oidc-spa 8.6.19 → 8.7.0

package/esm/server/createOidcSpaUtils.mjs

@@ -0,0 +1,639 @@
+import { Deferred } from "../tools/Deferred.mjs";
+import { decodeProtectedHeader, jwtVerify, createLocalJWKSet, errors, importJWK, calculateJwkThumbprint } from "../vendor/server/jose.mjs";
+import { assert, isAmong, id, is, Reflect } from "../vendor/server/tsafe.mjs";
+import { z } from "../vendor/server/zod.mjs";
+import { Evt, throttleTime } from "../vendor/server/evt.mjs";
+import { decodeJwt } from "../tools/decodeJwt.mjs";
+import { createHash } from "crypto";
+export function createOidcSpaUtils(params) {
+    const { decodedAccessTokenSchema } = params;
+    const dParamsOfBootstrap = new Deferred();
+    const evtPublicSigningKeys = Evt.create(undefined);
+    const evtInvalidSignature = Evt.create();
+    evtInvalidSignature.pipe(throttleTime(3600000)).attach(async () => {
+        const publicSigningKeys_new = await (async function callee(count) {
+            const paramsOfBootstrap = await dParamsOfBootstrap.pr;
+            assert(paramsOfBootstrap.implementation === "real");
+            const { issuerUri } = paramsOfBootstrap;
+            let wrap;
+            try {
+                wrap = await fetchPublicSigningKeys({ issuerUri });
+            }
+            catch (error) {
+                if (count === 9) {
+                    console.warn(`Failed to refresh public key and signing algorithm after ${count + 1} attempts`);
+                    return undefined;
+                }
+                const delayMs = 1000 * Math.pow(2, count);
+                console.warn(`Failed to refresh public key and signing algorithm: ${String(error)}, retrying in ${delayMs}ms`);
+                await new Promise(resolve => setTimeout(resolve, delayMs));
+                return callee(count + 1);
+            }
+            return wrap;
+        })(0);
+        if (publicSigningKeys_new === undefined) {
+            return;
+        }
+        evtPublicSigningKeys.state = publicSigningKeys_new;
+    });
+    let bootstrapAuth_prResolved = undefined;
+    const bootstrapAuth = paramsOfBootstrap => {
+        if (bootstrapAuth_prResolved !== undefined) {
+            return bootstrapAuth_prResolved;
+        }
+        return (bootstrapAuth_prResolved = (async () => {
+            dParamsOfBootstrap.resolve(paramsOfBootstrap);
+            if (paramsOfBootstrap.implementation === "real") {
+                evtPublicSigningKeys.state = await fetchPublicSigningKeys({
+                    issuerUri: paramsOfBootstrap.issuerUri
+                });
+            }
+        })());
+    };
+    const { getIsDpopPoofSeenRecordIfNotSeen } = (() => {
+        const timeSeenByDpopProofId = new Map();
+        const evtDpopProofAdded = Evt.create();
+        evtDpopProofAdded.pipe(throttleTime(40000)).attach(async () => {
+            await Promise.resolve();
+            const now = Date.now();
+            for (const [dpopProofId, timeSeen] of timeSeenByDpopProofId) {
+                if (now - timeSeen > 40000) {
+                    timeSeenByDpopProofId.delete(dpopProofId);
+                }
+                else {
+                    // NOTE: All entries added after are more recent.
