@benlampson/heimdall-browser 0.0.0-stage → 5.5.3

package/README.md

@@ -1,3 +1,31 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @benlampson/heimdall-browser
+
+框架无关的 Heimdall 浏览器 Token 与数据客户端，版本跟随 Heimdall 整体 Release。
+
+提供 Code + PKCE、Device Code、JWT 校验/未验证解码、JWT/opaque Access Token 获取与刷新、可选自动刷新、UserInfo、受控 Bearer 请求及撤销/退出。没有 UI、业务后端状态接口或数据库依赖。
+
+默认自动保存到 localStorage；可选 sessionStorage、自定义 Storage 或 `storage: false` 仅使用内存。localStorage 跨标签页协调要求 Web Locks。浏览器不使用 Client Secret。
+
+公开接口与示例见仓库 [SDK 指南](https://github.com/BenLampson/Asgard.Heimdall/blob/main/sdk/README.md)。
+
+`HeimdallProtocolClient` 从 `@benlampson/heimdall-browser/protocol` 导出，无 window 或存储访问；完整 Token 和登录事务由调用方保存。
+
+```ts
+import { HeimdallBrowserClient } from '@benlampson/heimdall-browser';
+const client = new HeimdallBrowserClient({
+  authority: 'https://idp.example.com/tenant-a', clientId: 'business-spa',
+  tenantId: 'tenant-a', applicationId: 'business-app', audience: 'business-api',
+  scope: 'openid profile offline_access business.api',
+  redirectUri: 'https://business.example.com/callback',
+  resourceBaseUrls: ['https://api.example.com/'], automaticRenew: true,
+});
+// 生成登录地址，由应用决定如何使用。
+const { url } = await client.createLoginRequest();
+// 在应用自己的回调路由中：await client.handleLoginCallback();
+// 业务按需获取：await client.getAccessToken() / client.getTokenSet();
+// 主动刷新：await client.refreshAccessToken();
+// 开关自动刷新：client.setAutomaticRenew(false);
+// 设备登录：requestDeviceAuthorization / exchangeDeviceCode / waitForDeviceToken。
+```
+
+登录方式在 Heimdall 托管页面完成，SDK 统一使用授权码 + PKCE。business.api 是需登记的示例 scope；回调、Origin、grant 与 audience 按实际 Client 配置。

package/dist/claims.d.ts

@@ -0,0 +1,11 @@
+import { type HeimdallIdentity } from './types.js';
+/** Asgard claim 当前使用数组或 JSON 数组字符串；不进行宽松字符串权限猜测。 */
+export declare function claimArray(value: unknown): string[];
+/** 仅提取身份数据快照；此处解码不能承担登录或 API 验证。 */
+export declare function displayIdentity(token: string): HeimdallIdentity;
+/** 只判断声明集合，不代替后端业务授权。 */
+export declare function hasAllPermissions(identity: HeimdallIdentity | null, permissions: readonly string[]): boolean;
+/** 回跳只允许本站路径，拒绝绝对 URL、反斜杠及控制字符。 */
+export declare function safeReturnPath(path?: string): string;
+/** 精确比较会话身份，刷新不能漂移到最近的 IDP 账号。 */
+export declare function sameIdentity(left: Pick<HeimdallIdentity, 'issuer' | 'clientId' | 'tenantId' | 'applicationId' | 'subjectId' | 'sessionId'>, right: Pick<HeimdallIdentity, 'issuer' | 'clientId' | 'tenantId' | 'applicationId' | 'subjectId' | 'sessionId'>): boolean;

package/dist/claims.js

@@ -0,0 +1,47 @@
+import { decodeJwt } from 'jose';
+import { HeimdallBrowserError } from './types.js';
+/** Asgard claim 当前使用数组或 JSON 数组字符串；不进行宽松字符串权限猜测。 */
+export function claimArray(value) {
+    if (typeof value === 'string') {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return [];
+        }
+    }
+    return Array.isArray(value) && value.every(item => typeof item === 'string' && item.length > 0) ? [...new Set(value)] : [];
+}
+/** 仅提取身份数据快照；此处解码不能承担登录或 API 验证。 */
+export function displayIdentity(token) {
+    const payload = decodeJwt(token);
+    const text = (key) => typeof payload[key] === 'string' ? payload[key] : '';
+    if (!text('sub') || !text('sid'))
+        throw new HeimdallBrowserError('invalid_identity');
+    return { issuer: text('iss'), clientId: text('client_id'), tenantId: text('tenant_id'), applicationId: text('application_id'),
+        subjectId: text('sub'), sessionId: text('sid'), roles: claimArray(payload.roles), permissions: claimArray(payload.permissions) };
+}
+/** 只判断声明集合，不代替后端业务授权。 */
+export function hasAllPermissions(identity, permissions) {
+    return identity !== null && permissions.every(value => identity.permissions.includes(value));
+}
+/** 回跳只允许本站路径，拒绝绝对 URL、反斜杠及控制字符。 */
+export function safeReturnPath(path = '/') {
+    if (!path.startsWith('/') || path.startsWith('//') || /[\\\x00-\x1f\x7f]/.test(path))
+        throw new HeimdallBrowserError('invalid_return_path');
+    let decoded;
+    try {
+        decoded = decodeURIComponent(path);
+    }
+    catch {
+        throw new HeimdallBrowserError('invalid_return_path');
+    }
+    if (decoded.startsWith('//') || /[\\\x00-\x1f\x7f]/.test(decoded))
+        throw new HeimdallBrowserError('invalid_return_path');
+    return path;
+}
+/** 精确比较会话身份，刷新不能漂移到最近的 IDP 账号。 */
+export function sameIdentity(left, right) {
+    return ['issuer', 'clientId', 'tenantId', 'applicationId', 'subjectId', 'sessionId'].every(key => left[key] === right[key]);
+}
+//# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAyB,MAAM,YAAY,CAAC;AAEzE,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7H,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IACrF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;QAC3H,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;AACrI,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,iBAAiB,CAAC,QAAiC,EAAE,WAA8B;IACjG,OAAO,QAAQ,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,GAAG;IACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IAC5I,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,YAAY,CAAC,IAA8G,EACzI,KAA+G;IAC/G,OAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACzI,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,88 @@
