ,IAAK,QACL,IAAK,aACD,MAAO,QACX,IAAK,QACL,IAAK,YACD,MAAO,QACX,IAAK,QACL,IAAK,YACD,MAAO,QACX,IAAK,YACD,MAAO,SACX,QACI,MAAM,IAAI,MAAM,yBAAyBA,CAAK,EAAE,CAAA,CAE5D,CACA,IAAK,UACD,MAAO,QACX,QACI,MAAM,IAAI,MAAM,oCAAoCH,CAAW,EAAE,CAAA,CAE7E,CAMA,SAASI,GAAYL,EAAyB,CAE1C,GAAI,OAAOA,GAAQ,UAAY,SAAUA,EAAK,OAAOA,EAGrD,GAAI,CACA,OAAOM,EAAAA,iBAAiBN,CAAG,CAC/B,MAAQ,CAEJ,MAAMO,EACF,OAAOP,GAAQ,SACT,OAAO,KAAKA,EAAK,MAAM,EACvB,OAAO,SAASA,CAAG,EACfA,GACC,IAAM,CACL,MAAM,IAAI,MAAM,sBAAsB,CAC1C,GAAA,EAEZ,OAAOQ,EAAAA,gBAAgBD,CAAM,CACjC,CACJ,CAMO,MAAME,EAAUC,GAAuB,CAC1C,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACjB,MAAM,IAAI,MAAM,4DAA4D,EAGhF,KAAM,CAACC,EAAYC,EAAa1B,CAAS,EAAIwB,EAE7C,GAAI,CAACC,GAAc,CAACC,GAAe,CAAC1B,EAChC,MAAM,IAAI,MAAM,kCAAkC,EAGtD,GAAI,CAAC3C,EAAwB,KAAKoE,CAAU,GAAK,CAACpE,EAAwB,KAAKqE,CAAW,GAAK,CAACrE,EAAwB,KAAK2C,CAAS,EAClI,MAAM,IAAI,MAAM,gDAAgD,EAGpE,GAAI,CACA,MAAM2B,EAAgB,KAAK,MAAM5E,EAAU,OAAO0E,CAAU,CAAC,EACvDG,EAAiB,KAAK,MAAM7E,EAAU,OAAO2E,CAAW,CAAC,EAE/D,GAAI,CAACpE,EAAcqE,CAAa,GAAK,CAACrE,EAAcsE,CAAc,EAC9D,MAAM,IAAI,MAAM,yCAAyC,EAG7D,MAAMxD,EAASuD,EACThE,EAAUiE,EAEhB,GAAI,OAAOxD,EAAO,KAAQ,UAAYA,EAAO,IAAI,SAAW,EACxD,MAAM,IAAI,MAAM,uCAAuC,EAE3D,GAAIA,EAAO,MAAQ,QAAa,OAAOA,EAAO,KAAQ,SAClD,MAAM,IAAI,MAAM,6BAA6B,EAEjD,GAAIA,EAAO,MAAQ,QAAa,OAAOA,EAAO,KAAQ,SAClD,MAAM,IAAI,MAAM,6BAA6B,EAEjD,GAAIA,EAAO,OAAS,SAAc,CAACZ,EAAcY,EAAO,IAAI,GAAKA,EAAO,KAAK,SAAW,GACpF,MAAM,IAAI,MAAM,0CAA0C,EAG9D,MAAO,CAAC,OAAAA,EAAQ,QAAAT,EAAS,UAAAqC,CAAA,CAC7B,OAAS6B,EAAK,CACV,MAAM,IAAI,MAAM,6CAA8CA,EAAc,OAAO,GAAG,CAC1F,CACJ,EAkBaC,EAAO,CAChBnE,EACAmC,EACA/B,EAAuB,CAAA,IACd,CACT,MAAM8C,EAAMK,GAAYpB,CAAM,EACxB7B,EAAMF,EAAQ,KAAO6C,EAAoBC,CAAG,EAC5CkB,EAAkBhE,EAAQ,kBAAoB2B,EAAWzB,CAAG,EAAI,OAAS,OACzE+D,EAAMjE,EAAQ,KAAO,MAE3B,GAAI,EAAEE,KAAOC,GAAqB,MAAM,IAAI,MAAM,0BAA0BD,CAAG,EAAE,EAEjF,MAAMG,EAAoB,CAAC,IAAAH,EAAK,IAAA+D,CAAA,EAC5BjE,EAAQ,MAAKK,EAAO,IAAML,EAAQ,KAEtC,MAAMkE,EAAgBlF,EAAU,OAAO,KAAK,UAAUqB,CAAM,CAAC,EACvD8D,EAAiBnF