@hawcx/oauth-client 6.0.0 → 6.2.0

package/dist/oauth.d.ts

@@ -17,6 +17,7 @@
  */
 import { type JWTPayload } from 'jose';
 import { ClientAssertionSigner } from './client-assertion';
+import { ProfileClient, type ProfileClientOptions } from './profile/client';
 export interface HawcxOAuthConfig {
     /** Your Hawcx config-id (sent as the `X-Config-Id` header on token exchange) */
     configId: string;
@@ -66,6 +67,46 @@ export interface HawcxOAuthIssuerConfig {
      * Spec.md §3.3.
      */
     clockToleranceSeconds?: number;
+    /**
+     * Optional custom domain (a DNS CNAME to Hawcx), e.g.
+     * `https://auth.example.com`. `scheme://host[:port]` only: https (http only
+     * for loopback), ASCII/punycode host or IP literal, no userinfo, path,
+     * query or fragment; one trailing `/` allowed. Canonicalised (lower-cased,
+     * default port dropped). `null`/`undefined` = unset. Invalid →
+     * `HawcxOAuthError` `invalid_custom_domain`, before any discovery fetch.
+     *
+     * Affects only the browser-facing URLs from {@link HawcxOAuth.buildAuthorizeUrl}
+     * and {@link HawcxOAuth.buildEndSessionUrl} (scheme + host + port swapped,
+     * path kept). Discovery, token exchange, JWKS and the `iss` check stay on
+     * the issuer.
+     */
+    customDomain?: string | null;
+}
+/** Options for {@link HawcxOAuth.buildAuthorizeUrl}. */
+export interface AuthorizeUrlOptions {
+    /** `redirect_uri` registered for the client. Required. */
+    redirectUri: string;
+    /** Opaque CSRF `state`. Required. */
+    state: string;
+    /** PKCE S256 `code_challenge`. Required. */
+    codeChallenge: string;
+    /** Optional OIDC `nonce`; pass the same value to `exchangeCode` as `expectedNonce`. */
+    nonce?: string;
+    /** Space-separated scopes (default `openid`). */
+    scope?: string;
+    /** Optional OIDC `prompt` (e.g. `login`). */
+    prompt?: string;
+    /**
+     * Additional query parameters (non-empty keys, string values). May not
+     * override any parameter the SDK sets, nor `request` / `request_uri`.
+     */
+    extraParams?: Record<string, string>;
+}
+/** Options for {@link HawcxOAuth.buildEndSessionUrl}. */
+export interface EndSessionUrlOptions {
+    postLogoutRedirectUri?: string;
+    idTokenHint?: string;
+    state?: string;
 }
 export interface JwtClaims extends JWTPayload {
     /** Subject (user ID) */
@@ -168,6 +209,8 @@ export declare class HawcxOAuth {
      * which returns a *new* configured client (this field is `readonly`).
      */
     private readonly clientAssertionSigner;
+    /** Validated custom-domain origin for browser URLs; `null` if unset or legacy mode. */
+    private readonly customDomain;
     /**
      * Construct a legacy-mode client. For discovery mode, prefer
      * {@link HawcxOAuth.fromIssuer}.
@@ -212,6 +255,14 @@ export declare class HawcxOAuth {
      * (the assertion would be silently ignored).
      */
     withClientAssertion(signer: ClientAssertionSigner): HawcxOAuth;
+    /**
+     * Client for the Hawcx profile service, built from this discovery-mode
+     * client and its {@link withClientAssertion} signer. Same as
+     * `new ProfileClient(oauth, options)`.
+     *
+     * @throws {HawcxError} in legacy mode or without a client-assertion signer.
+     */
+    profile(options?: ProfileClientOptions): ProfileClient;
     /**
      * Exchange authorization code for id_token and verified claims.
      *
@@ -261,5 +312,42 @@ export declare class HawcxOAuth {
      */
     clearCache(): void;
     private clearCacheWarned;
+    /**
+     * Build the browser `/authorize` URL (discovery mode only; no I/O).
+     *
+     * Base is the discovered `authorization_endpoint`; with `customDomain` set,
+     * its scheme + host + port are replaced by the custom domain's (path and any
+     * existing query kept). Sets `response_type=code`, `client_id`,
+     * `redirect_uri`, `scope` (default `openid`), `state`, `code_challenge`,
+     * `code_challenge_method=S256`, plus `nonce` / `prompt` / `extraParams`
+     * when given.
+     *
+     * @throws {HawcxOAuthError} `issuer_mode_required` in legacy mode;
+     *   `invalid_request` for a missing required option or a reserved
+     *   `extraParams` key.
+     * @throws {DiscoveryError} `invalid_discovery_document` if the discovered
+     *   `authorization_endpoint` is missing or insecure.
+     */
+    buildAuthorizeUrl(options: AuthorizeUrlOptions): string;
+    /**
+     * Build the browser RP-initiated logout URL (discovery mode only; no I/O).
+     * Base is the discovered `end_session_endpoint`, with the same
+     * `customDomain` origin swap as {@link buildAuthorizeUrl}. Always sets
+     * `client_id`; `post_logout_redirect_uri`, `id_token_hint` and `state` when given.
+     *
+     * @throws {HawcxOAuthError} `issuer_mode_required` in legacy mode.
