@honua/react 0.0.20-alpha.0 → 0.1.1-beta.0

package/core/auth/pkce.d.ts

@@ -0,0 +1,25 @@
+/**
+ * PKCE (RFC 7636) primitives built exclusively on WebCrypto.
+ *
+ * `globalThis.crypto` (the WebCrypto API) is available in browsers and in
+ * Node ≥20, so no `node:crypto` import — and therefore no bundler/runtime
+ * branch — is needed. This keeps the auth flow dependency-free and identical
+ * across environments.
+ *
+ * @packageDocumentation
+ */
+/**
+ * A PKCE code verifier + its S256 challenge. The verifier is high-entropy
+ * (32 random bytes → 43-char base64url string, within the RFC's 43–128 range);
+ * the challenge is `BASE64URL(SHA-256(verifier))`.
+ */
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+}
+/** Create a fresh PKCE verifier/challenge pair using SHA-256 (S256). */
+export declare function createPkcePair(): Promise<PkcePair>;
+/** Random, unguessable `state` value for CSRF protection on the redirect. */
+export declare function createStateToken(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/core/auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA6BH;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wEAAwE;AACxE,wBAAsB,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,CAQxD;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/core/auth/pkce.js

@@ -0,0 +1,46 @@
+/**
+ * PKCE (RFC 7636) primitives built exclusively on WebCrypto.
+ *
+ * `globalThis.crypto` (the WebCrypto API) is available in browsers and in
+ * Node ≥20, so no `node:crypto` import — and therefore no bundler/runtime
+ * branch — is needed. This keeps the auth flow dependency-free and identical
+ * across environments.
+ *
+ * @packageDocumentation
+ */
+function requireWebCrypto() {
+    const cryptoRef = globalThis.crypto;
+    if (!cryptoRef?.subtle) {
+        throw new Error("WebCrypto (globalThis.crypto.subtle) is unavailable. OAuth2 PKCE requires a browser or Node.js >= 20.");
+    }
+    return cryptoRef;
+}
+/** Base64url-encode raw bytes (no padding), per RFC 7636 §A. */
+function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    const base64 = typeof btoa === "function" ? btoa(binary) : Buffer.from(bytes).toString("base64");
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** Cryptographically-random base64url string derived from `byteLength` bytes. */
+function randomBase64Url(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    requireWebCrypto().getRandomValues(bytes);
+    return base64UrlEncode(bytes);
+}
+/** Create a fresh PKCE verifier/challenge pair using SHA-256 (S256). */
+export async function createPkcePair() {
+    const codeVerifier = randomBase64Url(32);
+    const digest = await requireWebCrypto().subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+    return {
+        codeVerifier,
+        codeChallenge: base64UrlEncode(new Uint8Array(digest)),
+        codeChallengeMethod: "S256",
+    };
+}
+/** Random, unguessable `state` value for CSRF protection on the redirect. */
+export function createStateToken() {
+    return randomBase64Url(16);
+}

package/core/auth/static-providers.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Static (non-interactive) {@link HonuaAuthProvider} built-ins for callers that
+ * already hold a long-lived credential.
+ *
+ * @packageDocumentation
+ */
+import type { HonuaAuthProvider } from "../types.js";
+/**
+ * Provider that attaches a static API key as `X-API-Key` on every request.
+ * Equivalent to `new HonuaClient({ apiKey })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export declare function apiKeyAuth(apiKey: string): HonuaAuthProvider;
+/**
+ * Provider that attaches a static bearer token as `Authorization: Bearer …`.
+ * Equivalent to `new HonuaClient({ bearerToken })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export declare function bearerTokenAuth(token: string): HonuaAuthProvider;
+//# sourceMappingURL=static-providers.d.ts.map

package/core/auth/static-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-providers.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/static-providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAI5D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAIhE"}

package/core/auth/static-providers.js

@@ -0,0 +1,26 @@
+/**
+ * Static (non-interactive) {@link HonuaAuthProvider} built-ins for callers that
+ * already hold a long-lived credential.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Provider that attaches a static API key as `X-API-Key` on every request.
+ * Equivalent to `new HonuaClient({ apiKey })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export function apiKeyAuth(apiKey) {
+    return {
+        getCredentials: () => ({ apiKey }),
+    };
+}
+/**
+ * Provider that attaches a static bearer token as `Authorization: Bearer …`.
+ * Equivalent to `new HonuaClient({ bearerToken })` but composable as an
+ * {@link HonuaAuthProvider}.
+ */
+export function bearerTokenAuth(token) {
+    return {
+        getCredentials: () => ({ bearerToken: token }),
+    };
+}

