@nexauthxyz/browser 0.1.2

package/dist/nexauth-browser-client.js

@@ -0,0 +1,496 @@
+import { OpenIdDiscoveryClient, normalizeIssuer } from './discovery.js';
+import { NexAuthError } from './errors.js';
+import { IdTokenVerifier } from './id-token-verifier.js';
+import { createPkcePair, generateSecureRandomValue } from './pkce.js';
+import { getDefaultBrowserStorage, NexAuthStorageManager } from './storage.js';
+const AUTHORIZATION_TRANSACTION_MAX_AGE_MS = 10 * 60 * 1000;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function getWindow() {
+    if (typeof window === 'undefined') {
+        throw new NexAuthError('invalid_configuration', 'NexAuth browser authentication requires a browser environment.');
+    }
+    return window;
+}
+function normalizeRequiredValue(value, name) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new NexAuthError('invalid_configuration', `${name} is required.`);
+    }
+    return normalized;
+}
+function normalizeRedirectUri(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch (error) {
+        throw new NexAuthError('invalid_configuration', 'The NexAuth redirect URI must be a valid absolute URL.', {
+            cause: error,
+        });
+    }
+    const local = url.hostname === 'localhost' ||
+        url.hostname === '127.0.0.1' ||
+        url.hostname === '[::1]';
+    if (url.protocol !== 'https:' && !local) {
+        throw new NexAuthError('invalid_configuration', 'The NexAuth redirect URI must use HTTPS outside local development.');
+    }
+    if (url.username || url.password || url.hash) {
+        throw new NexAuthError('invalid_configuration', 'The NexAuth redirect URI contains unsupported URL components.');
+    }
+    return url.toString();
+}
+function normalizeScope(value) {
+    const scopes = value
+        .split(/\s+/)
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    if (!scopes.includes('openid')) {
+        scopes.unshift('openid');
+    }
+    return [...new Set(scopes)].join(' ');
+}
+function mergeScopes(configuredScope, additionalScopes) {
+    if (!additionalScopes?.length) {
+        return configuredScope;
+    }
+    return normalizeScope(`${configuredScope} ${additionalScopes.join(' ')}`);
+}
+function normalizeReturnTo(value) {
+    if (!value) {
+        return undefined;
+    }
+    const normalized = value.trim();
+    if (!normalized) {
+        return undefined;
+    }
+    const browserWindow = getWindow();
+    let url;
+    try {
+        url = new URL(normalized, browserWindow.location.origin);
+    }
+    catch (error) {
+        throw new NexAuthError('login_failed', 'The return route is invalid.', {
+            cause: error,
+        });
+    }
+    if (url.origin !== browserWindow.location.origin) {
+        throw new NexAuthError('login_failed', 'The return route must belong to the current application.');
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+function validateTransaction(value) {
+    if (!isRecord(value) ||
+        typeof value.state !== 'string' ||
+        typeof value.nonce !== 'string' ||
+        typeof value.codeVerifier !== 'string' ||
+        typeof value.redirectUri !== 'string' ||
+        typeof value.createdAt !== 'number') {
+        throw new NexAuthError('missing_pkce_transaction', 'The stored authorization transaction is missing or invalid.');
+    }
+    return {
+        state: value.state,
+        nonce: value.nonce,
+        codeVerifier: value.codeVerifier,
+        redirectUri: value.redirectUri,
+        createdAt: value.createdAt,
+        ...(typeof value.returnTo === 'string'
+            ? {
+                returnTo: value.returnTo,
+            }
+            : {}),
+    };
+}
+function validateTokenResponse(value) {
+    if (!isRecord(value)) {
+        throw new NexAuthError('invalid_token_response', 'NexAuth returned an invalid token response.');
+    }
+    if (typeof value.access_token !== 'string' || !value.access_token.trim()) {
