@babelpeak/babel-suite-server-sdk 0.1.0 → 0.2.0

package/dist/client.d.ts

@@ -1,19 +1,42 @@
 import { type JWTPayload } from 'jose';
+/** Percorso del token ServiceAccount proiettato con audience = issuer di Suite. */
+export declare const DEFAULT_SA_TOKEN_FILE = "/var/run/secrets/babel-suite/token";
+/** URL interno di Suite quando il servizio gira nel cluster e SUITE_INTERNAL_URL manca. */
+export declare const DEFAULT_IN_CLUSTER_SUITE_URL = "http://babel-suite.babel-suite.svc.cluster.local:3001";
+/** Audience delle chiamate verso Suite /internal/*. */
+export declare const SUITE_INTERNAL_AUDIENCE = "suite-internal";
+export declare const SERVICE_TOKEN_TYP = "svc+jwt";
+export declare const EVENT_TOKEN_TYP = "suite-event+jwt";
 export interface PermissionDefinition {
     key: string;
     description?: string;
     /** Ruoli di sistema che ricevono il permesso di default; admin lo riceve sempre. */
     defaultRoles?: ('admin' | 'user')[];
 }
+/** `{ [audience]: { [servizio chiamante]: scope[] } }` */
+export type AcceptsFrom = Record<string, Record<string, string[]>>;
 export interface SuiteClientOptions {
     /** URL dell'issuer di Suite (es. https://suite.babelpeak.com). */
     issuer: string;
     /** Chiave del servizio: è l'`aud` atteso nei JWT. */
     service: string;
-    /** Service key per le route /internal/* (llm-config, permessi, introspect). */
+    /**
+     * Service key per le route /internal/* (llm-config, permessi, introspect): solo fuori
+     * produzione, quando manca il token ServiceAccount. Con NODE_ENV=production viene ignorata.
+     */
     serviceKey?: string;
-    /** Base URL delle route interne, se Suite le serve su un listener separato. Default: issuer. */
+    /**
+     * Base URL delle route interne (/internal/*). Default: env SUITE_INTERNAL_URL; dentro
+     * Kubernetes (KUBERNETES_SERVICE_HOST) l'URL del Service di Suite; altrimenti l'issuer.
+     */
     internalUrl?: string;
+    /**
+     * Token ServiceAccount proiettato. Default: env SUITE_SA_TOKEN_FILE o /var/run/secrets/babel-suite/token.
+     * Con NODE_ENV=production è obbligatorio: senza il file il costruttore lancia un errore.
+     */
+    tokenFile?: string;
+    /** Tentativi verso /internal/workload/token se Suite non risponde. Default: 4. */
+    serviceTokenAttempts?: number;
     /** Credenziali del client OIDC del servizio, per il token exchange fra servizi. */
     clientId?: string;
     clientSecret?: string;
@@ -62,6 +85,33 @@ export declare class SuiteError extends Error {
 }
 export declare class TokenError extends Error {
 }
+/** Token di servizio valido ma senza gli scope richiesti (→ 403). */
+export declare class ScopeError extends Error {
+}
+/** Chi chiama, secondo un `svc+jwt` verificato. */
+export interface ServiceAuth {
+    caller: string;
+    orgId?: string;
+    scopes: string[];
+    /**
+     * Token delegato (fase 8 di docs/SERVICE-AUTH.md): l'utente di Suite per cui agisce il
+     * chiamante. Quando c'è, `orgId` c'è sempre e il principal della richiesta è questo utente.
+     */
+    onBehalfOf?: string;
+    /** Permessi dell'utente in questo servizio nell'org, calcolati da Suite all'emissione. */
+    userPermissions?: string[];
+    token: string;
+    claims: JWTPayload;
+}
+export interface SuiteWebhookEvent {
+    event: string;
+    org_id: string;
+    service: string;
+    reason: string;
+}
+type HeaderBag = Record<string, string | string[] | undefined>;
+/** URL interno di default, senza configurazione (docs/SERVICE-AUTH.md, "Default automatici"). */
+export declare function defaultInternalUrl(issuer: string, env?: NodeJS.ProcessEnv): string;
 interface Discovery {
     issuer: string;
     jwks_uri: string;
@@ -82,29 +132,96 @@ export declare class SuiteClient {
     private readonly cache;
     private readonly inflight;
     private webhookSecret?;
+    readonly tokenFile: string;
+    private readonly serviceTokens;
+    private readonly serviceTokenInflight;
+    private readonly seenWebhookJti;
+    /** NODE_ENV=production alla creazione: niente fallback a service key e HMAC. */
+    readonly production: boolean;
     constructor(opts: SuiteClientOptions);
+    /** Vero se c'è il token ServiceAccount proiettato (identità workload). */
+    hasWorkloadIdentity(): boolean;
+    /** Vero se il client può chiamare /internal/* (token SA o, fuori produzione, service key). */
+    hasInternalCredentials(): boolean;
+    /**
+     * Token di servizio `svc+jwt` per `audience` (es. "docs", "code.orchestrator", "suite-internal").
+     * Il token SA si rilegge dal file a ogni emissione (kubelet lo ruota); il risultato resta in
+     * cache per (audience, org, utente, scope) fino a exp - 60 s; richieste concorrenti condividono
+     * la stessa chiamata; se Suite non risponde si riprova con backoff.
+     *
+     * `onBehalfOf` (id utente di Suite, richiede `orgId`) chiede un token delegato: Suite verifica
+     * che chiamante e destinatario siano abilitati nell'org, che l'utente sia membro con almeno un
+     * permesso del servizio chiamante e che gli scope siano delegabili; altrimenti 403 con `reason`.
