@eventuras/fides-auth 0.5.0 → 0.7.0

package/dist/oauth.js

@@ -1,178 +1,338 @@
-import { createLogger as e } from "./logger.js";
-import { t } from "./decode_jwt-1J26fl4I.js";
-import { a as n, c as r, i, l as a, n as o, o as s, r as c, s as l, t as u } from "./build-nL2--iMi.js";
+import { createLogger } from "./logger.js";
+import { getOAuthErrorLogContext } from "./oauth-logging.js";
+import { decodeJwt } from "jose";
+import * as openid from "openid-client";
 //#region src/oauth.ts
-var d = e({ namespace: "fides-auth:oauth" }), f = "openid profile email offline_access";
-async function p(e, t) {
-	d.debug({ issuer: e.issuer }, "Starting token refresh");
+var logger = createLogger({ namespace: "fides-auth:oauth" });
+/** Default OIDC scope requesting user identity, profile, email, and offline access. */
+var defaultScope = "openid profile email offline_access";
+/**
+* Refreshes an access token using a refresh token grant.
+*
+* @param oAuthConfig - OAuth configuration for the identity provider
+* @param refreshToken - The refresh token to exchange
+* @returns Token endpoint response containing new access and refresh tokens
+*/
+async function refreshAccessToken(oAuthConfig, refreshToken) {
+	logger.debug({ issuer: oAuthConfig.issuer }, "Starting token refresh");
 	try {
-		let n = await a(await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), t, { scope: e.scope });
-		return d.info({
-			hasAccessToken: !!n.access_token,
-			hasRefreshToken: !!n.refresh_token,
-			expiresIn: n.expires_in
-		}, "Token refresh successful"), n;
-	} catch (t) {
-		let n = t;
-		throw n?.code === "OAUTH_RESPONSE_BODY_ERROR" && n?.error === "invalid_grant" ? d.info({
-			error: n.error,
-			error_description: n.error_description,
-			issuer: e.issuer
-		}, "Token refresh failed - refresh token expired or invalid") : d.error({
-			error: t,
-			issuer: e.issuer
-		}, "Token refresh failed"), t;
+		const config = await openid.discovery(new URL(oAuthConfig.issuer), oAuthConfig.clientId, oAuthConfig.clientSecret, openid.ClientSecretPost(oAuthConfig.clientSecret));
+		const tokens = await openid.refreshTokenGrant(config, refreshToken, { scope: oAuthConfig.scope });
+		logger.info({
+			hasAccessToken: !!tokens.access_token,
+			hasRefreshToken: !!tokens.refresh_token,
+			expiresIn: tokens.expires_in
+		}, "Token refresh successful");
+		return tokens;
+	} catch (error) {
+		const errorContext = getOAuthErrorLogContext(error);
+		if (errorContext.code === "OAUTH_RESPONSE_BODY_ERROR" && errorContext.error === "invalid_grant") logger.info({
+			...errorContext,
+			issuer: oAuthConfig.issuer
+		}, "Token refresh failed - refresh token expired or invalid");
+		else logger.error({
+			error,
+			issuer: oAuthConfig.issuer
+		}, "Token refresh failed");
+		throw error;
 	}
 }
-async function m(e) {
-	let t = l(), i = await n(t), a = r(), o = {
-		redirect_uri: e.redirect_uri,
-		scope: e.scope ?? "openid profile email offline_access",
-		code_challenge: i,
+/**
+* Creates PKCE parameters for an OAuth flow.
+*
+* @param config - OAuthConfig configuration including the redirect URI and scope.
+* @returns A promise that resolves to an object containing:
+*  - code_verifier: The randomly generated PKCE code verifier.
+*  - code_challenge: The derived PKCE code challenge.
+*  - state: A random state to protect against CSRF.
+*  - parameters: A Record<string,string> with the assembled parameters.
+*/
+async function buildPKCEOptions(config) {
+	const code_verifier = openid.randomPKCECodeVerifier();
+	const code_challenge = await openid.calculatePKCECodeChallenge(code_verifier);
+	const state = openid.randomState();
+	const parameters = {
+		redirect_uri: config.redirect_uri,
+		scope: config.scope ?? "openid profile email offline_access",
+		code_challenge,
 		code_challenge_method: "S256",
-		state: a
+		state
 	};
-	return d.info({
-		redirectUri: e.redirect_uri,
-		scope: o.scope
-	}, "PKCE parameters generated"), {
-		code_verifier: t,
-		code_challenge: i,
-		state: a,
-		parameters: o
+	logger.info({
+		redirectUri: config.redirect_uri,
+		scope: parameters.scope
+	}, "PKCE parameters generated");
+	return {
+		code_verifier,
+		code_challenge,
+		state,
+		parameters
 	};
 }
-async function h(e, t) {
+/**
+* Builds an authorization URL with PKCE parameters.
+*
+* @param config - Discovered OpenID Configuration (use openid.discovery() to obtain)
+* @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)
+* @returns A Promise that resolves to the authorization URL
+*/
+async function buildAuthorizationUrl(config, pkceOptions) {
 	try {
-		let n = c(e, t.parameters);
-		return d.info("Authorization URL built successfully"), n;
-	} catch (e) {
-		throw d.error({ error: e }, "Failed to build authorization URL"), e;
+		const authUrl = openid.buildAuthorizationUrl(config, pkceOptions.parameters);
+		logger.info("Authorization URL built successfully");
+		return authUrl;
+	} catch (error) {
+		logger.error({ error }, "Failed to build authorization URL");
+		throw error;
 	}
 }
-async function g(e, t) {
+/**
+* Builds an authorization URL using Pushed Authorization Requests (RFC 9126).
+*
+* Posts the PKCE parameters to the provider's PAR endpoint and returns a URL
+* containing only `client_id` and `request_uri`. The provider's discovery
+* metadata must include `pushed_authorization_request_endpoint`.
