@intlayer/backend 7.1.4 → 7.1.5

package/dist/esm/node_modules/samlify/build/src/flow.mjs

@@ -1,389 +0,0 @@
-import { __commonJS } from "../../../../_virtual/rolldown_runtime.mjs";
-import { require_utility } from "./utility.mjs";
-import { require_urn } from "./urn.mjs";
-import { require_extractor } from "./extractor.mjs";
-import { require_libsaml } from "./libsaml.mjs";
-import { require_validator } from "./validator.mjs";
-
-//#region ../../node_modules/samlify/build/src/flow.js
-var require_flow = /* @__PURE__ */ __commonJS({ "../../node_modules/samlify/build/src/flow.js": ((exports) => {
-	var __awaiter = exports && exports.__awaiter || function(thisArg, _arguments, P, generator) {
-		function adopt(value) {
-			return value instanceof P ? value : new P(function(resolve) {
-				resolve(value);
-			});
-		}
-		return new (P || (P = Promise))(function(resolve, reject) {
-			function fulfilled(value) {
-				try {
-					step(generator.next(value));
-				} catch (e) {
-					reject(e);
-				}
-			}
-			function rejected(value) {
-				try {
-					step(generator["throw"](value));
-				} catch (e) {
-					reject(e);
-				}
-			}
-			function step(result) {
-				result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
-			}
-			step((generator = generator.apply(thisArg, _arguments || [])).next());
-		});
-	};
-	var __generator = exports && exports.__generator || function(thisArg, body) {
-		var _ = {
-			label: 0,
-			sent: function() {
-				if (t[0] & 1) throw t[1];
-				return t[1];
-			},
-			trys: [],
-			ops: []
-		}, f, y, t, g;
-		return g = {
-			next: verb(0),
-			"throw": verb(1),
-			"return": verb(2)
-		}, typeof Symbol === "function" && (g[Symbol.iterator] = function() {
-			return this;
-		}), g;
-		function verb(n) {
-			return function(v) {
-				return step([n, v]);
-			};
-		}
-		function step(op) {
-			if (f) throw new TypeError("Generator is already executing.");
-			while (_) try {
-				if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-				if (y = 0, t) op = [op[0] & 2, t.value];
-				switch (op[0]) {
-					case 0:
-					case 1:
-						t = op;
-						break;
-					case 4:
-						_.label++;
-						return {
-							value: op[1],
-							done: false
-						};
-					case 5:
-						_.label++;
-						y = op[1];
-						op = [0];
-						continue;
-					case 7:
-						op = _.ops.pop();
-						_.trys.pop();
-						continue;
-					default:
-						if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
-							_ = 0;
-							continue;
-						}
-						if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
-							_.label = op[1];
-							break;
-						}
-						if (op[0] === 6 && _.label < t[1]) {
-							_.label = t[1];
-							t = op;
-							break;
-						}
-						if (t && _.label < t[2]) {
-							_.label = t[2];
-							_.ops.push(op);
-							break;
-						}
-						if (t[2]) _.ops.pop();
-						_.trys.pop();
-						continue;
-				}
-				op = body.call(thisArg, _);
-			} catch (e) {
-				op = [6, e];
-				y = 0;
-			} finally {
-				f = t = 0;
-			}
-			if (op[0] & 5) throw op[1];
-			return {
-				value: op[0] ? op[1] : void 0,
-				done: true
-			};
-		}
-	};
-	var __read = exports && exports.__read || function(o, n) {
-		var m = typeof Symbol === "function" && o[Symbol.iterator];
-		if (!m) return o;
-		var i = m.call(o), r, ar = [], e;
-		try {
-			while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
-		} catch (error) {
-			e = { error };
-		} finally {
-			try {
-				if (r && !r.done && (m = i["return"])) m.call(i);
-			} finally {
-				if (e) throw e.error;
-			}
-		}
-		return ar;
-	};
-	var __importDefault = exports && exports.__importDefault || function(mod) {
-		return mod && mod.__esModule ? mod : { "default": mod };
-	};
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.flow = void 0;
-	var utility_1 = require_utility();
-	var validator_1 = require_validator();
-	var libsaml_1 = __importDefault(require_libsaml());
-	var extractor_1 = require_extractor();
-	var urn_1 = require_urn();
-	var bindDict = urn_1.wording.binding;
-	var urlParams = urn_1.wording.urlParams;
-	function getDefaultExtractorFields(parserType, assertion) {
-		switch (parserType) {
-			case urn_1.ParserType.SAMLRequest: return extractor_1.loginRequestFields;
-			case urn_1.ParserType.SAMLResponse:
-				if (!assertion) throw new Error("ERR_EMPTY_ASSERTION");
-				return (0, extractor_1.loginResponseFields)(assertion);
-			case urn_1.ParserType.LogoutRequest: return extractor_1.logoutRequestFields;
-			case urn_1.ParserType.LogoutResponse: return extractor_1.logoutResponseFields;
-			default: throw new Error("ERR_UNDEFINED_PARSERTYPE");
-		}
-	}
-	function redirectFlow(options) {
-		return __awaiter(this, void 0, void 0, function() {
-			var request, parserType, self, _a, checkSignature, from, query, octetString, sigAlg, signature, targetEntityMetadata, direction, content, xmlString, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, decodeSigAlg, verified, issuer, extractedProperties;
-			return __generator(this, function(_b) {
-				switch (_b.label) {
-					case 0:
-						request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;
-						query = request.query, octetString = request.octetString;
-						sigAlg = query.SigAlg, signature = query.Signature;
-						targetEntityMetadata = from.entityMeta;
-						direction = libsaml_1.default.getQueryParamByType(parserType);
-						content = query[direction];
-						if (content === void 0) return [2, Promise.reject("ERR_REDIRECT_FLOW_BAD_ARGS")];
-						xmlString = (0, utility_1.inflateString)(decodeURIComponent(content));
-						_b.label = 1;
-					case 1:
-						_b.trys.push([
-							1,
-							3,
-							,
-							4
-						]);
-						return [4, libsaml_1.default.isValidXml(xmlString)];
-					case 2:
-						_b.sent();
-						return [3, 4];
-					case 3:
-						_b.sent();
-						return [2, Promise.reject("ERR_INVALID_XML")];
-					case 4: return [4, checkStatus(xmlString, parserType)];
-					case 5:
-						_b.sent();
-						assertion = "";
-						if (parserType === urlParams.samlResponse) {