+        throw new NexAuthError('invalid_token_response', 'NexAuth did not return an access token.');
+    }
+    if (typeof value.token_type !== 'string' ||
+        value.token_type.toLowerCase() !== 'bearer') {
+        throw new NexAuthError('invalid_token_response', 'NexAuth returned an unsupported token type.');
+    }
+    if (typeof value.expires_in !== 'number' ||
+        !Number.isFinite(value.expires_in) ||
+        value.expires_in <= 0) {
+        throw new NexAuthError('invalid_token_response', 'NexAuth returned an invalid token expiration.');
+    }
+    return {
+        access_token: value.access_token,
+        token_type: value.token_type,
+        expires_in: value.expires_in,
+        ...(typeof value.scope === 'string'
+            ? {
+                scope: value.scope,
+            }
+            : {}),
+        ...(typeof value.id_token === 'string'
+            ? {
+                id_token: value.id_token,
+            }
+            : {}),
+        ...(typeof value.refresh_token === 'string'
+            ? {
+                refresh_token: value.refresh_token,
+            }
+            : {}),
+    };
+}
+function validateUserInfo(value) {
+    if (!isRecord(value) || typeof value.sub !== 'string' || !value.sub.trim()) {
+        throw new NexAuthError('userinfo_failed', 'NexAuth returned an invalid user profile.');
+    }
+    return value;
+}
+async function getResponseError(response, fallbackMessage) {
+    const headerRequestId = response.headers.get('x-request-id')?.trim() || undefined;
+    try {
+        const body = (await response.json());
+        if (typeof body.error === 'object' && body.error !== null) {
+            const requestId = body.error.requestId?.trim() ||
+                body.requestId?.trim() ||
+                body.request_id?.trim() ||
+                headerRequestId;
+            return {
+                message: body.error.message?.trim() || fallbackMessage,
+                ...(requestId ? { requestId } : {}),
+            };
+        }
+        const requestId = body.requestId?.trim() || body.request_id?.trim() || headerRequestId;
+        const message = body.error_description?.trim() ||
+            body.message?.trim() ||
+            (typeof body.error === 'string' ? body.error.trim() : undefined) ||
+            fallbackMessage;
+        return {
+            message,
+            ...(requestId ? { requestId } : {}),
+        };
+    }
+    catch {
+        return {
+            message: fallbackMessage,
+            ...(headerRequestId
+                ? {
+                    requestId: headerRequestId,
+                }
+                : {}),
+        };
+    }
+}
+export class NexAuthBrowserClient {
+    clientId;
+    redirectUri;
+    scope;
+    fetchImplementation;
+    storage;
+    discovery;
+    idTokenVerifier;
+    constructor(options) {
+        const issuer = normalizeIssuer(options.issuer);
+        this.clientId = normalizeRequiredValue(options.clientId, 'NexAuth client ID');
+        this.idTokenVerifier = new IdTokenVerifier(this.clientId);
+        const browserWindow = getWindow();
+        this.redirectUri = normalizeRedirectUri(options.redirectUri ?? `${browserWindow.location.origin}/auth/callback`);
+        this.scope = normalizeScope(options.scope?.trim() || 'openid profile email');
+        const fetchImplementation = options.fetch ?? globalThis.fetch;
+        if (typeof fetchImplementation !== 'function') {
+            throw new NexAuthError('invalid_configuration', 'The browser Fetch API is unavailable.');
+        }
+        this.fetchImplementation = fetchImplementation.bind(globalThis);
+        const storage = options.storage ?? getDefaultBrowserStorage();
+        this.storage = new NexAuthStorageManager(storage, options.storageKeyPrefix?.trim() || 'nexauth', this.clientId);
+        this.discovery = new OpenIdDiscoveryClient({