+*
+* @param config - Discovered OpenID Configuration (use openid.discovery() to obtain)
+* @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)
+* @returns A Promise that resolves to the PAR-based authorization URL
+*/
+async function buildAuthorizationUrlWithPAR(config, pkceOptions) {
 	try {
-		let n = await i(e, t.parameters);
-		return d.info("PAR authorization URL built successfully"), n;
-	} catch (e) {
-		throw d.error({ error: e }, "Failed to build PAR authorization URL"), e;
+		const authUrl = await openid.buildAuthorizationUrlWithPAR(config, pkceOptions.parameters);
+		logger.info("PAR authorization URL built successfully");
+		return authUrl;
+	} catch (error) {
+		logger.error({ error }, "Failed to build PAR authorization URL");
+		throw error;
 	}
 }
-async function _(e, t) {
-	d.debug({ issuer: e.issuer }, "Discovering OpenID configuration");
+/**
+* Convenience function to discover OpenID configuration and build an
+* authorization URL. Routes through PAR when `oauthConfig.usePar` is true and
+* the provider advertises `pushed_authorization_request_endpoint`.
+*
+* - `usePar === true` + provider advertises PAR → uses PAR.
+* - `usePar === true` + provider does **not** advertise PAR → throws.
+* - `usePar` unset/false + provider advertises PAR → standard flow + one-line
+*   `info` advisory that PAR is available but not enabled.
+* - `usePar` unset/false + no PAR endpoint → standard flow, no advisory.
+*
+* @param oauthConfig - Your OAuth configuration
+* @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)
+* @returns A Promise that resolves to the authorization URL
+*/
+async function discoverAndBuildAuthorizationUrl(oauthConfig, pkceOptions) {
+	logger.debug({ issuer: oauthConfig.issuer }, "Discovering OpenID configuration");
 	try {
-		let n = await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), r = n.serverMetadata().pushed_authorization_request_endpoint;
-		if (e.usePar) {
-			if (!r) throw Error("PAR requested (usePar=true) but provider does not advertise pushed_authorization_request_endpoint");
-			return g(n, t);
+		const config = await openid.discovery(new URL(oauthConfig.issuer), oauthConfig.clientId, oauthConfig.clientSecret, openid.ClientSecretPost(oauthConfig.clientSecret));
+		const parEndpoint = config.serverMetadata().pushed_authorization_request_endpoint;
+		if (oauthConfig.usePar) {
+			if (!parEndpoint) throw new Error("PAR requested (usePar=true) but provider does not advertise pushed_authorization_request_endpoint");
+			return buildAuthorizationUrlWithPAR(config, pkceOptions);
 		}
-		return r && d.info({ issuer: e.issuer }, "Provider advertises PAR but usePar is not enabled — set OAuthConfig.usePar=true to use it"), h(n, t);
-	} catch (t) {
-		throw d.error({
-			error: t,
-			issuer: e.issuer
-		}, "Failed to discover config or build URL"), t;
+		if (parEndpoint) logger.info({ issuer: oauthConfig.issuer }, "Provider advertises PAR but usePar is not enabled — set OAuthConfig.usePar=true to use it");
+		return buildAuthorizationUrl(config, pkceOptions);
+	} catch (error) {
+		logger.error({
+			error,
+			issuer: oauthConfig.issuer
+		}, "Failed to discover config or build URL");
+		throw error;
 	}
 }
-async function v(e, t, n, r) {
-	d.debug({
-		issuer: e.issuer,
-		clientId: e.clientId
+/**
+* Exchanges an authorization code for tokens using OIDC discovery and PKCE.
+*
+* @param oauthConfig - OAuth configuration
+* @param callbackUrl - The full callback URL with query parameters from the OIDC provider
+* @param codeVerifier - The PKCE code verifier stored during login initiation
+* @param expectedState - The state parameter stored during login initiation
+* @returns Token response from the OIDC provider
+*/
+async function exchangeAuthorizationCode(oauthConfig, callbackUrl, codeVerifier, expectedState) {
+	logger.debug({
+		issuer: oauthConfig.issuer,
+		clientId: oauthConfig.clientId
 	}, "Exchanging authorization code for tokens");
-	let i = await o(await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), t, {
-		pkceCodeVerifier: n,
-		expectedState: r
-	}, { redirect_uri: e.redirect_uri });
-	return d.info({
-		hasAccessToken: !!i.access_token,
-		hasRefreshToken: !!i.refresh_token,
-		expiresIn: i.expires_in
-	}, "Authorization code exchange successful"), i;
+	const config = await openid.discovery(new URL(oauthConfig.issuer), oauthConfig.clientId, oauthConfig.clientSecret, openid.ClientSecretPost(oauthConfig.clientSecret));
+	const tokens = await openid.authorizationCodeGrant(config, callbackUrl, {
+		pkceCodeVerifier: codeVerifier,
+		expectedState
+	}, { redirect_uri: oauthConfig.redirect_uri });
+	logger.info({
+		hasAccessToken: !!tokens.access_token,
+		hasRefreshToken: !!tokens.refresh_token,
+		expiresIn: tokens.expires_in
+	}, "Authorization code exchange successful");
+	return tokens;
 }
-function y(e, n = "roles") {
-	if (!e.id_token) throw Error("OIDC token response is missing id_token");
-	let r = t(e.id_token), i = r[n], a = typeof i == "string" ? [i] : [], o = Array.isArray(i) ? i : a;
-	return d.debug({
-		sub: r.sub,
-		rolesClaim: n,
-		rolesCount: o.length
-	}, "Extracted user from ID token"), {
-		sub: r.sub ?? "",
-		name: r.name,
-		email: r.email,
-		roles: o
+/**
+* Extracts user information from an OIDC token response.
+* Decodes the ID token and extracts standard claims plus roles from a configurable claim.
+*
+* @param tokens - Token response from the OIDC provider
+* @param rolesClaim - Name of the claim containing user roles (default: 'roles')
+* @returns Extracted user information
+*/
+function extractUserFromTokens(tokens, rolesClaim = "roles") {
+	if (!tokens.id_token) throw new Error("OIDC token response is missing id_token");
+	const idToken = decodeJwt(tokens.id_token);
+	const rawRoles = idToken[rolesClaim];
+	const nonArrayRoles = typeof rawRoles === "string" ? [rawRoles] : [];
+	const roles = Array.isArray(rawRoles) ? rawRoles : nonArrayRoles;
+	logger.debug({
+		sub: idToken.sub,
+		rolesClaim,
+		rolesCount: roles.length
+	}, "Extracted user from ID token");
+	return {
+		sub: idToken.sub ?? "",
+		name: idToken.name,
+		email: idToken.email,
+		roles
 	};
 }
-function b(e, t = "roles") {
-	if (!e.access_token) throw Error("OIDC token response is missing access_token");
-	let n = y(e, t);
+/**
+* Builds a Session object from an OIDC token response.
