@xemahq/oidc-session-nest 0.1.0

package/dist/nest/oidc-session.middleware.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcSessionMiddleware = exports.OIDC_SESSION_SCOPE = void 0;
+const common_1 = require("@nestjs/common");
+const oidc_session_context_1 = require("./oidc-session-context");
+const tokens_1 = require("./tokens");
+const cookie_1 = require("../http/cookie");
+const session_service_1 = require("../session/session-service");
+exports.OIDC_SESSION_SCOPE = Symbol.for('@xemahq/oidc-session-nest:request-scope');
+let OidcSessionMiddleware = class OidcSessionMiddleware {
+    sessions;
+    options;
+    constructor(sessions, options) {
+        this.sessions = sessions;
+        this.options = options;
+    }
+    async use(req, _res, next) {
+        const scope = await this.resolveScope(req);
+        req[exports.OIDC_SESSION_SCOPE] = scope;
+        (0, oidc_session_context_1.runWithSessionScope)(scope, () => {
+            next();
+        });
+    }
+    async resolveScope(req) {
+        const header = req.headers.cookie;
+        const cookieHeader = Array.isArray(header) ? header.join('; ') : header;
+        const cookieValue = (0, cookie_1.readCookie)(cookieHeader, this.options.cookie.name);
+        if (cookieValue === null) {
+            return { session: null, expired: false, projectId: null };
+        }
+        const resolved = await this.sessions.resolveSession(cookieValue);
+        return {
+            session: resolved.session,
+            expired: resolved.expired,
+            projectId: null,
+        };
+    }
+};
+exports.OidcSessionMiddleware = OidcSessionMiddleware;
+exports.OidcSessionMiddleware = OidcSessionMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(tokens_1.OIDC_SESSION_OPTIONS)),
+    __metadata("design:paramtypes", [session_service_1.SessionService, Object])
+], OidcSessionMiddleware);
+//# sourceMappingURL=oidc-session.middleware.js.map

package/dist/nest/oidc-session.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session.middleware.js","sourceRoot":"","sources":["../../src/nest/oidc-session.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAaA,2CAAyE;AAEzE,iEAGgC;AAChC,qCAAgD;AAChD,2CAA4C;AAC5C,gEAA4D;AAuB/C,QAAA,kBAAkB,GAAkB,MAAM,CAAC,GAAG,CACzD,yCAAyC,CAC1C,CAAC;AAQK,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAEb;IAIA;IALnB,YACmB,QAAwB,EAIxB,OAA2B;QAJ3B,aAAQ,GAAR,QAAQ,CAAgB;QAIxB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ,KAAK,CAAC,GAAG,CACP,GAAuB,EACvB,IAAa,EACb,IAA+B;QAE/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAK1C,GAAgD,CAAC,0BAAkB,CAAC,GAAG,KAAK,CAAC;QAC9E,IAAA,0CAAmB,EAAC,KAAK,EAAE,GAAG,EAAE;YAC9B,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAuB;QAEvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF,CAAA;AAzCY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;qCAHF,gCAAc;GAFhC,qBAAqB,CAyCjC"}

package/dist/nest/oidc-session.module.d.ts

@@ -0,0 +1,22 @@
+import { type DynamicModule, type InjectionToken, type MiddlewareConsumer, type NestModule, type OptionalFactoryDependency, type Provider } from '@nestjs/common';
+import { type OidcSessionOptions } from '../config/oidc-session-options';
+import { type FetchLike } from '../oidc/discovery';
+import type { SessionStore } from '../session/session-store';
+export { OIDC_SESSION_OPTIONS, OIDC_SESSION_STORE } from './tokens';
+export interface OidcSessionFactoryResult {
+    readonly options: OidcSessionOptions;
+    readonly store: SessionStore;
+    readonly fetchImpl?: FetchLike;
+}
+export interface OidcSessionModuleAsyncOptions {
+    readonly imports?: DynamicModule['imports'];
+    readonly inject?: readonly (InjectionToken | OptionalFactoryDependency)[];
+    readonly useFactory: (...args: never[]) => OidcSessionFactoryResult | Promise<OidcSessionFactoryResult>;
+    readonly mountEndpoints?: boolean;
+    readonly providers?: readonly Provider[];
+}
+export declare class OidcSessionModule implements NestModule {
+    static forRootAsync(asyncOptions: OidcSessionModuleAsyncOptions): DynamicModule;
+    configure(consumer: MiddlewareConsumer): void;
+}
+//# sourceMappingURL=oidc-session.module.d.ts.map

