@eventuras/fides-auth 0.5.0 → 0.7.0

package/dist/index.d.ts

@@ -4,6 +4,7 @@
  * Generic authentication utilities with support for multiple providers.
  */
 export * from './logger';
+export * from './oauth-logging';
 export * from './session-refresh';
 export * from './session-validation';
 export * from './utils';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
-import { configureLogger as e, createLogger as t } from "./logger.js";
-import { a as n, c as r, d as i, i as a, l as o, n as s, o as c, r as l, s as u, t as d, u as f } from "./utils-ByMRF7b2.js";
-import { n as p, t as m } from "./session-validation-BxObT3wC.js";
-import { refreshSession as h } from "./session-refresh.js";
+import { configureLogger, createLogger } from "./logger.js";
+import { getOAuthConfigLogContext, getOAuthErrorLogContext } from "./oauth-logging.js";
+import { refreshSession } from "./session-refresh.js";
+import { accessTokenExpires, createEncryptedJWT, decrypt, encrypt, generateToken, getSessionSecret, getSessionSecretUint8Array, hasScope, hexToUint8Array, sha256, sha512, toHex } from "./utils.js";
+import { isSession, validateSessionJwt } from "./session-validation.js";
 import "./types.js";
-export { d as accessTokenExpires, e as configureLogger, s as createEncryptedJWT, t as createLogger, l as decrypt, a as encrypt, n as generateToken, c as getSessionSecret, u as getSessionSecretUint8Array, r as hexToUint8Array, m as isSession, h as refreshSession, o as sha256, f as sha512, i as toHex, p as validateSessionJwt };
+export { accessTokenExpires, configureLogger, createEncryptedJWT, createLogger, decrypt, encrypt, generateToken, getOAuthConfigLogContext, getOAuthErrorLogContext, getSessionSecret, getSessionSecretUint8Array, hasScope, hexToUint8Array, isSession, refreshSession, sha256, sha512, toHex, validateSessionJwt };

package/dist/logger.js

@@ -1,91 +1,133 @@
 //#region src/logger.ts
-function e(e) {
-	return e instanceof Error ? {
-		name: e.name,
-		message: e.message,
-		stack: e.stack
-	} : e;
+function serializeError(value) {
+	if (value instanceof Error) return {
+		name: value.name,
+		message: value.message,
+		stack: value.stack
+	};
+	return value;
 }
-var t = new Set([
+/** Field names the logger reserves so callers can't accidentally clobber them. */
+var RESERVED_KEYS = new Set([
 	"level",
 	"time",
 	"namespace"
 ]);
-function n(t) {
-	let n = /* @__PURE__ */ new WeakSet();
+function safeStringify(record) {
+	const seen = /* @__PURE__ */ new WeakSet();
 	try {
-		return JSON.stringify(t, (t, r) => {
-			if (r instanceof Error) return e(r);
-			if (typeof r == "bigint") return r.toString();
-			if (typeof r == "object" && r) {
-				if (n.has(r)) return "[Circular]";
-				n.add(r);
+		return JSON.stringify(record, (_key, value) => {
+			if (value instanceof Error) return serializeError(value);
+			if (typeof value === "bigint") return value.toString();
+			if (typeof value === "object" && value !== null) {
+				if (seen.has(value)) return "[Circular]";
+				seen.add(value);
 			}
-			return r;
+			return value;
 		});
 	} catch {
 		return JSON.stringify({
-			level: t.level,
-			time: t.time,
-			namespace: t.namespace,
-			msg: typeof t.msg == "string" ? t.msg : "[unserializable log entry]",
-			_serializeError: !0
+			level: record.level,
+			time: record.time,
+			namespace: record.namespace,
+			msg: typeof record.msg === "string" ? record.msg : "[unserializable log entry]",
+			_serializeError: true
 		});
 	}
 }
-var r = class {
-	constructor(e, t) {
-		this.namespace = e, this.context = t;
+var ConsoleLogger = class {
+	constructor(namespace, context) {
+		this.namespace = namespace;
+		this.context = context;
 	}
-	write(r, i, a, o) {
-		if (a === void 0 && o === void 0) return;
-		let s = {
-			level: i,
+	write(method, level, data, msg) {
+		if (data === void 0 && msg === void 0) return;
+		const entry = {
+			level,
 			time: (/* @__PURE__ */ new Date()).toISOString(),
 			namespace: this.namespace
 		};
-		if (this.context) for (let [e, n] of Object.entries(this.context)) t.has(e) || (s[e] = n);
-		if (typeof a == "string") s.msg = a;
-		else if (o !== void 0 && (s.msg = o), a) for (let [e, n] of Object.entries(a)) t.has(e) || (s[e] = n);
-		s.error !== void 0 && (s.error = e(s.error)), console[r](n(s));
+		if (this.context) {
+			for (const [key, value] of Object.entries(this.context)) if (!RESERVED_KEYS.has(key)) entry[key] = value;
+		}
+		if (typeof data === "string") entry.msg = data;
+		else {
+			if (msg !== void 0) entry.msg = msg;
+			if (data) {
+				for (const [key, value] of Object.entries(data)) if (!RESERVED_KEYS.has(key)) entry[key] = value;
+			}
+		}
+		if (entry.error !== void 0) entry.error = serializeError(entry.error);
+		console[method](safeStringify(entry));
 	}
-	debug(e, t) {
-		this.write("debug", "debug", e, t);
+	debug(data, msg) {
+		this.write("debug", "debug", data, msg);
 	}
-	info(e, t) {
-		this.write("info", "info", e, t);
+	info(data, msg) {
+		this.write("info", "info", data, msg);
 	}
-	warn(e, t) {
-		this.write("warn", "warn", e, t);
+	warn(data, msg) {
+		this.write("warn", "warn", data, msg);
 	}
-	error(e, t) {
-		this.write("error", "error", e, t);
+	error(data, msg) {
+		this.write("error", "error", data, msg);
 	}
-}, i = { create({ namespace: e, context: t }) {
-	return new r(e, t);
-} }, a = 0;
-function o(e) {
-	i = e, a++;
+};
+var currentFactory = { create({ namespace, context }) {
+	return new ConsoleLogger(namespace, context);
+} };
+var factoryVersion = 0;
+/**
+* Configure a custom logger factory for fides-auth.
