@tidecloak/js 0.13.14 → 0.13.15

package/dist/cjs/lib/tidecloak-dpop.js

@@ -0,0 +1,481 @@
+// @ts-nocheck
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _DPoPStoreManager_instances, _DPoPStoreManager_dbName, _DPoPStoreManager_db, _DPoPStoreManager_useMemoryFallback, _DPoPStoreManager_memoryStore, _DPoPStoreManager_issuer, _DPoPStoreManager_clientId, _DPoPStoreManager_strictStorage, _DPoPStoreManager_openDatabase, _DPoPSignatureProvider_instances, _DPoPSignatureProvider_alg, _DPoPSignatureProvider_store, _DPoPSignatureProvider_serverAllowedAlgorithms, _DPoPSignatureProvider_resourceNonces, _DPoPSignatureProvider_generateKeyPair, _DPoPSignatureProvider_sign;
+/** @enum {string} */
+export const BrowserSignatureAlgs = {
+    ES256: 'ES256',
+    ES384: 'ES384',
+    ES512: 'ES512',
+    EdDSA: 'EdDSA'
+};
+const DB_VERSION = 1;
+const STORE_NAME = 'main';
+const STATE_KEY = 'dpopState';
+/** @type {Record<string, EcKeyGenParams | AlgorithmIdentifier>} */
+const KEY_GEN_PARAMS = {
+    ES256: { name: 'ECDSA', namedCurve: 'P-256' },
+    ES384: { name: 'ECDSA', namedCurve: 'P-384' },
+    ES512: { name: 'ECDSA', namedCurve: 'P-521' },
+    EdDSA: { name: 'Ed25519' }
+};
+/** @type {Record<string, EcdsaParams | AlgorithmIdentifier>} */
+const SIGN_PARAMS = {
+    ES256: { name: 'ECDSA', hash: 'SHA-256' },
+    ES384: { name: 'ECDSA', hash: 'SHA-384' },
+    ES512: { name: 'ECDSA', hash: 'SHA-512' },
+    EdDSA: { name: 'Ed25519' }
+};
+/** Fallback order when EdDSA is unsupported */
+const ECDSA_FALLBACK_ORDER = [
+    BrowserSignatureAlgs.ES256,
+    BrowserSignatureAlgs.ES384,
+    BrowserSignatureAlgs.ES512
+];
+/**
+ * Creates a safe database name from issuer and clientId.
+ * Uses SHA-256 hash of both issuer and clientId to avoid special characters
+ * and prevent injection attacks via malicious clientId values.
+ * @param {string} issuer - The authorization server issuer URL
+ * @param {string} clientId - The OIDC client identifier
+ * @returns {Promise<string>} A sanitized database name
+ */
+async function createDbName(issuer, clientId) {
+    const encoder = new TextEncoder();
+    // Hash issuer
+    const issuerData = encoder.encode(issuer);
+    const issuerHashBuffer = await crypto.subtle.digest('SHA-256', issuerData);
+    const issuerHashArray = new Uint8Array(issuerHashBuffer);
+    const issuerHash = Array.from(issuerHashArray.slice(0, 8))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+    // Hash clientId to prevent special character issues and injection
+    const clientData = encoder.encode(clientId);
+    const clientHashBuffer = await crypto.subtle.digest('SHA-256', clientData);
+    const clientHashArray = new Uint8Array(clientHashBuffer);
+    const clientHash = Array.from(clientHashArray.slice(0, 8))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+    return `dpop:${issuerHash}:${clientHash}`;
+}
+/**
+ * Manages persistent storage of DPoP key pairs and nonces in IndexedDB.
+ * Falls back to in-memory storage when IndexedDB is unavailable.
