@hawcx/oauth-client 5.2.0 → 6.2.0

package/dist/profile/client.js

@@ -0,0 +1,209 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _ProfileClient_http, _ProfileClient_forUser, _UserProfileClient_http;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserProfileClient = exports.ProfileClient = void 0;
+/**
+ * Hawcx profile service client.
+ *
+ * - {@link ProfileClient} acts as the backend itself (`client_credentials`,
+ *   `private_key_jwt`) and manages any user in the tenant.
+ * - {@link UserProfileClient} (from {@link ProfileClient.forUser}) acts for one
+ *   signed-in user via an RFC 8693 exchange of their ID token (`profile:self`).
+ *
+ * Backend only: the OP refuses both grants to public clients.
+ */
+const errors_1 = require("../errors");
+const url_1 = require("../internal/url");
+const http_1 = require("./http");
+const tokens_1 = require("./tokens");
+const toPage = (r) => ({
+    items: r.items,
+    nextCursor: r.next_cursor ?? null,
+});
+const isPage = (d) => (0, http_1.isObject)(d) && Array.isArray(d.items);
+const isConsents = (d) => (0, http_1.isObject)(d) && (0, http_1.isObject)(d.current) && Array.isArray(d.history);
+const userPath = (userId) => ['v1', 'users', (0, http_1.segment)(userId, 'userId')];
+const pageQuery = (p = {}) => ({ limit: p.limit, cursor: p.cursor });
+/**
+ * Yield every item across pages. Stops (without error) if the server hands
+ * back a cursor it already returned, so a server bug can't loop forever.
+ */
+async function* paginate(fetchPage) {
+    const seen = new Set();
+    let cursor;
+    for (;;) {
+        const page = await fetchPage(cursor);
+        yield* page.items;
+        // null, missing or "" ends it.
+        if (!page.nextCursor || seen.has(page.nextCursor))
+            return;
+        seen.add(page.nextCursor);
+        cursor = page.nextCursor;
+    }
+}
+/** Consent + audit calls, shared by the machine (`users/{id}`) and delegated (`me`) clients. */
+async function consents(http, prefix, page) {
+    const r = await http.request('GET', [...prefix, 'consents'], { query: pageQuery(page), valid: isConsents });
+    return { current: r.current, history: r.history, nextCursor: r.next_cursor ?? null };
+}
+const setConsent = (http, prefix, purpose, input) => http.request('PUT', [...prefix, 'consents', (0, http_1.segment)(purpose, 'purpose')], {
+    body: input,
+});
+const audit = async (http, prefix, page) => toPage(await http.request('GET', [...prefix, 'audit'], {
+    query: pageQuery(page),
+    valid: isPage,
+}));
+/** Machine client: manage any user's profile, consents and audit trail in the tenant. */
+class ProfileClient {
+    /**
+     * @param oauth - a discovery-mode client with a signer:
+     *   `(await HawcxOAuth.fromIssuer(...)).withClientAssertion(signer)`.
