@hawcx/oauth-client 0.1.0 → 4.0.1

package/dist/client.js

@@ -1,301 +0,0 @@
-"use strict";
-/**
- * Core OAuth client implementation
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.exchangeCodeForClaims = exchangeCodeForClaims;
-exports.exchangeCodeForTokenAndClaims = exchangeCodeForTokenAndClaims;
-exports.verifyJwt = verifyJwt;
-const axios_1 = __importDefault(require("axios"));
-const jwt = __importStar(require("jsonwebtoken"));
-const utils_1 = require("./utils");
-const exceptions_1 = require("./exceptions");
-/**
- * Internal helper to perform the code-for-token exchange with optional PKCE support
- */
-async function exchangeForToken(code, oauthTokenUrl, clientId, timeout = 20, codeVerifier, redirectUri, apiKey) {
-    try {
-        // Build token request payload
-        const payload = {
-            grant_type: 'authorization_code',
-            code,
-            client_id: clientId,
-        };
-        // Add PKCE code_verifier if provided (RFC 7636)
-        if (codeVerifier) {
-            payload.code_verifier = codeVerifier;
-        }
-        // Add redirect_uri if provided (OAuth 2.0 standard)
-        if (redirectUri) {
-            payload.redirect_uri = redirectUri;
-        }
-        const headers = {
-            'Content-Type': 'application/x-www-form-urlencoded',
-            Accept: 'application/json',
-        };
-        // Add API key header if provided (for OAuth providers that require it)
-        if (apiKey) {
-            headers['apikey'] = apiKey;
-        }
-        const response = await axios_1.default.post(oauthTokenUrl, payload, {
-            timeout: timeout * 1000,
-            headers,
-        });
-        return response.data;
-    }
-    catch (error) {
-        if (axios_1.default.isAxiosError(error)) {
-            const axiosError = error;
-            if (axiosError.response) {
-                const responseBody = axiosError.response.data;
-                const errorMsg = responseBody?.error_description ||
-                    responseBody?.error ||
-                    'Unknown server error';
-                throw new exceptions_1.OAuthExchangeError(`Code exchange failed: ${errorMsg}`, axiosError.response.status, responseBody);
-            }
-        }
-        throw new exceptions_1.OAuthExchangeError(`Network error while exchanging code: ${error}`);
-    }
-}
-/**
- * Exchange OAuth authorization code for verified JWT claims.
- *
- * Supports PKCE (Proof Key for Code Exchange) per RFC 7636 for enhanced security.
- *
- * @param options - Configuration options for code exchange
- * @returns Dictionary containing the verified JWT claims
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: '/path/to/public.pem'
- * });
- *
- * // With PKCE (recommended)
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   codeVerifier: session.pkceVerifier,
- *   redirectUri: 'https://myapp.com/callback',
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com'
- * });
- * ```
- */
-async function exchangeCodeForClaims(options) {
-    const { code, oauthTokenUrl, clientId, publicKey, jwksUrl, apiKey, codeVerifier, redirectUri, timeout = 20, audience, issuer, verifyExp = true, leeway = 0, algorithms, } = options;
-    // Input validation
-    if (!code || typeof code !== 'string') {
-        throw new exceptions_1.OAuthExchangeError('Authorization code must be a non-empty string');
-    }
-    if (!oauthTokenUrl || typeof oauthTokenUrl !== 'string') {
-        throw new exceptions_1.OAuthExchangeError('OAuth token URL must be a non-empty string');
-    }
-    if (!clientId || typeof clientId !== 'string') {
-        throw new exceptions_1.OAuthExchangeError('Client ID must be a non-empty string');
-    }
-    // Exchange code for id_token (with PKCE support)
-    const responseBody = await exchangeForToken(code, oauthTokenUrl, clientId, timeout, codeVerifier, redirectUri, apiKey);
-    const idToken = responseBody.id_token;
-    if (!idToken) {
-        throw new exceptions_1.OAuthExchangeError("OAuth server response missing 'id_token' field", undefined, responseBody);
-    }
-    // Verify JWT
-    const claims = await verifyJwt({
-        token: idToken,
-        publicKey,
-        jwksUrl,
-        audience,
-        issuer,
-        verifyExp,
-        leeway,
-        algorithms,
-    });
-    return claims;
-}
-/**
- * Exchange OAuth authorization code for verified JWT claims and the raw id_token.
