@andrewheberle/serverless-ssh-ca 0.23.0 → 0.24.0

package/dist/utils.d.ts

@@ -12,6 +12,38 @@ type AccessToken = {
     email: string;
     sub: string;
 };
+/**
+ * Thrown when a claim of a verified token is missing or is not of the
+ * expected type.
+ */
+export declare class TokenClaimError extends Error {
+    constructor(message: string);
+}
+/**
+ * Returns the subject of a verified token, which is compared between the
+ * access and identity tokens so must always be present.
+ *
+ * @param payload The payload of a verified token
+ * @returns The `sub` claim of the token
+ * @throws {@link TokenClaimError} when the `sub` claim is missing, empty or not a string
+ */
+export declare const tokenSubject: (payload: {
+    sub?: unknown;
+}) => string;
+/**
+ * Returns the email address of a verified access token, or why it cannot be
+ * used.
+ *
+ * @param payload The payload of a verified access token
+ * @returns The email address, or an error message if the claims are not acceptable
+ */
+export declare const tokenEmail: (payload: Record<string, unknown>) => {
+    ok: true;
+    email: string;
+} | {
+    ok: false;
+    error: string;
+};
 export declare const transformAuthorizationHeader: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => Promise<AccessToken | never>;
 /**
  * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
@@ -20,6 +52,22 @@ export declare const transformAuthorizationHeader: (env: SshCaBindings, val: str
  * @param ctx The Zod context for any errors
  */
 export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => PublicKey | never;
+/**
+ * Returns why a public key cannot be issued a certificate, or undefined if it
+ * can be.
+ *
+ * RSA keys must be at least {@link MinimumRsaKeyBits} bits, as smaller keys
+ * can be factored and are refused by current OpenSSH releases.
+ *
+ * @param key The public key a certificate would be issued for
+ * @returns The reason the key cannot be used, or undefined if it can be
+ */
+export declare const subjectKeyIssue: (key: PublicKey) => string | undefined;
+/**
+ * Refines a public key so only one allowed by {@link subjectKeyIssue} is
+ * accepted for a certificate request.
+ */
+export declare const refineSubjectKey: (val: PublicKey, ctx: z.RefinementCtx) => void;
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -59,13 +107,32 @@ type ParsedHostCertificateRequest = {
     proof: ProofOfPossession;
 } & HostCertificateRequest;
 export declare const refineHostCertificateRequest: (env: SshCaBindings, val: ParsedHostCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
+/**
+ * Returns why a principal cannot be included on a host certificate, or
+ * undefined if it can be.
+ *
+ * OpenSSH matches the principals of a host certificate as patterns, so a
+ * principal such as `*` would make the certificate valid for every host that
+ * trusts the CA. Principals are otherwise not restricted, as hosts may be
+ * reached by IP address, bare host name or fully qualified domain name.
+ *
+ * @param principal The principal to check
+ * @returns The reason the principal cannot be used, or undefined if it can be
+ */
+export declare const hostPrincipalIssue: (principal: string) => string | undefined;
+/**
+ * Refines a host certificate principal so only one allowed by
+ * {@link hostPrincipalIssue} is accepted.
+ */
+export declare const refineHostPrincipal: (val: string, ctx: z.RefinementCtx) => void;
 type ParsedHostCertificateRenewal = {
     certificate: SshCertificate;
     proof: RenewalProofOfPossession;
 } & HostCertificateRequest;
 /**
  * Checks a certificate presented for renewal was issued by this CA, is a host
- * certificate, is within its validity period and has not been revoked.
+ * certificate whose principals are allowed (see {@link hostPrincipalIssue}),
+ * is within its validity period and has not been revoked.
  *
  * @param env The CA bindings
  * @param isRevoked Returns whether a serial has been revoked

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAkC,SAAS,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/G,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8B1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAqD,SAAS,EAAc,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAOzD,CAAA;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAerH,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAsDrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,QAAS,SAAS,KAAG,MAAM,GAAG,SAOzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAS,SAAS,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAkBjI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAQD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,cAAe,MAAM,KAAG,MAAM,GAAG,SAc/D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8C1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}