+* Maps provider tokens and user claims into the internal Session format.
+*
+* @param tokens - Token response from the OIDC provider
+* @param rolesClaim - Name of the claim containing user roles (default: 'roles')
+* @returns A Session object ready to be encrypted and stored
+*/
+function buildSessionFromTokens(tokens, rolesClaim = "roles") {
+	if (!tokens.access_token) throw new Error("OIDC token response is missing access_token");
+	const userInfo = extractUserFromTokens(tokens, rolesClaim);
+	let scopes;
+	if (typeof tokens.scope === "string") {
+		const parsed = tokens.scope.split(" ").filter((s) => s.length > 0);
+		if (parsed.length > 0) scopes = parsed;
+	}
 	return {
 		tokens: {
-			accessToken: e.access_token,
-			accessTokenExpiresAt: e.expires_in ? new Date(Date.now() + e.expires_in * 1e3) : void 0,
-			refreshToken: e.refresh_token
+			accessToken: tokens.access_token,
+			accessTokenExpiresAt: tokens.expires_in ? new Date(Date.now() + tokens.expires_in * 1e3) : void 0,
+			refreshToken: tokens.refresh_token
 		},
 		user: {
-			name: n.name,
-			email: n.email,
-			roles: n.roles
-		}
+			name: userInfo.name,
+			email: userInfo.email,
+			roles: userInfo.roles
+		},
+		scopes
 	};
 }
-function x(e, t, n = "/", r) {
-	let i = e ?? n, a;
+/**
+* Validates a return URL against open redirect attacks.
+* Ensures the URL is same-origin and passes optional custom validation.
+*
+* @param returnTo - The raw returnTo path/URL to validate
+* @param applicationOrigin - The application's origin URL (e.g., 'https://example.com')
+* @param defaultPath - Fallback path if validation fails (default: '/')
+* @param validate - Optional custom validation function for the pathname
+* @returns A safe, validated URL
+*/
+function validateReturnUrl(returnTo, applicationOrigin, defaultPath = "/", validate) {
+	const redirectPath = returnTo ?? defaultPath;
+	let redirectUrl;
 	try {
-		a = new URL(i, t);
+		redirectUrl = new URL(redirectPath, applicationOrigin);
 	} catch {
-		return d.warn({ returnTo: i }, "Invalid returnTo URL, using default"), new URL(n, t);
+		logger.warn({ returnTo: redirectPath }, "Invalid returnTo URL, using default");
+		return new URL(defaultPath, applicationOrigin);
+	}
+	const originUrl = new URL(applicationOrigin);
+	if (redirectUrl.origin !== originUrl.origin) {
+		logger.error({
+			returnTo: redirectPath,
+			redirectOrigin: redirectUrl.origin,
+			applicationOrigin: originUrl.origin
+		}, "Possible open redirect attack: returnTo points outside application origin");
+		return new URL(defaultPath, applicationOrigin);
 	}
-	let o = new URL(t);
-	return a.origin === o.origin ? r && !r(a.pathname) ? (d.warn({ pathname: a.pathname }, "returnTo failed custom validation, falling back to default"), new URL(n, t)) : a : (d.error({
-		returnTo: i,
-		redirectOrigin: a.origin,
-		applicationOrigin: o.origin
-	}, "Possible open redirect attack: returnTo points outside application origin"), new URL(n, t));
+	if (validate && !validate(redirectUrl.pathname)) {
+		logger.warn({ pathname: redirectUrl.pathname }, "returnTo failed custom validation, falling back to default");
+		return new URL(defaultPath, applicationOrigin);
+	}
+	return redirectUrl;
 }
-async function S(e, t) {
+/**
+* Discovers the OIDC provider's end_session_endpoint and builds a logout URL.
+* Returns null if the provider doesn't expose an end_session_endpoint.
+*
+* @param oauthConfig - OAuth configuration (issuer, clientId, clientSecret)
+* @param postLogoutRedirectUri - URL to redirect to after provider logout
+* @returns Logout URL or null if not supported
+*/
+async function buildOidcLogoutUrl(oauthConfig, postLogoutRedirectUri) {
 	try {
-		let n = (await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret))).serverMetadata().end_session_endpoint;
-		if (!n) return d.info({ issuer: e.issuer }, "No end_session_endpoint found"), null;
-		let r = new URL(n);
-		return r.searchParams.set("client_id", e.clientId), r.searchParams.set("post_logout_redirect_uri", t), d.debug({ logoutUrl: r.toString() }, "Built OIDC logout URL"), r;
-	} catch (t) {
-		return d.warn({
-			error: t,
-			issuer: e.issuer
-		}, "OIDC discovery failed for logout"), null;
+		const endSessionEndpoint = (await openid.discovery(new URL(oauthConfig.issuer), oauthConfig.clientId, oauthConfig.clientSecret, openid.ClientSecretPost(oauthConfig.clientSecret))).serverMetadata().end_session_endpoint;
+		if (!endSessionEndpoint) {
+			logger.info({ issuer: oauthConfig.issuer }, "No end_session_endpoint found");
+			return null;
+		}
+		const logoutUrl = new URL(endSessionEndpoint);
+		logoutUrl.searchParams.set("client_id", oauthConfig.clientId);
+		logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutRedirectUri);
+		logger.debug({ logoutUrl: logoutUrl.toString() }, "Built OIDC logout URL");
+		return logoutUrl;
+	} catch (error) {
+		logger.warn({
+			error,
+			issuer: oauthConfig.issuer
+		}, "OIDC discovery failed for logout");
+		return null;
 	}
 }
-async function C(e) {
+/**
+* Performs OAuth 2.0 client credentials grant flow for machine-to-machine authentication.
