@hyper.authio/testing 0.1.1 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -4
- package/dist/index.cjs +306 -19
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +134 -7
- package/dist/index.d.ts +134 -7
- package/dist/index.js +308 -21
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
package/dist/index.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/fake-authio.ts","../src/manual-clock.ts","../src/webhook-delivery.ts"],"names":["randomUUID","SignJWT","decodeJwt","generateKeyPair","exportJWK","createServer","importJWK","jwtVerify","AuthioWebhookHeaders","computeWebhookSignatureHeader"],"mappings":";;;;;;;;AAyGO,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA;AAAA,EAEb,WAAwC,EAAC;AAAA;AAAA,EAEzC,QAAA,uBAAe,GAAA,EAAgG;AAAA;AAAA,EAExH,cAAA,GAA4C,CAAC,UAAU,CAAA;AAAA;AAAA,EAEvD,eAAA;AAAA;AAAA,EAEA,aAAA,GAAgB,KAAA;AAAA;AAAA,EAEhB,mBAAA;AAAA,EAEiB,OAAA,uBAAc,GAAA,EAA8B;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAA4B;AAAA,EACxC,KAAA,uBAAY,GAAA,EAA8H;AAAA,EAC1I,aAAA,uBAAoB,GAAA,EAA+D;AAAA,EACnF,MAAA,uBAAa,GAAA,EAAyB;AAAA,EACtC,WAAA,uBAAkB,GAAA,EAAoB;AAAA,EACtC,QAAA;AAAA,EACT,MAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACC,KAAA;AAAA,EACA,KAAA,GAAQ,YAAA;AAAA,EAET,YAAY,OAAA,EAA4B;AAC9C,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAQ,KAAA,IAAS,MAAA;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,mBAAA,IAAuB,GAAA;AAE/C,IAAA,KAAA,MAAW,MAAA,IAAU,OAAA,CAAQ,OAAA,IAAW,EAAC,OAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,MAAM,CAAA;AACpF,IAAA,KAAA,MAAW,IAAA,IAAQ,OAAA,CAAQ,KAAA,IAAS,EAAC,OAAQ,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,KAAA,CAAM,OAAA,GAA6B,EAAC,EAAwB;AACvE,IAAA,MAAM,IAAA,GAAO,IAAI,WAAA,CAAW,OAAO,CAAA;AAEnC,IAAA,MAAM,KAAK,MAAA,EAAO;AAElB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,SAAA,GAAoB;AACtB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA,EAGA,IAAI,MAAA,GAAiB;AACnB,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,QAAA,EAAW,KAAK,KAAK,CAAA,CAAA;AAAA,EAC7C;AAAA;AAAA,EAGA,IAAI,IAAA,GAAwB;AAC1B,IAAA,OAAO,EAAE,IAAA,EAAM,CAAC,IAAA,CAAK,SAAS,CAAA,EAAE;AAAA,EAClC;AAAA;AAAA,EAGA,UAAU,MAAA,EAAgC;AACxC,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,MAAM,CAAA;AAAA,EAC1C;AAAA;AAAA,EAGA,QAAQ,IAAA,EAA4B;AAClC,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,wBAAwB,OAAA,EAAiJ;AACvK,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,OAAA,CAAQ,QAAQ,CAAA;AAC9C,IAAA,MAAM,OAAOA,iBAAA,EAAW;AAExB,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,IAAA,EAAM;AAAA,MACnB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,KAAK,IAAA,CAAK,GAAA;AAAA,MACV,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,qBAAA;AAAA,MACtB,UAAU,OAAA,CAAQ;AAAA,KACnB,CAAA;AAED,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAA,CAAiB,OAAA,GAAkC,EAAC,EAAoB;AAC5E,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,aAAA;AACrC,IAAA,MAAM,MAAMA,iBAAA,EAAW;AACvB,IAAA,MAAM,OAAA,GAAsB;AAAA,MAC1B,GAAA,EAAK,QAAQ,IAAA,IAAQ,QAAA;AAAA,MACrB,GAAA,EAAK,QAAA;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,MAChD,GAAI,QAAQ,GAAA,GAAM,EAAE,KAAK,OAAA,CAAQ,GAAA,KAAQ,EAAC;AAAA,MAC1C,GAAG,OAAA,CAAQ;AAAA,KACb;AACA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAIC,YAAA,CAAQ,OAAO,CAAA,CACpC,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,KAAK,KAAA,EAAO,GAAA,EAAK,KAAA,EAAO,CAAA,CAChE,SAAA,CAAU,QAAQ,MAAA,IAAU,IAAA,CAAK,MAAM,CAAA,CACvC,WAAA,CAAY,OAAA,CAAQ,YAAY,QAAQ,CAAA,CACxC,YAAY,GAAG,CAAA,CACf,aAAa,GAAG,CAAA,CAChB,iBAAA,CAAkB,GAAA,IAAO,OAAA,CAAQ,SAAA,IAAa,KAAK,QAAA,CAAS,CAAA,CAC5D,MAAA,CAAO,GAAG,CAAA,CACV,IAAA,CAAK,QAAQ,SAAA,GAAY,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,UAAU,CAAA;AAE/D,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,MAAA,EAAQC,cAAA,CAAU,KAAK,CAAA,EAAG,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,CAAA;AAE7E,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,YAAY,KAAA,EAAqB;AAC/B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAEpC,IAAA,IAAI,MAAA,SAAe,OAAA,GAAU,IAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,aAAA,GAAsB;AACpB,IAAA,IAAA,CAAK,SAAS,MAAA,GAAS,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,WAAW,MAAA,EAA6C;AACtD,IAAA,OAAO,IAAA,CAAK,SAAS,MAAA,CAAO,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACxE;AAAA;AAAA,EAGA,KAAA,GAAuB;AACrB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAA,CAAK,OAAO,mBAAA,IAAsB;AAClC,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,KAAA,KAAW,QAAQ,MAAA,CAAO,KAAK,CAAA,GAAI,OAAA,EAAU,CAAA;AAAA,IAClE,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,MAAA,GAAwB;AACpC,IAAA,MAAM,OAAO,MAAMC,oBAAA,CAAgB,SAAS,EAAE,WAAA,EAAa,MAAM,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,MAAMA,oBAAA,CAAgB,OAAO,CAAA;AAE/C,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,eAAe,SAAA,CAAU,UAAA;AAC9B,IAAA,IAAA,CAAK,SAAA,GAAY,EAAE,GAAI,MAAMC,eAAU,IAAA,CAAK,SAAS,CAAA,EAAI,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,OAAA,EAAS,KAAK,KAAA,EAAM;AACnG,IAAA,IAAA,CAAK,MAAA,GAASC,iBAAA,CAAa,CAAC,OAAA,EAAS,QAAA,KAAa;AAChD,MAAA,IAAA,CAAK,OAAO,OAAA,EAAS,QAAQ,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACvD,QAAA,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,cAAA,EAAgB,iBAAA,EAAmB,MAAA,CAAO,KAAK,CAAA,IAAK,CAAA;AAAA,MACnG,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY,IAAA,CAAK,OAAO,MAAA,CAAO,CAAA,EAAG,WAAA,EAAa,OAAO,CAAC,CAAA;AAEhF,IAAA,IAAA,CAAK,UAAU,CAAA,iBAAA,EAAqB,IAAA,CAAK,MAAA,CAAO,OAAA,GAA0B,IAAI,CAAA,CAAA;AAAA,EAChF;AAAA,EAEA,MAAc,MAAA,CAAO,OAAA,EAA0B,QAAA,EAAyC;AACtF,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,QAAQ,GAAA,IAAO,GAAA,EAAK,KAAK,OAAO,CAAA;AACpD,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,WAAA,CAAY,IAAI,gBAAgB,OAAA,CAAQ,OAAA,CAAQ,cAAc,CAAA,EAAG,QAAA,CAAS,MAAM,CAAA,GAAI,IAAA,GAAO,EAAE,CAAC,CAAA;AAClH,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,CAAC,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAK,KAAA,IAAS,EAAG,CAAC,CAAC,CAAA;AAC1J,IAAA,MAAM,QAAA,GAAsC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,IAAU,OAAO,IAAA,EAAM,GAAA,CAAI,QAAA,EAAU,OAAA,EAAS,IAAA,EAAK;AAEjH,IAAA,IAAA,CAAK,QAAA,CAAS,KAAK,QAAQ,CAAA;AAE3B,IAAA,MAAM,MAAA,GAAS,CAAA,QAAA,EAAW,IAAA,CAAK,KAAK,CAAA,CAAA;AACpC,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,GAAI,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA,GAAI,GAAA,CAAI,QAAA;AACvF,IAAA,MAAM,QAAA,GAAW,WAAW,IAAI,CAAA;AAChC,IAAA,MAAM,OAAA,GAAU,WAAW,IAAA,CAAK,QAAA,CAAS,IAAI,QAAQ,CAAA,EAAG,OAAM,GAAI,MAAA;AAElE,IAAA,IAAI,OAAA,EAAS,OAAO,IAAA,CAAK,QAAA,EAAU,OAAO,CAAA;AAE1C,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,mCAAA;AACH,QAAA,OAAO,IAAA,CAAK,UAAU,EAAE,MAAA,EAAQ,KAAK,IAAA,EAAM,IAAA,CAAK,SAAA,EAAU,EAAG,CAAA;AAAA,MAC/D,KAAK,gCAAA;AACH,QAAA,OAAO,IAAA,CAAK,UAAU,EAAE,MAAA,EAAQ,KAAK,IAAA,EAAM,IAAA,CAAK,MAAM,CAAA;AAAA,MACxD,KAAK,gCAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,KAAA,CAAM,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MACxD,KAAK,2CAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,UAAA,CAAW,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MAC7D,KAAK,iCAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,MAAA,CAAO,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MACzD,KAAK,mCAAA;AACH,QAAA,OAAO,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,QAAQ,CAAA;AAAA,MACxC,KAAK,sCAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,MAAA,CAAO,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MACzD;AACE,QAAA,OAAO,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAM,EAAE,KAAA,EAAO,WAAA,EAAY,EAAG,CAAA;AAAA;AACvE,EACF;AAAA,EAEQ,SAAA,GAAqC;AAC3C,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,wBAAA,CAAA;AAE3B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,MAAA;AAAA,MACrC,sBAAA,EAAwB,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,MAC/B,cAAA,EAAgB,GAAG,IAAI,CAAA,MAAA,CAAA;AAAA,MACvB,sBAAA,EAAwB,GAAG,IAAI,CAAA,iBAAA,CAAA;AAAA,MAC/B,mBAAA,EAAqB,GAAG,IAAI,CAAA,OAAA,CAAA;AAAA,MAC5B,iBAAA,EAAmB,GAAG,IAAI,CAAA,SAAA,CAAA;AAAA,MAC1B,oBAAA,EAAsB,GAAG,IAAI,CAAA,OAAA,CAAA;AAAA,MAC7B,6BAAA,EAA+B,GAAG,IAAI,CAAA,YAAA,CAAA;AAAA,MACtC,QAAA,EAAU,GAAG,IAAI,CAAA,MAAA,CAAA;AAAA,MACjB,uBAAuB,CAAC,oBAAA,EAAsB,iBAAiB,oBAAA,EAAsB,UAAA,EAAY,gDAAgD,iDAAiD,CAAA;AAAA,MAClM,qCAAA,EAAuC,CAAC,qBAAA,EAAuB,oBAAA,EAAsB,mBAAmB,MAAM,CAAA;AAAA,MAC9G,gCAAA,EAAkC,CAAC,MAAM,CAAA;AAAA,MACzC,8CAAA,EAAgD;AAAA,KAClD;AAAA,EACF;AAAA,EAEA,MAAc,YAAA,CAAa,QAAA,EAAqC,IAAA,EAA2E;AACzI,IAAA,MAAM,OAAA,GAAU,CAAC,WAAA,MAA0C,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,gBAAA,EAAkB,iBAAA,EAAmB,WAAA,EAAY,EAAE,CAAA;AAC5I,IAAA,MAAM,aAAA,GAAgB,SAAS,OAAA,CAAQ,aAAA;AACvC,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI,aAAA,EAAe,UAAA,CAAW,QAAQ,CAAA,EAAG;AACvC,MAAA,MAAM,CAAC,EAAA,EAAI,MAAM,IAAI,MAAA,CAAO,IAAA,CAAK,cAAc,KAAA,CAAM,CAAC,GAAG,QAAQ,CAAA,CAAE,SAAS,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,kBAAkB,CAAA;AAErH,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,EAAA,IAAM,EAAE,CAAA;AAElC,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,CAAO,YAAA,IAAgB,OAAO,YAAA,KAAiB,MAAA,EAAQ,OAAO,OAAA,CAAQ,mCAAmC,CAAA;AAAA,IAC3H,CAAA,MAAA,IAAW,KAAK,gBAAA,EAAkB;AAChC,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,aAAa,EAAE,CAAA;AAE9C,MAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,EAAW,OAAO,QAAQ,mCAAmC,CAAA;AAC1E,MAAA,IAAI,IAAA,CAAK,qBAAA,KAA0B,wDAAA,EAA0D,OAAO,QAAQ,uBAAuB,CAAA;AAEnI,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,MAAMC,cAAA,CAAU,OAAO,SAAA,EAAW,MAAA,CAAO,UAAU,GAAG,CAAA;AAClE,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,IAAA,CAAK,kBAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,CAAO,UAAU,OAAA,EAAS,MAAA,CAAO,UAAU,QAAA,EAAU,IAAA,CAAK,QAAQ,CAAA;AAE5I,QAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,OAAO,QAAQ,2BAA2B,CAAA;AAAA,MAC9D,SAAS,KAAA,EAAO;AACd,QAAA,OAAO,OAAA,CAAQ,CAAA,+BAAA,EAAmC,KAAA,CAAgB,OAAO,CAAA,CAAE,CAAA;AAAA,MAC7E;AAAA,IACF,CAAA,MAAA,IAAW,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW;AAC3C,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,aAAa,EAAE,CAAA;AAE9C,MAAA,IAAI,CAAC,UAAU,MAAA,CAAO,YAAA,KAAiB,KAAK,aAAA,EAAe,OAAO,QAAQ,mCAAmC,CAAA;AAAA,IAC/G,CAAA,MAAO;AACL,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,aAAa,EAAE,CAAA;AAE9C,MAAA,IAAI,CAAC,UAAU,MAAA,CAAO,YAAA,IAAgB,OAAO,SAAA,EAAW,OAAO,QAAQ,+BAA+B,CAAA;AAAA,IACxG;AAEA,IAAA,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA;AAE3B,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,KAAA,CAAM,QAAA,EAAqC,IAAA,EAAwD;AAC/G,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,IAAS,MAAA,CAAO,aAAA,EAAe,KAAK,GAAG,CAAA;AAC1D,IAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,EAAe,WAAA,MAA0C,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,WAAA,EAAY,EAAE,CAAA;AAEvI,IAAA,QAAQ,KAAK,UAAA;AAAY,MACvB,KAAK,oBAAA;AACH,QAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,EAAQ,EAAE,KAAK,MAAA,CAAO,QAAA,EAAU,KAAA,EAAO,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA;AAAA,MACjH,KAAK,UAAA,EAAY;AACf,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,YAAY,EAAE,CAAA;AAE/C,QAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,QAAA,KAAa,KAAK,QAAA,EAAU,OAAO,KAAA,CAAM,eAAA,EAAiB,6BAA6B,CAAA;AAEzG,QAAA,OAAO,IAAA,CAAK,YAAY,MAAA,EAAQ,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,OAAO,MAAA,EAAQ,EAAE,GAAG,MAAA,CAAO,MAAA,EAAQ,GAAG,IAAA,CAAK,MAAA,EAAQ,oBAAoB,IAAA,CAAK,QAAA,EAAS,EAAE,EAAG,IAAI,CAAA;AAAA,MACjJ;AAAA,MACA,KAAK,oBAAA,EAAsB;AACzB,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,QAAQ,EAAE,CAAA;AAE3C,QAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAAY,IAAA,CAAK,WAAA,KAAgB,IAAA,CAAK,YAAA,EAAc,OAAO,KAAA,CAAM,iBAAiB,wBAAwB,CAAA;AAChJ,QAAA,IAAI,IAAA,CAAK,gBAAgB,IAAA,CAAK,YAAA,KAAiB,KAAK,aAAA,EAAe,OAAO,KAAA,CAAM,eAAA,EAAiB,2BAA2B,CAAA;AAE5H,QAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,IAAK,CAAA;AAE5B,QAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAA,CAAK,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,GAAA,KAAQ,KAAK,GAAG,CAAA;AAEpF,QAAA,OAAO,IAAA,CAAK,WAAA;AAAA,UACV,MAAA;AAAA,UACA,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,OAAO,IAAA,CAAK,KAAA,EAAO,QAAA,EAAU,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,UAAU,MAAA,EAAQ,EAAE,GAAG,MAAA,CAAO,MAAA,EAAQ,GAAG,KAAK,MAAA,EAAQ,kBAAA,EAAoB,IAAA,CAAK,QAAA,EAAS,EAAE;AAAA,UAC9J;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,eAAA,EAAiB;AACpB,QAAA,MAAM,UAAU,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,IAAA,CAAK,iBAAiB,EAAE,CAAA;AAE/D,QAAA,IAAI,CAAC,WAAW,OAAA,CAAQ,QAAA,KAAa,OAAO,QAAA,EAAU,OAAO,KAAA,CAAM,eAAA,EAAiB,iCAAiC,CAAA;AAErH,QAAA,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,IAAA,CAAK,aAAc,CAAA;AAE7C,QAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAA,CAAK,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,GAAA,KAAQ,QAAQ,GAAG,CAAA;AAEvF,QAAA,OAAO,IAAA,CAAK,WAAA;AAAA,UACV,MAAA;AAAA,UACA,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,KAAA,EAAO,KAAK,KAAA,IAAS,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,EAAE,GAAG,MAAA,CAAO,QAAQ,GAAG,IAAA,EAAM,QAAO,EAAE;AAAA,UACtG;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,iDAAA,EAAmD;AACtD,QAAA,MAAM,UAAU,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,iBAAiB,EAAE,CAAA;AAExD,QAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,SAAS,OAAO,KAAA,CAAM,iBAAiB,iCAAiC,CAAA;AAEhG,QAAA,IAAI,IAAA,CAAK,yBAAyB,4DAAA,EAA8D;AAC9F,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,mBAAA,GAAsB,IAAI,CAAA,IAAK;AAAA,YACjD,YAAA,EAAc,CAAA,eAAA,EAAkB,IAAA,CAAK,mBAAmB,CAAA,CAAA;AAAA,YACxD,mBAAmB,IAAA,CAAK,oBAAA;AAAA,YACxB,UAAA,EAAY,QAAA;AAAA,YACZ,UAAA,EAAY,IAAA;AAAA,YACZ,UAAU,IAAA,CAAK;AAAA,WACjB;AAEA,UAAA,OAAO,QAAA,IAAY,MAAA,IAAU,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,GAAY,MAAA,GAA6B,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,MAAA,EAAkC;AAAA,QACxJ;AAEA,QAAA,MAAM,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,SAAA,EAAW,KAAK,OAAA,EAAS,GAAA,EAAK,SAAA,EAAW,GAAA,EAAK,YAAY,GAAA,EAAK,IAAA,EAAM,GAAG,MAAA,KAAW,OAAA,CAAQ,MAAA;AAEtH,QAAA,OAAO,IAAA,CAAK,YAAY,MAAA,EAAQ;AAAA,UAC9B,GAAA,EAAK,QAAQ,MAAA,CAAO,GAAA;AAAA,UACpB,KAAA,EAAO,IAAA,CAAK,KAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,UACrC,UAAU,IAAA,CAAK,QAAA;AAAA,UACf,MAAA,EAAQ,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAK,EAAE,SAAA,EAAW,MAAA,CAAO,QAAA,EAAU,GAAA,EAAK,MAAA,CAAO,QAAA,EAAS;AAAE,SACjF,EAAG,MAAA,EAAW,IAAA,CAAK,oBAAoB,CAAA;AAAA,MACzC;AAAA,MACA,KAAK,8CAAA,EAAgD;AACnD,QAAA,MAAM,QAAQ,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,IAAA,CAAK,eAAe,EAAE,CAAA;AAEzD,QAAA,IAAI,KAAA,KAAU,MAAA,EAAW,OAAO,KAAA,CAAM,iBAAiB,sBAAsB,CAAA;AAE7E,QAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,IAAA,CAAK,WAAA,EAAc,QAAQ,CAAC,CAAA;AAEjD,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,cAAA,CAAe,MAAA,GAAS,CAAC,CAAC,CAAA,IAAK,UAAA;AAExF,QAAA,QAAQ,OAAA;AAAS,UACf,KAAK,SAAA;AACH,YAAA,OAAO,KAAA,CAAM,yBAAyB,gCAAgC,CAAA;AAAA,UACxE,KAAK,WAAA;AACH,YAAA,OAAO,KAAA,CAAM,aAAa,kBAAkB,CAAA;AAAA,UAC9C,KAAK,QAAA;AACH,YAAA,OAAO,KAAA,CAAM,iBAAiB,8BAA8B,CAAA;AAAA,UAC9D,KAAK,SAAA;AACH,YAAA,OAAO,KAAA,CAAM,iBAAiB,0BAA0B,CAAA;AAAA,UAC1D;AACE,YAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,EAAQ,EAAE,GAAA,EAAK,eAAe,KAAA,EAAO,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,CAAA;AAAA;AACxF,MACF;AAAA,MACA;AACE,QAAA,OAAO,KAAA,CAAM,wBAAA,EAA0B,CAAA,UAAA,EAAa,IAAA,CAAK,UAAU,CAAA,kBAAA,CAAoB,CAAA;AAAA;AAC3F,EACF;AAAA,EAEA,MAAc,WAAA,CACZ,MAAA,EACA,OAAA,EACA,MACA,eAAA,EAC0B;AAC1B,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,gBAAA,CAAiB;AAAA,MAC9C,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,MAAA,CAAO,QAAA;AAAA,MACrC,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AACD,IAAA,MAAM,IAAA,GAAgC;AAAA,MACpC,YAAA,EAAc,WAAA;AAAA,MACd,UAAA,EAAY,QAAA;AAAA,MACZ,YAAY,IAAA,CAAK,QAAA;AAAA,MACjB,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,MAChD,GAAI,eAAA,GAAkB,EAAE,iBAAA,EAAmB,eAAA,KAAoB;AAAC,KAClE;AAEA,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,MAAM,eAAeP,iBAAA,EAAW;AAEhC,MAAA,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,YAAA,EAAc,EAAE,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,OAAO,CAAA;AACvG,MAAA,IAAA,CAAK,aAAA,GAAgB,YAAA;AAAA,IACvB;AAEA,IAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAK;AAAA,EAC7B;AAAA,EAEA,MAAc,UAAA,CAAW,QAAA,EAAqC,IAAA,EAAwD;AACpH,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,SAAS,EAAE,CAAA;AAC/C,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAExC,IAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,OAAA,IAAA,CAAY,MAAA,CAAO,OAAO,GAAA,IAAO,CAAA,KAAM,GAAA,EAAK,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAM,EAAE,MAAA,EAAQ,OAAM,EAAE;AAEhH,IAAA,MAAM,SAAA,GAAY,CAAC,MAAA,CAAO,MAAA,CAAO,OAAO,EAAE,EAAE,IAAA,EAAK;AACjD,IAAA,MAAM,OAAA,GACJ,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,QAAA,IAAY,SAAA,CAAU,QAAA,CAAS,MAAA,CAAO,QAAQ,CAAA,GACrE,IAAA,GACA,SAAA,CAAU,IAAA,CAAK,CAAC,QAAA,KAAa,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,EAAG,oBAAA,EAAsB,QAAA,CAAS,MAAA,CAAO,QAAQ,CAAA,IAAK,QAAA,KAAa,MAAA,CAAO,QAAQ,CAAA;AAE9I,IAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,MAAA,EAAQ,KAAK,IAAA,EAAM,EAAE,MAAA,EAAQ,KAAA,EAAM,EAAE;AAE5D,IAAA,MAAM,EAAE,GAAA,EAAK,GAAG,MAAA,KAAW,MAAA,CAAO,MAAA;AAElC,IAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,MAAA,EAAQ,IAAA,EAAM,UAAA,EAAY,GAAA,IAAO,UAAU,QAAA,EAAU,MAAA,CAAO,kBAAA,EAAoB,GAAG,QAAO,EAAE;AAAA,EAC5H;AAAA,EAEA,MAAc,MAAA,CAAO,QAAA,EAAqC,IAAA,EAAwD;AAChH,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA;AACjC,IAAA,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA;AAE1C,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAI;AAAA,EACvB;AAAA,EAEA,MAAc,MAAA,CAAO,QAAA,EAAqC,IAAA,EAAwD;AAChH,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,MAAM,aAAaA,iBAAA,EAAW;AAE9B,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,UAAA,EAAY,CAAC,CAAA;AAElC,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACJ,WAAA,EAAa,UAAA;AAAA,QACb,SAAA,EAAW,WAAA;AAAA,QACX,gBAAA,EAAkB,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,OAAA,CAAA;AAAA,QAChC,yBAAA,EAA2B,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,2BAAA,CAAA;AAAA,