@adcp/sdk 5.23.0

package/dist/lib/signing/parser.js

@@ -0,0 +1,244 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSignatureInput = parseSignatureInput;
+exports.parseSignature = parseSignature;
+exports.rejectDuplicateDictionaryKeys = rejectDuplicateDictionaryKeys;
+const structured_headers_1 = require("structured-headers");
+const errors_1 = require("./errors");
+const STRING_PARAMS = new Set(['nonce', 'keyid', 'alg', 'tag']);
+const INTEGER_PARAMS = new Set(['created', 'expires']);
+function malformed(message) {
+    throw new errors_1.RequestSignatureError('request_signature_header_malformed', 1, message);
+}
+function parseSignatureInput(headerValue) {
+    rejectDuplicateDictionaryKeys(headerValue, 'Signature-Input');
+    let dict;
+    try {
+        dict = (0, structured_headers_1.parseDictionary)(headerValue);
+    }
+    catch (e) {
+        if (e instanceof structured_headers_1.ParseError)
+            malformed(`Signature-Input header is malformed: ${e.message}`);
+        throw e;
+    }
+    if (dict.size === 0)
+        malformed('Signature-Input header is empty');
+    const label = dict.has('sig1') ? 'sig1' : dict.keys().next().value;
+    const entry = dict.get(label);
+    if (!isInnerList(entry)) {
+        malformed('Signature-Input value must be a parenthesized component list');
+    }
+    const components = [];
+    for (const [bare] of entry[0]) {
+        if (typeof bare !== 'string')
+            malformed('Signature-Input components must all be strings');
+        components.push(bare);
+    }
+    const params = {};
+    for (const [key, value] of entry[1]) {
+        if (STRING_PARAMS.has(key)) {
+            if (typeof value !== 'string') {
+                malformed(`Signature parameter "${key}" must be a quoted string`);
+            }
+            params[key] = value;
+        }
+        else if (INTEGER_PARAMS.has(key)) {
+            if (typeof value !== 'number' || !Number.isInteger(value)) {
+                malformed(`Signature parameter "${key}" must be an integer`);
+            }
+            params[key] = value;
+        }
+        else if (typeof value === 'string' || typeof value === 'number') {
+            params[key] = value;
+        }
+    }
+    return {
+        label,
+        components,
+        signatureParamsValue: (0, structured_headers_1.serializeInnerList)(entry),
+        params: params,
+    };
+}
+function parseSignature(headerValue, expectedLabel) {
+    let dict;
+    try {
+        // RFC 9421 signatures commonly use base64url (`-`/`_`); RFC 8941 byte
+        // sequences only permit standard base64. Translate the characters inside
+        // byte-sequence delimiters before handing to the strict parser.
+        dict = (0, structured_headers_1.parseDictionary)(normalizeByteSequenceBase64(headerValue));
+    }
+    catch (e) {
+        if (e instanceof structured_headers_1.ParseError) {
+            if (/base64/i.test(e.message))
+                malformed('Signature value contains non-base64 characters');
+            malformed(`Signature header is malformed: ${e.message}`);
+        }
+        throw e;
+    }
+    const entry = dict.get(expectedLabel);
+    if (!entry) {
+        malformed(`Signature header does not contain label "${expectedLabel}"`);
+    }
+    if (!(entry[0] instanceof ArrayBuffer)) {
+        malformed(`Signature value for "${expectedLabel}" must be a byte sequence`);
+    }
+    return { label: expectedLabel, bytes: new Uint8Array(entry[0].slice(0)) };
+}
+function isInnerList(entry) {
+    return Array.isArray(entry) && Array.isArray(entry[0]);
+}
+/**
+ * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP
+ * profile (step 1) overrides that: duplicate keys are a downgrade vector —
+ * a proxy could smuggle a weaker component set past a verifier that reads
+ * the first. Detect duplicates at the raw-header level before the library
+ * silently drops them.