+*
+* @param config - Client credentials configuration including token endpoint, client ID, and secret
+* @returns Token response from the OAuth provider
+* @throws Error if the token request fails
+*
+* @example
+* ```typescript
+* const tokens = await clientCredentialsGrant({
+*   tokenEndpoint: 'https://api.example.com/oauth2/token',
+*   clientId: 'my-client-id',
+*   clientSecret: 'my-client-secret',
+*   scope: 'api:read api:write',
+* });
+* ```
+*/
+async function clientCredentialsGrant(config) {
 	try {
-		let t = new URLSearchParams({
+		const params = new URLSearchParams({
 			grant_type: "client_credentials",
-			client_id: e.clientId,
-			client_secret: e.clientSecret
+			client_id: config.clientId,
+			client_secret: config.clientSecret
 		});
-		e.scope && t.set("scope", e.scope);
-		let n = await fetch(e.tokenEndpoint, {
+		if (config.scope) params.set("scope", config.scope);
+		const response = await fetch(config.tokenEndpoint, {
 			method: "POST",
 			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: t
+			body: params
 		});
-		if (!n.ok) {
-			let e = await n.text();
-			throw d.error({
-				status: n.status,
-				error: e
-			}, "Client credentials grant failed"), Error(`Client credentials grant failed: ${n.status} - ${e}`);
+		if (!response.ok) {
+			const errorText = await response.text();
+			logger.error({
+				status: response.status,
+				error: errorText
+			}, "Client credentials grant failed");
+			throw new Error(`Client credentials grant failed: ${response.status} - ${errorText}`);
 		}
-		return await n.json();
-	} catch (t) {
-		throw d.error({
-			error: t,
-			tokenEndpoint: e.tokenEndpoint
-		}, "Client credentials grant error"), t;
+		return await response.json();
+	} catch (error) {
+		logger.error({
+			error,
+			tokenEndpoint: config.tokenEndpoint
+		}, "Client credentials grant error");
+		throw error;
 	}
 }
 //#endregion
-export { h as buildAuthorizationUrl, g as buildAuthorizationUrlWithPAR, S as buildOidcLogoutUrl, m as buildPKCEOptions, b as buildSessionFromTokens, C as clientCredentialsGrant, f as defaultScope, _ as discoverAndBuildAuthorizationUrl, v as exchangeAuthorizationCode, y as extractUserFromTokens, p as refreshAccessToken, x as validateReturnUrl };
+export { buildAuthorizationUrl, buildAuthorizationUrlWithPAR, buildOidcLogoutUrl, buildPKCEOptions, buildSessionFromTokens, clientCredentialsGrant, defaultScope, discoverAndBuildAuthorizationUrl, exchangeAuthorizationCode, extractUserFromTokens, refreshAccessToken, validateReturnUrl };
+
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","names":[],"sources":["../src/oauth.ts"],"sourcesContent":["import { decodeJwt } from 'jose';\n\nimport * as openid from 'openid-client';\n\nimport { createLogger } from './logger';\nimport { getOAuthErrorLogContext } from './oauth-logging';\nimport type { Session } from './types';\n\nconst logger = createLogger({ namespace: 'fides-auth:oauth' });\n\n// Re-export commonly used types from openid-client for convenience\nexport type { Configuration, TokenEndpointResponse } from 'openid-client';\n\n/** Default OIDC scope requesting user identity, profile, email, and offline access. */\nexport const defaultScope = 'openid profile email offline_access';\n\n/** Configuration for server-side OAuth / OIDC flows. */\nexport type OAuthConfig = {\n  issuer: string;\n  clientId: string;\n  clientSecret: string;\n  redirect_uri: string;\n  scope: string;\n  /**\n   * Opt in to Pushed Authorization Requests (RFC 9126) when the provider\n   * supports it. When true, authorization parameters are posted to the\n   * provider's PAR endpoint ahead of the redirect, and only `client_id` +\n   * `request_uri` travel through the user-agent. The provider must advertise\n   * `pushed_authorization_request_endpoint` in its discovery metadata.\n   */\n  usePar?: boolean;\n};\n\n/**\n * Refreshes an access token using a refresh token grant.\n *\n * @param oAuthConfig - OAuth configuration for the identity provider\n * @param refreshToken - The refresh token to exchange\n * @returns Token endpoint response containing new access and refresh tokens\n */\nexport async function refreshAccessToken(\n  oAuthConfig: OAuthConfig,\n  refreshToken: string,\n): Promise<openid.TokenEndpointResponse> {\n  logger.debug({ issuer: oAuthConfig.issuer }, 'Starting token refresh');\n\n  try {\n    const config = await openid.discovery(\n      new URL(oAuthConfig.issuer),\n      oAuthConfig.clientId,\n      oAuthConfig.clientSecret,\n      openid.ClientSecretPost(oAuthConfig.clientSecret),\n    );\n\n    const tokens = await openid.refreshTokenGrant(\n      config,\n      refreshToken,\n      {\n        scope: oAuthConfig.scope,\n      },\n    );\n\n    logger.info({\n      hasAccessToken: !!tokens.access_token,\n      hasRefreshToken: !!tokens.refresh_token,\n      expiresIn: tokens.expires_in\n    }, 'Token refresh successful');\n\n    return tokens;\n  } catch (error) {\n    const errorContext = getOAuthErrorLogContext(error);\n    const isInvalidGrant =\n      errorContext.code === 'OAUTH_RESPONSE_BODY_ERROR' && errorContext.error === 'invalid_grant';\n\n    if (isInvalidGrant) {\n      // Most often the refresh token has expired - log at info level\n      logger.info(\n        { ...errorContext, issuer: oAuthConfig.issuer },\n        'Token refresh failed - refresh token expired or invalid',\n      );\n    } else {\n      // Unexpected error - log at error level\n      logger.error({ error, issuer: oAuthConfig.issuer }, 'Token refresh failed');\n    }\n\n    throw error;\n  }\n}\n\n/** PKCE parameters generated for an authorization request. */\nexport interface PKCEOptions {\n  code_verifier: string;\n  code_challenge: string;\n  state: string;\n  parameters: Record<string, string>;\n}\n\n/**\n * Creates PKCE parameters for an OAuth flow.\n *\n * @param config - OAuthConfig configuration including the redirect URI and scope.\n * @returns A promise that resolves to an object containing:\n *  - code_verifier: The randomly generated PKCE code verifier.\n *  - code_challenge: The derived PKCE code challenge.\n *  - state: A random state to protect against CSRF.\n *  - parameters: A Record<string,string> with the assembled parameters.\n */\nexport async function buildPKCEOptions(config: OAuthConfig): Promise<PKCEOptions> {\n  const code_verifier = openid.randomPKCECodeVerifier();\n  const code_challenge = await openid.calculatePKCECodeChallenge(code_verifier);\n  const state = openid.randomState();\n\n  const parameters: Record<string, string> = {\n    redirect_uri: config.redirect_uri,\n    scope: config.scope ?? defaultScope,\n    code_challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n\n  logger.info(\n    { redirectUri: config.redirect_uri, scope: parameters.scope },\n    'PKCE parameters generated'\n  );\n\n  return { code_verifier, code_challenge, state, parameters };\n}\n\n/**\n * Builds an authorization URL with PKCE parameters.\n *\n * @param config - Discovered OpenID Configuration (use openid.discovery() to obtain)\n * @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)\n * @returns A Promise that resolves to the authorization URL\n */\nexport async function buildAuthorizationUrl(\n  config: openid.Configuration,\n  pkceOptions: PKCEOptions\n): Promise<URL> {\n  try {\n    const authUrl = openid.buildAuthorizationUrl(config, pkceOptions.parameters);\n    logger.info('Authorization URL built successfully');\n    return authUrl;\n  } catch (error) {\n    logger.error({ error }, 'Failed to build authorization URL');\n    throw error;\n  }\n}\n\n/**\n * Builds an authorization URL using Pushed Authorization Requests (RFC 9126).\n *\n * Posts the PKCE parameters to the provider's PAR endpoint and returns a URL\n * containing only `client_id` and `request_uri`. The provider's discovery\n * metadata must include `pushed_authorization_request_endpoint`.\n *\n * @param config - Discovered OpenID Configuration (use openid.discovery() to obtain)\n * @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)\n * @returns A Promise that resolves to the PAR-based authorization URL\n */\nexport async function buildAuthorizationUrlWithPAR(\n  config: openid.Configuration,\n  pkceOptions: PKCEOptions\n): Promise<URL> {\n  try {\n    const authUrl = await openid.buildAuthorizationUrlWithPAR(\n      config,\n      pkceOptions.parameters,\n    );\n    logger.info('PAR authorization URL built successfully');\n    return authUrl;\n  } catch (error) {\n    logger.error({ error }, 'Failed to build PAR authorization URL');\n    throw error;\n  }\n}\n\n/**\n * Convenience function to discover OpenID configuration and build an\n * authorization URL. Routes through PAR when `oauthConfig.usePar` is true and\n * the provider advertises `pushed_authorization_request_endpoint`.\n *\n * - `usePar === true` + provider advertises PAR → uses PAR.\n * - `usePar === true` + provider does **not** advertise PAR → throws.\n * - `usePar` unset/false + provider advertises PAR → standard flow + one-line\n *   `info` advisory that PAR is available but not enabled.\n * - `usePar` unset/false + no PAR endpoint → standard flow, no advisory.\n *\n * @param oauthConfig - Your OAuth configuration\n * @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)\n * @returns A Promise that resolves to the authorization URL\n */\nexport async function discoverAndBuildAuthorizationUrl(\n  oauthConfig: OAuthConfig,\n  pkceOptions: PKCEOptions\n): Promise<URL> {\n  logger.debug({ issuer: oauthConfig.issuer }, 'Discovering OpenID configuration');\n\n  try {\n    const config = await openid.discovery(\n      new URL(oauthConfig.issuer),\n      oauthConfig.clientId,\n      oauthConfig.clientSecret,\n      openid.ClientSecretPost(oauthConfig.clientSecret)\n    );\n\n    const parEndpoint = config.serverMetadata().pushed_authorization_request_endpoint;\n\n    if (oauthConfig.usePar) {\n      if (!parEndpoint) {\n        throw new Error(\n          'PAR requested (usePar=true) but provider does not advertise pushed_authorization_request_endpoint',\n        );\n      }\n      return buildAuthorizationUrlWithPAR(config, pkceOptions);\n    }\n\n    if (parEndpoint) {\n      logger.info(\n        { issuer: oauthConfig.issuer },\n        'Provider advertises PAR but usePar is not enabled — set OAuthConfig.usePar=true to use it',\n      );\n    }\n\n    return buildAuthorizationUrl(config, pkceOptions);\n  } catch (error) {\n    logger.error({ error, issuer: oauthConfig.issuer }, 'Failed to discover config or build URL');\n    throw error;\n  }\n}\n\n/**\n * Configuration for OAuth client credentials flow (machine-to-machine authentication)\n */\nexport type ClientCredentialsConfig = {\n  /** OAuth token endpoint URL */\n  tokenEndpoint: string;\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret */\n  clientSecret: string;\n  /** Optional scope for the access token */\n  scope?: string;\n};\n\n/**\n * Exchanges an authorization code for tokens using OIDC discovery and PKCE.\n *\n * @param oauthConfig - OAuth configuration\n * @param callbackUrl - The full callback URL with query parameters from the OIDC provider\n * @param codeVerifier - The PKCE code verifier stored during login initiation\n * @param expectedState - The state parameter stored during login initiation\n * @returns Token response from the OIDC provider\n */\nexport async function exchangeAuthorizationCode(\n  oauthConfig: OAuthConfig,\n  callbackUrl: URL,\n  codeVerifier: string,\n  expectedState: string,\n): Promise<openid.TokenEndpointResponse> {\n  logger.debug(\n    { issuer: oauthConfig.issuer, clientId: oauthConfig.clientId },\n    'Exchanging authorization code for tokens',\n  );\n\n  const config = await openid.discovery(\n    new URL(oauthConfig.issuer),\n    oauthConfig.clientId,\n    oauthConfig.clientSecret,\n    openid.ClientSecretPost(oauthConfig.clientSecret),\n  );\n\n  const tokens = await openid.authorizationCodeGrant(\n    config,\n    callbackUrl,\n    {\n      pkceCodeVerifier: codeVerifier,\n      expectedState,\n    },\n    { redirect_uri: oauthConfig.redirect_uri },\n  );\n\n  logger.info(\n    {\n      hasAccessToken: !!tokens.access_token,\n      hasRefreshToken: !!tokens.refresh_token,\n      expiresIn: tokens.expires_in,\n    },\n    'Authorization code exchange successful',\n  );\n\n  return tokens;\n}\n\n/**\n * Result of extracting user information from an OIDC token response.\n */\nexport interface OidcUserInfo {\n  sub: string;\n  name: string;\n  email: string;\n  roles: string[];\n}\n\n/**\n * Extracts user information from an OIDC token response.\n * Decodes the ID token and extracts standard claims plus roles from a configurable claim.\n *\n * @param tokens - Token response from the OIDC provider\n * @param rolesClaim - Name of the claim containing user roles (default: 'roles')\n * @returns Extracted user information\n */\nexport function extractUserFromTokens(\n  tokens: openid.TokenEndpointResponse,\n  rolesClaim: string = 'roles',\n): OidcUserInfo {\n  if (!tokens.id_token) {\n    throw new Error('OIDC token response is missing id_token');\n  }\n\n  const idToken = decodeJwt(tokens.id_token);\n\n  // Normalize roles: some providers send a single string instead of an array\n  const rawRoles = idToken[rolesClaim];\n  const nonArrayRoles = typeof rawRoles === 'string' ? [rawRoles] : [];\n  const roles = Array.isArray(rawRoles) ? rawRoles : nonArrayRoles;\n\n  logger.debug({ sub: idToken.sub, rolesClaim, rolesCount: roles.length }, 'Extracted user from ID token');\n\n  return {\n    sub: idToken.sub ?? '',\n    name: idToken.name as string,\n    email: idToken.email as string,\n    roles,\n  };\n}\n\n/**\n * Builds a Session object from an OIDC token response.\n * Maps provider tokens and user claims into the internal Session format.\n *\n * @param tokens - Token response from the OIDC provider\n * @param rolesClaim - Name of the claim containing user roles (default: 'roles')\n * @returns A Session object ready to be encrypted and stored\n */\nexport function buildSessionFromTokens(\n  tokens: openid.TokenEndpointResponse,\n  rolesClaim: string = 'roles',\n): Session {\n  if (!tokens.access_token) {\n    throw new Error('OIDC token response is missing access_token');\n  }\n\n  const userInfo = extractUserFromTokens(tokens, rolesClaim);\n\n  let scopes: string[] | undefined;\n  if (typeof tokens.scope === 'string') {\n    const parsed = tokens.scope.split(' ').filter(s => s.length > 0);\n    if (parsed.length > 0) scopes = parsed;\n  }\n\n  return {\n    tokens: {\n      accessToken: tokens.access_token,\n      accessTokenExpiresAt: tokens.expires_in\n        ? new Date(Date.now() + tokens.expires_in * 1000)\n        : undefined,\n      refreshToken: tokens.refresh_token,\n    },\n    user: {\n      name: userInfo.name,\n      email: userInfo.email,\n      roles: userInfo.roles,\n    },\n    scopes,\n  };\n}\n\n/**\n * Validates a return URL against open redirect attacks.\n * Ensures the URL is same-origin and passes optional custom validation.\n *\n * @param returnTo - The raw returnTo path/URL to validate\n * @param applicationOrigin - The application's origin URL (e.g., 'https://example.com')\n * @param defaultPath - Fallback path if validation fails (default: '/')\n * @param validate - Optional custom validation function for the pathname\n * @returns A safe, validated URL\n */\nexport function validateReturnUrl(\n  returnTo: string | null | undefined,\n  applicationOrigin: string,\n  defaultPath: string = '/',\n  validate?: (pathname: string) => boolean,\n): URL {\n  const redirectPath = returnTo ?? defaultPath;\n  let redirectUrl: URL;\n\n  try {\n    redirectUrl = new URL(redirectPath, applicationOrigin);\n  } catch {\n    logger.warn({ returnTo: redirectPath }, 'Invalid returnTo URL, using default');\n    return new URL(defaultPath, applicationOrigin);\n  }\n\n  // Enforce same-origin — cross-origin returnTo is a potential open redirect attack\n  const originUrl = new URL(applicationOrigin);\n  if (redirectUrl.origin !== originUrl.origin) {\n    logger.error(\n      { returnTo: redirectPath, redirectOrigin: redirectUrl.origin, applicationOrigin: originUrl.origin },\n      'Possible open redirect attack: returnTo points outside application origin',\n    );\n    return new URL(defaultPath, applicationOrigin);\n  }\n\n  // Custom validation\n  if (validate && !validate(redirectUrl.pathname)) {\n    logger.warn(\n      { pathname: redirectUrl.pathname },\n      'returnTo failed custom validation, falling back to default',\n    );\n    return new URL(defaultPath, applicationOrigin);\n  }\n\n  return redirectUrl;\n}\n\n/**\n * Discovers the OIDC provider's end_session_endpoint and builds a logout URL.\n * Returns null if the provider doesn't expose an end_session_endpoint.\n *\n * @param oauthConfig - OAuth configuration (issuer, clientId, clientSecret)\n * @param postLogoutRedirectUri - URL to redirect to after provider logout\n * @returns Logout URL or null if not supported\n */\nexport async function buildOidcLogoutUrl(\n  oauthConfig: OAuthConfig,\n  postLogoutRedirectUri: string,\n): Promise<URL | null> {\n  try {\n    const config = await openid.discovery(\n      new URL(oauthConfig.issuer),\n      oauthConfig.clientId,\n      oauthConfig.clientSecret,\n      openid.ClientSecretPost(oauthConfig.clientSecret),\n    );\n    const endSessionEndpoint = config.serverMetadata().end_session_endpoint;\n\n    if (!endSessionEndpoint) {\n      logger.info({ issuer: oauthConfig.issuer }, 'No end_session_endpoint found');\n      return null;\n    }\n\n    const logoutUrl = new URL(endSessionEndpoint);\n    logoutUrl.searchParams.set('client_id', oauthConfig.clientId);\n    logoutUrl.searchParams.set('post_logout_redirect_uri', postLogoutRedirectUri);\n\n    logger.debug({ logoutUrl: logoutUrl.toString() }, 'Built OIDC logout URL');\n    return logoutUrl;\n  } catch (error) {\n    logger.warn({ error, issuer: oauthConfig.issuer }, 'OIDC discovery failed for logout');\n    return null;\n  }\n}\n\n/**\n * Performs OAuth 2.0 client credentials grant flow for machine-to-machine authentication.\n *\n * @param config - Client credentials configuration including token endpoint, client ID, and secret\n * @returns Token response from the OAuth provider\n * @throws Error if the token request fails\n *\n * @example\n * ```typescript\n * const tokens = await clientCredentialsGrant({\n *   tokenEndpoint: 'https://api.example.com/oauth2/token',\n *   clientId: 'my-client-id',\n *   clientSecret: 'my-client-secret',\n *   scope: 'api:read api:write',\n * });\n * ```\n */\nexport async function clientCredentialsGrant(\n  config: ClientCredentialsConfig\n): Promise<openid.TokenEndpointResponse> {\n  try {\n    const params = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: config.clientId,\n      client_secret: config.clientSecret,\n    });\n\n    if (config.scope) {\n      params.set('scope', config.scope);\n    }\n\n    const response = await fetch(config.tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: params,\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      logger.error(\n        { status: response.status, error: errorText },\n        'Client credentials grant failed'\n      );\n      throw new Error(`Client credentials grant failed: ${response.status} - ${errorText}`);\n    }\n\n    return (await response.json()) as