+     */
+    getServiceToken(audience: string, opts?: {
+        orgId?: string;
+        onBehalfOf?: string;
+        scope?: string;
+    }): Promise<string>;
+    private requestServiceToken;
+    /**
+     * Verifica un token di servizio in ingresso: `typ` svc+jwt, `iss`, `aud` (default: questo
+     * servizio), `exp` con 30 s di tolleranza, e gli scope richiesti. Accetta la richiesta
+     * (headers.authorization) o direttamente il token.
+     *
+     * Token delegati (`on_behalf_of`): senza `org_id` sono sempre rifiutati. Con `delegableCallers`
+     * un token delegato di un chiamante non in elenco è rifiutato con ScopeError (403); senza
+     * l'opzione non si controlla il chiamante (lo fa il plugin con `acceptsDelegationFrom`).
+     */
+    verifyServiceToken(reqOrToken: string | {
+        headers: HeaderBag;
+    }, opts?: {
+        scopes?: string[];
+        audience?: string;
+        delegableCallers?: string[];
+    }): Promise<ServiceAuth>;
     /** Discovery da /.well-known, una volta sola (ritentata se fallisce). */
     getDiscovery(): Promise<Discovery>;
     private getJwks;
     /** Valida firma, issuer, `aud` = servizio e `typ` at+jwt. Nessuna chiamata a Suite per richiesta. */
     verifyToken(token: string): Promise<SuiteAuth>;
+    /**
+     * Credenziali per /internal/*: token workload aud=suite-internal se c'è il token SA (sempre, in
+     * produzione), altrimenti fuori produzione la service key.
+     */
     private internalHeaders;
     private internal;
-    /** Upsert idempotente dei permessi del servizio: si chiama a ogni avvio. */
-    registerPermissions(permissions: PermissionDefinition[]): Promise<{
+    /**
+     * Upsert idempotente dei permessi del servizio: si chiama a ogni avvio. `acceptsFrom`
+     * dichiara chi può chiamare le audience del servizio e con quali scope
+     * (`{ [audience]: { [caller]: scopes[] } }`); sostituisce le regole delle audience indicate.
+     * `acceptsDelegationFrom` (stessa forma) è il sottoinsieme delegabile con `on_behalf_of`; deve
+     * stare dentro `acceptsFrom` della stessa chiamata. Un'audience registrata senza delega la perde.
+     */
+    registerPermissions(permissions: PermissionDefinition[], opts?: {
+        acceptsFrom?: AcceptsFrom;
+        acceptsDelegationFrom?: AcceptsFrom;
+    }): Promise<{
         registered: number;
     }>;
-    /** Registra l'URL di invalidazione; il segreto HMAC resta in memoria. */
+    /**
+     * Registra l'URL di invalidazione. Fuori produzione Suite restituisce anche un segreto HMAC,
+     * che resta in memoria; in produzione le notifiche sono firmate solo con JWT.
+     */
     registerWebhook(url: string): Promise<{
-        secret: string;
+        url: string;
+        secret?: string;
+        signature?: string;
     }>;
-    /** Verifica firma e freschezza di una notifica di Suite. Ritorna l'org da invalidare. */
-    verifyWebhook(headers: Record<string, string | string[] | undefined>, rawBody: string): {
-        event: string;
-        org_id: string;
-        service: string;
-        reason: string;
-    };
+    /**
+     * Verifica una notifica di Suite con il JWT `suite-event+jwt` (Authorization: Bearer, legato al
+     * corpo grezzo con body_sha256, con protezione dal replay sul jti). Un JWT presente ma non
+     * valido è sempre un rifiuto: l'HMAC non lo salva mai. Solo fuori produzione, e solo se la
+     * notifica non ha un bearer, resta il fallback all'HMAC `x-suite-signature`.
+     */
+    verifyWebhookRequest(headers: HeaderBag, rawBody: string): Promise<SuiteWebhookEvent>;
+    private verifyWebhookJwt;
+    /**
+     * Verifica firma HMAC e freschezza di una notifica di Suite. Ritorna l'org da invalidare.
+     * Sempre rifiutata in produzione.
+     * @deprecated usare `verifyWebhookRequest` (JWT).
+     */
+    verifyWebhook(headers: Record<string, string | string[] | undefined>, rawBody: string): SuiteWebhookEvent;
     /** Config LLM dell'organizzazione, con cache e deduplica delle richieste concorrenti. */
     llmConfig(orgId: string): Promise<LlmConfig>;
     /** Invalida la cache (di un'org o tutta). */

package/dist/client.js

@@ -1,5 +1,19 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+/** Percorso del token ServiceAccount proiettato con audience = issuer di Suite. */
+export const DEFAULT_SA_TOKEN_FILE = '/var/run/secrets/babel-suite/token';
+/** URL interno di Suite quando il servizio gira nel cluster e SUITE_INTERNAL_URL manca. */
+export const DEFAULT_IN_CLUSTER_SUITE_URL = 'http://babel-suite.babel-suite.svc.cluster.local:3001';
+/** Audience delle chiamate verso Suite /internal/*. */
+export const SUITE_INTERNAL_AUDIENCE = 'suite-internal';
+export const SERVICE_TOKEN_TYP = 'svc+jwt';
+export const EVENT_TOKEN_TYP = 'suite-event+jwt';
+/** Tolleranza sull'orologio per i token tra servizi. */
+const SERVICE_CLOCK_TOLERANCE = 30;
+/** Il token di servizio si rinnova 60 s prima della scadenza. */
+const SERVICE_TOKEN_SKEW_MS = 60_000;
 export class SuiteError extends Error {
     status;
     body;
@@ -11,7 +25,28 @@ export class SuiteError extends Error {
 }
 export class TokenError extends Error {
 }
+/** Token di servizio valido ma senza gli scope richiesti (→ 403). */
+export class ScopeError extends Error {
+}
+const header = (headers, name) => {
+    const v = headers[name];
+    return Array.isArray(v) ? v[0] : v;
+};
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** URL interno di default, senza configurazione (docs/SERVICE-AUTH.md, "Default automatici"). */
+export function defaultInternalUrl(issuer, env = process.env) {
+    if (env.SUITE_INTERNAL_URL)
+        return env.SUITE_INTERNAL_URL;
+    if (env.KUBERNETES_SERVICE_HOST)
+        return DEFAULT_IN_CLUSTER_SUITE_URL;
+    return issuer;
+}
 const WEBHOOK_TOLERANCE_SEC = 300;
+/**
+ * Produzione secondo NODE_ENV, letto alla creazione del client. In produzione (fase 7 di
+ * docs/SERVICE-AUTH.md) niente service key né HMAC: solo identità workload e webhook JWT.