+                    break;
+                }
+            }
+        });
+        function getIsDpopPoofSeenRecordIfNotSeen(params) {
+            const { jkt, jti } = params;
+            const dpopProofId = `${jkt}:${jti}`;
+            if (timeSeenByDpopProofId.has(dpopProofId)) {
+                return true;
+            }
+            {
+                timeSeenByDpopProofId.set(dpopProofId, Date.now());
+                if (timeSeenByDpopProofId.size > 50000) {
+                    const firstEntry = timeSeenByDpopProofId[Symbol.iterator]().next().value;
+                    assert(firstEntry !== undefined);
+                    const [key] = firstEntry;
+                    timeSeenByDpopProofId.delete(key);
+                }
+                evtDpopProofAdded.post();
+            }
+            return false;
+        }
+        return { getIsDpopPoofSeenRecordIfNotSeen };
+    })();
+    const validateAndDecodeAccessToken = async ({ request }) => {
+        const paramsOfBootstrap = await dParamsOfBootstrap.pr;
+        if (paramsOfBootstrap.implementation === "mock" &&
+            paramsOfBootstrap.behavior === "use static identity") {
+            return id({
+                isSuccess: true,
+                decodedAccessToken: paramsOfBootstrap.decodedAccessToken_mock,
+                get accessToken() {
+                    if (paramsOfBootstrap.accessToken_mock === undefined) {
+                        throw new Error([
+                            "oidc-spa: No mock provided for accessToken.",
+                            "Provide accessToken_mock to bootstrapAuth"
+                        ].join(" "));
+                    }
+                    return paramsOfBootstrap.accessToken_mock;
+                },
+                get decodedAccessToken_original() {
+                    if (paramsOfBootstrap.decodedAccessToken_original_mock === undefined) {
+                        throw new Error([
+                            "oidc-spa: No mock provided for decodedAccessToken_original.",
+                            "Provide decodedAccessToken_original_mock to bootstrapAuth"
+                        ].join(" "));
+                    }
+                    return paramsOfBootstrap.decodedAccessToken_original_mock;
+                }
+            });
+        }
+        if (!request.headers.Authorization) {
+            return id({
+                isSuccess: false,
+                errorCause: "missing Authorization header",
+                debugErrorMessage: "The request is anonymous, no Authorization header"
+            });
+        }
+        const match = request.headers.Authorization.trim().match(/^((?:Bearer)|(?:DPoP))\s+(.+)$/i);
+        if (match === null) {
+            return id({
+                isSuccess: false,
+                errorCause: "validation error",
+                debugErrorMessage: "Malformed Authorization header"
+            });
+        }
+        const [, scheme, accessToken] = match;
+        if (!isAmong(["Bearer", "DPoP"], scheme)) {
+            return id({
+                isSuccess: false,
+                errorCause: "validation error",
+                debugErrorMessage: `Unsupported scheme ${scheme}, expected Bearer or DPoP`
+            });
+        }
+        let decodedAccessToken_original;
+        validation: {
+            if (paramsOfBootstrap.implementation === "mock") {
+                assert;
+                decodedAccessToken_original = decodeJwt(accessToken);
+                try {
+                    zDecodedAccessToken_RFC9068.parse(decodedAccessToken_original);
+                }
+                catch (error) {
+                    assert(error instanceof Error, "38292332");
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: [
+                            `The decoded access token does not satisfies`,
+                            `the shape mandated by RFC9068: ${error.message}`
+                        ].join(" ")
+                    });
+                }
+                assert(is(decodedAccessToken_original));
+                break validation;
+            }
+            let kid;
+            let alg;
+            {
+                let header;
+                try {
+                    header = decodeProtectedHeader(accessToken);
+                }
+                catch {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "Failed to decode the JWT header"
+                    });
+                }
+                const { kid: kidFromHeader, alg: algFromHeader } = header;
+                if (typeof kidFromHeader !== "string" || kidFromHeader.length === 0) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "The decoded JWT header does not have a kid property"
+                    });
+                }
+                if (typeof algFromHeader !== "string") {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "The decoded JWT header does not specify an algorithm"
+                    });
+                }
+                if (!isAmong([
+                    "RS256",
+                    "RS384",
+                    "RS512",
+                    "ES256",
+                    "ES384",
+                    "ES512",
+                    "PS256",
+                    "PS384",
+                    "PS512"
