@webex/internal-plugin-encryption 2.58.1 → 2.59.1-next.0

package/dist/encryption.js

@@ -225,7 +225,7 @@ var Encryption = _webexCore.WebexPlugin.extend({
       }));
     });
   },
-  version: "2.58.1"
+  version: "modern"
 });
 
 /**

package/dist/index.js

@@ -30,12 +30,10 @@ _Object$defineProperty(exports, "default", {
   }
 });
 var _promise = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/promise"));
-var _isString2 = _interopRequireDefault(require("lodash/isString"));
-var _isObject2 = _interopRequireDefault(require("lodash/isObject"));
-var _has2 = _interopRequireDefault(require("lodash/has"));
 require("@webex/internal-plugin-device");
 require("@webex/internal-plugin-mercury");
 var _webexCore = require("@webex/webex-core");
+var _lodash = require("lodash");
 var _encryption = _interopRequireDefault(require("./encryption"));
 var _config = _interopRequireDefault(require("./config"));
 var _kmsErrors = require("./kms-errors");
@@ -65,10 +63,10 @@ if (process.env.NODE_ENV === 'test') {
       // I don't see any practical way to reduce complexity here.
       // eslint-disable-next-line complexity
       test: function test(ctx, options) {
-        if (!(0, _has2.default)(options, 'body.kmsMessage')) {
+        if (!(0, _lodash.has)(options, 'body.kmsMessage')) {
           return _promise.default.resolve(false);
         }
-        if (!(0, _isObject2.default)(options.body.kmsMessage)) {
+        if (!(0, _lodash.isObject)(options.body.kmsMessage)) {
           return _promise.default.resolve(false);
         }
 
@@ -94,7 +92,7 @@ if (process.env.NODE_ENV === 'test') {
       name: 'decryptKmsMessage',
       direction: 'inbound',
       test: function test(ctx, response) {
-        return _promise.default.resolve((0, _has2.default)(response, 'body.kmsMessage') && (0, _isString2.default)(response.body.kmsMessage));
+        return _promise.default.resolve((0, _lodash.has)(response, 'body.kmsMessage') && (0, _lodash.isString)(response.body.kmsMessage));
       },
       extract: function extract(response) {
         return _promise.default.resolve(response.body);
@@ -118,7 +116,7 @@ if (process.env.NODE_ENV === 'test') {
         if (!object.kmsMessage) {
           return _promise.default.resolve();
         }
-        if ((0, _isString2.default)(object.kmsMessage)) {
+        if ((0, _lodash.isString)(object.kmsMessage)) {
           return _promise.default.resolve();
         }
         return ctx.webex.internal.encryption.kms.prepareRequest(object.kmsMessage).then(function (req) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["require","_webexCore","_encryption","_interopRequireDefault","_config","_kmsErrors","_kmsDryErrorInterceptor","_kms","interceptors","process","env","NODE_ENV","KmsDryErrorInterceptor","create","registerInternalPlugin","Encryption","payloadTransformer","predicates","name","direction","test","ctx","options","_has2","default","_promise","resolve","_isObject2","body","kmsMessage","keyUris","length","resourceUri","includes","uri","extract","response","_isString2","reason","Boolean","errorCode","transforms","fn","object","webex","internal","encryption","kms","prepareRequest","then","req","wrapped","decryptKmsMessage","promises","errors","map","error","description","desc","push","message","all","reject","DryError","config"],"sources":["index.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n// Note: There's a bug where if bind gets replayed because of a timeout in which\n// the original request eventually completed, there'll be an error indicating\n// the key can't be bound (because it already has been). This could be mitigated\n// by using Promise.race to resolve replays (as more requests get enqueue for a\n// specific action, accept whichever one completes first).\n\nimport '@webex/internal-plugin-device';\n\nimport '@webex/internal-plugin-mercury';\n\nimport {registerInternalPlugin} from '@webex/webex-core';\nimport {has, isObject, isString} from 'lodash';\n\nimport Encryption from './encryption';\nimport config from './config';\nimport {DryError} from './kms-errors';\n\nimport KmsDryErrorInterceptor from './kms-dry-error-interceptor';\n\nlet interceptors;\n\nif (process.env.NODE_ENV === 'test') {\n  interceptors = {\n    KmsDryErrorInterceptor: KmsDryErrorInterceptor.create,\n  };\n}\n\nregisterInternalPlugin('encryption', Encryption, {\n  payloadTransformer: {\n    predicates: [\n      {\n        name: 'encryptKmsMessage',\n        direction: 'outbound',\n        // I don't see any practical way to reduce complexity here.\n        // eslint-disable-next-line complexity\n        test(ctx, options) {\n          if (!has(options, 'body.kmsMessage')) {\n            return Promise.resolve(false);\n          }\n\n          if (!isObject(options.body.kmsMessage)) {\n            return Promise.resolve(false);\n          }\n\n          // If this is a template for a kms message, assume another transform\n          // will fill it in later. This is a bit of a leaky abstraction, but the\n          // alternative is building a complex rules engine for controlling\n          // ordering of transforms\n          if (options.body.kmsMessage.keyUris && options.body.kmsMessage.keyUris.length === 0) {\n            return Promise.resolve(false);\n          }\n          if (\n            options.body.kmsMessage.resourceUri &&\n            (options.body.kmsMessage.resourceUri.includes('<KRO>') ||\n              options.body.kmsMessage.resourceUri.includes('<KEYURL>'))\n          ) {\n            return Promise.resolve(false);\n          }\n          if (\n            options.body.kmsMessage.uri &&\n            (options.body.kmsMessage.uri.includes('<KRO>') ||\n              options.body.kmsMessage.uri.includes('<KEYURL>'))\n          ) {\n            return Promise.resolve(false);\n          }\n\n          return Promise.resolve(true);\n        },\n        extract(options) {\n          return Promise.resolve(options.body);\n        },\n      },\n      {\n        name: 'decryptKmsMessage',\n        direction: 'inbound',\n        test(ctx, response) {\n          return Promise.resolve(\n            has(response, 'body.kmsMessage') && isString(response.body.kmsMessage)\n          );\n        },\n        extract(response) {\n          return Promise.resolve(response.body);\n        },\n      },\n      {\n        name: 'decryptErrorResponse',\n        direction: 'inbound',\n        test(ctx, reason) {\n          return Promise.resolve(Boolean(reason.body && reason.body.errorCode === 1900000));\n        },\n        extract(reason) {\n          return Promise.resolve(reason);\n        },\n      },\n    ],\n    transforms: [\n      {\n        name: 'encryptKmsMessage',\n        fn(ctx, object) {\n          if (!object) {\n            return Promise.resolve();\n          }\n\n          if (!object.kmsMessage) {\n            return Promise.resolve();\n          }\n\n          if (isString(object.kmsMessage)) {\n            return Promise.resolve();\n          }\n\n          return ctx.webex.internal.encryption.kms.prepareRequest(object.kmsMessage).then((req) => {\n            object.kmsMessage = req.wrapped;\n          });\n        },\n      },\n      {\n        name: 'decryptKmsMessage',\n        fn(ctx, object) {\n          return ctx.webex.internal.encryption.kms\n            .decryptKmsMessage(object.kmsMessage)\n            .then((kmsMessage) => {\n              object.kmsMessage = kmsMessage;\n            });\n        },\n      },\n      {\n        name: 'decryptErrorResponse',\n        fn(ctx, reason) {\n          const promises = reason.body.errors.map((error) =>\n            ctx.webex.internal.encryption.kms.decryptKmsMessage(error.description).then((desc) => {\n              error.description = desc;\n            })\n          );\n\n          promises.push(\n            ctx.webex.internal.encryption.kms\n              .decryptKmsMessage(reason.body.message)\n              .then((kmsMessage) => {\n                reason.body.message = kmsMessage;\n              })\n          );\n\n          return Promise.all(promises).then(() => Promise.reject(new DryError(reason)));\n        },\n      },\n    ],\n  },\n  interceptors,\n  config,\n});\n\nexport {default} from './encryption';\nexport {default as KMS} from './kms';\nexport {KmsError, DryError} from './kms-errors';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUAA,OAAA;AAEAA,OAAA;AAEA,IAAAC,UAAA,GAAAD,OAAA;AAGA,IAAAE,WAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,OAAA,GAAAD,sBAAA,CAAAH,OAAA;AACA,IAAAK,UAAA,GAAAL,OAAA;AAEA,IAAAM,uBAAA,GAAAH,sBAAA,CAAAH,OAAA;AAwIA,IAAAO,IAAA,GAAAJ,sBAAA,CAAAH,OAAA;AA7JA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;;AAeA,IAAIQ,YAAY;AAEhB,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,MAAM,EAAE;EACnCH,YAAY,GAAG;IACbI,sBAAsB,EAAEA,+BAAsB,CAACC;EACjD,CAAC;AACH;AAEA,IAAAC,iCAAsB,EAAC,YAAY,EAAEC,mBAAU,EAAE;EAC/CC,kBAAkB,EAAE;IAClBC,UAAU,EAAE,CACV;MACEC,IAAI,EAAE,mBAAmB;MACzBC,SAAS,EAAE,UAAU;MACrB;MACA;MACAC,IAAI,WAAAA,KAACC,GAAG,EAAEC,OAAO,EAAE;QACjB,IAAI,CAAC,IAAAC,KAAA,CAAAC,OAAA,EAAIF,OAAO,EAAE,iBAAiB,CAAC,EAAE;UACpC,OAAOG,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAAC,KAAK,CAAC;QAC/B;QAEA,IAAI,CAAC,IAAAC,UAAA,CAAAH,OAAA,EAASF,OAAO,CAACM,IAAI,CAACC,UAAU,CAAC,EAAE;UACtC,OAAOJ,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAAC,KAAK,CAAC;QAC/B;;QAEA;QACA;QACA;QACA;QACA,IAAIJ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACC,OAAO,IAAIR,OAAO,CAACM,IAAI,CAACC,UAAU,CAACC,OAAO,CAACC,MAAM,KAAK,CAAC,EAAE;UACnF,OAAON,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAAC,KAAK,CAAC;QAC/B;QACA,IACEJ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACG,WAAW,KAClCV,OAAO,CAACM,IAAI,CAACC,UAAU,CAACG,WAAW,CAACC,QAAQ,CAAC,OAAO,CAAC,IACpDX,OAAO,CAACM,IAAI,CAACC,UAAU,CAACG,WAAW,CAACC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAC3D;UACA,OAAOR,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAAC,KAAK,CAAC;QAC/B;QACA,IACEJ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACK,GAAG,KAC1BZ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACK,GAAG,CAACD,QAAQ,CAAC,OAAO,CAAC,IAC5CX,OAAO,CAACM,IAAI,CAACC,UAAU,CAACK,GAAG,CAACD,QAAQ,CAAC,UAAU,CAAC,CAAC,EACnD;UACA,OAAOR,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAAC,KAAK,CAAC;QAC/B;QAEA,OAAOD,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAAC,IAAI,CAAC;MAC9B,CAAC;MACDS,OAAO,WAAAA,QAACb,OAAO,EAAE;QACf,OAAOG,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAACJ,OAAO,CAACM,IAAI,CAAC;MACtC;IACF,CAAC,EACD;MACEV,IAAI,EAAE,mBAAmB;MACzBC,SAAS,EAAE,SAAS;MACpBC,IAAI,WAAAA,KAACC,GAAG,EAAEe,QAAQ,EAAE;QAClB,OAAOX,QAAA,CAAAD,OAAA,CAAQE,OAAO,CACpB,IAAAH,KAAA,CAAAC,OAAA,EAAIY,QAAQ,EAAE,iBAAiB,CAAC,IAAI,IAAAC,UAAA,CAAAb,OAAA,EAASY,QAAQ,CAACR,IAAI,CAACC,UAAU,CAAC,CACvE;MACH,CAAC;MACDM,OAAO,WAAAA,QAACC,QAAQ,EAAE;QAChB,OAAOX,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAACU,QAAQ,CAACR,IAAI,CAAC;MACvC;IACF,CAAC,EACD;MACEV,IAAI,EAAE,sBAAsB;MAC5BC,SAAS,EAAE,SAAS;MACpBC,IAAI,WAAAA,KAACC,GAAG,EAAEiB,MAAM,EAAE;QAChB,OAAOb,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAACa,OAAO,CAACD,MAAM,CAACV,IAAI,IAAIU,MAAM,CAACV,IAAI,CAACY,SAAS,KAAK,OAAO,CAAC,CAAC;MACnF,CAAC;MACDL,OAAO,WAAAA,QAACG,MAAM,EAAE;QACd,OAAOb,QAAA,CAAAD,OAAA,CAAQE,OAAO,CAACY,MAAM,CAAC;MAChC;IACF,CAAC,CACF;IACDG,UAAU,EAAE,CACV;MACEvB,IAAI,EAAE,mBAAmB;MACzBwB,EAAE,WAAAA,GAACrB,GAAG,EAAEsB,MAAM,EAAE;QACd,IAAI,CAACA,MAAM,EAAE;UACX,OAAOlB,QAAA,CAAAD,OAAA,CAAQE,OAAO,EAAE;QAC1B;QAEA,IAAI,CAACiB,MAAM,CAACd,UAAU,EAAE;UACtB,OAAOJ,QAAA,CAAAD,OAAA,CAAQE,OAAO,EAAE;QAC1B;QAEA,IAAI,IAAAW,UAAA,CAAAb,OAAA,EAASmB,MAAM,CAACd,UAAU,CAAC,EAAE;UAC/B,OAAOJ,QAAA,CAAAD,OAAA,CAAQE,OAAO,EAAE;QAC1B;QAEA,OAAOL,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CAACC,cAAc,CAACL,MAAM,CAACd,UAAU,CAAC,CAACoB,IAAI,CAAC,UAACC,GAAG,EAAK;UACvFP,MAAM,CAACd,UAAU,GAAGqB,GAAG,CAACC,OAAO;QACjC,CAAC,CAAC;MACJ;IACF,CAAC,EACD;MACEjC,IAAI,EAAE,mBAAmB;MACzBwB,EAAE,WAAAA,GAACrB,GAAG,EAAEsB,MAAM,EAAE;QACd,OAAOtB,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CACrCK,iBAAiB,CAACT,MAAM,CAACd,UAAU,CAAC,CACpCoB,IAAI,CAAC,UAACpB,UAAU,EAAK;UACpBc,MAAM,CAACd,UAAU,GAAGA,UAAU;QAChC,CAAC,CAAC;MACN;IACF,CAAC,EACD;MACEX,IAAI,EAAE,sBAAsB;MAC5BwB,EAAE,WAAAA,GAACrB,GAAG,EAAEiB,MAAM,EAAE;QACd,IAAMe,QAAQ,GAAGf,MAAM,CAACV,IAAI,CAAC0B,MAAM,CAACC,GAAG,CAAC,UAACC,KAAK;UAAA,OAC5CnC,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CAACK,iBAAiB,CAACI,KAAK,CAACC,WAAW,CAAC,CAACR,IAAI,CAAC,UAACS,IAAI,EAAK;YACpFF,KAAK,CAACC,WAAW,GAAGC,IAAI;UAC1B,CAAC,CAAC;QAAA,EACH;QAEDL,QAAQ,CAACM,IAAI,CACXtC,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CAC9BK,iBAAiB,CAACd,MAAM,CAACV,IAAI,CAACgC,OAAO,CAAC,CACtCX,IAAI,CAAC,UAACpB,UAAU,EAAK;UACpBS,MAAM,CAACV,IAAI,CAACgC,OAAO,GAAG/B,UAAU;QAClC,CAAC,CAAC,CACL;QAED,OAAOJ,QAAA,CAAAD,OAAA,CAAQqC,GAAG,CAACR,QAAQ,CAAC,CAACJ,IAAI,CAAC;UAAA,OAAMxB,QAAA,CAAAD,OAAA,CAAQsC,MAAM,CAAC,IAAIC,mBAAQ,CAACzB,MAAM,CAAC,CAAC;QAAA,EAAC;MAC/E;IACF,CAAC;EAEL,CAAC;EACD9B,YAAY,EAAZA,YAAY;EACZwD,MAAM,EAANA;AACF,CAAC,CAAC"}
+{"version":3,"names":["require","_webexCore","_lodash","_encryption","_interopRequireDefault","_config","_kmsErrors","_kmsDryErrorInterceptor","_kms","interceptors","process","env","NODE_ENV","KmsDryErrorInterceptor","create","registerInternalPlugin","Encryption","payloadTransformer","predicates","name","direction","test","ctx","options","has","_promise","default","resolve","isObject","body","kmsMessage","keyUris","length","resourceUri","includes","uri","extract","response","isString","reason","Boolean","errorCode","transforms","fn","object","webex","internal","encryption","kms","prepareRequest","then","req","wrapped","decryptKmsMessage","promises","errors","map","error","description","desc","push","message","all","reject","DryError","config"],"sources":["index.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n// Note: There's a bug where if bind gets replayed because of a timeout in which\n// the original request eventually completed, there'll be an error indicating\n// the key can't be bound (because it already has been). This could be mitigated\n// by using Promise.race to resolve replays (as more requests get enqueue for a\n// specific action, accept whichever one completes first).\n\nimport '@webex/internal-plugin-device';\n\nimport '@webex/internal-plugin-mercury';\n\nimport {registerInternalPlugin} from '@webex/webex-core';\nimport {has, isObject, isString} from 'lodash';\n\nimport Encryption from './encryption';\nimport config from './config';\nimport {DryError} from './kms-errors';\n\nimport KmsDryErrorInterceptor from './kms-dry-error-interceptor';\n\nlet interceptors;\n\nif (process.env.NODE_ENV === 'test') {\n  interceptors = {\n    KmsDryErrorInterceptor: KmsDryErrorInterceptor.create,\n  };\n}\n\nregisterInternalPlugin('encryption', Encryption, {\n  payloadTransformer: {\n    predicates: [\n      {\n        name: 'encryptKmsMessage',\n        direction: 'outbound',\n        // I don't see any practical way to reduce complexity here.\n        // eslint-disable-next-line complexity\n        test(ctx, options) {\n          if (!has(options, 'body.kmsMessage')) {\n            return Promise.resolve(false);\n          }\n\n          if (!isObject(options.body.kmsMessage)) {\n            return Promise.resolve(false);\n          }\n\n          // If this is a template for a kms message, assume another transform\n          // will fill it in later. This is a bit of a leaky abstraction, but the\n          // alternative is building a complex rules engine for controlling\n          // ordering of transforms\n          if (options.body.kmsMessage.keyUris && options.body.kmsMessage.keyUris.length === 0) {\n            return Promise.resolve(false);\n          }\n          if (\n            options.body.kmsMessage.resourceUri &&\n            (options.body.kmsMessage.resourceUri.includes('<KRO>') ||\n              options.body.kmsMessage.resourceUri.includes('<KEYURL>'))\n          ) {\n            return Promise.resolve(false);\n          }\n          if (\n            options.body.kmsMessage.uri &&\n            (options.body.kmsMessage.uri.includes('<KRO>') ||\n              options.body.kmsMessage.uri.includes('<KEYURL>'))\n          ) {\n            return Promise.resolve(false);\n          }\n\n          return Promise.resolve(true);\n        },\n        extract(options) {\n          return Promise.resolve(options.body);\n        },\n      },\n      {\n        name: 'decryptKmsMessage',\n        direction: 'inbound',\n        test(ctx, response) {\n          return Promise.resolve(\n            has(response, 'body.kmsMessage') && isString(response.body.kmsMessage)\n          );\n        },\n        extract(response) {\n          return Promise.resolve(response.body);\n        },\n      },\n      {\n        name: 'decryptErrorResponse',\n        direction: 'inbound',\n        test(ctx, reason) {\n          return Promise.resolve(Boolean(reason.body && reason.body.errorCode === 1900000));\n        },\n        extract(reason) {\n          return Promise.resolve(reason);\n        },\n      },\n    ],\n    transforms: [\n      {\n        name: 'encryptKmsMessage',\n        fn(ctx, object) {\n          if (!object) {\n            return Promise.resolve();\n          }\n\n          if (!object.kmsMessage) {\n            return Promise.resolve();\n          }\n\n          if (isString(object.kmsMessage)) {\n            return Promise.resolve();\n          }\n\n          return ctx.webex.internal.encryption.kms.prepareRequest(object.kmsMessage).then((req) => {\n            object.kmsMessage = req.wrapped;\n          });\n        },\n      },\n      {\n        name: 'decryptKmsMessage',\n        fn(ctx, object) {\n          return ctx.webex.internal.encryption.kms\n            .decryptKmsMessage(object.kmsMessage)\n            .then((kmsMessage) => {\n              object.kmsMessage = kmsMessage;\n            });\n        },\n      },\n      {\n        name: 'decryptErrorResponse',\n        fn(ctx, reason) {\n          const promises = reason.body.errors.map((error) =>\n            ctx.webex.internal.encryption.kms.decryptKmsMessage(error.description).then((desc) => {\n              error.description = desc;\n            })\n          );\n\n          promises.push(\n            ctx.webex.internal.encryption.kms\n              .decryptKmsMessage(reason.body.message)\n              .then((kmsMessage) => {\n                reason.body.message = kmsMessage;\n              })\n          );\n\n          return Promise.all(promises).then(() => Promise.reject(new DryError(reason)));\n        },\n      },\n    ],\n  },\n  interceptors,\n  config,\n});\n\nexport {default} from './encryption';\nexport {default as KMS} from './kms';\nexport {KmsError, DryError} from './kms-errors';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUAA,OAAA;AAEAA,OAAA;AAEA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AAEA,IAAAG,WAAA,GAAAC,sBAAA,CAAAJ,OAAA;AACA,IAAAK,OAAA,GAAAD,sBAAA,CAAAJ,OAAA;AACA,IAAAM,UAAA,GAAAN,OAAA;AAEA,IAAAO,uBAAA,GAAAH,sBAAA,CAAAJ,OAAA;AAwIA,IAAAQ,IAAA,GAAAJ,sBAAA,CAAAJ,OAAA;AA7JA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;;AAeA,IAAIS,YAAY;AAEhB,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,MAAM,EAAE;EACnCH,YAAY,GAAG;IACbI,sBAAsB,EAAEA,+BAAsB,CAACC;EACjD,CAAC;AACH;AAEA,IAAAC,iCAAsB,EAAC,YAAY,EAAEC,mBAAU,EAAE;EAC/CC,kBAAkB,EAAE;IAClBC,UAAU,EAAE,CACV;MACEC,IAAI,EAAE,mBAAmB;MACzBC,SAAS,EAAE,UAAU;MACrB;MACA;MACAC,IAAI,WAAAA,KAACC,GAAG,EAAEC,OAAO,EAAE;QACjB,IAAI,CAAC,IAAAC,WAAG,EAACD,OAAO,EAAE,iBAAiB,CAAC,EAAE;UACpC,OAAOE,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAAC,KAAK,CAAC;QAC/B;QAEA,IAAI,CAAC,IAAAC,gBAAQ,EAACL,OAAO,CAACM,IAAI,CAACC,UAAU,CAAC,EAAE;UACtC,OAAOL,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAAC,KAAK,CAAC;QAC/B;;QAEA;QACA;QACA;QACA;QACA,IAAIJ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACC,OAAO,IAAIR,OAAO,CAACM,IAAI,CAACC,UAAU,CAACC,OAAO,CAACC,MAAM,KAAK,CAAC,EAAE;UACnF,OAAOP,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAAC,KAAK,CAAC;QAC/B;QACA,IACEJ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACG,WAAW,KAClCV,OAAO,CAACM,IAAI,CAACC,UAAU,CAACG,WAAW,CAACC,QAAQ,CAAC,OAAO,CAAC,IACpDX,OAAO,CAACM,IAAI,CAACC,UAAU,CAACG,WAAW,CAACC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAC3D;UACA,OAAOT,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAAC,KAAK,CAAC;QAC/B;QACA,IACEJ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACK,GAAG,KAC1BZ,OAAO,CAACM,IAAI,CAACC,UAAU,CAACK,GAAG,CAACD,QAAQ,CAAC,OAAO,CAAC,IAC5CX,OAAO,CAACM,IAAI,CAACC,UAAU,CAACK,GAAG,CAACD,QAAQ,CAAC,UAAU,CAAC,CAAC,EACnD;UACA,OAAOT,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAAC,KAAK,CAAC;QAC/B;QAEA,OAAOF,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAAC,IAAI,CAAC;MAC9B,CAAC;MACDS,OAAO,WAAAA,QAACb,OAAO,EAAE;QACf,OAAOE,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAACJ,OAAO,CAACM,IAAI,CAAC;MACtC;IACF,CAAC,EACD;MACEV,IAAI,EAAE,mBAAmB;MACzBC,SAAS,EAAE,SAAS;MACpBC,IAAI,WAAAA,KAACC,GAAG,EAAEe,QAAQ,EAAE;QAClB,OAAOZ,QAAA,CAAAC,OAAA,CAAQC,OAAO,CACpB,IAAAH,WAAG,EAACa,QAAQ,EAAE,iBAAiB,CAAC,IAAI,IAAAC,gBAAQ,EAACD,QAAQ,CAACR,IAAI,CAACC,UAAU,CAAC,CACvE;MACH,CAAC;MACDM,OAAO,WAAAA,QAACC,QAAQ,EAAE;QAChB,OAAOZ,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAACU,QAAQ,CAACR,IAAI,CAAC;MACvC;IACF,CAAC,EACD;MACEV,IAAI,EAAE,sBAAsB;MAC5BC,SAAS,EAAE,SAAS;MACpBC,IAAI,WAAAA,KAACC,GAAG,EAAEiB,MAAM,EAAE;QAChB,OAAOd,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAACa,OAAO,CAACD,MAAM,CAACV,IAAI,IAAIU,MAAM,CAACV,IAAI,CAACY,SAAS,KAAK,OAAO,CAAC,CAAC;MACnF,CAAC;MACDL,OAAO,WAAAA,QAACG,MAAM,EAAE;QACd,OAAOd,QAAA,CAAAC,OAAA,CAAQC,OAAO,CAACY,MAAM,CAAC;MAChC;IACF,CAAC,CACF;IACDG,UAAU,EAAE,CACV;MACEvB,IAAI,EAAE,mBAAmB;MACzBwB,EAAE,WAAAA,GAACrB,GAAG,EAAEsB,MAAM,EAAE;QACd,IAAI,CAACA,MAAM,EAAE;UACX,OAAOnB,QAAA,CAAAC,OAAA,CAAQC,OAAO,EAAE;QAC1B;QAEA,IAAI,CAACiB,MAAM,CAACd,UAAU,EAAE;UACtB,OAAOL,QAAA,CAAAC,OAAA,CAAQC,OAAO,EAAE;QAC1B;QAEA,IAAI,IAAAW,gBAAQ,EAACM,MAAM,CAACd,UAAU,CAAC,EAAE;UAC/B,OAAOL,QAAA,CAAAC,OAAA,CAAQC,OAAO,EAAE;QAC1B;QAEA,OAAOL,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CAACC,cAAc,CAACL,MAAM,CAACd,UAAU,CAAC,CAACoB,IAAI,CAAC,UAACC,GAAG,EAAK;UACvFP,MAAM,CAACd,UAAU,GAAGqB,GAAG,CAACC,OAAO;QACjC,CAAC,CAAC;MACJ;IACF,CAAC,EACD;MACEjC,IAAI,EAAE,mBAAmB;MACzBwB,EAAE,WAAAA,GAACrB,GAAG,EAAEsB,MAAM,EAAE;QACd,OAAOtB,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CACrCK,iBAAiB,CAACT,MAAM,CAACd,UAAU,CAAC,CACpCoB,IAAI,CAAC,UAACpB,UAAU,EAAK;UACpBc,MAAM,CAACd,UAAU,GAAGA,UAAU;QAChC,CAAC,CAAC;MACN;IACF,CAAC,EACD;MACEX,IAAI,EAAE,sBAAsB;MAC5BwB,EAAE,WAAAA,GAACrB,GAAG,EAAEiB,MAAM,EAAE;QACd,IAAMe,QAAQ,GAAGf,MAAM,CAACV,IAAI,CAAC0B,MAAM,CAACC,GAAG,CAAC,UAACC,KAAK;UAAA,OAC5CnC,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CAACK,iBAAiB,CAACI,KAAK,CAACC,WAAW,CAAC,CAACR,IAAI,CAAC,UAACS,IAAI,EAAK;YACpFF,KAAK,CAACC,WAAW,GAAGC,IAAI;UAC1B,CAAC,CAAC;QAAA,EACH;QAEDL,QAAQ,CAACM,IAAI,CACXtC,GAAG,CAACuB,KAAK,CAACC,QAAQ,CAACC,UAAU,CAACC,GAAG,CAC9BK,iBAAiB,CAACd,MAAM,CAACV,IAAI,CAACgC,OAAO,CAAC,CACtCX,IAAI,CAAC,UAACpB,UAAU,EAAK;UACpBS,MAAM,CAACV,IAAI,CAACgC,OAAO,GAAG/B,UAAU;QAClC,CAAC,CAAC,CACL;QAED,OAAOL,QAAA,CAAAC,OAAA,CAAQoC,GAAG,CAACR,QAAQ,CAAC,CAACJ,IAAI,CAAC;UAAA,OAAMzB,QAAA,CAAAC,OAAA,CAAQqC,MAAM,CAAC,IAAIC,mBAAQ,CAACzB,MAAM,CAAC,CAAC;QAAA,EAAC;MAC/E;IACF,CAAC;EAEL,CAAC;EACD9B,YAAY,EAAZA,YAAY;EACZwD,MAAM,EAANA;AACF,CAAC,CAAC"}

