npm - flujo-ai - Versions diffs - 3.26.0 → 3.28.0 - Mend

flujo-ai 3.26.0 → 3.28.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (706) hide show

package/.next/server/chunks/793.js ADDED Viewed

@@ -0,0 +1,393 @@
+"use strict";exports.id=793,exports.ids=[793],exports.modules={10793:(a,b,c)=>{c.d(b,{filesystemListResources:()=>g,filesystemReadResource:()=>i,isFilesystemAppUri:()=>h});let d="ui://filesystem/browser",e="ui://devcanvas/diff",f="text/html;profile=mcp-app";function g(){return{resources:[{uri:d,name:"filesystem_browser",mimeType:f,description:"Interactive file browser (navigate, preview, upload, download) for the filesystem server."},{uri:e,name:"devcanvas_diff",mimeType:f,description:"Docked diff canvas that shows file writes/edits live as they happen (pip display mode)."}]}}function h(a){return a===d||a===e}function i(a){if(!h(a))return{success:!1,error:`Not a filesystem app URI: ${a}`,statusCode:404};let b=a===e?k:j;return{success:!0,data:{contents:[{uri:a,mimeType:f,text:b,_meta:{ui:{csp:{},permissions:{}}}}]}}}let j=`<!doctype html>
+<html>
+<head>
+<meta charset="utf-8" />
+<style>
+  :root { --bg:#fff; --fg:#1a1a1a; --muted:#666; --border:#e0e0e0; --accent:#1565c0; --hover:#f5f5f5; }
+  [data-theme="dark"] { --bg:#1e1e1e; --fg:#e8e8e8; --muted:#9e9e9e; --border:#3a3a3a; --accent:#64b5f6; --hover:#2a2a2a; }
+  * { box-sizing: border-box; }
+  html,body { margin:0; padding:0; }
+  body { font: 13px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif; background:var(--bg); color:var(--fg); }
+  #wrap { padding:10px; }
+  .bar { display:flex; align-items:center; gap:6px; margin-bottom:8px; flex-wrap:wrap; }
+  .bar button, .bar label { font:inherit; cursor:pointer; border:1px solid var(--border); background:var(--bg); color:var(--fg); border-radius:5px; padding:3px 9px; }
+  .bar button:hover, .bar label:hover { background:var(--hover); }
+  .path { font-family:ui-monospace,SFMono-Regular,Menlo,monospace; color:var(--muted); word-break:break-all; flex:1 1 200px; }
+  ul { list-style:none; margin:0; padding:0; border:1px solid var(--border); border-radius:6px; overflow:hidden; }
+  li { display:flex; align-items:center; gap:8px; padding:5px 10px; cursor:pointer; border-bottom:1px solid var(--border); }
+  li:last-child { border-bottom:none; }
+  li:hover { background:var(--hover); }
+  .ico { width:16px; text-align:center; }
+  .nm { flex:1; word-break:break-all; }
+  .sz { color:var(--muted); font-size:11px; }
+  .dl { border:1px solid var(--border); background:var(--bg); color:var(--fg); border-radius:4px; padding:1px 7px; font-size:11px; cursor:pointer; }
+  .sel { border-color:var(--accent); color:var(--accent); font-weight:600; }
+  .msg { color:var(--muted); padding:8px 2px; }
+  .err { color:#d32f2f; }
+  pre { background:var(--hover); border:1px solid var(--border); border-radius:6px; padding:10px; max-height:320px; overflow:auto; white-space:pre-wrap; word-break:break-word; margin:8px 0 0; }
+  h4 { margin:10px 0 4px; }
+</style>
+</head>
+<body>
+<div id="wrap">
+  <div class="bar">
+    <button id="up" title="Parent directory">&#8593; Up</button>
+    <button id="refresh" title="Refresh">&#8635;</button>
+    <label>&#8593; Upload<input id="upload" type="file" style="display:none" /></label>
+    <span class="path" id="path"></span>
+  </div>
+  <div id="list"></div>
+  <div id="preview"></div>
+</div>
+<script>
+(function () {
+  var parentWin = window.parent;
+  var idc = 1;
+  var pending = {};
+  var cwd = ".";
+  function post(msg) { parentWin.postMessage(msg, "*"); }
+  function rpc(method, params) {
+    return new Promise(function (resolve, reject) {
+      var id = idc++;
+      pending[id] = { resolve: resolve, reject: reject };
+      post({ jsonrpc: "2.0", id: id, method: method, params: params || {} });
+    });
+  }
+  function notify(method, params) { post({ jsonrpc: "2.0", method: method, params: params || {} }); }
+  function applyTheme(ctx) {
+    var theme = ctx && ctx.theme ? ctx.theme : "light";
+    document.documentElement.setAttribute("data-theme", theme === "dark" ? "dark" : "light");
+  }
+  function sendSize() {
+    try {
+      var h = Math.ceil(document.documentElement.getBoundingClientRect().height);
+      notify("ui/notifications/size-changed", { width: 0, height: h });
+    } catch (e) {}
+  }
+  function payloadOf(result) {
+    if (!result) return null;
+    if (result.structuredContent) return result.structuredContent;
+    try {
+      var t = result.content && result.content[0] && result.content[0].text;
+      return t ? JSON.parse(t) : null;
+    } catch (e) { return null; }
+  }
+  function parentPath(p) {
+    var norm = p.replace(/[\\\\]+/g, "/").replace(/\\/+$/, "");
+    var i = norm.lastIndexOf("/");
+    if (i <= 0) return norm;
+    return norm.slice(0, i);
+  }
+  function joinPath(base, name) {
+    var norm = base.replace(/[\\\\]+/g, "/").replace(/\\/+$/, "");
+    return norm + "/" + name;
+  }
+  var listEl = document.getElementById("list");
+  var pathEl = document.getElementById("path");
+  var previewEl = document.getElementById("preview");
+  function setMsg(el, text, isErr) {
+    el.innerHTML = "";
+    var d = document.createElement("div");
+    d.className = "msg" + (isErr ? " err" : "");
+    d.textContent = text;
+    el.appendChild(d);
+    sendSize();
+  }
+  async function navigate(path) {
+    previewEl.innerHTML = "";
+    setMsg(listEl, "Loading " + path + " ...");
+    try {
+      var res = await rpc("tools/call", { name: "list_dir", arguments: { path: path } });
+      if (res && res.isError) throw new Error((payloadOf(res) || {}).error || "list_dir failed");
+      var data = payloadOf(res) || {};
+      cwd = data.path || path;
+      pathEl.textContent = cwd;
+      renderEntries(data.entries || []);
+    } catch (e) {
+      setMsg(listEl, "Error: " + (e && e.message ? e.message : e), true);
+    }
+  }
+  function renderEntries(entries) {
+    entries.sort(function (a, b) {
+      var ad = a.type === "directory" ? 0 : 1, bd = b.type === "directory" ? 0 : 1;
+      if (ad !== bd) return ad - bd;
+      return String(a.name).localeCompare(String(b.name));
+    });
+    listEl.innerHTML = "";
+    if (!entries.length) { setMsg(listEl, "(empty directory)"); return; }
+    var ul = document.createElement("ul");
+    entries.forEach(function (ent) {
+      var li = document.createElement("li");
+      var isDir = ent.type === "directory";
+      var ico = document.createElement("span"); ico.className = "ico"; ico.textContent = isDir ? "\\uD83D\\uDCC1" : "\\uD83D\\uDCC4";
+      var nm = document.createElement("span"); nm.className = "nm"; nm.textContent = ent.name;
+      li.appendChild(ico); li.appendChild(nm);
+      if (!isDir) {
+        var sz = document.createElement("span"); sz.className = "sz"; sz.textContent = fmtSize(ent.size); li.appendChild(sz);
+        var sel = document.createElement("button"); sel.className = "dl sel"; sel.textContent = "Select";
+        sel.onclick = function (e) { e.stopPropagation(); selectFile(joinPath(cwd, ent.name)); };
+        li.appendChild(sel);
+        var dl = document.createElement("button"); dl.className = "dl"; dl.textContent = "Download";
+        dl.onclick = function (e) { e.stopPropagation(); downloadFile(joinPath(cwd, ent.name), ent.name); };
+        li.appendChild(dl);
+        li.onclick = function () { preview(joinPath(cwd, ent.name), ent.name); };
+      } else {
+        li.onclick = function () { navigate(joinPath(cwd, ent.name)); };
+      }
+      ul.appendChild(li);
+    });
+    listEl.appendChild(ul);
+    sendSize();
+  }
+  function fmtSize(n) {
+    if (typeof n !== "number") return "";
+    if (n < 1024) return n + " B";
+    if (n < 1048576) return (n / 1024).toFixed(1) + " KB";
+    return (n / 1048576).toFixed(1) + " MB";
+  }
+  async function preview(path, name) {
+    previewEl.innerHTML = "";
+    var h = document.createElement("h4"); h.textContent = name; previewEl.appendChild(h);
+    var pre = document.createElement("pre"); pre.textContent = "Loading..."; previewEl.appendChild(pre);
+    sendSize();
+    try {
+      var res = await rpc("tools/call", { name: "read_file", arguments: { path: path } });
+      if (res && res.isError) throw new Error((payloadOf(res) || {}).error || "read_file failed");
+      var data = payloadOf(res) || {};
+      pre.textContent = typeof data.content === "string" ? data.content : "(no text content)";
+    } catch (e) {
+      pre.textContent = "Error: " + (e && e.message ? e.message : e);
+      pre.className = "err";
+    }
+    sendSize();
+  }
+  function selectFile(path) {
+    // The picker action: hand the chosen path back to the assistant as a user
+    // message (ui/message). The host injects it into the conversation, which
+    // resumes the waiting model.
+    rpc("ui/message", { role: "user", content: [{ type: "text", text: "Selected file: " + path }] })
+      .then(function () { setMsg(previewEl, "Selected " + path + " — sent to the assistant."); })
+      .catch(function (e) { setMsg(previewEl, "Select failed: " + (e && e.message ? e.message : e), true); });
+  }
+  async function downloadFile(path, name) {
+    try {
+      var res = await rpc("tools/call", { name: "read_file", arguments: { path: path } });
+      if (res && res.isError) throw new Error((payloadOf(res) || {}).error || "read_file failed");
+      var data = payloadOf(res) || {};
+      await rpc("ui/download-file", {
+        contents: [{ type: "resource", resource: { uri: "file:///" + name, mimeType: "text/plain", text: String(data.content == null ? "" : data.content) } }]
+      });
+    } catch (e) {
+      setMsg(previewEl, "Download failed: " + (e && e.message ? e.message : e), true);
+    }
+  }
+  document.getElementById("upload").onchange = function (ev) {
+    var file = ev.target.files && ev.target.files[0];
+    if (!file) return;
+    var reader = new FileReader();
+    reader.onload = async function () {
+      try {
+        await rpc("tools/call", { name: "write_file", arguments: { path: joinPath(cwd, file.name), content: String(reader.result) } });
+        navigate(cwd);
+      } catch (e) {
+        setMsg(previewEl, "Upload failed: " + (e && e.message ? e.message : e), true);
+      }
+    };
+    reader.readAsText(file);
+    ev.target.value = "";
+  };
+  document.getElementById("up").onclick = function () { navigate(parentPath(cwd)); };
+  document.getElementById("refresh").onclick = function () { navigate(cwd); };
+  // --- MCP Apps message handling ---
+  window.addEventListener("message", function (event) {
+    var m = event.data;
+    if (!m || m.jsonrpc !== "2.0") return;
+    if (m.id !== undefined && (m.result !== undefined || m.error !== undefined)) {
+      var p = pending[m.id];
+      if (!p) return;
+      delete pending[m.id];
+      if (m.error) p.reject(new Error(m.error.message || "RPC error"));
+      else p.resolve(m.result);
+      return;
+    }
+    // Host-initiated requests/notifications.
+    if (m.method === "ui/notifications/host-context-changed") { applyTheme(m.params); return; }
+    if (m.method === "ui/notifications/tool-input") {
+      var args = m.params && m.params.arguments;
+      if (args && typeof args.path === "string" && !started) { started = true; navigate(args.path); }
+      return;
+    }
+    if (m.method === "ping" && m.id !== undefined) { post({ jsonrpc: "2.0", id: m.id, result: {} }); return; }
+    if (m.method === "ui/resource-teardown" && m.id !== undefined) { post({ jsonrpc: "2.0", id: m.id, result: {} }); return; }
+  });
+  var started = false;
+  // Handshake: initialize -> initialized -> initial navigation.
+  rpc("ui/initialize", {
+    appInfo: { name: "filesystem-browser", version: "1.0.0" },
+    appCapabilities: { availableDisplayModes: ["inline", "fullscreen"] },
+    protocolVersion: "2026-01-26"
+  }).then(function (result) {
+    applyTheme(result && result.hostContext);
+    notify("ui/notifications/initialized", {});
+    // If no tool-input arrives shortly, start at the data directory (".").
