https://gaiafamily.com/en-us/_next/static/chunks/9951-29e047db948b5efa.js?dpl=dpl_CJPurkrPeaL5jw4oF8DS75wyXHbC

1try{let e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},t=(new e.Error).stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="461deff4-fcd0-4a9e-8385-e71360f4f844",e._sentryDebugIdIdentifier="sentry-dbid-461deff4-fcd0-4a9e-8385-e71360f4f844")}catch(e){}{let e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{};e._sentryModuleMetadata=e._sentryModuleMetadata||{},e._sentryModuleMetadata[new e.Error().stack]=Object.assign({},e._sentryModuleMetadata[new e.Error().stack],{"_sentryBundlerPluginAppKey:gaia-app":!0})}(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[9951],{935:(e,t)=>{"use strict";function r(e,t,r){n(e,t),t.set(e,r)}function n(e,t){if(t.has(e))throw TypeError("Cannot initialize the same private elements twice on an object")}function a(e,t){return e.get(o(e,t))}function i(e,t,r){return e.set(o(e,t),r),r}function o(e,t,r){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:r;throw TypeError("Private element is not present on this object")}Object.defineProperty(t,"__esModule",{value:!0}),t.SessionStore=void 0,t.defaultCookies=function(e){let t=e?"__Secure-":"";return{sessionToken:{name:`${t}next-auth.session-token`,options:{httpOnly:!0,sameSite:"lax",path:"/",secure:e}},callbackUrl:{name:`${t}next-auth.callback-url`,options:{httpOnly:!0,sameSite:"lax",path:"/",secure:e}},csrfToken:{name:`${e?"__Host-":""}next-auth.csrf-token`,options:{httpOnly:!0,sameSite:"lax",path:"/",secure:e}},pkceCodeVerifier:{name:`${t}next-auth.pkce.code_verifier`,options:{httpOnly:!0,sameSite:"lax",path:"/",secure:e,maxAge:900}},state:{name:`${t}next-auth.state`,options:{httpOnly:!0,sameSite:"lax",path:"/",secure:e,maxAge:900}},nonce:{name:`${t}next-auth.nonce`,options:{httpOnly:!0,sameSite:"lax",path:"/",secure:e}}}};var s=new WeakMap,c=new WeakMap,d=new WeakMap,l=new WeakSet;class u{constructor(e,t,o){!function(e,t){n(e,t),t.add(e)}(this,l),r(this,s,{}),r(this,c,void 0),r(this,d,void 0),i(d,this,o),i(c,this,e);let{cookies:u}=t,{name:p}=e;if("function"==typeof(null==u?void 0:u.getAll))for(let{name:e,value:t}of u.getAll())e.startsWith(p)&&(a(s,this)[e]=t);else if(u instanceof Map)for(let e of u.keys())e.startsWith(p)&&(a(s,this)[e]=u.get(e));else for(let e in u)e.startsWith(p)&&(a(s,this)[e]=u[e])}get value(){return Object.keys(a(s,this)).sort((e,t)=>{var r,n;return parseInt(null!=(r=e.split(".").pop())?r:"0")-parseInt(null!=(n=t.split(".").pop())?n:"0")}).map(e=>a(s,this)[e]).join("")}chunk(e,t){let r=o(l,this,h).call(this);for(let n of o(l,this,p).call(this,{name:a(c,this).name,value:e,options:{...a(c,this).options,...t}}))r[n.name]=n;return Object.values(r)}clean(){return Object.values(o(l,this,h).call(this))}}function p(e){let t=Math.ceil(e.value.length/3933);if(1===t)return a(s,this)[e.name]=e.value,[e];let r=[];for(let n=0;n<t;n++){let t=`${e.name}.${n}`,i=e.value.substr(3933*n,3933);r.push({...e,name:t,value:i}),a(s,this)[t]=i}return a(d,this).debug("CHUNKING_SESSION_COOKIE",{message:"Session cookie exceeds allowed 4096 bytes.",emptyCookieSize:163,valueSize:e.value.length,chunks:r.map(e=>e.value.length+163)}),r}function h(){let e={};for(let r in a(s,this)){var t;null==(t=a(s,this))||delete t[r],e[r]={name:r,value:"",options:{...a(c,this).options,maxAge:0}}}return e}t.SessionStore=u},8947:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.URL=t.DNS=t.stringToBytes=void 0;let n=r(50042),a=r(91180);function i(e){let t=new Uint8Array((e=unescape(encodeURIComponent(e))).length);for(let r=0;r<e.length;++r)t[r]=e.charCodeAt(r);return t}t.stringToBytes=i,t.DNS="6ba7b810-9dad-11d1-80b4-00c04fd430c8",t.URL="6ba7b811-9dad-11d1-80b4-00c04fd430c8",t.default=function(e,t,r,o,s,c){let d="string"==typeof r?i(r):r,l="string"==typeof o?(0,n.default)(o):o;if("string"==typeof o&&(o=(0,n.default)(o)),o?.length!==16)throw TypeError("Namespace must be array-like (16 iterable integer values, 0-255)");let u=new Uint8Array(16+d.length);if(u.set(l),u.set(d,l.length),(u=t(u))[6]=15&u[6]|e,u[8]=63&u[8]|128,s){if((c=c||0)<0||c+16>s.length)throw RangeError(`UUID byte range ${c}:${c+15} is out of buffer bounds`);for(let e=0;e<16;++e)s[c+e]=u[e];return s}return(0,a.unsafeStringify)(u)}},12299:(e,t)=>

1{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default="ffffffff-ffff-ffff-ffff-ffffffffffff"},13771:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(50042),a=r(91180);t.default=function(e){var t;let r=(t="string"==typeof e?(0,n.default)(e):e,Uint8Array.of((15&t[6])<<4|t[7]>>4&15,(15&t[7])<<4|(240&t[4])>>4,(15&t[4])<<4|(240&t[5])>>4,(15&t[5])<<4|(240&t[0])>>4,(15&t[0])<<4|(240&t[1])>>4,(15&t[1])<<4|(240&t[2])>>4,96|15&t[2],t[3],t[8],t[9],t[10],t[11],t[12],t[13],t[14],t[15]));return"string"==typeof e?(0,a.unsafeStringify)(r):r}},17150:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.updateV1State=void 0;let n=r(73084),a=r(91180),i={};function o(e,t,r){return e.msecs??=-1/0,e.nsecs??=0,t===e.msecs?(e.nsecs++,e.nsecs>=1e4&&(e.node=void 0,e.nsecs=0)):t>e.msecs?e.nsecs=0:t<e.msecs&&(e.node=void 0),e.node||(e.node=r.slice(10,16),e.node[0]|=1,e.clockseq=(r[8]<<8|r[9])&16383),e.msecs=t,e}function s(e,t,r,n,a,i,o=0){if(e.length<16)throw Error("Random bytes length must be >= 16");if(i){if(o<0||o+16>i.length)throw RangeError(`UUID byte range ${o}:${o+15} is out of buffer bounds`)}else i=new Uint8Array(16),o=0;t??=Date.now(),r??=0,n??=(e[8]<<8|e[9])&16383,a??=e.slice(10,16);let c=((0xfffffff&(t+=122192928e5))*1e4+r)%0x100000000;i[o++]=c>>>24&255,i[o++]=c>>>16&255,i[o++]=c>>>8&255,i[o++]=255&c;let d=t/0x100000000*1e4&0xfffffff;i[o++]=d>>>8&255,i[o++]=255&d,i[o++]=d>>>24&15|16,i[o++]=d>>>16&255,i[o++]=n>>>8|128,i[o++]=255&n;for(let e=0;e<6;++e)i[o++]=a[e];return i}t.updateV1State=o,t.default=function(e,t,r){let c,d=e?._v6??!1;if(e){let t=Object.keys(e);1===t.length&&"_v6"===t[0]&&(e=void 0)}if(e)c=s(e.random??e.rng?.()??(0,n.default)(),e.msecs,e.nsecs,e.clockseq,e.node,t,r);else{let e=Date.now(),a=(0,n.default)();o(i,e,a),c=s(a,i.msecs,i.nsecs,d?void 0:i.clockseq,d?void 0:i.node,t,r)}return t??(0,a.unsafeStringify)(c)}},18909:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(71049);t.default=function(e){if(!(0,n.default)(e))throw TypeError("Invalid UUID");return parseInt(e.slice(14,15),16)}},22455:e=>{e.exports=function(e){return e&&e.__esModule?e:{default:e}},e.exports.__esModule=!0,e.exports.default=e.exports},25346:(e,t,r)=>{"use strict";r.r(t),r.d(t,{default:()=>i,hkdf:()=>i});let n=async(e,t,r,n,a)=>{let{crypto:{subtle:i}}=(()=>{if("undefined"!=typeof globalThis)return globalThis;if("undefined"!=typeof self)return self;if("undefined"!=typeof window)return window;throw Error("unable to locate global object")})();return new Uint8Array(await i.deriveBits({name:"HKDF",hash:`SHA-${e.substr(3)}`,salt:r,info:n},await i.importKey("raw",t,"HKDF",!1,["deriveBits"]),a<<3))};function a(e,t){if("string"==typeof e)return new TextEncoder().encode(e);if(!(e instanceof Uint8Array))throw TypeError(`"${t}"" must be an instance of Uint8Array or a string`);return e}async function i(e,t,r,i,o){return n(function(e){switch(e){case"sha256":case"sha384":case"sha512":case"sha1":return e;default:throw TypeError('unsupported "digest" value')}}(e),function(e){let t=a(e,"ikm");if(!t.byteLength)throw TypeError('"ikm" must be at least one byte in length');return t}(t),a(r,"salt"),function(e){let t=a(e,"info");if(t.byteLength>1024)throw TypeError('"info" must not contain more than 1024 bytes');return t}(i),function(e,t){if("number"!=typeof e||!Number.isInteger(e)||e<1)throw TypeError('"keylen" must be a positive integer');if(e>255*(parseInt(t.substr(3),10)>>3||20))throw TypeError('"keylen" too large');return e}(o,e))}},27818:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0})},32750:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i},44959:(e,t,r)=>{"use strict";var n=r(87358),a=r(22455);Object.defineProperty(t,"__esModule",{value:!0});var i={encode:!0,decode:!0,getToken:!0};t.decode=p,t.encode=u,t.getToken=h;var o=r(62160),s=a(r(25346)),c=r(56649),d=r(935),l=r(27818);async function u(e){let{token:t={},secret:r,maxAge:n=2592e3,salt:a=""}=e,i=await f(r,a);return await new o.EncryptJWT(t).setProtectedHeader({alg:"dir",enc:"A256GCM"}).setIssuedAt().setExpirationTime((Date.now()/1e3|0)+n).setJti((0,c.v4)()).encrypt