+     * @throws {DiscoveryError} `invalid_discovery_document` if the discovered
+     *   `end_session_endpoint` is missing or insecure.
+     */
+    buildEndSessionUrl(options?: EndSessionUrlOptions | null): string;
+    /**
+     * Build a browser URL from a discovered endpoint, validated lazily (so
+     * fromIssuer keeps accepting documents without it): origin (custom domain
+     * if set, else the endpoint's) + RAW path + RAW query + `&` + SDK params.
+     * The endpoint query is copied verbatim, never re-serialised, and may not
+     * carry any of `sdkNames`; an `extraKeys` name it already carries is an
+     * `invalid_request` (RFC 6749 §3.1: no repeated parameters).
+     */
+    private browserUrl;
 }
 //# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AAmClF,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAErD,OAAO,CAAC,IAAI,CAAsD;IAElE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IAErE;;;OAGG;gBACS,MAAM,EAAE,gBAAgB;IAuCpC;;;;;;;;;;;;;;;OAeG;WACU,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;IAgI5E;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,UAAU;IA6B9D;;;;;;;;;;;;OAYG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;IA4F1B;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IA8ElF;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAoBf;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,gBAAgB,CAAS;CAClC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AAclF,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AA4B5E,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiCD,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAkDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAErD,OAAO,CAAC,IAAI,CAAsD;IAElE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IAErE,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C;;;OAGG;gBACS,MAAM,EAAE,gBAAgB;IAyCpC;;;;;;;;;;;;;;;OAeG;WACU,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;IAuI5E;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,UAAU;IA8B9D;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,aAAa;IAatD;;;;;;;;;;;;OAYG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;IAwI1B;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IA8ElF;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAoBf;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,gBAAgB,CAAS;IAEjC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAkCvD;;;;;;;;;OASG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,GAAG,MAAM;IAUjE;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;CAwDnB"}

package/dist/oauth.js

@@ -22,6 +22,7 @@ const jose_1 = require("jose");
 const client_assertion_1 = require("./client-assertion");
 const errors_1 = require("./errors");
 const url_1 = require("./internal/url");
+const client_1 = require("./profile/client");
 const DEFAULT_BASE_URL = 'https://api.hawcx.com';
 const DEFAULT_TIMEOUT_MS = 10000;
 /** Bound the discovery fetch so an unreachable issuer fails fast at startup. */
@@ -47,6 +48,35 @@ const DEFAULT_ID_TOKEN_ALGS = Object.freeze([
     'ES512',
     'EdDSA',
 ]);
+/** Authorize params the SDK sets itself; neither the endpoint query nor `extraParams` may carry them. */
+const AUTHORIZE_SDK_PARAMS = [
+    'response_type',
+    'client_id',
+    'redirect_uri',
+    'scope',
+    'state',
+    'nonce',
+    'code_challenge',
+    'code_challenge_method',
+    'prompt',
+];
+/** Authorize names an endpoint query may not carry: SDK-set plus JAR (contract R9). */
+const AUTHORIZE_COLLISION_NAMES = [...AUTHORIZE_SDK_PARAMS, 'request', 'request_uri'];
+/** End-session params the SDK sets itself; the endpoint query may not carry them. */
+const END_SESSION_SDK_PARAMS = [
+    'client_id',
+    'post_logout_redirect_uri',
+    'id_token_hint',
+    'state',
+];
+/** `extraParams` keys refused: SDK-set names plus JAR, which could replace them all. */
+const RESERVED_EXTRA_PARAMS = new Set([
+    ...AUTHORIZE_SDK_PARAMS,
+    'request',
+    'request_uri',
+]);
+/** Empty or ASCII-whitespace-only (cross-SDK "blank" rule R2; NBSP/BOM are not blank). */
+const isBlank = (v) => typeof v !== 'string' || /^[ \t\n\v\f\r]*$/.test(v);
 /**
  * Require https on a discovery-related URL. Plaintext http is permitted only
  * for the exact loopback hosts (localhost / 127.0.0.1 / [::1]) to support
@@ -105,6 +135,7 @@ class HawcxOAuth {
             this.discoveryMetadata = discoveryInit.metadata;
             this.allowedAlgorithms = discoveryInit.allowedAlgorithms;
             this.clientAssertionSigner = discoveryInit.signer ?? null;
+            this.customDomain = discoveryInit.customDomain ?? null;
         }
         else {
             // Structured parse + join (TOB-HSDK-13): the authorization code is
@@ -117,6 +148,7 @@ class HawcxOAuth {
             this.discoveryMetadata = null;
             this.allowedAlgorithms = null;
             this.clientAssertionSigner = null;
+            this.customDomain = null;
         }
     }
     /**
@@ -149,6 +181,9 @@ class HawcxOAuth {
         // RFC 8414 §2: the issuer has no query or fragment. Join structurally so
         // the discovery URL cannot leave the issuer's origin (TOB-HSDK-13).
         const issuerBase = (0, url_1.parseSecureBaseUrl)('issuer', issuer, discoveryUrlError);
+        const customDomain = config.customDomain != null
+            ? (0, url_1.parseCustomDomain)(config.customDomain, (message) => new errors_1.HawcxOAuthError(message, { error: 'invalid_custom_domain' }))
+            : null;
         const discoveryUrl = (0, url_1.safeJoinUrl)(issuerBase, '/.well-known/openid-configuration', 'discovery URL', discoveryUrlError);
         const timeout = config.discoveryTimeout ?? DEFAULT_DISCOVERY_TIMEOUT_MS;
         let response;
@@ -231,7 +266,7 @@ class HawcxOAuth {
             configId: config.configId,
             timeout: config.timeout,
             clockToleranceSeconds: config.clockToleranceSeconds,
-        }, { metadata, clientId: config.clientId, allowedAlgorithms });
+        }, { metadata, clientId: config.clientId, allowedAlgorithms, customDomain });
     }
     /**
      * Opt into `private_key_jwt` client authentication (discovery mode only).