-							verifiedDoc = (0, extractor_1.extract)(xmlString, [{
-								key: "assertion",
-								localPath: ["~Response", "Assertion"],
-								attributes: [],
-								context: true
-							}]);
-							if (verifiedDoc && verifiedDoc.assertion) assertion = verifiedDoc.assertion;
-						}
-						extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);
-						parseResult = {
-							samlContent: xmlString,
-							sigAlg: null,
-							extract: (0, extractor_1.extract)(xmlString, extractorFields)
-						};
-						if (checkSignature) {
-							if (!signature || !sigAlg) return [2, Promise.reject("ERR_MISSING_SIG_ALG")];
-							base64Signature = Buffer.from(decodeURIComponent(signature), "base64");
-							decodeSigAlg = decodeURIComponent(sigAlg);
-							verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);
-							if (!verified) return [2, Promise.reject("ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION")];
-							parseResult.sigAlg = decodeSigAlg;
-						}
-						issuer = targetEntityMetadata.getEntityID();
-						extractedProperties = parseResult.extract;
-						if ((parserType === "LogoutResponse" || parserType === "SAMLResponse") && extractedProperties && extractedProperties.issuer !== issuer) return [2, Promise.reject("ERR_UNMATCH_ISSUER")];
-						if (parserType === "SAMLResponse" && extractedProperties.sessionIndex.sessionNotOnOrAfter && !(0, validator_1.verifyTime)(void 0, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_EXPIRED_SESSION")];
-						if (parserType === "SAMLResponse" && extractedProperties.conditions && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_SUBJECT_UNCONFIRMED")];
-						return [2, Promise.resolve(parseResult)];
-				}
-			});
-		});
-	}
-	function postFlow(options) {
-		return __awaiter(this, void 0, void 0, function() {
-			var request, from, self, parserType, _a, checkSignature, body, direction, encodedRequest, samlContent, verificationOptions, decryptRequired, extractorFields, _b, verified, verifiedAssertionNode, result, result, decryptedDoc, _c, decryptedDocVerified, verifiedDecryptedAssertion, parseResult, targetEntityMetadata, issuer, extractedProperties;
-			return __generator(this, function(_d) {
-				switch (_d.label) {
-					case 0:
-						request = options.request, from = options.from, self = options.self, parserType = options.parserType, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a;
-						body = request.body;
-						direction = libsaml_1.default.getQueryParamByType(parserType);
-						encodedRequest = body[direction];
-						samlContent = String((0, utility_1.base64Decode)(encodedRequest));
-						verificationOptions = {
-							metadata: from.entityMeta,
-							signatureAlgorithm: from.entitySetting.requestSignatureAlgorithm
-						};
-						decryptRequired = from.entitySetting.isAssertionEncrypted;
-						extractorFields = [];
-						return [4, libsaml_1.default.isValidXml(samlContent)];
-					case 1:
-						_d.sent();
-						if (parserType !== urlParams.samlResponse) extractorFields = getDefaultExtractorFields(parserType, null);
-						return [4, checkStatus(samlContent, parserType)];
-					case 2:
-						_d.sent();
-						if (!checkSignature) return [3, 7];
-						_b = __read(libsaml_1.default.verifySignature(samlContent, verificationOptions), 2), verified = _b[0], verifiedAssertionNode = _b[1];
-						if (!(decryptRequired && verified && parserType === "SAMLResponse" && verifiedAssertionNode)) return [3, 4];
-						return [4, libsaml_1.default.decryptAssertion(self, verifiedAssertionNode)];
-					case 3:
-						result = _d.sent();
-						samlContent = result[0];
-						extractorFields = getDefaultExtractorFields(parserType, result[1]);
-						return [3, 7];
-					case 4:
-						if (!(decryptRequired && !verified)) return [3, 6];
-						return [4, libsaml_1.default.decryptAssertion(self, samlContent)];
-					case 5:
-						result = _d.sent();
-						decryptedDoc = result[0];
-						_c = __read(libsaml_1.default.verifySignature(decryptedDoc, verificationOptions), 2), decryptedDocVerified = _c[0], verifiedDecryptedAssertion = _c[1];
-						if (decryptedDocVerified) extractorFields = getDefaultExtractorFields(parserType, verifiedDecryptedAssertion);
-						else return [2, Promise.reject("FAILED_TO_VERIFY_SIGNATURE")];
-						return [3, 7];
-					case 6:
-						if (verified) extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);
-						else return [2, Promise.reject("FAILED_TO_VERIFY_SIGNATURE")];
-						_d.label = 7;
-					case 7:
-						parseResult = {
-							samlContent,
-							extract: (0, extractor_1.extract)(samlContent, extractorFields)
-						};
-						targetEntityMetadata = from.entityMeta;
-						issuer = targetEntityMetadata.getEntityID();
-						extractedProperties = parseResult.extract;
-						if ((parserType === "LogoutResponse" || parserType === "SAMLResponse") && extractedProperties && extractedProperties.issuer !== issuer) return [2, Promise.reject("ERR_UNMATCH_ISSUER")];
-						if (parserType === "SAMLResponse" && extractedProperties.sessionIndex.sessionNotOnOrAfter && !(0, validator_1.verifyTime)(void 0, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_EXPIRED_SESSION")];
-						if (parserType === "SAMLResponse" && extractedProperties.conditions && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_SUBJECT_UNCONFIRMED")];
-						return [2, Promise.resolve(parseResult)];
-				}
-			});
-		});
-	}
-	function postSimpleSignFlow(options) {
-		return __awaiter(this, void 0, void 0, function() {
-			var request, parserType, self, _a, checkSignature, from, body, octetString, targetEntityMetadata, direction, encodedRequest, sigAlg, signature, xmlString, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, verified, issuer, extractedProperties;
-			return __generator(this, function(_b) {
-				switch (_b.label) {
-					case 0:
-						request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;
-						body = request.body, octetString = request.octetString;
-						targetEntityMetadata = from.entityMeta;
