@idp.global/sdk 18.0.1 → 18.1.0

package/dist_ts_relyingparty/classes.idpoidcprovider.js

@@ -0,0 +1,255 @@
+import * as plugins from './plugins.js';
+import { OidcIntrospectionClient, OidcIntrospectionError, } from '../dist_ts_server/classes.oidc-introspection-client.js';
+/** The provider could not be asked, or did not answer in its own contract. The caller fails closed on it. */
+export class OidcAuthorityUnavailableError extends Error {
+    reason;
+    constructor(reason, causeArg) {
+        super('The identity provider could not be observed', { cause: causeArg });
+        this.reason = reason;
+        this.name = 'OidcAuthorityUnavailableError';
+    }
+}
+/** The provider refused the refresh with `invalid_grant`: the refresh family is revoked, expired or was reused. */
+export class OidcRefreshRefusedError extends Error {
+    constructor(causeArg) {
+        super('The identity provider refused the refresh', { cause: causeArg });
+        this.name = 'OidcRefreshRefusedError';
+    }
+}
+export class OidcCompletionError extends Error {
+    stage;
+    constructor(stage, causeArg) {
+        super('OIDC completion failed', { cause: causeArg });
+        this.stage = stage;
+        this.name = 'OidcCompletionError';
+    }
+}
+/**
+ * The scopes a relying party asks for. `organizations` and `roles` are what
+ * idp.global reports memberships under.
+ */
+export const IDP_OIDC_DEFAULT_SCOPES = 'openid profile email organizations roles';
+export const IDP_OIDC_DEFAULT_REQUEST_TIMEOUT_SECONDS = 10;
+const optionalString = (valueArg) => typeof valueArg === 'string' && valueArg.trim().length > 0 ? valueArg.trim() : undefined;
+/** When an access token dies, from the `expires_in` of a token response; `0` when it names none. */
+const expiryOf = (expiresInArg) => typeof expiresInArg === 'number' && Number.isFinite(expiresInArg) && expiresInArg > 0
+    ? Date.now() + Math.floor(expiresInArg) * 1_000
+    : 0;
+/**
+ * Organization claims as idp.global documents them: `id`, `name`, `slug` and
+ * the member's roles. Anything that is not that exact shape is dropped rather
+ * than guessed at.
+ */
+export const readOrganizationClaims = (valueArg) => {
+    if (!Array.isArray(valueArg)) {
+        return [];
+    }
+    const organizations = [];
+    for (const entry of valueArg) {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+            continue;
+        }
+        const candidate = entry;
+        const id = optionalString(candidate.id);
+        const name = optionalString(candidate.name);
+        const slug = optionalString(candidate.slug);
+        if (!id || !name || !slug) {
+            continue;
+        }
+        const roles = Array.isArray(candidate.roles)
+            ? candidate.roles.filter((roleArg) => typeof roleArg === 'string')
+            : [];
+        organizations.push({ id, name, slug, roles });
+    }
+    return organizations;
+};
+/**
+ * The relying-party side of the authorization code flow with S256 PKCE on
+ * `openid-client`, in the profile idp.global supports: code responses, S256
+ * challenges, RS256 ID tokens and `client_secret_basic` for a confidential
+ * client. Live organization authority is observed with the sdk's
+ * `OidcIntrospectionClient`.
+ */
+export class IdpOidcProvider {
+    requestTimeoutSeconds;
+    #options;
+    #configuration;
+    #introspection;
+    constructor(optionsArg) {
+        if (!(optionsArg?.issuer instanceof URL) || !(optionsArg.redirectUri instanceof URL)) {
+            throw new Error('IdpOidcProvider needs the issuer and the redirect URI as URLs');
+        }
+        if (!optionalString(optionsArg.clientId) || !optionalString(optionsArg.clientSecret)) {
+            throw new Error('IdpOidcProvider needs a client id and a client secret');
+        }
+        const timeout = optionsArg.requestTimeoutSeconds ?? IDP_OIDC_DEFAULT_REQUEST_TIMEOUT_SECONDS;
+        if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 60) {
+            throw new Error('IdpOidcProvider requestTimeoutSeconds must be an integer from 1 to 60');
+        }
+        this.requestTimeoutSeconds = timeout;
+        this.#options = optionsArg;
+    }
+    get configuration() {
+        if (!this.#configuration) {
+            throw new Error('The identity provider is not initialized');
+        }
+        return this.#configuration;
+    }
+    async init() {
+        if (this.#configuration) {
+            return;
+        }
+        const options = this.#options;
+        // the timeout given to discovery bounds discovery itself and stays on the
+        // resolved configuration for every later request
+        const configuration = await plugins.openidClient.discovery(options.issuer, options.clientId, {
+            client_secret: options.clientSecret,
+            token_endpoint_auth_method: 'client_secret_basic',
+            id_token_signed_response_alg: 'RS256',
+        }, plugins.openidClient.ClientSecretBasic(options.clientSecret), { timeout: this.requestTimeoutSeconds });
+        const metadata = configuration.serverMetadata();
+        if (!metadata.authorization_endpoint || !metadata.token_endpoint || !metadata.jwks_uri) {
+            throw new Error('The identity provider is missing required OIDC endpoints');
+        }
+        if (!metadata.code_challenge_methods_supported?.includes('S256')) {
+            throw new Error('The identity provider must support PKCE S256');
+        }
+        if (metadata.id_token_signing_alg_values_supported
+            && !metadata.id_token_signing_alg_values_supported.includes('RS256')) {