package/dist/nest/oidc-session.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session.module.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session.module.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,yBAAyB,EAC9B,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAIlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAGpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAQ7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,yBAAyB,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,KAAK,EAAE,KACb,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IASlE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAElC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC1C;AAYD,qBAEa,iBAAkB,YAAW,UAAU;IAClD,MAAM,CAAC,YAAY,CACjB,YAAY,EAAE,6BAA6B,GAC1C,aAAa;IA2FhB,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAG9C"}

package/dist/nest/oidc-session.module.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var OidcSessionModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcSessionModule = exports.OIDC_SESSION_STORE = exports.OIDC_SESSION_OPTIONS = void 0;
+const common_1 = require("@nestjs/common");
+const oidc_guard_1 = require("@xemahq/oidc-guard");
+const oidc_session_auth_controller_1 = require("./oidc-session-auth.controller");
+const oidc_session_guard_1 = require("./oidc-session.guard");
+const oidc_session_middleware_1 = require("./oidc-session.middleware");
+const tokens_1 = require("./tokens");
+const oidc_session_options_1 = require("../config/oidc-session-options");
+const discovery_1 = require("../oidc/discovery");
+const oidc_client_1 = require("../oidc/oidc-client");
+const session_service_1 = require("../session/session-service");
+var tokens_2 = require("./tokens");
+Object.defineProperty(exports, "OIDC_SESSION_OPTIONS", { enumerable: true, get: function () { return tokens_2.OIDC_SESSION_OPTIONS; } });
+Object.defineProperty(exports, "OIDC_SESSION_STORE", { enumerable: true, get: function () { return tokens_2.OIDC_SESSION_STORE; } });
+const OIDC_SESSION_FACTORY_RESULT = Symbol.for('@xemahq/oidc-session-nest:factory-result');
+let OidcSessionModule = OidcSessionModule_1 = class OidcSessionModule {
+    static forRootAsync(asyncOptions) {
+        const mountEndpoints = asyncOptions.mountEndpoints ?? true;
+        const providers = [
+            ...(asyncOptions.providers ?? []),
+            {
+                provide: OIDC_SESSION_FACTORY_RESULT,
+                useFactory: asyncOptions.useFactory,
+                ...(asyncOptions.inject === undefined
+                    ? {}
+                    : { inject: [...asyncOptions.inject] }),
+            },
+            {
+                provide: tokens_1.OIDC_SESSION_OPTIONS,
+                useFactory: (result) => (0, oidc_session_options_1.assertOidcSessionOptions)(result.options),
+                inject: [OIDC_SESSION_FACTORY_RESULT],
+            },
+            {
+                provide: tokens_1.OIDC_SESSION_STORE,
+                useFactory: (result) => result.store,
+                inject: [OIDC_SESSION_FACTORY_RESULT],
+            },
+            {
+                provide: oidc_client_1.OidcClient,
+                useFactory: (options, result) => {
+                    const fetchImpl = result.fetchImpl ?? defaultFetch;
+                    return new oidc_client_1.OidcClient({
+                        options: options.oidc,
+                        discovery: new discovery_1.OidcDiscovery(options.oidc.issuerUrl, fetchImpl),
+                        verifier: new oidc_guard_1.JwksVerifier(),
+                        fetchImpl,
+                    });
+                },
+                inject: [tokens_1.OIDC_SESSION_OPTIONS, OIDC_SESSION_FACTORY_RESULT],
+            },
+            {
+                provide: session_service_1.SessionService,
+                useFactory: (options, store, client) => new session_service_1.SessionService({ options, store, client }),
+                inject: [tokens_1.OIDC_SESSION_OPTIONS, tokens_1.OIDC_SESSION_STORE, oidc_client_1.OidcClient],
+            },
+            oidc_session_middleware_1.OidcSessionMiddleware,
+            oidc_session_guard_1.OidcSessionGuard,
+        ];
+        return {
+            module: OidcSessionModule_1,
+            ...(asyncOptions.imports === undefined
+                ? {}
+                : { imports: asyncOptions.imports }),
+            ...(mountEndpoints ? { controllers: [oidc_session_auth_controller_1.OidcSessionAuthController] } : {}),
+            providers,
+            exports: [
+                session_service_1.SessionService,
+                oidc_client_1.OidcClient,
+                oidc_session_guard_1.OidcSessionGuard,
+                tokens_1.OIDC_SESSION_OPTIONS,
+                tokens_1.OIDC_SESSION_STORE,
+            ],
+        };
+    }
+    configure(consumer) {
+        consumer.apply(oidc_session_middleware_1.OidcSessionMiddleware).forRoutes('*');
+    }
+};
+exports.OidcSessionModule = OidcSessionModule;
+exports.OidcSessionModule = OidcSessionModule = OidcSessionModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], OidcSessionModule);
+const defaultFetch = (input, init) => {
+    if (typeof globalThis.fetch !== 'function') {
+        return Promise.reject(new Error('[oidc-session-nest] This runtime has no global fetch. Supply ' +
+            '`fetchImpl` (undici, for example) from the module factory.'));
+    }
+    return globalThis.fetch(input, init);
+};
+//# sourceMappingURL=oidc-session.module.js.map