-						direction = libsaml_1.default.getQueryParamByType(parserType);
-						encodedRequest = body[direction];
-						sigAlg = body["SigAlg"];
-						signature = body["Signature"];
-						if (encodedRequest === void 0) return [2, Promise.reject("ERR_SIMPLESIGN_FLOW_BAD_ARGS")];
-						xmlString = String((0, utility_1.base64Decode)(encodedRequest));
-						_b.label = 1;
-					case 1:
-						_b.trys.push([
-							1,
-							3,
-							,
-							4
-						]);
-						return [4, libsaml_1.default.isValidXml(xmlString)];
-					case 2:
-						_b.sent();
-						return [3, 4];
-					case 3:
-						_b.sent();
-						return [2, Promise.reject("ERR_INVALID_XML")];
-					case 4: return [4, checkStatus(xmlString, parserType)];
-					case 5:
-						_b.sent();
-						assertion = "";
-						if (parserType === urlParams.samlResponse) {
-							verifiedDoc = (0, extractor_1.extract)(xmlString, [{
-								key: "assertion",
-								localPath: ["~Response", "Assertion"],
-								attributes: [],
-								context: true
-							}]);
-							if (verifiedDoc && verifiedDoc.assertion) assertion = verifiedDoc.assertion;
-						}
-						extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);
-						parseResult = {
-							samlContent: xmlString,
-							sigAlg: null,
-							extract: (0, extractor_1.extract)(xmlString, extractorFields)
-						};
-						if (checkSignature) {
-							if (!signature || !sigAlg) return [2, Promise.reject("ERR_MISSING_SIG_ALG")];
-							base64Signature = Buffer.from(signature, "base64");
-							verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);
-							if (!verified) return [2, Promise.reject("ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION")];
-							parseResult.sigAlg = sigAlg;
-						}
-						issuer = targetEntityMetadata.getEntityID();
-						extractedProperties = parseResult.extract;
-						if ((parserType === "LogoutResponse" || parserType === "SAMLResponse") && extractedProperties && extractedProperties.issuer !== issuer) return [2, Promise.reject("ERR_UNMATCH_ISSUER")];
-						if (parserType === "SAMLResponse" && extractedProperties.sessionIndex.sessionNotOnOrAfter && !(0, validator_1.verifyTime)(void 0, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_EXPIRED_SESSION")];
-						if (parserType === "SAMLResponse" && extractedProperties.conditions && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) return [2, Promise.reject("ERR_SUBJECT_UNCONFIRMED")];
-						return [2, Promise.resolve(parseResult)];
-				}
-			});
-		});
-	}
-	function checkStatus(content, parserType) {
-		if (parserType !== urlParams.samlResponse && parserType !== urlParams.logoutResponse) return Promise.resolve("SKIPPED");
-		var fields = parserType === urlParams.samlResponse ? extractor_1.loginResponseStatusFields : extractor_1.logoutResponseStatusFields;
-		var _a = (0, extractor_1.extract)(content, fields), top = _a.top, second = _a.second;
-		if (top === urn_1.StatusCode.Success) return Promise.resolve("OK");
-		if (!top) throw new Error("ERR_UNDEFINED_STATUS");
-		throw new Error("ERR_FAILED_STATUS with top tier code: ".concat(top, ", second tier code: ").concat(second));
-	}
-	function flow(options) {
-		var binding = options.binding;
-		var parserType = options.parserType;
-		options.supportBindings = [
-			urn_1.BindingNamespace.Redirect,
-			urn_1.BindingNamespace.Post,
-			urn_1.BindingNamespace.SimpleSign
-		];
-		if (parserType === urn_1.ParserType.SAMLResponse) options.supportBindings = [
-			urn_1.BindingNamespace.Post,
-			urn_1.BindingNamespace.Redirect,
-			urn_1.BindingNamespace.SimpleSign
-		];
-		if (binding === bindDict.post) return postFlow(options);
-		if (binding === bindDict.redirect) return redirectFlow(options);
-		if (binding === bindDict.simpleSign) return postSimpleSignFlow(options);
-		return Promise.reject("ERR_UNEXPECTED_FLOW");
-	}
-	exports.flow = flow;
-}) });
-
-//#endregion
-export default require_flow();
-
-export { require_flow };
-//# sourceMappingURL=flow.mjs.map

package/dist/esm/node_modules/samlify/build/src/flow.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"flow.mjs","names":[],"sources":["../../../../../../../../node_modules/samlify/build/src/flow.js"],"sourcesContent":["\"use strict\";\nvar __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {\n    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }\n    return new (P || (P = Promise))(function (resolve, reject) {\n        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }\n        function rejected(value) { try { step(generator[\"throw\"](value)); } catch (e) { reject(e); } }\n        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }\n        step((generator = generator.apply(thisArg, _arguments || [])).next());\n    });\n};\nvar __generator = (this && this.__generator) || function (thisArg, body) {\n    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;\n    return g = { next: verb(0), \"throw\": verb(1), \"return\": verb(2) }, typeof Symbol === \"function\" && (g[Symbol.iterator] = function() { return this; }), g;\n    function verb(n) { return function (v) { return step([n, v]); }; }\n    function step(op) {\n        if (f) throw new TypeError(\"Generator is already executing.\");\n        while (_) try {\n            if (f = 1, y && (t = op[0] & 2 ? y[\"return\"] : op[0] ? y[\"throw\"] || ((t = y[\"return\"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;\n            if (y = 0, t) op = [op[0] & 2, t.value];\n            switch (op[0]) {\n                case 0: case 1: t = op; break;\n                case 4: _.label++; return { value: op[1], done: false };\n                case 5: _.label++; y = op[1]; op = [0]; continue;\n                case 7: op = _.ops.pop(); _.trys.pop(); continue;\n                default:\n                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }\n                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }\n                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }\n                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }\n                    if (t[2]) _.ops.pop();\n                    _.trys.pop(); continue;\n            }\n            op = body.call(thisArg, _);\n        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }\n        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };\n    }\n};\nvar __read = (this && this.