@medplum/core 0.2.1 → 0.4.1

package/dist/client.js

@@ -1,541 +0,0 @@
-"use strict";
-// PKCE auth ased on:
-// https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MedplumClient = void 0;
-const cache_1 = require("./cache");
-const crypto_1 = require("./crypto");
-const eventtarget_1 = require("./eventtarget");
-const jwt_1 = require("./jwt");
-const outcomes_1 = require("./outcomes");
-const search_1 = require("./search");
-const storage_1 = require("./storage");
-const types_1 = require("./types");
-const utils_1 = require("./utils");
-const DEFAULT_BASE_URL = 'https://api.medplum.com/';
-const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
-const DEFAULT_BLOB_CACHE_SIZE = 100;
-const JSON_CONTENT_TYPE = 'application/json';
-const FHIR_CONTENT_TYPE = 'application/fhir+json';
-const PATCH_CONTENT_TYPE = 'application/json-patch+json';
-class MedplumClient extends eventtarget_1.EventTarget {
-    constructor(options) {
-        var _a, _b;
-        super();
-        if (options.baseUrl) {
-            if (!options.baseUrl.startsWith('http')) {
-                throw new Error('Base URL must start with http or https');
-            }
-            if (!options.baseUrl.endsWith('/')) {
-                throw new Error('Base URL must end with a trailing slash');
-            }
-        }
-        if (!options.clientId) {
-            throw new Error('Client ID cannot be empty');
-        }
-        this.fetch = options.fetch || window.fetch.bind(window);
-        this.storage = new storage_1.ClientStorage();
-        this.schema = new Map();
-        this.resourceCache = new cache_1.LRUCache((_a = options.resourceCacheSize) !== null && _a !== void 0 ? _a : DEFAULT_RESOURCE_CACHE_SIZE);
-        this.blobUrlCache = new cache_1.LRUCache((_b = options.blobCacheSize) !== null && _b !== void 0 ? _b : DEFAULT_BLOB_CACHE_SIZE);
-        this.baseUrl = options.baseUrl || DEFAULT_BASE_URL;
-        this.clientId = options.clientId;
-        this.authorizeUrl = options.authorizeUrl || this.baseUrl + 'oauth2/authorize';
-        this.tokenUrl = options.tokenUrl || this.baseUrl + 'oauth2/token';
-        this.logoutUrl = options.logoutUrl || this.baseUrl + 'oauth2/logout';
-        this.onUnauthenticated = options.onUnauthenticated;
-    }
-    /**
-     * Clears all auth state including local storage and session storage.
-     */
-    clear() {
-        this.storage.clear();
-        this.activeLogin = undefined;
-        this.dispatchEvent({ type: 'change' });
-    }
-    get(url, blob) {
-        return this.request('GET', url, undefined, undefined, blob);
-    }
-    post(url, body, contentType) {
-        return this.request('POST', url, contentType, body);
-    }
-    put(url, body, contentType) {
-        return this.request('PUT', url, contentType, body);
-    }
-    /**
-     * Tries to register a new user.
-     * @param request The registration request.
-     * @returns Promise to the user profile resource.
-     */
-    register(request) {
-        return this.post('auth/register', request)
-            .then((response) => this.handleLoginResponse(response));
-    }
-    /**
-     * Tries to sign in with email and password.
-     * @param email The user email address.
-     * @param password The user password.
-     * @param role The login role.
-     * @param scope The OAuth2 login scope.
-     * @param remember Optional flag to "remember" to generate a refresh token and persist in local storage.
-     * @returns Promise to the user profile resource.
-     */
-    signIn(email, password, role, scope, remember) {
-        return this.post('auth/login', {
-            clientId: this.clientId,
-            email,
-            password,
-            role,
-            scope,
-            remember: !!remember
-        }).then((response) => this.handleLoginResponse(response));
-    }
-    /**
-     * Tries to sign in with Google authentication.
-     * The response parameter is the result of a Google authentication.
-     * See: https://developers.google.com/identity/gsi/web/guides/handle-credential-responses-js-functions
-     * @param googleResponse The Google credential response.
-     * @returns Promise to the user profile resource.
-     */
-    signInWithGoogle(googleResponse) {
-        return this.post('auth/google', googleResponse)
-            .then((loginResponse) => this.handleLoginResponse(loginResponse));
-    }
-    /**
-     * Handles a login response.
-     * This can be used for both "register" and "signIn".
-     * @param response The login response.
-     * @returns The user profile.
-     */
-    handleLoginResponse(response) {
-        this.setActiveLogin(response);
-        return response.profile;
-    }
-    /**
-     * Signs out locally.
-     * Does not invalidate tokens with the server.
-     */
-    signOut() {
-        this.clear();
-        return Promise.resolve();
-    }
-    /**
-     * Tries to sign in the user.
-     * Returns true if the user is signed in.
-     * This may result in navigating away to the sign in page.
-     */
-    signInWithRedirect() {
-        const urlParams = new URLSearchParams(window.location.search);
-        const code = urlParams.get('code');
-        if (!code) {
-            this.requestAuthorization();
-            return undefined;
-        }
-        else {
-            return this.processCode(code);
-        }
-    }
-    /**
-     * Tries to sign out the user.
-     * See: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html
-     */
-    signOutWithRedirect() {
-        window.location.assign(this.logoutUrl);
-    }
-    fhirUrl(...path) {
-        const builder = [this.baseUrl, 'fhir/R4'];
-        path.forEach(p => builder.push('/', encodeURIComponent(p)));
-        return builder.join('');
-    }
-    search(search) {
-        if (typeof search === 'string') {
-            return this.get('fhir/R4/' + search);
-        }
-        else {
-            return this.get(this.fhirUrl(search.resourceType) + (0, search_1.formatSearchQuery)(search));
-        }
-    }
-    /**
-     * Searches a ValueSet resource using the "expand" operation.
-     * See: https://www.hl7.org/fhir/operation-valueset-expand.html
-     * @param system The ValueSet system url.
-     * @param filter The search string.
-     * @returns Promise to expanded ValueSet.
