@maronn-openid-connect/core 0.0.1

package/dist/authorization-request.js

@@ -0,0 +1,457 @@
+import { sanitizeErrorDescription } from './error-utils.js';
+import { isLoopbackHostname } from './loopback.js';
+import { parseRequestObject, RequestObjectError } from './request-object.js';
+export const DEFAULT_REQUEST_OBJECT_SIGNING_ALGS = ['RS256'];
+export var AuthorizationErrorCode;
+(function (AuthorizationErrorCode) {
+    AuthorizationErrorCode["InvalidRequest"] = "invalid_request";
+    AuthorizationErrorCode["UnauthorizedClient"] = "unauthorized_client";
+    AuthorizationErrorCode["AccessDenied"] = "access_denied";
+    AuthorizationErrorCode["UnsupportedResponseType"] = "unsupported_response_type";
+    AuthorizationErrorCode["InvalidScope"] = "invalid_scope";
+    AuthorizationErrorCode["ServerError"] = "server_error";
+    AuthorizationErrorCode["TemporarilyUnavailable"] = "temporarily_unavailable";
+    AuthorizationErrorCode["InteractionRequired"] = "interaction_required";
+    AuthorizationErrorCode["LoginRequired"] = "login_required";
+    AuthorizationErrorCode["AccountSelectionRequired"] = "account_selection_required";
+    AuthorizationErrorCode["ConsentRequired"] = "consent_required";
+    AuthorizationErrorCode["RequestNotSupported"] = "request_not_supported";
+    AuthorizationErrorCode["RequestUriNotSupported"] = "request_uri_not_supported";
+    AuthorizationErrorCode["RegistrationNotSupported"] = "registration_not_supported";
+})(AuthorizationErrorCode || (AuthorizationErrorCode = {}));
+export const defaultIsOfflineAccessGranted = (_request, { promptValues }) => promptValues.includes('consent');
+export const DEFAULT_MAX_CLAIMS_PARAMETER_LENGTH = 16384;
+export class AuthorizationError extends Error {
+    error;
+    errorDescription;
+    redirectUri;
+    state;
+    constructor(error, errorDescription, redirectUri, state) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'AuthorizationError';
+        this.error = error;
+        this.errorDescription = sanitized;
+        this.redirectUri = redirectUri;
+        this.state = state;
+    }
+    get redirectable() {
+        return this.redirectUri !== undefined;
+    }
+}
+const VALID_PROMPT_VALUES = ['none', 'login', 'consent', 'select_account'];
+const VALID_DISPLAY_VALUES = ['page', 'popup', 'touch', 'wap'];
+const VALID_CODE_CHALLENGE_METHODS = ['S256'];
+const CODE_CHALLENGE_S256_LENGTH = 43;
+const CODE_CHALLENGE_S256_PATTERN = /^[A-Za-z0-9\-_]+$/;
+function matchRedirectUri(requestUri, registeredUris, clientType) {
+    if (registeredUris.includes(requestUri)) {
+        return true;
+    }
+    if (clientType !== 'public') {
+        return false;
+    }
+    try {
+        const requestUrl = new URL(requestUri);
+        if (isLoopbackHostname(requestUrl.hostname)) {
+            return registeredUris.some((registeredUri) => {
+                try {
+                    const registeredUrl = new URL(registeredUri);
+                    return (isLoopbackHostname(registeredUrl.hostname) &&
+                        requestUrl.protocol === registeredUrl.protocol &&
+                        requestUrl.hostname === registeredUrl.hostname &&
+                        requestUrl.pathname === registeredUrl.pathname &&
+                        requestUrl.search === registeredUrl.search);
+                }
+                catch {
+                    return false;
+                }
+            });
+        }
+    }
+    catch {
+    }
+    return false;
+}
+const DANGEROUS_SCHEMES = new Set([
+    'javascript:',
+    'data:',
+    'file:',
+    'vbscript:',
+    'blob:',
+]);
+export function validateRegisteredRedirectUris(registeredUris) {
+    for (const uri of registeredUris) {
+        if (uri.includes('#')) {
+            throw new AuthorizationError(AuthorizationErrorCode.ServerError, `Registered redirect_uri must not contain fragment: ${uri}`);
+        }
+        const colonIndex = uri.indexOf(':');
+        if (colonIndex === -1) {
+            throw new AuthorizationError(AuthorizationErrorCode.ServerError, `Registered redirect_uri must include a scheme: ${uri}`);
+        }
+        const scheme = uri.slice(0, colonIndex + 1).toLowerCase();
+        if (DANGEROUS_SCHEMES.has(scheme)) {
+            throw new AuthorizationError(AuthorizationErrorCode.ServerError, `Registered redirect_uri uses a dangerous scheme: ${scheme} (${uri})`);
+        }
+        if (scheme === 'http:') {
+            let parsed;
+            try {
+                parsed = new URL(uri);
+            }
+            catch {
+                throw new AuthorizationError(AuthorizationErrorCode.ServerError, `Registered redirect_uri is not a valid URL: ${uri}`);
+            }
+            if (!isLoopbackHostname(parsed.hostname)) {
+                throw new AuthorizationError(AuthorizationErrorCode.ServerError, `Registered redirect_uri must use https:// or loopback http:// — got ${uri}`);
+            }
+        }
+    }
+}
+function resolveRedirectUri(requestRedirectUri, registeredUris, clientType) {
+    if (requestRedirectUri !== undefined) {
+        if (requestRedirectUri.includes('#')) {
+            throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'redirect_uri must not contain fragment');
+        }
+        if (!matchRedirectUri(requestRedirectUri, registeredUris, clientType)) {
+            throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'redirect_uri not registered');
+        }