__read) || function (o, n) {\n    var m = typeof Symbol === \"function\" && o[Symbol.iterator];\n    if (!m) return o;\n    var i = m.call(o), r, ar = [], e;\n    try {\n        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);\n    }\n    catch (error) { e = { error: error }; }\n    finally {\n        try {\n            if (r && !r.done && (m = i[\"return\"])) m.call(i);\n        }\n        finally { if (e) throw e.error; }\n    }\n    return ar;\n};\nvar __importDefault = (this && this.__importDefault) || function (mod) {\n    return (mod && mod.__esModule) ? mod : { \"default\": mod };\n};\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.flow = void 0;\nvar utility_1 = require(\"./utility\");\nvar validator_1 = require(\"./validator\");\nvar libsaml_1 = __importDefault(require(\"./libsaml\"));\nvar extractor_1 = require(\"./extractor\");\nvar urn_1 = require(\"./urn\");\nvar bindDict = urn_1.wording.binding;\nvar urlParams = urn_1.wording.urlParams;\n// get the default extractor fields based on the parserType\nfunction getDefaultExtractorFields(parserType, assertion) {\n    switch (parserType) {\n        case urn_1.ParserType.SAMLRequest:\n            return extractor_1.loginRequestFields;\n        case urn_1.ParserType.SAMLResponse:\n            if (!assertion) {\n                // unexpected hit\n                throw new Error('ERR_EMPTY_ASSERTION');\n            }\n            return (0, extractor_1.loginResponseFields)(assertion);\n        case urn_1.ParserType.LogoutRequest:\n            return extractor_1.logoutRequestFields;\n        case urn_1.ParserType.LogoutResponse:\n            return extractor_1.logoutResponseFields;\n        default:\n            throw new Error('ERR_UNDEFINED_PARSERTYPE');\n    }\n}\n// proceed the redirect binding flow\nfunction redirectFlow(options) {\n    return __awaiter(this, void 0, void 0, function () {\n        var request, parserType, self, _a, checkSignature, from, query, octetString, sigAlg, signature, targetEntityMetadata, direction, content, xmlString, e_1, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, decodeSigAlg, verified, issuer, extractedProperties;\n        return __generator(this, function (_b) {\n            switch (_b.label) {\n                case 0:\n                    request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;\n                    query = request.query, octetString = request.octetString;\n                    sigAlg = query.SigAlg, signature = query.Signature;\n                    targetEntityMetadata = from.entityMeta;\n                    direction = libsaml_1.default.getQueryParamByType(parserType);\n                    content = query[direction];\n                    // query must contain the saml content\n                    if (content === undefined) {\n                        return [2 /*return*/, Promise.reject('ERR_REDIRECT_FLOW_BAD_ARGS')];\n                    }\n                    xmlString = (0, utility_1.inflateString)(decodeURIComponent(content));\n                    _b.label = 1;\n                case 1:\n                    _b.trys.push([1, 3, , 4]);\n                    return [4 /*yield*/, libsaml_1.default.isValidXml(xmlString)];\n                case 2:\n                    _b.sent();\n                    return [3 /*break*/, 4];\n                case 3:\n                    e_1 = _b.sent();\n                    return [2 /*return*/, Promise.reject('ERR_INVALID_XML')];\n                case 4: \n                // check status based on different scenarios\n                return [4 /*yield*/, checkStatus(xmlString, parserType)];\n                case 5:\n                    // check status based on different scenarios\n                    _b.sent();\n                    assertion = '';\n                    if (parserType === urlParams.samlResponse) {\n                        verifiedDoc = (0, extractor_1.extract)(xmlString, [{\n                                key: 'assertion',\n                                localPath: ['~Response', 'Assertion'],\n                                attributes: [],\n                                context: true\n                            }]);\n                        if (verifiedDoc && verifiedDoc.assertion) {\n                            assertion = verifiedDoc.assertion;\n                        }\n                    }\n                    extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);\n                    parseResult = {\n                        samlContent: xmlString,\n                        sigAlg: null,\n                        extract: (0, extractor_1.extract)(xmlString, extractorFields),\n                    };\n                    // see if signature check is required\n                    // only verify message signature is enough\n                    if (checkSignature) {\n                        if (!signature || !sigAlg) {\n                            return [2 /*return*/, Promise.reject('ERR_MISSING_SIG_ALG')];\n                        }\n                        base64Signature = Buffer.from(decodeURIComponent(signature), 'base64');\n                        decodeSigAlg = decodeURIComponent(sigAlg);\n                        verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);\n                        if (!verified) {\n                            // Fail to verify message signature\n                            return [2 /*return*/, Promise.reject('ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION')];\n                        }\n                        parseResult.sigAlg = decodeSigAlg;\n                    }\n                    issuer = targetEntityMetadata.getEntityID();\n                    extractedProperties = parseResult.extract;\n                    // unmatched issuer\n                    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')\n                        && extractedProperties\n                        && extractedProperties.issuer !