samlify 2.11.0 → 2.13.0

package/build/src/metadata.js

@@ -34,19 +34,21 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
-* @file metadata.ts
-* @author tngan
-* @desc An abstraction for metadata of identity provider and service provider
-*/
+ * @file metadata.ts
+ * @author tngan
+ * @desc Abstraction for SAML entity metadata (IdP and SP share this base).
+ */
 var fs = __importStar(require("fs"));
 var urn_1 = require("./urn");
 var extractor_1 = require("./extractor");
 var utility_1 = require("./utility");
 var Metadata = /** @class */ (function () {
     /**
-    * @param  {string | Buffer} xml
-    * @param  {object} extraParse for custom metadata extractor
-    */
+     * Parse a SAML metadata XML document and hydrate a typed `meta` bag.
+     *
+     * @param xml raw metadata XML (string or Buffer)
+     * @param extraParse additional extractor fields merged into the standard set
+     */
     function Metadata(xml, extraParse) {
         if (extraParse === void 0) { extraParse = []; }
         this.xmlString = xml.toString();
@@ -55,18 +57,18 @@ var Metadata = /** @class */ (function () {
                 key: 'entityDescriptor',
                 localPath: ['EntityDescriptor'],
                 attributes: [],
-                context: true
+                context: true,
             },
             {
                 key: 'entityID',
                 localPath: ['EntityDescriptor'],
-                attributes: ['entityID']
+                attributes: ['entityID'],
             },
             {
                 // shared certificate for both encryption and signing
                 key: 'sharedCertificate',
                 localPath: ['EntityDescriptor', '~SSODescriptor', 'KeyDescriptor', 'KeyInfo', 'X509Data', 'X509Certificate'],
-                attributes: []
+                attributes: [],
             },
             {
                 // explicit certificate declaration for encryption and signing
@@ -74,25 +76,24 @@ var Metadata = /** @class */ (function () {
                 localPath: ['EntityDescriptor', '~SSODescriptor', 'KeyDescriptor'],
                 index: ['use'],
                 attributePath: ['KeyInfo', 'X509Data', 'X509Certificate'],
-                attributes: []
+                attributes: [],
             },
             {
                 key: 'singleLogoutService',
                 localPath: ['EntityDescriptor', '~SSODescriptor', 'SingleLogoutService'],
-                attributes: ['Binding', 'Location']
+                attributes: ['Binding', 'Location'],
             },
             {
                 key: 'nameIDFormat',
                 localPath: ['EntityDescriptor', '~SSODescriptor', 'NameIDFormat'],
                 attributes: [],
-            }
+            },
         ]));
-        // get shared certificate
         var sharedCertificate = this.meta.sharedCertificate;
         if (typeof sharedCertificate === 'string') {
             this.meta.certificate = {
                 signing: sharedCertificate,
-                encryption: sharedCertificate
+                encryption: sharedCertificate,
             };
             delete this.meta.sharedCertificate;
         }
@@ -102,46 +103,48 @@ var Metadata = /** @class */ (function () {
         }
     }
     /**
-    * @desc Get the metadata in xml format
-    * @return {string} metadata in xml format
-    */
+     * Return the underlying metadata XML.
+     */
     Metadata.prototype.getMetadata = function () {
         return this.xmlString;
     };
     /**
-    * @desc Export the metadata to specific file
-    * @param {string} exportFile is the output file path
-    */
+     * Write the metadata XML to disk at the given path.
+     *
+     * @param exportFile absolute file path
+     */
     Metadata.prototype.exportMetadata = function (exportFile) {
         fs.writeFileSync(exportFile, this.xmlString);
     };
     /**
-    * @desc Get the entityID in metadata
-    * @return {string} entityID
-    */
+     * Return the metadata `entityID`.
+     */
     Metadata.prototype.getEntityID = function () {
         return this.meta.entityID;
     };
     /**
-    * @desc Get the x509 certificate declared in entity metadata
-    * @param  {string} use declares the type of certificate
-    * @return {string} certificate in string format
-    */
+     * Return the X.509 certificate(s) declared in metadata for a given use.
+     *
+     * @param use `signing` or `encryption`
+     * @returns certificate body or list, or `null` when missing
+     */
     Metadata.prototype.getX509Certificate = function (use) {
-        return this.meta.certificate[use] || null;
+        var certificate = this.meta.certificate;
+        return (certificate && certificate[use]) || null;
     };
     /**
-    * @desc Get the support NameID format declared in entity metadata
-    * @return {array} support NameID format
-    */
+     * Return the supported NameID formats declared in metadata.
+     */
     Metadata.prototype.getNameIDFormat = function () {
         return this.meta.nameIDFormat;
     };
     /**
-    * @desc Get the entity endpoint for single logout service
-    * @param  {string} binding e.g. redirect, post
-    * @return {string/object} location
-    */
+     * Return the single-logout service endpoint for the requested binding.
+     * When no binding is provided, returns the raw service list.
+     *
+     * @param binding `redirect`, `post`, etc.
+     * @returns endpoint URL or raw service list
+     */
     Metadata.prototype.getSingleLogoutService = function (binding) {
         if (binding && (0, utility_1.isString)(binding)) {
             var bindType_1 = urn_1.namespace.binding[binding];
@@ -157,17 +160,18 @@ var Metadata = /** @class */ (function () {
         return this.meta.singleLogoutService;
     };
     /**
-    * @desc Get the support bindings
-    * @param  {[string]} services
-    * @return {[string]} support bindings
-    */
+     * Reduce a service descriptor array to the list of bindings it declares.
+     *
+     * @param services list of service descriptor objects
+     * @returns supported binding keys
+     */
     Metadata.prototype.getSupportBindings = function (services) {
         var supportBindings = [];
         if (services) {
-            supportBindings = services.reduce(function (acc, service) {
+            services.forEach(function (service) {
                 var supportBinding = Object.keys(service)[0];
-                return acc.push(supportBinding);
-            }, []);
+                supportBindings.push(supportBinding);
+            });
         }
         return supportBindings;
     };

package/build/src/metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/metadata.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;EAIE;AACF,qCAAyB;AACzB,6BAAkC;AAClC,yCAAsC;AACtC,qCAAqC;AAarC;IAKE;;;MAGE;IACF,kBAAY,GAAoB,EAAE,UAAoB;QAApB,2BAAA,EAAA,eAAoB;QACpD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC;YACpD;gBACE,GAAG,EAAE,kBAAkB;gBACvB,SAAS,EAAE,CAAC,kBAAkB,CAAC;gBAC/B,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI;aACd;YACD;gBACE,GAAG,EAAE,UAAU;gBACf,SAAS,EAAE,CAAC,kBAAkB,CAAC;gBAC/B,UAAU,EAAE,CAAC,UAAU,CAAC;aACzB;YACD;gBACE,qDAAqD;gBACrD,GAAG,EAAE,mBAAmB;gBACxB,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC;gBAC5G,UAAU,EAAE,EAAE;aACf;YACD;gBACE,8DAA8D;gBAC9D,GAAG,EAAE,aAAa;gBAClB,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,CAAC;gBAClE,KAAK,EAAE,CAAC,KAAK,CAAC;gBACd,aAAa,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC;gBACzD,UAAU,EAAE,EAAE;aACf;YACD;gBACE,GAAG,EAAE,qBAAqB;gBAC1B,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;gBACxE,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;aACpC;YACD;gBACE,GAAG,EAAE,cAAc;gBACnB,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,CAAC;gBACjE,UAAU,EAAE,EAAE;aACf;SACF,CAAC,CAAC,CAAC;QAEJ,yBAAyB;QACzB,IAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACtD,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG;gBACtB,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,iBAAiB;aAC9B,CAAC;YACF,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACrC,CAAC;QAED,IACE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IAEH,CAAC;IAED;;;MAGE;IACK,8BAAW,GAAlB;QACE,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;MAGE;IACK,iCAAc,GAArB,UAAsB,UAAkB;QACtC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED;;;MAGE;IACK,8BAAW,GAAlB;QACE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED;;;;MAIE;IACK,qCAAkB,GAAzB,UAA0B,GAAW;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED;;;MAGE;IACK,kCAAe,GAAtB;QACE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;IAChC,CAAC;IAED;;;;MAIE;IACK,yCAAsB,GAA7B,UAA8B,OAA2B;QACvD,IAAI,OAAO,IAAI,IAAA,kBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAM,UAAQ,GAAG,eAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACxD,IAAI,CAAC,CAAC,mBAAmB,YAAY,KAAK,CAAC,EAAE,CAAC;gBAC5C,mBAAmB,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC7C,CAAC;YACF,IAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAA,GAAG,IAAI,OAAA,GAAG,CAAC,OAAO,KAAK,UAAQ,EAAxB,CAAwB,CAAC,CAAC;YAC1E,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC,CAAC;IAED;;;;MAIE;IACK,qCAAkB,GAAzB,UAA0B,QAAkB;QAC1C,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,IAAI,QAAQ,EAAE,CAAC;YACb,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAC,GAAQ,EAAE,OAAO;gBAClD,IAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,CAAC,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACH,eAAC;AAAD,CAAC,AAhJD,IAgJC"}
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/metadata.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,qCAAyB;AACzB,6BAAkC;AAClC,yCAAsC;AACtC,qCAAqC;AA0BrC;IAKE;;;;;OAKG;IACH,kBAAY,GAAoB,EAAE,UAAgC;QAAhC,2BAAA,EAAA,eAAgC;QAChE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC;YACpD;gBACE,GAAG,EAAE,kBAAkB;gBACvB,SAAS,EAAE,CAAC,kBAAkB,CAAC;gBAC/B,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI;aACd;YACD;gBACE,GAAG,EAAE,UAAU;gBACf,SAAS,EAAE,CAAC,kBAAkB,CAAC;gBAC/B,UAAU,EAAE,CAAC,UAAU,CAAC;aACzB;YACD;gBACE,qDAAqD;gBACrD,GAAG,EAAE,mBAAmB;gBACxB,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC;gBAC5G,UAAU,EAAE,EAAE;aACf;YACD;gBACE,8DAA8D;gBAC9D,GAAG,EAAE,aAAa;gBAClB,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,CAAC;gBAClE,KAAK,EAAE,CAAC,KAAK,CAAC;gBACd,aAAa,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC;gBACzD,UAAU,EAAE,EAAE;aACf;YACD;gBACE,GAAG,EAAE,qBAAqB;gBAC1B,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;gBACxE,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;aACpC;YACD;gBACE,GAAG,EAAE,cAAc;gBACnB,SAAS,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,CAAC;gBACjE,UAAU,EAAE,EAAE;aACf;SACF,CAAC,CAAgB,CAAC;QAEnB,IAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACtD,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG;gBACtB,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,iBAAiB;aAC9B,CAAC;YACF,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACrC,CAAC;QAED,IACE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACI,8BAAW,GAAlB;QACE,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACI,iCAAc,GAArB,UAAsB,UAAkB;QACtC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACI,8BAAW,GAAlB;QACE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAkB,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACI,qCAAkB,GAAzB,UAA0B,GAAW;QACnC,IAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAA4D,CAAC;QAC3F,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAK,IAA0B,CAAC;IAC1E,CAAC;IAED;;OAEG;IACI,kCAAe,GAAtB;QACE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAwB,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACI,yCAAsB,GAA7B,UAA8B,OAA2B;QACvD,IAAI,OAAO,IAAI,IAAA,kBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAM,UAAQ,GAAG,eAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACxD,IAAI,CAAC,CAAC,mBAAmB,YAAY,KAAK,CAAC,EAAE,CAAC;gBAC5C,mBAAmB,GAAG,CAAC,mBAA4D,CAAC,CAAC;YACvF,CAAC;YACD,IAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAA,GAAG,IAAI,OAAA,GAAG,CAAC,OAAO,KAAK,UAAQ,EAAxB,CAAwB,CAAC,CAAC;YAC1E,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAwC,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACI,qCAAkB,GAAzB,UAA0B,QAAkB;QAC1C,IAAM,eAAe,GAAa,EAAE,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,CAAC,UAAA,OAAO;gBACtB,IAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/C,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACH,eAAC;AAAD,CAAC,AAnJD,IAmJC"}

package/build/src/options.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeCreateLoginRequestOptions = normalizeCreateLoginRequestOptions;
+exports.normalizeCreateLoginResponseOptions = normalizeCreateLoginResponseOptions;
+exports.normalizeCreateLogoutRequestOptions = normalizeCreateLogoutRequestOptions;
+exports.normalizeCreateLogoutResponseOptions = normalizeCreateLogoutResponseOptions;
+/**
+ * Resolve the 3rd-position parameter of `ServiceProvider#createLoginRequest`.
+ * Accepts a callback (legacy), an options bag, or undefined.
+ */
+function normalizeCreateLoginRequestOptions(input) {
+    if (input == null)
+        return {};
+    if (typeof input === 'function')
+        return { customTagReplacement: input };
+    return input;
+}
+/**
+ * Resolve the 5th-position parameter of `IdentityProvider#createLoginResponse`.
+ * Accepts a callback (legacy), an options bag, or undefined.
+ *
+ * Legacy positional `encryptThenSign` (6th) and `relayState` (7th) are
+ * folded into the bag when the 5th argument is the legacy callback form.
+ */
+function normalizeCreateLoginResponseOptions(optionsOrCallback, legacyEncryptThenSign, legacyRelayState) {
+    if (optionsOrCallback == null) {
+        return { encryptThenSign: legacyEncryptThenSign, relayState: legacyRelayState };
+    }
+    if (typeof optionsOrCallback === 'function') {
+        return {
+            customTagReplacement: optionsOrCallback,
+            encryptThenSign: legacyEncryptThenSign,
+            relayState: legacyRelayState,
+        };
+    }
+    return optionsOrCallback;
+}
+/**
+ * Resolve the 4th-position parameter of `Entity#createLogoutRequest`.
+ * Accepts a string (legacy `relayState`), an options bag, or undefined.
+ *
+ * Legacy positional `customTagReplacement` (5th) is folded into the bag
+ * when the 4th argument is the legacy string form.
+ */
+function normalizeCreateLogoutRequestOptions(optionsOrRelayState, legacyCustomTagReplacement) {
+    if (optionsOrRelayState == null) {
+        return { customTagReplacement: legacyCustomTagReplacement };
+    }
+    if (typeof optionsOrRelayState === 'string') {
+        return {
+            relayState: optionsOrRelayState,
+            customTagReplacement: legacyCustomTagReplacement,
+        };
+    }
+    return optionsOrRelayState;
+}
+/**
+ * Resolve the 4th-position parameter of `Entity#createLogoutResponse`.
+ * Same dispatch rules as {@link normalizeCreateLogoutRequestOptions}.
+ */
+function normalizeCreateLogoutResponseOptions(optionsOrRelayState, legacyCustomTagReplacement) {
+    if (optionsOrRelayState == null) {
+        return { customTagReplacement: legacyCustomTagReplacement };
+    }
+    if (typeof optionsOrRelayState === 'string') {
+        return {
+            relayState: optionsOrRelayState,
+            customTagReplacement: legacyCustomTagReplacement,
+        };
+    }
+    return optionsOrRelayState;
+}
+//# sourceMappingURL=options.js.map

package/build/src/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/options.ts"],"names":[],"mappings":";;AAsBA,gFAMC;AASD,kFAgBC;AASD,kFAcC;AAMD,oFAcC;AA9ED;;;GAGG;AACH,SAAgB,kCAAkC,CAChD,KAAmE;IAEnE,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mCAAmC,CACjD,iBAAgF,EAChF,qBAA+B,EAC/B,gBAAyB;IAEzB,IAAI,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO;YACL,oBAAoB,EAAE,iBAAiB;YACvC,eAAe,EAAE,qBAAqB;YACtC,UAAU,EAAE,gBAAgB;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mCAAmC,CACjD,mBAAoE,EACpE,0BAAiD;IAEjD,IAAI,mBAAmB,IAAI,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;YACL,UAAU,EAAE,mBAAmB;YAC/B,oBAAoB,EAAE,0BAA0B;SACjD,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAgB,oCAAoC,CAClD,mBAAqE,EACrE,0BAAiD;IAEjD,IAAI,mBAAmB,IAAI,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;YACL,UAAU,EAAE,mBAAmB;YAC/B,oBAAoB,EAAE,0BAA0B;SACjD,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}

package/build/src/urn.js

@@ -148,6 +148,12 @@ var algorithms = {
         RSA_SHA1: 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
         RSA_SHA256: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
         RSA_SHA512: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512',
+        // RSASSA-PSS with MGF1 — `xmldsig-core §6.4.2`, `xmldsig-more` (W3C
+        // Note, 2007-05). Recommended over PKCS#1 v1.5 for new deployments
+        // per `saml-sec-consider §6.5` and the audit follow-up F-7
+        // (`.skills/audits/2026-04-security-audit.md`). The default signing
+        // algorithm remains RSA-SHA256 (PKCS#1 v1.5); PSS is opt-in.
+        RSA_SHA256_MGF1: 'http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1',
     },
     encryption: {
         data: {
@@ -165,6 +171,9 @@ var algorithms = {
         'http://www.w3.org/2000/09/xmldsig#rsa-sha1': 'http://www.w3.org/2000/09/xmldsig#sha1',
         'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256': 'http://www.w3.org/2001/04/xmlenc#sha256',
         'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512': 'http://www.w3.org/2001/04/xmlenc#sha512', // support hashing algorithm sha512 in xml-crypto after 0.8.0
+        // PSS variant — `xmldsig-more` (2007-05) — pairs with the SHA-256
+        // digest URI per the OASIS-published mapping.
+        'http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1': 'http://www.w3.org/2001/04/xmlenc#sha256',
     },
 };
 exports.algorithms = algorithms;
@@ -202,11 +211,29 @@ var wording = {
 };
 exports.wording = wording;
 // https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP
-// some idps restrict the order of elements in entity descriptors
+// some idps restrict the order of elements in entity descriptors.
+//
+// Top-level keys (default / onelogin / shibboleth) describe SP-side
+// orderings and are kept at the root for backwards compatibility with
+// callers that read `Constants.elementsOrder.shibboleth` directly.
+//
+// IdP-side orderings live under the `idp` sub-key. The default sequence
+// matches `saml-metadata §2.4.3` (the schema-declared `<IDPSSODescriptor>`
+// child sequence) restricted to the elements samlify currently emits.
 var elementsOrder = {
     default: ['KeyDescriptor', 'NameIDFormat', 'SingleLogoutService', 'AssertionConsumerService'],
     onelogin: ['KeyDescriptor', 'NameIDFormat', 'SingleLogoutService', 'AssertionConsumerService'],
     shibboleth: ['KeyDescriptor', 'SingleLogoutService', 'NameIDFormat', 'AssertionConsumerService', 'AttributeConsumingService'],
+    idp: {
+        // Default mirrors the historical (pre-#429) emission order so callers
+        // that don't supply `elementsOrder` continue to receive byte-identical
+        // metadata XML. saml-metadata §2.4.3 permits this subset.
+        default: ['KeyDescriptor', 'NameIDFormat', 'SingleSignOnService', 'SingleLogoutService'],
+        // OneLogin-style: NameIDFormat ahead of the service endpoints.
+        onelogin: ['KeyDescriptor', 'NameIDFormat', 'SingleLogoutService', 'SingleSignOnService'],
+        // Shibboleth IdP convention puts SLO ahead of NameIDFormat.
+        shibboleth: ['KeyDescriptor', 'SingleLogoutService', 'NameIDFormat', 'SingleSignOnService'],
+    },
 };
 exports.elementsOrder = elementsOrder;
 //# sourceMappingURL=urn.js.map

package/build/src/urn.js.map

@@ -1 +1 @@
-{"version":3,"file":"urn.js","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":";AAAA;;;;EAIE;;;AAEF,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,mFAA+D,CAAA;IAC/D,2EAAuD,CAAA;IACvD,4FAAwE,CAAA;IACxE,mFAA+D,CAAA;AACjE,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAED,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;AAC3B,CAAC,EAHW,qBAAqB,qCAArB,qBAAqB,QAGhC;AAED,IAAY,UA0BX;AA1BD,WAAY,UAAU;IACpB,WAAW;IACX,oEAAsD,CAAA;IACtD,wEAA0D,CAAA;IAC1D,wEAA0D,CAAA;IAC1D,oFAAsE,CAAA;IACtE,0CAA0C;IAC1C,2EAA6D,CAAA;IAC7D,kGAAoF,CAAA;IACpF,4FAA8E,CAAA;IAC9E,kFAAoE,CAAA;IACpE,kFAAoE,CAAA;IACpE,wEAA0D,CAAA;IAC1D,kFAAoE,CAAA;IACpE,gFAAkE,CAAA;IAClE,0FAA4E,CAAA;IAC5E,gFAAkE,CAAA;IAClE,0FAA4E,CAAA;IAC5E,sGAAwF,CAAA;IACxF,gGAAkF,CAAA;IAClF,8FAAgF,CAAA;IAChF,gGAAkF,CAAA;IAClF,sFAAwE,CAAA;IACxE,0FAA4E,CAAA;IAC5E,sFAAwE,CAAA;IACxE,0FAA4E,CAAA;AAC9E,CAAC,EA1BW,UAAU,0BAAV,UAAU,QA0BrB;AAED,IAAM,SAAS,GAAG;IAChB,OAAO,EAAE;QACP,QAAQ,EAAE,oDAAoD;QAC9D,IAAI,EAAE,gDAAgD;QACtD,UAAU,EAAE,2DAA2D;QACvE,QAAQ,EAAE,oDAAoD;KAC/D;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,sCAAsC;QAChD,SAAS,EAAE,uCAAuC;QAClD,QAAQ,EAAE,sCAAsC;QAChD,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,0CAA0C;KACxD;IACD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,iDAAiD;QAC3D,0BAA0B,EAAE,mEAAmE;KAChG;IACD,MAAM,EAAE;QACN,YAAY,EAAE,wDAAwD;QACtE,UAAU,EAAE,sDAAsD;QAClE,SAAS,EAAE,qDAAqD;QAChE,MAAM,EAAE,kDAAkD;QAC1D,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,oDAAoD;QAC9D,0BAA0B,EAAE,sEAAsE;QAClG,eAAe,EAAE,2DAA2D;KAC7E;IACD,UAAU,EAAE;QACV,qCAAqC;QACrC,OAAO,EAAE,4CAA4C;QACrD,SAAS,EAAE,8CAA8C;QACzD,SAAS,EAAE,8CAA8C;QACzD,eAAe,EAAE,oDAAoD;QACrE,4BAA4B;QAC5B,UAAU,EAAE,gDAAgD;QAC5D,sBAAsB,EAAE,2DAA2D;QACnF,mBAAmB,EAAE,wDAAwD;QAC7E,cAAc,EAAE,mDAAmD;QACnE,cAAc,EAAE,mDAAmD;QACnE,SAAS,EAAE,8CAA8C;QACzD,cAAc,EAAE,mDAAmD;QACnE,aAAa,EAAE,kDAAkD;QACjE,kBAAkB,EAAE,uDAAuD;QAC3E,aAAa,EAAE,kDAAkD;QACjE,kBAAkB,EAAE,uDAAuD;QAC3E,wBAAwB,EAAE,6DAA6D;QACvF,qBAAqB,EAAE,0DAA0D;QACjF,oBAAoB,EAAE,yDAAyD;QAC/E,qBAAqB,EAAE,0DAA0D;QACjF,gBAAgB,EAAE,qDAAqD;QACvE,kBAAkB,EAAE,uDAAuD;QAC3E,gBAAgB,EAAE,qDAAqD;QACvE,kBAAkB,EAAE,uDAAuD;KAC5E;CACF,CAAC;AA4GO,8BAAS;AA1GlB,IAAM,IAAI,GAAG;IACX,OAAO,EAAE;QACP,WAAW,EAAE,eAAe;QAC5B,2BAA2B,EAAE,+BAA+B;QAC5D,oBAAoB,EAAE,wBAAwB;QAC9C,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,sBAAsB;QAC1C,mBAAmB,EAAE,uBAAuB;QAC5C,sBAAsB,EAAE,0BAA0B;QAClD,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,YAAY;QACtB,EAAE,EAAE,MAAM;QACV,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,gBAAgB;QAC9B,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,gBAAgB;QAC9B,eAAe,EAAE,mBAAmB;QACpC,YAAY,EAAE,gBAAgB;QAC9B,gBAAgB,EAAE,oBAAoB;QACtC,mCAAmC,EAAE,uCAAuC;QAC5E,UAAU,EAAE,cAAc;KAC3B;IACD,MAAM,EAAE;QACN,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,eAAe;QAC9B,aAAa,EAAE,UAAU;QACzB,cAAc,EAAE,gBAAgB;KACjC;CACF,CAAC;AA2EkB,oBAAI;AAzExB,IAAM,qBAAqB,GAAG;IAC5B,YAAY,EAAE;QACZ,iBAAiB,EAAE,mBAAmB;QACtC,iBAAiB,EAAE,mBAAmB;KACvC;CACF,CAAC;AAoE4D,sDAAqB;AAlEnF,IAAM,UAAU,GAAG;IACjB,SAAS,EAAE;QACT,QAAQ,EAAE,4CAA4C;QACtD,UAAU,EAAE,mDAAmD;QAC/D,UAAU,EAAE,mDAAmD;KAChE;IACD,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,OAAO,EAAE,6CAA6C;YACtD,OAAO,EAAE,6CAA6C;YACtD,OAAO,EAAE,gDAAgD;YACzD,WAAW,EAAE,4CAA4C;SAC1D;QACD,GAAG,EAAE;YACH,cAAc,EAAE,iDAAiD;YACjE,OAAO,EAAE,0CAA0C;SACpD;KACF;IACD,MAAM,EAAE;QACN,4CAA4C,EAAE,wCAAwC;QACtF,mDAAmD,EAAE,yCAAyC;QAC9F,mDAAmD,EAAE,yCAAyC,EAAE,6DAA6D;KAC9J;CACF,CAAC;AA2CwB,gCAAU;AAzCpC,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,yCAA2B,CAAA;IAC3B,2CAA6B,CAAA;IAC7B,6CAA+B,CAAA;IAC/B,+CAAiC,CAAA;AACnC,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAED,IAAM,OAAO,GAAG;IACd,SAAS,EAAE;QACT,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,eAAe;QAC9B,cAAc,EAAE,gBAAgB;QAChC,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,WAAW;QACtB,UAAU,EAAE,YAAY;KACzB;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,OAAO,EAAE;QACP,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,YAAY;KACtB;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,aAAa;QACjB,GAAG,EAAE,cAAc;KACpB;CACF,CAAC;AAUoC,0BAAO;AAR7C,uEAAuE;AACvE,iEAAiE;AACjE,IAAM,aAAa,GAAG;IACpB,OAAO,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,0BAA0B,CAAC;IAC7F,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,0BAA0B,CAAC;IAC9F,UAAU,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,0BAA0B,EAAE,2BAA2B,CAAC;CAC9H,CAAC;AAE6C,sCAAa"}
+{"version":3,"file":"urn.js","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":";AAAA;;;;EAIE;;;AAEF,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,mFAA+D,CAAA;IAC/D,2EAAuD,CAAA;IACvD,4FAAwE,CAAA;IACxE,mFAA+D,CAAA;AACjE,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAED,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;AAC3B,CAAC,EAHW,qBAAqB,qCAArB,qBAAqB,QAGhC;AAED,IAAY,UA0BX;AA1BD,WAAY,UAAU;IACpB,WAAW;IACX,oEAAsD,CAAA;IACtD,wEAA0D,CAAA;IAC1D,wEAA0D,CAAA;IAC1D,oFAAsE,CAAA;IACtE,0CAA0C;IAC1C,2EAA6D,CAAA;IAC7D,kGAAoF,CAAA;IACpF,4FAA8E,CAAA;IAC9E,kFAAoE,CAAA;IACpE,kFAAoE,CAAA;IACpE,wEAA0D,CAAA;IAC1D,kFAAoE,CAAA;IACpE,gFAAkE,CAAA;IAClE,0FAA4E,CAAA;IAC5E,gFAAkE,CAAA;IAClE,0FAA4E,CAAA;IAC5E,sGAAwF,CAAA;IACxF,gGAAkF,CAAA;IAClF,8FAAgF,CAAA;IAChF,gGAAkF,CAAA;IAClF,sFAAwE,CAAA;IACxE,0FAA4E,CAAA;IAC5E,sFAAwE,CAAA;IACxE,0FAA4E,CAAA;AAC9E,CAAC,EA1BW,UAAU,0BAAV,UAAU,QA0BrB;AAED,IAAM,SAAS,GAAG;IAChB,OAAO,EAAE;QACP,QAAQ,EAAE,oDAAoD;QAC9D,IAAI,EAAE,gDAAgD;QACtD,UAAU,EAAE,2DAA2D;QACvE,QAAQ,EAAE,oDAAoD;KAC/D;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,sCAAsC;QAChD,SAAS,EAAE,uCAAuC;QAClD,QAAQ,EAAE,sCAAsC;QAChD,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,0CAA0C;KACxD;IACD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,iDAAiD;QAC3D,0BAA0B,EAAE,mEAAmE;KAChG;IACD,MAAM,EAAE;QACN,YAAY,EAAE,wDAAwD;QACtE,UAAU,EAAE,sDAAsD;QAClE,SAAS,EAAE,qDAAqD;QAChE,MAAM,EAAE,kDAAkD;QAC1D,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,oDAAoD;QAC9D,0BAA0B,EAAE,sEAAsE;QAClG,eAAe,EAAE,2DAA2D;KAC7E;IACD,UAAU,EAAE;QACV,qCAAqC;QACrC,OAAO,EAAE,4CAA4C;QACrD,SAAS,EAAE,8CAA8C;QACzD,SAAS,EAAE,8CAA8C;QACzD,eAAe,EAAE,oDAAoD;QACrE,4BAA4B;QAC5B,UAAU,EAAE,gDAAgD;QAC5D,sBAAsB,EAAE,2DAA2D;QACnF,mBAAmB,EAAE,wDAAwD;QAC7E,cAAc,EAAE,mDAAmD;QACnE,cAAc,EAAE,mDAAmD;QACnE,SAAS,EAAE,8CAA8C;QACzD,cAAc,EAAE,mDAAmD;QACnE,aAAa,EAAE,kDAAkD;QACjE,kBAAkB,EAAE,uDAAuD;QAC3E,aAAa,EAAE,kDAAkD;QACjE,kBAAkB,EAAE,uDAAuD;QAC3E,wBAAwB,EAAE,6DAA6D;QACvF,qBAAqB,EAAE,0DAA0D;QACjF,oBAAoB,EAAE,yDAAyD;QAC/E,qBAAqB,EAAE,0DAA0D;QACjF,gBAAgB,EAAE,qDAAqD;QACvE,kBAAkB,EAAE,uDAAuD;QAC3E,gBAAgB,EAAE,qDAAqD;QACvE,kBAAkB,EAAE,uDAAuD;KAC5E;CACF,CAAC;AAuIO,8BAAS;AArIlB,IAAM,IAAI,GAAG;IACX,OAAO,EAAE;QACP,WAAW,EAAE,eAAe;QAC5B,2BAA2B,EAAE,+BAA+B;QAC5D,oBAAoB,EAAE,wBAAwB;QAC9C,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,sBAAsB;QAC1C,mBAAmB,EAAE,uBAAuB;QAC5C,sBAAsB,EAAE,0BAA0B;QAClD,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,YAAY;QACtB,EAAE,EAAE,MAAM;QACV,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,gBAAgB;QAC9B,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,gBAAgB;QAC9B,eAAe,EAAE,mBAAmB;QACpC,YAAY,EAAE,gBAAgB;QAC9B,gBAAgB,EAAE,oBAAoB;QACtC,mCAAmC,EAAE,uCAAuC;QAC5E,UAAU,EAAE,cAAc;KAC3B;IACD,MAAM,EAAE;QACN,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,eAAe;QAC9B,aAAa,EAAE,UAAU;QACzB,cAAc,EAAE,gBAAgB;KACjC;CACF,CAAC;AAsGkB,oBAAI;AApGxB,IAAM,qBAAqB,GAAG;IAC5B,YAAY,EAAE;QACZ,iBAAiB,EAAE,mBAAmB;QACtC,iBAAiB,EAAE,mBAAmB;KACvC;CACF,CAAC;AA+F4D,sDAAqB;AA7FnF,IAAM,UAAU,GAAG;IACjB,SAAS,EAAE;QACT,QAAQ,EAAE,4CAA4C;QACtD,UAAU,EAAE,mDAAmD;QAC/D,UAAU,EAAE,mDAAmD;QAC/D,oEAAoE;QACpE,mEAAmE;QACnE,2DAA2D;QAC3D,oEAAoE;QACpE,6DAA6D;QAC7D,eAAe,EAAE,wDAAwD;KAC1E;IACD,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,OAAO,EAAE,6CAA6C;YACtD,OAAO,EAAE,6CAA6C;YACtD,OAAO,EAAE,gDAAgD;YACzD,WAAW,EAAE,4CAA4C;SAC1D;QACD,GAAG,EAAE;YACH,cAAc,EAAE,iDAAiD;YACjE,OAAO,EAAE,0CAA0C;SACpD;KACF;IACD,MAAM,EAAE;QACN,4CAA4C,EAAE,wCAAwC;QACtF,mDAAmD,EAAE,yCAAyC;QAC9F,mDAAmD,EAAE,yCAAyC,EAAE,6DAA6D;QAC7J,kEAAkE;QAClE,8CAA8C;QAC9C,wDAAwD,EAAE,yCAAyC;KACpG;CACF,CAAC;AA6DwB,gCAAU;AA3DpC,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,yCAA2B,CAAA;IAC3B,2CAA6B,CAAA;IAC7B,6CAA+B,CAAA;IAC/B,+CAAiC,CAAA;AACnC,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAED,IAAM,OAAO,GAAG;IACd,SAAS,EAAE;QACT,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,eAAe;QAC9B,cAAc,EAAE,gBAAgB;QAChC,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,WAAW;QACtB,UAAU,EAAE,YAAY;KACzB;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,OAAO,EAAE;QACP,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,YAAY;KACtB;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,aAAa;QACjB,GAAG,EAAE,cAAc;KACpB;CACF,CAAC;AA4BoC,0BAAO;AA1B7C,uEAAuE;AACvE,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,sEAAsE;AACtE,IAAM,aAAa,GAAG;IACpB,OAAO,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,0BAA0B,CAAC;IAC7F,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,0BAA0B,CAAC;IAC9F,UAAU,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,0BAA0B,EAAE,2BAA2B,CAAC;IAC7H,GAAG,EAAE;QACH,sEAAsE;QACtE,uEAAuE;QACvE,0DAA0D;QAC1D,OAAO,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,qBAAqB,CAAC;QACxF,+DAA+D;QAC/D,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,qBAAqB,CAAC;QACzF,4DAA4D;QAC5D,UAAU,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,CAAC;KAC5F;CACF,CAAC;AAE6C,sCAAa"}