+import { HeimdallProtocolClient } from './protocol.js';
+import type { HeimdallTokenSet, HeimdallLoginOptions, HeimdallDeviceAuthorization, HeimdallDeviceTokenResult } from './protocol-types.js';
+import { type ApplicationLogoutResult, type HeimdallBrowserOptions, type HeimdallSnapshot } from './types.js';
+/** 框架无关的 Token 客户端，协议校验与凭据保存分离。 */
+export declare class HeimdallBrowserClient {
+    private readonly options;
+    private readonly sessions;
+    private readonly listeners;
+    private snapshot;
+    /** 无存储协议入口，直接返回 Token 结果。 */
+    readonly protocol: HeimdallProtocolClient;
+    private renewal?;
+    private timer?;
+    private automaticRenew;
+    private readonly storageHandler;
+    private readonly visibilityHandler;
+    constructor(options: HeimdallBrowserOptions);
+    /** 返回稳定的身份数据快照，不公开令牌。 */
+    getSnapshot: () => HeimdallSnapshot;
+    subscribe: (listener: () => void) => (() => void);
+    /** 每次协议操作使用隔离用户存储，事务存储仍由 oidc-client-ts 消费一次性 state。 */
+    private manager;
+    /** 生成浏览器回调可消费的地址，接入方决定是否跳转；事务临时保存在 sessionStorage。 */
+    createLoginRequest(returnPath?: string, login?: Omit<HeimdallLoginOptions, 'responseMode'>): Promise<{
+        url: string;
+    }>;
+    /** 明确发起登录；默认允许服务器使用现有 SSO，账号选择必须显式要求。 */
+    login(returnPath?: string, login?: Omit<HeimdallLoginOptions, 'responseMode'>): Promise<void>;
+    /** 候选失败或取消保留原应用身份。 */
+    switchAccount(returnPath?: string): Promise<void>;
+    /** 回调先完整验证再原子提交，提交后才撤销旧应用的凭据。 */
+    handleLoginCallback(url?: string): Promise<{
+        returnPath: string;
+        previousRevocationConfirmed: boolean;
+        tokens: HeimdallTokenSet;
+    }>;
+    /** 续期只使用 RT；不通过 iframe 自动从 IDP Cookie 恢复退出的登录。 */
+    getAccessToken(): Promise<string>;
+    /** 主动使用 Refresh Token 换取新 JWT，验证后自动保存。 */
+    refreshAccessToken(): Promise<string>;
+    /** 运行时开启或关闭后台自动续期。 */
+    setAutomaticRenew(enabled: boolean): void;
+    private obtainAccessToken;
+    /** Bearer 仅发送到配置资源前缀；禁止重定向，旧响应不能覆盖新身份数据。 */
+    fetch(input: string | URL, init?: RequestInit): Promise<Response>;
+    /** 展示资料来自 Discovery UserInfo，响应主体必须匹配当前会话。 */
+    getUserInfo(): Promise<Record<string, unknown>>;
+    /** 普通退出先结束本地版本，网络失败不恢复凭据。 */
+    logoutApplication(): Promise<ApplicationLogoutResult>;
+    /** 统一退出是独立明确操作，捕获原 ID Token；回调不声称通知全部送达。 */
+    logoutSso(): Promise<void>;
+    /** OIDC 库消费退出 state，迟到回跳不得清理后来建立的会话。 */
+    handleLogoutCallback(url?: string): Promise<{
+        returnedFromSso: true;
+    }>;
+    /** 卸载时释放监听和自动续期计时器；不注销用户。 */
+    dispose(): void;
+    private validate;
+    /** opaque 身份来自已签名 ID Token，角色权限不可从 opaque 解码。 */
+    private identity;
+    /** 完整凭据返回给调用方；Token 的取得时间与剩余有效期对应。 */
+    private tokens;
+    /** 获取完整 Token 结果，业务可完全自行保存。 */
+    getTokenSet(): Promise<HeimdallTokenSet>;
+    /** 设备码发起时绑定当前版本，退出或其它登录后不得覆盖它。 */
+    requestDeviceAuthorization(signal?: AbortSignal): Promise<HeimdallDeviceAuthorization & {
+        browserVersion: string;
+    }>;
+    /** 只尝试一次，成功后核对版本、校验身份并更新所选存储。 */
+    exchangeDeviceCode(device: HeimdallDeviceAuthorization & {
+        browserVersion: string;
+    }, signal?: AbortSignal): Promise<HeimdallDeviceTokenResult>;
+    /** 可取消轮询，收到 Token 后才提交浏览器凭据。 */
+    waitForDeviceToken(device: HeimdallDeviceAuthorization & {
+        browserVersion: string;
+    }, signal?: AbortSignal): Promise<HeimdallTokenSet>;
+    private acceptDeviceTokens;
+    private endCaptured;
+    /** 读取完整响应体后再次核对版本，防止 headers 已到而 body 迟到时污染新账号界面。 */
+    private guardResponse;
+    private revoke;
+    private readSnapshot;
+    private changed;
+    private scheduleRenew;
+    private trustedUrl;
+    private ensureResource;
+    private validateOptions;
+}

package/dist/client.js

@@ -0,0 +1,378 @@
+import { OidcClient, User, UserManager, WebStorageStateStore } from 'oidc-client-ts';
+import { HeimdallProtocolClient } from './protocol.js';
+import { displayIdentity, safeReturnPath, sameIdentity } from './claims.js';
+import { MemoryStorage, SessionStore } from './session.js';
+import { HeimdallBrowserError } from './types.js';
+/** 框架无关的 Token 客户端，协议校验与凭据保存分离。 */
+export class HeimdallBrowserClient {
+    options;
+    sessions;
+    listeners = new Set();
+    snapshot;
+    /** 无存储协议入口，直接返回 Token 结果。 */
+    protocol;
+    renewal;
+    timer;
+    automaticRenew;
+    storageHandler = (event) => { if (event.key === this.sessions.key)
+        this.changed(); };
+    visibilityHandler = () => { if (document.visibilityState === 'visible' && this.sessions.read().user)
+        void this.getAccessToken().catch(() => undefined); };
+    constructor(options) {
+        this.options = options;
+        this.validateOptions();
+        this.protocol = new HeimdallProtocolClient(options);
+        this.automaticRenew = options.automaticRenew ?? false;
+        const namespace = 'heimdall.sdk:' + JSON.stringify([options.authority, options.clientId, options.applicationId]);