+ */
+function rejectDuplicateDictionaryKeys(headerValue, headerName) {
+    const keys = extractTopLevelDictKeys(headerValue);
+    const seen = new Set();
+    for (const key of keys) {
+        if (seen.has(key)) {
+            malformed(`${headerName} header declares key "${key}" more than once`);
+        }
+        seen.add(key);
+    }
+}
+function extractTopLevelDictKeys(input) {
+    const keys = [];
+    let i = 0;
+    const len = input.length;
+    let atEntryStart = true;
+    while (i < len) {
+        if (atEntryStart) {
+            while (i < len && (input[i] === ' ' || input[i] === '\t'))
+                i++;
+            const keyStart = i;
+            while (i < len && /[A-Za-z0-9_*-]/.test(input[i]))
+                i++;
+            if (i > keyStart)
+                keys.push(input.slice(keyStart, i).toLowerCase());
+            atEntryStart = false;
+            continue;
+        }
+        const ch = input[i];
+        if (ch === '"') {
+            i++;
+            while (i < len) {
+                if (input[i] === '\\' && i + 1 < len) {
+                    i += 2;
+                    continue;
+                }
+                if (input[i] === '"') {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+            continue;
+        }
+        if (ch === ':') {
+            i++;
+            while (i < len && input[i] !== ':')
+                i++;
+            if (i < len)
+                i++;
+            continue;
+        }
+        if (ch === '(') {
+            i++;
+            let depth = 1;
+            while (i < len && depth > 0) {
+                const c = input[i];
+                if (c === '"') {
+                    i++;
+                    while (i < len) {
+                        if (input[i] === '\\' && i + 1 < len) {
+                            i += 2;
+                            continue;
+                        }
+                        if (input[i] === '"') {
+                            i++;
+                            break;
+                        }
+                        i++;
+                    }
+                    continue;
+                }
+                if (c === '(')
+                    depth++;
+                else if (c === ')')
+                    depth--;
+                i++;
+            }
+            continue;
+        }
+        if (ch === ',') {
+            atEntryStart = true;
+            i++;
+            continue;
+        }
+        i++;
+    }
+    return keys;
+}
+/**
+ * Translate base64url (`-`/`_`) inside byte-sequence delimiters to standard
+ * base64 (`+`/`/`) so the strict RFC 8941 parser accepts the value. Enforces
+ * the spec's single-alphabet rule: a byte-sequence token that mixes
+ * base64url (`[-_]`) with standard base64 (`[+/=]`) is ambiguous and MUST
+ * be rejected (`webhook_signature_header_malformed` / `request_signature_header_malformed`
+ * per profile).
+ */
+function normalizeByteSequenceBase64(input) {
+    let out = '';
+    let inString = false;
+    let inBytes = false;
+    let sawStandardAlphabet = false;
+    let sawUrlSafeAlphabet = false;
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (inString) {
+            out += ch;
+            if (ch === '\\' && i + 1 < input.length) {
+                out += input[++i];
+                continue;
+            }
+            if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (inBytes) {
+            if (ch === ':') {
+                inBytes = false;
+                out += ch;
+                if (sawStandardAlphabet && sawUrlSafeAlphabet) {
+                    malformed('Signature value mixes base64url and standard-base64 alphabets');
+                }
+                sawStandardAlphabet = false;
+                sawUrlSafeAlphabet = false;
+            }
+            else if (ch === '-') {
+                sawUrlSafeAlphabet = true;
+                out += '+';
+            }
+            else if (ch === '_') {
+                sawUrlSafeAlphabet = true;
+                out += '/';
+            }
+            else {
+                if (ch === '+' || ch === '/' || ch === '=')
+                    sawStandardAlphabet = true;
+                out += ch;
+            }
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === ':')
+            inBytes = true;
+        out += ch;
+    }
+    return out;
+}
+//# sourceMappingURL=parser.js.map

