@nihplod/sso-sdk 1.5.0 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/README.md +21 -2
  2. package/dist/index.d.mts +26 -1
  3. package/dist/index.d.ts +26 -1
  4. package/dist/index.js +148 -84
  5. package/dist/index.js.map +1 -1
  6. package/dist/index.mjs +148 -84
  7. package/dist/index.mjs.map +1 -1
  8. package/dist/next/index.d.mts +87 -2
  9. package/dist/next/index.d.ts +87 -2
  10. package/dist/next/index.js +330 -64
  11. package/dist/next/index.js.map +1 -1
  12. package/dist/next/index.mjs +329 -64
  13. package/dist/next/index.mjs.map +1 -1
  14. package/dist/react/index.d.mts +32 -2
  15. package/dist/react/index.d.ts +32 -2
  16. package/dist/react/index.js +196 -105
  17. package/dist/react/index.js.map +1 -1
  18. package/dist/react/index.mjs +196 -105
  19. package/dist/react/index.mjs.map +1 -1
  20. package/package.json +1 -1
package/dist/index.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/core/errors.ts","../src/core/pkce.ts","../src/core/storage.ts","../src/core/security.ts","../src/core/id-token.ts","../src/core/SsoClient.ts"],"sourcesContent":["/**\r\n * SSO SDK 错误类型\r\n */\r\n\r\n/** SSO 错误码 */\r\nexport type SsoErrorCode =\r\n | \"invalid_config\"\r\n | \"state_mismatch\"\r\n | \"pkce_required\"\r\n | \"token_request_failed\"\r\n | \"session_expired\"\r\n | \"no_refresh_token\"\r\n | \"userinfo_failed\"\r\n | \"not_authenticated\"\r\n | \"authorization_code_expired\"\r\n // 保留：当前 SDK 不主动抛出，预留给服务端错误透传/未来版本使用\r\n | \"authorization_code_used\"\r\n | \"client_disabled\"\r\n | \"user_denied_authorization\"\r\n // 保留：当前 SDK 不主动抛出，预留给服务端错误透传/未来版本使用\r\n | \"account_disabled\"\r\n | \"sso_server_error\"\r\n | \"rate_limited\"\r\n | \"network_error\"\r\n | \"popup_blocked\"\r\n | \"popup_closed\"\r\n | \"id_token_invalid\"\r\n | \"id_token_unsupported_alg\"\r\n | \"id_token_hs256_unsupported\"\r\n // 保留：当前 SDK 不主动抛出（HS256 一律拒绝，见 id_token_hs256_unsupported）\r\n | \"id_token_missing_secret\"\r\n | \"id_token_invalid_signature\"\r\n | \"id_token_issuer_mismatch\"\r\n | \"id_token_audience_mismatch\"\r\n | \"id_token_expired\"\r\n | \"id_token_missing_sub\"\r\n | \"id_token_at_hash_mismatch\"\r\n | \"id_token_nonce_mismatch\"\r\n | \"logout_token_invalid\"\r\n | \"logout_token_unsupported_alg\"\r\n | \"logout_token_invalid_signature\"\r\n | \"logout_token_issuer_mismatch\"\r\n | \"logout_token_audience_mismatch\"\r\n | \"logout_token_expired\"\r\n | \"logout_token_replay\";\r\n\r\n/**\r\n * 将 OAuth 2.0 服务端 error 字段映射到 SsoErrorCode\r\n *\r\n * @param oauthError 服务端返回的 error 字段\r\n * @param context 调用上下文：\"token_exchange\"（授权码换 token）或 \"refresh\"（刷新）。\r\n * invalid_grant 在换 token 场景多为授权码过期/已用，在刷新场景多为会话失效，\r\n * 需按上下文细化映射。\r\n */\r\nexport function mapOAuthErrorToSsoCode(\r\n oauthError: string,\r\n context: \"token_exchange\" | \"refresh\" = \"token_exchange\"\r\n): SsoErrorCode {\r\n switch (oauthError) {\r\n case \"invalid_grant\":\r\n // 刷新场景的 invalid_grant 表示 refresh_token 已撤销/过期（调用方另会清除本地登录态）\r\n return context === \"refresh\" ? \"session_expired\" : \"authorization_code_expired\";\r\n case \"invalid_client\":\r\n return \"client_disabled\";\r\n case \"access_denied\":\r\n return \"user_denied_authorization\";\r\n case \"server_error\":\r\n return \"sso_server_error\";\r\n case \"rate_limited\":\r\n // 限流是独立的可重试错误，不应误报为 network_error\r\n return \"rate_limited\";\r\n case \"invalid_scope\":\r\n case \"invalid_request\":\r\n case \"unauthorized_client\":\r\n case \"unsupported_grant_type\":\r\n default:\r\n return \"token_request_failed\";\r\n }\r\n}\r\n\r\n/**\r\n * SSO SDK 自定义错误\r\n */\r\nexport class SsoError extends Error {\r\n public readonly code: SsoErrorCode;\r\n public readonly description: string;\r\n public readonly cause?: unknown;\r\n\r\n constructor(code: SsoErrorCode, description: string, cause?: unknown) {\r\n super(`[SSO SDK] ${code}: ${description}`);\r\n this.name = \"SsoError\";\r\n this.code = code;\r\n this.description = description;\r\n this.cause = cause;\r\n }\r\n}\r\n\r\n/**\r\n * OAuth 2.0 协议层错误（RFC 6749 §5.2）\r\n *\r\n * 保留用于表示服务端原样返回的 OAuth 错误（error / error_description / error_uri），\r\n * 与 SDK 语义的 SsoError 区分。当前 SDK 内部不抛出此类型（统一使用 SsoError +\r\n * mapOAuthErrorToSsoCode 映射），作为公共类型导出供子项目自行解析 OAuth 响应时使用。\r\n */\r\nexport class OAuthError extends Error {\r\n public readonly code: string;\r\n public readonly description: string;\r\n public readonly uri?: string;\r\n\r\n constructor(code: string, description: string, uri?: string) {\r\n super(`[OAuth] ${code}: ${description}`);\r\n this.name = \"OAuthError\";\r\n this.code = code;\r\n this.description = description;\r\n this.uri = uri;\r\n }\r\n}\r\n","/**\r\n * PKCE (Proof Key for Code Exchange) 工具函数\r\n *\r\n * 实现 RFC 7636 规范：\r\n * - code_verifier: 43-128 字符的随机字符串\r\n * - code_challenge: SHA-256(code_verifier) 的 base64url 编码\r\n *\r\n * 仅支持 S256 模式，不提供 plain 模式。\r\n */\r\n\r\nconst VALID_CHARS =\r\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~\";\r\n\r\n/**\r\n * 生成密码学安全随机字符串\r\n *\r\n * 使用拒绝采样法（rejection sampling）避免取模非均匀分布。\r\n * VALID_CHARS 有 66 个字符，Uint8(0-255) 取模会偏向前 58 个字符。\r\n * 丢弃 >=198 的字节值使分布完全均匀（198 = floor(256/66) * 66）。\r\n */\r\nfunction generateRandomString(length: number): string {\r\n const mask = 198; // 66 * 3，最大均匀取值\r\n let result = \"\";\r\n\r\n while (result.length < length) {\r\n // 一次生成分块避免过小 array 的循环开销\r\n const chunkSize = Math.min(length * 2, 256);\r\n const array = new Uint8Array(chunkSize);\r\n crypto.getRandomValues(array);\r\n\r\n for (let i = 0; i < chunkSize && result.length < length; i++) {\r\n if (array[i] >= mask) continue; // 拒绝采样：丢弃 >=198 的字节\r\n result += VALID_CHARS[array[i] % VALID_CHARS.length];\r\n }\r\n }\r\n\r\n return result;\r\n}\r\n\r\n/**\r\n * 生成 code_verifier\r\n *\r\n * 生成 43-128 字符之间的安全随机字符串，\r\n * 使用 `crypto.getRandomValues` 保证密码学安全性。\r\n *\r\n * @param length - 长度（默认 64），范围 43-128\r\n */\r\nexport function generateCodeVerifier(length: number = 64): string {\r\n if (length < 43 || length > 128) {\r\n throw new Error(\"code_verifier length must be between 43 and 128\");\r\n }\r\n return generateRandomString(length);\r\n}\r\n\r\n/**\r\n * 计算 code_challenge (S256)\r\n *\r\n * 对 code_verifier 进行 SHA-256 哈希，然后进行 base64url 编码。\r\n *\r\n * @param codeVerifier - PKCE code_verifier\r\n */\r\nexport async function generateCodeChallenge(\r\n codeVerifier: string\r\n): Promise<string> {\r\n const encoder = new TextEncoder();\r\n const data = encoder.encode(codeVerifier);\r\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\r\n\r\n // 转为 base64url（无 padding）\r\n const bytes = new Uint8Array(hash);\r\n let binary = \"\";\r\n for (let i = 0; i < bytes.byteLength; i++) {\r\n binary += String.fromCharCode(bytes[i]);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/**\r\n * 生成 state 参数\r\n *\r\n * 32 字节 hex 随机字符串，用于 CSRF 防护。\r\n */\r\nexport function generateState(): string {\r\n const array = new Uint8Array(32);\r\n crypto.getRandomValues(array);\r\n return Array.from(array, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\r\n}\r\n","/**\n * Token 存储抽象层\n *\n * 分两类存储：\n * - Token 数据：默认使用 sessionStorage（标签页级持久化）。登录回调后 CallbackPage\n * 默认整页跳转，内存存储会丢失登录态，因此默认改为 sessionStorage：\n * 整页跳转与刷新后登录态保留，关闭标签页自动清除；SSR / 隐私模式写入失败时\n * 降级为内存 Map。对需要多 Tab 共享 token 或 BFF/Confidential Client 场景，\n * 可通过 setTokenStorage() 注入 localStorage 实现（如 createSecureStorage({ persist: true })）。\n * - 临时数据（PKCE verifier / state / OIDC nonce / returnUrl / popup nonce）：必须跨整页重定向存活\n * （login() 会 302 跳转到 SSO 中心再回来），因此默认写入 sessionStorage；\n * SSR 等无 sessionStorage 环境自动降级为内存 Map。\n *\n * 多 client 隔离：\n * - token / state / return_url 均支持按 clientId 隔离 key\n * - 不传 clientId 时使用全局 key，保持向后兼容\n */\n\n/** Token 数据 */\nexport interface TokenData {\n access_token: string;\n token_type: string;\n expires_in: number;\n refresh_token: string;\n id_token?: string;\n\n /** Token 签发时间（epoch ms），用于计算过期 */\n issued_at: number;\n\n /** 访问令牌实际过期时间（epoch ms）= issued_at + expires_in * 1000 */\n expires_at: number;\n}\n\n/** 存储接口 */\nexport interface TokenStorage {\n get(key: string): string | null;\n set(key: string, value: string): void;\n remove(key: string): void;\n /**\n * 可选：枚举当前存储中的 key（不含 SDK 内部前缀）。\n * 供 clearAllSsoData() 清理 client 级残留（`token:<clientId>` 等）。\n * 自定义存储若不实现，clearAllSsoData() 仅能按已知 key 清理。\n */\n keys?(): string[];\n}\n\n/** 默认 localStorage/sessionStorage key 前缀 */\nconst STORAGE_PREFIX = \"nihplod_sso_\";\n\n/** 常量 key 名称 */\nconst TOKEN_KEY = \"token\";\nconst VERIFIER_KEY_PREFIX = \"pkce_verifier_\";\nconst STATE_KEY = \"oauth_state\";\nconst NONCE_KEY = \"oidc_nonce\";\nconst RETURN_URL_KEY = \"return_url\";\nconst LOGOUT_STATE_KEY = \"logout_state\";\n// 静默登录探测标记（prompt=none 发起的 authorize 请求所携带的 state）\nconst SILENT_PROBE_KEY = \"silent_probe\";\n\nfunction buildKey(base: string, clientId?: string): string {\n return clientId ? `${base}:${clientId}` : base;\n}\n\n/**\n * 内存存储适配器\n *\n * 仅作为 sessionStorage 不可用（SSR / 隐私模式写入失败）时的降级方案，\n * 或显式注入使用。页面刷新后用户需重新登录。\n *\n * 代价：多 Tab 间不会自动同步 token；SDK 内部已用锁机制避免并发刷新。\n */\nfunction createMemoryStorageAdapter(): TokenStorage {\n const store = new Map<string, string>();\n return {\n get(key: string) {\n return store.get(key) ?? null;\n },\n set(key: string, value: string) {\n store.set(key, value);\n },\n remove(key: string) {\n store.delete(key);\n },\n keys() {\n return [...store.keys()];\n },\n };\n}\n\nconst memoryStorageAdapter = createMemoryStorageAdapter();\n\n/**\n * 浏览器 localStorage 实现\n *\n * 适用于：\n * - Next.js BFF / Confidential Client（refresh_token 不直接暴露给浏览器）。\n * - 需要多 Tab 共享 token 的场景。\n *\n * 注意：Public Client 在浏览器中直接存储 refresh_token 会增加 XSS 风险，\n * 建议改用内存存储或 Service Worker 封装。\n */\nconst localStorageAdapter: TokenStorage = {\n get(key: string) {\n try {\n if (typeof localStorage === \"undefined\") return null;\n return localStorage.getItem(STORAGE_PREFIX + key);\n } catch {\n // 沙箱 iframe / 禁用存储等场景访问 localStorage 会抛 SecurityError\n return null;\n }\n },\n set(key: string, value: string) {\n try {\n if (typeof localStorage === \"undefined\") return;\n localStorage.setItem(STORAGE_PREFIX + key, value);\n } catch (err) {\n // QuotaExceededError / SecurityError 等写入失败不应中断登录流程\n console.warn(\n `[SSO SDK] localStorage 写入失败（${err instanceof Error ? err.name : String(err)}），数据未持久化`\n );\n }\n },\n remove(key: string) {\n try {\n if (typeof localStorage === \"undefined\") return;\n localStorage.removeItem(STORAGE_PREFIX + key);\n } catch {\n // 忽略存储不可用\n }\n },\n keys() {\n try {\n if (typeof localStorage === \"undefined\") return [];\n const result: string[] = [];\n for (let i = 0; i < localStorage.length; i++) {\n const key = localStorage.key(i);\n if (key?.startsWith(STORAGE_PREFIX)) result.push(key.slice(STORAGE_PREFIX.length));\n }\n return result;\n } catch {\n return [];\n }\n },\n};\n\n/**\n * 浏览器 sessionStorage 实现\n *\n * 同时承担两个角色：\n * - Token 数据的默认存储：整页重定向（CallbackPage 默认行为）与页面刷新后\n * 登录态仍保留；sessionStorage 随标签页关闭自动清除，且不跨 Tab 共享，\n * 比 localStorage 缩小了 XSS 窃取 refresh_token 的暴露面。\n * - 临时数据（PKCE verifier / state / returnUrl / popup nonce）专用：\n * 必须跨整页重定向存活，不能放模块级内存。\n * SSR / 隐私模式写入失败时降级为内存 Map，保证不抛异常。\n */\nfunction createSessionStorageAdapter(): TokenStorage {\n const fallback = new Map<string, string>();\n return {\n get(key: string) {\n try {\n if (typeof sessionStorage !== \"undefined\") {\n return sessionStorage.getItem(STORAGE_PREFIX + key) ?? fallback.get(key) ?? null;\n }\n } catch {\n // 沙箱 iframe / 禁用存储：退化为内存 fallback\n }\n return fallback.get(key) ?? null;\n },\n set(key: string, value: string) {\n try {\n if (typeof sessionStorage !== \"undefined\") {\n sessionStorage.setItem(STORAGE_PREFIX + key, value);\n return;\n }\n } catch {\n // 隐私模式等场景写入失败时降级到内存\n }\n fallback.set(key, value);\n },\n remove(key: string) {\n fallback.delete(key);\n try {\n if (typeof sessionStorage === \"undefined\") return;\n sessionStorage.removeItem(STORAGE_PREFIX + key);\n } catch {\n // 忽略存储不可用\n }\n },\n keys() {\n const result = new Set<string>(fallback.keys());\n try {\n if (typeof sessionStorage !== \"undefined\") {\n for (let i = 0; i < sessionStorage.length; i++) {\n const key = sessionStorage.key(i);\n if (key?.startsWith(STORAGE_PREFIX)) result.add(key.slice(STORAGE_PREFIX.length));\n }\n }\n } catch {\n // 存储不可用：仅返回 fallback\n }\n return [...result];\n },\n };\n}\n\n/** 临时数据存储（跨整页重定向存活），独立于 token 存储，不受 setTokenStorage() 影响 */\nconst _transient: TokenStorage = createSessionStorageAdapter();\n\n/**\n * 创建存储实现\n *\n * @param options.persist 是否持久化到 localStorage。默认 false（sessionStorage）。\n * - false（默认）：sessionStorage，标签页级持久化（刷新/整页跳转后登录态保留，\n * 关闭标签页即清除），多 Tab 间不共享；隐私模式等写入失败时降级为内存。\n * - true：localStorage，多 Tab 共享、关闭浏览器后仍保留。\n * ⚠️ 安全警告：persist=true 会将 refresh_token 明文写入 localStorage，\n * 任何 XSS 均可在不被检测的情况下读取。仅在 BFF/Confidential Client\n * 且 refresh_token 不直接暴露给浏览器的场景下使用。\n */\nexport function createSecureStorage(options: { persist?: boolean } = {}): TokenStorage {\n return options.persist ? localStorageAdapter : createSessionStorageAdapter();\n}\n\n/**\n * 默认 token 存储：sessionStorage（标签页级持久化），SSR/隐私模式降级为内存。\n * 可通过 setTokenStorage() 覆盖。\n */\nlet _storage: TokenStorage = createSessionStorageAdapter();\n\n/**\n * 设置自定义存储实现\n */\nexport function setTokenStorage(storage: TokenStorage): void {\n _storage = storage;\n}\n\n/**\n * 获取当前存储实现\n */\nexport function getTokenStorage(): TokenStorage {\n return _storage;\n}\n\n// ============================================\n// Token 存取\n// ============================================\n\nexport function saveTokenData(data: TokenData, clientId?: string): void {\n _storage.set(buildKey(TOKEN_KEY, clientId), JSON.stringify(data));\n}\n\nexport function getTokenData(clientId?: string): TokenData | null {\n const raw = _storage.get(buildKey(TOKEN_KEY, clientId));\n if (!raw) return null;\n try {\n // 过期不物理删除：refresh_token 通常比 access_token 长寿，\n // 删除会同时丢弃 refresh_token 使刷新路径失效。\n // 是否过期由调用方依据 expires_at 判断（isAuthenticated / getUserInfo 等）。\n return JSON.parse(raw) as TokenData;\n } catch {\n return null;\n }\n}\n\nexport function removeTokenData(clientId?: string): void {\n _storage.remove(buildKey(TOKEN_KEY, clientId));\n}\n\n// ============================================\n// PKCE 临时数据存取（transient：sessionStorage，跨整页重定向存活）\n// ============================================\n\nexport function savePkceVerifier(clientId: string, verifier: string): void {\n _transient.set(VERIFIER_KEY_PREFIX + clientId, verifier);\n}\n\nexport function getPkceVerifier(clientId: string): string | null {\n return _transient.get(VERIFIER_KEY_PREFIX + clientId);\n}\n\nexport function removePkceVerifier(clientId: string): void {\n _transient.remove(VERIFIER_KEY_PREFIX + clientId);\n}\n\n// ============================================\n// State 参数存取（transient）\n// ============================================\n\nexport function saveOAuthState(state: string, clientId?: string): void {\n _transient.set(buildKey(STATE_KEY, clientId), state);\n}\n\nexport function getOAuthState(clientId?: string): string | null {\n return _transient.get(buildKey(STATE_KEY, clientId));\n}\n\nexport function removeOAuthState(clientId?: string): void {\n _transient.remove(buildKey(STATE_KEY, clientId));\n}\n\n// ============================================\n// OIDC nonce 存取（transient，ID Token 重放防护）\n// ============================================\n\nexport function saveOAuthNonce(nonce: string, clientId?: string): void {\n _transient.set(buildKey(NONCE_KEY, clientId), nonce);\n}\n\nexport function getOAuthNonce(clientId?: string): string | null {\n return _transient.get(buildKey(NONCE_KEY, clientId));\n}\n\nexport function removeOAuthNonce(clientId?: string): void {\n _transient.remove(buildKey(NONCE_KEY, clientId));\n}\n\n// ============================================\n// Logout State 存取（transient，RP-Initiated Logout CSRF 防护）\n// ============================================\n\nexport function saveLogoutState(state: string, clientId?: string): void {\n _transient.set(buildKey(LOGOUT_STATE_KEY, clientId), state);\n}\n\nexport function getLogoutState(clientId?: string): string | null {\n return _transient.get(buildKey(LOGOUT_STATE_KEY, clientId));\n}\n\nexport function removeLogoutState(clientId?: string): void {\n _transient.remove(buildKey(LOGOUT_STATE_KEY, clientId));\n}\n\n// ============================================\n// 返回 URL 存取（transient）\n// ============================================\nexport function saveReturnUrl(url: string, clientId?: string): void {\n _transient.set(buildKey(RETURN_URL_KEY, clientId), url);\n}\n\nexport function getReturnUrl(clientId?: string): string | null {\n return _transient.get(buildKey(RETURN_URL_KEY, clientId));\n}\n\nexport function removeReturnUrl(clientId?: string): void {\n _transient.remove(buildKey(RETURN_URL_KEY, clientId));\n}\n\n// ============================================\n// 静默登录探测标记存取（transient，prompt=none）\n// ============================================\n// 存的是该次探测 authorize 请求的 state 值，回调时用于匹配\n// （只有 state 与标记一致才按\"探测无会话\"处理，防伪造回调）\n\nexport function saveSilentProbe(state: string, clientId?: string): void {\n _transient.set(buildKey(SILENT_PROBE_KEY, clientId), state);\n}\n\nexport function getSilentProbe(clientId?: string): string | null {\n return _transient.get(buildKey(SILENT_PROBE_KEY, clientId));\n}\n\nexport function removeSilentProbe(clientId?: string): void {\n _transient.remove(buildKey(SILENT_PROBE_KEY, clientId));\n}\n\n// ============================================\n// 清理所有 SSO 数据\n// ============================================\n\nexport function clearAllSsoData(clientId?: string): void {\n if (clientId) {\n removeTokenData(clientId);\n removeOAuthState(clientId);\n removeOAuthNonce(clientId);\n removeReturnUrl(clientId);\n removeLogoutState(clientId);\n removeSilentProbe(clientId);\n removePkceVerifier(clientId);\n // popup nonce 复用 verifier key 空间（`${clientId}_popup_nonce`）\n removePkceVerifier(`${clientId}_popup_nonce`);\n return;\n }\n\n removeTokenData();\n removeOAuthState();\n removeOAuthNonce();\n removeReturnUrl();\n removeLogoutState();\n removeSilentProbe();\n\n // 无参调用必须清理全部 client 级残留（token:<clientId>、oauth_state:<clientId>、\n // oidc_nonce:<clientId>、return_url:<clientId>、pkce_verifier_<clientId> 等）。\n // 枚举浏览器存储中所有带前缀的 key：从原生存储、临时数据存储与 token 存储同时移除，\n // 且访问存储属性本身也要 try/catch（沙箱 iframe 下会抛 SecurityError）。\n const stores: Storage[] = [];\n try {\n if (typeof sessionStorage !== \"undefined\") stores.push(sessionStorage);\n } catch {\n /* 存储不可用 */\n }\n try {\n if (typeof localStorage !== \"undefined\") stores.push(localStorage);\n } catch {\n /* 存储不可用 */\n }\n\n const abstractKeys = new Set<string>();\n for (const store of stores) {\n const keys: string[] = [];\n try {\n for (let i = 0; i < store.length; i++) {\n const key = store.key(i);\n if (key?.startsWith(STORAGE_PREFIX)) keys.push(key);\n }\n } catch {\n continue;\n }\n for (const key of keys) {\n abstractKeys.add(key.slice(STORAGE_PREFIX.length));\n try {\n store.removeItem(key);\n } catch {\n /* 忽略 */\n }\n }\n }\n\n // 适配器级枚举：覆盖自定义 TokenStorage / 内存 fallback 中的 client 级 key\n // （这些 key 不在浏览器存储中，仅靠上方枚举无法发现）\n for (const store of [_transient, _storage]) {\n try {\n for (const key of store.keys?.() ?? []) abstractKeys.add(key);\n } catch {\n /* 忽略自定义实现异常 */\n }\n }\n\n for (const key of abstractKeys) {\n _transient.remove(key);\n _storage.remove(key);\n }\n}\n\n/**\n * 清理指定 clientId 列表的 PKCE verifier\n *\n * 适用于非浏览器环境或已知 clientId 场景。\n */\nexport function clearVerifiersForClients(clientIds: string[]): void {\n for (const clientId of clientIds) {\n _transient.remove(VERIFIER_KEY_PREFIX + clientId);\n }\n}\n","/**\n * 安全相关小工具：returnUrl 开放重定向校验、常量时间字符串比较\n */\n\n/**\n * 反斜杠或 ASCII 控制字符（tab/newline/CR/DEL）。\n * WHATWG URL 解析会在解析前剥离 TAB/LF/CR，并把 \"\\\" 归一化为 \"/\"，\n * 因此 \"/\\evil.com\"、\"/\\n//evil.com\" 能通过字符串前缀判断后变成跨站 URL。\n */\nconst UNSAFE_URL_CHAR_PATTERN = /[\\\\\\u0000-\\u001F\\u007F]/;\n\n/**\n * 校验 returnUrl 是否可信（防开放重定向）。\n * 仅允许：\n * - 站内相对路径（以单个 \"/\" 开头且不以 \"//\" 开头）\n * - 与 currentOrigin 完全同源的 http(s) 绝对 URL\n * 拒绝一切含反斜杠/控制字符的值（浏览器会将 \"/\\evil.com\" 解析为跨站 URL），\n * 拒绝 userinfo 与危险 scheme。\n */\nexport function isTrustedReturnUrl(url: string, currentOrigin: string): boolean {\n if (!url) return false;\n if (UNSAFE_URL_CHAR_PATTERN.test(url)) return false;\n if (url.startsWith(\"//\")) return false;\n if (url.startsWith(\"/\")) return true;\n try {\n const parsed = new URL(url);\n if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") return false;\n if (parsed.username || parsed.password) return false;\n return parsed.origin === currentOrigin;\n } catch {\n return false;\n }\n}\n\n/**\n * 常量时间字符串比较（避免 state / at_hash / nonce 等机密值的时序侧信道）。\n * 长度不同也执行完整循环，不提前返回。\n */\nexport function timingSafeEqualString(a: string, b: string): boolean {\n const ba = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (ba.length === 0 || bb.length === 0) return ba.length === bb.length;\n const len = Math.max(ba.length, bb.length);\n let diff = ba.length ^ bb.length;\n for (let i = 0; i < len; i++) {\n diff |= ba[i % ba.length] ^ bb[i % bb.length];\n }\n return diff === 0;\n}\n","/**\r\n * ID Token 验证工具（浏览器 / Edge Runtime 通用）\r\n *\r\n * 提取 SsoClient 与 Next.js callback 中重复的 ID Token 校验逻辑，\r\n * 包括 base64url 解码、JWKS 获取、RS256 签名验证、at_hash 计算等。\r\n */\r\n\r\nimport { SsoError } from \"./errors\";\r\nimport { timingSafeEqualString } from \"./security\";\r\n\r\n// 运行时 crypto.subtle 检测：现代浏览器 / Edge Runtime / Node 20+ 均提供全局 crypto\r\nconst _crypto: Pick<Crypto, \"subtle\"> | null =\r\n typeof crypto !== \"undefined\" && (crypto as Crypto).subtle ? (crypto as Crypto) : null;\r\n\r\nfunction getCrypto(): Crypto | null {\r\n return (_crypto as Crypto | null) ?? null;\r\n}\r\n\r\nexport interface JwksKey {\r\n kty: string;\r\n kid?: string;\r\n alg?: string;\r\n use?: string;\r\n n?: string;\r\n e?: string;\r\n x5c?: string[];\r\n}\r\n\r\nexport interface Jwks {\r\n keys: JwksKey[];\r\n}\r\n\r\nexport interface ValidateIdTokenResult {\r\n sub: string;\r\n}\r\n\r\nexport interface ValidateIdTokenOptions {\r\n /**\r\n * 发现 SSO 中心已启用 RS256 时，是否拒绝 HS256 ID Token。\r\n * 默认 true：只要 JWKS 中存在 RS256 签名密钥，就拒绝 HS256（安全推荐）。\r\n *\r\n * @deprecated 无实际作用：HS256 ID Token 一律被拒绝（对称密钥无法安全分发给\r\n * Public Client / BFF），该选项只影响走哪条抛错路径\r\n * （id_token_unsupported_alg 或 id_token_hs256_unsupported），\r\n * 不影响最终结果。保留仅为避免破坏 API，请勿依赖；将于未来大版本移除。\r\n */\r\n rejectHs256WhenRs256Available?: boolean;\r\n /**\r\n * 期望的 OIDC nonce（login 时生成并随 authorize 请求发送）。\r\n * 传入后 ID Token 必须携带 nonce claim 且与该值常量时间相等（fail-closed），\r\n * 否则抛出 id_token_nonce_mismatch，防止 ID Token 重放。\r\n * 不传则跳过 nonce 校验（如 refresh 流程签发的 ID Token）。