+    setTimeout(function () { if (!started) { started = true; navigate("."); } }, 400);
+  }).catch(function (e) {
+    setMsg(listEl, "Failed to initialize app: " + (e && e.message ? e.message : e), true);
+  });
+})();
+</script>
+</body>
+</html>`,k=`<!doctype html>
+<html>
+<head>
+<meta charset="utf-8" />
+<style>
+  :root { --bg:#fff; --fg:#1a1a1a; --muted:#666; --border:#e0e0e0; --accent:#1565c0; --add:#e6ffed; --addln:#22863a; --hover:#f5f5f5; }
+  [data-theme="dark"] { --bg:#1e1e1e; --fg:#e8e8e8; --muted:#9e9e9e; --border:#3a3a3a; --accent:#64b5f6; --add:#0f2f18; --addln:#7bd88f; --hover:#2a2a2a; }
+  * { box-sizing: border-box; }
+  html,body { margin:0; padding:0; height:100%; }
+  body { font: 13px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif; background:var(--bg); color:var(--fg); }
+  #wrap { padding:10px; }
+  h3 { margin:0 0 8px; font-size:14px; }
+  .empty { color:var(--muted); padding:10px 2px; }
+  .card { border:1px solid var(--border); border-radius:6px; margin-bottom:8px; overflow:hidden; }
+  .card h4 { margin:0; padding:6px 10px; background:var(--hover); font-size:12px; font-family:ui-monospace,SFMono-Regular,Menlo,monospace; word-break:break-all; display:flex; gap:8px; align-items:center; }
+  .badge { font-size:11px; padding:1px 6px; border-radius:10px; border:1px solid var(--border); color:var(--muted); }
+  .stat { font-size:11px; color:var(--addln); }
+  pre { margin:0; padding:8px 10px; max-height:220px; overflow:auto; white-space:pre-wrap; word-break:break-word; background:var(--bg); }
+  .del { color:#d32f2f; }
+</style>
+</head>
+<body>
+<div id="wrap">
+  <h3>Diff canvas</h3>
+  <div id="log"><div class="empty">Waiting for file writes / edits...</div></div>
+</div>
+<script>
+(function () {
+  var parentWin = window.parent;
+  var logEl = document.getElementById("log");
+  var changes = [];
+  var seen = 0;
+  function post(msg) { parentWin.postMessage(msg, "*"); }
+  function notify(method, params) { post({ jsonrpc: "2.0", method: method, params: params || {} }); }
+  function applyTheme(ctx) {
+    var theme = ctx && ctx.theme ? ctx.theme : "light";
+    document.documentElement.setAttribute("data-theme", theme === "dark" ? "dark" : "light");
+  }
+  function sendSize() {
+    try {
+      var h = Math.ceil(document.documentElement.getBoundingClientRect().height);
+      notify("ui/notifications/size-changed", { width: 0, height: h });
+    } catch (e) {}
+  }
+  function payloadOf(result) {
+    if (!result) return null;
+    if (result.structuredContent) return result.structuredContent;
+    try {
+      var t = result.content && result.content[0] && result.content[0].text;
+      return t ? JSON.parse(t) : null;
+    } catch (e) { return null; }
+  }
+  function render() {
+    if (!changes.length) { logEl.innerHTML = '<div class="empty">Waiting for file writes / edits...</div>'; sendSize(); return; }
+    logEl.innerHTML = "";
+    for (var i = changes.length - 1; i >= 0; i--) {
+      var c = changes[i];
+      var card = document.createElement("div"); card.className = "card";
+      var h = document.createElement("h4");
+      var nm = document.createElement("span"); nm.textContent = c.path || "(unknown path)"; nm.style.flex = "1";
+      h.appendChild(nm);
+      if (c.mode) { var b = document.createElement("span"); b.className = "badge"; b.textContent = c.mode; h.appendChild(b); }
+      if (c.stat) { var s = document.createElement("span"); s.className = "stat"; s.textContent = c.stat; h.appendChild(s); }
+      card.appendChild(h);
+      if (c.body) { var pre = document.createElement("pre"); pre.textContent = c.body; card.appendChild(pre); }
+      logEl.appendChild(card);
+    }
+    sendSize();
+  }
+  function addFromResult(payload, args) {
+    if (!payload && !args) return;
+    var p = payload || {};
+    var a = args || {};
+    var change = { path: p.path || a.path || "", mode: p.mode || (a.edits ? "edit" : (a.diff ? "diff" : undefined)), stat: "", body: "" };
+    if (p.diff && (typeof p.diff.added === "number" || typeof p.diff.removed === "number")) {
+      change.stat = "+" + (p.diff.added || 0) + " -" + (p.diff.removed || 0);
+    } else if (typeof p.bytesWritten === "number") {
+      change.stat = p.bytesWritten + " B";
+    } else if (typeof p.editsApplied === "number") {
+      change.stat = p.editsApplied + " edit(s)";
+    } else if (typeof p.applied === "number") {
+      change.stat = p.applied + " edit(s)";
+    }
+    if (typeof a.content === "string") change.body = a.content.slice(0, 4000);
+    else if (typeof a.diff === "string") change.body = a.diff.slice(0, 4000);
+    changes.push(change);
+    render();
+  }
+  var lastArgs = null;
+  window.addEventListener("message", function (event) {
+    var m = event.data;
+    if (!m || m.jsonrpc !== "2.0") return;
+    if (m.method === "ui/notifications/host-context-changed") { applyTheme(m.params); return; }
+    if (m.method === "ui/notifications/tool-input") { lastArgs = m.params && m.params.arguments; return; }
+    if (m.method === "ui/notifications/tool-result") {
+      addFromResult(payloadOf(m.params && m.params.result ? m.params.result : m.params), lastArgs);
+      lastArgs = null;
+      return;
+    }
+    if (m.method === "ping" && m.id !== undefined) { post({ jsonrpc: "2.0", id: m.id, result: {} }); return; }
+    if (m.method === "ui/resource-teardown" && m.id !== undefined) { post({ jsonrpc: "2.0", id: m.id, result: {} }); return; }
+  });
+  // Handshake: advertise pip so the host can dock this app.
+  var idc = 1; var pending = {};
+  function rpc(method, params) {
+    return new Promise(function (resolve, reject) {
+      var id = idc++; pending[id] = { resolve: resolve, reject: reject };
+      post({ jsonrpc: "2.0", id: id, method: method, params: params || {} });
+    });
+  }
+  window.addEventListener("message", function (event) {
+    var m = event.data;
+    if (!m || m.jsonrpc !== "2.0") return;
+    if (m.id !== undefined && (m.result !== undefined || m.error !== undefined)) {
+      var pr = pending[m.id]; if (!pr) return; delete pending[m.id];
+      if (m.error) pr.reject(new Error(m.error.message || "RPC error")); else pr.resolve(m.result);
+    }
+  });
+  rpc("ui/initialize", {
+    appInfo: { name: "devcanvas-diff", version: "1.0.0" },
+    appCapabilities: { availableDisplayModes: ["inline", "fullscreen", "pip"] },
+    protocolVersion: "2026-01-26"
+  }).then(function (result) {
+    applyTheme(result && result.hostContext);
+    notify("ui/notifications/initialized", {});
+    sendSize();
+  }).catch(function () { sendSize(); });
+})();
+</script>
+</body>
+</html>`}};

package/.next/server/chunks/8037.js ADDED Viewed

@@ -0,0 +1 @@

+ "use strict";exports.id=8037,exports.ids=[8037],exports.modules={48037:(a,b,c)=>{c.d(b,{A:()=>D});var d=c(21124),e=c(38301),f=c(60839),g=c(81637),h=c(8521),i=c(79515),j=c(88745),k=c(43312),l=c(68730),m=c(99561),n=c(5748),o=c(1994),p=c(17332),q=c(63908),r=c(36636),s=c(93516),t=c(92543),u=c(28055),v=c(59060);let w=(0,c(19815).h)("frontend/components/Chat/McpAppFrame"),x={name:"FLUJO",version:"1.0.0"};function y(a){let b=(Array.isArray(a?.content)?a.content:[]).map(a=>a?.type==="text"&&"string"==typeof a.text?a.text:"").filter(Boolean).join("\n").trim();return b||(a?.structuredContent&&"object"==typeof a.structuredContent?JSON.stringify(a.structuredContent):"")}let z=null;async function A(){z||(z=fetch("/api/mcp/app-sandbox").then(a=>a.json()).then(a=>"number"==typeof a?.port?a.port:4201).catch(()=>4201));let a=await z;return`${window.location.protocol}//${window.location.hostname}:${a}/sandbox.html`}function B(a){if(a)try{return JSON.parse(a)}catch{return}}function C(a){let b=B(a);return b&&"object"==typeof b?Array.isArray(b.content)?b:{content:[{type:"text",text:a}]}:null}let D=({serverName:a,uri:b,toolName:c,toolArgs:z,toolResultContent:D,onAppMessage:E,onRequestDock:F,onDockable:G,docked:H=!1,visible:I=!0})=>{let J=(0,f.A)(),[K,L]=(0,e.useState)(!1),[M,N]=(0,e.useState)(!1),[O,P]=(0,e.useState)(null),[Q,R]=(0,e.useState)("inline"),S=(0,e.useRef)(null),T=(0,e.useRef)(null),U=(0,e.useRef)(null),V=(0,e.useRef)(!1),W=(0,e.useRef)(E);(0,e.useEffect)(()=>{W.current=E},[E]);let X=(0,e.useRef)(F);(0,e.useEffect)(()=>{X.current=F},[F]);let Y=(0,e.useRef)(G);(0,e.useEffect)(()=>{Y.current=G},[G]);let Z=(0,e.useRef)(H);(0,e.useEffect)(()=>{Z.current=H},[H]);let $=(0,e.useRef)(!1),_=(0,e.useRef)(void 0),aa=(0,e.useCallback)(()=>{try{U.current?.close()}catch{}U.current=null,T.current&&T.current.parentNode&&T.current.parentNode.removeChild(T.current),T.current=null,V.current=!1},[]),ab=(0,e.useCallback)(async()=>{if(!V.current&&S.current){V.current=!0,N(!0),P(null);try{let c=await u.S.readResource(a,b);if(!c||!1===c.success)throw Error(c?.error||"Failed to read the UI resource.");let d=function(a){let b=a?.contents;if(!Array.isArray(b)||0===b.length)throw Error("Resource has no contents");let c=b.find(a=>"string"==typeof a.mimeType&&a.mimeType.replace(/\s+/g,"").startsWith("text/html;profile=mcp-app".replace(/\s+/g,""))&&("string"==typeof a.text||"string"==typeof a.blob))||b.find(a=>"string"==typeof a.text||"string"==typeof a.blob);if(!c)throw Error("Resource has no HTML body");let d="string"==typeof c.text?c.text:atob(c.blob);if(new TextEncoder().encode(d).length>v.Pt)throw Error(`Resource exceeds the ${Math.round(v.Pt/1024)} KiB size cap`);let e=(c._meta??c.meta)?.ui;return{html:d,csp:e?.csp,permissions:e?.permissions}}(c.data),e=await A(),f=document.createElement("iframe");f.title=`MCP App: ${b}`,f.setAttribute("sandbox","allow-scripts allow-same-origin allow-forms"),f.referrerPolicy="origin";let g=(0,t.Sy)(d.permissions);g&&f.setAttribute("allow",g),f.style.cssText=Z.current?"width:100%;height:100%;border:none;background:#fff;":"width:100%;min-height:120px;height:200px;border:none;border-radius:4px;background:#fff;",S.current.appendChild(f),T.current=f;let h=new Promise((a,b)=>{let c=setTimeout(()=>{window.removeEventListener("message",d),b(Error("Timed out waiting for the sandbox proxy."))},1e4),d=b=>{b.source===f.contentWindow&&b.data?.method==="ui/notifications/sandbox-proxy-ready"&&(clearTimeout(c),window.removeEventListener("message",d),a())};window.addEventListener("message",d)}),i=new URL(e);d.csp&&i.searchParams.set("csp",JSON.stringify(d.csp)),f.src=i.href,await h;let j=new t.T1(function(a){return{getServerCapabilities:()=>({tools:{},resources:{}}),setNotificationHandler:()=>{},request:async b=>{let{method:c,params:d}=b;if("tools/call"===c){w.info(`MCP App tools/call: ${a}/${d?.name}`);let b=await u.S.callTool(a,d.name,d.arguments??{});if(!b||!1===b.success)throw Error(b?.error||`Tool call failed: ${d?.name}`);return b.data}if("resources/read"===c){let b=await u.S.readResource(a,d.uri);if(!b||!1===b.success)throw Error(b?.error||`Resource read failed: ${d?.uri}`);return b.data}if("resources/list"===c)return{resources:[]};if("resources/templates/list"===c)return{resourceTemplates:[]};throw Error(`MCP App requested unsupported method: ${c}`)}}}(a),x,{openLinks:{},serverTools:{},serverResources:{},updateModelContext:{text:{}}},{hostContext:{theme:"dark"===J.palette.mode?"dark":"light",platform:"web",displayMode:Z.current?"pip":"inline",availableDisplayModes:["inline","fullscreen","pip"],containerDimensions:{maxHeight:6e3}}});U.current=j,j.onopenlink=async({url:a})=>(window.open(a,"_blank","noopener,noreferrer"),{}),j.ondownloadfile=async({contents:a})=>{try{for(let b of a??