+        return requestRedirectUri;
+    }
+    if (registeredUris.length === 1) {
+        return registeredUris[0];
+    }
+    throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'redirect_uri is required when multiple redirect URIs are registered');
+}
+export function resolveAuthorizationRedirectUri(effectiveParams, client) {
+    return resolveRedirectUri(effectiveParams.redirect_uri, client.redirectUris, client.clientType);
+}
+export function validatePromptParameter(effectiveParams, redirectUri, state) {
+    if (effectiveParams.prompt === undefined) {
+        return undefined;
+    }
+    return validatePrompt(effectiveParams.prompt, redirectUri, state);
+}
+function validatePrompt(promptValue, redirectUri, state) {
+    const values = promptValue.split(' ').filter((v) => v.length > 0);
+    for (const value of values) {
+        if (!VALID_PROMPT_VALUES.includes(value)) {
+            throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, `Invalid prompt value: ${value}`, redirectUri, state);
+        }
+    }
+    if (values.includes('none') && values.length > 1) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'prompt value "none" must not be combined with other values', redirectUri, state);
+    }
+    return values;
+}
+function validateMaxAge(maxAgeValue, redirectUri, state) {
+    const num = Number(maxAgeValue);
+    if (!Number.isFinite(num) || !Number.isInteger(num) || num < 0) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'max_age must be a non-negative integer', redirectUri, state);
+    }
+    return num;
+}
+function validateDefaultMaxAge(defaultMaxAge) {
+    if (!Number.isFinite(defaultMaxAge) ||
+        !Number.isInteger(defaultMaxAge) ||
+        defaultMaxAge < 0) {
+        throw new AuthorizationError(AuthorizationErrorCode.ServerError, 'Registered default_max_age must be a non-negative integer');
+    }
+    return defaultMaxAge;
+}
+export function resolveMaxAge(effectiveParams, client, redirectUri, state) {
+    if (effectiveParams.max_age !== undefined) {
+        return validateMaxAge(effectiveParams.max_age, redirectUri, state);
+    }
+    if (client.defaultMaxAge !== undefined) {
+        return validateDefaultMaxAge(client.defaultMaxAge);
+    }
+    return undefined;
+}
+function validateCodeChallenge(codeChallenge, codeChallengeMethod, redirectUri, state) {
+    if (!codeChallenge) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'Missing required parameter: code_challenge', redirectUri, state);
+    }
+    if (!codeChallengeMethod) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'Missing required parameter: code_challenge_method', redirectUri, state);
+    }
+    if (!VALID_CODE_CHALLENGE_METHODS.includes(codeChallengeMethod)) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, `Unsupported code_challenge_method: ${codeChallengeMethod}`, redirectUri, state);
+    }
+    if (codeChallenge.length !== CODE_CHALLENGE_S256_LENGTH) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, `code_challenge must be a ${CODE_CHALLENGE_S256_LENGTH}-character base64url-encoded SHA-256 hash for S256`, redirectUri, state);
+    }
+    if (!CODE_CHALLENGE_S256_PATTERN.test(codeChallenge)) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'code_challenge contains invalid characters (must be base64url: [A-Za-z0-9-_], 43 chars)', redirectUri, state);
+    }
+    return {
+        codeChallenge,
+        codeChallengeMethod: codeChallengeMethod,
+    };
+}
+export function validateAuthorizationCodePkce(effectiveParams, client, redirectUri, state, options = {}) {
+    const codeChallenge = effectiveParams.code_challenge;
+    const codeChallengeMethod = effectiveParams.code_challenge_method;
+    const pkceOmitted = codeChallenge === undefined && codeChallengeMethod === undefined;
+    if (pkceOmitted &&
+        options.allowNonPkceAuthorizationCodeFlow === true &&
+        client.clientType === 'confidential') {
+        return {};
+    }
+    return validateCodeChallenge(codeChallenge, codeChallengeMethod, redirectUri, state);
+}
+export async function resolveClientForAuthorization(params, clientResolver) {
+    const clientId = params.client_id;
+    if (!clientId) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'Missing required parameter: client_id');
+    }
+    const client = await clientResolver.findClient(clientId);
+    if (!client) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'Unknown client_id');
+    }
+    if (client.clientId !== clientId) {
+        throw new AuthorizationError(AuthorizationErrorCode.ServerError, `ClientResolver returned mismatched clientId: expected "${clientId}", got "${client.clientId}". ` +
+            'Ensure findClient returns data for the queried client_id. ' +
+            'clientId mismatch detected.');
+    }
+    return client;
+}
+export async function resolveRequestObjectParams(params, client, options = {}) {
+    if (params.request === undefined) {
+        return { effectiveParams: { ...params } };
+    }
+    let requestObjectClaims;
+    try {
+        requestObjectClaims = await parseRequestObject(params.request, {
+            jwks: client.jwks,
+            supportedSigningAlgs: options.supportedSigningAlgs ?? [
+                ...DEFAULT_REQUEST_OBJECT_SIGNING_ALGS,
+            ],
+            allowUnsigned: options.allowUnsigned ?? false,
+        });
+    }
+    catch (e) {
+        if (e instanceof RequestObjectError) {
+            throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, e.message);
