ng-secure-fetch 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Prathamesh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,410 @@
+# ng-secure-fetch
+
+Zero-dependency Angular library providing **RSA-2048-OAEP + AES-256-GCM hybrid encryption** with automatic HTTP request/response encryption and sessionStorage caching.
+
+**Browser-only library** using the Web Crypto API - requires browser environment.
+
+## Features
+
+- Hybrid encryption: RSA-2048-OAEP + AES-256-GCM
+- Automatic HTTP interceptors (transparent encryption/decryption)
+- SessionStorage caching (95% faster page refresh)
+- Public key pinning (SHA-256 hash verification)
+- Advanced pattern matching with dynamic segments
+- Per-request unique AES keys
+- Zero dependencies (Web Crypto API)
+- Browser environment only
+
+## Compatibility
+
+- **Angular**: 17+ (compatible with Angular 17 and all future versions)
+- **Environment**: Browser only (uses `window.crypto` Web Crypto API)
+- **Node.js**: Not supported in standard Node.js environments without polyfills
+
+## Installation
+
+```bash
+npm install ng-secure-fetch
+```
+
+## Quick Start
+
+### 1. Import and Configure
+
+```typescript
+import { ApplicationConfig } from '@angular/core';
+import { provideNgSecureFetch } from 'ng-secure-fetch';
+import { environment } from './environments/environment';
+
+// In your app.config.ts (standalone) or app.module.ts
+export const appConfig: ApplicationConfig = {
+  providers: [
+    provideNgSecureFetch({
+      enableEncryption: true,
+      publicKeyEndpoint: environment.apiUrl + '/crypto/init',
+      expectedPublicKeyHash: 'your-sha256-hash-here',
+      encryptDecryptForEndpoints: ['*'],
+      skipEncryptDecryptForEndpoints: ['/public/*'],
+      publicKeyHeaderName: 'X-Client-Init',
+      aesKeyHeaderName: 'X-Request-Context',
+      ivHeaderName: 'X-Client-Ref',
+      enableDebugLogging: true,
+      publicKeyFetchRetries: 3
+    })
+  ]
+};
+```
+
+### 2. Get Your Public Key Hash
+
+Enable debug logging temporarily to get your public key hash:
+
+```typescript
+enableDebugLogging: true
+```
+
+Check console output:
+```
+[ng-secure-fetch] Public key hash: abc123def456...your-actual-hash...
+```
+
+Copy the hash to `expectedPublicKeyHash` in your configuration.
+
+### 3. Done!
+
+All HTTP requests matching your endpoint patterns are now automatically encrypted.
+
+## Configuration
+
+```typescript
+interface SecurityConfig {
+  enableEncryption?: boolean;                  // Master switch (default: true)
+  publicKeyEndpoint?: string;                  // API endpoint for public key
+  expectedPublicKeyHash?: string;              // SHA-256 hash for MITM prevention
+  encryptDecryptForEndpoints?: string[];       // Endpoint patterns (default: ['*'])
+  skipEncryptDecryptForEndpoints?: string[];   // Exclude patterns (higher priority)
+  publicKeyHeaderName?: string;                // Custom public key header (default: 'X-Client-Init')
+  aesKeyHeaderName?: string;                   // Custom AES key header (default: 'X-Request-Context')
+  ivHeaderName?: string;                       // Custom IV header (default: 'X-Client-Ref')
+  enableDebugLogging?: boolean;                // Console logs (default: false)
+  publicKeyFetchRetries?: number;              // Retry attempts (default: 3)
+}
+```
+
+## Endpoint Pattern Matching
+
+Supports advanced pattern matching with dynamic segments and exclusion patterns:
+
+| Pattern | Description | Examples |
+|---------|-------------|----------|
+| `['*']` | Match all endpoints | Any URL |
+| `['/api/*']` | Glob pattern | `/api/users`, `/api/products` |
+| `['/exact/path']` | Exact substring | URLs containing `/exact/path` |
+| `['v1/{ignore}/users']` | Dynamic segment | `v1/MT1/users`, `v1/MT2/users` |
+| `['/api/{ignore}/items/{ignore}']` | Multiple dynamic | `/api/v1/items/123` |
+
+### Dynamic Segments with `{ignore}`
+
+```typescript
+// Pattern: 'v1/universal/business/applicationform/{ignore}/pocketInsurance'
+// Matches:
+//   ✅ v1/universal/business/applicationform/MT1/pocketInsurance
+//   ✅ v1/universal/business/applicationform/MT2/pocketInsurance
+//   ✅ v1/universal/business/applicationform/ABC123/pocketInsurance
+//   ❌ v1/universal/business/applicationform/pocketInsurance (missing segment)
+
+encryptDecryptForEndpoints: [
+  'v1/universal/business/applicationform/{ignore}/pocketInsurance'
+]
+```
+
+The `{ignore}` placeholder matches any non-slash characters, perfect for dynamic IDs or version numbers.
+
+### Skip Patterns (Exclusion with Higher Priority)
+
+Use `skipEncryptDecryptForEndpoints` to exclude specific endpoints even if they match `encryptDecryptForEndpoints`:
+
+```typescript
+provideNgSecureFetch({
+  enableEncryption: true,
+  
+  // Encrypt all API endpoints
+  encryptDecryptForEndpoints: ['*'],
+  
+  // But skip these specific endpoints (higher priority)
+  skipEncryptDecryptForEndpoints: [
+    '/v1/public/*',                    // Skip all public APIs
+    '/v1/health/check',                // Skip health check
+    'v1/user/{ignore}/profile/image'   // Skip profile image endpoints
+  ],
+  
+  // ...other config
+})
+```
+
+**Priority:**
+1. `skipEncryptDecryptForEndpoints` is checked **first** (if match → skip encryption)
+2. `encryptDecryptForEndpoints` is checked **second** (if match → encrypt)
+3. If neither matches → no encryption
+
+**Example Scenarios:**
+```typescript
+// Scenario 1: Encrypt all except public endpoints
+encryptDecryptForEndpoints: ['*']
+skipEncryptDecryptForEndpoints: ['/v1/public/*']
+// Result: /v1/public/data → not encrypted
+//         /v1/private/data → encrypted
+
+// Scenario 2: Encrypt specific endpoints but skip one
+encryptDecryptForEndpoints: ['v1/api/{ignore}/process']
+skipEncryptDecryptForEndpoints: ['v1/api/health/process']
+// Result: v1/api/MT1/process → encrypted
+//         v1/api/health/process → not encrypted (skip has priority)
+
+// Scenario 3: Fine-grained control
+encryptDecryptForEndpoints: ['/v1/business/*', '/v2/universal/*']
+skipEncryptDecryptForEndpoints: ['/v1/business/public/*']
+// Result: /v1/business/public/data → not encrypted (skip wins)
+//         /v1/business/private/data → encrypted
+//         /v2/universal/anything → encrypted
+```
+
+## How It Works
+
+### Initialization
+1. Check sessionStorage for cached PEM key
+2. If found: validate hash, import key, continue (5-10ms)
+3. If not found: fetch from API, verify hash, cache, continue (200-300ms)
+
+### Request Encryption (POST/PUT/PATCH)
+1. Generate random AES-256-GCM key + IV
+2. Encrypt payload with AES-GCM
+3. Encrypt AES key + IV with RSA public key
+4. Send encrypted data in body, keys in headers
+
+### Response Decryption
+1. Extract AES key + IV from response headers
+2. Decrypt response body with AES-GCM
+3. Return decrypted data to component
+
+## Backend Requirements
+
+### 1. Public Key Endpoint (GET /crypto/init)
+
+```
+HTTP/1.1 200 OK
+X-Client-Init: -----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
+-----END PUBLIC KEY-----
+Access-Control-Expose-Headers: X-Client-Init
+```
+
+**CORS is critical:** Without `Access-Control-Expose-Headers`, Angular cannot access the header even if visible in Network tab.
+
+### 2. Decrypt Requests
+
+- Extract `X-Request-Context` (RSA-encrypted AES key)
+- Extract `X-Client-Ref` (RSA-encrypted IV)
+- Decrypt with RSA private key
+- Decrypt request body with AES-256-GCM
+- Remove padding (split by `||`)
+
+### 3. Encrypt Responses
+
+```
+HTTP/1.1 200 OK
+X-Request-Context: <base64-raw-aes-key>
+X-Client-Ref: <base64-raw-iv>
+Access-Control-Expose-Headers: X-Request-Context, X-Client-Ref
+
+<Base64 encrypted data>
+```
+
+**Important:** Response headers contain raw AES key/IV (not RSA-encrypted), just base64-encoded.
+
+## Custom Header Names
+
+By default, the library expects the public key in the `X-Client-Init` header. You can customize this:
+
+```typescript
+// app.config.ts or app.module.ts
+provideNgSecureFetch({
+  enableEncryption: true,
+  publicKeyEndpoint: environment.apiUrl + '/crypto/init',
+  publicKeyHeaderName: 'X-Custom-Public-Key',  // Custom header name
+  expectedPublicKeyHash: 'your-sha256-hash-here',
+  encryptDecryptForEndpoints: ['*'],
+  enableDebugLogging: false,
+  publicKeyFetchRetries: 3
+})
+```
+
+**Backend Response:**
+```
+HTTP/1.1 200 OK
+X-Custom-Public-Key: -----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
+-----END PUBLIC KEY-----
+Access-Control-Expose-Headers: X-Custom-Public-Key
+```
+
+**Use Cases:**
+- Corporate proxy requirements (some proxies block certain headers)
+- Compliance with company header naming conventions
+- Avoiding conflicts with existing headers
+- Custom security policies
+
+### Custom AES Key and IV Headers
+
+You can also customize the headers used for AES key and IV exchange:
+
+```typescript
+// app.config.ts or app.module.ts
+provideNgSecureFetch({
+  enableEncryption: true,
+  publicKeyEndpoint: environment.apiUrl + '/crypto/init',
+  publicKeyHeaderName: 'X-Custom-Public-Key',
+  aesKeyHeaderName: 'X-Custom-AES-Key',      // Custom AES key header
+  ivHeaderName: 'X-Custom-IV',                // Custom IV header
+  expectedPublicKeyHash: 'your-sha256-hash-here',
+  encryptDecryptForEndpoints: ['*'],
+  enableDebugLogging: false,
+  publicKeyFetchRetries: 3
+})
+```
+
+**Request Headers (Frontend sends):**
+```http
+POST /api/data
+X-Custom-AES-Key: <encrypted-aes-key-base64>
+X-Custom-IV: <encrypted-iv-base64>
+Content-Type: text/plain
+
+<encrypted-payload>
+```
+
+**Response Headers (Backend sends):**
+```http
+HTTP/1.1 200 OK
+X-Custom-AES-Key: <raw-aes-key-base64>
+X-Custom-IV: <raw-iv-base64>
+Access-Control-Expose-Headers: X-Custom-AES-Key, X-Custom-IV
+
+<encrypted-response>
+```
+
+**Important:** 
+- Request headers contain RSA-encrypted AES key and IV (frontend → backend)
+- Response headers contain raw (base64) AES key and IV (backend → frontend)
+- All custom headers must be included in `Access-Control-Expose-Headers`
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Hash mismatch | Check console for actual hash, update `expectedPublicKeyHash` |
+| Header not found | Backend must add: `Access-Control-Expose-Headers: X-Client-Init` (or custom header name) |
+| Custom header not found | Set `publicKeyHeaderName` in config and ensure backend sends that header |
+| Custom AES/IV headers not found | Set `aesKeyHeaderName` and `ivHeaderName` in config; backend must send custom headers and expose them in CORS |
+| App won't load | Check network tab for `/crypto/init`, verify endpoint reachable |
+| Not encrypting | Check URL matches endpoint patterns, try `['*']` to test |
+| Decryption fails | Verify backend sends AES key and IV headers (default: `X-Request-Context`, `X-Client-Ref` or your custom names) |
+| Pattern not matching | Enable debug logging to see pattern matching details |
+
+## Key Improvements
+
+### SessionStorage Caching
+- First load: ~200-300ms (API call + RSA import)
+- Page refresh: ~5-10ms (cached key) - **95% faster**
+- Cache cleared on: browser close, hash mismatch, validation failure
+
+### Centralized Pattern Matching
+- `matchesPattern()` method in `CryptoService`
+- Shared between encryption and decryption interceptors
+- Supports dynamic segments with `{ignore}` placeholder
+
+### CORS-Aware Error Messages
+- Clear error messages when headers are blocked by CORS
+- Distinguishes between "header not sent" vs "header blocked by browser"
+
+## Architecture
+
+### File Structure
+
+```
+ng-secure-fetch/
+├── config/ng-secure-fetch.config.ts       # provideNgSecureFetch()
+├── initializers/ng-secure-fetch.initializer.ts   # APP_INITIALIZER
+├── interceptors/
+│   ├── encryption.interceptor.ts          # Request encryption
+│   └── decryption.interceptor.ts          # Response decryption
+├── models/
+│   ├── ng-secure-fetch-config.interface.ts   # Config interface
+│   └── encrypted-payload.interface.ts     # Payload structure
+└── services/crypto.service.ts             # Core crypto + pattern matching
+```
+
+### Key Concepts
+
+- **RSA-OAEP**: Asymmetric encryption for key exchange (slow, secure)
+- **AES-256-GCM**: Symmetric encryption for data (fast, secure, authenticated)
+- **Hybrid Encryption**: Use RSA to encrypt AES key, use AES to encrypt data
+- **Web Crypto API**: Browser-native crypto (no external libraries)
+- **Browser Only**: Requires `window.crypto` - not compatible with standard Node.js
+- **APP_INITIALIZER**: Angular DI token to run code before app loads
+- **HTTP Interceptors**: Middleware for HTTP requests/responses
+- **SessionStorage**: Browser storage that persists across page refreshes (tab-scoped)
+
+## Changelog
+
+### v1.0.0 (Current)
+- Renamed from "security" to "ng-secure-fetch"
+- Updated function name from `provideSecurity()` to `provideNgSecureFetch()`
+- Added npm publishing metadata
+- Browser environment only (Web Crypto API)
+- `skipEncryptDecryptForEndpoints` configuration (exclusion patterns with higher priority)
+- Error response decryption (4xx, 5xx status codes)
+- Enhanced error structure with `Object.assign()` for backward compatibility
+- Updated `matchesPattern()` to support skip patterns
+- Added debug logging for POST/PUT/PATCH request bodies
+- Added dynamic segment support with `{ignore}` placeholder
+- Moved `matchesPattern()` to `CryptoService` (DRY principle)
+- Improved CORS error messages
+- SessionStorage caching (95% faster refresh)
+- Automatic HTTP interceptors
+- Public key pinning
+
+## Building the Library
+
+To build the library for distribution:
+
+```bash
+ng build ng-secure-fetch
+```
+
+Build artifacts will be in `dist/ng-secure-fetch/`.
