npm - @oneidentity/safeguard - Versions diffs - 8.1.0 → 8.2.0 - Mend

@oneidentity/safeguard 8.1.0 → 8.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","names":["#value","#store","#agent","undiciRequest","#credentials","#doFetch","#username","#password","#provider","#getRstsToken","#exchangeForUserToken","#certFile","#keyFile","#cert","#key","#pfxFile","#pfx","#passphrase","#provider","#getRstsToken","#exchangeForUserToken","#redirectUri","#provider","#exchangeCode","#initiateRedirect","#provider","#callbackPort","#openBrowser","#exchangeCode","#onDeviceCode","#provider","#clientId","#pollingIntervalSeconds","#signal","#requestDeviceCode","#poll","#exchangeForUserToken","#accessToken","#host","#auth","#apiVersion","#timeout","#autoRefresh","#ca","#verify","#storage","#connected","#httpClient","#tokenSet","#ensureValidToken","#tokenRefreshPromise","#host","#auth","#ca","#verify","#apiVersion","#httpClient","#a2aRequest","#ensureHttpClient"],"sources":["../src/types.ts","../src/errors.ts","../src/secret.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/storage/types.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/device-code.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"sourcesContent":["/*\n Safeguard appliance service endpoints.\n /\nexport enum Service {\n CORE = 'core',\n APPLIANCE = 'appliance',\n NOTIFICATION = 'notification',\n A2A = 'a2a',\n EVENT = 'event',\n RSTS = 'RSTS',\n}\n\n/\n HTTP methods supported by the Safeguard API.\n /\nexport enum HttpMethod {\n GET = 'GET',\n POST = 'POST',\n PUT = 'PUT',\n DELETE = 'DELETE',\n PATCH = 'PATCH',\n}\n\n/\n Full response from a Safeguard API call (returned when fullResponse: true).\n /\nexport interface SafeguardResponse<T = unknown> {\n data: T;\n status: number;\n headers: Record<string, string>;\n}\n\n/\n Options for individual API requests.\n /\nexport interface RequestOptions {\n /* Request body as JSON-serializable object. /\n json?: unknown;\n /* Raw request body. /\n body?: BodyInit \| null;\n /* Additional HTTP headers. /\n headers?: Record<string, string>;\n /* URL query parameters. /\n query?: Record<string, string \| number \| boolean>;\n /* AbortSignal for request cancellation. /\n signal?: AbortSignal;\n /* Request timeout in milliseconds (overrides client default). /\n timeout?: number;\n /* If true, returns full response with status and headers. /\n fullResponse?: boolean;\n}\n\n/\n Options for constructing a SafeguardClient.\n /\nexport interface SafeguardClientOptions {\n /* Authentication strategy. /\n auth: import('./auth/types.js').Auth;\n /* Custom CA certificate (PEM string or Buffer). Node.js only. /\n ca?: string \| Buffer;\n /* Whether to verify TLS certificates. Default: true. /\n verify?: boolean;\n /* Safeguard API version prefix. Default: 'v4'. /\n apiVersion?: string;\n /* Request timeout in milliseconds. Default: 300_000 (5 min). /\n timeout?: number;\n /* Auto-refresh tokens before expiry. Default: true. /\n autoRefresh?: boolean;\n}\n","/\n Error hierarchy for the Safeguard SDK.\n \n SafeguardError\n * ├── ApiError (HTTP errors from Safeguard API)\n * │ ├── AuthenticationError (401)\n * │ ├── AuthorizationError (403)\n * │ └── NotFoundError (404)\n * ├── TransportError (Network/connection failures)\n * └── ConfigurationError (Invalid client options)\n /\n\nexport class SafeguardError extends Error {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'SafeguardError';\n }\n}\n\nexport interface ApiErrorBody {\n Code?: string;\n Message?: string;\n InnerError?: { Message?: string };\n [key: string]: unknown;\n}\n\nexport class ApiError extends SafeguardError {\n readonly status: number;\n readonly body: ApiErrorBody \| null;\n\n constructor(message: string, status: number, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, options);\n this.name = 'ApiError';\n this.status = status;\n this.body = body;\n }\n\n /\n Creates an appropriate ApiError subclass based on HTTP status code.\n /\n static fromResponse(status: number, body: string \| ApiErrorBody \| null): ApiError {\n const parsed = ApiError.parseBody(body);\n const message = ApiError.buildMessage(status, parsed);\n\n switch (status) {\n case 401:\n return new AuthenticationError(message, parsed);\n case 403:\n return new AuthorizationError(message, parsed);\n case 404:\n return new NotFoundError(message, parsed);\n default:\n return new ApiError(message, status, parsed);\n }\n }\n\n private static parseBody(body: string \| ApiErrorBody \| null): ApiErrorBody \| null {\n if (body === null \|\| body === undefined) return null;\n if (typeof body === 'object') return body;\n try {\n return JSON.parse(body) as ApiErrorBody;\n } catch {\n return { Message: body };\n }\n }\n\n private static buildMessage(status: number, body: ApiErrorBody \| null): string {\n const apiMessage = body?.Message ?? body?.InnerError?.Message;\n if (apiMessage) {\n return `HTTP ${String(status)}: ${apiMessage}`;\n }\n return `HTTP ${String(status)}`;\n }\n}\n\nexport class AuthenticationError extends ApiError {\n constructor(message: string, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, 401, body, options);\n this.name = 'AuthenticationError';\n }\n}\n\nexport class AuthorizationError extends ApiError {\n constructor(message: string, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, 403, body, options);\n this.name = 'AuthorizationError';\n }\n}\n\nexport class NotFoundError extends ApiError {\n constructor(message: string, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, 404, body, options);\n this.name = 'NotFoundError';\n }\n}\n\nexport class TransportError extends SafeguardError {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'TransportError';\n }\n}\n\nexport class ConfigurationError extends SafeguardError {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'ConfigurationError';\n }\n}\n","const REDACTED = '[REDACTED]';\n\n/\n A wrapper that prevents accidental logging of sensitive values.\n \n - `toString()` returns \"[REDACTED]\"\n * - `toJSON()` returns \"[REDACTED]\"\n * - `console.log(secretValue)` prints \"[REDACTED]\"\n * - `.expose()` returns the raw value when intentionally needed\n /\nexport class SecretValue {\n readonly #value: string;\n\n constructor(value: string) {\n this.#value = value;\n }\n\n /* Returns the raw secret. Use only when you intentionally need the plaintext. /\n expose(): string {\n return this.#value;\n }\n\n toString(): string {\n return REDACTED;\n }\n\n toJSON(): string {\n return REDACTED;\n }\n\n /* Node.js custom inspect (prevents leaking in console.log / util.inspect). /\n [Symbol.for('nodejs.util.inspect.custom')](): string {\n return REDACTED;\n }\n\n get [Symbol.toStringTag](): string {\n return 'SecretValue';\n }\n}\n","import { Service } from './types.js';\nimport { ConfigurationError } from './errors.js';\n\n/\n Validates that a host string is a bare hostname or IP address.\n * Rejects URLs, paths, query strings, userinfo, and embedded ports.\n \n @throws {ConfigurationError} if the host contains disallowed characters\n /\nexport function validateHost(host: string): string {\n if (!host) throw new ConfigurationError('Host must not be empty');\n\n const trimmed = host.trim();\n if (trimmed !== host) {\n throw new ConfigurationError('Host must not contain leading or trailing whitespace');\n }\n\n // Reject protocol prefixes\n if (/^[a-z][a-z0-9+.-]:\\/\\//i.test(host)) {\n throw new ConfigurationError(\n `Host must be a bare hostname or IP, not a URL. Remove the protocol prefix (e.g., use \"${host.replace(/^[a-z][a-z0-9+.-]:\\/\\//i, '')}\")`,\n );\n }\n\n // Reject path, query, fragment, userinfo characters\n if (/[/?#@]/.test(host)) {\n throw new ConfigurationError(\n 'Host must be a bare hostname or IP address — must not contain /, ?, #, or @',\n );\n }\n\n // Reject port suffix (e.g. \"host:8443\") — SDK always uses HTTPS/443\n if (/:\\d+$/.test(host) && !host.startsWith('[')) {\n throw new ConfigurationError(\n 'Host must not include a port number. The SDK always connects over HTTPS (port 443).',\n );\n }\n\n return host;\n}\n\n/\n Builds the base URL for a Safeguard service endpoint.\n \n @example\n * buildServiceUrl('appliance.example.com', Service.CORE)\n * // => 'https://appliance.example.com/service/core/v4'\n /\nexport function buildServiceUrl(host: string, service: Service, apiVersion: string = 'v4'): string {\n if (service === Service.RSTS) {\n return `https://${host}/RSTS`;\n }\n return `https://${host}/service/${service}/${apiVersion}`;\n}\n\n/\n Builds a full API URL including path and optional query parameters.\n \n @example\n * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq \"admin\"' })\n * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'\n /\nexport function buildRequestUrl(\n host: string,\n service: Service,\n relativeUrl: string,\n query?: Record<string, string \| number \| boolean>,\n apiVersion: string = 'v4',\n): string {\n const base = buildServiceUrl(host, service, apiVersion);\n const path = relativeUrl.startsWith('/') ? relativeUrl.slice(1) : relativeUrl;\n const url = new URL(`${base}/${path}`);\n\n if (query) {\n for (const [key, value] of Object.entries(query)) {\n url.searchParams.set(key, String(value));\n }\n }\n\n return url.toString();\n}\n\n/\n Encodes bytes to a URL-safe base64 string (no padding).\n /\nexport function base64UrlEncode(bytes: Uint8Array): string {\n const binary = String.fromCharCode(...bytes);\n return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/\n Generates a cryptographically random code verifier for PKCE.\n * Returns a 43-character base64url string (32 random bytes).\n /\nexport function generateCodeVerifier(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return base64UrlEncode(bytes);\n}\n\n/\n Computes the S256 code challenge from a code verifier.\n * Uses Web Crypto API (available in Node 20+ and all modern browsers).\n /\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n const encoder = new TextEncoder();\n const data = encoder.encode(verifier);\n const digest = await crypto.subtle.digest('SHA-256', data);\n return base64UrlEncode(new Uint8Array(digest));\n}\n\n/\n Generates a random state parameter for OAuth flows.\n /\nexport function generateState(): string {\n const bytes = new Uint8Array(16);\n crypto.getRandomValues(bytes);\n return base64UrlEncode(bytes);\n}\n\n/\n Extracts the `exp` claim from a JWT and returns expiresIn (seconds from now).\n * Returns undefined if the token is not a valid JWT or has no `exp` claim.\n /\nexport function getTokenExpiresIn(jwt: string): number \| undefined {\n try {\n const parts = jwt.split('.');\n if (parts.length !== 3) return undefined;\n // Base64url decode the payload\n const payload = parts[1]!.replace(/-/g, '+').replace(/_/g, '/');\n const json = atob(payload);\n const claims = JSON.parse(json) as { exp?: number };\n if (typeof claims.exp !== 'number') return undefined;\n const now = Math.floor(Date.now() / 1000);\n return Math.max(0, claims.exp - now);\n } catch {\n return undefined;\n }\n}\n","import type { StorageProvider } from './types.js';\n\n/\n In-memory storage provider. Default for Node.js environments.\n * Data does not persist across process restarts.\n /\nexport class MemoryStorage implements StorageProvider {\n readonly #store = new Map<string, string>();\n\n get(key: string): string \| null {\n return this.#store.get(key) ?? null;\n }\n\n set(key: string, value: string): void {\n this.#store.set(key, value);\n }\n\n remove(key: string): void {\n this.#store.delete(key);\n }\n\n clear(): void {\n this.#store.clear();\n }\n}\n","import type { StorageProvider } from './types.js';\n\n/\n Browser sessionStorage adapter. Data persists for the browser tab lifetime.\n * Requires a DOM environment (browser or jsdom).\n /\nexport class BrowserSessionStorage implements StorageProvider {\n get(key: string): string \| null {\n return sessionStorage.getItem(key);\n }\n\n set(key: string, value: string): void {\n sessionStorage.setItem(key, value);\n }\n\n remove(key: string): void {\n sessionStorage.removeItem(key);\n }\n\n clear(): void {\n sessionStorage.clear();\n }\n}\n","/\n Interface for token/state storage backends.\n /\nexport interface StorageProvider {\n get(key: string): string \| null;\n set(key: string, value: string): void;\n remove(key: string): void;\n clear(): void;\n}\n\n/* Well-known storage keys used by the SDK. /\nexport const StorageKeys = {\n STATE: 'safeguard_state',\n CODE_VERIFIER: 'safeguard_code_verifier',\n} as const;\n","import { Agent, request as undiciRequest } from 'undici';\nimport type { HttpClient, HttpRequestOptions, HttpResponse, TlsOptions } from './types.js';\n\n/\n Node.js HTTP client using undici for full TLS control.\n * Creates a per-instance Agent — no global state mutation.\n /\nexport class NodeHttpClient implements HttpClient {\n readonly #agent: Agent;\n\n constructor(tlsOptions?: TlsOptions) {\n this.#agent = new Agent({\n connect: {\n ca: tlsOptions?.ca,\n cert: tlsOptions?.cert,\n key: tlsOptions?.key,\n passphrase: tlsOptions?.passphrase,\n rejectUnauthorized: tlsOptions?.rejectUnauthorized ?? true,\n },\n });\n }\n\n async request(options: HttpRequestOptions): Promise<HttpResponse> {\n const { url, method, headers, body, signal, timeout } = options;\n\n const requestOptions: Parameters<typeof undiciRequest>[1] = {\n method: method as 'GET' \| 'POST' \| 'PUT' \| 'DELETE' \| 'PATCH',\n dispatcher: this.#agent,\n };\n\n if (headers) requestOptions.headers = headers;\n if (body != null) requestOptions.body = body;\n if (signal) requestOptions.signal = signal;\n if (timeout) {\n requestOptions.bodyTimeout = timeout;\n requestOptions.headersTimeout = timeout;\n }\n\n const response = await undiciRequest(url, requestOptions);\n\n const responseHeaders: Record<string, string> = {};\n const rawHeaders = response.headers;\n for (const [key, value] of Object.entries(rawHeaders)) {\n if (value !== undefined) {\n responseHeaders[key] = Array.isArray(value) ? value.join(', ') : value;\n }\n }\n\n const responseBody = await response.body.text();\n\n return {\n status: response.statusCode,\n headers: responseHeaders,\n body: responseBody,\n };\n }\n\n dispose(): void {\n this.#agent.close().catch(() => { / already closed or destroyed / });\n }\n}\n","import type { HttpClient, HttpRequestOptions, HttpResponse } from './types.js';\n\n/\n Browser HTTP client using native fetch API.\n * No TLS configuration needed — browser handles certificates.\n /\nexport class BrowserHttpClient implements HttpClient {\n readonly #credentials: RequestCredentials;\n\n constructor(options?: { credentials?: RequestCredentials }) {\n this.#credentials = options?.credentials ?? 'include';\n }\n\n async request(options: HttpRequestOptions): Promise<HttpResponse> {\n const { url, method, headers, body, signal, timeout } = options;\n\n const requestInit: RequestInit = {\n method,\n credentials: this.#credentials,\n };\n\n if (headers) requestInit.headers = headers;\n if (body != null) requestInit.body = body as BodyInit;\n if (signal \|\| timeout) {\n const controller = new AbortController();\n let timeoutId: ReturnType<typeof setTimeout> \| undefined;\n\n if (timeout) {\n timeoutId = setTimeout(() => controller.abort(new Error('Request timed out')), timeout);\n }\n\n requestInit.signal = signal\n ? AbortSignal.any([signal, controller.signal])\n : controller.signal;\n\n try {\n return await this.#doFetch(url, requestInit);\n } finally {\n if (timeoutId !== undefined) clearTimeout(timeoutId);\n }\n }\n\n return this.#doFetch(url, requestInit);\n }\n\n async #doFetch(url: string, init: RequestInit): Promise<HttpResponse> {\n const response = await fetch(url, init);\n\n const responseHeaders: Record<string, string> = {};\n response.headers.forEach((value, key) => {\n responseHeaders[key] = value;\n });\n\n const responseBody = await response.text();\n\n return {\n status: response.status,\n headers: responseHeaders,\n body: responseBody,\n };\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { getTokenExpiresIn } from '../utils.js';\n\nexport interface PasswordAuthOptions {\n username: string;\n password: string;\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n}\n\n/\n Authenticates using username/password via RSTS Resource Owner grant.\n /\nexport class PasswordAuth implements Auth {\n readonly #username: string;\n readonly #password: SecretValue;\n readonly #provider: string;\n\n constructor(options: PasswordAuthOptions) {\n if (!options.username) throw new ConfigurationError('PasswordAuth requires username');\n if (!options.password) throw new ConfigurationError('PasswordAuth requires password');\n if (!options.provider) throw new ConfigurationError('PasswordAuth requires provider');\n this.#username = options.username;\n this.#password = new SecretValue(options.password);\n this.#provider = options.provider;\n }\n\n get description(): string {\n return `PasswordAuth(${this.#username}@${this.#provider})`;\n }\n\n async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n // Step 1: Get RSTS token\n const rstsToken = await this.#getRstsToken(host, httpClient);\n\n // Step 2: Exchange RSTS token for Safeguard user token\n const userToken = await this.#exchangeForUserToken(host, httpClient, rstsToken);\n\n return userToken;\n }\n\n async refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet \| null> {\n // Password auth can always re-authenticate\n return this.authenticate(host, httpClient, storage);\n }\n\n async #getRstsToken(host: string, httpClient: HttpClient): Promise<string> {\n const body = JSON.stringify({\n grant_type: 'password',\n username: this.#username,\n password: this.#password.expose(),\n scope: 'rsts:sts:primaryproviderid:' + this.#provider.toLowerCase(),\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body,\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string };\n return data.access_token;\n }\n\n async #exchangeForUserToken(host: string, httpClient: HttpClient, rstsToken: string): Promise<TokenSet> {\n const response = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${rstsToken}`,\n },\n body: JSON.stringify({ StsAccessToken: rstsToken }),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(data.UserToken),\n acquiredAt: Date.now(),\n };\n if (data.ExpiresIn != null) {\n tokenSet.expiresIn = data.ExpiresIn;\n } else {\n const expiresIn = getTokenExpiresIn(data.UserToken);\n if (expiresIn != null) tokenSet.expiresIn = expiresIn;\n }\n return tokenSet;\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { getTokenExpiresIn } from '../utils.js';\n\nexport interface CertificateAuthOptions {\n /* Path to PEM certificate file, or PEM string. /\n certFile?: string;\n /* Path to PEM private key file, or PEM string. /\n keyFile?: string;\n /* PEM certificate content (alternative to certFile). /\n cert?: string \| Buffer;\n /* PEM key content (alternative to keyFile). /\n key?: string \| Buffer;\n /* Path to PFX/PKCS12 file (alternative to cert+key). /\n pfxFile?: string;\n /* PFX/PKCS12 content (alternative to cert+key). /\n pfx?: string \| Buffer;\n /* Passphrase for encrypted private key or PFX. /\n passphrase?: string;\n /* Identity provider name. Default: 'certificate'. /\n provider?: string;\n}\n\n/\n Authenticates using a client certificate (mTLS) against RSTS.\n * Node.js only — requires TLS client cert support in HttpClient.\n /\nexport class CertificateAuth implements Auth {\n readonly #certFile: string \| undefined;\n readonly #keyFile: string \| undefined;\n readonly #cert: string \| Buffer \| undefined;\n readonly #key: string \| Buffer \| undefined;\n readonly #pfxFile: string \| undefined;\n readonly #pfx: string \| Buffer \| undefined;\n readonly #passphrase: SecretValue \| undefined;\n readonly #provider: string;\n\n constructor(options: CertificateAuthOptions) {\n const hasPfx = options.pfx ?? options.pfxFile;\n const hasCert = options.cert ?? options.certFile;\n const hasKey = options.key ?? options.keyFile;\n if (!hasPfx && !hasCert) throw new ConfigurationError('CertificateAuth requires cert/certFile or pfxFile/pfx');\n if (!hasPfx && !hasKey) throw new ConfigurationError('CertificateAuth requires key or keyFile');\n this.#certFile = options.certFile;\n this.#keyFile = options.keyFile;\n this.#cert = options.cert;\n this.#key = options.key;\n this.#pfxFile = options.pfxFile;\n this.#pfx = options.pfx;\n this.#passphrase = options.passphrase ? new SecretValue(options.passphrase) : undefined;\n this.#provider = options.provider ?? 'certificate';\n }\n\n get description(): string {\n return `CertificateAuth(${this.