samlesa 3.4.3 → 3.5.0

package/build/src/entity-sp.js

@@ -4,12 +4,11 @@
  * @desc  Declares the actions taken by service provider
  */
 import Entity from './entity.js';
-import Artifact from './binding-artifact.js';
+import artifactBinding from './binding-artifact.js';
 import { namespace } from './urn.js';
 import redirectBinding from './binding-redirect.js';
 import postBinding from './binding-post.js';
 import simpleSignBinding from './binding-simplesign.js';
-import artifactSignBinding from './binding-artifact.js';
 import { flow } from './flow.js';
 /*
  * @desc interface function
@@ -19,8 +18,7 @@ export default function (props) {
 }
 /**
  * @desc Service provider can be configured using either metadata importing or spSetting
- * @param  {object} spSettingimport { FlowResult } from '../types/src/flow.d';
-
+ * @param  {object} spSetting
  */
 export class ServiceProvider extends Entity {
     /**
@@ -61,8 +59,13 @@ export class ServiceProvider extends Entity {
                 // Object context = {id, context, signature, sigAlg}
                 context = simpleSignBinding.base64LoginRequest({ idp, sp: this }, customTagReplacement);
                 break;
+            case nsBinding.artifact:
+                context = artifactBinding.soapLoginRequest("/*[local-name(.)='AuthnRequest']", {
+                    idp,
+                    sp: this
+                }, customTagReplacement);
+                break;
             default:
-                // Will support artifact in the next release
                 throw new Error('ERR_SP_LOGIN_REQUEST_UNDEFINED_BINDING');
         }
         return {
@@ -73,13 +76,7 @@ export class ServiceProvider extends Entity {
         };
     }
     async createLoginSoapRequest(idp, binding = 'artifact', config) {
-        const nsBinding = namespace.binding;
-        const protocol = nsBinding[binding];
-        if (this.entityMeta.isAuthnRequestSigned() !== idp.entityMeta.isWantAuthnRequestsSigned()) {
-            throw new Error('ERR_METADATA_CONFLICT_REQUEST_SIGNED_FLAG');
-        }
-        let context = null;
-        context = await artifactSignBinding.soapLoginRequest("/*[local-name(.)='AuthnRequest']", {
+        const context = await artifactBinding.soapLoginRequest("/*[local-name(.)='AuthnRequest']", {
             idp,
             sp: this,
             inResponse: config?.inResponseTo,
@@ -106,22 +103,27 @@ export class ServiceProvider extends Entity {
         });
     }
     /**
-     * @desc   request SamlResponse by Arc id
+     * @desc   Parse and validate Artifact Resolve request
      * @param  {IdentityProvider}   idp             object of identity provider
-     * @param  {string}   binding                   protocol binding
-     * @param  {request}   req                      request
+     * @param  {string}   xml                       SOAP request XML string
      */
     parseLoginRequestResolve(idp, xml) {
         const self = this;
-        return Artifact.parseLoginRequestResolve({
+        return artifactBinding.parseLoginRequestResolve({
             idp: idp,
             sp: self,
             xml: xml
         });
     }
+    /**
+     * @desc   Resolve SAML Response by Artifact ID
+     * @param  {IdentityProvider}   idp             object of identity provider
+     * @param  {string}   art                       Artifact string
+     * @param  {request}   req                      request
+     */
     parseLoginResponseResolve(idp, art, request) {
         const self = this;
-        return Artifact.parseLoginResponseResolve({
+        return artifactBinding.parseLoginResponseResolve({
             idp: idp,
             sp: self,
             art: art

package/build/src/flow.js

@@ -225,7 +225,7 @@ async function postFlow(options) {
     if (parserType === 'SAMLResponse'
         && extractedProperties.conditions
         && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_CONDITION_SESSION');
+        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
     }
     // invalid subjectConfirmation time
     // invalid time
@@ -416,13 +416,6 @@ async function postArtifactFlow(options) {
     //There is no validation of the response here. The upper-layer application
     // should verify the result by itself to see if the destination is equal to the SP acs and
     // whether the response.id is used to prevent replay attacks.
-    let destination = extractedProperties?.response?.destination;
-    let isExit = self?.entityMeta?.meta?.assertionConsumerService?.filter((item) => {
-        return item?.location === destination;
-    });
-    if (isExit?.length === 0) {
-        return Promise.reject('ERR_Destination_URL');
-    }
     if (parserType === 'SAMLResponse') {
         let destination = extractedProperties?.response?.destination;
         let isExit = self?.entityMeta?.meta?.assertionConsumerService?.filter((item) => {

