@bitgo-beta/sdk-hmac 1.0.1-beta.13 → 1.0.1-beta.1300

package/dist/src/browser.d.ts

@@ -0,0 +1,4 @@
+export * from './index';
+export * from './indexedDbTokenStore';
+export * from './webCryptoStrategy';
+//# sourceMappingURL=browser.d.ts.map

package/dist/src/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC"}

package/dist/src/browser.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./index"), exports);
+__exportStar(require("./indexedDbTokenStore"), exports);
+__exportStar(require("./webCryptoStrategy"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnJvd3Nlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9icm93c2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwwQ0FBd0I7QUFDeEIsd0RBQXNDO0FBQ3RDLHNEQUFvQyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vaW5kZXgnO1xuZXhwb3J0ICogZnJvbSAnLi9pbmRleGVkRGJUb2tlblN0b3JlJztcbmV4cG9ydCAqIGZyb20gJy4vd2ViQ3J5cHRvU3RyYXRlZ3knO1xuIl19

package/dist/src/defaultStrategy.d.ts

@@ -0,0 +1,11 @@
+import type { IHmacAuthStrategy, CalculateRequestHeadersOptions, RequestHeaders, VerifyResponseOptions, VerifyResponseInfo } from './types';
+/**
+ * Default HMAC auth strategy that wraps the existing synchronous Node.js crypto
+ * functions. This is used when no custom strategy is provided to BitGoAPI.
+ */
+export declare class DefaultHmacAuthStrategy implements IHmacAuthStrategy {
+    calculateRequestHeaders(params: CalculateRequestHeadersOptions): Promise<RequestHeaders>;
+    verifyResponse(params: VerifyResponseOptions): Promise<VerifyResponseInfo>;
+    calculateHMAC(key: string, message: string): Promise<string>;
+}
+//# sourceMappingURL=defaultStrategy.d.ts.map

package/dist/src/defaultStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultStrategy.d.ts","sourceRoot":"","sources":["../../src/defaultStrategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,8BAA8B,EAC9B,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,SAAS,CAAC;AAEjB;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IACzD,uBAAuB,CAAC,MAAM,EAAE,8BAA8B,GAAG,OAAO,CAAC,cAAc,CAAC;IAIxF,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI1E,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGnE"}

package/dist/src/defaultStrategy.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultHmacAuthStrategy = void 0;
+const hmac_1 = require("./hmac");
+/**
+ * Default HMAC auth strategy that wraps the existing synchronous Node.js crypto
+ * functions. This is used when no custom strategy is provided to BitGoAPI.
+ */
+class DefaultHmacAuthStrategy {
+    async calculateRequestHeaders(params) {
+        return (0, hmac_1.calculateRequestHeaders)(params);
+    }
+    async verifyResponse(params) {
+        return (0, hmac_1.verifyResponse)(params);
+    }
+    async calculateHMAC(key, message) {
+        return (0, hmac_1.calculateHMAC)(key, message);
+    }
+}
+exports.DefaultHmacAuthStrategy = DefaultHmacAuthStrategy;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVmYXVsdFN0cmF0ZWd5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2RlZmF1bHRTdHJhdGVneS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxpQ0FBZ0Y7QUFTaEY7OztHQUdHO0FBQ0gsTUFBYSx1QkFBdUI7SUFDbEMsS0FBSyxDQUFDLHVCQUF1QixDQUFDLE1BQXNDO1FBQ2xFLE9BQU8sSUFBQSw4QkFBdUIsRUFBQyxNQUFNLENBQUMsQ0FBQztJQUN6QyxDQUFDO0lBRUQsS0FBSyxDQUFDLGNBQWMsQ0FBQyxNQUE2QjtRQUNoRCxPQUFPLElBQUEscUJBQWMsRUFBQyxNQUFNLENBQUMsQ0FBQztJQUNoQyxDQUFDO0lBRUQsS0FBSyxDQUFDLGFBQWEsQ0FBQyxHQUFXLEVBQUUsT0FBZTtRQUM5QyxPQUFPLElBQUEsb0JBQWEsRUFBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDckMsQ0FBQztDQUNGO0FBWkQsMERBWUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBjYWxjdWxhdGVSZXF1ZXN0SGVhZGVycywgY2FsY3VsYXRlSE1BQywgdmVyaWZ5UmVzcG9uc2UgfSBmcm9tICcuL2htYWMnO1xuaW1wb3J0IHR5cGUge1xuICBJSG1hY0F1dGhTdHJhdGVneSxcbiAgQ2FsY3VsYXRlUmVxdWVzdEhlYWRlcnNPcHRpb25zLFxuICBSZXF1ZXN0SGVhZGVycyxcbiAgVmVyaWZ5UmVzcG9uc2VPcHRpb25zLFxuICBWZXJpZnlSZXNwb25zZUluZm8sXG59IGZyb20gJy4vdHlwZXMnO1xuXG4vKipcbiAqIERlZmF1bHQgSE1BQyBhdXRoIHN0cmF0ZWd5IHRoYXQgd3JhcHMgdGhlIGV4aXN0aW5nIHN5bmNocm9ub3VzIE5vZGUuanMgY3J5cHRvXG4gKiBmdW5jdGlvbnMuIFRoaXMgaXMgdXNlZCB3aGVuIG5vIGN1c3RvbSBzdHJhdGVneSBpcyBwcm92aWRlZCB0byBCaXRHb0FQSS5cbiAqL1xuZXhwb3J0IGNsYXNzIERlZmF1bHRIbWFjQXV0aFN0cmF0ZWd5IGltcGxlbWVudHMgSUhtYWNBdXRoU3RyYXRlZ3kge1xuICBhc3luYyBjYWxjdWxhdGVSZXF1ZXN0SGVhZGVycyhwYXJhbXM6IENhbGN1bGF0ZVJlcXVlc3RIZWFkZXJzT3B0aW9ucyk6IFByb21pc2U8UmVxdWVzdEhlYWRlcnM+IHtcbiAgICByZXR1cm4gY2FsY3VsYXRlUmVxdWVzdEhlYWRlcnMocGFyYW1zKTtcbiAgfVxuXG4gIGFzeW5jIHZlcmlmeVJlc3BvbnNlKHBhcmFtczogVmVyaWZ5UmVzcG9uc2VPcHRpb25zKTogUHJvbWlzZTxWZXJpZnlSZXNwb25zZUluZm8+IHtcbiAgICByZXR1cm4gdmVyaWZ5UmVzcG9uc2UocGFyYW1zKTtcbiAgfVxuXG4gIGFzeW5jIGNhbGN1bGF0ZUhNQUMoa2V5OiBzdHJpbmcsIG1lc3NhZ2U6IHN0cmluZyk6IFByb21pc2U8c3RyaW5nPiB7XG4gICAgcmV0dXJuIGNhbGN1bGF0ZUhNQUMoa2V5LCBtZXNzYWdlKTtcbiAgfVxufVxuIl19

