@outfoxx/sunday 2.0.0-beta.17 → 2.0.0-beta.19

package/build/request-security.js

@@ -11,59 +11,109 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-import { TokenProviderError } from './token-provider.js';
+import { withAbort } from './util/abort.js';
+import { prepareRequestBody } from './request-body.js';
+import { copyRequest, copyResponse } from './fetch-copy.js';
+import { RequestCancellationError } from './request-cancellation-error.js';
+import { TokenProviderError, providerCredentials, } from './token-provider.js';
 /** Adds all credentials atomically after every provider succeeds. */
-export async function authorizeRequest(request, bindings, manager, previous) {
-    if (!manager)
-        throw new TokenProviderError();
+export async function authorizeRequest(request, bindings, providers, maxBufferedRequestBytes) {
     const url = new URL(request.url);
     const headers = new Headers(request.headers);
-    validateTransports(bindings, url, headers, !previous);
-    const leases = await Promise.all(bindings.map(binding => manager.credentials(binding, request.signal)));
+    validateTransports(bindings, url, headers);
+    // Resolve every binding before starting work, so setup failure cannot strand earlier promises.
+    const selected = bindings.map((binding) => {
+        const provider = Object.hasOwn(providers, binding.provider)
+            ? providers[binding.provider]
+            : undefined;
+        if (!provider)
+            throw new TokenProviderError();
+        return { binding, provider };
+    });
+    const acquisition = new AbortController();
+    const signal = AbortSignal.any([request.signal, acquisition.signal]);
+    let leases;
+    try {
+        leases = await withAbort(() => Promise.all(selected.map(({ binding, provider }) => providerCredentials(provider, binding, signal))), signal);
+    }
+    catch (error) {
+        // Promise.all is fail-fast, but siblings still need a cooperative stop signal.
+        acquisition.abort(error);
+        throw error;
+    }
     request.signal.throwIfAborted();
     bindings.forEach((binding, index) => applyCredential(binding, leases[index].tokens.accessToken, url, headers));
-    // Passing the body explicitly avoids Request's internal stream proxy, which can stall uploads in Bun.
-    // Manual redirects also protect custom API-key headers and cookies from crossing origins.
-    const authorized = url.toString() === request.url && request.redirect === 'manual' ? request :
-        new Request(url, {
-            method: request.method, headers, body: request.body, signal: request.signal,
-            cache: request.cache, credentials: request.credentials, integrity: request.integrity,
-            keepalive: request.keepalive, mode: request.mode, redirect: 'manual',
-            referrer: request.referrer, referrerPolicy: request.referrerPolicy,
-            ...(request.body ? { duplex: 'half' } : {}),
-        });
-    for (const [name, value] of headers)
-        authorized.headers.set(name, value);
+    // Changing URL reconstructs Request from settings. Firefox does not expose Request.body,
+    // so retain its already-buffered native body through blob() instead of silently dropping it.
+    let body;
+    if (url.href !== request.url) {
+        if (request.body) {
+            body = await prepareRequestBody(request.body, {
+                signal: request.signal,
+                maxBytes: maxBufferedRequestBytes,
+            });
+        }
+        else if (request.body === undefined &&
+            !['GET', 'HEAD'].includes(request.method)) {
+            const buffered = await request.blob();
+            if (buffered.size)
+                body = buffered;
+        }
+    }
+    const authorized = copyRequest(request, {
+        ...(body !== undefined ? { body } : {}),
+        url,
+        headers,
+        redirect: 'manual',
+        credentials: 'omit',
+    });
     return { request: authorized, bindings, leases };
 }
+/** Proves body absence without treating an unavailable Request.body property as an empty body. */
+export function isBodylessRequest(request) {
+    // Fetch forbids bodies on GET/HEAD. Other methods require an inspectable null body.
+    return (request.method === 'GET' ||
+        request.method === 'HEAD' ||
+        request.body === null);
+}
 /** Requires a safe, replayable request and an explicit bearer invalid-token challenge. */
 export function canRecoverAuthentication(request, response) {
-    return response.status === 401 && ['GET', 'HEAD', 'OPTIONS'].includes(request.request.method) &&
-        request.request.body === null && request.bindings.some(isBearerBinding) &&
-        hasInvalidBearerChallenge(response.headers.get('WWW-Authenticate') ?? '');
+    return (response.status === 401 &&
+        ['GET', 'HEAD', 'OPTIONS'].includes(request.method) &&
+        isBodylessRequest(request) &&
+        /^Bearer[ \t]+[^ \t]+$/i.test(request.headers.get('Authorization') ?? '') &&
+        hasInvalidBearerChallenge(response.headers.get('WWW-Authenticate') ?? ''));
 }
 /** Returns only bearer receipts rejected by an invalid-token challenge, preserving other conjuncts. */
 export function rejectedBearerLeases(request) {
-    return request.leases.filter((_, index) => isBearerBinding(request.bindings[index]));
+    const token = /^Bearer[ \t]+([^ \t]+)$/i.exec(request.request.headers.get('Authorization') ?? '')?.[1];
+    return request.leases.filter((lease, index) => isBearerBinding(request.bindings[index]) &&