-     */
-    searchValueSet(system, filter) {
-        return this.get(this.fhirUrl('ValueSet', '$expand') +
-            `?url=${encodeURIComponent(system)}` +
-            `&filter=${encodeURIComponent(filter)}`);
-    }
-    read(resourceType, id) {
-        const cacheKey = resourceType + '/' + id;
-        const promise = this.get(this.fhirUrl(resourceType, id))
-            .then((resource) => {
-            this.resourceCache.set(cacheKey, resource);
-            return resource;
-        });
-        this.resourceCache.set(cacheKey, promise);
-        return promise;
-    }
-    readCached(resourceType, id) {
-        const cached = this.resourceCache.get(resourceType + '/' + id);
-        return cached ? Promise.resolve(cached) : this.read(resourceType, id);
-    }
-    readReference(reference) {
-        const refString = reference === null || reference === void 0 ? void 0 : reference.reference;
-        if (!refString) {
-            return Promise.reject('Missing reference');
-        }
-        const [resourceType, id] = refString.split('/');
-        return this.read(resourceType, id);
-    }
-    readCachedReference(reference) {
-        const refString = reference === null || reference === void 0 ? void 0 : reference.reference;
-        if (!refString) {
-            return Promise.reject('Missing reference');
-        }
-        const [resourceType, id] = refString.split('/');
-        return this.readCached(resourceType, id);
-    }
-    getTypeDefinition(resourceType) {
-        if (!resourceType) {
-            return Promise.reject('Missing resourceType');
-        }
-        const cached = this.schema.get(resourceType);
-        if (cached) {
-            return Promise.resolve(cached);
-        }
-        let typeDef;
-        return this.search('StructureDefinition?name:exact=' + encodeURIComponent(resourceType))
-            .then((result) => {
-            var _a;
-            if (!((_a = result.entry) === null || _a === void 0 ? void 0 : _a.length)) {
-                throw new Error('StructureDefinition not found');
-            }
-            const resource = result.entry[0].resource;
-            if (!resource) {
-                throw new Error('StructureDefinition not found');
-            }
-            typeDef = (0, types_1.indexStructureDefinition)(resource);
-        })
-            .then(() => this.search({
-            resourceType: 'SearchParameter',
-            count: 100,
-            filters: [{
-                    code: 'base',
-                    operator: search_1.Operator.EQUALS,
-                    value: resourceType
-                }]
-        }))
-            .then((result) => {
-            const entries = result.entry;
-            if (entries) {
-                typeDef.types[resourceType].searchParams = entries
-                    .map(e => e.resource)
-                    .sort((a, b) => { var _a, _b; return (_b = (_a = a.name) === null || _a === void 0 ? void 0 : _a.localeCompare(b.name)) !== null && _b !== void 0 ? _b : 0; });
-            }
-            this.schema.set(resourceType, typeDef);
-            return typeDef;
-        });
-    }
-    readHistory(resourceType, id) {
-        return this.get(this.fhirUrl(resourceType, id, '_history'));
-    }
-    readPatientEverything(id) {
-        return this.get(this.fhirUrl('Patient', id, '$everything'));
-    }
-    readBlob(url) {
-        return this.get(url, true);
-    }
-    readBlobAsObjectUrl(url) {
-        const promise = this.readBlob(url)
-            .then(imageBlob => {
-            const imageUrl = URL.createObjectURL(imageBlob);
-            this.blobUrlCache.set(url, imageUrl);
-            return imageUrl;
-        });
-        this.blobUrlCache.set(url, promise);
-        return promise;
-    }
-    readCachedBlobAsObjectUrl(url) {
-        const cached = this.blobUrlCache.get(url);
-        return cached ? Promise.resolve(cached) : this.readBlobAsObjectUrl(url);
-    }
-    readBinary(id) {
-        return this.readBlob(this.fhirUrl('Binary', id));
-    }
-    create(resource) {
-        if (!resource.resourceType) {
-            throw new Error('Missing resourceType');
-        }
-        return this.post(this.fhirUrl(resource.resourceType), resource);
-    }
-    createBinary(data, contentType) {
-        return this.post(this.fhirUrl('Binary'), data, contentType);
-    }
-    update(resource) {
-        if (!resource.resourceType) {
-            throw new Error('Missing resourceType');
-        }
-        if (!resource.id) {
-            throw new Error('Missing id');
-        }
-        return this.put(this.fhirUrl(resource.resourceType, resource.id), resource);
-    }
-    patch(resourceType, id, operations) {
-        return this.request('PATCH', this.fhirUrl(resourceType, id), PATCH_CONTENT_TYPE, operations);
-    }
-    graphql(gql) {
-        return this.post(this.fhirUrl('$graphql'), gql, JSON_CONTENT_TYPE);
-    }
-    subscribe(criteria, handler) {
-        return this.create({
-            resourceType: 'Subscription',
-            status: 'active',
-            criteria: criteria,
-            channel: {
-                type: 'sse'
-            }
-        }).then((sub) => {
-            const eventSource = new EventSource(this.baseUrl + 'sse?subscription=' + encodeURIComponent(sub.id), {
-                withCredentials: true
-            });
-            eventSource.onmessage = (e) => {
-                handler(JSON.parse(e.data));
-            };
-            return eventSource;
-        });
-    }
-    getActiveLogin() {
-        if (!this.activeLogin) {
-            this.activeLogin = this.storage.getObject('activeLogin');
-        }
-        return this.activeLogin;
-    }
-    setActiveLogin(login) {
-        this.activeLogin = login;
-        this.storage.setObject('activeLogin', login);
-        this.addLogin(login);
-        this.dispatchEvent({ type: 'change' });
-    }
-    getLogins() {
-        var _a;
-        return (_a = this.storage.getObject('logins')) !== null && _a !== void 0 ? _a : [];
-    }
-    addLogin(newLogin) {
-        const logins = this.getLogins().filter(login => { var _a, _b; return ((_a = login.profile) === null || _a === void 0 ? void 0 : _a.id) !== ((_b = newLogin.profile) === null || _b === void 0 ? void 0 : _b.id); });
-        logins.push(newLogin);
-        this.storage.setObject('logins', logins);
-    }
-    getProfile() {
-        var _a;
-        return (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.profile;
-    }
-    /**
-     * Makes an HTTP request.
-     * @param {string} method
-     * @param {string} url
-     * @param {string=} contentType
-     * @param {Object=} body
-     * @param {boolean=} blob
-     */
-    request(method, url, contentType, body, blob) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!url.startsWith('http')) {
-                url = this.baseUrl + url;
-            }
-            const headers = {
-                'Content-Type': contentType || FHIR_CONTENT_TYPE
-            };
-            const accessToken = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.accessToken;
-            if (accessToken) {
-                headers['Authorization'] = 'Bearer ' + accessToken;
-            }
-            const options = {
-                method: method,
-                cache: 'no-cache',
-                credentials: 'include',
-                headers
-            };
-            if (body) {
-                if (typeof body === 'string' || (typeof File !== 'undefined' && body instanceof File)) {
-                    options.body = body;
-                }
-                else {
-                    options.body = (0, utils_1.stringify)(body);
-                }
-            }
-            const response = yield this.fetch(url, options);
-            if (response.status === 401) {
-                // Refresh and try again
-                return this.handleUnauthenticated(method, url, contentType, body, blob);
-            }
-            if (response.status === 304) {
-                // No change
-                return undefined;
-            }
-            const obj = blob ? yield response.blob() : yield response.json();
-            if (obj.resourceType === 'OperationOutcome' && !(0, outcomes_1.isOk)(obj)) {
-                return Promise.reject(new outcomes_1.OperationOutcomeError(obj));
-            }
-            return obj;
-        });
-    }
-    /**
-     * Handles an unauthenticated response from the server.