package/dist/src/hmac.d.ts

@@ -1,3 +1,4 @@
+import { type BinaryLike, type KeyObject } from 'crypto';
 import { CalculateHmacSubjectOptions, CalculateRequestHeadersOptions, CalculateRequestHmacOptions, RequestHeaders, VerifyResponseInfo, VerifyResponseOptions } from './types';
 /**
  * Calculate the HMAC for the given key and message
@@ -5,7 +6,7 @@ import { CalculateHmacSubjectOptions, CalculateRequestHeadersOptions, CalculateR
  * @param message {String} - the actual message to HMAC
  * @returns {*} - the result of the HMAC operation
  */
-export declare function calculateHMAC(key: string, message: string): string;
+export declare function calculateHMAC(key: string | BinaryLike | KeyObject, message: string | BinaryLike): string;
 /**
  * Calculate the subject string that is to be HMAC'ed for a HTTP request or response
  * @param urlPath request url, including query params
@@ -13,19 +14,21 @@ export declare function calculateHMAC(key: string, message: string): string;
  * @param timestamp request timestamp from `Date.now()`
  * @param statusCode Only set for HTTP responses, leave blank for requests
  * @param method request method
- * @returns {string}
+ * @param authVersion authentication version (2 or 3)
+ * @param useOriginalPath whether to use the original urlPath without parsing (default false)
+ * @returns {string | Buffer}
  */
-export declare function calculateHMACSubject({ urlPath, text, timestamp, statusCode, method, authVersion, }: CalculateHmacSubjectOptions): string;
+export declare function calculateHMACSubject<T extends string | Buffer = string>({ urlPath, text, timestamp, statusCode, method, authVersion }: CalculateHmacSubjectOptions<T>, useOriginalPath?: boolean): T;
 /**
  * Calculate the HMAC for an HTTP request
  */
-export declare function calculateRequestHMAC({ url: urlPath, text, timestamp, token, method, authVersion, }: CalculateRequestHmacOptions): string;
+export declare function calculateRequestHMAC<T extends string | Buffer = string>({ url: urlPath, text, timestamp, token, method, authVersion }: CalculateRequestHmacOptions<T>, useOriginalPath?: boolean): string;
 /**
  * Calculate request headers with HMAC
  */
-export declare function calculateRequestHeaders({ url, text, token, method, authVersion, }: CalculateRequestHeadersOptions): RequestHeaders;
+export declare function calculateRequestHeaders<T extends string | Buffer = string>({ url, text, token, method, authVersion }: CalculateRequestHeadersOptions<T>, useOriginalPath?: boolean): RequestHeaders;
 /**
  * Verify the HMAC for an HTTP response
  */
-export declare function verifyResponse({ url: urlPath, statusCode, text, timestamp, token, hmac, method, authVersion, }: VerifyResponseOptions): VerifyResponseInfo;
+export declare function verifyResponse<T extends string | Buffer = string>({ url: urlPath, statusCode, text, timestamp, token, hmac, method, authVersion }: VerifyResponseOptions<T>, useOriginalPath?: boolean): VerifyResponseInfo<T>;
 //# sourceMappingURL=hmac.d.ts.map

package/dist/src/hmac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../../src/hmac.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAEjB;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,UAAU,EACV,MAAM,EACN,WAAW,GACZ,EAAE,2BAA2B,GAAG,MAAM,CAatC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,GAAG,EAAE,OAAO,EACZ,IAAI,EACJ,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE,2BAA2B,GAAG,MAAM,CAKtC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,GAAG,EACH,IAAI,EACJ,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE,8BAA8B,GAAG,cAAc,CAYjD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,EAC7B,GAAG,EAAE,OAAO,EACZ,UAAU,EACV,IAAI,EACJ,SAAS,EACT,KAAK,EACL,IAAI,EACJ,MAAM,EACN,WAAW,GACZ,EAAE,qBAAqB,GAAG,kBAAkB,CAyB5C"}
+{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../../src/hmac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGzD,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAGjB;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAExG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,EACrE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC,EAC7F,eAAe,UAAQ,GACtB,CAAC,CA8BH;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,EACrE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC,EAC7F,eAAe,UAAQ,GACtB,MAAM,CAKR;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,EACxE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC,EAC5E,eAAe,UAAQ,GACtB,cAAc,CAYhB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,EAC/D,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACzG,eAAe,UAAQ,GACtB,kBAAkB,CAAC,CAAC,CAAC,CA+BvB"}