+            throw new Error('The identity provider must sign ID tokens with RS256');
+        }
+        if (metadata.grant_types_supported && !metadata.grant_types_supported.includes('authorization_code')) {
+            throw new Error('The identity provider must support the authorization_code grant');
+        }
+        if (metadata.grant_types_supported && !metadata.grant_types_supported.includes('refresh_token')) {
+            // without rotation the access token dies long before the session does
+            throw new Error('The identity provider must support the refresh_token grant');
+        }
+        this.#introspection = new OidcIntrospectionClient({
+            issuer: options.issuer.origin,
+            clientId: options.clientId,
+            clientSecret: options.clientSecret,
+            ...(options.introspectionTimeoutMs !== undefined ? { timeoutMs: options.introspectionTimeoutMs } : {}),
+        });
+        this.#configuration = configuration;
+    }
+    async buildAuthorizationUrl(optionsArg) {
+        const codeChallenge = await plugins.openidClient.calculatePKCECodeChallenge(optionsArg.pkceVerifier);
+        return plugins.openidClient.buildAuthorizationUrl(this.configuration, {
+            redirect_uri: this.#options.redirectUri.href,
+            response_type: 'code',
+            scope: this.#options.scopes ?? IDP_OIDC_DEFAULT_SCOPES,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            state: optionsArg.state,
+            nonce: optionsArg.nonce,
+        });
+    }
+    async completeAuthorization(optionsArg) {
+        let tokens;
+        try {
+            tokens = await plugins.openidClient.authorizationCodeGrant(this.configuration, optionsArg.callbackUrl, {
+                pkceCodeVerifier: optionsArg.pkceVerifier,
+                expectedState: optionsArg.state,
+                expectedNonce: optionsArg.nonce,
+                idTokenExpected: true,
+            });
+        }
+        catch (error) {
+            throw new OidcCompletionError('token_exchange', error);
+        }
+        let subject;
+        try {
+            const claims = tokens.claims();
+            if (!claims?.sub) {
+                throw new Error('The token response carries no subject');
+            }
+            subject = claims.sub;
+        }
+        catch (error) {
+            throw new OidcCompletionError('token_validation', error);
+        }
+        // UserInfo is the current view of profile and organization claims; the ID
+        // token proves the login. Both are read, and the subjects must agree.
+        let userInfo;
+        try {
+            userInfo = await plugins.openidClient.fetchUserInfo(this.configuration, tokens.access_token, subject);
+        }
+        catch (error) {
+            throw new OidcCompletionError('userinfo', error);
+        }
+        if (userInfo.sub !== subject) {
+            throw new OidcCompletionError('token_validation', new Error('The UserInfo subject does not match the ID token'));
+        }
+        return {
+            subject,
+            accessToken: tokens.access_token,
+            ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
+            accessTokenExpiresAt: expiryOf(tokens.expires_in),
+            email: optionalString(userInfo.email),
+            emailVerified: userInfo.email_verified === true,
+            displayName: optionalString(userInfo.name) || optionalString(userInfo.preferred_username),
+            organizations: readOrganizationClaims(Reflect.get(userInfo, 'organizations')),
+        };
+    }
+    async revokeToken(tokenArg, hintArg) {
+        await plugins.openidClient.tokenRevocation(this.configuration, tokenArg, { token_type_hint: hintArg });
+    }
+    /**
+     * One `POST /oauth/introspect` through the confidential introspection
+     * client, which validates the whole answer before this code sees it. A
+     * refusal (`active: false`) is an answer; anything else is a failure to
+     * observe.
+     */
+    async introspectOrganization(optionsArg) {
+        if (!this.#introspection) {
+            throw new Error('The identity provider is not initialized');
+        }
+        let response;
+        try {
+            response = await this.#introspection.introspect({
+                token: optionsArg.accessToken,
+                subject: optionsArg.subject,
+                organizationId: optionsArg.organizationId,
+            });
+        }
+        catch (error) {
+            if (error instanceof OidcIntrospectionError) {
+                if (error.code === 'invalid_request') {
+                    // a request the endpoint's own client refuses is a defect of the
+                    // caller, never an answer about access
+                    throw error;
+                }
+                throw new OidcAuthorityUnavailableError(error.code, error);
+            }
+            throw new OidcAuthorityUnavailableError('unavailable', error);
+        }
+        if (!response.active) {
+            return { active: false, roles: [], expiresAt: 0 };
+        }
+        return {
+            active: true,
+            roles: response.idp_global_authority.roles,
+            expiresAt: response.exp * 1_000,
+        };
+    }
+    /** The refresh grant with rotation; a superseded refresh token is never kept by the caller. */
+    async refreshTokens(refreshTokenArg) {
+        let tokens;
+        try {
+            tokens = await plugins.openidClient.refreshTokenGrant(this.configuration, refreshTokenArg);