package/dist/lib/signing/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../src/lib/signing/parser.ts"],"names":[],"mappings":";;AAoCA,kDA0CC;AAED,wCAsBC;AAaD,sEASC;AA5HD,2DAAqG;AACrG,qCAAiD;AA4BjD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAChE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvD,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,IAAI,8BAAqB,CAAC,oCAAoC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,6BAA6B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,oCAAe,EAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,CAAC,YAAY,+BAAU;YAAE,SAAS,CAAC,wCAAwC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAgB,CAAC;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,8DAA8D,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS,CAAC,gDAAgD,CAAC,CAAC;QAC1F,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,SAAS,CAAC,wBAAwB,GAAG,2BAA2B,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;aAAM,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,SAAS,CAAC,wBAAwB,GAAG,sBAAsB,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK;QACL,UAAU;QACV,oBAAoB,EAAE,IAAA,uCAAkB,EAAC,KAAK,CAAC;QAC/C,MAAM,EAAE,MAAwC;KACjD,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAAC,WAAmB,EAAE,aAAqB;IACvE,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,sEAAsE;QACtE,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,GAAG,IAAA,oCAAe,EAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,CAAC,YAAY,+BAAU,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,gDAAgD,CAAC,CAAC;YAC3F,SAAS,CAAC,kCAAkC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,SAAS,CAAC,4CAA4C,aAAa,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,WAAW,CAAC,EAAE,CAAC;QACvC,SAAS,CAAC,wBAAwB,aAAa,2BAA2B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAE,KAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,WAAmB,EAAE,UAAkB;IACnF,MAAM,IAAI,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS,CAAC,GAAG,UAAU,yBAAyB,GAAG,kBAAkB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACf,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,CAAC,CAAC;YACnB,OAAO,CAAC,GAAG,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACpE,YAAY,GAAG,KAAK,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;gBACf,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;oBACrC,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,GAAG;gBAAE,CAAC,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBACd,CAAC,EAAE,CAAC;oBACJ,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;wBACf,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;4BACrC,CAAC,IAAI,CAAC,CAAC;4BACP,SAAS;wBACX,CAAC;wBACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;4BACrB,CAAC,EAAE,CAAC;4BACJ,MAAM;wBACR,CAAC;wBACD,CAAC,EAAE,CAAC;oBACN,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAClB,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;gBAC5B,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,YAAY,GAAG,IAAI,CAAC;YACpB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACjC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,OAAO,GAAG,KAAK,CAAC;gBAChB,GAAG,IAAI,EAAE,CAAC;gBACV,IAAI,mBAAmB,IAAI,kBAAkB,EAAE,CAAC;oBAC9C,SAAS,CAAC,+DAA+D,CAAC,CAAC;gBAC7E,CAAC;gBACD,mBAAmB,GAAG,KAAK,CAAC;gBAC5B,kBAAkB,GAAG,KAAK,CAAC;YAC7B,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,GAAG,IAAI,GAAG,CAAC;YACb,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,GAAG,IAAI,GAAG,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;oBAAE,mBAAmB,GAAG,IAAI,CAAC;gBACvE,GAAG,IAAI,EAAE,CAAC;YACZ,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,CAAC;QACpC,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/signing/postgres-replay-store.d.ts

@@ -0,0 +1,138 @@
+/**
+ * PostgreSQL-backed `ReplayStore` for distributed AdCP verifier deployments.
+ *
+ * Replaces `InMemoryReplayStore` when running multiple verifier instances
+ * behind a load balancer. The default in-memory store is per-process; a
+ * signature captured by an attacker can be replayed against a sibling
+ * instance whose cache hasn't seen the nonce. Sharing replay state via
+ * Postgres closes that hole using a `(keyid, scope, nonce)` primary key
+ * the verifier checks on every signed request.
+ *
+ * @example
+ * ```typescript
+ * import { Pool } from 'pg';
+ * import { PostgresReplayStore, getReplayStoreMigration } from '@adcp/sdk/signing/server';
+ *
+ * const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+ * await pool.query(getReplayStoreMigration());          // run once at boot
+ *
+ * const replayStore = new PostgresReplayStore(pool);
+ *
+ * app.use(createExpressVerifier({
+ *   capability: { ... },
+ *   jwks,
+ *   replayStore,                                        // <-- shared across instances
+ *   resolveOperation: mcpToolNameResolver,
+ * }));
+ *
+ * // Schedule the sweeper somewhere (cron, app timer, pg_cron, etc.):
+ * setInterval(() => sweepExpiredReplays(pool).catch(console.error), 60_000);
+ * ```
+ *
+ * Reuses the structural `PgQueryable` interface from `postgres-task-store`
+ * so the SDK stays free of a hard `pg` dependency — callers pass any
+ * pg-compatible query executor.
