@hawcx/oauth-client 0.1.0 → 4.0.1

package/dist/delegation/hawcx.js

@@ -1,152 +1,132 @@
 "use strict";
 /**
- * Hawcx-specific delegation client with high-level convenience methods.
- *
- * This module provides a streamlined API for common Hawcx operations like
- * MFA configuration, user management, and device operations. All cryptographic
- * operations (encryption, signing, verification) are handled automatically.
+ * Hawcx delegation client with ergonomic, high-level operations.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HawcxDelegationClient = exports.MfaMethod = void 0;
-const client_1 = require("./client");
-const crypto_1 = require("./crypto");
+exports.DelegationClient = exports.MfaMethod = void 0;
+const factory_1 = require("./factory");
 const exceptions_1 = require("./exceptions");
-/**
- * Supported MFA methods for Hawcx authentication.
- *
- * This enum ensures type safety and prevents typos when specifying MFA methods.
- *
- * @example
- * ```typescript
- * import { MfaMethod } from '@hawcx/oauth-client';
- *
- * // Use enum for type safety
- * await client.initiateMfaChange({
- *   userid: "user@example.com",
- *   mfaMethod: MfaMethod.SMS,  // Type-safe!
- *   phoneNumber: "+15551234567"
- * });
- *
- * // String values still work for backwards compatibility
- * await client.initiateMfaChange({
- *   userid: "user@example.com",
- *   mfaMethod: "sms",  // Also works
- *   phoneNumber: "+15551234567"
- * });
- * ```
- */
 var MfaMethod;
 (function (MfaMethod) {
     MfaMethod["EMAIL"] = "email";
     MfaMethod["SMS"] = "sms";
     MfaMethod["TOTP"] = "totp";
 })(MfaMethod || (exports.MfaMethod = MfaMethod = {}));
-/**
- * High-level client for Hawcx delegation operations.
- *
- * This client provides simplified methods for common Hawcx operations:
- * - MFA configuration (email, SMS, TOTP)
- * - User credential management
- * - Device operations
- *
- * All requests are automatically encrypted (ECIES) and signed (Ed25519/RSA-PSS).
- * All responses are automatically verified and decrypted.
- *
- * @example
- * ```typescript
- * // Initialize from keys
- * const client = HawcxDelegationClient.fromKeys({
- *   spSigningKey: process.env.SP_SIGNING_KEY!,
- *   spEncryptionKey: process.env.SP_ENCRYPTION_KEY!,
- *   idpVerifyKey: process.env.IDP_VERIFY_KEY!,
- *   idpEncryptionKey: process.env.IDP_ENCRYPTION_KEY!,
- *   baseUrl: 'https://ceasar-api.hawcx.com',
- *   spId: 'my-client-id'
- * });
- *
- * // Initiate SMS MFA setup
- * const result = await client.initiateMfaChange({
- *   userid: "user@example.com",
- *   mfaMethod: "sms",
- *   phoneNumber: "+15551234567"
- * });
- * console.log(result.session_id);
- *
- * // Verify OTP
- * await client.verifyMfaChange({
- *   userid: "user@example.com",
- *   sessionId: result.session_id,
- *   otp: "123456"
- * });
- * ```
- */
-class HawcxDelegationClient {
+class DelegationClient {
     constructor(options) {
-        this.client = new client_1.IdpDelegationClient({
-            baseUrl: options.baseUrl,
-            signer: options.signer,
-            verifier: options.verifier,
-            encryptor: options.encryptor,
-            decryptor: options.decryptor,
-            spId: options.spId,
-            timeout: options.timeout,
-        });
+        this.mfa = {
+            initiate: async (options) => {
+                const { userId, mfaMethod, phoneNumber, mfaChangeTo } = options;
+                const mfaMethodStr = typeof mfaMethod === 'string' ? mfaMethod : String(mfaMethod);
+                const mfaChangeToStr = mfaChangeTo ? String(mfaChangeTo) : undefined;
+                const validMethods = [MfaMethod.EMAIL, MfaMethod.SMS, MfaMethod.TOTP];
+                if (!validMethods.includes(mfaMethodStr)) {
+                    throw new exceptions_1.DelegationRequestError(`Invalid mfa_method '${mfaMethodStr}'. Must be one of: ${validMethods.join(', ')}`);
+                }
+                if (mfaMethodStr === MfaMethod.SMS && !phoneNumber) {
+                    throw new exceptions_1.DelegationRequestError('phoneNumber is required for SMS MFA');
+                }
+                const payload = {
+                    userid: userId,
+                    mfa_method: mfaMethodStr,
+                };
+                if (mfaMethodStr === MfaMethod.SMS && phoneNumber) {
+                    payload.contact = phoneNumber;
+                }
+                if (mfaChangeToStr) {
+                    payload.mfa_change_to = mfaChangeToStr;
+                }
+                return await this.request({
+                    endpoint: '/hc_auth/v5/update/initiate',
+                    payload,
+                });
+            },
+            verify: async (options) => {
+                const { userId, sessionId, otp } = options;
+                if (otp?.length !== 6 || !/^\d{6}$/.test(otp)) {
+                    throw new exceptions_1.DelegationRequestError('OTP must be a 6-digit code');
+                }
+                const payload = {
+                    userid: userId,
+                    session_id: sessionId,
+                    otp,
+                };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/update/verify',
+                    payload,
+                });
+            },
+        };
+        this.users = {
+            getCredentials: async (userId) => {
+                const payload = { userid: userId };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/update/get-creds',
+                    payload,
+                });
+            },
+            getPhone: async (userId) => {
+                const payload = { userid: userId };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/management/users/phone',
+                    payload,
+                });
+            },
+            updatePhone: async (options) => {
+                const payload = {
+                    userid: options.userId,
+                    new_phone_number: options.newPhoneNumber,
+                };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/management/users/phone',
+                    payload,
+                });
+            },
+        };
+        this.devices = {
+            list: async (userId) => {
+                const payload = { userid: userId };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/manage/devices',
+                    payload,
+                });
+            },
+            revoke: async (options) => {
+                const payload = { userid: options.userId, h2index: options.deviceId };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/manage/revoke',
+                    payload,
+                });
+            },
+            unrevoke: async (options) => {
+                const payload = { userid: options.userId, h2index: options.deviceId };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/manage/unrevoke',
+                    payload,
+                });
+            },
+            delete: async (options) => {
+                const payload = { userid: options.userId, h2index: options.deviceId };
+                return await this.request({
+                    endpoint: '/hc_auth/v5/manage/delete',
+                    payload,
+                });
+            },
+        };
+        this.transport = options.transport;
         this.apiKey = options.apiKey;
         this.baseUrl = options.baseUrl;
-        this.spId = options.spId;
     }
-    /**
-     * Create client from explicit key values (recommended).
-     *
-     * This method allows the application to load keys from any source
-     * (env vars, config files, secrets manager, etc.) and pass them
-     * as values to the SDK.
-     *
-     * @param options - Configuration options
-     * @returns Configured HawcxDelegationClient instance
-     * @throws DelegationRequestError if key initialization fails
-     *
-     * @example
-     * ```typescript
-     * import * as process from 'process';
-     *
-     * // App controls how to load keys
-     * const client = HawcxDelegationClient.fromKeys({
-     *   spSigningKey: process.env.MY_SIGNING_KEY!,
-     *   spEncryptionKey: process.env.MY_ENCRYPTION_KEY!,
-     *   idpVerifyKey: process.env.IDP_VERIFY_KEY!,
-     *   idpEncryptionKey: process.env.IDP_ENCRYPT_KEY!,
-     *   baseUrl: process.env.HAWCX_URL!,
-     *   spId: process.env.MY_CLIENT_ID!
-     * });
-     * ```
-     */
+    static fromSecretKey(options) {
+        const { apiKey, baseUrl } = options;
+        const transport = (0, factory_1.buildTransportFromSecretKey)(options);
+        return new DelegationClient({ transport, apiKey, baseUrl });
+    }
     static fromKeys(options) {
-        const { spSigningKey, spEncryptionKey, idpVerifyKey, idpEncryptionKey, baseUrl, spId, apiKey, timeout = 15, kid = 'hawcx', idpKid = 'hawcx', } = options;
-        try {
-            const signer = new crypto_1.Ed25519Signer(spSigningKey, kid);
-            const verifier = new crypto_1.Verifier({ [idpKid]: idpVerifyKey });
-            const encryptor = new crypto_1.EciesX25519Encryptor(idpEncryptionKey);
-            const decryptor = new crypto_1.EciesX25519Decryptor(spEncryptionKey);
-            console.log(`Initialized HawcxDelegationClient with base_url=${baseUrl}, sp_id=${spId}`);
-            return new HawcxDelegationClient({
-                baseUrl,
-                signer,
-                verifier,
-                encryptor,
-                decryptor,
-                spId,
-                apiKey,
-                timeout,
-            });
-        }
-        catch (error) {
-            throw new exceptions_1.DelegationRequestError(`Failed to initialize crypto helpers: ${error}`);
-        }
+        const { apiKey, baseUrl } = options;
+        const transport = (0, factory_1.buildTransportFromKeys)(options);
+        return new DelegationClient({ transport, apiKey, baseUrl });
     }
-    /**
-     * Build Hawcx API authentication headers
-     */
     buildAuthHeaders() {
         const headers = {};
         if (this.apiKey) {
@@ -154,173 +134,10 @@ class HawcxDelegationClient {
         }
         return headers;
     }
-    /**
-     * Initiate MFA setup or change for a user.
-     *
-     * This method starts the MFA enrollment/update process by sending an OTP
-     * to the user via their chosen method (email, SMS, or generating a TOTP secret).
-     *
-     * @param options - MFA initiation configuration
-     * @returns Dictionary containing session_id and optional TOTP details
-     * @throws DelegationRequestError if request fails or parameters are invalid
-     * @throws Error if SMS method specified without phone_number
-     *
-     * @example
-     * ```typescript
-     * import { MfaMethod } from '@hawcx/oauth-client';
-     *
-     * // Email MFA (with enum - recommended!)
-     * const result = await client.initiateMfaChange({
-     *   userid: "user@example.com",
-     *   mfaMethod: MfaMethod.EMAIL
-     * });
-     *
-     * // SMS MFA (string also works)
-     * const result = await client.initiateMfaChange({
-     *   userid: "user@example.com",
-     *   mfaMethod: "sms",
-     *   phoneNumber: "+15551234567"
-     * });
-     *
-     * // TOTP MFA
-     * const result = await client.initiateMfaChange({
-     *   userid: "user@example.com",
-     *   mfaMethod: MfaMethod.TOTP
-     * });
-     * console.log(`Scan QR code: ${result.otpauth_uri}`);
-     * ```
-     */
-    async initiateMfaChange(options) {
-        const { userid, mfaMethod, phoneNumber, mfaChangeTo } = options;
-        // Convert enum to string if needed
-        const mfaMethodStr = typeof mfaMethod === 'string' ? mfaMethod : String(mfaMethod);
-        const mfaChangeToStr = mfaChangeTo
-            ? typeof mfaChangeTo === 'string'
-                ? mfaChangeTo
-                : String(mfaChangeTo)
-            : undefined;
-        // Validate method
-        const validMethods = [MfaMethod.EMAIL, MfaMethod.SMS, MfaMethod.TOTP];
-        if (!validMethods.includes(mfaMethodStr)) {
-            throw new Error(`Invalid mfa_method '${mfaMethodStr}'. Must be one of: ${validMethods.join(', ')}`);
-        }
-        // Validate SMS requires phone number
-        if (mfaMethodStr === MfaMethod.SMS && !phoneNumber) {
-            throw new Error('phone_number is required for SMS MFA');
-        }
-        // Build Hawcx UpdateTable API payload
-        const payload = {
-            userid,
-            mfa_method: mfaMethodStr,
-        };
-        // Add SMS phone number
-        if (mfaMethodStr === MfaMethod.SMS && phoneNumber) {
-            payload.contact = phoneNumber;
-        }
-        // Add target method if changing
-        if (mfaChangeToStr) {
-            payload.mfa_change_to = mfaChangeToStr;
-        }
-        console.log(`[MFA Initiate] Method=${mfaMethodStr} for user=${userid}`);
-        try {
-            const response = await this.client.sendSecureRequest({
-                endpoint: '/hc_auth/v5/update/initiate',
-                payload,
-                extraHeaders: this.buildAuthHeaders(),
-            });
-            console.log(`[MFA Initiate] Success for user=${userid}, session_id=${response.session_id}`);
-            return response;
-        }
-        catch (error) {
-            console.error(`[MFA Initiate] Failed for user=${userid}:`, error);
-            throw error;
-        }
-    }
-    /**
-     * Verify OTP and complete MFA configuration change.