+            issuer,
+            fetch: this.fetchImplementation,
+        });
+    }
+    async getConfiguration() {
+        return this.discovery.getConfiguration();
+    }
+    async login(options = {}) {
+        const configuration = await this.discovery.getConfiguration();
+        const pkce = await createPkcePair();
+        const state = generateSecureRandomValue(32);
+        const nonce = generateSecureRandomValue(32);
+        const returnTo = normalizeReturnTo(options.returnTo);
+        const transaction = {
+            state,
+            nonce,
+            codeVerifier: pkce.verifier,
+            redirectUri: this.redirectUri,
+            createdAt: Date.now(),
+            ...(returnTo ? { returnTo } : {}),
+        };
+        this.storage.set('transaction', transaction);
+        const authorizationUrl = new URL(configuration.authorization_endpoint);
+        authorizationUrl.search = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.clientId,
+            redirect_uri: this.redirectUri,
+            scope: mergeScopes(this.scope, options.additionalScopes),
+            state,
+            nonce,
+            code_challenge: pkce.challenge,
+            code_challenge_method: pkce.method,
+            ...(options.prompt
+                ? {
+                    prompt: options.prompt,
+                }
+                : {}),
+        }).toString();
+        getWindow().location.assign(authorizationUrl.toString());
+    }
+    async handleCallback(input = {}) {
+        let callbackUrl;
+        try {
+            callbackUrl = new URL(input.url ?? getWindow().location.href);
+        }
+        catch (error) {
+            throw new NexAuthError('callback_failed', 'The authorization callback URL is invalid.', {
+                cause: error,
+            });
+        }
+        const transaction = validateTransaction(this.storage.get('transaction'));
+        const expectedRedirectUrl = new URL(transaction.redirectUri);
+        if (callbackUrl.origin !== expectedRedirectUrl.origin ||
+            callbackUrl.pathname !== expectedRedirectUrl.pathname) {
+            this.storage.remove('transaction');
+            throw new NexAuthError('callback_failed', 'The authorization callback does not match the configured redirect URI.');
+        }
+        const transactionAge = Date.now() - transaction.createdAt;
+        if (transactionAge < 0 ||
+            transactionAge > AUTHORIZATION_TRANSACTION_MAX_AGE_MS) {
+            this.storage.remove('transaction');
+            throw new NexAuthError('callback_failed', 'The authorization transaction has expired. Start sign-in again.');
+        }
+        const returnedState = callbackUrl.searchParams.get('state');
+        if (!returnedState || returnedState !== transaction.state) {
+            this.storage.remove('transaction');
+            throw new NexAuthError('invalid_state', 'The OAuth state validation failed.');
+        }
+        const oauthError = callbackUrl.searchParams.get('error');
+        if (oauthError) {
+            const description = callbackUrl.searchParams.get('error_description')?.trim() ||
+                'NexAuth denied the authorization request.';
+            this.storage.remove('transaction');
+            throw new NexAuthError('authorization_error', description);
+        }
+        const code = callbackUrl.searchParams.get('code')?.trim();
+        if (!code) {
+            this.storage.remove('transaction');
+            throw new NexAuthError('missing_authorization_code', 'The authorization callback does not contain a code.');
+        }
+        const configuration = await this.discovery.getConfiguration();
+        const token = await this.exchangeAuthorizationCode(configuration, code, transaction);
+        /*
+         * The authorization code is single-use and has now been consumed.
+         * Remove temporary PKCE state before further processing.
