@agentlogin/issuer 0.0.0-stage → 0.2.0-beta.2

package/dist/agents.js

@@ -0,0 +1,257 @@
+// Section 7: Agent Keys, enrollment, revocation, Accounts and management operations.
+import { calculateJwkThumbprint, compactVerify, decodeProtectedHeader, importJWK } from 'jose';
+import { ENROLLMENT_TYP } from './constants.js';
+import { OAuthError } from './errors.js';
+import { isAssertionWindowError, isKeyActivationConflictError } from './store.js';
+import { isPlainObject, parseBearer, randomId, randomSecret, sha256, typMatches } from './util.js';
+const B64U_32 = /^[A-Za-z0-9_-]{43}$/; // 32 octets
+/** The P-256 field prime; a coordinate encoding is canonical only when its value is below it. */
+const P256_PRIME = BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff');
+const coordinateValue = (b64u) => BigInt(`0x${Buffer.from(b64u, 'base64url').toString('hex')}`);
+/**
+ * 43 base64url characters carry 258 bits, so the last character has two unused bits and every 32-octet value has four
+ * spellings. Only the one a conforming encoder produces is accepted; the key identifier (a thumbprint over these
+ * strings) then names the decoded point, which is what Section 7.2 compares.
+ */
+const canonicalB64u = (s) => Buffer.from(s, 'base64url').toString('base64url') === s;
+/** Section 7.2: strict public-key validation. */
+export async function validateP256Jwk(jwk) {
+    const bad = (d) => new OAuthError(400, 'invalid_request', `jwk: ${d}`);
+    if (!isPlainObject(jwk))
+        throw bad('object required');
+    const keys = Object.keys(jwk).sort();
+    if (keys.join(',') !== 'crv,kty,x,y')
+        throw bad('exactly kty, crv, x, y are permitted');
+    if (jwk.kty !== 'EC' || jwk.crv !== 'P-256')
+        throw bad('only EC P-256 is supported');
+    if (typeof jwk.x !== 'string' || typeof jwk.y !== 'string' || !B64U_32.test(jwk.x) || !B64U_32.test(jwk.y))
+        throw bad('coordinates must be 32 octets base64url');
+    if (Buffer.from(jwk.x, 'base64url').length !== 32 || Buffer.from(jwk.y, 'base64url').length !== 32)
+        throw bad('coordinates must decode to exactly 32 octets');
+    if (!canonicalB64u(jwk.x) || !canonicalB64u(jwk.y))
+        throw bad('coordinates must be canonical base64url');
+    if (coordinateValue(jwk.x) >= P256_PRIME || coordinateValue(jwk.y) >= P256_PRIME)
+        throw bad('coordinates must be less than the field prime');
+    try {
+        // Web Cryptography rejects points that are not on the curve.
+        await crypto.subtle.importKey('jwk', { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y }, { name: 'ECDSA', namedCurve: 'P-256' }, true, ['verify']);
+    }
+    catch {
+        throw bad('point is not on the curve');
+    }
+    return { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y };
+}
+/** Section 7.2: a `pending` key not proved within T_ASSERT is deleted. Applied wherever a key is read, so it is never seen again. */
+async function dropIfUnproved(ctx, key, authorization) {
+    if (key?.status === 'pending') {
+        const now = await ctx.store.currentTime(ctx.now());
+        if (!key.challenge || now >= key.challenge.expiresAt) {
+            // The pending read may predate a successful proof. Cleanup must still find an expired pending challenge,
+            // and the reread may return this enrollment's activation, but must not retarget a management request
+            // to a replacement enrollment created while cleanup was delayed.