QACzC,UAAA,EAAY,GAAA;AAAA,QACZ,QAAA,EAAU;AAAA;AACZ,KACF;AAAA,EACF;AAAA,EAEA,MAAc,QAAA,CAAS,OAAA,EAAiC,QAAA,EAAyC;AAC/F,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,aAAA,EAAe,OAAA,CAAQ,eAAe,EAAE,CAAA;AAC9D,IAAA,MAAM,SAAS,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAEhD,IAAA,IAAI,CAAC,UAAU,MAAA,CAAO,OAAA;AACpB,MAAA,OAAO,KAAK,QAAA,EAAU;AAAA,QACpB,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,kBAAA,EAAoB,kFAAA;AAAmF,OACnH,CAAA;AAEH,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAA,CAAK,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,GAAA,KAAQ,MAAA,CAAO,OAAO,GAAG,CAAA;AAC7F,IAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,MAAA,CAAO,OAAO,GAAA,EAAK,GAAG,MAAM,QAAA,EAAS;AAE3D,IAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,OAAO,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,MAAA,EAAQ,CAAA;AAE5E,IAAA,MAAM,GAAA,GAAM,MAAM,IAAIC,YAAA,CAAQ,MAAM,CAAA,CACjC,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,CAAA,CACpD,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA,CACrB,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAC3B,WAAA,EAAY,CACZ,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA;AAEvB,IAAA,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,mBAAmB,CAAA;AAC7D,IAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAAA,EAClB;AAAA,EAEQ,YAAY,QAAA,EAAkC;AACpD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AAEpC,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAQ,CAAA,CAAA,CAAG,CAAA;AAE9D,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,IAAA,EAAmG;AACrH,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,OAAA;AACpC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,YAAA;AACzC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,EAAG,OAAO,QAAA;AACrC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,EAAG,OAAO,UAAA;AACvC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,cAAc,CAAA,EAAG,OAAO,QAAA;AAC1C,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,uBAAuB,CAAA,EAAG,OAAO,WAAA;AACnD,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,IAAA,CAAK,UAA0B,MAAA,EAA+B;AACrE,EAAA,MAAM,OAAA,GAAkC,EAAE,GAAG,MAAA,CAAO,OAAA,EAAQ;AAE5D,EAAA,IAAI,MAAA,CAAO,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,KAAM,kBAAA;AAE3D,EAAA,QAAA,CAAS,SAAA,CAAU,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,QAAA,CAAS,GAAA,CAAI,OAAO,IAAA,KAAS,MAAA,GAAY,SAAY,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAI,CAAC,CAAA;AAClF;AAEA,SAAS,SAAS,OAAA,EAA2C;AAC3D,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAE1B,IAAA,OAAA,CAAQ,GAAG,MAAA,EAAQ,CAAC,UAAkB,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AACxD,IAAA,OAAA,CAAQ,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAC,CAAA;AACvE,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;;;ACnmBO,IAAM,cAAN,MAAyC;AAAA;AAAA,EAErC,SAAmB,EAAC;AAAA,EACrB,IAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,KAAA,GAAgB,IAAA,CAAK,GAAA,EAAI,EAAG;AACtC,IAAA,IAAA,CAAK,IAAA,GAAO,KAAA;AAAA,EACd;AAAA,EAEA,GAAA,GAAc;AACZ,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA,EAEA,KAAA,CAAM,IAAY,MAAA,EAAqC;AACrD,IAAA,IAAI,QAAQ,OAAA,EAAS,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,MAAM,CAAA;AAExD,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,EAAE,CAAA;AACnB,IAAA,IAAA,CAAK,IAAA,IAAQ,EAAA;AAEb,IAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA,EAGA,QAAQ,EAAA,EAAkB;AACxB,IAAA,IAAA,CAAK,IAAA,IAAQ,EAAA;AAAA,EACf;AAAA;AAAA,EAGA,IAAI,EAAA,EAAkB;AACpB,IAAA,IAAA,CAAK,IAAA,GAAO,EAAA;AAAA,EACd;AACF;ACpBA,eAAsB,sBACpB,IAAA,EACA,IAAA,EACA,MAAA,EACA,OAAA,GAAiH,EAAC,EACpF;AAC9B,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI;AAChD,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,EAAA,IAAMD,iBAAAA,EAAW;AACpC,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,EAAA;AAAA,IACA,IAAA;AAAA,IACA,UAAA,EAAY,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,GAAI,CAAA;AAAA,IACvC,GAAI,QAAQ,OAAA,GAAU,EAAE,UAAU,OAAA,CAAQ,OAAA,KAAY,EAAC;AAAA,IACvD,GAAI,QAAQ,QAAA,GAAW,EAAE,WAAW,OAAA,CAAQ,QAAA,KAAa,EAAC;AAAA,IAC1D;AAAA,GACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACjC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,CAACQ,4BAAqB,SAAS,GAAG,MAAMC,oCAAA,CAA8B,IAAA,EAAM,QAAQ,SAAS,CAAA;AAAA,IAC7F,CAACD,2BAAA,CAAqB,KAAK,GAAG;AAAA,GAChC;AAEA,EAAA,IAAI,QAAQ,iBAAA,IAAqB,IAAA,EAAM,OAAA,CAAQA,2BAAA,CAAqB,OAAO,CAAA,GAAI,EAAA;AAE/E,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAM;AAChC","file":"index.cjs","sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\nimport { randomUUID } from \"node:crypto\";\nimport { decodeJwt, exportJWK, generateKeyPair, importJWK, jwtVerify, SignJWT, type CryptoKey, type JWK, type JWTPayload } from \"jose\";\n\n/**\n * A client registered in the fake.\n */\nexport interface FakeAuthioClient {\n clientId: string;\n /** For `client_secret_basic` and `client_secret_post`. */\n clientSecret?: string;\n /** The public JWK `private_key_jwt` assertions are verified with. */\n publicKey?: JWK;\n /** Scopes granted when a request names none. */\n defaultScopes?: string[];\n /** Extra claims put into every access token issued to the client. */\n claims?: Record<string, unknown>;\n /** The client this one's tokens are introspectable by, besides itself (a resource server's introspection client). */\n introspectionClients?: string[];\n}\n\n/**\n * A person the fake knows, for the password grant, authorization codes and UserInfo.\n */\nexport interface FakeAuthioUser {\n sub: string;\n username: string;\n password?: string;\n /** Claims put into the person's access tokens: `*_resource_access`, `org_id`, mapper claims… */\n claims?: Record<string, unknown>;\n /** What UserInfo answers besides `sub`. */\n userInfo?: Record<string, unknown>;\n}\n\n/**\n * An error the fake answers a request with.\n */\nexport interface FakeAuthioError {\n status: number;\n body?: Record<string, unknown>;\n headers?: Record<string, string>;\n}\n\n/**\n * A request the fake received.\n */\nexport interface FakeAuthioRecordedRequest {\n method: string;\n path: string;\n headers: Record<string, string>;\n form: Record<string, string>;\n /** The client the request authenticated as, when it did. */\n clientId?: string;\n}\n\n/**\n * What the device flow answers to successive polls.\n */\nexport type FakeAuthioDeviceOutcome = \"pending\" | \"slow_down\" | \"approved\" | \"denied\" | \"expired\";\n\n/**\n * Options of the fake.\n */\nexport interface FakeAuthioOptions {\n /** The realm. Defaults to `fake`. */\n realm?: string;\n /** Seconds tokens live. Defaults to 300. */\n accessTokenLifetime?: number;\n clients?: FakeAuthioClient[];\n users?: FakeAuthioUser[];\n}\n\n/**\n * Options of a token minted directly.\n */\nexport interface FakeAuthioTokenOptions {\n sub?: string;\n /** One or several audiences. Defaults to the client id. */\n audience?: string | string[];\n clientId?: string;\n scope?: string;\n /** Seconds. Negative values mint an expired token. */\n expiresIn?: number;\n /** The `typ` claim. Defaults to `Bearer`. */\n type?: string;\n /** Claims added to the payload. */\n claims?: Record<string, unknown>;\n /** Signs with another issuer. */\n issuer?: string;\n /** Signs with another key, so the signature does not verify. */\n untrusted?: boolean;\n}\n\ninterface IssuedToken {\n claims: JWTPayload;\n clientId: string;\n revoked: boolean;\n}\n\n/**\n * An in-memory Authio realm served over HTTP on loopback: discovery, JWKS, token (client credentials,\n * authorization code, refresh, token exchange, password, device code), introspection, revocation, UserInfo and\n * device authorization.\n */\nexport class FakeAuthio {\n /** Every request received, in order. */\n readonly requests: FakeAuthioRecordedRequest[] = [];\n /** Answers the next requests to an endpoint with these errors, in order, before answering normally. */\n readonly failures = new Map<\"token\" | \"introspect\" | \"revoke\" | \"userinfo\" | \"device\" | \"discovery\", FakeAuthioError[]>();\n /** What successive device-code polls answer; the last value repeats. Defaults to `[\"approved\"]`. */\n deviceOutcomes: FakeAuthioDeviceOutcome[] = [\"approved\"];\n /** Overrides the discovery document's issuer, to test the mismatch check. */\n discoveryIssuer: string | undefined;\n /** Answers UserInfo as `application/jwt`, signed by the realm key. */\n userInfoAsJwt = false;\n /** Answers connected-account exchanges. Defaults to granting a token for the provider. */\n connectionResponder: ((form: Record<string, string>) => FakeAuthioError | Record<string, unknown>) | undefined;\n\n private readonly clients = new Map<string, FakeAuthioClient>();\n private readonly users = new Map<string, FakeAuthioUser>();\n private readonly codes = new Map<string, { clientId: string; sub: string; redirectUri: string; scope?: string; codeVerifier?: string; resource?: string }>();\n private readonly refreshTokens = new Map<string, { clientId: string; sub: string; scope?: string }>();\n private readonly issued = new Map<string, IssuedToken>();\n private readonly devicePolls = new Map<string, number>();\n private readonly lifetime: number;\n private server!: Server;\n private signingKey!: CryptoKey;\n private untrustedKey!: CryptoKey;\n private publicJwk!: JWK;\n private baseUrl!: string;\n readonly realm: string;\n readonly keyId = \"fake-key-1\";\n\n private constructor(options: FakeAuthioOptions) {\n this.realm = options.realm ?? \"fake\";\n this.lifetime = options.accessTokenLifetime ?? 300;\n\n for (const client of options.clients ?? []) this.clients.set(client.clientId, client);\n for (const user of options.users ?? []) this.users.set(user.username, user);\n }\n\n /**\n * Starts the fake on a random loopback port.\n */\n static async start(options: FakeAuthioOptions = {}): Promise<FakeAuthio> {\n const fake = new FakeAuthio(options);\n\n await fake.listen();\n\n return fake;\n }\n\n /** `http://127.0.0.1:{port}`. */\n get authority(): string {\n return this.baseUrl;\n }\n\n /** `{authority}/realms/{realm}`. */\n get issuer(): string {\n return `${this.baseUrl}/realms/${this.realm}`;\n }\n\n /** The realm's public signing key. */\n get jwks(): { keys: JWK[] } {\n return { keys: [this.publicJwk] };\n }\n\n /** Registers a client. */\n addClient(client: FakeAuthioClient): void {\n this.clients.set(client.clientId, client);\n }\n\n /** Registers a person. */\n addUser(user: FakeAuthioUser): void {\n this.users.set(user.username, user);\n }\n\n /**\n * Registers an authorization code for a person, as the authorization endpoint would after sign-in.\n */\n createAuthorizationCode(options: { clientId: string; username: string; redirectUri: string; scope?: string; codeChallengeVerifier?: string; resource?: string }): string {\n const user = this.requireUser(options.username);\n const code = randomUUID();\n\n this.codes.set(code, {\n clientId: options.clientId,\n sub: user.sub,\n redirectUri: options.redirectUri,\n scope: options.scope,\n codeVerifier: options.codeChallengeVerifier,\n resource: options.resource,\n });\n\n return code;\n }\n\n /**\n * Mints an access token signed by the realm key, recorded so introspection and revocation know it.\n */\n async issueAccessToken(options: FakeAuthioTokenOptions = {}): Promise<string> {\n const now = Math.floor(Date.now() / 1000);\n const clientId = options.clientId ?? \"fake-client\";\n const jti = randomUUID();\n const payload: JWTPayload = {\n typ: options.type ?? \"Bearer\",\n azp: clientId,\n client_id: clientId,\n ...(options.scope ? { scope: options.scope } : {}),\n ...(options.sub ? { sub: options.sub } : {}),\n ...options.claims,\n };\n const token = await new SignJWT(payload)\n .setProtectedHeader({ alg: \"RS256\", kid: this.keyId, typ: \"JWT\" })\n .setIssuer(options.issuer ?? this.issuer)\n .setAudience(options.audience ?? clientId)\n .setIssuedAt(now)\n .setNotBefore(now)\n .setExpirationTime(now + (options.expiresIn ?? this.lifetime))\n .setJti(jti)\n .sign(options.untrusted ? this.untrustedKey : this.signingKey);\n\n this.issued.set(token, { claims: decodeJwt(token), clientId, revoked: false });\n\n return token;\n }\n\n /** Marks a token revoked, as Authio would after a sign-out. */\n revokeToken(token: string): void {\n const issued = this.issued.get(token);\n\n if (issued) issued.revoked = true;\n }\n\n /** Forgets the recorded requests. */\n clearRequests(): void {\n this.requests.length = 0;\n }\n\n /** The recorded requests to one endpoint path suffix, such as `/token`. */\n requestsTo(suffix: string): FakeAuthioRecordedRequest[] {\n return this.requests.filter((request) => request.path.endsWith(suffix));\n }\n\n /** Stops the server. */\n close(): Promise<void> {\n return new Promise((resolve, reject) => {\n this.server.closeAllConnections?.();\n this.server.close((error) => (error ? reject(error) : resolve()));\n });\n }\n\n private async listen(): Promise<void> {\n const pair = await generateKeyPair(\"RS256\", { extractable: true });\n const untrusted = await generateKeyPair(\"RS256\");\n\n this.signingKey = pair.privateKey;\n this.untrustedKey = untrusted.privateKey;\n this.publicJwk = { ...(await exportJWK(pair.publicKey)), kid: this.keyId, alg: \"RS256\", use: \"sig\" };\n this.server = createServer((request, response) => {\n this.handle(request, response).catch((error: unknown) => {\n send(response, { status: 500, body: { error: \"server_error\", error_description: String(error) } });\n });\n });\n\n await new Promise<void>((resolve) => this.server.listen(0, \"127.0.0.1\", resolve));\n\n this.baseUrl = `http://127.0.0.1:${(this.server.address() as AddressInfo).port}`;\n }\n\n private async handle(request: IncomingMessage, response: ServerResponse): Promise<void> {\n const url = new URL(request.url ?? \"/\", this.baseUrl);\n const body = await readBody(request);\n const form = Object.fromEntries(new URLSearchParams(request.headers[\"content-type\"]?.includes(\"form\") ? body : \"\"));\n const headers = Object.fromEntries(Object.entries(request.headers).map(([name, value]) => [name, Array.isArray(value) ? value.join(\", \") : (value ?? \"\")]));\n const recorded: FakeAuthioRecordedRequest = { method: request.method ?? \"GET\", path: url.pathname, headers, form };\n\n this.requests.push(recorded);\n\n const prefix = `/realms/${this.realm}`;\n const path = url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : url.pathname;\n const endpoint = endpointOf(path);\n const failure = endpoint ? this.failures.get(endpoint)?.shift() : undefined;\n\n if (failure) return send(response, failure);\n\n switch (path) {\n case \"/.well-known/openid-configuration\":\n return send(response, { status: 200, body: this.discovery() });\n case \"/protocol/openid-connect/certs\":\n return send(response, { status: 200, body: this.jwks });\n case \"/protocol/openid-connect/token\":\n return send(response, await this.token(recorded, form));\n case \"/protocol/openid-connect/token/introspect\":\n return send(response, await this.introspect(recorded, form));\n case \"/protocol/openid-connect/revoke\":\n return send(response, await this.revoke(recorded, form));\n case \"/protocol/openid-connect/userinfo\":\n return this.userInfo(headers, response);\n case \"/protocol/openid-connect/auth/device\":\n return send(response, await this.device(recorded, form));\n default:\n return send(response, { status: 404, body: { error: \"not_found\" } });\n }\n }\n\n private discovery(): Record<string, unknown> {\n const base = `${this.issuer}/protocol/openid-connect`;\n\n return {\n issuer: this.discoveryIssuer ?? this.issuer,\n authorization_endpoint: `${base}/auth`,\n token_endpoint: `${base}/token`,\n introspection_endpoint: `${base}/token/introspect`,\n revocation_endpoint: `${base}/revoke`,\n userinfo_endpoint: `${base}/userinfo`,\n end_session_endpoint: `${base}/logout`,\n device_authorization_endpoint: `${base}/auth/device`,\n jwks_uri: `${base}/certs`,\n grant_types_supported: [\"authorization_code\", \"refresh_token\", \"client_credentials\", \"password\", \"urn:ietf:params:oauth:grant-type:device_code\", \"urn:ietf:params:oauth:grant-type:token-exchange\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\", \"private_key_jwt\", \"none\"],\n code_challenge_methods_supported: [\"S256\"],\n authorization_response_iss_parameter_supported: true,\n };\n }\n\n private async authenticate(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioClient | FakeAuthioError> {\n const invalid = (description: string): FakeAuthioError => ({ status: 401, body: { error: \"invalid_client\", error_description: description } });\n const authorization = recorded.headers.authorization;\n let client: FakeAuthioClient | undefined;\n\n if (authorization?.startsWith(\"Basic \")) {\n const [id, secret] = Buffer.from(authorization.slice(6), \"base64\").toString(\"utf8\").split(\":\").map(decodeURIComponent);\n\n client = this.clients.get(id ?? \"\");\n\n if (!client || !client.clientSecret || client.clientSecret !== secret) return invalid(\"The client credentials are wrong.\");\n } else if (form.client_assertion) {\n client = this.clients.get(form.client_id ?? \"\");\n\n if (!client?.publicKey) return invalid(\"The client has no registered key.\");\n if (form.client_assertion_type !== \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\") return invalid(\"Wrong assertion type.\");\n\n try {\n const key = await importJWK(client.publicKey, client.publicKey.alg);\n const { payload } = await jwtVerify(form.client_assertion, key, { issuer: client.clientId, subject: client.clientId, audience: this.issuer });\n\n if (!payload.jti) return invalid(\"The assertion has no jti.\");\n } catch (error) {\n return invalid(`The assertion does not verify: ${(error as Error).message}`);\n }\n } else if (form.client_secret !== undefined) {\n client = this.clients.get(form.client_id ?? \"\");\n\n if (!client || client.clientSecret !== form.client_secret) return invalid(\"The client credentials are wrong.