+*
+* Can be called at any time — even after modules have already created loggers.
+* Existing loggers will pick up the new factory on their next log call.
+*
+* If not called, fides-auth uses a console-based logger.
+*
+* @param factory - A factory that creates logger instances
+*/
+function configureLogger(factory) {
+	currentFactory = factory;
+	factoryVersion++;
 }
-function s(e) {
-	let t = null, n = -1;
-	function r() {
-		return (t === null || n !== a) && (t = i.create(e), n = a), t;
+/**
+* Create a logger instance using the configured factory.
+*
+* Returns a lazy proxy: the underlying logger is created (or re-created)
+* on first use and whenever the factory is changed via `configureLogger()`.
+* This means module-scope loggers work correctly even when `configureLogger()`
+* is called after module imports.
+*
+* @param options - Logger options including namespace and optional context
+* @returns A logger instance
+*/
+function createLogger(options) {
+	let cached = null;
+	let cachedVersion = -1;
+	function resolve() {
+		if (cached === null || cachedVersion !== factoryVersion) {
+			cached = currentFactory.create(options);
+			cachedVersion = factoryVersion;
+		}
+		return cached;
 	}
 	return {
-		debug(e, t) {
-			r().debug(e, t);
+		debug(data, msg) {
+			resolve().debug(data, msg);
 		},
-		info(e, t) {
-			r().info(e, t);
+		info(data, msg) {
+			resolve().info(data, msg);
 		},
-		warn(e, t) {
-			r().warn(e, t);
+		warn(data, msg) {
+			resolve().warn(data, msg);
 		},
-		error(e, t) {
-			r().error(e, t);
+		error(data, msg) {
+			resolve().error(data, msg);
 		}
 	};
 }
 //#endregion
-export { o as configureLogger, s as createLogger };
+export { configureLogger, createLogger };
+
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","names":[],"sources":["../src/logger.ts"],"sourcesContent":["/**\n * Pluggable logger for fides-auth.\n *\n * The default writes newline-delimited JSON to `console.<level>` so output\n * is interoperable with Loki / Grafana / Datadog out of the box, even when\n * the consumer hasn't wired in a structured logger. Users can plug their\n * own backend (pino, winston, @eventuras/logger, ...) via `configureLogger()`.\n *\n * @example\n * // Use default JSONL console logger (no setup needed)\n * import { createLogger } from '@eventuras/fides-auth/logger';\n * const logger = createLogger({ namespace: 'my-app:auth' });\n * logger.info('Authentication successful');\n * // → {\"level\":\"info\",\"time\":\"…\",\"namespace\":\"my-app:auth\",\"msg\":\"Authentication successful\"}\n *\n * @example\n * // Plug in pino\n * import pino from 'pino';\n * import { configureLogger } from '@eventuras/fides-auth/logger';\n *\n * const pinoInstance = pino();\n * configureLogger({\n *   create({ namespace, context }) {\n *     return pinoInstance.child({ namespace, ...context });\n *   },\n * });\n *\n * @example\n * // Plug in @eventuras/logger\n * import { Logger } from '@eventuras/logger';\n * import { configureLogger } from '@eventuras/fides-auth/logger';\n *\n * configureLogger({\n *   create(options) {\n *     return Logger.create(options);\n *   },\n * });\n */\n\n/**\n * Logger interface compatible with pino, winston, and console.\n *\n * All methods accept either:\n * - A string message: `logger.info('hello')`\n * - A context object and message: `logger.info({ userId: 123 }, 'User logged in')`\n */\nexport interface FidesLogger {\n  debug(data?: Record<string, unknown> | string, msg?: string): void;\n  info(data?: Record<string, unknown> | string, msg?: string): void;\n  warn(data?: Record<string, unknown> | string, msg?: string): void;\n  error(data?: Record<string, unknown> | string, msg?: string): void;\n}\n\n/** Options for creating a logger instance. */\nexport interface FidesLoggerOptions {\n  /** Namespace for log filtering (e.g., 'fides-auth:oauth') */\n  namespace: string;\n  /** Persistent context fields included in every log entry */\n  context?: Record<string, unknown>;\n}\n\n/** Factory that creates logger instances. Implement this to integrate your preferred logger. */\nexport interface FidesLoggerFactory {\n  create(options: FidesLoggerOptions): FidesLogger;\n}\n\n/**\n * Console-based logger implementation that emits newline-delimited JSON.