@intlayer/backend 7.0.8 → 7.0.9-canary.2

package/dist/esm/node_modules/samlify/build/src/flow.mjs

@@ -0,0 +1,389 @@
+import { __commonJS } from "../../../../_virtual/rolldown_runtime.mjs";
+import { require_utility } from "./utility.mjs";
+import { require_urn } from "./urn.mjs";
+import { require_extractor } from "./extractor.mjs";
+import { require_libsaml } from "./libsaml.mjs";
+import { require_validator } from "./validator.mjs";
+
+//#region ../../node_modules/samlify/build/src/flow.js
+var require_flow = /* @__PURE__ */ __commonJS({ "../../node_modules/samlify/build/src/flow.js": ((exports) => {
+	var __awaiter = exports && exports.__awaiter || function(thisArg, _arguments, P, generator) {
+		function adopt(value) {
+			return value instanceof P ? value : new P(function(resolve) {
+				resolve(value);
+			});
+		}
+		return new (P || (P = Promise))(function(resolve, reject) {
+			function fulfilled(value) {
+				try {
+					step(generator.next(value));
+				} catch (e) {
+					reject(e);
+				}
+			}
+			function rejected(value) {
+				try {
+					step(generator["throw"](value));
+				} catch (e) {
+					reject(e);
+				}
+			}
+			function step(result) {
+				result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+			}
+			step((generator = generator.apply(thisArg, _arguments || [])).next());
+		});
+	};
+	var __generator = exports && exports.__generator || function(thisArg, body) {
+		var _ = {
+			label: 0,
+			sent: function() {
+				if (t[0] & 1) throw t[1];
+				return t[1];
+			},
+			trys: [],
+			ops: []
+		}, f, y, t, g;
+		return g = {
+			next: verb(0),
+			"throw": verb(1),
+			"return": verb(2)
+		}, typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+			return this;
+		}), g;
+		function verb(n) {
+			return function(v) {
+				return step([n, v]);
+			};
+		}
+		function step(op) {
+			if (f) throw new TypeError("Generator is already executing.");
+			while (_) try {
+				if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+				if (y = 0, t) op = [op[0] & 2, t.value];
+				switch (op[0]) {
+					case 0:
+					case 1:
+						t = op;
+						break;
+					case 4:
+						_.label++;
+						return {
+							value: op[1],
+							done: false
+						};
+					case 5:
+						_.label++;
+						y = op[1];
+						op = [0];
+						continue;
+					case 7:
+						op = _.ops.pop();
+						_.trys.pop();
+						continue;
+					default:
+						if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+							_ = 0;
+							continue;
+						}
+						if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+							_.label = op[1];
+							break;
+						}
+						if (op[0] === 6 && _.label < t[1]) {
+							_.label = t[1];
+							t = op;
+							break;
+						}
+						if (t && _.label < t[2]) {
+							_.label = t[2];
+							_.ops.push(op);
+							break;
+						}
+						if (t[2]) _.ops.pop();
+						_.trys.pop();
+						continue;
+				}
+				op = body.call(thisArg, _);
+			} catch (e) {
+				op = [6, e];
+				y = 0;
+			} finally {
+				f = t = 0;
+			}
+			if (op[0] & 5) throw op[1];
+			return {
+				value: op[0] ? op[1] : void 0,
+				done: true
+			};
+		}
+	};
+	var __read = exports && exports.__read || function(o, n) {
+		var m = typeof Symbol === "function" && o[Symbol.iterator];
+		if (!m) return o;
+		var i = m.call(o), r, ar = [], e;
+		try {
+			while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+		} catch (error) {
+			e = { error };
+		} finally {
+			try {
+				if (r && !r.done && (m = i["return"])) m.call(i);
+			} finally {
+				if (e) throw e.error;
+			}
+		}
+		return ar;
+	};
+	var __importDefault = exports && exports.__importDefault || function(mod) {
+		return mod && mod.__esModule ? mod : { "default": mod };
+	};
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.flow = void 0;
+	var utility_1 = require_utility();
+	var validator_1 = require_validator();
+	var libsaml_1 = __importDefault(require_libsaml());
+	var extractor_1 = require_extractor();
+	var urn_1 = require_urn();
+	var bindDict = urn_1.wording.binding;
+	var urlParams = urn_1.wording.urlParams;
+	function getDefaultExtractorFields(parserType, assertion) {
+		switch (parserType) {
+			case urn_1.ParserType.SAMLRequest: return extractor_1.loginRequestFields;
+			case urn_1.ParserType.SAMLResponse:
+				if (!assertion) throw new Error("ERR_EMPTY_ASSERTION");
+				return (0, extractor_1.loginResponseFields)(assertion);
+			case urn_1.ParserType.LogoutRequest: return extractor_1.logoutRequestFields;
+			case urn_1.ParserType.LogoutResponse: return extractor_1.logoutResponseFields;
+			default: throw new Error("ERR_UNDEFINED_PARSERTYPE");
+		}
+	}
+	function redirectFlow(options) {
+		return __awaiter(this, void 0, void 0, function() {
+			var request, parserType, self, _a, checkSignature, from, query, octetString, sigAlg, signature, targetEntityMetadata, direction, content, xmlString, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, decodeSigAlg, verified, issuer, extractedProperties;
+			return __generator(this, function(_b) {
+				switch (_b.label) {
+					case 0:
+						request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;
+						query = request.query, octetString = request.octetString;
+						sigAlg = query.SigAlg, signature = query.Signature;
+						targetEntityMetadata = from.entityMeta;
+						direction = libsaml_1.default.getQueryParamByType(parserType);
+						content = query[direction];
+						if (content === void 0) return [2, Promise.reject("ERR_REDIRECT_FLOW_BAD_ARGS")];
+						xmlString = (0, utility_1.inflateString)(decodeURIComponent(content));
+						_b.label = 1;
+					case 1:
+						_b.trys.push([
+							1,
+							3,
+							,
+							4
+						]);
+						return [4, libsaml_1.default.isValidXml(xmlString)];
+					case 2:
+						_b.sent();
+						return [3, 4];
+					case 3:
+						_b.sent();
+						return [2, Promise.reject("ERR_INVALID_XML")];
+					case 4: return [4, checkStatus(xmlString, parserType)];
+					case 5:
+						_b.sent();
+						assertion = "";