@@ -273,8 +308,28 @@ class HawcxOAuth {
             clientId: this.expectedAudience,
             allowedAlgorithms: this.allowedAlgorithms,
             signer,
+            customDomain: this.customDomain,
         });
     }
+    /**
+     * Client for the Hawcx profile service, built from this discovery-mode
+     * client and its {@link withClientAssertion} signer. Same as
+     * `new ProfileClient(oauth, options)`.
+     *
+     * @throws {HawcxError} in legacy mode or without a client-assertion signer.
+     */
+    profile(options) {
+        return new client_1.ProfileClient(this, options);
+    }
+    /**
+     * @internal What the profile client needs; `null` unless discovery mode
+     * with a signer. Not part of the public `.d.ts`.
+     */
+    profileContext() {
+        if (this.discoveryMetadata === null || this.clientAssertionSigner === null)
+            return null;
+        return { issuer: this.discoveryMetadata.issuer, configId: this.configId };
+    }
     /**
      * Exchange authorization code for id_token and verified claims.
      *
@@ -300,6 +355,22 @@ class HawcxOAuth {
         if (redirectUri) {
             body.append('redirect_uri', redirectUri);
         }
+        const data = (await this.postTokenForm(body));
+        const idToken = data.id_token;
+        if (!idToken) {
+            throw new errors_1.TokenExchangeError('Response missing id_token');
+        }
+        const claims = await this.verifyToken(idToken, expectedNonce !== undefined ? { nonce: expectedNonce } : undefined);
+        return { idToken, claims };
+    }
+    /**
+     * @internal POST `body` to the token endpoint as this client: adds
+     * `client_id` (discovery mode) and, with a signer, a fresh RFC 7523
+     * `client_assertion`; sends `X-Config-Id`; never follows redirects; maps
+     * failures to {@link TokenExchangeError}. Shared by {@link exchangeCode} and
+     * the profile client's token sources. Returns the parsed JSON body.
+     */
+    async postTokenForm(body, options = {}) {
         // Discovery mode: always identify the client with `client_id` in the form,
         // for public (PKCE) and private_key_jwt alike (RFC 6749 §4.1.3). Without
         // it the OP resolves the client from `X-Config-Id` alone, falls back to
@@ -323,7 +394,7 @@ class HawcxOAuth {
         }
         let response;
         try {
-            response = await fetch(this.tokenEndpoint, {
+            response = await (options.fetch ?? fetch)(this.tokenEndpoint, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/x-www-form-urlencoded',
@@ -331,11 +402,16 @@ class HawcxOAuth {
                     Accept: 'application/json',
                 },
                 body: body.toString(),
-                signal: AbortSignal.timeout(this.timeout),
+                // Never follow a redirect: the code / assertion / subject token must
+                // not be replayed to another host.
+                redirect: 'manual',
+                signal: AbortSignal.timeout(options.timeout ?? this.timeout),
             });
         }
         catch (err) {
-            throw new errors_1.TokenExchangeError(`Network error: ${err}`);
+            const e = new errors_1.TokenExchangeError(`Network error: ${err}`, undefined, { network: true });
+            e.cause = err;
+            throw e;
         }
         if (!response.ok) {
             let errorMsg = `HTTP ${response.status}`;
@@ -360,13 +436,30 @@ class HawcxOAuth {
                 errorDescription: errDesc,
             });
         }
-        const data = (await response.json());
-        const idToken = data.id_token;
-        if (!idToken) {
-            throw new errors_1.TokenExchangeError('Response missing id_token');
+        // A body that fails mid-read is a transport failure (retryable); one that
+        // arrived whole but is not a JSON object is a bad answer.
+        let text;
+        try {
+            text = await response.text();
         }
-        const claims = await this.verifyToken(idToken, expectedNonce !== undefined ? { nonce: expectedNonce } : undefined);
-        return { idToken, claims };
+        catch (err) {
+            // Keep the 2xx status: for exchangeCode the OP has already minted and the
+            // single-use code is spent, so a retry would get invalid_grant.
+            const e = new errors_1.TokenExchangeError(`Network error reading token response: ${err}`, response.status, { network: true });
+            e.cause = err;
+            throw e;
+        }
+        let data;
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            data = undefined;
+        }
+        if (data === null || typeof data !== 'object' || Array.isArray(data)) {
+            throw new errors_1.TokenExchangeError('Invalid JSON in token response', response.status);
+        }
+        return data;
     }
     /**
      * Verify a JWT token and return its claims.