package/dist/src/hmac.js

@@ -38,9 +38,9 @@ exports.calculateHMACSubject = calculateHMACSubject;
 exports.calculateRequestHMAC = calculateRequestHMAC;
 exports.calculateRequestHeaders = calculateRequestHeaders;
 exports.verifyResponse = verifyResponse;
-const crypto_1 = require("crypto");
 const urlLib = __importStar(require("url"));
 const sjcl = __importStar(require("@bitgo-beta/sjcl"));
+const util_1 = require("./util");
 /**
  * Calculate the HMAC for the given key and message
  * @param key {String} - the key to use for the HMAC
@@ -48,7 +48,7 @@ const sjcl = __importStar(require("@bitgo-beta/sjcl"));
  * @returns {*} - the result of the HMAC operation
  */
 function calculateHMAC(key, message) {
-    return (0, crypto_1.createHmac)('sha256', key).update(message).digest('hex');
+    return (0, util_1.createHmacWithSha256)(key, message);
 }
 /**
  * Calculate the subject string that is to be HMAC'ed for a HTTP request or response
@@ -57,36 +57,53 @@ function calculateHMAC(key, message) {
  * @param timestamp request timestamp from `Date.now()`
  * @param statusCode Only set for HTTP responses, leave blank for requests
  * @param method request method
- * @returns {string}
+ * @param authVersion authentication version (2 or 3)
+ * @param useOriginalPath whether to use the original urlPath without parsing (default false)
+ * @returns {string | Buffer}
  */
-function calculateHMACSubject({ urlPath, text, timestamp, statusCode, method, authVersion, }) {
-    const urlDetails = urlLib.parse(urlPath);
-    const queryPath = urlDetails.query && urlDetails.query.length > 0 ? urlDetails.path : urlDetails.pathname;
+function calculateHMACSubject({ urlPath, text, timestamp, statusCode, method, authVersion }, useOriginalPath = false) {
+    /* Normalize legacy 'del' to 'delete' for backward compatibility */
+    if (method === 'del') {
+        method = 'delete';
+    }
+    let queryPath = urlPath;
+    if (!useOriginalPath) {
+        const urlDetails = urlLib.parse(urlPath);
+        queryPath = urlDetails.query && urlDetails.query.length > 0 ? urlDetails.path : urlDetails.pathname;
+    }
+    let prefixedText;
     if (statusCode !== undefined && isFinite(statusCode) && Number.isInteger(statusCode)) {
-        if (authVersion === 3) {
-            return [method.toUpperCase(), timestamp, queryPath, statusCode, text].join('|');
-        }
-        return [timestamp, queryPath, statusCode, text].join('|');
+        prefixedText =
+            authVersion === 3
+                ? [method.toUpperCase(), timestamp, queryPath, statusCode].join('|')
+                : [timestamp, queryPath, statusCode].join('|');
+    }
+    else {
+        prefixedText =
+            authVersion === 3
+                ? [method.toUpperCase(), timestamp, '3.0', queryPath].join('|')
+                : [timestamp, queryPath].join('|');
     }
-    if (authVersion === 3) {
-        return [method.toUpperCase(), timestamp, '3.0', queryPath, text].join('|');
+    const isBuffer = Buffer.isBuffer(text);
+    if (isBuffer) {
+        return Buffer.concat([Buffer.from(prefixedText + '|', 'utf-8'), text]);
     }
-    return [timestamp, queryPath, text].join('|');
+    return [prefixedText, text].join('|');
 }
 /**
  * Calculate the HMAC for an HTTP request
  */
-function calculateRequestHMAC({ url: urlPath, text, timestamp, token, method, authVersion, }) {
-    const signatureSubject = calculateHMACSubject({ urlPath, text, timestamp, method, authVersion });
+function calculateRequestHMAC({ url: urlPath, text, timestamp, token, method, authVersion }, useOriginalPath = false) {
+    const signatureSubject = calculateHMACSubject({ urlPath, text, timestamp, method, authVersion }, useOriginalPath);
     // calculate the HMAC
     return calculateHMAC(token, signatureSubject);
 }
 /**
  * Calculate request headers with HMAC
  */
-function calculateRequestHeaders({ url, text, token, method, authVersion, }) {
+function calculateRequestHeaders({ url, text, token, method, authVersion }, useOriginalPath = false) {
     const timestamp = Date.now();
-    const hmac = calculateRequestHMAC({ url, text, timestamp, token, method, authVersion });
+    const hmac = calculateRequestHMAC({ url, text, timestamp, token, method, authVersion }, useOriginalPath);
     // calculate the SHA256 hash of the token
     const hashDigest = sjcl.hash.sha256.hash(token);
     const tokenHash = sjcl.codec.hex.fromBits(hashDigest);
@@ -99,7 +116,7 @@ function calculateRequestHeaders({ url, text, token, method, authVersion, }) {
 /**
  * Verify the HMAC for an HTTP response
  */
-function verifyResponse({ url: urlPath, statusCode, text, timestamp, token, hmac, method, authVersion, }) {
+function verifyResponse({ url: urlPath, statusCode, text, timestamp, token, hmac, method, authVersion }, useOriginalPath = false) {