1(i)}async function p(e){let{token:t,secret:r,salt:n=""}=e;if(!t)return null;let a=await f(r,n),{payload:i}=await (0,o.jwtDecrypt)(t,a,{clockTolerance:15});return i}async function h(e){var t,r,a,i;let{req:o,secureCookie:s=null!=(t=null==(r=n.env.NEXTAUTH_URL)?void 0:r.startsWith("https://"))?t:!!n.env.VERCEL,cookieName:c=s?"__Secure-next-auth.session-token":"next-auth.session-token",raw:l,decode:u=p,logger:h=console,secret:f=null!=(a=n.env.NEXTAUTH_SECRET)?a:n.env.AUTH_SECRET}=e;if(!o)throw Error("Must pass `req` to JWT getToken()");let y=new d.SessionStore({name:c,options:{secure:s}},{cookies:o.cookies,headers:o.headers},h).value,w=o.headers instanceof Headers?o.headers.get("authorization"):null==(i=o.headers)?void 0:i.authorization;if(!y&&(null==w?void 0:w.split(" ")[0])==="Bearer"){let e=w.split(" ")[1];try{y=decodeURIComponent(e)}catch(e){return null}}if(!y)return null;if(l)return y;try{return await u({token:y,secret:f})}catch(e){return null}}async function f(e,t){return await (0,s.default)("sha256",e,t,`NextAuth.js Generated Encryption Key${t?` (${t})`:""}`,32)}Object.keys(l).forEach(function(e){!("default"===e||"__esModule"===e||Object.prototype.hasOwnProperty.call(i,e))&&(e in t&&t[e]===l[e]||Object.defineProperty(t,e,{enumerable:!0,get:function(){return l[e]}}))})},47284:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default={randomUUID:"undefined"!=typeof crypto&&crypto.randomUUID&&crypto.randomUUID.bind(crypto)}},50042:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(71049);t.default=function(e){let t;if(!(0,n.default)(e))throw TypeError("Invalid UUID");return Uint8Array.of((t=parseInt(e.slice(0,8),16))>>>24,t>>>16&255,t>>>8&255,255&t,(t=parseInt(e.slice(9,13),16))>>>8,255&t,(t=parseInt(e.slice(14,18),16))>>>8,255&t,(t=parseInt(e.slice(19,23),16))>>>8,255&t,(t=parseInt(e.slice(24,36),16))/0x10000000000&255,t/0x100000000&255,t>>>24&255,t>>>16&255,t>>>8&255,255&t)}},50097:(e,t)=>{"use strict";function r(e){return(e+64>>>9<<4)+14+1}function n(e,t){let r=(65535&e)+(65535&t);return(e>>16)+(t>>16)+(r>>16)<<16|65535&r}function a(e,t,r,a,i,o){var s;return n((s=n(n(t,e),n(a,o)))<<i|s>>>32-i,r)}function i(e,t,r,n,i,o,s){return a(t&r|~t&n,e,t,i,o,s)}function o(e,t,r,n,i,o,s){return a(t&n|r&~n,e,t,i,o,s)}function s(e,t,r,n,i,o,s){return a(t^r^n,e,t,i,o,s)}function c(e,t,r,n,i,o,s){return a(r^(t|~n),e,t,i,o,s)}Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){var t=function(e,t){let a=new Uint32Array(r(t)).fill(0);a.set(e),a[t>>5]|=128<<t%32,a[a.length-1]=t,e=a;let d=0x67452301,l=-0x10325477,u=-0x67452302,p=0x10325476;for(let t=0;t<e.length;t+=16){let r=d,a=l,h=u,f=p;d=i(d,l,u,p,e[t],7,-0x28955b88),p=i(p,d,l,u,e[t+1],12,-0x173848aa),u=i(u,p,d,l,e[t+2],17,0x242070db),l=i(l,u,p,d,e[t+3],22,-0x3e423112),d=i(d,l,u,p,e[t+4],7,-0xa83f051),p=i(p,d,l,u,e[t+5],12,0x4787c62a),u=i(u,p,d,l,e[t+6],17,-0x57cfb9ed),l=i(l,u,p,d,e[t+7],22,-0x2b96aff),d=i(d,l,u,p,e[t+8],7,0x698098d8),p=i(p,d,l,u,e[t+9],12,-0x74bb0851),u=i(u,p,d,l,e[t+10],17,-42063),l=i(l,u,p,d,e[t+11],22,-0x76a32842),d=i(d,l,u,p,e[t+12],7,0x6b901122),p=i(p,d,l,u,e[t+13],12,-0x2678e6d),u=i(u,p,d,l,e[t+14],17,-0x5986bc72),l=i(l,u,p,d,e[t+15],22,0x49b40821),d=o(d,l,u,p,e[t+1],5,-0x9e1da9e),p=o(p,d,l,u,e[t+6],9,-0x3fbf4cc0),u=o(u,p,d,l,e[t+11],14,0x265e5a51),l=o(l,u,p,d,e[t],20,-0x16493856),d=o(d,l,u,p,e[t+5],5,-0x29d0efa3),p=o(p,d,l,u,e[t+10],9,0x2441453),u=o(u,p,d,l,e[t+15],14,-0x275e197f),l=o(l,u,p,d,e[t+4],20,-0x182c0438),d=o(d,l,u,p,e[t+9],5,0x21e1cde6),p=o(p,d,l,u,e[t+14],9,-0x3cc8f82a),u=o(u,p,d,l,e[t+3],14,-0xb2af279),l=o(l,u,p,d,e[t+8],20,0x455a14ed),d=o(d,l,u,p,e[t+13],5,-0x561c16fb),p=o(p,d,l,u,e[t+2],9,-0x3105c08),u=o(u,p,d,l,e[t+7],14,0x676f02d9),l=o(l,u,p,d,e[t+12],20,-0x72d5b376),d=s(d,l,u,p,e[t+5],4,-378558),p=s(p,d,l,u,e[t+8],11,-0x788e097f),u=s(u,p,d,l,e[t+11],16,0x6d9d6122),l=s(l,u,p,d,e[t+14],23,-0x21ac7f4),d=s(d,l,u,p,e[t+1],4,-0x5b4115bc),p=s(p,d,l,u,e[t+4],11,0x4bdecfa9),u=s(u,p,d,l,e[t+7],16,-0x944b4a0),l=s(l,u,p,d,e[t+10],23,-0x41404390),d=s(d,l,u,p,e[t+13],4,0x289b7ec6),p=s(p,d,l,u,e[t],11,-0x155ed806),u=s(u,p,d,l,e[t+3],16,-0x2b10cf7b),l=s(l,u,p,d,e[t+6],23,0x4881d05

1),d=s(d,l,u,p,e[t+9],4,-0x262b2fc7),p=s(p,d,l,u,e[t+12],11,-0x1924661b),u=s(u,p,d,l,e[t+15],16,0x1fa27cf8),l=s(l,u,p,d,e[t+2],23,-0x3b53a99b),d=c(d,l,u,p,e[t],6,-0xbd6ddbc),p=c(p,d,l,u,e[t+7],10,0x432aff97),u=c(u,p,d,l,e[t+14],15,-0x546bdc59),l=c(l,u,p,d,e[t+5],21,-0x36c5fc7),d=c(d,l,u,p,e[t+12],6,0x655b59c3),p=c(p,d,l,u,e[t+3],10,-0x70f3336e),u=c(u,p,d,l,e[t+10],15,-1051523),l=c(l,u,p,d,e[t+1],21,-0x7a7ba22f),d=c(d,l,u,p,e[t+8],6,0x6fa87e4f),p=c(p,d,l,u,e[t+15],10,-0x1d31920),u=c(u,p,d,l,e[t+6],15,-0x5cfebcec),l=c(l,u,p,d,e[t+13],21,0x4e0811a1),d=c(d,l,u,p,e[t+4],6,-0x8ac817e),p=c(p,d,l,u,e[t+11],10,-0x42c50dcb),u=c(u,p,d,l,e[t+2],15,0x2ad7d2bb),l=c(l,u,p,d,e[t+9],21,-0x14792c6f),d=n(d,r),l=n(l,a),u=n(u,h),p=n(p,f)}return Uint32Array.of(d,l,u,p)}(function(e){if(0===e.length)return new Uint32Array;let t=new Uint32Array(r(8*e.length)).fill(0);for(let r=0;r<e.length;r++)t[r>>2]|=(255&e[r])<<r%4*8;return t}(e),8*e.length);let a=new Uint8Array(4*t.length);for(let e=0;e<4*t.length;e++)a[e]=t[e>>2]>>>e%4*8&255;return a}},52722:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.URL=t.DNS=void 0;let n=r(84354),a=r(8947);var i=r(8947);function o(e,t,r,i){return(0,a.default)(80,n.default,e,t,r,i)}Object.defineProperty(t,"DNS",{enumerable:!0,get:function(){return i.DNS}}),Object.defineProperty(t,"URL",{enumerable:!0,get:function(){return i.URL}}),o.DNS=a.DNS,o.URL=a.URL,t.default=o},56649:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.version=t.validate=t.v7=t.v6ToV1=t.v6=t.v5=t.v4=t.v3=t.v1ToV6=t.v1=t.stringify=t.parse=t.NIL=t.MAX=void 0;var n=r(12299);Object.defineProperty(t,"MAX",{enumerable:!0,get:function(){return n.default}});var a=r(62122);Object.defineProperty(t,"NIL",{enumerable:!0,get:function(){return a.default}});var i=r(50042);Object.defineProperty(t,"parse",{enumerable:!0,get:function(){return i.default}});var o=r(91180);Object.defineProperty(t,"stringify",{enumerable:!0,get:function(){return o.default}});var s=r(17150);Object.defineProperty(t,"v1",{enumerable:!0,get:function(){return s.default}});var c=r(13771);Object.defineProperty(t,"v1ToV6",{enumerable:!0,get:function(){return c.default}});var d=r(65472);Object.defineProperty(t,"v3",{enumerable:!0,get:function(){return d.default}});var l=r(60077);Object.defineProperty(t,"v4",{enumerable:!0,get:function(){return l.default}});var u=r(52722);Object.defineProperty(t,"v5",{enumerable:!0,get:function(){return u.default}});var p=r(89399);Object.defineProperty(t,"v6",{enumerable:!0,get:function(){return p.default}});var h=r(85559);Object.defineProperty(t,"v6ToV1",{enumerable:!0,get:function(){return h.default}});var f=r(59172);Object.defineProperty(t,"v7",{enumerable:!0,get:function(){return f.default}});var y=r(71049);Object.defineProperty(t,"validate",{enumerable:!0,get:function(){return y.default}});var w=r(18909);Object.defineProperty(t,"version",{enumerable:!0,get:function(){return w.default}})},59172:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.updateV7State=void 0;let n=r(73084),a=r(91180),i={};function o(e,t,r){return e.msecs??=-1/0,e.seq??=0,t>e.msecs?(e.seq=r[6]<<23|r[7]<<16|r[8]<<8|r[9],e.msecs=t):(e.seq=e.seq+1|0,0===e.seq&&e.msecs++),e}function s(e,t,r,n,a=0){if(e.length<16)throw Error("Random bytes length must be >= 16");if(n){if(a<0||a+16>n.length)throw RangeError(`UUID byte range ${a}:${a+15} is out of buffer bounds`)}else n=new Uint8Array(16),a=0;return t??=Date.now(),r??=127*e[6]<<24|e[7]<<16|e[8]<<8|e[9],n[a++]=t/0x10000000000&255,n[a++]=t/0x100000000&255,n[a++]=t/0x1000000&255,n[a++]=t/65536&255,n[a++]=t/256&255,n[a++]=255&t,n[a++]=112|r>>>28&15,n[a++]=r>>>20&255,n[a++]=128|r>>>14&63,n[a++]=r>>>6&255,n[a++]=r<<2&255|3&e[10],n[a++]=e[11],n[a++]=e[12],n[a++]=e[13],n[a++]=e[14],n[a++]=e[15],n}t.updateV7State=o,t.default=function(e,t,r){let c;if(e)c=s(e.random??e.rng?.()??(0,n.default)(),e.msecs,e.seq,t,r);else{let e=Date.now(),a=(0,n.default)();o(i,e,a),c=s(a,i.msecs,i.seq,t,r)}return t??(0,a.unsafeStringify)(c)}},60077:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(47284),a=r(73084),i=r(91180);t.default=function(e,t,r){if(n.default.randomUUID&&!t&&!e)return n.default.randomUUID();let o=(e=e||{}).random??e.rng?.()??(0,a.default)();if(o.length<16)throw Error("Random bytes length must be >= 16");if(o[6]=15&o[6]|64,o[8]=63&o[8]|128,t){if((r=r||0)<0||r+16>t.length)throw RangeError(`UUID byte range ${r}:${r+15} is out of buffer bounds`);for(let e=0;e<16;++e)t[r+e]=o[e];return t}return(0,i.unsafeStringify)(o)}},62122:(e,t)=>{"use strict";

