@zeltjs/auth-jwt 0.7.0 → 0.8.0

package/dist/index.d.ts

@@ -2,31 +2,6 @@ import { Env, Next, RequestContext, RequestContextSchema } from "@zeltjs/core";
 import * as _$hono_utils_http_status0 from "hono/utils/http-status";
 import * as _$hono_http_exception0 from "hono/http-exception";
 
-//#region src/errors.d.ts
-type JwtConfigErrorReason = 'missing_secret';
-declare const ZeltJwtConfigError: new (context: {
-  reason: JwtConfigErrorReason;
-}, cause?: unknown) => Error & {
-  readonly name: string;
-  readonly context: {
-    reason: JwtConfigErrorReason;
-  };
-};
-//#endregion
-//#region src/exceptions.d.ts
-type UnauthorizedReason = 'missing_token' | 'invalid_token' | 'expired';
-declare const UnauthorizedException: new (context: {
-  reason: UnauthorizedReason;
-}, options?: {
-  status?: _$hono_utils_http_status0.ContentfulStatusCode;
-  cause?: unknown;
-}) => _$hono_http_exception0.HTTPException & {
-  readonly name: string;
-  readonly context: {
-    reason: UnauthorizedReason;
-  };
-};
-//#endregion
 //#region src/jwt.types.d.ts
 interface JwtPayload {
   sub?: string;
@@ -42,7 +17,7 @@ interface ResolveUserResult {
   roles: RequestContextSchema['authRoles'];
 }
 declare class JwtConfig {
-  private env;
+  protected readonly env: Env;
   constructor(env?: Env);
   /**
    * @throws {ZeltJwtConfigError} When JWT_SECRET is not set
@@ -54,9 +29,34 @@ declare class JwtConfig {
   get resolveUser(): (payload: JwtPayload) => Promise<ResolveUserResult>;
 }
 //#endregion
+//#region src/jwt.errors.d.ts
+type JwtConfigErrorReason = 'missing_secret';
+declare const ZeltJwtConfigError: new (context: {
+  reason: JwtConfigErrorReason;
+}, cause?: unknown) => Error & {
+  readonly name: string;
+  readonly context: {
+    reason: JwtConfigErrorReason;
+  };
+};
+//#endregion
+//#region src/jwt.exceptions.d.ts
+type UnauthorizedReason = 'missing_token' | 'invalid_token' | 'expired';
+declare const UnauthorizedException: new (context: {
+  reason: UnauthorizedReason;
+}, options?: {
+  status?: _$hono_utils_http_status0.ContentfulStatusCode;
+  cause?: unknown;
+}) => _$hono_http_exception0.HTTPException & {
+  readonly name: string;
+  readonly context: {
+    reason: UnauthorizedReason;
+  };
+};
+//#endregion
 //#region src/jwt.service.d.ts
 declare class JwtService {
-  private config;
+  private readonly config;
   constructor(config?: JwtConfig);
   sign(payload: Record<string, unknown>): Promise<string>;
   verify(token: string): Promise<JwtPayload>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/errors.ts","../src/exceptions.ts","../src/jwt.types.ts","../src/jwt.config.ts","../src/jwt.service.ts","../src/jwt.middleware.ts"],"mappings":";;;;;KAEY,oBAAA;AAAA,cAMC,kBAAA,OAAkB,OAAA;UAEb,oBAAA;AAAA;;;YAAA,oBAAA;EAAA;AAAA;;;KCRN,kBAAA;AAAA,cAQC,qBAAA,OAAqB,OAAA;UAGhB,kBAAA;AAAA;WAAkB,yBAAA,CASw/I,oBAAA;;MAAA,sBAAA,CAAA,aAAA;EAAA;;YAT1gJ,kBAAA;EAAA;AAAA;;;UCbD,UAAA;EACf,GAAA;EACA,GAAA;EACA,GAAA;EAAA,CACC,GAAA;AAAA;AAAA,KAGS,SAAA;;;UCDK,iBAAA;EACf,IAAA,EAAM,oBAAA;EACN,KAAA,EAAO,oBAAA;AAAA;AAAA,cAII,SAAA;EAAA,QACS,GAAA;cAAA,GAAA,GAAG,GAAA;EHLZ;;;EAAA,IGUP,MAAA,CAAA;EAAA,IAQA,SAAA,CAAA;EAAA,IAIA,MAAA,CAAA,GAAU,SAAA;EAAA,IAIV,UAAA,CAAA;EAAA,IAIA,WAAA,CAAA,IAAgB,OAAA,EAAS,UAAA,KAAe,OAAA,CAAQ,iBAAA;AAAA;;;cC/BzC,UAAA;EAAA,QACS,MAAA;cAAA,MAAA,GAAM,SAAA;EAEpB,IAAA,CAAK,OAAA,EAAS,MAAA,oBAA0B,OAAA;EAaxC,MAAA,CAAO,KAAA,WAAgB,OAAA,CAAQ,UAAA;EAMrC,MAAA,CAAO,KAAA,WAAgB,UAAA;EAAA,QAQf,cAAA;AAAA;;;cC5BG,aAAA;EAAA,iBAEQ,UAAA;EAAA,iBACA,MAAA;cADA,UAAA,GAAU,UAAA,EACV,MAAA,GAAM,SAAA;;;;ALJ3B;;EKYQ,GAAA,CAAI,CAAA,EAAG,cAAA,EAAgB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,QAAA;EAAA,QAsB1C,YAAA;AAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/jwt.types.ts","../src/jwt.config.ts","../src/jwt.errors.ts","../src/jwt.exceptions.ts","../src/jwt.service.ts","../src/jwt.middleware.ts"],"mappings":";;;;;UAAiB,UAAA;EACf,GAAA;EACA,GAAA;EACA,GAAA;EAAA,CACC,GAAA;AAAA;AAAA,KAGS,SAAA;;;UCDK,iBAAA;EACf,IAAA,EAAM,oBAAA;EACN,KAAA,EAAO,oBAAA;AAAA;AAAA,cAII,SAAA;EAAA,mBACoB,GAAA,EAAG,GAAA;cAAH,GAAA,GAAG,GAAA;EDXlC;;;EAAA,ICgBI,MAAA,CAAA;EAAA,IAQA,SAAA,CAAA;EAAA,IAIA,MAAA,CAAA,GAAU,SAAA;EAAA,IAIV,UAAA,CAAA;EAAA,IAIA,WAAA,CAAA,IAAgB,OAAA,EAAS,UAAA,KAAe,OAAA,CAAQ,iBAAA;AAAA;;;KCpC1C,oBAAA;AAAA,cAMC,kBAAA,OAAkB,OAAA;UAEb,oBAAA;AAAA;;;YAAA,oBAAA;EAAA;AAAA;;;KCRN,kBAAA;AAAA,cAQC,qBAAA,OAAqB,OAAA;UAGhB,kBAAA;AAAA;WAAkB,yBAAA,CAMhC,oBAAA;;MAAA,sBAAA,CAAA,aAAA;EAAA;;YANc,kBAAA;EAAA;AAAA;;;cCNL,UAAA;EAAA,iBACkB,MAAA;cAAA,MAAA,GAAM,SAAA;EAE7B,IAAA,CAAK,OAAA,EAAS,MAAA,oBAA0B,OAAA;EAaxC,MAAA,CAAO,KAAA,WAAgB,OAAA,CAAQ,UAAA;EAMrC,MAAA,CAAO,KAAA,WAAgB,UAAA;EAAA,QAQf,cAAA;AAAA;;;cC7BG,aAAA;EAAA,iBAEQ,UAAA;EAAA,iBACA,MAAA;cADA,UAAA,GAAU,UAAA,EACV,MAAA,GAAM,SAAA;;;;;;EAQnB,GAAA,CAAI,CAAA,EAAG,cAAA,EAAgB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,QAAA;EAAA,QAsB1C,YAAA;AAAA"}

package/dist/index.js

@@ -1,25 +1,10 @@
-import { defineError } from "@zeltjs/core/internal-bridge/errors";
 import { Config, Env, Injectable, Middleware, defineHttpException, inject, setUser } from "@zeltjs/core";
+import { defineError } from "@zeltjs/core/internal-bridge/errors";
 import { getCookie } from "hono/cookie";
-//#region src/errors.ts
+//#region src/jwt.errors.ts
 const messages$1 = { missing_secret: "JWT_SECRET environment variable is required" };
 const ZeltJwtConfigError = defineError("ZeltJwtConfigError", (ctx) => messages$1[ctx.reason]);
 //#endregion
-//#region src/exceptions.ts
-const messages = {
-	missing_token: "Authorization token is required",
-	invalid_token: "Invalid authorization token",
-	expired: "Authorization token has expired"
-};
-const UnauthorizedException = defineHttpException("UnauthorizedException", 401, (ctx) => messages[ctx.reason], { buildResponse: (ctx, status, message) => Response.json({
-	code: "UNAUTHORIZED",
-	reason: ctx.reason,
-	message
-}, {
-	status,
-	headers: { "WWW-Authenticate": "Bearer" }
-}) });
-//#endregion
 //#region src/jwt.config.ts
 function _ts_decorate$2(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -63,6 +48,21 @@ JwtConfig = _ts_decorate$2([
 	_ts_metadata$2("design:paramtypes", [void 0])
 ], JwtConfig);
 //#endregion
+//#region src/jwt.exceptions.ts
+const messages = {
+	missing_token: "Authorization token is required",
+	invalid_token: "Invalid authorization token",
+	expired: "Authorization token has expired"
+};
+const UnauthorizedException = defineHttpException("UnauthorizedException", 401, (ctx) => messages[ctx.reason], { buildResponse: (ctx, status, message) => Response.json({
+	code: "UNAUTHORIZED",
+	reason: ctx.reason,
+	message
+}, {
+	status,
+	headers: { "WWW-Authenticate": "Bearer" }
+}) });
+//#endregion
 //#region ../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/buffer_utils.js
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["defineError","messages","missing_secret","ZeltJwtConfigError","ctx","reason","defineHttpException","messages","missing_token","invalid_token","expired","UnauthorizedException","ctx","reason","buildResponse","status","message","Response","json","code","headers","Config","Env","inject","ZeltJwtConfigError","JwtConfig","secret","env","getString","reason","expiresIn","driver","cookieName","resolveUser","payload","user","sub","roles","encoder","TextEncoder","decoder","TextDecoder","MAX_INT32","concat","buffers","size","reduce","acc","length","buf","Uint8Array","i","buffer","set","writeUInt32BE","value","offset","RangeError","uint64be","high","Math","floor","low","uint32be","encodeBase64","input","Uint8Array","prototype","toBase64","CHUNK_SIZE","arr","i","length","push","String","fromCharCode","apply","subarray","btoa","join","decodeBase64","encoded","fromBase64","binary","atob","bytes","charCodeAt","encoder","decoder","encodeBase64","decodeBase64","decode","input","Uint8Array","fromBase64","alphabet","encoded","replace","TypeError","encode","unencoded","prototype","toBase64","omitPadding","JOSEError","Error","message","options","code","name","captureStackTrace","JWTClaimValidationFailed","payload","claim","reason","cause","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWEDecryptionFailed","JWEInvalid","JWSInvalid","JWTInvalid","JWKInvalid","JWKSInvalid","JWKSNoMatchingKey","JWKSMultipleMatchingKeys","JWKSTimeout","JWSSignatureVerificationFailed","unusable","name","prop","TypeError","isAlgorithm","algorithm","getHashLength","hash","parseInt","slice","getNamedCurve","alg","Error","checkUsage","key","usage","usages","includes","checkSigCryptoKey","expected","actual","namedCurve","checkEncCryptoKey","length","message","msg","actual","types","filter","Boolean","length","last","pop","join","name","withAlg","alg","assertCryptoKey","key","isCryptoKey","Error","Symbol","toStringTag","isKeyObject","headers","sources","filter","Boolean","length","acc","header","parameters","Object","keys","size","Set","parameter","has","add","isObjectLike","value","input","Object","prototype","toString","call","getPrototypeOf","proto","alg","key","startsWith","modulusLength","algorithm","TypeError","JOSENotSupported","subtleMapping","jwk","algorithm","keyUsages","kty","alg","name","hash","slice","d","parseInt","namedCurve","crv","TypeError","keyData","use","crypto","subtle","importKey","ext","key_ops","JOSENotSupported","Err","recognizedDefault","recognizedOption","protectedHeader","joseHeader","crit","undefined","Set","Array","isArray","length","some","input","recognized","Map","Object","entries","parameter","has","get","option","algorithms","undefined","Array","isArray","some","s","TypeError","Set","isObject","isJWK","key","kty","isPrivateJWK","d","isPublicJWK","isSecretJWK","k","isJWK","decode","importJWK","isCryptoKey","isKeyObject","cache","handleJWK","key","jwk","alg","freeze","WeakMap","cached","get","cryptoKey","Object","set","handleKeyObject","keyObject","isPublic","type","extractable","asymmetricKeyType","TypeError","toCryptoKey","hash","startsWith","name","nist","Map","namedCurve","asymmetricKeyDetails","Uint8Array","export","err","format","k","Error","withAlg","invalidKeyInput","isKeyLike","jwk","tag","key","Symbol","toStringTag","jwkMatchesOp","alg","usage","use","undefined","expected","TypeError","Array","isArray","key_ops","expectedKeyOp","includes","startsWith","test","endsWith","symmetricTypeCheck","Uint8Array","isJWK","isSecretJWK","type","asymmetricTypeCheck","isPrivateJWK","isPublicJWK","symmetric","JOSENotSupported","alg","algorithm","hash","slice","name","saltLength","parseInt","namedCurve","checkSigCryptoKey","invalidKeyInput","alg","key","usage","Uint8Array","startsWith","TypeError","crypto","subtle","importKey","hash","slice","name","subtleAlgorithm","checkKeyLength","getVerifyKey","alg","key","signature","data","cryptoKey","algorithm","crypto","subtle","verify","decode","b64u","verify","JOSEAlgNotAllowed","JWSInvalid","JWSSignatureVerificationFailed","concat","encoder","decoder","isDisjoint","isObject","checkKeyType","validateCrit","validateAlgorithms","normalizeKey","flattenedVerify","jws","key","options","protected","undefined","header","payload","signature","parsedProt","protectedHeader","JSON","parse","joseHeader","extensions","Map","crit","b64","has","alg","algorithms","Uint8Array","resolvedKey","data","encode","k","verified","result","unprotectedHeader","flattenedVerify","JWSInvalid","decoder","compactVerify","jws","key","options","Uint8Array","decode","protectedHeader","payload","signature","length","split","verified","protected","result","date","Math","floor","getTime","minute","hour","day","week","year","REGEX","str","matched","exec","TypeError","value","parseFloat","unit","toLowerCase","numericDate","Math","round","JWTClaimValidationFailed","JWTExpired","JWTInvalid","decoder","epoch","secs","isObject","encoder","validateInput","label","input","Number","isFinite","TypeError","normalizeTyp","value","includes","toLowerCase","checkAudiencePresence","audPayload","audOption","Array","isArray","some","Set","prototype","has","bind","validateClaimsSet","protectedHeader","encodedPayload","options","payload","JSON","parse","decode","typ","requiredClaims","issuer","subject","audience","maxTokenAge","presenceCheck","undefined","push","claim","reverse","iss","sub","aud","tolerance","clockTolerance","currentDate","now","Date","iat","nbf","exp","age","max","JWTClaimsBuilder","data","encode","stringify","jti","structuredClone","compactVerify","validateClaimsSet","JWTInvalid","jwtVerify","jwt","key","options","verified","protectedHeader","crit","includes","b64","payload","result","subtleAlgorithm","checkKeyLength","getSignKey","alg","key","data","cryptoKey","signature","crypto","subtle","sign","algorithm","Uint8Array","encode","b64u","sign","isDisjoint","JWSInvalid","encoder","decoder","concat","checkKeyType","validateCrit","normalizeKey","FlattenedSign","setProtectedHeader","protectedHeader","TypeError","setUnprotectedHeader","unprotectedHeader","key","options","joseHeader","extensions","Map","crit","b64","has","alg","payload","JSON","stringify","data","k","signature","jws","decode","header","protected","Uint8Array","FlattenedSign","CompactSign","setProtectedHeader","protectedHeader","sign","key","options","jws","payload","undefined","TypeError","protected","signature","CompactSign","JWTInvalid","JWTClaimsBuilder","SignJWT","setIssuer","issuer","iss","setSubject","subject","sub","setAudience","audience","aud","setJti","jwtId","jti","setNotBefore","input","nbf","setExpirationTime","exp","setIssuedAt","iat","setProtectedHeader","protectedHeader","sign","key","options","sig","data","Array","isArray","crit","includes","b64","payload","decode","b64u","decoder","isObject","JWTInvalid","decodeJwt","jwt","payload","length","split","decoded","result","JSON","parse","Injectable","inject","decodeJwt","jwtVerify","SignJWT","JwtConfig","JwtService","sign","payload","secret","TextEncoder","encode","config","expiresIn","parseExpiresIn","jwt","setProtectedHeader","alg","setIssuedAt","setExpirationTime","verify","token","decode","match","exec","value","parseInt","unit","unitMap","s","m","h","d","inject","Middleware","setUser","getCookie","UnauthorizedException","JwtConfig","JwtService","JwtMiddleware","use","c","next","token","extractToken","reason","verified","jwtService","verify","then","payload","ok","user","roles","config","resolveUser","undefined","driver","cookieName","authHeader","req","header","startsWith","slice"],"sources":["../src/errors.ts","../src/exceptions.ts","../src/jwt.config.ts","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/base64.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/util/base64url.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/util/errors.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/crypto_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/invalid_key_input.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_key_like.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_disjoint.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_object.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/check_key_length.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/jwk_to_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/validate_crit.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/validate_algorithms.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_jwk.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/normalize_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/check_key_type.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/subtle_dsa.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/get_sign_verify_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/flattened/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/compact/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/epoch.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/secs.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jwt/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/flattened/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/compact/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jwt/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/util/decode_jwt.js","../src/jwt.service.ts","../src/jwt.middleware.ts"],"sourcesContent":["import { defineError } from '@zeltjs/core/internal-bridge/errors';\n\nexport type JwtConfigErrorReason = 'missing_secret';\n\nconst messages: Record<JwtConfigErrorReason, string> = {\n  missing_secret: 'JWT_SECRET environment variable is required',\n};\n\nexport const ZeltJwtConfigError = defineError(\n  'ZeltJwtConfigError',\n  (ctx: { reason: JwtConfigErrorReason }) => messages[ctx.reason],\n);\n","import { defineHttpException } from '@zeltjs/core';\n\nexport type UnauthorizedReason = 'missing_token' | 'invalid_token' | 'expired';\n\nconst messages: Record<UnauthorizedReason, string> = {\n  missing_token: 'Authorization token is required',\n  invalid_token: 'Invalid authorization token',\n  expired: 'Authorization token has expired',\n};\n\nexport const UnauthorizedException = defineHttpException(\n  'UnauthorizedException',\n  401,\n  (ctx: { reason: UnauthorizedReason }) => messages[ctx.reason],\n  {\n    buildResponse: (ctx, status, message) =>\n      Response.json(\n        { code: 'UNAUTHORIZED', reason: ctx.reason, message },\n        { status, headers: { 'WWW-Authenticate': 'Bearer' } },\n      ),\n  },\n);\n","import type { RequestContextSchema } from '@zeltjs/core';\nimport { Config, Env, inject } from '@zeltjs/core';\n\nimport { ZeltJwtConfigError } from './errors';\nimport type { JwtDriver, JwtPayload } from './jwt.types';\n\nexport interface ResolveUserResult {\n  user: RequestContextSchema['user'];\n  roles: RequestContextSchema['authRoles'];\n}\n\n@Config\nexport class JwtConfig {\n  constructor(private env = inject(Env)) {}\n\n  /**\n   * @throws {ZeltJwtConfigError} When JWT_SECRET is not set\n   */\n  get secret(): string {\n    const secret = this.env.getString('JWT_SECRET');\n    if (!secret) {\n      throw new ZeltJwtConfigError({ reason: 'missing_secret' });\n    }\n    return secret;\n  }\n\n  get expiresIn(): string {\n    return '1h';\n  }\n\n  get driver(): JwtDriver {\n    return 'header';\n  }\n\n  get cookieName(): string {\n    return 'jwt';\n  }\n\n  get resolveUser(): (payload: JwtPayload) => Promise<ResolveUserResult> {\n    return async (payload) => ({\n      user: payload.sub,\n      roles: [],\n    });\n  }\n}\n","export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n    const size = buffers.reduce((acc, { length }) => acc + length, 0);\n    const buf = new Uint8Array(size);\n    let i = 0;\n    for (const buffer of buffers) {\n        buf.set(buffer, i);\n        i += buffer.length;\n    }\n    return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n    if (value < 0 || value >= MAX_INT32) {\n        throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n    }\n    buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n    const high = Math.floor(value / MAX_INT32);\n    const low = value % MAX_INT32;\n    const buf = new Uint8Array(8);\n    writeUInt32BE(buf, high, 0);\n    writeUInt32BE(buf, low, 4);\n    return buf;\n}\nexport function uint32be(value) {\n    const buf = new Uint8Array(4);\n    writeUInt32BE(buf, value);\n    return buf;\n}\n","export function encodeBase64(input) {\n    if (Uint8Array.prototype.toBase64) {\n        return input.toBase64();\n    }\n    const CHUNK_SIZE = 0x8000;\n    const arr = [];\n    for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n    }\n    return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(encoded);\n    }\n    const binary = atob(encoded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n            alphabet: 'base64url',\n        });\n    }\n    let encoded = input;\n    if (encoded instanceof Uint8Array) {\n        encoded = decoder.decode(encoded);\n    }\n    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, '');\n    try {\n        return decodeBase64(encoded);\n    }\n    catch {\n        throw new TypeError('The input to be decoded is not correctly encoded.');\n    }\n}\nexport function encode(input) {\n    let unencoded = input;\n    if (typeof unencoded === 'string') {\n        unencoded = encoder.encode(unencoded);\n    }\n    if (Uint8Array.prototype.toBase64) {\n        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n    }\n    return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","export class JOSEError extends Error {\n    static code = 'ERR_JOSE_GENERIC';\n    code = 'ERR_JOSE_GENERIC';\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n    static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JWTExpired extends JOSEError {\n    static code = 'ERR_JWT_EXPIRED';\n    code = 'ERR_JWT_EXPIRED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n    static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n    code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n    static code = 'ERR_JOSE_NOT_SUPPORTED';\n    code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n    static code = 'ERR_JWE_DECRYPTION_FAILED';\n    code = 'ERR_JWE_DECRYPTION_FAILED';\n    constructor(message = 'decryption operation failed', options) {\n        super(message, options);\n    }\n}\nexport class JWEInvalid extends JOSEError {\n    static code = 'ERR_JWE_INVALID';\n    code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n    static code = 'ERR_JWS_INVALID';\n    code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n    static code = 'ERR_JWT_INVALID';\n    code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n    static code = 'ERR_JWK_INVALID';\n    code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n    static code = 'ERR_JWKS_INVALID';\n    code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n    static code = 'ERR_JWKS_NO_MATCHING_KEY';\n    code = 'ERR_JWKS_NO_MATCHING_KEY';\n    constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n    [Symbol.asyncIterator];\n    static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSTimeout extends JOSEError {\n    static code = 'ERR_JWKS_TIMEOUT';\n    code = 'ERR_JWKS_TIMEOUT';\n    constructor(message = 'request timed out', options) {\n        super(message, options);\n    }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n    static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    constructor(message = 'signature verification failed', options) {\n        super(message, options);\n    }\n}\n","function unusable(name, prop = 'algorithm.name') {\n    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\n}\nfunction isAlgorithm(algorithm, name) {\n    return algorithm.name === name;\n}\nfunction getHashLength(hash) {\n    return parseInt(hash.name.slice(4), 10);\n}\nfunction getNamedCurve(alg) {\n    switch (alg) {\n        case 'ES256':\n            return 'P-256';\n        case 'ES384':\n            return 'P-384';\n        case 'ES512':\n            return 'P-521';\n        default:\n            throw new Error('unreachable');\n    }\n}\nfunction checkUsage(key, usage) {\n    if (usage && !key.usages.includes(usage)) {\n        throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n    }\n}\nexport function checkSigCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512': {\n            if (!isAlgorithm(key.algorithm, 'HMAC'))\n                throw unusable('HMAC');\n            const expected = parseInt(alg.slice(2), 10);\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        case 'RS256':\n        case 'RS384':\n        case 'RS512': {\n            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))\n                throw unusable('RSASSA-PKCS1-v1_5');\n            const expected = parseInt(alg.slice(2), 10);\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        case 'PS256':\n        case 'PS384':\n        case 'PS512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))\n                throw unusable('RSA-PSS');\n            const expected = parseInt(alg.slice(2), 10);\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        case 'Ed25519':\n        case 'EdDSA': {\n            if (!isAlgorithm(key.algorithm, 'Ed25519'))\n                throw unusable('Ed25519');\n            break;\n        }\n        case 'ES256':\n        case 'ES384':\n        case 'ES512': {\n            if (!isAlgorithm(key.algorithm, 'ECDSA'))\n                throw unusable('ECDSA');\n            const expected = getNamedCurve(alg);\n            const actual = key.algorithm.namedCurve;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.namedCurve');\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\nexport function checkEncCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'A128GCM':\n        case 'A192GCM':\n        case 'A256GCM': {\n            if (!isAlgorithm(key.algorithm, 'AES-GCM'))\n                throw unusable('AES-GCM');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'A128KW':\n        case 'A192KW':\n        case 'A256KW': {\n            if (!isAlgorithm(key.algorithm, 'AES-KW'))\n                throw unusable('AES-KW');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'ECDH': {\n            switch (key.algorithm.name) {\n                case 'ECDH':\n                case 'X25519':\n                    break;\n                default:\n                    throw unusable('ECDH or X25519');\n            }\n            break;\n        }\n        case 'PBES2-HS256+A128KW':\n        case 'PBES2-HS384+A192KW':\n        case 'PBES2-HS512+A256KW':\n            if (!isAlgorithm(key.algorithm, 'PBKDF2'))\n                throw unusable('PBKDF2');\n            break;\n        case 'RSA-OAEP':\n        case 'RSA-OAEP-256':\n        case 'RSA-OAEP-384':\n        case 'RSA-OAEP-512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))\n                throw unusable('RSA-OAEP');\n            const expected = parseInt(alg.slice(9), 10) || 1;\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\n","function message(msg, actual, ...types) {\n    types = types.filter(Boolean);\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `one of type ${types.join(', ')}, or ${last}.