+        token === lease.tokens.accessToken);
 }
 function isBearerBinding(binding) {
-    return binding.transport.location === 'header' && binding.transport.name.toLowerCase() === 'authorization' &&
-        binding.transport.prefix?.toLowerCase() === 'bearer';
+    return (binding.transport.location === 'header' &&
+        binding.transport.name.toLowerCase() === 'authorization' &&
+        binding.transport.prefix?.toLowerCase() === 'bearer');
 }
 /** Removes query credentials from responses before error translation or diagnostic rendering. */
 export function redactSecurityResponse(response, bindings) {
-    const queryNames = bindings.filter(binding => binding.transport.location === 'query').map(binding => binding.transport.name);
+    const queryNames = bindings
+        .filter((binding) => binding.transport.location === 'query')
+        .map((binding) => binding.transport.name);
     if (!queryNames.length || !response.url)
         return response;
     const url = new URL(response.url);
     for (const name of queryNames)
         if (url.searchParams.has(name))
             replaceQueryCredential(url, name, '[redacted]');
-    const result = new Response(response.body, { status: response.status, statusText: response.statusText, headers: response.headers });
-    Object.defineProperty(result, 'url', { value: url.toString() });
+    if (url.href === response.url)
+        return response;
+    // Filtered responses cannot be reconstructed; preserve the native response and its hidden body.
+    const result = response.status === 0 ? response : copyResponse(response);
+    Object.defineProperty(result, 'url', { value: url.href, configurable: true });
     return result;
 }
-function hasInvalidBearerChallenge(header) {
+export function hasInvalidBearerChallenge(header) {
     const parts = splitChallenges(header);
     if (!parts)
         return false;
@@ -83,14 +133,16 @@ function hasInvalidBearerChallenge(header) {
     return false;
 }
 function cookieEntries(headers) {
-    return (headers.get('Cookie') ?? '').split(';').flatMap(entry => {
+    return (headers.get('Cookie') ?? '').split(';').flatMap((entry) => {
         const split = entry.indexOf('=');
-        return split < 0 ? [] : [[entry.slice(0, split).trim(), entry.slice(split + 1).trim()]];
+        return split < 0
+            ? []
+            : [[entry.slice(0, split).trim(), entry.slice(split + 1).trim()]];
     });
 }
 // URLSearchParams re-encodes unrelated values, which can invalidate application-signed query parameters.
 function replaceQueryCredential(url, name, credential) {
-    const fields = (url.search ? url.search.slice(1).split('&') : []).filter(field => {
+    const fields = (url.search ? url.search.slice(1).split('&') : []).filter((field) => {
         const key = field.split('=', 1)[0];
         try {
             return decodeURIComponent(key.replaceAll('+', ' ')) !== name;
@@ -102,7 +154,7 @@ function replaceQueryCredential(url, name, credential) {
     fields.push(`${encodeURIComponent(name)}=${encodeURIComponent(credential)}`);
     url.search = fields.join('&');
 }
-function validateTransports(bindings, url, headers, checkExisting) {
+function validateTransports(bindings, url, headers) {
     const names = new Set();
     for (const binding of bindings) {
         const transport = binding.transport;
@@ -110,9 +162,11 @@ function validateTransports(bindings, url, headers, checkExisting) {
         if (names.has(name))
             throw new TokenProviderError();
         names.add(name);
-        if (checkExisting && ((transport.location === 'header' && headers.has(transport.name)) ||
-            (transport.location === 'query' && url.searchParams.has(transport.name)) ||
-            (transport.location === 'cookie' && cookieEntries(headers).some(([name]) => name === transport.name))))
+        if ((transport.location === 'header' && headers.has(transport.name)) ||
+            (transport.location === 'query' &&
+                url.searchParams.has(transport.name)) ||
+            (transport.location === 'cookie' &&
+                cookieEntries(headers).some(([name]) => name === transport.name)))
             throw new TokenProviderError();
     }
 }
@@ -121,7 +175,7 @@ function applyCredential(binding, token, url, headers) {
     const credential = transport.prefix ? `${transport.prefix} ${token}` : token;
     switch (transport.location) {
         case 'header': {
-            if ([...credential].some(character => character.codePointAt(0) < 32 || character.codePointAt(0) === 127))
+            if ([...credential].some((character) => character.codePointAt(0) < 32 || character.codePointAt(0) === 127))
                 throw new TokenProviderError();
             headers.set(transport.name, credential);
             break;
@@ -164,4 +218,15 @@ function splitChallenges(header) {
     parts.push(header.slice(start).trim());
     return parts;
 }
+/** Reports all matching rejections, including unsafe requests and exhausted recovery budgets. */
+export async function rejectCredentials(request, response) {
+    if (response.status !== 401 ||
+        !hasInvalidBearerChallenge(response.headers.get('WWW-Authenticate') ?? ''))
+        return;
+    let recoverable = true;
+    for (const lease of rejectedBearerLeases(request))
+        recoverable = ((await lease.invalidate?.()) ?? false) && recoverable;
+    if (!recoverable)
+        throw new RequestCancellationError('The credential owner rejected authentication recovery');
+}
 //# sourceMappingURL=request-security.js.map

package/build/request-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-security.js","sourceRoot":"","sources":["../src/request-security.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAIjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,QAAoC,EACpC,OAAiC,EACjC,QAA4B;IAE5B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/G,sGAAsG;IACtG,0FAA0F;IAC1F,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5F,IAAI,OAAO,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;YAC3E,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YACpF,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ;YACpE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc;YAClE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;QAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,OAA0B,EAAE,QAAkB;IACrF,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3F,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC;QACvE,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,OAA0B;IAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,OAAO,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe;QACxG,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CAAC,QAAkB,EAAE,QAAoC;IAC7F,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7H,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,UAAU;QAAE,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,sBAAsB,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpI,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,SAAS,EAAE,CAAC;YAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;YAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;aACpF,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;QAC1D,MAAM,KAAK,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,SAAS,sBAAsB,CAAC,GAAQ,EAAE,IAAY,EAAE,UAAkB;IACxE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC;YAAC,OAAO,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;QAAC,CAAC;QACrE,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAoC,EAAE,GAAQ,EAAE,OAAgB,EAAE,aAAsB;IAClH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACxH,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,aAAa,IAAI,CACnB,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CACtG;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB,EAAE,KAAa,EAAE,GAAQ,EAAE,OAAgB;IAC1F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,GAAG,EAAE,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,KAAK,GAAG,CAAC;gBAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;YAC3I,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,OAAO;YAAE,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAAC,MAAM;QAC7E,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QAAC,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"request-security.js","sourceRoot":"","sources":["../src/request-security.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAG3E,OAAO,EAEL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAS7B,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,QAAoC,EACpC,SAAkD,EAClD,uBAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,SAAS,CACtB,GAAG,EAAE,CACH,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CACrC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAC/C,CACF,EACH,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAClC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CACzE,CAAC;IACF,yFAAyF;IACzF,6FAA6F;IAC7F,IAAI,IAA0B,CAAC;IAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,uBAAuB;aAClC,CAAC,CAAC;QACL,CAAC;aAAM,IACL,OAAO,CAAC,IAAI,KAAK,SAAS;YAC1B,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EACzC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI;gBAAE,IAAI,GAAG,QAAQ,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE;QACtC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG;QACH,OAAO;QACP,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,oFAAoF;IACpF,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,KAAK;QACxB,OAAO,CAAC,MAAM,KAAK,MAAM;QACzB,OAAO,CAAC,IAAI,KAAK,IAAI,CACtB,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CACtC,OAAgB,EAChB,QAAkB;IAElB,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACnD,iBAAiB,CAAC,OAAO,CAAC;QAC1B,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACzE,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAClC,OAA0B;IAE1B,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CACnD,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ;QACvC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe;QACxD,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,CACrD,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,QAAkB,EAClB,QAAoC;IAEpC,MAAM,UAAU,GAAG,QAAQ;SACxB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC;SAC3D,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,UAAU;QAC3B,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAC5B,sBAAsB,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC/C,gGAAgG;IAChG,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;YACjD,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;QAC5D,MAAM,KAAK,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,KAAK,GAAG,CAAC;YACd,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,SAAS,sBAAsB,CAC7B,GAAQ,EACR,IAAY,EACZ,UAAkB;IAElB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACtE,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAoC,EACpC,GAAQ,EACR,OAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACxH,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,IACE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO;gBAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ;gBAC9B,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;YAEnE,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAAwB,EACxB,KAAa,EACb,GAAQ,EACR,OAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IACE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAClB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,GAAG,EAAE,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,KAAK,GAAG,CACtE;gBAED,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,OAAO;YACV,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CACpC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CACT,QAAQ,EACR,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9D,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAC1B,QAAkB;IAElB,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAE1E,OAAO;IACT,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,OAAO,CAAC;QAC/C,WAAW,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,WAAW,CAAC;IACvE,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,wBAAwB,CAChC,uDAAuD,CACxD,CAAC;AACN,CAAC"}

