nestjs-keycloak-auth 1.0.0

package/dist/guards/resource.guard.js

@@ -0,0 +1,245 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var ResourceGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceGuard = void 0;
+const core_1 = require("@nestjs/core");
+const keycloak_token_1 = require("../token/keycloak-token");
+const public_decorator_1 = require("../decorators/public.decorator");
+const resource_decorator_1 = require("../decorators/resource.decorator");
+const internal_util_1 = require("../internal.util");
+const keycloak_http_service_1 = require("../services/keycloak-http.service");
+const enforcer_options_decorator_1 = require("../decorators/enforcer-options.decorator");
+const keycloak_multitenant_service_1 = require("../services/keycloak-multitenant.service");
+const common_1 = require("@nestjs/common");
+const scopes_decorator_1 = require("../decorators/scopes.decorator");
+const constants_1 = require("../constants");
+/**
+ * This adds a resource guard, which is policy enforcement by default is permissive.
+ * Only controllers annotated with `@Resource` and methods with `@Scopes`
+ * are handled by this guard.
+ */
+let ResourceGuard = ResourceGuard_1 = class ResourceGuard {
+    constructor(singleTenant, keycloakOpts, multiTenant, keycloakHttp) {
+        this.singleTenant = singleTenant;
+        this.keycloakOpts = keycloakOpts;
+        this.multiTenant = multiTenant;
+        this.keycloakHttp = keycloakHttp;
+        this.logger = new common_1.Logger(ResourceGuard_1.name);
+        this.reflector = new core_1.Reflector();
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
+            const resource = this.reflector.get(resource_decorator_1.META_RESOURCE, context.getClass());
+            const explicitScopes = (_a = this.reflector.get(scopes_decorator_1.META_SCOPES, context.getHandler())) !== null && _a !== void 0 ? _a : [];
+            const conditionalScopes = this.reflector.get(scopes_decorator_1.META_CONDITIONAL_SCOPES, context.getHandler());
+            const isPublic = this.reflector.getAllAndOverride(public_decorator_1.META_PUBLIC, [
+                context.getClass(),
+                context.getHandler(),
+            ]);
+            const enforcerOptions = this.reflector.getAllAndOverride(enforcer_options_decorator_1.META_ENFORCER_OPTIONS, [context.getClass(), context.getHandler()]);
+            // Default to permissive
+            const policyEnforcementMode = this.keycloakOpts.policyEnforcement || constants_1.PolicyEnforcementMode.PERMISSIVE;
+            const shouldAllow = policyEnforcementMode === constants_1.PolicyEnforcementMode.PERMISSIVE;
+            // Extract request/response
+            const [request] = (0, internal_util_1.extractRequest)(context);
+            // if is not an HTTP request ignore this guard
+            if (!request) {
+                return true;
+            }
+            if (!request.user && isPublic) {
+                this.logger.verbose('Route has no user, and is public, allowed');
+                return true;
+            }
+            const tenantConfig = yield (0, internal_util_1.useTenantConfig)(request, request.accessToken, this.singleTenant, this.multiTenant, this.keycloakOpts);
+            // No resource given, check policy enforcement mode
+            if (!resource) {
+                if (shouldAllow) {
+                    this.logger.verbose('Controller has no @Resource defined, request allowed due to policy enforcement');
+                }
+                else {
+                    this.logger.verbose('Controller has no @Resource defined, request denied due to policy enforcement');
+                }
+                return shouldAllow;
+            }
+            // Build the required scopes
+            let token;
+            if (conditionalScopes) {
+                token = new keycloak_token_1.KeycloakToken(request.accessToken, tenantConfig.clientId);
+            }
+            const conditionalScopesResult = conditionalScopes
+                ? conditionalScopes(request, token)
+                : [];
+            const scopes = [...explicitScopes, ...conditionalScopesResult];
+            // Attach resolved scopes
+            request.scopes = scopes;
+            // No scopes given, check policy enforcement mode
+            if (!scopes || scopes.length === 0) {
+                if (shouldAllow) {
+                    this.logger.verbose('Route has no @Scope/@ConditionalScopes defined, request allowed due to policy enforcement');
+                }
+                else {
+                    this.logger.verbose('Route has no @Scope/@ConditionalScopes defined, request denied due to policy enforcement');
+                }
+                return shouldAllow;
+            }
+            this.logger.verbose(`Protecting resource [ ${resource} ] with scopes: [ ${scopes} ]`);
+            const user = (_c = (_b = request.user) === null || _b === void 0 ? void 0 : _b.preferred_username) !== null && _c !== void 0 ? _c : 'user';
+            // Build permissions as "resource#scope" pairs (Keycloak UMA format)
+            const permissions = scopes.map((scope) => `${resource}#${scope}`);
+            // Local permission check: if the access token already contains the
+            // required permissions, allow immediately without a server round-trip
+            // (matches keycloak-connect enforcer.js behavior)
+            if (request.accessToken) {
+                const accessToken = token !== null && token !== void 0 ? token : new keycloak_token_1.KeycloakToken(request.accessToken, tenantConfig.clientId);
+                const allPermissionsGranted = scopes.every((scope) => accessToken.hasPermission(resource, scope));
+                if (allPermissionsGranted) {
+                    this.logger.verbose(`Resource [ ${resource} ] granted to [ ${user} ] (local token check)`);
+                    return true;
+                }
+            }