== issuer) {\n                        return [2 /*return*/, Promise.reject('ERR_UNMATCH_ISSUER')];\n                    }\n                    // invalid session time\n                    // only run the verifyTime when `SessionNotOnOrAfter` exists\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.sessionIndex.sessionNotOnOrAfter\n                        && !(0, validator_1.verifyTime)(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_EXPIRED_SESSION')];\n                    }\n                    // invalid time\n                    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.conditions\n                        && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_SUBJECT_UNCONFIRMED')];\n                    }\n                    return [2 /*return*/, Promise.resolve(parseResult)];\n            }\n        });\n    });\n}\n// proceed the post flow\nfunction postFlow(options) {\n    return __awaiter(this, void 0, void 0, function () {\n        var request, from, self, parserType, _a, checkSignature, body, direction, encodedRequest, samlContent, verificationOptions, decryptRequired, extractorFields, _b, verified, verifiedAssertionNode, result, result, decryptedDoc, _c, decryptedDocVerified, verifiedDecryptedAssertion, parseResult, targetEntityMetadata, issuer, extractedProperties;\n        return __generator(this, function (_d) {\n            switch (_d.label) {\n                case 0:\n                    request = options.request, from = options.from, self = options.self, parserType = options.parserType, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a;\n                    body = request.body;\n                    direction = libsaml_1.default.getQueryParamByType(parserType);\n                    encodedRequest = body[direction];\n                    samlContent = String((0, utility_1.base64Decode)(encodedRequest));\n                    verificationOptions = {\n                        metadata: from.entityMeta,\n                        signatureAlgorithm: from.entitySetting.requestSignatureAlgorithm,\n                    };\n                    decryptRequired = from.entitySetting.isAssertionEncrypted;\n                    extractorFields = [];\n                    // validate the xml first\n                    return [4 /*yield*/, libsaml_1.default.isValidXml(samlContent)];\n                case 1:\n                    // validate the xml first\n                    _d.sent();\n                    if (parserType !== urlParams.samlResponse) {\n                        extractorFields = getDefaultExtractorFields(parserType, null);\n                    }\n                    // check status based on different scenarios\n                    return [4 /*yield*/, checkStatus(samlContent, parserType)];\n                case 2:\n                    // check status based on different scenarios\n                    _d.sent();\n                    if (!checkSignature) return [3 /*break*/, 7];\n                    _b = __read(libsaml_1.default.verifySignature(samlContent, verificationOptions), 2), verified = _b[0], verifiedAssertionNode = _b[1];\n                    if (!(decryptRequired && verified && parserType === 'SAMLResponse' && verifiedAssertionNode)) return [3 /*break*/, 4];\n                    return [4 /*yield*/, libsaml_1.default.decryptAssertion(self, verifiedAssertionNode)];\n                case 3:\n                    result = _d.sent();\n                    samlContent = result[0];\n                    // extractor depends on signed content\n                    extractorFields = getDefaultExtractorFields(parserType, result[1]);\n                    return [3 /*break*/, 7];\n                case 4:\n                    if (!(decryptRequired && !verified)) return [3 /*break*/, 6];\n                    return [4 /*yield*/, libsaml_1.default.decryptAssertion(self, samlContent)];\n                case 5:\n                    result = _d.sent();\n                    decryptedDoc = result[0];\n                    _c = __read(libsaml_1.default.verifySignature(decryptedDoc, verificationOptions), 2), decryptedDocVerified = _c[0], verifiedDecryptedAssertion = _c[1];\n                    if (decryptedDocVerified) {\n                        // extractor depends on signed content\n                        extractorFields = getDefaultExtractorFields(parserType, verifiedDecryptedAssertion);\n                    }\n                    else {\n                        return [2 /*return*/, Promise.reject('FAILED_TO_VERIFY_SIGNATURE')];\n                    }\n                    return [3 /*break*/, 7];\n                case 6:\n                    if (verified) {\n                        // extractor depends on signed content\n                        extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);\n                    }\n                    else {\n                        return [2 /*return*/, Promise.reject('FAILED_TO_VERIFY_SIGNATURE')];\n                    }\n                    _d.label = 7;\n                case 7:\n                    parseResult = {\n                        samlContent: samlContent,\n                        extract: (0, extractor_1.extract)(samlContent, extractorFields),\n                    };\n                    targetEntityMetadata = from.entityMeta;\n                    issuer = targetEntityMetadata.getEntityID();\n                    extractedProperties = parseResult.extract;\n                    // unmatched issuer\n                    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')\n                        && extractedProperties\n                        && extractedProperties.issuer !== issuer) {\n                        return [2 /*return*/, Promise.reject('ERR_UNMATCH_ISSUER')];\n                    }\n                    // invalid session time\n                    // only run the verifyTime when `SessionNotOnOrAfter` exists\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.sessionIndex.sessionNotOnOrAfter\n                        && !