- *
- * @param options - Configuration options for code exchange
- * @returns Tuple containing [claims, idToken]
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- */
-async function exchangeCodeForTokenAndClaims(options) {
-    const { code, oauthTokenUrl, clientId, publicKey, jwksUrl, apiKey, codeVerifier, redirectUri, timeout = 20, audience, issuer, verifyExp = true, leeway = 0, algorithms, } = options;
-    const responseBody = await exchangeForToken(code, oauthTokenUrl, clientId, timeout, codeVerifier, redirectUri, apiKey);
-    const idToken = responseBody.id_token;
-    if (!idToken) {
-        throw new exceptions_1.OAuthExchangeError("OAuth server response missing 'id_token' field", undefined, responseBody);
-    }
-    const claims = await verifyJwt({
-        token: idToken,
-        publicKey,
-        jwksUrl,
-        audience,
-        issuer,
-        verifyExp,
-        leeway,
-        algorithms,
-    });
-    return [claims, idToken];
-}
-/**
- * Verify a JWT and return its claims.
- *
- * This function verifies the JWT signature using the provided public key
- * and validates claims (audience, issuer, expiration).
- *
- * @param options - Configuration options for JWT verification
- * @returns Dictionary containing the verified JWT claims
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: 'keys/public.pem'
- * });
- * console.log(`User: ${claims.sub}`);
- *
- * // With validation
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com',
- *   leeway: 10  // Allow 10 seconds clock skew
- * });
- * ```
- */
-async function verifyJwt(options) {
-    const { token, publicKey, jwksUrl, audience, issuer, verifyExp = true, leeway = 0, algorithms, } = options;
-    // Input validation
-    if (!token || typeof token !== 'string') {
-        throw new exceptions_1.JWTVerificationError('Token must be a non-empty string');
-    }
-    if (!publicKey && !jwksUrl) {
-        throw new exceptions_1.JWTVerificationError("Must provide either 'publicKey' or 'jwksUrl'");
-    }
-    // Load and validate public key
-    let pemKey;
-    try {
-        if (jwksUrl) {
-            // Use JWKS URL for dynamic key fetching
-            // First decode JWT header to get kid
-            const header = jwt.decode(token, { complete: true })?.header;
-            if (!header) {
-                throw new exceptions_1.JWTVerificationError('Failed to decode JWT header');
-            }
-            const kid = header.kid;
-            // Fetch JWKS (uses cache)
-            const jwks = await (0, utils_1.fetchJwks)(jwksUrl);
-            // Extract key from JWKS
-            pemKey = (0, utils_1.getKeyFromJwks)(jwks, kid);
-        }
-        else {
-            // Use static public key
-            pemKey = (0, utils_1.loadPublicKey)(publicKey);
-        }
-    }
-    catch (error) {
-        if (error instanceof exceptions_1.InvalidPublicKeyError) {
-            throw error;
-        }
-        throw new exceptions_1.InvalidPublicKeyError(`Unexpected error loading public key: ${error}`);
-    }
-    // Build verification options
-    const verifyOptions = {
-        algorithms: algorithms || ['RS256', 'ES256', 'ES384', 'ES512', 'EdDSA'],
-        clockTolerance: leeway,
-        ignoreExpiration: !verifyExp,
-    };
-    if (audience) {
-        verifyOptions.audience = audience;
-    }
-    if (issuer) {
-        verifyOptions.issuer = issuer;
-    }
-    // Decode and verify
-    try {
-        const claims = jwt.verify(token, pemKey, verifyOptions);
-        // jwt.verify can return string or object, ensure we have an object
-        if (typeof claims === 'string') {
-            throw new exceptions_1.JWTVerificationError('Unexpected JWT format: claims is a string');
-        }
-        return claims;
-    }
-    catch (error) {
-        if (error instanceof jwt.TokenExpiredError) {
-            throw new exceptions_1.JWTVerificationError('Token has expired. Please re-authenticate.', error);
-        }
-        if (error instanceof jwt.JsonWebTokenError) {
-            if (error.message.includes('audience')) {
-                throw new exceptions_1.JWTVerificationError(`Token audience validation failed. Expected: ${audience}`, error);
-            }
-            if (error.message.includes('issuer')) {
-                throw new exceptions_1.JWTVerificationError(`Token issuer validation failed. Expected: ${issuer}`, error);