+        }
+        throw e;
+    }
+    return {
+        effectiveParams: mergeRequestObjectParams(params, requestObjectClaims),
+        requestObjectClaims,
+    };
+}
+export function rejectUnsupportedRequestParams(params, redirectUri, state, options = {}) {
+    if (params.request !== undefined &&
+        options.requestParameterSupported === false) {
+        throw new AuthorizationError(AuthorizationErrorCode.RequestNotSupported, 'request parameter (Request Object) is not supported', redirectUri, state);
+    }
+    if (params.request_uri !== undefined) {
+        throw new AuthorizationError(AuthorizationErrorCode.RequestUriNotSupported, 'request_uri parameter (Request Object by reference) is not supported', redirectUri, state);
+    }
+    if (params.registration !== undefined) {
+        throw new AuthorizationError(AuthorizationErrorCode.RegistrationNotSupported, 'registration parameter is not supported', redirectUri, state);
+    }
+}
+export function validateRequestObjectConsistency(params, requestObjectClaims, redirectUri, state) {
+    if (requestObjectClaims === undefined) {
+        return;
+    }
+    const roResponseType = typeof requestObjectClaims['response_type'] === 'string'
+        ? requestObjectClaims['response_type']
+        : undefined;
+    if (roResponseType !== undefined && roResponseType !== params.response_type) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'request object response_type does not match the request', redirectUri, state);
+    }
+    const roClientId = typeof requestObjectClaims['client_id'] === 'string'
+        ? requestObjectClaims['client_id']
+        : undefined;
+    if (roClientId !== undefined && roClientId !== params.client_id) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'request object client_id does not match the request', redirectUri, state);
+    }
+}
+export function validateResponseType(params, client, redirectUri, state) {
+    const responseType = params.response_type;
+    if (!responseType) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'Missing required parameter: response_type', redirectUri, state);
+    }
+    if (responseType !== 'code') {
+        throw new AuthorizationError(AuthorizationErrorCode.UnsupportedResponseType, `Unsupported response_type: ${responseType}`, redirectUri, state);
+    }
+    const allowedResponseTypes = client.responseTypes ?? ['code'];
+    if (!allowedResponseTypes.includes(responseType)) {
+        throw new AuthorizationError(AuthorizationErrorCode.UnauthorizedClient, `Client is not authorized to use response_type: ${responseType}`, redirectUri, state);
+    }
+    return responseType;
+}
+export function validateAuthorizationScope(queryParams, effectiveParams, redirectUri, state) {
+    const queryScopeValue = queryParams.scope;
+    if (!queryScopeValue) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'Missing required parameter: scope', redirectUri, state);
+    }
+    const scopeValue = effectiveParams.scope ?? queryScopeValue;
+    const scope = [...new Set(scopeValue.split(' ').filter((s) => s.length > 0))];
+    if (!scope.includes('openid')) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidScope, 'scope must include openid', redirectUri, state);
+    }
+    return scope;
+}
+export async function applyOfflineAccessPolicy(scope, effectiveParams, promptValues, isOfflineAccessGranted = defaultIsOfflineAccessGranted) {
+    if (!scope.includes('offline_access')) {
+        return scope;
+    }
+    const granted = await isOfflineAccessGranted(effectiveParams, {
+        promptValues: promptValues ?? [],
+    });
+    if (granted) {
+        return scope;
+    }
+    return scope.filter((s) => s !== 'offline_access');
+}
+export function validateDisplayParameter(effectiveParams, redirectUri, state) {
+    const display = effectiveParams.display;
+    if (display !== undefined &&
+        !VALID_DISPLAY_VALUES.includes(display)) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, `Unsupported display value: ${display}`, redirectUri, state);
+    }
+    return display;
+}
+export function parseAudienceParameter(effectiveParams) {
+    const audienceValue = effectiveParams.audience;
+    if (audienceValue === undefined) {
+        return undefined;
+    }
+    return audienceValue.split(' ').filter((a) => a.length > 0);
+}
+export async function validateAuthorizationRequest(params, clientResolver, options = {}) {
+    const client = await resolveClientForAuthorization(params, clientResolver);
+    validateRegisteredRedirectUris(client.redirectUris);
+    const requestParameterSupported = options.requestObject?.supported ?? true;
+    const { effectiveParams: effective, requestObjectClaims } = requestParameterSupported
+        ? await resolveRequestObjectParams(params, client, {
+            supportedSigningAlgs: options.requestObject?.supportedSigningAlgs,
+            allowUnsigned: options.requestObject?.allowUnsigned,
+        })
+        : { effectiveParams: { ...params }, requestObjectClaims: undefined };
+    const redirectUri = resolveAuthorizationRedirectUri(effective, client);
+    const state = effective.state;
+    rejectUnsupportedRequestParams(params, redirectUri, state, {
+        requestParameterSupported,
+    });
+    validateRequestObjectConsistency(params, requestObjectClaims, redirectUri, state);
+    const responseType = validateResponseType(params, client, redirectUri, state);
+    let scope = validateAuthorizationScope(params, effective, redirectUri, state);
+    const pkce = validateAuthorizationCodePkce(effective, client, redirectUri, state, {
+        allowNonPkceAuthorizationCodeFlow: options.allowNonPkceAuthorizationCodeFlow,
+    });
+    const prompt = validatePromptParameter(effective, redirectUri, state);
+    scope = await applyOfflineAccessPolicy(scope, effective, prompt, options.isOfflineAccessGranted);
+    const display = validateDisplayParameter(effective, redirectUri, state);
+    const maxAge = resolveMaxAge(effective, client, redirectUri, state);
+    const audience = parseAudienceParameter(effective);
+    const claims = parseClaimsRequestParameter(effective, redirectUri, state, options.maxClaimsParameterLength);
+    return {
+        responseType,
+        clientId: client.clientId,
+        redirectUri,
+        redirectUriExplicit: effective.redirect_uri !== undefined,
+        scope,
+        codeChallenge: pkce.codeChallenge,
+        codeChallengeMethod: pkce.codeChallengeMethod,
+        state,
+        nonce: effective.nonce,
+        prompt,
+        display,
+        maxAge,
+        uiLocales: effective.ui_locales,
+        claimsLocales: effective.claims_locales,
+        acrValues: effective.acr_values,
+        loginHint: effective.login_hint,
+        idTokenHint: effective.id_token_hint,
+        audience,
+        claims,
+    };
+}
+const REQUEST_OBJECT_OVERRIDE_KEYS = [
+    'redirect_uri',
+    'scope',
+    'state',
+    'nonce',
+    'prompt',
+    'display',
+    'max_age',
+    'ui_locales',
+    'claims_locales',
+    'acr_values',
+    'login_hint',
+    'id_token_hint',
+    'audience',
+    'code_challenge',
+    'code_challenge_method',
+];
+function mergeRequestObjectParams(params, roClaims) {
+    const overrides = {};
+    for (const key of REQUEST_OBJECT_OVERRIDE_KEYS) {
+        const value = roClaims[key];
+        if (value === undefined)
+            continue;
+        if (typeof value === 'string') {
+            overrides[key] = value;
+        }
+        else if (typeof value === 'number' || typeof value === 'boolean') {
+            overrides[key] = String(value);
+        }
+    }
+    const claimsValue = roClaims['claims'];
+    if (typeof claimsValue === 'string') {
+        overrides['claims'] = claimsValue;
+    }
+    else if (typeof claimsValue === 'object' &&
+        claimsValue !== null &&
+        !Array.isArray(claimsValue)) {
+        overrides['claims'] = JSON.stringify(claimsValue);
+    }
+    return { ...params, ...overrides };
+}
+export function parseClaimsRequestParameter(effectiveParams, redirectUri, state, maxLength = DEFAULT_MAX_CLAIMS_PARAMETER_LENGTH) {
+    const raw = effectiveParams.claims;
+    if (raw === undefined)
+        return undefined;
+    if (raw.length > maxLength) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'claims parameter exceeds the maximum allowed length', redirectUri, state);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'claims parameter must be a JSON object', redirectUri, state);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new AuthorizationError(AuthorizationErrorCode.InvalidRequest, 'claims parameter must be a JSON object', redirectUri, state);
+    }
+    const result = {};
+    const obj = parsed;
+    const userinfo = sanitizeClaimsMember(obj['userinfo']);
+    if (userinfo)
+        result.userinfo = userinfo;
+    const idToken = sanitizeClaimsMember(obj['id_token']);
+    if (idToken)
+        result.id_token = idToken;
+    return result;
+}
+function sanitizeClaimsMember(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (entry === null) {
+            result[key] = null;
+        }
+        else if (typeof entry === 'object' && !Array.isArray(entry)) {
+            result[key] = entry;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=authorization-request.js.map

package/dist/authorization-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-request.js","sourceRoot":"","sources":["../src/authorization-request.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAQ7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,OAAO,CAAU,CAAC;AAMtE,MAAM,CAAN,IAAY,sBAqBX;AArBD,WAAY,sBAAsB;IAEhC,4DAAkC,CAAA;IAClC,oEAA0C,CAAA;IAC1C,wDAA8B,CAAA;IAC9B,+EAAqD,CAAA;IACrD,wDAA8B,CAAA;IAC9B,sDAA4B,CAAA;IAC5B,4EAAkD,CAAA;IAElD,sEAA4C,CAAA;IAC5C,0DAAgC,CAAA;IAChC,iFAAuD,CAAA;IACvD,8DAAoC,CAAA;IAGpC,uEAA6C,CAAA;IAC7C,8EAAoD,CAAA;IAGpD,iFAAuD,CAAA;AACzD,CAAC,EArBW,sBAAsB,KAAtB,sBAAsB,QAqBjC;AAwID,MAAM,CAAC,MAAM,6BAA6B,GAAiC,CACzE,QAAQ,EACR,EAAE,YAAY,EAAE,EAChB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AA8DtC,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAK,CAAC;AA2CzD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3B,KAAK,CAAyB;IAC9B,gBAAgB,CAAS;IACzB,WAAW,CAAU;IACrB,KAAK,CAAU;IAE/B,YACE,KAA6B,EAC7B,gBAAwB,EACxB,WAAoB,EACpB,KAAc;QAKd,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC;IACxC,CAAC;CACF;AAED,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAGpF,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAExE,MAAM,4BAA4B,GAAG,CAAC,MAAM,CAAU,CAAC;AAIvD,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AASxD,SAAS,gBAAgB,CACvB,UAAkB,EAClB,cAAwB,EACxB,UAAsC;IAGtC,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC7C,OAAO,CACL,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC;wBAC1C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;wBAC9C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;wBAC9C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;wBAC9C,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAC3C,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,aAAa;IACb,OAAO;IACP,OAAO;IACP,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAUH,MAAM,UAAU,8BAA8B,CAAC,cAAwB;IACrE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,WAAW,EAClC,sDAAsD,GAAG,EAAE,CAC5D,CAAC;QACJ,CAAC;QAGD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,WAAW,EAClC,kDAAkD,GAAG,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAE1D,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,WAAW,EAClC,oDAAoD,MAAM,KAAK,GAAG,GAAG,CACtE,CAAC;QACJ,CAAC;QAGD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,WAAW,EAClC,+CAA+C,GAAG,EAAE,CACrD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,WAAW,EAClC,uEAAuE,GAAG,EAAE,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAOD,SAAS,kBAAkB,CACzB,kBAAsC,EACtC,cAAwB,EACxB,UAAsC;IAEtC,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAErC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAGD,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,6BAA6B,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAGD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,cAAc,CAAC,CAAC,CAAW,CAAC;IACrC,CAAC;IAGD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,qEAAqE,CACtE,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,+BAA+B,CAC7C,eAA2C,EAC3C,MAAkB;IAElB,OAAO,kBAAkB,CACvB,eAAe,CAAC,YAAY,EAC5B,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,UAAU,CAClB,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,uBAAuB,CACrC,eAA2C,EAC3C,WAAmB,EACnB,KAAc;IAEd,IAAI,eAAe,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,cAAc,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAMD,SAAS,cAAc,CACrB,WAAmB,EACnB,WAAmB,EACnB,KAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAGlE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,yBAAyB,KAAK,EAAE,EAChC,WAAW,EACX,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAGD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,4DAA4D,EAC5D,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAKD,SAAS,cAAc,CACrB,WAAmB,EACnB,WAAmB,EACnB,KAAc;IAEd,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,wCAAwC,EACxC,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AASD,SAAS,qBAAqB,CAAC,aAAqB;IAClD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QAChC,aAAa,GAAG,CAAC,EACjB,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,WAAW,EAClC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAUD,MAAM,UAAU,aAAa,CAC3B,eAA2C,EAC3C,MAAkB,EAClB,WAAmB,EACnB,KAAc;IAEd,IAAI,eAAe,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAMD,SAAS,qBAAqB,CAC5B,aAAiC,EACjC,mBAAuC,EACvC,WAAmB,EACnB,KAAc;IAGd,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,4CAA4C,EAC5C,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAGD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,mDAAmD,EACnD,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAGD,IAAI,CAAE,4BAAkD,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,sCAAsC,mBAAmB,EAAE,EAC3D,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAID,IAAI,aAAa,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,4BAA4B,0BAA0B,oDAAoD,EAC1G,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,yFAAyF,EACzF,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa;QACb,mBAAmB,EAAE,mBAA6B;KACnD,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,6BAA6B,CAC3C,eAA2C,EAC3C,MAAkB,EAClB,WAAmB,EACnB,KAAc,EACd,UAA2D,EAAE;IAE7D,MAAM,aAAa,GAAG,eAAe,CAAC,cAAc,CAAC;IACrD,MAAM,mBAAmB,GAAG,eAAe,CAAC,qBAAqB,CAAC;IAClE,MAAM,WAAW,GACf,aAAa,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,CAAC;IACnE,IACE,WAAW;QACX,OAAO,CAAC,iCAAiC,KAAK,IAAI;QAClD,MAAM,CAAC,UAAU,KAAK,cAAc,EACpC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,qBAAqB,CAC1B,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,KAAK,CACN,CAAC;AACJ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAkC,EAClC,cAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,uCAAuC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAID,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,WAAW,EAClC,0DAA0D,QAAQ,WAAW,MAAM,CAAC,QAAQ,KAAK;YAC/F,4DAA4D;YAC5D,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAgCD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAkC,EAClC,MAAkB,EAClB,UAWI,EAAE;IAEN,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,mBAA4C,CAAC;IACjD,IAAI,CAAC;QACH,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;YAC7D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,oBAAoB,EAClB,OAAO,CAAC,oBAAoB,IAAI;gBAC9B,GAAG,mCAAmC;aACvC;YACH,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,OAAO;QACL,eAAe,EAAE,wBAAwB,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACtE,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,8BAA8B,CAC5C,MAAkC,EAClC,WAAmB,EACnB,KAAc,EACd,UAAmD,EAAE;IAErD,IACE,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,OAAO,CAAC,yBAAyB,KAAK,KAAK,EAC3C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,mBAAmB,EAC1C,qDAAqD,EACrD,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,sBAAsB,EAC7C,sEAAsE,EACtE,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,wBAAwB,EAC/C,yCAAyC,EACzC,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,gCAAgC,CAC9C,MAAkC,EAClC,mBAAwD,EACxD,WAAmB,EACnB,KAAc;IAEd,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAClB,OAAO,mBAAmB,CAAC,eAAe,CAAC,KAAK,QAAQ;QACtD,CAAC,CAAE,mBAAmB,CAAC,eAAe,CAAY;QAClD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5E,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,yDAAyD,EACzD,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,mBAAmB,CAAC,WAAW,CAAC,KAAK,QAAQ;QAClD,CAAC,CAAE,mBAAmB,CAAC,WAAW,CAAY;QAC9C,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,qDAAqD,EACrD,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,oBAAoB,CAClC,MAAkC,EAClC,MAAkB,EAClB,WAAmB,EACnB,KAAc;IAEd,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,2CAA2C,EAC3C,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,uBAAuB,EAC9C,8BAA8B,YAAY,EAAE,EAC5C,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAMD,MAAM,oBAAoB,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,kBAAkB,EACzC,kDAAkD,YAAY,EAAE,EAChE,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAUD,MAAM,UAAU,0BAA0B,CACxC,WAAuC,EACvC,eAA2C,EAC3C,WAAmB,EACnB,KAAc;IAEd,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC;IAC1C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,mCAAmC,EACnC,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC;IAI5D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,YAAY,EACnC,2BAA2B,EAC3B,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAe,EACf,eAA2C,EAC3C,YAAkC,EAClC,yBAAuD,6BAA6B;IAEpF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,eAAe,EAAE;QAC5D,YAAY,EAAE,YAAY,IAAI,EAAE;KACjC,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;AACrD,CAAC;AAQD,MAAM,UAAU,wBAAwB,CACtC,eAA2C,EAC3C,WAAmB,EACnB,KAAc;IAEd,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC;IACxC,IACE,OAAO,KAAK,SAAS;QACrB,CAAE,oBAA0C,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,8BAA8B,OAAO,EAAE,EACvC,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD,MAAM,UAAU,sBAAsB,CACpC,eAA2C;IAE3C,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC;IAC/C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AA0BD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAkC,EAClC,cAA8B,EAC9B,UAA+C,EAAE;IAGjD,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAI3E,8BAA8B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAKpD,MAAM,yBAAyB,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,IAAI,IAAI,CAAC;IAC3E,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,mBAAmB,EAAE,GACvD,yBAAyB;QACvB,CAAC,CAAC,MAAM,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE;YAC/C,oBAAoB,EAAE,OAAO,CAAC,aAAa,EAAE,oBAAoB;YACjE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa;SACpD,CAAC;QACJ,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;IAKzE,MAAM,WAAW,GAAG,+BAA+B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAQvE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAG9B,8BAA8B,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;QACzD,yBAAyB;KAC1B,CAAC,CAAC;IAGH,gCAAgC,CAAC,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAGlF,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAG9E,IAAI,KAAK,GAAG,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAK9E,MAAM,IAAI,GAAG,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;QAChF,iCAAiC,EAAE,OAAO,CAAC,iCAAiC;KAC7E,CAAC,CAAC;IAGH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAItE,KAAK,GAAG,MAAM,wBAAwB,CACpC,KAAK,EACL,SAAS,EACT,MAAM,EACN,OAAO,CAAC,sBAAsB,CAC/B,CAAC;IAGF,MAAM,OAAO,GAAG,wBAAwB,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAGxE,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAGpE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAKnD,MAAM,MAAM,GAAG,2BAA2B,CACxC,SAAS,EACT,WAAW,EACX,KAAK,EACL,OAAO,CAAC,wBAAwB,CACjC,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW;QACX,mBAAmB,EAAE,SAAS,CAAC,YAAY,KAAK,SAAS;QACzD,KAAK;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,KAAK;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM;QACN,OAAO;QACP,MAAM;QACN,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,aAAa,EAAE,SAAS,CAAC,cAAc;QACvC,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,WAAW,EAAE,SAAS,CAAC,aAAa;QACpC,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAkBD,MAAM,4BAA4B,GAAG;IACnC,cAAc;IACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,UAAU;IACV,gBAAgB;IAChB,uBAAuB;CACf,CAAC;AAEX,SAAS,wBAAwB,CAC/B,MAAkC,EAClC,QAAiC;IAEjC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,4BAA4B,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACnE,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IAEH,CAAC;IAID,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,SAAS,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;IACpC,CAAC;SAAM,IACL,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAC3B,CAAC;QACD,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAID,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;AACrC,CAAC;AAWD,MAAM,UAAU,2BAA2B,CACzC,eAA2C,EAC3C,WAAmB,EACnB,KAAc,EACd,YAAoB,mCAAmC;IAEvD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAMxC,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,qDAAqD,EACrD,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,wCAAwC,EACxC,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,wCAAwC,EACxC,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,IAAI,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,KAA0B,CAAC;QAC3C,CAAC;IAEH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/client-auth.d.ts

@@ -0,0 +1,16 @@
+import type { TokenClientInfo, TokenClientResolver } from './token-request.js';
+export interface ClientAuthContext {
+    params: Record<string, string | undefined>;
+    authorizationHeader: string;
+    clientResolver: TokenClientResolver;
+}
+export interface PresentedClientCredentials {
+    clientId: string;
+    clientSecret?: string;
+    method: 'client_secret_basic' | 'client_secret_post' | 'none';
+}
+export declare function extractClientCredentials(context: Pick<ClientAuthContext, 'params' | 'authorizationHeader'>): PresentedClientCredentials;
+export declare function validateClientAuthMethod(client: TokenClientInfo, presented: PresentedClientCredentials): void;
+export declare function verifyClientSecret(client: TokenClientInfo, clientSecret: string | undefined): Promise<void>;
+export declare function authenticateClient(context: ClientAuthContext): Promise<string>;
+//# sourceMappingURL=client-auth.d.ts.map

package/dist/client-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-auth.d.ts","sourceRoot":"","sources":["../src/client-auth.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAK/E,MAAM,WAAW,iBAAiB;IAEhC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC;IAE5B,cAAc,EAAE,mBAAmB,CAAC;CACrC;AA6ED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IAEjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,MAAM,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;CAC/D;AAeD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,qBAAqB,CAAC,GACjE,0BAA0B,CAgE5B;AAcD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,0BAA0B,GACpC,IAAI,CAiCN;AAUD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef;AAqBD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,MAAM,CAAC,CAUjB"}

package/dist/client-auth.js

@@ -0,0 +1,116 @@
+import { timingSafeEqual } from './crypto-utils.js';
+import { resolveAuthenticatedTokenClient, TokenError, TokenErrorCode, } from './token-request.js';
+function formUrlDecode(value) {
+    return decodeURIComponent(value.replace(/\+/g, '%20'));
+}
+function matchAuthScheme(authHeader, scheme) {
+    const spaceIndex = authHeader.indexOf(' ');
+    if (spaceIndex === -1) {
+        return null;
+    }
+    const headerScheme = authHeader.slice(0, spaceIndex).toLowerCase();
+    if (headerScheme !== scheme.toLowerCase()) {
+        return null;
+    }
+    return authHeader.slice(spaceIndex + 1);
+}
+function hasAuthScheme(authHeader, scheme) {
+    return matchAuthScheme(authHeader, scheme) !== null;
+}
+function parseBasicAuth(authHeader) {
+    const base64Credentials = matchAuthScheme(authHeader, 'Basic');
+    if (base64Credentials === null) {
+        return null;
+    }
+    let decoded;
+    try {
+        const binary = atob(base64Credentials);
+        const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+        decoded = new TextDecoder().decode(bytes);
+    }
+    catch {
+        return null;
+    }
+    const separatorIndex = decoded.indexOf(':');
+    if (separatorIndex === -1) {
+        return null;
+    }
+    try {
+        return {
+            clientId: formUrlDecode(decoded.slice(0, separatorIndex)),
+            clientSecret: formUrlDecode(decoded.slice(separatorIndex + 1)),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function extractClientCredentials(context) {
+    const { params, authorizationHeader } = context;
+    const hasBasicHeader = hasAuthScheme(authorizationHeader, 'Basic');
+    const hasPostCredential = params.client_id !== undefined || params.client_secret !== undefined;
+    const hasPostSecret = params.client_secret !== undefined;
+    if (hasBasicHeader && hasPostSecret) {
+        throw new TokenError(TokenErrorCode.InvalidRequest, 'Multiple client authentication methods provided. Use either Authorization header or request body, not both.');
+    }
+    let clientId;
+    let clientSecret;
+    if (hasBasicHeader) {
+        const basic = parseBasicAuth(authorizationHeader);
+        if (!basic) {
+            throw new TokenError(TokenErrorCode.InvalidClient, 'Invalid Authorization header format');
+        }
+        if (params.client_id !== undefined &&
+            params.client_id !== basic.clientId) {
+            throw new TokenError(TokenErrorCode.InvalidRequest, 'client_id in request body does not match the Authorization header');
+        }
+        clientId = basic.clientId;
+        clientSecret = basic.clientSecret;
+    }
+    else if (hasPostCredential) {
+        clientId = params.client_id;
+        clientSecret = params.client_secret;
+    }
+    if (!clientId) {
+        throw new TokenError(TokenErrorCode.InvalidClient, 'Client authentication required');
+    }
+    const method = hasBasicHeader
+        ? 'client_secret_basic'
+        : clientSecret !== undefined
+            ? 'client_secret_post'
+            : 'none';
+    return { clientId, clientSecret, method };
+}
+export function validateClientAuthMethod(client, presented) {
+    const registeredMethod = client.tokenEndpointAuthMethod ?? 'client_secret_basic';
+    if (registeredMethod === 'none') {
+        if (presented.method !== 'none') {
+            throw new TokenError(TokenErrorCode.InvalidClient, 'Client authentication method does not match the registered token_endpoint_auth_method');
+        }
+        return;
+    }
+    if (!presented.clientSecret) {
+        throw new TokenError(TokenErrorCode.InvalidClient, 'Client authentication required');
+    }
+    if (presented.method !== registeredMethod) {
+        throw new TokenError(TokenErrorCode.InvalidClient, 'Client authentication method does not match the registered token_endpoint_auth_method');
+    }
+}
+export async function verifyClientSecret(client, clientSecret) {
+    const registeredMethod = client.tokenEndpointAuthMethod ?? 'client_secret_basic';
+    if (registeredMethod === 'none')
+        return;
+    const secretMatches = await timingSafeEqual(client.clientSecret ?? '', clientSecret ?? '');
+    if (!secretMatches) {
+        throw new TokenError(TokenErrorCode.InvalidClient, 'Client authentication failed');
+    }
+}
+export async function authenticateClient(context) {
+    const { params, authorizationHeader, clientResolver } = context;
+    const presented = extractClientCredentials({ params, authorizationHeader });
+    const client = await resolveAuthenticatedTokenClient(presented.clientId, clientResolver);
+    validateClientAuthMethod(client, presented);
+    await verifyClientSecret(client, presented.clientSecret);
+    return presented.clientId;
+}
+//# sourceMappingURL=client-auth.js.map

package/dist/client-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-auth.js","sourceRoot":"","sources":["../src/client-auth.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,+BAA+B,EAC/B,UAAU,EACV,cAAc,GACf,MAAM,oBAAoB,CAAC;AAmB5B,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAWD,SAAS,eAAe,CACtB,UAAkB,EAClB,MAAc;IAEd,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,YAAY,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,MAAc;IACvD,OAAO,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CACrB,UAAkB;IAElB,MAAM,iBAAiB,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,IAAI,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YACzD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;SAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AA8BD,MAAM,UAAU,wBAAwB,CACtC,OAAkE;IAElE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IAEhD,MAAM,cAAc,GAAG,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,iBAAiB,GACrB,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC;IAMvE,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC;IACzD,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,cAAc,EAC7B,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IAED,IAAI,QAA4B,CAAC;IACjC,IAAI,YAAgC,CAAC;IAErC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAGD,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;YAC9B,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,EACnC,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,cAAc,EAC7B,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACpC,CAAC;SAAM,IAAI,iBAAiB,EAAE,CAAC;QAC7B,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;IACtC,CAAC;IAID,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,gCAAgC,CACjC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAyC,cAAc;QACjE,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,YAAY,KAAK,SAAS;YAC1B,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,MAAM,CAAC;IAEb,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAcD,MAAM,UAAU,wBAAwB,CACtC,MAAuB,EACvB,SAAqC;IAGrC,MAAM,gBAAgB,GAAG,MAAM,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;IAMjF,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;QAChC,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAGD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,gCAAgC,CACjC,CAAC;IACJ,CAAC;IAGD,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,uFAAuF,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAuB,EACvB,YAAgC;IAEhC,MAAM,gBAAgB,GAAG,MAAM,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;IACjF,IAAI,gBAAgB,KAAK,MAAM;QAAE,OAAO;IAGxC,MAAM,aAAa,GAAG,MAAM,eAAe,CACzC,MAAM,CAAC,YAAY,IAAI,EAAE,EACzB,YAAY,IAAI,EAAE,CACnB,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,8BAA8B,CAC/B,CAAC;IACJ,CAAC;AACH,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEhE,MAAM,SAAS,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEzF,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IAEzD,OAAO,SAAS,CAAC,QAAQ,CAAC;AAC5B,CAAC"}

package/dist/crypto-utils.d.ts

@@ -0,0 +1,18 @@
+import type { webcrypto } from 'node:crypto';
+export declare function sign(data: string, privateKey: CryptoKey): Promise<string>;
+export declare function verify(data: string, signature: string, publicKey: CryptoKey): Promise<boolean>;
+export declare function generateRandomString(byteLength: number): string;
+export declare function timingSafeEqual(a: string, b: string): Promise<boolean>;
+export declare function sha256(data: string): Promise<string>;
+export declare function arrayBufferToBase64Url(buffer: ArrayBuffer): string;
+export declare function base64UrlToArrayBuffer(base64url: string): ArrayBuffer;
+export declare function base64UrlToArrayBufferStrict(base64url: string): ArrayBuffer;
+export declare function stringToArrayBuffer(str: string): ArrayBuffer;
+export declare function rsaModulusBitLength(jwkN: string): number;
+export declare function importPrivateKeyFromJwk(jwkString: string, algorithm?: webcrypto.RsaHashedImportParams | webcrypto.EcKeyImportParams, keyUsages?: webcrypto.KeyUsage[]): Promise<CryptoKey>;
+export declare function importPublicKeyFromJwk(jwkString: string, algorithm?: webcrypto.RsaHashedImportParams | webcrypto.EcKeyImportParams, keyUsages?: webcrypto.KeyUsage[]): Promise<CryptoKey>;
+export declare function extractAlgorithmParams(key: CryptoKey): webcrypto.RsaHashedImportParams | webcrypto.EcKeyImportParams;
+export declare function extractAlgorithmParamsFromJwk(jwk: webcrypto.JsonWebKey): webcrypto.RsaHashedImportParams | webcrypto.EcKeyImportParams;
+export declare function jwaToHashName(alg: string): 'SHA-256' | 'SHA-384' | 'SHA-512';
+export declare function getJwaAlgorithm(key: CryptoKey): string;
+//# sourceMappingURL=crypto-utils.d.ts.map