+ *
+ * Database is named using a hash of the issuer URL + clientId to ensure
+ * isolation between different authorization servers.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9449
+ */
+class DPoPStoreManager {
+    /**
+     * @param {string} issuer - The authorization server issuer URL
+     * @param {string} clientId - The OIDC client identifier
+     * @param {boolean} [strictStorage=false] - If true, throws error when IndexedDB is unavailable instead of falling back to memory
+     */
+    constructor(issuer, clientId, strictStorage = false) {
+        _DPoPStoreManager_instances.add(this);
+        /** @type {string} */
+        _DPoPStoreManager_dbName.set(this, ''
+        /** @type {IDBDatabase | null} */
+        );
+        /** @type {IDBDatabase | null} */
+        _DPoPStoreManager_db.set(this, null
+        /** @type {boolean} */
+        );
+        /** @type {boolean} */
+        _DPoPStoreManager_useMemoryFallback.set(this, false
+        /** @type {DPoPState | undefined} */
+        );
+        /** @type {DPoPState | undefined} */
+        _DPoPStoreManager_memoryStore.set(this, undefined
+        /** @type {string} */
+        );
+        /** @type {string} */
+        _DPoPStoreManager_issuer.set(this, void 0);
+        /** @type {string} */
+        _DPoPStoreManager_clientId.set(this, void 0);
+        /** @type {boolean} */
+        _DPoPStoreManager_strictStorage.set(this, void 0);
+        __classPrivateFieldSet(this, _DPoPStoreManager_issuer, issuer, "f");
+        __classPrivateFieldSet(this, _DPoPStoreManager_clientId, clientId, "f");
+        __classPrivateFieldSet(this, _DPoPStoreManager_strictStorage, strictStorage, "f");
+    }
+    /**
+     * Initialize the store manager. Must be called before other operations.
+     * @returns {Promise<DPoPStoreManager>}
+     */
+    async init() {
+        if (__classPrivateFieldGet(this, _DPoPStoreManager_db, "f") || __classPrivateFieldGet(this, _DPoPStoreManager_useMemoryFallback, "f")) {
+            return this; // Already initialized
+        }
+        try {
+            __classPrivateFieldSet(this, _DPoPStoreManager_dbName, await createDbName(__classPrivateFieldGet(this, _DPoPStoreManager_issuer, "f"), __classPrivateFieldGet(this, _DPoPStoreManager_clientId, "f")), "f");
+            __classPrivateFieldSet(this, _DPoPStoreManager_db, await __classPrivateFieldGet(this, _DPoPStoreManager_instances, "m", _DPoPStoreManager_openDatabase).call(this), "f");
+        }
+        catch (error) {
+            if (__classPrivateFieldGet(this, _DPoPStoreManager_strictStorage, "f")) {
+                throw new Error('DPoP requires IndexedDB for secure key storage, but it is unavailable.', { cause: error });
+            }
+            console.warn('[KEYCLOAK] IndexedDB unavailable, falling back to in-memory storage:', error);
+            __classPrivateFieldSet(this, _DPoPStoreManager_useMemoryFallback, true, "f");
+        }
+        return this;
+    }
+    /**
+     * Retrieve the stored key pair and nonce.
+     * @returns {Promise<DPoPState | undefined>}
+     */
+    async get() {
+        if (__classPrivateFieldGet(this, _DPoPStoreManager_useMemoryFallback, "f")) {
+            return __classPrivateFieldGet(this, _DPoPStoreManager_memoryStore, "f");
+        }
+        if (!__classPrivateFieldGet(this, _DPoPStoreManager_db, "f")) {
+            throw new Error('DPoPStoreManager not initialized. Call init() first.');
+        }
+        return new Promise((resolve, reject) => {
+            const transaction = /** @type {IDBDatabase} */ (__classPrivateFieldGet(this, _DPoPStoreManager_db, "f")).transaction(STORE_NAME, 'readonly');
+            const store = transaction.objectStore(STORE_NAME);
+            const request = store.get(STATE_KEY);
+            request.onerror = () => {
+                reject(request.error);
+            };
+            request.onsuccess = () => {
+                resolve(request.result);
+            };
+        });
+    }
+    /**
+     * Store or overwrite the key pair and optional nonce.
+     * @param {DPoPState} state - The state to store
+     * @returns {Promise<void>}
+     */
+    async set(state) {
+        if (__classPrivateFieldGet(this, _DPoPStoreManager_useMemoryFallback, "f")) {
+            __classPrivateFieldSet(this, _DPoPStoreManager_memoryStore, state, "f");
+            return;
+        }
+        if (!__classPrivateFieldGet(this, _DPoPStoreManager_db, "f")) {
+            throw new Error('DPoPStoreManager not initialized. Call init() first.');
+        }
+        return new Promise((resolve, reject) => {
+            const transaction = /** @type {IDBDatabase} */ (__classPrivateFieldGet(this, _DPoPStoreManager_db, "f")).transaction(STORE_NAME, 'readwrite');
+            const store = transaction.objectStore(STORE_NAME);
+            const request = store.put(state, STATE_KEY);
+            request.onerror = () => {
+                reject(request.error);
+            };
+            request.onsuccess = () => {
+                resolve();
+            };
+        });
+    }
+    /**
+     * Delete all stored data. Called on logout.