#provider})`;\n }\n\n /* Returns the TLS options needed to create an mTLS HttpClient. /\n getTlsOptions(): { cert?: string \| Buffer; key?: string \| Buffer; pfx?: string \| Buffer; passphrase?: string } {\n const opts: { cert?: string \| Buffer; key?: string \| Buffer; pfx?: string \| Buffer; passphrase?: string } = {};\n if (this.#pfx ?? this.#pfxFile) {\n opts.pfx = this.#pfx ?? this.#pfxFile!;\n } else {\n opts.cert = this.#cert ?? this.#certFile!;\n opts.key = this.#key ?? this.#keyFile!;\n }\n if (this.#passphrase) opts.passphrase = this.#passphrase.expose();\n return opts;\n }\n\n async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n // Step 1: Get RSTS token using client cert (mTLS)\n const rstsToken = await this.#getRstsToken(host, httpClient);\n\n // Step 2: Exchange RSTS token for Safeguard user token\n return this.#exchangeForUserToken(host, httpClient, rstsToken);\n }\n\n async refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet \| null> {\n return this.authenticate(host, httpClient, storage);\n }\n\n async #getRstsToken(host: string, httpClient: HttpClient): Promise<string> {\n const body = JSON.stringify({\n grant_type: 'client_credentials',\n scope: 'rsts:sts:primaryproviderid:' + this.#provider.toLowerCase(),\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body,\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string };\n return data.access_token;\n }\n\n async #exchangeForUserToken(host: string, httpClient: HttpClient, rstsToken: string): Promise<TokenSet> {\n const response = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${rstsToken}`,\n },\n body: JSON.stringify({ StsAccessToken: rstsToken }),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(data.UserToken),\n acquiredAt: Date.now(),\n };\n if (data.ExpiresIn != null) {\n tokenSet.expiresIn = data.ExpiresIn;\n } else {\n const expiresIn = getTokenExpiresIn(data.UserToken);\n if (expiresIn != null) tokenSet.expiresIn = expiresIn;\n }\n return tokenSet;\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { StorageKeys } from '../storage/types.js';\nimport { generateCodeVerifier, generateCodeChallenge, generateState } from '../utils.js';\n\nexport interface PkceAuthOptions {\n /* OAuth redirect URI (must match RSTS configuration). /\n redirectUri: string;\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n}\n\n/\n Authenticates using PKCE (Proof Key for Code Exchange) with browser redirect.\n * For browser environments where the user is redirected to RSTS login.\n /\nexport class PkceAuth implements Auth {\n readonly #redirectUri: string;\n readonly #provider: string;\n\n constructor(options: PkceAuthOptions) {\n if (!options.redirectUri) throw new ConfigurationError('PkceAuth requires redirectUri');\n if (!options.provider) throw new ConfigurationError('PkceAuth requires provider');\n this.#redirectUri = options.redirectUri;\n this.#provider = options.provider;\n }\n\n get description(): string {\n return `PKCE(redirect=${this.#redirectUri})`;\n }\n\n /\n Initiates the PKCE flow. If a stored authorization code exists (from callback),\n * exchanges it for a token. Otherwise, redirects to RSTS login.\n /\n async authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet> {\n // Check for authorization code (set by handlePkceCallback)\n const code = storage.get('safeguard_auth_code');\n if (code) {\n const verifier = storage.get(StorageKeys.CODE_VERIFIER);\n if (!verifier) {\n throw new ConfigurationError('PKCE code verifier not found in storage');\n }\n storage.remove('safeguard_auth_code');\n storage.remove(StorageKeys.CODE_VERIFIER);\n storage.remove(StorageKeys.STATE);\n return this.#exchangeCode(host, httpClient, code, verifier);\n }\n\n // No code — initiate redirect\n await this.#initiateRedirect(host, storage);\n\n // This point is never reached in a browser (redirect happens).\n // For testability, throw rather than hang.\n throw new ConfigurationError(\n 'PKCE redirect initiated. Call handlePkceCallback() on the callback page.',\n );\n }\n\n async #initiateRedirect(host: string, storage: StorageProvider): Promise<void> {\n const verifier = generateCodeVerifier();\n const challenge = await generateCodeChallenge(verifier);\n const state = generateState();\n\n storage.set(StorageKeys.CODE_VERIFIER, verifier);\n storage.set(StorageKeys.STATE, state);\n\n const params = new URLSearchParams({\n response_type: 'code',\n client_id: 'safeguard.js',\n redirect_uri: this.#redirectUri,\n scope: 'rsts:sts:primaryproviderid:' + this.#provider,\n code_challenge: challenge,\n code_challenge_method: 'S256',\n state,\n });\n\n const authUrl = `https://${host}/RSTS/Login?${params.toString()}`;\n\n // In browser environment, redirect\n if (typeof window !== 'undefined' && window.location) {\n window.location.href = authUrl;\n }\n }\n\n async #exchangeCode(\n host: string,\n httpClient: HttpClient,\n code: string,\n verifier: string,\n ): Promise<TokenSet> {\n const body = new URLSearchParams({\n grant_type: 'authorization_code',\n code,\n redirect_uri: this.#redirectUri,\n client_id: 'safeguard.js',\n code_verifier: verifier,\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: body.toString(),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string; expires_in?: number };\n\n // Exchange RSTS token for Safeguard user token\n const userTokenResponse = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${data.access_token}`,\n },\n body: JSON.stringify({ StsAccessToken: data.access_token }),\n });\n\n if (userTokenResponse.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(userTokenResponse.status, userTokenResponse.body);\n }\n\n const userData = JSON.parse(userTokenResponse.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(userData.UserToken),\n acquiredAt: Date.now(),\n };\n if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n\n // Token stays in-memory only (SafeguardClient.#tokenSet). Not persisted to\n // sessionStorage to avoid XSS exfiltration of high-privilege PAM tokens.\n return tokenSet;\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { generateCodeVerifier, generateCodeChallenge, generateState } from '../utils.js';\n\nexport interface PkceNonInteractiveAuthOptions {\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n /* Port for the local callback server. Default: 8400. /\n callbackPort?: number;\n}\n\n/\n Non-interactive PKCE authentication for Node.js automation.\n * Starts a local HTTP server to receive the callback, opens the system browser\n * for login, and waits for the redirect.\n \n Matches PySafeguard's PkceAuth behavior (local server pattern).\n /\nexport class PkceNonInteractiveAuth implements Auth {\n readonly #provider: string;\n readonly #callbackPort: number;\n\n constructor(options?: PkceNonInteractiveAuthOptions) {\n this.#provider = options?.provider ?? 'local';\n this.#callbackPort = options?.callbackPort ?? 8400;\n }\n\n get description(): string {\n return `PkceNonInteractiveAuth(port=${String(this.#callbackPort)})`;\n }\n\n async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n const { createServer } = await import('node:http');\n const { once } = await import('node:events');\n\n const verifier = generateCodeVerifier();\n const challenge = await generateCodeChallenge(verifier);\n const state = generateState();\n const redirectUri = `http://localhost:${String(this.#callbackPort)}/callback`;\n\n // Start local server to receive callback.\n // Bind explicitly to the loopback interface (127.0.0.1) so a co-resident\n // process on a shared host cannot intercept the authorization code by\n // racing the legitimate browser callback on the ephemeral port.\n const server = createServer();\n server.listen(this.#callbackPort, '127.0.0.1');\n\n const params = new URLSearchParams({\n response_type: 'code',\n client_id: 'safeguard.js',\n redirect_uri: redirectUri,\n scope: 'rsts:sts:primaryproviderid:' + this.#provider,\n code_challenge: challenge,\n code_challenge_method: 'S256',\n state,\n });\n\n const authUrl = `https://${host}/RSTS/Login?${params.toString()}`;\n\n // Open browser\n await this.#openBrowser(authUrl);\n\n // Wait for callback\n const code = await new Promise<string>((resolve, reject) => {\n const timeout = setTimeout(() => {\n server.close();\n reject(new ConfigurationError('PKCE callback timed out after 120 seconds'));\n }, 120_000);\n\n server.on('request', (req, res) => {\n const url = new URL(req.url ?? '/', `http://localhost:${String(this.#callbackPort)}`);\n if (url.pathname === '/callback') {\n const receivedCode = url.searchParams.get('code');\n const receivedState = url.searchParams.get('state');\n\n if (receivedState !== state) {\n res.writeHead(400, { 'Content-Type': 'text/plain' });\n res.end('State mismatch');\n clearTimeout(timeout);\n server.close();\n reject(new ConfigurationError('PKCE state mismatch'));\n return;\n }\n\n if (!receivedCode) {\n res.writeHead(400, { 'Content-Type': 'text/plain' });\n res.end('No authorization code received');\n clearTimeout(timeout);\n server.close();\n reject(new ConfigurationError('No authorization code in callback'));\n return;\n }\n\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('<html><body><h1>Authentication successful!</h1><p>You may close this window.</p></body></html>');\n clearTimeout(timeout);\n server.close();\n resolve(receivedCode);\n }\n });\n\n once(server, 'error').then(([err]) => {\n clearTimeout(timeout);\n reject(err as Error);\n }).catch(reject);\n });\n\n // Exchange code for token\n return this.#exchangeCode(host, httpClient, code, verifier, redirectUri);\n }\n\n async #exchangeCode(\n host: string,\n httpClient: HttpClient,\n code: string,\n verifier: string,\n redirectUri: string,\n ): Promise<TokenSet> {\n const body = new URLSearchParams({\n grant_type: 'authorization_code',\n code,\n redirect_uri: redirectUri,\n client_id: 'safeguard.js',\n code_verifier: verifier,\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: body.toString(),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string };\n\n // Exchange for user token\n const userResponse = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${data.access_token}`,\n },\n body: JSON.stringify({ StsAccessToken: data.access_token }),\n });\n\n if (userResponse.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(userResponse.status, userResponse.body);\n }\n\n const userData = JSON.parse(userResponse.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(userData.UserToken),\n acquiredAt: Date.now(),\n };\n if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n return tokenSet;\n }\n\n async #openBrowser(url: string): Promise<void> {\n const { platform } = await import('node:os');\n const { execFile } = await import('node:child_process');\n\n // Use execFile with argument arrays to prevent shell injection via host parameter\n if (platform() === 'win32') {\n execFile('cmd', ['/c', 'start', '', url]);\n } else if (platform() === 'darwin') {\n execFile('open', [url]);\n } else {\n execFile('xdg-open', [url]);\n }\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ApiError, ConfigurationError, SafeguardError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\n\n/\n Public device-code details handed to the caller for display.\n \n The raw `device_code` is intentionally NOT exposed — the library owns\n * polling and the caller only needs to render the verification URL and code.\n /\nexport interface DeviceCodeInfo {\n /* URL the user opens to authenticate (e.g. shown as a QR target or link). /\n verificationUri: string;\n /* Short code the user enters at the verification URL. /\n userCode: string;\n /* Verification URL with the user code pre-filled (RFC 8628 §3.3.1). /\n verificationUriComplete: string;\n /* Seconds until the device code expires. /\n expiresIn: number;\n /* Suggested minimum seconds between poll attempts. /\n interval: number;\n}\n\n/\n Options for {@link DeviceCodeAuth}.\n /\nexport interface DeviceCodeAuthOptions {\n /\n REQUIRED callback that receives the {@link DeviceCodeInfo} for display.\n * The library performs no display I/O; the caller renders the URL + code\n * (console, DOM, log). May be async; it is awaited before polling begins.\n /\n onDeviceCode: (info: DeviceCodeInfo) => void \| Promise<void>;\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n /* OAuth client id. Default: '' (matches other Safeguard SDKs). /\n clientId?: string;\n /* Starting poll interval in seconds. Default: 5. Auto-bumps on `slow_down`. /\n pollingIntervalSeconds?: number;\n /* Cancellation signal applied to HTTP requests and inter-poll delays. /\n signal?: AbortSignal;\n}\n\n/* Number of seconds to add to the poll interval on each `slow_down`. /\nconst SLOW_DOWN_INCREMENT_SECONDS = 5;\n\ninterface DeviceLoginResponse {\n device_code: string;\n user_code: string;\n verification_uri: string;\n verification_uri_complete: string;\n expires_in: number;\n interval: number;\n}\n\ninterface TokenPollResponse {\n access_token?: string;\n error?: string;\n}\n\n/* Error whose `name` is `AbortError`, matching standard web cancellation. /\nclass AbortError extends Error {\n constructor(message = 'The operation was aborted') {\n super(message);\n this.name = 'AbortError';\n }\n}\n\n/* Reject promptly if the signal is already aborted. /\nfunction throwIfAborted(signal?: AbortSignal): void {\n if (signal?.aborted) throw new AbortError();\n}\n\n/* Abortable sleep that rejects with an `AbortError` if the signal fires. /\nfunction delay(ms: number, signal?: AbortSignal): Promise<void> {\n return new Promise<void>((resolve, reject) => {\n if (signal?.aborted) {\n reject(new AbortError());\n return;\n }\n const onAbort = (): void => {\n clearTimeout(timer);\n reject(new AbortError());\n };\n const timer = setTimeout(() => {\n signal?.removeEventListener('abort', onAbort);\n resolve();\n }, ms);\n signal?.addEventListener('abort', onAbort, { once: true });\n });\n}\n\n/\n OAuth 2.0 Device Authorization Grant (RFC 8628) for Safeguard.\n \n Headless display-and-poll only: it requests a device code, hands the public\n * verification details to the required `onDeviceCode` callback, then polls the\n * token endpoint until the user authenticates in their own browser. It never\n * spawns or opens a browser and performs no display I/O. Platform-agnostic, so\n * it is exported from both the Node and browser entry points.\n /\nexport class DeviceCodeAuth implements Auth {\n readonly #onDeviceCode: (info: DeviceCodeInfo) => void \| Promise<void>;\n readonly #provider: string;\n readonly #clientId: string;\n readonly #pollingIntervalSeconds: number;\n readonly #signal: AbortSignal \| undefined;\n\n constructor(options: DeviceCodeAuthOptions) {\n if (typeof options?.onDeviceCode !== 'function') {\n throw new ConfigurationError('DeviceCodeAuth requires an onDeviceCode callback');\n }\n if (options.pollingIntervalSeconds !== undefined && options.pollingIntervalSeconds <= 0) {\n throw new ConfigurationError('pollingIntervalSeconds must be greater than 0');\n }\n this.#onDeviceCode = options.onDeviceCode;\n this.#provider = options.provider ?? 'local';\n this.#clientId = options.clientId ?? '';\n this.#pollingIntervalSeconds = options.pollingIntervalSeconds ?? 5;\n this.#signal = options.signal;\n }\n\n get description(): string {\n return 'DeviceCodeAuth';\n }\n\n async authenticate(\n host: string,\n httpClient: HttpClient,\n _storage: StorageProvider,\n ): Promise<TokenSet> {\n const signal = this.#signal;\n throwIfAborted(signal);\n\n const deviceCode = await this.#requestDeviceCode(host, httpClient, signal);\n\n const info: DeviceCodeInfo = {\n verificationUri: deviceCode.verification_uri,\n userCode: deviceCode.user_code,\n verificationUriComplete: deviceCode.verification_uri_complete,\n expiresIn: deviceCode.expires_in,\n interval: deviceCode.interval,\n };\n await this.#onDeviceCode(info);\n\n const accessToken = await this.#poll(host, httpClient, deviceCode, signal);\n return this.#exchangeForUserToken(host, httpClient, accessToken, signal);\n }\n\n async #requestDeviceCode(\n host: string,\n httpClient: HttpClient,\n signal: AbortSignal \| undefined,\n ): Promise<DeviceLoginResponse> {\n const requestOptions = {\n url: `https://${host}/RSTS/oauth2/DeviceLogin`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n client_id: this.#clientId,\n scope: `rsts:sts:primaryproviderid:${this.#provider}`,\n }),\n ...(signal ? { signal } : {}),\n };\n const response = await httpClient.request(requestOptions);\n\n if (response.status !== 200) {\n // The disabled-grant response is HTML, not JSON — substring match only,\n // never JSON.parse this path.\n if (response.body.toLowerCase().includes('device code grant type is not allowed')) {\n throw new ConfigurationError(\n 'Device Code grant is not enabled on this appliance. Enable it under ' +\n 'Settings -> OAuth 2.0 Grant Types (Allowed OAuth2 Grant Types must include DeviceCode).',\n );\n }\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n return JSON.parse(response.body) as DeviceLoginResponse;\n }\n\n async #poll(\n host: string,\n httpClient: HttpClient,\n deviceCode: DeviceLoginResponse,\n signal: AbortSignal \| undefined,\n ): Promise<string> {\n const deadline = Date.now() + deviceCode.expires_in 1000;\n let intervalSeconds = this.#pollingIntervalSeconds;\n\n for (;;) {\n throwIfAborted(signal);\n if (Date.now() >= deadline) {\n throw new SafeguardError('Device code authorization timed out before approval');\n }\n\n await delay(intervalSeconds * 1000, signal);\n throwIfAborted(signal);\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n device_code: deviceCode.device_code,\n client_id: this.#clientId,\n }),\n ...(signal ? { signal } : {}),\n });\n\n const data = JSON.parse(response.body) as TokenPollResponse;\n\n if (response.status === 200 && data.access_token) {\n return data.access_token;\n }\n\n switch (data.error) {\n case 'authorization_pending':\n continue;\n case 'slow_down':\n intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;\n continue;\n case 'access_denied':\n throw new SafeguardError('Device code authorization was denied by the user');\n case 'expired_token':\n throw new SafeguardError('Device code expired before authorization was completed');\n default:\n throw ApiError.fromResponse(response.status, response.body);\n }\n }\n }\n\n async #exchangeForUserToken(\n host: string,\n httpClient: HttpClient,\n stsAccessToken: string,\n signal: AbortSignal \| undefined,\n ): Promise<TokenSet> {\n const response = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${stsAccessToken}`,\n },\n body: JSON.stringify({ StsAccessToken: stsAccessToken }),\n ...(signal ? { signal } : {}),\n });\n\n if (response.status !== 200) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const userData = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(userData.UserToken),\n acquiredAt: Date.now(),\n };\n if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n return tokenSet;\n }\n}\n","import { StorageKeys } from '../storage/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport { ConfigurationError } from '../errors.js';\n\nexport interface PkceCallbackResult {\n code: string;\n state: string;\n}\n\n/*\n Parses the PKCE callback URL and stores the authorization code.\n * Call this on the callback/redirect page to complete the PKCE flow.\n \n This is the explicit replacement for the legacy `safeguardJsAccessTokenChecker.js`\n * script that ran as a side-effect on import.\n \n @param storage - StorageProvider to persist the code\n * @param url - The callback URL to parse (defaults to window.location.href)\n * @returns The parsed code and state, or null if not a valid callback\n /\nexport function handlePkceCallback(\n storage: StorageProvider,\n url?: string,\n): PkceCallbackResult \| null {\n const callbackUrl = url ?? (typeof window !== 'undefined' ? window.location.href : '');\n if (!callbackUrl) return null;\n\n const parsed = new URL(callbackUrl);\n const code = parsed.searchParams.get('code');\n const state = parsed.searchParams.get('state');\n\n if (!code \|\| !state) return null;\n\n // Validate state matches what we stored\n const storedState = storage.get(StorageKeys.STATE);\n if (storedState && storedState !== state) {\n throw new ConfigurationError('PKCE state mismatch — possible CSRF attack');\n }\n\n // Store the code for the PkceAuth strategy to pick up\n storage.set('safeguard_auth_code', code);\n\n return { code, state };\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\n\nexport interface TokenAuthOptions {\n /* Pre-existing Safeguard access token. /\n accessToken: string;\n}\n\n/\n Uses a pre-existing access token. No authentication flow — the token is assumed valid.\n * Useful when tokens are obtained externally or for service-to-service scenarios.