\r\n */\r\n expectedNonce?: string;\r\n}\r\n\r\nfunction base64UrlDecode(input: string): Uint8Array {\r\n const base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\r\n const binary = atob(padded);\r\n const bytes = new Uint8Array(binary.length);\r\n for (let i = 0; i < binary.length; i++) {\r\n bytes[i] = binary.charCodeAt(i);\r\n }\r\n return bytes;\r\n}\r\n\r\n/** 解码 JWT payload（不验证签名） */\r\nexport function decodeJwtPayload(token: string): Record<string, unknown> | null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[1]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 解码 JWT header */\r\nexport function decodeJwtHeader(token: string): Record<string, unknown> | null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[0]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 标准化 issuer/base URL，去除末尾斜杠 */\r\nfunction normalizeIssuer(url: string): string {\r\n return url.replace(/\\/+$/, \"\");\r\n}\r\n\r\n/** OIDC Discovery 文档（仅取本模块关心的字段） */\r\nexport interface OidcDiscoveryDoc {\r\n issuer?: string;\r\n jwks_uri?: string;\r\n}\r\n\r\nlet cachedJwks: { baseUrl: string; jwks: Jwks; fetchedAt: number } | null = null;\r\nlet cachedDiscovery: { baseUrl: string; doc: OidcDiscoveryDoc; fetchedAt: number } | null = null;\r\nconst JWKS_CACHE_TTL_MS = 5 * 60 * 1000;\r\n/** discovery / JWKS 拉取超时（与 SsoClient._getDiscovery 的 10s 一致） */\r\nconst FETCH_TIMEOUT_MS = 10000;\r\n\r\n/**\r\n * 拉取 OIDC Discovery 文档（带内存缓存；失败返回 null 不抛错）\r\n *\r\n * 只缓存成功结果：失败（网络错误 / 非 2xx）不缓存，主站短暂抖动不会让\r\n * 登录持续失败到 TTL 期满，下一次调用立即重试（与 core/discovery.ts 策略一致）。\r\n */\r\nexport async function fetchDiscoveryDoc(baseUrl: string): Promise<OidcDiscoveryDoc | null> {\r\n const now = Date.now();\r\n if (cachedDiscovery && cachedDiscovery.baseUrl === baseUrl && now - cachedDiscovery.fetchedAt < JWKS_CACHE_TTL_MS) {\r\n return cachedDiscovery.doc;\r\n }\r\n\r\n try {\r\n const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`, {\r\n signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\r\n });\r\n if (!res.ok) return null;\r\n const doc = (await res.json()) as OidcDiscoveryDoc;\r\n cachedDiscovery = { baseUrl, doc, fetchedAt: now };\r\n return doc;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\nexport interface FetchJwksOptions {\r\n /**\r\n * 绕过内存缓存与浏览器 HTTP 缓存（cache: \"no-cache\"）强制重取 JWKS，\r\n * 并同步刷新模块级缓存。用于密钥轮换后 kid 失配的自愈重试。\r\n */\r\n forceRefresh?: boolean;\r\n}\r\n\r\n/** 从 SSO 中心拉取 JWKS（带内存缓存；优先 Discovery 的 jwks_uri，回退硬编码路径） */\r\nexport async function fetchJwks(baseUrl: string, options: FetchJwksOptions = {}): Promise<Jwks | null> {\r\n const now = Date.now();\r\n if (!options.forceRefresh && cachedJwks && cachedJwks.baseUrl === baseUrl && now - cachedJwks.fetchedAt < JWKS_CACHE_TTL_MS) {\r\n return cachedJwks.jwks;\r\n }\r\n\r\n const discovery = await fetchDiscoveryDoc(baseUrl);\r\n const jwksUri = discovery?.jwks_uri || `${baseUrl}/api/oauth/jwks`;\r\n\r\n try {\r\n const res = await fetch(jwksUri, {\r\n signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\r\n ...(options.forceRefresh ? { cache: \"no-cache\" as RequestCache } : {}),\r\n });\r\n if (!res.ok) return null;\r\n const jwks = (await res.json()) as Jwks;\r\n cachedJwks = { baseUrl, jwks, fetchedAt: now };\r\n return jwks;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 清空 JWKS / Discovery 内存缓存（测试与密钥轮换场景使用） */\r\nexport function clearIdTokenCaches(): void {\r\n cachedJwks = null;\r\n cachedDiscovery = null;\r\n}\r\n\r\n/** 使用 RS256 公钥验证 ID Token 签名 */\r\nexport async function verifyRs256Signature(token: string, jwk: JwksKey): Promise<boolean> {\r\n try {\r\n const [headerB64, payloadB64, signature] = token.split(\".\");\r\n if (!signature || !jwk.n || !jwk.e) return false;\r\n\r\n const c = getCrypto();\r\n if (!c) return false;\r\n\r\n const cryptoKey = await c.subtle.importKey(\r\n \"jwk\",\r\n { kty: \"RSA\", n: jwk.n, e: jwk.e, alg: \"RS256\", ext: false },\r\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\r\n false,\r\n [\"verify\"]\r\n );\r\n\r\n const signatureBytes = base64UrlDecode(signature);\r\n const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\r\n return await c.subtle.verify(\r\n \"RSASSA-PKCS1-v1_5\",\r\n cryptoKey,\r\n signatureBytes as unknown as BufferSource,\r\n data as unknown as BufferSource\r\n );\r\n } catch {\r\n return false;\r\n }\r\n}\r\n\r\n/** 计算 OIDC at_hash（access_token SHA-256 前 128bit base64url） */\r\nexport async function computeAtHash(accessToken: string): Promise<string> {\r\n const c = getCrypto();\r\n if (!c) return \"\";\r\n const hash = await c.subtle.digest(\"SHA-256\", new TextEncoder().encode(accessToken));\r\n const bytes = new Uint8Array(hash);\r\n const half = bytes.slice(0, bytes.length / 2);\r\n let binary = \"\";\r\n for (const b of half) {\r\n binary += String.fromCharCode(b);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/** 验证 ID Token（iss、aud、exp、iat、azp、sub、签名、at_hash） */\r\nexport async function validateIdToken(\r\n idToken: string,\r\n accessToken: string,\r\n expectedIssuer: string,\r\n expectedClientId: string,\r\n options: ValidateIdTokenOptions = {}\r\n): Promise<ValidateIdTokenResult> {\r\n const { rejectHs256WhenRs256Available = true, expectedNonce } = options;\r\n\r\n const header = decodeJwtHeader(idToken);\r\n if (!header) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token 格式错误\");\r\n }\r\n\r\n const alg = header.alg;\r\n if (typeof alg !== \"string\" || (alg !== \"RS256\" && alg !== \"HS256\")) {\r\n throw new SsoError(\"id_token_unsupported_alg\", `不支持的 ID Token 签名算法: ${alg}`);\r\n }\r\n\r\n const baseUrl = normalizeIssuer(expectedIssuer);\r\n // issuer 以 Discovery 文档的 issuer 为准（防伪站伪造 iss 通过校验），回退调用方传入值\r\n const discovery = await fetchDiscoveryDoc(baseUrl);\r\n const normalizedIssuer = normalizeIssuer(discovery?.issuer || baseUrl);\r\n\r\n // RS256：通过 JWKS 验证签名\r\n if (alg === \"RS256\") {\r\n const jwks = await fetchJwks(baseUrl);\r\n if (!jwks) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"无法获取 JWKS 验证 ID Token 签名\");\r\n }\r\n const kid = typeof header.kid === \"string\" ? header.kid : undefined;\r\n // 有 kid 时精确匹配；无 kid 时逐个尝试所有 RS256 签名公钥\r\n const matchCandidates = (set: Jwks) =>\r\n set.keys.filter(\r\n (k) =>\r\n k.kty === \"RSA\" &&\r\n k.alg === \"RS256\" &&\r\n k.use === \"sig\" &&\r\n (kid ? k.kid === kid : true)\r\n );\r\n const verifyAny = async (keys: JwksKey[]): Promise<boolean> => {\r\n for (const key of keys) {\r\n if (await verifyRs256Signature(idToken, key)) return true;\r\n }\r\n return false;\r\n };\r\n\r\n let candidates = matchCandidates(jwks);\r\n let validSig = candidates.length > 0 ? await verifyAny(candidates) : false;\r\n\r\n // 密钥轮换自愈：按 kid 过滤无候选，或所有候选验签失败时，\r\n // 可能是本地 JWKS 缓存陈旧 —— 强制重取一次 JWKS 后重试，仍失败才抛错\r\n if (candidates.length === 0 || !validSig) {\r\n const freshJwks = await fetchJwks(baseUrl, { forceRefresh: true });\r\n if (freshJwks) {\r\n candidates = matchCandidates(freshJwks);\r\n validSig = candidates.length > 0 ? await verifyAny(candidates) : false;\r\n }\r\n }\r\n\r\n if (candidates.length === 0) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"JWKS 中未找到匹配的 RS256 公钥\");\r\n }\r\n if (!validSig) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"ID Token 签名验证失败\");\r\n }\r\n }\r\n\r\n // HS256：对称密钥无法安全分发给 Public Client / BFF。\r\n // SDK 拒绝 HS256 ID Token：主站需配置 RS256 密钥对以启用安全验证。\r\n if (alg === \"HS256\") {\r\n if (rejectHs256WhenRs256Available) {\r\n const jwks = await fetchJwks(baseUrl);\r\n const hasRs256 = jwks?.keys?.some((k) => k.alg === \"RS256\" && k.use === \"sig\");\r\n if (hasRs256) {\r\n throw new SsoError(\"id_token_unsupported_alg\", \"SSO 中心已配置 RS256，拒绝 HS256 ID Token\");\r\n }\r\n }\r\n throw new SsoError(\r\n \"id_token_hs256_unsupported\",\r\n \"ID Token 使用 HS256 对称签名，SDK 无法安全验证。\" +\r\n \"请联系管理员在 SSO 主站配置 RS256 密钥对（JWT_ID_TOKEN_PRIVATE_KEY / JWT_ID_TOKEN_PUBLIC_KEY）后重新签发。\"\r\n );\r\n }\r\n\r\n const payload = decodeJwtPayload(idToken);\r\n if (!payload) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token payload 解析失败\");\r\n }\r\n\r\n const tokenIssuer = typeof payload.iss === \"string\" ? normalizeIssuer(payload.iss) : \"\";\r\n if (tokenIssuer !== normalizedIssuer) {\r\n throw new SsoError(\"id_token_issuer_mismatch\", \"ID Token issuer 不匹配\");\r\n }\r\n\r\n // aud 校验：单值或数组包含 clientId；多 aud 时按 OIDC Core §3.1.3.7 要求 azp 必须等于 clientId\r\n const aud = payload.aud;\r\n const audList = Array.isArray(aud) ? aud : typeof aud === \"string\" ? [aud] : [];\r\n if (!audList.includes(expectedClientId)) {\r\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token audience 不匹配\");\r\n }\r\n if (audList.length > 1 && payload.azp !== expectedClientId) {\r\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token 多 audience 时 azp 必须为当前 client\");\r\n }\r\n\r\n // exp 必需且不得过期（允许 60s clock skew，与 iat 校验对称）\r\n if (typeof payload.exp !== \"number\") {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token 缺少 exp 声明\");\r\n }\r\n if (Date.now() >= payload.exp * 1000 + 60_000) {\r\n throw new SsoError(\"id_token_expired\", \"ID Token 已过期\");\r\n }\r\n\r\n // iat 不得在未来（允许 60s clock skew）\r\n if (typeof payload.iat === \"number\" && payload.iat * 1000 > Date.now() + 60_000) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token iat 在未来，疑似伪造或时钟异常\");\r\n }\r\n\r\n if (typeof payload.sub !== \"string\" || !payload.sub) {\r\n throw new SsoError(\"id_token_missing_sub\", \"ID Token 缺少 sub\");\r\n }\r\n\r\n // 校验 at_hash：确保 ID Token 与当前 access_token 绑定（常量时间比较）\r\n if (typeof payload.at_hash === \"string\" && payload.at_hash) {\r\n const actual = await computeAtHash(accessToken);\r\n if (!timingSafeEqualString(actual, payload.at_hash)) {\r\n throw new SsoError(\"id_token_at_hash_mismatch\", \"ID Token at_hash 不匹配\");\r\n }\r\n }\r\n\r\n // 校验 nonce（OIDC Core §3.1.3.7）：调用方传入 expectedNonce 时 fail-closed，\r\n // ID Token 必须携带 nonce 且与登录时生成的值常量时间相等，防 ID Token 重放\r\n if (expectedNonce !== undefined) {\r\n const tokenNonce = typeof payload.nonce === \"string\" ? payload.nonce : \"\";\r\n if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {\r\n throw new SsoError(\"id_token_nonce_mismatch\", \"ID Token nonce 不匹配\");\r\n }\r\n }\r\n\r\n return { sub: payload.sub };\r\n}\r\n","/**\r\n * SSO Client 核心类\r\n *\r\n * 封装完整的 OAuth 2.0 授权码 + PKCE S256 流程：\r\n * - login(): 发起授权请求\r\n * - handleCallback(): 处理回调，交换 token\r\n * - refreshToken(): 刷新 access token（原子轮换）\r\n * - getUserInfo(): 获取用户信息\r\n * - logout(): 登出\r\n * - isAuthenticated(): 检查认证状态\r\n */\r\n\r\nimport { SsoError, mapOAuthErrorToSsoCode } from \"./errors\";\r\nimport {\r\n generateCodeVerifier,\r\n generateCodeChallenge,\r\n generateState,\r\n} from \"./pkce\";\r\nimport {\r\n saveTokenData,\r\n getTokenData,\r\n removeTokenData,\r\n savePkceVerifier,\r\n getPkceVerifier,\r\n removePkceVerifier,\r\n saveOAuthState,\r\n getOAuthState,\r\n removeOAuthState,\r\n saveOAuthNonce,\r\n getOAuthNonce,\r\n removeOAuthNonce,\r\n saveLogoutState,\r\n getLogoutState,\r\n removeLogoutState,\r\n saveReturnUrl,\r\n saveSilentProbe,\r\n getSilentProbe,\r\n removeSilentProbe,\r\n clearAllSsoData,\r\n type TokenData,\r\n} from \"./storage\";\r\nimport { validateIdToken } from \"./id-token\";\r\nimport { isTrustedReturnUrl, timingSafeEqualString } from \"./security\";\r\n\r\n// ============================================\r\n// 网络请求超时\r\n// ============================================\r\n\r\n/** token / userinfo 请求默认超时（毫秒）：避免回调页/登录流程无限挂起 */\r\nconst REQUEST_TIMEOUT_MS = 10_000;\r\n/** revoke 为 best-effort，短超时避免登出等待过久 */\r\nconst REVOKE_TIMEOUT_MS = 3_000;\r\n\r\n/** 带超时的 fetch（AbortController）；超时抛 AbortError（调用方按网络错误处理） */\r\nasync function fetchWithTimeout(\r\n input: RequestInfo | URL,\r\n init: RequestInit = {},\r\n timeoutMs: number = REQUEST_TIMEOUT_MS\r\n): Promise<Response> {\r\n const controller = new AbortController();\r\n const timer = setTimeout(() => controller.abort(), timeoutMs);\r\n try {\r\n return await fetch(input, { ...init, signal: controller.signal });\r\n } finally {\r\n clearTimeout(timer);\r\n }\r\n}\r\n\r\n// ============================================\r\n// 类型定义\r\n// ============================================\r\n\r\n/**\r\n * Token 响应基本字段的防御性校验（fail-closed）。\r\n *\r\n * - access_token 必须为非空字符串；\r\n * - expires_in 必须为有限正数——否则 expires_at = NaN，本地会永久判定过期\r\n * （每次 getAccessToken/getUserInfo 都触发刷新），且刷新后仍写回 NaN；\r\n * - requireRefreshToken=true 时 refresh_token 必须为非空字符串：\r\n * 主站 authorization_code 交换必然签发 refresh_token（refresh 场景按\r\n * RFC 6749 §6 允许省略，调用方已做沿用旧值的回退），缺失即响应异常。\r\n */\r\nfunction assertValidTokenResponse(\r\n data: TokenResponse,\r\n requireRefreshToken: boolean\r\n): void {\r\n if (typeof data.access_token !== \"string\" || !data.access_token) {\r\n throw new SsoError(\"token_request_failed\", \"Token 响应缺少 access_token\");\r\n }\r\n if (\r\n typeof data.expires_in !== \"number\" ||\r\n !Number.isFinite(data.expires_in) ||\r\n data.expires_in <= 0\r\n ) {\r\n throw new SsoError(\r\n \"token_request_failed\",\r\n `Token 响应 expires_in 非法: ${String(data.expires_in)}`\r\n );\r\n }\r\n if (\r\n requireRefreshToken &&\r\n (typeof data.refresh_token !== \"string\" || !data.refresh_token)\r\n ) {\r\n throw new SsoError(\r\n \"token_request_failed\",\r\n \"Token 响应缺少 refresh_token（authorization_code 交换必须返回）\"\r\n );\r\n }\r\n}\r\n\r\n/** SSO 客户端配置 */\r\nexport interface SsoClientConfig {\r\n /** OAuth Client ID（从管理后台获取） */\r\n clientId: string;\r\n\r\n /** OAuth Client Secret（从管理后台获取）\r\n *\r\n * ⚠️ 安全提醒：client_secret 不应暴露在前端代码中。\r\n * 对于浏览器端 SPA（Public Client），应省略此字段；SDK 会使用 PKCE 完成授权，\r\n * 且 token 端点不会发送 client_secret。\r\n * 对于 BFF/Next.js 等 Confidential Client，可传入 client_secret。\r\n */\r\n clientSecret?: string;\r\n\r\n /** 回调 URL（必须与注册的 redirect_uri 完全一致） */\r\n redirectUri: string;\r\n\r\n /** SSO 中心地址，如 \"https://nihplod.cn\" */\r\n ssoBaseUrl: string;\r\n\r\n /** 请求的 scope（空格分隔），如 \"openid profile phone\" */\r\n scopes?: string;\r\n\r\n /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */\r\n postLogoutRedirectUri?: string;\r\n\r\n /**\r\n * 调试日志开关（默认 false）。开启后输出登录/回调/刷新/登出等关键流程日志，\r\n * 便于接入方定位问题（生产默认关闭，避免日志噪音）。\r\n */\r\n debug?: boolean;\r\n\r\n /**\r\n * 服务端到服务端调用的内网地址（可选，如 http://127.0.0.1:3000）。\r\n * 仅用于 discovery / token / userinfo / revocation 等服务器间请求；\r\n * 浏览器跳转（authorize、end-session）始终使用 ssoBaseUrl 公网地址。\r\n * 仅在 BFF/服务端场景配置；浏览器端（Public Client）不要配置。\r\n */\r\n serverBaseUrl?: string;\r\n}\r\n\r\n/** 用户信息 */\r\nexport interface SsoUser {\r\n sub: string;\r\n nickname?: string;\r\n avatar?: string;\r\n /** 手机号（脱敏，兼容保留的非标准 claim，新代码请使用 phone_number） */\r\n phone?: string;\r\n /** 手机号（脱敏，OIDC 标准 claim，与 phone 内容一致） */\r\n phone_number?: string;\r\n /** 生日（ISO 8601，需 birthday scope，未设置时为 null） */\r\n birthday?: string | null;\r\n membership_level?: string;\r\n /** 累计消费金额（单位：元，需 membership scope，与 membership_level 同源下发） */\r\n total_spent?: number;\r\n total_points?: number;\r\n}\r\n\r\n/** login() / getLoginUrl() 选项 */\r\nexport interface LoginOptions {\r\n /**\r\n * OIDC prompt 参数：\r\n * - \"none\"：静默探测 SSO 会话。用户在 IdP 有会话时直接回跳完成登录；\r\n * 无会话时 IdP 回跳 error=login_required（或 consent_required /\r\n * interaction_required），handleCallback() 识别后返回 null 而不抛错\r\n * （CallbackPage 默认跳回 returnUrl 并附 sso_probe=no_session）。\r\n * ⚠️ 不要在页面加载时自动探测（会打扰无会话用户并消耗请求），\r\n * 应由用户点击等明确动作触发。\r\n * - \"login\"：强制重新认证；\r\n * - \"consent\"：强制重新授权确认。\r\n */\r\n prompt?: \"none\" | \"login\" | \"consent\";\r\n}\r\n\r\n/** prompt=none 静默探测失败时 IdP 回跳的 error 值（OIDC Core §3.1.2.6） */\r\nconst SILENT_PROBE_ERRORS = new Set([\r\n \"login_required\",\r\n \"consent_required\",\r\n \"interaction_required\",\r\n]);\r\n\r\n/** Token 响应 */\r\nexport interface TokenResponse {\r\n access_token: string;\r\n token_type: string;\r\n expires_in: number;\r\n /**\r\n * authorization_code 交换主站必然返回（缺失时 handleCallback 抛\r\n * token_request_failed）；refresh 响应按 RFC 6749 §6 可省略，\r\n * 此时 SDK 沿用旧 refresh_token。\r\n */\r\n refresh_token: string;\r\n id_token?: string;\r\n}\r\n\r\n/** OIDC Discovery 文档 */\r\nexport interface OidcDiscovery {\r\n issuer: string;\r\n authorization_endpoint: string;\r\n token_endpoint: string;\r\n userinfo_endpoint: string;\r\n jwks_uri: string;\r\n introspection_endpoint: string;\r\n revocation_endpoint?: string;\r\n end_session_endpoint?: string;\r\n scopes_supported: string[];\r\n response_types_supported: string[];\r\n grant_types_supported: string[];\r\n code_challenge_methods_supported: string[];\r\n}\r\n\r\n// ============================================\r\n// SsoClient\r\n// ============================================\r\n\r\nexport class SsoClient {\r\n public readonly config: SsoClientConfig;\r\n /** 服务器间调用的基准地址（未配置 serverBaseUrl 时等于 ssoBaseUrl） */\r\n private readonly _serverBase: string;\r\n private _discovery: OidcDiscovery | null = null;\r\n private _discoveryFetchedAt: number = 0;\r\n private _refreshLock: Promise<TokenData> | null = null;\r\n\r\n /** Discovery 文档缓存 TTL（5 分钟） */\r\n private static readonly DISCOVERY_TTL_MS = 5 * 60 * 1000;\r\n\r\n /** Discovery fetch 超时（10 秒） */\r\n private static readonly DISCOVERY_TIMEOUT_MS = 10000;\r\n\r\n constructor(config: SsoClientConfig) {\r\n if (!config.clientId) throw new SsoError(\"invalid_config\", \"clientId 不能为空\");\r\n if (!config.redirectUri) throw new SsoError(\"invalid_config\", \"redirectUri 不能为空\");\r\n if (!config.ssoBaseUrl) throw new SsoError(\"invalid_config\", \"ssoBaseUrl 不能为空\");\r\n\r\n // 规范化 ssoBaseUrl：移除末尾斜杠\r\n const base = config.ssoBaseUrl.replace(/\\/+$/, \"\");\r\n this.config = { ...config, ssoBaseUrl: base };\r\n this._serverBase = (config.serverBaseUrl ?? base).replace(/\\/+$/, \"\");\r\n }\r\n\r\n // ============================================\r\n // 调试日志\r\n // ============================================\r\n\r\n /**\r\n * 调试日志（config.debug=true 时输出，前缀 [SSO SDK]）：\r\n * 覆盖登录发起 / 回调结果 / 刷新失败 / 登出等关键节点，便于接入方定位问题。\r\n * 不会输出 token/授权码等敏感值。\r\n */\r\n debugLog(...args: unknown[]): void {\r\n if (this.config.debug) {\r\n console.warn(\"[SSO SDK]\", ...args);\r\n }\r\n }\r\n\r\n // ============================================\r\n // 内部方法\r\n // ============================================\r\n\r\n /**\r\n * 获取 OIDC Discovery 文档（带缓存 + 超时）\r\n *\r\n * 缓存 5 分钟，超时 10 秒。\r\n * 失败时返回 null（上层调用方回退到硬编码默认端点）。\r\n */\r\n private async _getDiscovery(): Promise<OidcDiscovery | null> {\r\n const now = Date.now();\r\n\r\n // 命中缓存且未过期\r\n if (\r\n this._discovery &&\r\n now - this._discoveryFetchedAt < SsoClient.DISCOVERY_TTL_MS\r\n ) {\r\n return this._discovery;\r\n }\r\n\r\n // discovery 是服务器间调用：配置了 serverBaseUrl 时经内网拉取\r\n // （文档内容由 SSO 中心按公网 origin 生成，与拉取通道无关）\r\n const url = `${this._serverBase}/api/oauth/.well-known/openid-configuration`;\r\n\r\n try {\r\n const controller = new AbortController();\r\n const timeoutId = setTimeout(\r\n () => controller.abort(),\r\n SsoClient.DISCOVERY_TIMEOUT_MS\r\n );\r\n\r\n const res = await fetch(url, { signal: controller.signal });\r\n clearTimeout(timeoutId);\r\n\r\n if (!res.ok) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求失败: HTTP ${res.status}, 回退到默认端点`\r\n );\r\n return null;\r\n }\r\n\r\n this._discovery = (await res.json()) as OidcDiscovery;\r\n this._discoveryFetchedAt = now;\r\n return this._discovery;\r\n } catch (err) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求异常: ${err instanceof Error ? err.message : String(err)}, 回退到默认端点`\r\n );\r\n // 不清空已有缓存（即使过期也优于无数据）\r\n return this._discovery || null;\r\n }\r\n }\r\n\r\n /** 获取 authorize 端点 URL（优先 Discovery，回退默认） */\r\n private async _getAuthorizeEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.authorization_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/authorize`;\r\n }\r\n\r\n /** 获取 token 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */\r\n private async _getTokenEndpoint(): Promise<string> {\r\n if (this.config.serverBaseUrl) return `${this._serverBase}/api/oauth/token`;\r\n const d = await this._getDiscovery();\r\n if (d) return d.token_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/token`;\r\n }\r\n\r\n /** 获取 userinfo 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */\r\n private async _getUserinfoEndpoint(): Promise<string> {\r\n if (this.config.serverBaseUrl) return `${this._serverBase}/api/oauth/userinfo`;\r\n const d = await this._getDiscovery();\r\n if (d) return d.userinfo_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/userinfo`;\r\n }\r\n\r\n /**\r\n * 开放重定向防护：仅保存相对路径或与当前页面同源的 returnUrl，\r\n * 其余（如 https://evil.com）忽略并告警，防止回调后跳转到钓鱼站点。\r\n */\r\n private _saveReturnUrlIfTrusted(returnUrl: string): void {\r\n if (isTrustedReturnUrl(returnUrl, window.location.origin)) {\r\n // 按 clientId 隔离存储，与 CallbackPage 读取的 key 对应\r\n saveReturnUrl(returnUrl, this.config.clientId);\r\n } else {\r\n console.warn(`[SSO SDK] returnUrl 未通过同源校验，已忽略: ${returnUrl}`);\r\n }\r\n }\r\n\r\n // ============================================\r\n // 公共 API\r\n // ============================================\r\n\r\n /**\r\n * 发起 SSO 登录\r\n *\r\n * 生成 PKCE code_verifier/code_challenge 和 state 参数，\r\n * 构建 authorize URL，通过 302 跳转到 SSO 登录页。\r\n *\r\n * @param returnUrl - 登录成功后的返回地址（可选，保存到 sessionStorage；\r\n * 仅允许相对路径或同源绝对 URL，否则忽略并告警）\r\n * @param options.prompt - OIDC prompt 参数。传 \"none\" 为静默探测：\r\n * 额外在存储中记录探测标记（该次请求的 state），回调无会话时\r\n * handleCallback() 返回 null 而不抛错。\r\n *\r\n * ⚠️ 不要与 getLoginUrl() 混用：两者都会重新生成并覆盖 sessionStorage 中的\r\n * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。\r\n * 同一次登录只使用其中一个入口。\r\n */\r\n async login(returnUrl?: string, options: LoginOptions = {}): Promise<void> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n // OIDC nonce（256-bit 随机）：绑定 ID Token 到本次登录会话，防重放\r\n const nonce = generateState();\r\n\r\n // 保存 PKCE verifier、state 和 nonce 到 sessionStorage（整页重定向后仍可读取）\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n saveOAuthNonce(nonce, this.config.clientId);\r\n // 静默探测标记：存该次请求的 state，回调凭它识别\"探测无会话\"\r\n if (options.prompt === \"none\") {\r\n saveSilentProbe(state, this.config.clientId);\r\n } else {\r\n removeSilentProbe(this.config.clientId);\r\n }\r\n\r\n if (returnUrl) {\r\n this._saveReturnUrlIfTrusted(returnUrl);\r\n }\r\n\r\n // 构建 authorize URL\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"nonce\", nonce);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n if (options.prompt) {\r\n params.set(\"prompt\", options.prompt);\r\n }\r\n\r\n // 跳转\r\n window.location.href = `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /**\r\n * 构建登录 URL（不跳转，返回 URL 字符串）\r\n *\r\n * 适用于需要手动处理跳转的场景。\r\n *\r\n * ⚠️ 不要与 login() 混用：两者都会重新生成并覆盖 sessionStorage 中的\r\n * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。\r\n * 同一次登录只使用其中一个入口。\r\n */\r\n async getLoginUrl(returnUrl?: string, options: LoginOptions = {}): Promise<string> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n // OIDC nonce（与 state 同等强度的随机值），回调时校验 ID Token 的 nonce claim\r\n const nonce = generateState();\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n saveOAuthNonce(nonce, this.config.clientId);\r\n // 静默探测标记（与 login() 一致）：prompt=none 时记录该次请求的 state\r\n if (options.prompt === \"none\") {\r\n saveSilentProbe(state, this.config.clientId);\r\n } else {\r\n removeSilentProbe(this.config.clientId);\r\n }\r\n // returnUrl 按 clientId 隔离，与 login() / CallbackPage 保持一致\r\n if (returnUrl) this._saveReturnUrlIfTrusted(returnUrl);\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"nonce\", nonce);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n if (options.prompt) {\r\n params.set(\"prompt\", options.prompt);\r\n }\r\n\r\n return `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /**\r\n * 弹窗模式 SSO 登录\r\n *\r\n * 打开一个小窗口进行登录，认证完成后窗口自动关闭，\r\n * 主页面不丢失状态（适用于 SPA 中需要保持表单/浏览上下文的场景）。\r\n *\r\n * 流程：\r\n * 1. window.open() 打开授权 URL 到弹窗\r\n * 2. 用户在弹窗中完成登录\r\n * 3. 弹窗加载 CallbackPage 时检测到 window.opener，通过 postMessage 回传回调 URL\r\n * 4. 主页面收到消息后调用 handleCallback() 交换 token\r\n * 5. 