@soulcode/bexio-oauth 0.1.0 → 0.2.0

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,WAAW,IAAI,eAAe,EAC9B,SAAS,EACT,MAAM,IAAI,UAAU,EACpB,SAAS,GACV,MAAM,MAAM,CAAC;AAEd,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,SAAS,GAEV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,IAAI,EAAiB,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAa,MAAM,kBAAkB,CAAC;AAgGxD,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,+DAA+D;AAC/D,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAc;IAK9B,IAAI,KAAK,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAUD,SAAS,OAAO,CAAC,CAAc;IAC7B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAyB,EAAE,QAAgB;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,eAAe,CACjB,gBAAgB,EAChB,iDAAiD,CAClD,CAAC;IACJ,4CAA4C;IAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,MAAM,OAAO,EAAE,CAAC;IAClB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YACtC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAa,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAIhF,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK;QACf,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAEnE,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACzE,GAAG,CACJ,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mCAAmC,eAAe,GAAG,IAAI,GAAG,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,qEAAqE;IACrE,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE3E,4EAA4E;IAE5E,IAAI,UAAmD,CAAC;IACxD,SAAS,UAAU;QACjB,UAAU,KAAK,IAAI;aAChB,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE;YACrE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE;YACrD,yEAAyE;YACzE,OAAO,EAAE,oBAAoB;YAC7B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,GAAW,EAAE,OAAoB,EAAE,EAAE,CACxD,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC;SAC1B,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAW,EAAE,OAAoB,EAAE,EAAE,CAC1D,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1B,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,UAAU,GAAG,SAAS,CAAC;YACvB,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,6BAA6B,MAAM,EAAE,EACrC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,IAAuD,CAAC;IAC5D,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC3D,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YACzE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;gBACtC,eAAe,EAAE,oBAAoB,GAAG,IAAI;gBAC5C,CAAC,eAAe,CAAC,EAAE,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAE/E,KAAK,UAAU,YAAY,CAAC,QAAuB;QACjD,IAAI,CAAC,QAAQ,EAAE,OAAO;YACpB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;QACrE,IACE,QAAQ,CAAC,OAAO,KAAK,SAAS;YAC9B,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,KAQzB;QACC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,YAAY,CAC1B,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,MAAM,CAChB,CAAC;QACF,MAAM,IAAI,GACR,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC1E,OAAO,KAAK,CAAC,WAAW,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,QAAQ;YACX,IAAI;YACJ,WAAW,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;YAC7D,YAAY,EAAE,KAAK,CAAC,YAAY;gBAC9B,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC;gBACnD,CAAC,CAAC,IAAI;YACR,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,UAAU,YAAY,CACzB,MAAgB,EAChB,WAAmB;QAEnB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,MAAM,UAAU,EAAE,EAClB,WAAW,EACX,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CACpE,CAAC;YACF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,MAAmB,EAAE,KAAa;QACpD,OAAO,MAAM,CAAC,OAAO,CACnB,KAAK,EACL,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa,CAC1B,MAAmB,EACnB,SAAiB;QAEjB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,wCAAwC;YACxC,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,MAAsE,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,IAAI,CAAC,iBAAiB;gBACvC,KAAK,CAAC,KAAK,KAAK,eAAe,EAC/B,CAAC;gBACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9D,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,sDAAsD,EACtD,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1C,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,sBAAsB,EAAE;gBAC7D,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE;YAC5D,WAAW,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;YAC/D,YAAY,EAAE,MAAM,CAAC,aAAa;gBAChC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC;gBACrD,CAAC,CAAC,IAAI;YACR,eAAe,EACb,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;YAChD,gBAAgB,EACd,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;gBACvD,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;gBACnD,CAAC,CAAC,IAAI;YACV,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,IAAI,EAAE,MAAM,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;YACjE,GAAG;SACJ,CAAC,CAAC;QACH,qEAAqE;QACrE,2DAA2D;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,OAAO,CAAC,MAAmB,EAAE,GAAS;QAC7C,OAAO,CACL,MAAM,CAAC,eAAe,KAAK,IAAI;YAC/B,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,GAAG,CAAC,OAAO,EAAE,CAClE,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,MAAmB;QACtC,OAAO;YACL,WAAW,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;YACzD,SAAS,EAAE,MAAM,CAAC,eAAe;YACjC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC;IACJ,CAAC;IAED,SAAS,UAAU,CAAC,GAAS;QAC3B,OAAO;YACL,GAAG;YACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC;YAC9C,SAAS,EAAE,UAAU,EAAE;SACxB,CAAC;IACJ,CAAC;IAED,+EAA+E;IAE/E,MAAM,GAAG,GAAG;QACV;;;WAGG;QACH,KAAK,CAAC,KAAK,CACT,QAAiB,EACjB,OAA+C;YAE/C,IAAI,CAAC,OAAO,EAAE,OAAO;gBACnB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YACjE,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE;gBACxC,YAAY,EAAE,WAAW,CAAC,IAAI;gBAC9B,KAAK;gBACL,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;gBAC/D,qBAAqB,EAAE,MAAM;gBAC7B,KAAK;gBACL,KAAK;aACN,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B;gBACE,CAAC,EAAE,KAAK;gBACR,CAAC,EAAE,QAAQ;gBACX,CAAC,EAAE,KAAK;gBACR,CAAC,EAAE,OAAO,CAAC,OAAO;gBAClB,CAAC,EAAE,QAAQ;aACQ,EACrB,gBAAgB,EAChB,KAAK,EAAE,CACR,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;gBAC1B,QAAQ,EAAE,GAAG,CAAC,IAAI;gBAClB,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACnE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,cAAc,CAClB,OAAgB,EAChB,OAAwB;YAExB,IACE,CAAC,OAAO;gBACR,CAAC,SAAS,IAAI,OAAO;oBACnB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;oBAClB,CAAC,CAAC,OAAO,OAAO,CAAC,cAAc,KAAK,UAAU,CAAC,EACjD,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAE,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAsB;gBAC9D,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mDAAmD,CACpD,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAChB,SAAS,IAAI,OAAO;gBAClB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO;gBAC5B,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YACtD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,sEAAsE,CACvE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,eAAe,CACvB,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EACzD,kBAAkB,KAAK,EAAE,CAC1B,CAAC;YACJ,CAAC;YAED,2EAA2E;YAC3E,uEAAuE;YACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC7C,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAEtC,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,CAAC;YAC7B,IAAI,MAC+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,UAAU,EAAE;oBACxD,gBAAgB,EAAE,IAAI,CAAC,CAAC;oBACxB,aAAa,EAAE,IAAI,CAAC,CAAC;oBACrB,aAAa,EAAE,IAAI,CAAC,CAAC;oBACrB