(0, validator_1.verifyTime)(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_EXPIRED_SESSION')];\n                    }\n                    // invalid time\n                    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.conditions\n                        && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_SUBJECT_UNCONFIRMED')];\n                    }\n                    return [2 /*return*/, Promise.resolve(parseResult)];\n            }\n        });\n    });\n}\n// proceed the post simple sign binding flow\nfunction postSimpleSignFlow(options) {\n    return __awaiter(this, void 0, void 0, function () {\n        var request, parserType, self, _a, checkSignature, from, body, octetString, targetEntityMetadata, direction, encodedRequest, sigAlg, signature, xmlString, e_2, assertion, verifiedDoc, extractorFields, parseResult, base64Signature, verified, issuer, extractedProperties;\n        return __generator(this, function (_b) {\n            switch (_b.label) {\n                case 0:\n                    request = options.request, parserType = options.parserType, self = options.self, _a = options.checkSignature, checkSignature = _a === void 0 ? true : _a, from = options.from;\n                    body = request.body, octetString = request.octetString;\n                    targetEntityMetadata = from.entityMeta;\n                    direction = libsaml_1.default.getQueryParamByType(parserType);\n                    encodedRequest = body[direction];\n                    sigAlg = body['SigAlg'];\n                    signature = body['Signature'];\n                    // query must contain the saml content\n                    if (encodedRequest === undefined) {\n                        return [2 /*return*/, Promise.reject('ERR_SIMPLESIGN_FLOW_BAD_ARGS')];\n                    }\n                    xmlString = String((0, utility_1.base64Decode)(encodedRequest));\n                    _b.label = 1;\n                case 1:\n                    _b.trys.push([1, 3, , 4]);\n                    return [4 /*yield*/, libsaml_1.default.isValidXml(xmlString)];\n                case 2:\n                    _b.sent();\n                    return [3 /*break*/, 4];\n                case 3:\n                    e_2 = _b.sent();\n                    return [2 /*return*/, Promise.reject('ERR_INVALID_XML')];\n                case 4: \n                // check status based on different scenarios\n                return [4 /*yield*/, checkStatus(xmlString, parserType)];\n                case 5:\n                    // check status based on different scenarios\n                    _b.sent();\n                    assertion = '';\n                    if (parserType === urlParams.samlResponse) {\n                        verifiedDoc = (0, extractor_1.extract)(xmlString, [{\n                                key: 'assertion',\n                                localPath: ['~Response', 'Assertion'],\n                                attributes: [],\n                                context: true\n                            }]);\n                        if (verifiedDoc && verifiedDoc.assertion) {\n                            assertion = verifiedDoc.assertion;\n                        }\n                    }\n                    extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);\n                    parseResult = {\n                        samlContent: xmlString,\n                        sigAlg: null,\n                        extract: (0, extractor_1.extract)(xmlString, extractorFields),\n                    };\n                    // see if signature check is required\n                    // only verify message signature is enough\n                    if (checkSignature) {\n                        if (!signature || !sigAlg) {\n                            return [2 /*return*/, Promise.reject('ERR_MISSING_SIG_ALG')];\n                        }\n                        base64Signature = Buffer.from(signature, 'base64');\n                        verified = libsaml_1.default.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);\n                        if (!verified) {\n                            // Fail to verify message signature\n                            return [2 /*return*/, Promise.reject('ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION')];\n                        }\n                        parseResult.sigAlg = sigAlg;\n                    }\n                    issuer = targetEntityMetadata.getEntityID();\n                    extractedProperties = parseResult.extract;\n                    // unmatched issuer\n                    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')\n                        && extractedProperties\n                        && extractedProperties.issuer !== issuer) {\n                        return [2 /*return*/, Promise.reject('ERR_UNMATCH_ISSUER')];\n                    }\n                    // invalid session time\n                    // only run the verifyTime when `SessionNotOnOrAfter` exists\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.sessionIndex.sessionNotOnOrAfter\n                        && !(0, validator_1.verifyTime)(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_EXPIRED_SESSION')];\n                    }\n                    // invalid time\n                    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n                    if (parserType === 'SAMLResponse'\n                        && extractedProperties.conditions\n                        && !(0, validator_1.verifyTime)(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {\n                        return [2 /*return*/, Promise.reject('ERR_SUBJECT_UNCONFIRMED')];\n                    }\n                    return [2 /*return*/, Promise.resolve(parseResult)];\n            }\n        });\n    });\n}\nfunction checkStatus(content, parserType) {\n    // only check response parser\n    if (parserType !