+
+## Publishing to npm
+
+```bash
+cd dist/ng-secure-fetch
+npm publish
+```
+
+## Running Tests
+
+```bash
+ng test ng-secure-fetch
+```
+
+## License
+
+MIT
+
+## Contributing
+
+Contributions are welcome! Please open an issue or submit a pull request.
+
+## Support
+
+For issues and questions, please use the [GitHub Issues](https://github.com/yourusername/ng-secure-fetch/issues) page.

package/fesm2022/ng-secure-fetch.mjs

@@ -0,0 +1,557 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, inject, signal, Injectable, makeEnvironmentProviders, APP_INITIALIZER } from '@angular/core';
+import { HttpResponse, HttpErrorResponse, HttpClient, provideHttpClient, withInterceptors } from '@angular/common/http';
+import { from, switchMap, of, catchError, throwError, Observable, retry, timer, map } from 'rxjs';
+
+/** Default header name for public key exchange */
+const DEFAULT_PUBLIC_KEY_HEADER_NAME = 'X-Client-Init';
+/** Default header name for AES key in request/response */
+const DEFAULT_AES_KEY_HEADER_NAME = 'X-Request-Context';
+/** Default header name for IV in request/response */
+const DEFAULT_IV_HEADER_NAME = 'X-Client-Ref';
+/** Injection token for security config */
+const SECURITY_CONFIG = new InjectionToken('SecurityConfig');
+/** Default configuration with placeholder values - replace with your actual values */
+const DEFAULT_SECURITY_CONFIG = {
+    publicKeyEndpoint: 'https://your-api-domain.com/crypto/init',
+    expectedPublicKeyHash: 'your-sha256-hash-replace-this-with-actual-hash-from-console',
+    encryptDecryptForEndpoints: ['*'],
+    skipEncryptDecryptForEndpoints: [],
+    publicKeyHeaderName: DEFAULT_PUBLIC_KEY_HEADER_NAME,
+    aesKeyHeaderName: DEFAULT_AES_KEY_HEADER_NAME,
+    ivHeaderName: DEFAULT_IV_HEADER_NAME,
+    enableDebugLogging: false,
+    enableEncryption: true,
+    publicKeyFetchRetries: 3
+};
+
+class CryptoService {
+    config = inject(SECURITY_CONFIG);
+    publicKey = signal(null, ...(ngDevMode ? [{ debugName: "publicKey" }] : []));
+    STORAGE_KEY = 'ng_secure_fetch_public_key_pem';
+    /**
+     * Pattern matcher with support for dynamic segments:
+     * - '*' = matches all URLs
+     * - '/api/*' = matches URLs containing '/api/'
+     * - '/exact/path' = exact substring match
+     * - '/path/{ignore}/resource' = matches with dynamic segment (e.g., '/path/anything/resource')
+     * - Multiple {ignore} placeholders supported: '/api/{ignore}/items/{ignore}/details'
+     *
+     * @param url - The URL to check
+     * @param patterns - Array of patterns to match against
+     * @param skipPatterns - Optional array of patterns to exclude (higher priority)
+     * @returns true if URL matches patterns and doesn't match skipPatterns
+     */
+    matchesPattern(url, patterns, skipPatterns) {
+        // Check skip patterns first (higher priority)
+        if (skipPatterns && skipPatterns.length > 0) {
+            const shouldSkip = skipPatterns.some(pattern => {
+                if (pattern === '*')
+                    return true;
+                if (pattern.endsWith('/*')) {
+                    return url.includes(pattern.slice(0, -2));
+                }
+                if (pattern.includes('{ignore}')) {
+                    let regexPattern = pattern
+                        .replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+                        .replace(/\\{ignore\\}/g, '[^/]+');
+                    const regex = new RegExp(regexPattern);
+                    return regex.test(url);
+                }
+                return url.includes(pattern);
+            });
+            if (shouldSkip) {
+                this.config.enableDebugLogging && console.log(`[ng-secure-fetch] Skipped ${url}`);
+                return false;
+            }
+        }
+        // Check if URL matches any include pattern
+        return patterns.some(pattern => {
+            // Match all
+            if (pattern === '*')
+                return true;
+            // Glob pattern (e.g., '/api/*')
+            if (pattern.endsWith('/*')) {
+                return url.includes(pattern.slice(0, -2));
+            }
+            // Pattern with {ignore} placeholders for dynamic segments
+            if (pattern.includes('{ignore}')) {
+                // Convert pattern to regex:
+                // 'v1/universal/business/applicationform/{ignore}/pocketInsurance'
+                // becomes: v1\/universal\/business\/applicationform\/[^\/]+\/pocketInsurance
+                // Escape special regex characters except {ignore}
+                let regexPattern = pattern
+                    .replace(/[.*+?^${}()|[\]\\]/g, '\\$&') // Escape special chars
+                    .replace(/\\{ignore\\}/g, '[^/]+'); // Replace {ignore} with pattern to match any non-slash chars
+                // Create regex that checks if the pattern exists anywhere in the URL
+                const regex = new RegExp(regexPattern);
+                if (this.config.enableDebugLogging) {
+                    console.log(`[ng-secure-fetch] Pattern "${pattern}" ${regex.test(url) ? 'matched' : 'failed'} for ${url}`);
+                }
+                return regex.test(url);
+            }
+            // Exact substring match
+            return url.includes(pattern);
+        });
+    }
+    /** Verify public key hash (SHA-256) to prevent MITM attacks */
+    async verifyPublicKeyHash(pemKey) {
+        const expectedHash = this.config.expectedPublicKeyHash || 'REPLACE_WITH_YOUR_PUBLIC_KEY_HASH';
+        try {
+            const encoder = new TextEncoder();
+            const data = encoder.encode(pemKey);
+            const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+            const hashArray = Array.from(new Uint8Array(hashBuffer));
+            const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+            this.config.enableDebugLogging && console.log(`[ng-secure-fetch] Public key hash: ${hashHex}`);
+            if (expectedHash === 'REPLACE_WITH_YOUR_PUBLIC_KEY_HASH') {
+                console.warn(`[ng-secure-fetch] Public key pinning not configured! Use hash: ${hashHex}`);
+                return false;
+            }
+            const matches = hashHex === expectedHash;
+            if (!matches) {
+                console.error(`[ng-secure-fetch] Hash mismatch! Expected: ${expectedHash.substring(0, 16)}..., Got: ${hashHex.substring(0, 16)}...`);
+            }
+            else {
+                this.config.enableDebugLogging && console.log('[ng-secure-fetch] Public key hash verified');
+            }
+            return matches;
+        }
+        catch (error) {
+            console.error('[ng-secure-fetch] Hash verification error:', error);
+            return false;
+        }
+    }
+    /** Set RSA public key for encryption and cache in sessionStorage */
+    setPublicKey(key, pemKey) {
+        this.publicKey.set(key);
+        if (pemKey) {
+            try {
+                sessionStorage.setItem(this.STORAGE_KEY, pemKey);
+                this.config.enableDebugLogging && console.log('[ng-secure-fetch] Public key cached');
+            }
+            catch (error) {
+                console.warn('[ng-secure-fetch] Cache storage failed:', error);
+            }
+        }
+    }
+    /** Get current RSA public key */
+    getPublicKey() {
+        return this.publicKey();
+    }
+    /** Get cached PEM key from sessionStorage */
+    getCachedPemKey() {
+        try {
+            return sessionStorage.getItem(this.STORAGE_KEY);
+        }
+        catch (error) {
+            console.warn('[ng-secure-fetch] Cache read failed:', error);
+            return null;
+        }
+    }
+    /** Clear cached public key from sessionStorage */
+    clearCachedPublicKey() {
+        try {
+            sessionStorage.removeItem(this.STORAGE_KEY);
+            this.config.enableDebugLogging && console.log('[ng-secure-fetch] Cache cleared');
+        }
+        catch (error) {
+            console.warn('[ng-secure-fetch] Cache clear failed:', error);
+        }
+    }
+    /** Generate random AES-256-GCM key */
+    async generateAESKey() {
+        return await window.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    }
+    /** Import AES key from raw bytes (one-time use from response header) */
+    async importAESKey(keyBytes) {
+        return await window.crypto.subtle.importKey('raw', keyBytes, { name: 'AES-GCM', length: 256 }, false, ['decrypt']);
+    }
+    /** Generate random 12-byte IV for AES-GCM */
+    generateIV() {
+        return window.crypto.getRandomValues(new Uint8Array(12));
+    }
+    /** Generate random string for padding and obfuscation */
+    generateRandomString(minLength, maxLength) {
+        const length = Math.floor(Math.random() * (maxLength - minLength + 1)) + minLength;
+        const randomBytes = window.crypto.getRandomValues(new Uint8Array(length));
+        return this.arrayBufferToBase64(randomBytes.buffer);
+    }
+    /** Encrypt data using AES-GCM */
+    async encryptWithAES(data, aesKey, iv) {
+        const encoder = new TextEncoder();
+        const dataBuffer = encoder.encode(data);
+        return await window.crypto.subtle.encrypt({ name: 'AES-GCM', iv: iv }, aesKey, dataBuffer);
+    }
+    /** Encrypt AES key with RSA-OAEP public key */
+    async encryptAESKeyWithRSA(aesKey, rsaPublicKey) {
+        const aesKeyBuffer = await window.crypto.subtle.exportKey('raw', aesKey);
+        return await window.crypto.subtle.encrypt({ name: 'RSA-OAEP' }, rsaPublicKey, aesKeyBuffer);
+    }
+    /** Encrypt IV with RSA-OAEP public key */
+    async encryptIVWithRSA(iv, rsaPublicKey) {
+        return await window.crypto.subtle.encrypt({ name: 'RSA-OAEP' }, rsaPublicKey, iv);
+    }
+    /** Convert ArrayBuffer to Base64 */
+    arrayBufferToBase64(buffer) {
+        const bytes = new Uint8Array(buffer);
+        let binary = '';
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
+    /** Convert Base64 to ArrayBuffer */
+    base64ToArrayBuffer(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes.buffer;
+    }
+    /** Encrypt payload with AES-GCM + variable padding + RSA-encrypted keys */
+    async encryptPayload(payload) {
+        const rsaPublicKey = this.getPublicKey();
+        if (!rsaPublicKey)
+            return null;
+        const aesKey = await this.generateAESKey();
+        const iv = this.generateIV();
+        const payloadString = JSON.stringify(payload);
+        const padding = this.generateRandomString(16, 256);
+        const paddedData = `${payloadString}||${padding}`;
+        const [encryptedData, encryptedAesKey, encryptedIV] = await Promise.all([
+            this.encryptWithAES(paddedData, aesKey, iv),
+            this.encryptAESKeyWithRSA(aesKey, rsaPublicKey),
+            this.encryptIVWithRSA(iv, rsaPublicKey)
+        ]);
+        return {
+            encryptedData: this.arrayBufferToBase64(encryptedData),
+            encryptedAesKey: this.arrayBufferToBase64(encryptedAesKey),
+            iv: this.arrayBufferToBase64(encryptedIV)
+        };
+    }
+    /** Generate RSA-encrypted AES key and IV for GET requests (backend decrypts, uses for response) */
+    async generateEncryptedHeaders() {
+        const rsaPublicKey = this.getPublicKey();
+        if (!rsaPublicKey)
+            return null;
+        const aesKey = await this.generateAESKey();
+        const iv = this.generateIV();
+        const [encryptedAesKey, encryptedIV] = await Promise.all([
+            this.encryptAESKeyWithRSA(aesKey, rsaPublicKey),
+            this.encryptIVWithRSA(iv, rsaPublicKey)
+        ]);
+        const result = {
+            encryptedAesKey: this.arrayBufferToBase64(encryptedAesKey),
+            encryptedIV: this.arrayBufferToBase64(encryptedIV)
+        };
+        this.config.enableDebugLogging && console.log('[ng-secure-fetch] Generated encrypted headers');
+        return result;
+    }
+    /** Create obfuscated envelope with short field names (d=data, k=key, s=salt/IV) */
+    async createEncryptedEnvelope(originalPayload) {
+        const encryptedPayload = await this.encryptPayload(originalPayload);
+        if (!encryptedPayload)
+            return originalPayload;
+        return {
+            d: encryptedPayload.encryptedData,
+            k: encryptedPayload.encryptedAesKey,
+            s: encryptedPayload.iv
+        };
+    }
+    /** Decrypt response using raw AES key and IV from headers (sent over HTTPS) */
+    async decryptResponsePayload(encryptedData, aesKeyBase64, ivBase64) {
+        const encryptedBytes = this.base64ToArrayBuffer(encryptedData);
+        const aesKeyBytes = this.base64ToArrayBuffer(aesKeyBase64);
+        const ivBytes = this.base64ToArrayBuffer(ivBase64);
+        const aesKey = await this.importAESKey(aesKeyBytes);
+        const decryptedBuffer = await window.crypto.subtle.decrypt({ name: 'AES-GCM', iv: ivBytes }, aesKey, encryptedBytes);
+        const decoder = new TextDecoder();
+        const decryptedWithPadding = decoder.decode(decryptedBuffer);
+        const [actualData] = decryptedWithPadding.split('||');
+        this.config.enableDebugLogging && console.log('[ng-secure-fetch] Response decrypted');
+        return JSON.parse(actualData);
+    }
+    /** Import RSA public key from PEM format to CryptoKey */
+    async importPublicKey(pemKey) {
+        const pemHeader = '-----BEGIN PUBLIC KEY-----';
+        const pemFooter = '-----END PUBLIC KEY-----';
+        const pemContents = pemKey.replace(pemHeader, '').replace(pemFooter, '').replace(/\s/g, '');