+        }
+        catch (error) {
+            if (error instanceof plugins.openidClient.ResponseBodyError && error.error === 'invalid_grant') {
+                throw new OidcRefreshRefusedError(error);
+            }
+            throw new OidcAuthorityUnavailableError('unavailable', error);
+        }
+        return {
+            accessToken: tokens.access_token,
+            ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
+            accessTokenExpiresAt: expiryOf(tokens.expires_in),
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixzQkFBc0IsR0FDdkIsTUFBTSxtREFBbUQsQ0FBQztBQTBEM0QsNkdBQTZHO0FBQzdHLE1BQU0sT0FBTyw2QkFBOEIsU0FBUSxLQUFLO0lBRXBDO0lBRGxCLFlBQ2tCLE1BQTZCLEVBQzdDLFFBQWtCO1FBRWxCLEtBQUssQ0FBQyw2Q0FBNkMsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBSDFELFdBQU0sR0FBTixNQUFNLENBQXVCO1FBSTdDLElBQUksQ0FBQyxJQUFJLEdBQUcsK0JBQStCLENBQUM7SUFDOUMsQ0FBQztDQUNGO0FBRUQsbUhBQW1IO0FBQ25ILE1BQU0sT0FBTyx1QkFBd0IsU0FBUSxLQUFLO0lBQ2hELFlBQVksUUFBa0I7UUFDNUIsS0FBSyxDQUFDLDJDQUEyQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDeEUsSUFBSSxDQUFDLElBQUksR0FBRyx5QkFBeUIsQ0FBQztJQUN4QyxDQUFDO0NBQ0Y7QUFNRCxNQUFNLE9BQU8sbUJBQW9CLFNBQVEsS0FBSztJQUUxQjtJQURsQixZQUNrQixLQUFrQyxFQUNsRCxRQUFpQjtRQUVqQixLQUFLLENBQUMsd0JBQXdCLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUhyQyxVQUFLLEdBQUwsS0FBSyxDQUE2QjtRQUlsRCxJQUFJLENBQUMsSUFBSSxHQUFHLHFCQUFxQixDQUFDO0lBQ3BDLENBQUM7Q0FDRjtBQTBCRDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRywwQ0FBMEMsQ0FBQztBQUVsRixNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxFQUFFLENBQUM7QUFnQjNELE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUMvRCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBRTNGLG9HQUFvRztBQUNwRyxNQUFNLFFBQVEsR0FBRyxDQUFDLFlBQWdDLEVBQVUsRUFBRSxDQUM1RCxPQUFPLFlBQVksS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsSUFBSSxZQUFZLEdBQUcsQ0FBQztJQUNuRixDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEdBQUcsS0FBSztJQUMvQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRVI7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsUUFBaUIsRUFBNEIsRUFBRTtJQUNwRixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzdCLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUNELE1BQU0sYUFBYSxHQUE2QixFQUFFLENBQUM7SUFDbkQsS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUM3QixJQUFJLENBQUMsS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDaEUsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLFNBQVMsR0FBRyxLQUFnQyxDQUFDO1FBQ25ELE1BQU0sRUFBRSxHQUFHLGNBQWMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDeEMsTUFBTSxJQUFJLEdBQUcsY0FBYyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM1QyxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVDLElBQUksQ0FBQyxFQUFFLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUMxQixTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQztZQUMxQyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQXFCLEVBQUUsQ0FBQyxPQUFPLE9BQU8sS0FBSyxRQUFRLENBQUM7WUFDckYsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLGFBQWEsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFDRCxPQUFPLGFBQWEsQ0FBQztBQUN2QixDQUFDLENBQUM7QUFFRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLE9BQU8sZUFBZTtJQUNWLHFCQUFxQixDQUFTO0lBQ3JDLFFBQVEsQ0FBMEI7SUFDM0MsY0FBYyxDQUFzQztJQUNwRCxjQUFjLENBQTJCO0lBRXpDLFlBQVksVUFBbUM7UUFDN0MsSUFBSSxDQUFDLENBQUMsVUFBVSxFQUFFLE1BQU0sWUFBWSxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsVUFBVSxDQUFDLFdBQVcsWUFBWSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3JGLE1BQU0sSUFBSSxLQUFLLENBQUMsK0RBQStELENBQUMsQ0FBQztRQUNuRixDQUFDO1FBQ0QsSUFBSSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDckYsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMscUJBQXFCLElBQUksd0NBQXdDLENBQUM7UUFDN0YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLElBQUksT0FBTyxHQUFHLENBQUMsSUFBSSxPQUFPLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDbEUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO1FBQzNGLENBQUM7UUFDRCxJQUFJLENBQUMscUJBQXFCLEdBQUcsT0FBTyxDQUFDO1FBQ3JDLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDO0lBQzdCLENBQUM7SUFFRCxJQUFZLGFBQWE7UUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQztJQUM3QixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QixPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDOUIsMEVBQTBFO1FBQzFFLGlEQUFpRDtRQUNqRCxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUN4RCxPQUFPLENBQUMsTUFBTSxFQUNkLE9BQU8sQ0FBQyxRQUFRLEVBQ2hCO1lBQ0UsYUFBYSxFQUFFLE9BQU8sQ0FBQyxZQUFZO1lBQ25DLDBCQUEwQixFQUFFLHFCQUFxQjtZQUNqRCw0QkFBNEIsRUFBRSxPQUFPO1NBQ3RDLEVBQ0QsT0FBTyxDQUFDLFlBQVksQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQzVELEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxDQUN4QyxDQUFDO1FBQ0YsTUFBTSxRQUFRLEdBQUcsYUFBYSxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQ2hELElBQUksQ0FBQyxRQUFRLENBQUMsc0JBQXNCLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ3ZGLE1BQU0sSUFBSSxLQUFLLENBQUMsMERBQTBELENBQUMsQ0FBQztRQUM5RSxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQ0FBZ0MsRUFBRSxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUNqRSxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQ0UsUUFBUSxDQUFDLHFDQUFxQztlQUMzQyxDQUFDLFFBQVEsQ0FBQyxxQ0FBcUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQ3BFLENBQUM7WUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7UUFDMUUsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLHFCQUFxQixJQUFJLENBQUMsUUFBUSxDQUFDLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7WUFDckcsTUFBTSxJQUFJLEtBQUssQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUNoRyxzRUFBc0U7WUFDdEUsTUFBTSxJQUFJLEtBQUssQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxJQUFJLENBQUMsY0FBYyxHQUFHLElBQUksdUJBQXVCLENBQUM7WUFDaEQsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTTtZQUM3QixRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7WUFDMUIsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZO1lBQ2xDLEdBQUcsQ0FBQyxPQUFPLENBQUMsc0JBQXNCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsc0JBQXNCLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ3ZHLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxjQUFjLEdBQUcsYUFBYSxDQUFDO0lBQ3RDLENBQUM7SUFFTSxLQUFLLENBQUMscUJBQXFCLENBQUMsVUFBcUM7UUFDdEUsTUFBTSxhQUFhLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLDBCQUEwQixDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNyRyxPQUFPLE9BQU8sQ0FBQyxZQUFZLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRTtZQUNwRSxZQUFZLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsSUFBSTtZQUM1QyxhQUFhLEVBQUUsTUFBTTtZQUNyQixLQUFLLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLElBQUksdUJBQXVCO1lBQ3RELGNBQWMsRUFBRSxhQUFhO1lBQzdCLHFCQUFxQixFQUFFLE1BQU07WUFDN0IsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLO1lBQ3ZCLEtBQUssRUFBRSxVQUFVLENBQUMsS0FBSztTQUN4QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLHFCQUFxQixDQUFDLFVBQWtDO1FBQ25FLElBQUksTUFBK0UsQ0FBQztRQUNwRixJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLHNCQUFzQixDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsVUFBVSxDQUFDLFdBQVcsRUFBRTtnQkFDckcsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLFlBQVk7Z0JBQ3pDLGFBQWEsRUFBRSxVQUFVLENBQUMsS0FBSztnQkFDL0IsYUFBYSxFQUFFLFVBQVUsQ0FBQyxLQUFLO2dCQUMvQixlQUFlLEVBQUUsSUFBSTthQUN0QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBRUQsSUFBSSxPQUFlLENBQUM7UUFDcEIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQy9CLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUM7Z0JBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsT0FBTyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUM7UUFDdkIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksbUJBQW1CLENBQUMsa0JBQWtCLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUVELDBFQUEwRTtRQUMxRSxzRUFBc0U7UUFDdEUsSUFBSSxRQUF3RSxDQUFDO1FBQzdFLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN4RyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLEdBQUcsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUM3QixNQUFNLElBQUksbUJBQW1CLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQyxDQUFDO1FBQ25ILENBQUM7UUFFRCxPQUFPO1lBQ0wsT0FBTztZQUNQLFdBQVcsRUFBRSxNQUFNLENBQUMsWUFBWTtZQUNoQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdkUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7WUFDakQsS0FBSyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ3JDLGFBQWEsRUFBRSxRQUFRLENBQUMsY0FBYyxLQUFLLElBQUk7WUFDL0MsV0FBVyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksY0FBYyxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQztZQUN6RixhQUFhLEVBQUUsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7U0FDOUUsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFFBQWdCLEVBQUUsT0FBdUI7UUFDaEUsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLFFBQVEsRUFBRSxFQUFFLGVBQWUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxVQUluQztRQUNDLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDekIsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFDRCxJQUFJLFFBQW9FLENBQUM7UUFDekUsSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUM7Z0JBQzlDLEtBQUssRUFBRSxVQUFVLENBQUMsV0FBVztnQkFDN0IsT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFPO2dCQUMzQixjQUFjLEVBQUUsVUFBVSxDQUFDLGNBQWM7YUFDMUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSxzQkFBc0IsRUFBRSxDQUFDO2dCQUM1QyxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssaUJBQWlCLEVBQUUsQ0FBQztvQkFDckMsaUVBQWlFO29CQUNqRSx1Q0FBdUM7b0JBQ3ZDLE1BQU0sS0FBSyxDQUFDO2dCQUNkLENBQUM7Z0JBQ0QsTUFBTSxJQUFJLDZCQUE2QixDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFDN0QsQ0FBQztZQUNELE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxhQUFhLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDckIsT0FBTyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDcEQsQ0FBQztRQUNELE9BQU87WUFDTCxNQUFNLEVBQUUsSUFBSTtZQUNaLEtBQUssRUFBRSxRQUFRLENBQUMsb0JBQW9CLENBQUMsS0FBSztZQUMxQyxTQUFTLEVBQUUsUUFBUSxDQUFDLEdBQUcsR0FBRyxLQUFLO1NBQ2hDLENBQUM7SUFDSixDQUFDO0lBRUQsK0ZBQStGO0lBQ3hGLEtBQUssQ0FBQyxhQUFhLENBQUMsZUFBdUI7UUFDaEQsSUFBSSxNQUEwRSxDQUFDO1FBQy9FLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxlQUFlLENBQUMsQ0FBQztRQUM3RixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxZQUFZLE9BQU8sQ0FBQyxZQUFZLENBQUMsaUJBQWlCLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxlQUFlLEVBQUUsQ0FBQztnQkFDL0YsTUFBTSxJQUFJLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzNDLENBQUM7WUFDRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxPQUFPO1lBQ0wsV0FBVyxFQUFFLE1BQU0sQ0FBQyxZQUFZO1lBQ2hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxNQUFNLENBQUMsYUFBYSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN2RSxvQkFBb0IsRUFBRSxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQztTQUNsRCxDQUFDO0lBQ0osQ0FBQztDQUNGIn0=

package/dist_ts_relyingparty/classes.relyingpartyroutes.d.ts

@@ -0,0 +1,84 @@
+import type { RelyingPartySessions } from './classes.relyingpartysessions.js';
+import type { IResolvedRelyingPartySession } from './interfaces.js';
+/**
+ * The part of an HTTP request context the routes read. `IRequestContext` of
+ * `@push.rocks/smartserve` — what a typedserver `IRouteHandler` receives —
+ * satisfies it, so the routes plug into `addRoute()` / `addCustomRoutes()`
+ * without the sdk depending on either package.