-     *
-     * This method verifies the OTP sent to the user and completes the MFA
-     * enrollment/update process.
-     *
-     * @param options - MFA verification configuration
-     * @returns Dictionary containing success message and optional mfa_changed_to
-     * @throws DelegationRequestError if verification fails
-     * @throws Error if OTP format is invalid
-     *
-     * @example
-     * ```typescript
-     * // Get OTP from user
-     * const otp = getUserInput();
-     *
-     * // Verify and complete MFA setup
-     * const result = await client.verifyMfaChange({
-     *   userid: "user@example.com",
-     *   sessionId: sessionId,
-     *   otp: otp
-     * });
-     * console.log(`MFA updated: ${result.detail}`);
-     * ```
-     */
-    async verifyMfaChange(options) {
-        const { userid, sessionId, otp } = options;
-        // Validate OTP format
-        if (!otp || otp.length !== 6 || !/^\d{6}$/.test(otp)) {
-            throw new Error('OTP must be a 6-digit code');
-        }
-        // Build Hawcx UpdateTable API payload
-        const payload = {
-            userid,
-            session_id: sessionId,
-            otp,
-        };
-        console.log(`[MFA Verify] Verifying OTP for user=${userid}, session=${sessionId}`);
-        try {
-            const response = await this.client.sendSecureRequest({
-                endpoint: '/hc_auth/v5/update/verify',
-                payload,
-                extraHeaders: this.buildAuthHeaders(),
-            });
-            console.log(`[MFA Verify] Success for user=${userid}`);
-            return response;
-        }
-        catch (error) {
-            console.error(`[MFA Verify] Failed for user=${userid}:`, error);
-            throw error;
-        }
-    }
-    /**
-     * Get user's stored credentials and MFA status.
-     *
-     * This method retrieves the user's credentials from Hawcx, including
-     * their current MFA configuration.
-     *
-     * @param userid - User identifier
-     * @returns Dictionary containing user credentials and MFA status
-     *
-     * @example
-     * ```typescript
-     * const creds = await client.getUserCredentials("user@example.com");
-     * console.log(`MFA method: ${creds.mfa_method}`);
-     * console.log(`Phone: ${creds.contact}`);
-     * ```
-     */
-    async getUserCredentials(userid) {
-        const payload = { userid };
-        console.log(`[Get Creds] Fetching credentials for user=${userid}`);
-        try {
-            const response = await this.client.sendSecureRequest({
-                endpoint: '/hc_auth/v5/update/get-creds',
-                payload,
-                extraHeaders: this.buildAuthHeaders(),
-            });
-            console.log(`[Get Creds] Success for user=${userid}`);
-            return response;
-        }
-        catch (error) {
-            console.error(`[Get Creds] Failed for user=${userid}:`, error);
-            throw error;
-        }
+    async request(options) {
+        const headers = { ...this.buildAuthHeaders(), ...(options.headers ?? {}) };
+        return await this.transport.send({ ...options, headers });
     }
 }
-exports.HawcxDelegationClient = HawcxDelegationClient;
+exports.DelegationClient = DelegationClient;
 //# sourceMappingURL=hawcx.js.map

package/dist/delegation/hawcx.js.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,qCAAuD;AACvD,qCAKkB;AAClB,6CAAsD;AAEtD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AAsDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAa,qBAAqB;IAMhC,YAAY,OASX;QACC,IAAI,CAAC,MAAM,GAAG,IAAI,4BAAmB,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EACJ,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,OAAO,EACP,IAAI,EACJ,MAAM,EACN,OAAO,GAAG,EAAE,EACZ,GAAG,GAAG,OAAO,EACb,MAAM,GAAG,OAAO,GACjB,GAAG,OAAO,CAAC;QAEZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,iBAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,6BAAoB,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,6BAAoB,CAAC,eAAe,CAAC,CAAC;YAE5D,OAAO,CAAC,GAAG,CAAC,mDAAmD,OAAO,WAAW,IAAI,EAAE,CAAC,CAAC;YAEzF,OAAO,IAAI,qBAAqB,CAAC;gBAC/B,OAAO;gBACP,MAAM;gBACN,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,IAAI;gBACJ,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC;QACvD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAEhE,mCAAmC;QACnC,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,cAAc,GAAG,WAAW;YAChC,CAAC,CAAC,OAAO,WAAW,KAAK,QAAQ;gBAC/B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;YACvB,CAAC,CAAC,SAAS,CAAC;QAEd,kBAAkB;QAClB,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAwB;YACnC,MAAM;YACN,UAAU,EAAE,YAAY;SACzB,CAAC;QAEF,uBAAuB;QACvB,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;QAChC,CAAC;QAED,gCAAgC;QAChC,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,YAAY,aAAa,MAAM,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,QAAQ,EAAE,6BAA6B;gBACvC,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;aACtC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,mCAAmC,MAAM,gBAAgB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,eAAe,CAAC,OAA+B;QACnD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAE3C,sBAAsB;QACtB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG;YACd,MAAM;YACN,UAAU,EAAE,SAAS;YACrB,GAAG;SACJ,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,uCAAuC,MAAM,aAAa,SAAS,EAAE,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,QAAQ,EAAE,2BAA2B;gBACrC,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;aACtC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;YACvD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC;QAE3B,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,EAAE,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,QAAQ,EAAE,8BAA8B;gBACxC,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;aACtC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAlSD,sDAkSC"}
+{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AAmED,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBACtD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,oCAAoC;oBAC9C,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACtE,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,gBAAgB,EAAE,OAAO,CAAC,cAAc;iBACzC,CAAC;gBACF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,oCAAoC;oBAC9C,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAhJA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAmHF;AAxJD,4CAwJC"}

package/dist/delegation/index.d.ts

@@ -1,14 +1,9 @@
 /**
  * Hawcx OAuth Client SDK - Delegation Module
- *
- * Exposes the client and utilities for making secure, backend-to-backend
- * delegated requests to an IDP.
- *
- * For Hawcx-specific operations, use HawcxDelegationClient for simplified high-level API.
- * For generic delegation operations, use IdpDelegationClient for lower-level control.
  */
-export { IdpDelegationClient } from './client';
-export { HawcxDelegationClient, MfaMethod } from './hawcx';
-export { Ed25519Signer, RsaPssSigner, Verifier, EciesX25519Encryptor, EciesX25519Decryptor, nowS, } from './crypto';
+export { DelegationClient, MfaMethod, } from './hawcx';
+export type { DelegationClientBaseOptions, DelegationClientSecretKeyOptions, DelegationClientKeyOptions, MfaInitiateOptions, MfaVerifyOptions, UpdatePhoneOptions, DeviceOperationOptions, DelegationRequestOptions, } from './hawcx';
+export { parseHawcxSecretKey, generateCredentialBlob, } from './credentials';
+export type { ParsedCredentials, HawcxCredentialBlob, } from './credentials';
 export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, } from './exceptions';
 //# sourceMappingURL=index.d.ts.map

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,IAAI,GACL,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}

package/dist/delegation/index.js

@@ -1,27 +1,15 @@
 "use strict";
 /**
  * Hawcx OAuth Client SDK - Delegation Module
- *
- * Exposes the client and utilities for making secure, backend-to-backend
- * delegated requests to an IDP.
- *
- * For Hawcx-specific operations, use HawcxDelegationClient for simplified high-level API.
- * For generic delegation operations, use IdpDelegationClient for lower-level control.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = exports.nowS = exports.EciesX25519Decryptor = exports.EciesX25519Encryptor = exports.Verifier = exports.RsaPssSigner = exports.Ed25519Signer = exports.MfaMethod = exports.HawcxDelegationClient = exports.IdpDelegationClient = void 0;
-var client_1 = require("./client");
-Object.defineProperty(exports, "IdpDelegationClient", { enumerable: true, get: function () { return client_1.IdpDelegationClient; } });
+exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = exports.generateCredentialBlob = exports.parseHawcxSecretKey = exports.MfaMethod = exports.DelegationClient = void 0;
 var hawcx_1 = require("./hawcx");
-Object.defineProperty(exports, "HawcxDelegationClient", { enumerable: true, get: function () { return hawcx_1.HawcxDelegationClient; } });
+Object.defineProperty(exports, "DelegationClient", { enumerable: true, get: function () { return hawcx_1.DelegationClient; } });
 Object.defineProperty(exports, "MfaMethod", { enumerable: true, get: function () { return hawcx_1.MfaMethod; } });
-var crypto_1 = require("./crypto");
-Object.defineProperty(exports, "Ed25519Signer", { enumerable: true, get: function () { return crypto_1.Ed25519Signer; } });
-Object.defineProperty(exports, "RsaPssSigner", { enumerable: true, get: function () { return crypto_1.RsaPssSigner; } });
-Object.defineProperty(exports, "Verifier", { enumerable: true, get: function () { return crypto_1.Verifier; } });
-Object.defineProperty(exports, "EciesX25519Encryptor", { enumerable: true, get: function () { return crypto_1.EciesX25519Encryptor; } });
-Object.defineProperty(exports, "EciesX25519Decryptor", { enumerable: true, get: function () { return crypto_1.EciesX25519Decryptor; } });
-Object.defineProperty(exports, "nowS", { enumerable: true, get: function () { return crypto_1.nowS; } });
+var credentials_1 = require("./credentials");
+Object.defineProperty(exports, "parseHawcxSecretKey", { enumerable: true, get: function () { return credentials_1.parseHawcxSecretKey; } });
+Object.defineProperty(exports, "generateCredentialBlob", { enumerable: true, get: function () { return credentials_1.generateCredentialBlob; } });
 var exceptions_1 = require("./exceptions");
 Object.defineProperty(exports, "DelegationError", { enumerable: true, get: function () { return exceptions_1.DelegationError; } });
 Object.defineProperty(exports, "DelegationCryptoError", { enumerable: true, get: function () { return exceptions_1.DelegationCryptoError; } });

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,mCAA+C;AAAtC,6GAAA,mBAAmB,OAAA;AAC5B,iCAA2D;AAAlD,8GAAA,qBAAqB,OAAA;AAAE,kGAAA,SAAS,OAAA;AACzC,mCAOkB;AANhB,uGAAA,aAAa,OAAA;AACb,sGAAA,YAAY,OAAA;AACZ,kGAAA,QAAQ,OAAA;AACR,8GAAA,oBAAoB,OAAA;AACpB,8GAAA,oBAAoB,OAAA;AACpB,8FAAA,IAAI,OAAA;AAEN,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAaX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}

package/dist/delegation/transport.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Secure transport for ECIES-encrypted and signed delegation requests.
+ */
+import { Verifier, EciesX25519Encryptor, EciesX25519Decryptor, Ed25519Signer, RsaPssSigner } from './crypto';
+export type Signer = Ed25519Signer | RsaPssSigner;
+export type JsonObject = Record<string, unknown> | object;
+export interface SecureRequestOptions<TPayload extends JsonObject> {
+    /** API endpoint path (e.g., "/mfa/update" or "/device/revoke") */
+    endpoint: string;
+    /** Request payload dictionary to be encrypted and sent */
+    payload: TPayload;
+    /** If true, prepends base_url to endpoint (default: true) */
+    includeBaseUrl?: boolean;
+    /** Optional additional HTTP headers (e.g., API keys) */
+    headers?: Record<string, string>;
+}
+export interface DelegationTransportOptions {
+    baseUrl: string;
+    signer: Signer;
+    verifier: Verifier;
+    encryptor: EciesX25519Encryptor;
+    decryptor: EciesX25519Decryptor;
+    timeoutSeconds?: number;
+    clockSkewSeconds?: number;
+}
+export declare class DelegationTransport {
+    private baseUrl;
+    private signer;
+    private verifier;
+    private encryptor;
+    private decryptor;
+    private timeoutSeconds;
+    private clockSkewSeconds;
+    constructor(options: DelegationTransportOptions);
+    /**
+     * Send an encrypted and signed delegation request to the IDP.
+     */
+    send<TReq extends JsonObject, TRes extends JsonObject>(options: SecureRequestOptions<TReq>): Promise<TRes>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/delegation/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,UAAU,CAAC;AAGlB,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,UAAU;IAC/D,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,oBAAoB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,EAAE,0BAA0B;IAU/C;;OAEG;IACG,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EACzD,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC;CAkHjB"}