+						if (parserType === urlParams.samlResponse) {
+							verifiedDoc = (0, extractor_1.extract)(xmlString, [{
+								key: "assertion",
+								localPath: ["~Response", "Assertion"],
+								attributes: [],
+								context: true
+							}]);
+							if (verifiedDoc && verifiedDoc.assertion) assertion = verifiedDoc.assertion;
+						}
+						extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);
+						parseResult = {
+							samlContent: xmlString,
+							sigAlg: null,
+							extract: (0, extractor_1.extract)(xmlString, extractorFields)
+						};
+						if (checkSignature) {
+							if (!signature || !sigAlg) return [2, Promise.reject("ERR_MISSING_SIG_ALG")];
+							base64Signature = Buffer.from(decodeURIComponent(signature), "base64");
+							decodeSigAlg = decodeURIComponent(sigAlg);
+							verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);
+							if (!verified) return [2, Promise.reject("ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION")];
+							parseResult.sigAlg = decodeSigAlg;
+						}
+						issuer = targetEntityMetadata.getEntityID();
+						extractedProperties = parseResult.extract;
+						if ((parserType === "LogoutResponse" || parserType === "SAMLResponse") && extractedProperties && extractedProperties.issuer !== issuer) return [2, Promise.reject("ERR_UNMATCH_ISSUER")];
+						if (parserType === "SAMLResponse" && extractedProperties.sessionIndex.sessionNotOnOrAfter && !(0, validator_1.verifyTime)(void 0, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_EXPIRED_SESSION")];
+						if (parserType === "SAMLResponse" && extractedProperties.conditions && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_SUBJECT_UNCONFIRMED")];
+						return [2, Promise.resolve(parseResult)];
+				}
+			});
+		});
+	}
+	function postFlow(options) {
+		return __awaiter(this, void 0, void 0, function() {
+			var request, from, self, parserType, _a, checkSignature, body, direction, encodedRequest, samlContent, verificationOptions, decryptRequired, extractorFields, _b, verified, verifiedAssertionNode, result, result, decryptedDoc, _c, decryptedDocVerified, verifiedDecryptedAssertion, parseResult, targetEntityMetadata, issuer, extractedProperties;
+			return __generator(this, function(_d) {
+				switch (_d.label) {
+					case 0:
+						request = options.request, from = options.from, self = options.self, parserType = options.parserType, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a;
+						body = request.body;
+						direction = libsaml_1.default.getQueryParamByType(parserType);
+						encodedRequest = body[direction];
+						samlContent = String((0, utility_1.base64Decode)(encodedRequest));
+						verificationOptions = {
+							metadata: from.entityMeta,
+							signatureAlgorithm: from.entitySetting.requestSignatureAlgorithm
+						};
+						decryptRequired = from.entitySetting.isAssertionEncrypted;
+						extractorFields = [];
+						return [4, libsaml_1.default.isValidXml(samlContent)];
+					case 1:
+						_d.sent();
+						if (parserType !== urlParams.samlResponse) extractorFields = getDefaultExtractorFields(parserType, null);
+						return [4, checkStatus(samlContent, parserType)];
+					case 2:
+						_d.sent();
+						if (!checkSignature) return [3, 7];
+						_b = __read(libsaml_1.default.verifySignature(samlContent, verificationOptions), 2), verified = _b[0], verifiedAssertionNode = _b[1];
+						if (!(decryptRequired && verified && parserType === "SAMLResponse" && verifiedAssertionNode)) return [3, 4];
+						return [4, libsaml_1.default.decryptAssertion(self, verifiedAssertionNode)];
+					case 3:
+						result = _d.sent();
+						samlContent = result[0];
+						extractorFields = getDefaultExtractorFields(parserType, result[1]);
+						return [3, 7];
+					case 4:
+						if (!(decryptRequired && !verified)) return [3, 6];
+						return [4, libsaml_1.default.decryptAssertion(self, samlContent)];
+					case 5:
+						result = _d.sent();
+						decryptedDoc = result[0];
+						_c = __read(libsaml_1.default.verifySignature(decryptedDoc, verificationOptions), 2), decryptedDocVerified = _c[0], verifiedDecryptedAssertion = _c[1];
+						if (decryptedDocVerified) extractorFields = getDefaultExtractorFields(parserType, verifiedDecryptedAssertion);
+						else return [2, Promise.reject("FAILED_TO_VERIFY_SIGNATURE")];
+						return [3, 7];
+					case 6:
+						if (verified) extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);
+						else return [2, Promise.reject("FAILED_TO_VERIFY_SIGNATURE")];
+						_d.label = 7;
+					case 7:
+						parseResult = {
+							samlContent,
+							extract: (0, extractor_1.extract)(samlContent, extractorFields)
+						};
+						targetEntityMetadata = from.entityMeta;
+						issuer = targetEntityMetadata.getEntityID();
+						extractedProperties = parseResult.extract;
+						if ((parserType === "LogoutResponse" || parserType === "SAMLResponse") && extractedProperties && extractedProperties.issuer !== issuer) return [2, Promise.reject("ERR_UNMATCH_ISSUER")];
+						if (parserType === "SAMLResponse" && extractedProperties.sessionIndex.sessionNotOnOrAfter && !(0, validator_1.verifyTime)(void 0, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_EXPIRED_SESSION")];
+						if (parserType === "SAMLResponse" && extractedProperties.conditions && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_SUBJECT_UNCONFIRMED")];
+						return [2, Promise.resolve(parseResult)];
+				}
+			});
+		});
+	}
+	function postSimpleSignFlow(options) {
+		return __awaiter(this, void 0, void 0, function() {
+			var request, parserType, self, _a, checkSignature, from, body, octetString, targetEntityMetadata, direction, encodedRequest, sigAlg, signature, xmlString, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, verified, issuer, extractedProperties;
+			return __generator(this, function(_b) {
+				switch (_b.label) {
+					case 0:
+						request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;
+						body = request.body, octetString = request.octetString;