package/core/auth/token-endpoint.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Shared helpers for talking to an OAuth2 token endpoint and turning responses
+ * into {@link StoredCredential}s. Used by both the PKCE and client-credentials
+ * providers.
+ *
+ * @packageDocumentation
+ */
+import type { HonuaAuthCredentials } from "../types.js";
+import type { OAuth2TokenResponse, StoredCredential } from "./types.js";
+/**
+ * Project a {@link StoredCredential} into the {@link HonuaAuthCredentials} shape
+ * the client attaches to requests. Non-`Bearer` token types are emitted as a
+ * full `Authorization` value; the expiry drives the client's own refresh skew.
+ */
+export declare function toHonuaCredentials(credential: StoredCredential): HonuaAuthCredentials;
+/** Resolve `serviceKey`, defaulting to `${clientId}@${endpoint origin}`. */
+export declare function resolveServiceKey(serviceKey: string | undefined, clientId: string, endpoint: string): string;
+/** Default clock-skew tolerance (ms) applied to credential expiry checks. */
+export declare const DEFAULT_CLOCK_SKEW_MS = 60000;
+/** True when a credential is missing or within `skewMs` of (or past) expiry. */
+export declare function isCredentialExpiring(credential: StoredCredential | undefined, skewMs: number): boolean;
+/** Map a token response into a {@link StoredCredential} (clock-skew tolerant). */
+export declare function credentialFromTokenResponse(response: OAuth2TokenResponse, previous?: StoredCredential): StoredCredential;
+/**
+ * POST an `application/x-www-form-urlencoded` grant to the token endpoint and
+ * return the parsed {@link StoredCredential}.
+ *
+ * Errors are normalized to {@link HonuaAuthError}: an `invalid_grant` OAuth
+ * error (expired/revoked/invalid grant → re-auth needed) maps to code
+ * `invalid_grant`; every other transport/HTTP/parse failure maps to
+ * `refresh_failed` (transient, retry may succeed).
+ */
+export declare function requestToken(options: {
+    fetchFn: typeof fetch;
+    tokenEndpoint: string;
+    params: Record<string, string>;
+    previous?: StoredCredential;
+    signal?: AbortSignal;
+}): Promise<StoredCredential>;
+//# sourceMappingURL=token-endpoint.d.ts.map

package/core/auth/token-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-endpoint.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/token-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,GAAG,oBAAoB,CAWrF;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5G;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQtG;AAED,kFAAkF;AAClF,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,gBAAgB,CAwBlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,OAAO,KAAK,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmD5B"}

