@absolutejs/auth 0.35.0 → 0.36.0-beta.0

package/dist/index.d.ts

@@ -13491,6 +13491,7 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
                 resource?: string | undefined;
                 refresh_token?: string | undefined;
                 device_code?: string | undefined;
+                auth_req_id?: string | undefined;
                 client_secret?: string | undefined;
                 grant_type?: string | undefined;
                 code?: string | undefined;
@@ -13613,6 +13614,35 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
             };
         };
     };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                scope?: string | undefined;
+                client_secret?: string | undefined;
+                binding_message?: string | undefined;
+                login_hint?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         post: {
@@ -15124,12 +15154,12 @@ export type { DpopResult } from './oidc/dpop';
 export { CLIENT_ASSERTION_TYPE, verifyClientAssertion, verifyJwtSignedByClient } from './oidc/clientAuth';
 export { parseSignedRequestObject } from './oidc/jar';
 export type { JarParseResult } from './oidc/jar';
-export { createInMemoryAuthorizationCodeStore, createInMemoryClientAssertionJtiStore, createInMemoryClientRegistrationTokenStore, createInMemoryDeviceAuthorizationStore, createInMemoryInitialAccessTokenStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore, createInMemoryPushedAuthorizationRequestStore } from './oidc/inMemoryStores';
+export { createInMemoryAuthorizationCodeStore, createInMemoryBackchannelAuthStore, createInMemoryClientAssertionJtiStore, createInMemoryClientRegistrationTokenStore, createInMemoryDeviceAuthorizationStore, createInMemoryInitialAccessTokenStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore, createInMemoryPushedAuthorizationRequestStore } from './oidc/inMemoryStores';
 export { consumePushedRequest, pushAuthorizationRequest, DEFAULT_PAR_TTL_MS, REQUEST_URI_PREFIX } from './oidc/par';
 export { fetchUserInfo, readUserInfoBearer, userInfoChallengeHeader } from './oidc/userinfo';
 export type { UserInfoResult } from './oidc/userinfo';
 export { fanOutBackchannelLogout, mintLogoutToken, resolvePostLogoutRedirect, verifyIdTokenHint } from './oidc/logout';
-export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonLogoutDeliveryStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createNeonPushedAuthorizationRequestStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresLogoutDeliveryStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, createPostgresPushedAuthorizationRequestStore, oauthClientAssertionJtisTable, oauthClientRegistrationTokensTable, oauthClientsTable, oauthCodesTable, oauthDeviceAuthorizationsTable, oauthInitialAccessTokensTable, oauthLogoutDeliveriesTable, oauthPushedAuthorizationRequestsTable, oauthRefreshTokensTable } from './oidc/postgresStores';
+export { createNeonAuthorizationCodeStore, createNeonBackchannelAuthStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonLogoutDeliveryStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createNeonPushedAuthorizationRequestStore, createPostgresAuthorizationCodeStore, createPostgresBackchannelAuthStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresLogoutDeliveryStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, createPostgresPushedAuthorizationRequestStore, oauthClientAssertionJtisTable, oauthClientRegistrationTokensTable, oauthClientsTable, oauthCodesTable, oauthBackchannelAuthRequestsTable, oauthDeviceAuthorizationsTable, oauthInitialAccessTokensTable, oauthLogoutDeliveriesTable, oauthPushedAuthorizationRequestsTable, oauthRefreshTokensTable } from './oidc/postgresStores';
 export { deleteRegisteredClient, getRegisteredClient, registerClient, updateRegisteredClient, type ClientRegistrationDecision, type ClientRegistrationMetadata, type OnClientRegistration, type RegisterClientResult } from './oidc/registration';