package/dist/nest/oidc-session.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session.module.js","sourceRoot":"","sources":["../../src/nest/oidc-session.module.ts"],"names":[],"mappings":";;;;;;;;;;AAUA,2CASwB;AACxB,mDAAkD;AAElD,iFAA2E;AAC3E,6DAAwD;AACxD,uEAAkE;AAClE,qCAAoE;AACpE,yEAGwC;AACxC,iDAAkE;AAClE,qDAAiD;AACjD,gEAA4D;AAK5D,mCAAoE;AAA3D,8GAAA,oBAAoB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAoCjD,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAC5C,0CAA0C,CAC3C,CAAC;AASK,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAC5B,MAAM,CAAC,YAAY,CACjB,YAA2C;QAE3C,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,IAAI,IAAI,CAAC;QAE3D,MAAM,SAAS,GAAe;YAC5B,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;YACjC;gBACE,OAAO,EAAE,2BAA2B;gBACpC,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;aAC1C;YACD;gBACE,OAAO,EAAE,6BAAoB;gBAI7B,UAAU,EAAE,CAAC,MAAgC,EAAsB,EAAE,CACnE,IAAA,+CAAwB,EAAC,MAAM,CAAC,OAAO,CAAC;gBAC1C,MAAM,EAAE,CAAC,2BAA2B,CAAC;aACtC;YACD;gBACE,OAAO,EAAE,2BAAkB;gBAC3B,UAAU,EAAE,CAAC,MAAgC,EAAgB,EAAE,CAC7D,MAAM,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,2BAA2B,CAAC;aACtC;YACD;gBACE,OAAO,EAAE,wBAAU;gBACnB,UAAU,EAAE,CACV,OAA2B,EAC3B,MAAgC,EACpB,EAAE;oBACd,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC;oBACnD,OAAO,IAAI,wBAAU,CAAC;wBACpB,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,SAAS,EAAE,IAAI,yBAAa,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC;wBAC/D,QAAQ,EAAE,IAAI,yBAAY,EAAE;wBAC5B,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,EAAE,CAAC,6BAAoB,EAAE,2BAA2B,CAAC;aAC5D;YACD;gBACE,OAAO,EAAE,gCAAc;gBACvB,UAAU,EAAE,CACV,OAA2B,EAC3B,KAAmB,EACnB,MAAkB,EACF,EAAE,CAClB,IAAI,gCAAc,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBAChD,MAAM,EAAE,CAAC,6BAAoB,EAAE,2BAAkB,EAAE,wBAAU,CAAC;aAC/D;YAMD,+CAAqB;YACrB,qCAAgB;SACjB,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,mBAAiB;YACzB,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;YAKtC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,wDAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,SAAS;YACT,OAAO,EAAE;gBACP,gCAAc;gBACd,wBAAU;gBACV,qCAAgB;gBAChB,6BAAoB;gBACpB,2BAAkB;aACnB;SACF,CAAC;IACJ,CAAC;IAUD,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,+CAAqB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAjGY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,iBAAiB,CAiG7B;AASD,MAAM,YAAY,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IAC9C,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,+DAA+D;YAC7D,4DAA4D,CAC/D,CACF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC,CAAC"}

