{"version":3,"sources":["../src/index.ts","../src/class.ts"],"sourcesContent":["/**\n * @otplib/totp\n *\n * RFC 6238 TOTP (Time-Based One-Time Password) implementation.\n *\n * TOTP extends HOTP (RFC 4226) by using time as the moving factor\n * instead of an event counter.\n *\n * @see {@link https://tools.ietf.org/html/rfc6238 | RFC 6238}\n * @see {@link https://tools.ietf.org/html/rfc4226 | RFC 4226 (HOTP base algorithm)}\n */\n\nimport {\n  createGuardrails,\n  normalizeSecret,\n  normalizeEpochTolerance,\n  normalizeHashAlgorithm,\n  validateEpochTolerance,\n  validatePeriod,\n  validateSecret,\n  validateTime,\n  validateToken,\n  requireSecret,\n  requireCryptoPlugin,\n  AfterTimeStepNegativeError,\n  AfterTimeStepNotIntegerError,\n  AfterTimeStepRangeExceededError,\n} from \"@otplib/core\";\nimport { generate as generateHOTP, generateSync as generateHOTPSync } from \"@otplib/hotp\";\n\nimport type { TOTPGenerateOptions, TOTPVerifyOptions, VerifyResult } from \"./types.js\";\nimport type { CryptoPlugin, Digits, HashAlgorithm, OTPGuardrails, OTPHooks } from \"@otplib/core\";\n\n/**\n * Normalized options for TOTP generation\n * @internal\n */\ntype TOTPGenerateOptionsInternal = {\n  secret: Uint8Array;\n  counter: number;\n  algorithm: HashAlgorithm;\n  digits: Digits;\n  crypto: CryptoPlugin;\n  guardrails: OTPGuardrails;\n  hooks?: OTPHooks;\n};\n\n/**\n * Prepare and validate TOTP generation options\n *\n * Extracts defaults, normalizes the secret, validates parameters,\n * and calculates the HOTP counter from the epoch.\n *\n * @param options - TOTP generation options\n * @returns Normalized options ready for HOTP generation\n * @internal\n */\nfunction getTOTPGenerateOptions(options: TOTPGenerateOptions): TOTPGenerateOptionsInternal {\n  const {\n    secret,\n    epoch = Math.floor(Date.now() / 1000),\n    t0 = 0,\n    period = 30,\n    algorithm: rawAlgorithm = \"sha1\",\n    digits = 6,\n    crypto,\n    base32,\n    guardrails = createGuardrails(),\n    hooks,\n  } = options;\n\n  requireSecret(secret);\n  requireCryptoPlugin(crypto);\n\n  const secretBytes = normalizeSecret(secret, base32);\n  validateSecret(secretBytes, guardrails);\n  validateTime(epoch);\n  validatePeriod(period, guardrails);\n  // Case-fold at the public API boundary: untyped JS callers may pass 'SHA1'.\n  // Checked against the configured plugin's own set, so a plugin supporting\n  // fewer algorithms reports what it actually accepts rather than the full set.\n  const algorithm = normalizeHashAlgorithm(rawAlgorithm, {\n    supported: crypto.algorithms,\n    plugin: crypto.name,\n  });\n\n  const counter = Math.floor((epoch - t0) / period);\n\n  return {\n    secret: secretBytes,\n    counter,\n    algorithm,\n    digits,\n    crypto,\n    guardrails,\n    hooks,\n  };\n}\n\n/**\n * Generate a Time-based One-Time Password (TOTP)\n *\n * Implements the TOTP algorithm as specified in RFC 6238 Section 4:\n *\n * ```\n * T = (Current Unix time - T0) / X\n * TOTP = HOTP(K, T)\n * ```\n *\n * Where:\n * - T0 is the Unix time to start counting time steps (default 0, per RFC 6238 Section 4.1)\n * - X is the time step in seconds (default 30, per RFC 6238 Section 4.1)\n * - K is the shared secret key\n *\n * @see {@link https://tools.ietf.org/html/rfc6238#section-4 | RFC 6238 Section 4 - TOTP Algorithm}\n * @see {@link https://tools.ietf.org/html/rfc6238#section-4.1 | RFC 6238 Section 4.1 - Parameters}\n *\n * @param options - TOTP generation options\n * @returns The TOTP code as a string\n * @throws {AlgorithmUnsupportedError} If