+ */
+export interface IRelyingPartyHttpContext {
+    readonly method: string;
+    readonly url: URL;
+    readonly headers: Headers;
+    readonly request: Request;
+}
+export interface IRelyingPartyRoutesOptions {
+    sessions: RelyingPartySessions;
+    /** where a sign-in that did not finish sends the browser; no provider text is ever echoed into it */
+    failureLocation: string;
+    /**
+     * Where a refusal of the application (`RelyingPartyRefusal.code`) sends the
+     * browser, so the application can explain it; a refusal not named here is
+     * answered as a failed authentication with its status.
+     */
+    refusalLocations?: Readonly<Record<string, string>>;
+    /**
+     * The body `GET <prefix>session` answers with. Default:
+     * `{ session: { sessionId, principalId, expiresAt, csrfToken } | null }`.
+     */
+    sessionAnswer?(resolvedArg: IResolvedRelyingPartySession | null): Promise<object>;
+    /** the largest logout body read, in bytes; a longer one is cancelled as soon as it passes the limit */
+    maxBodyBytes?: number;
+    /**
+     * diagnostics of a failed start or callback; the default writes one JSON
+     * line to `console.error`. A throwing sink never changes the answer: the
+     * event and its failure go to `console.error` instead.
+     */
+    onRouteEvent?(eventArg: {
+        event: 'auth_login_start_failed' | 'auth_callback_failed' | 'auth_callback_declined' | 'auth_callback_refused';
+        stage?: string;
+        code?: string;
+        correlationId?: string;
+        message?: string;
+    }): void;
+}
+/**
+ * The HTTP steps of a relying-party login, all under the sessions' login path
+ * prefix (default `/auth/`):
+ *
+ * - `GET login?return=…` redirects to the provider and sets the intent cookie
+ * - `GET callback` consumes the attempt once and sets the session cookie; a
+ *   provider `error` abandons the attempt
+ * - `GET finalize` releases the return path only to the browser holding the
+ *   session this attempt created
+ * - `GET session` answers the current session
+ * - `POST logout` ends the session; it needs this origin and the CSRF token
+ *
+ * `handle()` answers `null` for every other request, so the application
+ * chains its own routes (a local password login) around it. Cookies are only
+ * ever set here: a `/typedrequest` answer cannot carry `Set-Cookie`.
+ */
+export declare class RelyingPartyRoutes {
+    #private;
+    constructor(optionsArg: IRelyingPartyRoutesOptions);
+    /** The paths the routes answer, for registering them one by one. */
+    get paths(): {
+        login: string;
+        callback: string;
+        finalize: string;
+        session: string;
+        logout: string;
+    };
+    readonly handle: (contextArg: IRelyingPartyHttpContext) => Promise<Response | null>;
+    private login;
+    private callback;
+    private logout;
+    private sessionAnswer;
+    /**
+     * A JSON body within `maxBodyBytes`, or `null`. The limit holds while the
+     * body streams, whatever `Content-Length` claims or omits: the read is
+     * cancelled at the first chunk that passes it.
+     */
+    private readJsonBody;
+    private emit;
+}

package/dist_ts_relyingparty/classes.relyingpartyroutes.js

@@ -0,0 +1,232 @@
+import * as plugins from './plugins.js';
+import { LoginCallbackError, RelyingPartyError, RelyingPartyRefusal } from './classes.errors.js';
+const DEFAULT_MAX_BODY_BYTES = 16 * 1024;
+/** What the provider names in a callback it did not issue a code for. */
+const MAX_PROVIDER_ERROR_CODE_LENGTH = 64;
+const noStoreHeaders = (headersArg) => {
+    const headers = new Headers(headersArg);
+    headers.set('Cache-Control', 'no-store');
+    headers.set('Pragma', 'no-cache');
+    headers.set('Cross-Origin-Resource-Policy', 'same-origin');
+    return headers;
+};
+const jsonResponse = (bodyArg, statusArg, headersArg) => {
+    const headers = noStoreHeaders(headersArg);
+    headers.set('Content-Type', 'application/json; charset=utf-8');
+    return new Response(JSON.stringify(bodyArg), { status: statusArg, headers });
+};
+const redirect = (locationArg, headersArg) => new Response(null, { status: 302, headers: noStoreHeaders({ Location: locationArg, ...headersArg }) });
+/**
+ * The HTTP steps of a relying-party login, all under the sessions' login path
+ * prefix (default `/auth/`):
+ *
+ * - `GET login?return=…` redirects to the provider and sets the intent cookie
+ * - `GET callback` consumes the attempt once and sets the session cookie; a
+ *   provider `error` abandons the attempt
+ * - `GET finalize` releases the return path only to the browser holding the
+ *   session this attempt created
+ * - `GET session` answers the current session
+ * - `POST logout` ends the session; it needs this origin and the CSRF token
+ *
+ * `handle()` answers `null` for every other request, so the application
+ * chains its own routes (a local password login) around it. Cookies are only
+ * ever set here: a `/typedrequest` answer cannot carry `Set-Cookie`.