+        this.config.enableDebugLogging && console.log('[ng-secure-fetch] Importing PEM key');
+        const binaryDer = atob(pemContents);
+        const binaryDerArray = new Uint8Array(binaryDer.length);
+        for (let i = 0; i < binaryDer.length; i++) {
+            binaryDerArray[i] = binaryDer.charCodeAt(i);
+        }
+        const cryptoKey = await window.crypto.subtle.importKey('spki', binaryDerArray.buffer, { name: 'RSA-OAEP', hash: 'SHA-256' }, true, ['encrypt']);
+        this.config.enableDebugLogging && console.log('[ng-secure-fetch] Key imported successfully');
+        return cryptoKey;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.16", ngImport: i0, type: CryptoService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.16", ngImport: i0, type: CryptoService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.16", ngImport: i0, type: CryptoService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }] });
+
+/** Encrypts requests: POST/PUT/PATCH body + headers, GET generates keys for response encryption */
+const encryptionInterceptor = (req, next) => {
+    const cryptoService = inject(CryptoService);
+    const config = inject(SECURITY_CONFIG, { optional: true });
+    if (config?.enableEncryption === false)
+        return next(req);
+    const encryptPatterns = config?.encryptDecryptForEndpoints || ['*'];
+    const skipPatterns = config?.skipEncryptDecryptForEndpoints;
+    const shouldEncrypt = cryptoService.matchesPattern(req.url, encryptPatterns, skipPatterns);
+    if (!shouldEncrypt)
+        return next(req);
+    if (config?.publicKeyEndpoint && req.url === config.publicKeyEndpoint)
+        return next(req);
+    const aesKeyHeader = config?.aesKeyHeaderName || DEFAULT_AES_KEY_HEADER_NAME;
+    const ivHeader = config?.ivHeaderName || DEFAULT_IV_HEADER_NAME;
+    if (req.method === 'GET') {
+        return from(cryptoService.generateEncryptedHeaders()).pipe(switchMap((headers) => {
+            if (!headers)
+                return next(req);
+            const encryptedReq = req.clone({
+                setHeaders: {
+                    [aesKeyHeader]: headers.encryptedAesKey,
+                    [ivHeader]: headers.encryptedIV
+                }
+            });
+            return next(encryptedReq);
+        }));
+    }
+    if (!req.body || typeof req.body !== 'object')
+        return next(req);
+    if (req.method === 'DELETE' || req.method === 'HEAD' || req.method === 'OPTIONS')
+        return next(req);
+    config?.enableDebugLogging && console.log(`[ng-secure-fetch] Encrypting ${req.method} request`);
+    return from(cryptoService.createEncryptedEnvelope(req.body)).pipe(switchMap((encryptedBody) => {
+        const envelope = encryptedBody;
+        const encryptedReq = req.clone({
+            body: envelope['d'],
+            setHeaders: {
+                'Content-Type': 'text/plain',
+                [aesKeyHeader]: envelope['k'],
+                [ivHeader]: envelope['s']
+            }
+        });
+        return next(encryptedReq);
+    }));
+};
+
+/** Decrypts responses using AES keys from headers (X-Request-Context, X-Client-Ref) */
+const decryptionInterceptor = (req, next) => {
+    const cryptoService = inject(CryptoService);
+    const config = inject(SECURITY_CONFIG, { optional: true });
+    return next(req).pipe(switchMap((event) => {
+        if (!(event instanceof HttpResponse))
+            return of(event);
+        if (config?.enableEncryption === false)
+            return of(event);
+        const encryptPatterns = config?.encryptDecryptForEndpoints || ['*'];
+        const skipPatterns = config?.skipEncryptDecryptForEndpoints;
+        const shouldDecrypt = cryptoService.matchesPattern(req.url, encryptPatterns, skipPatterns);
+        if (!shouldDecrypt)
+            return of(event);
+        if (config?.publicKeyEndpoint && req.url === config.publicKeyEndpoint)
+            return of(event);
+        return decryptResponse(event, cryptoService, config);
+    }), catchError((error) => {
+        // Handle error responses (4xx, 5xx)
+        if (config?.enableEncryption === false)
+            return throwError(() => error);
+        const encryptPatterns = config?.encryptDecryptForEndpoints || ['*'];
+        const skipPatterns = config?.skipEncryptDecryptForEndpoints;
+        const shouldDecrypt = cryptoService.matchesPattern(req.url, encryptPatterns, skipPatterns);
+        if (!shouldDecrypt)
+            return throwError(() => error);
+        if (config?.publicKeyEndpoint && req.url === config.publicKeyEndpoint)
+            return throwError(() => error);
+        const aesKeyHeader = config?.aesKeyHeaderName || DEFAULT_AES_KEY_HEADER_NAME;
+        const ivHeader = config?.ivHeaderName || DEFAULT_IV_HEADER_NAME;
+        config?.enableDebugLogging && console.log('[ng-secure-fetch] Error response received, attempting decryption');
+        // Check if error has encryption headers
+        const aesKeyBase64 = error.headers?.get(aesKeyHeader) || error.headers?.get(aesKeyHeader.toLowerCase());
+        const ivBase64 = error.headers?.get(ivHeader) || error.headers?.get(ivHeader.toLowerCase());
+        if (!aesKeyBase64 || !ivBase64 || !error.error) {
+            config?.enableDebugLogging && console.warn('[ng-secure-fetch] Error response not encrypted');
+            return throwError(() => error);
+        }
+        // Decrypt error response
+        return from(cryptoService.decryptResponsePayload(typeof error.error === 'string' ? error.error : JSON.stringify(error.error), aesKeyBase64, ivBase64).then((decrypted) => {
+            if (decrypted) {
+                config?.enableDebugLogging && console.log('[ng-secure-fetch] Error response decrypted');
+                // Return decrypted error - spread decrypted data to top level for easier access
+                // This allows components to access error.errors[0] instead of error.error.errors[0]
+                const decryptedError = new HttpErrorResponse({
+                    error: decrypted,
+                    headers: error.headers,
+                    status: error.status,
+                    statusText: error.statusText,
+                    url: error.url || undefined
+                });
+                // Merge decrypted properties to top level of error object
+                Object.assign(decryptedError, decrypted);
+                throw decryptedError;
+            }
+            config?.enableDebugLogging && console.warn('[ng-secure-fetch] Error decryption returned null');
+            throw error;
+        }, (decryptError) => {
+            config?.enableDebugLogging && console.error('[ng-secure-fetch] Failed to decrypt error response:', decryptError);
+            throw error;
+        }));
+    }));
+};
+/** Helper function to decrypt successful responses */
+function decryptResponse(event, cryptoService, config) {
+    const aesKeyHeader = config?.aesKeyHeaderName || DEFAULT_AES_KEY_HEADER_NAME;
+    const ivHeader = config?.ivHeaderName || DEFAULT_IV_HEADER_NAME;
+    const aesKeyBase64 = event.headers.get(aesKeyHeader) || event.headers.get(aesKeyHeader.toLowerCase());
+    const ivBase64 = event.headers.get(ivHeader) || event.headers.get(ivHeader.toLowerCase());
+    if (!aesKeyBase64 || !ivBase64 || !event.body) {
+        config?.enableDebugLogging && event.body && console.warn('[ng-secure-fetch] Missing encryption headers');
+        return of(event);
+    }
+    config?.enableDebugLogging && console.log('[ng-secure-fetch] Decrypting response');
+    return from(cryptoService.decryptResponsePayload(event.body, aesKeyBase64, ivBase64)).pipe(switchMap((decrypted) => {
+        if (decrypted) {
+            config?.enableDebugLogging && console.log('[ng-secure-fetch] Response decrypted successfully');
+            return of(event.clone({ body: decrypted }));
+        }
+        config?.enableDebugLogging && console.warn('[ng-secure-fetch] Decryption returned null');
+        return of(event);
+    }));
+}
+
+/** APP_INITIALIZER: Fetches public key, verifies hash, blocks app until ready */
+function initializeNgSecureFetchFactory() {
+    const http = inject(HttpClient);
+    const cryptoService = inject(CryptoService);
+    const config = inject(SECURITY_CONFIG);
+    return () => {
+        if (config.enableEncryption === false) {
+            config.enableDebugLogging && console.log('[ng-secure-fetch] Encryption disabled');
+            return of(void 0);
+        }
+        if (!config.publicKeyEndpoint) {
+            console.error('[ng-secure-fetch] publicKeyEndpoint required');
+            return throwError(() => new Error('publicKeyEndpoint required'));
+        }
+        // Check for cached public key in sessionStorage first
+        return new Observable((subscriber) => {
+            const cachedPemKey = cryptoService.getCachedPemKey();
+            if (cachedPemKey) {
+                config.enableDebugLogging && console.log('[ng-secure-fetch] Using cached key');
+                validateAndSetPublicKey(cryptoService, config, cachedPemKey).then(() => {
+                    config.enableDebugLogging && console.log('[ng-secure-fetch] Cached key validated');
+                    subscriber.next();
+                    subscriber.complete();
+                }).catch(err => {
+                    config.enableDebugLogging && console.warn('[ng-secure-fetch] Cache invalid, fetching fresh key');
+                    cryptoService.clearCachedPublicKey();
+                    fetchPublicKeyFromAPI(http, cryptoService, config).subscribe({
+                        next: () => {
+                            subscriber.next();
+                            subscriber.complete();
+                        },
+                        error: (err) => subscriber.error(err)
+                    });
+                });
+            }
+            else {
+                config.enableDebugLogging && console.log('[ng-secure-fetch] Fetching public key from API');
+                fetchPublicKeyFromAPI(http, cryptoService, config).subscribe({
+                    next: () => {
+                        subscriber.next();
+                        subscriber.complete();
+                    },
+                    error: (err) => subscriber.error(err)
+                });
+            }
+        });
+    };
+}
+/** Validate PEM key hash and import it (reusable for both cached and API keys) */
+async function validateAndSetPublicKey(cryptoService, config, pemKey) {
+    const isValid = await cryptoService.verifyPublicKeyHash(pemKey);
+    if (!isValid) {
+        throw new Error('Public key hash mismatch - possible MITM attack');
+    }
+    const cryptoKey = await cryptoService.importPublicKey(pemKey);
+    cryptoService.setPublicKey(cryptoKey, pemKey);
+    config.enableDebugLogging && console.log('[ng-secure-fetch] Public key imported & validated');
+}
+/** Helper function to fetch public key from API */
+function fetchPublicKeyFromAPI(http, cryptoService, config) {
+    const retries = config.publicKeyFetchRetries || 3;
+    return http.get(config.publicKeyEndpoint, { observe: 'response' }).pipe(retry({
+        count: retries,
+        delay: (_error, retryCount) => {
+            config.enableDebugLogging && console.warn(`[ng-secure-fetch] Retry ${retryCount}/${retries}`);
+            return timer(Math.pow(2, retryCount - 1) * 1000);
+        }
+    }), switchMap((response) => {
+        const headerName = config.publicKeyHeaderName || DEFAULT_PUBLIC_KEY_HEADER_NAME;
+        const pemKey = response.headers.get(headerName) || response.headers.get(headerName.toLowerCase());
+        if (!pemKey) {
+            const availableHeaders = response.headers.keys().join(', ');
+            console.error(`[ng-secure-fetch] ${headerName} header missing. Available: ${availableHeaders}`);
+            throw new Error(`${headerName} header not found. Set Access-Control-Expose-Headers`);
+        }
+        config.enableDebugLogging && console.log(`[ng-secure-fetch] Public key received from ${headerName}`);
+        return validateAndSetPublicKey(cryptoService, config, pemKey);
+    }), map(() => {
+        config.enableDebugLogging && console.log('[ng-secure-fetch] Initialized - encryption ready');
+        return void 0;
+    }), catchError((error) => {
+        console.error('[ng-secure-fetch] Initialization failed. Set enableEncryption: false to bypass');
+        return throwError(() => error);
+    }));
+}
+
+/**
+ * Complete ng-secure-fetch provider: config + interceptors + APP_INITIALIZER
+ * App blocks until public key is fetched and verified
+ *
+ * @example
+ * provideNgSecureFetch({
+ *   enableEncryption: true,
+ *   publicKeyEndpoint: environment.apiUrl + '/crypto/init',
+ *   expectedPublicKeyHash: 'your-sha256-hash-here',
+ *   encryptDecryptForEndpoints: ['/insurance/*'],
+ *   skipEncryptDecryptForEndpoints: ['/public/*'],
+ *   publicKeyHeaderName: 'X-Client-Init',
+ *   aesKeyHeaderName: 'X-Request-Context',
+ *   ivHeaderName: 'X-Client-Ref',
+ *   enableDebugLogging: false,
+ *   publicKeyFetchRetries: 3
+ * })
+ */
+function provideNgSecureFetch(config) {
+    return makeEnvironmentProviders([
+        { provide: SECURITY_CONFIG, useValue: config },
+        provideHttpClient(withInterceptors([encryptionInterceptor, decryptionInterceptor])),
+        { provide: APP_INITIALIZER, useFactory: initializeNgSecureFetchFactory, multi: true }
+    ]);
+}
+
+/*
+ * Public API Surface of ng-secure-fetch
+ *
+ * Users should only import from this public API surface.