,eAAe,EAAE,IAAI;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBACrD,MAAM,IAAI,eAAe,CACvB,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EAC/D,kBAAkB,KAAK,CAAC,KAAK,EAAE,EAC/B,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;oBAC/B,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,kCAAkC,EAClC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,2DAA2D,EAC3D,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EACnE,MAAM,CAAC,YAAY,CACpB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,OAAO,EAAE,IAAI,CAAC,CAAC;gBACf,MAAM;gBACN,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;gBAC1C,eAAe,EACb,SAAS,KAAK,SAAS;oBACrB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;gBAChD,gBAAgB,EACd,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;oBACvD,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;oBACnD,CAAC,CAAC,IAAI;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;aAC5B,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/D,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,QAAQ,CACZ,OAAgB,EAChB,OAAwB;YAExB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,QAAa,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;oBAC9D,MAAM,KAAK,CAAC;gBACd,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAE,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAsB;oBAC9D,CAAC,CAAC,IAAI,CAAC;gBACT,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,SAAS,CAAC,KAGf;YACC,IAAI,CAAC,KAAK,EAAE,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC,MAAM,EAAE,WAAW;gBACtB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;YACJ,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,CAAC;YAC7B,MAAM,cAAc,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC;YACjD,MAAM,MAAM,GAAG,KAAK,EAClB,KAAa,EACb,QAAiB,EACE,EAAE;gBACrB,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;wBAC/C,MAAM,EAAE,cAAc;wBACtB,QAAQ;wBACR,UAAU,EAAE,kBAAkB;wBAC9B,WAAW,EAAE,KAAK,EAAE;qBACrB,CAAC,CAAC;oBACH,OAAO,OAAmB,CAAC;gBAC7B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,0DAA0D;oBAC1D,wEAAwE;oBACxE,IACE,KAAK,YAAY,UAAU,CAAC,WAAW;wBACvC,KAAK,YAAY,SAAS;wBAC1B,CAAC,KAAK,YAAY,UAAU,CAAC,SAAS;4BACpC,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,EACpC,CAAC;wBACD,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,qCAAqC,EACrC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;oBACJ,CAAC;oBACD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gDAAgD,EAChD,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;YACF,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtD,uEAAuE;YACvE,6EAA6E;YAC7E,IAAI,YAAY,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACzC,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO;gBAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,EAChC,MAAM,CAAC,WAAW,CACnB,CAAC;YACF,MAAM,GAAG,GACP,OAAO,YAAY,CAAC,GAAG,KAAK,QAAQ;gBAClC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC;gBACnC,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM;gBACN,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;gBACzC,eAAe,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;gBACxC,gBAAgB,EAAE,IAAI;gBACtB,KAAK,EACH,MAAM,CAAC,KAAK;oBACZ,CAAC,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;aACvE,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,cAAc,CAAC,QAAuB;YAC1C,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC;YACvD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,SAAS,CAAC;gBACR,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBACxC,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,+BAA+B,CAChC,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;gBACpB,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;gBAE/C,mEAAmE;gBACnE,MAAM,UAAU,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;oBAC5C,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,GAAG,MAAM;oBACT,mBAAmB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;iBAC9D,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAChE,IAAI,SAAS;wBAAE,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;oBACvC,mEAAmE;oBACnE,qEAAqE;oBACrE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChD,IAAI,CAAC,OAAO;wBACV,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;oBAClE,MAAM,GAAG,OAAO,CAAC;oBACjB,SAAS;gBACX,CAAC;gBAED,mEAAmE;gBACnE,IAAI,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;oBACjC,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,kDAAkD,CACnD,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,IAAI;oBACP,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;gBAClE,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,KAAK,CAAC,UAAU,CAAC,KAA0B;YACzC,IAAI,CAAC,KAAK,EAAE,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;YACrE,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3E,CAAC;QAED,8EAA8E;QAC9E,KAAK,CAAC,UAAU,CAAC,QAAuB;YACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC;oBAClE,MAAM,IAAI,CAAC,eAAe,CACxB,CAAC,EACD,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,EAC7C;wBACE,eAAe,EAAE,eAAe;qBACjC,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,WAAW,CAAC,OAGjB;YACC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAsB;gBAChC,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,CAAC;gBACV,cAAc,EAAE,CAAC;gBACjB,MAAM,EAAE,CAAC;aACV,CAAC;YACF,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;gBACtC,eAAe;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG;aAC5B,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,UAAU,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;oBAC5C,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,GAAG,MAAM;oBACT,eAAe;iBAChB,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC;oBACH,IAAI,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;wBAAE,MAAM,CAAC,SAAS,EAAE,CAAC;;wBACjE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;wBAChD,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;IAEX,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,KAAK,GAAG;YACZ,GAAG,WAAW,IAAI,KAAK,EAAE;YACzB,QAAQ,WAAW,CAAC,QAAQ,EAAE;YAC9B,WAAW,MAAM,EAAE;YACnB,UAAU;YACV,cAAc;SACf,CAAC;QACF,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;QACvC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;QAC/D,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;QAC3E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAC3C,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;QACnD,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,22 @@
+import { TokenCipher } from "./crypto.js";
+import { type Oidc } from "./oidc.js";
+import type { GrantStore } from "./store/types.js";
+import type { BexioOAuthConfig } from "./types.js";
+/** The validated configuration and shared services every client method uses. */
+export interface ClientContext {
+    clientId: string;
+    cipher: TokenCipher;
+    store: GrantStore;
+    clock: () => Date;
+    fetchImpl: typeof fetch;
+    oidc: Oidc;
+    apiBaseUrl: string;
+    redirectUri: URL;
+    /** Space-separated, `BASE_SCOPES` included. */
+    scope: string;
+    lockTtlMs: number;
+    defaultReturnTo: string;
+}
+/** Validates the config (throws `invalid_config`) and builds the shared context. */
+export declare function resolveConfig(config: BexioOAuthConfig): ClientContext;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,GAAG,CAAC;IACjB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAYD,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAiDrE"}