package/build/src/schemaValidator.js

@@ -43,13 +43,11 @@ const metadataSchemas = [
  */
 function detectXXEIndicators(samlString) {
     const xxePatterns = [
-        /<!DOCTYPE\s[^>]*>/i,
-        /<!ENTITY\s+[^\s>]+\s+(?:SYSTEM|PUBLIC)\s+['"][^>]*>/i,
-        /&[a-zA-Z0-9._-]+;/g,
-        /SYSTEM\s*=/i,
-        /PUBLIC\s*=/i,
-        /file:\/\//,
-        /\.dtd['"]?/
+        /<!DOCTYPE\s[^>]*>/i, // DOCTYPE 声明
+        /<!ENTITY\s+[^\s>]+\s+(?:SYSTEM|PUBLIC)\s+['"][^>]*>/i, // 外部实体声明
+        /SYSTEM\s*['"]\s*file:\/\//i, // file:// 协议的系统引用
+        /SYSTEM\s*['"]\s*\.\.\/.*\.dtd['"]?/i, // 相对路径的 DTD 引用
+        /PUBLIC\s*['"][^'"]*['"]\s*['"][^'"]*\.dtd['"]?/i // 公共 DTD 引用
     ];
     const matches = {};
     xxePatterns.forEach((pattern, index) => {

package/build/src/urn.js

@@ -189,22 +189,31 @@ const messageConfigurations = {
 const algorithms = {
     // 1. 签名算法定义 (SignatureMethod)
     signature: {
-        // ❌ 原文错误修正：ECDSA 不能用 rsa-sha256 的 URI
-        ECDSA_SHA256: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha256',
-        ECDSA_SHA384: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha384',
-        ECDSA_SHA512: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha512',
-        DSA_SHA1: 'http://www.w3.org/2000/09/xmldsig#dsa-sha1',
-        RSA_SHA1: 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
+        // ❌ 不安全的算法（已废弃）
+        RSA_SHA1: 'http://www.w3.org/2000/09/xmldsig#rsa-sha1', // ⚠️ 已废弃，不推荐使用
+        DSA_SHA1: 'http://www.w3.org/2000/09/xmldsig#dsa-sha1', // ⚠️ 已废弃，不推荐使用
+        // ✅ 安全的 RSA 算法（推荐）
         RSA_SHA224: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224',
-        RSA_SHA256: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256', // 推荐
+        RSA_SHA256: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256', // ⭐ 推荐
         RSA_SHA384: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384',
         RSA_SHA512: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512',
-        // XML Signature 1.1 PSS 填充 (更安全)
+        // ✅ ECDSA 算法（推荐）
+        ECDSA_SHA256: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha256', // ⭐ 推荐
+        ECDSA_SHA384: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha384',
+        ECDSA_SHA512: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha512',
+        // ✅ XML Signature 1.1 PSS 填充（更安全）
         RSA_PSS_SHA256: 'http://www.w3.org/2007/05/xmldsig-more#rsa-pss-sha256',
-        // EdDSA (Ed25519)
-        EDDSA_ED25519: 'http://www.w3.org/2007/05/xmldsig-more#eddsa-ed25519',
+        // ✅ EdDSA (Ed25519/Ed448)
+        EDDSA_ED25519: 'http://www.w3.org/2007/05/xmldsig-more#eddsa-ed25519', // ⭐ 推荐
         EDDSA_ED488: 'http://www.w3.org/2021/04/xmldsig-more#eddsa-ed448'
     },
+    // 不安全的算法列表（用于验证和阻止）
+    unsafeAlgorithms: [
+        'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
+        'http://www.w3.org/2000/09/xmldsig#dsa-sha1',
+        'http://www.w3.org/2000/09/xmldsig#hmac-sha1',
+        'http://www.w3.org/2000/09/xmldsig#sha1',
+    ],
     // 2. 摘要算法定义 (DigestMethod)
     // 注意：这里直接使用标准推荐的 URI，SHA-2xx 系列推荐使用 xmlenc 命名空间
     digest: {
@@ -322,4 +331,77 @@ const elementsOrder = {
     onelogin: ['KeyDescriptor', 'NameIDFormat', 'ArtifactResolutionService', 'SingleLogoutService', 'AssertionConsumerService', 'AttributeConsumingService'],
     shibboleth: ['KeyDescriptor', 'ArtifactResolutionService', 'SingleLogoutService', 'NameIDFormat', 'AssertionConsumerService', 'AttributeConsumingService',],
 };
-export { namespace, tags, algorithms, wording, elementsOrder, messageConfigurations, getBindingName };
+/**
+ * 默认安全配置
+ */
+const defaultSecurityOptions = {
+    allowSHA1: false,
+    allowRSA15: false,
+    allowTripleDES: false,
+};
+/**
+ * 当前安全配置
+ */
+let currentSecurityOptions = { ...defaultSecurityOptions };
+/**
+ * 设置安全配置
+ * @param options 安全配置选项
+ */
+function setSecurityOptions(options) {
+    currentSecurityOptions = { ...currentSecurityOptions, ...options };
+}
+/**
+ * 获取当前安全配置
+ * @returns 安全配置对象
+ */
+function getSecurityOptions() {
+    return currentSecurityOptions;
+}
+/**
+ * 重置为默认安全配置
+ */
+function resetSecurityOptions() {
+    currentSecurityOptions = { ...defaultSecurityOptions };
+}
+/**
+ * 验证算法是否安全
+ * @param algorithm 算法 URI
+ * @returns 验证结果
+ */
+function validateAlgorithm(algorithm) {
+    // 检查 SHA-1
+    if (!currentSecurityOptions.allowSHA1 && algorithm.toLowerCase().includes('sha1')) {
+        return {
+            valid: false,
+            reason: 'SHA-1 algorithm is not allowed. Use SHA-256 or stronger.'
+        };
+    }
+    // 检查 RSA-1_5
+    if (!currentSecurityOptions.allowRSA15 && algorithm.includes('rsa-1_5')) {
+        return {
+            valid: false,
+            reason: 'RSA-1_5 key encryption is not allowed. Use RSA-OAEP instead.'
+        };
+    }
+    // 检查 TripleDES
+    if (!currentSecurityOptions.allowTripleDES && algorithm.includes('tripledes')) {
+        return {
+            valid: false,
+            reason: 'TripleDES encryption is not allowed. Use AES-GCM instead.'
+        };
+    }
+    return { valid: true };
+}
+/**
+ * 检查算法是否为不安全算法
+ * @param algorithm 算法 URI
+ * @returns 检查结果
+ */
+function checkUnsafeAlgorithm(algorithm) {
+    const isUnsafe = algorithms.unsafeAlgorithms.some(unsafeAlg => algorithm.toLowerCase().includes(unsafeAlg.toLowerCase().replace('http://www.w3.org/2000/09/xmldsig#', '').replace('#', ''))) || algorithm.toLowerCase().includes('sha1');
+    return {
+        isUnsafe,
+        algorithm: isUnsafe ? algorithm : undefined
+    };
+}
+export { namespace, tags, algorithms, wording, elementsOrder, messageConfigurations, getBindingName, defaultSecurityOptions, setSecurityOptions, getSecurityOptions, resetSecurityOptions, validateAlgorithm, checkUnsafeAlgorithm };