+ */
+export class RelyingPartyRoutes {
+    #sessions;
+    #options;
+    #maxBodyBytes;
+    constructor(optionsArg) {
+        this.#sessions = optionsArg.sessions;
+        this.#options = optionsArg;
+        this.#maxBodyBytes = optionsArg.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    }
+    /** The paths the routes answer, for registering them one by one. */
+    get paths() {
+        const prefix = this.#sessions.loginPathPrefix;
+        return {
+            login: prefix + 'login',
+            callback: prefix + 'callback',
+            finalize: prefix + 'finalize',
+            session: prefix + 'session',
+            logout: prefix + 'logout',
+        };
+    }
+    handle = async (contextArg) => {
+        const paths = this.paths;
+        const path = contextArg.url.pathname;
+        const method = contextArg.method.toUpperCase();
+        const providerLogin = this.#sessions.providerLoginEnabled;
+        if (path === paths.login && method === 'GET' && providerLogin) {
+            return this.login(contextArg);
+        }
+        if (path === paths.callback && method === 'GET' && providerLogin) {
+            return this.callback(contextArg);
+        }
+        if (path === paths.finalize && method === 'GET' && providerLogin) {
+            let location = this.#options.failureLocation;
+            try {
+                location = await this.#sessions.finalizeLogin(contextArg.headers.get('cookie'));
+            }
+            catch {
+                location = this.#options.failureLocation;
+            }
+            return redirect(location, { 'Set-Cookie': this.#sessions.clearIntentCookie() });
+        }
+        if (path === paths.session && method === 'GET') {
+            const resolved = await this.#sessions.resolveCookieSession(contextArg.headers.get('cookie'));
+            return jsonResponse(await this.sessionAnswer(resolved), 200);
+        }
+        if (path === paths.logout && method === 'POST') {
+            return this.logout(contextArg);
+        }
+        return null;
+    };
+    async login(contextArg) {
+        try {
+            const start = await this.#sessions.startLogin(contextArg.url.searchParams.get('return'));
+            return redirect(start.authorizationUrl.href, { 'Set-Cookie': start.intentCookie });
+        }
+        catch (error) {
+            this.emit({ event: 'auth_login_start_failed', message: error instanceof Error ? error.message : String(error) });
+            return jsonResponse({ error: 'authentication_unavailable' }, 503);
+        }
+    }
+    async callback(contextArg) {
+        // the callback is read from the public origin, never from a forwarded host
+        const callbackUrl = new URL(contextArg.url.pathname + contextArg.url.search, this.#sessions.publicOrigin);
+        const cookieHeader = contextArg.headers.get('cookie');
+        const providerError = callbackUrl.searchParams.get('error');
+        if (providerError) {
+            // the user cancelled, or the provider refused: nothing to exchange, and
+            // the attempt is consumed so its state never completes later
+            await this.#sessions.abandonLogin(callbackUrl, cookieHeader);
+            this.emit({ event: 'auth_callback_declined', code: providerError.slice(0, MAX_PROVIDER_ERROR_CODE_LENGTH) });
+            return redirect(this.#options.failureLocation, { 'Set-Cookie': this.#sessions.clearIntentCookie() });
+        }
+        try {
+            const opening = await this.#sessions.completeLogin(callbackUrl, cookieHeader);
+            return redirect(this.paths.finalize, { 'Set-Cookie': opening.sessionCookie });
+        }
+        catch (error) {
+            const clearIntent = { 'Set-Cookie': this.#sessions.clearIntentCookie() };
+            if (error instanceof RelyingPartyRefusal) {
+                this.emit({ event: 'auth_callback_refused', code: error.code });
+                const locations = this.#options.refusalLocations ?? {};
+                if (Object.hasOwn(locations, error.code)) {
+                    return redirect(locations[error.code], clearIntent);
+                }
+                return jsonResponse({ error: 'authentication_failed' }, error.status, clearIntent);
+            }
+            const status = error instanceof RelyingPartyError ? error.status : 502;
+            if (status >= 500) {
+                this.emit({
+                    event: 'auth_callback_failed',
+                    correlationId: plugins.crypto.randomUUID(),
+                    stage: error instanceof LoginCallbackError ? error.stage : 'unclassified',
+                    message: error instanceof Error ? error.message : String(error),
+                });
+            }
+            return jsonResponse({ error: 'authentication_failed' }, status, clearIntent);
+        }
+    }
+    async logout(contextArg) {
+        if (contextArg.headers.get('origin') !== this.#sessions.publicOrigin) {
+            return jsonResponse({ error: 'forbidden' }, 403);
+        }
+        const clearSession = { 'Set-Cookie': this.#sessions.clearSessionCookie() };
+        const resolved = await this.#sessions.resolveCookieSession(contextArg.headers.get('cookie'));
+        if (!resolved) {
+            return jsonResponse({ endedLiveSession: false }, 200, clearSession);
+        }
+        const body = await this.readJsonBody(contextArg);
+        const csrfToken = body && typeof body === 'object' ? Reflect.get(body, 'csrfToken') : undefined;
+        if (!this.#sessions.validateCsrf(resolved, csrfToken)) {
+            return jsonResponse({ error: 'forbidden' }, 403);
+        }
+        return jsonResponse({ endedLiveSession: await this.#sessions.logout(resolved.session.id) }, 200, clearSession);
+    }
+    async sessionAnswer(resolvedArg) {
+        if (this.#options.sessionAnswer) {
+            return this.#options.sessionAnswer(resolvedArg);
+        }
+        return {
+            session: resolvedArg
+                ? {
+                    sessionId: resolvedArg.session.id,
+                    principalId: resolvedArg.session.principalId,
+                    expiresAt: resolvedArg.session.expiresAt,
+                    csrfToken: resolvedArg.csrfToken,
+                }
+                : null,
+        };
+    }
+    /**
+     * A JSON body within `maxBodyBytes`, or `null`. The limit holds while the
+     * body streams, whatever `Content-Length` claims or omits: the read is
+     * cancelled at the first chunk that passes it.
