@hawcx/oauth-client 0.2.0 → 4.0.1

package/dist/delegation/transport.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Secure transport for ECIES-encrypted and signed delegation requests.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationTransport = void 0;
+const crypto_1 = require("./crypto");
+const exceptions_1 = require("./exceptions");
+class DelegationTransport {
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/$/, '');
+        this.signer = options.signer;
+        this.verifier = options.verifier;
+        this.encryptor = options.encryptor;
+        this.decryptor = options.decryptor;
+        this.timeoutSeconds = options.timeoutSeconds ?? 15;
+        this.clockSkewSeconds = options.clockSkewSeconds ?? 300;
+    }
+    /**
+     * Send an encrypted and signed delegation request to the IDP.
+     */
+    async send(options) {
+        const { endpoint, payload, includeBaseUrl = true, headers: extraHeaders = {} } = options;
+        let encryptedEnv;
+        let headers;
+        try {
+            const body = Buffer.from(JSON.stringify(payload));
+            encryptedEnv = await this.encryptor.encrypt(body);
+            const ts = (0, crypto_1.nowS)();
+            const sig = this.signer.signDetached(encryptedEnv, ts);
+            headers = {
+                'Content-Type': 'application/json',
+                'X-Enc-Alg': 'x25519-aesgcm',
+                'X-Timestamp': String(ts),
+                'X-Signature-Alg': sig.alg,
+                'X-Signature': sig.signatureB64,
+            };
+            if (sig.kid) {
+                headers['X-Key-Id'] = sig.kid;
+            }
+            Object.assign(headers, extraHeaders);
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationRequestError('Failed to prepare secure request', { cause: error });
+        }
+        let response;
+        let responseData;
+        try {
+            const url = includeBaseUrl ? this.baseUrl + endpoint : endpoint;
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.timeoutSeconds * 1000);
+            try {
+                response = await fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: encryptedEnv,
+                    signal: controller.signal,
+                });
+            }
+            finally {
+                clearTimeout(timeoutId);
+            }
+            responseData = Buffer.from(await response.arrayBuffer());
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationRequestError('Request to IDP failed', { cause: error });
+        }
+        try {
+            const respSig = response.headers.get('x-signature');
+            const respAlg = response.headers.get('x-signature-alg');
+            const respKid = response.headers.get('x-key-id');
+            const respTsHeader = response.headers.get('x-timestamp');
+            if (!respSig || !respAlg || !respTsHeader) {
+                throw new exceptions_1.DelegationResponseError('Missing signature headers in IDP response');
+            }
+            const respTs = Number(respTsHeader);
+            if (!Number.isFinite(respTs)) {
+                throw new exceptions_1.DelegationResponseError('Invalid response timestamp');
+            }
+            const skew = Math.abs((0, crypto_1.nowS)() - respTs);
+            if (skew > this.clockSkewSeconds) {
+                throw new exceptions_1.DelegationResponseError(`Response timestamp outside allowed skew (${this.clockSkewSeconds}s)`);
+            }
+            this.verifier.verify(responseData, respTs, respSig, respAlg, respKid ?? undefined);
+            if (response.headers.get('x-enc-alg') !== 'x25519-aesgcm') {
+                throw new exceptions_1.DelegationResponseError('IDP response must be ECIES encrypted');
+            }
+            const plaintext = await this.decryptor.decrypt(responseData);
+            const decryptedData = JSON.parse(plaintext.toString('utf-8'));
+            if (response.status >= 400) {
+                const errorDetail = decryptedData?.detail;
+                const errorBody = errorDetail ? String(errorDetail) : JSON.stringify(decryptedData);
+                throw new exceptions_1.DelegationRequestError(`IDP returned ${response.status}`, {
+                    statusCode: response.status,
+                    responseBody: errorBody,
+                });
+            }
+            return decryptedData;
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationRequestError) {
+                throw error;
+            }
+            if (error instanceof exceptions_1.DelegationResponseError) {
+                throw error;
+            }
+            if (response.status >= 400) {
+                const responseText = responseData.toString('utf-8').substring(0, 500);
+                throw new exceptions_1.DelegationRequestError(`IDP returned ${response.status}`, {
+                    statusCode: response.status,
+                    responseBody: responseText,
+                    cause: error,
+                });
+            }
+            throw new exceptions_1.DelegationResponseError('Failed to process secure response', { cause: error });
+        }
+    }
+}
+exports.DelegationTransport = DelegationTransport;
+//# sourceMappingURL=transport.js.map