弹窗自动关闭\r\n *\r\n * @param options - 弹窗配置\r\n * @param options.returnUrl - 登录成功后的返回地址\r\n * @param options.width - 弹窗宽度（默认 480）\r\n * @param options.height - 弹窗高度（默认 640）\r\n * @returns TokenData\r\n *\r\n * @example\r\n * ```typescript\r\n * const client = new SsoClient({ clientId: \"xxx\", redirectUri: \"https://myapp.com/callback\", ssoBaseUrl: \"https://nihplod.cn\" });\r\n * try {\r\n * const tokenData = await client.loginPopup({ returnUrl: \"/dashboard\" });\r\n * console.log(\"登录成功\", tokenData);\r\n * } catch (err) {\r\n * if (err instanceof SsoError && err.code === \"popup_blocked\") {\r\n * // 弹窗被拦截，回退到同页重定向\r\n * await client.login(\"/dashboard\");\r\n * }\r\n * }\r\n * ```\r\n */\r\n async loginPopup(\r\n options: { returnUrl?: string; width?: number; height?: number } = {}\r\n ): Promise<TokenData> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n const nonce = generateState(); // OIDC nonce：回调时校验 ID Token 的 nonce claim\r\n const popupNonce = generateState(); // 独立的 nonce 用于 postMessage 来源验证\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n saveOAuthNonce(nonce, this.config.clientId);\r\n // 保存 popup nonce 到 sessionStorage，用于 postMessage 校验\r\n savePkceVerifier(`${this.config.clientId}_popup_nonce`, popupNonce);\r\n\r\n if (options.returnUrl) {\r\n this._saveReturnUrlIfTrusted(options.returnUrl);\r\n }\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"nonce\", nonce);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n // 弹窗 nonce：回调页通过 postMessage 回传，主窗口校验防伪造\r\n params.set(\"popup_nonce\", popupNonce);\r\n\r\n const width = options.width || 480;\r\n const height = options.height || 640;\r\n const left = Math.max(0, (window.screen.width - width) / 2);\r\n const top = Math.max(0, (window.screen.height - height) / 2);\r\n\r\n const popupFeatures = [\r\n `width=${width}`,\r\n `height=${height}`,\r\n `left=${Math.round(left)}`,\r\n `top=${Math.round(top)}`,\r\n \"resizable=yes\",\r\n \"scrollbars=yes\",\r\n \"status=yes\",\r\n ].join(\",\");\r\n\r\n const popup = window.open(\r\n `${authorizeEndpoint}?${params.toString()}`,\r\n \"nihplod_sso_popup\",\r\n popupFeatures\r\n );\r\n\r\n if (!popup) {\r\n removePkceVerifier(this.config.clientId);\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n throw new SsoError(\r\n \"popup_blocked\",\r\n \"弹窗被浏览器拦截，请允许弹窗后重试\"\r\n );\r\n }\r\n\r\n // 计算 redirect_uri 的 origin，用于 postMessage 来源校验\r\n const redirectUriOrigin = new URL(this.config.redirectUri).origin;\r\n\r\n try {\r\n // 聚焦弹窗\r\n popup.focus();\r\n\r\n return await new Promise<TokenData>((resolve, reject) => {\r\n let completed = false;\r\n\r\n const handleMessage = (event: MessageEvent) => {\r\n if (completed) return;\r\n // 校验消息来源：必须来自 redirect_uri 对应的子项目 origin（回调页运行位置）\r\n if (event.origin !== redirectUriOrigin) return;\r\n if (!event.data || event.data.type !== \"nihplod_sso_popup_callback\") return;\r\n if (!event.data.callbackUrl) return;\r\n\r\n // 校验 popup nonce：防止伪造的 postMessage（fail-closed：本地 nonce 缺失同样拒绝）\r\n const savedNonce = getPkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n if (!savedNonce || !timingSafeEqualString(event.data.nonce ?? \"\", savedNonce)) return;\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n\r\n // 回 ACK：回调页会每 500ms 重发直到收到 ACK（或超时提示手动关闭），\r\n // 防止主窗口监听未挂载时消息丢失导致弹窗悬挂\r\n try {\r\n (event.source as Window | null)?.postMessage(\r\n { type: \"nihplod_sso_popup_ack\", nonce: savedNonce },\r\n event.origin\r\n );\r\n } catch {\r\n // ACK 失败不影响主流程（弹窗会超时提示手动关闭）\r\n }\r\n\r\n completed = true;\r\n cleanup();\r\n\r\n if (popup && !popup.closed) {\r\n popup.close();\r\n }\r\n\r\n this.handleCallback(event.data.callbackUrl)\r\n .then((tokenData) => {\r\n // prompt=none 静默探测在弹窗模式不支持（loginPopup 不带 prompt），\r\n // null 结果视为探测无会话\r\n if (tokenData === null) {\r\n reject(\r\n new SsoError(\"not_authenticated\", \"SSO 会话不存在（静默探测无会话）\")\r\n );\r\n return;\r\n }\r\n resolve(tokenData);\r\n })\r\n .catch(reject);\r\n };\r\n\r\n const pollTimer = setInterval(() => {\r\n if (popup.closed) {\r\n if (!completed) {\r\n completed = true;\r\n cleanup();\r\n reject(\r\n new SsoError(\r\n \"popup_closed\",\r\n \"登录窗口已关闭\"\r\n )\r\n );\r\n }\r\n }\r\n }, 500);\r\n\r\n const cleanup = () => {\r\n clearInterval(pollTimer);\r\n window.removeEventListener(\"message\", handleMessage);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n };\r\n\r\n window.addEventListener(\"message\", handleMessage);\r\n });\r\n } catch (err) {\r\n removePkceVerifier(this.config.clientId);\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n throw err;\r\n }\r\n }\r\n\r\n /**\r\n * 处理 OAuth 回调\r\n *\r\n * 解析回调 URL，校验 state 参数，用授权码交换 token。\r\n * 成功后 token 自动保存到 token 存储（默认 sessionStorage，可通过 setTokenStorage 定制）。\r\n *\r\n * @param callbackUrl - 完整的回调 URL（window.location.href）\r\n * @returns TokenData；prompt=none 静默探测且无 SSO 会话时返回 null\r\n * （IdP 回跳 login_required / consent_required / interaction_required\r\n * 且回调 state 与探测标记匹配），此时临时数据已清理，调用方按\"未登录\"处理即可\r\n */\r\n async handleCallback(\r\n callbackUrl: string\r\n ): Promise<TokenData | null> {\r\n const url = new URL(callbackUrl);\r\n const params = url.searchParams;\r\n\r\n // 检查错误（SSO 中心按 OAuth 2.0 规范回传 error 参数）\r\n const error = params.get(\"error\");\r\n if (error) {\r\n // 静默探测（prompt=none）无会话：IdP 以 error 回跳属预期结果而非异常。\r\n // 要求回调 state 与登录 state、探测标记三者一致（常量时间比较），\r\n // 防止伪造的 error 回调被当作探测结果\r\n const returnedErrorState = params.get(\"state\");\r\n const probeState = getSilentProbe(this.config.clientId);\r\n const savedStateForProbe = getOAuthState(this.config.clientId);\r\n if (\r\n SILENT_PROBE_ERRORS.has(error) &&\r\n probeState &&\r\n savedStateForProbe &&\r\n timingSafeEqualString(savedStateForProbe, returnedErrorState ?? \"\") &&\r\n timingSafeEqualString(probeState, returnedErrorState ?? \"\")\r\n ) {\r\n // 清除本次探测的全部临时数据（state/nonce/verifier/标记），返回 null\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n return null;\r\n }\r\n // 授权已失败，本次流程的临时数据（state/verifier/nonce/探测标记）不再有用，一并清理避免残留\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n const desc = params.get(\"error_description\") || error;\r\n throw new SsoError(mapOAuthErrorToSsoCode(error), `授权失败: ${desc}`);\r\n }\r\n\r\n const code = params.get(\"code\");\r\n const returnedState = params.get(\"state\");\r\n\r\n if (!code) {\r\n // 缺 code 的回调无法继续，清理临时数据避免残留\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n throw new SsoError(\"token_request_failed\", \"回调 URL 中缺少 authorization code\");\r\n }\r\n\r\n // 校验 state 参数（CSRF 防护，常量时间比较）\r\n const savedState = getOAuthState(this.config.clientId);\r\n if (!savedState || !timingSafeEqualString(savedState, returnedState ?? \"\")) {\r\n // state 不匹配：state 与 verifier 一并清除，避免残留半套临时数据\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n throw new SsoError(\r\n \"state_mismatch\",\r\n \"State 参数不匹配，可能存在 CSRF 攻击\"\r\n );\r\n }\r\n\r\n // state 校验通过：读取登录时保存的 OIDC nonce（validateIdToken 时 fail-closed 校验，\r\n // 成功后才随 state/verifier 一并清除——验签失败重试仍需它）\r\n const expectedNonce = getOAuthNonce(this.config.clientId) ?? undefined;\r\n\r\n // 获取 code_verifier\r\n const verifier = getPkceVerifier(this.config.clientId);\r\n if (!verifier) {\r\n throw new SsoError(\r\n \"pkce_required\",\r\n \"code_verifier 不存在（可能已过期或来自其他标签页）\"\r\n );\r\n }\r\n\r\n // 交换 token\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"authorization_code\");\r\n body.set(\"code\", code);\r\n body.set(\"code_verifier\", verifier);\r\n body.set(\"client_id\", this.config.clientId);\r\n body.set(\"redirect_uri\", this.config.redirectUri);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response;\r\n try {\r\n res = await fetchWithTimeout(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { /* ignore */ }\r\n const serverError = (errData.error as string) || \"\";\r\n throw new SsoError(\r\n mapOAuthErrorToSsoCode(serverError),\r\n (errData.error_description as string) || `Token 请求失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n // 先解析响应体，成功后再清除 state 和 verifier：\r\n // 若 JSON 畸形导致解析抛错，保留 state/verifier 允许用户重试回调\r\n const data: TokenResponse = await res.json();\r\n\r\n // 防御性校验：refresh_token 缺失或 expires_in 非法时 fail-closed 抛错，\r\n // 不保存半截 token 数据（authorization_code 交换主站必然签发 refresh_token）\r\n assertValidTokenResponse(data, true);\r\n\r\n // OIDC：请求 scope 含 openid 时，token 响应必须包含 id_token。\r\n // 缺失时 nonce/at_hash/签名均无从校验，直接 fail-closed 拒绝而不是静默降级。\r\n const requestedScopes = (this.config.scopes || \"openid profile\").split(\" \").filter(Boolean);\r\n if (requestedScopes.includes(\"openid\") && !data.id_token) {\r\n removeTokenData(this.config.clientId);\r\n throw new SsoError(\r\n \"id_token_invalid\",\r\n \"Token 响应缺少 id_token（scope 含 openid 时必需）\"\r\n );\r\n }\r\n\r\n // OIDC：验证 ID Token 签名、基本声明及 at_hash\r\n if (data.id_token) {\r\n try {\r\n await validateIdToken(\r\n data.id_token,\r\n data.access_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId,\r\n { expectedNonce }\r\n );\r\n } catch (err) {\r\n // 验证失败：不保存任何 token，防止伪造 ID Token\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n // 全部校验通过后清除 state、nonce 和 verifier（一次性临时数据）。\r\n // 推迟到验签之后：若 JWKS 暂时不可达导致验签失败，\r\n // 保留 state/verifier/nonce，用户刷新回调页即可重试\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n refresh_token: data.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in * 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n this.debugLog(\"handleCallback: token 交换成功\", { clientId: this.config.clientId });\r\n return tokenData;\r\n }\r\n\r\n /**\r\n * 刷新 Access Token\r\n *\r\n * 使用 refresh_token 换取新的 access_token。\r\n * 采用互斥锁防止并发刷新。\r\n * 支持 Refresh Token 原子轮换。\r\n */\r\n async refreshToken(): Promise<TokenData> {\r\n // 互斥锁：避免并发刷新\r\n if (this._refreshLock) return this._refreshLock;\r\n\r\n this._refreshLock = this._doRefreshToken();\r\n try {\r\n return await this._refreshLock;\r\n } finally {\r\n this._refreshLock = null;\r\n }\r\n }\r\n\r\n private async _doRefreshToken(): Promise<TokenData> {\r\n const current = getTokenData(this.config.clientId);\r\n if (!current?.refresh_token) {\r\n throw new SsoError(\"no_refresh_token\", \"没有可用的 refresh_token\");\r\n }\r\n\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"refresh_token\");\r\n body.set(\"refresh_token\", current.refresh_token);\r\n body.set(\"client_id\", this.config.clientId);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response | null = null;\r\n let lastErr: unknown;\r\n for (let attempt = 0; attempt < 2; attempt++) {\r\n try {\r\n res = await fetchWithTimeout(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n lastErr = null;\r\n break;\r\n } catch (err) {\r\n lastErr = err;\r\n if (attempt < 1) await new Promise((r) => setTimeout(r, 1000));\r\n }\r\n }\r\n if (lastErr || !res) {\r\n throw new SsoError(\"network_error\", \"刷新 Token 网络请求失败\", lastErr);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { /* ignore */ }\r\n const errorCode = (errData.error as string) || \"\";\r\n // 仅明确的 invalid_grant（refresh_token 已被撤销/过期）才清除本地登录态；\r\n // 网关/WAF 返回的 401（响应体无 OAuth error 字段）保留 token 按可重试处理，\r\n // 避免一次网络抖动把用户静默登出（重试上限由上层 SsoProvider 计数控制）\r\n if (errorCode === \"invalid_grant\") {\r\n removeTokenData(this.config.clientId);\r\n }\r\n this.debugLog(\"refreshToken: 刷新失败\", { status: res.status, error: errorCode });\r\n if (!errorCode && res.status === 401) {\r\n throw new SsoError(\"sso_server_error\", \"刷新 Token 失败（网关异常），请稍后重试\");\r\n }\r\n throw new SsoError(\r\n mapOAuthErrorToSsoCode(errorCode, \"refresh\"),\r\n (errData.error_description as string) || `刷新 Token 失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n const data: TokenResponse = await res.json();\r\n\r\n // 防御性校验：refresh 响应可省略 refresh_token（沿用旧值），\r\n // 但 access_token / expires_in 必须合法，否则 expires_at 为 NaN 永久判过期\r\n assertValidTokenResponse(data, false);\r\n\r\n if (data.id_token) {\r\n try {\r\n await validateIdToken(\r\n data.id_token,\r\n data.access_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId\r\n );\r\n } catch (err) {\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n // RFC 6749 §6：刷新响应可省略 refresh_token，此时沿用旧值\r\n refresh_token: data.refresh_token || current.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in * 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /**\r\n * 获取用户信息\r\n *\r\n * 若 access_token 已过期则自动刷新后再请求。\r\n */\r\n async getUserInfo(): Promise<SsoUser> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n\r\n if (!tokenData) {\r\n throw new SsoError(\"not_authenticated\", \"未登录\");\r\n }\r\n\r\n // 若已过期，先刷新\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n const userinfoEndpoint = await this._getUserinfoEndpoint();\r\n\r\n let res: Response;\r\n try {\r\n res = await fetchWithTimeout(userinfoEndpoint, {\r\n headers: {\r\n Authorization: `Bearer ${tokenData.access_token}`,\r\n },\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"获取用户信息网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n if (res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n throw new SsoError(\"not_authenticated\", \"Token 已失效\");\r\n }\r\n throw new SsoError(\r\n \"userinfo_failed\",\r\n `获取用户信息失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n return (await res.json()) as SsoUser;\r\n }\r\n\r\n /**\r\n * 获取当前 access_token\r\n *\r\n * 若已过期则自动刷新。用于子项目自行发起 API 请求时获取 Bearer token。\r\n * 若无 token 返回 null；若刷新失败则抛出错误（与 getUserInfo 行为一致）。\r\n */\r\n async getAccessToken(): Promise<string | null> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return null;\r\n\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n return tokenData.access_token;\r\n }\r\n\r\n /**\r\n * 检查是否已认证（不发起网络请求）\r\n *\r\n * 仅检查本地是否存在未过期的 access_token。\r\n */\r\n isAuthenticated(): boolean {\r\n const tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return false;\r\n return Date.now() < tokenData.expires_at;\r\n }\r\n\r\n /**\r\n * 登出\r\n *\r\n * 清除本地所有 token 和临时数据，并尝试撤销服务端 refresh_token。\r\n * @param redirectToSso - 是否重定向到 SSO 登出页（默认 false）。\r\n * 为 true 时携带 state 参数（已保存到 sessionStorage），\r\n * 回跳页面应调用 validateLogoutState() 校验防登出 CSRF。\r\n */\r\n async logout(redirectToSso: boolean = false): Promise<void> {\r\n // 获取 refresh_token 用于服务端撤销（需在 clearAllSsoData 之前）\r\n const tokenData = getTokenData(this.config.clientId);\r\n const refreshToken = tokenData?.refresh_token;\r\n const idTokenHint = tokenData?.id_token;\r\n\r\n clearAllSsoData(this.config.clientId);\r\n this.debugLog(\"logout: 本地数据已清除\", {\r\n clientId: this.config.clientId,\r\n redirectToSso,\r\n });\r\n\r\n // 尝试调用服务端 token revocation 端点（best-effort）\r\n // 仅 Confidential Client 携带 client_secret；Public Client 不传 secret。\r\n if (refreshToken && this.config.clientId) {\r\n try {\r\n // serverBaseUrl 配置时直连内网默认端点（discovery 文档内是公网 URL，\r\n // 会绕行公网）；否则用 Discovery，兜底公网默认路径\r\n const discovery = this.config.serverBaseUrl ? null : await this._getDiscovery();\r\n const revokeUrl = this.config.serverBaseUrl\r\n ? `${this._serverBase}/api/oauth/revoke`\r\n : discovery?.revocation_endpoint ||\r\n `${this.config.ssoBaseUrl}/api/oauth/revoke`;\r\n const revokeBody = new URLSearchParams({\r\n token: refreshToken,\r\n token_type_hint: \"refresh_token\",\r\n client_id: this.config.clientId,\r\n });\r\n if (this.config.clientSecret) {\r\n revokeBody.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n await fetchWithTimeout(\r\n revokeUrl,\r\n {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: revokeBody.toString(),\r\n },\r\n REVOKE_TIMEOUT_MS\r\n );\r\n } catch {\r\n // 撤销失败不影响本地登出（best-effort）\r\n }\r\n }\r\n\r\n if (redirectToSso) {\r\n // OIDC RP-Initiated Logout：携带 client_id / post_logout_redirect_uri / id_token_hint / state\r\n const discovery = await this._getDiscovery();\r\n const endSessionEndpoint =\r\n discovery?.end_session_endpoint || `${this.config.ssoBaseUrl}/api/oauth/end-session`;\r\n const logoutUrl = new URL(endSessionEndpoint);\r\n logoutUrl.searchParams.set(\"client_id\", this.config.clientId);\r\n const postLogoutUri = this.config.postLogoutRedirectUri || this.config.redirectUri;\r\n if (postLogoutUri) {\r\n logoutUrl.searchParams.set(\r\n \"post_logout_redirect_uri\",\r\n postLogoutUri\r\n );\r\n }\r\n if (idTokenHint) {\r\n logoutUrl.searchParams.set(\"id_token_hint\", idTokenHint);\r\n }\r\n // 携带 state 防登出 CSRF：回跳时用 validateLogoutState() 校验\r\n const state = generateState();\r\n saveLogoutState(state, this.config.clientId);\r\n logoutUrl.searchParams.set(\"state\", state);\r\n window.location.href = logoutUrl.toString();\r\n }\r\n }\r\n\r\n /**\r\n * 校验 RP-Initiated Logout 回跳的 state 参数（登出 CSRF 防护）\r\n *\r\n * 在 post_logout_redirect_uri 指向的页面加载时调用；\r\n * 仅在 URL 携带 state 且与 logout(redirectToSso=true) 保存的值一致时返回 true，\r\n * 校验后清除已保存的 logout state（一次性）。\r\n *\r\n * @param url - 当前页面完整 URL（window.location.href）\r\n *\r\n * @example\r\n * ```typescript\r\n * if (sso.validateLogoutState(window.location.href)) {\r\n * // 来自 SSO 登出的可信回跳\r\n * }\r\n * ```\r\n */\r\n validateLogoutState(url: string): boolean {\r\n const returnedState = new URL(url).searchParams.get(\"state\");\r\n if (!returnedState) return false;\r\n const savedState = getLogoutState(this.config.clientId);\r\n if (!savedState) return false;\r\n if (!timingSafeEqualString(savedState, returnedState)) return false;\r\n // 校验通过：logout state 为一次性临时数据，立即清除\r\n removeLogoutState(this.config.clientId);\r\n return true;\r\n }\r\n\r\n /**\r\n * 获取 OIDC Discovery 文档\r\n *\r\n * 用于调试和获取 SSO 中心完整配置。\r\n * 可能返回 null（当 Discovery 端点不可达且无缓存时）。\r\n */\r\n async getDiscovery(): Promise<OidcDiscovery | null> {\r\n return this._getDiscovery();\r\n }\r\n}\r\n"],"mappings":";AAsDO,SAAS,uBACd,YACA,UAAwC,kBAC1B;AACd,UAAQ,YAAY;AAAA,IAClB,KAAK;AAEH,aAAO,YAAY,YAAY,oBAAoB;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;AAKO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAKlC,YAAY,MAAoB,aAAqB,OAAiB;AACpE,UAAM,aAAa,IAAI,KAAK,WAAW,EAAE;AACzC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,QAAQ;AAAA,EACf;AACF;AASO,IAAM,aAAN,cAAyB,MAAM;AAAA,EAKpC,YAAY,MAAc,aAAqB,KAAc;AAC3D,UAAM,WAAW,IAAI,KAAK,WAAW,EAAE;AACvC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,MAAM;AAAA,EACb;AACF;;;AC1GA,IAAM,cACJ;AASF,SAAS,qBAAqB,QAAwB;AACpD,QAAM,OAAO;AACb,MAAI,SAAS;AAEb,SAAO,OAAO,SAAS,QAAQ;AAE7B,UAAM,YAAY,KAAK,IAAI,SAAS,GAAG,GAAG;AAC1C,UAAM,QAAQ,IAAI,WAAW,SAAS;AACtC,WAAO,gBAAgB,KAAK;AAE5B,aAAS,IAAI,GAAG,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC5D,UAAI,MAAM,CAAC,KAAK,KAAM;AACtB,gBAAU,YAAY,MAAM,CAAC,IAAI,YAAY,MAAM;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AACT;AAUO,SAAS,qBAAqB,SAAiB,IAAY;AAChE,MAAI,SAAS,MAAM,SAAS,KAAK;AAC/B,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,qBAAqB,MAAM;AACpC;AASA,eAAsB,sBACpB,cACiB;AACjB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,YAAY;AACxC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAGvD,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACzC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAOO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;;;ACvCA,IAAM,iBAAiB;AAGvB,IAAM,YAAY;AAClB,IAAM,sBAAsB;AAC5B,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AAEzB,IAAM,mBAAmB;AAEzB,SAAS,SAAS,MAAc,UAA2B;AACzD,SAAO,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;AAC5C;AAUA,SAAS,6BAA2C;AAClD,QAAM,QAAQ,oBAAI,IAAoB;AACtC,SAAO;AAAA,IACL,IAAI,KAAa;AACf,aAAO,MAAM,IAAI,GAAG,KAAK;AAAA,IAC3B;AAAA,IACA,IAAI,KAAa,OAAe;AAC9B,YAAM,IAAI,KAAK,KAAK;AAAA,IACtB;AAAA,IACA,OAAO,KAAa;AAClB,YAAM,OAAO,GAAG;AAAA,IAClB;AAAA,IACA,OAAO;AACL,aAAO,CAAC,GAAG,MAAM,KAAK,CAAC;AAAA,IACzB;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB,2BAA2B;AAYxD,IAAM,sBAAoC;AAAA,EACxC,IAAI,KAAa;AACf,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa,QAAO;AAChD,aAAO,aAAa,QAAQ,iBAAiB,GAAG;AAAA,IAClD,QAAQ;AAEN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,IAAI,KAAa,OAAe;AAC9B,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa;AACzC,mBAAa,QAAQ,iBAAiB,KAAK,KAAK;AAAA,IAClD,SAAS,KAAK;AAEZ,cAAQ;AAAA,QACN,wDAA+B,eAAe,QAAQ,IAAI,OAAO,OAAO,GAAG,CAAC;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO,KAAa;AAClB,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa;AACzC,mBAAa,WAAW,iBAAiB,GAAG;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EACA,OAAO;AACL,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa,QAAO,CAAC;AACjD,YAAM,SAAmB,CAAC;AAC1B,eAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK;AAC5C,cAAM,MAAM,aAAa,IAAI,CAAC;AAC9B,YAAI,KAAK,WAAW,cAAc,EAAG,QAAO,KAAK,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,MACnF;AACA,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;AAaA,SAAS,8BAA4C;AACnD,QAAM,WAAW,oBAAI,IAAoB;AACzC,SAAO;AAAA,IACL,IAAI,KAAa;AACf,UAAI;AACF,YAAI,OAAO,mBAAmB,aAAa;AACzC,iBAAO,eAAe,QAAQ,iBAAiB,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK;AAAA,QAC9E;AAAA,MACF,QAAQ;AAAA,MAER;AACA,aAAO,SAAS,IAAI,GAAG,KAAK;AAAA,IAC9B;AAAA,IACA,IAAI,KAAa,OAAe;AAC9B,UAAI;AACF,YAAI,OAAO,mBAAmB,aAAa;AACzC,yBAAe,QAAQ,iBAAiB,KAAK,KAAK;AAClD;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,eAAS,IAAI,KAAK,KAAK;AAAA,IACzB;AAAA,IACA,OAAO,KAAa;AAClB,eAAS,OAAO,GAAG;AACnB,UAAI;AACF,YAAI,OAAO,mBAAmB,YAAa;AAC3C,uBAAe,WAAW,iBAAiB,GAAG;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,IACA,OAAO;AACL,YAAM,SAAS,IAAI,IAAY,SAAS,KAAK,CAAC;AAC9C,UAAI;AACF,YAAI,OAAO,mBAAmB,aAAa;AACzC,mBAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,kBAAM,MAAM,eAAe,IAAI,CAAC;AAChC,gBAAI,KAAK,WAAW,cAAc,EAAG,QAAO,IAAI,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,UAClF;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,aAAO,CAAC,GAAG,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAGA,IAAM,aAA2B,4BAA4B;AAatD,SAAS,oBAAoB,UAAiC,CAAC,GAAiB;AACrF,SAAO,QAAQ,UAAU,sBAAsB,4BAA4B;AAC7E;AAMA,IAAI,WAAyB,4BAA4B;AAKlD,SAAS,gBAAgB,SAA6B;AAC3D,aAAW;AACb;AAKO,SAAS,kBAAgC;AAC9C,SAAO;AACT;AAMO,SAAS,cAAc,MAAiB,UAAyB;AACtE,WAAS,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK,UAAU,IAAI,CAAC;AAClE;AAEO,SAAS,aAAa,UAAqC;AAChE,QAAM,MAAM,SAAS,IAAI,SAAS,WAAW,QAAQ,CAAC;AACtD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AAIF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,UAAyB;AACvD,WAAS,OAAO,SAAS,WAAW,QAAQ,CAAC;AAC/C;AAMO,SAAS,iBAAiB,UAAkB,UAAwB;AACzE,aAAW,IAAI,sBAAsB,UAAU,QAAQ;AACzD;AAEO,SAAS,gBAAgB,UAAiC;AAC/D,SAAO,WAAW,IAAI,sBAAsB,QAAQ;AACtD;AAEO,SAAS,mBAAmB,UAAwB;AACzD,aAAW,OAAO,sBAAsB,QAAQ;AAClD;AAMO,SAAS,eAAe,OAAe,UAAyB;AACrE,aAAW,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK;AACrD;AAEO,SAAS,cAAc,UAAkC;AAC9D,SAAO,WAAW,IAAI,SAAS,WAAW,QAAQ,CAAC;AACrD;AAEO,SAAS,iBAAiB,UAAyB;AACxD,aAAW,OAAO,SAAS,WAAW,QAAQ,CAAC;AACjD;AAMO,SAAS,eAAe,OAAe,UAAyB;AACrE,aAAW,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK;AACrD;AAEO,SAAS,cAAc,UAAkC;AAC9D,SAAO,WAAW,IAAI,SAAS,WAAW,QAAQ,CAAC;AACrD;AAEO,SAAS,iBAAiB,UAAyB;AACxD,aAAW,OAAO,SAAS,WAAW,QAAQ,CAAC;AACjD;AAMO,SAAS,gBAAgB,OAAe,UAAyB;AACtE,aAAW,IAAI,SAAS,kBAAkB,QAAQ,GAAG,KAAK;AAC5D;AAEO,SAAS,eAAe,UAAkC;AAC/D,SAAO,WAAW,IAAI,SAAS,kBAAkB,QAAQ,CAAC;AAC5D;AAEO,SAAS,kBAAkB,UAAyB;AACzD,aAAW,OAAO,SAAS,kBAAkB,QAAQ,CAAC;AACxD;AAKO,SAAS,cAAc,KAAa,UAAyB;AAClE,aAAW,IAAI,SAAS,gBAAgB,QAAQ,GAAG,GAAG;AACxD;AAEO,SAAS,aAAa,UAAkC;AAC7D,SAAO,WAAW,IAAI,SAAS,gBAAgB,QAAQ,CAAC;AAC1D;AAEO,SAAS,gBAAgB,UAAyB;AACvD,aAAW,OAAO,SAAS,gBAAgB,QAAQ,CAAC;AACtD;AAQO,SAAS,gBAAgB,OAAe,UAAyB;AACtE,aAAW,IAAI,SAAS,kBAAkB,QAAQ,GAAG,KAAK;AAC5D;AAEO,SAAS,eAAe,UAAkC;AAC/D,SAAO,WAAW,IAAI,SAAS,kBAAkB,QAAQ,CAAC;AAC5D;AAEO,SAAS,kBAAkB,UAAyB;AACzD,aAAW,OAAO,SAAS,kBAAkB,QAAQ,CAAC;AACxD;AAMO,SAAS,gBAAgB,UAAyB;AACvD,MAAI,UAAU;AACZ,oBAAgB,QAAQ;AACxB,qBAAiB,QAAQ;AACzB,qBAAiB,QAAQ;AACzB,oBAAgB,QAAQ;AACxB,sBAAkB,QAAQ;AAC1B,sBAAkB,QAAQ;AAC1B,uBAAmB,QAAQ;AAE3B,uBAAmB,GAAG,QAAQ,cAAc;AAC5C;AAAA,EACF;AAEA,kBAAgB;AAChB,mBAAiB;AACjB,mBAAiB;AACjB,kBAAgB;AAChB,oBAAkB;AAClB,oBAAkB;AAMlB,QAAM,SAAoB,CAAC;AAC3B,MAAI;AACF,QAAI,OAAO,mBAAmB,YAAa,QAAO,KAAK,cAAc;AAAA,EACvE,QAAQ;AAAA,EAER;AACA,MAAI;AACF,QAAI,OAAO,iBAAiB,YAAa,QAAO,KAAK,YAAY;AAAA,EACnE,QAAQ;AAAA,EAER;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAiB,CAAC;AACxB,QAAI;AACF,eAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAM,MAAM,MAAM,IAAI,CAAC;AACvB,YAAI,KAAK,WAAW,cAAc,EAAG,MAAK,KAAK,GAAG;AAAA,MACpD;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AACA,eAAW,OAAO,MAAM;AACtB,mBAAa,IAAI,IAAI,MAAM,eAAe,MAAM,CAAC;AACjD,UAAI;AACF,cAAM,WAAW,GAAG;AAAA,MACtB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAIA,aAAW,SAAS,CAAC,YAAY,QAAQ,GAAG;AAC1C,QAAI;AACF,iBAAW,OAAO,MAAM,OAAO,KAAK,CAAC,EAAG,cAAa,IAAI,GAAG;AAAA,IAC9D,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,aAAW,OAAO,cAAc;AAC9B,eAAW,OAAO,GAAG;AACrB,aAAS,OAAO,GAAG;AAAA,EACrB;AACF;AAOO,SAAS,yBAAyB,WAA2B;AAClE,aAAW,YAAY,WAAW;AAChC,eAAW,OAAO,sBAAsB,QAAQ;AAAA,EAClD;AACF;;;AC5bA,IAAM,0BAA0B;AAUzB,SAAS,mBAAmB,KAAa,eAAgC;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,wBAAwB,KAAK,GAAG,EAAG,QAAO;AAC9C,MAAI,IAAI,WAAW,IAAI,EAAG,QAAO;AACjC,MAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAU,QAAO;AACxE,QAAI,OAAO,YAAY,OAAO,SAAU,QAAO;AAC/C,WAAO,OAAO,WAAW;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,sBAAsB,GAAW,GAAoB;AACnE,QAAM,KAAK,IAAI,YAAY,EAAE,OAAO,CAAC;AACrC,QAAM,KAAK,IAAI,YAAY,EAAE,OAAO,CAAC;AACrC,MAAI,GAAG,WAAW,KAAK,GAAG,WAAW,EAAG,QAAO,GAAG,WAAW,GAAG;AAChE,QAAM,MAAM,KAAK,IAAI,GAAG,QAAQ,GAAG,MAAM;AACzC,MAAI,OAAO,GAAG,SAAS,GAAG;AAC1B,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,YAAQ,GAAG,IAAI,GAAG,MAAM,IAAI,GAAG,IAAI,GAAG,MAAM;AAAA,EAC9C;AACA,SAAO,SAAS;AAClB;;;ACrCA,IAAM,UACJ,OAAO,WAAW,eAAgB,OAAkB,SAAU,SAAoB;AAEpF,SAAS,YAA2B;AAClC,SAAQ,WAA6B;AACvC;AAwCA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;AACjF,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,OAA+C;AAC9E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAA+C;AAC7E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,gBAAgB,KAAqB;AAC5C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAQA,IAAI,aAAwE;AAC5E,IAAI,kBAAwF;AAC5F,IAAM,oBAAoB,IAAI,KAAK;AAEnC,IAAM,mBAAmB;AAQzB,eAAsB,kBAAkB,SAAmD;AACzF,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,mBAAmB,gBAAgB,YAAY,WAAW,MAAM,gBAAgB,YAAY,mBAAmB;AACjH,WAAO,gBAAgB;AAAA,EACzB;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,+CAA+C;AAAA,MAC/E,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,IAC9C,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,MAAO,MAAM,IAAI,KAAK;AAC5B,sBAAkB,EAAE,SAAS,KAAK,WAAW,IAAI;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,UAAU,SAAiB,UAA4B,CAAC,GAAyB;AACrG,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,CAAC,QAAQ,gBAAgB,cAAc,WAAW,YAAY,WAAW,MAAM,WAAW,YAAY,mBAAmB;AAC3H,WAAO,WAAW;AAAA,EACpB;AAEA,QAAM,YAAY,MAAM,kBAAkB,OAAO;AACjD,QAAM,UAAU,WAAW,YAAY,GAAG,OAAO;AAEjD,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,SAAS;AAAA,MAC/B,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,MAC5C,GAAI,QAAQ,eAAe,EAAE,OAAO,WAA2B,IAAI,CAAC;AAAA,IACtE,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,iBAAa,EAAE,SAAS,MAAM,WAAW,IAAI;AAC7C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,qBAAqB,OAAe,KAAgC;AACxF,MAAI;AACF,UAAM,CAAC,WAAW,YAAY,SAAS,IAAI,MAAM,MAAM,GAAG;AAC1D,QAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,EAAG,QAAO;AAE3C,UAAM,IAAI,UAAU;AACpB,QAAI,CAAC,EAAG,QAAO;AAEf,UAAM,YAAY,MAAM,EAAE,OAAO;AAAA,MAC/B;AAAA,MACA,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3D,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,MAC7C;AAAA,MACA,CAAC,QAAQ;AAAA,IACX;AAEA,UAAM,iBAAiB,gBAAgB,SAAS;AAChD,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AAClE,WAAO,MAAM,EAAE,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,cAAc,aAAsC;AACxE,QAAM,IAAI,UAAU;AACpB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,MAAM,EAAE,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AACnF,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,QAAM,OAAO,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;AAC5C,MAAI,SAAS;AACb,aAAW,KAAK,MAAM;AACpB,cAAU,OAAO,aAAa,CAAC;AAAA,EACjC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAGA,eAAsB,gBACpB,SACA,aACA,gBACA,kBACA,UAAkC,CAAC,GACH;AAChC,QAAM,EAAE,gCAAgC,MAAM,cAAc,IAAI;AAEhE,QAAM,SAAS,gBAAgB,OAAO;AACtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,SAAS,oBAAoB,mCAAe;AAAA,EACxD;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,OAAO,QAAQ,YAAa,QAAQ,WAAW,QAAQ,SAAU;AACnE,UAAM,IAAI,SAAS,4BAA4B,+DAAuB,GAAG,EAAE;AAAA,EAC7E;AAEA,QAAM,UAAU,gBAAgB,cAAc;AAE9C,QAAM,YAAY,MAAM,kBAAkB,OAAO;AACjD,QAAM,mBAAmB,gBAAgB,WAAW,UAAU,OAAO;AAGrE,MAAI,QAAQ,SAAS;AACnB,UAAM,OAAO,MAAM,UAAU,OAAO;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,8BAA8B,kEAA0B;AAAA,IAC7E;AACA,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAE1D,UAAM,kBAAkB,CAAC,QACvB,IAAI,KAAK;AAAA,MACP,CAAC,MACC,EAAE,QAAQ,SACV,EAAE,QAAQ,WACV,EAAE,QAAQ,UACT,MAAM,EAAE,QAAQ,MAAM;AAAA,IAC3B;AACF,UAAM,YAAY,OAAO,SAAsC;AAC7D,iBAAW,OAAO,MAAM;AACtB,YAAI,MAAM,qBAAqB,SAAS,GAAG,EAAG,QAAO;AAAA,MACvD;AACA,aAAO;AAAA,IACT;AAEA,QAAI,aAAa,gBAAgB,IAAI;AACrC,QAAI,WAAW,WAAW,SAAS,IAAI,MAAM,UAAU,UAAU,IAAI;AAIrE,QAAI,WAAW,WAAW,KAAK,CAAC,UAAU;AACxC,YAAM,YAAY,MAAM,UAAU,SAAS,EAAE,cAAc,KAAK,CAAC;AACjE,UAAI,WAAW;AACb,qBAAa,gBAAgB,SAAS;AACtC,mBAAW,WAAW,SAAS,IAAI,MAAM,UAAU,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,QAAI,WAAW,WAAW,GAAG;AAC3B,YAAM,IAAI,SAAS,8BAA8B,oEAAuB;AAAA,IAC1E;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,SAAS,8BAA8B,+CAAiB;AAAA,IACpE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS;AACnB,QAAI,+BAA+B;AACjC,YAAM,OAAO,MAAM,UAAU,OAAO;AACpC,YAAM,WAAW,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AAC7E,UAAI,UAAU;AACZ,cAAM,IAAI,SAAS,4BAA4B,2EAAmC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,UAAU,iBAAiB,OAAO;AACxC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,SAAS,oBAAoB,2CAAuB;AAAA,EAChE;AAEA,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,IAAI;AACrF,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,SAAS,4BAA4B,oCAAqB;AAAA,EACtE;AAGA,QAAM,MAAM,QAAQ;AACpB,QAAM,UAAU,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC;AAC9E,MAAI,CAAC,QAAQ,SAAS,gBAAgB,GAAG;AACvC,UAAM,IAAI,SAAS,8BAA8B,sCAAuB;AAAA,EAC1E;AACA,MAAI,QAAQ,SAAS,KAAK,QAAQ,QAAQ,kBAAkB;AAC1D,UAAM,IAAI,SAAS,8BAA8B,2EAAwC;AAAA,EAC3F;AAGA,MAAI,OAAO,QAAQ,QAAQ,UAAU;AACnC,UAAM,IAAI,SAAS,oBAAoB,wCAAoB;AAAA,EAC7D;AACA,MAAI,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAO,KAAQ;AAC7C,UAAM,IAAI,SAAS,oBAAoB,6BAAc;AAAA,EACvD;AAGA,MAAI,OAAO,QAAQ,QAAQ,YAAY,QAAQ,MAAM,MAAO,KAAK,IAAI,IAAI,KAAQ;AAC/E,UAAM,IAAI,SAAS,oBAAoB,6FAA4B;AAAA,EACrE;AAEA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,SAAS,wBAAwB,2BAAiB;AAAA,EAC9D;AAGA,MAAI,OAAO,QAAQ,YAAY,YAAY,QAAQ,SAAS;AAC1D,UAAM,SAAS,MAAM,cAAc,WAAW;AAC9C,QAAI,CAAC,sBAAsB,QAAQ,QAAQ,OAAO,GAAG;AACnD,YAAM,IAAI,SAAS,6BAA6B,qCAAsB;AAAA,IACxE;AAAA,EACF;AAIA,MAAI,kBAAkB,QAAW;AAC/B,UAAM,aAAa,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AACvE,QAAI,CAAC,cAAc,CAAC,sBAAsB,eAAe,UAAU,GAAG;AACpE,YAAM,IAAI,SAAS,2BAA2B,mCAAoB;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,QAAQ,IAAI;AAC5B;;;ACnTA,IAAM,qBAAqB;AAE3B,IAAM,oBAAoB;AAG1B,eAAe,iBACb,OACA,OAAoB,CAAC,GACrB,YAAoB,oBACD;AACnB,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACF,WAAO,MAAM,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EAClE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAgBA,SAAS,yBACP,MACA,qBACM;AACN,MAAI,OAAO,KAAK,iBAAiB,YAAY,CAAC,KAAK,cAAc;AAC/D,UAAM,IAAI,SAAS,wBAAwB,6CAAyB;AAAA,EACtE;AACA,MACE,OAAO,KAAK,eAAe,YAC3B,CAAC,OAAO,SAAS,KAAK,UAAU,KAChC,KAAK,cAAc,GACnB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+CAA2B,OAAO,KAAK,UAAU,CAAC;AAAA,IACpD;AAAA,EACF;AACA,MACE,wBACC,OAAO,KAAK,kBAAkB,YAAY,CAAC,KAAK,gBACjD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AA6EA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAoCM,IAAM,aAAN,MAAM,WAAU;AAAA,EAcrB,YAAY,QAAyB;AAVrC,SAAQ,aAAmC;AAC3C,SAAQ,sBAA8B;AACtC,SAAQ,eAA0C;AAShD,QAAI,CAAC,OAAO,SAAU,OAAM,IAAI,SAAS,kBAAkB,mCAAe;AAC1E,QAAI,CAAC,OAAO,YAAa,OAAM,IAAI,SAAS,kBAAkB,sCAAkB;AAChF,QAAI,CAAC,OAAO,WAAY,OAAM,IAAI,SAAS,kBAAkB,qCAAiB;AAG9E,UAAM,OAAO,OAAO,WAAW,QAAQ,QAAQ,EAAE;AACjD,SAAK,SAAS,EAAE,GAAG,QAAQ,YAAY,KAAK;AAC5C,SAAK,eAAe,OAAO,iBAAiB,MAAM,QAAQ,QAAQ,EAAE;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,YAAY,MAAuB;AACjC,QAAI,KAAK,OAAO,OAAO;AACrB,cAAQ,KAAK,aAAa,GAAG,IAAI;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,gBAA+C;AAC3D,UAAM,MAAM,KAAK,IAAI;AAGrB,QACE,KAAK,cACL,MAAM,KAAK,sBAAsB,WAAU,kBAC3C;AACA,aAAO,KAAK;AAAA,IACd;AAIA,UAAM,MAAM,GAAG,KAAK,WAAW;AAE/B,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY;AAAA,QAChB,MAAM,WAAW,MAAM;AAAA,QACvB,WAAU;AAAA,MACZ;AAEA,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC1D,mBAAa,SAAS;AAEtB,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ;AAAA,UACN,2DAAuC,IAAI,MAAM;AAAA,QACnD;AACA,eAAO;AAAA,MACT;AAEA,WAAK,aAAc,MAAM,IAAI,KAAK;AAClC,WAAK,sBAAsB;AAC3B,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,sDAAkC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACpF;AAEA,aAAO,KAAK,cAAc;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,wBAAyC;AACrD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,oBAAqC;AACjD,QAAI,KAAK,OAAO,cAAe,QAAO,GAAG,KAAK,WAAW;AACzD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,uBAAwC;AACpD,QAAI,KAAK,OAAO,cAAe,QAAO,GAAG,KAAK,WAAW;AACzD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,WAAyB;AACvD,QAAI,mBAAmB,WAAW,OAAO,SAAS,MAAM,GAAG;AAEzD,oBAAc,WAAW,KAAK,OAAO,QAAQ;AAAA,IAC/C,OAAO;AACL,cAAQ,KAAK,2FAAoC,SAAS,EAAE;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,MAAM,WAAoB,UAAwB,CAAC,GAAkB;AACzE,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAE5B,UAAM,QAAQ,cAAc;AAG5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAC1C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,QAAQ,WAAW,QAAQ;AAC7B,sBAAgB,OAAO,KAAK,OAAO,QAAQ;AAAA,IAC7C,OAAO;AACL,wBAAkB,KAAK,OAAO,QAAQ;AAAA,IACxC;AAEA,QAAI,WAAW;AACb,WAAK,wBAAwB,SAAS;AAAA,IACxC;AAGA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAC1C,QAAI,QAAQ,QAAQ;AAClB,aAAO,IAAI,UAAU,QAAQ,MAAM;AAAA,IACrC;AAGA,WAAO,SAAS,OAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,YAAY,WAAoB,UAAwB,CAAC,GAAoB;AACjF,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAE5B,UAAM,QAAQ,cAAc;AAE5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAC1C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,QAAQ,WAAW,QAAQ;AAC7B,sBAAgB,OAAO,KAAK,OAAO,QAAQ;AAAA,IAC7C,OAAO;AACL,wBAAkB,KAAK,OAAO,QAAQ;AAAA,IACxC;AAEA,QAAI,UAAW,MAAK,wBAAwB,SAAS;AAErD,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAC1C,QAAI,QAAQ,QAAQ;AAClB,aAAO,IAAI,UAAU,QAAQ,MAAM;AAAA,IACrC;AAEA,WAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAM,WACJ,UAAmE,CAAC,GAChD;AACpB,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAC5B,UAAM,QAAQ,cAAc;AAC5B,UAAM,aAAa,cAAc;AAEjC,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAC1C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,qBAAiB,GAAG,KAAK,OAAO,QAAQ,gBAAgB,UAAU;AAElE,QAAI,QAAQ,WAAW;AACrB,WAAK,wBAAwB,QAAQ,SAAS;AAAA,IAChD;AAEA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAE1C,WAAO,IAAI,eAAe,UAAU;AAEpC,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,QAAQ,SAAS,CAAC;AAC1D,UAAM,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,SAAS,UAAU,CAAC;AAE3D,UAAM,gBAAgB;AAAA,MACpB,SAAS,KAAK;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,QAAQ,KAAK,MAAM,IAAI,CAAC;AAAA,MACxB,OAAO,KAAK,MAAM,GAAG,CAAC;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG;AAEV,UAAM,QAAQ,OAAO;AAAA,MACnB,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,OAAO;AACV,yBAAmB,KAAK,OAAO,QAAQ;AACvC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,oBAAoB,IAAI,IAAI,KAAK,OAAO,WAAW,EAAE;AAE3D,QAAI;AAEF,YAAM,MAAM;AAEZ,aAAO,MAAM,IAAI,QAAmB,CAAC,SAAS,WAAW;AACvD,YAAI,YAAY;AAEhB,cAAM,gBAAgB,CAAC,UAAwB;AAC7C,cAAI,UAAW;AAEf,cAAI,MAAM,WAAW,kBAAmB;AACxC,cAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,SAAS,6BAA8B;AACrE,cAAI,CAAC,MAAM,KAAK,YAAa;AAG7B,gBAAM,aAAa,gBAAgB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxE,cAAI,CAAC,cAAc,CAAC,sBAAsB,MAAM,KAAK,SAAS,IAAI,UAAU,EAAG;AAC/E,6BAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AAIxD,cAAI;AACF,YAAC,MAAM,QAA0B;AAAA,cAC/B,EAAE,MAAM,yBAAyB,OAAO,WAAW;AAAA,cACnD,MAAM;AAAA,YACR;AAAA,UACF,QAAQ;AAAA,UAER;AAEA,sBAAY;AACZ,kBAAQ;AAER,cAAI,SAAS,CAAC,MAAM,QAAQ;AAC1B,kBAAM,MAAM;AAAA,UACd;AAEA,eAAK,eAAe,MAAM,KAAK,WAAW,EACvC,KAAK,CAAC,cAAc;AAGnB,gBAAI,cAAc,MAAM;AACtB;AAAA,gBACE,IAAI,SAAS,qBAAqB,0FAAoB;AAAA,cACxD;AACA;AAAA,YACF;AACA,oBAAQ,SAAS;AAAA,UACnB,CAAC,EACA,MAAM,MAAM;AAAA,QACjB;AAEA,cAAM,YAAY,YAAY,MAAM;AAClC,cAAI,MAAM,QAAQ;AAChB,gBAAI,CAAC,WAAW;AACd,0BAAY;AACZ,sBAAQ;AACR;AAAA,gBACE,IAAI;AAAA,kBACF;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,GAAG,GAAG;AAEN,cAAM,UAAU,MAAM;AACpB,wBAAc,SAAS;AACvB,iBAAO,oBAAoB,WAAW,aAAa;AACnD,6BAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AAAA,QAC1D;AAEA,eAAO,iBAAiB,WAAW,aAAa;AAAA,MAClD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,yBAAmB,KAAK,OAAO,QAAQ;AACvC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eACJ,aAC2B;AAC3B,UAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,UAAM,SAAS,IAAI;AAGnB,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAI,OAAO;AAIT,YAAM,qBAAqB,OAAO,IAAI,OAAO;AAC7C,YAAM,aAAa,eAAe,KAAK,OAAO,QAAQ;AACtD,YAAM,qBAAqB,cAAc,KAAK,OAAO,QAAQ;AAC7D,UACE,oBAAoB,IAAI,KAAK,KAC7B,cACA,sBACA,sBAAsB,oBAAoB,sBAAsB,EAAE,KAClE,sBAAsB,YAAY,sBAAsB,EAAE,GAC1D;AAEA,yBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAiB,KAAK,OAAO,QAAQ;AACrC,2BAAmB,KAAK,OAAO,QAAQ;AACvC,0BAAkB,KAAK,OAAO,QAAQ;AACtC,eAAO;AAAA,MACT;AAEA,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,YAAM,OAAO,OAAO,IAAI,mBAAmB,KAAK;AAChD,YAAM,IAAI,SAAS,uBAAuB,KAAK,GAAG,6BAAS,IAAI,EAAE;AAAA,IACnE;AAEA,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,gBAAgB,OAAO,IAAI,OAAO;AAExC,QAAI,CAAC,MAAM;AAET,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,YAAM,IAAI,SAAS,wBAAwB,wDAA+B;AAAA,IAC5E;AAGA,UAAM,aAAa,cAAc,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,cAAc,CAAC,sBAAsB,YAAY,iBAAiB,EAAE,GAAG;AAE1E,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAIA,UAAM,gBAAgB,cAAc,KAAK,OAAO,QAAQ,KAAK;AAG7D,UAAM,WAAW,gBAAgB,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,oBAAoB;AAC3C,SAAK,IAAI,QAAQ,IAAI;AACrB,SAAK,IAAI,iBAAiB,QAAQ;AAClC,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,SAAK,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAChD,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,iBAAiB,eAAe;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,wCAAU,GAAG;AAAA,IACnD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,cAAe,QAAQ,SAAoB;AACjD,YAAM,IAAI;AAAA,QACR,uBAAuB,WAAW;AAAA,QACjC,QAAQ,qBAAgC,wCAAoB,IAAI,MAAM;AAAA,MACzE;AAAA,IACF;AAIA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAI3C,6BAAyB,MAAM,IAAI;AAInC,UAAM,mBAAmB,KAAK,OAAO,UAAU,kBAAkB,MAAM,GAAG,EAAE,OAAO,OAAO;AAC1F,QAAI,gBAAgB,SAAS,QAAQ,KAAK,CAAC,KAAK,UAAU;AACxD,sBAAgB,KAAK,OAAO,QAAQ;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,QAAI,KAAK,UAAU;AACjB,UAAI;AACF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,UACZ,EAAE,cAAc;AAAA,QAClB;AAAA,MACF,SAAS,KAAK;AAEZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAKA,qBAAiB,KAAK,OAAO,QAAQ;AACrC,qBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAmB,KAAK,OAAO,QAAQ;AACvC,sBAAkB,KAAK,OAAO,QAAQ;AAEtC,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,SAAK,SAAS,kDAA8B,EAAE,UAAU,KAAK,OAAO,SAAS,CAAC;AAC9E,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAmC;AAEvC,QAAI,KAAK,aAAc,QAAO,KAAK;AAEnC,SAAK,eAAe,KAAK,gBAAgB;AACzC,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,kBAAsC;AAClD,UAAM,UAAU,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,SAAS,oBAAoB,8CAAqB;AAAA,IAC9D;AAEA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,eAAe;AACtC,SAAK,IAAI,iBAAiB,QAAQ,aAAa;AAC/C,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI,MAAuB;AAC3B,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAI;AACF,cAAM,MAAM,iBAAiB,eAAe;AAAA,UAC1C,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,UAC/D,MAAM,KAAK,SAAS;AAAA,QACtB,CAAC;AACD,kBAAU;AACV;AAAA,MACF,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,EAAG,OAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAI,CAAC;AAAA,MAC/D;AAAA,IACF;AACA,QAAI,WAAW,CAAC,KAAK;AACnB,YAAM,IAAI,SAAS,iBAAiB,2DAAmB,OAAO;AAAA,IAChE;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,YAAa,QAAQ,SAAoB;AAI/C,UAAI,cAAc,iBAAiB;AACjC,wBAAgB,KAAK,OAAO,QAAQ;AAAA,MACtC;AACA,WAAK,SAAS,0CAAsB,EAAE,QAAQ,IAAI,QAAQ,OAAO,UAAU,CAAC;AAC5E,UAAI,CAAC,aAAa,IAAI,WAAW,KAAK;AACpC,cAAM,IAAI,SAAS,oBAAoB,yGAAyB;AAAA,MAClE;AACA,YAAM,IAAI;AAAA,QACR,uBAAuB,WAAW,SAAS;AAAA,QAC1C,QAAQ,qBAAgC,yCAAqB,IAAI,MAAM;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAI3C,6BAAyB,MAAM,KAAK;AAEpC,QAAI,KAAK,UAAU;AACjB,UAAI;AACF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,QACd;AAAA,MACF,SAAS,KAAK;AACZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA;AAAA,MAEjB,eAAe,KAAK,iBAAiB,QAAQ;AAAA,MAC7C,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAgC;AACpC,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AAEjD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,SAAS,qBAAqB,oBAAK;AAAA,IAC/C;AAGA,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,UAAM,mBAAmB,MAAM,KAAK,qBAAqB;AAEzD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,iBAAiB,kBAAkB;AAAA,QAC7C,SAAS;AAAA,UACP,eAAe,UAAU,UAAU,YAAY;AAAA,QACjD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,4EAAgB,GAAG;AAAA,IACzD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,IAAI,WAAW,KAAK;AACtB,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM,IAAI,SAAS,qBAAqB,0BAAW;AAAA,MACrD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,0DAAkB,IAAI,MAAM;AAAA,MAC9B;AAAA,IACF;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAyC;AAC7C,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,UAAW,QAAO;AAEvB,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAA2B;AACzB,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,QAAI,CAAC,UAAW,QAAO;AACvB,WAAO,KAAK,IAAI,IAAI,UAAU;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAO,gBAAyB,OAAsB;AAE1D,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,UAAM,eAAe,WAAW;AAChC,UAAM,cAAc,WAAW;AAE/B,oBAAgB,KAAK,OAAO,QAAQ;AACpC,SAAK,SAAS,sDAAmB;AAAA,MAC/B,UAAU,KAAK,OAAO;AAAA,MACtB;AAAA,IACF,CAAC;AAID,QAAI,gBAAgB,KAAK,OAAO,UAAU;AACxC,UAAI;AAGF,cAAM,YAAY,KAAK,OAAO,gBAAgB,OAAO,MAAM,KAAK,cAAc;AAC9E,cAAM,YAAY,KAAK,OAAO,gBAC1B,GAAG,KAAK,WAAW,sBACnB,WAAW,uBACX,GAAG,KAAK,OAAO,UAAU;AAC7B,cAAM,aAAa,IAAI,gBAAgB;AAAA,UACrC,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,WAAW,KAAK,OAAO;AAAA,QACzB,CAAC;AACD,YAAI,KAAK,OAAO,cAAc;AAC5B,qBAAW,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,QAC1D;AACA,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,YAC/D,MAAM,WAAW,SAAS;AAAA,UAC5B;AAAA,UACA;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,eAAe;AAEjB,YAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,YAAM,qBACJ,WAAW,wBAAwB,GAAG,KAAK,OAAO,UAAU;AAC9D,YAAM,YAAY,IAAI,IAAI,kBAAkB;AAC5C,gBAAU,aAAa,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5D,YAAM,gBAAgB,KAAK,OAAO,yBAAyB,KAAK,OAAO;AACvE,UAAI,eAAe;AACjB,kBAAU,aAAa;AAAA,UACrB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,aAAa;AACf,kBAAU,aAAa,IAAI,iBAAiB,WAAW;AAAA,MACzD;AAEA,YAAM,QAAQ,cAAc;AAC5B,sBAAgB,OAAO,KAAK,OAAO,QAAQ;AAC3C,gBAAU,aAAa,IAAI,SAAS,KAAK;AACzC,aAAO,SAAS,OAAO,UAAU,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,oBAAoB,KAAsB;AACxC,UAAM,gBAAgB,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,OAAO;AAC3D,QAAI,CAAC,cAAe,QAAO;AAC3B,UAAM,aAAa,eAAe,KAAK,OAAO,QAAQ;AACtD,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,CAAC,sBAAsB,YAAY,aAAa,EAAG,QAAO;AAE9D,sBAAkB,KAAK,OAAO,QAAQ;AACtC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,eAA8C;AAClD,WAAO,KAAK,cAAc;AAAA,EAC5B;AACF;AAAA;AAj4Ba,WASa,mBAAmB,IAAI,KAAK;AAAA;AATzC,WAYa,uBAAuB;AAZ1C,IAAM,YAAN;","names":[]}
1