@@ -503,6 +596,133 @@ class HawcxOAuth {
         }
         this.refreshJwks();
     }
+    /**
+     * Build the browser `/authorize` URL (discovery mode only; no I/O).
+     *
+     * Base is the discovered `authorization_endpoint`; with `customDomain` set,
+     * its scheme + host + port are replaced by the custom domain's (path and any
+     * existing query kept). Sets `response_type=code`, `client_id`,
+     * `redirect_uri`, `scope` (default `openid`), `state`, `code_challenge`,
+     * `code_challenge_method=S256`, plus `nonce` / `prompt` / `extraParams`
+     * when given.
+     *
+     * @throws {HawcxOAuthError} `issuer_mode_required` in legacy mode;
+     *   `invalid_request` for a missing required option or a reserved
+     *   `extraParams` key.
+     * @throws {DiscoveryError} `invalid_discovery_document` if the discovered
+     *   `authorization_endpoint` is missing or insecure.
+     */
+    buildAuthorizeUrl(options) {
+        const bad = (message) => new errors_1.HawcxOAuthError(`buildAuthorizeUrl: ${message}`, { error: 'invalid_request' });
+        for (const field of ['redirectUri', 'state', 'codeChallenge']) {
+            if (isBlank(options?.[field]))
+                throw bad(`${field} is required`);
+        }
+        const extra = Object.entries(options.extraParams ?? {});
+        for (const [key, value] of extra) {
+            if (key === '')
+                throw bad('extraParams keys must be non-empty');
+            if (typeof value !== 'string')
+                throw bad(`extraParams value for '${key}' must be a string`);
+            if (RESERVED_EXTRA_PARAMS.has(key)) {
+                throw bad(`extraParams may not override reserved parameter '${key}'`);
+            }
+        }
+        const p = new URLSearchParams();
+        p.set('response_type', 'code');
+        p.set('client_id', this.expectedAudience);
+        p.set('redirect_uri', options.redirectUri);
+        p.set('scope', isBlank(options.scope) ? 'openid' : options.scope);
+        p.set('state', options.state);
+        if (!isBlank(options.nonce))
+            p.set('nonce', options.nonce);
+        p.set('code_challenge', options.codeChallenge);
+        p.set('code_challenge_method', 'S256');
+        if (!isBlank(options.prompt))
+            p.set('prompt', options.prompt);
+        for (const [k, v] of extra)
+            p.append(k, v);
+        return this.browserUrl('authorization_endpoint', 'buildAuthorizeUrl', AUTHORIZE_COLLISION_NAMES, p, extra.map(([k]) => k));
+    }
+    /**
+     * Build the browser RP-initiated logout URL (discovery mode only; no I/O).
+     * Base is the discovered `end_session_endpoint`, with the same
+     * `customDomain` origin swap as {@link buildAuthorizeUrl}. Always sets
+     * `client_id`; `post_logout_redirect_uri`, `id_token_hint` and `state` when given.
+     *
+     * @throws {HawcxOAuthError} `issuer_mode_required` in legacy mode.
+     * @throws {DiscoveryError} `invalid_discovery_document` if the discovered
+     *   `end_session_endpoint` is missing or insecure.
+     */
+    buildEndSessionUrl(options) {
+        const o = options ?? {};
+        const p = new URLSearchParams();
+        p.set('client_id', this.expectedAudience);
+        if (!isBlank(o.postLogoutRedirectUri))
+            p.set('post_logout_redirect_uri', o.postLogoutRedirectUri);
+        if (!isBlank(o.idTokenHint))
+            p.set('id_token_hint', o.idTokenHint);
+        if (!isBlank(o.state))
+            p.set('state', o.state);
+        return this.browserUrl('end_session_endpoint', 'buildEndSessionUrl', END_SESSION_SDK_PARAMS, p);
+    }
+    /**
+     * Build a browser URL from a discovered endpoint, validated lazily (so
+     * fromIssuer keeps accepting documents without it): origin (custom domain
+     * if set, else the endpoint's) + RAW path + RAW query + `&` + SDK params.
+     * The endpoint query is copied verbatim, never re-serialised, and may not
+     * carry any of `sdkNames`; an `extraKeys` name it already carries is an
+     * `invalid_request` (RFC 6749 §3.1: no repeated parameters).
+     */
+    browserUrl(field, method, sdkNames, params, extraKeys = []) {
+        if (this.discoveryMetadata === null) {
+            throw new errors_1.HawcxOAuthError(`${method} requires issuer mode: build the client via HawcxOAuth.fromIssuer(...)`, { error: 'issuer_mode_required' });
+        }
+        const invalid = (message, cause) => new errors_1.DiscoveryError(`Discovery document: ${message}`, {
+            error: 'invalid_discovery_document',
+            ...(cause !== undefined && { cause }),
+        });
+        const raw = this.discoveryMetadata[field];
+        (0, url_1.assertSecureUrl)(field, raw, invalid);
+        // Checked raw: WHATWG strips tab/CR/LF and encodes space/"/</>, but the
+        // raw path and query are what gets emitted (contract R1).
+        if (/[^\x21-\x7e]|[\\"<>^`{|}#]/.test(raw)) {
+            throw invalid(`${field} must be printable ASCII without a fragment or any of \\ " < > ^ \` { | }`);
+        }
+        // Raw path + query: everything after a non-empty `//authority` (WHATWG
+        // also accepts `https:host` and `https:///host`; the other SDKs do not).