\n *\n * Used as the default when no custom logger factory is configured. JSONL\n * keeps fides-auth's output interoperable with log shippers (Loki, Grafana,\n * Datadog, etc.) even when the consuming app hasn't wired in a structured\n * logger via `configureLogger()`. Each entry preserves the original\n * `console.<level>` call so browser devtools and CI log filters still work.\n *\n * Output shape (example):\n *\n *   {\"level\":\"info\",\"time\":\"2026-04-15T19:40:57.300Z\",\"namespace\":\"fides-auth:oauth\",\"msg\":\"PKCE parameters generated\",\"codeChallenge\":\"…\"}\n *\n * Errors in the `data` field are serialized to `{ name, message, stack }`\n * so they survive `JSON.stringify`.\n */\ntype ConsoleMethod = 'debug' | 'info' | 'warn' | 'error';\n\nfunction serializeError(value: unknown): unknown {\n  if (value instanceof Error) {\n    return { name: value.name, message: value.message, stack: value.stack };\n  }\n  return value;\n}\n\n/** Field names the logger reserves so callers can't accidentally clobber them. */\nconst RESERVED_KEYS = new Set(['level', 'time', 'namespace']);\n\nfunction safeStringify(record: Record<string, unknown>): string {\n  const seen = new WeakSet<object>();\n  try {\n    return JSON.stringify(record, (_key, value) => {\n      if (value instanceof Error) return serializeError(value);\n      if (typeof value === 'bigint') return value.toString();\n      if (typeof value === 'object' && value !== null) {\n        if (seen.has(value)) return '[Circular]';\n        seen.add(value);\n      }\n      return value;\n    });\n  } catch {\n    // Last-resort fallback: drop the original record entirely so a single\n    // non-serializable payload can't take down the caller's request path.\n    return JSON.stringify({\n      level: record.level,\n      time: record.time,\n      namespace: record.namespace,\n      msg: typeof record.msg === 'string' ? record.msg : '[unserializable log entry]',\n      _serializeError: true,\n    });\n  }\n}\n\nclass ConsoleLogger implements FidesLogger {\n  constructor(\n    private readonly namespace: string,\n    private readonly context?: Record<string, unknown>,\n  ) { }\n\n  private write(\n    method: ConsoleMethod,\n    level: 'debug' | 'info' | 'warn' | 'error',\n    data?: Record<string, unknown> | string,\n    msg?: string,\n  ): void {\n    // Skip noisy empty entries — match the pre-JSON ConsoleLogger, which\n    // dropped calls with no data and no message.\n    if (data === undefined && msg === undefined) return;\n\n    // Reserved keys are set first so they appear at the front of the JSON\n    // output. User-supplied fields are filtered against RESERVED_KEYS so\n    // they can't clobber level/time/namespace.\n    const entry: Record<string, unknown> = {\n      level,\n      time: new Date().toISOString(),\n      namespace: this.namespace,\n    };\n\n    if (this.context) {\n      for (const [key, value] of Object.entries(this.context)) {\n        if (!RESERVED_KEYS.has(key)) entry[key] = value;\n      }\n    }\n\n    if (typeof data === 'string') {\n      entry.msg = data;\n    } else {\n      if (msg !== undefined) entry.msg = msg;\n      if (data) {\n        for (const [key, value] of Object.entries(data)) {\n          if (!RESERVED_KEYS.has(key)) entry[key] = value;\n        }\n      }\n    }\n\n    if (entry.error !== undefined) {\n      entry.error = serializeError(entry.error);\n    }\n\n    console[method](safeStringify(entry));\n  }\n\n  debug(data?: Record<string, unknown> | string, msg?: string): void {\n    this.write('debug', 'debug', data, msg);\n  }\n\n  info(data?: Record<string, unknown> | string, msg?: string): void {\n    this.write('info', 'info', data, msg);\n  }\n\n  warn(data?: Record<string, unknown> | string, msg?: string): void {\n    this.write('warn', 'warn', data, msg);\n  }\n\n  error(data?: Record<string, unknown> | string, msg?: string): void {\n    this.write('error', 'error', data, msg);\n  }\n}\n\nconst defaultFactory: FidesLoggerFactory = {\n  create({ namespace, context }) {\n    return new ConsoleLogger(namespace, context);\n  },\n};\n\nlet currentFactory: FidesLoggerFactory = defaultFactory;\nlet factoryVersion = 0;\n\n/**\n * Configure a custom logger factory for fides-auth.