+						targetEntityMetadata = from.entityMeta;
+						direction = libsaml_1.default.getQueryParamByType(parserType);
+						encodedRequest = body[direction];
+						sigAlg = body["SigAlg"];
+						signature = body["Signature"];
+						if (encodedRequest === void 0) return [2, Promise.reject("ERR_SIMPLESIGN_FLOW_BAD_ARGS")];
+						xmlString = String((0, utility_1.base64Decode)(encodedRequest));
+						_b.label = 1;
+					case 1:
+						_b.trys.push([
+							1,
+							3,
+							,
+							4
+						]);
+						return [4, libsaml_1.default.isValidXml(xmlString)];
+					case 2:
+						_b.sent();
+						return [3, 4];
+					case 3:
+						_b.sent();
+						return [2, Promise.reject("ERR_INVALID_XML")];
+					case 4: return [4, checkStatus(xmlString, parserType)];
+					case 5:
+						_b.sent();
+						assertion = "";
+						if (parserType === urlParams.samlResponse) {
+							verifiedDoc = (0, extractor_1.extract)(xmlString, [{
+								key: "assertion",
+								localPath: ["~Response", "Assertion"],
+								attributes: [],
+								context: true
+							}]);
+							if (verifiedDoc && verifiedDoc.assertion) assertion = verifiedDoc.assertion;
+						}
+						extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);
+						parseResult = {
+							samlContent: xmlString,
+							sigAlg: null,
+							extract: (0, extractor_1.extract)(xmlString, extractorFields)
+						};
+						if (checkSignature) {
+							if (!signature || !sigAlg) return [2, Promise.reject("ERR_MISSING_SIG_ALG")];
+							base64Signature = Buffer.from(signature, "base64");
+							verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);
+							if (!verified) return [2, Promise.reject("ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION")];
+							parseResult.sigAlg = sigAlg;
+						}
+						issuer = targetEntityMetadata.getEntityID();
+						extractedProperties = parseResult.extract;
+						if ((parserType === "LogoutResponse" || parserType === "SAMLResponse") && extractedProperties && extractedProperties.issuer !== issuer) return [2, Promise.reject("ERR_UNMATCH_ISSUER")];
+						if (parserType === "SAMLResponse" && extractedProperties.sessionIndex.sessionNotOnOrAfter && !(0, validator_1.verifyTime)(void 0, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_EXPIRED_SESSION")];
+						if (parserType === "SAMLResponse" && extractedProperties.conditions && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_SUBJECT_UNCONFIRMED")];
+						return [2, Promise.resolve(parseResult)];
+				}
+			});
+		});
+	}
+	function checkStatus(content, parserType) {
+		if (parserType !== urlParams.samlResponse && parserType !== urlParams.logoutResponse) return Promise.resolve("SKIPPED");
+		var fields = parserType === urlParams.samlResponse ? extractor_1.loginResponseStatusFields : extractor_1.logoutResponseStatusFields;
+		var _a = (0, extractor_1.extract)(content, fields), top = _a.top, second = _a.second;
+		if (top === urn_1.StatusCode.Success) return Promise.resolve("OK");
+		if (!top) throw new Error("ERR_UNDEFINED_STATUS");
+		throw new Error("ERR_FAILED_STATUS with top tier code: ".concat(top, ", second tier code: ").concat(second));
+	}
+	function flow(options) {
+		var binding = options.binding;
+		var parserType = options.parserType;
+		options.supportBindings = [
+			urn_1.BindingNamespace.Redirect,
+			urn_1.BindingNamespace.Post,
+			urn_1.BindingNamespace.SimpleSign
+		];
+		if (parserType === urn_1.ParserType.SAMLResponse) options.supportBindings = [
+			urn_1.BindingNamespace.Post,
+			urn_1.BindingNamespace.Redirect,
+			urn_1.BindingNamespace.SimpleSign
+		];
+		if (binding === bindDict.post) return postFlow(options);
+		if (binding === bindDict.redirect) return redirectFlow(options);
+		if (binding === bindDict.simpleSign) return postSimpleSignFlow(options);
+		return Promise.reject("ERR_UNEXPECTED_FLOW");
+	}
+	exports.flow = flow;
+}) });
+
+//#endregion
+export default require_flow();
+
+export { require_flow };
+//# sourceMappingURL=flow.mjs.map

package/dist/esm/node_modules/samlify/build/src/flow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.mjs","names":[],"sources":["../../../../../../../../node_modules/samlify/build/src/flow.js"],"sourcesContent":["\"use strict\";\nvar __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {\n    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }\n    return new (P || (P = Promise))(function (resolve, reject) {\n        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }\n        function rejected(value) { try { step(generator[\"throw\"](value)); } catch (e) { reject(e); } }\n        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }\n        step((generator = generator.apply(thisArg, _arguments || [])).next());\n    });\n};\nvar __generator = (this && this.__generator) || function (thisArg, body) {\n    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;\n    return g = { next: verb(0), \"throw\": verb(1), \"return\": verb(2) }, typeof Symbol === \"function\" && (g[Symbol.iterator] = function() { return this; }), g;\n    function verb(n) { return function (v) { return step([n, v]); }; }\n    function step(op) {\n        if (f) throw new TypeError(\"Generator is already executing.\");\n        while (_) try {\n            if (f = 1, y && (t = op[0] & 2 ? y[\"return\"] : op[0] ? y[\"throw\"] || ((t = y[\"return\"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;\n            if (y = 0, t) op = [op[0] & 2, t.value];\n            switch (op[0]) {\n                case 0: case 1: t = op; break;\n                case 4: _.label++; return { value: op[1], done: false };\n                case 5: _.label++; y = op[1]; op = [0]; continue;\n                case 7: op = _.ops.pop(); _.trys.pop(); continue;\n                default:\n                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }\n                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }\n                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }\n                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }\n                    if (t[2]) _.ops.pop();\n                    _.trys.pop(); continue;\n            }\n            op = body.call(thisArg, _);\n        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }\n        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };\n    }\n};\nvar __read = (this && this.