+ */
+import type { PgQueryable } from '../server/postgres-task-store';
+import type { ReplayInsertResult, ReplayStore } from './replay';
+export interface PostgresReplayStoreOptions {
+    /** Table name. Lowercase letters, digits, underscores only. Defaults to `adcp_replay_cache`. */
+    tableName?: string;
+    /**
+     * Max retained (unexpired) nonces per `(keyid, scope)` pair before
+     * `insert` returns `'rate_abuse'`. Mirrors `InMemoryReplayStore`'s
+     * `maxEntriesPerKeyid`. Defaults to 100,000.
+     *
+     * The cap is **best-effort** under concurrency: two simultaneous inserts
+     * at `cap-1` can both observe `n = cap-1` from the same MVCC snapshot
+     * and both insert, briefly overshooting by one. This matches
+     * `InMemoryReplayStore` semantics — the cap is a soft DoS guard, not a
+     * hard invariant.
+     */
+    cap?: number;
+}
+/**
+ * Pre-baked migration SQL for the default `adcp_replay_cache` table. Use
+ * when callers don't need a custom table name. Mirrors the convention of
+ * `MCP_TASKS_MIGRATION` (`postgres-task-store.ts`) and `ADCP_STATE_MIGRATION`
+ * (`postgres-state-store.ts`).
+ */
+export declare const REPLAY_CACHE_MIGRATION: string;
+/**
+ * Generate the SQL DDL for the replay-cache table. Idempotent — safe to
+ * run on existing tables. Run once at server startup, before constructing
+ * `PostgresReplayStore`.
+ *
+ * Schema:
+ * - `(keyid, scope, nonce)` is the primary key, so concurrent inserts of
+ *   the same tuple serialize against the unique index — the second insert
+ *   silently fails via `ON CONFLICT DO NOTHING`, which the adapter detects
+ *   to return `'replayed'`.
+ * - `expires_at` carries the per-row TTL since Postgres has no native TTL.
+ *   Lookups filter `expires_at > now()`; expired rows are deleted by the
+ *   exported {@link sweepExpiredReplays} helper which callers schedule
+ *   themselves.
+ */
+export declare function getReplayStoreMigration(tableName?: string): string;
+export declare class PostgresReplayStore implements ReplayStore {
+    private readonly db;
+    private readonly tableName;
+    private readonly cap;
+    constructor(db: PgQueryable, options?: PostgresReplayStoreOptions);
+    has(keyid: string, scope: string, nonce: string, now: number): Promise<boolean>;
+    isCapHit(keyid: string, scope: string, now: number): Promise<boolean>;
+    /**
+     * Atomically check replay → cap → insert in a single MVCC-snapshotted
+     * statement. Result precedence matches `InMemoryReplayStore`: replay
+     * wins over rate_abuse wins over ok.
+     *
+     * Recycles expired rows in place via `ON CONFLICT DO UPDATE WHERE
+     * existing-is-expired`. Without that, a same-nonce insert *after* the
+     * previous registration's TTL elapsed (but before the sweeper ran)
+     * would falsely report `'replayed'` — the sync `InMemoryReplayStore`
+     * prunes expired entries before the existence check, so we have to
+     * achieve the same semantics here without a separate prune step.
+     *
+     * The `RETURNING 1` is empty when (a) the cap blocked the insert
+     * (`WHERE` clause filtered the conditional INSERT to zero rows) or
+     * (b) the concurrent-same-nonce race lost — another transaction
+     * inserted the same `(keyid, scope, nonce)` between this statement's
+     * snapshot and our `ON CONFLICT`. Both branches are handled by the
+     * outer `CASE`.