+         */
+        this.storage.remove('transaction');
+        if (!token.id_token) {
+            throw new NexAuthError('id_token_validation_failed', 'NexAuth did not return an ID token for an OpenID request.');
+        }
+        const idTokenClaims = await this.idTokenVerifier.verify(token.id_token, configuration, transaction.nonce);
+        const user = await this.loadUserInfo(configuration, token.access_token);
+        if (user.sub !== idTokenClaims.sub) {
+            throw new NexAuthError('id_token_validation_failed', 'The UserInfo subject does not match the ID-token subject.');
+        }
+        const session = {
+            accessToken: token.access_token,
+            tokenType: 'Bearer',
+            expiresAt: Date.now() + token.expires_in * 1000,
+            user,
+            idToken: token.id_token,
+            idTokenClaims,
+            ...(token.scope
+                ? {
+                    scope: token.scope,
+                }
+                : {}),
+            ...(token.refresh_token
+                ? {
+                    refreshToken: token.refresh_token,
+                }
+                : {}),
+        };
+        this.storage.set('session', session);
+        return {
+            session,
+            ...(transaction.returnTo
+                ? {
+                    returnTo: transaction.returnTo,
+                }
+                : {}),
+        };
+    }
+    getSession() {
+        const value = this.storage.get('session');
+        if (!isRecord(value)) {
+            if (value !== null) {
+                this.storage.remove('session');
+            }
+            return null;
+        }
+        if (typeof value.accessToken !== 'string' ||
+            value.tokenType !== 'Bearer' ||
+            typeof value.expiresAt !== 'number' ||
+            !isRecord(value.user) ||
+            typeof value.user.sub !== 'string') {
+            this.storage.remove('session');
+            return null;
+        }
+        if (Date.now() >= value.expiresAt) {
+            this.storage.remove('session');
+            return null;
+        }
+        return value;
+    }
+    isAuthenticated() {
+        return this.getSession() !== null;
+    }
+    getAccessToken() {
+        return this.getSession()?.accessToken ?? null;
+    }
+    getUser() {
+        return this.getSession()?.user ?? null;
+    }
+    async logout(options = {}) {
+        if (options.localOnly === true) {
+            this.storage.clear();
+            return;
+        }
+        let configuration;
+        try {
+            configuration = await this.discovery.getConfiguration();
+        }
+        catch (error) {
+            this.storage.clear();
+            throw new NexAuthError('logout_failed', 'Local authentication was cleared, but NexAuth logout configuration could not be loaded.', {
+                cause: error,
+            });
+        }
+        this.storage.clear();
+        if (!configuration.end_session_endpoint) {
+            throw new NexAuthError('logout_failed', 'NexAuth does not advertise an end-session endpoint.');
+        }
+        let response;
+        try {
+            response = await this.fetchImplementation(configuration.end_session_endpoint, {
+                method: 'POST',
+                credentials: 'include',
+                headers: {
+                    Accept: 'application/json',
+                },
+            });
+        }
+        catch (error) {
+            throw new NexAuthError('logout_failed', 'Local authentication was cleared, but the NexAuth server session could not be terminated.', {
+                cause: error,
+            });
+        }
+        if (!response.ok) {
+            const responseError = await getResponseError(response, 'NexAuth could not terminate the server session.');
+            throw new NexAuthError('logout_failed', responseError.message, {
+                status: response.status,
+                ...(responseError.requestId
+                    ? {
+                        requestId: responseError.requestId,
+                    }
+                    : {}),
+            });
+        }
+    }
+    clearLocalSession() {
+        this.storage.clear();
+    }
+    async exchangeAuthorizationCode(configuration, code, transaction) {
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: this.clientId,
+            code,
+            redirect_uri: transaction.redirectUri,
+            code_verifier: transaction.codeVerifier,
+        });
+        let response;
+        try {
+            response = await this.fetchImplementation(configuration.token_endpoint, {
+                method: 'POST',
+                headers: {
+                    Accept: 'application/json',
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body,
+            });
+        }
+        catch (error) {
+            throw new NexAuthError('network_error', 'Unable to connect to the NexAuth token endpoint.', {
+                cause: error,
+            });
+        }
+        if (!response.ok) {
+            const responseError = await getResponseError(response, 'NexAuth rejected the authorization code.');
+            throw new NexAuthError('token_exchange_failed', responseError.message, {
+                status: response.status,