package/build/src/utility.js

@@ -312,6 +312,75 @@ export function castArrayOpt(a) {
 export function notEmpty(value) {
     return value !== null && value !== undefined;
 }
+/**
+ * @desc 验证 RelayState 是否符合 SAML 2.0 规范
+ * @param {string} relayState - RelayState 值
+ * @returns {{ valid: boolean; error?: string }} 验证结果
+ */
+export function validateRelayState(relayState) {
+    // RelayState 是可选的
+    if (!relayState || relayState.length === 0) {
+        return { valid: true };
+    }
+    // 验证长度（SAML 规范限制 80 字节）
+    if (relayState.length > 80) {
+        return {
+            valid: false,
+            error: 'RelayState exceeds 80 bytes'
+        };
+    }
+    // 验证是否为合法 URL（如果是 URL）
+    if (relayState.startsWith('http://') || relayState.startsWith('https://')) {
+        try {
+            new URL(relayState);
+        }
+        catch {
+            return {
+                valid: false,
+                error: 'RelayState is not a valid URL'
+            };
+        }
+    }
+    return { valid: true };
+}
+/**
+ * @desc 敏感信息键名列表（用于日志脱敏）
+ */
+const sensitiveKeys = [
+    'privateKey',
+    'privateKeyPass',
+    'encPrivateKey',
+    'encPrivateKeyPass',
+    'password',
+    'secret',
+    'signingCert',
+    'encryptCert'
+];
+/**
+ * @desc 日志脱敏函数，过滤敏感信息
+ * @param {any} data - 需要脱敏的数据
+ * @returns {any} 脱敏后的数据
+ */
+export function sanitizeLog(data) {
+    if (typeof data !== 'object' || data === null) {
+        return data;
+    }
+    const sanitized = Array.isArray(data) ? [] : {};
+    for (const [key, value] of Object.entries(data)) {
+        // 检查是否为敏感键名
+        if (sensitiveKeys.some(k => k.toLowerCase() === key.toLowerCase())) {
+            sanitized[key] = '***REDACTED***';
+        }
+        else if (typeof value === 'object' && value !== null) {
+            // 递归处理嵌套对象
+            sanitized[key] = sanitizeLog(value);
+        }
+        else {
+            sanitized[key] = value;
+        }
+    }
+    return sanitized;
+}
 const utility = {
     isString,
     base64Encode,
@@ -327,5 +396,7 @@ const utility = {
     readPrivateKey,
     convertToString,
     isNonEmptyArray,
+    validateRelayState,
+    sanitizeLog,
 };
 export default utility;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "samlesa",
-  "version": "3.4.3",
+  "version": "3.5.0",
   "description": "High-level API for Single Sign On (SAML 2.0) baseed on samlify ",
   "main": "build/index.js",
   "keywords": [
@@ -12,14 +12,23 @@
   ],
   "type": "module",
   "typings": "types/index.d.ts",
+  "homepage": "https://saml.veclea.com",
   "scripts": {
     "build": "tsc && copyfiles -u 1 src/schema/**/* build/src",
-    "docs": "docsify serve -o docs",
+    "build:fast": "tsc",
+    "build:clean": "tsc --build --clean && pnpm run build",
+    "docs:dev": "cd docs && npm run docs:dev",
+    "docs:build": "cd docs && npm run docs:build",
+    "docs:preview": "cd docs && npm run docs:preview",
+    "docs:deploy": "vercel --prod",
     "lint": "tslint -p .",
     "lint:fix": "tslint -p . --fix",
-    "test": "vitest",
-    "test:watch": "vitest --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:fast": "vitest run --pool=forks",
+    "test:artifact": "vitest run test/artifact.test.ts",
+    "generate-certs": "node scripts/generate-certs.js",
     "hooks:postinstall": "mklink /J .git\\hooks\\pre-commit .pre-commit.sh || copy .pre-commit.sh .git\\hooks\\pre-commit"
   },
   "exports": {
@@ -40,6 +49,10 @@
     "url": "https://github.com/Veclea/samlify.git",
     "type": "git"
   },
+  "bugs": {
+    "url": "https://github.com/Veclea/samlify/issues"
+  },
+  "docs": "https://saml.veclea.com",
   "license": "MIT",
   "dependencies": {
     "@xmldom/xmldom": "^0.9.8",