\n /\nexport class TokenAuth implements Auth {\n readonly #accessToken: SecretValue;\n\n constructor(options: TokenAuthOptions) {\n if (!options.accessToken) throw new ConfigurationError('TokenAuth requires accessToken');\n this.#accessToken = new SecretValue(options.accessToken);\n }\n\n get description(): string {\n return 'TokenAuth(pre-existing)';\n }\n\n async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n return {\n accessToken: this.#accessToken,\n acquiredAt: Date.now(),\n };\n }\n\n // No refresh possible with a pre-existing token\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { SecretValue } from '../secret.js';\n\n/\n Anonymous authentication — no credentials.\n * Used for accessing public Safeguard endpoints (e.g., appliance status).\n /\nexport class AnonymousAuth implements Auth {\n get description(): string {\n return 'AnonymousAuth';\n }\n\n async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n return {\n accessToken: new SecretValue(''),\n acquiredAt: Date.now(),\n };\n }\n}\n","import { Service, HttpMethod } from './types.js';\nimport type { RequestOptions, SafeguardClientOptions } from './types.js';\nimport type { Auth, TokenSet } from './auth/types.js';\nimport type { HttpClient } from './http/types.js';\nimport type { StorageProvider } from './storage/types.js';\nimport { MemoryStorage } from './storage/memory.js';\nimport { buildRequestUrl, validateHost } from './utils.js';\nimport { AuthenticationError, ConfigurationError, ApiError } from './errors.js';\n\nconst DEFAULT_TIMEOUT = 300_000;\nconst DEFAULT_API_VERSION = 'v4';\nconst TOKEN_REFRESH_MARGIN_MS = 60_000; // refresh 60s before expiry\n\n/\n Main entry point for the Safeguard SDK.\n * Instance-based — no global state. Multiple clients to different appliances are supported.\n /\nexport class SafeguardClient {\n readonly #host: string;\n readonly #auth: Auth;\n readonly #apiVersion: string;\n readonly #timeout: number;\n readonly #autoRefresh: boolean;\n readonly #ca: string \| Buffer \| undefined;\n readonly #verify: boolean;\n\n #httpClient: HttpClient \| undefined;\n #storage: StorageProvider;\n #tokenSet: TokenSet \| undefined;\n #connected = false;\n /* Single-flight refresh promise to prevent thundering herd on token expiry. /\n #tokenRefreshPromise: Promise<void> \| undefined;\n\n constructor(host: string, options: SafeguardClientOptions) {\n if (!host) throw new ConfigurationError('SafeguardClient requires a host');\n if (!options.auth) throw new ConfigurationError('SafeguardClient requires an auth strategy');\n this.#host = validateHost(host);\n this.#auth = options.auth;\n this.#apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;\n this.#timeout = options.timeout ?? DEFAULT_TIMEOUT;\n this.#autoRefresh = options.autoRefresh !== false;\n this.#ca = options.ca;\n this.#verify = options.verify !== false;\n this.#storage = new MemoryStorage();\n }\n\n /* The appliance hostname this client connects to. /\n get host(): string {\n return this.#host;\n }\n\n /* The API version prefix (e.g. 'v4'). /\n get apiVersion(): string {\n return this.#apiVersion;\n }\n\n /* Custom CA certificate, if provided. /\n get ca(): string \| Buffer \| undefined {\n return this.#ca;\n }\n\n /* Whether TLS verification is enabled. /\n get verify(): boolean {\n return this.#verify;\n }\n\n /* Whether the client has an active authenticated session. /\n get isConnected(): boolean {\n return this.#connected;\n }\n\n /\n Sets a custom StorageProvider (e.g., BrowserSessionStorage).\n * Must be called before connect().\n /\n setStorage(storage: StorageProvider): this {\n this.#storage = storage;\n return this;\n }\n\n /\n Sets the HttpClient implementation. If not called, must be set before connect().\n * The factory pattern allows platform-specific client injection:\n * - Node: `new NodeHttpClient({ ca, rejectUnauthorized })`\n * - Browser: `new BrowserHttpClient()`\n /\n setHttpClient(httpClient: HttpClient): this {\n this.#httpClient = httpClient;\n return this;\n }\n\n /\n Authenticate and establish a session.\n * @throws {AuthenticationError} if authentication fails\n * @throws {ConfigurationError} if httpClient not set\n /\n async connect(): Promise<void> {\n if (!this.#httpClient) {\n throw new ConfigurationError(\n 'HttpClient not set. Call setHttpClient() before connect(), or use SafeguardClient.createNode() / SafeguardClient.createBrowser().',\n );\n }\n\n this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient, this.#storage);\n if (!this.#tokenSet.accessToken.expose()) {\n throw new AuthenticationError('Authentication returned empty access token');\n }\n this.#connected = true;\n }\n\n /\n Disconnect — dispose HTTP client and clear token.\n /\n async disconnect(): Promise<void> {\n this.#tokenSet = undefined;\n this.#connected = false;\n this.#httpClient?.dispose?.();\n }\n\n /\n Returns seconds until the current access token expires, or -1 if unknown.\n /\n getAccessTokenLifetimeRemaining(): number {\n if (!this.#tokenSet?.expiresIn) return -1;\n const elapsed = (Date.now() - this.#tokenSet.acquiredAt) / 1000;\n return Math.max(0, this.#tokenSet.expiresIn - elapsed);\n }\n\n // ─── Convenience HTTP verbs ─────────────────────────────────────────\n\n async get<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.GET, relativeUrl, options);\n }\n\n async post<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.POST, relativeUrl, options);\n }\n\n async put<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.PUT, relativeUrl, options);\n }\n\n async delete<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.DELETE, relativeUrl, options);\n }\n\n async patch<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.PATCH, relativeUrl, options);\n }\n\n // ─── Core invoke ────────────────────────────────────────────────────\n\n /\n Low-level request method. Convenience verbs delegate here.\n \n When `options.fullResponse` is true, returns SafeguardResponse<T> with status + headers.\n * Otherwise returns just the parsed response body as T.\n /\n async invoke<T = unknown>(\n service: Service,\n method: HttpMethod,\n relativeUrl: string,\n options?: RequestOptions,\n ): Promise<T> {\n if (!this.#connected \|\| !this.#httpClient) {\n throw new ConfigurationError('Client not connected. Call connect() first.');\n }\n\n // Auto-refresh token if needed\n if (this.#autoRefresh) {\n await this.#ensureValidToken();\n }\n\n const url = buildRequestUrl(this.#host, service, relativeUrl, options?.query, this.#apiVersion);\n const headers: Record<string, string> = {\n Authorization: `Bearer ${this.#tokenSet!.accessToken.expose()}`,\n Accept: 'application/json',\n ...options?.headers,\n };\n\n let body: string \| null = null;\n if (options?.json != null) {\n body = JSON.stringify(options.json);\n headers['Content-Type'] = 'application/json';\n } else if (options?.body != null) {\n body = options.body as string;\n }\n\n const requestOpts: import('./http/types.js').HttpRequestOptions = {\n url,\n method,\n headers,\n body,\n timeout: options?.timeout ?? this.#timeout,\n };\n if (options?.signal) requestOpts.signal = options.signal;\n\n const response = await this.#httpClient.request(requestOpts);\n\n if (response.status >= 400) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = response.body ? (JSON.parse(response.body) as T) : (undefined as T);\n\n if (options?.fullResponse) {\n return { data, status: response.status, headers: response.headers } as unknown as T;\n }\n\n return data;\n }\n\n // ─── Private helpers ────────────────────────────────────────────────\n\n async #ensureValidToken(): Promise<void> {\n if (!this.#tokenSet) return;\n if (!this.#tokenSet.expiresIn) return; // can't determine expiry\n\n const elapsed = Date.now() - this.#tokenSet.acquiredAt;\n const expiresInMs = this.#tokenSet.expiresIn 1000;\n\n if (elapsed + TOKEN_REFRESH_MARGIN_MS < expiresInMs) {\n return; // token still fresh\n }\n\n // Single-flight: if a refresh is already running, all concurrent callers\n // await the same promise so the auth server only sees one exchange and no\n // two callers race the storage provider.\n if (this.#tokenRefreshPromise) {\n await this.#tokenRefreshPromise;\n return;\n }\n\n this.#tokenRefreshPromise = (async (): Promise<void> => {\n if (this.#auth.refreshToken) {\n const refreshed = await this.#auth.refreshToken(this.#host, this.#httpClient!, this.#storage);\n if (refreshed) {\n this.#tokenSet = refreshed;\n return;\n }\n }\n this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient!, this.#storage);\n })();\n\n try {\n await this.#tokenRefreshPromise;\n } finally {\n // Always clear the slot — failures must not be cached, otherwise\n // every subsequent invoke would inherit the same rejection forever.\n this.#tokenRefreshPromise = undefined;\n }\n }\n}\n","/*\n SSH key formats for private key retrieval.\n /\nexport enum SshKeyFormat {\n OpenSsh = 'OpenSsh',\n Ssh2 = 'Ssh2',\n Putty = 'Putty',\n}\n\n/\n An A2A retrievable account as returned by the discovery endpoint.\n /\nexport interface RetrievableAccount {\n AccountId: number;\n AssetId: number;\n AssetName: string;\n AccountName: string;\n DomainName: string;\n AccountType: string;\n ApiKey: string;\n}\n\n/\n Brokered access request types.\n /\nexport enum BrokeredAccessRequestType {\n Password = 'Password',\n SshKey = 'SshKey',\n ApiKey = 'ApiKey',\n Token = 'Token',\n RdpFile = 'RdpFile',\n RemoteDesktop = 'RemoteDesktop',\n SshSession = 'SshSession',\n}\n\n/\n Options for creating a brokered access request.\n /\nexport interface BrokeredAccessRequest {\n AccessType: BrokeredAccessRequestType;\n ForUserId?: number;\n ForUserName?: string;\n AssetId?: number;\n AccountId?: number;\n AccountAssetId?: number;\n AccountName?: string;\n AssetName?: string;\n DomainName?: string;\n}\n\n/\n Response from a brokered access request.\n /\nexport interface BrokeredAccessResponse {\n RequestId: string;\n AccessToken?: string;\n [key: string]: unknown;\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { CertificateAuth } from '../auth/certificate.js';\nimport { SecretValue } from '../secret.js';\nimport { ConfigurationError, ApiError } from '../errors.js';\nimport { SshKeyFormat } from './types.js';\nimport type {\n RetrievableAccount,\n BrokeredAccessRequest,\n BrokeredAccessResponse,\n} from './types.js';\n\nexport interface A2AClientOptions {\n /* Certificate-based auth (A2A always uses client certificates). /\n auth: CertificateAuth;\n /* Custom CA certificate (PEM). /\n ca?: string \| Buffer;\n /* Whether to verify TLS. Default: true. /\n verify?: boolean;\n /* API version string (default: 'v4'). /\n apiVersion?: string;\n}\n\n/\n Application-to-Application client for programmatic credential retrieval.\n * Uses client certificate authentication exclusively.\n \n Full parity with PySafeguard and SafeguardDotNet A2A clients.\n /\nexport class A2AClient {\n readonly #host: string;\n readonly #auth: CertificateAuth;\n readonly #ca: string \| Buffer \| undefined;\n readonly #verify: boolean;\n readonly #apiVersion: string;\n #httpClient: HttpClient \| undefined;\n\n constructor(host: string, options: A2AClientOptions) {\n if (!host) throw new ConfigurationError('A2AClient requires a host');\n if (!options.auth) throw new ConfigurationError('A2AClient requires a CertificateAuth');\n this.#host = host;\n this.#auth = options.auth;\n this.#ca = options.ca;\n this.#verify = options.verify !== false;\n this.#apiVersion = options.apiVersion ?? 'v4';\n }\n\n /* The appliance hostname. /\n get host(): string {\n return this.#host;\n }\n\n /* Custom CA, if set. /\n get ca(): string \| Buffer \| undefined {\n return this.#ca;\n }\n\n /* Whether TLS verification is enabled. /\n get verify(): boolean {\n return this.#verify;\n }\n\n /* The CertificateAuth providing TLS client cert configuration. /\n get auth(): CertificateAuth {\n return this.#auth;\n }\n\n /\n Sets the HttpClient (must be configured with client cert TLS).\n /\n setHttpClient(httpClient: HttpClient): this {\n this.#httpClient = httpClient;\n return this;\n }\n\n /\n Retrieve a password credential via A2A.\n * @param apiKey - The API key for the retrievable account\n /\n async retrievePassword(apiKey: string): Promise<SecretValue> {\n const body = await this.#a2aRequest(apiKey, 'GET', 'Credentials', { type: 'Password' });\n return new SecretValue(body);\n }\n\n /\n Retrieve an SSH private key credential via A2A.\n * @param apiKey - The API key for the retrievable account\n * @param format - SSH key format (default: OpenSsh)\n /\n async retrievePrivateKey(apiKey: string, format?: SshKeyFormat): Promise<SecretValue> {\n const keyType = format ?? SshKeyFormat.OpenSsh;\n const body = await this.#a2aRequest(apiKey, 'GET', 'Credentials', {\n type: 'SshKey',\n keyFormat: keyType,\n });\n return new SecretValue(body);\n }\n\n /\n Retrieve an API key secret credential via A2A.\n * @param apiKey - The API key for the retrievable account\n /\n async retrieveApiKeySecret(apiKey: string): Promise<SecretValue> {\n const body = await this.#a2aRequest(apiKey, 'GET', 'Credentials', { type: 'ApiKey' });\n return new SecretValue(body);\n }\n\n /\n Get the list of retrievable accounts available to this certificate.\n /\n async getRetrievableAccounts(): Promise<RetrievableAccount[]> {\n this.#ensureHttpClient();\n const response = await this.#httpClient!.request({\n url: `https://${this.#host}/service/a2a/${this.#apiVersion}/A2ARegistrations`,\n method: 'GET',\n headers: {\n Accept: 'application/json',\n },\n });\n\n if (response.status !== 200) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n return JSON.parse(response.body) as RetrievableAccount[];\n }\n\n /\n Set a password on a managed account via A2A.\n * @param apiKey - The API key for the account\n * @param password - The new password value\n /\n async setPassword(apiKey: string, password: string): Promise<void> {\n this.#ensureHttpClient();\n const response = await this.#httpClient!.request({\n url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials?type=Password`,\n method: 'PUT',\n headers: {\n Authorization: `A2A ${apiKey}`,\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n },\n body: JSON.stringify(password),\n });\n\n if (response.status !== 200 && response.status !== 204) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n }\n\n /\n Set a private key on a managed account via A2A.\n * @param apiKey - The API key for the account\n * @param key - The private key content\n * @param passphrase - Optional passphrase for the key\n * @param format - SSH key format (default: OpenSsh)\n /\n async setPrivateKey(\n apiKey: string,\n key: string,\n passphrase?: string,\n format?: SshKeyFormat,\n ): Promise<void> {\n this.#ensureHttpClient();\n const keyFormat = format ?? SshKeyFormat.OpenSsh;\n const payload: Record<string, string> = { PrivateKey: key, KeyFormat: keyFormat };\n if (passphrase) payload['Passphrase'] = passphrase;\n\n const response = await this.#httpClient!.request({\n url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials?type=SshKey`,\n method: 'PUT',\n headers: {\n Authorization: `A2A ${apiKey}`,\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n },\n body: JSON.stringify(payload),\n });\n\n if (response.status !== 200 && response.status !== 204) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n }\n\n /\n Submit a brokered access request via A2A.\n * @param apiKey - The API key for the access request\n * @param request - The access request details\n */\n async brokerAccessRequest(\n apiKey: string,\n request: BrokeredAccessRequest,\n ): Promise<BrokeredAccessResponse> {\n this.#ensureHttpClient();\n const response = await this.#httpClient!.request({\n url: `https://${this.#host}/service/a2a/${this.#apiVersion}/AccessRequests`,\n method: 'POST',\n headers: {\n Authorization: `A2A ${apiKey}`,\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n },\n body: JSON.stringify(request),\n });\n\n if (response.status !== 200 && response.status !== 201) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n return JSON.parse(response.body) as BrokeredAccessResponse;\n }\n\n // ─── Private helpers ────────────────────────────────────────────────\n\n async #a2aRequest(\n apiKey: string,\n method: string,\n endpoint: string,\n queryParams?: Record<string, string>,\n ): Promise<string> {\n this.#ensureHttpClient();\n let url = `https://${this.#host}/service/a2a/${this.#apiVersion}/${endpoint}`;\n if (queryParams) {\n const params = new URLSearchParams(queryParams);\n url += `?${params.toString()}`;\n }\n\n const response = await this.#httpClient!.request({\n url,\n method,\n headers: {\n Authorization: `A2A ${apiKey}`,\n Accept: 'application/json',\n },\n });\n\n if (response.status !== 200) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n return response.body;\n }\n\n #ensureHttpClient(): void {\n if (!this.#httpClient) {\n throw new ConfigurationError(\n 'HttpClient not set. Call setHttpClient() with a client configured for mTLS.',\n );\n }\n }\n}\n\nexport { SshKeyFormat, BrokeredAccessRequestType } from './types.js';\nexport type { RetrievableAccount, BrokeredAccessRequest, BrokeredAccessResponse } from './types.js';\n"],"mappings":";;;;;;;;;;;;;;;;;AAGA,IAAY,UAAL,yBAAA,SAAA;CACL,QAAA,UAAA;CACA,QAAA,eAAA;CACA,QAAA,kBAAA;CACA,QAAA,SAAA;CACA,QAAA,WAAA;CACA,QAAA,UAAA;;AACF,EAAA,CAAA,CAAA;;;;AAKA,IAAY,aAAL,yBAAA,YAAA;CACL,WAAA,SAAA;CACA,WAAA,UAAA;CACA,WAAA,SAAA;CACA,WAAA,YAAA;CACA,WAAA,WAAA;;AACF,EAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;ACTA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AASA,IAAa,WAAb,MAAa,iBAAiB,eAAe;CAC3C;CACA;CAEA,YAAY,SAAiB,QAAgB,OAA4B,MAAM,SAAwB;EACrG,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;;;;CAKA,OAAO,aAAa,QAAgB,MAA8C;EAChF,MAAM,SAAS,SAAS,UAAU,IAAI;EACtC,MAAM,UAAU,SAAS,aAAa,QAAQ,MAAM;EAEpD,QAAQ,QAAR;GACE,KAAK,KACH,OAAO,IAAI,oBAAoB,SAAS,MAAM;GAChD,KAAK,KACH,OAAO,IAAI,mBAAmB,SAAS,MAAM;GAC/C,KAAK,KACH,OAAO,IAAI,cAAc,SAAS,MAAM;GAC1C,SACE,OAAO,IAAI,SAAS,SAAS,QAAQ,MAAM;EAC/C;CACF;CAEA,OAAe,UAAU,MAAyD;EAChF,IAAI,SAAS,QAAQ,SAAS,KAAA,GAAW,OAAO;EAChD,IAAI,OAAO,SAAS,UAAU,OAAO;EACrC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,EAAE,SAAS,KAAK;EACzB;CACF;CAEA,OAAe,aAAa,QAAgB,MAAmC;EAC7E,MAAM,aAAa,MAAM,WAAW,MAAM,YAAY;EACtD,IAAI,YACF,OAAO,QAAQ,OAAO,MAAM,EAAE,IAAI;EAEpC,OAAO,QAAQ,OAAO,MAAM;CAC9B;AACF;AAEA,IAAa,sBAAb,cAAyC,SAAS;CAChD,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,SAAS;CAC/C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,SAAS;CAC1C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,eAAe;CACjD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,eAAe;CACrD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;AC5GA,MAAM,WAAW;;;;;;;;;AAUjB,IAAa,cAAb,MAAyB;CACvB;CAEA,YAAY,OAAe;EACzB,KAAKA,SAAS;CAChB;;CAGA,SAAiB;EACf,OAAO,KAAKA;CACd;CAEA,WAAmB;EACjB,OAAO;CACT;CAEA,SAAiB;EACf,OAAO;CACT;;CAGA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO;CACT;CAEA,KAAK,OAAO,eAAuB;EACjC,OAAO;CACT;AACF;;;;;;;;;AC7BA,SAAgB,aAAa,MAAsB;CACjD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,wBAAwB;CAGhE,IADgB,KAAK,KACX,MAAM,MACd,MAAM,IAAI,mBAAmB,sDAAsD;CAIrF,IAAI,2BAA2B,KAAK,IAAI,GACtC,MAAM,IAAI,mBACR,yFAAyF,KAAK,QAAQ,4BAA4B,EAAE,EAAE,GACxI;CAIF,IAAI,SAAS,KAAK,IAAI,GACpB,MAAM,IAAI,mBACR,6EACF;CAIF,IAAI,QAAQ,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,GAAG,GAC5C,MAAM,IAAI,mBACR,qFACF;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,gBAAgB,MAAc,SAAkB,aAAqB,MAAc;CACjG,IAAI,YAAA,QACF,OAAO,WAAW,KAAK;CAEzB,OAAO,WAAW,KAAK,WAAW,QAAQ,GAAG;AAC/C;;;;;;;;AASA,SAAgB,gBACd,MACA,SACA,aACA,OACA,aAAqB,MACb;CACR,MAAM,OAAO,gBAAgB,MAAM,SAAS,UAAU;CACtD,MAAM,OAAO,YAAY,WAAW,GAAG,IAAI,YAAY,MAAM,CAAC,IAAI;CAClE,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM;CAErC,IAAI,OACF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;CAI3C,OAAO,IAAI,SAAS;AACtB;;;;AAKA,SAAgB,gBAAgB,OAA2B;CACzD,MAAM,SAAS,OAAO,aAAa,GAAG,KAAK;CAC3C,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;;;;AAMA,SAAgB,uBAA+B;CAC7C,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,eAAsB,sBAAsB,UAAmC;CAE7E,MAAM,OAAO,IADO,YACD,CAAC,CAAC,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CACzD,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;;;;AAKA,SAAgB,gBAAwB;CACtC,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,SAAgB,kBAAkB,KAAiC;CACjE,IAAI;EACF,MAAM,QAAQ,IAAI,MAAM,GAAG;EAC3B,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;EAE/B,MAAM,UAAU,MAAM,EAAE,CAAE,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EAC9D,MAAM,OAAO,KAAK,OAAO;EACzB,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;EAC3C,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,GAAG;CACrC,QAAQ;EACN;CACF;AACF;;;;;;;ACpIA,IAAa,gBAAb,MAAsD;CACpD,yBAAkB,IAAI,IAAoB;CAE1C,IAAI,KAA4B;EAC9B,OAAO,KAAKC,OAAO,IAAI,GAAG,KAAK;CACjC;CAEA,IAAI,KAAa,OAAqB;EACpC,KAAKA,OAAO,IAAI,KAAK,KAAK;CAC5B;CAEA,OAAO