[]){let a,c=b?.resource;if(!c)continue;let d=("string"==typeof c.uri?c.uri.split("/").pop():"")||"download",e="string"==typeof c.mimeType?c.mimeType:"application/octet-stream";if("string"==typeof c.blob){let b=Uint8Array.from(atob(c.blob),a=>a.charCodeAt(0));a=new Blob([b],{type:e})}else a=new Blob([String(c.text??"")],{type:e});let f=URL.createObjectURL(a),g=document.createElement("a");g.href=f,g.download=d,document.body.appendChild(g),g.click(),g.remove(),setTimeout(()=>URL.revokeObjectURL(f),4e3)}return{}}catch(a){return w.warn("MCP App download failed",a),{isError:!0}}},j.onloggingmessage=a=>w.debug("MCP App log",a?.data),j.onmessage=async a=>{let b=y(a);return b&&(W.current?W.current(b):w.info(`MCP App message (no chat sink): ${b}`)),{}},j.onupdatemodelcontext=async a=>{let b=y(a);return b&&(W.current?W.current(b):w.info(`MCP App context update (no chat sink): ${b}`)),{}},j.onsizechange=async({width:a,height:b})=>{!Z.current&&("number"==typeof b&&b>0&&(f.style.height=`${b}px`),"number"==typeof a&&a>0&&(f.style.minWidth=`min(${a}px, 100%)`))},j.onrequestdisplaymode=async({mode:a})=>{if("pip"===a)return X.current?(X.current(),R("pip"),j.sendHostContextChange({displayMode:"pip"}),{mode:"pip"}):(R("inline"),j.sendHostContextChange({displayMode:"inline"}),{mode:"inline"});let b="fullscreen"===a?"fullscreen":"inline";return R(b),j.sendHostContextChange({displayMode:b}),{mode:b}},j.oninitialized=()=>{try{let a=j.getAppCapabilities()?.availableDisplayModes;Y.current?.(Array.isArray(a)&&a.includes("pip"))}catch{}let a=B(z);a&&"object"==typeof a&&j.sendToolInput({arguments:a});let b=C(D);b&&j.sendToolResult(b),_.current=D,$.current=!0,N(!1)},await j.connect(new t.hJ(f.contentWindow,f.contentWindow)),await j.sendSandboxResourceReady({html:d.html,csp:d.csp,permissions:d.permissions})}catch(c){w.warn(`Failed to mount MCP App ${b} from ${a}`,c),P(c instanceof Error?c.message:"Failed to load the app."),N(!1),aa()}}},[a,b,z,D,J.palette.mode,aa]),ac=(0,e.useCallback)(()=>{let a=!K;L(a),a&&setTimeout(()=>{ab()},0)},[K,ab]);return((0,e.useEffect)(()=>{H&&!V.current&&ab()},[H,ab]),(0,e.useEffect)(()=>{if(!$.current||!U.current||D===_.current)return;let a=C(D);if(a)try{U.current.sendToolResult(a)}catch(a){w.warn("MCP App re-feed failed",a)}_.current=D},[D]),(0,e.useEffect)(()=>{U.current?.sendHostContextChange({theme:"dark"===J.palette.mode?"dark":"light"})},[J.palette.mode]),(0,e.useEffect)(()=>()=>aa(),[aa]),H)?(0,d.jsxs)(g.default,{sx:{height:"100%",width:"100%",minHeight:0,display:I?"flex":"none",flexDirection:"column"},children:[M&&(0,d.jsxs)(g.default,{sx:{display:"flex",alignItems:"center",gap:1,py:2,justifyContent:"center"},children:[(0,d.jsx)(h.default,{size:16,thickness:6}),(0,d.jsx)(i.default,{variant:"body2",color:"text.secondary",children:"Loading the app…"})]}),O&&(0,d.jsx)(j.A,{severity:"error",sx:{m:1},children:O}),(0,d.jsx)(g.default,{ref:S,sx:{flex:1,minHeight:0,width:"100%",display:O?"none":"block"}})]}):(0,d.jsxs)(g.default,{sx:{mt:1,border:"1px solid",borderColor:"divider",borderRadius:1,overflow:"hidden",..."fullscreen"===Q?{position:"fixed",inset:16,zIndex:1300,bgcolor:"background.paper",boxShadow:6}:{}},children:[(0,d.jsxs)(g.default,{sx:{display:"flex",alignItems:"center",gap:1,px:1,py:.5,bgcolor:"action.hover"},children:[(0,d.jsx)(n.A,{fontSize:"small",color:"primary"}),(0,d.jsxs)(i.default,{variant:"body2",sx:{fontWeight:500},children:["Interactive app from ",a]}),(0,d.jsx)(k.A,{title:"Runs in a separate-origin sandbox (no access to FLUJO's origin, cookies, storage, or DOM). Its tool calls are brokered through this server only.",children:(0,d.jsx)(o.A,{fontSize:"small",color:"action"})}),K&&(0,d.jsx)(k.A,{title:"fullscreen"===Q?"Exit fullscreen":"Fullscreen",children:(0,d.jsx)(l.A,{size:"small",onClick:()=>{let a="fullscreen"===Q?"inline":"fullscreen";R(a),U.current?.sendHostContextChange({displayMode:a})},sx:{minWidth:0,ml:"auto"},children:"fullscreen"===Q?(0,d.jsx)(s.A,{fontSize:"small"}):(0,d.jsx)(r.A,{fontSize:"small"})})}),(0,d.jsx)(l.A,{size:"small",onClick:ac,startIcon:K?(0,d.jsx)(q.A,{}):(0,d.jsx)(p.A,{}),sx:{ml:K?0:"auto"},children:K?"Hide":"Open app"})]}),(0,d.jsx)(m.A,{in:K,unmountOnExit:!0,onExited:aa,children:(0,d.jsxs)(g.default,{sx:{p:1,height:"fullscreen"===Q?"calc(100vh - 100px)":"auto"},children:[M&&(0,d.jsxs)(g.default,{sx:{display:"flex",alignItems:"center",gap:1,py:2,justifyContent:"center"},children:[(0,d.jsx)(h.default,{size:16,thickness:6}),(0,d.jsx)(i.default,{variant:"body2",color:"text.secondary",children:"Loading the app…"})]}),O&&(0,d.jsx)(j.A,{severity:"error",sx:{my:1},children:O}),(0,d.jsx)(g.default,{ref:S,sx:{width:"100%",height:"fullscreen"===Q?"100%":"auto",display:O?"none":"block"}})]})})]})}},59060:(a,b,c)=>{c.d(b,{Gt:()=>e,Pt:()=>d});let d=2097152;function e(a){if(a&&"object"==typeof a){for(let b of[a.ui,a["io.modelcontextprotocol/ui"]])if(b&&"object"==typeof b){let a=b.resourceUri;if("string"==typeof a&&a.trim().toLowerCase().startsWith("ui://"))return a}}}}};

package/.next/server/chunks/8165.js ADDED Viewed

@@ -0,0 +1,3 @@
+"use strict";exports.id=8165,exports.ids=[8165],exports.modules={58165:(a,b,c)=>{let d,e;c.r(b),c.d(b,{CompactEncrypt:()=>by,CompactSign:()=>bA,EmbeddedJWK:()=>bI,EncryptJWT:()=>bE,FlattenedEncrypt:()=>bj,FlattenedSign:()=>bz,GeneralEncrypt:()=>bl,GeneralSign:()=>bC,SignJWT:()=>bD,UnsecuredJWT:()=>bS,base64url:()=>f,calculateJwkThumbprint:()=>bG,calculateJwkThumbprintUri:()=>bH,compactDecrypt:()=>bh,compactVerify:()=>bn,createLocalJWKSet:()=>bM,createRemoteJWKSet:()=>bR,cryptoRuntime:()=>bY,customFetch:()=>bN,decodeJwt:()=>bU,decodeProtectedHeader:()=>bT,errors:()=>g,exportJWK:()=>a1,exportPKCS8:()=>a0,exportSPKI:()=>a_,flattenedDecrypt:()=>bg,flattenedVerify:()=>bm,generalDecrypt:()=>bi,generalVerify:()=>bo,generateKeyPair:()=>bW,generateSecret:()=>bX,importJWK:()=>aZ,importPKCS8:()=>aY,importSPKI:()=>aW,importX509:()=>aX,jwksCache:()=>bP,jwtDecrypt:()=>bx,jwtVerify:()=>bw});var f={};c.r(f),c.d(f,{decode:()=>q,encode:()=>r});var g={};c.r(g),c.d(g,{JOSEAlgNotAllowed:()=>C,JOSEError:()=>z,JOSENotSupported:()=>D,JWEDecryptionFailed:()=>E,JWEInvalid:()=>F,JWKInvalid:()=>I,JWKSInvalid:()=>J,JWKSMultipleMatchingKeys:()=>L,JWKSNoMatchingKey:()=>K,JWKSTimeout:()=>M,JWSInvalid:()=>G,JWSSignatureVerificationFailed:()=>N,JWTClaimValidationFailed:()=>A,JWTExpired:()=>B,JWTInvalid:()=>H});let h=new TextEncoder,i=new TextDecoder;function j(...a){let b=new Uint8Array(a.reduce((a,{length:b})=>a+b,0)),c=0;for(let d of a)b.set(d,c),c+=d.length;return b}function k(a,b,c){if(b<0||b>=0x100000000)throw RangeError(`value must be >= 0 and <= ${0x100000000-1}. Received ${b}`);a.set([b>>>24,b>>>16,b>>>8,255&b],c)}function l(a){let b=Math.floor(a/0x100000000),c=new Uint8Array(8);return k(c,b,0),k(c,a%0x100000000,4),c}function m(a){let b=new Uint8Array(4);return k(b,a),b}function n(a){let b=new Uint8Array(a.length);for(let c=0;c<a.length;c++){let d=a.charCodeAt(c);if(d>127)throw TypeError("non-ASCII string encountered in encode()");b[c]=d}return b}function o(a){if(Uint8Array.prototype.toBase64)return a.toBase64();let b=[];for(let c=0;c<a.length;c+=32768)b.push(String.fromCharCode.apply(null,a.subarray(c,c+32768)));return btoa(b.join(""))}function p(a){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(a);let b=atob(a),c=new Uint8Array(b.length);for(let a=0;a<b.length;a++)c[a]=b.charCodeAt(a);return c}function q(a){if(Uint8Array.fromBase64)return Uint8Array.fromBase64("string"==typeof a?a:i.decode(a),{alphabet:"base64url"});let b=a;b instanceof Uint8Array&&(b=i.decode(b)),b=b.replace(/-/g,"+").replace(/_/g,"/");try{return p(b)}catch{throw TypeError("The input to be decoded is not correctly encoded.")}}function r(a){let b=a;return("string"==typeof b&&(b=h.encode(b)),Uint8Array.prototype.toBase64)?b.toBase64({alphabet:"base64url",omitPadding:!0}):o(b).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}let s=(a,b="algorithm.name")=>TypeError(`CryptoKey does not support this operation, its ${b} must be ${a}`);function t(a,b){if(parseInt(a.hash.name.slice(4),10)!==b)throw s(`SHA-${b}`,"algorithm.hash")}function u(a,b){if(b&&!a.usages.includes(b))throw TypeError(`CryptoKey does not support this operation, its usages must include ${b}.`)}function v(a,b,c){switch(b){case"A128GCM":case"A192GCM":case"A256GCM":{if("AES-GCM"!==a.algorithm.name)throw s("AES-GCM");let c=parseInt(b.slice(1,4),10);if(a.algorithm.length!==c)throw s(c,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if("AES-KW"!==a.algorithm.name)throw s("AES-KW");let c=parseInt(b.slice(1,4),10);if(a.algorithm.length!==c)throw s(c,"algorithm.length");break}case"ECDH":switch(a.algorithm.name){case"ECDH":case"X25519":break;default:throw s("ECDH or X25519")}break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if("PBKDF2"!==a.algorithm.name)throw s("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":if("RSA-OAEP"!==a.algorithm.name)throw s("RSA-OAEP");t(a.algorithm,parseInt(b.slice(9),10)||1);break;default:throw TypeError("CryptoKey does not support this operation")}u(a,c)}function w(a,b,...c){if((c=c.filter(Boolean)).length>2){let b=c.pop();a+=`one of type ${c.join(", ")}, or ${b}.`}else 2===c.length?a+=`one of type ${c[0]} or ${c[1]}.`:a+=`of type ${c[0]}.`;return null==b?a+=` Received ${b}`:"function"==typeof b&&b.name?a+=` Received function ${b.name}`:"object"==typeof b&&null!=b&&b.constructor?.name&&(a+=` Received an instance of ${b.constructor.name}`),a}let x=(a,...b)=>w("Key must be ",a,...b),y=(a,b,...c)=>w(`Key for the ${a} algorithm must be `,b,...c);class z extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(a,b){super(a,b),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class A extends z{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(a,b,c="unspecified",d="unspecified"){super(a,{cause:{claim:c,reason:d,payload:b}}),this.claim=c,this.reason=d,this.payload=b}}class B extends z{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(a,b,c="unspecified",d="unspecified"){super(a,{cause:{claim:c,reason:d,payload:b}}),this.claim=c,this.reason=d,this.payload=b}}class C extends z{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class D extends z{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class E extends z{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(a="decryption operation failed",b){super(a,b)}}class F extends z{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"}class G extends z{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class H extends z{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class I extends z{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"}class J extends z{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class K extends z{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(a="no applicable key found in the JSON Web Key Set",b){super(a,b)}}class L extends z{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(a="multiple matching keys found in the JSON Web Key Set",b){super(a,b)}}class M extends z{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(a="request timed out",b){super(a,b)}}class N extends z{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(a="signature verification failed",b){super(a,b)}}function O(a){if(!P(a))throw Error("CryptoKey instance expected")}let P=a=>{if(a?