package/types/src/binding-artifact.d.ts

@@ -1,35 +1,71 @@
+/**
+ * @file binding-artifact.ts
+ * @author tngan
+ * @desc Binding-level API for SAML 2.0 Artifact Binding
+ * @see https://docs.oasis-open.org/security/saml/v2.0/saml-bind-2.0-os.pdf
+ */
 import type { BindingContext } from './entity.js';
 import { IdentityProviderConstructor as IdentityProvider, ServiceProviderConstructor as ServiceProvider } from "./types.js";
 import { Base64LoginResponseParams } from "./types.js";
 /**
- * @desc Generate a base64 encoded login request
- * @param  {string} referenceTagXPath           reference uri
- * @param  {object} entity                      object includes both idp and sp
- * @param customTagReplacement
+ * Generate a SAML 2.0 compliant Artifact ID
+ * Format: [TypeCode: 2 bytes] + [EndpointIndex: 2 bytes] + [SourceID: 20 bytes] + [MessageHandle: 20 bytes]
+ * @param issuerId The entity ID of the issuing party (IdP)
+ * @param endpointIndex The index of the destination endpoint (default is 1 for Artifact Resolution Service)
+ * @returns The Base64 encoded Artifact ID string
+ */
+export declare function generateArtifactId(issuerId: string, endpointIndex?: number): string;
+/**
+ * @desc Generate a SOAP-encoded login request for Artifact binding
+ * @param {string} referenceTagXPath           reference uri
+ * @param {object} entity                      object includes both idp and sp
+ * @param {function} customTagReplacement     used when developers have their own login request template
+ * @returns {BindingContext}
+ */
+declare function soapLoginRequest(referenceTagXPath: string, entity: {
+    idp: IdentityProvider;
+    sp: ServiceProvider;
+    inResponse?: string;
+    relayState?: string;
+}, customTagReplacement?: (template: string) => BindingContext): BindingContext;
+/**
+ * @desc Generate a SOAP-encoded login response for Artifact binding
+ * @param {Base64LoginResponseParams} params  parameters for generating login response
+ * @returns {BindingContext}
  */
-declare function soapLoginRequest(referenceTagXPath: string, entity: any, customTagReplacement?: (template: string) => BindingContext): any;
 declare function soapLoginResponse(params: Base64LoginResponseParams): Promise<BindingContext>;
+/**
+ * @desc Parse and validate Artifact Resolve request
+ * @param {object} params
+ * @param {IdentityProvider} params.idp Identity Provider instance
+ * @param {ServiceProvider} params.sp Service Provider instance
+ * @param {string} params.xml SOAP request XML string
+ * @returns {Promise}
+ */
 declare function parseLoginRequestResolve(params: {
     idp: IdentityProvider;
     sp: ServiceProvider;
     xml: string;
-}): Promise<{
-    samlContent: any;
-    extract: any;
-}>;
+}): Promise<any>;
+/**
+ * @desc Parse and validate Artifact Resolve response
+ * @param {object} params
+ * @param {IdentityProvider} params.idp Identity Provider instance
+ * @param {ServiceProvider} params.sp Service Provider instance
+ * @param {string} params.art Artifact string
+ * @returns {Promise}
+ */
 declare function parseLoginResponseResolve(params: {
     idp: IdentityProvider;
     sp: ServiceProvider;
     art: string;
-}): Promise<{
-    samlContent: string;
-    extract: any;
-}>;
-declare const artifactSignBinding: {
-    parseLoginRequestResolve: typeof parseLoginRequestResolve;
+}): Promise<any>;
+declare const artifactBinding: {
     soapLoginRequest: typeof soapLoginRequest;
-    parseLoginResponseResolve: typeof parseLoginResponseResolve;
     soapLoginResponse: typeof soapLoginResponse;
+    parseLoginRequestResolve: typeof parseLoginRequestResolve;
+    parseLoginResponseResolve: typeof parseLoginResponseResolve;
+    generateArtifactId: typeof generateArtifactId;
 };
-export default artifactSignBinding;
+export default artifactBinding;
 //# sourceMappingURL=binding-artifact.d.ts.map