1Object.defineProperty(t,"__esModule",{value:!0}),t.default="00000000-0000-0000-0000-000000000000"},62160:(e,t,r)=>{"use strict";r.r(t),r.d(t,{CompactEncrypt:()=>tr,CompactSign:()=>ti,EmbeddedJWK:()=>tf,EncryptJWT:()=>tl,FlattenedEncrypt:()=>eq,FlattenedSign:()=>ta,GeneralEncrypt:()=>eQ,GeneralSign:()=>ts,SignJWT:()=>td,UnsecuredJWT:()=>tv,base64url:()=>a,calculateJwkThumbprint:()=>tp,calculateJwkThumbprintUri:()=>th,compactDecrypt:()=>e$,compactVerify:()=>e5,createLocalJWKSet:()=>tE,createRemoteJWKSet:()=>tA,cryptoRuntime:()=>tU,decodeJwt:()=>tC,decodeProtectedHeader:()=>tP,errors:()=>n,exportJWK:()=>eV,exportPKCS8:()=>eF,exportSPKI:()=>eG,flattenedDecrypt:()=>eN,flattenedVerify:()=>e2,generalDecrypt:()=>eB,generalVerify:()=>e8,generateKeyPair:()=>tx,generateSecret:()=>tT,importJWK:()=>ex,importPKCS8:()=>eW,importSPKI:()=>eK,importX509:()=>ek,jwtDecrypt:()=>tt,jwtVerify:()=>te});var n={};r.r(n),r.d(n,{JOSEAlgNotAllowed:()=>A,JOSEError:()=>E,JOSENotSupported:()=>v,JWEDecompressionFailed:()=>H,JWEDecryptionFailed:()=>_,JWEInvalid:()=>P,JWKInvalid:()=>k,JWKSInvalid:()=>W,JWKSMultipleMatchingKeys:()=>T,JWKSNoMatchingKey:()=>x,JWKSTimeout:()=>U,JWSInvalid:()=>C,JWSSignatureVerificationFailed:()=>R,JWTClaimValidationFailed:()=>b,JWTExpired:()=>S,JWTInvalid:()=>K});var a={};r.r(a),r.d(a,{decode:()=>tH,encode:()=>t_});let i=crypto,o=async(e,t)=>{let r=`SHA-${e.slice(-3)}`;return new Uint8Array(await i.subtle.digest(r,t))},s=new TextEncoder,c=new TextDecoder;function d(...e){let t=new Uint8Array(e.reduce((e,{length:t})=>e+t,0)),r=0;return e.forEach(e=>{t.set(e,r),r+=e.length}),t}function l(e,t,r){if(t<0||t>=0x100000000)throw RangeError(`value must be >= 0 and <= ${0x100000000-1}. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,255&t],r)}function u(e){let t=Math.floor(e/0x100000000),r=new Uint8Array(8);return l(r,t,0),l(r,e%0x100000000,4),r}function p(e){let t=new Uint8Array(4);return l(t,e),t}function h(e){return d(p(e.length),e)}async function f(e,t,r){let n=Math.ceil((t>>3)/32),a=new Uint8Array(32*n);for(let t=0;t<n;t++){let n=new Uint8Array(4+e.length+r.length);n.set(p(t+1)),n.set(e,4),n.set(r,4+e.length),a.set(await o("sha256",n),32*t)}return a.slice(0,t>>3)}let y=e=>{let t=e;"string"==typeof t&&(t=s.encode(t));let r=[];for(let e=0;e<t.length;e+=32768)r.push(String.fromCharCode.apply(null,t.subarray(e,e+32768)));return btoa(r.join(""))},w=e=>y(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"),m=e=>{let t=atob(e),r=new Uint8Array(t.length);for(let e=0;e<t.length;e++)r[e]=t.charCodeAt(e);return r},g=e=>{let t=e;t instanceof Uint8Array&&(t=c.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return m(t)}catch(e){throw TypeError("The input to be decoded is not correctly encoded.")}};class E extends Error{static get code(){return"ERR_JOSE_GENERIC"}constructor(e){var t;super(e),this.code="ERR_JOSE_GENERIC",this.name=this.constructor.name,null==(t=Error.captureStackTrace)||t.call(Error,this,this.constructor)}}class b extends E{static get code(){return"ERR_JWT_CLAIM_VALIDATION_FAILED"}constructor(e,t="unspecified",r="unspecified"){super(e),this.code="ERR_JWT_CLAIM_VALIDATION_FAILED",this.claim=t,this.reason=r}}class S extends E{static get code(){return"ERR_JWT_EXPIRED"}constructor(e,t="unspecified",r="unspecified"){super(e),this.code="ERR_JWT_EXPIRED",this.claim=t,this.reason=r}}class A extends E{constructor(){super(...arguments),this.code="ERR_JOSE_ALG_NOT_ALLOWED"}static get code(){return"ERR_JOSE_ALG_NOT_ALLOWED"}}class v extends E{constructor(){super(...arguments),this.code="ERR_JOSE_NOT_SUPPORTED"}static get code(){return"ERR_JOSE_NOT_SUPPORTED"}}class _ extends E{constructor(){super(...arguments),this.code="ERR_JWE_DECRYPTION_FAILED",this.message="decryption operation failed"}static get code(){return"ERR_JWE_DECRYPTION_FAILED"}}

1class H extends E{constructor(){super(...arguments),this.code="ERR_JWE_DECOMPRESSION_FAILED",this.message="decompression operation failed"}static get code(){return"ERR_JWE_DECOMPRESSION_FAILED"}}class P extends E{constructor(){super(...arguments),this.code="ERR_JWE_INVALID"}static get code(){return"ERR_JWE_INVALID"}}class C extends E{constructor(){super(...arguments),this.code="ERR_JWS_INVALID"}static get code(){return"ERR_JWS_INVALID"}}class K extends E{constructor(){super(...arguments),this.code="ERR_JWT_INVALID"}static get code(){return"ERR_JWT_INVALID"}}class k extends E{constructor(){super(...arguments),this.code="ERR_JWK_INVALID"}static get code(){return"ERR_JWK_INVALID"}}class W extends E{constructor(){super(...arguments),this.code="ERR_JWKS_INVALID"}static get code(){return"ERR_JWKS_INVALID"}}class x extends E{constructor(){super(...arguments),this.code="ERR_JWKS_NO_MATCHING_KEY",this.message="no applicable key found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_NO_MATCHING_KEY"}}class T extends E{constructor(){super(...arguments),this.code="ERR_JWKS_MULTIPLE_MATCHING_KEYS",this.message="multiple matching keys found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_MULTIPLE_MATCHING_KEYS"}}Symbol.asyncIterator;class U extends E{constructor(){super(...arguments),this.code="ERR_JWKS_TIMEOUT",this.message="request timed out"}static get code(){return"ERR_JWKS_TIMEOUT"}}class R extends E{constructor(){super(...arguments),this.code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED",this.message="signature verification failed"}static get code(){return"ERR_JWS_SIGNATURE_VERIFICATION_FAILED"}}let J=i.getRandomValues.bind(i);function I(e){switch(e){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new v(`Unsupported JWE Algorithm: ${e}`)}}let O=e=>J(new Uint8Array(I(e)>>3)),D=(e,t)=>{if(t.length<<3!==I(e))throw new P("Invalid Initialization Vector length")},M=(e,t)=>{let r=e.byteLength<<3;if(r!==t)throw new P(`Invalid Content Encryption Key length. Expected ${t} bits, got ${r} bits`)};function j(e,t="algorithm.name"){return TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`)}function N(e,t){return e.name===t}function $(e){return parseInt(e.name.slice(4),10)}function B(e,t){if(t.length&&!t.some(t=>e.usages.includes(t))){let e="CryptoKey does not support this operation, its usages must include ";if(t.length>2){let r=t.pop();e+=`one of ${t.join(", ")}, or ${r}.`}else 2===t.length?e+=`one of ${t[0]} or ${t[1]}.`:e+=`${t[0]}.`;throw TypeError(e)}}function L(e,t,...r){switch(t){case"A128GCM":case"A192GCM":case"A256GCM":{if(!N(e.algorithm,"AES-GCM"))throw j("AES-GCM");let r=parseInt(t.slice(1,4),10);if(e.algorithm.length!==r)throw j(r,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!N(e.algorithm,"AES-KW"))throw j("AES-KW");let r=parseInt(t.slice(1,4),10);if(e.algorithm.length!==r)throw j(r,"algorithm.length");break}case"ECDH":switch(e.algorithm.name){case"ECDH":case"X25519":case"X448":break;default:throw j("ECDH, X25519, or X448")}break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!N(e.algorithm,"PBKDF2"))throw j("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!N(e.algorithm,"RSA-OAEP"))throw j("RSA-OAEP");let r=parseInt(t.slice(9),10)||1;if($(e.algorithm.hash)!==r)throw j(`SHA-${r}`,"algorithm.hash");break}default:throw TypeError("CryptoKey does not support this operation")}B(e,r)}function G(e,t,...r){if(r.length>2){let t=r.pop();e+=`one of type ${r.join(", ")}, or ${t}.`}else 2===r.length?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return null==t?e+=` Received ${t}`:"function"==typeof t&&t.name?e+=` Received function ${t.name}`:"object"==typeof t&&null!=t&&t.constructor&&t.constructor.name&&(e+=` Received an instance of ${t.constructor.name}`),e}let F=(e,...t)=>G("Key must be ",e,...t);function V(e,t,...r){return G(`Key for the ${e} algorithm must be `,t,...r)}let z=["CryptoKey"];async function X(e,t,r,n,a,o){let s,c;if(!(t instanceof Uint8Array))throw TypeError(F(t,"Uint8Array"));let l=parseInt(e.slice(1,4),10),p=await i.subtle.importKey("raw",t.subarray(l>>3),"AES-CBC",!1,["decrypt"]),h=await i.subtle.importKey("raw",t.subarray(0,l>>3),{hash:`SHA-${l<<1}`,name:"HMAC"},!1,["sign"]),f=d(o,n,r,u(o.length<<3)),y=new Uint8Array((await i.subtle.sign("HMAC",h,f)).slice(0,l>>3));try{s=((e,t)=>{if(!(e instanceof Uint8Array))throw TypeError("First argument must be a buffer");if(!(t instanceof Uint8Array))throw TypeError("Second argument must be a buffer");if(e.length!==t.length)throw TypeError("Input buffers must have the same length");let r=e.length,n=0,a=-1;for(;++a<r;)n|=e[a]^t[a];return 0===n})(a,y)}catch(e){}if(!s)throw new _;try{c=new Uint8Array(await i.subtle.decrypt({iv:n,name:"AES-CBC"},p,r))}catch(e){}if(!c)throw new _;return c}async function q(e,t,r,n,a,o){let s;t instanceof Uint8Array?s=await i.subtle.importKey("raw",t,"AES-GCM",!1,["decrypt"]):(L(t,e,"decrypt"),s=t);try{return new Uint8Array(await i.subtle.decrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},s,d(r,a)))}catch(e){throw new _}}let Y=async(e,t,r,n,a,i)=>{if(!(t instanceof CryptoKey)&&!(t instanceof Uint8Array))throw TypeError(F(t,...z,"Uint8Array"));switch(D(e,n),e){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return t instanceof Uint8Array&&M(t,parseInt(e.slice(-3),10)),X(e,t,r,n,a,i);case"A128GCM":case"A192GCM":case"A256GCM":return t instanceof Uint8Array&&M(t,parseInt(e.slice(1,4),10)),q(e,t,r,n,a,i);default:throw new v("Unsupported JWE Content Encryption Algorithm")}},Q=async()=>{throw new v('JWE "zip" (Compression Algorithm) Header Parameter is not supported by your javascript runtime. You need to use the `inflateRaw` decrypt option to provide Inflate Raw implementation.')},Z=async()=>{throw new v('JWE "zip" (Compression Algorithm) Header Parameter is not supported by your javascript runtime. You need to use the `deflateRaw` encrypt option to provide Deflate Raw implementation.')},ee=(...e)=>{let t,r=e.filter(Boolean);if(0===r.length||1===r.length)return!0;for(let e of r){let r=Object.keys(e);if(!t||0===t.size){t=new Set(r);continue}for(let e of r){if(t.has(e))return!1;t.add(e)}}return!0};function et(e){if("object"!=typeof e||null===e||"[object Object]"!==Object.prototype.toString.call(e))return!1;if(null===Object.getPrototypeOf(e))return!0;let t=e;for(;null!==Object.getPrototypeOf(t);)t=Object.getPrototypeOf(t);return Object.getPrototypeOf(e)===t}