 export * from './adaptive/config';
 export * from './adaptive/fingerprint';

package/dist/index.js

@@ -4790,6 +4790,126 @@ var exchangeDeviceCode = async ({
   });
   return { ...tokenSet, ok: true };
 };
+var AUTH_REQ_ID_BYTES = 32;
+var DEFAULT_BACKCHANNEL_TTL_MINUTES = 10;
+var DEFAULT_BACKCHANNEL_TTL_MS = MILLISECONDS_IN_A_MINUTE * DEFAULT_BACKCHANNEL_TTL_MINUTES;
+var DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS = 5;
+var CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+var issueBackchannelAuth = async ({
+  clientId,
+  config,
+  loginHint,
+  bindingMessage,
+  now = Date.now(),
+  requestedScopes
+}) => {
+  if (!config.backchannelAuthStore || !config.resolveBackchannelUser) {
+    return { error: "invalid_request", ok: false };
+  }
+  const client = await config.clientStore.findClient(clientId);
+  if (!client)
+    return { error: "invalid_client", ok: false };
+  const resolved = await config.resolveBackchannelUser({
+    client,
+    loginHint
+  });
+  if (!resolved)
+    return { error: "unknown_user_id", ok: false };
+  const authReqId = generateSecureToken(AUTH_REQ_ID_BYTES);
+  const ttl = config.backchannelAuthTtlMs ?? DEFAULT_BACKCHANNEL_TTL_MS;
+  const interval = config.backchannelPollIntervalSeconds ?? DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS;
+  await config.backchannelAuthStore.saveBackchannelAuth({
+    authReqId,
+    bindingMessage,
+    clientId,
+    createdAt: now,
+    expiresAt: now + ttl,
+    intervalSeconds: interval,
+    scopes: requestedScopes,
+    status: "pending",
+    userSub: resolved.sub
+  });
+  await config.onBackchannelAuthRequest?.({
+    authReqId,
+    bindingMessage,
+    clientId,
+    scopes: requestedScopes,
+    userSub: resolved.sub
+  });
+  return {
+    auth_req_id: authReqId,
+    expires_in: Math.floor(ttl / MS_PER_SECOND),
+    interval,
+    ok: true
+  };
+};
+var decideBackchannel = async (config, authReqId, approval) => {
+  if (!config.backchannelAuthStore) {
+    return { error: "not_configured", ok: false };
+  }
+  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
+  if (!record)
+    return { error: "invalid_auth_req_id", ok: false };
+  if (record.expiresAt < Date.now()) {
+    return { error: "expired_token", ok: false };
+  }
+  if (record.status !== "pending") {
+    return { error: "already_decided", ok: false };
+  }
+  await config.backchannelAuthStore.updateStatus(authReqId, approval.status, approval.userSub ?? record.userSub);
+  return { ok: true };
+};
+var approveBackchannelAuth = async ({
+  authReqId,
+  config,
+  userSub
+}) => decideBackchannel(config, authReqId, {
+  status: "approved",
+  userSub
+});
+var denyBackchannelAuth = async ({
+  authReqId,
+  config
+}) => decideBackchannel(config, authReqId, { status: "denied" });
+var exchangeBackchannelAuth = async ({
+  authReqId,
+  clientId,
+  config,
+  dpopJkt,
+  now = Date.now()
+}) => {
+  if (!config.backchannelAuthStore) {
+    return { error: "invalid_grant", ok: false };
+  }
+  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
+  if (!record || record.clientId !== clientId) {
+    return { error: "invalid_grant", ok: false };
+  }
+  if (record.expiresAt < now) {
+    await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
+    return { error: "expired_token", ok: false };
+  }
+  if (record.lastPolledAt !== undefined && now - record.lastPolledAt < record.intervalSeconds * MS_PER_SECOND) {
+    return { error: "slow_down", ok: false };
+  }
+  await config.backchannelAuthStore.recordPoll(authReqId, now);
+  if (record.status === "pending") {
+    return { error: "authorization_pending", ok: false };
+  }
+  if (record.status === "denied" || record.userSub === undefined) {
+    return { error: "access_denied", ok: false };
+  }
+  await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
+  const tokenSet = await issueTokenSet({
+    clientId,
+    config,