`;\n    }\n    else if (types.length === 2) {\n        msg += `one of type ${types[0]} or ${types[1]}.`;\n    }\n    else {\n        msg += `of type ${types[0]}.`;\n    }\n    if (actual == null) {\n        msg += ` Received ${actual}`;\n    }\n    else if (typeof actual === 'function' && actual.name) {\n        msg += ` Received function ${actual.name}`;\n    }\n    else if (typeof actual === 'object' && actual != null) {\n        if (actual.constructor?.name) {\n            msg += ` Received an instance of ${actual.constructor.name}`;\n        }\n    }\n    return msg;\n}\nexport default (actual, ...types) => {\n    return message('Key must be ', actual, ...types);\n};\nexport function withAlg(alg, actual, ...types) {\n    return message(`Key for the ${alg} algorithm must be `, actual, ...types);\n}\n","export function assertCryptoKey(key) {\n    if (!isCryptoKey(key)) {\n        throw new Error('CryptoKey instance expected');\n    }\n}\nexport function isCryptoKey(key) {\n    return key?.[Symbol.toStringTag] === 'CryptoKey';\n}\nexport function isKeyObject(key) {\n    return key?.[Symbol.toStringTag] === 'KeyObject';\n}\nexport default (key) => {\n    return isCryptoKey(key) || isKeyObject(key);\n};\n","export default (...headers) => {\n    const sources = headers.filter(Boolean);\n    if (sources.length === 0 || sources.length === 1) {\n        return true;\n    }\n    let acc;\n    for (const header of sources) {\n        const parameters = Object.keys(header);\n        if (!acc || acc.size === 0) {\n            acc = new Set(parameters);\n            continue;\n        }\n        for (const parameter of parameters) {\n            if (acc.has(parameter)) {\n                return false;\n            }\n            acc.add(parameter);\n        }\n    }\n    return true;\n};\n","function isObjectLike(value) {\n    return typeof value === 'object' && value !== null;\n}\nexport default (input) => {\n    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n        return false;\n    }\n    if (Object.getPrototypeOf(input) === null) {\n        return true;\n    }\n    let proto = input;\n    while (Object.getPrototypeOf(proto) !== null) {\n        proto = Object.getPrototypeOf(proto);\n    }\n    return Object.getPrototypeOf(input) === proto;\n};\n","export default (alg, key) => {\n    if (alg.startsWith('RS') || alg.startsWith('PS')) {\n        const { modulusLength } = key.algorithm;\n        if (typeof modulusLength !== 'number' || modulusLength < 2048) {\n            throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n        }\n    }\n};\n","import { JOSENotSupported } from '../util/errors.js';\nfunction subtleMapping(jwk) {\n    let algorithm;\n    let keyUsages;\n    switch (jwk.kty) {\n        case 'RSA': {\n            switch (jwk.alg) {\n                case 'PS256':\n                case 'PS384':\n                case 'PS512':\n                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RS256':\n                case 'RS384':\n                case 'RS512':\n                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RSA-OAEP':\n                case 'RSA-OAEP-256':\n                case 'RSA-OAEP-384':\n                case 'RSA-OAEP-512':\n                    algorithm = {\n                        name: 'RSA-OAEP',\n                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n                    };\n                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n                    break;\n                default:\n                    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n            }\n            break;\n        }\n        case 'EC': {\n            switch (jwk.alg) {\n                case 'ES256':\n                    algorithm = { name: 'ECDSA', namedCurve: 'P-256' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ES384':\n                    algorithm = { name: 'ECDSA', namedCurve: 'P-384' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ES512':\n                    algorithm = { name: 'ECDSA', namedCurve: 'P-521' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n            }\n            break;\n        }\n        case 'OKP': {\n            switch (jwk.alg) {\n                case 'Ed25519':\n                case 'EdDSA':\n                    algorithm = { name: 'Ed25519' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n            }\n            break;\n        }\n        default:\n            throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n    }\n    return { algorithm, keyUsages };\n}\nexport default async (jwk) => {\n    if (!jwk.alg) {\n        throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n    }\n    const { algorithm, keyUsages } = subtleMapping(jwk);\n    const keyData = { ...jwk };\n    delete keyData.alg;\n    delete keyData.use;\n    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);\n};\n","import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';\nexport default (Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) => {\n    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n    }\n    if (!protectedHeader || protectedHeader.crit === undefined) {\n        return new Set();\n    }\n    if (!Array.isArray(protectedHeader.crit) ||\n        protectedHeader.crit.length === 0 ||\n        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n    }\n    let recognized;\n    if (recognizedOption !== undefined) {\n        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);\n    }\n    else {\n        recognized = recognizedDefault;\n    }\n    for (const parameter of protectedHeader.crit) {\n        if (!recognized.has(parameter)) {\n            throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n        }\n        if (joseHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n        }\n        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n        }\n    }\n    return new Set(protectedHeader.crit);\n};\n","export default (option, algorithms) => {\n    if (algorithms !== undefined &&\n        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {\n        throw new TypeError(`\"${option}\" option must be an array of strings`);\n    }\n    if (!algorithms) {\n        return undefined;\n    }\n    return new Set(algorithms);\n};\n","import isObject from './is_object.js';\nexport function isJWK(key) {\n    return isObject(key) && typeof key.kty === 'string';\n}\nexport function isPrivateJWK(key) {\n    return key.kty !== 'oct' && typeof key.d === 'string';\n}\nexport function isPublicJWK(key) {\n    return key.kty !== 'oct' && typeof key.d === 'undefined';\n}\nexport function isSecretJWK(key) {\n    return key.kty === 'oct' && typeof key.k === 'string';\n}\n","import { isJWK } from './is_jwk.js';\nimport { decode } from '../util/base64url.js';\nimport importJWK from './jwk_to_key.js';\nimport { isCryptoKey, isKeyObject } from './is_key_like.js';\nlet cache;\nconst handleJWK = async (key, jwk, alg, freeze = false) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(key);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const cryptoKey = await importJWK({ ...jwk, alg });\n    if (freeze)\n        Object.freeze(key);\n    if (!cached) {\n        cache.set(key, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nconst handleKeyObject = (keyObject, alg) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(keyObject);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const isPublic = keyObject.type === 'public';\n    const extractable = isPublic ? true : false;\n    let cryptoKey;\n    if (keyObject.asymmetricKeyType === 'x25519') {\n        switch (alg) {\n            case 'ECDH-ES':\n            case 'ECDH-ES+A128KW':\n            case 'ECDH-ES+A192KW':\n            case 'ECDH-ES+A256KW':\n                break;\n            default:\n                throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);\n    }\n    if (keyObject.asymmetricKeyType === 'ed25519') {\n        if (alg !== 'EdDSA' && alg !== 'Ed25519') {\n            throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n            isPublic ? 'verify' : 'sign',\n        ]);\n    }\n    if (keyObject.asymmetricKeyType === 'rsa') {\n        let hash;\n        switch (alg) {\n            case 'RSA-OAEP':\n                hash = 'SHA-1';\n                break;\n            case 'RS256':\n            case 'PS256':\n            case 'RSA-OAEP-256':\n                hash = 'SHA-256';\n                break;\n            case 'RS384':\n            case 'PS384':\n            case 'RSA-OAEP-384':\n                hash = 'SHA-384';\n                break;\n            case 'RS512':\n            case 'PS512':\n            case 'RSA-OAEP-512':\n                hash = 'SHA-512';\n                break;\n            default:\n                throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        if (alg.startsWith('RSA-OAEP')) {\n            return keyObject.toCryptoKey({\n                name: 'RSA-OAEP',\n                hash,\n            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);\n        }\n        cryptoKey = keyObject.toCryptoKey({\n            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',\n            hash,\n        }, extractable, [isPublic ? 'verify' : 'sign']);\n    }\n    if (keyObject.asymmetricKeyType === 'ec') {\n        const nist = new Map([\n            ['prime256v1', 'P-256'],\n            ['secp384r1', 'P-384'],\n            ['secp521r1', 'P-521'],\n        ]);\n        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);\n        if (!namedCurve) {\n            throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        if (alg === 'ES256' && namedCurve === 'P-256') {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg === 'ES384' && namedCurve === 'P-384') {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg === 'ES512' && namedCurve === 'P-521') {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg.startsWith('ECDH-ES')) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDH',\n                namedCurve,\n            }, extractable, isPublic ? [] : ['deriveBits']);\n        }\n    }\n    if (!cryptoKey) {\n        throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n    }\n    if (!cached) {\n        cache.set(keyObject, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nexport default async (key, alg) => {\n    if (key instanceof Uint8Array) {\n        return key;\n    }\n    if (isCryptoKey(key)) {\n        return key;\n    }\n    if (isKeyObject(key)) {\n        if (key.type === 'secret') {\n            return key.export();\n        }\n        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {\n            try {\n                return handleKeyObject(key, alg);\n            }\n            catch (err) {\n                if (err instanceof TypeError) {\n                    throw err;\n                }\n            }\n        }\n        let jwk = key.export({ format: 'jwk' });\n        return handleJWK(key, jwk, alg);\n    }\n    if (isJWK(key)) {\n        if (key.k) {\n            return decode(key.k);\n        }\n        return handleJWK(key, key, alg, true);\n    }\n    throw new Error('unreachable');\n};\n","import { withAlg as invalidKeyInput } from './invalid_key_input.js';\nimport isKeyLike from './is_key_like.js';\nimport * as jwk from './is_jwk.js';\nconst tag = (key) => key?.[Symbol.toStringTag];\nconst jwkMatchesOp = (alg, key, usage) => {\n    if (key.use !== undefined) {\n        let expected;\n        switch (usage) {\n            case 'sign':\n            case 'verify':\n                expected = 'sig';\n                break;\n            case 'encrypt':\n            case 'decrypt':\n                expected = 'enc';\n                break;\n        }\n        if (key.use !== expected) {\n            throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n        }\n    }\n    if (key.alg !== undefined && key.alg !== alg) {\n        throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n    }\n    if (Array.isArray(key.key_ops)) {\n        let expectedKeyOp;\n        switch (true) {\n            case usage === 'sign' || usage === 'verify':\n            case alg === 'dir':\n            case alg.includes('CBC-HS'):\n                expectedKeyOp = usage;\n                break;\n            case alg.startsWith('PBES2'):\n                expectedKeyOp = 'deriveBits';\n                break;\n            case /^A\\d{3}(?:GCM)?(?:KW)?$/.test(alg):\n                if (!alg.includes('GCM') && alg.endsWith('KW')) {\n                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';\n                }\n                else {\n                    expectedKeyOp = usage;\n                }\n                break;\n            case usage === 'encrypt' && alg.startsWith('RSA'):\n                expectedKeyOp = 'wrapKey';\n                break;\n            case usage === 'decrypt':\n                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';\n                break;\n        }\n        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {\n            throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n        }\n    }\n    return true;\n};\nconst symmetricTypeCheck = (alg, key, usage) => {\n    if (key instanceof Uint8Array)\n        return;\n    if (jwk.isJWK(key)) {\n        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))\n            return;\n        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present`);\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));\n    }\n    if (key.type !== 'secret') {\n        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type \"secret\"`);\n    }\n};\nconst asymmetricTypeCheck = (alg, key, usage) => {\n    if (jwk.isJWK(key)) {\n        switch (usage) {\n            case 'decrypt':\n            case 'sign':\n                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation be a private JWK`);\n            case 'encrypt':\n            case 'verify':\n                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation be a public JWK`);\n        }\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n    }\n    if (key.type === 'secret') {\n        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type \"secret\"`);\n    }\n    if (key.type === 'public') {\n        switch (usage) {\n            case 'sign':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type \"private\"`);\n            case 'decrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type \"private\"`);\n            default:\n                break;\n        }\n    }\n    if (key.type === 'private') {\n        switch (usage) {\n            case 'verify':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type \"public\"`);\n            case 'encrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type \"public\"`);\n            default:\n                break;\n        }\n    }\n};\nexport default (alg, key, usage) => {\n    const symmetric = alg.startsWith('HS') ||\n        alg === 'dir' ||\n        alg.startsWith('PBES2') ||\n        /^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(alg) ||\n        /^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(alg);\n    if (symmetric) {\n        symmetricTypeCheck(alg, key, usage);\n    }\n    else {\n        asymmetricTypeCheck(alg, key, usage);\n    }\n};\n","import { JOSENotSupported } from '../util/errors.js';\nexport default (alg, algorithm) => {\n    const hash = `SHA-${alg.slice(-3)}`;\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512':\n            return { hash, name: 'HMAC' };\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { hash, name: 'RSA-PSS', saltLength: parseInt(alg.slice(-3), 10) >> 3 };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { hash, name: 'RSASSA-PKCS1-v1_5' };\n        case 'ES256':\n        case 'ES384':\n        case 'ES512':\n            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };\n        case 'Ed25519':\n        case 'EdDSA':\n            return { name: 'Ed25519' };\n        default:\n            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n    }\n};\n","import { checkSigCryptoKey } from './crypto_key.js';\nimport invalidKeyInput from './invalid_key_input.js';\nexport default async (alg, key, usage) => {\n    if (key instanceof Uint8Array) {\n        if (!alg.startsWith('HS')) {\n            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n        }\n        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);\n    }\n    checkSigCryptoKey(key, alg, usage);\n    return key;\n};\n","import subtleAlgorithm from './subtle_dsa.js';\nimport checkKeyLength from './check_key_length.js';\nimport getVerifyKey from './get_sign_verify_key.js';\nexport default async (alg, key, signature, data) => {\n    const cryptoKey = await getVerifyKey(alg, key, 'verify');\n    checkKeyLength(alg, cryptoKey);\n    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);\n    try {\n        return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);\n    }\n    catch {\n        return false;\n    }\n};\n","import { decode as b64u } from '../../util/base64url.js';\nimport verify from '../../lib/verify.js';\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';\nimport { concat, encoder, decoder } from '../../lib/buffer_utils.js';\nimport isDisjoint from '../../lib/is_disjoint.js';\nimport isObject from '../../lib/is_object.js';\nimport checkKeyType from '../../lib/check_key_type.js';\nimport validateCrit from '../../lib/validate_crit.js';\nimport validateAlgorithms from '../../lib/validate_algorithms.js';\nimport normalizeKey from '../../lib/normalize_key.js';\nexport async function flattenedVerify(jws, key, options) {\n    if (!isObject(jws)) {\n        throw new JWSInvalid('Flattened JWS must be an object');\n    }\n    if (jws.protected === undefined && jws.header === undefined) {\n        throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n    }\n    if (jws.protected !== undefined && typeof jws.protected !== 'string') {\n        throw new JWSInvalid('JWS Protected Header incorrect type');\n    }\n    if (jws.payload === undefined) {\n        throw new JWSInvalid('JWS Payload missing');\n    }\n    if (typeof jws.signature !== 'string') {\n        throw new JWSInvalid('JWS Signature missing or incorrect type');\n    }\n    if (jws.header !== undefined && !isObject(jws.header)) {\n        throw new JWSInvalid('JWS Unprotected Header incorrect type');\n    }\n    let parsedProt = {};\n    if (jws.protected) {\n        try {\n            const protectedHeader = b64u(jws.protected);\n            parsedProt = JSON.parse(decoder.decode(protectedHeader));\n        }\n        catch {\n            throw new JWSInvalid('JWS Protected Header is invalid');\n        }\n    }\n    if (!isDisjoint(parsedProt, jws.header)) {\n        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');\n    }\n    const joseHeader = {\n        ...parsedProt,\n        ...jws.header,\n    };\n    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);\n    let b64 = true;\n    if (extensions.has('b64')) {\n        b64 = parsedProt.b64;\n        if (typeof b64 !== 'boolean') {\n            throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n        }\n    }\n    const { alg } = joseHeader;\n    if (typeof alg !== 'string' || !alg) {\n        throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n    }\n    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);\n    if (algorithms && !algorithms.has(alg)) {\n        throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n    }\n    if (b64) {\n        if (typeof jws.payload !== 'string') {\n            throw new JWSInvalid('JWS Payload must be a string');\n        }\n    }\n    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {\n        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');\n    }\n    let resolvedKey = false;\n    if (typeof key === 'function') {\n        key = await key(parsedProt, jws);\n        resolvedKey = true;\n    }\n    checkKeyType(alg, key, 'verify');\n    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);\n    let signature;\n    try {\n        signature = b64u(jws.signature);\n    }\n    catch {\n        throw new JWSInvalid('Failed to base64url decode the signature');\n    }\n    const k = await normalizeKey(key, alg);\n    const verified = await verify(alg, k, signature, data);\n    if (!verified) {\n        throw new JWSSignatureVerificationFailed();\n    }\n    let payload;\n    if (b64) {\n        try {\n            payload = b64u(jws.payload);\n        }\n        catch {\n            throw new JWSInvalid('Failed to base64url decode the payload');\n        }\n    }\n    else if (typeof jws.payload === 'string') {\n        payload = encoder.encode(jws.payload);\n    }\n    else {\n        payload = jws.payload;\n    }\n    const result = { payload };\n    if (jws.protected !== undefined) {\n        result.protectedHeader = parsedProt;\n    }\n    if (jws.header !== undefined) {\n        result.unprotectedHeader = jws.header;\n    }\n    if (resolvedKey) {\n        return { ...result, key: k };\n    }\n    return result;\n}\n","import { flattenedVerify } from '../flattened/verify.js';\nimport { JWSInvalid } from '../../util/errors.js';\nimport { decoder } from '../../lib/buffer_utils.js';\nexport async function compactVerify(jws, key, options) {\n    if (jws instanceof Uint8Array) {\n        jws = decoder.decode(jws);\n    }\n    if (typeof jws !== 'string') {\n        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');\n    }\n    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');\n    if (length !