,EAAU,OAAO,KAAK,UAAUY,CAAO,CAAC,EAEzDwE,EAAe,GAAGF,CAAa,IAAIC,CAAc,GAGvD,IAAIlC,EAAY9B,EAAmBD,CAAG,EAAE,KAAKkE,EAAcrC,CAAM,EAGjE,GAAIiC,IAAoB,QAAUrC,EAAWzB,CAAG,EAAG,CAC/C,MAAMM,EAAM,OAAO,KAAKyB,EAAW,WAAW,EAE9CA,EADa1B,GAAUC,EAAKF,EAAcJ,CAAG,CAAC,EAC7B,SAAS,WAAW,CACzC,CAEA,MAAO,GAAGgE,CAAa,IAAIC,CAAc,IAAIlC,CAAS,EAE1D,EAoBaoC,EAAS,CAClBb,EACAzB,EACA/B,EAA0B,CAAA,IAGqC,CAC/D,MAAMsE,EAAiBvE,EAAsBC,CAAO,EACpD,GAAIsE,EACA,MAAO,CACH,MAAO,GACP,MAAOA,CAAA,EAIf,IAAIC,EACJ,GAAI,CACAA,EAAUhB,EAAOC,CAAK,CAC1B,OAASM,EAAK,CACV,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAASA,EAAc,QACvB,KAAM,eAAA,CACV,CAER,CAEA,KAAM,CAAC,OAAAzD,EAAQ,QAAAT,EAAS,UAAAqC,CAAA,EAAasC,EAC/BC,EAAgBpE,EAAwBC,CAAM,EACpD,GAAImE,EACA,MAAO,CACH,MAAO,GACP,MAAOA,CAAA,EAIf,MAAMC,EAAgB9E,EAAyBC,CAAO,EACtD,GAAI6E,EACA,MAAO,CACH,MAAO,GACP,MAAOA,CAAA,EAKf,MAAMvE,EAAMG,EAAO,IACnB,GAAI,EAAEH,KAAOC,GACT,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,qCAAqCE,EAAO,GAAG,GACvD,KAAM,mBAAA,CACV,EAKR,GAAIL,EAAQ,YAAcA,EAAQ,WAAW,OAAS,GAC9C,CAACA,EAAQ,WAAW,SAASE,CAAG,EAChC,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAcA,CAAG,0CACzB,KAAM,uBAAA,CACV,EAMZ,GAAIG,EAAO,MAAQ,QAAaA,EAAO,MAAQ,MAC3C,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,4CAA4CA,EAAO,GAAG,IAC9D,KAAM,cAAA,CACV,EAKR,KAAM,CAACqD,EAAYC,CAAW,EAAIH,EAAM,MAAM,GAAG,EAC3CY,EAAe,GAAGV,CAAU,IAAIC,CAAW,GAEjD,GAAKhC,EAAWzB,CAAG,EAWZ,CAEH,MAAMwE,EAAS1E,EAAQ,gBAEvB,IAAI2E,EAGJ,GAAID,IAAW,OACX,GAAI,CACA,MAAMrD,EAAO,OAAO,KAAKY,EAAW,WAAW,EACzC2C,EAAexD,EAAUC,CAAI,EAAE,SAAS,WAAW,EACzDsD,EAAKxE,EAAmBD,CAAG,EAAE,OAAOkE,EAAcrC,EAAQ6C,CAAY,CAC1E,MAAQ,CACJD,EAAK,EACT,SAGKD,IAAW,MAChBC,EAAKxE,EAAmBD,CAAG,EAAE,OAAOkE,EAAcrC,EAAQE,CAAS,UAInE0C,EAAKxE,EAAmBD,CAAG,EAAE,OAAOkE,EAAcrC,EAAQE,CAAS,EAC/D,CAAC0C,EACD,GAAI,CACA,MAAMtD,EAAO,OAAO,KAAKY,EAAW,WAAW,EAE/C,GAAIZ,EAAK,SAAWf,EAAcJ,CAAG,EAAG,CACpC,MAAM0E,EAAexD,EAAUC,CAAI,EAAE,SAAS,WAAW,EACzDsD,EAAKxE,EAAmBD,CAAG,EAAE,OAAOkE,EAAcrC,EAAQ6C,CAAY,CAC1