1let er=[{hash:"SHA-256",name:"HMAC"},!0,["sign"]];function en(e,t){if(e.algorithm.length!==parseInt(t.slice(1,4),10))throw TypeError(`Invalid key size for alg: ${t}`)}function ea(e,t,r){if(e instanceof CryptoKey)return L(e,t,r),e;if(e instanceof Uint8Array)return i.subtle.importKey("raw",e,"AES-KW",!0,[r]);throw TypeError(F(e,...z,"Uint8Array"))}let ei=async(e,t,r)=>{let n=await ea(t,e,"wrapKey");en(n,e);let a=await i.subtle.importKey("raw",r,...er);return new Uint8Array(await i.subtle.wrapKey("raw",a,n,"AES-KW"))},eo=async(e,t,r)=>{let n=await ea(t,e,"unwrapKey");en(n,e);let a=await i.subtle.unwrapKey("raw",r,n,"AES-KW",...er);return new Uint8Array(await i.subtle.exportKey("raw",a))};async function es(e,t,r,n,a=new Uint8Array(0),o=new Uint8Array(0)){let c;if(!(e instanceof CryptoKey))throw TypeError(F(e,...z));if(L(e,"ECDH"),!(t instanceof CryptoKey))throw TypeError(F(t,...z));L(t,"ECDH","deriveBits");let l=d(h(s.encode(r)),h(a),h(o),p(n));return c="X25519"===e.algorithm.name?256:"X448"===e.algorithm.name?448:Math.ceil(parseInt(e.algorithm.namedCurve.substr(-3),10)/8)<<3,f(new Uint8Array(await i.subtle.deriveBits({name:e.algorithm.name,public:e},t,c)),n,l)}async function ec(e){if(!(e instanceof CryptoKey))throw TypeError(F(e,...z));return i.subtle.generateKey(e.algorithm,!0,["deriveBits"])}function ed(e){if(!(e instanceof CryptoKey))throw TypeError(F(e,...z));return["P-256","P-384","P-521"].includes(e.algorithm.namedCurve)||"X25519"===e.algorithm.name||"X448"===e.algorithm.name}async function el(e,t,r,n){if(!(e instanceof Uint8Array)||e.length<8)throw new P("PBES2 Salt Input must be 8 or more octets");let a=d(s.encode(t),new Uint8Array([0]),e),o=parseInt(t.slice(13,16),10),c={hash:`SHA-${t.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:a},l=await function(e,t){if(e instanceof Uint8Array)return i.subtle.importKey("raw",e,"PBKDF2",!1,["deriveBits"]);if(e instanceof CryptoKey)return L(e,t,"deriveBits","deriveKey"),e;throw TypeError(F(e,...z,"Uint8Array"))}(n,t);if(l.usages.includes("deriveBits"))return new Uint8Array(await i.subtle.deriveBits(c,l,o));if(l.usages.includes("deriveKey"))return i.subtle.deriveKey(c,l,{length:o,name:"AES-KW"},!1,["wrapKey","unwrapKey"]);throw TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"')}let eu=async(e,t,r,n=2048,a=J(new Uint8Array(16)))=>{let i=await el(a,e,n,t);return{encryptedKey:await ei(e.slice(-6),i,r),p2c:n,p2s:w(a)}},ep=async(e,t,r,n,a)=>{let i=await el(a,e,n,t);return eo(e.slice(-6),i,r)};function eh(e){switch(e){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new v(`alg ${e} is not supported either by JOSE or your javascript runtime`)}}let ef=(e,t)=>{if(e.startsWith("RS")||e.startsWith("PS")){let{modulusLength:r}=t.algorithm;if("number"!=typeof r||r<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}},ey=async(e,t,r)=>{if(!(t instanceof CryptoKey))throw TypeError(F(t,...z));if(L(t,e,"encrypt","wrapKey"),ef(e,t),t.usages.includes("encrypt"))return new Uint8Array(await i.subtle.encrypt(eh(e),t,r));if(t.usages.includes("wrapKey")){let n=await i.subtle.importKey("raw",r,...er);return new Uint8Array(await i.subtle.wrapKey("raw",n,t,eh(e)))}throw TypeError('RSA-OAEP key "usages" must include "encrypt" or "wrapKey" for this operation')},ew=async(e,t,r)=>{if(!(t instanceof CryptoKey))throw TypeError(F(t,...z));if(L(t,e,"decrypt","unwrapKey"),ef(e,t),t.usages.includes("decrypt"))return new Uint8Array(await i.subtle.decrypt(eh(e),t,r));if(t.usages.includes("unwrapKey")){let n=await i.subtle.unwrapKey("raw",r,t,eh(e),...er);return new Uint8Array(await i.subtle.exportKey("raw",n))}throw TypeError('RSA-OAEP key "usages" must include "decrypt" or "unwrapKey" for this operation')};function em(e){switch(e){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new v(`Unsupported JWE Algorithm: ${e}`)}}let eg=e=>J(new Uint8Array(em(e)>>3)),eE=(e,t)=>{let r=(e.match(/.{1,64}/g)||[]).join("\n");return`-----BEGIN ${t}-----
2${r}
3-----END ${t}-----`},eb=async(e,t,r)=>{if(!(r instanceof CryptoKey))throw TypeError(F(r,...z));if(!r.extractable)throw TypeError("CryptoKey is not extractable");if(r.type!==e)throw TypeError(`key is not a ${e} key`);return eE(y(new Uint8Array(await i.subtle.exportKey(t,r))),`${e.toUpperCase()} KEY`)},eS=(e,t,r=0)=>{0===r&&(t.unshift(t.length),t.unshift(6));let n=e.indexOf(t[0],r);if(-1===n)return!1;let a=e.subarray(n,n+t.length);return a.length===t.length&&(a.every((e,r)=>e===t[r])||eS(e,t,n+1))},eA=e=>{switch(!0){case eS(e,[42,134,72,206,61,3,1,7]):return"P-256";case eS(e,[43,129,4,0,34]):return"P-384";case eS(e,[43,129,4,0,35]):return"P-521";case eS(e,[43,101,110]):return"X25519";case eS(e,[43,101,111]):return"X448";case eS(e,[43,101,112]):return"Ed25519";case eS(e,[43,101,113]):return"Ed448";default:throw new v("Invalid or unsupported EC Key Curve or OKP Key Sub Type")}},ev=async(e,t,r,n,a)=>{var o;let s,c,d=new Uint8Array(atob(r.replace(e,"")).split("").map(e=>e.charCodeAt(0))),l="spki"===t;switch(n){case"PS256":case"PS384":case"PS512":s={name:"RSA-PSS",hash:`SHA-${n.slice(-3)}`},c=l?["verify"]:["sign"];break;case"RS256":case"RS384":case"RS512":s={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${n.slice(-3)}`},c=l?["verify"]:["sign"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":s={name:"RSA-OAEP",hash:`SHA-${parseInt(n.slice(-3),10)||1}`},c=l?["encrypt","wrapKey"]:["decrypt","unwrapKey"];break;case"ES256":s={name:"ECDSA",namedCurve:"P-256"},c=l?["verify"]:["sign"];break;case"ES384":s={name:"ECDSA",namedCurve:"P-384"},c=l?["verify"]:["sign"];break;case"ES512":s={name:"ECDSA",namedCurve:"P-521"},c=l?["verify"]:["sign"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let e=eA(d);s=e.startsWith("P-")?{name:"ECDH",namedCurve:e}:{name:e},c=l?[]:["deriveBits"];break}

3case"EdDSA":s={name:eA(d)},c=l?["verify"]:["sign"];break;default:throw new v('Invalid or unsupported "alg" (Algorithm) value')}return i.subtle.importKey(t,d,s,null!=(o=null==a?void 0:a.extractable)&&o,c)},e_=(e,t,r)=>ev(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g,"spki",e,t,r);function eH(e){let t=[],r=0;for(;r<e.length;){let n=eP(e.subarray(r));t.push(n),r+=n.byteLength}return t}function eP(e){let t=0,r=31&e[0];if(t++,31===r){for(r=0;e[t]>=128;)r=128*r+e[t]-128,t++;r=128*r+e[t]-128,t++}let n=0;if(e[t]<128)n=e[t],t++;else if(128===n){for(n=0;0!==e[t+n]||0!==e[t+n+1];){if(n>e.byteLength)throw TypeError("invalid indefinite form length");n++}let r=t+n+2;return{byteLength:r,contents:e.subarray(t,t+n),raw:e.subarray(0,r)}}else{let r=127&e[t];t++,n=0;for(let a=0;a<r;a++)n=256*n+e[t],t++}let a=t+n;return{byteLength:a,contents:e.subarray(t,a),raw:e.subarray(0,a)}}let eC=async e=>{var t,r;if(!e.alg)throw TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:n,keyUsages:a}=function(e){let t,r;switch(e.kty){case"oct":switch(e.alg){case"HS256":case"HS384":case"HS512":t={name:"HMAC",hash:`SHA-${e.alg.slice(-3)}`},r=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":throw new v(`${e.alg} keys cannot be imported as CryptoKey instances`);case"A128GCM":case"A192GCM":case"A256GCM":case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":t={name:"AES-GCM"},r=["encrypt","decrypt"];break;case"A128KW":case"A192KW":case"A256KW":t={name:"AES-KW"},r=["wrapKey","unwrapKey"];break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":t={name:"PBKDF2"},r=["deriveBits"];break;default:throw new v('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"RSA":switch(e.alg){case"PS256":case"PS384":case"PS512":t={name:"RSA-PSS",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":t={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":t={name:"RSA-OAEP",hash:`SHA-${parseInt(e.alg.slice(-3),10)||1}`},r=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new v('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"EC":switch(e.alg){case"ES256":t={name:"ECDSA",namedCurve:"P-256"},r=e.d?["sign"]:["verify"];break;case"ES384":t={name:"ECDSA",namedCurve:"P-384"},r=e.d?["sign"]:["verify"];break;case"ES512":t={name:"ECDSA",namedCurve:"P-521"},r=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new v('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"OKP":switch(e.alg){case"EdDSA":t={name:e.crv},r=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new v('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;default:throw new v('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:t,keyUsages:r}}(e),o=[n,null!=(t=e.ext)&&t,null!=(r=e.key_ops)?r:a];if("PBKDF2"===n.name)return i.subtle.importKey("raw",g(e.k),...o);let s={...e};return delete s.alg,delete s.use,i.subtle.importKey("jwk",s,...o)};async function eK(e,t,r){if("string"!=typeof e||0!==e.indexOf("-----BEGIN PUBLIC KEY-----"))throw TypeError('"spki" must be SPKI formatted string');return e_(e,t,r)}async function ek(e,t,r){let n;if("string"!=typeof e||0!==e.indexOf("-----BEGIN CERTIFICATE-----"))throw TypeError('"x509" must be X.509 formatted string');try{n=eE(function(e){let t=eH(eH(eP(e).contents)[0].contents);return y(t[160===t[0].raw[0]?6:5].raw)}(m(e.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g,""))),"PUBLIC KEY")}catch(e){throw TypeError("Failed to parse the X.509 certificate",{cause:e})}return e_(n,t,r)}async function eW(e,t,r){if("string"!=typeof e||0!==e.indexOf("-----BEGIN PRIVATE KEY-----"))throw TypeError('"pkcs8" must be PKCS#8 formatted string');