-     * First, tries to refresh the access token and retry the request.
-     * Otherwise, calls unauthenticated callbacks and rejects.
-     * @param method The HTTP method of the original request.
-     * @param url The URL of the original request.
-     * @param contentType The content type of the original request.
-     * @param body The body of the original request.
-     * @param blob Optional blob flag of the original request.
-     */
-    handleUnauthenticated(method, url, contentType, body, blob) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.refresh()
-                .then(() => this.request(method, url, contentType, body, blob))
-                .catch(error => {
-                this.clear();
-                if (this.onUnauthenticated) {
-                    this.onUnauthenticated();
-                }
-                return Promise.reject(error);
-            });
-        });
-    }
-    /**
-     * Redirects the user to the login screen for authorization.
-     * Clears all auth state including local storage and session storage.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
-     */
-    requestAuthorization() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!this.authorizeUrl) {
-                throw new Error('Missing authorize URL');
-            }
-            this.clear();
-            const pkceState = (0, crypto_1.getRandomString)();
-            this.storage.setString('pkceState', pkceState);
-            const codeVerifier = (0, crypto_1.getRandomString)();
-            this.storage.setString('codeVerifier', codeVerifier);
-            const arrayHash = yield (0, crypto_1.encryptSHA256)(codeVerifier);
-            const codeChallenge = (0, utils_1.arrayBufferToBase64)(arrayHash);
-            this.storage.setString('codeChallenge', codeChallenge);
-            const scope = 'launch/patient openid fhirUser offline_access user/*.*';
-            window.location.assign(this.authorizeUrl +
-                '?response_type=code' +
-                '&state=' + encodeURIComponent(pkceState) +
-                '&client_id=' + encodeURIComponent(this.clientId) +
-                '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +
-                '&scope=' + encodeURIComponent(scope) +
-                '&code_challenge_method=S256' +
-                '&code_challenge=' + encodeURIComponent(codeChallenge));
-        });
-    }
-    /**
-     * Processes an OAuth authorization code.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest
-     * @param code The authorization code received by URL parameter.
-     */
-    processCode(code) {
-        const pkceState = this.storage.getString('pkceState');
-        if (!pkceState) {
-            this.clear();
-            throw new Error('Invalid PCKE state');
-        }
-        const codeVerifier = this.storage.getString('codeVerifier');
-        if (!codeVerifier) {
-            this.clear();
-            throw new Error('Invalid PCKE code verifier');
-        }
-        return this.fetchTokens('grant_type=authorization_code' +
-            '&client_id=' + encodeURIComponent(this.clientId) +
-            '&code_verifier=' + encodeURIComponent(codeVerifier) +
-            '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +
-            '&code=' + encodeURIComponent(code));
-    }
-    /**
-     * Tries to refresh the auth tokens.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens
-     */
-    refresh() {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const refreshToken = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.refreshToken;
-            if (!refreshToken) {
-                this.clear();
-                return Promise.reject('Invalid refresh token');
-            }
-            yield this.fetchTokens('grant_type=refresh_token' +
-                '&client_id=' + encodeURIComponent(this.clientId) +
-                '&refresh_token=' + encodeURIComponent(refreshToken));
-        });
-    }
-    /**
-     * Makes a POST request to the tokens endpoint.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
-     * @param formBody Token parameters in URL encoded format.
-     */
-    fetchTokens(formBody) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!this.tokenUrl) {
-                throw new Error('Missing token URL');
-            }
-            return this.fetch(this.tokenUrl, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: formBody
-            })
-                .then(response => {
-                if (!response.ok) {
-                    return Promise.reject('Failed to fetch tokens');
-                }
-                return response.json();
-            })
-                .then(tokens => this.verifyTokens(tokens))
-                .then(() => { var _a; return (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.profile; });
-        });
-    }
-    /**
-     * Verifies the tokens received from the auth server.
-     * Validates the JWT against the JWKS.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
-     * @param tokens
-     */
-    verifyTokens(tokens) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const token = tokens.access_token;
-            // Verify token has not expired
-            const tokenPayload = (0, jwt_1.parseJWTPayload)(token);
-            if (Date.now() >= tokenPayload.exp * 1000) {
-                this.clear();
-                return Promise.reject('Token expired');
-            }
-            // Verify app_client_id
-            if (tokenPayload.client_id !== this.clientId) {
-                this.clear();
-                return Promise.reject('Token was not issued for this audience');
-            }
-            this.setActiveLogin(Object.assign(Object.assign({}, this.getActiveLogin()), { accessToken: token, refreshToken: tokens.refresh_token }));
-        });
-    }
-}
-exports.MedplumClient = MedplumClient;
-/**
- * Returns the base URL for the current page.