package/core/auth/token-endpoint.js

@@ -0,0 +1,133 @@
+/**
+ * Shared helpers for talking to an OAuth2 token endpoint and turning responses
+ * into {@link StoredCredential}s. Used by both the PKCE and client-credentials
+ * providers.
+ *
+ * @packageDocumentation
+ */
+import { HonuaAuthError } from "../errors.js";
+/**
+ * Project a {@link StoredCredential} into the {@link HonuaAuthCredentials} shape
+ * the client attaches to requests. Non-`Bearer` token types are emitted as a
+ * full `Authorization` value; the expiry drives the client's own refresh skew.
+ */
+export function toHonuaCredentials(credential) {
+    const result = {};
+    if (credential.tokenType && credential.tokenType.toLowerCase() !== "bearer") {
+        result.authorization = `${credential.tokenType} ${credential.accessToken}`;
+    }
+    else {
+        result.bearerToken = credential.accessToken;
+    }
+    if (credential.expiresAt !== undefined) {
+        result.expiresAt = credential.expiresAt;
+    }
+    return result;
+}
+/** Resolve `serviceKey`, defaulting to `${clientId}@${endpoint origin}`. */
+export function resolveServiceKey(serviceKey, clientId, endpoint) {
+    if (serviceKey) {
+        return serviceKey;
+    }
+    let origin = endpoint;
+    try {
+        origin = new URL(endpoint).origin;
+    }
+    catch {
+        // Non-absolute endpoint (tests) — fall back to the raw string.
+    }
+    return `${clientId}@${origin}`;
+}
+/** Default clock-skew tolerance (ms) applied to credential expiry checks. */
+export const DEFAULT_CLOCK_SKEW_MS = 60_000;
+/** True when a credential is missing or within `skewMs` of (or past) expiry. */
+export function isCredentialExpiring(credential, skewMs) {
+    if (!credential) {
+        return true;
+    }
+    if (credential.expiresAt === undefined) {
+        return false;
+    }
+    return credential.expiresAt - Date.now() <= skewMs;
+}
+/** Map a token response into a {@link StoredCredential} (clock-skew tolerant). */
+export function credentialFromTokenResponse(response, previous) {
+    const credential = {
+        accessToken: response.access_token,
+    };
+    if (response.token_type) {
+        credential.tokenType = response.token_type;
+    }
+    // Some authorization servers omit a rotated refresh token on refresh; keep
+    // the previous one so silent refresh keeps working (RFC 6749 §6).
+    const refreshToken = response.refresh_token ?? previous?.refreshToken;
+    if (refreshToken) {
+        credential.refreshToken = refreshToken;
+    }
+    if (typeof response.expires_in === "number" && Number.isFinite(response.expires_in)) {
+        credential.expiresAt = Date.now() + response.expires_in * 1000;
+    }
+    const scope = response.scope ?? previous?.scope;
+    if (scope) {
+        credential.scope = scope;
+    }
+    if (response.id_token) {
+        credential.idToken = response.id_token;
+    }
+    return credential;
+}
+/**
+ * POST an `application/x-www-form-urlencoded` grant to the token endpoint and
+ * return the parsed {@link StoredCredential}.
+ *
+ * Errors are normalized to {@link HonuaAuthError}: an `invalid_grant` OAuth
+ * error (expired/revoked/invalid grant → re-auth needed) maps to code
+ * `invalid_grant`; every other transport/HTTP/parse failure maps to
+ * `refresh_failed` (transient, retry may succeed).
+ */
+export async function requestToken(options) {
+    const body = new URLSearchParams(options.params);
+    let response;
+    try {
+        response = await options.fetchFn(options.tokenEndpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body: body.toString(),
+            ...(options.signal ? { signal: options.signal } : {}),
+        });
+    }
+    catch (cause) {
+        throw new HonuaAuthError("refresh_failed", "Token request failed at the transport layer.", { cause });
+    }
+    const text = await response.text();
+    let payload;
+    try {
+        payload = text ? JSON.parse(text) : {};
+    }
+    catch (cause) {
+        throw new HonuaAuthError("refresh_failed", `Token endpoint returned a non-JSON response (HTTP ${response.status}).`, {
+            cause,
+        });
+    }
+    if (!response.ok) {
+        const oauthError = isObject(payload) && typeof payload.error === "string" ? payload.error : undefined;
+        const description = isObject(payload) && typeof payload.error_description === "string" ? payload.error_description : undefined;
+        const message = `Token endpoint rejected the grant (HTTP ${response.status}${oauthError ? `, ${oauthError}` : ""})${description ? `: ${description}` : ""}`;
+        if (oauthError === "invalid_grant") {
+            throw new HonuaAuthError("invalid_grant", message, { cause: payload });
+        }
+        throw new HonuaAuthError("refresh_failed", message, { cause: payload });
+    }
+    if (!isObject(payload) || typeof payload.access_token !== "string") {
+        throw new HonuaAuthError("refresh_failed", "Token endpoint response is missing an access_token.", {
+            cause: payload,
+        });
+    }
+    return credentialFromTokenResponse(payload, options.previous);
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null;
+}