3return ev(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"pkcs8",e,t,r)}async function ex(e,t,r){var n;if(!et(e))throw TypeError("JWK must be an object");switch(t||(t=e.alg),e.kty){case"oct":if("string"!=typeof e.k||!e.k)throw TypeError('missing "k" (Key Value) Parameter value');if(null!=r||(r=!0!==e.ext),r)return eC({...e,alg:t,ext:null!=(n=e.ext)&&n});return g(e.k);case"RSA":if(void 0!==e.oth)throw new v('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');case"EC":case"OKP":return eC({...e,alg:t});default:throw new v('Unsupported "kty" (Key Type) Parameter value')}}let eT=(e,t,r)=>{e.startsWith("HS")||"dir"===e||e.startsWith("PBES2")||/^A\d{3}(?:GCM)?KW$/.test(e)?((e,t)=>{if(!(t instanceof Uint8Array)){if(!(t instanceof CryptoKey))throw TypeError(V(e,t,...z,"Uint8Array"));if("secret"!==t.type)throw TypeError(`${z.join(" or ")} instances for symmetric algorithms must be of type "secret"`)}})(e,t):((e,t,r)=>{if(!(t instanceof CryptoKey))throw TypeError(V(e,t,...z));if("secret"===t.type)throw TypeError(`${z.join(" or ")} instances for asymmetric algorithms must not be of type "secret"`);if("sign"===r&&"public"===t.type)throw TypeError(`${z.join(" or ")} instances for asymmetric algorithm signing must be of type "private"`);if("decrypt"===r&&"public"===t.type)throw TypeError(`${z.join(" or ")} instances for asymmetric algorithm decryption must be of type "private"`);if(t.algorithm&&"verify"===r&&"private"===t.type)throw TypeError(`${z.join(" or ")} instances for asymmetric algorithm verifying must be of type "public"`);if(t.algorithm&&"encrypt"===r&&"private"===t.type)throw TypeError(`${z.join(" or ")} instances for asymmetric algorithm encryption must be of type "public"`)})(e,t,r)};async function eU(e,t,r,n,a){if(!(r instanceof Uint8Array))throw TypeError(F(r,"Uint8Array"));let o=parseInt(e.slice(1,4),10),s=await i.subtle.importKey("raw",r.subarray(o>>3),"AES-CBC",!1,["encrypt"]),c=await i.subtle.importKey("raw",r.subarray(0,o>>3),{hash:`SHA-${o<<1}`,name:"HMAC"},!1,["sign"]),l=new Uint8Array(await i.subtle.encrypt({iv:n,name:"AES-CBC"},s,t)),p=d(a,n,l,u(a.length<<3));return{ciphertext:l,tag:new Uint8Array((await i.subtle.sign("HMAC",c,p)).slice(0,o>>3))}}async function eR(e,t,r,n,a){let o;r instanceof Uint8Array?o=await i.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(L(r,e,"encrypt"),o=r);let s=new Uint8Array(await i.subtle.encrypt({additionalData:a,iv:n,name:"AES-GCM",tagLength:128},o,t)),c=s.slice(-16);return{ciphertext:s.slice(0,-16),tag:c}}let eJ=async(e,t,r,n,a)=>{if(!(r instanceof CryptoKey)&&!(r instanceof Uint8Array))throw TypeError(F(r,...z,"Uint8Array"));switch(D(e,n),e){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&M(r,parseInt(e.slice(-3),10)),eU(e,t,r,n,a);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&M(r,parseInt(e.slice(1,4),10)),eR(e,t,r,n,a);default:throw new v("Unsupported JWE Content Encryption Algorithm")}};async function eI(e,t,r,n){let a=e.slice(0,7);n||(n=O(a));let{ciphertext:i,tag:o}=await eJ(a,r,t,n,new Uint8Array(0));return{encryptedKey:i,iv:w(n),tag:w(o)}}async function eO(e,t,r,n,a){return Y(e.slice(0,7),t,r,n,a,new Uint8Array(0))}async function eD(e,t,r,n,a){switch(eT(e,t,"decrypt"),e){case"dir":if(void 0!==r)throw new P("Encountered unexpected JWE Encrypted Key");return t;case"ECDH-ES":if(void 0!==r)throw new P("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let a,i;if(!et(n.epk))throw new P('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(!ed(t))throw new v("ECDH with the provided key is not allowed or not supported by your javascript runtime");let o=await ex(n.epk,e);if(void 0!==n.apu){if("string"!=typeof n.apu)throw new P('JOSE Header "apu" (Agreement PartyUInfo) invalid');try{a=g(n.apu)}catch(e){throw new P("Failed to base64url decode the apu")}}if(void 0!==n.apv){if("string"!=typeof n.apv)throw new P('JOSE Header "apv" (Agreement PartyVInfo) invalid');try{i=g(n.apv)}catch(e){throw new P("Failed to base64url decode the apv")}}let s=await es(o,t,"ECDH-ES"===e?n.enc:e,"ECDH-ES"===e?em(n.enc):parseInt(e.slice(-5,-2),10),a,i);if("ECDH-ES"===e)return s;if(void 0===r)throw new P("JWE Encrypted Key missing");return eo(e.slice(-6),s,r)}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":if(void 0===r)throw new P("JWE Encrypted Key missing");return ew(e,t,r);case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{let i;if(void 0===r)throw new P("JWE Encrypted Key missing");if("number"!=typeof n.p2c)throw new P('JOSE Header "p2c" (PBES2 Count) missing or invalid');let o=(null==a?void 0:a.maxPBES2Count)||1e4;if(n.p2c>o)throw new P('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if("string"!=typeof n.p2s)throw new P('JOSE Header "p2s" (PBES2 Salt) missing or invalid');try{i=g(n.p2s)}catch(e){throw new P("Failed to base64url decode the p2s")}return ep(e,t,r,n.p2c,i)}

3case"A128KW":case"A192KW":case"A256KW":if(void 0===r)throw new P("JWE Encrypted Key missing");return eo(e,t,r);case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{let a,i;if(void 0===r)throw new P("JWE Encrypted Key missing");if("string"!=typeof n.iv)throw new P('JOSE Header "iv" (Initialization Vector) missing or invalid');if("string"!=typeof n.tag)throw new P('JOSE Header "tag" (Authentication Tag) missing or invalid');try{a=g(n.iv)}catch(e){throw new P("Failed to base64url decode the iv")}try{i=g(n.tag)}catch(e){throw new P("Failed to base64url decode the tag")}return eO(e,t,r,a,i)}default:throw new v('Invalid or unsupported "alg" (JWE Algorithm) header value')}}let eM=function(e,t,r,n,a){let i;if(void 0!==a.crit&&void 0===n.crit)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||void 0===n.crit)return new Set;if(!Array.isArray(n.crit)||0===n.crit.length||n.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');for(let o of(i=void 0!==r?new Map([...Object.entries(r),...t.entries()]):t,n.crit)){if(!i.has(o))throw new v(`Extension Header Parameter "${o}" is not recognized`);if(void 0===a[o])throw new e(`Extension Header Parameter "${o}" is missing`);if(i.get(o)&&void 0===n[o])throw new e(`Extension Header Parameter "${o}" MUST be integrity protected`)}return new Set(n.crit)},ej=(e,t)=>{if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw TypeError(`"${e}" option must be an array of strings`);if(t)return new Set(t)};async function eN(e,t,r){var n;let a,i,o,l,u,p,h;if(!et(e))throw new P("Flattened JWE must be an object");if(void 0===e.protected&&void 0===e.header&&void 0===e.unprotected)throw new P("JOSE Header missing");if("string"!=typeof e.iv)throw new P("JWE Initialization Vector missing or incorrect type");if("string"!=typeof e.ciphertext)throw new P("JWE Ciphertext missing or incorrect type");if("string"!=typeof e.tag)throw new P("JWE Authentication Tag missing or incorrect type");if(void 0!==e.protected&&"string"!=typeof e.protected)throw new P("JWE Protected Header incorrect type");if(void 0!==e.encrypted_key&&"string"!=typeof e.encrypted_key)throw new P("JWE Encrypted Key incorrect type");if(void 0!==e.aad&&"string"!=typeof e.aad)throw new P("JWE AAD incorrect type");if(void 0!==e.header&&!et(e.header))throw new P("JWE Shared Unprotected Header incorrect type");if(void 0!==e.unprotected&&!et(e.unprotected))throw new P("JWE Per-Recipient Unprotected Header incorrect type");if(e.protected)try{let t=g(e.protected);a=JSON.parse(c.decode(t))}catch(e){throw new P("JWE Protected Header is invalid")}if(!ee(a,e.header,e.unprotected))throw new P("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let f={...a,...e.header,...e.unprotected};if(eM(P,new Map,null==r?void 0:r.crit,a,f),void 0!==f.zip){if(!a||!a.zip)throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');if("DEF"!==f.zip)throw new v('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value')}let{alg:y,enc:w}=f;if("string"!=typeof y||!y)throw new P("missing JWE Algorithm (alg) in JWE Header");if("string"!=typeof w||!w)throw new P("missing JWE Encryption Algorithm (enc) in JWE Header");let m=r&&ej("keyManagementAlgorithms",r.keyManagementAlgorithms),E=r&&ej("contentEncryptionAlgorithms",r.contentEncryptionAlgorithms);if(m&&!m.has(y))throw new A('"alg" (Algorithm) Header Parameter not allowed');if(E&&!E.has(w))throw new A('"enc" (Encryption Algorithm) Header Parameter not allowed');if(void 0!==e.encrypted_key)try{i=g(e.encrypted_key)}catch(e){throw new P("Failed to base64url decode the encrypted_key")}let b=!1;"function"==typeof t&&(t=await t(a,e),b=!0);try{o=await eD(y,t,i,f,r)}catch(e){if(e instanceof TypeError||e instanceof P||e instanceof v)throw e;o=eg(w)}try{l=g(e.iv)}catch(e){throw new P("Failed to base64url decode the iv")}try{u=g(e.tag)}catch(e){throw new P("Failed to base64url decode the tag")}let S=s.encode(null!=(n=e.protected)?n:"");p=void 0!==e.aad?d(S,s.encode("."),s.encode(e.aad)):S;try{h=g(e.ciphertext)}catch(e){throw new P("Failed to base64url decode the ciphertext")}let _=await Y(w,o,h,l,u,p);"DEF"===f.zip&&(_=await ((null==r?void 0:r.inflateRaw)||Q)(_));let H={plaintext:_};if(void 0!==e.protected&&(H.protectedHeader=a),void 0!==e.aad)try{H.additionalAuthenticatedData=g(e.aad)}catch(e){throw new P("Failed to base64url decode the aad")}return(void 0!==e.unprotected&&(H.sharedUnprotectedHeader=e.unprotected),void 0!==e.header&&(H.unprotectedHeader=e.header),b)?{...H,key:t}:H}async function e$(e,t,r){if(e instanceof Uint8Array&&(e=c.decode(e)),"string"!=typeof e)throw new P("Compact JWE must be a string or Uint8Array");let{0:n,1:a,2:i,3:o,4:s,length:d}=e.split(".");if(5!==d)throw new P("Invalid Compact JWE");let l=await eN({ciphertext:o,iv:i||void 0,protected:n||void 0,tag:s||void 0,encrypted_key:a||void 0},t,r),u={plaintext:l.plaintext,protectedHeader:l.protectedHeader};return"function"==typeof t?{...u,key:l.key}:u}async function eB(e,t,r){if(!et(e))throw new P("General JWE must be an object");

3if(!Array.isArray(e.recipients)||!e.recipients.every(et))throw new P("JWE Recipients missing or incorrect type");if(!e.recipients.length)throw new P("JWE Recipients has no members");for(let n of e.recipients)try{return await eN({aad:e.aad,ciphertext:e.ciphertext,encrypted_key:n.encrypted_key,header:n.header,iv:e.iv,protected:e.protected,tag:e.tag,unprotected:e.unprotected},t,r)}catch(e){}throw new _}let eL=async e=>{if(e instanceof Uint8Array)return{kty:"oct",k:w(e)};if(!(e instanceof CryptoKey))throw TypeError(F(e,...z,"Uint8Array"));if(!e.extractable)throw TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:t,key_ops:r,alg:n,use:a,...o}=await i.subtle.exportKey("jwk",e);return o};async function eG(e){return eb("public","spki",e)}async function eF(e){return eb("private","pkcs8",e)}async function eV(e){return eL(e)}async function ez(e,t,r,n,a={}){let i,o,s;switch(eT(e,r,"encrypt"),e){case"dir":s=r;break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!ed(r))throw new v("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:c,apv:d}=a,{epk:l}=a;l||(l=(await ec(r)).privateKey);let{x:u,y:p,crv:h,kty:f}=await eV(l),y=await es(r,l,"ECDH-ES"===e?t:e,"ECDH-ES"===e?em(t):parseInt(e.slice(-5,-2),10),c,d);if(o={epk:{x:u,crv:h,kty:f}},"EC"===f&&(o.epk.y=p),c&&(o.apu=w(c)),d&&(o.apv=w(d)),"ECDH-ES"===e){s=y;break}s=n||eg(t);let m=e.slice(-6);i=await ei(m,y,s);break}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":s=n||eg(t),i=await ey(e,r,s);break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{s=n||eg(t);let{p2c:c,p2s:d}=a;({encryptedKey:i,...o}=await eu(e,r,s,c,d));break}case"A128KW":case"A192KW":case"A256KW":s=n||eg(t),i=await ei(e,r,s);break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{s=n||eg(t);let{iv:c}=a;({encryptedKey:i,...o}=await eI(e,r,s,c));break}default:throw new v('Invalid or unsupported "alg" (JWE Algorithm) header value')}return{cek:s,encryptedKey:i,parameters:o}}let eX=Symbol();class eq{constructor(e){if(!(e instanceof Uint8Array))throw TypeError("plaintext must be an instance of Uint8Array");this._plaintext=e}setKeyManagementParameters(e){if(this._keyManagementParameters)throw TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=e,this}setProtectedHeader(e){if(this._protectedHeader)throw TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setSharedUnprotectedHeader(e){if(this._sharedUnprotectedHeader)throw TypeError("setSharedUnprotectedHeader can only be called once");return this._sharedUnprotectedHeader=e,this}setUnprotectedHeader(e){if(this._unprotectedHeader)throw TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}setAdditionalAuthenticatedData(e){return this._aad=e,this}setContentEncryptionKey(e){if(this._cek)throw TypeError("setContentEncryptionKey can only be called once");return this._cek=e,this}setInitializationVector(e){if(this._iv)throw TypeError("setInitializationVector can only be called once");return this._iv=e,this}async encrypt(e,t){let r,n,a,i,o,l,u;if(!this._protectedHeader&&!this._unprotectedHeader&&!this._sharedUnprotectedHeader)throw new P("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!ee(this._protectedHeader,this._unprotectedHeader,this._sharedUnprotectedHeader))throw new P("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let p={...this._protectedHeader,...this._unprotectedHeader,...this._sharedUnprotectedHeader};if(eM(P,new Map,null==t?void 0:t.crit,this._protectedHeader,p),void 0!==p.zip){if(!this._protectedHeader||!this._protectedHeader.zip)throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');if("DEF"!==p.zip)throw new v('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value')}let{alg:h,enc:f}=p;if("string"!=typeof h||!h)throw new P('JWE "alg" (Algorithm) Header Parameter missing or invalid');if("string"!=typeof f||!f)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if("dir"===h){if(this._cek)throw TypeError("setContentEncryptionKey cannot be called when using Direct Encryption")}else if("ECDH-ES"===h&&this._cek)throw TypeError("setContentEncryptionKey cannot be called when using Direct Key Agreement");{let a;({cek:n,encryptedKey:r,parameters:a}=await ez(h,f,e,this._cek,this._keyManagementParameters)),a&&(t&&eX in t?this._unprotectedHeader?this._unprotectedHeader={...this._unprotectedHeader,...a}:this.setUnprotectedHeader(a):this._protectedHeader?this._protectedHeader={...this._protectedHeader,...a}:this.setProtectedHeader(a))}if(this._iv||(this._iv=O(f)),i=this._protectedHeader?s.encode(w(JSON.stringify(this._protectedHeader))):s.encode(""),this._aad?(o=w(this._aad),a=d(i,s.encode("."),s.encode(o))):a=i,"DEF"===p.zip){let e=await ((null==t?void 0:t.deflateRaw)||Z)(this._plaintext);({ciphertext:l,tag:u}=await eJ(f,e,n,this._iv,a))}else({ciphertext:l,tag:u}=await eJ(f,this._plaintext,n,this._iv,a));let y={ciphertext:w(l),iv:w(this._iv),tag:w(u)};return r&&(y.encrypted_key=w(r)),o&&(y.aad=o),this._protectedHeader&&(y.protected=c.decode(i)),this._sharedUnprotectedHeader&&(y.unprotected=this._sharedUnprotectedHeader),this._unprotectedHeader&&(y.header=this._unprotectedHeader),y}}class eY{constructor(e,t,r){this.parent=e,this.key=t,this.options=r}setUnprotectedHeader(e){if(this.unprotectedHeader)throw TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=e,this}addRecipient(...e){return this.parent.addRecipient(...e)}encrypt(...e){return this.parent.encrypt(...e)}done(){return this.parent}}class eQ{constructor(e){this._recipients=[],this._plaintext=e}addRecipient(e,t){let r=new eY(this,e,{crit:null==t?void 0:t.crit});return this._recipients.push(r),r}setProtectedHeader(e){if(this._protectedHeader)throw TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setSharedUnprotectedHeader(e){if(this._unprotectedHeader)throw TypeError("setSharedUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}setAdditionalAuthenticatedData(e){return this._aad=e,this}async encrypt(e){var t,r,n;let a;if(!this._recipients.length)throw new P("at least one recipient must be added");if(e={deflateRaw:null==e?void 0:e.deflateRaw},1===this._recipients.length){let[t]=this._recipients,r=await new eq(this._plaintext).setAdditionalAuthenticatedData(this._aad).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(t.unprotectedHeader).encrypt