== 3) {\n        throw new JWSInvalid('Invalid Compact JWS');\n    }\n    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);\n    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","export default (date) => Math.floor(date.getTime() / 1000);\n","const minute = 60;\nconst hour = minute * 60;\nconst day = hour * 24;\nconst week = day * 7;\nconst year = day * 365.25;\nconst REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;\nexport default (str) => {\n    const matched = REGEX.exec(str);\n    if (!matched || (matched[4] && matched[1])) {\n        throw new TypeError('Invalid time period format');\n    }\n    const value = parseFloat(matched[2]);\n    const unit = matched[3].toLowerCase();\n    let numericDate;\n    switch (unit) {\n        case 'sec':\n        case 'secs':\n        case 'second':\n        case 'seconds':\n        case 's':\n            numericDate = Math.round(value);\n            break;\n        case 'minute':\n        case 'minutes':\n        case 'min':\n        case 'mins':\n        case 'm':\n            numericDate = Math.round(value * minute);\n            break;\n        case 'hour':\n        case 'hours':\n        case 'hr':\n        case 'hrs':\n        case 'h':\n            numericDate = Math.round(value * hour);\n            break;\n        case 'day':\n        case 'days':\n        case 'd':\n            numericDate = Math.round(value * day);\n            break;\n        case 'week':\n        case 'weeks':\n        case 'w':\n            numericDate = Math.round(value * week);\n            break;\n        default:\n            numericDate = Math.round(value * year);\n            break;\n    }\n    if (matched[1] === '-' || matched[4] === 'ago') {\n        return -numericDate;\n    }\n    return numericDate;\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';\nimport { decoder } from './buffer_utils.js';\nimport epoch from './epoch.js';\nimport secs from './secs.js';\nimport isObject from './is_object.js';\nimport { encoder } from './buffer_utils.js';\nfunction validateInput(label, input) {\n    if (!Number.isFinite(input)) {\n        throw new TypeError(`Invalid ${label} input`);\n    }\n    return input;\n}\nconst normalizeTyp = (value) => {\n    if (value.includes('/')) {\n        return value.toLowerCase();\n    }\n    return `application/${value.toLowerCase()}`;\n};\nconst checkAudiencePresence = (audPayload, audOption) => {\n    if (typeof audPayload === 'string') {\n        return audOption.includes(audPayload);\n    }\n    if (Array.isArray(audPayload)) {\n        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));\n    }\n    return false;\n};\nexport function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n    let payload;\n    try {\n        payload = JSON.parse(decoder.decode(encodedPayload));\n    }\n    catch {\n    }\n    if (!isObject(payload)) {\n        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');\n    }\n    const { typ } = options;\n    if (typ &&\n        (typeof protectedHeader.typ !== 'string' ||\n            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {\n        throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, 'typ', 'check_failed');\n    }\n    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;\n    const presenceCheck = [...requiredClaims];\n    if (maxTokenAge !== undefined)\n        presenceCheck.push('iat');\n    if (audience !== undefined)\n        presenceCheck.push('aud');\n    if (subject !== undefined)\n        presenceCheck.push('sub');\n    if (issuer !== undefined)\n        presenceCheck.push('iss');\n    for (const claim of new Set(presenceCheck.reverse())) {\n        if (!(claim in payload)) {\n            throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, 'missing');\n        }\n    }\n    if (issuer &&\n        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {\n        throw new JWTClaimValidationFailed('unexpected \"iss\" claim value', payload, 'iss', 'check_failed');\n    }\n    if (subject && payload.sub !== subject) {\n        throw new JWTClaimValidationFailed('unexpected \"sub\" claim value', payload, 'sub', 'check_failed');\n    }\n    if (audience &&\n        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {\n        throw new JWTClaimValidationFailed('unexpected \"aud\" claim value', payload, 'aud', 'check_failed');\n    }\n    let tolerance;\n    switch (typeof options.clockTolerance) {\n        case 'string':\n            tolerance = secs(options.clockTolerance);\n            break;\n        case 'number':\n            tolerance = options.clockTolerance;\n            break;\n        case 'undefined':\n            tolerance = 0;\n            break;\n        default:\n            throw new TypeError('Invalid clockTolerance option type');\n    }\n    const { currentDate } = options;\n    const now = epoch(currentDate || new Date());\n    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {\n        throw new JWTClaimValidationFailed('\"iat\" claim must be a number', payload, 'iat', 'invalid');\n    }\n    if (payload.nbf !== undefined) {\n        if (typeof payload.nbf !== 'number') {\n            throw new JWTClaimValidationFailed('\"nbf\" claim must be a number', payload, 'nbf', 'invalid');\n        }\n        if (payload.nbf > now + tolerance) {\n            throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, 'nbf', 'check_failed');\n        }\n    }\n    if (payload.exp !== undefined) {\n        if (typeof payload.exp !== 'number') {\n            throw new JWTClaimValidationFailed('\"exp\" claim must be a number', payload, 'exp', 'invalid');\n        }\n        if (payload.exp <= now - tolerance) {\n            throw new JWTExpired('\"exp\" claim timestamp check failed', payload, 'exp', 'check_failed');\n        }\n    }\n    if (maxTokenAge) {\n        const age = now - payload.iat;\n        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);\n        if (age - tolerance > max) {\n            throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');\n        }\n        if (age < 0 - tolerance) {\n            throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');\n        }\n    }\n    return payload;\n}\nexport class JWTClaimsBuilder {\n    #payload;\n    constructor(payload) {\n        if (!isObject(payload)) {\n            throw new TypeError('JWT Claims Set MUST be an object');\n        }\n        this.#payload = structuredClone(payload);\n    }\n    data() {\n        return encoder.encode(JSON.stringify(this.#payload));\n    }\n    get iss() {\n        return this.#payload.iss;\n    }\n    set iss(value) {\n        this.#payload.iss = value;\n    }\n    get sub() {\n        return this.#payload.sub;\n    }\n    set sub(value) {\n        this.#payload.sub = value;\n    }\n    get aud() {\n        return this.#payload.aud;\n    }\n    set aud(value) {\n        this.#payload.aud = value;\n    }\n    set jti(value) {\n        this.#payload.jti = value;\n    }\n    set nbf(value) {\n        if (typeof value === 'number') {\n            this.#payload.nbf = validateInput('setNotBefore', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.nbf = validateInput('setNotBefore', epoch(value));\n        }\n        else {\n            this.#payload.nbf = epoch(new Date()) + secs(value);\n        }\n    }\n    set exp(value) {\n        if (typeof value === 'number') {\n            this.#payload.exp = validateInput('setExpirationTime', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.exp = validateInput('setExpirationTime', epoch(value));\n        }\n        else {\n            this.#payload.exp = epoch(new Date()) + secs(value);\n        }\n    }\n    set iat(value) {\n        if (typeof value === 'undefined') {\n            this.#payload.iat = epoch(new Date());\n        }\n        else if (value instanceof Date) {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(value));\n        }\n        else if (typeof value === 'string') {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));\n        }\n        else {\n            this.#payload.iat = validateInput('setIssuedAt', value);\n        }\n    }\n}\n","import { compactVerify } from '../jws/compact/verify.js';\nimport { validateClaimsSet } from '../lib/jwt_claims_set.js';\nimport { JWTInvalid } from '../util/errors.js';\nexport async function jwtVerify(jwt, key, options) {\n    const verified = await compactVerify(jwt, key, options);\n    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {\n        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');\n    }\n    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n    const result = { payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import subtleAlgorithm from './subtle_dsa.js';\nimport checkKeyLength from './check_key_length.js';\nimport getSignKey from './get_sign_verify_key.js';\nexport default async (alg, key, data) => {\n    const cryptoKey = await getSignKey(alg, key, 'sign');\n    checkKeyLength(alg, cryptoKey);\n    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);\n    return new Uint8Array(signature);\n};\n","import { encode as b64u } from '../../util/base64url.js';\nimport sign from '../../lib/sign.js';\nimport isDisjoint from '../../lib/is_disjoint.js';\nimport { JWSInvalid } from '../../util/errors.js';\nimport { encoder, decoder, concat } from '../../lib/buffer_utils.js';\nimport checkKeyType from '../../lib/check_key_type.js';\nimport validateCrit from '../../lib/validate_crit.js';\nimport normalizeKey from '../../lib/normalize_key.js';\nexport class FlattenedSign {\n    #payload;\n    #protectedHeader;\n    #unprotectedHeader;\n    constructor(payload) {\n        if (!(payload instanceof Uint8Array)) {\n            throw new TypeError('payload must be an instance of Uint8Array');\n        }\n        this.#payload = payload;\n    }\n    setProtectedHeader(protectedHeader) {\n        if (this.#protectedHeader) {\n            throw new TypeError('setProtectedHeader can only be called once');\n        }\n        this.#protectedHeader = protectedHeader;\n        return this;\n    }\n    setUnprotectedHeader(unprotectedHeader) {\n        if (this.#unprotectedHeader) {\n            throw new TypeError('setUnprotectedHeader can only be called once');\n        }\n        this.#unprotectedHeader = unprotectedHeader;\n        return this;\n    }\n    async sign(key, options) {\n        if (!this.#protectedHeader && !this.#unprotectedHeader) {\n            throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');\n        }\n        if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) {\n            throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');\n        }\n        const joseHeader = {\n            ...this.#protectedHeader,\n            ...this.#unprotectedHeader,\n        };\n        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, this.#protectedHeader, joseHeader);\n        let b64 = true;\n        if (extensions.has('b64')) {\n            b64 = this.#protectedHeader.b64;\n            if (typeof b64 !== 'boolean') {\n                throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n            }\n        }\n        const { alg } = joseHeader;\n        if (typeof alg !== 'string' || !alg) {\n            throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n        }\n        checkKeyType(alg, key, 'sign');\n        let payload = this.#payload;\n        if (b64) {\n            payload = encoder.encode(b64u(payload));\n        }\n        let protectedHeader;\n        if (this.#protectedHeader) {\n            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));\n        }\n        else {\n            protectedHeader = encoder.encode('');\n        }\n        const data = concat(protectedHeader, encoder.encode('.'), payload);\n        const k = await normalizeKey(key, alg);\n        const signature = await sign(alg, k, data);\n        const jws = {\n            signature: b64u(signature),\n            payload: '',\n        };\n        if (b64) {\n            jws.payload = decoder.decode(payload);\n        }\n        if (this.#unprotectedHeader) {\n            jws.header = this.#unprotectedHeader;\n        }\n        if (this.#protectedHeader) {\n            jws.protected = decoder.decode(protectedHeader);\n        }\n        return jws;\n    }\n}\n","import { FlattenedSign } from '../flattened/sign.js';\nexport class CompactSign {\n    #flattened;\n    constructor(payload) {\n        this.#flattened = new FlattenedSign(payload);\n    }\n    setProtectedHeader(protectedHeader) {\n        this.#flattened.setProtectedHeader(protectedHeader);\n        return this;\n    }\n    async sign(key, options) {\n        const jws = await this.#flattened.sign(key, options);\n        if (jws.payload === undefined) {\n            throw new TypeError('use the flattened module for creating JWS with b64: false');\n        }\n        return `${jws.protected}.${jws.payload}.${jws.signature}`;\n    }\n}\n","import { CompactSign } from '../jws/compact/sign.js';\nimport { JWTInvalid } from '../util/errors.js';\nimport { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';\nexport class SignJWT {\n    #protectedHeader;\n    #jwt;\n    constructor(payload = {}) {\n        this.#jwt = new JWTClaimsBuilder(payload);\n    }\n    setIssuer(issuer) {\n        this.#jwt.iss = issuer;\n        return this;\n    }\n    setSubject(subject) {\n        this.#jwt.sub = subject;\n        return this;\n    }\n    setAudience(audience) {\n        this.#jwt.aud = audience;\n        return this;\n    }\n    setJti(jwtId) {\n        this.#jwt.jti = jwtId;\n        return this;\n    }\n    setNotBefore(input) {\n        this.#jwt.nbf = input;\n        return this;\n    }\n    setExpirationTime(input) {\n        this.#jwt.exp = input;\n        return this;\n    }\n    setIssuedAt(input) {\n        this.#jwt.iat = input;\n        return this;\n    }\n    setProtectedHeader(protectedHeader) {\n        this.#protectedHeader = protectedHeader;\n        return this;\n    }\n    async sign(key, options) {\n        const sig = new CompactSign(this.#jwt.data());\n        sig.setProtectedHeader(this.#protectedHeader);\n        if (Array.isArray(this.#protectedHeader?.crit) &&\n            this.#protectedHeader.crit.includes('b64') &&\n            this.#protectedHeader.b64 === false) {\n            throw new JWTInvalid('JWTs MUST NOT use unencoded payload');\n        }\n        return sig.sign(key, options);\n    }\n}\n","import { decode as b64u } from './base64url.js';\nimport { decoder } from '../lib/buffer_utils.js';\nimport isObject from '../lib/is_object.js';\nimport { JWTInvalid } from './errors.js';\nexport function decodeJwt(jwt) {\n    if (typeof jwt !== 'string')\n        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');\n    const { 1: payload, length } = jwt.split('.');\n    if (length === 5)\n        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');\n    if (length !== 3)\n        throw new JWTInvalid('Invalid JWT');\n    if (!payload)\n        throw new JWTInvalid('JWTs must contain a payload');\n    let decoded;\n    try {\n        decoded = b64u(payload);\n    }\n    catch {\n        throw new JWTInvalid('Failed to base64url decode the payload');\n    }\n    let result;\n    try {\n        result = JSON.parse(decoder.decode(decoded));\n    }\n    catch {\n        throw new JWTInvalid('Failed to parse the decoded payload as JSON');\n    }\n    if (!isObject(result))\n        throw new JWTInvalid('Invalid JWT Claims Set');\n    return result;\n}\n","import { Injectable, inject } from '@zeltjs/core';\nimport { decodeJwt, jwtVerify, SignJWT } from 'jose';\n\nimport { JwtConfig } from './jwt.config';\nimport type { JwtPayload } from './jwt.types';\n\n@Injectable()\nexport class JwtService {\n  constructor(private config = inject(JwtConfig)) {}\n\n  async sign(payload: Record<string, unknown>): Promise<string> {\n    const secret = new TextEncoder().encode(this.config.secret);\n    const expiresIn = this.parseExpiresIn(this.config.expiresIn);\n\n    const jwt = await new SignJWT(payload)\n      .setProtectedHeader({ alg: 'HS256' })\n      .setIssuedAt()\n      .setExpirationTime(expiresIn)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  async verify(token: string): Promise<JwtPayload> {\n    const secret = new TextEncoder().encode(this.config.secret);\n    const { payload } = await jwtVerify<JwtPayload>(token, secret);\n    return payload;\n  }\n\n  decode(token: string): JwtPayload | null {\n    try {\n      return decodeJwt<JwtPayload>(token);\n    } catch {\n      return null;\n    }\n  }\n\n  private parseExpiresIn(expiresIn: string): string | number {\n    const match = /^(\\d+)([smhd])$/.exec(expiresIn);\n    if (match) {\n      const value = parseInt(match[1] ?? '0', 10);\n      const unit = match[2] ?? '';\n      const unitMap: Record<string, string> = {\n        s: 'seconds',\n        m: 'minutes',\n        h: 'hours',\n        d: 'days',\n      };\n      return `${value} ${unitMap[unit]}`;\n    }\n    return expiresIn;\n  }\n}\n","import type { Next, RequestContext } from '@zeltjs/core';\nimport { inject, Middleware, setUser } from '@zeltjs/core';\nimport { getCookie } from 'hono/cookie';\n\nimport { UnauthorizedException } from './exceptions';\nimport { JwtConfig } from './jwt.config';\nimport { JwtService } from './jwt.service';\n\n@Middleware\nexport class JwtMiddleware {\n  constructor(\n    private readonly jwtService = inject(JwtService),\n    private readonly config = inject(JwtConfig),\n  ) {}\n\n  /**\n   * @throws {UnauthorizedException} When token is missing (401)\n   * @throws {UnauthorizedException} When token is invalid or expired (401)\n   * @throws {ZeltContextNotAvailableError}\n   */\n  async use(c: RequestContext, next: Next): Promise<Response | undefined> {\n    const token = this.extractToken(c);\n\n    if (!token) {\n      throw new UnauthorizedException({ reason: 'missing_token' });\n    }\n\n    const verified = await this.jwtService.verify(token).then(\n      (payload) => ({ ok: true as const, payload }),\n      () => ({ ok: false as const }),\n    );\n\n    if (!verified.ok) {\n      throw new UnauthorizedException({ reason: 'invalid_token' });\n    }\n\n    const { user, roles } = await this.config.resolveUser(verified.payload);\n    setUser(user, roles);\n    await next();\n    return undefined;\n  }\n\n  private extractToken(c: RequestContext): string | null {\n    if (this.config.driver === 'cookie') {\n      return getCookie(c, this.config.cookieName) ?? null;\n    }\n\n    const authHeader = c.req.header('Authorization');\n    if (!authHeader?.startsWith('Bearer ')) {\n      return null;\n    }\n    return authHeader.slice(7);\n  }\n}\n"],"x_google_ignoreList":[3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32],"mappings":";;;;AAIA,MAAMC,aAAiD,EACrDC,gBAAgB,+CAClB;AAEA,MAAaC,qBAAqBH,YAChC,uBACCI,QAA0CH,WAASG,IAAIC,QAAO;;;ACNjE,MAAME,WAA+C;CACnDC,eAAe;CACfC,eAAe;CACfC,SAAS;CACX;AAEA,MAAaC,wBAAwBL,oBACnC,yBACA,MACCM,QAAwCL,SAASK,IAAIC,SACtD,EACEC,gBAAgBF,KAAKG,QAAQC,YAC3BC,SAASC,KACP;CAAEC,MAAM;CAAgBN,QAAQD,IAAIC;CAAQG;CAAQ,EACpD;CAAED;CAAQK,SAAS,EAAE,oBAAoB,UAAS;CAAE,CAAA,EAE1D,CAAA;;;;;;;;;;;;ACRF,IAAaK,YAAb,MAAaA;;;IAMX,IAAIC,SAAiB;EACnB,MAAMA,SAAS,KAAKC,IAAIC,UAAU,aAAA;AAClC,MAAI,CAACF,OACH,OAAM,IAAIF,mBAAmB,EAAEK,QAAQ,kBAAiB,CAAA;AAE1D,SAAOH;;CAGT,IAAII,YAAoB;AACtB,SAAO;;CAGT,IAAIC,SAAoB;AACtB,SAAO;;CAGT,IAAIC,aAAqB;AACvB,SAAO;;CAGT,IAAIC,cAAmE;AACrE,SAAO,OAAOC,aAAa;GACzBC,MAAMD,QAAQE;GACdC,OAAO,EAAE;GACX;;CA7BF,YAAY,MAAcd,OAAOD,IAAI,EAAE;OAAnBK,MAAAA;;;;;;;;;;ACbtB,MAAaW,UAAU,IAAIC,aAAAA;AAC3B,MAAaC,UAAU,IAAIC,aAAAA;AAE3B,SAAgBE,OAAO,GAAGC,SAAO;CAC7B,MAAMC,OAAOD,QAAQE,QAAQC,KAAK,EAAEC,aAAaD,MAAMC,QAAQ,EAAA;CAC/D,MAAMC,MAAM,IAAIC,WAAWL,KAAAA;CAC3B,IAAIM,IAAI;AACR,MAAK,MAAMC,UAAUR,SAAS;AAC1BK,MAAII,IAAID,QAAQD,EAAAA;AAChBA,OAAKC,OAAOJ;;AAEhB,QAAOC;;;;ACXX,SAAgBe,aAAaC,OAAK;AAC9B,KAAIC,WAAWC,UAAUC,SACrB,QAAOH,MAAMG,UAAQ;CAEzB,MAAMC,aAAa;CACnB,MAAMC,MAAM,EAAE;AACd,MAAK,IAAIC,IAAI,GAAGA,IAAIN,MAAMO,QAAQD,KAAKF,WACnCC,KAAIG,KAAKC,OAAOC,aAAaC,MAAM,MAAMX,MAAMY,SAASN,GAAGA,IAAIF,WAAAA,CAAAA,CAAAA;AAEnE,QAAOS,KAAKR,IAAIS,KAAK,GAAA,CAAA;;AAEzB,SAAgBC,aAAaC,SAAO;AAChC,KAAIf,WAAWgB,WACX,QAAOhB,WAAWgB,WAAWD,QAAAA;CAEjC,MAAME,SAASC,KAAKH,QAAAA;CACpB,MAAMI,QAAQ,IAAInB,WAAWiB,OAAOX,OAAM;AAC1C,MAAK,IAAID,IAAI,GAAGA,IAAIY,OAAOX,QAAQD,IAC/Bc,OAAMd,KAAKY,OAAOG,WAAWf,EAAAA;AAEjC,QAAOc;;;;AClBX,SAAgBM,OAAOC,OAAK;AACxB,KAAIC,WAAWC,WACX,QAAOD,WAAWC,WAAW,OAAOF,UAAU,WAAWA,QAAQJ,QAAQG,OAAOC,MAAAA,EAAQ,EACpFG,UAAU,aACd,CAAA;CAEJ,IAAIC,UAAUJ;AACd,KAAII,mBAAmBH,WACnBG,WAAUR,QAAQG,OAAOK,QAAAA;AAE7BA,WAAUA,QAAQC,QAAQ,MAAM,IAAA,CAAKA,QAAQ,MAAM,IAAA,CAAKA,QAAQ,OAAO,GAAA;AACvE,KAAI;AACA,SAAOP,aAAaM,QAAAA;SAElB;AACF,QAAM,IAAIE,UAAU,oDAAA;;;AAG5B,SAAgBC,OAAOP,OAAK;CACxB,IAAIQ,YAAYR;AAChB,KAAI,OAAOQ,cAAc,SACrBA,aAAYb,QAAQY,OAAOC,UAAAA;AAE/B,KAAIP,WAAWQ,UAAUC,SACrB,QAAOF,UAAUE,SAAS;EAAEP,UAAU;EAAaQ,aAAa;EAAK,CAAA;AAEzE,QAAOd,aAAaW,UAAAA,CAAWH,QAAQ,MAAM,GAAA,CAAIA,QAAQ,OAAO,IAAA,CAAKA,QAAQ,OAAO,IAAA;;;;AC5BxF,IAAaO,YAAb,cAA+BC,MAAAA;CAG3B,YAAYC,SAASC,SAAS;AAC1B,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;AAGH,OAAKC,OAAO,KAAK,YAAYA;AAC7BJ,QAAMK,oBAAoB,MAAM,KAAK,YAAW;;;AAN3CN,UACFI,OAAO;AAQlB,IAAaG,2BAAb,cAA8CP,UAAAA;CAM1C,YAAYE,SAASM,SAASC,QAAQ,eAAeC,SAAS,eAAe;AACzE,QAAMR,SAAS,EAAES,OAAO;GAAEF;GAAOC;GAAQF;GAAQ,EAAE,CAAA,EAAA,KALvDJ,OAAO;AAMH,OAAKK,QAAQA;AACb,OAAKC,SAASA;AACd,OAAKF,UAAUA;;;AAVVD,yBACFH,OAAO;AAYlB,IAAaQ,aAAb,cAAgCZ,UAAAA;CAM5B,YAAYE,SAASM,SAASC,QAAQ,eAAeC,SAAS,eAAe;AACzE,QAAMR,SAAS,EAAES,OAAO;GAAEF;GAAOC;GAAQF;GAAQ,EAAE,CAAA,EAAA,KALvDJ,OAAO;AAMH,OAAKK,QAAQA;AACb,OAAKC,SAASA;AACd,OAAKF,UAAUA;;;AAVVI,WACFR,OAAO;AAYlB,IAAaS,oBAAb,cAAuCb,UAAAA;;AAAhC,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFES,kBACFT,OAAO;AAGlB,IAAaU,mBAAb,cAAsCd,UAAAA;;AAA/B,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEU,iBACFV,OAAO;AAGlB,IAAaW,sBAAb,cAAyCf,UAAAA;CAGrC,YAAYE,UAAU,+BAA+BC,SAAS;AAC1D,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEW,oBACFX,OAAO;AAMlB,IAAaY,aAAb,cAAgChB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEY,WACFZ,OAAO;AAGlB,IAAaa,aAAb,cAAgCjB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEa,WACFb,OAAO;AAGlB,IAAac,aAAb,cAAgClB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEc,WACFd,OAAO;AAGlB,IAAae,aAAb,cAAgCnB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEe,WACFf,OAAO;AAGlB,IAAagB,cAAb,cAAiCpB,UAAAA;;AAA1B,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEgB,YACFhB,OAAO;AAGlB,IAAaiB,oBAAb,cAAuCrB,UAAAA;CAGnC,YAAYE,UAAU,mDAAmDC,SAAS;AAC9E,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEiB,kBACFjB,OAAO;AAMlB,IAAakB,2BAAb,cAA8CtB,UAAAA;CAI1C,YAAYE,UAAU,wDAAwDC,SAAS;AACnF,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAHEkB,yBAEFlB,OAAO;AAMlB,IAAamB,cAAb,cAAiCvB,UAAAA;CAG7B,YAAYE,UAAU,qBAAqBC,SAAS;AAChD,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEmB,YACFnB,OAAO;AAMlB,IAAaoB,iCAAb,cAAoDxB,UAAAA;CAGhD,YAAYE,UAAU,iCAAiCC,SAAS;AAC5D,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEoB,+BACFpB,OAAO;;;AC7FlB,SAASqB,SAASC,MAAMC,OAAO,kBAAgB;AAC3C,wBAAO,IAAIC,UAAU,kDAAkDD,KAAK,WAAWD,OAAM;;AAEjG,SAASG,YAAYC,WAAWJ,MAAI;AAChC,QAAOI,UAAUJ,SAASA;;AAE9B,SAASK,cAAcC,MAAI;AACvB,QAAOC,SAASD,KAAKN,KAAKQ,MAAM,EAAA,EAAI,GAAA;;AAExC,SAASC,cAAcC,KAAG;AACtB,SAAQA,KAAR;EACI,KAAK,QACD,QAAO;EACX,KAAK,QACD,QAAO;EACX,KAAK,QACD,QAAO;EACX,QACI,OAAM,IAAIC,MAAM,cAAA;;;AAG5B,SAASC,WAAWC,KAAKC,OAAK;AAC1B,KAAIA,SAAS,CAACD,IAAIE,OAAOC,SAASF,MAAAA,CAC9B,OAAM,IAAIZ,UAAU,sEAAsEY,MAAM,GAAE;;AAG1G,SAAgBG,kBAAkBJ,KAAKH,KAAKI,OAAK;AAC7C,SAAQJ,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACP,YAAYU,IAAIT,WAAW,OAAA,CAC5B,OAAML,SAAS,OAAA;GACnB,MAAMmB,WAAWX,SAASG,IAAIF,MAAM,EAAA,EAAI,GAAA;AAExC,OADeH,cAAcQ,IAAIT,UAAUE,KACvCa,KAAWD,SACX,OAAMnB,SAAS,OAAOmB,YAAY,iBAAA;AACtC;;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACf,YAAYU,IAAIT,WAAW,oBAAA,CAC5B,OAAML,SAAS