auth0 4.0.0-beta.0 → 4.0.0-beta.2

package/README.md

@@ -8,7 +8,7 @@
 [![License](https://img.shields.io/:license-mit-blue.svg?style=flat)](https://opensource.org/licenses/MIT)
 ![CircleCI](https://img.shields.io/circleci/build/github/auth0/node-auth0)
 
-📚 [Documentation](#documentation) - 🚀 [Getting Started](#getting-started) - 💬 [Feedback](#feedback)
+📚 [Documentation](#documentation) - 🚀 [Getting Started](#getting-started) - 💻 [API Reference](#api-reference) - 💬 [Feedback](#feedback)
 
 ## Documentation
 
@@ -74,6 +74,11 @@ var management = new ManagementClient({
 });
 ```
 
+## API Reference
+
+- [AuthenticationClient](https://auth0.github.io/node-auth0/beta/classes/auth.AuthenticationClient.html)
+- [ManagementClient](https://auth0.github.io/node-auth0/beta/classes/management.ManagementClient.html)
+
 ## Feedback
 
 ### Contributing

package/dist/cjs/auth/base-auth-api.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseAuthAPI = exports.AuthApiError = void 0;
+const errors_js_1 = require("../lib/errors.js");
+const runtime_js_1 = require("../lib/runtime.js");
+const client_authentication_js_1 = require("./client-authentication.js");
+class AuthApiError extends Error {
+    constructor(error, error_description, statusCode, body, headers) {
+        super(error_description || error);
+        this.error = error;
+        this.error_description = error_description;
+        this.statusCode = statusCode;
+        this.body = body;
+        this.headers = headers;
+        this.name = 'AuthApiError';
+    }
+}
+exports.AuthApiError = AuthApiError;
+async function parseError(response) {
+    // Errors typically have a specific format:
+    // {
+    //    error: 'invalid_body',
+    //    error_description: 'Bad Request',
+    // }
+    const body = await response.text();
+    let data;
+    try {
+        data = JSON.parse(body);
+        return new AuthApiError(data.error, data.error_description, response.status, body, response.headers);
+    }
+    catch (_) {
+        return new errors_js_1.ResponseError(response.status, body, response.headers, 'Response returned an error code');
+    }
+}
+class BaseAuthAPI extends runtime_js_1.BaseAPI {
+    constructor(options) {
+        super({ ...options, baseUrl: `https://${options.domain}`, parseError });
+        this.domain = options.domain;
+        this.clientId = options.clientId;
+        this.clientSecret = options.clientSecret;
+        this.clientAssertionSigningKey = options.clientAssertionSigningKey;
+        this.clientAssertionSigningAlg = options.clientAssertionSigningAlg;
+    }
+    /**
+     * @private
+     */
+    async addClientAuthentication(payload, required) {
+        return (0, client_authentication_js_1.addClientAuthentication)({
+            payload,
+            domain: this.domain,
+            required,
+            clientId: this.clientId,
+            clientSecret: this.clientSecret,
+            clientAssertionSigningKey: this.clientAssertionSigningKey,
+            clientAssertionSigningAlg: this.clientAssertionSigningAlg,
+        });
+    }
+}
+exports.BaseAuthAPI = BaseAuthAPI;
+//# sourceMappingURL=base-auth-api.js.map

package/dist/cjs/auth/base-auth-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-auth-api.js","sourceRoot":"","sources":["../../../src/auth/base-auth-api.ts"],"names":[],"mappings":";;;AAAA,gDAAiD;AACjD,kDAA2D;AAC3D,yEAGoC;AAkBpC,MAAa,YAAa,SAAQ,KAAK;IAErC,YACS,KAAa,EACb,iBAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,OAAgB;QAEvB,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC;QAN3B,UAAK,GAAL,KAAK,CAAQ;QACb,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAS;QANhB,SAAI,GAAG,cAAuB,CAAC;IASxC,CAAC;CACF;AAXD,oCAWC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,2CAA2C;IAC3C,IAAI;IACJ,4BAA4B;IAC5B,uCAAuC;IACvC,IAAI;IAEJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAA0B,CAAC;IAE/B,IAAI;QACF,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;QAChD,OAAO,IAAI,YAAY,CACrB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,iBAAiB,EACtB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,QAAQ,CAAC,OAAO,CACjB,CAAC;KACH;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,IAAI,yBAAa,CACtB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,QAAQ,CAAC,OAAO,EAChB,iCAAiC,CAClC,CAAC;KACH;AACH,CAAC;AACD,MAAa,WAAY,SAAQ,oBAAO;IAOtC,YAAY,OAAoC;QAC9C,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;QACnE,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IACrE,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,uBAAuB,CACrC,OAAuC,EACvC,QAAiB;QAEjB,OAAO,IAAA,kDAAuB,EAAC;YAC7B,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;YACzD,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;SAC1D,CAAC,CAAC;IACL,CAAC;CACF;AAlCD,kCAkCC"}

package/dist/cjs/auth/client-authentication.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addClientAuthentication = void 0;
+const jose = __importStar(require("jose"));
+const uuid_1 = require("uuid");
+/**
+ * Adds client authentication, if available, to the provided payload.