3(t.key,{...t.options,...e}),n={ciphertext:r.ciphertext,iv:r.iv,recipients:[{}],tag:r.tag};return r.aad&&(n.aad=r.aad),r.protected&&(n.protected=r.protected),r.unprotected&&(n.unprotected=r.unprotected),r.encrypted_key&&(n.recipients[0].encrypted_key=r.encrypted_key),r.header&&(n.recipients[0].header=r.header),n}for(let e=0;e<this._recipients.length;e++){let t=this._recipients[e];if(!ee(this._protectedHeader,this._unprotectedHeader,t.unprotectedHeader))throw new P("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let r={...this._protectedHeader,...this._unprotectedHeader,...t.unprotectedHeader},{alg:n}=r;if("string"!=typeof n||!n)throw new P('JWE "alg" (Algorithm) Header Parameter missing or invalid');if("dir"===n||"ECDH-ES"===n)throw new P('"dir" and "ECDH-ES" alg may only be used with a single recipient');if("string"!=typeof r.enc||!r.enc)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(a){if(a!==r.enc)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}else a=r.enc;if(eM(P,new Map,t.options.crit,this._protectedHeader,r),void 0!==r.zip&&(!this._protectedHeader||!this._protectedHeader.zip))throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected')}let i=eg(a),o={ciphertext:"",iv:"",recipients:[],tag:""};for(let s=0;s<this._recipients.length;s++){let c=this._recipients[s],d={};o.recipients.push(d);let l=({...this._protectedHeader,...this._unprotectedHeader,...c.unprotectedHeader}).alg.startsWith("PBES2")?2048+s:void 0;if(0===s){let t=await new eq(this._plaintext).setAdditionalAuthenticatedData(this._aad).setContentEncryptionKey(i).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(c.unprotectedHeader).setKeyManagementParameters({p2c:l}).encrypt(c.key,{...c.options,...e,[eX]:!0});o.ciphertext=t.ciphertext,o.iv=t.iv,o.tag=t.tag,t.aad&&(o.aad=t.aad),t.protected&&(o.protected=t.protected),t.unprotected&&(o.unprotected=t.unprotected),d.encrypted_key=t.encrypted_key,t.header&&(d.header=t.header);continue}let{encryptedKey:u,parameters:p}=await ez((null==(t=c.unprotectedHeader)?void 0:t.alg)||(null==(r=this._protectedHeader)?void 0:r.alg)||(null==(n=this._unprotectedHeader)?void 0:n.alg),a,c.key,i,{p2c:l});d.encrypted_key=w(u),(c.unprotectedHeader||p)&&(d.header={...c.unprotectedHeader,...p})}return o}}function eZ(e,t){let r=`SHA-${e.slice(-3)}`;switch(e){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:e.slice(-3)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:t.namedCurve};case"EdDSA":return{name:t.name};default:throw new v(`alg ${e} is not supported either by JOSE or your javascript runtime`)}}function e0(e,t,r){if(t instanceof CryptoKey)return!function(e,t,...r){switch(t){case"HS256":case"HS384":case"HS512":{if(!N(e.algorithm,"HMAC"))throw j("HMAC");let r=parseInt(t.slice(2),10);if($(e.algorithm.hash)!==r)throw j(`SHA-${r}`,"algorithm.hash");break}case"RS256":case"RS384":case"RS512":{if(!N(e.algorithm,"RSASSA-PKCS1-v1_5"))throw j("RSASSA-PKCS1-v1_5");let r=parseInt(t.slice(2),10);if($(e.algorithm.hash)!==r)throw j(`SHA-${r}`,"algorithm.hash");break}

3case"PS256":case"PS384":case"PS512":{if(!N(e.algorithm,"RSA-PSS"))throw j("RSA-PSS");let r=parseInt(t.slice(2),10);if($(e.algorithm.hash)!==r)throw j(`SHA-${r}`,"algorithm.hash");break}case"EdDSA":if("Ed25519"!==e.algorithm.name&&"Ed448"!==e.algorithm.name)throw j("Ed25519 or Ed448");break;case"ES256":case"ES384":case"ES512":{if(!N(e.algorithm,"ECDSA"))throw j("ECDSA");let r=function(e){switch(e){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw Error("unreachable")}}(t);if(e.algorithm.namedCurve!==r)throw j(r,"algorithm.namedCurve");break}default:throw TypeError("CryptoKey does not support this operation")}B(e,r)}(t,e,r),t;if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw TypeError(F(t,...z));return i.subtle.importKey("raw",t,{hash:`SHA-${e.slice(-3)}`,name:"HMAC"},!1,[r])}throw TypeError(F(t,...z,"Uint8Array"))}let e1=async(e,t,r,n)=>{let a=await e0(e,t,"verify");ef(e,a);let o=eZ(e,a.algorithm);try{return await i.subtle.verify(o,a,r,n)}catch(e){return!1}};async function e2(e,t,r){var n;let a,i;if(!et(e))throw new C("Flattened JWS must be an object");if(void 0===e.protected&&void 0===e.header)throw new C('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==e.protected&&"string"!=typeof e.protected)throw new C("JWS Protected Header incorrect type");if(void 0===e.payload)throw new C("JWS Payload missing");if("string"!=typeof e.signature)throw new C("JWS Signature missing or incorrect type");if(void 0!==e.header&&!et(e.header))throw new C("JWS Unprotected Header incorrect type");let o={};if(e.protected)try{let t=g(e.protected);o=JSON.parse(c.decode(t))}catch(e){throw new C("JWS Protected Header is invalid")}if(!ee(o,e.header))throw new C("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let l={...o,...e.header},u=eM(C,new Map([["b64",!0]]),null==r?void 0:r.crit,o,l),p=!0;if(u.has("b64")&&"boolean"!=typeof(p=o.b64))throw new C('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:h}=l;if("string"!=typeof h||!h)throw new C('JWS "alg" (Algorithm) Header Parameter missing or invalid');let f=r&&ej("algorithms",r.algorithms);if(f&&!f.has(h))throw new A('"alg" (Algorithm) Header Parameter not allowed');if(p){if("string"!=typeof e.payload)throw new C("JWS Payload must be a string")}else if("string"!=typeof e.payload&&!(e.payload instanceof Uint8Array))throw new C("JWS Payload must be a string or an Uint8Array instance");let y=!1;"function"==typeof t&&(t=await t(o,e),y=!0),eT(h,t,"verify");let w=d(s.encode(null!=(n=e.protected)?n:""),s.encode("."),"string"==typeof e.payload?s.encode(e.payload):e.payload);try{a=g(e.signature)}catch(e){throw new C("Failed to base64url decode the signature")}if(!await e1(h,t,a,w))throw new R;if(p)try{i=g(e.payload)}catch(e){throw new C("Failed to base64url decode the payload")}else i="string"==typeof e.payload?s.encode(e.payload):e.payload;let m={payload:i};return(void 0!==e.protected&&(m.protectedHeader=o),void 0!==e.header&&(m.unprotectedHeader=e.header),y)?{...m,key:t}:m}async function e5(e,t,r){if(e instanceof Uint8Array&&(e=c.decode(e)),"string"!=typeof e)throw new C("Compact JWS must be a string or Uint8Array");let{0:n,1:a,2:i,length:o}=e.split(".");if(3!==o)throw new C("Invalid Compact JWS");let s=await e2({payload:a,protected:n,signature:i},t,r),d={payload:s.payload,protectedHeader:s.protectedHeader};return"function"==typeof t?{...d,key:s.key}:d}async function e8(e,t,r){if(!et(e))throw new C("General JWS must be an object");if(!Array.isArray(e.signatures)||!e.signatures.every(et))throw new C("JWS Signatures missing or incorrect type");for(let n of e.signatures)try{return await e2({header:n.header,payload:e.payload,protected:n.protected,signature:n.signature},t,r)}catch(e){}throw new R}let e4=e=>Math.floor(e.getTime()/1e3),e6=/^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i,e3=e=>{let t=e6.exec(e);if(!t)throw TypeError("Invalid time period format");let r=parseFloat(t[1]);switch(t[2].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":return Math.round(r);case"minute":case"minutes":case"min":case"mins":case"m":return Math.round(60*r);case"hour":case"hours":case"hr":case"hrs":case"h":return Math.round(3600*r);case"day":case"days":case"d":return Math.round(86400*r);case"week":case"weeks":case"w":return Math.round(604800*r);default:return Math.round(0x1e187e0*r)}},e9=e=>e.toLowerCase().replace(/^application\//,""),e7=(e,t,r={})=>{let n,a,{typ:i}=r;if(i&&("string"!=typeof e.typ||e9(e.typ)!==e9(i)))throw new b('unexpected "typ" JWT header value',"typ","check_failed");try{n=JSON.parse(c.decode(t))}catch(e){}if(!et(n))throw new K("JWT Claims Set must be a top-level JSON object");let{requiredClaims:o=[],issuer:s,subject:d,audience:l,maxTokenAge:u}=r;for(let e of(void 0!==u&&o.push("iat"),void 0!==l&&o.push("aud"),void 0!==d&&o.push("sub"),void 0!==s&&o.push("iss"),new Set(o.reverse())))if(!(e in n))throw new b(`missing required "${e}" claim`,e,"missing");if(s&&!(Array.isArray(s)?s:[s]).includes(n.iss))throw new b('unexpected "iss" claim value',"iss","check_failed");if(d&&n.sub!==d)throw new b('unexpected "sub" claim value',"sub","check_failed");if(l&&!((e,t)=>"string"==typeof e?t.includes(e):!!Array.isArray(e)&&t.some(Set.prototype.has.bind(new Set(e))))(n.aud,"string"==typeof l?[l]:l))throw new b('unexpected "aud" claim value',"aud","check_failed");switch(typeof r.clockTolerance){case"string":a=e3(r.clockTolerance);break;case"number":a=r.clockTolerance;break;case"undefined":a=0;break;default:throw TypeError("Invalid clockTolerance option type")}let{currentDate:p}=r,h=e4(p||new Date);if((void 0!==n.iat||u)&&"number"!=typeof n.iat)throw new b('"iat" claim must be a number',"iat","invali