+ {"version":3,"sources":["../src/core/errors.ts","../src/core/pkce.ts","../src/core/storage.ts","../src/core/security.ts","../src/core/id-token.ts","../src/core/http.ts","../src/core/SsoClient.ts"],"sourcesContent":["/**\r\n * SSO SDK 错误类型\r\n */\r\n\r\n/** SSO 错误码 */\r\nexport type SsoErrorCode =\r\n | \"invalid_config\"\r\n | \"state_mismatch\"\r\n | \"issuer_mismatch\"\r\n | \"pkce_required\"\r\n | \"token_request_failed\"\r\n | \"session_expired\"\r\n | \"no_refresh_token\"\r\n | \"userinfo_failed\"\r\n | \"not_authenticated\"\r\n | \"authorization_code_expired\"\r\n // 保留：当前 SDK 不主动抛出，预留给服务端错误透传/未来版本使用\r\n | \"authorization_code_used\"\r\n | \"client_disabled\"\r\n | \"user_denied_authorization\"\r\n // 保留：当前 SDK 不主动抛出，预留给服务端错误透传/未来版本使用\r\n | \"account_disabled\"\r\n | \"sso_server_error\"\r\n | \"rate_limited\"\r\n | \"network_error\"\r\n | \"popup_blocked\"\r\n | \"popup_closed\"\r\n | \"id_token_invalid\"\r\n | \"id_token_unsupported_alg\"\r\n | \"id_token_hs256_unsupported\"\r\n // 保留：当前 SDK 不主动抛出（HS256 一律拒绝，见 id_token_hs256_unsupported）\r\n | \"id_token_missing_secret\"\r\n | \"id_token_invalid_signature\"\r\n | \"id_token_issuer_mismatch\"\r\n | \"id_token_audience_mismatch\"\r\n | \"id_token_expired\"\r\n | \"id_token_missing_sub\"\r\n | \"id_token_at_hash_mismatch\"\r\n | \"id_token_nonce_mismatch\"\r\n | \"logout_token_invalid\"\r\n | \"logout_token_unsupported_alg\"\r\n | \"logout_token_invalid_signature\"\r\n | \"logout_token_issuer_mismatch\"\r\n | \"logout_token_audience_mismatch\"\r\n | \"logout_token_expired\"\r\n | \"logout_token_replay\";\r\n\r\n/**\r\n * 将 OAuth 2.0 服务端 error 字段映射到 SsoErrorCode\r\n *\r\n * @param oauthError 服务端返回的 error 字段\r\n * @param context 调用上下文：\"token_exchange\"（授权码换 token）或 \"refresh\"（刷新）。\r\n * invalid_grant 在换 token 场景多为授权码过期/已用，在刷新场景多为会话失效，\r\n * 需按上下文细化映射。\r\n */\r\nexport function mapOAuthErrorToSsoCode(\r\n oauthError: string,\r\n context: \"token_exchange\" | \"refresh\" = \"token_exchange\"\r\n): SsoErrorCode {\r\n switch (oauthError) {\r\n case \"invalid_grant\":\r\n // 刷新场景的 invalid_grant 表示 refresh_token 已撤销/过期（调用方另会清除本地登录态）\r\n return context === \"refresh\" ? \"session_expired\" : \"authorization_code_expired\";\r\n case \"invalid_client\":\r\n return \"client_disabled\";\r\n case \"access_denied\":\r\n return \"user_denied_authorization\";\r\n case \"server_error\":\r\n return \"sso_server_error\";\r\n case \"rate_limited\":\r\n // 限流是独立的可重试错误，不应误报为 network_error\r\n return \"rate_limited\";\r\n case \"invalid_scope\":\r\n case \"invalid_request\":\r\n case \"unauthorized_client\":\r\n case \"unsupported_grant_type\":\r\n default:\r\n return \"token_request_failed\";\r\n }\r\n}\r\n\r\n/**\r\n * SSO SDK 自定义错误\r\n */\r\nexport class SsoError extends Error {\r\n public readonly code: SsoErrorCode;\r\n public readonly description: string;\r\n public readonly cause?: unknown;\r\n\r\n constructor(code: SsoErrorCode, description: string, cause?: unknown) {\r\n super(`[SSO SDK] ${code}: ${description}`);\r\n this.name = \"SsoError\";\r\n this.code = code;\r\n this.description = description;\r\n this.cause = cause;\r\n }\r\n}\r\n\r\n/**\r\n * OAuth 2.0 协议层错误（RFC 6749 §5.2）\r\n *\r\n * 保留用于表示服务端原样返回的 OAuth 错误（error / error_description / error_uri），\r\n * 与 SDK 语义的 SsoError 区分。当前 SDK 内部不抛出此类型（统一使用 SsoError +\r\n * mapOAuthErrorToSsoCode 映射），作为公共类型导出供子项目自行解析 OAuth 响应时使用。\r\n */\r\nexport class OAuthError extends Error {\r\n public readonly code: string;\r\n public readonly description: string;\r\n public readonly uri?: string;\r\n\r\n constructor(code: string, description: string, uri?: string) {\r\n super(`[OAuth] ${code}: ${description}`);\r\n this.name = \"OAuthError\";\r\n this.code = code;\r\n this.description = description;\r\n this.uri = uri;\r\n }\r\n}\r\n","/**\r\n * PKCE (Proof Key for Code Exchange) 工具函数\r\n *\r\n * 实现 RFC 7636 规范：\r\n * - code_verifier: 43-128 字符的随机字符串\r\n * - code_challenge: SHA-256(code_verifier) 的 base64url 编码\r\n *\r\n * 仅支持 S256 模式，不提供 plain 模式。\r\n */\r\n\r\nconst VALID_CHARS =\r\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~\";\r\n\r\n/**\r\n * 生成密码学安全随机字符串\r\n *\r\n * 使用拒绝采样法（rejection sampling）避免取模非均匀分布。\r\n * VALID_CHARS 有 66 个字符，Uint8(0-255) 取模会偏向前 58 个字符。\r\n * 丢弃 >=198 的字节值使分布完全均匀（198 = floor(256/66) * 66）。\r\n */\r\nfunction generateRandomString(length: number): string {\r\n const mask = 198; // 66 * 3，最大均匀取值\r\n let result = \"\";\r\n\r\n while (result.length < length) {\r\n // 一次生成分块避免过小 array 的循环开销\r\n const chunkSize = Math.min(length * 2, 256);\r\n const array = new Uint8Array(chunkSize);\r\n crypto.getRandomValues(array);\r\n\r\n for (let i = 0; i < chunkSize && result.length < length; i++) {\r\n if (array[i] >= mask) continue; // 拒绝采样：丢弃 >=198 的字节\r\n result += VALID_CHARS[array[i] % VALID_CHARS.length];\r\n }\r\n }\r\n\r\n return result;\r\n}\r\n\r\n/**\r\n * 生成 code_verifier\r\n *\r\n * 生成 43-128 字符之间的安全随机字符串，\r\n * 使用 `crypto.getRandomValues` 保证密码学安全性。\r\n *\r\n * @param length - 长度（默认 64），范围 43-128\r\n */\r\nexport function generateCodeVerifier(length: number = 64): string {\r\n if (length < 43 || length > 128) {\r\n throw new Error(\"code_verifier length must be between 43 and 128\");\r\n }\r\n return generateRandomString(length);\r\n}\r\n\r\n/**\r\n * 计算 code_challenge (S256)\r\n *\r\n * 对 code_verifier 进行 SHA-256 哈希，然后进行 base64url 编码。\r\n *\r\n * @param codeVerifier - PKCE code_verifier\r\n */\r\nexport async function generateCodeChallenge(\r\n codeVerifier: string\r\n): Promise<string> {\r\n const encoder = new TextEncoder();\r\n const data = encoder.encode(codeVerifier);\r\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\r\n\r\n // 转为 base64url（无 padding）\r\n const bytes = new Uint8Array(hash);\r\n let binary = \"\";\r\n for (let i = 0; i < bytes.byteLength; i++) {\r\n binary += String.fromCharCode(bytes[i]);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/**\r\n * 生成 state 参数\r\n *\r\n * 32 字节 hex 随机字符串，用于 CSRF 防护。\r\n */\r\nexport function generateState(): string {\r\n const array = new Uint8Array(32);\r\n crypto.getRandomValues(array);\r\n return Array.from(array, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\r\n}\r\n","/**\n * Token 存储抽象层\n *\n * 分两类存储：\n * - Token 数据：默认使用 sessionStorage（标签页级持久化）。登录回调后 CallbackPage\n * 默认整页跳转，内存存储会丢失登录态，因此默认改为 sessionStorage：\n * 整页跳转与刷新后登录态保留，关闭标签页自动清除；SSR / 隐私模式写入失败时\n * 降级为内存 Map。对需要多 Tab 共享 token 或 BFF/Confidential Client 场景，\n * 可通过 setTokenStorage() 注入 localStorage 实现（如 createSecureStorage({ persist: true })）。\n * - 临时数据（PKCE verifier / state / OIDC nonce / returnUrl / popup nonce）：必须跨整页重定向存活\n * （login() 会 302 跳转到 SSO 中心再回来），因此默认写入 sessionStorage；\n * SSR 等无 sessionStorage 环境自动降级为内存 Map。\n *\n * 多 client 隔离：\n * - token / state / return_url 均支持按 clientId 隔离 key\n * - 不传 clientId 时使用全局 key，保持向后兼容\n */\n\n/** Token 数据 */\nexport interface TokenData {\n access_token: string;\n token_type: string;\n expires_in: number;\n refresh_token: string;\n id_token?: string;\n\n /** Token 签发时间（epoch ms），用于计算过期 */\n issued_at: number;\n\n /** 访问令牌实际过期时间（epoch ms）= issued_at + expires_in * 1000 */\n expires_at: number;\n}\n\n/** 存储接口 */\nexport interface TokenStorage {\n get(key: string): string | null;\n set(key: string, value: string): void;\n remove(key: string): void;\n /**\n * 可选：枚举当前存储中的 key（不含 SDK 内部前缀）。\n * 供 clearAllSsoData() 清理 client 级残留（`token:<clientId>` 等）。\n * 自定义存储若不实现，clearAllSsoData() 仅能按已知 key 清理。\n */\n keys?(): string[];\n}\n\n/** 默认 localStorage/sessionStorage key 前缀 */\nconst STORAGE_PREFIX = \"nihplod_sso_\";\n\n/** 常量 key 名称 */\nconst TOKEN_KEY = \"token\";\nconst VERIFIER_KEY_PREFIX = \"pkce_verifier_\";\nconst STATE_KEY = \"oauth_state\";\nconst NONCE_KEY = \"oidc_nonce\";\nconst RETURN_URL_KEY = \"return_url\";\nconst LOGOUT_STATE_KEY = \"logout_state\";\n// 静默登录探测标记（prompt=none 发起的 authorize 请求所携带的 state）\nconst SILENT_PROBE_KEY = \"silent_probe\";\n\nfunction buildKey(base: string, clientId?: string): string {\n return clientId ? `${base}:${clientId}` : base;\n}\n\n/**\n * 浏览器 localStorage 实现\n *\n * 适用于：\n * - Next.js BFF / Confidential Client（refresh_token 不直接暴露给浏览器）。\n * - 需要多 Tab 共享 token 的场景。\n *\n * 注意：Public Client 在浏览器中直接存储 refresh_token 会增加 XSS 风险，\n * 建议改用内存存储或 Service Worker 封装。\n */\nconst localStorageAdapter: TokenStorage = {\n get(key: string) {\n try {\n if (typeof localStorage === \"undefined\") return null;\n return localStorage.getItem(STORAGE_PREFIX + key);\n } catch {\n // 沙箱 iframe / 禁用存储等场景访问 localStorage 会抛 SecurityError\n return null;\n }\n },\n set(key: string, value: string) {\n try {\n if (typeof localStorage === \"undefined\") return;\n localStorage.setItem(STORAGE_PREFIX + key, value);\n } catch (err) {\n // QuotaExceededError / SecurityError 等写入失败不应中断登录流程\n console.warn(\n `[SSO SDK] localStorage 写入失败（${err instanceof Error ? err.name : String(err)}），数据未持久化`\n );\n }\n },\n remove(key: string) {\n try {\n if (typeof localStorage === \"undefined\") return;\n localStorage.removeItem(STORAGE_PREFIX + key);\n } catch {\n // 忽略存储不可用\n }\n },\n keys() {\n try {\n if (typeof localStorage === \"undefined\") return [];\n const result: string[] = [];\n for (let i = 0; i < localStorage.length; i++) {\n const key = localStorage.key(i);\n if (key?.startsWith(STORAGE_PREFIX)) result.push(key.slice(STORAGE_PREFIX.length));\n }\n return result;\n } catch {\n return [];\n }\n },\n};\n\n/**\n * 浏览器 sessionStorage 实现\n *\n * 同时承担两个角色：\n * - Token 数据的默认存储：整页重定向（CallbackPage 默认行为）与页面刷新后\n * 登录态仍保留；sessionStorage 随标签页关闭自动清除，且不跨 Tab 共享，\n * 比 localStorage 缩小了 XSS 窃取 refresh_token 的暴露面。\n * - 临时数据（PKCE verifier / state / returnUrl / popup nonce）专用：\n * 必须跨整页重定向存活，不能放模块级内存。\n * SSR / 隐私模式写入失败时降级为内存 Map，保证不抛异常。\n */\nfunction createSessionStorageAdapter(): TokenStorage {\n const fallback = new Map<string, string>();\n return {\n get(key: string) {\n try {\n if (typeof sessionStorage !== \"undefined\") {\n return sessionStorage.getItem(STORAGE_PREFIX + key) ?? fallback.get(key) ?? null;\n }\n } catch {\n // 沙箱 iframe / 禁用存储：退化为内存 fallback\n }\n return fallback.get(key) ?? null;\n },\n set(key: string, value: string) {\n try {\n if (typeof sessionStorage !== \"undefined\") {\n sessionStorage.setItem(STORAGE_PREFIX + key, value);\n return;\n }\n } catch {\n // 隐私模式等场景写入失败时降级到内存\n }\n fallback.set(key, value);\n },\n remove(key: string) {\n fallback.delete(key);\n try {\n if (typeof sessionStorage === \"undefined\") return;\n sessionStorage.removeItem(STORAGE_PREFIX + key);\n } catch {\n // 忽略存储不可用\n }\n },\n keys() {\n const result = new Set<string>(fallback.keys());\n try {\n if (typeof sessionStorage !== \"undefined\") {\n for (let i = 0; i < sessionStorage.length; i++) {\n const key = sessionStorage.key(i);\n if (key?.startsWith(STORAGE_PREFIX)) result.add(key.slice(STORAGE_PREFIX.length));\n }\n }\n } catch {\n // 存储不可用：仅返回 fallback\n }\n return [...result];\n },\n };\n}\n\n/** 临时数据存储（跨整页重定向存活），独立于 token 存储，不受 setTokenStorage() 影响 */\nconst _transient: TokenStorage = createSessionStorageAdapter();\n\n/**\n * 创建存储实现\n *\n * @param options.persist 是否持久化到 localStorage。默认 false（sessionStorage）。\n * - false（默认）：sessionStorage，标签页级持久化（刷新/整页跳转后登录态保留，\n * 关闭标签页即清除），多 Tab 间不共享；隐私模式等写入失败时降级为内存。\n * - true：localStorage，多 Tab 共享、关闭浏览器后仍保留。\n * ⚠️ 安全警告：persist=true 会将 refresh_token 明文写入 localStorage，\n * 任何 XSS 均可在不被检测的情况下读取。仅在 BFF/Confidential Client\n * 且 refresh_token 不直接暴露给浏览器的场景下使用。\n */\nexport function createSecureStorage(options: { persist?: boolean } = {}): TokenStorage {\n return options.persist ? localStorageAdapter : createSessionStorageAdapter();\n}\n\n/**\n * 默认 token 存储：sessionStorage（标签页级持久化），SSR/隐私模式降级为内存。\n * 可通过 setTokenStorage() 覆盖。\n */\nlet _storage: TokenStorage = createSessionStorageAdapter();\n\n/**\n * 设置自定义存储实现\n */\nexport function setTokenStorage(storage: TokenStorage): void {\n _storage = storage;\n}\n\n/**\n * 获取当前存储实现\n */\nexport function getTokenStorage(): TokenStorage {\n return _storage;\n}\n\n// ============================================\n// Token 存取\n// ============================================\n\nexport function saveTokenData(data: TokenData, clientId?: string): void {\n _storage.set(buildKey(TOKEN_KEY, clientId), JSON.stringify(data));\n}\n\nexport function getTokenData(clientId?: string): TokenData | null {\n const raw = _storage.get(buildKey(TOKEN_KEY, clientId));\n if (!raw) return null;\n try {\n // 过期不物理删除：refresh_token 通常比 access_token 长寿，\n // 删除会同时丢弃 refresh_token 使刷新路径失效。\n // 是否过期由调用方依据 expires_at 判断（isAuthenticated / getUserInfo 等）。\n return JSON.parse(raw) as TokenData;\n } catch {\n return null;\n }\n}\n\nexport function removeTokenData(clientId?: string): void {\n _storage.remove(buildKey(TOKEN_KEY, clientId));\n}\n\n// ============================================\n// PKCE 临时数据存取（transient：sessionStorage，跨整页重定向存活）\n// ============================================\n\nexport function savePkceVerifier(clientId: string, verifier: string): void {\n _transient.set(VERIFIER_KEY_PREFIX + clientId, verifier);\n}\n\nexport function getPkceVerifier(clientId: string): string | null {\n return _transient.get(VERIFIER_KEY_PREFIX + clientId);\n}\n\nexport function removePkceVerifier(clientId: string): void {\n _transient.remove(VERIFIER_KEY_PREFIX + clientId);\n}\n\n// ============================================\n// State 参数存取（transient）\n// ============================================\n\nexport function saveOAuthState(state: string, clientId?: string): void {\n _transient.set(buildKey(STATE_KEY, clientId), state);\n}\n\nexport function getOAuthState(clientId?: string): string | null {\n return _transient.get(buildKey(STATE_KEY, clientId));\n}\n\nexport function removeOAuthState(clientId?: string): void {\n _transient.remove(buildKey(STATE_KEY, clientId));\n}\n\n// ============================================\n// OIDC nonce 存取（transient，ID Token 重放防护）\n// ============================================\n\nexport function saveOAuthNonce(nonce: string, clientId?: string): void {\n _transient.set(buildKey(NONCE_KEY, clientId), nonce);\n}\n\nexport function getOAuthNonce(clientId?: string): string | null {\n return _transient.get(buildKey(NONCE_KEY, clientId));\n}\n\nexport function removeOAuthNonce(clientId?: string): void {\n _transient.remove(buildKey(NONCE_KEY, clientId));\n}\n\n// ============================================\n// Logout State 存取（transient，RP-Initiated Logout CSRF 防护）\n// ============================================\n\nexport function saveLogoutState(state: string, clientId?: string): void {\n _transient.set(buildKey(LOGOUT_STATE_KEY, clientId), state);\n}\n\nexport function getLogoutState(clientId?: string): string | null {\n return _transient.get(buildKey(LOGOUT_STATE_KEY, clientId));\n}\n\nexport function removeLogoutState(clientId?: string): void {\n _transient.remove(buildKey(LOGOUT_STATE_KEY, clientId));\n}\n\n// ============================================\n// 返回 URL 存取（transient）\n// ============================================\nexport function saveReturnUrl(url: string, clientId?: string): void {\n _transient.set(buildKey(RETURN_URL_KEY, clientId), url);\n}\n\nexport function getReturnUrl(clientId?: string): string | null {\n return _transient.get(buildKey(RETURN_URL_KEY, clientId));\n}\n\nexport function removeReturnUrl(clientId?: string): void {\n _transient.remove(buildKey(RETURN_URL_KEY, clientId));\n}\n\n// ============================================\n// 静默登录探测标记存取（transient，prompt=none）\n// ============================================\n// 存的是该次探测 authorize 请求的 state 值，回调时用于匹配\n// （只有 state 与标记一致才按\"探测无会话\"处理，防伪造回调）\n\nexport function saveSilentProbe(state: string, clientId?: string): void {\n _transient.set(buildKey(SILENT_PROBE_KEY, clientId), state);\n}\n\nexport function getSilentProbe(clientId?: string): string | null {\n return _transient.get(buildKey(SILENT_PROBE_KEY, clientId));\n}\n\nexport function removeSilentProbe(clientId?: string): void {\n _transient.remove(buildKey(SILENT_PROBE_KEY, clientId));\n}\n\n// ============================================\n// 清理所有 SSO 数据\n// ============================================\n\nexport function clearAllSsoData(clientId?: string): void {\n if (clientId) {\n removeTokenData(clientId);\n removeOAuthState(clientId);\n removeOAuthNonce(clientId);\n removeReturnUrl(clientId);\n removeLogoutState(clientId);\n removeSilentProbe(clientId);\n removePkceVerifier(clientId);\n // popup nonce 复用 verifier key 空间（`${clientId}_popup_nonce`）\n removePkceVerifier(`${clientId}_popup_nonce`);\n return;\n }\n\n removeTokenData();\n removeOAuthState();\n removeOAuthNonce();\n removeReturnUrl();\n removeLogoutState();\n removeSilentProbe();\n\n // 无参调用必须清理全部 client 级残留（token:<clientId>、oauth_state:<clientId>、\n // oidc_nonce:<clientId>、return_url:<clientId>、pkce_verifier_<clientId> 等）。\n // 枚举浏览器存储中所有带前缀的 key：从原生存储、临时数据存储与 token 存储同时移除，\n // 且访问存储属性本身也要 try/catch（沙箱 iframe 下会抛 SecurityError）。\n const stores: Storage[] = [];\n try {\n if (typeof sessionStorage !== \"undefined\") stores.push(sessionStorage);\n } catch {\n /* 存储不可用 */\n }\n try {\n if (typeof localStorage !== \"undefined\") stores.push(localStorage);\n } catch {\n /* 存储不可用 */\n }\n\n const abstractKeys = new Set<string>();\n for (const store of stores) {\n const keys: string[] = [];\n try {\n for (let i = 0; i < store.length; i++) {\n const key = store.key(i);\n if (key?.startsWith(STORAGE_PREFIX)) keys.push(key);\n }\n } catch {\n continue;\n }\n for (const key of keys) {\n abstractKeys.add(key.slice(STORAGE_PREFIX.length));\n try {\n store.removeItem(key);\n } catch {\n /* 忽略 */\n }\n }\n }\n\n // 适配器级枚举：覆盖自定义 TokenStorage / 内存 fallback 中的 client 级 key\n // （这些 key 不在浏览器存储中，仅靠上方枚举无法发现）\n for (const store of [_transient, _storage]) {\n try {\n for (const key of store.keys?.() ?? []) abstractKeys.add(key);\n } catch {\n /* 忽略自定义实现异常 */\n }\n }\n\n for (const key of abstractKeys) {\n _transient.remove(key);\n _storage.remove(key);\n }\n}\n\n/**\n * 清理指定 clientId 列表的 PKCE verifier\n *\n * 适用于非浏览器环境或已知 clientId 场景。\n */\nexport function clearVerifiersForClients(clientIds: string[]): void {\n for (const clientId of clientIds) {\n _transient.remove(VERIFIER_KEY_PREFIX + clientId);\n }\n}\n","/**\n * 安全相关小工具：returnUrl 开放重定向校验、常量时间字符串比较\n */\n\n/**\n * 反斜杠或 ASCII 控制字符（tab/newline/CR/DEL）。\n * WHATWG URL 解析会在解析前剥离 TAB/LF/CR，并把 \"\\\" 归一化为 \"/\"，\n * 因此 \"/\\evil.com\"、\"/\\n//evil.com\" 能通过字符串前缀判断后变成跨站 URL。\n */\nconst UNSAFE_URL_CHAR_PATTERN = /[\\\\\\u0000-\\u001F\\u007F]/;\n\n/**\n * 校验 returnUrl 是否可信（防开放重定向）。\n * 仅允许：\n * - 站内相对路径（以单个 \"/\" 开头且不以 \"//\" 开头）\n * - 与 currentOrigin 完全同源的 http(s) 绝对 URL\n * 拒绝一切含反斜杠/控制字符的值（浏览器会将 \"/\\evil.com\" 解析为跨站 URL），\n * 拒绝 userinfo 与危险 scheme。\n */\nexport function isTrustedReturnUrl(url: string, currentOrigin: string): boolean {\n if (!url) return false;\n if (UNSAFE_URL_CHAR_PATTERN.test(url)) return false;\n if (url.startsWith(\"//\")) return false;\n if (url.startsWith(\"/\")) return true;\n try {\n const parsed = new URL(url);\n if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") return false;\n if (parsed.username || parsed.password) return false;\n return parsed.origin === currentOrigin;\n } catch {\n return false;\n }\n}\n\n/**\n * 常量时间字符串比较（避免 state / at_hash / nonce 等机密值的时序侧信道）。\n * 长度不同也执行完整循环，不提前返回。\n */\nexport function timingSafeEqualString(a: string, b: string): boolean {\n const ba = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (ba.length === 0 || bb.length === 0) return ba.length === bb.length;\n const len = Math.max(ba.length, bb.length);\n let diff = ba.length ^ bb.length;\n for (let i = 0; i < len; i++) {\n diff |= ba[i % ba.length] ^ bb[i % bb.length];\n }\n return diff === 0;\n}\n","/**\r\n * ID Token 验证工具（浏览器 / Edge Runtime 通用）\r\n *\r\n * 提取 SsoClient 与 Next.js callback 中重复的 ID Token 校验逻辑，\r\n * 包括 base64url 解码、JWKS 获取、RS256 签名验证、at_hash 计算等。\r\n */\r\n\r\nimport { SsoError } from \"./errors\";\r\nimport { timingSafeEqualString } from \"./security\";\r\n\r\n// 运行时 crypto.subtle 检测：现代浏览器 / Edge Runtime / Node 20+ 均提供全局 crypto\r\nconst _crypto: Pick<Crypto, \"subtle\"> | null =\r\n typeof crypto !== \"undefined\" && (crypto as Crypto).subtle ? (crypto as Crypto) : null;\r\n\r\nfunction getCrypto(): Crypto | null {\r\n return (_crypto as Crypto | null) ?? null;\r\n}\r\n\r\nexport interface JwksKey {\r\n kty: string;\r\n kid?: string;\r\n alg?: string;\r\n use?: string;\r\n n?: string;\r\n e?: string;\r\n x5c?: string[];\r\n}\r\n\r\nexport interface Jwks {\r\n keys: JwksKey[];\r\n}\r\n\r\nexport interface ValidateIdTokenResult {\r\n sub: string;\r\n}\r\n\r\nexport interface ValidateIdTokenOptions {\r\n /**\r\n * 发现 SSO 中心已启用 RS256 时，是否拒绝 HS256 ID Token。\r\n * 默认 true：只要 JWKS 中存在 RS256 签名密钥，就拒绝 HS256（安全推荐）。\r\n *\r\n * @deprecated 无实际作用：HS256 ID Token 一律被拒绝（对称密钥无法安全分发给\r\n * Public Client / BFF），该选项只影响走哪条抛错路径\r\n * （id_token_unsupported_alg 或 id_token_hs256_unsupported），\r\n * 不影响最终结果。保留仅为避免破坏 API，请勿依赖；将于未来大版本移除。\r\n */\r\n rejectHs256WhenRs256Available?: boolean;\r\n /**\r\n * 期望的 OIDC nonce（login 时生成并随 authorize 请求发送）。\r\n * 传入后 ID Token 必须携带 nonce claim 且与该值常量时间相等（fail-closed），\r\n * 否则抛出 id_token_nonce_mismatch，防止 ID Token 重放。\r\n * 不传时（如 refresh 流程）：ID Token 若仍携带 nonce 会被拒绝（OIDC Core §12.2，\r\n * refresh 签发的 ID Token 不得携带 nonce），否则跳过 nonce 校验。\r\n */\r\n expectedNonce?: string;\r\n}\r\n\r\nfunction base64UrlDecode(input: string): Uint8Array {\r\n const base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\r\n const binary = atob(padded);\r\n const bytes = new Uint8Array(binary.length);\r\n for (let i = 0; i < binary.length; i++) {\r\n bytes[i] = binary.charCodeAt(i);\r\n }\r\n return bytes;\r\n}\r\n\r\n/** 解码 JWT payload（不验证签名） */\r\nexport function decodeJwtPayload(token: string): Record<string, unknown> | null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[1]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 解码 JWT header */\r\nexport function decodeJwtHeader(token: string): Record<string, unknown> | null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[0]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 标准化 issuer/base URL，去除末尾斜杠 */\r\nfunction normalizeIssuer(url: string): string {\r\n return url.replace(/\\/+$/, \"\");\r\n}\r\n\r\n/** OIDC Discovery 文档（仅取本模块关心的字段） */\r\nexport interface OidcDiscoveryDoc {\r\n issuer?: string;\r\n jwks_uri?: string;\r\n}\r\n\r\nlet cachedJwks: { baseUrl: string; jwks: Jwks; fetchedAt: number } | null = null;\r\nlet cachedDiscovery: { baseUrl: string; doc: OidcDiscoveryDoc; fetchedAt: number } | null = null;\r\nconst JWKS_CACHE_TTL_MS = 5 * 60 * 1000;\r\n/** discovery / JWKS 拉取超时（与 SsoClient._getDiscovery 的 10s 一致） */\r\nconst FETCH_TIMEOUT_MS = 10000;\r\n\r\n/**\r\n * 拉取 OIDC Discovery 文档（带内存缓存；失败返回 null 不抛错）\r\n *\r\n * 只缓存成功结果：失败（网络错误 / 非 2xx）不缓存，主站短暂抖动不会让\r\n * 登录持续失败到 TTL 期满，下一次调用立即重试（与 core/discovery.ts 策略一致）。\r\n */\r\nexport async function fetchDiscoveryDoc(baseUrl: string): Promise<OidcDiscoveryDoc | null> {\r\n const now = Date.now();\r\n if (cachedDiscovery && cachedDiscovery.baseUrl === baseUrl && now - cachedDiscovery.fetchedAt < JWKS_CACHE_TTL_MS) {\r\n return cachedDiscovery.doc;\r\n }\r\n\r\n try {\r\n const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`, {\r\n signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\r\n });\r\n if (!res.ok) return null;\r\n const doc = (await res.json()) as OidcDiscoveryDoc;\r\n cachedDiscovery = { baseUrl, doc, fetchedAt: now };\r\n return doc;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\nexport interface FetchJwksOptions {\r\n /**\r\n * 绕过内存缓存与浏览器 HTTP 缓存（cache: \"no-cache\"）强制重取 JWKS，\r\n * 并同步刷新模块级缓存。用于密钥轮换后 kid 失配的自愈重试。\r\n */\r\n forceRefresh?: boolean;\r\n}\r\n\r\n/** 从 SSO 中心拉取 JWKS（带内存缓存；优先 Discovery 的 jwks_uri，回退硬编码路径） */\r\nexport async function fetchJwks(baseUrl: string, options: FetchJwksOptions = {}): Promise<Jwks | null> {\r\n const now = Date.now();\r\n if (!options.forceRefresh && cachedJwks && cachedJwks.baseUrl === baseUrl && now - cachedJwks.fetchedAt < JWKS_CACHE_TTL_MS) {\r\n return cachedJwks.jwks;\r\n }\r\n\r\n const discovery = await fetchDiscoveryDoc(baseUrl);\r\n // Discovery 文档中的 jwks_uri 必须与 baseUrl 同源：否则被篡改的文档可把验签公钥\r\n // 指向攻击者服务器，从而伪造任意 ID Token。跨源 JWKS 请由服务端显式代理。\r\n let jwksUri = `${baseUrl}/api/oauth/jwks`;\r\n if (discovery?.jwks_uri) {\r\n try {\r\n if (new URL(discovery.jwks_uri).origin === new URL(baseUrl).origin) {\r\n jwksUri = discovery.jwks_uri;\r\n } else {\r\n console.warn(\r\n \"[SSO SDK] Discovery 的 jwks_uri 与 ssoBaseUrl 不同源，已忽略并使用默认 JWKS 端点\"\r\n );\r\n }\r\n } catch {\r\n // 非法 URL：使用默认端点\r\n }\r\n }\r\n\r\n try {\r\n const res = await fetch(jwksUri, {\r\n signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\r\n ...(options.forceRefresh ? { cache: \"no-cache\" as RequestCache } : {}),\r\n });\r\n if (!res.ok) return null;\r\n const jwks = (await res.json()) as Jwks;\r\n cachedJwks = { baseUrl, jwks, fetchedAt: now };\r\n return jwks;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 清空 JWKS / Discovery 内存缓存（测试与密钥轮换场景使用） */\r\nexport function clearIdTokenCaches(): void {\r\n cachedJwks = null;\r\n cachedDiscovery = null;\r\n}\r\n\r\n/** 使用 RS256 公钥验证 ID Token 签名 */\r\nexport async function verifyRs256Signature(token: string, jwk: JwksKey): Promise<boolean> {\r\n try {\r\n const [headerB64, payloadB64, signature] = token.split(\".\");\r\n if (!signature || !jwk.n || !jwk.e) return false;\r\n\r\n const c = getCrypto();\r\n if (!c) return false;\r\n\r\n const cryptoKey = await c.subtle.importKey(\r\n \"jwk\",\r\n { kty: \"RSA\", n: jwk.n, e: jwk.e, alg: \"RS256\", ext: false },\r\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\r\n false,\r\n [\"verify\"]\r\n );\r\n\r\n const signatureBytes = base64UrlDecode(signature);\r\n const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\r\n return await c.subtle.verify(\r\n \"RSASSA-PKCS1-v1_5\",\r\n cryptoKey,\r\n signatureBytes as unknown as BufferSource,\r\n data as unknown as BufferSource\r\n );\r\n } catch {\r\n return false;\r\n }\r\n}\r\n\r\n/** 计算 OIDC at_hash（access_token SHA-256 前 128bit base64url） */\r\nexport async function computeAtHash(accessToken: string): Promise<string> {\r\n const c = getCrypto();\r\n if (!c) return \"\";\r\n const hash = await c.subtle.digest(\"SHA-256\", new TextEncoder().encode(accessToken));\r\n const bytes = new Uint8Array(hash);\r\n const half = bytes.slice(0, bytes.length / 2);\r\n let binary = \"\";\r\n for (const b of half) {\r\n binary += String.fromCharCode(b);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/** 验证 ID Token（iss、aud、exp、iat、azp、sub、签名、at_hash） */\r\nexport async function validateIdToken(\r\n idToken: string,\r\n accessToken: string,\r\n expectedIssuer: string,\r\n expectedClientId: string,\r\n options: ValidateIdTokenOptions = {}\r\n): Promise<ValidateIdTokenResult> {\r\n const { rejectHs256WhenRs256Available = true, expectedNonce } = options;\r\n\r\n const header = decodeJwtHeader(idToken);\r\n if (!header) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token 格式错误\");\r\n }\r\n\r\n const alg = header.alg;\r\n if (typeof alg !