@de-otio/trellis 0.7.0 → 0.9.0

package/dist/lib/oauth/device-authorization.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * RFC 8628 device authorization grant adapter (T9b-d).
  *
@@ -22,37 +21,23 @@
  *     within 60s the row evaporates (read-once short-window).
  *   - successful poll deletes the row before returning (read-once strict).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.USER_CODE_FAILURE_LIMIT = exports.POST_APPROVAL_TTL_SECONDS = exports.DEFAULT_INTERVAL = exports.DEFAULT_EXPIRES_IN = exports.USER_CODE_LEN = exports.USER_CODE_ALPHABET = void 0;
-exports.formatUserCode = formatUserCode;
-exports.normaliseUserCode = normaliseUserCode;
-exports.hashUserCode = hashUserCode;
-exports.generateUserCode = generateUserCode;
-exports.generateDeviceCode = generateDeviceCode;
-exports.startDeviceAuthorization = startDeviceAuthorization;
-exports.loadByDeviceCode = loadByDeviceCode;
-exports.lookupDeviceCodeByUserCode = lookupDeviceCodeByUserCode;
-exports.incrementFailedLookup = incrementFailedLookup;
-exports.invalidateDeviceCode = invalidateDeviceCode;
-exports.approveDeviceAuth = approveDeviceAuth;
-exports.pollDeviceAuth = pollDeviceAuth;
-const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
-const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
-const node_crypto_1 = require("node:crypto");
-const envelope_crypto_1 = require("./envelope-crypto");
+import { DynamoDBClient, GetItemCommand, PutItemCommand, DeleteItemCommand, UpdateItemCommand, ConditionalCheckFailedException, } from "@aws-sdk/client-dynamodb";
+import { marshall, unmarshall } from "@aws-sdk/util-dynamodb";
+import { randomBytes, createHash } from "node:crypto";
+import { open, resolveKek, seal } from "./envelope-crypto.js";
 /** Unambiguous user-code alphabet — no 0/O, 1/I/L, 2/Z, U/V, A/H, S/5, etc. */
-exports.USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+export const USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
 /** 8-character user codes, displayed as `XXXX-XXXX` to humans. */
-exports.USER_CODE_LEN = 8;
+export const USER_CODE_LEN = 8;
 /** Default RFC 8628 expires_in. */
-exports.DEFAULT_EXPIRES_IN = 600;
+export const DEFAULT_EXPIRES_IN = 600;
 /** Default RFC 8628 polling interval. */
-exports.DEFAULT_INTERVAL = 5;
+export const DEFAULT_INTERVAL = 5;
 /** TTL for the post-approval window — agents must poll within this. */
-exports.POST_APPROVAL_TTL_SECONDS = 60;
+export const POST_APPROVAL_TTL_SECONDS = 60;
 /** Failure lockout threshold for user_code lookups against a single device_code. */
-exports.USER_CODE_FAILURE_LIMIT = 10;
-const ddb = new client_dynamodb_1.DynamoDBClient({
+export const USER_CODE_FAILURE_LIMIT = 10;
+const ddb = new DynamoDBClient({
     region: process.env.AWS_REGION || "us-east-1",
     ...(process.env.DYNAMODB_ENDPOINT ? { endpoint: process.env.DYNAMODB_ENDPOINT } : {}),
 });
@@ -61,50 +46,50 @@ function tableName() {
         `${process.env.STAGE || "dev"}-trellis-device-auth`);
 }
 /** Format a 4-char-grouped human display: `BCDF-GHJK`. */
-function formatUserCode(raw) {
-    if (raw.length !== exports.USER_CODE_LEN)
+export function formatUserCode(raw) {
+    if (raw.length !== USER_CODE_LEN)
         return raw;
     return `${raw.slice(0, 4)}-${raw.slice(4)}`;
 }
 /** Strip the dash so callers can match the canonical alphabet. */
-function normaliseUserCode(input) {
+export function normaliseUserCode(input) {
     return input.replace(/[\s-]/g, "").toUpperCase();
 }
 /** SHA-256 hex; used as the secondary lookup key for user_code. */
-function hashUserCode(userCode) {
-    return (0, node_crypto_1.createHash)("sha256").update(userCode).digest("hex");
+export function hashUserCode(userCode) {
+    return createHash("sha256").update(userCode).digest("hex");
 }
 /**
  * Generate a cryptographically random user_code from the unambiguous alphabet.
  * Uniformly samples by rejecting bytes that would bias the modulo (alphabet
  * length 20 doesn't divide 256 evenly).
