@webex/webex-core 3.12.0-next.44 → 3.12.0-next.46

package/dist/config.js

@@ -84,6 +84,15 @@ var _default = exports.default = {
      * @type {boolean}
      */
     validateDomains: true,
+    /**
+     * When true, enables the CatalogUrlInterceptor which validates that all
+     * outbound request URLs are in the service catalog or allowed domains.
+     * This prevents SSRF attacks where attacker-controlled URLs could be
+     * sent to the SDK.
+     *
+     * @type {boolean}
+     */
+    validateCatalogUrls: false,
     /**
      * services that don't need auth validation
      */

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"names":["_storage","require","_credentialsConfig","_interopRequireDefault","_default","exports","default","maxAppLevelRedirects","maxLocusRedirects","maxAuthenticationReplays","maxReconnectAttempts","onBeforeLogout","trackingIdPrefix","trackingIdSuffix","AlternateLogger","undefined","credentials","CredentialsConfig","fedramp","process","env","ENABLE_FEDRAMP","services","useUserOnboardingServiceForActivations","useCatalogOverride","skipPreauthCatalogOnUnauthenticated","catalogInitTimeout","discovery","hydra","HYDRA_SERVICE_URL","sqdiscovery","SQDISCOVERY_SERVICE_URL","u2c","U2C_SERVICE_URL","validateDomains","servicesNotNeedValidation","allowedDomains","device","preDiscoveryServices","hydraServiceUrl","metrics","type","calling","cacheU2C","payloadTransformer","predicates","transforms","storage","boundedAdapter","MemoryStoreAdapter","unboundedAdapter"],"sources":["config.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport {MemoryStoreAdapter} from './lib/storage';\nimport CredentialsConfig from './credentials-config';\n\nexport default {\n  maxAppLevelRedirects: 10,\n  maxLocusRedirects: 5,\n  maxAuthenticationReplays: 1,\n  maxReconnectAttempts: 1,\n  onBeforeLogout: [],\n  trackingIdPrefix: 'webex-js-sdk',\n  trackingIdSuffix: '',\n  AlternateLogger: undefined,\n  credentials: new CredentialsConfig(),\n  fedramp: process.env.ENABLE_FEDRAMP || false,\n  services: {\n    /**\n     * When true, uses the user-onboarding service for user activation.\n     * When false (default), uses the license service.\n     *\n     * @type {boolean}\n     */\n    useUserOnboardingServiceForActivations: false,\n\n    /**\n     * When true, requests the U2C catalog override.\n     *\n     * @type {boolean}\n     */\n    useCatalogOverride: false,\n\n    /**\n     * When true, skips fetching the preauth catalog during initialization\n     * while the user is unauthenticated (no existing token). The catalog is\n     * expected to be collected manually later instead. When false (default),\n     * the preauth catalog is collected automatically during init.\n     *\n     * @type {boolean}\n     */\n    skipPreauthCatalogOnUnauthenticated: false,\n\n    /**\n     * Maximum time (in milliseconds) to wait for the initial service catalog\n     * collection when `waitForCatalogInit` is enabled, before letting\n     * `services.ready` (and therefore `webex.ready`) fire anyway. Prevents a\n     * hung catalog request from leaving the app on a permanent spinner.\n     *\n     * @type {number}\n     */\n    catalogInitTimeout: 15000,\n\n    /**\n     * A list of services that are available prior to catalog collection.\n     *\n     * @type {Object}\n     */\n    discovery: {\n      /**\n       * The hydra discovery url.\n       *\n       * @type {string}\n       */\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n\n      /**\n       * load balanced region info url\n       */\n      sqdiscovery: process.env.SQDISCOVERY_SERVICE_URL || 'https://ds.ciscospark.com/v1/region',\n\n      /**\n       * The u2c discovery url\n       *\n       * @type {string}\n       */\n      u2c: process.env.U2C_SERVICE_URL || 'https://u2c.wbx2.com/u2c/api/v1',\n    },\n\n    /**\n     * When true, considers all urls in `allowedDomains` as safe for auth tokens\n     *\n     * @type {boolean}\n     */\n    validateDomains: true,\n\n    /**\n     * services that don't need auth validation\n     */\n\n    servicesNotNeedValidation: ['webex-appapi-service'],\n\n    /**\n     * Contains a list of allowed domain host addresses.\n     *\n     * @type {Array<string>}\n     */\n    allowedDomains: [],\n  },\n  device: {\n    preDiscoveryServices: {\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n      hydraServiceUrl: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n    },\n    validateDomains: true,\n  },\n  metrics: {\n    type: ['behavioral', 'operational'],\n  },\n  calling: {\n    /**\n     * Controls whether U2C service catalogs should be cached and warmed from cache.\n     * When false, the services layer will skip reading and writing the U2C cache.\n     */\n    cacheU2C: false,\n  },\n  payloadTransformer: {\n    predicates: [],\n    transforms: [],\n  },\n  storage: {\n    boundedAdapter: MemoryStoreAdapter,\n    unboundedAdapter: MemoryStoreAdapter,\n  },\n};\n"],"mappings":";;;;;;;;AAMA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,kBAAA,GAAAC,sBAAA,CAAAF,OAAA;AAPA;AACA;AACA;AAEA;AAAA,IAAAG,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAKe;EACbC,oBAAoB,EAAE,EAAE;EACxBC,iBAAiB,EAAE,CAAC;EACpBC,wBAAwB,EAAE,CAAC;EAC3BC,oBAAoB,EAAE,CAAC;EACvBC,cAAc,EAAE,EAAE;EAClBC,gBAAgB,EAAE,cAAc;EAChCC,gBAAgB,EAAE,EAAE;EACpBC,eAAe,EAAEC,SAAS;EAC1BC,WAAW,EAAE,IAAIC,0BAAiB,CAAC,CAAC;EACpCC,OAAO,EAAEC,OAAO,CAACC,GAAG,CAACC,cAAc,IAAI,KAAK;EAC5CC,QAAQ,EAAE;IACR;AACJ;AACA;AACA;AACA;AACA;IACIC,sCAAsC,EAAE,KAAK;IAE7C;AACJ;AACA;AACA;AACA;IACIC,kBAAkB,EAAE,KAAK;IAEzB;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,mCAAmC,EAAE,KAAK;IAE1C;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,kBAAkB,EAAE,KAAK;IAEzB;AACJ;AACA;AACA;AACA;IACIC,SAAS,EAAE;MACT;AACN;AACA;AACA;AACA;MACMC,KAAK,EAAET,OAAO,CAACC,GAAG,CAACS,iBAAiB,IAAI,+BAA+B;MAEvE;AACN;AACA;MACMC,WAAW,EAAEX,OAAO,CAACC,GAAG,CAACW,uBAAuB,IAAI,qCAAqC;MAEzF;AACN;AACA;AACA;AACA;MACMC,GAAG,EAAEb,OAAO,CAACC,GAAG,CAACa,eAAe,IAAI;IACtC,CAAC;IAED;AACJ;AACA;AACA;AACA;IACIC,eAAe,EAAE,IAAI;IAErB;AACJ;AACA;;IAEIC,yBAAyB,EAAE,CAAC,sBAAsB,CAAC;IAEnD;AACJ;AACA;AACA;AACA;IACIC,cAAc,EAAE;EAClB,CAAC;EACDC,MAAM,EAAE;IACNC,oBAAoB,EAAE;MACpBV,KAAK,EAAET,OAAO,CAACC,GAAG,CAACS,iBAAiB,IAAI,+BAA+B;MACvEU,eAAe,EAAEpB,OAAO,CAACC,GAAG,CAACS,iBAAiB,IAAI;IACpD,CAAC;IACDK,eAAe,EAAE;EACnB,CAAC;EACDM,OAAO,EAAE;IACPC,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa;EACpC,CAAC;EACDC,OAAO,EAAE;IACP;AACJ;AACA;AACA;IACIC,QAAQ,EAAE;EACZ,CAAC;EACDC,kBAAkB,EAAE;IAClBC,UAAU,EAAE,EAAE;IACdC,UAAU,EAAE;EACd,CAAC;EACDC,OAAO,EAAE;IACPC,cAAc,EAAEC,2BAAkB;IAClCC,gBAAgB,EAAED;EACpB;AACF,CAAC","ignoreList":[]}
+{"version":3,"names":["_storage","require","_credentialsConfig","_interopRequireDefault","_default","exports","default","maxAppLevelRedirects","maxLocusRedirects","maxAuthenticationReplays","maxReconnectAttempts","onBeforeLogout","trackingIdPrefix","trackingIdSuffix","AlternateLogger","undefined","credentials","CredentialsConfig","fedramp","process","env","ENABLE_FEDRAMP","services","useUserOnboardingServiceForActivations","useCatalogOverride","skipPreauthCatalogOnUnauthenticated","catalogInitTimeout","discovery","hydra","HYDRA_SERVICE_URL","sqdiscovery","SQDISCOVERY_SERVICE_URL","u2c","U2C_SERVICE_URL","validateDomains","validateCatalogUrls","servicesNotNeedValidation","allowedDomains","device","preDiscoveryServices","hydraServiceUrl","metrics","type","calling","cacheU2C","payloadTransformer","predicates","transforms","storage","boundedAdapter","MemoryStoreAdapter","unboundedAdapter"],"sources":["config.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport {MemoryStoreAdapter} from './lib/storage';\nimport CredentialsConfig from './credentials-config';\n\nexport default {\n  maxAppLevelRedirects: 10,\n  maxLocusRedirects: 5,\n  maxAuthenticationReplays: 1,\n  maxReconnectAttempts: 1,\n  onBeforeLogout: [],\n  trackingIdPrefix: 'webex-js-sdk',\n  trackingIdSuffix: '',\n  AlternateLogger: undefined,\n  credentials: new CredentialsConfig(),\n  fedramp: process.env.ENABLE_FEDRAMP || false,\n  services: {\n    /**\n     * When true, uses the user-onboarding service for user activation.\n     * When false (default), uses the license service.\n     *\n     * @type {boolean}\n     */\n    useUserOnboardingServiceForActivations: false,\n\n    /**\n     * When true, requests the U2C catalog override.\n     *\n     * @type {boolean}\n     */\n    useCatalogOverride: false,\n\n    /**\n     * When true, skips fetching the preauth catalog during initialization\n     * while the user is unauthenticated (no existing token). The catalog is\n     * expected to be collected manually later instead. When false (default),\n     * the preauth catalog is collected automatically during init.\n     *\n     * @type {boolean}\n     */\n    skipPreauthCatalogOnUnauthenticated: false,\n\n    /**\n     * Maximum time (in milliseconds) to wait for the initial service catalog\n     * collection when `waitForCatalogInit` is enabled, before letting\n     * `services.ready` (and therefore `webex.ready`) fire anyway. Prevents a\n     * hung catalog request from leaving the app on a permanent spinner.\n     *\n     * @type {number}\n     */\n    catalogInitTimeout: 15000,\n\n    /**\n     * A list of services that are available prior to catalog collection.\n     *\n     * @type {Object}\n     */\n    discovery: {\n      /**\n       * The hydra discovery url.\n       *\n       * @type {string}\n       */\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n\n      /**\n       * load balanced region info url\n       */\n      sqdiscovery: process.env.SQDISCOVERY_SERVICE_URL || 'https://ds.ciscospark.com/v1/region',\n\n      /**\n       * The u2c discovery url\n       *\n       * @type {string}\n       */\n      u2c: process.env.U2C_SERVICE_URL || 'https://u2c.wbx2.com/u2c/api/v1',\n    },\n\n    /**\n     * When true, considers all urls in `allowedDomains` as safe for auth tokens\n     *\n     * @type {boolean}\n     */\n    validateDomains: true,\n\n    /**\n     * When true, enables the CatalogUrlInterceptor which validates that all\n     * outbound request URLs are in the service catalog or allowed domains.\n     * This prevents SSRF attacks where attacker-controlled URLs could be\n     * sent to the SDK.\n     *\n     * @type {boolean}\n     */\n    validateCatalogUrls: false,\n\n    /**\n     * services that don't need auth validation\n     */\n\n    servicesNotNeedValidation: ['webex-appapi-service'],\n\n    /**\n     * Contains a list of allowed domain host addresses.\n     *\n     * @type {Array<string>}\n     */\n    allowedDomains: [],\n  },\n  device: {\n    preDiscoveryServices: {\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n      hydraServiceUrl: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n    },\n    validateDomains: true,\n  },\n  metrics: {\n    type: ['behavioral', 'operational'],\n  },\n  calling: {\n    /**\n     * Controls whether U2C service catalogs should be cached and warmed from cache.\n     * When false, the services layer will skip reading and writing the U2C cache.\n     */\n    cacheU2C: false,\n  },\n  payloadTransformer: {\n    predicates: [],\n    transforms: [],\n  },\n  storage: {\n    boundedAdapter: MemoryStoreAdapter,\n    unboundedAdapter: MemoryStoreAdapter,\n  },\n};\n"],"mappings":";;;;;;;;AAMA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,kBAAA,GAAAC,sBAAA,CAAAF,OAAA;AAPA;AACA;AACA;AAEA;AAAA,IAAAG,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAKe;EACbC,oBAAoB,EAAE,EAAE;EACxBC,iBAAiB,EAAE,CAAC;EACpBC,wBAAwB,EAAE,CAAC;EAC3BC,oBAAoB,EAAE,CAAC;EACvBC,cAAc,EAAE,EAAE;EAClBC,gBAAgB,EAAE,cAAc;EAChCC,gBAAgB,EAAE,EAAE;EACpBC,eAAe,EAAEC,SAAS;EAC1BC,WAAW,EAAE,IAAIC,0BAAiB,CAAC,CAAC;EACpCC,OAAO,EAAEC,OAAO,CAACC,GAAG,CAACC,cAAc,IAAI,KAAK;EAC5CC,QAAQ,EAAE;IACR;AACJ;AACA;AACA;AACA;AACA;IACIC,sCAAsC,EAAE,KAAK;IAE7C;AACJ;AACA;AACA;AACA;IACIC,kBAAkB,EAAE,KAAK;IAEzB;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,mCAAmC,EAAE,KAAK;IAE1C;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,kBAAkB,EAAE,KAAK;IAEzB;AACJ;AACA;AACA;AACA;IACIC,SAAS,EAAE;MACT;AACN;AACA;AACA;AACA;MACMC,KAAK,EAAET,OAAO,CAACC,GAAG,CAACS,iBAAiB,IAAI,+BAA+B;MAEvE;AACN;AACA;MACMC,WAAW,EAAEX,OAAO,CAACC,GAAG,CAACW,uBAAuB,IAAI,qCAAqC;MAEzF;AACN;AACA;AACA;AACA;MACMC,GAAG,EAAEb,OAAO,CAACC,GAAG,CAACa,eAAe,IAAI;IACtC,CAAC;IAED;AACJ;AACA;AACA;AACA;IACIC,eAAe,EAAE,IAAI;IAErB;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,mBAAmB,EAAE,KAAK;IAE1B;AACJ;AACA;;IAEIC,yBAAyB,EAAE,CAAC,sBAAsB,CAAC;IAEnD;AACJ;AACA;AACA;AACA;IACIC,cAAc,EAAE;EAClB,CAAC;EACDC,MAAM,EAAE;IACNC,oBAAoB,EAAE;MACpBX,KAAK,EAAET,OAAO,CAACC,GAAG,CAACS,iBAAiB,IAAI,+BAA+B;MACvEW,eAAe,EAAErB,OAAO,CAACC,GAAG,CAACS,iBAAiB,IAAI;IACpD,CAAC;IACDK,eAAe,EAAE;EACnB,CAAC;EACDO,OAAO,EAAE;IACPC,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa;EACpC,CAAC;EACDC,OAAO,EAAE;IACP;AACJ;AACA;AACA;IACIC,QAAQ,EAAE;EACZ,CAAC;EACDC,kBAAkB,EAAE;IAClBC,UAAU,EAAE,EAAE;IACdC,UAAU,EAAE;EACd,CAAC;EACDC,OAAO,EAAE;IACPC,cAAc,EAAEC,2BAAkB;IAClCC,gBAAgB,EAAED;EACpB;AACF,CAAC","ignoreList":[]}

package/dist/index.js

@@ -20,6 +20,12 @@ _Object$defineProperty(exports, "Batcher", {
     return _batcher.default;
   }
 });
+_Object$defineProperty(exports, "CatalogUrlInterceptor", {
+  enumerable: true,
+  get: function get() {
+    return _catalogUrl.default;
+  }
+});
 _Object$defineProperty(exports, "Credentials", {
   enumerable: true,
   get: function get() {
@@ -315,6 +321,7 @@ var _webexHttpError = _interopRequireDefault(require("./lib/webex-http-error"));
 var _statelessWebexPlugin = _interopRequireDefault(require("./lib/stateless-webex-plugin"));
 var _webexPlugin = _interopRequireDefault(require("./lib/webex-plugin"));
 var _auth = _interopRequireDefault(require("./interceptors/auth"));
+var _catalogUrl = _interopRequireDefault(require("./interceptors/catalog-url"));
 var _networkTiming = _interopRequireDefault(require("./interceptors/network-timing"));
 var _payloadTransformer = _interopRequireDefault(require("./interceptors/payload-transformer"));
 var _redirect = _interopRequireDefault(require("./interceptors/redirect"));