     const signatureSubject = calculateHMACSubject({
         urlPath,
         text,
@@ -107,12 +124,14 @@ function verifyResponse({ url: urlPath, statusCode, text, timestamp, token, hmac
         statusCode,
         method,
         authVersion,
-    });
+    }, useOriginalPath);
     // calculate the HMAC
     const expectedHmac = calculateHMAC(token, signatureSubject);
-    // determine if the response is still within the validity window (5 minute window)
+    // determine if the response is still within the validity window (5-minute backwards window, 1-minute forward window)
     const now = Date.now();
-    const isInResponseValidityWindow = timestamp >= now - 1000 * 60 * 5 && timestamp <= now;
+    const backwardValidityWindow = 1000 * 60 * 5;
+    const forwardValidityWindow = 1000 * 60;
+    const isInResponseValidityWindow = timestamp >= now - backwardValidityWindow && timestamp <= now + forwardValidityWindow;
     // verify the HMAC and timestamp
     return {
         isValid: expectedHmac === hmac,
@@ -122,4 +141,4 @@ function verifyResponse({ url: urlPath, statusCode, text, timestamp, token, hmac
         verificationTime: now,
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG1hYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9obWFjLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBa0JBLHNDQUVDO0FBV0Qsb0RBb0JDO0FBS0Qsb0RBWUM7QUFLRCwwREFrQkM7QUFLRCx3Q0FrQ0M7QUFsSUQsbUNBQW9DO0FBQ3BDLDRDQUE4QjtBQUM5Qix1REFBeUM7QUFVekM7Ozs7O0dBS0c7QUFDSCxTQUFnQixhQUFhLENBQUMsR0FBVyxFQUFFLE9BQWU7SUFDeEQsT0FBTyxJQUFBLG1CQUFVLEVBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDakUsQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBZ0Isb0JBQW9CLENBQUMsRUFDbkMsT0FBTyxFQUNQLElBQUksRUFDSixTQUFTLEVBQ1QsVUFBVSxFQUNWLE1BQU0sRUFDTixXQUFXLEdBQ2lCO0lBQzVCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDekMsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLEtBQUssSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7SUFDMUcsSUFBSSxVQUFVLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDckYsSUFBSSxXQUFXLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEIsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUNELElBQUksV0FBVyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFDRCxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDaEQsQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBZ0Isb0JBQW9CLENBQUMsRUFDbkMsR0FBRyxFQUFFLE9BQU8sRUFDWixJQUFJLEVBQ0osU0FBUyxFQUNULEtBQUssRUFDTCxNQUFNLEVBQ04sV0FBVyxHQUNpQjtJQUM1QixNQUFNLGdCQUFnQixHQUFHLG9CQUFvQixDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFFakcscUJBQXFCO0lBQ3JCLE9BQU8sYUFBYSxDQUFDLEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0FBQ2hELENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLHVCQUF1QixDQUFDLEVBQ3RDLEdBQUcsRUFDSCxJQUFJLEVBQ0osS0FBSyxFQUNMLE1BQU0sRUFDTixXQUFXLEdBQ29CO0lBQy9CLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUM3QixNQUFNLElBQUksR0FBRyxvQkFBb0IsQ0FBQyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUV4Rix5Q0FBeUM7SUFDekMsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2hELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN0RCxPQUFPO1FBQ0wsSUFBSTtRQUNKLFNBQVM7UUFDVCxTQUFTO0tBQ1YsQ0FBQztBQUNKLENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLGNBQWMsQ0FBQyxFQUM3QixHQUFHLEVBQUUsT0FBTyxFQUNaLFVBQVUsRUFDVixJQUFJLEVBQ0osU0FBUyxFQUNULEtBQUssRUFDTCxJQUFJLEVBQ0osTUFBTSxFQUNOLFdBQVcsR0FDVztJQUN0QixNQUFNLGdCQUFnQixHQUFHLG9CQUFvQixDQUFDO1FBQzVDLE9BQU87UUFDUCxJQUFJO1FBQ0osU0FBUztRQUNULFVBQVU7UUFDVixNQUFNO1FBQ04sV0FBVztLQUNaLENBQUMsQ0FBQztJQUVILHFCQUFxQjtJQUNyQixNQUFNLFlBQVksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLGdCQUFnQixDQUFDLENBQUM7SUFFNUQsa0ZBQWtGO0lBQ2xGLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUN2QixNQUFNLDBCQUEwQixHQUFHLFNBQVMsSUFBSSxHQUFHLEdBQUcsSUFBSSxHQUFHLEVBQUUsR0FBRyxDQUFDLElBQUksU0FBUyxJQUFJLEdBQUcsQ0FBQztJQUV4RixnQ0FBZ0M7SUFDaEMsT0FBTztRQUNMLE9BQU8sRUFBRSxZQUFZLEtBQUssSUFBSTtRQUM5QixZQUFZO1FBQ1osZ0JBQWdCO1FBQ2hCLDBCQUEwQjtRQUMxQixnQkFBZ0IsRUFBRSxHQUFHO0tBQ3RCLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgY3JlYXRlSG1hYyB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgKiBhcyB1cmxMaWIgZnJvbSAndXJsJztcbmltcG9ydCAqIGFzIHNqY2wgZnJvbSAnQGJpdGdvLWJldGEvc2pjbCc7XG5pbXBvcnQge1xuICBDYWxjdWxhdGVIbWFjU3ViamVjdE9wdGlvbnMsXG4gIENhbGN1bGF0ZVJlcXVlc3RIZWFkZXJzT3B0aW9ucyxcbiAgQ2FsY3VsYXRlUmVxdWVzdEhtYWNPcHRpb25zLFxuICBSZXF1ZXN0SGVhZGVycyxcbiAgVmVyaWZ5UmVzcG9uc2VJbmZvLFxuICBWZXJpZnlSZXNwb25zZU9wdGlvbnMsXG59IGZyb20gJy4vdHlwZXMnO1xuXG4vKipcbiAqIENhbGN1bGF0ZSB0aGUgSE1BQyBmb3IgdGhlIGdpdmVuIGtleSBhbmQgbWVzc2FnZVxuICogQHBhcmFtIGtleSB7U3RyaW5nfSAtIHRoZSBrZXkgdG8gdXNlIGZvciB0aGUgSE1BQ1xuICogQHBhcmFtIG1lc3NhZ2Uge1N0cmluZ30gLSB0aGUgYWN0dWFsIG1lc3NhZ2UgdG8gSE1BQ1xuICogQHJldHVybnMgeyp9IC0gdGhlIHJlc3VsdCBvZiB0aGUgSE1BQyBvcGVyYXRpb25cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNhbGN1bGF0ZUhNQUMoa2V5OiBzdHJpbmcsIG1lc3NhZ2U6IHN0cmluZyk6IHN0cmluZyB7XG4gIHJldHVybiBjcmVhdGVIbWFjKCdzaGEyNTYnLCBrZXkpLnVwZGF0ZShtZXNzYWdlKS5kaWdlc3QoJ2hleCcpO1xufVxuXG4vKipcbiAqIENhbGN1bGF0ZSB0aGUgc3ViamVjdCBzdHJpbmcgdGhhdCBpcyB0byBiZSBITUFDJ2VkIGZvciBhIEhUVFAgcmVxdWVzdCBvciByZXNwb25zZVxuICogQHBhcmFtIHVybFBhdGggcmVxdWVzdCB1cmwsIGluY2x1ZGluZyBxdWVyeSBwYXJhbXNcbiAqIEBwYXJhbSB0ZXh0IHJlcXVlc3QgYm9keSB0ZXh0XG4gKiBAcGFyYW0gdGltZXN0YW1wIHJlcXVlc3QgdGltZXN0YW1wIGZyb20gYERhdGUubm93KClgXG4gKiBAcGFyYW0gc3RhdHVzQ29kZSBPbmx5IHNldCBmb3IgSFRUUCByZXNwb25zZXMsIGxlYXZlIGJsYW5rIGZvciByZXF1ZXN0c1xuICogQHBhcmFtIG1ldGhvZCByZXF1ZXN0IG1ldGhvZFxuICogQHJldHVybnMge3N0cmluZ31cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNhbGN1bGF0ZUhNQUNTdWJqZWN0KHtcbiAgdXJsUGF0aCxcbiAgdGV4dCxcbiAgdGltZXN0YW1wLFxuICBzdGF0dXNDb2RlLFxuICBtZXRob2QsXG4gIGF1dGhWZXJzaW9uLFxufTogQ2FsY3VsYXRlSG1hY1N1YmplY3RPcHRpb25zKTogc3RyaW5nIHtcbiAgY29uc3QgdXJsRGV0YWlscyA9IHVybExpYi5wYXJzZSh1cmxQYXRoKTtcbiAgY29uc3QgcXVlcnlQYXRoID0gdXJsRGV0YWlscy5xdWVyeSAmJiB1cmxEZXRhaWxzLnF1ZXJ5Lmxlbmd0aCA+IDAgPyB1cmxEZXRhaWxzLnBhdGggOiB1cmxEZXRhaWxzLnBhdGhuYW1lO1xuICBpZiAoc3RhdHVzQ29kZSAhPT0gdW5kZWZpbmVkICYmIGlzRmluaXRlKHN0YXR1c0NvZGUpICYmIE51bWJlci5pc0ludGVnZXIoc3RhdHVzQ29kZSkpIHtcbiAgICBpZiAoYXV0aFZlcnNpb24gPT09IDMpIHtcbiAgICAgIHJldHVybiBbbWV0aG9kLnRvVXBwZXJDYXNlKCksIHRpbWVzdGFtcCwgcXVlcnlQYXRoLCBzdGF0dXNDb2RlLCB0ZXh0XS5qb2luKCd8Jyk7XG4gICAgfVxuICAgIHJldHVybiBbdGltZXN0YW1wLCBxdWVyeVBhdGgsIHN0YXR1c0NvZGUsIHRleHRdLmpvaW4oJ3wnKTtcbiAgfVxuICBpZiAoYXV0aFZlcnNpb24gPT09IDMpIHtcbiAgICByZXR1cm4gW21ldGhvZC50b1VwcGVyQ2FzZSgpLCB0aW1lc3RhbXAsICczLjAnLCBxdWVyeVBhdGgsIHRleHRdLmpvaW4oJ3wnKTtcbiAgfVxuICByZXR1cm4gW3RpbWVzdGFtcCwgcXVlcnlQYXRoLCB0ZXh0XS5qb2luKCd8Jyk7XG59XG5cbi8qKlxuICogQ2FsY3VsYXRlIHRoZSBITUFDIGZvciBhbiBIVFRQIHJlcXVlc3RcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNhbGN1bGF0ZVJlcXVlc3RITUFDKHtcbiAgdXJsOiB1cmxQYXRoLFxuICB0ZXh0LFxuICB0aW1lc3RhbXAsXG4gIHRva2VuLFxuICBtZXRob2QsXG4gIGF1dGhWZXJzaW9uLFxufTogQ2FsY3VsYXRlUmVxdWVzdEhtYWNPcHRpb25zKTogc3RyaW5nIHtcbiAgY29uc3Qgc2lnbmF0dXJlU3ViamVjdCA9IGNhbGN1bGF0ZUhNQUNTdWJqZWN0KHsgdXJsUGF0aCwgdGV4dCwgdGltZXN0YW1wLCBtZXRob2QsIGF1dGhWZXJzaW9uIH0pO1xuXG4gIC8vIGNhbGN1bGF0ZSB0aGUgSE1BQ1xuICByZXR1cm4gY2FsY3VsYXRlSE1BQyh0b2tlbiwgc2lnbmF0dXJlU3ViamVjdCk7XG59XG5cbi8qKlxuICogQ2FsY3VsYXRlIHJlcXVlc3QgaGVhZGVycyB3aXRoIEhNQUNcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNhbGN1bGF0ZVJlcXVlc3RIZWFkZXJzKHtcbiAgdXJsLFxuICB0ZXh0LFxuICB0b2tlbixcbiAgbWV0aG9kLFxuICBhdXRoVmVyc2lvbixcbn06IENhbGN1bGF0ZVJlcXVlc3RIZWFkZXJzT3B0aW9ucyk6IFJlcXVlc3RIZWFkZXJzIHtcbiAgY29uc3QgdGltZXN0YW1wID0gRGF0ZS5ub3coKTtcbiAgY29uc3QgaG1hYyA9IGNhbGN1bGF0ZVJlcXVlc3RITUFDKHsgdXJsLCB0ZXh0LCB0aW1lc3RhbXAsIHRva2VuLCBtZXRob2QsIGF1dGhWZXJzaW9uIH0pO1xuXG4gIC8vIGNhbGN1bGF0ZSB0aGUgU0hBMjU2IGhhc2ggb2YgdGhlIHRva2VuXG4gIGNvbnN0IGhhc2hEaWdlc3QgPSBzamNsLmhhc2guc2hhMjU2Lmhhc2godG9rZW4pO1xuICBjb25zdCB0b2tlbkhhc2ggPSBzamNsLmNvZGVjLmhleC5mcm9tQml0cyhoYXNoRGlnZXN0KTtcbiAgcmV0dXJuIHtcbiAgICBobWFjLFxuICAgIHRpbWVzdGFtcCxcbiAgICB0b2tlbkhhc2gsXG4gIH07XG59XG5cbi8qKlxuICogVmVyaWZ5IHRoZSBITUFDIGZvciBhbiBIVFRQIHJlc3BvbnNlXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiB2ZXJpZnlSZXNwb25zZSh7XG4gIHVybDogdXJsUGF0aCxcbiAgc3RhdHVzQ29kZSxcbiAgdGV4dCxcbiAgdGltZXN0YW1wLFxuICB0b2tlbixcbiAgaG1hYyxcbiAgbWV0aG9kLFxuICBhdXRoVmVyc2lvbixcbn06IFZlcmlmeVJlc3BvbnNlT3B0aW9ucyk6IFZlcmlmeVJlc3BvbnNlSW5mbyB7XG4gIGNvbnN0IHNpZ25hdHVyZVN1YmplY3QgPSBjYWxjdWxhdGVITUFDU3ViamVjdCh7XG4gICAgdXJsUGF0aCxcbiAgICB0ZXh0LFxuICAgIHRpbWVzdGFtcCxcbiAgICBzdGF0dXNDb2RlLFxuICAgIG1ldGhvZCxcbiAgICBhdXRoVmVyc2lvbixcbiAgfSk7XG5cbiAgLy8gY2FsY3VsYXRlIHRoZSBITUFDXG4gIGNvbnN0IGV4cGVjdGVkSG1hYyA9IGNhbGN1bGF0ZUhNQUModG9rZW4sIHNpZ25hdHVyZVN1YmplY3QpO1xuXG4gIC8vIGRldGVybWluZSBpZiB0aGUgcmVzcG9uc2UgaXMgc3RpbGwgd2l0aGluIHRoZSB2YWxpZGl0eSB3aW5kb3cgKDUgbWludXRlIHdpbmRvdylcbiAgY29uc3Qgbm93ID0gRGF0ZS5ub3coKTtcbiAgY29uc3QgaXNJblJlc3BvbnNlVmFsaWRpdHlXaW5kb3cgPSB0aW1lc3RhbXAgPj0gbm93IC0gMTAwMCAqIDYwICogNSAmJiB0aW1lc3RhbXAgPD0gbm93O1xuXG4gIC8vIHZlcmlmeSB0aGUgSE1BQyBhbmQgdGltZXN0YW1wXG4gIHJldHVybiB7XG4gICAgaXNWYWxpZDogZXhwZWN0ZWRIbWFjID09PSBobWFjLFxuICAgIGV4cGVjdGVkSG1hYyxcbiAgICBzaWduYXR1cmVTdWJqZWN0LFxuICAgIGlzSW5SZXNwb25zZVZhbGlkaXR5V2luZG93LFxuICAgIHZlcmlmaWNhdGlvblRpbWU6IG5vdyxcbiAgfTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG1hYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9obWFjLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBbUJBLHNDQUVDO0FBYUQsb0RBaUNDO0FBS0Qsb0RBUUM7QUFLRCwwREFlQztBQUtELHdDQWtDQztBQTFJRCw0Q0FBOEI7QUFDOUIsdURBQXlDO0FBU3pDLGlDQUE4QztBQUU5Qzs7Ozs7R0FLRztBQUNILFNBQWdCLGFBQWEsQ0FBQyxHQUFvQyxFQUFFLE9BQTRCO0lBQzlGLE9BQU8sSUFBQSwyQkFBb0IsRUFBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDNUMsQ0FBQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxTQUFnQixvQkFBb0IsQ0FDbEMsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBa0MsRUFDN0YsZUFBZSxHQUFHLEtBQUs7SUFFdkIsbUVBQW1FO0lBQ25FLElBQUksTUFBTSxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ3JCLE1BQU0sR0FBRyxRQUFRLENBQUM7SUFDcEIsQ0FBQztJQUVELElBQUksU0FBUyxHQUFrQixPQUFPLENBQUM7SUFDdkMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDekMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxLQUFLLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO0lBQ3RHLENBQUM7SUFFRCxJQUFJLFlBQW9CLENBQUM7SUFDekIsSUFBSSxVQUFVLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDckYsWUFBWTtZQUNWLFdBQVcsS0FBSyxDQUFDO2dCQUNmLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7Z0JBQ3BFLENBQUMsQ0FBQyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3JELENBQUM7U0FBTSxDQUFDO1FBQ04sWUFBWTtZQUNWLFdBQVcsS0FBSyxDQUFDO2dCQUNmLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLFNBQVMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7Z0JBQy9ELENBQUMsQ0FBQyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdkMsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUNiLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsWUFBWSxHQUFHLEdBQUcsRUFBRSxPQUFPLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBTSxDQUFDO0lBQzlFLENBQUM7SUFDRCxPQUFPLENBQUMsWUFBWSxFQUFFLElBQUksQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQU0sQ0FBQztBQUM3QyxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxTQUFnQixvQkFBb0IsQ0FDbEMsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQWtDLEVBQzdGLGVBQWUsR0FBRyxLQUFLO0lBRXZCLE1BQU0sZ0JBQWdCLEdBQUcsb0JBQW9CLENBQUMsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFFbEgscUJBQXFCO0lBQ3JCLE9BQU8sYUFBYSxDQUFDLEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0FBQ2hELENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLHVCQUF1QixDQUNyQyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQXFDLEVBQzVFLGVBQWUsR0FBRyxLQUFLO0lBRXZCLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUM3QixNQUFNLElBQUksR0FBRyxvQkFBb0IsQ0FBQyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFFekcseUNBQXlDO0lBQ3pDLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNoRCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDdEQsT0FBTztRQUNMLElBQUk7UUFDSixTQUFTO1FBQ1QsU0FBUztLQUNWLENBQUM7QUFDSixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxTQUFnQixjQUFjLENBQzVCLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQTRCLEVBQ3pHLGVBQWUsR0FBRyxLQUFLO0lBRXZCLE1BQU0sZ0JBQWdCLEdBQUcsb0JBQW9CLENBQzNDO1FBQ0UsT0FBTztRQUNQLElBQUk7UUFDSixTQUFTO1FBQ1QsVUFBVTtRQUNWLE1BQU07UUFDTixXQUFXO0tBQ1osRUFDRCxlQUFlLENBQ2hCLENBQUM7SUFFRixxQkFBcUI7SUFDckIsTUFBTSxZQUFZLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0lBRTVELHFIQUFxSDtJQUNySCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7SUFDdkIsTUFBTSxzQkFBc0IsR0FBRyxJQUFJLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQztJQUM3QyxNQUFNLHFCQUFxQixHQUFHLElBQUksR0FBRyxFQUFFLENBQUM7SUFDeEMsTUFBTSwwQkFBMEIsR0FDOUIsU0FBUyxJQUFJLEdBQUcsR0FBRyxzQkFBc0IsSUFBSSxTQUFTLElBQUksR0FBRyxHQUFHLHFCQUFxQixDQUFDO0lBRXhGLGdDQUFnQztJQUNoQyxPQUFPO1FBQ0wsT0FBTyxFQUFFLFlBQVksS0FBSyxJQUFJO1FBQzlCLFlBQVk7UUFDWixnQkFBZ0I7UUFDaEIsMEJBQTBCO1FBQzFCLGdCQUFnQixFQUFFLEdBQUc7S0FDdEIsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyB0eXBlIEJpbmFyeUxpa2UsIHR5cGUgS2V5T2JqZWN0IH0gZnJvbSAnY3J5cHRvJztcbmltcG9ydCAqIGFzIHVybExpYiBmcm9tICd1cmwnO1xuaW1wb3J0ICogYXMgc2pjbCBmcm9tICdAYml0Z28tYmV0YS9zamNsJztcbmltcG9ydCB7XG4gIENhbGN1bGF0ZUhtYWNTdWJqZWN0T3B0aW9ucyxcbiAgQ2FsY3VsYXRlUmVxdWVzdEhlYWRlcnNPcHRpb25zLFxuICBDYWxjdWxhdGVSZXF1ZXN0SG1hY09wdGlvbnMsXG4gIFJlcXVlc3RIZWFkZXJzLFxuICBWZXJpZnlSZXNwb25zZUluZm8sXG4gIFZlcmlmeVJlc3BvbnNlT3B0aW9ucyxcbn0gZnJvbSAnLi90eXBlcyc7XG5pbXBvcnQgeyBjcmVhdGVIbWFjV2l0aFNoYTI1NiB9IGZyb20gJy4vdXRpbCc7XG5cbi8qKlxuICogQ2FsY3VsYXRlIHRoZSBITUFDIGZvciB0aGUgZ2l2ZW4ga2V5IGFuZCBtZXNzYWdlXG4gKiBAcGFyYW0ga2V5IHtTdHJpbmd9IC0gdGhlIGtleSB0byB1c2UgZm9yIHRoZSBITUFDXG4gKiBAcGFyYW0gbWVzc2FnZSB7U3RyaW5nfSAtIHRoZSBhY3R1YWwgbWVzc2FnZSB0byBITUFDXG4gKiBAcmV0dXJucyB7Kn0gLSB0aGUgcmVzdWx0IG9mIHRoZSBITUFDIG9wZXJhdGlvblxuICovXG5leHBvcnQgZnVuY3Rpb24gY2FsY3VsYXRlSE1BQyhrZXk6IHN0cmluZyB8IEJpbmFyeUxpa2UgfCBLZXlPYmplY3QsIG1lc3NhZ2U6IHN0cmluZyB8IEJpbmFyeUxpa2UpOiBzdHJpbmcge1xuICByZXR1cm4gY3JlYXRlSG1hY1dpdGhTaGEyNTYoa2V5LCBtZXNzYWdlKTtcbn1cblxuLyoqXG4gKiBDYWxjdWxhdGUgdGhlIHN1YmplY3Qgc3RyaW5nIHRoYXQgaXMgdG8gYmUgSE1BQydlZCBmb3IgYSBIVFRQIHJlcXVlc3Qgb3IgcmVzcG9uc2VcbiAqIEBwYXJhbSB1cmxQYXRoIHJlcXVlc3QgdXJsLCBpbmNsdWRpbmcgcXVlcnkgcGFyYW1zXG4gKiBAcGFyYW0gdGV4dCByZXF1ZXN0IGJvZHkgdGV4dFxuICogQHBhcmFtIHRpbWVzdGFtcCByZXF1ZXN0IHRpbWVzdGFtcCBmcm9tIGBEYXRlLm5vdygpYFxuICogQHBhcmFtIHN0YXR1c0NvZGUgT25seSBzZXQgZm9yIEhUVFAgcmVzcG9uc2VzLCBsZWF2ZSBibGFuayBmb3IgcmVxdWVzdHNcbiAqIEBwYXJhbSBtZXRob2QgcmVxdWVzdCBtZXRob2RcbiAqIEBwYXJhbSBhdXRoVmVyc2lvbiBhdXRoZW50aWNhdGlvbiB2ZXJzaW9uICgyIG9yIDMpXG4gKiBAcGFyYW0gdXNlT3JpZ2luYWxQYXRoIHdoZXRoZXIgdG8gdXNlIHRoZSBvcmlnaW5hbCB1cmxQYXRoIHdpdGhvdXQgcGFyc2luZyAoZGVmYXVsdCBmYWxzZSlcbiAqIEByZXR1cm5zIHtzdHJpbmcgfCBCdWZmZXJ9XG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjYWxjdWxhdGVITUFDU3ViamVjdDxUIGV4dGVuZHMgc3RyaW5nIHwgQnVmZmVyID0gc3RyaW5nPihcbiAgeyB1cmxQYXRoLCB0ZXh0LCB0aW1lc3RhbXAsIHN0YXR1c0NvZGUsIG1ldGhvZCwgYXV0aFZlcnNpb24gfTogQ2FsY3VsYXRlSG1hY1N1YmplY3RPcHRpb25zPFQ+LFxuICB1c2VPcmlnaW5hbFBhdGggPSBmYWxzZVxuKTogVCB7XG4gIC8qIE5vcm1hbGl6ZSBsZWdhY3kgJ2RlbCcgdG8gJ2RlbGV0ZScgZm9yIGJhY2t3YXJkIGNvbXBhdGliaWxpdHkgKi9cbiAgaWYgKG1ldGhvZCA9PT0gJ2RlbCcpIHtcbiAgICBtZXRob2QgPSAnZGVsZXRlJztcbiAgfVxuXG4gIGxldCBxdWVyeVBhdGg6IHN0cmluZyB8IG51bGwgPSB1cmxQYXRoO1xuICBpZiAoIXVzZU9yaWdpbmFsUGF0aCkge1xuICAgIGNvbnN0IHVybERldGFpbHMgPSB1cmxMaWIucGFyc2UodXJsUGF0aCk7XG4gICAgcXVlcnlQYXRoID0gdXJsRGV0YWlscy5xdWVyeSAmJiB1cmxEZXRhaWxzLnF1ZXJ5Lmxlbmd0aCA+IDAgPyB1cmxEZXRhaWxzLnBhdGggOiB1cmxEZXRhaWxzLnBhdGhuYW1lO1xuICB9XG5cbiAgbGV0IHByZWZpeGVkVGV4dDogc3RyaW5nO1xuICBpZiAoc3RhdHVzQ29kZSAhPT0gdW5kZWZpbmVkICYmIGlzRmluaXRlKHN0YXR1c0NvZGUpICYmIE51bWJlci5pc0ludGVnZXIoc3RhdHVzQ29kZSkpIHtcbiAgICBwcmVmaXhlZFRleHQgPVxuICAgICAgYXV0aFZlcnNpb24gPT09IDNcbiAgICAgICAgPyBbbWV0aG9kLnRvVXBwZXJDYXNlKCksIHRpbWVzdGFtcCwgcXVlcnlQYXRoLCBzdGF0dXNDb2RlXS5qb2luKCd8JylcbiAgICAgICAgOiBbdGltZXN0YW1wLCBxdWVyeVBhdGgsIHN0YXR1c0NvZGVdLmpvaW4oJ3wnKTtcbiAgfSBlbHNlIHtcbiAgICBwcmVmaXhlZFRleHQgPVxuICAgICAgYXV0aFZlcnNpb24gPT09IDNcbiAgICAgICAgPyBbbWV0aG9kLnRvVXBwZXJDYXNlKCksIHRpbWVzdGFtcCwgJzMuMCcsIHF1ZXJ5UGF0aF0uam9pbignfCcpXG4gICAgICAgIDogW3RpbWVzdGFtcCwgcXVlcnlQYXRoXS5qb2luKCd8Jyk7XG4gIH1cblxuICBjb25zdCBpc0J1ZmZlciA9IEJ1ZmZlci5pc0J1ZmZlcih0ZXh0KTtcbiAgaWYgKGlzQnVmZmVyKSB7XG4gICAgcmV0dXJuIEJ1ZmZlci5jb25jYXQoW0J1ZmZlci5mcm9tKHByZWZpeGVkVGV4dCArICd8JywgJ3V0Zi04JyksIHRleHRdKSBhcyBUO1xuICB9XG4gIHJldHVybiBbcHJlZml4ZWRUZXh0LCB0ZXh0XS5qb2luKCd8JykgYXMgVDtcbn1cblxuLyoqXG4gKiBDYWxjdWxhdGUgdGhlIEhNQUMgZm9yIGFuIEhUVFAgcmVxdWVzdFxuICovXG5leHBvcnQgZnVuY3Rpb24gY2FsY3VsYXRlUmVxdWVzdEhNQUM8VCBleHRlbmRzIHN0cmluZyB8IEJ1ZmZlciA9IHN0cmluZz4oXG4gIHsgdXJsOiB1cmxQYXRoLCB0ZXh0LCB0aW1lc3RhbXAsIHRva2VuLCBtZXRob2QsIGF1dGhWZXJzaW9uIH06IENhbGN1bGF0ZVJlcXVlc3RIbWFjT3B0aW9uczxUPixcbiAgdXNlT3JpZ2luYWxQYXRoID0gZmFsc2Vcbik6IHN0cmluZyB7XG4gIGNvbnN0IHNpZ25hdHVyZVN1YmplY3QgPSBjYWxjdWxhdGVITUFDU3ViamVjdCh7IHVybFBhdGgsIHRleHQsIHRpbWVzdGFtcCwgbWV0aG9kLCBhdXRoVmVyc2lvbiB9LCB1c2VPcmlnaW5hbFBhdGgpO1xuXG4gIC8vIGNhbGN1bGF0ZSB0aGUgSE1BQ1xuICByZXR1cm4gY2FsY3VsYXRlSE1BQyh0b2tlbiwgc2lnbmF0dXJlU3ViamVjdCk7XG59XG5cbi8qKlxuICogQ2FsY3VsYXRlIHJlcXVlc3QgaGVhZGVycyB3aXRoIEhNQUNcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNhbGN1bGF0ZVJlcXVlc3RIZWFkZXJzPFQgZXh0ZW5kcyBzdHJpbmcgfCBCdWZmZXIgPSBzdHJpbmc+KFxuICB7IHVybCwgdGV4dCwgdG9rZW4sIG1ldGhvZCwgYXV0aFZlcnNpb24gfTogQ2FsY3VsYXRlUmVxdWVzdEhlYWRlcnNPcHRpb25zPFQ+LFxuICB1c2VPcmlnaW5hbFBhdGggPSBmYWxzZVxuKTogUmVxdWVzdEhlYWRlcnMge1xuICBjb25zdCB0aW1lc3RhbXAgPSBEYXRlLm5vdygpO1xuICBjb25zdCBobWFjID0gY2FsY3VsYXRlUmVxdWVzdEhNQUMoeyB1cmwsIHRleHQsIHRpbWVzdGFtcCwgdG9rZW4sIG1ldGhvZCwgYXV0aFZlcnNpb24gfSwgdXNlT3JpZ2luYWxQYXRoKTtcblxuICAvLyBjYWxjdWxhdGUgdGhlIFNIQTI1NiBoYXNoIG9mIHRoZSB0b2tlblxuICBjb25zdCBoYXNoRGlnZXN0ID0gc2pjbC5oYXNoLnNoYTI1Ni5oYXNoKHRva2VuKTtcbiAgY29uc3QgdG9rZW5IYXNoID0gc2pjbC5jb2RlYy5oZXguZnJvbUJpdHMoaGFzaERpZ2VzdCk7XG4gIHJldHVybiB7XG4gICAgaG1hYyxcbiAgICB0aW1lc3RhbXAsXG4gICAgdG9rZW5IYXNoLFxuICB9O1xufVxuXG4vKipcbiAqIFZlcmlmeSB0aGUgSE1BQyBmb3IgYW4gSFRUUCByZXNwb25zZVxuICovXG5leHBvcnQgZnVuY3Rpb24gdmVyaWZ5UmVzcG9uc2U8VCBleHRlbmRzIHN0cmluZyB8IEJ1ZmZlciA9IHN0cmluZz4oXG4gIHsgdXJsOiB1cmxQYXRoLCBzdGF0dXNDb2RlLCB0ZXh0LCB0aW1lc3RhbXAsIHRva2VuLCBobWFjLCBtZXRob2QsIGF1dGhWZXJzaW9uIH06IFZlcmlmeVJlc3BvbnNlT3B0aW9uczxUPixcbiAgdXNlT3JpZ2luYWxQYXRoID0gZmFsc2Vcbik6IFZlcmlmeVJlc3BvbnNlSW5mbzxUPiB7XG4gIGNvbnN0IHNpZ25hdHVyZVN1YmplY3QgPSBjYWxjdWxhdGVITUFDU3ViamVjdChcbiAgICB7XG4gICAgICB1cmxQYXRoLFxuICAgICAgdGV4dCxcbiAgICAgIHRpbWVzdGFtcCxcbiAgICAgIHN0YXR1c0NvZGUsXG4gICAgICBtZXRob2QsXG4gICAgICBhdXRoVmVyc2lvbixcbiAgICB9LFxuICAgIHVzZU9yaWdpbmFsUGF0aFxuICApO1xuXG4gIC8vIGNhbGN1bGF0ZSB0aGUgSE1BQ1xuICBjb25zdCBleHBlY3RlZEhtYWMgPSBjYWxjdWxhdGVITUFDKHRva2VuLCBzaWduYXR1cmVTdWJqZWN0KTtcblxuICAvLyBkZXRlcm1pbmUgaWYgdGhlIHJlc3BvbnNlIGlzIHN0aWxsIHdpdGhpbiB0aGUgdmFsaWRpdHkgd2luZG93ICg1LW1pbnV0ZSBiYWNrd2FyZHMgd2luZG93LCAxLW1pbnV0ZSBmb3J3YXJkIHdpbmRvdylcbiAgY29uc3Qgbm93ID0gRGF0ZS5ub3coKTtcbiAgY29uc3QgYmFja3dhcmRWYWxpZGl0eVdpbmRvdyA9IDEwMDAgKiA2MCAqIDU7XG4gIGNvbnN0IGZvcndhcmRWYWxpZGl0eVdpbmRvdyA9IDEwMDAgKiA2MDtcbiAgY29uc3QgaXNJblJlc3BvbnNlVmFsaWRpdHlXaW5kb3cgPVxuICAgIHRpbWVzdGFtcCA+PSBub3cgLSBiYWNrd2FyZFZhbGlkaXR5V2luZG93ICYmIHRpbWVzdGFtcCA8PSBub3cgKyBmb3J3YXJkVmFsaWRpdHlXaW5kb3c7XG5cbiAgLy8gdmVyaWZ5IHRoZSBITUFDIGFuZCB0aW1lc3RhbXBcbiAgcmV0dXJuIHtcbiAgICBpc1ZhbGlkOiBleHBlY3RlZEhtYWMgPT09IGhtYWMsXG4gICAgZXhwZWN0ZWRIbWFjLFxuICAgIHNpZ25hdHVyZVN1YmplY3QsXG4gICAgaXNJblJlc3BvbnNlVmFsaWRpdHlXaW5kb3csXG4gICAgdmVyaWZpY2F0aW9uVGltZTogbm93LFxuICB9O1xufVxuIl19