\");\n } else {\n client = this.clients.get(form.client_id ?? \"\");\n\n if (!client || client.clientSecret || client.publicKey) return invalid(\"The client must authenticate.\");\n }\n\n recorded.clientId = client.clientId;\n\n return client;\n }\n\n private async token(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n const scope = form.scope ?? client.defaultScopes?.join(\" \");\n const grant = (error: string, description: string): FakeAuthioError => ({ status: 400, body: { error, error_description: description } });\n\n switch (form.grant_type) {\n case \"client_credentials\":\n return this.tokenAnswer(client, { sub: client.clientId, scope, audience: form.resource, claims: client.claims });\n case \"password\": {\n const user = this.users.get(form.username ?? \"\");\n\n if (!user || user.password !== form.password) return grant(\"invalid_grant\", \"Wrong username or password.\");\n\n return this.tokenAnswer(client, { sub: user.sub, scope, claims: { ...client.claims, ...user.claims, preferred_username: user.username } }, user);\n }\n case \"authorization_code\": {\n const code = this.codes.get(form.code ?? \"\");\n\n if (!code || code.clientId !== client.clientId || code.redirectUri !== form.redirect_uri) return grant(\"invalid_grant\", \"The code is not valid.\");\n if (code.codeVerifier && code.codeVerifier !== form.code_verifier) return grant(\"invalid_grant\", \"PKCE verification failed.\");\n\n this.codes.delete(form.code!);\n\n const user = [...this.users.values()].find((candidate) => candidate.sub === code.sub)!;\n\n return this.tokenAnswer(\n client,\n { sub: user.sub, scope: code.scope, audience: form.resource ?? code.resource, claims: { ...client.claims, ...user.claims, preferred_username: user.username } },\n user,\n );\n }\n case \"refresh_token\": {\n const refresh = this.refreshTokens.get(form.refresh_token ?? \"\");\n\n if (!refresh || refresh.clientId !== client.clientId) return grant(\"invalid_grant\", \"The refresh token is not valid.\");\n\n this.refreshTokens.delete(form.refresh_token!);\n\n const user = [...this.users.values()].find((candidate) => candidate.sub === refresh.sub);\n\n return this.tokenAnswer(\n client,\n { sub: refresh.sub, scope: form.scope ?? refresh.scope, claims: { ...client.claims, ...user?.claims } },\n user,\n );\n }\n case \"urn:ietf:params:oauth:grant-type:token-exchange\": {\n const subject = this.issued.get(form.subject_token ?? \"\");\n\n if (!subject || subject.revoked) return grant(\"invalid_grant\", \"The subject token is not valid.\");\n\n if (form.requested_token_type === \"urn:authio:params:oauth:token-type:connection-access-token\") {\n const answer = this.connectionResponder?.(form) ?? {\n access_token: `provider-token-${form.connection_provider}`,\n issued_token_type: form.requested_token_type,\n token_type: \"Bearer\",\n expires_in: 3600,\n provider: form.connection_provider,\n };\n\n return \"status\" in answer && typeof answer.status === \"number\" ? (answer as FakeAuthioError) : { status: 200, body: answer as Record<string, unknown> };\n }\n\n const { iss: _issuer, aud: _audience, exp: _expiry, iat: _issuedAt, nbf: _notBefore, jti: _jti, ...claims } = subject.claims;\n\n return this.tokenAnswer(client, {\n sub: subject.claims.sub,\n scope: form.scope ?? (subject.claims.scope as string | undefined),\n audience: form.resource,\n claims: { ...claims, act: { client_id: client.clientId, sub: client.clientId } },\n }, undefined, form.requested_token_type);\n }\n case \"urn:ietf:params:oauth:grant-type:device_code\": {\n const polls = this.devicePolls.get(form.device_code ?? \"\");\n\n if (polls === undefined) return grant(\"invalid_grant\", \"Unknown device code.\");\n\n this.devicePolls.set(form.device_code!, polls + 1);\n\n const outcome = this.deviceOutcomes[Math.min(polls, this.deviceOutcomes.length - 1)] ?? \"approved\";\n\n switch (outcome) {\n case \"pending\":\n return grant(\"authorization_pending\", \"The user has not approved yet.\");\n case \"slow_down\":\n return grant(\"slow_down\", \"Poll less often.\");\n case \"denied\":\n return grant(\"access_denied\", \"The user denied the request.\");\n case \"expired\":\n return grant(\"expired_token\", \"The device code expired.\");\n default:\n return this.tokenAnswer(client, { sub: \"device-user\", scope, claims: client.claims });\n }\n }\n default:\n return grant(\"unsupported_grant_type\", `The grant ${form.grant_type} is not supported.`);\n }\n }\n\n private async tokenAnswer(\n client: FakeAuthioClient,\n options: { sub?: string; scope?: string; audience?: string; claims?: Record<string, unknown> },\n user?: FakeAuthioUser,\n issuedTokenType?: string,\n ): Promise<FakeAuthioError> {\n const accessToken = await this.issueAccessToken({\n clientId: client.clientId,\n sub: options.sub,\n scope: options.scope,\n audience: options.audience ?? client.clientId,\n claims: options.claims,\n });\n const body: Record<string, unknown> = {\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: this.lifetime,\n ...(options.scope ? { scope: options.scope } : {}),\n ...(issuedTokenType ? { issued_token_type: issuedTokenType } : {}),\n };\n\n if (user) {\n const refreshToken = randomUUID();\n\n this.refreshTokens.set(refreshToken, { clientId: client.clientId, sub: user.sub, scope: options.scope });\n body.refresh_token = refreshToken;\n }\n\n return { status: 200, body };\n }\n\n private async introspect(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n const issued = this.issued.get(form.token ?? \"\");\n const now = Math.floor(Date.now() / 1000);\n\n if (!issued || issued.revoked || (issued.claims.exp ?? 0) <= now) return { status: 200, body: { active: false } };\n\n const audiences = [issued.claims.aud ?? []].flat();\n const allowed =\n issued.clientId === client.clientId && audiences.includes(client.clientId)\n ? true\n : audiences.some((audience) => this.clients.get(audience)?.introspectionClients?.includes(client.clientId) || audience === client.clientId);\n\n if (!allowed) return { status: 200, body: { active: false } };\n\n const { typ, ...claims } = issued.claims;\n\n return { status: 200, body: { active: true, token_type: typ ?? \"Bearer\", username: claims.preferred_username, ...claims } };\n }\n\n private async revoke(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n this.revokeToken(form.token ?? \"\");\n this.refreshTokens.delete(form.token ?? \"\");\n\n return { status: 200 };\n }\n\n private async device(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n const deviceCode = randomUUID();\n\n this.devicePolls.set(deviceCode, 0);\n\n return {\n status: 200,\n body: {\n device_code: deviceCode,\n user_code: \"WDJB-MJHT\",\n verification_uri: `${this.issuer}/device`,\n verification_uri_complete: `${this.issuer}/device?user_code=WDJB-MJHT`,\n expires_in: 600,\n interval: 5,\n },\n };\n }\n\n private async userInfo(headers: Record<string, string>, response: ServerResponse): Promise<void> {\n const token = headers.authorization?.replace(/^Bearer\\s+/i, \"\");\n const issued = token ? this.issued.get(token) : undefined;\n\n if (!issued || issued.revoked)\n return send(response, {\n status: 401,\n headers: { \"www-authenticate\": 'Bearer error=\"invalid_token\", error_description=\"The access token is not valid.\"' },\n });\n\n const user = [...this.users.values()].find((candidate) => candidate.sub === issued.claims.sub);\n const claims = { sub: issued.claims.sub, ...user?.userInfo };\n\n if (!this.userInfoAsJwt) return send(response, { status: 200, body: claims });\n\n const jwt = await new SignJWT(claims)\n .setProtectedHeader({ alg: \"RS256\", kid: this.keyId })\n .setIssuer(this.issuer)\n .setAudience(issued.clientId)\n .setIssuedAt()\n .sign(this.signingKey);\n\n response.writeHead(200, { \"content-type\": \"application/jwt\" });\n response.end(jwt);\n }\n\n private requireUser(username: string): FakeAuthioUser {\n const user = this.users.get(username);\n\n if (!user) throw new Error(`The fake has no user ${username}.`);\n\n return user;\n }\n}\n\nfunction endpointOf(path: string): \"token\" | \"introspect\" | \"revoke\" | \"userinfo\" | \"device\" | \"discovery\" | undefined {\n if (path.endsWith(\"/token\")) return \"token\";\n if (path.endsWith(\"/introspect\")) return \"introspect\";\n if (path.endsWith(\"/revoke\")) return \"revoke\";\n if (path.endsWith(\"/userinfo\")) return \"userinfo\";\n if (path.endsWith(\"/auth/device\")) return \"device\";\n if (path.endsWith(\"/openid-configuration\")) return \"discovery\";\n return undefined;\n}\n\nfunction send(response: ServerResponse, answer: FakeAuthioError): void {\n const headers: Record<string, string> = { ...answer.headers };\n\n if (answer.body !== undefined) headers[\"content-type\"] ??= \"application/json\";\n\n response.writeHead(answer.status, headers);\n response.end(answer.body === undefined ? undefined : JSON.stringify(answer.body));\n}\n\nfunction readBody(request: IncomingMessage): Promise<string> {\n return new Promise((resolve, reject) => {\n const chunks: Buffer[] = [];\n\n request.on(\"data\", (chunk: Buffer) => chunks.push(chunk));\n request.on(\"end\", () => resolve(Buffer.concat(chunks).toString(\"utf8\")));\n request.on(\"error\", reject);\n });\n}\n","import type { AuthioClock } from \"@hyper.authio/client\";\n\n/**\n * A clock that moves only when told to. `sleep` returns at once and moves the clock forward by the time asked, so\n * device polling and cache expiry run instantly and deterministically.\n */\nexport class ManualClock implements AuthioClock {\n /** Every `sleep` asked for, in milliseconds. */\n readonly sleeps: number[] = [];\n private time: number;\n\n /**\n * @param start Milliseconds since the epoch. Defaults to the current time.\n */\n constructor(start: number = Date.now()) {\n this.time = start;\n }\n\n now(): number {\n return this.time;\n }\n\n sleep(ms: number, signal?: AbortSignal): Promise<void> {\n if (signal?.aborted) return Promise.reject(signal.reason);\n\n this.sleeps.push(ms);\n this.time += ms;\n\n return Promise.resolve();\n }\n\n /** Moves the clock forward. */\n advance(ms: number): void {\n this.time += ms;\n }\n\n /** Sets the clock. */\n set(ms: number): void {\n this.time = ms;\n }\n}\n","import { randomUUID } from \"node:crypto\";\nimport { AuthioWebhookHeaders, computeWebhookSignatureHeader } from \"@hyper.authio/client\";\n\n/**\n * A webhook delivery as Authio would send it.\n */\nexport interface FakeWebhookDelivery {\n readonly body: string;\n readonly headers: Record<string, string>;\n readonly event: Record<string, unknown>;\n}\n\n/**\n * Builds a signed webhook delivery.\n *\n * @param type The event type.\n * @param data The event data.\n * @param secret The webhook secret.\n * @param options `id`, `timestamp` (milliseconds) and extra event members.\n */\nexport async function createWebhookDelivery(\n type: string,\n data: unknown,\n secret: string,\n options: { id?: string; timestamp?: number; realmId?: string; clientId?: string; sendEventIdHeader?: boolean } = {},\n): Promise<FakeWebhookDelivery> {\n const timestamp = options.timestamp ?? Date.now();\n const id = options.id ?? randomUUID();\n const event = {\n id,\n type,\n created_at: Math.floor(timestamp / 1000),\n ...(options.realmId ? { realm_id: options.realmId } : {}),\n ...(options.clientId ? { client_id: options.clientId } : {}),\n data,\n };\n const body = JSON.stringify(event);\n const headers: Record<string, string> = {\n \"content-type\": \"application/json\",\n [AuthioWebhookHeaders.Signature]: await computeWebhookSignatureHeader(body, secret, timestamp),\n [AuthioWebhookHeaders.Event]: type,\n };\n\n if (options.sendEventIdHeader ?? true) headers[AuthioWebhookHeaders.EventId] = id;\n\n return { body, headers, event };\n}\n"]}
|
|
1
|
+
{"version":3,"sources":["../src/fake-authio.ts","../src/manual-clock.ts","../src/webhook-delivery.ts"],"names":["randomUUID","SignJWT","decodeJwt","generateKeyPair","exportJWK","createServer","jwtVerify","importJWK","CompactEncrypt","createHash","AuthioWebhookHeaders","computeWebhookSignatureHeader"],"mappings":";;;;;;;;AAyNO,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA;AAAA,EAEb,WAAwC,EAAC;AAAA;AAAA,EAEzC,QAAA,uBAAe,GAAA,EAAiC;AAAA;AAAA,EAEhD,wBAAyD,EAAC;AAAA;AAAA,EAEnE,cAAA,GAA4C,CAAC,UAAU,CAAA;AAAA;AAAA,EAEvD,eAAA;AAAA;AAAA,EAEA,aAAA,GAAgB,KAAA;AAAA;AAAA,EAEhB,uBAAA,GAA0B,KAAA;AAAA;AAAA,EAE1B,mBAAA;AAAA;AAAA,EAEA,QAAA;AAAA,EAEiB,OAAA,uBAAc,GAAA,EAA8B;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAA4B;AAAA,EACxC,oBAAA,uBAA2B,GAAA,EAA2C;AAAA,EACtE,KAAA,uBAAY,GAAA,EAAyB;AAAA,EACrC,aAAA,uBAAoB,GAAA,EAAgG;AAAA,EACpH,MAAA,uBAAa,GAAA,EAAyB;AAAA,EACtC,WAAA,uBAAkB,GAAA,EAAoB;AAAA,EACtC,QAAA;AAAA,EACT,OAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACC,KAAA;AAAA,EACA,KAAA,GAAQ,YAAA;AAAA,EAET,YAAY,OAAA,EAA4B;AAC9C,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAQ,KAAA,IAAS,MAAA;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,mBAAA,IAAuB,GAAA;AAE/C,IAAA,KAAA,MAAW,MAAA,IAAU,OAAA,CAAQ,OAAA,IAAW,EAAC,OAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,MAAM,CAAA;AACpF,IAAA,KAAA,MAAW,IAAA,IAAQ,OAAA,CAAQ,KAAA,IAAS,EAAC,OAAQ,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAC1E,IAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,oBAAA,IAAwB,EAAC,OAAQ,oBAAA,CAAqB,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AAAA,EACpG;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,KAAA,CAAM,OAAA,GAA6B,EAAC,EAAwB;AACvE,IAAA,MAAM,IAAA,GAAO,IAAI,WAAA,CAAW,OAAO,CAAA;AAEnC,IAAA,MAAM,KAAK,MAAA,EAAO;AAElB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,SAAA,GAAoB;AACtB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA,EAGA,IAAI,MAAA,GAAiB;AACnB,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,QAAA,EAAW,KAAK,KAAK,CAAA,CAAA;AAAA,EAC7C;AAAA;AAAA,EAGA,IAAI,IAAA,GAAwB;AAC1B,IAAA,OAAO,EAAE,IAAA,EAAM,CAAC,IAAA,CAAK,SAAS,CAAA,EAAE;AAAA,EAClC;AAAA;AAAA,EAGA,IAAI,cAAA,GAA6E;AAC/E,IAAA,OAAO,IAAA,CAAK,OAAA,GAAU,EAAE,GAAA,EAAK,KAAK,OAAA,CAAQ,GAAA,EAAK,GAAA,EAAK,IAAA,CAAK,QAAQ,GAAA,EAAK,QAAA,EAAU,IAAA,CAAK,OAAA,CAAQ,UAAS,GAAI,MAAA;AAAA,EAC5G;AAAA;AAAA,EAGA,UAAU,MAAA,EAAgC;AACxC,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,MAAM,CAAA;AAAA,EAC1C;AAAA;AAAA,EAGA,QAAQ,IAAA,EAA4B;AAClC,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAAA,EACpC;AAAA;AAAA,EAGA,uBAAuB,KAAA,EAA4C;AACjE,IAAA,IAAA,CAAK,oBAAA,CAAqB,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,KAAK,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,wBAAwB,OAAA,EAAiK;AACvL,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,OAAA,CAAQ,QAAQ,CAAA;AAC9C,IAAA,MAAM,OAAOA,iBAAA,EAAW;AAExB,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,IAAA,EAAM;AAAA,MACnB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,KAAK,IAAA,CAAK,GAAA;AAAA,MACV,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,qBAAA;AAAA,MACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,OAAO,OAAA,CAAQ;AAAA,KAChB,CAAA;AAED,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,gBAAA,EAAmE;AACjF,IAAA,MAAM,WAAW,MAAM,KAAA,CAAM,kBAAkB,EAAE,QAAA,EAAU,UAAU,CAAA;AACrE,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAEhD,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,QAAQ,CAAA;AAEjC,MAAA,OAAO,EAAE,YAAY,MAAA,CAAO,WAAA,CAAY,SAAS,YAAY,CAAA,EAAG,aAAa,QAAA,EAAS;AAAA,IACxF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,OAAA,GAAU,uCAAA,CAAwC,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AAEtE,IAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,8CAAA,EAAiD,QAAA,CAAS,MAAM,CAAA,iBAAA,CAAmB,CAAA;AAEjH,IAAA,OAAO,EAAE,YAAY,IAAA,CAAK,KAAA,CAAM,mBAAmB,OAAO,CAAC,CAAA,EAA6B,WAAA,EAAa,MAAA,EAAU;AAAA,EACjH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAA,CAAiB,OAAA,GAAkC,EAAC,EAAoB;AAC5E,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,aAAA;AACrC,IAAA,MAAM,MAAMA,iBAAA,EAAW;AACvB,IAAA,MAAM,OAAA,GAAsB;AAAA,MAC1B,GAAA,EAAK,QAAQ,IAAA,IAAQ,QAAA;AAAA,MACrB,GAAA,EAAK,QAAA;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,MAChD,GAAI,QAAQ,GAAA,GAAM,EAAE,KAAK,OAAA,CAAQ,GAAA,KAAQ,EAAC;AAAA,MAC1C,GAAG,OAAA,CAAQ;AAAA,KACb;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAIC,YAAA,CAAQ,OAAO,CAAA,CACrC,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,KAAK,KAAA,EAAO,GAAA,EAAK,KAAA,EAAO,CAAA,CAChE,SAAA,CAAU,QAAQ,MAAA,IAAU,IAAA,CAAK,MAAM,CAAA,CACvC,WAAA,CAAY,OAAA,CAAQ,YAAY,QAAQ,CAAA,CACxC,YAAY,GAAG,CAAA,CACf,aAAa,GAAG,CAAA,CAChB,iBAAA,CAAkB,GAAA,IAAO,OAAA,CAAQ,SAAA,IAAa,KAAK,QAAA,CAAS,CAAA,CAC5D,MAAA,CAAO,GAAG,CAAA,CACV,IAAA,CAAK,QAAQ,SAAA,GAAY,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,UAAU,CAAA;AAC/D,IAAA,MAAM,KAAA,GAAQ,QAAQ,SAAA,GAAY,MAAM,UAAU,MAAA,EAAQ,OAAA,CAAQ,SAAS,CAAA,GAAI,MAAA;AAE/E,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,MAAA,EAAQC,cAAA,CAAU,MAAM,CAAA,EAAG,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,CAAA;AAE9E,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,OAAA,EAAgI;AACtJ,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,OAAA,GAAmC;AAAA,MACvC,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,KAAK,OAAA,CAAQ,QAAA;AAAA,MACb,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,GAAA;AAAA,MACX,KAAKF,iBAAA,EAAW;AAAA,MAChB,GAAI,QAAQ,GAAA,GAAM,EAAE,KAAK,OAAA,CAAQ,GAAA,KAAQ,EAAC;AAAA,MAC1C,GAAI,QAAQ,GAAA,GAAM,EAAE,KAAK,OAAA,CAAQ,GAAA,KAAQ,EAAC;AAAA,MAC1C,MAAA,EAAQ,EAAE,oDAAA,EAAsD,EAAC,EAAE;AAAA,MACnE,GAAG,OAAA,CAAQ;AAAA,KACb;AAEA,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA,EAAW,OAAO,OAAA,CAAQ,GAAG,CAAA;AAE1F,IAAA,MAAM,MAAA,GAAS,MAAM,IAAIC,YAAA,CAAQ,OAAqB,CAAA,CAAE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,KAAK,IAAA,CAAK,KAAA,EAAO,KAAK,OAAA,CAAQ,IAAA,IAAQ,cAAc,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA;AACrK,IAAA,MAAM,aAAa,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,QAAQ,CAAA,EAAG,UAAA;AAEvD,IAAA,OAAO,UAAA,EAAY,YAAA,GAAe,SAAA,CAAU,MAAA,EAAQ,UAAU,CAAA,GAAI,MAAA;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,wBAAA,CAAyB,