the algorithm is invalid or unsupported by the plugin\n * @throws {HMACError} If HMAC computation fails in the crypto plugin\n *\n * @example\n * ```ts\n * import { generate } from '@otplib/totp';\n * import { NodeCryptoPlugin } from '@otplib/plugin-crypto-node';\n *\n * const totp = generate({\n *   secret: new Uint8Array([1, 2, 3, 4, 5]),\n *   time: Date.now() / 1000,\n *   period: 30,\n *   digits: 6,\n *   crypto: new NodeCryptoPlugin(),\n * });\n * // Returns: '123456'\n * ```\n */\nexport async function generate(options: TOTPGenerateOptions): Promise<string> {\n  const opt = getTOTPGenerateOptions(options);\n  return generateHOTP(opt);\n}\n\n/**\n * Generate a Time-based One-Time Password (TOTP) synchronously\n *\n * This is the synchronous version of {@link generate}. It requires a crypto\n * plugin that supports synchronous HMAC operations (e.g., NodeCryptoPlugin\n * or NobleCryptoPlugin). Using this with WebCryptoPlugin will throw an error.\n *\n * @see {@link generate} for the async version\n * @see {@link https://tools.ietf.org/html/rfc6238#section-4 | RFC 6238 Section 4}\n *\n * @param options - TOTP generation options\n * @returns The TOTP code as a string\n * @throws {AlgorithmUnsupportedError} If the algorithm is invalid or unsupported by the plugin\n * @throws {HMACError} If HMAC computation fails or the plugin does not support sync operations\n *\n * @example\n * ```ts\n * import { generateSync } from '@otplib/totp';\n * import { NodeCryptoPlugin } from '@otplib/plugin-crypto-node';\n *\n * const totp = generateSync({\n *   secret: new Uint8Array([1, 2, 3, 4, 5]),\n *   epoch: Math.floor(Date.now() / 1000),\n *   period: 30,\n *   digits: 6,\n *   crypto: new NodeCryptoPlugin(),\n * });\n * // Returns: '123456'\n * ```\n */\nexport function generateSync(options: TOTPGenerateOptions): string {\n  const opt = getTOTPGenerateOptions(options);\n  return generateHOTPSync(opt);\n}\n\n/**\n * Validate afterTimeStep parameter for replay protection\n *\n * Ensures afterTimeStep is a valid non-negative integer and doesn't make\n * verification impossible by exceeding the valid counter range.\n *\n * @param afterTimeStep - The afterTimeStep value to validate (undefined is valid)\n * @param maxCounter - The maximum counter in the verification window\n * @throws {AfterTimeStepNegativeError} If afterTimeStep is negative\n * @throws {AfterTimeStepNotIntegerError} If afterTimeStep is not an integer\n * @throws {AfterTimeStepRangeExceededError} If afterTimeStep exceeds maxCounter\n *\n * @internal\n */\nfunction validateAfterTimeStep(afterTimeStep: number | undefined, maxCounter: number): void {\n  if (afterTimeStep === undefined) {\n    return;\n  }\n\n  if (afterTimeStep < 0) {\n    throw new AfterTimeStepNegativeError();\n  }\n\n  if (!Number.isSafeInteger(afterTimeStep)) {\n    throw new AfterTimeStepNotIntegerError();\n  }\n\n  if (afterTimeStep > maxCounter) {\n    throw new AfterTimeStepRangeExceededError();\n  }\n}\n\n/**\n * Check if a counter should be skipped based on afterTimeStep\n * @internal\n */\nfunction shouldSkipAfterTimeStep(counter: number, afterTimeStep: number | undefined): boolean {\n  return afterTimeStep !== undefined && counter <= afterTimeStep;\n}\n\n/**\n * Normalized options for TOTP verification\n * @internal\n */\ntype TOTPVerifyOptionsInternal = {\n  token: string;\n  crypto: CryptoPlugin;\n  minCounter: number;\n  maxCounter: number;\n  currentCounter: number;\n  t0: number;\n  period: number;\n  afterTimeStep?: number;\n\n  getGenerateOptions: (counter: number) => TOTPGenerateOptions;\n};\n\n/**\n * Prepare and validate TOTP verification options\n *\n * Extracts defaults, normalizes the secret, validates parameters,\n * and calculates the counter range based on epoch tolerance.