,oBAAA;GACnB,MAAMmB,WAAWX,SAASG,IAAIF,MAAM,EAAA,EAAI,GAAA;AAExC,OADeH,cAAcQ,IAAIT,UAAUE,KACvCa,KAAWD,SACX,OAAMnB,SAAS,OAAOmB,YAAY,iBAAA;AACtC;;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACf,YAAYU,IAAIT,WAAW,UAAA,CAC5B,OAAML,SAAS,UAAA;GACnB,MAAMmB,WAAWX,SAASG,IAAIF,MAAM,EAAA,EAAI,GAAA;AAExC,OADeH,cAAcQ,IAAIT,UAAUE,KACvCa,KAAWD,SACX,OAAMnB,SAAS,OAAOmB,YAAY,iBAAA;AACtC;;EAEJ,KAAK;EACL,KAAK;AACD,OAAI,CAACf,YAAYU,IAAIT,WAAW,UAAA,CAC5B,OAAML,SAAS,UAAA;AACnB;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACI,YAAYU,IAAIT,WAAW,QAAA,CAC5B,OAAML,SAAS,QAAA;GACnB,MAAMmB,WAAWT,cAAcC,IAAAA;AAE/B,OADeG,IAAIT,UAAUgB,eACdF,SACX,OAAMnB,SAASmB,UAAU,uBAAA;AAC7B;;EAEJ,QACI,OAAM,IAAIhB,UAAU,4CAAA;;AAE5BU,YAAWC,KAAKC,MAAAA;;;;ACjFpB,SAASS,QAAQC,KAAKC,QAAQ,GAAGC,OAAK;AAClCA,SAAQA,MAAMC,OAAOC,QAAAA;AACrB,KAAIF,MAAMG,SAAS,GAAG;EAClB,MAAMC,OAAOJ,MAAMK,KAAG;AACtBP,SAAO,eAAeE,MAAMM,KAAK,KAAA,CAAM,OAAOF,KAAK;YAE9CJ,MAAMG,WAAW,EACtBL,QAAO,eAAeE,MAAM,GAAG,MAAMA,MAAM,GAAG;KAG9CF,QAAO,WAAWE,MAAM,GAAG;AAE/B,KAAID,UAAU,KACVD,QAAO,aAAaC;UAEf,OAAOA,WAAW,cAAcA,OAAOQ,KAC5CT,QAAO,sBAAsBC,OAAOQ;UAE/B,OAAOR,WAAW,YAAYA,UAAU;MACzCA,OAAO,aAAaQ,KACpBT,QAAO,4BAA4BC,OAAO,YAAYQ;;AAG9D,QAAOT;;AAEX,IAAA,8BAAgBC,QAAQ,GAAGC,UAAAA;AACvB,QAAOH,QAAQ,gBAAgBE,QAAAA,GAAWC,MAAAA;;AAE9C,SAAgBQ,QAAQC,KAAKV,QAAQ,GAAGC,OAAK;AACzC,QAAOH,QAAQ,eAAeY,IAAI,sBAAsBV,QAAAA,GAAWC,MAAAA;;;;ACxBvE,SAAgBY,YAAYD,KAAG;AAC3B,QAAOA,MAAMG,OAAOC,iBAAiB;;AAEzC,SAAgBC,YAAYL,KAAG;AAC3B,QAAOA,MAAMG,OAAOC,iBAAiB;;AAEzC,IAAA,wBAAgBJ,QAAAA;AACZ,QAAOC,YAAYD,IAAAA,IAAQK,YAAYL,IAAAA;;;;ACZ3C,IAAA,wBAAgB,GAAGM,YAAAA;CACf,MAAMC,UAAUD,QAAQE,OAAOC,QAAAA;AAC/B,KAAIF,QAAQG,WAAW,KAAKH,QAAQG,WAAW,EAC3C,QAAO;CAEX,IAAIC;AACJ,MAAK,MAAMC,UAAUL,SAAS;EAC1B,MAAMM,aAAaC,OAAOC,KAAKH,OAAAA;AAC/B,MAAI,CAACD,OAAOA,IAAIK,SAAS,GAAG;AACxBL,SAAM,IAAIM,IAAIJ,WAAAA;AACd;;AAEJ,OAAK,MAAMK,aAAaL,YAAY;AAChC,OAAIF,IAAIQ,IAAID,UAAAA,CACR,QAAO;AAEXP,OAAIS,IAAIF,UAAAA;;;AAGhB,QAAO;;;;ACnBX,SAASG,aAAaC,OAAK;AACvB,QAAO,OAAOA,UAAU,YAAYA,UAAU;;AAElD,IAAA,sBAAgBC,UAAAA;AACZ,KAAI,CAACF,aAAaE,MAAAA,IAAUC,OAAOC,UAAUC,SAASC,KAAKJ,MAAAA,KAAW,kBAClE,QAAO;AAEX,KAAIC,OAAOI,eAAeL,MAAAA,KAAW,KACjC,QAAO;CAEX,IAAIM,QAAQN;AACZ,QAAOC,OAAOI,eAAeC,MAAAA,KAAW,KACpCA,SAAQL,OAAOI,eAAeC,MAAAA;AAElC,QAAOL,OAAOI,eAAeL,MAAAA,KAAWM;;;;ACd5C,IAAA,6BAAgBC,KAAKC,QAAAA;AACjB,KAAID,IAAIE,WAAW,KAAA,IAASF,IAAIE,WAAW,KAAA,EAAO;EAC9C,MAAM,EAAEC,kBAAkBF,IAAIG;AAC9B,MAAI,OAAOD,kBAAkB,YAAYA,gBAAgB,KACrD,OAAM,IAAIE,UAAU,GAAGL,IAAI,uDAAsD;;;;;ACH7F,SAASO,cAAcC,KAAG;CACtB,IAAIC;CACJ,IAAIC;AACJ,SAAQF,IAAIG,KAAZ;EACI,KAAK;AACD,WAAQH,IAAII,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;AACDH,iBAAY;MAAEI,MAAM;MAAWC,MAAM,OAAON,IAAII,IAAIG,MAAM,GAAC;MAAK;AAChEL,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAAqBC,MAAM,OAAON,IAAII,IAAIG,MAAM,GAAC;MAAK;AAC1EL,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY;MACRI,MAAM;MACNC,MAAM,OAAOG,SAAST,IAAII,IAAIG,MAAM,GAAC,EAAI,GAAA,IAAO;MACpD;AACAL,iBAAYF,IAAIQ,IAAI,CAAC,WAAW,YAAY,GAAG,CAAC,WAAW,UAAU;AACrE;IACJ,QACI,OAAM,IAAIV,iBAAiB,iEAAA;;AAEnC;EAEJ,KAAK;AACD,WAAQE,IAAII,KAAZ;IACI,KAAK;AACDH,iBAAY;MAAEI,MAAM;MAASK,YAAY;MAAQ;AACjDR,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAASK,YAAY;MAAQ;AACjDR,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAASK,YAAY;MAAQ;AACjDR,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAAQK,YAAYV,IAAIW;MAAI;AAChDT,iBAAYF,IAAIQ,IAAI,CAAC,aAAa,GAAG,EAAE;AACvC;IACJ,QACI,OAAM,IAAIV,iBAAiB,iEAAA;;AAEnC;EAEJ,KAAK;AACD,WAAQE,IAAII,KAAZ;IACI,KAAK;IACL,KAAK;AACDH,iBAAY,EAAEI,MAAM,WAAU;AAC9BH,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY,EAAEI,MAAML,IAAIW,KAAI;AAC5BT,iBAAYF,IAAIQ,IAAI,CAAC,aAAa,GAAG,EAAE;AACvC;IACJ,QACI,OAAM,IAAIV,iBAAiB,iEAAA;;AAEnC;EAEJ,QACI,OAAM,IAAIA,iBAAiB,gEAAA;;AAEnC,QAAO;EAAEG;EAAWC;EAAU;;AAElC,IAAA,sBAAe,OAAOF,QAAAA;AAClB,KAAI,CAACA,IAAII,IACL,OAAM,IAAIQ,UAAU,+DAAA;CAExB,MAAM,EAAEX,WAAWC,cAAcH,cAAcC,IAAAA;CAC/C,MAAMa,UAAU,EAAE,GAAGb,KAAI;AACzB,QAAOa,QAAQT;AACf,QAAOS,QAAQC;AACf,QAAOC,OAAOC,OAAOC,UAAU,OAAOJ,SAASZ,WAAWD,IAAIkB,QAAQlB,IAAIQ,IAAI,QAAQ,OAAOR,IAAImB,WAAWjB,UAAAA;;;;AC3FhH,IAAA,0BAAgBmB,KAAKC,mBAAmBC,kBAAkBC,iBAAiBC,eAAAA;AACvE,KAAIA,WAAWC,SAASC,KAAAA,KAAaH,iBAAiBE,SAASC,KAAAA,EAC3D,OAAM,IAAIN,IAAI,mEAAA;AAElB,KAAI,CAACG,mBAAmBA,gBAAgBE,SAASC,KAAAA,EAC7C,wBAAO,IAAIC,KAAAA;AAEf,KAAI,CAACC,MAAMC,QAAQN,gBAAgBE,KAAI,IACnCF,gBAAgBE,KAAKK,WAAW,KAChCP,gBAAgBE,KAAKM,MAAMC,UAAU,OAAOA,UAAU,YAAYA,MAAMF,WAAW,EAAA,CACnF,OAAM,IAAIV,IAAI,0FAAA;CAElB,IAAIa;AACJ,KAAIX,qBAAqBI,KAAAA,EACrBO,cAAa,IAAIC,IAAI,CAAA,GAAIC,OAAOC,QAAQd,iBAAAA,EAAAA,GAAsBD,kBAAkBe,SAAO,CAAG,CAAA;KAG1FH,cAAaZ;AAEjB,MAAK,MAAMgB,aAAad,gBAAgBE,MAAM;AAC1C,MAAI,CAACQ,WAAWK,IAAID,UAAAA,CAChB,OAAM,IAAIlB,iBAAiB,+BAA+BkB,UAAU,qBAAoB;AAE5F,MAAIb,WAAWa,eAAeX,KAAAA,EAC1B,OAAM,IAAIN,IAAI,+BAA+BiB,UAAU,cAAa;AAExE,MAAIJ,WAAWM,IAAIF,UAAAA,IAAcd,gBAAgBc,eAAeX,KAAAA,EAC5D,OAAM,IAAIN,IAAI,+BAA+BiB,UAAU,+BAA8B;;AAG7F,QAAO,IAAIV,IAAIJ,gBAAgBE,KAAI;;;;AC/BvC,IAAA,gCAAgBe,QAAQC,eAAAA;AACpB,KAAIA,eAAeC,KAAAA,MACd,CAACC,MAAMC,QAAQH,WAAAA,IAAeA,WAAWI,MAAMC,MAAM,OAAOA,MAAM,SAAQ,EAC3E,OAAM,IAAIC,UAAU,IAAIP,OAAO,sCAAqC;AAExE,KAAI,CAACC,WACD;AAEJ,QAAO,IAAIO,IAAIP,WAAAA;;;;ACPnB,SAAgBS,MAAMC,KAAG;AACrB,QAAOF,kBAASE,IAAAA,IAAQ,OAAOA,IAAIC,QAAQ;;AAE/C,SAAgBC,aAAaF,KAAG;AAC5B,QAAOA,IAAIC,QAAQ,SAAS,OAAOD,IAAIG,MAAM;;AAEjD,SAAgBC,YAAYJ,KAAG;AAC3B,QAAOA,IAAIC,QAAQ,SAAS,OAAOD,IAAIG,MAAM;;AAEjD,SAAgBE,YAAYL,KAAG;AAC3B,QAAOA,IAAIC,QAAQ,SAAS,OAAOD,IAAIM,MAAM;;;;ACPjD,IAAIM;AACJ,MAAMC,YAAY,OAAOC,KAAKC,KAAKC,KAAKC,SAAS,UAAK;AAClDL,WAAAA,wBAAU,IAAIM,SAAAA;CACd,IAAIC,SAASP,MAAMQ,IAAIN,IAAAA;AACvB,KAAIK,SAASH,KACT,QAAOG,OAAOH;CAElB,MAAMK,YAAY,MAAMZ,mBAAU;EAAE,GAAGM;EAAKC;EAAI,CAAA;AAChD,KAAIC,OACAK,QAAOL,OAAOH,IAAAA;AAClB,KAAI,CAACK,OACDP,OAAMW,IAAIT,KAAK,GAAGE,MAAMK,WAAU,CAAA;KAGlCF,QAAOH,OAAOK;AAElB,QAAOA;;AAEX,MAAMG,mBAAmBC,WAAWT,QAAAA;AAChCJ,WAAAA,wBAAU,IAAIM,SAAAA;CACd,IAAIC,SAASP,MAAMQ,IAAIK,UAAAA;AACvB,KAAIN,SAASH,KACT,QAAOG,OAAOH;CAElB,MAAMU,WAAWD,UAAUE,SAAS;CACpC,MAAMC,cAAcF,WAAW,OAAO;CACtC,IAAIL;AACJ,KAAII,UAAUI,sBAAsB,UAAU;AAC1C,UAAQb,KAAR;GACI,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,iBACD;GACJ,QACI,OAAM,IAAIc,UAAU,6DAAA;;AAE5BT,cAAYI,UAAUM,YAAYN,UAAUI,mBAAmBD,aAAaF,WAAW,EAAE,GAAG,CAAC,aAAa,CAAA;;AAE9G,KAAID,UAAUI,sBAAsB,WAAW;AAC3C,MAAIb,QAAQ,WAAWA,QAAQ,UAC3B,OAAM,IAAIc,UAAU,6DAAA;AAExBT,cAAYI,UAAUM,YAAYN,UAAUI,mBAAmBD,aAAa,CACxEF,WAAW,WAAW,OACzB,CAAA;;AAEL,KAAID,UAAUI,sBAAsB,OAAO;EACvC,IAAIG;AACJ,UAAQhB,KAAR;GACI,KAAK;AACDgB,WAAO;AACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;AACDA,WAAO;AACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;AACDA,WAAO;AACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;AACDA,WAAO;AACP;GACJ,QACI,OAAM,IAAIF,UAAU,6DAAA;;AAE5B,MAAId,IAAIiB,WAAW,WAAA,CACf,QAAOR,UAAUM,YAAY;GACzBG,MAAM;GACNF;GACJ,EAAGJ,aAAaF,WAAW,CAAC,UAAU,GAAG,CAAC,UAAU,CAAA;AAExDL,cAAYI,UAAUM,YAAY;GAC9BG,MAAMlB,IAAIiB,WAAW,KAAA,GAAQ,YAAY;GACzCD;GACJ,EAAGJ,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;;AAElD,KAAID,UAAUI,sBAAsB,MAAM;EAMtC,MAAMQ,aAAaF,IALFC,IAAI;GACjB,CAAC,cAAc,QAAQ;GACvB,CAAC,aAAa,QAAQ;GACtB,CAAC,aAAa,QAAQ;GACzB,CACkBD,CAAKf,IAAIK,UAAUa,sBAAsBD,WAAAA;AAC5D,MAAI,CAACA,WACD,OAAM,IAAIP,UAAU,6DAAA;AAExB,MAAId,QAAQ,WAAWqB,eAAe,QAClChB,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;AAElD,MAAIV,QAAQ,WAAWqB,eAAe,QAClChB,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;AAElD,MAAIV,QAAQ,WAAWqB,eAAe,QAClChB,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;AAElD,MAAIV,IAAIiB,WAAW,UAAA,CACfZ,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAaF,WAAW,EAAE,GAAG,CAAC,aAAa,CAAA;;AAGtD,KAAI,CAACL,UACD,OAAM,IAAIS,UAAU,6DAAA;AAExB,KAAI,CAACX,OACDP,OAAMW,IAAIE,WAAW,GAAGT,MAAMK,WAAU,CAAA;KAGxCF,QAAOH,OAAOK;AAElB,QAAOA;;AAEX,IAAA,yBAAe,OAAOP,KAAKE,QAAAA;AACvB,KAAIF,eAAeyB,WACf,QAAOzB;AAEX,KAAIJ,YAAYI,IAAAA,CACZ,QAAOA;AAEX,KAAIH,YAAYG,IAAAA,EAAM;AAClB,MAAIA,IAAIa,SAAS,SACb,QAAOb,IAAI0B,QAAM;AAErB,MAAI,iBAAiB1B,OAAO,OAAOA,IAAIiB,gBAAgB,WACnD,KAAI;AACA,UAAOP,gBAAgBV,KAAKE,IAAAA;WAEzByB,KAAK;AACR,OAAIA,eAAeX,UACf,OAAMW;;AAKlB,SAAO5B,UAAUC,KADPA,IAAI0B,OAAO,EAAEE,QAAQ,OAAM,CACf3B,EAAKC,IAAAA;;AAE/B,KAAIT,MAAMO,IAAAA,EAAM;AACZ,MAAIA,IAAI6B,EACJ,QAAOnC,OAAOM,IAAI6B,EAAC;AAEvB,SAAO9B,UAAUC,KAAKA,KAAKE,KAAK,KAAA;;AAEpC,OAAM,IAAI4B,MAAM,cAAA;;;;AC/JpB,MAAMK,OAAOC,QAAQA,MAAMC,OAAOC;AAClC,MAAMC,gBAAgBC,KAAKJ,KAAKK,UAAAA;AAC5B,KAAIL,IAAIM,QAAQC,KAAAA,GAAW;EACvB,IAAIC;AACJ,UAAQH,OAAR;GACI,KAAK;GACL,KAAK;AACDG,eAAW;AACX;GACJ,KAAK;GACL,KAAK;AACDA,eAAW;AACX;;AAER,MAAIR,IAAIM,QAAQE,SACZ,OAAM,IAAIC,UAAU,sDAAsDD,SAAS,gBAAe;;AAG1G,KAAIR,IAAII,QAAQG,KAAAA,KAAaP,IAAII,QAAQA,IACrC,OAAM,IAAIK,UAAU,sDAAsDL,IAAI,gBAAe;AAEjG,KAAIM,MAAMC,QAAQX,IAAIY,QAAO,EAAG;EAC5B,IAAIC;AACJ,UAAQ,MAAR;GACI,KAAKR,UAAU,UAAUA,UAAU;GACnC,KAAKD,QAAQ;GACb,KAAKA,IAAIU,SAAS,SAAA;AACdD,oBAAgBR;AAChB;GACJ,KAAKD,IAAIW,WAAW,QAAA;AAChBF,oBAAgB;AAChB;GACJ,KAAK,0BAA0BG,KAAKZ,IAAAA;AAChC,QAAI,CAACA,IAAIU,SAAS,MAAA,IAAUV,IAAIa,SAAS,KAAA,CACrCJ,iBAAgBR,UAAU,YAAY,YAAY;QAGlDQ,iBAAgBR;AAEpB;GACJ,KAAKA,UAAU,aAAaD,IAAIW,WAAW,MAAA;AACvCF,oBAAgB;AAChB;GACJ,KAAKR,UAAU;AACXQ,oBAAgBT,IAAIW,WAAW,MAAA,GAAS,cAAc;AACtD;;AAER,MAAIF,iBAAiBb,IAAIY,SAASE,WAAWD,cAAAA,KAAmB,MAC5D,OAAM,IAAIJ,UAAU,+DAA+DI,cAAc,gBAAe;;AAGxH,QAAO;;AAEX,MAAMK,sBAAsBd,KAAKJ,KAAKK,UAAAA;AAClC,KAAIL,eAAemB,WACf;AACJ,KAAIrB,MAAUE,IAAAA,EAAM;AAChB,MAAIF,YAAgBE,IAAAA,IAAQG,aAAaC,KAAKJ,KAAKK,MAAAA,CAC/C;AACJ,QAAM,IAAII,UAAU,0HAAyH;;AAEjJ,KAAI,CAACZ,oBAAUG,IAAAA,CACX,OAAM,IAAIS,UAAUb,QAAgBQ,KAAKJ,KAAK,aAAa,aAAa,gBAAgB,aAAA,CAAA;AAE5F,KAAIA,IAAIsB,SAAS,SACb,OAAM,IAAIb,UAAU,GAAGV,IAAIC,IAAAA,CAAK,8DAA6D;;AAGrG,MAAMuB,uBAAuBnB,KAAKJ,KAAKK,UAAAA;AACnC,KAAIP,MAAUE,IAAAA,CACV,SAAQK,OAAR;EACI,KAAK;EACL,KAAK;AACD,OAAIP,aAAiBE,IAAAA,IAAQG,aAAaC,KAAKJ,KAAKK,MAAAA,CAChD;AACJ,SAAM,IAAII,UAAU,mDAAkD;EAC1E,KAAK;EACL,KAAK;AACD,OAAIX,YAAgBE,IAAAA,IAAQG,aAAaC,KAAKJ,KAAKK,MAAAA,CAC/C;AACJ,SAAM,IAAII,UAAU,kDAAiD;;AAGjF,KAAI,CAACZ,oBAAUG,IAAAA,CACX,OAAM,IAAIS,UAAUb,QAAgBQ,KAAKJ,KAAK,aAAa,aAAa,eAAA,CAAA;AAE5E,KAAIA,IAAIsB,SAAS,SACb,OAAM,IAAIb,UAAU,GAAGV,IAAIC,IAAAA,CAAK,mEAAkE;AAEtG,KAAIA,IAAIsB,SAAS,SACb,SAAQjB,OAAR;EACI,KAAK,OACD,OAAM,IAAII,UAAU,GAAGV,IAAIC,IAAAA,CAAK,uEAAsE;EAC1G,KAAK,UACD,OAAM,IAAIS,UAAU,GAAGV,IAAIC,IAAAA,CAAK,0EAAyE;EAC7G,QACI;;AAGZ,KAAIA,IAAIsB,SAAS,UACb,SAAQjB,OAAR;EACI,KAAK,SACD,OAAM,IAAII,UAAU,GAAGV,IAAIC,IAAAA,CAAK,wEAAuE;EAC3G,KAAK,UACD,OAAM,IAAIS,UAAU,GAAGV,IAAIC,IAAAA,CAAK,yEAAwE;EAC5G,QACI;;;AAIhB,IAAA,2BAAgBI,KAAKJ,KAAKK,UAAAA;AAMtB,KALkBD,IAAIW,WAAW,KAAA,IAC7BX,QAAQ,SACRA,IAAIW,WAAW,QAAA,IACf,oCAAoCC,KAAKZ,IAAAA,IACzC,0CAA0CY,KAAKZ,IAAAA,CAE/Cc,oBAAmBd,KAAKJ,KAAKK,MAAAA;KAG7BkB,qBAAoBnB,KAAKJ,KAAKK,MAAAA;;;;AC1HtC,IAAA,uBAAgBuB,KAAKC,cAAAA;CACjB,MAAMC,OAAO,OAAOF,IAAIG,MAAM,GAAC;AAC/B,SAAQH,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAEE;GAAME,MAAM;GAAO;EAChC,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAEF;GAAME,MAAM;GAAWC,YAAYC,SAASN,IAAIG,MAAM,GAAC,EAAI,GAAA,IAAO;GAAE;EACjF,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAED;GAAME,MAAM;GAAoB;EAC7C,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAEF;GAAME,MAAM;GAASG,YAAYN,UAAUM;GAAW;EACnE,KAAK;EACL,KAAK,QACD,QAAO,EAAEH,MAAM,WAAU;EAC7B,QACI,OAAM,IAAIL,iBAAiB,OAAOC,IAAI,6DAA4D;;;;;ACtB9G,IAAA,+BAAe,OAAOU,KAAKC,KAAKC,UAAAA;AAC5B,KAAID,eAAeE,YAAY;AAC3B,MAAI,CAACH,IAAII,WAAW,KAAA,CAChB,OAAM,IAAIC,UAAUN,0BAAgBE,KAAK,aAAa,aAAa,eAAA,CAAA;AAEvE,SAAOK,OAAOC,OAAOC,UAAU,OAAOP,KAAK;GAAEQ,MAAM,OAAOT,IAAIU,MAAM,GAAC;GAAMC,MAAM;GAAO,EAAG,OAAO,CAACT,MAAM,CAAA;;AAE7GJ,mBAAkBG,KAAKD,KAAKE,MAAAA;AAC5B,QAAOD;;;;ACPX,IAAA,kBAAe,OAAOc,KAAKC,KAAKC,WAAWC,SAAAA;CACvC,MAAMC,YAAY,MAAML,4BAAaC,KAAKC,KAAK,SAAA;AAC/CH,0BAAeE,KAAKI,UAAAA;CACpB,MAAMC,YAAYR,mBAAgBG,KAAKI,UAAUC,UAAS;AAC1D,KAAI;AACA,SAAO,MAAMC,OAAOC,OAAOC,OAAOH,WAAWD,WAAWF,WAAWC,KAAAA;SAEjE;AACF,SAAO;;;;;ACDf,eAAsBqB,gBAAgBC,KAAKC,KAAKC,SAAO;AACnD,KAAI,CAACR,kBAASM,IAAAA,CACV,OAAM,IAAIZ,WAAW,kCAAA;AAEzB,KAAIY,IAAIG,cAAcC,KAAAA,KAAaJ,IAAIK,WAAWD,KAAAA,EAC9C,OAAM,IAAIhB,WAAW,4EAAA;AAEzB,KAAIY,IAAIG,cAAcC,KAAAA,KAAa,OAAOJ,IAAIG,cAAc,SACxD,OAAM,IAAIf,WAAW,sCAAA;AAEzB,KAAIY,IAAIM,YAAYF,KAAAA,EAChB,OAAM,IAAIhB,WAAW,sBAAA;AAEzB,KAAI,OAAOY,IAAIO,cAAc,SACzB,OAAM,IAAInB,WAAW,0CAAA;AAEzB,KAAIY,IAAIK,WAAWD,KAAAA,KAAa,CAACV,kBAASM,IAAIK,OAAM,CAChD,OAAM,IAAIjB,WAAW,wCAAA;CAEzB,IAAIoB,aAAa,EAAC;AAClB,KAAIR,IAAIG,UACJ,KAAI;EACA,MAAMM,kBAAkBxB,OAAKe,IAAIG,UAAS;AAC1CK,eAAaE,KAAKC,MAAMnB,QAAQR,OAAOyB,gBAAAA,CAAAA;SAErC;AACF,QAAM,IAAIrB,WAAW,kCAAA;;AAG7B,KAAI,CAACK,oBAAWe,YAAYR,IAAIK,OAAM,CAClC,OAAM,IAAIjB,WAAW,4EAAA;CAEzB,MAAMwB,aAAa;EACf,GAAGJ;EACH,GAAGR,IAAIK;EACX;CACA,MAAMQ,aAAajB,sBAAaR,YAAY,IAAI0B,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAA,EAAGZ,SAASa,MAAMP,YAAYI,WAAAA;CACjG,IAAII,MAAM;AACV,KAAIH,WAAWI,IAAI,MAAA,EAAQ;AACvBD,QAAMR,WAAWQ;AACjB,MAAI,OAAOA,QAAQ,UACf,OAAM,IAAI5B,WAAW,4EAAA;;CAG7B,MAAM,EAAE8B,QAAQN;AAChB,KAAI,OAAOM,QAAQ,YAAY,CAACA,IAC5B,OAAM,IAAI9B,WAAW,8DAAA;CAEzB,MAAM+B,aAAajB,WAAWL,4BAAmB,cAAcK,QAAQiB,WAAU;AACjF,KAAIA,cAAc,CAACA,WAAWF,IAAIC,IAAAA,CAC9B,OAAM,IAAI/B,kBAAkB,yDAAA;AAEhC,KAAI6B;MACI,OAAOhB,IAAIM,YAAY,SACvB,OAAM,IAAIlB,WAAW,+BAAA;YAGpB,OAAOY,IAAIM,YAAY,YAAY,EAAEN,IAAIM,mBAAmBc,YACjE,OAAM,IAAIhC,WAAW,yDAAA;CAEzB,IAAIiC,cAAc;AAClB,KAAI,OAAOpB,QAAQ,YAAY;AAC3BA,QAAM,MAAMA,IAAIO,YAAYR,IAAAA;AAC5BqB,gBAAc;;AAElB1B,wBAAauB,KAAKjB,KAAK,SAAA;CACvB,MAAMqB,OAAOhC,OAAOC,QAAQgC,OAAOvB,IAAIG,aAAa,GAAA,EAAKZ,QAAQgC,OAAO,IAAA,EAAM,OAAOvB,IAAIM,YAAY,WAAWf,QAAQgC,OAAOvB,IAAIM,QAAO,GAAIN,IAAIM,QAAO;CACzJ,IAAIC;AACJ,KAAI;AACAA,cAAYtB,OAAKe,IAAIO,UAAS;SAE5B;AACF,QAAM,IAAInB,WAAW,2CAAA;;CAEzB,MAAMoC,IAAI,MAAM1B,sBAAaG,KAAKiB,IAAAA;AAElC,KAAI,CAACO,MADkBvC,eAAOgC,KAAKM,GAAGjB,WAAWe,KAAAA,CAE7C,OAAM,IAAIjC,gCAAAA;CAEd,IAAIiB;AACJ,KAAIU,IACA,KAAI;AACAV,YAAUrB,OAAKe,IAAIM,QAAO;SAExB;AACF,QAAM,IAAIlB,WAAW,yCAAA;;UAGpB,OAAOY,IAAIM,YAAY,SAC5BA,WAAUf,QAAQgC,OAAOvB,IAAIM,QAAO;KAGpCA,WAAUN,IAAIM;CAElB,MAAMoB,SAAS,EAAEpB,SAAQ;AACzB,KAAIN,IAAIG,cAAcC,KAAAA,EAClBsB,QAAOjB,kBAAkBD;AAE7B,KAAIR,IAAIK,WAAWD,KAAAA,EACfsB,QAAOC,oBAAoB3B,IAAIK;AAEnC,KAAIgB,YACA,QAAO;EAAE,GAAGK;EAAQzB,KAAKuB;EAAE;AAE/B,QAAOE;;;;AC/GX,eAAsBK,cAAcC,KAAKC,KAAKC,SAAO;AACjD,KAAIF,eAAeG,WACfH,OAAMF,QAAQM,OAAOJ,IAAAA;AAEzB,KAAI,OAAOA,QAAQ,SACf,OAAM,IAAIH,WAAW,6CAAA;CAEzB,MAAM,EAAE,GAAGQ,iBAAiB,GAAGC,SAAS,GAAGC,WAAWC,WAAWR,IAAIS,MAAM,IAAA;AAC3E,KAAID,WAAW,EACX,OAAM,IAAIX,WAAW,sBAAA;CAEzB,MAAMa,WAAW,MAAMd,gBAAgB;EAAEU;EAASK,WAAWN;EAAiBE;EAAU,EAAGN,KAAKC,QAAAA;CAChG,MAAMU,SAAS;EAAEN,SAASI,SAASJ;EAASD,iBAAiBK,SAASL;EAAgB;AACtF,KAAI,OAAOJ,QAAQ,WACf,QAAO;EAAE,GAAGW;EAAQX,KAAKS,SAAST;EAAI;AAE1C,QAAOW;;;;ACnBX,IAAA,kBAAgBC,SAASC,KAAKC,MAAMF,KAAKG,SAAO,GAAK,IAAI;;;ACAzD,MAAMC,SAAS;AACf,MAAMC,OAAOD,SAAS;AACtB,MAAME,MAAMD,OAAO;AACnB,MAAME,OAAOD,MAAM;AACnB,MAAME,OAAOF,MAAM;AACnB,MAAMG,QAAQ;AACd,IAAA,iBAAgBC,QAAAA;CACZ,MAAMC,UAAUF,MAAMG,KAAKF,IAAAA;AAC3B,KAAI,CAACC,WAAYA,QAAQ,MAAMA,QAAQ,GACnC,OAAM,IAAIE,UAAU,6BAAA;CAExB,MAAMC,QAAQC,WAAWJ,QAAQ,GAAE;CACnC,MAAMK,OAAOL,QAAQ,GAAGM,aAAW;CACnC,IAAIC;AACJ,SAAQF,MAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACDE,iBAAcC,KAAKC,MAAMN,MAAAA;AACzB;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACDI,iBAAcC,KAAKC,MAAMN,QAAQV,OAAAA;AACjC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACDc,iBAAcC,KAAKC,MAAMN,QAAQT,KAAAA;AACjC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;AACDa,iBAAcC,KAAKC,MAAMN,QAAQR,IAAAA;AACjC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;AACDY,iBAAcC,KAAKC,MAAMN,QAAQP,KAAAA;AACjC;EACJ;AACIW,iBAAcC,KAAKC,MAAMN,QAAQN,KAAAA;AACjC;;AAER,KAAIG,QAAQ,OAAO,OAAOA,QAAQ,OAAO,MACrC,QAAO,CAACO;AAEZ,QAAOA;;;;;;;;;;;;AC/CX,SAASW,cAAcC,OAAOC,OAAK;AAC/B,KAAI,CAACC,OAAOC,SAASF,MAAAA,CACjB,OAAM,IAAIG,UAAU,WAAWJ,MAAM,QAAO;AAEhD,QAAOC;;AAEX,MAAMI,gBAAgBC,UAAAA;AAClB,KAAIA,MAAMC,SAAS,IAAA,CACf,QAAOD,MAAME,aAAW;AAE5B,QAAO,eAAeF,MAAME,aAAW;;AAE3C,MAAMC,yBAAyBC,YAAYC,cAAAA;AACvC,KAAI,OAAOD,eAAe,SACtB,QAAOC,UAAUJ,SAASG,WAAAA;AAE9B,KAAIE,MAAMC,QAAQH,WAAAA,CACd,QAAOC,UAAUG,KAAKC,IAAIC,UAAUC,IAAIC,KAAK,IAAIH,IAAIL,WAAAA,CAAAA,CAAAA;AAEzD,QAAO;;AAEX,SAAgBS,kBAAkBC,iBAAiBC,gBAAgBC,UAAU,EAAE,EAAA;CAC3E,IAAIC;AACJ,KAAI;AACAA,YAAUC,KAAKC,MAAM/B,QAAQgC,OAAOL,eAAAA,CAAAA;SAElC;AAEN,KAAI,CAACxB,kBAAS0B,QAAAA,CACV,OAAM,IAAI9B,WAAW,iDAAA;CAEzB,MAAM,EAAEkC,QAAQL;AAChB,KAAIK,QACC,OAAOP,gBAAgBO,QAAQ,YAC5BtB,aAAae,gBAAgBO,IAAG,KAAMtB,aAAasB,IAAG,EAC1D,OAAM,IAAIpC,yBAAyB,uCAAqCgC,SAAS,OAAO,eAAA;CAE5F,MAAM,EAAEK,iBAAiB,EAAE,EAAEC,QAAQC,SAASC,UAAUC,gBAAgBV;CACxE,MAAMW,gBAAgB,CAAA,GAAIL,eAAe;AACzC,KAAII,gBAAgBE,KAAAA,EAChBD,eAAcE,KAAK,MAAA;AACvB,KAAIJ,aAAaG,KAAAA,EACbD,eAAcE,KAAK,MAAA;AACvB,KAAIL,YAAYI,KAAAA,EACZD,eAAcE,KAAK,MAAA;AACvB,KAAIN,WAAWK,KAAAA,EACXD,eAAcE,KAAK,MAAA;AACvB,MAAK,MAAMC,SAAS,IAAIrB,IAAIkB,cAAcI,SAAO,CAAA,CAC7C,KAAI,EAAED,SAASb,SACX,OAAM,IAAIhC,yBAAyB,qBAAqB6C,MAAM,UAAUb,SAASa,OAAO,UAAA;AAGhG,KAAIP,UACA,EAAEjB,MAAMC,QAAQgB,OAAAA,GAAUA,SAAS,CAACA,OAAO,EAAEtB,SAASgB,QAAQe,IAAG,CACjE,OAAM,IAAI/C,yBAAyB,kCAAgCgC,SAAS,OAAO,eAAA;AAEvF,KAAIO,WAAWP,QAAQgB,QAAQT,QAC3B,OAAM,IAAIvC,yBAAyB,kCAAgCgC,SAAS,OAAO,eAAA;AAEvF,KAAIQ,YACA,CAACtB,sBAAsBc,QAAQiB,KAAK,OAAOT,aAAa,WAAW,CAACA,SAAS,GAAGA,SAAAA,CAChF,OAAM,IAAIxC,yBAAyB,kCAAgCgC,SAAS,OAAO,eAAA;CAEvF,IAAIkB;AACJ,SAAQ,OAAOnB,QAAQoB,gBAAvB;EACI,KAAK;AACDD,eAAY7C,aAAK0B,QAAQoB,eAAc;AACvC;EACJ,KAAK;AACDD,eAAYnB,QAAQoB;AACpB;EACJ,KAAK;AACDD,eAAY;AACZ;EACJ,QACI,OAAM,IAAIrC,UAAU,qCAAA;;CAE5B,MAAM,EAAEuC,gBAAgBrB;CACxB,MAAMsB,MAAMjD,cAAMgD,+BAAe,IAAIE,MAAAA,CAAAA;AACrC,MAAKtB,QAAQuB,QAAQZ,KAAAA,KAAaF,gBAAgB,OAAOT,QAAQuB,QAAQ,SACrE,OAAM,IAAIvD,yBAAyB,kCAAgCgC,SAAS,OAAO,UAAA;AAEvF,KAAIA,QAAQwB,QAAQb,KAAAA,GAAW;AAC3B,MAAI,OAAOX,QAAQwB,QAAQ,SACvB,OAAM,IAAIxD,yBAAyB,kCAAgCgC,SAAS,OAAO,UAAA;AAEvF,MAAIA,QAAQwB,MAAMH,MAAMH,UACpB,OAAM,IAAIlD,yBAAyB,wCAAsCgC,SAAS,OAAO,eAAA;;AAGjG,KAAIA,QAAQyB,QAAQd,KAAAA,GAAW;AAC3B,MAAI,OAAOX,QAAQyB,QAAQ,SACvB,OAAM,IAAIzD,yBAAyB,kCAAgCgC,SAAS,OAAO,UAAA;AAEvF,MAAIA,QAAQyB,OAAOJ,MAAMH,UACrB,OAAM,IAAIjD,WAAW,wCAAsC+B,SAAS,OAAO,eAAA;;AAGnF,KAAIS,aAAa;EACb,MAAMiB,MAAML,MAAMrB,QAAQuB;EAC1B,MAAMI,MAAM,OAAOlB,gBAAgB,WAAWA,cAAcpC,aAAKoC,YAAAA;AACjE,MAAIiB,MAAMR,YAAYS,IAClB,OAAM,IAAI1D,WAAW,8DAA4D+B,SAAS,OAAO,eAAA;AAErG,MAAI0B,MAAM,IAAIR,UACV,OAAM,IAAIlD,yBAAyB,mEAAiEgC,SAAS,OAAO,eAAA;;AAG5H,QAAOA;;IAGP,aAAA,iDAAA,WAAA;AADJ,IAAa4B,mBAAb,MAAaA;CAQTC,OAAO;AACH,SAAOtD,QAAQuD,OAAO7B,KAAK8B,UAAU,kCAAA,MAAK,WAAA,CAAA,YAAA,CAAA;;CAE9C,IAAIhB,MAAM;AACN,SAAO,kCAAA,MAAK,WAAA,CAAA,YAASA;;CAEzB,IAAIA,IAAIhC,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASgC,MAAMhC;;CAExB,IAAIiC,MAAM;AACN,SAAO,kCAAA,MAAK,WAAA,CAAA,YAASA;;CAEzB,IAAIA,IAAIjC,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASiC,MAAMjC;;CAExB,IAAIkC,MAAM;AACN,SAAO,kCAAA,MAAK,WAAA,CAAA,YAASA;;CAEzB,IAAIA,IAAIlC,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASkC,MAAMlC;;CAExB,IAAIiD,IAAIjD,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASiD,MAAMjD;;CAExB,IAAIyC,IAAIzC,OAAO;AACX,MAAI,OAAOA,UAAU,SACjB,mCAAA,MAAK,WAAA,CAAA,YAASyC,MAAMhD,cAAc,gBAAgBO,MAAAA;WAE7CA,iBAAiBuC,KACtB,mCAAA,MAAK,WAAA,CAAA,YAASE,MAAMhD,cAAc,gBAAgBJ,cAAMW,MAAAA,CAAAA;MAGxD,mCAAA,MAAK,WAAA,CAAA,YAASyC,MAAMpD,8BAAM,IAAIkD,MAAAA,CAAAA,GAAUjD,aAAKU,MAAAA;;CAGrD,IAAI0C,IAAI1C,OAAO;AACX,MAAI,OAAOA,UAAU,SACjB,mCAAA,MAAK,WAAA,CAAA,YAAS0C,MAAMjD,cAAc,qBAAqBO,MAAAA;WAElDA,iBAAiBuC,KACtB,mCAAA,MAAK,WAAA,CAAA,YAASG,MAAMjD,cAAc,qBAAqBJ,cAAMW,MAAAA,CAAAA;MAG7D,mCAAA,MAAK,WAAA,CAAA,YAAS0C,MAAMrD,8BAAM,IAAIkD,MAAAA,CAAAA,GAAUjD,aAAKU,MAAAA;;CAGrD,IAAIwC,IAAIxC,OAAO;AACX,MAAI,OAAOA,UAAU,YACjB,mCAAA,MAAK,WAAA,CAAA,YAASwC,MAAMnD,8BAAM,IAAIkD,MAAAA,CAAAA;WAEzBvC,iBAAiBuC,KACtB,mCAAA,MAAK,WAAA,CAAA,YAASC,MAAM/C,cAAc,eAAeJ,cAAMW,MAAAA,CAAAA;WAElD,OAAOA,UAAU,SACtB,mCAAA,MAAK,WAAA,CAAA,YAASwC,MAAM/C,cAAc,eAAeJ,8BAAM,IAAIkD,MAAAA,CAAAA,GAAUjD,aAAKU,MAAAA,CAAAA;MAG1E,mCAAA,MAAK,WAAA,CAAA,YAASwC,MAAM/C,cAAc,eAAeO,MAAAA;;CA/DzD,YAAYiB,SAAS;AADrB,SAAA,eAAA,MAAA,YAAA;;UAAA,KAAA;;AAEI,MAAI,CAAC1B,kBAAS0B,QAAAA,CACV,OAAM,IAAInB,UAAU,mCAAA;AAExB,oCAAA,MAAK,WAAA,CAAA,cAAWoD,gBAAgBjC,QAAAA;;;;;ACvHxC,eAAsBqC,UAAUC,KAAKC,KAAKC,SAAO;CAC7C,MAAMC,WAAW,MAAMP,cAAcI,KAAKC,KAAKC,QAAAA;AAC/C,KAAIC,SAASC,gBAAgBC,MAAMC,SAAS,MAAA,IAAUH,SAASC,gBAAgBG,QAAQ,MACnF,OAAM,IAAIT,WAAW,sCAAA;CAGzB,MAAMW,SAAS;EAAED,SADDX,kBAAkBM,SAASC,iBAAiBD,SAASK,SAASN,QAC7DM;EAASJ,iBAAiBD,SAASC;EAAgB;AACpE,KAAI,OAAOH,QAAQ,WACf,QAAO;EAAE,GAAGQ;EAAQR,KAAKE,SAASF;EAAI;AAE1C,QAAOQ;;;;ACVX,IAAA,gBAAe,OAAOI,KAAKC,KAAKC,SAAAA;CAC5B,MAAMC,YAAY,MAAMJ,4BAAWC,KAAKC,KAAK,OAAA;AAC7CH,0BAAeE,KAAKG,UAAAA;CACpB,MAAMC,YAAY,MAAMC,OAAOC,OAAOC,KAAKV,mBAAgBG,KAAKG,UAAUK,UAAS,EAAGL,WAAWD,KAAAA;AACjG,QAAO,IAAIO,WAAWL,UAAAA;;;;;;;;;;;;ICEtB,WAAA,iDAAA,WAAA,EACA,qBAAA,iDAAA,mBAAA,EACA,qBAAA,iDAAA,qBAAA;AAHJ,IAAaiB,gBAAb,MAAaA;CAUTC,mBAAmBC,iBAAiB;AAChC,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACL,OAAM,IAAIC,UAAU,6CAAA;AAExB,oCAAA,MAAK,mBAAA,CAAA,sBAAmBD;AACxB,SAAO;;CAEXE,qBAAqBC,mBAAmB;AACpC,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACL,OAAM,IAAIF,UAAU,+CAAA;AAExB,oCAAA,MAAK,mBAAA,CAAA,sBAAqBE;AAC1B,SAAO;;CAEX,MAAMd,KAAKe,KAAKC,SAAS;AACrB,MAAI,CAAC,kCAAA,MAAK,mBAAA,CAAA,uBAAoB,CAAC,kCAAA,MAAK,mBAAA,CAAA,oBAChC,OAAM,IAAId,WAAW,kFAAA;AAEzB,MAAI,CAACD,oBAAW,kCAAA,MAAK,mBAAA,CAAA,qBAAkB,kCAAA,MAAK,mBAAA,CAAA,oBAAA,CACxC,OAAM,IAAIC,WAAW,4EAAA;EAEzB,MAAMe,aAAa;MACZ,kCAAA,MAAK,mBAAA,CAAA;MACL,kCAAA,MAAK,mBAAA,CAAA;GACZ;EACA,MAAMC,aAAaX,sBAAaL,YAAY,IAAIiB,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAA,EAAGH,SAASI,MAAM,kCAAA,MAAK,mBAAA,CAAA,qBAAkBH,WAAAA;EAC5G,IAAII,MAAM;AACV,MAAIH,WAAWI,IAAI,MAAA,EAAQ;AACvBD,SAAM,kCAAA,MAAK,mBAAA,CAAA,oBAAiBA;AAC5B,OAAI,OAAOA,QAAQ,UACf,OAAM,IAAInB,WAAW,4EAAA;;EAG7B,MAAM,EAAEqB,QAAQN;AAChB,MAAI,OAAOM,QAAQ,YAAY,CAACA,IAC5B,OAAM,IAAIrB,WAAW,8DAAA;AAEzBI,yBAAaiB,KAAKR,KAAK,OAAA;EACvB,IAAIS,UAAU,kCAAA,MAAK,SAAA,CAAA;AACnB,MAAIH,IACAG,WAAUrB,QAAQL,OAAOC,OAAKyB,QAAAA,CAAAA;EAElC,IAAIb;AACJ,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACLA,mBAAkBR,QAAQL,OAAOC,OAAK0B,KAAKC,UAAU,kCAAA,MAAK,mBAAA,CAAA,oBAAA,CAAA,CAAA;MAG1Df,mBAAkBR,QAAQL,OAAO,GAAA;EAErC,MAAM6B,OAAOtB,OAAOM,iBAAiBR,QAAQL,OAAO,IAAA,EAAM0B,QAAAA;EAG1D,MAAMM,MAAM;GACRD,WAAW9B,OAAK8B,MAFI7B,aAAKuB,KAAKK,MADlBpB,sBAAaO,KAAKQ,IAAAA,EACGI,KAAAA,CAEjBE;GAChBL,SAAS;GACb;AACA,MAAIH,IACAS,KAAIN,UAAUpB,QAAQ2B,OAAOP,QAAAA;AAEjC,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACLM,KAAIE,SAAS,kCAAA,MAAK,mBAAA,CAAA;AAEtB,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACLF,KAAIG,YAAY7B,QAAQ2B,OAAOpB,gBAAAA;AAEnC,SAAOmB;;CAvEX,YAAYN,SAAS;AAHrB,SAAA,eAAA,MAAA,UAAA;;UAAA,KAAA;;AACA,SAAA,eAAA,MAAA,oBAAA;;UAAA,KAAA;;AACA,SAAA,eAAA,MAAA,oBAAA;;UAAA,KAAA;;AAEI,MAAI,EAAEA,mBAAmBU,YACrB,OAAM,IAAItB,UAAU,4CAAA;AAExB,oCAAA,MAAK,SAAA,CAAA,YAAWY;;;;;;;;;;;;;ICdpB,aAAA,iDAAA,aAAA;AADJ,IAAaY,cAAb,MAAaA;CAKTC,mBAAmBC,iBAAiB;AAChC,oCAAA,MAAK,WAAA,CAAA,YAAWD,mBAAmBC,gBAAAA;AACnC,SAAO;;CAEX,MAAMC,KAAKC,KAAKC,SAAS;EACrB,MAAMC,MAAM,MAAM,kCAAA,MAAK,WAAA,CAAA,YAAWH,KAAKC,KAAKC,QAAAA;AAC5C,MAAIC,IAAIC,YAAYC,KAAAA,EAChB,OAAM,IAAIC,UAAU,4DAAA;AAExB,SAAO,GAAGH,IAAII,UAAU,GAAGJ,IAAIC,QAAQ,GAAGD,IAAIK;;CAZlD,YAAYJ,SAAS;AADrB,SAAA,eAAA,MAAA,YAAA;;UAAA,KAAA;;AAEI,oCAAA,MAAK,WAAA,CAAA,cAAa,IAAIR,cAAcQ,QAAAA;;;;;;;;;;;;;ICAxC,mBAAA,+CAAA,mBAAA,EACA,OAAA,+CAAA,OAAA;AAFJ,IAAaQ,UAAb,MAAaA;CAMTC,UAAUC,QAAQ;AACd,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,WAAWC,SAAS;AAChB,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,YAAYC,UAAU;AAClB,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,OAAOC,OAAO;AACV,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,aAAaC,OAAO;AAChB,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,kBAAkBF,OAAO;AACrB,kCAAA,MAAK,KAAA,CAAA,MAAKG,MAAMH;AAChB,SAAO;;CAEXI,YAAYJ,OAAO;AACf,kCAAA,MAAK,KAAA,CAAA,MAAKK,MAAML;AAChB,SAAO;;CAEXM,mBAAmBC,iBAAiB;AAChC,kCAAA,MAAK,iBAAA,CAAA,oBAAmBA;AACxB,SAAO;;CAEX,MAAMC,KAAKC,KAAKC,SAAS;EACrB,MAAMC,MAAM,IAAI5B,YAAY,gCAAA,MAAK,KAAA,CAAA,MAAK6B,MAAI,CAAA;AAC1CD,MAAIL,mBAAmB,gCAAA,MAAK,iBAAA,CAAA,kBAAA;AAC5B,MAAIO,MAAMC,QAAQ,gCAAA,MAAK,iBAAA,CAAA,mBAAkBC,KAAAA,IACrC,gCAAA,MAAK,iBAAA,CAAA,kBAAiBA,KAAKC,SAAS,MAAA,IACpC,gCAAA,MAAK,iBAAA,CAAA,kBAAiBC,QAAQ,MAC9B,OAAM,IAAIjC,WAAW,sCAAA;AAEzB,SAAO2B,IAAIH,KAAKC,KAAKC,QAAAA;;CA3CzB,YAAYQ,UAAU,EAAE,EAAE;AAF1B,SAAA,eAAA,MAAA,kBAAA;;UAAA,KAAA;;AACA,SAAA,eAAA,MAAA,MAAA;;UAAA,KAAA;;AAEI,kCAAA,MAAK,KAAA,CAAA,QAAO,IAAIjC,iBAAiBiC,QAAAA;;;;;ACHzC,SAAgBM,UAAUC,KAAG;AACzB,KAAI,OAAOA,QAAQ,SACf,OAAM,IAAIF,WAAW,gEAAA;CACzB,MAAM,EAAE,GAAGG,SAASC,WAAWF,IAAIG,MAAM,IAAA;AACzC,KAAID,WAAW,EACX,OAAM,IAAIJ,WAAW,2DAAA;AACzB,KAAII,WAAW,EACX,OAAM,IAAIJ,WAAW,cAAA;AACzB,KAAI,CAACG,QACD,OAAM,IAAIH,WAAW,8BAAA;CACzB,IAAIM;AACJ,KAAI;AACAA,YAAUT,OAAKM,QAAAA;SAEb;AACF,QAAM,IAAIH,WAAW,yCAAA;;CAEzB,IAAIO;AACJ,KAAI;AACAA,WAASC,KAAKC,MAAMX,QAAQF,OAAOU,QAAAA,CAAAA;SAEjC;AACF,QAAM,IAAIN,WAAW,8CAAA;;AAEzB,KAAI,CAACD,kBAASQ,OAAAA,CACV,OAAM,IAAIP,WAAW,yBAAA;AACzB,QAAOO;;;;;;;;;;;;;ACvBX,IAAaS,aAAb,MAAaA;CAGX,MAAMC,KAAKC,SAAmD;EAC5D,MAAMC,SAAS,IAAIC,aAAAA,CAAcC,OAAO,KAAKC,OAAOH,OAAM;EAC1D,MAAMI,YAAY,KAAKC,eAAe,KAAKF,OAAOC,UAAS;AAQ3D,SAAOE,MANW,IAAIX,QAAQI,QAAAA,CAC3BQ,mBAAmB,EAAEC,KAAK,SAAQ,CAAA,CAClCC,aAAW,CACXC,kBAAkBN,UAAAA,CAClBN,KAAKE,OAAAA;;CAKV,MAAMW,OAAOC,OAAoC;EAE/C,MAAM,EAAEb,YAAY,MAAML,UAAsBkB,OADjC,IAAIX,aAAAA,CAAcC,OAAO,KAAKC,OAAOH,OACGA,CAAAA;AACvD,SAAOD;;CAGTc,OAAOD,OAAkC;AACvC,MAAI;AACF,UAAOnB,UAAsBmB,MAAAA;UACvB;AACN,UAAO;;;CAIHP,eAAeD,WAAoC;EACzD,MAAMU,QAAQ,kBAAkBC,KAAKX,UAAAA;AACrC,MAAIU,MASF,QAAO,GAROG,SAASH,MAAM,MAAM,KAAK,GAQ9BE,CAAM,GAAGG;GALjBC,GAAG;GACHC,GAAG;GACHC,GAAG;GACHC,GAAG;GAEqB,CAPbT,MAAM,MAAM;AAS3B,SAAOV;;CA1CT,YAAY,SAAiBZ,OAAOI,UAAU,EAAE;OAA5BO,SAAAA;;;;;;;;;;;;;;;;;;;ACCtB,IAAa4B,gBAAb,MAAaA;;;;;IAWX,MAAMC,IAAIC,GAAmBC,MAA2C;EACtE,MAAMC,QAAQ,KAAKC,aAAaH,EAAAA;AAEhC,MAAI,CAACE,MACH,OAAM,IAAIP,sBAAsB,EAAES,QAAQ,iBAAgB,CAAA;EAG5D,MAAMC,WAAW,MAAM,KAAKC,WAAWC,OAAOL,MAAAA,CAAOM,MAClDC,aAAa;GAAEC,IAAI;GAAeD;GAAQ,UACpC,EAAEC,IAAI,OAAe,EAAA;AAG9B,MAAI,CAACL,SAASK,GACZ,OAAM,IAAIf,sBAAsB,EAAES,QAAQ,iBAAgB,CAAA;EAG5D,MAAM,EAAEO,MAAMC,UAAU,MAAM,KAAKC,OAAOC,YAAYT,SAASI,QAAO;AACtEhB,UAAQkB,MAAMC,MAAAA;AACd,QAAMX,MAAAA;;CAIAE,aAAaH,GAAkC;AACrD,MAAI,KAAKa,OAAOG,WAAW,SACzB,QAAOtB,UAAUM,GAAG,KAAKa,OAAOI,WAAU,IAAK;EAGjD,MAAMC,aAAalB,EAAEmB,IAAIC,OAAO,gBAAA;AAChC,MAAI,CAACF,YAAYG,WAAW,UAAA,CAC1B,QAAO;AAET,SAAOH,WAAWI,MAAM,EAAA;;CAzC1B,YACE,aAA8B/B,OAAOM,WAAW,EAChD,SAA0BN,OAAOK,UAAU,EAC3C;OAFiBU,aAAAA;OACAO,SAAAA"}