- */
-function getBaseUrl() {
-    return window.location.protocol + '//' + window.location.host + '/';
-}
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";AAAA,qBAAqB;AACrB,yIAAyI;;;;;;;;;;;;AAEzI,mCAAmC;AACnC,qCAA0D;AAC1D,+CAA4C;AAE5C,+BAAwC;AACxC,yCAAyD;AACzD,qCAAsE;AACtE,uCAA0C;AAC1C,mCAA+E;AAC/E,mCAA0E;AAE1E,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAmGzD,MAAa,aAAc,SAAQ,yBAAW;IAc5C,YAAY,OAA6B;;QACvC,KAAK,EAAE,CAAC;QAER,IAAI,OAAO,CAAC,OAAO,EAAE;YACnB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;gBACvC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;aAC3D;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;gBAClC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC5D;SACF;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;SAC9C;QAED,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,uBAAa,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,gBAAQ,CAAC,MAAA,OAAO,CAAC,iBAAiB,mCAAI,2BAA2B,CAAC,CAAC;QAC5F,IAAI,CAAC,YAAY,GAAG,IAAI,gBAAQ,CAAC,MAAA,OAAO,CAAC,aAAa,mCAAI,uBAAuB,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,GAAG,kBAAkB,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;QACrE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,IAAc;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,GAAW,EAAE,IAAS,EAAE,WAAoB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,IAAS,EAAE,WAAoB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,OAAwB;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC;aACvC,IAAI,CAAC,CAAC,QAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CACJ,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,KAAa,EACb,QAAkB;QAElB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;YACL,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC,IAAI,CAAC,CAAC,QAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,cAAwC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC;aAC5C,IAAI,CAAC,CAAC,aAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC;IACrF,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,QAAuB;QACjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE;YACT,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;SAClB;aAAM;YACL,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;SAC/B;IACH,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,GAAG,IAAc;QACvB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,CAAqB,MAA8B;QACvD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;YAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;SACtC;aAAM;YACL,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;SAChF;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc,EAAE,MAAc;QAC3C,OAAO,IAAI,CAAC,GAAG,CACb,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;YACnC,QAAQ,kBAAkB,CAAC,MAAM,CAAC,EAAE;YACpC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,CAAqB,YAAoB,EAAE,EAAU;QACvD,MAAM,QAAQ,GAAG,YAAY,GAAG,GAAG,GAAG,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,QAAW,EAAE,EAAE;YACpB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,UAAU,CAAqB,YAAoB,EAAE,EAAU;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,GAAG,GAAG,GAAG,EAAE,CAA+B,CAAC;QAC7F,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,aAAa,CAAqB,SAAuB;QACvD,MAAM,SAAS,GAAG,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,SAAS,CAAC;QACvC,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;SAC5C;QACD,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,mBAAmB,CAAqB,SAAuB;QAC7D,MAAM,SAAS,GAAG,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,SAAS,CAAC;QACvC,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;SAC5C;QACD,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,iBAAiB,CAAC,YAAoB;QACpC,IAAI,CAAC,YAAY,EAAE;YACjB,OAAO,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;SAC/C;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE;YACV,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAChC;QACD,IAAI,OAAmC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAsB,iCAAiC,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;aAC1G,IAAI,CAAC,CAAC,MAAmC,EAAE,EAAE;;YAC5C,IAAI,CAAC,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,MAAM,CAAA,EAAE;gBACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;aAClD;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1C,IAAI,CAAC,QAAQ,EAAE;gBACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;aAClD;YACD,OAAO,GAAG,IAAA,gCAAwB,EAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAkB;YACvC,YAAY,EAAE,iBAAiB;YAC/B,KAAK,EAAE,GAAG;YACV,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,iBAAQ,CAAC,MAAM;oBACzB,KAAK,EAAE,YAAY;iBACpB,CAAC;SACH,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,MAA+B,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;YAC7B,IAAI,OAAO,EAAE;gBACX,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,YAAY,GAAG,OAAO;qBAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAA2B,CAAC;qBACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,eAAC,OAAA,MAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,aAAa,CAAC,CAAC,CAAC,IAAc,CAAC,mCAAI,CAAC,CAAA,EAAA,CAAC,CAAC;aACjE;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,WAAW,CAAqB,YAAoB,EAAE,EAAU;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,qBAAqB,CAAC,EAAU;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,mBAAmB,CAAC,GAAW;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;aAC/B,IAAI,CAAC,SAAS,CAAC,EAAE;YAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,yBAAyB,CAAC,GAAW;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CAAqB,QAAW;QACpC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;SACzC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,YAAY,CAAC,IAAS,EAAE,WAAmB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAqB,QAAW;QACpC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;SACzC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;SAC/B;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,EAAU,EAAE,UAAe;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,CAAC,GAAQ;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACrE,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,OAA8B;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,YAAY,EAAE,cAAc;YAC5B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,IAAI,EAAE,KAAK;aACZ;SACF,CAAC,CAAC,IAAI,CAAC,CAAC,GAAiB,EAAE,EAAE;YAC5B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,GAAG,mBAAmB,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAY,CAAC,EAAE;gBAC7G,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,WAAW,CAAC,SAAS,GAAG,CAAC,CAAe,EAAE,EAAE;gBAC1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAa,CAAC,CAAC;YAC1C,CAAC,CAAC;YAEF,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAgB,aAAa,CAAC,CAAC;SACzE;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,cAAc,CAAC,KAAoB;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,SAAS;;QACP,OAAO,MAAA,IAAI,CAAC,OAAO,CAAC,SAAS,CAAkB,QAAQ,CAAC,mCAAI,EAAE,CAAC;IACjE,CAAC;IAED,QAAQ,CAAC,QAAuB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,eAAC,OAAA,CAAA,MAAA,KAAK,CAAC,OAAO,0CAAE,EAAE,OAAK,MAAA,QAAQ,CAAC,OAAO,0CAAE,EAAE,CAAA,CAAA,EAAA,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU;;QACR,OAAO,MAAA,IAAI,CAAC,cAAc,EAAE,0CAAE,OAAO,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACW,OAAO,CACnB,MAAc,EACd,GAAW,EACX,WAAoB,EACpB,IAAU,EACV,IAAc;;;YAEd,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