+     */
+    insert(keyid: string, scope: string, nonce: string, ttlSeconds: number, now: number): Promise<ReplayInsertResult>;
+}
+export interface SweepExpiredReplaysOptions {
+    /** Table name. Defaults to `adcp_replay_cache`. */
+    tableName?: string;
+    /** Current time in seconds (UNIX epoch). Defaults to `Date.now() / 1000`. */
+    now?: number;
+    /**
+     * Limit the number of rows deleted per call. Useful for very large
+     * tables where a single `DELETE` would lock the table too long. When
+     * unset, deletes all expired rows in one statement.
+     */
+    batchSize?: number;
+}
+/**
+ * Delete expired rows from the replay-cache table. Postgres has no native
+ * TTL; callers schedule this helper themselves (cron, an app-side timer,
+ * a `pg_cron` job, etc.).
+ *
+ * Returns the count of rows deleted, so callers can tune sweep frequency
+ * against observed accumulation. A typical schedule is once per minute
+ * for moderate-traffic verifiers; a hot-path verifier signing thousands
+ * per second may want every 10–15 seconds.
+ *
+ * @example
+ * ```typescript
+ * setInterval(async () => {
+ *   const { deleted } = await sweepExpiredReplays(pool);
+ *   if (deleted > 0) metrics.replayCacheSweep(deleted);
+ * }, 60_000);
+ * ```
+ */
+export declare function sweepExpiredReplays(db: PgQueryable, options?: SweepExpiredReplaysOptions): Promise<{
+    deleted: number;
+}>;
+//# sourceMappingURL=postgres-replay-store.d.ts.map

package/dist/lib/signing/postgres-replay-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-replay-store.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/postgres-replay-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAqBhE,MAAM,WAAW,0BAA0B;IACzC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAkD,CAAC;AAExF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,MAAsB,GAAG,MAAM,CAEjF;AAuBD,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEjB,EAAE,EAAE,WAAW,EAAE,OAAO,GAAE,0BAA+B;IAU/D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW/E,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3E;;;;;;;;;;;;;;;;;;OAkBG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC;CAuC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,WAAW,EACf,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B9B"}

package/dist/lib/signing/postgres-replay-store.js

@@ -0,0 +1,236 @@
+"use strict";
+/**
+ * PostgreSQL-backed `ReplayStore` for distributed AdCP verifier deployments.
+ *
+ * Replaces `InMemoryReplayStore` when running multiple verifier instances
+ * behind a load balancer. The default in-memory store is per-process; a
+ * signature captured by an attacker can be replayed against a sibling
+ * instance whose cache hasn't seen the nonce. Sharing replay state via
+ * Postgres closes that hole using a `(keyid, scope, nonce)` primary key
+ * the verifier checks on every signed request.
+ *
+ * @example
+ * ```typescript
+ * import { Pool } from 'pg';
+ * import { PostgresReplayStore, getReplayStoreMigration } from '@adcp/sdk/signing/server';
+ *
+ * const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+ * await pool.query(getReplayStoreMigration());          // run once at boot
+ *
+ * const replayStore = new PostgresReplayStore(pool);
+ *
+ * app.use(createExpressVerifier({
+ *   capability: { ... },
+ *   jwks,
+ *   replayStore,                                        // <-- shared across instances
+ *   resolveOperation: mcpToolNameResolver,
+ * }));
+ *
+ * // Schedule the sweeper somewhere (cron, app timer, pg_cron, etc.):
+ * setInterval(() => sweepExpiredReplays(pool).catch(console.error), 60_000);
+ * ```
+ *
+ * Reuses the structural `PgQueryable` interface from `postgres-task-store`
+ * so the SDK stays free of a hard `pg` dependency — callers pass any
+ * pg-compatible query executor.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresReplayStore = exports.REPLAY_CACHE_MIGRATION = void 0;
+exports.getReplayStoreMigration = getReplayStoreMigration;
+exports.sweepExpiredReplays = sweepExpiredReplays;
+const DEFAULT_TABLE = 'adcp_replay_cache';
+const DEFAULT_CAP = 100_000;
+const VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+/**
+ * Reject non-finite or out-of-range timestamps before they reach Postgres.