+{"version":3,"file":"index.js","names":["defineError","messages","missing_secret","ZeltJwtConfigError","ctx","reason","Config","Env","inject","ZeltJwtConfigError","JwtConfig","secret","env","getString","reason","expiresIn","driver","cookieName","resolveUser","payload","user","sub","roles","defineHttpException","messages","missing_token","invalid_token","expired","UnauthorizedException","ctx","reason","buildResponse","status","message","Response","json","code","headers","encoder","TextEncoder","decoder","TextDecoder","MAX_INT32","concat","buffers","size","reduce","acc","length","buf","Uint8Array","i","buffer","set","writeUInt32BE","value","offset","RangeError","uint64be","high","Math","floor","low","uint32be","encodeBase64","input","Uint8Array","prototype","toBase64","CHUNK_SIZE","arr","i","length","push","String","fromCharCode","apply","subarray","btoa","join","decodeBase64","encoded","fromBase64","binary","atob","bytes","charCodeAt","encoder","decoder","encodeBase64","decodeBase64","decode","input","Uint8Array","fromBase64","alphabet","encoded","replace","TypeError","encode","unencoded","prototype","toBase64","omitPadding","JOSEError","Error","message","options","code","name","captureStackTrace","JWTClaimValidationFailed","payload","claim","reason","cause","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWEDecryptionFailed","JWEInvalid","JWSInvalid","JWTInvalid","JWKInvalid","JWKSInvalid","JWKSNoMatchingKey","JWKSMultipleMatchingKeys","JWKSTimeout","JWSSignatureVerificationFailed","unusable","name","prop","TypeError","isAlgorithm","algorithm","getHashLength","hash","parseInt","slice","getNamedCurve","alg","Error","checkUsage","key","usage","usages","includes","checkSigCryptoKey","expected","actual","namedCurve","checkEncCryptoKey","length","message","msg","actual","types","filter","Boolean","length","last","pop","join","name","withAlg","alg","assertCryptoKey","key","isCryptoKey","Error","Symbol","toStringTag","isKeyObject","headers","sources","filter","Boolean","length","acc","header","parameters","Object","keys","size","Set","parameter","has","add","isObjectLike","value","input","Object","prototype","toString","call","getPrototypeOf","proto","alg","key","startsWith","modulusLength","algorithm","TypeError","JOSENotSupported","subtleMapping","jwk","algorithm","keyUsages","kty","alg","name","hash","slice","d","parseInt","namedCurve","crv","TypeError","keyData","use","crypto","subtle","importKey","ext","key_ops","JOSENotSupported","Err","recognizedDefault","recognizedOption","protectedHeader","joseHeader","crit","undefined","Set","Array","isArray","length","some","input","recognized","Map","Object","entries","parameter","has","get","option","algorithms","undefined","Array","isArray","some","s","TypeError","Set","isObject","isJWK","key","kty","isPrivateJWK","d","isPublicJWK","isSecretJWK","k","isJWK","decode","importJWK","isCryptoKey","isKeyObject","cache","handleJWK","key","jwk","alg","freeze","WeakMap","cached","get","cryptoKey","Object","set","handleKeyObject","keyObject","isPublic","type","extractable","asymmetricKeyType","TypeError","toCryptoKey","hash","startsWith","name","nist","Map","namedCurve","asymmetricKeyDetails","Uint8Array","export","err","format","k","Error","withAlg","invalidKeyInput","isKeyLike","jwk","tag","key","Symbol","toStringTag","jwkMatchesOp","alg","usage","use","undefined","expected","TypeError","Array","isArray","key_ops","expectedKeyOp","includes","startsWith","test","endsWith","symmetricTypeCheck","Uint8Array","isJWK","isSecretJWK","type","asymmetricTypeCheck","isPrivateJWK","isPublicJWK","symmetric","JOSENotSupported","alg","algorithm","hash","slice","name","saltLength","parseInt","namedCurve","checkSigCryptoKey","invalidKeyInput","alg","key","usage","Uint8Array","startsWith","TypeError","crypto","subtle","importKey","hash","slice","name","subtleAlgorithm","checkKeyLength","getVerifyKey","alg","key","signature","data","cryptoKey","algorithm","crypto","subtle","verify","decode","b64u","verify","JOSEAlgNotAllowed","JWSInvalid","JWSSignatureVerificationFailed","concat","encoder","decoder","isDisjoint","isObject","checkKeyType","validateCrit","validateAlgorithms","normalizeKey","flattenedVerify","jws","key","options","protected","undefined","header","payload","signature","parsedProt","protectedHeader","JSON","parse","joseHeader","extensions","Map","crit","b64","has","alg","algorithms","Uint8Array","resolvedKey","data","encode","k","verified","result","unprotectedHeader","flattenedVerify","JWSInvalid","decoder","compactVerify","jws","key","options","Uint8Array","decode","protectedHeader","payload","signature","length","split","verified","protected","result","date","Math","floor","getTime","minute","hour","day","week","year","REGEX","str","matched","exec","TypeError","value","parseFloat","unit","toLowerCase","numericDate","Math","round","JWTClaimValidationFailed","JWTExpired","JWTInvalid","decoder","epoch","secs","isObject","encoder","validateInput","label","input","Number","isFinite","TypeError","normalizeTyp","value","includes","toLowerCase","checkAudiencePresence","audPayload","audOption","Array","isArray","some","Set","prototype","has","bind","validateClaimsSet","protectedHeader","encodedPayload","options","payload","JSON","parse","decode","typ","requiredClaims","issuer","subject","audience","maxTokenAge","presenceCheck","undefined","push","claim","reverse","iss","sub","aud","tolerance","clockTolerance","currentDate","now","Date","iat","nbf","exp","age","max","JWTClaimsBuilder","data","encode","stringify","jti","structuredClone","compactVerify","validateClaimsSet","JWTInvalid","jwtVerify","jwt","key","options","verified","protectedHeader","crit","includes","b64","payload","result","subtleAlgorithm","checkKeyLength","getSignKey","alg","key","data","cryptoKey","signature","crypto","subtle","sign","algorithm","Uint8Array","encode","b64u","sign","isDisjoint","JWSInvalid","encoder","decoder","concat","checkKeyType","validateCrit","normalizeKey","FlattenedSign","setProtectedHeader","protectedHeader","TypeError","setUnprotectedHeader","unprotectedHeader","key","options","joseHeader","extensions","Map","crit","b64","has","alg","payload","JSON","stringify","data","k","signature","jws","decode","header","protected","Uint8Array","FlattenedSign","CompactSign","setProtectedHeader","protectedHeader","sign","key","options","jws","payload","undefined","TypeError","protected","signature","CompactSign","JWTInvalid","JWTClaimsBuilder","SignJWT","setIssuer","issuer","iss","setSubject","subject","sub","setAudience","audience","aud","setJti","jwtId","jti","setNotBefore","input","nbf","setExpirationTime","exp","setIssuedAt","iat","setProtectedHeader","protectedHeader","sign","key","options","sig","data","Array","isArray","crit","includes","b64","payload","decode","b64u","decoder","isObject","JWTInvalid","decodeJwt","jwt","payload","length","split","decoded","result","JSON","parse","Injectable","inject","decodeJwt","jwtVerify","SignJWT","JwtConfig","JwtService","sign","payload","secret","TextEncoder","encode","config","expiresIn","parseExpiresIn","jwt","setProtectedHeader","alg","setIssuedAt","setExpirationTime","verify","token","decode","match","exec","value","parseInt","unit","unitMap","s","m","h","d","inject","Middleware","setUser","getCookie","JwtConfig","UnauthorizedException","JwtService","JwtMiddleware","use","c","next","token","extractToken","reason","verified","jwtService","verify","then","payload","ok","user","roles","config","resolveUser","undefined","driver","cookieName","authHeader","req","header","startsWith","slice"],"sources":["../src/jwt.errors.ts","../src/jwt.config.ts","../src/jwt.exceptions.ts","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/base64.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/util/base64url.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/util/errors.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/crypto_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/invalid_key_input.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_key_like.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_disjoint.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_object.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/check_key_length.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/jwk_to_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/validate_crit.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/validate_algorithms.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/is_jwk.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/normalize_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/check_key_type.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/subtle_dsa.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/get_sign_verify_key.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/flattened/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/compact/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/epoch.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/secs.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jwt/verify.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/lib/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/flattened/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jws/compact/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/jwt/sign.js","../../../node_modules/.pnpm/jose@6.0.11/node_modules/jose/dist/webapi/util/decode_jwt.js","../src/jwt.service.ts","../src/jwt.middleware.ts"],"sourcesContent":["import { defineError } from '@zeltjs/core/internal-bridge/errors';\n\nexport type JwtConfigErrorReason = 'missing_secret';\n\nconst messages: Record<JwtConfigErrorReason, string> = {\n  missing_secret: 'JWT_SECRET environment variable is required',\n};\n\nexport const ZeltJwtConfigError = defineError(\n  'ZeltJwtConfigError',\n  (ctx: { reason: JwtConfigErrorReason }) => messages[ctx.reason],\n);\n","import type { RequestContextSchema } from '@zeltjs/core';\nimport { Config, Env, inject } from '@zeltjs/core';\n\nimport { ZeltJwtConfigError } from './jwt.errors';\nimport type { JwtDriver, JwtPayload } from './jwt.types';\n\nexport interface ResolveUserResult {\n  user: RequestContextSchema['user'];\n  roles: RequestContextSchema['authRoles'];\n}\n\n@Config\nexport class JwtConfig {\n  constructor(protected readonly env = inject(Env)) {}\n\n  /**\n   * @throws {ZeltJwtConfigError} When JWT_SECRET is not set\n   */\n  get secret(): string {\n    const secret = this.env.getString('JWT_SECRET');\n    if (!secret) {\n      throw new ZeltJwtConfigError({ reason: 'missing_secret' });\n    }\n    return secret;\n  }\n\n  get expiresIn(): string {\n    return '1h';\n  }\n\n  get driver(): JwtDriver {\n    return 'header';\n  }\n\n  get cookieName(): string {\n    return 'jwt';\n  }\n\n  get resolveUser(): (payload: JwtPayload) => Promise<ResolveUserResult> {\n    return async (payload) => ({\n      user: payload.sub,\n      roles: [],\n    });\n  }\n}\n","import { defineHttpException } from '@zeltjs/core';\n\nexport type UnauthorizedReason = 'missing_token' | 'invalid_token' | 'expired';\n\nconst messages: Record<UnauthorizedReason, string> = {\n  missing_token: 'Authorization token is required',\n  invalid_token: 'Invalid authorization token',\n  expired: 'Authorization token has expired',\n};\n\nexport const UnauthorizedException = defineHttpException(\n  'UnauthorizedException',\n  401,\n  (ctx: { reason: UnauthorizedReason }) => messages[ctx.reason],\n  {\n    buildResponse: (ctx, status, message) =>\n      Response.json(\n        { code: 'UNAUTHORIZED', reason: ctx.reason, message },\n        { status, headers: { 'WWW-Authenticate': 'Bearer' } },\n      ),\n  },\n);\n","export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n    const size = buffers.reduce((acc, { length }) => acc + length, 0);\n    const buf = new Uint8Array(size);\n    let i = 0;\n    for (const buffer of buffers) {\n        buf.set(buffer, i);\n        i += buffer.length;\n    }\n    return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n    if (value < 0 || value >= MAX_INT32) {\n        throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n    }\n    buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n    const high = Math.floor(value / MAX_INT32);\n    const low = value % MAX_INT32;\n    const buf = new Uint8Array(8);\n    writeUInt32BE(buf, high, 0);\n    writeUInt32BE(buf, low, 4);\n    return buf;\n}\nexport function uint32be(value) {\n    const buf = new Uint8Array(4);\n    writeUInt32BE(buf, value);\n    return buf;\n}\n","export function encodeBase64(input) {\n    if (Uint8Array.prototype.toBase64) {\n        return input.toBase64();\n    }\n    const CHUNK_SIZE = 0x8000;\n    const arr = [];\n    for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n    }\n    return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(encoded);\n    }\n    const binary = atob(encoded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n    if (Uint8Array.fromBase64) {\n        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n            alphabet: 'base64url',\n        });\n    }\n    let encoded = input;\n    if (encoded instanceof Uint8Array) {\n        encoded = decoder.decode(encoded);\n    }\n    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, '');\n    try {\n        return decodeBase64(encoded);\n    }\n    catch {\n        throw new TypeError('The input to be decoded is not correctly encoded.');\n    }\n}\nexport function encode(input) {\n    let unencoded = input;\n    if (typeof unencoded === 'string') {\n        unencoded = encoder.encode(unencoded);\n    }\n    if (Uint8Array.prototype.toBase64) {\n        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n    }\n    return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","export class JOSEError extends Error {\n    static code = 'ERR_JOSE_GENERIC';\n    code = 'ERR_JOSE_GENERIC';\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n    static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JWTExpired extends JOSEError {\n    static code = 'ERR_JWT_EXPIRED';\n    code = 'ERR_JWT_EXPIRED';\n    claim;\n    reason;\n    payload;\n    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n        super(message, { cause: { claim, reason, payload } });\n        this.claim = claim;\n        this.reason = reason;\n        this.payload = payload;\n    }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n    static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n    code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n    static code = 'ERR_JOSE_NOT_SUPPORTED';\n    code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n    static code = 'ERR_JWE_DECRYPTION_FAILED';\n    code = 'ERR_JWE_DECRYPTION_FAILED';\n    constructor(message = 'decryption operation failed', options) {\n        super(message, options);\n    }\n}\nexport class JWEInvalid extends JOSEError {\n    static code = 'ERR_JWE_INVALID';\n    code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n    static code = 'ERR_JWS_INVALID';\n    code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n    static code = 'ERR_JWT_INVALID';\n    code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n    static code = 'ERR_JWK_INVALID';\n    code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n    static code = 'ERR_JWKS_INVALID';\n    code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n    static code = 'ERR_JWKS_NO_MATCHING_KEY';\n    code = 'ERR_JWKS_NO_MATCHING_KEY';\n    constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n    [Symbol.asyncIterator];\n    static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n    constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n        super(message, options);\n    }\n}\nexport class JWKSTimeout extends JOSEError {\n    static code = 'ERR_JWKS_TIMEOUT';\n    code = 'ERR_JWKS_TIMEOUT';\n    constructor(message = 'request timed out', options) {\n        super(message, options);\n    }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n    static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n    constructor(message = 'signature verification failed', options) {\n        super(message, options);\n    }\n}\n","function unusable(name, prop = 'algorithm.name') {\n    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\n}\nfunction isAlgorithm(algorithm, name) {\n    return algorithm.name === name;\n}\nfunction getHashLength(hash) {\n    return parseInt(hash.name.slice(4), 10);\n}\nfunction getNamedCurve(alg) {\n    switch (alg) {\n        case 'ES256':\n            return 'P-256';\n        case 'ES384':\n            return 'P-384';\n        case 'ES512':\n            return 'P-521';\n        default:\n            throw new Error('unreachable');\n    }\n}\nfunction checkUsage(key, usage) {\n    if (usage && !key.usages.includes(usage)) {\n        throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n    }\n}\nexport function checkSigCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512': {\n            if (!isAlgorithm(key.algorithm, 'HMAC'))\n                throw unusable('HMAC');\n            const expected = parseInt(alg.slice(2), 10);\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        case 'RS256':\n        case 'RS384':\n        case 'RS512': {\n            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))\n                throw unusable('RSASSA-PKCS1-v1_5');\n            const expected = parseInt(alg.slice(2), 10);\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        case 'PS256':\n        case 'PS384':\n        case 'PS512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))\n                throw unusable('RSA-PSS');\n            const expected = parseInt(alg.slice(2), 10);\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        case 'Ed25519':\n        case 'EdDSA': {\n            if (!isAlgorithm(key.algorithm, 'Ed25519'))\n                throw unusable('Ed25519');\n            break;\n        }\n        case 'ES256':\n        case 'ES384':\n        case 'ES512': {\n            if (!isAlgorithm(key.algorithm, 'ECDSA'))\n                throw unusable('ECDSA');\n            const expected = getNamedCurve(alg);\n            const actual = key.algorithm.namedCurve;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.namedCurve');\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\nexport function checkEncCryptoKey(key, alg, usage) {\n    switch (alg) {\n        case 'A128GCM':\n        case 'A192GCM':\n        case 'A256GCM': {\n            if (!isAlgorithm(key.algorithm, 'AES-GCM'))\n                throw unusable('AES-GCM');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'A128KW':\n        case 'A192KW':\n        case 'A256KW': {\n            if (!isAlgorithm(key.algorithm, 'AES-KW'))\n                throw unusable('AES-KW');\n            const expected = parseInt(alg.slice(1, 4), 10);\n            const actual = key.algorithm.length;\n            if (actual !== expected)\n                throw unusable(expected, 'algorithm.length');\n            break;\n        }\n        case 'ECDH': {\n            switch (key.algorithm.name) {\n                case 'ECDH':\n                case 'X25519':\n                    break;\n                default:\n                    throw unusable('ECDH or X25519');\n            }\n            break;\n        }\n        case 'PBES2-HS256+A128KW':\n        case 'PBES2-HS384+A192KW':\n        case 'PBES2-HS512+A256KW':\n            if (!isAlgorithm(key.algorithm, 'PBKDF2'))\n                throw unusable('PBKDF2');\n            break;\n        case 'RSA-OAEP':\n        case 'RSA-OAEP-256':\n        case 'RSA-OAEP-384':\n        case 'RSA-OAEP-512': {\n            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))\n                throw unusable('RSA-OAEP');\n            const expected = parseInt(alg.slice(9), 10) || 1;\n            const actual = getHashLength(key.algorithm.hash);\n            if (actual !== expected)\n                throw unusable(`SHA-${expected}`, 'algorithm.hash');\n            break;\n        }\n        default:\n            throw new TypeError('CryptoKey does not support this operation');\n    }\n    checkUsage(key, usage);\n}\n","function message(msg, actual, ...types) {\n    types = types.filter(Boolean);\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `one of type ${types.join(', ')}, or ${last}.`;\n    }\n    else if (types.length === 2) {\n        msg += `one of type ${types[0]} or ${types[1]}.`;\n    }\n    else {\n        msg += `of type ${types[0]}.`;\n    }\n    if (actual == null) {\n        msg += ` Received ${actual}`;\n    }\n    else if (typeof actual === 'function' && actual.name) {\n        msg += ` Received function ${actual.name}`;\n    }\n    else if (typeof actual === 'object' && actual != null) {\n        if (actual.constructor?.name) {\n            msg += ` Received an instance of ${actual.constructor.name}`;\n        }\n    }\n    return msg;\n}\nexport default (actual, ...types) => {\n    return message('Key must be ', actual, ...types);\n};\nexport function withAlg(alg, actual, ...types) {\n    return message(`Key for the ${alg} algorithm must be `, actual, ...types);\n}\n","export function assertCryptoKey(key) {\n    if (!isCryptoKey(key)) {\n        throw new Error('CryptoKey instance expected');\n    }\n}\nexport function isCryptoKey(key) {\n    return key?.[Symbol.toStringTag] === 'CryptoKey';\n}\nexport function isKeyObject(key) {\n    return key?.[Symbol.toStringTag] === 'KeyObject';\n}\nexport default (key) => {\n    return isCryptoKey(key) || isKeyObject(key);\n};\n","export default (...headers) => {\n    const sources = headers.filter(Boolean);\n    if (sources.length === 0 || sources.length === 1) {\n        return true;\n    }\n    let acc;\n    for (const header of sources) {\n        const parameters = Object.keys(header);\n        if (!acc || acc.size === 0) {\n            acc = new Set(parameters);\n            continue;\n        }\n        for (const parameter of parameters) {\n            if (acc.has(parameter)) {\n                return false;\n            }\n            acc.add(parameter);\n        }\n    }\n    return true;\n};\n","function isObjectLike(value) {\n    return typeof value === 'object' && value !