+        this.sessions = new SessionStore(namespace, options.storage === false ? new MemoryStorage() : options.storage ?? window.localStorage, options.storage !== false && ((options.storage ?? window.localStorage) === window.localStorage || (options.sharedStorage ?? false)));
+        this.snapshot = this.readSnapshot();
+        window.addEventListener('storage', this.storageHandler);
+        document.addEventListener('visibilitychange', this.visibilityHandler);
+        this.scheduleRenew();
+    }
+    /** 返回稳定的身份数据快照，不公开令牌。 */
+    getSnapshot = () => this.snapshot;
+    subscribe = (listener) => { this.listeners.add(listener); return () => this.listeners.delete(listener); };
+    /** 每次协议操作使用隔离用户存储，事务存储仍由 oidc-client-ts 消费一次性 state。 */
+    async manager() {
+        return new UserManager({ authority: this.options.authority, client_id: this.options.clientId,
+            metadata: await this.protocol.getDiscovery(), fetchRequestCredentials: 'omit',
+            redirect_uri: this.options.redirectUri, post_logout_redirect_uri: this.options.postLogoutRedirectUri,
+            response_type: 'code', scope: this.options.scope ?? 'openid profile email offline_access',
+            automaticSilentRenew: false, loadUserInfo: false, filterProtocolClaims: false,
+            stateStore: new WebStorageStateStore({ store: window.sessionStorage, prefix: this.sessions.key + ':oidc:' }),
+            userStore: new WebStorageStateStore({ store: new MemoryStorage() }), requestTimeoutInSeconds: 15 });
+    }
+    /** 生成浏览器回调可消费的地址，接入方决定是否跳转；事务临时保存在 sessionStorage。 */
+    async createLoginRequest(returnPath = '/', login = {}) {
+        if (login.maxAge !== undefined && (!Number.isSafeInteger(login.maxAge) || login.maxAge < 0))
+            throw new HeimdallBrowserError('invalid_max_age');
+        if (login.prompt !== undefined && !['none', 'login', 'consent', 'select_account'].includes(login.prompt))
+            throw new HeimdallBrowserError('invalid_login_parameters');
+        const request = await new OidcClient((await this.manager()).settings).createSigninRequest({ prompt: login.prompt, max_age: login.maxAge, nonce: crypto.randomUUID(),
+            state: { sdk: 1, version: this.sessions.read().version, returnPath: safeReturnPath(returnPath) } });
+        return { url: request.url };
+    }
+    /** 明确发起登录；默认允许服务器使用现有 SSO，账号选择必须显式要求。 */
+    async login(returnPath = '/', login = {}) {
+        const request = await this.createLoginRequest(returnPath, login);
+        window.location.assign(request.url);
+    }
+    /** 候选失败或取消保留原应用身份。 */
+    async switchAccount(returnPath = '/') { await this.login(returnPath, { prompt: 'select_account' }); }
+    /** 回调先完整验证再原子提交，提交后才撤销旧应用的凭据。 */
+    async handleLoginCallback(url) {
+        return this.sessions.protocol(async () => {
+            const manager = await this.manager();
+            const callback = url ?? window.location.href;
+            let saved;
+            try {
+                ({ state: saved } = await new OidcClient(manager.settings).readSigninResponseState(callback, true));
+            }
+            catch {
+                throw new HeimdallBrowserError('invalid_login_callback');
+            }
+            finally {
+                await manager.events.unload();
+            }
+            const state = saved.data;
+            if (state?.sdk !== 1 || typeof state.version !== 'string')
+                throw new HeimdallBrowserError('invalid_callback_state');
+            const target = safeReturnPath(state.returnPath);
+            // Token POST 统一由纯协议层发送，禁止 HTTP 重定向重发 code/verifier/RT。
+            const tokens = await this.protocol.exchangeCode(new URL(callback).searchParams, { url: '', state: saved.id, nonce: saved.nonce ?? '',
+                codeVerifier: saved.code_verifier ?? '', authority: saved.authority, clientId: saved.client_id, redirectUri: saved.redirect_uri, createdAt: saved.created * 1000 });
+            const profile = await this.protocol.validateJwt(tokens.id_token, { idToken: true });
+            const candidate = new User({ ...tokens, expires_at: Math.floor(tokens.obtained_at / 1000) + tokens.expires_in, profile: profile, userState: state });
+            await this.validate(candidate, true);
+            let previous = null;
+            await this.sessions.locked(() => {
+                const old = this.sessions.read();
+                if (old.user)
+                    previous = User.fromStorageString(old.user);
+                this.sessions.commit(state.version, candidate.toStorageString());
+            });
+            this.changed();
+            const oldUser = previous;
+            const confirmed = oldUser && oldUser.access_token !== candidate.access_token ? await this.revoke(oldUser) : true;
+            return { returnPath: target, previousRevocationConfirmed: confirmed, tokens: this.tokens(candidate) };
+        });
+    }
+    /** 续期只使用 RT；不通过 iframe 自动从 IDP Cookie 恢复退出的登录。 */
+    async getAccessToken() { return this.obtainAccessToken(false); }