+                ], algFromHeader)) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: `Unsupported or too weak algorithm ${algFromHeader}`
+                    });
+                }
+                kid = kidFromHeader;
+                alg = algFromHeader;
+            }
+            const publicSigningKeys = evtPublicSigningKeys.state;
+            assert(publicSigningKeys !== undefined);
+            if (!publicSigningKeys.kidSet.has(kid)) {
+                return id({
+                    isSuccess: false,
+                    errorCause: "validation error",
+                    debugErrorMessage: `No public signing key found with kid ${kid}`
+                });
+            }
+            try {
+                const verification = await jwtVerify(accessToken, publicSigningKeys.keyResolver, {
+                    algorithms: [alg]
+                });
+                decodedAccessToken_original = verification.payload;
+            }
+            catch (error) {
+                assert(error instanceof Error, "3922843");
+                if (error instanceof errors.JWTExpired) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error - access token expired",
+                        debugErrorMessage: error.message
+                    });
+                }
+                evtInvalidSignature.post();
+                return id({
+                    isSuccess: false,
+                    errorCause: "validation error - invalid signature",
+                    debugErrorMessage: error.message
+                });
+            }
+            try {
+                zDecodedAccessToken_RFC9068.parse(decodedAccessToken_original);
+            }
+            catch (error) {
+                assert(error instanceof Error, "382923");
+                return id({
+                    isSuccess: false,
+                    errorCause: "validation error",
+                    debugErrorMessage: [
+                        `The decoded access token does not satisfies`,
+                        `the shape mandated by RFC9068: ${error.message}`
+                    ].join(" ")
+                });
+            }
+            assert(is(decodedAccessToken_original));
+            // Validate issuer
+            {
+                const { issuerUri } = paramsOfBootstrap;
+                const normalize = (url) => url.replace(/\/$/, "");
+                if (normalize(decodedAccessToken_original.iss) !== normalize(issuerUri)) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: [
+                            `iss claim in access token payload "${decodedAccessToken_original.iss}"`,
+                            `does not match the issuerUri "${issuerUri}".`
+                        ].join(" ")
+                    });
+                }
+            }
+            validate_audience: {
+                const { expectedAudience } = paramsOfBootstrap;
+                if (expectedAudience === undefined) {
+                    break validate_audience;
+                }
+                const audiences = decodedAccessToken_original.aud instanceof Array
+                    ? decodedAccessToken_original.aud
+                    : [decodedAccessToken_original.aud];
+                if (!audiences.includes(expectedAudience)) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: [
+                            `Not expected audience, got aud claim ${JSON.stringify(decodedAccessToken_original.aud)}`,
+                            `but expected "${expectedAudience}".`
+                        ].join(" ")
+                    });
+                }
+            }
+            validate_DPoP: {
+                const cnf_jkt = decodedAccessToken_original.cnf === undefined
+                    ? undefined
+                    : decodedAccessToken_original.cnf.jkt;
+                if (cnf_jkt !== undefined && typeof cnf_jkt !== "string") {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "cnf.jkt claim is expected to be a string"
+                    });
+                }
+                if (scheme === "Bearer") {
+                    if (cnf_jkt !== undefined) {
+                        return id({
+                            isSuccess: false,
+                            errorCause: "validation error",
+                            debugErrorMessage: [
+                                "access token is DPoP bound (cnf.jkt claim present)",
+                                "but used with bearer scheme"
+                            ].join(" ")
+                        });
+                    }
+                    break validate_DPoP;
+                }
+                assert;
+                if (cnf_jkt === undefined) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: [
+                            "DPoP validation error, missing cnf.jtk claim",
+                            "in the access token payload"
+                        ].join(" ")
+                    });
+                }
+                if (!request.headers.DPoP) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "Scheme DPoP was specified but the DPoP header is missing"
+                    });
+                }
+                const dpopHeaderValue = request.headers.DPoP.trim();
+                let dpopHeader;
+                try {
+                    dpopHeader = decodeProtectedHeader(dpopHeaderValue);
+                }