,KAAmB;EACxB,KAAKA,OAAO,OAAO,GAAG;CACxB;CAEA,QAAc;EACZ,KAAKA,OAAO,MAAM;CACpB;AACF;;;;;;;AClBA,IAAa,wBAAb,MAA8D;CAC5D,IAAI,KAA4B;EAC9B,OAAO,eAAe,QAAQ,GAAG;CACnC;CAEA,IAAI,KAAa,OAAqB;EACpC,eAAe,QAAQ,KAAK,KAAK;CACnC;CAEA,OAAO,KAAmB;EACxB,eAAe,WAAW,GAAG;CAC/B;CAEA,QAAc;EACZ,eAAe,MAAM;CACvB;AACF;;;;ACXA,MAAa,cAAc;CACzB,OAAO;CACP,eAAe;AACjB;;;;;;;ACPA,IAAa,iBAAb,MAAkD;CAChD;CAEA,YAAY,YAAyB;EACnC,KAAKC,SAAS,IAAI,MAAM,EACtB,SAAS;GACP,IAAI,YAAY;GAChB,MAAM,YAAY;GAClB,KAAK,YAAY;GACjB,YAAY,YAAY;GACxB,oBAAoB,YAAY,sBAAsB;EACxD,EACF,CAAC;CACH;CAEA,MAAM,QAAQ,SAAoD;EAChE,MAAM,EAAE,KAAK,QAAQ,SAAS,MAAM,QAAQ,YAAY;EAExD,MAAM,iBAAsD;GAClD;GACR,YAAY,KAAKA;EACnB;EAEA,IAAI,SAAS,eAAe,UAAU;EACtC,IAAI,QAAQ,MAAM,eAAe,OAAO;EACxC,IAAI,QAAQ,eAAe,SAAS;EACpC,IAAI,SAAS;GACX,eAAe,cAAc;GAC7B,eAAe,iBAAiB;EAClC;EAEA,MAAM,WAAW,MAAMC,QAAc,KAAK,cAAc;EAExD,MAAM,kBAA0C,CAAC;EACjD,MAAM,aAAa,SAAS;EAC5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GACZ,gBAAgB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;EAIrE,MAAM,eAAe,MAAM,SAAS,KAAK,KAAK;EAE9C,OAAO;GACL,QAAQ,SAAS;GACjB,SAAS;GACT,MAAM;EACR;CACF;CAEA,UAAgB;EACd,KAAKD,OAAO,MAAM,CAAC,CAAC,YAAY,CAAoC,CAAC;CACvE;AACF;;;;;;;ACtDA,IAAa,oBAAb,MAAqD;CACnD;CAEA,YAAY,SAAgD;EAC1D,KAAKE,eAAe,SAAS,eAAe;CAC9C;CAEA,MAAM,QAAQ,SAAoD;EAChE,MAAM,EAAE,KAAK,QAAQ,SAAS,MAAM,QAAQ,YAAY;EAExD,MAAM,cAA2B;GAC/B;GACA,aAAa,KAAKA;EACpB;EAEA,IAAI,SAAS,YAAY,UAAU;EACnC,IAAI,QAAQ,MAAM,YAAY,OAAO;EACrC,IAAI,UAAU,SAAS;GACrB,MAAM,aAAa,IAAI,gBAAgB;GACvC,IAAI;GAEJ,IAAI,SACF,YAAY,iBAAiB,WAAW,sBAAM,IAAI,MAAM,mBAAmB,CAAC,GAAG,OAAO;GAGxF,YAAY,SAAS,SACjB,YAAY,IAAI,CAAC,QAAQ,WAAW,MAAM,CAAC,IAC3C,WAAW;GAEf,IAAI;IACF,OAAO,MAAM,KAAKC,SAAS,KAAK,WAAW;GAC7C,UAAU;IACR,IAAI,cAAc,KAAA,GAAW,aAAa,SAAS;GACrD;EACF;EAEA,OAAO,KAAKA,SAAS,KAAK,WAAW;CACvC;CAEA,MAAMA,SAAS,KAAa,MAA0C;EACpE,MAAM,WAAW,MAAM,MAAM,KAAK,IAAI;EAEtC,MAAM,kBAA0C,CAAC;EACjD,SAAS,QAAQ,SAAS,OAAO,QAAQ;GACvC,gBAAgB,OAAO;EACzB,CAAC;EAED,MAAM,eAAe,MAAM,SAAS,KAAK;EAEzC,OAAO;GACL,QAAQ,SAAS;GACjB,SAAS;GACT,MAAM;EACR;CACF;AACF;;;;;;AC5CA,IAAa,eAAb,MAA0C;CACxC;CACA;CACA;CAEA,YAAY,SAA8B;EACxC,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,KAAKC,YAAY,QAAQ;EACzB,KAAKC,YAAY,IAAI,YAAY,QAAQ,QAAQ;EACjD,KAAKC,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,gBAAgB,KAAKF,UAAU,GAAG,KAAKE,UAAU;CAC1D;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EAErG,MAAM,YAAY,MAAM,KAAKC,cAAc,MAAM,UAAU;EAK3D,OAAO,MAFiB,KAAKC,sBAAsB,MAAM,YAAY,SAAS;CAGhF;CAEA,MAAM,aAAa,MAAc,YAAwB,SAAoD;EAE3G,OAAO,KAAK,aAAa,MAAM,YAAY,OAAO;CACpD;CAEA,MAAMD,cAAc,MAAc,YAAyC;EACzE,MAAM,OAAO,KAAK,UAAU;GAC1B,YAAY;GACZ,UAAU,KAAKH;GACf,UAAU,KAAKC,UAAU,OAAO;GAChC,OAAO,gCAAgC,KAAKC,UAAU,YAAY;EACpE,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAGA,OADa,KAAK,MAAM,SAAS,IACvB,CAAC,CAAC;CACd;CAEA,MAAME,sBAAsB,MAAc,YAAwB,WAAsC;EACtG,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,UAAU,CAAC;EACpD,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,KAAK,SAAS;GAC3C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,KAAK,aAAa,MACpB,SAAS,YAAY,KAAK;OACrB;GACL,MAAM,YAAY,kBAAkB,KAAK,SAAS;GAClD,IAAI,aAAa,MAAM,SAAS,YAAY;EAC9C;EACA,OAAO;CACT;AACF;;;;;;;ACzEA,IAAa,kBAAb,MAA6C;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAiC;EAC3C,MAAM,SAAS,QAAQ,OAAO,QAAQ;EACtC,MAAM,UAAU,QAAQ,QAAQ,QAAQ;EACxC,MAAM,SAAS,QAAQ,OAAO,QAAQ;EACtC,IAAI,CAAC,UAAU,CAAC,SAAS,MAAM,IAAI,mBAAmB,uDAAuD;EAC7G,IAAI,CAAC,UAAU,CAAC,QAAQ,MAAM,IAAI,mBAAmB,yCAAyC;EAC9F,KAAKC,YAAY,QAAQ;EACzB,KAAKC,WAAW,QAAQ;EACxB,KAAKC,QAAQ,QAAQ;EACrB,KAAKC,OAAO,QAAQ;EACpB,KAAKC,WAAW,QAAQ;EACxB,KAAKC,OAAO,QAAQ;EACpB,KAAKC,cAAc,QAAQ,aAAa,IAAI,YAAY,QAAQ,UAAU,IAAI,KAAA;EAC9E,KAAKC,YAAY,QAAQ,YAAY;CACvC;CAEA,IAAI,cAAsB;EACxB,OAAO,mBAAmB,KAAKA,UAAU;CAC3C;;CAGA,gBAA+G;EAC7G,MAAM,OAAsG,CAAC;EAC7G,IAAI,KAAKF,QAAQ,KAAKD,UACpB,KAAK,MAAM,KAAKC,QAAQ,KAAKD;OACxB;GACL,KAAK,OAAO,KAAKF,SAAS,KAAKF;GAC/B,KAAK,MAAM,KAAKG,QAAQ,KAAKF;EAC/B;EACA,IAAI,KAAKK,aAAa,KAAK,aAAa,KAAKA,YAAY,OAAO;EAChE,OAAO;CACT;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EAErG,MAAM,YAAY,MAAM,KAAKE,cAAc,MAAM,UAAU;EAG3D,OAAO,KAAKC,sBAAsB,MAAM,YAAY,SAAS;CAC/D;CAEA,MAAM,aAAa,MAAc,YAAwB,SAAoD;EAC3G,OAAO,KAAK,aAAa,MAAM,YAAY,OAAO;CACpD;CAEA,MAAMD,cAAc,MAAc,YAAyC;EACzE,MAAM,OAAO,KAAK,UAAU;GAC1B,YAAY;GACZ,OAAO,gCAAgC,KAAKD,UAAU,YAAY;EACpE,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAGA,OADa,KAAK,MAAM,SAAS,IACvB,CAAC,CAAC;CACd;CAEA,MAAME,sBAAsB,MAAc,YAAwB,WAAsC;EACtG,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,UAAU,CAAC;EACpD,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,KAAK,SAAS;GAC3C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,KAAK,aAAa,MACpB,SAAS,YAAY,KAAK;OACrB;GACL,MAAM,YAAY,kBAAkB,KAAK,SAAS;GAClD,IAAI,aAAa,MAAM,SAAS,YAAY;EAC9C;EACA,OAAO;CACT;AACF;;;;;;;ACrHA,IAAa,WAAb,MAAsC;CACpC;CACA;CAEA,YAAY,SAA0B;EACpC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,+BAA+B;EACtF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,4BAA4B;EAChF,KAAKC,eAAe,QAAQ;EAC5B,KAAKC,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,iBAAiB,KAAKD,aAAa;CAC5C;;;;;CAMA,MAAM,aAAa,MAAc,YAAwB,SAA6C;EAEpG,MAAM,OAAO,QAAQ,IAAI,qBAAqB;EAC9C,IAAI,MAAM;GACR,MAAM,WAAW,QAAQ,IAAI,YAAY,aAAa;GACtD,IAAI,CAAC,UACH,MAAM,IAAI,mBAAmB,yCAAyC;GAExE,QAAQ,OAAO,qBAAqB;GACpC,QAAQ,OAAO,YAAY,aAAa;GACxC,QAAQ,OAAO,YAAY,KAAK;GAChC,OAAO,KAAKE,cAAc,MAAM,YAAY,MAAM,QAAQ;EAC5D;EAGA,MAAM,KAAKC,kBAAkB,MAAM,OAAO;EAI1C,MAAM,IAAI,mBACR,0EACF;CACF;CAEA,MAAMA,kBAAkB,MAAc,SAAyC;EAC7E,MAAM,WAAW,qBAAqB;EACtC,MAAM,YAAY,MAAM,sBAAsB,QAAQ;EACtD,MAAM,QAAQ,cAAc;EAE5B,QAAQ,IAAI,YAAY,eAAe,QAAQ;EAC/C,QAAQ,IAAI,YAAY,OAAO,KAAK;EAYpC,MAAM,UAAU,WAAW,KAAK,cAAc,IAV3B,gBAAgB;GACjC,eAAe;GACf,WAAW;GACX,cAAc,KAAKH;GACnB,OAAO,gCAAgC,KAAKC;GAC5C,gBAAgB;GAChB,uBAAuB;GACvB;EACF,CAEmD,CAAC,CAAC,SAAS;EAG9D,IAAI,OAAO,WAAW,eAAe,OAAO,UAC1C,OAAO,SAAS,OAAO;CAE3B;CAEA,MAAMC,cACJ,MACA,YACA,MACA,UACmB;EACnB,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ;GACA,cAAc,KAAKF;GACnB,WAAW;GACX,eAAe;EACjB,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EAGrC,MAAM,oBAAoB,MAAM,WAAW,QAAQ;GACjD,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,KAAK;GAChC;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,KAAK,aAAa,CAAC;EAC5D,CAAC;EAED,IAAI,kBAAkB,WAAW,KAAK;GACpC,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,kBAAkB,QAAQ,kBAAkB,IAAI;EAC9E;EAEA,MAAM,WAAW,KAAK,MAAM,kBAAkB,IAAI;EAClD,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAI9D,OAAO;CACT;AACF;;;;;;;;;;AC1HA,IAAa,yBAAb,MAAoD;CAClD;CACA;CAEA,YAAY,SAAyC;EACnD,KAAKI,YAAY,SAAS,YAAY;EACtC,KAAKC,gBAAgB,SAAS,gBAAgB;CAChD;CAEA,IAAI,cAAsB;EACxB,OAAO,+BAA+B,OAAO,KAAKA,aAAa,EAAE;CACnE;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EACrG,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,MAAM,EAAE,SAAS,MAAM,OAAO;EAE9B,MAAM,WAAW,qBAAqB;EACtC,MAAM,YAAY,MAAM,sBAAsB,QAAQ;EACtD,MAAM,QAAQ,cAAc;EAC5B,MAAM,cAAc,oBAAoB,OAAO,KAAKA,aAAa,EAAE;EAMnE,MAAM,SAAS,aAAa;EAC5B,OAAO,OAAO,KAAKA,eAAe,WAAW;EAY7C,MAAM,UAAU,WAAW,KAAK,cAAc,IAV3B,gBAAgB;GACjC,eAAe;GACf,WAAW;GACX,cAAc;GACd,OAAO,gCAAgC,KAAKD;GAC5C,gBAAgB;GAChB,uBAAuB;GACvB;EACF,CAEmD,CAAC,CAAC,SAAS;EAG9D,MAAM,KAAKE,aAAa,OAAO;EAG/B,MAAM,OAAO,MAAM,IAAI,SAAiB,SAAS,WAAW;GAC1D,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM;IACb,OAAO,IAAI,mBAAmB,2CAA2C,CAAC;GAC5E,GAAG,IAAO;GAEV,OAAO,GAAG,YAAY,KAAK,QAAQ;IACjC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,OAAO,KAAKD,aAAa,GAAG;IACpF,IAAI,IAAI,aAAa,aAAa;KAChC,MAAM,eAAe,IAAI,aAAa,IAAI,MAAM;KAGhD,IAFsB,IAAI,aAAa,IAAI,OAE3B,MAAM,OAAO;MAC3B,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;MACnD,IAAI,IAAI,gBAAgB;MACxB,aAAa,OAAO;MACpB,OAAO,MAAM;MACb,OAAO,IAAI,mBAAmB,qBAAqB,CAAC;MACpD;KACF;KAEA,IAAI,CAAC,cAAc;MACjB,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;MACnD,IAAI,IAAI,gCAAgC;MACxC,aAAa,OAAO;MACpB,OAAO,MAAM;MACb,OAAO,IAAI,mBAAmB,mCAAmC,CAAC;MAClE;KACF;KAEA,IAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;KAClD,IAAI,IAAI,gGAAgG;KACxG,aAAa,OAAO;KACpB,OAAO,MAAM;KACb,QAAQ,YAAY;IACtB;GACF,CAAC;GAED,KAAK,QAAQ,OAAO,CAAC,CAAC,MAAM,CAAC,SAAS;IACpC,aAAa,OAAO;IACpB,OAAO,GAAY;GACrB,CAAC,CAAC,CAAC,MAAM,MAAM;EACjB,CAAC;EAGD,OAAO,KAAKE,cAAc,MAAM,YAAY,MAAM,UAAU,WAAW;CACzE;CAEA,MAAMA,cACJ,MACA,YACA,MACA,UACA,aACmB;EACnB,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ;GACA,cAAc;GACd,WAAW;GACX,eAAe;EACjB,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EAGrC,MAAM,eAAe,MAAM,WAAW,QAAQ;GAC5C,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,KAAK;GAChC;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,KAAK,aAAa,CAAC;EAC5D,CAAC;EAED,IAAI,aAAa,WAAW,KAAK;GAC/B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,aAAa,QAAQ,aAAa,IAAI;EACpE;EAEA,MAAM,WAAW,KAAK,MAAM,aAAa,IAAI;EAC7C,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAC9D,OAAO;CACT;CAEA,MAAMD,aAAa,KAA4B;EAC7C,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,EAAE,aAAa,MAAM,OAAO;EAGlC,IAAI,SAAS,MAAM,SACjB,SAAS,OAAO;GAAC;GAAM;GAAS;GAAI;EAAG,CAAC;OACnC,IAAI,SAAS,MAAM,UACxB,SAAS,QAAQ,CAAC,GAAG,CAAC;OAEtB,SAAS,YAAY,CAAC,GAAG,CAAC;CAE9B;AACF;;;;ACvIA,MAAM,8BAA8B;;AAiBpC,IAAM,aAAN,cAAyB,MAAM;CAC7B,YAAY,UAAU,6BAA6B;EACjD,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;AAGA,SAAS,eAAe,QAA4B;CAClD,IAAI,QAAQ,SAAS,MAAM,IAAI,WAAW;AAC5C;;AAGA,SAAS,MAAM,IAAY,QAAqC;CAC9D,OAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,IAAI,QAAQ,SAAS;GACnB,OAAO,IAAI,WAAW,CAAC;GACvB;EACF;EACA,MAAM,gBAAsB;GAC1B,aAAa,KAAK;GAClB,OAAO,IAAI,WAAW,CAAC;EACzB;EACA,MAAM,QAAQ,iBAAiB;GAC7B,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EACL,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;;;;;;;;;;AAWA,IAAa,iBAAb,MAA4C;CAC1C;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAgC;EAC1C,IAAI,OAAO,SAAS,iBAAiB,YACnC,MAAM,IAAI,mBAAmB,kDAAkD;EAEjF,IAAI,QAAQ,2BAA2B,KAAA,KAAa,QAAQ,0BAA0B,GACpF,MAAM,IAAI,mBAAmB,+CAA+C;EAE9E,KAAKE,gBAAgB,QAAQ;EAC7B,KAAKC,YAAY,QAAQ,YAAY;EACrC,KAAKC,YAAY,QAAQ,YAAY;EACrC,KAAKC,0BAA0B,QAAQ,0BAA0B;EACjE,KAAKC,UAAU,QAAQ;CACzB;CAEA,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aACJ,MACA,YACA,UACmB;EACnB,MAAM,SAAS,KAAKA;EACpB,eAAe,MAAM;EAErB,MAAM,aAAa,MAAM,KAAKC,mBAAmB,MAAM,YAAY,MAAM;EAEzE,MAAM,OAAuB;GAC3B,iBAAiB,WAAW;GAC5B,UAAU,WAAW;GACrB,yBAAyB,WAAW;GACpC,WAAW,WAAW;GACtB,UAAU,WAAW;EACvB;EACA,MAAM,KAAKL,cAAc,IAAI;EAE7B,MAAM,cAAc,MAAM,KAAKM,MAAM,MAAM,YAAY,YAAY,MAAM;EACzE,OAAO,KAAKC,sBAAsB,MAAM,YAAY,aAAa,MAAM;CACzE;CAEA,MAAMF,mBACJ,MACA,YACA,QAC8B;EAC9B,MAAM,iBAAiB;GACrB,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IACnB,WAAW,KAAKH;IAChB,OAAO,8BAA8B,KAAKD;GAC5C,CAAC;GACD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B;EACA,MAAM,WAAW,MAAM,WAAW,QAAQ,cAAc;EAExD,IAAI,SAAS,WAAW,KAAK;GAG3B,IAAI,SAAS,KAAK,YAAY,CAAC,CAAC,SAAS,uCAAuC,GAC9E,MAAM,IAAI,mBACR,6JAEF;GAEF,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,OAAO,KAAK,MAAM,SAAS,IAAI;CACjC;CAEA,MAAMK,MACJ,MACA,YACA,YACA,QACiB;EACjB,MAAM,WAAW,KAAK,IAAI,IAAI,WAAW,aAAa;EACtD,IAAI,kBAAkB,KAAKH;EAE3B,SAAS;GACP,eAAe,MAAM;GACrB,IAAI,KAAK,IAAI,KAAK,UAChB,MAAM,IAAI,eAAe,qDAAqD;GAGhF,MAAM,MAAM,kBAAkB,KAAM,MAAM;GAC1C,eAAe,MAAM;GAErB,MAAM,WAAW,MAAM,WAAW,QAAQ;IACxC,KAAK,WAAW,KAAK;IACrB,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM,KAAK,UAAU;KACnB,YAAY;KACZ,aAAa,WAAW;KACxB,WAAW,KAAKD;IAClB,CAAC;IACD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC7B,CAAC;GAED,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;GAErC,IAAI,SAAS,WAAW,OAAO,KAAK,cAClC,OAAO,KAAK;GAGd,QAAQ,KAAK,OAAb;IACE,KAAK,yBACH;IACF,KAAK;KACH,mBAAmB;KACnB;IACF,KAAK,iBACH,MAAM,IAAI,eAAe,kDAAkD;IAC7E,KAAK,iBACH,MAAM,IAAI,eAAe,wDAAwD;IACnF,SACE,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;GAC9D;EACF;CACF;CAEA,MAAMK,sBACJ,MACA,YACA,gBACA,QACmB;EACnB,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,eAAe,CAAC;GACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,CAAC;EAED,IAAI,SAAS,WAAW,KACtB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,MAAM,WAAW,KAAK,MAAM,SAAS,IAAI;EACzC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAC9D,OAAO;CACT;AACF;;;;;;;;;;;;;;ACpPA,SAAgB,mBACd,SACA,KAC2B;CAC3B,MAAM,cAAc,QAAQ,OAAO,WAAW,cAAc,OAAO,SAAS,OAAO;CACnF,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,MAAM,OAAO,OAAO,aAAa,IAAI,MAAM;CAC3C,MAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;CAE7C,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO;CAG5B,MAAM,cAAc,QAAQ,IAAI,YAAY,KAAK;CACjD,IAAI,eAAe,gBAAgB,OACjC,MAAM,IAAI,mBAAmB,4CAA4C;CAI3E,QAAQ,IAAI,uBAAuB,IAAI;CAEvC,OAAO;EAAE;EAAM;CAAM;AACvB;;;;;;;AC5BA,IAAa,YAAb,MAAuC;CACrC;CAEA,YAAY,SAA2B;EACrC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,gCAAgC;EACvF,KAAKC,eAAe,IAAI,YAAY,QAAQ,WAAW;CACzD;CAEA,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,KAAKA;GAClB,YAAY,KAAK,IAAI;EACvB;CACF;AAGF;;;;;;;AC1BA,IAAa,gBAAb,MAA2C;CACzC,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,IAAI,YAAY,EAAE;GAC/B,YAAY,KAAK,IAAI;EACvB;CACF;AACF;;;ACXA,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;;;;;AAMhC,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,aAAa;;CAEb;CAEA,YAAY,MAAc,SAAiC;EACzD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,iCAAiC;EACzE,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI,mBAAmB,2CAA2C;EAC3F,KAAKC,QAAQ,aAAa,IAAI;EAC9B,KAAKC,QAAQ,QAAQ;EACrB,KAAKC,cAAc,QAAQ,cAAc;EACzC,KAAKC,WAAW,QAAQ,WAAW;EACnC,KAAKC,eAAe,QAAQ,gBAAgB;EAC5C,KAAKC,MAAM,QAAQ;EACnB,KAAKC,UAAU,QAAQ,WAAW;EAClC,KAAKC,WAAW,IAAI,cAAc;CACpC;;CAGA,IAAI,OAAe;EACjB,OAAO,KAAKP;CACd;;CAGA,IAAI,aAAqB;EACvB,OAAO,KAAKE;CACd;;CAGA,IAAI,KAAkC;EACpC,OAAO,KAAKG;CACd;;CAGA,IAAI,SAAkB;EACpB,OAAO,KAAKC;CACd;;CAGA,IAAI,cAAuB;EACzB,OAAO,KAAKE;CACd;;;;;CAMA,WAAW,SAAgC;EACzC,KAAKD,WAAW;EAChB,OAAO;CACT;;;;;;;CAQA,cAAc,YAA8B;EAC1C,KAAKE,cAAc;EACnB,OAAO;CACT;;;;;;CAOA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAKA,aACR,MAAM,IAAI,mBACR,mIACF;EAGF,KAAKC,YAAY,MAAM,KAAKT,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAa,KAAKF,QAAQ;EAC1F,IAAI,CAAC,KAAKG,UAAU,YAAY,OAAO,GACrC,MAAM,IAAI,oBAAoB,4CAA4C;EAE5E,KAAKF,aAAa;CACpB;;;;CAKA,MAAM,aAA4B;EAChC,KAAKE,YAAY,KAAA;EACjB,KAAKF,aAAa;EAClB,KAAKC,aAAa,UAAU;CAC9B;;;;CAKA,kCAA0C;EACxC,IAAI,CAAC,KAAKC,WAAW,WAAW,OAAO;EACvC,MAAM,WAAW,KAAK,IAAI,IAAI,KAAKA,UAAU,cAAc;EAC3D,OAAO,KAAK,IAAI,GAAG,KAAKA,UAAU,YAAY,OAAO;CACvD;CAIA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,KAAkB,SAAkB,aAAqB,SAAsC;EACnG,OAAO,KAAK,OAAU,SAAA,QAA0B,aAAa,OAAO;CACtE;CAEA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,OAAoB,SAAkB,aAAqB,SAAsC;EACrG,OAAO,KAAK,OAAU,SAAA,UAA4B,aAAa,OAAO;CACxE;CAEA,MAAM,MAAmB,SAAkB,aAAqB,SAAsC;EACpG,OAAO,KAAK,OAAU,SAAA,SAA2B,aAAa,OAAO;CACvE;;;;;;;CAUA,MAAM,OACJ,SACA,QACA,aACA,SACY;EACZ,IAAI,CAAC,KAAKF,cAAc,CAAC,KAAKC,aAC5B,MAAM,IAAI,mBAAmB,6CAA6C;EAI5E,IAAI,KAAKL,cACP,MAAM,KAAKO,kBAAkB;EAG/B,MAAM,MAAM,gBAAgB,KAAKX,OAAO,SAAS,aAAa,SAAS,OAAO,KAAKE,WAAW;EAC9F,MAAM,UAAkC;GACtC,eAAe,UAAU,KAAKQ,UAAW,YAAY,OAAO;GAC5D,QAAQ;GACR,GAAG,SAAS;EACd;EAEA,IAAI,OAAsB;EAC1B,IAAI,SAAS,QAAQ,MAAM;GACzB,OAAO,KAAK,UAAU,QAAQ,IAAI;GAClC,QAAQ,kBAAkB;EAC5B,OAAO,IAAI,SAAS,QAAQ,MAC1B,OAAO,QAAQ;EAGjB,MAAM,cAA4D;GAChE;GACA;GACA;GACA;GACA,SAAS,SAAS,WAAW,KAAKP;EACpC;EACA,IAAI,SAAS,QAAQ,YAAY,SAAS,QAAQ;EAElD,MAAM,WAAW,MAAM,KAAKM,YAAY,QAAQ,WAAW;EAE3D,IAAI,SAAS,UAAU,KACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,MAAM,OAAO,SAAS,OAAQ,KAAK,MAAM,SAAS,IAAI,IAAW,KAAA;EAEjE,IAAI,SAAS,cACX,OAAO;GAAE;GAAM,QAAQ,SAAS;GAAQ,SAAS,SAAS;EAAQ;EAGpE,OAAO;CACT;CAIA,MAAME,oBAAmC;EACvC,IAAI,CAAC,KAAKD,WAAW;EACrB,IAAI,CAAC,KAAKA,UAAU,WAAW;EAE/B,MAAM,UAAU,KAAK,IAAI,IAAI,KAAKA,UAAU;EAC5C,MAAM,cAAc,KAAKA,UAAU,YAAY;EAE/C,IAAI,UAAU,0BAA0B,aACtC;EAMF,IAAI,KAAKE,sBAAsB;GAC7B,MAAM,KAAKA;GACX;EACF;EAEA,KAAKA,wBAAwB,YAA2B;GACtD,IAAI,KAAKX,MAAM,cAAc;IAC3B,MAAM,YAAY,MAAM,KAAKA,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAc,KAAKF,QAAQ;IAC5F,IAAI,WAAW;KACb,KAAKG,YAAY;KACjB;IACF;GACF;GACA,KAAKA,YAAY,MAAM,KAAKT,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAc,KAAKF,QAAQ;EAC7F,EAAA,CAAG;EAEH,IAAI;GACF,MAAM,KAAKK;EACb,UAAU;GAGR,KAAKA,uBAAuB,KAAA;EAC9B;CACF;AACF;;;;;;ACzPA,IAAY,eAAL,yBAAA,cAAA;CACL,aAAA,aAAA;CACA,aAAA,UAAA;CACA,aAAA,WAAA;;AACF,EAAA,CAAA,CAAA;;;;AAkBA,IAAY,4BAAL,yBAAA,2BAAA;CACL,0BAAA,cAAA;CACA,0BAAA,YAAA;CACA,0BAAA,YAAA;CACA,0BAAA,WAAA;CACA,0BAAA,aAAA;CACA,0BAAA,mBAAA;CACA,0BAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;;;;;;;;;ACLA,IAAa,YAAb,MAAuB;CACrB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,MAAc,SAA2B;EACnD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,2BAA2B;EACnE,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI,mBAAmB,sCAAsC;EACtF,KAAKC,QAAQ;EACb,KAAKC,QAAQ,QAAQ;EACrB,KAAKC,MAAM,QAAQ;EACnB,KAAKC,UAAU,QAAQ,WAAW;EAClC,KAAKC,cAAc,QAAQ,cAAc;CAC3C;;CAGA,IAAI,OAAe;EACjB,OAAO,KAAKJ;CACd;;CAGA,IAAI,KAAkC;EACpC,OAAO,KAAKE;CACd;;CAGA,IAAI,SAAkB;EACpB,OAAO,KAAKC;CACd;;CAGA,IAAI,OAAwB;EAC1B,OAAO,KAAKF;CACd;;;;CAKA,cAAc,YAA8B;EAC1C,KAAKI,cAAc;EACnB,OAAO;CACT;;;;;CAMA,MAAM,iBAAiB,QAAsC;EAE3D,OAAO,IAAI,YAAY,MADJ,KAAKC,YAAY,QAAQ,OAAO,eAAe,EAAE,MAAM,WAAW,CAAC,CAC3D;CAC7B;;;;;;CAOA,MAAM,mBAAmB,QAAgB,QAA6C;EACpF,MAAM,UAAU,UAAA;EAKhB,OAAO,IAAI,YAAY,MAJJ,KAAKA,YAAY,QAAQ,OAAO,eAAe;GAChE,MAAM;GACN,WAAW;EACb,CAAC,CAC0B;CAC7B;;;;;CAMA,MAAM,qBAAqB,QAAsC;EAE/D,OAAO,IAAI,YAAY,MADJ,KAAKA,YAAY,QAAQ,OAAO,eAAe,EAAE,MAAM,SAAS,CAAC,CACzD;CAC7B;;;;CAKA,MAAM,yBAAwD;EAC5D,KAAKC,kBAAkB;EACvB,MAAM,WAAW,MAAM,KAAKF,YAAa,QAAQ;GAC/C,KAAK,WAAW,KAAKL,MAAM,eAAe,KAAKI,YAAY;GAC3D,QAAQ;GACR,SAAS,EACP,QAAQ,mBACV;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KACtB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,OAAO,KAAK,MAAM,SAAS,IAAI;CACjC;;;;;;CAOA,MAAM,YAAY,QAAgB,UAAiC;EACjE,KAAKG,kBAAkB;EACvB,MAAM,WAAW,MAAM,KAAKF,YAAa,QAAQ;GAC/C,KAAK,WAAW,KAAKL,MAAM,eAAe,KAAKI,YAAY;GAC3D,QAAQ;GACR,SAAS;IACP,eAAe,OAAO;IACtB,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM,KAAK,UAAU,QAAQ;EAC/B,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;CAE9D;;;;;;;;CASA,MAAM,cACJ,QACA,KACA,YACA,QACe;EACf,KAAKG,kBAAkB;EAEvB,MAAM,UAAkC;GAAE,YAAY;GAAK,WADzC,UAAA;EAC8D;EAChF,IAAI,YAAY,QAAQ,gBAAgB;EAExC,MAAM,WAAW,MAAM,KAAKF,YAAa,QAAQ;GAC/C,KAAK,WAAW,KAAKL,MAAM,eAAe,KAAKI,YAAY;GAC3D,QAAQ;GACR,SAAS;IACP,eAAe,OAAO;IACtB,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;CAE9D;;;;;;CAOA,MAAM,oBACJ,QACA,SACiC;EACjC,KAAKG,kBAAkB;EACvB,MAAM,WAAW,MAAM,KAAKF,YAAa,QAAQ;GAC/C,KAAK,WAAW,KAAKL,MAAM,eAAe,KAAKI,YAAY;GAC3D,QAAQ;GACR,SAAS;IACP,eAAe,OAAO;IACtB,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,OAAO,KAAK,MAAM,SAAS,IAAI;CACjC;CAIA,MAAME,YACJ,QACA,QACA,UACA,aACiB;EACjB,KAAKC,kBAAkB;EACvB,IAAI,MAAM,WAAW,KAAKP,MAAM,eAAe,KAAKI,YAAY,GAAG;EACnE,IAAI,aAAa;GACf,MAAM,SAAS,IAAI,gBAAgB,WAAW;GAC9C,OAAO,IAAI,OAAO,SAAS;EAC7B;EAEA,MAAM,WAAW,MAAM,KAAKC,YAAa,QAAQ;GAC/C;GACA;GACA,SAAS;IACP,eAAe,OAAO;IACtB,QAAQ;GACV;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KACtB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,OAAO,SAAS;CAClB;CAEA,oBAA0B;EACxB,IAAI,CAAC,KAAKA,aACR,MAAM,IAAI,mBACR,6EACF;CAEJ;AACF"}