;gBAC3B,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;aAC1B;YAED,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,WAAW,IAAI,iBAAiB;aACjD,CAAC;YAEF,MAAM,WAAW,GAAG,MAAA,IAAI,CAAC,cAAc,EAAE,0CAAE,WAAW,CAAC;YACvD,IAAI,WAAW,EAAE;gBACf,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC;aACpD;YAED,MAAM,OAAO,GAAgB;gBAC3B,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,SAAS;gBACtB,OAAO;aACR,CAAC;YAEF,IAAI,IAAI,EAAE;gBACR,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,EAAE;oBACrF,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;iBACrB;qBAAM;oBACL,OAAO,CAAC,IAAI,GAAG,IAAA,iBAAS,EAAC,IAAI,CAAC,CAAC;iBAChC;aACF;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;gBAC3B,wBAAwB;gBACxB,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;aACzE;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;gBAC3B,YAAY;gBACZ,OAAO,SAAS,CAAC;aAClB;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjE,IAAI,GAAG,CAAC,YAAY,KAAK,kBAAkB,IAAI,CAAC,IAAA,eAAI,EAAC,GAAG,CAAC,EAAE;gBACzD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,gCAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;aACvD;YACD,OAAO,GAAG,CAAC;;KACZ;IAED;;;;;;;;;OASG;IACW,qBAAqB,CACjC,MAAc,EACd,GAAW,EACX,WAAoB,EACpB,IAAU,EACV,IAAc;;YACd,OAAO,IAAI,CAAC,OAAO,EAAE;iBAClB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;iBAC9D,KAAK,CAAC,KAAK,CAAC,EAAE;gBACb,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,IAAI,IAAI,CAAC,iBAAiB,EAAE;oBAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;iBAC1B;gBACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;QACP,CAAC;KAAA;IAED;;;;OAIG;IACW,oBAAoB;;YAChC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;gBACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;aAC1C;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;YAEb,MAAM,SAAS,GAAG,IAAA,wBAAe,GAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAE/C,MAAM,YAAY,GAAG,IAAA,wBAAe,GAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;YAErD,MAAM,SAAS,GAAG,MAAM,IAAA,sBAAa,EAAC,YAAY,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,IAAA,2BAAmB,EAAC,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;YAEvD,MAAM,KAAK,GAAG,wDAAwD,CAAC;YAEvE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;gBACtC,qBAAqB;gBACrB,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;gBACzC,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACjD,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC;gBACnD,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBACrC,6BAA6B;gBAC7B,kBAAkB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5D,CAAC;KAAA;IAED;;;;OAIG;IACK,WAAW,CAAC,IAAY;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE;YACd,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;SACvC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE;YACjB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;SAC/C;QAED,OAAO,IAAI,CAAC,WAAW,CACrB,+BAA+B;YAC/B,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,iBAAiB,GAAG,kBAAkB,CAAC,YAAY,CAAC;YACpD,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC;YACnD,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACW,OAAO;;;YACnB,MAAM,YAAY,GAAG,MAAA,IAAI,CAAC,cAAc,EAAE,0CAAE,YAAY,CAAC;YACzD,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;aAChD;YAED,MAAM,IAAI,CAAC,WAAW,CACpB,0BAA0B;gBAC1B,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACjD,iBAAiB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;;KACzD;IAED;;;;OAIG;IACW,WAAW,CAAC,QAAgB;;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;aACtC;YAED,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,CAAC,QAAQ,EACb;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,QAAQ;aACf,CAAC;iBACD,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACf,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAChB,OAAO,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;iBACjD;gBACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,CAAC,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;iBACzC,IAAI,CAAC,GAAG,EAAE,WAAC,OAAA,MAAA,IAAI,CAAC,cAAc,EAAE,0CAAE,OAA0B,CAAA,EAAA,CAAC,CAAC;QACnE,CAAC;KAAA;IAED;;;;;OAKG;IACW,YAAY,CAAC,MAAqB;;YAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;YAElC,+BAA+B;YAC/B,MAAM,YAAY,GAAG,IAAA,qBAAe,EAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,YAAY,CAAC,GAAG,GAAG,IAAI,EAAE;gBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;aACxC;YAED,uBAAuB;YACvB,IAAI,YAAY,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE;gBAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;aACjE;YAED,IAAI,CAAC,cAAc,iCACb,IAAI,CAAC,cAAc,EAAoB,KAC3C,WAAW,EAAE,KAAK,EAClB,YAAY,EAAE,MAAM,CAAC,aAAa,IAClC,CAAC;QACL,CAAC;KAAA;CACF;AA7kBD,sCA6kBC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;AACtE,CAAC","sourcesContent":["// PKCE auth ased on:\n// https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/\n\nimport { LRUCache } from './cache';\nimport { encryptSHA256, getRandomString } from './crypto';\nimport { EventTarget } from './eventtarget';\nimport { Binary, Bundle, Project, Reference, Resource, SearchParameter, StructureDefinition, Subscription, ValueSet } from './fhir';\nimport { parseJWTPayload } from './jwt';\nimport { isOk, OperationOutcomeError } from './outcomes';\nimport { formatSearchQuery, Operator, SearchRequest } from './search';\nimport { ClientStorage } from './storage';\nimport { IndexedStructureDefinition, indexStructureDefinition } from './types';\nimport { arrayBufferToBase64, ProfileResource, stringify } from './utils';\n\nconst DEFAULT_BASE_URL = 'https://api.medplum.com/';\nconst DEFAULT_RESOURCE_CACHE_SIZE = 1000;\nconst DEFAULT_BLOB_CACHE_SIZE = 100;\nconst JSON_CONTENT_TYPE = 'application/json';\nconst FHIR_CONTENT_TYPE = 'application/fhir+json';\nconst PATCH_CONTENT_TYPE = 'application/json-patch+json';\n\nexport interface MedplumClientOptions {\n  /**\n   * The client ID.\n   * Required.\n   */\n  clientId: string;\n\n  /**\n   * Base server URL.\n   * Optional.  Default value is \"https://api.medplum.com/\".\n   * Use this to point to a custom Medplum deployment.\n   */\n  baseUrl?: string;\n\n  /**\n   * OAuth2 authorize URL.\n   * Optional.  Default value is baseUrl + \"/oauth2/authorize\".\n   * Use this if you want to use a separate OAuth server.\n   */\n  authorizeUrl?: string;\n\n  /**\n   * OAuth2 token URL.\n   * Optional.  Default value is baseUrl + \"/oauth2/token\".\n   * Use this if you want to use a separate OAuth server.\n   */\n  tokenUrl?: string;\n\n  /**\n   * OAuth2 logout URL.\n   * Optional.  Default value is baseUrl + \"/oauth2/logout\".\n   * Use this if you want to use a separate OAuth server.\n   */\n  logoutUrl?: string;\n\n  /**\n   * Number of resources to store in the cache.\n   * Optional.  Default value is 1000.\n   * Consider using this for performance of displaying Patient or Practitioner resources.\n   */\n  resourceCacheSize?: number;\n\n  /**\n   * Number of blob URLs to store in the cache.\n   * Optional.  Default value is 100.\n   * Consider using this for performance of displaying Patient or Practitioner resources.\n   */\n  blobCacheSize?: number;\n\n  /**\n   * Optional fetch implementation.\n   * Optional.  Default is window.fetch.\n   * For nodejs applications, consider the 'node-fetch' package.\n   */\n  fetch?: FetchLike;\n\n  /**\n   * Optional callback for when the client is unauthenticated.