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return a instanceof CryptoKey}catch{return!1}},Q=a=>a?.[Symbol.toStringTag]==="KeyObject",R=a=>P(a)||Q(a);function S(a){switch(a){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new D(`Unsupported JWE Algorithm: ${a}`)}}let T=a=>crypto.getRandomValues(new Uint8Array(S(a)>>3));function U(a,b){let c=a.byteLength<<3;if(c!==b)throw new F(`Invalid Content Encryption Key length. Expected ${b} bits, got ${c} bits`)}function V(a){switch(a){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new D(`Unsupported JWE Algorithm: ${a}`)}}function W(a,b){if(b.length<<3!==V(a))throw new F("Invalid Initialization Vector length")}async function X(a,b,c){if(!(b instanceof Uint8Array))throw TypeError(x(b,"Uint8Array"));let d=parseInt(a.slice(1,4),10);return{encKey:await crypto.subtle.importKey("raw",b.subarray(d>>3),"AES-CBC",!1,[c]),macKey:await crypto.subtle.importKey("raw",b.subarray(0,d>>3),{hash:`SHA-${d<<1}`,name:"HMAC"},!1,["sign"]),keySize:d}}async function Y(a,b,c){return new Uint8Array((await crypto.subtle.sign("HMAC",a,b)).slice(0,c>>3))}async function Z(a,b,c,d,e){let{encKey:f,macKey:g,keySize:h}=await X(a,c,"encrypt"),i=new Uint8Array(await crypto.subtle.encrypt({iv:d,name:"AES-CBC"},f,b)),k=j(e,d,i,l(e.length<<3));return{ciphertext:i,tag:await Y(g,k,h),iv:d}}async function $(a,b){if(!(a instanceof Uint8Array))throw TypeError("First argument must be a buffer");if(!(b instanceof Uint8Array))throw TypeError("Second argument must be a buffer");let c={name:"HMAC",hash:"SHA-256"},d=await crypto.subtle.generateKey(c,!1,["sign"]),e=new Uint8Array(await crypto.subtle.sign(c,d,a)),f=new Uint8Array(await crypto.subtle.sign(c,d,b)),g=0,h=-1;for(;++h<32;)g|=e[h]^f[h];return 0===g}async function _(a,b,c,d,e,f){let g,h,{encKey:i,macKey:k,keySize:m}=await X(a,b,"decrypt"),n=j(f,d,c,l(f.length<<3)),o=await Y(k,n,m);try{g=await $(e,o)}catch{}if(!g)throw new E;try{h=new Uint8Array(await crypto.subtle.decrypt({iv:d,name:"AES-CBC"},i,c))}catch{}if(!h)throw new E;return h}async function aa(a,b,c,d,e){let f;c instanceof Uint8Array?f=await crypto.subtle.importKey("raw",c,"AES-GCM",!1,["encrypt"]):(v(c,a,"encrypt"),f=c);let g=new Uint8Array(await crypto.subtle.encrypt({additionalData:e,iv:d,name:"AES-GCM",tagLength:128},f,b)),h=g.slice(-16);return{ciphertext:g.slice(0,-16),tag:h,iv:d}}async function ab(a,b,c,d,e,f){let g;b instanceof Uint8Array?g=await crypto.subtle.importKey("raw",b,"AES-GCM",!1,["decrypt"]):(v(b,a,"decrypt"),g=b);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:f,iv:d,name:"AES-GCM",tagLength:128},g,j(c,e)))}catch{throw new E}}let ac="Unsupported JWE Content Encryption Algorithm";async function ad(a,b,c,d,e){if(!P(c)&&!(c instanceof Uint8Array))throw TypeError(x(c,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(d)W(a,d);else d=crypto.getRandomValues(new Uint8Array(V(a)>>3));switch(a){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return c instanceof Uint8Array&&U(c,parseInt(a.slice(-3),10)),Z(a,b,c,d,e);case"A128GCM":case"A192GCM":case"A256GCM":return c instanceof Uint8Array&&U(c,parseInt(a.slice(1,4),10)),aa(a,b,c,d,e);default:throw new D(ac)}}async function ae(a,b,c,d,e,f){if(!P(b)&&!(b instanceof Uint8Array))throw TypeError(x(b,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!d)throw new F("JWE Initialization Vector missing");if(!e)throw new F("JWE Authentication Tag missing");switch(W(a,d),a){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return b instanceof Uint8Array&&U(b,parseInt(a.slice(-3),10)),_(a,b,c,d,e,f);case"A128GCM":case"A192GCM":case"A256GCM":return b instanceof Uint8Array&&U(b,parseInt(a.slice(1,4),10)),ab(a,b,c,d,e,f);default:throw new D(ac)}}let af=Symbol();function ag(a,b){if(a)throw TypeError(`${b} can only be called once`)}function ah(a,b,c){try{return q(a)}catch{throw new c(`Failed to base64url decode the ${b}`)}}async function ai(a,b){let c=`SHA-${a.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(c,b))}function aj(a){if("object"!=typeof a||null===a||"[object Object]"!==Object.prototype.toString.call(a))return!1;if(null===Object.getPrototypeOf(a))return!0;let b=a;for(;null!==Object.getPrototypeOf(b);)b=Object.getPrototypeOf(b);return Object.getPrototypeOf(a)===b}function ak(...a){let b,c=a.filter(Boolean);if(0===c.length||1===c.length)return!0;for(let a of c){let c=Object.keys(a);if(!b||0===b.size){b=new Set(c);continue}for(let a of c){if(b.has(a))return!1;b.add(a)}}return!0}let al=a=>aj(a)&&"string"==typeof a.kty;function am(a,b){if(a.algorithm.length!==parseInt(b.slice(1,4),10))throw TypeError(`Invalid key size for alg: ${b}`)}function an(a,b,c){return a instanceof Uint8Array?crypto.subtle.importKey("raw",a,"AES-KW",!0,[c]):(v(a,b,c),a)}async function ao(a,b,c){let d=await an(b,a,"wrapKey");am(d,a);let e=await crypto.subtle.importKey("raw",c,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",e,d,"AES-KW"))}async function ap(a,b,c){let d=await an(b,a,"unwrapKey");am(d,a);let e=await crypto.subtle.unwrapKey("raw",c,d,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",e))}function aq(a){return j(m(a.length),a)}async function ar(a,b,c){let d=b>>3,e=Math.ceil(d/32),f=new Uint8Array(32*e);for(let b=1;b<=e;b++){let d=new Uint8Array(4+a.length+c.length);d.set(m(b),0),d.set(a,4),d.set(c,4+a.length);let e=await ai("sha256",d);f.set(e,(b-1)*32)}return f.slice(0,d)}async function as(a,b,c,d,e=new Uint8Array,f=new Uint8Array){var g;v(a,"ECDH"),v(b,"ECDH","deriveBits");let h=aq(n(c)),i=aq(e),k=aq(f),l=j(h,i,k,m(d),new Uint8Array);return ar(new Uint8Array(await crypto.subtle.deriveBits({name:a.algorithm.name,public:a},b,"X25519"===(g=a).algorithm.name?256:Math.ceil(parseInt(g.algorithm.namedCurve.slice(-3),10)/8)<<3)),d,l)}function at(a){switch(a.algorithm.namedCurve){case"P-256":case"P-384":case"P-521":return!0;default:return"X25519"===a.algorithm.name}}async function au(a,b,c,d){if(!(a instanceof Uint8Array)||a.length<8)throw new F("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(c)||1!==Math.sign(c))throw new F("PBES2 Count Input must be a positive integer");let e=j(n(b),Uint8Array.of(0),a),f=parseInt(b.slice(13,16),10),g={hash:`SHA-${b.slice(8,11)}`,iterations:c,name:"PBKDF2",salt:e},h=await (d instanceof Uint8Array?crypto.subtle.importKey("raw",d,"PBKDF2",!1,["deriveBits"]):(v(d,b,"deriveBits"),d));return new Uint8Array(await crypto.subtle.deriveBits(g,h,f))}async function av(a,b,c,d=2048,e=crypto.getRandomValues(new Uint8Array(16))){let f=await au(e,a,d,b);return{encryptedKey:await ao(a.slice(-6),f,c),p2c:d,p2s:r(e)}}async function aw(a,b,c,d,e){let f=await au(e,a,d,b);return ap(a.slice(-6),f,c)}function ax(a,b){if(a.startsWith("RS")||a.startsWith("PS")){let{modulusLength:c}=b.algorithm;if("number"!=typeof c||c<2048)throw TypeError(`${a} requires key modulusLength to be 2048 bits or larger`)}}function ay(a,b){let c=`SHA-${a.slice(-3)}`;switch(a){case"HS256":case"HS384":case"HS512":return{hash:c,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:c,name:"RSA-PSS",saltLength:parseInt(a.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:c,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:c,name:"ECDSA",namedCurve:b.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:a};default:throw new D(`alg ${a} is not supported either by JOSE or your javascript runtime`)}}async function az(a,b,c){if(b instanceof Uint8Array){if(!a.startsWith("HS"))throw TypeError(x(b,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",b,{hash:`SHA-${a.slice(-3)}`,name:"HMAC"},!1,[c])}switch(a){case"HS256":case"HS384":case"HS512":if("HMAC"!==b.algorithm.name)throw s("HMAC");t(b.algorithm,parseInt(a.slice(2),10));break;case"RS256":case"RS384":case"RS512":if("RSASSA-PKCS1-v1_5"!==b.algorithm.name)throw s("RSASSA-PKCS1-v1_5");t(b.algorithm,parseInt(a.slice(2),10));break;case"PS256":case"PS384":case"PS512":if("RSA-PSS"!==b.algorithm.name)throw s("RSA-PSS");t(b.algorithm,parseInt(a.slice(2),10));break;case"Ed25519":case"EdDSA":if("Ed25519"!==b.algorithm.name)throw s("Ed25519");break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":let d;if(d=b.algorithm,d.name!==a)throw s(a);break;case"ES256":case"ES384":case"ES512":{if("ECDSA"!==b.algorithm.name)throw s("ECDSA");let c=function(a){switch(a){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw Error("unreachable")}}(a);if(b.algorithm.namedCurve!==c)throw s(c,"algorithm.namedCurve");break}default:throw TypeError("CryptoKey does not support this operation")}return u(b,c),b}async function aA(a,b,c){let d=await az(a,b,"sign");return ax(a,d),new Uint8Array(await crypto.subtle.sign(ay(a,d.algorithm),d,c))}async function aB(a,b,c,d){let e=await az(a,b,"verify");ax(a,e);let f=ay(a,e.algorithm);try{return await crypto.subtle.verify(f,e,c,d)}catch{return!1}}let aC=a=>{switch(a){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new D(`alg ${a} is not supported either by JOSE or your javascript runtime`)}};async function aD(a,b,c){return v(b,a,"encrypt"),ax(a,b),new Uint8Array(await crypto.subtle.encrypt(aC(a),b,c))}async function aE(a,b,c){return v(b,a,"decrypt"),ax(a,b),new Uint8Array(await crypto.subtle.decrypt(aC(a),b,c))}let aF='Invalid or unsupported JWK "alg" (Algorithm) Parameter value';async function aG(a){if(!a.alg)throw TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:b,keyUsages:c}=function(a){let b,c;switch(a.kty){case"AKP":switch(a.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":b={name:a.alg},c=a.priv?["sign"]:["verify"];break;default:throw new D(aF)}break;case"RSA":switch(a.alg){case"PS256":case"PS384":case"PS512":b={name:"RSA-PSS",hash:`SHA-${a.alg.slice(-3)}`},c=a.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":b={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${a.alg.slice(-3)}`},c=a.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":b={name:"RSA-OAEP",hash:`SHA-${parseInt(a.alg.slice(-3),10)||1}`},c=a.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new D(aF)}break;case"EC":switch(a.alg){case"ES256":case"ES384":case"ES512":b={name:"ECDSA",namedCurve:({ES256:"P-256",ES384:"P-384",ES512:"P-521"})[a.alg]},c=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":b={name:"ECDH",namedCurve:a.crv},c=a.d?["deriveBits"]:[];break;default:throw new D(aF)}break;case"OKP":switch(a.alg){case"Ed25519":case"EdDSA":b={name:"Ed25519"},c=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":b={name:a.crv},c=a.d?["deriveBits"]:[];break;default:throw new D(aF)}break;default:throw new D('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:b,keyUsages:c}}(a),d={...a};return"AKP"!==d.kty&&delete d.alg,delete d.use,crypto.subtle.importKey("jwk",d,b,a.ext??(!a.d&&!a.priv),a.key_ops??c)}let aH="given KeyObject instance cannot be used for this algorithm",aI=async(a,b,c,e=!1)=>{let f=(d||=new WeakMap).get(a);if(f?.