\n *\n * @param options - TOTP verification options\n * @returns Normalized options with calculated counter range\n * @internal\n */\nfunction getTOTPVerifyOptions(options: TOTPVerifyOptions): TOTPVerifyOptionsInternal {\n  const {\n    secret,\n    token,\n    epoch = Math.floor(Date.now() / 1000),\n    t0 = 0,\n    period = 30,\n    algorithm: rawAlgorithm = \"sha1\",\n    digits = 6,\n    crypto,\n    base32,\n    epochTolerance = 0,\n    afterTimeStep,\n    guardrails = createGuardrails(),\n    hooks,\n  } = options;\n\n  requireSecret(secret);\n  requireCryptoPlugin(crypto);\n\n  const secretBytes = normalizeSecret(secret, base32);\n  validateSecret(secretBytes, guardrails);\n  validateTime(epoch);\n  validatePeriod(period, guardrails);\n  // Case-fold at the public API boundary: untyped JS callers may pass 'SHA1'.\n  // Checked against the configured plugin's own set, so a plugin supporting\n  // fewer algorithms reports what it actually accepts rather than the full set.\n  const algorithm = normalizeHashAlgorithm(rawAlgorithm, {\n    supported: crypto.algorithms,\n    plugin: crypto.name,\n  });\n\n  // Use custom validator if provided, otherwise default digit-only check\n  if (hooks?.validateToken) {\n    hooks.validateToken(token, digits);\n  } else {\n    validateToken(token, digits);\n  }\n\n  validateEpochTolerance(epochTolerance, period, guardrails);\n\n  const currentCounter = Math.floor((epoch - t0) / period);\n\n  // Normalize epochTolerance to [pastTolerance, futureTolerance]\n  const [pastTolerance, futureTolerance] = normalizeEpochTolerance(epochTolerance);\n\n  // Calculate the range of counters that could have valid tokens\n  // Valid time range is [epoch - pastTolerance, epoch + futureTolerance]\n  const minCounter = Math.max(0, Math.floor((epoch - pastTolerance - t0) / period));\n  const maxCounter = Math.floor((epoch + futureTolerance - t0) / period);\n\n  // Validate afterTimeStep against the calculated maxCounter\n  validateAfterTimeStep(afterTimeStep, maxCounter);\n\n  return {\n    token,\n    crypto,\n    minCounter,\n    maxCounter,\n    currentCounter,\n    t0,\n    period,\n    afterTimeStep,\n    getGenerateOptions: (counter: number) => ({\n      secret: secretBytes,\n      epoch: counter * period + t0,\n      t0,\n      period,\n      algorithm,\n      digits,\n      crypto,\n      guardrails,\n      hooks,\n    }),\n  };\n}\n\n/**\n * Verify a TOTP code\n *\n * Compares the provided token against the expected TOTP value\n * using constant-time comparison to prevent timing attacks.\n *\n * The verification window allows for clock drift between client and server,\n * as recommended in RFC 6238 Section 5.2.\n *\n * @see {@link https://tools.ietf.org/html/rfc6238#section-5.2 | RFC 6238 Section 5.2 - Validation and Time-Step Size}\n *\n * @param options - TOTP verification options\n * @returns Verification result with validity and optional delta\n * @throws {AlgorithmUnsupportedError} If the algorithm is invalid or unsupported by the plugin\n * @throws {HMACError} If HMAC computation fails in the crypto plugin\n *\n * @example Using epochTolerance\n * ```ts\n * import { verify } from '@otplib/totp';\n * import { NodeCryptoPlugin } from '@otplib/plugin-crypto-node';\n *\n * // Accept tokens valid within ±30 seconds\n * const