+            // Server-side permission check
+            const claims = this.resolveClaims(request, enforcerOptions);
+            const responseMode = (_d = enforcerOptions === null || enforcerOptions === void 0 ? void 0 : enforcerOptions.response_mode) !== null && _d !== void 0 ? _d : 'permissions';
+            const audience = (_e = enforcerOptions === null || enforcerOptions === void 0 ? void 0 : enforcerOptions.resource_server_id) !== null && _e !== void 0 ? _e : tenantConfig.clientId;
+            const isPublicClient = tenantConfig.isPublic;
+            if (responseMode === 'permissions') {
+                // Permissions mode: get permission list from server, validate locally
+                try {
+                    const serverPermissions = (yield this.keycloakHttp.checkPermission(tenantConfig.realmUrl, tenantConfig.clientId, tenantConfig.secret, request.accessToken, permissions, {
+                        claims: claims || undefined,
+                        response_mode: 'permissions',
+                        audience,
+                        isPublic: isPublicClient,
+                    }));
+                    const isAllowed = this.validatePermissionsLocally(serverPermissions, resource, scopes);
+                    if (isAllowed) {
+                        // Attach permissions to request (matches original enforcer.js)
+                        request.permissions = serverPermissions;
+                        this.logger.verbose(`Resource [ ${resource} ] granted to [ ${user} ]`);
+                    }
+                    else {
+                        this.logger.verbose(`Resource [ ${resource} ] denied to [ ${user} ]`);
+                    }
+                    return isAllowed;
+                }
+                catch (_f) {
+                    this.logger.verbose(`Resource [ ${resource} ] denied to [ ${user} ] (permissions check failed)`);
+                    return false;
+                }
+            }
+            if (responseMode === 'token') {
+                // Token mode: get a new grant with permissions, validate locally
+                try {
+                    const grant = (yield this.keycloakHttp.checkPermission(tenantConfig.realmUrl, tenantConfig.clientId, tenantConfig.secret, request.accessToken, permissions, {
+                        claims: claims || undefined,
+                        response_mode: 'token',
+                        audience,
+                        isPublic: isPublicClient,
+                    }));
+                    const grantToken = new keycloak_token_1.KeycloakToken(grant.access_token, tenantConfig.clientId);
+                    const isAllowed = scopes.every((scope) => grantToken.hasPermission(resource, scope));
+                    if (isAllowed) {
+                        this.logger.verbose(`Resource [ ${resource} ] granted to [ ${user} ]`);
+                    }
+                    else {
+                        this.logger.verbose(`Resource [ ${resource} ] denied to [ ${user} ]`);
+                    }
+                    return isAllowed;
+                }
+                catch (_g) {
+                    this.logger.verbose(`Resource [ ${resource} ] denied to [ ${user} ] (token check failed)`);
+                    return false;
+                }
+            }
+            // Default: decision mode
+            const isAllowed = (yield this.keycloakHttp.checkPermission(tenantConfig.realmUrl, tenantConfig.clientId, tenantConfig.secret, request.accessToken, permissions, {
+                claims: claims || undefined,
+                response_mode: 'decision',
+                audience,
+                isPublic: isPublicClient,
+            }));
+            // If statement for verbose logging only
+            if (!isAllowed) {
+                this.logger.verbose(`Resource [ ${resource} ] denied to [ ${user} ]`);
+            }
+            else {
+                this.logger.verbose(`Resource [ ${resource} ] granted to [ ${user} ]`);
+            }
+            return isAllowed;
+        });
+    }
+    /**
+    * Validate server-returned permissions against expected resource:scope pairs.
+    * Matches keycloak-connect enforcer.js handlePermissions logic.
+    */
+    validatePermissionsLocally(serverPermissions, resource, scopes) {
+        if (!serverPermissions || serverPermissions.length === 0) {
+            return false;
+        }
+        for (const scope of scopes) {
+            let found = false;
+            for (const permission of serverPermissions) {
+                if (permission.rsid === resource || permission.rsname === resource) {
+                    if (scope) {
+                        if (permission.scopes && permission.scopes.length > 0) {
+                            if (!permission.scopes.includes(scope)) {
+                                return false;
+                            }
+                            found = true;
+                            break;
+                        }
+                        return false;
+                    }
+                    found = true;
+                    break;
+                }
+            }
+            if (!found) {
+                return false;
+            }
+        }
+        return true;
+    }
+    resolveClaims(request, enforcerOptions) {
+        var _a;
+        if (!enforcerOptions) {
+            return undefined;
+        }
+        const claims = (_a = enforcerOptions.claims) === null || _a === void 0 ? void 0 : _a.call(enforcerOptions, request);
+        if (claims) {
+            this.logger.verbose(`Enforcing claims, keys: ${Object.keys(claims).join(', ')}`);
+        }
+        return claims;
+    }
+};
+exports.ResourceGuard = ResourceGuard;
+exports.ResourceGuard = ResourceGuard = ResourceGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, keycloak_multitenant_service_1.KeycloakMultiTenantService,
+        keycloak_http_service_1.KeycloakHttpService])
+], ResourceGuard);