package/build/response-adapter.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Adapts the response returned by Fetch before Sunday handling. Hidden native intermediate
+ * responses are unavailable. The request is the one submitted to Fetch, not a wire-level trace.
+ * Consumed resources must be replaced before returning; use request.signal for cancellation.
+ * Sunday cancels returned bodies on abort, including while decoding or validation owns their reader.
+ */
+export interface ResponseAdapter {
+    /** Returns the adapted value; throwing stops the remaining adapters. */
+    adapt(response: Response, request: Request): Response | Promise<Response>;
+}

package/build/response-adapter.js

@@ -0,0 +1,15 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+export {};
+//# sourceMappingURL=response-adapter.js.map

package/build/response-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-adapter.js","sourceRoot":"","sources":["../src/response-adapter.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC"}

package/build/response-adapters.d.ts

@@ -0,0 +1,13 @@
+import { ResponseAdapter } from './response-adapter.js';
+/** Explicit, flat, ordered composition of response adapters. No request capability is inferred. */
+export declare class ResponseAdapters implements ResponseAdapter {
+    readonly adapters: readonly ResponseAdapter[];
+    constructor(...adapters: readonly ResponseAdapter[]);
+    /** Appends adapters without nesting execution pipelines. */
+    chainTo(...next: readonly ResponseAdapter[]): ResponseAdapters;
+    adapt(response: Response, request: Request): Promise<Response>;
+}
+/** Composes plain object adapters without inferring response capabilities from request adapters. */
+export declare function chainResponseAdapters(...adapters: readonly ResponseAdapter[]): ResponseAdapters;
+/** @internal Native Fetch bodies already own cancellation and must retain their byte-stream capabilities. */
+export declare function adaptResponse(adapters: readonly ResponseAdapter[], response: Response, request: Request, native?: boolean): Promise<Response>;

package/build/response-adapters.js

@@ -0,0 +1,75 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { ownBody, bodyReads, sameBody } from './util/owned-body.js';
+import { copyResponse } from './fetch-copy.js';
+import { discardBody, withAbort } from './util/abort.js';
+/** Explicit, flat, ordered composition of response adapters. No request capability is inferred. */
+export class ResponseAdapters {
+    adapters;
+    constructor(...adapters) {
+        this.adapters = Object.freeze(adapters.flatMap((adapter) => adapter instanceof ResponseAdapters ? adapter.adapters : [adapter]));
+    }
+    /** Appends adapters without nesting execution pipelines. */
+    chainTo(...next) {
+        return new ResponseAdapters(this, ...next);
+    }
+    async adapt(response, request) {
+        return adaptResponse(this.adapters, response, request);
+    }
+}
+/** Composes plain object adapters without inferring response capabilities from request adapters. */
+export function chainResponseAdapters(...adapters) {
+    return new ResponseAdapters(...adapters);
+}
+/** @internal Native Fetch bodies already own cancellation and must retain their byte-stream capabilities. */
+export async function adaptResponse(adapters, response, request, native = false) {
+    if (!adapters.length) {
+        request.signal.throwIfAborted();
+        return response;
+    }
+    const cancellation = new AbortController();
+    const signal = AbortSignal.any([request.signal, cancellation.signal]);
+    let current = response;
+    const owned = (value) => {
+        if (!value.body || value.status === 0)
+            return value;
+        const body = ownBody(value.body, signal);
+        if (body !== value.body)
+            return copyResponse(value, { body });
+        bodyReads(value);
+        return value;
+    };
+    try {
+        signal.throwIfAborted();
+        if (!native)
+            current = owned(current);
+        for (const adapter of adapters) {
+            const adapted = await withAbort(() => adapter.adapt(current, request), signal, discardBody);
+            if (sameBody(adapted.body, current.body)) {
+                current = adapted;
+                bodyReads(current);
+            }
+            else
+                current = owned(adapted);
+        }
+        signal.throwIfAborted();
+        return current;
+    }
+    catch (error) {
+        cancellation.abort(error);
+        discardBody(current, error);
+        throw error;
+    }
+}
+//# sourceMappingURL=response-adapters.js.map

package/build/response-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-adapters.js","sourceRoot":"","sources":["../src/response-adapters.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzD,mGAAmG;AACnG,MAAM,OAAO,gBAAgB;IAClB,QAAQ,CAA6B;IAE9C,YAAY,GAAG,QAAoC;QACjD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC3B,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3B,OAAO,YAAY,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,GAAG,IAAgC;QACzC,OAAO,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAkB,EAAE,OAAgB;QAC9C,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;CACF;AAED,oGAAoG;AACpG,MAAM,UAAU,qBAAqB,CACnC,GAAG,QAAoC;IAEvC,OAAO,IAAI,gBAAgB,CAAC,GAAG,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAoC,EACpC,QAAkB,EAClB,OAAgB,EAChB,MAAM,GAAG,KAAK;IAEd,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,KAAe,EAAY,EAAE;QAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,SAAS,CAC7B,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EACrC,MAAM,EACN,WAAW,CACZ,CAAC;YACF,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,OAAO,GAAG,OAAO,CAAC;gBAClB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;;gBAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/build/token-manager.d.ts

@@ -1,15 +1,20 @@
 import { SecurityBinding } from './security-binding.js';
-import { TokenProvider, TokenSet, TokenStore } from './token-provider.js';
+import { TokenConfiguration, TokenProvider, TokenRequest, TokenSet, TokenStore } from './token-provider.js';
 /** A credential receipt used for conditional invalidation after an invalid-token response. */
 export interface TokenLease {
     readonly key: string;
     readonly tokens: TokenSet;
+    /** Rejects the original credential without invalidating a concurrent replacement. */
+    readonly invalidate?: () => Promise<boolean>;
 }
 /**
  * Shared token lifecycle with one renewal per cache key. Canceling one caller leaves other waiters
- * running; canceling the last waiter signals the provider. A failed renewal is never cached.
+ * running; canceling the last waiter stops waiting for the provider without abandoning storage commits.
+ * A failed or cancelled acquisition is never cached.
  */
-export declare class TokenManager {
+export declare class TokenManager implements TokenProvider {
+    readonly identity: string;
+    private readonly provider?;
     private readonly providers;
     private readonly store;
     private readonly renewals;
@@ -17,11 +22,15 @@ export declare class TokenManager {
     private readonly locks;
     private readonly now;
     private readonly skew;
-    constructor(providers: Readonly<Record<string, TokenProvider>>, options?: {
+    constructor(providers: TokenProvider | Readonly<Record<string, TokenProvider>>, options?: {
         store?: TokenStore;
         expirySkewMs?: number;
         now?: () => number;
     });
+    /** Forwards application configuration to the explicitly managed provider. */
+    configure(binding: SecurityBinding): TokenConfiguration;
+    /** Obtains managed credentials; receipt acquisition preserves rejection context. */
+    acquire(request: TokenRequest, signal: AbortSignal): Promise<TokenSet>;
     /** Acquires current credentials without invoking authorization twice for an expired interactive session. */
     credentials(binding: SecurityBinding, signal?: AbortSignal): Promise<TokenLease>;
     /** Invalidates only the credential that failed, preserving a token already renewed by another caller. */