+ * `to_timestamp(NaN)` raises a parse error and `to_timestamp(±Infinity)`
+ * silently produces an `infinity` timestamp — neither would lapse replay
+ * protection, but a buggy `options.now()` injection point could DoS the
+ * verifier with PG errors. Bound to JS-safe-integer territory; verifiers
+ * pass UNIX seconds, not microseconds, so the upper bound is effectively
+ * "year 9999 plus epsilon."
+ */
+function assertFiniteSeconds(label, value) {
+    if (!Number.isFinite(value) || value < 0 || value > Number.MAX_SAFE_INTEGER) {
+        throw new TypeError(`PostgresReplayStore: ${label} must be a finite non-negative number; received ${value}`);
+    }
+}
+/**
+ * Pre-baked migration SQL for the default `adcp_replay_cache` table. Use
+ * when callers don't need a custom table name. Mirrors the convention of
+ * `MCP_TASKS_MIGRATION` (`postgres-task-store.ts`) and `ADCP_STATE_MIGRATION`
+ * (`postgres-state-store.ts`).
+ */
+exports.REPLAY_CACHE_MIGRATION = renderReplayStoreMigration(DEFAULT_TABLE);
+/**
+ * Generate the SQL DDL for the replay-cache table. Idempotent — safe to
+ * run on existing tables. Run once at server startup, before constructing
+ * `PostgresReplayStore`.
+ *
+ * Schema:
+ * - `(keyid, scope, nonce)` is the primary key, so concurrent inserts of
+ *   the same tuple serialize against the unique index — the second insert
+ *   silently fails via `ON CONFLICT DO NOTHING`, which the adapter detects
+ *   to return `'replayed'`.
+ * - `expires_at` carries the per-row TTL since Postgres has no native TTL.
+ *   Lookups filter `expires_at > now()`; expired rows are deleted by the
+ *   exported {@link sweepExpiredReplays} helper which callers schedule
+ *   themselves.
+ */
+function getReplayStoreMigration(tableName = DEFAULT_TABLE) {
+    return renderReplayStoreMigration(tableName);
+}
+function renderReplayStoreMigration(tableName) {
+    if (!VALID_IDENTIFIER.test(tableName)) {
+        throw new Error(`Invalid table name: "${tableName}". Must match /^[a-z_][a-z0-9_]*$/.`);
+    }
+    return `
+    CREATE TABLE IF NOT EXISTS ${tableName} (
+      keyid       TEXT NOT NULL,
+      scope       TEXT NOT NULL,
+      nonce       TEXT NOT NULL,
+      expires_at  TIMESTAMPTZ NOT NULL,
+      PRIMARY KEY (keyid, scope, nonce)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_${tableName}_expires_at
+      ON ${tableName}(expires_at);
+
+    CREATE INDEX IF NOT EXISTS idx_${tableName}_keyid_scope_active
+      ON ${tableName}(keyid, scope, expires_at);
+  `;
+}
+class PostgresReplayStore {
+    db;
+    tableName;
+    cap;
+    constructor(db, options = {}) {
+        const tableName = options.tableName ?? DEFAULT_TABLE;
+        if (!VALID_IDENTIFIER.test(tableName)) {
+            throw new Error(`Invalid table name: "${tableName}". Must match /^[a-z_][a-z0-9_]*$/.`);
+        }
+        this.db = db;
+        this.tableName = tableName;
+        this.cap = options.cap ?? DEFAULT_CAP;
+    }
+    async has(keyid, scope, nonce, now) {
+        assertFiniteSeconds('now', now);
+        const result = await this.db.query(`SELECT 1 FROM ${this.tableName}
+       WHERE keyid = $1 AND scope = $2 AND nonce = $3 AND expires_at > to_timestamp($4)
+       LIMIT 1`, [keyid, scope, nonce, now]);
+        return (result.rowCount ?? 0) > 0;
+    }
+    async isCapHit(keyid, scope, now) {
+        assertFiniteSeconds('now', now);
+        const result = await this.db.query(`SELECT count(*)::bigint AS active FROM ${this.tableName}
+       WHERE keyid = $1 AND scope = $2 AND expires_at > to_timestamp($3)`, [keyid, scope, now]);
+        const row = result.rows[0];
+        if (!row)
+            return false;
+        // count(*)::bigint returns string in node-postgres by default; coerce.
+        const active = typeof row.active === 'string' ? Number(row.active) : row.active;
+        return active >= this.cap;
+    }
+    /**
+     * Atomically check replay → cap → insert in a single MVCC-snapshotted
+     * statement. Result precedence matches `InMemoryReplayStore`: replay
+     * wins over rate_abuse wins over ok.
+     *
+     * Recycles expired rows in place via `ON CONFLICT DO UPDATE WHERE
+     * existing-is-expired`. Without that, a same-nonce insert *after* the
+     * previous registration's TTL elapsed (but before the sweeper ran)
+     * would falsely report `'replayed'` — the sync `InMemoryReplayStore`
+     * prunes expired entries before the existence check, so we have to
+     * achieve the same semantics here without a separate prune step.
+     *
+     * The `RETURNING 1` is empty when (a) the cap blocked the insert
+     * (`WHERE` clause filtered the conditional INSERT to zero rows) or
+     * (b) the concurrent-same-nonce race lost — another transaction
+     * inserted the same `(keyid, scope, nonce)` between this statement's
+     * snapshot and our `ON CONFLICT`. Both branches are handled by the
+     * outer `CASE`.
+     */
+    async insert(keyid, scope, nonce, ttlSeconds, now) {
+        assertFiniteSeconds('now', now);
+        assertFiniteSeconds('ttlSeconds', ttlSeconds);
+        const expiresAt = now + ttlSeconds;
+        const result = await this.db.query(`WITH
+        existing AS (
+          SELECT 1 FROM ${this.tableName}
+          WHERE keyid = $1 AND scope = $2 AND nonce = $3 AND expires_at > to_timestamp($4)
+        ),
+        active AS (
+          SELECT count(*)::bigint AS n FROM ${this.tableName}
+          WHERE keyid = $1 AND scope = $2 AND expires_at > to_timestamp($4)
+        ),
+        upsert AS (
+          INSERT INTO ${this.tableName} (keyid, scope, nonce, expires_at)
+          SELECT $1, $2, $3, to_timestamp($5)
+          WHERE NOT EXISTS (SELECT 1 FROM existing)
+            AND (SELECT n FROM active) < $6::bigint
+          ON CONFLICT (keyid, scope, nonce) DO UPDATE
+            SET expires_at = EXCLUDED.expires_at
+            WHERE ${this.tableName}.expires_at <= to_timestamp($4)
+          RETURNING 1
+        )
+      SELECT
+        CASE
+          WHEN EXISTS (SELECT 1 FROM existing) THEN 'replayed'
+          WHEN (SELECT n FROM active) >= $6::bigint THEN 'rate_abuse'
+          WHEN EXISTS (SELECT 1 FROM upsert) THEN 'ok'
+          ELSE 'replayed'
+        END AS result`, [keyid, scope, nonce, now, expiresAt, this.cap]);
+        const row = result.rows[0];
+        if (!row) {
+            throw new Error('PostgresReplayStore.insert: query returned no rows');
+        }
+        return row.result;
+    }
+}
+exports.PostgresReplayStore = PostgresReplayStore;
+/**
+ * Delete expired rows from the replay-cache table. Postgres has no native
+ * TTL; callers schedule this helper themselves (cron, an app-side timer,
+ * a `pg_cron` job, etc.).
+ *
+ * Returns the count of rows deleted, so callers can tune sweep frequency
+ * against observed accumulation. A typical schedule is once per minute
+ * for moderate-traffic verifiers; a hot-path verifier signing thousands
+ * per second may want every 10–15 seconds.