E,CACJ,MAAQ,CAER,CAIR,GAAI,CAACD,EACD,MAAO,CAAC,MAAO,GAAO,MAAO,CAAC,OAAQ,gCAAiC,KAAM,oBAAmB,CAExG,KAnDsB,CAElB,IAAIE,EAAmB,GACvB,GAAI,CACAA,EAAmB1E,EAAmBD,CAAG,EAAE,OAAOkE,EAAcrC,EAAQE,CAAS,CACrF,MAAQ,CACJ4C,EAAmB,EACvB,CACA,GAAI,CAACA,EACD,MAAO,CAAC,MAAO,GAAO,MAAO,CAAC,OAAQ,gCAAiC,KAAM,oBAAmB,CAExG,CA2CA,MAAMC,EAAM,KAAK,MAAM,KAAK,IAAA,EAAQ,GAAI,EAClCC,EAAO/E,EAAQ,WAAa,EAElC,GAAI,CAACA,EAAQ,kBACLJ,EAAQ,MAAQ,QAAakF,EAAMlF,EAAQ,IAAMmF,EACjD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gBACR,KAAM,eAAA,CACV,EAKZ,GAAInF,EAAQ,MAAQ,QAAakF,EAAMC,EAAOnF,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,sBACR,KAAM,kBAAA,CACV,EAIR,GAAIA,EAAQ,MAAQ,QAAakF,EAAMC,EAAOnF,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BACR,KAAM,qBAAA,CACV,EAKR,GAAII,EAAQ,cAAgB,QAAaJ,EAAQ,MAAQ,OAAW,CAChE,MAAMoF,EAAWF,EAAMlF,EAAQ,IAC/B,GAAIoF,EAAWhF,EAAQ,YACnB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAcgF,CAAQ,mCAAmChF,EAAQ,WAAW,KACpF,KAAM,eAAA,CACV,CAGZ,CAKA,GAAIA,EAAQ,SAAW,OAAW,CAC9B,GAAIJ,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,gBAAA,CACV,EAGR,GAAII,EAAQ,SAAWJ,EAAQ,IAC3B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,mCAAmCI,EAAQ,MAAM,WAAWJ,EAAQ,GAAG,IAC/E,KAAM,gBAAA,CACV,CAGZ,CAGA,GAAII,EAAQ,UAAY,OAAW,CAC/B,GAAIJ,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,+CACR,KAAM,iBAAA,CACV,EAGR,GAAII,EAAQ,UAAYJ,EAAQ,IAC5B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,oCAAoCI,EAAQ,OAAO,WAAWJ,EAAQ,GAAG,IACjF,KAAM,iBAAA,CACV,CAGZ,CAGA,GAAII,EAAQ,WAAa,OAAW,CAChC,MAAMiF,EAAMrF,EAAQ,IACpB,GAAIqF,IAAQ,OACR,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gDACR,KAAM,kBAAA,CACV,EAIR,MAAMC,EAAc,MAAM,QAAQlF,EAAQ,QAAQ,EAAIA,EAAQ,SAAW,CAACA,EAAQ,QAAQ,EACpFmF,EAAW,MAAM,QAAQF,CAAG,EAAIA,EAAM,CAACA,CAAG,EAGhD,GAAI,CADaC,EAAY,QAAUC,EAAS,SAAShG,CAAC,CAAC,EAEvD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,0BACR,KAAM,kBAAA,CACV,CAGZ,CAGA,GAAIa,EAAQ,QAAU,OAAW,CAC7B,GAAIJ,