+    /** 主动使用 Refresh Token 换取新 JWT，验证后自动保存。 */
+    async refreshAccessToken() { return this.obtainAccessToken(true); }
+    /** 运行时开启或关闭后台自动续期。 */
+    setAutomaticRenew(enabled) { this.automaticRenew = enabled; this.scheduleRenew(); }
+    async obtainAccessToken(forceRefresh) {
+        if (this.renewal)
+            return this.renewal;
+        this.renewal = this.sessions.protocol(async () => {
+            const captured = this.sessions.read();
+            if (!captured.user)
+                throw new HeimdallBrowserError('not_authenticated');
+            const oldUser = User.fromStorageString(captured.user);
+            let candidate = oldUser;
+            if (forceRefresh || oldUser.expired || (oldUser.refresh_token && (oldUser.expires_in ?? 0) < 60)) {
+                if (!oldUser.refresh_token)
+                    throw new HeimdallBrowserError('login_required');
+                try {
+                    const identity = this.identity(oldUser);
+                    const tokens = await this.protocol.refreshToken(oldUser.refresh_token, { subjectId: identity.subjectId, sessionId: identity.sessionId });
+                    const profile = tokens.id_token ? await this.protocol.validateJwt(tokens.id_token, { idToken: true }) : oldUser.profile;
+                    candidate = new User({ ...tokens, refresh_token: tokens.refresh_token ?? oldUser.refresh_token,
+                        id_token: tokens.id_token ?? oldUser.id_token, scope: tokens.scope ?? oldUser.scope,
+                        expires_at: Math.floor(tokens.obtained_at / 1000) + tokens.expires_in, profile: profile });
+                }
+                catch (error) {
+                    if (typeof error === 'object' && error !== null && 'code' in error && error.code === 'invalid_grant')
+                        await this.endCaptured(captured, oldUser.access_token);
+                    throw new HeimdallBrowserError('renewal_failed');
+                }
+            }
+            if (!sameIdentity(this.identity(oldUser), this.identity(candidate)))
+                throw new HeimdallBrowserError('identity_changed');
+            await this.validate(candidate, candidate.id_token !== oldUser.id_token);
+            await this.sessions.locked(() => {
+                const current = this.sessions.read();
+                if (current.version !== captured.version || current.user !== captured.user)
+                    throw new HeimdallBrowserError('session_changed');
+                if (candidate !== oldUser)
+                    this.sessions.commit(captured.version, candidate.toStorageString());
+            });
+            this.changed();
+            return candidate.access_token;
+        }).finally(() => { this.renewal = undefined; });
+        return this.renewal;
+    }
+    /** Bearer 仅发送到配置资源前缀；禁止重定向，旧响应不能覆盖新身份数据。 */
+    async fetch(input, init = {}) {
+        const url = new URL(input, window.location.origin);
+        this.ensureResource(url);
+        const token = await this.getAccessToken();
+        const captured = this.sessions.read();
+        if (!captured.user || User.fromStorageString(captured.user).access_token !== token)
+            throw new HeimdallBrowserError('session_changed');
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `Bearer ${token}`);
+        const response = await globalThis.fetch(url, { ...init, headers, credentials: 'omit', redirect: 'error',
+            signal: init.signal ?? AbortSignal.timeout(15000) });
+        const current = this.sessions.read();
+        if (current.version !== captured.version || !current.user || User.fromStorageString(current.user).access_token !== token)
+            throw new HeimdallBrowserError('session_changed');
+        if (response.status === 401)
+            await this.endCaptured(captured, token);
+        return this.guardResponse(response, captured.version, token);
+    }
+    /** 展示资料来自 Discovery UserInfo，响应主体必须匹配当前会话。 */
+    async getUserInfo() {
+        const token = await this.getAccessToken();
+        const captured = this.sessions.read();
+        if (!captured.user || User.fromStorageString(captured.user).access_token !== token)
+            throw new HeimdallBrowserError('session_changed');
+        const profile = await this.protocol.getUserInfo(token, this.identity(User.fromStorageString(captured.user)).subjectId);
+        if (this.sessions.read().version !== captured.version)
+            throw new HeimdallBrowserError('session_changed');
+        if (profile.sub !== this.identity(User.fromStorageString(captured.user)).subjectId)
+            throw new HeimdallBrowserError('identity_changed');
+        return profile;
+    }
+    /** 普通退出先结束本地版本，网络失败不恢复凭据。 */
+    async logoutApplication() {
+        let user = null;
+        await this.sessions.locked(() => {
+            const captured = this.sessions.read();
+            user = captured.user ? User.fromStorageString(captured.user) : null;
+            this.sessions.commit(captured.version);
+        });