package/dist/utils.js

@@ -1,8 +1,8 @@
 import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors";
 import { CertificateParseError, SshCertificate } from "./ssh/certificate.js";
-import { KeyParseError, parsePrivateKey, PublicKey, UnsupportedKeyError } from "./ssh/keys.js";
+import { KeyParseError, MinimumRsaKeyBits, parsePrivateKey, PublicKey, rsaKeyBits, UnsupportedKeyError } from "./ssh/keys.js";
 import z from "zod";
-import { verifyJWT } from "./verify.js";
+import { MissingAudienceError, verifyJWT } from "./verify.js";
 import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js";
 import { logger } from "./logger.js";
 import { ms } from "itty-time";
@@ -42,6 +42,64 @@ export const transformProofOfPossession = (env, val, ctx) => {
         return z.NEVER;
     }
 };
+/**
+ * Thrown when a claim of a verified token is missing or is not of the
+ * expected type.
+ */
+export class TokenClaimError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "TokenClaimError";
+        Object.setPrototypeOf(this, TokenClaimError.prototype);
+    }
+}
+const SubjectClaimSchema = z.string().min(1);
+/**
+ * Returns the subject of a verified token, which is compared between the
+ * access and identity tokens so must always be present.
+ *
+ * @param payload The payload of a verified token
+ * @returns The `sub` claim of the token
+ * @throws {@link TokenClaimError} when the `sub` claim is missing, empty or not a string
+ */
+export const tokenSubject = (payload) => {
+    const parsed = SubjectClaimSchema.safeParse(payload.sub);
+    if (!parsed.success) {
+        throw new TokenClaimError("JWT was verified but was missing required sub claim");
+    }
+    return parsed.data;
+};
+/**
+ * The claims of an access token that identify the user's email address.
+ *
+ * `email_verified` is optional as not every IdP includes it, but when it is
+ * included it must be true, as an IdP may otherwise issue a token for an
+ * address the user has not shown they control.
+ */
+const EmailClaimsSchema = z.object({
+    email: z.email(),
+    email_verified: z.boolean().optional(),
+});
+/**
+ * Returns the email address of a verified access token, or why it cannot be
+ * used.
+ *
+ * @param payload The payload of a verified access token
+ * @returns The email address, or an error message if the claims are not acceptable
+ */
+export const tokenEmail = (payload) => {
+    if (payload.email === undefined) {
+        return { ok: false, error: "JWT was verified but was missing required email claim" };
+    }
+    const parsed = EmailClaimsSchema.safeParse(payload);
+    if (!parsed.success) {
+        return { ok: false, error: "JWT was verified but the email or email_verified claim was not valid" };
+    }
+    if (parsed.data.email_verified === false) {
+        return { ok: false, error: "JWT was verified but the email address has not been verified by the IdP" };
+    }
+    return { ok: true, email: parsed.data.email };
+};
 export const transformAuthorizationHeader = async (env, val, ctx) => {
     if (!val.startsWith("Bearer ") || val.length <= 7) {
         return fatalIssue(ctx, "authorization header must be a Bearer token", val);
@@ -52,18 +110,27 @@ export const transformAuthorizationHeader = async (env, val, ctx) => {
         return fatalIssue(ctx, "request did not contain a JWT", val);
     }
     try {
-        // verify jwt
-        const { payload } = await verifyJWT(env, jwt);
-        if (payload.email === undefined) {
-            return fatalIssue(ctx, "JWT was verified but was missing required email claim", val);
+        // verify jwt, which must be issued for this CA
+        const aud = split(env.JWT_ACCESS_TOKEN_AUD).length > 0 ? env.JWT_ACCESS_TOKEN_AUD : env.JWT_AUD;
+        const { payload } = await verifyJWT(env, jwt, aud);
+        const email = tokenEmail(payload);
+        if (!email.ok) {
+            l.warn(email.error, "in", "transformAuthorizationHeader");
+            return fatalIssue(ctx, email.error, val);
         }
         return {
-            email: payload.email,
-            sub: payload.sub,
+            email: email.email,
+            sub: tokenSubject(payload),
         };
     }
     catch (err) {
         switch (true) {
+            case (err instanceof MissingAudienceError):
+                // a misconfigured CA is a server error, not a validation failure
+                l.error(err.message, "in", "transformAuthorizationHeader");
+                throw new InternalServerErrorException(err.message);
+            case (err instanceof TokenClaimError):
+                return fatalIssue(ctx, err.message, val);
             case (err instanceof JWSInvalid):
                 return fatalIssue(ctx, "the access token was invalid", val);
             case (err instanceof JWTInvalid):
@@ -124,6 +191,33 @@ export const transformPublicKey = (val, ctx) => {
         return z.NEVER;
     }
 };
+/**
+ * Returns why a public key cannot be issued a certificate, or undefined if it
+ * can be.
+ *
+ * RSA keys must be at least {@link MinimumRsaKeyBits} bits, as smaller keys
+ * can be factored and are refused by current OpenSSH releases.
+ *
+ * @param key The public key a certificate would be issued for
+ * @returns The reason the key cannot be used, or undefined if it can be
+ */
+export const subjectKeyIssue = (key) => {