package/types/src/binding-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding-artifact.d.ts","sourceRoot":"","sources":["../../src/binding-artifact.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAShD,OAAO,EACH,2BAA2B,IAAI,gBAAgB,EAC/C,0BAA0B,IAAI,eAAe,EAChD,MAAM,YAAY,CAAC;AAiBpB,OAAO,EAAC,yBAAyB,EAAC,MAAM,YAAY,CAAC;AAwBrD;;;;;GAKG;AACH,iBAAS,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAAG,GAAG,CAkGlI;AAqCD,iBAAe,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0F3F;AAID,iBAAe,wBAAwB,CAAC,MAAM,EAAE;IAC5C,GAAG,EAAE,gBAAgB,CAAC;IACtB,EAAE,EAAE,eAAe,CAAC;IACpB,GAAG,EAAE,MAAM,CAAA;CACd;;;GAqDA;AAED,iBAAe,yBAAyB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,gBAAgB,CAAC;IAAC,EAAE,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;;;GAgP3G;AAED,QAAA,MAAM,mBAAmB;;;;;CAOxB,CAAC;AAEF,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"binding-artifact.d.ts","sourceRoot":"","sources":["../../src/binding-artifact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAOlD,OAAO,EACH,2BAA2B,IAAI,gBAAgB,EAC/C,0BAA0B,IAAI,eAAe,EAChD,MAAM,YAAY,CAAC;AAYpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AA0BvD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,GAAE,MAAU,GAAG,MAAM,CAoBtF;AAED;;;;;;GAMG;AACH,iBAAS,gBAAgB,CACrB,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE;IACJ,GAAG,EAAE,gBAAgB,CAAC;IACtB,EAAE,EAAE,eAAe,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,EACD,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAC5D,cAAc,CAsGhB;AAED;;;;GAIG;AACH,iBAAe,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuE3F;AAED;;;;;;;GAOG;AACH,iBAAe,wBAAwB,CAAC,MAAM,EAAE;IAC5C,GAAG,EAAE,gBAAgB,CAAC;IACtB,EAAE,EAAE,eAAe,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,GAAG,CAAC,CA6Cf;AAED;;;;;;;GAOG;AACH,iBAAe,yBAAyB,CAAC,MAAM,EAAE;IAC7C,GAAG,EAAE,gBAAgB,CAAC;IACtB,EAAE,EAAE,eAAe,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,GAAG,CAAC,CAyJf;AAED,QAAA,MAAM,eAAe;;;;;;CAMpB,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/types/src/entity-idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-idp.d.ts","sourceRoot":"","sources":["../../src/entity-idp.ts"],"names":[],"mappings":"AAYA,OAAO,MAAM,EAAE,EAAC,KAAK,gBAAgB,EAAC,MAAM,aAAa,CAAC;AAC1D,OAAO,EACH,0BAA0B,IAAI,eAAe,EAE7C,wBAAwB,EACxB,KAAK,wBAAwB,EAChC,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAO,KAAK,UAAU,EAAC,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAEhD;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,KAAK,EAAE,wBAAwB,oBAEvD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,MAAM;IAEhC,UAAU,EAAE,wBAAwB,CAAC;gBAEjC,UAAU,EAAE,wBAAwB;IAWhD;;;OAGG;IACU,mBAAmB,CAAC,MAAM,EAAE;QACrC,EAAE,EAAE,eAAe,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC;QAC5D,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,EAAE,KAAK,CAAC;KAEnB;IAiED;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB;CAYhF"}
+{"version":3,"file":"entity-idp.d.ts","sourceRoot":"","sources":["../../src/entity-idp.ts"],"names":[],"mappings":"AAYA,OAAO,MAAM,EAAE,EAAC,KAAK,gBAAgB,EAAC,MAAM,aAAa,CAAC;AAC1D,OAAO,EACH,0BAA0B,IAAI,eAAe,EAE7C,wBAAwB,EACxB,KAAK,wBAAwB,EAChC,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAO,KAAK,UAAU,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAEhD;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,KAAK,EAAE,wBAAwB,oBAEvD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,MAAM;IAEhC,UAAU,EAAE,wBAAwB,CAAC;gBAEjC,UAAU,EAAE,wBAAwB;IAWhD;;;OAGG;IACU,mBAAmB,CAAC,MAAM,EAAE;QACrC,EAAE,EAAE,eAAe,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC;QAC5D,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,EAAE,KAAK,CAAC;KACnB;IAiED;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB;CAYhF"}