__read) || function (o, n) {\n    var m = typeof Symbol === \"function\" && o[Symbol.iterator];\n    if (!m) return o;\n    var i = m.call(o), r, ar = [], e;\n    try {\n        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);\n    }\n    catch (error) { e = { error: error }; }\n    finally {\n        try {\n            if (r && !r.done && (m = i[\"return\"])) m.call(i);\n        }\n        finally { if (e) throw e.error; }\n    }\n    return ar;\n};\nvar __importDefault = (this && this.__importDefault) || function (mod) {\n    return (mod && mod.__esModule) ? mod : { \"default\": mod };\n};\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.flow = void 0;\nvar utility_1 = require(\"./utility\");\nvar validator_1 = require(\"./validator\");\nvar libsaml_1 = __importDefault(require(\"./libsaml\"));\nvar extractor_1 = require(\"./extractor\");\nvar urn_1 = require(\"./urn\");\nvar bindDict = urn_1.wording.binding;\nvar urlParams = urn_1.wording.urlParams;\n// get the default extractor fields based on the parserType\nfunction getDefaultExtractorFields(parserType, assertion) {\n    switch (parserType) {\n        case urn_1.ParserType.SAMLRequest:\n            return extractor_1.loginRequestFields;\n        case urn_1.ParserType.SAMLResponse:\n            if (!assertion) {\n                // unexpected hit\n                throw new Error('ERR_EMPTY_ASSERTION');\n            }\n            return (0, extractor_1.loginResponseFields)(assertion);\n        case urn_1.ParserType.LogoutRequest:\n            return extractor_1.logoutRequestFields;\n        case urn_1.ParserType.LogoutResponse:\n            return extractor_1.logoutResponseFields;\n        default:\n            throw new Error('ERR_UNDEFINED_PARSERTYPE');\n    }\n}\n// proceed the redirect binding flow\nfunction redirectFlow(options) {\n    return __awaiter(this, void 0, void 0, function () {\n        var request, parserType, self, _a, checkSignature, from, query, octetString, sigAlg, signature, targetEntityMetadata, direction, content, xmlString, e_1, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, decodeSigAlg, verified, issuer, extractedProperties;\n        return __generator(this, function (_b) {\n            switch (_b.label) {\n                case 0:\n                    request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;\n                    query = request.query, octetString = request.octetString;\n                    sigAlg = query.SigAlg, signature = query.Signature;\n                    targetEntityMetadata = from.entityMeta;\n                    direction = libsaml_1.default.getQueryParamByType(parserType);\n                    content = query[direction];\n                    // query must contain the saml content\n                    if (content === undefined) {\n                        return [2 /*return*/, Promise.reject('ERR_REDIRECT_FLOW_BAD_ARGS')];\n                    }\n                    xmlString = (0, utility_1.inflateString)(decodeURIComponent(content));\n                    _b.label = 1;\n                case 1:\n                    _b.trys.push([1, 3, , 4]);\n                    return [4 /*yield*/, libsaml_1.default.isValidXml(xmlString)];\n                case 2:\n                    _b.sent();\n                    return [3 /*break*/, 4];\n                case 3:\n                    e_1 = _b.sent();\n                    return [2 /*return*/, Promise.reject('ERR_INVALID_XML')];\n                case 4: \n                // check status based on different scenarios\n                return [4 /*yield*/, checkStatus(xmlString, parserType)];\n                case 5:\n                    // check status based on different scenarios\n                    _b.sent();\n                    assertion = '';\n                    if (parserType === urlParams.samlResponse) {\n                        verifiedDoc = (0, extractor_1.extract)(xmlString, [{\n                                key: 'assertion',\n                                localPath: ['~Response', 'Assertion'],\n                                attributes: [],\n                                context: true\n                            }]);\n                        if (verifiedDoc && verifiedDoc.assertion) {\n                            assertion = verifiedDoc.assertion;\n                        }\n                    }\n                    extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);\n                    parseResult = {\n                        samlContent: xmlString,\n                        sigAlg: null,\n                        extract: (0, extractor_1.extract)(xmlString, extractorFields),\n                    };\n                    // see if signature check is required\n                    // only verify message signature is enough\n                    if (checkSignature) {\n                        if (!signature || !sigAlg) {\n                            return [2 /*return*/, Promise.reject('ERR_MISSING_SIG_ALG')];\n                        }\n                        base64Signature = Buffer.from(decodeURIComponent(signature), 'base64');\n                        decodeSigAlg = decodeURIComponent(sigAlg);\n                        verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);\n                        if (!verified) {\n                            // Fail to verify message signature\n                            return [2 /*return*/, Promise.reject('ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION')];\n                        }\n                        parseResult.sigAlg = decodeSigAlg;\n                    }\n                    issuer = targetEntityMetadata.getEntityID();\n                    extractedProperties = parseResult.extract;\n                    // unmatched issuer\n                    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')\n                        && extractedProperties\n                        && extractedProperties.issuer !