{"version":3,"sources":["../src/auth/emailCode.ts","../src/auth/CavosAuth.ts"],"names":[],"mappings":";;;;;;AACO,IAAM,iBAAA,GAAoB;AAM1B,SAAS,mBAAmB,GAAA,EAAqB;AACtD,EAAA,OAAO,GAAA,CAAI,WAAA,EAAY,CAAE,OAAA,CAAQ,UAAU,EAAE,CAAA;AAC/C;;;ACqDO,IAAM,YAAN,MAAwC;AAAA,EA4B7C,WAAA,CAA6B,IAAA,GAAyB,EAAC,EAAG;AAA7B,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAtB7B;AAAA,IAAA,IAAA,CAAQ,WAAA,GAA6B,IAAA;AACrC,IAAA,IAAA,CAAQ,IAAA,GAAwB,IAAA;AAIhC;AAAA;AAAA;AAAA,IAAA,IAAA,CAAQ,kBAAA,GAAsD,IAAA;AAe9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAgC,IAAA;AAGtC,IAAA,IAAA,CAAK,UAAA,GAAa,KAAK,UAAA,IAAc,mBAAA;AACrC,IAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA,mBAAA,EAAsB,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA,CAAA;AACvE,IAAA,IAAA,CAAK,YAAA,GAAe,CAAA,gBAAA,EAAmB,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA,CAAA;AAC9D,IAAA,IAAA,CAAK,cAAA,GAAiB,CAAA,uBAAA,EAA0B,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA,CAAA;AACvE,IAAA,IAAI,IAAA,CAAK,cAAA,KAAmB,KAAA,IAAS,OAAO,WAAW,WAAA,EAAa;AAGlE,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,YAAA,CAAa,UAAA,CAAW,IAAA,CAAK,kBAAkB,CAAA;AAAA,MACxD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAA,GAA2B;AACjC,IAAA,OAAO,KAAK,IAAA,CAAK,cAAA,KAAmB,KAAA,GAAQ,MAAA,CAAO,iBAAiB,MAAA,CAAO,YAAA;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAA,GAAmC;AACjC,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,QAAQ,IAAA,CAAK,eAAA,EAAgB,CAAE,OAAA,CAAQ,KAAK,kBAAkB,CAAA;AACpE,MAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AACjC,MAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,MAAA,KAAW,UAAU,OAAO,IAAA;AACpE,MAAA,IAAA,CAAK,IAAA,GAAO,QAAA;AACZ,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA;AAC1B,IAAA,IAAA,CAAK,aAAa,IAAI,CAAA;AACtB,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,eAAA,EAAgB,CAAE,UAAA,CAAW,IAAA,CAAK,kBAAkB,CAAA;AAAA,MAC3D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAkB,WAAA,EAAuC;AAC7D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,QAAA,EAAU,WAAW,CAAA;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,iBAAiB,WAAA,EAAuC;AAC5D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,WAAW,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAc,QAAA,CAAS,QAAA,EAA8B,WAAA,EAAuC;AAC1F,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACvF,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,KAAA,EAAO,KAAK,UAAA,EAAW;AAAA,MACvB,YAAA,EAAc,WAAA,IAAe,MAAA,CAAO,QAAA,CAAS,IAAA;AAAA,MAC7C,GAAI,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAM,GAAI;AAAC,KACtD,CAAA;AACD,IAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,IAAI,CAAA,cAAA,EAAiB,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AACpE,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAA,CAAe,gBAAA,EAA0B,WAAA,EAAyC;AACtF,IAAA,MAAM,YAAA,GAAe,oBAAoB,gBAAgB,CAAA;AACzD,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,MAAM,mBAAA,GAAsB,eAAe,uBAAA,EAAwB;AACnE,MAAA,IAAI,CAAC,mBAAA,EAAqB,MAAM,IAAI,MAAM,6CAA6C,CAAA;AACvF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,8BAAA,EAAgC;AAAA,QAC7D,IAAA,EAAM,YAAA;AAAA,QACN,MAAA,EAAQ,KAAK,IAAA,CAAK,KAAA;AAAA,QAClB,YAAA,EAAc;AAAA,OACf,CAAA;AACD,MAAA,OAAO,KAAK,oBAAA,CAAqB,IAAA,CAAK,SAAA,CAAU,MAAM,GAAG,OAAO,CAAA;AAAA,IAClE;AACA,IAAA,MAAM,QAAA,GAAW,gBAAgB,gBAAgB,CAAA;AACjD,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,QAAA,EAAU,OAAO,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,KAAA,EAA8B;AAC1C,IAAA,MAAM,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAAA,MAC5C,MAAA,EAAQ,KAAK,YAAA,EAAa;AAAA,MAC1B,KAAA,EAAO,eAAe,KAAK;AAAA,KAC5B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAA,CAAU,KAAA,EAAe,IAAA,EAAiC;AAC9D,IAAA,MAAM,KAAA,GAAQ,KAAK,YAAA,EAAa;AAChC,IAAA,MAAM,OAAA,GAAU,eAAe,KAAK,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,iBAAA,CAAkB,EAAE,CAAC,CAAA;AACpD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,4BAA4B,EAAE,MAAA,EAAQ,OAAO,CAAA;AAClF,IAAA,MAAM,YAAqB,OAAA,EAAS,UAAA;AACpC,IAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AACA,IAAA,MAAM,aAAa,MAAM,kBAAA;AAAA,MACvB,SAAA;AAAA,MACA,OAAA,CAAQ,wBAAA;AAAA,MACR,IAAA,CAAK,KAAK,WAAA,IAAe;AAAA,KAC3B;AACA,IAAA,MAAM,SAAS,MAAM,aAAA;AAAA,MACnB,SAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,QACE,MAAA,EAAQ,cAAA;AAAA,QACR,KAAA,EAAO,OAAA;AAAA,QACP,IAAA,EAAM,mBAAmB,IAAI,CAAA;AAAA,QAC7B,YAAA,EAAc,WAAW,MAAM;AAAA,OACjC;AAAA,MACA,CAAC,QAAQ,IAAA,CAAK,SAAA,CAAU,2BAA2B,EAAE,UAAA,EAAY,SAAA,EAAW,GAAA,EAAK;AAAA,KACnF;AACA,IAAA,IAAI,OAAO,MAAA,KAAW,gBAAA,IAAoB,OAAO,MAAA,CAAO,aAAa,QAAA,EAAU;AAC7E,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,QAAQ,CAAA,CAAE,QAAQ,oBAAA,EAAsB;AAC1D,MAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAK,oBAAA,CAAqB,MAAA,CAAO,QAAA,EAAU,OAAA,EAAS,SAAS,MAAM,CAAA;AAAA,EAC5E;AAAA;AAAA,EAGA,MAAM,YAAA,GAAkC;AACtC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,yDAAoD,CAAA;AACpF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,2BAAA,GAAwD;AACtD,IAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC5B,MAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,IAAA,CAAK,kBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,2BAAA,GAAuC;AACrC,IAAA,OAAO,KAAK,kBAAA,KAAuB,IAAA;AAAA,EACrC;AAAA,EAEA,+BAAA,GAA4D;AAS1D,IAAA,OAAO,KAAK,2BAAA,EAA4B;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,+BAA+B,OAAA,EAAuB;AACpD,IAAA,MAAM,MAAA,GAAS,SAAS,OAAO,CAAA;AAC/B,IAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,GAAG,CAAA,EAAG;AACxC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,6BAA6B,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,GAAA,IAAO,IAAI,CAAC,CAAA,qHAAA;AAAA,OAElE;AAAA,IACF;AACA,IAAA,IAAA,CAAK,kBAAA,GAAqB,+BAA+B,OAAO,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,oBAAA,CACZ,QAAA,EACA,QAAA,EACA,eACA,eAAA,EACmB;AACnB,IAAA,IAAI,KAAA,GAAQ,QAAA;AACZ,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AAClC,MAAA,KAAA,GAAQ,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,GAAA,IAAO,OAAO,KAAA,IAAS,QAAA;AAAA,IAC3D,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,MAAA,GAAS,SAAS,KAAK,CAAA;AAC7B,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI,oBAAA,CAAqB,MAAA,CAAO,GAAG,CAAA,EAAG;AACpC,MAAA,MAAM,IAAA,GAAO,eAAA,IAAmB,IAAA,CAAK,eAAA,EAAgB;AACrD,MAAA,kBAAA,CAAmB,MAAA,CAAO,OAAO,IAAI,CAAA;AACrC,MAAA,WAAA,GAAc,IAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,aAAa,KAAK,CAAA;AACvB,IAAA,IAAA,CAAK,kBAAA,GAAqB,uBAAuB,MAAA,CAAO,GAAG,IACvD,8BAAA,CAA+B,KAAA,EAAO,WAAW,CAAA,GACjD,IAAA;AACJ,IAAA,OAAO,KAAK,QAAA,CAAS;AAAA,MACnB,QAAQ,MAAA,CAAO,MAAA,CAAO,OAAO,MAAA,CAAO,OAAA,IAAW,OAAO,GAAG,CAAA;AAAA,MACzD,KAAA,EAAO,OAAO,KAAA,IAAS,aAAA;AAAA,MACvB,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,QAAA,EAAU,kBAAA,CAAmB,MAAA,EAAQ,QAAQ;AAAA,KAC9C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAA,GAA8B;AAC5B,IAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,OAAO,IAAA,CAAK,cAAA;AACrC,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAA,GAAiB,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,YAAY,CAAA;AAAA,IACvE,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACd;AAAA,EAEQ,aAAa,KAAA,EAA4B;AAC/C,IAAA,IAAA,CAAK,cAAA,GAAiB,KAAA;AACtB,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,WAC5D,MAAA,CAAO,cAAA,CAAe,UAAA,CAAW,IAAA,CAAK,YAAY,CAAA;AAAA,IACzD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,UAAA,GAAqB;AAC3B,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,iBAAA,CAAkB,EAAE,CAAC,CAAA;AACpD,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,IAAA,CAAK,cAAA,EAAgB,MAAM,CAAA;AAAA,IAC3D,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,OAAO,WAAW,MAAM,CAAA;AAAA,EAC1B;AAAA;AAAA,EAGQ,eAAA,GAAiC;AACvC,IAAA,IAAI,SAAS,IAAA,CAAK,WAAA;AAClB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA,IAAK,MAAA;AAC/D,MAAA,MAAA,CAAO,cAAA,CAAe,UAAA,CAAW,IAAA,CAAK,cAAc,CAAA;AAAA,IACtD,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,SAAS,EAAA,EAAwB;AACvC,IAAA,IAAA,CAAK,IAAA,GAAO,EAAA;AACZ,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,eAAA,GAAkB,OAAA,CAAQ,IAAA,CAAK,oBAAoB,IAAA,CAAK,SAAA,CAAU,EAAE,CAAC,CAAA;AAAA,MAC5E,CAAA,CAAA,MAAQ;AAAA,MAIR;AAAA,IACF;AACA,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEA,MAAc,IAAI,IAAA,EAA4B;AAC5C,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AACjD,IAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,MAAM,CAAA,UAAA,EAAa,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AAC/E,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB;AAAA,EAEQ,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,OAAO,