+ *
+ * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
+ * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
+ *
+ * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
+ */
+const addClientAuthentication = async ({ payload, domain, clientId, required, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, }) => {
+    const cid = payload.client_id || clientId;
+    if (clientAssertionSigningKey && !payload.client_assertion) {
+        const alg = clientAssertionSigningAlg || 'RS256';
+        const privateKey = await jose.importPKCS8(clientAssertionSigningKey, alg);
+        payload.client_assertion = await new jose.SignJWT({})
+            .setProtectedHeader({ alg })
+            .setIssuedAt()
+            .setSubject(cid)
+            .setJti((0, uuid_1.v4)())
+            .setIssuer(cid)
+            .setAudience(`https://${domain}/`)
+            .setExpirationTime('2mins')
+            .sign(privateKey);
+        payload.client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+    }
+    else if (clientSecret && !payload.client_secret) {
+        payload.client_secret = clientSecret;
+    }
+    if (required &&
+        (!payload.client_secret || payload.client_secret.trim().length === 0) &&
+        (!payload.client_assertion || payload.client_assertion.trim().length === 0)) {
+        throw new Error('The client_secret or client_assertion field is required.');
+    }
+    return payload;
+};
+exports.addClientAuthentication = addClientAuthentication;
+//# sourceMappingURL=client-authentication.js.map

package/dist/cjs/auth/client-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-authentication.js","sourceRoot":"","sources":["../../../src/auth/client-authentication.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,+BAAkC;AAoBlC;;;;;;;GAOG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAC5C,OAAO,EACP,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,yBAAyB,EACzB,yBAAyB,EACzB,YAAY,GACmB,EAAoC,EAAE;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC1C,IAAI,yBAAyB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;QAC1D,MAAM,GAAG,GAAG,yBAAyB,IAAI,OAAO,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAE1E,OAAO,CAAC,gBAAgB,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;aAClD,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;aAC3B,WAAW,EAAE;aACb,UAAU,CAAC,GAAG,CAAC;aACf,MAAM,CAAC,IAAA,SAAI,GAAE,CAAC;aACd,SAAS,CAAC,GAAG,CAAC;aACd,WAAW,CAAC,WAAW,MAAM,GAAG,CAAC;aACjC,iBAAiB,CAAC,OAAO,CAAC;aAC1B,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO,CAAC,qBAAqB,GAAG,wDAAwD,CAAC;KAC1F;SAAM,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;QACjD,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC;KACtC;IACD,IACE,QAAQ;QACR,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAC3E;QACA,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;KAC7E;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAnCW,QAAA,uBAAuB,2BAmClC"}

package/dist/cjs/auth/database.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Database = void 0;
+const models_js_1 = require("../lib/models.js");
+const runtime_js_1 = require("../lib/runtime.js");
+const base_auth_api_js_1 = require("./base-auth-api.js");
+/**
+ * Sign-up and change-password for Database & Active Directory authentication services.