+ */
+const isProduction = (env = process.env) => env.NODE_ENV === 'production';
 /**
  * Client di Suite indipendente dal framework: validazione JWT con JWKS in cache,
  * config LLM con cache e invalidazione, registrazione permessi e webhook, token exchange.
@@ -27,12 +62,177 @@ export class SuiteClient {
     cache = new Map();
     inflight = new Map();
     webhookSecret;
+    tokenFile;
+    serviceTokens = new Map();
+    serviceTokenInflight = new Map();
+    seenWebhookJti = new Map();
+    /** NODE_ENV=production alla creazione: niente fallback a service key e HMAC. */
+    production;
     constructor(opts) {
         this.opts = opts;
         this.issuer = opts.issuer.replace(/\/$/, '');
         this.service = opts.service;
-        this.internalUrl = (opts.internalUrl ?? this.issuer).replace(/\/$/, '');
+        this.internalUrl = (opts.internalUrl ?? defaultInternalUrl(this.issuer)).replace(/\/$/, '');
+        this.tokenFile = opts.tokenFile ?? process.env.SUITE_SA_TOKEN_FILE ?? DEFAULT_SA_TOKEN_FILE;
         this.doFetch = opts.fetch ?? fetch;
+        this.production = isProduction();
+        if (this.production && !this.hasWorkloadIdentity()) {
+            // Meglio non partire che ripiegare in silenzio su una service key che Suite rifiuta.
+            throw new SuiteError(`NODE_ENV=production ma il token ServiceAccount ${this.tokenFile} non esiste: in ` +
+                'produzione il servizio si autentica solo con l’identità workload. Montare il volume ' +
+                'proiettato "suite-identity" (audience = issuer di Suite) o impostare SUITE_SA_TOKEN_FILE. ' +
+                'Vedi docs/SERVICE-AUTH.md.');
+        }
+    }
+    /** Vero se c'è il token ServiceAccount proiettato (identità workload). */
+    hasWorkloadIdentity() {
+        return existsSync(this.tokenFile);
+    }
+    /** Vero se il client può chiamare /internal/* (token SA o, fuori produzione, service key). */
+    hasInternalCredentials() {
+        return this.hasWorkloadIdentity() || (!this.production && !!this.opts.serviceKey);
+    }
+    /**
+     * Token di servizio `svc+jwt` per `audience` (es. "docs", "code.orchestrator", "suite-internal").
+     * Il token SA si rilegge dal file a ogni emissione (kubelet lo ruota); il risultato resta in
+     * cache per (audience, org, utente, scope) fino a exp - 60 s; richieste concorrenti condividono
+     * la stessa chiamata; se Suite non risponde si riprova con backoff.
+     *
+     * `onBehalfOf` (id utente di Suite, richiede `orgId`) chiede un token delegato: Suite verifica
+     * che chiamante e destinatario siano abilitati nell'org, che l'utente sia membro con almeno un
+     * permesso del servizio chiamante e che gli scope siano delegabili; altrimenti 403 con `reason`.
+     */
+    async getServiceToken(audience, opts = {}) {
+        if (opts.onBehalfOf && !opts.orgId) {
+            throw new SuiteError('onBehalfOf richiede orgId');
+        }
+        const key = [audience, opts.orgId ?? '', opts.onBehalfOf ?? '', opts.scope ?? ''].join('\u0000');
+        const hit = this.serviceTokens.get(key);
+        if (hit && hit.refreshAt > Date.now())
+            return hit.token;
+        const pending = this.serviceTokenInflight.get(key);
+        if (pending)
+            return pending;
+        const p = this.requestServiceToken(audience, opts)
+            .then(({ token, expiresIn }) => {
+            this.serviceTokens.set(key, {
+                token,
+                refreshAt: Date.now() + Math.max(0, expiresIn * 1000 - SERVICE_TOKEN_SKEW_MS),
+            });
+            return token;
+        })
+            .finally(() => this.serviceTokenInflight.delete(key));
+        this.serviceTokenInflight.set(key, p);
+        return p;
+    }
+    async requestServiceToken(audience, opts) {
+        const attempts = Math.max(1, this.opts.serviceTokenAttempts ?? 4);
+        let lastError;
+        for (let i = 0; i < attempts; i++) {
+            if (i > 0)
+                await sleep(Math.min(5_000, 250 * 2 ** (i - 1)) * (0.5 + Math.random() / 2));
+            let saToken;
+            try {
+                saToken = (await readFile(this.tokenFile, 'utf8')).trim();
+            }
+            catch (err) {
+                throw new SuiteError(`token ServiceAccount non leggibile (${this.tokenFile}): ${err.message}`);
+            }
+            let res;
+            try {
+                res = await this.doFetch(`${this.internalUrl}/internal/workload/token`, {
+                    method: 'POST',
+                    headers: { authorization: `Bearer ${saToken}`, 'content-type': 'application/json' },
+                    body: JSON.stringify({
+                        audience,
+                        ...(opts.orgId ? { org_id: opts.orgId } : {}),
+                        ...(opts.onBehalfOf ? { on_behalf_of: opts.onBehalfOf } : {}),
+                        ...(opts.scope ? { scope: opts.scope } : {}),
+                    }),
+                });
+            }
+            catch (err) {
+                lastError = err;
+                continue;
+            }
+            const text = await res.text();
+            const body = text ? JSON.parse(text) : undefined;
+            if (res.ok && typeof body?.access_token === 'string') {
+                return {
+                    token: body.access_token,
+                    expiresIn: typeof body.expires_in === 'number' ? body.expires_in : 300,
+                };
+            }
+            const err = new SuiteError(`token di servizio per ${audience}: HTTP ${res.status}`, res.status, body);
+            // 4xx (tranne 429) è una risposta definitiva: inutile riprovare.
+            if (res.status < 500 && res.status !== 429)
+                throw err;
+            lastError = err;
+        }
+        throw lastError instanceof SuiteError
+            ? lastError
+            : new SuiteError(`Suite non raggiungibile: ${lastError?.message ?? 'errore'}`);
+    }
+    /**
+     * Verifica un token di servizio in ingresso: `typ` svc+jwt, `iss`, `aud` (default: questo
+     * servizio), `exp` con 30 s di tolleranza, e gli scope richiesti. Accetta la richiesta
+     * (headers.authorization) o direttamente il token.
+     *
+     * Token delegati (`on_behalf_of`): senza `org_id` sono sempre rifiutati. Con `delegableCallers`
+     * un token delegato di un chiamante non in elenco è rifiutato con ScopeError (403); senza
+     * l'opzione non si controlla il chiamante (lo fa il plugin con `acceptsDelegationFrom`).
+     */
+    async verifyServiceToken(reqOrToken, opts = {}) {
+        let token;
+        if (typeof reqOrToken === 'string')
+            token = reqOrToken;
+        else {
+            const h = header(reqOrToken.headers, 'authorization');
+            if (!h?.startsWith('Bearer '))
+                throw new TokenError('bearer token mancante');
+            token = h.slice(7).trim();
+        }
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, await this.getJwks(), {
+                issuer: this.issuer,
+                audience: opts.audience ?? this.service,
+                typ: SERVICE_TOKEN_TYP,
+                algorithms: ['RS256'],
+                clockTolerance: SERVICE_CLOCK_TOLERANCE,
+                requiredClaims: ['exp', 'iat', 'sub'],
+            }));
+        }
+        catch (err) {
+            throw new TokenError(`token di servizio non valido: ${err.message}`);
+        }
+        const caller = payload.azp;
+        if (payload.token_use !== 'service' ||
+            typeof caller !== 'string' ||
+            payload.sub !== `svc:${caller}`) {
+            throw new TokenError('non è un token di servizio');
+        }
+        const scopes = typeof payload.scope === 'string' ? payload.scope.split(' ').filter(Boolean) : [];
+        const orgId = typeof payload.org_id === 'string' ? payload.org_id : undefined;
+        let delegation = {};
+        if (payload.on_behalf_of !== undefined) {
+            const perms = payload.user_permissions;
+            if (typeof payload.on_behalf_of !== 'string' ||
+                !payload.on_behalf_of ||
+                !orgId ||
+                !Array.isArray(perms) ||
+                !perms.every((p) => typeof p === 'string')) {
+                throw new TokenError('token delegato non valido (on_behalf_of senza org_id o permessi)');
+            }
+            if (opts.delegableCallers && !opts.delegableCallers.includes(caller)) {
+                throw new ScopeError(`token delegati di ${caller} non accettati`);
+            }
+            delegation = { onBehalfOf: payload.on_behalf_of, userPermissions: perms };
+        }
+        const missing = (opts.scopes ?? []).filter((s) => !scopes.includes(s));
+        if (missing.length)
+            throw new ScopeError(`scope richiesto: ${missing.join(', ')}`);
+        return { caller, orgId, scopes, ...delegation, token, claims: payload };
     }
     /** Discovery da /.well-known, una volta sola (ritentata se fallisce). */
     getDiscovery() {
@@ -81,16 +281,24 @@ export class SuiteClient {
             : [];
         return { userId: payload.sub, orgId: payload.org_id, permissions, token, claims: payload };
     }
-    internalHeaders() {
-        if (!this.opts.serviceKey)
-            throw new SuiteError('serviceKey non configurata');
+    /**
+     * Credenziali per /internal/*: token workload aud=suite-internal se c'è il token SA (sempre, in
+     * produzione), altrimenti fuori produzione la service key.
+     */
+    async internalHeaders() {
+        if (this.production || this.hasWorkloadIdentity()) {
+            return { authorization: `Bearer ${await this.getServiceToken(SUITE_INTERNAL_AUDIENCE)}` };
+        }
+        if (!this.opts.serviceKey) {
+            throw new SuiteError('né token ServiceAccount né serviceKey configurati');
+        }
         return {
             'x-suite-service': this.service,
             'x-suite-service-key': this.opts.serviceKey,
         };
     }
     async internal(method, path, body) {
-        const headers = this.internalHeaders();
+        const headers = await this.internalHeaders();
         if (body !== undefined)
             headers['content-type'] = 'application/json';
         const res = await this.doFetch(`${this.internalUrl}/internal${path}`, {
@@ -104,21 +312,81 @@ export class SuiteClient {
             throw new SuiteError(`Suite ${method} ${path}: HTTP ${res.status}`, res.status, parsed);
         return parsed;
     }
-    /** Upsert idempotente dei permessi del servizio: si chiama a ogni avvio. */
-    registerPermissions(permissions) {
+    /**
+     * Upsert idempotente dei permessi del servizio: si chiama a ogni avvio. `acceptsFrom`
+     * dichiara chi può chiamare le audience del servizio e con quali scope
+     * (`{ [audience]: { [caller]: scopes[] } }`); sostituisce le regole delle audience indicate.
+     * `acceptsDelegationFrom` (stessa forma) è il sottoinsieme delegabile con `on_behalf_of`; deve
+     * stare dentro `acceptsFrom` della stessa chiamata. Un'audience registrata senza delega la perde.
+     */
+    registerPermissions(permissions, opts = {}) {
         return this.internal('POST', '/permissions/register', {
             service: this.service,
             permissions,
+            ...(opts.acceptsFrom ? { acceptsFrom: opts.acceptsFrom } : {}),
+            ...(opts.acceptsDelegationFrom ? { acceptsDelegationFrom: opts.acceptsDelegationFrom } : {}),
         });
     }
-    /** Registra l'URL di invalidazione; il segreto HMAC resta in memoria. */
+    /**
+     * Registra l'URL di invalidazione. Fuori produzione Suite restituisce anche un segreto HMAC,
+     * che resta in memoria; in produzione le notifiche sono firmate solo con JWT.
+     */
     async registerWebhook(url) {
         const res = await this.internal('POST', '/llm-config/webhook', { url });
-        this.webhookSecret = res.secret;
+        this.webhookSecret = this.production ? undefined : (res.secret ?? undefined);
         return res;
     }
-    /** Verifica firma e freschezza di una notifica di Suite. Ritorna l'org da invalidare. */
+    /**
+     * Verifica una notifica di Suite con il JWT `suite-event+jwt` (Authorization: Bearer, legato al
+     * corpo grezzo con body_sha256, con protezione dal replay sul jti). Un JWT presente ma non
+     * valido è sempre un rifiuto: l'HMAC non lo salva mai. Solo fuori produzione, e solo se la
+     * notifica non ha un bearer, resta il fallback all'HMAC `x-suite-signature`.
+     */
+    async verifyWebhookRequest(headers, rawBody) {
+        const auth = header(headers, 'authorization');
+        if (auth?.startsWith('Bearer ')) {
+            await this.verifyWebhookJwt(auth.slice(7).trim(), rawBody);
+            return JSON.parse(rawBody);
+        }
+        if (this.production) {
+            throw new TokenError('webhook senza JWT suite-event+jwt (in produzione l’HMAC non vale)');
+        }
+        return this.verifyWebhook(headers, rawBody);
+    }
+    async verifyWebhookJwt(token, rawBody) {
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, await this.getJwks(), {
+                issuer: this.issuer,
+                audience: this.service,
+                typ: EVENT_TOKEN_TYP,
+                algorithms: ['RS256'],
+                clockTolerance: SERVICE_CLOCK_TOLERANCE,
+                requiredClaims: ['exp', 'iat', 'jti'],
+            }));
+        }
+        catch (err) {
+            throw new TokenError(`JWT del webhook non valido: ${err.message}`);
+        }
+        const digest = createHash('sha256').update(rawBody).digest('hex');
+        if (payload.body_sha256 !== digest)
+            throw new TokenError('body_sha256 non corrisponde');
+        const now = Date.now();
+        for (const [jti, exp] of this.seenWebhookJti)
+            if (exp < now)
+                this.seenWebhookJti.delete(jti);
+        if (this.seenWebhookJti.has(payload.jti))
+            throw new TokenError('webhook già ricevuto (replay)');
+        this.seenWebhookJti.set(payload.jti, (payload.exp + SERVICE_CLOCK_TOLERANCE) * 1000);
+    }
+    /**
+     * Verifica firma HMAC e freschezza di una notifica di Suite. Ritorna l'org da invalidare.
+     * Sempre rifiutata in produzione.
+     * @deprecated usare `verifyWebhookRequest` (JWT).
+     */
     verifyWebhook(headers, rawBody) {
+        if (this.production)
+            throw new TokenError('in produzione i webhook HMAC non sono accettati');
         if (!this.webhookSecret)
             throw new TokenError('webhook non registrato');
         const ts = String(headers['x-suite-timestamp'] ?? '');

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAwDnF,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IACA;IAHlB,YACE,OAAe,EACC,MAAe,EACf,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAAU;IAGhC,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAQlC;;;GAGG;AACH,MAAM,OAAO,WAAW;IAWO;IAVpB,MAAM,CAAS;IACf,OAAO,CAAS;IACR,WAAW,CAAS;IACpB,OAAO,CAAe;IAC/B,SAAS,CAAsB;IAC/B,IAAI,CAAyC;IACpC,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACjE,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC1D,aAAa,CAAU;IAE/B,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,mCAAmC,CAAC,CAAC;YAClF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,4EAA4E;YAC5E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;gBAClD,gBAAgB,EAAE,MAAM;gBACxB,WAAW,EAAE,EAAE,GAAG,MAAM;gBACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,GAAG,EAAE,QAAQ;gBACb,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC;aAC9C,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YACpD,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7F,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;QAC9E,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,OAAO;YAC/B,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;SAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,YAAY,IAAI,EAAE,EAAE;YACpE,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,MAAM,IAAI,UAAU,CAAC,SAAS,MAAM,IAAI,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1F,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,mBAAmB,CAAC,WAAmC;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAyB,MAAM,EAAE,uBAAuB,EAAE;YAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAqB,MAAM,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yFAAyF;IACzF,aAAa,CAAC,OAAsD,EAAE,OAAe;QACnF,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACxE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,qBAAqB,EAAE,CAAC;YAChE,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAKxB,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAY,KAAK,EAAE,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aACzF,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;gBACpB,KAAK;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,GAAG,IAAI;aAC7D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6CAA6C;IAC7C,UAAU,CAAC,KAAc;QACvB,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;YAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACvE,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,QAAQ,CAKjB,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,SAAS,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,KAAiE;QACnF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,kBAAkB,EAChB,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBACxC,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,+CAA+C;YACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAC1F,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,SAAS,KAAK,EAAE;aAChC;YACD,IAAI;SACL,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,2BAA2B,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAEnF,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAC1E,2FAA2F;AAC3F,MAAM,CAAC,MAAM,4BAA4B,GAAG,uDAAuD,CAAC;AACpG,uDAAuD;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AACjD,wDAAwD;AACxD,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAwErC,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IACA;IAHlB,YACE,OAAe,EACC,MAAe,EACf,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAAU;IAGhC,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,qEAAqE;AACrE,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AA2BxC,MAAM,MAAM,GAAG,CAAC,OAAkB,EAAE,IAAY,EAAE,EAAE;IAClD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE,iGAAiG;AACjG,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACrF,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,GAAG,CAAC,kBAAkB,CAAC;IAC1D,IAAI,GAAG,CAAC,uBAAuB;QAAE,OAAO,4BAA4B,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAQ7F;;;GAGG;AACH,MAAM,OAAO,WAAW;IAiBO;IAhBpB,MAAM,CAAS;IACf,OAAO,CAAS;IACR,WAAW,CAAS;IACpB,OAAO,CAAe;IAC/B,SAAS,CAAsB;IAC/B,IAAI,CAAyC;IACpC,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACjE,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC1D,aAAa,CAAU;IACtB,SAAS,CAAS;IACV,aAAa,GAAG,IAAI,GAAG,EAAgD,CAAC;IACxE,oBAAoB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC1D,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,gFAAgF;IACvE,UAAU,CAAU;IAE7B,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,qBAAqB,CAAC;QAC5F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,YAAY,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACnD,qFAAqF;YACrF,MAAM,IAAI,UAAU,CAClB,kDAAkD,IAAI,CAAC,SAAS,kBAAkB;gBAChF,sFAAsF;gBACtF,4FAA4F;gBAC5F,4BAA4B,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;QACjB,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,8FAA8F;IAC9F,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CACnB,QAAgB,EAChB,OAAgE,EAAE;QAElE,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CACpF,QAAQ,CACT,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC;aAC/C,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC1B,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,qBAAqB,CAAC;aAC9E,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,QAAgB,EAChB,IAA6D;QAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACxF,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,UAAU,CAClB,uCAAuC,IAAI,CAAC,SAAS,MAAO,GAAa,CAAC,OAAO,EAAE,CACpF,CAAC;YACJ,CAAC;YACD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,0BAA0B,EAAE;oBACtE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBACnF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,QAAQ;wBACR,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7C,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO;oBACL,KAAK,EAAE,IAAI,CAAC,YAAY;oBACxB,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG;iBACvE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,UAAU,CACxB,yBAAyB,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE,EACvD,GAAG,CAAC,MAAM,EACV,IAAI,CACL,CAAC;YACF,iEAAiE;YACjE,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,GAAG,CAAC;YACtD,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,YAAY,UAAU;YACnC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,UAAU,CAAC,4BAA6B,SAAmB,EAAE,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CACtB,UAA2C,EAC3C,OAA8E,EAAE;QAEhF,IAAI,KAAa,CAAC;QAClB,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,KAAK,GAAG,UAAU,CAAC;aAClD,CAAC;YACJ,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAC7E,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO;gBACvC,GAAG,EAAE,iBAAiB;gBACtB,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,uBAAuB;gBACvC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;QAC3B,IACE,OAAO,CAAC,SAAS,KAAK,SAAS;YAC/B,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAO,CAAC,GAAG,KAAK,OAAO,MAAM,EAAE,EAC/B,CAAC;YACD,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,UAAU,GAAwD,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;YACvC,IACE,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;gBACxC,CAAC,OAAO,CAAC,YAAY;gBACrB,CAAC,KAAK;gBACN,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC1C,CAAC;gBACD,MAAM,IAAI,UAAU,CAAC,kEAAkE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,UAAU,CAAC,qBAAqB,MAAM,gBAAgB,CAAC,CAAC;YACpE,CAAC;YACD,UAAU,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,KAAiB,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1E,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,mCAAmC,CAAC,CAAC;YAClF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,4EAA4E;YAC5E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;gBAClD,gBAAgB,EAAE,MAAM;gBACxB,WAAW,EAAE,EAAE,GAAG,MAAM;gBACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,GAAG,EAAE,QAAQ;gBACb,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC;aAC9C,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YACpD,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAClD,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,mDAAmD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,OAAO;YAC/B,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;SAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,YAAY,IAAI,EAAE,EAAE;YACpE,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,