+     * @returns {Promise<void>}
+     */
+    async flush() {
+        if (__classPrivateFieldGet(this, _DPoPStoreManager_useMemoryFallback, "f")) {
+            __classPrivateFieldSet(this, _DPoPStoreManager_memoryStore, undefined, "f");
+            return;
+        }
+        if (!__classPrivateFieldGet(this, _DPoPStoreManager_db, "f")) {
+            throw new Error('DPoPStoreManager not initialized. Call init() first.');
+        }
+        return new Promise((resolve, reject) => {
+            const transaction = /** @type {IDBDatabase} */ (__classPrivateFieldGet(this, _DPoPStoreManager_db, "f")).transaction(STORE_NAME, 'readwrite');
+            const store = transaction.objectStore(STORE_NAME);
+            const request = store.delete(STATE_KEY);
+            request.onerror = () => {
+                reject(request.error);
+            };
+            request.onsuccess = () => {
+                resolve();
+            };
+        });
+    }
+    /**
+     * Update only the nonce while preserving existing keys.
+     * Convenience method for handling DPoP-Nonce header responses.
+     * @param {string} nonce - The new nonce from the authorization server
+     * @returns {Promise<void>}
+     * @throws {Error} If nonce fails validation
+     */
+    async updateNonce(nonce) {
+        // Validate nonce to prevent DoS and injection attacks
+        const MAX_NONCE_LENGTH = 512;
+        // RFC 9449 doesn't specify format, but nonces should be printable ASCII for HTTP headers
+        const VALID_NONCE_PATTERN = /^[\x21-\x7E]+$/;
+        if (typeof nonce !== 'string' || nonce.length === 0) {
+            throw new Error('DPoP nonce must be a non-empty string');
+        }
+        if (nonce.length > MAX_NONCE_LENGTH) {
+            throw new Error(`DPoP nonce exceeds maximum length of ${MAX_NONCE_LENGTH} characters`);
+        }
+        if (!VALID_NONCE_PATTERN.test(nonce)) {
+            throw new Error('DPoP nonce contains invalid characters');
+        }
+        const state = await this.get();
+        if (state) {
+            state.nonce = nonce;
+            await this.set(state);
+        }
+    }
+    /**
+     * Close the database connection.
+     */
+    close() {
+        if (__classPrivateFieldGet(this, _DPoPStoreManager_db, "f")) {
+            __classPrivateFieldGet(this, _DPoPStoreManager_db, "f").close();
+            __classPrivateFieldSet(this, _DPoPStoreManager_db, null, "f");
+        }
+    }
+}
+_DPoPStoreManager_dbName = new WeakMap(), _DPoPStoreManager_db = new WeakMap(), _DPoPStoreManager_useMemoryFallback = new WeakMap(), _DPoPStoreManager_memoryStore = new WeakMap(), _DPoPStoreManager_issuer = new WeakMap(), _DPoPStoreManager_clientId = new WeakMap(), _DPoPStoreManager_strictStorage = new WeakMap(), _DPoPStoreManager_instances = new WeakSet(), _DPoPStoreManager_openDatabase = function _DPoPStoreManager_openDatabase() {
+    return new Promise((resolve, reject) => {
+        if (typeof indexedDB === 'undefined') {
+            reject(new Error('IndexedDB is not available'));
+            return;
+        }
+        const request = indexedDB.open(__classPrivateFieldGet(this, _DPoPStoreManager_dbName, "f"), DB_VERSION);
+        request.onerror = () => {
+            reject(request.error);
+        };
+        request.onsuccess = () => {
+            resolve(request.result);
+        };
+        request.onupgradeneeded = (event) => {
+            /** @type {IDBDatabase} */
+            const db = /** @type {IDBOpenDBRequest} */ (event.target).result;
+            const oldVersion = event.oldVersion;
+            // Version 0 -> 1: Initial schema creation
+            if (oldVersion < 1) {
+                db.createObjectStore(STORE_NAME);
+            }
+            // Future migrations:
+            // if (oldVersion < 2) {
+            //   // Example: Add an index to the store
+            //   const store = event.target.transaction.objectStore(STORE_NAME)
+            //   store.createIndex('indexName', 'keyPath')
+            // }
+        };
+    });
+};
+export class DPoPSignatureProvider {
+    /**
+     * @param {DPoPSignatureProviderOptions} options
+     */
+    constructor(options) {
+        _DPoPSignatureProvider_instances.add(this);
+        /**@type {BrowserSignatureAlgs} */