1	+ {"version":3,"file":"index.js","names":["undiciRequest"],"sources":["../src/types.ts","../src/errors.ts","../src/secret.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/storage/types.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/device-code.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"sourcesContent":["/*\n Safeguard appliance service endpoints.\n /\nexport enum Service {\n CORE = 'core',\n APPLIANCE = 'appliance',\n NOTIFICATION = 'notification',\n A2A = 'a2a',\n EVENT = 'event',\n RSTS = 'RSTS',\n}\n\n/\n HTTP methods supported by the Safeguard API.\n /\nexport enum HttpMethod {\n GET = 'GET',\n POST = 'POST',\n PUT = 'PUT',\n DELETE = 'DELETE',\n PATCH = 'PATCH',\n}\n\n/\n Full response from a Safeguard API call (returned when fullResponse: true).\n /\nexport interface SafeguardResponse<T = unknown> {\n data: T;\n status: number;\n headers: Record<string, string>;\n}\n\n/\n Options for individual API requests.\n /\nexport interface RequestOptions {\n /* Request body as JSON-serializable object. /\n json?: unknown;\n /* Raw request body. /\n body?: BodyInit \| null;\n /* Additional HTTP headers. /\n headers?: Record<string, string>;\n /* URL query parameters. /\n query?: Record<string, string \| number \| boolean>;\n /* AbortSignal for request cancellation. /\n signal?: AbortSignal;\n /* Request timeout in milliseconds (overrides client default). /\n timeout?: number;\n /* If true, returns full response with status and headers. /\n fullResponse?: boolean;\n}\n\n/\n Options for constructing a SafeguardClient.\n /\nexport interface SafeguardClientOptions {\n /* Authentication strategy. /\n auth: import('./auth/types.js').Auth;\n /* Custom CA certificate (PEM string or Buffer). Node.js only. /\n ca?: string \| Buffer;\n /* Whether to verify TLS certificates. Default: true. /\n verify?: boolean;\n /* Safeguard API version prefix. Default: 'v4'. /\n apiVersion?: string;\n /* Request timeout in milliseconds. Default: 300_000 (5 min). /\n timeout?: number;\n /* Auto-refresh tokens before expiry. Default: true. /\n autoRefresh?: boolean;\n}\n","/\n Error hierarchy for the Safeguard SDK.\n \n SafeguardError\n * ├── ApiError (HTTP errors from Safeguard API)\n * │ ├── AuthenticationError (401)\n * │ ├── AuthorizationError (403)\n * │ └── NotFoundError (404)\n * ├── TransportError (Network/connection failures)\n * └── ConfigurationError (Invalid client options)\n /\n\nexport class SafeguardError extends Error {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'SafeguardError';\n }\n}\n\nexport interface ApiErrorBody {\n Code?: string;\n Message?: string;\n InnerError?: { Message?: string };\n [key: string]: unknown;\n}\n\nexport class ApiError extends SafeguardError {\n readonly status: number;\n readonly body: ApiErrorBody \| null;\n\n constructor(message: string, status: number, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, options);\n this.name = 'ApiError';\n this.status = status;\n this.body = body;\n }\n\n /\n Creates an appropriate ApiError subclass based on HTTP status code.\n /\n static fromResponse(status: number, body: string \| ApiErrorBody \| null): ApiError {\n const parsed = ApiError.parseBody(body);\n const message = ApiError.buildMessage(status, parsed);\n\n switch (status) {\n case 401:\n return new AuthenticationError(message, parsed);\n case 403:\n return new AuthorizationError(message, parsed);\n case 404:\n return new NotFoundError(message, parsed);\n default:\n return new ApiError(message, status, parsed);\n }\n }\n\n private static parseBody(body: string \| ApiErrorBody \| null): ApiErrorBody \| null {\n if (body === null \|\| body === undefined) return null;\n if (typeof body === 'object') return body;\n try {\n return JSON.parse(body) as ApiErrorBody;\n } catch {\n return { Message: body };\n }\n }\n\n private static buildMessage(status: number, body: ApiErrorBody \| null): string {\n const apiMessage = body?.Message ?? body?.InnerError?.Message;\n if (apiMessage) {\n return `HTTP ${String(status)}: ${apiMessage}`;\n }\n return `HTTP ${String(status)}`;\n }\n}\n\nexport class AuthenticationError extends ApiError {\n constructor(message: string, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, 401, body, options);\n this.name = 'AuthenticationError';\n }\n}\n\nexport class AuthorizationError extends ApiError {\n constructor(message: string, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, 403, body, options);\n this.name = 'AuthorizationError';\n }\n}\n\nexport class NotFoundError extends ApiError {\n constructor(message: string, body: ApiErrorBody \| null = null, options?: ErrorOptions) {\n super(message, 404, body, options);\n this.name = 'NotFoundError';\n }\n}\n\nexport class TransportError extends SafeguardError {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'TransportError';\n }\n}\n\nexport class ConfigurationError extends SafeguardError {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'ConfigurationError';\n }\n}\n","const REDACTED = '[REDACTED]';\n\n/\n A wrapper that prevents accidental logging of sensitive values.\n \n - `toString()` returns \"[REDACTED]\"\n * - `toJSON()` returns \"[REDACTED]\"\n * - `console.log(secretValue)` prints \"[REDACTED]\"\n * - `.expose()` returns the raw value when intentionally needed\n /\nexport class SecretValue {\n readonly #value: string;\n\n constructor(value: string) {\n this.#value = value;\n }\n\n /* Returns the raw secret. Use only when you intentionally need the plaintext. /\n expose(): string {\n return this.#value;\n }\n\n toString(): string {\n return REDACTED;\n }\n\n toJSON(): string {\n return REDACTED;\n }\n\n /* Node.js custom inspect (prevents leaking in console.log / util.inspect). /\n [Symbol.for('nodejs.util.inspect.custom')](): string {\n return REDACTED;\n }\n\n get [Symbol.toStringTag](): string {\n return 'SecretValue';\n }\n}\n","import { Service } from './types.js';\nimport { ConfigurationError } from './errors.js';\n\n/\n Validates that a host string is a bare hostname or IP address.\n * Rejects URLs, paths, query strings, userinfo, and embedded ports.\n \n @throws {ConfigurationError} if the host contains disallowed characters\n /\nexport function validateHost(host: string): string {\n if (!host) throw new ConfigurationError('Host must not be empty');\n\n const trimmed = host.trim();\n if (trimmed !== host) {\n throw new ConfigurationError('Host must not contain leading or trailing whitespace');\n }\n\n // Reject protocol prefixes\n if (/^[a-z][a-z0-9+.-]:\\/\\//i.test(host)) {\n throw new ConfigurationError(\n `Host must be a bare hostname or IP, not a URL. Remove the protocol prefix (e.g., use \"${host.replace(/^[a-z][a-z0-9+.-]:\\/\\//i, '')}\")`,\n );\n }\n\n // Reject path, query, fragment, userinfo characters\n if (/[/?#@]/.test(host)) {\n throw new ConfigurationError(\n 'Host must be a bare hostname or IP address — must not contain /, ?, #, or @',\n );\n }\n\n // Reject port suffix (e.g. \"host:8443\") — SDK always uses HTTPS/443\n if (/:\\d+$/.test(host) && !host.startsWith('[')) {\n throw new ConfigurationError(\n 'Host must not include a port number. The SDK always connects over HTTPS (port 443).',\n );\n }\n\n return host;\n}\n\n/\n Builds the base URL for a Safeguard service endpoint.\n \n @example\n * buildServiceUrl('appliance.example.com', Service.CORE)\n * // => 'https://appliance.example.com/service/core/v4'\n /\nexport function buildServiceUrl(host: string, service: Service, apiVersion: string = 'v4'): string {\n if (service === Service.RSTS) {\n return `https://${host}/RSTS`;\n }\n return `https://${host}/service/${service}/${apiVersion}`;\n}\n\n/\n Builds a full API URL including path and optional query parameters.\n \n @example\n * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq \"admin\"' })\n * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'\n /\nexport function buildRequestUrl(\n host: string,\n service: Service,\n relativeUrl: string,\n query?: Record<string, string \| number \| boolean>,\n apiVersion: string = 'v4',\n): string {\n const base = buildServiceUrl(host, service, apiVersion);\n const path = relativeUrl.startsWith('/') ? relativeUrl.slice(1) : relativeUrl;\n const url = new URL(`${base}/${path}`);\n\n if (query) {\n for (const [key, value] of Object.entries(query)) {\n url.searchParams.set(key, String(value));\n }\n }\n\n return url.toString();\n}\n\n/\n Encodes bytes to a URL-safe base64 string (no padding).\n /\nexport function base64UrlEncode(bytes: Uint8Array): string {\n const binary = String.fromCharCode(...bytes);\n return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/\n Generates a cryptographically random code verifier for PKCE.\n * Returns a 43-character base64url string (32 random bytes).\n /\nexport function generateCodeVerifier(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return base64UrlEncode(bytes);\n}\n\n/\n Computes the S256 code challenge from a code verifier.\n * Uses Web Crypto API (available in Node 20+ and all modern browsers).\n /\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n const encoder = new TextEncoder();\n const data = encoder.encode(verifier);\n const digest = await crypto.subtle.digest('SHA-256', data);\n return base64UrlEncode(new Uint8Array(digest));\n}\n\n/\n Generates a random state parameter for OAuth flows.\n /\nexport function generateState(): string {\n const bytes = new Uint8Array(16);\n crypto.getRandomValues(bytes);\n return base64UrlEncode(bytes);\n}\n\n/\n Extracts the `exp` claim from a JWT and returns expiresIn (seconds from now).\n * Returns undefined if the token is not a valid JWT or has no `exp` claim.\n /\nexport function getTokenExpiresIn(jwt: string): number \| undefined {\n try {\n const parts = jwt.split('.');\n if (parts.length !== 3) return undefined;\n // Base64url decode the payload\n const payload = parts[1]!.replace(/-/g, '+').replace(/_/g, '/');\n const json = atob(payload);\n const claims = JSON.parse(json) as { exp?: number };\n if (typeof claims.exp !== 'number') return undefined;\n const now = Math.floor(Date.now() / 1000);\n return Math.max(0, claims.exp - now);\n } catch {\n return undefined;\n }\n}\n","import type { StorageProvider } from './types.js';\n\n/\n In-memory storage provider. Default for Node.js environments.\n * Data does not persist across process restarts.\n /\nexport class MemoryStorage implements StorageProvider {\n readonly #store = new Map<string, string>();\n\n get(key: string): string \| null {\n return this.#store.get(key) ?? null;\n }\n\n set(key: string, value: string): void {\n this.#store.set(key, value);\n }\n\n remove(key: string): void {\n this.#store.delete(key);\n }\n\n clear(): void {\n this.#store.clear();\n }\n}\n","import type { StorageProvider } from './types.js';\n\n/\n Browser sessionStorage adapter. Data persists for the browser tab lifetime.\n * Requires a DOM environment (browser or jsdom).\n /\nexport class BrowserSessionStorage implements StorageProvider {\n get(key: string): string \| null {\n return sessionStorage.getItem(key);\n }\n\n set(key: string, value: string): void {\n sessionStorage.setItem(key, value);\n }\n\n remove(key: string): void {\n sessionStorage.removeItem(key);\n }\n\n clear(): void {\n sessionStorage.clear();\n }\n}\n","/\n Interface for token/state storage backends.\n /\nexport interface StorageProvider {\n get(key: string): string \| null;\n set(key: string, value: string): void;\n remove(key: string): void;\n clear(): void;\n}\n\n/* Well-known storage keys used by the SDK. /\nexport const StorageKeys = {\n STATE: 'safeguard_state',\n CODE_VERIFIER: 'safeguard_code_verifier',\n} as const;\n","import { Agent, request as undiciRequest } from 'undici';\nimport type { HttpClient, HttpRequestOptions, HttpResponse, TlsOptions } from './types.js';\n\n/* Connect options passed to the undici Agent's TLS layer. /\ntype TlsConnectOptions = {\n ca?: string \| Buffer \| undefined;\n cert?: string \| Buffer \| undefined;\n key?: string \| Buffer \| undefined;\n pfx?: string \| Buffer \| undefined;\n passphrase?: string \| undefined;\n rejectUnauthorized: boolean;\n minVersion?: TlsOptions['minVersion'];\n maxVersion?: TlsOptions['maxVersion'];\n};\n\n/\n Resolve the undici Agent `connect` (TLS) options from {@link TlsOptions}.\n \n Applies the opt-in `minVersion`/`maxVersion` pins. When a client certificate\n * is present and the caller has pinned neither bound, the connection is capped\n * at TLS 1.2: Node has no client-side TLS 1.3 post-handshake authentication\n * (see https://github.com/nodejs/node/issues/46120), so on TLS 1.3 the client\n * never presents its certificate and cert/A2A auth fails (error 60094) on the\n * appliance's Standard binding. Capping at TLS 1.2 keeps the cert request\n * in-handshake so it works by default. Setting either bound explicitly (for\n * example `minVersion: 'TLSv1.3'` when targeting a Cert SNI hostname) disables\n * the auto-cap. Password/token connections carry no certificate and keep\n * negotiating up to TLS 1.3.\n /\nexport function resolveTlsConnectOptions(tlsOptions?: TlsOptions): TlsConnectOptions {\n const connect: TlsConnectOptions = {\n ca: tlsOptions?.ca,\n cert: tlsOptions?.cert,\n key: tlsOptions?.key,\n pfx: tlsOptions?.pfx,\n passphrase: tlsOptions?.passphrase,\n rejectUnauthorized: tlsOptions?.rejectUnauthorized ?? true,\n };\n\n const hasClientCert = Boolean(tlsOptions?.cert ?? tlsOptions?.key ?? tlsOptions?.pfx);\n\n if (tlsOptions?.minVersion) connect.minVersion = tlsOptions.minVersion;\n if (tlsOptions?.maxVersion) {\n connect.maxVersion = tlsOptions.maxVersion;\n } else if (hasClientCert && !tlsOptions?.minVersion) {\n connect.maxVersion = 'TLSv1.2';\n }\n\n return connect;\n}\n\n/\n Node.js HTTP client using undici for full TLS control.\n * Creates a per-instance Agent — no global state mutation.\n /\nexport class NodeHttpClient implements HttpClient {\n readonly #agent: Agent;\n\n constructor(tlsOptions?: TlsOptions) {\n const hasClientCert = Boolean(\n tlsOptions?.cert ?? tlsOptions?.key ?? tlsOptions?.pfx,\n );\n this.#agent = new Agent({\n connect: resolveTlsConnectOptions(tlsOptions),\n // Pin HTTP/1.1 for client-certificate connections (cert auth and A2A).\n // The appliance's HTTP/2-capable Standard binding rejects certificate\n // auth over HTTP/2 with HTTP_1_1_REQUIRED, independent of TLS version.\n // undici negotiates HTTP/2 via ALPN by default, so disable it whenever a\n // client certificate is present (see issue #650). Password/token\n // connections carry no certificate and keep HTTP/2.\n ...(hasClientCert ? { allowH2: false } : {}),\n });\n }\n\n async request(options: HttpRequestOptions): Promise<HttpResponse> {\n const { url, method, headers, body, signal, timeout } = options;\n\n const requestOptions: Parameters<typeof undiciRequest>[1] = {\n method: method as 'GET' \| 'POST' \| 'PUT' \| 'DELETE' \| 'PATCH',\n dispatcher: this.#agent,\n };\n\n if (headers) requestOptions.headers = headers;\n if (body != null) requestOptions.body = body;\n if (signal) requestOptions.signal = signal;\n if (timeout) {\n requestOptions.bodyTimeout = timeout;\n requestOptions.headersTimeout = timeout;\n }\n\n const response = await undiciRequest(url, requestOptions);\n\n const responseHeaders: Record<string, string> = {};\n const rawHeaders = response.headers;\n for (const [key, value] of Object.entries(rawHeaders)) {\n if (value !== undefined) {\n responseHeaders[key] = Array.isArray(value) ? value.join(', ') : value;\n }\n }\n\n const responseBody = await response.body.text();\n\n return {\n status: response.statusCode,\n headers: responseHeaders,\n body: responseBody,\n };\n }\n\n dispose(): void {\n this.#agent.close().catch(() => { / already closed or destroyed / });\n }\n}\n","import type { HttpClient, HttpRequestOptions, HttpResponse } from './types.js';\n\n/\n Browser HTTP client using native fetch API.\n * No TLS configuration needed — browser handles certificates.\n /\nexport class BrowserHttpClient implements HttpClient {\n readonly #credentials: RequestCredentials;\n\n constructor(options?: { credentials?: RequestCredentials }) {\n this.#credentials = options?.credentials ?? 'include';\n }\n\n async request(options: HttpRequestOptions): Promise<HttpResponse> {\n const { url, method, headers, body, signal, timeout } = options;\n\n const requestInit: RequestInit = {\n method,\n credentials: this.#credentials,\n };\n\n if (headers) requestInit.headers = headers;\n if (body != null) requestInit.body = body as BodyInit;\n if (signal \|\| timeout) {\n const controller = new AbortController();\n let timeoutId: ReturnType<typeof setTimeout> \| undefined;\n\n if (timeout) {\n timeoutId = setTimeout(() => controller.abort(new Error('Request timed out')), timeout);\n }\n\n requestInit.signal = signal\n ? AbortSignal.any([signal, controller.signal])\n : controller.signal;\n\n try {\n return await this.#doFetch(url, requestInit);\n } finally {\n if (timeoutId !== undefined) clearTimeout(timeoutId);\n }\n }\n\n return this.#doFetch(url, requestInit);\n }\n\n async #doFetch(url: string, init: RequestInit): Promise<HttpResponse> {\n const response = await fetch(url, init);\n\n const responseHeaders: Record<string, string> = {};\n response.headers.forEach((value, key) => {\n responseHeaders[key] = value;\n });\n\n const responseBody = await response.text();\n\n return {\n status: response.status,\n headers: responseHeaders,\n body: responseBody,\n };\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { getTokenExpiresIn } from '../utils.js';\n\nexport interface PasswordAuthOptions {\n username: string;\n password: string;\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n}\n\n/\n Authenticates using username/password via RSTS Resource Owner grant.\n /\nexport class PasswordAuth implements Auth {\n readonly #username: string;\n readonly #password: SecretValue;\n readonly #provider: string;\n\n constructor(options: PasswordAuthOptions) {\n if (!options.username) throw new ConfigurationError('PasswordAuth requires username');\n if (!options.password) throw new ConfigurationError('PasswordAuth requires password');\n if (!options.provider) throw new ConfigurationError('PasswordAuth requires provider');\n this.#username = options.username;\n this.#password = new SecretValue(options.password);\n this.#provider = options.provider;\n }\n\n get description(): string {\n return `PasswordAuth(${this.#username}@${this.#provider})`;\n }\n\n async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n // Step 1: Get RSTS token\n const rstsToken = await this.#getRstsToken(host, httpClient);\n\n // Step 2: Exchange RSTS token for Safeguard user token\n const userToken = await this.#exchangeForUserToken(host, httpClient, rstsToken);\n\n return userToken;\n }\n\n async refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet \| null> {\n // Password auth can always re-authenticate\n return this.authenticate(host, httpClient, storage);\n }\n\n async #getRstsToken(host: string, httpClient: HttpClient): Promise<string> {\n const body = JSON.stringify({\n grant_type: 'password',\n username: this.#username,\n password: this.#password.expose(),\n scope: 'rsts:sts:primaryproviderid:' + this.#provider.toLowerCase(),\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body,\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string };\n return data.access_token;\n }\n\n async #exchangeForUserToken(host: string, httpClient: HttpClient, rstsToken: string): Promise<TokenSet> {\n const response = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${rstsToken}`,\n },\n body: JSON.stringify({ StsAccessToken: rstsToken }),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(data.UserToken),\n acquiredAt: Date.now(),\n };\n if (data.ExpiresIn != null) {\n tokenSet.expiresIn = data.ExpiresIn;\n } else {\n const expiresIn = getTokenExpiresIn(data.UserToken);\n if (expiresIn != null) tokenSet.expiresIn = expiresIn;\n }\n return tokenSet;\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { getTokenExpiresIn } from '../utils.js';\n\nexport interface CertificateAuthOptions {\n /* Path to PEM certificate file, or PEM string. /\n certFile?: string;\n /* Path to PEM private key file, or PEM string. /\n keyFile?: string;\n /* PEM certificate content (alternative to certFile). /\n cert?: string \| Buffer;\n /* PEM key content (alternative to keyFile). /\n key?: string \| Buffer;\n /* Path to PFX/PKCS12 file (alternative to cert+key). /\n pfxFile?: string;\n /* PFX/PKCS12 content (alternative to cert+key). /\n pfx?: string \| Buffer;\n /* Passphrase for encrypted private key or PFX. /\n passphrase?: string;\n /* Identity provider name. Default: 'certificate'. /\n provider?: string;\n}\n\n/\n Authenticates using a client certificate (mTLS) against RSTS.\n * Node.js only — requires TLS client cert support in HttpClient.\n /\nexport class CertificateAuth implements Auth {\n readonly #certFile: string \| undefined;\n readonly #keyFile: string \| undefined;\n readonly #cert: string \| Buffer \| undefined;\n readonly #key: string \| Buffer \| undefined;\n readonly #pfxFile: string \| undefined;\n readonly #pfx: string \| Buffer \| undefined;\n readonly #passphrase: SecretValue \| undefined;\n readonly #provider: string;\n\n constructor(options: CertificateAuthOptions) {\n const hasPfx = options.pfx ?? options.pfxFile;\n const hasCert = options.cert ?? options.certFile;\n const hasKey = options.key ?? options.keyFile;\n if (!hasPfx && !hasCert) throw new ConfigurationError('CertificateAuth requires cert/certFile or pfxFile/pfx');\n if (!hasPfx && !hasKey) throw new ConfigurationError('CertificateAuth requires key or keyFile');\n this.#certFile = options.certFile;\n this.#keyFile = options.keyFile;\n this.#cert = options.cert;\n this.#key = options.key;\n this.#pfxFile = options.pfxFile;\n this.#pfx = options.pfx;\n this.#passphrase = options.passphrase ? new SecretValue(options.passphrase) : undefined;\n this.#provider = options.provider ?? 'certificate';\n }\n\n get description(): string {\n return `CertificateAuth(${this.#provider})`;\n }\n\n /* Returns the TLS options needed to create an mTLS HttpClient. /\n getTlsOptions(): { cert?: string \| Buffer; key?: string \| Buffer; pfx?: string \| Buffer; passphrase?: string } {\n const opts: { cert?: string \| Buffer; key?: string \| Buffer; pfx?: string \| Buffer; passphrase?: string } = {};\n if (this.#pfx ?? this.#pfxFile) {\n opts.pfx = this.#pfx ?? this.#pfxFile!;\n } else {\n opts.cert = this.#cert ?? this.#certFile!;\n opts.key = this.#key ?? this.#keyFile!;\n }\n if (this.#passphrase) opts.passphrase = this.#passphrase.expose();\n return opts;\n }\n\n async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n // Step 1: Get RSTS token using client cert (mTLS)\n const rstsToken = await this.#getRstsToken(host, httpClient);\n\n // Step 2: Exchange RSTS token for Safeguard user token\n return this.