\n   * Default is do nothing.\n   * For client side applications, consider redirecting to a sign in page.\n   */\n  onUnauthenticated?: () => void;\n}\n\nexport interface FetchLike {\n  (url: string, options?: any): Promise<any>;\n}\n\ninterface LoginResponse {\n  project: Project;\n  profile: ProfileResource;\n  accessToken: string;\n  refreshToken: string;\n}\n\ninterface TokenResponse {\n  token_type: string;\n  id_token: string;\n  access_token: string;\n  refresh_token: string;\n  expires_in: number;\n}\n\nexport interface RegisterRequest {\n  firstName: string;\n  lastName: string;\n  projectName: string;\n  email: string;\n  password: string;\n  remember?: boolean;\n}\n\nexport interface GoogleCredentialResponse {\n  readonly clientId: string;\n  readonly credential: string;\n}\n\nexport class MedplumClient extends EventTarget {\n  private readonly fetch: FetchLike;\n  private readonly storage: ClientStorage;\n  private readonly schema: Map<string, IndexedStructureDefinition>;\n  private readonly resourceCache: LRUCache<Resource | Promise<Resource>>;\n  private readonly blobUrlCache: LRUCache<string | Promise<string>>;\n  private readonly baseUrl: string;\n  private readonly clientId: string;\n  private readonly authorizeUrl: string;\n  private readonly tokenUrl: string;\n  private readonly logoutUrl: string;\n  private readonly onUnauthenticated?: () => void;\n  private activeLogin?: LoginResponse;\n\n  constructor(options: MedplumClientOptions) {\n    super();\n\n    if (options.baseUrl) {\n      if (!options.baseUrl.startsWith('http')) {\n        throw new Error('Base URL must start with http or https');\n      }\n      if (!options.baseUrl.endsWith('/')) {\n        throw new Error('Base URL must end with a trailing slash');\n      }\n    }\n\n    if (!options.clientId) {\n      throw new Error('Client ID cannot be empty');\n    }\n\n    this.fetch = options.fetch || window.fetch.bind(window);\n    this.storage = new ClientStorage();\n    this.schema = new Map();\n    this.resourceCache = new LRUCache(options.resourceCacheSize ?? DEFAULT_RESOURCE_CACHE_SIZE);\n    this.blobUrlCache = new LRUCache(options.blobCacheSize ?? DEFAULT_BLOB_CACHE_SIZE);\n    this.baseUrl = options.baseUrl || DEFAULT_BASE_URL;\n    this.clientId = options.clientId;\n    this.authorizeUrl = options.authorizeUrl || this.baseUrl + 'oauth2/authorize';\n    this.tokenUrl = options.tokenUrl || this.baseUrl + 'oauth2/token';\n    this.logoutUrl = options.logoutUrl || this.baseUrl + 'oauth2/logout';\n    this.onUnauthenticated = options.onUnauthenticated;\n  }\n\n  /**\n   * Clears all auth state including local storage and session storage.\n   */\n  clear(): void {\n    this.storage.clear();\n    this.activeLogin = undefined;\n    this.dispatchEvent({ type: 'change' });\n  }\n\n  get(url: string, blob?: boolean): Promise<any> {\n    return this.request('GET', url, undefined, undefined, blob);\n  }\n\n  post(url: string, body: any, contentType?: string): Promise<any> {\n    return this.request('POST', url, contentType, body);\n  }\n\n  put(url: string, body: any, contentType?: string): Promise<any> {\n    return this.request('PUT', url, contentType, body);\n  }\n\n  /**\n   * Tries to register a new user.\n   * @param request The registration request.\n   * @returns Promise to the user profile resource.\n   */\n  register(request: RegisterRequest): Promise<ProfileResource> {\n    return this.post('auth/register', request)\n      .then((response: LoginResponse) => this.handleLoginResponse(response));\n  }\n\n  /**\n   * Tries to sign in with email and password.\n   * @param email The user email address.\n   * @param password The user password.\n   * @param role The login role.\n   * @param scope The OAuth2 login scope.\n   * @param remember Optional flag to \"remember\" to generate a refresh token and persist in local storage.\n   * @returns Promise to the user profile resource.\n   */\n  signIn(\n    email: string,\n    password: string,\n    role: string,\n    scope: string,\n    remember?: boolean): Promise<ProfileResource> {\n\n    return this.post('auth/login', {\n      clientId: this.clientId,\n      email,\n      password,\n      role,\n      scope,\n      remember: !!remember\n    }).then((response: LoginResponse) => this.handleLoginResponse(response));\n  }\n\n  /**\n   * Tries to sign in with Google authentication.\n   * The response parameter is the result of a Google authentication.\n   * See: https://developers.google.com/identity/gsi/web/guides/handle-credential-responses-js-functions\n   * @param googleResponse The Google credential response.\n   * @returns Promise to the user profile resource.\n   */\n  signInWithGoogle(googleResponse: GoogleCredentialResponse): Promise<ProfileResource> {\n    return this.post('auth/google', googleResponse)\n      .then((loginResponse: LoginResponse) => this.handleLoginResponse(loginResponse));\n  }\n\n  /**\n   * Handles a login response.\n   * This can be used for both \"register\" and \"signIn\".\n   * @param response The login response.\n   * @returns The user profile.\n   */\n  private handleLoginResponse(response: LoginResponse): ProfileResource {\n    this.setActiveLogin(response);\n    return response.profile;\n  }\n\n  /**\n   * Signs out locally.\n   * Does not invalidate tokens with the server.\n   */\n  signOut(): Promise<void> {\n    this.clear();\n    return Promise.resolve();\n  }\n\n  /**\n   * Tries to sign in the user.\n   * Returns true if the user is signed in.\n   * This may result in navigating away to the sign in page.\n   */\n  signInWithRedirect(): Promise<ProfileResource | void> | undefined {\n    const urlParams = new URLSearchParams(window.location.search);\n    const code = urlParams.get('code');\n    if (!code) {\n      this.requestAuthorization();\n      return undefined;\n    } else {\n      return this.processCode(code);\n    }\n  }\n\n  /**\n   * Tries to sign out the user.\n   * See: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html\n   */\n  signOutWithRedirect(): void {\n    window.location.assign(this.logoutUrl);\n  }\n\n  fhirUrl(...path: string[]): string {\n    const builder = [this.baseUrl, 'fhir/R4'];\n    path.forEach(p => builder.push('/', encodeURIComponent(p)))\n    return builder.join('');\n  }\n\n  search<T extends Resource>(search: string | SearchRequest): Promise<Bundle<T>> {\n    if (typeof search === 'string') {\n      return this.get('fhir/R4/' + search);\n    } else {\n      return this.get(this.fhirUrl(search.resourceType) + formatSearchQuery(search));\n    }\n  }\n\n  /**\n   * Searches a ValueSet resource using the \"expand\" operation.\n   * See: https://www.hl7.org/fhir/operation-valueset-expand.html\n   * @param system The ValueSet system url.\n   * @param filter The search string.\n   * @returns Promise to expanded ValueSet.