== urlParams.samlResponse && parserType !== urlParams.logoutResponse) {\n        return Promise.resolve('SKIPPED');\n    }\n    var fields = parserType === urlParams.samlResponse\n        ? extractor_1.loginResponseStatusFields\n        : extractor_1.logoutResponseStatusFields;\n    var _a = (0, extractor_1.extract)(content, fields), top = _a.top, second = _a.second;\n    // only resolve when top-tier status code is success\n    if (top === urn_1.StatusCode.Success) {\n        return Promise.resolve('OK');\n    }\n    if (!top) {\n        throw new Error('ERR_UNDEFINED_STATUS');\n    }\n    // returns a detailed error for two-tier error code\n    throw new Error(\"ERR_FAILED_STATUS with top tier code: \".concat(top, \", second tier code: \").concat(second));\n}\nfunction flow(options) {\n    var binding = options.binding;\n    var parserType = options.parserType;\n    options.supportBindings = [urn_1.BindingNamespace.Redirect, urn_1.BindingNamespace.Post, urn_1.BindingNamespace.SimpleSign];\n    // saml response  allows POST, REDIRECT\n    if (parserType === urn_1.ParserType.SAMLResponse) {\n        options.supportBindings = [urn_1.BindingNamespace.Post, urn_1.BindingNamespace.Redirect, urn_1.BindingNamespace.SimpleSign];\n    }\n    if (binding === bindDict.post) {\n        return postFlow(options);\n    }\n    if (binding === bindDict.redirect) {\n        return redirectFlow(options);\n    }\n    if (binding === bindDict.simpleSign) {\n        return postSimpleSignFlow(options);\n    }\n    return Promise.reject('ERR_UNEXPECTED_FLOW');\n}\nexports.flow = flow;\n//# sourceMappingURL=flow.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;CACA,IAAI,+BAA0B,aAAc,SAAU,SAAS,YAAY,GAAG,WAAW;EACrF,SAAS,MAAM,OAAO;AAAE,UAAO,iBAAiB,IAAI,QAAQ,IAAI,EAAE,SAAU,SAAS;AAAE,YAAQ,MAAM;KAAI;;AACzG,SAAO,KAAK,MAAM,IAAI,UAAU,SAAU,SAAS,QAAQ;GACvD,SAAS,UAAU,OAAO;AAAE,QAAI;AAAE,UAAK,UAAU,KAAK,MAAM,CAAC;aAAW,GAAG;AAAE,YAAO,EAAE;;;GACtF,SAAS,SAAS,OAAO;AAAE,QAAI;AAAE,UAAK,UAAU,SAAS,MAAM,CAAC;aAAW,GAAG;AAAE,YAAO,EAAE;;;GACzF,SAAS,KAAK,QAAQ;AAAE,WAAO,OAAO,QAAQ,OAAO,MAAM,GAAG,MAAM,OAAO,MAAM,CAAC,KAAK,WAAW,SAAS;;AAC3G,SAAM,YAAY,UAAU,MAAM,SAAS,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC;IACvE;;CAEN,IAAI,iCAA4B,eAAgB,SAAU,SAAS,MAAM;EACrE,IAAI,IAAI;GAAE,OAAO;GAAG,MAAM,WAAW;AAAE,QAAI,EAAE,KAAK,EAAG,OAAM,EAAE;AAAI,WAAO,EAAE;;GAAO,MAAM,EAAE;GAAE,KAAK,EAAE;GAAE,EAAE,GAAG,GAAG,GAAG;AAC/G,SAAO,IAAI;GAAE,MAAM,KAAK,EAAE;GAAE,SAAS,KAAK,EAAE;GAAE,UAAU,KAAK,EAAE;GAAE,EAAE,OAAO,WAAW,eAAe,EAAE,OAAO,YAAY,WAAW;AAAE,UAAO;MAAU;EACvJ,SAAS,KAAK,GAAG;AAAE,UAAO,SAAU,GAAG;AAAE,WAAO,KAAK,CAAC,GAAG,EAAE,CAAC;;;EAC5D,SAAS,KAAK,IAAI;AACd,OAAI,EAAG,OAAM,IAAI,UAAU,kCAAkC;AAC7D,UAAO,EAAG,KAAI;AACV,QAAI,IAAI,GAAG,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,YAAY,GAAG,KAAK,EAAE,cAAc,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,GAAG,GAAG,GAAG,EAAE,KAAM,QAAO;AAC3J,QAAI,IAAI,GAAG,EAAG,MAAK,CAAC,GAAG,KAAK,GAAG,EAAE,MAAM;AACvC,YAAQ,GAAG,IAAX;KACI,KAAK;KAAG,KAAK;AAAG,UAAI;AAAI;KACxB,KAAK;AAAG,QAAE;AAAS,aAAO;OAAE,OAAO,GAAG;OAAI,MAAM;OAAO;KACvD,KAAK;AAAG,QAAE;AAAS,UAAI,GAAG;AAAI,WAAK,CAAC,EAAE;AAAE;KACxC,KAAK;AAAG,WAAK,EAAE,IAAI,KAAK;AAAE,QAAE,KAAK,KAAK;AAAE;KACxC;AACI,UAAI,EAAE,IAAI,EAAE,MAAM,IAAI,EAAE,SAAS,KAAK,EAAE,EAAE,SAAS,QAAQ,GAAG,OAAO,KAAK,GAAG,OAAO,IAAI;AAAE,WAAI;AAAG;;AACjG,UAAI,GAAG,OAAO,MAAM,CAAC,KAAM,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,KAAM;AAAE,SAAE,QAAQ,GAAG;AAAI;;AAC9E,UAAI,GAAG,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI;AAAE,SAAE,QAAQ,EAAE;AAAI,WAAI;AAAI;;AAC7D,UAAI,KAAK,EAAE,QAAQ,EAAE,IAAI;AAAE,SAAE,QAAQ,EAAE;AAAI,SAAE,IAAI,KAAK,GAAG;AAAE;;AAC3D,UAAI,EAAE,GAAI,GAAE,IAAI,KAAK;AACrB,QAAE,KAAK,KAAK;AAAE;;AAEtB,SAAK,KAAK,KAAK,SAAS,EAAE;YACrB,GAAG;AAAE,SAAK,CAAC,GAAG,EAAE;AAAE,QAAI;aAAa;AAAE,QAAI,IAAI;;AACtD,OAAI,GAAG,KAAK,EAAG,OAAM,GAAG;AAAI,UAAO;IAAE,OAAO,GAAG,KAAK,GAAG,KAAK,KAAK;IAAG,MAAM;IAAM;;;CAGxF,IAAI,4BAAuB,UAAW,SAAU,GAAG,GAAG;EAClD,IAAI,IAAI,OAAO,WAAW,cAAc,EAAE,OAAO;AACjD,MAAI,CAAC,EAAG,QAAO;EACf,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE;AAC/B,MAAI;AACA,WAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAM,IAAG,KAAK,EAAE,MAAM;WAEvE,OAAO;AAAE,OAAI,EAAS,OAAO;YAC5B;AACJ,OAAI;AACA,QAAI,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,WAAY,GAAE,KAAK,EAAE;aAE5C;AAAE,QAAI,EAAG,OAAM,EAAE;;;AAE7B,SAAO;;CAEX,IAAI,qCAAgC,mBAAoB,SAAU,KAAK;AACnE,SAAQ,OAAO,IAAI,aAAc,MAAM,EAAE,WAAW,KAAK;;AAE7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,OAAO,KAAK;CACpB,IAAI;CACJ,IAAI;CACJ,IAAI,YAAY,kCAAqC;CACrD,IAAI;CACJ,IAAI;CACJ,IAAI,WAAW,MAAM,QAAQ;CAC7B,IAAI,YAAY,MAAM,QAAQ;CAE9B,SAAS,0BAA0B,YAAY,WAAW;AACtD,UAAQ,YAAR;GACI,KAAK,MAAM,WAAW,YAClB,QAAO,YAAY;GACvB,KAAK,MAAM,WAAW;AAClB,QAAI,CAAC,UAED,OAAM,IAAI,MAAM,sBAAsB;AAE1C,YAAQ,GAAG,YAAY,qBAAqB,UAAU;GAC1D,KAAK,MAAM,WAAW,cAClB,QAAO,YAAY;GACvB,KAAK,MAAM,WAAW,eAClB,QAAO,YAAY;GACvB,QACI,OAAM,IAAI,MAAM,2BAA2B;;;CAIvD,SAAS,aAAa,SAAS;AAC3B,SAAO,UAAU,MAAM,KAAK,GAAG,KAAK,GAAG,WAAY;GAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,gBAAgB,MAAM,OAAO,aAAa,QAAQ,WAAW,sBAAsB,WAAW,SAAS,WAAgB,WAAW,aAAa,iBAAiB,aAAa,iBAAiB,cAAc,UAAU,QAAQ;AACjQ,UAAO,YAAY,MAAM,SAAU,IAAI;AACnC,YAAQ,GAAG,OAAX;KACI,KAAK;AACD,gBAAU,QAAQ,SAAS,aAAa,QAAQ,YAAY,OAAO,QAAQ,MAAM,KAAK,QAAQ,gBAAgB,iBAAiB,OAAO,KAAK,IAAI,OAAO,IAAI,OAAO,QAAQ;AACzK,cAAQ,QAAQ,OAAO,cAAc,QAAQ;AAC7C,eAAS,MAAM,QAAQ,YAAY,MAAM;AACzC,6BAAuB,KAAK;AAC5B,kBAAY,UAAU,QAAQ,oBAAoB,WAAW;AAC7D,gBAAU,MAAM;AAEhB,UAAI,YAAY,OACZ,QAAO,CAAC,GAAc,QAAQ,OAAO,6BAA6B,CAAC;AAEvE,mBAAa,GAAG,UAAU,eAAe,mBAAmB,QAAQ,CAAC;AACrE,SAAG,QAAQ;KACf,KAAK;AACD,SAAG,KAAK,KAAK;OAAC;OAAG;;OAAK;OAAE,CAAC;AACzB,aAAO,CAAC,GAAa,UAAU,QAAQ,WAAW,UAAU,CAAC;KACjE,KAAK;AACD,SAAG,MAAM;AACT,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,MAAM,GAAG,MAAM;AACf,aAAO,CAAC,GAAc,QAAQ,OAAO,kBAAkB,CAAC;KAC5D,KAAK,EAEL,QAAO,CAAC,GAAa,YAAY,WAAW,WAAW,CAAC;KACxD,KAAK;AAED,SAAG,MAAM;AACT,kBAAY;AACZ,UAAI,eAAe,UAAU,cAAc;AACvC,sBAAe,GAAG,YAAY,SAAS,WAAW,CAAC;QAC3C,KAAK;QACL,WAAW,CAAC,aAAa,YAAY;QACrC,YAAY,EAAE;QACd,SAAS;QACZ,CAAC,CAAC;AACP