#exchangeForUserToken(host, httpClient, rstsToken);\n }\n\n async refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet \| null> {\n return this.authenticate(host, httpClient, storage);\n }\n\n async #getRstsToken(host: string, httpClient: HttpClient): Promise<string> {\n const body = JSON.stringify({\n grant_type: 'client_credentials',\n scope: 'rsts:sts:primaryproviderid:' + this.#provider.toLowerCase(),\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body,\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string };\n return data.access_token;\n }\n\n async #exchangeForUserToken(host: string, httpClient: HttpClient, rstsToken: string): Promise<TokenSet> {\n const response = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${rstsToken}`,\n },\n body: JSON.stringify({ StsAccessToken: rstsToken }),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(data.UserToken),\n acquiredAt: Date.now(),\n };\n if (data.ExpiresIn != null) {\n tokenSet.expiresIn = data.ExpiresIn;\n } else {\n const expiresIn = getTokenExpiresIn(data.UserToken);\n if (expiresIn != null) tokenSet.expiresIn = expiresIn;\n }\n return tokenSet;\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { StorageKeys } from '../storage/types.js';\nimport { generateCodeVerifier, generateCodeChallenge, generateState } from '../utils.js';\n\nexport interface PkceAuthOptions {\n /* OAuth redirect URI (must match RSTS configuration). /\n redirectUri: string;\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n}\n\n/\n Authenticates using PKCE (Proof Key for Code Exchange) with browser redirect.\n * For browser environments where the user is redirected to RSTS login.\n /\nexport class PkceAuth implements Auth {\n readonly #redirectUri: string;\n readonly #provider: string;\n\n constructor(options: PkceAuthOptions) {\n if (!options.redirectUri) throw new ConfigurationError('PkceAuth requires redirectUri');\n if (!options.provider) throw new ConfigurationError('PkceAuth requires provider');\n this.#redirectUri = options.redirectUri;\n this.#provider = options.provider;\n }\n\n get description(): string {\n return `PKCE(redirect=${this.#redirectUri})`;\n }\n\n /\n Initiates the PKCE flow. If a stored authorization code exists (from callback),\n * exchanges it for a token. Otherwise, redirects to RSTS login.\n /\n async authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet> {\n // Check for authorization code (set by handlePkceCallback)\n const code = storage.get('safeguard_auth_code');\n if (code) {\n const verifier = storage.get(StorageKeys.CODE_VERIFIER);\n if (!verifier) {\n throw new ConfigurationError('PKCE code verifier not found in storage');\n }\n storage.remove('safeguard_auth_code');\n storage.remove(StorageKeys.CODE_VERIFIER);\n storage.remove(StorageKeys.STATE);\n return this.#exchangeCode(host, httpClient, code, verifier);\n }\n\n // No code — initiate redirect\n await this.#initiateRedirect(host, storage);\n\n // This point is never reached in a browser (redirect happens).\n // For testability, throw rather than hang.\n throw new ConfigurationError(\n 'PKCE redirect initiated. Call handlePkceCallback() on the callback page.',\n );\n }\n\n async #initiateRedirect(host: string, storage: StorageProvider): Promise<void> {\n const verifier = generateCodeVerifier();\n const challenge = await generateCodeChallenge(verifier);\n const state = generateState();\n\n storage.set(StorageKeys.CODE_VERIFIER, verifier);\n storage.set(StorageKeys.STATE, state);\n\n const params = new URLSearchParams({\n response_type: 'code',\n client_id: 'safeguard.js',\n redirect_uri: this.#redirectUri,\n scope: 'rsts:sts:primaryproviderid:' + this.#provider,\n code_challenge: challenge,\n code_challenge_method: 'S256',\n state,\n });\n\n const authUrl = `https://${host}/RSTS/Login?${params.toString()}`;\n\n // In browser environment, redirect\n if (typeof window !== 'undefined' && window.location) {\n window.location.href = authUrl;\n }\n }\n\n async #exchangeCode(\n host: string,\n httpClient: HttpClient,\n code: string,\n verifier: string,\n ): Promise<TokenSet> {\n const body = new URLSearchParams({\n grant_type: 'authorization_code',\n code,\n redirect_uri: this.#redirectUri,\n client_id: 'safeguard.js',\n code_verifier: verifier,\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: body.toString(),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string; expires_in?: number };\n\n // Exchange RSTS token for Safeguard user token\n const userTokenResponse = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${data.access_token}`,\n },\n body: JSON.stringify({ StsAccessToken: data.access_token }),\n });\n\n if (userTokenResponse.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(userTokenResponse.status, userTokenResponse.body);\n }\n\n const userData = JSON.parse(userTokenResponse.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(userData.UserToken),\n acquiredAt: Date.now(),\n };\n if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n\n // Token stays in-memory only (SafeguardClient.#tokenSet). Not persisted to\n // sessionStorage to avoid XSS exfiltration of high-privilege PAM tokens.\n return tokenSet;\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { generateCodeVerifier, generateCodeChallenge, generateState } from '../utils.js';\n\nexport interface PkceNonInteractiveAuthOptions {\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n /* Port for the local callback server. Default: 8400. /\n callbackPort?: number;\n}\n\n/\n Non-interactive PKCE authentication for Node.js automation.\n * Starts a local HTTP server to receive the callback, opens the system browser\n * for login, and waits for the redirect.\n \n Matches PySafeguard's PkceAuth behavior (local server pattern).\n /\nexport class PkceNonInteractiveAuth implements Auth {\n readonly #provider: string;\n readonly #callbackPort: number;\n\n constructor(options?: PkceNonInteractiveAuthOptions) {\n this.#provider = options?.provider ?? 'local';\n this.#callbackPort = options?.callbackPort ?? 8400;\n }\n\n get description(): string {\n return `PkceNonInteractiveAuth(port=${String(this.#callbackPort)})`;\n }\n\n async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n const { createServer } = await import('node:http');\n const { once } = await import('node:events');\n\n const verifier = generateCodeVerifier();\n const challenge = await generateCodeChallenge(verifier);\n const state = generateState();\n const redirectUri = `http://localhost:${String(this.#callbackPort)}/callback`;\n\n // Start local server to receive callback.\n // Bind explicitly to the loopback interface (127.0.0.1) so a co-resident\n // process on a shared host cannot intercept the authorization code by\n // racing the legitimate browser callback on the ephemeral port.\n const server = createServer();\n server.listen(this.#callbackPort, '127.0.0.1');\n\n const params = new URLSearchParams({\n response_type: 'code',\n client_id: 'safeguard.js',\n redirect_uri: redirectUri,\n scope: 'rsts:sts:primaryproviderid:' + this.#provider,\n code_challenge: challenge,\n code_challenge_method: 'S256',\n state,\n });\n\n const authUrl = `https://${host}/RSTS/Login?${params.toString()}`;\n\n // Open browser\n await this.#openBrowser(authUrl);\n\n // Wait for callback\n const code = await new Promise<string>((resolve, reject) => {\n const timeout = setTimeout(() => {\n server.close();\n reject(new ConfigurationError('PKCE callback timed out after 120 seconds'));\n }, 120_000);\n\n server.on('request', (req, res) => {\n const url = new URL(req.url ?? '/', `http://localhost:${String(this.#callbackPort)}`);\n if (url.pathname === '/callback') {\n const receivedCode = url.searchParams.get('code');\n const receivedState = url.searchParams.get('state');\n\n if (receivedState !== state) {\n res.writeHead(400, { 'Content-Type': 'text/plain' });\n res.end('State mismatch');\n clearTimeout(timeout);\n server.close();\n reject(new ConfigurationError('PKCE state mismatch'));\n return;\n }\n\n if (!receivedCode) {\n res.writeHead(400, { 'Content-Type': 'text/plain' });\n res.end('No authorization code received');\n clearTimeout(timeout);\n server.close();\n reject(new ConfigurationError('No authorization code in callback'));\n return;\n }\n\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('<html><body><h1>Authentication successful!</h1><p>You may close this window.</p></body></html>');\n clearTimeout(timeout);\n server.close();\n resolve(receivedCode);\n }\n });\n\n once(server, 'error').then(([err]) => {\n clearTimeout(timeout);\n reject(err as Error);\n }).catch(reject);\n });\n\n // Exchange code for token\n return this.#exchangeCode(host, httpClient, code, verifier, redirectUri);\n }\n\n async #exchangeCode(\n host: string,\n httpClient: HttpClient,\n code: string,\n verifier: string,\n redirectUri: string,\n ): Promise<TokenSet> {\n const body = new URLSearchParams({\n grant_type: 'authorization_code',\n code,\n redirect_uri: redirectUri,\n client_id: 'safeguard.js',\n code_verifier: verifier,\n });\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: body.toString(),\n });\n\n if (response.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = JSON.parse(response.body) as { access_token: string };\n\n // Exchange for user token\n const userResponse = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${data.access_token}`,\n },\n body: JSON.stringify({ StsAccessToken: data.access_token }),\n });\n\n if (userResponse.status !== 200) {\n const { ApiError } = await import('../errors.js');\n throw ApiError.fromResponse(userResponse.status, userResponse.body);\n }\n\n const userData = JSON.parse(userResponse.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(userData.UserToken),\n acquiredAt: Date.now(),\n };\n if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n return tokenSet;\n }\n\n async #openBrowser(url: string): Promise<void> {\n const { platform } = await import('node:os');\n const { execFile } = await import('node:child_process');\n\n // Use execFile with argument arrays to prevent shell injection via host parameter\n if (platform() === 'win32') {\n execFile('cmd', ['/c', 'start', '', url]);\n } else if (platform() === 'darwin') {\n execFile('open', [url]);\n } else {\n execFile('xdg-open', [url]);\n }\n }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ApiError, ConfigurationError, SafeguardError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\n\n/\n Public device-code details handed to the caller for display.\n \n The raw `device_code` is intentionally NOT exposed — the library owns\n * polling and the caller only needs to render the verification URL and code.\n /\nexport interface DeviceCodeInfo {\n /* URL the user opens to authenticate (e.g. shown as a QR target or link). /\n verificationUri: string;\n /* Short code the user enters at the verification URL. /\n userCode: string;\n /* Verification URL with the user code pre-filled (RFC 8628 §3.3.1). /\n verificationUriComplete: string;\n /* Seconds until the device code expires. /\n expiresIn: number;\n /* Suggested minimum seconds between poll attempts. /\n interval: number;\n}\n\n/\n Options for {@link DeviceCodeAuth}.\n /\nexport interface DeviceCodeAuthOptions {\n /\n REQUIRED callback that receives the {@link DeviceCodeInfo} for display.\n * The library performs no display I/O; the caller renders the URL + code\n * (console, DOM, log). May be async; it is awaited before polling begins.\n /\n onDeviceCode: (info: DeviceCodeInfo) => void \| Promise<void>;\n /* Identity provider name. Default: 'local'. /\n provider?: string;\n /* OAuth client id. Default: '' (matches other Safeguard SDKs). /\n clientId?: string;\n /* Starting poll interval in seconds. Default: 5. Auto-bumps on `slow_down`. /\n pollingIntervalSeconds?: number;\n /* Cancellation signal applied to HTTP requests and inter-poll delays. /\n signal?: AbortSignal;\n}\n\n/* Number of seconds to add to the poll interval on each `slow_down`. /\nconst SLOW_DOWN_INCREMENT_SECONDS = 5;\n\ninterface DeviceLoginResponse {\n device_code: string;\n user_code: string;\n verification_uri: string;\n verification_uri_complete: string;\n expires_in: number;\n interval: number;\n}\n\ninterface TokenPollResponse {\n access_token?: string;\n error?: string;\n}\n\n/* Error whose `name` is `AbortError`, matching standard web cancellation. /\nclass AbortError extends Error {\n constructor(message = 'The operation was aborted') {\n super(message);\n this.name = 'AbortError';\n }\n}\n\n/* Reject promptly if the signal is already aborted. /\nfunction throwIfAborted(signal?: AbortSignal): void {\n if (signal?.aborted) throw new AbortError();\n}\n\n/* Abortable sleep that rejects with an `AbortError` if the signal fires. /\nfunction delay(ms: number, signal?: AbortSignal): Promise<void> {\n return new Promise<void>((resolve, reject) => {\n if (signal?.aborted) {\n reject(new AbortError());\n return;\n }\n const onAbort = (): void => {\n clearTimeout(timer);\n reject(new AbortError());\n };\n const timer = setTimeout(() => {\n signal?.removeEventListener('abort', onAbort);\n resolve();\n }, ms);\n signal?.addEventListener('abort', onAbort, { once: true });\n });\n}\n\n/\n OAuth 2.0 Device Authorization Grant (RFC 8628) for Safeguard.\n \n Headless display-and-poll only: it requests a device code, hands the public\n * verification details to the required `onDeviceCode` callback, then polls the\n * token endpoint until the user authenticates in their own browser. It never\n * spawns or opens a browser and performs no display I/O. Platform-agnostic, so\n * it is exported from both the Node and browser entry points.\n /\nexport class DeviceCodeAuth implements Auth {\n readonly #onDeviceCode: (info: DeviceCodeInfo) => void \| Promise<void>;\n readonly #provider: string;\n readonly #clientId: string;\n readonly #pollingIntervalSeconds: number;\n readonly #signal: AbortSignal \| undefined;\n\n constructor(options: DeviceCodeAuthOptions) {\n if (typeof options?.onDeviceCode !== 'function') {\n throw new ConfigurationError('DeviceCodeAuth requires an onDeviceCode callback');\n }\n if (options.pollingIntervalSeconds !== undefined && options.pollingIntervalSeconds <= 0) {\n throw new ConfigurationError('pollingIntervalSeconds must be greater than 0');\n }\n this.#onDeviceCode = options.onDeviceCode;\n this.#provider = options.provider ?? 'local';\n this.#clientId = options.clientId ?? '';\n this.#pollingIntervalSeconds = options.pollingIntervalSeconds ?? 5;\n this.#signal = options.signal;\n }\n\n get description(): string {\n return 'DeviceCodeAuth';\n }\n\n async authenticate(\n host: string,\n httpClient: HttpClient,\n _storage: StorageProvider,\n ): Promise<TokenSet> {\n const signal = this.#signal;\n throwIfAborted(signal);\n\n const deviceCode = await this.#requestDeviceCode(host, httpClient, signal);\n\n const info: DeviceCodeInfo = {\n verificationUri: deviceCode.verification_uri,\n userCode: deviceCode.user_code,\n verificationUriComplete: deviceCode.verification_uri_complete,\n expiresIn: deviceCode.expires_in,\n interval: deviceCode.interval,\n };\n await this.#onDeviceCode(info);\n\n const accessToken = await this.#poll(host, httpClient, deviceCode, signal);\n return this.#exchangeForUserToken(host, httpClient, accessToken, signal);\n }\n\n async #requestDeviceCode(\n host: string,\n httpClient: HttpClient,\n signal: AbortSignal \| undefined,\n ): Promise<DeviceLoginResponse> {\n const requestOptions = {\n url: `https://${host}/RSTS/oauth2/DeviceLogin`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n client_id: this.#clientId,\n scope: `rsts:sts:primaryproviderid:${this.#provider}`,\n }),\n ...(signal ? { signal } : {}),\n };\n const response = await httpClient.request(requestOptions);\n\n if (response.status !== 200) {\n // The disabled-grant response is HTML, not JSON — substring match only,\n // never JSON.parse this path.\n if (response.body.toLowerCase().includes('device code grant type is not allowed')) {\n throw new ConfigurationError(\n 'Device Code grant is not enabled on this appliance. Enable it under ' +\n 'Settings -> OAuth 2.0 Grant Types (Allowed OAuth2 Grant Types must include DeviceCode).',\n );\n }\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n return JSON.parse(response.body) as DeviceLoginResponse;\n }\n\n async #poll(\n host: string,\n httpClient: HttpClient,\n deviceCode: DeviceLoginResponse,\n signal: AbortSignal \| undefined,\n ): Promise<string> {\n const deadline = Date.now() + deviceCode.expires_in 1000;\n let intervalSeconds = this.#pollingIntervalSeconds;\n\n for (;;) {\n throwIfAborted(signal);\n if (Date.now() >= deadline) {\n throw new SafeguardError('Device code authorization timed out before approval');\n }\n\n await delay(intervalSeconds * 1000, signal);\n throwIfAborted(signal);\n\n const response = await httpClient.request({\n url: `https://${host}/RSTS/oauth2/token`,\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n device_code: deviceCode.device_code,\n client_id: this.#clientId,\n }),\n ...(signal ? { signal } : {}),\n });\n\n const data = JSON.parse(response.body) as TokenPollResponse;\n\n if (response.status === 200 && data.access_token) {\n return data.access_token;\n }\n\n switch (data.error) {\n case 'authorization_pending':\n continue;\n case 'slow_down':\n intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;\n continue;\n case 'access_denied':\n throw new SafeguardError('Device code authorization was denied by the user');\n case 'expired_token':\n throw new SafeguardError('Device code expired before authorization was completed');\n default:\n throw ApiError.fromResponse(response.status, response.body);\n }\n }\n }\n\n async #exchangeForUserToken(\n host: string,\n httpClient: HttpClient,\n stsAccessToken: string,\n signal: AbortSignal \| undefined,\n ): Promise<TokenSet> {\n const response = await httpClient.request({\n url: `https://${host}/service/core/v4/Token/LoginResponse`,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${stsAccessToken}`,\n },\n body: JSON.stringify({ StsAccessToken: stsAccessToken }),\n ...(signal ? { signal } : {}),\n });\n\n if (response.status !== 200) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const userData = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n const tokenSet: TokenSet = {\n accessToken: new SecretValue(userData.UserToken),\n acquiredAt: Date.now(),\n };\n if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n return tokenSet;\n }\n}\n","import { StorageKeys } from '../storage/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport { ConfigurationError } from '../errors.js';\n\nexport interface PkceCallbackResult {\n code: string;\n state: string;\n}\n\n/*\n Parses the PKCE callback URL and stores the authorization code.\n * Call this on the callback/redirect page to complete the PKCE flow.\n \n This is the explicit replacement for the legacy `safeguardJsAccessTokenChecker.js`\n * script that ran as a side-effect on import.\n \n @param storage - StorageProvider to persist the code\n * @param url - The callback URL to parse (defaults to window.location.href)\n * @returns The parsed code and state, or null if not a valid callback\n /\nexport function handlePkceCallback(\n storage: StorageProvider,\n url?: string,\n): PkceCallbackResult \| null {\n const callbackUrl = url ?? (typeof window !== 'undefined' ? window.location.href : '');\n if (!callbackUrl) return null;\n\n const parsed = new URL(callbackUrl);\n const code = parsed.searchParams.get('code');\n const state = parsed.searchParams.get('state');\n\n if (!code \|\| !state) return null;\n\n // Validate state matches what we stored\n const storedState = storage.get(StorageKeys.STATE);\n if (storedState && storedState !== state) {\n throw new ConfigurationError('PKCE state mismatch — possible CSRF attack');\n }\n\n // Store the code for the PkceAuth strategy to pick up\n storage.set('safeguard_auth_code', code);\n\n return { code, state };\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\n\nexport interface TokenAuthOptions {\n /* Pre-existing Safeguard access token. /\n accessToken: string;\n}\n\n/\n Uses a pre-existing access token. No authentication flow — the token is assumed valid.\n * Useful when tokens are obtained externally or for service-to-service scenarios.\n /\nexport class TokenAuth implements Auth {\n readonly #accessToken: SecretValue;\n\n constructor(options: TokenAuthOptions) {\n if (!options.accessToken) throw new ConfigurationError('TokenAuth requires accessToken');\n this.#accessToken = new SecretValue(options.accessToken);\n }\n\n get description(): string {\n return 'TokenAuth(pre-existing)';\n }\n\n async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n return {\n accessToken: this.