@oneunit/auth 2.0.0

package/dist/auth.js

@@ -0,0 +1,560 @@
+import { ConfigurationError, ProviderError, UnauthorizedError, ValidationError } from "./errors.js";
+import { decode, encode, encodeAccessToken, encodeRefreshToken } from "./jwt.js";
+import { RBAC } from "./rbac.js";
+import { OAuth } from "./oauth.js";
+import { hashPassword, verifyPassword, needsRehash } from "./password.js";
+import { extractBearerToken, getHeader, isPlainObject, parseCookieHeader, parseExpiresIn, parseQueryString, randomToken, sha256, unique, } from "./utils.js";
+const DEFAULT_ACCESS_TTL = "15m";
+const DEFAULT_REFRESH_TTL = "7d";
+/**
+ * Claims that define *who* the token speaks for and *what* it may do. These are
+ * derived from the authenticated user record and RBAC, so nothing a caller
+ * supplies may overwrite them: a token minted for user 42 must never carry
+ * `sub: "admin"`.
+ */
+const RESERVED_CLAIMS = new Set([
+    "sub",
+    "userId",
+    "roles",
+    "permissions",
+    "typ",
+    "iss",
+    "aud",
+    "exp",
+    "iat",
+    "nbf",
+    "jti",
+]);
+export class Auth {
+    secret;
+    refreshSecret;
+    issuer;
+    audience;
+    algorithm;
+    accessTokenTtl;
+    refreshTokenTtl;
+    clockTolerance;
+    trustUserPermissions;
+    userStore;
+    refreshStore;
+    onLogin;
+    onLink;
+    rbac;
+    oauth;
+    claimExtractors = new Map();
+    hooks = {
+        beforeLogin: [],
+        afterLogin: [],
+        afterVerify: [],
+    };
+    constructor(options = {}) {
+        if (!options.secret) {
+            throw new ConfigurationError("Authentication secret is required");
+        }
+        this.secret = options.secret;
+        this.refreshSecret = options.refreshSecret ?? options.secret;
+        this.issuer = options.issuer;
+        this.audience = options.audience;
+        this.algorithm = options.algorithm ?? "HS256";
+        this.accessTokenTtl = options.accessTokenTtl ?? options.expiresIn ?? DEFAULT_ACCESS_TTL;
+        this.refreshTokenTtl = options.refreshTokenTtl ?? DEFAULT_REFRESH_TTL;
+        this.clockTolerance = options.clockTolerance ?? 0;
+        this.trustUserPermissions = options.trustUserPermissions ?? false;
+        this.userStore = options.userStore ?? null;
+        this.refreshStore = options.refreshStore ?? createMemoryRefreshStore();
+        this.onLogin = options.onLogin;
+        this.onLink = options.onLink;
+        this.rbac = normalizeRbac(options.rbac ?? options.roles);
+        this.oauth = options.oauth instanceof OAuth
+            ? options.oauth
+            : new OAuth(options.oauth ?? { providers: options.providers, redirectUri: options.redirectUri });
+    }
+    registerExtractor(name, extractor) {
+        if (typeof extractor !== "function") {
+            throw new ValidationError("Claim extractor must be a function");
+        }
+        if (RESERVED_CLAIMS.has(name)) {
+            throw new ValidationError(`Claim name "${name}" is reserved and cannot be produced by an extractor. ` +
+                "Identity and permission claims are derived from the user record and RBAC.");
+        }
+        this.claimExtractors.set(name, extractor);
+        return this;
+    }
+    hook(event, handler) {
+        if (!this.hooks[event]) {
+            throw new ValidationError(`Unknown auth hook: ${event}`);
+        }
+        if (typeof handler !== "function") {
+            throw new ValidationError("Hook handler must be a function");
+        }
+        this.hooks[event].push(handler);
+        return this;
+    }
+    async login(user, options = {}) {
+        if (!user || (user.id !== 0 && !user.id)) {
+            throw new ValidationError("User with id is required for login");
+        }
+        await this.runHooks("beforeLogin", { user, options });
+        const roles = unique([
+            ...(Array.isArray(user.roles) ? user.roles : []),
+            ...(user.role ? [user.role] : []),
+        ]);
+        // Permissions are derived from roles. A `permissions` field on the user
+        // record is only honoured when the application opts in, because a single
+        // tainted row (or a client-supplied field) would otherwise mint a token
+        // carrying arbitrary grants.
+        const permissions = unique([
+            ...(this.trustUserPermissions && Array.isArray(user.permissions) ? user.permissions : []),
+            ...[...this.rbac.subjectPermissions({ ...user, roles, permissions: undefined })],
+        ]);
+        const extra = await this.collectClaims(user, options.extractors);
+        const additional = isPlainObject(options.additionalClaims) ? options.additionalClaims : {};
+        for (const key of Object.keys(additional)) {
+            if (RESERVED_CLAIMS.has(key)) {
+                throw new ValidationError(`additionalClaims cannot override the reserved claim "${key}". ` +
+                    "Identity and permission claims are derived from the user record and RBAC.");
+            }
+        }
+        const payload = {
+            sub: String(user.id),
+            userId: user.id,
+            ...(user.email !== undefined && { email: user.email }),
+            ...(user.username !== undefined && { username: user.username }),
+            ...(user.name !== undefined && { name: user.name }),
+            roles,
+            permissions,
+            ...extra,
+            ...additional,
+        };
+        const subject = String(user.id);
+        const accessToken = encodeAccessToken(payload, this.secret, {
+            audience: this.audience,
+            issuer: this.issuer,
+            algorithm: this.algorithm,
+            jwtid: randomToken(16),
+            expiresIn: options.accessTokenTtl ?? this.accessTokenTtl,
+        });
+        let refreshToken = null;
+        if (options.refresh !== false) {
+            const jwtid = randomToken(16);
+            refreshToken = encodeRefreshToken({ sub: subject, userId: user.id, roles }, this.refreshSecret, {
+                audience: this.audience,
+                issuer: this.issuer,
+                algorithm: this.algorithm,
+                jwtid,
+                expiresIn: options.refreshTokenTtl ?? this.refreshTokenTtl,
+            });
+            await this.refreshStore.save({
+                id: jwtid,
+                userId: user.id,
+                tokenHash: sha256(refreshToken),
+                expiresAt: Date.now() + parseExpiresIn(options.refreshTokenTtl ?? this.refreshTokenTtl) * 1000,
+            });
+        }
+        const result = {
+            token: accessToken,
+            accessToken,
+            refreshToken,
+            payload,
+            user: {
+                id: user.id,
+                email: user.email,
+                username: user.username,
+                name: user.name,
+                roles,
+                permissions,
+            },
+        };
+        await this.runHooks("afterLogin", result);
+        if (typeof this.onLogin === "function") {
+            await this.onLogin(result);
+        }
+        return result;
+    }
+    async loginWithPassword(identifier, password, options = {}) {
+        if (!this.userStore?.findByCredentials && !this.userStore?.findByEmail && !this.userStore?.findByUsername) {
+            throw new ConfigurationError("A userStore with credential lookup is required for password login");
+        }
+        const user = this.userStore.findByCredentials
+            ? await this.userStore.findByCredentials(identifier)
+            : (await this.userStore.findByEmail?.(identifier)) ?? (await this.userStore.findByUsername?.(identifier));
+        if (!user?.passwordHash) {
+            throw new UnauthorizedError("Invalid credentials");
+        }
+        const valid = await verifyPassword(password, user.passwordHash);
+        if (!valid) {
+            throw new UnauthorizedError("Invalid credentials");
+        }
+        if (needsRehash(user.passwordHash) && this.userStore.updatePassword) {
+            const nextHash = await hashPassword(password);
+            await this.userStore.updatePassword(user.id, nextHash);
+        }
+        return this.login(user, options);
+    }
+    async register(input = {}, options = {}) {
+        if (!this.userStore?.create) {
+            throw new ConfigurationError("A userStore with create() is required for registration");
+        }
+        if (typeof input.password !== "string" || !input.password) {
+            throw new ValidationError("Password is required");
+        }
+        const passwordHash = await hashPassword(input.password);
+        // Roles come from server-side options only. `input.roles` is attacker
+        // controlled on a public sign-up form and must never reach the user record.