+    dpopJkt,
+    now,
+    scopes: record.scopes,
+    sub: record.userSub
+  });
+  return { ...tokenSet, ok: true };
+};
 
 // src/oidc/clientAuth.ts
 var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
@@ -5517,6 +5637,7 @@ var oidcProviderRoutes = (config) => {
   const introspectRoute = `${oidcRoute}/introspect`;
   const revokeRoute = `${oidcRoute}/revoke`;
   const deviceAuthorizationRoute = `${oidcRoute}/device_authorization`;
+  const backchannelAuthorizationRoute = `${oidcRoute}/bc-authorize`;
   const deviceApproveRoute = `${oidcRoute}/device/decision`;
   const endSessionRoute = `${oidcRoute}/end_session`;
   const parRoute = `${oidcRoute}/par`;
@@ -5671,6 +5792,38 @@ var oidcProviderRoutes = (config) => {
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
     }, HTTP_OK2);
   };
+  const grantBackchannel = async (client, body, dpop) => {
+    if (config.backchannelAuthStore === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+    }
+    if (body.auth_req_id === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+    }
+    const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
+      htm: "POST",
+      htu: tokenUrl,
+      proof: dpop
+    });
+    if (dpop !== undefined && dpopResult === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+    }
+    const result = await exchangeBackchannelAuth({
+      authReqId: body.auth_req_id,
+      clientId: client.clientId,
+      config,
+      dpopJkt: dpopResult?.jkt
+    });
+    if (!result.ok)
+      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+    return jsonResponse({
+      access_token: result.access_token,
+      expires_in: result.expires_in,
+      id_token: result.id_token,
+      refresh_token: result.refresh_token,
+      scope: result.scope,
+      token_type: dpopResult === undefined ? "Bearer" : "DPoP"
+    }, HTTP_OK2);
+  };
   const grantDeviceCode = async (client, body, dpop) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
@@ -5711,6 +5864,9 @@ var oidcProviderRoutes = (config) => {
   if (config.deviceAuthorizationStore) {
     grantTypes.push("urn:ietf:params:oauth:grant-type:device_code");
   }
+  if (config.backchannelAuthStore) {
+    grantTypes.push(CIBA_GRANT_TYPE);
+  }
   const discovery = {
     authorization_endpoint: `${issuer}${authorizeRoute}`,
     backchannel_logout_session_supported: false,
@@ -5742,6 +5898,11 @@ var oidcProviderRoutes = (config) => {
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
   }
+  if (config.backchannelAuthStore) {
+    discovery.backchannel_authentication_endpoint = `${issuer}${backchannelAuthorizationRoute}`;
+    discovery.backchannel_token_delivery_modes_supported = ["poll"];
+    discovery.backchannel_user_code_parameter_supported = false;
+  }
   if (config.clientRegistrationTokenStore !== undefined) {
     discovery.registration_endpoint = registrationBaseUrl;
   }
@@ -5964,10 +6125,14 @@ var oidcProviderRoutes = (config) => {
     if (body.grant_type === "urn:ietf:params:oauth:grant-type:device_code") {
       return grantDeviceCode(client, body, headers.dpop);
     }
+    if (body.grant_type === CIBA_GRANT_TYPE) {
+      return grantBackchannel(client, body, headers.dpop);
+    }
     return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
   }, {
     body: t12.Object({
       audience: t12.Optional(t12.String()),
+      auth_req_id: t12.Optional(t12.String()),
       client_assertion: t12.Optional(t12.String()),
       client_assertion_type: t12.Optional(t12.String()),
       client_id: t12.Optional(t12.String()),
@@ -6082,6 +6247,50 @@ var oidcProviderRoutes = (config) => {
     headers: t12.Object({
       authorization: t12.Optional(t12.String())
     })
+  }).post(backchannelAuthorizationRoute, async ({ body, headers }) => {
+    if (config.backchannelAuthStore === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+    }
+    const basic = readBasicAuth2(headers.authorization);
+    const clientId = body.client_id ?? basic.clientId;
+    const clientSecret = body.client_secret ?? basic.clientSecret;
+    if (clientId === undefined) {
+      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+    }
+    const client = await authenticateClient(clientId, clientSecret);
+    if (client === undefined) {
+      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+    }
+    if (body.login_hint === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+    }
+    const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
+    const result = await issueBackchannelAuth({
+      bindingMessage: body.binding_message,
+      clientId: client.clientId,
+      config,
+      loginHint: body.login_hint,
+      now: Date.now(),
+      requestedScopes: requested
+    });
+    if (!result.ok)
+      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+    return jsonResponse({
+      auth_req_id: result.auth_req_id,
+      expires_in: result.expires_in,
+      interval: result.interval
+    }, HTTP_OK2);
+  }, {
+    body: t12.Object({
+      binding_message: t12.Optional(t12.String()),
+      client_id: t12.Optional(t12.String()),
+      client_secret: t12.Optional(t12.String()),
+      login_hint: t12.Optional(t12.String()),
+      scope: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
   }).post(deviceAuthorizationRoute, async ({ body, headers }) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
@@ -21542,6 +21751,30 @@ var createInMemoryAuthorizationCodeStore = () => {
     }
   };
 };
+var createInMemoryBackchannelAuthStore = () => {
+  const byAuthReqId = new Map;
+  return {
+    deleteByAuthReqId: async (authReqId) => {
+      byAuthReqId.delete(authReqId);
+    },
+    findByAuthReqId: async (authReqId) => byAuthReqId.get(authReqId),
+    recordPoll: async (authReqId, polledAt) => {
+      const record = byAuthReqId.get(authReqId);
+      if (!record)
+        return;
+      byAuthReqId.set(authReqId, { ...record, lastPolledAt: polledAt });
+    },
+    saveBackchannelAuth: async (request) => {
+      byAuthReqId.set(request.authReqId, { ...request });
+    },
+    updateStatus: async (authReqId, status, userSub) => {
+      const record = byAuthReqId.get(authReqId);
+      if (!record)
+        return;
+      byAuthReqId.set(authReqId, { ...record, status, userSub });
+    }
+  };
+};
 var createInMemoryClientAssertionJtiStore = () => {
   const seen = new Map;
   return {
@@ -21689,6 +21922,20 @@ var createInMemoryPushedAuthorizationRequestStore = () => {
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
 var ID_LENGTH7 = 255;
+var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_requests", {
+  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH7 }).primaryKey(),
+  binding_message: text("binding_message"),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  interval_seconds: bigint("interval_seconds", {
+    mode: "number"
+  }).notNull(),
+  last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
+  scopes: text("scopes").array().notNull(),
+  status: varchar("status", { length: 16 }).notNull(),
+  user_sub: varchar("user_sub", { length: ID_LENGTH7 })
+});
 var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
   client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
   composite_key: varchar("composite_key", {
@@ -22054,6 +22301,48 @@ var createPostgresPushedAuthorizationRequestStore = (db) => ({
     });
   }
 });
+var toBackchannelAuth = (row) => ({
+  authReqId: row.auth_req_id,
+  bindingMessage: row.binding_message ?? undefined,
+  clientId: row.client_id,
+  createdAt: row.created_at_ms,
+  expiresAt: row.expires_at_ms,
+  intervalSeconds: row.interval_seconds,
+  lastPolledAt: row.last_polled_at_ms ?? undefined,
+  scopes: row.scopes,
+  status: row.status,
+  userSub: row.user_sub ?? undefined
+});
+var createNeonBackchannelAuthStore = (databaseUrl) => createPostgresBackchannelAuthStore(createNeonDatabase(databaseUrl));
+var createPostgresBackchannelAuthStore = (db) => ({