+     */
+    constructor(oauth, options = {}) {
+        _ProfileClient_http.set(this, void 0);
+        _ProfileClient_forUser.set(this, void 0);
+        const ctx = oauth.profileContext();
+        if (ctx === null) {
+            throw new errors_1.HawcxError('ProfileClient requires a discovery-mode HawcxOAuth with a client assertion signer: ' +
+                '(await HawcxOAuth.fromIssuer({...})).withClientAssertion(signer)');
+        }
+        const base = (0, url_1.parseSecureBaseUrl)('baseUrl', options.baseUrl ?? `${ctx.issuer.replace(/\/+$/, '')}/profile`, message => new errors_1.HawcxError(message));
+        const timeout = options.timeout ?? 10000;
+        const http = (tokens, surface401 = false) => new http_1.ProfileHttp({
+            baseUrl: base.origin + base.pathPrefix,
+            configId: ctx.configId,
+            tokens,
+            fetch: options.fetch,
+            timeout,
+            maxRetries: options.maxRetries,
+            sleep: options.sleep,
+            surface401,
+        });
+        const tokenOpts = { fetch: options.fetch, timeout, now: options.now };
+        __classPrivateFieldSet(this, _ProfileClient_http, http((0, tokens_1.machineTokenSource)(oauth, { ...tokenOpts, scopes: options.scopes })), "f");
+        __classPrivateFieldSet(this, _ProfileClient_forUser, idToken => http((0, tokens_1.exchangeTokenSource)(oauth, idToken, { ...tokenOpts, audience: options.audience }), true), "f");
+    }
+    /**
+     * A client acting for the user whose ID token this is (its `aud` must be
+     * this same client). Exchanges lazily on first call and caches the token for
+     * its own lifetime. The OP caps that lifetime at the ID token's `exp` (60 s
+     * by default), so use it with the ID token you just received at sign-in; for
+     * later work on a user's profile use the machine methods with their
+     * `user_id` (the `sub` claim).
+     */
+    forUser(idToken) {
+        if (typeof idToken !== 'string' || idToken === '')
+            throw new errors_1.HawcxError('idToken is required');
+        return UserProfileClient.create(__classPrivateFieldGet(this, _ProfileClient_forUser, "f").call(this, idToken));
+    }
+    /** `GET /v1/users/{userId}` [users:read] */
+    async getUser(userId) {
+        return __classPrivateFieldGet(this, _ProfileClient_http, "f").request('GET', userPath(userId));
+    }
+    /** `GET /v1/users` [users:read] */
+    async listUsers(options = {}) {
+        const { limit, email, status, cursor } = options;
+        return toPage(await __classPrivateFieldGet(this, _ProfileClient_http, "f").request('GET', ['v1', 'users'], {
+            query: { limit, email, status, cursor },
+            valid: isPage,
+        }));
+    }
+    /** Every user matching the filters, following `next_cursor`. */
+    iterUsers(options = {}) {
+        return paginate(cursor => this.listUsers({ ...options, cursor }));
+    }
+    /**
+     * `POST /v1/users` [users:write]; 404 if the identity doesn't exist, 409 if
+     * the profile does. `user_id` must pass the same path-segment rules as
+     * `userId` elsewhere. Retried only on a transient token-endpoint failure.
+     */
+    async createUser(input) {
+        // Never create a record the other methods can't address.
+        (0, http_1.segment)(input?.user_id, 'user_id');
+        return __classPrivateFieldGet(this, _ProfileClient_http, "f").request('POST', ['v1', 'users'], { body: input });
+    }
+    /** `PATCH /v1/users/{userId}` [users:write]: `null` clears a field, an omitted key is unchanged. Retried only on a transient token-endpoint failure. */
+    async updateUser(userId, patch) {
+        return __classPrivateFieldGet(this, _ProfileClient_http, "f").request('PATCH', userPath(userId), { body: patch });
+    }
+    /** `PUT /v1/users/{userId}` [users:write] */
+    async replaceUser(userId, input) {
+        return __classPrivateFieldGet(this, _ProfileClient_http, "f").request('PUT', userPath(userId), { body: input });
+    }
+    /** `DELETE /v1/users/{userId}` [users:delete] */
+    async deleteUser(userId) {
+        await __classPrivateFieldGet(this, _ProfileClient_http, "f").request('DELETE', userPath(userId));
+    }
+    /** `GET /v1/users/{userId}/consents` [consent:read] */
+    async getConsents(userId, page) {
+        return consents(__classPrivateFieldGet(this, _ProfileClient_http, "f"), userPath(userId), page);
+    }
+    /** `PUT /v1/users/{userId}/consents/{purpose}` [consent:write]; 422 for an unknown purpose. */
+    async setConsent(userId, purpose, input) {
+        return setConsent(__classPrivateFieldGet(this, _ProfileClient_http, "f"), userPath(userId), purpose, input);
+    }
+    /** `GET /v1/users/{userId}/audit` [audit:read] */
+    async getAudit(userId, page) {
+        return audit(__classPrivateFieldGet(this, _ProfileClient_http, "f"), userPath(userId), page);
+    }
+    /** The user's whole audit trail, following `next_cursor`. */
+    iterAudit(userId, options = {}) {
+        return paginate(cursor => this.getAudit(userId, { limit: options.limit, cursor }));
+    }
+}
+exports.ProfileClient = ProfileClient;
+_ProfileClient_http = new WeakMap(), _ProfileClient_forUser = new WeakMap();
+/** Delegated client (`profile:self`): the signed-in user's own profile, consents and audit. */
+class UserProfileClient {
+    /** Not constructible directly: use {@link ProfileClient.forUser}. */
+    constructor(http) {
+        _UserProfileClient_http.set(this, void 0);
+        // Runtime guard for plain-JS callers; TypeScript already refuses `new`.