#accessToken,\n acquiredAt: Date.now(),\n };\n }\n\n // No refresh possible with a pre-existing token\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { SecretValue } from '../secret.js';\n\n/\n Anonymous authentication — no credentials.\n * Used for accessing public Safeguard endpoints (e.g., appliance status).\n /\nexport class AnonymousAuth implements Auth {\n get description(): string {\n return 'AnonymousAuth';\n }\n\n async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n return {\n accessToken: new SecretValue(''),\n acquiredAt: Date.now(),\n };\n }\n}\n","import { Service, HttpMethod } from './types.js';\nimport type { RequestOptions, SafeguardClientOptions } from './types.js';\nimport type { Auth, TokenSet } from './auth/types.js';\nimport type { HttpClient } from './http/types.js';\nimport type { StorageProvider } from './storage/types.js';\nimport { MemoryStorage } from './storage/memory.js';\nimport { buildRequestUrl, validateHost } from './utils.js';\nimport { AuthenticationError, ConfigurationError, ApiError } from './errors.js';\n\nconst DEFAULT_TIMEOUT = 300_000;\nconst DEFAULT_API_VERSION = 'v4';\nconst TOKEN_REFRESH_MARGIN_MS = 60_000; // refresh 60s before expiry\n\n/\n Main entry point for the Safeguard SDK.\n * Instance-based — no global state. Multiple clients to different appliances are supported.\n /\nexport class SafeguardClient {\n readonly #host: string;\n readonly #auth: Auth;\n readonly #apiVersion: string;\n readonly #timeout: number;\n readonly #autoRefresh: boolean;\n readonly #ca: string \| Buffer \| undefined;\n readonly #verify: boolean;\n\n #httpClient: HttpClient \| undefined;\n #storage: StorageProvider;\n #tokenSet: TokenSet \| undefined;\n #connected = false;\n /* Single-flight refresh promise to prevent thundering herd on token expiry. /\n #tokenRefreshPromise: Promise<void> \| undefined;\n\n constructor(host: string, options: SafeguardClientOptions) {\n if (!host) throw new ConfigurationError('SafeguardClient requires a host');\n if (!options.auth) throw new ConfigurationError('SafeguardClient requires an auth strategy');\n this.#host = validateHost(host);\n this.#auth = options.auth;\n this.#apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;\n this.#timeout = options.timeout ?? DEFAULT_TIMEOUT;\n this.#autoRefresh = options.autoRefresh !== false;\n this.#ca = options.ca;\n this.#verify = options.verify !== false;\n this.#storage = new MemoryStorage();\n }\n\n /* The appliance hostname this client connects to. /\n get host(): string {\n return this.#host;\n }\n\n /* The API version prefix (e.g. 'v4'). /\n get apiVersion(): string {\n return this.#apiVersion;\n }\n\n /* Custom CA certificate, if provided. /\n get ca(): string \| Buffer \| undefined {\n return this.#ca;\n }\n\n /* Whether TLS verification is enabled. /\n get verify(): boolean {\n return this.#verify;\n }\n\n /* Whether the client has an active authenticated session. /\n get isConnected(): boolean {\n return this.#connected;\n }\n\n /\n Sets a custom StorageProvider (e.g., BrowserSessionStorage).\n * Must be called before connect().\n /\n setStorage(storage: StorageProvider): this {\n this.#storage = storage;\n return this;\n }\n\n /\n Sets the HttpClient implementation. If not called, must be set before connect().\n * The factory pattern allows platform-specific client injection:\n * - Node: `new NodeHttpClient({ ca, rejectUnauthorized })`\n * - Browser: `new BrowserHttpClient()`\n /\n setHttpClient(httpClient: HttpClient): this {\n this.#httpClient = httpClient;\n return this;\n }\n\n /\n Authenticate and establish a session.\n * @throws {AuthenticationError} if authentication fails\n * @throws {ConfigurationError} if httpClient not set\n /\n async connect(): Promise<void> {\n if (!this.#httpClient) {\n throw new ConfigurationError(\n 'HttpClient not set. Call setHttpClient() before connect(), or use SafeguardClient.createNode() / SafeguardClient.createBrowser().',\n );\n }\n\n this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient, this.#storage);\n if (!this.#tokenSet.accessToken.expose()) {\n throw new AuthenticationError('Authentication returned empty access token');\n }\n this.#connected = true;\n }\n\n /\n Disconnect — dispose HTTP client and clear token.\n /\n async disconnect(): Promise<void> {\n this.#tokenSet = undefined;\n this.#connected = false;\n this.#httpClient?.dispose?.();\n }\n\n /\n Returns seconds until the current access token expires, or -1 if unknown.\n /\n getAccessTokenLifetimeRemaining(): number {\n if (!this.#tokenSet?.expiresIn) return -1;\n const elapsed = (Date.now() - this.#tokenSet.acquiredAt) / 1000;\n return Math.max(0, this.#tokenSet.expiresIn - elapsed);\n }\n\n // ─── Convenience HTTP verbs ─────────────────────────────────────────\n\n async get<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.GET, relativeUrl, options);\n }\n\n async post<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.POST, relativeUrl, options);\n }\n\n async put<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.PUT, relativeUrl, options);\n }\n\n async delete<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.DELETE, relativeUrl, options);\n }\n\n async patch<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n return this.invoke<T>(service, HttpMethod.PATCH, relativeUrl, options);\n }\n\n // ─── Core invoke ────────────────────────────────────────────────────\n\n /\n Low-level request method. Convenience verbs delegate here.\n \n When `options.fullResponse` is true, returns SafeguardResponse<T> with status + headers.\n * Otherwise returns just the parsed response body as T.\n /\n async invoke<T = unknown>(\n service: Service,\n method: HttpMethod,\n relativeUrl: string,\n options?: RequestOptions,\n ): Promise<T> {\n if (!this.#connected \|\| !this.#httpClient) {\n throw new ConfigurationError('Client not connected. Call connect() first.');\n }\n\n // Auto-refresh token if needed\n if (this.#autoRefresh) {\n await this.#ensureValidToken();\n }\n\n const url = buildRequestUrl(this.#host, service, relativeUrl, options?.query, this.#apiVersion);\n const headers: Record<string, string> = {\n Authorization: `Bearer ${this.#tokenSet!.accessToken.expose()}`,\n Accept: 'application/json',\n ...options?.headers,\n };\n\n let body: string \| null = null;\n if (options?.json != null) {\n body = JSON.stringify(options.json);\n headers['Content-Type'] = 'application/json';\n } else if (options?.body != null) {\n body = options.body as string;\n }\n\n const requestOpts: import('./http/types.js').HttpRequestOptions = {\n url,\n method,\n headers,\n body,\n timeout: options?.timeout ?? this.#timeout,\n };\n if (options?.signal) requestOpts.signal = options.signal;\n\n const response = await this.#httpClient.request(requestOpts);\n\n if (response.status >= 400) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n const data = response.body ? (JSON.parse(response.body) as T) : (undefined as T);\n\n if (options?.fullResponse) {\n return { data, status: response.status, headers: response.headers } as unknown as T;\n }\n\n return data;\n }\n\n // ─── Private helpers ────────────────────────────────────────────────\n\n async #ensureValidToken(): Promise<void> {\n if (!this.#tokenSet) return;\n if (!this.#tokenSet.expiresIn) return; // can't determine expiry\n\n const elapsed = Date.now() - this.#tokenSet.acquiredAt;\n const expiresInMs = this.#tokenSet.expiresIn 1000;\n\n if (elapsed + TOKEN_REFRESH_MARGIN_MS < expiresInMs) {\n return; // token still fresh\n }\n\n // Single-flight: if a refresh is already running, all concurrent callers\n // await the same promise so the auth server only sees one exchange and no\n // two callers race the storage provider.\n if (this.#tokenRefreshPromise) {\n await this.#tokenRefreshPromise;\n return;\n }\n\n this.#tokenRefreshPromise = (async (): Promise<void> => {\n if (this.#auth.refreshToken) {\n const refreshed = await this.#auth.refreshToken(this.#host, this.#httpClient!, this.#storage);\n if (refreshed) {\n this.#tokenSet = refreshed;\n return;\n }\n }\n this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient!, this.#storage);\n })();\n\n try {\n await this.#tokenRefreshPromise;\n } finally {\n // Always clear the slot — failures must not be cached, otherwise\n // every subsequent invoke would inherit the same rejection forever.\n this.#tokenRefreshPromise = undefined;\n }\n }\n}\n","/*\n SSH key formats for private key retrieval.\n /\nexport enum SshKeyFormat {\n OpenSsh = 'OpenSsh',\n Ssh2 = 'Ssh2',\n Putty = 'Putty',\n}\n\n/\n An A2A retrievable account as returned by the discovery endpoint.\n /\nexport interface RetrievableAccount {\n AccountId: number;\n AssetId: number;\n AssetName: string;\n AccountName: string;\n DomainName: string;\n AccountType: string;\n ApiKey: string;\n}\n\n/\n Brokered access request types.\n /\nexport enum BrokeredAccessRequestType {\n Password = 'Password',\n SshKey = 'SshKey',\n ApiKey = 'ApiKey',\n Token = 'Token',\n RdpFile = 'RdpFile',\n RemoteDesktop = 'RemoteDesktop',\n SshSession = 'SshSession',\n}\n\n/\n Options for creating a brokered access request.\n /\nexport interface BrokeredAccessRequest {\n AccessType: BrokeredAccessRequestType;\n ForUserId?: number;\n ForUserName?: string;\n AssetId?: number;\n AccountId?: number;\n AccountAssetId?: number;\n AccountName?: string;\n AssetName?: string;\n DomainName?: string;\n}\n\n/\n Response from a brokered access request.\n /\nexport interface BrokeredAccessResponse {\n RequestId: string;\n AccessToken?: string;\n [key: string]: unknown;\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { CertificateAuth } from '../auth/certificate.js';\nimport { SecretValue } from '../secret.js';\nimport { ConfigurationError, ApiError } from '../errors.js';\nimport { SshKeyFormat } from './types.js';\nimport type {\n RetrievableAccount,\n BrokeredAccessRequest,\n BrokeredAccessResponse,\n} from './types.js';\n\nexport interface A2AClientOptions {\n /* Certificate-based auth (A2A always uses client certificates). /\n auth: CertificateAuth;\n /* Custom CA certificate (PEM). /\n ca?: string \| Buffer;\n /* Whether to verify TLS. Default: true. /\n verify?: boolean;\n /* API version string (default: 'v4'). /\n apiVersion?: string;\n}\n\n/\n Application-to-Application client for programmatic credential retrieval.\n * Uses client certificate authentication exclusively.\n \n Full parity with PySafeguard and SafeguardDotNet A2A clients.\n /\nexport class A2AClient {\n readonly #host: string;\n readonly #auth: CertificateAuth;\n readonly #ca: string \| Buffer \| undefined;\n readonly #verify: boolean;\n readonly #apiVersion: string;\n #httpClient: HttpClient \| undefined;\n\n constructor(host: string, options: A2AClientOptions) {\n if (!host) throw new ConfigurationError('A2AClient requires a host');\n if (!options.auth) throw new ConfigurationError('A2AClient requires a CertificateAuth');\n this.#host = host;\n this.#auth = options.auth;\n this.#ca = options.ca;\n this.#verify = options.verify !== false;\n this.#apiVersion = options.apiVersion ?? 'v4';\n }\n\n /* The appliance hostname. /\n get host(): string {\n return this.#host;\n }\n\n /* Custom CA, if set. /\n get ca(): string \| Buffer \| undefined {\n return this.#ca;\n }\n\n /* Whether TLS verification is enabled. /\n get verify(): boolean {\n return this.#verify;\n }\n\n /* The CertificateAuth providing TLS client cert configuration. /\n get auth(): CertificateAuth {\n return this.#auth;\n }\n\n /\n Sets the HttpClient (must be configured with client cert TLS).\n /\n setHttpClient(httpClient: HttpClient): this {\n this.#httpClient = httpClient;\n return this;\n }\n\n /\n Retrieve a password credential via A2A.\n * @param apiKey - The API key for the retrievable account\n /\n async retrievePassword(apiKey: string): Promise<SecretValue> {\n const body = await this.#a2aRequest(apiKey, 'GET', 'Credentials', { type: 'Password' });\n // The appliance returns the credential as a JSON string (e.g. `\"secret\"`);\n // decode it so callers get the raw value, not a quoted string.\n return new SecretValue(JSON.parse(body) as string);\n }\n\n /\n Retrieve an SSH private key credential via A2A.\n * @param apiKey - The API key for the retrievable account\n * @param format - SSH key format (default: OpenSsh)\n /\n async retrievePrivateKey(apiKey: string, format?: SshKeyFormat): Promise<SecretValue> {\n const keyType = format ?? SshKeyFormat.OpenSsh;\n // The A2ACredentialType enum is Password\|PrivateKey\|ApiKey\|File; there is no\n // \"SshKey\" value, so an SSH private key is requested as type=PrivateKey with\n // the desired serialization passed via keyFormat.\n const body = await this.#a2aRequest(apiKey, 'GET', 'Credentials', {\n type: 'PrivateKey',\n keyFormat: keyType,\n });\n return new SecretValue(JSON.parse(body) as string);\n }\n\n /\n Retrieve an API key secret credential via A2A.\n * @param apiKey - The API key for the retrievable account\n /\n async retrieveApiKeySecret(apiKey: string): Promise<SecretValue> {\n const body = await this.#a2aRequest(apiKey, 'GET', 'Credentials', { type: 'ApiKey' });\n return new SecretValue(body);\n }\n\n /\n Get the list of retrievable accounts available to this certificate.\n \n Retrievable accounts live under the Core service and are authorized by the\n * client certificate alone (no per-account API key). Enumerate every A2A\n * registration bound to the certificate, then collect each registration's\n * retrievable accounts.\n /\n async getRetrievableAccounts(): Promise<RetrievableAccount[]> {\n this.#ensureHttpClient();\n const regResponse = await this.#httpClient!.request({\n url: `https://${this.#host}/service/core/${this.#apiVersion}/A2ARegistrations`,\n method: 'GET',\n headers: {\n Accept: 'application/json',\n },\n });\n\n if (regResponse.status !== 200) {\n throw ApiError.fromResponse(regResponse.status, regResponse.body);\n }\n\n const registrations = JSON.parse(regResponse.body) as Array<{ Id: number }>;\n const accounts: RetrievableAccount[] = [];\n for (const reg of registrations) {\n const acctResponse = await this.#httpClient!.request({\n url: `https://${this.#host}/service/core/${this.#apiVersion}/A2ARegistrations/${reg.Id}/RetrievableAccounts`,\n method: 'GET',\n headers: {\n Accept: 'application/json',\n },\n });\n\n if (acctResponse.status !== 200) {\n throw ApiError.fromResponse(acctResponse.status, acctResponse.body);\n }\n\n accounts.push(...(JSON.parse(acctResponse.body) as RetrievableAccount[]));\n }\n\n return accounts;\n }\n\n /\n Set a password on a managed account via A2A.\n * @param apiKey - The API key for the account\n * @param password - The new password value\n /\n async setPassword(apiKey: string, password: string): Promise<void> {\n this.#ensureHttpClient();\n const response = await this.#httpClient!.request({\n url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials/Password`,\n method: 'PUT',\n headers: {\n Authorization: `A2A ${apiKey}`,\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n },\n body: JSON.stringify(password),\n });\n\n if (response.status !== 200 && response.status !== 204) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n }\n\n /\n Set a private key on a managed account via A2A.\n * @param apiKey - The API key for the account\n * @param key - The private key content\n * @param passphrase - Optional passphrase for the key\n * @param format - SSH key format (default: OpenSsh)\n /\n async setPrivateKey(\n apiKey: string,\n key: string,\n passphrase?: string,\n format?: SshKeyFormat,\n ): Promise<void> {\n this.#ensureHttpClient();\n const keyFormat = format ?? SshKeyFormat.OpenSsh;\n // SSH keys are set on the dedicated Credentials/SshKey sub-path (mirroring\n // Credentials/Password), not via a type query param. The body is an\n // AccountSshKey ({ PrivateKey, Passphrase }); it does not accept a KeyFormat\n // property, so the serialization is passed as a query parameter instead.\n const payload: Record<string, string> = { PrivateKey: key };\n if (passphrase) payload['Passphrase'] = passphrase;\n\n const response = await this.#httpClient!.request({\n url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials/SshKey?keyFormat=${keyFormat}`,\n method: 'PUT',\n headers: {\n Authorization: `A2A ${apiKey}`,\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n },\n body: JSON.stringify(payload),\n });\n\n if (response.status !== 200 && response.status !== 204) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n }\n\n /\n Submit a brokered access request via A2A.\n * @param apiKey - The API key for the access request\n * @param request - The access request details\n */\n async brokerAccessRequest(\n apiKey: string,\n request: BrokeredAccessRequest,\n ): Promise<BrokeredAccessResponse> {\n this.#ensureHttpClient();\n const response = await this.#httpClient!.request({\n url: `https://${this.#host}/service/a2a/${this.#apiVersion}/AccessRequests`,\n method: 'POST',\n headers: {\n Authorization: `A2A ${apiKey}`,\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n },\n body: JSON.stringify(request),\n });\n\n if (response.status !== 200 && response.status !== 201) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n return JSON.parse(response.body) as BrokeredAccessResponse;\n }\n\n // ─── Private helpers ────────────────────────────────────────────────\n\n async #a2aRequest(\n apiKey: string,\n method: string,\n endpoint: string,\n queryParams?: Record<string, string>,\n ): Promise<string> {\n this.#ensureHttpClient();\n let url = `https://${this.#host}/service/a2a/${this.#apiVersion}/${endpoint}`;\n if (queryParams) {\n const params = new URLSearchParams(queryParams);\n url += `?${params.toString()}`;\n }\n\n const response = await this.#httpClient!.request({\n url,\n method,\n headers: {\n Authorization: `A2A ${apiKey}`,\n Accept: 'application/json',\n },\n });\n\n if (response.status !== 200) {\n throw ApiError.fromResponse(response.status, response.body);\n }\n\n return response.body;\n }\n\n #ensureHttpClient(): void {\n if (!this.