+                ...(responseError.requestId
+                    ? {
+                        requestId: responseError.requestId,
+                    }
+                    : {}),
+            });
+        }
+        let bodyValue;
+        try {
+            bodyValue = await response.json();
+        }
+        catch (error) {
+            throw new NexAuthError('invalid_token_response', 'NexAuth returned malformed token JSON.', {
+                status: response.status,
+                cause: error,
+            });
+        }
+        return validateTokenResponse(bodyValue);
+    }
+    async loadUserInfo(configuration, accessToken) {
+        let response;
+        try {
+            response = await this.fetchImplementation(configuration.userinfo_endpoint, {
+                method: 'GET',
+                headers: {
+                    Accept: 'application/json',
+                    Authorization: `Bearer ${accessToken}`,
+                },
+            });
+        }
+        catch (error) {
+            throw new NexAuthError('network_error', 'Unable to connect to the NexAuth UserInfo endpoint.', {
+                cause: error,
+            });
+        }
+        if (!response.ok) {
+            const responseError = await getResponseError(response, 'NexAuth could not load the authenticated user.');
+            throw new NexAuthError('userinfo_failed', responseError.message, {
+                status: response.status,
+                ...(responseError.requestId
+                    ? {
+                        requestId: responseError.requestId,
+                    }
+                    : {}),
+            });
+        }
+        let value;
+        try {
+            value = await response.json();
+        }
+        catch (error) {
+            throw new NexAuthError('userinfo_failed', 'NexAuth returned malformed UserInfo JSON.', {
+                status: response.status,
+                cause: error,
+            });
+        }
+        return validateUserInfo(value);
+    }
+}
+//# sourceMappingURL=nexauth-browser-client.js.map

package/dist/nexauth-browser-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexauth-browser-client.js","sourceRoot":"","sources":["../src/nexauth-browser-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAe/E,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgB5D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,IAAY;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAEhC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,wDAAwD,EACxD;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GACT,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IAE3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,KAAK;SACjB,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAClB,eAAuB,EACvB,gBAA+C;IAE/C,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,eAAe,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAEhC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,SAAS,EAAE,CAAC;IAElC,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,8BAA8B,EAAE;YACrE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,YAAY,CACpB,cAAc,EACd,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,0BAA0B,EAC1B,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACpC,CAAC,CAAC;gBACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,IACE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAC3C,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,IACE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAClC,KAAK,CAAC,UAAU,IAAI,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAE5B,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YACjC,CAAC,CAAC;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACpC,CAAC,CAAC;gBACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,GAAG,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;YACzC,CAAC,CAAC;gBACE,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,OAAO,KAAoB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB,EAClB,eAAuB;IAKvB,MAAM,eAAe,GACnB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;QAEzD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,SAAS,GACb,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE;gBAC5B,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE;gBACtB,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;gBACvB,eAAe,CAAC;YAElB,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,eAAe;gBACtD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;QAEvE,MAAM,OAAO,GACX,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE;YAC9B,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;YACpB,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,eAAe,CAAC;QAElB,OAAO;YACL,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,GAAG,CAAC,eAAe;gBACjB,CAAC,CAAC;oBACE,SAAS,EAAE,eAAe;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IACd,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,KAAK,CAAS;IACd,mBAAmB,CAA0B;IAC7C,OAAO,CAAwB;IAC/B,SAAS,CAAwB;IACjC,eAAe,CAAkB;IAElD,YAAmB,OAAoC;QACrD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC,QAAQ,GAAG,sBAAsB,CACpC,OAAO,CAAC,QAAQ,EAChB,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE1D,MAAM,aAAa,GAAG,SAAS,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,oBAAoB,CACrC,OAAO,CAAC,WAAW,