+                catch {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "Failed to decode DPoP proof header"
+                    });
+                }
+                const { jwk, alg: dpopAlg, typ: dpopTyp } = dpopHeader;
+                if (dpopAlg === undefined) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof header missing alg"
+                    });
+                }
+                if (!isAmong([
+                    "RS256",
+                    "RS384",
+                    "RS512",
+                    "ES256",
+                    "ES384",
+                    "ES512",
+                    "PS256",
+                    "PS384",
+                    "PS512"
+                ], dpopAlg)) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: `Unsupported or too weak DPoP algorithm ${dpopAlg}`
+                    });
+                }
+                if (dpopTyp === undefined || dpopTyp.toLowerCase() !== "dpop+jwt") {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof header typ must be dpop+jwt"
+                    });
+                }
+                if (jwk === undefined) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof header missing jwk"
+                    });
+                }
+                let jkt_calculated;
+                try {
+                    jkt_calculated = await calculateJwkThumbprint(jwk);
+                }
+                catch (error) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: `Failed to calculate DPoP jwk thumbprint: ${String(error)}`
+                    });
+                }
+                if (jkt_calculated !== cnf_jkt) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP jwk thumbprint does not match cnf.jkt claim"
+                    });
+                }
+                let dpopPayload;
+                try {
+                    const key = await importJWK(jwk, dpopAlg);
+                    const verification = await jwtVerify(dpopHeaderValue, key, {
+                        algorithms: [dpopAlg],
+                        typ: "dpop+jwt"
+                    });
+                    dpopPayload = verification.payload;
+                }
+                catch (error) {
+                    assert(error instanceof Error);
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: `DPoP proof signature/structure invalid: ${error.message}`
+                    });
+                }
+                const { htm, htu, ath, iat, jti } = dpopPayload;
+                {
+                    if (iat === undefined) {
+                        return id({
+                            isSuccess: false,
+                            errorCause: "validation error",
+                            debugErrorMessage: "DPoP proof missing or invalid iat claim"
+                        });
+                    }
+                    const now = Math.floor(Date.now() / 1000);
+                    const maxAgeSeconds = 40;
+                    const maxFutureSkewSeconds = 3;
+                    if (iat - now > maxFutureSkewSeconds) {
+                        return id({
+                            isSuccess: false,
+                            errorCause: "validation error",
+                            debugErrorMessage: "DPoP proof iat is in the future"
+                        });
+                    }
+                    if (now - iat > maxAgeSeconds) {
+                        return id({
+                            isSuccess: false,
+                            errorCause: "validation error",
+                            debugErrorMessage: "DPoP proof iat too old"
+                        });
+                    }
+                }
+                if (typeof htm !== "string" || htm.toUpperCase() !== request.method.toUpperCase()) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof htm claim does not match request method"
+                    });
+                }
+                const expectedHtu = (() => {
+                    try {
+                        const url = new URL(request.url);
+                        return `${url.origin}${url.pathname}`;
+                    }
+                    catch {
+                        return undefined;
+                    }
+                })();
+                if (expectedHtu === undefined || typeof htu !== "string" || htu !== expectedHtu) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof htu claim does not match request url"
+                    });
+                }
+                if (typeof ath !== "string") {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof missing ath claim"
+                    });
+                }
+                const expectedAth = createHash("sha256").update(accessToken).digest("base64url");
+                if (ath !== expectedAth) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof ath claim does not match access token"
+                    });
+                }
+                if (jti === undefined) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof missing jti claim"
+                    });
+                }
+                if (getIsDpopPoofSeenRecordIfNotSeen({ jkt: cnf_jkt, jti })) {
+                    return id({
+                        isSuccess: false,
+                        errorCause: "validation error",
+                        debugErrorMessage: "DPoP proof replayed"