+  deleteByAuthReqId: async (authReqId) => {
+    await db.delete(oauthBackchannelAuthRequestsTable).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId));
+  },
+  findByAuthReqId: async (authReqId) => {
+    const [row] = await db.select().from(oauthBackchannelAuthRequestsTable).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId)).limit(1);
+    return row ? toBackchannelAuth(row) : undefined;
+  },
+  recordPoll: async (authReqId, polledAt) => {
+    await db.update(oauthBackchannelAuthRequestsTable).set({ last_polled_at_ms: polledAt }).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId));
+  },
+  saveBackchannelAuth: async (request) => {
+    await db.insert(oauthBackchannelAuthRequestsTable).values({
+      auth_req_id: request.authReqId,
+      binding_message: request.bindingMessage ?? null,
+      client_id: request.clientId,
+      created_at_ms: request.createdAt,
+      expires_at_ms: request.expiresAt,
+      interval_seconds: request.intervalSeconds,
+      last_polled_at_ms: request.lastPolledAt ?? null,
+      scopes: request.scopes,
+      status: request.status,
+      user_sub: request.userSub ?? null
+    });
+  },
+  updateStatus: async (authReqId, status, userSub) => {
+    await db.update(oauthBackchannelAuthRequestsTable).set({ status, user_sub: userSub ?? null }).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId));
+  }
+});
 // src/adaptive/config.ts
 var DEFAULT_HISTORY_LIMIT = 50;
 var DEFAULT_MAX_TRAVEL_KMH = 900;
@@ -23316,6 +23605,7 @@ var blockMigrations = {
   lockout: initMigration("lockout", [lockoutsTable]),
   mfa: initMigration("mfa", [mfaEnrollmentsTable]),
   oidc: initMigration("oidc", [
+    oauthBackchannelAuthRequestsTable,
     oauthClientAssertionJtisTable,
     oauthClientRegistrationTokensTable,
     oauthClientsTable,
@@ -24034,6 +24324,7 @@ export {
   oauthClientsTable,
   oauthClientRegistrationTokensTable,
   oauthClientAssertionJtisTable,
+  oauthBackchannelAuthRequestsTable,
   mintLogoutToken,
   mintDpopNonce,
   mfaTotpRoutes,
@@ -24052,6 +24343,7 @@ export {
   jwkThumbprint,
   issueTokenSet,
   issueDeviceAuthorization,
+  issueBackchannelAuth,
   isValidUser,
   isValidProviderOption,
   isUserSessionId,
@@ -24098,11 +24390,13 @@ export {
   exchangeToken,
   exchangeDeviceCode,
   exchangeClientCredentials,
+  exchangeBackchannelAuth,
   evaluatePassword,
   endImpersonation,
   encryptTotpSecret,
   encryptSecret,
   denyDeviceAuthorization,
+  denyBackchannelAuth,
   deleteWarrant,
   deleteRegisteredClient,
   defineProvidersConfiguration,
@@ -24157,6 +24451,7 @@ export {
   createPostgresCredentialStore,
   createPostgresClientRegistrationTokenStore,
   createPostgresClientAssertionJtiStore,
+  createPostgresBackchannelAuthStore,
   createPostgresAuthorizationCodeStore,
   createPostgresAuditSink,
   createPostgresApiKeyStore,
@@ -24191,6 +24486,7 @@ export {
   createNeonCredentialStore,
   createNeonClientRegistrationTokenStore,
   createNeonClientAssertionJtiStore,
+  createNeonBackchannelAuthStore,
   createNeonAuthorizationCodeStore,
   createNeonAuthSessionStore,
   createNeonAuditSink,
@@ -24227,6 +24523,7 @@ export {
   createInMemoryClientRegistrationTokenStore,
   createInMemoryClientAssertionJtiStore,
   createInMemoryCheckCache,
+  createInMemoryBackchannelAuthStore,
   createInMemoryAuthorizationCodeStore,
   createInMemoryAuthSessionStore,
   createInMemoryAuditSink,
@@ -24260,6 +24557,7 @@ export {
   assessRisk,
   assessAbuse,
   approveDeviceAuthorization,
+  approveBackchannelAuth,
   apiKeysTable,
   apiKeysRoutes,
   apiClientsTable,
@@ -24297,8 +24595,9 @@ export {
   DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   DEFAULT_BACKUP_CODE_COUNT,
   CLIENT_ASSERTION_TYPE,
+  CIBA_GRANT_TYPE,
   AuthIdentityConflictError
 };
 
-//# debugId=E33462A0DBAD894164756E2164756E21
+//# debugId=6F90E4F856A11E4B64756E2164756E21
 //# sourceMappingURL=index.js.map