package/dist/delegation/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,qCAOkB;AAClB,6CAA+E;AA0B/E,MAAa,mBAAmB;IAS9B,YAAY,OAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAAmC;QAEnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAEzF,IAAI,YAAoB,CAAC;QACzB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAElD,MAAM,EAAE,GAAG,IAAA,aAAI,GAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAEvD,OAAO,GAAG;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,eAAe;gBAC5B,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzB,iBAAiB,EAAE,GAAG,CAAC,GAAG;gBAC1B,aAAa,EAAE,GAAG,CAAC,YAAY;aAChC,CAAC;YAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEnF,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAC1B,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YAED,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,oCAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,oCAAuB,CAAC,4BAA4B,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAA,aAAI,GAAE,GAAG,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjC,MAAM,IAAI,oCAAuB,CAC/B,4CAA4C,IAAI,CAAC,gBAAgB,IAAI,CACtE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;YAEnF,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS,CAAC;YAEtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAI,aAAyC,EAAE,MAAM,CAAC;gBACvE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBACpF,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,oCAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtE,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,oCAAuB,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AA1ID,kDA0IC"}

package/dist/errors.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Hawcx OAuth Errors
+ */
+export declare class HawcxOAuthError extends Error {
+    constructor(message: string);
+}
+export declare class TokenExchangeError extends HawcxOAuthError {
+    readonly statusCode?: number;
+    constructor(message: string, statusCode?: number);
+}
+export declare class TokenVerificationError extends HawcxOAuthError {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAKjD;AAED,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,EAAE,MAAM;CAI5B"}

package/dist/errors.js

@@ -0,0 +1,29 @@
+"use strict";
+/**
+ * Hawcx OAuth Errors
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = void 0;
+class HawcxOAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'HawcxOAuthError';
+    }
+}
+exports.HawcxOAuthError = HawcxOAuthError;
+class TokenExchangeError extends HawcxOAuthError {
+    constructor(message, statusCode) {
+        super(message);
+        this.name = 'TokenExchangeError';
+        this.statusCode = statusCode;
+    }
+}
+exports.TokenExchangeError = TokenExchangeError;
+class TokenVerificationError extends HawcxOAuthError {
+    constructor(message) {
+        super(message);
+        this.name = 'TokenVerificationError';
+    }
+}
+exports.TokenVerificationError = TokenVerificationError;
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAED,MAAa,kBAAmB,SAAQ,eAAe;IAGrD,YAAY,OAAe,EAAE,UAAmB;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AARD,gDAQC;AAED,MAAa,sBAAuB,SAAQ,eAAe;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC"}