result = await verify({\n *   secret: mySecret,\n *   token: '123456',\n *   epochTolerance: 30,\n *   crypto: new NodeCryptoPlugin(),\n * });\n * if (result.valid) {\n *   console.log(`Token matched at epoch: ${result.epoch}`);\n * }\n * ```\n */\nexport async function verify(options: TOTPVerifyOptions): Promise<VerifyResult> {\n  const {\n    token,\n    crypto,\n    minCounter,\n    maxCounter,\n    currentCounter,\n    t0,\n    period,\n    afterTimeStep,\n    getGenerateOptions,\n  } = getTOTPVerifyOptions(options);\n\n  for (let counter = minCounter; counter <= maxCounter; counter++) {\n    // Early rejection: skip counters that don't meet afterTimeStep constraint\n    if (shouldSkipAfterTimeStep(counter, afterTimeStep)) {\n      continue;\n    }\n\n    const expected = await generate(getGenerateOptions(counter));\n    if (crypto.constantTimeEqual(expected, token)) {\n      return {\n        valid: true,\n        delta: counter - currentCounter,\n        epoch: counter * period + t0,\n        timeStep: counter,\n      };\n    }\n  }\n\n  return { valid: false };\n}\n\n/**\n * Verify a TOTP code synchronously\n *\n * This is the synchronous version of {@link verify}. It requires a crypto\n * plugin that supports synchronous HMAC operations (e.g., NodeCryptoPlugin\n * or NobleCryptoPlugin). Using this with WebCryptoPlugin will throw an error.\n *\n * @see {@link verify} for the async version\n * @see {@link https://tools.ietf.org/html/rfc6238#section-5.2 | RFC 6238 Section 5.2}\n *\n * @param options - TOTP verification options\n * @returns Verification result with validity and optional delta\n * @throws {AlgorithmUnsupportedError} If the algorithm is invalid or unsupported by the plugin\n * @throws {HMACError} If HMAC computation fails or the plugin does not support sync operations\n *\n * @example\n * ```ts\n * import { verifySync } from '@otplib/totp';\n * import { NodeCryptoPlugin } from '@otplib/plugin-crypto-node';\n *\n * const result = verifySync({\n *   secret: mySecret,\n *   token: '123456',\n *   epochTolerance: 30,\n *   crypto: new NodeCryptoPlugin(),\n * });\n * if (result.valid) {\n *   console.log(`Token matched at epoch: ${result.epoch}`);\n * }\n * ```\n */\nexport function verifySync(options: TOTPVerifyOptions): VerifyResult {\n  const {\n    token,\n    crypto,\n    minCounter,\n    maxCounter,\n    currentCounter,\n    t0,\n    period,\n    afterTimeStep,\n    getGenerateOptions,\n  } = getTOTPVerifyOptions(options);\n\n  for (let counter = minCounter; counter <= maxCounter; counter++) {\n    // Early rejection: skip counters that don't meet afterTimeStep constraint\n    if (shouldSkipAfterTimeStep(counter, afterTimeStep)) {\n      continue;\n    }\n\n    const expected = generateSync(getGenerateOptions(counter));\n    if (crypto.constantTimeEqual(expected, token)) {\n      return {\n        valid: true,\n        delta: counter - currentCounter,\n        epoch: counter * period + t0,\n        timeStep: counter,\n      };\n    }\n  }\n\n  return { valid: false };\n}\n\n/**\n * Get the remaining time until the next TOTP period\n *\n * @param time - Current Unix timestamp in seconds (default: now)\n * @param period - Time step in seconds (default: 30)\n * @param t0 - Initial Unix time to start counting time steps (default: 0)\n * @returns Remaining seconds until next period\n *\n * @example\n * ```ts\n * import { getRemainingTime } from '@otplib/totp';\n *\n * const remaining = getRemainingTime();\n * // Returns: 15 (seconds remaining in current 30-second window)\n * ```\n */\nexport function getRemainingTime(\n  time: number = Math.floor(Date.now() / 1000),\n  period: number = 30,\n  t0: number = 0,\n  guardrails: OTPGuardrails = createGuardrails(),\n): number {\n  validateTime(time);\n  validatePeriod(period, guardrails);\n\n  const counter = Math.floor((time - t0) / period);\n  const nextCounter = counter + 1;\n  const nextTime = nextCounter * period + t0;\n\n  return nextTime - time;\n}\n\n/**\n * Get the current TOTP counter value\n *\n * @param time - Current Unix timestamp in seconds (default: now)\n * @param period - Time step in seconds (default: 30)\n * @param t0 - Initial Unix time to start counting time steps (default: 0)\n * @returns Current counter value\n *\n * @example\n * ```ts\n * import { getTimeStepUsed } from '@otplib/totp';\n *\n * const counter = getTimeStepUsed();\n * // Returns: 12345 (current counter value)\n * ```\n */\nexport function getTimeStepUsed(\n  time: number = Math.floor(Date.now() / 1000),\n  period: number = 30,\n  t0: number = 0,\n  guardrails: OTPGuardrails = createGuardrails(),\n): number {\n  validateTime(time);\n  validatePeriod(period, guardrails);\n\n  return Math.floor((time - t0) / period);\n}\n\nexport type { CryptoPlugin, Digits, HashAlgorithm, OTPResult } from \"@otplib/core\";\nexport type {\n  TOTPOptions,\n  TOTPGenerateOptions,\n  TOTPVerifyOptions,\n  VerifyResult,\n  VerifyResultValid,\n  VerifyResultInvalid,\n} from \"./types\";\n\nexport { TOTP } from \"./class\";\n\n// Result wrapping utilities for users who want safe variants\nexport { wrapResult, wrapResultAsync } from \"@otplib/core\";\n","/**\n * @otplib/totp\n *\n * TOTP class wrapper for convenient API\n */\n\nimport {\n  generateSecret as generateSecretCore,\n  requireCryptoPlugin,\n  requireBase32Plugin,\n  requireSecret,\n  requireLabel,\n  requireIssuer,\n  requireBase32String,\n  createGuardrails,\n} from \"@otplib/core\";\nimport { generateTOTP as generateTOTPURI } from \"@otplib/uri\";\n\nimport { generate as generateCode, verify as verifyCode } from \"./index.js\";\n\nimport type { VerifyResult, TOTPOptions, TOTPVerifyOptions } from \"./types.js\";\nimport type { OTPGuardrails } from \"@otplib/core\";\n\n/**\n * TOTP class for time-based one-time password generation\n *\n * @example\n * ```typescript\n * import { TOTP } from '@otplib/totp';\n * import { NodeCryptoPlugin } from '@otplib/plugin-crypto-node';\n * import { ScureBase32Plugin } from '@otplib/plugin-base32-scure';\n *\n * const totp = new TOTP({\n *   issuer: 'MyApp',\n *   label: 'user@example.com',\n *   crypto: new NodeCryptoPlugin(),\n *   base32: new ScureBase32Plugin(),\n * });\n *\n * const secret = totp.generateSecret();\n * const token = await totp.generate();\n * const isValid = await totp.verify(token);\n * ```\n */\nexport class TOTP {\n  private readonly options: TOTPOptions;\n  private readonly guardrails: OTPGuardrails;\n\n  constructor(options: TOTPOptions = {}) {\n    this.options = options;\n    this.guardrails = createGuardrails(options.guardrails);\n  }\n\n  /**\n   * Generate a random Base32-encoded secret\n   *\n   * @returns Base32-encoded secret\n   */\n  generateSecret(): string {\n    const { crypto, base32 } = this.options;\n\n    requireCryptoPlugin(crypto);\n    requireBase32Plugin(base32);\n\n    return generateSecretCore({ crypto, base32 });\n  }\n\n  /**\n   * Generate a TOTP code\n   *\n   * @param options - Optional overrides\n   * @returns The TOTP code\n   * @throws {AlgorithmUnsupportedError} If the algorithm is invalid or unsupported by the