+            await ctx.store.deleteKey(key.kid, key.enrollment, now);
+            const current = authorization
+                ? (await ctx.store.readManagementKeys(key.handle, authorization, key.kid))?.[0]
+                : await ctx.store.getKey(key.kid, key.handle);
+            return current?.enrollment === key.enrollment && current.agentSub === key.agentSub ? current : undefined;
+        }
+    }
+    return key;
+}
+export const getLiveKey = async (ctx, kid, handle, authorization) => dropIfUnproved(ctx, authorization ? (await ctx.store.readManagementKeys(handle, authorization, kid))?.[0] : await ctx.store.getKey(kid, handle), authorization);
+export async function listLiveKeys(ctx, handle, authorization) {
+    const keys = [];
+    const records = authorization ? await ctx.store.readManagementKeys(handle, authorization) : await ctx.store.listKeys(handle);
+    if (!records)
+        throw new OAuthError(404, 'not_found');
+    for (const k of records) {
+        const live = await dropIfUnproved(ctx, k, authorization);
+        if (live)
+            keys.push(live);
+    }
+    return keys;
+}
+/** Section 7.1: a key whose `expires_at` has passed is not `active`. */
+const isActive = (ctx, k) => k.status === 'active' && ctx.now() < k.expiresAt;
+export function keyRecord(ctx, k) {
+    const status = k.status !== 'revoked' && ctx.now() >= k.expiresAt ? 'expired' : k.status;
+    return { kid: k.kid, status, jwk: k.jwk, permissions: k.permissions, name: k.name, created_at: k.createdAt, expires_at: k.expiresAt };
+}
+/** Section 7.2: create a pending key. */
+export async function enrollKey(ctx, handle, body, authorization, enrollmentId = randomId(), challengeExpiresAt) {
+    if (!isPlainObject(body))
+        throw new OAuthError(400, 'invalid_request', 'body must be an object');
+    if (!/^[A-Za-z0-9_-]{16,128}$/.test(enrollmentId))
+        throw new OAuthError(400, 'invalid_request', 'invalid internal enrollment identifier');
+    const jwk = await validateP256Jwk(body.jwk);
+    // The thumbprint is taken over canonical coordinates, so equal identifiers mean equal decoded points (Section 7.2).
+    const kid = await calculateJwkThumbprint(jwk, 'sha256');
+    const now = await ctx.store.currentTime(ctx.now());
+    // Hosted approval retries may reuse an internal enrollment ID only within its original proof window.
+    // Carry that fixed deadline into the atomic store insertion; a retry must not renew it.
+    const challengeDeadline = challengeExpiresAt ?? now + ctx.constants.T_ASSERT;
+    if (!Number.isSafeInteger(challengeDeadline) || challengeDeadline <= now || challengeDeadline > now + ctx.constants.T_ASSERT)
+        throw new OAuthError(400, 'invalid_request', 'invalid enrollment challenge deadline');
+    let expiresAt = now + ctx.constants.T_KEY;
+    if (body.expires_at !== undefined) {
+        if (typeof body.expires_at !== 'number' || !Number.isInteger(body.expires_at) || body.expires_at <= now)
+            throw new OAuthError(400, 'invalid_request', 'expires_at');
+        expiresAt = Math.min(body.expires_at, now + ctx.constants.T_KEY_MAX);
+    }
+    const challenge = randomSecret();
+    const key = {
+        kid,
+        handle,
+        agentSub: authorization.agentSub,
+        enrollment: enrollmentId, // credentials bind to this enrollment; an earlier, expired one of the same key stays dead
+        status: 'pending',
+        jwk,
+        permissions: { share_owner: false },
+        name: typeof body.name === 'string' ? body.name.slice(0, 200) : undefined,
+        createdAt: now,
+        expiresAt,
+        challenge: { value: challenge, expiresAt: challengeDeadline },
+    };
+    // One atomic operation with its preconditions: not revoked for this handle, not enrolled now (Section 7.2).
+    const inserted = await ctx.store.insertKey(key, now, authorization);
+    if (inserted === 'unauthorized')
+        throw new OAuthError(404, 'not_found', 'the Agent or credential changed during enrollment');
+    if (inserted === 'revoked')
+        throw new OAuthError(400, 'invalid_request', 'this public key was revoked for this handle');
+    if (inserted === 'other_handle')
+        throw new OAuthError(400, 'invalid_request', 'public key is enrolled for another handle');
+    if (inserted === 'enrolled')
+        throw new OAuthError(400, 'invalid_request', 'key already enrolled');
+    return { enrollmentId, record: keyRecord(ctx, key), challenge, proof_url: `${ctx.issuer}/agents/${encodeURIComponent(handle)}/keys/${encodeURIComponent(kid)}/proof` };
+}
+/** Section 7.2: verify the enrollment proof and activate the key. */
+export async function proveKey(ctx, handle, kid, body) {
+    const key = await getLiveKey(ctx, kid, handle);
+    const now = await ctx.store.currentTime(ctx.now());
+    // Section 6.7: `unknown_key` (401) when `kid` names no enrolled key of the handle; a pending key that timed out is gone (Section 7.2).