package/dist/src/hmacv4.d.ts

@@ -0,0 +1,185 @@
+/**
+ * @prettier
+ *
+ * V4 HMAC Authentication Module
+ *
+ * This module implements the v4 authentication scheme which uses a canonical
+ * preimage construction with newline-separated fields and body hashing.
+ *
+ * Key differences from v2/v3:
+ * - Separator: newline (\n) instead of pipe (|)
+ * - Body: SHA256 hash of raw bytes instead of actual body content
+ * - Timestamp: seconds instead of milliseconds
+ * - New field: authRequestId for request tracking
+ * - Trailing newline in preimage
+ * - Support for x-original-* headers (proxy scenarios)
+ */
+import { type HashableData } from './util';
+import { CalculateV4PreimageOptions, CalculateV4RequestHmacOptions, CalculateV4RequestHeadersOptions, V4RequestHeaders, VerifyV4ResponseOptions, VerifyV4ResponseInfo } from './types';
+/**
+ * Build canonical preimage for v4 authentication.
+ *
+ * The preimage is constructed as newline-separated values with a trailing newline:
+ * ```
+ * {timestampSec}
+ * {METHOD}
+ * {pathWithQuery}
+ * {bodyHashHex}
+ * {authRequestId}
+ * ```
+ *
+ * This function normalizes the HTTP method to uppercase and handles the
+ * legacy 'del' method conversion to 'DELETE'.
+ *
+ * @param options - The preimage components
+ * @returns Newline-separated canonical preimage string with trailing newline
+ *
+ * @example
+ * ```typescript
+ * const preimage = calculateV4Preimage({
+ *   timestampSec: 1761100000,
+ *   method: 'post',
+ *   pathWithQuery: '/v2/wallets/transfer?foo=bar',
+ *   bodyHashHex: '0d5e3b7a8f9c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e',
+ *   authRequestId: '1b7a1d2b-7a2f-4e4b-a1f8-c2a5a0f84e3e',
+ * });
+ *
+ * // Result:
+ * // "1761100000\nPOST\n/v2/wallets/transfer?foo=bar\n0d5e3b...d6e\n1b7a1d2b-7a2f-4e4b-a1f8-c2a5a0f84e3e\n"
+ * ```
+ */
+export declare function calculateV4Preimage({ timestampSec, method, pathWithQuery, bodyHashHex, authRequestId, }: CalculateV4PreimageOptions): string;
+/**
+ * Calculate SHA256 hash of body and return as lowercase hex string.
+ *
+ * This is used to compute the bodyHashHex field for v4 authentication.
+ * The hash is computed over the raw bytes of the request body, ensuring
+ * that the exact bytes sent over the wire are used for signature calculation.
+ *
+ * Accepts common byte representations for Node.js and browser environments,
+ * including Uint8Array and ArrayBuffer for Fetch API compatibility.
+ *
+ * @param body - Raw request body (string, Buffer, Uint8Array, or ArrayBuffer)
+ * @returns Lowercase hex SHA256 hash (64 characters)
+ *
+ * @example
+ * ```typescript
+ * // Node.js with Buffer
+ * const hash1 = calculateBodyHash(Buffer.from('{"address":"tb1q...","amount":100000}'));
+ *
+ * // Browser with Uint8Array
+ * const hash2 = calculateBodyHash(new TextEncoder().encode('{"address":"tb1q..."}'));
+ *
+ * // Browser with ArrayBuffer
+ * const hash3 = calculateBodyHash(await response.arrayBuffer());
+ *
+ * // All return: '0d5e3b7a8f...' (64 character hex string)
+ * ```
+ */
+export declare function calculateBodyHash(body: HashableData): string;
+/**
+ * Calculate the HMAC-SHA256 signature for a v4 HTTP request.
+ *
+ * This function:
+ * 1. Builds the canonical preimage from the provided options
+ * 2. Computes HMAC-SHA256 of the preimage using the raw access token
+ *
+ * @param options - Request parameters and raw access token
+ * @returns Lowercase hex HMAC-SHA256 signature
+ *
+ * @example
+ * ```typescript
+ * const hmac = calculateV4RequestHmac({
+ *   timestampSec: 1761100000,
+ *   method: 'POST',
+ *   pathWithQuery: '/v2/wallets/transfer',
+ *   bodyHashHex: '0d5e3b...',
+ *   authRequestId: '1b7a1d2b-7a2f-4e4b-a1f8-c2a5a0f84e3e',
+ *   rawToken: 'your-token',
+ * });
+ * ```
+ */
+export declare function calculateV4RequestHmac({ timestampSec, method, pathWithQuery, bodyHashHex, authRequestId, rawToken, }: CalculateV4RequestHmacOptions): string;
+/**
+ * Generate all headers required for v4 authenticated requests.
+ *
+ * This is a convenience function that:
+ * 1. Generates the current timestamp (in seconds)
+ * 2. Calculates the body hash from raw bytes
+ * 3. Computes the HMAC signature
+ * 4. Returns all values needed for request headers
+ *
+ * @param options - Request parameters including raw body and raw token
+ * @returns Object containing all v4 authentication header values
+ *
+ * @example
+ * ```typescript
+ * const headers = calculateV4RequestHeaders({
+ *   method: 'POST',
+ *   pathWithQuery: '/v2/wallets/transfer?foo=bar',
+ *   rawBody: Buffer.from('{"address":"tb1q..."}'),
+ *   rawToken: 'your-token',
+ *   authRequestId: '1b7a1d2b-7a2f-4e4b-a1f8-c2a5a0f84e3e',
+ * });
+ *
+ * // Use headers to set:
+ * // - X-Request-Timestamp: headers.timestampSec
+ * // - X-Signature: headers.hmac
+ * // - X-Content-SHA256: headers.bodyHashHex
+ * // - X-Auth-Request-Id: headers.authRequestId
+ * ```
+ */
+export declare function calculateV4RequestHeaders({ method, pathWithQuery, rawBody, rawToken, authRequestId, }: CalculateV4RequestHeadersOptions): V4RequestHeaders;
+/**
+ * Build canonical preimage for v4 response verification.
+ *
+ * Response preimage includes the status code and uses the same format:
+ * ```
+ * {timestampSec}
+ * {METHOD}
+ * {pathWithQuery}
+ * {statusCode}
+ * {bodyHashHex}
+ * {authRequestId}
+ * ```
+ *
+ * @param options - Response verification parameters
+ * @returns Newline-separated canonical preimage string with trailing newline
+ */
+export declare function calculateV4ResponsePreimage({ timestampSec, method, pathWithQuery, statusCode, bodyHashHex, authRequestId, }: Omit<VerifyV4ResponseOptions, 'hmac' | 'rawToken'>): string;
+/**
+ * Verify the HMAC signature of a v4 HTTP response.
+ *
+ * This function:
+ * 1. Reconstructs the canonical preimage from response data
+ * 2. Calculates the expected HMAC
+ * 3. Compares with the received HMAC
+ * 4. Checks if the timestamp is within the validity window
+ *
+ * The validity window is:
+ * - 5 minutes backwards (to account for clock skew and network latency)
+ * - 1 minute forwards (to account for minor clock differences)
+ *
+ * @param options - Response data and raw token for verification
+ * @returns Verification result including validity and diagnostic info
+ */
+export declare function verifyV4Response({ hmac, timestampSec, method, pathWithQuery, bodyHashHex, authRequestId, statusCode, rawToken, }: VerifyV4ResponseOptions): VerifyV4ResponseInfo;
+/**
+ * Extract path with query from x-original-uri header or request URL.
+ * Always canonicalizes to pathname + search to handle absolute URLs.
+ *
+ * @param xOriginalUri - Value of x-original-uri header (if present)
+ * @param requestUrl - The actual request URL
+ * @returns The canonical path with query to use for preimage calculation
+ *
+ */
+export declare function getPathWithQuery(xOriginalUri: string | undefined, requestUrl: string): string;
+/**
+ * Get method from x-original-method header or actual request method.
+ *
+ * @param xOriginalMethod - Value of x-original-method header (if present)
+ * @param requestMethod - The actual request method
+ * @returns The method to use for preimage calculation
+ */
+export declare function getMethod(xOriginalMethod: string | undefined, requestMethod: string): string;
+//# sourceMappingURL=hmacv4.d.ts.map

package/dist/src/hmacv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmacv4.d.ts","sourceRoot":"","sources":["../../src/hmacv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAML,KAAK,YAAY,EAClB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,EAChC,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,YAAY,EACZ,MAAM,EACN,aAAa,EACb,WAAW,EACX,aAAa,GACd,EAAE,0BAA0B,GAAG,MAAM,CAOrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,YAAY,EACZ,MAAM,EACN,aAAa,EACb,WAAW,EACX,aAAa,EACb,QAAQ,GACT,EAAE,6BAA6B,GAAG,MAAM,CAUxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,MAAM,EACN,aAAa,EACb,OAAO,EACP,QAAQ,EACR,aAAa,GACd,EAAE,gCAAgC,GAAG,gBAAgB,CAmBrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,YAAY,EACZ,MAAM,EACN,aAAa,EACb,UAAU,EACV,WAAW,EACX,aAAa,GACd,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,MAAM,CAa7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,IAAI,EACJ,YAAY,EACZ,MAAM,EACN,aAAa,EACb,WAAW,EACX,aAAa,EACb,UAAU,EACV,QAAQ,GACT,EAAE,uBAAuB,GAAG,oBAAoB,CAkChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI7F;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAG5F"}