== issuer) {\n                        return [2 /*return*/, Promise.reject('ERR_UNMATCH_ISSUER')];\n                    }\n                    // invalid session time\n                    // only run the verifyTime when `SessionNotOnOrAfter` exists\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.sessionIndex.sessionNotOnOrAfter\n                        && !(0, validator_1.verifyTime)(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_EXPIRED_SESSION')];\n                    }\n                    // invalid time\n                    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.conditions\n                        && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_SUBJECT_UNCONFIRMED')];\n                    }\n                    return [2 /*return*/, Promise.resolve(parseResult)];\n            }\n        });\n    });\n}\n// proceed the post flow\nfunction postFlow(options) {\n    return __awaiter(this, void 0, void 0, function () {\n        var request, from, self, parserType, _a, checkSignature, body, direction, encodedRequest, samlContent, verificationOptions, decryptRequired, extractorFields, _b, verified, verifiedAssertionNode, result, result, decryptedDoc, _c, decryptedDocVerified, verifiedDecryptedAssertion, parseResult, targetEntityMetadata, issuer, extractedProperties;\n        return __generator(this, function (_d) {\n            switch (_d.label) {\n                case 0:\n                    request = options.request, from = options.from, self = options.self, parserType = options.parserType, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a;\n                    body = request.body;\n                    direction = libsaml_1.default.getQueryParamByType(parserType);\n                    encodedRequest = body[direction];\n                    samlContent = String((0, utility_1.base64Decode)(encodedRequest));\n                    verificationOptions = {\n                        metadata: from.entityMeta,\n                        signatureAlgorithm: from.entitySetting.requestSignatureAlgorithm,\n                    };\n                    decryptRequired = from.entitySetting.isAssertionEncrypted;\n                    extractorFields = [];\n                    // validate the xml first\n                    return [4 /*yield*/, libsaml_1.default.isValidXml(samlContent)];\n                case 1:\n                    // validate the xml first\n                    _d.sent();\n                    if (parserType !== urlParams.samlResponse) {\n                        extractorFields = getDefaultExtractorFields(parserType, null);\n                    }\n                    // check status based on different scenarios\n                    return [4 /*yield*/, checkStatus(samlContent, parserType)];\n                case 2:\n                    // check status based on different scenarios\n                    _d.sent();\n                    if (!checkSignature) return [3 /*break*/, 7];\n                    _b = __read(libsaml_1.default.verifySignature(samlContent, verificationOptions), 2), verified = _b[0], verifiedAssertionNode = _b[1];\n                    if (!(decryptRequired && verified && parserType === 'SAMLResponse' && verifiedAssertionNode)) return [3 /*break*/, 4];\n                    return [4 /*yield*/, libsaml_1.default.decryptAssertion(self, verifiedAssertionNode)];\n                case 3:\n                    result = _d.sent();\n                    samlContent = result[0];\n                    // extractor depends on signed content\n                    extractorFields = getDefaultExtractorFields(parserType, result[1]);\n                    return [3 /*break*/, 7];\n                case 4:\n                    if (!(decryptRequired && !verified)) return [3 /*break*/, 6];\n                    return [4 /*yield*/, libsaml_1.default.decryptAssertion(self, samlContent)];\n                case 5:\n                    result = _d.sent();\n                    decryptedDoc = result[0];\n                    _c = __read(libsaml_1.default.verifySignature(decryptedDoc, verificationOptions), 2), decryptedDocVerified = _c[0], verifiedDecryptedAssertion = _c[1];\n                    if (decryptedDocVerified) {\n                        // extractor depends on signed content\n                        extractorFields = getDefaultExtractorFields(parserType, verifiedDecryptedAssertion);\n                    }\n                    else {\n                        return [2 /*return*/, Promise.reject('FAILED_TO_VERIFY_SIGNATURE')];\n                    }\n                    return [3 /*break*/, 7];\n                case 6:\n                    if (verified) {\n                        // extractor depends on signed content\n                        extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);\n                    }\n                    else {\n                        return [2 /*return*/, Promise.reject('FAILED_TO_VERIFY_SIGNATURE')];\n                    }\n                    _d.label = 7;\n                case 7:\n                    parseResult = {\n                        samlContent: samlContent,\n                        extract: (0, extractor_1.extract)(samlContent, extractorFields),\n                    };\n                    targetEntityMetadata = from.entityMeta;\n                    issuer = targetEntityMetadata.getEntityID();\n                    extractedProperties = parseResult.extract;\n                    // unmatched issuer\n                    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')\n                        && extractedProperties\n                        && extractedProperties.issuer !