  */
-function generateUserCode(rng = node_crypto_1.randomBytes) {
-    const alphaLen = exports.USER_CODE_ALPHABET.length; // 20
+export function generateUserCode(rng = randomBytes) {
+    const alphaLen = USER_CODE_ALPHABET.length; // 20
     const cutoff = Math.floor(256 / alphaLen) * alphaLen; // 240; reject 240..255
     const out = [];
-    while (out.length < exports.USER_CODE_LEN) {
-        const buf = rng(exports.USER_CODE_LEN * 2); // oversample
-        for (let i = 0; i < buf.length && out.length < exports.USER_CODE_LEN; i++) {
+    while (out.length < USER_CODE_LEN) {
+        const buf = rng(USER_CODE_LEN * 2); // oversample
+        for (let i = 0; i < buf.length && out.length < USER_CODE_LEN; i++) {
             const b = buf[i];
             if (b >= cutoff)
                 continue;
-            out.push(exports.USER_CODE_ALPHABET[b % alphaLen]);
+            out.push(USER_CODE_ALPHABET[b % alphaLen]);
         }
     }
     return out.join("");
 }
 /** 256-bit URL-safe random device_code. */
-function generateDeviceCode(rng = node_crypto_1.randomBytes) {
+export function generateDeviceCode(rng = randomBytes) {
     return rng(32).toString("base64url");
 }
 /**
  * Issue a new device-authorization request. Stores a `pending` record with
  * TTL = expires_in seconds, plus a secondary index row keyed by user_code hash.
  */
-async function startDeviceAuthorization(input) {
-    const expiresIn = input.expiresIn ?? exports.DEFAULT_EXPIRES_IN;
-    const interval = input.interval ?? exports.DEFAULT_INTERVAL;
+export async function startDeviceAuthorization(input) {
+    const expiresIn = input.expiresIn ?? DEFAULT_EXPIRES_IN;
+    const interval = input.interval ?? DEFAULT_INTERVAL;
     const now = Math.floor(Date.now() / 1000);
     const expiresAt = now + expiresIn;
     const deviceCode = generateDeviceCode();
@@ -122,9 +107,9 @@ async function startDeviceAuthorization(input) {
         agentLabel: input.agentLabel,
         sourceIp: input.sourceIp,
     };
-    await ddb.send(new client_dynamodb_1.PutItemCommand({
+    await ddb.send(new PutItemCommand({
         TableName: tableName(),
-        Item: (0, util_dynamodb_1.marshall)({
+        Item: marshall({
             pk: `dc#${deviceCode}`,
             sk: "rec",
             ...record,
@@ -133,9 +118,9 @@ async function startDeviceAuthorization(input) {
         }, { removeUndefinedValues: true }),
         ConditionExpression: "attribute_not_exists(pk)",
     }));
-    await ddb.send(new client_dynamodb_1.PutItemCommand({
+    await ddb.send(new PutItemCommand({
         TableName: tableName(),
-        Item: (0, util_dynamodb_1.marshall)({
+        Item: marshall({
             pk: `uc#${userCodeHash}`,
             sk: "idx",
             deviceCode,
@@ -153,28 +138,28 @@ async function startDeviceAuthorization(input) {
     };
 }
 /** Internal helper — load a record by device_code or return null. */
-async function loadByDeviceCode(deviceCode) {
-    const out = await ddb.send(new client_dynamodb_1.GetItemCommand({
+export async function loadByDeviceCode(deviceCode) {
+    const out = await ddb.send(new GetItemCommand({
         TableName: tableName(),
-        Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+        Key: marshall({ pk: `dc#${deviceCode}`, sk: "rec" }),
     }));
     if (!out.Item)
         return null;
-    const raw = (0, util_dynamodb_1.unmarshall)(out.Item);
+    const raw = unmarshall(out.Item);
     if (raw.ttl && raw.ttl < Math.floor(Date.now() / 1000))
         return null;
     return rawToRecord(raw);
 }
 /** Internal helper — resolve user_code to a device_code via the secondary key. */
-async function lookupDeviceCodeByUserCode(userCode) {
+export async function lookupDeviceCodeByUserCode(userCode) {
     const userCodeHash = hashUserCode(normaliseUserCode(userCode));
-    const out = await ddb.send(new client_dynamodb_1.GetItemCommand({
+    const out = await ddb.send(new GetItemCommand({
         TableName: tableName(),
-        Key: (0, util_dynamodb_1.marshall)({ pk: `uc#${userCodeHash}`, sk: "idx" }),
+        Key: marshall({ pk: `uc#${userCodeHash}`, sk: "idx" }),
     }));
     if (!out.Item)
         return null;
-    const raw = (0, util_dynamodb_1.unmarshall)(out.Item);
+    const raw = unmarshall(out.Item);
     if (raw.ttl && raw.ttl < Math.floor(Date.now() / 1000))
         return null;
     return raw.deviceCode || null;
@@ -183,56 +168,56 @@ async function lookupDeviceCodeByUserCode(userCode) {
  * Increment the failed-lookup counter on a device_code. Returns the new count.