+ * All other modules are considered internal implementation details.
+ */
+// Configuration Provider
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { DEFAULT_AES_KEY_HEADER_NAME, DEFAULT_IV_HEADER_NAME, DEFAULT_PUBLIC_KEY_HEADER_NAME, DEFAULT_SECURITY_CONFIG, SECURITY_CONFIG, provideNgSecureFetch };
+//# sourceMappingURL=ng-secure-fetch.mjs.map

package/fesm2022/ng-secure-fetch.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ng-secure-fetch.mjs","sources":["../../../projects/ng-secure-fetch/src/lib/models/ng-secure-fetch-config.interface.ts","../../../projects/ng-secure-fetch/src/lib/services/crypto.service.ts","../../../projects/ng-secure-fetch/src/lib/interceptors/encryption.interceptor.ts","../../../projects/ng-secure-fetch/src/lib/interceptors/decryption.interceptor.ts","../../../projects/ng-secure-fetch/src/lib/initializers/ng-secure-fetch.initializer.ts","../../../projects/ng-secure-fetch/src/lib/config/ng-secure-fetch.config.ts","../../../projects/ng-secure-fetch/src/public-api.ts","../../../projects/ng-secure-fetch/src/ng-secure-fetch.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\r\n\r\n/** Default header name for public key exchange */\r\nexport const DEFAULT_PUBLIC_KEY_HEADER_NAME = 'X-Client-Init';\r\n\r\n/** Default header name for AES key in request/response */\r\nexport const DEFAULT_AES_KEY_HEADER_NAME = 'X-Request-Context';\r\n\r\n/** Default header name for IV in request/response */\r\nexport const DEFAULT_IV_HEADER_NAME = 'X-Client-Ref';\r\n\r\n/** Security library configuration */\r\nexport interface SecurityConfig {\r\n  /** Master switch: true = fetch key + encrypt/decrypt, false = bypass all (default: true) */\r\n  enableEncryption?: boolean;\r\n\r\n  /** Full public key endpoint URL (required if enableEncryption is true) */\r\n  publicKeyEndpoint?: string;\r\n\r\n  /** Expected SHA-256 hash for public key pinning (MITM protection) */\r\n  expectedPublicKeyHash?: string;\r\n\r\n  /** Endpoint patterns to encrypt: ['*'] = all, ['/api/*'] = glob, ['/exact/path'] = exact (default: ['*']) */\r\n  encryptDecryptForEndpoints?: string[];\r\n\r\n  /** Endpoint patterns to skip encryption (higher priority than encryptDecryptForEndpoints) */\r\n  skipEncryptDecryptForEndpoints?: string[];\r\n\r\n  /** Custom header name for public key exchange (default: 'X-Client-Init') */\r\n  publicKeyHeaderName?: string;\r\n\r\n  /** Custom header name for AES key in request/response (default: 'X-Request-Context') */\r\n  aesKeyHeaderName?: string;\r\n\r\n  /** Custom header name for IV in request/response (default: 'X-Client-Ref') */\r\n  ivHeaderName?: string;\r\n\r\n  /** Enable debug logging (default: true) */\r\n  enableDebugLogging?: boolean;\r\n\r\n  /** Retry attempts for public key fetch (default: 3) */\r\n  publicKeyFetchRetries?: number;\r\n}\r\n\r\n/** Injection token for security config */\r\nexport const SECURITY_CONFIG = new InjectionToken<SecurityConfig>('SecurityConfig');\r\n\r\n/** Default configuration with placeholder values - replace with your actual values */\r\nexport const DEFAULT_SECURITY_CONFIG: SecurityConfig = {\r\n  publicKeyEndpoint: 'https://your-api-domain.com/crypto/init',\r\n  expectedPublicKeyHash: 'your-sha256-hash-replace-this-with-actual-hash-from-console',\r\n  encryptDecryptForEndpoints: ['*'],\r\n  skipEncryptDecryptForEndpoints: [],\r\n  publicKeyHeaderName: DEFAULT_PUBLIC_KEY_HEADER_NAME,\r\n  aesKeyHeaderName: DEFAULT_AES_KEY_HEADER_NAME,\r\n  ivHeaderName: DEFAULT_IV_HEADER_NAME,\r\n  enableDebugLogging: false,\r\n  enableEncryption: true,\r\n  publicKeyFetchRetries: 3\r\n};\r\n","import { Injectable, signal, inject } from '@angular/core';\r\nimport { SECURITY_CONFIG } from '../models/ng-secure-fetch-config.interface';\r\nimport { EncryptedPayload } from '../models/encrypted-payload.interface';\r\n\r\n@Injectable({\r\n  providedIn: 'root'\r\n})\r\nexport class CryptoService {\r\n  private readonly config = inject(SECURITY_CONFIG);\r\n  private readonly publicKey = signal<CryptoKey | null>(null);\r\n  private readonly STORAGE_KEY = 'ng_secure_fetch_public_key_pem';\r\n\r\n  /** \r\n   * Pattern matcher with support for dynamic segments:\r\n   * - '*' = matches all URLs\r\n   * - '/api/*' = matches URLs containing '/api/'\r\n   * - '/exact/path' = exact substring match\r\n   * - '/path/{ignore}/resource' = matches with dynamic segment (e.g., '/path/anything/resource')\r\n   * - Multiple {ignore} placeholders supported: '/api/{ignore}/items/{ignore}/details'\r\n   * \r\n   * @param url - The URL to check\r\n   * @param patterns - Array of patterns to match against\r\n   * @param skipPatterns - Optional array of patterns to exclude (higher priority)\r\n   * @returns true if URL matches patterns and doesn't match skipPatterns\r\n   */\r\n  matchesPattern(url: string, patterns: string[], skipPatterns?: string[]): boolean {\r\n    // Check skip patterns first (higher priority)\r\n    if (skipPatterns && skipPatterns.length > 0) {\r\n      const shouldSkip = skipPatterns.some(pattern => {\r\n        if (pattern === '*') return true;\r\n        \r\n        if (pattern.endsWith('/*')) {\r\n          return url.includes(pattern.slice(0, -2));\r\n        }\r\n        \r\n        if (pattern.includes('{ignore}')) {\r\n          let regexPattern = pattern\r\n            .replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\r\n            .replace(/\\\\{ignore\\\\}/g, '[^/]+');\r\n          const regex = new RegExp(regexPattern);\r\n          return regex.test(url);\r\n        }\r\n        \r\n        return url.includes(pattern);\r\n      });\r\n      \r\n      if (shouldSkip) {\r\n        this.config.enableDebugLogging && console.log(`[ng-secure-fetch] Skipped ${url}`);\r\n        return false;\r\n      }\r\n    }\r\n    \r\n    // Check if URL matches any include pattern\r\n    return patterns.some(pattern => {\r\n      // Match all\r\n      if (pattern === '*') return true;\r\n      \r\n      // Glob pattern (e.g., '/api/*')\r\n      if (pattern.endsWith('/*')) {\r\n        return url.includes(pattern.slice(0, -2));\r\n      }\r\n      \r\n      // Pattern with {ignore} placeholders for dynamic segments\r\n      if (pattern.includes('{ignore}')) {\r\n        // Convert pattern to regex:\r\n        // 'v1/universal/business/applicationform/{ignore}/pocketInsurance'\r\n        // becomes: v1\\/universal\\/business\\/applicationform\\/[^\\/]+\\/pocketInsurance\r\n        \r\n        // Escape special regex characters except {ignore}\r\n        let regexPattern = pattern\r\n          .replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')  // Escape special chars\r\n          .replace(/\\\\{ignore\\\\}/g, '[^/]+');       // Replace {ignore} with pattern to match any non-slash chars\r\n        \r\n        // Create regex that checks if the pattern exists anywhere in the URL\r\n        const regex = new RegExp(regexPattern);\r\n        \r\n        if (this.config.enableDebugLogging) {\r\n          console.log(`[ng-secure-fetch] Pattern \"${pattern}\" ${regex.test(url) ? 'matched' : 'failed'} for ${url}`);\r\n        }\r\n        \r\n        return regex.test(url);\r\n      }\r\n      \r\n      // Exact substring match\r\n      return url.includes(pattern);\r\n    });\r\n  }\r\n\r\n  /** Verify public key hash (SHA-256) to prevent MITM attacks */\r\n  async verifyPublicKeyHash(pemKey: string): Promise<boolean> {\r\n    const expectedHash = this.config.expectedPublicKeyHash || 'REPLACE_WITH_YOUR_PUBLIC_KEY_HASH';\r\n\r\n    try {\r\n      const encoder = new TextEncoder();\r\n      const data = encoder.encode(pemKey);\r\n      const hashBuffer = await crypto.subtle.digest('SHA-256', data);\r\n      const hashArray = Array.from(new Uint8Array(hashBuffer));\r\n      const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');\r\n      \r\n      this.config.enableDebugLogging && console.log(`[ng-secure-fetch] Public key hash: ${hashHex}`);\r\n      \r\n      if (expectedHash === 'REPLACE_WITH_YOUR_PUBLIC_KEY_HASH') {\r\n        console.warn(`[ng-secure-fetch] Public key pinning not configured! Use hash: ${hashHex}`);\r\n        return false;\r\n      }\r\n      \r\n      const matches = hashHex === expectedHash;\r\n      \r\n      if (!matches) {\r\n        console.error(`[ng-secure-fetch] Hash mismatch! Expected: ${expectedHash.substring(0, 16)}..., Got: ${hashHex.substring(0, 16)}...`);\r\n      } else {\r\n        this.config.enableDebugLogging && console.log('[ng-secure-fetch] Public key hash verified');\r\n      }\r\n      \r\n      return matches;\r\n    } catch (error) {\r\n      console.error('[ng-secure-fetch] Hash verification error:', error);\r\n      return false;\r\n    }\r\n  }\r\n\r\n  /** Set RSA public key for encryption and cache in sessionStorage */\r\n  setPublicKey(key: CryptoKey, pemKey?: string): void {\r\n    this.publicKey.set(key);\r\n    \r\n    if (pemKey) {\r\n      try {\r\n        sessionStorage.setItem(this.STORAGE_KEY, pemKey);\r\n        this.config.enableDebugLogging && console.log('[ng-secure-fetch] Public key cached');\r\n      } catch (error) {\r\n        console.warn('[ng-secure-fetch] Cache storage failed:', error);\r\n      }\r\n    }\r\n  }\r\n\r\n  /** Get current RSA public key */\r\n  getPublicKey(): CryptoKey | null {\r\n    return this.publicKey();\r\n  }\r\n\r\n  /** Get cached PEM key from sessionStorage */\r\n  getCachedPemKey(): string | null {\r\n    try {\r\n      return sessionStorage.getItem(this.STORAGE_KEY);\r\n    } catch (error) {\r\n      console.warn('[ng-secure-fetch] Cache read failed:', error);\r\n      return null;\r\n    }\r\n  }\r\n\r\n  /** Clear cached public key from sessionStorage */\r\n  clearCachedPublicKey(): void {\r\n    try {\r\n      sessionStorage.removeItem(this.STORAGE_KEY);\r\n      this.config.enableDebugLogging && console.log('[ng-secure-fetch] Cache cleared');\r\n    } catch (error) {\r\n      console.warn('[ng-secure-fetch] Cache clear failed:', error);\r\n    }\r\n  }\r\n\r\n  /** Generate random AES-256-GCM key */\r\n  private async generateAESKey(): Promise<CryptoKey> {\r\n    return await window.crypto.subtle.generateKey(\r\n      { name: 'AES-GCM', length: 256 },\r\n      true,\r\n      ['encrypt', 'decrypt']\r\n    );\r\n  }\r\n\r\n  /** Import AES key from raw bytes (one-time use from response header) */\r\n  private async importAESKey(keyBytes: ArrayBuffer): Promise<CryptoKey> {\r\n    return await window.crypto.subtle.importKey(\r\n      'raw',\r\n      keyBytes,\r\n      { name: 'AES-GCM', length: 256 },\r\n      false,\r\n      ['decrypt']\r\n    );\r\n  }\r\n\r\n  /** Generate random 12-byte IV for AES-GCM */\r\n  private generateIV(): Uint8Array {\r\n    return window.crypto.getRandomValues(new Uint8Array(12));\r\n  }\r\n\r\n  /** Generate random string for padding and obfuscation */\r\n  private generateRandomString(minLength: number, maxLength: number): string {\r\n    const length = Math.floor(Math.random() * (maxLength - minLength + 1)) + minLength;\r\n    const randomBytes = window.crypto.getRandomValues(new Uint8Array(length));\r\n    return this.arrayBufferToBase64(randomBytes.buffer);\r\n  }\r\n\r\n  /** Encrypt data using AES-GCM */\r\n  private async encryptWithAES(data: string, aesKey: CryptoKey, iv: Uint8Array): Promise<ArrayBuffer> {\r\n    