+        this.changed();
+        return { localLogoutCompleted: true, revocationConfirmed: user ? await this.revoke(user) : true };
+    }
+    /** 统一退出是独立明确操作，捕获原 ID Token；回调不声称通知全部送达。 */
+    async logoutSso() {
+        let captured;
+        let user;
+        let endedVersion;
+        await this.sessions.locked(() => {
+            captured = this.sessions.read();
+            if (!captured.user)
+                throw new HeimdallBrowserError('not_authenticated');
+            user = User.fromStorageString(captured.user);
+            if (!user.id_token || !this.identity(user).sessionId)
+                throw new HeimdallBrowserError('logout_hint_missing');
+            endedVersion = this.sessions.commit(captured.version).version;
+        });
+        this.changed();
+        await (await this.manager()).signoutRedirect({ id_token_hint: user.id_token,
+            extraQueryParams: { client_id: this.options.clientId }, state: { sdk: 1, endedVersion } });
+    }
+    /** OIDC 库消费退出 state，迟到回跳不得清理后来建立的会话。 */
+    async handleLogoutCallback(url) {
+        const response = await (await this.manager()).signoutRedirectCallback(url);
+        const state = response.userState;
+        if (state?.sdk !== 1 || state.endedVersion !== this.sessions.read().version)
+            throw new HeimdallBrowserError('session_changed');
+        return { returnedFromSso: true };
+    }
+    /** 卸载时释放监听和自动续期计时器；不注销用户。 */
+    dispose() { clearTimeout(this.timer); window.removeEventListener('storage', this.storageHandler); document.removeEventListener('visibilitychange', this.visibilityHandler); this.listeners.clear(); }
+    async validate(user, verifyIdToken) {
+        let id;
+        if (verifyIdToken) {
+            if (!user.id_token)
+                throw new HeimdallBrowserError('id_token_missing');
+            id = await this.protocol.validateJwt(user.id_token, { idToken: true });
+            if (typeof id.sid !== 'string' || !id.sid)
+                throw new HeimdallBrowserError('invalid_identity');
+            user.profile = id;
+        }
+        if ((this.options.accessTokenFormat ?? 'jwt') === 'jwt') {
+            const claims = await this.protocol.validateJwt(user.access_token, { tokenType: 'UserLogin', subjectId: id?.sub, sessionId: typeof id?.sid === 'string' ? id.sid : undefined });
+            if (typeof claims.sid !== 'string' || !claims.sid)
+                throw new HeimdallBrowserError('invalid_identity');
+        }
+        // 已登录凭据的 ID Token 可早于 AT 到期；opaque 不以旧 ID Token 的到期时间替代 AT 寿命。
+    }
+    /** opaque 身份来自已签名 ID Token，角色权限不可从 opaque 解码。 */
+    identity(user) {
+        if ((this.options.accessTokenFormat ?? 'jwt') === 'jwt')
+            return displayIdentity(user.access_token);
+        if (typeof user.profile.sub !== 'string' || typeof user.profile.sid !== 'string')
+            throw new HeimdallBrowserError('invalid_identity');
+        return { issuer: this.options.authority, clientId: this.options.clientId, tenantId: this.options.tenantId,
+            applicationId: this.options.applicationId, subjectId: user.profile.sub, sessionId: user.profile.sid, roles: [], permissions: [] };
+    }
+    /** 完整凭据返回给调用方；Token 的取得时间与剩余有效期对应。 */
+    tokens(user) {
+        return { access_token: user.access_token, token_type: 'Bearer', expires_in: Math.max(0, user.expires_in ?? 0),
+            refresh_token: user.refresh_token, id_token: user.id_token, scope: user.scope, obtained_at: Date.now() };
+    }
+    /** 获取完整 Token 结果，业务可完全自行保存。 */
+    async getTokenSet() {
+        await this.getAccessToken();
+        const current = this.sessions.read();
+        if (!current.user)
+            throw new HeimdallBrowserError('not_authenticated');
+        return this.tokens(User.fromStorageString(current.user));
+    }
+    /** 设备码发起时绑定当前版本，退出或其它登录后不得覆盖它。 */
+    async requestDeviceAuthorization(signal) {
+        const version = this.sessions.read().version;
+        return { ...await this.protocol.requestDeviceAuthorization(signal), browserVersion: version };
+    }
+    /** 只尝试一次，成功后核对版本、校验身份并更新所选存储。 */
+    async exchangeDeviceCode(device, signal) {
+        return this.sessions.protocol(async () => {
+            const result = await this.protocol.exchangeDeviceCode(device, signal);
+            if (result.status === 'complete')
+                await this.acceptDeviceTokens(result.tokens, device.browserVersion);
+            return result;
+        });
+    }
+    /** 可取消轮询，收到 Token 后才提交浏览器凭据。 */
+    async waitForDeviceToken(device, signal) {
+        return this.sessions.protocol(async () => {
+            const tokens = await this.protocol.waitForDeviceToken(device, signal);
+            await this.acceptDeviceTokens(tokens, device.browserVersion);
+            return tokens;
+        });
+    }
+    async acceptDeviceTokens(tokens, version) {
+        if (!tokens.id_token)
+            throw new HeimdallBrowserError('id_token_missing');
+        const id = await this.protocol.validateJwt(tokens.id_token, { idToken: true });