openid.TokenEndpointResponse;\n  } catch (error) {\n    logger.error({ error, tokenEndpoint: config.tokenEndpoint }, 'Client credentials grant error');\n    throw error;\n  }\n}\n"],"mappings":";;;;;AAQA,IAAM,SAAS,aAAa,EAAE,WAAW,oBAAoB,CAAC;;AAM9D,IAAa,eAAe;;;;;;;;AA0B5B,eAAsB,mBACpB,aACA,cACuC;AACvC,QAAO,MAAM,EAAE,QAAQ,YAAY,QAAQ,EAAE,yBAAyB;AAEtE,KAAI;EACF,MAAM,SAAS,MAAM,OAAO,UAC1B,IAAI,IAAI,YAAY,OAAO,EAC3B,YAAY,UACZ,YAAY,cACZ,OAAO,iBAAiB,YAAY,aAAa,CAClD;EAED,MAAM,SAAS,MAAM,OAAO,kBAC1B,QACA,cACA,EACE,OAAO,YAAY,OACpB,CACF;AAED,SAAO,KAAK;GACV,gBAAgB,CAAC,CAAC,OAAO;GACzB,iBAAiB,CAAC,CAAC,OAAO;GAC1B,WAAW,OAAO;GACnB,EAAE,2BAA2B;AAE9B,SAAO;UACA,OAAO;EACd,MAAM,eAAe,wBAAwB,MAAM;AAInD,MAFE,aAAa,SAAS,+BAA+B,aAAa,UAAU,gBAI5E,QAAO,KACL;GAAE,GAAG;GAAc,QAAQ,YAAY;GAAQ,EAC/C,0DACD;MAGD,QAAO,MAAM;GAAE;GAAO,QAAQ,YAAY;GAAQ,EAAE,uBAAuB;AAG7E,QAAM;;;;;;;;;;;;;AAsBV,eAAsB,iBAAiB,QAA2C;CAChF,MAAM,gBAAgB,OAAO,wBAAwB;CACrD,MAAM,iBAAiB,MAAM,OAAO,2BAA2B,cAAc;CAC7E,MAAM,QAAQ,OAAO,aAAa;CAElC,MAAM,aAAqC;EACzC,cAAc,OAAO;EACrB,OAAO,OAAO,SAAA;EACd;EACA,uBAAuB;EACvB;EACD;AAED,QAAO,KACL;EAAE,aAAa,OAAO;EAAc,OAAO,WAAW;EAAO,EAC7D,4BACD;AAED,QAAO;EAAE;EAAe;EAAgB;EAAO;EAAY;;;;;;;;;AAU7D,eAAsB,sBACpB,QACA,aACc;AACd,KAAI;EACF,MAAM,UAAU,OAAO,sBAAsB,QAAQ,YAAY,WAAW;AAC5E,SAAO,KAAK,uCAAuC;AACnD,SAAO;UACA,OAAO;AACd,SAAO,MAAM,EAAE,OAAO,EAAE,oCAAoC;AAC5D,QAAM;;;;;;;;;;;;;;AAeV,eAAsB,6BACpB,QACA,aACc;AACd,KAAI;EACF,MAAM,UAAU,MAAM,OAAO,6BAC3B,QACA,YAAY,WACb;AACD,SAAO,KAAK,2CAA2C;AACvD,SAAO;UACA,OAAO;AACd,SAAO,MAAM,EAAE,OAAO,EAAE,wCAAwC;AAChE,QAAM;;;;;;;;;;;;;;;;;;AAmBV,eAAsB,iCACpB,aACA,aACc;AACd,QAAO,MAAM,EAAE,QAAQ,YAAY,QAAQ,EAAE,mCAAmC;AAEhF,KAAI;EACF,MAAM,SAAS,MAAM,OAAO,UAC1B,IAAI,IAAI,YAAY,OAAO,EAC3B,YAAY,UACZ,YAAY,cACZ,OAAO,iBAAiB,YAAY,aAAa,CAClD;EAED,MAAM,cAAc,OAAO,gBAAgB,CAAC;AAE5C,MAAI,YAAY,QAAQ;AACtB,OAAI,CAAC,YACH,OAAM,IAAI,MACR,oGACD;AAEH,UAAO,6BAA6B,QAAQ,YAAY;;AAG1D,MAAI,YACF,QAAO,KACL,EAAE,QAAQ,YAAY,QAAQ,EAC9B,4FACD;AAGH,SAAO,sBAAsB,QAAQ,YAAY;UAC1C,OAAO;AACd,SAAO,MAAM;GAAE;GAAO,QAAQ,YAAY;GAAQ,EAAE,yCAAyC;AAC7F,QAAM;;;;;;;;;;;;AA2BV,eAAsB,0BACpB,aACA,aACA,cACA,eACuC;AACvC,QAAO,MACL;EAAE,QAAQ,YAAY;EAAQ,UAAU,YAAY;EAAU,EAC9D,2CACD;CAED,MAAM,SAAS,MAAM,OAAO,UAC1B,IAAI,IAAI,YAAY,OAAO,EAC3B,YAAY,UACZ,YAAY,cACZ,OAAO,iBAAiB,YAAY,aAAa,CAClD;CAED,MAAM,SAAS,MAAM,OAAO,uBAC1B,QACA,aACA;EACE,kBAAkB;EAClB;EACD,EACD,EAAE,cAAc,YAAY,cAAc,CAC3C;AAED,QAAO,KACL;EACE,gBAAgB,CAAC,CAAC,OAAO;EACzB,iBAAiB,CAAC,CAAC,OAAO;EAC1B,WAAW,OAAO;EACnB,EACD,yCACD;AAED,QAAO;;;;;;;;;;AAqBT,SAAgB,sBACd,QACA,aAAqB,SACP;AACd,KAAI,CAAC,OAAO,SACV,OAAM,IAAI,MAAM,0CAA0C;CAG5D,MAAM,UAAU,UAAU,OAAO,SAAS;CAG1C,MAAM,WAAW,QAAQ;CACzB,MAAM,gBAAgB,OAAO,aAAa,WAAW,CAAC,SAAS,GAAG,EAAE;CACpE,MAAM,QAAQ,MAAM,QAAQ,SAAS,GAAG,WAAW;AAEnD,QAAO,MAAM;EAAE,KAAK,QAAQ;EAAK;EAAY,YAAY,MAAM;EAAQ,EAAE,+BAA+B;AAExG,QAAO;EACL,KAAK,QAAQ,OAAO;EACpB,MAAM,QAAQ;EACd,OAAO,QAAQ;EACf;EACD;;;;;;;;;;AAWH,SAAgB,uBACd,QACA,aAAqB,SACZ;AACT,KAAI,CAAC,OAAO,aACV,OAAM,IAAI,MAAM,8CAA8C;CAGhE,MAAM,WAAW,sBAAsB,QAAQ,WAAW;CAE1D,IAAI;AACJ,KAAI,OAAO,OAAO,UAAU,UAAU;EACpC,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI,CAAC,QAAO,MAAK,EAAE,SAAS,EAAE;AAChE,MAAI,OAAO,SAAS,EAAG,UAAS;;AAGlC,QAAO;EACL,QAAQ;GACN,aAAa,OAAO;GACpB,sBAAsB,OAAO,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,aAAa,IAAK,GAC/C,KAAA;GACJ,cAAc,OAAO;GACtB;EACD,MAAM;GACJ,MAAM,SAAS;GACf,OAAO,SAAS;GAChB,OAAO,SAAS;GACjB;EACD;EACD;;;;;;;;;;;;AAaH,SAAgB,kBACd,UACA,mBACA,cAAsB,KACtB,UACK;CACL,MAAM,eAAe,YAAY;CACjC,IAAI;AAEJ,KAAI;AACF,gBAAc,IAAI,IAAI,cAAc,kBAAkB;SAChD;AACN,SAAO,KAAK,EAAE,UAAU,cAAc,EAAE,sCAAsC;AAC9E,SAAO,IAAI,IAAI,aAAa,kBAAkB;;CAIhD,MAAM,YAAY,IAAI,IAAI,kBAAkB;AAC5C,KAAI,YAAY,WAAW,UAAU,QAAQ;AAC3C,SAAO,MACL;GAAE,UAAU;GAAc,gBAAgB,YAAY;GAAQ,mBAAmB,UAAU;GAAQ,EACnG,4EACD;AACD,SAAO,IAAI,IAAI,aAAa,kBAAkB;;AAIhD,KAAI,YAAY,CAAC,SAAS,YAAY,SAAS,EAAE;AAC/C,SAAO,KACL,EAAE,UAAU,YAAY,UAAU,EAClC,6DACD;AACD,SAAO,IAAI,IAAI,aAAa,kBAAkB;;AAGhD,QAAO;;;;;;;;;;AAWT,eAAsB,mBACpB,aACA,uBACqB;AACrB,KAAI;EAOF,MAAM,sBAAqB,MANN,OAAO,UAC1B,IAAI,IAAI,YAAY,OAAO,EAC3B,YAAY,UACZ,YAAY,cACZ,OAAO,iBAAiB,YAAY,aAAa,CAClD,EACiC,gBAAgB,CAAC;AAEnD,MAAI,CAAC,oBAAoB;AACvB,UAAO,KAAK,EAAE,QAAQ,YAAY,QAAQ,EAAE,gCAAgC;AAC5E,UAAO;;EAGT,MAAM,YAAY,IAAI,IAAI,mBAAmB;AAC7C,YAAU,aAAa,IAAI,aAAa,YAAY,SAAS;AAC7D,YAAU,aAAa,IAAI,4BAA4B,sBAAsB;AAE7E,SAAO,MAAM,EAAE,WAAW,UAAU,UAAU,EAAE,EAAE,wBAAwB;AAC1E,SAAO;UACA,OAAO;AACd,SAAO,KAAK;GAAE;GAAO,QAAQ,YAAY;GAAQ,EAAE,mCAAmC;AACtF,SAAO;;;;;;;;;;;;;;;;;;;;AAqBX,eAAsB,uBACpB,QACuC;AACvC,KAAI;EACF,MAAM,SAAS,IAAI,gBAAgB;GACjC,YAAY;GACZ,WAAW,OAAO;GAClB,eAAe,OAAO;GACvB,CAAC;AAEF,MAAI,OAAO,MACT,QAAO,IAAI,SAAS,OAAO,MAAM;EAGnC,MAAM,WAAW,MAAM,MAAM,OAAO,eAAe;GACjD,QAAQ;GACR,SAAS,EAAE,gBAAgB,qCAAqC;GAChE,MAAM;GACP,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,MAAM;AACvC,UAAO,MACL;IAAE,QAAQ,SAAS;IAAQ,OAAO;IAAW,EAC7C,kCACD;AACD,SAAM,IAAI,MAAM,oCAAoC,SAAS,OAAO,KAAK,YAAY;;AAGvF,SAAQ,MAAM,SAAS,MAAM;UACtB,OAAO;AACd,SAAO,MAAM;GAAE;GAAO,eAAe,OAAO;GAAe,EAAE,iCAAiC;AAC9F,QAAM"}