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["require","_credentials","_services","_servicesV","_serviceConstants","_interopRequireWildcard","exports","serviceConstants","_storage","_webexCore","_webexHttpError","_interopRequireDefault","_statelessWebexPlugin","_webexPlugin","_auth","_networkTiming","_payloadTransformer","_redirect","_responseLogger","_requestEvent","_requestLogger","_requestTiming","_userAgent","_proxy","_webexTrackingId","_webexUserAgent","_rateLimit","_embargo","_defaultOptions","_hostmap","_service","_serverError","_batcher","_page","_config","e","t","_WeakMap","r","n","__esModule","o","i","f","__proto__","default","_typeof","has","get","set","_t","hasOwnProperty","call","_Object$defineProperty","_Object$getOwnPropertyDescriptor"],"sources":["index.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n *\n * Services is currently a part of webex-core due to how the contents of\n * the original internal-plugin-services needed to be accessed when webex-core\n * is initialized. As a plugin outside of webex-core, it would initialize after\n * credentials, causing all requests prior to its initialization to fail\n * federation requirements, and instead send requests to the environmentally-\n * assigned urls.\n */\n\nimport './plugins/logger';\nimport './lib/credentials';\nimport './lib/services';\n\nexport {Credentials, filterScope, grantErrors, sortScope, Token} from './lib/credentials';\n\nexport {\n  ServiceCatalog,\n  ServiceRegistry,\n  ServiceState,\n  Services,\n  ServiceHost,\n  ServiceUrl,\n} from './lib/services';\n\nexport {ServiceCatalogV2, ServicesV2, ServiceDetail} from './lib/services-v2';\nexport * as serviceConstants from './lib/constants';\nexport {\n  makeWebexStore,\n  makeWebexPluginStore,\n  MemoryStoreAdapter,\n  NotFoundError,\n  persist,\n  StorageError,\n  waitForValue,\n} from './lib/storage';\n\nexport {default, registerPlugin, registerInternalPlugin} from './webex-core';\n\nexport {default as WebexHttpError} from './lib/webex-http-error';\nexport {default as StatelessWebexPlugin} from './lib/stateless-webex-plugin';\nexport {default as WebexPlugin} from './lib/webex-plugin';\nexport {default as AuthInterceptor} from './interceptors/auth';\nexport {default as NetworkTimingInterceptor} from './interceptors/network-timing';\nexport {default as PayloadTransformerInterceptor} from './interceptors/payload-transformer';\nexport {default as RedirectInterceptor} from './interceptors/redirect';\nexport {default as ResponseLoggerInterceptor} from './interceptors/response-logger';\nexport {default as RequestEventInterceptor} from './interceptors/request-event';\nexport {default as RequestLoggerInterceptor} from './interceptors/request-logger';\nexport {default as RequestTimingInterceptor} from './interceptors/request-timing';\nexport {default as UserAgentInterceptor} from './interceptors/user-agent';\nexport {default as ProxyInterceptor} from './interceptors/proxy';\nexport {default as WebexTrackingIdInterceptor} from './interceptors/webex-tracking-id';\nexport {sequenceNumbers as webexTrackingIdSequenceNumbers} from './interceptors/webex-tracking-id';\nexport {default as WebexUserAgentInterceptor} from './interceptors/webex-user-agent';\nexport {default as RateLimitInterceptor} from './interceptors/rate-limit';\nexport {default as EmbargoInterceptor} from './interceptors/embargo';\nexport {default as DefaultOptionsInterceptor} from './interceptors/default-options';\nexport {default as HostMapInterceptor} from './lib/interceptors/hostmap';\nexport {default as ServiceInterceptor} from './lib/interceptors/service';\nexport {default as ServerErrorInterceptor} from './lib/interceptors/server-error';\n\nexport {default as Batcher} from './lib/batcher';\nexport {default as Page} from './lib/page';\nexport {default as config} from './config';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWAA,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AAaA,IAAAG,UAAA,GAAAH,OAAA;AAA8E,IAAAI,iBAAA,GAAAC,uBAAA,CAAAL,OAAA;AAAAM,OAAA,CAAAC,gBAAA,GAAAH,iBAAA;AAE9E,IAAAI,QAAA,GAAAR,OAAA;AAUA,IAAAS,UAAA,GAAAJ,uBAAA,CAAAL,OAAA;AAEA,IAAAU,eAAA,GAAAC,sBAAA,CAAAX,OAAA;AACA,IAAAY,qBAAA,GAAAD,sBAAA,CAAAX,OAAA;AACA,IAAAa,YAAA,GAAAF,sBAAA,CAAAX,OAAA;AACA,IAAAc,KAAA,GAAAH,sBAAA,CAAAX,OAAA;AACA,IAAAe,cAAA,GAAAJ,sBAAA,CAAAX,OAAA;AACA,IAAAgB,mBAAA,GAAAL,sBAAA,CAAAX,OAAA;AACA,IAAAiB,SAAA,GAAAN,sBAAA,CAAAX,OAAA;AACA,IAAAkB,eAAA,GAAAP,sBAAA,CAAAX,OAAA;AACA,IAAAmB,aAAA,GAAAR,sBAAA,CAAAX,OAAA;AACA,IAAAoB,cAAA,GAAAT,sBAAA,CAAAX,OAAA;AACA,IAAAqB,cAAA,GAAAV,sBAAA,CAAAX,OAAA;AACA,IAAAsB,UAAA,GAAAX,sBAAA,CAAAX,OAAA;AACA,IAAAuB,MAAA,GAAAZ,sBAAA,CAAAX,OAAA;AACA,IAAAwB,gBAAA,GAAAnB,uBAAA,CAAAL,OAAA;AAEA,IAAAyB,eAAA,GAAAd,sBAAA,CAAAX,OAAA;AACA,IAAA0B,UAAA,GAAAf,sBAAA,CAAAX,OAAA;AACA,IAAA2B,QAAA,GAAAhB,sBAAA,CAAAX,OAAA;AACA,IAAA4B,eAAA,GAAAjB,sBAAA,CAAAX,OAAA;AACA,IAAA6B,QAAA,GAAAlB,sBAAA,CAAAX,OAAA;AACA,IAAA8B,QAAA,GAAAnB,sBAAA,CAAAX,OAAA;AACA,IAAA+B,YAAA,GAAApB,sBAAA,CAAAX,OAAA;AAEA,IAAAgC,QAAA,GAAArB,sBAAA,CAAAX,OAAA;AACA,IAAAiC,KAAA,GAAAtB,sBAAA,CAAAX,OAAA;AACA,IAAAkC,OAAA,GAAAvB,sBAAA,CAAAX,OAAA;AAA2C,SAAAK,wBAAA8B,CAAA,EAAAC,CAAA,6BAAAC,QAAA,MAAAC,CAAA,OAAAD,QAAA,IAAAE,CAAA,OAAAF,QAAA,YAAAhC,uBAAA,YAAAA,wBAAA8B,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,gBAAAW,OAAA,CAAAX,CAAA,0BAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAM,GAAA,CAAAZ,CAAA,UAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,GAAAM,CAAA,CAAAQ,GAAA,CAAAd,CAAA,EAAAQ,CAAA,cAAAO,EAAA,IAAAf,CAAA,gBAAAe,EAAA,OAAAC,cAAA,CAAAC,IAAA,CAAAjB,CAAA,EAAAe,EAAA,OAAAR,CAAA,IAAAD,CAAA,GAAAY,sBAAA,KAAAC,gCAAA,CAAAnB,CAAA,EAAAe,EAAA,OAAAR,CAAA,CAAAM,GAAA,IAAAN,CAAA,CAAAO,GAAA,IAAAR,CAAA,CAAAE,CAAA,EAAAO,EAAA,EAAAR,CAAA,IAAAC,CAAA,CAAAO,EAAA,IAAAf,CAAA,CAAAe,EAAA,WAAAP,CAAA,KAAAR,CAAA,EAAAC,CAAA","ignoreList":[]}
+{"version":3,"names":["require","_credentials","_services","_servicesV","_serviceConstants","_interopRequireWildcard","exports","serviceConstants","_storage","_webexCore","_webexHttpError","_interopRequireDefault","_statelessWebexPlugin","_webexPlugin","_auth","_catalogUrl","_networkTiming","_payloadTransformer","_redirect","_responseLogger","_requestEvent","_requestLogger","_requestTiming","_userAgent","_proxy","_webexTrackingId","_webexUserAgent","_rateLimit","_embargo","_defaultOptions","_hostmap","_service","_serverError","_batcher","_page","_config","e","t","_WeakMap","r","n","__esModule","o","i","f","__proto__","default","_typeof","has","get","set","_t","hasOwnProperty","call","_Object$defineProperty","_Object$getOwnPropertyDescriptor"],"sources":["index.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n *\n * Services is currently a part of webex-core due to how the contents of\n * the original internal-plugin-services needed to be accessed when webex-core\n * is initialized. As a plugin outside of webex-core, it would initialize after\n * credentials, causing all requests prior to its initialization to fail\n * federation requirements, and instead send requests to the environmentally-\n * assigned urls.\n */\n\nimport './plugins/logger';\nimport './lib/credentials';\nimport './lib/services';\n\nexport {Credentials, filterScope, grantErrors, sortScope, Token} from './lib/credentials';\n\nexport {\n  ServiceCatalog,\n  ServiceRegistry,\n  ServiceState,\n  Services,\n  ServiceHost,\n  ServiceUrl,\n} from './lib/services';\n\nexport {ServiceCatalogV2, ServicesV2, ServiceDetail} from './lib/services-v2';\nexport * as serviceConstants from './lib/constants';\nexport {\n  makeWebexStore,\n  makeWebexPluginStore,\n  MemoryStoreAdapter,\n  NotFoundError,\n  persist,\n  StorageError,\n  waitForValue,\n} from './lib/storage';\n\nexport {default, registerPlugin, registerInternalPlugin} from './webex-core';\n\nexport {default as WebexHttpError} from './lib/webex-http-error';\nexport {default as StatelessWebexPlugin} from './lib/stateless-webex-plugin';\nexport {default as WebexPlugin} from './lib/webex-plugin';\nexport {default as AuthInterceptor} from './interceptors/auth';\nexport {default as CatalogUrlInterceptor} from './interceptors/catalog-url';\nexport {default as NetworkTimingInterceptor} from './interceptors/network-timing';\nexport {default as PayloadTransformerInterceptor} from './interceptors/payload-transformer';\nexport {default as RedirectInterceptor} from './interceptors/redirect';\nexport {default as ResponseLoggerInterceptor} from './interceptors/response-logger';\nexport {default as RequestEventInterceptor} from './interceptors/request-event';\nexport {default as RequestLoggerInterceptor} from './interceptors/request-logger';\nexport {default as RequestTimingInterceptor} from './interceptors/request-timing';\nexport {default as UserAgentInterceptor} from './interceptors/user-agent';\nexport {default as ProxyInterceptor} from './interceptors/proxy';\nexport {default as WebexTrackingIdInterceptor} from './interceptors/webex-tracking-id';\nexport {sequenceNumbers as webexTrackingIdSequenceNumbers} from './interceptors/webex-tracking-id';\nexport {default as WebexUserAgentInterceptor} from './interceptors/webex-user-agent';\nexport {default as RateLimitInterceptor} from './interceptors/rate-limit';\nexport {default as EmbargoInterceptor} from './interceptors/embargo';\nexport {default as DefaultOptionsInterceptor} from './interceptors/default-options';\nexport {default as HostMapInterceptor} from './lib/interceptors/hostmap';\nexport {default as ServiceInterceptor} from './lib/interceptors/service';\nexport {default as ServerErrorInterceptor} from './lib/interceptors/server-error';\n\nexport {default as Batcher} from './lib/batcher';\nexport {default as Page} from './lib/page';\nexport {default as config} from './config';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWAA,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AAaA,IAAAG,UAAA,GAAAH,OAAA;AAA8E,IAAAI,iBAAA,GAAAC,uBAAA,CAAAL,OAAA;AAAAM,OAAA,CAAAC,gBAAA,GAAAH,iBAAA;AAE9E,IAAAI,QAAA,GAAAR,OAAA;AAUA,IAAAS,UAAA,GAAAJ,uBAAA,CAAAL,OAAA;AAEA,IAAAU,eAAA,GAAAC,sBAAA,CAAAX,OAAA;AACA,IAAAY,qBAAA,GAAAD,sBAAA,CAAAX,OAAA;AACA,IAAAa,YAAA,GAAAF,sBAAA,CAAAX,OAAA;AACA,IAAAc,KAAA,GAAAH,sBAAA,CAAAX,OAAA;AACA,IAAAe,WAAA,GAAAJ,sBAAA,CAAAX,OAAA;AACA,IAAAgB,cAAA,GAAAL,sBAAA,CAAAX,OAAA;AACA,IAAAiB,mBAAA,GAAAN,sBAAA,CAAAX,OAAA;AACA,IAAAkB,SAAA,GAAAP,sBAAA,CAAAX,OAAA;AACA,IAAAmB,eAAA,GAAAR,sBAAA,CAAAX,OAAA;AACA,IAAAoB,aAAA,GAAAT,sBAAA,CAAAX,OAAA;AACA,IAAAqB,cAAA,GAAAV,sBAAA,CAAAX,OAAA;AACA,IAAAsB,cAAA,GAAAX,sBAAA,CAAAX,OAAA;AACA,IAAAuB,UAAA,GAAAZ,sBAAA,CAAAX,OAAA;AACA,IAAAwB,MAAA,GAAAb,sBAAA,CAAAX,OAAA;AACA,IAAAyB,gBAAA,GAAApB,uBAAA,CAAAL,OAAA;AAEA,IAAA0B,eAAA,GAAAf,sBAAA,CAAAX,OAAA;AACA,IAAA2B,UAAA,GAAAhB,sBAAA,CAAAX,OAAA;AACA,IAAA4B,QAAA,GAAAjB,sBAAA,CAAAX,OAAA;AACA,IAAA6B,eAAA,GAAAlB,sBAAA,CAAAX,OAAA;AACA,IAAA8B,QAAA,GAAAnB,sBAAA,CAAAX,OAAA;AACA,IAAA+B,QAAA,GAAApB,sBAAA,CAAAX,OAAA;AACA,IAAAgC,YAAA,GAAArB,sBAAA,CAAAX,OAAA;AAEA,IAAAiC,QAAA,GAAAtB,sBAAA,CAAAX,OAAA;AACA,IAAAkC,KAAA,GAAAvB,sBAAA,CAAAX,OAAA;AACA,IAAAmC,OAAA,GAAAxB,sBAAA,CAAAX,OAAA;AAA2C,SAAAK,wBAAA+B,CAAA,EAAAC,CAAA,6BAAAC,QAAA,MAAAC,CAAA,OAAAD,QAAA,IAAAE,CAAA,OAAAF,QAAA,YAAAjC,uBAAA,YAAAA,wBAAA+B,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,gBAAAW,OAAA,CAAAX,CAAA,0BAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAM,GAAA,CAAAZ,CAAA,UAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,GAAAM,CAAA,CAAAQ,GAAA,CAAAd,CAAA,EAAAQ,CAAA,cAAAO,EAAA,IAAAf,CAAA,gBAAAe,EAAA,OAAAC,cAAA,CAAAC,IAAA,CAAAjB,CAAA,EAAAe,EAAA,OAAAR,CAAA,IAAAD,CAAA,GAAAY,sBAAA,KAAAC,gCAAA,CAAAnB,CAAA,EAAAe,EAAA,OAAAR,CAAA,CAAAM,GAAA,IAAAN,CAAA,CAAAO,GAAA,IAAAR,CAAA,CAAAE,CAAA,EAAAO,EAAA,EAAAR,CAAA,IAAAC,CAAA,CAAAO,EAAA,IAAAf,CAAA,CAAAe,EAAA,WAAAP,CAAA,KAAAR,CAAA,EAAAC,CAAA","ignoreList":[]}

package/dist/interceptors/catalog-url.js

@@ -0,0 +1,87 @@
+"use strict";
+
+var _Reflect$construct = require("@babel/runtime-corejs2/core-js/reflect/construct");
+var _Object$defineProperty = require("@babel/runtime-corejs2/core-js/object/define-property");
+var _interopRequireDefault = require("@babel/runtime-corejs2/helpers/interopRequireDefault");
+_Object$defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+var _promise = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/promise"));
+var _classCallCheck2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/classCallCheck"));
+var _createClass2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/createClass"));
+var _possibleConstructorReturn2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/possibleConstructorReturn"));
+var _getPrototypeOf2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/getPrototypeOf"));
+var _inherits2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/inherits"));
+var _httpCore = require("@webex/http-core");
+function _callSuper(t, o, e) { return o = (0, _getPrototypeOf2.default)(o), (0, _possibleConstructorReturn2.default)(t, _isNativeReflectConstruct() ? _Reflect$construct(o, e || [], (0, _getPrototypeOf2.default)(t).constructor) : o.apply(t, e)); }
+function _isNativeReflectConstruct() { try { var t = !Boolean.prototype.valueOf.call(_Reflect$construct(Boolean, [], function () {})); } catch (t) {} return (_isNativeReflectConstruct = function _isNativeReflectConstruct() { return !!t; })(); } /*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+/**
+ * Validates that request URLs are in the service catalog.
+ * Prevents SSRF attacks by blocking requests to unknown hosts.
+ * @class
+ */
+var CatalogUrlInterceptor = exports.default = /*#__PURE__*/function (_Interceptor) {
+  function CatalogUrlInterceptor() {
+    (0, _classCallCheck2.default)(this, CatalogUrlInterceptor);
+    return _callSuper(this, CatalogUrlInterceptor, arguments);
+  }
+  (0, _inherits2.default)(CatalogUrlInterceptor, _Interceptor);
+  return (0, _createClass2.default)(CatalogUrlInterceptor, [{
+    key: "onRequest",
+    value:
+    /**
+     * @see {@link Interceptor#onRequest}
+     * @param {Object} options
+     * @returns {Object}
+     */
+    function onRequest(options) {
+      var _this$webex$internal;
+      if (options.service && !options.uri && !options.url) {
+        return _promise.default.resolve(options);
+      }
+      var url = options.uri || options.url;
+
+      // No URL to validate
+      if (!url) {
+        return _promise.default.resolve(options);
+      }
+
+      // Check if services plugin is available
+      if (!((_this$webex$internal = this.webex.internal) !== null && _this$webex$internal !== void 0 && _this$webex$internal.services)) {
+        var _this$webex$logger, _this$webex$logger$wa;
+        // Services not loaded yet - allow but log
+        (_this$webex$logger = this.webex.logger) === null || _this$webex$logger === void 0 ? void 0 : (_this$webex$logger$wa = _this$webex$logger.warn) === null || _this$webex$logger$wa === void 0 ? void 0 : _this$webex$logger$wa.call(_this$webex$logger, "catalog-url: Cannot validate URL (services not loaded): ".concat(url));
+        return _promise.default.resolve(options);
+      }
+      var services = this.webex.internal.services;
+
+      // Check if URL is in service catalog
+      if (services.getServiceFromUrl(url)) {
+        return _promise.default.resolve(options);
+      }
+
+      // Honor allowedDomains (same policy as auth interceptor)
+      if (services.validateDomains && services.hasAllowedDomains() && services.isAllowedDomainUrl(url)) {
+        return _promise.default.resolve(options);
+      }
+
+      // URL not in catalog or allowed domains - block the request
+      return _promise.default.reject(new Error("Request blocked: URL not in service catalog or allowed domains: ".concat(url, ".")));
+    }
+  }], [{
+    key: "create",
+    value:
+    /**
+     * @returns {CatalogUrlInterceptor}
+     */
+    function create() {
+      return new CatalogUrlInterceptor({
+        webex: this
+      });
+    }
+  }]);
+}(_httpCore.Interceptor);
+//# sourceMappingURL=catalog-url.js.map

package/dist/interceptors/catalog-url.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_httpCore","require","_callSuper","t","o","e","_getPrototypeOf2","default","_possibleConstructorReturn2","_isNativeReflectConstruct","_Reflect$construct","constructor","apply","Boolean","prototype","valueOf","call","CatalogUrlInterceptor","exports","_Interceptor","_classCallCheck2","arguments","_inherits2","_createClass2","key","value","onRequest","options","_this$webex$internal","service","uri","url","_promise","resolve","webex","internal","services","_this$webex$logger","_this$webex$logger$wa","logger","warn","concat","getServiceFromUrl","validateDomains","hasAllowedDomains","isAllowedDomainUrl","reject","Error","create","Interceptor"],"sources":["catalog-url.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport {Interceptor} from '@webex/http-core';\n\n/**\n * Validates that request URLs are in the service catalog.\n * Prevents SSRF attacks by blocking requests to unknown hosts.\n * @class\n */\nexport default class CatalogUrlInterceptor extends Interceptor {\n  /**\n   * @returns {CatalogUrlInterceptor}\n   */\n  static create() {\n    return new CatalogUrlInterceptor({webex: this});\n  }\n\n  /**\n   * @see {@link Interceptor#onRequest}\n   * @param {Object} options\n   * @returns {Object}\n   */\n  onRequest(options) {\n    if (options.service && !options.uri && !options.url) {\n      return Promise.resolve(options);\n    }\n\n    const url = options.uri || options.url;\n\n    // No URL to validate\n    if (!url) {\n      return Promise.resolve(options);\n    }\n\n    // Check if services plugin is available\n    if (!this.webex.internal?.services) {\n      // Services not loaded yet - allow but log\n      this.webex.logger?.warn?.(`catalog-url: Cannot validate URL (services not loaded): ${url}`);\n\n      return Promise.resolve(options);\n    }\n\n    const {services} = this.webex.internal;\n\n    // Check if URL is in service catalog\n    if (services.getServiceFromUrl(url)) {\n      return Promise.resolve(options);\n    }\n\n    // Honor allowedDomains (same policy as auth interceptor)\n    if (\n      services.validateDomains &&\n      services.hasAllowedDomains() &&\n      services.isAllowedDomainUrl(url)\n    ) {\n      return Promise.resolve(options);\n    }\n\n    // URL not in catalog or allowed domains - block the request\n    return Promise.reject(\n      new Error(`Request blocked: URL not in service catalog or allowed domains: ${url}.`)\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAIA,IAAAA,SAAA,GAAAC,OAAA;AAA6C,SAAAC,WAAAC,CAAA,EAAAC,CAAA,EAAAC,CAAA,WAAAD,CAAA,OAAAE,gBAAA,CAAAC,OAAA,EAAAH,CAAA,OAAAI,2BAAA,CAAAD,OAAA,EAAAJ,CAAA,EAAAM,yBAAA,KAAAC,kBAAA,CAAAN,CAAA,EAAAC,CAAA,YAAAC,gBAAA,CAAAC,OAAA,EAAAJ,CAAA,EAAAQ,WAAA,IAAAP,CAAA,CAAAQ,KAAA,CAAAT,CAAA,EAAAE,CAAA;AAAA,SAAAI,0BAAA,cAAAN,CAAA,IAAAU,OAAA,CAAAC,SAAA,CAAAC,OAAA,CAAAC,IAAA,CAAAN,kBAAA,CAAAG,OAAA,iCAAAV,CAAA,aAAAM,yBAAA,YAAAA,0BAAA,aAAAN,CAAA,UAJ7C;AACA;AACA;AAIA;AACA;AACA;AACA;AACA;AAJA,IAKqBc,qBAAqB,GAAAC,OAAA,CAAAX,OAAA,0BAAAY,YAAA;EAAA,SAAAF,sBAAA;IAAA,IAAAG,gBAAA,CAAAb,OAAA,QAAAU,qBAAA;IAAA,OAAAf,UAAA,OAAAe,qBAAA,EAAAI,SAAA;EAAA;EAAA,IAAAC,UAAA,CAAAf,OAAA,EAAAU,qBAAA,EAAAE,YAAA;EAAA,WAAAI,aAAA,CAAAhB,OAAA,EAAAU,qBAAA;IAAAO,GAAA;IAAAC,KAAA;IAQxC;AACF;AACA;AACA;AACA;IACE,SAAAC,SAASA,CAACC,OAAO,EAAE;MAAA,IAAAC,oBAAA;MACjB,IAAID,OAAO,CAACE,OAAO,IAAI,CAACF,OAAO,CAACG,GAAG,IAAI,CAACH,OAAO,CAACI,GAAG,EAAE;QACnD,OAAOC,QAAA,CAAAzB,OAAA,CAAQ0B,OAAO,CAACN,OAAO,CAAC;MACjC;MAEA,IAAMI,GAAG,GAAGJ,OAAO,CAACG,GAAG,IAAIH,OAAO,CAACI,GAAG;;MAEtC;MACA,IAAI,CAACA,GAAG,EAAE;QACR,OAAOC,QAAA,CAAAzB,OAAA,CAAQ0B,OAAO,CAACN,OAAO,CAAC;MACjC;;MAEA;MACA,IAAI,GAAAC,oBAAA,GAAC,IAAI,CAACM,KAAK,CAACC,QAAQ,cAAAP,oBAAA,eAAnBA,oBAAA,CAAqBQ,QAAQ,GAAE;QAAA,IAAAC,kBAAA,EAAAC,qBAAA;QAClC;QACA,CAAAD,kBAAA,OAAI,CAACH,KAAK,CAACK,MAAM,cAAAF,kBAAA,wBAAAC,qBAAA,GAAjBD,kBAAA,CAAmBG,IAAI,cAAAF,qBAAA,uBAAvBA,qBAAA,CAAAtB,IAAA,CAAAqB,kBAAA,6DAAAI,MAAA,CAAqFV,GAAG,CAAE,CAAC;QAE3F,OAAOC,QAAA,CAAAzB,OAAA,CAAQ0B,OAAO,CAACN,OAAO,CAAC;MACjC;MAEA,IAAOS,QAAQ,GAAI,IAAI,CAACF,KAAK,CAACC,QAAQ,CAA/BC,QAAQ;;MAEf;MACA,IAAIA,QAAQ,CAACM,iBAAiB,CAACX,GAAG,CAAC,EAAE;QACnC,OAAOC,QAAA,CAAAzB,OAAA,CAAQ0B,OAAO,CAACN,OAAO,CAAC;MACjC;;MAEA;MACA,IACES,QAAQ,CAACO,eAAe,IACxBP,QAAQ,CAACQ,iBAAiB,CAAC,CAAC,IAC5BR,QAAQ,CAACS,kBAAkB,CAACd,GAAG,CAAC,EAChC;QACA,OAAOC,QAAA,CAAAzB,OAAA,CAAQ0B,OAAO,CAACN,OAAO,CAAC;MACjC;;MAEA;MACA,OAAOK,QAAA,CAAAzB,OAAA,CAAQuC,MAAM,CACnB,IAAIC,KAAK,oEAAAN,MAAA,CAAoEV,GAAG,MAAG,CACrF,CAAC;IACH;EAAC;IAAAP,GAAA;IAAAC,KAAA;IApDD;AACF;AACA;IACE,SAAOuB,MAAMA,CAAA,EAAG;MACd,OAAO,IAAI/B,qBAAqB,CAAC;QAACiB,KAAK,EAAE;MAAI,CAAC,CAAC;IACjD;EAAC;AAAA,EANgDe,qBAAW","ignoreList":[]}