package/core/auth/types.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Shared types for the built-in {@link HonuaAuthProvider} implementations
+ * (`oauth2`, `clientCredentials`, `apiKeyAuth`, `bearerTokenAuth`) and the
+ * pluggable {@link CredentialStore}.
+ *
+ * @packageDocumentation
+ */
+import type { HonuaAuthError } from "../errors.js";
+/**
+ * A persisted OAuth2 credential. Access/refresh tokens plus expiry are stored
+ * in a {@link CredentialStore}; the SDK only ever attaches `accessToken` as a
+ * bearer credential and uses `refreshToken`/`expiresAt` to drive silent
+ * refresh.
+ */
+export interface StoredCredential {
+    /** The bearer access token attached to outgoing requests. */
+    accessToken: string;
+    /** Token type from the token response; defaults to `Bearer`. */
+    tokenType?: string;
+    /** Refresh token, when the authorization server issued one. */
+    refreshToken?: string;
+    /** Absolute expiry as epoch milliseconds (from `expires_in`). */
+    expiresAt?: number;
+    /** Granted scope string, if the token response narrowed it. */
+    scope?: string;
+    /** OpenID Connect ID token, when present (never sent to resource servers). */
+    idToken?: string;
+}
+/**
+ * Pluggable credential persistence. The default is an in-memory store scoped to
+ * the provider instance. Browser adapters (`sessionStorageCredentialStore`,
+ * `localStorageCredentialStore`) are explicit opt-in because Web Storage is
+ * readable by any script on the origin (XSS exfiltration risk) — see
+ * `docs/auth.md`.
+ *
+ * Keys are namespaced per origin/service by the provider so tokens for one
+ * service are never returned for another.
+ */
+export interface CredentialStore {
+    get(key: string): StoredCredential | undefined | Promise<StoredCredential | undefined>;
+    set(key: string, value: StoredCredential): void | Promise<void>;
+    delete(key: string): void | Promise<void>;
+}
+/** Lifecycle events emitted by the OAuth2 / client-credentials providers. */
+export type HonuaAuthEvent = {
+    type: "signed-in";
+    credential: StoredCredential;
+} | {
+    type: "token-refreshed";
+    credential: StoredCredential;
+} | {
+    type: "refresh-failed";
+    error: HonuaAuthError;
+} | {
+    type: "signed-out";
+};
+/** Listener registered with `provider.on(...)`. */
+export type HonuaAuthEventListener = (event: HonuaAuthEvent) => void;
+/** Handle returned by `provider.on(...)`; call `remove()` to unsubscribe. */
+export interface HonuaAuthEventHandle {
+    remove(): void;
+}
+/** Interactive sign-in mode for the OAuth2 authorization-code + PKCE flow. */
+export type OAuth2SignInMode = "redirect" | "popup";
+/**
+ * Configuration for the OAuth2 authorization-code + PKCE provider produced by
+ * {@link oauth2}. Only WebCrypto is used for PKCE (Node ≥20 exposes
+ * `globalThis.crypto`); no new hard dependencies are introduced.
+ */
+export interface OAuth2Config {
+    /** Authorization endpoint (where the browser is redirected to sign in). */
+    authorizationEndpoint: string;
+    /** Token endpoint (code exchange + refresh). */
+    tokenEndpoint: string;
+    /** Public client identifier. */
+    clientId: string;
+    /** Registered redirect URI that receives the authorization `code`+`state`. */
+    redirectUri: string;
+    /** Requested scopes. */
+    scopes?: readonly string[];
+    /** Interactive mode. Defaults to `redirect`. */
+    mode?: OAuth2SignInMode;
+    /**
+     * Credential store. Defaults to an in-memory store. Scoped per
+     * origin/service via {@link OAuth2Config.serviceKey}.
+     */
+    store?: CredentialStore;
+    /**
+     * Stable key that scopes stored credentials to this service. Defaults to
+     * `${clientId}@${origin of tokenEndpoint}` so tokens are never shared across
+     * services or origins.
+     */
+    serviceKey?: string;
+    /**
+     * Clock-skew tolerance in milliseconds. A credential is treated as expiring
+     * this long before its real expiry so a refresh happens before requests fail.
+     * Defaults to 60_000.
+     */
+    clockSkewMs?: number;
+    /** Optional revocation endpoint (RFC 7009) called on `signOut()`. */
+    revocationEndpoint?: string;
+    /** Extra query params appended to the authorization request. */
+    extraAuthorizationParams?: Record<string, string>;
+    /** Extra body params appended to token/refresh requests. */
+    extraTokenParams?: Record<string, string>;
+    /** Popup window features string (popup mode). */
+    popupFeatures?: string;
+    /** Override `fetch` (Node/tests). Defaults to `globalThis.fetch`. */
+    fetchFn?: typeof fetch;
+    /**
+     * Window used for redirect/popup + transaction persistence. Defaults to
+     * `globalThis.window`. Injectable for tests / non-DOM hosts.
+     */
+    windowRef?: Window;
+    /** Auth lifecycle listener. */
+    onEvent?: HonuaAuthEventListener;
+}
+/**
+ * Configuration for the OAuth2 client-credentials provider produced by
+ * {@link clientCredentials}. Intended for confidential Node clients — the
+ * client secret must never ship to a browser.
+ */
+export interface ClientCredentialsConfig {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: readonly string[];
+    store?: CredentialStore;
+    serviceKey?: string;
+    clockSkewMs?: number;
+    extraTokenParams?: Record<string, string>;
+    fetchFn?: typeof fetch;
+    onEvent?: HonuaAuthEventListener;
+}
+/** Raw OAuth2 token endpoint response shape (RFC 6749 §5.1). */
+export interface OAuth2TokenResponse {
+    access_token: string;
+    token_type?: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+    id_token?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/core/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACvF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,6EAA6E;AAC7E,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAE3B,mDAAmD;AACnD,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;AAErE,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gDAAgD;IAChD,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/core/auth/types.js

