@adcp/sdk 5.23.0

package/dist/lib/server/auth-introspection.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyIntrospection = verifyIntrospection;
+/**
+ * RFC 7662 OAuth 2.0 Token Introspection authenticator.
+ *
+ * Use case: the agent is NOT the identity issuer. Instead it proxies an
+ * upstream OAuth provider (Snap, Meta, TikTok, Google, …) — the Bearer
+ * token a buyer presents is the upstream platform's access token, not a
+ * JWT the adapter minted. {@link verifyBearer} doesn't apply there; the
+ * only way to validate the token is to ask the upstream: POST the token
+ * to its RFC 7662 introspection endpoint and check `active: true`.
+ *
+ * Matches the {@link Authenticator} contract of {@link verifyBearer}:
+ * returns `null` when no bearer header is present (so {@link anyOf} can
+ * fall through), throws {@link AuthError} when a token was presented
+ * and rejected. Public error messages are sanitized — the upstream
+ * response body never crosses the wire, only a generic "Token
+ * validation failed." / "Insufficient scope." message on 401.
+ *
+ * **Positive-response caching is opt-in.** Introspection endpoints are
+ * often rate-limited and always round-trip at least one TLS handshake
+ * worth of latency — a small in-process LRU keyed on the token's
+ * SHA-256 hash amortizes the cost across closely-spaced requests from
+ * the same buyer. Negative responses are NOT cached by default; a
+ * stolen-then-revoked token must be able to fail the next request. Set
+ * `cache.negativeTtlSeconds` to cache `active: false` too (mitigates
+ * introspection-amplification DoS, trades against revocation latency).
+ */
+const crypto_1 = require("crypto");
+const auth_1 = require("./auth");
+/** Build a token-introspection authenticator. See {@link VerifyIntrospectionOptions}. */
+function verifyIntrospection(options) {
+    // Resolved defaults + sanity-checks at construction so misconfig fails loud at boot.
+    let introspectionUrl;
+    try {
+        introspectionUrl = new URL(options.introspectionUrl);
+    }
+    catch {
+        throw new Error(`verifyIntrospection: \`introspectionUrl\` is not a valid URL: ${options.introspectionUrl}`);
+    }
+    if (introspectionUrl.protocol !== 'https:' && !isLoopbackHost(introspectionUrl.hostname)) {
+        throw new Error(`verifyIntrospection: \`introspectionUrl\` must use https:// (got ${introspectionUrl.protocol}). ` +
+            'Sending bearer tokens over plain HTTP to remote hosts is a credential-exposure bug.');
+    }
+    if (!options.clientId || !options.clientSecret) {
+        throw new Error('verifyIntrospection: `clientId` and `clientSecret` are required (RFC 7662 mandates client auth).');
+    }
+    const clientAuth = options.clientAuth ?? 'basic';
+    const timeoutMs = options.timeoutMs ?? 2000;
+    const tokenTypeHint = options.tokenTypeHint ?? 'access_token';
+    const requiredScopes = options.requiredScopes ?? [];
+    const cache = options.cache ? createIntrospectionCache(options.cache) : undefined;
+    // RFC 6749 §2.3.1 mandates application/x-www-form-urlencoded on the
+    // clientId and clientSecret BEFORE base64'ing for Basic auth. That's
+    // what `formUrlEncode` does (encodeURIComponent + `!*'()` escapes).
+    // Some legacy ASes compare the decoded Basic-auth password directly
+    // against the stored secret without percent-decoding — if that's
+    // biting you, set `clientAuth: 'body'` to send creds in the form body
+    // instead, which sidesteps the encoding negotiation entirely.
+    const basicAuthHeader = clientAuth === 'basic'
+        ? `Basic ${Buffer.from(`${formUrlEncode(options.clientId)}:${formUrlEncode(options.clientSecret)}`).toString('base64')}`
+        : undefined;
+    return async (req) => {
+        const token = (0, auth_1.extractBearerToken)(req);
+        if (!token)
+            return null;
+        // Cache lookup keyed on SHA-256(token) so the cache never stores
+        // the raw bearer in process memory.
+        const cacheKey = cache ? sha256(token) : undefined;
+        if (cache && cacheKey) {
+            const hit = cache.get(cacheKey);
+            if (hit) {
+                if (hit.principal === null) {
+                    throw new auth_1.AuthError('Token validation failed.');
+                }
+                return { ...hit.principal, token };
+            }
+        }
+        let response;
+        try {
+            response = await introspect({
+                introspectionUrl,
+                token,
+                tokenTypeHint,
+                clientAuth,
+                basicAuthHeader,
+                clientId: options.clientId,
+                clientSecret: options.clientSecret,
+                timeoutMs,
+            });
+        }
+        catch (err) {
+            // Network / HTTP errors — fail closed but DON'T cache. The next
+            // request retries. Public message is generic; cause is logged.
+            throw new auth_1.AuthError('Token validation failed.', { cause: err });
+        }
+        // Inactive token. Cache the negative result if enabled — mitigates
+        // replay-amplification of a revoked token. Cause message is generic.
+        if (!response.active) {
+            if (cache && cacheKey && cache.negativeTtlMs > 0) {
+                cache.set(cacheKey, { principal: null, expiresAt: Date.now() + cache.negativeTtlMs });
+            }
+            throw new auth_1.AuthError('Token validation failed.');
+        }
+        // Audience check — only when the caller specified a required audience.
+        // Many upstream IdPs don't populate `aud` on access tokens, so the
+        // default "no audience required" is correct for the adapter case.
+        if (options.audience !== undefined) {
+            const aud = response.aud;
+            const audList = typeof aud === 'string' ? [aud] : Array.isArray(aud) ? aud : [];
+            if (!audList.includes(options.audience)) {
+                throw new auth_1.AuthError('Token validation failed.');
+            }
+        }
+        const scopes = parseScope(response.scope);
+        if (requiredScopes.length > 0) {
+            const missing = requiredScopes.filter(s => !scopes.includes(s));
+            if (missing.length > 0) {
+                throw new auth_1.AuthError('Insufficient scope.');
+            }
+        }
+        const principal = {
+            principal: typeof response.sub === 'string'
+                ? response.sub
+                : typeof response.client_id === 'string'
+                    ? response.client_id
+                    : 'unknown',
+            token,
+            scopes,
+            claims: response,
+        };
+        if (typeof response.exp === 'number')
+            principal.expiresAt = response.exp;
+        if (cache && cacheKey) {
+            // Cap the positive TTL at the token's own remaining lifetime —
+            // never let the cache extend a token past its issued `exp`. When
+            // the IdP omits `exp`, fall back to the configured TTL.
+            const nowSec = Math.floor(Date.now() / 1000);
+            const configuredTtlMs = cache.positiveTtlMs;
+            const effectiveTtlMs = typeof response.exp === 'number'
+                ? Math.min(configuredTtlMs, Math.max(0, (response.exp - nowSec) * 1000))
+                : configuredTtlMs;
+            if (effectiveTtlMs > 0) {
+                // Deep-clone the principal for the cache entry so callers that
+                // mutate the returned principal can't poison the cached copy.
+                // `claims` is cloned with structuredClone — a shallow spread would
+                // leave nested objects aliased, and a malicious or buggy caller
+                // that set `returned.claims.scope = 'admin'` would upgrade every
+                // subsequent cached lookup.
+                const cachedPrincipal = {
+                    principal: principal.principal,
+                    scopes: [...scopes],
+                    claims: principal.claims ? structuredClone(principal.claims) : undefined,
+                };
+                if (principal.expiresAt !== undefined)
+                    cachedPrincipal.expiresAt = principal.expiresAt;
+                cache.set(cacheKey, {
+                    principal: cachedPrincipal,
+                    expiresAt: Date.now() + effectiveTtlMs,
+                });
+            }
+        }
+        // Return a fresh object to callers — the cached copy is sealed behind
+        // the `cachedPrincipal` closure. If the caller mutates the returned
+        // `scopes` array or `claims` object, the cache entry stays clean
+        // because it was cloned at `set` time (see block above).
+        return principal;
+    };
+}
+/**
+ * Check whether a hostname is a loopback address. Exact-match for the
+ * three literal forms (`localhost`, `127.0.0.1`, `[::1]`) so attacker
+ * tricks like `localhost.evil.com` don't slip past — URL parser sets
+ * `.hostname` to the whole string, not the left-most label.
+ */
+function isLoopbackHost(hostname) {
+    // URL parses IPv6 `[::1]` as hostname `::1` (brackets stripped). The
+    // 127.0.0.0/8 range is loopback per RFC 6890 — accept anything in
+    // that range since Node's own fetch routes it to lo0.
+    if (hostname === 'localhost' || hostname === '::1')
+        return true;
+    const m = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+    if (!m)
+        return false;
+    return m.slice(1).every(octet => {
+        const n = Number(octet);
+        return n >= 0 && n <= 255;
+    });
+}
+/**
+ * application/x-www-form-urlencoded encoding per RFC 6749 §2.3.1 and
+ * Appendix B. Differs from `encodeURIComponent` in that `!*'()` MUST be
+ * percent-encoded (those are reserved in the form-urlencoded grammar).
+ * Rare in real-world client credentials but spec-correct and avoids
+ * per-IdP quirks when a secret happens to include one of those chars.
+ */
+function formUrlEncode(s) {
+    return encodeURIComponent(s).replace(/[!*'()]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+}
+// ---------------------------------------------------------------------------
+// Introspection transport
+// ---------------------------------------------------------------------------
+async function introspect(args) {
+    const body = new URLSearchParams();
+    body.set('token', args.token);
+    body.set('token_type_hint', args.tokenTypeHint);
+    if (args.clientAuth === 'body') {
+        body.set('client_id', args.clientId);
+        body.set('client_secret', args.clientSecret);
+    }
+    const headers = {
+        'content-type': 'application/x-www-form-urlencoded',
+        accept: 'application/json',
+    };
+    if (args.basicAuthHeader)
+        headers.authorization = args.basicAuthHeader;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), args.timeoutMs);
+    try {
+        const res = await fetch(args.introspectionUrl, {
+            method: 'POST',
+            headers,
+            body,
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            // 4xx/5xx — don't treat as `active: false`; that would mask a
+            // misconfigured client credential as a revoked token.
+            const statusText = res.statusText || 'no status text';
+            throw new Error(`introspection endpoint returned HTTP ${res.status} (${statusText})`);
+        }
+        const ct = res.headers.get('content-type') || '';
+        if (!ct.includes('application/json')) {
+            throw new Error(`introspection endpoint returned non-JSON content-type: ${ct}`);
+        }
+        const json = (await res.json());
+        if (typeof json?.active !== 'boolean') {
+            throw new Error('introspection response missing required `active` field');
+        }
+        return json;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function sha256(input) {
+    return (0, crypto_1.createHash)('sha256').update(input).digest('hex');
+}
+function parseScope(scope) {
+    if (typeof scope !== 'string' || scope.length === 0)
+        return [];
+    return scope.split(/\s+/).filter(Boolean);
+}
+/**
+ * Small insertion-ordered LRU. Map iteration order is insertion order; to
+ * bump an entry on access, delete + re-set. Keeps the implementation
+ * dependency-free.
+ */
+function createIntrospectionCache(options) {
+    const max = options.max ?? 1024;
+    const positiveTtlMs = (options.ttlSeconds ?? 60) * 1000;
+    const negativeTtlMs = (options.negativeTtlSeconds ?? 0) * 1000;
+    const store = new Map();
+    return {
+        positiveTtlMs,
+        negativeTtlMs,
+        get(key) {
+            const entry = store.get(key);
+            if (!entry)
+                return undefined;
+            if (entry.expiresAt <= Date.now()) {
+                store.delete(key);
+                return undefined;
+            }
+            // Bump LRU: re-insert at the tail.
+            store.delete(key);
+            store.set(key, entry);
+            return entry;
+        },
+        set(key, entry) {
+            if (store.has(key))
+                store.delete(key);
+            store.set(key, entry);
+            while (store.size > max) {
+                const oldest = store.keys().next().value;
+                if (oldest === undefined)
+                    break;
+                store.delete(oldest);
+            }
+        },
+    };
+}
+//# sourceMappingURL=auth-introspection.js.map

package/dist/lib/server/auth-introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-introspection.js","sourceRoot":"","sources":["../../../src/lib/server/auth-introspection.ts"],"names":[],"mappings":";;AAsHA,kDAoJC;AA1QD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,mCAAoC;AAEpC,iCAAgH;AAyFhH,yFAAyF;AACzF,SAAgB,mBAAmB,CAAC,OAAmC;IACrE,qFAAqF;IACrF,IAAI,gBAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CACb,oEAAoE,gBAAgB,CAAC,QAAQ,KAAK;YAChG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;IAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAElF,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,iEAAiE;IACjE,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,eAAe,GACnB,UAAU,KAAK,OAAO;QACpB,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACxH,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,KAAK,EAAE,GAAoB,EAAuB,EAAE;QACzD,MAAM,KAAK,GAAG,IAAA,yBAAkB,EAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnD,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC3B,MAAM,IAAI,gBAAS,CAAC,0BAA0B,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,UAAU,CAAC;gBAC1B,gBAAgB;gBAChB,KAAK;gBACL,aAAa;gBACb,UAAU;gBACV,eAAe;gBACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gEAAgE;YAChE,+DAA+D;YAC/D,MAAM,IAAI,gBAAS,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,IAAI,gBAAS,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;YACzB,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,gBAAS,CAAC,0BAA0B,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,gBAAS,CAAC,qBAAqB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAkB;YAC/B,SAAS,EACP,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;gBAC9B,CAAC,CAAC,QAAQ,CAAC,GAAG;gBACd,CAAC,CAAC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;oBACtC,CAAC,CAAC,QAAQ,CAAC,SAAS;oBACpB,CAAC,CAAC,SAAS;YACjB,KAAK;YACL,MAAM;YACN,MAAM,EAAE,QAAQ;SACjB,CAAC;QACF,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAAE,SAAS,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC;QAEzE,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,+DAA+D;YAC/D,iEAAiE;YACjE,wDAAwD;YACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7C,MAAM,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC;YAC5C,MAAM,cAAc,GAClB,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxE,CAAC,CAAC,eAAe,CAAC;YACtB,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;gBACvB,+DAA+D;gBAC/D,8DAA8D;gBAC9D,mEAAmE;gBACnE,gEAAgE;gBAChE,iEAAiE;gBACjE,4BAA4B;gBAC5B,MAAM,eAAe,GAAkB;oBACrC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;oBACnB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;iBACzE,CAAC;gBACF,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;oBAAE,eAAe,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;gBACvF,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;iBACvC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,yDAAyD;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,qEAAqE;IACrE,kEAAkE;IAClE,sDAAsD;IACtD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,CAAC,GAAG,wCAAwC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAC,IASzB;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,mCAAmC;QACnD,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC;IAEvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,8DAA8D;YAC9D,sDAAsD;YACtD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,gBAAgB,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,KAAK,UAAU,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,0DAA0D,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAaD;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAkC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACxD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,OAAO;QACL,aAAa;QACb,aAAa;QACb,GAAG,CAAC,GAAG;YACL,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,mCAAmC;YACnC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACzC,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM;gBAChC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/server/auth-signature.d.ts

@@ -0,0 +1,322 @@
+/**
+ * Bridge between {@link verifyRequestSignature} and the {@link Authenticator}
+ * surface so RFC 9421 signatures compose with bearer / API-key auth via
+ * {@link anyOf}.
+ *
+ * Use when an agent declares the `signed-requests` specialism AND also
+ * accepts bearer-authed callers — the composition signals "either credential
+ * type is sufficient". Unsigned-but-bearered requests fall through to the
+ * next authenticator; signed requests with a valid signature short-circuit
+ * the chain and surface a principal derived from the signing key.
+ *
+ * A request with a present-but-invalid signature throws {@link AuthError}
+ * so `serve()` can return a 401 — `anyOf` surfaces that as "credentials
+ * rejected" rather than falling through.
+ *
+ * ```ts
+ * import {
+ *   serve,
+ *   verifyApiKey,
+ *   anyOf,
+ *   verifySignatureAsAuthenticator,
+ *   mcpToolNameResolver,
+ * } from '@adcp/sdk/server';
+ *
+ * serve(createAgent, {
+ *   authenticate: anyOf(
+ *     verifyApiKey({ keys: { 'sk_live_abc': { principal: 'acct_42' } } }),
+ *     verifySignatureAsAuthenticator({
+ *       jwks, replayStore, revocationStore,
+ *       capability: { supported: true, required_for: [], covers_content_digest: 'either' },
+ *       resolveOperation: mcpToolNameResolver,
+ *     }),
+ *   ),
+ * });
+ * ```
+ *
+ * The returned authenticator is tagged with {@link AUTH_NEEDS_RAW_BODY} so
+ * `serve()` buffers `req.rawBody` before authentication runs.
+ */
+import type { IncomingMessage } from 'http';
+import type { JwksResolver } from '../signing/jwks';
+import { type ReplayStore } from '../signing/replay';
+import { type RevocationStore } from '../signing/revocation';
+import type { VerifiedSigner, VerifierCapability } from '../signing/types';
+import { type AuthPrincipal, type Authenticator } from './auth';
+export interface VerifySignatureAsAuthenticatorOptions {
+    /** Verifier capability block. `required_for` is not enforced here — unsigned
+     *  requests fall through to the next authenticator — so set it to whatever
+     *  your `request_signing` capability claim advertises. */
+    capability: VerifierCapability;
+    /** Resolves verification keys by `keyid`. */
+    jwks: JwksResolver;
+    /**
+     * Stores `(keyid, signature-bytes, expires)` tuples for replay detection.
+     * Defaults to a fresh {@link InMemoryReplayStore} — fine for single-process
+     * deployments. Wire a shared store (Redis, Postgres, etc.) for multi-replica
+     * setups where a signature accepted on one replica must be rejected on the
+     * others.
+     */
+    replayStore?: ReplayStore;
+    /**
+     * Consulted for revoked `kid` / `jti` before accepting a signature.
+     * Defaults to a fresh {@link InMemoryRevocationStore}. Most agents don't
+     * revoke at runtime; when you do, swap in a store backed by your secrets
+     * manager or admin tooling.
+     */
+    revocationStore?: RevocationStore;
+    /** Override clock for tests. */
+    now?: () => number;
+    /**
+     * Extract the AdCP operation name from the incoming request. Called with
+     * the raw `IncomingMessage`; `req.rawBody` has been buffered by `serve()`
+     * before this runs. Same semantics as
+     * `ExpressMiddlewareOptions.resolveOperation` on {@link createExpressVerifier}.
+     *
+     * SECURITY: a resolver that always returns `undefined` disables
+     * `capability.required_for` enforcement for this authenticator. Since the
+     * bypass here is intentional (this adapter is for composition with other
+     * authenticators — see the module docstring), the fall-through still
+     * happens when the resolver returns `undefined`, so `required_for`
+     * enforcement should live in a separate `preTransport`-mounted verifier
+     * when composition is active.
+     */
+    resolveOperation: (req: IncomingMessage & {
+        rawBody?: string;
+    }) => string | undefined;
+    /**
+     * Override how the request's full URL is reconstructed. Use when the
+     * server sits behind a TLS-terminating or path-rewriting load balancer
+     * and `req.headers.host` / `req.url` don't reflect what the signer signed.
+     */
+    getUrl?: (req: IncomingMessage & {
+        rawBody?: string;
+    }) => string;
+    /** Resolve the `agent_url` claim the verifier stamps on verified results. */
+    agentUrlForKeyid?: (keyid: string) => string | undefined;
+    /**
+     * Shape the principal returned on successful signature verification.
+     * Defaults to `{ principal: `signing:${keyid}`, claims: { signature: VerifiedSigner } }`.
+     */
+    makePrincipal?: (signer: VerifiedSigner) => AuthPrincipal;
+}
+/**
+ * Build an {@link Authenticator} that verifies an RFC 9421 request signature.
+ *
+ * Behavior matrix:
+ * - No `Signature-Input` header → returns `null` (fall through to next authenticator).
+ * - Signature present and valid → returns {@link AuthPrincipal}.
+ * - Signature present but invalid → throws {@link AuthError} (surfaces as 401).
+ *
+ * Populates `req.verifiedSigner` on success so downstream handlers see the
+ * same side-channel state as the Express-shaped middleware.
+ */
+export declare function verifySignatureAsAuthenticator(options: VerifySignatureAsAuthenticatorOptions): Authenticator;
+/**
+ * Compose a signature authenticator with a fallback under presence-gated
+ * semantics: if the incoming request declares a `Signature-Input` header,
+ * the signature authenticator is the ONLY path — its result (principal,
+ * `null`, or thrown {@link AuthError}) is the final outcome and the fallback
+ * never runs. Without `Signature-Input`, the fallback handles the request.
+ *
+ * This is the correct composition for the `signed-requests` specialism.
+ * {@link anyOf}'s either-or contract incorrectly accepts a bearer-authed
+ * request whose signature is present-but-invalid — fine for "either
+ * credential is sufficient" but wrong for spec conformance, where a
+ * declared-but-invalid signature MUST be rejected even when a valid bearer
+ * accompanies it (revocation, window expiry, malformed covered-components,
+ * etc.).
+ *
+ * ```ts
+ * import {
+ *   serve,
+ *   anyOf,
+ *   verifyApiKey,
+ *   verifySignatureAsAuthenticator,
+ *   requireSignatureWhenPresent,
+ * } from '@adcp/sdk/server';
+ *
+ * serve(createAgent, {
+ *   authenticate: requireSignatureWhenPresent(
+ *     verifySignatureAsAuthenticator({ jwks, replayStore, revocationStore, capability, resolveOperation }),
+ *     anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),
+ *   ),
+ * });
+ * ```
+ *
+ * Presence is detected from RFC 9421 signature headers: either
+ * `Signature-Input` or the paired `Signature`. A request carrying only one of
+ * the two is malformed but still treated as "signed intent" — the signature
+ * authenticator runs and throws, which is what AdCP's negative conformance
+ * vectors expect.
+ *
+ * Behavior matrix:
+ *
+ * | RFC 9421 signature header present? | Signature result          | Outcome                      |
+ * |------------------------------------|---------------------------|------------------------------|
+ * | yes                                | verified                  | signature principal          |
+ * | yes                                | throws {@link AuthError}  | 401 (does NOT fall through)  |
+ * | yes                                | returns `null`            | 401 via re-thrown `AuthError` (does NOT fall through) |
+ * | no                                 | —                         | fallback runs verbatim       |
+ *
+ * The returned authenticator is tagged with {@link AUTH_NEEDS_RAW_BODY} when
+ * either branch needs the raw body, so `serve()` buffers `req.rawBody` ahead
+ * of authentication.
+ *
+ * **Do not nest this helper inside {@link anyOf}.** `anyOf` catches thrown
+ * `AuthError`s and tries the next authenticator, which re-introduces the
+ * bypass this helper exists to prevent. `anyOf` refuses such composition at
+ * wire-up time (throws synchronously) — invert the order instead:
+ * `requireSignatureWhenPresent(sig, anyOf(bearer, apiKey))`.
+ */
+export interface RequireSignatureWhenPresentOptions {
+    /**
+     * Operations that MUST be signed. When the incoming request carries no
+     * RFC 9421 signature header AND the fallback authenticator returns
+     * `null` (no credentials at all), the gate throws an {@link AuthError}
+     * whose `cause` is {@link RequestSignatureError} with
+     * `request_signature_required` — `serve()` maps that into a 401 with
+     * `WWW-Authenticate: Signature error="request_signature_required"`.
+     *
+     * "Fallback bypass" is deliberately allowed: if the caller presents a
+     * valid bearer (or API key) on a `requiredFor` operation, the fallback
+     * succeeds and the request is accepted without a signature. This
+     * matches the consensus on
+     * [adcp#2586](https://github.com/adcontextprotocol/adcp/issues/2586):
+     * `required_for` signals "signatures are the mandatory mechanism for
+     * unauthenticated callers" — not "signatures are mandatory on top of
+     * every other credential."
+     *
+     * When the request IS signed, `required_for` enforcement happens inside
+     * the signature verifier itself (via `capability.required_for`), not
+     * here — this pre-check is only for the no-signature path.
+     */
+    requiredFor?: readonly string[];
+    /**
+     * Extract the AdCP operation name (or any identifier that can be
+     * matched against `requiredFor`) from the incoming request.
+     *
+     * For MCP agents, pass the exported {@link mcpToolNameResolver} — it
+     * implements the standard `tools/call` → `params.name` parse. For A2A
+     * agents (or other non-JSON-RPC envelopes), supply a bespoke resolver.
+     *
+     * When `requiredFor` is set but `resolveOperation` is omitted OR
+     * returns `undefined`, the pre-check is skipped — better to let the
+     * downstream handler produce a precise `INVALID_REQUEST` than to
+     * reject every unsigned call as signature-required.
+     */
+    resolveOperation?: (req: IncomingMessage & {
+        rawBody?: string;
+    }) => string | undefined;
+}
+/**
+ * Compose a signature authenticator with a fallback under presence-gated
+ * semantics: if the incoming request declares a `Signature-Input` header,
+ * the signature authenticator is the ONLY path — its result (principal,
+ * `null`, or thrown {@link AuthError}) is the final outcome and the fallback
+ * never runs. Without `Signature-Input`, the fallback handles the request.
+ *
+ * Pass {@link RequireSignatureWhenPresentOptions.requiredFor} to enforce
+ * `required_for` for the no-signature path: when the fallback produces no
+ * principal on an operation that MUST be signed, the gate throws an
+ * {@link AuthError} whose cause is a {@link RequestSignatureError} with
+ * code `request_signature_required` — `serve()` maps that into a 401
+ * with the RFC 9421 `WWW-Authenticate: Signature` challenge.
+ */
+export declare function requireSignatureWhenPresent(signatureAuth: Authenticator, fallbackAuth: Authenticator, options?: RequireSignatureWhenPresentOptions): Authenticator;
+export interface RequireAuthenticatedOrSignedOptions {
+    /** RFC 9421 request-signature authenticator. Usually built with {@link verifySignatureAsAuthenticator}. */
+    signature: Authenticator;
+    /**
+     * Credential authenticator that runs when no signature is present.
+     * Usually {@link anyOf} of `verifyApiKey` / `verifyBearer` — whatever
+     * credential types the agent accepts on unsigned calls.
+     */
+    fallback: Authenticator;
+    /**
+     * Operations that MUST be authenticated with a signature when no other
+     * credential is presented. See
+     * {@link RequireSignatureWhenPresentOptions.requiredFor}.
+     *
+     * Pass `MUTATING_TASKS` (exported from `@adcp/sdk`) to require
+     * signatures on every mutating AdCP operation — matches the common
+     * declaration in `capabilities.request_signing.required_for`.
+     */
+    requiredFor?: readonly string[];
+    /** See {@link RequireSignatureWhenPresentOptions.resolveOperation}. */
+    resolveOperation?: (req: IncomingMessage & {
+        rawBody?: string;
+    }) => string | undefined;
+}
+/**
+ * Bundled composition of {@link requireSignatureWhenPresent} with an
+ * operation resolver — one call produces an authenticator that:
+ *
+ *   1. Prefers the RFC 9421 signature path when a `Signature-Input`
+ *      header is present, with no bearer fall-through on invalid
+ *      signatures (matches the `signed-requests` specialism contract).
+ *   2. Accepts bearer / API key when no signature is present, including
+ *      on `requiredFor` operations — valid credentials bypass the
+ *      signature requirement.
+ *   3. Rejects unsigned calls with no credentials on `requiredFor`
+ *      operations with a `WWW-Authenticate: Signature` challenge whose
+ *      error is `request_signature_required`.
+ *
+ * ```ts
+ * import {
+ *   serve,
+ *   verifyApiKey,
+ *   verifyBearer,
+ *   anyOf,
+ *   verifySignatureAsAuthenticator,
+ *   requireAuthenticatedOrSigned,
+ *   mcpToolNameResolver,
+ *   MUTATING_TASKS,
+ * } from '@adcp/sdk/server';
+ *
+ * serve(createAgent, {
+ *   authenticate: requireAuthenticatedOrSigned({
+ *     signature: verifySignatureAsAuthenticator({
+ *       jwks, replayStore, revocationStore, capability,
+ *       resolveOperation: mcpToolNameResolver,
+ *     }),
+ *     fallback: anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),
+ *     requiredFor: [...MUTATING_TASKS],
+ *     resolveOperation: mcpToolNameResolver,
+ *   }),
+ * });
+ * ```
+ */
+export declare function requireAuthenticatedOrSigned(options: RequireAuthenticatedOrSignedOptions): Authenticator;
+/**
+ * Default `resolveOperation` for MCP agents. Parses the buffered JSON-RPC
+ * body on `req.rawBody` and returns `params.name` when `method === 'tools/call'`.
+ * Returns `undefined` for non-`tools/call` methods, a missing body, or
+ * malformed JSON — the same "skip the pre-check and let the handler produce
+ * a precise error" semantics every other `resolveOperation` in the SDK
+ * uses.
+ *
+ * Pass directly as `resolveOperation` on {@link verifySignatureAsAuthenticator},
+ * {@link requireSignatureWhenPresent}, {@link requireAuthenticatedOrSigned},
+ * or `createExpressVerifier` from `@adcp/sdk/signing`:
+ *
+ * ```ts
+ * serve(createAgent, {
+ *   authenticate: requireAuthenticatedOrSigned({
+ *     signature: verifySignatureAsAuthenticator({
+ *       jwks, replayStore, revocationStore, capability,
+ *       resolveOperation: mcpToolNameResolver,
+ *     }),
+ *     fallback: anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),
+ *     requiredFor: [...MUTATING_TASKS],
+ *     resolveOperation: mcpToolNameResolver,
+ *   }),
+ * });
+ * ```
+ *
+ * A2A agents use a different envelope — write a bespoke resolver there.
+ */
+export declare function mcpToolNameResolver(req: {
+    rawBody?: string;
+}): string | undefined;
+//# sourceMappingURL=auth-signature.d.ts.map

package/dist/lib/server/auth-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-signature.d.ts","sourceRoot":"","sources":["../../../src/lib/server/auth-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAG5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAgB,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,aAAa,EAInB,MAAM,QAAQ,CAAC;AAEhB,MAAM,WAAW,qCAAqC;IACpD;;8DAE0D;IAC1D,UAAU,EAAE,kBAAkB,CAAC;IAC/B,6CAA6C;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,gBAAgB,EAAE,CAAC,GAAG,EAAE,eAAe,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,GAAG,SAAS,CAAC;IACtF;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;IACjE,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACzD;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,aAAa,CAAC;CAC3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,qCAAqC,GAAG,aAAa,CAuF5G;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,WAAW,kCAAkC;IACjD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,GAAG,SAAS,CAAC;CACxF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,aAAa,EAC3B,OAAO,GAAE,kCAAuC,GAC/C,aAAa,CAuEf;AAED,MAAM,WAAW,mCAAmC;IAClD,2GAA2G;IAC3G,SAAS,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,QAAQ,EAAE,aAAa,CAAC;IACxB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,GAAG,SAAS,CAAC;CACxF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,mCAAmC,GAAG,aAAa,CAKxG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAWjF"}