package/dist/lib/batcher.js

@@ -302,7 +302,7 @@ var Batcher = _webexPlugin.default.extend({
   fingerprintResponse: function fingerprintResponse(item) {
     throw new Error('fingerprintResponse() must be implemented');
   },
-  version: "3.12.0-next.44"
+  version: "3.12.0-next.46"
 });
 var _default2 = exports.default = Batcher;
 //# sourceMappingURL=batcher.js.map

package/dist/lib/credentials/credentials.js

@@ -1,6 +1,10 @@
 "use strict";
 
 var _typeof = require("@babel/runtime-corejs2/helpers/typeof");
+var _Array$from = require("@babel/runtime-corejs2/core-js/array/from");
+var _Symbol = require("@babel/runtime-corejs2/core-js/symbol");
+var _Symbol$iterator = require("@babel/runtime-corejs2/core-js/symbol/iterator");
+var _Array$isArray = require("@babel/runtime-corejs2/core-js/array/is-array");
 var _Object$keys2 = require("@babel/runtime-corejs2/core-js/object/keys");
 var _Object$getOwnPropertySymbols = require("@babel/runtime-corejs2/core-js/object/get-own-property-symbols");
 var _Object$getOwnPropertyDescriptor2 = require("@babel/runtime-corejs2/core-js/object/get-own-property-descriptor");
@@ -20,6 +24,7 @@ var _promise = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/pr
 var _now = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/date/now"));
 var _getOwnPropertyDescriptor = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/object/get-own-property-descriptor"));
 var _defineProperty2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/defineProperty"));
+var _toConsumableArray2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/toConsumableArray"));
 var _applyDecoratedDescriptor2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/applyDecoratedDescriptor"));
 var _querystring = _interopRequireDefault(require("querystring"));
 var _url = _interopRequireDefault(require("url"));
@@ -41,6 +46,9 @@ var _dec, _dec2, _dec3, _dec4, _dec5, _dec6, _obj;
 function _interopRequireWildcard(e, t) { if ("function" == typeof _WeakMap) var r = new _WeakMap(), n = new _WeakMap(); return (_interopRequireWildcard = function _interopRequireWildcard(e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != _typeof(e) && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (var _t in e) "default" !== _t && {}.hasOwnProperty.call(e, _t) && ((i = (o = _Object$defineProperty) && _Object$getOwnPropertyDescriptor2(e, _t)) && (i.get || i.set) ? o(f, _t, i) : f[_t] = e[_t]); return f; })(e, t); }
 function ownKeys(e, r) { var t = _Object$keys2(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return _Object$getOwnPropertyDescriptor2(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor2(t, r)); }); } return e; }
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof _Symbol && r[_Symbol$iterator] || r["@@iterator"]; if (!t) { if (_Array$isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? _Array$from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 /**
  * @class
  */
@@ -219,6 +227,53 @@ var Credentials = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
     // Return the token section that contains the OrgId.
     return fields[2];
   },
+  /**
+   * Extract the CI user ID [cis_uuid] from a provided token.
+   *
+   * @private
+   * @param {string} token - The access token to extract the user ID from.
+   * @throws {Error} - If the token cannot be parsed or does not contain a user ID.
+   * @returns {string} - The CI user ID.
+   */
+  extractUserIdFromToken: function extractUserIdFromToken() {
+    var token = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : '';
+    // User tokens are JWT-like; the middle section holds a base64-encoded JSON payload.
+    var payload = JSON.parse(_common.base64.decode(token.split('.')[1]));
+    if (!payload.cis_uuid) {
+      throw new Error('the provided token does not contain a user ID');
+    }
+    return payload.cis_uuid;
+  },
+  /**
+   * Get the CI user ID [cis_uuid] of the currently authenticated user.
+   *
+   * Checks the supertoken first, then falls back to any stored user tokens.
+   *
+   * @throws {Error} - If the user ID could not be determined from any token.
+   * @returns {string} - The CI user ID.
+   */
+  getUserId: function getUserId() {
+    var tokens = [this.supertoken].concat((0, _toConsumableArray2.default)(this.userTokens.models));
+    var _iterator = _createForOfIteratorHelper(tokens),
+      _step;
+    try {
+      for (_iterator.s(); !(_step = _iterator.n()).done;) {
+        var token = _step.value;
+        if (token && token.access_token) {
+          try {
+            return this.extractUserIdFromToken(token.access_token);
+          } catch (_unused2) {
+            // token wasn't parseable or lacked a user ID; try the next one
+          }
+        }
+      }
+    } catch (err) {
+      _iterator.e(err);
+    } finally {
+      _iterator.f();
+    }
+    throw new Error('could not extract the user ID from any available token');
+  },
   /**
    * Generates a Third-Party Login URL pointing at IdBroker's
    * `/idb/ThirdPartyLogin` endpoint. Used by the social-provider sign-in
@@ -600,7 +655,7 @@ var Credentials = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       this.refresh();
     }
   },
-  version: "3.12.0-next.44"
+  version: "3.12.0-next.46"
 }, (0, _applyDecoratedDescriptor2.default)(_obj, "getUserToken", [_dec, _dec2], (0, _getOwnPropertyDescriptor.default)(_obj, "getUserToken"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "initialize", [_dec3], (0, _getOwnPropertyDescriptor.default)(_obj, "initialize"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "invalidate", [_common.oneFlight, _dec4], (0, _getOwnPropertyDescriptor.default)(_obj, "invalidate"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "refresh", [_common.oneFlight, _dec5, _dec6], (0, _getOwnPropertyDescriptor.default)(_obj, "refresh"), _obj), _obj));
 var _default = exports.default = Credentials;
 //# sourceMappingURL=credentials.js.map