+    const bits = rsaKeyBits(key);
+    if (bits !== undefined && bits < MinimumRsaKeyBits) {
+        return `RSA keys must be at least ${MinimumRsaKeyBits} bits, not ${bits}`;
+    }
+    return undefined;
+};
+/**
+ * Refines a public key so only one allowed by {@link subjectKeyIssue} is
+ * accepted for a certificate request.
+ */
+export const refineSubjectKey = (val, ctx) => {
+    const issue = subjectKeyIssue(val);
+    if (issue !== undefined) {
+        fatalIssue(ctx, issue, val.toString());
+    }
+};
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -170,11 +264,11 @@ export const parseIdentity = async (env, jwt, claim) => {
     if (jwt === undefined) {
         throw new Error("missing identity token");
     }
-    const aud = split(env.JWT_AUD);
-    const { payload } = await verifyJWT(env, jwt, { aud: aud.length === 0 ? undefined : aud });
+    const { payload } = await verifyJWT(env, jwt, env.JWT_AUD);
+    const sub = tokenSubject(payload);
     const principals = identityPrincipals(env, payload, claim);
     return {
-        sub: payload.sub,
+        sub: sub,
         principals: principals,
     };
 };
@@ -184,9 +278,14 @@ export const transformIdentityToken = async (env, val, ctx) => {
         return identity;
     }
     catch (err) {
+        // a misconfigured CA is a server error, not a validation failure
+        if (err instanceof MissingAudienceError) {
+            logger(env).error(err.message, "in", "transformIdentityToken");
+            throw new InternalServerErrorException(err.message);
+        }
         ctx.issues.push({
             code: "custom",
-            message: err instanceof PrincipalsClaimError ? err.message : "problem parsing identity token",
+            message: err instanceof PrincipalsClaimError || err instanceof TokenClaimError ? err.message : "problem parsing identity token",
             input: val
         });
         return z.NEVER;
@@ -285,9 +384,49 @@ export const refineHostCertificateRequest = async (env, val, ctx) => {
         return fatalIssue(ctx, "proof of possession verification unhandled error", val);
     }
 };
+// characters that OpenSSH treats as pattern syntax when matching host
+// certificate principals, or that separate entries in a pattern list
+const HostPrincipalPatternChars = /[*?!,]/;
+// whitespace and control characters, which no host name contains
+const HostPrincipalInvalidChars = /[\s\p{Cc}]/u;
+/**
+ * Returns why a principal cannot be included on a host certificate, or
+ * undefined if it can be.
+ *
+ * OpenSSH matches the principals of a host certificate as patterns, so a
+ * principal such as `*` would make the certificate valid for every host that
+ * trusts the CA. Principals are otherwise not restricted, as hosts may be
+ * reached by IP address, bare host name or fully qualified domain name.
+ *
+ * @param principal The principal to check
+ * @returns The reason the principal cannot be used, or undefined if it can be
+ */
+export const hostPrincipalIssue = (principal) => {
+    if (principal === "") {
+        return "host certificate principals must not be empty";
+    }
+    if (HostPrincipalPatternChars.test(principal)) {
+        return `host certificate principal ${JSON.stringify(principal)} must not contain wildcard or pattern characters (*, ?, ! or ,)`;
+    }
+    if (HostPrincipalInvalidChars.test(principal)) {
+        return `host certificate principal ${JSON.stringify(principal)} must not contain whitespace or control characters`;
+    }
+    return undefined;
+};
+/**
+ * Refines a host certificate principal so only one allowed by
+ * {@link hostPrincipalIssue} is accepted.
+ */
+export const refineHostPrincipal = (val, ctx) => {
+    const issue = hostPrincipalIssue(val);
+    if (issue !== undefined) {
+        fatalIssue(ctx, issue, val);
+    }
+};
 /**
  * Checks a certificate presented for renewal was issued by this CA, is a host
- * certificate, is within its validity period and has not been revoked.
+ * certificate whose principals are allowed (see {@link hostPrincipalIssue}),
+ * is within its validity period and has not been revoked.
  *
  * @param env The CA bindings
  * @param isRevoked Returns whether a serial has been revoked
@@ -306,6 +445,20 @@ export const checkRenewableCertificate = async (env, isRevoked, certificate) =>
     if (certificate.kind !== "host") {
         return "the provided certificate is not a host certificate";
     }
+    // a certificate issued before small RSA keys were refused must not be
+    // renewed, as the renewal would keep its key
+    const keyIssue = subjectKeyIssue(certificate.publicKey);
+    if (keyIssue !== undefined) {
+        return `the provided certificate cannot be renewed: ${keyIssue}`;
+    }
+    // a certificate issued before wildcard principals were refused must not
+    // be renewed, as the renewal would keep its principals
+    for (const principal of certificate.principals) {
+        const issue = hostPrincipalIssue(principal);
+        if (issue !== undefined) {
+            return `the provided certificate cannot be renewed: ${issue}`;
+        }
+    }
     // check certificate is within its validity period, allowing for clock
     // skew at the start as a certificate issued moments ago may have a
     // validity start up to a second in the future