+        if (!(http instanceof http_1.ProfileHttp)) {
+            throw new errors_1.HawcxError('UserProfileClient is created with ProfileClient.forUser(idToken)');
+        }
+        __classPrivateFieldSet(this, _UserProfileClient_http, http, "f");
+    }
+    /** @internal */
+    static create(http) {
+        return new UserProfileClient(http);
+    }
+    /** `GET /v1/me` */
+    async getMe() {
+        return __classPrivateFieldGet(this, _UserProfileClient_http, "f").request('GET', ['v1', 'me']);
+    }
+    /** `PATCH /v1/me`: `null` clears a field, an omitted key is unchanged. Retried only on a transient token-endpoint failure. */
+    async updateMe(patch) {
+        return __classPrivateFieldGet(this, _UserProfileClient_http, "f").request('PATCH', ['v1', 'me'], { body: patch });
+    }
+    /** `GET /v1/me/consents` */
+    async getMyConsents(page) {
+        return consents(__classPrivateFieldGet(this, _UserProfileClient_http, "f"), ['v1', 'me'], page);
+    }
+    /** `PUT /v1/me/consents/{purpose}` */
+    async setMyConsent(purpose, input) {
+        return setConsent(__classPrivateFieldGet(this, _UserProfileClient_http, "f"), ['v1', 'me'], purpose, input);
+    }
+    /** `GET /v1/me/audit` */
+    async getMyAudit(page) {
+        return audit(__classPrivateFieldGet(this, _UserProfileClient_http, "f"), ['v1', 'me'], page);
+    }
+    /** The user's whole audit trail, following `next_cursor`. */
+    iterMyAudit(options = {}) {
+        return paginate(cursor => this.getMyAudit({ limit: options.limit, cursor }));
+    }
+}
+exports.UserProfileClient = UserProfileClient;
+_UserProfileClient_http = new WeakMap();
+//# sourceMappingURL=client.js.map

package/dist/profile/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/profile/client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,sCAAuC;AACvC,yCAAqD;AAErD,iCAAwD;AACxD,qCAAmE;AAwDnE,MAAM,MAAM,GAAG,CAAI,CAAc,EAAW,EAAE,CAAC,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;CAClC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACrE,MAAM,UAAU,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,IAAI,IAAA,eAAQ,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAElG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAA,cAAO,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,MAAM,SAAS,GAAG,CAAC,IAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAElF;;;GAGG;AACH,KAAK,SAAS,CAAC,CAAC,QAAQ,CAAI,SAAgD;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAA0B,CAAC;IAC/B,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAClB,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO;QAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,QAAQ,CACrB,IAAiB,EACjB,MAAgB,EAChB,IAAkB;IAElB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAIzB,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAiB,EAAE,MAAgB,EAAE,OAAe,EAAE,KAAmB,EAAE,EAAE,CAC/F,IAAI,CAAC,OAAO,CAAU,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,IAAA,cAAO,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE;IACjF,IAAI,EAAE,KAAK;CACZ,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,KAAK,EAAE,IAAiB,EAAE,MAAgB,EAAE,IAAkB,EAAE,EAAE,CAC9E,MAAM,CACJ,MAAM,IAAI,CAAC,OAAO,CAAuB,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE;IACpE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM;CACd,CAAC,CACH,CAAC;AAEJ,yFAAyF;AACzF,MAAa,aAAa;IAIxB;;;OAGG;IACH,YAAY,KAAiB,EAAE,UAAgC,EAAE;QAPxD,sCAAmB;QACnB,yCAA2C;QAOlD,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAU,CAClB,qFAAqF;gBACnF,kEAAkE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,wBAAkB,EAC7B,SAAS,EACT,OAAO,CAAC