+ *
+ * @example
+ * ```typescript
+ * setInterval(async () => {
+ *   const { deleted } = await sweepExpiredReplays(pool);
+ *   if (deleted > 0) metrics.replayCacheSweep(deleted);
+ * }, 60_000);
+ * ```
+ */
+async function sweepExpiredReplays(db, options = {}) {
+    const tableName = options.tableName ?? DEFAULT_TABLE;
+    if (!VALID_IDENTIFIER.test(tableName)) {
+        throw new Error(`Invalid table name: "${tableName}". Must match /^[a-z_][a-z0-9_]*$/.`);
+    }
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const batchSize = options.batchSize;
+    if (batchSize === undefined) {
+        const result = await db.query(`DELETE FROM ${tableName} WHERE expires_at <= to_timestamp($1)`, [now]);
+        return { deleted: result.rowCount ?? 0 };
+    }
+    // Bounded sweep — use a CTE to delete only `batchSize` rows. Useful when
+    // the table has accumulated a long tail and a single DELETE would
+    // hold a long table lock.
+    const result = await db.query(`WITH expired AS (
+      SELECT keyid, scope, nonce
+      FROM ${tableName}
+      WHERE expires_at <= to_timestamp($1)
+      LIMIT $2
+    )
+    DELETE FROM ${tableName}
+    USING expired
+    WHERE ${tableName}.keyid = expired.keyid
+      AND ${tableName}.scope = expired.scope
+      AND ${tableName}.nonce = expired.nonce`, [now, batchSize]);
+    return { deleted: result.rowCount ?? 0 };
+}
+//# sourceMappingURL=postgres-replay-store.js.map

package/dist/lib/signing/postgres-replay-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-replay-store.js","sourceRoot":"","sources":["../../../src/lib/signing/postgres-replay-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAgEH,0DAEC;AAgKD,kDAiCC;AA9PD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAa,EAAE,KAAa;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,mDAAmD,KAAK,EAAE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAmBD;;;;;GAKG;AACU,QAAA,sBAAsB,GAAW,0BAA0B,CAAC,aAAa,CAAC,CAAC;AAExF;;;;;;;;;;;;;;GAcG;AACH,SAAgB,uBAAuB,CAAC,YAAoB,aAAa;IACvE,OAAO,0BAA0B,CAAC,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAiB;IACnD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO;iCACwB,SAAS;;;;;;;;qCAQL,SAAS;WACnC,SAAS;;qCAEiB,SAAS;WACnC,SAAS;GACjB,CAAC;AACJ,CAAC;AAED,MAAa,mBAAmB;IACb,EAAE,CAAc;IAChB,SAAS,CAAS;IAClB,GAAG,CAAS;IAE7B,YAAY,EAAe,EAAE,UAAsC,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,qCAAqC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,KAAa,EAAE,GAAW;QAChE,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC,iBAAiB,IAAI,CAAC,SAAS;;eAEtB,EACT,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAC3B,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,KAAa,EAAE,GAAW;QACtD,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC,0CAA0C,IAAI,CAAC,SAAS;yEACW,EACnE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CACpB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA4C,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,uEAAuE;QACvE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAChF,OAAO,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,MAAM,CACV,KAAa,EACb,KAAa,EACb,KAAa,EACb,UAAkB,EAClB,GAAW;QAEX,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChC,mBAAmB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC;;0BAEoB,IAAI,CAAC,SAAS;;;;8CAIM,IAAI,CAAC,SAAS;;;;wBAIpC,IAAI,CAAC,SAAS;;;;;;oBAMlB,IAAI,CAAC,SAAS;;;;;;;;;sBASZ,EAChB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA+C,CAAC;QACzE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;CACF;AAxGD,kDAwGC;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,mBAAmB,CACvC,EAAe,EACf,UAAsC,EAAE;IAExC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IACrD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAEpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,SAAS,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,yEAAyE;IACzE,kEAAkE;IAClE,0BAA0B;IAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;;aAES,SAAS;;;;kBAIJ,SAAS;;YAEf,SAAS;YACT,SAAS;YACT,SAAS,wBAAwB,EACzC,CAAC,GAAG,EAAE,SAAS,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC"}