+        const m = /^([A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?]+)(.*)$/.exec(raw);
+        if (m === null)
+            throw invalid(`${field} has no host`);
+        // An empty userinfo (`https://@h`) or empty port (`https://h:`) passes WHATWG but not the other SDKs.
+        if (/@|:$/.test(m[1].slice(m[1].indexOf('//') + 2)))
+            throw invalid(`${field} has userinfo or an empty port`);
+        const rest = m[2];
+        const q = rest.indexOf('?');
+        const path = q === -1 ? rest : rest.slice(0, q);
+        const query = q === -1 ? '' : rest.slice(q + 1);
+        for (const piece of query.split('&')) {
+            const name = piece.split('=', 1)[0];
+            let decoded = name;
+            try {
+                decoded = decodeURIComponent(name);
+            }
+            catch {
+                // malformed escape: compare the raw name
+            }
+            if (sdkNames.includes(decoded)) {
+                throw invalid(`${field} query must not set SDK parameter '${decoded}'`);
+            }
+            if (extraKeys.includes(decoded)) {
+                throw new errors_1.HawcxOAuthError(`${method}: extraParams key '${decoded}' is already in the ${field} query`, {
+                    error: 'invalid_request',
+                });
+            }
+        }
+        // Raw scheme + authority when no custom domain (contract R6).
+        const origin = this.customDomain ?? m[1];
+        return `${origin}${path}?${query === '' ? '' : query + '&'}${params}`;
+    }
 }
 exports.HawcxOAuth = HawcxOAuth;
 //# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH,+BAAsE;AACtE,yDAAkF;AAClF,qCAKkB;AAClB,wCAAwG;AAExG,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,gFAAgF;AAChF,MAAM,4BAA4B,GAAG,IAAK,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAqHH;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,GAAW;IAClD,IAAA,qBAAe,EAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,iBAAiB,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC5D,IAAI,uBAAc,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,cAAc,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;IACzD,MAAM,GAAG,GAAG,IAAI,wBAAe,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAG,GAA2B,CAAC,KAAK,GAAG,KAAK,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,UAAU;IA4CrB,YAAY,MAAwB,EAAE,aAA6B;QArB3D,SAAI,GAAiD,IAAI,CAAC;QAsf1D,qBAAgB,GAAG,KAAK,CAAC;QAhe/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACpD,IAAI,CAAC,qBAAqB;YACxB,MAAM,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,wDAAwD;YACxD,MAAM,IAAI,GAAG,IAAA,wBAAkB,EAAC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,CAAC,aAAa,GAAG,IAAA,iBAAW,EAAC,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC1F,IAAI,CAAC,OAAO,GAAG,IAAA,iBAAW,EAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;YAC3E,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,UAAU,GAAG,IAAA,wBAAkB,EAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,IAAA,iBAAW,EAC9B,UAAU,EACV,mCAAmC,EACnC,eAAe,EACf,iBAAiB,CAClB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,4BAA4B,CAAC;QAExE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CAAC,4BAA4B,YAAY,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAc,CACtB,gCAAgC,QAAQ,CAAC,MAAM,OAAO,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CACtB,8BAA8B,YAAY,oBAAoB,EAC9D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,+BAA+B,KAAK,GAAG,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,gBAAgB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAClD,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC/D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,6BAA6B;gBAChE,4EAA4E,CAC/E,CAAC;QACJ,CAAC;QACD,6DAA6D;QAC7D,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CACxD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,0CAA0C;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mCAAmC;gBAC/D,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,uBAAuB;gBAC/D,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,qCAAqC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,GAAG,CAAC,QAAQ,CAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAc,CACtB,8BAA8B,aAAa,8BAA8B;gBACvE,eAAe,MAAM,mDAAmD,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,GAAG,GAAG;YACN,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,aAAa;YAC7B,QAAQ,EAAE,OAAO;YACjB,qCAAqC,EAAE,SAAS;SACjD,CAAC;QAEF,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,EACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAA6B;QAC/C,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAc,CACtB,uFAAuF;gBACrF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yDAAyD;gBACpF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,EACD;YACE,QAAQ,EAAE,IAAI,CAAC,iBAAiB;YAChC,QAAQ,EAAE,IAAI,CAAC,gBAA0B;YACzC,iBAAiB,EAAE,IAAI,CAAC,iBAAsC;YAC9D,MAAM;SACP,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAoB,EACpB,WAAoB,EACpB,aAAsB;QAEtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,kCAAkC;QAClC,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACvD,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAiB,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wCAAqB,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CACT,kBAAkB,EAClB,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;oBAC5B,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,OAA2B,CAAC;YAChC,IAAI,OAA2B,CAAC;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;oBACrB,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBACjC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,OAAO;gBACd,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,OAAO,EACP,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAA4B;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,qEAAqE;gBACrE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI;oBACrC,UAAU,EAAE,IAAI,CAAC,iBAA6B;iBAC/C,CAAC;gBACF,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,cAAc,EAAE,IAAI,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,+BAAsB,CAC9B,mCAAmC,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,KAAK,IAAI,WAAW,IAAI,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjE,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,IAAI,+BAAsB,CAC9B,iEAAiE;oBAC/D,