package/dist/guards/role.guard.d.ts

@@ -0,0 +1,17 @@
+import { ResolvedTenantConfig } from '../interface/tenant-config.interface';
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
+import { KeycloakMultiTenantService } from '../services/keycloak-multitenant.service';
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+/**
+ * A permissive type of role guard. Roles are set via `@Roles` decorator.
+ * @since 1.1.0
+ */
+export declare class RoleGuard implements CanActivate {
+    private singleTenant;
+    private keycloakOpts;
+    private multiTenant;
+    private readonly logger;
+    private readonly reflector;
+    constructor(singleTenant: ResolvedTenantConfig, keycloakOpts: KeycloakAuthConfig, multiTenant: KeycloakMultiTenantService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/guards/role.guard.js

@@ -0,0 +1,113 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var RoleGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleGuard = void 0;
+const core_1 = require("@nestjs/core");
+const errors_1 = require("../errors");
+const keycloak_token_1 = require("../token/keycloak-token");
+const internal_util_1 = require("../internal.util");
+const roles_decorator_1 = require("../decorators/roles.decorator");
+const keycloak_multitenant_service_1 = require("../services/keycloak-multitenant.service");
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants");
+/**
+ * A permissive type of role guard. Roles are set via `@Roles` decorator.
+ * @since 1.1.0
+ */
+let RoleGuard = RoleGuard_1 = class RoleGuard {
+    constructor(singleTenant, keycloakOpts, multiTenant) {
+        this.singleTenant = singleTenant;
+        this.keycloakOpts = keycloakOpts;
+        this.multiTenant = multiTenant;
+        this.logger = new common_1.Logger(RoleGuard_1.name);
+        this.reflector = new core_1.Reflector();
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const roleMerge = this.keycloakOpts.roleMerge
+                ? this.keycloakOpts.roleMerge
+                : constants_1.RoleMerge.OVERRIDE;
+            const roles = [];
+            const matchingMode = this.reflector.getAllAndOverride(roles_decorator_1.META_ROLE_MATCHING_MODE, [context.getClass(), context.getHandler()]);
+            if (roleMerge == constants_1.RoleMerge.ALL) {
+                const mergedRoles = this.reflector.getAllAndMerge(roles_decorator_1.META_ROLES, [
+                    context.getClass(),
+                    context.getHandler(),
+                ]);
+                if (mergedRoles) {
+                    roles.push(...mergedRoles);
+                }
+            }
+            else if (roleMerge == constants_1.RoleMerge.OVERRIDE) {
+                const resultRoles = this.reflector.getAllAndOverride(roles_decorator_1.META_ROLES, [context.getClass(), context.getHandler()]);
+                if (resultRoles) {
+                    roles.push(...resultRoles);
+                }
+            }
+            else {
+                throw new errors_1.KeycloakConfigError(`Unknown role merge: ${roleMerge}`);
+            }
+            if (roles.length === 0) {
+                return true;
+            }
+            const roleMatchingMode = matchingMode !== null && matchingMode !== void 0 ? matchingMode : constants_1.RoleMatch.ANY;
+            this.logger.verbose(`Using matching mode: ${roleMatchingMode}`, { roles });
+            // Extract request
+            const [request] = (0, internal_util_1.extractRequest)(context);
+            // if is not an HTTP request ignore this guard
+            if (!request) {
+                return true;
+            }
+            const { accessToken } = request;
+            if (!accessToken) {
+                // No access token attached, auth guard should have attached the necessary token
+                this.logger.warn('No access token found in request, are you sure AuthGuard is first in the chain?');
+                return false;
+            }
+            // Resolve tenant config to get clientId
+            const tenantConfig = yield (0, internal_util_1.useTenantConfig)(request, accessToken, this.singleTenant, this.multiTenant, this.keycloakOpts);
+            // Use native KeycloakToken for role checking — pure in-memory, no HTTP
+            const token = new keycloak_token_1.KeycloakToken(accessToken, tenantConfig.clientId);
+            // For verbose logging, we store it instead of returning it immediately
+            const granted = roleMatchingMode === constants_1.RoleMatch.ANY
+                ? roles.some((r) => token.hasRole(r))
+                : roles.every((r) => token.hasRole(r));
+            if (granted) {
+                this.logger.verbose('Resource granted due to role(s)');
+            }
+            else {
+                this.logger.verbose('Resource denied due to mismatched role(s)');
+            }
+            return granted;
+        });
+    }
+};
+exports.RoleGuard = RoleGuard;
+exports.RoleGuard = RoleGuard = RoleGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, keycloak_multitenant_service_1.KeycloakMultiTenantService])
+], RoleGuard);