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,aAAA,CACV,EAGR,GAAII,EAAQ,QAAUJ,EAAQ,IAC1B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BAA6BI,EAAQ,KAAK,WAAWJ,EAAQ,GAAG,IACxE,KAAM,aAAA,CACV,CAGZ,CAEA,MAAO,CAAC,MAAO,GAAM,OAAAS,EAAQ,QAAAT,EAAS,UAAAqC,CAAA,CAC1C,EAGamD,GAAM,CACf,KAAArB,EACA,OAAAM,EACA,OAAAd,EACA,WAAYpD,CAChB,ECx1BO,SAASkF,EAAUvC,EAAqB,CAC3C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SAAU,MAAM,IAAI,MAAM,mBAAmB,EACxE,OAAOA,EAAI,OAAO,CAAC,OAAQ,MAAM,CACrC,CAMO,SAASwC,EAAUC,EAAqB,CAC3C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SAAU,MAAM,IAAI,MAAM,aAAa,EAElE,OAAQA,EAAI,IAAA,CACR,IAAK,MAAO,CACR,GAAI,EAAE,MAAOA,IAAQ,OAAOA,EAAI,GAAM,SAClC,MAAM,IAAI,MAAM,8BAA8B,EAGlD,OAAOjC,EAAAA,gBAAgB,OAAO,KAAKiC,EAAI,EAAG,WAAW,CAAC,CAC1D,CAEA,IAAK,MACL,IAAK,KACL,IAAK,MAED,MAAI,MAAOA,GAAO,OAAQA,EAAY,GAAM,SAEjCnC,EAAAA,iBAAiB,CAAC,OAAQ,MAAO,IAAKmC,EAAI,EAK9CC,EAAAA,gBAAgB,CAAC,OAAQ,MAAO,IAAKD,EAAI,EAGpD,QACI,MAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE,CAAA,CAE3E,CAMO,SAASE,EAAY3C,EAAqB,CAC7C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SACvB,MAAM,IAAI,MAAM,mBAAmB,EAQvC,MAAMyC,GAJFzC,EAAI,OAAS,UACP0C,EAAAA,gBAAgB1C,CAAG,EACnBA,GAEY,OAAO,CAAC,OAAQ,MAAM,EAG5C,cAAQyC,EAAY,EACpB,OAAQA,EAAY,EACpB,OAAQA,EAAY,EACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,GACbA,CACX,CAOO,SAASG,EAAiBH,EAAUI,EAAoB,SAAkB,CAC7E,GAAI,CAACJ,GAAO,OAAOA,GAAQ,SACvB,MAAM,IAAI,MAAM,aAAa,EAGjC,IAAIK,EAEJ,OAAQL,EAAI,IAAA,CACR,IAAK,MACDK,EAAS,CAAC,EAAGL,EAAI,EAAG,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAA,EACzC,MAEJ,IAAK,KACDK,EAAS,CAAC,IAAKL,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,EAAG,EAAGA,EAAI,CAAA,EACvD,MAEJ,IAAK,MACDK,EAAS,CAAC,IAAKL,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAA,EAC7C,MAEJ,IAAK,MACDK,EAAS,CAAC,EAAGL,EAAI,EAAG,IAAKA,EAAI,GAAA,EAC7B,MAEJ,QACI,MAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE,CAAA,CAIvE,MAAMM,EAAO,KAAK,UACd,OAAO,KAAKD,CAAM,EACb,OACA,