+ */
+class Database extends base_auth_api_js_1.BaseAuthAPI {
+    /**
+     * Given a user's credentials, and a connection, this endpoint will create a new user using active authentication.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#signup
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   password: '{PASSWORD}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.signUp(data);
+     * ```
+     */
+    async signUp(bodyParameters, initOverrides) {
+        // TODO: call this `validateRequiredParams` so we can use with bodyParameters in the auth api
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['email', 'password', 'connection']);
+        const response = await this.request({
+            path: '/dbconnections/signup',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: { client_id: this.clientId, ...bodyParameters },
+        }, initOverrides);
+        return models_js_1.JSONApiResponse.fromResponse(response);
+    }
+    /**
+     * Given a user's email address and a connection, Auth0 will send a change password email.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#change-password
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.changePassword(data);
+     * ```
+     */
+    async changePassword(bodyParameters, initOverrides) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['email', 'connection']);
+        const response = await this.request({
+            path: '/dbconnections/change_password',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: { client_id: this.clientId, ...bodyParameters },
+        }, initOverrides);
+        return models_js_1.TextApiResponse.fromResponse(response);
+    }
+}
+exports.Database = Database;
+//# sourceMappingURL=database.js.map

package/dist/cjs/auth/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/auth/database.ts"],"names":[],"mappings":";;;AAAA,gDAAkF;AAClF,kDAAkE;AAClE,yDAAiD;AA8GjD;;GAEG;AACH,MAAa,QAAS,SAAQ,8BAAW;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,MAAM,CACV,cAA6B,EAC7B,aAA4B;QAE5B,6FAA6F;QAC7F,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAEnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,2BAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAqC,EACrC,aAA4B;QAE5B,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,2BAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF;AA7ED,4BA6EC"}

package/dist/cjs/auth/id-token-validator.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDTokenValidator = exports.IdTokenValidatorError = void 0;
+const jose = __importStar(require("jose"));
+const DEFAULT_CLOCK_TOLERANCE = 60; // secs
+class IdTokenValidatorError extends Error {
+}
+exports.IdTokenValidatorError = IdTokenValidatorError;
+class IDTokenValidator {
+    constructor({ domain, clientId, clientSecret, agent, headers, timeoutDuration, idTokenSigningAlg = 'RS256', clockTolerance = DEFAULT_CLOCK_TOLERANCE, }) {
+        this.jwks = jose.createRemoteJWKSet(new URL(`https://${domain}/.well-known/jwks.json`), {
+            timeoutDuration,
+            agent,
+            headers,
+        });
+        this.alg = idTokenSigningAlg;
+        this.audience = clientId;
+        this.secret = new TextEncoder().encode(clientSecret);
+        this.issuer = `https://${domain}/`;
+        this.clockTolerance = clockTolerance;
+    }
+    async validate(idToken, { nonce, maxAge, organization } = {}) {
+        const secret = this.alg === 'HS256' ? this.secret : this.jwks;
+        const header = jose.decodeProtectedHeader(idToken);
+        const payload = jose.decodeJwt(idToken);
+        // Check algorithm
+        if (header.alg !== 'RS256' && header.alg !== 'HS256') {
+            throw new Error(`Signature algorithm of "${header.alg}" is not supported. Expected the ID token to be signed with "RS256" or "HS256".`);
+        }
+        // Issuer
+        if (!payload.iss || typeof payload.iss !== 'string') {
+            throw new IdTokenValidatorError('Issuer (iss) claim must be a string present in the ID token');
+        }
+        if (payload.iss !== this.issuer) {
+            throw new IdTokenValidatorError(`Issuer (iss) claim mismatch in the ID token; expected "${this.issuer}", found "${payload.iss}"`);
+        }
+        // Subject
+        if (!payload.sub || typeof payload.sub !== 'string') {
+            throw new IdTokenValidatorError('Subject (sub) claim must be a string present in the ID token');
+        }
+        // Audience
+        if (!payload.aud || !(typeof payload.aud === 'string' || Array.isArray(payload.aud))) {
+            throw new IdTokenValidatorError('Audience (aud) claim must be a string or array of strings present in the ID token');
+        }
+        if (Array.isArray(payload.aud) && !payload.aud.includes(this.audience)) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but was not one of "${payload.aud.join(', ')}"`);
+        }
+        else if (typeof payload.aud === 'string' && payload.aud !== this.audience) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but found "${payload.aud}"`);
+        }
+        // Organization
+        if (organization) {
+            if (!payload.org_id || typeof payload.org_id !== 'string') {
+                throw new IdTokenValidatorError('Organization Id (org_id) claim must be a string present in the ID token');
+            }
+            if (payload.org_id !== organization) {
+                throw new IdTokenValidatorError(`Organization Id (org_id) claim value mismatch in the ID token; expected "${organization}", found "${payload.org_id}"'`);
+            }
+        }
+        // Time validation (epoch)
+        const now = Math.floor(Date.now() / 1000);
+        // Expires at
+        if (!payload.exp || typeof payload.exp !== 'number') {
+            throw new IdTokenValidatorError('Expiration Time (exp) claim must be a number present in the ID token');
+        }
+        const expTime = payload.exp + this.clockTolerance;
+        if (now > expTime) {
+            throw new IdTokenValidatorError(`Expiration Time (exp) claim error in the ID token; current time (${now}) is after expiration time (${expTime})`);
+        }
+        // Issued at
+        if (!payload.iat || typeof payload.iat !== 'number') {
+            throw new IdTokenValidatorError('Issued At (iat) claim must be a number present in the ID token');
+        }
+        // Nonce
+        if (nonce || payload.nonce) {
+            if (!payload.nonce || typeof payload.nonce !== 'string') {
+                throw new IdTokenValidatorError('Nonce (nonce) claim must be a string present in the ID token');
+            }
+            if (payload.nonce !== nonce) {
+                throw new IdTokenValidatorError(`Nonce (nonce) claim mismatch in the ID token; expected "${nonce}", found "${payload.nonce}"`);
+            }
+        }
+        // Authorized party
+        if (Array.isArray(payload.aud) && payload.aud.length > 1) {
+            if (!payload.azp || typeof payload.azp !== 'string') {
+                throw new IdTokenValidatorError('Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values');
+            }
+            if (payload.azp !== this.audience) {
+                throw new IdTokenValidatorError(`Authorized Party (azp) claim mismatch in the ID token; expected "${this.audience}", found "${payload.azp}"`);
+            }
+        }
+        // Authentication time
+        if (maxAge) {
+            if (!payload.auth_time || typeof payload.auth_time !== 'number') {
+                throw new IdTokenValidatorError('Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified');
+            }
+            const authValidUntil = payload.auth_time + maxAge + this.clockTolerance;
+            if (now > authValidUntil) {
+                throw new IdTokenValidatorError(`Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Currrent time (${now}) is after last auth at ${authValidUntil}`);
+            }
+        }
+        await jose.jwtVerify(idToken, secret, {
+            issuer: this.issuer,
+            audience: this.audience,
+            clockTolerance: this.clockTolerance,
+            maxTokenAge: maxAge,
+            algorithms: ['HS256', 'RS256'],
+        });
+    }
+}
+exports.IDTokenValidator = IDTokenValidator;
+//# sourceMappingURL=id-token-validator.js.map

package/dist/cjs/auth/id-token-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-validator.js","sourceRoot":"","sources":["../../../src/auth/id-token-validator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAG7B,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,OAAO;AAE3C,MAAa,qBAAsB,SAAQ,KAAK;CAAG;AAAnD,sDAAmD;AAQnD,MAAa,gBAAgB;IAW3B,YAAY,EACV,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,OAAO,EACP,eAAe,EACf,iBAAiB,GAAG,OAAO,EAC3B,cAAc,GAAG,uBAAuB,GACZ;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,EAAE;YACtF,eAAe;YACf,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,KAA6B,EAAE;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAExC,kBAAkB;QAClB,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE;YACpD,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,GAAG,iFAAiF,CACvH,CAAC;SACH;QACD,SAAS;QACT,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,6DAA6D,CAC9D,CAAC;SACH;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE;YAC/B,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,IAAI,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,GAAG,CACjG,CAAC;SACH;QAED,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;SACH;QAED,WAAW;QACX,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;YACpF,MAAM,IAAI,qBAAqB,CAC7B,mFAAmF,CACpF,CAAC;SACH;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,MAAM,IAAI,qBAAqB,CAC7B,4DACE,IAAI,CAAC,QACP,yBAAyB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnD,CAAC;SACH;aAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;YAC3E,MAAM,IAAI,qBAAqB,CAC7B,4DAA4D,IAAI,CAAC,QAAQ,gBAAgB,OAAO,CAAC,GAAG,GAAG,CACxG,CAAC;SACH;QAED,eAAe;QACf,IAAI,YAAY,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE;gBACzD,MAAM,IAAI,qBAAqB,CAC7B,yEAAyE,CAC1E,CAAC;aACH;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE;gBACnC,MAAM,IAAI,qBAAqB,CAC7B,4EAA4E,YAAY,aAAa,OAAO,CAAC,MAAM,IAAI,CACxH,CAAC;aACH;SACF;QAED,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,aAAa;QACb,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,sEAAsE,CACvE,CAAC;SACH;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAElD,IAAI,GAAG,GAAG,OAAO,EAAE;YACjB,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,GAAG,+BAA+B,OAAO,GAAG,CACjH,CAAC;SACH;QAED,YAAY;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,gEAAgE,CACjE,CAAC;SACH;QAED,QAAQ;QACR,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE;YAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE;gBACvD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;aACH;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE;gBAC3B,MAAM,IAAI,qBAAqB,CAC7B,2DAA2D,KAAK,aAAa,OAAO,CAAC,KAAK,GAAG,CAC9F,CAAC;aACH;SACF;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;gBACnD,MAAM,IAAI,qBAAqB,CAC7B,qHAAqH,CACtH,CAAC;aACH;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;gBACjC,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,IAAI,CAAC,QAAQ,aAAa,OAAO,CAAC,GAAG,GAAG,CAC7G,CAAC;aACH;SACF;QAED,sBAAsB;QACtB,IAAI,MAAM,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,oHAAoH,CACrH,CAAC;aACH;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;YACxE,IAAI,GAAG,GAAG,cAAc,EAAE;gBACxB,MAAM,IAAI,qBAAqB,CAC7B,wJAAwJ,GAAG,2BAA2B,cAAc,EAAE,CACvM,CAAC;aACH;SACF;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAa,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;CACF;AA9KD,4CA8KC"}

package/dist/cjs/auth/index.js

@@ -0,0 +1,40 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationClient = exports.AuthApiError = exports.IdTokenValidatorError = void 0;
+const telemetry_middleware_js_1 = require("../lib/middleware/telemetry-middleware.js");
+const database_js_1 = require("./database.js");
+const oauth_js_1 = require("./oauth.js");
+const passwordless_js_1 = require("./passwordless.js");
+__exportStar(require("./database.js"), exports);
+__exportStar(require("./oauth.js"), exports);
+__exportStar(require("./passwordless.js"), exports);
+var id_token_validator_js_1 = require("./id-token-validator.js");
+Object.defineProperty(exports, "IdTokenValidatorError", { enumerable: true, get: function () { return id_token_validator_js_1.IdTokenValidatorError; } });
+var base_auth_api_js_1 = require("./base-auth-api.js");
+Object.defineProperty(exports, "AuthApiError", { enumerable: true, get: function () { return base_auth_api_js_1.AuthApiError; } });
+class AuthenticationClient {
+    constructor(options) {
+        if (options.telemetry !== false) {
+            options.middleware = [...(options.middleware || []), new telemetry_middleware_js_1.TelemetryMiddleware(options)];
+        }
+        this.database = new database_js_1.Database(options);
+        this.oauth = new oauth_js_1.OAuth(options);
+        this.passwordless = new passwordless_js_1.Passwordless(options);
+    }
+}
+exports.AuthenticationClient = AuthenticationClient;
+//# sourceMappingURL=index.js.map

package/dist/cjs/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,uFAAgF;AAEhF,+CAAyC;AACzC,yCAAmC;AACnC,uDAAiD;AAEjD,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,iEAAwF;AAAvD,8HAAA,qBAAqB,OAAA;AACtD,uDAA+E;AAAtE,gHAAA,YAAY,OAAA;AAErB,MAAa,oBAAoB;IAK/B,YAAY,OAAoC;QAC9C,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE;YAC/B,OAAO,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,IAAI,6CAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;SACxF;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAK,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,8BAAY,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;AAdD,oDAcC"}

package/dist/cjs/auth/oauth.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth = void 0;
+const runtime_js_1 = require("../lib/runtime.js");
+const base_auth_api_js_1 = require("./base-auth-api.js");
+const id_token_validator_js_1 = require("./id-token-validator.js");
+/**
+ *  OAuth 2.0 flows.
+ */
+class OAuth extends base_auth_api_js_1.BaseAuthAPI {
+    constructor(options) {
+        super(options);
+        this.idTokenValidator = new id_token_validator_js_1.IDTokenValidator(options);
+    }
+    async validateIdToken(tokenSet, idTokenValidateOptions) {
+        const { id_token: idToken } = tokenSet;
+        if (idToken) {
+            await this.idTokenValidator.validate(idToken, idTokenValidateOptions);
+        }
+    }
+    /**
+     * Perform an OAuth 2.0 grant.
+     * (You should only need this if you can't find the grant you need in this library.)
+     */
+    async grant(grantType, bodyParameters, { idTokenValidateOptions, initOverrides } = {}) {
+        const response = await this.request({
+            path: '/oauth/token',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                client_id: this.clientId,
+                ...bodyParameters,
+                grant_type: grantType,
+            }),
+        }, initOverrides);
+        const res = await runtime_js_1.JSONApiResponse.fromResponse(response);
+        await this.validateIdToken(res.data, idTokenValidateOptions);
+        return res;
+    }
+    /**
+     * This is the flow that regular web apps use to access an API.
+     *
+     * Use this endpoint to exchange an Authorization Code for a Token.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow44
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrant({ code: 'mycode' });
+     * ```
+     */
+    async authorizationCodeGrant(bodyParameters, options = {}) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['code']);
+        return this.grant('authorization_code', await this.addClientAuthentication(bodyParameters, true), options);
+    }
+    /**
+     * PKCE was originally designed to protect the authorization code flow in mobile apps,
+     * but its ability to prevent authorization code injection makes it useful for every type of OAuth client,
+     * even web apps that use client authentication.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow-with-pkce45
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrantWithPKCE({
+     *   code: 'mycode',
+     *   code_verifier: 'mycodeverifier'
+     * });
+     * ```
+     */
+    async authorizationCodeGrantWithPKCE(bodyParameters, options = {}) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['code', 'code_verifier']);
+        return this.grant('authorization_code', await this.addClientAuthentication(bodyParameters, false), options);
+    }
+    /**
+     * This is the OAuth 2.0 grant that server processes use to access an API.
+     *
+     * Use this endpoint to directly request an Access Token by using the Client's credentials
+     * (a Client ID and a Client Secret or a Client Assertion).
+     *
+     * See: https://auth0.com/docs/api/authentication#client-credentials-flow
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.clientCredentialsGrant({ audience: 'myaudience' });
+     * ```
+     */
+    async clientCredentialsGrant(bodyParameters, options = {}) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['audience']);
+        return this.grant('client_credentials', await this.addClientAuthentication(bodyParameters, true), options);
+    }
+    /**
+     * This information is typically received from a highly trusted public client like a SPA*.
+     * (<strong>*Note:</string> For single-page applications and native/mobile apps, we recommend using web flows instead.)