+        _DPoPSignatureProvider_alg.set(this, void 0);
+        /**@type {DPoPStoreManager} */
+        _DPoPSignatureProvider_store.set(this, void 0);
+        /** @type {string[]} */
+        _DPoPSignatureProvider_serverAllowedAlgorithms.set(this, void 0);
+        /** @type {Map<string, string>} Resource server nonces keyed by origin */
+        _DPoPSignatureProvider_resourceNonces.set(this, new Map());
+        const { issuerUrl, clientId, serverSupportedAlgorithms, requestedAlgorithm, strictStorage = false } = options;
+        // Check for Web Crypto API availability
+        if (typeof crypto === 'undefined' || !crypto.subtle) {
+            throw new Error('DPoP requires Web Crypto API (crypto.subtle) which is not available in this environment.');
+        }
+        // Validate required options
+        if (!issuerUrl) {
+            throw new Error('DPoP requires issuerUrl');
+        }
+        if (!clientId) {
+            throw new Error('DPoP requires clientId');
+        }
+        if (!serverSupportedAlgorithms || !Array.isArray(serverSupportedAlgorithms)) {
+            throw new Error('DPoP requires serverSupportedAlgorithms array');
+        }
+        __classPrivateFieldSet(this, _DPoPSignatureProvider_serverAllowedAlgorithms, serverSupportedAlgorithms, "f");
+        let chosenAlgorithm = BrowserSignatureAlgs.ES256; // default value (due to high availability in browsers)
+        if (requestedAlgorithm !== undefined) {
+            // Check to see if requestedAlgorithm is supported by the server
+            if (!__classPrivateFieldGet(this, _DPoPSignatureProvider_serverAllowedAlgorithms, "f").includes(requestedAlgorithm)) {
+                throw new Error(`Requested algorithm '${requestedAlgorithm}' is not supported by the server. Server supports: ${__classPrivateFieldGet(this, _DPoPSignatureProvider_serverAllowedAlgorithms, "f").join(', ')}`);
+            }
+            chosenAlgorithm = requestedAlgorithm;
+        }
+        __classPrivateFieldSet(this, _DPoPSignatureProvider_alg, chosenAlgorithm, "f");
+        __classPrivateFieldSet(this, _DPoPSignatureProvider_store, new DPoPStoreManager(issuerUrl.toString(), clientId, strictStorage), "f");
+    }
+    async init() {
+        await __classPrivateFieldGet(this, _DPoPSignatureProvider_store, "f").init();
+        // Check for existing keys or generate new ones
+        let state = await __classPrivateFieldGet(this, _DPoPSignatureProvider_store, "f").get();
+        if (!state) {
+            const keys = await __classPrivateFieldGet(this, _DPoPSignatureProvider_instances, "m", _DPoPSignatureProvider_generateKeyPair).call(this);
+            state = { keys };
+            await __classPrivateFieldGet(this, _DPoPSignatureProvider_store, "f").set(state);
+        }
+    }
+    /**
+     * Clear all stored DPoP state (keys and nonce) for this client. Called on logout.
+     * Only affects the keys for this specific issuer+clientId combination.
+     * @returns {Promise<void>}
+     */
+    async flush() {
+        await __classPrivateFieldGet(this, _DPoPSignatureProvider_store, "f").flush();
+    }
+    /**
+     * Get the stored authorization server nonce.
+     * @returns {Promise<string | undefined>}
+     */
+    async getAuthServerNonce() {
+        const state = await __classPrivateFieldGet(this, _DPoPSignatureProvider_store, "f").get();
+        return state === null || state === void 0 ? void 0 : state.nonce;
+    }
+    /**
+     * Update the authorization server nonce. Called after receiving DPoP-Nonce header.
+     * @param {string} nonce
+     * @returns {Promise<void>}
+     */
+    async updateAuthServerNonce(nonce) {
+        await __classPrivateFieldGet(this, _DPoPSignatureProvider_store, "f").updateNonce(nonce);
+    }
+    /**
+     * Get the stored resource server nonce for a given origin.
+     * @param {string} origin - The resource server origin (e.g., "https://api.example.com")
+     * @returns {string | undefined} The stored nonce, or undefined if none exists
+     */
+    getResourceServerNonce(origin) {
+        return __classPrivateFieldGet(this, _DPoPSignatureProvider_resourceNonces, "f").get(origin);
+    }
+    /**
+     * Update the resource server nonce for a given origin. Called after receiving DPoP-Nonce header.
+     * Silently ignores invalid nonces to prevent DoS attacks.
+     * @param {string} origin - The resource server origin
+     * @param {string} nonce - The nonce from the DPoP-Nonce response header
+     */
+    updateResourceServerNonce(origin, nonce) {
+        // Validate nonce to prevent DoS and injection attacks
+        const MAX_NONCE_LENGTH = 512;
+        const VALID_NONCE_PATTERN = /^[\x21-\x7E]+$/;
+        if (typeof nonce !== 'string' || nonce.length === 0)
+            return;
+        if (nonce.length > MAX_NONCE_LENGTH)
+            return;
+        if (!VALID_NONCE_PATTERN.test(nonce))
+            return;
+        __classPrivateFieldGet(this, _DPoPSignatureProvider_resourceNonces, "f").set(origin, nonce);
+    }
+    /**
+     * @param {string} url
+     * @param {string} httpMethod
+     * @param {string} [accessToken] Access token if calling resource server
+     * @param {string} [nonce] Server-provided nonce
+     * @returns {Promise<string>}
+     */
+    async generateDPoPProof(url, httpMethod, accessToken, nonce) {
+        const payload = {
+            jti: crypto.randomUUID(),
+            htm: httpMethod,
+            htu: (() => {
+                const urlObj = new URL(url);
+                return urlObj.origin + urlObj.pathname;
+            })(),
+            iat: Math.floor(Date.now() / 1000), // TODO - Get server time here instead of local time
+            ...(accessToken !== undefined && {
+                ath: base64UrlEncodeBuffer(await sha256Digest(accessToken))
+            }),
+            ...(nonce !== undefined && { nonce })
+        };
+        const state = await __classPrivateFieldGet(this, _DPoPSignatureProvider_store, "f").get();
+        if (state === undefined)
+            throw new Error('DPoP not initialized');
+        const exportedJwk = await crypto.subtle.exportKey("jwk", state.keys.publicKey);
+        const header = {
+            alg: __classPrivateFieldGet(this, _DPoPSignatureProvider_alg, "f"),
+            typ: "dpop+jwt",
+            // Note: `y` is undefined for EdDSA/OKP keys (RFC 8037) but present for EC keys.
+            // JSON.stringify omits undefined values, so this produces valid JWKs for both.
+            jwk: {
+                crv: exportedJwk.crv,
+                kty: exportedJwk.kty,
+                x: exportedJwk.x,
+                y: exportedJwk.y
+            }
+        };
+        const te = new TextEncoder();
+        const unsignedToken = `${base64UrlEncodeBuffer(te.encode(JSON.stringify(header)))}.${base64UrlEncodeBuffer(te.encode(JSON.stringify(payload)))}`;
+        const signature = await __classPrivateFieldGet(this, _DPoPSignatureProvider_instances, "m", _DPoPSignatureProvider_sign).call(this, te.encode(unsignedToken), state.keys.privateKey);
+        return `${unsignedToken}.${base64UrlEncodeBuffer(signature)}`;
+    }
+}
+_DPoPSignatureProvider_alg = new WeakMap(), _DPoPSignatureProvider_store = new WeakMap(), _DPoPSignatureProvider_serverAllowedAlgorithms = new WeakMap(), _DPoPSignatureProvider_resourceNonces = new WeakMap(), _DPoPSignatureProvider_instances = new WeakSet(), _DPoPSignatureProvider_generateKeyPair = 
+/**
+ * @returns {Promise<CryptoKeyPair>}
+ */
+async function _DPoPSignatureProvider_generateKeyPair() {
+    const params = KEY_GEN_PARAMS[__classPrivateFieldGet(this, _DPoPSignatureProvider_alg, "f")];
+    if (!params) {
+        throw new Error(`Unknown signature algorithm: ${__classPrivateFieldGet(this, _DPoPSignatureProvider_alg, "f")}`);
+    }
+    try {
+        return /** @type {CryptoKeyPair} */ (await crypto.subtle.generateKey(params, false, ['sign']));
+    }
+    catch (ex) {
+        if (!(ex instanceof DOMException && ex.name === 'NotSupportedError')) {
+            throw ex;
+        }
+        // Only EdDSA needs fallback; ECDSA is universally supported
+        if (__classPrivateFieldGet(this, _DPoPSignatureProvider_alg, "f") !== BrowserSignatureAlgs.EdDSA) {
+            throw ex;
+        }
+        // Find the next available algorithm that both the browser and server support
+        const fallback = ECDSA_FALLBACK_ORDER.find(alg => __classPrivateFieldGet(this, _DPoPSignatureProvider_serverAllowedAlgorithms, "f").includes(alg));
+        if (!fallback) {
+            throw new Error('No supported algorithm available in this browser');
+        }
+        __classPrivateFieldSet(this, _DPoPSignatureProvider_alg, fallback, "f");
+        return __classPrivateFieldGet(this, _DPoPSignatureProvider_instances, "m", _DPoPSignatureProvider_generateKeyPair).call(this);
+    }
+}, _DPoPSignatureProvider_sign = 
+/**
+ * @param {Uint8Array<ArrayBuffer>} msg
+ * @param {CryptoKey} key
+ * @returns {Promise<ArrayBuffer>}
+ */
+async function _DPoPSignatureProvider_sign(msg, key) {
+    const params = SIGN_PARAMS[__classPrivateFieldGet(this, _DPoPSignatureProvider_alg, "f")];
+    if (!params) {
+        throw new Error(`Unknown signature algorithm: ${__classPrivateFieldGet(this, _DPoPSignatureProvider_alg, "f")}`);
+    }
+    return await crypto.subtle.sign(params, key, msg);
+};
+/**
+ * @param {string} message
+ * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest#basic_example
+ */
+async function sha256Digest(message) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(message);
+    if (typeof crypto === 'undefined' || typeof crypto.subtle === 'undefined') {
+        throw new Error('Web Crypto API is not available.');
+    }
+    return await crypto.subtle.digest('SHA-256', data);
+}
+/**
+ * @param {ArrayBuffer | Uint8Array} buffer
+ */
+function base64UrlEncodeBuffer(buffer) {
+    const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+    const binary = String.fromCharCode(...bytes);
+    return btoa(binary)
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replaceAll('=', '');
+}
+//# sourceMappingURL=tidecloak-dpop.js.map

package/dist/cjs/lib/tidecloak-dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tidecloak-dpop.js","sourceRoot":"","sources":["../../../lib/tidecloak-dpop.js"],"names":[],"mappings":"AAAA,cAAc;;;;;;;;;;;;;AAEd,qBAAqB;AACrB,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;CACf,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,CAAA;AACpB,MAAM,UAAU,GAAG,MAAM,CAAA;AACzB,MAAM,SAAS,GAAG,WAAW,CAAA;AAE7B,mEAAmE;AACnE,MAAM,cAAc,GAAG;IACrB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE;IAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE;IAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE;IAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAC3B,CAAA;AAED,gEAAgE;AAChE,MAAM,WAAW,GAAG;IAClB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;IACzC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;IACzC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;IACzC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAC3B,CAAA;AAED,+CAA+C;AAC/C,MAAM,oBAAoB,GAAG;IAC3B,oBAAoB,CAAC,KAAK;IAC1B,oBAAoB,CAAC,KAAK;IAC1B,oBAAoB,CAAC,KAAK;CAC3B,CAAA;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CAAC,MAAM,EAAE,QAAQ;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IAEjC,cAAc;IACd,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,eAAe,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEX,kEAAkE;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,eAAe,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEX,OAAO,QAAQ,UAAU,IAAI,UAAU,EAAE,CAAA;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,gBAAgB;IAsBpB;;;;OAIG;IACH,YAAY,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,KAAK;;QA1BnD,qBAAqB;QACrB,mCAAU,EAAE;QAEZ,iCAAiC;UAFrB;QAEZ,iCAAiC;QACjC,+BAAM,IAAI;QAEV,sBAAsB;UAFZ;QAEV,sBAAsB;QACtB,8CAAqB,KAAK;QAE1B,oCAAoC;UAFV;QAE1B,oCAAoC;QACpC,wCAAe,SAAS;QAExB,qBAAqB;UAFG;QAExB,qBAAqB;QACrB,2CAAO;QAEP,qBAAqB;QACrB,6CAAS;QAET,sBAAsB;QACtB,kDAAc;QAQZ,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAA;QACrB,uBAAA,IAAI,8BAAa,QAAQ,MAAA,CAAA;QACzB,uBAAA,IAAI,mCAAkB,aAAa,MAAA,CAAA;IACrC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,uBAAA,IAAI,4BAAI,IAAI,uBAAA,IAAI,2CAAmB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAA,CAAC,sBAAsB;QACpC,CAAC;QAED,IAAI,CAAC;YACH,uBAAA,IAAI,4BAAW,MAAM,YAAY,CAAC,uBAAA,IAAI,gCAAQ,EAAE,uBAAA,IAAI,kCAAU,CAAC,MAAA,CAAA;YAC/D,uBAAA,IAAI,wBAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,CAAgB,MAAA,CAAA;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,uBAAA,IAAI,uCAAe,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,wEAAwE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