package/dist/config.js

@@ -0,0 +1,57 @@
+import { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER } from "./claims.js";
+import { TokenCipher } from "./crypto.js";
+import { toMs } from "./duration.js";
+import { BexioOAuthError } from "./errors.js";
+import { createOidc } from "./oidc.js";
+import { safeReturnTo } from "./return-to.js";
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * One refresh makes up to three Bexio calls inside the lock: token (10 s), the
+ * JWKS fetch for the refreshed ID token (10 s), and the role (5 s).
+ */
+const MIN_LOCK_TTL_MS = 30_000;
+const isLoopbackHttp = (url) => url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+/** Validates the config (throws `invalid_config`) and builds the shared context. */
+export function resolveConfig(config) {
+    for (const key of ["clientId", "clientSecret", "redirectUri"]) {
+        if (!config[key])
+            throw new BexioOAuthError("invalid_config", `${key} is required`);
+    }
+    if (!config.store)
+        throw new BexioOAuthError("invalid_config", "store is required");
+    const cipher = new TokenCipher(config.keys);
+    const fetchImpl = config.fetch ?? fetch;
+    const issuer = config.issuer ?? BEXIO_ISSUER;
+    const redirectUri = new URL(config.redirectUri);
+    // Plain http only for local development: the flow cookie would otherwise
+    // travel without `Secure`.
+    if (redirectUri.protocol !== "https:" && !isLoopbackHttp(redirectUri)) {
+        throw new BexioOAuthError("invalid_config", "redirectUri must use https (http is allowed for loopback hosts only)");
+    }
+    const lockTtlMs = toMs(config.refreshLockTtl ?? "30s", "refreshLockTtl");
+    if (lockTtlMs < MIN_LOCK_TTL_MS) {
+        throw new BexioOAuthError("invalid_config", `refreshLockTtl must be at least ${MIN_LOCK_TTL_MS / 1000}s`);
+    }
+    const defaultReturnTo = safeReturnTo(config.defaultReturnTo, "/");
+    return {
+        clientId: config.clientId,
+        cipher,
+        store: config.store,
+        clock: config.clock ?? (() => new Date()),
+        fetchImpl,
+        oidc: createOidc({
+            issuer,
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            // http is allowed only for local mocks; real issuers must use https.
+            allowInsecure: isLoopbackHttp(new URL(issuer)),
+            fetchImpl,
+        }),
+        apiBaseUrl: config.apiBaseUrl ?? BEXIO_API_BASE_URL,
+        redirectUri,
+        scope: [...new Set([...BASE_SCOPES, ...(config.scopes ?? [])])].join(" "),
+        lockTtlMs,
+        defaultReturnTo,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAoB9C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE;;;GAGG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CAClC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,MAAwB;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK;QACf,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAEnE,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzE,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mCAAmC,eAAe,GAAG,IAAI,GAAG,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAElE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACzC,SAAS;QACT,IAAI,EAAE,UAAU,CAAC;YACf,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,qEAAqE;YACrE,aAAa,EAAE,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,SAAS;SACV,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,kBAAkB;QACnD,WAAW;QACX,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,SAAS;QACT,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/connect-flow.d.ts