[c])return f[c];let g=await aG({...b,alg:c});return e&&Object.freeze(a),f?f[c]=g:d.set(a,{[c]:g}),g};async function aJ(a,b){if(a instanceof Uint8Array||P(a))return a;if(Q(a)){if("secret"===a.type)return a.export();if("toCryptoKey"in a&&"function"==typeof a.toCryptoKey)try{return((a,b)=>{let c,e=(d||=new WeakMap).get(a);if(e?.[b])return e[b];let f="public"===a.type,g=!!f;if("x25519"===a.asymmetricKeyType){switch(b){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw TypeError(aH)}c=a.toCryptoKey(a.asymmetricKeyType,g,f?[]:["deriveBits"])}if("ed25519"===a.asymmetricKeyType){if("EdDSA"!==b&&"Ed25519"!==b)throw TypeError(aH);c=a.toCryptoKey(a.asymmetricKeyType,g,[f?"verify":"sign"])}switch(a.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":if(b!==a.asymmetricKeyType.toUpperCase())throw TypeError(aH);c=a.toCryptoKey(a.asymmetricKeyType,g,[f?"verify":"sign"])}if("rsa"===a.asymmetricKeyType){let d;switch(b){case"RSA-OAEP":d="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":d="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":d="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":d="SHA-512";break;default:throw TypeError(aH)}if(b.startsWith("RSA-OAEP"))return a.toCryptoKey({name:"RSA-OAEP",hash:d},g,f?["encrypt"]:["decrypt"]);c=a.toCryptoKey({name:b.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:d},g,[f?"verify":"sign"])}if("ec"===a.asymmetricKeyType){let d=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(a.asymmetricKeyDetails?.namedCurve);if(!d)throw TypeError(aH);let e={ES256:"P-256",ES384:"P-384",ES512:"P-521"};e[b]&&d===e[b]&&(c=a.toCryptoKey({name:"ECDSA",namedCurve:d},g,[f?"verify":"sign"])),b.startsWith("ECDH-ES")&&(c=a.toCryptoKey({name:"ECDH",namedCurve:d},g,f?[]:["deriveBits"]))}if(!c)throw TypeError(aH);return e?e[b]=c:d.set(a,{[b]:c}),c})(a,b)}catch(a){if(a instanceof TypeError)throw a}let c=a.export({format:"jwk"});return aI(a,c,b)}if(al(a))return a.k?q(a.k):aI(a,a,b,!0);throw Error("unreachable")}let aK=(a,b)=>{let c=(a.match(/.{1,64}/g)||[]).join("\n");return`-----BEGIN ${b}-----
+${c}
+-----END ${b}-----`},aL=async(a,b,c)=>{if(Q(c)){if(c.type!==a)throw TypeError(`key is not a ${a} key`);return c.export({format:"pem",type:b})}if(!P(c))throw TypeError(x(c,"CryptoKey","KeyObject"));if(!c.extractable)throw TypeError("CryptoKey is not extractable");if(c.type!==a)throw TypeError(`key is not a ${a} key`);return aK(o(new Uint8Array(await crypto.subtle.exportKey(b,c))),`${a.toUpperCase()} KEY`)},aM=(a,b)=>{if(a.byteLength!==b.length)return!1;for(let c=0;c<a.byteLength;c++)if(a[c]!==b[c])return!1;return!0},aN=a=>({data:a,pos:0}),aO=a=>{let b=a.data[a.pos++];if(128&b){let c=127&b,d=0;for(let b=0;b<c;b++)d=d<<8|a.data[a.pos++];return d}return b},aP=(a,b=1)=>{if(b<=0)return;a.pos++;let c=aO(a);a.pos+=c,b>1&&aP(a,b-1)},aQ=(a,b,c)=>{if(a.data[a.pos++]!==b)throw Error(c)},aR=(a,b)=>{let c=a.data.subarray(a.pos,a.pos+b);return a.pos+=b,c},aS=a=>{let b=(a=>{aQ(a,6,"Expected algorithm OID");let b=aO(a);return aR(a,b)})(a);if(aM(b,[43,101,110]))return"X25519";if(!aM(b,[42,134,72,206,61,2,1]))throw Error("Unsupported key algorithm");aQ(a,6,"Expected curve OID");let c=aO(a),d=aR(a,c);for(let{name:a,oid:b}of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}])if(aM(d,b))return a;throw Error("Unsupported named curve")},aT=async(a,b,c,d)=>{let e,f,g="spki"===a,h=()=>g?["verify"]:["sign"];switch(c){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${c.slice(-3)}`},f=h();break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${c.slice(-3)}`},f=h();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(c.slice(-3),10)||1}`},f=g?["encrypt","wrapKey"]:["decrypt","unwrapKey"];break;case"ES256":case"ES384":case"ES512":e={name:"ECDSA",namedCurve:({ES256:"P-256",ES384:"P-384",ES512:"P-521"})[c]},f=h();break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":try{let a=d.getNamedCurve(b);e="X25519"===a?{name:"X25519"}:{name:"ECDH",namedCurve:a}}catch(a){throw new D("Invalid or unsupported key format")}f=g?[]:["deriveBits"];break;case"Ed25519":case"EdDSA":e={name:"Ed25519"},f=h();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":e={name:c},f=h();break;default:throw new D('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(a,b,e,d?.extractable??!!g,f)},aU=(a,b)=>p(a.replace(b,"")),aV=(a,b,c)=>{let d=aU(a,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g),e=c;return b?.startsWith?.("ECDH-ES")&&((e||={}).getNamedCurve=a=>{let b=aN(a);return!function(a){aQ(a,48,"Invalid SPKI structure"),aO(a),aQ(a,48,"Expected algorithm identifier"),aO(a),a.pos}(b),aS(b)}),aT("spki",d,b,e)};async function aW(a,b,c){if("string"!=typeof a||0!==a.indexOf("-----BEGIN PUBLIC KEY-----"))throw TypeError('"spki" must be SPKI formatted string');return aV(a,b,c)}async function aX(a,b,c){let d;if("string"!=typeof a||0!==a.indexOf("-----BEGIN CERTIFICATE-----"))throw TypeError('"x509" must be X.509 formatted string');try{d=function(a){var b=aU(a,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);let c=aN(b);aQ(c,48,"Invalid certificate structure"),aO(c),aQ(c,48,"Invalid tbsCertificate structure"),aO(c),160===b[c.pos]?aP(c,6):aP(c,5);let d=c.pos;aQ(c,48,"Invalid SPKI structure");let e=aO(c);return b.subarray(d,d+e+(c.pos-d))}(a)}catch(a){throw TypeError("Failed to parse the X.509 certificate",{cause:a})}return aV(aK(o(d),"PUBLIC KEY"),b,c)}async function aY(a,b,c){if("string"!=typeof a||0!==a.indexOf("-----BEGIN PRIVATE KEY-----"))throw TypeError('"pkcs8" must be PKCS#8 formatted string');let d=aU(a,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g),e=c;return b?.startsWith?.("ECDH-ES")&&((e||={}).getNamedCurve=a=>{let b=aN(a);return!function(a){aQ(a,48,"Invalid PKCS#8 structure"),aO(a),aQ(a,2,"Expected version field");let b=aO(a);a.pos+=b,aQ(a,48,"Expected algorithm identifier"),aO(a),a.pos}(b),aS(b)}),aT("pkcs8",d,b,e)}async function aZ(a,b,c){let d;if(!aj(a))throw TypeError("JWK must be an object");switch(b??=a.alg,d??=c?.extractable??a.ext,a.kty){case"oct":if("string"!=typeof a.k||!a.k)throw TypeError('missing "k" (Key Value) Parameter value');return q(a.k);case"RSA":if("oth"in a&&void 0!==a.oth)throw new D('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return aG({...a,alg:b,ext:d});case"AKP":if("string"!=typeof a.alg||!a.alg)throw TypeError('missing "alg" (Algorithm) Parameter value');if(void 0!==b&&b!==a.alg)throw TypeError("JWK alg and alg option value mismatch");return aG({...a,ext:d});case"EC":case"OKP":return aG({...a,alg:b,ext:d});default:throw new D('Unsupported "kty" (Key Type) Parameter value')}}async function a$(a){if(Q(a))if("secret"!==a.type)return a.export({format:"jwk"});else a=a.export();if(a instanceof Uint8Array)return{kty:"oct",k:r(a)};if(!P(a))throw TypeError(x(a,"CryptoKey","KeyObject","Uint8Array"));if(!a.extractable)throw TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:b,key_ops:c,alg:d,use:e,...f}=await crypto.subtle.exportKey("jwk",a);return"AKP"===f.kty&&(f.alg=d),f}async function a_(a){return aL("public","spki",a)}async function a0(a){return aL("private","pkcs8",a)}async function a1(a){return a$(a)}async function a2(a,b,c,d){let e=a.slice(0,7),f=await ad(e,c,b,d,new Uint8Array);return{encryptedKey:f.ciphertext,iv:r(f.iv),tag:r(f.tag)}}async function a3(a,b,c,d,e){return ae(a.slice(0,7),b,c,d,e,new Uint8Array)}let a4='Invalid or unsupported "alg" (JWE Algorithm) header value';function a5(a){if(void 0===a)throw new F("JWE Encrypted Key missing")}async function a6(a,b,c,d,e){switch(a){case"dir":if(void 0!==c)throw new F("Encountered unexpected JWE Encrypted Key");return b;case"ECDH-ES":if(void 0!==c)throw new F("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let e,f;if(!aj(d.epk))throw new F('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(O(b),!at(b))throw new D("ECDH with the provided key is not allowed or not supported by your javascript runtime");let g=await aZ(d.epk,a);if(O(g),void 0!==d.apu){if("string"!=typeof d.apu)throw new F('JOSE Header "apu" (Agreement PartyUInfo) invalid');e=ah(d.apu,"apu",F)}if(void 0!==d.apv){if("string"!=typeof d.apv)throw new F('JOSE Header "apv" (Agreement PartyVInfo) invalid');f=ah(d.apv,"apv",F)}let h=await as(g,b,"ECDH-ES"===a?d.enc:a,"ECDH-ES"===a?S(d.enc):parseInt(a.slice(-5,-2),10),e,f);if("ECDH-ES"===a)return h;return a5(c),ap(a.slice(-6),h,c)}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return a5(c),O(b),aE(a,b,c);case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{let f;if(a5(c),"number"!=typeof d.p2c)throw new F('JOSE Header "p2c" (PBES2 Count) missing or invalid');let g=e?.maxPBES2Count||1e4;if(d.p2c>g)throw new F('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if("string"!=typeof d.p2s)throw new F('JOSE Header "p2s" (PBES2 Salt) missing or invalid');return f=ah(d.p2s,"p2s",F),aw(a,b,c,d.p2c,f)}case"A128KW":case"A192KW":case"A256KW":return a5(c),ap(a,b,c);case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":if(a5(c),"string"!=typeof d.iv)throw new F('JOSE Header "iv" (Initialization Vector) missing or invalid');if("string"!=typeof d.tag)throw new F('JOSE Header "tag" (Authentication Tag) missing or invalid');return a3(a,b,c,ah(d.iv,"iv",F),ah(d.tag,"tag",F));default:throw new D(a4)}}async function a7(a,b,c,d,e={}){let f,g,h;switch(a){case"dir":h=c;break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let i;if(O(c),!at(c))throw new D("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:j,apv:k}=e;i=e.epk?await aJ(e.epk,a):(await crypto.subtle.generateKey(c.algorithm,!0,["deriveBits"])).privateKey;let{x:l,y:m,crv:n,kty:o}=await a1(i),p=await as(c,i,"ECDH-ES"===a?b:a,"ECDH-ES"===a?S(b):parseInt(a.slice(-5,-2),10),j,k);if(g={epk:{x:l,crv:n,kty:o}},"EC"===o&&(g.epk.y=m),j&&(g.apu=r(j)),k&&(g.apv=r(k)),"ECDH-ES"===a){h=p;break}h=d||T(b);let q=a.slice(-6);f=await ao(q,p,h);break}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":h=d||T(b),O(c),f=await aD(a,c,h);break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{h=d||T(b);let{p2c:i,p2s:j}=e;({encryptedKey:f,...g}=await av(a,c,h,i,j));break}case"A128KW":case"A192KW":case"A256KW":h=d||T(b),f=await ao(a,c,h);break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{h=d||T(b);let{iv:i}=e;({encryptedKey:f,...g}=await a2(a,c,h,i));break}default:throw new D(a4)}return{cek:h,encryptedKey:f,parameters:g}}function a8(a,b,c,d,e){let f;if(void 0!==e.crit&&d?.crit===void 0)throw new a('"crit" (Critical) Header Parameter MUST be integrity protected');if(!d||void 0===d.crit)return new Set;if(!Array.isArray(d.crit)||0===d.crit.length||d.crit.some(a=>"string"!=typeof a||0===a.length))throw new a('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');for(let g of(f=void 0!==c?new Map([...Object.entries(c),...b.entries()]):b,d.crit)){if(!f.has(g))throw new D(`Extension Header Parameter "${g}" is not recognized`);if(void 0===e[g])throw new a(`Extension Header Parameter "${g}" is missing`);if(f.get(g)&&void 0===d[g])throw new a(`Extension Header Parameter "${g}" MUST be integrity protected`)}return new Set(d.crit)}function a9(a,b){if(void 0!==b&&(!Array.isArray(b)||b.some(a=>"string"!=typeof a)))throw TypeError(`"${a}" option must be an array of strings`);if(b)return new Set(b)}let ba=a=>a?.[Symbol.toStringTag],bb=(a,b,c)=>{if(void 0!==b.use){let a;switch(c){case"sign":case"verify":a="sig";break;case"encrypt":case"decrypt":a="enc"}if(b.use!==a)throw TypeError(`Invalid key for this operation, its "use" must be "${a}" when present`)}if(void 0!