package/dist/index.d.ts

@@ -1,26 +1,21 @@
 /**
  * Hawcx OAuth Client SDK
  *
- * A lightweight, production-ready Node.js library for exchanging OAuth authorization
- * codes and verifying JWT claims. Built with security, reliability, and ease of use in mind.
+ * Simple, production-ready SDK for exchanging authorization codes
+ * and verifying JWT tokens with Hawcx OAuth service.
  *
  * @example
  * ```typescript
- * import { exchangeCodeForClaims } from '@hawcx/oauth-client';
+ * import { HawcxOAuth } from '@hawcx/oauth-client';
  *
- * const claims = await exchangeCodeForClaims({
- *   code: 'abc123',
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: 'path/to/public.pem'
- * });
- * console.log(claims.sub); // 'user@example.com'
+ * const oauth = new HawcxOAuth({ configId: 'your-api-key' });
+ * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
  * ```
  */
-export { exchangeCodeForClaims, exchangeCodeForTokenAndClaims, verifyJwt, } from './client';
-export type { ExchangeCodeOptions, VerifyJwtOptions } from './client';
-export { fetchJwks, getKeyFromJwks } from './utils';
-export { HawcxOAuthError, InvalidPublicKeyError, OAuthExchangeError, JWTVerificationError, } from './exceptions';
+export { HawcxOAuth } from './oauth';
+export type { HawcxOAuthConfig, ExchangeResult, JwtClaims } from './oauth';
+export { HawcxOAuthError, TokenExchangeError, TokenVerificationError } from './errors';
 export * from './delegation';
-export declare const VERSION = "0.1.0";
+export * from './stepup';
+export declare const VERSION = "4.0.1";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,SAAS,GACV,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGtE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGpD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAGtB,cAAc,cAAc,CAAC;AAE7B,eAAO,MAAM,OAAO,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAGvF,cAAc,cAAc,CAAC;AAG7B,cAAc,UAAU,CAAC;AAEzB,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/index.js