3d");if(void 0!==n.nbf){if("number"!=typeof n.nbf)throw new b('"nbf" claim must be a number',"nbf","invalid");if(n.nbf>h+a)throw new b('"nbf" claim timestamp check failed',"nbf","check_failed")}if(void 0!==n.exp){if("number"!=typeof n.exp)throw new b('"exp" claim must be a number',"exp","invalid");if(n.exp<=h-a)throw new S('"exp" claim timestamp check failed',"exp","check_failed")}if(u){let e=h-n.iat;if(e-a>("number"==typeof u?u:e3(u)))throw new S('"iat" claim timestamp check failed (too far in the past)',"iat","check_failed");if(e<0-a)throw new b('"iat" claim timestamp check failed (it should be in the past)',"iat","check_failed")}return n};async function te(e,t,r){var n;let a=await e5(e,t,r);if((null==(n=a.protectedHeader.crit)?void 0:n.includes("b64"))&&!1===a.protectedHeader.b64)throw new K("JWTs MUST NOT use unencoded payload");let i={payload:e7(a.protectedHeader,a.payload,r),protectedHeader:a.protectedHeader};return"function"==typeof t?{...i,key:a.key}:i}async function tt(e,t,r){let n=await e$(e,t,r),a=e7(n.protectedHeader,n.plaintext,r),{protectedHeader:i}=n;if(void 0!==i.iss&&i.iss!==a.iss)throw new b('replicated "iss" claim header parameter mismatch',"iss","mismatch");if(void 0!==i.sub&&i.sub!==a.sub)throw new b('replicated "sub" claim header parameter mismatch',"sub","mismatch");if(void 0!==i.aud&&JSON.stringify(i.aud)!==JSON.stringify(a.aud))throw new b('replicated "aud" claim header parameter mismatch',"aud","mismatch");let o={payload:a,protectedHeader:i};return"function"==typeof t?{...o,key:n.key}:o}class tr{constructor(e){this._flattened=new eq(e)}setContentEncryptionKey(e){return this._flattened.setContentEncryptionKey(e),this}setInitializationVector(e){return this._flattened.setInitializationVector(e),this}setProtectedHeader(e){return this._flattened.setProtectedHeader(e),this}setKeyManagementParameters(e){return this._flattened.setKeyManagementParameters(e),this}async encrypt(e,t){let r=await this._flattened.encrypt(e,t);return[r.protected,r.encrypted_key,r.iv,r.ciphertext,r.tag].join(".")}}let tn=async(e,t,r)=>{let n=await e0(e,t,"sign");return ef(e,n),new Uint8Array(await i.subtle.sign(eZ(e,n.algorithm),n,r))};class ta{constructor(e){if(!(e instanceof Uint8Array))throw TypeError("payload must be an instance of Uint8Array");this._payload=e}setProtectedHeader(e){if(this._protectedHeader)throw TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setUnprotectedHeader(e){if(this._unprotectedHeader)throw TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}async sign(e,t){let r;if(!this._protectedHeader&&!this._unprotectedHeader)throw new C("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!ee(this._protectedHeader,this._unprotectedHeader))throw new C("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...this._protectedHeader,...this._unprotectedHeader},a=eM(C,new Map([["b64",!0]]),null==t?void 0:t.crit,this._protectedHeader,n),i=!0;if(a.has("b64")&&"boolean"!=typeof(i=this._protectedHeader.b64))throw new C('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:o}=n;if("string"!=typeof o||!o)throw new C('JWS "alg" (Algorithm) Header Parameter missing or invalid');eT(o,e,"sign");let l=this._payload;i&&(l=s.encode(w(l)));let u=d(r=this._protectedHeader?s.encode(w(JSON.stringify(this._protectedHeader))):s.encode(""),s.encode("."),l),p={signature:w(await tn(o,e,u)),payload:""};return i&&(p.payload=c.decode(l)),this._unprotectedHeader&&(p.header=this._unprotectedHeader),this._protectedHeader&&(p.protected=c.decode(r)),p}}class ti{constructor(e){this._flattened=new ta(e)}setProtectedHeader(e){return this._flattened.setProtectedHeader(e),this}async sign(e,t){let r=await this._flattened.sign(e,t);if(void 0===r.payload)throw TypeError("use the flattened module for creating JWS with b64: false");return`${r.protected}.${r.payload}.${r.signature}`}}class to{constructor(e,t,r){this.parent=e,this.key=t,this.options=r}setProtectedHeader(e){if(this.protectedHeader)throw TypeError("setProtectedHeader can only be called once");return this.protectedHeader=e,this}setUnprotectedHeader(e){if(this.unprotectedHeader)throw TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=e,this}addSignature(...e){return this.parent.addSignature(...e)}sign(...e){return this.parent.sign(...e)}done(){return this.parent}}class ts{constructor(e){this._signatures=[],this._payload=e}addSignature(e,t){let r=new to(this,e,t);return this._signatures.push(r),r}async sign(){if(!this._signatures.length)throw new C("at least one signature must be added");let e={signatures:[],payload:""};for(let t=0;t<this._signatures.length;t++){let r=this._signatures[t],n=new ta(this._payload);n.setProtectedHeader(r.protectedHeader),n.setUnprotectedHeader(r.unprotectedHeader);let{payload:a,...i}=await n.sign(r.key,r.options);if(0===t)e.payload=a;else if(e.payload!==a)throw new C("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(i)}return e}}class tc{constructor(e){if(!et(e))throw TypeError("JWT Claims Set MUST be an object");this._payload=e}setIssuer(e){return this._payload={...this._payload,iss:e},this}setSubject(e){return this._payload={...this._payload,sub:e},this}setAudience(e){return this._payload={...this._payload,aud:e},this}setJti(e){return this._payload={...this._payload,jti:e},this}setNotBefore(e){return"number"==typeof e?this._payload={...this._payload,nbf:e}:this._payload={...this._payload,nbf:e4(new Date)+e3(e)},this}setExpirationTime(e){return"number"==typeof e?this._payload={...this._payload,exp:e}:this._payload={...this._payload,exp:e4(new Date)+e3(e)},this}setIssuedAt(e){return void 0===e?this._payload={...this._payload,iat:e4(new Date)}:this._payload={...this._payload,iat:e},this}}class td extends tc{setProtectedHeader(e){return this._protectedHeader=e,this}async sign(e,t){var r;let n=new ti(s.encode(JSON.stringify(this._payload)));if(n.setProtectedHeader(this._protectedHeader),Array.isArray(null==(r=this._protectedHeader)?void 0:r.crit)&&this._protectedHeader.crit.includes("b64")&&!1===this._protectedHeader.b64)throw new K("JWTs MUST NOT use unencoded payload");return n.sign(e,t)}}class tl extends tc{setProtectedHeader(e){if(this._protectedHeader)throw TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setKeyManagementParameters(e){if(this._keyManagementParameters)throw TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=e,this}setContentEncryptionKey(e){if(this._cek)throw TypeError("setContentEncryptionKey can only be called once");return this._cek=e,this}setInitializationVector(e){if(this._iv)throw TypeError("setInitializationVector can only be called once");return this._iv=e,this}replicateIssuerAsHeader(){return this._replicateIssuerAsHeader=!0,this}replicateSubjectAsHeader(){return this._replicateSubjectAsHeader=!0,this}replicateAudienceAsHeader(){return this._replicateAudienceAsHeader=!0,this}async encrypt(e,t){let r=new tr(s.encode(JSON.stringify(this._payload)));return this._replicateIssuerAsHeader&&(this._protectedHeader={...this._protectedHeader,iss:this._payload.iss}),this._replicateSubjectAsHeader&&(this._protectedHeader={...this._protectedHeader,sub:this._payload.sub}),this._replicateAudienceAsHeader&&(this._protectedHeader={...this._protectedHeader,aud:this._payload.aud}),r.setProtectedHeader(this._protectedHeader),this._iv&&r.setInitializationVector(this._iv),this._cek&&r.setContentEncryptionKey(this._cek),this._keyManagementParameters&&r.setKeyManagementParameters(this._keyManagementParameters),r.encrypt(e,t)}}let tu=(e,t)=>

3{if("string"!=typeof e||!e)throw new k(`${t} missing or invalid`)};async function tp(e,t){let r;if(!et(e))throw TypeError("JWK must be an object");if(null!=t||(t="sha256"),"sha256"!==t&&"sha384"!==t&&"sha512"!==t)throw TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');switch(e.kty){case"EC":tu(e.crv,'"crv" (Curve) Parameter'),tu(e.x,'"x" (X Coordinate) Parameter'),tu(e.y,'"y" (Y Coordinate) Parameter'),r={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":tu(e.crv,'"crv" (Subtype of Key Pair) Parameter'),tu(e.x,'"x" (Public Key) Parameter'),r={crv:e.crv,kty:e.kty,x:e.x};break;case"RSA":tu(e.e,'"e" (Exponent) Parameter'),tu(e.n,'"n" (Modulus) Parameter'),r={e:e.e,kty:e.kty,n:e.n};break;case"oct":tu(e.k,'"k" (Key Value) Parameter'),r={k:e.k,kty:e.kty};break;default:throw new v('"kty" (Key Type) Parameter missing or unsupported')}let n=s.encode(JSON.stringify(r));return w(await o(t,n))}async function th(e,t){null!=t||(t="sha256");let r=await tp(e,t);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${t.slice(-3)}:${r}`}async function tf(e,t){let r={...e,...null==t?void 0:t.header};if(!et(r.jwk))throw new C('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=await ex({...r.jwk,ext:!0},r.alg,!0);if(n instanceof Uint8Array||"public"!==n.type)throw new C('"jwk" (JSON Web Key) Header Parameter must be a public key');return n}function ty(e){return e&&"object"==typeof e&&Array.isArray(e.keys)&&e.keys.every(tw)}function tw(e){return et(e)}class tm{constructor(e){if(this._cached=new WeakMap,!ty(e))throw new W("JSON Web Key Set malformed");this._jwks=function(e){return"function"==typeof structuredClone?structuredClone(e):JSON.parse(JSON.stringify(e))}(e)}async getKey(e,t){let{alg:r,kid:n}={...e,...null==t?void 0:t.header},a=function(e){switch("string"==typeof e&&e.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";default:throw new v('Unsupported "alg" value for a JSON Web Key Set')}}(r),i=this._jwks.keys.filter(e=>{let t=a===e.kty;if(t&&"string"==typeof n&&(t=n===e.kid),t&&"string"==typeof e.alg&&(t=r===e.alg),t&&"string"==typeof e.use&&(t="sig"===e.use),t&&Array.isArray(e.key_ops)&&(t=e.key_ops.includes("verify")),t&&"EdDSA"===r&&(t="Ed25519"===e.crv||"Ed448"===e.crv),t)switch(r){case"ES256":t="P-256"===e.crv;break;case"ES256K":t="secp256k1"===e.crv;break;case"ES384":t="P-384"===e.crv;break;case"ES512":t="P-521"===e.crv}return t}),{0:o,length:s}=i;if(0===s)throw new x;if(1!==s){let e=new T,{_cached:t}=this;throw e[Symbol.asyncIterator]=async function*(){for(let e of i)try{yield await tg(t,e,r)}catch(e){continue}},e}return tg(this._cached,o,r)}}async function tg(e,t,r){let n=e.get(t)||e.set(t,{}).get(t);if(void 0===n[r]){let e=await ex({...t,ext:!0},r);if(e instanceof Uint8Array||"public"!==e.type)throw new W("JSON Web Key Set members must be public keys");n[r]=e}return n[r]}function tE(e){let t=new tm(e);return async function(e,r){return t.getKey(e,r)}}let tb=async(e,t,r)=>{let n,a,i=!1;"function"==typeof AbortController&&(n=new AbortController,a=setTimeout(()=>{i=!0,n.abort()},t));let o=await fetch(e.href,{signal:n?n.signal:void 0,redirect:"manual",headers:r.headers}).catch(e=>{if(i)throw new U;throw e});if(void 0!==a&&clearTimeout(a),200!==o.status)throw new E("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await o.json()}catch(e){throw new E("Failed to parse the JSON Web Key Set HTTP response as JSON")}};class tS extends tm{constructor(e,t){if(super({keys:[]}),this._jwks=void 0,!(e instanceof URL))throw TypeError("url must be an instance of URL");this._url=new URL(e.href),this._options={agent:null==t?void 0:t.agent,headers:null==t?void 0:t.headers},this._timeoutDuration="number"==typeof(null==t?void 0:t.timeoutDuration)?null==t?void 0:t.timeoutDuration:5e3,this._cooldownDuration="number"==typeof(null==t?void 0:t.cooldownDuration)?null==t?void 0:t.cooldownDuration:3e4,this._cacheMaxAge="number"==typeof(null==t?void 0:t.cacheMaxAge)?null==t?void 0:t.cacheMaxAge:6e5}coolingDown(){return"number"==typeof this._jwksTimestamp&&Date.now()<this._jwksTimestamp+this._cooldownDuration}fresh(){return"number"==typeof this._jwksTimestamp&&Date.now()<this._jwksTimestamp+this._cacheMaxAge}async getKey(e,t){this._jwks&&this.fresh()||await this.reload();try{return await super.getKey(e,t)}catch(r){if(r instanceof x&&!1===this.coolingDown())return await this.reload(),super.getKey(e,t);throw r}}async reload(){this._pendingFetch&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&(this._pe