@@ -0,0 +1,15 @@
+import type { ClientContext } from "./config.js";
+import type { CallbackOptions, CallbackResult } from "./types.js";
+/** `BexioOAuth.start`. */
+export declare function start(ctx: ClientContext, options: {
+    ownerId: string;
+    returnTo?: string;
+}): Promise<Response>;
+/** `BexioOAuth.handleCallback`. */
+export declare function handleCallback(ctx: ClientContext, request: Request, options: CallbackOptions): Promise<CallbackResult>;
+/**
+ * `BexioOAuth.callback`: reads the flow cookie once, so a failure can still
+ * redirect to the `returnTo` it recorded.
+ */
+export declare function callback(ctx: ClientContext, request: Request, options: CallbackOptions): Promise<Response>;
+//# sourceMappingURL=connect-flow.d.ts.map

package/dist/connect-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-flow.d.ts","sourceRoot":"","sources":["../src/connect-flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAajD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAElE,0BAA0B;AAC1B,wBAAsB,KAAK,CACzB,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAED,mCAAmC;AACnC,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAkBnB"}

package/dist/connect-flow.js

@@ -0,0 +1,123 @@
+import * as oidc from "openid-client";
+import { BexioOAuthError, isBexioOAuthError } from "./errors.js";
+import { FLOW_TTL_SECONDS, flowCookie, readFlow, sealFlow, } from "./flow-cookie.js";
+import { decodeIfJwt, saveTokens, toGrant, withUserInfo } from "./grants.js";
+import { describe } from "./oidc.js";
+import { tokenExpiry } from "./refresh.js";
+import { safeReturnTo } from "./return-to.js";
+/** `BexioOAuth.start`. */
+export async function start(ctx, options) {
+    if (!options?.ownerId)
+        throw new BexioOAuthError("invalid_config", "ownerId is required");
+    const returnTo = safeReturnTo(options.returnTo, ctx.defaultReturnTo);
+    const c = await ctx.oidc.config();
+    const verifier = oidc.randomPKCECodeVerifier();
+    const state = oidc.randomState();
+    const nonce = oidc.randomNonce();
+    const url = oidc.buildAuthorizationUrl(c, {
+        redirect_uri: ctx.redirectUri.href,
+        scope: ctx.scope,
+        code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
+        code_challenge_method: "S256",
+        state,
+        nonce,
+    });
+    const sealed = await sealFlow(ctx.cipher, { s: state, v: verifier, n: nonce, o: options.ownerId, r: returnTo }, ctx.clock());
+    const headers = new Headers({
+        Location: url.href,
+        "Cache-Control": "no-store",
+    });
+    headers.append("Set-Cookie", flowCookie(ctx.redirectUri, sealed, FLOW_TTL_SECONDS));
+    return new Response(null, { status: 302, headers });
+}
+/** `BexioOAuth.handleCallback`. */
+export async function handleCallback(ctx, request, options) {
+    assertCallbackOptions(options);
+    return completeCallback(ctx, request, options, await readFlow(ctx.cipher, request, ctx.clock()));
+}
+/**
+ * `BexioOAuth.callback`: reads the flow cookie once, so a failure can still
+ * redirect to the `returnTo` it recorded.
+ */
+export async function callback(ctx, request, options) {
+    const headers = new Headers({ "Cache-Control": "no-store" });
+    headers.append("Set-Cookie", flowCookie(ctx.redirectUri, "", 0));
+    const origin = ctx.redirectUri.origin;
+    assertCallbackOptions(options);
+    const flow = await readFlow(ctx.cipher, request, ctx.clock());
+    let location;
+    try {
+        const result = await completeCallback(ctx, request, options, flow);
+        location = new URL(result.returnTo, origin);
+    }
+    catch (error) {
+        if (!isBexioOAuthError(error) || error.code === "invalid_config")
+            throw error;
+        location = new URL(flow?.r ?? ctx.defaultReturnTo, origin);
+        location.searchParams.set("bexio_error", error.code);
+    }
+    headers.set("Location", location.href);
+    return new Response(null, { status: 302, headers });
+}
+function assertCallbackOptions(options) {
+    if (!options ||
+        ("ownerId" in options
+            ? !options.ownerId
+            : typeof options.authorizeOwner !== "function")) {
+        throw new BexioOAuthError("invalid_config", "pass ownerId or authorizeOwner");
+    }
+}
+/** The callback after the flow cookie was read (`flow` is null when unreadable). */
+async function completeCallback(ctx, request, options, flow) {
+    const params = new URL(request.url).searchParams;
+    if (!flow || params.get("state") !== flow.s) {
+        throw new BexioOAuthError("state_mismatch", "flow cookie missing or expired, or state mismatch");
+    }
+    const ownerAllowed = "ownerId" in options
+        ? flow.o === options.ownerId
+        : (await options.authorizeOwner(flow.o)) === true;
+    if (!ownerAllowed) {
+        throw new BexioOAuthError("owner_mismatch", "the signed-in user may not connect Bexio for the owner used at start");
+    }
+    const error = params.get("error");
+    if (error) {
+        throw new BexioOAuthError(error === "access_denied" ? "access_denied" : "idp_error", `Bexio returned ${error}`);
+    }
+    // Rebuild the URL on the registered redirect URI, so a proxy that rewrites
+    // the host doesn't change the redirect_uri sent to the token endpoint.
+    const currentUrl = new URL(ctx.redirectUri.href);
+    currentUrl.search = params.toString();
+    const c = await ctx.oidc.config();
+    let tokens;
+    try {
+        tokens = await oidc.authorizationCodeGrant(c, currentUrl, {
+            pkceCodeVerifier: flow.v,
+            expectedState: flow.s,
+            expectedNonce: flow.n,
+            idTokenExpected: true,
+        });
+    }
+    catch (cause) {
+        if (cause instanceof oidc.AuthorizationResponseError) {
+            throw new BexioOAuthError(cause.error === "access_denied" ? "access_denied" : "idp_error", `Bexio returned ${cause.error}`, { cause: describe(cause) });
+        }
+        if (cause instanceof TypeError) {
+            throw new BexioOAuthError("idp_error", "Bexio token endpoint unreachable", { cause: describe(cause) });
+        }
+        throw new BexioOAuthError("invalid_callback", "authorization code exchange or ID token validation failed", { cause: describe(cause) });
+    }
+    const now = ctx.clock();
+    const claims = await withUserInfo(ctx, { ...decodeIfJwt(tokens.access_token), ...(tokens.claims() ?? {}) }, tokens.access_token);
+    const record = await saveTokens(ctx, {
+        ownerId: flow.o,
+        claims,
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token ?? null,
+        ...tokenExpiry(tokens, now),
+        scope: tokens.scope ?? null,
+    });
+    const headers = new Headers();
+    headers.append("Set-Cookie", flowCookie(ctx.redirectUri, "", 0));
+    return { grant: toGrant(record), returnTo: flow.r, headers };
+}
+//# sourceMappingURL=connect-flow.js.map