YAC7G,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,sEAAsE,EAAE,KAAK,CAAC,CAAA;YAC3F,uBAAA,IAAI,uCAAsB,IAAI,MAAA,CAAA;QAChC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IA2CD;;;OAGG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,uBAAA,IAAI,2CAAmB,EAAE,CAAC;YAC5B,OAAO,uBAAA,IAAI,qCAAa,CAAA;QAC1B,CAAC;QAED,IAAI,CAAC,uBAAA,IAAI,4BAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,WAAW,GAAG,0BAA0B,CAAC,CAAC,uBAAA,IAAI,4BAAI,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAC7F,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAEpC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE;gBACrB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACvB,CAAC,CAAA;YAED,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;gBACvB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACzB,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAK;QACb,IAAI,uBAAA,IAAI,2CAAmB,EAAE,CAAC;YAC5B,uBAAA,IAAI,iCAAgB,KAAK,MAAA,CAAA;YACzB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,uBAAA,IAAI,4BAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,WAAW,GAAG,0BAA0B,CAAC,CAAC,uBAAA,IAAI,4BAAI,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;YAC9F,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YAE3C,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE;gBACrB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACvB,CAAC,CAAA;YAED,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;gBACvB,OAAO,EAAE,CAAA;YACX,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,uBAAA,IAAI,2CAAmB,EAAE,CAAC;YAC5B,uBAAA,IAAI,iCAAgB,SAAS,MAAA,CAAA;YAC7B,OAAM;QACR,CAAC;QAED,IAAI,CAAC,uBAAA,IAAI,4BAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,WAAW,GAAG,0BAA0B,CAAC,CAAC,uBAAA,IAAI,4BAAI,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;YAC9F,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAEvC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE;gBACrB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACvB,CAAC,CAAA;YAED,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;gBACvB,OAAO,EAAE,CAAA;YACX,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,KAAK;QACrB,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,GAAG,CAAA;QAC5B,yFAAyF;QACzF,MAAM,mBAAmB,GAAG,gBAAgB,CAAA;QAE5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,wCAAwC,gBAAgB,aAAa,CAAC,CAAA;QACxF,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;QAC9B,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;YACnB,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,uBAAA,IAAI,4BAAI,EAAE,CAAC;YACb,uBAAA,IAAI,4BAAI,CAAC,KAAK,EAAE,CAAA;YAChB,uBAAA,IAAI,wBAAO,IAAI,MAAA,CAAA;QACjB,CAAC;IACH,CAAC;CACF;;IAlKG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAA;YAC/C,OAAM;QACR,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,uBAAA,IAAI,gCAAQ,EAAE,UAAU,CAAC,CAAA;QAExD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE;YACrB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACvB,CAAC,CAAA;QAED,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC,CAAA;QAED,OAAO,CAAC,eAAe,GAAG,CAAC,KAAK,EAAE,EAAE;YAClC,0BAA0B;YAC1B,MAAM,EAAE,GAAG,+BAA+B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;YAChE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;YAEnC,0CAA0C;YAC1C,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnB,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAClC,CAAC;YAED,qBAAqB;YACrB,wBAAwB;YACxB,0CAA0C;YAC1C,mEAAmE;YACnE,8CAA8C;YAC9C,IAAI;QACN,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAkIH,MAAM,OAAO,qBAAqB;IAShC;;OAEG;IACH,YAAY,OAAO;;QAXnB,kCAAkC;QAClC,6CAAK;QACL,8BAA8B;QAC9B,+CAAO;QACP,uBAAuB;QACvB,iEAAyB;QACzB,yEAAyE;QACzE,gDAAkB,IAAI,GAAG,EAAE,EAAC;QAK1B,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GAAG,KAAK,EACtB,GAAG,OAAO,CAAC;QAEZ,wCAAwC;QACxC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC9G,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,yBAAyB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,uBAAA,IAAI,kDAA4B,yBAAyB,MAAA,CAAC;QAE1D,IAAI,eAAe,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,uDAAuD;QAEzG,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,gEAAgE;YAChE,IAAI,CAAC,uBAAA,IAAI,sDAAyB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,kBAAkB,sDAAsD,uBAAA,IAAI,sDAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9J,CAAC;YAED,eAAe,GAAG,kBAAkB,CAAA;QACtC,CAAC;QAED,uBAAA,IAAI,8BAAQ,eAAe,MAAA,CAAC;QAE5B,uBAAA,IAAI,gCAAU,IAAI,gBAAgB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAA,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,uBAAA,IAAI,oCAAO,CAAC,IAAI,EAAE,CAAC;QAEzB,+CAA+C;QAC/C,IAAI,KAAK,GAAG,MAAM,uBAAA,IAAI,oCAAO,CAAC,GAAG,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,gFAAiB,MAArB,IAAI,CAAmB,CAAA;YAC1C,KAAK,GAAG,EAAE,IAAI,EAAE,CAAA;YAChB,MAAM,uBAAA,IAAI,oCAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IA+CD;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,uBAAA,IAAI,oCAAO,CAAC,KAAK,EAAE,CAAA;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,KAAK,GAAG,MAAM,uBAAA,IAAI,oCAAO,CAAC,GAAG,EAAE,CAAA;QACrC,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAA;IACrB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAAK;QAC/B,MAAM,uBAAA,IAAI,oCAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED;;;;OAIG;IACH,sBAAsB,CAAC,MAAM;QAC3B,OAAO,uBAAA,IAAI,6CAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,MAAM,EAAE,KAAK;QACrC,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,GAAG,CAAA;QAC5B,MAAM,mBAAmB,GAAG,gBAAgB,CAAA;QAE5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;YAAE,OAAM;QAC3C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAM;QAE5C,uBAAA,IAAI,6CAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK;QACzD,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,CAAC,GAAG,EAAE;gBACP,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,OAAO,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,EAAE;YACJ,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,oDAAoD;YAExF,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI;gBAC7B,GAAG,EAAE,qBAAqB,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;aAC9D,CAAC;YAEF,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;SACxC,CAAA;QAED,MAAM,KAAK,GAAG,MAAM,uBAAA,IAAI,oCAAO,CAAC,GAAG,EAAE,CAAA;QACrC,IAAG,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QAC/D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG;YACX,GAAG,EAAE,uBAAA,IAAI,kCAAK;YACd,GAAG,EAAE,UAAU;YACf,gFAAgF;YAChF,+EAA+E;YAC/E,GAAG,EAAE;gBACD,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,CAAC,EAAE,WAAW,CAAC,CAAC;gBAChB,CAAC,EAAE,WAAW,CAAC,CAAC;aACnB;SACJ,CAAC;QAEF,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,GAAG,qBAAqB,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QAChJ,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,qEAAM,MAAV,IAAI,EAAO,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpF,OAAO,GAAG,aAAa,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAA;IAC/D,CAAC;CACF;;AAhJC;;GAEG;AACH,KAAK;IACH,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAA,IAAI,kCAAK,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,uBAAA,IAAI,kCAAK,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,CAClC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CACzD,CAAA;IACH,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,EAAE,YAAY,YAAY,IAAI,EAAE,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,CAAC;YACrE,MAAM,EAAE,CAAA;QACV,CAAC;QACD,4DAA4D;QAC5D,IAAI,uBAAA,IAAI,kCAAK,KAAK,oBAAoB,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,EAAE,CAAA;QACV,CAAC;QACD,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC/C,uBAAA,IAAI,sDAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC5C,CAAA;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;QACD,uBAAA,IAAI,8BAAQ,QAAQ,MAAA,CAAA;QACpB,OAAO,uBAAA,IAAI,gFAAiB,MAArB,IAAI,CAAmB,CAAA;IAChC,CAAC;AACH,CAAC;AACD;;;;GAIG;AACH,KAAK,sCAAO,GAAG,EAAE,GAAG;IAClB,MAAM,MAAM,GAAG,WAAW,CAAC,uBAAA,IAAI,kCAAK,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,uBAAA,IAAI,kCAAK,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AACnD,CAAC;AAuGH;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAE,OAAO;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEpC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IAED,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;AACpD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,MAAM;IACnC,MAAM,KAAK,GAAG,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAA;IAE5C,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AACxB,CAAC"}