plugin\n   * @throws {HMACError} If HMAC computation fails in the crypto plugin\n   */\n  async generate(options?: Partial<TOTPOptions>): Promise<string> {\n    const mergedOptions = { ...this.options, ...options };\n    const {\n      secret,\n      crypto,\n      base32,\n      algorithm = \"sha1\",\n      digits = 6,\n      period = 30,\n      epoch,\n      t0 = 0,\n    } = mergedOptions;\n\n    requireSecret(secret);\n    requireCryptoPlugin(crypto);\n\n    // Use class guardrails, or override if provided in options\n    const guardrails = options?.guardrails ?? this.guardrails;\n\n    return generateCode({\n      secret,\n      algorithm,\n      digits,\n      period,\n      epoch: epoch ?? Math.floor(Date.now() / 1000),\n      t0,\n      crypto,\n      base32,\n      guardrails,\n      hooks: mergedOptions.hooks,\n    });\n  }\n\n  /**\n   * Verify a TOTP code\n   *\n   * @param token - The token to verify\n   * @param options - Optional verification options\n   * @returns Verification result with validity and optional delta\n   * @throws {AlgorithmUnsupportedError} If the algorithm is invalid or unsupported by the plugin\n   * @throws {HMACError} If HMAC computation fails in the crypto plugin\n   */\n  async verify(\n    token: string,\n    options?: Partial<Omit<TOTPVerifyOptions, \"token\">>,\n  ): Promise<VerifyResult> {\n    const mergedOptions = { ...this.options, ...options };\n    const {\n      secret,\n      crypto,\n      base32,\n      algorithm = \"sha1\",\n      digits = 6,\n      period = 30,\n      epoch,\n      t0 = 0,\n      epochTolerance = 0,\n      afterTimeStep,\n    } = mergedOptions;\n\n    requireSecret(secret);\n    requireCryptoPlugin(crypto);\n\n    // Use class guardrails, or override if provided in options\n    const guardrails = options?.guardrails ?? this.guardrails;\n\n    return verifyCode({\n      secret,\n      token,\n      algorithm,\n      digits,\n      period,\n      epoch: epoch ?? Math.floor(Date.now() / 1000),\n      t0,\n      epochTolerance,\n      afterTimeStep,\n      crypto,\n      base32,\n      guardrails,\n      hooks: mergedOptions.hooks,\n    });\n  }\n\n  /**\n   * Generate an otpauth:// URI for QR codes\n   *\n   * When called with parameters, merges them with instance options.\n   * This preserves algorithm, digits, and period settings from the instance\n   * while allowing label, issuer, and secret to be overridden.\n   *\n   * @param options - Optional overrides for label, issuer, and secret\n   * @returns The otpauth:// URI\n   * @throws {AlgorithmUnsupportedError} If a non-empty algorithm is not supported\n   *\n   * @example Without parameters (uses instance settings)\n   * ```typescript\n   * const totp = new TOTP({\n   *   label: 'user@example.com',\n   *   issuer: 'MyApp',\n   *   secret: 'JBSWY3DPEHPK3PXP',\n   *   crypto: new NodeCryptoPlugin(),\n   *   base32: new ScureBase32Plugin(),\n   * });\n   * const uri = totp.toURI();\n   * ```\n   *\n   * @example With parameters (overrides instance settings)\n   * ```typescript\n   * const totp = new TOTP({\n   *   algorithm: 'sha256',\n   *   digits: 8,\n   *   crypto: new NodeCryptoPlugin(),\n   *   base32: new ScureBase32Plugin(),\n   * });\n   * // Uses instance's algorithm and digits with provided label/issuer/secret\n   * const uri = totp.toURI({\n   *   label: 'user@example.com',\n   *   issuer: 'MyApp',\n   *   secret: 'JBSWY3DPEHPK3PXP',\n   * });\n   * ```\n   */\n  toURI(options?: { label?: string; issuer?: string; secret?: string }): string {\n    const {\n      