OAAO,CAACE,EAAKjF,KACViF,EAAIjF,CAAC,EAAI+E,EAAO/E,CAAC,EACViF,GACR,CAAA,CAA4B,CAAA,EAGvC,OAAOC,EAAAA,WAAWJ,CAAO,EACpB,OAAOE,CAAI,EACX,OAAO,WAAW,CAC3B,CAOO,SAASG,EAAWT,EAA8B,OACrD,IAAKU,EAAAV,EAAI,MAAJ,MAAAU,EAAS,OACd,OAAOF,EAAAA,WAAW,MAAM,EAAE,OAAO,OAAO,KAAKR,EAAI,IAAI,CAAC,EAAG,QAAQ,CAAC,EAAE,OAAO,WAAW,CAC1F,CAEO,MAAMW,GAAM,CACf,OAAQb,EACR,OAAQC,EACR,SAAUG,EACV,WAAYC,CAChB,EAqBO,SAASS,EACZC,EACAC,EACS,CACT,GAAI,CAACD,GAAQ,CAAC,MAAM,QAAQA,EAAK,IAAI,EAAG,MAAM,IAAI,MAAM,cAAc,EAEtE,IAAIb,EAOJ,GALIc,MAAWD,EAAK,KAAK,KAAKvF,GAAKA,EAAE,MAAQwF,CAAG,GAG5C,CAACd,GAAOa,EAAK,KAAK,SAAW,IAAGb,EAAMa,EAAK,KAAK,CAAC,GAEjD,CAACb,EAAK,MAAM,IAAI,MAAM,uBAAuB,EACjD,OAAOD,EAAUC,CAAG,CACxB,CAMO,SAASe,EAAcF,EAAkB,CAC5C,MAAO,CACH,KAAMG,EAAa,GAAGH,EAAK,IAAI,CAAA,CAEvC,CAEO,SAASG,KAAgBC,EAA+B,CAC3D,OAAOA,EAAK,IAAKjB,GAAQ,CACrB,MAAMkB,EAAa,CACf,GAAGlB,EACH,IAAKA,EAAI,KAAOG,EAAiBH,CAAG,EACpC,IAAKA,EAAI,KAAOS,EAAWT,CAAG,CAAA,EAIlC,cAAO,eAAekB,EAAY,cAAe,CAC7C,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAMnB,EAAUmB,CAAU,CAAA,CACpC,EAEMA,CACX,CAAC,CACL,CAEO,MAAMC,EAAU,MACnBC,EACA3G,EAUK,KACmB,CACxB,MAAM4G,EAAU,OAAOD,GAAQ,SAAWA,EAAMA,EAAI,SAAA,EAC9CE,EAAU7G,EAAQ,OAAS,WAAW,MACtC8G,EAAM,KAAK,IAAI,EAAG9G,EAAQ,KAAO,EAAI,GAAM,EAC3C+G,EAAY,KAAK,IAAI,EAAG/G,EAAQ,WAAa,GAAK,EAClDgH,EAAgB,yBAEtB,GAAI,CAACH,EACD,MAAM,IAAI,MAAM,mCAAmC,EAGvD,MAAMI,GAAY,IAAM,CACpB,GAAIjH,EAAQ,iBAAkB,CAC1B,MAAMkH,EAAWlH,EAAQ,iBACzB,GAAI,CACA,OAAO,IAAI,IAAIkH,EAAUN,CAAO,EAAE,SAAA,CACtC,MAAQ,CACJ,OAAOM,CACX,CACJ,CAMA,OAJIlH,EAAQ,uBAIR4G,EAAQ,SAASI,CAAa,EACvBJ,EAGJ,GAAGA,EAAQ,QAAQ,OAAQ,EAAE,CAAC,GAAGI,CAAa,EACzD,GAAA,EAEMG,GAAS,IAAM,CACjB,GAAInH,EAAQ,MAAO,OAAOA,EAAQ,MAClC,IAAIoH,EACJ,MAAO,CACH,IAAK,IAAMA,EACX,IAAK,CAACC,EAAc3H,IAAgB,CAChC0H,EAAc1H,CAClB,CAAA,CAER,GAAA,EAEA,IAAI4H,EACAC,EAAgB,EAChBC,EACAC,EAAsB,EAE1B,MAAMC,EAAY,MAAOC,GAAgD,CACrE,GAAIH,EAAiB,OAAOA,EAE5BA,GAAmB,SAAY,CAC3B,MAAMI,EAAa,IAAI,gBACvB,IAAIC,EAEAd,EAAY,IACZc,EAAgB,WAAW,IAAMD,EAAW,MAAA,EAASb