const encoder = new TextEncoder();\r\n    const dataBuffer = encoder.encode(data);\r\n    return await window.crypto.subtle.encrypt({ name: 'AES-GCM', iv: iv as BufferSource }, aesKey, dataBuffer);\r\n  }\r\n\r\n  /** Encrypt AES key with RSA-OAEP public key */\r\n  private async encryptAESKeyWithRSA(aesKey: CryptoKey, rsaPublicKey: CryptoKey): Promise<ArrayBuffer> {\r\n    const aesKeyBuffer = await window.crypto.subtle.exportKey('raw', aesKey);\r\n    return await window.crypto.subtle.encrypt({ name: 'RSA-OAEP' }, rsaPublicKey, aesKeyBuffer);\r\n  }\r\n\r\n  /** Encrypt IV with RSA-OAEP public key */\r\n  private async encryptIVWithRSA(iv: Uint8Array, rsaPublicKey: CryptoKey): Promise<ArrayBuffer> {\r\n    return await window.crypto.subtle.encrypt({ name: 'RSA-OAEP' }, rsaPublicKey, iv as BufferSource);\r\n  }\r\n\r\n  /** Convert ArrayBuffer to Base64 */\r\n  private arrayBufferToBase64(buffer: ArrayBuffer): string {\r\n    const bytes = new Uint8Array(buffer);\r\n    let binary = '';\r\n    for (let i = 0; i < bytes.length; i++) {\r\n      binary += String.fromCharCode(bytes[i]);\r\n    }\r\n    return btoa(binary);\r\n  }\r\n\r\n  /** Convert Base64 to ArrayBuffer */\r\n  private base64ToArrayBuffer(base64: string): ArrayBuffer {\r\n    const binary = atob(base64);\r\n    const bytes = new Uint8Array(binary.length);\r\n    for (let i = 0; i < binary.length; i++) {\r\n      bytes[i] = binary.charCodeAt(i);\r\n    }\r\n    return bytes.buffer;\r\n  }\r\n\r\n  /** Encrypt payload with AES-GCM + variable padding + RSA-encrypted keys */\r\n  async encryptPayload(payload: Record<string, unknown>): Promise<EncryptedPayload | null> {\r\n    const rsaPublicKey = this.getPublicKey();\r\n    if (!rsaPublicKey) return null;\r\n\r\n    const aesKey = await this.generateAESKey();\r\n    const iv = this.generateIV();\r\n    const payloadString = JSON.stringify(payload);\r\n    const padding = this.generateRandomString(16, 256);\r\n    const paddedData = `${payloadString}||${padding}`;\r\n\r\n    const [encryptedData, encryptedAesKey, encryptedIV] = await Promise.all([\r\n      this.encryptWithAES(paddedData, aesKey, iv),\r\n      this.encryptAESKeyWithRSA(aesKey, rsaPublicKey),\r\n      this.encryptIVWithRSA(iv, rsaPublicKey)\r\n    ]);\r\n\r\n    return {\r\n      encryptedData: this.arrayBufferToBase64(encryptedData),\r\n      encryptedAesKey: this.arrayBufferToBase64(encryptedAesKey),\r\n      iv: this.arrayBufferToBase64(encryptedIV)\r\n    };\r\n  }\r\n\r\n  /** Generate RSA-encrypted AES key and IV for GET requests (backend decrypts, uses for response) */\r\n  async generateEncryptedHeaders(): Promise<{ encryptedAesKey: string; encryptedIV: string } | null> {\r\n    const rsaPublicKey = this.getPublicKey();\r\n    if (!rsaPublicKey) return null;\r\n\r\n    const aesKey = await this.generateAESKey();\r\n    const iv = this.generateIV();\r\n\r\n    const [encryptedAesKey, encryptedIV] = await Promise.all([\r\n      this.encryptAESKeyWithRSA(aesKey, rsaPublicKey),\r\n      this.encryptIVWithRSA(iv, rsaPublicKey)\r\n    ]);\r\n\r\n    const result = {\r\n      encryptedAesKey: this.arrayBufferToBase64(encryptedAesKey),\r\n      encryptedIV: this.arrayBufferToBase64(encryptedIV)\r\n    }\r\n\r\n    this.config.enableDebugLogging && console.log('[ng-secure-fetch] Generated encrypted headers');\r\n\r\n    return result;\r\n  }\r\n\r\n  /** Create obfuscated envelope with short field names (d=data, k=key, s=salt/IV) */\r\n  async createEncryptedEnvelope(originalPayload: Record<string, unknown>): Promise<Record<string, unknown>> {\r\n    const encryptedPayload = await this.encryptPayload(originalPayload);\r\n    if (!encryptedPayload) return originalPayload;\r\n\r\n    return {\r\n      d: encryptedPayload.encryptedData,\r\n      k: encryptedPayload.encryptedAesKey,\r\n      s: encryptedPayload.iv\r\n    };\r\n  }\r\n\r\n  /** Decrypt response using raw AES key and IV from headers (sent over HTTPS) */\r\n  async decryptResponsePayload(\r\n    encryptedData: string,\r\n    aesKeyBase64: string,\r\n    ivBase64: string\r\n  ): Promise<Record<string, unknown> | null> {\r\n    const encryptedBytes = this.base64ToArrayBuffer(encryptedData);\r\n    const aesKeyBytes = this.base64ToArrayBuffer(aesKeyBase64);\r\n    const ivBytes = this.base64ToArrayBuffer(ivBase64);\r\n    const aesKey = await this.importAESKey(aesKeyBytes);\r\n\r\n    const decryptedBuffer = await window.crypto.subtle.decrypt(\r\n      { name: 'AES-GCM', iv: ivBytes },\r\n      aesKey,\r\n      encryptedBytes\r\n    );\r\n\r\n    const decoder = new TextDecoder();\r\n    const decryptedWithPadding = decoder.decode(decryptedBuffer);\r\n    const [actualData] = decryptedWithPadding.split('||');\r\n\r\n    this.config.enableDebugLogging && console.log('[ng-secure-fetch] Response decrypted');\r\n\r\n    return JSON.parse(actualData);\r\n  }\r\n\r\n  /** Import RSA public key from PEM format to CryptoKey */\r\n  async importPublicKey(pemKey: string): Promise<CryptoKey> {\r\n    const pemHeader = '-----BEGIN PUBLIC KEY-----';\r\n    const pemFooter = '-----END PUBLIC KEY-----';\r\n    const pemContents = pemKey.replace(pemHeader, '').replace(pemFooter, '').replace(/\\s/g, '');\r\n    \r\n    this.config.enableDebugLogging && console.log('[ng-secure-fetch] Importing PEM key');\r\n    \r\n    const binaryDer = atob(pemContents);\r\n    const binaryDerArray = new Uint8Array(binaryDer.length);\r\n    for (let i = 0; i < binaryDer.length; i++) {\r\n      binaryDerArray[i] = binaryDer.charCodeAt(i);\r\n    }\r\n\r\n    const cryptoKey = await window.crypto.subtle.importKey(\r\n      'spki',\r\n      binaryDerArray.buffer,\r\n      { name: 'RSA-OAEP', hash: 'SHA-256' },\r\n      true,\r\n      ['encrypt']\r\n    );\r\n\r\n    this.config.enableDebugLogging && console.log('[ng-secure-fetch] Key imported successfully');\r\n\r\n    return cryptoKey;\r\n  }\r\n}\r\n","import { HttpInterceptorFn } from '@angular/common/http';\r\nimport { inject } from '@angular/core';\r\nimport { from, switchMap } from 'rxjs';\r\nimport { CryptoService } from '../services/crypto.service';\r\nimport { SECURITY_CONFIG, SecurityConfig, DEFAULT_AES_KEY_HEADER_NAME, DEFAULT_IV_HEADER_NAME } from '../models/ng-secure-fetch-config.interface';\r\n\r\n/** Encrypts requests: POST/PUT/PATCH body + headers, GET generates keys for response encryption */\r\nexport const encryptionInterceptor: HttpInterceptorFn = (req, next) => {\r\n  const cryptoService = inject(CryptoService);\r\n  const config = inject(SECURITY_CONFIG, { optional: true }) as SecurityConfig | null;\r\n\r\n  if (config?.enableEncryption === false) return next(req);\r\n\r\n  const encryptPatterns = config?.encryptDecryptForEndpoints || ['*'];\r\n  const skipPatterns = config?.skipEncryptDecryptForEndpoints;\r\n  const shouldEncrypt = cryptoService.matchesPattern(req.url, encryptPatterns, skipPatterns);\r\n\r\n  if (!shouldEncrypt) return next(req);\r\n  if (config?.publicKeyEndpoint && req.url === config.publicKeyEndpoint) return next(req);\r\n\r\n  const aesKeyHeader = config?.aesKeyHeaderName || DEFAULT_AES_KEY_HEADER_NAME;\r\n  const ivHeader = config?.ivHeaderName || DEFAULT_IV_HEADER_NAME;\r\n\r\n  if (req.method === 'GET') {\r\n    return from(cryptoService.generateEncryptedHeaders()).pipe(\r\n      switchMap((headers: { encryptedAesKey: string; encryptedIV: string } | null) => {\r\n        if (!headers) return next(req);\r\n        const encryptedReq = req.clone({\r\n          setHeaders: {\r\n            [aesKeyHeader]: headers.encryptedAesKey,\r\n            [ivHeader]: headers.encryptedIV\r\n          }\r\n        });\r\n        return next(encryptedReq);\r\n      })\r\n    );\r\n  }\r\n\r\n  if (!req.body || typeof req.body !== 'object') return next(req);\r\n  if (req.method === 'DELETE' || req.method === 'HEAD' || req.method === 'OPTIONS') return next(req);\r\n\r\n  config?.enableDebugLogging && console.log(`[ng-secure-fetch] Encrypting ${req.method} request`);\r\n\r\n  return from(cryptoService.createEncryptedEnvelope(req.body as Record<string, unknown>)).pipe(\r\n    switchMap((encryptedBody: Record<string, unknown>) => {\r\n      const envelope = encryptedBody as Record<string, unknown>;\r\n      const encryptedReq = req.clone({\r\n        body: envelope['d'],\r\n        setHeaders: {\r\n          'Content-Type': 'text/plain',\r\n          [aesKeyHeader]: envelope['k'] as string,\r\n          [ivHeader]: envelope['s'] as string\r\n        }\r\n      });\r\n      return next(encryptedReq);\r\n    })\r\n  );\r\n};\r\n","import { HttpInterceptorFn, HttpResponse, HttpErrorResponse } from '@angular/common/http';\r\nimport { inject } from '@angular/core';\r\nimport { from, switchMap, of, throwError, catchError } from 'rxjs';\r\nimport { CryptoService } from '../services/crypto.service';\r\nimport { SECURITY_CONFIG, SecurityConfig, DEFAULT_AES_KEY_HEADER_NAME, DEFAULT_IV_HEADER_NAME } from '../models/ng-secure-fetch-config.interface';\r\n\r\n/** Decrypts responses using AES keys from headers (X-Request-Context, X-Client-Ref) */\r\nexport const decryptionInterceptor: HttpInterceptorFn = (req, next) => {\r\n  const cryptoService = inject(CryptoService);\r\n  const config = inject(SECURITY_CONFIG, { optional: true }) as SecurityConfig | null;\r\n\r\n  return next(req).pipe(\r\n    switchMap((event: any) => {\r\n      if (!(event instanceof HttpResponse)) return of(event);\r\n      if (config?.enableEncryption === false) return of(event);\r\n\r\n      const encryptPatterns = config?.encryptDecryptForEndpoints || ['*'];\r\n      const skipPatterns = config?.skipEncryptDecryptForEndpoints;\r\n      const shouldDecrypt = cryptoService.matchesPattern(req.url, encryptPatterns, skipPatterns);\r\n\r\n      if (!shouldDecrypt) return of(event);\r\n      if (config?.publicKeyEndpoint && req.url === config.publicKeyEndpoint) return of(event);\r\n\r\n      return decryptResponse(event, cryptoService, config);\r\n    }),\r\n    catchError((error: HttpErrorResponse) => {\r\n      // Handle error responses (4xx, 5xx)\r\n      if (config?.enableEncryption === false) return throwError(() => error);\r\n\r\n      const encryptPatterns = config?.encryptDecryptForEndpoints || ['*'];\r\n      const skipPatterns = config?.skipEncryptDecryptForEndpoints;\r\n      const shouldDecrypt = cryptoService.matchesPattern(req.url, encryptPatterns, skipPatterns);\r\n\r\n      if (!shouldDecrypt) return throwError(() => error);\r\n      if (config?.publicKeyEndpoint && req.url === config.publicKeyEndpoint) return throwError(() => error);\r\n\r\n      const aesKeyHeader = config?.aesKeyHeaderName || DEFAULT_AES_KEY_HEADER_NAME;\r\n      const ivHeader = config?.ivHeaderName || DEFAULT_IV_HEADER_NAME;\r\n\r\n      config?.enableDebugLogging && console.log('[ng-secure-fetch] Error response received, attempting decryption');\r\n\r\n      // Check if error has encryption headers\r\n      const aesKeyBase64 = error.headers?.get(aesKeyHeader) || error.headers?.get(aesKeyHeader.toLowerCase());\r\n      const ivBase64 = error.headers?.get(ivHeader) || error.headers?.get(ivHeader.toLowerCase());\r\n\r\n      if (!aesKeyBase64 || !ivBase64 || !error.error) {\r\n        config?.enableDebugLogging && console.warn('[ng-secure-fetch] Error response not