== \"string\" || (alg !== \"RS256\" && alg !== \"HS256\")) {\r\n throw new SsoError(\"id_token_unsupported_alg\", `不支持的 ID Token 签名算法: ${alg}`);\r\n }\r\n\r\n const baseUrl = normalizeIssuer(expectedIssuer);\r\n // issuer 以 Discovery 文档的 issuer 为准（防伪站伪造 iss 通过校验），回退调用方传入值\r\n const discovery = await fetchDiscoveryDoc(baseUrl);\r\n const normalizedIssuer = normalizeIssuer(discovery?.issuer || baseUrl);\r\n\r\n // RS256：通过 JWKS 验证签名\r\n if (alg === \"RS256\") {\r\n const jwks = await fetchJwks(baseUrl);\r\n if (!jwks) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"无法获取 JWKS 验证 ID Token 签名\");\r\n }\r\n const kid = typeof header.kid === \"string\" ? header.kid : undefined;\r\n // 有 kid 时精确匹配；无 kid 时逐个尝试所有 RS256 签名公钥\r\n const matchCandidates = (set: Jwks) =>\r\n set.keys.filter(\r\n (k) =>\r\n k.kty === \"RSA\" &&\r\n k.alg === \"RS256\" &&\r\n k.use === \"sig\" &&\r\n (kid ? k.kid === kid : true)\r\n );\r\n const verifyAny = async (keys: JwksKey[]): Promise<boolean> => {\r\n for (const key of keys) {\r\n if (await verifyRs256Signature(idToken, key)) return true;\r\n }\r\n return false;\r\n };\r\n\r\n let candidates = matchCandidates(jwks);\r\n let validSig = candidates.length > 0 ? await verifyAny(candidates) : false;\r\n\r\n // 密钥轮换自愈：按 kid 过滤无候选，或所有候选验签失败时，\r\n // 可能是本地 JWKS 缓存陈旧 —— 强制重取一次 JWKS 后重试，仍失败才抛错\r\n if (candidates.length === 0 || !validSig) {\r\n const freshJwks = await fetchJwks(baseUrl, { forceRefresh: true });\r\n if (freshJwks) {\r\n candidates = matchCandidates(freshJwks);\r\n validSig = candidates.length > 0 ? await verifyAny(candidates) : false;\r\n }\r\n }\r\n\r\n if (candidates.length === 0) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"JWKS 中未找到匹配的 RS256 公钥\");\r\n }\r\n if (!validSig) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"ID Token 签名验证失败\");\r\n }\r\n }\r\n\r\n // HS256：对称密钥无法安全分发给 Public Client / BFF。\r\n // SDK 拒绝 HS256 ID Token：主站需配置 RS256 密钥对以启用安全验证。\r\n if (alg === \"HS256\") {\r\n if (rejectHs256WhenRs256Available) {\r\n const jwks = await fetchJwks(baseUrl);\r\n const hasRs256 = jwks?.keys?.some((k) => k.alg === \"RS256\" && k.use === \"sig\");\r\n if (hasRs256) {\r\n throw new SsoError(\"id_token_unsupported_alg\", \"SSO 中心已配置 RS256，拒绝 HS256 ID Token\");\r\n }\r\n }\r\n throw new SsoError(\r\n \"id_token_hs256_unsupported\",\r\n \"ID Token 使用 HS256 对称签名，SDK 无法安全验证。\" +\r\n \"请联系管理员在 SSO 主站配置 RS256 密钥对（JWT_ID_TOKEN_PRIVATE_KEY / JWT_ID_TOKEN_PUBLIC_KEY）后重新签发。\"\r\n );\r\n }\r\n\r\n const payload = decodeJwtPayload(idToken);\r\n if (!payload) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token payload 解析失败\");\r\n }\r\n\r\n const tokenIssuer = typeof payload.iss === \"string\" ? normalizeIssuer(payload.iss) : \"\";\r\n if (tokenIssuer !== normalizedIssuer) {\r\n throw new SsoError(\"id_token_issuer_mismatch\", \"ID Token issuer 不匹配\");\r\n }\r\n\r\n // aud 校验：单值或数组包含 clientId；多 aud 时按 OIDC Core §3.1.3.7 要求 azp 必须等于 clientId\r\n const aud = payload.aud;\r\n const audList = Array.isArray(aud) ? aud : typeof aud === \"string\" ? [aud] : [];\r\n if (!audList.includes(expectedClientId)) {\r\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token audience 不匹配\");\r\n }\r\n if (audList.length > 1 && payload.azp !== expectedClientId) {\r\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token 多 audience 时 azp 必须为当前 client\");\r\n }\r\n\r\n // exp 必需且不得过期（允许 60s clock skew，与 iat 校验对称）\r\n if (typeof payload.exp !== \"number\") {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token 缺少 exp 声明\");\r\n }\r\n if (Date.now() >= payload.exp * 1000 + 60_000) {\r\n throw new SsoError(\"id_token_expired\", \"ID Token 已过期\");\r\n }\r\n\r\n // iat 必需（OIDC Core §2：ID Token 必须包含 iat）且不得在未来（允许 60s clock skew）\r\n if (typeof payload.iat !== \"number\") {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token 缺少 iat 声明\");\r\n }\r\n if (payload.iat * 1000 > Date.now() + 60_000) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token iat 在未来，疑似伪造或时钟异常\");\r\n }\r\n\r\n if (typeof payload.sub !== \"string\" || !payload.sub) {\r\n throw new SsoError(\"id_token_missing_sub\", \"ID Token 缺少 sub\");\r\n }\r\n\r\n // 校验 at_hash：确保 ID Token 与当前 access_token 绑定（常量时间比较）\r\n if (typeof payload.at_hash === \"string\" && payload.at_hash) {\r\n const actual = await computeAtHash(accessToken);\r\n if (!timingSafeEqualString(actual, payload.at_hash)) {\r\n throw new SsoError(\"id_token_at_hash_mismatch\", \"ID Token at_hash 不匹配\");\r\n }\r\n }\r\n\r\n // 校验 nonce（OIDC Core §3.1.3.7）：调用方传入 expectedNonce 时 fail-closed，\r\n // ID Token 必须携带 nonce 且与登录时生成的值常量时间相等，防 ID Token 重放。\r\n // 未传 expectedNonce（如本地 nonce cookie 已被清除/过期）但 ID Token 携带 nonce\r\n // 时同样拒绝（OIDC Core §12.2）：该 token 声称绑定某次登录会话，本地却无法核对，\r\n // 可能是非本次登录签发的重放 token。refresh 签发的 ID Token 按规范不携带 nonce，\r\n // 不受影响（refresh 流程不传 expectedNonce 且 token 无 nonce claim）。\r\n if (expectedNonce !== undefined) {\r\n const tokenNonce = typeof payload.nonce === \"string\" ? payload.nonce : \"\";\r\n if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {\r\n throw new SsoError(\"id_token_nonce_mismatch\", \"ID Token nonce 不匹配\");\r\n }\r\n } else if (typeof payload.nonce === \"string\" && payload.nonce) {\r\n throw new SsoError(\r\n \"id_token_nonce_mismatch\",\r\n \"ID Token 携带 nonce 但本地无期望值（可能非本次登录会话签发）\"\r\n );\r\n }\r\n\r\n return { sub: payload.sub };\r\n}\r\n","/**\n * 网络请求工具：带超时的 fetch（AbortController）\n *\n * 内部模块：不从包入口导出（core/SsoClient 与 next/callback 共用）。\n */\n\n/** token / userinfo 请求默认超时（毫秒）：避免回调页/登录流程无限挂起 */\nexport const REQUEST_TIMEOUT_MS = 10_000;\n\n/** 带超时的 fetch（AbortController）；超时抛 AbortError（调用方按网络错误处理） */\nexport async function fetchWithTimeout(\n input: RequestInfo | URL,\n init: RequestInit = {},\n timeoutMs: number = REQUEST_TIMEOUT_MS\n): Promise<Response> {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n try {\n return await fetch(input, { ...init, signal: controller.signal });\n } finally {\n clearTimeout(timer);\n }\n}\n","/**\r\n * SSO Client 核心类\r\n *\r\n * 封装完整的 OAuth 2.0 授权码 + PKCE S256 流程：\r\n * - login(): 发起授权请求\r\n * - handleCallback(): 处理回调，交换 token\r\n * - refreshToken(): 刷新 access token（原子轮换）\r\n * - getUserInfo(): 获取用户信息\r\n * - logout(): 登出\r\n * - isAuthenticated(): 检查认证状态\r\n */\r\n\r\nimport { SsoError, mapOAuthErrorToSsoCode } from \"./errors\";\r\nimport { generateCodeVerifier, generateCodeChallenge, generateState } from \"./pkce\";\r\nimport {\r\n saveTokenData,\r\n getTokenData,\r\n removeTokenData,\r\n savePkceVerifier,\r\n getPkceVerifier,\r\n removePkceVerifier,\r\n saveOAuthState,\r\n getOAuthState,\r\n removeOAuthState,\r\n saveOAuthNonce,\r\n getOAuthNonce,\r\n removeOAuthNonce,\r\n saveLogoutState,\r\n getLogoutState,\r\n removeLogoutState,\r\n saveReturnUrl,\r\n saveSilentProbe,\r\n getSilentProbe,\r\n removeSilentProbe,\r\n clearAllSsoData,\r\n type TokenData,\r\n} from \"./storage\";\r\nimport { validateIdToken } from \"./id-token\";\r\nimport { isTrustedReturnUrl, timingSafeEqualString } from \"./security\";\r\nimport { fetchWithTimeout } from \"./http\";\r\n\r\n// ============================================\r\n// 网络请求超时\r\n// ============================================\r\n\r\n// fetchWithTimeout（默认超时 10s）已收敛到 ./http（与 next/callback 共用）\r\n/** revoke 为 best-effort，短超时避免登出等待过久 */\r\nconst REVOKE_TIMEOUT_MS = 3_000;\r\n/**\r\n * 过期判定提前量（毫秒）：getAccessToken/getUserInfo 在 token 剩余有效期\r\n * 不足 10s 时即触发刷新，避免拿到的 token 在请求到达服务端时已过期\r\n */\r\nconst EXPIRY_SKEW_MS = 10_000;\r\n\r\n// ============================================\r\n// 类型定义\r\n// ============================================\r\n\r\n/**\r\n * Token 响应基本字段的防御性校验（fail-closed）。\r\n *\r\n * - access_token 必须为非空字符串；\r\n * - expires_in 必须为有限正数——否则 expires_at = NaN，本地会永久判定过期\r\n * （每次 getAccessToken/getUserInfo 都触发刷新），且刷新后仍写回 NaN；\r\n * - requireRefreshToken=true 时 refresh_token 必须为非空字符串：\r\n * 主站 authorization_code 交换必然签发 refresh_token（refresh 场景按\r\n * RFC 6749 §6 允许省略，调用方已做沿用旧值的回退），缺失即响应异常。\r\n */\r\nfunction assertValidTokenResponse(data: TokenResponse, requireRefreshToken: boolean): void {\r\n if (typeof data.access_token !== \"string\" || !data.access_token) {\r\n throw new SsoError(\"token_request_failed\", \"Token 响应缺少 access_token\");\r\n }\r\n if (\r\n typeof data.expires_in !== \"number\" ||\r\n !Number.isFinite(data.expires_in) ||\r\n data.expires_in <= 0\r\n ) {\r\n throw new SsoError(\r\n \"token_request_failed\",\r\n `Token 响应 expires_in 非法: ${String(data.expires_in)}`\r\n );\r\n }\r\n if (requireRefreshToken && (typeof data.refresh_token !== \"string\" || !data.refresh_token)) {\r\n throw new SsoError(\r\n \"token_request_failed\",\r\n \"Token 响应缺少 refresh_token（authorization_code 交换必须返回）\"\r\n );\r\n }\r\n}\r\n\r\n/** SSO 客户端配置 */\r\nexport interface SsoClientConfig {\r\n /** OAuth Client ID（从管理后台获取） */\r\n clientId: string;\r\n\r\n /** OAuth Client Secret（从管理后台获取）\r\n *\r\n * ⚠️ 安全提醒：client_secret 不应暴露在前端代码中。\r\n * 对于浏览器端 SPA（Public Client），应省略此字段；SDK 会使用 PKCE 完成授权，\r\n * 且 token 端点不会发送 client_secret。\r\n * 对于 BFF/Next.js 等 Confidential Client，可传入 client_secret。\r\n */\r\n clientSecret?: string;\r\n\r\n /** 回调 URL（必须与注册的 redirect_uri 完全一致） */\r\n redirectUri: string;\r\n\r\n /** SSO 中心地址，如 \"https://nihplod.cn\" */\r\n ssoBaseUrl: string;\r\n\r\n /**\r\n * 允许 Discovery 文档声明跨源端点（默认 false）。\r\n *\r\n * ⚠️ 安全警告：Discovery 文档若被篡改（如中间人/反向代理劫持），攻击者可把\r\n * token_endpoint 指向自己的服务器窃取 authorization code / refresh_token。\r\n * SDK 默认校验 authorization_endpoint 必须与 ssoBaseUrl 同源、\r\n * token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl（或 serverBaseUrl）同源，\r\n * 不匹配时告警并回退到默认端点。仅当 SSO 中心确实把端点托管在其他域名时\r\n * 才设置此开关，并自行确保 Discovery 通道可信。\r\n */\r\n allowCrossOriginDiscoveryEndpoints?: boolean;\r\n\r\n /** 请求的 scope（空格分隔），如 \"openid profile phone\" */\r\n scopes?: string;\r\n\r\n /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */\r\n postLogoutRedirectUri?: string;\r\n\r\n /**\r\n * 调试日志开关（默认 false）。开启后输出登录/回调/刷新/登出等关键流程日志，\r\n * 便于接入方定位问题（生产默认关闭，避免日志噪音）。\r\n */\r\n debug?: boolean;\r\n\r\n /**\r\n * 服务端到服务端调用的内网地址（可选，如 http://127.0.0.1:3000）。\r\n * 仅用于 discovery / token / userinfo / revocation 等服务器间请求；\r\n * 浏览器跳转（authorize、end-session）始终使用 ssoBaseUrl 公网地址。\r\n * 仅在 BFF/服务端场景配置；浏览器端（Public Client）不要配置。\r\n */\r\n serverBaseUrl?: string;\r\n}\r\n\r\n/** 用户信息 */\r\nexport interface SsoUser {\r\n sub: string;\r\n nickname?: string;\r\n avatar?: string;\r\n /** 手机号（脱敏，兼容保留的非标准 claim，新代码请使用 phone_number） */\r\n phone?: string;\r\n /** 手机号（脱敏，OIDC 标准 claim，与 phone 内容一致） */\r\n phone_number?: string;\r\n /** 生日（ISO 8601，需 birthday scope，未设置时为 null） */\r\n birthday?: string | null;\r\n membership_level?: string;\r\n /** 累计消费金额（单位：元，需 membership scope，与 membership_level 同源下发） */\r\n total_spent?: number;\r\n total_points?: number;\r\n}\r\n\r\n/** login() / getLoginUrl() 选项 */\r\nexport interface LoginOptions {\r\n /**\r\n * OIDC prompt 参数：\r\n * - \"none\"：静默探测 SSO 会话。用户在 IdP 有会话时直接回跳完成登录；\r\n * 无会话时 IdP 回跳 error=login_required（或 consent_required /\r\n * interaction_required），handleCallback() 识别后返回 null 而不抛错\r\n * （CallbackPage 默认跳回 returnUrl 并附 sso_probe=no_session）。\r\n * ⚠️ 不要在页面加载时自动探测（会打扰无会话用户并消耗请求），\r\n * 应由用户点击等明确动作触发。\r\n * - \"login\"：强制重新认证；\r\n * - \"consent\"：强制重新授权确认。\r\n */\r\n prompt?: \"none\" | \"login\" | \"consent\";\r\n}\r\n\r\n/** prompt=none 静默探测失败时 IdP 回跳的 error 值（OIDC Core §3.1.2.6） */\r\nconst SILENT_PROBE_ERRORS = new Set([\"login_required\", \"consent_required\", \"interaction_required\"]);\r\n\r\n/** Token 响应 */\r\nexport interface TokenResponse {\r\n access_token: string;\r\n token_type: string;\r\n expires_in: number;\r\n /**\r\n * authorization_code 交换主站必然返回（缺失时 handleCallback 抛\r\n * token_request_failed）；refresh 响应按 RFC 6749 §6 可省略，\r\n * 此时 SDK 沿用旧 refresh_token。\r\n */\r\n refresh_token: string;\r\n id_token?: string;\r\n}\r\n\r\n/** OIDC Discovery 文档 */\r\nexport interface OidcDiscovery {\r\n issuer: string;\r\n authorization_endpoint: string;\r\n token_endpoint: string;\r\n userinfo_endpoint: string;\r\n jwks_uri: string;\r\n introspection_endpoint: string;\r\n revocation_endpoint?: string;\r\n end_session_endpoint?: string;\r\n scopes_supported: string[];\r\n response_types_supported: string[];\r\n grant_types_supported: string[];\r\n code_challenge_methods_supported: string[];\r\n}\r\n\r\n// ============================================\r\n// SsoClient\r\n// ============================================\r\n\r\nexport class SsoClient {\r\n public readonly config: SsoClientConfig;\r\n /** 服务器间调用的基准地址（未配置 serverBaseUrl 时等于 ssoBaseUrl） */\r\n private readonly _serverBase: string;\r\n private _discovery: OidcDiscovery | null = null;\r\n private _discoveryFetchedAt: number = 0;\r\n private _refreshLock: Promise<TokenData> | null = null;\r\n /** Discovery 端点 origin 校验失败只告警一次（拒绝的文档不缓存，避免每次调用刷屏） */\r\n private _discoveryOriginWarned = false;\r\n\r\n /** Discovery 文档缓存 TTL（5 分钟） */\r\n private static readonly DISCOVERY_TTL_MS = 5 * 60 * 1000;\r\n\r\n /** Discovery fetch 超时（10 秒） */\r\n private static readonly DISCOVERY_TIMEOUT_MS = 10000;\r\n\r\n constructor(config: SsoClientConfig) {\r\n if (!config.clientId) throw new SsoError(\"invalid_config\", \"clientId 不能为空\");\r\n if (!config.redirectUri) throw new SsoError(\"invalid_config\", \"redirectUri 不能为空\");\r\n if (!config.ssoBaseUrl) throw new SsoError(\"invalid_config\", \"ssoBaseUrl 不能为空\");\r\n\r\n // 规范化 ssoBaseUrl：移除末尾斜杠\r\n const base = config.ssoBaseUrl.replace(/\\/+$/, \"\");\r\n this.config = { ...config, ssoBaseUrl: base };\r\n this._serverBase = (config.serverBaseUrl ?? base).replace(/\\/+$/, \"\");\r\n }\r\n\r\n // ============================================\r\n // 调试日志\r\n // ============================================\r\n\r\n /**\r\n * 调试日志（config.debug=true 时输出，前缀 [SSO SDK]）：\r\n * 覆盖登录发起 / 回调结果 / 刷新失败 / 登出等关键节点，便于接入方定位问题。\r\n * 不会输出 token/授权码等敏感值。\r\n */\r\n debugLog(...args: unknown[]): void {\r\n if (this.config.debug) {\r\n console.warn(\"[SSO SDK]\", ...args);\r\n }\r\n }\r\n\r\n // ============================================\r\n // 内部方法\r\n // ============================================\r\n\r\n /**\r\n * 校验 Discovery 文档端点 origin（防文档被篡改后 token/code 被导向攻击者服务器）：\r\n * - authorization_endpoint 必须与 ssoBaseUrl 同源（浏览器跳转目标）；\r\n * - token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl 同源，\r\n * 或（配置了 serverBaseUrl 时）与内网地址同源。\r\n * 任一不匹配：告警并返回 null（上层回退到默认端点，fail-safe）。\r\n * 可通过 config.allowCrossOriginDiscoveryEndpoints 关闭（见配置项警告）。\r\n */\r\n private _sanitizeDiscovery(d: OidcDiscovery): OidcDiscovery | null {\r\n if (this.config.allowCrossOriginDiscoveryEndpoints) return d;\r\n const allowedOrigins = new Set<string>();\r\n try {\r\n allowedOrigins.add(new URL(this.config.ssoBaseUrl).origin);\r\n allowedOrigins.add(new URL(this._serverBase).origin);\r\n } catch {\r\n return null;\r\n }\r\n const sameOrigin = (endpoint: string): boolean => {\r\n try {\r\n return allowedOrigins.has(new URL(endpoint).origin);\r\n } catch {\r\n return false;\r\n }\r\n };\r\n // 浏览器跳转端点只允许公网 origin（内网地址用户浏览器不可达）\r\n const publicOrigin = new URL(this.config.ssoBaseUrl).origin;\r\n let authorizationOk = false;\r\n try {\r\n authorizationOk = new URL(d.authorization_endpoint).origin === publicOrigin;\r\n } catch {\r\n authorizationOk = false;\r\n }\r\n const bad: string[] = [];\r\n if (!authorizationOk) bad.push(\"authorization_endpoint\");\r\n if (!sameOrigin(d.token_endpoint)) bad.push(\"token_endpoint\");\r\n if (!sameOrigin(d.userinfo_endpoint)) bad.push(\"userinfo_endpoint\");\r\n // 其余端点同样可能把凭证/浏览器跳转导向攻击者，必须一并校验 origin。\r\n if (d.jwks_uri && !sameOrigin(d.jwks_uri)) bad.push(\"jwks_uri\");\r\n if (d.revocation_endpoint && !sameOrigin(d.revocation_endpoint)) {\r\n bad.push(\"revocation_endpoint\");\r\n }\r\n if (d.introspection_endpoint && !sameOrigin(d.introspection_endpoint)) {\r\n bad.push(\"introspection_endpoint\");\r\n }\r\n if (d.end_session_endpoint) {\r\n try {\r\n if (new URL(d.end_session_endpoint).origin !== publicOrigin) {\r\n bad.push(\"end_session_endpoint\");\r\n }\r\n } catch {\r\n bad.push(\"end_session_endpoint\");\r\n }\r\n }\r\n if (bad.length > 0) {\r\n if (!this._discoveryOriginWarned) {\r\n this._discoveryOriginWarned = true;\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 端点 origin 与 ssoBaseUrl/serverBaseUrl 不匹配（${bad.join(\", \")}），` +\r\n \"已回退到默认端点。若 SSO 中心确实托管跨源端点，请设置 allowCrossOriginDiscoveryEndpoints: true\"\r\n );\r\n }\r\n return null;\r\n }\r\n return d;\r\n }\r\n\r\n /**\r\n * 获取 OIDC Discovery 文档（带缓存 + 超时）\r\n *\r\n * 缓存 5 分钟，超时 10 秒。\r\n * 失败时返回 null（上层调用方回退到硬编码默认端点）。\r\n */\r\n private async _getDiscovery(): Promise<OidcDiscovery | null> {\r\n const now = Date.now();\r\n\r\n // 命中缓存且未过期\r\n if (this._discovery && now - this._discoveryFetchedAt < SsoClient.DISCOVERY_TTL_MS) {\r\n return this._discovery;\r\n }\r\n\r\n // discovery 是服务器间调用：配置了 serverBaseUrl 时经内网拉取\r\n // （文档内容由 SSO 中心按公网 origin 生成，与拉取通道无关）\r\n const url = `${this._serverBase}/api/oauth/.well-known/openid-configuration`;\r\n\r\n try {\r\n const controller = new AbortController();\r\n const timeoutId = setTimeout(() => controller.abort(), SsoClient.DISCOVERY_TIMEOUT_MS);\r\n\r\n const res = await fetch(url, { signal: controller.signal });\r\n clearTimeout(timeoutId);\r\n\r\n if (!res.ok) {\r\n console.warn(`[SSO SDK] OIDC Discovery 请求失败: HTTP ${res.status}, 回退到默认端点`);\r\n return null;\r\n }\r\n\r\n const doc = (await res.json()) as OidcDiscovery;\r\n // 端点 origin 校验：不匹配的文档视为不可用，回退默认端点（不缓存）\r\n const sanitized = this._sanitizeDiscovery(doc);\r\n if (!sanitized) return null;\r\n this._discovery = sanitized;\r\n this._discoveryFetchedAt = now;\r\n return this._discovery;\r\n } catch (err) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求异常: ${err instanceof Error ? err.message : String(err)}, 回退到默认端点`\r\n );\r\n // 不清空已有缓存（即使过期也优于无数据）\r\n return this._discovery || null;\r\n }\r\n }\r\n\r\n /** 获取 authorize 端点 URL（优先 Discovery，回退默认） */\r\n private async _getAuthorizeEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.authorization_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/authorize`;\r\n }\r\n\r\n /** 获取 token 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */\r\n private async _getTokenEndpoint(): Promise<string> {\r\n if (this.config.serverBaseUrl) return `${this._serverBase}/api/oauth/token`;\r\n const d = await this._getDiscovery();\r\n if (d) return d.token_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/token`;\r\n }\r\n\r\n /** 获取 userinfo 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */\r\n private async _getUserinfoEndpoint(): Promise<string> {\r\n if (this.config.serverBaseUrl) return `${this._serverBase}/api/oauth/userinfo`;\r\n const d = await this._getDiscovery();\r\n if (d) return d.userinfo_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/userinfo`;\r\n }\r\n\r\n /**\r\n * 开放重定向防护：仅保存相对路径或与当前页面同源的 returnUrl，\r\n * 其余（如 https://evil.com）忽略并告警，防止回调后跳转到钓鱼站点。\r\n */\r\n private _saveReturnUrlIfTrusted(returnUrl: string): void {\r\n if (isTrustedReturnUrl(returnUrl, window.location.origin)) {\r\n // 按 clientId 隔离存储，与 CallbackPage 读取的 key 对应\r\n saveReturnUrl(returnUrl, this.config.clientId);\r\n } else {\r\n console.warn(`[SSO SDK] returnUrl 未通过同源校验，已忽略: ${returnUrl}`);\r\n }\r\n }\r\n\r\n // ============================================\r\n // 公共 API\r\n // ============================================\r\n\r\n /**\r\n * 发起 SSO 登录\r\n *\r\n * 生成 PKCE code_verifier/code_challenge 和 state 参数，\r\n * 构建 authorize URL，通过 302 跳转到 SSO 登录页。\r\n *\r\n * @param returnUrl - 登录成功后的返回地址（可选，保存到 sessionStorage；\r\n * 仅允许相对路径或同源绝对 URL，否则忽略并告警）\r\n * @param options.prompt - OIDC prompt 参数。传 \"none\" 为静默探测：\r\n * 额外在存储中记录探测标记（该次请求的 state），回调无会话时\r\n * handleCallback() 返回 null 而不抛错。\r\n *\r\n * ⚠️ 不要与 getLoginUrl() 混用：两者都会重新生成并覆盖 sessionStorage 中的\r\n * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。\r\n * 同一次登录只使用其中一个入口。\r\n */\r\n async login(returnUrl?: string, options: LoginOptions = {}): Promise<void> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n // OIDC nonce（256-bit 随机）：绑定 ID Token 到本次登录会话，防重放\r\n const nonce = generateState();\r\n\r\n // 保存 PKCE verifier、state 和 nonce 到 sessionStorage（整页重定向后仍可读取）\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n saveOAuthNonce(nonce, this.config.clientId);\r\n // 静默探测标记：存该次请求的 state，回调凭它识别\"探测无会话\"\r\n if (options.prompt === \"none\") {\r\n saveSilentProbe(state, this.config.clientId);\r\n } else {\r\n removeSilentProbe(this.config.clientId);\r\n }\r\n\r\n if (returnUrl) {\r\n this._saveReturnUrlIfTrusted(returnUrl);\r\n }\r\n\r\n // 构建 authorize URL\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"nonce\", nonce);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n if (options.prompt) {\r\n params.set(\"prompt\", options.prompt);\r\n }\r\n\r\n // 跳转\r\n window.location.href = `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /**\r\n * 构建登录 URL（不跳转，返回 URL 字符串）\r\n *\r\n * 适用于需要手动处理跳转的场景。\r\n *\r\n * ⚠️ 不要与 login() 混用：两者都会重新生成并覆盖 sessionStorage 中的\r\n * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。\r\n * 同一次登录只使用其中一个入口。\r\n */\r\n async getLoginUrl(returnUrl?: string, options: LoginOptions = {}): Promise<string> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n // OIDC nonce（与 state 同等强度的随机值），回调时校验 ID Token 的 nonce claim\r\n const nonce = generateState();\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n saveOAuthNonce(nonce, this.config.clientId);\r\n // 静默探测标记（与 login() 一致）：prompt=none 时记录该次请求的 state\r\n if (options.prompt === \"none\") {\r\n saveSilentProbe(state, this.config.clientId);\r\n } else {\r\n removeSilentProbe(this.config.clientId);\r\n }\r\n // returnUrl 按 clientId 隔离，与 login() / CallbackPage 保持一致\r\n if (returnUrl) this._saveReturnUrlIfTrusted(returnUrl);\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"nonce\", nonce);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n if (options.prompt) {\r\n params.set(\"prompt\", options.prompt);\r\n }\r\n\r\n return `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /**\r\n * 弹窗模式 SSO 登录\r\n *\r\n * 打开一个小窗口进行登录，认证完成后窗口自动关闭，\r\n * 主页面不丢失状态（适用于 SPA 中需要保持表单/浏览上下文的场景）。\r\n *\r\n * 流程：\r\n * 1. window.open() 打开授权 URL 到弹窗\r\n * 2. 用户在弹窗中完成登录\r\n * 3. 弹窗加载 CallbackPage 时检测到 window.opener，通过 postMessage 回传回调 URL\r\n * 4. 主页面收到消息后调用 handleCallback() 交换 token\r\n * 5. 