,CAAS,GAGlE,IAAIe,EACJ,GAAI,CACAA,EAAW,MAAMjB,EAAQI,EAAU,CAAC,OAAQW,EAAW,OAAO,CAClE,OAASG,EAAO,CACZ,MAAIH,EAAW,OAAO,QACZ,IAAI,MAAM,8BAA8Bb,CAAS,IAAI,EAEzDgB,CACV,QAAA,CACQF,gBAA4BA,CAAa,CACjD,CAEA,GAAI,CAACC,EAAS,GACV,MAAM,IAAI,MAAM,yBAAyBA,EAAS,MAAM,IAAIA,EAAS,UAAU,EAAE,EAGrF,MAAME,EAAO,MAAMF,EAAS,KAAA,EAC5B,GAAI,CAACE,GAAQ,OAAOA,GAAS,UAAY,CAAC,MAAM,QAASA,EAAa,IAAI,EACtE,MAAM,IAAI,MAAM,cAAc,EAGlC,OAAO1B,EAAc0B,CAAY,CACrC,GAAA,EAEA,GAAI,CACA,MAAMC,EAAQ,MAAMT,EACpB,OAAAF,EAAaW,EACb,MAAMd,EAAM,IAAIF,EAAUgB,CAAK,EAC/BR,EAAsB,EAClBX,EAAM,IAAGS,EAAgB,KAAK,MAAQT,GACnCmB,CACX,OAASF,EAAO,CACZ,GAAI,CAACJ,GAAuB,CAACL,EACzB,MAAMS,EAKV,GAFAN,GAAuB,EAEnBX,EAAM,EAAG,CACT,MAAMoB,EAAU,KAAK,IACjB,KAAK,IAAIpB,EAAK,GAAM,EAAI,KAAK,IAAI,EAAGW,EAAsB,CAAC,EAC3D,GAAK,EAETF,EAAgB,KAAK,MAAQW,CACjC,CAEA,eAAQ,KAAK,4BAA4BjB,CAAQ,wBAAyBc,CAAK,EACxET,CACX,QAAA,CACIE,EAAkB,MACtB,CACJ,EAEAF,EAAa,MAAMH,EAAM,IAAIF,CAAQ,EAChCK,GAGDA,EAAahB,EAAcgB,CAAU,EACjCR,EAAM,IAAGS,EAAgB,KAAK,MAAQT,IAH1CQ,EAAa,MAAMI,EAAU,EAAK,EAOtC,MAAMS,EAAyB,CAC3B,MAAM,MAAkC,CACpC,OAAIrB,EAAM,GAAK,KAAK,IAAA,GAASS,GACzB,MAAMG,EAAU,EAAI,EAEjBnB,EAAa,GAAIe,EAAoB,IAAI,CACpD,EACA,MAAM,SAAiC,CACnC,aAAMI,EAAU,EAAK,EACdS,CACX,EACA,MAAM,IAAI9B,EAAkD,CAExD,MAAMvD,GADO,MAAMqF,EAAS,KAAA,GACX,KAAMC,GAAMA,EAAE,MAAQ/B,CAAG,EAC1C,GAAKvD,EACL,OAAOyD,EAAazD,CAAG,EAAE,CAAC,CAC9B,EACA,MAAM,KAAK7D,EAAoD,CAC3D,MAAMuH,EAAO,MAAM2B,EAAS,KAAA,EACtBE,EAAU,OAAO,QAAQpJ,CAAK,EAEpC,OAAIoJ,EAAQ,SAAW,EAAU9B,EAAa,GAAGC,CAAI,EAE9CD,EAAa,GAAGC,EAAK,OAAQ1D,GAChCuF,EAAQ,MAAM,CAAC,CAACC,EAAOpG,CAAQ,IAAM,CACjC,MAAMxC,EAAQoD,EAAIwF,CAAK,EACvB,OAAI,MAAM,QAAQpG,CAAQ,EACf,MAAM,QAAQxC,CAAK,GACnBA,EAAM,SAAWwC,EAAS,QAC1BxC,EAAM,MAAM,CAAC6I,EAAM7H,IAAM6H,IAASrG,EAASxB,CAAC,CAAC,EAEjDhB,IAAUwC,CACrB,CAAC,CAAA,CACJ,CACL,EACA,MAAM,UAAUjD,EAA8D,CAC1E,OAAOkJ,EAAS,KAAKlJ,CAAK,EAAE,KAAK,CAAC,CAAC6D,CAAG,IAAMA,CAAG,CACnD,EACA,QAA2B,CACvB,OAAOwE,CACX,CAAA,EAGJ,OAAOa,CACX,EAEaK,GAAO,CAChB,YAAarC,EACb,UAAWG,EACX,QAAAI,CACJ"}