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAC9E,IAAA,OAAO,KAAK,IAAA,CAAK,KAAA;AAAA,EACnB;AAAA,EAEA,MAAc,SAAA,CAAU,IAAA,EAAc,IAAA,EAA6B;AACjE,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACjD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,KAC1B,CAAA;AACD,IAAA,IAAI,CAAA,CAAE,EAAA,EAAI,OAAO,CAAA,CAAE,IAAA,EAAK;AACxB,IAAA,MAAM,OAAO,MAAM,CAAA,CAAE,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC1C,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG,KAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,GAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAQ,OAAO,IAAA,KAAS,QAAA,GAAW,YAAA,CAAa,IAAI,CAAA,GAAI,MAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,KAAA,IAAS,CAAA,UAAA,EAAa,IAAI,OAAO,CAAA,CAAE,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAAA,EACrE;AAAA,EAEA,MAAc,IAAA,CAAK,IAAA,EAAc,IAAA,EAA6B;AAC5D,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACjD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,KAC1B,CAAA;AACD,IAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,MAAM,CAAA,UAAA,EAAa,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AAC/E,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB;AACF;AAEA,IAAM,YAAA,GAAuC;AAAA,EAC3C,eAAA,EAAiB,8BAAA;AAAA,EACjB,aAAA,EAAe,kDAAA;AAAA,EACf,mBAAA,EAAqB,2CAAA;AAAA,EACrB,aAAA,EAAe,gFAAA;AAAA,EACf,YAAA,EAAc,gDAAA;AAAA,EACd,iBAAA,EAAmB,0DAAA;AAAA,EACnB,mBAAA,EAAqB,0DAAA;AAAA,EACrB,aAAA,EAAe;AACjB,CAAA;AAEA,SAAS,eAAe,KAAA,EAAuB;AAC7C,EAAA,OAAO,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAClC;AAGA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,IAAI,MAAM,QAAA,CAAS,YAAY,KAAK,KAAA,CAAM,QAAA,CAAS,eAAe,CAAA,EAAG;AACnE,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA,GAAQ,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAC9E,IAAA,OAAO,OAAO,GAAA,CAAI,WAAW,KAAK,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA;AAAA,EAClE;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,oBAAoB,KAAA,EAA8B;AACzD,EAAA,IAAI,qBAAA,CAAsB,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,GAC/B,IAAI,IAAI,KAAK,CAAA,CAAE,eACf,IAAI,eAAA,CAAgB,MAAM,UAAA,CAAW,GAAG,IAAI,KAAA,GAAQ,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AACnE,IAAA,OAAO,MAAA,CAAO,IAAI,iBAAiB,CAAA;AAAA,EACrC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,uBAAA,GAAyC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,SAAS,IAAI,CAAA;AACxC,EAAA,GAAA,CAAI,YAAA,CAAa,OAAO,iBAAiB,CAAA;AACzC,EAAA,GAAA,CAAI,YAAA,CAAa,OAAO,WAAW,CAAA;AACnC,EAAA,GAAA,CAAI,YAAA,CAAa,OAAO,cAAc,CAAA;AACtC,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAWA,SAAS,kBAAA,CAAmB,QAAa,QAAA,EAA0B;AACjE,EAAA,QAAQ,QAAQ,GAAA;AAAK,IACnB,KAAK,6BAAA;AACH,MAAA,OAAO,QAAA;AAAA,IACT,KAAK,2BAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT,KAAK,oBAAA;AACH,MAAA,OAAO,OAAA;AAAA,IACT;AACE,MAAA,OAAO,QAAQ,QAAA,IAAY,QAAA;AAAA;AAEjC;AAEA,SAAS,SAAS,GAAA,EAAkB;AAClC,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACpD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AACxB","file":"chunk-HTAIM7NU.mjs","sourcesContent":["/** Characters in the sign-in code the enclave mails. */\nexport const EMAIL_CODE_LENGTH = 9;\n\n/**\n * A code as the enclave compares it: lower-case, with whitespace and hyphens\n * removed, so a pasted `QPZ-RY9 X8G` is the code that was sent.\n */\nexport function normalizeEmailCode(raw: string): string {\n  return raw.toLowerCase().replace(/[\\s-]/g, \"\");\n}\n","import type { AuthProvider, Identity } from \"./AuthProvider\";\nimport {\n  createSocialRecoveryCredential,\n  ENCLAVE_EMAIL_ISSUER,\n  isSocialRecoveryIssuer,\n  type SocialRecoveryCredential,\n} from \"../recovery/SocialRecoveryCredential\";\nimport type { AttestationPolicy } from \"../recovery/SocialRecoveryClient\";\nimport { DEFAULT_SOCIAL_RECOVERY_ATTESTATION } from \"../recovery/attestationDefaults\";\nimport { runEnclaveJob, verifiedChannelKey } from \"../recovery/enclaveChannel\";\nimport { secureRandomBytes } from \"../crypto/encoding\";\nimport { normalizeEmailCode } from \"./emailCode\";\nimport {\n  assertLoginBinding,\n  loginNonce,\n  loginSecretFrom,\n  requiresLoginBinding,\n} from \"./loginBinding\";\n\nexport interface CavosAuthOptions {\n  /** Cavos backend base URL. Defaults to the hosted service (same as @cavos/react). */\n  backendUrl?: string;\n  /** App identifier registered with Cavos (the `appId` from the dashboard). */\n  appId?: string;\n  /**\n   * `false` keeps the signed-in identity in `sessionStorage`: it survives a\n   * reload and the OAuth redirect, and ends when the tab closes. Any identity\n   * already in `localStorage` is removed. Defaults to `true` (`localStorage`,\n   * signed in across tabs and restarts).