@@ -0,0 +1,8 @@
+/**
+ * Shared types for the built-in {@link HonuaAuthProvider} implementations
+ * (`oauth2`, `clientCredentials`, `apiKeyAuth`, `bearerTokenAuth`) and the
+ * pluggable {@link CredentialStore}.
+ *
+ * @packageDocumentation
+ */
+export {};

package/core/bounded-json.d.ts

@@ -0,0 +1,4 @@
+/** Internal structural guard for byte-bounded JSON received across trust boundaries. */
+export type BoundedJsonStructureViolation = "max-depth" | "max-nodes" | "non-json";
+export declare function boundedJsonStructureViolation(value: unknown, maxDepth: number, maxNodes: number): BoundedJsonStructureViolation | undefined;
+//# sourceMappingURL=bounded-json.d.ts.map

package/core/bounded-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-json.d.ts","sourceRoot":"","sources":["../../../src/core/bounded-json.ts"],"names":[],"mappings":"AAAA,wFAAwF;AAExF,MAAM,MAAM,6BAA6B,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,CAAC;AAEnF,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,6BAA6B,GAAG,SAAS,CAwB3C"}

package/core/bounded-json.js

@@ -0,0 +1,38 @@
+/** Internal structural guard for byte-bounded JSON received across trust boundaries. */
+export function boundedJsonStructureViolation(value, maxDepth, maxNodes) {
+    const pending = [{ value, depth: 0 }];
+    let nodes = 0;
+    while (pending.length > 0) {
+        const current = pending.pop();
+        nodes += 1;
+        if (nodes > maxNodes)
+            return "max-nodes";
+        if (current.depth > maxDepth)
+            return "max-depth";
+        if (current.value === null || typeof current.value === "string" || typeof current.value === "boolean")
+            continue;
+        if (typeof current.value === "number") {
+            if (!Number.isFinite(current.value))
+                return "non-json";
+            continue;
+        }
+        if (Array.isArray(current.value)) {
+            for (const entry of current.value)
+                pending.push({ value: entry, depth: current.depth + 1 });
+            continue;
+        }
+        if (isPlainObject(current.value)) {
+            for (const entry of Object.values(current.value))
+                pending.push({ value: entry, depth: current.depth + 1 });
+            continue;
+        }
+        return "non-json";
+    }
+    return undefined;
+}
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}

package/core/cache-state.d.ts

@@ -39,6 +39,14 @@ export interface HonuaMetadataRequestOptions {
     readonly ttlMs?: number;
     /** Optional stale fallback window surfaced to callers in `HonuaCacheState`. */
     readonly staleIfErrorMs?: number;
+    /**
+     * Maximum decoded response-body bytes accepted before metadata parsing.
+     * Adapters that consume bounded discovery documents set this explicitly so
+     * a missing or dishonest `Content-Length` cannot turn metadata discovery
+     * into an unbounded allocation. The limit is enforced while streaming the
+     * body, not only from response headers.
+     */
+    readonly maxResponseBytes?: number;
 }
 export interface NormalizedHonuaMetadataRequestOptions {
     readonly signal?: AbortSignal;
@@ -47,6 +55,7 @@ export interface NormalizedHonuaMetadataRequestOptions {
     readonly staleIfError: boolean;
     readonly ttlMs?: number;
     readonly staleIfErrorMs?: number;
+    readonly maxResponseBytes?: number;
 }
 export declare const HONUA_DEFAULT_METADATA_CACHE_TTL_MS: number;
 export declare const HONUA_DEFAULT_METADATA_STALE_IF_ERROR_MS: number;