package/dist/lib/credentials/credentials.js.map

@@ -1 +1 @@
-{"version":3,"names":["_querystring","_interopRequireDefault","require","_url","_jsonwebtoken","_common","_commonTimers","_lodash","_webexPlugin","_decorators","_grantErrors","_interopRequireWildcard","_scope","_token","_tokenCollection","_constants","_dec","_dec2","_dec3","_dec4","_dec5","_dec6","_obj","e","t","_WeakMap","r","n","__esModule","o","i","f","__proto__","default","_typeof","has","get","set","_t","hasOwnProperty","call","_Object$defineProperty","_Object$getOwnPropertyDescriptor2","ownKeys","_Object$keys2","_Object$getOwnPropertySymbols","filter","enumerable","push","apply","_objectSpread","arguments","length","Object","forEach","_defineProperty2","_Object$getOwnPropertyDescriptors","_Object$defineProperties","Credentials","WebexPlugin","extend","oneFlight","keyFactory","scope","waitForValue","persist","whileInFlight","collections","userTokens","TokenCollection","dataTypes","token","makeStateDataType","Token","dataType","derived","canAuthorize","deps","fn","Boolean","supertoken","canRefresh","config","jwtRefreshCallback","isUnverifiedGuest","isGuest","JSON","parse","base64","decode","access_token","split","user_type","_unused","props","prop","namespace","session","isRefreshing","type","ready","refreshTimer","undefined","buildLoginUrl","options","clientType","state","isObject","Error","client_id","redirect_uri","cloneDeep","response_type","_deleteProperty","isEmpty","encodeState","concat","authorizeUrl","querystring","stringify","getOrgId","logger","info","extractOrgIdFromJWT","_this$supertoken","extractOrgIdFromUserToken","decodedJWT","jwt","realm","fields","buildThirdPartyLoginUrl","oauth2provider","returnURL","query","thirdPartyLoginUrl","buildLogoutUrl","logoutUrl","cisService","service","goto","calcRefreshTimeout","expiration","Math","floor","random","constructor","_this","_dataTypes","_keys","key","bind","_len","args","Array","_key","_apply","downscope","_this2","catch","reason","_reason$body","failReason","body","warn","trace","webex","internal","metrics","submitClientMetrics","METRICS","JS_SDK_CREDENTIALS_DOWNSCOPE_FAILED","requestedScope","_promise","resolve","serialize","parent","getClientToken","_this3","request","method","uri","tokenUrl","form","grant_type","self_contained_token","auth","user","pass","client_secret","sendImmediately","shouldRefreshAccessToken","then","res","statusCode","reject","ErrorConstructor","grantErrors","select","error","_res","getUserToken","_this4","once","filterScope","sortScope","tap","add","initialize","attrs","_this5","authorization","expires","scheduleRefresh","prototype","listenToOnce","authorizationString","parsed","url","href","substr","indexOf","invalidate","clearTimeout","unset","err","models","remove","refresh","_this6","tokens","clone","requestAccessTokenFromJwt","services","updateCredentialsConfig","OAuthError","trigger","st","invalidScopes","diffScopes","JS_SDK_CREDENTIALS_TOKEN_REFRESH_SCOPE_MISMATCH","all","map","tokenScope","revoke","_this7","expiresIn","_now","timeoutLength","safeSetTimeout","version","_applyDecoratedDescriptor2","_getOwnPropertyDescriptor","_default","exports"],"sources":["credentials.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport jwt from 'jsonwebtoken';\nimport {base64, encodeState, makeStateDataType, oneFlight, tap, whileInFlight} from '@webex/common';\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {clone, cloneDeep, isObject, isEmpty} from 'lodash';\n\nimport WebexPlugin from '../webex-plugin';\nimport {persist, waitForValue} from '../storage/decorators';\n\nimport grantErrors, {OAuthError} from './grant-errors';\nimport {filterScope, diffScopes, sortScope} from './scope';\nimport Token from './token';\nimport TokenCollection from './token-collection';\nimport {METRICS} from '../constants';\n\n/**\n * @class\n */\nconst Credentials = WebexPlugin.extend({\n  collections: {\n    userTokens: TokenCollection,\n  },\n\n  dataTypes: {\n    token: makeStateDataType(Token, 'token').dataType,\n  },\n\n  derived: {\n    canAuthorize: {\n      deps: ['supertoken', 'supertoken.canAuthorize', 'canRefresh'],\n      fn() {\n        return Boolean((this.supertoken && this.supertoken.canAuthorize) || this.canRefresh);\n      },\n    },\n    canRefresh: {\n      deps: ['supertoken', 'supertoken.canRefresh'],\n      fn() {\n        // If we're operating in JWT mode, we have to delegate to the consumer\n        if (this.config.jwtRefreshCallback) {\n          return true;\n        }\n\n        return Boolean(this.supertoken && this.supertoken.canRefresh);\n      },\n    },\n    isUnverifiedGuest: {\n      deps: ['supertoken'],\n      /**\n       * Returns true if the user is an unverified guest\n       * @returns {boolean}\n       */\n      fn() {\n        let isGuest = false;\n        try {\n          isGuest =\n            JSON.parse(base64.decode(this.supertoken.access_token.split('.')[1])).user_type ===\n            'guest';\n        } catch {\n          /* the non-guest token is formatted differently so catch is expected */\n        }\n\n        return isGuest;\n      },\n    },\n  },\n\n  props: {\n    supertoken: makeStateDataType(Token, 'token').prop,\n  },\n\n  namespace: 'Credentials',\n\n  session: {\n    isRefreshing: {\n      default: false,\n      type: 'boolean',\n    },\n    /**\n     * Becomes `true` once the {@link loaded} event fires.\n     * @see {@link WebexPlugin#ready}\n     * @instance\n     * @memberof Credentials\n     * @type {boolean}\n     */\n    ready: {\n      default: false,\n      type: 'boolean',\n    },\n    refreshTimer: {\n      default: undefined,\n      type: 'any',\n    },\n  },\n\n  /**\n   * Generates an OAuth Login URL. Prefers the api.ciscospark.com proxy if the\n   * instance is initialize with an authorizatUrl, but fallsback to idbroker\n   * as the base otherwise.\n   * @instance\n   * @memberof Credentials\n   * @param {Object} [options={}]\n   * @returns {string}\n   */\n  buildLoginUrl(options = {clientType: 'public'}) {\n    /* eslint-disable camelcase */\n    if (options.state !== undefined && !isObject(options.state)) {\n      throw new Error('if specified, `options.state` must be an object');\n    }\n\n    options.client_id = this.config.client_id;\n    options.redirect_uri = this.config.redirect_uri;\n    options.scope = this.config.scope;\n\n    options = cloneDeep(options);\n\n    if (!options.response_type) {\n      options.response_type = options.clientType === 'public' ? 'token' : 'code';\n    }\n    Reflect.deleteProperty(options, 'clientType');\n\n    if (options.state) {\n      if (!isEmpty(options.state)) {\n        options.state = encodeState(options.state);\n      } else {\n        delete options.state;\n      }\n    }\n\n    return `${this.config.authorizeUrl}?${querystring.stringify(options)}`;\n    /* eslint-enable camelcase */\n  },\n\n  /**\n   * Get the determined OrgId.\n   *\n   * @throws {Error} - If the OrgId could not be determined.\n   * @returns {string} - The OrgId.\n   */\n  getOrgId() {\n    this.logger.info('credentials: attempting to retrieve the OrgId from token');\n\n    try {\n      // Attempt to extract a client-authenticated token's OrgId.\n      this.logger.info('credentials: trying to extract OrgId from JWT');\n\n      return this.extractOrgIdFromJWT(this.supertoken.access_token);\n    } catch (e) {\n      // Attempt to extract a user token's OrgId.\n      this.logger.info('credentials: could not extract OrgId from JWT');\n      this.logger.info('credentials: attempting to extract OrgId from user token');\n\n      try {\n        return this.extractOrgIdFromUserToken(this.supertoken?.access_token);\n      } catch (f) {\n        this.logger.info('credentials: could not extract OrgId from user token');\n        throw f;\n      }\n    }\n  },\n\n  /**\n   * Extract the OrgId [realm] from a provided JWT.\n   *\n   * @private\n   * @param {string} token - The JWT to extract the OrgId from.\n   * @throws {Error} - If the token does not pass JWT general/realm validation.\n   * @returns {string} - The OrgId.\n   */\n  extractOrgIdFromJWT(token = '') {\n    // Decoded the provided token.\n    const decodedJWT = jwt.decode(token);\n\n    // Validate that the provided token is a JWT.\n    if (!decodedJWT) {\n      throw new Error('unable to extract the OrgId from the provided JWT');\n    }\n\n    if (!decodedJWT.realm) {\n      throw new Error('the provided JWT does not contain an OrgId');\n    }\n\n    // Return the OrgId [realm].\n    return decodedJWT.realm;\n  },\n\n  /**\n   * Extract the OrgId [realm] from a provided user token.\n   *\n   * @private\n   * @param {string} token - The user token to extract the OrgId from.\n   * @throws {Error} - Will throw an error if the provided token is invalid.\n   * @returns {string} - The OrgId.\n   */\n  extractOrgIdFromUserToken(token = '') {\n    // Split the provided token into subsections.\n    const fields = token.split('_');\n\n    // Validate that the provided token has the proper amount of sections.\n    if (fields.length !== 3) {\n      throw new Error(\n        `the provided token is not a valid format, token has ${fields.length} sections`\n      );\n    }\n\n    // Return the token section that contains the OrgId.\n    return fields[2];\n  },\n\n  /**\n   * Generates a Third-Party Login URL pointing at IdBroker's\n   * `/idb/ThirdPartyLogin` endpoint. Used by the social-provider sign-in\n   * flow (Google / Microsoft / Apple / ...).\n   *\n   * Mirrors `buildLoginUrl` / `buildLogoutUrl` — pure URL construction,\n   * no navigation side effects. Reads from `this.config.thirdPartyLoginUrl`,\n   * which is derived from `idbroker.url` in `credentials-config.js`.\n   *\n   * @instance\n   * @memberof Credentials\n   * @param {Object} options\n   * @param {string} options.oauth2provider - Provider name (`google`,\n   *   `microsoft`, `apple`, ...). Required.\n   * @param {string} options.returnURL - URL IdBroker should send the user\n   *   back to after the third-party hand-off. Required.\n   * @param {Object} [options.state] - Optional state object. When non-empty\n   *   it is JSON-stringified and base64url-encoded, then emitted as the\n   *   top-level `state` query param so IdBroker can echo it back unchanged\n   *   on the callback (mirrors `buildLoginUrl`).\n   * @returns {string}\n   */\n  buildThirdPartyLoginUrl(options = {}) {\n    const {oauth2provider, returnURL, state} = options;\n\n    if (!oauth2provider) {\n      throw new Error('`options.oauth2provider` is required');\n    }\n    if (!returnURL) {\n      throw new Error('`options.returnURL` is required');\n    }\n    if (state !== undefined && !isObject(state)) {\n      throw new Error('if specified, `options.state` must be an object');\n    }\n\n    const query = {\n      oauth2provider,\n      returnURL,\n    };\n\n    if (state && !isEmpty(state)) {\n      query.state = encodeState(state);\n    }\n\n    return `${this.config.thirdPartyLoginUrl}?${querystring.stringify(query)}`;\n  },\n\n  /**\n   * Generates a Logout URL\n   * @instance\n   * @memberof Credentials\n   * @param {Object} [options={}]\n   * @returns {[type]}\n   */\n  buildLogoutUrl(options = {}) {\n    return `${this.config.logoutUrl}?${querystring.stringify({\n      cisService: this.config.service,\n      goto: this.config.redirect_uri,\n      ...options,\n    })}`;\n  },\n\n  /**\n   * Generates a number between 60% - 90% of expired value\n   * @instance\n   * @memberof Credentials\n   * @param {number} expiration\n   * @private\n   * @returns {number}\n   */\n  calcRefreshTimeout(expiration) {\n    return Math.floor(((Math.floor(Math.random() * 4) + 6) / 10) * expiration);\n  },\n\n  constructor(...args) {\n    // HACK to deal with the fact that AmpersandState#dataTypes#set is a pure\n    // function.\n    this._dataTypes = cloneDeep(this._dataTypes);\n    Object.keys(this._dataTypes).forEach((key) => {\n      if (this._dataTypes[key].set) {\n        this._dataTypes[key].set = this._dataTypes[key].set.bind(this);\n      }\n    });\n    // END HACK\n    Reflect.apply(WebexPlugin, this, args);\n  },\n\n  /**\n   * Downscopes a token\n   * @instance\n   * @memberof Credentials\n   * @param {string} scope\n   * @private\n   * @returns {Promise<Token>}\n   */\n  downscope(scope) {\n    return this.supertoken.downscope(scope).catch((reason) => {\n      const failReason = reason?.body ?? reason;\n      this.logger.warn(`credentials: failed to downscope supertoken to \"${scope}\"`, failReason);\n      this.logger.trace(`credentials: falling back to supertoken for ${scope}`);\n      this.webex.internal.metrics.submitClientMetrics(METRICS.JS_SDK_CREDENTIALS_DOWNSCOPE_FAILED, {\n        fields: {\n          requestedScope: scope,\n          failReason,\n        },\n      });\n\n      return Promise.resolve(new Token({scope, ...this.supertoken.serialize()}), {\n        parent: this,\n      });\n    });\n  },\n\n  /**\n   * Requests a client credentials grant and returns the token. Given the\n   * limited use for such tokens as this time, this method does not cache its\n   * token.\n   * @instance\n   * @memberof Credentials\n   * @param {Object} options\n   * @returns {Promise<Token>}\n   */\n  getClientToken(options = {}) {\n    this.logger.info('credentials: requesting client credentials grant');\n\n    return this.webex\n      .request({\n        /* eslint-disable camelcase */\n        method: 'POST',\n        uri: options.uri || this.config.tokenUrl,\n        form: {\n          grant_type: 'client_credentials',\n          scope: options.scope || 'webexsquare:admin',\n          self_contained_token: true,\n        },\n        auth: {\n          user: this.config.client_id,\n          pass: this.config.client_secret,\n          sendImmediately: true,\n        },\n        shouldRefreshAccessToken: false,\n        /* eslint-enable camelcase */\n      })\n      .then((res) => new Token(res.body, {parent: this}))\n      .catch((res) => {\n        if (res.statusCode !== 400) {\n          return Promise.reject(res);\n        }\n\n        const ErrorConstructor = grantErrors.select(res.body.error);\n\n        return Promise.reject(new ErrorConstructor(res._res || res));\n      });\n  },\n\n  @oneFlight({keyFactory: (scope) => scope})\n  @waitForValue('@')\n  /**\n   * Resolves with a token with the specified scopes. If no scope is specified,\n   * defaults to omit(webex.credentials.scope, 'spark:kms'). If no such token is\n   * available, downscopes the supertoken to that scope.\n   * @instance\n   * @memberof Credentials\n   * @param {string} scope\n   * @returns {Promise<Token>}\n   */\n  getUserToken(scope) {\n    return Promise.resolve(\n      !this.isRefreshing ||\n        new Promise((resolve) => {\n          this.logger.info(\n            'credentials: token refresh inflight; delaying getUserToken until refresh completes'\n          );\n          this.once('change:isRefreshing', () => {\n            this.logger.info('credentials: token refresh complete; reinvoking getUserToken');\n            resolve();\n          });\n        })\n    ).then(() => {\n      if (!this.canAuthorize) {\n        this.logger.info('credentials: cannot produce an access token from current state');\n\n        return Promise.reject(new Error('Current state cannot produce an access token'));\n      }\n\n      if (!scope) {\n        scope = filterScope('spark:kms', this.supertoken.scope);\n      }\n\n      scope = sortScope(scope);\n\n      if (scope === sortScope(this.supertoken.scope)) {\n        return Promise.resolve(this.supertoken);\n      }\n\n      const token = this.userTokens.get(scope);\n\n      // we should also check for the token.access_token since token object does\n      // not get cleared on unsetting while logging out.\n      if (!token || !token.access_token) {\n        return this.downscope(scope).then(tap((t) => this.userTokens.add(t)));\n      }\n\n      return Promise.resolve(token);\n    });\n  },\n\n  @persist('@')\n  /**\n   * Initializer\n   * @instance\n   * @memberof Credentials\n   * @param {Object} attrs\n   * @param {Object} options\n   * @private\n   * @returns {Credentials}\n   */\n  initialize(attrs, options) {\n    if (attrs) {\n      if (typeof attrs === 'string') {\n        this.supertoken = attrs;\n      }\n\n      if (attrs.access_token) {\n        this.supertoken = attrs;\n      }\n\n      if (attrs.authorization) {\n        if (attrs.authorization.supertoken) {\n          this.supertoken = attrs.authorization.supertoken;\n        } else {\n          this.supertoken = attrs.authorization;\n        }\n      }\n\n      // schedule refresh\n      if (this.supertoken && this.supertoken.expires) {\n        this.scheduleRefresh(this.supertoken.expires);\n      }\n    }\n\n    Reflect.apply(WebexPlugin.prototype.initialize, this, [attrs, options]);\n\n    this.listenToOnce(this.parent, 'change:config', () => {\n      if (this.config.authorizationString) {\n        const parsed = url.parse(this.config.authorizationString, true);\n\n        /* eslint-disable camelcase */\n        this.config.client_id = parsed.query.client_id;\n        this.config.redirect_uri = parsed.query.redirect_uri;\n        this.config.scope = parsed.query.scope;\n        this.config.authorizeUrl = parsed.href.substr(0, parsed.href.indexOf('?'));\n        /* eslint-enable camelcase */\n      }\n    });\n\n    this.webex.once('loaded', () => {\n      this.ready = true;\n    });\n  },\n\n  @oneFlight\n  @waitForValue('@')\n  /**\n   * Clears all tokens from store them from the stores.