package/dist/connect-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-flow.js","sourceRoot":"","sources":["../src/connect-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,QAAQ,GAET,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,WAAW,EAAsB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,0BAA0B;AAC1B,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,GAAkB,EAClB,OAA+C;IAE/C,IAAI,CAAC,OAAO,EAAE,OAAO;QACnB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE;QACxC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;QAC/D,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,GAAG,CAAC,MAAM,EACV,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EACpE,GAAG,CAAC,KAAK,EAAE,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,QAAQ,EAAE,GAAG,CAAC,IAAI;QAClB,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACtD,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,OAAgB,EAChB,OAAwB;IAExB,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,gBAAgB,CACrB,GAAG,EACH,OAAO,EACP,OAAO,EACP,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAkB,EAClB,OAAgB,EAChB,OAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;IACtC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnE,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAC9D,MAAM,KAAK,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC3D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAwB;IACrD,IACE,CAAC,OAAO;QACR,CAAC,SAAS,IAAI,OAAO;YACnB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;YAClB,CAAC,CAAC,OAAO,OAAO,CAAC,cAAc,KAAK,UAAU,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,gBAAgB,CAC7B,GAAkB,EAClB,OAAgB,EAChB,OAAwB,EACxB,IAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAChB,SAAS,IAAI,OAAO;QAClB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO;QAC5B,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CACvB,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EACzD,kBAAkB,KAAK,EAAE,CAC1B,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjD,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAEtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,UAAU,EAAE;YACxD,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACxB,aAAa,EAAE,IAAI,CAAC,CAAC;YACrB,aAAa,EAAE,IAAI,CAAC,CAAC;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CACvB,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EAC/D,kBAAkB,KAAK,CAAC,KAAK,EAAE,EAC/B,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,kCAAkC,EAClC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,2DAA2D,EAC3D,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,GAAG,EACH,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EACnE,MAAM,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACnC,OAAO,EAAE,IAAI,CAAC,CAAC;QACf,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC1C,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC"}

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA8B,UAAU,EAAE,MAAM,MAAM,CAAC;AAGnE;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAOD,2DAA2D;AAC3D,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAMD;;;;GAIG;AACH,qBAAa,WAAW;;gBAKV,OAAO,EAAE,OAAO;IA2BtB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW5D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtD,IAAI,CACR,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,MAAM,CAAC;IASlB,2EAA2E;IACrE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;CAwCnE"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA8B,UAAU,EAAE,MAAM,MAAM,CAAC;AAGnE;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAUD,2DAA2D;AAC3D,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAMD;;;;GAIG;AACH,qBAAa,WAAW;;gBAKV,OAAO,EAAE,OAAO;IA6BtB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW5D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtD,IAAI,CACR,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,MAAM,CAAC;IASlB,2EAA2E;IACrE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;CAyCnE"}

package/dist/crypto.js

@@ -5,6 +5,8 @@ const JWE_ALGORITHMS = {
     keyManagementAlgorithms: ["dir"],
     contentEncryptionAlgorithms: ["A256GCM"],
 };
+/** 32 bytes as unpadded base64url: exactly 43 characters of the base64url alphabet. */
+const KEY_FORMAT = /^[A-Za-z0-9_-]{43}$/;
 /** A new random key for the keyring, base64url-encoded. */
 export function generateKey() {
     return randomBytes(32).toString("base64url");
@@ -27,11 +29,13 @@ export class TokenCipher {
         }
         this.#keys = new Map();
         for (const [kid, encoded] of Object.entries(keyring.keys)) {
-            const bytes = Buffer.from(encoded, "base64url");
-            if (bytes.length !== 32) {
-                throw new BexioOAuthError("invalid_config", `key "${kid}" must be 32 bytes, base64url-encoded`);
+            // Strict: Buffer.from(…, "base64url") silently drops characters it
+            // doesn't know, so a mangled key could still "decode" to 32 bytes and
+            // then differ between environments.
+            if (typeof encoded !== "string" || !KEY_FORMAT.test(encoded)) {
+                throw new BexioOAuthError("invalid_config", `key "${kid}" must be 32 bytes, base64url-encoded without padding (43 characters)`);
             }
-            this.#keys.set(kid, new Uint8Array(bytes));
+            this.#keys.set(kid, new Uint8Array(Buffer.from(encoded, "base64url")));
         }
         if (!this.#keys.has(keyring.current)) {
             throw new BexioOAuthError("invalid_config", `keys.current "${keyring.current}" is not in keys`);
@@ -46,11 +50,11 @@ export class TokenCipher {
             kid: this.#current,
             bxg: hash(binding),
         })
-            .encrypt(this.#key(this.#current));
+            .encrypt(this.#key(this.#current).key);
     }
     async decrypt(jwe, binding) {
         try {
-            const { plaintext, protectedHeader } = await compactDecrypt(jwe, (header) => this.#key(header.kid), JWE_ALGORITHMS);
+            const { plaintext, protectedHeader } = await compactDecrypt(jwe, (header) => this.#key(header.kid).key, JWE_ALGORITHMS);
             if (protectedHeader.bxg !== hash(binding)) {
                 throw new Error("binding mismatch");
             }
@@ -81,15 +85,16 @@ export class TokenCipher {
             return null;
         }
     }
+    /** The key for `kid`, with `kid` narrowed to a known key id. */
     #key(kid) {
         const key = kid === undefined ? undefined : this.#keys.get(kid);
-        if (!key)
+        if (kid === undefined || !key)
             throw new Error("unknown key id");
-        return key;
+        return { kid, key };
     }
     // The flow cookie uses a key derived from the keyring, never the token key itself.
-    #flowKey(kid) {
-        const base = this.#key(kid);
+    #flowKey(requested) {
+        const { kid, key: base } = this.#key(requested);
         let derived = this.#flowKeys.get(kid);
         if (!derived) {
             derived = new Uint8Array(hkdfSync("sha256", base, new Uint8Array(0), "bexio-oauth/flow-cookie", 32));

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C,MAAM,cAAc,GAAG;IACrB,uBAAuB,EAAE,CAAC,KAAK,CAAC;IAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;CACzC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACb,QAAQ,CAAS;IACjB,KAAK,CAA0B;IAC/B,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEnD,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,QAAQ,GAAG,uCAAuC,CACnD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,iBAAiB,OAAO,CAAC,OAAO,kBAAkB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QAC9C,OAAO,IAAI,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;aAC3D,kBAAkB,CAAC;YAClB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;SACnB,CAAC;aACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAAe;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CACzD,GAAG,EACH,CAAC,MAAkC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAC7D,cAAc,CACf,CAAC;YACF,IAAI,eAAe,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAmB,EACnB,UAAkB,EAClB,GAAS;QAET,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;aAC3B,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;aACtE,WAAW,CAAC,UAAU,CAAC;aACvB,iBAAiB,CAAC,UAAU,GAAG,UAAU,CAAC;aAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,GAAS;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAClC,KAAK,EACL,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EACrC;gBACE,GAAG,cAAc;gBACjB,WAAW,EAAE,GAAG;aACjB,CACF,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAuB;QAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,GAAuB;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,UAAU,CACtB,QAAQ,CACN,QAAQ,EACR,IAAI,EACJ,IAAI,UAAU,CAAC,CAAC,CAAC,EACjB,yBAAyB,EACzB,EAAE,CACH,CACF,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAI,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C,MAAM,cAAc,GAAG;IACrB,uBAAuB,EAAE,CAAC,KAAK,CAAC;IAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;CACzC,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,GAAG,qBAAqB,CAAC;AAEzC,2DAA2D;AAC3D,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACb,QAAQ,CAAS;IACjB,KAAK,CAA0B;IAC/B,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEnD,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,QAAQ,GAAG,uEAAuE,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,iBAAiB,OAAO,CAAC,OAAO,kBAAkB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QAC9C,OAAO,IAAI,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;aAC3D,kBAAkB,CAAC;YAClB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;SACnB,CAAC;aACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAAe;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CACzD,GAAG,EACH,CAAC,MAAkC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EACjE,cAAc,CACf,CAAC;YACF,IAAI,eAAe,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAmB,EACnB,UAAkB,EAClB,GAAS;QAET,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;aAC3B,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;aACtE,WAAW,CAAC,UAAU,CAAC;aACvB,iBAAiB,CAAC,UAAU,GAAG,UAAU,CAAC;aAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,GAAS;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAClC,KAAK,EACL,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EACrC;gBACE,GAAG,cAAc;gBACjB,WAAW,EAAE,GAAG;aACjB,CACF,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,GAAuB;QAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,SAA6B;QACpC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,UAAU,CACtB,QAAQ,CACN,QAAQ,EACR,IAAI,EACJ,IAAI,UAAU,CAAC,CAAC,CAAC,EACjB,yBAAyB,EACzB,EAAE,CACH,CACF,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/external-tokens.d.ts

@@ -0,0 +1,8 @@
+import type { ClientContext } from "./config.js";
+import type { ExternalTokens, Grant } from "./types.js";
+/** `BexioOAuth.saveGrant`: verifies tokens from your auth framework, then stores them. */
+export declare function saveGrant(ctx: ClientContext, input: {
+    ownerId: string;
+    tokens: ExternalTokens;
+}): Promise<Grant>;
+//# sourceMappingURL=external-tokens.d.ts.map

package/dist/external-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-tokens.d.ts","sourceRoot":"","sources":["../src/external-tokens.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AA+CxD,0FAA0F;AAC1F,wBAAsB,SAAS,CAC7B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACjD,OAAO,CAAC,KAAK,CAAC,CAuDhB"}

package/dist/external-tokens.js

@@ -0,0 +1,73 @@
+import { errors as joseErrors, jwtVerify } from "jose";
+import { BexioOAuthError } from "./errors.js";
+import { saveTokens, toGrant, withUserInfo } from "./grants.js";
+import { describe } from "./oidc.js";
+const SIGNING_ALGORITHMS = ["RS256", "PS256", "ES256"];
+/**
+ * Verifies a token's signature against Bexio's keys, plus issuer, expiry and
+ * (when given) audience. Not getting the keys is `idp_error`; a token that
+ * fails a check is `invalid_callback`.
+ */
+async function verifyBexioJwt(ctx, token, issuer, audience) {
+    const keys = await ctx.oidc.keySet();
+    try {
+        const { payload } = await jwtVerify(token, keys, {
+            issuer,
+            audience,
+            algorithms: SIGNING_ALGORITHMS,
+            currentDate: ctx.clock(),
+        });
+        return payload;
+    }
+    catch (error) {
+        // Not getting Bexio's keys is an outage, not a bad token.
+        // (jose reports a bad JWKS response, e.g. a 503, as its generic error.)
+        if (error instanceof joseErrors.JWKSTimeout ||
+            error instanceof TypeError ||
+            (error instanceof joseErrors.JOSEError &&
+                error.code === "ERR_JOSE_GENERIC")) {
+            throw new BexioOAuthError("idp_error", "could not load Bexio's signing keys", { cause: describe(error) });
+        }
+        throw new BexioOAuthError("invalid_callback", "token signature, issuer or expiry check failed", { cause: describe(error) });
+    }
+}
+/** `BexioOAuth.saveGrant`: verifies tokens from your auth framework, then stores them. */
+export async function saveGrant(ctx, input) {
+    if (!input?.ownerId)
+        throw new BexioOAuthError("invalid_config", "ownerId is required");
+    const { tokens } = input;
+    if (!tokens?.accessToken)
+        throw new BexioOAuthError("invalid_config", "tokens.accessToken is required");
+    const issuer = (await ctx.oidc.config()).serverMetadata().issuer;
+    const accessClaims = await verifyBexioJwt(ctx, tokens.accessToken, issuer);
+    // Must be an access token issued to this app: rejects tokens issued to
+    // another client (token substitution) and ID tokens passed as access tokens.
+    if (accessClaims.azp !== ctx.clientId) {
+        throw new BexioOAuthError("invalid_callback", "access token was not issued to this client");
+    }
+    if (accessClaims.typ !== undefined && accessClaims.typ !== "Bearer") {
+        throw new BexioOAuthError("invalid_callback", "tokens.accessToken is not an access token");
+    }
+    const idClaims = tokens.idToken
+        ? await verifyBexioJwt(ctx, tokens.idToken, issuer, ctx.clientId)
+        : {};
+    if (tokens.idToken && idClaims.sub !== accessClaims.sub) {
+        throw new BexioOAuthError("invalid_callback", "ID token and access token belong to different users");
+    }
+    const claims = await withUserInfo(ctx, { ...accessClaims, ...idClaims }, tokens.accessToken);
+    const exp = typeof accessClaims.exp === "number"
+        ? new Date(accessClaims.exp * 1000)
+        : null;
+    const record = await saveTokens(ctx, {
+        ownerId: input.ownerId,
+        claims,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken ?? null,
+        accessExpiresAt: tokens.expiresAt ?? exp,
+        refreshExpiresAt: null,
+        scope: tokens.scope ??
+            (typeof accessClaims.scope === "string" ? accessClaims.scope : null),
+    });
+    return toGrant(record);
+}
+//# sourceMappingURL=external-tokens.js.map

package/dist/external-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-tokens.js","sourceRoot":"","sources":["../src/external-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEvD;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAkB,EAClB,KAAa,EACb,MAAc,EACd,QAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM;YACN,QAAQ;YACR,UAAU,EAAE,kBAAkB;YAC9B,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE;SACzB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0DAA0D;QAC1D,wEAAwE;QACxE,IACE,KAAK,YAAY,UAAU,CAAC,WAAW;YACvC,KAAK,YAAY,SAAS;YAC1B,CAAC,KAAK,YAAY,UAAU,CAAC,SAAS;gBACpC,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,qCAAqC,EACrC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gDAAgD,EAChD,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAkB,EAClB,KAAkD;IAElD,IAAI,CAAC,KAAK,EAAE,OAAO;QACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,MAAM,EAAE,WAAW;QACtB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;IACJ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO;QAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;QACjE,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,GAAG,EACH,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,EAChC,MAAM,CAAC,WAAW,CACnB,CAAC;IACF,MAAM,GAAG,GACP,OAAO,YAAY,CAAC,GAAG,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,eAAe,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;QACxC,gBAAgB,EAAE,IAAI;QACtB,KAAK,EACH,MAAM,CAAC,KAAK;YACZ,CAAC,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;KACvE,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC"}

package/dist/flow-cookie.d.ts

@@ -0,0 +1,23 @@
+import type { JWTPayload } from "jose";
+import type { TokenCipher } from "./crypto.js";
+/** The encrypted, short-lived cookie that carries the Connect flow's state. */
+export declare const FLOW_COOKIE = "bexio_oauth_flow";
+export declare const FLOW_TTL_SECONDS = 600;
+export interface FlowState extends JWTPayload {
+    /** state */ s: string;
+    /** PKCE verifier */ v: string;
+    /** nonce */ n: string;
+    /** ownerId */ o: string;
+    /** returnTo */ r: string;
+}
+/** The value of cookie `name` in the request's `Cookie` header, or `null`. */
+export declare function readCookie(request: Request, name: string): string | null;
+/**
+ * The `Set-Cookie` value for the flow cookie, scoped to the callback path.
+ * `Secure` whenever the redirect URI is https. `("", 0)` deletes it.
+ */
+export declare function flowCookie(redirectUri: URL, value: string, maxAge: number): string;
+export declare function sealFlow(cipher: TokenCipher, flow: FlowState, now: Date): Promise<string>;
+/** The request's flow state, or `null` when the cookie is missing, invalid or expired. */
+export declare function readFlow(cipher: TokenCipher, request: Request, now: Date): Promise<FlowState | null>;
+//# sourceMappingURL=flow-cookie.d.ts.map

package/dist/flow-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-cookie.d.ts","sourceRoot":"","sources":["../src/flow-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,+EAA+E;AAC/E,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUxE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,GAAG,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,MAAM,CAUR;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,0FAA0F;AAC1F,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAI3B"}

package/dist/flow-cookie.js

@@ -0,0 +1,44 @@
+/** The encrypted, short-lived cookie that carries the Connect flow's state. */
+export const FLOW_COOKIE = "bexio_oauth_flow";
+export const FLOW_TTL_SECONDS = 600;
+/** The value of cookie `name` in the request's `Cookie` header, or `null`. */
+export function readCookie(request, name) {
+    const header = request.headers.get("cookie");
+    if (!header)
+        return null;
+    for (const part of header.split(";")) {
+        const index = part.indexOf("=");
+        if (index === -1)
+            continue;
+        if (part.slice(0, index).trim() === name)
+            return part.slice(index + 1).trim();
+    }
+    return null;
+}
+/**
+ * The `Set-Cookie` value for the flow cookie, scoped to the callback path.
+ * `Secure` whenever the redirect URI is https. `("", 0)` deletes it.
+ */
+export function flowCookie(redirectUri, value, maxAge) {
+    const parts = [
+        `${FLOW_COOKIE}=${value}`,
+        `Path=${redirectUri.pathname}`,
+        `Max-Age=${maxAge}`,
+        "HttpOnly",
+        "SameSite=Lax",
+    ];
+    if (redirectUri.protocol === "https:")
+        parts.push("Secure");
+    return parts.join("; ");
+}
+export function sealFlow(cipher, flow, now) {
+    return cipher.seal(flow, FLOW_TTL_SECONDS, now);
+}
+/** The request's flow state, or `null` when the cookie is missing, invalid or expired. */
+export async function readFlow(cipher, request, now) {
+    const sealed = readCookie(request, FLOW_COOKIE);
+    if (!sealed)
+        return null;
+    return (await cipher.unseal(sealed, now));
+}
+//# sourceMappingURL=flow-cookie.js.map

package/dist/flow-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-cookie.js","sourceRoot":"","sources":["../src/flow-cookie.ts"],"names":[],"mappings":"AAGA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAUpC,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YACtC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,WAAgB,EAChB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAG;QACZ,GAAG,WAAW,IAAI,KAAK,EAAE;QACzB,QAAQ,WAAW,CAAC,QAAQ,EAAE;QAC9B,WAAW,MAAM,EAAE;QACnB,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,MAAmB,EACnB,IAAe,EACf,GAAS;IAET,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAmB,EACnB,OAAgB,EAChB,GAAS;IAET,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAqB,CAAC;AAChE,CAAC"}

package/dist/grants.d.ts

@@ -0,0 +1,36 @@
+import { type ClaimBag } from "./claims.js";
+import type { ClientContext } from "./config.js";
+import type { TokenCipher } from "./crypto.js";
+import type { GrantRecord, GrantStore } from "./store/types.js";
+import type { AccessToken, Grant, GrantSelector } from "./types.js";
+/** The app-facing view of a stored grant: no token material. */
+export declare function toGrant(r: GrantRecord): Grant;
+/** The binding a grant's ciphertexts are encrypted under. */
+export declare function bindingOf(record: GrantRecord): string;
+export declare function decryptFor(cipher: TokenCipher, record: GrantRecord, value: string): Promise<string>;
+/** Decrypts the grant's access token for the caller. */
+export declare function issue(cipher: TokenCipher, record: GrantRecord): Promise<AccessToken>;
+/** Exactly one grant of the owner, or `not_connected` / `ambiguous_grant`. */
+export declare function resolveGrant(store: GrantStore, selector: GrantSelector): Promise<GrantRecord>;
+/** The token's claims if it is a JWT, else none (Bexio access tokens usually are). */
+export declare function decodeIfJwt(token: string): ClaimBag;
+/**
+ * Adds userinfo claims, only when the tokens lack the company claims. Token
+ * claims win over userinfo; a userinfo failure keeps the token claims.
+ */
+export declare function withUserInfo(ctx: ClientContext, claims: ClaimBag, accessToken: string): Promise<ClaimBag>;
+/** Encrypts the tokens, reads the role and upserts the grant for the identity in `claims`. */
+export declare function saveTokens(ctx: ClientContext, input: {
+    ownerId: string;
+    claims: ClaimBag;
+    accessToken: string;
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+    scope: string | null;
+}): Promise<GrantRecord>;
+export declare function listGrants(store: GrantStore, query: {
+    ownerId: string;
+}): Promise<Grant[]>;
+export declare function disconnect(ctx: ClientContext, selector: GrantSelector): Promise<void>;
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEpE,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAkB7C;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAErD;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wDAAwD;AACxD,wBAAsB,KAAK,CACzB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,WAAW,CAAC,CAMtB;AAED,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,WAAW,CAAC,CAatB;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAMnD;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAYnB;AAED,8FAA8F;AAC9F,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACA,OAAO,CAAC,WAAW,CAAC,CAuBtB;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACzB,OAAO,CAAC,KAAK,EAAE,CAAC,CAIlB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAef"}