package/dist/index.d.ts

@@ -0,0 +1 @@
+export * from './keycloak-auth.module';

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// public-api
+__exportStar(require("./keycloak-auth.module"), exports);

package/dist/interface/enforcer-options.interface.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Local replacement for keycloak-connect's EnforcerOptions.
+ */
+export interface KeycloakEnforcerOptions {
+    response_mode?: 'decision' | 'permissions' | 'token';
+    resource_server_id?: string;
+    claims?: (request: unknown) => Record<string, unknown>;
+}

package/dist/interface/enforcer-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/interface/jwks.interface.d.ts

@@ -0,0 +1,22 @@
+export interface JwksKey {
+    kid: string;
+    kty: string;
+    alg?: string;
+    use?: string;
+    n?: string;
+    e?: string;
+    x5c?: string[];
+    x5t?: string;
+    'x5t#S256'?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+    [key: string]: unknown;
+}
+export interface JwksResponse {
+    keys: JwksKey[];
+}
+export interface CachedJwks {
+    keys: Map<string, JwksKey>;
+    fetchedAt: number;
+}

package/dist/interface/jwks.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/interface/jwt.interface.d.ts

@@ -0,0 +1,46 @@
+export interface JwtHeader {
+    alg?: string;
+    typ?: string;
+    kid?: string;
+    [key: string]: unknown;
+}
+export interface JwtPermission {
+    rsid?: string;
+    rsname?: string;
+    scopes?: string[];
+}
+export interface JwtContent {
+    exp: number;
+    iat?: number;
+    typ?: string;
+    iss?: string;
+    aud?: string | string[];
+    azp?: string;
+    sub?: string;
+    preferred_username?: string;
+    realm_access?: {
+        roles: string[];
+    };
+    resource_access?: Record<string, {
+        roles: string[];
+    }>;
+    authorization?: {
+        permissions: JwtPermission[];
+    };
+    scope?: string;
+    sid?: string;
+    events?: Record<string, unknown>;
+    action?: string;
+    adapterSessionIds?: string[];
+    notBefore?: number;
+    [key: string]: unknown;
+}
+export interface JwtPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    iat?: number;
+    preferred_username?: string;
+    [key: string]: unknown;
+}

package/dist/interface/jwt.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/interface/keycloak-auth-module-async-options.interface.d.ts

@@ -0,0 +1,11 @@
+import { ModuleMetadata, Type } from '@nestjs/common/interfaces';
+import { KeycloakAuthOptions } from './keycloak-auth-options.interface';
+import { KeycloakAuthOptionsFactory } from './keycloak-auth-options-factory.interface';
+import { InjectionToken } from '@nestjs/common/interfaces/modules/injection-token.interface';
+import { OptionalFactoryDependency } from '@nestjs/common/interfaces/modules/optional-factory-dependency.interface';
+export interface KeycloakAuthModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    inject?: Array<InjectionToken | OptionalFactoryDependency>;
+    useExisting?: Type<KeycloakAuthOptionsFactory>;
+    useClass?: Type<KeycloakAuthOptionsFactory>;
+    useFactory?: (...args: unknown[]) => Promise<KeycloakAuthOptions> | KeycloakAuthOptions;
+}

package/dist/interface/keycloak-auth-module-async-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/interface/keycloak-auth-options-factory.interface.d.ts

@@ -0,0 +1,4 @@
+import { KeycloakAuthOptions } from './keycloak-auth-options.interface';
+export interface KeycloakAuthOptionsFactory {
+    createKeycloakAuthOptions(): Promise<KeycloakAuthOptions> | KeycloakAuthOptions;
+}

package/dist/interface/keycloak-auth-options-factory.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });