@intlayer/backend 7.0.9-canary.0 → 7.0.9-canary.3

package/dist/esm/node_modules/samlify/build/src/binding-post.mjs

@@ -0,0 +1,504 @@
+import { __commonJS } from "../../../../_virtual/rolldown_runtime.mjs";
+import { require_utility } from "./utility.mjs";
+import { require_urn } from "./urn.mjs";
+import { require_libsaml } from "./libsaml.mjs";
+
+//#region ../../node_modules/samlify/build/src/binding-post.js
+var require_binding_post = /* @__PURE__ */ __commonJS({ "../../node_modules/samlify/build/src/binding-post.js": ((exports) => {
+	/**
+	* @file binding-post.ts
+	* @author tngan
+	* @desc Binding-level API, declare the functions using POST binding
+	*/
+	var __assign = exports && exports.__assign || function() {
+		__assign = Object.assign || function(t) {
+			for (var s, i = 1, n = arguments.length; i < n; i++) {
+				s = arguments[i];
+				for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];
+			}
+			return t;
+		};
+		return __assign.apply(this, arguments);
+	};
+	var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+		if (k2 === void 0) k2 = k;
+		var desc = Object.getOwnPropertyDescriptor(m, k);
+		if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {
+			enumerable: true,
+			get: function() {
+				return m[k];
+			}
+		};
+		Object.defineProperty(o, k2, desc);
+	}) : (function(o, m, k, k2) {
+		if (k2 === void 0) k2 = k;
+		o[k2] = m[k];
+	}));
+	var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+		Object.defineProperty(o, "default", {
+			enumerable: true,
+			value: v
+		});
+	}) : function(o, v) {
+		o["default"] = v;
+	});
+	var __importStar = exports && exports.__importStar || function(mod) {
+		if (mod && mod.__esModule) return mod;
+		var result = {};
+		if (mod != null) {
+			for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+		}
+		__setModuleDefault(result, mod);
+		return result;
+	};
+	var __awaiter = exports && exports.__awaiter || function(thisArg, _arguments, P, generator) {
+		function adopt(value) {
+			return value instanceof P ? value : new P(function(resolve) {
+				resolve(value);
+			});
+		}
+		return new (P || (P = Promise))(function(resolve, reject) {
+			function fulfilled(value) {
+				try {
+					step(generator.next(value));
+				} catch (e) {
+					reject(e);
+				}
+			}
+			function rejected(value) {
+				try {
+					step(generator["throw"](value));
+				} catch (e) {
+					reject(e);
+				}
+			}
+			function step(result) {
+				result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+			}
+			step((generator = generator.apply(thisArg, _arguments || [])).next());
+		});
+	};
+	var __generator = exports && exports.__generator || function(thisArg, body) {
+		var _ = {
+			label: 0,
+			sent: function() {
+				if (t[0] & 1) throw t[1];
+				return t[1];
+			},
+			trys: [],
+			ops: []
+		}, f, y, t, g;
+		return g = {
+			next: verb(0),
+			"throw": verb(1),
+			"return": verb(2)
+		}, typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+			return this;
+		}), g;
+		function verb(n) {
+			return function(v) {
+				return step([n, v]);
+			};
+		}
+		function step(op) {
+			if (f) throw new TypeError("Generator is already executing.");
+			while (_) try {
+				if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+				if (y = 0, t) op = [op[0] & 2, t.value];
+				switch (op[0]) {
+					case 0:
+					case 1:
+						t = op;
+						break;
+					case 4:
+						_.label++;
+						return {
+							value: op[1],
+							done: false
+						};
+					case 5:
+						_.label++;
+						y = op[1];
+						op = [0];
+						continue;
+					case 7:
+						op = _.ops.pop();
+						_.trys.pop();
+						continue;
+					default:
+						if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+							_ = 0;
+							continue;
+						}
+						if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+							_.label = op[1];
+							break;
+						}
+						if (op[0] === 6 && _.label < t[1]) {
+							_.label = t[1];
+							t = op;
+							break;
+						}
+						if (t && _.label < t[2]) {
+							_.label = t[2];
+							_.ops.push(op);
+							break;
+						}
+						if (t[2]) _.ops.pop();
+						_.trys.pop();
+						continue;
+				}
+				op = body.call(thisArg, _);
+			} catch (e) {
+				op = [6, e];
+				y = 0;
+			} finally {
+				f = t = 0;
+			}
+			if (op[0] & 5) throw op[1];
+			return {
+				value: op[0] ? op[1] : void 0,
+				done: true
+			};
+		}
+	};
+	var __importDefault = exports && exports.__importDefault || function(mod) {
+		return mod && mod.__esModule ? mod : { "default": mod };
+	};
+	Object.defineProperty(exports, "__esModule", { value: true });
+	var urn_1 = require_urn();
+	var libsaml_1 = __importDefault(require_libsaml());
+	var utility_1 = __importStar(require_utility());
+	var binding = urn_1.wording.binding;
+	/**
+	* @desc Generate a base64 encoded login request
+	* @param  {string} referenceTagXPath           reference uri
+	* @param  {object} entity                      object includes both idp and sp
+	* @param  {function} customTagReplacement     used when developers have their own login response template
+	*/
+	function base64LoginRequest(referenceTagXPath, entity, customTagReplacement) {
+		var metadata = {
+			idp: entity.idp.entityMeta,
+			sp: entity.sp.entityMeta
+		};
+		var spSetting = entity.sp.entitySetting;
+		var id = "";
+		if (metadata && metadata.idp && metadata.sp) {
+			var base = metadata.idp.getSingleSignOnService(binding.post);
+			var rawSamlRequest = void 0;
+			if (spSetting.loginRequestTemplate && customTagReplacement) {
+				var info = customTagReplacement(spSetting.loginRequestTemplate.context);
+				id = (0, utility_1.get)(info, "id", null);
+				rawSamlRequest = (0, utility_1.get)(info, "context", null);
+			} else {
+				var nameIDFormat = spSetting.nameIDFormat;
+				var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+				id = spSetting.generateID();
+				rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginRequestTemplate.context, {
+					ID: id,
+					Destination: base,
+					Issuer: metadata.sp.getEntityID(),
+					IssueInstant: (/* @__PURE__ */ new Date()).toISOString(),
+					AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.post),
+					EntityID: metadata.sp.getEntityID(),
+					AllowCreate: spSetting.allowCreate,
+					NameIDFormat: selectedNameIDFormat
+				});
+			}
+			if (metadata.idp.isWantAuthnRequestsSigned()) {
+				var privateKey = spSetting.privateKey, privateKeyPass = spSetting.privateKeyPass, signatureAlgorithm = spSetting.requestSignatureAlgorithm, transformationAlgorithms = spSetting.transformationAlgorithms;
+				return {
+					id,
+					context: libsaml_1.default.constructSAMLSignature({
+						referenceTagXPath,
+						privateKey,
+						privateKeyPass,
+						signatureAlgorithm,
+						transformationAlgorithms,
+						rawSamlMessage: rawSamlRequest,
+						signingCert: metadata.sp.getX509Certificate("signing"),
+						signatureConfig: spSetting.signatureConfig || {
+							prefix: "ds",
+							location: {
+								reference: "/*[local-name(.)='AuthnRequest']/*[local-name(.)='Issuer']",
+								action: "after"
+							}
+						}
+					})
+				};
+			}
+			return {
+				id,
+				context: utility_1.default.base64Encode(rawSamlRequest)
+			};
+		}
+		throw new Error("ERR_GENERATE_POST_LOGIN_REQUEST_MISSING_METADATA");
+	}
+	/**
+	* @desc Generate a base64 encoded login response
+	* @param  {object} requestInfo                 corresponding request, used to obtain the id
+	* @param  {object} entity                      object includes both idp and sp
+	* @param  {object} user                        current logged user (e.g. req.user)
+	* @param  {function} customTagReplacement     used when developers have their own login response template
+	* @param  {boolean}  encryptThenSign           whether or not to encrypt then sign first (if signing). Defaults to sign-then-encrypt
+	*/
+	function base64LoginResponse(requestInfo, entity, user, customTagReplacement, encryptThenSign) {
+		if (requestInfo === void 0) requestInfo = {};
+		if (user === void 0) user = {};
+		if (encryptThenSign === void 0) encryptThenSign = false;
+		return __awaiter(this, void 0, void 0, function() {
+			var idpSetting, spSetting, id, metadata, nameIDFormat, selectedNameIDFormat, base, rawSamlResponse, nowTime, spEntityID, fiveMinutesLaterTime, fiveMinutesLater, now, acl, tvalue, template, privateKey, privateKeyPass, signatureAlgorithm, config, context;
+			return __generator(this, function(_a) {
+				switch (_a.label) {
+					case 0:
+						idpSetting = entity.idp.entitySetting;
+						spSetting = entity.sp.entitySetting;
+						id = idpSetting.generateID();
+						metadata = {
+							idp: entity.idp.entityMeta,
+							sp: entity.sp.entityMeta
+						};
+						nameIDFormat = idpSetting.nameIDFormat;
+						selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+						if (!(metadata && metadata.idp && metadata.sp)) return [3, 3];
+						base = metadata.sp.getAssertionConsumerService(binding.post);
+						rawSamlResponse = void 0;
+						nowTime = /* @__PURE__ */ new Date();
+						spEntityID = metadata.sp.getEntityID();
+						fiveMinutesLaterTime = new Date(nowTime.getTime());
+						fiveMinutesLaterTime.setMinutes(fiveMinutesLaterTime.getMinutes() + 5);
+						fiveMinutesLater = fiveMinutesLaterTime.toISOString();
+						now = nowTime.toISOString();
+						acl = metadata.sp.getAssertionConsumerService(binding.post);
+						tvalue = {
+							ID: id,
+							AssertionID: idpSetting.generateID(),
+							Destination: base,
+							Audience: spEntityID,
+							EntityID: spEntityID,
+							SubjectRecipient: acl,
+							Issuer: metadata.idp.getEntityID(),
+							IssueInstant: now,
+							AssertionConsumerServiceURL: acl,
+							StatusCode: urn_1.StatusCode.Success,
+							ConditionsNotBefore: now,
+							ConditionsNotOnOrAfter: fiveMinutesLater,
+							SubjectConfirmationDataNotOnOrAfter: fiveMinutesLater,
+							NameIDFormat: selectedNameIDFormat,
+							NameID: user.email || "",
+							InResponseTo: (0, utility_1.get)(requestInfo, "extract.request.id", ""),
+							AuthnStatement: "",
+							AttributeStatement: ""
+						};
+						if (idpSetting.loginResponseTemplate && customTagReplacement) {
+							template = customTagReplacement(idpSetting.loginResponseTemplate.context);
+							rawSamlResponse = (0, utility_1.get)(template, "context", null);
+						} else {
+							if (requestInfo !== null) tvalue.InResponseTo = requestInfo.extract.request.id;
+							rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginResponseTemplate.context, tvalue);
+						}
+						privateKey = idpSetting.privateKey, privateKeyPass = idpSetting.privateKeyPass, signatureAlgorithm = idpSetting.requestSignatureAlgorithm;
+						config = {
+							privateKey,
+							privateKeyPass,
+							signatureAlgorithm,
+							signingCert: metadata.idp.getX509Certificate("signing"),
+							isBase64Output: false
+						};
+						if (metadata.sp.isWantAssertionsSigned()) rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), {
+							rawSamlMessage: rawSamlResponse,
+							transformationAlgorithms: spSetting.transformationAlgorithms,
+							referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']",
+							signatureConfig: {
+								prefix: "ds",
+								location: {
+									reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']",
+									action: "after"
+								}
+							}
+						}));
+						if (!encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), {
+							rawSamlMessage: rawSamlResponse,
+							isMessageSigned: true,
+							transformationAlgorithms: spSetting.transformationAlgorithms,
+							signatureConfig: spSetting.signatureConfig || {
+								prefix: "ds",
+								location: {
+									reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']",
+									action: "after"
+								}
+							}
+						}));
+						if (!idpSetting.isAssertionEncrypted) return [3, 2];
+						return [4, libsaml_1.default.encryptAssertion(entity.idp, entity.sp, rawSamlResponse)];
+					case 1:
+						context = _a.sent();
+						if (encryptThenSign) rawSamlResponse = utility_1.default.base64Decode(context);
+						else return [2, Promise.resolve({
+							id,
+							context
+						})];
+						_a.label = 2;
+					case 2:
+						if (encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), {
+							rawSamlMessage: rawSamlResponse,
+							isMessageSigned: true,
+							transformationAlgorithms: spSetting.transformationAlgorithms,
+							signatureConfig: spSetting.signatureConfig || {
+								prefix: "ds",
+								location: {
+									reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']",
+									action: "after"
+								}
+							}
+						}));
+						return [2, Promise.resolve({
+							id,
+							context: utility_1.default.base64Encode(rawSamlResponse)
+						})];
+					case 3: throw new Error("ERR_GENERATE_POST_LOGIN_RESPONSE_MISSING_METADATA");
+				}
+			});
+		});
+	}
+	/**
+	* @desc Generate a base64 encoded logout request
+	* @param  {object} user                         current logged user (e.g. req.user)
+	* @param  {string} referenceTagXPath            reference uri
+	* @param  {object} entity                       object includes both idp and sp
+	* @param  {function} customTagReplacement      used when developers have their own login response template
+	* @return {string} base64 encoded request
+	*/
+	function base64LogoutRequest(user, referenceTagXPath, entity, customTagReplacement) {
+		var metadata = {
+			init: entity.init.entityMeta,
+			target: entity.target.entityMeta
+		};
+		var initSetting = entity.init.entitySetting;
+		var nameIDFormat = initSetting.nameIDFormat;
+		var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+		var id = "";
+		if (metadata && metadata.init && metadata.target) {
+			var rawSamlRequest = void 0;
+			if (initSetting.logoutRequestTemplate && customTagReplacement) {
+				var template = customTagReplacement(initSetting.logoutRequestTemplate.context);
+				id = (0, utility_1.get)(template, "id", null);
+				rawSamlRequest = (0, utility_1.get)(template, "context", null);
+			} else {
+				id = initSetting.generateID();
+				var tvalue = {
+					ID: id,
+					Destination: metadata.target.getSingleLogoutService(binding.post),
+					Issuer: metadata.init.getEntityID(),
+					IssueInstant: (/* @__PURE__ */ new Date()).toISOString(),
+					EntityID: metadata.init.getEntityID(),
+					NameIDFormat: selectedNameIDFormat,
+					NameID: user.logoutNameID
+				};
+				rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutRequestTemplate.context, tvalue);
+			}
+			if (entity.target.entitySetting.wantLogoutRequestSigned) {
+				var privateKey = initSetting.privateKey, privateKeyPass = initSetting.privateKeyPass, signatureAlgorithm = initSetting.requestSignatureAlgorithm, transformationAlgorithms = initSetting.transformationAlgorithms;
+				return {
+					id,
+					context: libsaml_1.default.constructSAMLSignature({
+						referenceTagXPath,
+						privateKey,
+						privateKeyPass,
+						signatureAlgorithm,
+						transformationAlgorithms,
+						rawSamlMessage: rawSamlRequest,
+						signingCert: metadata.init.getX509Certificate("signing"),
+						signatureConfig: initSetting.signatureConfig || {
+							prefix: "ds",
+							location: {
+								reference: "/*[local-name(.)='LogoutRequest']/*[local-name(.)='Issuer']",
+								action: "after"
+							}
+						}
+					})
+				};
+			}
+			return {
+				id,
+				context: utility_1.default.base64Encode(rawSamlRequest)
+			};
+		}
+		throw new Error("ERR_GENERATE_POST_LOGOUT_REQUEST_MISSING_METADATA");
+	}
+	/**
+	* @desc Generate a base64 encoded logout response
+	* @param  {object} requestInfo                 corresponding request, used to obtain the id
+	* @param  {string} referenceTagXPath           reference uri
+	* @param  {object} entity                      object includes both idp and sp
+	* @param  {function} customTagReplacement     used when developers have their own login response template
+	*/
+	function base64LogoutResponse(requestInfo, entity, customTagReplacement) {
+		var metadata = {
+			init: entity.init.entityMeta,
+			target: entity.target.entityMeta
+		};
+		var id = "";
+		var initSetting = entity.init.entitySetting;
+		if (metadata && metadata.init && metadata.target) {
+			var rawSamlResponse = void 0;
+			if (initSetting.logoutResponseTemplate) {
+				var template = customTagReplacement(initSetting.logoutResponseTemplate.context);
+				id = template.id;
+				rawSamlResponse = template.context;
+			} else {
+				id = initSetting.generateID();
+				var tvalue = {
+					ID: id,
+					Destination: metadata.target.getSingleLogoutService(binding.post),
+					EntityID: metadata.init.getEntityID(),
+					Issuer: metadata.init.getEntityID(),
+					IssueInstant: (/* @__PURE__ */ new Date()).toISOString(),
+					StatusCode: urn_1.StatusCode.Success,
+					InResponseTo: (0, utility_1.get)(requestInfo, "extract.request.id", null)
+				};
+				rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutResponseTemplate.context, tvalue);
+			}
+			if (entity.target.entitySetting.wantLogoutResponseSigned) {
+				var privateKey = initSetting.privateKey, privateKeyPass = initSetting.privateKeyPass, signatureAlgorithm = initSetting.requestSignatureAlgorithm, transformationAlgorithms = initSetting.transformationAlgorithms;
+				return {
+					id,
+					context: libsaml_1.default.constructSAMLSignature({
+						isMessageSigned: true,
+						transformationAlgorithms,
+						privateKey,
+						privateKeyPass,
+						signatureAlgorithm,
+						rawSamlMessage: rawSamlResponse,
+						signingCert: metadata.init.getX509Certificate("signing"),
+						signatureConfig: {
+							prefix: "ds",
+							location: {
+								reference: "/*[local-name(.)='LogoutResponse']/*[local-name(.)='Issuer']",
+								action: "after"
+							}
+						}
+					})
+				};
+			}
+			return {
+				id,
+				context: utility_1.default.base64Encode(rawSamlResponse)
+			};
+		}
+		throw new Error("ERR_GENERATE_POST_LOGOUT_RESPONSE_MISSING_METADATA");
+	}
+	var postBinding = {
+		base64LoginRequest,
+		base64LoginResponse,
+		base64LogoutRequest,
+		base64LogoutResponse
+	};
+	exports.default = postBinding;
+}) });
+
+//#endregion
+export default require_binding_post();
+
+export { require_binding_post };
+//# sourceMappingURL=binding-post.mjs.map

package/dist/esm/node_modules/samlify/build/src/binding-post.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-post.mjs","names":[],"sources":["../../../../../../../../node_modules/samlify/build/src/binding-post.js"],"sourcesContent":["\"use strict\";\n/**\n* @file binding-post.ts\n* @author tngan\n* @desc Binding-level API, declare the functions using POST binding\n*/\nvar __assign = (this && this.__assign) || function () {\n    __assign = Object.assign || function(t) {\n        for (var s, i = 1, n = arguments.length; i < n; i++) {\n            s = arguments[i];\n            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))\n                t[p] = s[p];\n        }\n        return t;\n    };\n    return __assign.apply(this, arguments);\n};\nvar __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {\n    if (k2 === undefined) k2 = k;\n    var desc = Object.getOwnPropertyDescriptor(m, k);\n    if (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) {\n      desc = { enumerable: true, get: function() { return m[k]; } };\n    }\n    Object.defineProperty(o, k2, desc);\n}) : (function(o, m, k, k2) {\n    if (k2 === undefined) k2 = k;\n    o[k2] = m[k];\n}));\nvar __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {\n    Object.defineProperty(o, \"default\", { enumerable: true, value: v });\n}) : function(o, v) {\n    o[\"default\"] = v;\n});\nvar __importStar = (this && this.__importStar) || function (mod) {\n    if (mod && mod.__esModule) return mod;\n    var result = {};\n    if (mod != null) for (var k in mod) if (k !== \"default\" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);\n    __setModuleDefault(result, mod);\n    return result;\n};\nvar __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {\n    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }\n    return new (P || (P = Promise))(function (resolve, reject) {\n        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }\n        function rejected(value) { try { step(generator[\"throw\"](value)); } catch (e) { reject(e); } }\n        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }\n        step((generator = generator.apply(thisArg, _arguments || [])).next());\n    });\n};\nvar __generator = (this && this.__generator) || function (thisArg, body) {\n    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;\n    return g = { next: verb(0), \"throw\": verb(1), \"return\": verb(2) }, typeof Symbol === \"function\" && (g[Symbol.iterator] = function() { return this; }), g;\n    function verb(n) { return function (v) { return step([n, v]); }; }\n    function step(op) {\n        if (f) throw new TypeError(\"Generator is already executing.\");\n        while (_) try {\n            if (f = 1, y && (t = op[0] & 2 ? y[\"return\"] : op[0] ? y[\"throw\"] || ((t = y[\"return\"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;\n            if (y = 0, t) op = [op[0] & 2, t.value];\n            switch (op[0]) {\n                case 0: case 1: t = op; break;\n                case 4: _.label++; return { value: op[1], done: false };\n                case 5: _.label++; y = op[1]; op = [0]; continue;\n                case 7: op = _.ops.pop(); _.trys.pop(); continue;\n                default:\n                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }\n                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }\n                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }\n                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }\n                    if (t[2]) _.ops.pop();\n                    _.trys.pop(); continue;\n            }\n            op = body.call(thisArg, _);\n        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }\n        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };\n    }\n};\nvar __importDefault = (this && this.__importDefault) || function (mod) {\n    return (mod && mod.__esModule) ? mod : { \"default\": mod };\n};\nObject.defineProperty(exports, \"__esModule\", { value: true });\nvar urn_1 = require(\"./urn\");\nvar libsaml_1 = __importDefault(require(\"./libsaml\"));\nvar utility_1 = __importStar(require(\"./utility\"));\nvar binding = urn_1.wording.binding;\n/**\n* @desc Generate a base64 encoded login request\n* @param  {string} referenceTagXPath           reference uri\n* @param  {object} entity                      object includes both idp and sp\n* @param  {function} customTagReplacement     used when developers have their own login response template\n*/\nfunction base64LoginRequest(referenceTagXPath, entity, customTagReplacement) {\n    var metadata = { idp: entity.idp.entityMeta, sp: entity.sp.entityMeta };\n    var spSetting = entity.sp.entitySetting;\n    var id = '';\n    if (metadata && metadata.idp && metadata.sp) {\n        var base = metadata.idp.getSingleSignOnService(binding.post);\n        var rawSamlRequest = void 0;\n        if (spSetting.loginRequestTemplate && customTagReplacement) {\n            var info = customTagReplacement(spSetting.loginRequestTemplate.context);\n            id = (0, utility_1.get)(info, 'id', null);\n            rawSamlRequest = (0, utility_1.get)(info, 'context', null);\n        }\n        else {\n            var nameIDFormat = spSetting.nameIDFormat;\n            var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;\n            id = spSetting.generateID();\n            rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginRequestTemplate.context, {\n                ID: id,\n                Destination: base,\n                Issuer: metadata.sp.getEntityID(),\n                IssueInstant: new Date().toISOString(),\n                AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.post),\n                EntityID: metadata.sp.getEntityID(),\n                AllowCreate: spSetting.allowCreate,\n                NameIDFormat: selectedNameIDFormat\n            });\n        }\n        if (metadata.idp.isWantAuthnRequestsSigned()) {\n            var privateKey = spSetting.privateKey, privateKeyPass = spSetting.privateKeyPass, signatureAlgorithm = spSetting.requestSignatureAlgorithm, transformationAlgorithms = spSetting.transformationAlgorithms;\n            return {\n                id: id,\n                context: libsaml_1.default.constructSAMLSignature({\n                    referenceTagXPath: referenceTagXPath,\n                    privateKey: privateKey,\n                    privateKeyPass: privateKeyPass,\n                    signatureAlgorithm: signatureAlgorithm,\n                    transformationAlgorithms: transformationAlgorithms,\n                    rawSamlMessage: rawSamlRequest,\n                    signingCert: metadata.sp.getX509Certificate('signing'),\n                    signatureConfig: spSetting.signatureConfig || {\n                        prefix: 'ds',\n                        location: { reference: \"/*[local-name(.)='AuthnRequest']/*[local-name(.)='Issuer']\", action: 'after' },\n                    }\n                }),\n            };\n        }\n        // No need to embeded XML signature\n        return {\n            id: id,\n            context: utility_1.default.base64Encode(rawSamlRequest),\n        };\n    }\n    throw new Error('ERR_GENERATE_POST_LOGIN_REQUEST_MISSING_METADATA');\n}\n/**\n* @desc Generate a base64 encoded login response\n* @param  {object} requestInfo                 corresponding request, used to obtain the id\n* @param  {object} entity                      object includes both idp and sp\n* @param  {object} user                        current logged user (e.g. req.user)\n* @param  {function} customTagReplacement     used when developers have their own login response template\n* @param  {boolean}  encryptThenSign           whether or not to encrypt then sign first (if signing). Defaults to sign-then-encrypt\n*/\nfunction base64LoginResponse(requestInfo, entity, user, customTagReplacement, encryptThenSign) {\n    if (requestInfo === void 0) { requestInfo = {}; }\n    if (user === void 0) { user = {}; }\n    if (encryptThenSign === void 0) { encryptThenSign = false; }\n    return __awaiter(this, void 0, void 0, function () {\n        var idpSetting, spSetting, id, metadata, nameIDFormat, selectedNameIDFormat, base, rawSamlResponse, nowTime, spEntityID, fiveMinutesLaterTime, fiveMinutesLater, now, acl, tvalue, template, privateKey, privateKeyPass, signatureAlgorithm, config, context;\n        return __generator(this, function (_a) {\n            switch (_a.label) {\n                case 0:\n                    idpSetting = entity.idp.entitySetting;\n                    spSetting = entity.sp.entitySetting;\n                    id = idpSetting.generateID();\n                    metadata = {\n                        idp: entity.idp.entityMeta,\n                        sp: entity.sp.entityMeta,\n                    };\n                    nameIDFormat = idpSetting.nameIDFormat;\n                    selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;\n                    if (!(metadata && metadata.idp && metadata.sp)) return [3 /*break*/, 3];\n                    base = metadata.sp.getAssertionConsumerService(binding.post);\n                    rawSamlResponse = void 0;\n                    nowTime = new Date();\n                    spEntityID = metadata.sp.getEntityID();\n                    fiveMinutesLaterTime = new Date(nowTime.getTime());\n                    fiveMinutesLaterTime.setMinutes(fiveMinutesLaterTime.getMinutes() + 5);\n                    fiveMinutesLater = fiveMinutesLaterTime.toISOString();\n                    now = nowTime.toISOString();\n                    acl = metadata.sp.getAssertionConsumerService(binding.post);\n                    tvalue = {\n                        ID: id,\n                        AssertionID: idpSetting.generateID(),\n                        Destination: base,\n                        Audience: spEntityID,\n                        EntityID: spEntityID,\n                        SubjectRecipient: acl,\n                        Issuer: metadata.idp.getEntityID(),\n                        IssueInstant: now,\n                        AssertionConsumerServiceURL: acl,\n                        StatusCode: urn_1.StatusCode.Success,\n                        // can be customized\n                        ConditionsNotBefore: now,\n                        ConditionsNotOnOrAfter: fiveMinutesLater,\n                        SubjectConfirmationDataNotOnOrAfter: fiveMinutesLater,\n                        NameIDFormat: selectedNameIDFormat,\n                        NameID: user.email || '',\n                        InResponseTo: (0, utility_1.get)(requestInfo, 'extract.request.id', ''),\n                        AuthnStatement: '',\n                        AttributeStatement: '',\n                    };\n                    if (idpSetting.loginResponseTemplate && customTagReplacement) {\n                        template = customTagReplacement(idpSetting.loginResponseTemplate.context);\n                        rawSamlResponse = (0, utility_1.get)(template, 'context', null);\n                    }\n                    else {\n                        if (requestInfo !== null) {\n                            tvalue.InResponseTo = requestInfo.extract.request.id;\n                        }\n                        rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginResponseTemplate.context, tvalue);\n                    }\n                    privateKey = idpSetting.privateKey, privateKeyPass = idpSetting.privateKeyPass, signatureAlgorithm = idpSetting.requestSignatureAlgorithm;\n                    config = {\n                        privateKey: privateKey,\n                        privateKeyPass: privateKeyPass,\n                        signatureAlgorithm: signatureAlgorithm,\n                        signingCert: metadata.idp.getX509Certificate('signing'),\n                        isBase64Output: false,\n                    };\n                    // step: sign assertion ? -> encrypted ? -> sign message ?\n                    if (metadata.sp.isWantAssertionsSigned()) {\n                        // console.debug('sp wants assertion signed');\n                        rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), { rawSamlMessage: rawSamlResponse, transformationAlgorithms: spSetting.transformationAlgorithms, referenceTagXPath: \"/*[local-name(.)='Response']/*[local-name(.)