+                    });
+                }
+            }
+        }
+        let decodedAccessToken;
+        if (decodedAccessTokenSchema === undefined) {
+            // @ts-expect-error: We know it will match because DecodedAccessToken will default to DecodedAccessToken_RFC9068
+            decodedAccessToken = decodedAccessToken_original;
+        }
+        else {
+            try {
+                decodedAccessToken = decodedAccessTokenSchema.parse(decodedAccessToken_original);
+            }
+            catch (error) {
+                assert(error instanceof Error);
+                return id({
+                    isSuccess: false,
+                    errorCause: "validation error",
+                    debugErrorMessage: [
+                        `The decoded access token does not satisfies`,
+                        `the shape that the application expects: ${error.message}`
+                    ].join(" ")
+                });
+            }
+        }
+        return id({
+            isSuccess: true,
+            decodedAccessToken,
+            decodedAccessToken_original,
+            accessToken
+        });
+    };
+    return {
+        bootstrapAuth,
+        validateAndDecodeAccessToken,
+        ofTypeDecodedAccessToken: Reflect()
+    };
+}
+async function fetchPublicSigningKeys(params) {
+    const { issuerUri } = params;
+    const { jwks_uri } = await (async () => {
+        const url = `${issuerUri.replace(/\/$/, "")}/.well-known/openid-configuration`;
+        const response = await fetch(url);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch openid configuration of the issuerUri: ${issuerUri} (${url}): ${response.statusText}`);
+        }
+        let data;
+        try {
+            data = await response.json();
+        }
+        catch (error) {
+            throw new Error(`Failed to parse json from ${url}: ${String(error)}`);
+        }
+        {
+            const zWellKnownConfiguration = z.object({
+                jwks_uri: z.string()
+            });
+            assert();
+            try {
+                zWellKnownConfiguration.parse(data);
+            }
+            catch {
+                throw new Error(`${url} does not have a jwks_uri property`);
+            }
+            assert(is(data));
+        }
+        const { jwks_uri } = data;
+        return { jwks_uri };
+    })();
+    const { jwks } = await (async () => {
+        const response = await fetch(jwks_uri);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch public key and algorithm from ${jwks_uri}: ${response.statusText}`);
+        }
+        let jwks;
+        try {
+            jwks = await response.json();
+        }
+        catch (error) {
+            throw new Error(`Failed to parse json from ${jwks_uri}: ${String(error)}`);
+        }
+        {
+            const zJwks = z.object({
+                keys: z.array(z.object({
+                    kid: z.string(),
+                    kty: z.string(),
+                    use: z.string().optional(),
+                    alg: z.string().optional()
+                }))
+            });
+            assert();
+            try {
+                zJwks.parse(jwks);
+            }
+            catch {
+                throw new Error(`${jwks_uri} does not have the expected shape`);
+            }
+            assert(is(jwks));
+        }
+        return { jwks };
+    })();
+    //const signatureKeys = jwks.keys.filter((key): key is JWKS["keys"][number] & { kid: string } => {
+    const signatureKeys = jwks.keys.filter(key => {
+        if (typeof key.kid !== "string" || key.kid.length === 0) {
+            return false;
+        }
+        if (key.use !== undefined && key.use !== "sig") {
+            return false;
+        }
+        const supportedKty = ["RSA", "EC"];
+        if (!supportedKty.includes(key.kty)) {
+            return false;
+        }
+        return true;
+    });
+    assert(signatureKeys.length !== 0, `No public signing key found at ${jwks_uri}, ${JSON.stringify(jwks, null, 2)}`);
+    const kidSet = new Set(signatureKeys.map(({ kid }) => kid));
+    const keyResolver = createLocalJWKSet({
+        keys: signatureKeys
+    });
+    return {
+        keyResolver,
+        kidSet
+    };
+}
+const zDecodedAccessToken_RFC9068 = (() => {
+    const zTargetType = z
+        .object({
+        iss: z.string(),
+        sub: z.string(),
+        aud: z.union([z.string(), z.array(z.string())]),
+        exp: z.number(),
+        iat: z.number(),
+        client_id: z.string().optional(),
+        scope: z.string().optional(),
+        jti: z.string().optional(),
+        nbf: z.number().optional(),
+        auth_time: z.number().optional(),
+        cnf: z.record(z.string(), z.unknown()).optional()
+    })
+        .catchall(z.unknown());
+    assert;
+    return id(zTargetType);
+})();
+//# sourceMappingURL=createOidcSpaUtils.mjs.map