3ndingFetch=void 0),this._pendingFetch||(this._pendingFetch=tb(this._url,this._timeoutDuration,this._options).then(e=>{if(!ty(e))throw new W("JSON Web Key Set malformed");this._jwks={keys:e.keys},this._jwksTimestamp=Date.now(),this._pendingFetch=void 0}).catch(e=>{throw this._pendingFetch=void 0,e})),await this._pendingFetch}}function tA(e,t){let r=new tS(e,t);return async function(e,t){return r.getKey(e,t)}}class tv extends tc{encode(){let e=w(JSON.stringify({alg:"none"})),t=w(JSON.stringify(this._payload));return`${e}.${t}.`}static decode(e,t){let r;if("string"!=typeof e)throw new K("Unsecured JWT must be a string");let{0:n,1:a,2:i,length:o}=e.split(".");if(3!==o||""!==i)throw new K("Invalid Unsecured JWT");try{if(r=JSON.parse(c.decode(g(n))),"none"!==r.alg)throw Error()}catch(e){throw new K("Invalid Unsecured JWT")}return{payload:e7(r,g(a),t),header:r}}}let t_=w,tH=g;function tP(e){let t;if("string"==typeof e){let r=e.split(".");(3===r.length||5===r.length)&&([t]=r)}else if("object"==typeof e&&e)if("protected"in e)t=e.protected;else throw TypeError("Token does not contain a Protected Header");try{if("string"!=typeof t||!t)throw Error();let e=JSON.parse(c.decode(tH(t)));if(!et(e))throw Error();return e}catch(e){throw TypeError("Invalid Token or Protected Header formatting")}}function tC(e){let t,r;if("string"!=typeof e)throw new K("JWTs must use Compact JWS serialization, JWT must be a string");let{1:n,length:a}=e.split(".");if(5===a)throw new K("Only JWTs using Compact JWS serialization can be decoded");if(3!==a)throw new K("Invalid JWT");if(!n)throw new K("JWTs must contain a payload");try{t=tH(n)}catch(e){throw new K("Failed to base64url decode the payload")}try{r=JSON.parse(c.decode(t))}catch(e){throw new K("Failed to parse the decoded payload as JSON")}if(!et(r))throw new K("Invalid JWT Claims Set");return r}async function tK(e,t){var r;let n,a,o;switch(e){case"HS256":case"HS384":case"HS512":n=parseInt(e.slice(-3),10),a={name:"HMAC",hash:`SHA-${n}`,length:n},o=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return J(new Uint8Array((n=parseInt(e.slice(-3),10))>>3));case"A128KW":case"A192KW":case"A256KW":a={name:"AES-KW",length:n=parseInt(e.slice(1,4),10)},o=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":a={name:"AES-GCM",length:n=parseInt(e.slice(1,4),10)},o=["encrypt","decrypt"];break;default:throw new v('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return i.subtle.generateKey(a,null!=(r=null==t?void 0:t.extractable)&&r,o)}function tk(e){var t;let r=null!=(t=null==e?void 0:e.modulusLength)?t:2048;if("number"!=typeof r||r<2048)throw new v("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return r}async function tW(e,t){var r,n,a;let o,s;switch(e){case"PS256":case"PS384":case"PS512":o={name:"RSA-PSS",hash:`SHA-${e.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:tk(t)},s=["sign","verify"];break;case"RS256":case"RS384":case"RS512":o={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:tk(t)},s=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":o={name:"RSA-OAEP",hash:`SHA-${parseInt(e.slice(-3),10)||1}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:tk(t)},s=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":o={name:"ECDSA",namedCurve:"P-256"},s=["sign","verify"];break;case"ES384":o={name:"ECDSA",namedCurve:"P-384"},s=["sign","verify"];break;case"ES512":o={name:"ECDSA",namedCurve:"P-521"},s=["sign","verify"];break;case"EdDSA":s=["sign","verify"];let c=null!=(r=null==t?void 0:t.crv)?r:"Ed25519";

3switch(c){case"Ed25519":case"Ed448":o={name:c};break;default:throw new v("Invalid or unsupported crv option provided")}break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{s=["deriveKey","deriveBits"];let e=null!=(n=null==t?void 0:t.crv)?n:"P-256";switch(e){case"P-256":case"P-384":case"P-521":o={name:"ECDH",namedCurve:e};break;case"X25519":case"X448":o={name:e};break;default:throw new v("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448")}break}default:throw new v('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return i.subtle.generateKey(o,null!=(a=null==t?void 0:t.extractable)&&a,s)}async function tx(e,t){return tW(e,t)}async function tT(e,t){return tK(e,t)}let tU="WebCryptoAPI"},65069:(e,t,r)=>{"use strict";r.d(t,{w:()=>o});var n=r(87358);function a(e,t){if(e instanceof Promise)throw Error(t)}var i=r(87358);function o(e){let t="object"==typeof e.client?e.client:{},r="object"==typeof e.server?e.server:{},o=e.shared,s=e.runtimeEnv?e.runtimeEnv:{...i.env,...e.experimental__runtimeEnv};return function(e){let t=e.runtimeEnvStrict??e.runtimeEnv??n.env;if(e.emptyStringAsUndefined)for(let[e,r]of Object.entries(t))""===r&&delete t[e];if(e.skipValidation)return t;let r="object"==typeof e.client?e.client:{},i="object"==typeof e.server?e.server:{},o="object"==typeof e.shared?e.shared:{},s=e.isServer??("undefined"==typeof window||"Deno"in window),c=s?{...i,...o,...r}:{...r,...o},d=e.createFinalSchema?.(c,s)["~standard"].validate(t)??function(e,t){let r={},n=[];for(let i in e){let o=e[i]["~standard"].validate(t[i]);if(a(o,`Validation must be synchronous, but ${i} returned a Promise.`),o.issues){n.push(...o.issues.map(e=>({...e,path:[i,...e.path??[]]})));continue}r[i]=o.value}return n.length?{issues:n}:{value:r}}(c,t);a(d,"Validation must be synchronous");let l=e.onValidationError??(e=>{throw console.error("❌ Invalid environment variables:",e),Error("Invalid environment variables")}),u=e.onInvalidAccess??(()=>{throw Error("❌ Attempted to access a server-side environment variable on the client")});return d.issues?l(d.issues):new Proxy(Object.assign((e.extends??[]).reduce((e,t)=>Object.assign(e,t),{}),d.value),{get(t,r){if("string"==typeof r&&"__esModule"!==r&&"$$typeof"!==r)return s||e.clientPrefix&&(r.startsWith(e.clientPrefix)||r in o)?Reflect.get(t,r):u(r)}})}({...e,shared:o,client:t,server:r,clientPrefix:"NEXT_PUBLIC_",runtimeEnv:s})}},65472:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.URL=t.DNS=void 0;let n=r(50097),a=r(8947);var i=r(8947);function o(e,t,r,i){return(0,a.default)(48,n.default,e,t,r,i)}Object.defineProperty(t,"DNS",{enumerable:!0,get:function(){return i.DNS}}),Object.defineProperty(t,"URL",{enumerable:!0,get:function(){return i.URL}}),o.DNS=a.DNS,o.URL=a.URL,t.default=o},71049:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(32750);t.default=function(e){return"string"==typeof e&&n.default.test(e)}},73084:(e,t)=>{"use strict";let r;Object.defineProperty(t,"__esModule",{value:!0});let n=new Uint8Array(16);t.default=function(){if(!r){if("undefined"==typeof crypto||!crypto.getRandomValues)throw Error("crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported");r=crypto.getRandomValues.bind(crypto)}return r(n)}},84354:(e,t)=>{"use strict";function r(e,t){return e<<t|e>>>32-t}Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){let t=[0x5a827999,0x6ed9eba1,0x8f1bbcdc,0xca62c1d6],n=[0x67452301,0xefcdab89,0x98badcfe,0x10325476,0xc3d2e1f0],a=new Uint8Array(e.length+1);a.set(e),a[e.length]=128;let i=Math.ceil(((e=a).length/4+2)/16),o=Array(i);for(let t=0;t<i;++t){let r=new Uint32Array(16);for(let n=0;n<16;++n)r[n]=e[64*t+4*n]<<24|e[64*t+4*n+1]<<16|e[64*t+4*n+2]<<8|e[64*t+4*n+3];o[t]=r}o[i-1][14]=(e.length-1)*8/0x100000000,o[i-1][14]=Math.floor(o[i-1][14]),o[i-1][15]=(e.length-1)*8|0;for(let e=0;e<i;++e){let a=new Uint32Array(80);for(let t=0;t<16;++t)a[t]=o[e][t];for(let e=16;e<80;++e)a[e]=r(a[e-3]^a[e-8]^a[e-14]^a[e-16],1);let i=n[0],s=n[1],c=n[2],d=n[3],l=n[4];for(let e=0;e<80;++e){let n=Math.floor(e/20),o=r(i,5)+function(e,t,r,n){switch(e){case 0:return t&r^~t&n;case 1:case 3:return t^r^n;case 2:return t&r^t&n^r&n}}(n,s,c,d)+l+t[n]+a[e]>>>0;l=d,d=c,c=r(s,30)>>>0,s=i,i=o}n[0]=n[0]+i>>>0,n[1]=n[1]+s>>>0,n[2]=n[2]+c>>>0,n[3]=n[3]+d>>>0,n[4]=n[4]+l>>>0}return Uint8Array.of(n[0]>>24,n[0]>>16,n[0]>>8,n[0],n[1]>>24,n[1]>>16,n[1]>>8,n[1],n[2]>>24,n[2]>>16,n[2]>>8,n[2],n[3]>

3>24,n[3]>>16,n[3]>>8,n[3],n[4]>>24,n[4]>>16,n[4]>>8,n[4])}},85559:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(50042),a=r(91180);t.default=function(e){var t;let r=(t="string"==typeof e?(0,n.default)(e):e,Uint8Array.of((15&t[3])<<4|t[4]>>4&15,(15&t[4])<<4|(240&t[5])>>4,(15&t[5])<<4|15&t[6],t[7],(15&t[1])<<4|(240&t[2])>>4,(15&t[2])<<4|(240&t[3])>>4,16|(240&t[0])>>4,(15&t[0])<<4|(240&t[1])>>4,t[8],t[9],t[10],t[11],t[12],t[13],t[14],t[15]));return"string"==typeof e?(0,a.unsafeStringify)(r):r}},89399:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(91180),a=r(17150),i=r(13771);t.default=function(e,t,r){e??={},r??=0;let o=(0,a.default)({...e,_v6:!0},new Uint8Array(16));if(o=(0,i.default)(o),t){if(r<0||r+16>t.length)throw RangeError(`UUID byte range ${r}:${r+15} is out of buffer bounds`);for(let e=0;e<16;e++)t[r+e]=o[e];return t}return(0,n.unsafeStringify)(o)}},91180:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.unsafeStringify=void 0;let n=r(71049),a=[];for(let e=0;e<256;++e)a.push((e+256).toString(16).slice(1));function i(e,t=0){return(a[e[t+0]]+a[e[t+1]]+a[e[t+2]]+a[e[t+3]]+"-"+a[e[t+4]]+a[e[t+5]]+"-"+a[e[t+6]]+a[e[t+7]]+"-"+a[e[t+8]]+a[e[t+9]]+"-"+a[e[t+10]]+a[e[t+11]]+a[e[t+12]]+a[e[t+13]]+a[e[t+14]]+a[e[t+15]]).toLowerCase()}t.unsafeStringify=i,t.default=function(e,t=0){let r=i(e,t);if(!(0,n.default)(r))throw TypeError("Stringified UUID is invalid");return r}}}]);