='Assertion']\", signatureConfig: {\n                                prefix: 'ds',\n                                location: { reference: \"/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']\", action: 'after' },\n                            } }));\n                    }\n                    // console.debug('after assertion signed', rawSamlResponse);\n                    // SAML response must be signed sign message first, then encrypt\n                    if (!encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {\n                        // console.debug('sign then encrypt and sign entire message');\n                        rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), { rawSamlMessage: rawSamlResponse, isMessageSigned: true, transformationAlgorithms: spSetting.transformationAlgorithms, signatureConfig: spSetting.signatureConfig || {\n                                prefix: 'ds',\n                                location: { reference: \"/*[local-name(.)='Response']/*[local-name(.)='Issuer']\", action: 'after' },\n                            } }));\n                    }\n                    if (!idpSetting.isAssertionEncrypted) return [3 /*break*/, 2];\n                    return [4 /*yield*/, libsaml_1.default.encryptAssertion(entity.idp, entity.sp, rawSamlResponse)];\n                case 1:\n                    context = _a.sent();\n                    if (encryptThenSign) {\n                        //need to decode it\n                        rawSamlResponse = utility_1.default.base64Decode(context);\n                    }\n                    else {\n                        return [2 /*return*/, Promise.resolve({ id: id, context: context })];\n                    }\n                    _a.label = 2;\n                case 2:\n                    //sign after encrypting\n                    if (encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {\n                        rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), { rawSamlMessage: rawSamlResponse, isMessageSigned: true, transformationAlgorithms: spSetting.transformationAlgorithms, signatureConfig: spSetting.signatureConfig || {\n                                prefix: 'ds',\n                                location: { reference: \"/*[local-name(.)='Response']/*[local-name(.)='Issuer']\", action: 'after' },\n                            } }));\n                    }\n                    return [2 /*return*/, Promise.resolve({\n                            id: id,\n                            context: utility_1.default.base64Encode(rawSamlResponse),\n                        })];\n                case 3: throw new Error('ERR_GENERATE_POST_LOGIN_RESPONSE_MISSING_METADATA');\n            }\n        });\n    });\n}\n/**\n* @desc Generate a base64 encoded logout request\n* @param  {object} user                         current logged user (e.g. req.user)\n* @param  {string} referenceTagXPath            reference uri\n* @param  {object} entity                       object includes both idp and sp\n* @param  {function} customTagReplacement      used when developers have their own login response template\n* @return {string} base64 encoded request\n*/\nfunction base64LogoutRequest(user, referenceTagXPath, entity, customTagReplacement) {\n    var metadata = { init: entity.init.entityMeta, target: entity.target.entityMeta };\n    var initSetting = entity.init.entitySetting;\n    var nameIDFormat = initSetting.nameIDFormat;\n    var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;\n    var id = '';\n    if (metadata && metadata.init && metadata.target) {\n        var rawSamlRequest = void 0;\n        if (initSetting.logoutRequestTemplate && customTagReplacement) {\n            var template = customTagReplacement(initSetting.logoutRequestTemplate.context);\n            id = (0, utility_1.get)(template, 'id', null);\n            rawSamlRequest = (0, utility_1.get)(template, 'context', null);\n        }\n        else {\n            id = initSetting.generateID();\n            var tvalue = {\n                ID: id,\n                Destination: metadata.target.getSingleLogoutService(binding.post),\n                Issuer: metadata.init.getEntityID(),\n                IssueInstant: new Date().toISOString(),\n                EntityID: metadata.init.getEntityID(),\n                NameIDFormat: selectedNameIDFormat,\n                NameID: user.logoutNameID,\n            };\n            rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutRequestTemplate.context, tvalue);\n        }\n        if (entity.target.entitySetting.wantLogoutRequestSigned) {\n            // Need to embeded XML signature\n            var privateKey = initSetting.privateKey, privateKeyPass = initSetting.privateKeyPass, signatureAlgorithm = initSetting.requestSignatureAlgorithm, transformationAlgorithms = initSetting.transformationAlgorithms;\n            return {\n                id: id,\n                context: libsaml_1.default.constructSAMLSignature({\n                    referenceTagXPath: referenceTagXPath,\n                    privateKey: privateKey,\n                    privateKeyPass: privateKeyPass,\n                    signatureAlgorithm: signatureAlgorithm,\n                    transformationAlgorithms: transformationAlgorithms,\n                    rawSamlMessage: rawSamlRequest,\n                    signingCert: metadata.init.getX509Certificate('signing'),\n                    signatureConfig: initSetting.signatureConfig || {\n                        prefix: 'ds',\n                        location: { reference: \"/*[local-name(.)='LogoutRequest']/*[local-name(.)