\n *\n * Can be called at any time — even after modules have already created loggers.\n * Existing loggers will pick up the new factory on their next log call.\n *\n * If not called, fides-auth uses a console-based logger.\n *\n * @param factory - A factory that creates logger instances\n */\nexport function configureLogger(factory: FidesLoggerFactory): void {\n  currentFactory = factory;\n  factoryVersion++;\n}\n\n/**\n * Create a logger instance using the configured factory.\n *\n * Returns a lazy proxy: the underlying logger is created (or re-created)\n * on first use and whenever the factory is changed via `configureLogger()`.\n * This means module-scope loggers work correctly even when `configureLogger()`\n * is called after module imports.\n *\n * @param options - Logger options including namespace and optional context\n * @returns A logger instance\n */\nexport function createLogger(options: FidesLoggerOptions): FidesLogger {\n  let cached: FidesLogger | null = null;\n  let cachedVersion = -1;\n\n  function resolve(): FidesLogger {\n    if (cached === null || cachedVersion !== factoryVersion) {\n      cached = currentFactory.create(options);\n      cachedVersion = factoryVersion;\n    }\n    return cached;\n  }\n\n  return {\n    debug(data?, msg?) { resolve().debug(data, msg); },\n    info(data?, msg?) { resolve().info(data, msg); },\n    warn(data?, msg?) { resolve().warn(data, msg); },\n    error(data?, msg?) { resolve().error(data, msg); },\n  };\n}\n"],"mappings":";AAoFA,SAAS,eAAe,OAAyB;AAC/C,KAAI,iBAAiB,MACnB,QAAO;EAAE,MAAM,MAAM;EAAM,SAAS,MAAM;EAAS,OAAO,MAAM;EAAO;AAEzE,QAAO;;;AAIT,IAAM,gBAAgB,IAAI,IAAI;CAAC;CAAS;CAAQ;CAAY,CAAC;AAE7D,SAAS,cAAc,QAAyC;CAC9D,MAAM,uBAAO,IAAI,SAAiB;AAClC,KAAI;AACF,SAAO,KAAK,UAAU,SAAS,MAAM,UAAU;AAC7C,OAAI,iBAAiB,MAAO,QAAO,eAAe,MAAM;AACxD,OAAI,OAAO,UAAU,SAAU,QAAO,MAAM,UAAU;AACtD,OAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,QAAI,KAAK,IAAI,MAAM,CAAE,QAAO;AAC5B,SAAK,IAAI,MAAM;;AAEjB,UAAO;IACP;SACI;AAGN,SAAO,KAAK,UAAU;GACpB,OAAO,OAAO;GACd,MAAM,OAAO;GACb,WAAW,OAAO;GAClB,KAAK,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;GACnD,iBAAiB;GAClB,CAAC;;;AAIN,IAAM,gBAAN,MAA2C;CACzC,YACE,WACA,SACA;AAFiB,OAAA,YAAA;AACA,OAAA,UAAA;;CAGnB,MACE,QACA,OACA,MACA,KACM;AAGN,MAAI,SAAS,KAAA,KAAa,QAAQ,KAAA,EAAW;EAK7C,MAAM,QAAiC;GACrC;GACA,uBAAM,IAAI,MAAM,EAAC,aAAa;GAC9B,WAAW,KAAK;GACjB;AAED,MAAI,KAAK;QACF,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,QAAQ,CACrD,KAAI,CAAC,cAAc,IAAI,IAAI,CAAE,OAAM,OAAO;;AAI9C,MAAI,OAAO,SAAS,SAClB,OAAM,MAAM;OACP;AACL,OAAI,QAAQ,KAAA,EAAW,OAAM,MAAM;AACnC,OAAI;SACG,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,CAC7C,KAAI,CAAC,cAAc,IAAI,IAAI,CAAE,OAAM,OAAO;;;AAKhD,MAAI,MAAM,UAAU,KAAA,EAClB,OAAM,QAAQ,eAAe,MAAM,MAAM;AAG3C,UAAQ,QAAQ,cAAc,MAAM,CAAC;;CAGvC,MAAM,MAAyC,KAAoB;AACjE,OAAK,MAAM,SAAS,SAAS,MAAM,IAAI;;CAGzC,KAAK,MAAyC,KAAoB;AAChE,OAAK,MAAM,QAAQ,QAAQ,MAAM,IAAI;;CAGvC,KAAK,MAAyC,KAAoB;AAChE,OAAK,MAAM,QAAQ,QAAQ,MAAM,IAAI;;CAGvC,MAAM,MAAyC,KAAoB;AACjE,OAAK,MAAM,SAAS,SAAS,MAAM,IAAI;;;AAU3C,IAAI,iBAAqC,EALvC,OAAO,EAAE,WAAW,WAAW;AAC7B,QAAO,IAAI,cAAc,WAAW,QAAQ;GAIP;AACzC,IAAI,iBAAiB;;;;;;;;;;;AAYrB,SAAgB,gBAAgB,SAAmC;AACjE,kBAAiB;AACjB;;;;;;;;;;;;;AAcF,SAAgB,aAAa,SAA0C;CACrE,IAAI,SAA6B;CACjC,IAAI,gBAAgB;CAEpB,SAAS,UAAuB;AAC9B,MAAI,WAAW,QAAQ,kBAAkB,gBAAgB;AACvD,YAAS,eAAe,OAAO,QAAQ;AACvC,mBAAgB;;AAElB,SAAO;;AAGT,QAAO;EACL,MAAM,MAAO,KAAM;AAAE,YAAS,CAAC,MAAM,MAAM,IAAI;;EAC/C,KAAK,MAAO,KAAM;AAAE,YAAS,CAAC,KAAK,MAAM,IAAI;;EAC7C,KAAK,MAAO,KAAM;AAAE,YAAS,CAAC,KAAK,MAAM,IAAI;;EAC7C,MAAM,MAAO,KAAM;AAAE,YAAS,CAAC,MAAM,MAAM,IAAI;;EAChD"}

package/dist/oauth-browser.js

@@ -1,49 +1,71 @@
 //#region src/oauth-browser.ts
-function e(e) {
-	let t = new Uint8Array(e);
-	return crypto.getRandomValues(t), Array.from(t).map((e) => "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[e % 66]).join("");