,WAAI,eAAe,YAAY,UAC3B,aAAY,YAAY;;AAGhC,wBAAkB,0BAA0B,YAAY,UAAU,SAAS,IAAI,YAAY,KAAK;AAChG,oBAAc;OACV,aAAa;OACb,QAAQ;OACR,UAAU,GAAG,YAAY,SAAS,WAAW,gBAAgB;OAChE;AAGD,UAAI,gBAAgB;AAChB,WAAI,CAAC,aAAa,CAAC,OACf,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAEhE,yBAAkB,OAAO,KAAK,mBAAmB,UAAU,EAAE,SAAS;AACtE,sBAAe,mBAAmB,OAAO;AACzC,kBAAW,UAAU,QAAQ,uBAAuB,sBAAsB,aAAa,iBAAiB,OAAO;AAC/G,WAAI,CAAC,SAED,QAAO,CAAC,GAAc,QAAQ,OAAO,4CAA4C,CAAC;AAEtF,mBAAY,SAAS;;AAEzB,eAAS,qBAAqB,aAAa;AAC3C,4BAAsB,YAAY;AAElC,WAAK,eAAe,oBAAoB,eAAe,mBAChD,uBACA,oBAAoB,WAAW,OAClC,QAAO,CAAC,GAAc,QAAQ,OAAO,qBAAqB,CAAC;AAI/D,UAAI,eAAe,kBACZ,oBAAoB,aAAa,uBACjC,EAAE,GAAG,YAAY,YAAY,QAAW,oBAAoB,aAAa,qBAAqB,KAAK,cAAc,YAAY,CAChI,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAIhE,UAAI,eAAe,kBACZ,oBAAoB,cACpB,EAAE,GAAG,YAAY,YAAY,oBAAoB,WAAW,WAAW,oBAAoB,WAAW,cAAc,KAAK,cAAc,YAAY,CACtJ,QAAO,CAAC,GAAc,QAAQ,OAAO,0BAA0B,CAAC;AAEpE,aAAO,CAAC,GAAc,QAAQ,QAAQ,YAAY,CAAC;;KAE7D;IACJ;;CAGN,SAAS,SAAS,SAAS;AACvB,SAAO,UAAU,MAAM,KAAK,GAAG,KAAK,GAAG,WAAY;GAC/C,IAAI,SAAS,MAAM,MAAM,YAAY,IAAI,gBAAgB,MAAM,WAAW,gBAAgB,aAAa,qBAAqB,iBAAiB,iBAAiB,IAAI,UAAU,uBAAuB,QAAQ,QAAQ,cAAc,IAAI,sBAAsB,4BAA4B,aAAa,sBAAsB,QAAQ;AAClU,UAAO,YAAY,MAAM,SAAU,IAAI;AACnC,YAAQ,GAAG,OAAX;KACI,KAAK;AACD,gBAAU,QAAQ,SAAS,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,aAAa,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,iBAAiB,OAAO,KAAK,IAAI,OAAO;AAC3K,aAAO,QAAQ;AACf,kBAAY,UAAU,QAAQ,oBAAoB,WAAW;AAC7D,uBAAiB,KAAK;AACtB,oBAAc,QAAQ,GAAG,UAAU,cAAc,eAAe,CAAC;AACjE,4BAAsB;OAClB,UAAU,KAAK;OACf,oBAAoB,KAAK,cAAc;OAC1C;AACD,wBAAkB,KAAK,cAAc;AACrC,wBAAkB,EAAE;AAEpB,aAAO,CAAC,GAAa,UAAU,QAAQ,WAAW,YAAY,CAAC;KACnE,KAAK;AAED,SAAG,MAAM;AACT,UAAI,eAAe,UAAU,aACzB,mBAAkB,0BAA0B,YAAY,KAAK;AAGjE,aAAO,CAAC,GAAa,YAAY,aAAa,WAAW,CAAC;KAC9D,KAAK;AAED,SAAG,MAAM;AACT,UAAI,CAAC,eAAgB,QAAO,CAAC,GAAa,EAAE;AAC5C,WAAK,OAAO,UAAU,QAAQ,gBAAgB,aAAa,oBAAoB,EAAE,EAAE,EAAE,WAAW,GAAG,IAAI,wBAAwB,GAAG;AAClI,UAAI,EAAE,mBAAmB,YAAY,eAAe,kBAAkB,uBAAwB,QAAO,CAAC,GAAa,EAAE;AACrH,aAAO,CAAC,GAAa,UAAU,QAAQ,iBAAiB,MAAM,sBAAsB,CAAC;KACzF,KAAK;AACD,eAAS,GAAG,MAAM;AAClB,oBAAc,OAAO;AAErB,wBAAkB,0BAA0B,YAAY,OAAO,GAAG;AAClE,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,UAAI,EAAE,mBAAmB,CAAC,UAAW,QAAO,CAAC,GAAa,EAAE;AAC5D,aAAO,CAAC,GAAa,UAAU,QAAQ,iBAAiB,MAAM,YAAY,CAAC;KAC/E,KAAK;AACD,eAAS,GAAG,MAAM;AAClB,qBAAe,OAAO;AACtB,WAAK,OAAO,UAAU,QAAQ,gBAAgB,cAAc,oBAAoB,EAAE,EAAE,EAAE,uBAAuB,GAAG,IAAI,6BAA6B,GAAG;AACpJ,UAAI,qBAEA,mBAAkB,0BAA0B,YAAY,2BAA2B;UAGnF,QAAO,CAAC,GAAc,QAAQ,OAAO,6BAA6B,CAAC;AAEvE,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,UAAI,SAEA,mBAAkB,0BAA0B,YAAY,sBAAsB;UAG9E,QAAO,CAAC,GAAc,QAAQ,OAAO,6BAA6B,CAAC;AAEvE,SAAG,QAAQ;KACf,KAAK;AACD,oBAAc;OACG;OACb,UAAU,GAAG,YAAY,SAAS,aAAa,gBAAgB;OAClE;AACD,6BAAuB,KAAK;AAC5B,eAAS,qBAAqB,aAAa;AAC3C,4BAAsB,YAAY;AAElC,WAAK,eAAe,oBAAoB,eAAe,mBAChD,uBACA,oBAAoB,WAAW,OAClC,QAAO,CAAC,GAAc,QAAQ,OAAO,qBAAqB,CAAC;AAI/D,UAAI,eAAe,kBACZ,oBAAoB,aAAa,uBACjC,EAAE,GAAG,YAAY,YAAY,QAAW,oBAAoB,aAAa,qBAAqB,KAAK,cAAc,YAAY,CAChI,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAIhE,UAAI,eAAe,kBACZ,oBAAoB,cACpB,EAAE,GAAG,YAAY,YAAY,oBAAoB,WAAW,WAAW,oBAAoB,WAAW,cAAc,KAAK,cAAc,YAAY,CACtJ,QAAO,CAAC,GAAc,QAAQ,OAAO,0BAA0B,CAAC;AAEpE,aAAO,CAAC,GAAc,QAAQ,QAAQ,YAAY,CAAC;;KAE7D;IACJ;;CAGN,SAAS,mBAAmB,SAAS;AACjC,SAAO,UAAU,MAAM,KAAK,GAAG,KAAK,GAAG,WAAY;GAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,gBAAgB,MAAM,MAAM,aAAa,sBAAsB,WAAW,gBAAgB,QAAQ,WAAW,WAAgB,WAAW,aAAa,iBAAiB,aAAa,iBAAiB,UAAU,QAAQ;AACzP,UAAO,YAAY,MAAM,SAAU,IAAI;AACnC,YAAQ,GAAG,OAAX;KACI,KAAK;AACD,gBAAU,QAAQ,SAAS,aAAa,QAAQ,YAAY,OAAO,QAAQ,MAAM,KAAK,QAAQ,gBAAgB,iBAAiB,OAAO,KAAK,IAAI,OAAO,IAAI,OAAO,QAAQ;AACzK,aAAO,QAAQ,MAAM,cAAc,QAAQ;AAC3C,6BAAuB,KAAK;AAC5B,kBAAY,UAAU,QAAQ,oBAAoB,WAAW;AAC7D,uBAAiB,KAAK;AACtB,eAAS,KAAK;AACd,kBAAY,KAAK;AAEjB,UAAI,mBAAmB,OACnB,QAAO,CAAC,GAAc,QAAQ,OAAO,+BAA+B,CAAC;AAEzE,kBAAY,QAAQ,GAAG,UAAU,cAAc,eAAe,CAAC;AAC/D,SAAG,QAAQ;KACf,KAAK;AACD,SAAG,KAAK,KAAK;OAAC;OAAG;;OAAK;OAAE,CAAC;AACzB,aAAO,CAAC,GAAa,UAAU,QAAQ,WAAW,UAAU,CAAC;KACjE,KAAK;AACD,SAAG,MAAM;AACT,aAAO,CAAC,GAAa,EAAE;KAC3B,KAAK;AACD,MAAM,GAAG,MAAM;AACf,aAAO,CAAC,GAAc,QAAQ,OAAO,kBAAkB,CAAC;KAC5D,KAAK,EAEL,QAAO,CAAC,GAAa,YAAY,WAAW,WAAW,CAAC;KACxD,KAAK;AAED,SAAG,MAAM;AACT,kBAAY;AACZ,UAAI,eAAe,UAAU,cAAc;AACvC,sBAAe,GAAG,YAAY,SAAS,WAAW,CAAC;QAC3C,KAAK;QACL,WAAW,CAAC,aAAa,YAAY;QACrC,YAAY,EAAE;QACd,SAAS;QACZ,CAAC,CAAC;AACP,WAAI,eAAe,YAAY,UAC3B,aAAY,YAAY;;AAGhC,wBAAkB,0BAA0B,YAAY,UAAU,SAAS,IAAI,YAAY,KAAK;AAChG,oBAAc;OACV,aAAa;OACb,QAAQ;OACR,UAAU,GAAG,YAAY,SAAS,WAAW,gBAAgB;OAChE;AAGD,UAAI,gBAAgB;AAChB,WAAI,CAAC,aAAa,CAAC,OACf,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAEhE,yBAAkB,OAAO,KAAK,WAAW,SAAS;AAClD,kBAAW,UAAU,QAAQ,uBAAuB,sBAAsB,aAAa,iBAAiB,OAAO;AAC/G,WAAI,CAAC,SAED,QAAO,CAAC,GAAc,QAAQ,OAAO,4CAA4C,CAAC;AAEtF,mBAAY,SAAS;;AAEzB,eAAS,qBAAqB,aAAa;AAC3C,4BAAsB,YAAY;AAElC,WAAK,eAAe,oBAAoB,eAAe,mBAChD,uBACA,oBAAoB,WAAW,OAClC,QAAO,CAAC,GAAc,QAAQ,OAAO,qBAAqB,CAAC;AAI/D,UAAI,eAAe,kBACZ,oBAAoB,aAAa,uBACjC,EAAE,GAAG,YAAY,YAAY,QAAW,oBAAoB,aAAa,qBAAqB,KAAK,cAAc,YAAY,CAChI,QAAO,CAAC,GAAc,QAAQ,OAAO,sBAAsB,CAAC;AAIhE,UAAI,eAAe,kBACZ,oBAAoB,cACpB,EAAE,GAAG,YAAY,YAAY,oBAAoB,WAAW,WAAW,oBAAoB,WAAW,cAAc,KAAK,cAAc,YAAY,CACtJ,QAAO,CAAC,GAAc,QAAQ,OAAO,0BAA0B,CAAC;AAEpE,aAAO,CAAC,GAAc,QAAQ,QAAQ,YAAY,CAAC;;KAE7D;IACJ;;CAEN,SAAS,YAAY,SAAS,YAAY;AAEtC,MAAI,eAAe,UAAU,gBAAgB,eAAe,UAAU,eAClE,QAAO,QAAQ,QAAQ,UAAU;EAErC,IAAI,SAAS,eAAe,UAAU,eAChC,YAAY,4BACZ,YAAY;EAClB,IAAI,MAAM,GAAG,YAAY,SAAS,SAAS,OAAO,EAAE,MAAM,GAAG,KAAK,SAAS,GAAG;AAE9E,MAAI,QAAQ,MAAM,WAAW,QACzB,QAAO,QAAQ,QAAQ,KAAK;AAEhC,MAAI,CAAC,IACD,OAAM,IAAI,MAAM,uBAAuB;AAG3C,QAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,uBAAuB,CAAC,OAAO,OAAO,CAAC;;CAEhH,SAAS,KAAK,SAAS;EACnB,IAAI,UAAU,QAAQ;EACtB,IAAI,aAAa,QAAQ;AACzB,UAAQ,kBAAkB;GAAC,MAAM,iBAAiB;GAAU,MAAM,iBAAiB;GAAM,MAAM,iBAAiB;GAAW;AAE3H,MAAI,eAAe,MAAM,WAAW,aAChC,SAAQ,kBAAkB;GAAC,MAAM,iBAAiB;GAAM,MAAM,iBAAiB;GAAU,MAAM,iBAAiB;GAAW;AAE/H,MAAI,YAAY,SAAS,KACrB,QAAO,SAAS,QAAQ;AAE5B,MAAI,YAAY,SAAS,SACrB,QAAO,aAAa,QAAQ;AAEhC,MAAI,YAAY,SAAS,WACrB,QAAO,mBAAmB,QAAQ;AAEtC,SAAO,QAAQ,OAAO,sBAAsB;;AAEhD,SAAQ,OAAO"}