+        const user = new User({ ...tokens, expires_at: Math.floor(tokens.obtained_at / 1000) + tokens.expires_in, profile: id });
+        await this.validate(user, true);
+        let previous = null;
+        await this.sessions.locked(() => {
+            const current = this.sessions.read();
+            if (current.user)
+                previous = User.fromStorageString(current.user);
+            this.sessions.commit(version, user.toStorageString());
+        });
+        this.changed();
+        if (previous)
+            await this.revoke(previous);
+    }
+    async endCaptured(captured, token) {
+        await this.sessions.locked(() => {
+            const current = this.sessions.read();
+            if (current.version === captured.version && current.user && User.fromStorageString(current.user).access_token === token)
+                this.sessions.commit(captured.version);
+        });
+        this.changed();
+    }
+    /** 读取完整响应体后再次核对版本，防止 headers 已到而 body 迟到时污染新账号界面。 */
+    guardResponse(response, version, token) {
+        const check = () => {
+            const current = this.sessions.read();
+            if (current.version !== version || !current.user || User.fromStorageString(current.user).access_token !== token)
+                throw new HeimdallBrowserError('session_changed');
+        };
+        for (const method of ['json', 'text', 'arrayBuffer', 'blob', 'formData']) {
+            const read = response[method].bind(response);
+            Object.defineProperty(response, method, { value: async () => { const result = await read(); check(); return result; } });
+        }
+        const clone = response.clone.bind(response);
+        Object.defineProperty(response, 'clone', { value: () => { check(); return this.guardResponse(clone(), version, token); } });
+        return response;
+    }
+    async revoke(user) {
+        try {
+            for (const type of ['refresh_token', 'access_token']) {
+                if (!user[type])
+                    continue;
+                await this.protocol.revokeToken(user[type], type);
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    readSnapshot() {
+        const current = this.sessions.read();
+        let identity = null;
+        try {
+            if (current.user)
+                identity = this.identity(User.fromStorageString(current.user));
+        }
+        catch { /* 快照只包含可解析身份数据。 */ }
+        return { identity, version: current.version };
+    }
+    changed() { this.snapshot = this.readSnapshot(); this.scheduleRenew(); for (const listener of this.listeners)
+        listener(); }
+    scheduleRenew() {
+        clearTimeout(this.timer);
+        const current = this.sessions.read();
+        if (!this.automaticRenew || !current.user)
+            return;
+        const user = User.fromStorageString(current.user);
+        if (!user.refresh_token)
+            return;
+        this.timer = setTimeout(() => { void this.getAccessToken().catch(() => { }); }, Math.max(1000, ((user.expires_in ?? 0) - 60) * 1000));
+    }
+    trustedUrl(value) {
+        const url = new URL(value);
+        if (url.username || url.password || url.hash || !(url.protocol === 'https:'
+            || (this.options.allowLocalhostHttp && url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))))
+            throw new HeimdallBrowserError('untrusted_url');
+        return url;
+    }
+    ensureResource(url) {
+        if (!(this.options.resourceBaseUrls ?? []).some(base => {
+            const allowed = this.trustedUrl(base);
+            return url.origin === allowed.origin && (url.pathname === allowed.pathname.replace(/\/$/, '') || url.pathname.startsWith(allowed.pathname.replace(/\/$/, '') + '/'));
+        }))
+            throw new HeimdallBrowserError('untrusted_resource');
+    }
+    validateOptions() {
+        for (const value of [this.options.authority, this.options.redirectUri, this.options.postLogoutRedirectUri,
+            ...(this.options.resourceBaseUrls ?? [])])
+            this.trustedUrl(value);
+        if (!this.options.clientId || !this.options.applicationId || !this.options.audience
+            || !(this.options.scope ?? 'openid').split(' ').includes('openid'))
+            throw new HeimdallBrowserError('invalid_configuration');
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAuC,MAAM,gBAAgB,CAAC;AAC1H,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EACJ,MAAM,YAAY,CAAC;AAE1C,mCAAmC;AACrC,MAAM,OAAO,qBAAqB;IAYH;IAXZ,QAAQ,CAAe;IACvB,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAC3C,QAAQ,CAAmB;IACnC,6BAA6B;IACpB,QAAQ,CAAyB;IAClC,OAAO,CAAmB;IAC1B,KAAK,CAAiC;IACtC,cAAc,CAAU;IACf,cAAc,GAAG,CAAC,KAAmB,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACnG,iBAAiB,GAAG,GAAG,EAAE,GAAG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;QAAE,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3K,YAA6B,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QACtD,MAAM,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QACjH,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,YAAY,EAClI