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAEhF,qCAAqC;YACrC,IAAI,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC/C,uDAAuD;gBACvD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;gBAChD,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBAC3F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtC,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,uEAAuE;gBACvE,mEAAmE;gBACnE,sCAAsC;gBACtC,eAAe,EAAE,IAAI,CAAC,OAAO;gBAC7B,GAAG,CAAC,oBAAoB,IAAI;oBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,qEAAqE;QACrE,8EAA8E;QAC9E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,uEAAuE;gBACrE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;CAGF;AA9gBD,gCA8gBC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH,+BAAsE;AACtE,yDAAkF;AAClF,qCAKkB;AAClB,wCAMwB;AACxB,6CAA4E;AAE5E,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,gFAAgF;AAChF,MAAM,4BAA4B,GAAG,IAAK,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAgGH,yGAAyG;AACzG,MAAM,oBAAoB,GAAsB;IAC9C,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;IACvB,QAAQ;CACT,CAAC;AACF,uFAAuF;AACvF,MAAM,yBAAyB,GAAsB,CAAC,GAAG,oBAAoB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACzG,qFAAqF;AACrF,MAAM,sBAAsB,GAAsB;IAChD,WAAW;IACX,0BAA0B;IAC1B,eAAe;IACf,OAAO;CACR,CAAC;AACF,wFAAwF;AACxF,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,GAAG,oBAAoB;IACvB,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAiE7F;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,GAAW;IAClD,IAAA,qBAAe,EAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,iBAAiB,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC5D,IAAI,uBAAc,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,cAAc,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;IACzD,MAAM,GAAG,GAAG,IAAI,wBAAe,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAG,GAA2B,CAAC,KAAK,GAAG,KAAK,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAuBF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,UAAU;IA+CrB,YAAY,MAAwB,EAAE,aAA6B;QAxB3D,SAAI,GAAiD,IAAI,CAAC;QAmkB1D,qBAAgB,GAAG,KAAK,CAAC;QA1iB/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACpD,IAAI,CAAC,qBAAqB;YACxB,MAAM,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC;YAC1D,IAAI,CAAC,YAAY,GAAG,aAAa,CAAC,YAAY,IAAI,IAAI,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,wDAAwD;YACxD,MAAM,IAAI,GAAG,IAAA,wBAAkB,EAAC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,CAAC,aAAa,GAAG,IAAA,iBAAW,EAAC,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC1F,IAAI,CAAC,OAAO,GAAG,IAAA,iBAAW,EAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;YAC3E,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,UAAU,GAAG,IAAA,wBAAkB,EAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY,IAAI,IAAI;YACzB,CAAC,CAAC,IAAA,uBAAiB,EACf,MAAM,CAAC,YAAY,EACnB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,wBAAe,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAC9E;YACH,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,YAAY,GAAG,IAAA,iBAAW,EAC9B,UAAU,EACV,mCAAmC,EACnC,eAAe,EACf,iBAAiB,CAClB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,4BAA4B,CAAC;QAExE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CAAC,4BAA4B,YAAY,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAc,CACtB,gCAAgC,QAAQ,CAAC,MAAM,OAAO,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CACtB,8BAA8B,YAAY,oBAAoB,EAC9D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,+BAA+B,KAAK,GAAG,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,gBAAgB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAClD,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC/D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,6BAA6B;gBAChE,4EAA4E,CAC/E,CAAC;QACJ,CAAC;QACD,6DAA6D;QAC7D,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CACxD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,0CAA0C;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mCAAmC;gBAC/D,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,uBAAuB;gBAC/D,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,qCAAqC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,GAAG,CAAC,QAAQ,CAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAc,CACtB,8BAA8B,aAAa,8BAA8B;gBACvE,eAAe,MAAM,mDAAmD,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,GAAG,GAAG;YACN,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,aAAa;YAC7B,QAAQ,EAAE,OAAO;YACjB,qCAAqC,EAAE,SAAS;SACjD,CAAC;QAEF,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,EACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,CACzE,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAA6B;QAC/C,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAc,CACtB,uFAAuF;gBACrF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yDAAyD;gBACpF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,EACD;YACE,QAAQ,EAAE,IAAI,CAAC,iBAAiB;YAChC,QAAQ,EAAE,IAAI,CAAC,gBAA0B;YACzC,iBAAiB,EAAE,IAAI,CAAC,iBAAsC;YAC9D,MAAM;YACN,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,OAA8B;QACpC,OAAO,IAAI,sBAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,qBAAqB,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACxF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAoB,EACpB,WAAoB,EACpB,aAAsB;QAEtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAkB,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,OAAO,EACP,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,IAAqB,EACrB,UAAsD,EAAE;QAExD,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,kCAAkC;QAClC,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACvD,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAiB,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wCAAqB,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CACT,kBAAkB,EAClB,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;oBAC5B,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,qEAAqE;gBACrE,mCAAmC;gBACnC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAyB,CAAC,KAAK,GAAG,GAAG,CAAC;YACvC,MAAM,CAAC,CAAC;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,OAA2B,CAAC;YAChC,IAAI,OAA2B,CAAC;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;oBACrB,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBACjC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,OAAO;gBACd,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