== issuer) {\n                        return [2 /*return*/, Promise.reject('ERR_UNMATCH_ISSUER')];\n                    }\n                    // invalid session time\n                    // only run the verifyTime when `SessionNotOnOrAfter` exists\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.sessionIndex.sessionNotOnOrAfter\n                        && !(0, validator_1.verifyTime)(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_EXPIRED_SESSION')];\n                    }\n                    // invalid time\n                    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.conditions\n                        && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_SUBJECT_UNCONFIRMED')];\n                    }\n                    return [2 /*return*/, Promise.resolve(parseResult)];\n            }\n        });\n    });\n}\n// proceed the post simple sign binding flow\nfunction postSimpleSignFlow(options) {\n    return __awaiter(this, void 0, void 0, function () {\n        var request, parserType, self, _a, checkSignature, from, body, octetString, targetEntityMetadata, direction, encodedRequest, sigAlg, signature, xmlString, e_2, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, verified, issuer, extractedProperties;\n        return __generator(this, function (_b) {\n            switch (_b.label) {\n                case 0:\n                    request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;\n                    body = request.body, octetString = request.octetString;\n                    targetEntityMetadata = from.entityMeta;\n                    direction = libsaml_1.default.getQueryParamByType(parserType);\n                    encodedRequest = body[direction];\n                    sigAlg = body['SigAlg'];\n                    signature = body['Signature'];\n                    // query must contain the saml content\n                    if (encodedRequest === undefined) {\n                        return [2 /*return*/, Promise.reject('ERR_SIMPLESIGN_FLOW_BAD_ARGS')];\n                    }\n                    xmlString = String((0, utility_1.base64Decode)(encodedRequest));\n                    _b.label = 1;\n                case 1:\n                    _b.trys.push([1, 3, , 4]);\n                    return [4 /*yield*/, libsaml_1.default.isValidXml(xmlString)];\n                case 2:\n                    _b.sent();\n                    return [3 /*break*/, 4];\n                case 3:\n                    e_2 = _b.sent();\n                    return [2 /*return*/, Promise.reject('ERR_INVALID_XML')];\n                case 4: \n                // check status based on different scenarios\n                return [4 /*yield*/, checkStatus(xmlString, parserType)];\n                case 5:\n                    // check status based on different scenarios\n                    _b.sent();\n                    assertion = '';\n                    if (parserType === urlParams.samlResponse) {\n                        verifiedDoc = (0, extractor_1.extract)(xmlString, [{\n                                key: 'assertion',\n                                localPath: ['~Response', 'Assertion'],\n                                attributes: [],\n                                context: true\n                            }]);\n                        if (verifiedDoc && verifiedDoc.assertion) {\n                            assertion = verifiedDoc.assertion;\n                        }\n                    }\n                    extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);\n                    parseResult = {\n                        samlContent: xmlString,\n                        sigAlg: null,\n                        extract: (0, extractor_1.extract)(xmlString, extractorFields),\n                    };\n                    // see if signature check is required\n                    // only verify message signature is enough\n                    if (checkSignature) {\n                        if (!signature || !sigAlg) {\n                            return [2 /*return*/, Promise.reject('ERR_MISSING_SIG_ALG')];\n                        }\n                        base64Signature = Buffer.from(signature, 'base64');\n                        verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);\n                        if (!verified) {\n                            // Fail to verify message signature\n                            return [2 /*return*/, Promise.reject('ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION')];\n                        }\n                        parseResult.sigAlg = sigAlg;\n                    }\n                    issuer = targetEntityMetadata.getEntityID();\n                    extractedProperties = parseResult.extract;\n                    // unmatched issuer\n                    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')\n                        && extractedProperties\n                        && extractedProperties.issuer !== issuer) {\n                        return [2 /*return*/, Promise.reject('ERR_UNMATCH_ISSUER')];\n                    }\n                    // invalid session time\n                    // only run the verifyTime when `SessionNotOnOrAfter` exists\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.sessionIndex.sessionNotOnOrAfter\n                        && !(0, validator_1.verifyTime)(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_EXPIRED_SESSION')];\n                    }\n                    // invalid time\n                    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.conditions\n                        && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_SUBJECT_UNCONFIRMED')];\n                    }\n                    return [2 /*return*/, Promise.resolve(parseResult)];\n            }\n        });\n    });\n}\nfunction checkStatus(content, parserType) {\n    // only check response parser\n    if (parserType !== urlParams.samlResponse && parserType !