encrypted');\r\n        return throwError(() => error);\r\n      }\r\n\r\n      // Decrypt error response\r\n      return from(\r\n        cryptoService.decryptResponsePayload(\r\n          typeof error.error === 'string' ? error.error : JSON.stringify(error.error),\r\n          aesKeyBase64,\r\n          ivBase64\r\n        ).then(\r\n          (decrypted: Record<string, unknown> | null) => {\r\n            if (decrypted) {\r\n              config?.enableDebugLogging && console.log('[ng-secure-fetch] Error response decrypted');\r\n              \r\n              // Return decrypted error - spread decrypted data to top level for easier access\r\n              // This allows components to access error.errors[0] instead of error.error.errors[0]\r\n              const decryptedError = new HttpErrorResponse({\r\n                error: decrypted,\r\n                headers: error.headers,\r\n                status: error.status,\r\n                statusText: error.statusText,\r\n                url: error.url || undefined\r\n              });\r\n              \r\n              // Merge decrypted properties to top level of error object\r\n              Object.assign(decryptedError, decrypted);\r\n              \r\n              throw decryptedError;\r\n            }\r\n            config?.enableDebugLogging && console.warn('[ng-secure-fetch] Error decryption returned null');\r\n            throw error;\r\n          },\r\n          (decryptError: any) => {\r\n            config?.enableDebugLogging && console.error('[ng-secure-fetch] Failed to decrypt error response:', decryptError);\r\n            throw error;\r\n          }\r\n        )\r\n      );\r\n    })\r\n  );\r\n};\r\n\r\n/** Helper function to decrypt successful responses */\r\nfunction decryptResponse(\r\n  event: HttpResponse<any>,\r\n  cryptoService: CryptoService,\r\n  config: SecurityConfig | null\r\n) {\r\n  const aesKeyHeader = config?.aesKeyHeaderName || DEFAULT_AES_KEY_HEADER_NAME;\r\n  const ivHeader = config?.ivHeaderName || DEFAULT_IV_HEADER_NAME;\r\n\r\n  const aesKeyBase64 = event.headers.get(aesKeyHeader) || event.headers.get(aesKeyHeader.toLowerCase());\r\n  const ivBase64 = event.headers.get(ivHeader) || event.headers.get(ivHeader.toLowerCase());\r\n\r\n  if (!aesKeyBase64 || !ivBase64 || !event.body) {\r\n    config?.enableDebugLogging && event.body && console.warn('[ng-secure-fetch] Missing encryption headers');\r\n    return of(event);\r\n  }\r\n\r\n  config?.enableDebugLogging && console.log('[ng-secure-fetch] Decrypting response');\r\n\r\n  return from(\r\n    cryptoService.decryptResponsePayload(event.body as string, aesKeyBase64, ivBase64)\r\n  ).pipe(\r\n    switchMap((decrypted: Record<string, unknown> | null) => {\r\n      if (decrypted) {\r\n        config?.enableDebugLogging && console.log('[ng-secure-fetch] Response decrypted successfully');\r\n        return of(event.clone({ body: decrypted }));\r\n      }\r\n      config?.enableDebugLogging && console.warn('[ng-secure-fetch] Decryption returned null');\r\n      return of(event);\r\n    })\r\n  );\r\n}\r\n","import { inject } from '@angular/core';\r\nimport { HttpClient, HttpResponse } from '@angular/common/http';\r\nimport { Observable, of, throwError, retry, catchError, switchMap, map, timer, Subscriber } from 'rxjs';\r\nimport { CryptoService } from '../services/crypto.service';\r\nimport { SECURITY_CONFIG, SecurityConfig, DEFAULT_PUBLIC_KEY_HEADER_NAME } from '../models/ng-secure-fetch-config.interface';\r\n\r\n/** APP_INITIALIZER: Fetches public key, verifies hash, blocks app until ready */\r\nexport function initializeNgSecureFetchFactory(): () => Observable<void> {\r\n  const http = inject(HttpClient);\r\n  const cryptoService = inject(CryptoService);\r\n  const config = inject(SECURITY_CONFIG);\r\n\r\n  return () => {\r\n    if (config.enableEncryption === false) {\r\n      config.enableDebugLogging && console.log('[ng-secure-fetch] Encryption disabled');\r\n      return of(void 0);\r\n    }\r\n\r\n    if (!config.publicKeyEndpoint) {\r\n      console.error('[ng-secure-fetch] publicKeyEndpoint required');\r\n      return throwError(() => new Error('publicKeyEndpoint required'));\r\n    }\r\n\r\n    // Check for cached public key in sessionStorage first\r\n    return new Observable<void>((subscriber: Subscriber<void>) => {\r\n      const cachedPemKey = cryptoService.getCachedPemKey();\r\n      \r\n      if (cachedPemKey) {\r\n        config.enableDebugLogging && console.log('[ng-secure-fetch] Using cached key');\r\n        \r\n        validateAndSetPublicKey(cryptoService, config, cachedPemKey).then(() => {\r\n          config.enableDebugLogging && console.log('[ng-secure-fetch] Cached key validated');\r\n          subscriber.next();\r\n          subscriber.complete();\r\n        }).catch(err => {\r\n          config.enableDebugLogging && console.warn('[ng-secure-fetch] Cache invalid, fetching fresh key');\r\n          cryptoService.clearCachedPublicKey();\r\n          \r\n          fetchPublicKeyFromAPI(http, cryptoService, config).subscribe({\r\n            next: () => {\r\n              subscriber.next();\r\n              subscriber.complete();\r\n            },\r\n            error: (err: any) => subscriber.error(err)\r\n          });\r\n        });\r\n      } else {\r\n        config.enableDebugLogging && console.log('[ng-secure-fetch] Fetching public key from API');\r\n        \r\n        fetchPublicKeyFromAPI(http, cryptoService, config).subscribe({\r\n          next: () => {\r\n            subscriber.next();\r\n            subscriber.complete();\r\n          },\r\n          error: (err: any) => subscriber.error(err)\r\n        });\r\n      }\r\n    });\r\n  };\r\n}\r\n\r\n/** Validate PEM key hash and import it (reusable for both cached and API keys) */\r\nasync function validateAndSetPublicKey(\r\n  cryptoService: CryptoService,\r\n  config: SecurityConfig,\r\n  pemKey: string\r\n): Promise<void> {\r\n  const isValid = await cryptoService.verifyPublicKeyHash(pemKey);\r\n  if (!isValid) {\r\n    throw new Error('Public key hash mismatch - possible MITM attack');\r\n  }\r\n  \r\n  const cryptoKey = await cryptoService.importPublicKey(pemKey);\r\n  cryptoService.setPublicKey(cryptoKey, pemKey);\r\n  config.enableDebugLogging && console.log('[ng-secure-fetch] Public key imported & validated');\r\n}\r\n\r\n/** Helper function to fetch public key from API */\r\nfunction fetchPublicKeyFromAPI(http: HttpClient, cryptoService: CryptoService, config: SecurityConfig): Observable<void> {\r\n  const retries = config.publicKeyFetchRetries || 3;\r\n\r\n  return http.get<void>(config.publicKeyEndpoint!, { observe: 'response' }).pipe(\r\n    retry({\r\n      count: retries,\r\n      delay: (_error: any, retryCount: number) => {\r\n        config.enableDebugLogging && console.warn(`[ng-secure-fetch] Retry ${retryCount}/${retries}`);\r\n        return timer(Math.pow(2, retryCount - 1) * 1000);\r\n      }\r\n    }),\r\n\r\n    switchMap((response: HttpResponse<void>) => {\r\n      const headerName = config.publicKeyHeaderName || DEFAULT_PUBLIC_KEY_HEADER_NAME;\r\n      const pemKey = response.headers.get(headerName) || response.headers.get(headerName.toLowerCase());\r\n      \r\n      if (!pemKey) {\r\n        const availableHeaders = response.headers.keys().join(', ');\r\n        console.error(`[ng-secure-fetch] ${headerName} header missing. Available: ${availableHeaders}`);\r\n        throw new Error(`${headerName} header not found. Set Access-Control-Expose-Headers`);\r\n      }\r\n      \r\n      config.enableDebugLogging && console.log(`[ng-secure-fetch] Public key received from ${headerName}`);\r\n      return validateAndSetPublicKey(cryptoService, config, pemKey);\r\n    }),\r\n\r\n    map(() => {\r\n      config.enableDebugLogging && console.log('[ng-secure-fetch] Initialized - encryption ready');\r\n      return void 0;\r\n    }),\r\n\r\n    catchError((error: any) => {\r\n      console.error('[ng-secure-fetch] Initialization failed. Set enableEncryption: false to bypass');\r\n      return throwError(() => error);\r\n    })\r\n  );\r\n}\r\n","import { EnvironmentProviders, makeEnvironmentProviders, APP_INITIALIZER } from '@angular/core';\r\nimport { provideHttpClient, withInterceptors } from '@angular/common/http';\r\nimport { SecurityConfig, SECURITY_CONFIG } from '../models/ng-secure-fetch-config.interface';\r\nimport { encryptionInterceptor } from '../interceptors/encryption.interceptor';\r\nimport { decryptionInterceptor } from '../interceptors/decryption.interceptor';\r\nimport { initializeNgSecureFetchFactory } from '../initializers/ng-secure-fetch.initializer';\r\n\r\n/**\r\n * Complete ng-secure-fetch provider: config + interceptors + APP_INITIALIZER\r\n * App blocks until public key is fetched and verified\r\n * \r\n * @example\r\n * provideNgSecureFetch({\r\n *   enableEncryption: true,\r\n *   publicKeyEndpoint: environment.apiUrl + '/crypto/init',\r\n *   expectedPublicKeyHash: 'your-sha256-hash-here',\r\n *   encryptDecryptForEndpoints: ['/insurance/*'],\r\n *   skipEncryptDecryptForEndpoints: ['/public/*'],\r\n *   publicKeyHeaderName: 'X-Client-Init',\r\n *   aesKeyHeaderName: 'X-Request-Context',\r\n *   ivHeaderName: 'X-Client-Ref',\r\n *   enableDebugLogging: false,\r\n *   publicKeyFetchRetries: 3\r\n * })\r\n */\r\nexport function provideNgSecureFetch(config: SecurityConfig): EnvironmentProviders {\r\n  return makeEnvironmentProviders([\r\n    { provide: SECURITY_CONFIG, useValue: config },\r\n    provideHttpClient(withInterceptors([encryptionInterceptor, decryptionInterceptor])),\r\n    { provide: APP_INITIALIZER, useFactory: initializeNgSecureFetchFactory, multi: true }\r\n  ]);\r\n}\r\n","/*\r\n * Public API Surface of ng-secure-fetch\r\n * \r\n * Users should only import from this public API surface.\r\n * All other modules are considered internal implementation details.