\n   *\n   * This is no longer quite the right name for this method, but all of the\n   * alternatives I'm coming up with are already taken.\n   * @instance\n   * @memberof Credentials\n   * @returns {Promise}\n   */\n  invalidate() {\n    this.logger.info('credentials: invalidating tokens');\n\n    // clear refresh timer\n    if (this.refreshTimer) {\n      clearTimeout(this.refreshTimer);\n      this.unset('refreshTimer');\n    }\n\n    try {\n      this.unset('supertoken');\n    } catch (err) {\n      this.logger.warn('credentials: failed to clear supertoken', err);\n    }\n\n    while (this.userTokens.models.length) {\n      try {\n        this.userTokens.remove(this.userTokens.models[0]);\n      } catch (err) {\n        this.logger.warn('credentials: failed to remove user token', err);\n      }\n    }\n\n    this.logger.info('credentials: finished removing tokens');\n\n    // Return a promise to give the storage layer a tick or two to clear\n    // localStorage\n    return Promise.resolve();\n  },\n\n  @oneFlight\n  @whileInFlight('isRefreshing')\n  @waitForValue('@')\n  /**\n   * Removes the supertoken and child tokens, then refreshes the supertoken;\n   * subsequent calls to {@link Credentials#getUserToken()} will re-downscope\n   * child tokens. Enqueus revocation of previous previousTokens. Yes, that's\n   * the correct number of \"previous\"es.\n   * @instance\n   * @memberof Credentials\n   * @returns {Promise}\n   */\n  refresh() {\n    this.logger.info('credentials: refresh requested');\n\n    const {supertoken} = this;\n    const tokens = clone(this.userTokens.models);\n\n    // This is kind of a leaky abstraction, since it relies on the authorization\n    // plugin, but the only alternatives I see are\n    // 1. put all JWT support in core\n    // 2. have separate jwt and non-jwt auth plugins\n    // while I like #2 from a code simplicity standpoint, the third-party DX\n    // isn't great\n    if (this.config.jwtRefreshCallback) {\n      return (\n        this.config\n          .jwtRefreshCallback(this.webex)\n          // eslint-disable-next-line no-shadow\n          .then((jwt) => this.webex.authorization.requestAccessTokenFromJwt({jwt}))\n      );\n    }\n\n    if (this.webex.internal.services) {\n      this.webex.internal.services.updateCredentialsConfig();\n    }\n\n    return supertoken\n      .refresh()\n      .catch((error) => {\n        if (error instanceof OAuthError) {\n          // Error: super token refresh failed with 400 status code.\n          // Hence emit an event to the client, an opportunity to logout.\n          this.unset('supertoken');\n          while (this.userTokens.models.length) {\n            try {\n              this.userTokens.remove(this.userTokens.models[0]);\n            } catch (err) {\n              this.logger.warn('credentials: failed to remove user token', err);\n            }\n          }\n          this.webex.trigger('client:InvalidRequestError');\n        }\n\n        return Promise.reject(error);\n      })\n      .then((st) => {\n        // clear refresh timer\n        if (this.refreshTimer) {\n          clearTimeout(this.refreshTimer);\n          this.unset('refreshTimer');\n        }\n        this.supertoken = st;\n\n        const invalidScopes = diffScopes(this.config.scope, st.scope);\n\n        if (invalidScopes !== '') {\n          this.logger.warn(\n            `credentials: \"${invalidScopes}\" scope(s) are invalid because not listed in the supertoken, they will be excluded from user token requests.`\n          );\n          this.webex.internal.metrics.submitClientMetrics(\n            METRICS.JS_SDK_CREDENTIALS_TOKEN_REFRESH_SCOPE_MISMATCH,\n            {fields: {invalidScopes}}\n          );\n        }\n\n        return Promise.all(\n          tokens.map((token) => {\n            const tokenScope = filterScope(diffScopes(token.scope, st.scope), token.scope);\n\n            return (\n              this.downscope(tokenScope)\n                // eslint-disable-next-line max-nested-callbacks\n                .then((t) => {\n                  this.logger.info(`credentials: revoking token for ${token.scope}`);\n\n                  return token\n                    .revoke()\n                    .catch((err) => {\n                      this.logger.warn('credentials: failed to revoke user token', err);\n                    })\n                    .then(() => {\n                      this.userTokens.remove(token.scope);\n                      this.userTokens.add(t);\n                    });\n                })\n            );\n          })\n        );\n      })\n      .then(() => {\n        this.scheduleRefresh(this.supertoken.expires);\n      });\n  },\n\n  /**\n   * Schedules a token refresh or refreshes the token if token has expired\n   * @instance\n   * @memberof Credentials\n   * @param {number} expires\n   * @private\n   * @returns {undefined}\n   */\n  scheduleRefresh(expires) {\n    const expiresIn = expires - Date.now();\n\n    if (expiresIn > 0) {\n      const timeoutLength = this.calcRefreshTimeout(expiresIn);\n\n      this.refreshTimer = safeSetTimeout(() => this.refresh(), timeoutLength);\n    } else {\n      this.refresh();\n    }\n  },\n});\n\nexport default Credentials;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,IAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,aAAA,GAAAH,sBAAA,CAAAC,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AACA,IAAAK,OAAA,GAAAL,OAAA;AAEA,IAAAM,YAAA,GAAAP,sBAAA,CAAAC,OAAA;AACA,IAAAO,WAAA,GAAAP,OAAA;AAEA,IAAAQ,YAAA,GAAAC,uBAAA,CAAAT,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,MAAA,GAAAZ,sBAAA,CAAAC,OAAA;AACA,IAAAY,gBAAA,GAAAb,sBAAA,CAAAC,OAAA;AACA,IAAAa,UAAA,GAAAb,OAAA;AAAqC,IAAAc,IAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,IAAA;AAnBrC;AACA;AACA;AAFA,SAAAX,wBAAAY,CAAA,EAAAC,CAAA,6BAAAC,QAAA,MAAAC,CAAA,OAAAD,QAAA,IAAAE,CAAA,OAAAF,QAAA,YAAAd,uBAAA,YAAAA,wBAAAY,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,gBAAAW,OAAA,CAAAX,CAAA,0BAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAM,GAAA,CAAAZ,CAAA,UAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,GAAAM,CAAA,CAAAQ,GAAA,CAAAd,CAAA,EAAAQ,CAAA,cAAAO,EAAA,IAAAf,CAAA,gBAAAe,EAAA,OAAAC,cAAA,CAAAC,IAAA,CAAAjB,CAAA,EAAAe,EAAA,OAAAR,CAAA,IAAAD,CAAA,GAAAY,sBAAA,KAAAC,iCAAA,CAAAnB,CAAA,EAAAe,EAAA,OAAAR,CAAA,CAAAM,GAAA,IAAAN,CAAA,CAAAO,GAAA,IAAAR,CAAA,CAAAE,CAAA,EAAAO,EAAA,EAAAR,CAAA,IAAAC,CAAA,CAAAO,EAAA,IAAAf,CAAA,CAAAe,EAAA,WAAAP,CAAA,KAAAR,CAAA,EAAAC,CAAA;AAAA,SAAAmB,QAAApB,CAAA,EAAAG,CAAA,QAAAF,CAAA,GAAAoB,aAAA,CAAArB,CAAA,OAAAsB,6BAAA,QAAAhB,CAAA,GAAAgB,6BAAA,CAAAtB,CAAA,GAAAG,CAAA,KAAAG,CAAA,GAAAA,CAAA,CAAAiB,MAAA,WAAApB,CAAA,WAAAgB,iCAAA,CAAAnB,CAAA,EAAAG,CAAA,EAAAqB,UAAA,OAAAvB,CAAA,CAAAwB,IAAA,CAAAC,KAAA,CAAAzB,CAAA,EAAAK,CAAA,YAAAL,CAAA;AAAA,SAAA0B,cAAA3B,CAAA,aAAAG,CAAA,MAAAA,CAAA,GAAAyB,SAAA,CAAAC,MAAA,EAAA1B,CAAA,UAAAF,CAAA,WAAA2B,SAAA,CAAAzB,CAAA,IAAAyB,SAAA,CAAAzB,CAAA,QAAAA,CAAA,OAAAiB,OAAA,CAAAU,MAAA,CAAA7B,CAAA,OAAA8B,OAAA,WAAA5B,CAAA,QAAA6B,gBAAA,CAAAtB,OAAA,EAAAV,CAAA,EAAAG,CAAA,EAAAF,CAAA,CAAAE,CAAA,SAAA8B,iCAAA,GAAAC,wBAAA,CAAAlC,CAAA,EAAAiC,iCAAA,CAAAhC,CAAA,KAAAmB,OAAA,CAAAU,MAAA,CAAA7B,CAAA,GAAA8B,OAAA,WAAA5B,CAAA,IAAAe,sBAAA,CAAAlB,CAAA,EAAAG,CAAA,EAAAgB,iCAAA,CAAAlB,CAAA,EAAAE,CAAA,iBAAAH,CAAA;AAqBA;AACA;AACA;AACA,IAAMmC,WAAW,GAAGC,oBAAW,CAACC,MAAM,EAAA5C,IAAA,GAyVnC,IAAA6C,iBAAS,EAAC;EAACC,UAAU,EAAE,SAAZA,UAAUA,CAAGC,KAAK;IAAA,OAAKA,KAAK;EAAA;AAAA,CAAC,CAAC,EAAA9C,KAAA,GACzC,IAAA+C,wBAAY,EAAC,GAAG,CAAC,EAAA9C,KAAA,GAmDjB,IAAA+C,mBAAO,EAAC,GAAG,CAAC,EAAA9C,KAAA,GAuDZ,IAAA6C,wBAAY,EAAC,GAAG,CAAC,EAAA5C,KAAA,GAyCjB,IAAA8C,qBAAa,EAAC,cAAc,CAAC,EAAA7C,KAAA,GAC7B,IAAA2C,wBAAY,EAAC,GAAG,CAAC,EAAA1C,IAAA,GA9emB;EACrC6C,WAAW,EAAE;IACXC,UAAU,EAAEC;EACd,CAAC;EAEDC,SAAS,EAAE;IACTC,KAAK,EAAE,IAAAC,yBAAiB,EAACC,cAAK,EAAE,OAAO,CAAC,CAACC;EAC3C,CAAC;EAEDC,OAAO,EAAE;IACPC,YAAY,EAAE;MACZC,IAAI,EAAE,CAAC,YAAY,EAAE,yBAAyB,EAAE,YAAY,CAAC;MAC7DC,EAAE,WAAFA,EAAEA,CAAA,EAAG;QACH,OAAOC,OAAO,CAAE,IAAI,CAACC,UAAU,IAAI,IAAI,CAACA,UAAU,CAACJ,YAAY,IAAK,IAAI,CAACK,UAAU,CAAC;MACtF;IACF,CAAC;IACDA,UAAU,EAAE;MACVJ,IAAI,EAAE,CAAC,YAAY,EAAE,uBAAuB,CAAC;MAC7CC,EAAE,WAAFA,EAAEA,CAAA,EAAG;QACH;QACA,IAAI,IAAI,CAACI,MAAM,CAACC,kBAAkB,EAAE;UAClC,OAAO,IAAI;QACb;QAEA,OAAOJ,OAAO,CAAC,IAAI,CAACC,UAAU,IAAI,IAAI,CAACA,UAAU,CAACC,UAAU,CAAC;MAC/D;IACF,CAAC;IACDG,iBAAiB,EAAE;MACjBP,IAAI,EAAE,CAAC,YAAY,CAAC;MACpB;AACN;AACA;AACA;MACMC,EAAE,WAAFA,EAAEA,CAAA,EAAG;QACH,IAAIO,OAAO,GAAG,KAAK;QACnB,IAAI;UACFA,OAAO,GACLC,IAAI,CAACC,KAAK,CAACC,cAAM,CAACC,MAAM,CAAC,IAAI,CAACT,UAAU,CAACU,YAAY,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAACC,SAAS,KAC/E,OAAO;QACX,CAAC,CAAC,OAAAC,OAAA,EAAM;UACN;QAAA;QAGF,OAAOR,OAAO;MAChB;IACF;EACF,CAAC;EAEDS,KAAK,EAAE;IACLd,UAAU,EAAE,IAAAR,yBAAiB,EAACC,cAAK,EAAE,OAAO,CAAC,CAACsB;EAChD,CAAC;EAEDC,SAAS,EAAE,aAAa;EAExBC,OAAO,EAAE;IACPC,YAAY,EAAE;MACZjE,OAAO,EAAE,KAAK;MACdkE,IAAI,EAAE;IACR,CAAC;IACD;AACJ;AACA;AACA;AACA;AACA;AACA;IACIC,KAAK,EAAE;MACLnE,OAAO,EAAE,KAAK;MACdkE,IAAI,EAAE;IACR,CAAC;IACDE,YAAY,EAAE;MACZpE,OAAO,EAAEqE,SAAS;MAClBH,IAAI,EAAE;IACR;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEI,aAAa,WAAbA,aAAaA,CAAA,EAAmC;IAAA,IAAlCC,OAAO,GAAArD,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAmD,SAAA,GAAAnD,SAAA,MAAG;MAACsD,UAAU,EAAE;IAAQ,CAAC;IAC5C;IACA,IAAID,OAAO,CAACE,KAAK,KAAKJ,SAAS,IAAI,CAAC,IAAAK,gBAAQ,EAACH,OAAO,CAACE,KAAK,CAAC,EAAE;MAC3D,MAAM,IAAIE,KAAK,CAAC,iDAAiD,CAAC;IACpE;IAEAJ,OAAO,CAACK,SAAS,GAAG,IAAI,CAAC3B,MAAM,CAAC2B,SAAS;IACzCL,OAAO,CAACM,YAAY,GAAG,IAAI,CAAC5B,MAAM,CAAC4B,YAAY;IAC/CN,OAAO,CAACzC,KAAK,GAAG,IAAI,CAACmB,MAAM,CAACnB,KAAK;IAEjCyC,OAAO,GAAG,IAAAO,iBAAS,EAACP,OAAO,CAAC;IAE5B,IAAI,CAACA,OAAO,CAACQ,aAAa,EAAE;MAC1BR,OAAO,CAACQ,aAAa,GAAGR,OAAO,CAACC,UAAU,KAAK,QAAQ,GAAG,OAAO,GAAG,MAAM;IAC5E;IACA,IAAAQ,eAAA,CAAAhF,OAAA,EAAuBuE,OAAO,EAAE,YAAY,CAAC;IAE7C,IAAIA,OAAO,CAACE,KAAK,EAAE;MACjB,IAAI,CAAC,IAAAQ,eAAO,EAACV,OAAO,CAACE,KAAK,CAAC,EAAE;QAC3BF,OAAO,CAACE,KAAK,GAAG,IAAAS,mBAAW,EAACX,OAAO,CAACE,KAAK,CAAC;MAC5C,CAAC,MAAM;QACL,OAAOF,OAAO,CAACE,KAAK;MACtB;IACF;IAEA,UAAAU,MAAA,CAAU,IAAI,CAAClC,MAAM,CAACmC,YAAY,OAAAD,MAAA,CAAIE,oBAAW,CAACC,SAAS,CAACf,OAAO,CAAC;IACpE;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEgB,QAAQ,WAARA,QAAQA,CAAA,EAAG;IACT,IAAI,CAACC,MAAM,CAACC,IAAI,CAAC,0DAA0D,CAAC;IAE5E,IAAI;MACF;MACA,IAAI,CAACD,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;MAEjE,OAAO,IAAI,CAACC,mBAAmB,CAAC,IAAI,CAAC3C,UAAU,CAACU,YAAY,CAAC;IAC/D,CAAC,CAAC,OAAOnE,CAAC,EAAE;MACV;MACA,IAAI,CAACkG,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;MACjE,IAAI,CAACD,MAAM,CAACC,IAAI,CAAC,0DAA0D,CAAC;MAE5E,IAAI;QAAA,IAAAE,gBAAA;QACF,OAAO,IAAI,CAACC,yBAAyB,EAAAD,gBAAA,GAAC,IAAI,CAAC5C,UAAU,cAAA4C,gBAAA,uBAAfA,gBAAA,CAAiBlC,YAAY,CAAC;MACtE,CAAC,CAAC,OAAO3D,CAAC,EAAE;QACV,IAAI,CAAC0F,MAAM,CAACC,IAAI,CAAC,sDAAsD,CAAC;QACxE,MAAM3F,CAAC;MACT;IACF;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE4F,mBAAmB,WAAnBA,mBAAmBA,CAAA,EAAa;IAAA,IAAZpD,KAAK,GAAApB,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAmD,SAAA,GAAAnD,SAAA,MAAG,EAAE;IAC5B;IACA,IAAM2E,UAAU,GAAGC,qBAAG,CAACtC,MAAM,CAAClB,KAAK,CAAC;;IAEpC;IACA,IAAI,CAACuD,UAAU,EAAE;MACf,MAAM,IAAIlB,KAAK,CAAC,mDAAmD,CAAC;IACtE;IAEA,IAAI,CAACkB,UAAU,CAACE,KAAK,EAAE;MACrB,MAAM,IAAIpB,KAAK,CAAC,4CAA4C,CAAC;IAC/D;;IAEA;IACA,OAAOkB,UAAU,CAACE,KAAK;EACzB,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEH,yBAAyB,WAAzBA,yBAAyBA,CAAA,EAAa;IAAA,IAAZtD,KAAK,GAAApB,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAmD,SAAA,GAAAnD,SAAA,MAAG,EAAE;IAClC;IACA,IAAM8E,MAAM,GAAG1D,KAAK,CAACoB,KAAK,CAAC,GAAG,CAAC;;IAE/B;IACA,IAAIsC,MAAM,CAAC7E,MAAM,KAAK,CAAC,EAAE;MACvB,MAAM,IAAIwD,KAAK,wDAAAQ,MAAA,CAC0Ca,MAAM,CAAC7E,MAAM,cACtE,CAAC;IACH;;IAEA;IACA,OAAO6E,MAAM,CAAC,CAAC,CAAC;EAClB,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,uBAAuB,WAAvBA,uBAAuBA,CAAA,EAAe;IAAA,IAAd1B,OAAO,GAAArD,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAmD,SAAA,GAAAnD,SAAA,MAAG,CAAC,CAAC;IAClC,IAAOgF,cAAc,GAAsB3B,OAAO,CAA3C2B,cAAc;MAAEC,SAAS,GAAW5B,OAAO,CAA3B4B,SAAS;MAAE1B,KAAK,GAAIF,OAAO,CAAhBE,KAAK;IAEvC,IAAI,CAACyB,cAAc,EAAE;MACnB,MAAM,IAAIvB,KAAK,CAAC,sCAAsC,CAAC;IACzD;IACA,IAAI,CAACwB,SAAS,EAAE;MACd,MAAM,IAAIxB,KAAK,CAAC,iCAAiC,CAAC;IACpD;IACA,IAAIF,KAAK,KAAKJ,SAAS,IAAI,CAAC,IAAAK,gBAAQ,EAACD,KAAK,CAAC,EAAE;MAC3C,MAAM,IAAIE,KAAK,CAAC,iDAAiD,CAAC;IACpE;IAEA,IAAMyB,KAAK,GAAG;MACZF,cAAc,EAAdA,cAAc;MACdC,SAAS,EAATA;IACF,CAAC;IAED,IAAI1B,KAAK,IAAI,CAAC,IAAAQ,eAAO,EAACR,KAAK,CAAC,EAAE;MAC5B2B,KAAK,CAAC3B,KAAK,GAAG,IAAAS,mBAAW,EAACT,KAAK,CAAC;IAClC;IAEA,UAAAU,MAAA,CAAU,IAAI,CAAClC,MAAM,CAACoD,kBAAkB,OAAAlB,MAAA,CAAIE,oBAAW,CAACC,SAAS,CAACc,KAAK,CAAC;EAC1E,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEE,cAAc,WAAdA,cAAcA,CAAA,EAAe;IAAA,IAAd/B,OAAO,GAAArD,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAmD,SAAA,GAAAnD,SAAA,MAAG,CAAC,CAAC;IACzB,UAAAiE,MAAA,CAAU,IAAI,CAAClC,MAAM,CAACsD,SAAS,OAAApB,MAAA,CAAIE,oBAAW,CAACC,SAAS,CAAArE,aAAA;MACtDuF,UAAU,EAAE,IAAI,CAACvD,MAAM,CAACwD,OAAO;MAC/BC,IAAI,EAAE,IAAI,CAACzD,MAAM,CAAC4B;IAAY,GAC3BN,OAAO,CACX,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEoC,kBAAkB,WAAlBA,kBAAkBA,CAACC,UAAU,EAAE;IAC7B,OAAOC,IAAI,CAACC,KAAK,CAAE,CAACD,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAIH,UAAU,CAAC;EAC5E,CAAC;EAEDI,WAAW,WAAXA,WAAWA,CAAA,EAAU;IAAA,IAAAC,KAAA;IACnB;IACA;IACA,IAAI,CAACC,UAAU,GAAG,IAAApC,iBAAS,EAAC,IAAI,CAACoC,UAAU,CAAC;IAC5C,IAAAC,KAAA,CAAAnH,OAAA,EAAY,IAAI,CAACkH,UAAU,CAAC,CAAC7F,OAAO,CAAC,UAAC+F,GAAG,EAAK;MAC5C,IAAIH,KAAI,CAACC,UAAU,CAACE,GAAG,CAAC,CAAChH,GAAG,EAAE;QAC5B6G,KAAI,CAACC,UAAU,CAACE,GAAG,CAAC,CAAChH,GAAG,GAAG6G,KAAI,CAACC,UAAU,CAACE,GAAG,CAAC,CAAChH,GAAG,CAACiH,IAAI,CAACJ,KAAI,CAAC;MAChE;IACF,CAAC,CAAC;IACF;IAAA,SAAAK,IAAA,GAAApG,SAAA,CAAAC,MAAA,EATaoG,IAAI,OAAAC,KAAA,CAAAF,IAAA,GAAAG,IAAA,MAAAA,IAAA,GAAAH,IAAA,EAAAG,IAAA;MAAJF,IAAI,CAAAE,IAAA,IAAAvG,SAAA,CAAAuG,IAAA;IAAA;IAUjB,IAAAC,MAAA,CAAA1H,OAAA,EAAc0B,oBAAW,EAAE,IAAI,EAAE6F,IAAI,CAAC;EACxC,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEI,SAAS,WAATA,SAASA,CAAC7F,KAAK,EAAE;IAAA,IAAA8F,MAAA;IACf,OAAO,IAAI,CAAC7E,UAAU,CAAC4E,SAAS,CAAC7F,KAAK,CAAC,CAAC+F,KAAK,CAAC,UAACC,MAAM,EAAK;MAAA,IAAAC,YAAA;MACxD,IAAMC,UAAU,IAAAD,YAAA,GAAGD,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,IAAI,cAAAF,YAAA,cAAAA,YAAA,GAAID,MAAM;MACzCF,MAAI,CAACpC,MAAM,CAAC0C,IAAI,qDAAA/C,MAAA,CAAoDrD,KAAK,SAAKkG,UAAU,CAAC;MACzFJ,MAAI,CAACpC,MAAM,CAAC2C,KAAK,gDAAAhD,MAAA,CAAgDrD,KAAK,CAAE,CAAC;MACzE8F,MAAI,CAACQ,KAAK,CAACC,QAAQ,CAACC,OAAO,CAACC,mBAAmB,CAACC,kBAAO,CAACC,mCAAmC,EAAE;QAC3FzC,MAAM,EAAE;UACN0C,cAAc,EAAE5G,KAAK;UACrBkG,UAAU,EAAVA;QACF;MACF,CAAC,CAAC;MAEF,OAAOW,QAAA,CAAA3I,OAAA,CAAQ4I,OAAO,CAAC,IAAIpG,cAAK,CAAAvB,aAAA;QAAEa,KAAK,EAALA;MAAK,GAAK8F,MAAI,CAAC7E,UAAU,CAAC8F,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;QACzEC,MAAM,EAAElB;MACV,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEmB,cAAc,WAAdA,cAAcA,CAAA,EAAe;IAAA,IAAAC,MAAA;IAAA,IAAdzE,OAAO,GAAArD,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAmD,SAAA,GAAAnD,SAAA,MAAG,CAAC,CAAC;IACzB,IAAI,CAACsE,MAAM,CAACC,IAAI,CAAC,kDAAkD,CAAC;IAEpE,OAAO,IAAI,CAAC2C,KAAK,CACda,OAAO,CAAC;MACP;MACAC,MAAM,EAAE,MAAM;MACdC,GAAG,EAAE5E,OAAO,CAAC4E,GAAG,IAAI,IAAI,CAAClG,MAAM,CAACmG,QAAQ;MACxCC,IAAI,EAAE;QACJC,UAAU,EAAE,oBAAoB;QAChCxH,KAAK,EAAEyC,OAAO,CAACzC,KAAK,IAAI,mBAAmB;QAC3CyH,oBAAoB,EAAE;MACxB,CAAC;MACDC,IAAI,EAAE;QACJC,IAAI,EAAE,IAAI,CAACxG,MAAM,CAAC2B,SAAS;QAC3B8E,IAAI,EAAE,IAAI,CAACzG,MAAM,CAAC0G,aAAa;QAC/BC,eAAe,EAAE;MACnB,CAAC;MACDC,wBAAwB,EAAE;MAC1B;IACF,CAAC,CAAC,CACDC,IAAI,CAAC,UAACC,GAAG;MAAA,OAAK,IAAIvH,cAAK,CAACuH,GAAG,CAAC9B,IAAI,EAAE;QAACa,MAAM,EAAEE;MAAI,CAAC,CAAC;IAAA,EAAC,CAClDnB,KAAK,CAAC,UAACkC,GAAG,EAAK;MACd,IAAIA,GAAG,CAACC,UAAU,KAAK,GAAG,EAAE;QAC1B,OAAOrB,QAAA,CAAA3I,OAAA,CAAQiK,MAAM,CAACF,GAAG,CAAC;MAC5B;MAEA,IAAMG,gBAAgB,GAAGC,oBAAW,CAACC,MAAM,CAACL,GAAG,CAAC9B,IAAI,CAACoC,KAAK,CAAC;MAE3D,OAAO1B,QAAA,CAAA3I,OAAA,CAAQiK,MAAM,CAAC,IAAIC,gBAAgB,CAACH,GAAG,CAACO,IAAI,IAAIP,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC;EACN,CAAC;EAID;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEQ,YAAY,WAAZA,YAAYA,CAACzI,KAAK,EAAE;IAAA,IAAA0I,MAAA;IAClB,OAAO7B,QAAA,CAAA3I,OAAA,CAAQ4I,OAAO,CACpB,CAAC,IAAI,CAAC3E,YAAY,IAChB,IAAA0E,QAAA,CAAA3I,OAAA,CAAY,UAAC4I,OAAO,EAAK;MACvB4B,MAAI,CAAChF,MAAM,CAACC,IAAI,CACd,oFACF,CAAC;MACD+E,MAAI,CAACC,IAAI,CAAC,qBAAqB,EAAE,YAAM;QACrCD,MAAI,CAAChF,MAAM,CAACC,IAAI,CAAC,8DAA8D,CAAC;QAChFmD,OAAO,CAAC,CAAC;MACX,CAAC,CAAC;IACJ,CAAC,CACL,CAAC,CAACkB,IAAI,CAAC,YAAM;MACX,IAAI,CAACU,MAAI,CAAC7H,YAAY,EAAE;QACtB6H,MAAI,CAAChF,MAAM,CAACC,IAAI,CAAC,gEAAgE,CAAC;QAElF,OAAOkD,QAAA,CAAA3I,OAAA,CAAQiK,MAAM,CAAC,IAAItF,KAAK,CAAC,8CAA8C,CAAC,CAAC;MAClF;MAEA,IAAI,CAAC7C,KAAK,EAAE;QACVA,KAAK,GAAG,IAAA4I,kBAAW,EAAC,WAAW,EAAEF,MAAI,CAACzH,UAAU,CAACjB,KAAK,CAAC;MACzD;MAEAA,KAAK,GAAG,IAAA6I,gBAAS,EAAC7I,KAAK,CAAC;MAExB,IAAIA,KAAK,KAAK,IAAA6I,gBAAS,EAACH,MAAI,CAACzH,UAAU,CAACjB,KAAK,CAAC,EAAE;QAC9C,OAAO6G,QAAA,CAAA3I,OAAA,CAAQ4I,OAAO,CAAC4B,MAAI,CAACzH,UAAU,CAAC;MACzC;MAEA,IAAMT,KAAK,GAAGkI,MAAI,CAACrI,UAAU,CAAChC,GAAG,CAAC2B,KAAK,CAAC;;MAExC;MACA;MACA,IAAI,CAACQ,KAAK,IAAI,CAACA,KAAK,CAACmB,YAAY,EAAE;QACjC,OAAO+G,MAAI,CAAC7C,SAAS,CAAC7F,KAAK,CAAC,CAACgI,IAAI,CAAC,IAAAc,WAAG,EAAC,UAACrL,CAAC;UAAA,OAAKiL,MAAI,CAACrI,UAAU,CAAC0I,GAAG,CAACtL,CAAC,CAAC;QAAA,EAAC,CAAC;MACvE;MAEA,OAAOoJ,QAAA,CAAA3I,OAAA,CAAQ4I,OAAO,CAACtG,KAAK,CAAC;IAC/B,CAAC,CAAC;EACJ,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEwI,UAAU,WAAVA,UAAUA,CAACC,KAAK,EAAExG,OAAO,EAAE;IAAA,IAAAyG,MAAA;IACzB,IAAID,KAAK,EAAE;MACT,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE;QAC7B,IAAI,CAAChI,UAAU,GAAGgI,KAAK;MACzB;MAEA,IAAIA,KAAK,CAACtH,YAAY,EAAE;QACtB,IAAI,CAACV,UAAU,GAAGgI,KAAK;MACzB;MAEA,IAAIA,KAAK,CAACE,aAAa,EAAE;QACvB,IAAIF,KAAK,CAACE,aAAa,CAAClI,UAAU,EAAE;UAClC,IAAI,CAACA,UAAU,GAAGgI,KAAK,CAACE,aAAa,CAAClI,UAAU;QAClD,CAAC,MAAM;UACL,IAAI,CAACA,UAAU,GAAGgI,KAAK,CAACE,aAAa;QACvC;MACF;;MAEA;MACA,IAAI,IAAI,CAAClI,UAAU,IAAI,IAAI,CAACA,UAAU,CAACmI,OAAO,EAAE;QAC9C,IAAI,CAACC,eAAe,CAAC,IAAI,CAACpI,UAAU,CAACmI,OAAO,CAAC;MAC/C;IACF;IAEA,IAAAxD,MAAA,CAAA1H,OAAA,EAAc0B,oBAAW,CAAC0J,SAAS,CAACN,UAAU,EAAE,IAAI,EAAE,CAACC,KAAK,EAAExG,OAAO,CAAC,CAAC;IAEvE,IAAI,CAAC8G,YAAY,CAAC,IAAI,CAACvC,MAAM,EAAE,eAAe,EAAE,YAAM;MACpD,IAAIkC,MAAI,CAAC/H,MAAM,CAACqI,mBAAmB,EAAE;QACnC,IAAMC,MAAM,GAAGC,YAAG,CAAClI,KAAK,CAAC0H,MAAI,CAAC/H,MAAM,CAACqI,mBAAmB,EAAE,IAAI,CAAC;;QAE/D;QACAN,MAAI,CAAC/H,MAAM,CAAC2B,SAAS,GAAG2G,MAAM,CAACnF,KAAK,CAACxB,SAAS;QAC9CoG,MAAI,CAAC/H,MAAM,CAAC4B,YAAY,GAAG0G,MAAM,CAACnF,KAAK,CAACvB,YAAY;QACpDmG,MAAI,CAAC/H,MAAM,CAACnB,KAAK,GAAGyJ,MAAM,CAACnF,KAAK,CAACtE,KAAK;QACtCkJ,MAAI,CAAC/H,MAAM,CAACmC,YAAY,GAAGmG,MAAM,CAACE,IAAI,CAACC,MAAM,CAAC,CAAC,EAAEH,MAAM,CAACE,IAAI,CAACE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1E;MACF;IACF,CAAC,CAAC;IAEF,IAAI,CAACvD,KAAK,CAACqC,IAAI,CAAC,QAAQ,EAAE,YAAM;MAC9BO,MAAI,CAAC7G,KAAK,GAAG,IAAI;IACnB,CAAC,CAAC;EACJ,CAAC;EAID;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEyH,UAAU,WAAVA,UAAUA,CAAA,EAAG;IACX,IAAI,CAACpG,MAAM,CAACC,IAAI,CAAC,kCAAkC,CAAC;;IAEpD;IACA,IAAI,IAAI,CAACrB,YAAY,EAAE;MACrByH,YAAY,CAAC,IAAI,CAACzH,YAAY,CAAC;MAC/B,IAAI,CAAC0H,KAAK,CAAC,cAAc,CAAC;IAC5B;IAEA,IAAI;MACF,IAAI,CAACA,KAAK,CAAC,YAAY,CAAC;IAC1B,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,IAAI,CAACvG,MAAM,CAAC0C,IAAI,CAAC,yCAAyC,EAAE6D,GAAG,CAAC;IAClE;IAEA,OAAO,IAAI,CAAC5J,UAAU,CAAC6J,MAAM,CAAC7K,MAAM,EAAE;MACpC,IAAI;QACF,IAAI,CAACgB,UAAU,CAAC8J,MAAM,CAAC,IAAI,CAAC9J,UAAU,CAAC6J,MAAM,CAAC,CAAC,CAAC,CAAC;MACnD,CAAC,CAAC,OAAOD,GAAG,EAAE;QACZ,IAAI,CAACvG,MAAM,CAAC0C,IAAI,CAAC,0CAA0C,EAAE6D,GAAG,CAAC;MACnE;IACF;IAEA,IAAI,CAACvG,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;;IAEzD;IACA;IACA,OAAOkD,QAAA,CAAA3I,OAAA,CAAQ4I,OAAO,CAAC,CAAC;EAC1B,CAAC;EAKD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEsD,OAAO,WAAPA,OAAOA,CAAA,EAAG;IAAA,IAAAC,MAAA;IACR,IAAI,CAAC3G,MAAM,CAACC,IAAI,CAAC,gCAAgC,CAAC;IAElD,IAAO1C,UAAU,GAAI,IAAI,CAAlBA,UAAU;IACjB,IAAMqJ,MAAM,GAAG,IAAAC,aAAK,EAAC,IAAI,CAAClK,UAAU,CAAC6J,MAAM,CAAC;;IAE5C;IACA;IACA;IACA;IACA;IACA;IACA,IAAI,IAAI,CAAC/I,MAAM,CAACC,kBAAkB,EAAE;MAClC,OACE,IAAI,CAACD,MAAM,CACRC,kBAAkB,CAAC,IAAI,CAACkF,KAAK;MAC9B;MAAA,CACC0B,IAAI,CAAC,UAAChE,GAAG;QAAA,OAAKqG,MAAI,CAAC/D,KAAK,CAAC6C,aAAa,CAACqB,yBAAyB,CAAC;UAACxG,GAAG,EAAHA;QAAG,CAAC,CAAC;MAAA,EAAC;IAE/E;IAEA,IAAI,IAAI,CAACsC,KAAK,CAACC,QAAQ,CAACkE,QAAQ,EAAE;MAChC,IAAI,CAACnE,KAAK,CAACC,QAAQ,CAACkE,QAAQ,CAACC,uBAAuB,CAAC,CAAC;IACxD;IAEA,OAAOzJ,UAAU,CACdmJ,OAAO,CAAC,CAAC,CACTrE,KAAK,CAAC,UAACwC,KAAK,EAAK;MAChB,IAAIA,KAAK,YAAYoC,uBAAU,EAAE;QAC/B;QACA;QACAN,MAAI,CAACL,KAAK,CAAC,YAAY,CAAC;QACxB,OAAOK,MAAI,CAAChK,UAAU,CAAC6J,MAAM,CAAC7K,MAAM,EAAE;UACpC,IAAI;YACFgL,MAAI,CAAChK,UAAU,CAAC8J,MAAM,CAACE,MAAI,CAAChK,UAAU,CAAC6J,MAAM,CAAC,CAAC,CAAC,CAAC;UACnD,CAAC,CAAC,OAAOD,GAAG,EAAE;YACZI,MAAI,CAAC3G,MAAM,CAAC0C,IAAI,CAAC,0CAA0C,EAAE6D,GAAG,CAAC;UACnE;QACF;QACAI,MAAI,CAAC/D,KAAK,CAACsE,OAAO,CAAC,4BAA4B,CAAC;MAClD;MAEA,OAAO/D,QAAA,CAAA3I,OAAA,CAAQiK,MAAM,CAACI,KAAK,CAAC;IAC9B,CAAC,CAAC,CACDP,IAAI,CAAC,UAAC6C,EAAE,EAAK;MACZ;MACA,IAAIR,MAAI,CAAC/H,YAAY,EAAE;QACrByH,YAAY,CAACM,MAAI,CAAC/H,YAAY,CAAC;QAC/B+H,MAAI,CAACL,KAAK,CAAC,cAAc,CAAC;MAC5B;MACAK,MAAI,CAACpJ,UAAU,GAAG4J,EAAE;MAEpB,IAAMC,aAAa,GAAG,IAAAC,iBAAU,EAACV,MAAI,CAAClJ,MAAM,CAACnB,KAAK,EAAE6K,EAAE,CAAC7K,KAAK,CAAC;MAE7D,IAAI8K,aAAa,KAAK,EAAE,EAAE;QACxBT,MAAI,CAAC3G,MAAM,CAAC0C,IAAI,mBAAA/C,MAAA,CACGyH,aAAa,kHAChC,CAAC;QACDT,MAAI,CAAC/D,KAAK,CAACC,QAAQ,CAACC,OAAO,CAACC,mBAAmB,CAC7CC,kBAAO,CAACsE,+CAA+C,EACvD;UAAC9G,MAAM,EAAE;YAAC4G,aAAa,EAAbA;UAAa;QAAC,CAC1B,CAAC;MACH;MAEA,OAAOjE,QAAA,CAAA3I,OAAA,CAAQ+M,GAAG,CAChBX,MAAM,CAACY,GAAG,CAAC,UAAC1K,KAAK,EAAK;QACpB,IAAM2K,UAAU,GAAG,IAAAvC,kBAAW,EAAC,IAAAmC,iBAAU,EAACvK,KAAK,CAACR,KAAK,EAAE6K,EAAE,CAAC7K,KAAK,CAAC,EAAEQ,KAAK,CAACR,KAAK,CAAC;QAE9E,OACEqK,MAAI,CAACxE,SAAS,CAACsF,UAAU;QACvB;QAAA,CACCnD,IAAI,CAAC,UAACvK,CAAC,EAAK;UACX4M,MAAI,CAAC3G,MAAM,CAACC,IAAI,oCAAAN,MAAA,CAAoC7C,KAAK,CAACR,KAAK,CAAE,CAAC;UAElE,OAAOQ,KAAK,CACT4K,MAAM,CAAC,CAAC,CACRrF,KAAK,CAAC,UAACkE,GAAG,EAAK;YACdI,MAAI,CAAC3G,MAAM,CAAC0C,IAAI,CAAC,0CAA0C,EAAE6D,GAAG,CAAC;UACnE,CAAC,CAAC,CACDjC,IAAI,CAAC,YAAM;YACVqC,MAAI,CAAChK,UAAU,CAAC8J,MAAM,CAAC3J,KAAK,CAACR,KAAK,CAAC;YACnCqK,MAAI,CAAChK,UAAU,CAAC0I,GAAG,CAACtL,CAAC,CAAC;UACxB,CAAC,CAAC;QACN,CAAC,CAAC;MAER,CAAC,CACH,CAAC;IACH,CAAC,CAAC,CACDuK,IAAI,CAAC,YAAM;MACVqC,MAAI,CAAChB,eAAe,CAACgB,MAAI,CAACpJ,UAAU,CAACmI,OAAO,CAAC;IAC/C,CAAC,CAAC;EACN,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,eAAe,WAAfA,eAAeA,CAACD,OAAO,EAAE;IAAA,IAAAiC,MAAA;IACvB,IAAMC,SAAS,GAAGlC,OAAO,GAAG,IAAAmC,IAAA,CAAArN,OAAA,EAAS,CAAC;IAEtC,IAAIoN,SAAS,GAAG,CAAC,EAAE;MACjB,IAAME,aAAa,GAAG,IAAI,CAAC3G,kBAAkB,CAACyG,SAAS,CAAC;MAExD,IAAI,CAAChJ,YAAY,GAAG,IAAAmJ,4BAAc,EAAC;QAAA,OAAMJ,MAAI,CAACjB,OAAO,CAAC,CAAC;MAAA,GAAEoB,aAAa,CAAC;IACzE,CAAC,MAAM;MACL,IAAI,CAACpB,OAAO,CAAC,CAAC;IAChB;EACF,CAAC;EAAAsB,OAAA;AACH,CAAC,MAAAC,0BAAA,CAAAzN,OAAA,EAAAX,IAAA,mBAAAN,IAAA,EAAAC,KAAA,OAAA0O,yBAAA,CAAA1N,OAAA,EAAAX,IAAA,mBAAAA,IAAA,OAAAoO,0BAAA,CAAAzN,OAAA,EAAAX,IAAA,iBAAAJ,KAAA,OAAAyO,yBAAA,CAAA1N,OAAA,EAAAX,IAAA,iBAAAA,IAAA,OAAAoO,0BAAA,CAAAzN,OAAA,EAAAX,IAAA,iBArKEuC,iBAAS,EAAA1C,KAAA,OAAAwO,yBAAA,CAAA1N,OAAA,EAAAX,IAAA,iBAAAA,IAAA,OAAAoO,0BAAA,CAAAzN,OAAA,EAAAX,IAAA,cAyCTuC,iBAAS,EAAAzC,KAAA,EAAAC,KAAA,OAAAsO,yBAAA,CAAA1N,OAAA,EAAAX,IAAA,cAAAA,IAAA,GAAAA,IAAA,CA4HX,CAAC;AAAC,IAAAsO,QAAA,GAAAC,OAAA,CAAA5N,OAAA,GAEYyB,WAAW","ignoreList":[]}
+{"version":3,"names":["_querystring","_interopRequireDefault","require","_url","_jsonwebtoken","_common","_commonTimers","_lodash","_webexPlugin","_decorators","_grantErrors","_interopRequireWildcard","_scope","_token","_tokenCollection","_constants","_dec","_dec2","_dec3","_dec4","_dec5","_dec6","_obj","e","t","_WeakMap","r","n","__esModule","o","i","f","__proto__","default","_typeof","has","get","set","_t","hasOwnProperty","call","_Object$defineProperty","_Object$getOwnPropertyDescriptor2","ownKeys","_Object$keys2","_Object$getOwnPropertySymbols","filter","enumerable","push","apply","_objectSpread","arguments","length","Object","forEach","_defineProperty2","_Object$getOwnPropertyDescriptors","_Object$defineProperties","_createForOfIteratorHelper","_Symbol","_Symbol$iterator","_Array$isArray","_unsupportedIterableToArray","_n","F","s","done","value","TypeError","a","u","next","return","_arrayLikeToArray","toString","slice","constructor","name","_Array$from","test","Array","Credentials","WebexPlugin","extend","oneFlight","keyFactory","scope","waitForValue","persist","whileInFlight","collections","userTokens","TokenCollection","dataTypes","token","makeStateDataType","Token","dataType","derived","canAuthorize","deps","fn","Boolean","supertoken","canRefresh","config","jwtRefreshCallback","isUnverifiedGuest","isGuest","JSON","parse","base64","decode","access_token","split","user_type","_unused","props","prop","namespace","session","isRefreshing","type","ready","refreshTimer","undefined","buildLoginUrl","options","clientType","state","isObject","Error","client_id","redirect_uri","cloneDeep","response_type","_deleteProperty","isEmpty","encodeState","concat","authorizeUrl","querystring","stringify","getOrgId","logger","info","extractOrgIdFromJWT","_this$supertoken","extractOrgIdFromUserToken","decodedJWT","jwt","realm","fields","extractUserIdFromToken","payload","cis_uuid","getUserId","tokens","_toConsumableArray2","models","_iterator","_step","_unused2","err","buildThirdPartyLoginUrl","oauth2provider","returnURL","query","thirdPartyLoginUrl","buildLogoutUrl","logoutUrl","cisService","service","goto","calcRefreshTimeout","expiration","Math","floor","random","_this","_dataTypes","_keys","key","bind","_len","args","_key","_apply","downscope","_this2","catch","reason","_reason$body","failReason","body","warn","trace","webex","internal","metrics","submitClientMetrics","METRICS","JS_SDK_CREDENTIALS_DOWNSCOPE_FAILED","requestedScope","_promise","resolve","serialize","parent","getClientToken","_this3","request","method","uri","tokenUrl","form","grant_type","self_contained_token","auth","user","pass","client_secret","sendImmediately","shouldRefreshAccessToken","then","res","statusCode","reject","ErrorConstructor","grantErrors","select","error","_res","getUserToken","_this4","once","filterScope","sortScope","tap","add","initialize","attrs","_this5","authorization","expires","scheduleRefresh","prototype","listenToOnce","authorizationString","parsed","url","href","substr","indexOf","invalidate","clearTimeout","unset","remove","refresh","_this6","clone","requestAccessTokenFromJwt","services","updateCredentialsConfig","OAuthError","trigger","st","invalidScopes","diffScopes","JS_SDK_CREDENTIALS_TOKEN_REFRESH_SCOPE_MISMATCH","all","map","tokenScope","revoke","_this7","expiresIn","_now","timeoutLength","safeSetTimeout","version","_applyDecoratedDescriptor2","_getOwnPropertyDescriptor","_default","exports"],"sources":["credentials.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport jwt from 'jsonwebtoken';\nimport {base64, encodeState, makeStateDataType, oneFlight, tap, whileInFlight} from '@webex/common';\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {clone, cloneDeep, isObject, isEmpty} from 'lodash';\n\nimport WebexPlugin from '../webex-plugin';\nimport {persist, waitForValue} from '../storage/decorators';\n\nimport grantErrors, {OAuthError} from './grant-errors';\nimport {filterScope, diffScopes, sortScope} from './scope';\nimport Token from './token';\nimport TokenCollection from './token-collection';\nimport {METRICS} from '../constants';\n\n/**\n * @class\n */\nconst Credentials = WebexPlugin.extend({\n  collections: {\n    userTokens: TokenCollection,\n  },\n\n  dataTypes: {\n    token: makeStateDataType(Token, 'token').dataType,\n  },\n\n  derived: {\n    canAuthorize: {\n      deps: ['supertoken', 'supertoken.canAuthorize', 'canRefresh'],\n      fn() {\n        return Boolean((this.supertoken && this.supertoken.canAuthorize) || this.canRefresh);\n      },\n    },\n    canRefresh: {\n      deps: ['supertoken', 'supertoken.canRefresh'],\n      fn() {\n        // If we're operating in JWT mode, we have to delegate to the consumer\n        if (this.config.jwtRefreshCallback) {\n          return true;\n        }\n\n        return Boolean(this.supertoken && this.supertoken.canRefresh);\n      },\n    },\n    isUnverifiedGuest: {\n      deps: ['supertoken'],\n      /**\n       * Returns true if the user is an unverified guest\n       * @returns {boolean}\n       */\n      fn() {\n        let isGuest = false;\n        try {\n          isGuest =\n            JSON.parse(base64.decode(this.supertoken.access_token.split('.')[1])).user_type ===\n            'guest';\n        } catch {\n          /* the non-guest token is formatted differently so catch is expected */\n        }\n\n        return isGuest;\n      },\n    },\n  },\n\n  props: {\n    supertoken: makeStateDataType(Token, 'token').prop,\n  },\n\n  namespace: 'Credentials',\n\n  session: {\n    isRefreshing: {\n      default: false,\n      type: 'boolean',\n    },\n    /**\n     * Becomes `true` once the {@link loaded} event fires.\n     * @see {@link WebexPlugin#ready}\n     * @instance\n     * @memberof Credentials\n     * @type {boolean}\n     */\n    ready: {\n      default: false,\n      type: 'boolean',\n    },\n    refreshTimer: {\n      default: undefined,\n      type: 'any',\n    },\n  },\n\n  /**\n   * Generates an OAuth Login URL. Prefers the api.ciscospark.com proxy if the\n   * instance is initialize with an authorizatUrl, but fallsback to idbroker\n   * as the base otherwise.\n   * @instance\n   * @memberof Credentials\n   * @param {Object} [options={}]\n   * @returns {string}\n   */\n  buildLoginUrl(options = {clientType: 'public'}) {\n    /* eslint-disable camelcase */\n    if (options.state !== undefined && !isObject(options.state)) {\n      throw new Error('if specified, `options.state` must be an object');\n    }\n\n    options.client_id = this.config.client_id;\n    options.redirect_uri = this.config.redirect_uri;\n    options.scope = this.config.scope;\n\n    options = cloneDeep(options);\n\n    if (!options.response_type) {\n      options.response_type = options.clientType === 'public' ? 'token' : 'code';\n    }\n    Reflect.deleteProperty(options, 'clientType');\n\n    if (options.state) {\n      if (!isEmpty(options.state)) {\n        options.state = encodeState(options.state);\n      } else {\n        delete options.state;\n      }\n    }\n\n    return `${this.config.authorizeUrl}?${querystring.stringify(options)}`;\n    /* eslint-enable camelcase */\n  },\n\n  /**\n   * Get the determined OrgId.\n   *\n   * @throws {Error} - If the OrgId could not be determined.\n   * @returns {string} - The OrgId.\n   */\n  getOrgId() {\n    this.logger.info('credentials: attempting to retrieve the OrgId from token');\n\n    try {\n      // Attempt to extract a client-authenticated token's OrgId.\n      this.logger.info('credentials: trying to extract OrgId from JWT');\n\n      return this.extractOrgIdFromJWT(this.supertoken.access_token);\n    } catch (e) {\n      // Attempt to extract a user token's OrgId.\n      this.logger.info('credentials: could not extract OrgId from JWT');\n      this.logger.info('credentials: attempting to extract OrgId from user token');\n\n      try {\n        return this.extractOrgIdFromUserToken(this.supertoken?.access_token);\n      } catch (f) {\n        this.logger.info('credentials: could not extract OrgId from user token');\n        throw f;\n      }\n    }\n  },\n\n  /**\n   * Extract the OrgId [realm] from a provided JWT.\n   *\n   * @private\n   * @param {string} token - The JWT to extract the OrgId from.\n   * @throws {Error} - If the token does not pass JWT general/realm validation.\n   * @returns {string} - The OrgId.\n   */\n  extractOrgIdFromJWT(token = '') {\n    // Decoded the provided token.\n    const decodedJWT = jwt.decode(token);\n\n    // Validate that the provided token is a JWT.\n    if (!decodedJWT) {\n      throw new Error('unable to extract the OrgId from the provided JWT');\n    }\n\n    if (!decodedJWT.realm) {\n      throw new Error('the provided JWT does not contain an OrgId');\n    }\n\n    // Return the OrgId [realm].\n    return decodedJWT.realm;\n  },\n\n  /**\n   * Extract the OrgId [realm] from a provided user token.\n   *\n   * @private\n   * @param {string} token - The user token to extract the OrgId from.\n   * @throws {Error} - Will throw an error if the provided token is invalid.\n   * @returns {string} - The OrgId.\n   */\n  extractOrgIdFromUserToken(token = '') {\n    // Split the provided token into subsections.\n    const fields = token.split('_');\n\n    // Validate that the provided token has the proper amount of sections.\n    if (fields.length !== 3) {\n      throw new Error(\n        `the provided token is not a valid format, token has ${fields.length} sections`\n      );\n    }\n\n    // Return the token section that contains the OrgId.\n    return fields[2];\n  },\n\n  /**\n   * Extract the CI user ID [cis_uuid] from a provided token.\n   *\n   * @private\n   * @param {string} token - The access token to extract the user ID from.\n   * @throws {Error} - If the token cannot be parsed or does not contain a user ID.\n   * @returns {string} - The CI user ID.\n   */\n  extractUserIdFromToken(token = '') {\n    // User tokens are JWT-like; the middle section holds a base64-encoded JSON payload.\n    const payload = JSON.parse(base64.decode(token.split('.')[1]));\n\n    if (!payload.cis_uuid) {\n      throw new Error('the provided token does not contain a user ID');\n    }\n\n    return payload.cis_uuid;\n  },\n\n  /**\n   * Get the CI user ID [cis_uuid] of the currently authenticated user.\n   *\n   * Checks the supertoken first, then falls back to any stored user tokens.\n   *\n   * @throws {Error} - If the user ID could not be determined from any token.\n   * @returns {string} - The CI user ID.\n   */\n  getUserId() {\n    const tokens = [this.supertoken, ...this.userTokens.models];\n\n    for (const token of tokens) {\n      if (token && token.access_token) {\n        try {\n          return this.extractUserIdFromToken(token.access_token);\n        } catch {\n          // token wasn't parseable or lacked a user ID; try the next one\n        }\n      }\n    }\n\n    throw new Error('could not extract the user ID from any available token');\n  },\n\n  /**\n   * Generates a Third-Party Login URL pointing at IdBroker's\n   * `/idb/ThirdPartyLogin` endpoint. Used by the social-provider sign-in\n   * flow (Google / Microsoft / Apple / ...).\n   *\n   * Mirrors `buildLoginUrl` / `buildLogoutUrl` — pure URL construction,\n   * no navigation side effects. Reads from `this.config.thirdPartyLoginUrl`,\n   * which is derived from `idbroker.url` in `credentials-config.js`.\n   *\n   * @instance\n   * @memberof Credentials\n   * @param {Object} options\n   * @param {string} options.oauth2provider - Provider name (`google`,\n   *   `microsoft`, `apple`, ...). Required.\n   * @param {string} options.returnURL - URL IdBroker should send the user\n   *   back to after the third-party hand-off. Required.\n   * @param {Object} [options.state] - Optional state object. When non-empty\n   *   it is JSON-stringified and base64url-encoded, then emitted as the\n   *   top-level `state` query param so IdBroker can echo it back unchanged\n   *   on the callback (mirrors `buildLoginUrl`).\n   * @returns {string}\n   */\n  buildThirdPartyLoginUrl(options = {}) {\n    const {oauth2provider, returnURL, state} = options;\n\n    if (!oauth2provider) {\n      throw new Error('`options.oauth2provider` is required');\n    }\n    if (!returnURL) {\n      throw new Error('`options.returnURL` is required');\n    }\n    if (state !== undefined && !isObject(state)) {\n      throw new Error('if specified, `options.state` must be an object');\n    }\n\n    const query = {\n      oauth2provider,\n      returnURL,\n    };\n\n    if (state && !isEmpty(state)) {\n      query.state = encodeState(state);\n    }\n\n    return `${this.config.thirdPartyLoginUrl}?${querystring.stringify(query)}`;\n  },\n\n  /**\n   * Generates a Logout URL\n   * @instance\n   * @memberof Credentials\n   * @param {Object} [options={}]\n   * @returns {[type]}\n   */\n  buildLogoutUrl(options = {}) {\n    return `${this.config.logoutUrl}?${querystring.stringify({\n      cisService: this.config.service,\n      goto: this.config.redirect_uri,\n      ...options,\n    })}`;\n  },\n\n  /**\n   * Generates a number between 60% - 90% of expired value\n   * @instance\n   * @memberof Credentials\n   * @param {number} expiration\n   * @private\n   * @returns {number}\n   */\n  calcRefreshTimeout(expiration) {\n    return Math.floor(((Math.floor(Math.random() * 4) + 6) / 10) * expiration);\n  },\n\n  constructor(...args) {\n    // HACK to deal with the fact that AmpersandState#dataTypes#set is a pure\n    // function.\n    this._dataTypes = cloneDeep(this._dataTypes);\n    Object.keys(this._dataTypes).forEach((key) => {\n      if (this._dataTypes[key].set) {\n        this._dataTypes[key].set = this._dataTypes[key].set.bind(this);\n      }\n    });\n    // END HACK\n    Reflect.apply(WebexPlugin, this, args);\n  },\n\n  /**\n   * Downscopes a token\n   * @instance\n   * @memberof Credentials\n   * @param {string} scope\n   * @private\n   * @returns {Promise<Token>}\n   */\n  downscope(scope) {\n    return this.supertoken.downscope(scope).catch((reason) => {\n      const failReason = reason?.body ?? reason;\n      this.logger.warn(`credentials: failed to downscope supertoken to \"${scope}\"`, failReason);\n      this.logger.trace(`credentials: falling back to supertoken for ${scope}`);\n      this.webex.internal.metrics.submitClientMetrics(METRICS.JS_SDK_CREDENTIALS_DOWNSCOPE_FAILED, {\n        fields: {\n          requestedScope: scope,\n          failReason,\n        },\n      });\n\n      return Promise.resolve(new Token({scope, ...this.supertoken.serialize()}), {\n        parent: this,\n      });\n    });\n  },\n\n  /**\n   * Requests a client credentials grant and returns the token. Given the\n   * limited use for such tokens as this time, this method does not cache its\n   * token.\n   * @instance\n   * @memberof Credentials\n   * @param {Object} options\n   * @returns {Promise<Token>}\n   */\n  getClientToken(options = {}) {\n    this.logger.info('credentials: requesting client credentials grant');\n\n    return this.webex\n      .request({\n        /* eslint-disable camelcase */\n        method: 'POST',\n        uri: options.uri || this.config.tokenUrl,\n        form: {\n          grant_type: 'client_credentials',\n          scope: options.scope || 'webexsquare:admin',\n          self_contained_token: true,\n        },\n        auth: {\n          user: this.config.client_id,\n          pass: this.config.client_secret,\n          sendImmediately: true,\n        },\n        shouldRefreshAccessToken: false,\n        /* eslint-enable camelcase */\n      })\n      .then((res) => new Token(res.body, {parent: this}))\n      .catch((res) => {\n        if (res.statusCode !== 400) {\n          return Promise.reject(res);\n        }\n\n        const ErrorConstructor = grantErrors.select(res.body.error);\n\n        return Promise.reject(new ErrorConstructor(res._res || res));\n      });\n  },\n\n  @oneFlight({keyFactory: (scope) => scope})\n  @waitForValue('@')\n  /**\n   * Resolves with a token with the specified scopes. If no scope is specified,\n   * defaults to omit(webex.credentials.scope, 'spark:kms'). If no such token is\n   * available, downscopes the supertoken to that scope.\n   * @instance\n   * @memberof Credentials\n   * @param {string} scope\n   * @returns {Promise<Token>}\n   */\n  getUserToken(scope) {\n    return Promise.resolve(\n      !this.isRefreshing ||\n        new Promise((resolve) => {\n          this.logger.info(\n            'credentials: token refresh inflight; delaying getUserToken until refresh completes'\n          );\n          this.once('change:isRefreshing', () => {\n            this.logger.info('credentials: token refresh complete; reinvoking getUserToken');\n            resolve();\n          });\n        })\n    ).then(() => {\n      if (!this.canAuthorize) {\n        this.logger.info('credentials: cannot produce an access token from current state');\n\n        return Promise.reject(new Error('Current state cannot produce an access token'));\n      }\n\n      if (!scope) {\n        scope = filterScope('spark:kms', this.supertoken.scope);\n      }\n\n      scope = sortScope(scope);\n\n      if (scope === sortScope(this.supertoken.scope)) {\n        return Promise.resolve(this.supertoken);\n      }\n\n      const token = this.userTokens.get(scope);\n\n      // we should also check for the token.access_token since token object does\n      // not get cleared on unsetting while logging out.\n      if (!token || !token.access_token) {\n        return this.downscope(scope).then(tap((t) => this.userTokens.add(t)));\n      }\n\n      return Promise.resolve(token);\n    });\n  },\n\n  @persist('@')\n  /**\n   * Initializer\n   * @instance\n   * @memberof Credentials\n   * @param {Object} attrs\n   * @param {Object} options\n   * @private\n   * @returns {Credentials}\n   */\n  initialize(attrs, options) {\n    if (attrs) {\n      if (typeof attrs === 'string') {\n        this.supertoken = attrs;\n      }\n\n      if (attrs.access_token) {\n        this.supertoken = attrs;\n      }\n\n      if (attrs.authorization) {\n        if (attrs.authorization.supertoken) {\n          this.supertoken = attrs.authorization.supertoken;\n        } else {\n          this.supertoken = attrs.authorization;\n        }\n      }\n\n      // schedule refresh\n      if (this.supertoken && this.supertoken.expires) {\n        this.scheduleRefresh(this.supertoken.expires);\n      }\n    }\n\n    Reflect.apply(WebexPlugin.prototype.initialize, this, [attrs, options]);\n\n    this.listenToOnce(this.parent, 'change:config', () => {\n      if (this.config.authorizationString) {\n        const parsed = url.parse(this.config.authorizationString, true);\n\n        /* eslint-disable camelcase */\n        this.config.client_id = parsed.query.client_id;\n        this.config.redirect_uri = parsed.query.redirect_uri;\n        this.config.scope = parsed.query.scope;\n        this.config.authorizeUrl = parsed.href.substr(0, parsed.href.indexOf('?'));\n        /* eslint-enable camelcase */\n      }\n    });\n\n    this.webex.once('loaded', () => {\n      this.ready = true;\n    });\n  },\n\n  @oneFlight\n  @waitForValue('@')\n  /**\n   * Clears all tokens from store them from the stores.\n   *\n   * This is no longer quite the right name for this method, but all of the\n   * alternatives I'm coming up with are already taken.\n   * @instance\n   * @memberof Credentials\n   * @returns {Promise}\n   */\n  invalidate() {\n    this.logger.info('credentials: invalidating tokens');\n\n    // clear refresh timer\n    if (this.refreshTimer) {\n      clearTimeout(this.refreshTimer);\n      this.unset('refreshTimer');\n    }\n\n    try {\n      this.unset('supertoken');\n    } catch (err) {\n      this.logger.warn('credentials: failed to clear supertoken', err);\n    }\n\n    while (this.userTokens.models.length) {\n      try {\n        this.userTokens.remove(this.userTokens.models[0]);\n      } catch (err) {\n        this.logger.warn('credentials: failed to remove user token', err);\n      }\n    }\n\n    this.logger.info('credentials: finished removing tokens');\n\n    // Return a promise to give the storage layer a tick or two to clear\n    // localStorage\n    return Promise.resolve();\n  },\n\n  @oneFlight\n  @whileInFlight('isRefreshing')\n  @waitForValue('@')\n  /**\n   * Removes the supertoken and child tokens, then refreshes the supertoken;\n   * subsequent calls to {@link Credentials#getUserToken()} will re-downscope\n   * child tokens. Enqueus revocation of previous previousTokens. Yes, that's\n   * the correct number of \"previous\"es.\n   * @instance\n   * @memberof Credentials\n   * @returns {Promise}\n   */\n  refresh() {\n    this.logger.info('credentials: refresh requested');\n\n    const {supertoken} = this;\n    const tokens = clone(this.userTokens.models);\n\n    // This is kind of a leaky abstraction, since it relies on the authorization\n    // plugin, but the only alternatives I see are\n    // 1. put all JWT support in core\n    // 2. have separate jwt and non-jwt auth plugins\n    // while I like #2 from a code simplicity standpoint, the third-party DX\n    // isn't great\n    if (this.config.jwtRefreshCallback) {\n      return (\n        this.config\n          .jwtRefreshCallback(this.webex)\n          // eslint-disable-next-line no-shadow\n          .then((jwt) => this.webex.authorization.requestAccessTokenFromJwt({jwt}))\n      );\n    }\n\n    if (this.webex.internal.services) {\n      this.webex.internal.services.updateCredentialsConfig();\n    }\n\n    return supertoken\n      .refresh()\n      .catch((error) => {\n        if (error instanceof OAuthError) {\n          // Error: super token refresh failed with 400 status code.\n          // Hence emit an event to the client, an opportunity to logout.\n          this.unset('supertoken');\n          while (this.userTokens.models.length) {\n            try {\n              this.userTokens.remove(this.userTokens.models[0]);\n            } catch (err) {\n              this.logger.warn('credentials: failed to remove user token', err);\n            }\n          }\n          this.webex.trigger('client:InvalidRequestError');\n        }\n\n        return Promise.reject(error);\n      })\n      .then((st) => {\n        // clear refresh timer\n        if (this.refreshTimer) {\n          clearTimeout(this.refreshTimer);\n          this.unset('refreshTimer');\n        }\n        this.supertoken = st;\n\n        const invalidScopes = diffScopes(this.config.scope, st.scope);\n\n        if (invalidScopes !== '') {\n          this.logger.warn(\n            `credentials: \"${invalidScopes}\" scope(s) are invalid because not listed in the supertoken, they will be excluded from user token requests.`\n          );\n          this.webex.internal.metrics.submitClientMetrics(\n            METRICS.JS_SDK_CREDENTIALS_TOKEN_REFRESH_SCOPE_MISMATCH,\n            {fields: {invalidScopes}}\n          );\n        }\n\n        return Promise.all(\n          tokens.map((token) => {\n            const tokenScope = filterScope(diffScopes(token.scope, st.scope), token.scope);\n\n            return (\n              this.downscope(tokenScope)\n                // eslint-disable-next-line max-nested-callbacks\n                .then((t) => {\n                  this.logger.info(`credentials: revoking token for ${token.scope}`);\n\n                  return token\n                    .revoke()\n                    .catch((err) => {\n                      this.logger.warn('credentials: failed to revoke user token', err);\n                    })\n                    .then(() => {\n                      this.userTokens.remove(token.scope);\n                      this.userTokens.add(t);\n                    });\n                })\n            );\n          })\n        );\n      })\n      .then(() => {\n        this.scheduleRefresh(this.supertoken.expires);\n      });\n  },\n\n  /**\n   * Schedules a token refresh or refreshes the token if token has expired\n   * @instance\n   * @memberof Credentials\n   * @param {number} expires\n   * @private\n   * @returns {undefined}\n   */\n  scheduleRefresh(expires) {\n    const expiresIn = expires - Date.now();\n\n    if (expiresIn > 0) {\n      const timeoutLength = this.calcRefreshTimeout(expiresIn);\n\n      this.refreshTimer = safeSetTimeout(() => this.refresh(), timeoutLength);\n    } else {\n      this.refresh();\n    }\n  },\n});\n\nexport default Credentials;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,IAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,aAAA,GAAAH,sBAAA,CAAAC,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AACA,IAAAK,OAAA,GAAAL,OAAA;AAEA,IAAAM,YAAA,GAAAP,sBAAA,CAAAC,OAAA;AACA,IAAAO,WAAA,GAAAP,OAAA;AAEA,IAAAQ,YAAA,GAAAC,uBAAA,CAAAT,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,MAAA,GAAAZ,sBAAA,CAAAC,OAAA;AACA,IAAAY,gBAAA,GAAAb,sBAAA,CAAAC,OAAA;AACA,IAAAa,UAAA,GAAAb,OAAA;AAAqC,IAAAc,IAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,KAAA,EAAAC,IAAA;AAnBrC;AACA;AACA;AAFA,SAAAX,wBAAAY,CAAA,EAAAC,CAAA,6BAAAC,QAAA,MAAAC,CAAA,OAAAD,QAAA,IAAAE,CAAA,OAAAF,QAAA,YAAAd,uBAAA,YAAAA,wBAAAY,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,gBAAAW,OAAA,CAAAX,CAAA,0BAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAM,GAAA,CAAAZ,CAAA,UAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,GAAAM,CAAA,CAAAQ,GAAA,CAAAd,CAAA,EAAAQ,CAAA,cAAAO,EAAA,IAAAf,CAAA,gBAAAe,EAAA,OAAAC,cAAA,CAAAC,IAAA,CAAAjB,CAAA,EAAAe,EAAA,OAAAR,CAAA,IAAAD,CAAA,GAAAY,sBAAA,KAAAC,iCAAA,CAAAnB,CAAA,EAAAe,EAAA,OAAAR,CAAA,CAAAM,GAAA,IAAAN,CAAA,CAAAO,GAAA,IAAAR,CAAA,CAAAE,CAAA,EAAAO,EAAA,EAAAR,CAAA,IAAAC,CAAA,CAAAO,EAAA,IAAAf,CAAA,CAAAe,EAAA,WAAAP,CAAA,KAAAR,CAAA,EAAAC,CAAA;AAAA,SAAAmB,QAAApB,CAAA,EAAAG,CAAA,QAAAF,CAAA,GAAAoB,aAAA,CAAArB,CAAA,OAAAsB,6BAAA,QAAAhB,CAAA,GAAAgB,6BAAA,CAAAtB,CAAA,GAAAG,CAAA,KAAAG,CAAA,GAAAA,CAAA,CAAAiB,MAAA,WAAApB,CAAA,WAAAgB,iCAAA,CAAAnB,CAAA,EAAAG,CAAA,EAAAqB,UAAA,OAAAvB,CAAA,CAAAwB,IAAA,CAAAC,KAAA,CAAAzB,CAAA,EAAAK,CAAA,YAAAL,CAAA;AAAA,SAAA0B,cAAA3B,CAAA,aAAAG,CAAA,MAAAA,CAAA,GAAAyB,SAAA,CAAAC,MAAA,EAAA1B,CAAA,UAAAF,CAAA,WAAA2B,SAAA,CAAAzB,CAAA,IAAAyB,SAAA,CAAAzB,CAAA,QAAAA,CAAA,OAAAiB,OAAA,CAAAU,MAAA,CAAA7B,CAAA,OAAA8B,OAAA,WAAA5B,CAAA,QAAA6B,gBAAA,CAAAtB,OAAA,EAAAV,CAAA,EAAAG,CAAA,EAAAF,CAAA,CAAAE,CAAA,SAAA8B,iCAAA,GAAAC,wBAAA,CAAAlC,CAAA,EAAAiC,iCAAA,CAAAhC,CAAA,KAAAmB,OAAA,CAAAU,MAAA,CAAA7B,CAAA,GAAA8B,OAAA,WAAA5B,CAAA,IAAAe,sBAAA,CAAAlB,CAAA,EAAAG,CAAA,EAAAgB,iCAAA,CAAAlB,CAAA,EAAAE,CAAA,iBAAAH,CAAA;AAAA,SAAAmC,2BAAAhC,CAAA,EAAAH,CAAA,QAAAC,CAAA,yBAAAmC,OAAA,IAAAjC,CAAA,CAAAkC,gBAAA,KAAAlC,CAAA,qBAAAF,CAAA,QAAAqC,cAAA,CAAAnC,CAAA,MAAAF,CAAA,GAAAsC,2BAAA,CAAApC,CAAA,MAAAH,CAAA,IAAAG,CAAA,uBAAAA,CAAA,CAAA0B,MAAA,IAAA5B,CAAA,KAAAE,CAAA,GAAAF,CAAA,OAAAuC,EAAA,MAAAC,CAAA,YAAAA,EAAA,eAAAC,CAAA,EAAAD,CAAA,EAAArC,CAAA,WAAAA,EAAA,WAAAoC,EAAA,IAAArC,CAAA,CAAA0B,MAAA,KAAAc,IAAA,WAAAA,IAAA,MAAAC,KAAA,EAAAzC,CAAA,CAAAqC,EAAA,UAAAxC,CAAA,WAAAA,EAAAG,CAAA,UAAAA,CAAA,KAAAK,CAAA,EAAAiC,CAAA,gBAAAI,SAAA,iJAAAvC,CAAA,EAAAwC,CAAA,OAAAC,CAAA,gBAAAL,CAAA,WAAAA,EAAA,IAAAzC,CAAA,GAAAA,CAAA,CAAAgB,IAAA,CAAAd,CAAA,MAAAC,CAAA,WAAAA,EAAA,QAAAD,CAAA,GAAAF,CAAA,CAAA+C,IAAA,WAAAF,CAAA,GAAA3C,CAAA,CAAAwC,IAAA,EAAAxC,CAAA,KAAAH,CAAA,WAAAA,EAAAG,CAAA,IAAA4C,CAAA,OAAAzC,CAAA,GAAAH,CAAA,KAAAK,CAAA,WAAAA,EAAA,UAAAsC,CAAA,YAAA7C,CAAA,CAAAgD,MAAA,IAAAhD,CAAA,CAAAgD,MAAA,oBAAAF,CAAA,QAAAzC,CAAA;AAAA,SAAAiC,4BAAApC,CAAA,EAAA2C,CAAA,QAAA3C,CAAA,2BAAAA,CAAA,SAAA+C,iBAAA,CAAA/C,CAAA,EAAA2C,CAAA,OAAA7C,CAAA,MAAAkD,QAAA,CAAAlC,IAAA,CAAAd,CAAA,EAAAiD,KAAA,6BAAAnD,CAAA,IAAAE,CAAA,CAAAkD,WAAA,KAAApD,CAAA,GAAAE,CAAA,CAAAkD,WAAA,CAAAC,IAAA,aAAArD,CAAA,cAAAA,CAAA,GAAAsD,WAAA,CAAApD,CAAA,oBAAAF,CAAA,+CAAAuD,IAAA,CAAAvD,CAAA,IAAAiD,iBAAA,CAAA/C,CAAA,EAAA2C,CAAA;AAAA,SAAAI,kBAAA/C,CAAA,EAAA2C,CAAA,aAAAA,CAAA,IAAAA,CAAA,GAAA3C,CAAA,CAAA0B,MAAA,MAAAiB,CAAA,GAAA3C,CAAA,CAAA0B,MAAA,YAAA7B,CAAA,MAAAI,CAAA,GAAAqD,KAAA,CAAAX,CAAA,GAAA9C,CAAA,GAAA8C,CAAA,EAAA9C,CAAA,IAAAI,CAAA,CAAAJ,CAAA,IAAAG,CAAA,CAAAH,CAAA,UAAAI,CAAA;AAqBA;AACA;AACA;AACA,IAAMsD,WAAW,GAAGC,oBAAW,CAACC,MAAM,EAAAnE,IAAA,GAoYnC,IAAAoE,iBAAS,EAAC;EAACC,UAAU,EAAE,SAAZA,UAAUA,CAAGC,KAAK;IAAA,OAAKA,KAAK;EAAA;AAAA,CAAC,CAAC,EAAArE,KAAA,GACzC,IAAAsE,wBAAY,EAAC,GAAG,CAAC,EAAArE,KAAA,GAmDjB,IAAAsE,mBAAO,EAAC,GAAG,CAAC,EAAArE,KAAA,GAuDZ,IAAAoE,wBAAY,EAAC,GAAG,CAAC,EAAAnE,KAAA,GAyCjB,IAAAqE,qBAAa,EAAC,cAAc,CAAC,EAAApE,KAAA,GAC7B,IAAAkE,wBAAY,EAAC,GAAG,CAAC,EAAAjE,IAAA,GAzhBmB;EACrCoE,WAAW,EAAE;IACXC,UAAU,EAAEC;EACd,CAAC;EAEDC,SAAS,EAAE;IACTC,KAAK,EAAE,IAAAC,yBAAiB,EAACC,cAAK,EAAE,OAAO,CAAC,CAACC;EAC3C,CAAC;EAEDC,OAAO,EAAE;IACPC,YAAY,EAAE;MACZC,IAAI,EAAE,CAAC,YAAY,EAAE,yBAAyB,EAAE,YAAY,CAAC;MAC7DC,EAAE,WAAFA,EAAEA,CAAA,EAAG;QACH,OAAOC,OAAO,CAAE,IAAI,CAACC,UAAU,IAAI,IAAI,CAACA,UAAU,CAACJ,YAAY,IAAK,IAAI,CAACK,UAAU,CAAC;MACtF;IACF,CAAC;IACDA,UAAU,EAAE;MACVJ,IAAI,EAAE,CAAC,YAAY,EAAE,uBAAuB,CAAC;MAC7CC,EAAE,WAAFA,EAAEA,CAAA,EAAG;QACH;QACA,IAAI,IAAI,CAACI,MAAM,CAACC,kBAAkB,EAAE;UAClC,OAAO,IAAI;QACb;QAEA,OAAOJ,OAAO,CAAC,IAAI,CAACC,UAAU,IAAI,IAAI,CAACA,UAAU,CAACC,UAAU,CAAC;MAC/D;IACF,CAAC;IACDG,iBAAiB,EAAE;MACjBP,IAAI,EAAE,CAAC,YAAY,CAAC;MACpB;AACN;AACA;AACA;MACMC,EAAE,WAAFA,EAAEA,CAAA,EAAG;QACH,IAAIO,OAAO,GAAG,KAAK;QACnB,IAAI;UACFA,OAAO,GACLC,IAAI,CAACC,KAAK,CAACC,cAAM,CAACC,MAAM,CAAC,IAAI,CAACT,UAAU,CAACU,YAAY,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAACC,SAAS,KAC/E,OAAO;QACX,CAAC,CAAC,OAAAC,OAAA,EAAM;UACN;QAAA;QAGF,OAAOR,OAAO;MAChB;IACF;EACF,CAAC;EAEDS,KAAK,EAAE;IACLd,UAAU,EAAE,IAAAR,yBAAiB,EAACC,cAAK,EAAE,OAAO,CAAC,CAACsB;EAChD,CAAC;EAEDC,SAAS,EAAE,aAAa;EAExBC,OAAO,EAAE;IACPC,YAAY,EAAE;MACZxF,OAAO,EAAE,KAAK;MACdyF,IAAI,EAAE;IACR,CAAC;IACD;AACJ;AACA;AACA;AACA;AACA;AACA;IACIC,KAAK,EAAE;MACL1F,OAAO,EAAE,KAAK;MACdyF,IAAI,EAAE;IACR,CAAC;IACDE,YAAY,EAAE;MACZ3F,OAAO,EAAE4F,SAAS;MAClBH,IAAI,EAAE;IACR;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEI,aAAa,WAAbA,aAAaA,CAAA,EAAmC;IAAA,IAAlCC,OAAO,GAAA5E,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAA0E,SAAA,GAAA1E,SAAA,MAAG;MAAC6E,UAAU,EAAE;IAAQ,CAAC;IAC5C;IACA,IAAID,OAAO,CAACE,KAAK,KAAKJ,SAAS,IAAI,CAAC,IAAAK,gBAAQ,EAACH,OAAO,CAACE,KAAK,CAAC,EAAE;MAC3D,MAAM,IAAIE,KAAK,CAAC,iDAAiD,CAAC;IACpE;IAEAJ,OAAO,CAACK,SAAS,GAAG,IAAI,CAAC3B,MAAM,CAAC2B,SAAS;IACzCL,OAAO,CAACM,YAAY,GAAG,IAAI,CAAC5B,MAAM,CAAC4B,YAAY;IAC/CN,OAAO,CAACzC,KAAK,GAAG,IAAI,CAACmB,MAAM,CAACnB,KAAK;IAEjCyC,OAAO,GAAG,IAAAO,iBAAS,EAACP,OAAO,CAAC;IAE5B,IAAI,CAACA,OAAO,CAACQ,aAAa,EAAE;MAC1BR,OAAO,CAACQ,aAAa,GAAGR,OAAO,CAACC,UAAU,KAAK,QAAQ,GAAG,OAAO,GAAG,MAAM;IAC5E;IACA,IAAAQ,eAAA,CAAAvG,OAAA,EAAuB8F,OAAO,EAAE,YAAY,CAAC;IAE7C,IAAIA,OAAO,CAACE,KAAK,EAAE;MACjB,IAAI,CAAC,IAAAQ,eAAO,EAACV,OAAO,CAACE,KAAK,CAAC,EAAE;QAC3BF,OAAO,CAACE,KAAK,GAAG,IAAAS,mBAAW,EAACX,OAAO,CAACE,KAAK,CAAC;MAC5C,CAAC,MAAM;QACL,OAAOF,OAAO,CAACE,KAAK;MACtB;IACF;IAEA,UAAAU,MAAA,CAAU,IAAI,CAAClC,MAAM,CAACmC,YAAY,OAAAD,MAAA,CAAIE,oBAAW,CAACC,SAAS,CAACf,OAAO,CAAC;IACpE;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEgB,QAAQ,WAARA,QAAQA,CAAA,EAAG;IACT,IAAI,CAACC,MAAM,CAACC,IAAI,CAAC,0DAA0D,CAAC;IAE5E,IAAI;MACF;MACA,IAAI,CAACD,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;MAEjE,OAAO,IAAI,CAACC,mBAAmB,CAAC,IAAI,CAAC3C,UAAU,CAACU,YAAY,CAAC;IAC/D,CAAC,CAAC,OAAO1F,CAAC,EAAE;MACV;MACA,IAAI,CAACyH,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;MACjE,IAAI,CAACD,MAAM,CAACC,IAAI,CAAC,0DAA0D,CAAC;MAE5E,IAAI;QAAA,IAAAE,gBAAA;QACF,OAAO,IAAI,CAACC,yBAAyB,EAAAD,gBAAA,GAAC,IAAI,CAAC5C,UAAU,cAAA4C,gBAAA,uBAAfA,gBAAA,CAAiBlC,YAAY,CAAC;MACtE,CAAC,CAAC,OAAOlF,CAAC,EAAE;QACV,IAAI,CAACiH,MAAM,CAACC,IAAI,CAAC,sDAAsD,CAAC;QACxE,MAAMlH,CAAC;MACT;IACF;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEmH,mBAAmB,WAAnBA,mBAAmBA,CAAA,EAAa;IAAA,IAAZpD,KAAK,GAAA3C,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAA0E,SAAA,GAAA1E,SAAA,MAAG,EAAE;IAC5B;IACA,IAAMkG,UAAU,GAAGC,qBAAG,CAACtC,MAAM,CAAClB,KAAK,CAAC;;IAEpC;IACA,IAAI,CAACuD,UAAU,EAAE;MACf,MAAM,IAAIlB,KAAK,CAAC,mDAAmD,CAAC;IACtE;IAEA,IAAI,CAACkB,UAAU,CAACE,KAAK,EAAE;MACrB,MAAM,IAAIpB,KAAK,CAAC,4CAA4C,CAAC;IAC/D;;IAEA;IACA,OAAOkB,UAAU,CAACE,KAAK;EACzB,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEH,yBAAyB,WAAzBA,yBAAyBA,CAAA,EAAa;IAAA,IAAZtD,KAAK,GAAA3C,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAA0E,SAAA,GAAA1E,SAAA,MAAG,EAAE;IAClC;IACA,IAAMqG,MAAM,GAAG1D,KAAK,CAACoB,KAAK,CAAC,GAAG,CAAC;;IAE/B;IACA,IAAIsC,MAAM,CAACpG,MAAM,KAAK,CAAC,EAAE;MACvB,MAAM,IAAI+E,KAAK,wDAAAQ,MAAA,CAC0Ca,MAAM,CAACpG,MAAM,cACtE,CAAC;IACH;;IAEA;IACA,OAAOoG,MAAM,CAAC,CAAC,CAAC;EAClB,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,sBAAsB,WAAtBA,sBAAsBA,CAAA,EAAa;IAAA,IAAZ3D,KAAK,GAAA3C,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAA0E,SAAA,GAAA1E,SAAA,MAAG,EAAE;IAC/B;IACA,IAAMuG,OAAO,GAAG7C,IAAI,CAACC,KAAK,CAACC,cAAM,CAACC,MAAM,CAAClB,KAAK,CAACoB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,IAAI,CAACwC,OAAO,CAACC,QAAQ,EAAE;MACrB,MAAM,IAAIxB,KAAK,CAAC,+CAA+C,CAAC;IAClE;IAEA,OAAOuB,OAAO,CAACC,QAAQ;EACzB,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,SAAS,WAATA,SAASA,CAAA,EAAG;IACV,IAAMC,MAAM,IAAI,IAAI,CAACtD,UAAU,EAAAoC,MAAA,KAAAmB,mBAAA,CAAA7H,OAAA,EAAK,IAAI,CAAC0D,UAAU,CAACoE,MAAM,EAAC;IAAC,IAAAC,SAAA,GAAAtG,0BAAA,CAExCmG,MAAM;MAAAI,KAAA;IAAA;MAA1B,KAAAD,SAAA,CAAA/F,CAAA,MAAAgG,KAAA,GAAAD,SAAA,CAAArI,CAAA,IAAAuC,IAAA,GAA4B;QAAA,IAAjB4B,KAAK,GAAAmE,KAAA,CAAA9F,KAAA;QACd,IAAI2B,KAAK,IAAIA,KAAK,CAACmB,YAAY,EAAE;UAC/B,IAAI;YACF,OAAO,IAAI,CAACwC,sBAAsB,CAAC3D,KAAK,CAACmB,YAAY,CAAC;UACxD,CAAC,CAAC,OAAAiD,QAAA,EAAM;YACN;UAAA;QAEJ;MACF;IAAC,SAAAC,GAAA;MAAAH,SAAA,CAAAzI,CAAA,CAAA4I,GAAA;IAAA;MAAAH,SAAA,CAAAjI,CAAA;IAAA;IAED,MAAM,IAAIoG,KAAK,CAAC,wDAAwD,CAAC;EAC3E,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEiC,uBAAuB,WAAvBA,uBAAuBA,CAAA,EAAe;IAAA,IAAdrC,OAAO,GAAA5E,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAA0E,SAAA,GAAA1E,SAAA,MAAG,CAAC,CAAC;IAClC,IAAOkH,cAAc,GAAsBtC,OAAO,CAA3CsC,cAAc;MAAEC,SAAS,GAAWvC,OAAO,CAA3BuC,SAAS;MAAErC,KAAK,GAAIF,OAAO,CAAhBE,KAAK;IAEvC,IAAI,CAACoC,cAAc,EAAE;MACnB,MAAM,IAAIlC,KAAK,CAAC,sCAAsC,CAAC;IACzD;IACA,IAAI,CAACmC,SAAS,EAAE;MACd,MAAM,IAAInC,KAAK,CAAC,iCAAiC,CAAC;IACpD;IACA,IAAIF,KAAK,KAAKJ,SAAS,IAAI,CAAC,IAAAK,gBAAQ,EAACD,KAAK,CAAC,EAAE;MAC3C,MAAM,IAAIE,KAAK,CAAC,iDAAiD,CAAC;IACpE;IAEA,IAAMoC,KAAK,GAAG;MACZF,cAAc,EAAdA,cAAc;MACdC,SAAS,EAATA;IACF,CAAC;IAED,IAAIrC,KAAK,IAAI,CAAC,IAAAQ,eAAO,EAACR,KAAK,CAAC,EAAE;MAC5BsC,KAAK,CAACtC,KAAK,GAAG,IAAAS,mBAAW,EAACT,KAAK,CAAC;IAClC;IAEA,UAAAU,MAAA,CAAU,IAAI,CAAClC,MAAM,CAAC+D,kBAAkB,OAAA7B,MAAA,CAAIE,oBAAW,CAACC,SAAS,CAACyB,KAAK,CAAC;EAC1E,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEE,cAAc,WAAdA,cAAcA,CAAA,EAAe;IAAA,IAAd1C,OAAO,GAAA5E,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAA0E,SAAA,GAAA1E,SAAA,MAAG,CAAC,CAAC;IACzB,UAAAwF,MAAA,CAAU,IAAI,CAAClC,MAAM,CAACiE,SAAS,OAAA/B,MAAA,CAAIE,oBAAW,CAACC,SAAS,CAAA5F,aAAA;MACtDyH,UAAU,EAAE,IAAI,CAAClE,MAAM,CAACmE,OAAO;MAC/BC,IAAI,EAAE,IAAI,CAACpE,MAAM,CAAC4B;IAAY,GAC3BN,OAAO,CACX,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE+C,kBAAkB,WAAlBA,kBAAkBA,CAACC,UAAU,EAAE;IAC7B,OAAOC,IAAI,CAACC,KAAK,CAAE,CAACD,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAIH,UAAU,CAAC;EAC5E,CAAC;EAEDnG,WAAW,WAAXA,WAAWA,CAAA,EAAU;IAAA,IAAAuG,KAAA;IACnB;IACA;IACA,IAAI,CAACC,UAAU,GAAG,IAAA9C,iBAAS,EAAC,IAAI,CAAC8C,UAAU,CAAC;IAC5C,IAAAC,KAAA,CAAApJ,OAAA,EAAY,IAAI,CAACmJ,UAAU,CAAC,CAAC9H,OAAO,CAAC,UAACgI,GAAG,EAAK;MAC5C,IAAIH,KAAI,CAACC,UAAU,CAACE,GAAG,CAAC,CAACjJ,GAAG,EAAE;QAC5B8I,KAAI,CAACC,UAAU,CAACE,GAAG,CAAC,CAACjJ,GAAG,GAAG8I,KAAI,CAACC,UAAU,CAACE,GAAG,CAAC,CAACjJ,GAAG,CAACkJ,IAAI,CAACJ,KAAI,CAAC;MAChE;IACF,CAAC,CAAC;IACF;IAAA,SAAAK,IAAA,GAAArI,SAAA,CAAAC,MAAA,EATaqI,IAAI,OAAAzG,KAAA,CAAAwG,IAAA,GAAAE,IAAA,MAAAA,IAAA,GAAAF,IAAA,EAAAE,IAAA;MAAJD,IAAI,CAAAC,IAAA,IAAAvI,SAAA,CAAAuI,IAAA;IAAA;IAUjB,IAAAC,MAAA,CAAA1J,OAAA,EAAciD,oBAAW,EAAE,IAAI,EAAEuG,IAAI,CAAC;EACxC,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEG,SAAS,WAATA,SAASA,CAACtG,KAAK,EAAE;IAAA,IAAAuG,MAAA;IACf,OAAO,IAAI,CAACtF,UAAU,CAACqF,SAAS,CAACtG,KAAK,CAAC,CAACwG,KAAK,CAAC,UAACC,MAAM,EAAK;MAAA,IAAAC,YAAA;MACxD,IAAMC,UAAU,IAAAD,YAAA,GAAGD,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,IAAI,cAAAF,YAAA,cAAAA,YAAA,GAAID,MAAM;MACzCF,MAAI,CAAC7C,MAAM,CAACmD,IAAI,qDAAAxD,MAAA,CAAoDrD,KAAK,SAAK2G,UAAU,CAAC;MACzFJ,MAAI,CAAC7C,MAAM,CAACoD,KAAK,gDAAAzD,MAAA,CAAgDrD,KAAK,CAAE,CAAC;MACzEuG,MAAI,CAACQ,KAAK,CAACC,QAAQ,CAACC,OAAO,CAACC,mBAAmB,CAACC,kBAAO,CAACC,mCAAmC,EAAE;QAC3FlD,MAAM,EAAE;UACNmD,cAAc,EAAErH,KAAK;UACrB2G,UAAU,EAAVA;QACF;MACF,CAAC,CAAC;MAEF,OAAOW,QAAA,CAAA3K,OAAA,CAAQ4K,OAAO,CAAC,IAAI7G,cAAK,CAAA9C,aAAA;QAAEoC,KAAK,EAALA;MAAK,GAAKuG,MAAI,CAACtF,UAAU,CAACuG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;QACzEC,MAAM,EAAElB;MACV,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEmB,cAAc,WAAdA,cAAcA,CAAA,EAAe;IAAA,IAAAC,MAAA;IAAA,IAAdlF,OAAO,GAAA5E,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAA0E,SAAA,GAAA1E,SAAA,MAAG,CAAC,CAAC;IACzB,IAAI,CAAC6F,MAAM,CAACC,IAAI,CAAC,kDAAkD,CAAC;IAEpE,OAAO,IAAI,CAACoD,KAAK,CACda,OAAO,CAAC;MACP;MACAC,MAAM,EAAE,MAAM;MACdC,GAAG,EAAErF,OAAO,CAACqF,GAAG,IAAI,IAAI,CAAC3G,MAAM,CAAC4G,QAAQ;MACxCC,IAAI,EAAE;QACJC,UAAU,EAAE,oBAAoB;QAChCjI,KAAK,EAAEyC,OAAO,CAACzC,KAAK,IAAI,mBAAmB;QAC3CkI,oBAAoB,EAAE;MACxB,CAAC;MACDC,IAAI,EAAE;QACJC,IAAI,EAAE,IAAI,CAACjH,MAAM,CAAC2B,SAAS;QAC3BuF,IAAI,EAAE,IAAI,CAAClH,MAAM,CAACmH,aAAa;QAC/BC,eAAe,EAAE;MACnB,CAAC;MACDC,wBAAwB,EAAE;MAC1B;IACF,CAAC,CAAC,CACDC,IAAI,CAAC,UAACC,GAAG;MAAA,OAAK,IAAIhI,cAAK,CAACgI,GAAG,CAAC9B,IAAI,EAAE;QAACa,MAAM,EAAEE;MAAI,CAAC,CAAC;IAAA,EAAC,CAClDnB,KAAK,CAAC,UAACkC,GAAG,EAAK;MACd,IAAIA,GAAG,CAACC,UAAU,KAAK,GAAG,EAAE;QAC1B,OAAOrB,QAAA,CAAA3K,OAAA,CAAQiM,MAAM,CAACF,GAAG,CAAC;MAC5B;MAEA,IAAMG,gBAAgB,GAAGC,oBAAW,CAACC,MAAM,CAACL,GAAG,CAAC9B,IAAI,CAACoC,KAAK,CAAC;MAE3D,OAAO1B,QAAA,CAAA3K,OAAA,CAAQiM,MAAM,CAAC,IAAIC,gBAAgB,CAACH,GAAG,CAACO,IAAI,IAAIP,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC;EACN,CAAC;EAID;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEQ,YAAY,WAAZA,YAAYA,CAAClJ,KAAK,EAAE;IAAA,IAAAmJ,MAAA;IAClB,OAAO7B,QAAA,CAAA3K,OAAA,CAAQ4K,OAAO,CACpB,CAAC,IAAI,CAACpF,YAAY,IAChB,IAAAmF,QAAA,CAAA3K,OAAA,CAAY,UAAC4K,OAAO,EAAK;MACvB4B,MAAI,CAACzF,MAAM,CAACC,IAAI,CACd,oFACF,CAAC;MACDwF,MAAI,CAACC,IAAI,CAAC,qBAAqB,EAAE,YAAM;QACrCD,MAAI,CAACzF,MAAM,CAACC,IAAI,CAAC,8DAA8D,CAAC;QAChF4D,OAAO,CAAC,CAAC;MACX,CAAC,CAAC;IACJ,CAAC,CACL,CAAC,CAACkB,IAAI,CAAC,YAAM;MACX,IAAI,CAACU,MAAI,CAACtI,YAAY,EAAE;QACtBsI,MAAI,CAACzF,MAAM,CAACC,IAAI,CAAC,gEAAgE,CAAC;QAElF,OAAO2D,QAAA,CAAA3K,OAAA,CAAQiM,MAAM,CAAC,IAAI/F,KAAK,CAAC,8CAA8C,CAAC,CAAC;MAClF;MAEA,IAAI,CAAC7C,KAAK,EAAE;QACVA,KAAK,GAAG,IAAAqJ,kBAAW,EAAC,WAAW,EAAEF,MAAI,CAAClI,UAAU,CAACjB,KAAK,CAAC;MACzD;MAEAA,KAAK,GAAG,IAAAsJ,gBAAS,EAACtJ,KAAK,CAAC;MAExB,IAAIA,KAAK,KAAK,IAAAsJ,gBAAS,EAACH,MAAI,CAAClI,UAAU,CAACjB,KAAK,CAAC,EAAE;QAC9C,OAAOsH,QAAA,CAAA3K,OAAA,CAAQ4K,OAAO,CAAC4B,MAAI,CAAClI,UAAU,CAAC;MACzC;MAEA,IAAMT,KAAK,GAAG2I,MAAI,CAAC9I,UAAU,CAACvD,GAAG,CAACkD,KAAK,CAAC;;MAExC;MACA;MACA,IAAI,CAACQ,KAAK,IAAI,CAACA,KAAK,CAACmB,YAAY,EAAE;QACjC,OAAOwH,MAAI,CAAC7C,SAAS,CAACtG,KAAK,CAAC,CAACyI,IAAI,CAAC,IAAAc,WAAG,EAAC,UAACrN,CAAC;UAAA,OAAKiN,MAAI,CAAC9I,UAAU,CAACmJ,GAAG,CAACtN,CAAC,CAAC;QAAA,EAAC,CAAC;MACvE;MAEA,OAAOoL,QAAA,CAAA3K,OAAA,CAAQ4K,OAAO,CAAC/G,KAAK,CAAC;IAC/B,CAAC,CAAC;EACJ,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEiJ,UAAU,WAAVA,UAAUA,CAACC,KAAK,EAAEjH,OAAO,EAAE;IAAA,IAAAkH,MAAA;IACzB,IAAID,KAAK,EAAE;MACT,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE;QAC7B,IAAI,CAACzI,UAAU,GAAGyI,KAAK;MACzB;MAEA,IAAIA,KAAK,CAAC/H,YAAY,EAAE;QACtB,IAAI,CAACV,UAAU,GAAGyI,KAAK;MACzB;MAEA,IAAIA,KAAK,CAACE,aAAa,EAAE;QACvB,IAAIF,KAAK,CAACE,aAAa,CAAC3I,UAAU,EAAE;UAClC,IAAI,CAACA,UAAU,GAAGyI,KAAK,CAACE,aAAa,CAAC3I,UAAU;QAClD,CAAC,MAAM;UACL,IAAI,CAACA,UAAU,GAAGyI,KAAK,CAACE,aAAa;QACvC;MACF;;MAEA;MACA,IAAI,IAAI,CAAC3I,UAAU,IAAI,IAAI,CAACA,UAAU,CAAC4I,OAAO,EAAE;QAC9C,IAAI,CAACC,eAAe,CAAC,IAAI,CAAC7I,UAAU,CAAC4I,OAAO,CAAC;MAC/C;IACF;IAEA,IAAAxD,MAAA,CAAA1J,OAAA,EAAciD,oBAAW,CAACmK,SAAS,CAACN,UAAU,EAAE,IAAI,EAAE,CAACC,KAAK,EAAEjH,OAAO,CAAC,CAAC;IAEvE,IAAI,CAACuH,YAAY,CAAC,IAAI,CAACvC,MAAM,EAAE,eAAe,EAAE,YAAM;MACpD,IAAIkC,MAAI,CAACxI,MAAM,CAAC8I,mBAAmB,EAAE;QACnC,IAAMC,MAAM,GAAGC,YAAG,CAAC3I,KAAK,CAACmI,MAAI,CAACxI,MAAM,CAAC8I,mBAAmB,EAAE,IAAI,CAAC;;QAE/D;QACAN,MAAI,CAACxI,MAAM,CAAC2B,SAAS,GAAGoH,MAAM,CAACjF,KAAK,CAACnC,SAAS;QAC9C6G,MAAI,CAACxI,MAAM,CAAC4B,YAAY,GAAGmH,MAAM,CAACjF,KAAK,CAAClC,YAAY;QACpD4G,MAAI,CAACxI,MAAM,CAACnB,KAAK,GAAGkK,MAAM,CAACjF,KAAK,CAACjF,KAAK;QACtC2J,MAAI,CAACxI,MAAM,CAACmC,YAAY,GAAG4G,MAAM,CAACE,IAAI,CAACC,MAAM,CAAC,CAAC,EAAEH,MAAM,CAACE,IAAI,CAACE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1E;MACF;IACF,CAAC,CAAC;IAEF,IAAI,CAACvD,KAAK,CAACqC,IAAI,CAAC,QAAQ,EAAE,YAAM;MAC9BO,MAAI,CAACtH,KAAK,GAAG,IAAI;IACnB,CAAC,CAAC;EACJ,CAAC;EAID;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEkI,UAAU,WAAVA,UAAUA,CAAA,EAAG;IACX,IAAI,CAAC7G,MAAM,CAACC,IAAI,CAAC,kCAAkC,CAAC;;IAEpD;IACA,IAAI,IAAI,CAACrB,YAAY,EAAE;MACrBkI,YAAY,CAAC,IAAI,CAAClI,YAAY,CAAC;MAC/B,IAAI,CAACmI,KAAK,CAAC,cAAc,CAAC;IAC5B;IAEA,IAAI;MACF,IAAI,CAACA,KAAK,CAAC,YAAY,CAAC;IAC1B,CAAC,CAAC,OAAO5F,GAAG,EAAE;MACZ,IAAI,CAACnB,MAAM,CAACmD,IAAI,CAAC,yCAAyC,EAAEhC,GAAG,CAAC;IAClE;IAEA,OAAO,IAAI,CAACxE,UAAU,CAACoE,MAAM,CAAC3G,MAAM,EAAE;MACpC,IAAI;QACF,IAAI,CAACuC,UAAU,CAACqK,MAAM,CAAC,IAAI,CAACrK,UAAU,CAACoE,MAAM,CAAC,CAAC,CAAC,CAAC;MACnD,CAAC,CAAC,OAAOI,GAAG,EAAE;QACZ,IAAI,CAACnB,MAAM,CAACmD,IAAI,CAAC,0CAA0C,EAAEhC,GAAG,CAAC;MACnE;IACF;IAEA,IAAI,CAACnB,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;;IAEzD;IACA;IACA,OAAO2D,QAAA,CAAA3K,OAAA,CAAQ4K,OAAO,CAAC,CAAC;EAC1B,CAAC;EAKD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEoD,OAAO,WAAPA,OAAOA,CAAA,EAAG;IAAA,IAAAC,MAAA;IACR,IAAI,CAAClH,MAAM,CAACC,IAAI,CAAC,gCAAgC,CAAC;IAElD,IAAO1C,UAAU,GAAI,IAAI,CAAlBA,UAAU;IACjB,IAAMsD,MAAM,GAAG,IAAAsG,aAAK,EAAC,IAAI,CAACxK,UAAU,CAACoE,MAAM,CAAC;;IAE5C;IACA;IACA;IACA;IACA;IACA;IACA,IAAI,IAAI,CAACtD,MAAM,CAACC,kBAAkB,EAAE;MAClC,OACE,IAAI,CAACD,MAAM,CACRC,kBAAkB,CAAC,IAAI,CAAC2F,KAAK;MAC9B;MAAA,CACC0B,IAAI,CAAC,UAACzE,GAAG;QAAA,OAAK4G,MAAI,CAAC7D,KAAK,CAAC6C,aAAa,CAACkB,yBAAyB,CAAC;UAAC9G,GAAG,EAAHA;QAAG,CAAC,CAAC;MAAA,EAAC;IAE/E;IAEA,IAAI,IAAI,CAAC+C,KAAK,CAACC,QAAQ,CAAC+D,QAAQ,EAAE;MAChC,IAAI,CAAChE,KAAK,CAACC,QAAQ,CAAC+D,QAAQ,CAACC,uBAAuB,CAAC,CAAC;IACxD;IAEA,OAAO/J,UAAU,CACd0J,OAAO,CAAC,CAAC,CACTnE,KAAK,CAAC,UAACwC,KAAK,EAAK;MAChB,IAAIA,KAAK,YAAYiC,uBAAU,EAAE;QAC/B;QACA;QACAL,MAAI,CAACH,KAAK,CAAC,YAAY,CAAC;QACxB,OAAOG,MAAI,CAACvK,UAAU,CAACoE,MAAM,CAAC3G,MAAM,EAAE;UACpC,IAAI;YACF8M,MAAI,CAACvK,UAAU,CAACqK,MAAM,CAACE,MAAI,CAACvK,UAAU,CAACoE,MAAM,CAAC,CAAC,CAAC,CAAC;UACnD,CAAC,CAAC,OAAOI,GAAG,EAAE;YACZ+F,MAAI,CAAClH,MAAM,CAACmD,IAAI,CAAC,0CAA0C,EAAEhC,GAAG,CAAC;UACnE;QACF;QACA+F,MAAI,CAAC7D,KAAK,CAACmE,OAAO,CAAC,4BAA4B,CAAC;MAClD;MAEA,OAAO5D,QAAA,CAAA3K,OAAA,CAAQiM,MAAM,CAACI,KAAK,CAAC;IAC9B,CAAC,CAAC,CACDP,IAAI,CAAC,UAAC0C,EAAE,EAAK;MACZ;MACA,IAAIP,MAAI,CAACtI,YAAY,EAAE;QACrBkI,YAAY,CAACI,MAAI,CAACtI,YAAY,CAAC;QAC/BsI,MAAI,CAACH,KAAK,CAAC,cAAc,CAAC;MAC5B;MACAG,MAAI,CAAC3J,UAAU,GAAGkK,EAAE;MAEpB,IAAMC,aAAa,GAAG,IAAAC,iBAAU,EAACT,MAAI,CAACzJ,MAAM,CAACnB,KAAK,EAAEmL,EAAE,CAACnL,KAAK,CAAC;MAE7D,IAAIoL,aAAa,KAAK,EAAE,EAAE;QACxBR,MAAI,CAAClH,MAAM,CAACmD,IAAI,mBAAAxD,MAAA,CACG+H,aAAa,kHAChC,CAAC;QACDR,MAAI,CAAC7D,KAAK,CAACC,QAAQ,CAACC,OAAO,CAACC,mBAAmB,CAC7CC,kBAAO,CAACmE,+CAA+C,EACvD;UAACpH,MAAM,EAAE;YAACkH,aAAa,EAAbA;UAAa;QAAC,CAC1B,CAAC;MACH;MAEA,OAAO9D,QAAA,CAAA3K,OAAA,CAAQ4O,GAAG,CAChBhH,MAAM,CAACiH,GAAG,CAAC,UAAChL,KAAK,EAAK;QACpB,IAAMiL,UAAU,GAAG,IAAApC,kBAAW,EAAC,IAAAgC,iBAAU,EAAC7K,KAAK,CAACR,KAAK,EAAEmL,EAAE,CAACnL,KAAK,CAAC,EAAEQ,KAAK,CAACR,KAAK,CAAC;QAE9E,OACE4K,MAAI,CAACtE,SAAS,CAACmF,UAAU;QACvB;QAAA,CACChD,IAAI,CAAC,UAACvM,CAAC,EAAK;UACX0O,MAAI,CAAClH,MAAM,CAACC,IAAI,oCAAAN,MAAA,CAAoC7C,KAAK,CAACR,KAAK,CAAE,CAAC;UAElE,OAAOQ,KAAK,CACTkL,MAAM,CAAC,CAAC,CACRlF,KAAK,CAAC,UAAC3B,GAAG,EAAK;YACd+F,MAAI,CAAClH,MAAM,CAACmD,IAAI,CAAC,0CAA0C,EAAEhC,GAAG,CAAC;UACnE,CAAC,CAAC,CACD4D,IAAI,CAAC,YAAM;YACVmC,MAAI,CAACvK,UAAU,CAACqK,MAAM,CAAClK,KAAK,CAACR,KAAK,CAAC;YACnC4K,MAAI,CAACvK,UAAU,CAACmJ,GAAG,CAACtN,CAAC,CAAC;UACxB,CAAC,CAAC;QACN,CAAC,CAAC;MAER,CAAC,CACH,CAAC;IACH,CAAC,CAAC,CACDuM,IAAI,CAAC,YAAM;MACVmC,MAAI,CAACd,eAAe,CAACc,MAAI,CAAC3J,UAAU,CAAC4I,OAAO,CAAC;IAC/C,CAAC,CAAC;EACN,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,eAAe,WAAfA,eAAeA,CAACD,OAAO,EAAE;IAAA,IAAA8B,MAAA;IACvB,IAAMC,SAAS,GAAG/B,OAAO,GAAG,IAAAgC,IAAA,CAAAlP,OAAA,EAAS,CAAC;IAEtC,IAAIiP,SAAS,GAAG,CAAC,EAAE;MACjB,IAAME,aAAa,GAAG,IAAI,CAACtG,kBAAkB,CAACoG,SAAS,CAAC;MAExD,IAAI,CAACtJ,YAAY,GAAG,IAAAyJ,4BAAc,EAAC;QAAA,OAAMJ,MAAI,CAAChB,OAAO,CAAC,CAAC;MAAA,GAAEmB,aAAa,CAAC;IACzE,CAAC,MAAM;MACL,IAAI,CAACnB,OAAO,CAAC,CAAC;IAChB;EACF,CAAC;EAAAqB,OAAA;AACH,CAAC,MAAAC,0BAAA,CAAAtP,OAAA,EAAAX,IAAA,mBAAAN,IAAA,EAAAC,KAAA,OAAAuQ,yBAAA,CAAAvP,OAAA,EAAAX,IAAA,mBAAAA,IAAA,OAAAiQ,0BAAA,CAAAtP,OAAA,EAAAX,IAAA,iBAAAJ,KAAA,OAAAsQ,yBAAA,CAAAvP,OAAA,EAAAX,IAAA,iBAAAA,IAAA,OAAAiQ,0BAAA,CAAAtP,OAAA,EAAAX,IAAA,iBArKE8D,iBAAS,EAAAjE,KAAA,OAAAqQ,yBAAA,CAAAvP,OAAA,EAAAX,IAAA,iBAAAA,IAAA,OAAAiQ,0BAAA,CAAAtP,OAAA,EAAAX,IAAA,cAyCT8D,iBAAS,EAAAhE,KAAA,EAAAC,KAAA,OAAAmQ,yBAAA,CAAAvP,OAAA,EAAAX,IAAA,cAAAA,IAAA,GAAAA,IAAA,CA4HX,CAAC;AAAC,IAAAmQ,QAAA,GAAAC,OAAA,CAAAzP,OAAA,GAEYgD,WAAW","ignoreList":[]}

package/dist/lib/credentials/token.js

@@ -532,7 +532,7 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       return res.body;
     });
   },
-  version: "3.12.0-next.44"
+  version: "3.12.0-next.46"
 }, (0, _applyDecoratedDescriptor2.default)(_obj, "downscope", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "downscope"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "refresh", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "refresh"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "revoke", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "revoke"), _obj), _obj));
 var _default = exports.default = Token;
 //# sourceMappingURL=token.js.map