+/**
+* Generate random string for code verifier (PKCE)
+* Uses Web Crypto API (browser-compatible)
+*/
+function generateRandomString(length) {
+	const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+	const randomValues = new Uint8Array(length);
+	crypto.getRandomValues(randomValues);
+	return Array.from(randomValues).map((x) => charset[x % 66]).join("");
 }
-async function t(e) {
-	let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t);
-	return btoa(String.fromCharCode(...new Uint8Array(n))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+/**
+* Generate PKCE code challenge from verifier
+* Uses Web Crypto API SHA-256
+*/
+async function generateCodeChallenge(verifier) {
+	const data = new TextEncoder().encode(verifier);
+	const hash = await crypto.subtle.digest("SHA-256", data);
+	return btoa(String.fromCharCode(...new Uint8Array(hash))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
 }
-async function n() {
-	let n = e(128);
+/**
+* Generate PKCE parameters for OAuth flow
+*/
+async function generatePKCE() {
+	const code_verifier = generateRandomString(128);
 	return {
-		code_verifier: n,
-		code_challenge: await t(n),
-		state: e(32)
+		code_verifier,
+		code_challenge: await generateCodeChallenge(code_verifier),
+		state: generateRandomString(32)
 	};
 }
-function r(e, t) {
-	let n = new URLSearchParams({
-		client_id: e.clientId,
-		redirect_uri: e.redirect_uri,
+/**
+* Build authorization URL for OAuth flow
+*/
+function buildAuthorizationUrl(config, pkce) {
+	const params = new URLSearchParams({
+		client_id: config.clientId,
+		redirect_uri: config.redirect_uri,
 		response_type: "code",
-		scope: e.scope,
-		state: t.state,
-		code_challenge: t.code_challenge,
+		scope: config.scope,
+		state: pkce.state,
+		code_challenge: pkce.code_challenge,
 		code_challenge_method: "S256"
 	});
-	return `${e.issuer}/auth?${n.toString()}`;
+	return `${config.issuer}/auth?${params.toString()}`;
 }
-async function i(e, t, n) {
-	let r = await fetch(`${e.issuer}/token`, {
+/**
+* Exchange authorization code for tokens
+*/
+async function exchangeCodeForTokens(config, code, codeVerifier) {
+	const response = await fetch(`${config.issuer}/token`, {
 		method: "POST",
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: new URLSearchParams({
 			grant_type: "authorization_code",
-			code: t,
-			redirect_uri: e.redirect_uri,
-			client_id: e.clientId,
-			code_verifier: n
+			code,
+			redirect_uri: config.redirect_uri,
+			client_id: config.clientId,
+			code_verifier: codeVerifier
 		})
 	});
-	if (!r.ok) {
-		let e = await r.text();
-		throw Error(`Token exchange failed: ${r.status} - ${e}`);
+	if (!response.ok) {
+		const error = await response.text();
+		throw new Error(`Token exchange failed: ${response.status} - ${error}`);
 	}
-	return r.json();
+	return response.json();
 }
 //#endregion
-export { r as buildAuthorizationUrl, i as exchangeCodeForTokens, n as generatePKCE };
+export { buildAuthorizationUrl, exchangeCodeForTokens, generatePKCE };
+
+//# sourceMappingURL=oauth-browser.js.map

package/dist/oauth-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-browser.js","names":[],"sources":["../src/oauth-browser.ts"],"sourcesContent":["/**\n * Browser-compatible OAuth 2.0 + PKCE helpers\n *\n * This module provides OAuth 2.0 helpers that work in browser environments.\n * Unlike `oauth.ts` which uses openid-client (Node.js only), this uses\n * browser-native Web Crypto API for PKCE generation.\n *\n * **Use this in:**\n * - Vite/React SPAs\n * - Browser-only applications\n * - Any frontend that can't use Node.js APIs\n *\n * **Usage:**\n * ```typescript\n * import { generatePKCE, buildAuthorizationUrl, exchangeCodeForTokens }\n *   from '@eventuras/fides-auth/oauth-browser';\n *\n * // 1. Start OAuth flow\n * const pkce = await generatePKCE();\n * sessionStorage.setItem('code_verifier', pkce.code_verifier);\n * sessionStorage.setItem('state', pkce.state);\n *\n * const authUrl = buildAuthorizationUrl(config, pkce);\n * window.location.href = authUrl;\n *\n * // 2. Handle callback\n * const code = new URLSearchParams(window.location.search).get('code');\n * const verifier = sessionStorage.getItem('code_verifier');\n * const tokens = await exchangeCodeForTokens(config, code, verifier);\n * ```\n */\n\n/** Configuration for browser-side OAuth / OIDC flows (no client secret). */\nexport interface OAuthConfig {\n  issuer: string;\n  clientId: string;\n  redirect_uri: string;\n  scope: string;\n}\n\n/** PKCE parameters for a browser-initiated authorization request. */\nexport interface PKCEParams {\n  code_verifier: string;\n  code_challenge: string;\n  state: string;\n}\n\n/**\n * Generate random string for code verifier (PKCE)\n * Uses Web Crypto API (browser-compatible)\n */\nfunction generateRandomString(length: number): string {\n  const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n  const randomValues = new Uint8Array(length);\n  crypto.getRandomValues(randomValues);\n  return Array.from(randomValues)\n    .map((x) => charset[x % charset.length])\n    .join('');\n}\n\n/**\n * Generate PKCE code challenge from verifier\n * Uses Web Crypto API SHA-256\n */\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n\n  // Base64URL encode\n  return btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replace(/=+$/, '');\n}\n\n/**\n * Generate PKCE parameters for OAuth flow\n */\nexport async function generatePKCE(): Promise<PKCEParams> {\n  const code_verifier = generateRandomString(128);\n  const code_challenge = await generateCodeChallenge(code_verifier);\n  const state = generateRandomString(32);\n\n  return {\n    code_verifier,\n    code_challenge,\n    state,\n  };\n}\n\n/**\n * Build authorization URL for OAuth flow\n */\nexport function buildAuthorizationUrl(\n  config: OAuthConfig,\n  pkce: PKCEParams\n): string {\n  const params = new URLSearchParams({\n    client_id: config.clientId,\n    redirect_uri: config.redirect_uri,\n    response_type: 'code',\n    scope: config.scope,\n    state: pkce.state,\n    code_challenge: pkce.code_challenge,\n    code_challenge_method: 'S256',\n  });\n\n  return `${config.issuer}/auth?${params.toString()}`;\n}\n\n/**\n * Exchange authorization code for tokens\n */\nexport async function exchangeCodeForTokens(\n  config: OAuthConfig,\n  code: string,\n  codeVerifier: string\n): Promise<{\n  access_token: string;\n  id_token: string;\n  refresh_token?: string;\n  expires_in: number;\n}> {\n  const response = await fetch(`${config.issuer}/token`, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: config.redirect_uri,\n      client_id: config.clientId,\n      code_verifier: codeVerifier,\n    }),\n  });\n\n  if (!response.ok) {\n    const error = await response.text();\n    throw new Error(`Token exchange failed: ${response.status} - ${error}`);\n  }\n\n  return response.json();\n}\n"],"mappings":";;;;;AAmDA,SAAS,qBAAqB,QAAwB;CACpD,MAAM,UAAU;CAChB,MAAM,eAAe,IAAI,WAAW,OAAO;AAC3C,QAAO,gBAAgB,aAAa;AACpC,QAAO,MAAM,KAAK,aAAa,CAC5B,KAAK,MAAM,QAAQ,IAAI,IAAgB,CACvC,KAAK,GAAG;;;;;;AAOb,eAAe,sBAAsB,UAAmC;CAEtE,MAAM,OAAO,IADO,aACP,CAAQ,OAAO,SAAS;CACrC,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAGxD,QAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC,CACtD,WAAW,KAAK,IAAI,CACpB,WAAW,KAAK,IAAI,CACpB,QAAQ,OAAO,GAAG;;;;;AAMvB,eAAsB,eAAoC;CACxD,MAAM,gBAAgB,qBAAqB,IAAI;AAI/C,QAAO;EACL;EACA,gBAAA,MAL2B,sBAAsB,cAAc;EAM/D,OALY,qBAAqB,GAKjC;EACD;;;;;AAMH,SAAgB,sBACd,QACA,MACQ;CACR,MAAM,SAAS,IAAI,gBAAgB;EACjC,WAAW,OAAO;EAClB,cAAc,OAAO;EACrB,eAAe;EACf,OAAO,OAAO;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,uBAAuB;EACxB,CAAC;AAEF,QAAO,GAAG,OAAO,OAAO,QAAQ,OAAO,UAAU;;;;;AAMnD,eAAsB,sBACpB,QACA,MACA,cAMC;CACD,MAAM,WAAW,MAAM,MAAM,GAAG,OAAO,OAAO,SAAS;EACrD,QAAQ;EACR,SAAS,EACP,gBAAgB,qCACjB;EACD,MAAM,IAAI,gBAAgB;GACxB,YAAY;GACZ;GACA,cAAc,OAAO;GACrB,WAAW,OAAO;GAClB,eAAe;GAChB,CAAC;EACH,CAAC;AAEF,KAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAM,IAAI,MAAM,0BAA0B,SAAS,OAAO,KAAK,QAAQ;;AAGzE,QAAO,SAAS,MAAM"}

package/dist/oauth-logging.d.ts

@@ -0,0 +1,45 @@
+import { OAuthConfig } from './oauth';
+/**
+ * Returns a structured, log-safe context describing an `OAuthConfig`.