issuer: instanceIssuer,\n      label: instanceLabel,\n      secret: instanceSecret,\n      algorithm = \"sha1\",\n      digits = 6,\n      period = 30,\n    } = this.options;\n\n    // Merge provided parameters with instance options\n    const finalLabel = options?.label ?? instanceLabel;\n    const finalIssuer = options?.issuer ?? instanceIssuer;\n    const finalSecret = options?.secret ?? instanceSecret;\n\n    requireSecret(finalSecret);\n    requireLabel(finalLabel);\n    requireIssuer(finalIssuer);\n    requireBase32String(finalSecret);\n\n    return generateTOTPURI({\n      issuer: finalIssuer,\n      label: finalLabel,\n      secret: finalSecret,\n      algorithm,\n      digits,\n      period,\n    });\n  }\n}\n"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,UAAAE,EAAA,aAAAC,EAAA,iBAAAC,EAAA,qBAAAC,EAAA,oBAAAC,EAAA,WAAAC,EAAA,eAAAC,EAAA,mFAAAC,EAAAT,GAYA,IAAAU,EAeO,wBACPC,EAA2E,wBCtB3E,IAAAC,EASO,wBACPC,EAAgD,uBA4BzC,IAAMC,EAAN,KAAW,CACC,QACA,WAEjB,YAAYC,EAAuB,CAAC,EAAG,CACrC,KAAK,QAAUA,EACf,KAAK,cAAa,oBAAiBA,EAAQ,UAAU,CACvD,CAOA,gBAAyB,CACvB,GAAM,CAAE,OAAAC,EAAQ,OAAAC,CAAO,EAAI,KAAK,QAEhC,gCAAoBD,CAAM,KAC1B,uBAAoBC,CAAM,KAEnB,EAAAC,gBAAmB,CAAE,OAAAF,EAAQ,OAAAC,CAAO,CAAC,CAC9C,CAUA,MAAM,SAASF,EAAiD,CAC9D,IAAMI,EAAgB,CAAE,GAAG,KAAK,QAAS,GAAGJ,CAAQ,EAC9C,CACJ,OAAAK,EACA,OAAAJ,EACA,OAAAC,EACA,UAAAI,EAAY,OACZ,OAAAC,EAAS,EACT,OAAAC,EAAS,GACT,MAAAC,EACA,GAAAC,EAAK,CACP,EAAIN,KAEJ,iBAAcC,CAAM,KACpB,uBAAoBJ,CAAM,EAG1B,IAAMU,EAAaX,GAAS,YAAc,KAAK,WAE/C,OAAOY,EAAa,CAClB,OAAAP,EACA,UAAAC,EACA,OAAAC,EACA,OAAAC,EACA,MAAOC,GAAS,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAC5C,GAAAC,EACA,OAAAT,EACA,OAAAC,EACA,WAAAS,EACA,MAAOP,EAAc,KACvB,CAAC,CACH,CAWA,MAAM,OACJS,EACAb,EACuB,CACvB,IAAMI,EAAgB,CAAE,GAAG,KAAK,QAAS,GAAGJ,CAAQ,EAC9C,CACJ,OAAAK,EACA,OAAAJ,EACA,OAAAC,EACA,UAAAI,EAAY,OACZ,OAAAC,EAAS,EACT,OAAAC,EAAS,GACT,MAAAC,EACA,GAAAC,EAAK,EACL,eAAAI,EAAiB,EACjB,cAAAC,CACF,EAAIX,KAEJ,iBAAcC,CAAM,KACpB,uBAAoBJ,CAAM,EAG1B,IAAMU,EAAaX,GAAS,YAAc,KAAK,WAE/C,OAAOgB,EAAW,CAChB,OAAAX,EACA,MAAAQ,EACA,UAAAP,EACA,OAAAC,EACA,OAAAC,EACA,MAAOC,GAAS,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAC5C,GAAAC,EACA,eAAAI,EACA,cAAAC,EACA,OAAAd,EACA,OAAAC,EACA,WAAAS,EACA,MAAOP,EAAc,KACvB,CAAC,CACH,CAyCA,MAAMJ,EAAwE,CAC5E,GAAM,CACJ,OAAQiB,EACR,MAAOC,EACP,OAAQC,EACR,UAAAb,EAAY,OACZ,OAAAC,EAAS,EACT,OAAAC,EAAS,EACX,EAAI,KAAK,QAGHY,EAAapB,GAAS,OAASkB,EAC/BG,EAAcrB,GAAS,QAAUiB,EACjCK,EAActB,GAAS,QAAUmB,EAEvC,0BAAcG,CAAW,KACzB,gBAAaF,CAAU,KACvB,iBAAcC,CAAW,KACzB,uBAAoBC,CAAW,KAExB,EAAAC,cAAgB,CACrB,OAAQF,EACR,MAAOD,EACP,OAAQE,EACR,UAAAhB,EACA,OAAAC,EACA,OAAAC,CACF,CAAC,CACH,CACF,ED0SA,IAAAgB,EAA4C,wBAnd5C,SAASC,EAAuBC,EAA2D,CACzF,GAAM,CACJ,OAAAC,EACA,MAAAC,EAAQ,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EACpC,GAAAC,EAAK,EACL,OAAAC,EAAS,GACT,UAAWC,EAAe,OAC1B,OAAAC,EAAS,EACT,OAAAC,EACA,OAAAC,EACA,WAAAC,KAAa,oBAAiB,EAC9B,MAAAC,CACF,EAAIV,KAEJ,iBAAcC,CAAM,KACpB,uBAAoBM,CAAM,EAE1B,IAAMI,KAAc,mBAAgBV,EAAQO,CAAM,KAClD,kBAAeG,EAAaF,CAAU,KACtC,gBAAaP,CAAK,KAClB,kBAAeE,EAAQK,CAAU,EAIjC,IAAMG,KAAY,0BAAuBP,EAAc,CACrD,UAAWE,EAAO,WAClB,OAAQA,EAAO,IACjB,CAAC,EAEKM,EAAU,KAAK,OAAOX,EAAQC,GAAMC,CAAM,EAEhD,MAAO,CACL,OAAQO,EACR,QAAAE,EACA,UAAAD,EACA,OAAAN,EACA,OAAAC,EACA,WAAAE,EACA,MAAAC,CACF,CACF,CAwCA,eAAsBI,EAASd,EAA+C,CAC5E,IAAMe,EAAMhB,EAAuBC,CAAO,EAC1C,SAAO,EAAAgB,UAAaD,CAAG,CACzB,CAgCO,SAASE,EAAajB,EAAsC,CACjE,IAAMe,EAAMhB,EAAuBC,CAAO,EAC1C,SAAO,EAAAkB,cAAiBH,CAAG,CAC7B,CAgBA,SAASI,EAAsBC,EAAmCC,EAA0B,CAC1F,GAAID,IAAkB,OAItB,IAAIA,EAAgB,EAClB,MAAM,IAAI,6BAGZ,GAAI,CAAC,OAAO,cAAcA,CAAa,EACrC,MAAM,IAAI,+BAGZ,GAAIA,EAAgBC