\n   */\n  searchValueSet(system: string, filter: string): Promise<ValueSet> {\n    return this.get(\n      this.fhirUrl('ValueSet', '$expand') +\n      `?url=${encodeURIComponent(system)}` +\n      `&filter=${encodeURIComponent(filter)}`);\n  }\n\n  read<T extends Resource>(resourceType: string, id: string): Promise<T> {\n    const cacheKey = resourceType + '/' + id;\n    const promise = this.get(this.fhirUrl(resourceType, id))\n      .then((resource: T) => {\n        this.resourceCache.set(cacheKey, resource);\n        return resource;\n      });\n    this.resourceCache.set(cacheKey, promise);\n    return promise;\n  }\n\n  readCached<T extends Resource>(resourceType: string, id: string): Promise<T> {\n    const cached = this.resourceCache.get(resourceType + '/' + id) as T | Promise<T> | undefined;\n    return cached ? Promise.resolve(cached) : this.read(resourceType, id);\n  }\n\n  readReference<T extends Resource>(reference: Reference<T>): Promise<T> {\n    const refString = reference?.reference;\n    if (!refString) {\n      return Promise.reject('Missing reference');\n    }\n    const [resourceType, id] = refString.split('/');\n    return this.read(resourceType, id);\n  }\n\n  readCachedReference<T extends Resource>(reference: Reference<T>): Promise<T> {\n    const refString = reference?.reference;\n    if (!refString) {\n      return Promise.reject('Missing reference');\n    }\n    const [resourceType, id] = refString.split('/');\n    return this.readCached(resourceType, id);\n  }\n\n  getTypeDefinition(resourceType: string): Promise<IndexedStructureDefinition> {\n    if (!resourceType) {\n      return Promise.reject('Missing resourceType');\n    }\n    const cached = this.schema.get(resourceType);\n    if (cached) {\n      return Promise.resolve(cached);\n    }\n    let typeDef: IndexedStructureDefinition;\n    return this.search<StructureDefinition>('StructureDefinition?name:exact=' + encodeURIComponent(resourceType))\n      .then((result: Bundle<StructureDefinition>) => {\n        if (!result.entry?.length) {\n          throw new Error('StructureDefinition not found');\n        }\n        const resource = result.entry[0].resource;\n        if (!resource) {\n          throw new Error('StructureDefinition not found');\n        }\n        typeDef = indexStructureDefinition(resource);\n      })\n      .then(() => this.search<SearchParameter>({\n        resourceType: 'SearchParameter',\n        count: 100,\n        filters: [{\n          code: 'base',\n          operator: Operator.EQUALS,\n          value: resourceType\n        }]\n      }))\n      .then((result: Bundle<SearchParameter>) => {\n        const entries = result.entry;\n        if (entries) {\n          typeDef.types[resourceType].searchParams = entries\n            .map(e => e.resource as SearchParameter)\n            .sort((a, b) => a.name?.localeCompare(b.name as string) ?? 0);\n        }\n        this.schema.set(resourceType, typeDef);\n        return typeDef;\n      });\n  }\n\n  readHistory<T extends Resource>(resourceType: string, id: string): Promise<Bundle<T>> {\n    return this.get(this.fhirUrl(resourceType, id, '_history'));\n  }\n\n  readPatientEverything(id: string): Promise<Bundle> {\n    return this.get(this.fhirUrl('Patient', id, '$everything'));\n  }\n\n  readBlob(url: string): Promise<Blob> {\n    return this.get(url, true);\n  }\n\n  readBlobAsObjectUrl(url: string): Promise<string> {\n    const promise = this.readBlob(url)\n      .then(imageBlob => {\n        const imageUrl = URL.createObjectURL(imageBlob);\n        this.blobUrlCache.set(url, imageUrl);\n        return imageUrl;\n      });\n    this.blobUrlCache.set(url, promise);\n    return promise;\n  }\n\n  readCachedBlobAsObjectUrl(url: string): Promise<string> {\n    const cached = this.blobUrlCache.get(url);\n    return cached ? Promise.resolve(cached) : this.readBlobAsObjectUrl(url);\n  }\n\n  readBinary(id: string): Promise<Blob> {\n    return this.readBlob(this.fhirUrl('Binary', id));\n  }\n\n  create<T extends Resource>(resource: T): Promise<T> {\n    if (!resource.resourceType) {\n      throw new Error('Missing resourceType');\n    }\n    return this.post(this.fhirUrl(resource.resourceType), resource);\n  }\n\n  createBinary(data: any, contentType: string): Promise<Binary> {\n    return this.post(this.fhirUrl('Binary'), data, contentType);\n  }\n\n  update<T extends Resource>(resource: T): Promise<T> {\n    if (!resource.resourceType) {\n      throw new Error('Missing resourceType');\n    }\n    if (!resource.id) {\n      throw new Error('Missing id');\n    }\n    return this.put(this.fhirUrl(resource.resourceType, resource.id), resource);\n  }\n\n  patch(resourceType: string, id: string, operations: any): Promise<any> {\n    return this.request('PATCH', this.fhirUrl(resourceType, id), PATCH_CONTENT_TYPE, operations);\n  }\n\n  graphql(gql: any): Promise<any> {\n    return this.post(this.fhirUrl('$graphql'), gql, JSON_CONTENT_TYPE);\n  }\n\n  subscribe(criteria: string, handler: (e: Resource) => void): Promise<EventSource> {\n    return this.create({\n      resourceType: 'Subscription',\n      status: 'active',\n      criteria: criteria,\n      channel: {\n        type: 'sse'\n      }\n    }).then((sub: Subscription) => {\n      const eventSource = new EventSource(this.baseUrl + 'sse?subscription=' + encodeURIComponent(sub.id as string), {\n        withCredentials: true\n      });\n\n      eventSource.onmessage = (e: MessageEvent) => {\n        handler(JSON.parse(e.data) as Resource);\n      };\n\n      return eventSource;\n    });\n  }\n\n  getActiveLogin(): LoginResponse | undefined {\n    if (!this.activeLogin) {\n      this.activeLogin = this.storage.getObject<LoginResponse>('activeLogin');\n    }\n    return this.activeLogin;\n  }\n\n  setActiveLogin(login: LoginResponse): void {\n    this.activeLogin = login;\n    this.storage.setObject('activeLogin', login);\n    this.addLogin(login);\n    this.dispatchEvent({ type: 'change' });\n  }\n\n  getLogins(): LoginResponse[] {\n    return this.storage.getObject<LoginResponse[]>('logins') ?? [];\n  }\n\n  addLogin(newLogin: LoginResponse): void {\n    const logins = this.getLogins().filter(login => login.profile?.id !== newLogin.profile?.id);\n    logins.push(newLogin);\n    this.storage.setObject('logins', logins);\n  }\n\n  getProfile(): ProfileResource | undefined {\n    return this.getActiveLogin()?.profile;\n  }\n\n  /**\n   * Makes an HTTP request.\n   * @param {string} method\n   * @param {string} url\n   * @param {string=} contentType\n   * @param {Object=} body\n   * @param {boolean=} blob\n   */\n  private async request(\n    method: string,\n    url: string,\n    contentType?: string,\n    body?: any,\n    blob?: boolean): Promise<any> {\n\n    if (!url.startsWith('http')) {\n      url = this.baseUrl + url;\n    }\n\n    const headers: Record<string, string> = {\n      'Content-Type': contentType || FHIR_CONTENT_TYPE\n    };\n\n    const accessToken = this.getActiveLogin()?.accessToken;\n    if (accessToken) {\n      headers['Authorization'] = 'Bearer ' + accessToken;\n    }\n\n    const options: RequestInit = {\n      method: method,\n      cache: 'no-cache',\n      credentials: 'include',\n      headers\n    };\n\n    if (body) {\n      if (typeof body === 'string' || (typeof File !== 'undefined' && body instanceof File)) {\n        options.body = body;\n      } else {\n        options.body = stringify(body);\n      }\n    }\n\n    const response = await this.fetch(url, options);\n    if (response.status === 401) {\n      // Refresh and try again\n      return this.handleUnauthenticated(method, url, contentType, body, blob);\n    }\n\n    if (response.status === 304) {\n      // No change\n      return undefined;\n    }\n\n    const obj = blob ? await response.blob() : await response.json();\n    if (obj.resourceType === 'OperationOutcome' && !isOk(obj)) {\n      return Promise.reject(new OperationOutcomeError(obj));\n    }\n    return obj;\n  }\n\n  /**\n   * Handles an unauthenticated response from the server.