+        const roles = options.roles ?? (this.rbac.defaultRole ? [this.rbac.defaultRole] : []);
+        const user = await this.userStore.create({
+            email: input.email,
+            username: input.username,
+            name: input.name,
+            roles,
+            passwordHash,
+            metadata: input.metadata,
+        });
+        return this.login(user, options);
+    }
+    async verify(token, options = {}) {
+        if (!token) {
+            throw new UnauthorizedError("Token is required");
+        }
+        const claims = decode(token, this.secret, {
+            audience: options.audience ?? this.audience,
+            issuer: options.issuer ?? this.issuer,
+            algorithms: [this.algorithm],
+            clockTolerance: options.clockTolerance ?? this.clockTolerance,
+        });
+        // A refresh token is signed with the same secret and would otherwise verify
+        // as a bearer credential, turning a 7-day token into a 7-day access token.
+        if (claims.typ === "refresh" && options.acceptTokenType !== "refresh") {
+            throw new UnauthorizedError("Refresh tokens cannot be used as access tokens");
+        }
+        await this.runHooks("afterVerify", claims);
+        return claims;
+    }
+    async verifyRequest(request, options = {}) {
+        const token = this.extractToken(request, options);
+        if (!token) {
+            throw new UnauthorizedError("Missing bearer token");
+        }
+        return this.verify(token, options);
+    }
+    extractToken(request, options = {}) {
+        if (typeof request === "string") {
+            return extractBearerToken(request) ?? request;
+        }
+        const req = request;
+        const headers = collectHeaders(req);
+        const authorization = getHeader(headers, "authorization");
+        const fromHeader = extractBearerToken(authorization);
+        if (fromHeader) {
+            return fromHeader;
+        }
+        const cookieName = options.cookie ?? "access_token";
+        const cookies = req?.cookies ?? parseCookieHeader(getHeader(headers, "cookie"));
+        if (cookies?.[cookieName]) {
+            return cookies[cookieName];
+        }
+        const query = collectQuery(req);
+        return query.access_token ?? query.token ?? null;
+    }
+    async refresh(refreshToken, options = {}) {
+        if (!refreshToken) {
+            throw new UnauthorizedError("Refresh token is required");
+        }
+        const claims = decode(refreshToken, this.refreshSecret, {
+            audience: this.audience,
+            issuer: this.issuer,
+            algorithms: [this.algorithm],
+            clockTolerance: this.clockTolerance,
+        });
+        if (claims.typ && claims.typ !== "refresh") {
+            throw new UnauthorizedError("Not a refresh token");
+        }
+        if (claims.jti) {
+            // Consume the token in a single store operation when the store supports
+            // it, so two concurrent refreshes cannot both pass the validity check.
+            if (typeof this.refreshStore.consume === "function") {
+                const consumed = await this.refreshStore.consume(claims.jti);
+                if (!consumed) {
+                    throw new UnauthorizedError("Refresh token has been revoked");
+                }
+            }
+            else {
+                this.requireRevokeSupport();
+                const stored = await this.refreshStore.get(claims.jti);
+                if (!stored) {
+                    throw new UnauthorizedError("Refresh token has been revoked");
+                }
+                await this.refreshStore.revoke?.(claims.jti);
+            }
+        }
+        let user = {
+            id: (claims.userId ?? claims.sub),
+            roles: claims.roles,
+        };
+        if (this.userStore?.findById) {
+            user = await this.userStore.findById(user.id) ?? user;
+        }
+        return this.login(user, options);
+    }
+    /**
+     * Rotation only reaches this when `consume` is absent, so `revoke` is the only
+     * thing that can do the job.
+     */
+    requireRevokeSupport() {
+        if (typeof this.refreshStore.revoke !== "function") {
+            throw new ConfigurationError("The configured refreshStore cannot revoke tokens; implement revoke() so refresh rotation can invalidate the presented token");
+        }
+    }
+    async revoke(refreshToken) {
+        if (!refreshToken) {
+            return false;
+        }
+        // For logout, consume() and revoke() are interchangeable: both remove a
+        // specific id. A store that can rotate can therefore also log out.
+        const canRevoke = typeof this.refreshStore.revoke === "function" || typeof this.refreshStore.consume === "function";
+        if (!canRevoke) {
+            throw new ConfigurationError("The configured refreshStore cannot revoke tokens; implement revoke() or consume() to enable logout");
+        }
+        const claims = decode(refreshToken, this.refreshSecret, {
+            algorithms: [this.algorithm],
+            clockTolerance: this.clockTolerance,
+            ignoreExpiration: true,
+        });
+        if (claims?.typ && claims.typ !== "refresh") {
+            throw new UnauthorizedError("Not a refresh token");
+        }
+        if (claims?.jti) {
+            if (typeof this.refreshStore.revoke === "function") {
+                await this.refreshStore.revoke(claims.jti);
+            }
+            else {
+                await this.refreshStore.consume?.(claims.jti);
+            }
+            return true;
+        }
+        return false;
+    }
+    async logout(refreshToken) {
+        return this.revoke(refreshToken);
+    }
+    getAuthorizationUrl(provider, options = {}) {
+        return this.oauth.authorize(provider, options);
+    }
+    async loginWithOAuth(provider, params, options = {}) {
+        const result = await this.oauth.callback(provider, params);
+        const profile = result.profile;
+        let user = null;
+        if (this.userStore?.findByProvider && profile.id !== undefined) {
+            user = await this.userStore.findByProvider(provider, profile.id) ?? null;
+        }
+        if (!user && profile.email && this.userStore?.findByEmail) {
+            user = await this.userStore.findByEmail(profile.email) ?? null;
+            if (user && this.userStore.linkProvider) {
+                await this.userStore.linkProvider(user.id, provider, profile);
+                if (typeof this.onLink === "function") {
+                    await this.onLink({ user, provider, profile });
+                }
+            }
+        }
+        if (!user && this.userStore?.createFromProvider) {
+            user = await this.userStore.createFromProvider(provider, profile, result.tokens);
+        }
+        if (!user) {
+            // Without a provider-side identifier every user from this provider would
+            // collapse onto the same subject ("google:undefined"), so distinct people
+            // would share one identity. Fail closed instead of issuing the token.
+            if (profile.id === undefined || profile.id === null || profile.id === "") {
+                throw new ProviderError(`OAuth provider "${provider}" returned a profile without a subject identifier. ` +
+                    "Map a stable user id in the provider's profileMap before logging users in.", { cause: profile.raw });
+            }
+            user = {
+                id: `${provider}:${profile.id}`,
+                email: profile.email,
+                username: profile.username,
+                name: profile.name,
+                avatar: profile.avatar,
+                roles: options.roles ?? (this.rbac.defaultRole ? [this.rbac.defaultRole] : []),
+                provider,
+                providerId: profile.id,
+            };
+        }
+        const session = await this.login(user, {
+            ...options,
+            additionalClaims: {
+                provider,
+                providerId: profile.id,
+                ...(options.additionalClaims ?? {}),
+            },
+        });
+        return {
+            ...session,
+            oauth: result,
+        };
+    }
+    can(subject, permission) {
+        return this.rbac.can(subject, permission);
+    }
+    authorize(subject, permission) {
+        return this.rbac.authorize(subject, permission);
+    }
+    hasRole(subject, roles) {
+        return this.rbac.hasAnyRole(subject, roles);
+    }
+    hashPassword(password, options) {
+        return hashPassword(password, options);
+    }
+    verifyPassword(password, hash) {
+        return verifyPassword(password, hash);
+    }
+    sign(payload, options = {}) {
+        return encode(payload, this.secret, {
+            issuer: this.issuer,
+            audience: this.audience,
+            algorithm: this.algorithm,
+            expiresIn: options.expiresIn ?? this.accessTokenTtl,
+            ...options,
+        });
+    }
+    async collectClaims(user, extractorNames = []) {
+        const names = extractorNames.length > 0 ? extractorNames : [...this.claimExtractors.keys()];
+        const claims = {};
+        for (const name of names) {
+            const extractor = this.claimExtractors.get(name);
+            if (!extractor) {
+                continue;
+            }
+            try {
+                const value = await extractor(user);
+                if (isPlainObject(value)) {
+                    // A returned object may not reintroduce a reserved claim either.