MAAM,IAAI,UAAU,CAAC,SAAS,MAAM,IAAI,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1F,OAAO,MAAW,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,WAAmC,EACnC,OAA2E,EAAE;QAE7E,OAAO,IAAI,CAAC,QAAQ,CAAyB,MAAM,EAAE,uBAAuB,EAAE;YAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,MAAM,EACN,qBAAqB,EACrB,EAAE,GAAG,EAAE,CACR,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAkB,EAAE,OAAe;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9C,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,UAAU,CAAC,mEAAmE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,OAAe;QAC3D,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,GAAG,EAAE,eAAe;gBACpB,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,uBAAuB;gBACvC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc;YAAE,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7F,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAI,CAAC;YACvC,MAAM,IAAI,UAAU,CAAC,+BAA+B,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAI,EAAE,CAAC,OAAO,CAAC,GAAI,GAAG,uBAAuB,CAAC,GAAG,IAAI,CAAC,CAAC;IACzF,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,OAAsD,EAAE,OAAe;QACnF,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,UAAU,CAAC,iDAAiD,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACxE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,qBAAqB,EAAE,CAAC;YAChE,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;IAClD,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAY,KAAK,EAAE,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aACzF,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;gBACpB,KAAK;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,GAAG,IAAI;aAC7D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6CAA6C;IAC7C,UAAU,CAAC,KAAc;QACvB,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;YAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACvE,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,QAAQ,CAKjB,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,SAAS,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,KAAiE;QACnF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,kBAAkB,EAChB,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBACxC,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,+CAA+C;YACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAC1F,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,SAAS,KAAK,EAAE;aAChC;YACD,IAAI;SACL,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,2BAA2B,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,2 +1,2 @@
 export { suiteAuth, type SuiteAuthOptions } from './plugin.js';
-export { SuiteClient, SuiteError, TokenError, type LlmConfig, type OrgMember, type PermissionDefinition, type SuiteAuth, type SuiteClientOptions, } from './client.js';
+export { DEFAULT_IN_CLUSTER_SUITE_URL, DEFAULT_SA_TOKEN_FILE, EVENT_TOKEN_TYP, SERVICE_TOKEN_TYP, SUITE_INTERNAL_AUDIENCE, ScopeError, SuiteClient, SuiteError, TokenError, defaultInternalUrl, type AcceptsFrom, type LlmConfig, type ServiceAuth, type SuiteWebhookEvent, type OrgMember, type PermissionDefinition, type SuiteAuth, type SuiteClientOptions, } from './client.js';

package/dist/index.js

@@ -1,3 +1,3 @@
 export { suiteAuth } from './plugin.js';
-export { SuiteClient, SuiteError, TokenError, } from './client.js';
+export { DEFAULT_IN_CLUSTER_SUITE_URL, DEFAULT_SA_TOKEN_FILE, EVENT_TOKEN_TYP, SERVICE_TOKEN_TYP, SUITE_INTERNAL_AUDIENCE, ScopeError, SuiteClient, SuiteError, TokenError, defaultInternalUrl, } from './client.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,WAAW,EACX,UAAU,EACV,UAAU,GAMX,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,kBAAkB,GASnB,MAAM,aAAa,CAAC"}

package/dist/plugin.d.ts

@@ -1,8 +1,20 @@
 import type { FastifyPluginAsync, preHandlerAsyncHookHandler } from 'fastify';
-import { SuiteClient, type PermissionDefinition, type SuiteAuth, type SuiteClientOptions } from './client.js';
+import { SuiteClient, type AcceptsFrom, type PermissionDefinition, type ServiceAuth, type SuiteAuth, type SuiteClientOptions } from './client.js';
 export interface SuiteAuthOptions extends SuiteClientOptions {
     /** Permessi del servizio, registrati all'avvio con upsert idempotente. */
     permissions?: PermissionDefinition[];
+    /**
+     * Chi può chiamare questo servizio con un token di servizio e con quali scope,
+     * registrato all'avvio insieme ai permessi: `{ [audience]: { [caller]: scope[] } }`.
+     */
+    acceptsFrom?: AcceptsFrom;
+    /**
+     * Sottoinsieme di `acceptsFrom` che i chiamanti possono usare con token delegati
+     * (`on_behalf_of`, fase 8): `{ [audience]: { [caller]: scope[] } }`. `requireServiceToken`
+     * rifiuta con 403 i token delegati di chiamanti non elencati per l'audience (senza questa
+     * opzione, tutti i token delegati).
+     */
+    acceptsDelegationFrom?: AcceptsFrom;
     /**
      * URL pubblico (raggiungibile da Suite) dell'endpoint di invalidazione. Se valorizzato,
      * all'avvio il plugin lo registra presso Suite (la route su `webhookPath` è sempre montata).
@@ -10,7 +22,7 @@ export interface SuiteAuthOptions extends SuiteClientOptions {
     webhookUrl?: string;
     /**
      * Path locale dell'endpoint di invalidazione, montato sempre dal plugin
-     * (risponde 401 finché il webhook non è registrato). Default: /internal/config-changed.
+     * (senza un JWT valido, o fuori produzione una firma HMAC valida, risponde 401). Default: /internal/config-changed.
      * `false` per non montarlo.
      */
     webhookPath?: string | false;
@@ -24,9 +36,18 @@ declare module 'fastify' {
         authenticate: preHandlerAsyncHookHandler;
         /** preHandler: autentica e richiede il permesso indicato (nel token scoped del servizio). */
         requirePermission: (...permissions: string[]) => preHandlerAsyncHookHandler;
+        /**
+         * preHandler per le chiamate da altri servizi: richiede un `svc+jwt` con `aud` di questo
+         * servizio (o `audience`) e gli scope indicati; popola `req.serviceAuth`.