='Issuer']\", action: 'after' },\n                    }\n                }),\n            };\n        }\n        return {\n            id: id,\n            context: utility_1.default.base64Encode(rawSamlRequest),\n        };\n    }\n    throw new Error('ERR_GENERATE_POST_LOGOUT_REQUEST_MISSING_METADATA');\n}\n/**\n* @desc Generate a base64 encoded logout response\n* @param  {object} requestInfo                 corresponding request, used to obtain the id\n* @param  {string} referenceTagXPath           reference uri\n* @param  {object} entity                      object includes both idp and sp\n* @param  {function} customTagReplacement     used when developers have their own login response template\n*/\nfunction base64LogoutResponse(requestInfo, entity, customTagReplacement) {\n    var metadata = {\n        init: entity.init.entityMeta,\n        target: entity.target.entityMeta,\n    };\n    var id = '';\n    var initSetting = entity.init.entitySetting;\n    if (metadata && metadata.init && metadata.target) {\n        var rawSamlResponse = void 0;\n        if (initSetting.logoutResponseTemplate) {\n            var template = customTagReplacement(initSetting.logoutResponseTemplate.context);\n            id = template.id;\n            rawSamlResponse = template.context;\n        }\n        else {\n            id = initSetting.generateID();\n            var tvalue = {\n                ID: id,\n                Destination: metadata.target.getSingleLogoutService(binding.post),\n                EntityID: metadata.init.getEntityID(),\n                Issuer: metadata.init.getEntityID(),\n                IssueInstant: new Date().toISOString(),\n                StatusCode: urn_1.StatusCode.Success,\n                InResponseTo: (0, utility_1.get)(requestInfo, 'extract.request.id', null)\n            };\n            rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutResponseTemplate.context, tvalue);\n        }\n        if (entity.target.entitySetting.wantLogoutResponseSigned) {\n            var privateKey = initSetting.privateKey, privateKeyPass = initSetting.privateKeyPass, signatureAlgorithm = initSetting.requestSignatureAlgorithm, transformationAlgorithms = initSetting.transformationAlgorithms;\n            return {\n                id: id,\n                context: libsaml_1.default.constructSAMLSignature({\n                    isMessageSigned: true,\n                    transformationAlgorithms: transformationAlgorithms,\n                    privateKey: privateKey,\n                    privateKeyPass: privateKeyPass,\n                    signatureAlgorithm: signatureAlgorithm,\n                    rawSamlMessage: rawSamlResponse,\n                    signingCert: metadata.init.getX509Certificate('signing'),\n                    signatureConfig: {\n                        prefix: 'ds',\n                        location: {\n                            reference: \"/*[local-name(.)='LogoutResponse']/*[local-name(.)='Issuer']\",\n                            action: 'after'\n                        }\n                    }\n                }),\n            };\n        }\n        return {\n            id: id,\n            context: utility_1.default.base64Encode(rawSamlResponse),\n        };\n    }\n    throw new Error('ERR_GENERATE_POST_LOGOUT_RESPONSE_MISSING_METADATA');\n}\nvar postBinding = {\n    base64LoginRequest: base64LoginRequest,\n    base64LoginResponse: base64LoginResponse,\n    base64LogoutRequest: base64LogoutRequest,\n    base64LogoutResponse: base64LogoutResponse,\n};\nexports.default = postBinding;\n//# sourceMappingURL=binding-post.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;CAMA,IAAI,8BAAyB,YAAa,WAAY;AAClD,aAAW,OAAO,UAAU,SAAS,GAAG;AACpC,QAAK,IAAI,GAAG,IAAI,GAAG,IAAI,UAAU,QAAQ,IAAI,GAAG,KAAK;AACjD,QAAI,UAAU;AACd,SAAK,IAAI,KAAK,EAAG,KAAI,OAAO,UAAU,eAAe,KAAK,GAAG,EAAE,CAC3D,GAAE,KAAK,EAAE;;AAEjB,UAAO;;AAEX,SAAO,SAAS,MAAM,MAAM,UAAU;;CAE1C,IAAI,qCAAgC,oBAAqB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AAC5F,MAAI,OAAO,OAAW,MAAK;EAC3B,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAClE,QAAO;GAAE,YAAY;GAAM,KAAK,WAAW;AAAE,WAAO,EAAE;;GAAO;AAE/D,SAAO,eAAe,GAAG,IAAI,KAAK;OAChC,SAAS,GAAG,GAAG,GAAG,IAAI;AACxB,MAAI,OAAO,OAAW,MAAK;AAC3B,IAAE,MAAM,EAAE;;CAEd,IAAI,wCAAmC,uBAAwB,OAAO,UAAU,SAAS,GAAG,GAAG;AAC3F,SAAO,eAAe,GAAG,WAAW;GAAE,YAAY;GAAM,OAAO;GAAG,CAAC;MAClE,SAAS,GAAG,GAAG;AAChB,IAAE,aAAa;;CAEnB,IAAI,kCAA6B,gBAAiB,SAAU,KAAK;AAC7D,MAAI,OAAO,IAAI,WAAY,QAAO;EAClC,IAAI,SAAS,EAAE;AACf,MAAI,OAAO,MAAM;QAAK,IAAI,KAAK,IAAK,KAAI,MAAM,aAAa,OAAO,UAAU,eAAe,KAAK,KAAK,EAAE,CAAE,iBAAgB,QAAQ,KAAK,EAAE;;AACxI,qBAAmB,QAAQ,IAAI;AAC/B,SAAO;;CAEX,IAAI,+BAA0B,aAAc,SAAU,SAAS,YAAY,GAAG,WAAW;EACrF,SAAS,MAAM,OAAO;AAAE,UAAO,iBAAiB,IAAI,QAAQ,IAAI,EAAE,SAAU,SAAS;AAAE,YAAQ,MAAM;KAAI;;AACzG,SAAO,KAAK,MAAM,IAAI,UAAU,SAAU,SAAS,QAAQ;GACvD,SAAS,UAAU,OAAO;AAAE,QAAI;AAAE,UAAK,UAAU,KAAK,MAAM,CAAC;aAAW,GAAG;AAAE,YAAO,EAAE;;;GACtF,SAAS,SAAS,OAAO;AAAE,QAAI;AAAE,UAAK,UAAU,SAAS,MAAM,CAAC;aAAW,GAAG;AAAE,YAAO,EAAE;;;GACzF,SAAS,KAAK,QAAQ;AAAE,WAAO,OAAO,QAAQ,OAAO,MAAM,GAAG,MAAM,OAAO,MAAM,CAAC,KAAK,WAAW,SAAS;;AAC3G,SAAM,YAAY,UAAU,MAAM,SAAS,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC;IACvE;;CAEN,IAAI,iCAA4B,eAAgB,SAAU,SAAS,MAAM;EACrE,IAAI,IAAI;GAAE,OAAO;GAAG,MAAM,WAAW;AAAE,QAAI,EAAE,KAAK,EAAG,OAAM,EAAE;AAAI,WAAO,EAAE;;GAAO,MAAM,EAAE;GAAE,KAAK,EAAE;GAAE,EAAE,GAAG,GAAG,GAAG;AAC/G,SAAO,IAAI;GAAE,MAAM,KAAK,EAAE;GAAE,SAAS,KAAK,EAAE;GAAE,UAAU,KAAK,EAAE;GAAE,EAAE,OAAO,WAAW,eAAe,EAAE,OAAO,YAAY,WAAW;AAAE,UAAO;MAAU;EACvJ,SAAS,KAAK,GAAG;AAAE,UAAO,SAAU,GAAG;AAAE,WAAO,KAAK,CAAC,GAAG,EAAE,CAAC;;;EAC5D,SAAS,KAAK,IAAI;AACd,OAAI,EAAG,OAAM,IAAI,UAAU,kCAAkC;AAC7D,UAAO,EAAG,KAAI;AACV,QAAI,IAAI,GAAG,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,YAAY,GAAG,KAAK,EAAE,cAAc,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,GAAG,GAAG,GAAG,EAAE,KAAM,QAAO;AAC3J,QAAI,IAAI,GAAG,EAAG,MAAK,CAAC,GAAG,KAAK,GAAG,EAAE,MAAM;AACvC,YAAQ,GAAG,IAAX;KACI,KAAK;KAAG,KAAK;AAAG,UAAI;AAAI;KACxB,KAAK;AAAG,QAAE;AAAS,aAAO;OAAE,OAAO,GAAG;OAAI,MAAM;OAAO;KACvD,KAAK;AAAG,QAAE;AAAS,UAAI,GAAG;AAAI,WAAK,CAAC,EAAE;AAAE;KACxC,KAAK;AAAG,WAAK,EAAE,IAAI,KAAK;AAAE,QAAE,KAAK,KAAK;AAAE;KACxC;AACI,UAAI,EAAE,IAAI,EAAE,MAAM,IAAI,EAAE,SAAS,KAAK,EAAE,EAAE,SAAS,QAAQ,GAAG,OAAO,KAAK,GAAG,OAAO,IAAI;AAAE,WAAI;AAAG;;AACjG,UAAI,GAAG,OAAO,MAAM,CAAC,KAAM,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,KAAM;AAAE,SAAE,QAAQ,GAAG;AAAI;;AAC9E,UAAI,GAAG,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI;AAAE,SAAE,QAAQ,EAAE;AAAI,WAAI;AAAI;;AAC7D,UAAI,KAAK,EAAE,QAAQ,EAAE,IAAI;AAAE,SAAE,QAAQ,EAAE;AAAI,SAAE,IAAI,KAAK,GAAG;AAAE;;AAC3D,UAAI,EAAE,GAAI,GAAE,IAAI,KAAK;AACrB,QAAE,KAAK,KAAK;AAAE;;AAEtB,SAAK,KAAK,KAAK,SAAS,EAAE;YACrB,GAAG;AAAE,SAAK,CAAC,GAAG,EAAE;AAAE,QAAI;aAAa;AAAE,QAAI,IAAI;;AACtD,OAAI,GAAG,KAAK,EAAG,OAAM,GAAG;AAAI,UAAO;IAAE,OAAO,GAAG,KAAK,GAAG,KAAK,KAAK;IAAG,MAAM;IAAM;;;CAGxF,IAAI,qCAAgC,mBAAoB,SAAU,KAAK;AACnE,SAAQ,OAAO,IAAI,aAAc,MAAM,EAAE,WAAW,KAAK;;AAE7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