== urlParams.logoutResponse) {\n        return Promise.resolve('SKIPPED');\n    }\n    var fields = parserType === urlParams.samlResponse\n        ? extractor_1.loginResponseStatusFields\n        : extractor_1.logoutResponseStatusFields;\n    var _a = (0, extractor_1.extract)(content, fields), top = _a.top, second = _a.second;\n    // only resolve when top-tier status code is success\n    if (top === urn_1.StatusCode.Success) {\n        return Promise.resolve('OK');\n    }\n    if (!top) {\n        throw new Error('ERR_UNDEFINED_STATUS');\n    }\n    // returns a detailed error for two-tier error code\n    throw new Error(\"ERR_FAILED_STATUS with top tier code: \".concat(top, \", second tier code: \").concat(second));\n}\nfunction flow(options) {\n    var binding = options.binding;\n    var parserType = options.parserType;\n    options.supportBindings = [urn_1.BindingNamespace.Redirect, urn_1.BindingNamespace.Post, urn_1.BindingNamespace.SimpleSign];\n    // saml response  allows POST, REDIRECT\n    if (parserType === urn_1.ParserType.SAMLResponse) {\n        options.supportBindings = [urn_1.BindingNamespace.Post, urn_1.BindingNamespace.Redirect, urn_1.BindingNamespace.SimpleSign];\n    }\n    if (binding === bindDict.post) {\n        return postFlow(options);\n    }\n    if (binding === bindDict.redirect) {\n        return redirectFlow(options);\n    }\n    if (binding === bindDict.simpleSign) {\n        return postSimpleSignFlow(options);\n    }\n    return Promise.reject('ERR_UNEXPECTED_FLOW');\n}\nexports.flow = flow;\n//# sourceMappingURL=flow.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;CACA,IAAI,+BAA0B,aAAc,SAAU,SAAS,YAAY,GAAG,WAAW;EACrF,SAAS,MAAM,OAAO;AAAE,UAAO,iBAAiB,IAAI,QAAQ,IAAI,EAAE,SAAU,SAAS;AAAE,YAAQ,MAAM;KAAI;;AACzG,SAAO,KAAK,MAAM,IAAI,UAAU,SAAU,SAAS,QAAQ;GACvD,SAAS,UAAU,OAAO;AAAE,QAAI;AAAE,UAAK,UAAU,KAAK,MAAM,CAAC;aAAW,GAAG;AAAE,YAAO,EAAE;;;GACtF,SAAS,SAAS,OAAO;AAAE,QAAI;AAAE,UAAK,UAAU,SAAS,MAAM,CAAC;aAAW,GAAG;AAAE,YAAO,EAAE;;;GACzF,SAAS,KAAK,QAAQ;AAAE,WAAO,OAAO,QAAQ,OAAO,MAAM,GAAG,MAAM,OAAO,MAAM,CAAC,KAAK,WAAW,SAAS;;AAC3G,SAAM,YAAY,UAAU,MAAM,SAAS,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC;IACvE;;CAEN,IAAI,iCAA4B,eAAgB,SAAU,SAAS,MAAM;EACrE,IAAI,IAAI;GAAE,OAAO;GAAG,MAAM,WAAW;AAAE,QAAI,EAAE,KAAK,EAAG,OAAM,EAAE;AAAI,WAAO,EAAE;;GAAO,MAAM,EAAE;GAAE,KAAK,EAAE;GAAE,EAAE,GAAG,GAAG,GAAG;AAC/G,SAAO,IAAI;GAAE,MAAM,KAAK,EAAE;GAAE,SAAS,KAAK,EAAE;GAAE,UAAU,KAAK,EAAE;GAAE,EAAE,OAAO,WAAW,eAAe,EAAE,OAAO,YAAY,WAAW;AAAE,UAAO;MAAU;EACvJ,SAAS,KAAK,GAAG;AAAE,UAAO,SAAU,GAAG;AAAE,WAAO,KAAK,CAAC,GAAG,EAAE,CAAC;;;EAC5D,SAAS,KAAK,IAAI;AACd,OAAI,EAAG,OAAM,IAAI,UAAU,kCAAkC;AAC7D,UAAO,EAAG,KAAI;AACV,QAAI,IAAI,GAAG,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,YAAY,GAAG,KAAK,EAAE,cAAc,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,GAAG,GAAG,GAAG,EAAE,KAAM,QAAO;AAC3J,QAAI,IAAI,GAAG,EAAG,MAAK,CAAC,GAAG,KAAK,GAAG,EAAE,MAAM;AACvC,YAAQ,GAAG,IAAX;KACI,KAAK;KAAG,KAAK;AAAG,UAAI;AAAI;KACxB,KAAK;AAAG,QAAE;AAAS,aAAO;OAAE,OAAO,GAAG;OAAI,MAAM;OAAO;KACvD,KAAK;AAAG,QAAE;AAAS,UAAI,GAAG;AAAI,WAAK,CAAC,EAAE;AAAE;KACxC,KAAK;AAAG,WAAK,EAAE,IAAI,KAAK;AAAE,QAAE,KAAK,KAAK;AAAE;KACxC;AACI,UAAI,EAAE,IAAI,EAAE,MAAM,IAAI,EAAE,SAAS,KAAK,EAAE,EAAE,SAAS,QAAQ,GAAG,OAAO,KAAK,GAAG,OAAO,IAAI;AAAE,WAAI;AAAG;;AACjG,UAAI,GAAG,OAAO,MAAM,CAAC,KAAM,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,KAAM;AAAE,SAAE,QAAQ,GAAG;AAAI;;AAC9E,UAAI,GAAG,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI;AAAE,SAAE,QAAQ,EAAE;AAAI,WAAI;AAAI;;AAC7D,UAAI,KAAK,EAAE,QAAQ,EAAE,IAAI;AAAE,SAAE,QAAQ,EAAE;AAAI,SAAE,IAAI,KAAK,GAAG;AAAE;;AAC3D,UAAI,EAAE,GAAI,GAAE,IAAI,KAAK;AACrB,QAAE,KAAK,KAAK;AAAE;;AAEtB,SAAK,KAAK,KAAK,SAAS,EAAE;YACrB,GAAG;AAAE,SAAK,CAAC,GAAG,EAAE;AAAE,QAAI;aAAa;AAAE,QAAI,IAAI;;AACtD,OAAI,GAAG,KAAK,EAAG,OAAM,GAAG;AAAI,UAAO;IAAE,OAAO,GAAG,KAAK,GAAG,KAAK,KAAK;IAAG,MAAM;IAAM;;;CAGxF,IAAI,4BAAuB,UAAW,SAAU,GAAG,GAAG;EAClD,IAAI,IAAI,OAAO,WAAW,cAAc,EAAE,OAAO;AACjD,MAAI,CAAC,EAAG,QAAO;EACf,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE;AAC/B,MAAI;AACA,WAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAM,IAAG,KAAK,EAAE,MAAM;WAEvE,OAAO;AAAE,OAAI,EAAS,OAAO;YAC5B;AACJ,OAAI;AACA,QAAI,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,WAAY,GAAE,KAAK,EAAE;aAE5C;AAAE,QAAI,EAAG,OAAM,EAAE;;;AAE7B,SAAO;;CAEX,IAAI,qCAAgC,mBAAoB,SAAU,KAAK;AACnE,SAAQ,OAAO,IAAI,aAAc,MAAM,EAAE,WAAW,KAAK;;AAE7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,OAAO,KAAK;CACpB,IAAI;CACJ,IAAI;CACJ,IAAI,YAAY,kCAAqC;CACrD,IAAI;CACJ,IAAI;CACJ,IAAI,WAAW,MAAM,QAAQ;CAC7B,IAAI,YAAY,MAAM,QAAQ;CAE9B,SAAS,0BAA0B,YAAY,WAAW;AACtD,UAAQ,YAAR;GACI,KAAK,MAAM,WAAW,YAClB,QAAO,YAAY;GACvB,KAAK,MAAM,WAAW;AAClB,QAAI,CAAC,UAED,OAAM,IAAI,MAAM,sBAAsB;AAE1C,YAAQ,GAAG,YAAY,qBAAqB,UAAU;GAC1D,KAAK,MAAM,WAAW,cAClB,QAAO,YAAY;GACvB,KAAK,MAAM,WAAW,eAClB,QAAO,YAAY;GACvB,QACI,OAAM,IAAI,MAAM,2BAA2B;;;CAIvD,SAAS,aAAa,SAAS;AAC3B,SAAO,UAAU,MAAM,KAAK,GAAG,KAAK,GAAG,WAAY;GAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,gBAAgB,MAAM,OAAO,aAAa,QAAQ,WAAW,sBAAsB,WAAW,SAAS,WAAgB,WAAW,aAAa,iBAAiB,aAAa,iBAAiB,cAAc,UAAU,QAAQ;AACjQ,UAAO,YAAY,MAAM,SAAU,IAAI;AACnC,YAAQ,GAAG,OAAX;KACI,KAAK;AACD,gBAAU,QAAQ,SAAS,aAAa,QAAQ,YAAY,OAAO,QAAQ,MAAM,KAAK,QAAQ,gBAAgB,iBAAiB,OAAO,KAAK,IAAI,OAAO,IAAI,OAAO,QAAQ;AACzK,cAAQ,QAAQ,OAAO,cAAc,QAAQ;AAC7C,eAAS,MAAM,QAAQ,YAAY,MAAM;AACzC,6BAAuB,KAAK;AAC5B,kBAAY,UAAU,QAAQ,oBAAoB,WAAW;AAC7D,gBAAU,MAAM;AAEhB,UAAI,YAAY,OACZ,QAAO,CAAC,GAAc,QAAQ,OAAO,6BAA6B,CAAC;AAEvE,mBAAa,GAAG,UAAU,eAAe,mBAAmB,QAAQ,CAAC;AACrE,SAAG,QAAQ;KACf,KAAK;AACD,SAAG,KAAK,KAAK;OAAC;OAAG;;OAAK;OAAE,CAAC;AACzB,aAAO,CAAC,GAAa,UAAU,QAAQ,WAAW,UAAU,CAAC;KACjE,KAAK;AACD,SAAG,MAAM;AACT,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,MAAM,GAAG,MAAM;AACf,aAAO,CAAC,GAAc,QAAQ,OAAO,kBAAkB,CAAC;KAC5D,KAAK,EAEL,QAAO,CAAC,GAAa,YAAY,WAAW,WAAW,CAAC;KACxD,KAAK;AAED,SAAG,MAAM;AACT,kBAAY;AACZ,UAAI,eAAe,UAAU,cAAc;AACvC,sBAAe,GAAG,YAAY,SAAS,WAAW,CAAC;QAC3C,KAAK;QACL,WAAW,CAAC,aAAa,YAAY;QACrC,YAAY,EAAE;QACd,SAAS;QACZ,CAAC,CAAC;AACP,WAAI,eAAe,YAAY,UAC3B,aAAY,YAAY;;AAGhC,wBAAkB,0BAA0B,YAAY,UAAU,SAAS,IAAI,YAAY,KAAK;AAChG,oBAAc;OACV,aAAa;OACb,QAAQ;OACR,UAAU,GAAG,YAAY,SAAS,WAAW,gBAAgB;OAChE;AAGD,UAAI,gBAAgB;AAChB,WAAI,CAAC,aAAa,CAAC,OACf,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAEhE,yBAAkB,OAAO,KAAK,mBAAmB,UAAU,EAAE,SAAS;AACtE,sBAAe,mBAAmB,OAAO;AACzC,kBAAW,UAAU,QAAQ,uBAAuB,sBAAsB,aAAa,iBAAiB,OAAO;AAC/G,WAAI,CAAC,SAED,QAAO,CAAC,GAAc,QAAQ,OAAO,4CAA4C,CAAC;AAEtF,mBAAY,SAAS;;AAEzB,eAAS,qBAAqB,aAAa;AAC3C,4BAAsB,YAAY;AAElC,WAAK,eAAe,oBAAoB,eAAe,mBAChD,uBACA,oBAAoB,WAAW,OAClC,QAAO,CAAC,GAAc,QAAQ,OAAO,qBAAqB,CAAC;AAI/D,UAAI,eAAe,kBACZ,oBAAoB,aAAa,uBACjC,EAAE,GAAG,YAAY,YAAY,QAAW,oBAAoB,aAAa,qBAAqB,KAAK,cAAc,YAAY,CAChI,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAIhE,UAAI,eAAe,kBACZ,oBAAoB,cACpB,EAAE,GAAG,YAAY,YAAY,oBAAoB,WAAW,WAAW,oBAAoB,WAAW,cAAc,KAAK,cAAc,YAAY,CACtJ,QAAO,CAAC,GAAc,QAAQ,OAAO,0BAA0B,CAAC;AAEpE,aAAO,CAAC,GAAc,QAAQ,QAAQ,YAAY,CAAC;;KAE7D;IACJ;;CAGN,SAAS,SAAS,SAAS;AACvB,SAAO,UAAU,MAAM,KAAK,GAAG,KAAK,GAAG,WAAY;GAC/C,IAAI,SAAS,MAAM,MAAM,YAAY,IAAI,gBAAgB,MAAM,WAAW,gBAAgB,aAAa,qBAAqB,iBAAiB,iBAAiB,IAAI,UAAU,uBAAuB,QAAQ,QAAQ,cAAc,IAAI,sBAAsB,4BAA4B,aAAa,sBAAsB,QAAQ;AAClU,UAAO,YAAY,MAAM,SAAU,IAAI;AACnC,YAAQ,GAAG,OAAX;KACI,KAAK;AACD,gBAAU,QAAQ,SAAS,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,aAAa,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,iBAAiB,OAAO,KAAK,IAAI,OAAO;AAC3K,aAAO,QAAQ;AACf,kBAAY,UAAU,QAAQ,oBAAoB,WAAW;AAC7D,uBAAiB,KAAK;AACtB,oBAAc,QAAQ,GAAG,UAAU,cAAc,eAAe,CAAC;AACjE,4BAAsB;OAClB,UAAU,KAAK;OACf,oBAAoB,KAAK,cAAc;OAC1C;AACD,wBAAkB,KAAK,cAAc;AACrC,wBAAkB,EAAE;AAEpB,aAAO,CAAC,GAAa,UAAU,QAAQ,WAAW,YAAY,CAAC;KACnE,KAAK;AAED,SAAG,MAAM;AACT,UAAI,eAAe,UAAU,aACzB,mBAAkB,0BAA0B,YAAY,KAAK;AAGjE,aAAO,CAAC,GAAa,YAAY,aAAa,WAAW,CAAC;KAC9D,KAAK;AAED,SAAG,MAAM;AACT,UAAI,CAAC,eAAgB,QAAO,CAAC,GAAa,EAAE;AAC5C,WAAK,OAAO,UAAU,QAAQ,gBAAgB,aAAa,oBAAoB,EAAE,EAAE,EAAE,WAAW,GAAG,IAAI,wBAAwB,GAAG;AAClI,UAAI,EAAE,mBAAmB,YAAY,eAAe,kBAAkB,uBAAwB,QAAO,CAAC,GAAa,EAAE;AACrH,aAAO,CAAC,GAAa,UAAU,QAAQ,iBAAiB,MAAM,sBAAsB,CAAC;KACzF,KAAK;AACD,eAAS,GAAG,MAAM;AAClB,oBAAc,OAAO;AAErB,wBAAkB,0BAA0B,YAAY,OAAO,GAAG;AAClE,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,UAAI,EAAE,mBAAmB,CAAC,UAAW,QAAO,CAAC,GAAa,EAAE;AAC5D,aAAO,CAAC,GAAa,UAAU,QAAQ,iBAAiB,MAAM,YAAY,CAAC;KAC/E,KAAK;AACD,eAAS,GAAG,MAAM;AAClB,qBAAe,OAAO;AACtB,WAAK,OAAO,UAAU,QAAQ,gBAAgB,cAAc,oBAAoB,EAAE,EAAE,EAAE,uBAAuB,GAAG,IAAI,6BAA6B,GAAG;AACpJ,UAAI,qBAEA,mBAAkB,0BAA0B,YAAY,2BAA2B;UAGnF,QAAO,CAAC,GAAc,QAAQ,OAAO,6BAA6B,CAAC;AAEvE,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,UAAI,SAEA,mBAAkB,0BAA0B,YAAY,sBAAsB;UAG9E,QAAO,CAAC,GAAc,QAAQ,OAAO,6BAA6B,CAAC;AAEvE,SAAG,QAAQ;KACf,KAAK;AACD,oBAAc;OACG;OACb,UAAU,GAAG,YAAY,SAAS,aAAa,gBAAgB;OAClE;AACD,6BAAuB,KAAK;AAC5B,eAAS,qBAAqB,aAAa;AAC3C,4BAAsB,YAAY;AAElC,WAAK,eAAe,oBAAoB,eAAe,mBAChD,uBACA,oBAAoB,WAAW,OAClC,QAAO,CAAC,GAAc,QAAQ,OAAO,qBAAqB,CAAC;AAI/D,UAAI,eAAe,kBACZ,oBAAoB,aAAa,uBACjC,EAAE,GAAG,YAAY,YAAY,QAAW,oBAAoB,aAAa,qBAAqB,KAAK,cAAc,YAAY,CAChI,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAIhE,UAAI,eAAe,kBACZ,oBAAoB,cACpB,EAAE,GAAG,YAAY,YAAY,oBAAoB,WAAW,WAAW,oBAAoB,WAAW,cAAc,KAAK,cAAc,YAAY,CACtJ,QAAO,CAAC,GAAc,QAAQ,OAAO,0BAA0B,CAAC;AAEpE,aAAO,CAAC,GAAc,QAAQ,QAAQ,YAAY,CAAC;;KAE7D;IACJ;;CAGN,SAAS,mBAAmB,SAAS;AACjC,SAAO,UAAU,MAAM,KAAK,GAAG,KAAK,GAAG,WAAY;GAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,gBAAgB,MAAM,MAAM,aAAa,sBAAsB,WAAW,gBAAgB,QAAQ,WAAW,WAAgB,WAAW,aAAa,iBAAiB,aAAa,iBAAiB,UAAU,QAAQ;AACzP,UAAO,YAAY,MAAM,SAAU,IAAI;AACnC,YAAQ,GAAG,OAAX;KACI,KAAK;AACD,gBAAU,QAAQ,SAAS,aAAa,QAAQ,YAAY,OAAO,QAAQ,MAAM,KAAK,QAAQ,gBAAgB,iBAAiB,OAAO,KAAK,IAAI,OAAO,IAAI,OAAO,QAAQ;AACzK,aAAO,QAAQ,MAAM,cAAc,QAAQ;AAC3C,6BAAuB,KAAK;AAC5B,kBAAY,UAAU,QAAQ,oBAAoB,WAAW;AAC7D,uBAAiB,KAAK;AACtB,eAAS,KAAK;AACd,kBAAY,KAAK;AAEjB,UAAI,mBAAmB,OACnB,QAAO,CAAC,GAAc,QAAQ,OAAO,+BAA+B,CAAC;AAEzE,kBAAY,QAAQ,GAAG,UAAU,cAAc,eAAe,CAAC;AAC/D,SAAG,QAAQ;KACf,KAAK;AACD,SAAG,KAAK,KAAK;OAAC;OAAG;;OAAK;OAAE,CAAC;AACzB,aAAO,CAAC,GAAa,UAAU,QAAQ,WAAW,UAAU,CAAC;KACjE,KAAK;AACD,SAAG,MAAM;AACT,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,MAAM,GAAG,MAAM;AACf,aAAO,CAAC,GAAc,QAAQ,OAAO,kBAAkB,CAAC;KAC5D,KAAK,EAEL,QAAO,CAAC,GAAa,YAAY,WAAW,WAAW,CAAC;KACxD,KAAK;AAED,SAAG,MAAM;AACT,kBAAY;AACZ,UAAI,eAAe,UAAU,cAAc;AACvC,sBAAe,GAAG,YAAY,SAAS,WAAW,CAAC;QAC3C,KAAK;QACL,WAAW,CAAC,aAAa,YAAY;QACrC,YAAY,EAAE;QACd,SAAS;QACZ,CAAC,CAAC;AACP,WAAI,eAAe,YAAY,UAC3B,aAAY,YAAY;;AAGhC,wBAAkB,0BAA0B,YAAY,UAAU,SAAS,IAAI,YAAY,KAAK;AAChG,oBAAc;OACV,aAAa;OACb,QAAQ;OACR,UAAU,GAAG,YAAY,SAAS,WAAW,gBAAgB;OAChE;AAGD,UAAI,gBAAgB;AAChB,WAAI,CAAC,aAAa,CAAC,OACf,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAEhE,yBAAkB,OAAO,KAAK,WAAW,SAAS;AAClD,kBAAW,UAAU,QAAQ,uBAAuB,sBAAsB,aAAa,iBAAiB,OAAO;AAC/G,WAAI,CAAC,SAED,QAAO,CAAC,GAAc,QAAQ,OAAO,4CAA4C,CAAC;AAEtF,mBAAY,SAAS;;AAEzB,eAAS,qBAAqB,aAAa;AAC3C,4BAAsB,YAAY;AAElC,WAAK,eAAe,oBAAoB,eAAe,mBAChD,uBACA,oBAAoB,WAAW,OAClC,QAAO,CAAC,GAAc,QAAQ,OAAO,qBAAqB,CAAC;AAI/D,UAAI,eAAe,kBACZ,oBAAoB,aAAa,uBACjC,EAAE,GAAG,YAAY,YAAY,QAAW,oBAAoB,aAAa,qBAAqB,KAAK,cAAc,YAAY,CAChI,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAIhE,UAAI,eAAe,kBACZ,oBAAoB,cACpB,EAAE,GAAG,YAAY,YAAY,oBAAoB,WAAW,WAAW,oBAAoB,WAAW,cAAc,KAAK,cAAc,YAAY,CACtJ,QAAO,CAAC,GAAc,QAAQ,OAAO,0BAA0B,CAAC;AAEpE,aAAO,CAAC,GAAc,QAAQ,QAAQ,YAAY,CAAC;;KAE7D;IACJ;;CAEN,SAAS,YAAY,SAAS,YAAY;AAEtC,MAAI,eAAe,UAAU,gBAAgB,eAAe,UAAU,eAClE,QAAO,QAAQ,QAAQ,UAAU;EAErC,IAAI,SAAS,eAAe,UAAU,eAChC,YAAY,4BACZ,YAAY;EAClB,IAAI,MAAM,GAAG,YAAY,SAAS,SAAS,OAAO,EAAE,MAAM,GAAG,KAAK,SAAS,GAAG;AAE9E,MAAI,QAAQ,MAAM,WAAW,QACzB,QAAO,QAAQ,QAAQ,KAAK;AAEhC,MAAI,CAAC,IACD,OAAM,IAAI,MAAM,uBAAuB;AAG3C,QAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,uBAAuB,CAAC,OAAO,OAAO,CAAC;;CAEhH,SAAS,KAAK,SAAS;EACnB,IAAI,UAAU,QAAQ;EACtB,IAAI,aAAa,QAAQ;AACzB,UAAQ,kBAAkB;GAAC,MAAM,iBAAiB;GAAU,MAAM,iBAAiB;GAAM,MAAM,iBAAiB;GAAW;AAE3H,MAAI,eAAe,MAAM,WAAW,aAChC,SAAQ,kBAAkB;GAAC,MAAM,iBAAiB;GAAM,MAAM,iBAAiB;GAAU,MAAM,iBAAiB;GAAW;AAE/H,MAAI,YAAY,SAAS,KACrB,QAAO,SAAS,QAAQ;AAE5B,MAAI,YAAY,SAAS,SACrB,QAAO,aAAa,QAAQ;AAEhC,MAAI,YAAY,SAAS,WACrB,QAAO,mBAAmB,QAAQ;AAEtC,SAAO,QAAQ,OAAO,sBAAsB;;AAEhD,SAAQ,OAAO"}