+         */
+        requireServiceToken: (opts?: {
+            scopes?: string[];
+            audience?: string;
+        }) => preHandlerAsyncHookHandler;
     }
     interface FastifyRequest {
         auth: SuiteAuth;
+        serviceAuth: ServiceAuth;
     }
 }
 export declare const suiteAuth: FastifyPluginAsync<SuiteAuthOptions>;

package/dist/plugin.js

@@ -1,5 +1,5 @@
 import fp from 'fastify-plugin';
-import { SuiteClient, TokenError, } from './client.js';
+import { ScopeError, SuiteClient, TokenError, } from './client.js';
 function unauthorized(reply, message) {
     return reply
         .code(401)
@@ -10,6 +10,7 @@ const plugin = async (app, opts) => {
     const client = new SuiteClient(opts);
     app.decorate('suite', client);
     app.decorateRequest('auth', null);
+    app.decorateRequest('serviceAuth', null);
     async function authenticate(req, reply) {
         const header = req.headers.authorization;
         if (!header?.startsWith('Bearer '))
@@ -39,14 +40,33 @@ const plugin = async (app, opts) => {
             }
         };
     });
+    app.decorate('requireServiceToken', (o = {}) => {
+        return async function (req, reply) {
+            const audience = o.audience ?? client.service;
+            try {
+                req.serviceAuth = await client.verifyServiceToken(req, {
+                    ...o,
+                    delegableCallers: Object.keys(opts.acceptsDelegationFrom?.[audience] ?? {}),
+                });
+            }
+            catch (err) {
+                if (err instanceof ScopeError) {
+                    return reply.code(403).send({ error: 'forbidden', message: err.message });
+                }
+                if (err instanceof TokenError)
+                    return unauthorized(reply, err.message);
+                throw err;
+            }
+        };
+    });
     if (opts.webhookPath !== false) {
         const path = opts.webhookPath ?? '/internal/config-changed';
         await app.register(async (child) => {
-            // La firma HMAC è calcolata sul body grezzo.
+            // JWT (body_sha256) e firma HMAC sono calcolati sul body grezzo.
             child.addContentTypeParser('application/json', { parseAs: 'string' }, (_req, body, done) => done(null, body));
             child.post(path, async (req, reply) => {
                 try {
-                    const event = client.verifyWebhook(req.headers, String(req.body ?? ''));
+                    const event = await client.verifyWebhookRequest(req.headers, String(req.body ?? ''));
                     client.invalidate(event.org_id);
                     return reply.code(204).send();
                 }
@@ -59,13 +79,18 @@ const plugin = async (app, opts) => {
             });
         });
     }
-    // Registrazione all'avvio: permessi e webhook. Senza service key non c'è nulla da registrare.
+    // Registrazione all'avvio: permessi, acceptsFrom e webhook. Senza token SA né service key
+    // non c'è modo di chiamare /internal/*.
     app.addHook('onReady', async () => {
-        if (!opts.serviceKey)
+        if (!client.hasInternalCredentials())
             return;
         try {
-            if (opts.permissions?.length)
-                await client.registerPermissions(opts.permissions);
+            if (opts.permissions?.length || opts.acceptsFrom) {
+                await client.registerPermissions(opts.permissions ?? [], {
+                    acceptsFrom: opts.acceptsFrom,
+                    acceptsDelegationFrom: opts.acceptsDelegationFrom,
+                });
+            }
             if (opts.webhookUrl)
                 await client.registerWebhook(opts.webhookUrl);
         }

package/dist/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EACL,WAAW,EACX,UAAU,GAIX,MAAM,aAAa,CAAC;AAiCrB,SAAS,YAAY,CAAC,KAAmB,EAAE,OAAe;IACxD,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;SAC1D,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,MAAM,GAAyC,KAAK,EAAE,GAAoB,EAAE,IAAI,EAAE,EAAE;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,IAA4B,CAAC,CAAC;IAE1D,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,KAAmB;QAClE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACxF,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,YAA0C,CAAC,CAAC;IACzE,GAAG,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,QAAkB,EAAE,EAAE;QAC1D,OAAO,KAAK,WAAW,GAAmB,EAAE,KAAmB;YAC7D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI;oBAAE,OAAO;YACzB,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,KAAK;qBACT,IAAI,CAAC,GAAG,CAAC;qBACT,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAA+B,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,CAAC;QAC5D,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,6CAA6C;YAC7C,KAAK,CAAC,oBAAoB,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACzF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CACjB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;oBACxE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;wBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1F,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8FAA8F;IAC9F,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM;gBAAE,MAAM,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjF,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI;gBAAE,MAAM,GAAG,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,GAMX,MAAM,aAAa,CAAC;AAsDrB,SAAS,YAAY,CAAC,KAAmB,EAAE,OAAe;IACxD,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;SAC1D,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,MAAM,GAAyC,KAAK,EAAE,GAAoB,EAAE,IAAI,EAAE,EAAE;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,IAA4B,CAAC,CAAC;IAC1D,GAAG,CAAC,eAAe,CAAC,aAAa,EAAE,IAA8B,CAAC,CAAC;IAEnE,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,KAAmB;QAClE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACxF,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,YAA0C,CAAC,CAAC;IACzE,GAAG,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,QAAkB,EAAE,EAAE;QAC1D,OAAO,KAAK,WAAW,GAAmB,EAAE,KAAmB;YAC7D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI;oBAAE,OAAO;YACzB,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,KAAK;qBACT,IAAI,CAAC,GAAG,CAAC;qBACT,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAA+B,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,IAA8C,EAAE,EAAE,EAAE;QACvF,OAAO,KAAK,WAAW,GAAmB,EAAE,KAAmB;YAC7D,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC;YAC9C,IAAI,CAAC;gBACH,GAAG,CAAC,WAAW,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE;oBACrD,GAAG,CAAC;oBACJ,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;iBAC5E,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBACD,IAAI,GAAG,YAAY,UAAU;oBAAE,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAA+B,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,CAAC;QAC5D,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,iEAAiE;YACjE,KAAK,CAAC,oBAAoB,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACzF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CACjB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;oBACrF,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;wBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1F,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,wCAAwC;IACxC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;YAAE,OAAO;QAC7C,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjD,MAAM,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE;oBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI;gBAAE,MAAM,GAAG,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@babelpeak/babel-suite-server-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "SDK Node per integrare un servizio con Babel Suite: auth JWT, permessi, config LLM",
   "license": "UNLICENSED",
   "repository": {