QAAA,EAAkB,OAAA,GAA0C,EAAC,EAAoB;AAC9G,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAExC,IAAA,IAAI,CAAC,QAAQ,oBAAA,EAAsB,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,QAAQ,CAAA,6BAAA,CAA+B,CAAA;AAE7G,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,iBAAA,CAAkB,EAAE,QAAA,EAAU,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,CAAA;AACjG,IAAA,IAAI,MAAA,GAAS,CAAA;AAEb,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,oBAAA,EAAsB;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,QAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,cAAc,WAAA,EAAa,EAAE,QAAA;AAAS,OACnE,CAAA;AAED,MAAA,MAAA,GAAS,QAAA,CAAS,MAAA;AAClB,MAAA,MAAM,SAAS,WAAA,EAAY;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAA,GAAS,CAAA;AAAA,IACX;AAEA,IAAA,IAAA,CAAK,qBAAA,CAAsB,KAAK,EAAE,QAAA,EAAU,KAAK,MAAA,CAAO,oBAAA,EAAsB,WAAA,EAAa,MAAA,EAAQ,CAAA;AAEnG,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA,EAGA,YAAY,KAAA,EAAqB;AAC/B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAEpC,IAAA,IAAI,MAAA,SAAe,OAAA,GAAU,IAAA;AAE7B,IAAA,IAAA,CAAK,aAAA,CAAc,OAAO,KAAK,CAAA;AAAA,EACjC;AAAA;AAAA,EAGA,oBAAoB,OAAA,EAA+C;AACjE,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,OAAO,CAAA,IAAK,IAAA,CAAK,aAAA;AAClC,MAAA,IAAK,OAAA,CAAQ,GAAA,KAAQ,MAAA,IAAa,OAAA,CAAQ,QAAQ,OAAA,CAAQ,GAAA,IAAS,OAAA,CAAQ,GAAA,KAAQ,UAAa,OAAA,CAAQ,GAAA,KAAQ,MAAA,IAAa,OAAA,CAAQ,QAAQ,OAAA,CAAQ,GAAA;AACnJ,QAAA,IAAA,CAAK,aAAA,CAAc,OAAO,KAAK,CAAA;AAAA,EACrC;AAAA;AAAA,EAGA,aAAA,GAAsB;AACpB,IAAA,IAAA,CAAK,SAAS,MAAA,GAAS,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,WAAW,MAAA,EAA6C;AACtD,IAAA,OAAO,IAAA,CAAK,SAAS,MAAA,CAAO,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACxE;AAAA;AAAA,EAGA,KAAA,GAAuB;AACrB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAA,CAAK,OAAO,mBAAA,IAAsB;AAClC,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,KAAA,KAAW,QAAQ,MAAA,CAAO,KAAK,CAAA,GAAI,OAAA,EAAU,CAAA;AAAA,IAClE,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,MAAA,GAAwB;AACpC,IAAA,MAAM,OAAO,MAAME,oBAAA,CAAgB,SAAS,EAAE,WAAA,EAAa,MAAM,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,MAAMA,oBAAA,CAAgB,OAAO,CAAA;AAE/C,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,kBAAkB,IAAA,CAAK,SAAA;AAC5B,IAAA,IAAA,CAAK,eAAe,SAAA,CAAU,UAAA;AAC9B,IAAA,IAAA,CAAK,SAAA,GAAY,EAAE,GAAI,MAAMC,eAAU,IAAA,CAAK,SAAS,CAAA,EAAI,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,OAAA,EAAS,KAAK,KAAA,EAAM;AACnG,IAAA,IAAA,CAAK,MAAA,GAASC,iBAAA,CAAa,CAAC,OAAA,EAAS,QAAA,KAAa;AAChD,MAAA,IAAA,CAAK,OAAO,OAAA,EAAS,QAAQ,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACvD,QAAA,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,cAAA,EAAgB,iBAAA,EAAmB,MAAA,CAAO,KAAK,CAAA,IAAK,CAAA;AAAA,MACnG,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY,IAAA,CAAK,OAAO,MAAA,CAAO,CAAA,EAAG,WAAA,EAAa,OAAO,CAAC,CAAA;AAEhF,IAAA,IAAA,CAAK,UAAU,CAAA,iBAAA,EAAqB,IAAA,CAAK,MAAA,CAAO,OAAA,GAA0B,IAAI,CAAA,CAAA;AAAA,EAChF;AAAA,EAEA,MAAc,MAAA,CAAO,OAAA,EAA0B,QAAA,EAAyC;AACtF,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,QAAQ,GAAA,IAAO,GAAA,EAAK,KAAK,OAAO,CAAA;AACpD,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,WAAA,CAAY,IAAI,gBAAgB,OAAA,CAAQ,OAAA,CAAQ,cAAc,CAAA,EAAG,QAAA,CAAS,MAAM,CAAA,GAAI,IAAA,GAAO,EAAE,CAAC,CAAA;AAClH,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,CAAC,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAK,KAAA,IAAS,EAAG,CAAC,CAAC,CAAA;AAC1J,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,YAAY,CAAA;AACjD,IAAA,MAAM,QAAA,GAAsC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,IAAU,KAAA,EAAO,IAAA,EAAM,GAAA,CAAI,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,KAAA,EAAM;AAExH,IAAA,IAAA,CAAK,QAAA,CAAS,KAAK,QAAQ,CAAA;AAE3B,IAAA,MAAM,MAAA,GAAS,CAAA,QAAA,EAAW,IAAA,CAAK,KAAK,CAAA,CAAA;AACpC,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,GAAI,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA,GAAI,GAAA,CAAI,QAAA;AACvF,IAAA,MAAM,QAAA,GAAW,WAAW,IAAI,CAAA;AAChC,IAAA,MAAM,OAAA,GAAU,WAAW,IAAA,CAAK,QAAA,CAAS,IAAI,QAAQ,CAAA,EAAG,OAAM,GAAI,MAAA;AAElE,IAAA,IAAI,OAAA,EAAS,OAAO,IAAA,CAAK,QAAA,EAAU,OAAO,CAAA;AAE1C,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,mCAAA;AACH,QAAA,OAAO,IAAA,CAAK,UAAU,EAAE,MAAA,EAAQ,KAAK,IAAA,EAAM,IAAA,CAAK,SAAA,EAAU,EAAG,CAAA;AAAA,MAC/D,KAAK,gCAAA;AACH,QAAA,OAAO,IAAA,CAAK,UAAU,EAAE,MAAA,EAAQ,KAAK,IAAA,EAAM,IAAA,CAAK,MAAM,CAAA;AAAA,MACxD,KAAK,+BAAA;AACH,QAAA,OAAO,IAAA,CAAK,iBAAA,CAAkB,KAAA,EAAO,QAAQ,CAAA;AAAA,MAC/C,KAAK,gCAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,KAAA,CAAM,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MACxD,KAAK,2CAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,UAAA,CAAW,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MAC7D,KAAK,iCAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,MAAA,CAAO,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MACzD,KAAK,mCAAA;AACH,QAAA,OAAO,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,QAAQ,CAAA;AAAA,MACxC,KAAK,sCAAA;AACH,QAAA,OAAO,KAAK,QAAA,EAAU,MAAM,KAAK,MAAA,CAAO,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,MACzD,KAAK,iCAAA;AACH,QAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,QAAQ,CAAA;AAAA,MAChD;AACE,QAAA,OAAO,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAM,EAAE,KAAA,EAAO,WAAA,EAAY,EAAG,CAAA;AAAA;AACvE,EACF;AAAA,EAEQ,SAAA,GAAqC;AAC3C,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,wBAAA,CAAA;AAE3B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,MAAA;AAAA,MACrC,sBAAA,EAAwB,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,MAC/B,cAAA,EAAgB,GAAG,IAAI,CAAA,MAAA,CAAA;AAAA,MACvB,sBAAA,EAAwB,GAAG,IAAI,CAAA,iBAAA,CAAA;AAAA,MAC/B,mBAAA,EAAqB,GAAG,IAAI,CAAA,OAAA,CAAA;AAAA,MAC5B,iBAAA,EAAmB,GAAG,IAAI,CAAA,SAAA,CAAA;AAAA,MAC1B,oBAAA,EAAsB,GAAG,IAAI,CAAA,OAAA,CAAA;AAAA,MAC7B,6BAAA,EAA+B,GAAG,IAAI,CAAA,YAAA,CAAA;AAAA,MACtC,QAAA,EAAU,GAAG,IAAI,CAAA,MAAA,CAAA;AAAA,MACjB,kBAAkB,CAAC,QAAA,EAAU,WAAW,OAAA,EAAS,OAAA,EAAS,SAAS,gBAAgB,CAAA;AAAA,MACnF,wBAAA,EAA0B,CAAC,MAAM,CAAA;AAAA,MACjC,wBAAA,EAA0B,CAAC,OAAA,EAAS,aAAa,CAAA;AAAA,MACjD,qBAAA,EAAuB;AAAA,QACrB,oBAAA;AAAA,QACA,eAAA;AAAA,QACA,oBAAA;AAAA,QACA,UAAA;AAAA,QACA,8CAAA;AAAA,QACA,iDAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,uBAAA,EAAyB,CAAC,QAAQ,CAAA;AAAA,MAClC,qCAAA,EAAuC,CAAC,OAAO,CAAA;AAAA,MAC/C,wCAAA,EAA0C,CAAC,UAAA,EAAY,cAAc,CAAA;AAAA,MACrE,wCAAA,EAA0C,CAAC,eAAA,EAAiB,eAAA,EAAiB,eAAe,CAAA;AAAA,MAC5F,qCAAA,EAAuC,CAAC,OAAO,CAAA;AAAA,MAC/C,wCAAA,EAA0C,CAAC,UAAA,EAAY,cAAc,CAAA;AAAA,MACrE,wCAAA,EAA0C,CAAC,eAAA,EAAiB,eAAA,EAAiB,eAAe,CAAA;AAAA,MAC5F,qCAAA,EAAuC,CAAC,qBAAA,EAAuB,oBAAA,EAAsB,mBAAmB,MAAM,CAAA;AAAA,MAC9G,gCAAA,EAAkC,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MAClD,uBAAA,EAAyB,CAAC,MAAA,EAAQ,OAAA,EAAS,kBAAkB,SAAS,CAAA;AAAA,MACtE,wBAAA,EAA0B,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MAC1C,oBAAA,EAAsB,CAAC,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAAA,MACpC,4BAAA,EAA8B,IAAA;AAAA,MAC9B,oCAAA,EAAsC,IAAA;AAAA,MACtC,8CAAA,EAAgD,CAAC,IAAA,CAAK;AAAA,KACxD;AAAA,EACF;AAAA,EAEQ,iBAAA,CAAkB,OAA+B,QAAA,EAAgC;AACvF,IAAA,MAAM,SAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,aAAa,EAAE,CAAA;AAErD,IAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,IAAA,CAAK,UAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,oBAAA,IAAwB,CAAA;AAC/H,IAAA,IAAI,CAAC,KAAA,CAAM,YAAA,IAAiB,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,YAAA,CAAa,QAAA,CAAS,KAAA,CAAM,YAAY,CAAA;AACjG,MAAA,OAAO,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,qCAAA,EAAsC,EAAG,CAAA;AAErI,IAAA,MAAM,MAAA,GAAS,CAAC,UAAA,KAAmD;AACjE,MAAA,MAAM,SAAiC,EAAC;AAExC,MAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,EAAE,GAAG,UAAA,EAAY,KAAA,EAAO,KAAA,CAAM,OAAO,GAAA,EAAK,IAAA,CAAK,0BAA0B,MAAA,GAAY,IAAA,CAAK,QAAQ,CAAA;AAC3I,QAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAA,CAAO,IAAI,CAAA,GAAI,KAAA;AAE1C,MAAA,IAAI,KAAA,CAAM,kBAAkB,aAAA,EAAe;AACzC,QAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAEzD,QAAA,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,4BAA4B,CAAA;AACtE,QAAA,QAAA,CAAS,GAAA;AAAA,UACP,CAAA,wDAAA,EAA2D,OAAO,CAAA,wKAAA,EAA2K,IAAA,CAAK,SAAA,CAAU,IAAI,GAAA,CAAI,KAAA,CAAM,YAAa,CAAA,CAAE,MAAM,CAAC,CAAA,yBAAA;AAAA,SAClS;AACA,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,KAAA,CAAM,YAAa,CAAA;AAE5C,MAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG,QAAA,CAAS,YAAA,CAAa,GAAA,CAAI,IAAA,EAAM,KAAK,CAAA;AAEzF,MAAA,QAAA,CAAS,UAAU,GAAA,EAAK,EAAE,UAAU,QAAA,CAAS,QAAA,IAAY,CAAA;AACzD,MAAA,QAAA,CAAS,GAAA,EAAI;AAAA,IACf,CAAA;AAEA,IAAA,IAAI,KAAA,CAAM,aAAA,KAAkB,MAAA,EAAQ,OAAO,MAAA,CAAO,EAAE,KAAA,EAAO,2BAAA,EAA6B,iBAAA,EAAmB,yBAAA,EAA2B,CAAA;AAEtI,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,qBAAA,KAA0B,KAAA,CAAM,iBAAiB,OAAA,GAAU,MAAA,CAAA;AAEhF,IAAA,IAAI,MAAA,IAAU,MAAA,KAAW,MAAA,IAAU,MAAA,KAAW,OAAA,EAAS,OAAO,MAAA,CAAO,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,0BAAA,EAA4B,CAAA;AAEhJ,IAAA,MAAM,OAAA,GAAA,CAAW,MAAM,MAAA,IAAU,EAAA,EAAI,MAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC9D,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,SAAS,KAAA,CAAM,OAAA,KAAY,SAAY,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,GAAI,MAAA;AACrE,IAAA,MAAM,MAAA,GAAS,KAAK,OAAA,KAAY,MAAA,IAAa,WAAW,MAAA,IAAa,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,QAAA,GAAW,MAAA;AACnG,IAAA,MAAM,YAAA,GAAA,CAAgB,KAAA,CAAM,UAAA,IAAc,EAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,GAAG,EAAE,CAAA;AACrF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,KAAY,MAAA,IAAa,YAAA,KAAiB,MAAA,IAAa,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,GAAI,MAAA,CAAO,YAAY,CAAA;AAEzH,IAAA,IAAI,QAAQ,QAAA,CAAS,MAAM,CAAA,KAAM,CAAC,KAAK,OAAA,IAAW,MAAA,IAAU,MAAA,CAAA,EAAS,OAAO,OAAO,EAAE,KAAA,EAAO,gBAAA,EAAkB,iBAAA,EAAmB,wBAAwB,CAAA;AAEzJ,IAAA,IAAI,CAAC,KAAK,OAAA,IAAW,OAAA,CAAQ,SAAS,OAAO,CAAA,IAAK,UAAU,MAAA,IAAW,KAAA,CAAM,cAAc,IAAA,CAAK,KAAA,CAAM,IAAI,KAAA,CAAM,UAAU,GAAG,GAAA,KAAQ,IAAA,CAAK,QAAQ,GAAA,EAAM;AACtJ,MAAA,MAAM,YAAY,KAAA,CAAM,UAAA,IAAc,KAAK,KAAA,CAAM,GAAA,CAAI,MAAM,UAAU,CAAA,GAAI,MAAM,UAAA,GAAa,MAAA,KAAc,KAAK,QAAA,IAAY,IAAA,CAAK,MAAM,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACpJ,MAAA,MAAM,OAAO,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA,GAAI,MAAA;AAEnD,MAAA,IAAI,CAAC,MAAM,OAAO,MAAA,CAAO,EAAE,KAAA,EAAO,eAAA,EAAiB,iBAAA,EAAmB,kCAAA,EAAoC,CAAA;AAE1G,MAAA,MAAM,GAAA,GAAM,YAAA,IAAgB,IAAA,CAAK,GAAA,IAAO,GAAA;AAExC,MAAA,IAAA,CAAK,OAAA,GAAU;AAAA,QACb,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,GAAA,EAAKL,iBAAA,EAAW,CAAE,OAAA,CAAQ,MAAM,EAAE,CAAA;AAAA,QAClC,QAAA,EAAU,GAAA;AAAA,QACV,GAAA;AAAA,QACA,GAAA,EAAK,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA,IAAK,CAAA,GAAI,CAAC,KAAA,EAAO,KAAA,EAAO,KAAK,CAAA,GAAI,CAAC,KAAK,CAAA,CAAA;AAAA,QACnE,OAAA,sBAAa,GAAA;AAAI,OACnB;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA;AAExC,IAAA,MAAM,OAAOA,iBAAA,EAAW;AAExB,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,IAAA,EAAM;AAAA,MACnB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,GAAA,EAAK,KAAK,OAAA,CAAQ,GAAA;AAAA,MAClB,aAAa,KAAA,CAAM,YAAA;AAAA,MACnB,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,eAAe,KAAA,CAAM,cAAA;AAAA,MACrB,mBAAA,EAAqB,MAAA;AAAA,MACrB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,GAAA,EAAK,KAAK,OAAA,CAAQ,GAAA;AAAA,MAClB,QAAA,EAAU,KAAK,OAAA,CAAQ,QAAA;AAAA,MACvB,GAAA,EAAK,KAAK,OAAA,CAAQ,GAAA;AAAA,MAClB,GAAA,EAAK,KAAK,OAAA,CAAQ;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,EAAE,MAAM,CAAA;AAAA,EACjB;AAAA,EAEA,MAAc,kBAAA,CAAmB,KAAA,EAA+B,QAAA,EAAyC;AACvG,IAAA,IAAI,WAAW,KAAA,CAAM,SAAA;AAErB,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMM,cAAA,CAAU,KAAA,CAAM,aAAA,EAAe,IAAA,CAAK,eAAA,EAAiB,EAAE,MAAA,EAAQ,IAAA,CAAK,QAAQ,CAAA;AAEtG,QAAA,QAAA,KAAa,CAAC,QAAQ,GAAA,IAAO,EAAE,CAAA,CAAE,IAAA,GAAO,CAAC,CAAA;AAAA,MAC3C,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,iCAAA,EAAkC,EAAG,CAAA;AAAA,MACjI;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,GAAI,MAAA;AACvD,IAAA,MAAM,WAAW,KAAA,CAAM,wBAAA;AAEvB,IAAA,IAAI,QAAA,KAAa,CAAC,MAAA,IAAW,MAAA,CAAO,0BAA0B,CAAC,MAAA,CAAO,sBAAA,CAAuB,QAAA,CAAS,QAAQ,CAAA,CAAA;AAC5G,MAAA,OAAO,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,iDAAA,EAAkD,EAAG,CAAA;AAEjJ,IAAA,MAAM,QAAQ,IAAA,CAAK,OAAA;AAEnB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAEf,IAAA,IAAI,OAAO,IAAA,CAAK,mBAAA,CAAoB,EAAE,GAAA,EAAK,KAAA,CAAM,KAAK,CAAA;AAEtD,IAAA,IAAI,KAAA,EAAA;AACF,MAAA,KAAA,MAAW,EAAA,IAAM,MAAM,OAAA,EAAS,IAAI,KAAK,OAAA,CAAQ,GAAA,CAAI,EAAE,CAAA,EAAG,oBAAA,QAA4B,IAAA,CAAK,wBAAA,CAAyB,IAAI,EAAE,GAAA,EAAK,MAAM,GAAA,EAAK,GAAA,EAAK,KAAA,CAAM,GAAA,EAAK,CAAA;AAAA,IAAA;AAE5J,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,4BAA4B,CAAA;AACtE,MAAA,QAAA,CAAS,IAAI,2CAA2C,CAAA;AACxD,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,QAAQ,CAAA;AAEjC,IAAA,IAAI,MAAM,KAAA,EAAO,QAAA,CAAS,aAAa,GAAA,CAAI,OAAA,EAAS,MAAM,KAAK,CAAA;AAE/D,IAAA,QAAA,CAAS,UAAU,GAAA,EAAK,EAAE,UAAU,QAAA,CAAS,QAAA,IAAY,CAAA;AACzD,IAAA,QAAA,CAAS,GAAA,EAAI;AAAA,EACf;AAAA,EAEA,MAAc,YAAA,CAAa,QAAA,EAAqC,IAAA,EAA2E;AACzI,IAAA,MAAM,OAAA,GAAU,CAAC,WAAA,MAA0C,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,gBAAA,EAAkB,iBAAA,EAAmB,WAAA,EAAY,EAAE,CAAA;AAC5I,IAAA,MAAM,aAAA,GAAgB,SAAS,OAAA,CAAQ,aAAA;AACvC,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI,aAAA,EAAe,UAAA,CAAW,QAAQ,CAAA,EAAG;AACvC,MAAA,MAAM,CAAC,EAAA,EAAI,MAAM,IAAI,MAAA,CAAO,IAAA,CAAK,cAAc,KAAA,CAAM,CAAC,GAAG,QAAQ,CAAA,CAAE,SAAS,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,kBAAkB,CAAA;AAErH,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,EAAA,IAAM,EAAE,CAAA;AAElC,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,CAAO,YAAA,IAAgB,OAAO,YAAA,KAAiB,MAAA,EAAQ,OAAO,OAAA,CAAQ,mCAAmC,CAAA;AAAA,IAC3H,CAAA,MAAA,IAAW,KAAK,gBAAA,EAAkB;AAChC,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,aAAa,EAAE,CAAA;AAE9C,MAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,EAAW,OAAO,QAAQ,mCAAmC,CAAA;AAC1E,MAAA,IAAI,IAAA,CAAK,qBAAA,KAA0B,wDAAA,EAA0D,OAAO,QAAQ,uBAAuB,CAAA;AAEnI,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,MAAMC,cAAA,CAAU,OAAO,SAAA,EAAW,MAAA,CAAO,UAAU,GAAG,CAAA;AAClE,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMD,cAAA,CAAU,IAAA,CAAK,kBAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,CAAO,UAAU,OAAA,EAAS,MAAA,CAAO,UAAU,QAAA,EAAU,IAAA,CAAK,QAAQ,CAAA;AAE5I,QAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,OAAO,QAAQ,2BAA2B,CAAA;AAAA,MAC9D,SAAS,KAAA,EAAO;AACd,QAAA,OAAO,OAAA,CAAQ,CAAA,+BAAA,EAAmC,KAAA,CAAgB,OAAO,CAAA,CAAE,CAAA;AAAA,MAC7E;AAAA,IACF,CAAA,MAAA,IAAW,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW;AAC3C,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,aAAa,EAAE,CAAA;AAE9C,MAAA,IAAI,CAAC,UAAU,MAAA,CAAO,YAAA,KAAiB,KAAK,aAAA,EAAe,OAAO,QAAQ,mCAAmC,CAAA;AAAA,IAC/G,CAAA,MAAO;AACL,MAAA,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,aAAa,EAAE,CAAA;AAE9C,MAAA,IAAI,CAAC,UAAU,MAAA,CAAO,YAAA,IAAgB,OAAO,SAAA,EAAW,OAAO,QAAQ,+BAA+B,CAAA;AAAA,IACxG;AAEA,IAAA,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA;AAE3B,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,KAAA,CAAM,QAAA,EAAqC,IAAA,EAAwD;AAC/G,IAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,EAAe,WAAA,MAA0C,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,WAAA,EAAY,EAAE,CAAA;AAEvI,IAAA,IAAI,IAAA,CAAK,eAAe,uBAAA,EAAyB;AAC/C,MAAA,MAAM,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAA,CAAI,IAAA,CAAK,iBAAiB,EAAE,CAAA;AAElE,MAAA,IAAI,CAAC,OAAQ,IAAA,CAAK,SAAA,IAAa,IAAI,QAAA,IAAY,IAAA,CAAK,cAAc,GAAA,CAAI,QAAA;AACpE,QAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,KAAA,EAAO,gBAAA,EAAkB,iBAAA,EAAmB,yCAAA,EAA0C,EAAE;AAExH,MAAA,MAAM,QAAA,GAAW,IAAI,QAAA,IAAY,QAAA;AAEjC,MAAA,QAAA,CAAS,QAAA,GAAW,QAAA;AAEpB,MAAA,OAAO,IAAA,CAAK,YAAY,IAAA,CAAK,OAAA,CAAQ,IAAI,QAAQ,CAAA,IAAK,EAAE,QAAA,EAAS,EAAG;AAAA,QAClE,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,UAAU,IAAA,CAAK,QAAA;AAAA,QACf,MAAA,EAAQ,EAAE,GAAA,EAAK,uBAAA,EAAyB,UAAA,EAAY,uBAAA,EAAyB,aAAA,EAAe,GAAA,CAAI,GAAA,EAAK,GAAG,GAAA,CAAI,MAAA;AAAO,OACpH,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,IAAS,MAAA,CAAO,aAAA,EAAe,KAAK,GAAG,CAAA;AAE1D,IAAA,QAAQ,KAAK,UAAA;AAAY,MACvB,KAAK,oBAAA;AACH,QAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,EAAQ,EAAE,KAAK,MAAA,CAAO,QAAA,EAAU,KAAA,EAAO,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA;AAAA,MACjH,KAAK,UAAA,EAAY;AACf,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,YAAY,EAAE,CAAA;AAE/C,QAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,QAAA,KAAa,KAAK,QAAA,EAAU,OAAO,KAAA,CAAM,eAAA,EAAiB,6BAA6B,CAAA;AAEzG,QAAA,OAAO,IAAA,CAAK,YAAY,MAAA,EAAQ,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,OAAO,MAAA,EAAQ,EAAE,GAAG,MAAA,CAAO,MAAA,EAAQ,GAAG,IAAA,CAAK,MAAA,EAAQ,oBAAoB,IAAA,CAAK,QAAA,EAAS,EAAE,EAAG,IAAI,CAAA;AAAA,MACjJ;AAAA,MACA,KAAK,oBAAA,EAAsB;AACzB,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,QAAQ,EAAE,CAAA;AAE3C,QAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAAY,IAAA,CAAK,WAAA,KAAgB,IAAA,CAAK,YAAA,EAAc,OAAO,KAAA,CAAM,iBAAiB,wBAAwB,CAAA;AAChJ,QAAA,IAAI,IAAA,CAAK,gBAAgB,IAAA,CAAK,YAAA,KAAiB,KAAK,aAAA,EAAe,OAAO,KAAA,CAAM,eAAA,EAAiB,2BAA2B,CAAA;AAC5H,QAAA,IAAI,IAAA,CAAK,aAAA,IAAiB,CAAC,iBAAA,CAAkB,IAAA,CAAK,eAAe,IAAA,CAAK,aAAA,EAAe,IAAA,CAAK,mBAAA,IAAuB,OAAO,CAAA;AACtH,UAAA,OAAO,KAAA,CAAM,iBAAiB,2BAA2B,CAAA;AAE3D,QAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,IAAK,CAAA;AAE5B,QAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAA,CAAK,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,GAAA,KAAQ,KAAK,GAAG,CAAA;AACpF,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,GAChB,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,SAAA,EAAW,IAAA,CAAK,UAAU,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAI,GACxE,EAAE,SAAA,EAAW,KAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,EAAG,GAAA,EAAK,IAAA,CAAK,GAAA,IAAO,KAAK,GAAA,EAAK,IAAA,CAAK,GAAA,IAAO,CAAC,KAAK,CAAA,EAAE;AAE/F,QAAA,OAAO,IAAA,CAAK,WAAA;AAAA,UACV,MAAA;AAAA,UACA;AAAA,YACE,KAAK,IAAA,CAAK,GAAA;AAAA,YACV,OAAO,IAAA,CAAK,KAAA;AAAA,YACZ,QAAA,EAAU,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,QAAA;AAAA,YAChC,MAAA,EAAQ,EAAE,GAAG,MAAA,CAAO,MAAA,EAAQ,GAAG,IAAA,CAAK,MAAA,EAAQ,GAAG,MAAA,EAAQ,kBAAA,EAAoB,IAAA,CAAK,QAAA;AAAS,WAC3F;AAAA,UACA,IAAA;AAAA,UACA,MAAA;AAAA,UACA,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,MAAA;AAAO,SAC9B;AAAA,MACF;AAAA,MACA,KAAK,eAAA,EAAiB;AACpB,QAAA,MAAM,UAAU,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,IAAA,CAAK,iBAAiB,EAAE,CAAA;AAE/D,QAAA,IAAI,CAAC,WAAW,OAAA,CAAQ,QAAA,KAAa,OAAO,QAAA,EAAU,OAAO,KAAA,CAAM,eAAA,EAAiB,iCAAiC,CAAA;AAErH,QAAA,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,IAAA,CAAK,aAAc,CAAA;AAE7C,QAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAA,CAAK,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,GAAA,KAAQ,QAAQ,GAAG,CAAA;AAEvF,QAAA,OAAO,IAAA,CAAK,WAAA;AAAA,UACV,MAAA;AAAA,UACA,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,EAAE,GAAG,MAAA,CAAO,MAAA,EAAQ,GAAG,IAAA,EAAM,MAAA,EAAQ,GAAI,OAAA,CAAQ,GAAA,GAAM,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC,EAAG,EAAE;AAAA,UACpJ;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,iDAAA,EAAmD;AACtD,QAAA,MAAM,UAAU,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,iBAAiB,EAAE,CAAA;AAExD,QAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,SAAS,OAAO,KAAA,CAAM,iBAAiB,iCAAiC,CAAA;AAEhG,QAAA,IAAI,IAAA,CAAK,yBAAyB,4DAAA,EAA8D;AAC9F,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,mBAAA,GAAsB,IAAI,CAAA,IAAK;AAAA,YACjD,YAAA,EAAc,CAAA,eAAA,EAAkB,IAAA,CAAK,mBAAmB,CAAA,CAAA;AAAA,YACxD,mBAAmB,IAAA,CAAK,oBAAA;AAAA,YACxB,UAAA,EAAY,QAAA;AAAA,YACZ,UAAA,EAAY,IAAA;AAAA,YACZ,UAAU,IAAA,CAAK;AAAA,WACjB;AAEA,UAAA,OAAO,QAAA,IAAY,MAAA,IAAU,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,GAAY,MAAA,GAA6B,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,MAAA,EAAkC;AAAA,QACxJ;AAEA,QAAA,MAAM,EAAE,GAAA,EAAK,OAAA,EAAS,KAAK,SAAA,EAAW,GAAA,EAAK,SAAS,GAAA,EAAK,SAAA,EAAW,GAAA,EAAK,UAAA,EAAY,KAAK,IAAA,EAAM,KAAA,EAAO,QAAQ,GAAG,MAAA,KAAW,OAAA,CAAQ,MAAA;AAErI,QAAA,OAAO,IAAA,CAAK,YAAY,MAAA,EAAQ;AAAA,UAC9B,GAAA,EAAK,QAAQ,MAAA,CAAO,GAAA;AAAA,UACpB,KAAA,EAAO,IAAA,CAAK,KAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,UACrC,UAAU,IAAA,CAAK,QAAA;AAAA,UACf,MAAA,EAAQ,EAAE,GAAG,MAAA,EAAQ,KAAK,EAAE,SAAA,EAAW,MAAA,CAAO,QAAA,EAAS;AAAE,SAC3D,EAAG,MAAA,EAAW,IAAA,CAAK,oBAAoB,CAAA;AAAA,MACzC;AAAA,MACA,KAAK,8CAAA,EAAgD;AACnD,QAAA,MAAM,QAAQ,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,IAAA,CAAK,eAAe,EAAE,CAAA;AAEzD,QAAA,IAAI,KAAA,KAAU,MAAA,EAAW,OAAO,KAAA,CAAM,iBAAiB,sBAAsB,CAAA;AAE7E,QAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,IAAA,CAAK,WAAA,EAAc,QAAQ,CAAC,CAAA;AAEjD,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,cAAA,CAAe,MAAA,GAAS,CAAC,CAAC,CAAA,IAAK,UAAA;AAExF,QAAA,QAAQ,OAAA;AAAS,UACf,KAAK,SAAA;AACH,YAAA,OAAO,KAAA,CAAM,yBAAyB,gCAAgC,CAAA;AAAA,UACxE,KAAK,WAAA;AACH,YAAA,OAAO,KAAA,CAAM,aAAa,kBAAkB,CAAA;AAAA,UAC9C,KAAK,QAAA;AACH,YAAA,OAAO,KAAA,CAAM,iBAAiB,8BAA8B,CAAA;AAAA,UAC9D,KAAK,SAAA;AACH,YAAA,OAAO,KAAA,CAAM,iBAAiB,0BAA0B,CAAA;AAAA,UAC1D;AACE,YAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,EAAQ,EAAE,GAAA,EAAK,eAAe,KAAA,EAAO,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,CAAA;AAAA;AACxF,MACF;AAAA,MACA;AACE,QAAA,OAAO,KAAA,CAAM,wBAAA,EAA0B,CAAA,UAAA,EAAa,IAAA,CAAK,UAAU,CAAA,kBAAA,CAAoB,CAAA;AAAA;AAC3F,EACF;AAAA,EAEA,MAAc,WAAA,CACZ,MAAA,EACA,OAAA,EACA,IAAA,EACA,iBACA,OAAA,EAC0B;AAC1B,IAAA,MAAM,aAAa,MAAA,CAAO,UAAA;AAC1B,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,gBAAA,CAAiB;AAAA,MAC9C,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,MAAA,CAAO,QAAA;AAAA,MACrC,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,GAAI,UAAA,EAAY,YAAA,GAAe,EAAE,SAAA,EAAW,UAAA,KAAe;AAAC,KAC7D,CAAA;AACD,IAAA,MAAM,IAAA,GAAgC;AAAA,MACpC,YAAA,EAAc,WAAA;AAAA,MACd,UAAA,EAAY,QAAA;AAAA,MACZ,YAAY,IAAA,CAAK,QAAA;AAAA,MACjB,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,MAChD,GAAI,eAAA,GAAkB,EAAE,iBAAA,EAAmB,eAAA,KAAoB;AAAC,KAClE;AAEA,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,MAAM,eAAeN,iBAAA,EAAW;AAChC,MAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,MAAA,EAAQ,QAAQ,QAAA,GAAW,OAAA,CAAQ,OAAO,GAAA,GAAM,MAAA;AAE3E,MAAA,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,YAAA,EAAc,EAAE,QAAA,EAAU,OAAO,QAAA,EAAU,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,OAAO,GAAA,EAAK,SAAA,EAAW,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,IAAA,EAAM,CAAA;AACvK,MAAA,IAAA,CAAK,aAAA,GAAgB,YAAA;AAAA,IACvB;AAEA,IAAA,IAAI,IAAA,IAAQ,OAAA,IAAA,CAAY,OAAA,CAAQ,KAAA,IAAS,EAAA,EAAI,MAAM,GAAG,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC1E,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,MAAA,MAAM,SAAS,MAAA,CAAO,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,QAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,CAAC,GAAG,KAAK,CAAA,KAAM,KAAA,KAAU,MAAS,CAAC,CAAA;AAC3G,MAAA,MAAM,MAAA,GAAS,MAAM,IAAIC,YAAA,CAAQ;AAAA,QAC/B,GAAA,EAAK,IAAA;AAAA,QACL,KAAK,MAAA,CAAO,QAAA;AAAA,QACZ,GAAG,MAAA;AAAA,QACH,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,QAChD,OAAA,EAAS,SAAS,WAAW,CAAA;AAAA,QAC7B,oBAAoB,IAAA,CAAK,QAAA;AAAA,QACzB,GAAG,IAAA,CAAK;AAAA,OACT,CAAA,CACE,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,KAAA,EAAO,CAAA,CAChE,SAAA,CAAU,KAAK,MAAM,CAAA,CACrB,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAC3B,UAAA,CAAW,IAAA,CAAK,GAAG,EACnB,WAAA,CAAY,GAAG,CAAA,CACf,iBAAA,CAAkB,MAAM,IAAA,CAAK,QAAQ,CAAA,CACrC,IAAA,CAAK,KAAK,UAAU,CAAA;AAEvB,MAAA,IAAA,CAAK,QAAA,GAAW,cAAc,UAAA,CAAW,QAAA,KAAa,QAAQ,MAAM,SAAA,CAAU,MAAA,EAAQ,UAAU,CAAA,GAAI,MAAA;AAAA,IACtG;AAEA,IAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAK;AAAA,EAC7B;AAAA,EAEA,MAAc,UAAA,CAAW,QAAA,EAAqC,IAAA,EAAwD;AACpH,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,SAAS,EAAE,CAAA;AAC/C,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,UAAU,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,IAAA,CAAK,SAAS,EAAE,CAAA;AAEvD,IAAA,IAAI,OAAA;AACF,MAAA,OAAO,OAAA,CAAQ,QAAA,KAAa,MAAA,CAAO,QAAA,GAC/B;AAAA,QACE,MAAA,EAAQ,GAAA;AAAA,QACR,IAAA,EAAM;AAAA,UACJ,MAAA,EAAQ,IAAA;AAAA,UACR,UAAA,EAAY,SAAA;AAAA,UACZ,WAAW,OAAA,CAAQ,QAAA;AAAA,UACnB,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,KAAK,OAAA,CAAQ,SAAA;AAAA,UACb,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,UAChD,GAAI,QAAQ,GAAA,GAAM,EAAE,KAAK,OAAA,CAAQ,GAAA,KAAQ;AAAC;AAC5C,OACF,GACA,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAM,EAAE,MAAA,EAAQ,OAAM,EAAE;AAE7C,IAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,OAAA,IAAA,CAAY,MAAA,CAAO,OAAO,GAAA,IAAO,CAAA,KAAM,GAAA,EAAK,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAM,EAAE,MAAA,EAAQ,OAAM,EAAE;AAEhH,IAAA,MAAM,SAAA,GAAY,CAAC,MAAA,CAAO,MAAA,CAAO,OAAO,EAAE,EAAE,IAAA,EAAK;AACjD,IAAA,MAAM,OAAA,GACJ,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,QAAA,IAAY,SAAA,CAAU,QAAA,CAAS,MAAA,CAAO,QAAQ,CAAA,GACrE,IAAA,GACA,SAAA,CAAU,IAAA,CAAK,CAAC,QAAA,KAAa,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,EAAG,oBAAA,EAAsB,QAAA,CAAS,MAAA,CAAO,QAAQ,CAAA,IAAK,QAAA,KAAa,MAAA,CAAO,QAAQ,CAAA;AAE9I,IAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,MAAA,EAAQ,KAAK,IAAA,EAAM,EAAE,MAAA,EAAQ,KAAA,EAAM,EAAE;AAE5D,IAAA,MAAM,EAAE,GAAA,EAAK,GAAG,MAAA,KAAW,MAAA,CAAO,MAAA;AAElC,IAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,MAAA,EAAQ,IAAA,EAAM,UAAA,EAAY,GAAA,IAAO,UAAU,QAAA,EAAU,MAAA,CAAO,kBAAA,EAAoB,GAAG,QAAO,EAAE;AAAA,EAC5H;AAAA,EAEA,MAAc,MAAA,CAAO,QAAA,EAAqC,IAAA,EAAwD;AAChH,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA;AACjC,IAAA,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA;AAE1C,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAI;AAAA,EACvB;AAAA,EAEA,MAAc,MAAA,CAAO,QAAA,EAAqC,IAAA,EAAwD;AAChH,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAU,IAAI,CAAA;AAErD,IAAA,IAAI,QAAA,IAAY,QAAQ,OAAO,MAAA;AAE/B,IAAA,MAAM,aAAaD,iBAAA,EAAW;AAE9B,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,UAAA,EAAY,CAAC,CAAA;AAElC,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACJ,WAAA,EAAa,UAAA;AAAA,QACb,SAAA,EAAW,WAAA;AAAA,QACX,gBAAA,EAAkB,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,OAAA,CAAA;AAAA,QAChC,yBAAA,EAA2B,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,2BAAA,CAAA;AAAA,QACzC,UAAA,EAAY,GAAA;AAAA,QACZ,QAAA,EAAU;AAAA;AACZ,KACF;AAAA,EACF;AAAA,EAEA,MAAc,QAAA,CAAS,OAAA,EAAiC,QAAA,EAAyC;AAC/F,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,aAAA,EAAe,OAAA,CAAQ,eAAe,EAAE,CAAA;AAC9D,IAAA,MAAM,SAAS,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAEhD,IAAA,IAAI,CAAC,UAAU,MAAA,CAAO,OAAA;AACpB,MAAA,OAAO,KAAK,QAAA,EAAU;AAAA,QACpB,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,kBAAA,EAAoB,kFAAA;AAAmF,OACnH,CAAA;AAEH,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAA,CAAK,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,GAAA,KAAQ,MAAA,CAAO,OAAO,GAAG,CAAA;AAC7F,IAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,MAAA,CAAO,OAAO,GAAA,EAAK,GAAG,MAAM,QAAA,EAAS;AAE3D,IAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,OAAO,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,MAAA,EAAQ,CAAA;AAE5E,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAIC,YAAA,CAAQ,MAAM,CAAA,CACpC,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,CAAA,CACpD,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA,CACrB,WAAA,CAAY,MAAA,CAAO,QAAQ,EAC3B,WAAA,CAAY,GAAG,CAAA,CACf,iBAAA,CAAkB,MAAM,IAAA,CAAK,QAAQ,CAAA,CACrC,IAAA,CAAK,KAAK,UAAU,CAAA;AACvB,IAAA,MAAM,aAAa,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG,UAAA;AACtD,IAAA,MAAM,GAAA,GAAM,cAAc,UAAA,CAAW,QAAA,KAAa,QAAQ,MAAM,SAAA,CAAU,MAAA,EAAQ,UAAU,CAAA,GAAI,MAAA;AAEhG,IAAA,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,mBAAmB,CAAA;AAC7D,IAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAAA,EAClB;AAAA,EAEQ,YAAY,QAAA,EAAkC;AACpD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AAEpC,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAQ,CAAA,CAAA,CAAG,CAAA;AAE9D,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,IAAA,EAAoC;AACtD,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,OAAA;AACpC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,YAAA;AACzC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,EAAG,OAAO,QAAA;AACrC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,EAAG,OAAO,UAAA;AACvC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,cAAc,CAAA,EAAG,OAAO,QAAA;AAC1C,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,uBAAuB,CAAA,EAAG,OAAO,WAAA;AACnD,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,WAAA;AACnC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,EAAG,OAAO,QAAA;AACrC,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,SAAA,CAAU,QAAgB,UAAA,EAA0F;AACjI,EAAA,MAAM,SAAA,GAAY,WAAW,SAAA,IAAa,cAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,MAAMM,cAAA,CAAU,EAAE,GAAG,UAAA,CAAW,GAAA,EAAK,GAAA,EAAK,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO,OAAA,EAAS,MAAA,IAAa,SAAS,CAAA;AAE5G,EAAA,OAAO,IAAIC,mBAAA,CAAe,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAC,CAAA,CACvD,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAA,EAAW,GAAA,EAAK,UAAA,CAAW,oBAAoB,eAAA,EAAiB,GAAA,EAAK,KAAA,EAAO,GAAA,EAAK,OAAO,GAAI,UAAA,CAAW,GAAA,CAAI,GAAA,GAAM,EAAE,GAAA,EAAK,UAAA,CAAW,GAAA,CAAI,GAAA,KAAQ,EAAC,EAAI,CAAA,CAC9K,QAAQ,GAAG,CAAA;AAChB;AAEA,SAAS,iBAAA,CAAkB,QAAA,EAA8B,SAAA,EAAmB,MAAA,EAAyB;AACnG,EAAA,IAAI,CAAC,UAAU,OAAO,KAAA;AAEtB,EAAA,OAAO,MAAA,KAAW,MAAA,GAASC,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,QAAA,EAAU,OAAO,CAAA,CAAE,MAAA,CAAO,WAAW,CAAA,KAAM,YAAY,QAAA,KAAa,SAAA;AAC7H;AAEA,SAAS,SAAS,KAAA,EAAuB;AACvC,EAAA,OAAOA,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AAClG;AAEA,SAAS,IAAA,CAAK,UAA0B,MAAA,EAA+B;AACrE,EAAA,MAAM,OAAA,GAAkC,EAAE,GAAG,MAAA,CAAO,OAAA,EAAQ;AAE5D,EAAA,IAAI,MAAA,CAAO,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,KAAM,kBAAA;AAE3D,EAAA,QAAA,CAAS,SAAA,CAAU,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,QAAA,CAAS,GAAA,CAAI,OAAO,IAAA,KAAS,MAAA,GAAY,SAAY,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAI,CAAC,CAAA;AAClF;AAEA,SAAS,SAAS,OAAA,EAA2C;AAC3D,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAE1B,IAAA,OAAA,CAAQ,GAAG,MAAA,EAAQ,CAAC,UAAkB,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AACxD,IAAA,OAAA,CAAQ,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAC,CAAA;AACvE,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;;;ACvkCO,IAAM,cAAN,MAAyC;AAAA;AAAA,EAErC,SAAmB,EAAC;AAAA,EACrB,IAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,KAAA,GAAgB,IAAA,CAAK,GAAA,EAAI,EAAG;AACtC,IAAA,IAAA,CAAK,IAAA,GAAO,KAAA;AAAA,EACd;AAAA,EAEA,GAAA,GAAc;AACZ,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA,EAEA,KAAA,CAAM,IAAY,MAAA,EAAqC;AACrD,IAAA,IAAI,QAAQ,OAAA,EAAS,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,MAAM,CAAA;AAExD,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,EAAE,CAAA;AACnB,IAAA,IAAA,CAAK,IAAA,IAAQ,EAAA;AAEb,IAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA,EAGA,QAAQ,EAAA,EAAkB;AACxB,IAAA,IAAA,CAAK,IAAA,IAAQ,EAAA;AAAA,EACf;AAAA;AAAA,EAGA,IAAI,EAAA,EAAkB;AACpB,IAAA,IAAA,CAAK,IAAA,GAAO,EAAA;AAAA,EACd;AACF;ACpBA,eAAsB,sBACpB,IAAA,EACA,IAAA,EACA,MAAA,EACA,OAAA,GAAiH,EAAC,EACpF;AAC9B,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI;AAChD,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,EAAA,IAAMT,iBAAAA,EAAW;AACpC,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,EAAA;AAAA,IACA,IAAA;AAAA,IACA,UAAA,EAAY,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,GAAI,CAAA;AAAA,IACvC,GAAI,QAAQ,OAAA,GAAU,EAAE,UAAU,OAAA,CAAQ,OAAA,KAAY,EAAC;AAAA,IACvD,GAAI,QAAQ,QAAA,GAAW,EAAE,WAAW,OAAA,CAAQ,QAAA,KAAa,EAAC;AAAA,IAC1D;AAAA,GACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACjC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,CAACU,4BAAqB,SAAS,GAAG,MAAMC,oCAAA,CAA8B,IAAA,EAAM,QAAQ,SAAS,CAAA;AAAA,IAC7F,CAACD,2BAAA,CAAqB,KAAK,GAAG;AAAA,GAChC;AAEA,EAAA,IAAI,QAAQ,iBAAA,IAAqB,IAAA,EAAM,OAAA,CAAQA,2BAAA,CAAqB,OAAO,CAAA,GAAI,EAAA;AAE/E,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAM;AAChC","file":"index.cjs","sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport {\n CompactEncrypt,\n decodeJwt,\n exportJWK,\n generateKeyPair,\n importJWK,\n jwtVerify,\n SignJWT,\n type CryptoKey,\n type JWK,\n type JWTPayload,\n} from \"jose\";\n\n/**\n * How the fake encrypts what it issues to a client, as Authio does once the client registered an encryption key.\n */\nexport interface FakeAuthioClientEncryption {\n /** The client's public encryption key (RSA). */\n key: JWK;\n /** Defaults to `RSA-OAEP-256`. */\n algorithm?: \"RSA-OAEP\" | \"RSA-OAEP-256\";\n /** Defaults to `A256CBC-HS512`. */\n encryptionMethod?: \"A128CBC-HS256\" | \"A192CBC-HS384\" | \"A256CBC-HS512\";\n /** Encrypts the client's access tokens (nested JWT). */\n accessTokens?: boolean;\n /** Encrypts the client's ID tokens. Defaults to `true`. */\n idTokens?: boolean;\n /** Encrypts UserInfo answered as a JWT. Defaults to `true`. */\n userInfo?: boolean;\n /** Encrypts back-channel logout tokens. */\n logoutTokens?: boolean;\n}\n\n/**\n * A client registered in the fake.\n */\nexport interface FakeAuthioClient {\n clientId: string;\n /** For `client_secret_basic` and `client_secret_post`. */\n clientSecret?: string;\n /** The public JWK `private_key_jwt` assertions are verified with. */\n publicKey?: JWK;\n /** Scopes granted when a request names none. */\n defaultScopes?: string[];\n /** Extra claims put into every access token issued to the client. */\n claims?: Record<string, unknown>;\n /** The client this one's tokens are introspectable by, besides itself (a resource server's introspection client). */\n introspectionClients?: string[];\n /** The redirect URIs the authorization endpoint accepts. Any when absent. */\n redirectUris?: string[];\n /** The post-logout redirect URIs the end-session endpoint accepts. Any when absent. */\n postLogoutRedirectUris?: string[];\n /** Where back-channel logout tokens are posted when a session of the client ends. */\n backchannelLogoutUri?: string;\n /** Encrypts what is issued to the client. */\n encryption?: FakeAuthioClientEncryption;\n}\n\n/**\n * A person the fake knows, for the password grant, authorization codes and UserInfo.\n */\nexport interface FakeAuthioUser {\n sub: string;\n username: string;\n password?: string;\n /** Claims put into the person's access tokens: `*_resource_access`, `org_id`, mapper claims… */\n claims?: Record<string, unknown>;\n /** What UserInfo answers besides `sub`. */\n userInfo?: Record<string, unknown>;\n /** The sign-in's methods. Defaults to `[\"pwd\"]`. */\n amr?: string[];\n /** The sign-in's level. Defaults to `1`, or the `acr_values` asked for. */\n acr?: string;\n}\n\n/**\n * A personal access token the fake accepts with the `personal_access_token` grant.\n */\nexport interface FakeAuthioPersonalAccessToken {\n /** The `pat_…` value. */\n token: string;\n /** The credential's id, the token's `sub`. */\n sub: string;\n /** The consumer's client, for a consumer's token; the `authio` client of an account otherwise. */\n clientId?: string;\n /** Claims added to the access token. */\n claims?: Record<string, unknown>;\n}\n\n/**\n * An error the fake answers a request with.\n */\nexport interface FakeAuthioError {\n status: number;\n body?: Record<string, unknown>;\n headers?: Record<string, string>;\n}\n\n/**\n * A request the fake received.\n */\nexport interface FakeAuthioRecordedRequest {\n method: string;\n path: string;\n headers: Record<string, string>;\n form: Record<string, string>;\n /** The query parameters. */\n query: Record<string, string>;\n /** The client the request authenticated as, when it did. */\n clientId?: string;\n}\n\n/**\n * A back-channel logout token the fake posted to a client.\n */\nexport interface FakeAuthioBackchannelDelivery {\n clientId: string;\n uri: string;\n logoutToken: string;\n /** The HTTP status the client answered, or 0 when it could not be reached. */\n status: number;\n}\n\n/**\n * The parameters an authorization ended with, as the fake sent them back.\n */\nexport interface FakeAuthioAuthorizationOutcome {\n /** `code`, `state` and `iss`, or `error`, `error_description`, `state` and `iss`. */\n parameters: Record<string, string>;\n /** The redirect URI with the parameters, for `response_mode=query`. */\n callbackUrl: string | undefined;\n}\n\n/**\n * What the device flow answers to successive polls.\n */\nexport type FakeAuthioDeviceOutcome = \"pending\" | \"slow_down\" | \"approved\" | \"denied\" | \"expired\";\n\n/**\n * Options of the fake.\n */\nexport interface FakeAuthioOptions {\n /** The realm. Defaults to `fake`. */\n realm?: string;\n /** Seconds tokens live. Defaults to 300. */\n accessTokenLifetime?: number;\n clients?: FakeAuthioClient[];\n users?: FakeAuthioUser[];\n personalAccessTokens?: FakeAuthioPersonalAccessToken[];\n}\n\n/**\n * Options of a token minted directly.\n */\nexport interface FakeAuthioTokenOptions {\n sub?: string;\n /** One or several audiences. Defaults to the client id. */\n audience?: string | string[];\n clientId?: string;\n scope?: string;\n /** Seconds. Negative values mint an expired token. */\n expiresIn?: number;\n /** The `typ` claim. Defaults to `Bearer`. */\n type?: string;\n /** Claims added to the payload. */\n claims?: Record<string, unknown>;\n /** Signs with another issuer. */\n issuer?: string;\n /** Signs with another key, so the signature does not verify. */\n untrusted?: boolean;\n /** Encrypts the token (nested JWT) to this public key, as Authio does for a client with an encryption key. */\n encryptTo?: { key: JWK; algorithm?: \"RSA-OAEP\" | \"RSA-OAEP-256\"; encryptionMethod?: string };\n}\n\ninterface IssuedToken {\n claims: JWTPayload;\n clientId: string;\n revoked: boolean;\n}\n\ninterface PendingCode {\n clientId: string;\n sub: string;\n redirectUri: string;\n scope?: string;\n codeVerifier?: string;\n codeChallenge?: string;\n codeChallengeMethod?: string;\n resource?: string;\n nonce?: string;\n sid?: string;\n authTime?: number;\n acr?: string;\n amr?: string[];\n}\n\ninterface FakeSession {\n sub: string;\n sid: string;\n authTime: number;\n acr: string;\n amr: string[];\n clients: Set<string>;\n}\n\ntype Endpoint = \"token\" | \"introspect\" | \"revoke\" | \"userinfo\" | \"device\" | \"discovery\" | \"authorize\" | \"logout\";\n\n/**\n * An in-memory Authio realm served over HTTP on loopback: discovery, JWKS, authorization (PKCE, `state`, `nonce`,\n * `prompt`, `max_age`, `acr_values`, `response_mode=web_message`, RFC 9207 `iss`), token (client credentials,\n * authorization code with ID tokens, refresh, token exchange, password, device code, personal access token),\n * introspection, revocation, UserInfo, device authorization, end session and back-channel logout delivery, with JWE\n * (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.\n */\nexport class FakeAuthio {\n /** Every request received, in order. */\n readonly requests: FakeAuthioRecordedRequest[] = [];\n /** Answers the next requests to an endpoint with these errors, in order, before answering normally. */\n readonly failures = new Map<Endpoint, FakeAuthioError[]>();\n /** Every back-channel logout token posted, in order. */\n readonly backchannelDeliveries: FakeAuthioBackchannelDelivery[] = [];\n /** What successive device-code polls answer; the last value repeats. Defaults to `[\"approved\"]`. */\n deviceOutcomes: FakeAuthioDeviceOutcome[] = [\"approved\"];\n /** Overrides the discovery document's issuer, to test the mismatch check. */\n discoveryIssuer: string | undefined;\n /** Answers UserInfo as `application/jwt`, signed by the realm key (and encrypted for a client with a key). */\n userInfoAsJwt = false;\n /** Leaves `iss` out of authorization responses, to test the RFC 9207 check. */\n omitAuthorizationIssuer = false;\n /** Answers connected-account exchanges. Defaults to granting a token for the provider. */\n connectionResponder: ((form: Record<string, string>) => FakeAuthioError | Record<string, unknown>) | undefined;\n /** The person the authorization endpoint signs in when the request names none with `login_hint`. Defaults to the first user. */\n signInAs: string | undefined;\n\n private readonly clients = new Map<string, FakeAuthioClient>();\n private readonly users = new Map<string, FakeAuthioUser>();\n private readonly personalAccessTokens = new Map<string, FakeAuthioPersonalAccessToken>();\n private readonly codes = new Map<string, PendingCode>();\n private readonly refreshTokens = new Map<string, { clientId: string; sub: string; scope?: string; sid?: string; expiresAt: number }>();\n private readonly issued = new Map<string, IssuedToken>();\n private readonly devicePolls = new Map<string, number>();\n private readonly lifetime: number;\n private session: FakeSession | undefined;\n private server!: Server;\n private signingKey!: CryptoKey;\n private verificationKey!: CryptoKey;\n private untrustedKey!: CryptoKey;\n private publicJwk!: JWK;\n private baseUrl!: string;\n readonly realm: string;\n readonly keyId = \"fake-key-1\";\n\n private constructor(options: FakeAuthioOptions) {\n this.realm = options.realm ?? \"fake\";\n this.lifetime = options.accessTokenLifetime ?? 300;\n\n for (const client of options.clients ?? []) this.clients.set(client.clientId, client);\n for (const user of options.users ?? []) this.users.set(user.username, user);\n for (const pat of options.personalAccessTokens ?? []) this.personalAccessTokens.set(pat.token, pat);\n }\n\n /**\n * Starts the fake on a random loopback port.\n */\n static async start(options: FakeAuthioOptions = {}): Promise<FakeAuthio> {\n const fake = new FakeAuthio(options);\n\n await fake.listen();\n\n return fake;\n }\n\n /** `http://127.0.0.1:{port}`. */\n get authority(): string {\n return this.baseUrl;\n }\n\n /** `{authority}/realms/{realm}`. */\n get issuer(): string {\n return `${this.baseUrl}/realms/${this.realm}`;\n }\n\n /** The realm's public signing key. */\n get jwks(): { keys: JWK[] } {\n return { keys: [this.publicJwk] };\n }\n\n /** The session the authorization endpoint keeps (one browser), or `undefined` when nobody is signed in. */\n get currentSession(): { sub: string; sid: string; authTime: number } | undefined {\n return this.session ? { sub: this.session.sub, sid: this.session.sid, authTime: this.session.authTime } : undefined;\n }\n\n /** Registers a client. */\n addClient(client: FakeAuthioClient): void {\n this.clients.set(client.clientId, client);\n }\n\n /** Registers a person. */\n addUser(user: FakeAuthioUser): void {\n this.users.set(user.username, user);\n }\n\n /** Registers a personal access token. */\n addPersonalAccessToken(token: FakeAuthioPersonalAccessToken): void {\n this.personalAccessTokens.set(token.token, token);\n }\n\n /** Ends the signed-in session without notifying anyone, as if it expired. */\n endSession(): void {\n this.session = undefined;\n }\n\n /**\n * Registers an authorization code for a person, as the authorization endpoint would after sign-in.\n */\n createAuthorizationCode(options: { clientId: string; username: string; redirectUri: string; scope?: string; codeChallengeVerifier?: string; resource?: string; nonce?: string }): string {\n const user = this.requireUser(options.username);\n const code = randomUUID();\n\n this.codes.set(code, {\n clientId: options.clientId,\n sub: user.sub,\n redirectUri: options.redirectUri,\n scope: options.scope,\n codeVerifier: options.codeChallengeVerifier,\n resource: options.resource,\n nonce: options.nonce,\n });\n\n return code;\n }\n\n /**\n * Follows an authorization URL as a browser would, signing in `signInAs` (or the `login_hint`), and returns what\n * Authio sent back: the callback URL for `response_mode=query`, the posted message's parameters for `web_message`.\n */\n async authorize(authorizationUrl: string): Promise<FakeAuthioAuthorizationOutcome> {\n const response = await fetch(authorizationUrl, { redirect: \"manual\" });\n const location = response.headers.get(\"location\");\n\n if (location) {\n const callback = new URL(location);\n\n return { parameters: Object.fromEntries(callback.searchParams), callbackUrl: location };\n }\n\n const html = await response.text();\n const message = /data-authorization-response='([^']*)'/.exec(html)?.[1];\n\n if (!message) throw new Error(`The fake answered the authorization with HTTP ${response.status} and no response.`);\n\n return { parameters: JSON.parse(decodeURIComponent(message)) as Record<string, string>, callbackUrl: undefined };\n }\n\n /**\n * Mints an access token signed by the realm key, recorded so introspection and revocation know it.\n */\n async issueAccessToken(options: FakeAuthioTokenOptions = {}): Promise<string> {\n const now = Math.floor(Date.now() / 1000);\n const clientId = options.clientId ?? \"fake-client\";\n const jti = randomUUID();\n const payload: JWTPayload = {\n typ: options.type ?? \"Bearer\",\n azp: clientId,\n client_id: clientId,\n ...(options.scope ? { scope: options.scope } : {}),\n ...(options.sub ? { sub: options.sub } : {}),\n ...options.claims,\n };\n const signed = await new SignJWT(payload)\n .setProtectedHeader({ alg: \"RS256\", kid: this.keyId, typ: \"JWT\" })\n .setIssuer(options.issuer ?? this.issuer)\n .setAudience(options.audience ?? clientId)\n .setIssuedAt(now)\n .setNotBefore(now)\n .setExpirationTime(now + (options.expiresIn ?? this.lifetime))\n .setJti(jti)\n .sign(options.untrusted ? this.untrustedKey : this.signingKey);\n const token = options.encryptTo ? await encryptTo(signed, options.encryptTo) : signed;\n\n this.issued.set(token, { claims: decodeJwt(signed), clientId, revoked: false });\n\n return token;\n }\n\n /**\n * Mints a back-channel logout token for a client, signed by the realm key. `overrides` replaces claims (`undefined`\n * removes one) and `type` the header `typ`, to build invalid ones in tests.\n */\n async createLogoutToken(options: { clientId: string; sub?: string; sid?: string; type?: string; overrides?: Record<string, unknown> }): Promise<string> {\n const now = Math.floor(Date.now() / 1000);\n const payload: Record<string, unknown> = {\n iss: this.issuer,\n aud: options.clientId,\n iat: now,\n exp: now + 120,\n jti: randomUUID(),\n ...(options.sub ? { sub: options.sub } : {}),\n ...(options.sid ? { sid: options.sid } : {}),\n events: { \"http://schemas.openid.net/event/backchannel-logout\": {} },\n ...options.overrides,\n };\n\n for (const key of Object.keys(payload)) if (payload[key] === undefined) delete payload[key];\n\n const signed = await new SignJWT(payload as JWTPayload).setProtectedHeader({ alg: \"RS256\", kid: this.keyId, typ: options.type ?? \"logout+jwt\" }).sign(this.signingKey);\n const encryption = this.clients.get(options.clientId)?.encryption;\n\n return encryption?.logoutTokens ? encryptTo(signed, encryption) : signed;\n }\n\n /**\n * Posts a back-channel logout token to the client's `backchannelLogoutUri`, as Authio does when a session ends.\n *\n * @returns The HTTP status the client answered, or 0 when it could not be reached.\n */\n async deliverBackchannelLogout(clientId: string, options: { sub?: string; sid?: string } = {}): Promise<number> {\n const client = this.clients.get(clientId);\n\n if (!client?.backchannelLogoutUri) throw new Error(`The fake client ${clientId} has no backchannelLogoutUri.`);\n\n const logoutToken = await this.createLogoutToken({ clientId, sub: options.sub, sid: options.sid });\n let status = 0;\n\n try {\n const response = await fetch(client.backchannelLogoutUri, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({ logout_token: logoutToken }).toString(),\n });\n\n status = response.status;\n await response.arrayBuffer();\n } catch {\n status = 0;\n }\n\n this.backchannelDeliveries.push({ clientId, uri: client.backchannelLogoutUri, logoutToken, status });\n\n return status;\n }\n\n /** Marks a token revoked, as Authio would after a sign-out: an access token, or a refresh token, which is then forgotten. */\n revokeToken(token: string): void {\n const issued = this.issued.get(token);\n\n if (issued) issued.revoked = true;\n\n this.refreshTokens.delete(token);\n }\n\n /** Revokes every refresh token of a person, or of one Authio session (`sid`), as Authio does when a session ends. */\n revokeRefreshTokens(options: { sub?: string; sid?: string }): void {\n for (const [token, refresh] of this.refreshTokens)\n if ((options.sid !== undefined && refresh.sid === options.sid) || (options.sid === undefined && options.sub !== undefined && refresh.sub === options.sub))\n this.refreshTokens.delete(token);\n }\n\n /** Forgets the recorded requests. */\n clearRequests(): void {\n this.requests.length = 0;\n }\n\n /** The recorded requests to one endpoint path suffix, such as `/token`. */\n requestsTo(suffix: string): FakeAuthioRecordedRequest[] {\n return this.requests.filter((request) => request.path.endsWith(suffix));\n }\n\n /** Stops the server. */\n close(): Promise<void> {\n return new Promise((resolve, reject) => {\n this.server.closeAllConnections?.();\n this.server.close((error) => (error ? reject(error) : resolve()));\n });\n }\n\n private async listen(): Promise<void> {\n const pair = await generateKeyPair(\"RS256\", { extractable: true });\n const untrusted = await generateKeyPair(\"RS256\");\n\n this.signingKey = pair.privateKey;\n this.verificationKey = pair.publicKey;\n this.untrustedKey = untrusted.privateKey;\n this.publicJwk = { ...(await exportJWK(pair.publicKey)), kid: this.keyId, alg: \"RS256\", use: \"sig\" };\n this.server = createServer((request, response) => {\n this.handle(request, response).catch((error: unknown) => {\n send(response, { status: 500, body: { error: \"server_error\", error_description: String(error) } });\n });\n });\n\n await new Promise<void>((resolve) => this.server.listen(0, \"127.0.0.1\", resolve));\n\n this.baseUrl = `http://127.0.0.1:${(this.server.address() as AddressInfo).port}`;\n }\n\n private async handle(request: IncomingMessage, response: ServerResponse): Promise<void> {\n const url = new URL(request.url ?? \"/\", this.baseUrl);\n const body = await readBody(request);\n const form = Object.fromEntries(new URLSearchParams(request.headers[\"content-type\"]?.includes(\"form\") ? body : \"\"));\n const headers = Object.fromEntries(Object.entries(request.headers).map(([name, value]) => [name, Array.isArray(value) ? value.join(\", \") : (value ?? \"\")]));\n const query = Object.fromEntries(url.searchParams);\n const recorded: FakeAuthioRecordedRequest = { method: request.method ?? \"GET\", path: url.pathname, headers, form, query };\n\n this.requests.push(recorded);\n\n const prefix = `/realms/${this.realm}`;\n const path = url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : url.pathname;\n const endpoint = endpointOf(path);\n const failure = endpoint ? this.failures.get(endpoint)?.shift() : undefined;\n\n if (failure) return send(response, failure);\n\n switch (path) {\n case \"/.well-known/openid-configuration\":\n return send(response, { status: 200, body: this.discovery() });\n case \"/protocol/openid-connect/certs\":\n return send(response, { status: 200, body: this.jwks });\n case \"/protocol/openid-connect/auth\":\n return this.authorizeEndpoint(query, response);\n case \"/protocol/openid-connect/token\":\n return send(response, await this.token(recorded, form));\n case \"/protocol/openid-connect/token/introspect\":\n return send(response, await this.introspect(recorded, form));\n case \"/protocol/openid-connect/revoke\":\n return send(response, await this.revoke(recorded, form));\n case \"/protocol/openid-connect/userinfo\":\n return this.userInfo(headers, response);\n case \"/protocol/openid-connect/auth/device\":\n return send(response, await this.device(recorded, form));\n case \"/protocol/openid-connect/logout\":\n return this.endSessionEndpoint(query, response);\n default:\n return send(response, { status: 404, body: { error: \"not_found\" } });\n }\n }\n\n private discovery(): Record<string, unknown> {\n const base = `${this.issuer}/protocol/openid-connect`;\n\n return {\n issuer: this.discoveryIssuer ?? this.issuer,\n authorization_endpoint: `${base}/auth`,\n token_endpoint: `${base}/token`,\n introspection_endpoint: `${base}/token/introspect`,\n revocation_endpoint: `${base}/revoke`,\n userinfo_endpoint: `${base}/userinfo`,\n end_session_endpoint: `${base}/logout`,\n device_authorization_endpoint: `${base}/auth/device`,\n jwks_uri: `${base}/certs`,\n scopes_supported: [\"openid\", \"profile\", \"email\", \"phone\", \"roles\", \"offline_access\"],\n response_types_supported: [\"code\"],\n response_modes_supported: [\"query\", \"web_message\"],\n grant_types_supported: [\n \"authorization_code\",\n \"refresh_token\",\n \"client_credentials\",\n \"password\",\n \"urn:ietf:params:oauth:grant-type:device_code\",\n \"urn:ietf:params:oauth:grant-type:token-exchange\",\n \"personal_access_token\",\n ],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"RS256\"],\n id_token_encryption_alg_values_supported: [\"RSA-OAEP\", \"RSA-OAEP-256\"],\n id_token_encryption_enc_values_supported: [\"A128CBC-HS256\", \"A192CBC-HS384\", \"A256CBC-HS512\"],\n userinfo_signing_alg_values_supported: [\"RS256\"],\n userinfo_encryption_alg_values_supported: [\"RSA-OAEP\", \"RSA-OAEP-256\"],\n userinfo_encryption_enc_values_supported: [\"A128CBC-HS256\", \"A192CBC-HS384\", \"A256CBC-HS512\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\", \"private_key_jwt\", \"none\"],\n code_challenge_methods_supported: [\"S256\", \"plain\"],\n prompt_values_supported: [\"none\", \"login\", \"select_account\", \"consent\"],\n display_values_supported: [\"page\", \"popup\"],\n acr_values_supported: [\"1\", \"2\", \"3\"],\n backchannel_logout_supported: true,\n backchannel_logout_session_supported: true,\n authorization_response_iss_parameter_supported: !this.omitAuthorizationIssuer,\n };\n }\n\n private authorizeEndpoint(query: Record<string, string>, response: ServerResponse): void {\n const client = this.clients.get(query.client_id ?? \"\");\n\n if (!client) return send(response, { status: 400, body: { error: \"invalid_request\", error_description: \"Unknown client_id.\" } });\n if (!query.redirect_uri || (client.redirectUris && !client.redirectUris.includes(query.redirect_uri)))\n return send(response, { status: 400, body: { error: \"invalid_request\", error_description: \"The redirect_uri is not registered.\" } });\n\n const answer = (parameters: Record<string, string | undefined>) => {\n const values: Record<string, string> = {};\n\n for (const [name, value] of Object.entries({ ...parameters, state: query.state, iss: this.omitAuthorizationIssuer ? undefined : this.issuer }))\n if (value !== undefined) values[name] = value;\n\n if (query.response_mode === \"web_message\") {\n const message = encodeURIComponent(JSON.stringify(values));\n\n response.writeHead(200, { \"content-type\": \"text/html; charset=utf-8\" });\n response.end(\n `<!doctype html><html><body data-authorization-response='${message}'><script>window.opener&&window.opener.postMessage({type:\"authorization_response\",response:JSON.parse(decodeURIComponent(document.body.dataset.authorizationResponse))},${JSON.stringify(new URL(query.redirect_uri!).origin)});</script></body></html>`,\n );\n return;\n }\n\n const location = new URL(query.redirect_uri!);\n\n for (const [name, value] of Object.entries(values)) location.searchParams.set(name, value);\n\n response.writeHead(302, { location: location.toString() });\n response.end();\n };\n\n if (query.response_type !== \"code\") return answer({ error: \"unsupported_response_type\", error_description: \"Only code is supported.\" });\n\n const method = query.code_challenge_method ?? (query.code_challenge ? \"plain\" : undefined);\n\n if (method && method !== \"S256\" && method !== \"plain\") return answer({ error: \"invalid_request\", error_description: \"Unsupported PKCE method.\" });\n\n const prompts = (query.prompt ?? \"\").split(\" \").filter(Boolean);\n const now = Math.floor(Date.now() / 1000);\n const maxAge = query.max_age !== undefined ? Number(query.max_age) : undefined;\n const tooOld = this.session !== undefined && maxAge !== undefined && now - this.session.authTime > maxAge;\n const requestedAcr = (query.acr_values ?? \"\").split(\" \").filter(Boolean).sort().at(-1);\n const weaker = this.session !== undefined && requestedAcr !== undefined && Number(this.session.acr) < Number(requestedAcr);\n\n if (prompts.includes(\"none\") && (!this.session || tooOld || weaker)) return answer({ error: \"login_required\", error_description: \"Nobody is signed in.\" });\n\n if (!this.session || prompts.includes(\"login\") || tooOld || weaker || (query.login_hint && this.users.get(query.login_hint)?.sub !== this.session.sub)) {\n const username = (query.login_hint && this.users.has(query.login_hint) ? query.login_hint : undefined) ?? this.signInAs ?? this.users.keys().next().value;\n const user = username ? this.users.get(username) : undefined;\n\n if (!user) return answer({ error: \"access_denied\", error_description: \"The fake has no user to sign in.\" });\n\n const acr = requestedAcr ?? user.acr ?? \"1\";\n\n this.session = {\n sub: user.sub,\n sid: randomUUID().replace(/-/g, \"\"),\n authTime: now,\n acr,\n amr: user.amr ?? (Number(acr) >= 2 ? [\"pwd\", \"otp\", \"mfa\"] : [\"pwd\"]),\n clients: new Set(),\n };\n }\n\n this.session.clients.add(client.clientId);\n\n const code = randomUUID();\n\n this.codes.set(code, {\n clientId: client.clientId,\n sub: this.session.sub,\n redirectUri: query.redirect_uri,\n scope: query.scope,\n codeChallenge: query.code_challenge,\n codeChallengeMethod: method,\n resource: query.resource,\n nonce: query.nonce,\n sid: this.session.sid,\n authTime: this.session.authTime,\n acr: this.session.acr,\n amr: this.session.amr,\n });\n\n answer({ code });\n }\n\n private async endSessionEndpoint(query: Record<string, string>, response: ServerResponse): Promise<void> {\n let clientId = query.client_id;\n\n if (query.id_token_hint) {\n try {\n const { payload } = await jwtVerify(query.id_token_hint, this.verificationKey, { issuer: this.issuer });\n\n clientId ??= [payload.aud ?? []].flat()[0];\n } catch {\n return send(response, { status: 400, body: { error: \"invalid_request\", error_description: \"The id_token_hint is not valid.\" } });\n }\n }\n\n const client = clientId ? this.clients.get(clientId) : undefined;\n const redirect = query.post_logout_redirect_uri;\n\n if (redirect && (!client || (client.postLogoutRedirectUris && !client.postLogoutRedirectUris.includes(redirect))))\n return send(response, { status: 400, body: { error: \"invalid_request\", error_description: \"The post_logout_redirect_uri is not registered.\" } });\n\n const ended = this.session;\n\n this.session = undefined;\n\n if (ended) this.revokeRefreshTokens({ sid: ended.sid });\n\n if (ended)\n for (const id of ended.clients) if (this.clients.get(id)?.backchannelLogoutUri) await this.deliverBackchannelLogout(id, { sub: ended.sub, sid: ended.sid });\n\n if (!redirect) {\n response.writeHead(200, { \"content-type\": \"text/html; charset=utf-8\" });\n response.end(\"<!doctype html><p>You are signed out.</p>\");\n return;\n }\n\n const location = new URL(redirect);\n\n if (query.state) location.searchParams.set(\"state\", query.state);\n\n response.writeHead(302, { location: location.toString() });\n response.end();\n }\n\n private async authenticate(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioClient | FakeAuthioError> {\n const invalid = (description: string): FakeAuthioError => ({ status: 401, body: { error: \"invalid_client\", error_description: description } });\n const authorization = recorded.headers.authorization;\n let client: FakeAuthioClient | undefined;\n\n if (authorization?.startsWith(\"Basic \")) {\n const [id, secret] = Buffer.from(authorization.slice(6), \"base64\").toString(\"utf8\").split(\":\").map(decodeURIComponent);\n\n client = this.clients.get(id ?? \"\");\n\n if (!client || !client.clientSecret || client.clientSecret !== secret) return invalid(\"The client credentials are wrong.\");\n } else if (form.client_assertion) {\n client = this.clients.get(form.client_id ?? \"\");\n\n if (!client?.publicKey) return invalid(\"The client has no registered key.\");\n if (form.client_assertion_type !== \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\") return invalid(\"Wrong assertion type.\");\n\n try {\n const key = await importJWK(client.publicKey, client.publicKey.alg);\n const { payload } = await jwtVerify(form.client_assertion, key, { issuer: client.clientId, subject: client.clientId, audience: this.issuer });\n\n if (!payload.jti) return invalid(\"The assertion has no jti.\");\n } catch (error) {\n return invalid(`The assertion does not verify: ${(error as Error).message}`);\n }\n } else if (form.client_secret !== undefined) {\n client = this.clients.get(form.client_id ?? \"\");\n\n if (!client || client.clientSecret !== form.client_secret) return invalid(\"The client credentials are wrong.\");\n } else {\n client = this.clients.get(form.client_id ?? \"\");\n\n if (!client || client.clientSecret || client.publicKey) return invalid(\"The client must authenticate.\");\n }\n\n recorded.clientId = client.clientId;\n\n return client;\n }\n\n private async token(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const grant = (error: string, description: string): FakeAuthioError => ({ status: 400, body: { error, error_description: description } });\n\n if (form.grant_type === \"personal_access_token\") {\n const pat = this.personalAccessTokens.get(form.client_secret ?? \"\");\n\n if (!pat || (form.client_id && pat.clientId && form.client_id !== pat.clientId))\n return { status: 401, body: { error: \"invalid_client\", error_description: \"The personal access token is not valid.\" } };\n\n const clientId = pat.clientId ?? \"authio\";\n\n recorded.clientId = clientId;\n\n return this.tokenAnswer(this.clients.get(clientId) ?? { clientId }, {\n sub: pat.sub,\n scope: form.scope,\n audience: form.resource,\n claims: { amr: \"personal_access_token\", actor_type: \"personal_access_token\", credential_id: pat.sub, ...pat.claims },\n });\n }\n\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n const scope = form.scope ?? client.defaultScopes?.join(\" \");\n\n switch (form.grant_type) {\n case \"client_credentials\":\n return this.tokenAnswer(client, { sub: client.clientId, scope, audience: form.resource, claims: client.claims });\n case \"password\": {\n const user = this.users.get(form.username ?? \"\");\n\n if (!user || user.password !== form.password) return grant(\"invalid_grant\", \"Wrong username or password.\");\n\n return this.tokenAnswer(client, { sub: user.sub, scope, claims: { ...client.claims, ...user.claims, preferred_username: user.username } }, user);\n }\n case \"authorization_code\": {\n const code = this.codes.get(form.code ?? \"\");\n\n if (!code || code.clientId !== client.clientId || code.redirectUri !== form.redirect_uri) return grant(\"invalid_grant\", \"The code is not valid.\");\n if (code.codeVerifier && code.codeVerifier !== form.code_verifier) return grant(\"invalid_grant\", \"PKCE verification failed.\");\n if (code.codeChallenge && !verifiesChallenge(form.code_verifier, code.codeChallenge, code.codeChallengeMethod ?? \"plain\"))\n return grant(\"invalid_grant\", \"PKCE verification failed.\");\n\n this.codes.delete(form.code!);\n\n const user = [...this.users.values()].find((candidate) => candidate.sub === code.sub)!;\n const signIn = code.sid\n ? { sid: code.sid, auth_time: code.authTime, acr: code.acr, amr: code.amr }\n : { auth_time: Math.floor(Date.now() / 1000), acr: user.acr ?? \"1\", amr: user.amr ?? [\"pwd\"] };\n\n return this.tokenAnswer(\n client,\n {\n sub: user.sub,\n scope: code.scope,\n audience: form.resource ?? code.resource,\n claims: { ...client.claims, ...user.claims, ...signIn, preferred_username: user.username },\n },\n user,\n undefined,\n { nonce: code.nonce, signIn },\n );\n }\n case \"refresh_token\": {\n const refresh = this.refreshTokens.get(form.refresh_token ?? \"\");\n\n if (!refresh || refresh.clientId !== client.clientId) return grant(\"invalid_grant\", \"The refresh token is not valid.\");\n\n this.refreshTokens.delete(form.refresh_token!);\n\n const user = [...this.users.values()].find((candidate) => candidate.sub === refresh.sub);\n\n return this.tokenAnswer(\n client,\n { sub: refresh.sub, scope: form.scope ?? refresh.scope, claims: { ...client.claims, ...user?.claims, ...(refresh.sid ? { sid: refresh.sid } : {}) } },\n user,\n );\n }\n case \"urn:ietf:params:oauth:grant-type:token-exchange\": {\n const subject = this.issued.get(form.subject_token ?? \"\");\n\n if (!subject || subject.revoked) return grant(\"invalid_grant\", \"The subject token is not valid.\");\n\n if (form.requested_token_type === \"urn:authio:params:oauth:token-type:connection-access-token\") {\n const answer = this.connectionResponder?.(form) ?? {\n access_token: `provider-token-${form.connection_provider}`,\n issued_token_type: form.requested_token_type,\n token_type: \"Bearer\",\n expires_in: 3600,\n provider: form.connection_provider,\n };\n\n return \"status\" in answer && typeof answer.status === \"number\" ? (answer as FakeAuthioError) : { status: 200, body: answer as Record<string, unknown> };\n }\n\n const { iss: _issuer, aud: _audience, exp: _expiry, iat: _issuedAt, nbf: _notBefore, jti: _jti, scope: _scope, ...claims } = subject.claims;\n\n return this.tokenAnswer(client, {\n sub: subject.claims.sub,\n scope: form.scope ?? (subject.claims.scope as string | undefined),\n audience: form.resource,\n claims: { ...claims, act: { client_id: client.clientId } },\n }, undefined, form.requested_token_type);\n }\n case \"urn:ietf:params:oauth:grant-type:device_code\": {\n const polls = this.devicePolls.get(form.device_code ?? \"\");\n\n if (polls === undefined) return grant(\"invalid_grant\", \"Unknown device code.\");\n\n this.devicePolls.set(form.device_code!, polls + 1);\n\n const outcome = this.deviceOutcomes[Math.min(polls, this.deviceOutcomes.length - 1)] ?? \"approved\";\n\n switch (outcome) {\n case \"pending\":\n return grant(\"authorization_pending\", \"The user has not approved yet.\");\n case \"slow_down\":\n return grant(\"slow_down\", \"Poll less often.\");\n case \"denied\":\n return grant(\"access_denied\", \"The user denied the request.\");\n case \"expired\":\n return grant(\"expired_token\", \"The device code expired.\");\n default:\n return this.tokenAnswer(client, { sub: \"device-user\", scope, claims: client.claims });\n }\n }\n default:\n return grant(\"unsupported_grant_type\", `The grant ${form.grant_type} is not supported.`);\n }\n }\n\n private async tokenAnswer(\n client: FakeAuthioClient,\n options: { sub?: string; scope?: string; audience?: string; claims?: Record<string, unknown> },\n user?: FakeAuthioUser,\n issuedTokenType?: string,\n idToken?: { nonce?: string; signIn: Record<string, unknown> },\n ): Promise<FakeAuthioError> {\n const encryption = client.encryption;\n const accessToken = await this.issueAccessToken({\n clientId: client.clientId,\n sub: options.sub,\n scope: options.scope,\n audience: options.audience ?? client.clientId,\n claims: options.claims,\n ...(encryption?.accessTokens ? { encryptTo: encryption } : {}),\n });\n const body: Record<string, unknown> = {\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: this.lifetime,\n ...(options.scope ? { scope: options.scope } : {}),\n ...(issuedTokenType ? { issued_token_type: issuedTokenType } : {}),\n };\n\n if (user) {\n const refreshToken = randomUUID();\n const sid = typeof options.claims?.sid === \"string\" ? options.claims.sid : undefined;\n\n this.refreshTokens.set(refreshToken, { clientId: client.clientId, sub: user.sub, scope: options.scope, sid, expiresAt: Math.floor(Date.now() / 1000) + 30 * 24 * 3600 });\n body.refresh_token = refreshToken;\n }\n\n if (user && idToken && (options.scope ?? \"\").split(\" \").includes(\"openid\")) {\n const now = Math.floor(Date.now() / 1000);\n const signIn = Object.fromEntries(Object.entries(idToken.signIn).filter(([, value]) => value !== undefined));\n const signed = await new SignJWT({\n typ: \"ID\",\n azp: client.clientId,\n ...signIn,\n ...(idToken.nonce ? { nonce: idToken.nonce } : {}),\n at_hash: halfHash(accessToken),\n preferred_username: user.username,\n ...user.userInfo,\n })\n .setProtectedHeader({ alg: \"RS256\", kid: this.keyId, typ: \"JWT\" })\n .setIssuer(this.issuer)\n .setAudience(client.clientId)\n .setSubject(user.sub)\n .setIssuedAt(now)\n .setExpirationTime(now + this.lifetime)\n .sign(this.signingKey);\n\n body.id_token = encryption && encryption.idTokens !== false ? await encryptTo(signed, encryption) : signed;\n }\n\n return { status: 200, body };\n }\n\n private async introspect(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n const issued = this.issued.get(form.token ?? \"\");\n const now = Math.floor(Date.now() / 1000);\n const refresh = this.refreshTokens.get(form.token ?? \"\");\n\n if (refresh)\n return refresh.clientId === client.clientId\n ? {\n status: 200,\n body: {\n active: true,\n token_type: \"Refresh\",\n client_id: refresh.clientId,\n sub: refresh.sub,\n exp: refresh.expiresAt,\n ...(refresh.scope ? { scope: refresh.scope } : {}),\n ...(refresh.sid ? { sid: refresh.sid } : {}),\n },\n }\n : { status: 200, body: { active: false } };\n\n if (!issued || issued.revoked || (issued.claims.exp ?? 0) <= now) return { status: 200, body: { active: false } };\n\n const audiences = [issued.claims.aud ?? []].flat();\n const allowed =\n issued.clientId === client.clientId && audiences.includes(client.clientId)\n ? true\n : audiences.some((audience) => this.clients.get(audience)?.introspectionClients?.includes(client.clientId) || audience === client.clientId);\n\n if (!allowed) return { status: 200, body: { active: false } };\n\n const { typ, ...claims } = issued.claims;\n\n return { status: 200, body: { active: true, token_type: typ ?? \"Bearer\", username: claims.preferred_username, ...claims } };\n }\n\n private async revoke(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n this.revokeToken(form.token ?? \"\");\n this.refreshTokens.delete(form.token ?? \"\");\n\n return { status: 200 };\n }\n\n private async device(recorded: FakeAuthioRecordedRequest, form: Record<string, string>): Promise<FakeAuthioError> {\n const client = await this.authenticate(recorded, form);\n\n if (\"status\" in client) return client;\n\n const deviceCode = randomUUID();\n\n this.devicePolls.set(deviceCode, 0);\n\n return {\n status: 200,\n body: {\n device_code: deviceCode,\n user_code: \"WDJB-MJHT\",\n verification_uri: `${this.issuer}/device`,\n verification_uri_complete: `${this.issuer}/device?user_code=WDJB-MJHT`,\n expires_in: 600,\n interval: 5,\n },\n };\n }\n\n private async userInfo(headers: Record<string, string>, response: ServerResponse): Promise<void> {\n const token = headers.authorization?.replace(/^Bearer\\s+/i, \"\");\n const issued = token ? this.issued.get(token) : undefined;\n\n if (!issued || issued.revoked)\n return send(response, {\n status: 401,\n headers: { \"www-authenticate\": 'Bearer error=\"invalid_token\", error_description=\"The access token is not valid.\"' },\n });\n\n const user = [...this.users.values()].find((candidate) => candidate.sub === issued.claims.sub);\n const claims = { sub: issued.claims.sub, ...user?.userInfo };\n\n if (!this.userInfoAsJwt) return send(response, { status: 200, body: claims });\n\n const now = Math.floor(Date.now() / 1000);\n const signed = await new SignJWT(claims)\n .setProtectedHeader({ alg: \"RS256\", kid: this.keyId })\n .setIssuer(this.issuer)\n .setAudience(issued.clientId)\n .setIssuedAt(now)\n .setExpirationTime(now + this.lifetime)\n .sign(this.signingKey);\n const encryption = this.clients.get(issued.clientId)?.encryption;\n const jwt = encryption && encryption.userInfo !