,0DAA0D;QAC1D,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,gEAAgE;YAChE,MAAM,CAAC,GAAG,IAAI,2BAAkB,CAC9B,yCAAyC,GAAG,EAAE,EAC9C,QAAQ,CAAC,MAAM,EACf,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;YACD,CAAyB,CAAC,KAAK,GAAG,GAAG,CAAC;YACvC,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,2BAAkB,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,IAA+B,CAAC;IACzC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAA4B;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,qEAAqE;gBACrE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI;oBACrC,UAAU,EAAE,IAAI,CAAC,iBAA6B;iBAC/C,CAAC;gBACF,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,cAAc,EAAE,IAAI,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,+BAAsB,CAC9B,mCAAmC,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,KAAK,IAAI,WAAW,IAAI,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjE,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,IAAI,+BAAsB,CAC9B,iEAAiE;oBAC/D,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAEhF,qCAAqC;YACrC,IAAI,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC/C,uDAAuD;gBACvD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;gBAChD,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBAC3F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtC,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,uEAAuE;gBACvE,mEAAmE;gBACnE,sCAAsC;gBACtC,eAAe,EAAE,IAAI,CAAC,OAAO;gBAC7B,GAAG,CAAC,oBAAoB,IAAI;oBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,qEAAqE;QACrE,8EAA8E;QAC9E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,uEAAuE;gBACrE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAID;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,OAA4B;QAC5C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAC9B,IAAI,wBAAe,CAAC,sBAAsB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACrF,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe,CAAU,EAAE,CAAC;YACvE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,EAAE;gBAAE,MAAM,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC,0BAA0B,GAAG,oBAAoB,CAAC,CAAC;YAC5F,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,CAAC,oDAAoD,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAiB,CAAC,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAM,CAAC,CAAC;QACnE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAM,CAAC,CAAC;QAC5D,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAO,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK;YAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,UAAU,CACpB,wBAAwB,EACxB,mBAAmB,EACnB,yBAAyB,EACzB,CAAC,EACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,kBAAkB,CAAC,OAAqC;QACtD,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAiB,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,qBAAsB,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,WAAY,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;;OAOG;IACK,UAAU,CAChB,KAAwD,EACxD,MAAc,EACd,QAA2B,EAC3B,MAAuB,EACvB,YAA+B,EAAE;QAEjC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,wBAAe,CACvB,GAAG,MAAM,wEAAwE,EACjF,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAClC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAClD,IAAI,uBAAc,CAAC,uBAAuB,OAAO,EAAE,EAAE;YACnD,KAAK,EAAE,4BAA4B;YACnC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC,CAAC,CAAC;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAW,CAAC;QACpD,IAAA,qBAAe,EAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,OAAO,CAAC,GAAG,KAAK,2EAA2E,CAAC,CAAC;QACrG,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,OAAO,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QACtD,sGAAsG;QACtG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,OAAO,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;QAC7G,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;YAC3C,CAAC;YACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,GAAG,KAAK,sCAAsC,OAAO,GAAG,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,wBAAe,CAAC,GAAG,MAAM,sBAAsB,OAAO,uBAAuB,KAAK,QAAQ,EAAE;oBACpG,KAAK,EAAE,iBAAiB;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO,GAAG,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;IACxE,CAAC;CACF;AAluBD,gCAkuBC"}

package/dist/profile/client.d.ts

@@ -0,0 +1,99 @@
+import type { HawcxOAuth } from '../oauth';
+import type { AuditEvent, Consent, ConsentInput, ConsentsPage, CreateUserInput, ListUsersOptions, MyProfilePatch, Page, PageOptions, Profile, ProfilePatch, ReplaceUserInput } from './types';
+export interface ProfileClientOptions {
+    /** Profile service base URL (default `{issuer}/profile`). https, or http on loopback only. */
+    baseUrl?: string;
+    /** Machine scopes to request. Default: none sent, so the OP grants the client's allowed scopes. `[]` throws. */
+    scopes?: readonly string[];
+    /** Token-exchange `audience` for {@link ProfileClient.forUser} (default `hx-profile`). */
+    audience?: string;
+    /**
+     * Timeout in ms for each profile request and each token-endpoint call this
+     * client makes (default 10000, whatever the `HawcxOAuth` client's own
+     * `timeout`).
+     */
+    timeout?: number;
+    /**
+     * Retry budget per call (default 2). GET/PUT/DELETE retry on a network
+     * error, 408, 429, 502, 503, 504. Every method, POST/PATCH included, retries
+     * a token-endpoint network error, 408, 429, 502, 503 or 504 (no profile
+     * request was sent). A DELETE answered 404 counts as success once an earlier
+     * attempt of the call may have run (no response, a 2xx whose body failed
+     * mid-read, or 504).
+     */
+    maxRetries?: number;
+    /**
+     * `fetch` implementation (default: global `fetch`). Errors from an injected
+     * fetch whose shape isn't recognised (no connect-phase `code`/`errno`, with
+     * `syscall` where needed, on the error or its `cause`) are treated as "may
+     * have run" for the DELETE-404 rule.
+     */
+    fetch?: typeof fetch;
+}
+/** Machine client: manage any user's profile, consents and audit trail in the tenant. */
+export declare class ProfileClient {
+    #private;
+    /**
+     * @param oauth - a discovery-mode client with a signer:
+     *   `(await HawcxOAuth.fromIssuer(...)).withClientAssertion(signer)`.