\n   */\n  persistSession?: boolean;\n  /**\n   * The enclave measurements email login verifies before it sends a code to\n   * the enclave. Defaults to the enclave shipped with this package.\n   */\n  attestation?: AttestationPolicy;\n}\n\n/**\n * Hosted login (Privy-like) backed by the Cavos backend — same endpoints\n * `@cavos/react` uses for Google / Apple OAuth, plus an email code the recovery\n * enclave generates and verifies itself. Login only\n * resolves a stable `userId` (the OAuth `sub` claim); it never touches signing.\n * Feed the returned `Identity` to `Cavos.connect`.\n *\n *   const auth = new CavosAuth({ appId });\n *   // social: open the returned URL; user returns, then:\n *   const identity = await auth.handleCallback(window.location.search);\n *   // or email OTP:\n *   await auth.sendOtp(email); const identity = await auth.verifyOtp(email, code);\n *   const cavos = await Cavos.connect({ network, appSalt, identity, paymasterApiKey });\n *\n * Device-signer model note: the backend issues a Cavos JWT (the same one react\n * uses for on-chain RSA verification). Here we only need the stable `sub` claim\n * from it — the RSA/JWKS/nonce machinery react relies on is dead weight for the\n * device model, because the device key (not the JWT) authorizes on-chain calls.\n * The provider token is kept in `sessionStorage` so a reconnect can still\n * authenticate to the wallet registry. The separate social-recovery credential\n * is NOT: it stays in memory, its SHA-256 fingerprint reserves exactly one\n * enclave session, and the token itself travels only through the attested\n * encrypted channel.\n */\nexport class CavosAuth implements AuthProvider {\n  private readonly backendUrl: string;\n  private readonly identityStorageKey: string;\n  private readonly authTokenKey: string;\n  private readonly loginSecretKey: string;\n  /** The login secret, for a callback this same instance handles. */\n  private loginSecret: string | null = null;\n  private last: Identity | null = null;\n  /** Fresh OIDC proof retained only in memory for an immediate TEE recovery.\n   * Never persisted to localStorage and never sent to the Cavos control plane\n   * outside the attested encrypted channel. */\n  private recoveryCredential: SocialRecoveryCredential | null = null;\n  /**\n   * The raw provider token from this session's login.\n   *\n   * Held in `sessionStorage`, not memory alone. The wallet registry\n   * authenticates with it, and `resolveAddress` fails closed rather than mint a\n   * second wallet for a user who already has one — so a token that does not\n   * survive a reload takes every reconnect down with it, and a device with no\n   * cached address can never connect at all.\n   *\n   * `sessionStorage` and not `localStorage`: it dies with the tab, is not shared\n   * across tabs, and never reaches another origin. The token is already inside\n   * this page's JavaScript either way; what changes is that it now outlives a\n   * navigation, which is exactly what the reconnect needs.\n   */\n  private authTokenValue: string | null = null;\n\n  constructor(private readonly opts: CavosAuthOptions = {}) {\n    this.backendUrl = opts.backendUrl ?? \"https://cavos.xyz\";\n    this.identityStorageKey = `cavos-kit:identity:${opts.appId ?? \"default\"}`;\n    this.authTokenKey = `cavos-kit:token:${opts.appId ?? \"default\"}`;\n    this.loginSecretKey = `cavos-kit:login-secret:${opts.appId ?? \"default\"}`;\n    if (opts.persistSession === false && typeof window !== \"undefined\") {\n      // An identity saved before the app turned persistence off would\n      // otherwise keep this browser signed in for good.\n      try {\n        window.localStorage.removeItem(this.identityStorageKey);\n      } catch {\n        /* nothing was stored if storage is unavailable */\n      }\n    }\n  }\n\n  /**\n   * Where the identity lives. Resolved on use, not in the constructor, because\n   * the provider also builds this during SSR, where there is no `window`.\n   */\n  private identityStorage(): Storage {\n    return this.opts.persistSession === false ? window.sessionStorage : window.localStorage;\n  }\n\n  /**\n   * Restore the last confirmed identity for this app on this browser. This is\n   * deliberately only public profile data — never an OAuth token or private\n   * key. The device signer remains protected in IndexedDB/WebCrypto.\n   */\n  restoreIdentity(): Identity | null {\n    if (typeof window === \"undefined\") return null;\n    try {\n      const value = this.identityStorage().getItem(this.identityStorageKey);\n      if (!value) return null;\n      const identity = JSON.parse(value) as Identity;\n      if (!identity.userId || typeof identity.userId !== \"string\") return null;\n      this.last = identity;\n      return identity;\n    } catch {\n      return null;\n    }\n  }\n\n  /** Clear the persisted identity on an explicit user logout. */\n  clearStoredIdentity(): void {\n    this.last = null;\n    this.recoveryCredential = null;\n    this.setAuthToken(null);\n    if (typeof window !== \"undefined\") {\n      try {\n        this.identityStorage().removeItem(this.identityStorageKey);\n      } catch {\n        /* nothing was stored if storage is unavailable */\n      }\n    }\n  }\n\n  /** Redirect URL for Google login (open it; user returns to your redirectUri). */\n  async getGoogleOAuthUrl(redirectUri?: string): Promise<string> {\n    return this.oauthUrl(\"google\", redirectUri);\n  }\n\n  /** Redirect URL for Apple login. */\n  async getAppleOAuthUrl(redirectUri?: string): Promise<string> {\n    return this.oauthUrl(\"apple\", redirectUri);\n  }\n\n  private async oauthUrl(provider: \"google\" | \"apple\", redirectUri?: string): Promise<string> {\n    if (typeof window === \"undefined\") throw new Error(\"kit/auth: OAuth requires a browser\");\n    const params = new URLSearchParams({\n      nonce: this.startLogin(),\n      redirect_uri: redirectUri ?? window.location.href,\n      ...(this.opts.appId ? { app_id: this.opts.appId } : {}),\n    });\n    const { url } = await this.get(`/api/oauth/v2/${provider}?${params}`);\n    return url;\n  }\n\n  /**\n   * Resolve identity from an OAuth callback. Current callbacks carry only a\n   * short-lived one-time code; legacy raw auth data remains readable so apps can\n   * roll forward without losing an already-open callback.\n   */\n  async handleCallback(authDataOrSearch: string, redirectUri?: string): Promise<Identity> {\n    const callbackCode = extractCallbackCode(authDataOrSearch);\n    if (callbackCode) {\n      const callbackRedirectUri = redirectUri ?? currentCleanCallbackUrl();\n      if (!callbackRedirectUri) throw new Error(\"kit/auth: callback redirect URI is required\");\n      const result = await this.post(\"/api/oauth/callback/exchange\", {\n        code: callbackCode,\n        app_id: this.opts.appId,\n        redirect_uri: callbackRedirectUri,\n      });\n      return this.identityFromAuthData(JSON.stringify(result), \"oauth\");\n    }\n    const authData = extractAuthData(authDataOrSearch);\n    return this.identityFromAuthData(authData, \"oauth\");\n  }\n\n  /**\n   * Email a 9-character sign-in code. The code is generated and mailed by the\n   * recovery enclave, so the Cavos control plane never sees it.\n   */\n  async sendOtp(email: string): Promise<void> {\n    await this.emailPost(\"/api/oauth/email/code\", {\n      app_id: this.requireAppId(),\n      email: normalizeEmail(email),\n    });\n  }\n\n  /**\n   * Verify the emailed code inside the attested enclave and resolve the\n   * identity. The enclave answers with its own signed token, bound to a secret\n   * created here, and that token is used exactly like a Google id_token.\n   */\n  async verifyOtp(email: string, code: string): Promise<Identity> {\n    const appId = this.requireAppId();\n    const address = normalizeEmail(email);\n    const secret = loginSecretFrom(secureRandomBytes(32));\n    const session = await this.emailPost(\"/api/oauth/email/session\", { app_id: appId });\n    const sessionId: unknown = session?.session_id;\n    if (typeof sessionId !