弹窗自动关闭\r\n *\r\n * @param options - 弹窗配置\r\n * @param options.returnUrl - 登录成功后的返回地址\r\n * @param options.width - 弹窗宽度（默认 480）\r\n * @param options.height - 弹窗高度（默认 640）\r\n * @returns TokenData\r\n *\r\n * @example\r\n * ```typescript\r\n * const client = new SsoClient({ clientId: \"xxx\", redirectUri: \"https://myapp.com/callback\", ssoBaseUrl: \"https://nihplod.cn\" });\r\n * try {\r\n * const tokenData = await client.loginPopup({ returnUrl: \"/dashboard\" });\r\n * console.log(\"登录成功\", tokenData);\r\n * } catch (err) {\r\n * if (err instanceof SsoError && err.code === \"popup_blocked\") {\r\n * // 弹窗被拦截，回退到同页重定向\r\n * await client.login(\"/dashboard\");\r\n * }\r\n * }\r\n * ```\r\n */\r\n async loginPopup(\r\n options: { returnUrl?: string; width?: number; height?: number } = {}\r\n ): Promise<TokenData> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n const nonce = generateState(); // OIDC nonce：回调时校验 ID Token 的 nonce claim\r\n const popupNonce = generateState(); // 独立的 nonce 用于 postMessage 来源验证\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n saveOAuthNonce(nonce, this.config.clientId);\r\n // 保存 popup nonce 到 sessionStorage，用于 postMessage 校验\r\n savePkceVerifier(`${this.config.clientId}_popup_nonce`, popupNonce);\r\n\r\n if (options.returnUrl) {\r\n this._saveReturnUrlIfTrusted(options.returnUrl);\r\n }\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"nonce\", nonce);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n // 弹窗 nonce：回调页通过 postMessage 回传，主窗口校验防伪造\r\n params.set(\"popup_nonce\", popupNonce);\r\n\r\n const width = options.width || 480;\r\n const height = options.height || 640;\r\n const left = Math.max(0, (window.screen.width - width) / 2);\r\n const top = Math.max(0, (window.screen.height - height) / 2);\r\n\r\n const popupFeatures = [\r\n `width=${width}`,\r\n `height=${height}`,\r\n `left=${Math.round(left)}`,\r\n `top=${Math.round(top)}`,\r\n \"resizable=yes\",\r\n \"scrollbars=yes\",\r\n \"status=yes\",\r\n ].join(\",\");\r\n\r\n const popup = window.open(\r\n `${authorizeEndpoint}?${params.toString()}`,\r\n \"nihplod_sso_popup\",\r\n popupFeatures\r\n );\r\n\r\n if (!popup) {\r\n removePkceVerifier(this.config.clientId);\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n throw new SsoError(\"popup_blocked\", \"弹窗被浏览器拦截，请允许弹窗后重试\");\r\n }\r\n\r\n // 计算 redirect_uri 的 origin，用于 postMessage 来源校验\r\n const redirectUriOrigin = new URL(this.config.redirectUri).origin;\r\n\r\n try {\r\n // 聚焦弹窗\r\n popup.focus();\r\n\r\n return await new Promise<TokenData>((resolve, reject) => {\r\n let completed = false;\r\n\r\n const handleMessage = (event: MessageEvent) => {\r\n if (completed) return;\r\n // 校验消息来源：必须来自 redirect_uri 对应的子项目 origin（回调页运行位置）\r\n if (event.origin !== redirectUriOrigin) return;\r\n if (!event.data || event.data.type !== \"nihplod_sso_popup_callback\") return;\r\n if (!event.data.callbackUrl) return;\r\n\r\n // 校验 popup nonce：防止伪造的 postMessage（fail-closed：本地 nonce 缺失同样拒绝）\r\n const savedNonce = getPkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n if (!savedNonce || !timingSafeEqualString(event.data.nonce ?? \"\", savedNonce)) return;\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n\r\n // 回 ACK：回调页会每 500ms 重发直到收到 ACK（或超时提示手动关闭），\r\n // 防止主窗口监听未挂载时消息丢失导致弹窗悬挂\r\n try {\r\n (event.source as Window | null)?.postMessage(\r\n { type: \"nihplod_sso_popup_ack\", nonce: savedNonce },\r\n event.origin\r\n );\r\n } catch {\r\n // ACK 失败不影响主流程（弹窗会超时提示手动关闭）\r\n }\r\n\r\n completed = true;\r\n cleanup();\r\n\r\n if (popup && !popup.closed) {\r\n popup.close();\r\n }\r\n\r\n this.handleCallback(event.data.callbackUrl)\r\n .then((tokenData) => {\r\n // prompt=none 静默探测在弹窗模式不支持（loginPopup 不带 prompt），\r\n // null 结果视为探测无会话\r\n if (tokenData === null) {\r\n reject(new SsoError(\"not_authenticated\", \"SSO 会话不存在（静默探测无会话）\"));\r\n return;\r\n }\r\n resolve(tokenData);\r\n })\r\n .catch(reject);\r\n };\r\n\r\n const pollTimer = setInterval(() => {\r\n if (popup.closed) {\r\n if (!completed) {\r\n completed = true;\r\n cleanup();\r\n reject(new SsoError(\"popup_closed\", \"登录窗口已关闭\"));\r\n }\r\n }\r\n }, 500);\r\n\r\n const cleanup = () => {\r\n clearInterval(pollTimer);\r\n window.removeEventListener(\"message\", handleMessage);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n };\r\n\r\n window.addEventListener(\"message\", handleMessage);\r\n });\r\n } catch (err) {\r\n removePkceVerifier(this.config.clientId);\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n throw err;\r\n }\r\n }\r\n\r\n /**\r\n * 处理 OAuth 回调\r\n *\r\n * 解析回调 URL，校验 state 参数，用授权码交换 token。\r\n * 成功后 token 自动保存到 token 存储（默认 sessionStorage，可通过 setTokenStorage 定制）。\r\n *\r\n * @param callbackUrl - 完整的回调 URL（window.location.href）\r\n * @returns TokenData；prompt=none 静默探测且无 SSO 会话时返回 null\r\n * （IdP 回跳 login_required / consent_required / interaction_required\r\n * 且回调 state 与探测标记匹配），此时临时数据已清理，调用方按\"未登录\"处理即可\r\n */\r\n async handleCallback(callbackUrl: string): Promise<TokenData | null> {\r\n const url = new URL(callbackUrl);\r\n const params = url.searchParams;\r\n\r\n // 检查错误（SSO 中心按 OAuth 2.0 规范回传 error 参数）\r\n const error = params.get(\"error\");\r\n if (error) {\r\n // 静默探测（prompt=none）无会话：IdP 以 error 回跳属预期结果而非异常。\r\n // 要求回调 state 与登录 state、探测标记三者一致（常量时间比较），\r\n // 防止伪造的 error 回调被当作探测结果\r\n const returnedErrorState = params.get(\"state\");\r\n const probeState = getSilentProbe(this.config.clientId);\r\n const savedStateForProbe = getOAuthState(this.config.clientId);\r\n if (\r\n SILENT_PROBE_ERRORS.has(error) &&\r\n probeState &&\r\n savedStateForProbe &&\r\n timingSafeEqualString(savedStateForProbe, returnedErrorState ?? \"\") &&\r\n timingSafeEqualString(probeState, returnedErrorState ?? \"\")\r\n ) {\r\n // 清除本次探测的全部临时数据（state/nonce/verifier/标记），返回 null\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n return null;\r\n }\r\n // 授权已失败，本次流程的临时数据（state/verifier/nonce/探测标记）不再有用，一并清理避免残留\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n const desc = params.get(\"error_description\") || error;\r\n throw new SsoError(mapOAuthErrorToSsoCode(error), `授权失败: ${desc}`);\r\n }\r\n\r\n const code = params.get(\"code\");\r\n const returnedState = params.get(\"state\");\r\n\r\n if (!code) {\r\n // 缺 code 的回调无法继续，清理临时数据避免残留\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n throw new SsoError(\"token_request_failed\", \"回调 URL 中缺少 authorization code\");\r\n }\r\n\r\n // 校验 state 参数（CSRF 防护，常量时间比较）\r\n const savedState = getOAuthState(this.config.clientId);\r\n if (!savedState || !timingSafeEqualString(savedState, returnedState ?? \"\")) {\r\n // state 不匹配：state 与 verifier 一并清除，避免残留半套临时数据\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n throw new SsoError(\"state_mismatch\", \"State 参数不匹配，可能存在 CSRF 攻击\");\r\n }\r\n\r\n // RFC 9207：校验授权响应中的 iss，防止混合 IdP / 错误 IdP 的回调被本应用接受。\r\n // 仅在响应携带 iss 时校验；以 Discovery 的 issuer 为准，回退 ssoBaseUrl。\r\n const returnedIss = params.get(\"iss\");\r\n if (returnedIss) {\r\n const discovery = await this._getDiscovery();\r\n const expectedIssuer = (discovery?.issuer || this.config.ssoBaseUrl).replace(/\\/+$/, \"\");\r\n if (returnedIss.replace(/\\/+$/, \"\") !== expectedIssuer) {\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n throw new SsoError(\"issuer_mismatch\", \"授权响应 issuer 不匹配，可能存在 IdP 混叠攻击\");\r\n }\r\n }\r\n\r\n // state 校验通过：读取登录时保存的 OIDC nonce（validateIdToken 时 fail-closed 校验，\r\n // 成功后才随 state/verifier 一并清除——验签失败重试仍需它）\r\n const expectedNonce = getOAuthNonce(this.config.clientId) ?? undefined;\r\n\r\n // 获取 code_verifier\r\n const verifier = getPkceVerifier(this.config.clientId);\r\n if (!verifier) {\r\n throw new SsoError(\"pkce_required\", \"code_verifier 不存在（可能已过期或来自其他标签页）\");\r\n }\r\n\r\n // 交换 token\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"authorization_code\");\r\n body.set(\"code\", code);\r\n body.set(\"code_verifier\", verifier);\r\n body.set(\"client_id\", this.config.clientId);\r\n body.set(\"redirect_uri\", this.config.redirectUri);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response;\r\n try {\r\n res = await fetchWithTimeout(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n // 授权码已被消费（一次性），即使重试同一回调也只会再次得到 invalid_grant，\r\n // 因此与 error-param 路径一致清除本次流程的全部临时数据\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n let errData: Record<string, unknown> = {};\r\n try {\r\n errData = await res.json();\r\n } catch {\r\n /* ignore */\r\n }\r\n const serverError = (errData.error as string) || \"\";\r\n throw new SsoError(\r\n mapOAuthErrorToSsoCode(serverError),\r\n (errData.error_description as string) || `Token 请求失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n // 先解析响应体，成功后再清除 state 和 verifier：\r\n // 若 JSON 畸形导致解析抛错，保留 state/verifier 允许用户重试回调\r\n const data: TokenResponse = await res.json();\r\n\r\n // 防御性校验：refresh_token 缺失或 expires_in 非法时 fail-closed 抛错，\r\n // 不保存半截 token 数据（authorization_code 交换主站必然签发 refresh_token）\r\n assertValidTokenResponse(data, true);\r\n\r\n // OIDC：请求 scope 含 openid 时，token 响应必须包含 id_token。\r\n // 缺失时 nonce/at_hash/签名均无从校验，直接 fail-closed 拒绝而不是静默降级。\r\n const requestedScopes = (this.config.scopes || \"openid profile\").split(\" \").filter(Boolean);\r\n if (requestedScopes.includes(\"openid\") && !data.id_token) {\r\n // 授权码已消费、重试必然得到相同结果，临时数据（state/verifier/nonce）一并清除\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n removeTokenData(this.config.clientId);\r\n throw new SsoError(\"id_token_invalid\", \"Token 响应缺少 id_token（scope 含 openid 时必需）\");\r\n }\r\n\r\n // OIDC：验证 ID Token 签名、基本声明及 at_hash\r\n if (data.id_token) {\r\n try {\r\n await validateIdToken(\r\n data.id_token,\r\n data.access_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId,\r\n { expectedNonce }\r\n );\r\n } catch (err) {\r\n // 验证失败：不保存任何 token，防止伪造 ID Token\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n // 全部校验通过后清除 state、nonce 和 verifier（一次性临时数据）。\r\n // 推迟到验签之后：若 JWKS 暂时不可达导致验签失败，\r\n // 保留 state/verifier/nonce，用户刷新回调页即可重试\r\n removeOAuthState(this.config.clientId);\r\n removeOAuthNonce(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n removeSilentProbe(this.config.clientId);\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n refresh_token: data.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in * 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n this.debugLog(\"handleCallback: token 交换成功\", { clientId: this.config.clientId });\r\n return tokenData;\r\n }\r\n\r\n /**\r\n * 刷新 Access Token\r\n *\r\n * 使用 refresh_token 换取新的 access_token。\r\n * 采用互斥锁防止并发刷新。\r\n * 支持 Refresh Token 原子轮换。\r\n */\r\n async refreshToken(): Promise<TokenData> {\r\n // 互斥锁：避免并发刷新\r\n if (this._refreshLock) return this._refreshLock;\r\n\r\n this._refreshLock = this._doRefreshToken();\r\n try {\r\n return await this._refreshLock;\r\n } finally {\r\n this._refreshLock = null;\r\n }\r\n }\r\n\r\n private async _doRefreshToken(): Promise<TokenData> {\r\n const current = getTokenData(this.config.clientId);\r\n if (!current?.refresh_token) {\r\n throw new SsoError(\"no_refresh_token\", \"没有可用的 refresh_token\");\r\n }\r\n\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"refresh_token\");\r\n body.set(\"refresh_token\", current.refresh_token);\r\n body.set(\"client_id\", this.config.clientId);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response | null = null;\r\n let lastErr: unknown;\r\n try {\r\n res = await fetchWithTimeout(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n lastErr = err;\r\n }\r\n if (lastErr || !res) {\r\n throw new SsoError(\"network_error\", \"刷新 Token 网络请求失败\", lastErr);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try {\r\n errData = await res.json();\r\n } catch {\r\n /* ignore */\r\n }\r\n const errorCode = (errData.error as string) || \"\";\r\n // 仅明确的 invalid_grant（refresh_token 已被撤销/过期）才清除本地登录态；\r\n // 网关/WAF 返回的 401（响应体无 OAuth error 字段）保留 token 按可重试处理，\r\n // 避免一次网络抖动把用户静默登出（重试上限由上层 SsoProvider 计数控制）\r\n if (errorCode === \"invalid_grant\") {\r\n removeTokenData(this.config.clientId);\r\n }\r\n this.debugLog(\"refreshToken: 刷新失败\", { status: res.status, error: errorCode });\r\n if (!errorCode && res.status === 401) {\r\n throw new SsoError(\"sso_server_error\", \"刷新 Token 失败（网关异常），请稍后重试\");\r\n }\r\n throw new SsoError(\r\n mapOAuthErrorToSsoCode(errorCode, \"refresh\"),\r\n (errData.error_description as string) || `刷新 Token 失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n const data: TokenResponse = await res.json();\r\n\r\n // 防御性校验：refresh 响应可省略 refresh_token（沿用旧值），\r\n // 但 access_token / expires_in 必须合法，否则 expires_at 为 NaN 永久判过期\r\n assertValidTokenResponse(data, false);\r\n\r\n if (data.id_token) {\r\n try {\r\n // refresh 流程不传 expectedNonce：原始 nonce 是一次性的，登录成功后已删除。\r\n // refresh 签发的 ID Token 按 OIDC Core §12.2 不得携带 nonce；\r\n // validateIdToken 现已 fail-closed 拒绝任何携带 nonce 但无期望值的 token，\r\n // 因此此处无需传值也不会误伤合法 refresh 响应\r\n await validateIdToken(\r\n data.id_token,\r\n data.access_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId\r\n );\r\n } catch (err) {\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n // RFC 6749 §6：刷新响应可省略 refresh_token，此时沿用旧值\r\n refresh_token: data.refresh_token || current.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in * 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /**\r\n * 获取用户信息\r\n *\r\n * 若 access_token 已过期则自动刷新后再请求。\r\n */\r\n async getUserInfo(): Promise<SsoUser> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n\r\n if (!tokenData) {\r\n throw new SsoError(\"not_authenticated\", \"未登录\");\r\n }\r\n\r\n // 若已过期（含 10s 提前量：避免返回即将过期的 token），先刷新\r\n if (Date.now() >= tokenData.expires_at - EXPIRY_SKEW_MS) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n const userinfoEndpoint = await this._getUserinfoEndpoint();\r\n\r\n let res: Response;\r\n try {\r\n res = await fetchWithTimeout(userinfoEndpoint, {\r\n headers: {\r\n Authorization: `Bearer ${tokenData.access_token}`,\r\n },\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"获取用户信息网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n if (res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n throw new SsoError(\"not_authenticated\", \"Token 已失效\");\r\n }\r\n throw new SsoError(\"userinfo_failed\", `获取用户信息失败: HTTP ${res.status}`);\r\n }\r\n\r\n return (await res.json()) as SsoUser;\r\n }\r\n\r\n /**\r\n * 获取当前 access_token\r\n *\r\n * 若已过期则自动刷新。用于子项目自行发起 API 请求时获取 Bearer token。\r\n * 若无 token 返回 null；若刷新失败则抛出错误（与 getUserInfo 行为一致）。\r\n */\r\n async getAccessToken(): Promise<string | null> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return null;\r\n\r\n if (Date.now() >= tokenData.expires_at - EXPIRY_SKEW_MS) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n return tokenData.access_token;\r\n }\r\n\r\n /**\r\n * 检查是否已认证（不发起网络请求）\r\n *\r\n * 仅检查本地是否存在未过期的 access_token。\r\n * 故意不做 EXPIRY_SKEW_MS 提前量：这是同步的 UI 提示判定（是否显示\"已登录\"），\r\n * 提前 10s 翻转 false 会让调用方在 token 仍有效时误显示未登录；真正发请求的\r\n * getAccessToken/getUserInfo 已带提前量。\r\n */\r\n isAuthenticated(): boolean {\r\n const tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return false;\r\n return Date.now() < tokenData.expires_at;\r\n }\r\n\r\n /**\r\n * 登出\r\n *\r\n * 清除本地所有 token 和临时数据，并尝试撤销服务端 refresh_token。\r\n * @param redirectToSso - 是否重定向到 SSO 登出页（默认 false）。\r\n * 为 true 时携带 state 参数（已保存到 sessionStorage），\r\n * 回跳页面应调用 validateLogoutState() 校验防登出 CSRF。\r\n */\r\n async logout(redirectToSso: boolean = false): Promise<void> {\r\n // 获取 refresh_token 用于服务端撤销（需在 clearAllSsoData 之前）\r\n const tokenData = getTokenData(this.config.clientId);\r\n const refreshToken = tokenData?.refresh_token;\r\n const idTokenHint = tokenData?.id_token;\r\n\r\n clearAllSsoData(this.config.clientId);\r\n this.debugLog(\"logout: 本地数据已清除\", {\r\n clientId: this.config.clientId,\r\n redirectToSso,\r\n });\r\n\r\n // 尝试调用服务端 token revocation 端点（best-effort）\r\n // 仅 Confidential Client 携带 client_secret；Public Client 不传 secret。\r\n if (refreshToken && this.config.clientId) {\r\n try {\r\n // serverBaseUrl 配置时直连内网默认端点（discovery 文档内是公网 URL，\r\n // 会绕行公网）；否则用 Discovery，兜底公网默认路径\r\n const discovery = this.config.serverBaseUrl ? null : await this._getDiscovery();\r\n const revokeUrl = this.config.serverBaseUrl\r\n ? `${this._serverBase}/api/oauth/revoke`\r\n : discovery?.revocation_endpoint || `${this.config.ssoBaseUrl}/api/oauth/revoke`;\r\n const revokeBody = new URLSearchParams({\r\n token: refreshToken,\r\n token_type_hint: \"refresh_token\",\r\n client_id: this.config.clientId,\r\n });\r\n if (this.config.clientSecret) {\r\n revokeBody.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n const doRevoke = () =>\r\n fetchWithTimeout(\r\n revokeUrl,\r\n {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: revokeBody.toString(),\r\n },\r\n REVOKE_TIMEOUT_MS\r\n );\r\n let res = await doRevoke();\r\n // 5xx/429 可重试：服务端 503 明确要求客户端重试，避免 refresh_token 残留。\r\n if (!res.ok && (res.status >= 500 || res.status === 429)) {\r\n await new Promise((resolve) => setTimeout(resolve, 300));\r\n res = await doRevoke();\r\n }\r\n if (!res.ok) {\r\n this.debugLog(\"logout: 服务端撤销 refresh_token 失败\", { status: res.status });\r\n }\r\n } catch {\r\n // 撤销失败不影响本地登出（best-effort）\r\n }\r\n }\r\n\r\n if (redirectToSso) {\r\n // OIDC RP-Initiated Logout：携带 client_id / post_logout_redirect_uri / id_token_hint / state\r\n const discovery = await this._getDiscovery();\r\n const endSessionEndpoint =\r\n discovery?.end_session_endpoint || `${this.config.ssoBaseUrl}/api/oauth/end-session`;\r\n const logoutUrl = new URL(endSessionEndpoint);\r\n logoutUrl.searchParams.set(\"client_id\", this.config.clientId);\r\n const postLogoutUri = this.config.postLogoutRedirectUri || this.config.redirectUri;\r\n if (postLogoutUri) {\r\n logoutUrl.searchParams.set(\"post_logout_redirect_uri\", postLogoutUri);\r\n }\r\n if (idTokenHint) {\r\n logoutUrl.searchParams.set(\"id_token_hint\", idTokenHint);\r\n }\r\n // 携带 state 防登出 CSRF：回跳时用 validateLogoutState() 校验\r\n const state = generateState();\r\n saveLogoutState(state, this.config.clientId);\r\n logoutUrl.searchParams.set(\"state\", state);\r\n window.location.href = logoutUrl.toString();\r\n }\r\n }\r\n\r\n /**\r\n * 校验 RP-Initiated Logout 回跳的 state 参数（登出 CSRF 防护）\r\n *\r\n * 在 post_logout_redirect_uri 指向的页面加载时调用；\r\n * 仅在 URL 携带 state 且与 logout(redirectToSso=true) 保存的值一致时返回 true，\r\n * 校验后清除已保存的 logout state（一次性）。\r\n *\r\n * @param url - 当前页面完整 URL（window.location.href）\r\n *\r\n * @example\r\n * ```typescript\r\n * if (sso.validateLogoutState(window.location.href)) {\r\n * // 来自 SSO 登出的可信回跳\r\n * }\r\n * ```\r\n */\r\n validateLogoutState(url: string): boolean {\r\n const returnedState = new URL(url).searchParams.get(\"state\");\r\n if (!returnedState) return false;\r\n const savedState = getLogoutState(this.config.clientId);\r\n if (!savedState) return false;\r\n if (!timingSafeEqualString(savedState, returnedState)) return false;\r\n // 校验通过：logout state 为一次性临时数据，立即清除\r\n removeLogoutState(this.config.clientId);\r\n return true;\r\n }\r\n\r\n /**\r\n * 获取 OIDC Discovery 文档\r\n *\r\n * 用于调试和获取 SSO 中心完整配置。\r\n * 可能返回 null（当 Discovery 端点不可达且无缓存时）。\r\n */\r\n async getDiscovery(): Promise<OidcDiscovery | null> {\r\n return this._getDiscovery();\r\n }\r\n}\r\n"],"mappings":";AAuDO,SAAS,uBACd,YACA,UAAwC,kBAC1B;AACd,UAAQ,YAAY;AAAA,IAClB,KAAK;AAEH,aAAO,YAAY,YAAY,oBAAoB;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;AAKO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAKlC,YAAY,MAAoB,aAAqB,OAAiB;AACpE,UAAM,aAAa,IAAI,KAAK,WAAW,EAAE;AACzC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,QAAQ;AAAA,EACf;AACF;AASO,IAAM,aAAN,cAAyB,MAAM;AAAA,EAKpC,YAAY,MAAc,aAAqB,KAAc;AAC3D,UAAM,WAAW,IAAI,KAAK,WAAW,EAAE;AACvC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,MAAM;AAAA,EACb;AACF;;;AC3GA,IAAM,cACJ;AASF,SAAS,qBAAqB,QAAwB;AACpD,QAAM,OAAO;AACb,MAAI,SAAS;AAEb,SAAO,OAAO,SAAS,QAAQ;AAE7B,UAAM,YAAY,KAAK,IAAI,SAAS,GAAG,GAAG;AAC1C,UAAM,QAAQ,IAAI,WAAW,SAAS;AACtC,WAAO,gBAAgB,KAAK;AAE5B,aAAS,IAAI,GAAG,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC5D,UAAI,MAAM,CAAC,KAAK,KAAM;AACtB,gBAAU,YAAY,MAAM,CAAC,IAAI,YAAY,MAAM;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AACT;AAUO,SAAS,qBAAqB,SAAiB,IAAY;AAChE,MAAI,SAAS,MAAM,SAAS,KAAK;AAC/B,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,qBAAqB,MAAM;AACpC;AASA,eAAsB,sBACpB,cACiB;AACjB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,YAAY;AACxC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAGvD,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACzC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAOO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;;;ACvCA,IAAM,iBAAiB;AAGvB,IAAM,YAAY;AAClB,IAAM,sBAAsB;AAC5B,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AAEzB,IAAM,mBAAmB;AAEzB,SAAS,SAAS,MAAc,UAA2B;AACzD,SAAO,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;AAC5C;AAYA,IAAM,sBAAoC;AAAA,EACxC,IAAI,KAAa;AACf,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa,QAAO;AAChD,aAAO,aAAa,QAAQ,iBAAiB,GAAG;AAAA,IAClD,QAAQ;AAEN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,IAAI,KAAa,OAAe;AAC9B,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa;AACzC,mBAAa,QAAQ,iBAAiB,KAAK,KAAK;AAAA,IAClD,SAAS,KAAK;AAEZ,cAAQ;AAAA,QACN,wDAA+B,eAAe,QAAQ,IAAI,OAAO,OAAO,GAAG,CAAC;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO,KAAa;AAClB,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa;AACzC,mBAAa,WAAW,iBAAiB,GAAG;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EACA,OAAO;AACL,QAAI;AACF,UAAI,OAAO,iBAAiB,YAAa,QAAO,CAAC;AACjD,YAAM,SAAmB,CAAC;AAC1B,eAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK;AAC5C,cAAM,MAAM,aAAa,IAAI,CAAC;AAC9B,YAAI,KAAK,WAAW,cAAc,EAAG,QAAO,KAAK,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,MACnF;AACA,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;AAaA,SAAS,8BAA4C;AACnD,QAAM,WAAW,oBAAI,IAAoB;AACzC,SAAO;AAAA,IACL,IAAI,KAAa;AACf,UAAI;AACF,YAAI,OAAO,mBAAmB,aAAa;AACzC,iBAAO,eAAe,QAAQ,iBAAiB,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK;AAAA,QAC9E;AAAA,MACF,QAAQ;AAAA,MAER;AACA,aAAO,SAAS,IAAI,GAAG,KAAK;AAAA,IAC9B;AAAA,IACA,IAAI,KAAa,OAAe;AAC9B,UAAI;AACF,YAAI,OAAO,mBAAmB,aAAa;AACzC,yBAAe,QAAQ,iBAAiB,KAAK,KAAK;AAClD;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,eAAS,IAAI,KAAK,KAAK;AAAA,IACzB;AAAA,IACA,OAAO,KAAa;AAClB,eAAS,OAAO,GAAG;AACnB,UAAI;AACF,YAAI,OAAO,mBAAmB,YAAa;AAC3C,uBAAe,WAAW,iBAAiB,GAAG;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,IACA,OAAO;AACL,YAAM,SAAS,IAAI,IAAY,SAAS,KAAK,CAAC;AAC9C,UAAI;AACF,YAAI,OAAO,mBAAmB,aAAa;AACzC,mBAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,kBAAM,MAAM,eAAe,IAAI,CAAC;AAChC,gBAAI,KAAK,WAAW,cAAc,EAAG,QAAO,IAAI,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,UAClF;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,aAAO,CAAC,GAAG,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAGA,IAAM,aAA2B,4BAA4B;AAatD,SAAS,oBAAoB,UAAiC,CAAC,GAAiB;AACrF,SAAO,QAAQ,UAAU,sBAAsB,4BAA4B;AAC7E;AAMA,IAAI,WAAyB,4BAA4B;AAKlD,SAAS,gBAAgB,SAA6B;AAC3D,aAAW;AACb;AAKO,SAAS,kBAAgC;AAC9C,SAAO;AACT;AAMO,SAAS,cAAc,MAAiB,UAAyB;AACtE,WAAS,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK,UAAU,IAAI,CAAC;AAClE;AAEO,SAAS,aAAa,UAAqC;AAChE,QAAM,MAAM,SAAS,IAAI,SAAS,WAAW,QAAQ,CAAC;AACtD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AAIF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,UAAyB;AACvD,WAAS,OAAO,SAAS,WAAW,QAAQ,CAAC;AAC/C;AAMO,SAAS,iBAAiB,UAAkB,UAAwB;AACzE,aAAW,IAAI,sBAAsB,UAAU,QAAQ;AACzD;AAEO,SAAS,gBAAgB,UAAiC;AAC/D,SAAO,WAAW,IAAI,sBAAsB,QAAQ;AACtD;AAEO,SAAS,mBAAmB,UAAwB;AACzD,aAAW,OAAO,sBAAsB,QAAQ;AAClD;AAMO,SAAS,eAAe,OAAe,UAAyB;AACrE,aAAW,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK;AACrD;AAEO,SAAS,cAAc,UAAkC;AAC9D,SAAO,WAAW,IAAI,SAAS,WAAW,QAAQ,CAAC;AACrD;AAEO,SAAS,iBAAiB,UAAyB;AACxD,aAAW,OAAO,SAAS,WAAW,QAAQ,CAAC;AACjD;AAMO,SAAS,eAAe,OAAe,UAAyB;AACrE,aAAW,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK;AACrD;AAEO,SAAS,cAAc,UAAkC;AAC9D,SAAO,WAAW,IAAI,SAAS,WAAW,QAAQ,CAAC;AACrD;AAEO,SAAS,iBAAiB,UAAyB;AACxD,aAAW,OAAO,SAAS,WAAW,QAAQ,CAAC;AACjD;AAMO,SAAS,