+                    for (const [key, entry] of Object.entries(value)) {
+                        if (!RESERVED_CLAIMS.has(key)) {
+                            claims[key] = entry;
+                        }
+                    }
+                }
+                else if (value !== undefined) {
+                    claims[name] = value;
+                }
+            }
+            catch {
+                claims[name] = null;
+            }
+        }
+        return claims;
+    }
+    async runHooks(event, payload) {
+        for (const handler of this.hooks[event]) {
+            await handler(payload, this);
+        }
+    }
+}
+function normalizeRbac(value) {
+    if (value instanceof RBAC) {
+        return value;
+    }
+    if (!value) {
+        return new RBAC();
+    }
+    if ("roles" in value || "permissions" in value || "defaultRole" in value) {
+        return new RBAC(value);
+    }
+    return new RBAC({ roles: value });
+}
+function collectHeaders(request) {
+    const headers = {};
+    const source = request?.headers;
+    const bag = source;
+    if (bag && typeof bag.forEach === "function") {
+        // WHATWG Headers (and Map-like bags) call back with (value, key), the
+        // reverse of uWS. Copy both names so getHeader() can find them either way.
+        bag.forEach((value, key) => {
+            if (value === undefined || value === null) {
+                return;
+            }
+            headers[String(key).toLowerCase()] = String(value);
+        });
+    }
+    else if (bag && typeof bag.get === "function") {
+        for (const name of ["authorization", "cookie"]) {
+            const value = bag.get(name);
+            if (value !== undefined && value !== null) {
+                headers[name] = String(value);
+            }
+        }
+    }
+    else if (isPlainObject(source)) {
+        for (const [key, value] of Object.entries(source)) {
+            if (value !== undefined && value !== null) {
+                headers[key.toLowerCase()] = Array.isArray(value) ? String(value[0]) : String(value);
+            }
+        }
+    }
+    if (typeof request?.getHeader === "function") {
+        const authorization = request.getHeader("authorization");
+        const cookie = request.getHeader("cookie");
+        if (authorization)
+            headers.authorization = authorization;
+        if (cookie)
+            headers.cookie = cookie;
+    }
+    if (typeof request?.forEach === "function") {
+        // uWebSockets.js HttpRequest.forEach passes (key, value).
+        request.forEach((key, value) => {
+            const name = String(key).toLowerCase();
+            if (headers[name] === undefined) {
+                headers[name] = String(value);
+            }
+        });
+    }
+    return headers;
+}
+function collectQuery(request) {
+    if (request?.query && typeof request.query === "object" && !Array.isArray(request.query)) {
+        return parseQueryString(request.query);
+    }
+    if (typeof request?.query === "string") {
+        return parseQueryString(request.query);
+    }
+    if (typeof request?.getQuery === "function") {
+        return parseQueryString(request.getQuery());
+    }
+    return {};
+}
+export function createMemoryRefreshStore() {
+    const store = new Map();
+    const readValid = (id) => {
+        const record = store.get(id);
+        if (!record) {
+            return null;
+        }
+        if (record.expiresAt && record.expiresAt <= Date.now()) {
+            store.delete(id);
+            return null;
+        }
+        return record;
+    };
+    return {
+        async save(record) {
+            store.set(record.id, record);
+        },
+        async get(id) {
+            return readValid(id);
+        },
+        // Read and delete without an await in between, so a token cannot be
+        // refreshed twice in parallel.
+        async consume(id) {
+            const record = readValid(id);
+            store.delete(id);
+            return record;
+        },
+        async revoke(id) {
+            store.delete(id);
+        },
+    };
+}
+export function createAuth(options) {
+    return new Auth(options);
+}
+export { Auth as auth };
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAuB1E,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,MAAM,GACP,MAAM,YAAY,CAAC;AAEpB,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,KAAK;IACL,QAAQ;IACR,OAAO;IACP,aAAa;IACb,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAIH,MAAM,OAAO,IAAI;IACf,MAAM,CAAS;IACf,aAAa,CAAS;IACtB,MAAM,CAAU;IAChB,QAAQ,CAAqB;IAC7B,SAAS,CAAS;IAClB,cAAc,CAAkB;IAChC,eAAe,CAAkB;IACjC,cAAc,CAAS;IACvB,oBAAoB,CAAU;IAC9B,SAAS,CAAmB;IAC5B,YAAY,CAAe;IAC3B,OAAO,CAAyB;IAChC,MAAM,CAAwB;IAC9B,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,KAAK,GAA4C;QAC/C,WAAW,EAAE,EAAE;QACf,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,mBAAmB,CAAC;QACtE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,KAAK,CAAC;QAElE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,wBAAwB,EAAE,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;QAEzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,YAAY,KAAK;YACzC,CAAC,CAAC,OAAO,CAAC,KAAK;YACf,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,iBAAiB,CAAC,IAAY,EAAE,SAAyB;QACvD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,eAAe,IAAI,wDAAwD;gBACzE,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,KAAmB,EAAE,OAAwB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,eAAe,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAgB,EAAE,UAAwB,EAAE;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAEtD,MAAM,KAAK,GAAG,MAAM,CAAC;YACnB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAC,CAAC;QACH,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,6BAA6B;QAC7B,MAAM,WAAW,GAAG,MAAM,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;SACjF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,eAAe,CACvB,wDAAwD,GAAG,KAAK;oBAC9D,2EAA2E,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAe;YAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK;YACL,WAAW;YACX,GAAG,KAAK;YACR,GAAG,UAAU;SACd,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhC,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;YAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YACtB,SAAS,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;SACzD,CAAC,CAAC;QAEH,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC9B,YAAY,GAAG,kBAAkB,CAC/B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EACxC,IAAI,CAAC,aAAa,EAClB;gBACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK;gBACL,SAAS,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe;aAC3D,CACF,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC3B,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,KAAK,EAAE,WAAW;YAClB,WAAW;YACX,YAAY;YACZ,OAAO;YACP,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK;gBACL,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,QAAgB,EAAE,UAAwB,EAAE;QACtF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC;YAC1G,MAAM,IAAI,kBAAkB,CAAC,mEAAmE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB;YAC3C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC;YACpD,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5G,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAiC,EAAE,EAAE,UAAwB,EAAE;QAC5E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,kBAAkB,CAAC,wDAAwD,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK;YACL,YAAY;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,UAA4B,EAAE;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAC3C,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,UAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;SAC9D,CAAC,CAAC;QAEH,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,iBAAiB,CAAC,gDAAgD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB,EAAE,UAA+B,EAAE;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,CAAC,OAAgB,EAAE,UAA+B,EAAE;QAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QAChD,CAAC;QAED,MAAM,GAAG,GAAG,OAAkC,CAAC;QAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,UAAwB,EAAE;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;YACtD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,GAAe;YACrB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAoB;YACpD,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;QACF,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;YAC7B,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;;OAGG;IACK,oBAAoB;QAC1B,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACnD,MAAM,IAAI,kBAAkB,CAC1B,6HAA6H,CAC9H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAA4B;QACvC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC;QACpH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,oGAAoG,CACrG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;YACtD,UAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;YAChB,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAA4B;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAED,mBAAmB,CAAC,QAAgB,EAAE,UAAiC,EAAE;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,MAAuC,EACvC,UAAwB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,IAAI,IAAI,GAAsB,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,SAAS,EAAE,cAAc,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC/D,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;YAC1D,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC/D,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACtC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,CAAC;YAChD,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,yEAAyE;YACzE,0EAA0E;YAC1E,sEAAsE;YACtE,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACzE,MAAM,IAAI,aAAa,CACrB,mBAAmB,QAAQ,qDAAqD;oBAC9E,4EAA4E,EAC9E,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,GAAG;gBACL,EAAE,EAAE,GAAG,QAAQ,IAAI,OAAO,CAAC,EAAE,EAAE;gBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,QAAQ;gBACR,UAAU,EAAE,OAAO,CAAC,EAAE;aACvB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YACrC,GAAG,OAAO;YACV,gBAAgB,EAAE;gBAChB,QAAQ;gBACR,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;aACpC;SACF,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,OAAO;YACV,KAAK,EAAE,MAAM;SACd,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,OAAgD,EAAE,UAA6B;QACjF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS,CAAC,OAAgD,EAAE,UAA6B;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,OAAgD,EAAE,KAAwB;QAChF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,OAAyB;QACtD,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,cAAc,CAAC,QAAgB,EAAE,IAAY;QAC3C,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,UAA0B,EAAE;QAChD,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;YAClC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc;YACnD,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAgB,EAAE,iBAA2B,EAAE;QACjE,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,iEAAiE;oBACjE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACjD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAmB,EAAE,OAAgB;QAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CACpB,KAAmG;IAEnG,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,IAAI,aAAa,IAAI,KAAK,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;QACzE,OAAO,IAAI,IAAI,CAAC,KAAoB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,KAA6B,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,OAAqB;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAY,OAAO,EAAE,OAAO,CAAC;IACzC,MAAM,GAAG,GAAG,MAEC,CAAC;IAEd,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC7C,sEAAsE;QACtE,2EAA2E;QAC3E,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,OAAO,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,aAAa;YAAE,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;QACzD,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,OAAO,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3C,0DAA0D;QAC1D,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB;IACzC,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzF,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,OAAO,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,SAAS,GAAG,CAAC,EAAU,EAAwB,EAAE;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,oEAAoE;QACpE,+BAA+B;QAC/B,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,39 @@
+import type { AuthErrorOptions } from "./types.js";
+export declare class AuthError extends Error {
+    readonly name: string;
+    readonly code: string;
+    readonly status: number;
+    readonly cause?: unknown;
+    constructor(message: string, { code, status, cause }?: AuthErrorOptions);
+    toJSON(): {
+        name: string;
+        message: string;
+        code: string;
+        status: number;
+    };
+}
+export declare class InvalidTokenError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+export declare class TokenExpiredError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+export declare class UnauthorizedError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+export declare class ForbiddenError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+export declare class ConfigurationError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+export declare class OAuthError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+export declare class ProviderError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+export declare class ValidationError extends AuthError {
+    constructor(message?: string, options?: AuthErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAkB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAmB,EAAE,MAAY,EAAE,KAAK,EAAE,GAAE,gBAAqB;IAWhG,MAAM,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAQ1E;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAA6B,EAAE,OAAO,GAAE,gBAAqB;CAGjF;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAAsB,EAAE,OAAO,GAAE,gBAAqB;CAG1E;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAAiB,EAAE,OAAO,GAAE,gBAAqB;CAGrE;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAc,EAAE,OAAO,GAAE,gBAAqB;CAGlE;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,SAAyC,EAAE,OAAO,GAAE,gBAAqB;CAG7F;AAED,qBAAa,UAAW,SAAQ,SAAS;gBAC3B,OAAO,SAAgC,EAAE,OAAO,GAAE,gBAAqB;CAGpF;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAA4B,EAAE,OAAO,GAAE,gBAAqB;CAGhF;AAED,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,SAAsB,EAAE,OAAO,GAAE,gBAAqB;CAG1E"}