== \"string\") {\n      throw new Error(\"kit/auth: the email session carried no id\");\n    }\n    const channelKey = await verifiedChannelKey(\n      sessionId,\n      session.attestation_document_b64,\n      this.opts.attestation ?? DEFAULT_SOCIAL_RECOVERY_ATTESTATION,\n    );\n    const result = await runEnclaveJob<{ result?: string; id_token?: unknown }>(\n      sessionId,\n      channelKey,\n      {\n        action: \"verify_email\",\n        email: address,\n        code: normalizeEmailCode(code),\n        client_nonce: loginNonce(secret),\n      },\n      (job) => this.emailPost(\"/api/oauth/email/verify\", { session_id: sessionId, job }),\n    );\n    if (result.result !== \"email_verified\" || typeof result.id_token !== \"string\") {\n      throw new Error(\"kit/auth: the enclave did not verify this email\");\n    }\n    if (parseJwt(result.id_token).iss !== ENCLAVE_EMAIL_ISSUER) {\n      throw new Error(\"kit/auth: the email token was not issued by the enclave\");\n    }\n    return this.identityFromAuthData(result.id_token, \"email\", address, secret);\n  }\n\n  /** AuthProvider: returns the identity resolved by the last login step. */\n  async authenticate(): Promise<Identity> {\n    if (!this.last) throw new Error(\"kit/auth: no identity yet — complete a login first\");\n    return this.last;\n  }\n\n  /**\n   * Return the fresh social credential the recovery enclave requires.\n   * Callers should use it immediately; it is intentionally not restorable\n   * after a refresh. A new social login is required for each recovery attempt.\n   */\n  getSocialRecoveryCredential(): SocialRecoveryCredential {\n    if (!this.recoveryCredential) {\n      throw new Error(\"kit/auth: complete a fresh social login before recovery\");\n    }\n    return this.recoveryCredential;\n  }\n\n  /**\n   * Take the fresh social credential exactly once. A provider token is bound to\n   * one enclave session, so retaining it after recovery only permits accidental\n   * replay attempts during the wallet's post-recovery reconnect.\n   */\n  /**\n   * Whether a login proof is available without taking it.\n   *\n   * The UI has to choose how a device gets authorized before anything runs, and\n   * that choice depends on whether the enclave can be used at all. Asking with\n   * `consume` would spend the proof to find out.\n   */\n  hasSocialRecoveryCredential(): boolean {\n    return this.recoveryCredential !== null;\n  }\n\n  consumeSocialRecoveryCredential(): SocialRecoveryCredential {\n    // Kept for the session rather than dropped on first use. A session holds a\n    // wallet on every configured chain and each needs its own enrolment, so\n    // spending the credential on the first one left the rest unprotected —\n    // with no error, because there was simply nothing left to try with.\n    //\n    // Replay is the control plane's to refuse, and it does: one session per\n    // credential per wallet. It cannot be reused against a wallet it has\n    // already enrolled.\n    return this.getSocialRecoveryCredential();\n  }\n\n  /**\n   * Accept a provider id_token obtained by the host's own authentication.\n   *\n   * Apps that sign users in themselves already hold a Google or Apple token;\n   * this lets social recovery use it instead of sending the user through a\n   * second sign-in. Nothing here grants trust: the token is checked inside the\n   * enclave against the issuer and audience sealed for the app, and only Google\n   * or Apple can produce a token that passes.\n   *\n   * Rejected up front if it was not issued by a provider the enclave accepts,\n   * so a mistake surfaces here rather than as an opaque enclave failure.\n   *\n   * The token must be recent — the enclave requires the authentication to be\n   * within five minutes — so pass one straight from a sign-in, not a stored one.