package/dist/kms-certificate-validation.js

@@ -19,11 +19,11 @@ var _inherits2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/
 var _possibleConstructorReturn2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/possibleConstructorReturn"));
 var _getPrototypeOf2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/getPrototypeOf"));
 var _wrapNativeSuper2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/wrapNativeSuper"));
-var _isArray2 = _interopRequireDefault(require("lodash/isArray"));
 var _url = require("url");
 var _validUrl = require("valid-url");
 var _asn1js = require("asn1js");
 var _pkijs = require("pkijs");
+var _lodash = require("lodash");
 var _nodeJose = _interopRequireDefault(require("node-jose"));
 var _isomorphicWebcrypto = _interopRequireDefault(require("isomorphic-webcrypto"));
 var _safeBuffer = require("safe-buffer");
@@ -257,7 +257,7 @@ var validateKMS = function validateKMS(caroots) {
     return _promise.default.resolve().then(function () {
       validateKtyHeader(jwt);
       validateKidHeader(jwt);
-      if (!((0, _isArray2.default)(jwt.x5c) && jwt.x5c.length > 0)) {
+      if (!((0, _lodash.isArray)(jwt.x5c) && jwt.x5c.length > 0)) {
         throwError('JWK does not contain a list of certificates');
       }
       var certificates = jwt.x5c.map(decodeCert);

package/dist/kms-certificate-validation.js.map

@@ -1 +1 @@
-{"version":3,"names":["_url","require","_validUrl","_asn1js","_pkijs","_nodeJose","_interopRequireDefault","_isomorphicWebcrypto","_safeBuffer","_createForOfIteratorHelper","o","allowArrayLike","it","_Symbol","_Symbol$iterator","_Array$isArray","_unsupportedIterableToArray","length","i","F","s","n","done","value","e","_e","f","TypeError","normalCompletion","didErr","err","call","step","next","_e2","return","minLen","_arrayLikeToArray","Object","prototype","toString","slice","constructor","name","_Array$from","test","arr","len","arr2","Array","_createSuper","Derived","hasNativeReflectConstruct","_isNativeReflectConstruct","_createSuperInternal","Super","_getPrototypeOf2","default","result","NewTarget","_Reflect$construct","arguments","apply","_possibleConstructorReturn2","Reflect","sham","Proxy","Boolean","valueOf","setEngine","crypto","CryptoEngine","subtle","VALID_KTY","VALID_KID_PROTOCOL","X509_COMMON_NAME_KEY","X509_SUBJECT_ALT_NAME_KEY","KMSError","_Error","_inherits2","_super","message","_this","_classCallCheck2","kmsError","_createClass2","_wrapNativeSuper2","Error","exports","throwError","concat","decodeCert","pem","der","Buffer","from","ber","Uint8Array","buffer","asn1","fromBER","Certificate","schema","validateKtyHeader","_ref","kty","validateKidHeader","_ref2","kid","isUri","parseUrl","protocol","validateCommonName","_ref3","_ref4","_ref5","_slicedToArray2","certificate","kidHostname","hostname","validationSuccessful","extensions","_iterator","_step","extension","extnID","altNames","parsedValue","_iterator2","_step2","entry","san","subjectAttributes","subject","typesAndValues","_iterator3","_step3","attribute","type","commonName","valueBlock","validatePublicCertificate","_ref6","_ref7","_ref8","publicExponent","modulus","encode","jose","util","base64url","publicKey","subjectPublicKeyInfo","subjectPublicKey","asn1PublicCert","valueHex","publicCert","RSAPublicKey","publicExponentHex","modulusHex","validateCertificatesSignature","certificates","caroots","undefined","certificateEngine","CertificateChainValidationEngine","trustedCerts","map","certs","verify","then","_ref9","resultCode","resultMessage","validateKMS","jwt","_promise","resolve","_isArray2","x5c","promise","_default"],"sources":["kms-certificate-validation.js"],"sourcesContent":["import {parse as parseUrl} from 'url';\n\nimport {isUri} from 'valid-url';\nimport {fromBER} from 'asn1js';\nimport {\n  Certificate,\n  RSAPublicKey,\n  CertificateChainValidationEngine,\n  CryptoEngine,\n  setEngine,\n} from 'pkijs';\nimport {isArray} from 'lodash';\nimport jose from 'node-jose';\nimport crypto from 'isomorphic-webcrypto';\nimport {Buffer} from 'safe-buffer';\n\nsetEngine(\n  'newEngine',\n  crypto,\n  new CryptoEngine({\n    name: '',\n    crypto,\n    subtle: crypto.subtle,\n  })\n);\n\nconst VALID_KTY = 'RSA';\nconst VALID_KID_PROTOCOL = 'kms:';\n\nconst X509_COMMON_NAME_KEY = '2.5.4.3';\n\nconst X509_SUBJECT_ALT_NAME_KEY = '2.5.29.17';\n\n/**\n * Customize Error so the SDK knows to quit retrying and notify\n * the user\n */\nexport class KMSError extends Error {\n  /**\n   * add kmsError field to notify\n   * @param {string} message\n   */\n  constructor(message) {\n    super(message);\n    this.kmsError = true;\n  }\n}\n\nconst throwError = (err) => {\n  throw new KMSError(`INVALID KMS: ${err}`);\n};\n\n/**\n * Converts the PEM string to a pkijs certificate object\n * @param {string} pem PEM representation of a certificate\n * @returns {Certificate} pkijs object of the certificate\n */\nconst decodeCert = (pem) => {\n  if (typeof pem !== 'string') {\n    throwError('certificate needs to be a string');\n  }\n\n  const der = Buffer.from(pem, 'base64');\n  const ber = new Uint8Array(der).buffer;\n\n  const asn1 = fromBER(ber);\n\n  return new Certificate({schema: asn1.result});\n};\n\n/**\n * Validate the 'kty' property of the KMS credentials\n * @param {Object} JWT KMS credentials\n * @param {string} JWT.kty type of certificate\n * @throws {KMSError} if kty is not a valid type\n * @returns {void}\n */\nconst validateKtyHeader = ({kty}) => {\n  if (kty !== VALID_KTY) {\n    throwError(`'kty' header must be '${VALID_KTY}'`);\n  }\n};\n\nconst validateKidHeader = ({kid}) => {\n  if (!isUri(kid)) {\n    throwError(\"'kid' is not a valid URI\");\n  }\n\n  if (parseUrl(kid).protocol !== VALID_KID_PROTOCOL) {\n    throwError(`'kid' protocol must be '${VALID_KID_PROTOCOL}'`);\n  }\n};\n\n/**\n * Checks the first certificate matches the 'kid' in the JWT.\n * It first checks the Subject Alternative Name then it checks\n * the Common Name\n * @param {Certificate} certificate represents the KMS\n * @param {Object} JWT KMS credentials\n * @param {string} JWT.kid the uri of the KMS\n * @throws {KMSError} if unable to validate certificate against KMS credentials\n * @returns {void}\n */\nconst validateCommonName = ([certificate], {kid}) => {\n  const kidHostname = parseUrl(kid).hostname;\n  let validationSuccessful = false;\n\n  if (certificate.extensions) {\n    // Subject Alt Names are in here\n    for (const extension of certificate.extensions) {\n      if (extension.extnID === X509_SUBJECT_ALT_NAME_KEY) {\n        const {altNames} = extension.parsedValue;\n\n        for (const entry of altNames) {\n          const san = entry.value;\n\n          validationSuccessful = san === kidHostname;\n          if (validationSuccessful) {\n            break;\n          }\n        }\n\n        if (validationSuccessful) {\n          break;\n        }\n      }\n    }\n  }\n\n  if (!validationSuccessful) {\n    // Didn't match kid in the Subject Alt Names, checking the Common Name\n    const subjectAttributes = certificate.subject.typesAndValues;\n\n    for (const attribute of subjectAttributes) {\n      if (attribute.type === X509_COMMON_NAME_KEY) {\n        const commonName = attribute.value.valueBlock.value;\n\n        validationSuccessful = commonName === kidHostname;\n        if (validationSuccessful) {\n          break;\n        }\n      }\n    }\n  }\n\n  if (!validationSuccessful) {\n    throwError(\"hostname of the 1st certificate does not match 'kid'\");\n  }\n};\n\n/**\n * Validate the first KMS certificate against the information\n * provided in the JWT\n * @param {Certificate} certificate first certificate the identifies the KMS\n * @param {Object} JWT credentials of the KMS\n * @param {string} JWT.e Public exponent of the first certificate\n * @param {string} KWT.n Modulus of the first certificate\n * @throws {KMSError} if e or n doesn't match the first certificate\n * @returns {void}\n */\nconst validatePublicCertificate = ([certificate], {e: publicExponent, n: modulus}) => {\n  const {encode} = jose.util.base64url;\n\n  const publicKey = certificate.subjectPublicKeyInfo.subjectPublicKey;\n  const asn1PublicCert = fromBER(publicKey.valueBlock.valueHex);\n  const publicCert = new RSAPublicKey({schema: asn1PublicCert.result});\n  const publicExponentHex = publicCert.publicExponent.valueBlock.valueHex;\n  const modulusHex = publicCert.modulus.valueBlock.valueHex;\n\n  if (publicExponent !== encode(publicExponentHex)) {\n    throwError('Public exponent is invalid');\n  }\n  if (modulus !== encode(modulusHex)) {\n    throwError('Modulus is invalid');\n  }\n};\n\n/**\n * Validates the list of certificates against the CAs provided\n * @param {certificate[]} certificates list of certificates provided\n *   by the KMS to certify itself\n * @param {string[]} [caroots=[]] list of Certificate Authorities used to\n *   validate the KMS's certificates\n * @returns {Promise} rejects if unable to validate the certificates\n */\nconst validateCertificatesSignature = (certificates, caroots = []) => {\n  const certificateEngine = new CertificateChainValidationEngine({\n    trustedCerts: caroots.map(decodeCert),\n    certs: certificates,\n  });\n\n  return certificateEngine.verify().then(({result, resultCode, resultMessage}) => {\n    if (!result) {\n      throwError(`Certificate Validation failed [${resultCode}]: ${resultMessage}`);\n    }\n  });\n};\n\n/**\n * Validates the information provided by the KMS. This is a curried function.\n * The first function takes the caroots param and returns a second function.\n * The second function takes the credentials of the KMS and validates it\n * @param {string[]} caroots PEM encoded certificates that will be used\n *   as Certificate Authorities\n * @param {Object} jwt Object containing the fields necessary to\n *   validate the KMS\n * @returns {Promise} when resolved will return the jwt\n */\nconst validateKMS =\n  (caroots) =>\n  (jwt = {}) =>\n    Promise.resolve().then(() => {\n      validateKtyHeader(jwt);\n      validateKidHeader(jwt);\n\n      if (!(isArray(jwt.x5c) && jwt.x5c.length > 0)) {\n        throwError('JWK does not contain a list of certificates');\n      }\n      const certificates = jwt.x5c.map(decodeCert);\n\n      validateCommonName(certificates, jwt);\n      validatePublicCertificate(certificates, jwt);\n\n      // Skip validating signatures if no CA roots were provided\n      const promise = caroots\n        ? validateCertificatesSignature(certificates, caroots)\n        : Promise.resolve();\n\n      return promise.then(() => jwt);\n    });\n\nexport default validateKMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,IAAA,GAAAC,OAAA;AAEA,IAAAC,SAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAQA,IAAAI,SAAA,GAAAC,sBAAA,CAAAL,OAAA;AACA,IAAAM,oBAAA,GAAAD,sBAAA,CAAAL,OAAA;AACA,IAAAO,WAAA,GAAAP,OAAA;AAAmC,SAAAQ,2BAAAC,CAAA,EAAAC,cAAA,QAAAC,EAAA,UAAAC,OAAA,oBAAAH,CAAA,CAAAI,gBAAA,KAAAJ,CAAA,qBAAAE,EAAA,QAAAG,cAAA,CAAAL,CAAA,MAAAE,EAAA,GAAAI,2BAAA,CAAAN,CAAA,MAAAC,cAAA,IAAAD,CAAA,WAAAA,CAAA,CAAAO,MAAA,qBAAAL,EAAA,EAAAF,CAAA,GAAAE,EAAA,MAAAM,CAAA,UAAAC,CAAA,YAAAA,EAAA,eAAAC,CAAA,EAAAD,CAAA,EAAAE,CAAA,WAAAA,EAAA,QAAAH,CAAA,IAAAR,CAAA,CAAAO,MAAA,WAAAK,IAAA,mBAAAA,IAAA,SAAAC,KAAA,EAAAb,CAAA,CAAAQ,CAAA,UAAAM,CAAA,WAAAA,EAAAC,EAAA,UAAAA,EAAA,KAAAC,CAAA,EAAAP,CAAA,gBAAAQ,SAAA,iJAAAC,gBAAA,SAAAC,MAAA,UAAAC,GAAA,WAAAV,CAAA,WAAAA,EAAA,IAAAR,EAAA,GAAAA,EAAA,CAAAmB,IAAA,CAAArB,CAAA,MAAAW,CAAA,WAAAA,EAAA,QAAAW,IAAA,GAAApB,EAAA,CAAAqB,IAAA,IAAAL,gBAAA,GAAAI,IAAA,CAAAV,IAAA,SAAAU,IAAA,KAAAR,CAAA,WAAAA,EAAAU,GAAA,IAAAL,MAAA,SAAAC,GAAA,GAAAI,GAAA,KAAAR,CAAA,WAAAA,EAAA,eAAAE,gBAAA,IAAAhB,EAAA,CAAAuB,MAAA,UAAAvB,EAAA,CAAAuB,MAAA,oBAAAN,MAAA,QAAAC,GAAA;AAAA,SAAAd,4BAAAN,CAAA,EAAA0B,MAAA,SAAA1B,CAAA,qBAAAA,CAAA,sBAAA2B,iBAAA,CAAA3B,CAAA,EAAA0B,MAAA,OAAAf,CAAA,GAAAiB,MAAA,CAAAC,SAAA,CAAAC,QAAA,CAAAT,IAAA,CAAArB,CAAA,EAAA+B,KAAA,aAAApB,CAAA,iBAAAX,CAAA,CAAAgC,WAAA,EAAArB,CAAA,GAAAX,CAAA,CAAAgC,WAAA,CAAAC,IAAA,MAAAtB,CAAA,cAAAA,CAAA,mBAAAuB,WAAA,CAAAlC,CAAA,OAAAW,CAAA,+DAAAwB,IAAA,CAAAxB,CAAA,UAAAgB,iBAAA,CAAA3B,CAAA,EAAA0B,MAAA;AAAA,SAAAC,kBAAAS,GAAA,EAAAC,GAAA,QAAAA,GAAA,YAAAA,GAAA,GAAAD,GAAA,CAAA7B,MAAA,EAAA8B,GAAA,GAAAD,GAAA,CAAA7B,MAAA,WAAAC,CAAA,MAAA8B,IAAA,OAAAC,KAAA,CAAAF,GAAA,GAAA7B,CAAA,GAAA6B,GAAA,EAAA7B,CAAA,IAAA8B,IAAA,CAAA9B,CAAA,IAAA4B,GAAA,CAAA5B,CAAA,UAAA8B,IAAA;AAAA,SAAAE,aAAAC,OAAA,QAAAC,yBAAA,GAAAC,yBAAA,oBAAAC,qBAAA,QAAAC,KAAA,OAAAC,gBAAA,CAAAC,OAAA,EAAAN,OAAA,GAAAO,MAAA,MAAAN,yBAAA,QAAAO,SAAA,OAAAH,gBAAA,CAAAC,OAAA,QAAAf,WAAA,EAAAgB,MAAA,GAAAE,kBAAA,CAAAL,KAAA,EAAAM,SAAA,EAAAF,SAAA,YAAAD,MAAA,GAAAH,KAAA,CAAAO,KAAA,OAAAD,SAAA,gBAAAE,2BAAA,CAAAN,OAAA,QAAAC,MAAA;AAAA,SAAAL,0BAAA,eAAAW,OAAA,qBAAAJ,kBAAA,oBAAAA,kBAAA,CAAAK,IAAA,2BAAAC,KAAA,oCAAAC,OAAA,CAAA5B,SAAA,CAAA6B,OAAA,CAAArC,IAAA,CAAA6B,kBAAA,CAAAO,OAAA,8CAAA3C,CAAA;AAEnC,IAAA6C,gBAAS,EACP,WAAW,EACXC,4BAAM,EACN,IAAIC,mBAAY,CAAC;EACf5B,IAAI,EAAE,EAAE;EACR2B,MAAM,EAANA,4BAAM;EACNE,MAAM,EAAEF,4BAAM,CAACE;AACjB,CAAC,CAAC,CACH;AAED,IAAMC,SAAS,GAAG,KAAK;AACvB,IAAMC,kBAAkB,GAAG,MAAM;AAEjC,IAAMC,oBAAoB,GAAG,SAAS;AAEtC,IAAMC,yBAAyB,GAAG,WAAW;;AAE7C;AACA;AACA;AACA;AAHA,IAIaC,QAAQ,0BAAAC,MAAA;EAAA,IAAAC,UAAA,CAAAtB,OAAA,EAAAoB,QAAA,EAAAC,MAAA;EAAA,IAAAE,MAAA,GAAA9B,YAAA,CAAA2B,QAAA;EACnB;AACF;AACA;AACA;EACE,SAAAA,SAAYI,OAAO,EAAE;IAAA,IAAAC,KAAA;IAAA,IAAAC,gBAAA,CAAA1B,OAAA,QAAAoB,QAAA;IACnBK,KAAA,GAAAF,MAAA,CAAAjD,IAAA,OAAMkD,OAAO;IACbC,KAAA,CAAKE,QAAQ,GAAG,IAAI;IAAC,OAAAF,KAAA;EACvB;EAAC,WAAAG,aAAA,CAAA5B,OAAA,EAAAoB,QAAA;AAAA,oBAAAS,iBAAA,CAAA7B,OAAA,EAR2B8B,KAAK;AAAAC,OAAA,CAAAX,QAAA,GAAAA,QAAA;AAWnC,IAAMY,UAAU,GAAG,SAAbA,UAAUA,CAAI3D,GAAG,EAAK;EAC1B,MAAM,IAAI+C,QAAQ,iBAAAa,MAAA,CAAiB5D,GAAG,EAAG;AAC3C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,IAAM6D,UAAU,GAAG,SAAbA,UAAUA,CAAIC,GAAG,EAAK;EAC1B,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3BH,UAAU,CAAC,kCAAkC,CAAC;EAChD;EAEA,IAAMI,GAAG,GAAGC,kBAAM,CAACC,IAAI,CAACH,GAAG,EAAE,QAAQ,CAAC;EACtC,IAAMI,GAAG,GAAG,IAAIC,UAAU,CAACJ,GAAG,CAAC,CAACK,MAAM;EAEtC,IAAMC,IAAI,GAAG,IAAAC,eAAO,EAACJ,GAAG,CAAC;EAEzB,OAAO,IAAIK,kBAAW,CAAC;IAACC,MAAM,EAAEH,IAAI,CAACzC;EAAM,CAAC,CAAC;AAC/C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAM6C,iBAAiB,GAAG,SAApBA,iBAAiBA,CAAAC,IAAA,EAAc;EAAA,IAATC,GAAG,GAAAD,IAAA,CAAHC,GAAG;EAC7B,IAAIA,GAAG,KAAKhC,SAAS,EAAE;IACrBgB,UAAU,0BAAAC,MAAA,CAA0BjB,SAAS,OAAI;EACnD;AACF,CAAC;AAED,IAAMiC,iBAAiB,GAAG,SAApBA,iBAAiBA,CAAAC,KAAA,EAAc;EAAA,IAATC,GAAG,GAAAD,KAAA,CAAHC,GAAG;EAC7B,IAAI,CAAC,IAAAC,eAAK,EAACD,GAAG,CAAC,EAAE;IACfnB,UAAU,CAAC,0BAA0B,CAAC;EACxC;EAEA,IAAI,IAAAqB,UAAQ,EAACF,GAAG,CAAC,CAACG,QAAQ,KAAKrC,kBAAkB,EAAE;IACjDe,UAAU,4BAAAC,MAAA,CAA4BhB,kBAAkB,OAAI;EAC9D;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMsC,kBAAkB,GAAG,SAArBA,kBAAkBA,CAAAC,KAAA,EAAAC,KAAA,EAA6B;EAAA,IAAAC,KAAA,OAAAC,eAAA,CAAA3D,OAAA,EAAAwD,KAAA;IAAxBI,WAAW,GAAAF,KAAA;EAAA,IAAIP,GAAG,GAAAM,KAAA,CAAHN,GAAG;EAC7C,IAAMU,WAAW,GAAG,IAAAR,UAAQ,EAACF,GAAG,CAAC,CAACW,QAAQ;EAC1C,IAAIC,oBAAoB,GAAG,KAAK;EAEhC,IAAIH,WAAW,CAACI,UAAU,EAAE;IAC1B;IAAA,IAAAC,SAAA,GAAAjH,0BAAA,CACwB4G,WAAW,CAACI,UAAU;MAAAE,KAAA;IAAA;MAA9C,KAAAD,SAAA,CAAAtG,CAAA,MAAAuG,KAAA,GAAAD,SAAA,CAAArG,CAAA,IAAAC,IAAA,GAAgD;QAAA,IAArCsG,SAAS,GAAAD,KAAA,CAAApG,KAAA;QAClB,IAAIqG,SAAS,CAACC,MAAM,KAAKjD,yBAAyB,EAAE;UAClD,IAAOkD,QAAQ,GAAIF,SAAS,CAACG,WAAW,CAAjCD,QAAQ;UAA0B,IAAAE,UAAA,GAAAvH,0BAAA,CAErBqH,QAAQ;YAAAG,MAAA;UAAA;YAA5B,KAAAD,UAAA,CAAA5G,CAAA,MAAA6G,MAAA,GAAAD,UAAA,CAAA3G,CAAA,IAAAC,IAAA,GAA8B;cAAA,IAAnB4G,KAAK,GAAAD,MAAA,CAAA1G,KAAA;cACd,IAAM4G,GAAG,GAAGD,KAAK,CAAC3G,KAAK;cAEvBiG,oBAAoB,GAAGW,GAAG,KAAKb,WAAW;cAC1C,IAAIE,oBAAoB,EAAE;gBACxB;cACF;YACF;UAAC,SAAA1F,GAAA;YAAAkG,UAAA,CAAAxG,CAAA,CAAAM,GAAA;UAAA;YAAAkG,UAAA,CAAAtG,CAAA;UAAA;UAED,IAAI8F,oBAAoB,EAAE;YACxB;UACF;QACF;MACF;IAAC,SAAA1F,GAAA;MAAA4F,SAAA,CAAAlG,CAAA,CAAAM,GAAA;IAAA;MAAA4F,SAAA,CAAAhG,CAAA;IAAA;EACH;EAEA,IAAI,CAAC8F,oBAAoB,EAAE;IACzB;IACA,IAAMY,iBAAiB,GAAGf,WAAW,CAACgB,OAAO,CAACC,cAAc;IAAC,IAAAC,UAAA,GAAA9H,0BAAA,CAErC2H,iBAAiB;MAAAI,MAAA;IAAA;MAAzC,KAAAD,UAAA,CAAAnH,CAAA,MAAAoH,MAAA,GAAAD,UAAA,CAAAlH,CAAA,IAAAC,IAAA,GAA2C;QAAA,IAAhCmH,SAAS,GAAAD,MAAA,CAAAjH,KAAA;QAClB,IAAIkH,SAAS,CAACC,IAAI,KAAK/D,oBAAoB,EAAE;UAC3C,IAAMgE,UAAU,GAAGF,SAAS,CAAClH,KAAK,CAACqH,UAAU,CAACrH,KAAK;UAEnDiG,oBAAoB,GAAGmB,UAAU,KAAKrB,WAAW;UACjD,IAAIE,oBAAoB,EAAE;YACxB;UACF;QACF;MACF;IAAC,SAAA1F,GAAA;MAAAyG,UAAA,CAAA/G,CAAA,CAAAM,GAAA;IAAA;MAAAyG,UAAA,CAAA7G,CAAA;IAAA;EACH;EAEA,IAAI,CAAC8F,oBAAoB,EAAE;IACzB/B,UAAU,CAAC,sDAAsD,CAAC;EACpE;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMoD,yBAAyB,GAAG,SAA5BA,yBAAyBA,CAAAC,KAAA,EAAAC,KAAA,EAAuD;EAAA,IAAAC,KAAA,OAAA5B,eAAA,CAAA3D,OAAA,EAAAqF,KAAA;IAAlDzB,WAAW,GAAA2B,KAAA;EAAA,IAAOC,cAAc,GAAAF,KAAA,CAAjBvH,CAAC;IAAqB0H,OAAO,GAAAH,KAAA,CAAV1H,CAAC;EACrE,IAAO8H,MAAM,GAAIC,iBAAI,CAACC,IAAI,CAACC,SAAS,CAA7BH,MAAM;EAEb,IAAMI,SAAS,GAAGlC,WAAW,CAACmC,oBAAoB,CAACC,gBAAgB;EACnE,IAAMC,cAAc,GAAG,IAAAtD,eAAO,EAACmD,SAAS,CAACX,UAAU,CAACe,QAAQ,CAAC;EAC7D,IAAMC,UAAU,GAAG,IAAIC,mBAAY,CAAC;IAACvD,MAAM,EAAEoD,cAAc,CAAChG;EAAM,CAAC,CAAC;EACpE,IAAMoG,iBAAiB,GAAGF,UAAU,CAACX,cAAc,CAACL,UAAU,CAACe,QAAQ;EACvE,IAAMI,UAAU,GAAGH,UAAU,CAACV,OAAO,CAACN,UAAU,CAACe,QAAQ;EAEzD,IAAIV,cAAc,KAAKE,MAAM,CAACW,iBAAiB,CAAC,EAAE;IAChDrE,UAAU,CAAC,4BAA4B,CAAC;EAC1C;EACA,IAAIyD,OAAO,KAAKC,MAAM,CAACY,UAAU,CAAC,EAAE;IAClCtE,UAAU,CAAC,oBAAoB,CAAC;EAClC;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMuE,6BAA6B,GAAG,SAAhCA,6BAA6BA,CAAIC,YAAY,EAAmB;EAAA,IAAjBC,OAAO,GAAArG,SAAA,CAAA5C,MAAA,QAAA4C,SAAA,QAAAsG,SAAA,GAAAtG,SAAA,MAAG,EAAE;EAC/D,IAAMuG,iBAAiB,GAAG,IAAIC,uCAAgC,CAAC;IAC7DC,YAAY,EAAEJ,OAAO,CAACK,GAAG,CAAC5E,UAAU,CAAC;IACrC6E,KAAK,EAAEP;EACT,CAAC,CAAC;EAEF,OAAOG,iBAAiB,CAACK,MAAM,EAAE,CAACC,IAAI,CAAC,UAAAC,KAAA,EAAyC;IAAA,IAAvCjH,MAAM,GAAAiH,KAAA,CAANjH,MAAM;MAAEkH,UAAU,GAAAD,KAAA,CAAVC,UAAU;MAAEC,aAAa,GAAAF,KAAA,CAAbE,aAAa;IACxE,IAAI,CAACnH,MAAM,EAAE;MACX+B,UAAU,mCAAAC,MAAA,CAAmCkF,UAAU,SAAAlF,MAAA,CAAMmF,aAAa,EAAG;IAC/E;EACF,CAAC,CAAC;AACJ,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMC,WAAW,GACf,SADIA,WAAWA,CACdZ,OAAO;EAAA,OACR;IAAA,IAACa,GAAG,GAAAlH,SAAA,CAAA5C,MAAA,QAAA4C,SAAA,QAAAsG,SAAA,GAAAtG,SAAA,MAAG,CAAC,CAAC;IAAA,OACPmH,QAAA,CAAAvH,OAAA,CAAQwH,OAAO,EAAE,CAACP,IAAI,CAAC,YAAM;MAC3BnE,iBAAiB,CAACwE,GAAG,CAAC;MACtBrE,iBAAiB,CAACqE,GAAG,CAAC;MAEtB,IAAI,EAAE,IAAAG,SAAA,CAAAzH,OAAA,EAAQsH,GAAG,CAACI,GAAG,CAAC,IAAIJ,GAAG,CAACI,GAAG,CAAClK,MAAM,GAAG,CAAC,CAAC,EAAE;QAC7CwE,UAAU,CAAC,6CAA6C,CAAC;MAC3D;MACA,IAAMwE,YAAY,GAAGc,GAAG,CAACI,GAAG,CAACZ,GAAG,CAAC5E,UAAU,CAAC;MAE5CqB,kBAAkB,CAACiD,YAAY,EAAEc,GAAG,CAAC;MACrClC,yBAAyB,CAACoB,YAAY,EAAEc,GAAG,CAAC;;MAE5C;MACA,IAAMK,OAAO,GAAGlB,OAAO,GACnBF,6BAA6B,CAACC,YAAY,EAAEC,OAAO,CAAC,GACpDc,QAAA,CAAAvH,OAAA,CAAQwH,OAAO,EAAE;MAErB,OAAOG,OAAO,CAACV,IAAI,CAAC;QAAA,OAAMK,GAAG;MAAA,EAAC;IAChC,CAAC,CAAC;EAAA;AAAA;AAAC,IAAAM,QAAA,GAEQP,WAAW;AAAAtF,OAAA,CAAA/B,OAAA,GAAA4H,QAAA"}
+{"version":3,"names":["_url","require","_validUrl","_asn1js","_pkijs","_lodash","_nodeJose","_interopRequireDefault","_isomorphicWebcrypto","_safeBuffer","_createForOfIteratorHelper","o","allowArrayLike","it","_Symbol","_Symbol$iterator","_Array$isArray","_unsupportedIterableToArray","length","i","F","s","n","done","value","e","_e","f","TypeError","normalCompletion","didErr","err","call","step","next","_e2","return","minLen","_arrayLikeToArray","Object","prototype","toString","slice","constructor","name","_Array$from","test","arr","len","arr2","Array","_createSuper","Derived","hasNativeReflectConstruct","_isNativeReflectConstruct","_createSuperInternal","Super","_getPrototypeOf2","default","result","NewTarget","_Reflect$construct","arguments","apply","_possibleConstructorReturn2","Reflect","sham","Proxy","Boolean","valueOf","setEngine","crypto","CryptoEngine","subtle","VALID_KTY","VALID_KID_PROTOCOL","X509_COMMON_NAME_KEY","X509_SUBJECT_ALT_NAME_KEY","KMSError","_Error","_inherits2","_super","message","_this","_classCallCheck2","kmsError","_createClass2","_wrapNativeSuper2","Error","exports","throwError","concat","decodeCert","pem","der","Buffer","from","ber","Uint8Array","buffer","asn1","fromBER","Certificate","schema","validateKtyHeader","_ref","kty","validateKidHeader","_ref2","kid","isUri","parseUrl","protocol","validateCommonName","_ref3","_ref4","_ref5","_slicedToArray2","certificate","kidHostname","hostname","validationSuccessful","extensions","_iterator","_step","extension","extnID","altNames","parsedValue","_iterator2","_step2","entry","san","subjectAttributes","subject","typesAndValues","_iterator3","_step3","attribute","type","commonName","valueBlock","validatePublicCertificate","_ref6","_ref7","_ref8","publicExponent","modulus","encode","jose","util","base64url","publicKey","subjectPublicKeyInfo","subjectPublicKey","asn1PublicCert","valueHex","publicCert","RSAPublicKey","publicExponentHex","modulusHex","validateCertificatesSignature","certificates","caroots","undefined","certificateEngine","CertificateChainValidationEngine","trustedCerts","map","certs","verify","then","_ref9","resultCode","resultMessage","validateKMS","jwt","_promise","resolve","isArray","x5c","promise","_default"],"sources":["kms-certificate-validation.js"],"sourcesContent":["import {parse as parseUrl} from 'url';\n\nimport {isUri} from 'valid-url';\nimport {fromBER} from 'asn1js';\nimport {\n  Certificate,\n  RSAPublicKey,\n  CertificateChainValidationEngine,\n  CryptoEngine,\n  setEngine,\n} from 'pkijs';\nimport {isArray} from 'lodash';\nimport jose from 'node-jose';\nimport crypto from 'isomorphic-webcrypto';\nimport {Buffer} from 'safe-buffer';\n\nsetEngine(\n  'newEngine',\n  crypto,\n  new CryptoEngine({\n    name: '',\n    crypto,\n    subtle: crypto.subtle,\n  })\n);\n\nconst VALID_KTY = 'RSA';\nconst VALID_KID_PROTOCOL = 'kms:';\n\nconst X509_COMMON_NAME_KEY = '2.5.4.3';\n\nconst X509_SUBJECT_ALT_NAME_KEY = '2.5.29.17';\n\n/**\n * Customize Error so the SDK knows to quit retrying and notify\n * the user\n */\nexport class KMSError extends Error {\n  /**\n   * add kmsError field to notify\n   * @param {string} message\n   */\n  constructor(message) {\n    super(message);\n    this.kmsError = true;\n  }\n}\n\nconst throwError = (err) => {\n  throw new KMSError(`INVALID KMS: ${err}`);\n};\n\n/**\n * Converts the PEM string to a pkijs certificate object\n * @param {string} pem PEM representation of a certificate\n * @returns {Certificate} pkijs object of the certificate\n */\nconst decodeCert = (pem) => {\n  if (typeof pem !== 'string') {\n    throwError('certificate needs to be a string');\n  }\n\n  const der = Buffer.from(pem, 'base64');\n  const ber = new Uint8Array(der).buffer;\n\n  const asn1 = fromBER(ber);\n\n  return new Certificate({schema: asn1.result});\n};\n\n/**\n * Validate the 'kty' property of the KMS credentials\n * @param {Object} JWT KMS credentials\n * @param {string} JWT.kty type of certificate\n * @throws {KMSError} if kty is not a valid type\n * @returns {void}\n */\nconst validateKtyHeader = ({kty}) => {\n  if (kty !== VALID_KTY) {\n    throwError(`'kty' header must be '${VALID_KTY}'`);\n  }\n};\n\nconst validateKidHeader = ({kid}) => {\n  if (!isUri(kid)) {\n    throwError(\"'kid' is not a valid URI\");\n  }\n\n  if (parseUrl(kid).protocol !== VALID_KID_PROTOCOL) {\n    throwError(`'kid' protocol must be '${VALID_KID_PROTOCOL}'`);\n  }\n};\n\n/**\n * Checks the first certificate matches the 'kid' in the JWT.\n * It first checks the Subject Alternative Name then it checks\n * the Common Name\n * @param {Certificate} certificate represents the KMS\n * @param {Object} JWT KMS credentials\n * @param {string} JWT.kid the uri of the KMS\n * @throws {KMSError} if unable to validate certificate against KMS credentials\n * @returns {void}\n */\nconst validateCommonName = ([certificate], {kid}) => {\n  const kidHostname = parseUrl(kid).hostname;\n  let validationSuccessful = false;\n\n  if (certificate.extensions) {\n    // Subject Alt Names are in here\n    for (const extension of certificate.extensions) {\n      if (extension.extnID === X509_SUBJECT_ALT_NAME_KEY) {\n        const {altNames} = extension.parsedValue;\n\n        for (const entry of altNames) {\n          const san = entry.value;\n\n          validationSuccessful = san === kidHostname;\n          if (validationSuccessful) {\n            break;\n          }\n        }\n\n        if (validationSuccessful) {\n          break;\n        }\n      }\n    }\n  }\n\n  if (!validationSuccessful) {\n    // Didn't match kid in the Subject Alt Names, checking the Common Name\n    const subjectAttributes = certificate.subject.typesAndValues;\n\n    for (const attribute of subjectAttributes) {\n      if (attribute.type === X509_COMMON_NAME_KEY) {\n        const commonName = attribute.value.valueBlock.value;\n\n        validationSuccessful = commonName === kidHostname;\n        if (validationSuccessful) {\n          break;\n        }\n      }\n    }\n  }\n\n  if (!validationSuccessful) {\n    throwError(\"hostname of the 1st certificate does not match 'kid'\");\n  }\n};\n\n/**\n * Validate the first KMS certificate against the information\n * provided in the JWT\n * @param {Certificate} certificate first certificate the identifies the KMS\n * @param {Object} JWT credentials of the KMS\n * @param {string} JWT.e Public exponent of the first certificate\n * @param {string} KWT.n Modulus of the first certificate\n * @throws {KMSError} if e or n doesn't match the first certificate\n * @returns {void}\n */\nconst validatePublicCertificate = ([certificate], {e: publicExponent, n: modulus}) => {\n  const {encode} = jose.util.base64url;\n\n  const publicKey = certificate.subjectPublicKeyInfo.subjectPublicKey;\n  const asn1PublicCert = fromBER(publicKey.valueBlock.valueHex);\n  const publicCert = new RSAPublicKey({schema: asn1PublicCert.result});\n  const publicExponentHex = publicCert.publicExponent.valueBlock.valueHex;\n  const modulusHex = publicCert.modulus.valueBlock.valueHex;\n\n  if (publicExponent !== encode(publicExponentHex)) {\n    throwError('Public exponent is invalid');\n  }\n  if (modulus !== encode(modulusHex)) {\n    throwError('Modulus is invalid');\n  }\n};\n\n/**\n * Validates the list of certificates against the CAs provided\n * @param {certificate[]} certificates list of certificates provided\n *   by the KMS to certify itself\n * @param {string[]} [caroots=[]] list of Certificate Authorities used to\n *   validate the KMS's certificates\n * @returns {Promise} rejects if unable to validate the certificates\n */\nconst validateCertificatesSignature = (certificates, caroots = []) => {\n  const certificateEngine = new CertificateChainValidationEngine({\n    trustedCerts: caroots.map(decodeCert),\n    certs: certificates,\n  });\n\n  return certificateEngine.verify().then(({result, resultCode, resultMessage}) => {\n    if (!result) {\n      throwError(`Certificate Validation failed [${resultCode}]: ${resultMessage}`);\n    }\n  });\n};\n\n/**\n * Validates the information provided by the KMS. This is a curried function.\n * The first function takes the caroots param and returns a second function.\n * The second function takes the credentials of the KMS and validates it\n * @param {string[]} caroots PEM encoded certificates that will be used\n *   as Certificate Authorities\n * @param {Object} jwt Object containing the fields necessary to\n *   validate the KMS\n * @returns {Promise} when resolved will return the jwt\n */\nconst validateKMS =\n  (caroots) =>\n  (jwt = {}) =>\n    Promise.resolve().then(() => {\n      validateKtyHeader(jwt);\n      validateKidHeader(jwt);\n\n      if (!(isArray(jwt.x5c) && jwt.x5c.length > 0)) {\n        throwError('JWK does not contain a list of certificates');\n      }\n      const certificates = jwt.x5c.map(decodeCert);\n\n      validateCommonName(certificates, jwt);\n      validatePublicCertificate(certificates, jwt);\n\n      // Skip validating signatures if no CA roots were provided\n      const promise = caroots\n        ? validateCertificatesSignature(certificates, caroots)\n        : Promise.resolve();\n\n      return promise.then(() => jwt);\n    });\n\nexport default validateKMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,IAAA,GAAAC,OAAA;AAEA,IAAAC,SAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAOA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,SAAA,GAAAC,sBAAA,CAAAN,OAAA;AACA,IAAAO,oBAAA,GAAAD,sBAAA,CAAAN,OAAA;AACA,IAAAQ,WAAA,GAAAR,OAAA;AAAmC,SAAAS,2BAAAC,CAAA,EAAAC,cAAA,QAAAC,EAAA,UAAAC,OAAA,oBAAAH,CAAA,CAAAI,gBAAA,KAAAJ,CAAA,qBAAAE,EAAA,QAAAG,cAAA,CAAAL,CAAA,MAAAE,EAAA,GAAAI,2BAAA,CAAAN,CAAA,MAAAC,cAAA,IAAAD,CAAA,WAAAA,CAAA,CAAAO,MAAA,qBAAAL,EAAA,EAAAF,CAAA,GAAAE,EAAA,MAAAM,CAAA,UAAAC,CAAA,YAAAA,EAAA,eAAAC,CAAA,EAAAD,CAAA,EAAAE,CAAA,WAAAA,EAAA,QAAAH,CAAA,IAAAR,CAAA,CAAAO,MAAA,WAAAK,IAAA,mBAAAA,IAAA,SAAAC,KAAA,EAAAb,CAAA,CAAAQ,CAAA,UAAAM,CAAA,WAAAA,EAAAC,EAAA,UAAAA,EAAA,KAAAC,CAAA,EAAAP,CAAA,gBAAAQ,SAAA,iJAAAC,gBAAA,SAAAC,MAAA,UAAAC,GAAA,WAAAV,CAAA,WAAAA,EAAA,IAAAR,EAAA,GAAAA,EAAA,CAAAmB,IAAA,CAAArB,CAAA,MAAAW,CAAA,WAAAA,EAAA,QAAAW,IAAA,GAAApB,EAAA,CAAAqB,IAAA,IAAAL,gBAAA,GAAAI,IAAA,CAAAV,IAAA,SAAAU,IAAA,KAAAR,CAAA,WAAAA,EAAAU,GAAA,IAAAL,MAAA,SAAAC,GAAA,GAAAI,GAAA,KAAAR,CAAA,WAAAA,EAAA,eAAAE,gBAAA,IAAAhB,EAAA,CAAAuB,MAAA,UAAAvB,EAAA,CAAAuB,MAAA,oBAAAN,MAAA,QAAAC,GAAA;AAAA,SAAAd,4BAAAN,CAAA,EAAA0B,MAAA,SAAA1B,CAAA,qBAAAA,CAAA,sBAAA2B,iBAAA,CAAA3B,CAAA,EAAA0B,MAAA,OAAAf,CAAA,GAAAiB,MAAA,CAAAC,SAAA,CAAAC,QAAA,CAAAT,IAAA,CAAArB,CAAA,EAAA+B,KAAA,aAAApB,CAAA,iBAAAX,CAAA,CAAAgC,WAAA,EAAArB,CAAA,GAAAX,CAAA,CAAAgC,WAAA,CAAAC,IAAA,MAAAtB,CAAA,cAAAA,CAAA,mBAAAuB,WAAA,CAAAlC,CAAA,OAAAW,CAAA,+DAAAwB,IAAA,CAAAxB,CAAA,UAAAgB,iBAAA,CAAA3B,CAAA,EAAA0B,MAAA;AAAA,SAAAC,kBAAAS,GAAA,EAAAC,GAAA,QAAAA,GAAA,YAAAA,GAAA,GAAAD,GAAA,CAAA7B,MAAA,EAAA8B,GAAA,GAAAD,GAAA,CAAA7B,MAAA,WAAAC,CAAA,MAAA8B,IAAA,OAAAC,KAAA,CAAAF,GAAA,GAAA7B,CAAA,GAAA6B,GAAA,EAAA7B,CAAA,IAAA8B,IAAA,CAAA9B,CAAA,IAAA4B,GAAA,CAAA5B,CAAA,UAAA8B,IAAA;AAAA,SAAAE,aAAAC,OAAA,QAAAC,yBAAA,GAAAC,yBAAA,oBAAAC,qBAAA,QAAAC,KAAA,OAAAC,gBAAA,CAAAC,OAAA,EAAAN,OAAA,GAAAO,MAAA,MAAAN,yBAAA,QAAAO,SAAA,OAAAH,gBAAA,CAAAC,OAAA,QAAAf,WAAA,EAAAgB,MAAA,GAAAE,kBAAA,CAAAL,KAAA,EAAAM,SAAA,EAAAF,SAAA,YAAAD,MAAA,GAAAH,KAAA,CAAAO,KAAA,OAAAD,SAAA,gBAAAE,2BAAA,CAAAN,OAAA,QAAAC,MAAA;AAAA,SAAAL,0BAAA,eAAAW,OAAA,qBAAAJ,kBAAA,oBAAAA,kBAAA,CAAAK,IAAA,2BAAAC,KAAA,oCAAAC,OAAA,CAAA5B,SAAA,CAAA6B,OAAA,CAAArC,IAAA,CAAA6B,kBAAA,CAAAO,OAAA,8CAAA3C,CAAA;AAEnC,IAAA6C,gBAAS,EACP,WAAW,EACXC,4BAAM,EACN,IAAIC,mBAAY,CAAC;EACf5B,IAAI,EAAE,EAAE;EACR2B,MAAM,EAANA,4BAAM;EACNE,MAAM,EAAEF,4BAAM,CAACE;AACjB,CAAC,CAAC,CACH;AAED,IAAMC,SAAS,GAAG,KAAK;AACvB,IAAMC,kBAAkB,GAAG,MAAM;AAEjC,IAAMC,oBAAoB,GAAG,SAAS;AAEtC,IAAMC,yBAAyB,GAAG,WAAW;;AAE7C;AACA;AACA;AACA;AAHA,IAIaC,QAAQ,0BAAAC,MAAA;EAAA,IAAAC,UAAA,CAAAtB,OAAA,EAAAoB,QAAA,EAAAC,MAAA;EAAA,IAAAE,MAAA,GAAA9B,YAAA,CAAA2B,QAAA;EACnB;AACF;AACA;AACA;EACE,SAAAA,SAAYI,OAAO,EAAE;IAAA,IAAAC,KAAA;IAAA,IAAAC,gBAAA,CAAA1B,OAAA,QAAAoB,QAAA;IACnBK,KAAA,GAAAF,MAAA,CAAAjD,IAAA,OAAMkD,OAAO;IACbC,KAAA,CAAKE,QAAQ,GAAG,IAAI;IAAC,OAAAF,KAAA;EACvB;EAAC,WAAAG,aAAA,CAAA5B,OAAA,EAAAoB,QAAA;AAAA,oBAAAS,iBAAA,CAAA7B,OAAA,EAR2B8B,KAAK;AAAAC,OAAA,CAAAX,QAAA,GAAAA,QAAA;AAWnC,IAAMY,UAAU,GAAG,SAAbA,UAAUA,CAAI3D,GAAG,EAAK;EAC1B,MAAM,IAAI+C,QAAQ,iBAAAa,MAAA,CAAiB5D,GAAG,EAAG;AAC3C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,IAAM6D,UAAU,GAAG,SAAbA,UAAUA,CAAIC,GAAG,EAAK;EAC1B,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3BH,UAAU,CAAC,kCAAkC,CAAC;EAChD;EAEA,IAAMI,GAAG,GAAGC,kBAAM,CAACC,IAAI,CAACH,GAAG,EAAE,QAAQ,CAAC;EACtC,IAAMI,GAAG,GAAG,IAAIC,UAAU,CAACJ,GAAG,CAAC,CAACK,MAAM;EAEtC,IAAMC,IAAI,GAAG,IAAAC,eAAO,EAACJ,GAAG,CAAC;EAEzB,OAAO,IAAIK,kBAAW,CAAC;IAACC,MAAM,EAAEH,IAAI,CAACzC;EAAM,CAAC,CAAC;AAC/C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAM6C,iBAAiB,GAAG,SAApBA,iBAAiBA,CAAAC,IAAA,EAAc;EAAA,IAATC,GAAG,GAAAD,IAAA,CAAHC,GAAG;EAC7B,IAAIA,GAAG,KAAKhC,SAAS,EAAE;IACrBgB,UAAU,0BAAAC,MAAA,CAA0BjB,SAAS,OAAI;EACnD;AACF,CAAC;AAED,IAAMiC,iBAAiB,GAAG,SAApBA,iBAAiBA,CAAAC,KAAA,EAAc;EAAA,IAATC,GAAG,GAAAD,KAAA,CAAHC,GAAG;EAC7B,IAAI,CAAC,IAAAC,eAAK,EAACD,GAAG,CAAC,EAAE;IACfnB,UAAU,CAAC,0BAA0B,CAAC;EACxC;EAEA,IAAI,IAAAqB,UAAQ,EAACF,GAAG,CAAC,CAACG,QAAQ,KAAKrC,kBAAkB,EAAE;IACjDe,UAAU,4BAAAC,MAAA,CAA4BhB,kBAAkB,OAAI;EAC9D;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMsC,kBAAkB,GAAG,SAArBA,kBAAkBA,CAAAC,KAAA,EAAAC,KAAA,EAA6B;EAAA,IAAAC,KAAA,OAAAC,eAAA,CAAA3D,OAAA,EAAAwD,KAAA;IAAxBI,WAAW,GAAAF,KAAA;EAAA,IAAIP,GAAG,GAAAM,KAAA,CAAHN,GAAG;EAC7C,IAAMU,WAAW,GAAG,IAAAR,UAAQ,EAACF,GAAG,CAAC,CAACW,QAAQ;EAC1C,IAAIC,oBAAoB,GAAG,KAAK;EAEhC,IAAIH,WAAW,CAACI,UAAU,EAAE;IAC1B;IAAA,IAAAC,SAAA,GAAAjH,0BAAA,CACwB4G,WAAW,CAACI,UAAU;MAAAE,KAAA;IAAA;MAA9C,KAAAD,SAAA,CAAAtG,CAAA,MAAAuG,KAAA,GAAAD,SAAA,CAAArG,CAAA,IAAAC,IAAA,GAAgD;QAAA,IAArCsG,SAAS,GAAAD,KAAA,CAAApG,KAAA;QAClB,IAAIqG,SAAS,CAACC,MAAM,KAAKjD,yBAAyB,EAAE;UAClD,IAAOkD,QAAQ,GAAIF,SAAS,CAACG,WAAW,CAAjCD,QAAQ;UAA0B,IAAAE,UAAA,GAAAvH,0BAAA,CAErBqH,QAAQ;YAAAG,MAAA;UAAA;YAA5B,KAAAD,UAAA,CAAA5G,CAAA,MAAA6G,MAAA,GAAAD,UAAA,CAAA3G,CAAA,IAAAC,IAAA,GAA8B;cAAA,IAAnB4G,KAAK,GAAAD,MAAA,CAAA1G,KAAA;cACd,IAAM4G,GAAG,GAAGD,KAAK,CAAC3G,KAAK;cAEvBiG,oBAAoB,GAAGW,GAAG,KAAKb,WAAW;cAC1C,IAAIE,oBAAoB,EAAE;gBACxB;cACF;YACF;UAAC,SAAA1F,GAAA;YAAAkG,UAAA,CAAAxG,CAAA,CAAAM,GAAA;UAAA;YAAAkG,UAAA,CAAAtG,CAAA;UAAA;UAED,IAAI8F,oBAAoB,EAAE;YACxB;UACF;QACF;MACF;IAAC,SAAA1F,GAAA;MAAA4F,SAAA,CAAAlG,CAAA,CAAAM,GAAA;IAAA;MAAA4F,SAAA,CAAAhG,CAAA;IAAA;EACH;EAEA,IAAI,CAAC8F,oBAAoB,EAAE;IACzB;IACA,IAAMY,iBAAiB,GAAGf,WAAW,CAACgB,OAAO,CAACC,cAAc;IAAC,IAAAC,UAAA,GAAA9H,0BAAA,CAErC2H,iBAAiB;MAAAI,MAAA;IAAA;MAAzC,KAAAD,UAAA,CAAAnH,CAAA,MAAAoH,MAAA,GAAAD,UAAA,CAAAlH,CAAA,IAAAC,IAAA,GAA2C;QAAA,IAAhCmH,SAAS,GAAAD,MAAA,CAAAjH,KAAA;QAClB,IAAIkH,SAAS,CAACC,IAAI,KAAK/D,oBAAoB,EAAE;UAC3C,IAAMgE,UAAU,GAAGF,SAAS,CAAClH,KAAK,CAACqH,UAAU,CAACrH,KAAK;UAEnDiG,oBAAoB,GAAGmB,UAAU,KAAKrB,WAAW;UACjD,IAAIE,oBAAoB,EAAE;YACxB;UACF;QACF;MACF;IAAC,SAAA1F,GAAA;MAAAyG,UAAA,CAAA/G,CAAA,CAAAM,GAAA;IAAA;MAAAyG,UAAA,CAAA7G,CAAA;IAAA;EACH;EAEA,IAAI,CAAC8F,oBAAoB,EAAE;IACzB/B,UAAU,CAAC,sDAAsD,CAAC;EACpE;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMoD,yBAAyB,GAAG,SAA5BA,yBAAyBA,CAAAC,KAAA,EAAAC,KAAA,EAAuD;EAAA,IAAAC,KAAA,OAAA5B,eAAA,CAAA3D,OAAA,EAAAqF,KAAA;IAAlDzB,WAAW,GAAA2B,KAAA;EAAA,IAAOC,cAAc,GAAAF,KAAA,CAAjBvH,CAAC;IAAqB0H,OAAO,GAAAH,KAAA,CAAV1H,CAAC;EACrE,IAAO8H,MAAM,GAAIC,iBAAI,CAACC,IAAI,CAACC,SAAS,CAA7BH,MAAM;EAEb,IAAMI,SAAS,GAAGlC,WAAW,CAACmC,oBAAoB,CAACC,gBAAgB;EACnE,IAAMC,cAAc,GAAG,IAAAtD,eAAO,EAACmD,SAAS,CAACX,UAAU,CAACe,QAAQ,CAAC;EAC7D,IAAMC,UAAU,GAAG,IAAIC,mBAAY,CAAC;IAACvD,MAAM,EAAEoD,cAAc,CAAChG;EAAM,CAAC,CAAC;EACpE,IAAMoG,iBAAiB,GAAGF,UAAU,CAACX,cAAc,CAACL,UAAU,CAACe,QAAQ;EACvE,IAAMI,UAAU,GAAGH,UAAU,CAACV,OAAO,CAACN,UAAU,CAACe,QAAQ;EAEzD,IAAIV,cAAc,KAAKE,MAAM,CAACW,iBAAiB,CAAC,EAAE;IAChDrE,UAAU,CAAC,4BAA4B,CAAC;EAC1C;EACA,IAAIyD,OAAO,KAAKC,MAAM,CAACY,UAAU,CAAC,EAAE;IAClCtE,UAAU,CAAC,oBAAoB,CAAC;EAClC;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMuE,6BAA6B,GAAG,SAAhCA,6BAA6BA,CAAIC,YAAY,EAAmB;EAAA,IAAjBC,OAAO,GAAArG,SAAA,CAAA5C,MAAA,QAAA4C,SAAA,QAAAsG,SAAA,GAAAtG,SAAA,MAAG,EAAE;EAC/D,IAAMuG,iBAAiB,GAAG,IAAIC,uCAAgC,CAAC;IAC7DC,YAAY,EAAEJ,OAAO,CAACK,GAAG,CAAC5E,UAAU,CAAC;IACrC6E,KAAK,EAAEP;EACT,CAAC,CAAC;EAEF,OAAOG,iBAAiB,CAACK,MAAM,EAAE,CAACC,IAAI,CAAC,UAAAC,KAAA,EAAyC;IAAA,IAAvCjH,MAAM,GAAAiH,KAAA,CAANjH,MAAM;MAAEkH,UAAU,GAAAD,KAAA,CAAVC,UAAU;MAAEC,aAAa,GAAAF,KAAA,CAAbE,aAAa;IACxE,IAAI,CAACnH,MAAM,EAAE;MACX+B,UAAU,mCAAAC,MAAA,CAAmCkF,UAAU,SAAAlF,MAAA,CAAMmF,aAAa,EAAG;IAC/E;EACF,CAAC,CAAC;AACJ,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAMC,WAAW,GACf,SADIA,WAAWA,CACdZ,OAAO;EAAA,OACR;IAAA,IAACa,GAAG,GAAAlH,SAAA,CAAA5C,MAAA,QAAA4C,SAAA,QAAAsG,SAAA,GAAAtG,SAAA,MAAG,CAAC,CAAC;IAAA,OACPmH,QAAA,CAAAvH,OAAA,CAAQwH,OAAO,EAAE,CAACP,IAAI,CAAC,YAAM;MAC3BnE,iBAAiB,CAACwE,GAAG,CAAC;MACtBrE,iBAAiB,CAACqE,GAAG,CAAC;MAEtB,IAAI,EAAE,IAAAG,eAAO,EAACH,GAAG,CAACI,GAAG,CAAC,IAAIJ,GAAG,CAACI,GAAG,CAAClK,MAAM,GAAG,CAAC,CAAC,EAAE;QAC7CwE,UAAU,CAAC,6CAA6C,CAAC;MAC3D;MACA,IAAMwE,YAAY,GAAGc,GAAG,CAACI,GAAG,CAACZ,GAAG,CAAC5E,UAAU,CAAC;MAE5CqB,kBAAkB,CAACiD,YAAY,EAAEc,GAAG,CAAC;MACrClC,yBAAyB,CAACoB,YAAY,EAAEc,GAAG,CAAC;;MAE5C;MACA,IAAMK,OAAO,GAAGlB,OAAO,GACnBF,6BAA6B,CAACC,YAAY,EAAEC,OAAO,CAAC,GACpDc,QAAA,CAAAvH,OAAA,CAAQwH,OAAO,EAAE;MAErB,OAAOG,OAAO,CAACV,IAAI,CAAC;QAAA,OAAMK,GAAG;MAAA,EAAC;IAChC,CAAC,CAAC;EAAA;AAAA;AAAC,IAAAM,QAAA,GAEQP,WAAW;AAAAtF,OAAA,CAAA/B,OAAA,GAAA4H,QAAA"}

package/dist/kms.js

@@ -16,7 +16,6 @@ var _promise = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/pr
 var _stringify = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/json/stringify"));
 var _now = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/date/now"));
 var _getOwnPropertyDescriptor = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/object/get-own-property-descriptor"));
-var _omit2 = _interopRequireDefault(require("lodash/omit"));
 var _querystring = _interopRequireDefault(require("querystring"));
 var _util = _interopRequireDefault(require("util"));
 var _commonTimers = require("@webex/common-timers");
@@ -24,6 +23,7 @@ var _common = require("@webex/common");
 var _webexCore = require("@webex/webex-core");
 var _nodeKms = require("node-kms");
 var _nodeJose = _interopRequireDefault(require("node-jose"));
+var _lodash = require("lodash");
 var _uuid = _interopRequireDefault(require("uuid"));
 var _kmsBatcher = _interopRequireWildcard(require("./kms-batcher"));
 var _kmsCertificateValidation = _interopRequireWildcard(require("./kms-certificate-validation"));
@@ -487,7 +487,7 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
       }).then(function () {
         /* istanbul ignore else */
         if (process.env.NODE_ENV !== 'production') {
-          _this14.logger.info('kms: request payload', _util.default.inspect((0, _omit2.default)(JSON.parse((0, _stringify.default)(req)), 'wrapped'), {
+          _this14.logger.info('kms: request payload', _util.default.inspect((0, _lodash.omit)(JSON.parse((0, _stringify.default)(req)), 'wrapped'), {
             depth: null
           }));
         }
@@ -515,7 +515,7 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
         // eslint-disable-next-line max-nested-callbacks
         .then(function () {
           if (process.env.NODE_ENV !== 'production') {
-            _this15.logger.info('kms: response payload', _util.default.inspect((0, _omit2.default)(JSON.parse((0, _stringify.default)(res)), 'wrapped'), {
+            _this15.logger.info('kms: response payload', _util.default.inspect((0, _lodash.omit)(JSON.parse((0, _stringify.default)(res)), 'wrapped'), {
               depth: null
             }));
           }
@@ -802,7 +802,7 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
     context.ephemeralKey = originalContext.ephemeralKey;
     return context;
   },
-  version: "2.58.1"
+  version: "modern"
 }, ((0, _applyDecoratedDescriptor2.default)(_obj, "fetchKey", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "fetchKey"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "_getContext", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "_getContext"), _obj)), _obj)));
 var _default = KMS;
 exports.default = _default;

package/dist/kms.js.map

@@ -1 +1 @@
-{"version":3,"names":["_querystring","_interopRequireDefault","require","_util","_commonTimers","_common","_webexCore","_nodeKms","_nodeJose","_uuid","_kmsBatcher","_interopRequireWildcard","_kmsCertificateValidation","_dec","_obj","_getRequireWildcardCache","nodeInterop","_WeakMap2","cacheBabelInterop","cacheNodeInterop","obj","__esModule","_typeof","default","cache","has","get","newObj","hasPropertyDescriptor","_Object$defineProperty","_Object$getOwnPropertyDescriptor2","key","Object","prototype","hasOwnProperty","call","desc","set","contexts","_weakMap","kmsDetails","partialContexts","consoleDebug","KMS","WebexPlugin","extend","oneFlight","keyFactory","_ref","uri","onBehalfOf","concat","namespace","children","batcher","KMSBatcher","bindKey","_ref2","_this","kro","kroUri","keyUri","logger","info","_promise","reject","Error","request","method","resourceUri","then","res","createResource","_ref3","_this2","userIds","keyUris","keys","reduce","uris","k","push","length","resource","addAuthorization","_ref4","_this3","authIds","authorizations","listAuthorizations","_ref5","_this4","removeAuthorization","_ref6","_this5","authId","userId","querystring","stringify","createUnboundKeys","_ref7","_this6","count","all","map","asKey","fetchPublicKey","_ref8","_this7","assignedOrgId","publicKey","uploadCustomerMasterKey","_ref9","_this8","customerMasterKey","_ref9$awsKms","awsKms","requestId","uuid","v4","listAllCustomerMasterKey","_ref10","_this9","_ref10$awsKms","changeCustomerMasterKeyState","_ref11","_this10","keyId","keyState","deleteAllCustomerMasterKeys","_ref12","_this11","_ref12$awsKms","useGlobalMasterKey","_ref13","_this12","fetchKey","_ref14","_this13","ping","jose","JWK","jwk","prepareRequest","payload","_this14","isECDHRequest","includes","resolve","_getContext","context","req","Request","requestContext","_contextOnBehalfOf","wrap","serverKey","process","env","NODE_ENV","util","inspect","_omit2","JSON","parse","_stringify","depth","processKmsMessageEvent","event","_this15","encryption","kmsMessages","kmsMessage","index","_isECDHEMessage","isECDHMessage","Response","unwrap","catch","reason","error","stack","decryptKmsMessage","body","_getKMSStaticPubKey","kmsStaticPubKey","fields","split","header","base64url","decode","kid","_this16","_ref15","arguments","undefined","timeout","config","kmsInitialTimeout","webex","internal","mercury","connect","TIMEOUT_SYMBOL","status","statusCode","message","match","warn","KMSError","trigger","ecdhMaxTimeout","nextTimeout","kmsMaxTimeout","delete","_getAuthorization","credentials","getUserToken","token","access_token","_this17","promise","_prepareContext","expiresIn","ephemeralKey","expirationDate","_now","safeSetTimeout","_ref16","_ref17","_slicedToArray2","authorization","clientInfo","credential","bearer","_getKMSCluster","_getKMSDetails","_ref18","kmsCluster","_this18","details","service","device","rsaPublicKey","_ref19","_this19","Context","validateKMS","caroots","_ref20","_ref21","clientId","url","serverInfo","createECDHKey","localECDHKey","_ref22","_ref23","cluster","toJSON","deriveEphemeralKey","originalContext","version","_applyDecoratedDescriptor2","_getOwnPropertyDescriptor","_default","exports"],"sources":["kms.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport util from 'util';\n\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {oneFlight} from '@webex/common';\nimport {WebexPlugin} from '@webex/webex-core';\nimport {Context, Request, Response} from 'node-kms';\nimport jose from 'node-jose';\nimport {omit} from 'lodash';\nimport uuid from 'uuid';\n\nimport KMSBatcher, {TIMEOUT_SYMBOL} from './kms-batcher';\nimport validateKMS, {KMSError} from './kms-certificate-validation';\n\nconst contexts = new WeakMap();\nconst kmsDetails = new WeakMap();\nconst partialContexts = new WeakMap();\n\nconst consoleDebug = require('debug')('kms');\n\n/**\n * @class\n */\nconst KMS = WebexPlugin.extend({\n  namespace: 'Encryption',\n\n  children: {\n    batcher: KMSBatcher,\n  },\n\n  /**\n   * Binds a key to a resource\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro\n   * @param {string} options.kroUri\n   * @param {Key} options.key\n   * @param {string} options.keyUri\n   * @returns {Promise<Key>}\n   */\n  bindKey({kro, kroUri, key, keyUri}) {\n    kroUri = kroUri || kro.uri;\n    keyUri = keyUri || key.uri;\n\n    this.logger.info('kms: binding key to resource');\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    /* istanbul ignore if */\n    if (!keyUri) {\n      return Promise.reject(new Error('`key` or `keyUri` is required'));\n    }\n\n    return this.request({\n      method: 'update',\n      resourceUri: kroUri,\n      uri: keyUri,\n    }).then((res) => {\n      this.logger.info('kms: bound key to resource');\n\n      return res.key;\n    });\n  },\n\n  /**\n   * Creates a new KMS Resource\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.keyUris\n   * @param {Key} options.key\n   * @param {Array<Keys>} options.keys\n   * @returns {Promise<KMSResourceObject>}\n   */\n  createResource({userIds, keyUris, key, keys}) {\n    keyUris = keyUris || [];\n    /* istanbul ignore if */\n    if (keys) {\n      keyUris = keys.reduce((uris, k) => {\n        uris.push(k.uri);\n\n        return uris;\n      }, keyUris);\n    }\n\n    /* istanbul ignore else */\n    if (key) {\n      keyUris.push(key.uri);\n    }\n\n    /* istanbul ignore if */\n    if (keyUris.length === 0) {\n      return Promise.reject(new Error('Cannot create KMS Resource without at least one keyUri'));\n    }\n\n    this.logger.info('kms: creating resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/resources',\n      userIds,\n      keyUris,\n    }).then((res) => {\n      this.logger.info('kms: created resource');\n\n      return res.resource;\n    });\n  },\n\n  /**\n   * Authorizes a user or KRO to a KRO\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.authIds interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  addAuthorization({userIds, authIds, kro, kroUri}) {\n    userIds = userIds || [];\n    kroUri = kroUri || kro.uri;\n\n    if (authIds) {\n      userIds = userIds.concat(authIds);\n    }\n\n    /* istanbul ignore if */\n    if (userIds.length === 0) {\n      return Promise.reject(new Error('Cannot add authorization without userIds or authIds'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: adding authorization to kms resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/authorizations',\n      resourceUri: kroUri,\n      userIds,\n    }).then((res) => {\n      this.logger.info('kms: added authorization');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Retrieve a list of users that have been authorized to the KRO\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Array<authId>}\n   */\n  listAuthorizations({kro, kroUri}) {\n    kroUri = kroUri || kro.uri;\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    return this.request({\n      method: 'retrieve',\n      uri: `${kroUri}/authorizations`,\n    }).then((res) => {\n      this.logger.info('kms: retrieved authorization list');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Deauthorizes a user or KRO from a KRO\n   * @param {Object} options\n   * @param {string} options.userId\n   * @param {string} options.authId interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  removeAuthorization({authId, userId, kro, kroUri}) {\n    authId = authId || userId;\n    kroUri = kroUri || kro.uri;\n\n    /* istanbul ignore if */\n    if (!authId) {\n      return Promise.reject(new Error('Cannot remove authorization without authId'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: removing authorization from kms resource');\n\n    return this.request({\n      method: 'delete',\n      uri: `${kroUri}/authorizations?${querystring.stringify({authId})}`,\n    }).then((res) => {\n      this.logger.info('kms: removed authorization');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Requests `count` unbound keys from the kms\n   * @param {Object} options\n   * @param {Number} options.count\n   * @returns {Array<Key>}\n   */\n  createUnboundKeys({count}) {\n    this.logger.info(`kms: request ${count} unbound keys`);\n\n    /* istanbul ignore if */\n    if (!count) {\n      return Promise.reject(new Error('`options.count` is required'));\n    }\n\n    return this.request({\n      method: 'create',\n      uri: '/keys',\n      count,\n    }).then((res) => {\n      this.logger.info('kms: received unbound keys');\n\n      return Promise.all(res.keys.map(this.asKey));\n    });\n  },\n\n  /**\n   * @typedef {Object} FetchPublicKeyResponse\n   * @property {number} status 200,400(Bad Request: Request payload missing info),404(Not Found: HSM Public Key not found),501(Not Implemented: This KMS does not support BYOK),502(Bad Gateway: KMS could not communicate with HSM)\n   * @property {UUID} requestId this is should be unique, used for debug.\n   * @property {string} publicKey\n   */\n  /**\n   * get public key from kms\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<FetchPublicKeyResponse>} response of get public key api\n   */\n  fetchPublicKey({assignedOrgId}) {\n    this.logger.info('kms: fetch public key for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: '/publicKey',\n      assignedOrgId,\n    }).then((res) => {\n      this.logger.info('kms: received public key');\n\n      return res.publicKey;\n    });\n  },\n\n  /**\n   * @typedef {Object} UploadCmkResponse\n   * @property {number} status\n   * @property {UUID} requestId\n   * @property {string} uri\n   * @property {string} keysState\n   */\n  /**\n   * upload master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {string} options.customerMasterKey the master key\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<UploadCmkResponse>} response of upload CMK api\n   */\n  uploadCustomerMasterKey({assignedOrgId, customerMasterKey, awsKms = false}) {\n    this.logger.info('kms: upload customer master key for byok');\n\n    return this.request({\n      method: 'create',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      customerMasterKey,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to upload customer master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * get all customer master keys for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  listAllCustomerMasterKey({assignedOrgId, awsKms = false}) {\n    this.logger.info('kms: get all customer master keys for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to get all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * @typedef {Object} ActivateCmkResponse\n   * @property {number} status\n   * @property {UUID} requestId\n   * @property {Array<CMK>} customerMasterKeys\n   */\n  /**\n   *\n   * @typedef {Object} CMK\n   * @property {string} usageState\n   * @property {UUID} assignedOrgId\n   * @property {string} uri\n   * @property {string} source\n   * @property {Date | undefined} stateUpdatedOn\n   * @property {Date | undefined} rotation\n   */\n  /**\n   * change one customer master key state for one org.\n   * delete pending key, then the keyState should be 'removedclean';\n   * active pending key, then the keyState should be 'active';\n   *\n   * @param {Object} options\n   * @param {string} options.keyId the id of one customer master key, it should be a url\n   * @param {string} options.keyState one of the following: PENDING, RECOVERING,ACTIVE,REVOKED,DEACTIVATED,REENCRYPTING,RETIRED,DELETED,DISABLED,REMOVEDCLEAN,REMOVEDDIRTY;\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  changeCustomerMasterKeyState({keyId, keyState, assignedOrgId}) {\n    this.logger.info('kms: change one customer master key state for byok');\n\n    return this.request({\n      method: 'update',\n      uri: keyId,\n      keyState,\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to change the customer master key state to {}', keyState);\n\n      return res;\n    });\n  },\n\n  /**\n   * this is for test case. it will delete all CMKs, no matter what their status is. This is mainly for test purpose\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<{status, requestId}>}\n   */\n  deleteAllCustomerMasterKeys({assignedOrgId, awsKms = false}) {\n    this.logger.info('kms: delete all customer master keys at the same time');\n\n    return this.request({\n      method: 'delete',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to delete all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * return to use global master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of activate CMK api\n   */\n  useGlobalMasterKey({assignedOrgId}) {\n    this.logger.info('kms: return to use global master key');\n\n    return this.request({\n      method: 'update',\n      uri: 'default',\n      keyState: 'ACTIVE',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to return to global master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * Fetches the specified key from the kms\n   * @param {Object} options\n   * @param {string} options.uri\n   * @param {string} options.onBehalfOf The id of a user, upon whose behalf, the key is to be retrieved or undefined if retrieval is for the active user\n   * @returns {Promise<Key>}\n   */\n  // Ideally, this would be done via the kms batcher, but other than request id,\n  // there isn't any other userful key in a kms response to match it to a\n  // request. as such, we need the batcher to group requests, but one flight to\n  // make sure we don't make the same request multiple times.\n  @oneFlight({\n    keyFactory: ({uri, onBehalfOf}) => `${uri}/${onBehalfOf}`,\n  })\n  fetchKey({uri, onBehalfOf}) {\n    /* istanbul ignore if */\n    if (!uri) {\n      return Promise.reject(new Error('`options.uri` is required'));\n    }\n\n    this.logger.info('kms: fetching key');\n\n    return this.request(\n      {\n        method: 'retrieve',\n        uri,\n      },\n      {onBehalfOf}\n    ).then((res) => {\n      this.logger.info('kms: fetched key');\n\n      return this.asKey(res.key);\n    });\n  },\n\n  /**\n   * Pings the kms. Mostly for testing\n   * @returns {Promise}\n   */\n  ping() {\n    return this.request({\n      method: 'update',\n      uri: '/ping',\n    });\n  },\n\n  /**\n   * Ensures a key obect is Key instance\n   * @param {Object} key\n   * @returns {Promise<Key>}\n   */\n  asKey(key) {\n    return jose.JWK.asKey(key.jwk).then((jwk) => {\n      key.jwk = jwk;\n\n      return key;\n    });\n  },\n\n  /**\n   * Adds appropriate metadata to the KMS request\n   * @param {Object} payload\n   * @param {Object} onBehalfOf Optional parameter to prepare the request on behalf of another user\n   * @returns {Promise<KMS.Request>}\n   */\n  prepareRequest(payload, onBehalfOf) {\n    const isECDHRequest = payload.method === 'create' && payload.uri.includes('/ecdhe');\n\n    return Promise.resolve(isECDHRequest ? partialContexts.get(this) : this._getContext()).then(\n      (context) => {\n        this.logger.info(`kms: wrapping ${isECDHRequest ? 'ephemeral key' : 'kms'} request`);\n        const req = new Request(payload);\n        let requestContext = context;\n\n        if (onBehalfOf) {\n          requestContext = this._contextOnBehalfOf(context, onBehalfOf);\n        }\n\n        return req.wrap(requestContext, {serverKey: isECDHRequest}).then(() => {\n          /* istanbul ignore else */\n          if (process.env.NODE_ENV !== 'production') {\n            this.logger.info(\n              'kms: request payload',\n              util.inspect(omit(JSON.parse(JSON.stringify(req)), 'wrapped'), {depth: null})\n            );\n          }\n\n          return req;\n        });\n      }\n    );\n  },\n\n  /**\n   * Accepts a kms message event, decrypts it, and passes it to the batcher\n   * @param {Object} event\n   * @returns {Promise<Object>}\n   */\n  processKmsMessageEvent(event) {\n    this.logger.info('kms: received kms message');\n\n    return Promise.all(\n      event.encryption.kmsMessages.map((kmsMessage, index) =>\n        this._isECDHEMessage(kmsMessage).then((isECDHMessage) => {\n          this.logger.info(`kms: received ${isECDHMessage ? 'ecdhe' : 'normal'} message`);\n          const res = new Response(kmsMessage);\n\n          return (\n            Promise.resolve(isECDHMessage ? partialContexts.get(this) : contexts.get(this))\n              // eslint-disable-next-line max-nested-callbacks\n              .then((context) => res.unwrap(context))\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => {\n                if (process.env.NODE_ENV !== 'production') {\n                  this.logger.info(\n                    'kms: response payload',\n                    util.inspect(omit(JSON.parse(JSON.stringify(res)), 'wrapped'), {depth: null})\n                  );\n                }\n              })\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => {\n                event.encryption.kmsMessages[index] = res;\n              })\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => res)\n          );\n        })\n      )\n    )\n      .then(() => this.batcher.processKmsMessageEvent(event))\n      .catch((reason) => {\n        this.logger.error('kms: decrypt failed', reason.stack);\n\n        return Promise.reject(reason);\n      })\n      .then(() => event);\n  },\n\n  /**\n   * Decrypts a kms message\n   * @param {Object} kmsMessage\n   * @returns {Promise<Object>}\n   */\n  decryptKmsMessage(kmsMessage) {\n    const res = new Response(kmsMessage);\n\n    return contexts\n      .get(this)\n      .then((context) => res.unwrap(context))\n      .then(() => res.body);\n  },\n\n  /**\n   * Determines if the kms message is an ecdhe message or a normal message\n   * @param {Object} kmsMessage\n   * @returns {Promise<boolean>}\n   */\n  _isECDHEMessage(kmsMessage) {\n    return this._getKMSStaticPubKey().then((kmsStaticPubKey) => {\n      const fields = kmsMessage.split('.');\n\n      if (fields.length !== 3) {\n        return false;\n      }\n\n      const header = JSON.parse(jose.util.base64url.decode(fields[0]));\n\n      return header.kid === kmsStaticPubKey.kid;\n    });\n  },\n\n  /**\n   * Sends a request to the kms\n   * @param {Object} payload\n   * @param {Object} options\n   * @param {Number} options.timeout (internal)\n   * @param {string} options.onBehalfOf Run the request on behalf of another user (UUID), used in compliance scenarios\n   * @returns {Promise<Object>}\n   */\n  request(payload, {timeout, onBehalfOf} = {}) {\n    timeout = timeout || this.config.kmsInitialTimeout;\n\n    // Note: this should only happen when we're using the async kms batcher;\n    // once we implement the sync batcher, this'll need to be smarter.\n    return (\n      this.webex.internal.mercury\n        .connect()\n        .then(() => this.prepareRequest(payload, onBehalfOf))\n        .then((req) => {\n          req[TIMEOUT_SYMBOL] = timeout;\n\n          return this.batcher.request(req);\n        })\n        // High complexity is due to attempt at test mode resiliency\n        // eslint-disable-next-line complexity\n        .catch((reason) => {\n          if (\n            process.env.NODE_ENV === 'test' &&\n            (reason.status === 403 || reason.statusCode === 403) &&\n            reason.message.match(\n              /Failed to resolve authorization token in KmsMessage request for user/\n            )\n          ) {\n            this.logger.warn('kms: rerequested key due to test-mode kms auth failure');\n\n            return this.request(payload, {onBehalfOf});\n          }\n\n          // KMS Error. Notify the user\n          if (reason instanceof KMSError) {\n            this.webex.trigger('client:InvalidRequestError');\n\n            return Promise.reject(reason);\n          }\n\n          // Ideally, most or all of the code below would go in kms-batcher, but\n          // but batching needs at least one more round of refactoring for that to\n          // work.\n          if (!reason.statusCode && !reason.status) {\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              /* istanbul ignore next: reason.stack vs stack difficult to control in test */\n              this.logger.info('kms: request error', reason.stack || reason);\n            }\n\n            consoleDebug(`timeout ${timeout}`);\n            timeout *= 2;\n\n            if (timeout >= this.config.ecdhMaxTimeout) {\n              this.logger.info('kms: exceeded maximum KMS request retries');\n\n              return Promise.reject(reason);\n            }\n\n            // Peek ahead to make sure we don't reset the timeout if the next timeout\n            // will exceed the maximum timeout for renegotiating ECDH keys.\n            const nextTimeout = timeout * 2;\n\n            if (timeout >= this.config.kmsMaxTimeout && nextTimeout < this.config.ecdhMaxTimeout) {\n              this.logger.info(\n                'kms: exceeded maximum KMS request retries; negotiating new ecdh key'\n              );\n\n              /* istanbul ignore else */\n              if (process.env.NODE_ENV !== 'production') {\n                this.logger.info('kms: timeout/maxtimeout', timeout, this.config.kmsMaxTimeout);\n              }\n\n              contexts.delete(this);\n              timeout = 0;\n            }\n\n            return this.request(payload, {timeout, onBehalfOf});\n          }\n\n          return Promise.reject(reason);\n        })\n    );\n  },\n\n  /**\n   * @private\n   * @returns {Promise<string>}\n   */\n  _getAuthorization() {\n    return this.webex.credentials.getUserToken('spark:kms').then((token) => token.access_token);\n  },\n\n  @oneFlight\n  /**\n   * @private\n   * @param {String} onBehalfOf create context on behalf of another user, undefined when this is not necessary\n   * @returns {Promise<Object>}\n   */\n  _getContext() {\n    let promise = contexts.get(this);\n\n    if (!promise) {\n      promise = this._prepareContext();\n      contexts.set(this, promise);\n      promise.then((context) => {\n        const expiresIn = context.ephemeralKey.expirationDate - Date.now() - 30000;\n\n        safeSetTimeout(() => contexts.delete(this), expiresIn);\n      });\n    }\n\n    return Promise.all([promise, this._getAuthorization()]).then(([context, authorization]) => {\n      context.clientInfo.credential.bearer = authorization;\n\n      return context;\n    });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSCluster() {\n    this.logger.info('kms: retrieving KMS cluster');\n\n    return this._getKMSDetails().then(({kmsCluster}) => kmsCluster);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSDetails() {\n    let details = kmsDetails.get(this);\n\n    if (!details) {\n      this.logger.info('kms: fetching KMS details');\n      details = this.webex\n        .request({\n          service: 'encryption',\n          resource: `/kms/${this.webex.internal.device.userId}`,\n        })\n        .then((res) => {\n          this.logger.info('kms: fetched KMS details');\n          const {body} = res;\n\n          body.rsaPublicKey = JSON.parse(body.rsaPublicKey);\n\n          return body;\n        })\n        .catch((reason) => {\n          this.logger.error('kms: failed to fetch KMS details', reason);\n\n          return Promise.reject(reason);\n        });\n\n      kmsDetails.set(this, details);\n    }\n\n    return details;\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSStaticPubKey() {\n    this.logger.info('kms: retrieving KMS static public key');\n\n    return this._getKMSDetails().then(({rsaPublicKey}) => rsaPublicKey);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _prepareContext() {\n    this.logger.info('kms: creating context');\n    const context = new Context();\n\n    return Promise.all([\n      this._getKMSStaticPubKey().then(validateKMS(this.config.caroots)),\n      this._getAuthorization(),\n    ])\n      .then(([kmsStaticPubKey, authorization]) => {\n        context.clientInfo = {\n          clientId: this.webex.internal.device.url,\n          credential: {\n            userId: this.webex.internal.device.userId,\n            bearer: authorization,\n          },\n        };\n\n        context.serverInfo = {\n          key: kmsStaticPubKey,\n        };\n\n        this.logger.info('kms: creating local ephemeral key');\n\n        return context.createECDHKey();\n      })\n      .then((localECDHKey) => {\n        context.ephemeralKey = localECDHKey;\n        partialContexts.set(this, context);\n\n        return Promise.all([localECDHKey.asKey(), this._getKMSCluster()]);\n      })\n      .then(([localECDHKey, cluster]) => {\n        this.logger.info('kms: submitting ephemeral key request');\n\n        return this.request({\n          uri: `${cluster}/ecdhe`,\n          method: 'create',\n          jwk: localECDHKey.toJSON(),\n        });\n      })\n      .then((res) => {\n        this.logger.info('kms: deriving final ephemeral key');\n\n        return context.deriveEphemeralKey(res.key);\n      })\n      .then((key) => {\n        context.ephemeralKey = key;\n        partialContexts.delete(this);\n        this.logger.info('kms: derived final ephemeral key');\n\n        return context;\n      })\n      .catch((reason) => {\n        this.logger.error('kms: failed to negotiate ephemeral key', reason);\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * KMS 'retrieve' requests can be made on behalf of another user. This is useful\n   * for scenarios such as eDiscovery. i.e. Where an authorized compliance officer is\n   * entitled to retrieve content generated by any organisational user.\n   * As the KMSContext is cached, updating it will affect separate requests. Hence when\n   * making a request onBehalfOf another user create a new context for just this request.\n   * However this context will be 'light' as it only needs to change one field.\n   * @param {Object} originalContext - The base context to 'copy'\n   * @param {String} onBehalfOf - The user specified in the new context\n   * @returns {Context} A 'copy' of the existing context with a new user specified\n   * @private\n   */\n  _contextOnBehalfOf(originalContext, onBehalfOf) {\n    const context = new Context();\n\n    context.clientInfo = context.clientInfo = {\n      clientId: originalContext.clientInfo.clientId,\n      credential: {\n        userId: onBehalfOf,\n        onBehalfOf, // Supports running onBehalfOf self. i.e. A CO which calls onBehalfOf with CO.id.\n        bearer: originalContext.clientInfo.credential.bearer,\n      },\n    };\n    context.serverInfo = originalContext.serverInfo;\n    context.ephemeralKey = originalContext.ephemeralKey;\n\n    return context;\n  },\n});\n\nexport default KMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAIA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAP,sBAAA,CAAAC,OAAA;AAEA,IAAAO,KAAA,GAAAR,sBAAA,CAAAC,OAAA;AAEA,IAAAQ,WAAA,GAAAC,uBAAA,CAAAT,OAAA;AACA,IAAAU,yBAAA,GAAAD,uBAAA,CAAAT,OAAA;AAAmE,IAAAW,IAAA,EAAAC,IAAA;AAAA,SAAAC,yBAAAC,WAAA,eAAAC,SAAA,kCAAAC,iBAAA,OAAAD,SAAA,QAAAE,gBAAA,OAAAF,SAAA,YAAAF,wBAAA,YAAAA,yBAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,aAAAE,OAAA,CAAAF,GAAA,yBAAAA,GAAA,4BAAAG,OAAA,EAAAH,GAAA,UAAAI,KAAA,GAAAT,wBAAA,CAAAC,WAAA,OAAAQ,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAL,GAAA,YAAAI,KAAA,CAAAE,GAAA,CAAAN,GAAA,SAAAO,MAAA,WAAAC,qBAAA,GAAAC,sBAAA,IAAAC,iCAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAC,MAAA,CAAAC,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAf,GAAA,EAAAW,GAAA,SAAAK,IAAA,GAAAR,qBAAA,GAAAE,iCAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAK,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,sBAAA,CAAAF,MAAA,EAAAI,GAAA,EAAAK,IAAA,YAAAT,MAAA,CAAAI,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAJ,MAAA,CAAAJ,OAAA,GAAAH,GAAA,MAAAI,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAjB,GAAA,EAAAO,MAAA,YAAAA,MAAA;AAEnE,IAAMW,QAAQ,GAAG,IAAAC,QAAA,CAAAhB,OAAA,EAAa;AAC9B,IAAMiB,UAAU,GAAG,IAAAD,QAAA,CAAAhB,OAAA,EAAa;AAChC,IAAMkB,eAAe,GAAG,IAAAF,QAAA,CAAAhB,OAAA,EAAa;AAErC,IAAMmB,YAAY,GAAGxC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;;AAE5C;AACA;AACA;AACA,IAAMyC,GAAG,GAAGC,sBAAW,CAACC,MAAM,EAAAhC,IAAA,GAqY3B,IAAAiC,iBAAS,EAAC;EACTC,UAAU,EAAE,SAAAA,WAAAC,IAAA;IAAA,IAAEC,GAAG,GAAAD,IAAA,CAAHC,GAAG;MAAEC,UAAU,GAAAF,IAAA,CAAVE,UAAU;IAAA,UAAAC,MAAA,CAASF,GAAG,OAAAE,MAAA,CAAID,UAAU;EAAA;AACzD,CAAC,CAAC,GAAApC,IAAA,GAvY2B;EAC7BsC,SAAS,EAAE,YAAY;EAEvBC,QAAQ,EAAE;IACRC,OAAO,EAAEC;EACX,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,OAAO,WAAAA,QAAAC,KAAA,EAA6B;IAAA,IAAAC,KAAA;IAAA,IAA3BC,GAAG,GAAAF,KAAA,CAAHE,GAAG;MAAEC,MAAM,GAAAH,KAAA,CAANG,MAAM;MAAE7B,GAAG,GAAA0B,KAAA,CAAH1B,GAAG;MAAE8B,MAAM,GAAAJ,KAAA,CAANI,MAAM;IAC/BD,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;IAC1BY,MAAM,GAAGA,MAAM,IAAI9B,GAAG,CAACkB,GAAG;IAE1B,IAAI,CAACa,MAAM,CAACC,IAAI,CAAC,8BAA8B,CAAC;;IAEhD;IACA,IAAI,CAACH,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;;IAEA;IACA,IAAI,CAACL,MAAM,EAAE;MACX,OAAOG,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBC,WAAW,EAAET,MAAM;MACnBX,GAAG,EAAEY;IACP,CAAC,CAAC,CAACS,IAAI,CAAC,UAACC,GAAG,EAAK;MACfb,KAAI,CAACI,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOQ,GAAG,CAACxC,GAAG;IAChB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEyC,cAAc,WAAAA,eAAAC,KAAA,EAAgC;IAAA,IAAAC,MAAA;IAAA,IAA9BC,OAAO,GAAAF,KAAA,CAAPE,OAAO;MAAEC,OAAO,GAAAH,KAAA,CAAPG,OAAO;MAAE7C,GAAG,GAAA0C,KAAA,CAAH1C,GAAG;MAAE8C,IAAI,GAAAJ,KAAA,CAAJI,IAAI;IACzCD,OAAO,GAAGA,OAAO,IAAI,EAAE;IACvB;IACA,IAAIC,IAAI,EAAE;MACRD,OAAO,GAAGC,IAAI,CAACC,MAAM,CAAC,UAACC,IAAI,EAAEC,CAAC,EAAK;QACjCD,IAAI,CAACE,IAAI,CAACD,CAAC,CAAC/B,GAAG,CAAC;QAEhB,OAAO8B,IAAI;MACb,CAAC,EAAEH,OAAO,CAAC;IACb;;IAEA;IACA,IAAI7C,GAAG,EAAE;MACP6C,OAAO,CAACK,IAAI,CAAClD,GAAG,CAACkB,GAAG,CAAC;IACvB;;IAEA;IACA,IAAI2B,OAAO,CAACM,MAAM,KAAK,CAAC,EAAE;MACxB,OAAOlB,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5F;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,wBAAwB,CAAC;IAE1C,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,YAAY;MACjB0B,OAAO,EAAPA,OAAO;MACPC,OAAO,EAAPA;IACF,CAAC,CAAC,CAACN,IAAI,CAAC,UAACC,GAAG,EAAK;MACfG,MAAI,CAACZ,MAAM,CAACC,IAAI,CAAC,uBAAuB,CAAC;MAEzC,OAAOQ,GAAG,CAACY,QAAQ;IACrB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAAgB,WAAAA,iBAAAC,KAAA,EAAkC;IAAA,IAAAC,MAAA;IAAA,IAAhCX,OAAO,GAAAU,KAAA,CAAPV,OAAO;MAAEY,OAAO,GAAAF,KAAA,CAAPE,OAAO;MAAE5B,GAAG,GAAA0B,KAAA,CAAH1B,GAAG;MAAEC,MAAM,GAAAyB,KAAA,CAANzB,MAAM;IAC7Ce,OAAO,GAAGA,OAAO,IAAI,EAAE;IACvBf,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;IAE1B,IAAIsC,OAAO,EAAE;MACXZ,OAAO,GAAGA,OAAO,CAACxB,MAAM,CAACoC,OAAO,CAAC;IACnC;;IAEA;IACA,IAAIZ,OAAO,CAACO,MAAM,KAAK,CAAC,EAAE;MACxB,OAAOlB,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzF;;IAEA;IACA,IAAI,CAACN,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;IAE7D,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,iBAAiB;MACtBoB,WAAW,EAAET,MAAM;MACnBe,OAAO,EAAPA;IACF,CAAC,CAAC,CAACL,IAAI,CAAC,UAACC,GAAG,EAAK;MACfe,MAAI,CAACxB,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;MAE5C,OAAOQ,GAAG,CAACiB,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,kBAAkB,WAAAA,mBAAAC,KAAA,EAAgB;IAAA,IAAAC,MAAA;IAAA,IAAdhC,GAAG,GAAA+B,KAAA,CAAH/B,GAAG;MAAEC,MAAM,GAAA8B,KAAA,CAAN9B,MAAM;IAC7BA,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;IAC1B;IACA,IAAI,CAACW,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBnB,GAAG,KAAAE,MAAA,CAAKS,MAAM;IAChB,CAAC,CAAC,CAACU,IAAI,CAAC,UAACC,GAAG,EAAK;MACfoB,MAAI,CAAC7B,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAOQ,GAAG,CAACiB,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEI,mBAAmB,WAAAA,oBAAAC,KAAA,EAAgC;IAAA,IAAAC,MAAA;IAAA,IAA9BC,MAAM,GAAAF,KAAA,CAANE,MAAM;MAAEC,MAAM,GAAAH,KAAA,CAANG,MAAM;MAAErC,GAAG,GAAAkC,KAAA,CAAHlC,GAAG;MAAEC,MAAM,GAAAiC,KAAA,CAANjC,MAAM;IAC9CmC,MAAM,GAAGA,MAAM,IAAIC,MAAM;IACzBpC,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;;IAE1B;IACA,IAAI,CAAC8C,MAAM,EAAE;MACX,OAAO/B,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF;;IAEA;IACA,IAAI,CAACN,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;IAEjE,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,KAAAE,MAAA,CAAKS,MAAM,sBAAAT,MAAA,CAAmB8C,oBAAW,CAACC,SAAS,CAAC;QAACH,MAAM,EAANA;MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CAACzB,IAAI,CAAC,UAACC,GAAG,EAAK;MACfuB,MAAI,CAAChC,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOQ,GAAG,CAACiB,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEW,iBAAiB,WAAAA,kBAAAC,KAAA,EAAU;IAAA,IAAAC,MAAA;IAAA,IAARC,KAAK,GAAAF,KAAA,CAALE,KAAK;IACtB,IAAI,CAACxC,MAAM,CAACC,IAAI,iBAAAZ,MAAA,CAAiBmD,KAAK,mBAAgB;;IAEtD;IACA,IAAI,CAACA,KAAK,EAAE;MACV,OAAOtC,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,OAAO;MACZqD,KAAK,EAALA;IACF,CAAC,CAAC,CAAChC,IAAI,CAAC,UAACC,GAAG,EAAK;MACf8B,MAAI,CAACvC,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOC,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAChC,GAAG,CAACM,IAAI,CAAC2B,GAAG,CAACH,MAAI,CAACI,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;EACEC,cAAc,WAAAA,eAAAC,KAAA,EAAkB;IAAA,IAAAC,MAAA;IAAA,IAAhBC,aAAa,GAAAF,KAAA,CAAbE,aAAa;IAC3B,IAAI,CAAC/C,MAAM,CAACC,IAAI,CAAC,gCAAgC,CAAC;IAElD,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBnB,GAAG,EAAE,YAAY;MACjB4D,aAAa,EAAbA;IACF,CAAC,CAAC,CAACvC,IAAI,CAAC,UAACC,GAAG,EAAK;MACfqC,MAAI,CAAC9C,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;MAE5C,OAAOQ,GAAG,CAACuC,SAAS;IACtB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,uBAAuB,WAAAA,wBAAAC,KAAA,EAAqD;IAAA,IAAAC,MAAA;IAAA,IAAnDJ,aAAa,GAAAG,KAAA,CAAbH,aAAa;MAAEK,iBAAiB,GAAAF,KAAA,CAAjBE,iBAAiB;MAAAC,YAAA,GAAAH,KAAA,CAAEI,MAAM;MAANA,MAAM,GAAAD,YAAA,cAAG,KAAK,GAAAA,YAAA;IACvE,IAAI,CAACrD,MAAM,CAACC,IAAI,CAAC,0CAA0C,CAAC;IAE5D,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAEmE,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCP,aAAa,EAAbA,aAAa;MACbK,iBAAiB,EAAjBA,iBAAiB;MACjBG,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACf0C,MAAI,CAACnD,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;MAE7D,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEiD,wBAAwB,WAAAA,yBAAAC,MAAA,EAAkC;IAAA,IAAAC,MAAA;IAAA,IAAhCb,aAAa,GAAAY,MAAA,CAAbZ,aAAa;MAAAc,aAAA,GAAAF,MAAA,CAAEL,MAAM;MAANA,MAAM,GAAAO,aAAA,cAAG,KAAK,GAAAA,aAAA;IACrD,IAAI,CAAC7D,MAAM,CAACC,IAAI,CAAC,4CAA4C,CAAC;IAE9D,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBnB,GAAG,EAAEmE,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCP,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACfmD,MAAI,CAAC5D,MAAM,CAACC,IAAI,CAAC,6CAA6C,CAAC;MAE/D,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEqD,4BAA4B,WAAAA,6BAAAC,MAAA,EAAmC;IAAA,IAAAC,OAAA;IAAA,IAAjCC,KAAK,GAAAF,MAAA,CAALE,KAAK;MAAEC,QAAQ,GAAAH,MAAA,CAARG,QAAQ;MAAEnB,aAAa,GAAAgB,MAAA,CAAbhB,aAAa;IAC1D,IAAI,CAAC/C,MAAM,CAACC,IAAI,CAAC,oDAAoD,CAAC;IAEtE,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE8E,KAAK;MACVC,QAAQ,EAARA,QAAQ;MACRnB,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACfuD,OAAI,CAAChE,MAAM,CAACC,IAAI,CAAC,2DAA2D,EAAEiE,QAAQ,CAAC;MAEvF,OAAOzD,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE0D,2BAA2B,WAAAA,4BAAAC,MAAA,EAAkC;IAAA,IAAAC,OAAA;IAAA,IAAhCtB,aAAa,GAAAqB,MAAA,CAAbrB,aAAa;MAAAuB,aAAA,GAAAF,MAAA,CAAEd,MAAM;MAANA,MAAM,GAAAgB,aAAA,cAAG,KAAK,GAAAA,aAAA;IACxD,IAAI,CAACtE,MAAM,CAACC,IAAI,CAAC,uDAAuD,CAAC;IAEzE,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAEmE,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCP,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACf4D,OAAI,CAACrE,MAAM,CAACC,IAAI,CAAC,gDAAgD,CAAC;MAElE,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE8D,kBAAkB,WAAAA,mBAAAC,MAAA,EAAkB;IAAA,IAAAC,OAAA;IAAA,IAAhB1B,aAAa,GAAAyB,MAAA,CAAbzB,aAAa;IAC/B,IAAI,CAAC/C,MAAM,CAACC,IAAI,CAAC,sCAAsC,CAAC;IAExD,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,SAAS;MACd+E,QAAQ,EAAE,QAAQ;MAClBnB,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACfgE,OAAI,CAACzE,MAAM,CAACC,IAAI,CAAC,4CAA4C,CAAC;MAE9D,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAgBDiE,QAAQ,WAAAA,SAAAC,MAAA,EAAoB;IAAA,IAAAC,OAAA;IAAA,IAAlBzF,GAAG,GAAAwF,MAAA,CAAHxF,GAAG;MAAEC,UAAU,GAAAuF,MAAA,CAAVvF,UAAU;IACvB;IACA,IAAI,CAACD,GAAG,EAAE;MACR,OAAOe,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/D;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,mBAAmB,CAAC;IAErC,OAAO,IAAI,CAACI,OAAO,CACjB;MACEC,MAAM,EAAE,UAAU;MAClBnB,GAAG,EAAHA;IACF,CAAC,EACD;MAACC,UAAU,EAAVA;IAAU,CAAC,CACb,CAACoB,IAAI,CAAC,UAACC,GAAG,EAAK;MACdmE,OAAI,CAAC5E,MAAM,CAACC,IAAI,CAAC,kBAAkB,CAAC;MAEpC,OAAO2E,OAAI,CAACjC,KAAK,CAAClC,GAAG,CAACxC,GAAG,CAAC;IAC5B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;EACE4G,IAAI,WAAAA,KAAA,EAAG;IACL,OAAO,IAAI,CAACxE,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE;IACP,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;EACEwD,KAAK,WAAAA,MAAC1E,GAAG,EAAE;IACT,OAAO6G,iBAAI,CAACC,GAAG,CAACpC,KAAK,CAAC1E,GAAG,CAAC+G,GAAG,CAAC,CAACxE,IAAI,CAAC,UAACwE,GAAG,EAAK;MAC3C/G,GAAG,CAAC+G,GAAG,GAAGA,GAAG;MAEb,OAAO/G,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEgH,cAAc,WAAAA,eAACC,OAAO,EAAE9F,UAAU,EAAE;IAAA,IAAA+F,OAAA;IAClC,IAAMC,aAAa,GAAGF,OAAO,CAAC5E,MAAM,KAAK,QAAQ,IAAI4E,OAAO,CAAC/F,GAAG,CAACkG,QAAQ,CAAC,QAAQ,CAAC;IAEnF,OAAOnF,QAAA,CAAAzC,OAAA,CAAQ6H,OAAO,CAACF,aAAa,GAAGzG,eAAe,CAACf,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC2H,WAAW,EAAE,CAAC,CAAC/E,IAAI,CACzF,UAACgF,OAAO,EAAK;MACXL,OAAI,CAACnF,MAAM,CAACC,IAAI,kBAAAZ,MAAA,CAAkB+F,aAAa,GAAG,eAAe,GAAG,KAAK,cAAW;MACpF,IAAMK,GAAG,GAAG,IAAIC,gBAAO,CAACR,OAAO,CAAC;MAChC,IAAIS,cAAc,GAAGH,OAAO;MAE5B,IAAIpG,UAAU,EAAE;QACduG,cAAc,GAAGR,OAAI,CAACS,kBAAkB,CAACJ,OAAO,EAAEpG,UAAU,CAAC;MAC/D;MAEA,OAAOqG,GAAG,CAACI,IAAI,CAACF,cAAc,EAAE;QAACG,SAAS,EAAEV;MAAa,CAAC,CAAC,CAAC5E,IAAI,CAAC,YAAM;QACrE;QACA,IAAIuF,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;UACzCd,OAAI,CAACnF,MAAM,CAACC,IAAI,CACd,sBAAsB,EACtBiG,aAAI,CAACC,OAAO,CAAC,IAAAC,MAAA,CAAA3I,OAAA,EAAK4I,IAAI,CAACC,KAAK,CAAC,IAAAC,UAAA,CAAA9I,OAAA,EAAegI,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;YAACe,KAAK,EAAE;UAAI,CAAC,CAAC,CAC9E;QACH;QAEA,OAAOf,GAAG;MACZ,CAAC,CAAC;IACJ,CAAC,CACF;EACH,CAAC;EAED;AACF;AACA;AACA;AACA;EACEgB,sBAAsB,WAAAA,uBAACC,KAAK,EAAE;IAAA,IAAAC,OAAA;IAC5B,IAAI,CAAC3G,MAAM,CAACC,IAAI,CAAC,2BAA2B,CAAC;IAE7C,OAAOC,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAChBiE,KAAK,CAACE,UAAU,CAACC,WAAW,CAACnE,GAAG,CAAC,UAACoE,UAAU,EAAEC,KAAK;MAAA,OACjDJ,OAAI,CAACK,eAAe,CAACF,UAAU,CAAC,CAACtG,IAAI,CAAC,UAACyG,aAAa,EAAK;QACvDN,OAAI,CAAC3G,MAAM,CAACC,IAAI,kBAAAZ,MAAA,CAAkB4H,aAAa,GAAG,OAAO,GAAG,QAAQ,cAAW;QAC/E,IAAMxG,GAAG,GAAG,IAAIyG,iBAAQ,CAACJ,UAAU,CAAC;QAEpC,OACE5G,QAAA,CAAAzC,OAAA,CAAQ6H,OAAO,CAAC2B,aAAa,GAAGtI,eAAe,CAACf,GAAG,CAAC+I,OAAI,CAAC,GAAGnI,QAAQ,CAACZ,GAAG,CAAC+I,OAAI,CAAC;QAC5E;QAAA,CACCnG,IAAI,CAAC,UAACgF,OAAO;UAAA,OAAK/E,GAAG,CAAC0G,MAAM,CAAC3B,OAAO,CAAC;QAAA;QACtC;QAAA,CACChF,IAAI,CAAC,YAAM;UACV,IAAIuF,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;YACzCU,OAAI,CAAC3G,MAAM,CAACC,IAAI,CACd,uBAAuB,EACvBiG,aAAI,CAACC,OAAO,CAAC,IAAAC,MAAA,CAAA3I,OAAA,EAAK4I,IAAI,CAACC,KAAK,CAAC,IAAAC,UAAA,CAAA9I,OAAA,EAAegD,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;cAAC+F,KAAK,EAAE;YAAI,CAAC,CAAC,CAC9E;UACH;QACF,CAAC;QACD;QAAA,CACChG,IAAI,CAAC,YAAM;UACVkG,KAAK,CAACE,UAAU,CAACC,WAAW,CAACE,KAAK,CAAC,GAAGtG,GAAG;QAC3C,CAAC;QACD;QAAA,CACCD,IAAI,CAAC;UAAA,OAAMC,GAAG;QAAA,EAAC;MAEtB,CAAC,CAAC;IAAA,EACH,CACF,CACED,IAAI,CAAC;MAAA,OAAMmG,OAAI,CAACnH,OAAO,CAACiH,sBAAsB,CAACC,KAAK,CAAC;IAAA,EAAC,CACtDU,KAAK,CAAC,UAACC,MAAM,EAAK;MACjBV,OAAI,CAAC3G,MAAM,CAACsH,KAAK,CAAC,qBAAqB,EAAED,MAAM,CAACE,KAAK,CAAC;MAEtD,OAAOrH,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;IAC/B,CAAC,CAAC,CACD7G,IAAI,CAAC;MAAA,OAAMkG,KAAK;IAAA,EAAC;EACtB,CAAC;EAED;AACF;AACA;AACA;AACA;EACEc,iBAAiB,WAAAA,kBAACV,UAAU,EAAE;IAC5B,IAAMrG,GAAG,GAAG,IAAIyG,iBAAQ,CAACJ,UAAU,CAAC;IAEpC,OAAOtI,QAAQ,CACZZ,GAAG,CAAC,IAAI,CAAC,CACT4C,IAAI,CAAC,UAACgF,OAAO;MAAA,OAAK/E,GAAG,CAAC0G,MAAM,CAAC3B,OAAO,CAAC;IAAA,EAAC,CACtChF,IAAI,CAAC;MAAA,OAAMC,GAAG,CAACgH,IAAI;IAAA,EAAC;EACzB,CAAC;EAED;AACF;AACA;AACA;AACA;EACET,eAAe,WAAAA,gBAACF,UAAU,EAAE;IAC1B,OAAO,IAAI,CAACY,mBAAmB,EAAE,CAAClH,IAAI,CAAC,UAACmH,eAAe,EAAK;MAC1D,IAAMC,MAAM,GAAGd,UAAU,CAACe,KAAK,CAAC,GAAG,CAAC;MAEpC,IAAID,MAAM,CAACxG,MAAM,KAAK,CAAC,EAAE;QACvB,OAAO,KAAK;MACd;MAEA,IAAM0G,MAAM,GAAGzB,IAAI,CAACC,KAAK,CAACxB,iBAAI,CAACoB,IAAI,CAAC6B,SAAS,CAACC,MAAM,CAACJ,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;MAEhE,OAAOE,MAAM,CAACG,GAAG,KAAKN,eAAe,CAACM,GAAG;IAC3C,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE5H,OAAO,WAAAA,QAAC6E,OAAO,EAA8B;IAAA,IAAAgD,OAAA;IAAA,IAAAC,MAAA,GAAAC,SAAA,CAAAhH,MAAA,QAAAgH,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAJ,CAAC,CAAC;MAAzBE,OAAO,GAAAH,MAAA,CAAPG,OAAO;MAAElJ,UAAU,GAAA+I,MAAA,CAAV/I,UAAU;IACnCkJ,OAAO,GAAGA,OAAO,IAAI,IAAI,CAACC,MAAM,CAACC,iBAAiB;;IAElD;IACA;IACA,OACE,IAAI,CAACC,KAAK,CAACC,QAAQ,CAACC,OAAO,CACxBC,OAAO,EAAE,CACTpI,IAAI,CAAC;MAAA,OAAM0H,OAAI,CAACjD,cAAc,CAACC,OAAO,EAAE9F,UAAU,CAAC;IAAA,EAAC,CACpDoB,IAAI,CAAC,UAACiF,GAAG,EAAK;MACbA,GAAG,CAACoD,0BAAc,CAAC,GAAGP,OAAO;MAE7B,OAAOJ,OAAI,CAAC1I,OAAO,CAACa,OAAO,CAACoF,GAAG,CAAC;IAClC,CAAC;IACD;IACA;IAAA,CACC2B,KAAK,CAAC,UAACC,MAAM,EAAK;MACjB,IACEtB,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,MAAM,KAC9BoB,MAAM,CAACyB,MAAM,KAAK,GAAG,IAAIzB,MAAM,CAAC0B,UAAU,KAAK,GAAG,CAAC,IACpD1B,MAAM,CAAC2B,OAAO,CAACC,KAAK,CAClB,sEAAsE,CACvE,EACD;QACAf,OAAI,CAAClI,MAAM,CAACkJ,IAAI,CAAC,wDAAwD,CAAC;QAE1E,OAAOhB,OAAI,CAAC7H,OAAO,CAAC6E,OAAO,EAAE;UAAC9F,UAAU,EAAVA;QAAU,CAAC,CAAC;MAC5C;;MAEA;MACA,IAAIiI,MAAM,YAAY8B,kCAAQ,EAAE;QAC9BjB,OAAI,CAACO,KAAK,CAACW,OAAO,CAAC,4BAA4B,CAAC;QAEhD,OAAOlJ,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;MAC/B;;MAEA;MACA;MACA;MACA,IAAI,CAACA,MAAM,CAAC0B,UAAU,IAAI,CAAC1B,MAAM,CAACyB,MAAM,EAAE;QACxC;QACA,IAAI/C,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;UACzC;UACAiC,OAAI,CAAClI,MAAM,CAACC,IAAI,CAAC,oBAAoB,EAAEoH,MAAM,CAACE,KAAK,IAAIF,MAAM,CAAC;QAChE;QAEAzI,YAAY,YAAAS,MAAA,CAAYiJ,OAAO,EAAG;QAClCA,OAAO,IAAI,CAAC;QAEZ,IAAIA,OAAO,IAAIJ,OAAI,CAACK,MAAM,CAACc,cAAc,EAAE;UACzCnB,OAAI,CAAClI,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;UAE7D,OAAOC,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;QAC/B;;QAEA;QACA;QACA,IAAMiC,WAAW,GAAGhB,OAAO,GAAG,CAAC;QAE/B,IAAIA,OAAO,IAAIJ,OAAI,CAACK,MAAM,CAACgB,aAAa,IAAID,WAAW,GAAGpB,OAAI,CAACK,MAAM,CAACc,cAAc,EAAE;UACpFnB,OAAI,CAAClI,MAAM,CAACC,IAAI,CACd,qEAAqE,CACtE;;UAED;UACA,IAAI8F,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;YACzCiC,OAAI,CAAClI,MAAM,CAACC,IAAI,CAAC,yBAAyB,EAAEqI,OAAO,EAAEJ,OAAI,CAACK,MAAM,CAACgB,aAAa,CAAC;UACjF;UAEA/K,QAAQ,CAACgL,MAAM,CAACtB,OAAI,CAAC;UACrBI,OAAO,GAAG,CAAC;QACb;QAEA,OAAOJ,OAAI,CAAC7H,OAAO,CAAC6E,OAAO,EAAE;UAACoD,OAAO,EAAPA,OAAO;UAAElJ,UAAU,EAAVA;QAAU,CAAC,CAAC;MACrD;MAEA,OAAOc,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;IAC/B,CAAC,CAAC;EAER,CAAC;EAED;AACF;AACA;AACA;EACEoC,iBAAiB,WAAAA,kBAAA,EAAG;IAClB,OAAO,IAAI,CAAChB,KAAK,CAACiB,WAAW,CAACC,YAAY,CAAC,WAAW,CAAC,CAACnJ,IAAI,CAAC,UAACoJ,KAAK;MAAA,OAAKA,KAAK,CAACC,YAAY;IAAA,EAAC;EAC7F,CAAC;EAGD;AACF;AACA;AACA;AACA;EACEtE,WAAW,WAAAA,YAAA,EAAG;IAAA,IAAAuE,OAAA;IACZ,IAAIC,OAAO,GAAGvL,QAAQ,CAACZ,GAAG,CAAC,IAAI,CAAC;IAEhC,IAAI,CAACmM,OAAO,EAAE;MACZA,OAAO,GAAG,IAAI,CAACC,eAAe,EAAE;MAChCxL,QAAQ,CAACD,GAAG,CAAC,IAAI,EAAEwL,OAAO,CAAC;MAC3BA,OAAO,CAACvJ,IAAI,CAAC,UAACgF,OAAO,EAAK;QACxB,IAAMyE,SAAS,GAAGzE,OAAO,CAAC0E,YAAY,CAACC,cAAc,GAAG,IAAAC,IAAA,CAAA3M,OAAA,GAAU,GAAG,KAAK;QAE1E,IAAA4M,4BAAc,EAAC;UAAA,OAAM7L,QAAQ,CAACgL,MAAM,CAACM,OAAI,CAAC;QAAA,GAAEG,SAAS,CAAC;MACxD,CAAC,CAAC;IACJ;IAEA,OAAO/J,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAC,CAACsH,OAAO,EAAE,IAAI,CAACN,iBAAiB,EAAE,CAAC,CAAC,CAACjJ,IAAI,CAAC,UAAA8J,MAAA,EAA8B;MAAA,IAAAC,MAAA,OAAAC,eAAA,CAAA/M,OAAA,EAAA6M,MAAA;QAA5B9E,OAAO,GAAA+E,MAAA;QAAEE,aAAa,GAAAF,MAAA;MACnF/E,OAAO,CAACkF,UAAU,CAACC,UAAU,CAACC,MAAM,GAAGH,aAAa;MAEpD,OAAOjF,OAAO;IAChB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;EACEqF,cAAc,WAAAA,eAAA,EAAG;IACf,IAAI,CAAC7K,MAAM,CAACC,IAAI,CAAC,6BAA6B,CAAC;IAE/C,OAAO,IAAI,CAAC6K,cAAc,EAAE,CAACtK,IAAI,CAAC,UAAAuK,MAAA;MAAA,IAAEC,UAAU,GAAAD,MAAA,CAAVC,UAAU;MAAA,OAAMA,UAAU;IAAA,EAAC;EACjE,CAAC;EAED;AACF;AACA;AACA;EACEF,cAAc,WAAAA,eAAA,EAAG;IAAA,IAAAG,OAAA;IACf,IAAIC,OAAO,GAAGxM,UAAU,CAACd,GAAG,CAAC,IAAI,CAAC;IAElC,IAAI,CAACsN,OAAO,EAAE;MACZ,IAAI,CAAClL,MAAM,CAACC,IAAI,CAAC,2BAA2B,CAAC;MAC7CiL,OAAO,GAAG,IAAI,CAACzC,KAAK,CACjBpI,OAAO,CAAC;QACP8K,OAAO,EAAE,YAAY;QACrB9J,QAAQ,UAAAhC,MAAA,CAAU,IAAI,CAACoJ,KAAK,CAACC,QAAQ,CAAC0C,MAAM,CAAClJ,MAAM;MACrD,CAAC,CAAC,CACD1B,IAAI,CAAC,UAACC,GAAG,EAAK;QACbwK,OAAI,CAACjL,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;QAC5C,IAAOwH,IAAI,GAAIhH,GAAG,CAAXgH,IAAI;QAEXA,IAAI,CAAC4D,YAAY,GAAGhF,IAAI,CAACC,KAAK,CAACmB,IAAI,CAAC4D,YAAY,CAAC;QAEjD,OAAO5D,IAAI;MACb,CAAC,CAAC,CACDL,KAAK,CAAC,UAACC,MAAM,EAAK;QACjB4D,OAAI,CAACjL,MAAM,CAACsH,KAAK,CAAC,kCAAkC,EAAED,MAAM,CAAC;QAE7D,OAAOnH,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;MAC/B,CAAC,CAAC;MAEJ3I,UAAU,CAACH,GAAG,CAAC,IAAI,EAAE2M,OAAO,CAAC;IAC/B;IAEA,OAAOA,OAAO;EAChB,CAAC;EAED;AACF;AACA;AACA;EACExD,mBAAmB,WAAAA,oBAAA,EAAG;IACpB,IAAI,CAAC1H,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;IAEzD,OAAO,IAAI,CAAC6K,cAAc,EAAE,CAACtK,IAAI,CAAC,UAAA8K,MAAA;MAAA,IAAED,YAAY,GAAAC,MAAA,CAAZD,YAAY;MAAA,OAAMA,YAAY;IAAA,EAAC;EACrE,CAAC;EAED;AACF;AACA;AACA;EACErB,eAAe,WAAAA,gBAAA,EAAG;IAAA,IAAAuB,OAAA;IAChB,IAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,uBAAuB,CAAC;IACzC,IAAMuF,OAAO,GAAG,IAAIgG,gBAAO,EAAE;IAE7B,OAAOtL,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAC,CACjB,IAAI,CAACiF,mBAAmB,EAAE,CAAClH,IAAI,CAAC,IAAAiL,iCAAW,EAAC,IAAI,CAAClD,MAAM,CAACmD,OAAO,CAAC,CAAC,EACjE,IAAI,CAACjC,iBAAiB,EAAE,CACzB,CAAC,CACCjJ,IAAI,CAAC,UAAAmL,MAAA,EAAsC;MAAA,IAAAC,MAAA,OAAApB,eAAA,CAAA/M,OAAA,EAAAkO,MAAA;QAApChE,eAAe,GAAAiE,MAAA;QAAEnB,aAAa,GAAAmB,MAAA;MACpCpG,OAAO,CAACkF,UAAU,GAAG;QACnBmB,QAAQ,EAAEN,OAAI,CAAC9C,KAAK,CAACC,QAAQ,CAAC0C,MAAM,CAACU,GAAG;QACxCnB,UAAU,EAAE;UACVzI,MAAM,EAAEqJ,OAAI,CAAC9C,KAAK,CAACC,QAAQ,CAAC0C,MAAM,CAAClJ,MAAM;UACzC0I,MAAM,EAAEH;QACV;MACF,CAAC;MAEDjF,OAAO,CAACuG,UAAU,GAAG;QACnB9N,GAAG,EAAE0J;MACP,CAAC;MAED4D,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAOuF,OAAO,CAACwG,aAAa,EAAE;IAChC,CAAC,CAAC,CACDxL,IAAI,CAAC,UAACyL,YAAY,EAAK;MACtBzG,OAAO,CAAC0E,YAAY,GAAG+B,YAAY;MACnCtN,eAAe,CAACJ,GAAG,CAACgN,OAAI,EAAE/F,OAAO,CAAC;MAElC,OAAOtF,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAC,CAACwJ,YAAY,CAACtJ,KAAK,EAAE,EAAE4I,OAAI,CAACV,cAAc,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CACDrK,IAAI,CAAC,UAAA0L,MAAA,EAA6B;MAAA,IAAAC,MAAA,OAAA3B,eAAA,CAAA/M,OAAA,EAAAyO,MAAA;QAA3BD,YAAY,GAAAE,MAAA;QAAEC,OAAO,GAAAD,MAAA;MAC3BZ,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;MAEzD,OAAOsL,OAAI,CAAClL,OAAO,CAAC;QAClBlB,GAAG,KAAAE,MAAA,CAAK+M,OAAO,WAAQ;QACvB9L,MAAM,EAAE,QAAQ;QAChB0E,GAAG,EAAEiH,YAAY,CAACI,MAAM;MAC1B,CAAC,CAAC;IACJ,CAAC,CAAC,CACD7L,IAAI,CAAC,UAACC,GAAG,EAAK;MACb8K,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAOuF,OAAO,CAAC8G,kBAAkB,CAAC7L,GAAG,CAACxC,GAAG,CAAC;IAC5C,CAAC,CAAC,CACDuC,IAAI,CAAC,UAACvC,GAAG,EAAK;MACbuH,OAAO,CAAC0E,YAAY,GAAGjM,GAAG;MAC1BU,eAAe,CAAC6K,MAAM,CAAC+B,OAAI,CAAC;MAC5BA,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,kCAAkC,CAAC;MAEpD,OAAOuF,OAAO;IAChB,CAAC,CAAC,CACD4B,KAAK,CAAC,UAACC,MAAM,EAAK;MACjBkE,OAAI,CAACvL,MAAM,CAACsH,KAAK,CAAC,wCAAwC,EAAED,MAAM,CAAC;MAEnE,OAAOnH,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;IAC/B,CAAC,CAAC;EACN,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEzB,kBAAkB,WAAAA,mBAAC2G,eAAe,EAAEnN,UAAU,EAAE;IAC9C,IAAMoG,OAAO,GAAG,IAAIgG,gBAAO,EAAE;IAE7BhG,OAAO,CAACkF,UAAU,GAAGlF,OAAO,CAACkF,UAAU,GAAG;MACxCmB,QAAQ,EAAEU,eAAe,CAAC7B,UAAU,CAACmB,QAAQ;MAC7ClB,UAAU,EAAE;QACVzI,MAAM,EAAE9C,UAAU;QAClBA,UAAU,EAAVA,UAAU;QAAE;QACZwL,MAAM,EAAE2B,eAAe,CAAC7B,UAAU,CAACC,UAAU,CAACC;MAChD;IACF,CAAC;IACDpF,OAAO,CAACuG,UAAU,GAAGQ,eAAe,CAACR,UAAU;IAC/CvG,OAAO,CAAC0E,YAAY,GAAGqC,eAAe,CAACrC,YAAY;IAEnD,OAAO1E,OAAO;EAChB,CAAC;EAAAgH,OAAA;AACH,CAAC,OAAAC,0BAAA,CAAAhP,OAAA,EAAAT,IAAA,eAAAD,IAAA,OAAA2P,yBAAA,CAAAjP,OAAA,EAAAT,IAAA,eAAAA,IAAA,OAAAyP,0BAAA,CAAAhP,OAAA,EAAAT,IAAA,kBA3KEgC,iBAAS,OAAA0N,yBAAA,CAAAjP,OAAA,EAAAT,IAAA,kBAAAA,IAAA,IAAAA,IAAA,GA2KV;AAAC,IAAA2P,QAAA,GAEY9N,GAAG;AAAA+N,OAAA,CAAAnP,OAAA,GAAAkP,QAAA"}
+{"version":3,"names":["_querystring","_interopRequireDefault","require","_util","_commonTimers","_common","_webexCore","_nodeKms","_nodeJose","_lodash","_uuid","_kmsBatcher","_interopRequireWildcard","_kmsCertificateValidation","_dec","_obj","_getRequireWildcardCache","nodeInterop","_WeakMap2","cacheBabelInterop","cacheNodeInterop","obj","__esModule","_typeof","default","cache","has","get","newObj","hasPropertyDescriptor","_Object$defineProperty","_Object$getOwnPropertyDescriptor2","key","Object","prototype","hasOwnProperty","call","desc","set","contexts","_weakMap","kmsDetails","partialContexts","consoleDebug","KMS","WebexPlugin","extend","oneFlight","keyFactory","_ref","uri","onBehalfOf","concat","namespace","children","batcher","KMSBatcher","bindKey","_ref2","_this","kro","kroUri","keyUri","logger","info","_promise","reject","Error","request","method","resourceUri","then","res","createResource","_ref3","_this2","userIds","keyUris","keys","reduce","uris","k","push","length","resource","addAuthorization","_ref4","_this3","authIds","authorizations","listAuthorizations","_ref5","_this4","removeAuthorization","_ref6","_this5","authId","userId","querystring","stringify","createUnboundKeys","_ref7","_this6","count","all","map","asKey","fetchPublicKey","_ref8","_this7","assignedOrgId","publicKey","uploadCustomerMasterKey","_ref9","_this8","customerMasterKey","_ref9$awsKms","awsKms","requestId","uuid","v4","listAllCustomerMasterKey","_ref10","_this9","_ref10$awsKms","changeCustomerMasterKeyState","_ref11","_this10","keyId","keyState","deleteAllCustomerMasterKeys","_ref12","_this11","_ref12$awsKms","useGlobalMasterKey","_ref13","_this12","fetchKey","_ref14","_this13","ping","jose","JWK","jwk","prepareRequest","payload","_this14","isECDHRequest","includes","resolve","_getContext","context","req","Request","requestContext","_contextOnBehalfOf","wrap","serverKey","process","env","NODE_ENV","util","inspect","omit","JSON","parse","_stringify","depth","processKmsMessageEvent","event","_this15","encryption","kmsMessages","kmsMessage","index","_isECDHEMessage","isECDHMessage","Response","unwrap","catch","reason","error","stack","decryptKmsMessage","body","_getKMSStaticPubKey","kmsStaticPubKey","fields","split","header","base64url","decode","kid","_this16","_ref15","arguments","undefined","timeout","config","kmsInitialTimeout","webex","internal","mercury","connect","TIMEOUT_SYMBOL","status","statusCode","message","match","warn","KMSError","trigger","ecdhMaxTimeout","nextTimeout","kmsMaxTimeout","delete","_getAuthorization","credentials","getUserToken","token","access_token","_this17","promise","_prepareContext","expiresIn","ephemeralKey","expirationDate","_now","safeSetTimeout","_ref16","_ref17","_slicedToArray2","authorization","clientInfo","credential","bearer","_getKMSCluster","_getKMSDetails","_ref18","kmsCluster","_this18","details","service","device","rsaPublicKey","_ref19","_this19","Context","validateKMS","caroots","_ref20","_ref21","clientId","url","serverInfo","createECDHKey","localECDHKey","_ref22","_ref23","cluster","toJSON","deriveEphemeralKey","originalContext","version","_applyDecoratedDescriptor2","_getOwnPropertyDescriptor","_default","exports"],"sources":["kms.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport util from 'util';\n\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {oneFlight} from '@webex/common';\nimport {WebexPlugin} from '@webex/webex-core';\nimport {Context, Request, Response} from 'node-kms';\nimport jose from 'node-jose';\nimport {omit} from 'lodash';\nimport uuid from 'uuid';\n\nimport KMSBatcher, {TIMEOUT_SYMBOL} from './kms-batcher';\nimport validateKMS, {KMSError} from './kms-certificate-validation';\n\nconst contexts = new WeakMap();\nconst kmsDetails = new WeakMap();\nconst partialContexts = new WeakMap();\n\nconst consoleDebug = require('debug')('kms');\n\n/**\n * @class\n */\nconst KMS = WebexPlugin.extend({\n  namespace: 'Encryption',\n\n  children: {\n    batcher: KMSBatcher,\n  },\n\n  /**\n   * Binds a key to a resource\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro\n   * @param {string} options.kroUri\n   * @param {Key} options.key\n   * @param {string} options.keyUri\n   * @returns {Promise<Key>}\n   */\n  bindKey({kro, kroUri, key, keyUri}) {\n    kroUri = kroUri || kro.uri;\n    keyUri = keyUri || key.uri;\n\n    this.logger.info('kms: binding key to resource');\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    /* istanbul ignore if */\n    if (!keyUri) {\n      return Promise.reject(new Error('`key` or `keyUri` is required'));\n    }\n\n    return this.request({\n      method: 'update',\n      resourceUri: kroUri,\n      uri: keyUri,\n    }).then((res) => {\n      this.logger.info('kms: bound key to resource');\n\n      return res.key;\n    });\n  },\n\n  /**\n   * Creates a new KMS Resource\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.keyUris\n   * @param {Key} options.key\n   * @param {Array<Keys>} options.keys\n   * @returns {Promise<KMSResourceObject>}\n   */\n  createResource({userIds, keyUris, key, keys}) {\n    keyUris = keyUris || [];\n    /* istanbul ignore if */\n    if (keys) {\n      keyUris = keys.reduce((uris, k) => {\n        uris.push(k.uri);\n\n        return uris;\n      }, keyUris);\n    }\n\n    /* istanbul ignore else */\n    if (key) {\n      keyUris.push(key.uri);\n    }\n\n    /* istanbul ignore if */\n    if (keyUris.length === 0) {\n      return Promise.reject(new Error('Cannot create KMS Resource without at least one keyUri'));\n    }\n\n    this.logger.info('kms: creating resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/resources',\n      userIds,\n      keyUris,\n    }).then((res) => {\n      this.logger.info('kms: created resource');\n\n      return res.resource;\n    });\n  },\n\n  /**\n   * Authorizes a user or KRO to a KRO\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.authIds interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  addAuthorization({userIds, authIds, kro, kroUri}) {\n    userIds = userIds || [];\n    kroUri = kroUri || kro.uri;\n\n    if (authIds) {\n      userIds = userIds.concat(authIds);\n    }\n\n    /* istanbul ignore if */\n    if (userIds.length === 0) {\n      return Promise.reject(new Error('Cannot add authorization without userIds or authIds'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: adding authorization to kms resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/authorizations',\n      resourceUri: kroUri,\n      userIds,\n    }).then((res) => {\n      this.logger.info('kms: added authorization');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Retrieve a list of users that have been authorized to the KRO\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Array<authId>}\n   */\n  listAuthorizations({kro, kroUri}) {\n    kroUri = kroUri || kro.uri;\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    return this.request({\n      method: 'retrieve',\n      uri: `${kroUri}/authorizations`,\n    }).then((res) => {\n      this.logger.info('kms: retrieved authorization list');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Deauthorizes a user or KRO from a KRO\n   * @param {Object} options\n   * @param {string} options.userId\n   * @param {string} options.authId interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  removeAuthorization({authId, userId, kro, kroUri}) {\n    authId = authId || userId;\n    kroUri = kroUri || kro.uri;\n\n    /* istanbul ignore if */\n    if (!authId) {\n      return Promise.reject(new Error('Cannot remove authorization without authId'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: removing authorization from kms resource');\n\n    return this.request({\n      method: 'delete',\n      uri: `${kroUri}/authorizations?${querystring.stringify({authId})}`,\n    }).then((res) => {\n      this.logger.info('kms: removed authorization');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Requests `count` unbound keys from the kms\n   * @param {Object} options\n   * @param {Number} options.count\n   * @returns {Array<Key>}\n   */\n  createUnboundKeys({count}) {\n    this.logger.info(`kms: request ${count} unbound keys`);\n\n    /* istanbul ignore if */\n    if (!count) {\n      return Promise.reject(new Error('`options.count` is required'));\n    }\n\n    return this.request({\n      method: 'create',\n      uri: '/keys',\n      count,\n    }).then((res) => {\n      this.logger.info('kms: received unbound keys');\n\n      return Promise.all(res.keys.map(this.asKey));\n    });\n  },\n\n  /**\n   * @typedef {Object} FetchPublicKeyResponse\n   * @property {number} status 200,400(Bad Request: Request payload missing info),404(Not Found: HSM Public Key not found),501(Not Implemented: This KMS does not support BYOK),502(Bad Gateway: KMS could not communicate with HSM)\n   * @property {UUID} requestId this is should be unique, used for debug.\n   * @property {string} publicKey\n   */\n  /**\n   * get public key from kms\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<FetchPublicKeyResponse>} response of get public key api\n   */\n  fetchPublicKey({assignedOrgId}) {\n    this.logger.info('kms: fetch public key for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: '/publicKey',\n      assignedOrgId,\n    }).then((res) => {\n      this.logger.info('kms: received public key');\n\n      return res.publicKey;\n    });\n  },\n\n  /**\n   * @typedef {Object} UploadCmkResponse\n   * @property {number} status\n   * @property {UUID} requestId\n   * @property {string} uri\n   * @property {string} keysState\n   */\n  /**\n   * upload master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {string} options.customerMasterKey the master key\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<UploadCmkResponse>} response of upload CMK api\n   */\n  uploadCustomerMasterKey({assignedOrgId, customerMasterKey, awsKms = false}) {\n    this.logger.info('kms: upload customer master key for byok');\n\n    return this.request({\n      method: 'create',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      customerMasterKey,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to upload customer master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * get all customer master keys for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  listAllCustomerMasterKey({assignedOrgId, awsKms = false}) {\n    this.logger.info('kms: get all customer master keys for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to get all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * @typedef {Object} ActivateCmkResponse\n   * @property {number} status\n   * @property {UUID} requestId\n   * @property {Array<CMK>} customerMasterKeys\n   */\n  /**\n   *\n   * @typedef {Object} CMK\n   * @property {string} usageState\n   * @property {UUID} assignedOrgId\n   * @property {string} uri\n   * @property {string} source\n   * @property {Date | undefined} stateUpdatedOn\n   * @property {Date | undefined} rotation\n   */\n  /**\n   * change one customer master key state for one org.\n   * delete pending key, then the keyState should be 'removedclean';\n   * active pending key, then the keyState should be 'active';\n   *\n   * @param {Object} options\n   * @param {string} options.keyId the id of one customer master key, it should be a url\n   * @param {string} options.keyState one of the following: PENDING, RECOVERING,ACTIVE,REVOKED,DEACTIVATED,REENCRYPTING,RETIRED,DELETED,DISABLED,REMOVEDCLEAN,REMOVEDDIRTY;\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  changeCustomerMasterKeyState({keyId, keyState, assignedOrgId}) {\n    this.logger.info('kms: change one customer master key state for byok');\n\n    return this.request({\n      method: 'update',\n      uri: keyId,\n      keyState,\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to change the customer master key state to {}', keyState);\n\n      return res;\n    });\n  },\n\n  /**\n   * this is for test case. it will delete all CMKs, no matter what their status is. This is mainly for test purpose\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<{status, requestId}>}\n   */\n  deleteAllCustomerMasterKeys({assignedOrgId, awsKms = false}) {\n    this.logger.info('kms: delete all customer master keys at the same time');\n\n    return this.request({\n      method: 'delete',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to delete all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * return to use global master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of activate CMK api\n   */\n  useGlobalMasterKey({assignedOrgId}) {\n    this.logger.info('kms: return to use global master key');\n\n    return this.request({\n      method: 'update',\n      uri: 'default',\n      keyState: 'ACTIVE',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to return to global master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * Fetches the specified key from the kms\n   * @param {Object} options\n   * @param {string} options.uri\n   * @param {string} options.onBehalfOf The id of a user, upon whose behalf, the key is to be retrieved or undefined if retrieval is for the active user\n   * @returns {Promise<Key>}\n   */\n  // Ideally, this would be done via the kms batcher, but other than request id,\n  // there isn't any other userful key in a kms response to match it to a\n  // request. as such, we need the batcher to group requests, but one flight to\n  // make sure we don't make the same request multiple times.\n  @oneFlight({\n    keyFactory: ({uri, onBehalfOf}) => `${uri}/${onBehalfOf}`,\n  })\n  fetchKey({uri, onBehalfOf}) {\n    /* istanbul ignore if */\n    if (!uri) {\n      return Promise.reject(new Error('`options.uri` is required'));\n    }\n\n    this.logger.info('kms: fetching key');\n\n    return this.request(\n      {\n        method: 'retrieve',\n        uri,\n      },\n      {onBehalfOf}\n    ).then((res) => {\n      this.logger.info('kms: fetched key');\n\n      return this.asKey(res.key);\n    });\n  },\n\n  /**\n   * Pings the kms. Mostly for testing\n   * @returns {Promise}\n   */\n  ping() {\n    return this.request({\n      method: 'update',\n      uri: '/ping',\n    });\n  },\n\n  /**\n   * Ensures a key obect is Key instance\n   * @param {Object} key\n   * @returns {Promise<Key>}\n   */\n  asKey(key) {\n    return jose.JWK.asKey(key.jwk).then((jwk) => {\n      key.jwk = jwk;\n\n      return key;\n    });\n  },\n\n  /**\n   * Adds appropriate metadata to the KMS request\n   * @param {Object} payload\n   * @param {Object} onBehalfOf Optional parameter to prepare the request on behalf of another user\n   * @returns {Promise<KMS.Request>}\n   */\n  prepareRequest(payload, onBehalfOf) {\n    const isECDHRequest = payload.method === 'create' && payload.uri.includes('/ecdhe');\n\n    return Promise.resolve(isECDHRequest ? partialContexts.get(this) : this._getContext()).then(\n      (context) => {\n        this.logger.info(`kms: wrapping ${isECDHRequest ? 'ephemeral key' : 'kms'} request`);\n        const req = new Request(payload);\n        let requestContext = context;\n\n        if (onBehalfOf) {\n          requestContext = this._contextOnBehalfOf(context, onBehalfOf);\n        }\n\n        return req.wrap(requestContext, {serverKey: isECDHRequest}).then(() => {\n          /* istanbul ignore else */\n          if (process.env.NODE_ENV !== 'production') {\n            this.logger.info(\n              'kms: request payload',\n              util.inspect(omit(JSON.parse(JSON.stringify(req)), 'wrapped'), {depth: null})\n            );\n          }\n\n          return req;\n        });\n      }\n    );\n  },\n\n  /**\n   * Accepts a kms message event, decrypts it, and passes it to the batcher\n   * @param {Object} event\n   * @returns {Promise<Object>}\n   */\n  processKmsMessageEvent(event) {\n    this.logger.info('kms: received kms message');\n\n    return Promise.all(\n      event.encryption.kmsMessages.map((kmsMessage, index) =>\n        this._isECDHEMessage(kmsMessage).then((isECDHMessage) => {\n          this.logger.info(`kms: received ${isECDHMessage ? 'ecdhe' : 'normal'} message`);\n          const res = new Response(kmsMessage);\n\n          return (\n            Promise.resolve(isECDHMessage ? partialContexts.get(this) : contexts.get(this))\n              // eslint-disable-next-line max-nested-callbacks\n              .then((context) => res.unwrap(context))\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => {\n                if (process.env.NODE_ENV !== 'production') {\n                  this.logger.info(\n                    'kms: response payload',\n                    util.inspect(omit(JSON.parse(JSON.stringify(res)), 'wrapped'), {depth: null})\n                  );\n                }\n              })\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => {\n                event.encryption.kmsMessages[index] = res;\n              })\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => res)\n          );\n        })\n      )\n    )\n      .then(() => this.batcher.processKmsMessageEvent(event))\n      .catch((reason) => {\n        this.logger.error('kms: decrypt failed', reason.stack);\n\n        return Promise.reject(reason);\n      })\n      .then(() => event);\n  },\n\n  /**\n   * Decrypts a kms message\n   * @param {Object} kmsMessage\n   * @returns {Promise<Object>}\n   */\n  decryptKmsMessage(kmsMessage) {\n    const res = new Response(kmsMessage);\n\n    return contexts\n      .get(this)\n      .then((context) => res.unwrap(context))\n      .then(() => res.body);\n  },\n\n  /**\n   * Determines if the kms message is an ecdhe message or a normal message\n   * @param {Object} kmsMessage\n   * @returns {Promise<boolean>}\n   */\n  _isECDHEMessage(kmsMessage) {\n    return this._getKMSStaticPubKey().then((kmsStaticPubKey) => {\n      const fields = kmsMessage.split('.');\n\n      if (fields.length !== 3) {\n        return false;\n      }\n\n      const header = JSON.parse(jose.util.base64url.decode(fields[0]));\n\n      return header.kid === kmsStaticPubKey.kid;\n    });\n  },\n\n  /**\n   * Sends a request to the kms\n   * @param {Object} payload\n   * @param {Object} options\n   * @param {Number} options.timeout (internal)\n   * @param {string} options.onBehalfOf Run the request on behalf of another user (UUID), used in compliance scenarios\n   * @returns {Promise<Object>}\n   */\n  request(payload, {timeout, onBehalfOf} = {}) {\n    timeout = timeout || this.config.kmsInitialTimeout;\n\n    // Note: this should only happen when we're using the async kms batcher;\n    // once we implement the sync batcher, this'll need to be smarter.\n    return (\n      this.webex.internal.mercury\n        .connect()\n        .then(() => this.prepareRequest(payload, onBehalfOf))\n        .then((req) => {\n          req[TIMEOUT_SYMBOL] = timeout;\n\n          return this.batcher.request(req);\n        })\n        // High complexity is due to attempt at test mode resiliency\n        // eslint-disable-next-line complexity\n        .catch((reason) => {\n          if (\n            process.env.NODE_ENV === 'test' &&\n            (reason.status === 403 || reason.statusCode === 403) &&\n            reason.message.match(\n              /Failed to resolve authorization token in KmsMessage request for user/\n            )\n          ) {\n            this.logger.warn('kms: rerequested key due to test-mode kms auth failure');\n\n            return this.request(payload, {onBehalfOf});\n          }\n\n          // KMS Error. Notify the user\n          if (reason instanceof KMSError) {\n            this.webex.trigger('client:InvalidRequestError');\n\n            return Promise.reject(reason);\n          }\n\n          // Ideally, most or all of the code below would go in kms-batcher, but\n          // but batching needs at least one more round of refactoring for that to\n          // work.\n          if (!reason.statusCode && !reason.status) {\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              /* istanbul ignore next: reason.stack vs stack difficult to control in test */\n              this.logger.info('kms: request error', reason.stack || reason);\n            }\n\n            consoleDebug(`timeout ${timeout}`);\n            timeout *= 2;\n\n            if (timeout >= this.config.ecdhMaxTimeout) {\n              this.logger.info('kms: exceeded maximum KMS request retries');\n\n              return Promise.reject(reason);\n            }\n\n            // Peek ahead to make sure we don't reset the timeout if the next timeout\n            // will exceed the maximum timeout for renegotiating ECDH keys.\n            const nextTimeout = timeout * 2;\n\n            if (timeout >= this.config.kmsMaxTimeout && nextTimeout < this.config.ecdhMaxTimeout) {\n              this.logger.info(\n                'kms: exceeded maximum KMS request retries; negotiating new ecdh key'\n              );\n\n              /* istanbul ignore else */\n              if (process.env.NODE_ENV !== 'production') {\n                this.logger.info('kms: timeout/maxtimeout', timeout, this.config.kmsMaxTimeout);\n              }\n\n              contexts.delete(this);\n              timeout = 0;\n            }\n\n            return this.request(payload, {timeout, onBehalfOf});\n          }\n\n          return Promise.reject(reason);\n        })\n    );\n  },\n\n  /**\n   * @private\n   * @returns {Promise<string>}\n   */\n  _getAuthorization() {\n    return this.webex.credentials.getUserToken('spark:kms').then((token) => token.access_token);\n  },\n\n  @oneFlight\n  /**\n   * @private\n   * @param {String} onBehalfOf create context on behalf of another user, undefined when this is not necessary\n   * @returns {Promise<Object>}\n   */\n  _getContext() {\n    let promise = contexts.get(this);\n\n    if (!promise) {\n      promise = this._prepareContext();\n      contexts.set(this, promise);\n      promise.then((context) => {\n        const expiresIn = context.ephemeralKey.expirationDate - Date.now() - 30000;\n\n        safeSetTimeout(() => contexts.delete(this), expiresIn);\n      });\n    }\n\n    return Promise.all([promise, this._getAuthorization()]).then(([context, authorization]) => {\n      context.clientInfo.credential.bearer = authorization;\n\n      return context;\n    });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSCluster() {\n    this.logger.info('kms: retrieving KMS cluster');\n\n    return this._getKMSDetails().then(({kmsCluster}) => kmsCluster);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSDetails() {\n    let details = kmsDetails.get(this);\n\n    if (!details) {\n      this.logger.info('kms: fetching KMS details');\n      details = this.webex\n        .request({\n          service: 'encryption',\n          resource: `/kms/${this.webex.internal.device.userId}`,\n        })\n        .then((res) => {\n          this.logger.info('kms: fetched KMS details');\n          const {body} = res;\n\n          body.rsaPublicKey = JSON.parse(body.rsaPublicKey);\n\n          return body;\n        })\n        .catch((reason) => {\n          this.logger.error('kms: failed to fetch KMS details', reason);\n\n          return Promise.reject(reason);\n        });\n\n      kmsDetails.set(this, details);\n    }\n\n    return details;\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSStaticPubKey() {\n    this.logger.info('kms: retrieving KMS static public key');\n\n    return this._getKMSDetails().then(({rsaPublicKey}) => rsaPublicKey);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _prepareContext() {\n    this.logger.info('kms: creating context');\n    const context = new Context();\n\n    return Promise.all([\n      this._getKMSStaticPubKey().then(validateKMS(this.config.caroots)),\n      this._getAuthorization(),\n    ])\n      .then(([kmsStaticPubKey, authorization]) => {\n        context.clientInfo = {\n          clientId: this.webex.internal.device.url,\n          credential: {\n            userId: this.webex.internal.device.userId,\n            bearer: authorization,\n          },\n        };\n\n        context.serverInfo = {\n          key: kmsStaticPubKey,\n        };\n\n        this.logger.info('kms: creating local ephemeral key');\n\n        return context.createECDHKey();\n      })\n      .then((localECDHKey) => {\n        context.ephemeralKey = localECDHKey;\n        partialContexts.set(this, context);\n\n        return Promise.all([localECDHKey.asKey(), this._getKMSCluster()]);\n      })\n      .then(([localECDHKey, cluster]) => {\n        this.logger.info('kms: submitting ephemeral key request');\n\n        return this.request({\n          uri: `${cluster}/ecdhe`,\n          method: 'create',\n          jwk: localECDHKey.toJSON(),\n        });\n      })\n      .then((res) => {\n        this.logger.info('kms: deriving final ephemeral key');\n\n        return context.deriveEphemeralKey(res.key);\n      })\n      .then((key) => {\n        context.ephemeralKey = key;\n        partialContexts.delete(this);\n        this.logger.info('kms: derived final ephemeral key');\n\n        return context;\n      })\n      .catch((reason) => {\n        this.logger.error('kms: failed to negotiate ephemeral key', reason);\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * KMS 'retrieve' requests can be made on behalf of another user. This is useful\n   * for scenarios such as eDiscovery. i.e. Where an authorized compliance officer is\n   * entitled to retrieve content generated by any organisational user.\n   * As the KMSContext is cached, updating it will affect separate requests. Hence when\n   * making a request onBehalfOf another user create a new context for just this request.\n   * However this context will be 'light' as it only needs to change one field.\n   * @param {Object} originalContext - The base context to 'copy'\n   * @param {String} onBehalfOf - The user specified in the new context\n   * @returns {Context} A 'copy' of the existing context with a new user specified\n   * @private\n   */\n  _contextOnBehalfOf(originalContext, onBehalfOf) {\n    const context = new Context();\n\n    context.clientInfo = context.clientInfo = {\n      clientId: originalContext.clientInfo.clientId,\n      credential: {\n        userId: onBehalfOf,\n        onBehalfOf, // Supports running onBehalfOf self. i.e. A CO which calls onBehalfOf with CO.id.\n        bearer: originalContext.clientInfo.credential.bearer,\n      },\n    };\n    context.serverInfo = originalContext.serverInfo;\n    context.ephemeralKey = originalContext.ephemeralKey;\n\n    return context;\n  },\n});\n\nexport default KMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAIA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAP,sBAAA,CAAAC,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AACA,IAAAQ,KAAA,GAAAT,sBAAA,CAAAC,OAAA;AAEA,IAAAS,WAAA,GAAAC,uBAAA,CAAAV,OAAA;AACA,IAAAW,yBAAA,GAAAD,uBAAA,CAAAV,OAAA;AAAmE,IAAAY,IAAA,EAAAC,IAAA;AAAA,SAAAC,yBAAAC,WAAA,eAAAC,SAAA,kCAAAC,iBAAA,OAAAD,SAAA,QAAAE,gBAAA,OAAAF,SAAA,YAAAF,wBAAA,YAAAA,yBAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,aAAAE,OAAA,CAAAF,GAAA,yBAAAA,GAAA,4BAAAG,OAAA,EAAAH,GAAA,UAAAI,KAAA,GAAAT,wBAAA,CAAAC,WAAA,OAAAQ,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAL,GAAA,YAAAI,KAAA,CAAAE,GAAA,CAAAN,GAAA,SAAAO,MAAA,WAAAC,qBAAA,GAAAC,sBAAA,IAAAC,iCAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAC,MAAA,CAAAC,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAf,GAAA,EAAAW,GAAA,SAAAK,IAAA,GAAAR,qBAAA,GAAAE,iCAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAK,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,sBAAA,CAAAF,MAAA,EAAAI,GAAA,EAAAK,IAAA,YAAAT,MAAA,CAAAI,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAJ,MAAA,CAAAJ,OAAA,GAAAH,GAAA,MAAAI,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAjB,GAAA,EAAAO,MAAA,YAAAA,MAAA;AAEnE,IAAMW,QAAQ,GAAG,IAAAC,QAAA,CAAAhB,OAAA,EAAa;AAC9B,IAAMiB,UAAU,GAAG,IAAAD,QAAA,CAAAhB,OAAA,EAAa;AAChC,IAAMkB,eAAe,GAAG,IAAAF,QAAA,CAAAhB,OAAA,EAAa;AAErC,IAAMmB,YAAY,GAAGzC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;;AAE5C;AACA;AACA;AACA,IAAM0C,GAAG,GAAGC,sBAAW,CAACC,MAAM,EAAAhC,IAAA,GAqY3B,IAAAiC,iBAAS,EAAC;EACTC,UAAU,EAAE,SAAAA,WAAAC,IAAA;IAAA,IAAEC,GAAG,GAAAD,IAAA,CAAHC,GAAG;MAAEC,UAAU,GAAAF,IAAA,CAAVE,UAAU;IAAA,UAAAC,MAAA,CAASF,GAAG,OAAAE,MAAA,CAAID,UAAU;EAAA;AACzD,CAAC,CAAC,GAAApC,IAAA,GAvY2B;EAC7BsC,SAAS,EAAE,YAAY;EAEvBC,QAAQ,EAAE;IACRC,OAAO,EAAEC;EACX,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,OAAO,WAAAA,QAAAC,KAAA,EAA6B;IAAA,IAAAC,KAAA;IAAA,IAA3BC,GAAG,GAAAF,KAAA,CAAHE,GAAG;MAAEC,MAAM,GAAAH,KAAA,CAANG,MAAM;MAAE7B,GAAG,GAAA0B,KAAA,CAAH1B,GAAG;MAAE8B,MAAM,GAAAJ,KAAA,CAANI,MAAM;IAC/BD,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;IAC1BY,MAAM,GAAGA,MAAM,IAAI9B,GAAG,CAACkB,GAAG;IAE1B,IAAI,CAACa,MAAM,CAACC,IAAI,CAAC,8BAA8B,CAAC;;IAEhD;IACA,IAAI,CAACH,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;;IAEA;IACA,IAAI,CAACL,MAAM,EAAE;MACX,OAAOG,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBC,WAAW,EAAET,MAAM;MACnBX,GAAG,EAAEY;IACP,CAAC,CAAC,CAACS,IAAI,CAAC,UAACC,GAAG,EAAK;MACfb,KAAI,CAACI,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOQ,GAAG,CAACxC,GAAG;IAChB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEyC,cAAc,WAAAA,eAAAC,KAAA,EAAgC;IAAA,IAAAC,MAAA;IAAA,IAA9BC,OAAO,GAAAF,KAAA,CAAPE,OAAO;MAAEC,OAAO,GAAAH,KAAA,CAAPG,OAAO;MAAE7C,GAAG,GAAA0C,KAAA,CAAH1C,GAAG;MAAE8C,IAAI,GAAAJ,KAAA,CAAJI,IAAI;IACzCD,OAAO,GAAGA,OAAO,IAAI,EAAE;IACvB;IACA,IAAIC,IAAI,EAAE;MACRD,OAAO,GAAGC,IAAI,CAACC,MAAM,CAAC,UAACC,IAAI,EAAEC,CAAC,EAAK;QACjCD,IAAI,CAACE,IAAI,CAACD,CAAC,CAAC/B,GAAG,CAAC;QAEhB,OAAO8B,IAAI;MACb,CAAC,EAAEH,OAAO,CAAC;IACb;;IAEA;IACA,IAAI7C,GAAG,EAAE;MACP6C,OAAO,CAACK,IAAI,CAAClD,GAAG,CAACkB,GAAG,CAAC;IACvB;;IAEA;IACA,IAAI2B,OAAO,CAACM,MAAM,KAAK,CAAC,EAAE;MACxB,OAAOlB,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5F;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,wBAAwB,CAAC;IAE1C,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,YAAY;MACjB0B,OAAO,EAAPA,OAAO;MACPC,OAAO,EAAPA;IACF,CAAC,CAAC,CAACN,IAAI,CAAC,UAACC,GAAG,EAAK;MACfG,MAAI,CAACZ,MAAM,CAACC,IAAI,CAAC,uBAAuB,CAAC;MAEzC,OAAOQ,GAAG,CAACY,QAAQ;IACrB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAAgB,WAAAA,iBAAAC,KAAA,EAAkC;IAAA,IAAAC,MAAA;IAAA,IAAhCX,OAAO,GAAAU,KAAA,CAAPV,OAAO;MAAEY,OAAO,GAAAF,KAAA,CAAPE,OAAO;MAAE5B,GAAG,GAAA0B,KAAA,CAAH1B,GAAG;MAAEC,MAAM,GAAAyB,KAAA,CAANzB,MAAM;IAC7Ce,OAAO,GAAGA,OAAO,IAAI,EAAE;IACvBf,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;IAE1B,IAAIsC,OAAO,EAAE;MACXZ,OAAO,GAAGA,OAAO,CAACxB,MAAM,CAACoC,OAAO,CAAC;IACnC;;IAEA;IACA,IAAIZ,OAAO,CAACO,MAAM,KAAK,CAAC,EAAE;MACxB,OAAOlB,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzF;;IAEA;IACA,IAAI,CAACN,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;IAE7D,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,iBAAiB;MACtBoB,WAAW,EAAET,MAAM;MACnBe,OAAO,EAAPA;IACF,CAAC,CAAC,CAACL,IAAI,CAAC,UAACC,GAAG,EAAK;MACfe,MAAI,CAACxB,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;MAE5C,OAAOQ,GAAG,CAACiB,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,kBAAkB,WAAAA,mBAAAC,KAAA,EAAgB;IAAA,IAAAC,MAAA;IAAA,IAAdhC,GAAG,GAAA+B,KAAA,CAAH/B,GAAG;MAAEC,MAAM,GAAA8B,KAAA,CAAN9B,MAAM;IAC7BA,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;IAC1B;IACA,IAAI,CAACW,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBnB,GAAG,KAAAE,MAAA,CAAKS,MAAM;IAChB,CAAC,CAAC,CAACU,IAAI,CAAC,UAACC,GAAG,EAAK;MACfoB,MAAI,CAAC7B,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAOQ,GAAG,CAACiB,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEI,mBAAmB,WAAAA,oBAAAC,KAAA,EAAgC;IAAA,IAAAC,MAAA;IAAA,IAA9BC,MAAM,GAAAF,KAAA,CAANE,MAAM;MAAEC,MAAM,GAAAH,KAAA,CAANG,MAAM;MAAErC,GAAG,GAAAkC,KAAA,CAAHlC,GAAG;MAAEC,MAAM,GAAAiC,KAAA,CAANjC,MAAM;IAC9CmC,MAAM,GAAGA,MAAM,IAAIC,MAAM;IACzBpC,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACV,GAAG;;IAE1B;IACA,IAAI,CAAC8C,MAAM,EAAE;MACX,OAAO/B,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF;;IAEA;IACA,IAAI,CAACN,MAAM,EAAE;MACX,OAAOI,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;IAEjE,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,KAAAE,MAAA,CAAKS,MAAM,sBAAAT,MAAA,CAAmB8C,oBAAW,CAACC,SAAS,CAAC;QAACH,MAAM,EAANA;MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CAACzB,IAAI,CAAC,UAACC,GAAG,EAAK;MACfuB,MAAI,CAAChC,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOQ,GAAG,CAACiB,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEW,iBAAiB,WAAAA,kBAAAC,KAAA,EAAU;IAAA,IAAAC,MAAA;IAAA,IAARC,KAAK,GAAAF,KAAA,CAALE,KAAK;IACtB,IAAI,CAACxC,MAAM,CAACC,IAAI,iBAAAZ,MAAA,CAAiBmD,KAAK,mBAAgB;;IAEtD;IACA,IAAI,CAACA,KAAK,EAAE;MACV,OAAOtC,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,OAAO;MACZqD,KAAK,EAALA;IACF,CAAC,CAAC,CAAChC,IAAI,CAAC,UAACC,GAAG,EAAK;MACf8B,MAAI,CAACvC,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOC,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAChC,GAAG,CAACM,IAAI,CAAC2B,GAAG,CAACH,MAAI,CAACI,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;EACEC,cAAc,WAAAA,eAAAC,KAAA,EAAkB;IAAA,IAAAC,MAAA;IAAA,IAAhBC,aAAa,GAAAF,KAAA,CAAbE,aAAa;IAC3B,IAAI,CAAC/C,MAAM,CAACC,IAAI,CAAC,gCAAgC,CAAC;IAElD,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBnB,GAAG,EAAE,YAAY;MACjB4D,aAAa,EAAbA;IACF,CAAC,CAAC,CAACvC,IAAI,CAAC,UAACC,GAAG,EAAK;MACfqC,MAAI,CAAC9C,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;MAE5C,OAAOQ,GAAG,CAACuC,SAAS;IACtB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,uBAAuB,WAAAA,wBAAAC,KAAA,EAAqD;IAAA,IAAAC,MAAA;IAAA,IAAnDJ,aAAa,GAAAG,KAAA,CAAbH,aAAa;MAAEK,iBAAiB,GAAAF,KAAA,CAAjBE,iBAAiB;MAAAC,YAAA,GAAAH,KAAA,CAAEI,MAAM;MAANA,MAAM,GAAAD,YAAA,cAAG,KAAK,GAAAA,YAAA;IACvE,IAAI,CAACrD,MAAM,CAACC,IAAI,CAAC,0CAA0C,CAAC;IAE5D,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAEmE,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCP,aAAa,EAAbA,aAAa;MACbK,iBAAiB,EAAjBA,iBAAiB;MACjBG,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACf0C,MAAI,CAACnD,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;MAE7D,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEiD,wBAAwB,WAAAA,yBAAAC,MAAA,EAAkC;IAAA,IAAAC,MAAA;IAAA,IAAhCb,aAAa,GAAAY,MAAA,CAAbZ,aAAa;MAAAc,aAAA,GAAAF,MAAA,CAAEL,MAAM;MAANA,MAAM,GAAAO,aAAA,cAAG,KAAK,GAAAA,aAAA;IACrD,IAAI,CAAC7D,MAAM,CAACC,IAAI,CAAC,4CAA4C,CAAC;IAE9D,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBnB,GAAG,EAAEmE,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCP,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACfmD,MAAI,CAAC5D,MAAM,CAACC,IAAI,CAAC,6CAA6C,CAAC;MAE/D,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEqD,4BAA4B,WAAAA,6BAAAC,MAAA,EAAmC;IAAA,IAAAC,OAAA;IAAA,IAAjCC,KAAK,GAAAF,MAAA,CAALE,KAAK;MAAEC,QAAQ,GAAAH,MAAA,CAARG,QAAQ;MAAEnB,aAAa,GAAAgB,MAAA,CAAbhB,aAAa;IAC1D,IAAI,CAAC/C,MAAM,CAACC,IAAI,CAAC,oDAAoD,CAAC;IAEtE,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE8E,KAAK;MACVC,QAAQ,EAARA,QAAQ;MACRnB,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACfuD,OAAI,CAAChE,MAAM,CAACC,IAAI,CAAC,2DAA2D,EAAEiE,QAAQ,CAAC;MAEvF,OAAOzD,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE0D,2BAA2B,WAAAA,4BAAAC,MAAA,EAAkC;IAAA,IAAAC,OAAA;IAAA,IAAhCtB,aAAa,GAAAqB,MAAA,CAAbrB,aAAa;MAAAuB,aAAA,GAAAF,MAAA,CAAEd,MAAM;MAANA,MAAM,GAAAgB,aAAA,cAAG,KAAK,GAAAA,aAAA;IACxD,IAAI,CAACtE,MAAM,CAACC,IAAI,CAAC,uDAAuD,CAAC;IAEzE,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAEmE,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCP,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACf4D,OAAI,CAACrE,MAAM,CAACC,IAAI,CAAC,gDAAgD,CAAC;MAElE,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE8D,kBAAkB,WAAAA,mBAAAC,MAAA,EAAkB;IAAA,IAAAC,OAAA;IAAA,IAAhB1B,aAAa,GAAAyB,MAAA,CAAbzB,aAAa;IAC/B,IAAI,CAAC/C,MAAM,CAACC,IAAI,CAAC,sCAAsC,CAAC;IAExD,OAAO,IAAI,CAACI,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE,SAAS;MACd+E,QAAQ,EAAE,QAAQ;MAClBnB,aAAa,EAAbA,aAAa;MACbQ,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACjD,IAAI,CAAC,UAACC,GAAG,EAAK;MACfgE,OAAI,CAACzE,MAAM,CAACC,IAAI,CAAC,4CAA4C,CAAC;MAE9D,OAAOQ,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAgBDiE,QAAQ,WAAAA,SAAAC,MAAA,EAAoB;IAAA,IAAAC,OAAA;IAAA,IAAlBzF,GAAG,GAAAwF,MAAA,CAAHxF,GAAG;MAAEC,UAAU,GAAAuF,MAAA,CAAVvF,UAAU;IACvB;IACA,IAAI,CAACD,GAAG,EAAE;MACR,OAAOe,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAAC,IAAIC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/D;IAEA,IAAI,CAACJ,MAAM,CAACC,IAAI,CAAC,mBAAmB,CAAC;IAErC,OAAO,IAAI,CAACI,OAAO,CACjB;MACEC,MAAM,EAAE,UAAU;MAClBnB,GAAG,EAAHA;IACF,CAAC,EACD;MAACC,UAAU,EAAVA;IAAU,CAAC,CACb,CAACoB,IAAI,CAAC,UAACC,GAAG,EAAK;MACdmE,OAAI,CAAC5E,MAAM,CAACC,IAAI,CAAC,kBAAkB,CAAC;MAEpC,OAAO2E,OAAI,CAACjC,KAAK,CAAClC,GAAG,CAACxC,GAAG,CAAC;IAC5B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;EACE4G,IAAI,WAAAA,KAAA,EAAG;IACL,OAAO,IAAI,CAACxE,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBnB,GAAG,EAAE;IACP,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;EACEwD,KAAK,WAAAA,MAAC1E,GAAG,EAAE;IACT,OAAO6G,iBAAI,CAACC,GAAG,CAACpC,KAAK,CAAC1E,GAAG,CAAC+G,GAAG,CAAC,CAACxE,IAAI,CAAC,UAACwE,GAAG,EAAK;MAC3C/G,GAAG,CAAC+G,GAAG,GAAGA,GAAG;MAEb,OAAO/G,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEgH,cAAc,WAAAA,eAACC,OAAO,EAAE9F,UAAU,EAAE;IAAA,IAAA+F,OAAA;IAClC,IAAMC,aAAa,GAAGF,OAAO,CAAC5E,MAAM,KAAK,QAAQ,IAAI4E,OAAO,CAAC/F,GAAG,CAACkG,QAAQ,CAAC,QAAQ,CAAC;IAEnF,OAAOnF,QAAA,CAAAzC,OAAA,CAAQ6H,OAAO,CAACF,aAAa,GAAGzG,eAAe,CAACf,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC2H,WAAW,EAAE,CAAC,CAAC/E,IAAI,CACzF,UAACgF,OAAO,EAAK;MACXL,OAAI,CAACnF,MAAM,CAACC,IAAI,kBAAAZ,MAAA,CAAkB+F,aAAa,GAAG,eAAe,GAAG,KAAK,cAAW;MACpF,IAAMK,GAAG,GAAG,IAAIC,gBAAO,CAACR,OAAO,CAAC;MAChC,IAAIS,cAAc,GAAGH,OAAO;MAE5B,IAAIpG,UAAU,EAAE;QACduG,cAAc,GAAGR,OAAI,CAACS,kBAAkB,CAACJ,OAAO,EAAEpG,UAAU,CAAC;MAC/D;MAEA,OAAOqG,GAAG,CAACI,IAAI,CAACF,cAAc,EAAE;QAACG,SAAS,EAAEV;MAAa,CAAC,CAAC,CAAC5E,IAAI,CAAC,YAAM;QACrE;QACA,IAAIuF,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;UACzCd,OAAI,CAACnF,MAAM,CAACC,IAAI,CACd,sBAAsB,EACtBiG,aAAI,CAACC,OAAO,CAAC,IAAAC,YAAI,EAACC,IAAI,CAACC,KAAK,CAAC,IAAAC,UAAA,CAAA9I,OAAA,EAAegI,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;YAACe,KAAK,EAAE;UAAI,CAAC,CAAC,CAC9E;QACH;QAEA,OAAOf,GAAG;MACZ,CAAC,CAAC;IACJ,CAAC,CACF;EACH,CAAC;EAED;AACF;AACA;AACA;AACA;EACEgB,sBAAsB,WAAAA,uBAACC,KAAK,EAAE;IAAA,IAAAC,OAAA;IAC5B,IAAI,CAAC3G,MAAM,CAACC,IAAI,CAAC,2BAA2B,CAAC;IAE7C,OAAOC,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAChBiE,KAAK,CAACE,UAAU,CAACC,WAAW,CAACnE,GAAG,CAAC,UAACoE,UAAU,EAAEC,KAAK;MAAA,OACjDJ,OAAI,CAACK,eAAe,CAACF,UAAU,CAAC,CAACtG,IAAI,CAAC,UAACyG,aAAa,EAAK;QACvDN,OAAI,CAAC3G,MAAM,CAACC,IAAI,kBAAAZ,MAAA,CAAkB4H,aAAa,GAAG,OAAO,GAAG,QAAQ,cAAW;QAC/E,IAAMxG,GAAG,GAAG,IAAIyG,iBAAQ,CAACJ,UAAU,CAAC;QAEpC,OACE5G,QAAA,CAAAzC,OAAA,CAAQ6H,OAAO,CAAC2B,aAAa,GAAGtI,eAAe,CAACf,GAAG,CAAC+I,OAAI,CAAC,GAAGnI,QAAQ,CAACZ,GAAG,CAAC+I,OAAI,CAAC;QAC5E;QAAA,CACCnG,IAAI,CAAC,UAACgF,OAAO;UAAA,OAAK/E,GAAG,CAAC0G,MAAM,CAAC3B,OAAO,CAAC;QAAA;QACtC;QAAA,CACChF,IAAI,CAAC,YAAM;UACV,IAAIuF,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;YACzCU,OAAI,CAAC3G,MAAM,CAACC,IAAI,CACd,uBAAuB,EACvBiG,aAAI,CAACC,OAAO,CAAC,IAAAC,YAAI,EAACC,IAAI,CAACC,KAAK,CAAC,IAAAC,UAAA,CAAA9I,OAAA,EAAegD,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;cAAC+F,KAAK,EAAE;YAAI,CAAC,CAAC,CAC9E;UACH;QACF,CAAC;QACD;QAAA,CACChG,IAAI,CAAC,YAAM;UACVkG,KAAK,CAACE,UAAU,CAACC,WAAW,CAACE,KAAK,CAAC,GAAGtG,GAAG;QAC3C,CAAC;QACD;QAAA,CACCD,IAAI,CAAC;UAAA,OAAMC,GAAG;QAAA,EAAC;MAEtB,CAAC,CAAC;IAAA,EACH,CACF,CACED,IAAI,CAAC;MAAA,OAAMmG,OAAI,CAACnH,OAAO,CAACiH,sBAAsB,CAACC,KAAK,CAAC;IAAA,EAAC,CACtDU,KAAK,CAAC,UAACC,MAAM,EAAK;MACjBV,OAAI,CAAC3G,MAAM,CAACsH,KAAK,CAAC,qBAAqB,EAAED,MAAM,CAACE,KAAK,CAAC;MAEtD,OAAOrH,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;IAC/B,CAAC,CAAC,CACD7G,IAAI,CAAC;MAAA,OAAMkG,KAAK;IAAA,EAAC;EACtB,CAAC;EAED;AACF;AACA;AACA;AACA;EACEc,iBAAiB,WAAAA,kBAACV,UAAU,EAAE;IAC5B,IAAMrG,GAAG,GAAG,IAAIyG,iBAAQ,CAACJ,UAAU,CAAC;IAEpC,OAAOtI,QAAQ,CACZZ,GAAG,CAAC,IAAI,CAAC,CACT4C,IAAI,CAAC,UAACgF,OAAO;MAAA,OAAK/E,GAAG,CAAC0G,MAAM,CAAC3B,OAAO,CAAC;IAAA,EAAC,CACtChF,IAAI,CAAC;MAAA,OAAMC,GAAG,CAACgH,IAAI;IAAA,EAAC;EACzB,CAAC;EAED;AACF;AACA;AACA;AACA;EACET,eAAe,WAAAA,gBAACF,UAAU,EAAE;IAC1B,OAAO,IAAI,CAACY,mBAAmB,EAAE,CAAClH,IAAI,CAAC,UAACmH,eAAe,EAAK;MAC1D,IAAMC,MAAM,GAAGd,UAAU,CAACe,KAAK,CAAC,GAAG,CAAC;MAEpC,IAAID,MAAM,CAACxG,MAAM,KAAK,CAAC,EAAE;QACvB,OAAO,KAAK;MACd;MAEA,IAAM0G,MAAM,GAAGzB,IAAI,CAACC,KAAK,CAACxB,iBAAI,CAACoB,IAAI,CAAC6B,SAAS,CAACC,MAAM,CAACJ,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;MAEhE,OAAOE,MAAM,CAACG,GAAG,KAAKN,eAAe,CAACM,GAAG;IAC3C,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE5H,OAAO,WAAAA,QAAC6E,OAAO,EAA8B;IAAA,IAAAgD,OAAA;IAAA,IAAAC,MAAA,GAAAC,SAAA,CAAAhH,MAAA,QAAAgH,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAJ,CAAC,CAAC;MAAzBE,OAAO,GAAAH,MAAA,CAAPG,OAAO;MAAElJ,UAAU,GAAA+I,MAAA,CAAV/I,UAAU;IACnCkJ,OAAO,GAAGA,OAAO,IAAI,IAAI,CAACC,MAAM,CAACC,iBAAiB;;IAElD;IACA;IACA,OACE,IAAI,CAACC,KAAK,CAACC,QAAQ,CAACC,OAAO,CACxBC,OAAO,EAAE,CACTpI,IAAI,CAAC;MAAA,OAAM0H,OAAI,CAACjD,cAAc,CAACC,OAAO,EAAE9F,UAAU,CAAC;IAAA,EAAC,CACpDoB,IAAI,CAAC,UAACiF,GAAG,EAAK;MACbA,GAAG,CAACoD,0BAAc,CAAC,GAAGP,OAAO;MAE7B,OAAOJ,OAAI,CAAC1I,OAAO,CAACa,OAAO,CAACoF,GAAG,CAAC;IAClC,CAAC;IACD;IACA;IAAA,CACC2B,KAAK,CAAC,UAACC,MAAM,EAAK;MACjB,IACEtB,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,MAAM,KAC9BoB,MAAM,CAACyB,MAAM,KAAK,GAAG,IAAIzB,MAAM,CAAC0B,UAAU,KAAK,GAAG,CAAC,IACpD1B,MAAM,CAAC2B,OAAO,CAACC,KAAK,CAClB,sEAAsE,CACvE,EACD;QACAf,OAAI,CAAClI,MAAM,CAACkJ,IAAI,CAAC,wDAAwD,CAAC;QAE1E,OAAOhB,OAAI,CAAC7H,OAAO,CAAC6E,OAAO,EAAE;UAAC9F,UAAU,EAAVA;QAAU,CAAC,CAAC;MAC5C;;MAEA;MACA,IAAIiI,MAAM,YAAY8B,kCAAQ,EAAE;QAC9BjB,OAAI,CAACO,KAAK,CAACW,OAAO,CAAC,4BAA4B,CAAC;QAEhD,OAAOlJ,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;MAC/B;;MAEA;MACA;MACA;MACA,IAAI,CAACA,MAAM,CAAC0B,UAAU,IAAI,CAAC1B,MAAM,CAACyB,MAAM,EAAE;QACxC;QACA,IAAI/C,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;UACzC;UACAiC,OAAI,CAAClI,MAAM,CAACC,IAAI,CAAC,oBAAoB,EAAEoH,MAAM,CAACE,KAAK,IAAIF,MAAM,CAAC;QAChE;QAEAzI,YAAY,YAAAS,MAAA,CAAYiJ,OAAO,EAAG;QAClCA,OAAO,IAAI,CAAC;QAEZ,IAAIA,OAAO,IAAIJ,OAAI,CAACK,MAAM,CAACc,cAAc,EAAE;UACzCnB,OAAI,CAAClI,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;UAE7D,OAAOC,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;QAC/B;;QAEA;QACA;QACA,IAAMiC,WAAW,GAAGhB,OAAO,GAAG,CAAC;QAE/B,IAAIA,OAAO,IAAIJ,OAAI,CAACK,MAAM,CAACgB,aAAa,IAAID,WAAW,GAAGpB,OAAI,CAACK,MAAM,CAACc,cAAc,EAAE;UACpFnB,OAAI,CAAClI,MAAM,CAACC,IAAI,CACd,qEAAqE,CACtE;;UAED;UACA,IAAI8F,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;YACzCiC,OAAI,CAAClI,MAAM,CAACC,IAAI,CAAC,yBAAyB,EAAEqI,OAAO,EAAEJ,OAAI,CAACK,MAAM,CAACgB,aAAa,CAAC;UACjF;UAEA/K,QAAQ,CAACgL,MAAM,CAACtB,OAAI,CAAC;UACrBI,OAAO,GAAG,CAAC;QACb;QAEA,OAAOJ,OAAI,CAAC7H,OAAO,CAAC6E,OAAO,EAAE;UAACoD,OAAO,EAAPA,OAAO;UAAElJ,UAAU,EAAVA;QAAU,CAAC,CAAC;MACrD;MAEA,OAAOc,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;IAC/B,CAAC,CAAC;EAER,CAAC;EAED;AACF;AACA;AACA;EACEoC,iBAAiB,WAAAA,kBAAA,EAAG;IAClB,OAAO,IAAI,CAAChB,KAAK,CAACiB,WAAW,CAACC,YAAY,CAAC,WAAW,CAAC,CAACnJ,IAAI,CAAC,UAACoJ,KAAK;MAAA,OAAKA,KAAK,CAACC,YAAY;IAAA,EAAC;EAC7F,CAAC;EAGD;AACF;AACA;AACA;AACA;EACEtE,WAAW,WAAAA,YAAA,EAAG;IAAA,IAAAuE,OAAA;IACZ,IAAIC,OAAO,GAAGvL,QAAQ,CAACZ,GAAG,CAAC,IAAI,CAAC;IAEhC,IAAI,CAACmM,OAAO,EAAE;MACZA,OAAO,GAAG,IAAI,CAACC,eAAe,EAAE;MAChCxL,QAAQ,CAACD,GAAG,CAAC,IAAI,EAAEwL,OAAO,CAAC;MAC3BA,OAAO,CAACvJ,IAAI,CAAC,UAACgF,OAAO,EAAK;QACxB,IAAMyE,SAAS,GAAGzE,OAAO,CAAC0E,YAAY,CAACC,cAAc,GAAG,IAAAC,IAAA,CAAA3M,OAAA,GAAU,GAAG,KAAK;QAE1E,IAAA4M,4BAAc,EAAC;UAAA,OAAM7L,QAAQ,CAACgL,MAAM,CAACM,OAAI,CAAC;QAAA,GAAEG,SAAS,CAAC;MACxD,CAAC,CAAC;IACJ;IAEA,OAAO/J,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAC,CAACsH,OAAO,EAAE,IAAI,CAACN,iBAAiB,EAAE,CAAC,CAAC,CAACjJ,IAAI,CAAC,UAAA8J,MAAA,EAA8B;MAAA,IAAAC,MAAA,OAAAC,eAAA,CAAA/M,OAAA,EAAA6M,MAAA;QAA5B9E,OAAO,GAAA+E,MAAA;QAAEE,aAAa,GAAAF,MAAA;MACnF/E,OAAO,CAACkF,UAAU,CAACC,UAAU,CAACC,MAAM,GAAGH,aAAa;MAEpD,OAAOjF,OAAO;IAChB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;EACEqF,cAAc,WAAAA,eAAA,EAAG;IACf,IAAI,CAAC7K,MAAM,CAACC,IAAI,CAAC,6BAA6B,CAAC;IAE/C,OAAO,IAAI,CAAC6K,cAAc,EAAE,CAACtK,IAAI,CAAC,UAAAuK,MAAA;MAAA,IAAEC,UAAU,GAAAD,MAAA,CAAVC,UAAU;MAAA,OAAMA,UAAU;IAAA,EAAC;EACjE,CAAC;EAED;AACF;AACA;AACA;EACEF,cAAc,WAAAA,eAAA,EAAG;IAAA,IAAAG,OAAA;IACf,IAAIC,OAAO,GAAGxM,UAAU,CAACd,GAAG,CAAC,IAAI,CAAC;IAElC,IAAI,CAACsN,OAAO,EAAE;MACZ,IAAI,CAAClL,MAAM,CAACC,IAAI,CAAC,2BAA2B,CAAC;MAC7CiL,OAAO,GAAG,IAAI,CAACzC,KAAK,CACjBpI,OAAO,CAAC;QACP8K,OAAO,EAAE,YAAY;QACrB9J,QAAQ,UAAAhC,MAAA,CAAU,IAAI,CAACoJ,KAAK,CAACC,QAAQ,CAAC0C,MAAM,CAAClJ,MAAM;MACrD,CAAC,CAAC,CACD1B,IAAI,CAAC,UAACC,GAAG,EAAK;QACbwK,OAAI,CAACjL,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;QAC5C,IAAOwH,IAAI,GAAIhH,GAAG,CAAXgH,IAAI;QAEXA,IAAI,CAAC4D,YAAY,GAAGhF,IAAI,CAACC,KAAK,CAACmB,IAAI,CAAC4D,YAAY,CAAC;QAEjD,OAAO5D,IAAI;MACb,CAAC,CAAC,CACDL,KAAK,CAAC,UAACC,MAAM,EAAK;QACjB4D,OAAI,CAACjL,MAAM,CAACsH,KAAK,CAAC,kCAAkC,EAAED,MAAM,CAAC;QAE7D,OAAOnH,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;MAC/B,CAAC,CAAC;MAEJ3I,UAAU,CAACH,GAAG,CAAC,IAAI,EAAE2M,OAAO,CAAC;IAC/B;IAEA,OAAOA,OAAO;EAChB,CAAC;EAED;AACF;AACA;AACA;EACExD,mBAAmB,WAAAA,oBAAA,EAAG;IACpB,IAAI,CAAC1H,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;IAEzD,OAAO,IAAI,CAAC6K,cAAc,EAAE,CAACtK,IAAI,CAAC,UAAA8K,MAAA;MAAA,IAAED,YAAY,GAAAC,MAAA,CAAZD,YAAY;MAAA,OAAMA,YAAY;IAAA,EAAC;EACrE,CAAC;EAED;AACF;AACA;AACA;EACErB,eAAe,WAAAA,gBAAA,EAAG;IAAA,IAAAuB,OAAA;IAChB,IAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,uBAAuB,CAAC;IACzC,IAAMuF,OAAO,GAAG,IAAIgG,gBAAO,EAAE;IAE7B,OAAOtL,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAC,CACjB,IAAI,CAACiF,mBAAmB,EAAE,CAAClH,IAAI,CAAC,IAAAiL,iCAAW,EAAC,IAAI,CAAClD,MAAM,CAACmD,OAAO,CAAC,CAAC,EACjE,IAAI,CAACjC,iBAAiB,EAAE,CACzB,CAAC,CACCjJ,IAAI,CAAC,UAAAmL,MAAA,EAAsC;MAAA,IAAAC,MAAA,OAAApB,eAAA,CAAA/M,OAAA,EAAAkO,MAAA;QAApChE,eAAe,GAAAiE,MAAA;QAAEnB,aAAa,GAAAmB,MAAA;MACpCpG,OAAO,CAACkF,UAAU,GAAG;QACnBmB,QAAQ,EAAEN,OAAI,CAAC9C,KAAK,CAACC,QAAQ,CAAC0C,MAAM,CAACU,GAAG;QACxCnB,UAAU,EAAE;UACVzI,MAAM,EAAEqJ,OAAI,CAAC9C,KAAK,CAACC,QAAQ,CAAC0C,MAAM,CAAClJ,MAAM;UACzC0I,MAAM,EAAEH;QACV;MACF,CAAC;MAEDjF,OAAO,CAACuG,UAAU,GAAG;QACnB9N,GAAG,EAAE0J;MACP,CAAC;MAED4D,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAOuF,OAAO,CAACwG,aAAa,EAAE;IAChC,CAAC,CAAC,CACDxL,IAAI,CAAC,UAACyL,YAAY,EAAK;MACtBzG,OAAO,CAAC0E,YAAY,GAAG+B,YAAY;MACnCtN,eAAe,CAACJ,GAAG,CAACgN,OAAI,EAAE/F,OAAO,CAAC;MAElC,OAAOtF,QAAA,CAAAzC,OAAA,CAAQgF,GAAG,CAAC,CAACwJ,YAAY,CAACtJ,KAAK,EAAE,EAAE4I,OAAI,CAACV,cAAc,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CACDrK,IAAI,CAAC,UAAA0L,MAAA,EAA6B;MAAA,IAAAC,MAAA,OAAA3B,eAAA,CAAA/M,OAAA,EAAAyO,MAAA;QAA3BD,YAAY,GAAAE,MAAA;QAAEC,OAAO,GAAAD,MAAA;MAC3BZ,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;MAEzD,OAAOsL,OAAI,CAAClL,OAAO,CAAC;QAClBlB,GAAG,KAAAE,MAAA,CAAK+M,OAAO,WAAQ;QACvB9L,MAAM,EAAE,QAAQ;QAChB0E,GAAG,EAAEiH,YAAY,CAACI,MAAM;MAC1B,CAAC,CAAC;IACJ,CAAC,CAAC,CACD7L,IAAI,CAAC,UAACC,GAAG,EAAK;MACb8K,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAOuF,OAAO,CAAC8G,kBAAkB,CAAC7L,GAAG,CAACxC,GAAG,CAAC;IAC5C,CAAC,CAAC,CACDuC,IAAI,CAAC,UAACvC,GAAG,EAAK;MACbuH,OAAO,CAAC0E,YAAY,GAAGjM,GAAG;MAC1BU,eAAe,CAAC6K,MAAM,CAAC+B,OAAI,CAAC;MAC5BA,OAAI,CAACvL,MAAM,CAACC,IAAI,CAAC,kCAAkC,CAAC;MAEpD,OAAOuF,OAAO;IAChB,CAAC,CAAC,CACD4B,KAAK,CAAC,UAACC,MAAM,EAAK;MACjBkE,OAAI,CAACvL,MAAM,CAACsH,KAAK,CAAC,wCAAwC,EAAED,MAAM,CAAC;MAEnE,OAAOnH,QAAA,CAAAzC,OAAA,CAAQ0C,MAAM,CAACkH,MAAM,CAAC;IAC/B,CAAC,CAAC;EACN,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEzB,kBAAkB,WAAAA,mBAAC2G,eAAe,EAAEnN,UAAU,EAAE;IAC9C,IAAMoG,OAAO,GAAG,IAAIgG,gBAAO,EAAE;IAE7BhG,OAAO,CAACkF,UAAU,GAAGlF,OAAO,CAACkF,UAAU,GAAG;MACxCmB,QAAQ,EAAEU,eAAe,CAAC7B,UAAU,CAACmB,QAAQ;MAC7ClB,UAAU,EAAE;QACVzI,MAAM,EAAE9C,UAAU;QAClBA,UAAU,EAAVA,UAAU;QAAE;QACZwL,MAAM,EAAE2B,eAAe,CAAC7B,UAAU,CAACC,UAAU,CAACC;MAChD;IACF,CAAC;IACDpF,OAAO,CAACuG,UAAU,GAAGQ,eAAe,CAACR,UAAU;IAC/CvG,OAAO,CAAC0E,YAAY,GAAGqC,eAAe,CAACrC,YAAY;IAEnD,OAAO1E,OAAO;EAChB,CAAC;EAAAgH,OAAA;AACH,CAAC,OAAAC,0BAAA,CAAAhP,OAAA,EAAAT,IAAA,eAAAD,IAAA,OAAA2P,yBAAA,CAAAjP,OAAA,EAAAT,IAAA,eAAAA,IAAA,OAAAyP,0BAAA,CAAAhP,OAAA,EAAAT,IAAA,kBA3KEgC,iBAAS,OAAA0N,yBAAA,CAAAjP,OAAA,EAAAT,IAAA,kBAAAA,IAAA,IAAAA,IAAA,GA2KV;AAAC,IAAA2P,QAAA,GAEY9N,GAAG;AAAA+N,OAAA,CAAAnP,OAAA,GAAAkP,QAAA"}

package/package.json

@@ -1,6 +1,5 @@
 {
   "name": "@webex/internal-plugin-encryption",
-  "version": "2.58.1",
   "description": "",
   "license": "MIT",
   "main": "dist/index.js",
@@ -25,27 +24,27 @@
   },
   "devDependencies": {
     "@babel/core": "^7.17.10",
-    "@webex/babel-config-legacy": "2.58.1",
-    "@webex/eslint-config-legacy": "2.58.1",
-    "@webex/jest-config-legacy": "2.58.1",
-    "@webex/legacy-tools": "2.58.1",
-    "@webex/test-helper-chai": "2.58.1",
-    "@webex/test-helper-make-local-url": "2.58.1",
-    "@webex/test-helper-mocha": "2.58.1",
-    "@webex/test-helper-mock-webex": "2.58.1",
-    "@webex/test-helper-test-users": "2.58.1",
+    "@webex/babel-config-legacy": "workspace:^",
+    "@webex/eslint-config-legacy": "workspace:^",
+    "@webex/jest-config-legacy": "workspace:^",
+    "@webex/legacy-tools": "workspace:^",
+    "@webex/test-helper-chai": "workspace:^",
+    "@webex/test-helper-make-local-url": "workspace:^",
+    "@webex/test-helper-mocha": "workspace:^",
+    "@webex/test-helper-mock-webex": "workspace:^",
+    "@webex/test-helper-test-users": "workspace:^",
     "eslint": "^8.24.0",
     "prettier": "^2.7.1",
     "sinon": "^9.2.4"
   },
   "dependencies": {
-    "@webex/common": "2.58.1",
-    "@webex/common-timers": "2.58.1",
-    "@webex/http-core": "2.58.1",
-    "@webex/internal-plugin-device": "2.58.1",
-    "@webex/internal-plugin-mercury": "2.58.1",
-    "@webex/test-helper-file": "2.58.1",
-    "@webex/webex-core": "2.58.1",
+    "@webex/common": "workspace:^",
+    "@webex/common-timers": "workspace:^",
+    "@webex/http-core": "workspace:^",
+    "@webex/internal-plugin-device": "workspace:^",
+    "@webex/internal-plugin-mercury": "workspace:^",
+    "@webex/test-helper-file": "workspace:^",
+    "@webex/webex-core": "workspace:^",
     "asn1js": "^2.0.26",
     "debug": "^4.3.4",
     "isomorphic-webcrypto": "^2.3.8",
@@ -61,10 +60,12 @@
   "scripts": {
     "build": "yarn build:src",
     "build:src": "webex-legacy-tools build -dest \"./dist\" -src \"./src\" -js -ts -maps",
+    "deploy:npm": "npm publish",
     "test": "yarn test:style && yarn test:unit && yarn test:integration && yarn test:browser",
     "test:browser": "webex-legacy-tools test --integration --unit --runner karma",
     "test:integration:broken": "webex-legacy-tools test --integration --runner mocha",
     "test:style": "eslint ./src/**/*.*",
     "test:unit": "webex-legacy-tools test --unit --runner jest"
-  }
+  },
+  "version": "2.59.1-next.0"
 }