+ *
+ * Excludes `clientSecret`. Use this to attach provider configuration to log
+ * lines for debugging OAuth/OIDC flows without leaking credentials.
+ */
+export declare function getOAuthConfigLogContext(config: OAuthConfig): {
+    clientId: string;
+    issuer: string;
+    redirectUri: string;
+    scope: string;
+    usePar: boolean;
+};
+/**
+ * Returns a structured log context for an unknown OAuth-related error.
+ *
+ * `oauth4webapi` (used via `openid-client`) wraps OAuth response errors. The
+ * original OAuth response (`{error, error_description, ...}`) usually lives
+ * either on the error itself or on `cause`.
+ *
+ * @see https://github.com/panva/oauth4webapi/blob/main/docs/classes/ResponseBodyError.md
+ */
+export declare function getOAuthErrorLogContext(error: unknown): {
+    value: unknown;
+    code?: undefined;
+    error?: undefined;
+    errorDescription?: undefined;
+    message?: undefined;
+    name?: undefined;
+    status?: undefined;
+    causeMessage?: undefined;
+    causeName?: undefined;
+} | {
+    code: string | undefined;
+    error: string | undefined;
+    errorDescription: string | undefined;
+    message: string | undefined;
+    name: string | undefined;
+    status: number | undefined;
+    causeMessage: string | undefined;
+    causeName: string | undefined;
+    value?: undefined;
+};
+//# sourceMappingURL=oauth-logging.d.ts.map

package/dist/oauth-logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-logging.d.ts","sourceRoot":"","sources":["../src/oauth-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW;;;;;;EAQ3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;EA0BrD"}

package/dist/oauth-logging.js

@@ -0,0 +1,50 @@
+//#region src/oauth-logging.ts
+/**
+* Returns a structured, log-safe context describing an `OAuthConfig`.
+*
+* Excludes `clientSecret`. Use this to attach provider configuration to log
+* lines for debugging OAuth/OIDC flows without leaking credentials.
+*/
+function getOAuthConfigLogContext(config) {
+	return {
+		clientId: config.clientId,
+		issuer: config.issuer,
+		redirectUri: config.redirect_uri,
+		scope: config.scope,
+		usePar: config.usePar ?? false
+	};
+}
+/**
+* Returns a structured log context for an unknown OAuth-related error.
+*
+* `oauth4webapi` (used via `openid-client`) wraps OAuth response errors. The
+* original OAuth response (`{error, error_description, ...}`) usually lives
+* either on the error itself or on `cause`.
+*
+* @see https://github.com/panva/oauth4webapi/blob/main/docs/classes/ResponseBodyError.md
+*/
+function getOAuthErrorLogContext(error) {
+	if (typeof error !== "object" || error === null) return { value: error };
+	const candidate = error;
+	const cause = typeof candidate.cause === "object" && candidate.cause !== null ? candidate.cause : null;
+	return {
+		code: stringProp(candidate, "code") ?? (cause ? stringProp(cause, "code") : void 0),
+		error: stringProp(candidate, "error") ?? (cause ? stringProp(cause, "error") : void 0),
+		errorDescription: stringProp(candidate, "error_description") ?? (cause ? stringProp(cause, "error_description") : void 0),
+		message: stringProp(candidate, "message"),
+		name: stringProp(candidate, "name"),
+		status: numberProp(candidate, "status"),
+		causeMessage: cause ? stringProp(cause, "message") : void 0,
+		causeName: cause ? stringProp(cause, "name") : void 0
+	};
+}
+function stringProp(value, key) {
+	return typeof value[key] === "string" ? value[key] : void 0;
+}
+function numberProp(value, key) {
+	return typeof value[key] === "number" ? value[key] : void 0;
+}
+//#endregion
+export { getOAuthConfigLogContext, getOAuthErrorLogContext };
+
+//# sourceMappingURL=oauth-logging.js.map

package/dist/oauth-logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-logging.js","names":[],"sources":["../src/oauth-logging.ts"],"sourcesContent":["import type { OAuthConfig } from './oauth';\n\n/**\n * Returns a structured, log-safe context describing an `OAuthConfig`.\n *\n * Excludes `clientSecret`. Use this to attach provider configuration to log\n * lines for debugging OAuth/OIDC flows without leaking credentials.\n */\nexport function getOAuthConfigLogContext(config: OAuthConfig) {\n  return {\n    clientId: config.clientId,\n    issuer: config.issuer,\n    redirectUri: config.redirect_uri,\n    scope: config.scope,\n    usePar: config.usePar ?? false,\n  };\n}\n\n/**\n * Returns a structured log context for an unknown OAuth-related error.