package/core/cache-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-state.d.ts","sourceRoot":"","sources":["../../../src/core/cache-state.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,qBAAqB,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjF,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,mCAAmC,QAAgB,CAAC;AACjE,eAAO,MAAM,wCAAwC,QAAiB,CAAC;AAEvE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAchF;AAED,wBAAgB,oCAAoC,CAClD,OAAO,GAAE,2BAAgC,GACxC,qCAAqC,CAYvC;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAMhG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;CAC1C,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBzB;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,GAAG,CAAC,CAQ1E;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAMrD"}
+{"version":3,"file":"cache-state.d.ts","sourceRoot":"","sources":["../../../src/core/cache-state.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,qBAAqB,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjF,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,mCAAmC,QAAgB,CAAC;AACjE,eAAO,MAAM,wCAAwC,QAAiB,CAAC;AAEvE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAchF;AAED,wBAAgB,oCAAoC,CAClD,OAAO,GAAE,2BAAgC,GACxC,qCAAqC,CAcvC;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAMhG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;CAC1C,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBzB;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,GAAG,CAAC,CAQ1E;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAMrD"}

package/core/cache-state.js

@@ -18,6 +18,7 @@ export function createHonuaCacheState(init) {
 export function normalizeHonuaMetadataRequestOptions(options = {}) {
     const ttlMs = normalizeNonNegativeInteger(options.ttlMs) ?? HONUA_DEFAULT_METADATA_CACHE_TTL_MS;
     const staleIfErrorMs = normalizeNonNegativeInteger(options.staleIfErrorMs) ?? HONUA_DEFAULT_METADATA_STALE_IF_ERROR_MS;
+    const maxResponseBytes = normalizeMaximumResponseBytes(options.maxResponseBytes);
     return {
         ...(options.signal ? { signal: options.signal } : {}),
         refresh: options.refresh === true,
@@ -25,6 +26,7 @@ export function normalizeHonuaMetadataRequestOptions(options = {}) {
         staleIfError: options.staleIfError !== false,
         ttlMs,
         staleIfErrorMs,
+        ...(maxResponseBytes !== undefined ? { maxResponseBytes } : {}),
     };
 }
 export function isHonuaCacheEntryFresh(cachedAtMs, now, ttlMs) {
@@ -85,3 +87,11 @@ function normalizeNonNegativeInteger(value) {
     }
     return Math.max(0, Math.trunc(value));
 }
+function normalizeMaximumResponseBytes(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new TypeError("maxResponseBytes must be a positive safe integer.");
+    }
+    return value;
+}

package/core/capabilities-xml.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Bounded XML tree used by the WMS/WMTS capabilities readers.
+ *
+ * This is deliberately not a general XML implementation. It accepts the XML
+ * 1.0 subset used by OGC service metadata, matches namespace-qualified names
+ * by their local suffix, and rejects declarations that could introduce
+ * external entities. Every allocation is covered by a small fixed budget so a
+ * capabilities response cannot turn metadata discovery into an unbounded
+ * parser workload.
+ *
+ * @internal
+ */
+export declare const OGC_CAPABILITIES_XML_LIMITS: Readonly<{
+    maxBytes: number;
+    maxElements: 12000;
+    maxDepth: 32;
+    maxAttributesPerElement: 64;
+    maxAttributeBytes: number;
+    maxTextBytes: number;
+}>;
+export interface CapabilitiesXmlElement {
+    readonly name: string;
+    readonly localName: string;
+    readonly attributes: Readonly<Record<string, string>>;
+    readonly children: readonly CapabilitiesXmlElement[];
+    readonly text: string;
+}
+export declare function parseCapabilitiesXml(xml: string, family: "WMS" | "WMTS"): CapabilitiesXmlElement;
+export declare function xmlChild(node: CapabilitiesXmlElement | undefined, localName: string): CapabilitiesXmlElement | undefined;
+export declare function xmlChildren(node: CapabilitiesXmlElement | undefined, localName: string): readonly CapabilitiesXmlElement[];
+export declare function xmlAttribute(node: CapabilitiesXmlElement, name: string): string | undefined;
+export declare function xmlText(node: CapabilitiesXmlElement | undefined): string | undefined;
+//# sourceMappingURL=capabilities-xml.d.ts.map

package/core/capabilities-xml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities-xml.d.ts","sourceRoot":"","sources":["../../../src/core/capabilities-xml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,2BAA2B;;;;;;;EAOtC,CAAC;AAEH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAWD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,sBAAsB,CAmGhG;AAED,wBAAgB,QAAQ,CACtB,IAAI,EAAE,sBAAsB,GAAG,SAAS,EACxC,SAAS,EAAE,MAAM,GAChB,sBAAsB,GAAG,SAAS,CAEpC;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,sBAAsB,GAAG,SAAS,EACxC,SAAS,EAAE,MAAM,GAChB,SAAS,sBAAsB,EAAE,CAEnC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3F;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIpF"}