\n   */\n  useExternalSocialRecoveryToken(idToken: string): void {\n    const claims = parseJwt(idToken);\n    if (!isSocialRecoveryIssuer(claims?.iss)) {\n      throw new Error(\n        `kit/auth: id_token issuer ${JSON.stringify(claims?.iss ?? null)} cannot be used for social recovery. ` +\n          \"Pass the raw Google or Apple id_token from your login, not your own session JWT.\",\n      );\n    }\n    this.recoveryCredential = createSocialRecoveryCredential(idToken);\n  }\n\n  // ── internals ──────────────────────────────────────────────────────────────\n\n  /**\n   * Build an `Identity` from whatever the backend returned. The Cavos backend\n   * wraps the user id in a JWT (its `sub` claim); for the device model we only\n   * need that stable id — the signature is never checked on-chain.\n   */\n  private async identityFromAuthData(\n    authData: string,\n    provider: string,\n    emailOverride?: string,\n    presentedSecret?: string,\n  ): Promise<Identity> {\n    let token = authData;\n    try {\n      const parsed = JSON.parse(authData);\n      token = parsed.id_token ?? parsed.jwt ?? parsed.token ?? authData;\n    } catch {\n      // raw JWT\n    }\n    const claims = parseJwt(token);\n    let loginSecret: string | undefined;\n    if (requiresLoginBinding(claims.iss)) {\n      const kept = presentedSecret ?? this.takeLoginSecret();\n      assertLoginBinding(claims.nonce, kept);\n      loginSecret = kept;\n    }\n    this.setAuthToken(token);\n    this.recoveryCredential = isSocialRecoveryIssuer(claims.iss)\n      ? createSocialRecoveryCredential(token, loginSecret)\n      : null;\n    return this.remember({\n      userId: String(claims.sub ?? claims.user_id ?? claims.uid),\n      email: claims.email ?? emailOverride,\n      name: claims.name,\n      provider: providerFromClaims(claims, provider),\n    });\n  }\n\n  /**\n   * The provider id_token from this session's login, for the wallet registry.\n   * Null on a page reload that restored the identity from storage but not\n   * the token — the address cache covers that device; a brand-new device has\n   * just logged in and therefore has one.\n   */\n  getAuthToken(): string | null {\n    if (this.authTokenValue) return this.authTokenValue;\n    try {\n      this.authTokenValue = window.sessionStorage.getItem(this.authTokenKey);\n    } catch {\n      // No session storage (private mode, blocked): memory only, as before.\n    }\n    return this.authTokenValue;\n  }\n\n  private setAuthToken(token: string | null): void {\n    this.authTokenValue = token;\n    if (typeof window === \"undefined\") return;\n    try {\n      if (token) window.sessionStorage.setItem(this.authTokenKey, token);\n      else window.sessionStorage.removeItem(this.authTokenKey);\n    } catch {\n      /* memory-only fallback; a reconnect will 401 as it did before */\n    }\n  }\n\n  /**\n   * Begin a Google or Apple login: keep a fresh secret for the trip to the\n   * provider and back, and return the nonce that commits to it.\n   *\n   * `sessionStorage` because the login navigates away and the secret has to be\n   * here when the callback lands; it is removed as soon as it is read. Where\n   * storage is unavailable only this instance remembers it, so a login that\n   * reloads the page is refused at the callback — the safe outcome.\n   */\n  private startLogin(): string {\n    const secret = loginSecretFrom(secureRandomBytes(32));\n    this.loginSecret = secret;\n    try {\n      window.sessionStorage.setItem(this.loginSecretKey, secret);\n    } catch {\n      /* memory only */\n    }\n    return loginNonce(secret);\n  }\n\n  /** The secret of the login in flight, taken exactly once. */\n  private takeLoginSecret(): string | null {\n    let secret = this.loginSecret;\n    this.loginSecret = null;\n    try {\n      secret = window.sessionStorage.getItem(this.loginSecretKey) ?? secret;\n      window.sessionStorage.removeItem(this.loginSecretKey);\n    } catch {\n      /* memory only */\n    }\n    return secret;\n  }\n\n  private remember(id: Identity): Identity {\n    this.last = id;\n    if (typeof window !== \"undefined\") {\n      try {\n        this.identityStorage().setItem(this.identityStorageKey, JSON.stringify(id));\n      } catch {\n        // Private mode and blocked site data throw here. This store only saves\n        // a returning user from signing in again; an unwritable one must not\n        // take down the login that just succeeded.