== null;\n}\nexport default (input) => {\n    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n        return false;\n    }\n    if (Object.getPrototypeOf(input) === null) {\n        return true;\n    }\n    let proto = input;\n    while (Object.getPrototypeOf(proto) !== null) {\n        proto = Object.getPrototypeOf(proto);\n    }\n    return Object.getPrototypeOf(input) === proto;\n};\n","export default (alg, key) => {\n    if (alg.startsWith('RS') || alg.startsWith('PS')) {\n        const { modulusLength } = key.algorithm;\n        if (typeof modulusLength !== 'number' || modulusLength < 2048) {\n            throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n        }\n    }\n};\n","import { JOSENotSupported } from '../util/errors.js';\nfunction subtleMapping(jwk) {\n    let algorithm;\n    let keyUsages;\n    switch (jwk.kty) {\n        case 'RSA': {\n            switch (jwk.alg) {\n                case 'PS256':\n                case 'PS384':\n                case 'PS512':\n                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RS256':\n                case 'RS384':\n                case 'RS512':\n                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'RSA-OAEP':\n                case 'RSA-OAEP-256':\n                case 'RSA-OAEP-384':\n                case 'RSA-OAEP-512':\n                    algorithm = {\n                        name: 'RSA-OAEP',\n                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n                    };\n                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n                    break;\n                default:\n                    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n            }\n            break;\n        }\n        case 'EC': {\n            switch (jwk.alg) {\n                case 'ES256':\n                    algorithm = { name: 'ECDSA', namedCurve: 'P-256' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ES384':\n                    algorithm = { name: 'ECDSA', namedCurve: 'P-384' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ES512':\n                    algorithm = { name: 'ECDSA', namedCurve: 'P-521' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n            }\n            break;\n        }\n        case 'OKP': {\n            switch (jwk.alg) {\n                case 'Ed25519':\n                case 'EdDSA':\n                    algorithm = { name: 'Ed25519' };\n                    keyUsages = jwk.d ? ['sign'] : ['verify'];\n                    break;\n                case 'ECDH-ES':\n                case 'ECDH-ES+A128KW':\n                case 'ECDH-ES+A192KW':\n                case 'ECDH-ES+A256KW':\n                    algorithm = { name: jwk.crv };\n                    keyUsages = jwk.d ? ['deriveBits'] : [];\n                    break;\n                default:\n                    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n            }\n            break;\n        }\n        default:\n            throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n    }\n    return { algorithm, keyUsages };\n}\nexport default async (jwk) => {\n    if (!jwk.alg) {\n        throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n    }\n    const { algorithm, keyUsages } = subtleMapping(jwk);\n    const keyData = { ...jwk };\n    delete keyData.alg;\n    delete keyData.use;\n    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);\n};\n","import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';\nexport default (Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) => {\n    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n    }\n    if (!protectedHeader || protectedHeader.crit === undefined) {\n        return new Set();\n    }\n    if (!Array.isArray(protectedHeader.crit) ||\n        protectedHeader.crit.length === 0 ||\n        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {\n        throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n    }\n    let recognized;\n    if (recognizedOption !== undefined) {\n        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);\n    }\n    else {\n        recognized = recognizedDefault;\n    }\n    for (const parameter of protectedHeader.crit) {\n        if (!recognized.has(parameter)) {\n            throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n        }\n        if (joseHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n        }\n        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {\n            throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n        }\n    }\n    return new Set(protectedHeader.crit);\n};\n","export default (option, algorithms) => {\n    if (algorithms !== undefined &&\n        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {\n        throw new TypeError(`\"${option}\" option must be an array of strings`);\n    }\n    if (!algorithms) {\n        return undefined;\n    }\n    return new Set(algorithms);\n};\n","import isObject from './is_object.js';\nexport function isJWK(key) {\n    return isObject(key) && typeof key.kty === 'string';\n}\nexport function isPrivateJWK(key) {\n    return key.kty !== 'oct' && typeof key.d === 'string';\n}\nexport function isPublicJWK(key) {\n    return key.kty !== 'oct' && typeof key.d === 'undefined';\n}\nexport function isSecretJWK(key) {\n    return key.kty === 'oct' && typeof key.k === 'string';\n}\n","import { isJWK } from './is_jwk.js';\nimport { decode } from '../util/base64url.js';\nimport importJWK from './jwk_to_key.js';\nimport { isCryptoKey, isKeyObject } from './is_key_like.js';\nlet cache;\nconst handleJWK = async (key, jwk, alg, freeze = false) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(key);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const cryptoKey = await importJWK({ ...jwk, alg });\n    if (freeze)\n        Object.freeze(key);\n    if (!cached) {\n        cache.set(key, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nconst handleKeyObject = (keyObject, alg) => {\n    cache ||= new WeakMap();\n    let cached = cache.get(keyObject);\n    if (cached?.[alg]) {\n        return cached[alg];\n    }\n    const isPublic = keyObject.type === 'public';\n    const extractable = isPublic ? true : false;\n    let cryptoKey;\n    if (keyObject.asymmetricKeyType === 'x25519') {\n        switch (alg) {\n            case 'ECDH-ES':\n            case 'ECDH-ES+A128KW':\n            case 'ECDH-ES+A192KW':\n            case 'ECDH-ES+A256KW':\n                break;\n            default:\n                throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);\n    }\n    if (keyObject.asymmetricKeyType === 'ed25519') {\n        if (alg !== 'EdDSA' && alg !== 'Ed25519') {\n            throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [\n            isPublic ? 'verify' : 'sign',\n        ]);\n    }\n    if (keyObject.asymmetricKeyType === 'rsa') {\n        let hash;\n        switch (alg) {\n            case 'RSA-OAEP':\n                hash = 'SHA-1';\n                break;\n            case 'RS256':\n            case 'PS256':\n            case 'RSA-OAEP-256':\n                hash = 'SHA-256';\n                break;\n            case 'RS384':\n            case 'PS384':\n            case 'RSA-OAEP-384':\n                hash = 'SHA-384';\n                break;\n            case 'RS512':\n            case 'PS512':\n            case 'RSA-OAEP-512':\n                hash = 'SHA-512';\n                break;\n            default:\n                throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        if (alg.startsWith('RSA-OAEP')) {\n            return keyObject.toCryptoKey({\n                name: 'RSA-OAEP',\n                hash,\n            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);\n        }\n        cryptoKey = keyObject.toCryptoKey({\n            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',\n            hash,\n        }, extractable, [isPublic ? 'verify' : 'sign']);\n    }\n    if (keyObject.asymmetricKeyType === 'ec') {\n        const nist = new Map([\n            ['prime256v1', 'P-256'],\n            ['secp384r1', 'P-384'],\n            ['secp521r1', 'P-521'],\n        ]);\n        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);\n        if (!namedCurve) {\n            throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n        }\n        if (alg === 'ES256' && namedCurve === 'P-256') {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg === 'ES384' && namedCurve === 'P-384') {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg === 'ES512' && namedCurve === 'P-521') {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDSA',\n                namedCurve,\n            }, extractable, [isPublic ? 'verify' : 'sign']);\n        }\n        if (alg.startsWith('ECDH-ES')) {\n            cryptoKey = keyObject.toCryptoKey({\n                name: 'ECDH',\n                namedCurve,\n            }, extractable, isPublic ? [] : ['deriveBits']);\n        }\n    }\n    if (!cryptoKey) {\n        throw new TypeError('given KeyObject instance cannot be used for this algorithm');\n    }\n    if (!cached) {\n        cache.set(keyObject, { [alg]: cryptoKey });\n    }\n    else {\n        cached[alg] = cryptoKey;\n    }\n    return cryptoKey;\n};\nexport default async (key, alg) => {\n    if (key instanceof Uint8Array) {\n        return key;\n    }\n    if (isCryptoKey(key)) {\n        return key;\n    }\n    if (isKeyObject(key)) {\n        if (key.type === 'secret') {\n            return key.export();\n        }\n        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {\n            try {\n                return handleKeyObject(key, alg);\n            }\n            catch (err) {\n                if (err instanceof TypeError) {\n                    throw err;\n                }\n            }\n        }\n        let jwk = key.export({ format: 'jwk' });\n        return handleJWK(key, jwk, alg);\n    }\n    if (isJWK(key)) {\n        if (key.k) {\n            return decode(key.k);\n        }\n        return handleJWK(key, key, alg, true);\n    }\n    throw new Error('unreachable');\n};\n","import { withAlg as invalidKeyInput } from './invalid_key_input.js';\nimport isKeyLike from './is_key_like.js';\nimport * as jwk from './is_jwk.js';\nconst tag = (key) => key?.[Symbol.toStringTag];\nconst jwkMatchesOp = (alg, key, usage) => {\n    if (key.use !== undefined) {\n        let expected;\n        switch (usage) {\n            case 'sign':\n            case 'verify':\n                expected = 'sig';\n                break;\n            case 'encrypt':\n            case 'decrypt':\n                expected = 'enc';\n                break;\n        }\n        if (key.use !== expected) {\n            throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n        }\n    }\n    if (key.alg !== undefined && key.alg !== alg) {\n        throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n    }\n    if (Array.isArray(key.key_ops)) {\n        let expectedKeyOp;\n        switch (true) {\n            case usage === 'sign' || usage === 'verify':\n            case alg === 'dir':\n            case alg.includes('CBC-HS'):\n                expectedKeyOp = usage;\n                break;\n            case alg.startsWith('PBES2'):\n                expectedKeyOp = 'deriveBits';\n                break;\n            case /^A\\d{3}(?:GCM)?(?:KW)?$/.test(alg):\n                if (!alg.includes('GCM') && alg.endsWith('KW')) {\n                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';\n                }\n                else {\n                    expectedKeyOp = usage;\n                }\n                break;\n            case usage === 'encrypt' && alg.startsWith('RSA'):\n                expectedKeyOp = 'wrapKey';\n                break;\n            case usage === 'decrypt':\n                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';\n                break;\n        }\n        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {\n            throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n        }\n    }\n    return true;\n};\nconst symmetricTypeCheck = (alg, key, usage) => {\n    if (key instanceof Uint8Array)\n        return;\n    if (jwk.isJWK(key)) {\n        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))\n            return;\n        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present`);\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));\n    }\n    if (key.type !== 'secret') {\n        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type \"secret\"`);\n    }\n};\nconst asymmetricTypeCheck = (alg, key, usage) => {\n    if (jwk.isJWK(key)) {\n        switch (usage) {\n            case 'decrypt':\n            case 'sign':\n                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation be a private JWK`);\n            case 'encrypt':\n            case 'verify':\n                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))\n                    return;\n                throw new TypeError(`JSON Web Key for this operation be a public JWK`);\n        }\n    }\n    if (!isKeyLike(key)) {\n        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n    }\n    if (key.type === 'secret') {\n        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type \"secret\"`);\n    }\n    if (key.type === 'public') {\n        switch (usage) {\n            case 'sign':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type \"private\"`);\n            case 'decrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type \"private\"`);\n            default:\n                break;\n        }\n    }\n    if (key.type === 'private') {\n        switch (usage) {\n            case 'verify':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type \"public\"`);\n            case 'encrypt':\n                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type \"public\"`);\n            default:\n                break;\n        }\n    }\n};\nexport default (alg, key, usage) => {\n    const symmetric = alg.startsWith('HS') ||\n        alg === 'dir' ||\n        alg.startsWith('PBES2') ||\n        /^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(alg) ||\n        /^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(alg);\n    if (symmetric) {\n        symmetricTypeCheck(alg, key, usage);\n    }\n    else {\n        asymmetricTypeCheck(alg, key, usage);\n    }\n};\n","import { JOSENotSupported } from '../util/errors.js';\nexport default (alg, algorithm) => {\n    const hash = `SHA-${alg.slice(-3)}`;\n    switch (alg) {\n        case 'HS256':\n        case 'HS384':\n        case 'HS512':\n            return { hash, name: 'HMAC' };\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { hash, name: 'RSA-PSS', saltLength: parseInt(alg.slice(-3), 10) >> 3 };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { hash, name: 'RSASSA-PKCS1-v1_5' };\n        case 'ES256':\n        case 'ES384':\n        case 'ES512':\n            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };\n        case 'Ed25519':\n        case 'EdDSA':\n            return { name: 'Ed25519' };\n        default:\n            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n    }\n};\n","import { checkSigCryptoKey } from './crypto_key.js';\nimport invalidKeyInput from './invalid_key_input.js';\nexport default async (alg, key, usage) => {\n    if (key instanceof Uint8Array) {\n        if (!alg.startsWith('HS')) {\n            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));\n        }\n        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);\n    }\n    checkSigCryptoKey(key, alg, usage);\n    return key;\n};\n","import subtleAlgorithm from './subtle_dsa.js';\nimport checkKeyLength from './check_key_length.js';\nimport getVerifyKey from './get_sign_verify_key.js';\nexport default async (alg, key, signature, data) => {\n    const cryptoKey = await getVerifyKey(alg, key, 'verify');\n    checkKeyLength(alg, cryptoKey);\n    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);\n    try {\n        return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);\n    }\n    catch {\n        return false;\n    }\n};\n","import { decode as b64u } from '../../util/base64url.js';\nimport verify from '../../lib/verify.js';\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';\nimport { concat, encoder, decoder } from '../../lib/buffer_utils.js';\nimport isDisjoint from '../../lib/is_disjoint.js';\nimport isObject from '../../lib/is_object.js';\nimport checkKeyType from '../../lib/check_key_type.js';\nimport validateCrit from '../../lib/validate_crit.js';\nimport validateAlgorithms from '../../lib/validate_algorithms.js';\nimport normalizeKey from '../../lib/normalize_key.js';\nexport async function flattenedVerify(jws, key, options) {\n    if (!isObject(jws)) {\n        throw new JWSInvalid('Flattened JWS must be an object');\n    }\n    if (jws.protected === undefined && jws.header === undefined) {\n        throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n    }\n    if (jws.protected !== undefined && typeof jws.protected !== 'string') {\n        throw new JWSInvalid('JWS Protected Header incorrect type');\n    }\n    if (jws.payload === undefined) {\n        throw new JWSInvalid('JWS Payload missing');\n    }\n    if (typeof jws.signature !== 'string') {\n        throw new JWSInvalid('JWS Signature missing or incorrect type');\n    }\n    if (jws.header !== undefined && !isObject(jws.header)) {\n        throw new JWSInvalid('JWS Unprotected Header incorrect type');\n    }\n    let parsedProt = {};\n    if (jws.protected) {\n        try {\n            const protectedHeader = b64u(jws.protected);\n            parsedProt = JSON.parse(decoder.decode(protectedHeader));\n        }\n        catch {\n            throw new JWSInvalid('JWS Protected Header is invalid');\n        }\n    }\n    if (!isDisjoint(parsedProt, jws.header)) {\n        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');\n    }\n    const joseHeader = {\n        ...parsedProt,\n        ...jws.header,\n    };\n    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);\n    let b64 = true;\n    if (extensions.has('b64')) {\n        b64 = parsedProt.b64;\n        if (typeof b64 !== 'boolean') {\n            throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n        }\n    }\n    const { alg } = joseHeader;\n    if (typeof alg !== 'string' || !alg) {\n        throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n    }\n    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);\n    if (algorithms && !algorithms.has(alg)) {\n        throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n    }\n    if (b64) {\n        if (typeof jws.payload !== 'string') {\n            throw new JWSInvalid('JWS Payload must be a string');\n        }\n    }\n    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {\n        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');\n    }\n    let resolvedKey = false;\n    if (typeof key === 'function') {\n        key = await key(parsedProt, jws);\n        resolvedKey = true;\n    }\n    checkKeyType(alg, key, 'verify');\n    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);\n    let signature;\n    try {\n        signature = b64u(jws.signature);\n    }\n    catch {\n        throw new JWSInvalid('Failed to base64url decode the signature');\n    }\n    const k = await normalizeKey(key, alg);\n    const verified = await verify(alg, k, signature, data);\n    if (!verified) {\n        throw new JWSSignatureVerificationFailed();\n    }\n    let payload;\n    if (b64) {\n        try {\n            payload = b64u(jws.payload);\n        }\n        catch {\n            throw new JWSInvalid('Failed to base64url decode the payload');\n        }\n    }\n    else if (typeof jws.payload === 'string') {\n        payload = encoder.encode(jws.payload);\n    }\n    else {\n        payload = jws.payload;\n    }\n    const result = { payload };\n    if (jws.protected !== undefined) {\n        result.protectedHeader = parsedProt;\n    }\n    if (jws.header !== undefined) {\n        result.unprotectedHeader = jws.header;\n    }\n    if (resolvedKey) {\n        return { ...result, key: k };\n    }\n    return result;\n}\n","import { flattenedVerify } from '../flattened/verify.js';\nimport { JWSInvalid } from '../../util/errors.js';\nimport { decoder } from '../../lib/buffer_utils.js';\nexport async function compactVerify(jws, key, options) {\n    if (jws instanceof Uint8Array) {\n        jws = decoder.decode(jws);\n    }\n    if (typeof jws !== 'string') {\n        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');\n    }\n    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');\n    if (length !== 3) {\n        throw new JWSInvalid('Invalid Compact JWS');\n    }\n    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);\n    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","export default (date) => Math.floor(date.getTime() / 1000);\n","const minute = 60;\nconst hour = minute * 60;\nconst day = hour * 24;\nconst week = day * 7;\nconst year = day * 365.25;\nconst REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;\nexport default (str) => {\n    const matched = REGEX.exec(str);\n    if (!matched || (matched[4] && matched[1])) {\n        throw new TypeError('Invalid time period format');\n    }\n    const value = parseFloat(matched[2]);\n    const unit = matched[3].toLowerCase();\n    let numericDate;\n    switch (unit) {\n        case 'sec':\n        case 'secs':\n        case 'second':\n        case 'seconds':\n        case 's':\n            numericDate = Math.round(value);\n            break;\n        case 'minute':\n        case 'minutes':\n        case 'min':\n        case 'mins':\n        case 'm':\n            numericDate = Math.round(value * minute);\n            break;\n        case 'hour':\n        case 'hours':\n        case 'hr':\n        case 'hrs':\n        case 'h':\n            numericDate = Math.round(value * hour);\n            break;\n        case 'day':\n        case 'days':\n        case 'd':\n            numericDate = Math.round(value * day);\n            break;\n        case 'week':\n        case 'weeks':\n        case 'w':\n            numericDate = Math.round(value * week);\n            break;\n        default:\n            numericDate = Math.round(value * year);\n            break;\n    }\n    if (matched[1] === '-' || matched[4] === 'ago') {\n        return -numericDate;\n    }\n    return numericDate;\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';\nimport { decoder } from './buffer_utils.js';\nimport epoch from './epoch.js';\nimport secs from './secs.js';\nimport isObject from './is_object.js';\nimport { encoder } from './buffer_utils.js';\nfunction validateInput(label, input) {\n    if (!Number.isFinite(input)) {\n        throw new TypeError(`Invalid ${label} input`);\n    }\n    return input;\n}\nconst normalizeTyp = (value) => {\n    if (value.includes('/')) {\n        return value.toLowerCase();\n    }\n    return `application/${value.toLowerCase()}`;\n};\nconst checkAudiencePresence = (audPayload, audOption) => {\n    if (typeof audPayload === 'string') {\n        return audOption.includes(audPayload);\n    }\n    if (Array.isArray(audPayload)) {\n        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));\n    }\n    return false;\n};\nexport function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n    let payload;\n    try {\n        payload = JSON.parse(decoder.decode(encodedPayload));\n    }\n    catch {\n    }\n    if (!isObject(payload)) {\n        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');\n    }\n    const { typ } = options;\n    if (typ &&\n        (typeof protectedHeader.typ !