,OAAO,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAC9D,OAAO,CAAC,EAAE,CAAC,IAAI,mBAAU,CAAC,OAAO,CAAC,CACnC,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAM,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,MAA6C,EAAE,UAAU,GAAG,KAAK,EAAE,EAAE,CACjF,IAAI,kBAAW,CAAC;YACd,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU;YACtC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU;SACX,CAAC,CAAC;QACL,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACtE,uBAAA,IAAI,uBAAS,IAAI,CAAC,IAAA,2BAAkB,EAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAA,CAAC;QACvF,uBAAA,IAAI,0BAAY,OAAO,CAAC,EAAE,CACxB,IAAI,CAAC,IAAA,4BAAmB,EAAC,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,MAAA,CAAC;IAClG,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,OAAe;QACrB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;YAAE,MAAM,IAAI,mBAAU,CAAC,qBAAqB,CAAC,CAAC;QAC/F,OAAO,iBAAiB,CAAC,MAAM,CAAC,uBAAA,IAAI,8BAAS,MAAb,IAAI,EAAU,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,uBAAA,IAAI,2BAAM,CAAC,OAAO,CAAU,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,SAAS,CAAC,UAA4B,EAAE;QAC5C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACjD,OAAO,MAAM,CACX,MAAM,uBAAA,IAAI,2BAAM,CAAC,OAAO,CAAoB,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YAClE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;YACvC,KAAK,EAAE,MAAM;SACd,CAAC,CACH,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,SAAS,CAAC,UAA4C,EAAE;QACtD,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrC,yDAAyD;QACzD,IAAA,cAAO,EAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnC,OAAO,uBAAA,IAAI,2BAAM,CAAC,OAAO,CAAU,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,wJAAwJ;IACxJ,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAmB;QAClD,OAAO,uBAAA,IAAI,2BAAM,CAAC,OAAO,CAAU,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAuB;QACvD,OAAO,uBAAA,IAAI,2BAAM,CAAC,OAAO,CAAU,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,uBAAA,IAAI,2BAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,IAAkB;QAClD,OAAO,QAAQ,CAAC,uBAAA,IAAI,2BAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,KAAmB;QACnE,OAAO,UAAU,CAAC,uBAAA,IAAI,2BAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAkB;QAC/C,OAAO,KAAK,CAAC,uBAAA,IAAI,2BAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,6DAA6D;IAC7D,SAAS,CAAC,MAAc,EAAE,UAA8B,EAAE;QACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;CACF;AAtHD,sCAsHC;;AAED,+FAA+F;AAC/F,MAAa,iBAAiB;IAG5B,qEAAqE;IACrE,YAAoB,IAAkB;QAH7B,0CAAmB;QAI1B,wEAAwE;QACxE,IAAI,CAAC,CAAC,IAAI,YAAY,kBAAW,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,mBAAU,CAAC,kEAAkE,CAAC,CAAC;QAC3F,CAAC;QACD,uBAAA,IAAI,2BAAS,IAAI,MAAA,CAAC;IACpB,CAAC;IAED,gBAAgB;IAChB,MAAM,CAAC,MAAM,CAAC,IAAiB;QAC7B,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,mBAAmB;IACnB,KAAK,CAAC,KAAK;QACT,OAAO,uBAAA,IAAI,+BAAM,CAAC,OAAO,CAAU,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,8HAA8H;IAC9H,KAAK,CAAC,QAAQ,CAAC,KAAqB;QAClC,OAAO,uBAAA,IAAI,+BAAM,CAAC,OAAO,CAAU,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,aAAa,CAAC,IAAkB;QACpC,OAAO,QAAQ,CAAC,uBAAA,IAAI,+BAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,KAAmB;QACrD,OAAO,UAAU,CAAC,uBAAA,IAAI,+BAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,UAAU,CAAC,IAAkB;QACjC,OAAO,KAAK,CAAC,uBAAA,IAAI,+BAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,UAA8B,EAAE;QAC1C,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;CACF;AA9CD,8CA8CC"}

package/dist/profile/errors.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Profile service errors (RFC 9457 `application/problem+json`).
+ */
+import { HawcxError } from '../errors';
+export interface ProfileApiErrorInit {
+    /**
+     * HTTP status; `0` for a network failure or timeout (no response). A 2xx
+     * whose body could not be read keeps its status (the call ran).
+     */
+    status: number;
+    title?: string | null;
+    detail?: string | null;
+    type?: string | null;
+    instance?: string | null;
+    requestId?: string | null;
+    retryAfter?: number | null;
+    missing?: string[] | null;
+    fields?: string[] | null;
+    body?: Record<string, unknown> | null;
+    /** Response body text; capped with {@link capRawBody}. */
+    rawBody?: string | null;
+}
+/**
+ * `text` capped at 4096 UTF-16 code units, never ending on half a surrogate
+ * pair; `null` for an empty body.
+ */
+export declare function capRawBody(text: string): string | null;
+/**
+ * A non-2xx answer, unusable 2xx, or no answer from the Hawcx profile service. Message is
+ * `"<status> <title>: <detail>"`; never carries a token.
+ */
+export declare class ProfileApiError extends HawcxError {
+    readonly status: number;
+    readonly title: string | null;
+    readonly detail: string | null;
+    readonly type: string | null;
+    readonly instance: string | null;
+    /** `X-Request-Id` response header (else a body `request_id`, Kong), for support tickets. */
+    readonly requestId: string | null;
+    /** `Retry-After` in seconds, when the server sent one. */
+    readonly retryAfter: number | null;
+    /** Scopes the token lacked (403 insufficient scope). */
+    readonly missing: string[] | null;
+    /** Rejected request fields (422). */
+    readonly fields: string[] | null;
+    /** The parsed problem body, or `null` if the body was not a JSON object. */
+    readonly body: Record<string, unknown> | null;
+    /**
+     * The response body text as received (e.g. a gateway's HTML error page),
+     * capped at 4096 UTF-16 code units; `null` if empty or no response. On a
+     * 2xx it is kept only for a markup page: a body that does not parse as JSON
+     * and starts with `<` after whitespace or a BOM (any other 2xx body may carry profile
+     * PII). Never part of `message`.
+     */
+    readonly rawBody: string | null;
+    constructor(init: ProfileApiErrorInit, message?: string);
+}
+/** Trimmed `X-Request-Id`; if blank, a string `request_id` in a JSON-object body (Kong); else null. */
+export declare function requestIdFrom(headers: Headers, body: Record<string, unknown> | null): string | null;
+/** Map an error response to a {@link ProfileApiError}; never throws. */
+export declare function parseProblem(status: number, headers: Headers, bodyText: string): ProfileApiError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/profile/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/profile/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAID;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKtD;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEpB,IAAI,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,MAAM;CAiBxD;AAUD,uGAAuG;AACvG,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACnC,MAAM,GAAG,IAAI,CAEf;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CA6BhG"}

package/dist/profile/errors.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProfileApiError = void 0;
+exports.capRawBody = capRawBody;
+exports.requestIdFrom = requestIdFrom;
+exports.parseProblem = parseProblem;
+/**
+ * Profile service errors (RFC 9457 `application/problem+json`).