+     */
+    constructor(oauth: HawcxOAuth, options?: ProfileClientOptions);
+    /**
+     * A client acting for the user whose ID token this is (its `aud` must be
+     * this same client). Exchanges lazily on first call and caches the token for
+     * its own lifetime. The OP caps that lifetime at the ID token's `exp` (60 s
+     * by default), so use it with the ID token you just received at sign-in; for
+     * later work on a user's profile use the machine methods with their
+     * `user_id` (the `sub` claim).
+     */
+    forUser(idToken: string): UserProfileClient;
+    /** `GET /v1/users/{userId}` [users:read] */
+    getUser(userId: string): Promise<Profile>;
+    /** `GET /v1/users` [users:read] */
+    listUsers(options?: ListUsersOptions): Promise<Page<Profile>>;
+    /** Every user matching the filters, following `next_cursor`. */
+    iterUsers(options?: Omit<ListUsersOptions, 'cursor'>): AsyncGenerator<Profile>;
+    /**
+     * `POST /v1/users` [users:write]; 404 if the identity doesn't exist, 409 if
+     * the profile does. `user_id` must pass the same path-segment rules as
+     * `userId` elsewhere. Retried only on a transient token-endpoint failure.
+     */
+    createUser(input: CreateUserInput): Promise<Profile>;
+    /** `PATCH /v1/users/{userId}` [users:write]: `null` clears a field, an omitted key is unchanged. Retried only on a transient token-endpoint failure. */
+    updateUser(userId: string, patch: ProfilePatch): Promise<Profile>;
+    /** `PUT /v1/users/{userId}` [users:write] */
+    replaceUser(userId: string, input: ReplaceUserInput): Promise<Profile>;
+    /** `DELETE /v1/users/{userId}` [users:delete] */
+    deleteUser(userId: string): Promise<void>;
+    /** `GET /v1/users/{userId}/consents` [consent:read] */
+    getConsents(userId: string, page?: PageOptions): Promise<ConsentsPage>;
+    /** `PUT /v1/users/{userId}/consents/{purpose}` [consent:write]; 422 for an unknown purpose. */
+    setConsent(userId: string, purpose: string, input: ConsentInput): Promise<Consent>;
+    /** `GET /v1/users/{userId}/audit` [audit:read] */
+    getAudit(userId: string, page?: PageOptions): Promise<Page<AuditEvent>>;
+    /** The user's whole audit trail, following `next_cursor`. */
+    iterAudit(userId: string, options?: {
+        limit?: number;
+    }): AsyncGenerator<AuditEvent>;
+}
+/** Delegated client (`profile:self`): the signed-in user's own profile, consents and audit. */
+export declare class UserProfileClient {
+    #private;
+    /** Not constructible directly: use {@link ProfileClient.forUser}. */
+    private constructor();
+    /** `GET /v1/me` */
+    getMe(): Promise<Profile>;
+    /** `PATCH /v1/me`: `null` clears a field, an omitted key is unchanged. Retried only on a transient token-endpoint failure. */
+    updateMe(patch: MyProfilePatch): Promise<Profile>;
+    /** `GET /v1/me/consents` */
+    getMyConsents(page?: PageOptions): Promise<ConsentsPage>;
+    /** `PUT /v1/me/consents/{purpose}` */
+    setMyConsent(purpose: string, input: ConsentInput): Promise<Consent>;
+    /** `GET /v1/me/audit` */
+    getMyAudit(page?: PageOptions): Promise<Page<AuditEvent>>;
+    /** The user's whole audit trail, following `next_cursor`. */
+    iterMyAudit(options?: {
+        limit?: number;
+    }): AsyncGenerator<AuditEvent>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/profile/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/profile/client.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,KAAK,EACV,UAAU,EACV,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,IAAI,EACJ,WAAW,EACX,OAAO,EACP,YAAY,EACZ,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gHAAgH;IAChH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAKtB;AA+DD,yFAAyF;AACzF,qBAAa,aAAa;;IAIxB;;;OAGG;gBACS,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,oBAAyB;IA+BjE;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB;IAK3C,4CAA4C;IACtC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/C,mCAAmC;IAC7B,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAUvE,gEAAgE;IAChE,SAAS,CAAC,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAM,GAAG,cAAc,CAAC,OAAO,CAAC;IAIlF;;;;OAIG;IACG,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAM1D,wJAAwJ;IAClJ,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvE,6CAA6C;IACvC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5E,iDAAiD;IAC3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,uDAAuD;IACjD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAI5E,+FAA+F;IACzF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxF,kDAAkD;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAI7E,6DAA6D;IAC7D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,cAAc,CAAC,UAAU,CAAC;CAGxF;AAED,+FAA+F;AAC/F,qBAAa,iBAAiB;;IAG5B,qEAAqE;IACrE,OAAO;IAaP,mBAAmB;IACb,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,8HAA8H;IACxH,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvD,4BAA4B;IACtB,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAI9D,sCAAsC;IAChC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAI1E,yBAAyB;IACnB,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAI/D,6DAA6D;IAC7D,WAAW,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,cAAc,CAAC,UAAU,CAAC;CAG1E"}