+     *
+     * See: https://auth0.com/docs/api/authentication#resource-owner-password
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.clientCredentialsGrant({
+     *     username: 'myusername@example.com',
+     *     password: 'mypassword'
+     *   },
+     *   { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } }
+     * );
+     * ```
+     *
+     * Set the'auth0-forwarded-for' header to the end-user IP as a string value if you want
+     * brute-force protection to work in server-side scenarios.
+     *
+     * See https://auth0.com/docs/get-started/authentication-and-authorization-flow/avoid-common-issues-with-resource-owner-password-flow-and-attack-protection
+     *
+     */
+    async passwordGrant(bodyParameters, options = {}) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['username', 'password']);
+        return this.grant(bodyParameters.realm ? 'http://auth0.com/oauth/grant-type/password-realm' : 'password', await this.addClientAuthentication(bodyParameters, false), options);
+    }
+    /**
+     * Use this endpoint to refresh an Access Token using the Refresh Token you got during authorization.
+     *
+     * See: https://auth0.com/docs/api/authentication#refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.refreshTokenGrant({ refresh_token: 'myrefreshtoken' })
+     * ```
+     */
+    async refreshTokenGrant(bodyParameters, options = {}) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['refresh_token']);
+        return this.grant('refresh_token', await this.addClientAuthentication(bodyParameters, false), options);
+    }
+    /**
+     * Use this endpoint to invalidate a Refresh Token if it has been compromised.
+     *
+     * The behaviour of this endpoint depends on the state of the <a href="https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens#refresh-tokens-and-grants">Refresh Token Revocation Deletes Grant</a> toggle.
+     * If this toggle is enabled, then each revocation request invalidates not only the specific token, but all other tokens based on the same authorization grant.
+     * This means that all Refresh Tokens that have been issued for the same user, application, and audience will be revoked.
+     * If this toggle is disabled, then only the refresh token is revoked, while the grant is left intact.
+     *
+     * See: https://auth0.com/docs/api/authentication#revoke-refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.revokeRefreshToken({ token: 'myrefreshtoken' })
+     * ```
+     */
+    async revokeRefreshToken(bodyParameters, options = {}) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['token']);
+        const response = await this.request({
+            path: '/oauth/revoke',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: await this.addClientAuthentication({ client_id: this.clientId, ...bodyParameters }, false),
+        }, options.initOverrides);
+        return runtime_js_1.VoidApiResponse.fromResponse(response);
+    }
+}
+exports.OAuth = OAuth;
+//# sourceMappingURL=oauth.js.map

package/dist/cjs/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":";;;AAAA,kDAK2B;AAC3B,yDAA8E;AAC9E,mEAAmF;AAsKnF;;GAEG;AACH,MAAa,KAAM,SAAQ,8BAAW;IAEpC,YAAY,OAAoC;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,gBAAgB,GAAG,IAAI,wCAAgB,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,QAAkB,EAClB,sBAA+C;QAE/C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,OAAO,EAAE;YACX,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;SACvE;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,cAAmC,EACnC,EAAE,sBAAsB,EAAE,aAAa,KAAmB,EAAE;QAE5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,GAAG,cAAc;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAC;SACH,EACD,aAAa,CACd,CAAC;QAEF,MAAM,GAAG,GAA8B,MAAM,4BAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpF,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAAyC,EAAE;QAE3C,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EACxD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,8BAA8B,CAClC,cAAqD,EACrD,UAAyC,EAAE;QAE3C,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAEzE,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAA4C,EAAE;QAE9C,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EACxD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC,EACpC,UAAwB,EAAE;QAE1B,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAExE,OAAO,IAAI,CAAC,KAAK,CACf,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,UAAU,EACtF,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAwC,EACxC,UAAwB,EAAE;QAE1B,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAEjE,OAAO,IAAI,CAAC,KAAK,CACf,eAAe,EACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,kBAAkB,CACtB,cAAyC,EACzC,UAA4C,EAAE;QAE9C,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CACtC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE,EAC/C,KAAK,CACN;SACF,EACD,OAAO,CAAC,aAAa,CACtB,CAAC;QAEF,OAAO,4BAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF;AAlQD,sBAkQC"}