gBAAgB,OAAe,UAAyB;AACtE,aAAW,IAAI,SAAS,kBAAkB,QAAQ,GAAG,KAAK;AAC5D;AAEO,SAAS,eAAe,UAAkC;AAC/D,SAAO,WAAW,IAAI,SAAS,kBAAkB,QAAQ,CAAC;AAC5D;AAEO,SAAS,kBAAkB,UAAyB;AACzD,aAAW,OAAO,SAAS,kBAAkB,QAAQ,CAAC;AACxD;AAKO,SAAS,cAAc,KAAa,UAAyB;AAClE,aAAW,IAAI,SAAS,gBAAgB,QAAQ,GAAG,GAAG;AACxD;AAEO,SAAS,aAAa,UAAkC;AAC7D,SAAO,WAAW,IAAI,SAAS,gBAAgB,QAAQ,CAAC;AAC1D;AAEO,SAAS,gBAAgB,UAAyB;AACvD,aAAW,OAAO,SAAS,gBAAgB,QAAQ,CAAC;AACtD;AAQO,SAAS,gBAAgB,OAAe,UAAyB;AACtE,aAAW,IAAI,SAAS,kBAAkB,QAAQ,GAAG,KAAK;AAC5D;AAEO,SAAS,eAAe,UAAkC;AAC/D,SAAO,WAAW,IAAI,SAAS,kBAAkB,QAAQ,CAAC;AAC5D;AAEO,SAAS,kBAAkB,UAAyB;AACzD,aAAW,OAAO,SAAS,kBAAkB,QAAQ,CAAC;AACxD;AAMO,SAAS,gBAAgB,UAAyB;AACvD,MAAI,UAAU;AACZ,oBAAgB,QAAQ;AACxB,qBAAiB,QAAQ;AACzB,qBAAiB,QAAQ;AACzB,oBAAgB,QAAQ;AACxB,sBAAkB,QAAQ;AAC1B,sBAAkB,QAAQ;AAC1B,uBAAmB,QAAQ;AAE3B,uBAAmB,GAAG,QAAQ,cAAc;AAC5C;AAAA,EACF;AAEA,kBAAgB;AAChB,mBAAiB;AACjB,mBAAiB;AACjB,kBAAgB;AAChB,oBAAkB;AAClB,oBAAkB;AAMlB,QAAM,SAAoB,CAAC;AAC3B,MAAI;AACF,QAAI,OAAO,mBAAmB,YAAa,QAAO,KAAK,cAAc;AAAA,EACvE,QAAQ;AAAA,EAER;AACA,MAAI;AACF,QAAI,OAAO,iBAAiB,YAAa,QAAO,KAAK,YAAY;AAAA,EACnE,QAAQ;AAAA,EAER;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAiB,CAAC;AACxB,QAAI;AACF,eAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAM,MAAM,MAAM,IAAI,CAAC;AACvB,YAAI,KAAK,WAAW,cAAc,EAAG,MAAK,KAAK,GAAG;AAAA,MACpD;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AACA,eAAW,OAAO,MAAM;AACtB,mBAAa,IAAI,IAAI,MAAM,eAAe,MAAM,CAAC;AACjD,UAAI;AACF,cAAM,WAAW,GAAG;AAAA,MACtB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAIA,aAAW,SAAS,CAAC,YAAY,QAAQ,GAAG;AAC1C,QAAI;AACF,iBAAW,OAAO,MAAM,OAAO,KAAK,CAAC,EAAG,cAAa,IAAI,GAAG;AAAA,IAC9D,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,aAAW,OAAO,cAAc;AAC9B,eAAW,OAAO,GAAG;AACrB,aAAS,OAAO,GAAG;AAAA,EACrB;AACF;AAOO,SAAS,yBAAyB,WAA2B;AAClE,aAAW,YAAY,WAAW;AAChC,eAAW,OAAO,sBAAsB,QAAQ;AAAA,EAClD;AACF;;;AChaA,IAAM,0BAA0B;AAUzB,SAAS,mBAAmB,KAAa,eAAgC;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,wBAAwB,KAAK,GAAG,EAAG,QAAO;AAC9C,MAAI,IAAI,WAAW,IAAI,EAAG,QAAO;AACjC,MAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAU,QAAO;AACxE,QAAI,OAAO,YAAY,OAAO,SAAU,QAAO;AAC/C,WAAO,OAAO,WAAW;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,sBAAsB,GAAW,GAAoB;AACnE,QAAM,KAAK,IAAI,YAAY,EAAE,OAAO,CAAC;AACrC,QAAM,KAAK,IAAI,YAAY,EAAE,OAAO,CAAC;AACrC,MAAI,GAAG,WAAW,KAAK,GAAG,WAAW,EAAG,QAAO,GAAG,WAAW,GAAG;AAChE,QAAM,MAAM,KAAK,IAAI,GAAG,QAAQ,GAAG,MAAM;AACzC,MAAI,OAAO,GAAG,SAAS,GAAG;AAC1B,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,YAAQ,GAAG,IAAI,GAAG,MAAM,IAAI,GAAG,IAAI,GAAG,MAAM;AAAA,EAC9C;AACA,SAAO,SAAS;AAClB;;;ACrCA,IAAM,UACJ,OAAO,WAAW,eAAgB,OAAkB,SAAU,SAAoB;AAEpF,SAAS,YAA2B;AAClC,SAAQ,WAA6B;AACvC;AAyCA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;AACjF,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,OAA+C;AAC9E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAA+C;AAC7E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,gBAAgB,KAAqB;AAC5C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAQA,IAAI,aAAwE;AAC5E,IAAI,kBAAwF;AAC5F,IAAM,oBAAoB,IAAI,KAAK;AAEnC,IAAM,mBAAmB;AAQzB,eAAsB,kBAAkB,SAAmD;AACzF,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,mBAAmB,gBAAgB,YAAY,WAAW,MAAM,gBAAgB,YAAY,mBAAmB;AACjH,WAAO,gBAAgB;AAAA,EACzB;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,+CAA+C;AAAA,MAC/E,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,IAC9C,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,MAAO,MAAM,IAAI,KAAK;AAC5B,sBAAkB,EAAE,SAAS,KAAK,WAAW,IAAI;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,UAAU,SAAiB,UAA4B,CAAC,GAAyB;AACrG,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,CAAC,QAAQ,gBAAgB,cAAc,WAAW,YAAY,WAAW,MAAM,WAAW,YAAY,mBAAmB;AAC3H,WAAO,WAAW;AAAA,EACpB;AAEA,QAAM,YAAY,MAAM,kBAAkB,OAAO;AAGjD,MAAI,UAAU,GAAG,OAAO;AACxB,MAAI,WAAW,UAAU;AACvB,QAAI;AACF,UAAI,IAAI,IAAI,UAAU,QAAQ,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE,QAAQ;AAClE,kBAAU,UAAU;AAAA,MACtB,OAAO;AACL,gBAAQ;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,SAAS;AAAA,MAC/B,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,MAC5C,GAAI,QAAQ,eAAe,EAAE,OAAO,WAA2B,IAAI,CAAC;AAAA,IACtE,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,iBAAa,EAAE,SAAS,MAAM,WAAW,IAAI;AAC7C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,qBAAqB,OAAe,KAAgC;AACxF,MAAI;AACF,UAAM,CAAC,WAAW,YAAY,SAAS,IAAI,MAAM,MAAM,GAAG;AAC1D,QAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,EAAG,QAAO;AAE3C,UAAM,IAAI,UAAU;AACpB,QAAI,CAAC,EAAG,QAAO;AAEf,UAAM,YAAY,MAAM,EAAE,OAAO;AAAA,MAC/B;AAAA,MACA,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3D,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,MAC7C;AAAA,MACA,CAAC,QAAQ;AAAA,IACX;AAEA,UAAM,iBAAiB,gBAAgB,SAAS;AAChD,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AAClE,WAAO,MAAM,EAAE,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,cAAc,aAAsC;AACxE,QAAM,IAAI,UAAU;AACpB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,MAAM,EAAE,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AACnF,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,QAAM,OAAO,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;AAC5C,MAAI,SAAS;AACb,aAAW,KAAK,MAAM;AACpB,cAAU,OAAO,aAAa,CAAC;AAAA,EACjC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAGA,eAAsB,gBACpB,SACA,aACA,gBACA,kBACA,UAAkC,CAAC,GACH;AAChC,QAAM,EAAE,gCAAgC,MAAM,cAAc,IAAI;AAEhE,QAAM,SAAS,gBAAgB,OAAO;AACtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,SAAS,oBAAoB,mCAAe;AAAA,EACxD;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,OAAO,QAAQ,YAAa,QAAQ,WAAW,QAAQ,SAAU;AACnE,UAAM,IAAI,SAAS,4BAA4B,+DAAuB,GAAG,EAAE;AAAA,EAC7E;AAEA,QAAM,UAAU,gBAAgB,cAAc;AAE9C,QAAM,YAAY,MAAM,kBAAkB,OAAO;AACjD,QAAM,mBAAmB,gBAAgB,WAAW,UAAU,OAAO;AAGrE,MAAI,QAAQ,SAAS;AACnB,UAAM,OAAO,MAAM,UAAU,OAAO;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,8BAA8B,kEAA0B;AAAA,IAC7E;AACA,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAE1D,UAAM,kBAAkB,CAAC,QACvB,IAAI,KAAK;AAAA,MACP,CAAC,MACC,EAAE,QAAQ,SACV,EAAE,QAAQ,WACV,EAAE,QAAQ,UACT,MAAM,EAAE,QAAQ,MAAM;AAAA,IAC3B;AACF,UAAM,YAAY,OAAO,SAAsC;AAC7D,iBAAW,OAAO,MAAM;AACtB,YAAI,MAAM,qBAAqB,SAAS,GAAG,EAAG,QAAO;AAAA,MACvD;AACA,aAAO;AAAA,IACT;AAEA,QAAI,aAAa,gBAAgB,IAAI;AACrC,QAAI,WAAW,WAAW,SAAS,IAAI,MAAM,UAAU,UAAU,IAAI;AAIrE,QAAI,WAAW,WAAW,KAAK,CAAC,UAAU;AACxC,YAAM,YAAY,MAAM,UAAU,SAAS,EAAE,cAAc,KAAK,CAAC;AACjE,UAAI,WAAW;AACb,qBAAa,gBAAgB,SAAS;AACtC,mBAAW,WAAW,SAAS,IAAI,MAAM,UAAU,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,QAAI,WAAW,WAAW,GAAG;AAC3B,YAAM,IAAI,SAAS,8BAA8B,oEAAuB;AAAA,IAC1E;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,SAAS,8BAA8B,+CAAiB;AAAA,IACpE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS;AACnB,QAAI,+BAA+B;AACjC,YAAM,OAAO,MAAM,UAAU,OAAO;AACpC,YAAM,WAAW,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AAC7E,UAAI,UAAU;AACZ,cAAM,IAAI,SAAS,4BAA4B,2EAAmC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,UAAU,iBAAiB,OAAO;AACxC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,SAAS,oBAAoB,2CAAuB;AAAA,EAChE;AAEA,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,IAAI;AACrF,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,SAAS,4BAA4B,oCAAqB;AAAA,EACtE;AAGA,QAAM,MAAM,QAAQ;AACpB,QAAM,UAAU,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC;AAC9E,MAAI,CAAC,QAAQ,SAAS,gBAAgB,GAAG;AACvC,UAAM,IAAI,SAAS,8BAA8B,sCAAuB;AAAA,EAC1E;AACA,MAAI,QAAQ,SAAS,KAAK,QAAQ,QAAQ,kBAAkB;AAC1D,UAAM,IAAI,SAAS,8BAA8B,2EAAwC;AAAA,EAC3F;AAGA,MAAI,OAAO,QAAQ,QAAQ,UAAU;AACnC,UAAM,IAAI,SAAS,oBAAoB,wCAAoB;AAAA,EAC7D;AACA,MAAI,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAO,KAAQ;AAC7C,UAAM,IAAI,SAAS,oBAAoB,6BAAc;AAAA,EACvD;AAGA,MAAI,OAAO,QAAQ,QAAQ,UAAU;AACnC,UAAM,IAAI,SAAS,oBAAoB,wCAAoB;AAAA,EAC7D;AACA,MAAI,QAAQ,MAAM,MAAO,KAAK,IAAI,IAAI,KAAQ;AAC5C,UAAM,IAAI,SAAS,oBAAoB,6FAA4B;AAAA,EACrE;AAEA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,SAAS,wBAAwB,2BAAiB;AAAA,EAC9D;AAGA,MAAI,OAAO,QAAQ,YAAY,YAAY,QAAQ,SAAS;AAC1D,UAAM,SAAS,MAAM,cAAc,WAAW;AAC9C,QAAI,CAAC,sBAAsB,QAAQ,QAAQ,OAAO,GAAG;AACnD,YAAM,IAAI,SAAS,6BAA6B,qCAAsB;AAAA,IACxE;AAAA,EACF;AAQA,MAAI,kBAAkB,QAAW;AAC/B,UAAM,aAAa,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AACvE,QAAI,CAAC,cAAc,CAAC,sBAAsB,eAAe,UAAU,GAAG;AACpE,YAAM,IAAI,SAAS,2BAA2B,mCAAoB;AAAA,IACpE;AAAA,EACF,WAAW,OAAO,QAAQ,UAAU,YAAY,QAAQ,OAAO;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,QAAQ,IAAI;AAC5B;;;ACzXO,IAAM,qBAAqB;AAGlC,eAAsB,iBACpB,OACA,OAAoB,CAAC,GACrB,YAAoB,oBACD;AACnB,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACF,WAAO,MAAM,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EAClE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;;;ACyBA,IAAM,oBAAoB;AAK1B,IAAM,iBAAiB;AAgBvB,SAAS,yBAAyB,MAAqB,qBAAoC;AACzF,MAAI,OAAO,KAAK,iBAAiB,YAAY,CAAC,KAAK,cAAc;AAC/D,UAAM,IAAI,SAAS,wBAAwB,6CAAyB;AAAA,EACtE;AACA,MACE,OAAO,KAAK,eAAe,YAC3B,CAAC,OAAO,SAAS,KAAK,UAAU,KAChC,KAAK,cAAc,GACnB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+CAA2B,OAAO,KAAK,UAAU,CAAC;AAAA,IACpD;AAAA,EACF;AACA,MAAI,wBAAwB,OAAO,KAAK,kBAAkB,YAAY,CAAC,KAAK,gBAAgB;AAC1F,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAyFA,IAAM,sBAAsB,oBAAI,IAAI,CAAC,kBAAkB,oBAAoB,sBAAsB,CAAC;AAoC3F,IAAM,aAAN,MAAM,WAAU;AAAA,EAgBrB,YAAY,QAAyB;AAZrC,SAAQ,aAAmC;AAC3C,SAAQ,sBAA8B;AACtC,SAAQ,eAA0C;AAElD;AAAA,SAAQ,yBAAyB;AAS/B,QAAI,CAAC,OAAO,SAAU,OAAM,IAAI,SAAS,kBAAkB,mCAAe;AAC1E,QAAI,CAAC,OAAO,YAAa,OAAM,IAAI,SAAS,kBAAkB,sCAAkB;AAChF,QAAI,CAAC,OAAO,WAAY,OAAM,IAAI,SAAS,kBAAkB,qCAAiB;AAG9E,UAAM,OAAO,OAAO,WAAW,QAAQ,QAAQ,EAAE;AACjD,SAAK,SAAS,EAAE,GAAG,QAAQ,YAAY,KAAK;AAC5C,SAAK,eAAe,OAAO,iBAAiB,MAAM,QAAQ,QAAQ,EAAE;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,YAAY,MAAuB;AACjC,QAAI,KAAK,OAAO,OAAO;AACrB,cAAQ,KAAK,aAAa,GAAG,IAAI;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,mBAAmB,GAAwC;AACjE,QAAI,KAAK,OAAO,mCAAoC,QAAO;AAC3D,UAAM,iBAAiB,oBAAI,IAAY;AACvC,QAAI;AACF,qBAAe,IAAI,IAAI,IAAI,KAAK,OAAO,UAAU,EAAE,MAAM;AACzD,qBAAe,IAAI,IAAI,IAAI,KAAK,WAAW,EAAE,MAAM;AAAA,IACrD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,aAA8B;AAChD,UAAI;AACF,eAAO,eAAe,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AAAA,MACpD,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,IAAI,KAAK,OAAO,UAAU,EAAE;AACrD,QAAI,kBAAkB;AACtB,QAAI;AACF,wBAAkB,IAAI,IAAI,EAAE,sBAAsB,EAAE,WAAW;AAAA,IACjE,QAAQ;AACN,wBAAkB;AAAA,IACpB;AACA,UAAM,MAAgB,CAAC;AACvB,QAAI,CAAC,gBAAiB,KAAI,KAAK,wBAAwB;AACvD,QAAI,CAAC,WAAW,EAAE,cAAc,EAAG,KAAI,KAAK,gBAAgB;AAC5D,QAAI,CAAC,WAAW,EAAE,iBAAiB,EAAG,KAAI,KAAK,mBAAmB;AAElE,QAAI,EAAE,YAAY,CAAC,WAAW,EAAE,QAAQ,EAAG,KAAI,KAAK,UAAU;AAC9D,QAAI,EAAE,uBAAuB,CAAC,WAAW,EAAE,mBAAmB,GAAG;AAC/D,UAAI,KAAK,qBAAqB;AAAA,IAChC;AACA,QAAI,EAAE,0BAA0B,CAAC,WAAW,EAAE,sBAAsB,GAAG;AACrE,UAAI,KAAK,wBAAwB;AAAA,IACnC;AACA,QAAI,EAAE,sBAAsB;AAC1B,UAAI;AACF,YAAI,IAAI,IAAI,EAAE,oBAAoB,EAAE,WAAW,cAAc;AAC3D,cAAI,KAAK,sBAAsB;AAAA,QACjC;AAAA,MACF,QAAQ;AACN,YAAI,KAAK,sBAAsB;AAAA,MACjC;AAAA,IACF;AACA,QAAI,IAAI,SAAS,GAAG;AAClB,UAAI,CAAC,KAAK,wBAAwB;AAChC,aAAK,yBAAyB;AAC9B,gBAAQ;AAAA,UACN,wGAAqE,IAAI,KAAK,IAAI,CAAC;AAAA,QAErF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,gBAA+C;AAC3D,UAAM,MAAM,KAAK,IAAI;AAGrB,QAAI,KAAK,cAAc,MAAM,KAAK,sBAAsB,WAAU,kBAAkB;AAClF,aAAO,KAAK;AAAA,IACd;AAIA,UAAM,MAAM,GAAG,KAAK,WAAW;AAE/B,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,WAAU,oBAAoB;AAErF,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC1D,mBAAa,SAAS;AAEtB,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ,KAAK,2DAAuC,IAAI,MAAM,8CAAW;AACzE,eAAO;AAAA,MACT;AAEA,YAAM,MAAO,MAAM,IAAI,KAAK;AAE5B,YAAM,YAAY,KAAK,mBAAmB,GAAG;AAC7C,UAAI,CAAC,UAAW,QAAO;AACvB,WAAK,aAAa;AAClB,WAAK,sBAAsB;AAC3B,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,sDAAkC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACpF;AAEA,aAAO,KAAK,cAAc;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,wBAAyC;AACrD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,oBAAqC;AACjD,QAAI,KAAK,OAAO,cAAe,QAAO,GAAG,KAAK,WAAW;AACzD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,uBAAwC;AACpD,QAAI,KAAK,OAAO,cAAe,QAAO,GAAG,KAAK,WAAW;AACzD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,WAAyB;AACvD,QAAI,mBAAmB,WAAW,OAAO,SAAS,MAAM,GAAG;AAEzD,oBAAc,WAAW,KAAK,OAAO,QAAQ;AAAA,IAC/C,OAAO;AACL,cAAQ,KAAK,2FAAoC,SAAS,EAAE;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,MAAM,WAAoB,UAAwB,CAAC,GAAkB;AACzE,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAE5B,UAAM,QAAQ,cAAc;AAG5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAC1C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,QAAQ,WAAW,QAAQ;AAC7B,sBAAgB,OAAO,KAAK,OAAO,QAAQ;AAAA,IAC7C,OAAO;AACL,wBAAkB,KAAK,OAAO,QAAQ;AAAA,IACxC;AAEA,QAAI,WAAW;AACb,WAAK,wBAAwB,SAAS;AAAA,IACxC;AAGA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAC1C,QAAI,QAAQ,QAAQ;AAClB,aAAO,IAAI,UAAU,QAAQ,MAAM;AAAA,IACrC;AAGA,WAAO,SAAS,OAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,YAAY,WAAoB,UAAwB,CAAC,GAAoB;AACjF,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAE5B,UAAM,QAAQ,cAAc;AAE5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAC1C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,QAAQ,WAAW,QAAQ;AAC7B,sBAAgB,OAAO,KAAK,OAAO,QAAQ;AAAA,IAC7C,OAAO;AACL,wBAAkB,KAAK,OAAO,QAAQ;AAAA,IACxC;AAEA,QAAI,UAAW,MAAK,wBAAwB,SAAS;AAErD,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAC1C,QAAI,QAAQ,QAAQ;AAClB,aAAO,IAAI,UAAU,QAAQ,MAAM;AAAA,IACrC;AAEA,WAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAM,WACJ,UAAmE,CAAC,GAChD;AACpB,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAC5B,UAAM,QAAQ,cAAc;AAC5B,UAAM,aAAa,cAAc;AAEjC,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAC1C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,qBAAiB,GAAG,KAAK,OAAO,QAAQ,gBAAgB,UAAU;AAElE,QAAI,QAAQ,WAAW;AACrB,WAAK,wBAAwB,QAAQ,SAAS;AAAA,IAChD;AAEA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAE1C,WAAO,IAAI,eAAe,UAAU;AAEpC,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,QAAQ,SAAS,CAAC;AAC1D,UAAM,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,SAAS,UAAU,CAAC;AAE3D,UAAM,gBAAgB;AAAA,MACpB,SAAS,KAAK;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,QAAQ,KAAK,MAAM,IAAI,CAAC;AAAA,MACxB,OAAO,KAAK,MAAM,GAAG,CAAC;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG;AAEV,UAAM,QAAQ,OAAO;AAAA,MACnB,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,OAAO;AACV,yBAAmB,KAAK,OAAO,QAAQ;AACvC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxD,YAAM,IAAI,SAAS,iBAAiB,wGAAmB;AAAA,IACzD;AAGA,UAAM,oBAAoB,IAAI,IAAI,KAAK,OAAO,WAAW,EAAE;AAE3D,QAAI;AAEF,YAAM,MAAM;AAEZ,aAAO,MAAM,IAAI,QAAmB,CAAC,SAAS,WAAW;AACvD,YAAI,YAAY;AAEhB,cAAM,gBAAgB,CAAC,UAAwB;AAC7C,cAAI,UAAW;AAEf,cAAI,MAAM,WAAW,kBAAmB;AACxC,cAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,SAAS,6BAA8B;AACrE,cAAI,CAAC,MAAM,KAAK,YAAa;AAG7B,gBAAM,aAAa,gBAAgB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxE,cAAI,CAAC,cAAc,CAAC,sBAAsB,MAAM,KAAK,SAAS,IAAI,UAAU,EAAG;AAC/E,6BAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AAIxD,cAAI;AACF,YAAC,MAAM,QAA0B;AAAA,cAC/B,EAAE,MAAM,yBAAyB,OAAO,WAAW;AAAA,cACnD,MAAM;AAAA,YACR;AAAA,UACF,QAAQ;AAAA,UAER;AAEA,sBAAY;AACZ,kBAAQ;AAER,cAAI,SAAS,CAAC,MAAM,QAAQ;AAC1B,kBAAM,MAAM;AAAA,UACd;AAEA,eAAK,eAAe,MAAM,KAAK,WAAW,EACvC,KAAK,CAAC,cAAc;AAGnB,gBAAI,cAAc,MAAM;AACtB,qBAAO,IAAI,SAAS,qBAAqB,0FAAoB,CAAC;AAC9D;AAAA,YACF;AACA,oBAAQ,SAAS;AAAA,UACnB,CAAC,EACA,MAAM,MAAM;AAAA,QACjB;AAEA,cAAM,YAAY,YAAY,MAAM;AAClC,cAAI,MAAM,QAAQ;AAChB,gBAAI,CAAC,WAAW;AACd,0BAAY;AACZ,sBAAQ;AACR,qBAAO,IAAI,SAAS,gBAAgB,4CAAS,CAAC;AAAA,YAChD;AAAA,UACF;AAAA,QACF,GAAG,GAAG;AAEN,cAAM,UAAU,MAAM;AACpB,wBAAc,SAAS;AACvB,iBAAO,oBAAoB,WAAW,aAAa;AACnD,6BAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AAAA,QAC1D;AAEA,eAAO,iBAAiB,WAAW,aAAa;AAAA,MAClD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,yBAAmB,KAAK,OAAO,QAAQ;AACvC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAe,aAAgD;AACnE,UAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,UAAM,SAAS,IAAI;AAGnB,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAI,OAAO;AAIT,YAAM,qBAAqB,OAAO,IAAI,OAAO;AAC7C,YAAM,aAAa,eAAe,KAAK,OAAO,QAAQ;AACtD,YAAM,qBAAqB,cAAc,KAAK,OAAO,QAAQ;AAC7D,UACE,oBAAoB,IAAI,KAAK,KAC7B,cACA,sBACA,sBAAsB,oBAAoB,sBAAsB,EAAE,KAClE,sBAAsB,YAAY,sBAAsB,EAAE,GAC1D;AAEA,yBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAiB,KAAK,OAAO,QAAQ;AACrC,2BAAmB,KAAK,OAAO,QAAQ;AACvC,0BAAkB,KAAK,OAAO,QAAQ;AACtC,eAAO;AAAA,MACT;AAEA,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,YAAM,OAAO,OAAO,IAAI,mBAAmB,KAAK;AAChD,YAAM,IAAI,SAAS,uBAAuB,KAAK,GAAG,6BAAS,IAAI,EAAE;AAAA,IACnE;AAEA,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,gBAAgB,OAAO,IAAI,OAAO;AAExC,QAAI,CAAC,MAAM;AAET,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,YAAM,IAAI,SAAS,wBAAwB,wDAA+B;AAAA,IAC5E;AAGA,UAAM,aAAa,cAAc,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,cAAc,CAAC,sBAAsB,YAAY,iBAAiB,EAAE,GAAG;AAE1E,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,YAAM,IAAI,SAAS,kBAAkB,sFAA0B;AAAA,IACjE;AAIA,UAAM,cAAc,OAAO,IAAI,KAAK;AACpC,QAAI,aAAa;AACf,YAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,YAAM,kBAAkB,WAAW,UAAU,KAAK,OAAO,YAAY,QAAQ,QAAQ,EAAE;AACvF,UAAI,YAAY,QAAQ,QAAQ,EAAE,MAAM,gBAAgB;AACtD,yBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAiB,KAAK,OAAO,QAAQ;AACrC,2BAAmB,KAAK,OAAO,QAAQ;AACvC,0BAAkB,KAAK,OAAO,QAAQ;AACtC,cAAM,IAAI,SAAS,mBAAmB,+GAA+B;AAAA,MACvE;AAAA,IACF;AAIA,UAAM,gBAAgB,cAAc,KAAK,OAAO,QAAQ,KAAK;AAG7D,UAAM,WAAW,gBAAgB,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,SAAS,iBAAiB,4HAAkC;AAAA,IACxE;AAGA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,oBAAoB;AAC3C,SAAK,IAAI,QAAQ,IAAI;AACrB,SAAK,IAAI,iBAAiB,QAAQ;AAClC,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,SAAK,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAChD,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,iBAAiB,eAAe;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,wCAAU,GAAG;AAAA,IACnD;AAEA,QAAI,CAAC,IAAI,IAAI;AAGX,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,UAAI,UAAmC,CAAC;AACxC,UAAI;AACF,kBAAU,MAAM,IAAI,KAAK;AAAA,MAC3B,QAAQ;AAAA,MAER;AACA,YAAM,cAAe,QAAQ,SAAoB;AACjD,YAAM,IAAI;AAAA,QACR,uBAAuB,WAAW;AAAA,QACjC,QAAQ,qBAAgC,wCAAoB,IAAI,MAAM;AAAA,MACzE;AAAA,IACF;AAIA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAI3C,6BAAyB,MAAM,IAAI;AAInC,UAAM,mBAAmB,KAAK,OAAO,UAAU,kBAAkB,MAAM,GAAG,EAAE,OAAO,OAAO;AAC1F,QAAI,gBAAgB,SAAS,QAAQ,KAAK,CAAC,KAAK,UAAU;AAExD,uBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,wBAAkB,KAAK,OAAO,QAAQ;AACtC,sBAAgB,KAAK,OAAO,QAAQ;AACpC,YAAM,IAAI,SAAS,oBAAoB,2FAAyC;AAAA,IAClF;AAGA,QAAI,KAAK,UAAU;AACjB,UAAI;AACF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,UACZ,EAAE,cAAc;AAAA,QAClB;AAAA,MACF,SAAS,KAAK;AAEZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAKA,qBAAiB,KAAK,OAAO,QAAQ;AACrC,qBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAmB,KAAK,OAAO,QAAQ;AACvC,sBAAkB,KAAK,OAAO,QAAQ;AAEtC,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,SAAK,SAAS,kDAA8B,EAAE,UAAU,KAAK,OAAO,SAAS,CAAC;AAC9E,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAmC;AAEvC,QAAI,KAAK,aAAc,QAAO,KAAK;AAEnC,SAAK,eAAe,KAAK,gBAAgB;AACzC,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,kBAAsC;AAClD,UAAM,UAAU,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,SAAS,oBAAoB,8CAAqB;AAAA,IAC9D;AAEA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,eAAe;AACtC,SAAK,IAAI,iBAAiB,QAAQ,aAAa;AAC/C,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI,MAAuB;AAC3B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,iBAAiB,eAAe;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,gBAAU;AAAA,IACZ;AACA,QAAI,WAAW,CAAC,KAAK;AACnB,YAAM,IAAI,SAAS,iBAAiB,2DAAmB,OAAO;AAAA,IAChE;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AACF,kBAAU,MAAM,IAAI,KAAK;AAAA,MAC3B,QAAQ;AAAA,MAER;AACA,YAAM,YAAa,QAAQ,SAAoB;AAI/C,UAAI,cAAc,iBAAiB;AACjC,wBAAgB,KAAK,OAAO,QAAQ;AAAA,MACtC;AACA,WAAK,SAAS,0CAAsB,EAAE,QAAQ,IAAI,QAAQ,OAAO,UAAU,CAAC;AAC5E,UAAI,CAAC,aAAa,IAAI,WAAW,KAAK;AACpC,cAAM,IAAI,SAAS,oBAAoB,yGAAyB;AAAA,MAClE;AACA,YAAM,IAAI;AAAA,QACR,uBAAuB,WAAW,SAAS;AAAA,QAC1C,QAAQ,qBAAgC,yCAAqB,IAAI,MAAM;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAI3C,6BAAyB,MAAM,KAAK;AAEpC,QAAI,KAAK,UAAU;AACjB,UAAI;AAKF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,QACd;AAAA,MACF,SAAS,KAAK;AACZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA;AAAA,MAEjB,eAAe,KAAK,iBAAiB,QAAQ;AAAA,MAC7C,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAgC;AACpC,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AAEjD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,SAAS,qBAAqB,oBAAK;AAAA,IAC/C;AAGA,QAAI,KAAK,IAAI,KAAK,UAAU,aAAa,gBAAgB;AACvD,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,UAAM,mBAAmB,MAAM,KAAK,qBAAqB;AAEzD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,iBAAiB,kBAAkB;AAAA,QAC7C,SAAS;AAAA,UACP,eAAe,UAAU,UAAU,YAAY;AAAA,QACjD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,4EAAgB,GAAG;AAAA,IACzD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,IAAI,WAAW,KAAK;AACtB,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM,IAAI,SAAS,qBAAqB,0BAAW;AAAA,MACrD;AACA,YAAM,IAAI,SAAS,mBAAmB,0DAAkB,IAAI,MAAM,EAAE;AAAA,IACtE;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAyC;AAC7C,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,UAAW,QAAO;AAEvB,QAAI,KAAK,IAAI,KAAK,UAAU,aAAa,gBAAgB;AACvD,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAA2B;AACzB,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,QAAI,CAAC,UAAW,QAAO;AACvB,WAAO,KAAK,IAAI,IAAI,UAAU;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAO,gBAAyB,OAAsB;AAE1D,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,UAAM,eAAe,WAAW;AAChC,UAAM,cAAc,WAAW;AAE/B,oBAAgB,KAAK,OAAO,QAAQ;AACpC,SAAK,SAAS,sDAAmB;AAAA,MAC/B,UAAU,KAAK,OAAO;AAAA,MACtB;AAAA,IACF,CAAC;AAID,QAAI,gBAAgB,KAAK,OAAO,UAAU;AACxC,UAAI;AAGF,cAAM,YAAY,KAAK,OAAO,gBAAgB,OAAO,MAAM,KAAK,cAAc;AAC9E,cAAM,YAAY,KAAK,OAAO,gBAC1B,GAAG,KAAK,WAAW,sBACnB,WAAW,uBAAuB,GAAG,KAAK,OAAO,UAAU;AAC/D,cAAM,aAAa,IAAI,gBAAgB;AAAA,UACrC,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,WAAW,KAAK,OAAO;AAAA,QACzB,CAAC;AACD,YAAI,KAAK,OAAO,cAAc;AAC5B,qBAAW,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,QAC1D;AACA,cAAM,WAAW,MACf;AAAA,UACE;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,YAC/D,MAAM,WAAW,SAAS;AAAA,UAC5B;AAAA,UACA;AAAA,QACF;AACF,YAAI,MAAM,MAAM,SAAS;AAEzB,YAAI,CAAC,IAAI,OAAO,IAAI,UAAU,OAAO,IAAI,WAAW,MAAM;AACxD,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AACvD,gBAAM,MAAM,SAAS;AAAA,QACvB;AACA,YAAI,CAAC,IAAI,IAAI;AACX,eAAK,SAAS,qEAAkC,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,QACxE;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,eAAe;AAEjB,YAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,YAAM,qBACJ,WAAW,wBAAwB,GAAG,KAAK,OAAO,UAAU;AAC9D,YAAM,YAAY,IAAI,IAAI,kBAAkB;AAC5C,gBAAU,aAAa,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5D,YAAM,gBAAgB,KAAK,OAAO,yBAAyB,KAAK,OAAO;AACvE,UAAI,eAAe;AACjB,kBAAU,aAAa,IAAI,4BAA4B,aAAa;AAAA,MACtE;AACA,UAAI,aAAa;AACf,kBAAU,aAAa,IAAI,iBAAiB,WAAW;AAAA,MACzD;AAEA,YAAM,QAAQ,cAAc;AAC5B,sBAAgB,OAAO,KAAK,OAAO,QAAQ;AAC3C,gBAAU,aAAa,IAAI,SAAS,KAAK;AACzC,aAAO,SAAS,OAAO,UAAU,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,oBAAoB,KAAsB;AACxC,UAAM,gBAAgB,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,OAAO;AAC3D,QAAI,CAAC,cAAe,QAAO;AAC3B,UAAM,aAAa,eAAe,KAAK,OAAO,QAAQ;AACtD,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,CAAC,sBAAsB,YAAY,aAAa,EAAG,QAAO;AAE9D,sBAAkB,KAAK,OAAO,QAAQ;AACtC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,eAA8C;AAClD,WAAO,KAAK,cAAc;AAAA,EAC5B;AACF;AAAA;AAn9Ba,WAWa,mBAAmB,IAAI,KAAK;AAAA;AAXzC,WAca,uBAAuB;AAd1C,IAAM,YAAN;","names":[]}