\n *\n * `oauth4webapi` (used via `openid-client`) wraps OAuth response errors. The\n * original OAuth response (`{error, error_description, ...}`) usually lives\n * either on the error itself or on `cause`.\n *\n * @see https://github.com/panva/oauth4webapi/blob/main/docs/classes/ResponseBodyError.md\n */\nexport function getOAuthErrorLogContext(error: unknown) {\n  if (typeof error !== 'object' || error === null) {\n    return { value: error };\n  }\n\n  const candidate = error as Record<string, unknown>;\n  const cause =\n    typeof candidate.cause === 'object' && candidate.cause !== null\n      ? (candidate.cause as Record<string, unknown>)\n      : null;\n\n  // OAuth-specific fields (code/error/error_description) may live either on\n  // the error itself or on `cause` depending on how oauth4webapi wraps the\n  // response. Prefer the top-level value but fall back to `cause`.\n  return {\n    code: stringProp(candidate, 'code') ?? (cause ? stringProp(cause, 'code') : undefined),\n    error: stringProp(candidate, 'error') ?? (cause ? stringProp(cause, 'error') : undefined),\n    errorDescription:\n      stringProp(candidate, 'error_description') ??\n      (cause ? stringProp(cause, 'error_description') : undefined),\n    message: stringProp(candidate, 'message'),\n    name: stringProp(candidate, 'name'),\n    status: numberProp(candidate, 'status'),\n    causeMessage: cause ? stringProp(cause, 'message') : undefined,\n    causeName: cause ? stringProp(cause, 'name') : undefined,\n  };\n}\n\nfunction stringProp(value: Record<string, unknown>, key: string): string | undefined {\n  return typeof value[key] === 'string' ? (value[key] as string) : undefined;\n}\n\nfunction numberProp(value: Record<string, unknown>, key: string): number | undefined {\n  return typeof value[key] === 'number' ? (value[key] as number) : undefined;\n}\n"],"mappings":";;;;;;;AAQA,SAAgB,yBAAyB,QAAqB;AAC5D,QAAO;EACL,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,aAAa,OAAO;EACpB,OAAO,OAAO;EACd,QAAQ,OAAO,UAAU;EAC1B;;;;;;;;;;;AAYH,SAAgB,wBAAwB,OAAgB;AACtD,KAAI,OAAO,UAAU,YAAY,UAAU,KACzC,QAAO,EAAE,OAAO,OAAO;CAGzB,MAAM,YAAY;CAClB,MAAM,QACJ,OAAO,UAAU,UAAU,YAAY,UAAU,UAAU,OACtD,UAAU,QACX;AAKN,QAAO;EACL,MAAM,WAAW,WAAW,OAAO,KAAK,QAAQ,WAAW,OAAO,OAAO,GAAG,KAAA;EAC5E,OAAO,WAAW,WAAW,QAAQ,KAAK,QAAQ,WAAW,OAAO,QAAQ,GAAG,KAAA;EAC/E,kBACE,WAAW,WAAW,oBAAoB,KACzC,QAAQ,WAAW,OAAO,oBAAoB,GAAG,KAAA;EACpD,SAAS,WAAW,WAAW,UAAU;EACzC,MAAM,WAAW,WAAW,OAAO;EACnC,QAAQ,WAAW,WAAW,SAAS;EACvC,cAAc,QAAQ,WAAW,OAAO,UAAU,GAAG,KAAA;EACrD,WAAW,QAAQ,WAAW,OAAO,OAAO,GAAG,KAAA;EAChD;;AAGH,SAAS,WAAW,OAAgC,KAAiC;AACnF,QAAO,OAAO,MAAM,SAAS,WAAY,MAAM,OAAkB,KAAA;;AAGnE,SAAS,WAAW,OAAgC,KAAiC;AACnF,QAAO,OAAO,MAAM,SAAS,WAAY,MAAM,OAAkB,KAAA"}

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,uFAAuF;AACvF,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAElE,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CA6CvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBhF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CASd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAYd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAkCd;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAiCvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,OAAO,CAqBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,EACzB,WAAW,GAAE,MAAY,EACzB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACvC,GAAG,CA+BL;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAyBrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAgCvC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,uFAAuF;AACvF,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAElE,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CA4CvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBhF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CASd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAYd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAkCd;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAiCvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,OAAO,CA4BT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,EACzB,WAAW,GAAE,MAAY,EACzB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACvC,GAAG,CA+BL;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAyBrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAgCvC"}