+ */
+const errors_1 = require("../errors");
+const RAW_BODY_CAP = 4096;
+/**
+ * `text` capped at 4096 UTF-16 code units, never ending on half a surrogate
+ * pair; `null` for an empty body.
+ */
+function capRawBody(text) {
+    if (text === '')
+        return null;
+    if (text.length <= RAW_BODY_CAP)
+        return text;
+    const last = text.charCodeAt(RAW_BODY_CAP - 1);
+    return text.slice(0, last >= 0xd800 && last <= 0xdbff ? RAW_BODY_CAP - 1 : RAW_BODY_CAP);
+}
+/**
+ * A non-2xx answer, unusable 2xx, or no answer from the Hawcx profile service. Message is
+ * `"<status> <title>: <detail>"`; never carries a token.
+ */
+class ProfileApiError extends errors_1.HawcxError {
+    constructor(init, message) {
+        const title = init.title ?? null;
+        const detail = init.detail ?? null;
+        super(message ?? `${init.status}${title ? ` ${title}` : ''}${detail ? `: ${detail}` : ''}`);
+        this.name = 'ProfileApiError';
+        this.status = init.status;
+        this.title = title;
+        this.detail = detail;
+        this.type = init.type ?? null;
+        this.instance = init.instance ?? null;
+        this.requestId = init.requestId ?? null;
+        this.retryAfter = init.retryAfter ?? null;
+        this.missing = init.missing ?? null;
+        this.fields = init.fields ?? null;
+        this.body = init.body ?? null;
+        this.rawBody = init.rawBody ?? null;
+    }
+}
+exports.ProfileApiError = ProfileApiError;
+/** A string, trimmed; blank counts as absent. */
+const text = (v) => {
+    const t = typeof v === 'string' ? v.trim() : '';
+    return t === '' ? null : t;
+};
+const strArray = (v) => Array.isArray(v) && v.every(x => typeof x === 'string') ? v : null;
+/** Trimmed `X-Request-Id`; if blank, a string `request_id` in a JSON-object body (Kong); else null. */
+function requestIdFrom(headers, body) {
+    return text(headers.get('X-Request-Id')) ?? text(body?.request_id);
+}
+/** Map an error response to a {@link ProfileApiError}; never throws. */
+function parseProblem(status, headers, bodyText) {
+    let body = null;
+    try {
+        const parsed = JSON.parse(bodyText);
+        if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            body = parsed;
+        }
+    }
+    catch {
+        // not JSON (e.g. a gateway HTML page): keep what the status tells us
+    }
+    // Delta-seconds only; an HTTP-date Retry-After falls back to backoff.
+    const ra = headers.get('Retry-After');
+    const retryAfter = ra !== null && /^\d+$/.test(ra.trim()) ? Number(ra.trim()) : null;
+    const title = text(body?.title);
+    // Kong answers {"message": ..., "request_id": ...}, not problem+json.