\n      }\n    }\n    return id;\n  }\n\n  private async get(path: string): Promise<any> {\n    const r = await fetch(`${this.backendUrl}${path}`);\n    if (!r.ok) throw new Error(`kit/auth: ${path} -> ${r.status} ${await r.text()}`);\n    return r.json();\n  }\n\n  private requireAppId(): string {\n    if (!this.opts.appId) throw new Error(\"kit/auth: email sign-in needs an appId\");\n    return this.opts.appId;\n  }\n\n  private async emailPost(path: string, body: unknown): Promise<any> {\n    const r = await fetch(`${this.backendUrl}${path}`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n    if (r.ok) return r.json();\n    const text = await r.text().catch(() => \"\");\n    let code: unknown;\n    try {\n      code = JSON.parse(text)?.error;\n    } catch {\n      code = undefined;\n    }\n    const known = typeof code === \"string\" ? EMAIL_ERRORS[code] : undefined;\n    throw new Error(known ?? `kit/auth: ${path} -> ${r.status} ${text}`);\n  }\n\n  private async post(path: string, body: unknown): Promise<any> {\n    const r = await fetch(`${this.backendUrl}${path}`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n    if (!r.ok) throw new Error(`kit/auth: ${path} -> ${r.status} ${await r.text()}`);\n    return r.json();\n  }\n}\n\nconst EMAIL_ERRORS: Record<string, string> = {\n  invalid_request: \"Enter a valid email address.\",\n  app_not_found: \"kit/auth: this app is not registered with Cavos.\",\n  email_undeliverable: \"This email provider is not supported yet.\",\n  code_cooldown: \"A code was just sent to this address. Wait a minute before requesting another.\",\n  rate_limited: \"Too many attempts. Try again in a few minutes.\",\n  email_unavailable: \"Email sign-in is unavailable right now. Try again later.\",\n  enclave_unavailable: \"Email sign-in is unavailable right now. Try again later.\",\n  code_rejected: \"That code is wrong or has expired. Request a new one.\",\n};\n\nfunction normalizeEmail(email: string): string {\n  return email.trim().toLowerCase();\n}\n\n/** Pull the `auth_data` / `zk_auth_data` value out of a callback string. */\nfunction extractAuthData(input: string): string {\n  if (input.includes(\"auth_data=\") || input.includes(\"zk_auth_data=\")) {\n    const params = new URLSearchParams(input.startsWith(\"?\") ? input : `?${input}`);\n    return params.get(\"auth_data\") ?? params.get(\"zk_auth_data\") ?? input;\n  }\n  return input;\n}\n\nfunction extractCallbackCode(input: string): string | null {\n  if (/^[A-Za-z0-9_-]{43}$/.test(input)) return input;\n  try {\n    const params = input.includes('://')\n      ? new URL(input).searchParams\n      : new URLSearchParams(input.startsWith('?') ? input : `?${input}`);\n    return params.get('cavos_auth_code');\n  } catch {\n    return null;\n  }\n}\n\nfunction currentCleanCallbackUrl(): string | null {\n  if (typeof window === 'undefined') return null;\n  const url = new URL(window.location.href);\n  url.searchParams.delete('cavos_auth_code');\n  url.searchParams.delete('auth_data');\n  url.searchParams.delete('zk_auth_data');\n  return url.toString();\n}\n\n/** Decode a JWT payload (no verification — the backend already validated it). */\n/**\n * Which provider actually signed this token.\n *\n * A raw Google or Apple id_token carries no `provider` claim, so the OAuth\n * path would fall through to the literal \"oauth\" — true, and useless to\n * anything that wants to name the provider back to the user. The issuer is the\n * authoritative answer and is always there.\n */\nfunction providerFromClaims(claims: any, fallback: string): string {\n  switch (claims?.iss) {\n    case \"https://accounts.google.com\":\n      return \"google\";\n    case \"https://appleid.apple.com\":\n      return \"apple\";\n    case ENCLAVE_EMAIL_ISSUER:\n      return \"email\";\n    default:\n      return claims?.provider ?? fallback;\n  }\n}\n\nfunction parseJwt(jwt: string): any {\n  const part = jwt.split(\".\")[1];\n  if (!part) throw new Error(\"kit/auth: malformed JWT\");\n  const json = atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n  return JSON.parse(json);\n}\n"]}