package/types/src/entity-sp.d.ts

@@ -10,8 +10,7 @@ import { type FlowResult } from './flow.js';
 export default function (props: ServiceProviderSettings): ServiceProvider;
 /**
  * @desc Service provider can be configured using either metadata importing or spSetting
- * @param  {object} spSettingimport { FlowResult } from '../types/src/flow.d';
-
+ * @param  {object} spSetting
  */
 export declare class ServiceProvider extends Entity {
     entityMeta: ServiceProviderMetadata;
@@ -27,11 +26,11 @@ export declare class ServiceProvider extends Entity {
      * @param  {function} customTagReplacement     used when developers have their own login response template
      */
     createLoginRequest(idp: IdentityProvider, binding?: string, customTagReplacement?: (template: string) => BindingContext): BindingContext | PostBindingContext | SimpleSignBindingContext;
-    createLoginSoapRequest(idp: IdentityProvider, binding: string | undefined, config: {
+    createLoginSoapRequest(idp: IdentityProvider, binding?: string, config?: {
         customTagReplacement?: (template: string) => BindingContext;
         inResponseTo?: string;
         relayState?: string;
-    }): Promise<any>;
+    }): Promise<BindingContext>;
     /**
      * @desc   Validation of the parsed the URL parameters
      * @param  {IdentityProvider}   idp             object of identity provider
@@ -40,18 +39,17 @@ export declare class ServiceProvider extends Entity {
      */
     parseLoginResponse(idp: any, binding: any, request: ESamlHttpRequest): Promise<FlowResult>;
     /**
-     * @desc   request SamlResponse by Arc id
+     * @desc   Parse and validate Artifact Resolve request
      * @param  {IdentityProvider}   idp             object of identity provider
-     * @param  {string}   binding                   protocol binding
+     * @param  {string}   xml                       SOAP request XML string
+     */
+    parseLoginRequestResolve(idp: IdentityProvider, xml: string): Promise<any>;
+    /**
+     * @desc   Resolve SAML Response by Artifact ID
+     * @param  {IdentityProvider}   idp             object of identity provider
+     * @param  {string}   art                       Artifact string
      * @param  {request}   req                      request
      */
-    parseLoginRequestResolve(idp: any, xml: any): Promise<{
-        samlContent: any;
-        extract: any;
-    }>;
-    parseLoginResponseResolve(idp: IdentityProvider, art: string, request: ESamlHttpRequest): Promise<{
-        samlContent: string;
-        extract: any;
-    }>;
+    parseLoginResponseResolve(idp: IdentityProvider, art: string, request: ESamlHttpRequest): Promise<any>;
 }
 //# sourceMappingURL=entity-sp.d.ts.map