+    const detail = text(body?.detail) ?? (title === null ? text(body?.message) : null);
+    return new ProfileApiError({
+        status,
+        title,
+        detail,
+        type: text(body?.type),
+        instance: text(body?.instance),
+        requestId: requestIdFrom(headers, body),
+        retryAfter,
+        missing: strArray(body?.missing),
+        fields: strArray(body?.fields),
+        body,
+        rawBody: capRawBody(bodyText),
+    });
+}
+//# sourceMappingURL=errors.js.map

package/dist/profile/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/profile/errors.ts"],"names":[],"mappings":";;;AA8BA,gCAKC;AA2DD,sCAKC;AAGD,oCA6BC;AAnID;;GAEG;AACH,sCAAuC;AAqBvC,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;GAGG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAa,eAAgB,SAAQ,mBAAU;IAyB7C,YAAY,IAAyB,EAAE,OAAgB;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QACnC,KAAK,CAAC,OAAO,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,CAAC;CACF;AA1CD,0CA0CC;AAED,iDAAiD;AACjD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAiB,EAAE;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAmB,EAAE,CAC/C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AAEnF,uGAAuG;AACvG,SAAgB,aAAa,CAC3B,OAAgB,EAChB,IAAoC;IAEpC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC;AAED,wEAAwE;AACxE,SAAgB,YAAY,CAAC,MAAc,EAAE,OAAgB,EAAE,QAAgB;IAC7E,IAAI,IAAI,GAAmC,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,IAAI,GAAG,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,sEAAsE;IACtE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnF,OAAO,IAAI,eAAe,CAAC;QACzB,MAAM;QACN,KAAK;QACL,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC9B,SAAS,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC;QACvC,UAAU;QACV,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;QAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAC9B,IAAI;QACJ,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/dist/profile/http.d.ts

@@ -0,0 +1,57 @@
+import type { TokenSource } from './tokens';
+export interface ProfileHttpOptions {
+    /** Base URL, e.g. `https://api.hawcx.com/profile` (https, http only on loopback). */
+    baseUrl: string;
+    configId: string;
+    tokens: Pick<TokenSource, 'getToken' | 'invalidate'>;
+    /**
+     * `fetch` implementation. Failures from an injected fetch whose error shape
+     * isn't recognised (no connect-phase `code`/`errno`) count as "may have run".
+     */
+    fetch?: typeof fetch;
+    /** Per-request timeout in ms (default 10000). */
+    timeout?: number;
+    /**
+     * Retry budget per call (default 2): GET/PUT/DELETE on transient profile
+     * failures, and every method (POST/PATCH included) on a transient
+     * token-endpoint failure, since no profile request was sent.
+     */
+    maxRetries?: number;
+    /** Injectable for tests. */
+    sleep?: (ms: number) => Promise<void>;
+    /**
+     * After a 401, if minting the replay's token fails with a non-transient
+     * token error, throw that 401 instead (delegated client: the ID token has
+     * expired, so `invalid_grant` would hide the real answer).
+     */
+    surface401?: boolean;
+}
+export interface RequestOptions {
+    query?: Record<string, string | number | undefined>;
+    body?: unknown;
+    /** Shape check for a 2xx JSON body (default: a JSON object); `false` throws `Unexpected response body`. */
+    valid?: (data: unknown) => boolean;
+}
+export declare const isObject: (v: unknown) => v is Record<string, unknown>;
+/**
+ * Validate a caller-supplied path parameter and percent-encode it as exactly
+ * one segment (`?`, `#`, `%` encoded). Empty, `.`, `..`, and anything with
+ * `/`, `\` or a control character are refused client-side: an encoded `%2F`
+ * could still be decoded into a separator by a proxy.
+ */
+export declare function segment(value: string, name: string): string;
+export declare class ProfileHttp {
+    #private;
+    constructor(options: ProfileHttpOptions);
+    /**
+     * `segments` must already be encoded literals or {@link segment} output.
+     * Returns the parsed 2xx JSON body, which must pass `opts.valid` (default:
+     * a JSON object) or a `ProfileApiError` is thrown; a 204 to any method but
+     * DELETE is `Unexpected response body`. `null` only for a DELETE answered
+     * 2xx (whatever the body), or a DELETE answered 404 after an earlier attempt
+     * of the same call may have run (no response, a 2xx whose body failed
+     * mid-read, or 504).
+     */
+    request<T = unknown>(method: string, segments: string[], opts?: RequestOptions): Promise<T>;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/profile/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/profile/http.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC;IACrD;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2GAA2G;IAC3G,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CACpC;AAUD,eAAO,MAAM,QAAQ,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACP,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAc3D;AAED,qBAAa,WAAW;;gBAIV,OAAO,EAAE,kBAAkB;IAYvC;;;;;;;;OAQG;IACG,OAAO,CAAC,CAAC,GAAG,OAAO,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,EAClB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,CAAC,CAAC;CA0Kd"}