@@ -2,20 +2,15 @@
 /**
  * Hawcx OAuth Client SDK
  *
- * A lightweight, production-ready Node.js library for exchanging OAuth authorization
- * codes and verifying JWT claims. Built with security, reliability, and ease of use in mind.
+ * Simple, production-ready SDK for exchanging authorization codes
+ * and verifying JWT tokens with Hawcx OAuth service.
  *
  * @example
  * ```typescript
- * import { exchangeCodeForClaims } from '@hawcx/oauth-client';
+ * import { HawcxOAuth } from '@hawcx/oauth-client';
  *
- * const claims = await exchangeCodeForClaims({
- *   code: 'abc123',
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: 'path/to/public.pem'
- * });
- * console.log(claims.sub); // 'user@example.com'
+ * const oauth = new HawcxOAuth({ configId: 'your-api-key' });
+ * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
  * ```
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
@@ -33,23 +28,16 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERSION = exports.JWTVerificationError = exports.OAuthExchangeError = exports.InvalidPublicKeyError = exports.HawcxOAuthError = exports.getKeyFromJwks = exports.fetchJwks = exports.verifyJwt = exports.exchangeCodeForTokenAndClaims = exports.exchangeCodeForClaims = void 0;
-// Core OAuth client
-var client_1 = require("./client");
-Object.defineProperty(exports, "exchangeCodeForClaims", { enumerable: true, get: function () { return client_1.exchangeCodeForClaims; } });
-Object.defineProperty(exports, "exchangeCodeForTokenAndClaims", { enumerable: true, get: function () { return client_1.exchangeCodeForTokenAndClaims; } });
-Object.defineProperty(exports, "verifyJwt", { enumerable: true, get: function () { return client_1.verifyJwt; } });
-// JWKS utilities
-var utils_1 = require("./utils");
-Object.defineProperty(exports, "fetchJwks", { enumerable: true, get: function () { return utils_1.fetchJwks; } });
-Object.defineProperty(exports, "getKeyFromJwks", { enumerable: true, get: function () { return utils_1.getKeyFromJwks; } });
-// Exceptions
-var exceptions_1 = require("./exceptions");
-Object.defineProperty(exports, "HawcxOAuthError", { enumerable: true, get: function () { return exceptions_1.HawcxOAuthError; } });
-Object.defineProperty(exports, "InvalidPublicKeyError", { enumerable: true, get: function () { return exceptions_1.InvalidPublicKeyError; } });
-Object.defineProperty(exports, "OAuthExchangeError", { enumerable: true, get: function () { return exceptions_1.OAuthExchangeError; } });
-Object.defineProperty(exports, "JWTVerificationError", { enumerable: true, get: function () { return exceptions_1.JWTVerificationError; } });
+exports.VERSION = exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = exports.HawcxOAuth = void 0;
+var oauth_1 = require("./oauth");
+Object.defineProperty(exports, "HawcxOAuth", { enumerable: true, get: function () { return oauth_1.HawcxOAuth; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "HawcxOAuthError", { enumerable: true, get: function () { return errors_1.HawcxOAuthError; } });
+Object.defineProperty(exports, "TokenExchangeError", { enumerable: true, get: function () { return errors_1.TokenExchangeError; } });
+Object.defineProperty(exports, "TokenVerificationError", { enumerable: true, get: function () { return errors_1.TokenVerificationError; } });
 // Delegation module
 __exportStar(require("./delegation"), exports);
-exports.VERSION = '0.1.0';
+// Step-up module
+__exportStar(require("./stepup"), exports);
+exports.VERSION = '4.0.1';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;AAEH,oBAAoB;AACpB,mCAIkB;AAHhB,+GAAA,qBAAqB,OAAA;AACrB,uHAAA,6BAA6B,OAAA;AAC7B,mGAAA,SAAS,OAAA;AAIX,iBAAiB;AACjB,iCAAoD;AAA3C,kGAAA,SAAS,OAAA;AAAE,uGAAA,cAAc,OAAA;AAElC,aAAa;AACb,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,gHAAA,kBAAkB,OAAA;AAClB,kHAAA,oBAAoB,OAAA;AAGtB,oBAAoB;AACpB,+CAA6B;AAEhB,QAAA,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;AAEH,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AAEnB,mCAAuF;AAA9E,yGAAA,eAAe,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,gHAAA,sBAAsB,OAAA;AAEpE,oBAAoB;AACpB,+CAA6B;AAE7B,iBAAiB;AACjB,2CAAyB;AAEZ,QAAA,OAAO,GAAG,OAAO,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Hawcx OAuth Client
+ *
+ * Simple, clean implementation using the jose library for JWT verification.
+ */
+import { type JWTPayload } from 'jose';
+export interface HawcxOAuthConfig {
+    /** Your Hawcx API key (X-Config-Id) */
+    configId: string;
+    /** Base URL override (default: https://api.hawcx.com) */
+    baseUrl?: string;
+    /** Request timeout in ms (default: 10000) */
+    timeout?: number;
+}
+export interface JwtClaims extends JWTPayload {
+    /** Subject (user ID) */
+    sub?: string;
+    /** Issuer */
+    iss?: string;
+    /** Audience */
+    aud?: string | string[];
+    /** Issued at (unix timestamp) */
+    iat?: number;
+    /** Expiration (unix timestamp) */
+    exp?: number;
+    /** Not before (unix timestamp) */
+    nbf?: number;
+    /** JWT ID */
+    jti?: string;
+    /** Nonce */
+    nonce?: string;
+    /** Authentication methods */
+    amr?: string[];
+    /** MFA method used */
+    mfa_method?: string;
+    /** Email */
+    email?: string;
+    /** Name */
+    name?: string;
+}
+export interface ExchangeResult {
+    /** Raw id_token JWT */
+    idToken: string;
+    /** Verified JWT claims */
+    claims: JwtClaims;
+}
+/**
+ * Hawcx OAuth Client
+ *
+ * Handles code exchange and JWT verification using the jose library.
+ *
+ * @example
+ * ```typescript
+ * const oauth = new HawcxOAuth({ configId: 'your-api-key' });
+ *
+ * // Exchange authorization code for tokens
+ * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
+ * console.log(claims.sub); // user ID
+ *
+ * // Later, verify an existing token
+ * const claims = await oauth.verifyToken(idToken);
+ * ```
+ */
+export declare class HawcxOAuth {
+    private readonly configId;
+    private readonly baseUrl;
+    private readonly timeout;
+    private jwks;
+    constructor(config: HawcxOAuthConfig);
+    /**
+     * Exchange authorization code for id_token and verified claims.
+     *
+     * @param code - Authorization code from auth flow
+     * @param codeVerifier - PKCE code verifier
+     * @returns id_token and verified claims
+     */
+    exchangeCode(code: string, codeVerifier: string): Promise<ExchangeResult>;
+    /**
+     * Verify a JWT token and return its claims.
+     *
+     * Uses the jose library which handles all signature formats automatically,
+     * including ECDSA signature conversion between P1363 and DER formats.
+     *
+     * @param token - JWT token to verify
+     * @returns Verified claims
+     */
+    verifyToken(token: string): Promise<JwtClaims>;
+    /**
+     * Get or create the remote JWKS.
+     * The jose library handles caching internally.
+     */
+    private getJwks;
+    /**
+     * Clear the JWKS cache (useful for testing or key rotation).
+     */
+    clearCache(): void;
+}
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAKtE,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,IAAI,CAAsD;gBAEtD,MAAM,EAAE,gBAAgB;IASpC;;;;;;OAMG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAkD/E;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA+BpD;;;OAGG;IACH,OAAO,CAAC,OAAO;IAaf;;OAEG;IACH,UAAU,IAAI,IAAI;CAGnB"}

package/dist/oauth.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * Hawcx OAuth Client
+ *
+ * Simple, clean implementation using the jose library for JWT verification.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HawcxOAuth = void 0;
+const jose_1 = require("jose");
+const errors_1 = require("./errors");
+const DEFAULT_BASE_URL = 'https://api.hawcx.com';
+/**
+ * Hawcx OAuth Client
+ *
+ * Handles code exchange and JWT verification using the jose library.
+ *
+ * @example
+ * ```typescript
+ * const oauth = new HawcxOAuth({ configId: 'your-api-key' });
+ *
+ * // Exchange authorization code for tokens
+ * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
+ * console.log(claims.sub); // user ID
+ *
+ * // Later, verify an existing token
+ * const claims = await oauth.verifyToken(idToken);
+ * ```
+ */
+class HawcxOAuth {
+    constructor(config) {
+        this.jwks = null;
+        if (!config.configId) {
+            throw new Error('configId is required');
+        }
+        this.configId = config.configId;
+        this.baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, '');
+        this.timeout = config.timeout ?? 10000;
+    }
+    /**
+     * Exchange authorization code for id_token and verified claims.
+     *
+     * @param code - Authorization code from auth flow
+     * @param codeVerifier - PKCE code verifier
+     * @returns id_token and verified claims
+     */
+    async exchangeCode(code, codeVerifier) {
+        if (!code)
+            throw new errors_1.TokenExchangeError('code is required');
+        if (!codeVerifier)
+            throw new errors_1.TokenExchangeError('codeVerifier is required');
+        // Exchange code for token
+        const tokenUrl = `${this.baseUrl}/oauth2/token`;
+        const body = new URLSearchParams();
+        body.append('code', code);
+        body.append('code_verifier', codeVerifier);
+        let response;
+        try {
+            response = await fetch(tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'X-Config-Id': this.configId,
+                },
+                body: body.toString(),
+                signal: AbortSignal.timeout(this.timeout),
+            });
+        }
+        catch (err) {
+            throw new errors_1.TokenExchangeError(`Network error: ${err}`);
+        }
+        if (!response.ok) {
+            let errorMsg = `HTTP ${response.status}`;
+            try {
+                const data = (await response.json());
+                errorMsg = data.error_description || data.error || errorMsg;
+            }
+            catch {
+                // ignore parse errors
+            }
+            throw new errors_1.TokenExchangeError(errorMsg, response.status);
+        }
+        const data = (await response.json());
+        const idToken = data.id_token;
+        if (!idToken) {
+            throw new errors_1.TokenExchangeError('Response missing id_token');
+        }
+        // Verify the token
+        const claims = await this.verifyToken(idToken);
+        return { idToken, claims };
+    }
+    /**
+     * Verify a JWT token and return its claims.
+     *
+     * Uses the jose library which handles all signature formats automatically,
+     * including ECDSA signature conversion between P1363 and DER formats.
+     *
+     * @param token - JWT token to verify
+     * @returns Verified claims
+     */
+    async verifyToken(token) {
+        if (!token)
+            throw new errors_1.TokenVerificationError('token is required');
+        try {
+            // Get or create the JWKS
+            const jwks = this.getJwks();
+            // Verify the token using jose - handles all the crypto automatically
+            const { payload } = await (0, jose_1.jwtVerify)(token, jwks);
+            return payload;
+        }
+        catch (err) {
+            if (err instanceof errors_1.TokenVerificationError)
+                throw err;
+            const message = err instanceof Error ? err.message : String(err);
+            // Map jose errors to our error types
+            if (message.includes('expired')) {
+                throw new errors_1.TokenVerificationError('Token expired');
+            }
+            if (message.includes('not yet valid') || message.includes('nbf')) {
+                throw new errors_1.TokenVerificationError('Token not yet valid');
+            }
+            if (message.includes('signature')) {
+                throw new errors_1.TokenVerificationError('Invalid signature');
+            }
+            throw new errors_1.TokenVerificationError(`Token verification failed: ${message}`);
+        }
+    }
+    /**
+     * Get or create the remote JWKS.
+     * The jose library handles caching internally.
+     */
+    getJwks() {
+        if (!this.jwks) {
+            const jwksUrl = new URL(`${this.baseUrl}/keys`);
+            this.jwks = (0, jose_1.createRemoteJWKSet)(jwksUrl, {
+                headers: {
+                    'X-Config-Id': this.configId,
+                },
+            });
+        }
+        return this.jwks;
+    }
+    /**
+     * Clear the JWKS cache (useful for testing or key rotation).
+     */
+    clearCache() {
+        this.jwks = null;
+    }
+}
+exports.HawcxOAuth = HawcxOAuth;
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,+BAAsE;AACtE,qCAAsE;AAEtE,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAmDjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,UAAU;IAMrB,YAAY,MAAwB;QAF5B,SAAI,GAAiD,IAAI,CAAC;QAGhE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAM,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,YAAoB;QACnD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,eAAe,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAE3C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;iBAC7B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;gBACtD,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE/C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,qEAAqE;YACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAEjD,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,qCAAqC;YACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,CAAC,CAAC;YAEhD,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,OAAO,EAAE;oBACP,aAAa,EAAE,IAAI,CAAC,QAAQ;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAvID,gCAuIC"}

package/dist/stepup/client.d.ts

@@ -0,0 +1,26 @@
+import { DelegationTransport } from '../delegation/transport';
+import { DelegationKeyMaterial } from '../delegation/factory';
+import { StepUpClientBaseOptions, StepUpConsumeOptions, StepUpConsumeResponse, StepUpStartOptions, StepUpStartTokenResponse } from './types';
+export interface StepUpClientSecretKeyOptions extends StepUpClientBaseOptions {
+    secretKey: string;
+    apiKey?: string;
+}
+export type StepUpClientKeyOptions = StepUpClientBaseOptions & DelegationKeyMaterial & {
+    apiKey?: string;
+};
+export declare class StepUpClient {
+    private transport;
+    private options;
+    private apiKey?;
+    constructor(options: {
+        transport: DelegationTransport;
+        clientOptions: StepUpClientBaseOptions;
+        apiKey?: string;
+    });
+    static fromSecretKey(options: StepUpClientSecretKeyOptions): StepUpClient;
+    static fromKeys(options: StepUpClientKeyOptions): StepUpClient;
+    private buildExtraHeaders;
+    startToken(options: StepUpStartOptions): Promise<StepUpStartTokenResponse>;
+    consumeReceipt(options: StepUpConsumeOptions): Promise<StepUpConsumeResponse>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/stepup/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAuD,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,MAAM,CAAC,CAAS;gBAEZ,OAAO,EAAE;QACnB,SAAS,EAAE,mBAAmB,CAAC;QAC/B,aAAa,EAAE,uBAAuB,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAMD,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,4BAA4B,GAAG,YAAY;IAMzE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY;IAM9D,OAAO,CAAC,iBAAiB;IAmBnB,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA6B1E,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAoBpF"}