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,gBAAgB,CACxE,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG,cAAc,CACzB,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAChD,CAAC;QAEF,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAE9D,IAAI,OAAO,mBAAmB,KAAK,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,uCAAuC,CACxC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEhE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,EAAE,CAAC;QAE9D,IAAI,CAAC,OAAO,GAAG,IAAI,qBAAqB,CACtC,OAAO,EACP,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,EAC7C,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,CAAC;YACzC,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,mBAAmB;SAChC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,UAAwB,EAAE;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,KAAK,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErD,MAAM,WAAW,GAA6B;YAC5C,KAAK;YACL,KAAK;YACL,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QAEvE,gBAAgB,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;YAC5C,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC;YACxD,KAAK;YACL,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,SAAS;YAC9B,qBAAqB,EAAE,IAAI,CAAC,MAAM;YAClC,GAAG,CAAC,OAAO,CAAC,MAAM;gBAChB,CAAC,CAAC;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,SAAS,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAoC,EAAE;QAEtC,IAAI,WAAgB,CAAC;QAErB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,4CAA4C,EAC5C;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,mBAAmB,CACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAU,aAAa,CAAC,CACzC,CAAC;QAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7D,IACE,WAAW,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM;YACjD,WAAW,CAAC,QAAQ,KAAK,mBAAmB,CAAC,QAAQ,EACrD,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAEnC,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC;QAE1D,IACE,cAAc,GAAG,CAAC;YAClB,cAAc,GAAG,oCAAoC,EACrD,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAEnC,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAEnC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,oCAAoC,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEzD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GACf,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE;gBACzD,2CAA2C,CAAC;YAE9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAEnC,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAE1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAEnC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAE9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAChD,aAAa,EACb,IAAI,EACJ,WAAW,CACZ,CAAC;QAEF;;;WAGG;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GACjB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAC/B,KAAK,CAAC,QAAQ,EACd,aAAa,EACb,WAAW,CAAC,KAAK,CAClB,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAExE,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAmB;YAC9B,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI;YAC/C,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,aAAa;YAEb,GAAG,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,GAAG,CAAC,KAAK,CAAC,aAAa;gBACrB,CAAC,CAAC;oBACE,YAAY,EAAE,KAAK,CAAC,aAAa;iBAClC;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAErC,OAAO;YACL,OAAO;YACP,GAAG,CAAC,WAAW,CAAC,QAAQ;gBACtB,CAAC,CAAC;oBACE,QAAQ,EAAE,WAAW,CAAC,QAAQ;iBAC/B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEM,UAAU;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAU,SAAS,CAAC,CAAC;QAEnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACrC,KAAK,CAAC,SAAS,KAAK,QAAQ;YAC5B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YACrB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,EAClC,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAkC,CAAC;IAC5C,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC;IACpC,CAAC;IAEM,cAAc;QACnB,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,IAAI,IAAI,CAAC;IAChD,CAAC;IAEM,OAAO;QACZ,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,UAAyB,EAAE;QAC7C,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,aAAkC,CAAC;QAEvC,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAErB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,yFAAyF,EACzF;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACvC,aAAa,CAAC,oBAAoB,EAClC;gBACE,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,2FAA2F,EAC3F;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,QAAQ,EACR,iDAAiD,CAClD,CAAC;YAEF,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE;gBAC7D,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,aAAa,CAAC,SAAS;oBACzB,CAAC,CAAC;wBACE,SAAS,EAAE,aAAa,CAAC,SAAS;qBACnC;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,iBAAiB;QACtB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,aAAkC,EAClC,IAAY,EACZ,WAAqC;QAErC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,IAAI;YACJ,YAAY,EAAE,WAAW,CAAC,WAAW;YACrC,aAAa,EAAE,WAAW,CAAC,YAAY;SACxC,CAAC,CAAC;QAEH,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,cAAc,EAAE;gBACtE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,kDAAkD,EAClD;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,QAAQ,EACR,0CAA0C,CAC3C,CAAC;YAEF,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,aAAa,CAAC,OAAO,EAAE;gBACrE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