,EAClB,MAAM,IAAI,kCAEd,CAMA,SAASC,EAAwBT,EAAiBO,EAA4C,CAC5F,OAAOA,IAAkB,QAAaP,GAAWO,CACnD,CA6BA,SAASG,EAAqBvB,EAAuD,CACnF,GAAM,CACJ,OAAAC,EACA,MAAAuB,EACA,MAAAtB,EAAQ,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EACpC,GAAAC,EAAK,EACL,OAAAC,EAAS,GACT,UAAWC,EAAe,OAC1B,OAAAC,EAAS,EACT,OAAAC,EACA,OAAAC,EACA,eAAAiB,EAAiB,EACjB,cAAAL,EACA,WAAAX,KAAa,oBAAiB,EAC9B,MAAAC,CACF,EAAIV,KAEJ,iBAAcC,CAAM,KACpB,uBAAoBM,CAAM,EAE1B,IAAMI,KAAc,mBAAgBV,EAAQO,CAAM,KAClD,kBAAeG,EAAaF,CAAU,KACtC,gBAAaP,CAAK,KAClB,kBAAeE,EAAQK,CAAU,EAIjC,IAAMG,KAAY,0BAAuBP,EAAc,CACrD,UAAWE,EAAO,WAClB,OAAQA,EAAO,IACjB,CAAC,EAGGG,GAAO,cACTA,EAAM,cAAcc,EAAOlB,CAAM,KAEjC,iBAAckB,EAAOlB,CAAM,KAG7B,0BAAuBmB,EAAgBrB,EAAQK,CAAU,EAEzD,IAAMiB,EAAiB,KAAK,OAAOxB,EAAQC,GAAMC,CAAM,EAGjD,CAACuB,EAAeC,CAAe,KAAI,2BAAwBH,CAAc,EAIzEI,EAAa,KAAK,IAAI,EAAG,KAAK,OAAO3B,EAAQyB,EAAgBxB,GAAMC,CAAM,CAAC,EAC1EiB,EAAa,KAAK,OAAOnB,EAAQ0B,EAAkBzB,GAAMC,CAAM,EAGrE,OAAAe,EAAsBC,EAAeC,CAAU,EAExC,CACL,MAAAG,EACA,OAAAjB,EACA,WAAAsB,EACA,WAAAR,EACA,eAAAK,EACA,GAAAvB,EACA,OAAAC,EACA,cAAAgB,EACA,mBAAqBP,IAAqB,CACxC,OAAQF,EACR,MAAOE,EAAUT,EAASD,EAC1B,GAAAA,EACA,OAAAC,EACA,UAAAQ,EACA,OAAAN,EACA,OAAAC,EACA,WAAAE,EACA,MAAAC,CACF,EACF,CACF,CAmCA,eAAsBoB,EAAO9B,EAAmD,CAC9E,GAAM,CACJ,MAAAwB,EACA,OAAAjB,EACA,WAAAsB,EACA,WAAAR,EACA,eAAAK,EACA,GAAAvB,EACA,OAAAC,EACA,cAAAgB,EACA,mBAAAW,CACF,EAAIR,EAAqBvB,CAAO,EAEhC,QAASa,EAAUgB,EAAYhB,GAAWQ,EAAYR,IAAW,CAE/D,GAAIS,EAAwBT,EAASO,CAAa,EAChD,SAGF,IAAMY,EAAW,MAAMlB,EAASiB,EAAmBlB,CAAO,CAAC,EAC3D,GAAIN,EAAO,kBAAkByB,EAAUR,CAAK,EAC1C,MAAO,CACL,MAAO,GACP,MAAOX,EAAUa,EACjB,MAAOb,EAAUT,EAASD,EAC1B,SAAUU,CACZ,CAEJ,CAEA,MAAO,CAAE,MAAO,EAAM,CACxB,CAiCO,SAASoB,EAAWjC,EAA0C,CACnE,GAAM,CACJ,MAAAwB,EACA,OAAAjB,EACA,WAAAsB,EACA,WAAAR,EACA,eAAAK,EACA,GAAAvB,EACA,OAAAC,EACA,cAAAgB,EACA,mBAAAW,CACF,EAAIR,EAAqBvB,CAAO,EAEhC,QAASa,EAAUgB,EAAYhB,GAAWQ,EAAYR,IAAW,CAE/D,GAAIS,EAAwBT,EAASO,CAAa,EAChD,SAGF,IAAMY,EAAWf,EAAac,EAAmBlB,CAAO,CAAC,EACzD,GAAIN,EAAO,kBAAkByB,EAAUR,CAAK,EAC1C,MAAO,CACL,MAAO,GACP,MAAOX,EAAUa,EACjB,MAAOb,EAAUT,EAASD,EAC1B,SAAUU,CACZ,CAEJ,CAEA,MAAO,CAAE,MAAO,EAAM,CACxB,CAkBO,SAASqB,EACdC,EAAe,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAC3C/B,EAAiB,GACjBD,EAAa,EACbM,KAA4B,oBAAiB,EACrC,CACR,yBAAa0B,CAAI,KACjB,kBAAe/B,EAAQK,CAAU,GAEjB,KAAK,OAAO0B,EAAOhC,GAAMC,CAAM,EACjB,GACCA,EAASD,EAEtBgC,CACpB,CAkBO,SAASC,EACdD,EAAe,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAC3C/B,EAAiB,GACjBD,EAAa,EACbM,KAA4B,oBAAiB,EACrC,CACR,yBAAa0B,CAAI,KACjB,kBAAe/B,EAAQK,CAAU,EAE1B,KAAK,OAAO0B,EAAOhC,GAAMC,CAAM,CACxC","names":["index_exports","__export","TOTP","generate","generateSync","getRemainingTime","getTimeStepUsed","verify","verifySync","__toCommonJS","import_core","import_hotp","import_core","import_uri","TOTP","options","crypto","base32","generateSecretCore","mergedOptions","secret","algorithm","digits","period","epoch","t0","guardrails","generate","token","epochTolerance","afterTimeStep","verify","instanceIssuer","instanceLabel","instanceSecret","finalLabel","finalIssuer","finalSecret","generateTOTPURI","import_core","getTOTPGenerateOptions","options","secret","epoch","t0","period","rawAlgorithm","digits","crypto","base32","guardrails","hooks","secretBytes","algorithm","counter","generate","opt","generateHOTP","generateSync","generateHOTPSync","validateAfterTimeStep","afterTimeStep","maxCounter","shouldSkipAfterTimeStep","getTOTPVerifyOptions","token","epochTolerance","currentCounter","pastTolerance","futureTolerance","minCounter","verify","getGenerateOptions","expected","verifySync","getRemainingTime","time","getTimeStepUsed"]}