== 'string' ||\n            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {\n        throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, 'typ', 'check_failed');\n    }\n    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;\n    const presenceCheck = [...requiredClaims];\n    if (maxTokenAge !== undefined)\n        presenceCheck.push('iat');\n    if (audience !== undefined)\n        presenceCheck.push('aud');\n    if (subject !== undefined)\n        presenceCheck.push('sub');\n    if (issuer !== undefined)\n        presenceCheck.push('iss');\n    for (const claim of new Set(presenceCheck.reverse())) {\n        if (!(claim in payload)) {\n            throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, 'missing');\n        }\n    }\n    if (issuer &&\n        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {\n        throw new JWTClaimValidationFailed('unexpected \"iss\" claim value', payload, 'iss', 'check_failed');\n    }\n    if (subject && payload.sub !== subject) {\n        throw new JWTClaimValidationFailed('unexpected \"sub\" claim value', payload, 'sub', 'check_failed');\n    }\n    if (audience &&\n        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {\n        throw new JWTClaimValidationFailed('unexpected \"aud\" claim value', payload, 'aud', 'check_failed');\n    }\n    let tolerance;\n    switch (typeof options.clockTolerance) {\n        case 'string':\n            tolerance = secs(options.clockTolerance);\n            break;\n        case 'number':\n            tolerance = options.clockTolerance;\n            break;\n        case 'undefined':\n            tolerance = 0;\n            break;\n        default:\n            throw new TypeError('Invalid clockTolerance option type');\n    }\n    const { currentDate } = options;\n    const now = epoch(currentDate || new Date());\n    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {\n        throw new JWTClaimValidationFailed('\"iat\" claim must be a number', payload, 'iat', 'invalid');\n    }\n    if (payload.nbf !== undefined) {\n        if (typeof payload.nbf !== 'number') {\n            throw new JWTClaimValidationFailed('\"nbf\" claim must be a number', payload, 'nbf', 'invalid');\n        }\n        if (payload.nbf > now + tolerance) {\n            throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, 'nbf', 'check_failed');\n        }\n    }\n    if (payload.exp !== undefined) {\n        if (typeof payload.exp !== 'number') {\n            throw new JWTClaimValidationFailed('\"exp\" claim must be a number', payload, 'exp', 'invalid');\n        }\n        if (payload.exp <= now - tolerance) {\n            throw new JWTExpired('\"exp\" claim timestamp check failed', payload, 'exp', 'check_failed');\n        }\n    }\n    if (maxTokenAge) {\n        const age = now - payload.iat;\n        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);\n        if (age - tolerance > max) {\n            throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');\n        }\n        if (age < 0 - tolerance) {\n            throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');\n        }\n    }\n    return payload;\n}\nexport class JWTClaimsBuilder {\n    #payload;\n    constructor(payload) {\n        if (!isObject(payload)) {\n            throw new TypeError('JWT Claims Set MUST be an object');\n        }\n        this.#payload = structuredClone(payload);\n    }\n    data() {\n        return encoder.encode(JSON.stringify(this.#payload));\n    }\n    get iss() {\n        return this.#payload.iss;\n    }\n    set iss(value) {\n        this.#payload.iss = value;\n    }\n    get sub() {\n        return this.#payload.sub;\n    }\n    set sub(value) {\n        this.#payload.sub = value;\n    }\n    get aud() {\n        return this.#payload.aud;\n    }\n    set aud(value) {\n        this.#payload.aud = value;\n    }\n    set jti(value) {\n        this.#payload.jti = value;\n    }\n    set nbf(value) {\n        if (typeof value === 'number') {\n            this.#payload.nbf = validateInput('setNotBefore', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.nbf = validateInput('setNotBefore', epoch(value));\n        }\n        else {\n            this.#payload.nbf = epoch(new Date()) + secs(value);\n        }\n    }\n    set exp(value) {\n        if (typeof value === 'number') {\n            this.#payload.exp = validateInput('setExpirationTime', value);\n        }\n        else if (value instanceof Date) {\n            this.#payload.exp = validateInput('setExpirationTime', epoch(value));\n        }\n        else {\n            this.#payload.exp = epoch(new Date()) + secs(value);\n        }\n    }\n    set iat(value) {\n        if (typeof value === 'undefined') {\n            this.#payload.iat = epoch(new Date());\n        }\n        else if (value instanceof Date) {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(value));\n        }\n        else if (typeof value === 'string') {\n            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));\n        }\n        else {\n            this.#payload.iat = validateInput('setIssuedAt', value);\n        }\n    }\n}\n","import { compactVerify } from '../jws/compact/verify.js';\nimport { validateClaimsSet } from '../lib/jwt_claims_set.js';\nimport { JWTInvalid } from '../util/errors.js';\nexport async function jwtVerify(jwt, key, options) {\n    const verified = await compactVerify(jwt, key, options);\n    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {\n        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');\n    }\n    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n    const result = { payload, protectedHeader: verified.protectedHeader };\n    if (typeof key === 'function') {\n        return { ...result, key: verified.key };\n    }\n    return result;\n}\n","import subtleAlgorithm from './subtle_dsa.js';\nimport checkKeyLength from './check_key_length.js';\nimport getSignKey from './get_sign_verify_key.js';\nexport default async (alg, key, data) => {\n    const cryptoKey = await getSignKey(alg, key, 'sign');\n    checkKeyLength(alg, cryptoKey);\n    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);\n    return new Uint8Array(signature);\n};\n","import { encode as b64u } from '../../util/base64url.js';\nimport sign from '../../lib/sign.js';\nimport isDisjoint from '../../lib/is_disjoint.js';\nimport { JWSInvalid } from '../../util/errors.js';\nimport { encoder, decoder, concat } from '../../lib/buffer_utils.js';\nimport checkKeyType from '../../lib/check_key_type.js';\nimport validateCrit from '../../lib/validate_crit.js';\nimport normalizeKey from '../../lib/normalize_key.js';\nexport class FlattenedSign {\n    #payload;\n    #protectedHeader;\n    #unprotectedHeader;\n    constructor(payload) {\n        if (!(payload instanceof Uint8Array)) {\n            throw new TypeError('payload must be an instance of Uint8Array');\n        }\n        this.#payload = payload;\n    }\n    setProtectedHeader(protectedHeader) {\n        if (this.#protectedHeader) {\n            throw new TypeError('setProtectedHeader can only be called once');\n        }\n        this.#protectedHeader = protectedHeader;\n        return this;\n    }\n    setUnprotectedHeader(unprotectedHeader) {\n        if (this.#unprotectedHeader) {\n            throw new TypeError('setUnprotectedHeader can only be called once');\n        }\n        this.#unprotectedHeader = unprotectedHeader;\n        return this;\n    }\n    async sign(key, options) {\n        if (!this.#protectedHeader && !this.#unprotectedHeader) {\n            throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');\n        }\n        if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) {\n            throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');\n        }\n        const joseHeader = {\n            ...this.#protectedHeader,\n            ...this.#unprotectedHeader,\n        };\n        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, this.#protectedHeader, joseHeader);\n        let b64 = true;\n        if (extensions.has('b64')) {\n            b64 = this.#protectedHeader.b64;\n            if (typeof b64 !== 'boolean') {\n                throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n            }\n        }\n        const { alg } = joseHeader;\n        if (typeof alg !== 'string' || !alg) {\n            throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n        }\n        checkKeyType(alg, key, 'sign');\n        let payload = this.#payload;\n        if (b64) {\n            payload = encoder.encode(b64u(payload));\n        }\n        let protectedHeader;\n        if (this.#protectedHeader) {\n            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));\n        }\n        else {\n            protectedHeader = encoder.encode('');\n        }\n        const data = concat(protectedHeader, encoder.encode('.'), payload);\n        const k = await normalizeKey(key, alg);\n        const signature = await sign(alg, k, data);\n        const jws = {\n            signature: b64u(signature),\n            payload: '',\n        };\n        if (b64) {\n            jws.payload = decoder.decode(payload);\n        }\n        if (this.#unprotectedHeader) {\n            jws.header = this.#unprotectedHeader;\n        }\n        if (this.#protectedHeader) {\n            jws.protected = decoder.decode(protectedHeader);\n        }\n        return jws;\n    }\n}\n","import { FlattenedSign } from '../flattened/sign.js';\nexport class CompactSign {\n    #flattened;\n    constructor(payload) {\n        this.#flattened = new FlattenedSign(payload);\n    }\n    setProtectedHeader(protectedHeader) {\n        this.#flattened.setProtectedHeader(protectedHeader);\n        return this;\n    }\n    async sign(key, options) {\n        const jws = await this.#flattened.sign(key, options);\n        if (jws.payload === undefined) {\n            throw new TypeError('use the flattened module for creating JWS with b64: false');\n        }\n        return `${jws.protected}.${jws.payload}.${jws.signature}`;\n    }\n}\n","import { CompactSign } from '../jws/compact/sign.js';\nimport { JWTInvalid } from '../util/errors.js';\nimport { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';\nexport class SignJWT {\n    #protectedHeader;\n    #jwt;\n    constructor(payload = {}) {\n        this.#jwt = new JWTClaimsBuilder(payload);\n    }\n    setIssuer(issuer) {\n        this.#jwt.iss = issuer;\n        return this;\n    }\n    setSubject(subject) {\n        this.#jwt.sub = subject;\n        return this;\n    }\n    setAudience(audience) {\n        this.#jwt.aud = audience;\n        return this;\n    }\n    setJti(jwtId) {\n        this.#jwt.jti = jwtId;\n        return this;\n    }\n    setNotBefore(input) {\n        this.#jwt.nbf = input;\n        return this;\n    }\n    setExpirationTime(input) {\n        this.#jwt.exp = input;\n        return this;\n    }\n    setIssuedAt(input) {\n        this.#jwt.iat = input;\n        return this;\n    }\n    setProtectedHeader(protectedHeader) {\n        this.#protectedHeader = protectedHeader;\n        return this;\n    }\n    async sign(key, options) {\n        const sig = new CompactSign(this.#jwt.data());\n        sig.setProtectedHeader(this.#protectedHeader);\n        if (Array.isArray(this.#protectedHeader?.crit) &&\n            this.#protectedHeader.crit.includes('b64') &&\n            this.#protectedHeader.b64 === false) {\n            throw new JWTInvalid('JWTs MUST NOT use unencoded payload');\n        }\n        return sig.sign(key, options);\n    }\n}\n","import { decode as b64u } from './base64url.js';\nimport { decoder } from '../lib/buffer_utils.js';\nimport isObject from '../lib/is_object.js';\nimport { JWTInvalid } from './errors.js';\nexport function decodeJwt(jwt) {\n    if (typeof jwt !== 'string')\n        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');\n    const { 1: payload, length } = jwt.split('.');\n    if (length === 5)\n        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');\n    if (length !== 3)\n        throw new JWTInvalid('Invalid JWT');\n    if (!payload)\n        throw new JWTInvalid('JWTs must contain a payload');\n    let decoded;\n    try {\n        decoded = b64u(payload);\n    }\n    catch {\n        throw new JWTInvalid('Failed to base64url decode the payload');\n    }\n    let result;\n    try {\n        result = JSON.parse(decoder.decode(decoded));\n    }\n    catch {\n        throw new JWTInvalid('Failed to parse the decoded payload as JSON');\n    }\n    if (!isObject(result))\n        throw new JWTInvalid('Invalid JWT Claims Set');\n    return result;\n}\n","import { Injectable, inject } from '@zeltjs/core';\nimport { decodeJwt, jwtVerify, SignJWT } from 'jose';\n\nimport { JwtConfig } from './jwt.config';\nimport type { JwtPayload } from './jwt.types';\n\n@Injectable()\nexport class JwtService {\n  constructor(private readonly config = inject(JwtConfig)) {}\n\n  async sign(payload: Record<string, unknown>): Promise<string> {\n    const secret = new TextEncoder().encode(this.config.secret);\n    const expiresIn = this.parseExpiresIn(this.config.expiresIn);\n\n    const jwt = await new SignJWT(payload)\n      .setProtectedHeader({ alg: 'HS256' })\n      .setIssuedAt()\n      .setExpirationTime(expiresIn)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  async verify(token: string): Promise<JwtPayload> {\n    const secret = new TextEncoder().encode(this.config.secret);\n    const { payload } = await jwtVerify<JwtPayload>(token, secret);\n    return payload;\n  }\n\n  decode(token: string): JwtPayload | null {\n    try {\n      return decodeJwt<JwtPayload>(token);\n    } catch {\n      return null;\n    }\n  }\n\n  private parseExpiresIn(expiresIn: string): string | number {\n    const match = /^(\\d+)([smhd])$/.exec(expiresIn);\n    if (match) {\n      const value = parseInt(match[1] ?? '0', 10);\n      const unit = match[2] ?? '';\n      const unitMap: Record<string, string> = {\n        s: 'seconds',\n        m: 'minutes',\n        h: 'hours',\n        d: 'days',\n      };\n      return `${value} ${unitMap[unit]}`;\n    }\n    return expiresIn;\n  }\n}\n","import type { Next, RequestContext } from '@zeltjs/core';\nimport { inject, Middleware, setUser } from '@zeltjs/core';\nimport { getCookie } from 'hono/cookie';\nimport { JwtConfig } from './jwt.config';\nimport { UnauthorizedException } from './jwt.exceptions';\nimport { JwtService } from './jwt.service';\n\n@Middleware\nexport class JwtMiddleware {\n  constructor(\n    private readonly jwtService = inject(JwtService),\n    private readonly config = inject(JwtConfig),\n  ) {}\n\n  /**\n   * @throws {UnauthorizedException} When token is missing (401)\n   * @throws {UnauthorizedException} When token is invalid or expired (401)\n   * @throws {ZeltContextNotAvailableError}\n   */\n  async use(c: RequestContext, next: Next): Promise<Response | undefined> {\n    const token = this.extractToken(c);\n\n    if (!token) {\n      throw new UnauthorizedException({ reason: 'missing_token' });\n    }\n\n    const verified = await this.jwtService.verify(token).then(\n      (payload) => ({ ok: true as const, payload }),\n      () => ({ ok: false as const }),\n    );\n\n    if (!verified.ok) {\n      throw new UnauthorizedException({ reason: 'invalid_token' });\n    }\n\n    const { user, roles } = await this.config.resolveUser(verified.payload);\n    setUser(user, roles);\n    await next();\n    return undefined;\n  }\n\n  private extractToken(c: RequestContext): string | null {\n    if (this.config.driver === 'cookie') {\n      return getCookie(c, this.config.cookieName) ?? null;\n    }\n\n    const authHeader = c.req.header('Authorization');\n    if (!authHeader?.startsWith('Bearer ')) {\n      return null;\n    }\n    return authHeader.slice(7);\n  }\n}\n"],"x_google_ignoreList":[3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32],"mappings":";;;;AAIA,MAAMC,aAAiD,EACrDC,gBAAgB,+CAClB;AAEA,MAAaC,qBAAqBH,YAChC,uBACCI,QAA0CH,WAASG,IAAIC,QAAO;;;;;;;;;;;;ACEjE,IAAaK,YAAb,MAAaA;;;IAMX,IAAIC,SAAiB;EACnB,MAAMA,SAAS,KAAKC,IAAIC,UAAU,aAAA;AAClC,MAAI,CAACF,OACH,OAAM,IAAIF,mBAAmB,EAAEK,QAAQ,kBAAiB,CAAA;AAE1D,SAAOH;;CAGT,IAAII,YAAoB;AACtB,SAAO;;CAGT,IAAIC,SAAoB;AACtB,SAAO;;CAGT,IAAIC,aAAqB;AACvB,SAAO;;CAGT,IAAIC,cAAmE;AACrE,SAAO,OAAOC,aAAa;GACzBC,MAAMD,QAAQE;GACdC,OAAO,EAAE;GACX;;CA7BF,YAAY,MAAyBd,OAAOD,IAAI,EAAE;OAAnBK,MAAAA;;;;;;;;;;ACTjC,MAAMY,WAA+C;CACnDC,eAAe;CACfC,eAAe;CACfC,SAAS;CACX;AAEA,MAAaC,wBAAwBL,oBACnC,yBACA,MACCM,QAAwCL,SAASK,IAAIC,SACtD,EACEC,gBAAgBF,KAAKG,QAAQC,YAC3BC,SAASC,KACP;CAAEC,MAAM;CAAgBN,QAAQD,IAAIC;CAAQG;CAAQ,EACpD;CAAED;CAAQK,SAAS,EAAE,oBAAoB,UAAS;CAAE,CAAA,EAE1D,CAAA;;;ACpBF,MAAaC,UAAU,IAAIC,aAAAA;AAC3B,MAAaC,UAAU,IAAIC,aAAAA;AAE3B,SAAgBE,OAAO,GAAGC,SAAO;CAC7B,MAAMC,OAAOD,QAAQE,QAAQC,KAAK,EAAEC,aAAaD,MAAMC,QAAQ,EAAA;CAC/D,MAAMC,MAAM,IAAIC,WAAWL,KAAAA;CAC3B,IAAIM,IAAI;AACR,MAAK,MAAMC,UAAUR,SAAS;AAC1BK,MAAII,IAAID,QAAQD,EAAAA;AAChBA,OAAKC,OAAOJ;;AAEhB,QAAOC;;;;ACXX,SAAgBe,aAAaC,OAAK;AAC9B,KAAIC,WAAWC,UAAUC,SACrB,QAAOH,MAAMG,UAAQ;CAEzB,MAAMC,aAAa;CACnB,MAAMC,MAAM,EAAE;AACd,MAAK,IAAIC,IAAI,GAAGA,IAAIN,MAAMO,QAAQD,KAAKF,WACnCC,KAAIG,KAAKC,OAAOC,aAAaC,MAAM,MAAMX,MAAMY,SAASN,GAAGA,IAAIF,WAAAA,CAAAA,CAAAA;AAEnE,QAAOS,KAAKR,IAAIS,KAAK,GAAA,CAAA;;AAEzB,SAAgBC,aAAaC,SAAO;AAChC,KAAIf,WAAWgB,WACX,QAAOhB,WAAWgB,WAAWD,QAAAA;CAEjC,MAAME,SAASC,KAAKH,QAAAA;CACpB,MAAMI,QAAQ,IAAInB,WAAWiB,OAAOX,OAAM;AAC1C,MAAK,IAAID,IAAI,GAAGA,IAAIY,OAAOX,QAAQD,IAC/Bc,OAAMd,KAAKY,OAAOG,WAAWf,EAAAA;AAEjC,QAAOc;;;;AClBX,SAAgBM,OAAOC,OAAK;AACxB,KAAIC,WAAWC,WACX,QAAOD,WAAWC,WAAW,OAAOF,UAAU,WAAWA,QAAQJ,QAAQG,OAAOC,MAAAA,EAAQ,EACpFG,UAAU,aACd,CAAA;CAEJ,IAAIC,UAAUJ;AACd,KAAII,mBAAmBH,WACnBG,WAAUR,QAAQG,OAAOK,QAAAA;AAE7BA,WAAUA,QAAQC,QAAQ,MAAM,IAAA,CAAKA,QAAQ,MAAM,IAAA,CAAKA,QAAQ,OAAO,GAAA;AACvE,KAAI;AACA,SAAOP,aAAaM,QAAAA;SAElB;AACF,QAAM,IAAIE,UAAU,oDAAA;;;AAG5B,SAAgBC,OAAOP,OAAK;CACxB,IAAIQ,YAAYR;AAChB,KAAI,OAAOQ,cAAc,SACrBA,aAAYb,QAAQY,OAAOC,UAAAA;AAE/B,KAAIP,WAAWQ,UAAUC,SACrB,QAAOF,UAAUE,SAAS;EAAEP,UAAU;EAAaQ,aAAa;EAAK,CAAA;AAEzE,QAAOd,aAAaW,UAAAA,CAAWH,QAAQ,MAAM,GAAA,CAAIA,QAAQ,OAAO,IAAA,CAAKA,QAAQ,OAAO,IAAA;;;;AC5BxF,IAAaO,YAAb,cAA+BC,MAAAA;CAG3B,YAAYC,SAASC,SAAS;AAC1B,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;AAGH,OAAKC,OAAO,KAAK,YAAYA;AAC7BJ,QAAMK,oBAAoB,MAAM,KAAK,YAAW;;;AAN3CN,UACFI,OAAO;AAQlB,IAAaG,2BAAb,cAA8CP,UAAAA;CAM1C,YAAYE,SAASM,SAASC,QAAQ,eAAeC,SAAS,eAAe;AACzE,QAAMR,SAAS,EAAES,OAAO;GAAEF;GAAOC;GAAQF;GAAQ,EAAE,CAAA,EAAA,KALvDJ,OAAO;AAMH,OAAKK,QAAQA;AACb,OAAKC,SAASA;AACd,OAAKF,UAAUA;;;AAVVD,yBACFH,OAAO;AAYlB,IAAaQ,aAAb,cAAgCZ,UAAAA;CAM5B,YAAYE,SAASM,SAASC,QAAQ,eAAeC,SAAS,eAAe;AACzE,QAAMR,SAAS,EAAES,OAAO;GAAEF;GAAOC;GAAQF;GAAQ,EAAE,CAAA,EAAA,KALvDJ,OAAO;AAMH,OAAKK,QAAQA;AACb,OAAKC,SAASA;AACd,OAAKF,UAAUA;;;AAVVI,WACFR,OAAO;AAYlB,IAAaS,oBAAb,cAAuCb,UAAAA;;AAAhC,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFES,kBACFT,OAAO;AAGlB,IAAaU,mBAAb,cAAsCd,UAAAA;;AAA/B,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEU,iBACFV,OAAO;AAGlB,IAAaW,sBAAb,cAAyCf,UAAAA;CAGrC,YAAYE,UAAU,+BAA+BC,SAAS;AAC1D,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEW,oBACFX,OAAO;AAMlB,IAAaY,aAAb,cAAgChB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEY,WACFZ,OAAO;AAGlB,IAAaa,aAAb,cAAgCjB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEa,WACFb,OAAO;AAGlB,IAAac,aAAb,cAAgClB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEc,WACFd,OAAO;AAGlB,IAAae,aAAb,cAAgCnB,UAAAA;;AAAzB,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEe,WACFf,OAAO;AAGlB,IAAagB,cAAb,cAAiCpB,UAAAA;;AAA1B,QAAA,GAAA,KAAA,EAAA,KAEHI,OAAO;;;AAFEgB,YACFhB,OAAO;AAGlB,IAAaiB,oBAAb,cAAuCrB,UAAAA;CAGnC,YAAYE,UAAU,mDAAmDC,SAAS;AAC9E,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEiB,kBACFjB,OAAO;AAMlB,IAAakB,2BAAb,cAA8CtB,UAAAA;CAI1C,YAAYE,UAAU,wDAAwDC,SAAS;AACnF,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAHEkB,yBAEFlB,OAAO;AAMlB,IAAamB,cAAb,cAAiCvB,UAAAA;CAG7B,YAAYE,UAAU,qBAAqBC,SAAS;AAChD,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEmB,YACFnB,OAAO;AAMlB,IAAaoB,iCAAb,cAAoDxB,UAAAA;CAGhD,YAAYE,UAAU,iCAAiCC,SAAS;AAC5D,QAAMD,SAASC,QAAAA,EAAAA,KAFnBC,OAAO;;;AAFEoB,+BACFpB,OAAO;;;AC7FlB,SAASqB,SAASC,MAAMC,OAAO,kBAAgB;AAC3C,wBAAO,IAAIC,UAAU,kDAAkDD,KAAK,WAAWD,OAAM;;AAEjG,SAASG,YAAYC,WAAWJ,MAAI;AAChC,QAAOI,UAAUJ,SAASA;;AAE9B,SAASK,cAAcC,MAAI;AACvB,QAAOC,SAASD,KAAKN,KAAKQ,MAAM,EAAA,EAAI,GAAA;;AAExC,SAASC,cAAcC,KAAG;AACtB,SAAQA,KAAR;EACI,KAAK,QACD,QAAO;EACX,KAAK,QACD,QAAO;EACX,KAAK,QACD,QAAO;EACX,QACI,OAAM,IAAIC,MAAM,cAAA;;;AAG5B,SAASC,WAAWC,KAAKC,OAAK;AAC1B,KAAIA,SAAS,CAACD,IAAIE,OAAOC,SAASF,MAAAA,CAC9B,OAAM,IAAIZ,UAAU,sEAAsEY,MAAM,GAAE;;AAG1G,SAAgBG,kBAAkBJ,KAAKH,KAAKI,OAAK;AAC7C,SAAQJ,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACP,YAAYU,IAAIT,WAAW,OAAA,CAC5B,OAAML,SAAS,OAAA;GACnB,MAAMmB,WAAWX,SAASG,IAAIF,MAAM,EAAA,EAAI,GAAA;AAExC,OADeH,cAAcQ,IAAIT,UAAUE,KACvCa,KAAWD,SACX,OAAMnB,SAAS,OAAOmB,YAAY,iBAAA;AACtC;;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACf,YAAYU,IAAIT,WAAW,oBAAA,CAC5B,OAAML,SAAS,oBAAA;GACnB,MAAMmB,WAAWX,SAASG,IAAIF,MAAM,EAAA,EAAI,GAAA;AAExC,OADeH,cAAcQ,IAAIT,UAAUE,KACvCa,KAAWD,SACX,OAAMnB,SAAS,OAAOmB,YAAY,iBAAA;AACtC;;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACf,YAAYU,IAAIT,WAAW,UAAA,CAC5B,OAAML,SAAS,UAAA;GACnB,MAAMmB,WAAWX,SAASG,IAAIF,MAAM,EAAA,EAAI,GAAA;AAExC,OADeH,cAAcQ,IAAIT,UAAUE,KACvCa,KAAWD,SACX,OAAMnB,SAAS,OAAOmB,YAAY,iBAAA;AACtC;;EAEJ,KAAK;EACL,KAAK;AACD,OAAI,CAACf,YAAYU,IAAIT,WAAW,UAAA,CAC5B,OAAML,SAAS,UAAA;AACnB;EAEJ,KAAK;EACL,KAAK;EACL,KAAK,SAAS;AACV,OAAI,CAACI,YAAYU,IAAIT,WAAW,QAAA,CAC5B,OAAML,SAAS,QAAA;GACnB,MAAMmB,WAAWT,cAAcC,IAAAA;AAE/B,OADeG,IAAIT,UAAUgB,eACdF,SACX,OAAMnB,SAASmB,UAAU,uBAAA;AAC7B;;EAEJ,QACI,OAAM,IAAIhB,UAAU,4CAAA;;AAE5BU,YAAWC,KAAKC,MAAAA;;;;ACjFpB,SAASS,QAAQC,KAAKC,QAAQ,GAAGC,OAAK;AAClCA,SAAQA,MAAMC,OAAOC,QAAAA;AACrB,KAAIF,MAAMG,SAAS,GAAG;EAClB,MAAMC,OAAOJ,MAAMK,KAAG;AACtBP,SAAO,eAAeE,MAAMM,KAAK,KAAA,CAAM,OAAOF,KAAK;YAE9CJ,MAAMG,WAAW,EACtBL,QAAO,eAAeE,MAAM,GAAG,MAAMA,MAAM,GAAG;KAG9CF,QAAO,WAAWE,MAAM,GAAG;AAE/B,KAAID,UAAU,KACVD,QAAO,aAAaC;UAEf,OAAOA,WAAW,cAAcA,OAAOQ,KAC5CT,QAAO,sBAAsBC,OAAOQ;UAE/B,OAAOR,WAAW,YAAYA,UAAU;MACzCA,OAAO,aAAaQ,KACpBT,QAAO,4BAA4BC,OAAO,YAAYQ;;AAG9D,QAAOT;;AAEX,IAAA,8BAAgBC,QAAQ,GAAGC,UAAAA;AACvB,QAAOH,QAAQ,gBAAgBE,QAAAA,GAAWC,MAAAA;;AAE9C,SAAgBQ,QAAQC,KAAKV,QAAQ,GAAGC,OAAK;AACzC,QAAOH,QAAQ,eAAeY,IAAI,sBAAsBV,QAAAA,GAAWC,MAAAA;;;;ACxBvE,SAAgBY,YAAYD,KAAG;AAC3B,QAAOA,MAAMG,OAAOC,iBAAiB;;AAEzC,SAAgBC,YAAYL,KAAG;AAC3B,QAAOA,MAAMG,OAAOC,iBAAiB;;AAEzC,IAAA,wBAAgBJ,QAAAA;AACZ,QAAOC,YAAYD,IAAAA,IAAQK,YAAYL,IAAAA;;;;ACZ3C,IAAA,wBAAgB,GAAGM,YAAAA;CACf,MAAMC,UAAUD,QAAQE,OAAOC,QAAAA;AAC/B,KAAIF,QAAQG,WAAW,KAAKH,QAAQG,WAAW,EAC3C,QAAO;CAEX,IAAIC;AACJ,MAAK,MAAMC,UAAUL,SAAS;EAC1B,MAAMM,aAAaC,OAAOC,KAAKH,OAAAA;AAC/B,MAAI,CAACD,OAAOA,IAAIK,SAAS,GAAG;AACxBL,SAAM,IAAIM,IAAIJ,WAAAA;AACd;;AAEJ,OAAK,MAAMK,aAAaL,YAAY;AAChC,OAAIF,IAAIQ,IAAID,UAAAA,CACR,QAAO;AAEXP,OAAIS,IAAIF,UAAAA;;;AAGhB,QAAO;;;;ACnBX,SAASG,aAAaC,OAAK;AACvB,QAAO,OAAOA,UAAU,YAAYA,UAAU;;AAElD,IAAA,sBAAgBC,UAAAA;AACZ,KAAI,CAACF,aAAaE,MAAAA,IAAUC,OAAOC,UAAUC,SAASC,KAAKJ,MAAAA,KAAW,kBAClE,QAAO;AAEX,KAAIC,OAAOI,eAAeL,MAAAA,KAAW,KACjC,QAAO;CAEX,IAAIM,QAAQN;AACZ,QAAOC,OAAOI,eAAeC,MAAAA,KAAW,KACpCA,SAAQL,OAAOI,eAAeC,MAAAA;AAElC,QAAOL,OAAOI,eAAeL,MAAAA,KAAWM;;;;ACd5C,IAAA,6BAAgBC,KAAKC,QAAAA;AACjB,KAAID,IAAIE,WAAW,KAAA,IAASF,IAAIE,WAAW,KAAA,EAAO;EAC9C,MAAM,EAAEC,kBAAkBF,IAAIG;AAC9B,MAAI,OAAOD,kBAAkB,YAAYA,gBAAgB,KACrD,OAAM,IAAIE,UAAU,GAAGL,IAAI,uDAAsD;;;;;ACH7F,SAASO,cAAcC,KAAG;CACtB,IAAIC;CACJ,IAAIC;AACJ,SAAQF,IAAIG,KAAZ;EACI,KAAK;AACD,WAAQH,IAAII,KAAZ;IACI,KAAK;IACL,KAAK;IACL,KAAK;AACDH,iBAAY;MAAEI,MAAM;MAAWC,MAAM,OAAON,IAAII,IAAIG,MAAM,GAAC;MAAK;AAChEL,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAAqBC,MAAM,OAAON,IAAII,IAAIG,MAAM,GAAC;MAAK;AAC1EL,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY;MACRI,MAAM;MACNC,MAAM,OAAOG,SAAST,IAAII,IAAIG,MAAM,GAAC,EAAI,GAAA,IAAO;MACpD;AACAL,iBAAYF,IAAIQ,IAAI,CAAC,WAAW,YAAY,GAAG,CAAC,WAAW,UAAU;AACrE;IACJ,QACI,OAAM,IAAIV,iBAAiB,iEAAA;;AAEnC;EAEJ,KAAK;AACD,WAAQE,IAAII,KAAZ;IACI,KAAK;AACDH,iBAAY;MAAEI,MAAM;MAASK,YAAY;MAAQ;AACjDR,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAASK,YAAY;MAAQ;AACjDR,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAASK,YAAY;MAAQ;AACjDR,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY;MAAEI,MAAM;MAAQK,YAAYV,IAAIW;MAAI;AAChDT,iBAAYF,IAAIQ,IAAI,CAAC,aAAa,GAAG,EAAE;AACvC;IACJ,QACI,OAAM,IAAIV,iBAAiB,iEAAA;;AAEnC;EAEJ,KAAK;AACD,WAAQE,IAAII,KAAZ;IACI,KAAK;IACL,KAAK;AACDH,iBAAY,EAAEI,MAAM,WAAU;AAC9BH,iBAAYF,IAAIQ,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS;AACzC;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACDP,iBAAY,EAAEI,MAAML,IAAIW,KAAI;AAC5BT,iBAAYF,IAAIQ,IAAI,CAAC,aAAa,GAAG,EAAE;AACvC;IACJ,QACI,OAAM,IAAIV,iBAAiB,iEAAA;;AAEnC;EAEJ,QACI,OAAM,IAAIA,iBAAiB,gEAAA;;AAEnC,QAAO;EAAEG;EAAWC;EAAU;;AAElC,IAAA,sBAAe,OAAOF,QAAAA;AAClB,KAAI,CAACA,IAAII,IACL,OAAM,IAAIQ,UAAU,+DAAA;CAExB,MAAM,EAAEX,WAAWC,cAAcH,cAAcC,IAAAA;CAC/C,MAAMa,UAAU,EAAE,GAAGb,KAAI;AACzB,QAAOa,QAAQT;AACf,QAAOS,QAAQC;AACf,QAAOC,OAAOC,OAAOC,UAAU,OAAOJ,SAASZ,WAAWD,IAAIkB,QAAQlB,IAAIQ,IAAI,QAAQ,OAAOR,IAAImB,WAAWjB,UAAAA;;;;AC3FhH,IAAA,0BAAgBmB,KAAKC,mBAAmBC,kBAAkBC,iBAAiBC,eAAAA;AACvE,KAAIA,WAAWC,SAASC,KAAAA,KAAaH,iBAAiBE,SAASC,KAAAA,EAC3D,OAAM,IAAIN,IAAI,mEAAA;AAElB,KAAI,CAACG,mBAAmBA,gBAAgBE,SAASC,KAAAA,EAC7C,wBAAO,IAAIC,KAAAA;AAEf,KAAI,CAACC,MAAMC,QAAQN,gBAAgBE,KAAI,IACnCF,gBAAgBE,KAAKK,WAAW,KAChCP,gBAAgBE,KAAKM,MAAMC,UAAU,OAAOA,UAAU,YAAYA,MAAMF,WAAW,EAAA,CACnF,OAAM,IAAIV,IAAI,0FAAA;CAElB,IAAIa;AACJ,KAAIX,qBAAqBI,KAAAA,EACrBO,cAAa,IAAIC,IAAI,CAAA,GAAIC,OAAOC,QAAQd,iBAAAA,EAAAA,GAAsBD,kBAAkBe,SAAO,CAAG,CAAA;KAG1FH,cAAaZ;AAEjB,MAAK,MAAMgB,aAAad,gBAAgBE,MAAM;AAC1C,MAAI,CAACQ,WAAWK,IAAID,UAAAA,CAChB,OAAM,IAAIlB,iBAAiB,+BAA+BkB,UAAU,qBAAoB;AAE5F,MAAIb,WAAWa,eAAeX,KAAAA,EAC1B,OAAM,IAAIN,IAAI,+BAA+BiB,UAAU,cAAa;AAExE,MAAIJ,WAAWM,IAAIF,UAAAA,IAAcd,gBAAgBc,eAAeX,KAAAA,EAC5D,OAAM,IAAIN,IAAI,+BAA+BiB,UAAU,+BAA8B;;AAG7F,QAAO,IAAIV,IAAIJ,gBAAgBE,KAAI;;;;AC/BvC,IAAA,gCAAgBe,QAAQC,eAAAA;AACpB,KAAIA,eAAeC,KAAAA,MACd,CAACC,MAAMC,QAAQH,WAAAA,IAAeA,WAAWI,MAAMC,MAAM,OAAOA,MAAM,SAAQ,EAC3E,OAAM,IAAIC,UAAU,IAAIP,OAAO,sCAAqC;AAExE,KAAI,CAACC,WACD;AAEJ,QAAO,IAAIO,IAAIP,WAAAA;;;;ACPnB,SAAgBS,MAAMC,KAAG;AACrB,QAAOF,kBAASE,IAAAA,IAAQ,OAAOA,IAAIC,QAAQ;;AAE/C,SAAgBC,aAAaF,KAAG;AAC5B,QAAOA,IAAIC,QAAQ,SAAS,OAAOD,IAAIG,MAAM;;AAEjD,SAAgBC,YAAYJ,KAAG;AAC3B,QAAOA,IAAIC,QAAQ,SAAS,OAAOD,IAAIG,MAAM;;AAEjD,SAAgBE,YAAYL,KAAG;AAC3B,QAAOA,IAAIC,QAAQ,SAAS,OAAOD,IAAIM,MAAM;;;;ACPjD,IAAIM;AACJ,MAAMC,YAAY,OAAOC,KAAKC,KAAKC,KAAKC,SAAS,UAAK;AAClDL,WAAAA,wBAAU,IAAIM,SAAAA;CACd,IAAIC,SAASP,MAAMQ,IAAIN,IAAAA;AACvB,KAAIK,SAASH,KACT,QAAOG,OAAOH;CAElB,MAAMK,YAAY,MAAMZ,mBAAU;EAAE,GAAGM;EAAKC;EAAI,CAAA;AAChD,KAAIC,OACAK,QAAOL,OAAOH,IAAAA;AAClB,KAAI,CAACK,OACDP,OAAMW,IAAIT,KAAK,GAAGE,MAAMK,WAAU,CAAA;KAGlCF,QAAOH,OAAOK;AAElB,QAAOA;;AAEX,MAAMG,mBAAmBC,WAAWT,QAAAA;AAChCJ,WAAAA,wBAAU,IAAIM,SAAAA;CACd,IAAIC,SAASP,MAAMQ,IAAIK,UAAAA;AACvB,KAAIN,SAASH,KACT,QAAOG,OAAOH;CAElB,MAAMU,WAAWD,UAAUE,SAAS;CACpC,MAAMC,cAAcF,WAAW,OAAO;CACtC,IAAIL;AACJ,KAAII,UAAUI,sBAAsB,UAAU;AAC1C,UAAQb,KAAR;GACI,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,iBACD;GACJ,QACI,OAAM,IAAIc,UAAU,6DAAA;;AAE5BT,cAAYI,UAAUM,YAAYN,UAAUI,mBAAmBD,aAAaF,WAAW,EAAE,GAAG,CAAC,aAAa,CAAA;;AAE9G,KAAID,UAAUI,sBAAsB,WAAW;AAC3C,MAAIb,QAAQ,WAAWA,QAAQ,UAC3B,OAAM,IAAIc,UAAU,6DAAA;AAExBT,cAAYI,UAAUM,YAAYN,UAAUI,mBAAmBD,aAAa,CACxEF,WAAW,WAAW,OACzB,CAAA;;AAEL,KAAID,UAAUI,sBAAsB,OAAO;EACvC,IAAIG;AACJ,UAAQhB,KAAR;GACI,KAAK;AACDgB,WAAO;AACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;AACDA,WAAO;AACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;AACDA,WAAO;AACP;GACJ,KAAK;GACL,KAAK;GACL,KAAK;AACDA,WAAO;AACP;GACJ,QACI,OAAM,IAAIF,UAAU,6DAAA;;AAE5B,MAAId,IAAIiB,WAAW,WAAA,CACf,QAAOR,UAAUM,YAAY;GACzBG,MAAM;GACNF;GACJ,EAAGJ,aAAaF,WAAW,CAAC,UAAU,GAAG,CAAC,UAAU,CAAA;AAExDL,cAAYI,UAAUM,YAAY;GAC9BG,MAAMlB,IAAIiB,WAAW,KAAA,GAAQ,YAAY;GACzCD;GACJ,EAAGJ,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;;AAElD,KAAID,UAAUI,sBAAsB,MAAM;EAMtC,MAAMQ,aAAaF,IALFC,IAAI;GACjB,CAAC,cAAc,QAAQ;GACvB,CAAC,aAAa,QAAQ;GACtB,CAAC,aAAa,QAAQ;GACzB,CACkBD,CAAKf,IAAIK,UAAUa,sBAAsBD,WAAAA;AAC5D,MAAI,CAACA,WACD,OAAM,IAAIP,UAAU,6DAAA;AAExB,MAAId,QAAQ,WAAWqB,eAAe,QAClChB,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;AAElD,MAAIV,QAAQ,WAAWqB,eAAe,QAClChB,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;AAElD,MAAIV,QAAQ,WAAWqB,eAAe,QAClChB,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAa,CAACF,WAAW,WAAW,OAAO,CAAA;AAElD,MAAIV,IAAIiB,WAAW,UAAA,CACfZ,aAAYI,UAAUM,YAAY;GAC9BG,MAAM;GACNG;GACJ,EAAGT,aAAaF,WAAW,EAAE,GAAG,CAAC,aAAa,CAAA;;AAGtD,KAAI,CAACL,UACD,OAAM,IAAIS,UAAU,6DAAA;AAExB,KAAI,CAACX,OACDP,OAAMW,IAAIE,WAAW,GAAGT,MAAMK,WAAU,CAAA;KAGxCF,QAAOH,OAAOK;AAElB,QAAOA;;AAEX,IAAA,yBAAe,OAAOP,KAAKE,QAAAA;AACvB,KAAIF,eAAeyB,WACf,QAAOzB;AAEX,KAAIJ,YAAYI,IAAAA,CACZ,QAAOA;AAEX,KAAIH,YAAYG,IAAAA,EAAM;AAClB,MAAIA,IAAIa,SAAS,SACb,QAAOb,IAAI0B,QAAM;AAErB,MAAI,iBAAiB1B,OAAO,OAAOA,IAAIiB,gBAAgB,WACnD,KAAI;AACA,UAAOP,gBAAgBV,KAAKE,IAAAA;WAEzByB,KAAK;AACR,OAAIA,eAAeX,UACf,OAAMW;;AAKlB,SAAO5B,UAAUC,KADPA,IAAI0B,OAAO,EAAEE,QAAQ,OAAM,CACf3B,EAAKC,IAAAA;;AAE/B,KAAIT,MAAMO,IAAAA,EAAM;AACZ,MAAIA,IAAI6B,EACJ,QAAOnC,OAAOM,IAAI6B,EAAC;AAEvB,SAAO9B,UAAUC,KAAKA,KAAKE,KAAK,KAAA;;AAEpC,OAAM,IAAI4B,MAAM,cAAA;;;;AC/JpB,MAAMK,OAAOC,QAAQA,MAAMC,OAAOC;AAClC,MAAMC,gBAAgBC,KAAKJ,KAAKK,UAAAA;AAC5B,KAAIL,IAAIM,QAAQC,KAAAA,GAAW;EACvB,IAAIC;AACJ,UAAQH,OAAR;GACI,KAAK;GACL,KAAK;AACDG,eAAW;AACX;GACJ,KAAK;GACL,KAAK;AACDA,eAAW;AACX;;AAER,MAAIR,IAAIM,QAAQE,SACZ,OAAM,IAAIC,UAAU,sDAAsDD,SAAS,gBAAe;;AAG1G,KAAIR,IAAII,QAAQG,KAAAA,KAAaP,IAAII,QAAQA,IACrC,OAAM,IAAIK,UAAU,sDAAsDL,IAAI,gBAAe;AAEjG,KAAIM,MAAMC,QAAQX,IAAIY,QAAO,EAAG;EAC5B,IAAIC;AACJ,UAAQ,MAAR;GACI,KAAKR,UAAU,UAAUA,UAAU;GACnC,KAAKD,QAAQ;GACb,KAAKA,IAAIU,SAAS,SAAA;AACdD,oBAAgBR;AAChB;GACJ,KAAKD,IAAIW,WAAW,QAAA;AAChBF,oBAAgB;AAChB;GACJ,KAAK,0BAA0BG,KAAKZ,IAAAA;AAChC,QAAI,CAACA,IAAIU,SAAS,MAAA,IAAUV,IAAIa,SAAS,KAAA,CACrCJ,iBAAgBR,UAAU,YAAY,YAAY;QAGlDQ,iBAAgBR;AAEpB;GACJ,KAAKA,UAAU,aAAaD,IAAIW,WAAW,MAAA;AACvCF,oBAAgB;AAChB;GACJ,KAAKR,UAAU;AACXQ,oBAAgBT,IAAIW,WAAW,MAAA,GAAS,cAAc;AACtD;;AAER,MAAIF,iBAAiBb,IAAIY,SAASE,WAAWD,cAAAA,KAAmB,MAC5D,OAAM,IAAIJ,UAAU,+DAA+DI,cAAc,gBAAe;;AAGxH,QAAO;;AAEX,MAAMK,sBAAsBd,KAAKJ,KAAKK,UAAAA;AAClC,KAAIL,eAAemB,WACf;AACJ,KAAIrB,MAAUE,IAAAA,EAAM;AAChB,MAAIF,YAAgBE,IAAAA,IAAQG,aAAaC,KAAKJ,KAAKK,MAAAA,CAC/C;AACJ,QAAM,IAAII,UAAU,0HAAyH;;AAEjJ,KAAI,CAACZ,oBAAUG,IAAAA,CACX,OAAM,IAAIS,UAAUb,QAAgBQ,KAAKJ,KAAK,aAAa,aAAa,gBAAgB,aAAA,CAAA;AAE5F,KAAIA,IAAIsB,SAAS,SACb,OAAM,IAAIb,UAAU,GAAGV,IAAIC,IAAAA,CAAK,8DAA6D;;AAGrG,MAAMuB,uBAAuBnB,KAAKJ,KAAKK,UAAAA;AACnC,KAAIP,MAAUE,IAAAA,CACV,SAAQK,OAAR;EACI,KAAK;EACL,KAAK;AACD,OAAIP,aAAiBE,IAAAA,IAAQG,aAAaC,KAAKJ,KAAKK,MAAAA,CAChD;AACJ,SAAM,IAAII,UAAU,mDAAkD;EAC1E,KAAK;EACL,KAAK;AACD,OAAIX,YAAgBE,IAAAA,IAAQG,aAAaC,KAAKJ,KAAKK,MAAAA,CAC/C;AACJ,SAAM,IAAII,UAAU,kDAAiD;;AAGjF,KAAI,CAACZ,oBAAUG,IAAAA,CACX,OAAM,IAAIS,UAAUb,QAAgBQ,KAAKJ,KAAK,aAAa,aAAa,eAAA,CAAA;AAE5E,KAAIA,IAAIsB,SAAS,SACb,OAAM,IAAIb,UAAU,GAAGV,IAAIC,IAAAA,CAAK,mEAAkE;AAEtG,KAAIA,IAAIsB,SAAS,SACb,SAAQjB,OAAR;EACI,KAAK,OACD,OAAM,IAAII,UAAU,GAAGV,IAAIC,IAAAA,CAAK,uEAAsE;EAC1G,KAAK,UACD,OAAM,IAAIS,UAAU,GAAGV,IAAIC,IAAAA,CAAK,0EAAyE;EAC7G,QACI;;AAGZ,KAAIA,IAAIsB,SAAS,UACb,SAAQjB,OAAR;EACI,KAAK,SACD,OAAM,IAAII,UAAU,GAAGV,IAAIC,IAAAA,CAAK,wEAAuE;EAC3G,KAAK,UACD,OAAM,IAAIS,UAAU,GAAGV,IAAIC,IAAAA,CAAK,yEAAwE;EAC5G,QACI;;;AAIhB,IAAA,2BAAgBI,KAAKJ,KAAKK,UAAAA;AAMtB,KALkBD,IAAIW,WAAW,KAAA,IAC7BX,QAAQ,SACRA,IAAIW,WAAW,QAAA,IACf,oCAAoCC,KAAKZ,IAAAA,IACzC,0CAA0CY,KAAKZ,IAAAA,CAE/Cc,oBAAmBd,KAAKJ,KAAKK,MAAAA;KAG7BkB,qBAAoBnB,KAAKJ,KAAKK,MAAAA;;;;AC1HtC,IAAA,uBAAgBuB,KAAKC,cAAAA;CACjB,MAAMC,OAAO,OAAOF,IAAIG,MAAM,GAAC;AAC/B,SAAQH,KAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAEE;GAAME,MAAM;GAAO;EAChC,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAEF;GAAME,MAAM;GAAWC,YAAYC,SAASN,IAAIG,MAAM,GAAC,EAAI,GAAA,IAAO;GAAE;EACjF,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAED;GAAME,MAAM;GAAoB;EAC7C,KAAK;EACL,KAAK;EACL,KAAK,QACD,QAAO;GAAEF;GAAME,MAAM;GAASG,YAAYN,UAAUM;GAAW;EACnE,KAAK;EACL,KAAK,QACD,QAAO,EAAEH,MAAM,WAAU;EAC7B,QACI,OAAM,IAAIL,iBAAiB,OAAOC,IAAI,6DAA4D;;;;;ACtB9G,IAAA,+BAAe,OAAOU,KAAKC,KAAKC,UAAAA;AAC5B,KAAID,eAAeE,YAAY;AAC3B,MAAI,CAACH,IAAII,WAAW,KAAA,CAChB,OAAM,IAAIC,UAAUN,0BAAgBE,KAAK,aAAa,aAAa,eAAA,CAAA;AAEvE,SAAOK,OAAOC,OAAOC,UAAU,OAAOP,KAAK;GAAEQ,MAAM,OAAOT,IAAIU,MAAM,GAAC;GAAMC,MAAM;GAAO,EAAG,OAAO,CAACT,MAAM,CAAA;;AAE7GJ,mBAAkBG,KAAKD,KAAKE,MAAAA;AAC5B,QAAOD;;;;ACPX,IAAA,kBAAe,OAAOc,KAAKC,KAAKC,WAAWC,SAAAA;CACvC,MAAMC,YAAY,MAAML,4BAAaC,KAAKC,KAAK,SAAA;AAC/CH,0BAAeE,KAAKI,UAAAA;CACpB,MAAMC,YAAYR,mBAAgBG,KAAKI,UAAUC,UAAS;AAC1D,KAAI;AACA,SAAO,MAAMC,OAAOC,OAAOC,OAAOH,WAAWD,WAAWF,WAAWC,KAAAA;SAEjE;AACF,SAAO;;;;;ACDf,eAAsBqB,gBAAgBC,KAAKC,KAAKC,SAAO;AACnD,KAAI,CAACR,kBAASM,IAAAA,CACV,OAAM,IAAIZ,WAAW,kCAAA;AAEzB,KAAIY,IAAIG,cAAcC,KAAAA,KAAaJ,IAAIK,WAAWD,KAAAA,EAC9C,OAAM,IAAIhB,WAAW,4EAAA;AAEzB,KAAIY,IAAIG,cAAcC,KAAAA,KAAa,OAAOJ,IAAIG,cAAc,SACxD,OAAM,IAAIf,WAAW,sCAAA;AAEzB,KAAIY,IAAIM,YAAYF,KAAAA,EAChB,OAAM,IAAIhB,WAAW,sBAAA;AAEzB,KAAI,OAAOY,IAAIO,cAAc,SACzB,OAAM,IAAInB,WAAW,0CAAA;AAEzB,KAAIY,IAAIK,WAAWD,KAAAA,KAAa,CAACV,kBAASM,IAAIK,OAAM,CAChD,OAAM,IAAIjB,WAAW,wCAAA;CAEzB,IAAIoB,aAAa,EAAC;AAClB,KAAIR,IAAIG,UACJ,KAAI;EACA,MAAMM,kBAAkBxB,OAAKe,IAAIG,UAAS;AAC1CK,eAAaE,KAAKC,MAAMnB,QAAQR,OAAOyB,gBAAAA,CAAAA;SAErC;AACF,QAAM,IAAIrB,WAAW,kCAAA;;AAG7B,KAAI,CAACK,oBAAWe,YAAYR,IAAIK,OAAM,CAClC,OAAM,IAAIjB,WAAW,4EAAA;CAEzB,MAAMwB,aAAa;EACf,GAAGJ;EACH,GAAGR,IAAIK;EACX;CACA,MAAMQ,aAAajB,sBAAaR,YAAY,IAAI0B,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAA,EAAGZ,SAASa,MAAMP,YAAYI,WAAAA;CACjG,IAAII,MAAM;AACV,KAAIH,WAAWI,IAAI,MAAA,EAAQ;AACvBD,QAAMR,WAAWQ;AACjB,MAAI,OAAOA,QAAQ,UACf,OAAM,IAAI5B,WAAW,4EAAA;;CAG7B,MAAM,EAAE8B,QAAQN;AAChB,KAAI,OAAOM,QAAQ,YAAY,CAACA,IAC5B,OAAM,IAAI9B,WAAW,8DAAA;CAEzB,MAAM+B,aAAajB,WAAWL,4BAAmB,cAAcK,QAAQiB,WAAU;AACjF,KAAIA,cAAc,CAACA,WAAWF,IAAIC,IAAAA,CAC9B,OAAM,IAAI/B,kBAAkB,yDAAA;AAEhC,KAAI6B;MACI,OAAOhB,IAAIM,YAAY,SACvB,OAAM,IAAIlB,WAAW,+BAAA;YAGpB,OAAOY,IAAIM,YAAY,YAAY,EAAEN,IAAIM,mBAAmBc,YACjE,OAAM,IAAIhC,WAAW,yDAAA;CAEzB,IAAIiC,cAAc;AAClB,KAAI,OAAOpB,QAAQ,YAAY;AAC3BA,QAAM,MAAMA,IAAIO,YAAYR,IAAAA;AAC5BqB,gBAAc;;AAElB1B,wBAAauB,KAAKjB,KAAK,SAAA;CACvB,MAAMqB,OAAOhC,OAAOC,QAAQgC,OAAOvB,IAAIG,aAAa,GAAA,EAAKZ,QAAQgC,OAAO,IAAA,EAAM,OAAOvB,IAAIM,YAAY,WAAWf,QAAQgC,OAAOvB,IAAIM,QAAO,GAAIN,IAAIM,QAAO;CACzJ,IAAIC;AACJ,KAAI;AACAA,cAAYtB,OAAKe,IAAIO,UAAS;SAE5B;AACF,QAAM,IAAInB,WAAW,2CAAA;;CAEzB,MAAMoC,IAAI,MAAM1B,sBAAaG,KAAKiB,IAAAA;AAElC,KAAI,CAACO,MADkBvC,eAAOgC,KAAKM,GAAGjB,WAAWe,KAAAA,CAE7C,OAAM,IAAIjC,gCAAAA;CAEd,IAAIiB;AACJ,KAAIU,IACA,KAAI;AACAV,YAAUrB,OAAKe,IAAIM,QAAO;SAExB;AACF,QAAM,IAAIlB,WAAW,yCAAA;;UAGpB,OAAOY,IAAIM,YAAY,SAC5BA,WAAUf,QAAQgC,OAAOvB,IAAIM,QAAO;KAGpCA,WAAUN,IAAIM;CAElB,MAAMoB,SAAS,EAAEpB,SAAQ;AACzB,KAAIN,IAAIG,cAAcC,KAAAA,EAClBsB,QAAOjB,kBAAkBD;AAE7B,KAAIR,IAAIK,WAAWD,KAAAA,EACfsB,QAAOC,oBAAoB3B,IAAIK;AAEnC,KAAIgB,YACA,QAAO;EAAE,GAAGK;EAAQzB,KAAKuB;EAAE;AAE/B,QAAOE;;;;AC/GX,eAAsBK,cAAcC,KAAKC,KAAKC,SAAO;AACjD,KAAIF,eAAeG,WACfH,OAAMF,QAAQM,OAAOJ,IAAAA;AAEzB,KAAI,OAAOA,QAAQ,SACf,OAAM,IAAIH,WAAW,6CAAA;CAEzB,MAAM,EAAE,GAAGQ,iBAAiB,GAAGC,SAAS,GAAGC,WAAWC,WAAWR,IAAIS,MAAM,IAAA;AAC3E,KAAID,WAAW,EACX,OAAM,IAAIX,WAAW,sBAAA;CAEzB,MAAMa,WAAW,MAAMd,gBAAgB;EAAEU;EAASK,WAAWN;EAAiBE;EAAU,EAAGN,KAAKC,QAAAA;CAChG,MAAMU,SAAS;EAAEN,SAASI,SAASJ;EAASD,iBAAiBK,SAASL;EAAgB;AACtF,KAAI,OAAOJ,QAAQ,WACf,QAAO;EAAE,GAAGW;EAAQX,KAAKS,SAAST;EAAI;AAE1C,QAAOW;;;;ACnBX,IAAA,kBAAgBC,SAASC,KAAKC,MAAMF,KAAKG,SAAO,GAAK,IAAI;;;ACAzD,MAAMC,SAAS;AACf,MAAMC,OAAOD,SAAS;AACtB,MAAME,MAAMD,OAAO;AACnB,MAAME,OAAOD,MAAM;AACnB,MAAME,OAAOF,MAAM;AACnB,MAAMG,QAAQ;AACd,IAAA,iBAAgBC,QAAAA;CACZ,MAAMC,UAAUF,MAAMG,KAAKF,IAAAA;AAC3B,KAAI,CAACC,WAAYA,QAAQ,MAAMA,QAAQ,GACnC,OAAM,IAAIE,UAAU,6BAAA;CAExB,MAAMC,QAAQC,WAAWJ,QAAQ,GAAE;CACnC,MAAMK,OAAOL,QAAQ,GAAGM,aAAW;CACnC,IAAIC;AACJ,SAAQF,MAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACDE,iBAAcC,KAAKC,MAAMN,MAAAA;AACzB;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACDI,iBAAcC,KAAKC,MAAMN,QAAQV,OAAAA;AACjC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACDc,iBAAcC,KAAKC,MAAMN,QAAQT,KAAAA;AACjC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;AACDa,iBAAcC,KAAKC,MAAMN,QAAQR,IAAAA;AACjC;EACJ,KAAK;EACL,KAAK;EACL,KAAK;AACDY,iBAAcC,KAAKC,MAAMN,QAAQP,KAAAA;AACjC;EACJ;AACIW,iBAAcC,KAAKC,MAAMN,QAAQN,KAAAA;AACjC;;AAER,KAAIG,QAAQ,OAAO,OAAOA,QAAQ,OAAO,MACrC,QAAO,CAACO;AAEZ,QAAOA;;;;;;;;;;;;AC/CX,SAASW,cAAcC,OAAOC,OAAK;AAC/B,KAAI,CAACC,OAAOC,SAASF,MAAAA,CACjB,OAAM,IAAIG,UAAU,WAAWJ,MAAM,QAAO;AAEhD,QAAOC;;AAEX,MAAMI,gBAAgBC,UAAAA;AAClB,KAAIA,MAAMC,SAAS,IAAA,CACf,QAAOD,MAAME,aAAW;AAE5B,QAAO,eAAeF,MAAME,aAAW;;AAE3C,MAAMC,yBAAyBC,YAAYC,cAAAA;AACvC,KAAI,OAAOD,eAAe,SACtB,QAAOC,UAAUJ,SAASG,WAAAA;AAE9B,KAAIE,MAAMC,QAAQH,WAAAA,CACd,QAAOC,UAAUG,KAAKC,IAAIC,UAAUC,IAAIC,KAAK,IAAIH,IAAIL,WAAAA,CAAAA,CAAAA;AAEzD,QAAO;;AAEX,SAAgBS,kBAAkBC,iBAAiBC,gBAAgBC,UAAU,EAAE,EAAA;CAC3E,IAAIC;AACJ,KAAI;AACAA,YAAUC,KAAKC,MAAM/B,QAAQgC,OAAOL,eAAAA,CAAAA;SAElC;AAEN,KAAI,CAACxB,kBAAS0B,QAAAA,CACV,OAAM,IAAI9B,WAAW,iDAAA;CAEzB,MAAM,EAAEkC,QAAQL;AAChB,KAAIK,QACC,OAAOP,gBAAgBO,QAAQ,YAC5BtB,aAAae,gBAAgBO,IAAG,KAAMtB,aAAasB,IAAG,EAC1D,OAAM,IAAIpC,yBAAyB,uCAAqCgC,SAAS,OAAO,eAAA;CAE5F,MAAM,EAAEK,iBAAiB,EAAE,EAAEC,QAAQC,SAASC,UAAUC,gBAAgBV;CACxE,MAAMW,gBAAgB,CAAA,GAAIL,eAAe;AACzC,KAAII,gBAAgBE,KAAAA,EAChBD,eAAcE,KAAK,MAAA;AACvB,KAAIJ,aAAaG,KAAAA,EACbD,eAAcE,KAAK,MAAA;AACvB,KAAIL,YAAYI,KAAAA,EACZD,eAAcE,KAAK,MAAA;AACvB,KAAIN,WAAWK,KAAAA,EACXD,eAAcE,KAAK,MAAA;AACvB,MAAK,MAAMC,SAAS,IAAIrB,IAAIkB,cAAcI,SAAO,CAAA,CAC7C,KAAI,EAAED,SAASb,SACX,OAAM,IAAIhC,yBAAyB,qBAAqB6C,MAAM,UAAUb,SAASa,OAAO,UAAA;AAGhG,KAAIP,UACA,EAAEjB,MAAMC,QAAQgB,OAAAA,GAAUA,SAAS,CAACA,OAAO,EAAEtB,SAASgB,QAAQe,IAAG,CACjE,OAAM,IAAI/C,yBAAyB,kCAAgCgC,SAAS,OAAO,eAAA;AAEvF,KAAIO,WAAWP,QAAQgB,QAAQT,QAC3B,OAAM,IAAIvC,yBAAyB,kCAAgCgC,SAAS,OAAO,eAAA;AAEvF,KAAIQ,YACA,CAACtB,sBAAsBc,QAAQiB,KAAK,OAAOT,aAAa,WAAW,CAACA,SAAS,GAAGA,SAAAA,CAChF,OAAM,IAAIxC,yBAAyB,kCAAgCgC,SAAS,OAAO,eAAA;CAEvF,IAAIkB;AACJ,SAAQ,OAAOnB,QAAQoB,gBAAvB;EACI,KAAK;AACDD,eAAY7C,aAAK0B,QAAQoB,eAAc;AACvC;EACJ,KAAK;AACDD,eAAYnB,QAAQoB;AACpB;EACJ,KAAK;AACDD,eAAY;AACZ;EACJ,QACI,OAAM,IAAIrC,UAAU,qCAAA;;CAE5B,MAAM,EAAEuC,gBAAgBrB;CACxB,MAAMsB,MAAMjD,cAAMgD,+BAAe,IAAIE,MAAAA,CAAAA;AACrC,MAAKtB,QAAQuB,QAAQZ,KAAAA,KAAaF,gBAAgB,OAAOT,QAAQuB,QAAQ,SACrE,OAAM,IAAIvD,yBAAyB,kCAAgCgC,SAAS,OAAO,UAAA;AAEvF,KAAIA,QAAQwB,QAAQb,KAAAA,GAAW;AAC3B,MAAI,OAAOX,QAAQwB,QAAQ,SACvB,OAAM,IAAIxD,yBAAyB,kCAAgCgC,SAAS,OAAO,UAAA;AAEvF,MAAIA,QAAQwB,MAAMH,MAAMH,UACpB,OAAM,IAAIlD,yBAAyB,wCAAsCgC,SAAS,OAAO,eAAA;;AAGjG,KAAIA,QAAQyB,QAAQd,KAAAA,GAAW;AAC3B,MAAI,OAAOX,QAAQyB,QAAQ,SACvB,OAAM,IAAIzD,yBAAyB,kCAAgCgC,SAAS,OAAO,UAAA;AAEvF,MAAIA,QAAQyB,OAAOJ,MAAMH,UACrB,OAAM,IAAIjD,WAAW,wCAAsC+B,SAAS,OAAO,eAAA;;AAGnF,KAAIS,aAAa;EACb,MAAMiB,MAAML,MAAMrB,QAAQuB;EAC1B,MAAMI,MAAM,OAAOlB,gBAAgB,WAAWA,cAAcpC,aAAKoC,YAAAA;AACjE,MAAIiB,MAAMR,YAAYS,IAClB,OAAM,IAAI1D,WAAW,8DAA4D+B,SAAS,OAAO,eAAA;AAErG,MAAI0B,MAAM,IAAIR,UACV,OAAM,IAAIlD,yBAAyB,mEAAiEgC,SAAS,OAAO,eAAA;;AAG5H,QAAOA;;IAGP,aAAA,iDAAA,WAAA;AADJ,IAAa4B,mBAAb,MAAaA;CAQTC,OAAO;AACH,SAAOtD,QAAQuD,OAAO7B,KAAK8B,UAAU,kCAAA,MAAK,WAAA,CAAA,YAAA,CAAA;;CAE9C,IAAIhB,MAAM;AACN,SAAO,kCAAA,MAAK,WAAA,CAAA,YAASA;;CAEzB,IAAIA,IAAIhC,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASgC,MAAMhC;;CAExB,IAAIiC,MAAM;AACN,SAAO,kCAAA,MAAK,WAAA,CAAA,YAASA;;CAEzB,IAAIA,IAAIjC,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASiC,MAAMjC;;CAExB,IAAIkC,MAAM;AACN,SAAO,kCAAA,MAAK,WAAA,CAAA,YAASA;;CAEzB,IAAIA,IAAIlC,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASkC,MAAMlC;;CAExB,IAAIiD,IAAIjD,OAAO;AACX,oCAAA,MAAK,WAAA,CAAA,YAASiD,MAAMjD;;CAExB,IAAIyC,IAAIzC,OAAO;AACX,MAAI,OAAOA,UAAU,SACjB,mCAAA,MAAK,WAAA,CAAA,YAASyC,MAAMhD,cAAc,gBAAgBO,MAAAA;WAE7CA,iBAAiBuC,KACtB,mCAAA,MAAK,WAAA,CAAA,YAASE,MAAMhD,cAAc,gBAAgBJ,cAAMW,MAAAA,CAAAA;MAGxD,mCAAA,MAAK,WAAA,CAAA,YAASyC,MAAMpD,8BAAM,IAAIkD,MAAAA,CAAAA,GAAUjD,aAAKU,MAAAA;;CAGrD,IAAI0C,IAAI1C,OAAO;AACX,MAAI,OAAOA,UAAU,SACjB,mCAAA,MAAK,WAAA,CAAA,YAAS0C,MAAMjD,cAAc,qBAAqBO,MAAAA;WAElDA,iBAAiBuC,KACtB,mCAAA,MAAK,WAAA,CAAA,YAASG,MAAMjD,cAAc,qBAAqBJ,cAAMW,MAAAA,CAAAA;MAG7D,mCAAA,MAAK,WAAA,CAAA,YAAS0C,MAAMrD,8BAAM,IAAIkD,MAAAA,CAAAA,GAAUjD,aAAKU,MAAAA;;CAGrD,IAAIwC,IAAIxC,OAAO;AACX,MAAI,OAAOA,UAAU,YACjB,mCAAA,MAAK,WAAA,CAAA,YAASwC,MAAMnD,8BAAM,IAAIkD,MAAAA,CAAAA;WAEzBvC,iBAAiBuC,KACtB,mCAAA,MAAK,WAAA,CAAA,YAASC,MAAM/C,cAAc,eAAeJ,cAAMW,MAAAA,CAAAA;WAElD,OAAOA,UAAU,SACtB,mCAAA,MAAK,WAAA,CAAA,YAASwC,MAAM/C,cAAc,eAAeJ,8BAAM,IAAIkD,MAAAA,CAAAA,GAAUjD,aAAKU,MAAAA,CAAAA;MAG1E,mCAAA,MAAK,WAAA,CAAA,YAASwC,MAAM/C,cAAc,eAAeO,MAAAA;;CA/DzD,YAAYiB,SAAS;AADrB,SAAA,eAAA,MAAA,YAAA;;UAAA,KAAA;;AAEI,MAAI,CAAC1B,kBAAS0B,QAAAA,CACV,OAAM,IAAInB,UAAU,mCAAA;AAExB,oCAAA,MAAK,WAAA,CAAA,cAAWoD,gBAAgBjC,QAAAA;;;;;ACvHxC,eAAsBqC,UAAUC,KAAKC,KAAKC,SAAO;CAC7C,MAAMC,WAAW,MAAMP,cAAcI,KAAKC,KAAKC,QAAAA;AAC/C,KAAIC,SAASC,gBAAgBC,MAAMC,SAAS,MAAA,IAAUH,SAASC,gBAAgBG,QAAQ,MACnF,OAAM,IAAIT,WAAW,sCAAA;CAGzB,MAAMW,SAAS;EAAED,SADDX,kBAAkBM,SAASC,iBAAiBD,SAASK,SAASN,QAC7DM;EAASJ,iBAAiBD,SAASC;EAAgB;AACpE,KAAI,OAAOH,QAAQ,WACf,QAAO;EAAE,GAAGQ;EAAQR,KAAKE,SAASF;EAAI;AAE1C,QAAOQ;;;;ACVX,IAAA,gBAAe,OAAOI,KAAKC,KAAKC,SAAAA;CAC5B,MAAMC,YAAY,MAAMJ,4BAAWC,KAAKC,KAAK,OAAA;AAC7CH,0BAAeE,KAAKG,UAAAA;CACpB,MAAMC,YAAY,MAAMC,OAAOC,OAAOC,KAAKV,mBAAgBG,KAAKG,UAAUK,UAAS,EAAGL,WAAWD,KAAAA;AACjG,QAAO,IAAIO,WAAWL,UAAAA;;;;;;;;;;;;ICEtB,WAAA,iDAAA,WAAA,EACA,qBAAA,iDAAA,mBAAA,EACA,qBAAA,iDAAA,qBAAA;AAHJ,IAAaiB,gBAAb,MAAaA;CAUTC,mBAAmBC,iBAAiB;AAChC,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACL,OAAM,IAAIC,UAAU,6CAAA;AAExB,oCAAA,MAAK,mBAAA,CAAA,sBAAmBD;AACxB,SAAO;;CAEXE,qBAAqBC,mBAAmB;AACpC,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACL,OAAM,IAAIF,UAAU,+CAAA;AAExB,oCAAA,MAAK,mBAAA,CAAA,sBAAqBE;AAC1B,SAAO;;CAEX,MAAMd,KAAKe,KAAKC,SAAS;AACrB,MAAI,CAAC,kCAAA,MAAK,mBAAA,CAAA,uBAAoB,CAAC,kCAAA,MAAK,mBAAA,CAAA,oBAChC,OAAM,IAAId,WAAW,kFAAA;AAEzB,MAAI,CAACD,oBAAW,kCAAA,MAAK,mBAAA,CAAA,qBAAkB,kCAAA,MAAK,mBAAA,CAAA,oBAAA,CACxC,OAAM,IAAIC,WAAW,4EAAA;EAEzB,MAAMe,aAAa;MACZ,kCAAA,MAAK,mBAAA,CAAA;MACL,kCAAA,MAAK,mBAAA,CAAA;GACZ;EACA,MAAMC,aAAaX,sBAAaL,YAAY,IAAIiB,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAA,EAAGH,SAASI,MAAM,kCAAA,MAAK,mBAAA,CAAA,qBAAkBH,WAAAA;EAC5G,IAAII,MAAM;AACV,MAAIH,WAAWI,IAAI,MAAA,EAAQ;AACvBD,SAAM,kCAAA,MAAK,mBAAA,CAAA,oBAAiBA;AAC5B,OAAI,OAAOA,QAAQ,UACf,OAAM,IAAInB,WAAW,4EAAA;;EAG7B,MAAM,EAAEqB,QAAQN;AAChB,MAAI,OAAOM,QAAQ,YAAY,CAACA,IAC5B,OAAM,IAAIrB,WAAW,8DAAA;AAEzBI,yBAAaiB,KAAKR,KAAK,OAAA;EACvB,IAAIS,UAAU,kCAAA,MAAK,SAAA,CAAA;AACnB,MAAIH,IACAG,WAAUrB,QAAQL,OAAOC,OAAKyB,QAAAA,CAAAA;EAElC,IAAIb;AACJ,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACLA,mBAAkBR,QAAQL,OAAOC,OAAK0B,KAAKC,UAAU,kCAAA,MAAK,mBAAA,CAAA,oBAAA,CAAA,CAAA;MAG1Df,mBAAkBR,QAAQL,OAAO,GAAA;EAErC,MAAM6B,OAAOtB,OAAOM,iBAAiBR,QAAQL,OAAO,IAAA,EAAM0B,QAAAA;EAG1D,MAAMM,MAAM;GACRD,WAAW9B,OAAK8B,MAFI7B,aAAKuB,KAAKK,MADlBpB,sBAAaO,KAAKQ,IAAAA,EACGI,KAAAA,CAEjBE;GAChBL,SAAS;GACb;AACA,MAAIH,IACAS,KAAIN,UAAUpB,QAAQ2B,OAAOP,QAAAA;AAEjC,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACLM,KAAIE,SAAS,kCAAA,MAAK,mBAAA,CAAA;AAEtB,MAAI,kCAAA,MAAK,mBAAA,CAAA,oBACLF,KAAIG,YAAY7B,QAAQ2B,OAAOpB,gBAAAA;AAEnC,SAAOmB;;CAvEX,YAAYN,SAAS;AAHrB,SAAA,eAAA,MAAA,UAAA;;UAAA,KAAA;;AACA,SAAA,eAAA,MAAA,oBAAA;;UAAA,KAAA;;AACA,SAAA,eAAA,MAAA,oBAAA;;UAAA,KAAA;;AAEI,MAAI,EAAEA,mBAAmBU,YACrB,OAAM,IAAItB,UAAU,4CAAA;AAExB,oCAAA,MAAK,SAAA,CAAA,YAAWY;;;;;;;;;;;;;ICdpB,aAAA,iDAAA,aAAA;AADJ,IAAaY,cAAb,MAAaA;CAKTC,mBAAmBC,iBAAiB;AAChC,oCAAA,MAAK,WAAA,CAAA,YAAWD,mBAAmBC,gBAAAA;AACnC,SAAO;;CAEX,MAAMC,KAAKC,KAAKC,SAAS;EACrB,MAAMC,MAAM,MAAM,kCAAA,MAAK,WAAA,CAAA,YAAWH,KAAKC,KAAKC,QAAAA;AAC5C,MAAIC,IAAIC,YAAYC,KAAAA,EAChB,OAAM,IAAIC,UAAU,4DAAA;AAExB,SAAO,GAAGH,IAAII,UAAU,GAAGJ,IAAIC,QAAQ,GAAGD,IAAIK;;CAZlD,YAAYJ,SAAS;AADrB,SAAA,eAAA,MAAA,YAAA;;UAAA,KAAA;;AAEI,oCAAA,MAAK,WAAA,CAAA,cAAa,IAAIR,cAAcQ,QAAAA;;;;;;;;;;;;;ICAxC,mBAAA,+CAAA,mBAAA,EACA,OAAA,+CAAA,OAAA;AAFJ,IAAaQ,UAAb,MAAaA;CAMTC,UAAUC,QAAQ;AACd,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,WAAWC,SAAS;AAChB,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,YAAYC,UAAU;AAClB,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,OAAOC,OAAO;AACV,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,aAAaC,OAAO;AAChB,kCAAA,MAAK,KAAA,CAAA,MAAKC,MAAMD;AAChB,SAAO;;CAEXE,kBAAkBF,OAAO;AACrB,kCAAA,MAAK,KAAA,CAAA,MAAKG,MAAMH;AAChB,SAAO;;CAEXI,YAAYJ,OAAO;AACf,kCAAA,MAAK,KAAA,CAAA,MAAKK,MAAML;AAChB,SAAO;;CAEXM,mBAAmBC,iBAAiB;AAChC,kCAAA,MAAK,iBAAA,CAAA,oBAAmBA;AACxB,SAAO;;CAEX,MAAMC,KAAKC,KAAKC,SAAS;EACrB,MAAMC,MAAM,IAAI5B,YAAY,gCAAA,MAAK,KAAA,CAAA,MAAK6B,MAAI,CAAA;AAC1CD,MAAIL,mBAAmB,gCAAA,MAAK,iBAAA,CAAA,kBAAA;AAC5B,MAAIO,MAAMC,QAAQ,gCAAA,MAAK,iBAAA,CAAA,mBAAkBC,KAAAA,IACrC,gCAAA,MAAK,iBAAA,CAAA,kBAAiBA,KAAKC,SAAS,MAAA,IACpC,gCAAA,MAAK,iBAAA,CAAA,kBAAiBC,QAAQ,MAC9B,OAAM,IAAIjC,WAAW,sCAAA;AAEzB,SAAO2B,IAAIH,KAAKC,KAAKC,QAAAA;;CA3CzB,YAAYQ,UAAU,EAAE,EAAE;AAF1B,SAAA,eAAA,MAAA,kBAAA;;UAAA,KAAA;;AACA,SAAA,eAAA,MAAA,MAAA;;UAAA,KAAA;;AAEI,kCAAA,MAAK,KAAA,CAAA,QAAO,IAAIjC,iBAAiBiC,QAAAA;;;;;ACHzC,SAAgBM,UAAUC,KAAG;AACzB,KAAI,OAAOA,QAAQ,SACf,OAAM,IAAIF,WAAW,gEAAA;CACzB,MAAM,EAAE,GAAGG,SAASC,WAAWF,IAAIG,MAAM,IAAA;AACzC,KAAID,WAAW,EACX,OAAM,IAAIJ,WAAW,2DAAA;AACzB,KAAII,WAAW,EACX,OAAM,IAAIJ,WAAW,cAAA;AACzB,KAAI,CAACG,QACD,OAAM,IAAIH,WAAW,8BAAA;CACzB,IAAIM;AACJ,KAAI;AACAA,YAAUT,OAAKM,QAAAA;SAEb;AACF,QAAM,IAAIH,WAAW,yCAAA;;CAEzB,IAAIO;AACJ,KAAI;AACAA,WAASC,KAAKC,MAAMX,QAAQF,OAAOU,QAAAA,CAAAA;SAEjC;AACF,QAAM,IAAIN,WAAW,8CAAA;;AAEzB,KAAI,CAACD,kBAASQ,OAAAA,CACV,OAAM,IAAIP,WAAW,yBAAA;AACzB,QAAOO;;;;;;;;;;;;;ACvBX,IAAaS,aAAb,MAAaA;CAGX,MAAMC,KAAKC,SAAmD;EAC5D,MAAMC,SAAS,IAAIC,aAAAA,CAAcC,OAAO,KAAKC,OAAOH,OAAM;EAC1D,MAAMI,YAAY,KAAKC,eAAe,KAAKF,OAAOC,UAAS;AAQ3D,SAAOE,MANW,IAAIX,QAAQI,QAAAA,CAC3BQ,mBAAmB,EAAEC,KAAK,SAAQ,CAAA,CAClCC,aAAW,CACXC,kBAAkBN,UAAAA,CAClBN,KAAKE,OAAAA;;CAKV,MAAMW,OAAOC,OAAoC;EAE/C,MAAM,EAAEb,YAAY,MAAML,UAAsBkB,OADjC,IAAIX,aAAAA,CAAcC,OAAO,KAAKC,OAAOH,OACGA,CAAAA;AACvD,SAAOD;;CAGTc,OAAOD,OAAkC;AACvC,MAAI;AACF,UAAOnB,UAAsBmB,MAAAA;UACvB;AACN,UAAO;;;CAIHP,eAAeD,WAAoC;EACzD,MAAMU,QAAQ,kBAAkBC,KAAKX,UAAAA;AACrC,MAAIU,MASF,QAAO,GAROG,SAASH,MAAM,MAAM,KAAK,GAQ9BE,CAAM,GAAGG;GALjBC,GAAG;GACHC,GAAG;GACHC,GAAG;GACHC,GAAG;GAEqB,CAPbT,MAAM,MAAM;AAS3B,SAAOV;;CA1CT,YAAY,SAA0BZ,OAAOI,UAAU,EAAE;OAA5BO,SAAAA;;;;;;;;;;;;;;;;;;;ACA/B,IAAa4B,gBAAb,MAAaA;;;;;IAWX,MAAMC,IAAIC,GAAmBC,MAA2C;EACtE,MAAMC,QAAQ,KAAKC,aAAaH,EAAAA;AAEhC,MAAI,CAACE,MACH,OAAM,IAAIN,sBAAsB,EAAEQ,QAAQ,iBAAgB,CAAA;EAG5D,MAAMC,WAAW,MAAM,KAAKC,WAAWC,OAAOL,MAAAA,CAAOM,MAClDC,aAAa;GAAEC,IAAI;GAAeD;GAAQ,UACpC,EAAEC,IAAI,OAAe,EAAA;AAG9B,MAAI,CAACL,SAASK,GACZ,OAAM,IAAId,sBAAsB,EAAEQ,QAAQ,iBAAgB,CAAA;EAG5D,MAAM,EAAEO,MAAMC,UAAU,MAAM,KAAKC,OAAOC,YAAYT,SAASI,QAAO;AACtEhB,UAAQkB,MAAMC,MAAAA;AACd,QAAMX,MAAAA;;CAIAE,aAAaH,GAAkC;AACrD,MAAI,KAAKa,OAAOG,WAAW,SACzB,QAAOtB,UAAUM,GAAG,KAAKa,OAAOI,WAAU,IAAK;EAGjD,MAAMC,aAAalB,EAAEmB,IAAIC,OAAO,gBAAA;AAChC,MAAI,CAACF,YAAYG,WAAW,UAAA,CAC1B,QAAO;AAET,SAAOH,WAAWI,MAAM,EAAA;;CAzC1B,YACE,aAA8B/B,OAAOM,WAAW,EAChD,SAA0BN,OAAOI,UAAU,EAC3C;OAFiBW,aAAAA;OACAO,SAAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeltjs/auth-jwt",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -22,14 +22,14 @@
   ],
   "peerDependencies": {
     "hono": "^4.0.0",
-    "@zeltjs/core": "0.7.0"
+    "@zeltjs/core": "0.8.0"
   },
   "devDependencies": {
     "@types/node": "22.19.17",
     "hono": "4.12.16",
     "jose": "6.0.11",
-    "@zeltjs/core": "0.7.0",
-    "@zeltjs/testing": "0.7.0"
+    "@zeltjs/testing": "0.8.0",
+    "@zeltjs/core": "0.8.0"
   },
   "volta": {
     "extends": "../../package.json"