,aAAa,CAAC,SAAS;oBACzB,CAAC,CAAC;wBACE,SAAS,EAAE,aAAa,CAAC,SAAS;qBACnC;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAkB,CAAC;QAEvB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,wCAAwC,EACxC;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,aAAkC,EAClC,WAAmB;QAEnB,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACvC,aAAa,CAAC,iBAAiB,EAC/B;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,EACrD;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,QAAQ,EACR,gDAAgD,CACjD,CAAC;YAEF,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,aAAa,CAAC,OAAO,EAAE;gBAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,aAAa,CAAC,SAAS;oBACzB,CAAC,CAAC;wBACE,SAAS,EAAE,aAAa,CAAC,SAAS;qBACnC;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAc,CAAC;QAEnB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,2CAA2C,EAC3C;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/pkce.d.ts

@@ -0,0 +1,9 @@
+export interface PkcePair {
+    readonly verifier: string;
+    readonly challenge: string;
+    readonly method: 'S256';
+}
+export declare function generateSecureRandomValue(byteLength?: number): string;
+export declare function createCodeChallenge(verifier: string): Promise<string>;
+export declare function createPkcePair(): Promise<PkcePair>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgCD,wBAAgB,yBAAyB,CAAC,UAAU,SAAK,GAAG,MAAM,CAajE;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyB3E;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,CAaxD"}

package/dist/pkce.js

@@ -0,0 +1,58 @@
+import { NexAuthError } from './errors.js';
+function getWebCrypto() {
+    const cryptoImplementation = globalThis.crypto;
+    if (!cryptoImplementation ||
+        typeof cryptoImplementation.getRandomValues !== 'function' ||
+        !cryptoImplementation.subtle) {
+        throw new NexAuthError('invalid_configuration', 'This browser does not provide the Web Crypto API required by NexAuth.');
+    }
+    return cryptoImplementation;
+}
+function bytesToBase64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/g, '');
+}
+export function generateSecureRandomValue(byteLength = 32) {
+    if (!Number.isInteger(byteLength) || byteLength < 16) {
+        throw new NexAuthError('invalid_configuration', 'Secure random values must contain at least 16 bytes.');
+    }
+    const bytes = new Uint8Array(byteLength);
+    getWebCrypto().getRandomValues(bytes);
+    return bytesToBase64Url(bytes);
+}
+export async function createCodeChallenge(verifier) {
+    if (verifier.length < 43 || verifier.length > 128) {
+        throw new NexAuthError('invalid_configuration', 'The PKCE verifier must contain between 43 and 128 characters.');
+    }
+    const encodedVerifier = new TextEncoder().encode(verifier);
+    let digest;
+    try {
+        digest = await getWebCrypto().subtle.digest('SHA-256', encodedVerifier);
+    }
+    catch (error) {
+        throw new NexAuthError('login_failed', 'Unable to create the PKCE authorization challenge.', {
+            cause: error,
+        });
+    }
+    return bytesToBase64Url(new Uint8Array(digest));
+}
+export async function createPkcePair() {
+    /*
+     * 64 random bytes produce an 86-character base64url verifier,
+     * which satisfies the RFC 7636 requirement of 43–128 characters.
+     */
+    const verifier = generateSecureRandomValue(64);
+    const challenge = await createCodeChallenge(verifier);
+    return {
+        verifier,
+        challenge,
+        method: 'S256',
+    };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,SAAS,YAAY;IACnB,MAAM,oBAAoB,GAAG,UAAU,CAAC,MAAM,CAAC;IAE/C,IACE,CAAC,oBAAoB;QACrB,OAAO,oBAAoB,CAAC,eAAe,KAAK,UAAU;QAC1D,CAAC,oBAAoB,CAAC,MAAM,EAC5B,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAU,GAAG,EAAE;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAEzC,YAAY,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAClD,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,IAAI,MAAmB,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,cAAc,EACd,oDAAoD,EACpD;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC;;;OAGG;IACH,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEtD,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC"}

package/dist/storage.d.ts

@@ -0,0 +1,14 @@
+import type { NexAuthStorage } from './types.js';
+export type NexAuthStorageEntry = 'session' | 'transaction';
+export declare function getDefaultBrowserStorage(): NexAuthStorage;
+export declare class NexAuthStorageManager {
+    private readonly storage;
+    private readonly namespace;
+    constructor(storage: NexAuthStorage, prefix: string, clientId: string);
+    get<T>(entry: NexAuthStorageEntry): T | null;
+    set<T>(entry: NexAuthStorageEntry, value: T): void;
+    remove(entry: NexAuthStorageEntry): void;
+    clear(): void;
+    private getKey;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,aAAa,CAAC;AAY5D,wBAAgB,wBAAwB,IAAI,cAAc,CAYzD;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGjC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;IAUX,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,GAAG,CAAC,GAAG,IAAI;IAuC5C,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IA8BlD,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI;IAcxC,KAAK,IAAI,IAAI;IAUpB,OAAO,CAAC,MAAM;CAGf"}