\n   * First, tries to refresh the access token and retry the request.\n   * Otherwise, calls unauthenticated callbacks and rejects.\n   * @param method The HTTP method of the original request.\n   * @param url The URL of the original request.\n   * @param contentType The content type of the original request.\n   * @param body The body of the original request.\n   * @param blob Optional blob flag of the original request.\n   */\n  private async handleUnauthenticated(\n    method: string,\n    url: string,\n    contentType?: string,\n    body?: any,\n    blob?: boolean): Promise<any> {\n    return this.refresh()\n      .then(() => this.request(method, url, contentType, body, blob))\n      .catch(error => {\n        this.clear();\n        if (this.onUnauthenticated) {\n          this.onUnauthenticated();\n        }\n        return Promise.reject(error);\n      });\n  }\n\n  /**\n   * Redirects the user to the login screen for authorization.\n   * Clears all auth state including local storage and session storage.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint\n   */\n  private async requestAuthorization() {\n    if (!this.authorizeUrl) {\n      throw new Error('Missing authorize URL');\n    }\n\n    this.clear();\n\n    const pkceState = getRandomString();\n    this.storage.setString('pkceState', pkceState);\n\n    const codeVerifier = getRandomString();\n    this.storage.setString('codeVerifier', codeVerifier);\n\n    const arrayHash = await encryptSHA256(codeVerifier);\n    const codeChallenge = arrayBufferToBase64(arrayHash);\n    this.storage.setString('codeChallenge', codeChallenge);\n\n    const scope = 'launch/patient openid fhirUser offline_access user/*.*';\n\n    window.location.assign(this.authorizeUrl +\n      '?response_type=code' +\n      '&state=' + encodeURIComponent(pkceState) +\n      '&client_id=' + encodeURIComponent(this.clientId) +\n      '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +\n      '&scope=' + encodeURIComponent(scope) +\n      '&code_challenge_method=S256' +\n      '&code_challenge=' + encodeURIComponent(codeChallenge));\n  }\n\n  /**\n   * Processes an OAuth authorization code.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest\n   * @param code The authorization code received by URL parameter.\n   */\n  private processCode(code: string): Promise<ProfileResource> {\n    const pkceState = this.storage.getString('pkceState');\n    if (!pkceState) {\n      this.clear();\n      throw new Error('Invalid PCKE state');\n    }\n\n    const codeVerifier = this.storage.getString('codeVerifier');\n    if (!codeVerifier) {\n      this.clear();\n      throw new Error('Invalid PCKE code verifier');\n    }\n\n    return this.fetchTokens(\n      'grant_type=authorization_code' +\n      '&client_id=' + encodeURIComponent(this.clientId) +\n      '&code_verifier=' + encodeURIComponent(codeVerifier) +\n      '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +\n      '&code=' + encodeURIComponent(code));\n  }\n\n  /**\n   * Tries to refresh the auth tokens.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens\n   */\n  private async refresh(): Promise<void> {\n    const refreshToken = this.getActiveLogin()?.refreshToken;\n    if (!refreshToken) {\n      this.clear();\n      return Promise.reject('Invalid refresh token');\n    }\n\n    await this.fetchTokens(\n      'grant_type=refresh_token' +\n      '&client_id=' + encodeURIComponent(this.clientId) +\n      '&refresh_token=' + encodeURIComponent(refreshToken));\n  }\n\n  /**\n   * Makes a POST request to the tokens endpoint.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint\n   * @param formBody Token parameters in URL encoded format.\n   */\n  private async fetchTokens(formBody: string): Promise<ProfileResource> {\n    if (!this.tokenUrl) {\n      throw new Error('Missing token URL');\n    }\n\n    return this.fetch(\n      this.tokenUrl,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: formBody\n      })\n      .then(response => {\n        if (!response.ok) {\n          return Promise.reject('Failed to fetch tokens');\n        }\n        return response.json();\n      })\n      .then(tokens => this.verifyTokens(tokens))\n      .then(() => this.getActiveLogin()?.profile as ProfileResource);\n  }\n\n  /**\n   * Verifies the tokens received from the auth server.\n   * Validates the JWT against the JWKS.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint\n   * @param tokens\n   */\n  private async verifyTokens(tokens: TokenResponse): Promise<void> {\n    const token = tokens.access_token;\n\n    // Verify token has not expired\n    const tokenPayload = parseJWTPayload(token);\n    if (Date.now() >= tokenPayload.exp * 1000) {\n      this.clear();\n      return Promise.reject('Token expired');\n    }\n\n    // Verify app_client_id\n    if (tokenPayload.client_id !== this.clientId) {\n      this.clear();\n      return Promise.reject('Token was not issued for this audience');\n    }\n\n    this.setActiveLogin({\n      ...(this.getActiveLogin() as LoginResponse),\n      accessToken: token,\n      refreshToken: tokens.refresh_token\n    });\n  }\n}\n\n/**\n * Returns the base URL for the current page.\n */\nfunction getBaseUrl() {\n  return window.location.protocol + '//' + window.location.host + '/';\n}\n"]}

package/dist/crypto.js

@@ -1,33 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptSHA256 = exports.getRandomString = void 0;
-const utils_1 = require("./utils");
-/**
- * Returns a cryptographically secure random string.
- */
-function getRandomString() {
-    const randomItems = new Uint32Array(28);
-    crypto.getRandomValues(randomItems);
-    return (0, utils_1.arrayBufferToHex)(randomItems.buffer);
-}
-exports.getRandomString = getRandomString;
-/**
- * Encrypts a string with SHA256 encryption.
- * @param str
- */
-function encryptSHA256(str) {
-    return __awaiter(this, void 0, void 0, function* () {
-        return crypto.subtle.digest('SHA-256', new TextEncoder().encode(str));
-    });
-}
-exports.encryptSHA256 = encryptSHA256;
-//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,mCAA2C;AAE3C;;GAEG;AACH,SAAgB,eAAe;IAC7B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACpC,OAAO,IAAA,wBAAgB,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAJD,0CAIC;AAED;;;GAGG;AACH,SAAsB,aAAa,CAAC,GAAW;;QAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;CAAA;AAFD,sCAEC","sourcesContent":["import { arrayBufferToHex } from './utils';\n\n/**\n * Returns a cryptographically secure random string.\n */\nexport function getRandomString(): string {\n  const randomItems = new Uint32Array(28);\n  crypto.getRandomValues(randomItems);\n  return arrayBufferToHex(randomItems.buffer);\n}\n\n/**\n * Encrypts a string with SHA256 encryption.\n * @param str\n */\nexport async function encryptSHA256(str: string): Promise<ArrayBuffer> {\n  return crypto.subtle.digest('SHA-256', new TextEncoder().encode(str));\n}\n"]}