package/esm/server/createOidcSpaUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOidcSpaUtils.mjs","sourceRoot":"","sources":["../../src/server/createOidcSpaUtils.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EACH,qBAAqB,EACrB,SAAS,EACT,iBAAiB,EACjB,MAAM,EACN,SAAS,EACT,sBAAsB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAe,EAAE,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,CAAC,EAAE,MAAM,sBAAsB,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAAqD,MAEtF;IACG,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,CAAC;IAE5C,MAAM,kBAAkB,GAAG,IAAI,QAAQ,EAAyC,CAAC;IAEjF,MAAM,oBAAoB,GAAG,GAAG,CAAC,MAAM,CAAgC,SAAS,CAAC,CAAC;IAElF,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,EAAQ,CAAC;IAE/C,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,OAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QAC/D,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,UAAU,MAAM,CACtD,KAAa;YAEb,MAAM,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,EAAE,CAAC;YAEtD,MAAM,CAAC,iBAAiB,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC;YAEpD,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC;YAExC,IAAI,IAAmC,CAAC;YAExC,IAAI,CAAC;gBACD,IAAI,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CACR,4DAA4D,KAAK,GAAG,CAAC,WAAW,CACnF,CAAC;oBAEF,OAAO,SAAS,CAAC;gBACrB,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAE1C,OAAO,CAAC,IAAI,CACR,uDAAuD,MAAM,CACzD,KAAK,CACR,iBAAiB,OAAO,IAAI,CAChC,CAAC;gBAEF,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAE3D,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEN,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO;QACX,CAAC;QAED,oBAAoB,CAAC,KAAK,GAAG,qBAAqB,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,wBAAwB,GAA8B,SAAS,CAAC;IAIpE,MAAM,aAAa,GAAyB,iBAAiB,CAAC,EAAE;QAC5D,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,wBAAwB,CAAC;QACpC,CAAC;QAED,OAAO,CAAC,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3C,kBAAkB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAE9C,IAAI,iBAAiB,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;gBAC9C,oBAAoB,CAAC,KAAK,GAAG,MAAM,sBAAsB,CAAC;oBACtD,SAAS,EAAE,iBAAiB,CAAC,SAAS;iBACzC,CAAC,CAAC;YACP,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,MAAM,EAAE,gCAAgC,EAAE,GAAG,CAAC,GAAG,EAAE;QAC/C,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAExD,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAQ,CAAC;QAE7C,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,KAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC3D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,KAAK,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC;gBAC1D,IAAI,GAAG,GAAG,QAAQ,GAAG,KAAM,EAAE,CAAC;oBAC1B,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACJ,iDAAiD;oBACjD,MAAM;gBACV,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,SAAS,gCAAgC,CAAC,MAAoC;YAC1E,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;YAC5B,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAEpC,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,CAAC;gBACG,qBAAqB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAEnD,IAAI,qBAAqB,CAAC,IAAI,GAAG,KAAM,EAAE,CAAC;oBACtC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;oBAEzE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;oBAEjC,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;oBAEzB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;gBAED,iBAAiB,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAED,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAChD,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,4BAA4B,GAAwC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC5F,MAAM,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,EAAE,CAAC;QAEtD,IACI,iBAAiB,CAAC,cAAc,KAAK,MAAM;YAC3C,iBAAiB,CAAC,QAAQ,KAAK,qBAAqB,EACtD,CAAC;YACC,OAAO,EAAE,CAAsE;gBAC3E,SAAS,EAAE,IAAI;gBACf,kBAAkB,EAAE,iBAAiB,CAAC,uBAAuB;gBAC7D,IAAI,WAAW;oBACX,IAAI,iBAAiB,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;wBACnD,MAAM,IAAI,KAAK,CACX;4BACI,6CAA6C;4BAC7C,2CAA2C;yBAC9C,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;oBACN,CAAC;oBAED,OAAO,iBAAiB,CAAC,gBAAgB,CAAC;gBAC9C,CAAC;gBACD,IAAI,2BAA2B;oBAC3B,IAAI,iBAAiB,CAAC,gCAAgC,KAAK,SAAS,EAAE,CAAC;wBACnE,MAAM,IAAI,KAAK,CACX;4BACI,6DAA6D;4BAC7D,2DAA2D;yBAC9D,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;oBACN,CAAC;oBAED,OAAO,iBAAiB,CAAC,gCAAgC,CAAC;gBAC9D,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACjC,OAAO,EAAE,CAAkD;gBACvD,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,8BAA8B;gBAC1C,iBAAiB,EAAE,mDAAmD;aACzE,CAAC,CAAC;QACP,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAE5F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,CAAkD;gBACvD,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,kBAAkB;gBAC9B,iBAAiB,EAAE,gCAAgC;aACtD,CAAC,CAAC;QACP,CAAC;QAED,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,CAAkD;gBACvD,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,kBAAkB;gBAC9B,iBAAiB,EAAE,sBAAsB,MAAM,2BAA2B;aAC7E,CAAC,CAAC;QACP,CAAC;QAED,IAAI,2BAAoC,CAAC;QAEzC,UAAU,EAAE,CAAC;YACT,IAAI,iBAAiB,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;gBAC9C,MAAgE,CAAC;gBAEjE,2BAA2B,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;gBAErD,IAAI,CAAC;oBACD,2BAA2B,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACnE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,YAAY,KAAK,EAAE,UAAU,CAAC,CAAC;oBAE3C,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE;4BACf,6CAA6C;4BAC7C,kCAAkC,KAAK,CAAC,OAAO,EAAE;yBACpD,CAAC,IAAI,CAAC,GAAG,CAAC;qBACd,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,CAAC,EAAE,CAA6B,2BAA2B,CAAC,CAAC,CAAC;gBAEpE,MAAM,UAAU,CAAC;YACrB,CAAC;YAED,IAAI,GAAW,CAAC;YAChB,IAAI,GAAW,CAAC;YAEhB,CAAC;gBACG,IAAI,MAAgD,CAAC;gBAErD,IAAI,CAAC;oBACD,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACL,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,iCAAiC;qBACvD,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;gBAE1D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClE,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,qDAAqD;qBAC3E,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACpC,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,sDAAsD;qBAC5E,CAAC,CAAC;gBACP,CAAC;gBAED,IACI,CAAC,OAAO,CACJ;oBACI,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;iBACV,EACD,aAAa,CAChB,EACH,CAAC;oBACC,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,qCAAqC,aAAa,EAAE;qBAC1E,CAAC,CAAC;gBACP,CAAC;gBAED,GAAG,GAAG,aAAa,CAAC;gBACpB,GAAG,GAAG,aAAa,CAAC;YACxB,CAAC;YAED,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,CAAC;YAErD,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC;YAExC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE,CAAkD;oBACvD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,kBAAkB;oBAC9B,iBAAiB,EAAE,wCAAwC,GAAG,EAAE;iBACnE,CAAC,CAAC;YACP,CAAC;YAED,IAAI,CAAC;gBACD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,WAAW,EAAE;oBAC7E,UAAU,EAAE,CAAC,GAAG,CAAC;iBACpB,CAAC,CAAC;gBAEH,2BAA2B,GAAG,YAAY,CAAC,OAAO,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,YAAY,KAAK,EAAE,SAAS,CAAC,CAAC;gBAE1C,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;oBACrC,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,yCAAyC;wBACrD,iBAAiB,EAAE,KAAK,CAAC,OAAO;qBACnC,CAAC,CAAC;gBACP,CAAC;gBAED,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAE3B,OAAO,EAAE,CAAkD;oBACvD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,sCAAsC;oBAClD,iBAAiB,EAAE,KAAK,CAAC,OAAO;iBACnC,CAAC,CAAC;YACP,CAAC;YAED,IAAI,CAAC;gBACD,2BAA2B,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,YAAY,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAEzC,OAAO,EAAE,CAAkD;oBACvD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,kBAAkB;oBAC9B,iBAAiB,EAAE;wBACf,6CAA6C;wBAC7C,kCAAkC,KAAK,CAAC,OAAO,EAAE;qBACpD,CAAC,IAAI,CAAC,GAAG,CAAC;iBACd,CAAC,CAAC;YACP,CAAC;YAED,MAAM,CAAC,EAAE,CAA6B,2BAA2B,CAAC,CAAC,CAAC;YAEpE,kBAAkB;YAClB,CAAC;gBACG,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC;gBAExC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAE1D,IAAI,SAAS,CAAC,2BAA2B,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtE,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE;4BACf,sCAAsC,2BAA2B,CAAC,GAAG,GAAG;4BACxE,iCAAiC,SAAS,IAAI;yBACjD,CAAC,IAAI,CAAC,GAAG,CAAC;qBACd,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,iBAAiB,EAAE,CAAC;gBAChB,MAAM,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,CAAC;gBAE/C,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,iBAAiB,CAAC;gBAC5B,CAAC;gBAED,MAAM,SAAS,GACX,2BAA2B,CAAC,GAAG,YAAY,KAAK;oBAC5C,CAAC,CAAC,2BAA2B,CAAC,GAAG;oBACjC,CAAC,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;gBAE5C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACxC,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE;4BACf,wCAAwC,IAAI,CAAC,SAAS,CAClD,2BAA2B,CAAC,GAAG,CAClC,EAAE;4BACH,iBAAiB,gBAAgB,IAAI;yBACxC,CAAC,IAAI,CAAC,GAAG,CAAC;qBACd,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,aAAa,EAAE,CAAC;gBACZ,MAAM,OAAO,GACT,2BAA2B,CAAC,GAAG,KAAK,SAAS;oBACzC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC;gBAE9C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACvD,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,0CAA0C;qBAChE,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACtB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBACxB,OAAO,EAAE,CAAkD;4BACvD,SAAS,EAAE,KAAK;4BAChB,UAAU,EAAE,kBAAkB;4BAC9B,iBAAiB,EAAE;gCACf,oDAAoD;gCACpD,6BAA6B;6BAChC,CAAC,IAAI,CAAC,GAAG,CAAC;yBACd,CAAC,CAAC;oBACP,CAAC;oBAED,MAAM,aAAa,CAAC;gBACxB,CAAC;gBACD,MAAqC,CAAC;gBAEtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE;4BACf,8CAA8C;4BAC9C,6BAA6B;yBAChC,CAAC,IAAI,CAAC,GAAG,CAAC;qBACd,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACxB,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,0DAA0D;qBAChF,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAEpD,IAAI,UAAoD,CAAC;gBAEzD,IAAI,CAAC;oBACD,UAAU,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACL,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,oCAAoC;qBAC1D,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;gBAEvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,+BAA+B;qBACrD,CAAC,CAAC;gBACP,CAAC;gBAED,IACI,CAAC,OAAO,CACJ;oBACI,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;iBACV,EACD,OAAO,CACV,EACH,CAAC;oBACC,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,0CAA0C,OAAO,EAAE;qBACzE,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;oBAChE,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,wCAAwC;qBAC9D,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACpB,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,+BAA+B;qBACrD,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,cAAsB,CAAC;gBAE3B,IAAI,CAAC;oBACD,cAAc,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACvD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE;qBACjF,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;oBAC7B,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,kDAAkD;qBACxE,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,WAA6D,CAAC;gBAElE,IAAI,CAAC;oBACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC1C,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE;wBACvD,UAAU,EAAE,CAAC,OAAO,CAAC;wBACrB,GAAG,EAAE,UAAU;qBAClB,CAAC,CAAC;oBACH,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC;gBACvC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC;oBAE/B,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,2CAA2C,KAAK,CAAC,OAAO,EAAE;qBAChF,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC;gBAEhD,CAAC;oBACG,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACpB,OAAO,EAAE,CAAkD;4BACvD,SAAS,EAAE,KAAK;4BAChB,UAAU,EAAE,kBAAkB;4BAC9B,iBAAiB,EAAE,yCAAyC;yBAC/D,CAAC,CAAC;oBACP,CAAC;oBAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;oBAC1C,MAAM,aAAa,GAAG,EAAE,CAAC;oBACzB,MAAM,oBAAoB,GAAG,CAAC,CAAC;oBAE/B,IAAI,GAAG,GAAG,GAAG,GAAG,oBAAoB,EAAE,CAAC;wBACnC,OAAO,EAAE,CAAkD;4BACvD,SAAS,EAAE,KAAK;4BAChB,UAAU,EAAE,kBAAkB;4BAC9B,iBAAiB,EAAE,iCAAiC;yBACvD,CAAC,CAAC;oBACP,CAAC;oBAED,IAAI,GAAG,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;wBAC5B,OAAO,EAAE,CAAkD;4BACvD,SAAS,EAAE,KAAK;4BAChB,UAAU,EAAE,kBAAkB;4BAC9B,iBAAiB,EAAE,wBAAwB;yBAC9C,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC;gBAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;oBAChF,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,oDAAoD;qBAC1E,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;oBACtB,IAAI,CAAC;wBACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBACjC,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACL,OAAO,SAAS,CAAC;oBACrB,CAAC;gBACL,CAAC,CAAC,EAAE,CAAC;gBAEL,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBAC9E,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,iDAAiD;qBACvE,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,8BAA8B;qBACpD,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAEjF,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBACtB,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,kDAAkD;qBACxE,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACpB,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,8BAA8B;qBACpD,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;oBAC1D,OAAO,EAAE,CAAkD;wBACvD,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,kBAAkB;wBAC9B,iBAAiB,EAAE,qBAAqB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QAED,IAAI,kBAAsC,CAAC;QAE3C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzC,gHAAgH;YAChH,kBAAkB,GAAG,2BAA2B,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC;gBACD,kBAAkB,GAAG,wBAAwB,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACrF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC;gBAE/B,OAAO,EAAE,CAAkD;oBACvD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,kBAAkB;oBAC9B,iBAAiB,EAAE;wBACf,6CAA6C;wBAC7C,2CAA2C,KAAK,CAAC,OAAO,EAAE;qBAC7D,CAAC,IAAI,CAAC,GAAG,CAAC;iBACd,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAsE;YAC3E,SAAS,EAAE,IAAI;YACf,kBAAkB;YAClB,2BAA2B;YAC3B,WAAW;SACd,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,OAAO;QACH,aAAa;QACb,4BAA4B;QAC5B,wBAAwB,EAAE,OAAO,EAAsB;KAC1D,CAAC;AACN,CAAC;AAOD,KAAK,UAAU,sBAAsB,CAAC,MAA6B;IAC/D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;QAE/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACX,0DAA0D,SAAS,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CACzG,CAAC;QACN,CAAC;QAED,IAAI,IAAa,CAAC;QAElB,IAAI,CAAC;YACD,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,CAAC;YAKG,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;gBACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;aACvB,CAAC,CAAC;YAEH,MAAM,EAA2E,CAAC;YAElF,IAAI,CAAC;gBACD,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,oCAAoC,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,CAAC,EAAE,CAAyB,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAE1B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACxB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACX,iDAAiD,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;QACN,CAAC;QAED,IAAI,IAAa,CAAC;QAElB,IAAI,CAAC;YACD,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,CAAC;YAUG,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CACT,CAAC,CAAC,MAAM,CAAC;oBACL,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;oBACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;oBACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;iBAC7B,CAAC,CACL;aACJ,CAAC,CAAC;YAEH,MAAM,EAAuC,CAAC;YAE9C,IAAI,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,mCAAmC,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,EAAE,CAAO,IAAI,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC,EAAE,CAAC;IAEL,kGAAkG;IAClG,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACzC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,IAAI,CAAU,CAAC;QAE5C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAoC,CAAC,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,CACF,aAAa,CAAC,MAAM,KAAK,CAAC,EAC1B,kCAAkC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACjF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,MAAM,WAAW,GAAG,iBAAiB,CAAC;QAClC,IAAI,EAAE,aAAa;KACtB,CAAC,CAAC;IAEH,OAAO;QACH,WAAW;QACX,MAAM;KACT,CAAC;AACN,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE;IAGtC,MAAM,WAAW,GAAG,CAAC;SAChB,MAAM,CAAC;QACJ,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAI3B,MAAwC,CAAC;IAEzC,OAAO,EAAE,CAAwB,WAAW,CAAC,CAAC;AAClD,CAAC,CAAC,EAAE,CAAC"}

package/esm/server/index.d.ts

@@ -0,0 +1,2 @@
+export type * from "./types";
+export declare const oidcSpa: import("./utilsBuilder").OidcSpaUtilsBuilder<import("./types").DecodedAccessToken_RFC9068, never>;