  * Once the count exceeds USER_CODE_FAILURE_LIMIT the record is deleted (lockout).
  */
-async function incrementFailedLookup(deviceCode) {
+export async function incrementFailedLookup(deviceCode) {
     try {
-        const out = await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+        const out = await ddb.send(new UpdateItemCommand({
             TableName: tableName(),
-            Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+            Key: marshall({ pk: `dc#${deviceCode}`, sk: "rec" }),
             UpdateExpression: "ADD failedLookups :one",
-            ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":one": 1 }),
+            ExpressionAttributeValues: marshall({ ":one": 1 }),
             ConditionExpression: "attribute_exists(pk)",
             ReturnValues: "ALL_NEW",
         }));
         if (!out.Attributes)
             return 0;
-        const updated = (0, util_dynamodb_1.unmarshall)(out.Attributes);
+        const updated = unmarshall(out.Attributes);
         const newCount = updated.failedLookups ?? 0;
-        if (newCount >= exports.USER_CODE_FAILURE_LIMIT) {
+        if (newCount >= USER_CODE_FAILURE_LIMIT) {
             await invalidateDeviceCode(deviceCode);
         }
         return newCount;
     }
     catch (err) {
-        if (err instanceof client_dynamodb_1.ConditionalCheckFailedException)
+        if (err instanceof ConditionalCheckFailedException)
             return 0;
         throw err;
     }
 }
 /** Delete a device-auth record (e.g. on lockout or successful poll). */
-async function invalidateDeviceCode(deviceCode) {
-    await ddb.send(new client_dynamodb_1.DeleteItemCommand({
+export async function invalidateDeviceCode(deviceCode) {
+    await ddb.send(new DeleteItemCommand({
         TableName: tableName(),
-        Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+        Key: marshall({ pk: `dc#${deviceCode}`, sk: "rec" }),
     }));
 }
 /**
  * Mark a device-auth record approved and stash the encrypted token blob.
  * Re-keys the record's TTL to NOW + POST_APPROVAL_TTL_SECONDS.
  */
-async function approveDeviceAuth(ctx) {
-    const kek = await (0, envelope_crypto_1.resolveKek)();
-    const envelope = (0, envelope_crypto_1.seal)(JSON.stringify(ctx.tokens), ctx.deviceCode, kek);
-    const newTtl = Math.floor(Date.now() / 1000) + exports.POST_APPROVAL_TTL_SECONDS;
-    await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+export async function approveDeviceAuth(ctx) {
+    const kek = await resolveKek();
+    const envelope = seal(JSON.stringify(ctx.tokens), ctx.deviceCode, kek);
+    const newTtl = Math.floor(Date.now() / 1000) + POST_APPROVAL_TTL_SECONDS;
+    await ddb.send(new UpdateItemCommand({
         TableName: tableName(),
-        Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${ctx.deviceCode}`, sk: "rec" }),
+        Key: marshall({ pk: `dc#${ctx.deviceCode}`, sk: "rec" }),
         UpdateExpression: "SET #status = :approved, envelope = :env, approvedByUserId = :u, cognitoSub = :s, tenantId = :t, sessionId = :sid, expiresAt = :ttl, #ttlAttr = :ttl REMOVE userCode",
         ConditionExpression: "attribute_exists(pk) AND #status = :pending",
         ExpressionAttributeNames: {
             "#status": "status",
             "#ttlAttr": "ttl",
         },
-        ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({
+        ExpressionAttributeValues: marshall({
             ":approved": "approved",
             ":pending": "pending",
             ":env": JSON.stringify(envelope),
@@ -249,7 +234,7 @@ async function approveDeviceAuth(ctx) {
  * outcomes: pending, slow_down, ok, expired, denied. On success the
  * record is deleted before tokens return (read-once).
  */
-async function pollDeviceAuth(deviceCode) {
+export async function pollDeviceAuth(deviceCode) {
     const record = await loadByDeviceCode(deviceCode);
     if (!record)
         return { outcome: "gone" };
@@ -265,17 +250,17 @@ async function pollDeviceAuth(deviceCode) {
     if (record.status === "pending") {
         // Best-effort lastPolledAt update so subsequent fast polls hit slow_down.
         try {
-            await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+            await ddb.send(new UpdateItemCommand({
                 TableName: tableName(),
-                Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+                Key: marshall({ pk: `dc#${deviceCode}`, sk: "rec" }),
                 UpdateExpression: "SET lastPolledAt = :n",
                 ConditionExpression: "attribute_exists(pk) AND #status = :pending",
                 ExpressionAttributeNames: { "#status": "status" },
-                ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":n": nowSec, ":pending": "pending" }),
+                ExpressionAttributeValues: marshall({ ":n": nowSec, ":pending": "pending" }),
             }));
         }
         catch (err) {
-            if (!(err instanceof client_dynamodb_1.ConditionalCheckFailedException))
+            if (!(err instanceof ConditionalCheckFailedException))
                 throw err;
         }
         return { outcome: "pending" };
@@ -283,8 +268,8 @@ async function pollDeviceAuth(deviceCode) {
     // status === approved. Decrypt, then delete the row before returning.
     if (!record.envelope)
         return { outcome: "expired" };
-    const kek = await (0, envelope_crypto_1.resolveKek)();
-    const plaintext = (0, envelope_crypto_1.open)(record.envelope, deviceCode, kek);
+    const kek = await resolveKek();
+    const plaintext = open(record.envelope, deviceCode, kek);
     const tokens = JSON.parse(plaintext);
     await invalidateDeviceCode(deviceCode);
     return { outcome: "ok", tokens };

package/dist/lib/oauth/device-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-authorization.js","sourceRoot":"","sources":["../../../src/lib/oauth/device-authorization.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAgGH,wCAGC;AAGD,8CAEC;AAGD,oCAEC;AAOD,4CAaC;AAGD,gDAEC;AAMD,4DAsEC;AAGD,4CAWC;AAGD,gEAYC;AAMD,sDAuBC;AAGD,oDAOC;AAgBD,8CA4BC;AAOD,wCAyCC;AAhXD,8DAOkC;AAClC,0DAA8D;AAC9D,6CAAsD;AACtD,uDAAgF;AAEhF,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,kEAAkE;AACrD,QAAA,aAAa,GAAG,CAAC,CAAC;AAC/B,mCAAmC;AACtB,QAAA,kBAAkB,GAAG,GAAG,CAAC;AACtC,yCAAyC;AAC5B,QAAA,gBAAgB,GAAG,CAAC,CAAC;AAClC,uEAAuE;AAC1D,QAAA,yBAAyB,GAAG,EAAE,CAAC;AAC5C,oFAAoF;AACvE,QAAA,uBAAuB,GAAG,EAAE,CAAC;AA0D1C,MAAM,GAAG,GAAG,IAAI,gCAAc,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtF,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,sBAAsB,CACpD,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAa;QAAE,OAAO,GAAG,CAAC;IAC7C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,SAAgB,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,MAA6B,yBAAW;IACvE,MAAM,QAAQ,GAAG,0BAAkB,CAAC,MAAM,CAAC,CAAC,KAAK;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,uBAAuB;IAC7E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,GAAG,qBAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,qBAAa,EAAE,CAAC,EAAE,EAAE,CAAC;YAClE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YAClB,IAAI,CAAC,IAAI,MAAM;gBAAE,SAAS;YAC1B,GAAG,CAAC,IAAI,CAAC,0BAAkB,CAAC,CAAC,GAAG,QAAQ,CAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,2CAA2C;AAC3C,SAAgB,kBAAkB,CAAC,MAA6B,yBAAW;IACzE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,0BAAkB,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,wBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC;IAElC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAqB;QAC/B,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,SAAS,EAAE,GAAG;QACd,QAAQ;QACR,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,IAAA,wBAAQ,EACZ;YACE,EAAE,EAAE,MAAM,UAAU,EAAE;YACtB,EAAE,EAAE,KAAK;YACT,GAAG,MAAM;YACT,gDAAgD;YAChD,GAAG,EAAE,SAAS;SACf,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC;QACD,mBAAmB,EAAE,0BAA0B;KAChD,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,IAAA,wBAAQ,EACZ;YACE,EAAE,EAAE,MAAM,YAAY,EAAE;YACxB,EAAE,EAAE,KAAK;YACT,UAAU;YACV,SAAS,EAAE,GAAG;YACd,GAAG,EAAE,SAAS;SACf,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC;KACF,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;QACnC,gBAAgB,EAAE,KAAK,CAAC,mBAAmB;QAC3C,yBAAyB,EAAE,GAAG,KAAK,CAAC,mBAAmB,cAAc,cAAc,CAAC,QAAQ,CAAC,EAAE;QAC/F,UAAU,EAAE,SAAS;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,qEAAqE;AAC9D,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACrD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAA,0BAAU,EAAC,GAAG,CAAC,IAAI,CAA+C,CAAC;IAC/E,IAAI,GAAG,CAAC,GAAG,IAAK,GAAG,CAAC,GAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,0BAA0B,CAAC,QAAgB;IAC/D,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACvD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAA,0BAAU,EAAC,GAAG,CAAC,IAAI,CAA+C,CAAC;IAC/E,IAAI,GAAG,CAAC,GAAG,IAAK,GAAG,CAAC,GAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAQ,GAAG,CAAC,UAAqB,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,mCAAiB,CAAC;YACpB,SAAS,EAAE,SAAS,EAAE;YACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACpD,gBAAgB,EAAE,wBAAwB;YAC1C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAClD,mBAAmB,EAAE,sBAAsB;YAC3C,YAAY,EAAE,SAAS;SACxB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAA,0BAAU,EAAC,GAAG,CAAC,UAAU,CAA+B,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,IAAI,+BAAuB,EAAE,CAAC;YACxC,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iDAA+B;YAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wEAAwE;AACjE,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAoB;IAC1D,MAAM,GAAG,GAAG,MAAM,IAAA,4BAAU,GAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAA,sBAAI,EAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,iCAAyB,CAAC;IAEzE,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACxD,gBAAgB,EACd,sKAAsK;QACxK,mBAAmB,EAAE,6CAA6C;QAClE,wBAAwB,EAAE;YACxB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,KAAK;SAClB;QACD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC;YAClC,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,gBAAgB;YAC1B,IAAI,EAAE,GAAG,CAAC,UAAU;YACpB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,SAAS;YACrB,MAAM,EAAE,MAAM;SACf,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAE7D,uDAAuD;IACvD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,GAAG,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;gBACpB,SAAS,EAAE,SAAS,EAAE;gBACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBACpD,gBAAgB,EAAE,uBAAuB;gBACzC,mBAAmB,EAAE,6CAA6C;gBAClE,wBAAwB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;gBACjD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;aAC7E,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,iDAA+B,CAAC;gBAAE,MAAM,GAAG,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,IAAA,4BAAU,GAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAA,sBAAI,EAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAa,CAAC;IAEjD,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,YAAY,EAAE,GAAG,CAAC,YAAsB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,MAAM,EAAE,GAAG,CAAC,MAA2C;QACvD,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,aAAa,EAAG,GAAG,CAAC,aAAwB,IAAI,CAAC;QACjD,YAAY,EAAE,GAAG,CAAC,YAAkC;QACpD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAoB,CAAC,CAAC,CAAC,SAAS;QAC3F,gBAAgB,EAAE,GAAG,CAAC,gBAAsC;QAC5D,UAAU,EAAE,GAAG,CAAC,UAAgC;QAChD,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,UAAU,EAAE,GAAG,CAAC,UAAgC;QAChD,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,SAAS,EAAE,GAAG,CAAC,SAA+B;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"device-authorization.js","sourceRoot":"","sources":["../../../src/lib/oauth/device-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAuB,MAAM,sBAAsB,CAAC;AAEnF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,mCAAmC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,yCAAyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AA0D1C,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtF,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,sBAAsB,CACpD,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,GAAG,CAAC;IAC7C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA6B,WAAW;IACvE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,uBAAuB;IAC7E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;YAClE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YAClB,IAAI,CAAC,IAAI,MAAM;gBAAE,SAAS;YAC1B,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,GAAG,QAAQ,CAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,kBAAkB,CAAC,MAA6B,WAAW;IACzE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC;IAElC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAqB;QAC/B,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,SAAS,EAAE,GAAG;QACd,QAAQ;QACR,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,cAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,QAAQ,CACZ;YACE,EAAE,EAAE,MAAM,UAAU,EAAE;YACtB,EAAE,EAAE,KAAK;YACT,GAAG,MAAM;YACT,gDAAgD;YAChD,GAAG,EAAE,SAAS;SACf,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC;QACD,mBAAmB,EAAE,0BAA0B;KAChD,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,cAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,QAAQ,CACZ;YACE,EAAE,EAAE,MAAM,YAAY,EAAE;YACxB,EAAE,EAAE,KAAK;YACT,UAAU;YACV,SAAS,EAAE,GAAG;YACd,GAAG,EAAE,SAAS;SACf,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC;KACF,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;QACnC,gBAAgB,EAAE,KAAK,CAAC,mBAAmB;QAC3C,yBAAyB,EAAE,GAAG,KAAK,CAAC,mBAAmB,cAAc,cAAc,CAAC,QAAQ,CAAC,EAAE;QAC/F,UAAU,EAAE,SAAS;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,cAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACrD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAA+C,CAAC;IAC/E,IAAI,GAAG,CAAC,GAAG,IAAK,GAAG,CAAC,GAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAAgB;IAC/D,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,cAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACvD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAA+C,CAAC;IAC/E,IAAI,GAAG,CAAC,GAAG,IAAK,GAAG,CAAC,GAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAQ,GAAG,CAAC,UAAqB,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,iBAAiB,CAAC;YACpB,SAAS,EAAE,SAAS,EAAE;YACtB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACpD,gBAAgB,EAAE,wBAAwB;YAC1C,yBAAyB,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAClD,mBAAmB,EAAE,sBAAsB;YAC3C,YAAY,EAAE,SAAS;SACxB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAA+B,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YACxC,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,+BAA+B;YAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAoB;IAC1D,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,yBAAyB,CAAC;IAEzE,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACxD,gBAAgB,EACd,sKAAsK;QACxK,mBAAmB,EAAE,6CAA6C;QAClE,wBAAwB,EAAE;YACxB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,KAAK;SAClB;QACD,yBAAyB,EAAE,QAAQ,CAAC;YAClC,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,gBAAgB;YAC1B,IAAI,EAAE,GAAG,CAAC,UAAU;YACpB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,SAAS;YACrB,MAAM,EAAE,MAAM;SACf,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAE7D,uDAAuD;IACvD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,GAAG,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;gBACpB,SAAS,EAAE,SAAS,EAAE;gBACtB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBACpD,gBAAgB,EAAE,uBAAuB;gBACzC,mBAAmB,EAAE,6CAA6C;gBAClE,wBAAwB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;gBACjD,yBAAyB,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;aAC7E,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,+BAA+B,CAAC;gBAAE,MAAM,GAAG,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAa,CAAC;IAEjD,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,YAAY,EAAE,GAAG,CAAC,YAAsB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,MAAM,EAAE,GAAG,CAAC,MAA2C;QACvD,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,aAAa,EAAG,GAAG,CAAC,aAAwB,IAAI,CAAC;QACjD,YAAY,EAAE,GAAG,CAAC,YAAkC;QACpD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAoB,CAAC,CAAC,CAAC,SAAS;QAC3F,gBAAgB,EAAE,GAAG,CAAC,gBAAsC;QAC5D,UAAU,EAAE,GAAG,CAAC,UAAgC;QAChD,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,UAAU,EAAE,GAAG,CAAC,UAAgC;QAChD,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,SAAS,EAAE,GAAG,CAAC,SAA+B;KAC/C,CAAC;AACJ,CAAC"}

package/dist/lib/oauth/envelope-crypto.d.ts

@@ -87,11 +87,11 @@ export declare function safeEqual(a: string, b: string): boolean;
 /**
  * Hook for tests + production wiring. Defaults to a stub that throws,
  * directing callers to install `@aws-sdk/client-kms` and override via
- * `setKmsKekFetcher`. The skybber CDK wires the AWS-SDK-backed fetcher
+ * `setKmsKekFetcher`. The trellis CDK wires the AWS-SDK-backed fetcher
  * during process bootstrap.
  */
 export type KmsKekFetcher = (kmsKeyId: string, region: string) => Promise<Buffer>;
-/** Wire the production KMS path. Skybber CDK calls this during bootstrap. */
+/** Wire the production KMS path. Trellis CDK calls this during bootstrap. */
 export declare function setKmsKekFetcher(fn: KmsKekFetcher): void;
 export declare function resolveKek(): Promise<Buffer>;
 /** Reset the cached KEK. Test-only. */

package/dist/lib/oauth/envelope-crypto.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Envelope encryption helpers for OAuth device-authorization records.
  *
@@ -21,20 +20,9 @@
  * decrypt time fails with an authentication error rather than returning
  * silently truncated plaintext.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CURRENT_KEK_VERSION = exports.DEK_INFO = void 0;
-exports.deriveDek = deriveDek;
-exports.seal = seal;
-exports.open = open;
-exports.resolveKekForVersion = resolveKekForVersion;
-exports.safeEqual = safeEqual;
-exports.setKmsKekFetcher = setKmsKekFetcher;
-exports.resolveKek = resolveKek;
-exports._resetKekCacheForTest = _resetKekCacheForTest;
-exports._resetKmsKekFetcherForTest = _resetKmsKekFetcherForTest;
-const node_crypto_1 = require("node:crypto");
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes, timingSafeEqual, } from "node:crypto";
 /** HKDF info string. Versioned so future schema changes are detectable. */
-exports.DEK_INFO = "trellis-device-auth-dek-v1";
+export const DEK_INFO = "trellis-device-auth-dek-v1";
 /** Length of the AES-256 DEK in bytes. */
 const DEK_LEN = 32;
 /** Length of the HKDF salt stored alongside the ciphertext. */
@@ -44,7 +32,7 @@ const IV_LEN = 12;
 /** AES-GCM authentication tag length (16 bytes / 128 bits). */
 const TAG_LEN = 16;
 /** Current KEK version written by `seal`. */
-exports.CURRENT_KEK_VERSION = 1;
+export const CURRENT_KEK_VERSION = 1;
 function b64url(b) {
     return b.toString("base64url");
 }
@@ -56,7 +44,7 @@ function fromB64url(s) {
  * The device_code is the IKM; the KEK is mixed in as part of the salt so a
  * stolen DynamoDB row alone cannot derive the DEK.
  */
-function deriveDek(deviceCode, kek, salt) {
+export function deriveDek(deviceCode, kek, salt) {
     if (!deviceCode || deviceCode.length < 16) {
         throw new Error("device_code too short");
     }
@@ -69,7 +57,7 @@ function deriveDek(deviceCode, kek, salt) {
     // HKDF: ikm = device_code; salt = (kek || salt); info = DEK_INFO.
     // Mixing KEK into the salt means the DEK depends on both pieces.
     const combinedSalt = Buffer.concat([kek, salt]);
-    const dek = (0, node_crypto_1.hkdfSync)("sha256", deviceCode, combinedSalt, exports.DEK_INFO, DEK_LEN);
+    const dek = hkdfSync("sha256", deviceCode, combinedSalt, DEK_INFO, DEK_LEN);
     return Buffer.from(dek);
 }
 /**
@@ -77,11 +65,11 @@ function deriveDek(deviceCode, kek, salt) {
  * Returns the storable envelope; ciphertext + iv + tag are sufficient for
  * decryption only when device_code is supplied at open time.
  */
-function seal(plaintext, deviceCode, kek) {
-    const salt = (0, node_crypto_1.randomBytes)(SALT_LEN);
-    const iv = (0, node_crypto_1.randomBytes)(IV_LEN);
+export function seal(plaintext, deviceCode, kek) {
+    const salt = randomBytes(SALT_LEN);
+    const iv = randomBytes(IV_LEN);
     const dek = deriveDek(deviceCode, kek, salt);
-    const cipher = (0, node_crypto_1.createCipheriv)("aes-256-gcm", dek, iv, { authTagLength: TAG_LEN });
+    const cipher = createCipheriv("aes-256-gcm", dek, iv, { authTagLength: TAG_LEN });
     const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
     // Wipe the DEK from our reference. (V8 doesn't guarantee wipe, but at
@@ -93,8 +81,8 @@ function seal(plaintext, deviceCode, kek) {
         tag: b64url(tag),
         ciphertext: b64url(ct),
         alg: "AES-256-GCM+HKDF-SHA256",
-        info: exports.DEK_INFO,
-        keyVersion: exports.CURRENT_KEK_VERSION,
+        info: DEK_INFO,
+        keyVersion: CURRENT_KEK_VERSION,
     };
 }
 /**
@@ -107,11 +95,11 @@ function seal(plaintext, deviceCode, kek) {
  * The MVP runs version 1 only; this signature stays compatible for
  * forward-rotation scenarios (G4 MEDIUM-1).
  */
-function open(envelope, deviceCode, kek) {
+export function open(envelope, deviceCode, kek) {
     if (envelope.alg !== "AES-256-GCM+HKDF-SHA256") {
         throw new Error(`unsupported envelope alg: ${envelope.alg}`);
     }
-    if (envelope.info !== exports.DEK_INFO) {
+    if (envelope.info !== DEK_INFO) {
         throw new Error(`unsupported envelope info: ${envelope.info}`);
     }
     // Reject envelopes from versions we don't yet know how to dispatch.
@@ -133,7 +121,7 @@ function open(envelope, deviceCode, kek) {
     if (tag.length !== TAG_LEN)
         throw new Error("envelope tag length");
     const dek = deriveDek(deviceCode, kek, salt);
-    const decipher = (0, node_crypto_1.createDecipheriv)("aes-256-gcm", dek, iv, { authTagLength: TAG_LEN });
+    const decipher = createDecipheriv("aes-256-gcm", dek, iv, { authTagLength: TAG_LEN });
     decipher.setAuthTag(tag);
     let pt;
     try {
@@ -151,7 +139,7 @@ function open(envelope, deviceCode, kek) {
  * sealed envelope should call this rather than `resolveKek()` directly
  * (G4 MEDIUM-1).
  */
-async function resolveKekForVersion(version) {
+export async function resolveKekForVersion(version) {
     if (version !== 1) {
         throw new Error(`unsupported envelope keyVersion: ${version}`);
     }
@@ -163,12 +151,12 @@ async function resolveKekForVersion(version) {
  * stored hash (we don't store the device_code itself, so this is reserved
  * for refresh-jti comparisons).
  */
-function safeEqual(a, b) {
+export function safeEqual(a, b) {
     const ab = Buffer.from(a, "utf8");
     const bb = Buffer.from(b, "utf8");
     if (ab.length !== bb.length)
         return false;
-    return (0, node_crypto_1.timingSafeEqual)(ab, bb);
+    return timingSafeEqual(ab, bb);
 }
 /**
  * Resolve the KEK at runtime. Two paths:
@@ -182,11 +170,11 @@ let cachedKek;
 let kmsKekFetcher = async () => {
     throw new Error("KMS KEK fetcher not configured; call setKmsKekFetcher() at startup or set DEVICE_AUTH_KEK_BASE64");
 };
-/** Wire the production KMS path. Skybber CDK calls this during bootstrap. */
-function setKmsKekFetcher(fn) {
+/** Wire the production KMS path. Trellis CDK calls this during bootstrap. */
+export function setKmsKekFetcher(fn) {
     kmsKekFetcher = fn;
 }
-async function resolveKek() {
+export async function resolveKek() {
     if (cachedKek)
         return cachedKek;
     const inline = process.env.DEVICE_AUTH_KEK_BASE64;
@@ -211,11 +199,11 @@ async function resolveKek() {
     return cachedKek;
 }
 /** Reset the cached KEK. Test-only. */
-function _resetKekCacheForTest() {
+export function _resetKekCacheForTest() {
     cachedKek = undefined;
 }
 /** Reset the KMS fetcher to its default (test-only). */
-function _resetKmsKekFetcherForTest() {
+export function _resetKmsKekFetcherForTest() {
     kmsKekFetcher = async () => {
         throw new Error("KMS KEK fetcher not configured; call setKmsKekFetcher() at startup or set DEVICE_AUTH_KEK_BASE64");
     };

package/dist/lib/oauth/envelope-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope-crypto.js","sourceRoot":"","sources":["../../../src/lib/oauth/envelope-crypto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AA6DH,8BAmBC;AAOD,oBA0BC;AAYD,oBAuCC;AASD,oDAKC;AAQD,8BAKC;AA2BD,4CAEC;AAED,gCA2BC;AAGD,sDAEC;AAGD,gEAMC;AArQD,6CAMqB;AAErB,2EAA2E;AAC9D,QAAA,QAAQ,GAAG,4BAA4B,CAAC;AAErD,0CAA0C;AAC1C,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,+DAA+D;AAC/D,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,gEAAgE;AAChE,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,+DAA+D;AAC/D,MAAM,OAAO,GAAG,EAAE,CAAC;AAyBnB,6CAA6C;AAChC,QAAA,mBAAmB,GAAG,CAAC,CAAC;AAErC,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CACvB,UAAkB,EAClB,GAAW,EACX,IAAY;IAEZ,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAA,sBAAQ,EAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAQ,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAgB,IAAI,CAClB,SAAiB,EACjB,UAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,sEAAsE;IACtE,4DAA4D;IAC5D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QACd,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,EAAE,yBAAyB;QAC9B,IAAI,EAAE,gBAAQ;QACd,UAAU,EAAE,2BAAmB;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,IAAI,CAClB,QAAwB,EACxB,UAAkB,EAClB,GAAW;IAEX,IAAI,QAAQ,CAAC,GAAG,KAAK,yBAAyB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,oEAAoE;IACpE,8DAA8D;IAC9D,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;IACjD,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,eAAe,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtE,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAEnE,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB,CAAC,OAAe;IACxD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAA,6BAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,SAA6B,CAAC;AAUlC,IAAI,aAAa,GAAkB,KAAK,IAAI,EAAE;IAC5C,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;AACJ,CAAC,CAAC;AAEF,6EAA6E;AAC7E,SAAgB,gBAAgB,CAAC,EAAiB;IAChD,aAAa,GAAG,EAAE,CAAC;AACrB,CAAC;AAEM,KAAK,UAAU,UAAU;IAC9B,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,SAAS,GAAG,CAAC,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;IAClB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uCAAuC;AACvC,SAAgB,qBAAqB;IACnC,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC;AAED,wDAAwD;AACxD,SAAgB,0BAA0B;IACxC,aAAa,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"envelope-crypto.js","sourceRoot":"","sources":["../../../src/lib/oauth/envelope-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAErD,0CAA0C;AAC1C,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,+DAA+D;AAC/D,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,gEAAgE;AAChE,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,+DAA+D;AAC/D,MAAM,OAAO,GAAG,EAAE,CAAC;AAyBnB,6CAA6C;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,UAAkB,EAClB,GAAW,EACX,IAAY;IAEZ,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAClB,SAAiB,EACjB,UAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,sEAAsE;IACtE,4DAA4D;IAC5D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QACd,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,EAAE,yBAAyB;QAC9B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,mBAAmB;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,IAAI,CAClB,QAAwB,EACxB,UAAkB,EAClB,GAAW;IAEX,IAAI,QAAQ,CAAC,GAAG,KAAK,yBAAyB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,oEAAoE;IACpE,8DAA8D;IAC9D,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;IACjD,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,eAAe,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtE,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAEnE,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe;IACxD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,SAA6B,CAAC;AAUlC,IAAI,aAAa,GAAkB,KAAK,IAAI,EAAE;IAC5C,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;AACJ,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,EAAiB;IAChD,aAAa,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,SAAS,GAAG,CAAC,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;IAClB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,qBAAqB;IACnC,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B;IACxC,aAAa,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}