==b.alg&&b.alg!==a)throw TypeError(`Invalid key for this operation, its "alg" must be "${a}" when present`);if(Array.isArray(b.key_ops)){let d;switch(!0){case"sign"===c||"verify"===c:case"dir"===a:case a.includes("CBC-HS"):d=c;break;case a.startsWith("PBES2"):d="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(a):d=!a.includes("GCM")&&a.endsWith("KW")?"encrypt"===c?"wrapKey":"unwrapKey":c;break;case"encrypt"===c&&a.startsWith("RSA"):d="wrapKey";break;case"decrypt"===c:d=a.startsWith("RSA")?"unwrapKey":"deriveBits"}if(d&&b.key_ops?.includes?.(d)===!1)throw TypeError(`Invalid key for this operation, its "key_ops" must include "${d}" when present`)}return!0};function bc(a,b,c){switch(a.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":((a,b,c)=>{if(!(b instanceof Uint8Array)){if(al(b)){let d;if("oct"===(d=b).kty&&"string"==typeof d.k&&bb(a,b,c))return;throw TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!R(b))throw TypeError(y(a,b,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if("secret"!==b.type)throw TypeError(`${ba(b)} instances for symmetric algorithms must be of type "secret"`)}})(a,b,c);break;default:((a,b,c)=>{if(al(b))switch(c){case"decrypt":case"sign":let d;if("oct"!==(d=b).kty&&("AKP"===d.kty&&"string"==typeof d.priv||"string"==typeof d.d)&&bb(a,b,c))return;throw TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":let e;if("oct"!==(e=b).kty&&void 0===e.d&&void 0===e.priv&&bb(a,b,c))return;throw TypeError("JSON Web Key for this operation must be a public JWK")}if(!R(b))throw TypeError(y(a,b,"CryptoKey","KeyObject","JSON Web Key"));if("secret"===b.type)throw TypeError(`${ba(b)} instances for asymmetric algorithms must not be of type "secret"`);if("public"===b.type)switch(c){case"sign":throw TypeError(`${ba(b)} instances for asymmetric algorithm signing must be of type "private"`);case"decrypt":throw TypeError(`${ba(b)} instances for asymmetric algorithm decryption must be of type "private"`)}if("private"===b.type)switch(c){case"verify":throw TypeError(`${ba(b)} instances for asymmetric algorithm verifying must be of type "public"`);case"encrypt":throw TypeError(`${ba(b)} instances for asymmetric algorithm encryption must be of type "public"`)}})(a,b,c)}}function bd(a){if(void 0===globalThis[a])throw new D(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${a} API.`)}async function be(a){bd("CompressionStream");let b=new CompressionStream("deflate-raw"),c=b.writable.getWriter();c.write(a).catch(()=>{}),c.close().catch(()=>{});let d=[],e=b.readable.getReader();for(;;){let{value:a,done:b}=await e.read();if(b)break;d.push(a)}return j(...d)}async function bf(a,b){bd("DecompressionStream");let c=new DecompressionStream("deflate-raw"),d=c.writable.getWriter();d.write(a).catch(()=>{}),d.close().catch(()=>{});let e=[],f=0,g=c.readable.getReader();for(;;){let{value:a,done:c}=await g.read();if(c)break;if(e.push(a),f+=a.byteLength,b!==1/0&&f>b)throw new F("Decompressed plaintext exceeded the configured limit")}return j(...e)}async function bg(a,b,c){let d,e,f,g,h,k;if(!aj(a))throw new F("Flattened JWE must be an object");if(void 0===a.protected&&void 0===a.header&&void 0===a.unprotected)throw new F("JOSE Header missing");if(void 0!==a.iv&&"string"!=typeof a.iv)throw new F("JWE Initialization Vector incorrect type");if("string"!=typeof a.ciphertext)throw new F("JWE Ciphertext missing or incorrect type");if(void 0!==a.tag&&"string"!=typeof a.tag)throw new F("JWE Authentication Tag incorrect type");if(void 0!==a.protected&&"string"!=typeof a.protected)throw new F("JWE Protected Header incorrect type");if(void 0!==a.encrypted_key&&"string"!=typeof a.encrypted_key)throw new F("JWE Encrypted Key incorrect type");if(void 0!==a.aad&&"string"!=typeof a.aad)throw new F("JWE AAD incorrect type");if(void 0!==a.header&&!aj(a.header))throw new F("JWE Shared Unprotected Header incorrect type");if(void 0!==a.unprotected&&!aj(a.unprotected))throw new F("JWE Per-Recipient Unprotected Header incorrect type");if(a.protected)try{let b=q(a.protected);d=JSON.parse(i.decode(b))}catch{throw new F("JWE Protected Header is invalid")}if(!ak(d,a.header,a.unprotected))throw new F("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let l={...d,...a.header,...a.unprotected};if(a8(F,new Map,c?.crit,d,l),void 0!==l.zip&&"DEF"!==l.zip)throw new D('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(void 0!==l.zip&&!d?.zip)throw new F('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:m,enc:o}=l;if("string"!=typeof m||!m)throw new F("missing JWE Algorithm (alg) in JWE Header");if("string"!=typeof o||!o)throw new F("missing JWE Encryption Algorithm (enc) in JWE Header");let p=c&&a9("keyManagementAlgorithms",c.keyManagementAlgorithms),r=c&&a9("contentEncryptionAlgorithms",c.contentEncryptionAlgorithms);if(p&&!p.has(m)||!p&&m.startsWith("PBES2"))throw new C('"alg" (Algorithm) Header Parameter value not allowed');if(r&&!r.has(o))throw new C('"enc" (Encryption Algorithm) Header Parameter value not allowed');void 0!==a.encrypted_key&&(e=ah(a.encrypted_key,"encrypted_key",F));let s=!1;"function"==typeof b&&(b=await b(d,a),s=!0),bc("dir"===m?o:m,b,"decrypt");let t=await aJ(b,m);try{f=await a6(m,t,e,l,c)}catch(a){if(a instanceof TypeError||a instanceof F||a instanceof D)throw a;f=T(o)}void 0!==a.iv&&(g=ah(a.iv,"iv",F)),void 0!==a.tag&&(h=ah(a.tag,"tag",F));let u=void 0!==a.protected?n(a.protected):new Uint8Array;k=void 0!==a.aad?j(u,n("."),n(a.aad)):u;let v=ah(a.ciphertext,"ciphertext",F),w=await ae(o,f,v,g,h,k),x={plaintext:w};if("DEF"===l.zip){let a=c?.maxDecompressedLength??25e4;if(0===a)throw new D('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(a!==1/0&&(!Number.isSafeInteger(a)||a<1))throw TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");x.plaintext=await bf(w,a).catch(a=>{if(a instanceof F)throw a;throw new F("Failed to decompress plaintext",{cause:a})})}return(void 0!==a.protected&&(x.protectedHeader=d),void 0!==a.aad&&(x.additionalAuthenticatedData=ah(a.aad,"aad",F)),void 0!==a.unprotected&&(x.sharedUnprotectedHeader=a.unprotected),void 0!==a.header&&(x.unprotectedHeader=a.header),s)?{...x,key:t}:x}async function bh(a,b,c){if(a instanceof Uint8Array&&(a=i.decode(a)),"string"!=typeof a)throw new F("Compact JWE must be a string or Uint8Array");let{0:d,1:e,2:f,3:g,4:h,length:j}=a.split(".");if(5!==j)throw new F("Invalid Compact JWE");let k=await bg({ciphertext:g,iv:f||void 0,protected:d,tag:h||void 0,encrypted_key:e||void 0},b,c),l={plaintext:k.plaintext,protectedHeader:k.protectedHeader};return"function"==typeof b?{...l,key:k.key}:l}async function bi(a,b,c){if(!aj(a))throw new F("General JWE must be an object");if(!Array.isArray(a.recipients)||!a.recipients.every(aj))throw new F("JWE Recipients missing or incorrect type");if(!a.recipients.length)throw new F("JWE Recipients has no members");for(let d of a.recipients)try{return await bg({aad:a.aad,ciphertext:a.ciphertext,encrypted_key:d.encrypted_key,header:d.header,iv:a.iv,protected:a.protected,tag:a.tag,unprotected:a.unprotected},b,c)}catch{}throw new E}class bj{#a;#b;#c;#d;#e;#f;#g;#h;constructor(a){if(!(a instanceof Uint8Array))throw TypeError("plaintext must be an instance of Uint8Array");this.#a=a}setKeyManagementParameters(a){return ag(this.#h,"setKeyManagementParameters"),this.#h=a,this}setProtectedHeader(a){return ag(this.#b,"setProtectedHeader"),this.#b=a,this}setSharedUnprotectedHeader(a){return ag(this.#c,"setSharedUnprotectedHeader"),this.#c=a,this}setUnprotectedHeader(a){return ag(this.#d,"setUnprotectedHeader"),this.#d=a,this}setAdditionalAuthenticatedData(a){return this.#e=a,this}setContentEncryptionKey(a){return ag(this.#f,"setContentEncryptionKey"),this.#f=a,this}setInitializationVector(a){return ag(this.#g,"setInitializationVector"),this.#g=a,this}async encrypt(a,b){let c,d,e,f,g,h;if(!this.#b&&!this.#d&&!this.#c)throw new F("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!ak(this.#b,this.#d,this.#c))throw new F("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let i={...this.#b,...this.#d,...this.#c};if(a8(F,new Map,b?.crit,this.#b,i),void 0!==i.zip&&"DEF"!==i.zip)throw new D('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(void 0!==i.zip&&!this.#b?.zip)throw new F('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:k,enc:l}=i;if("string"!=typeof k||!k)throw new F('JWE "alg" (Algorithm) Header Parameter missing or invalid');if("string"!=typeof l||!l)throw new F('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(this.#f&&("dir"===k||"ECDH-ES"===k))throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${k}`);bc("dir"===k?l:k,a,"encrypt");{let e,f=await aJ(a,k);({cek:d,encryptedKey:c,parameters:e}=await a7(k,l,f,this.#f,this.#h)),e&&(b&&af in b?this.#d?this.#d={...this.#d,...e}:this.setUnprotectedHeader(e):this.#b?this.#b={...this.#b,...e}:this.setProtectedHeader(e))}if(this.#b?g=n(f=r(JSON.stringify(this.#b))):(f="",g=new Uint8Array),this.#e){let a=n(h=r(this.#e));e=j(g,n("."),a)}else e=g;let m=this.#a;"DEF"===i.zip&&(m=await be(m).catch(a=>{throw new F("Failed to compress plaintext",{cause:a})}));let{ciphertext:o,tag:p,iv:q}=await ad(l,m,d,this.#g,e),s={ciphertext:r(o)};return q&&(s.iv=r(q)),p&&(s.tag=r(p)),c&&(s.encrypted_key=r(c)),h&&(s.aad=h),this.#b&&(s.protected=f),this.#c&&(s.unprotected=this.#c),this.#d&&(s.header=this.#d),s}}class bk{#i;unprotectedHeader;keyManagementParameters;key;options;constructor(a,b,c){this.#i=a,this.key=b,this.options=c}setUnprotectedHeader(a){return ag(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=a,this}setKeyManagementParameters(a){return ag(this.keyManagementParameters,"setKeyManagementParameters"),this.keyManagementParameters=a,this}addRecipient(...a){return this.#i.addRecipient(...a)}encrypt(...a){return this.#i.encrypt(...a)}done(){return this.#i}}class bl{#a;#j=[];#b;#d;#e;constructor(a){this.#a=a}addRecipient(a,b){let c=new bk(this,a,{crit:b?.crit});return this.#j.push(c),c}setProtectedHeader(a){return ag(this.#b,"setProtectedHeader"),this.#b=a,this}setSharedUnprotectedHeader(a){return ag(this.#d,"setSharedUnprotectedHeader"),this.#d=a,this}setAdditionalAuthenticatedData(a){return this.#e=a,this}async encrypt(){let a;if(!this.#j.length)throw new F("at least one recipient must be added");if(1===this.#j.length){let[a]=this.#j,b=await new bj(this.#a).setAdditionalAuthenticatedData(this.#e).setProtectedHeader(this.#b).setSharedUnprotectedHeader(this.#d).setUnprotectedHeader(a.unprotectedHeader).encrypt(a.key,{...a.options}),c={ciphertext:b.ciphertext,iv:b.iv,recipients:[{}],tag:b.tag};return b.aad&&(c.aad=b.aad),b.protected&&(c.protected=b.protected),b.unprotected&&(c.unprotected=b.unprotected),b.encrypted_key&&(c.recipients[0].encrypted_key=b.encrypted_key),b.header&&(c.recipients[0].header=b.header),c}for(let b=0;b<this.#j.length;b++){let c=this.#j[b];if(!ak(this.#b,this.#d,c.unprotectedHeader))throw new F("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let d={...this.#b,...this.#d,...c.unprotectedHeader},{alg:e}=d;if("string"!=typeof e||!e)throw new F('JWE "alg" (Algorithm) Header Parameter missing or invalid');if("dir"===e||"ECDH-ES"===e)throw new F('"dir" and "ECDH-ES" alg may only be used with a single recipient');if("string"!=typeof d.enc||!d.enc)throw new F('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(a){if(a!==d.enc)throw new F('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}else a=d.enc;if(a8(F,new Map,c.options.crit,this.#b,d),void 0!==d.zip&&"DEF"!==d.zip)throw new D('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(void 0!==d.zip&&!this.#b?.zip)throw new F('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}let b=T(a),c={ciphertext:"",recipients:[]};for(let d=0;d<this.#j.length;d++){let e=this.#j[d],f={};if(c.recipients.push(f),0===d){let a=await new bj(this.#a).setAdditionalAuthenticatedData(this.#e).setContentEncryptionKey(b).setProtectedHeader(this.#b).setSharedUnprotectedHeader(this.#d).setUnprotectedHeader(e.unprotectedHeader).setKeyManagementParameters(e.keyManagementParameters).encrypt(e.key,{...e.options,[af]:!0});c.ciphertext=a.ciphertext,c.iv=a.iv,c.tag=a.tag,a.aad&&(c.aad=a.aad),a.protected&&(c.protected=a.protected),a.unprotected&&(c.unprotected=a.unprotected),f.encrypted_key=a.encrypted_key,a.header&&(f.header=a.header);continue}let g=e.unprotectedHeader?.alg||this.#b?.alg||this.#d?.alg;bc("dir"===g?a:g,e.key,"encrypt");let h=await aJ(e.key,g),{encryptedKey:i,parameters:j}=await a7(g,a,h,b,e.keyManagementParameters);f.encrypted_key=r(i),(e.unprotectedHeader||j)&&(f.header={...e.unprotectedHeader,...j})}return c}}async function bm(a,b,c){if(!aj(a))throw new G("Flattened JWS must be an object");if(void 0===a.protected&&void 0===a.header)throw new G('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==a.protected&&"string"!=typeof a.protected)throw new G("JWS Protected Header incorrect type");if(void 0===a.payload)throw new G("JWS Payload missing");if("string"!=typeof a.signature)throw new G("JWS Signature missing or incorrect type");if(void 0!==a.header&&!aj(a.header))throw new G("JWS Unprotected Header incorrect type");let d={};if(a.protected)try{let b=q(a.protected);d=JSON.parse(i.decode(b))}catch{throw new G("JWS Protected Header is invalid")}if(!ak(d,a.header))throw new G("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let e={...d,...a.header},f=a8(G,new Map([["b64",!0]]),c?.crit,d,e),g=!0;if(f.has("b64")&&"boolean"!=typeof(g=d.b64))throw new G('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:k}=e;if("string"!=typeof k||!k)throw new G('JWS "alg" (Algorithm) Header Parameter missing or invalid');let l=c&&a9("algorithms",c.algorithms);if(l&&!l.has(k))throw new C('"alg" (Algorithm) Header Parameter value not allowed');if(g){if("string"!=typeof a.payload)throw new G("JWS Payload must be a string")}else if("string"!=typeof a.payload&&!(a.payload instanceof Uint8Array))throw new G("JWS Payload must be a string or an Uint8Array instance");let m=!1;"function"==typeof b&&(b=await b(d,a),m=!0),bc(k,b,"verify");let o=j(void 0!==a.protected?n(a.protected):new Uint8Array,n("."),"string"==typeof a.payload?g?n(a.payload):h.encode(a.payload):a.payload),p=ah(a.signature,"signature",G),r=await aJ(b,k);if(!await aB(k,r,p,o))throw new N;let s={payload:g?ah(a.payload,"payload",G):"string"==typeof a.payload?h.encode(a.payload):a.payload};return(void 0!==a.protected&&(s.protectedHeader=d),void 0!==a.header&&(s.unprotectedHeader=a.header),m)?{...s,key:r}:s}async function bn(a,b,c){if(a instanceof Uint8Array&&(a=i.decode(a)),"string"!=typeof a)throw new G("Compact JWS must be a string or Uint8Array");let{0:d,1:e,2:f,length:g}=a.split(".");if(3!==g)throw new G("Invalid Compact JWS");let h=await bm({payload:e,protected:d,signature:f},b,c),j={payload:h.payload,protectedHeader:h.protectedHeader};return"function"==typeof b?{...j,key:h.key}:j}async function bo(a,b,c){if(!aj(a))throw new G("General JWS must be an object");if(!Array.isArray(a.signatures)||!a.signatures.every(aj))throw new G("JWS Signatures missing or incorrect type");for(let d of a.signatures)try{return await bm({header:d.header,payload:a.payload,protected:d.protected,signature:d.signature},b,c)}catch{}throw new N}let bp=a=>Math.floor(a.getTime()/1e3),bq=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;function br(a){let b,c=bq.exec(a);if(!c||c[4]&&c[1])throw TypeError("Invalid time period format");let d=parseFloat(c[2]);switch(c[3].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":b=Math.round(d);break;case"minute":case"minutes":case"min":case"mins":case"m":b=Math.round(60*d);break;case"hour":case"hours":case"hr":case"hrs":case"h":b=Math.round(3600*d);break;case"day":case"days":case"d":b=Math.round(86400*d);break;case"week":case"weeks":case"w":b=Math.round(604800*d);break;default:b=Math.round(0x1e187e0*d)}return"-"===c[1]||"ago"===c[4]?-b:b}function bs(a,b){if(!Number.isFinite(b))throw TypeError(`Invalid ${a} input`);return b}let bt=a=>a.includes("/")?a.toLowerCase():`application/${a.toLowerCase()}`;function bu(a,b,c={}){var d,e;let f,g;try{f=JSON.parse(i.decode(b))}catch{}if(!aj(f))throw new H("JWT Claims Set must be a top-level JSON object");let{typ:h}=c;if(h&&("string"!=typeof a.typ||bt(a.typ)!==bt(h)))throw new A('unexpected "typ" JWT header value',f,"typ","check_failed");let{requiredClaims:j=[],issuer:k,subject:l,audience:m,maxTokenAge:n}=c,o=[...j];for(let a of(void 0!==n&&o.push("iat"),void 0!==m&&o.push("aud"),void 0!==l&&o.push("sub"),void 0!==k&&o.push("iss"),new Set(o.reverse())))if(!(a in f))throw new A(`missing required "${a}" claim`,f,a,"missing");if(k&&!(Array.isArray(k)?k:[k]).includes(f.iss))throw new A('unexpected "iss" claim value',f,"iss","check_failed");if(l&&f.sub!==l)throw new A('unexpected "sub" claim value',f,"sub","check_failed");if(m&&(d=f.aud,e="string"==typeof m?[m]:m,"string"==typeof d?!e.includes(d):!(Array.isArray(d)&&e.some(Set.prototype.has.bind(new Set(d))))))throw new A('unexpected "aud" claim value',f,"aud","check_failed");switch(typeof c.clockTolerance){case"string":g=br(c.clockTolerance);break;case"number":g=c.clockTolerance;break;case"undefined":g=0;break;default:throw TypeError("Invalid clockTolerance option type")}let{currentDate:p}=c,q=bp(p||new Date);if((void 0!==f.iat||n)&&"number"!=typeof f.iat)throw new A('"iat" claim must be a number',f,"iat","invalid");if(void 0!==f.nbf){if("number"!=typeof f.nbf)throw new A('"nbf" claim must be a number',f,"nbf","invalid");if(f.nbf>q+g)throw new A('"nbf" claim timestamp check failed',f,"nbf","check_failed")}if(void 0!==f.exp){if("number"!=typeof f.exp)throw new A('"exp" claim must be a number',f,"exp","invalid");if(f.exp<=q-g)throw new B('"exp" claim timestamp check failed',f,"exp","check_failed")}if(n){let a=q-f.iat;if(a-g>("number"==typeof n?n:br(n)))throw new B('"iat" claim timestamp check failed (too far in the past)',f,"iat","check_failed");if(a<0-g)throw new A('"iat" claim timestamp check failed (it should be in the past)',f,"iat","check_failed")}return f}class bv{#k;constructor(a){if(!aj(a))throw TypeError("JWT Claims Set MUST be an object");this.#k=structuredClone(a)}data(){return h.encode(JSON.stringify(this.#k))}get iss(){return this.#k.iss}set iss(a){this.#k.iss=a}get sub(){return this.#k.sub}set sub(a){this.#k.sub=a}get aud(){return this.#k.aud}set aud(a){this.#k.aud=a}set jti(a){this.#k.jti=a}set nbf(a){"number"==typeof a?this.#k.nbf=bs("setNotBefore",a):a instanceof Date?this.#k.nbf=bs("setNotBefore",bp(a)):this.#k.nbf=bp(new Date)+br(a)}set exp(a){"number"==typeof a?this.#k.exp=bs("setExpirationTime",a):a instanceof Date?this.#k.exp=bs("setExpirationTime",bp(a)):this.#k.exp=bp(new Date)+br(a)}set iat(a){void 0===a?this.#k.iat=bp(new Date):a instanceof Date?this.#k.iat=bs("setIssuedAt",bp(a)):"string"==typeof a?this.#k.iat=bs("setIssuedAt",bp(new Date)+br(a)):this.#k.iat=bs("setIssuedAt",a)}}async function bw(a,b,c){let d=await bn(a,b,c);if(d.protectedHeader.crit?.includes("b64")&&!1===d.protectedHeader.b64)throw new H("JWTs MUST NOT use unencoded payload");let e={payload:bu(d.protectedHeader,d.payload,c),protectedHeader:d.protectedHeader};return"function"==typeof b?{...e,key:d.key}:e}async function bx(a,b,c){let d=await bh(a,b,c),e=bu(d.protectedHeader,d.plaintext,c),{protectedHeader:f}=d;if(void 0!==f.iss&&f.iss!==e.iss)throw new A('replicated "iss" claim header parameter mismatch',e,"iss","mismatch");if(void 0!==f.sub&&f.sub!==e.sub)throw new A('replicated "sub" claim header parameter mismatch',e,"sub","mismatch");if(void 0!==f.aud&&JSON.stringify(f.aud)!==JSON.stringify(e.aud))throw new A('replicated "aud" claim header parameter mismatch',e,"aud","mismatch");let g={payload:e,protectedHeader:f};return"function"==typeof b?{...g,key:d.key}:g}class by{#l;constructor(a){this.#l=new bj(a)}setContentEncryptionKey(a){return this.#l.setContentEncryptionKey(a),this}setInitializationVector(a){return this.#l.setInitializationVector(a),this}setProtectedHeader(a){return this.#l.setProtectedHeader(a),this}setKeyManagementParameters(a){return this.#l.setKeyManagementParameters(a),this}async encrypt(a,b){let c=await this.#l.encrypt(a,b);return[c.protected,c.encrypted_key,c.iv,c.ciphertext,c.tag].join(".")}}class bz{#k;#b;#d;constructor(a){if(!(a instanceof Uint8Array))throw TypeError("payload must be an instance of Uint8Array");this.#k=a}setProtectedHeader(a){return ag(this.#b,"setProtectedHeader"),this.#b=a,this}setUnprotectedHeader(a){return ag(this.#d,"setUnprotectedHeader"),this.#d=a,this}async sign(a,b){let c,d,e,f;if(!this.#b&&!this.#d)throw new G("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!ak(this.#b,this.#d))throw new G("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let g={...this.#b,...this.#d},h=a8(G,new Map([["b64",!0]]),b?.crit,this.#b,g),i=!0;if(h.has("b64")&&"boolean"!=typeof(i=this.#b.b64))throw new G('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:k}=g;if("string"!=typeof k||!k)throw new G('JWS "alg" (Algorithm) Header Parameter missing or invalid');bc(k,a,"sign"),i?d=n(c=r(this.#k)):(d=this.#k,c=""),this.#b?f=n(e=r(JSON.stringify(this.#b))):(e="",f=new Uint8Array);let l=j(f,n("."),d),m=await aJ(a,k),o={signature:r(await aA(k,m,l)),payload:c};return this.#d&&(o.header=this.#d),this.#b&&(o.protected=e),o}}class bA{#l;constructor(a){this.#l=new bz(a)}setProtectedHeader(a){return this.#l.setProtectedHeader(a),this}async sign(a,b){let c=await this.#l.sign(a,b);if(void 0===c.payload)throw TypeError("use the flattened module for creating JWS with b64: false");return`${c.protected}.${c.payload}.${c.signature}`}}class bB{#i;protectedHeader;unprotectedHeader;options;key;constructor(a,b,c){this.#i=a,this.key=b,this.options=c}setProtectedHeader(a){return ag(this.protectedHeader,"setProtectedHeader"),this.protectedHeader=a,this}setUnprotectedHeader(a){return ag(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=a,this}addSignature(...a){return this.#i.addSignature(...a)}sign(...a){return this.#i.sign(...a)}done(){return this.#i}}class bC{#k;#m=[];constructor(a){this.#k=a}addSignature(a,b){let c=new bB(this,a,b);return this.#m.push(c),c}async sign(){if(!this.#m.length)throw new G("at least one signature must be added");let a={signatures:[],payload:""};for(let b=0;b<this.#m.length;b++){let c=this.#m[b],d=new bz(this.#k);d.setProtectedHeader(c.protectedHeader),d.setUnprotectedHeader(c.unprotectedHeader);let{payload:e,...f}=await d.sign(c.key,c.options);if(0===b)a.payload=e;else if(a.payload!==e)throw new G("inconsistent use of JWS Unencoded Payload (RFC7797)");a.signatures.push(f)}return a}}class bD{#b;#n;constructor(a={}){this.#n=new bv(a)}setIssuer(a){return this.#n.iss=a,this}setSubject(a){return this.#n.sub=a,this}setAudience(a){return this.#n.aud=a,this}setJti(a){return this.#n.jti=a,this}setNotBefore(a){return this.#n.nbf=a,this}setExpirationTime(a){return this.#n.exp=a,this}setIssuedAt(a){return this.#n.iat=a,this}setProtectedHeader(a){return this.#b=a,this}async sign(a,b){let c=new bA(this.#n.data());if(c.setProtectedHeader(this.#b),Array.isArray(this.#b?.crit)&&this.#b.crit.includes("b64")&&!1===this.#b.b64)throw new H("JWTs MUST NOT use unencoded payload");return c.sign(a,b)}}class bE{#f;#g;#h;#b;#o;#p;#q;#n;constructor(a={}){this.#n=new bv(a)}setIssuer(a){return this.#n.iss=a,this}setSubject(a){return this.#n.sub=a,this}setAudience(a){return this.#n.aud=a,this}setJti(a){return this.#n.jti=a,this}setNotBefore(a){return this.#n.nbf=a,this}setExpirationTime(a){return this.#n.exp=a,this}setIssuedAt(a){return this.#n.iat=a,this}setProtectedHeader(a){return ag(this.#b,"setProtectedHeader"),this.#b=a,this}setKeyManagementParameters(a){return ag(this.#h,"setKeyManagementParameters"),this.#h=a,this}setContentEncryptionKey(a){return ag(this.#f,"setContentEncryptionKey"),this.#f=a,this}setInitializationVector(a){return ag(this.#g,"setInitializationVector"),this.#g=a,this}replicateIssuerAsHeader(){return this.#o=!0,this}replicateSubjectAsHeader(){return this.#p=!0,this}replicateAudienceAsHeader(){return this.#q=!0,this}async encrypt(a,b){let c=new by(this.#n.data());return this.#b&&(this.#o||this.#p||this.#q)&&(this.#b={...this.#b,iss:this.#o?this.#n.iss:void 0,sub:this.#p?this.#n.sub:void 0,aud:this.#q?this.#n.aud:void 0}),c.setProtectedHeader(this.#b),this.#g&&c.setInitializationVector(this.#g),this.#f&&c.setContentEncryptionKey(this.#f),this.#h&&c.setKeyManagementParameters(this.#h),c.encrypt(a,b)}}let bF=(a,b)=>{if("string"!=typeof a||!a)throw new I(`${b} missing or invalid`)};async function bG(a,b){let c,d;if(al(a))c=a;else if(R(a))c=await a1(a);else throw TypeError(x(a,"CryptoKey","KeyObject","JSON Web Key"));if("sha256"!==(b??="sha256")&&"sha384"!==b&&"sha512"!==b)throw TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');switch(c.kty){case"AKP":bF(c.alg,'"alg" (Algorithm) Parameter'),bF(c.pub,'"pub" (Public key) Parameter'),d={alg:c.alg,kty:c.kty,pub:c.pub};break;case"EC":bF(c.crv,'"crv" (Curve) Parameter'),bF(c.x,'"x" (X Coordinate) Parameter'),bF(c.y,'"y" (Y Coordinate) Parameter'),d={crv:c.crv,kty:c.kty,x:c.x,y:c.y};break;case"OKP":bF(c.crv,'"crv" (Subtype of Key Pair) Parameter'),bF(c.x,'"x" (Public Key) Parameter'),d={crv:c.crv,kty:c.kty,x:c.x};break;case"RSA":bF(c.e,'"e" (Exponent) Parameter'),bF(c.n,'"n" (Modulus) Parameter'),d={e:c.e,kty:c.kty,n:c.n};break;case"oct":bF(c.k,'"k" (Key Value) Parameter'),d={k:c.k,kty:c.kty};break;default:throw new D('"kty" (Key Type) Parameter missing or unsupported')}let e=n(JSON.stringify(d));return r(await ai(b,e))}async function bH(a,b){b??="sha256";let c=await bG(a,b);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${b.slice(-3)}:${c}`}async function bI(a,b){let c={...a,...b?.header};if(!aj(c.jwk))throw new G('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let d=await aZ({...c.jwk,ext:!0},c.alg);if(d instanceof Uint8Array||"public"!==d.type)throw new G('"jwk" (JSON Web Key) Header Parameter must be a public key');return d}function bJ(a){return aj(a)}class bK{#r;#s=new WeakMap;constructor(a){if(!function(a){return a&&"object"==typeof a&&Array.isArray(a.keys)&&a.keys.every(bJ)}(a))throw new J("JSON Web Key Set malformed");this.#r=structuredClone(a)}jwks(){return this.#r}async getKey(a,b){let{alg:c,kid:d}={...a,...b?.header},e=function(a){switch("string"==typeof a&&a.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new D('Unsupported "alg" value for a JSON Web Key Set')}}(c),f=this.#r.keys.filter(a=>{let b=e===a.kty;if(b&&"string"==typeof d&&(b=d===a.kid),b&&("string"==typeof a.alg||"AKP"===e)&&(b=c===a.alg),b&&"string"==typeof a.use&&(b="sig"===a.use),b&&Array.isArray(a.key_ops)&&(b=a.key_ops.includes("verify")),b)switch(c){case"ES256":b="P-256"===a.crv;break;case"ES384":b="P-384"===a.crv;break;case"ES512":b="P-521"===a.crv;break;case"Ed25519":case"EdDSA":b="Ed25519"===a.crv}return b}),{0:g,length:h}=f;if(0===h)throw new K;if(1!==h){let a=new L,b=this.#s;throw a[Symbol.asyncIterator]=async function*(){for(let a of f)try{yield await bL(b,a,c)}catch{}},a}return bL(this.#s,g,c)}}async function bL(a,b,c){let d=a.get(b)||a.set(b,{}).get(b);if(void 0===d[c]){let a=await aZ({...b,ext:!0},c);if(a instanceof Uint8Array||"public"!==a.type)throw new J("JSON Web Key Set members must be public keys");d[c]=a}return d[c]}function bM(a){let b=new bK(a),c=async(a,c)=>b.getKey(a,c);return Object.defineProperties(c,{jwks:{value:()=>structuredClone(b.jwks()),enumerable:!1,configurable:!1,writable:!1}}),c}"undefined"!=typeof navigator&&navigator.userAgent?.startsWith?.("Mozilla/5.0 ")||(e="jose/v6.2.3");let bN=Symbol();async function bO(a,b,c,d=fetch){let e=await d(a,{method:"GET",signal:c,redirect:"manual",headers:b}).catch(a=>{if("TimeoutError"===a.name)throw new M;throw a});if(200!==e.status)throw new z("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await e.json()}catch{throw new z("Failed to parse the JSON Web Key Set HTTP response as JSON")}}let bP=Symbol();class bQ{#t;#u;#v;#w;#x;#y;#z;#A;#B;#C;constructor(a,b){if(!(a instanceof URL))throw TypeError("url must be an instance of URL");this.#t=new URL(a.href),this.#u="number"==typeof b?.timeoutDuration?b?.timeoutDuration:5e3,this.#v="number"==typeof b?.cooldownDuration?b?.cooldownDuration:3e4,this.#w="number"==typeof b?.cacheMaxAge?b?.cacheMaxAge:6e5,this.#z=new Headers(b?.headers),e&&!this.#z.has("User-Agent")&&this.#z.set("User-Agent",e),this.#z.has("accept")||(this.#z.set("accept","application/json"),this.#z.append("accept","application/jwk-set+json")),this.#A=b?.[bN],b?.[bP]!==void 0&&(this.#C=b?.[bP],function(a,b){return!("object"!=typeof a||null===a||!("uat"in a)||"number"!=typeof a.uat||Date.now()-a.uat>=b)&&"jwks"in a&&!!aj(a.jwks)&&!!Array.isArray(a.jwks.keys)&&!!Array.prototype.every.call(a.jwks.keys,aj)}(b?.[bP],this.#w)&&(this.#x=this.#C.uat,this.#B=bM(this.#C.jwks)))}pendingFetch(){return!!this.#y}coolingDown(){return"number"==typeof this.#x&&Date.now()<this.#x+this.#v}fresh(){return"number"==typeof this.#x&&Date.now()<this.#x+this.#w}jwks(){return this.#B?.jwks()}async getKey(a,b){this.#B&&this.fresh()||await this.reload();try{return await this.#B(a,b)}catch(c){if(c instanceof K&&!1===this.coolingDown())return await this.reload(),this.#B(a,b);throw c}}async reload(){this.#y&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&(this.#y=void 0),this.#y||=bO(this.#t.href,this.#z,AbortSignal.timeout(this.#u),this.#A).then(a=>{this.#B=bM(a),this.#C&&(this.#C.uat=Date.now(),this.#C.jwks=a),this.#x=Date.now(),this.#y=void 0}).catch(a=>{throw this.#y=void 0,a}),await this.#y}}function bR(a,b){let c=new bQ(a,b),d=async(a,b)=>c.getKey(a,b);return Object.defineProperties(d,{coolingDown:{get:()=>c.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>c.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>c.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>c.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>c.jwks(),enumerable:!0,configurable:!1,writable:!1}}),d}class bS{#n;constructor(a={}){this.#n=new bv(a)}encode(){let a=r(JSON.stringify({alg:"none"})),b=r(this.#n.data());return`${a}.${b}.`}setIssuer(a){return this.#n.iss=a,this}setSubject(a){return this.#n.sub=a,this}setAudience(a){return this.#n.aud=a,this}setJti(a){return this.#n.jti=a,this}setNotBefore(a){return this.#n.nbf=a,this}setExpirationTime(a){return this.#n.exp=a,this}setIssuedAt(a){return this.#n.iat=a,this}static decode(a,b){let c;if("string"!=typeof a)throw new H("Unsecured JWT must be a string");let{0:d,1:e,2:f,length:g}=a.split(".");if(3!==g||""!==f)throw new H("Invalid Unsecured JWT");try{if(c=JSON.parse(i.decode(q(d))),"none"!==c.alg)throw Error()}catch{throw new H("Invalid Unsecured JWT")}return{payload:bu(c,q(e),b),header:c}}}function bT(a){let b;if("string"==typeof a){let c=a.split(".");(3===c.length||5===c.length)&&([b]=c)}else if("object"==typeof a&&a)if("protected"in a)b=a.protected;else throw TypeError("Token does not contain a Protected Header");try{if("string"!=typeof b||!b)throw Error();let a=JSON.parse(i.decode(q(b)));if(!aj(a))throw Error();return a}catch{throw TypeError("Invalid Token or Protected Header formatting")}}function bU(a){let b,c;if("string"!=typeof a)throw new H("JWTs must use Compact JWS serialization, JWT must be a string");let{1:d,length:e}=a.split(".");if(5===e)throw new H("Only JWTs using Compact JWS serialization can be decoded");if(3!==e)throw new H("Invalid JWT");if(!d)throw new H("JWTs must contain a payload");try{b=q(d)}catch{throw new H("Failed to base64url decode the payload")}try{c=JSON.parse(i.decode(b))}catch{throw new H("Failed to parse the decoded payload as JSON")}if(!aj(c))throw new H("Invalid JWT Claims Set");return c}function bV(a){let b=a?.modulusLength??2048;if("number"!=typeof b||b<2048)throw new D("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return b}async function bW(a,b){let c,d;switch(a){case"PS256":case"PS384":case"PS512":c={name:"RSA-PSS",hash:`SHA-${a.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:bV(b)},d=["sign","verify"];break;case"RS256":case"RS384":case"RS512":c={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${a.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:bV(b)},d=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":c={name:"RSA-OAEP",hash:`SHA-${parseInt(a.slice(-3),10)||1}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:bV(b)},d=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":c={name:"ECDSA",namedCurve:"P-256"},d=["sign","verify"];break;case"ES384":c={name:"ECDSA",namedCurve:"P-384"},d=["sign","verify"];break;case"ES512":c={name:"ECDSA",namedCurve:"P-521"},d=["sign","verify"];break;case"Ed25519":case"EdDSA":d=["sign","verify"],c={name:"Ed25519"};break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":d=["sign","verify"],c={name:a};break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{d=["deriveBits"];let a=b?.crv??"P-256";switch(a){case"P-256":case"P-384":case"P-521":c={name:"ECDH",namedCurve:a};break;case"X25519":c={name:"X25519"};break;default:throw new D("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}break}default:throw new D('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(c,b?.extractable??!1,d)}async function bX(a,b){let c,d,e;switch(a){case"HS256":case"HS384":case"HS512":c=parseInt(a.slice(-3),10),d={name:"HMAC",hash:`SHA-${c}`,length:c},e=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return c=parseInt(a.slice(-3),10),crypto.getRandomValues(new Uint8Array(c>>3));case"A128KW":case"A192KW":case"A256KW":d={name:"AES-KW",length:c=parseInt(a.slice(1,4),10)},e=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":d={name:"AES-GCM",length:c=parseInt(a.slice(1,4),10)},e=["encrypt","decrypt"];break;default:throw new D('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(d,b?.extractable??!1,e)}let bY="WebCryptoAPI"}};