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAA;AAC/G,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9F,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAEvD,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,aAAa;QACb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAE7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;QAED,OAAO;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,8BAA8B,CAAC;gBACnD,OAAO,UAAU,CAAC,GAAG,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;YAC9E;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,GAAG,CAAC,GAAqC,EAAU,EAAE;IACpE,OAAO,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAClG,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAqB,EAAE;IACpH,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,6DAA6D;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,IAAI,oBAAoB,CAAC,OAAO,KAAK,gDAAgD,CAAC,CAAA;IAC7F,CAAC;IAEA,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAEtB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEvE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;YAC7F,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAA0B,EAAE;IAC3H,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,WAA2B,EAA+B,EAAE;IAC9J,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACxF,OAAO,2CAA2C,CAAA;IACnD,CAAC;IAED,0DAA0D;IAC1D,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAoC,EAAE,GAAoB,EAAkB,EAAE;IACjL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAA;YACxD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,2CAA2C,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACtG,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAuB,EAAE;IAC9E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;IAE1C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAsB,EAAE;IAC3F,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC,CAAA"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE7D,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9F,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAEvD,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAE7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAA;IACvD,CAAC;CACD;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAU,EAAE;IAClE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAA;IACjF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgC,EAA8D,EAAE;IAC1H,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sEAAsE,EAAE,CAAA;IACpG,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yEAAyE,EAAE,CAAA;IACvG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,+CAA+C;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;QAC/F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAElD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,OAAO;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC;SAC1B,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,iEAAiE;gBACjE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;gBAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpD,KAAK,CAAC,GAAG,YAAY,eAAe,CAAC;gBACpC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACzC,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,8BAA8B,CAAC;gBACnD,OAAO,UAAU,CAAC,GAAG,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;YAC9E;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,GAAG,CAAC,GAAqC,EAAU,EAAE;IACpE,OAAO,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAClG,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAqB,EAAE;IACpH,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAc,EAAsB,EAAE;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAO,6BAA6B,iBAAiB,cAAc,IAAI,EAAE,CAAA;IAC1E,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAc,EAAE,GAAoB,EAAQ,EAAE;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvC,CAAC;AACF,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,6DAA6D;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,IAAI,oBAAoB,CAAC,OAAO,KAAK,gDAAgD,CAAC,CAAA;IAC7F,CAAC;IAEA,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAEtB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEvE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,GAAG;QACR,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,iEAAiE;QACjE,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAA;YAC9D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;YAC/H,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAA0B,EAAE;IAC3H,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,sEAAsE;AACtE,qEAAqE;AACrE,MAAM,yBAAyB,GAAG,QAAQ,CAAA;AAC1C,iEAAiE;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAsB,EAAE;IAC3E,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,+CAA+C,CAAA;IACvD,CAAC;IAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iEAAiE,CAAA;IAChI,CAAC;IAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oDAAoD,CAAA;IACnH,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,GAAoB,EAAQ,EAAE;IAC9E,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC;AACF,CAAC,CAAA;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,WAA2B,EAA+B,EAAE;IAC9J,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,+CAA+C,QAAQ,EAAE,CAAA;IACjE,CAAC;IAED,wEAAwE;IACxE,uDAAuD;IACvD,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,+CAA+C,KAAK,EAAE,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACxF,OAAO,2CAA2C,CAAA;IACnD,CAAC;IAED,0DAA0D;IAC1D,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAoC,EAAE,GAAoB,EAAkB,EAAE;IACjL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAA;YACxD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,2CAA2C,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACtG,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAuB,EAAE;IAC9E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;IAE1C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAsB,EAAE;IAC3F,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC,CAAA"}

package/dist/verify.d.ts

@@ -1,8 +1,20 @@
 import { CertificateRequestJWTPayload } from "./types.js";
 import type { SshCaBindings } from "./types.js";
-type VerifyOptions = {
-    aud?: string | string[];
-};
-export declare const verifyJWT: (env: SshCaBindings, jwt: string, opts?: VerifyOptions) => Promise<import("jose").JWTVerifyResult<CertificateRequestJWTPayload> & import("jose").ResolvedKey>;
-export {};
+/**
+ * Thrown when no audience is configured for a token, as a token issued for
+ * any client of the IdP would otherwise be accepted.
+ */
+export declare class MissingAudienceError extends Error {
+    constructor(message: string);
+}
+/**
+ * Verifies a JWT from the IdP, including that it was issued for one of the
+ * audiences given.
+ *
+ * @param env The CA bindings
+ * @param jwt The JWT to verify
+ * @param aud The audiences the JWT may be issued for, which must not be empty
+ * @throws {@link MissingAudienceError} when no audience is given
+ */
+export declare const verifyJWT: (env: SshCaBindings, jwt: string, aud: string | string[] | undefined) => Promise<import("jose").JWTVerifyResult<CertificateRequestJWTPayload> & import("jose").ResolvedKey>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG/C,KAAK,aAAa,GAAG;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,OAAO,MAAM,SAAQ,aAAa,uGAenF,CAAA"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG/C;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AA4BD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,OAAO,MAAM,OAAO,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,uGAWlG,CAAA"}

package/dist/verify.js

@@ -1,17 +1,55 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { split } from "./utils.js";
-export const verifyJWT = async (env, jwt, opts = {}) => {
-    const JWKS = createRemoteJWKSet(new URL(env.JWT_JWKS_URL));
-    if (opts.aud !== undefined) {
-        return await jwtVerify(jwt, JWKS, {
-            issuer: env.JWT_ISSUER,
-            algorithms: split(env.JWT_ALGORITHMS),
-            audience: opts.aud
-        });
+/**
+ * Thrown when no audience is configured for a token, as a token issued for
+ * any client of the IdP would otherwise be accepted.
+ */
+export class MissingAudienceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "MissingAudienceError";
+        Object.setPrototypeOf(this, MissingAudienceError.prototype);
     }
-    return await jwtVerify(jwt, JWKS, {
+}
+// the remote JWKS for each URL, kept between requests so the keys that jose
+// caches are reused rather than fetched again for every token
+const remoteJWKSets = new Map();
+/**
+ * Returns the remote JWKS for a URL, creating it on first use.
+ *
+ * jose caches the keys it fetches for up to 10 minutes and fetches them again
+ * sooner when a token is signed with a key it does not have, so keys rotated
+ * by the IdP are still picked up.
+ *
+ * @param url The URL of the JWKS
+ * @returns The remote JWKS for the URL
+ */
+const remoteJWKSet = (url) => {
+    let jwks = remoteJWKSets.get(url);
+    if (jwks === undefined) {
+        jwks = createRemoteJWKSet(new URL(url));
+        remoteJWKSets.set(url, jwks);
+    }
+    return jwks;
+};
+/**
+ * Verifies a JWT from the IdP, including that it was issued for one of the
+ * audiences given.
+ *
+ * @param env The CA bindings
+ * @param jwt The JWT to verify
+ * @param aud The audiences the JWT may be issued for, which must not be empty
+ * @throws {@link MissingAudienceError} when no audience is given
+ */
+export const verifyJWT = async (env, jwt, aud) => {
+    const audience = split(aud);
+    if (audience.length === 0) {
+        throw new MissingAudienceError("no audience is configured for verifying tokens, set JWT_AUD");
+    }
+    return await jwtVerify(jwt, remoteJWKSet(env.JWT_JWKS_URL), {
         issuer: env.JWT_ISSUER,
         algorithms: split(env.JWT_ALGORITHMS),
+        audience: audience,
     });
 };
 //# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAMlC,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,IAAI,GAAkB,EAAE,EAAE,EAAE;IACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAE7D,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;YAC/D,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;YACrC,QAAQ,EAAE,IAAI,CAAC,GAAG;SAClB,CAAC,CAAA;IACH,CAAC;IAEE,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;KACxC,CAAC,CAAA;AACN,CAAC,CAAA"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAElC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAID,4EAA4E;AAC5E,8DAA8D;AAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,CAAC,GAAW,EAAgB,EAAE;IAClD,IAAI,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACvC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAAE,EAAE;IACtG,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,6DAA6D,CAAC,CAAA;IAC9F,CAAC;IAED,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;QACzF,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;QACrC,QAAQ,EAAE,QAAQ;KAClB,CAAC,CAAA;AACH,CAAC,CAAA"}