;CAC7D,IAAI;CACJ,IAAI,YAAY,kCAAqC;CACrD,IAAI,YAAY,+BAAkC;CAClD,IAAI,UAAU,MAAM,QAAQ;;;;;;;CAO5B,SAAS,mBAAmB,mBAAmB,QAAQ,sBAAsB;EACzE,IAAI,WAAW;GAAE,KAAK,OAAO,IAAI;GAAY,IAAI,OAAO,GAAG;GAAY;EACvE,IAAI,YAAY,OAAO,GAAG;EAC1B,IAAI,KAAK;AACT,MAAI,YAAY,SAAS,OAAO,SAAS,IAAI;GACzC,IAAI,OAAO,SAAS,IAAI,uBAAuB,QAAQ,KAAK;GAC5D,IAAI,iBAAiB,KAAK;AAC1B,OAAI,UAAU,wBAAwB,sBAAsB;IACxD,IAAI,OAAO,qBAAqB,UAAU,qBAAqB,QAAQ;AACvE,UAAM,GAAG,UAAU,KAAK,MAAM,MAAM,KAAK;AACzC,sBAAkB,GAAG,UAAU,KAAK,MAAM,WAAW,KAAK;UAEzD;IACD,IAAI,eAAe,UAAU;IAC7B,IAAI,uBAAuB,MAAM,QAAQ,aAAa,GAAG,aAAa,KAAK;AAC3E,SAAK,UAAU,YAAY;AAC3B,qBAAiB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,4BAA4B,SAAS;KACzG,IAAI;KACJ,aAAa;KACb,QAAQ,SAAS,GAAG,aAAa;KACjC,+BAAc,IAAI,MAAM,EAAC,aAAa;KACtC,6BAA6B,SAAS,GAAG,4BAA4B,QAAQ,KAAK;KAClF,UAAU,SAAS,GAAG,aAAa;KACnC,aAAa,UAAU;KACvB,cAAc;KACjB,CAAC;;AAEN,OAAI,SAAS,IAAI,2BAA2B,EAAE;IAC1C,IAAI,aAAa,UAAU,YAAY,iBAAiB,UAAU,gBAAgB,qBAAqB,UAAU,2BAA2B,2BAA2B,UAAU;AACjL,WAAO;KACC;KACJ,SAAS,UAAU,QAAQ,uBAAuB;MAC3B;MACP;MACI;MACI;MACM;MAC1B,gBAAgB;MAChB,aAAa,SAAS,GAAG,mBAAmB,UAAU;MACtD,iBAAiB,UAAU,mBAAmB;OAC1C,QAAQ;OACR,UAAU;QAAE,WAAW;QAA8D,QAAQ;QAAS;OACzG;MACJ,CAAC;KACL;;AAGL,UAAO;IACC;IACJ,SAAS,UAAU,QAAQ,aAAa,eAAe;IAC1D;;AAEL,QAAM,IAAI,MAAM,mDAAmD;;;;;;;;;;CAUvE,SAAS,oBAAoB,aAAa,QAAQ,MAAM,sBAAsB,iBAAiB;AAC3F,MAAI,gBAAgB,KAAK,EAAK,eAAc,EAAE;AAC9C,MAAI,SAAS,KAAK,EAAK,QAAO,EAAE;AAChC,MAAI,oBAAoB,KAAK,EAAK,mBAAkB;AACpD,SAAO,UAAU,MAAM,KAAK,GAAG,KAAK,GAAG,WAAY;GAC/C,IAAI,YAAY,WAAW,IAAI,UAAU,cAAc,sBAAsB,MAAM,iBAAiB,SAAS,YAAY,sBAAsB,kBAAkB,KAAK,KAAK,QAAQ,UAAU,YAAY,gBAAgB,oBAAoB,QAAQ;AACrP,UAAO,YAAY,MAAM,SAAU,IAAI;AACnC,YAAQ,GAAG,OAAX;KACI,KAAK;AACD,mBAAa,OAAO,IAAI;AACxB,kBAAY,OAAO,GAAG;AACtB,WAAK,WAAW,YAAY;AAC5B,iBAAW;OACP,KAAK,OAAO,IAAI;OAChB,IAAI,OAAO,GAAG;OACjB;AACD,qBAAe,WAAW;AAC1B,6BAAuB,MAAM,QAAQ,aAAa,GAAG,aAAa,KAAK;AACvE,UAAI,EAAE,YAAY,SAAS,OAAO,SAAS,IAAK,QAAO,CAAC,GAAa,EAAE;AACvE,aAAO,SAAS,GAAG,4BAA4B,QAAQ,KAAK;AAC5D,wBAAkB,KAAK;AACvB,gCAAU,IAAI,MAAM;AACpB,mBAAa,SAAS,GAAG,aAAa;AACtC,6BAAuB,IAAI,KAAK,QAAQ,SAAS,CAAC;AAClD,2BAAqB,WAAW,qBAAqB,YAAY,GAAG,EAAE;AACtE,yBAAmB,qBAAqB,aAAa;AACrD,YAAM,QAAQ,aAAa;AAC3B,YAAM,SAAS,GAAG,4BAA4B,QAAQ,KAAK;AAC3D,eAAS;OACL,IAAI;OACJ,aAAa,WAAW,YAAY;OACpC,aAAa;OACb,UAAU;OACV,UAAU;OACV,kBAAkB;OAClB,QAAQ,SAAS,IAAI,aAAa;OAClC,cAAc;OACd,6BAA6B;OAC7B,YAAY,MAAM,WAAW;OAE7B,qBAAqB;OACrB,wBAAwB;OACxB,qCAAqC;OACrC,cAAc;OACd,QAAQ,KAAK,SAAS;OACtB,eAAe,GAAG,UAAU,KAAK,aAAa,sBAAsB,GAAG;OACvE,gBAAgB;OAChB,oBAAoB;OACvB;AACD,UAAI,WAAW,yBAAyB,sBAAsB;AAC1D,kBAAW,qBAAqB,WAAW,sBAAsB,QAAQ;AACzE,0BAAmB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;aAE9D;AACD,WAAI,gBAAgB,KAChB,QAAO,eAAe,YAAY,QAAQ,QAAQ;AAEtD,yBAAkB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,6BAA6B,SAAS,OAAO;;AAE1H,mBAAa,WAAW,YAAY,iBAAiB,WAAW,gBAAgB,qBAAqB,WAAW;AAChH,eAAS;OACO;OACI;OACI;OACpB,aAAa,SAAS,IAAI,mBAAmB,UAAU;OACvD,gBAAgB;OACnB;AAED,UAAI,SAAS,GAAG,wBAAwB,CAEpC,mBAAkB,UAAU,QAAQ,uBAAuB,SAAS,SAAS,EAAE,EAAE,OAAO,EAAE;OAAE,gBAAgB;OAAiB,0BAA0B,UAAU;OAA0B,mBAAmB;OAA6D,iBAAiB;QACpR,QAAQ;QACR,UAAU;SAAE,WAAW;SAAuF,QAAQ;SAAS;QAClI;OAAE,CAAC,CAAC;AAIb,UAAI,CAAC,oBAAoB,UAAU,qBAAqB,CAAC,SAAS,GAAG,wBAAwB,EAEzF,mBAAkB,UAAU,QAAQ,uBAAuB,SAAS,SAAS,EAAE,EAAE,OAAO,EAAE;OAAE,gBAAgB;OAAiB,iBAAiB;OAAM,0BAA0B,UAAU;OAA0B,iBAAiB,UAAU,mBAAmB;QACxP,QAAQ;QACR,UAAU;SAAE,WAAW;SAA0D,QAAQ;SAAS;QACrG;OAAE,CAAC,CAAC;AAEb,UAAI,CAAC,WAAW,qBAAsB,QAAO,CAAC,GAAa,EAAE;AAC7D,aAAO,CAAC,GAAa,UAAU,QAAQ,iBAAiB,OAAO,KAAK,OAAO,IAAI,gBAAgB,CAAC;KACpG,KAAK;AACD,gBAAU,GAAG,MAAM;AACnB,UAAI,gBAEA,mBAAkB,UAAU,QAAQ,aAAa,QAAQ;UAGzD,QAAO,CAAC,GAAc,QAAQ,QAAQ;OAAM;OAAa;OAAS,CAAC,CAAC;AAExE,SAAG,QAAQ;KACf,KAAK;AAED,UAAI,oBAAoB,UAAU,qBAAqB,CAAC,SAAS,GAAG,wBAAwB,EACxF,mBAAkB,UAAU,QAAQ,uBAAuB,SAAS,SAAS,EAAE,EAAE,OAAO,EAAE;OAAE,gBAAgB;OAAiB,iBAAiB;OAAM,0BAA0B,UAAU;OAA0B,iBAAiB,UAAU,mBAAmB;QACxP,QAAQ;QACR,UAAU;SAAE,WAAW;SAA0D,QAAQ;SAAS;QACrG;OAAE,CAAC,CAAC;AAEb,aAAO,CAAC,GAAc,QAAQ,QAAQ;OAC1B;OACJ,SAAS,UAAU,QAAQ,aAAa,gBAAgB;OAC3D,CAAC,CAAC;KACX,KAAK,EAAG,OAAM,IAAI,MAAM,oDAAoD;;KAElF;IACJ;;;;;;;;;;CAUN,SAAS,oBAAoB,MAAM,mBAAmB,QAAQ,sBAAsB;EAChF,IAAI,WAAW;GAAE,MAAM,OAAO,KAAK;GAAY,QAAQ,OAAO,OAAO;GAAY;EACjF,IAAI,cAAc,OAAO,KAAK;EAC9B,IAAI,eAAe,YAAY;EAC/B,IAAI,uBAAuB,MAAM,QAAQ,aAAa,GAAG,aAAa,KAAK;EAC3E,IAAI,KAAK;AACT,MAAI,YAAY,SAAS,QAAQ,SAAS,QAAQ;GAC9C,IAAI,iBAAiB,KAAK;AAC1B,OAAI,YAAY,yBAAyB,sBAAsB;IAC3D,IAAI,WAAW,qBAAqB,YAAY,sBAAsB,QAAQ;AAC9E,UAAM,GAAG,UAAU,KAAK,UAAU,MAAM,KAAK;AAC7C,sBAAkB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;UAE7D;AACD,SAAK,YAAY,YAAY;IAC7B,IAAI,SAAS;KACT,IAAI;KACJ,aAAa,SAAS,OAAO,uBAAuB,QAAQ,KAAK;KACjE,QAAQ,SAAS,KAAK,aAAa;KACnC,+BAAc,IAAI,MAAM,EAAC,aAAa;KACtC,UAAU,SAAS,KAAK,aAAa;KACrC,cAAc;KACd,QAAQ,KAAK;KAChB;AACD,qBAAiB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,6BAA6B,SAAS,OAAO;;AAEzH,OAAI,OAAO,OAAO,cAAc,yBAAyB;IAErD,IAAI,aAAa,YAAY,YAAY,iBAAiB,YAAY,gBAAgB,qBAAqB,YAAY,2BAA2B,2BAA2B,YAAY;AACzL,WAAO;KACC;KACJ,SAAS,UAAU,QAAQ,uBAAuB;MAC3B;MACP;MACI;MACI;MACM;MAC1B,gBAAgB;MAChB,aAAa,SAAS,KAAK,mBAAmB,UAAU;MACxD,iBAAiB,YAAY,mBAAmB;OAC5C,QAAQ;OACR,UAAU;QAAE,WAAW;QAA+D,QAAQ;QAAS;OAC1G;MACJ,CAAC;KACL;;AAEL,UAAO;IACC;IACJ,SAAS,UAAU,QAAQ,aAAa,eAAe;IAC1D;;AAEL,QAAM,IAAI,MAAM,oDAAoD;;;;;;;;;CASxE,SAAS,qBAAqB,aAAa,QAAQ,sBAAsB;EACrE,IAAI,WAAW;GACX,MAAM,OAAO,KAAK;GAClB,QAAQ,OAAO,OAAO;GACzB;EACD,IAAI,KAAK;EACT,IAAI,cAAc,OAAO,KAAK;AAC9B,MAAI,YAAY,SAAS,QAAQ,SAAS,QAAQ;GAC9C,IAAI,kBAAkB,KAAK;AAC3B,OAAI,YAAY,wBAAwB;IACpC,IAAI,WAAW,qBAAqB,YAAY,uBAAuB,QAAQ;AAC/E,SAAK,SAAS;AACd,sBAAkB,SAAS;UAE1B;AACD,SAAK,YAAY,YAAY;IAC7B,IAAI,SAAS;KACT,IAAI;KACJ,aAAa,SAAS,OAAO,uBAAuB,QAAQ,KAAK;KACjE,UAAU,SAAS,KAAK,aAAa;KACrC,QAAQ,SAAS,KAAK,aAAa;KACnC,+BAAc,IAAI,MAAM,EAAC,aAAa;KACtC,YAAY,MAAM,WAAW;KAC7B,eAAe,GAAG,UAAU,KAAK,aAAa,sBAAsB,KAAK;KAC5E;AACD,sBAAkB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,8BAA8B,SAAS,OAAO;;AAE3H,OAAI,OAAO,OAAO,cAAc,0BAA0B;IACtD,IAAI,aAAa,YAAY,YAAY,iBAAiB,YAAY,gBAAgB,qBAAqB,YAAY,2BAA2B,2BAA2B,YAAY;AACzL,WAAO;KACC;KACJ,SAAS,UAAU,QAAQ,uBAAuB;MAC9C,iBAAiB;MACS;MACd;MACI;MACI;MACpB,gBAAgB;MAChB,aAAa,SAAS,KAAK,mBAAmB,UAAU;MACxD,iBAAiB;OACb,QAAQ;OACR,UAAU;QACN,WAAW;QACX,QAAQ;QACX;OACJ;MACJ,CAAC;KACL;;AAEL,UAAO;IACC;IACJ,SAAS,UAAU,QAAQ,aAAa,gBAAgB;IAC3D;;AAEL,QAAM,IAAI,MAAM,qDAAqD;;CAEzE,IAAI,cAAc;EACM;EACC;EACA;EACC;EACzB;AACD,SAAQ,UAAU"}