package/types/src/entity-sp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-sp.d.ts","sourceRoot":"","sources":["../../src/entity-sp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,MAAU,MAAM,aAAa,CAAC;AAGrC,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,IAAI,gBAAgB,EAC/C,uBAAuB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAO,KAAK,UAAU,EAAC,MAAM,WAAW,CAAC;AAKhD,MAAM,CAAC,OAAO,WAAW,KAAK,EAAE,uBAAuB,mBAEtD;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,MAAM;IACjC,UAAU,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;gBACS,SAAS,EAAE,uBAAuB;IAS9C;;;;;OAKG;IACI,kBAAkB,CACrB,GAAG,EAAE,gBAAgB,EACrB,OAAO,SAAa,EACpB,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAC5D,cAAc,GAAG,kBAAkB,GAAG,wBAAwB;IAkCpD,sBAAsB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,OAAO,oBAAa,EACpB,MAAM,EAAC;QACL,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC;QAC5D,YAAY,CAAC,EAAC,MAAM,CAAC;QACrB,UAAU,CAAC,EAAC,MAAM,CAAC;KACpB,GACH,OAAO,CAAC,GAAG,CAAC;IAsBd;;;;;OAKG;IACI,kBAAkB,CAAC,GAAG,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,EAAE,gBAAgB;IAcjE;;;;;OAKG;IACI,wBAAwB,CAAC,GAAG,KAAA,EAAC,GAAG,KAAA;;;;IAQhC,yBAAyB,CAAC,GAAG,EAAC,gBAAgB,EAAE,GAAG,EAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB;;;;CAS7F"}
+{"version":3,"file":"entity-sp.d.ts","sourceRoot":"","sources":["../../src/entity-sp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,IAAI,gBAAgB,EAC/C,uBAAuB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAO,KAAK,UAAU,EAAC,MAAM,WAAW,CAAC;AAKhD,MAAM,CAAC,OAAO,WAAW,KAAK,EAAE,uBAAuB,mBAEtD;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,MAAM;IACjC,UAAU,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;gBACS,SAAS,EAAE,uBAAuB;IAS9C;;;;;OAKG;IACI,kBAAkB,CACrB,GAAG,EAAE,gBAAgB,EACrB,OAAO,SAAa,EACpB,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAC5D,cAAc,GAAG,kBAAkB,GAAG,wBAAwB;IAuCpD,sBAAsB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,OAAO,SAAa,EACpB,MAAM,CAAC,EAAE;QACP,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC;QAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACF,OAAO,CAAC,cAAc,CAAC;IAmB1B;;;;;OAKG;IACI,kBAAkB,CAAC,GAAG,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,EAAE,gBAAgB;IAajE;;;;OAIG;IACI,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM;IASlE;;;;;OAKG;IACI,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB;CAS/F"}

package/types/src/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/flow.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAqsBD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BhG;AAED,wBAAgB,IAAI,CAAC,OAAO,KAAA,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BjD"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/flow.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AA8rBD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BhG;AAED,wBAAgB,IAAI,CAAC,OAAO,KAAA,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BjD"}

package/types/src/schemaValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemaValidator.d.ts","sourceRoot":"","sources":["../../src/schemaValidator.ts"],"names":[],"mappings":"AAsFA;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAU,KAAK,MAAM,EAAE,SAAQ,OAAe,qBA4BlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAU,KAAK,MAAM,EAAE,UAAS,OAAe;;;EA+D3E,CAAC"}
+{"version":3,"file":"schemaValidator.d.ts","sourceRoot":"","sources":["../../src/schemaValidator.ts"],"names":[],"mappings":"AAoFA;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAU,KAAK,MAAM,EAAE,SAAQ,OAAe,qBA4BlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAU,KAAK,MAAM,EAAE,UAAS,OAAe;;;EA+D3E,CAAC"}

package/types/src/urn.d.ts

@@ -164,19 +164,20 @@ declare const messageConfigurations: {
 };
 declare const algorithms: {
     signature: {
-        ECDSA_SHA256: string;
-        ECDSA_SHA384: string;
-        ECDSA_SHA512: string;
-        DSA_SHA1: string;
         RSA_SHA1: string;
+        DSA_SHA1: string;
         RSA_SHA224: string;
         RSA_SHA256: string;
         RSA_SHA384: string;
         RSA_SHA512: string;
+        ECDSA_SHA256: string;
+        ECDSA_SHA384: string;
+        ECDSA_SHA512: string;
         RSA_PSS_SHA256: string;
         EDDSA_ED25519: string;
         EDDSA_ED488: string;
     };
+    unsafeAlgorithms: string[];
     digest: {
         SHA1: string;
         SHA224: string;
@@ -268,5 +269,52 @@ declare const elementsOrder: {
     onelogin: string[];
     shibboleth: string[];
 };
-export { namespace, tags, algorithms, wording, elementsOrder, messageConfigurations, getBindingName };
+/**
+ * 安全配置选项
+ */
+interface SecurityOptions {
+    /** 是否允许 SHA-1 算法（默认 false） */
+    allowSHA1: boolean;
+    /** 是否允许 RSA-1_5 密钥加密（默认 false） */
+    allowRSA15: boolean;
+    /** 是否允许 TripleDES 加密（默认 false） */
+    allowTripleDES: boolean;
+}
+/**
+ * 默认安全配置
+ */
+declare const defaultSecurityOptions: SecurityOptions;
+/**
+ * 设置安全配置
+ * @param options 安全配置选项
+ */
+declare function setSecurityOptions(options: Partial<SecurityOptions>): void;
+/**
+ * 获取当前安全配置
+ * @returns 安全配置对象
+ */
+declare function getSecurityOptions(): SecurityOptions;
+/**
+ * 重置为默认安全配置
+ */
+declare function resetSecurityOptions(): void;
+/**
+ * 验证算法是否安全
+ * @param algorithm 算法 URI
+ * @returns 验证结果
+ */
+declare function validateAlgorithm(algorithm: string): {
+    valid: boolean;
+    reason?: string;
+};
+/**
+ * 检查算法是否为不安全算法
+ * @param algorithm 算法 URI
+ * @returns 检查结果
+ */
+declare function checkUnsafeAlgorithm(algorithm: string): {
+    isUnsafe: boolean;
+    algorithm?: string;
+};
+export { namespace, tags, algorithms, wording, elementsOrder, messageConfigurations, getBindingName, SecurityOptions, defaultSecurityOptions, setSecurityOptions, getSecurityOptions, resetSecurityOptions, validateAlgorithm, checkUnsafeAlgorithm };
 //# sourceMappingURL=urn.d.ts.map