\r\n */\r\n\r\n// Configuration Provider\r\nexport * from './lib/config/ng-secure-fetch.config';\r\n\r\n// Configuration Interface\r\nexport * from './lib/models/ng-secure-fetch-config.interface';\r\n\r\n// Data Models\r\nexport * from './lib/models/encrypted-payload.interface';\r\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":";;;;;AAEA;AACO,MAAM,8BAA8B,GAAG;AAE9C;AACO,MAAM,2BAA2B,GAAG;AAE3C;AACO,MAAM,sBAAsB,GAAG;AAmCtC;MACa,eAAe,GAAG,IAAI,cAAc,CAAiB,gBAAgB;AAElF;AACO,MAAM,uBAAuB,GAAmB;AACrD,IAAA,iBAAiB,EAAE,yCAAyC;AAC5D,IAAA,qBAAqB,EAAE,6DAA6D;IACpF,0BAA0B,EAAE,CAAC,GAAG,CAAC;AACjC,IAAA,8BAA8B,EAAE,EAAE;AAClC,IAAA,mBAAmB,EAAE,8BAA8B;AACnD,IAAA,gBAAgB,EAAE,2BAA2B;AAC7C,IAAA,YAAY,EAAE,sBAAsB;AACpC,IAAA,kBAAkB,EAAE,KAAK;AACzB,IAAA,gBAAgB,EAAE,IAAI;AACtB,IAAA,qBAAqB,EAAE;;;MCnDZ,aAAa,CAAA;AACP,IAAA,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC;AAChC,IAAA,SAAS,GAAG,MAAM,CAAmB,IAAI,qDAAC;IAC1C,WAAW,GAAG,gCAAgC;AAE/D;;;;;;;;;;;;AAYG;AACH,IAAA,cAAc,CAAC,GAAW,EAAE,QAAkB,EAAE,YAAuB,EAAA;;QAErE,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;YAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,IAAG;gBAC7C,IAAI,OAAO,KAAK,GAAG;AAAE,oBAAA,OAAO,IAAI;AAEhC,gBAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;AAC1B,oBAAA,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C;AAEA,gBAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;oBAChC,IAAI,YAAY,GAAG;AAChB,yBAAA,OAAO,CAAC,qBAAqB,EAAE,MAAM;AACrC,yBAAA,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC;AACpC,oBAAA,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC;AACtC,oBAAA,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxB;AAEA,gBAAA,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC9B,YAAA,CAAC,CAAC;YAEF,IAAI,UAAU,EAAE;AACd,gBAAA,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA,0BAAA,EAA6B,GAAG,CAAA,CAAE,CAAC;AACjF,gBAAA,OAAO,KAAK;YACd;QACF;;AAGA,QAAA,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAG;;YAE7B,IAAI,OAAO,KAAK,GAAG;AAAE,gBAAA,OAAO,IAAI;;AAGhC,YAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;AAC1B,gBAAA,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C;;AAGA,YAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;;;;;gBAMhC,IAAI,YAAY,GAAG;AAChB,qBAAA,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC;AACtC,qBAAA,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;;AAGrC,gBAAA,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC;AAEtC,gBAAA,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE;oBAClC,OAAO,CAAC,GAAG,CAAC,CAAA,2BAAA,EAA8B,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAE,CAAC;gBAC5G;AAEA,gBAAA,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YACxB;;AAGA,YAAA,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC9B,QAAA,CAAC,CAAC;IACJ;;IAGA,MAAM,mBAAmB,CAAC,MAAc,EAAA;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,mCAAmC;AAE7F,QAAA,IAAI;AACF,YAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;AACnC,YAAA,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;AAC9D,YAAA,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AACxD,YAAA,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAE5E,YAAA,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA,mCAAA,EAAsC,OAAO,CAAA,CAAE,CAAC;AAE9F,YAAA,IAAI,YAAY,KAAK,mCAAmC,EAAE;AACxD,gBAAA,OAAO,CAAC,IAAI,CAAC,kEAAkE,OAAO,CAAA,CAAE,CAAC;AACzF,gBAAA,OAAO,KAAK;YACd;AAEA,YAAA,MAAM,OAAO,GAAG,OAAO,KAAK,YAAY;YAExC,IAAI,CAAC,OAAO,EAAE;gBACZ,OAAO,CAAC,KAAK,CAAC,CAAA,2CAAA,EAA8C,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA,UAAA,EAAa,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA,GAAA,CAAK,CAAC;YACtI;iBAAO;gBACL,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC;YAC7F;AAEA,YAAA,OAAO,OAAO;QAChB;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC;AAClE,YAAA,OAAO,KAAK;QACd;IACF;;IAGA,YAAY,CAAC,GAAc,EAAE,MAAe,EAAA;AAC1C,QAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAEvB,IAAI,MAAM,EAAE;AACV,YAAA,IAAI;gBACF,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC;YACtF;YAAE,OAAO,KAAK,EAAE;AACd,gBAAA,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,CAAC;YAChE;QACF;IACF;;IAGA,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,SAAS,EAAE;IACzB;;IAGA,eAAe,GAAA;AACb,QAAA,IAAI;YACF,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjD;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,IAAI,CAAC,sCAAsC,EAAE,KAAK,CAAC;AAC3D,YAAA,OAAO,IAAI;QACb;IACF;;IAGA,oBAAoB,GAAA;AAClB,QAAA,IAAI;AACF,YAAA,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;QAClF;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,KAAK,CAAC;QAC9D;IACF;;AAGQ,IAAA,MAAM,cAAc,GAAA;QAC1B,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB;IACH;;IAGQ,MAAM,YAAY,CAAC,QAAqB,EAAA;AAC9C,QAAA,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACzC,KAAK,EACL,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ;IACH;;IAGQ,UAAU,GAAA;AAChB,QAAA,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1D;;IAGQ,oBAAoB,CAAC,SAAiB,EAAE,SAAiB,EAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS;AAClF,QAAA,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,MAAM,CAAC;IACrD;;AAGQ,IAAA,MAAM,cAAc,CAAC,IAAY,EAAE,MAAiB,EAAE,EAAc,EAAA;AAC1E,QAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;QACjC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACvC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;IAC5G;;AAGQ,IAAA,MAAM,oBAAoB,CAAC,MAAiB,EAAE,YAAuB,EAAA;AAC3E,QAAA,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;AACxE,QAAA,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC;IAC7F;;AAGQ,IAAA,MAAM,gBAAgB,CAAC,EAAc,EAAE,YAAuB,EAAA;AACpE,QAAA,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,EAAkB,CAAC;IACnG;;AAGQ,IAAA,mBAAmB,CAAC,MAAmB,EAAA;AAC7C,QAAA,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC;QACpC,IAAI,MAAM,GAAG,EAAE;AACf,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACrC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC;AACA,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB;;AAGQ,IAAA,mBAAmB,CAAC,MAAc,EAAA;AACxC,QAAA,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;AAC3C,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACtC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACjC;QACA,OAAO,KAAK,CAAC,MAAM;IACrB;;IAGA,MAAM,cAAc,CAAC,OAAgC,EAAA;AACnD,QAAA,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE;AACxC,QAAA,IAAI,CAAC,YAAY;AAAE,YAAA,OAAO,IAAI;AAE9B,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE;AAC1C,QAAA,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;QAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC;AAClD,QAAA,MAAM,UAAU,GAAG,CAAA,EAAG,aAAa,CAAA,EAAA,EAAK,OAAO,EAAE;AAEjD,QAAA,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtE,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;AAC3C,YAAA,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC;AAC/C,YAAA,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,YAAY;AACvC,SAAA,CAAC;QAEF,OAAO;AACL,YAAA,aAAa,EAAE,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC;AACtD,YAAA,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;AAC1D,YAAA,EAAE,EAAE,IAAI,CAAC,mBAAmB,CAAC,WAAW;SACzC;IACH;;AAGA,IAAA,MAAM,wBAAwB,GAAA;AAC5B,QAAA,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE;AACxC,QAAA,IAAI,CAAC,YAAY;AAAE,YAAA,OAAO,IAAI;AAE9B,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE;AAC1C,QAAA,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;QAE5B,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACvD,YAAA,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC;AAC/C,YAAA,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,YAAY;AACvC,SAAA,CAAC;AAEF,QAAA,MAAM,MAAM,GAAG;AACb,YAAA,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;AAC1D,YAAA,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,WAAW;SAClD;QAED,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC;AAE9F,QAAA,OAAO,MAAM;IACf;;IAGA,MAAM,uBAAuB,CAAC,eAAwC,EAAA;QACpE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;AACnE,QAAA,IAAI,CAAC,gBAAgB;AAAE,YAAA,OAAO,eAAe;QAE7C,OAAO;YACL,CAAC,EAAE,gBAAgB,CAAC,aAAa;YACjC,CAAC,EAAE,gBAAgB,CAAC,eAAe;YACnC,CAAC,EAAE,gBAAgB,CAAC;SACrB;IACH;;AAGA,IAAA,MAAM,sBAAsB,CAC1B,aAAqB,EACrB,YAAoB,EACpB,QAAgB,EAAA;QAEhB,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;QAEnD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CACxD,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAChC,MAAM,EACN,cAAc,CACf;AAED,QAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;QACjC,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QAC5D,MAAM,CAAC,UAAU,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC;QAErD,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC;AAErF,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B;;IAGA,MAAM,eAAe,CAAC,MAAc,EAAA;QAClC,MAAM,SAAS,GAAG,4BAA4B;QAC9C,MAAM,SAAS,GAAG,0BAA0B;QAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAE3F,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC;AAEpF,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;QACnC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC;AACvD,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzC,cAAc,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7C;AAEA,QAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACpD,MAAM,EACN,cAAc,CAAC,MAAM,EACrB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EACrC,IAAI,EACJ,CAAC,SAAS,CAAC,CACZ;QAED,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC;AAE5F,QAAA,OAAO,SAAS;IAClB;wGA7UW,aAAa,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAb,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,aAAa,cAFZ,MAAM,EAAA,CAAA;;4FAEP,aAAa,EAAA,UAAA,EAAA,CAAA;kBAHzB,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;;ACAD;AACO,MAAM,qBAAqB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AACpE,IAAA,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;AAC3C,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAA0B;AAEnF,IAAA,IAAI,MAAM,EAAE,gBAAgB,KAAK,KAAK;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAExD,MAAM,eAAe,GAAG,MAAM,EAAE,0BAA0B,IAAI,CAAC,GAAG,CAAC;AACnE,IAAA,MAAM,YAAY,GAAG,MAAM,EAAE,8BAA8B;AAC3D,IAAA,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,CAAC;AAE1F,IAAA,IAAI,CAAC,aAAa;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,MAAM,EAAE,iBAAiB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,iBAAiB;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAEvF,IAAA,MAAM,YAAY,GAAG,MAAM,EAAE,gBAAgB,IAAI,2BAA2B;AAC5E,IAAA,MAAM,QAAQ,GAAG,MAAM,EAAE,YAAY,IAAI,sBAAsB;AAE/D,IAAA,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE;AACxB,QAAA,OAAO,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC,CAAC,IAAI,CACxD,SAAS,CAAC,CAAC,OAAgE,KAAI;AAC7E,YAAA,IAAI,CAAC,OAAO;AAAE,gBAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAC9B,YAAA,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC;AAC7B,gBAAA,UAAU,EAAE;AACV,oBAAA,CAAC,YAAY,GAAG,OAAO,CAAC,eAAe;AACvC,oBAAA,CAAC,QAAQ,GAAG,OAAO,CAAC;AACrB;AACF,aAAA,CAAC;AACF,YAAA,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC,CAAC,CACH;IACH;IAEA,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAC/D,IAAA,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAElG,IAAA,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA,6BAAA,EAAgC,GAAG,CAAC,MAAM,CAAA,QAAA,CAAU,CAAC;AAE/F,IAAA,OAAO,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAA+B,CAAC,CAAC,CAAC,IAAI,CAC1F,SAAS,CAAC,CAAC,aAAsC,KAAI;QACnD,MAAM,QAAQ,GAAG,aAAwC;AACzD,QAAA,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC;AAC7B,YAAA,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC;AACnB,YAAA,UAAU,EAAE;AACV,gBAAA,cAAc,EAAE,YAAY;AAC5B,gBAAA,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAW;AACvC,gBAAA,CAAC,QAAQ,GAAG,QAAQ,CAAC,GAAG;AACzB;AACF,SAAA,CAAC;AACF,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC,CAAC,CACH;AACH,CAAC;;ACnDD;AACO,MAAM,qBAAqB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AACpE,IAAA,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;AAC3C,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAA0B;AAEnF,IAAA,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,SAAS,CAAC,CAAC,KAAU,KAAI;AACvB,QAAA,IAAI,EAAE,KAAK,YAAY,YAAY,CAAC;AAAE,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;AACtD,QAAA,IAAI,MAAM,EAAE,gBAAgB,KAAK,KAAK;AAAE,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;QAExD,MAAM,eAAe,GAAG,MAAM,EAAE,0BAA0B,IAAI,CAAC,GAAG,CAAC;AACnE,QAAA,MAAM,YAAY,GAAG,MAAM,EAAE,8BAA8B;AAC3D,QAAA,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,CAAC;AAE1F,QAAA,IAAI,CAAC,aAAa;AAAE,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;QACpC,IAAI,MAAM,EAAE,iBAAiB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,iBAAiB;AAAE,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;QAEvF,OAAO,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC;AACtD,IAAA,CAAC,CAAC,EACF,UAAU,CAAC,CAAC,KAAwB,KAAI;;AAEtC,QAAA,IAAI,MAAM,EAAE,gBAAgB,KAAK,KAAK;AAAE,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAEtE,MAAM,eAAe,GAAG,MAAM,EAAE,0BAA0B,IAAI,CAAC,GAAG,CAAC;AACnE,QAAA,MAAM,YAAY,GAAG,MAAM,EAAE,8BAA8B;AAC3D,QAAA,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,CAAC;AAE1F,QAAA,IAAI,CAAC,aAAa;AAAE,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAClD,IAAI,MAAM,EAAE,iBAAiB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,iBAAiB;AAAE,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;AAErG,QAAA,MAAM,YAAY,GAAG,MAAM,EAAE,gBAAgB,IAAI,2BAA2B;AAC5E,QAAA,MAAM,QAAQ,GAAG,MAAM,EAAE,YAAY,IAAI,sBAAsB;QAE/D,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC;;QAG7G,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE3F,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YAC9C,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC;AAC5F,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC;;AAGA,QAAA,OAAO,IAAI,CACT,aAAa,CAAC,sBAAsB,CAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAC3E,YAAY,EACZ,QAAQ,CACT,CAAC,IAAI,CACJ,CAAC,SAAyC,KAAI;YAC5C,IAAI,SAAS,EAAE;gBACb,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC;;;AAIvF,gBAAA,MAAM,cAAc,GAAG,IAAI,iBAAiB,CAAC;AAC3C,oBAAA,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;AAC5B,oBAAA,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI;AACnB,iBAAA,CAAC;;AAGF,gBAAA,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC;AAExC,gBAAA,MAAM,cAAc;YACtB;YACA,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC;AAC9F,YAAA,MAAM,KAAK;AACb,QAAA,CAAC,EACD,CAAC,YAAiB,KAAI;YACpB,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,YAAY,CAAC;AAChH,YAAA,MAAM,KAAK;QACb,CAAC,CACF,CACF;IACH,CAAC,CAAC,CACH;AACH,CAAC;AAED;AACA,SAAS,eAAe,CACtB,KAAwB,EACxB,aAA4B,EAC5B,MAA6B,EAAA;AAE7B,IAAA,MAAM,YAAY,GAAG,MAAM,EAAE,gBAAgB,IAAI,2BAA2B;AAC5E,IAAA,MAAM,QAAQ,GAAG,MAAM,EAAE,YAAY,IAAI,sBAAsB;IAE/D,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IACrG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEzF,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;AAC7C,QAAA,MAAM,EAAE,kBAAkB,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC;AACxG,QAAA,OAAO,EAAE,CAAC,KAAK,CAAC;IAClB;IAEA,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC;IAElF,OAAO,IAAI,CACT,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CACnF,CAAC,IAAI,CACJ,SAAS,CAAC,CAAC,SAAyC,KAAI;QACtD,IAAI,SAAS,EAAE;YACb,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC;AAC9F,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7C;QACA,MAAM,EAAE,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC;AACxF,QAAA,OAAO,EAAE,CAAC,KAAK,CAAC;IAClB,CAAC,CAAC,CACH;AACH;;AClHA;SACgB,8BAA8B,GAAA;AAC5C,IAAA,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;AAC/B,IAAA,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;AAC3C,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC;AAEtC,IAAA,OAAO,MAAK;AACV,QAAA,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE;YACrC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC;AACjF,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB;AAEA,QAAA,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE;AAC7B,YAAA,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC;YAC7D,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClE;;AAGA,QAAA,OAAO,IAAI,UAAU,CAAO,CAAC,UAA4B,KAAI;AAC3D,YAAA,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE;YAEpD,IAAI,YAAY,EAAE;gBAChB,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;gBAE9E,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,MAAK;oBACrE,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC;oBAClF,UAAU,CAAC,IAAI,EAAE;oBACjB,UAAU,CAAC,QAAQ,EAAE;AACvB,gBAAA,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAG;oBACb,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,qDAAqD,CAAC;oBAChG,aAAa,CAAC,oBAAoB,EAAE;oBAEpC,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC;wBAC3D,IAAI,EAAE,MAAK;4BACT,UAAU,CAAC,IAAI,EAAE;4BACjB,UAAU,CAAC,QAAQ,EAAE;wBACvB,CAAC;wBACD,KAAK,EAAE,CAAC,GAAQ,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG;AAC1C,qBAAA,CAAC;AACJ,gBAAA,CAAC,CAAC;YACJ;iBAAO;gBACL,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC;gBAE1F,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC;oBAC3D,IAAI,EAAE,MAAK;wBACT,UAAU,CAAC,IAAI,EAAE;wBACjB,UAAU,CAAC,QAAQ,EAAE;oBACvB,CAAC;oBACD,KAAK,EAAE,CAAC,GAAQ,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG;AAC1C,iBAAA,CAAC;YACJ;AACF,QAAA,CAAC,CAAC;AACJ,IAAA,CAAC;AACH;AAEA;AACA,eAAe,uBAAuB,CACpC,aAA4B,EAC5B,MAAsB,EACtB,MAAc,EAAA;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE;AACZ,QAAA,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC;IACpE;IAEA,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC;AAC7D,IAAA,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC;IAC7C,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC;AAC/F;AAEA;AACA,SAAS,qBAAqB,CAAC,IAAgB,EAAE,aAA4B,EAAE,MAAsB,EAAA;AACnG,IAAA,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,IAAI,CAAC;AAEjD,IAAA,OAAO,IAAI,CAAC,GAAG,CAAO,MAAM,CAAC,iBAAkB,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAC5E,KAAK,CAAC;AACJ,QAAA,KAAK,EAAE,OAAO;AACd,QAAA,KAAK,EAAE,CAAC,MAAW,EAAE,UAAkB,KAAI;AACzC,YAAA,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA,wBAAA,EAA2B,UAAU,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE,CAAC;AAC7F,YAAA,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;QAClD;AACD,KAAA,CAAC,EAEF,SAAS,CAAC,CAAC,QAA4B,KAAI;AACzC,QAAA,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,IAAI,8BAA8B;QAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QAEjG,IAAI,CAAC,MAAM,EAAE;AACX,YAAA,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,CAAA,kBAAA,EAAqB,UAAU,CAAA,4BAAA,EAA+B,gBAAgB,CAAA,CAAE,CAAC;AAC/F,YAAA,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAA,oDAAA,CAAsD,CAAC;QACtF;QAEA,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA,2CAAA,EAA8C,UAAU,CAAA,CAAE,CAAC;QACpG,OAAO,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC;AAC/D,IAAA,CAAC,CAAC,EAEF,GAAG,CAAC,MAAK;QACP,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC;QAC5F,OAAO,KAAK,CAAC;AACf,IAAA,CAAC,CAAC,EAEF,UAAU,CAAC,CAAC,KAAU,KAAI;AACxB,QAAA,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC;AAC/F,QAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;IAChC,CAAC,CAAC,CACH;AACH;;AC3GA;;;;;;;;;;;;;;;;;AAiBG;AACG,SAAU,oBAAoB,CAAC,MAAsB,EAAA;AACzD,IAAA,OAAO,wBAAwB,CAAC;AAC9B,QAAA,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC9C,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACnF,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,8BAA8B,EAAE,KAAK,EAAE,IAAI;AACpF,KAAA,CAAC;AACJ;;AC/BA;;;;;AAKG;AAEH;;ACPA;;AAEG;;;;"}

package/index.d.ts

@@ -0,0 +1,84 @@
+import { InjectionToken, EnvironmentProviders } from '@angular/core';
+
+/** Default header name for public key exchange */
+declare const DEFAULT_PUBLIC_KEY_HEADER_NAME = "X-Client-Init";
+/** Default header name for AES key in request/response */
+declare const DEFAULT_AES_KEY_HEADER_NAME = "X-Request-Context";
+/** Default header name for IV in request/response */
+declare const DEFAULT_IV_HEADER_NAME = "X-Client-Ref";
+/** Security library configuration */
+interface SecurityConfig {
+    /** Master switch: true = fetch key + encrypt/decrypt, false = bypass all (default: true) */
+    enableEncryption?: boolean;
+    /** Full public key endpoint URL (required if enableEncryption is true) */
+    publicKeyEndpoint?: string;
+    /** Expected SHA-256 hash for public key pinning (MITM protection) */
+    expectedPublicKeyHash?: string;
+    /** Endpoint patterns to encrypt: ['*'] = all, ['/api/*'] = glob, ['/exact/path'] = exact (default: ['*']) */
+    encryptDecryptForEndpoints?: string[];
+    /** Endpoint patterns to skip encryption (higher priority than encryptDecryptForEndpoints) */
+    skipEncryptDecryptForEndpoints?: string[];
+    /** Custom header name for public key exchange (default: 'X-Client-Init') */
+    publicKeyHeaderName?: string;
+    /** Custom header name for AES key in request/response (default: 'X-Request-Context') */
+    aesKeyHeaderName?: string;
+    /** Custom header name for IV in request/response (default: 'X-Client-Ref') */
+    ivHeaderName?: string;
+    /** Enable debug logging (default: true) */
+    enableDebugLogging?: boolean;
+    /** Retry attempts for public key fetch (default: 3) */
+    publicKeyFetchRetries?: number;
+}
+/** Injection token for security config */
+declare const SECURITY_CONFIG: InjectionToken<SecurityConfig>;
+/** Default configuration with placeholder values - replace with your actual values */
+declare const DEFAULT_SECURITY_CONFIG: SecurityConfig;
+
+/**
+ * Complete ng-secure-fetch provider: config + interceptors + APP_INITIALIZER
+ * App blocks until public key is fetched and verified
+ *
+ * @example
+ * provideNgSecureFetch({
+ *   enableEncryption: true,
+ *   publicKeyEndpoint: environment.apiUrl + '/crypto/init',
+ *   expectedPublicKeyHash: 'your-sha256-hash-here',
+ *   encryptDecryptForEndpoints: ['/insurance/*'],
+ *   skipEncryptDecryptForEndpoints: ['/public/*'],
+ *   publicKeyHeaderName: 'X-Client-Init',
+ *   aesKeyHeaderName: 'X-Request-Context',
+ *   ivHeaderName: 'X-Client-Ref',
+ *   enableDebugLogging: false,
+ *   publicKeyFetchRetries: 3
+ * })
+ */
+declare function provideNgSecureFetch(config: SecurityConfig): EnvironmentProviders;
+
+/**
+ * Encrypted payload structure for hybrid encryption
+ */
+interface EncryptedPayload {
+    /**
+     * AES-GCM encrypted data (Base64 encoded)
+     */
+    encryptedData: string;
+    /**
+     * RSA-OAEP encrypted AES key (Base64 encoded)
+     */
+    encryptedAesKey: string;
+    /**
+     * RSA-OAEP encrypted IV (Base64 encoded)
+     */
+    iv: string;
+}
+/**
+ * Obfuscated encrypted envelope with short field names
+ */
+interface EncryptedEnvelope {
+    d: string;
+    k: string;
+    s: string;
+}
+
+export { DEFAULT_AES_KEY_HEADER_NAME, DEFAULT_IV_HEADER_NAME, DEFAULT_PUBLIC_KEY_HEADER_NAME, DEFAULT_SECURITY_CONFIG, SECURITY_CONFIG, provideNgSecureFetch };
+export type { EncryptedEnvelope, EncryptedPayload, SecurityConfig };

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "ng-secure-fetch",
+  "version": "1.0.0",
+  "description": "Zero-dependency Angular library providing RSA-2048-OAEP + AES-256-GCM hybrid encryption with automatic HTTP request/response encryption and sessionStorage caching",
+  "keywords": [
+    "angular",
+    "encryption",
+    "security",
+    "http",
+    "interceptor",
+    "rsa",
+    "aes",
+    "hybrid-encryption",
+    "web-crypto-api",
+    "zero-dependencies"
+  ],
+  "author": "Prathamesh Vasekar <prathameshvasekar4.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/prathameshv4/ng-secure-fetch.git"
+  },
+  "bugs": {
+    "url": "https://github.com/prathameshv4/ng-secure-fetch/issues"
+  },
+  "homepage": "https://github.com/prathameshv4/ng-secure-fetch#readme",
+  "peerDependencies": {
+    "@angular/common": ">=17.0.0",
+    "@angular/core": ">=17.0.0"
+  },
+  "dependencies": {
+    "tslib": "^2.3.0"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "browser": {
+    "crypto": false
+  },
+  "module": "fesm2022/ng-secure-fetch.mjs",
+  "typings": "index.d.ts",
+  "exports": {
+    "./package.json": {
+      "default": "./package.json"
+    },
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./fesm2022/ng-secure-fetch.mjs"
+    }
+  }
+}