package/dist/nest/session-actor.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const SessionActor: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=session-actor.decorator.d.ts.map

package/dist/nest/session-actor.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-actor.decorator.d.ts","sourceRoot":"","sources":["../../src/nest/session-actor.decorator.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,YAAY,mDAUxB,CAAC"}

package/dist/nest/session-actor.decorator.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionActor = void 0;
+const common_1 = require("@nestjs/common");
+const oidc_session_context_1 = require("./oidc-session-context");
+const oidc_session_middleware_1 = require("./oidc-session.middleware");
+exports.SessionActor = (0, common_1.createParamDecorator)((_data, context) => {
+    const ambient = (0, oidc_session_context_1.currentSessionScope)();
+    const scope = ambient ??
+        context.switchToHttp().getRequest()[oidc_session_middleware_1.OIDC_SESSION_SCOPE];
+    return scope?.session?.actor ?? null;
+});
+//# sourceMappingURL=session-actor.decorator.js.map

package/dist/nest/session-actor.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-actor.decorator.js","sourceRoot":"","sources":["../../src/nest/session-actor.decorator.ts"],"names":[],"mappings":";;;AASA,2CAA6E;AAG7E,iEAA6D;AAC7D,uEAGmC;AAItB,QAAA,YAAY,GAAG,IAAA,6BAAoB,EAC9C,CAAC,KAAc,EAAE,OAAyB,EAA4B,EAAE;IACtE,MAAM,OAAO,GAAG,IAAA,0CAAmB,GAAE,CAAC;IACtC,MAAM,KAAK,GACT,OAAO;QACP,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAuB,CACtD,4CAAkB,CACnB,CAAC;IACJ,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;AACvC,CAAC,CACF,CAAC"}

package/dist/nest/session-client-transport.d.ts

@@ -0,0 +1,6 @@
+export interface SessionClientTransport {
+    getAuthToken: () => Promise<string>;
+    getHeaders: () => Record<string, string>;
+}
+export declare function sessionClientTransport(): SessionClientTransport;
+//# sourceMappingURL=session-client-transport.d.ts.map

package/dist/nest/session-client-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-client-transport.d.ts","sourceRoot":"","sources":["../../src/nest/session-client-transport.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAYD,wBAAgB,sBAAsB,IAAI,sBAAsB,CA6C/D"}

package/dist/nest/session-client-transport.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionClientTransport = sessionClientTransport;
+const platform_common_1 = require("@xemahq/platform-common");
+const oidc_session_context_1 = require("./oidc-session-context");
+const headers_1 = require("../http/headers");
+function sessionClientTransport() {
+    return {
+        getAuthToken: () => {
+            const scope = (0, oidc_session_context_1.currentSessionScope)();
+            if (scope === undefined) {
+                return Promise.reject(new Error('[oidc-session-nest] A Xema client was called outside a request ' +
+                    'scope, so there is no session to take a bearer from. Calls made ' +
+                    'from a background job or a boot hook need their own service ' +
+                    'credential rather than a browser session.'));
+            }
+            if (scope.session === null) {
+                return Promise.reject(new Error('[oidc-session-nest] A Xema client was called on a request with no ' +
+                    'session. Mount OidcSessionGuard on this route, or do not call a ' +
+                    'Xema peer on an anonymous path.'));
+            }
+            return Promise.resolve(scope.session.record.accessToken);
+        },
+        getHeaders: () => {
+            const scope = (0, oidc_session_context_1.currentSessionScope)();
+            const headers = {};
+            if (scope === undefined) {
+                return headers;
+            }
+            const activeOrgId = scope.session?.record.activeOrgId ?? null;
+            if (activeOrgId !== null) {
+                headers[platform_common_1.OrgHeaderName.Canonical] = activeOrgId;
+            }
+            if (scope.projectId !== null) {
+                headers[headers_1.PROJECT_HEADER_NAME] = scope.projectId;
+            }
+            return headers;
+        },
+    };
+}
+//# sourceMappingURL=session-client-transport.js.map

package/dist/nest/session-client-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-client-transport.js","sourceRoot":"","sources":["../../src/nest/session-client-transport.ts"],"names":[],"mappings":";;AAiDA,wDA6CC;AA1ED,6DAAwD;AAExD,iEAA6D;AAC7D,6CAAsD;AA0BtD,SAAgB,sBAAsB;IACpC,OAAO;QACL,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;YACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,iEAAiE;oBAC/D,kEAAkE;oBAClE,8DAA8D;oBAC9D,2CAA2C,CAC9C,CACF,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,oEAAoE;oBAClE,kEAAkE;oBAClE,iCAAiC,CACpC,CACF,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3D,CAAC;QAED,UAAU,EAAE,GAAG,EAAE;YACf,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;YACpC,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;YAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,CAAC,+BAAa,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;YACjD,CAAC;YAID,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,CAAC,6BAAmB,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;YACjD,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/nest/tokens.d.ts

@@ -0,0 +1,3 @@
+export declare const OIDC_SESSION_OPTIONS: unique symbol;
+export declare const OIDC_SESSION_STORE: unique symbol;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/nest/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/nest/tokens.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,oBAAoB,eAEhC,CAAC;AAGF,eAAO,MAAM,kBAAkB,eAAgD,CAAC"}

package/dist/nest/tokens.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_SESSION_STORE = exports.OIDC_SESSION_OPTIONS = void 0;
+exports.OIDC_SESSION_OPTIONS = Symbol.for('@xemahq/oidc-session-nest:options');
+exports.OIDC_SESSION_STORE = Symbol.for('@xemahq/oidc-session-nest:store');
+//# sourceMappingURL=tokens.js.map

package/dist/nest/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/nest/tokens.ts"],"names":[],"mappings":";;;AAUa,QAAA,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAC5C,mCAAmC,CACpC,CAAC;AAGW,QAAA,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC"}

package/dist/oidc/discovery.d.ts

@@ -0,0 +1,30 @@
+export interface OidcDiscoveryDocument {
+    readonly issuer: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly jwksUri: string;
+    readonly endSessionEndpoint?: string;
+}
+export type FetchLike = (input: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+}>;
+export declare class OidcDiscovery {
+    private readonly issuerUrl;
+    private readonly fetchImpl;
+    private readonly ttlMs;
+    private readonly now;
+    private cached;
+    private inFlight;
+    constructor(issuerUrl: string, fetchImpl: FetchLike, ttlMs?: number, now?: () => number);
+    get discoveryUrl(): string;
+    resolve(): Promise<OidcDiscoveryDocument>;
+    private fetchDocument;
+}
+//# sourceMappingURL=discovery.d.ts.map

package/dist/oidc/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAOD,MAAM,MAAM,SAAS,GAAG,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,KACE,OAAO,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC,CAAC;AAaH,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,OAAO,CAAC,MAAM,CACP;IAEP,OAAO,CAAC,QAAQ,CAA+C;gBAG5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,EACpB,KAAK,GAAE,MAAuB,EAC9B,GAAG,GAAE,MAAM,MAAyB;IAIvD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAEK,OAAO,IAAI,OAAO,CAAC,qBAAqB,CAAC;YAgBjC,aAAa;CA2D5B"}

package/dist/oidc/discovery.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcDiscovery = void 0;
+const errors_1 = require("../errors");
+const DEFAULT_TTL_MS = 60 * 60 * 1000;
+class OidcDiscovery {
+    issuerUrl;
+    fetchImpl;
+    ttlMs;
+    now;
+    cached = null;
+    inFlight = null;
+    constructor(issuerUrl, fetchImpl, ttlMs = DEFAULT_TTL_MS, now = () => Date.now()) {
+        this.issuerUrl = issuerUrl;
+        this.fetchImpl = fetchImpl;
+        this.ttlMs = ttlMs;
+        this.now = now;
+    }
+    get discoveryUrl() {
+        return `${this.issuerUrl.replace(/\/+$/u, '')}/.well-known/openid-configuration`;
+    }
+    async resolve() {
+        const cached = this.cached;
+        if (cached !== null && this.now() - cached.fetchedAt < this.ttlMs) {
+            return cached.document;
+        }
+        const existing = this.inFlight;
+        if (existing !== null) {
+            return existing;
+        }
+        const pending = this.fetchDocument().finally(() => {
+            this.inFlight = null;
+        });
+        this.inFlight = pending;
+        return pending;
+    }
+    async fetchDocument() {
+        const url = this.discoveryUrl;
+        let body;
+        let status;
+        let ok;
+        try {
+            const response = await this.fetchImpl(url, {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+            });
+            ok = response.ok;
+            status = response.status;
+            body = await response.text();
+        }
+        catch (error) {
+            throw new errors_1.OidcTokenEndpointFailedError(`OIDC discovery at ${url} could not be reached: ${describe(error)}`);
+        }
+        if (!ok) {
+            throw new errors_1.OidcTokenEndpointFailedError(`OIDC discovery at ${url} answered HTTP ${status}.`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch (error) {
+            throw new errors_1.OidcTokenEndpointFailedError(`OIDC discovery at ${url} did not return JSON: ${describe(error)}`);
+        }
+        if (parsed === null || typeof parsed !== 'object') {
+            throw new errors_1.OidcTokenEndpointFailedError(`OIDC discovery at ${url} did not return a JSON object.`);
+        }
+        const document = parsed;
+        const issuer = requireString(document, 'issuer', url);
+        if (issuer !== this.issuerUrl.replace(/\/+$/u, '')) {
+            throw new errors_1.OidcTokenEndpointFailedError(`OIDC discovery at ${url} declares issuer "${issuer}", which is not the ` +
+                `configured issuer "${this.issuerUrl}". Refusing rather than trusting ` +
+                'a provider that names a different issuer than the one configured.');
+        }
+        const endSessionEndpoint = optionalString(document, 'end_session_endpoint');
+        const resolved = {
+            issuer,
+            authorizationEndpoint: requireString(document, 'authorization_endpoint', url),
+            tokenEndpoint: requireString(document, 'token_endpoint', url),
+            jwksUri: requireString(document, 'jwks_uri', url),
+            ...(endSessionEndpoint === undefined ? {} : { endSessionEndpoint }),
+        };
+        this.cached = { document: resolved, fetchedAt: this.now() };
+        return resolved;
+    }
+}
+exports.OidcDiscovery = OidcDiscovery;
+function requireString(document, key, url) {
+    const value = document[key];
+    if (typeof value !== 'string' || value === '') {
+        throw new errors_1.OidcTokenEndpointFailedError(`OIDC discovery at ${url} did not provide a usable "${key}".`);
+    }
+    return value;
+}
+function optionalString(document, key) {
+    const value = document[key];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/oidc/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":";;;AAiBA,sCAAyD;AAiCzD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAUtC,MAAa,aAAa;IAOL;IACA;IACA;IACA;IATX,MAAM,GACZ,IAAI,CAAC;IAEC,QAAQ,GAA0C,IAAI,CAAC;IAE/D,YACmB,SAAiB,EACjB,SAAoB,EACpB,QAAgB,cAAc,EAC9B,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAHpC,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAW;QACpB,UAAK,GAAL,KAAK,CAAyB;QAC9B,QAAG,GAAH,GAAG,CAAiC;IACpD,CAAC;IAGJ,IAAI,YAAY;QACd,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,mCAAmC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QAC9B,IAAI,IAAY,CAAC;QACjB,IAAI,MAAc,CAAC;QACnB,IAAI,EAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACzC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YACzB,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qCAA4B,CACpC,qBAAqB,GAAG,0BAA0B,QAAQ,CAAC,KAAK,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,qCAA4B,CACpC,qBAAqB,GAAG,kBAAkB,MAAM,GAAG,CACpD,CAAC;QACJ,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qCAA4B,CACpC,qBAAqB,GAAG,yBAAyB,QAAQ,CAAC,KAAK,CAAC,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,qCAA4B,CACpC,qBAAqB,GAAG,gCAAgC,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAiC,CAAC;QAEnD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,qCAA4B,CACpC,qBAAqB,GAAG,qBAAqB,MAAM,sBAAsB;gBACvE,sBAAsB,IAAI,CAAC,SAAS,mCAAmC;gBACvE,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAA0B;YACtC,MAAM;YACN,qBAAqB,EAAE,aAAa,CAAC,QAAQ,EAAE,wBAAwB,EAAE,GAAG,CAAC;YAC7E,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,CAAC;YAC7D,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC;YACjD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC;SACpE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AA7FD,sCA6FC;AAED,SAAS,aAAa,CACpB,QAAiC,EACjC,GAAW,EACX,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,qCAA4B,CACpC,qBAAqB,GAAG,8BAA8B,GAAG,IAAI,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,QAAiC,EACjC,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/oidc/oidc-client.d.ts

@@ -0,0 +1,44 @@
+import { type JwksVerifier, type DecodedJwtPayload } from '@xemahq/oidc-guard';
+import { type OidcDiscovery, type FetchLike } from './discovery';
+import type { OidcProviderOptions } from '../config/oidc-session-options';
+export interface OidcTokenSet {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly idToken?: string;
+    readonly accessTokenExpiresAt: number;
+    readonly accessClaims: DecodedJwtPayload;
+    readonly idClaims?: DecodedJwtPayload;
+}
+export declare class OidcInvalidGrantError extends Error {
+    constructor(message: string);
+}
+export interface OidcClientDeps {
+    readonly options: OidcProviderOptions;
+    readonly discovery: OidcDiscovery;
+    readonly verifier: JwksVerifier;
+    readonly fetchImpl: FetchLike;
+}
+export interface AuthorizationRequest {
+    readonly state: string;
+    readonly nonce: string;
+    readonly codeChallenge: string;
+}
+export declare class OidcClient {
+    private readonly options;
+    private readonly discovery;
+    private readonly verifier;
+    private readonly fetchImpl;
+    private readonly jwksCacheKey;
+    constructor(deps: OidcClientDeps);
+    buildAuthorizationUrl(request: AuthorizationRequest): Promise<string>;
+    exchangeCode(input: {
+        code: string;
+        codeVerifier: string;
+        nonce: string;
+    }): Promise<OidcTokenSet>;
+    refresh(refreshToken: string): Promise<OidcTokenSet>;
+    buildEndSessionUrl(idToken?: string): Promise<string | null>;
+    private postToTokenEndpoint;
+    private toTokenSet;
+}
+//# sourceMappingURL=oidc-client.d.ts.map

package/dist/oidc/oidc-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../../src/oidc/oidc-client.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAM/E,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IAEzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAaD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAGD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAID,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAE9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAE1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IAExC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IAOtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,IAAI,EAAE,cAAc;IAS1B,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqBrE,YAAY,CAAC,KAAK,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAkBnB,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAmBpD,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAmBpD,mBAAmB;YAwEnB,UAAU;CAuEzB"}