#httpClient) {\n throw new ConfigurationError(\n 'HttpClient not set. Call setHttpClient() with a client configured for mTLS.',\n );\n }\n }\n}\n\nexport { SshKeyFormat, BrokeredAccessRequestType } from './types.js';\nexport type { RetrievableAccount, BrokeredAccessRequest, BrokeredAccessResponse } from './types.js';\n"],"mappings":";;;;;;;;;;;;;;;;;AAGA,IAAY,UAAL,yBAAA,SAAA;CACL,QAAA,UAAA;CACA,QAAA,eAAA;CACA,QAAA,kBAAA;CACA,QAAA,SAAA;CACA,QAAA,WAAA;CACA,QAAA,UAAA;;AACF,EAAA,CAAA,CAAA;;;;AAKA,IAAY,aAAL,yBAAA,YAAA;CACL,WAAA,SAAA;CACA,WAAA,UAAA;CACA,WAAA,SAAA;CACA,WAAA,YAAA;CACA,WAAA,WAAA;;AACF,EAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;ACTA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AASA,IAAa,WAAb,MAAa,iBAAiB,eAAe;CAC3C;CACA;CAEA,YAAY,SAAiB,QAAgB,OAA4B,MAAM,SAAwB;EACrG,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;;;;CAKA,OAAO,aAAa,QAAgB,MAA8C;EAChF,MAAM,SAAS,SAAS,UAAU,IAAI;EACtC,MAAM,UAAU,SAAS,aAAa,QAAQ,MAAM;EAEpD,QAAQ,QAAR;GACE,KAAK,KACH,OAAO,IAAI,oBAAoB,SAAS,MAAM;GAChD,KAAK,KACH,OAAO,IAAI,mBAAmB,SAAS,MAAM;GAC/C,KAAK,KACH,OAAO,IAAI,cAAc,SAAS,MAAM;GAC1C,SACE,OAAO,IAAI,SAAS,SAAS,QAAQ,MAAM;EAC/C;CACF;CAEA,OAAe,UAAU,MAAyD;EAChF,IAAI,SAAS,QAAQ,SAAS,KAAA,GAAW,OAAO;EAChD,IAAI,OAAO,SAAS,UAAU,OAAO;EACrC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,EAAE,SAAS,KAAK;EACzB;CACF;CAEA,OAAe,aAAa,QAAgB,MAAmC;EAC7E,MAAM,aAAa,MAAM,WAAW,MAAM,YAAY;EACtD,IAAI,YACF,OAAO,QAAQ,OAAO,MAAM,EAAE,IAAI;EAEpC,OAAO,QAAQ,OAAO,MAAM;CAC9B;AACF;AAEA,IAAa,sBAAb,cAAyC,SAAS;CAChD,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,SAAS;CAC/C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,SAAS;CAC1C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,eAAe;CACjD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,eAAe;CACrD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;AC5GA,MAAM,WAAW;;;;;;;;;AAUjB,IAAa,cAAb,MAAyB;CACvB;CAEA,YAAY,OAAe;EACzB,KAAK,SAAS;CAChB;;CAGA,SAAiB;EACf,OAAO,KAAK;CACd;CAEA,WAAmB;EACjB,OAAO;CACT;CAEA,SAAiB;EACf,OAAO;CACT;;CAGA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO;CACT;CAEA,KAAK,OAAO,eAAuB;EACjC,OAAO;CACT;AACF;;;;;;;;;AC7BA,SAAgB,aAAa,MAAsB;CACjD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,wBAAwB;CAGhE,IADgB,KAAK,KACX,MAAM,MACd,MAAM,IAAI,mBAAmB,sDAAsD;CAIrF,IAAI,2BAA2B,KAAK,IAAI,GACtC,MAAM,IAAI,mBACR,yFAAyF,KAAK,QAAQ,4BAA4B,EAAE,EAAE,GACxI;CAIF,IAAI,SAAS,KAAK,IAAI,GACpB,MAAM,IAAI,mBACR,6EACF;CAIF,IAAI,QAAQ,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,GAAG,GAC5C,MAAM,IAAI,mBACR,qFACF;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,gBAAgB,MAAc,SAAkB,aAAqB,MAAc;CACjG,IAAI,YAAA,QACF,OAAO,WAAW,KAAK;CAEzB,OAAO,WAAW,KAAK,WAAW,QAAQ,GAAG;AAC/C;;;;;;;;AASA,SAAgB,gBACd,MACA,SACA,aACA,OACA,aAAqB,MACb;CACR,MAAM,OAAO,gBAAgB,MAAM,SAAS,UAAU;CACtD,MAAM,OAAO,YAAY,WAAW,GAAG,IAAI,YAAY,MAAM,CAAC,IAAI;CAClE,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM;CAErC,IAAI,OACF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;CAI3C,OAAO,IAAI,SAAS;AACtB;;;;AAKA,SAAgB,gBAAgB,OAA2B;CACzD,MAAM,SAAS,OAAO,aAAa,GAAG,KAAK;CAC3C,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;;;;AAMA,SAAgB,uBAA+B;CAC7C,MAAM,wBAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,eAAsB,sBAAsB,UAAmC;CAE7E,MAAM,OAAO,IADO,YACD,CAAC,CAAC,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CACzD,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;;;;AAKA,SAAgB,gBAAwB;CACtC,MAAM,wBAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,SAAgB,kBAAkB,KAAiC;CACjE,IAAI;EACF,MAAM,QAAQ,IAAI,MAAM,GAAG;EAC3B,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;EAE/B,MAAM,UAAU,MAAM,EAAE,CAAE,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EAC9D,MAAM,OAAO,KAAK,OAAO;EACzB,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;EAC3C,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,GAAG;CACrC,QAAQ;EACN;CACF;AACF;;;;;;;ACpIA,IAAa,gBAAb,MAAsD;CACpD,yBAAkB,IAAI,IAAoB;CAE1C,IAAI,KAA4B;EAC9B,OAAO,KAAK,OAAO,IAAI,GAAG,KAAK;CACjC;CAEA,IAAI,KAAa,OAAqB;EACpC,KAAK,OAAO,IAAI,KAAK,KAAK;CAC5B;CAEA,OAAO,KAAmB;EACxB,KAAK,OAAO,OAAO,GAAG;CACxB;CAEA,QAAc;EACZ,KAAK,OAAO,MAAM;CACpB;AACF;;;;;;;AClBA,IAAa,wBAAb,MAA8D;CAC5D,IAAI,KAA4B;EAC9B,OAAO,eAAe,QAAQ,GAAG;CACnC;CAEA,IAAI,KAAa,OAAqB;EACpC,eAAe,QAAQ,KAAK,KAAK;CACnC;CAEA,OAAO,KAAmB;EACxB,eAAe,WAAW,GAAG;CAC/B;CAEA,QAAc;EACZ,eAAe,MAAM;CACvB;AACF;;;;ACXA,MAAa,cAAc;CACzB,OAAO;CACP,eAAe;AACjB;;;;;;;;;;;;;;;;;ACeA,SAAgB,yBAAyB,YAA4C;CACnF,MAAM,UAA6B;EACjC,IAAI,YAAY;EAChB,MAAM,YAAY;EAClB,KAAK,YAAY;EACjB,KAAK,YAAY;EACjB,YAAY,YAAY;EACxB,oBAAoB,YAAY,sBAAsB;CACxD;CAEA,MAAM,gBAAgB,QAAQ,YAAY,QAAQ,YAAY,OAAO,YAAY,GAAG;CAEpF,IAAI,YAAY,YAAY,QAAQ,aAAa,WAAW;CAC5D,IAAI,YAAY,YACd,QAAQ,aAAa,WAAW;MAC3B,IAAI,iBAAiB,CAAC,YAAY,YACvC,QAAQ,aAAa;CAGvB,OAAO;AACT;;;;;AAMA,IAAa,iBAAb,MAAkD;CAChD;CAEA,YAAY,YAAyB;EACnC,MAAM,gBAAgB,QACpB,YAAY,QAAQ,YAAY,OAAO,YAAY,GACrD;EACA,KAAK,SAAS,IAAI,MAAM;GACtB,SAAS,yBAAyB,UAAU;GAO5C,GAAI,gBAAgB,EAAE,SAAS,MAAM,IAAI,CAAC;EAC5C,CAAC;CACH;CAEA,MAAM,QAAQ,SAAoD;EAChE,MAAM,EAAE,KAAK,QAAQ,SAAS,MAAM,QAAQ,YAAY;EAExD,MAAM,iBAAsD;GAClD;GACR,YAAY,KAAK;EACnB;EAEA,IAAI,SAAS,eAAe,UAAU;EACtC,IAAI,QAAQ,MAAM,eAAe,OAAO;EACxC,IAAI,QAAQ,eAAe,SAAS;EACpC,IAAI,SAAS;GACX,eAAe,cAAc;GAC7B,eAAe,iBAAiB;EAClC;EAEA,MAAM,WAAW,MAAMA,QAAc,KAAK,cAAc;EAExD,MAAM,kBAA0C,CAAC;EACjD,MAAM,aAAa,SAAS;EAC5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GACZ,gBAAgB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;EAIrE,MAAM,eAAe,MAAM,SAAS,KAAK,KAAK;EAE9C,OAAO;GACL,QAAQ,SAAS;GACjB,SAAS;GACT,MAAM;EACR;CACF;CAEA,UAAgB;EACd,KAAK,OAAO,MAAM,CAAC,CAAC,YAAY,CAAoC,CAAC;CACvE;AACF;;;;;;;AC1GA,IAAa,oBAAb,MAAqD;CACnD;CAEA,YAAY,SAAgD;EAC1D,KAAK,eAAe,SAAS,eAAe;CAC9C;CAEA,MAAM,QAAQ,SAAoD;EAChE,MAAM,EAAE,KAAK,QAAQ,SAAS,MAAM,QAAQ,YAAY;EAExD,MAAM,cAA2B;GAC/B;GACA,aAAa,KAAK;EACpB;EAEA,IAAI,SAAS,YAAY,UAAU;EACnC,IAAI,QAAQ,MAAM,YAAY,OAAO;EACrC,IAAI,UAAU,SAAS;GACrB,MAAM,aAAa,IAAI,gBAAgB;GACvC,IAAI;GAEJ,IAAI,SACF,YAAY,iBAAiB,WAAW,sBAAM,IAAI,MAAM,mBAAmB,CAAC,GAAG,OAAO;GAGxF,YAAY,SAAS,SACjB,YAAY,IAAI,CAAC,QAAQ,WAAW,MAAM,CAAC,IAC3C,WAAW;GAEf,IAAI;IACF,OAAO,MAAM,KAAK,SAAS,KAAK,WAAW;GAC7C,UAAU;IACR,IAAI,cAAc,KAAA,GAAW,aAAa,SAAS;GACrD;EACF;EAEA,OAAO,KAAK,SAAS,KAAK,WAAW;CACvC;CAEA,MAAM,SAAS,KAAa,MAA0C;EACpE,MAAM,WAAW,MAAM,MAAM,KAAK,IAAI;EAEtC,MAAM,kBAA0C,CAAC;EACjD,SAAS,QAAQ,SAAS,OAAO,QAAQ;GACvC,gBAAgB,OAAO;EACzB,CAAC;EAED,MAAM,eAAe,MAAM,SAAS,KAAK;EAEzC,OAAO;GACL,QAAQ,SAAS;GACjB,SAAS;GACT,MAAM;EACR;CACF;AACF;;;;;;AC5CA,IAAa,eAAb,MAA0C;CACxC;CACA;CACA;CAEA,YAAY,SAA8B;EACxC,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,KAAK,YAAY,QAAQ;EACzB,KAAK,YAAY,IAAI,YAAY,QAAQ,QAAQ;EACjD,KAAK,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,gBAAgB,KAAK,UAAU,GAAG,KAAK,UAAU;CAC1D;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EAErG,MAAM,YAAY,MAAM,KAAK,cAAc,MAAM,UAAU;EAK3D,OAAO,MAFiB,KAAK,sBAAsB,MAAM,YAAY,SAAS;CAGhF;CAEA,MAAM,aAAa,MAAc,YAAwB,SAAoD;EAE3G,OAAO,KAAK,aAAa,MAAM,YAAY,OAAO;CACpD;CAEA,MAAM,cAAc,MAAc,YAAyC;EACzE,MAAM,OAAO,KAAK,UAAU;GAC1B,YAAY;GACZ,UAAU,KAAK;GACf,UAAU,KAAK,UAAU,OAAO;GAChC,OAAO,gCAAgC,KAAK,UAAU,YAAY;EACpE,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAGA,OADa,KAAK,MAAM,SAAS,IACvB,CAAC,CAAC;CACd;CAEA,MAAM,sBAAsB,MAAc,YAAwB,WAAsC;EACtG,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,UAAU,CAAC;EACpD,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,KAAK,SAAS;GAC3C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,KAAK,aAAa,MACpB,SAAS,YAAY,KAAK;OACrB;GACL,MAAM,YAAY,kBAAkB,KAAK,SAAS;GAClD,IAAI,aAAa,MAAM,SAAS,YAAY;EAC9C;EACA,OAAO;CACT;AACF;;;;;;;ACzEA,IAAa,kBAAb,MAA6C;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAiC;EAC3C,MAAM,SAAS,QAAQ,OAAO,QAAQ;EACtC,MAAM,UAAU,QAAQ,QAAQ,QAAQ;EACxC,MAAM,SAAS,QAAQ,OAAO,QAAQ;EACtC,IAAI,CAAC,UAAU,CAAC,SAAS,MAAM,IAAI,mBAAmB,uDAAuD;EAC7G,IAAI,CAAC,UAAU,CAAC,QAAQ,MAAM,IAAI,mBAAmB,yCAAyC;EAC9F,KAAK,YAAY,QAAQ;EACzB,KAAK,WAAW,QAAQ;EACxB,KAAK,QAAQ,QAAQ;EACrB,KAAK,OAAO,QAAQ;EACpB,KAAK,WAAW,QAAQ;EACxB,KAAK,OAAO,QAAQ;EACpB,KAAK,cAAc,QAAQ,aAAa,IAAI,YAAY,QAAQ,UAAU,IAAI,KAAA;EAC9E,KAAK,YAAY,QAAQ,YAAY;CACvC;CAEA,IAAI,cAAsB;EACxB,OAAO,mBAAmB,KAAK,UAAU;CAC3C;;CAGA,gBAA+G;EAC7G,MAAM,OAAsG,CAAC;EAC7G,IAAI,KAAK,QAAQ,KAAK,UACpB,KAAK,MAAM,KAAK,QAAQ,KAAK;OACxB;GACL,KAAK,OAAO,KAAK,SAAS,KAAK;GAC/B,KAAK,MAAM,KAAK,QAAQ,KAAK;EAC/B;EACA,IAAI,KAAK,aAAa,KAAK,aAAa,KAAK,YAAY,OAAO;EAChE,OAAO;CACT;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EAErG,MAAM,YAAY,MAAM,KAAK,cAAc,MAAM,UAAU;EAG3D,OAAO,KAAK,sBAAsB,MAAM,YAAY,SAAS;CAC/D;CAEA,MAAM,aAAa,MAAc,YAAwB,SAAoD;EAC3G,OAAO,KAAK,aAAa,MAAM,YAAY,OAAO;CACpD;CAEA,MAAM,cAAc,MAAc,YAAyC;EACzE,MAAM,OAAO,KAAK,UAAU;GAC1B,YAAY;GACZ,OAAO,gCAAgC,KAAK,UAAU,YAAY;EACpE,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAGA,OADa,KAAK,MAAM,SAAS,IACvB,CAAC,CAAC;CACd;CAEA,MAAM,sBAAsB,MAAc,YAAwB,WAAsC;EACtG,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,UAAU,CAAC;EACpD,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,KAAK,SAAS;GAC3C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,KAAK,aAAa,MACpB,SAAS,YAAY,KAAK;OACrB;GACL,MAAM,YAAY,kBAAkB,KAAK,SAAS;GAClD,IAAI,aAAa,MAAM,SAAS,YAAY;EAC9C;EACA,OAAO;CACT;AACF;;;;;;;ACrHA,IAAa,WAAb,MAAsC;CACpC;CACA;CAEA,YAAY,SAA0B;EACpC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,+BAA+B;EACtF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,4BAA4B;EAChF,KAAK,eAAe,QAAQ;EAC5B,KAAK,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,iBAAiB,KAAK,aAAa;CAC5C;;;;;CAMA,MAAM,aAAa,MAAc,YAAwB,SAA6C;EAEpG,MAAM,OAAO,QAAQ,IAAI,qBAAqB;EAC9C,IAAI,MAAM;GACR,MAAM,WAAW,QAAQ,IAAI,YAAY,aAAa;GACtD,IAAI,CAAC,UACH,MAAM,IAAI,mBAAmB,yCAAyC;GAExE,QAAQ,OAAO,qBAAqB;GACpC,QAAQ,OAAO,YAAY,aAAa;GACxC,QAAQ,OAAO,YAAY,KAAK;GAChC,OAAO,KAAK,cAAc,MAAM,YAAY,MAAM,QAAQ;EAC5D;EAGA,MAAM,KAAK,kBAAkB,MAAM,OAAO;EAI1C,MAAM,IAAI,mBACR,0EACF;CACF;CAEA,MAAM,kBAAkB,MAAc,SAAyC;EAC7E,MAAM,WAAW,qBAAqB;EACtC,MAAM,YAAY,MAAM,sBAAsB,QAAQ;EACtD,MAAM,QAAQ,cAAc;EAE5B,QAAQ,IAAI,YAAY,eAAe,QAAQ;EAC/C,QAAQ,IAAI,YAAY,OAAO,KAAK;EAYpC,MAAM,UAAU,WAAW,KAAK,cAAc,IAV3B,gBAAgB;GACjC,eAAe;GACf,WAAW;GACX,cAAc,KAAK;GACnB,OAAO,gCAAgC,KAAK;GAC5C,gBAAgB;GAChB,uBAAuB;GACvB;EACF,CAEmD,CAAC,CAAC,SAAS;EAG9D,IAAI,OAAO,WAAW,eAAe,OAAO,UAC1C,OAAO,SAAS,OAAO;CAE3B;CAEA,MAAM,cACJ,MACA,YACA,MACA,UACmB;EACnB,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ;GACA,cAAc,KAAK;GACnB,WAAW;GACX,eAAe;EACjB,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EAGrC,MAAM,oBAAoB,MAAM,WAAW,QAAQ;GACjD,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,KAAK;GAChC;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,KAAK,aAAa,CAAC;EAC5D,CAAC;EAED,IAAI,kBAAkB,WAAW,KAAK;GACpC,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,kBAAkB,QAAQ,kBAAkB,IAAI;EAC9E;EAEA,MAAM,WAAW,KAAK,MAAM,kBAAkB,IAAI;EAClD,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAI9D,OAAO;CACT;AACF;;;;;;;;;;AC1HA,IAAa,yBAAb,MAAoD;CAClD;CACA;CAEA,YAAY,SAAyC;EACnD,KAAK,YAAY,SAAS,YAAY;EACtC,KAAK,gBAAgB,SAAS,gBAAgB;CAChD;CAEA,IAAI,cAAsB;EACxB,OAAO,+BAA+B,OAAO,KAAK,aAAa,EAAE;CACnE;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EACrG,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,MAAM,EAAE,SAAS,MAAM,OAAO;EAE9B,MAAM,WAAW,qBAAqB;EACtC,MAAM,YAAY,MAAM,sBAAsB,QAAQ;EACtD,MAAM,QAAQ,cAAc;EAC5B,MAAM,cAAc,oBAAoB,OAAO,KAAK,aAAa,EAAE;EAMnE,MAAM,SAAS,aAAa;EAC5B,OAAO,OAAO,KAAK,eAAe,WAAW;EAY7C,MAAM,UAAU,WAAW,KAAK,cAAc,IAV3B,gBAAgB;GACjC,eAAe;GACf,WAAW;GACX,cAAc;GACd,OAAO,gCAAgC,KAAK;GAC5C,gBAAgB;GAChB,uBAAuB;GACvB;EACF,CAEmD,CAAC,CAAC,SAAS;EAG9D,MAAM,KAAK,aAAa,OAAO;EAG/B,MAAM,OAAO,MAAM,IAAI,SAAiB,SAAS,WAAW;GAC1D,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM;IACb,OAAO,IAAI,mBAAmB,2CAA2C,CAAC;GAC5E,GAAG,IAAO;GAEV,OAAO,GAAG,YAAY,KAAK,QAAQ;IACjC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,OAAO,KAAK,aAAa,GAAG;IACpF,IAAI,IAAI,aAAa,aAAa;KAChC,MAAM,eAAe,IAAI,aAAa,IAAI,MAAM;KAGhD,IAFsB,IAAI,aAAa,IAAI,OAE3B,MAAM,OAAO;MAC3B,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;MACnD,IAAI,IAAI,gBAAgB;MACxB,aAAa,OAAO;MACpB,OAAO,MAAM;MACb,OAAO,IAAI,mBAAmB,qBAAqB,CAAC;MACpD;KACF;KAEA,IAAI,CAAC,cAAc;MACjB,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;MACnD,IAAI,IAAI,gCAAgC;MACxC,aAAa,OAAO;MACpB,OAAO,MAAM;MACb,OAAO,IAAI,mBAAmB,mCAAmC,CAAC;MAClE;KACF;KAEA,IAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;KAClD,IAAI,IAAI,gGAAgG;KACxG,aAAa,OAAO;KACpB,OAAO,MAAM;KACb,QAAQ,YAAY;IACtB;GACF,CAAC;GAED,KAAK,QAAQ,OAAO,CAAC,CAAC,MAAM,CAAC,SAAS;IACpC,aAAa,OAAO;IACpB,OAAO,GAAY;GACrB,CAAC,CAAC,CAAC,MAAM,MAAM;EACjB,CAAC;EAGD,OAAO,KAAK,cAAc,MAAM,YAAY,MAAM,UAAU,WAAW;CACzE;CAEA,MAAM,cACJ,MACA,YACA,MACA,UACA,aACmB;EACnB,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ;GACA,cAAc;GACd,WAAW;GACX,eAAe;EACjB,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EAGrC,MAAM,eAAe,MAAM,WAAW,QAAQ;GAC5C,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,KAAK;GAChC;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,KAAK,aAAa,CAAC;EAC5D,CAAC;EAED,IAAI,aAAa,WAAW,KAAK;GAC/B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,aAAa,QAAQ,aAAa,IAAI;EACpE;EAEA,MAAM,WAAW,KAAK,MAAM,aAAa,IAAI;EAC7C,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAC9D,OAAO;CACT;CAEA,MAAM,aAAa,KAA4B;EAC7C,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,EAAE,aAAa,MAAM,OAAO;EAGlC,IAAI,SAAS,MAAM,SACjB,SAAS,OAAO;GAAC;GAAM;GAAS;GAAI;EAAG,CAAC;OACnC,IAAI,SAAS,MAAM,UACxB,SAAS,QAAQ,CAAC,GAAG,CAAC;OAEtB,SAAS,YAAY,CAAC,GAAG,CAAC;CAE9B;AACF;;;;ACvIA,MAAM,8BAA8B;;AAiBpC,IAAM,aAAN,cAAyB,MAAM;CAC7B,YAAY,UAAU,6BAA6B;EACjD,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;AAGA,SAAS,eAAe,QAA4B;CAClD,IAAI,QAAQ,SAAS,MAAM,IAAI,WAAW;AAC5C;;AAGA,SAAS,MAAM,IAAY,QAAqC;CAC9D,OAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,IAAI,QAAQ,SAAS;GACnB,OAAO,IAAI,WAAW,CAAC;GACvB;EACF;EACA,MAAM,gBAAsB;GAC1B,aAAa,KAAK;GAClB,OAAO,IAAI,WAAW,CAAC;EACzB;EACA,MAAM,QAAQ,iBAAiB;GAC7B,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EACL,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;;;;;;;;;;AAWA,IAAa,iBAAb,MAA4C;CAC1C;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAgC;EAC1C,IAAI,OAAO,SAAS,iBAAiB,YACnC,MAAM,IAAI,mBAAmB,kDAAkD;EAEjF,IAAI,QAAQ,2BAA2B,KAAA,KAAa,QAAQ,0BAA0B,GACpF,MAAM,IAAI,mBAAmB,+CAA+C;EAE9E,KAAK,gBAAgB,QAAQ;EAC7B,KAAK,YAAY,QAAQ,YAAY;EACrC,KAAK,YAAY,QAAQ,YAAY;EACrC,KAAK,0BAA0B,QAAQ,0BAA0B;EACjE,KAAK,UAAU,QAAQ;CACzB;CAEA,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aACJ,MACA,YACA,UACmB;EACnB,MAAM,SAAS,KAAK;EACpB,eAAe,MAAM;EAErB,MAAM,aAAa,MAAM,KAAK,mBAAmB,MAAM,YAAY,MAAM;EAEzE,MAAM,OAAuB;GAC3B,iBAAiB,WAAW;GAC5B,UAAU,WAAW;GACrB,yBAAyB,WAAW;GACpC,WAAW,WAAW;GACtB,UAAU,WAAW;EACvB;EACA,MAAM,KAAK,cAAc,IAAI;EAE7B,MAAM,cAAc,MAAM,KAAK,MAAM,MAAM,YAAY,YAAY,MAAM;EACzE,OAAO,KAAK,sBAAsB,MAAM,YAAY,aAAa,MAAM;CACzE;CAEA,MAAM,mBACJ,MACA,YACA,QAC8B;EAC9B,MAAM,iBAAiB;GACrB,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IACnB,WAAW,KAAK;IAChB,OAAO,8BAA8B,KAAK;GAC5C,CAAC;GACD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B;EACA,MAAM,WAAW,MAAM,WAAW,QAAQ,cAAc;EAExD,IAAI,SAAS,WAAW,KAAK;GAG3B,IAAI,SAAS,KAAK,YAAY,CAAC,CAAC,SAAS,uCAAuC,GAC9E,MAAM,IAAI,mBACR,6JAEF;GAEF,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,OAAO,KAAK,MAAM,SAAS,IAAI;CACjC;CAEA,MAAM,MACJ,MACA,YACA,YACA,QACiB;EACjB,MAAM,WAAW,KAAK,IAAI,IAAI,WAAW,aAAa;EACtD,IAAI,kBAAkB,KAAK;EAE3B,SAAS;GACP,eAAe,MAAM;GACrB,IAAI,KAAK,IAAI,KAAK,UAChB,MAAM,IAAI,eAAe,qDAAqD;GAGhF,MAAM,MAAM,kBAAkB,KAAM,MAAM;GAC1C,eAAe,MAAM;GAErB,MAAM,WAAW,MAAM,WAAW,QAAQ;IACxC,KAAK,WAAW,KAAK;IACrB,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM,KAAK,UAAU;KACnB,YAAY;KACZ,aAAa,WAAW;KACxB,WAAW,KAAK;IAClB,CAAC;IACD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC7B,CAAC;GAED,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;GAErC,IAAI,SAAS,WAAW,OAAO,KAAK,cAClC,OAAO,KAAK;GAGd,QAAQ,KAAK,OAAb;IACE,KAAK,yBACH;IACF,KAAK;KACH,mBAAmB;KACnB;IACF,KAAK,iBACH,MAAM,IAAI,eAAe,kDAAkD;IAC7E,KAAK,iBACH,MAAM,IAAI,eAAe,wDAAwD;IACnF,SACE,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;GAC9D;EACF;CACF;CAEA,MAAM,sBACJ,MACA,YACA,gBACA,QACmB;EACnB,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,eAAe,CAAC;GACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,CAAC;EAED,IAAI,SAAS,WAAW,KACtB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,MAAM,WAAW,KAAK,MAAM,SAAS,IAAI;EACzC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAC9D,OAAO;CACT;AACF;;;;;;;;;;;;;;ACpPA,SAAgB,mBACd,SACA,KAC2B;CAC3B,MAAM,cAAc,QAAQ,OAAO,WAAW,cAAc,OAAO,SAAS,OAAO;CACnF,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,MAAM,OAAO,OAAO,aAAa,IAAI,MAAM;CAC3C,MAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;CAE7C,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO;CAG5B,MAAM,cAAc,QAAQ,IAAI,YAAY,KAAK;CACjD,IAAI,eAAe,gBAAgB,OACjC,MAAM,IAAI,mBAAmB,4CAA4C;CAI3E,QAAQ,IAAI,uBAAuB,IAAI;CAEvC,OAAO;EAAE;EAAM;CAAM;AACvB;;;;;;;AC5BA,IAAa,YAAb,MAAuC;CACrC;CAEA,YAAY,SAA2B;EACrC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,gCAAgC;EACvF,KAAK,eAAe,IAAI,YAAY,QAAQ,WAAW;CACzD;CAEA,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,KAAK;GAClB,YAAY,KAAK,IAAI;EACvB;CACF;AAGF;;;;;;;AC1BA,IAAa,gBAAb,MAA2C;CACzC,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,IAAI,YAAY,EAAE;GAC/B,YAAY,KAAK,IAAI;EACvB;CACF;AACF;;;ACXA,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;;;;;AAMhC,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,aAAa;;CAEb;CAEA,YAAY,MAAc,SAAiC;EACzD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,iCAAiC;EACzE,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI,mBAAmB,2CAA2C;EAC3F,KAAK,QAAQ,aAAa,IAAI;EAC9B,KAAK,QAAQ,QAAQ;EACrB,KAAK,cAAc,QAAQ,cAAc;EACzC,KAAK,WAAW,QAAQ,WAAW;EACnC,KAAK,eAAe,QAAQ,gBAAgB;EAC5C,KAAK,MAAM,QAAQ;EACnB,KAAK,UAAU,QAAQ,WAAW;EAClC,KAAK,WAAW,IAAI,cAAc;CACpC;;CAGA,IAAI,OAAe;EACjB,OAAO,KAAK;CACd;;CAGA,IAAI,aAAqB;EACvB,OAAO,KAAK;CACd;;CAGA,IAAI,KAAkC;EACpC,OAAO,KAAK;CACd;;CAGA,IAAI,SAAkB;EACpB,OAAO,KAAK;CACd;;CAGA,IAAI,cAAuB;EACzB,OAAO,KAAK;CACd;;;;;CAMA,WAAW,SAAgC;EACzC,KAAK,WAAW;EAChB,OAAO;CACT;;;;;;;CAQA,cAAc,YAA8B;EAC1C,KAAK,cAAc;EACnB,OAAO;CACT;;;;;;CAOA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAK,aACR,MAAM,IAAI,mBACR,mIACF;EAGF,KAAK,YAAY,MAAM,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,aAAa,KAAK,QAAQ;EAC1F,IAAI,CAAC,KAAK,UAAU,YAAY,OAAO,GACrC,MAAM,IAAI,oBAAoB,4CAA4C;EAE5E,KAAK,aAAa;CACpB;;;;CAKA,MAAM,aAA4B;EAChC,KAAK,YAAY,KAAA;EACjB,KAAK,aAAa;EAClB,KAAK,aAAa,UAAU;CAC9B;;;;CAKA,kCAA0C;EACxC,IAAI,CAAC,KAAK,WAAW,WAAW,OAAO;EACvC,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,UAAU,cAAc;EAC3D,OAAO,KAAK,IAAI,GAAG,KAAK,UAAU,YAAY,OAAO;CACvD;CAIA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,KAAkB,SAAkB,aAAqB,SAAsC;EACnG,OAAO,KAAK,OAAU,SAAA,QAA0B,aAAa,OAAO;CACtE;CAEA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,OAAoB,SAAkB,aAAqB,SAAsC;EACrG,OAAO,KAAK,OAAU,SAAA,UAA4B,aAAa,OAAO;CACxE;CAEA,MAAM,MAAmB,SAAkB,aAAqB,SAAsC;EACpG,OAAO,KAAK,OAAU,SAAA,SAA2B,aAAa,OAAO;CACvE;;;;;;;CAUA,MAAM,OACJ,SACA,QACA,aACA,SACY;EACZ,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,aAC5B,MAAM,IAAI,mBAAmB,6CAA6C;EAI5E,IAAI,KAAK,cACP,MAAM,KAAK,kBAAkB;EAG/B,MAAM,MAAM,gBAAgB,KAAK,OAAO,SAAS,aAAa,SAAS,OAAO,KAAK,WAAW;EAC9F,MAAM,UAAkC;GACtC,eAAe,UAAU,KAAK,UAAW,YAAY,OAAO;GAC5D,QAAQ;GACR,GAAG,SAAS;EACd;EAEA,IAAI,OAAsB;EAC1B,IAAI,SAAS,QAAQ,MAAM;GACzB,OAAO,KAAK,UAAU,QAAQ,IAAI;GAClC,QAAQ,kBAAkB;EAC5B,OAAO,IAAI,SAAS,QAAQ,MAC1B,OAAO,QAAQ;EAGjB,MAAM,cAA4D;GAChE;GACA;GACA;GACA;GACA,SAAS,SAAS,WAAW,KAAK;EACpC;EACA,IAAI,SAAS,QAAQ,YAAY,SAAS,QAAQ;EAElD,MAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAW;EAE3D,IAAI,SAAS,UAAU,KACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,MAAM,OAAO,SAAS,OAAQ,KAAK,MAAM,SAAS,IAAI,IAAW,KAAA;EAEjE,IAAI,SAAS,cACX,OAAO;GAAE;GAAM,QAAQ,SAAS;GAAQ,SAAS,SAAS;EAAQ;EAGpE,OAAO;CACT;CAIA,MAAM,oBAAmC;EACvC,IAAI,CAAC,KAAK,WAAW;EACrB,IAAI,CAAC,KAAK,UAAU,WAAW;EAE/B,MAAM,UAAU,KAAK,IAAI,IAAI,KAAK,UAAU;EAC5C,MAAM,cAAc,KAAK,UAAU,YAAY;EAE/C,IAAI,UAAU,0BAA0B,aACtC;EAMF,IAAI,KAAK,sBAAsB;GAC7B,MAAM,KAAK;GACX;EACF;EAEA,KAAK,wBAAwB,YAA2B;GACtD,IAAI,KAAK,MAAM,cAAc;IAC3B,MAAM,YAAY,MAAM,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,aAAc,KAAK,QAAQ;IAC5F,IAAI,WAAW;KACb,KAAK,YAAY;KACjB;IACF;GACF;GACA,KAAK,YAAY,MAAM,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,aAAc,KAAK,QAAQ;EAC7F,EAAA,CAAG;EAEH,IAAI;GACF,MAAM,KAAK;EACb,UAAU;GAGR,KAAK,uBAAuB,KAAA;EAC9B;CACF;AACF;;;;;;ACzPA,IAAY,eAAL,yBAAA,cAAA;CACL,aAAA,aAAA;CACA,aAAA,UAAA;CACA,aAAA,WAAA;;AACF,EAAA,CAAA,CAAA;;;;AAkBA,IAAY,4BAAL,yBAAA,2BAAA;CACL,0BAAA,cAAA;CACA,0BAAA,YAAA;CACA,0BAAA,YAAA;CACA,0BAAA,WAAA;CACA,0BAAA,aAAA;CACA,0BAAA,mBAAA;CACA,0BAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;;;;;;;;;ACLA,IAAa,YAAb,MAAuB;CACrB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,MAAc,SAA2B;EACnD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,2BAA2B;EACnE,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI,mBAAmB,sCAAsC;EACtF,KAAK,QAAQ;EACb,KAAK,QAAQ,QAAQ;EACrB,KAAK,MAAM,QAAQ;EACnB,KAAK,UAAU,QAAQ,WAAW;EAClC,KAAK,cAAc,QAAQ,cAAc;CAC3C;;CAGA,IAAI,OAAe;EACjB,OAAO,KAAK;CACd;;CAGA,IAAI,KAAkC;EACpC,OAAO,KAAK;CACd;;CAGA,IAAI,SAAkB;EACpB,OAAO,KAAK;CACd;;CAGA,IAAI,OAAwB;EAC1B,OAAO,KAAK;CACd;;;;CAKA,cAAc,YAA8B;EAC1C,KAAK,cAAc;EACnB,OAAO;CACT;;;;;CAMA,MAAM,iBAAiB,QAAsC;EAC3D,MAAM,OAAO,MAAM,KAAK,YAAY,QAAQ,OAAO,eAAe,EAAE,MAAM,WAAW,CAAC;EAGtF,OAAO,IAAI,YAAY,KAAK,MAAM,IAAI,CAAW;CACnD;;;;;;CAOA,MAAM,mBAAmB,QAAgB,QAA6C;EACpF,MAAM,UAAU,UAAA;EAIhB,MAAM,OAAO,MAAM,KAAK,YAAY,QAAQ,OAAO,eAAe;GAChE,MAAM;GACN,WAAW;EACb,CAAC;EACD,OAAO,IAAI,YAAY,KAAK,MAAM,IAAI,CAAW;CACnD;;;;;CAMA,MAAM,qBAAqB,QAAsC;EAE/D,OAAO,IAAI,YAAY,MADJ,KAAK,YAAY,QAAQ,OAAO,eAAe,EAAE,MAAM,SAAS,CAAC,CACzD;CAC7B;;;;;;;;;CAUA,MAAM,yBAAwD;EAC5D,KAAK,kBAAkB;EACvB,MAAM,cAAc,MAAM,KAAK,YAAa,QAAQ;GAClD,KAAK,WAAW,KAAK,MAAM,gBAAgB,KAAK,YAAY;GAC5D,QAAQ;GACR,SAAS,EACP,QAAQ,mBACV;EACF,CAAC;EAED,IAAI,YAAY,WAAW,KACzB,MAAM,SAAS,aAAa,YAAY,QAAQ,YAAY,IAAI;EAGlE,MAAM,gBAAgB,KAAK,MAAM,YAAY,IAAI;EACjD,MAAM,WAAiC,CAAC;EACxC,KAAK,MAAM,OAAO,eAAe;GAC/B,MAAM,eAAe,MAAM,KAAK,YAAa,QAAQ;IACnD,KAAK,WAAW,KAAK,MAAM,gBAAgB,KAAK,YAAY,oBAAoB,IAAI,GAAG;IACvF,QAAQ;IACR,SAAS,EACP,QAAQ,mBACV;GACF,CAAC;GAED,IAAI,aAAa,WAAW,KAC1B,MAAM,SAAS,aAAa,aAAa,QAAQ,aAAa,IAAI;GAGpE,SAAS,KAAK,GAAI,KAAK,MAAM,aAAa,IAAI,CAA0B;EAC1E;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,YAAY,QAAgB,UAAiC;EACjE,KAAK,kBAAkB;EACvB,MAAM,WAAW,MAAM,KAAK,YAAa,QAAQ;GAC/C,KAAK,WAAW,KAAK,MAAM,eAAe,KAAK,YAAY;GAC3D,QAAQ;GACR,SAAS;IACP,eAAe,OAAO;IACtB,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM,KAAK,UAAU,QAAQ;EAC/B,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;CAE9D;;;;;;;;CASA,MAAM,cACJ,QACA,KACA,YACA,QACe;EACf,KAAK,kBAAkB;EACvB,MAAM,YAAY,UAAA;EAKlB,MAAM,UAAkC,EAAE,YAAY,IAAI;EAC1D,IAAI,YAAY,QAAQ,gBAAgB;EAExC,MAAM,WAAW,MAAM,KAAK,YAAa,QAAQ;GAC/C,KAAK,WAAW,KAAK,MAAM,eAAe,KAAK,YAAY,gCAAgC;GAC3F,QAAQ;GACR,SAAS;IACP,eAAe,OAAO;IACtB,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;CAE9D;;;;;;CAOA,MAAM,oBACJ,QACA,SACiC;EACjC,KAAK,kBAAkB;EACvB,MAAM,WAAW,MAAM,KAAK,YAAa,QAAQ;GAC/C,KAAK,WAAW,KAAK,MAAM,eAAe,KAAK,YAAY;GAC3D,QAAQ;GACR,SAAS;IACP,eAAe,OAAO;IACtB,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,OAAO,KAAK,MAAM,SAAS,IAAI;CACjC;CAIA,MAAM,YACJ,QACA,QACA,UACA,aACiB;EACjB,KAAK,kBAAkB;EACvB,IAAI,MAAM,WAAW,KAAK,MAAM,eAAe,KAAK,YAAY,GAAG;EACnE,IAAI,aAAa;GACf,MAAM,SAAS,IAAI,gBAAgB,WAAW;GAC9C,OAAO,IAAI,OAAO,SAAS;EAC7B;EAEA,MAAM,WAAW,MAAM,KAAK,YAAa,QAAQ;GAC/C;GACA;GACA,SAAS;IACP,eAAe,OAAO;IACtB,QAAQ;GACV;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KACtB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,OAAO,SAAS;CAClB;CAEA,oBAA0B;EACxB,IAAI,CAAC,KAAK,aACR,MAAM,IAAI,mBACR,6EACF;CAEJ;AACF"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@oneidentity/safeguard",
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "One Identity Safeguard JavaScript/TypeScript SDK",
   "type": "module",
   "exports": {