-            }
-            if (error.message.includes('signature')) {
-                throw new exceptions_1.JWTVerificationError('Token signature verification failed. Token may have been tampered with.', error);
-            }
-            if (error.message.includes('jwt malformed')) {
-                throw new exceptions_1.JWTVerificationError('Token has invalid structure or encoding', error);
-            }
-            throw new exceptions_1.JWTVerificationError(`Token validation failed: ${error.message}`, error);
-        }
-        if (error instanceof jwt.NotBeforeError) {
-            throw new exceptions_1.JWTVerificationError('Token not yet valid (nbf claim). Check server clock synchronization.', error);
-        }
-        throw new exceptions_1.JWTVerificationError(`Unexpected error during JWT verification: ${error}`, error);
-    }
-}
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuKH,sDAkEC;AAWD,sEAmDC;AAgCD,8BAyHC;AA9bD,kDAA0C;AAC1C,kDAAoC;AACpC,mCAAmE;AACnE,6CAIsB;AA0DtB;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,aAAqB,EACrB,QAAgB,EAChB,UAAkB,EAAE,EACpB,YAAqB,EACrB,WAAoB,EACpB,MAAe;IAEf,IAAI,CAAC;QACH,8BAA8B;QAC9B,MAAM,OAAO,GAAQ;YACnB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,QAAQ;SACpB,CAAC;QAEF,gDAAgD;QAChD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC;QACvC,CAAC;QAED,oDAAoD;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAQ;YACnB,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,uEAAuE;QACvE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,eAAK,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE;YACxD,OAAO,EAAE,OAAO,GAAG,IAAI;YACvB,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,KAAmB,CAAC;YACvC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9C,MAAM,QAAQ,GACX,YAAoB,EAAE,iBAAiB;oBACvC,YAAoB,EAAE,KAAK;oBAC5B,sBAAsB,CAAC;gBACzB,MAAM,IAAI,+BAAkB,CAC1B,yBAAyB,QAAQ,EAAE,EACnC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAC1B,YAAY,CACb,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,+BAAkB,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,KAAK,UAAU,qBAAqB,CACzC,OAA4B;IAE5B,MAAM,EACJ,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,SAAS,EACT,OAAO,EACP,MAAM,EACN,YAAY,EACZ,WAAW,EACX,OAAO,GAAG,EAAE,EACZ,QAAQ,EACR,MAAM,EACN,SAAS,GAAG,IAAI,EAChB,MAAM,GAAG,CAAC,EACV,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,mBAAmB;IACnB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,+BAAkB,CAAC,+CAA+C,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,+BAAkB,CAAC,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,+BAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,iDAAiD;IACjD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,WAAW,EACX,MAAM,CACP,CAAC;IAEF,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,+BAAkB,CAC1B,gDAAgD,EAChD,SAAS,EACT,YAAY,CACb,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,KAAK,EAAE,OAAO;QACd,SAAS;QACT,OAAO;QACP,QAAQ;QACR,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,6BAA6B,CACjD,OAA4B;IAE5B,MAAM,EACJ,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,SAAS,EACT,OAAO,EACP,MAAM,EACN,YAAY,EACZ,WAAW,EACX,OAAO,GAAG,EAAE,EACZ,QAAQ,EACR,MAAM,EACN,SAAS,GAAG,IAAI,EAChB,MAAM,GAAG,CAAC,EACV,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,WAAW,EACX,MAAM,CACP,CAAC;IAEF,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,+BAAkB,CAC1B,gDAAgD,EAChD,SAAS,EACT,YAAY,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,KAAK,EAAE,OAAO;QACd,SAAS;QACT,OAAO;QACP,QAAQ;QACR,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACI,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,MAAM,EACJ,KAAK,EACL,SAAS,EACT,OAAO,EACP,QAAQ,EACR,MAAM,EACN,SAAS,GAAG,IAAI,EAChB,MAAM,GAAG,CAAC,EACV,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,mBAAmB;IACnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,iCAAoB,CAAC,kCAAkC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,iCAAoB,CAAC,8CAA8C,CAAC,CAAC;IACjF,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,wCAAwC;YACxC,qCAAqC;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;YAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iCAAoB,CAAC,6BAA6B,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YAEvB,0BAA0B;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAA,iBAAS,EAAC,OAAO,CAAC,CAAC;YAEtC,wBAAwB;YACxB,MAAM,GAAG,IAAA,sBAAc,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,MAAM,GAAG,IAAA,qBAAa,EAAC,SAAU,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,kCAAqB,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,6BAA6B;IAC7B,MAAM,aAAa,GAAsB;QACvC,UAAU,EAAG,UAA8B,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC5F,cAAc,EAAE,MAAM;QACtB,gBAAgB,EAAE,CAAC,SAAS;KAC7B,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC;IAChC,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAExD,mEAAmE;QACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,iCAAoB,CAAC,2CAA2C,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,MAA6B,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3C,MAAM,IAAI,iCAAoB,CAC5B,4CAA4C,EAC5C,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,iCAAoB,CAC5B,+CAA+C,QAAQ,EAAE,EACzD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iCAAoB,CAC5B,6CAA6C,MAAM,EAAE,EACrD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,iCAAoB,CAC5B,yEAAyE,EACzE,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,iCAAoB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,iCAAoB,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,iCAAoB,CAC5B,sEAAsE,EACtE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,iCAAoB,CAC5B,6CAA6C,KAAK,EAAE,EACpD,KAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/delegation/client.d.ts

@@ -1,116 +0,0 @@
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP
- */
-import { Verifier, EciesX25519Encryptor, EciesX25519Decryptor, Ed25519Signer, RsaPssSigner } from './crypto';
-export type Signer = Ed25519Signer | RsaPssSigner;
-/**
- * Options for sending secure delegation requests
- */
-export interface SecureRequestOptions {
-    /** API endpoint path (e.g., "/mfa/update" or "/device/revoke") */
-    endpoint: string;
-    /** Request payload dictionary to be encrypted and sent */
-    payload: Record<string, any>;
-    /** If true, prepends base_url to endpoint (default: true) */
-    includeBaseUrl?: boolean;
-    /** Optional additional HTTP headers (e.g., API keys) */
-    extraHeaders?: Record<string, string>;
-}
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP.
- */
-export declare class IdpDelegationClient {
-    private baseUrl;
-    private signer;
-    private verifier;
-    private encryptor;
-    private decryptor;
-    private spId;
-    private timeout;
-    constructor(options: {
-        baseUrl: string;
-        signer: Signer;
-        verifier: Verifier;
-        encryptor: EciesX25519Encryptor;
-        decryptor: EciesX25519Decryptor;
-        spId: string;
-        timeout?: number;
-    });
-    /**
-     * Send an encrypted and signed delegation request to the IDP.
-     *
-     * This method automatically handles all cryptographic operations:
-     * - ECIES (X25519 + AES-GCM) encryption of the request payload
-     * - Ed25519/RSA-PSS detached signature generation
-     * - HTTP header construction with delegation metadata
-     * - Response signature verification
-     * - ECIES decryption of the response
-     *
-     * @param options - Request configuration options
-     * @returns Decrypted and verified response dictionary from the IDP
-     * @throws DelegationRequestError - If request preparation or sending fails
-     * @throws DelegationResponseError - If response verification or decryption fails
-     *
-     * @example
-     * ```typescript
-     * // Initialize client
-     * const client = new IdpDelegationClient({
-     *   baseUrl: "https://idp.example.com",
-     *   signer, verifier,
-     *   encryptor, decryptor,
-     *   spId: "my-sp"
-     * });
-     *
-     * // Send secure request with automatic crypto
-     * const response = await client.sendSecureRequest({
-     *   endpoint: "/mfa/update",
-     *   payload: {
-     *     userid: "user@example.com",
-     *     mfa_method: "sms",
-     *     contact: "+15551234567"
-     *   }
-     * });
-     * console.log(response); // { success: true, session_id: '...' }
-     * ```
-     *
-     * Security Notes:
-     * - All requests are encrypted with ECIES (X25519 + AES-GCM)
-     * - All requests include a detached signature (Ed25519 or RSA-PSS)
-     * - All responses are verified and decrypted automatically
-     * - Timestamps are included to prevent replay attacks
-     */
-    sendSecureRequest(options: SecureRequestOptions): Promise<Record<string, any>>;
-    /**
-     * Request an MFA method update for a user.
-     *
-     * @param options - MFA update configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    mfaUpdate(options: {
-        userId: string;
-        method: string;
-        enabled: boolean;
-        reason: string;
-        requestedBy?: string;
-    }): Promise<Record<string, any>>;
-    /**
-     * Request the current MFA status for a user.
-     *
-     * @param userId - The ID of the user to query
-     * @returns The decrypted acknowledgment response from the IDP containing the MFA status
-     */
-    mfaGetStatus(userId: string): Promise<Record<string, any>>;
-    /**
-     * Request to revoke a user's device.
-     *
-     * @param options - Device revocation configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    deviceRevoke(options: {
-        userId: string;
-        deviceId: string;
-        reason: string;
-        requestedBy?: string;
-    }): Promise<Record<string, any>>;
-}
-//# sourceMappingURL=client.d.ts.map

package/dist/delegation/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/delegation/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,UAAU,CAAC;AAGlB,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,QAAQ,CAAC;QACnB,SAAS,EAAE,oBAAoB,CAAC;QAChC,SAAS,EAAE,oBAAoB,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;IAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAyGpF;;;;;OAKG;IACG,SAAS,CAAC,OAAO,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAqBhC;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAmBhE;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAoBjC"}

package/dist/delegation/client.js

@@ -1,227 +0,0 @@
-"use strict";
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdpDelegationClient = void 0;
-const axios_1 = __importDefault(require("axios"));
-const uuid_1 = require("uuid");
-const crypto_1 = require("./crypto");
-const exceptions_1 = require("./exceptions");
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP.
- */
-class IdpDelegationClient {
-    constructor(options) {
-        this.baseUrl = options.baseUrl.replace(/\/$/, '');
-        this.signer = options.signer;
-        this.verifier = options.verifier;
-        this.encryptor = options.encryptor;
-        this.decryptor = options.decryptor;
-        this.spId = options.spId;
-        this.timeout = options.timeout || 15;
-    }
-    /**
-     * Send an encrypted and signed delegation request to the IDP.
-     *
-     * This method automatically handles all cryptographic operations:
-     * - ECIES (X25519 + AES-GCM) encryption of the request payload
-     * - Ed25519/RSA-PSS detached signature generation
-     * - HTTP header construction with delegation metadata
-     * - Response signature verification
-     * - ECIES decryption of the response
-     *
-     * @param options - Request configuration options
-     * @returns Decrypted and verified response dictionary from the IDP
-     * @throws DelegationRequestError - If request preparation or sending fails
-     * @throws DelegationResponseError - If response verification or decryption fails
-     *
-     * @example
-     * ```typescript
-     * // Initialize client
-     * const client = new IdpDelegationClient({
-     *   baseUrl: "https://idp.example.com",
-     *   signer, verifier,
-     *   encryptor, decryptor,
-     *   spId: "my-sp"
-     * });
-     *
-     * // Send secure request with automatic crypto
-     * const response = await client.sendSecureRequest({
-     *   endpoint: "/mfa/update",
-     *   payload: {
-     *     userid: "user@example.com",
-     *     mfa_method: "sms",
-     *     contact: "+15551234567"
-     *   }
-     * });
-     * console.log(response); // { success: true, session_id: '...' }
-     * ```
-     *
-     * Security Notes:
-     * - All requests are encrypted with ECIES (X25519 + AES-GCM)
-     * - All requests include a detached signature (Ed25519 or RSA-PSS)
-     * - All responses are verified and decrypted automatically
-     * - Timestamps are included to prevent replay attacks
-     */
-    async sendSecureRequest(options) {
-        const { endpoint, payload, includeBaseUrl = true, extraHeaders = {} } = options;
-        let encryptedEnv;
-        let headers;
-        try {
-            // Step 1: Serialize and encrypt the payload
-            const body = Buffer.from(JSON.stringify(payload));
-            encryptedEnv = this.encryptor.encrypt(body);
-            // Step 2: Generate timestamp and signature
-            const ts = (0, crypto_1.nowS)();
-            const sig = this.signer.signDetached(encryptedEnv, ts);
-            // Step 3: Build delegation headers
-            headers = {
-                'Content-Type': 'application/json',
-                'X-Enc-Alg': 'x25519-aesgcm',
-                'X-SP-Id': this.spId,
-                'X-Timestamp': String(ts),
-                'X-Signature-Alg': sig.alg,
-                'X-Signature': sig.signatureB64,
-            };
-            if (sig.kid) {
-                headers['X-Key-Id'] = sig.kid;
-            }
-            // Merge extra headers (e.g., API authentication headers)
-            Object.assign(headers, extraHeaders);
-        }
-        catch (error) {
-            throw new exceptions_1.DelegationRequestError(`Failed to prepare secure request: ${error}`);
-        }
-        // Step 4: Send encrypted request to IDP
-        let response;
-        try {
-            const url = includeBaseUrl ? this.baseUrl + endpoint : endpoint;
-            response = await axios_1.default.post(url, encryptedEnv, {
-                headers,
-                timeout: this.timeout * 1000,
-                validateStatus: () => true, // Don't throw on any status
-                responseType: 'arraybuffer',
-            });
-        }
-        catch (error) {
-            if (axios_1.default.isAxiosError(error)) {
-                throw new exceptions_1.DelegationRequestError(`Request to IDP failed: ${error.message}`);
-            }
-            throw new exceptions_1.DelegationRequestError(`Request to IDP failed: ${error}`);
-        }
-        // Step 5: Verify and decrypt response (even for error statuses)
-        try {
-            const respTs = parseInt(response.headers['x-timestamp'] || String((0, crypto_1.nowS)()));
-            const respSig = response.headers['x-signature'];
-            const respAlg = response.headers['x-signature-alg'];
-            const respKid = response.headers['x-key-id'];
-            if (!respSig || !respAlg) {
-                throw new exceptions_1.DelegationResponseError('Missing signature headers in IDP response');
-            }
-            this.verifier.verify(Buffer.from(response.data), respTs, respSig, respAlg, respKid);
-            // Step 6: Verify encryption and decrypt response
-            if (response.headers['x-enc-alg'] !== 'x25519-aesgcm') {
-                throw new exceptions_1.DelegationResponseError('IDP response must be ECIES encrypted');
-            }
-            const plaintext = this.decryptor.decrypt(Buffer.from(response.data));
-            const decryptedData = JSON.parse(plaintext.toString('utf-8'));
-            // Now check HTTP status and include decrypted error message if available
-            if (response.status >= 400) {
-                const errorDetail = decryptedData.detail || JSON.stringify(decryptedData);
-                throw new exceptions_1.DelegationRequestError(`IDP returned ${response.status}: ${errorDetail}`, response.status, errorDetail);
-            }
-            return decryptedData;
-        }
-        catch (error) {
-            if (error instanceof exceptions_1.DelegationRequestError) {
-                throw error;
-            }
-            if (error instanceof exceptions_1.DelegationResponseError) {
-                throw error;
-            }
-            // If we can't decrypt, fall back to raw response
-            if (response.status >= 400) {
-                const responseText = Buffer.from(response.data).toString('utf-8').substring(0, 500);
-                throw new exceptions_1.DelegationRequestError(`IDP returned ${response.status}: ${responseText}`, response.status);
-            }
-            throw new exceptions_1.DelegationResponseError(`Failed to process secure response: ${error}`);
-        }
-    }
-    /**
-     * Request an MFA method update for a user.
-     *
-     * @param options - MFA update configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    async mfaUpdate(options) {
-        const { userId, method, enabled, reason, requestedBy } = options;
-        const payload = {
-            v: '1',
-            type: 'delegation.request',
-            action: 'mfa.update',
-            sp: { id: this.spId, kid: this.signer.kid },
-            subject: { user_id: userId },
-            params: { method, enabled: Boolean(enabled) },
-            audit: { reason, requested_by: requestedBy || userId },
-            jti: (0, uuid_1.v4)().replace(/-/g, ''),
-            iat: (0, crypto_1.nowS)(),
-        };
-        return this.sendSecureRequest({
-            endpoint: '/mfa/update',
-            payload,
-        });
-    }
-    /**
-     * Request the current MFA status for a user.
-     *
-     * @param userId - The ID of the user to query
-     * @returns The decrypted acknowledgment response from the IDP containing the MFA status
-     */
-    async mfaGetStatus(userId) {
-        const payload = {
-            v: '1',
-            type: 'delegation.request',
-            action: 'mfa.get_status',
-            sp: { id: this.spId, kid: this.signer.kid },
-            subject: { user_id: userId },
-            params: {},
-            audit: { reason: 'User status query', requested_by: userId },
-            jti: (0, uuid_1.v4)().replace(/-/g, ''),
-            iat: (0, crypto_1.nowS)(),
-        };
-        return this.sendSecureRequest({
-            endpoint: '/mfa/get',
-            payload,
-        });
-    }
-    /**
-     * Request to revoke a user's device.
-     *
-     * @param options - Device revocation configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    async deviceRevoke(options) {
-        const { userId, deviceId, reason, requestedBy } = options;
-        const payload = {
-            v: '1',
-            type: 'delegation.request',
-            action: 'device.revoke',
-            sp: { id: this.spId, kid: this.signer.kid },
-            subject: { user_id: userId, device_id: deviceId },
-            params: {},
-            audit: { reason, requested_by: requestedBy || userId },
-            jti: (0, uuid_1.v4)().replace(/-/g, ''),
-            iat: (0, crypto_1.nowS)(),
-        };
-        return this.sendSecureRequest({
-            endpoint: '/device/revoke',
-            payload,
-        });
-    }
-}
-exports.IdpDelegationClient = IdpDelegationClient;
-//# sourceMappingURL=client.js.map

package/dist/delegation/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/delegation/client.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;AAEH,kDAA0B;AAC1B,+BAAoC;AACpC,qCAOkB;AAClB,6CAA+E;AAkB/E;;GAEG;AACH,MAAa,mBAAmB;IAS9B,YAAY,OAQX;QACC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAA6B;QACnD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAEhF,IAAI,YAAoB,CAAC;QACzB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAE5C,2CAA2C;YAC3C,MAAM,EAAE,GAAG,IAAA,aAAI,GAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAEvD,mCAAmC;YACnC,OAAO,GAAG;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,eAAe;gBAC5B,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzB,iBAAiB,EAAE,GAAG,CAAC,GAAG;gBAC1B,aAAa,EAAE,GAAG,CAAC,YAAY;aAChC,CAAC;YAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,yDAAyD;YACzD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,wCAAwC;QACxC,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChE,QAAQ,GAAG,MAAM,eAAK,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE;gBAC7C,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI;gBAC5B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,4BAA4B;gBACxD,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,mCAAsB,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,IAAA,aAAI,GAAE,CAAC,CAAC,CAAC;YAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAE7C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,oCAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAEpF,iDAAiD;YACjD,IAAI,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;gBACtD,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAE9D,yEAAyE;YACzE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAC1E,MAAM,IAAI,mCAAsB,CAC9B,gBAAgB,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,EACjD,QAAQ,CAAC,MAAM,EACf,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,oCAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,iDAAiD;YACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpF,MAAM,IAAI,mCAAsB,CAC9B,gBAAgB,QAAQ,CAAC,MAAM,KAAK,YAAY,EAAE,EAClD,QAAQ,CAAC,MAAM,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,OAMf;QACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAEjE,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,GAAG;YACN,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,YAAY;YACpB,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7C,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,IAAI,MAAM,EAAE;YACtD,GAAG,EAAE,IAAA,SAAM,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,GAAG,EAAE,IAAA,aAAI,GAAE;SACZ,CAAC;QAEF,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,QAAQ,EAAE,aAAa;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,GAAG;YACN,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,gBAAgB;YACxB,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC5B,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,EAAE;YAC5D,GAAG,EAAE,IAAA,SAAM,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,GAAG,EAAE,IAAA,aAAI,GAAE;SACZ,CAAC;QAEF,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,QAAQ,EAAE,UAAU;YACpB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,OAKlB;QACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAE1D,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,GAAG;YACN,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,eAAe;YACvB,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;YACjD,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,IAAI,MAAM,EAAE;YACtD,GAAG,EAAE,IAAA,SAAM,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,GAAG,EAAE,IAAA,aAAI,GAAE;SACZ,CAAC;QAEF,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,QAAQ,EAAE,gBAAgB;YAC1B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;CACF;AAxQD,kDAwQC"}