+     */
+    async readJsonBody(contextArg) {
+        const declaredLength = Number(contextArg.headers.get('content-length') || 0);
+        if (!Number.isFinite(declaredLength) || declaredLength < 0 || declaredLength > this.#maxBodyBytes) {
+            return null;
+        }
+        const body = contextArg.request.body;
+        if (!body) {
+            return null;
+        }
+        const reader = body.getReader();
+        const chunks = [];
+        let received = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done) {
+                    break;
+                }
+                received += value.byteLength;
+                if (received > this.#maxBodyBytes) {
+                    await reader.cancel();
+                    return null;
+                }
+                chunks.push(value);
+            }
+        }
+        catch {
+            return null;
+        }
+        finally {
+            reader.releaseLock();
+        }
+        try {
+            return JSON.parse(Buffer.concat(chunks, received).toString('utf8'));
+        }
+        catch {
+            return null;
+        }
+    }
+    emit(eventArg) {
+        if (!this.#options.onRouteEvent) {
+            console.error(JSON.stringify(eventArg));
+            return;
+        }
+        const reportFailure = (errorArg) => {
+            console.error(JSON.stringify({
+                event: 'hook_failed',
+                hook: 'onRouteEvent',
+                message: errorArg instanceof Error ? errorArg.message : String(errorArg),
+            }));
+            console.error(JSON.stringify(eventArg));
+        };
+        try {
+            const result = this.#options.onRouteEvent(eventArg);
+            if (result instanceof Promise) {
+                result.catch(reportFailure);
+            }
+        }
+        catch (error) {
+            reportFailure(error);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5yZWx5aW5ncGFydHlyb3V0ZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5yZWx5aW5ncGFydHlyb3V0ZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGtCQUFrQixFQUFFLGlCQUFpQixFQUFFLG1CQUFtQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFnRGpHLE1BQU0sc0JBQXNCLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUN6Qyx5RUFBeUU7QUFDekUsTUFBTSw4QkFBOEIsR0FBRyxFQUFFLENBQUM7QUFFMUMsTUFBTSxjQUFjLEdBQUcsQ0FBQyxVQUFtQyxFQUFXLEVBQUU7SUFDdEUsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyw4QkFBOEIsRUFBRSxhQUFhLENBQUMsQ0FBQztJQUMzRCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLE9BQWUsRUFBRSxTQUFpQixFQUFFLFVBQW1DLEVBQVksRUFBRTtJQUN6RyxNQUFNLE9BQU8sR0FBRyxjQUFjLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDM0MsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztJQUMvRCxPQUFPLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7QUFDL0UsQ0FBQyxDQUFDO0FBRUYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxXQUFtQixFQUFFLFVBQW1DLEVBQVksRUFBRSxDQUN0RixJQUFJLFFBQVEsQ0FBQyxJQUFJLEVBQUUsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxjQUFjLENBQUMsRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLEdBQUcsVUFBVSxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7QUFFekc7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBTSxPQUFPLGtCQUFrQjtJQUNwQixTQUFTLENBQXVCO0lBQ2hDLFFBQVEsQ0FBNkI7SUFDckMsYUFBYSxDQUFTO0lBRS9CLFlBQVksVUFBc0M7UUFDaEQsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDO1FBQzNCLElBQUksQ0FBQyxhQUFhLEdBQUcsVUFBVSxDQUFDLFlBQVksSUFBSSxzQkFBc0IsQ0FBQztJQUN6RSxDQUFDO0lBRUQsb0VBQW9FO0lBQ3BFLElBQVcsS0FBSztRQUNkLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDO1FBQzlDLE9BQU87WUFDTCxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU87WUFDdkIsUUFBUSxFQUFFLE1BQU0sR0FBRyxVQUFVO1lBQzdCLFFBQVEsRUFBRSxNQUFNLEdBQUcsVUFBVTtZQUM3QixPQUFPLEVBQUUsTUFBTSxHQUFHLFNBQVM7WUFDM0IsTUFBTSxFQUFFLE1BQU0sR0FBRyxRQUFRO1NBQzFCLENBQUM7SUFDSixDQUFDO0lBRWUsTUFBTSxHQUFHLEtBQUssRUFBRSxVQUFvQyxFQUE0QixFQUFFO1FBQ2hHLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUM7UUFDekIsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUM7UUFDckMsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUMvQyxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1FBRTFELElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQyxLQUFLLElBQUksTUFBTSxLQUFLLEtBQUssSUFBSSxhQUFhLEVBQUUsQ0FBQztZQUM5RCxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEMsQ0FBQztRQUNELElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQyxRQUFRLElBQUksTUFBTSxLQUFLLEtBQUssSUFBSSxhQUFhLEVBQUUsQ0FBQztZQUNqRSxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDbkMsQ0FBQztRQUNELElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQyxRQUFRLElBQUksTUFBTSxLQUFLLEtBQUssSUFBSSxhQUFhLEVBQUUsQ0FBQztZQUNqRSxJQUFJLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQztZQUM3QyxJQUFJLENBQUM7Z0JBQ0gsUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNsRixDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQztZQUMzQyxDQUFDO1lBQ0QsT0FBTyxRQUFRLENBQUMsUUFBUSxFQUFFLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsaUJBQWlCLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQyxPQUFPLElBQUksTUFBTSxLQUFLLEtBQUssRUFBRSxDQUFDO1lBQy9DLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1lBQzdGLE9BQU8sWUFBWSxDQUFDLE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxJQUFJLEtBQUssS0FBSyxDQUFDLE1BQU0sSUFBSSxNQUFNLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDL0MsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2pDLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxLQUFLLENBQUMsVUFBb0M7UUFDdEQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUN6RixPQUFPLFFBQVEsQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLEVBQUUsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSx5QkFBeUIsRUFBRSxPQUFPLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNqSCxPQUFPLFlBQVksQ0FBQyxFQUFFLEtBQUssRUFBRSw0QkFBNEIsRUFBRSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLFFBQVEsQ0FBQyxVQUFvQztRQUN6RCwyRUFBMkU7UUFDM0UsTUFBTSxXQUFXLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUMxRyxNQUFNLFlBQVksR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN0RCxNQUFNLGFBQWEsR0FBRyxXQUFXLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM1RCxJQUFJLGFBQWEsRUFBRSxDQUFDO1lBQ2xCLHdFQUF3RTtZQUN4RSw2REFBNkQ7WUFDN0QsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDN0QsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSx3QkFBd0IsRUFBRSxJQUFJLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsOEJBQThCLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDN0csT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN2RyxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDOUUsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsRUFBRSxZQUFZLEVBQUUsT0FBTyxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDaEYsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLFdBQVcsR0FBRyxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLGlCQUFpQixFQUFFLEVBQUUsQ0FBQztZQUN6RSxJQUFJLEtBQUssWUFBWSxtQkFBbUIsRUFBRSxDQUFDO2dCQUN6QyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLHVCQUF1QixFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDaEUsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsSUFBSSxFQUFFLENBQUM7Z0JBQ3ZELElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7b0JBQ3pDLE9BQU8sUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsV0FBVyxDQUFDLENBQUM7Z0JBQ3RELENBQUM7Z0JBQ0QsT0FBTyxZQUFZLENBQUMsRUFBRSxLQUFLLEVBQUUsdUJBQXVCLEVBQUUsRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1lBQ3JGLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxLQUFLLFlBQVksaUJBQWlCLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztZQUN2RSxJQUFJLE1BQU0sSUFBSSxHQUFHLEVBQUUsQ0FBQztnQkFDbEIsSUFBSSxDQUFDLElBQUksQ0FBQztvQkFDUixLQUFLLEVBQUUsc0JBQXNCO29CQUM3QixhQUFhLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUU7b0JBQzFDLEtBQUssRUFBRSxLQUFLLFlBQVksa0JBQWtCLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLGNBQWM7b0JBQ3pFLE9BQU8sRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2lCQUNoRSxDQUFDLENBQUM7WUFDTCxDQUFDO1lBQ0QsT0FBTyxZQUFZLENBQUMsRUFBRSxLQUFLLEVBQUUsdUJBQXVCLEVBQUUsRUFBRSxNQUFNLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFDL0UsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQW9DO1FBQ3ZELElBQUksVUFBVSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNyRSxPQUFPLFlBQVksQ0FBQyxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLENBQUM7UUFDM0UsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDN0YsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2QsT0FBTyxZQUFZLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDdEUsQ0FBQztRQUNELE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNqRCxNQUFNLFNBQVMsR0FBRyxJQUFJLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ2hHLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN0RCxPQUFPLFlBQVksQ0FBQyxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQ0QsT0FBTyxZQUFZLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxHQUFHLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDakgsQ0FBQztJQUVPLEtBQUssQ0FBQyxhQUFhLENBQUMsV0FBZ0Q7UUFDMUUsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ2hDLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUNELE9BQU87WUFDTCxPQUFPLEVBQUUsV0FBVztnQkFDbEIsQ0FBQyxDQUFDO29CQUNFLFNBQVMsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLEVBQUU7b0JBQ2pDLFdBQVcsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLFdBQVc7b0JBQzVDLFNBQVMsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLFNBQVM7b0JBQ3hDLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztpQkFDakM7Z0JBQ0gsQ0FBQyxDQUFDLElBQUk7U0FDVCxDQUFDO0lBQ0osQ0FBQztJQUVEOzs7O09BSUc7SUFDSyxLQUFLLENBQUMsWUFBWSxDQUFDLFVBQW9DO1FBQzdELE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQzdFLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxJQUFJLGNBQWMsR0FBRyxDQUFDLElBQUksY0FBYyxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUNsRyxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztRQUNyQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDVixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDaEMsTUFBTSxNQUFNLEdBQWlCLEVBQUUsQ0FBQztRQUNoQyxJQUFJLFFBQVEsR0FBRyxDQUFDLENBQUM7UUFDakIsSUFBSSxDQUFDO1lBQ0gsU0FBUyxDQUFDO2dCQUNSLE1BQU0sRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQzVDLElBQUksSUFBSSxFQUFFLENBQUM7b0JBQ1QsTUFBTTtnQkFDUixDQUFDO2dCQUNELFFBQVEsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDO2dCQUM3QixJQUFJLFFBQVEsR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7b0JBQ2xDLE1BQU0sTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO29CQUN0QixPQUFPLElBQUksQ0FBQztnQkFDZCxDQUFDO2dCQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDckIsQ0FBQztRQUNILENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7Z0JBQVMsQ0FBQztZQUNULE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN2QixDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBWSxDQUFDO1FBQ2pGLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRU8sSUFBSSxDQUFDLFFBQWdGO1FBQzNGLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ2hDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1lBQ3hDLE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFpQixFQUFFLEVBQUU7WUFDMUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO2dCQUMzQixLQUFLLEVBQUUsYUFBYTtnQkFDcEIsSUFBSSxFQUFFLGNBQWM7Z0JBQ3BCLE9BQU8sRUFBRSxRQUFRLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDO2FBQ3pFLENBQUMsQ0FBQyxDQUFDO1lBQ0osT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDMUMsQ0FBQyxDQUFDO1FBQ0YsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQVksSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDN0QsSUFBSSxNQUFNLFlBQVksT0FBTyxFQUFFLENBQUM7Z0JBQzlCLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDOUIsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==