== false ? await encryptTo(signed, encryption) : signed;\n\n response.writeHead(200, { \"content-type\": \"application/jwt\" });\n response.end(jwt);\n }\n\n private requireUser(username: string): FakeAuthioUser {\n const user = this.users.get(username);\n\n if (!user) throw new Error(`The fake has no user ${username}.`);\n\n return user;\n }\n}\n\nfunction endpointOf(path: string): Endpoint | undefined {\n if (path.endsWith(\"/token\")) return \"token\";\n if (path.endsWith(\"/introspect\")) return \"introspect\";\n if (path.endsWith(\"/revoke\")) return \"revoke\";\n if (path.endsWith(\"/userinfo\")) return \"userinfo\";\n if (path.endsWith(\"/auth/device\")) return \"device\";\n if (path.endsWith(\"/openid-configuration\")) return \"discovery\";\n if (path.endsWith(\"/auth\")) return \"authorize\";\n if (path.endsWith(\"/logout\")) return \"logout\";\n return undefined;\n}\n\nasync function encryptTo(signed: string, encryption: { key: JWK; algorithm?: string; encryptionMethod?: string }): Promise<string> {\n const algorithm = encryption.algorithm ?? \"RSA-OAEP-256\";\n const key = await importJWK({ ...encryption.key, alg: algorithm, use: \"enc\", key_ops: undefined }, algorithm);\n\n return new CompactEncrypt(new TextEncoder().encode(signed))\n .setProtectedHeader({ alg: algorithm, enc: encryption.encryptionMethod ?? \"A256CBC-HS512\", typ: \"JWE\", cty: \"JWT\", ...(encryption.key.kid ? { kid: encryption.key.kid } : {}) })\n .encrypt(key);\n}\n\nfunction verifiesChallenge(verifier: string | undefined, challenge: string, method: string): boolean {\n if (!verifier) return false;\n\n return method === \"S256\" ? createHash(\"sha256\").update(verifier, \"ascii\").digest(\"base64url\") === challenge : verifier === challenge;\n}\n\nfunction halfHash(value: string): string {\n return createHash(\"sha256\").update(value, \"ascii\").digest().subarray(0, 16).toString(\"base64url\");\n}\n\nfunction send(response: ServerResponse, answer: FakeAuthioError): void {\n const headers: Record<string, string> = { ...answer.headers };\n\n if (answer.body !== undefined) headers[\"content-type\"] ??= \"application/json\";\n\n response.writeHead(answer.status, headers);\n response.end(answer.body === undefined ? undefined : JSON.stringify(answer.body));\n}\n\nfunction readBody(request: IncomingMessage): Promise<string> {\n return new Promise((resolve, reject) => {\n const chunks: Buffer[] = [];\n\n request.on(\"data\", (chunk: Buffer) => chunks.push(chunk));\n request.on(\"end\", () => resolve(Buffer.concat(chunks).toString(\"utf8\")));\n request.on(\"error\", reject);\n });\n}\n","import type { AuthioClock } from \"@hyper.authio/client\";\n\n/**\n * A clock that moves only when told to. `sleep` returns at once and moves the clock forward by the time asked, so\n * device polling and cache expiry run instantly and deterministically.\n */\nexport class ManualClock implements AuthioClock {\n /** Every `sleep` asked for, in milliseconds. */\n readonly sleeps: number[] = [];\n private time: number;\n\n /**\n * @param start Milliseconds since the epoch. Defaults to the current time.\n */\n constructor(start: number = Date.now()) {\n this.time = start;\n }\n\n now(): number {\n return this.time;\n }\n\n sleep(ms: number, signal?: AbortSignal): Promise<void> {\n if (signal?.aborted) return Promise.reject(signal.reason);\n\n this.sleeps.push(ms);\n this.time += ms;\n\n return Promise.resolve();\n }\n\n /** Moves the clock forward. */\n advance(ms: number): void {\n this.time += ms;\n }\n\n /** Sets the clock. */\n set(ms: number): void {\n this.time = ms;\n }\n}\n","import { randomUUID } from \"node:crypto\";\nimport { AuthioWebhookHeaders, computeWebhookSignatureHeader } from \"@hyper.authio/client\";\n\n/**\n * A webhook delivery as Authio would send it.\n */\nexport interface FakeWebhookDelivery {\n readonly body: string;\n readonly headers: Record<string, string>;\n readonly event: Record<string, unknown>;\n}\n\n/**\n * Builds a signed webhook delivery.\n *\n * @param type The event type.\n * @param data The event data.\n * @param secret The webhook secret.\n * @param options `id`, `timestamp` (milliseconds) and extra event members.\n */\nexport async function createWebhookDelivery(\n type: string,\n data: unknown,\n secret: string,\n options: { id?: string; timestamp?: number; realmId?: string; clientId?: string; sendEventIdHeader?: boolean } = {},\n): Promise<FakeWebhookDelivery> {\n const timestamp = options.timestamp ?? Date.now();\n const id = options.id ?? randomUUID();\n const event = {\n id,\n type,\n created_at: Math.floor(timestamp / 1000),\n ...(options.realmId ? { realm_id: options.realmId } : {}),\n ...(options.clientId ? { client_id: options.clientId } : {}),\n data,\n };\n const body = JSON.stringify(event);\n const headers: Record<string, string> = {\n \"content-type\": \"application/json\",\n [AuthioWebhookHeaders.Signature]: await computeWebhookSignatureHeader(body, secret, timestamp),\n [AuthioWebhookHeaders.Event]: type,\n };\n\n if (options.sendEventIdHeader ?? true) headers[AuthioWebhookHeaders.EventId] = id;\n\n return { body, headers, event };\n}\n"]}
|
package/dist/index.d.cts
CHANGED
|
@@ -1,6 +1,25 @@
|
|
|
1
1
|
import { JWK } from 'jose';
|
|
2
2
|
import { AuthioClock } from '@hyper.authio/client';
|
|
3
3
|
|
|
4
|
+
/**
|
|
5
|
+
* How the fake encrypts what it issues to a client, as Authio does once the client registered an encryption key.
|
|
6
|
+
*/
|
|
7
|
+
interface FakeAuthioClientEncryption {
|
|
8
|
+
/** The client's public encryption key (RSA). */
|
|
9
|
+
key: JWK;
|
|
10
|
+
/** Defaults to `RSA-OAEP-256`. */
|
|
11
|
+
algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
|
|
12
|
+
/** Defaults to `A256CBC-HS512`. */
|
|
13
|
+
encryptionMethod?: "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
|
|
14
|
+
/** Encrypts the client's access tokens (nested JWT). */
|
|
15
|
+
accessTokens?: boolean;
|
|
16
|
+
/** Encrypts the client's ID tokens. Defaults to `true`. */
|
|
17
|
+
idTokens?: boolean;
|
|
18
|
+
/** Encrypts UserInfo answered as a JWT. Defaults to `true`. */
|
|
19
|
+
userInfo?: boolean;
|
|
20
|
+
/** Encrypts back-channel logout tokens. */
|
|
21
|
+
logoutTokens?: boolean;
|
|
22
|
+
}
|
|
4
23
|
/**
|
|
5
24
|
* A client registered in the fake.
|
|
6
25
|
*/
|
|
@@ -16,6 +35,14 @@ interface FakeAuthioClient {
|
|
|
16
35
|
claims?: Record<string, unknown>;
|
|
17
36
|
/** The client this one's tokens are introspectable by, besides itself (a resource server's introspection client). */
|
|
18
37
|
introspectionClients?: string[];
|
|
38
|
+
/** The redirect URIs the authorization endpoint accepts. Any when absent. */
|
|
39
|
+
redirectUris?: string[];
|
|
40
|
+
/** The post-logout redirect URIs the end-session endpoint accepts. Any when absent. */
|
|
41
|
+
postLogoutRedirectUris?: string[];
|
|
42
|
+
/** Where back-channel logout tokens are posted when a session of the client ends. */
|
|
43
|
+
backchannelLogoutUri?: string;
|
|
44
|
+
/** Encrypts what is issued to the client. */
|
|
45
|
+
encryption?: FakeAuthioClientEncryption;
|
|
19
46
|
}
|
|
20
47
|
/**
|
|
21
48
|
* A person the fake knows, for the password grant, authorization codes and UserInfo.
|
|
@@ -28,6 +55,23 @@ interface FakeAuthioUser {
|
|
|
28
55
|
claims?: Record<string, unknown>;
|
|
29
56
|
/** What UserInfo answers besides `sub`. */
|
|
30
57
|
userInfo?: Record<string, unknown>;
|
|
58
|
+
/** The sign-in's methods. Defaults to `["pwd"]`. */
|
|
59
|
+
amr?: string[];
|
|
60
|
+
/** The sign-in's level. Defaults to `1`, or the `acr_values` asked for. */
|
|
61
|
+
acr?: string;
|
|
62
|
+
}
|
|
63
|
+
/**
|
|
64
|
+
* A personal access token the fake accepts with the `personal_access_token` grant.
|
|
65
|
+
*/
|
|
66
|
+
interface FakeAuthioPersonalAccessToken {
|
|
67
|
+
/** The `pat_…` value. */
|
|
68
|
+
token: string;
|
|
69
|
+
/** The credential's id, the token's `sub`. */
|
|
70
|
+
sub: string;
|
|
71
|
+
/** The consumer's client, for a consumer's token; the `authio` client of an account otherwise. */
|
|
72
|
+
clientId?: string;
|
|
73
|
+
/** Claims added to the access token. */
|
|
74
|
+
claims?: Record<string, unknown>;
|
|
31
75
|
}
|
|
32
76
|
/**
|
|
33
77
|
* An error the fake answers a request with.
|
|
@@ -45,9 +89,30 @@ interface FakeAuthioRecordedRequest {
|
|
|
45
89
|
path: string;
|
|
46
90
|
headers: Record<string, string>;
|
|
47
91
|
form: Record<string, string>;
|
|
92
|
+
/** The query parameters. */
|
|
93
|
+
query: Record<string, string>;
|
|
48
94
|
/** The client the request authenticated as, when it did. */
|
|
49
95
|
clientId?: string;
|
|
50
96
|
}
|
|
97
|
+
/**
|
|
98
|
+
* A back-channel logout token the fake posted to a client.
|
|
99
|
+
*/
|
|
100
|
+
interface FakeAuthioBackchannelDelivery {
|
|
101
|
+
clientId: string;
|
|
102
|
+
uri: string;
|
|
103
|
+
logoutToken: string;
|
|
104
|
+
/** The HTTP status the client answered, or 0 when it could not be reached. */
|
|
105
|
+
status: number;
|
|
106
|
+
}
|
|
107
|
+
/**
|
|
108
|
+
* The parameters an authorization ended with, as the fake sent them back.
|
|
109
|
+
*/
|
|
110
|
+
interface FakeAuthioAuthorizationOutcome {
|
|
111
|
+
/** `code`, `state` and `iss`, or `error`, `error_description`, `state` and `iss`. */
|
|
112
|
+
parameters: Record<string, string>;
|
|
113
|
+
/** The redirect URI with the parameters, for `response_mode=query`. */
|
|
114
|
+
callbackUrl: string | undefined;
|
|
115
|
+
}
|
|
51
116
|
/**
|
|
52
117
|
* What the device flow answers to successive polls.
|
|
53
118
|
*/
|
|
@@ -62,6 +127,7 @@ interface FakeAuthioOptions {
|
|
|
62
127
|
accessTokenLifetime?: number;
|
|
63
128
|
clients?: FakeAuthioClient[];
|
|
64
129
|
users?: FakeAuthioUser[];
|
|
130
|
+
personalAccessTokens?: FakeAuthioPersonalAccessToken[];
|
|
65
131
|
}
|
|
66
132
|
/**
|
|
67
133
|
* Options of a token minted directly.
|
|
@@ -82,34 +148,52 @@ interface FakeAuthioTokenOptions {
|
|
|
82
148
|
issuer?: string;
|
|
83
149
|
/** Signs with another key, so the signature does not verify. */
|
|
84
150
|
untrusted?: boolean;
|
|
151
|
+
/** Encrypts the token (nested JWT) to this public key, as Authio does for a client with an encryption key. */
|
|
152
|
+
encryptTo?: {
|
|
153
|
+
key: JWK;
|
|
154
|
+
algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
|
|
155
|
+
encryptionMethod?: string;
|
|
156
|
+
};
|
|
85
157
|
}
|
|
158
|
+
type Endpoint = "token" | "introspect" | "revoke" | "userinfo" | "device" | "discovery" | "authorize" | "logout";
|
|
86
159
|
/**
|
|
87
|
-
* An in-memory Authio realm served over HTTP on loopback: discovery, JWKS,
|
|
88
|
-
*
|
|
89
|
-
* device
|
|
160
|
+
* An in-memory Authio realm served over HTTP on loopback: discovery, JWKS, authorization (PKCE, `state`, `nonce`,
|
|
161
|
+
* `prompt`, `max_age`, `acr_values`, `response_mode=web_message`, RFC 9207 `iss`), token (client credentials,
|
|
162
|
+
* authorization code with ID tokens, refresh, token exchange, password, device code, personal access token),
|
|
163
|
+
* introspection, revocation, UserInfo, device authorization, end session and back-channel logout delivery, with JWE
|
|
164
|
+
* (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.
|
|
90
165
|
*/
|
|
91
166
|
declare class FakeAuthio {
|
|
92
167
|
/** Every request received, in order. */
|
|
93
168
|
readonly requests: FakeAuthioRecordedRequest[];
|
|
94
169
|
/** Answers the next requests to an endpoint with these errors, in order, before answering normally. */
|
|
95
|
-
readonly failures: Map<
|
|
170
|
+
readonly failures: Map<Endpoint, FakeAuthioError[]>;
|
|
171
|
+
/** Every back-channel logout token posted, in order. */
|
|
172
|
+
readonly backchannelDeliveries: FakeAuthioBackchannelDelivery[];
|
|
96
173
|
/** What successive device-code polls answer; the last value repeats. Defaults to `["approved"]`. */
|
|
97
174
|
deviceOutcomes: FakeAuthioDeviceOutcome[];
|
|
98
175
|
/** Overrides the discovery document's issuer, to test the mismatch check. */
|
|
99
176
|
discoveryIssuer: string | undefined;
|
|
100
|
-
/** Answers UserInfo as `application/jwt`, signed by the realm key. */
|
|
177
|
+
/** Answers UserInfo as `application/jwt`, signed by the realm key (and encrypted for a client with a key). */
|
|
101
178
|
userInfoAsJwt: boolean;
|
|
179
|
+
/** Leaves `iss` out of authorization responses, to test the RFC 9207 check. */
|
|
180
|
+
omitAuthorizationIssuer: boolean;
|
|
102
181
|
/** Answers connected-account exchanges. Defaults to granting a token for the provider. */
|
|
103
182
|
connectionResponder: ((form: Record<string, string>) => FakeAuthioError | Record<string, unknown>) | undefined;
|
|
183
|
+
/** The person the authorization endpoint signs in when the request names none with `login_hint`. Defaults to the first user. */
|
|
184
|
+
signInAs: string | undefined;
|
|
104
185
|
private readonly clients;
|
|
105
186
|
private readonly users;
|
|
187
|
+
private readonly personalAccessTokens;
|
|
106
188
|
private readonly codes;
|
|
107
189
|
private readonly refreshTokens;
|
|
108
190
|
private readonly issued;
|
|
109
191
|
private readonly devicePolls;
|
|
110
192
|
private readonly lifetime;
|
|
193
|
+
private session;
|
|
111
194
|
private server;
|
|
112
195
|
private signingKey;
|
|
196
|
+
private verificationKey;
|
|
113
197
|
private untrustedKey;
|
|
114
198
|
private publicJwk;
|
|
115
199
|
private baseUrl;
|
|
@@ -128,10 +212,20 @@ declare class FakeAuthio {
|
|
|
128
212
|
get jwks(): {
|
|
129
213
|
keys: JWK[];
|
|
130
214
|
};
|
|
215
|
+
/** The session the authorization endpoint keeps (one browser), or `undefined` when nobody is signed in. */
|
|
216
|
+
get currentSession(): {
|
|
217
|
+
sub: string;
|
|
218
|
+
sid: string;
|
|
219
|
+
authTime: number;
|
|
220
|
+
} | undefined;
|
|
131
221
|
/** Registers a client. */
|
|
132
222
|
addClient(client: FakeAuthioClient): void;
|
|
133
223
|
/** Registers a person. */
|
|
134
224
|
addUser(user: FakeAuthioUser): void;
|
|
225
|
+
/** Registers a personal access token. */
|
|
226
|
+
addPersonalAccessToken(token: FakeAuthioPersonalAccessToken): void;
|
|
227
|
+
/** Ends the signed-in session without notifying anyone, as if it expired. */
|
|
228
|
+
endSession(): void;
|
|
135
229
|
/**
|
|
136
230
|
* Registers an authorization code for a person, as the authorization endpoint would after sign-in.
|
|
137
231
|
*/
|
|
@@ -142,13 +236,44 @@ declare class FakeAuthio {
|
|
|
142
236
|
scope?: string;
|
|
143
237
|
codeChallengeVerifier?: string;
|
|
144
238
|
resource?: string;
|
|
239
|
+
nonce?: string;
|
|
145
240
|
}): string;
|
|
241
|
+
/**
|
|
242
|
+
* Follows an authorization URL as a browser would, signing in `signInAs` (or the `login_hint`), and returns what
|
|
243
|
+
* Authio sent back: the callback URL for `response_mode=query`, the posted message's parameters for `web_message`.
|
|
244
|
+
*/
|
|
245
|
+
authorize(authorizationUrl: string): Promise<FakeAuthioAuthorizationOutcome>;
|
|
146
246
|
/**
|
|
147
247
|
* Mints an access token signed by the realm key, recorded so introspection and revocation know it.
|
|
148
248
|
*/
|
|
149
249
|
issueAccessToken(options?: FakeAuthioTokenOptions): Promise<string>;
|
|
150
|
-
/**
|
|
250
|
+
/**
|
|
251
|
+
* Mints a back-channel logout token for a client, signed by the realm key. `overrides` replaces claims (`undefined`
|
|
252
|
+
* removes one) and `type` the header `typ`, to build invalid ones in tests.
|
|
253
|
+
*/
|
|
254
|
+
createLogoutToken(options: {
|
|
255
|
+
clientId: string;
|
|
256
|
+
sub?: string;
|
|
257
|
+
sid?: string;
|
|
258
|
+
type?: string;
|
|
259
|
+
overrides?: Record<string, unknown>;
|
|
260
|
+
}): Promise<string>;
|
|
261
|
+
/**
|
|
262
|
+
* Posts a back-channel logout token to the client's `backchannelLogoutUri`, as Authio does when a session ends.
|
|
263
|
+
*
|
|
264
|
+
* @returns The HTTP status the client answered, or 0 when it could not be reached.
|
|
265
|
+
*/
|
|
266
|
+
deliverBackchannelLogout(clientId: string, options?: {
|
|
267
|
+
sub?: string;
|
|
268
|
+
sid?: string;
|
|
269
|
+
}): Promise<number>;
|
|
270
|
+
/** Marks a token revoked, as Authio would after a sign-out: an access token, or a refresh token, which is then forgotten. */
|
|
151
271
|
revokeToken(token: string): void;
|
|
272
|
+
/** Revokes every refresh token of a person, or of one Authio session (`sid`), as Authio does when a session ends. */
|
|
273
|
+
revokeRefreshTokens(options: {
|
|
274
|
+
sub?: string;
|
|
275
|
+
sid?: string;
|
|
276
|
+
}): void;
|
|
152
277
|
/** Forgets the recorded requests. */
|
|
153
278
|
clearRequests(): void;
|
|
154
279
|
/** The recorded requests to one endpoint path suffix, such as `/token`. */
|
|
@@ -158,6 +283,8 @@ declare class FakeAuthio {
|
|
|
158
283
|
private listen;
|
|
159
284
|
private handle;
|
|
160
285
|
private discovery;
|
|
286
|
+
private authorizeEndpoint;
|
|
287
|
+
private endSessionEndpoint;
|
|
161
288
|
private authenticate;
|
|
162
289
|
private token;
|
|
163
290
|
private tokenAnswer;
|
|
@@ -212,4 +339,4 @@ declare function createWebhookDelivery(type: string, data: unknown, secret: stri
|
|
|
212
339
|
sendEventIdHeader?: boolean;
|
|
213
340
|
}): Promise<FakeWebhookDelivery>;
|
|
214
341
|
|
|
215
|
-
export { FakeAuthio, type FakeAuthioClient, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioOptions, type FakeAuthioRecordedRequest, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };
|
|
342
|
+
export { FakeAuthio, type FakeAuthioAuthorizationOutcome, type FakeAuthioBackchannelDelivery, type FakeAuthioClient, type FakeAuthioClientEncryption, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioOptions, type FakeAuthioPersonalAccessToken, type FakeAuthioRecordedRequest, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };
|