+    if (!key || key.handle !== handle)
+        throw new OAuthError(401, 'unknown_key');
+    // Section 7.4 table: proofs with a revoked or expired key are refused with `key_revoked`.
+    if (key.status === 'revoked' || key.status === 'expired' || now >= key.expiresAt)
+        throw new OAuthError(401, 'key_revoked');
+    if (!isPlainObject(body) || typeof body.proof !== 'string')
+        throw new OAuthError(400, 'invalid_request', 'proof required');
+    // An active key has no unconsumed challenge left, so no proof can satisfy the `nonce` rule of Section 7.2.
+    if (key.status !== 'pending' || !key.challenge)
+        throw new OAuthError(400, 'invalid_assertion', 'the key has no unconsumed challenge');
+    const jws = body.proof;
+    const bad = (d) => new OAuthError(400, 'invalid_assertion', d);
+    if (Buffer.byteLength(jws) > ctx.constants.N_ASSERTION)
+        throw bad('proof too large');
+    let header;
+    try {
+        header = decodeProtectedHeader(jws);
+    }
+    catch {
+        throw bad('malformed JWS');
+    }
+    if (header.alg !== 'ES256')
+        throw bad('alg');
+    if (!typMatches(header.typ, ENROLLMENT_TYP))
+        throw bad('typ');
+    if (header.kid !== kid)
+        throw bad('kid');
+    for (const f of ['jwk', 'jku', 'x5u', 'x5c', 'crit'])
+        if (header[f] !== undefined)
+            throw bad(`header ${f} not permitted`);
+    let payload;
+    try {
+        const r = await compactVerify(jws, await importJWK(key.jwk, 'ES256'), { algorithms: ['ES256'] });
+        payload = JSON.parse(Buffer.from(r.payload).toString('utf8'));
+        if (!isPlainObject(payload))
+            throw new Error();
+    }
+    catch {
+        throw new OAuthError(401, 'invalid_signature');
+    }
+    if (payload.iss !== handle || payload.sub !== handle)
+        throw bad('iss and sub must be the handle');
+    if (payload.aud !== ctx.issuer)
+        throw bad('aud');
+    if (payload.nonce !== key.challenge.value)
+        throw bad('nonce');
+    const { iat, exp } = payload;
+    const verifiedAt = await ctx.store.currentTime(ctx.now());
+    if (typeof iat !== 'number' || typeof exp !== 'number')
+        throw bad('iat and exp required');
+    if (exp > iat + ctx.constants.T_ASSERT || verifiedAt >= exp || iat < verifiedAt - ctx.constants.T_ASSERT || iat > verifiedAt + ctx.constants.T_SKEW)
+        throw bad('iat/exp window');
+    if (typeof payload.jti !== 'string')
+        throw bad('jti required');
+    // Activation is one conditional write: it succeeds only if this enrollment is still pending with this challenge.
+    // A revocation that completed while the signature was being verified therefore wins (Section 7.3).
+    let activated;
+    try {
+        activated = await ctx.store.activateKey(kid, key.enrollment, key.challenge.value, verifiedAt, { notBefore: iat - ctx.constants.T_SKEW, expiresAt: exp });
+    }
+    catch (error) {
+        if (isKeyActivationConflictError(error))
+            throw new OAuthError(400, 'invalid_request', 'public key is active for another Agent');
+        if (isAssertionWindowError(error))
+            throw bad('proof expired while awaiting activation');
+        throw error;
+    }
+    if (!activated) {
+        // A replacement enrollment cannot hide the expiry of the proof's original enrollment.
+        if ((await ctx.store.currentTime(ctx.now())) >= key.expiresAt)
+            throw new OAuthError(401, 'key_revoked');
+        const current = await ctx.store.getKey(kid, handle);
+        if (current && (current.status === 'revoked' || current.status === 'expired' || (await ctx.store.currentTime(ctx.now())) >= current.expiresAt))
+            throw new OAuthError(401, 'key_revoked');
+        throw new OAuthError(current && current.handle === handle ? 400 : 401, current && current.handle === handle ? 'invalid_assertion' : 'unknown_key', 'the key has no unconsumed challenge');
+    }
+    return keyRecord(ctx, { ...key, status: 'active', challenge: undefined });
+}
+/** Section 7.3: revocation and all its effects are one enrollment-conditional store transaction. */
+export async function revokeKeyEffects(ctx, key, authorization) {
+    const revoked = await ctx.store.revokeKey(key.kid, key.enrollment, ctx.now(), authorization);
+    if (!revoked)
+        throw new OAuthError(404, 'not_found');
+}
+/** Section 7.3: a stale bulk request can affect only the immutable Agent identity it authorized. */
+export async function revokeAllKeys(ctx, handle, cred) {
+    if (!(await ctx.store.revokeAllKeys(handle, cred, ctx.now())))
+        throw new OAuthError(404, 'not_found');
+}
+/** Section 7.4: status, invalidation fence and dependent records change in one store transaction. */
+export async function setAccountStatus(ctx, handle, clientId, status, authorization) {
+    const account = await ctx.store.setAccountStatus(handle, clientId, status, authorization, ctx.now());
+    if (!account)
+        throw new OAuthError(404, 'not_found', 'no account for this client');
+    return accountRecord(account);
+}
+export async function setAgentEnabled(ctx, agent, enabled) {
+    return ctx.store.setAgentEnabled(agent.handle, enabled, agent.sub, ctx.now());
+}
+/** Deletion and the removal of dependent records are atomic; a replacement cannot be swept by stale cleanup. */
+export async function deleteAgent(ctx, agent) {
+    if (!(await ctx.store.deleteAgent(agent.handle, agent.sub, ctx.now())))
+        throw new OAuthError(404, 'not_found');
+}
+/**
+ * Sections 6.6 and 7.8: only an Owner Credential from a session that authenticated the Owner by `passkey`, `oidc`,
+ * `domain`, or `email` plus a factor the Agent cannot read approves a transaction or grants `share_owner`. An allow-list:
+ * a credential whose session is not recorded, or was established by a one-time code or link alone, does not qualify.
+ */
+export const approvalSession = (cred) => cred.kind === 'owner' && (cred.sessionAuth === 'passkey' || cred.sessionAuth === 'oidc' || cred.sessionAuth === 'domain' || cred.sessionAuth === 'email_factor');
+export function accountRecord(a) {
+    return { client_id: a.clientId, status: a.status, first_signed_in_at: a.firstSignedInAt, last_signed_in_at: a.lastSignedInAt, sign_in_count: a.signInCount };
+}
+/** Section 7.8: resolves the credential and checks that the handle belongs to its Owner. */
+export async function authorizeManagement(ctx, authorization, handle, delegable) {
+    const bearer = parseBearer(authorization);
+    const cred = bearer ? await ctx.store.resolveManagement(sha256(bearer), handle) : 'invalid_token';
+    if (cred === 'invalid_token')
+        throw new OAuthError(401, 'invalid_token', undefined, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+    if (cred === 'not_found')
+        throw new OAuthError(404, 'not_found');
+    if (cred.kind === 'delegated' && !delegable)
+        throw new OAuthError(403, 'insufficient_permission', undefined, { 'WWW-Authenticate': 'Bearer error="insufficient_scope"' });
+    return cred;
+}
+//# sourceMappingURL=agents.js.map

package/dist/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAA0F,MAAM,YAAY,CAAC;AAC1K,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnG,MAAM,OAAO,GAAG,qBAAqB,CAAC,CAAC,YAAY;AACnD,iGAAiG;AACjG,MAAM,UAAU,GAAG,MAAM,CAAC,oEAAoE,CAAC,CAAC;AAChG,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAChH;;;;GAIG;AACH,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAEtG,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAY;IAChD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,aAAa;QAAE,MAAM,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACrF,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,MAAM,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACjK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC9J,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,MAAM,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACzG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU;QAAE,MAAM,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7I,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,qIAAqI;AACrI,KAAK,UAAU,cAAc,CAAC,GAAkB,EAAE,GAAyB,EAAE,aAAuC;IAClH,IAAI,GAAG,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACrD,yGAAyG;YACzG,qGAAqG;YACrG,iEAAiE;YACjE,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,aAAa;gBAC3B,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/E,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,OAAO,EAAE,UAAU,KAAK,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,MAAc,EAAE,aAAuC,EAAiC,EAAE,CAC1J,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;AAClK,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,MAAc,EAAE,aAAuC;IAC5G,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7H,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;QACzD,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,wEAAwE;AACxE,MAAM,QAAQ,GAAG,CAAC,GAAkB,EAAE,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;AAEhH,MAAM,UAAU,SAAS,CAAC,GAAkB,EAAE,CAAW;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;AACxI,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAkB,EAAE,MAAc,EAAE,IAAa,EAAE,aAAsC,EAAE,YAAY,GAAG,QAAQ,EAAE,EAAE,kBAA2B;IAC/K,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;IAC1I,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,oHAAoH;IACpH,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,qGAAqG;IACrG,wFAAwF;IACxF,MAAM,iBAAiB,GAAG,kBAAkB,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,IAAI,GAAG,IAAI,iBAAiB,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ;QAC1H,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IACxF,IAAI,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,GAAG;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;QACpK,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAa;QACpB,GAAG;QACH,MAAM;QACN,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,UAAU,EAAE,YAAY,EAAE,0FAA0F;QACpH,MAAM,EAAE,SAAS;QACjB,GAAG;QACH,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;QACnC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,SAAS,EAAE,GAAG;QACd,SAAS;QACT,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE;KAC9D,CAAC;IACF,4GAA4G;IAC5G,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,cAAc;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,mDAAmD,CAAC,CAAC;IAC7H,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IACxH,IAAI,QAAQ,KAAK,cAAc;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;IAC3H,IAAI,QAAQ,KAAK,UAAU;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IAClG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,WAAW,kBAAkB,CAAC,MAAM,CAAC,SAAS,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AACzK,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,MAAc,EAAE,GAAW,EAAE,IAAa;IAC3F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,uIAAuI;IACvI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5E,0FAA0F;IAC1F,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC3H,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC3H,2GAA2G;IAC3G,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;IACtI,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,WAAW;QAAE,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU;QAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACnI,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM;QAAE,MAAM,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC1F,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,UAAU,IAAI,GAAG,IAAI,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjL,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/D,iHAAiH;IACjH,mGAAmG;IACnG,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3J,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;QAChI,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACxF,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,sFAAsF;QACtF,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACzL,MAAM,IAAI,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,EAAE,qCAAqC,CAAC,CAAC;IAC5L,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,GAAyC,EAAE,aAAsC;IAC1I,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IAC7F,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,MAAc,EAAE,IAA6B;IACnG,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACxG,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,MAA8B,EAAE,aAAsC;IACjK,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC;IACnF,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAkB,EAAE,KAAY,EAAE,OAAgB;IACtF,OAAO,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAkB,EAAE,KAAY;IAChE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAgB,EAAW,EAAE,CAC3D,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC;AAEnK,MAAM,UAAU,aAAa,CAAC,CAA6G;IACzI,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/J,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAkB,EAAE,aAAiC,EAAE,MAAc,EAAE,SAAkB;IACjI,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAClG,IAAI,IAAI,KAAK,eAAe;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC5I,IAAI,IAAI,KAAK,WAAW;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAC1K,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from 'hono';
+import type { IssuerContext } from './context.js';
+export declare function createIssuerApp(ctx: IssuerContext): Hono;