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACvI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxD,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IACD,yBAAyB;IACzB,WAAW,GAAG,GAAqB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;IACpD,SAAS,GAAG,CAAC,QAAoB,EAAgB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpI,wDAAwD;IAChD,KAAK,CAAC,OAAO;QACnB,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC1F,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAA2B,EAAE,uBAAuB,EAAE,MAAM;YACtG,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;YACpG,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,qCAAqC;YACzF,oBAAoB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK;YAC7E,UAAU,EAAE,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC5G,SAAS,EAAE,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,EAAE,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,kBAAkB,CAAC,UAAU,GAAG,GAAG,EAAE,QAAoD,EAAE;QAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAC/I,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;QACrK,MAAM,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;YACjK,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACtG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IACD,yCAAyC;IACzC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,QAAoD,EAAE;QAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,sBAAsB;IACtB,KAAK,CAAC,aAAa,CAAC,UAAU,GAAG,GAAG,IAAmB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;IAEpH,iCAAiC;IACjC,KAAK,CAAC,mBAAmB,CAAC,GAAY;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7C,IAAI,KAAkB,CAAC;YACvB,IAAI,CAAC;gBAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAAC,CAAC;YAC5G,MAAM,CAAC;gBAAC,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;YAAC,CAAC;oBAC3D,CAAC;gBAAC,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAA2E,CAAC;YAChG,IAAI,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;YACpH,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChD,uDAAuD;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;gBAClI,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;YACtK,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,OAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACxK,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAgB,IAAI,CAAC;YACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,IAAI;oBAAE,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAQ,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,QAAuB,CAAC;YACxC,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACxG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,cAAc,KAAsB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjF,0CAA0C;IAC1C,KAAK,CAAC,kBAAkB,KAAsB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEpF,sBAAsB;IACtB,iBAAiB,CAAC,OAAgB,IAAU,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAE1F,KAAK,CAAC,iBAAiB,CAAC,YAAqB;QACnD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,SAAS,GAAG,OAAO,CAAC;YACxB,IAAI,YAAY,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACjG,IAAI,CAAC,OAAO,CAAC,aAAa;oBAAE,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBAC7E,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;oBACzI,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;oBACxH,SAAS,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa;wBAC5F,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;wBACnF,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,OAA0B,EAAE,CAAC,CAAC;gBAClH,CAAC;gBACD,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;wBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;oBAC7J,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YACxH,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;oBAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;gBAC9H,IAAI,SAAS,KAAK,OAAO;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;YACjG,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,KAAK,CAAC,KAAmB,EAAE,OAAoB,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACtI,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;YACrG,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK;YACtH,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACtI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvH,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACzG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACvI,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,6BAA6B;IAC7B,KAAK,CAAC,iBAAiB;QACrB,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpG,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,SAAS;QACb,IAAI,QAAwB,CAAC;QAC7B,IAAI,IAAW,CAAC;QAChB,IAAI,YAAqB,CAAC;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;YAC9B,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;YACxE,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS;gBAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;YAC5G,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ;YACzE,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,oBAAoB,CAAC,GAAY;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAgE,CAAC;QACxF,IAAI,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO;YAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAC/H,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,6BAA6B;IAC7B,OAAO,KAAW,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEnM,KAAK,CAAC,QAAQ,CAAC,IAAU,EAAE,aAAsB;QACvD,IAAI,EAAE,CAAC;QACP,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YACvE,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,OAAO,EAAE,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,GAAG;gBAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC9F,IAAI,CAAC,OAAO,GAAG,EAAqB,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/K,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACxG,CAAC;QACD,+DAA+D;IACjE,CAAC;IACD,iDAAiD;IACzC,QAAQ,CAAC,IAAU;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK;YAAE,OAAO,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnG,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACrI,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YACvG,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACtI,CAAC;IACD,sCAAsC;IAC9B,MAAM,CAAC,IAAU;QACvB,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;YAC3G,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC7G,CAAC;IACD,+BAA+B;IAC/B,KAAK,CAAC,WAAW;QAAgC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAAC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjH,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IACrI,kCAAkC;IAClC,KAAK,CAAC,0BAA0B,CAAC,MAAoB;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC;QAAC,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IAC9I,CAAC;IACD,iCAAiC;IACjC,KAAK,CAAC,kBAAkB,CAAC,MAAgE,EAAE,MAAoB;QAC7G,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAAG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChH,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAAC,CAAC,CAAC,CAAC;IAC7H,CAAC;IACD,gCAAgC;IAChC,KAAK,CAAC,kBAAkB,CAAC,MAAgE,EAAE,MAAoB;QAC7G,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAAG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACO,KAAK,CAAC,kBAAkB,CAAC,MAAwB,EAAE,OAAe;QACxE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,EAAqB,EAAE,CAAC,CAAC;QAC5I,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,IAAI,QAAQ,GAAgB,IAAI,CAAC;QAClE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;YAAG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,OAAO,CAAC,IAAI;gBAAE,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5E,IAAI,QAAQ;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAuB,EAAE,KAAa;QAC9D,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClK,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,qDAAqD;IAC7C,aAAa,CAAC,QAAkB,EAAE,OAAe,EAAE,KAAa;QACtE,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK;gBAC7G,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACtD,CAAC,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAU,EAAE,CAAC;YAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5H,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAU;QAC7B,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,cAAc,CAAU,EAAE,CAAC;gBAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAE,EAAE,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC;IACO,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,QAAQ,GAA4B,IAAI,CAAC;QAC7C,IAAI,CAAC;YAAC,IAAI,OAAO,CAAC,IAAI;gBAAE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACvH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IACO,OAAO,KAAW,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjI,aAAa;QACnB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACjK,CAAC;IACO,UAAU,CAAC,KAAa;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;eACtE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/H,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IACO,cAAc,CAAC,GAAQ;QAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACrD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACvK,CAAC,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IACO,eAAe;QACrB,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;YACvG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;eAC9E,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IAChI,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { HeimdallBrowserClient } from './client.js';
+export { HeimdallBrowserError } from './types.js';
+export type { HeimdallBrowserOptions, HeimdallIdentity, HeimdallSnapshot, ApplicationLogoutResult } from './types.js';
+export { hasAllPermissions } from './claims.js';
+export { HeimdallProtocolClient } from './protocol.js';
+export { HeimdallProtocolError } from './protocol-types.js';
+export type { HeimdallProtocolOptions, HeimdallTokenSet, HeimdallLoginRequest, HeimdallLoginOptions, HeimdallDeviceAuthorization, HeimdallDeviceTokenResult, HeimdallJwtValidation } from './protocol-types.js';

package/dist/index.js

@@ -0,0 +1,6 @@
+export { HeimdallBrowserClient } from './client.js';
+export { HeimdallBrowserError } from './types.js';
+export { hasAllPermissions } from './claims.js';
+export { HeimdallProtocolClient } from './protocol.js';
+export { HeimdallProtocolError } from './protocol-types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}