package/types/src/urn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urn.d.ts","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,gBAAgB;IAC1B,QAAQ,uDAAuD;IAC/D,IAAI,mDAAmD;IACvD,UAAU,8DAA8D;IACxE,QAAQ,uDAAuD;CAChE;AACD,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,CAK/F,CAAC;AAGD,iBAAS,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,CAEjG;AAED,oBAAY,qBAAqB;IAC/B,GAAG,sBAAsB;IACzB,GAAG,sBAAsB;CAC1B;AAED,oBAAY,UAAU;IAEpB,OAAO,+CAA+C;IACtD,SAAS,iDAAiD;IAC1D,SAAS,iDAAiD;IAC1D,eAAe,uDAAuD;IAEtE,UAAU,mDAAmD;IAC7D,sBAAsB,8DAA8D;IACpF,mBAAmB,2DAA2D;IAC9E,cAAc,sDAAsD;IACpE,cAAc,sDAAsD;IACpE,SAAS,iDAAiD;IAC1D,cAAc,sDAAsD;IACpE,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,wBAAwB,gEAAgE;IACxF,qBAAqB,6DAA6D;IAClF,oBAAoB,4DAA4D;IAChF,qBAAqB,6DAA6D;IAClF,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;IAC5E,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;CAC7E;AAED,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGd,CAAC;AAEF,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BT,CAAC;AAEF,QAAA,MAAM,qBAAqB;;;;;CAK1B,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAmFZ;;;WAGG;;;;;;;;;;;;;CAwBN,CAAC;AAaF,oBAAY,UAAU;IACpB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;CAClC;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;CAyBZ,CAAC;AAIF,QAAA,MAAM,aAAa;;;;CAIlB,CAAC;AAEF,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAC,cAAc,EAAC,CAAC"}
+{"version":3,"file":"urn.d.ts","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,gBAAgB;IAC1B,QAAQ,uDAAuD;IAC/D,IAAI,mDAAmD;IACvD,UAAU,8DAA8D;IACxE,QAAQ,uDAAuD;CAChE;AACD,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,CAK/F,CAAC;AAGD,iBAAS,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,CAEjG;AAED,oBAAY,qBAAqB;IAC/B,GAAG,sBAAsB;IACzB,GAAG,sBAAsB;CAC1B;AAED,oBAAY,UAAU;IAEpB,OAAO,+CAA+C;IACtD,SAAS,iDAAiD;IAC1D,SAAS,iDAAiD;IAC1D,eAAe,uDAAuD;IAEtE,UAAU,mDAAmD;IAC7D,sBAAsB,8DAA8D;IACpF,mBAAmB,2DAA2D;IAC9E,cAAc,sDAAsD;IACpE,cAAc,sDAAsD;IACpE,SAAS,iDAAiD;IAC1D,cAAc,sDAAsD;IACpE,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,wBAAwB,gEAAgE;IACxF,qBAAqB,6DAA6D;IAClF,oBAAoB,4DAA4D;IAChF,qBAAqB,6DAA6D;IAClF,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;IAC5E,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;CAC7E;AAED,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGd,CAAC;AAEF,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BT,CAAC;AAEF,QAAA,MAAM,qBAAqB;;;;;CAK1B,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6FZ;;;WAGG;;;;;;;;;;;;;CAwBN,CAAC;AAaF,oBAAY,UAAU;IACpB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;CAClC;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;CAyBZ,CAAC;AAIF,QAAA,MAAM,aAAa;;;;CAIlB,CAAC;AAEF;;GAEG;AACH,UAAU,eAAe;IACvB,8BAA8B;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,kCAAkC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,kCAAkC;IAClC,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,QAAA,MAAM,sBAAsB,EAAE,eAI7B,CAAC;AAOF;;;GAGG;AACH,iBAAS,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,QAE5D;AAED;;;GAGG;AACH,iBAAS,kBAAkB,IAAI,eAAe,CAE7C;AAED;;GAEG;AACH,iBAAS,oBAAoB,SAE5B;AAED;;;;GAIG;AACH,iBAAS,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BjF;AAED;;;;GAIG;AACH,iBAAS,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAS1F;AAED,OAAO,EACL,SAAS,EACT,IAAI,EACJ,UAAU,EACV,OAAO,EACP,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACrB,CAAC"}